From 17872018cc037e699b1f6e1589d0ad05e0883cca Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Wed, 15 Jul 2026 17:52:39 +0200
Subject: [PATCH 001/171] feat(nsjail): make python/ansible rlimit_as
 configurable per worker (GIT-921) (#10138)

nsjail caps a jailed job's virtual address space at rlimit_as (4096 MiB for
python3 and ansible). JIT runtimes (Bun/JavaScriptCore, the JVM) reserve large
virtual ranges up front, so a subprocess spawned from a jailed Python/Ansible
job can crash against this cap even when its physical memory use is modest
(e.g. the Bun-compiled claude CLI hitting JSC/pthread allocation failures).

Most other language protos already run with disable_rl: true (unlimited);
python3 and ansible are the outliers with an explicit rlimit_as. This exposes
that cap via a per-language env var (NSJAIL_PY_RLIMIT_AS_MB,
NSJAIL_ANSIBLE_RLIMIT_AS_MB) so operators can raise or lift it on a dedicated
worker pool without a source patch/rebuild and without weakening the
mount/PID/user-namespace isolation that provides the real security boundary.
Only the address-space limit changes; cpu/fsize/nofile rlimits are untouched.

Value is in MiB, or unlimited/none/inf/0 to uncap (rlimit_as_type: INF). Unset
keeps the historical 4096 default.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../nsjail/run.ansible.config.proto           |  2 +-
 .../nsjail/run.python3.config.proto           |  2 +-
 .../windmill-worker/src/ansible_executor.rs   | 11 ++-
 backend/windmill-worker/src/common.rs         | 82 +++++++++++++++++++
 .../windmill-worker/src/python_executor.rs    | 15 ++--
 backend/windmill-worker/src/worker.rs         |  8 ++
 6 files changed, 110 insertions(+), 10 deletions(-)

diff --git a/backend/windmill-worker/nsjail/run.ansible.config.proto b/backend/windmill-worker/nsjail/run.ansible.config.proto
index 2c731e34f9..afaf066f17 100644
--- a/backend/windmill-worker/nsjail/run.ansible.config.proto
+++ b/backend/windmill-worker/nsjail/run.ansible.config.proto
@@ -5,7 +5,7 @@ hostname: "ansible"
 log_level: ERROR
 time_limit: {TIMEOUT}
 
-rlimit_as: 4096
+{RLIMIT_AS}
 rlimit_cpu: 1000
 rlimit_fsize: 1000
 rlimit_nofile: 10000
diff --git a/backend/windmill-worker/nsjail/run.python3.config.proto b/backend/windmill-worker/nsjail/run.python3.config.proto
index 53d5a6c64d..269ae1f0f8 100644
--- a/backend/windmill-worker/nsjail/run.python3.config.proto
+++ b/backend/windmill-worker/nsjail/run.python3.config.proto
@@ -5,7 +5,7 @@ hostname: "python"
 log_level: ERROR
 time_limit: {TIMEOUT}
 
-rlimit_as: 4096
+{RLIMIT_AS}
 rlimit_cpu: 1000
 rlimit_fsize: 1000
 rlimit_nofile: 10000
diff --git a/backend/windmill-worker/src/ansible_executor.rs b/backend/windmill-worker/src/ansible_executor.rs
index 292246c62c..92bffe0cf0 100644
--- a/backend/windmill-worker/src/ansible_executor.rs
+++ b/backend/windmill-worker/src/ansible_executor.rs
@@ -31,13 +31,14 @@ use crate::{
     bash_executor::BIN_BASH,
     common::{
         build_command_with_isolation, check_executor_binary_exists, get_reserved_variables,
-        read_and_check_result, resolve_nsjail_timeout, resolve_nsjail_tmp_mount_block,
-        start_child_process, transform_json, OccupancyMetrics,
+        read_and_check_result, render_nsjail_rlimit_as, resolve_nsjail_timeout,
+        resolve_nsjail_tmp_mount_block, start_child_process, transform_json, OccupancyMetrics,
     },
     handle_child::handle_child,
     is_sandboxing_enabled,
     python_executor::{create_dependencies_dir, handle_python_reqs, uv_pip_compile},
-    DISABLE_NUSER, GIT_PATH, HOME_ENV, NSJAIL_PATH, PATH_ENV, PROXY_ENVS, PY_INSTALL_DIR, TZ_ENV,
+    DISABLE_NUSER, GIT_PATH, HOME_ENV, NSJAIL_ANSIBLE_RLIMIT_AS_MB, NSJAIL_PATH, PATH_ENV,
+    PROXY_ENVS, PY_INSTALL_DIR, TZ_ENV,
 };
 use windmill_common::client::AuthedClient;
 
@@ -1659,6 +1660,10 @@ mount {{
             job_dir,
             "run.config.proto",
             &NSJAIL_CONFIG_RUN_ANSIBLE_CONTENT
+                .replace(
+                    "{RLIMIT_AS}",
+                    &render_nsjail_rlimit_as(NSJAIL_ANSIBLE_RLIMIT_AS_MB.as_deref(), 4096),
+                )
                 .replace("{PY_INSTALL_DIR}", &*PY_INSTALL_DIR)
                 .replace("{JOB_DIR}", job_dir)
                 .replace("{CLONE_NEWUSER}", &(!*DISABLE_NUSER).to_string())
diff --git a/backend/windmill-worker/src/common.rs b/backend/windmill-worker/src/common.rs
index a88ba67bb7..6618ac7906 100644
--- a/backend/windmill-worker/src/common.rs
+++ b/backend/windmill-worker/src/common.rs
@@ -1124,6 +1124,45 @@ pub async fn resolve_nsjail_timeout(
     (duration.as_secs() + 15).to_string()
 }
 
+/// Render the `rlimit_as` line for an nsjail run config, honoring a per-language
+/// env-var override.
+///
+/// nsjail caps a jailed job's virtual address space at `rlimit_as` MiB. JIT
+/// runtimes (Bun/JavaScriptCore, the JVM) reserve large virtual ranges up front,
+/// so a subprocess spawned from a jailed Python/Ansible job can crash against this
+/// cap even when its physical memory use is modest. Lifting it lets operators run
+/// such workloads on a dedicated worker pool (set the env var only there) without
+/// giving up the mount/PID/user-namespace isolation that provides the real
+/// security boundary. Only the address-space limit is affected; the other rlimits
+/// (cpu/fsize/nofile) in the proto are untouched.
+///
+/// `env_override` is the raw value of the language's `NSJAIL_*_RLIMIT_AS_MB` env var:
+/// - unset/empty -> historical default (`rlimit_as: {default_mb}`)
+/// - `unlimited`/`none`/`inf`/`0` -> `rlimit_as_type: INF` (address space uncapped)
+/// - a positive integer (MiB) -> `rlimit_as: {n}`
+pub fn render_nsjail_rlimit_as(env_override: Option<&str>, default_mb: u32) -> String {
+    match env_override.map(str::trim) {
+        None | Some("") => format!("rlimit_as: {default_mb}"),
+        Some(v)
+            if v.eq_ignore_ascii_case("unlimited")
+                || v.eq_ignore_ascii_case("none")
+                || v.eq_ignore_ascii_case("inf")
+                || v == "0" =>
+        {
+            "rlimit_as_type: INF".to_string()
+        }
+        Some(v) => match v.parse::<u32>() {
+            Ok(mb) => format!("rlimit_as: {mb}"),
+            Err(_) => {
+                tracing::warn!(
+                    "Invalid nsjail rlimit_as override {v:?}, using default {default_mb}MiB"
+                );
+                format!("rlimit_as: {default_mb}")
+            }
+        },
+    }
+}
+
 /// Default size (in bytes) of the `/tmp` tmpfs mount inside nsjail sandboxes,
 /// used when the `nsjail_tmpfs_size_mb` instance setting is unset.
 pub const DEFAULT_NSJAIL_TMPFS_SIZE_BYTES: u64 = 800_000_000;
@@ -1233,6 +1272,49 @@ pub(crate) async fn resolve_nsjail_tmp_mount_block(job_dir: &str) -> String {
     bind_mount_block(&jail_tmp)
 }
 
+#[cfg(test)]
+mod nsjail_rlimit_as_tests {
+    use super::render_nsjail_rlimit_as;
+
+    #[test]
+    fn unset_uses_default() {
+        assert_eq!(render_nsjail_rlimit_as(None, 4096), "rlimit_as: 4096");
+        assert_eq!(render_nsjail_rlimit_as(Some("  "), 4096), "rlimit_as: 4096");
+    }
+
+    #[test]
+    fn numeric_override_is_used() {
+        assert_eq!(
+            render_nsjail_rlimit_as(Some("16384"), 4096),
+            "rlimit_as: 16384"
+        );
+        assert_eq!(
+            render_nsjail_rlimit_as(Some("  8192 "), 4096),
+            "rlimit_as: 8192"
+        );
+    }
+
+    #[test]
+    fn unlimited_keywords_emit_inf() {
+        for v in ["unlimited", "UNLIMITED", "none", "inf", "0"] {
+            assert_eq!(
+                render_nsjail_rlimit_as(Some(v), 4096),
+                "rlimit_as_type: INF",
+                "value {v:?}"
+            );
+        }
+    }
+
+    #[test]
+    fn invalid_falls_back_to_default() {
+        assert_eq!(
+            render_nsjail_rlimit_as(Some("abc"), 4096),
+            "rlimit_as: 4096"
+        );
+        assert_eq!(render_nsjail_rlimit_as(Some("-1"), 4096), "rlimit_as: 4096");
+    }
+}
+
 #[cfg(test)]
 mod nsjail_tmp_mount_tests {
     use super::*;
diff --git a/backend/windmill-worker/src/python_executor.rs b/backend/windmill-worker/src/python_executor.rs
index 9ca79c6852..a3ae036894 100644
--- a/backend/windmill-worker/src/python_executor.rs
+++ b/backend/windmill-worker/src/python_executor.rs
@@ -155,16 +155,17 @@ use windmill_object_store::OBJECT_STORE_SETTINGS;
 use crate::{
     common::{
         build_command_with_isolation, create_args_and_out_file, get_reserved_variables, read_file,
-        read_result, resolve_nsjail_timeout, resolve_nsjail_tmp_mount_block, start_child_process,
-        OccupancyMetrics, StreamNotifier, DEV_CONF_NSJAIL,
+        read_result, render_nsjail_rlimit_as, resolve_nsjail_timeout,
+        resolve_nsjail_tmp_mount_block, start_child_process, OccupancyMetrics, StreamNotifier,
+        DEV_CONF_NSJAIL,
     },
     get_proxy_envs_for_lang,
     handle_child::handle_child,
     is_sandboxing_enabled, read_ee_registry_with_workspace_override,
     worker_utils::ping_job_status,
-    PyV, DISABLE_NUSER, HOME_ENV, NSJAIL_AVAILABLE, NSJAIL_PATH, PATH_ENV, PIP_EXTRA_INDEX_URL,
-    PIP_INDEX_URL, PROXY_ENVS, PY_INSTALL_DIR, TRACING_PROXY_CA_CERT_PATH, TZ_ENV, UV_CACHE_DIR,
-    UV_EXCLUDE_NEWER, UV_INDEX_STRATEGY, UV_PYTHON_INSTALL_MIRROR,
+    PyV, DISABLE_NUSER, HOME_ENV, NSJAIL_AVAILABLE, NSJAIL_PATH, NSJAIL_PY_RLIMIT_AS_MB, PATH_ENV,
+    PIP_EXTRA_INDEX_URL, PIP_INDEX_URL, PROXY_ENVS, PY_INSTALL_DIR, TRACING_PROXY_CA_CERT_PATH,
+    TZ_ENV, UV_CACHE_DIR, UV_EXCLUDE_NEWER, UV_INDEX_STRATEGY, UV_PYTHON_INSTALL_MIRROR,
 };
 use windmill_common::client::AuthedClient;
 
@@ -1077,6 +1078,10 @@ mount {{
             job_dir,
             "run.config.proto",
             &NSJAIL_CONFIG_RUN_PYTHON3_CONTENT
+                .replace(
+                    "{RLIMIT_AS}",
+                    &render_nsjail_rlimit_as(NSJAIL_PY_RLIMIT_AS_MB.as_deref(), 4096),
+                )
                 .replace("{JOB_DIR}", job_dir)
                 .replace("{PY_INSTALL_DIR}", &*PY_INSTALL_DIR)
                 .replace("{CLONE_NEWUSER}", &(!*DISABLE_NUSER).to_string())
diff --git a/backend/windmill-worker/src/worker.rs b/backend/windmill-worker/src/worker.rs
index a4672145bb..69642cd4ea 100644
--- a/backend/windmill-worker/src/worker.rs
+++ b/backend/windmill-worker/src/worker.rs
@@ -342,6 +342,14 @@ lazy_static::lazy_static! {
     .and_then(|x| x.parse::<bool>().ok())
     .unwrap_or(false);
 
+    /// Per-language override for the nsjail `rlimit_as` (virtual address space) cap.
+    /// Value is in MiB, or `unlimited`/`none`/`inf`/`0` to uncap. Unset keeps the
+    /// historical default baked into the proto. See `render_nsjail_rlimit_as`.
+    pub static ref NSJAIL_PY_RLIMIT_AS_MB: Option<String> =
+        std::env::var("NSJAIL_PY_RLIMIT_AS_MB").ok();
+    pub static ref NSJAIL_ANSIBLE_RLIMIT_AS_MB: Option<String> =
+        std::env::var("NSJAIL_ANSIBLE_RLIMIT_AS_MB").ok();
+
     // pub static ref DISABLE_NSJAIL: bool = false;
     pub static ref DISABLE_NSJAIL: bool = std::env::var("DISABLE_NSJAIL")
         .ok()

From 8bfe5c93404ba3f137394f16d0571a06d891dc3b Mon Sep 17 00:00:00 2001
From: hugocasa <hugo@casademont.ch>
Date: Wed, 15 Jul 2026 17:53:09 +0200
Subject: [PATCH 002/171] fix(ai): stop sending the AI agent system prompt
 twice for OpenAI (#10126)

* fix(ai): stop sending the AI agent system prompt twice for OpenAI

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(ai): document collect_system_prompt precedence and trim duplicate comments

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(ai): hoist only the leading system prompt for OpenAI

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../windmill-ai/src/providers/anthropic.rs    | 101 ++++++++++++--
 backend/windmill-ai/src/providers/openai.rs   | 131 +++++++++++++++++-
 backend/windmill-ai/src/utils.rs              | 108 ++++++++++++++-
 3 files changed, 325 insertions(+), 15 deletions(-)

diff --git a/backend/windmill-ai/src/providers/anthropic.rs b/backend/windmill-ai/src/providers/anthropic.rs
index d71de2f35f..a255f47a6d 100644
--- a/backend/windmill-ai/src/providers/anthropic.rs
+++ b/backend/windmill-ai/src/providers/anthropic.rs
@@ -6,7 +6,10 @@ use crate::{
     query_builder::{BuildRequestArgs, ParsedResponse, QueryBuilder, StreamEventSink},
     sse::{AnthropicSSEParser, SSEParser},
     types::*,
-    utils::{extract_text_content, should_use_structured_output_tool, AI_HTTP_HEADERS},
+    utils::{
+        collect_system_prompt, extract_text_content, should_use_structured_output_tool,
+        AI_HTTP_HEADERS,
+    },
 };
 use async_trait::async_trait;
 use http::Method;
@@ -209,7 +212,7 @@ fn convert_messages_to_anthropic(messages: &[OpenAIMessage]) -> Vec<AnthropicMes
     for msg in messages {
         match msg.role.as_str() {
             "system" => {
-                // Skip - handled via args.system_prompt in build_text_request
+                // Lifted into the request's top-level `system` field by build_text_request
             }
             "user" => {
                 // Convert user messages
@@ -601,19 +604,17 @@ impl AnthropicQueryBuilder {
             }
         }
 
-        // Build system content from system_prompt, but None if system_prompt is empty string
-        let system = match args.system_prompt {
-            Some(s) if !s.is_empty() => Some(vec![AnthropicSystemContent {
+        let system = collect_system_prompt(&prepared_messages, args.system_prompt).map(|text| {
+            vec![AnthropicSystemContent {
                 r#type: "text".to_string(),
-                text: s.to_string(),
+                text,
                 cache_control: if self.is_vertex() {
                     None
                 } else {
                     Some(CacheControl::ephemeral())
                 },
-            }]),
-            _ => None,
-        };
+            }]
+        });
 
         // Check if we need to force tool usage for structured output
         let has_output_properties = args
@@ -842,6 +843,88 @@ mod tests {
         }
     }
 
+    const SYSTEM_PROMPT: &str = "You are a helpful assistant";
+
+    fn authed_client() -> AuthedClient {
+        AuthedClient::new(
+            "http://localhost:8000".to_string(),
+            "test-workspace".to_string(),
+            "token".to_string(),
+            None,
+        )
+    }
+
+    fn message(role: &str, text: &str) -> OpenAIMessage {
+        OpenAIMessage {
+            role: role.to_string(),
+            content: Some(OpenAIContent::Text(text.to_string())),
+            ..Default::default()
+        }
+    }
+
+    async fn build_text_body(messages: &[OpenAIMessage], system_prompt: Option<&str>) -> String {
+        let args = BuildRequestArgs {
+            messages,
+            tools: None,
+            model: "claude-sonnet-4",
+            temperature: None,
+            reasoning_effort: None,
+            max_tokens: None,
+            output_schema: None,
+            output_type: &OutputType::Text,
+            system_prompt,
+            user_message: "hello",
+            attachments: None,
+            has_websearch: false,
+        };
+
+        AnthropicQueryBuilder::new(AIProvider::Anthropic, AIPlatform::Standard)
+            .build_request(&args, &authed_client(), "test-workspace")
+            .await
+            .unwrap()
+    }
+
+    /// The worker prepends the system prompt as a system message *and* passes it as
+    /// `system_prompt`; the request must still carry it exactly once.
+    #[tokio::test]
+    async fn sends_system_prompt_only_in_system_field() {
+        let messages = vec![message("system", SYSTEM_PROMPT), message("user", "hi")];
+
+        let body = build_text_body(&messages, Some(SYSTEM_PROMPT)).await;
+        let request: serde_json::Value = serde_json::from_str(&body).unwrap();
+
+        assert_eq!(request["system"][0]["text"], SYSTEM_PROMPT);
+        assert_eq!(body.matches(SYSTEM_PROMPT).count(), 1);
+
+        let sent = request["messages"].as_array().unwrap();
+        assert!(sent.iter().all(|message| message["role"] != "system"));
+        assert_eq!(sent.len(), 1);
+        assert_eq!(sent[0]["role"], "user");
+    }
+
+    /// Manual-memory conversations supply their own system messages without a
+    /// `system_prompt` arg: those must still reach the model.
+    #[tokio::test]
+    async fn lifts_manual_system_messages_into_system_field() {
+        let messages = vec![message("system", "be terse"), message("user", "hi")];
+
+        let body = build_text_body(&messages, None).await;
+        let request: serde_json::Value = serde_json::from_str(&body).unwrap();
+
+        assert_eq!(request["system"][0]["text"], "be terse");
+        assert_eq!(request["messages"].as_array().unwrap().len(), 1);
+    }
+
+    #[tokio::test]
+    async fn omits_system_without_a_system_prompt() {
+        let messages = vec![message("user", "hi")];
+
+        let body = build_text_body(&messages, None).await;
+        let request: serde_json::Value = serde_json::from_str(&body).unwrap();
+
+        assert!(request.get("system").is_none());
+    }
+
     fn has_header(headers: &[(String, String)], name: &str, value: &str) -> bool {
         headers
             .iter()
diff --git a/backend/windmill-ai/src/providers/openai.rs b/backend/windmill-ai/src/providers/openai.rs
index bdb882679b..8a90d84658 100644
--- a/backend/windmill-ai/src/providers/openai.rs
+++ b/backend/windmill-ai/src/providers/openai.rs
@@ -6,7 +6,7 @@ use crate::{
     query_builder::{BuildRequestArgs, ParsedResponse, QueryBuilder, StreamEventSink},
     sse::{OpenAIResponsesSSEParser, SSEParser},
     types::*,
-    utils::extract_text_content,
+    utils::{collect_system_prompt, extract_text_content},
 };
 use async_trait::async_trait;
 use serde::{Deserialize, Serialize};
@@ -206,7 +206,7 @@ pub struct ResponsesApiRequest<'a> {
     pub model: &'a str,
     pub input: Vec<ResponsesApiInputItem>,
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub instructions: Option<&'a str>,
+    pub instructions: Option<String>,
     pub tools: Vec<ResponsesApiTool>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub stream: Option<bool>,
@@ -371,9 +371,19 @@ impl OpenAIQueryBuilder {
         let prepared_messages =
             prepare_messages_for_api(args.messages, client, workspace_id).await?;
 
+        // Only the system prompt leading the conversation moves to `instructions`; echoing it in
+        // `input` as well would send it twice. This API accepts system messages anywhere in
+        // `input`, so any later one stays where the caller put it, position and content intact.
+        let leading_system = prepared_messages
+            .iter()
+            .take_while(|message| message.role == "system")
+            .count();
+        let instructions =
+            collect_system_prompt(&prepared_messages[..leading_system], args.system_prompt);
+
         // Convert full message history to Responses API input format
         // (following frontend pattern from openai-responses.ts)
-        let input_items = convert_messages_to_responses_input(&prepared_messages);
+        let input_items = convert_messages_to_responses_input(&prepared_messages[leading_system..]);
 
         // Build tools array using typed structs
         let mut tools: Vec<ResponsesApiTool> = Vec::new();
@@ -416,7 +426,7 @@ impl OpenAIQueryBuilder {
         let request = ResponsesApiRequest {
             model: args.model,
             input: input_items,
-            instructions: args.system_prompt, // System prompt goes to instructions field
+            instructions,
             tools,
             stream: Some(true),
             temperature: args.temperature,
@@ -474,7 +484,7 @@ impl OpenAIQueryBuilder {
         let request = ResponsesApiRequest {
             model: args.model,
             input: vec![ResponsesApiInputItem::InputMessage { role: "user".to_string(), content }],
-            instructions: args.system_prompt,
+            instructions: args.system_prompt.map(str::to_string),
             tools,
             stream: None, // Image generation doesn't use streaming
             temperature: args.temperature,
@@ -582,3 +592,114 @@ impl QueryBuilder for OpenAIQueryBuilder {
         vec![("Authorization", format!("Bearer {}", api_key))]
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::query_builder::QueryBuilder;
+
+    const SYSTEM_PROMPT: &str = "You are a helpful assistant";
+
+    fn client() -> AuthedClient {
+        AuthedClient::new(
+            "http://localhost:8000".to_string(),
+            "test-workspace".to_string(),
+            "token".to_string(),
+            None,
+        )
+    }
+
+    fn message(role: &str, text: &str) -> OpenAIMessage {
+        OpenAIMessage {
+            role: role.to_string(),
+            content: Some(OpenAIContent::Text(text.to_string())),
+            ..Default::default()
+        }
+    }
+
+    async fn build_text_body(messages: &[OpenAIMessage], system_prompt: Option<&str>) -> String {
+        let args = BuildRequestArgs {
+            messages,
+            tools: None,
+            model: "gpt-5",
+            temperature: None,
+            reasoning_effort: None,
+            max_tokens: None,
+            output_schema: None,
+            output_type: &OutputType::Text,
+            system_prompt,
+            user_message: "hello",
+            attachments: None,
+            has_websearch: false,
+        };
+
+        OpenAIQueryBuilder::new(AIProvider::OpenAI)
+            .build_request(&args, &client(), "test-workspace")
+            .await
+            .unwrap()
+    }
+
+    /// The worker prepends the system prompt as a system message *and* passes it as
+    /// `system_prompt`; the request must still carry it exactly once.
+    #[tokio::test]
+    async fn sends_system_prompt_only_in_instructions() {
+        let messages = vec![message("system", SYSTEM_PROMPT), message("user", "hi")];
+
+        let body = build_text_body(&messages, Some(SYSTEM_PROMPT)).await;
+        let request: serde_json::Value = serde_json::from_str(&body).unwrap();
+
+        assert_eq!(request["instructions"], SYSTEM_PROMPT);
+        assert_eq!(body.matches(SYSTEM_PROMPT).count(), 1);
+
+        let input = request["input"].as_array().unwrap();
+        assert!(input.iter().all(|item| item["role"] != "system"));
+        assert_eq!(input.len(), 1);
+        assert_eq!(input[0]["role"], "user");
+    }
+
+    /// This API takes system messages anywhere in `input`, so a late steering message keeps
+    /// its position instead of being hoisted into `instructions`.
+    #[tokio::test]
+    async fn keeps_a_mid_conversation_system_message_in_place() {
+        let messages = vec![
+            message("system", SYSTEM_PROMPT),
+            message("user", "hi"),
+            message("system", "answer in one word"),
+            message("user", "and now?"),
+        ];
+
+        let body = build_text_body(&messages, Some(SYSTEM_PROMPT)).await;
+        let request: serde_json::Value = serde_json::from_str(&body).unwrap();
+
+        assert_eq!(request["instructions"], SYSTEM_PROMPT);
+        assert_eq!(body.matches(SYSTEM_PROMPT).count(), 1);
+
+        let input = request["input"].as_array().unwrap();
+        assert_eq!(input.len(), 3);
+        assert_eq!(input[1]["role"], "system");
+        assert_eq!(input[1]["content"][0]["text"], "answer in one word");
+    }
+
+    /// Manual-memory conversations supply their own system messages without a
+    /// `system_prompt` arg: those must still reach the model.
+    #[tokio::test]
+    async fn lifts_manual_system_messages_into_instructions() {
+        let messages = vec![message("system", "be terse"), message("user", "hi")];
+
+        let body = build_text_body(&messages, None).await;
+        let request: serde_json::Value = serde_json::from_str(&body).unwrap();
+
+        assert_eq!(request["instructions"], "be terse");
+        assert_eq!(request["input"].as_array().unwrap().len(), 1);
+    }
+
+    #[tokio::test]
+    async fn omits_instructions_without_a_system_prompt() {
+        let messages = vec![message("user", "hi")];
+
+        let body = build_text_body(&messages, None).await;
+        let request: serde_json::Value = serde_json::from_str(&body).unwrap();
+
+        assert!(request.get("instructions").is_none());
+    }
+}
diff --git a/backend/windmill-ai/src/utils.rs b/backend/windmill-ai/src/utils.rs
index fab1644255..66b68e9b6f 100644
--- a/backend/windmill-ai/src/utils.rs
+++ b/backend/windmill-ai/src/utils.rs
@@ -1,6 +1,6 @@
 use crate::{
     ai_providers::AIProvider,
-    ai_types::{ContentPart, OpenAIContent},
+    ai_types::{ContentPart, OpenAIContent, OpenAIMessage},
 };
 use windmill_common::utils::configure_client;
 
@@ -69,6 +69,37 @@ pub fn should_use_structured_output_tool(provider: &AIProvider, model: &str) ->
     model.contains("claude") || provider == &AIProvider::AWSBedrock
 }
 
+/// Collect the system prompt for providers that take it in a dedicated top-level field
+/// (Anthropic's `system`, OpenAI's `instructions`) instead of inline in the message list.
+///
+/// Every system message in `messages` is joined, since manual-memory conversations can carry
+/// system messages of their own alongside the one the caller prepends from `system_prompt`.
+/// `system_prompt` is a fallback used only when `messages` holds no system message, for callers
+/// that pass it without prepending it. Only text content survives, so pass just the messages the
+/// provider cannot render inline: Anthropic's API takes no system role at all and hands over
+/// everything, while OpenAI's accepts system messages inside `input` and hands over only the
+/// leading ones. Whatever is passed here must be left out of the message list the provider
+/// sends, or the same prompt goes over the wire twice.
+pub fn collect_system_prompt(
+    messages: &[OpenAIMessage],
+    system_prompt: Option<&str>,
+) -> Option<String> {
+    let from_messages = messages
+        .iter()
+        .filter(|message| message.role == "system")
+        .filter_map(|message| message.content.as_ref().map(extract_text_content))
+        .filter(|text| !text.is_empty())
+        .collect::<Vec<_>>();
+
+    if from_messages.is_empty() {
+        system_prompt
+            .filter(|prompt| !prompt.is_empty())
+            .map(str::to_string)
+    } else {
+        Some(from_messages.join("\n\n"))
+    }
+}
+
 /// Extract text content from OpenAIContent, joining parts with space if multiple
 pub fn extract_text_content(content: &OpenAIContent) -> String {
     match content {
@@ -93,6 +124,81 @@ mod tests {
     use tokio::io::{AsyncReadExt, AsyncWriteExt};
     use tokio::net::TcpListener;
 
+    fn message(role: &str, text: &str) -> OpenAIMessage {
+        OpenAIMessage {
+            role: role.to_string(),
+            content: Some(OpenAIContent::Text(text.to_string())),
+            ..Default::default()
+        }
+    }
+
+    #[test]
+    fn joins_every_system_message() {
+        let messages = vec![
+            message("system", "be helpful"),
+            message("user", "hi"),
+            message("system", "be terse"),
+        ];
+
+        assert_eq!(
+            collect_system_prompt(&messages, Some("be helpful")),
+            Some("be helpful\n\nbe terse".to_string())
+        );
+    }
+
+    /// A dedicated system field is text-only, so non-text parts cannot be carried over.
+    #[test]
+    fn keeps_only_text_parts_of_a_system_message() {
+        let messages = vec![OpenAIMessage {
+            role: "system".to_string(),
+            content: Some(OpenAIContent::Parts(vec![
+                ContentPart::Text { text: "be terse".to_string() },
+                ContentPart::ImageUrl {
+                    image_url: crate::ai_types::ImageUrlData {
+                        url: "data:image/png;base64,x".to_string(),
+                    },
+                },
+            ])),
+            ..Default::default()
+        }];
+
+        assert_eq!(
+            collect_system_prompt(&messages, None),
+            Some("be terse".to_string())
+        );
+    }
+
+    /// The argument is a fallback, not an extra source: system messages win outright.
+    #[test]
+    fn prefers_system_messages_over_the_argument() {
+        let messages = vec![message("system", "be terse"), message("user", "hi")];
+
+        assert_eq!(
+            collect_system_prompt(&messages, Some("unused fallback")),
+            Some("be terse".to_string())
+        );
+    }
+
+    #[test]
+    fn falls_back_to_the_system_prompt_argument() {
+        let messages = vec![message("user", "hi")];
+
+        assert_eq!(
+            collect_system_prompt(&messages, Some("be helpful")),
+            Some("be helpful".to_string())
+        );
+    }
+
+    #[test]
+    fn treats_empty_prompts_as_absent() {
+        assert_eq!(
+            collect_system_prompt(&[message("user", "hi")], Some("")),
+            None
+        );
+        assert_eq!(collect_system_prompt(&[message("user", "hi")], None), None);
+        assert_eq!(collect_system_prompt(&[message("system", "")], None), None);
+    }
+
     /// Regression test for GHSA-5q4v-c4v3-v7wr: `AI_HTTP_CLIENT` must not follow redirects.
     #[tokio::test]
     async fn ai_http_client_does_not_follow_redirects() {

From 2fe999f66cd15acd81850f970ada31e9892abff2 Mon Sep 17 00:00:00 2001
From: Diego Imbert <70353967+diegoimbert@users.noreply.github.com>
Date: Wed, 15 Jul 2026 17:55:01 +0200
Subject: [PATCH 003/171] fix(frontend): treat a displaced draft save as
 superseded, not failed (#10094)

---
 frontend/src/lib/coalescingRunner.svelte.ts   |  22 ++-
 frontend/src/lib/coalescingRunner.test.ts     |  81 +++++++++++
 frontend/src/lib/userDraftDbSyncer.svelte.ts  |  41 ++++--
 .../src/lib/userDraftDisplacedSave.test.ts    | 133 ++++++++++++++++++
 4 files changed, 264 insertions(+), 13 deletions(-)
 create mode 100644 frontend/src/lib/userDraftDisplacedSave.test.ts

diff --git a/frontend/src/lib/coalescingRunner.svelte.ts b/frontend/src/lib/coalescingRunner.svelte.ts
index 0f687d4829..61849c3e36 100644
--- a/frontend/src/lib/coalescingRunner.svelte.ts
+++ b/frontend/src/lib/coalescingRunner.svelte.ts
@@ -30,6 +30,9 @@ export type CoalescingKeyedRunner = {
 	cancel(key: string): boolean
 	/** Reactively whether `key`'s chain is running (SvelteSet-backed). */
 	isRunning(key: string): boolean
+	/** Resolves once `key`'s chain has drained (nothing running, nothing
+	 * pending), immediately if it's idle. Never rejects. */
+	settled(key: string): Promise<void>
 }
 
 type PendingTask = {
@@ -51,6 +54,8 @@ export function createCoalescingKeyedRunner(): CoalescingKeyedRunner {
 	// Reactive mirror of keys with a running chain, kept in lock-step with
 	// `state` (SvelteSet for per-key `isRunning` subscriptions).
 	const runningKeys = new SvelteSet<string>()
+	// Live chain promise per key, backing `settled`.
+	const chains = new Map<string, Promise<void>>()
 
 	async function chain(key: string, first: PendingTask): Promise<void> {
 		let current: PendingTask | undefined = first
@@ -71,6 +76,7 @@ export function createCoalescingKeyedRunner(): CoalescingKeyedRunner {
 		}
 		state.delete(key)
 		runningKeys.delete(key)
+		chains.delete(key)
 	}
 
 	/** Set `task` pending for `key`, displacing (and rejecting) any prior
@@ -84,7 +90,15 @@ export function createCoalescingKeyedRunner(): CoalescingKeyedRunner {
 		}
 		state.set(key, { pending: undefined })
 		runningKeys.add(key)
-		void chain(key, task)
+		// Register the chain promise BEFORE the first task runs. `chain` invokes
+		// the task synchronously, so a task that calls `settled(key)` (or that
+		// throws synchronously, running cleanup) would otherwise race ahead of a
+		// `chains.set(key, chain(...))` and leave the map wrong. A separate
+		// deferred sidesteps that: it's live before the task starts and resolves
+		// when the chain drains.
+		let done!: () => void
+		chains.set(key, new Promise<void>((resolve) => (done = resolve)))
+		void chain(key, task).finally(done)
 	}
 
 	function submit(key: string, fn: CoalescingTask): void {
@@ -114,5 +128,9 @@ export function createCoalescingKeyedRunner(): CoalescingKeyedRunner {
 		return runningKeys.has(key)
 	}
 
-	return { submit, submitAndWait, cancel, isRunning }
+	function settled(key: string): Promise<void> {
+		return chains.get(key) ?? Promise.resolve()
+	}
+
+	return { submit, submitAndWait, cancel, isRunning, settled }
 }
diff --git a/frontend/src/lib/coalescingRunner.test.ts b/frontend/src/lib/coalescingRunner.test.ts
index 49cca4688e..1ae97e7db1 100644
--- a/frontend/src/lib/coalescingRunner.test.ts
+++ b/frontend/src/lib/coalescingRunner.test.ts
@@ -115,6 +115,87 @@ describe('createCoalescingKeyedRunner', () => {
 		expect(runner.cancel('k')).toBe(false)
 	})
 
+	it('settled resolves immediately for an idle key', async () => {
+		const runner = createCoalescingKeyedRunner()
+		await expect(runner.settled('k')).resolves.toBeUndefined()
+	})
+
+	it('settled resolves once the chain drains, including the displacing task', async () => {
+		const runner = createCoalescingKeyedRunner()
+		const d = deferred()
+		const last = deferred()
+		const h = vi.fn(() => last.promise)
+
+		runner.submit('k', () => d.promise) // in flight
+		void runner.submitAndWait('k', () => Promise.resolve()).catch(() => {}) // displaced below
+		runner.submit('k', h)
+
+		let drained = false
+		void runner.settled('k').then(() => (drained = true))
+
+		d.resolve()
+		await d.promise
+		await Promise.resolve()
+		await Promise.resolve()
+		expect(h).toHaveBeenCalledTimes(1)
+		expect(drained).toBe(false) // h still running
+
+		last.resolve()
+		await runner.settled('k')
+		expect(drained).toBe(true)
+		expect(runner.isRunning('k')).toBe(false)
+	})
+
+	it('settled called synchronously from within the first task does not resolve early', async () => {
+		const runner = createCoalescingKeyedRunner()
+		const d = deferred()
+		let settledEarly = false
+		let settledResolved = false
+		runner.submit('k', () => {
+			// Re-entrant: the task is invoked synchronously as the chain starts.
+			const p = runner.settled('k')
+			void p.then(() => (settledResolved = true))
+			// Give the microtask a tick to (wrongly) resolve if the entry is missing.
+			void Promise.resolve().then(() => {
+				if (settledResolved) settledEarly = true
+			})
+			return d.promise
+		})
+		await Promise.resolve()
+		await Promise.resolve()
+		expect(settledEarly).toBe(false)
+		expect(settledResolved).toBe(false) // still running
+
+		d.resolve()
+		await runner.settled('k')
+		expect(settledResolved).toBe(true)
+	})
+
+	it('a synchronously-throwing first task leaves no stale chain entry', async () => {
+		const runner = createCoalescingKeyedRunner()
+		const err = vi.spyOn(console, 'error').mockImplementation(() => {})
+		runner.submit('k', () => {
+			throw new Error('sync boom')
+		})
+		// Chain drained synchronously; the key must be idle and settled a no-op.
+		expect(runner.isRunning('k')).toBe(false)
+		await expect(runner.settled('k')).resolves.toBeUndefined()
+		// A fresh submit still starts a new chain (map wasn't left stale).
+		const ran = vi.fn(() => Promise.resolve())
+		runner.submit('k', ran)
+		expect(ran).toHaveBeenCalledTimes(1)
+		err.mockRestore()
+	})
+
+	it('settled ignores a task failure (the chain survives it)', async () => {
+		const runner = createCoalescingKeyedRunner()
+		const err = vi.spyOn(console, 'error').mockImplementation(() => {})
+		runner.submit('k', () => Promise.reject(new Error('boom')))
+		await expect(runner.settled('k')).resolves.toBeUndefined()
+		expect(runner.isRunning('k')).toBe(false)
+		err.mockRestore()
+	})
+
 	it('does not abort the in-flight task on cancel', async () => {
 		const runner = createCoalescingKeyedRunner()
 		const d = deferred()
diff --git a/frontend/src/lib/userDraftDbSyncer.svelte.ts b/frontend/src/lib/userDraftDbSyncer.svelte.ts
index a75f6b6837..77e2eecc88 100644
--- a/frontend/src/lib/userDraftDbSyncer.svelte.ts
+++ b/frontend/src/lib/userDraftDbSyncer.svelte.ts
@@ -1,7 +1,7 @@
 import { SvelteMap } from 'svelte/reactivity'
 import { DraftService, type UserDraftItemKind } from './gen'
 import { OpenAPI } from './gen/core/OpenAPI'
-import { createCoalescingKeyedRunner } from './coalescingRunner.svelte'
+import { createCoalescingKeyedRunner, CoalescingDisplacedError } from './coalescingRunner.svelte'
 import { createDebouncerByKey } from './debouncerByKey.svelte'
 import { setLocalDraftHint } from './localDraftHints.svelte'
 
@@ -92,10 +92,16 @@ export type UserDraftDbSyncerSaveOpts = {
 	value: unknown | null
 	/** Bypass the debouncer: cancel any pending autosave for this key (it
 	 * would otherwise overwrite what we send), route through the coalescing
-	 * runner to preserve ordering against an in-flight POST, and resolve
-	 * the returned promise only once the POST lands. Use for
+	 * runner to preserve ordering against an in-flight POST, and resolve only
+	 * once the key's save chain has drained. Use for
 	 * `await save(...); read-the-server` flows where a fire-and-forget save
-	 * would race the next read. */
+	 * would race the next read.
+	 *
+	 * Resolving means "the key is settled", NOT "your payload won": a newer
+	 * save can displace this one (it then carries the later state), and — as
+	 * with every other `save` — `postSave` routes a rejected or failed POST to
+	 * `conflicts` / `failures` rather than throwing. Read those to know what
+	 * actually landed. */
 	immediate?: boolean
 	/** Skip the optimistic-concurrency check and overwrite the server row.
 	 * Used by the conflict-resolution UI ("Overwrite the remote"). Default
@@ -441,10 +447,19 @@ export const UserDraftDbSyncer = {
 		pendingSaveOpts.set(key, opts)
 		if (opts.immediate) {
 			// Drop the queued autosave — firing it after our POST would
-			// re-save the pre-delete value.
+			// re-save the pre-delete value. `submitAndWait` displaces the
+			// runner's own pending task, so no `runner.cancel` needed.
 			debouncer.cancel(key)
-			runner.cancel(key)
-			await runner.submitAndWait(key, () => postSave(opts))
+			try {
+				await runner.submitAndWait(key, () => postSave(opts))
+			} catch (e) {
+				// Displacement is not a failure: a newer save took our slot, so
+				// re-POSTing ours would undo it. Wait for the chain instead —
+				// callers await this to know the key is settled, not to know
+				// their own payload won.
+				if (!(e instanceof CoalescingDisplacedError)) throw e
+				await runner.settled(key)
+			}
 			return
 		}
 		// Auto-save off: opts stay parked (above) for an explicit flush but
@@ -563,8 +578,10 @@ export const UserDraftDbSyncer = {
 
 	/**
 	 * Force-save: bypass the `last_sync` check and overwrite the server row
-	 * (conflict modal's "Overwrite the remote"). Resolves only after the
-	 * POST lands so the caller can `await` before navigating / refetching.
+	 * (conflict modal's "Overwrite the remote"). Resolves once the key's save
+	 * chain drains — see `immediate`; resolution means the chain settled, not
+	 * that this force payload won (a later save can displace it). Callers
+	 * `await` before navigating / refetching.
 	 */
 	async overwrite(opts: Omit<UserDraftDbSyncerSaveOpts, 'force'>): Promise<void> {
 		await this.save({ ...opts, immediate: true, force: true })
@@ -572,8 +589,10 @@ export const UserDraftDbSyncer = {
 
 	/**
 	 * Flush the draft's queued autosave NOW (explicit Ctrl/Cmd+S). Re-submits
-	 * the parked opts with `immediate: true` and resolves only after the POST
-	 * lands, so callers can `await flush(...); show "Saved"`.
+	 * the parked opts with `immediate: true` and resolves once the key's save
+	 * chain drains (see `immediate` — the parked payload may be displaced by a
+	 * later save carrying newer state), so callers can `await flush(...); show
+	 * "Saved"`.
 	 *
 	 * No-op when nothing is pending. "No pending" does NOT mean "nothing to
 	 * save" — Monaco may hold unmaterialized text; flush the editor
diff --git a/frontend/src/lib/userDraftDisplacedSave.test.ts b/frontend/src/lib/userDraftDisplacedSave.test.ts
new file mode 100644
index 0000000000..50e24ba5c6
--- /dev/null
+++ b/frontend/src/lib/userDraftDisplacedSave.test.ts
@@ -0,0 +1,133 @@
+import { describe, it, expect, afterEach, vi } from 'vitest'
+
+// Mocked so a test can hold a POST in flight — that window is what makes a
+// queued save displaceable.
+const updateDraft = vi.fn(async (..._args: any[]) => ({
+	status: 'saved' as const,
+	current_timestamp: '2020-01-01T00:00:00Z'
+}))
+
+vi.mock('./gen', () => ({
+	DraftService: { updateDraft: (...a: unknown[]) => updateDraft(...(a as [])) }
+}))
+vi.mock('./gen/core/OpenAPI', () => ({ OpenAPI: { BASE: '' } }))
+vi.mock('./localDraftHints.svelte', () => ({ setLocalDraftHint: vi.fn() }))
+
+import { UserDraftDbSyncer } from './userDraftDbSyncer.svelte'
+
+function deferred<T = void>() {
+	let resolve!: (v: T) => void
+	const promise = new Promise<T>((res) => (resolve = res))
+	return { promise, resolve }
+}
+
+afterEach(() => {
+	vi.clearAllMocks()
+	updateDraft.mockResolvedValue({ status: 'saved', current_timestamp: '2020-01-01T00:00:00Z' })
+})
+
+/**
+ * Deploying queues several saves for one draft key back-to-back (mirror write,
+ * post-deploy delete, unmount flush), so the runner displaces one of them. A
+ * displaced save must read as "superseded", never as a failure.
+ */
+describe('UserDraftDbSyncer immediate save displacement', () => {
+	it('resolves a displaced immediate save once the superseding save lands', async () => {
+		const q = { workspace: 'w', itemKind: 'script' as const, path: 'u/me/displaced_a' }
+		const inFlight = deferred()
+		updateDraft.mockImplementationOnce(async () => {
+			await inFlight.promise
+			return { status: 'saved', current_timestamp: '2020-01-01T00:00:00Z' }
+		})
+
+		const first = UserDraftDbSyncer.save({ ...q, value: { content: '1' }, immediate: true })
+		// Queues behind `first`, then gets displaced by the delete below.
+		const displaced = UserDraftDbSyncer.save({ ...q, value: { content: '2' }, immediate: true })
+		const deleting = UserDraftDbSyncer.save({ ...q, value: null, immediate: true })
+
+		inFlight.resolve()
+		await expect(displaced).resolves.toBeUndefined()
+		await Promise.all([first, deleting])
+
+		// The displaced task never POSTed — the delete carries the later state.
+		expect(updateDraft).toHaveBeenCalledTimes(2)
+		expect(updateDraft.mock.calls.map((c: any[]) => c[0].requestBody.value)).toEqual([
+			{ content: '1' },
+			null
+		])
+	})
+
+	it('does not resolve a displaced save before the superseding POST lands', async () => {
+		const q = { workspace: 'w', itemKind: 'script' as const, path: 'u/me/displaced_b' }
+		const inFlight = deferred()
+		const deletePost = deferred()
+		updateDraft
+			.mockImplementationOnce(async () => {
+				await inFlight.promise
+				return { status: 'saved', current_timestamp: '2020-01-01T00:00:00Z' }
+			})
+			.mockImplementationOnce(async () => {
+				await deletePost.promise
+				return { status: 'saved', current_timestamp: '2020-01-01T00:00:01Z' }
+			})
+
+		const first = UserDraftDbSyncer.save({ ...q, value: { content: '1' }, immediate: true })
+		const displaced = UserDraftDbSyncer.save({ ...q, value: { content: '2' }, immediate: true })
+		const deleting = UserDraftDbSyncer.save({ ...q, value: null, immediate: true })
+
+		let displacedSettled = false
+		void displaced.then(() => (displacedSettled = true))
+
+		inFlight.resolve()
+		await vi.waitFor(() => expect(updateDraft).toHaveBeenCalledTimes(2))
+		// Delete still in flight: callers that `await save()` before invalidating
+		// must not read the server yet.
+		expect(displacedSettled).toBe(false)
+
+		deletePost.resolve()
+		await Promise.all([first, displaced, deleting])
+		expect(displacedSettled).toBe(true)
+	})
+
+	it('resolves a pending save dropped by lockSync without POSTing it', async () => {
+		const q = { workspace: 'w', itemKind: 'script' as const, path: 'u/me/displaced_lock' }
+		const inFlight = deferred()
+		updateDraft.mockImplementationOnce(async () => {
+			await inFlight.promise
+			return { status: 'saved', current_timestamp: '2020-01-01T00:00:00Z' }
+		})
+
+		const first = UserDraftDbSyncer.save({ ...q, value: { content: '1' }, immediate: true })
+		const dropped = UserDraftDbSyncer.save({ ...q, value: { content: '2' }, immediate: true })
+		// Another user's draft was loaded: this value must never reach the server.
+		UserDraftDbSyncer.lockSync(q)
+
+		inFlight.resolve()
+		// Resolves like every other save on a locked key — the lock's whole point
+		// is that the write is dropped, so the caller has nothing to wait for.
+		await expect(dropped).resolves.toBeUndefined()
+		await first
+		expect(updateDraft).toHaveBeenCalledTimes(1)
+		expect(updateDraft.mock.calls[0][0].requestBody.value).toEqual({ content: '1' })
+		UserDraftDbSyncer.unlockSync(q)
+	})
+
+	it('resolves a flush displaced by a later immediate save', async () => {
+		const q = { workspace: 'w', itemKind: 'script' as const, path: 'u/me/displaced_c' }
+		const inFlight = deferred()
+		updateDraft.mockImplementationOnce(async () => {
+			await inFlight.promise
+			return { status: 'saved', current_timestamp: '2020-01-01T00:00:00Z' }
+		})
+
+		// Park opts (the reactive mirror's autosave) so `flush` has something to send.
+		void UserDraftDbSyncer.save({ ...q, value: { content: 'typed' }, auto: true })
+		const first = UserDraftDbSyncer.save({ ...q, value: { content: 'x' }, immediate: true })
+		const flushed = UserDraftDbSyncer.flush(q) // pending behind `first`
+		const deleting = UserDraftDbSyncer.save({ ...q, value: null, immediate: true }) // displaces it
+
+		inFlight.resolve()
+		await expect(flushed).resolves.toBeUndefined()
+		await Promise.all([first, deleting])
+	})
+})

From af177cefe07e6037e33cc90757088a98fb63a49f Mon Sep 17 00:00:00 2001
From: Guilhem <guilhemlemouel@gmail.com>
Date: Wed, 15 Jul 2026 17:55:21 +0200
Subject: [PATCH 004/171] fix(frontend): graceful small-screen timeframe picker
 on the runs page (#10073)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix(frontend): prevent runs timeframe calendar popover overflow on small screens

The Runs page timeframe picker rendered its popover as a wide 3-column row
(preset list + two side-by-side calendars). With the right-aligned trigger and
a center-anchored `bottom` placement, the popup ran off the right edge on
narrow viewports.

Anchor the popover to the right edge (`placement="bottom-end"`) and make its
content reflow to a vertical stack below the `sm` breakpoint, capped at
`max-w-[calc(100vw-2rem)] max-h-[80vh] overflow-auto` so it can never exceed the
viewport. The desktop side-by-side layout is unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(frontend): compact runs timeframe picker with a Start/End toggle on small screens

The two-calendar desktop popover needs ~780px (two min-w-9 grids + presets +
popover padding); below that it overflows. Under 800px, show a single calendar
with a Start/End toggle picking which bound it edits, using set-start/set-end so
each bound keeps its date and HH:MM time inputs — the same precision the desktop
start/end pair offers.

On short/landscape viewports the compact panel is scroll-contained within the
popover's fitViewport height (contentClasses overflow-y-auto, scoped to the
small layout) so its lower controls stay reachable. The desktop two-calendar
layout is unchanged.

Presets are shared between both layouts via a snippet, and the active range is
preserved across the breakpoint since both branches drive the same value.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(frontend): let InlineCalendarInput month/year selects portal, use in compact timeframe picker

Add an opt-in `portalSelects` prop to InlineCalendarInput that portals the
month/year dropdowns to the body (default keeps them in-flow, so existing
consumers are unchanged). The compact runs timeframe picker enables it so the
dropdowns escape its scroll-contained (overflow-y-auto) popover instead of
being clipped.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../common/InlineCalendarInput.svelte         |  15 ++-
 .../components/runs/TimeframeSelect.svelte    | 123 +++++++++++++-----
 2 files changed, 100 insertions(+), 38 deletions(-)

diff --git a/frontend/src/lib/components/common/InlineCalendarInput.svelte b/frontend/src/lib/components/common/InlineCalendarInput.svelte
index 2ef2e4bd2f..7c20af8e74 100644
--- a/frontend/src/lib/components/common/InlineCalendarInput.svelte
+++ b/frontend/src/lib/components/common/InlineCalendarInput.svelte
@@ -63,9 +63,18 @@
 
 	type Props = (DateProps | RangeProps) & {
 		class?: string
+		// Portal the month/year dropdowns to the body so they escape an `overflow`
+		// ancestor (e.g. a scroll-contained popover). Off by default: in-flow.
+		portalSelects?: boolean
 	}
 
-	let { mode = 'date', value = $bindable(), class: className, ...rest }: Props = $props()
+	let {
+		mode = 'date',
+		value = $bindable(),
+		class: className,
+		portalSelects = false,
+		...rest
+	}: Props = $props()
 
 	const onClickBehavior = $derived(
 		mode === 'range' ? ((rest as RangeProps).onClickBehavior ?? 'set-range') : 'set-range'
@@ -425,14 +434,14 @@
 			<Select
 				class="basis-1/2"
 				inputClass="text-center !rounded-r-none !border-r-0"
-				disablePortal
+				disablePortal={!portalSelects}
 				bind:value={viewMonth}
 				items={MONTH_NAMES.map((name, i) => ({ label: name, value: i + 1 }))}
 			/>
 			<Select
 				class="basis-1/2"
 				inputClass="text-center !rounded-l-none !border-l-0"
-				disablePortal
+				disablePortal={!portalSelects}
 				bind:value={viewYear}
 				onCreateItem={(val) => (viewYear = parseInt(val) || viewYear)}
 				items={YEAR_LIST.map((year) => ({ label: year.toString(), value: year }))}
diff --git a/frontend/src/lib/components/runs/TimeframeSelect.svelte b/frontend/src/lib/components/runs/TimeframeSelect.svelte
index cc5a99f70c..f8d2b0df71 100644
--- a/frontend/src/lib/components/runs/TimeframeSelect.svelte
+++ b/frontend/src/lib/components/runs/TimeframeSelect.svelte
@@ -78,6 +78,8 @@
 <script lang="ts">
 	import { CalendarIcon, RefreshCw } from 'lucide-svelte'
 	import { Button } from '../common'
+	import ToggleButtonGroup from '../common/toggleButton-v2/ToggleButtonGroup.svelte'
+	import ToggleButton from '../common/toggleButton-v2/ToggleButton.svelte'
 	import Popover from '../meltComponents/Popover.svelte'
 	import { watch } from 'runed'
 	import { page } from '$app/state'
@@ -98,6 +100,14 @@
 
 	let isOpen = $state(false)
 
+	// The two-calendar desktop popover needs ~780px (two min-w-9 grids + presets +
+	// popover padding); below that it overflows. Under 800px use a single calendar
+	// with a Start/End toggle, which keeps each bound's date + time inputs.
+	const TWO_CALENDAR_MIN_WIDTH = 800
+	let innerWidth = $state<number | undefined>(undefined)
+	const isSmall = $derived(innerWidth != undefined && innerWidth < TWO_CALENDAR_MIN_WIDTH)
+	let smallBound = $state<'start' | 'end'>('start')
+
 	function onManualInput(input: { minTs?: string | null; maxTs?: string | null }) {
 		if (value.type !== 'manual')
 			value = buildManualTimeframe(input.minTs ?? null, input.maxTs ?? null)
@@ -113,6 +123,22 @@
 	}
 </script>
 
+<svelte:window bind:innerWidth />
+
+{#snippet presetButtons()}
+	{#each items as item (item.label)}
+		<Button
+			onClick={() => (value = { ...item })}
+			variant="subtle"
+			unifiedSize="md"
+			selected={value.label === item.label}
+			btnClasses="justify-start text-nowrap"
+		>
+			{item.label}
+		</Button>
+	{/each}
+{/snippet}
+
 <div class="relative flex {wrapperClasses}">
 	<Button
 		unifiedSize="md"
@@ -134,7 +160,12 @@
 			Reset
 		</Button>
 	{/if}
-	<Popover enableFlyTransition bind:isOpen>
+	<Popover
+		enableFlyTransition
+		placement="bottom-end"
+		contentClasses={isSmall ? 'overflow-y-auto' : ''}
+		bind:isOpen
+	>
 		{#snippet trigger()}
 			<Button
 				unifiedSize="md"
@@ -152,41 +183,63 @@
 					value.type === 'manual' && value.minTs ? new Date(value.minTs) : undefined
 				)
 			}}
-			<div class="flex divide-x">
-				<div class="flex flex-col p-2">
-					{#each items as item}
-						<Button
-							onClick={() => (value = { ...item })}
-							variant="subtle"
-							unifiedSize="md"
-							selected={value.label === item.label}
-							btnClasses="justify-start text-nowrap"
-						>
-							{item.label}
-						</Button>
-					{/each}
+			{#if isSmall}
+				<div class="flex flex-col divide-y max-w-[calc(100vw-2rem)]">
+					<div class="flex flex-row flex-wrap gap-1 p-2">
+						{@render presetButtons()}
+					</div>
+					<div class="flex flex-col gap-2 p-2">
+						<ToggleButtonGroup bind:selected={smallBound} class="w-full">
+							{#snippet children({ item })}
+								<ToggleButton value="start" label="Start" {item} />
+								<ToggleButton value="end" label="End" {item} />
+							{/snippet}
+						</ToggleButtonGroup>
+						<InlineCalendarInput
+							class="w-full"
+							infiniteRange
+							portalSelects
+							mode="range"
+							onClickBehavior={smallBound === 'end' ? 'set-end' : 'set-start'}
+							bind:value={
+								() => range,
+								(v) =>
+									onManualInput(
+										smallBound === 'end'
+											? { maxTs: fromCalendarDate(v.end)?.toISOString() ?? null }
+											: { minTs: fromCalendarDate(v.start)?.toISOString() ?? null }
+									)
+							}
+						/>
+					</div>
 				</div>
-				<InlineCalendarInput
-					class="p-4 max-w-[18rem]"
-					infiniteRange
-					mode="range"
-					onClickBehavior="set-start"
-					bind:value={
-						() => range,
-						(v) => onManualInput({ minTs: fromCalendarDate(v.start)?.toISOString() ?? null })
-					}
-				/>
-				<InlineCalendarInput
-					class="p-4 max-w-[18rem]"
-					infiniteRange
-					mode="range"
-					onClickBehavior="set-end"
-					bind:value={
-						() => range,
-						(v) => onManualInput({ maxTs: fromCalendarDate(v.end)?.toISOString() ?? null })
-					}
-				/>
-			</div>
+			{:else}
+				<div class="flex divide-x">
+					<div class="flex flex-col p-2">
+						{@render presetButtons()}
+					</div>
+					<InlineCalendarInput
+						class="p-4 max-w-[18rem]"
+						infiniteRange
+						mode="range"
+						onClickBehavior="set-start"
+						bind:value={
+							() => range,
+							(v) => onManualInput({ minTs: fromCalendarDate(v.start)?.toISOString() ?? null })
+						}
+					/>
+					<InlineCalendarInput
+						class="p-4 max-w-[18rem]"
+						infiniteRange
+						mode="range"
+						onClickBehavior="set-end"
+						bind:value={
+							() => range,
+							(v) => onManualInput({ maxTs: fromCalendarDate(v.end)?.toISOString() ?? null })
+						}
+					/>
+				</div>
+			{/if}
 		{/snippet}
 	</Popover>
 </div>

From 9705d602848966f850613233d6e23b73a753c259 Mon Sep 17 00:00:00 2001
From: Guilhem <guilhemlemouel@gmail.com>
Date: Wed, 15 Jul 2026 17:56:19 +0200
Subject: [PATCH 005/171] fix(frontend): keep session-exit URL clean by syncing
 new_draft strip with the router (#10101)

* fix(frontend): keep session-exit URL clean by syncing new_draft strip with the router

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore(frontend): correct replaceState comment and test-mock wording per review

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* docs(frontend): correct replaceState comment and drop drafting-history phrasing

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 frontend/src/lib/newDraftFlag.test.ts | 15 +++++++++++++++
 frontend/src/lib/newDraftFlag.ts      | 15 +++++++++++++--
 2 files changed, 28 insertions(+), 2 deletions(-)

diff --git a/frontend/src/lib/newDraftFlag.test.ts b/frontend/src/lib/newDraftFlag.test.ts
index 95063aa34c..4a2141817e 100644
--- a/frontend/src/lib/newDraftFlag.test.ts
+++ b/frontend/src/lib/newDraftFlag.test.ts
@@ -17,6 +17,18 @@ vi.mock('./localDraftHints.svelte', () => ({
 	setLocalDraftHint: vi.fn(),
 	getLocalDraftHint: () => hints.value
 }))
+// `stripNewDraftFlag` rewrites the URL through SvelteKit's `replaceState` and
+// refreshes the session-switch's remembered nav route. Mock those so the strip
+// is observable via `window.location.href` (mirroring jsdom) and the remembered
+// route can be asserted.
+const rememberNavRoute = vi.hoisted(() => vi.fn())
+vi.mock('$app/navigation', () => ({
+	replaceState: (url: URL | string, _state: unknown) => {
+		window.location.href = new URL(url, window.location.href).toString()
+	}
+}))
+vi.mock('$app/state', () => ({ page: { state: {} } }))
+vi.mock('$lib/components/sessions/sessionSwitch.svelte', () => ({ rememberNavRoute }))
 
 import { UserDraftDbSyncer } from './userDraftDbSyncer.svelte'
 import { stripNewDraftFlagOnSave, shouldSeedNewDraft } from './newDraftFlag'
@@ -108,6 +120,9 @@ describe('stripNewDraftFlagOnSave', () => {
 		expect(window.location.href).not.toContain('new_draft')
 		// Sibling seeding params are preserved.
 		expect(window.location.href).toContain('template=foo')
+		// The remembered nav route is refreshed to the stripped URL so exiting an
+		// AI session returns here without re-adding ?new_draft.
+		expect(rememberNavRoute).toHaveBeenCalledWith('/scripts/edit/u/me/draft_d?template=foo')
 	})
 
 	it('does not strip on a delete save', async () => {
diff --git a/frontend/src/lib/newDraftFlag.ts b/frontend/src/lib/newDraftFlag.ts
index 20f45cf0e9..88e58f030a 100644
--- a/frontend/src/lib/newDraftFlag.ts
+++ b/frontend/src/lib/newDraftFlag.ts
@@ -1,16 +1,27 @@
+import { page } from '$app/state'
+import { replaceState } from '$app/navigation'
+import { rememberNavRoute } from '$lib/components/sessions/sessionSwitch.svelte'
 import { UserDraftDbSyncer, type UserDraftLastSyncQuery } from '$lib/userDraftDbSyncer.svelte'
 import { getLocalDraftHint } from '$lib/localDraftHints.svelte'
 import type { UserDraftItemKind } from '$lib/gen'
 
 /** Drop `?new_draft=true` from the current URL (preserving every other param),
  * mutating the address bar without a navigation. No-op when the flag is absent
- * or `window` is unavailable (SSR). */
+ * or `window` is unavailable (SSR).
+ *
+ * Uses SvelteKit's `replaceState` (not raw `history.replaceState`, which the
+ * router warns conflicts with it) so the history entry keeps the router's
+ * bookkeeping and `page.state`. Also refreshes the remembered nav route:
+ * `afterNavigate` never observes this in-place rewrite, so without it
+ * `exitSessionMode` would restore the pre-strip URL — still carrying
+ * `?new_draft=true` — and re-enter the seed-empty branch. */
 export function stripNewDraftFlag(): void {
 	if (typeof window === 'undefined') return
 	const url = new URL(window.location.href)
 	if (url.searchParams.get('new_draft') !== 'true') return
 	url.searchParams.delete('new_draft')
-	window.history.replaceState(window.history.state, '', url.toString())
+	replaceState(url, page.state)
+	rememberNavRoute(url.pathname + url.search)
 }
 
 /**

From 2092155191401474b6791dd02e2d15183aad3c60 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Wed, 15 Jul 2026 18:00:53 +0200
Subject: [PATCH 006/171] chore(main): release 1.760.0 (#10128)

* chore(main): release 1.760.0

* Apply automatic changes

---------

Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>
---
 CHANGELOG.md                                  |  22 +++
 backend/Cargo.lock                            | 164 +++++++++---------
 backend/Cargo.toml                            |   4 +-
 .../parsers/windmill-parser-wasm/Cargo.lock   |  48 ++---
 .../parsers/windmill-parser-wasm/Cargo.toml   |   2 +-
 backend/windmill-api/openapi.yaml             |   2 +-
 benchmarks/lib.ts                             |   2 +-
 cli/src/core/constants.ts                     |   2 +-
 frontend/package-lock.json                    |   4 +-
 frontend/package.json                         |   2 +-
 lsp/Pipfile                                   |   2 +-
 openflow.openapi.yaml                         |   2 +-
 .../WindmillClient/WindmillClient.psd1        |   2 +-
 python-client/wmill/pyproject.toml            |   2 +-
 typescript-client/jsr.json                    |   2 +-
 typescript-client/package.json                |   2 +-
 version.txt                                   |   2 +-
 17 files changed, 144 insertions(+), 122 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4ca0d1da5b..0e6a13c300 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,27 @@
 # Changelog
 
+## [1.760.0](https://github.com/windmill-labs/windmill/compare/v1.759.0...v1.760.0) (2026-07-15)
+
+
+### Features
+
+* **nsjail:** make python/ansible rlimit_as configurable per worker (GIT-921) ([#10138](https://github.com/windmill-labs/windmill/issues/10138)) ([1787201](https://github.com/windmill-labs/windmill/commit/17872018cc037e699b1f6e1589d0ad05e0883cca))
+
+
+### Bug Fixes
+
+* **ai:** disable redirects on worker AI provider client (GHSA-5q4v) ([#10122](https://github.com/windmill-labs/windmill/issues/10122)) ([27ead8d](https://github.com/windmill-labs/windmill/commit/27ead8d0848cceacaf0c49fed0e8896472b851e3))
+* **ai:** stop sending the AI agent system prompt twice for OpenAI ([#10126](https://github.com/windmill-labs/windmill/issues/10126)) ([8bfe5c9](https://github.com/windmill-labs/windmill/commit/8bfe5c93404ba3f137394f16d0571a06d891dc3b))
+* **apps:** invalidate cached app policy on change or deletion (GHSA-r5v4-cxh9-7qhq) ([#10121](https://github.com/windmill-labs/windmill/issues/10121)) ([f7eb5c4](https://github.com/windmill-labs/windmill/commit/f7eb5c460d78792c24297e20cb062638522a4f68))
+* **bash:** normalize CRLF line endings before running scripts ([#10131](https://github.com/windmill-labs/windmill/issues/10131)) ([6407d9f](https://github.com/windmill-labs/windmill/commit/6407d9ff5ce51e71ff8b8fc503d89a2bdc2e1761))
+* **cli-image:** patch fixable CRITICAL CVEs in windmill-cli image (GIT-922) ([#10135](https://github.com/windmill-labs/windmill/issues/10135)) ([5626768](https://github.com/windmill-labs/windmill/commit/56267684718944ef4d4ecd3b610bad81132e1990))
+* **frontend:** graceful small-screen timeframe picker on the runs page ([#10073](https://github.com/windmill-labs/windmill/issues/10073)) ([af177ce](https://github.com/windmill-labs/windmill/commit/af177cefe07e6037e33cc90757088a98fb63a49f))
+* **frontend:** keep session-exit URL clean by syncing new_draft strip with the router ([#10101](https://github.com/windmill-labs/windmill/issues/10101)) ([9705d60](https://github.com/windmill-labs/windmill/commit/9705d602848966f850613233d6e23b73a753c259))
+* **frontend:** only carry custom-tag overrides on 'Run again' ([#10137](https://github.com/windmill-labs/windmill/issues/10137)) ([bd3adc9](https://github.com/windmill-labs/windmill/commit/bd3adc9781d8e77928c9feb03d0e05b63a1aaf7c))
+* **frontend:** treat a displaced draft save as superseded, not failed ([#10094](https://github.com/windmill-labs/windmill/issues/10094)) ([2fe999f](https://github.com/windmill-labs/windmill/commit/2fe999f66cd15acd81850f970ada31e9892abff2))
+* reject git URL fragment/query SSRF bypass (GHSA-p5cj-8cfh-mjv6) ([#10120](https://github.com/windmill-labs/windmill/issues/10120)) ([73c8d7f](https://github.com/windmill-labs/windmill/commit/73c8d7f08ad55cd2323d1bb9438f00a8ac30e046))
+* **security:** enforce variables:write scope on resource-delete var cascade (GHSA-xmr2-98m6-cjf7) ([#10123](https://github.com/windmill-labs/windmill/issues/10123)) ([188647a](https://github.com/windmill-labs/windmill/commit/188647a942a0cb496d63c71bf3e0f7a3136ec217))
+
 ## [1.759.0](https://github.com/windmill-labs/windmill/compare/v1.758.0...v1.759.0) (2026-07-15)
 
 
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index 489390e83a..ea2a6eedde 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -5212,9 +5212,9 @@ checksum = "0cc23270f6e1808e30a928bdc84dea0b9b4136a8bc82338574f23baf47bbd280"
 
 [[package]]
 name = "globset"
-version = "0.4.18"
+version = "0.4.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52dfc19153a48bde0cbd630453615c8151bce3a5adfac7a0aebfbf0a1e1f57e3"
+checksum = "e47d37d2ae4464254884b60ab7071be2b876a9c35b696bd018ddcc76847309cd"
 dependencies = [
  "aho-corasick",
  "bstr",
@@ -10978,9 +10978,9 @@ checksum = "8003eb09806ff2ae4661dd0dca27cbd9f65ba85de06cc0302c364b0d661ba368"
 
 [[package]]
 name = "snap"
-version = "1.1.1"
+version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b6b67fb9a61334225b5b790716f609cd58395f895b3fe8b328786812a40bc3b"
+checksum = "199905e6153d6405f9728fe44daace35f8f837bbf830bb6e85fbd5828709a886"
 
 [[package]]
 name = "socket2"
@@ -13870,7 +13870,7 @@ dependencies = [
 
 [[package]]
 name = "windmill"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -13952,7 +13952,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-ai"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "async-stream",
  "async-trait",
@@ -13985,7 +13985,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-alerting"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -13998,7 +13998,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "argon2",
@@ -14136,7 +14136,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-agent-workers"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14159,7 +14159,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-assets"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14174,7 +14174,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-auth"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14200,7 +14200,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "reqwest 0.12.28",
  "serde",
@@ -14210,7 +14210,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-configs"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14227,7 +14227,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-debug"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "axum 0.8.9",
  "base64 0.22.1",
@@ -14249,7 +14249,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-embeddings"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14272,7 +14272,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flow-conversations"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14288,7 +14288,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flows"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14309,7 +14309,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-groups"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14330,7 +14330,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-inputs"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14344,7 +14344,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-integration-tests"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -14379,7 +14379,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-jobs"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14404,7 +14404,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-npm-proxy"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "axum 0.8.9",
  "flate2",
@@ -14422,7 +14422,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-openapi"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14444,7 +14444,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-schedule"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14464,7 +14464,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-scripts"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14501,7 +14501,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-settings"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14529,7 +14529,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-sse"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "lazy_static",
  "serde",
@@ -14541,7 +14541,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-users"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "argon2",
  "axum 0.8.9",
@@ -14566,7 +14566,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workers"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14580,7 +14580,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workspaces"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14615,7 +14615,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -14629,7 +14629,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14648,7 +14648,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "aes-gcm",
  "aho-corasick",
@@ -14750,7 +14750,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-dep-map"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "chrono",
  "itertools 0.14.0",
@@ -14769,7 +14769,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "regex",
  "serde",
@@ -14784,7 +14784,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "astral-tokio-tar",
@@ -14808,7 +14808,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-jseval"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -14825,7 +14825,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -14841,7 +14841,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-mcp"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -14862,7 +14862,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-native-triggers"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -14893,7 +14893,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-oauth"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "arc-swap",
@@ -14918,7 +14918,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-object-store"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "async-stream",
@@ -14952,7 +14952,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-operator"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -14970,7 +14970,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -14979,7 +14979,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -14991,7 +14991,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15003,7 +15003,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -15015,7 +15015,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15027,7 +15027,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15039,7 +15039,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -15050,7 +15050,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15061,7 +15061,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15073,7 +15073,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -15084,7 +15084,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15106,7 +15106,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15118,7 +15118,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15132,7 +15132,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -15149,7 +15149,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15162,7 +15162,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -15174,7 +15174,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15192,7 +15192,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -15208,7 +15208,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -15224,7 +15224,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -15235,7 +15235,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15274,7 +15274,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-runtime-nativets"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "const_format",
@@ -15314,7 +15314,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "getrandom 0.3.4",
  "wasm-bindgen",
@@ -15325,7 +15325,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-store"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15359,7 +15359,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-test-utils"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15383,7 +15383,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15416,7 +15416,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-azure"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15449,7 +15449,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-email"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15469,7 +15469,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-gcp"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15503,7 +15503,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-http"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15539,7 +15539,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-kafka"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15562,7 +15562,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-mqtt"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15586,7 +15586,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-nats"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -15610,7 +15610,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-postgres"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15645,7 +15645,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-sqs"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15673,7 +15673,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-websocket"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15698,7 +15698,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "bitflags 2.13.0",
@@ -15717,7 +15717,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "async-once-cell",
@@ -15827,7 +15827,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker-volumes"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "bytes",
  "futures",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index acaef26b20..d367cde7eb 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.759.0"
+version = "1.760.0"
 authors.workspace = true
 edition.workspace = true
 
@@ -87,7 +87,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal", "./parsers/windmill-parser-wasm"]
 
 [workspace.package]
-version = "1.759.0"
+version = "1.760.0"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.lock b/backend/parsers/windmill-parser-wasm/Cargo.lock
index 222292b087..46885ae98d 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.lock
+++ b/backend/parsers/windmill-parser-wasm/Cargo.lock
@@ -6191,7 +6191,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill-common"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "aho-corasick",
  "anyhow",
@@ -6272,7 +6272,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -6284,7 +6284,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "convert_case",
  "serde",
@@ -6293,7 +6293,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6305,7 +6305,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6317,7 +6317,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -6329,7 +6329,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6341,7 +6341,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6353,7 +6353,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -6364,7 +6364,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6375,7 +6375,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6387,7 +6387,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6398,7 +6398,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -6420,7 +6420,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6432,7 +6432,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6446,7 +6446,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "convert_case",
@@ -6463,7 +6463,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6476,7 +6476,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -6488,7 +6488,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6506,7 +6506,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -6522,7 +6522,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6538,7 +6538,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wasm"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "getrandom 0.2.17",
@@ -6570,7 +6570,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -6581,7 +6581,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.759.0"
+version = "1.760.0"
 dependencies = [
  "anyhow",
  "bitflags",
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.toml b/backend/parsers/windmill-parser-wasm/Cargo.toml
index 4a2ad50f4c..90cbce6838 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.toml
+++ b/backend/parsers/windmill-parser-wasm/Cargo.toml
@@ -12,7 +12,7 @@ resolver = "2"
 members = ["."]
 
 [workspace.package]
-version = "1.759.0"
+version = "1.760.0"
 edition = "2021"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 70bb50aa45..96b3f96bd6 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.759.0
+  version: 1.760.0
   title: Windmill API
 
   contact:
diff --git a/benchmarks/lib.ts b/benchmarks/lib.ts
index 1cc713ae60..81c57ac9d5 100644
--- a/benchmarks/lib.ts
+++ b/benchmarks/lib.ts
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.759.0";
+export const VERSION = "v1.760.0";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({
diff --git a/cli/src/core/constants.ts b/cli/src/core/constants.ts
index 6cd9394f19..991c0bd5b7 100644
--- a/cli/src/core/constants.ts
+++ b/cli/src/core/constants.ts
@@ -10,4 +10,4 @@ export const WM_FORK_PREFIX = "wm-fork";
 // (e.g. utils.ts) can read it without importing main.ts and creating a circular
 // dependency (main → workspace → utils → main) that triggers a TDZ.
 // Re-exported from main.ts for backwards compatibility.
-export const VERSION = "1.759.0";
+export const VERSION = "1.760.0";
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 8e4d5c8cbd..3fbc6b8126 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.759.0",
+	"version": "1.760.0",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "@windmill-labs/components",
-			"version": "1.759.0",
+			"version": "1.760.0",
 			"hasInstallScript": true,
 			"license": "AGPL-3.0",
 			"dependencies": {
diff --git a/frontend/package.json b/frontend/package.json
index 0015541e04..8445d86221 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.759.0",
+	"version": "1.760.0",
 	"scripts": {
 		"dev": "vite dev",
 		"dev:ui-builder": "mv static/ui_builder static/ui_builder.dev-disabled 2>/dev/null || true ; trap 'mv static/ui_builder.dev-disabled static/ui_builder 2>/dev/null || true' EXIT ; vite dev",
diff --git a/lsp/Pipfile b/lsp/Pipfile
index 62e6aea3c0..6ddaff60b0 100644
--- a/lsp/Pipfile
+++ b/lsp/Pipfile
@@ -4,7 +4,7 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-wmill = ">=1.759.0"
+wmill = ">=1.760.0"
 sendgrid = "*"
 mysql-connector-python = "*"
 pymongo = "*"
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index 1b5d938026..9973653550 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1,7 +1,7 @@
 openapi: '3.0.3'
 
 info:
-  version: 1.759.0
+  version: 1.760.0
   title: OpenFlow Spec
   contact:
     name: Ruben Fiszel
diff --git a/powershell-client/WindmillClient/WindmillClient.psd1 b/powershell-client/WindmillClient/WindmillClient.psd1
index ba13ab2a42..d137711c36 100644
--- a/powershell-client/WindmillClient/WindmillClient.psd1
+++ b/powershell-client/WindmillClient/WindmillClient.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'WindmillClient.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '1.759.0'
+    ModuleVersion     = '1.760.0'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()
diff --git a/python-client/wmill/pyproject.toml b/python-client/wmill/pyproject.toml
index 7a6a4ccf02..1ba4a31515 100644
--- a/python-client/wmill/pyproject.toml
+++ b/python-client/wmill/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill"
-version = "1.759.0"
+version = "1.760.0"
 description = "A client library for accessing Windmill server wrapping the Windmill client API"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/typescript-client/jsr.json b/typescript-client/jsr.json
index 6839da6bba..f454d94cc6 100644
--- a/typescript-client/jsr.json
+++ b/typescript-client/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@windmill/windmill",
-  "version": "1.759.0",
+  "version": "1.760.0",
   "exports": "./src/index.ts",
   "publish": {
     "exclude": ["!src", "./s3Types.ts", "./sqlUtils.ts", "./client.ts"]
diff --git a/typescript-client/package.json b/typescript-client/package.json
index aa2e068397..a90b8241ac 100644
--- a/typescript-client/package.json
+++ b/typescript-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.759.0",
+  "version": "1.760.0",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "homepage": "https://github.com/windmill-labs/windmill/tree/main/typescript-client#readme",
diff --git a/version.txt b/version.txt
index 67fbbd4999..920e44d956 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.759.0
+1.760.0

From 8c725d9e44e38bf3b35f41b847cdf8745e07942e Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Wed, 15 Jul 2026 21:18:15 +0200
Subject: [PATCH 007/171] fix(apps): honor presigned S3 signature on app
 display/preview routes (#10141)

The app provenance gate short-circuits on a valid presigned signature, but only the raw download_s3_file route parsed it. The parquet/csv/table-count/file-preview/metadata routes discarded sig/exp and always fell through to the provenance gate, so a presigned S3 object rendered as a table showed "File restricted" for any viewer who did not produce it. Thread sig/exp through every apps_u S3 display route and forward the presigned bearer from ParqetCsvTableRenderer/DisplayResult.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 backend/Cargo.lock                            |   2 +
 backend/Cargo.toml                            |   2 +
 backend/tests/app_s3_onbehalf.rs              | 125 ++++++++++++++++++
 backend/windmill-api/openapi.yaml             |  24 ++++
 backend/windmill-api/src/apps.rs              |  49 ++++---
 .../src/lib/components/DisplayResult.svelte   |   2 +
 .../components/ParqetCsvTableRenderer.svelte  |  29 +++-
 7 files changed, 214 insertions(+), 19 deletions(-)

diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index ea2a6eedde..21e390f4ea 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -13885,6 +13885,8 @@ dependencies = [
  "futures",
  "gethostname",
  "git-version",
+ "hex",
+ "hmac",
  "lazy_static",
  "once_cell",
  "opentelemetry 0.30.0",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index d367cde7eb..85b129ea0b 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -326,6 +326,8 @@ async-nats.workspace = true
 aws-sdk-sqs.workspace = true
 aws-config.workspace = true
 aws-credential-types.workspace = true
+hmac.workspace = true
+hex.workspace = true
 
 
 [workspace.dependencies]
diff --git a/backend/tests/app_s3_onbehalf.rs b/backend/tests/app_s3_onbehalf.rs
index 2e1085edd3..9dd96e30f1 100644
--- a/backend/tests/app_s3_onbehalf.rs
+++ b/backend/tests/app_s3_onbehalf.rs
@@ -144,6 +144,131 @@ async fn test_deployed_app_s3_onbehalf_provenance(db: Pool<Postgres>) -> anyhow:
     Ok(())
 }
 
+/// Mint a presigned bearer (`exp=..&sig=..`) exactly as `sign_s3_objects` does:
+/// `HMAC-SHA256(workspace_key, "file_key={s3}&exp={exp}")` (no storage param, since
+/// these routes send none). `validate_s3_signature` is `private`-gated, so this test
+/// only runs with the `private` feature.
+#[cfg(feature = "private")]
+fn mint_presigned(workspace_key: &str, s3: &str, exp: i64) -> String {
+    use hmac::{Hmac, Mac};
+    use sha2::Sha256;
+    let mut mac = Hmac::<Sha256>::new_from_slice(workspace_key.as_bytes()).unwrap();
+    mac.update(format!("file_key={s3}&exp={exp}").as_bytes());
+    let sig = hex::encode(mac.finalize().into_bytes());
+    format!("exp={exp}&sig={sig}")
+}
+
+/// A presigned S3 object (bearer minted by `signS3Objects`) bypasses the provenance
+/// gate on EVERY app-scoped display route, not just the raw `download_s3_file`
+/// download: a valid signature clears the gate on preview/count/metadata/csv routes,
+/// while an unsigned key stays denied and a forged/expired signature is rejected.
+#[cfg(feature = "private")]
+#[sqlx::test(fixtures("base"))]
+async fn test_deployed_app_s3_presigned_bypasses_gate(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let ws = format!("http://localhost:{port}/api/w/test-workspace");
+
+    let resp = authed(client().post(format!("{ws}/apps/create")), ADMIN_TOKEN)
+        .json(&json!({
+            "path": APP,
+            "summary": "s3 presigned test",
+            "value": {},
+            "policy": {
+                "execution_mode": "anonymous",
+                "triggerables": {},
+                "allowed_s3_keys": [{ "s3_path": DECLARED }]
+            }
+        }))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 201, "app create: {}", resp.text().await?);
+
+    let workspace_key: String = sqlx::query_scalar(
+        "SELECT key FROM workspace_key WHERE workspace_id = 'test-workspace' AND kind = 'cloud'",
+    )
+    .fetch_one(&db)
+    .await?;
+    let exp = chrono::Utc::now().timestamp() + 3600;
+    let presigned = mint_presigned(&workspace_key, NON_PROVENANCE, exp);
+
+    let get = |route: String, token: &'static str| {
+        let url = format!("{ws}/apps_u/{route}");
+        authed(client().get(url), token).send()
+    };
+    let denied = |body: &str| body.contains("File restricted");
+
+    // Control: NON_PROVENANCE without a signature is denied by the gate.
+    let body = get(
+        format!("download_s3_file/{APP}?s3={NON_PROVENANCE}"),
+        USER_TOKEN,
+    )
+    .await?
+    .text()
+    .await?;
+    assert!(
+        denied(&body),
+        "unsigned non-provenance key must be denied: {body}"
+    );
+
+    // Every display route: a valid presigned key clears the gate (falls through to
+    // the storage read, which fails with a storage error, never "File restricted").
+    // `read_bytes_*` are required on load_file_preview.
+    let routes = [
+        format!("download_s3_file/{APP}?s3={NON_PROVENANCE}&{presigned}"),
+        format!("load_table_count/{APP}?file_key={NON_PROVENANCE}&{presigned}"),
+        format!("load_csv_preview/{APP}?file_key={NON_PROVENANCE}&limit=5&offset=0&{presigned}"),
+        format!("load_parquet_preview/{APP}?file_key={NON_PROVENANCE}&limit=5&offset=0&{presigned}"),
+        format!("load_file_metadata/{APP}?file_key={NON_PROVENANCE}&{presigned}"),
+        format!(
+            "load_file_preview/{APP}?file_key={NON_PROVENANCE}&read_bytes_from=0&read_bytes_length=4096&{presigned}"
+        ),
+        format!("download_s3_parquet_file_as_csv/{APP}?file_key={NON_PROVENANCE}&{presigned}"),
+    ];
+    for route in routes {
+        let body = get(route.clone(), USER_TOKEN).await?.text().await?;
+        assert!(
+            !denied(&body),
+            "presigned key must bypass the gate on {route}: {body}"
+        );
+    }
+
+    // A tampered signature must NOT bypass: presence of `sig` commits to validation,
+    // so a wrong sig is rejected outright ("Invalid signature") rather than falling
+    // back to the provenance gate.
+    let forged = format!("exp={exp}&sig={}", "00".repeat(32));
+    let body = get(
+        format!("download_s3_file/{APP}?s3={NON_PROVENANCE}&{forged}"),
+        USER_TOKEN,
+    )
+    .await?
+    .text()
+    .await?;
+    assert!(
+        body.contains("Invalid signature"),
+        "forged signature must be rejected: {body}"
+    );
+
+    // An expired-but-valid signature is rejected on expiry, not bypassed.
+    let past = chrono::Utc::now().timestamp() - 10;
+    let expired = mint_presigned(&workspace_key, NON_PROVENANCE, past);
+    let body = get(
+        format!("download_s3_file/{APP}?s3={NON_PROVENANCE}&{expired}"),
+        USER_TOKEN,
+    )
+    .await?
+    .text()
+    .await?;
+    assert!(
+        body.contains("Signature expired"),
+        "expired signature must be rejected: {body}"
+    );
+
+    Ok(())
+}
+
 /// Seed a completed job whose result carries an s3 object. `app_trigger` sets the
 /// app-origination marker exactly as `execute_component` stamps it: `Some(app_path)`
 /// => `trigger_kind = 'app'` + `trigger = <app_path>` (an app-launched run);
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 96b3f96bd6..4df03ae467 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -12139,6 +12139,8 @@ paths:
           in: query
           schema:
             type: string
+        - $ref: "#/components/parameters/S3Sig"
+        - $ref: "#/components/parameters/S3Exp"
       responses:
         "200":
           description: FileMetadata
@@ -12191,6 +12193,8 @@ paths:
           in: query
           schema:
             type: string
+        - $ref: "#/components/parameters/S3Sig"
+        - $ref: "#/components/parameters/S3Exp"
       responses:
         "200":
           description: FilePreview
@@ -12241,6 +12245,8 @@ paths:
           in: query
           schema:
             type: string
+        - $ref: "#/components/parameters/S3Sig"
+        - $ref: "#/components/parameters/S3Exp"
       responses:
         "200":
           description: Parquet Preview
@@ -12293,6 +12299,8 @@ paths:
           in: query
           schema:
             type: string
+        - $ref: "#/components/parameters/S3Sig"
+        - $ref: "#/components/parameters/S3Exp"
       responses:
         "200":
           description: Csv Preview
@@ -12325,6 +12333,8 @@ paths:
           in: query
           schema:
             type: string
+        - $ref: "#/components/parameters/S3Sig"
+        - $ref: "#/components/parameters/S3Exp"
       responses:
         "200":
           description: Table count
@@ -12354,6 +12364,8 @@ paths:
           in: query
           schema:
             type: string
+        - $ref: "#/components/parameters/S3Sig"
+        - $ref: "#/components/parameters/S3Exp"
       responses:
         "200":
           description: The downloaded file
@@ -22660,6 +22672,18 @@ components:
       required: true
       schema:
         type: string
+    S3Sig:
+      name: sig
+      in: query
+      description: HMAC signature of a presigned S3 object (bypasses the app provenance gate)
+      schema:
+        type: string
+    S3Exp:
+      name: exp
+      in: query
+      description: Expiry timestamp of a presigned S3 object signature
+      schema:
+        type: string
     CustomPath:
       name: custom_path
       in: path
diff --git a/backend/windmill-api/src/apps.rs b/backend/windmill-api/src/apps.rs
index 8169a42677..fe10229af3 100644
--- a/backend/windmill-api/src/apps.rs
+++ b/backend/windmill-api/src/apps.rs
@@ -3896,6 +3896,10 @@ async fn check_if_allowed_to_access_s3_file_from_app(
         windmill_api_auth::scopes::has_app_embed_sentinel(authed.scopes.as_deref())
     });
 
+    // A valid presigned bearer is a self-authorizing capability, so it short-circuits
+    // the provenance gate. OSS builds cannot validate signatures (no workspace-key
+    // HMAC), so there the bearer is ignored and the request falls through to the
+    // checks below — the same path these routes took before presigning.
     if file_query.sig.is_some() {
         #[cfg(feature = "private")]
         {
@@ -3908,13 +3912,11 @@ async fn check_if_allowed_to_access_s3_file_from_app(
                 &db,
             )
             .await?;
-            Ok(())
+            return Ok(());
         }
-        #[cfg(not(feature = "private"))]
-        return Err(Error::InternalErr(
-            "Internal error: signature validation is not supported in open source mode".to_string(),
-        ));
-    } else if matches!(policy.execution_mode, ExecutionMode::Viewer) && !is_app_embed {
+    }
+
+    if matches!(policy.execution_mode, ExecutionMode::Viewer) && !is_app_embed {
         // Viewer mode: the on-behalf identity IS the viewer, so the downstream
         // get_workspace_s3_resource_and_check_paths already bounds the read by
         // their own perms — no provenance gate (it would over-restrict). Embed
@@ -4051,14 +4053,25 @@ async fn download_s3_file_from_app(
     .await
 }
 
+// Presigned bearer params (`exp=..&sig=..`) extracted as a second `Query` so the
+// app-scoped preview/count/metadata routes honor a presigned key the same way the
+// raw `download_s3_file` route does.
 #[cfg(feature = "parquet")]
-fn app_s3_file_query(s3: String, storage: Option<String>) -> AppS3FileQuery {
+#[derive(Deserialize)]
+struct AppS3Sig {
+    sig: Option<String>,
+    #[cfg(feature = "private")]
+    exp: Option<String>,
+}
+
+#[cfg(feature = "parquet")]
+fn app_s3_file_query(s3: String, storage: Option<String>, sig: AppS3Sig) -> AppS3FileQuery {
     AppS3FileQuery {
         s3,
         storage,
-        sig: None,
+        sig: sig.sig,
         #[cfg(feature = "private")]
-        exp: None,
+        exp: sig.exp,
     }
 }
 
@@ -4154,9 +4167,10 @@ async fn app_download_s3_parquet_file_as_csv(
     Extension(db): Extension<DB>,
     Path((w_id, path)): Path<(String, StripPath)>,
     Query(query): Query<DownloadFileQuery>,
+    Query(sig): Query<AppS3Sig>,
 ) -> Result<Response> {
     let path = path.to_path();
-    let file_query = app_s3_file_query(query.file_key.clone(), query.storage.clone());
+    let file_query = app_s3_file_query(query.file_key.clone(), query.storage.clone(), sig);
     let job_authed =
         app_s3_on_behalf_and_provenance(&db, &path, &w_id, &opt_authed, &file_query).await?;
     crate::job_helpers_oss::download_s3_parquet_file_as_csv_internal(
@@ -4179,9 +4193,10 @@ async fn app_load_file_metadata(
     Extension(db): Extension<DB>,
     Path((w_id, path)): Path<(String, StripPath)>,
     Query(query): Query<LoadFileMetadataQuery>,
+    Query(sig): Query<AppS3Sig>,
 ) -> Result<Response> {
     let path = path.to_path();
-    let file_query = app_s3_file_query(query.file_key.clone(), query.storage.clone());
+    let file_query = app_s3_file_query(query.file_key.clone(), query.storage.clone(), sig);
     let job_authed =
         app_s3_on_behalf_and_provenance(&db, &path, &w_id, &opt_authed, &file_query).await?;
     let resp =
@@ -4195,9 +4210,10 @@ async fn app_load_file_preview(
     Extension(db): Extension<DB>,
     Path((w_id, path)): Path<(String, StripPath)>,
     Query(query): Query<LoadFilePreviewQuery>,
+    Query(sig): Query<AppS3Sig>,
 ) -> Result<Response> {
     let path = path.to_path();
-    let file_query = app_s3_file_query(query.file_key.clone(), query.storage.clone());
+    let file_query = app_s3_file_query(query.file_key.clone(), query.storage.clone(), sig);
     let job_authed =
         app_s3_on_behalf_and_provenance(&db, &path, &w_id, &opt_authed, &file_query).await?;
     let resp =
@@ -4211,10 +4227,11 @@ async fn app_load_table_count(
     Extension(db): Extension<DB>,
     Path((w_id, path)): Path<(String, StripPath)>,
     Query(query): Query<AppLoadCountQuery>,
+    Query(sig): Query<AppS3Sig>,
 ) -> Result<Response> {
     let path = path.to_path();
     let (file_key, inner) = query.into_inner();
-    let file_query = app_s3_file_query(file_key.clone(), inner.storage.clone());
+    let file_query = app_s3_file_query(file_key.clone(), inner.storage.clone(), sig);
     let job_authed =
         app_s3_on_behalf_and_provenance(&db, &path, &w_id, &opt_authed, &file_query).await?;
     let resp =
@@ -4229,10 +4246,11 @@ async fn app_load_parquet_preview(
     Extension(db): Extension<DB>,
     Path((w_id, path)): Path<(String, StripPath)>,
     Query(query): Query<AppLoadPreviewQuery>,
+    Query(sig): Query<AppS3Sig>,
 ) -> Result<Response> {
     let path = path.to_path();
     let (file_key, inner) = query.into_inner();
-    let file_query = app_s3_file_query(file_key.clone(), inner.storage.clone());
+    let file_query = app_s3_file_query(file_key.clone(), inner.storage.clone(), sig);
     let job_authed =
         app_s3_on_behalf_and_provenance(&db, &path, &w_id, &opt_authed, &file_query).await?;
     let resp = crate::job_helpers_oss::load_preview_internal(
@@ -4248,10 +4266,11 @@ async fn app_load_csv_preview(
     Extension(db): Extension<DB>,
     Path((w_id, path)): Path<(String, StripPath)>,
     Query(query): Query<AppLoadPreviewQuery>,
+    Query(sig): Query<AppS3Sig>,
 ) -> Result<Response> {
     let path = path.to_path();
     let (file_key, inner) = query.into_inner();
-    let file_query = app_s3_file_query(file_key.clone(), inner.storage.clone());
+    let file_query = app_s3_file_query(file_key.clone(), inner.storage.clone(), sig);
     let job_authed =
         app_s3_on_behalf_and_provenance(&db, &path, &w_id, &opt_authed, &file_query).await?;
     let resp = crate::job_helpers_oss::load_preview_internal(
diff --git a/frontend/src/lib/components/DisplayResult.svelte b/frontend/src/lib/components/DisplayResult.svelte
index 4e0c5ef8aa..ae44015cb8 100644
--- a/frontend/src/lib/components/DisplayResult.svelte
+++ b/frontend/src/lib/components/DisplayResult.svelte
@@ -1060,6 +1060,7 @@
 										{appPath}
 										s3resource={s3object?.s3}
 										storage={s3object?.storage}
+										presigned={s3object?.presigned}
 									/>
 								{/key}
 							{:else if s3object?.s3?.endsWith('.png') || s3object?.s3?.endsWith('.jpeg') || s3object?.s3?.endsWith('.jpg') || s3object?.s3?.endsWith('.webp')}
@@ -1116,6 +1117,7 @@
 											{appPath}
 											s3resource={s3object?.s3}
 											storage={s3object?.storage}
+											presigned={s3object?.presigned}
 										/>{:else}
 										<button
 											class="text-primary whitespace-nowrap flex gap-2 items-center"
diff --git a/frontend/src/lib/components/ParqetCsvTableRenderer.svelte b/frontend/src/lib/components/ParqetCsvTableRenderer.svelte
index e7651e5703..70a182ea62 100644
--- a/frontend/src/lib/components/ParqetCsvTableRenderer.svelte
+++ b/frontend/src/lib/components/ParqetCsvTableRenderer.svelte
@@ -26,6 +26,10 @@
 		// through the app-scoped, provenance-gated `apps_u/*` endpoints instead of
 		// the viewer-scoped `job_helpers/*` API. Undefined in the editor/preview.
 		appPath?: string | undefined
+		// HMAC bearer (`exp=..&sig=..`) minted by `signS3Objects`. When present on a
+		// deployed-app read, it bypasses the provenance gate — matching the download
+		// and image routes. Forwarded to every app-scoped preview/count/export call.
+		presigned?: string | undefined
 	}
 
 	let {
@@ -33,9 +37,18 @@
 		storage,
 		workspaceId,
 		disable_download = false,
-		appPath = undefined
+		appPath = undefined,
+		presigned = undefined
 	}: Props = $props()
 
+	// Split the presigned bearer into typed query params for the generated client.
+	// Only meaningful in deployed-app (`appPath`) reads; empty otherwise.
+	function presignedParams(): { sig?: string; exp?: string } {
+		if (!appPath || !presigned) return {}
+		const p = new URLSearchParams(presigned)
+		return { sig: p.get('sig') ?? undefined, exp: p.get('exp') ?? undefined }
+	}
+
 	// Route the parquet/csv read through the app-scoped endpoints when `appPath`
 	// is set, else the viewer-scoped helpers. Same request/response shape either
 	// way — the only difference is which identity authorizes the S3 read.
@@ -48,7 +61,8 @@
 					fileKey: s3resource,
 					searchCol,
 					searchTerm,
-					storage
+					storage,
+					...presignedParams()
 				})
 			: HelpersService.loadTableRowCount({
 					workspace,
@@ -71,7 +85,14 @@
 		const workspace = workspaceId ?? $workspaceStore!
 		const csv = s3resource.endsWith('.csv')
 		if (appPath) {
-			const data = { workspace, path: appPath, fileKey: s3resource, storage, ...args }
+			const data = {
+				workspace,
+				path: appPath,
+				fileKey: s3resource,
+				storage,
+				...args,
+				...presignedParams()
+			}
 			return csv ? AppService.appLoadCsvPreview(data) : AppService.appLoadParquetPreview(data)
 		}
 		const data = { workspace, path: s3resource, storage, ...args }
@@ -230,7 +251,7 @@
 	{/if}
 	{#if !disable_download && !s3resource.endsWith('.csv')}
 		{@const csvApiPath = appPath
-			? `/w/${workspaceId}/apps_u/download_s3_parquet_file_as_csv/${appPath}?file_key=${encodeURIComponent(s3resource)}${storage ? `&storage=${storage}` : ''}`
+			? `/w/${workspaceId}/apps_u/download_s3_parquet_file_as_csv/${appPath}?file_key=${encodeURIComponent(s3resource)}${storage ? `&storage=${storage}` : ''}${presigned ? `&${presigned}` : ''}`
 			: `/w/${workspaceId}/job_helpers/download_s3_parquet_file_as_csv?file_key=${encodeURIComponent(s3resource)}${storage ? `&storage=${storage}` : ''}`}
 		{@const csvName = (s3resource.split('/').pop() ?? 'download') + '.csv'}
 		{#if shouldDownloadViaClient()}

From a935d06c8ee15690daced19746ab01e542d6c4c3 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Wed, 15 Jul 2026 21:29:39 +0200
Subject: [PATCH 008/171] chore(main): release 1.760.1 (#10142)

* chore(main): release 1.760.1

* Apply automatic changes

---------

Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>
---
 CHANGELOG.md                                  |   7 +
 backend/Cargo.lock                            | 164 +++++++++---------
 backend/Cargo.toml                            |   4 +-
 .../parsers/windmill-parser-wasm/Cargo.lock   |  48 ++---
 .../parsers/windmill-parser-wasm/Cargo.toml   |   2 +-
 backend/windmill-api/openapi.yaml             |   2 +-
 benchmarks/lib.ts                             |   2 +-
 cli/src/core/constants.ts                     |   2 +-
 frontend/package-lock.json                    |   4 +-
 frontend/package.json                         |   2 +-
 lsp/Pipfile                                   |   2 +-
 openflow.openapi.yaml                         |   2 +-
 .../WindmillClient/WindmillClient.psd1        |   2 +-
 python-client/wmill/pyproject.toml            |   2 +-
 typescript-client/jsr.json                    |   2 +-
 typescript-client/package.json                |   2 +-
 version.txt                                   |   2 +-
 17 files changed, 129 insertions(+), 122 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0e6a13c300..ed3e5e116b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.760.1](https://github.com/windmill-labs/windmill/compare/v1.760.0...v1.760.1) (2026-07-15)
+
+
+### Bug Fixes
+
+* **apps:** honor presigned S3 signature on app display/preview routes ([#10141](https://github.com/windmill-labs/windmill/issues/10141)) ([8c725d9](https://github.com/windmill-labs/windmill/commit/8c725d9e44e38bf3b35f41b847cdf8745e07942e))
+
 ## [1.760.0](https://github.com/windmill-labs/windmill/compare/v1.759.0...v1.760.0) (2026-07-15)
 
 
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index 21e390f4ea..cd6af43c36 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -2205,9 +2205,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.6.1"
+version = "4.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ddb117e43bbf7dacf0a4190fef4d345b9bad68dfc649cb349e7d17d28428e51"
+checksum = "dd059f9da4f5c36b3787f65d38ccaab1cc315f07b01f89abc8359ee6a8205011"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -2215,9 +2215,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.6.0"
+version = "4.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "714a53001bf66416adb0e2ef5ac857140e7dc3a0c48fb28b2f10762fc4b5069f"
+checksum = "f09628afdcc538b57f3c6341e9c8e9970f18e4a481690a64974d7023bd33548b"
 dependencies = [
  "anstream",
  "anstyle",
@@ -13870,7 +13870,7 @@ dependencies = [
 
 [[package]]
 name = "windmill"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -13954,7 +13954,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-ai"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "async-stream",
  "async-trait",
@@ -13987,7 +13987,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-alerting"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14000,7 +14000,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "argon2",
@@ -14138,7 +14138,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-agent-workers"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14161,7 +14161,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-assets"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14176,7 +14176,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-auth"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14202,7 +14202,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "reqwest 0.12.28",
  "serde",
@@ -14212,7 +14212,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-configs"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14229,7 +14229,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-debug"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "axum 0.8.9",
  "base64 0.22.1",
@@ -14251,7 +14251,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-embeddings"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14274,7 +14274,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flow-conversations"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14290,7 +14290,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flows"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14311,7 +14311,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-groups"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14332,7 +14332,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-inputs"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14346,7 +14346,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-integration-tests"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -14381,7 +14381,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-jobs"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14406,7 +14406,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-npm-proxy"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "axum 0.8.9",
  "flate2",
@@ -14424,7 +14424,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-openapi"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14446,7 +14446,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-schedule"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14466,7 +14466,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-scripts"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14503,7 +14503,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-settings"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14531,7 +14531,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-sse"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "lazy_static",
  "serde",
@@ -14543,7 +14543,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-users"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "argon2",
  "axum 0.8.9",
@@ -14568,7 +14568,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workers"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14582,7 +14582,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workspaces"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14617,7 +14617,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -14631,7 +14631,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14650,7 +14650,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "aes-gcm",
  "aho-corasick",
@@ -14752,7 +14752,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-dep-map"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "chrono",
  "itertools 0.14.0",
@@ -14771,7 +14771,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "regex",
  "serde",
@@ -14786,7 +14786,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "astral-tokio-tar",
@@ -14810,7 +14810,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-jseval"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "futures",
@@ -14827,7 +14827,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -14843,7 +14843,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-mcp"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -14864,7 +14864,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-native-triggers"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -14895,7 +14895,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-oauth"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "arc-swap",
@@ -14920,7 +14920,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-object-store"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "async-stream",
@@ -14954,7 +14954,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-operator"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "futures",
@@ -14972,7 +14972,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -14981,7 +14981,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -14993,7 +14993,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15005,7 +15005,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -15017,7 +15017,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15029,7 +15029,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15041,7 +15041,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -15052,7 +15052,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15063,7 +15063,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15075,7 +15075,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -15086,7 +15086,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15108,7 +15108,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15120,7 +15120,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15134,7 +15134,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -15151,7 +15151,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15164,7 +15164,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "serde",
@@ -15176,7 +15176,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15194,7 +15194,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -15210,7 +15210,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -15226,7 +15226,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "serde",
@@ -15237,7 +15237,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15276,7 +15276,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-runtime-nativets"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "const_format",
@@ -15316,7 +15316,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "getrandom 0.3.4",
  "wasm-bindgen",
@@ -15327,7 +15327,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-store"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15361,7 +15361,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-test-utils"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15385,7 +15385,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15418,7 +15418,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-azure"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15451,7 +15451,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-email"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15471,7 +15471,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-gcp"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15505,7 +15505,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-http"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15541,7 +15541,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-kafka"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15564,7 +15564,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-mqtt"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15588,7 +15588,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-nats"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -15612,7 +15612,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-postgres"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15647,7 +15647,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-sqs"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15675,7 +15675,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-websocket"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15700,7 +15700,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "bitflags 2.13.0",
@@ -15719,7 +15719,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "async-once-cell",
@@ -15829,7 +15829,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker-volumes"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "bytes",
  "futures",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 85b129ea0b..9551690cf0 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.760.0"
+version = "1.760.1"
 authors.workspace = true
 edition.workspace = true
 
@@ -87,7 +87,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal", "./parsers/windmill-parser-wasm"]
 
 [workspace.package]
-version = "1.760.0"
+version = "1.760.1"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.lock b/backend/parsers/windmill-parser-wasm/Cargo.lock
index 46885ae98d..f71ebedbe4 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.lock
+++ b/backend/parsers/windmill-parser-wasm/Cargo.lock
@@ -6191,7 +6191,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill-common"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "aho-corasick",
  "anyhow",
@@ -6272,7 +6272,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -6284,7 +6284,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "convert_case",
  "serde",
@@ -6293,7 +6293,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6305,7 +6305,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6317,7 +6317,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -6329,7 +6329,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6341,7 +6341,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6353,7 +6353,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -6364,7 +6364,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6375,7 +6375,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6387,7 +6387,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6398,7 +6398,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -6420,7 +6420,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6432,7 +6432,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6446,7 +6446,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "convert_case",
@@ -6463,7 +6463,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6476,7 +6476,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "serde",
@@ -6488,7 +6488,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6506,7 +6506,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -6522,7 +6522,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6538,7 +6538,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wasm"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "getrandom 0.2.17",
@@ -6570,7 +6570,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "serde",
@@ -6581,7 +6581,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.760.0"
+version = "1.760.1"
 dependencies = [
  "anyhow",
  "bitflags",
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.toml b/backend/parsers/windmill-parser-wasm/Cargo.toml
index 90cbce6838..24903d6edb 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.toml
+++ b/backend/parsers/windmill-parser-wasm/Cargo.toml
@@ -12,7 +12,7 @@ resolver = "2"
 members = ["."]
 
 [workspace.package]
-version = "1.760.0"
+version = "1.760.1"
 edition = "2021"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 4df03ae467..a731822c54 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.760.0
+  version: 1.760.1
   title: Windmill API
 
   contact:
diff --git a/benchmarks/lib.ts b/benchmarks/lib.ts
index 81c57ac9d5..34a898542d 100644
--- a/benchmarks/lib.ts
+++ b/benchmarks/lib.ts
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.760.0";
+export const VERSION = "v1.760.1";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({
diff --git a/cli/src/core/constants.ts b/cli/src/core/constants.ts
index 991c0bd5b7..305a1836be 100644
--- a/cli/src/core/constants.ts
+++ b/cli/src/core/constants.ts
@@ -10,4 +10,4 @@ export const WM_FORK_PREFIX = "wm-fork";
 // (e.g. utils.ts) can read it without importing main.ts and creating a circular
 // dependency (main → workspace → utils → main) that triggers a TDZ.
 // Re-exported from main.ts for backwards compatibility.
-export const VERSION = "1.760.0";
+export const VERSION = "1.760.1";
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 3fbc6b8126..1c1b983cfb 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.760.0",
+	"version": "1.760.1",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "@windmill-labs/components",
-			"version": "1.760.0",
+			"version": "1.760.1",
 			"hasInstallScript": true,
 			"license": "AGPL-3.0",
 			"dependencies": {
diff --git a/frontend/package.json b/frontend/package.json
index 8445d86221..a9838a73a4 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.760.0",
+	"version": "1.760.1",
 	"scripts": {
 		"dev": "vite dev",
 		"dev:ui-builder": "mv static/ui_builder static/ui_builder.dev-disabled 2>/dev/null || true ; trap 'mv static/ui_builder.dev-disabled static/ui_builder 2>/dev/null || true' EXIT ; vite dev",
diff --git a/lsp/Pipfile b/lsp/Pipfile
index 6ddaff60b0..98820f3272 100644
--- a/lsp/Pipfile
+++ b/lsp/Pipfile
@@ -4,7 +4,7 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-wmill = ">=1.760.0"
+wmill = ">=1.760.1"
 sendgrid = "*"
 mysql-connector-python = "*"
 pymongo = "*"
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index 9973653550..634e6387ea 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1,7 +1,7 @@
 openapi: '3.0.3'
 
 info:
-  version: 1.760.0
+  version: 1.760.1
   title: OpenFlow Spec
   contact:
     name: Ruben Fiszel
diff --git a/powershell-client/WindmillClient/WindmillClient.psd1 b/powershell-client/WindmillClient/WindmillClient.psd1
index d137711c36..01313ddfea 100644
--- a/powershell-client/WindmillClient/WindmillClient.psd1
+++ b/powershell-client/WindmillClient/WindmillClient.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'WindmillClient.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '1.760.0'
+    ModuleVersion     = '1.760.1'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()
diff --git a/python-client/wmill/pyproject.toml b/python-client/wmill/pyproject.toml
index 1ba4a31515..be4b577ecc 100644
--- a/python-client/wmill/pyproject.toml
+++ b/python-client/wmill/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill"
-version = "1.760.0"
+version = "1.760.1"
 description = "A client library for accessing Windmill server wrapping the Windmill client API"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/typescript-client/jsr.json b/typescript-client/jsr.json
index f454d94cc6..9ca1a210d7 100644
--- a/typescript-client/jsr.json
+++ b/typescript-client/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@windmill/windmill",
-  "version": "1.760.0",
+  "version": "1.760.1",
   "exports": "./src/index.ts",
   "publish": {
     "exclude": ["!src", "./s3Types.ts", "./sqlUtils.ts", "./client.ts"]
diff --git a/typescript-client/package.json b/typescript-client/package.json
index a90b8241ac..b3d040dc46 100644
--- a/typescript-client/package.json
+++ b/typescript-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.760.0",
+  "version": "1.760.1",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "homepage": "https://github.com/windmill-labs/windmill/tree/main/typescript-client#readme",
diff --git a/version.txt b/version.txt
index 920e44d956..1a33933b31 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.760.0
+1.760.1

From 0ea570570e65abf64b3b171e592a8dd3eea0b105 Mon Sep 17 00:00:00 2001
From: AlexRV12 <71396855+AlexRV12@users.noreply.github.com>
Date: Thu, 16 Jul 2026 11:17:20 +0200
Subject: [PATCH 009/171] feat(ai-sessions): CRUD markdown artifacts in
 sessions (#10046)

* feat: add IndexedDB persistence layer for AI-chat artifacts

* feat: add reactive store for AI-chat artifacts

* feat: add artifact chat tools and wire store lifecycle

* feat: add markdown artifact viewer with source toggle

* feat: surface session artifacts in the preview panel and chat list

* feat: tell the copilot when to use artifacts in the session prompt

* test(ai_evals): add artifact case and wire artifact helpers for session context

* fix(copilot): keep in-memory artifacts across same-session resyncs

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat: unify session composer edits/artifacts/jobs into a status line

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat: add an artifacts section to the session preview picker

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat: share markdown prose presets and restyle the artifact viewer

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* refactor: unify session status popovers into one keyboard-navigable shell

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix: reset first-block top margin in all markdown prose presets

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix: open the preview picker on the artifacts branch for an active artifact

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix: keep artifact picker scope independent of branch hydration state

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Guilhem Lemouel <guilhemlemouel@gmail.com>
---
 .../frontend/core/global/globalEvalRunner.ts  |  96 +++++++-
 ai_evals/cases/global.yaml                    |  24 ++
 ai_evals/core/types.ts                        |   2 +
 ai_evals/modes/global.ts                      |   1 +
 .../lib/components/chat/ChatMessage.svelte    |   3 +-
 .../copilot/chat/AIChatManager.svelte.ts      |  20 +-
 .../copilot/chat/AssistantMessage.svelte      |  16 +-
 .../copilot/chat/JobsSegment.svelte           | 142 ++++++------
 .../chat/artifacts/ArtifactViewer.svelte      |  97 ++++++++
 .../chat/artifacts/ArtifactsSegment.svelte    |  64 ++++++
 .../chat/artifacts/artifactTools.test.ts      | 162 +++++++++++++
 .../copilot/chat/artifacts/artifactTools.ts   | 163 +++++++++++++
 .../chat/artifacts/artifactsDB.test.ts        | 145 ++++++++++++
 .../copilot/chat/artifacts/artifactsDB.ts     | 108 +++++++++
 .../chat/artifacts/artifactsState.svelte.ts   | 134 +++++++++++
 .../chat/artifacts/artifactsState.test.ts     | 216 ++++++++++++++++++
 .../components/copilot/chat/global/core.ts    |  16 +-
 frontend/src/lib/components/markdownProse.ts  |  36 +++
 .../sessions/PreviewRouterPicker.svelte       |  52 ++++-
 .../components/sessions/PreviewTabHost.svelte |  38 +++
 .../sessions/SessionChangesBar.svelte         | 121 +++++-----
 .../sessions/SessionDiffDrawer.svelte         |   4 +-
 .../sessions/SessionStatusPopover.svelte      | 145 ++++++++++++
 .../sessions/SessionStatusToken.svelte        |  29 +++
 .../sessions/WorkspaceDiffDrawer.svelte       |  30 ++-
 .../components/sessions/previewRouter.test.ts |  44 +++-
 .../lib/components/sessions/previewRouter.ts  |  24 ++
 .../sessions/sessionPreviewTabs.svelte.ts     |  65 +++++-
 .../sessions/sessionPreviewTabs.test.ts       | 104 ++++++++-
 .../sessions/sessionRuntime.svelte.ts         |  14 ++
 .../sessions/sessionState.svelte.ts           |   6 +-
 .../sessions/sessionStateIndexedDb.test.ts    |  13 +-
 .../workspaceSettings/AiSkillsSettings.svelte |  10 +-
 .../(root)/(logged)/sessions/+page.svelte     |  39 +++-
 34 files changed, 1981 insertions(+), 202 deletions(-)
 create mode 100644 frontend/src/lib/components/copilot/chat/artifacts/ArtifactViewer.svelte
 create mode 100644 frontend/src/lib/components/copilot/chat/artifacts/ArtifactsSegment.svelte
 create mode 100644 frontend/src/lib/components/copilot/chat/artifacts/artifactTools.test.ts
 create mode 100644 frontend/src/lib/components/copilot/chat/artifacts/artifactTools.ts
 create mode 100644 frontend/src/lib/components/copilot/chat/artifacts/artifactsDB.test.ts
 create mode 100644 frontend/src/lib/components/copilot/chat/artifacts/artifactsDB.ts
 create mode 100644 frontend/src/lib/components/copilot/chat/artifacts/artifactsState.svelte.ts
 create mode 100644 frontend/src/lib/components/copilot/chat/artifacts/artifactsState.test.ts
 create mode 100644 frontend/src/lib/components/markdownProse.ts
 create mode 100644 frontend/src/lib/components/sessions/SessionStatusPopover.svelte
 create mode 100644 frontend/src/lib/components/sessions/SessionStatusToken.svelte

diff --git a/ai_evals/adapters/frontend/core/global/globalEvalRunner.ts b/ai_evals/adapters/frontend/core/global/globalEvalRunner.ts
index e553d15f56..8fe28d022a 100644
--- a/ai_evals/adapters/frontend/core/global/globalEvalRunner.ts
+++ b/ai_evals/adapters/frontend/core/global/globalEvalRunner.ts
@@ -3,7 +3,7 @@ import { tmpdir } from "os";
 import { join } from "path";
 import type { AIProvider } from "$lib/gen/types.gen";
 import {
-  globalTools,
+  globalToolsFor,
   prepareGlobalSystemMessage,
   prepareGlobalUserMessage,
 } from "../../../../../frontend/src/lib/components/copilot/chat/global/core";
@@ -43,6 +43,67 @@ const LIVE_EDITOR_ITEM_KINDS = {
   app: "raw_app",
 } as const;
 
+// SessionArtifactsStore can't run here (bun has no IndexedDB, nor the compiled $state runes),
+// so mirror only its tool-facing shape; its own logic (scoping, race guard) is unit-tested.
+const EVAL_SESSION_ID = "eval-session";
+function createEvalArtifactHelpers() {
+  const items = new Map<string, Record<string, unknown>>();
+  let seq = 0;
+  const store = {
+    create: async (sessionId: string, input: Record<string, any>) => {
+      const now = seq++;
+      const artifact = {
+        id: `eval-artifact-${now}`,
+        sessionId,
+        chatId: input.chatId,
+        kind: input.kind ?? "md",
+        name: input.name,
+        content: input.content,
+        createdAt: now,
+        updatedAt: now,
+      };
+      items.set(artifact.id, artifact);
+      return artifact;
+    },
+    get: async (id: string) => items.get(id),
+    update: async (
+      id: string,
+      input: Record<string, any>,
+      opts?: { sessionId?: string },
+    ) => {
+      const existing = items.get(id);
+      if (!existing) return undefined;
+      if (
+        opts?.sessionId !== undefined &&
+        existing.sessionId !== opts.sessionId
+      )
+        return undefined;
+      const updated = {
+        ...existing,
+        name: input.name ?? existing.name,
+        content: input.content ?? existing.content,
+        updatedAt: seq++,
+      };
+      items.set(id, updated);
+      return updated;
+    },
+    remove: async (id: string) => {
+      items.delete(id);
+    },
+    listForSession: async (sessionId: string) =>
+      [...items.values()].filter((a) => a.sessionId === sessionId),
+  };
+  return {
+    helpers: {
+      artifacts: store,
+      sessionId: EVAL_SESSION_ID,
+      getChatId: () => "eval-chat",
+      openArtifact: () => {},
+    },
+    snapshot: () => [...items.values()],
+  };
+}
+
 export interface GlobalLiveEditorDraftFixture {
   type: keyof typeof LIVE_EDITOR_ITEM_KINDS;
   storagePath?: string;
@@ -80,6 +141,8 @@ export interface GlobalEvalOptions {
   workspaceFixtures?: BenchmarkWorkspaceRunnables;
   liveEditorDrafts?: GlobalLiveEditorDraftFixture[];
   user?: GlobalUserFixture;
+  // Emulate a session chat (preview tools + session prompt); default false = standalone baseline.
+  sessionChat?: boolean;
   model?: string;
   maxIterations?: number;
   provider?: AIProvider;
@@ -98,7 +161,10 @@ export async function runGlobalEval(
     (await mkdtemp(join(tmpdir(), "wmill-frontend-global-benchmark-")));
 
   clearGlobalDrafts(workspaceRoot);
-  registerBenchmarkWorkspaceRunnables(workspaceRoot, options.workspaceFixtures ?? {});
+  registerBenchmarkWorkspaceRunnables(
+    workspaceRoot,
+    options.workspaceFixtures ?? {},
+  );
   seedLiveEditorDrafts(workspaceRoot, options.liveEditorDrafts ?? []);
 
   try {
@@ -107,18 +173,25 @@ export async function runGlobalEval(
       process.env[DISABLE_ACTIVE_EDITOR_CONTEXT_ENV] !== "1";
     // Pass the seeded identity straight to the prompt builder rather than mutating
     // the process-global `userStore`, so concurrent cases never race on it.
+    const evalArtifacts = createEvalArtifactHelpers();
     const rawResult = await runEval({
       userPrompt,
-      systemMessage: prepareGlobalSystemMessage(undefined, { user: options.user }),
+      systemMessage: prepareGlobalSystemMessage(undefined, {
+        user: options.user,
+        previewTools: options.sessionChat ?? false,
+      }),
       userMessage: prepareGlobalUserMessage(
         userPrompt,
         [],
         injectActiveEditorContext ? { workspace: workspaceRoot } : {},
       ),
-      tools: getGlobalEvalTools(),
-      helpers: {},
+      tools: getGlobalEvalTools(options.sessionChat ?? false),
+      helpers: evalArtifacts.helpers,
       apiKey,
-      getOutput: () => collectGlobalDraftState(workspaceRoot),
+      getOutput: async () => ({
+        ...(await collectGlobalDraftState(workspaceRoot)),
+        artifacts: evalArtifacts.snapshot(),
+      }),
       onAssistantMessageStart: options.runContext?.onAssistantMessageStart,
       onAssistantToken: options.runContext?.onAssistantChunk,
       onAssistantMessageEnd: options.runContext?.onAssistantMessageEnd,
@@ -213,10 +286,15 @@ function clearLiveEditorDrafts(
   }
 }
 
-function getGlobalEvalTools(): ProductionTool<{}>[] {
+// Gate session-preview tools on sessionChat, as production's globalToolsFor does.
+function getGlobalEvalTools(sessionChat: boolean): ProductionTool<{}>[] {
   const disableSearchApp = process.env[DISABLE_SEARCH_APP_ENV] === "1";
-  return (globalTools as ProductionTool<{}>[])
-    .filter((tool) => !(disableSearchApp && tool.def.function.name === "search_app"))
+  return (
+    globalToolsFor({ sessionPreview: sessionChat }) as ProductionTool<{}>[]
+  )
+    .filter(
+      (tool) => !(disableSearchApp && tool.def.function.name === "search_app"),
+    )
     .map((tool) => {
       if (!MUTATING_GLOBAL_TOOLS.has(tool.def.function.name)) {
         return tool;
diff --git a/ai_evals/cases/global.yaml b/ai_evals/cases/global.yaml
index 0f7f2a4717..775cfefa48 100644
--- a/ai_evals/cases/global.yaml
+++ b/ai_evals/cases/global.yaml
@@ -1055,6 +1055,7 @@
     You just opened the runs page for me in the side panel. Close that tab, I'm done looking at it.
   runtime:
     maxTurns: 6
+    sessionChat: true
   validate:
     draftCountExactly: 0
   toolExpect:
@@ -1509,3 +1510,26 @@
     - creates a new shared folder named "analytics" via create_folder
     - drafts a script placed in that folder (f/analytics/...) returning an ISO timestamp
     - leaves the script as a draft only
+
+- id: global-artifact-plan-create
+  prompt: |-
+    I'm about to build a customer onboarding flow, but first I want a short written plan I can review and iterate on before any code.
+    Draft a markdown plan with a title, a one-sentence summary, and three or four bullet steps.
+    Keep it as something I can reopen and revise later — don't build the flow itself yet.
+  initial: ai_evals/fixtures/frontend/global/initial/user_admin_empty.json
+  runtime:
+    maxTurns: 6
+    sessionChat: true
+  validate:
+    draftCountExactly: 0
+  toolExpect:
+    requiredToolsUsed:
+      - create_artifact
+    forbiddenToolsUsed:
+      - write_flow
+      - write_script
+      - deploy_workspace_item
+  judgeChecklist:
+    - saves the plan as a markdown artifact via create_artifact rather than only replying inline
+    - the artifact content has a title, a one-line summary, and three or four bullet steps for onboarding
+    - does not create a flow or script draft yet
diff --git a/ai_evals/core/types.ts b/ai_evals/core/types.ts
index f142bc8d36..83e9a218f3 100644
--- a/ai_evals/core/types.ts
+++ b/ai_evals/core/types.ts
@@ -31,6 +31,8 @@ export interface EvalCaseRuntimeSpec {
   maxTurns?: number;
   backendPreview?: EvalCaseRuntimeBackendPreview;
   appContext?: EvalCaseRuntimeAppContextSpec;
+  // Global mode: run as a session chat (preview tools + session prompt) vs the standalone chat.
+  sessionChat?: boolean;
 }
 
 export interface FlowValidationSpec {
diff --git a/ai_evals/modes/global.ts b/ai_evals/modes/global.ts
index 050a4caad9..5628c21d5d 100644
--- a/ai_evals/modes/global.ts
+++ b/ai_evals/modes/global.ts
@@ -41,6 +41,7 @@ export function createGlobalModeRunner(
           workspaceFixtures: initial?.workspace,
           liveEditorDrafts: initial?.liveEditorDrafts,
           user: initial?.user,
+          sessionChat: context.evalCase?.runtime?.sessionChat,
           maxIterations: context.evalCase?.runtime?.maxTurns,
           provider: modelConfig.provider,
           model: modelConfig.model,
diff --git a/frontend/src/lib/components/chat/ChatMessage.svelte b/frontend/src/lib/components/chat/ChatMessage.svelte
index f811abd0a2..181ca68700 100644
--- a/frontend/src/lib/components/chat/ChatMessage.svelte
+++ b/frontend/src/lib/components/chat/ChatMessage.svelte
@@ -6,6 +6,7 @@
 	import LinkRenderer from '$lib/components/copilot/chat/LinkRenderer.svelte'
 	import DisplayResult from '$lib/components/DisplayResult.svelte'
 	import { workspaceStore } from '$lib/stores'
+	import { markdownProse } from '$lib/components/markdownProse'
 
 	interface Props {
 		role: 'user' | 'assistant' | 'tool' | 'system'
@@ -103,7 +104,7 @@
 						<AlertTriangle class="w-3.5 h-3.5 text-red-500" />
 					{/if}
 				{/if}
-				<div class="prose prose-sm dark:prose-invert break-words prose-headings:!text-base">
+				<div class={markdownProse.sm}>
 					<Markdown
 						md={content}
 						plugins={[
diff --git a/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts b/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
index bbec8f69a9..5384c7dc0b 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
+++ b/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
@@ -110,6 +110,7 @@ import {
 import { scopedKey, onUserChange, migrateLegacyLocalStorage } from '$lib/userScopedStorage'
 import { getLocalSetting, storeLocalSetting } from '$lib/utils'
 import { AttachedFilesStore } from './files/attachedFiles.svelte'
+import { SessionArtifactsStore } from './artifacts/artifactsState.svelte'
 import { appendAttachedFilesRoster } from './files/fileTools'
 
 // SSR and users who prefer reduced motion get no typewriter pacing.
@@ -272,6 +273,8 @@ export class AIChatManager {
 	historyManager = new HistoryManager()
 	/** Files the user attached to the current GLOBAL-mode conversation. */
 	attachedFiles = new AttachedFilesStore()
+	/** Markdown artifacts the copilot created for the current session. */
+	artifacts = new SessionArtifactsStore()
 	abortController: AbortController | undefined = undefined
 	inlineAbortController: AbortController | undefined = undefined
 	// Flag to skip Responses API if it's not available (e.g., Azure region doesn't support it)
@@ -317,6 +320,8 @@ export class AIChatManager {
 	 * undefined in the global side-panel chat, where the tray falls back to opening
 	 * the run in a new browser tab. */
 	openRunInPreview?: (a: { jobId: string; workspace: string; label: string }) => void
+	openArtifact?: (artifactId: string, name: string) => void
+	closeArtifact?: (artifactId: string) => void
 	loading = $state<boolean>(false)
 	currentReply = $state<string>('')
 	currentReasoning = $state<string>('')
@@ -1465,7 +1470,13 @@ export class AIChatManager {
 			// permission gating. The global side-panel chat follows the live navigation
 			// workspace instead, so leave it unset there — allowedOpenPages reads the store.
 			...(this.isSessionChat
-				? { sessionId: this.sessionId, operatingWorkspace: this.operatingWorkspace }
+				? {
+						sessionId: this.sessionId,
+						operatingWorkspace: this.operatingWorkspace,
+						artifacts: this.artifacts,
+						getChatId: () => this.historyManager.getCurrentChatId(),
+						openArtifact: this.openArtifact
+					}
 				: {}),
 			testActiveFlow: async (args?: Record<string, any>) => this.flowAiChatHelpers?.testFlow(args),
 			attachedFiles: this.attachedFiles,
@@ -1491,6 +1502,7 @@ export class AIChatManager {
 			this.helpers = baseHelpers
 		}
 		this.systemMessage = systemMessage
+		this.syncArtifactsSession()
 	}
 
 	refreshGlobalSkills = async (workspace = this.operatingWorkspace ?? '') => {
@@ -2600,6 +2612,7 @@ export class AIChatManager {
 		// session, so "New chat" must clear them — otherwise the next, unrelated conversation
 		// would still get the previous file roster and could read/search it.
 		if (!this.isSessionChat) this.attachedFiles.clear()
+		this.syncArtifactsSession()
 		this.onChatRotated?.(this.historyManager.getCurrentChatId())
 	}
 
@@ -2637,10 +2650,15 @@ export class AIChatManager {
 			if (this.backgroundJobs.length > 0) this.backgroundJobs = [...this.backgroundJobs]
 			this.#ensureJobPoller()
 			this.#automaticScroll = true
+			this.syncArtifactsSession()
 			this.onChatRotated?.(id)
 		}
 	}
 
+	private syncArtifactsSession = () => {
+		void this.artifacts.setSession(this.isSessionChat ? this.sessionId : undefined)
+	}
+
 	get automaticScroll() {
 		return this.#automaticScroll
 	}
diff --git a/frontend/src/lib/components/copilot/chat/AssistantMessage.svelte b/frontend/src/lib/components/copilot/chat/AssistantMessage.svelte
index 80cd446d13..0f3f261f26 100644
--- a/frontend/src/lib/components/copilot/chat/AssistantMessage.svelte
+++ b/frontend/src/lib/components/copilot/chat/AssistantMessage.svelte
@@ -13,6 +13,7 @@
 		remarkWindmillPaths,
 		workspaceItemRegistry
 	} from './workspaceItems.svelte'
+	import { markdownProse } from '$lib/components/markdownProse'
 
 	interface Props {
 		message: DisplayMessage
@@ -97,11 +98,7 @@
 		{#if reasoningExpanded}
 			<div
 				transition:slide={{ duration: 150 }}
-				class="p-2 bg-surface text-secondary break-words prose prose-sm dark:prose-invert max-w-full leading-snug
-					prose-p:text-2xs prose-li:text-2xs prose-code:text-2xs prose-pre:text-2xs prose-ul:!pl-5
-					prose-headings:font-medium prose-headings:text-secondary prose-headings:mt-2 prose-headings:mb-1
-					prose-h1:text-2xs prose-h2:text-2xs prose-h3:text-2xs prose-h4:text-2xs prose-h5:text-2xs prose-h6:text-2xs
-					prose-strong:text-secondary"
+				class="p-2 bg-surface text-secondary {markdownProse.xs}"
 			>
 				<Markdown md={reasoning} plugins={[gfmPlugin()]} />
 			</div>
@@ -110,14 +107,7 @@
 {/if}
 
 {#if message.content}
-	<div
-		class="prose prose-sm dark:prose-invert w-full max-w-full leading-snug space-y-2 prose-ul:!pl-6
-			prose-p:text-xs prose-li:text-xs prose-code:text-xs prose-pre:text-xs
-			prose-code:break-words prose-a:break-words
-			prose-headings:font-medium prose-headings:text-emphasis prose-headings:mt-3 prose-headings:mb-1
-			prose-h1:text-sm prose-h2:text-xs prose-h3:text-xs prose-h4:text-xs prose-h5:text-xs prose-h6:text-xs
-			prose-table:block prose-table:max-w-full prose-table:overflow-x-auto prose-table:text-xs"
-	>
+	<div class="w-full space-y-2 {markdownProse.sm}">
 		<Markdown md={message.content} {plugins} />
 	</div>
 {/if}
diff --git a/frontend/src/lib/components/copilot/chat/JobsSegment.svelte b/frontend/src/lib/components/copilot/chat/JobsSegment.svelte
index 0bcb315bda..9a6d505b8a 100644
--- a/frontend/src/lib/components/copilot/chat/JobsSegment.svelte
+++ b/frontend/src/lib/components/copilot/chat/JobsSegment.svelte
@@ -3,11 +3,11 @@
 	import Badge from '$lib/components/common/badge/Badge.svelte'
 	import Modal from '$lib/components/common/modal/Modal.svelte'
 	import Portal from '$lib/components/Portal.svelte'
-	import Popover from '$lib/components/meltComponents/Popover.svelte'
+	import SessionStatusPopover from '$lib/components/sessions/SessionStatusPopover.svelte'
 	import { zIndexes } from '$lib/zIndexes'
 	import JobStatusIcon from '$lib/components/runs/JobStatusIcon.svelte'
 	import FlowStatusWaitingForEvents from '$lib/components/FlowStatusWaitingForEvents.svelte'
-	import { ChevronUp, ExternalLink, Hourglass, ThumbsUp, TimerOff } from 'lucide-svelte'
+	import { ChevronUp, Hourglass, ThumbsUp, TimerOff } from 'lucide-svelte'
 	import { base } from '$lib/base'
 	import { slide } from 'svelte/transition'
 	import { JobService, type Job } from '$lib/gen'
@@ -15,6 +15,7 @@
 	import { sendUserToast } from '$lib/toast'
 	import { getAiChatManager } from './aiChatManagerContext'
 	import { deriveChatJobStatus, type ChatJob, type ChatJobStatus } from './shared'
+	import { TOKEN_TRIGGER_CLASS } from '$lib/components/sessions/SessionStatusToken.svelte'
 
 	// The "Jobs" segment of the session bar: a compact status chip that summarizes
 	// the background jobs the chat started, opening a popover with the full list
@@ -104,12 +105,27 @@
 					danger: false
 				}
 			if (failureCount > 0)
-				return { dot: dotClass('failure'), pulse: false, text: `${jobs.length}`, danger: true }
+				return {
+					dot: dotClass('failure'),
+					pulse: false,
+					text: `${failureCount} failed`,
+					danger: true
+				}
 			// All terminal, none failed: green if anything actually succeeded, else gray
 			// (only canceled jobs left — a cancel isn't a success, so don't show green).
 			if (successCount > 0)
-				return { dot: dotClass('success'), pulse: false, text: `${jobs.length}`, danger: false }
-			return { dot: dotClass('canceled'), pulse: false, text: `${jobs.length}`, danger: false }
+				return {
+					dot: dotClass('success'),
+					pulse: false,
+					text: `${successCount} succeeded`,
+					danger: false
+				}
+			return {
+				dot: dotClass('canceled'),
+				pulse: false,
+				text: `${jobs.length} canceled`,
+				danger: false
+			}
 		}
 	)
 
@@ -191,7 +207,6 @@
 	}
 
 	// --- Popover open state + auto-open on approval ---
-	let popover: Popover | undefined = $state()
 	let open = $state(false)
 
 	// A job entering the approval state needs attention, so open the popover to
@@ -200,7 +215,7 @@
 	let prevApprovalCount = 0
 	$effect(() => {
 		const count = approvalCount
-		if (count > prevApprovalCount) popover?.open()
+		if (count > prevApprovalCount) open = true
 		prevApprovalCount = count
 	})
 
@@ -256,26 +271,33 @@
 	     even when the chip's visual change alone wouldn't be. role="status" already
 	     implies aria-live="polite". -->
 	<div class="sr-only" role="status">{announcement}</div>
-	<Popover
-		bind:this={popover}
-		bind:isOpen={open}
-		placement="top-end"
-		enableFlyTransition
+	<SessionStatusPopover
+		bind:open
+		label="Jobs"
+		{ariaLabel}
+		title="Jobs this session"
+		items={sortedJobs}
+		itemKey={(job) => job.jobId}
+		rowTitle={(job) => job.label}
+		onPick={openRun}
+		placement={standalone ? 'top-end' : 'top-start'}
 		usePointerDownOutside
-		class={standalone
+		closeOnOtherPopoverOpen={!standalone}
+		triggerClass={standalone
 			? 'flex h-[34px] w-full items-center rounded-md border bg-surface-tertiary px-3 hover:bg-surface-hover'
-			: 'flex h-full items-center px-3.5 hover:bg-surface-hover'}
-		triggerAttrs={{ 'aria-label': ariaLabel, 'aria-haspopup': 'dialog' }}
-		contentClasses="!bg-surface"
+			: TOKEN_TRIGGER_CLASS}
+		maxHeightClass={standalone ? 'max-h-[50vh]' : 'max-h-[min(12rem,50vh)]'}
 	>
-		{#snippet trigger()}
+		{#snippet customTrigger()}
 			<span class="flex min-w-0 items-center gap-2 text-xs">
-				<span class="shrink-0 font-normal text-primary">Jobs</span>
+				{#if standalone}
+					<span class="shrink-0 font-normal text-primary">Jobs</span>
+				{/if}
 				<span
 					class={`size-[7px] shrink-0 rounded-full ${segment.dot} ${segment.pulse ? 'motion-safe:animate-pulse' : ''}`}
 				></span>
 				<span
-					class={`min-w-0 truncate font-normal ${runningJob ? 'text-2xs' : 'text-xs'} ${segment.danger ? 'text-red-500' : 'text-primary'}`}
+					class={`min-w-0 truncate font-normal ${runningJob ? 'text-2xs' : 'text-xs'} ${segment.danger ? 'text-red-500' : standalone ? 'text-primary' : 'text-secondary'}`}
 					title={runningJob?.label ?? undefined}
 					dir={runningJob ? 'rtl' : undefined}
 				>
@@ -294,62 +316,42 @@
 				{/if}
 				<ChevronUp
 					size={14}
-					class={`shrink-0 text-secondary transition-transform duration-150 ${open ? 'rotate-180' : ''}`}
+					class={`shrink-0 ${standalone ? 'text-secondary' : 'text-tertiary'} transition-transform duration-150 ${open ? 'rotate-180' : ''}`}
 				/>
 			</span>
 		{/snippet}
 
-		{#snippet content()}
-			<div class="flex max-h-[50vh] w-80 flex-col text-xs">
-				<div class="border-b px-3 py-2 text-tertiary">Jobs this session</div>
-				<div class="min-h-0 flex-1 overflow-y-auto py-1">
-					{#each sortedJobs as job (job.jobId)}
-						<div class="flex items-center gap-2.5 px-3 py-1.5">
-							{#if job.status === 'queued' || !job.job}
-								<!-- Queued: match the job detail page's orange badge (JobStatusIcon's
-								     default queued badge is gray). Also covers the pre-first-fetch state. -->
-								<Badge color="orange" baseClass="!px-1.5" title="Queued"
-									><Hourglass size={13} /></Badge
-								>
-							{:else}
-								<JobStatusIcon job={job.job} />
-							{/if}
-							<span class="min-w-0 grow truncate text-secondary" title={job.label}>{job.label}</span
-							>
-							<span class="shrink-0 tabular-nums text-tertiary">{elapsedLabel(job)}</span>
-							<div class="flex shrink-0 items-center gap-1.5">
-								{#if job.status === 'suspended'}
-									<Button
-										unifiedSize="xs"
-										variant="accent"
-										startIcon={{ icon: ThumbsUp }}
-										on:click={() => openApproval(job)}>Approve</Button
-									>
-								{/if}
-								{#if !isTerminal(job.status)}
-									<Button
-										unifiedSize="xs"
-										variant="accent"
-										destructive
-										startIcon={{ icon: TimerOff }}
-										on:click={() => aiChatManager.cancelJob(job.jobId)}>Cancel</Button
-									>
-								{/if}
-								<Button
-									iconOnly
-									unifiedSize="xs"
-									variant="subtle"
-									startIcon={{ icon: ExternalLink }}
-									title="Open the run"
-									on:click={() => openRun(job)}
-								/>
-							</div>
-						</div>
-					{/each}
-				</div>
-			</div>
+		{#snippet row(job)}
+			{#if job.status === 'queued' || !job.job}
+				<!-- Queued: match the job detail page's orange badge (JobStatusIcon's
+				     default queued badge is gray). Also covers the pre-first-fetch state. -->
+				<Badge color="orange" baseClass="!px-1.5" title="Queued"><Hourglass size={13} /></Badge>
+			{:else}
+				<JobStatusIcon job={job.job} />
+			{/if}
+			<span class="min-w-0 grow truncate text-primary">{job.label}</span>
+			<span class="shrink-0 tabular-nums text-tertiary">{elapsedLabel(job)}</span>
 		{/snippet}
-	</Popover>
+		{#snippet actions(job)}
+			{#if job.status === 'suspended'}
+				<Button
+					unifiedSize="xs"
+					variant="accent"
+					startIcon={{ icon: ThumbsUp }}
+					on:click={() => openApproval(job)}>Approve</Button
+				>
+			{/if}
+			{#if !isTerminal(job.status)}
+				<Button
+					unifiedSize="xs"
+					variant="accent"
+					destructive
+					startIcon={{ icon: TimerOff }}
+					on:click={() => aiChatManager.cancelJob(job.jobId)}>Cancel</Button
+				>
+			{/if}
+		{/snippet}
+	</SessionStatusPopover>
 
 	<!-- Portal to <body> + a z-index above the editor: opened from deep in the
 	     sessions chat column, the modal would otherwise be trapped below the
diff --git a/frontend/src/lib/components/copilot/chat/artifacts/ArtifactViewer.svelte b/frontend/src/lib/components/copilot/chat/artifacts/ArtifactViewer.svelte
new file mode 100644
index 0000000000..2aadcca63d
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/artifacts/ArtifactViewer.svelte
@@ -0,0 +1,97 @@
+<script lang="ts">
+	import Markdown from 'svelte-exmarkdown'
+	import { gfmPlugin } from 'svelte-exmarkdown/gfm'
+	import { Code, Eye, FileText, Copy, Check, Download } from 'lucide-svelte'
+	import { Button } from '$lib/components/common'
+	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
+	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
+	import SimpleEditor from '$lib/components/SimpleEditor.svelte'
+	import { copyToClipboard, download } from '$lib/utils'
+	import CodeDisplay from '../script/CodeDisplay.svelte'
+	import LinkRenderer from '../LinkRenderer.svelte'
+	import { artifactFilename, artifactMimeType, type PersistedArtifact } from './artifactsDB'
+	import { markdownProse } from '$lib/components/markdownProse'
+
+	interface Props {
+		artifact: PersistedArtifact
+	}
+
+	let { artifact }: Props = $props()
+
+	// Markdown is the only rendered kind in v1; anything else shows source only.
+	const canPreview = $derived(artifact.kind === 'md')
+	let showSource = $state(false)
+	const source = $derived(!canPreview || showSource)
+
+	let copied = $state(false)
+	async function copyRaw() {
+		if (!(await copyToClipboard(artifact.content))) return
+		copied = true
+		setTimeout(() => (copied = false), 1500)
+	}
+	function downloadFile() {
+		download(artifactFilename(artifact), artifact.content, artifactMimeType(artifact.kind))
+	}
+
+	const plugins = [gfmPlugin(), { renderer: { pre: CodeDisplay, a: LinkRenderer } }]
+</script>
+
+<div class="flex flex-col h-full bg-surface-tertiary">
+	<div class="flex items-center justify-between gap-2 px-8 py-2">
+		<div class="flex items-center gap-1.5 min-w-0 flex-1">
+			<FileText size={14} class="shrink-0 text-secondary" />
+			<span class="truncate text-xs font-normal text-emphasis" title={artifact.name}>
+				{artifact.name}
+			</span>
+		</div>
+		<div class="flex items-center gap-2 shrink-0">
+			<!-- Copy raw markdown, with a dropdown for the download-as-file variant. -->
+			<Button
+				unifiedSize="sm"
+				variant="default"
+				startIcon={{ icon: copied ? Check : Copy }}
+				onClick={copyRaw}
+				title="Copy raw markdown"
+				dropdownItems={[{ label: 'Download as .md', icon: Download, onClick: downloadFile }]}
+			>
+				{copied ? 'Copied' : 'Copy'}
+			</Button>
+			{#if canPreview}
+				<ToggleButtonGroup
+					noWFull
+					selected={showSource ? 'source' : 'preview'}
+					onSelected={(v) => (showSource = v === 'source')}
+				>
+					{#snippet children({ item })}
+						<ToggleButton {item} value="preview" icon={Eye} iconOnly tooltip="Preview" size="sm" />
+						<ToggleButton
+							{item}
+							value="source"
+							icon={Code}
+							iconOnly
+							tooltip="View source"
+							size="sm"
+						/>
+					{/snippet}
+				</ToggleButtonGroup>
+			{/if}
+		</div>
+	</div>
+
+	<div class="flex-1 min-h-0 overflow-auto px-8">
+		{#if source}
+			<!-- key: SimpleEditor reads `code` only on init; remount on id or content change. -->
+			{#key `${artifact.id}:${artifact.updatedAt}`}
+				<SimpleEditor lang="markdown" code={artifact.content} readOnly class="h-full" />
+			{/key}
+		{:else}
+			<!-- Pinned under the header, fades scrolled-under content instead of hard-clipping it.
+			     The negative margin cancels its flow height so it overlays instead of pushing. -->
+			<div class="sticky top-0 z-10 h-4 -mb-4 bg-gradient-to-b from-surface-tertiary to-transparent"
+			></div>
+			<div class="pb-4 pt-2 {markdownProse.doc}">
+				<Markdown md={artifact.content} {plugins} />
+			</div>
+		{/if}
+	</div>
+</div>
diff --git a/frontend/src/lib/components/copilot/chat/artifacts/ArtifactsSegment.svelte b/frontend/src/lib/components/copilot/chat/artifacts/ArtifactsSegment.svelte
new file mode 100644
index 0000000000..96412d9b3c
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/artifacts/ArtifactsSegment.svelte
@@ -0,0 +1,64 @@
+<script lang="ts">
+	import { Button } from '$lib/components/common'
+	import TimeAgo from '$lib/components/TimeAgo.svelte'
+	import SessionStatusPopover from '$lib/components/sessions/SessionStatusPopover.svelte'
+	import { Download, Trash2 } from 'lucide-svelte'
+	import { download, displayDate } from '$lib/utils'
+	import { getAiChatManager } from '../aiChatManagerContext'
+	import { artifactFilename, artifactMimeType, type PersistedArtifact } from './artifactsDB'
+
+	const aiChatManager = getAiChatManager()
+	const artifacts = $derived(aiChatManager.artifacts.artifacts)
+	const label = $derived(`${artifacts.length} artifact${artifacts.length === 1 ? '' : 's'}`)
+
+	// Empty-at-0 gating is owned by the parent (SessionChangesBar) so the status
+	// line's separators stay correct; this renders unconditionally.
+	let open = $state(false)
+</script>
+
+<SessionStatusPopover
+	bind:open
+	{label}
+	title="Artifacts this session"
+	items={artifacts}
+	itemKey={(a) => a.id}
+	rowTitle={(a) => a.name}
+	onPick={(a: PersistedArtifact) => aiChatManager.openArtifact?.(a.id, a.name)}
+>
+	{#snippet row(a)}
+		<span class="min-w-0 flex-1 truncate font-normal text-primary">{a.name}</span>
+		<span
+			class="shrink-0 rounded bg-surface-secondary px-1 py-0.5 text-2xs font-normal uppercase text-tertiary"
+		>
+			{a.kind}
+		</span>
+		<span
+			class="min-w-[4.5rem] shrink-0 text-right text-2xs font-normal text-hint"
+			title={displayDate(new Date(a.updatedAt))}
+		>
+			<TimeAgo date={new Date(a.updatedAt).toISOString()} noSeconds />
+		</span>
+	{/snippet}
+	{#snippet actions(a)}
+		<Button
+			unifiedSize="xs"
+			variant="subtle"
+			iconOnly
+			title="Download"
+			startIcon={{ icon: Download }}
+			onClick={() => download(artifactFilename(a), a.content, artifactMimeType(a.kind))}
+		/>
+		<Button
+			unifiedSize="xs"
+			destructive
+			variant="subtle"
+			iconOnly
+			title="Delete"
+			startIcon={{ icon: Trash2 }}
+			onClick={() => {
+				aiChatManager.closeArtifact?.(a.id)
+				void aiChatManager.artifacts.remove(a.id)
+			}}
+		/>
+	{/snippet}
+</SessionStatusPopover>
diff --git a/frontend/src/lib/components/copilot/chat/artifacts/artifactTools.test.ts b/frontend/src/lib/components/copilot/chat/artifacts/artifactTools.test.ts
new file mode 100644
index 0000000000..0660708001
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/artifacts/artifactTools.test.ts
@@ -0,0 +1,162 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { IDBFactory } from 'fake-indexeddb'
+import type { Tool } from '../shared'
+
+// The real ../shared pulls the whole component/monaco graph, which the node test env can't
+// load. artifactTools only needs createToolDef to stamp the function name (as datatableTools.test).
+vi.mock('../shared', () => ({
+	createToolDef: (_schema: unknown, name: string, description: string) => ({
+		type: 'function',
+		function: { name, description, parameters: {} }
+	})
+}))
+
+// The user-scoping subscription is BROWSER-gated; the node test env reports false.
+vi.mock('esm-env', async (orig) => ({
+	...(await orig<typeof import('esm-env')>()),
+	BROWSER: true
+}))
+
+// Stub $lib/stores + $lib/utils (userScopedStorage's only deps here) to keep their heavy
+// svelte/app-store graphs out of the per-test cold transform.
+vi.mock('$lib/stores', async () => {
+	const { writable } = await import('svelte/store')
+	return { userStore: writable(undefined) }
+})
+vi.mock('$lib/utils', () => ({ getLocalSetting: () => undefined, storeLocalSetting: () => {} }))
+
+// Reset the memoised DB handle and install a fresh store per test (see artifactsDB tests).
+// sessionId has no default: passing undefined must stay undefined (the no-session case), not
+// fall back to 's1' as a defaulted parameter would. The DB is namespaced by email, so seed a user.
+async function fresh(sessionId: string | undefined) {
+	vi.resetModules()
+	;(globalThis as any).indexedDB = new IDBFactory()
+	;(await import('$lib/stores')).userStore.set({ email: 'a@x.com' } as never)
+	const { SessionArtifactsStore } = await import('./artifactsState.svelte')
+	const { artifactTools } = await import('./artifactTools')
+	const dbMod = await import('./artifactsDB')
+	const store = new SessionArtifactsStore()
+	const statuses: any[] = []
+	const opened: Array<[string, string]> = []
+	const helpers = {
+		artifacts: store,
+		sessionId,
+		getChatId: () => 'c1',
+		openArtifact: (id: string, name: string) => opened.push([id, name])
+	}
+	const byName = Object.fromEntries(artifactTools.map((t) => [t.def.function.name, t])) as Record<
+		string,
+		Tool<{}>
+	>
+	const call = (name: string, args: any) =>
+		byName[name].fn({
+			args,
+			workspace: 'w',
+			helpers,
+			toolId: 't',
+			toolCallbacks: { setToolStatus: (_id: string, m: any) => statuses.push(m) } as any
+		})
+	return { call, store, dbMod, statuses, opened }
+}
+
+let ctx: Awaited<ReturnType<typeof fresh>>
+beforeEach(async () => {
+	ctx = await fresh('s1')
+})
+
+describe('artifact tools', () => {
+	it('create_artifact persists (session-scoped, chat provenance) and opens the preview', async () => {
+		const res = JSON.parse(await ctx.call('create_artifact', { name: 'Plan', content: '# hi' }))
+		expect(res.success).toBe(true)
+		expect(res.name).toBe('Plan')
+		const stored = await ctx.dbMod.getArtifact(res.id)
+		expect(stored).toMatchObject({
+			name: 'Plan',
+			content: '# hi',
+			kind: 'md',
+			sessionId: 's1',
+			chatId: 'c1'
+		})
+		expect(ctx.opened).toEqual([[res.id, 'Plan']])
+	})
+
+	it('list_artifacts returns id/name/kind without content', async () => {
+		const a = JSON.parse(await ctx.call('create_artifact', { name: 'A', content: 'a' }))
+		const b = JSON.parse(await ctx.call('create_artifact', { name: 'B', content: 'b' }))
+		const list = JSON.parse(await ctx.call('list_artifacts', {}))
+		expect(list.map((x: any) => x.id).sort()).toEqual([a.id, b.id].sort())
+		expect(list.find((x: any) => x.id === b.id)).toEqual({ id: b.id, name: 'B', kind: 'md' })
+		expect(list[0]).not.toHaveProperty('content')
+	})
+
+	it('read_artifact returns the full content', async () => {
+		const a = JSON.parse(await ctx.call('create_artifact', { name: 'A', content: 'body' }))
+		const read = JSON.parse(await ctx.call('read_artifact', { id: a.id }))
+		expect(read).toMatchObject({ id: a.id, name: 'A', kind: 'md', content: 'body' })
+	})
+
+	it('list_artifacts still returns a create whose persist was swallowed', async () => {
+		await ctx.store.setSession('s1') // load the session so create reflects in the in-memory list
+		const created = JSON.parse(await ctx.call('create_artifact', { name: 'Ghost', content: 'x' }))
+		await ctx.dbMod.deleteArtifact(created.id) // mimic a quota-swallowed persist: gone from the DB
+		expect(await ctx.dbMod.getArtifact(created.id)).toBeUndefined()
+		// read and list both stay consistent via the in-memory fallback.
+		const list = JSON.parse(await ctx.call('list_artifacts', {}))
+		expect(list.map((x: any) => x.id)).toContain(created.id)
+	})
+
+	it('update_artifact overwrites content and persists', async () => {
+		const a = JSON.parse(await ctx.call('create_artifact', { name: 'A', content: 'v1' }))
+		const res = JSON.parse(await ctx.call('update_artifact', { id: a.id, content: 'v2' }))
+		expect(res.success).toBe(true)
+		expect((await ctx.dbMod.getArtifact(a.id))?.content).toBe('v2')
+	})
+
+	it('update_artifact reports a missing id', async () => {
+		const res = JSON.parse(await ctx.call('update_artifact', { id: 'nope', content: 'x' }))
+		expect(res.success).toBe(false)
+		expect(res.error).toMatch(/No artifact/)
+	})
+
+	it('read_artifact reports a missing id', async () => {
+		const res = JSON.parse(await ctx.call('read_artifact', { id: 'nope' }))
+		expect(res.success).toBe(false)
+	})
+
+	it('rejects content over the size cap without persisting', async () => {
+		const huge = 'x'.repeat(256 * 1024 + 1)
+		const res = JSON.parse(await ctx.call('create_artifact', { name: 'Big', content: huge }))
+		expect(res.success).toBe(false)
+		expect(res.error).toMatch(/too large/)
+		expect(await ctx.dbMod.listArtifactsForSession('s1')).toEqual([])
+	})
+
+	it('reports unavailable when there is no session', async () => {
+		const noSession = await fresh(undefined)
+		for (const name of ['create_artifact', 'list_artifacts', 'update_artifact', 'read_artifact']) {
+			const res = JSON.parse(await noSession.call(name, { id: 'x', name: 'A', content: 'a' }))
+			expect(res.success).toBe(false)
+			expect(res.error).toMatch(/inside an AI session/)
+		}
+	})
+
+	it('update_artifact and read_artifact ignore ids from another session', async () => {
+		// Belongs to s2; the tools resolve session 's1'.
+		await ctx.dbMod.putArtifact({
+			id: 'other',
+			sessionId: 's2',
+			chatId: 'c2',
+			kind: 'md',
+			name: 'Other',
+			content: 'secret',
+			createdAt: 0,
+			updatedAt: 0
+		})
+		const read = JSON.parse(await ctx.call('read_artifact', { id: 'other' }))
+		expect(read.success).toBe(false)
+		const updated = JSON.parse(await ctx.call('update_artifact', { id: 'other', content: 'x' }))
+		expect(updated.success).toBe(false)
+		// The other session's content is untouched.
+		expect((await ctx.dbMod.getArtifact('other'))?.content).toBe('secret')
+	})
+})
diff --git a/frontend/src/lib/components/copilot/chat/artifacts/artifactTools.ts b/frontend/src/lib/components/copilot/chat/artifacts/artifactTools.ts
new file mode 100644
index 0000000000..2716793a56
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/artifacts/artifactTools.ts
@@ -0,0 +1,163 @@
+import { z } from 'zod'
+import { createToolDef, type Tool } from '../shared'
+import type { SessionArtifactsStore } from './artifactsState.svelte'
+
+// The subset of GlobalToolHelpers these tools read. Kept local (not imported from
+// global/core) so the tools don't pull the whole global tool module — which would be a
+// circular import, since global/core registers these tools.
+type ArtifactToolHelpers = {
+	artifacts?: SessionArtifactsStore
+	sessionId?: string
+	getChatId?: () => string | undefined
+	openArtifact?: (artifactId: string, name: string) => void
+}
+
+const MAX_ARTIFACT_BYTES = 256 * 1024
+
+const createArtifactSchema = z.object({
+	name: z.string().describe('Short display title for the artifact.'),
+	content: z.string().describe('Full markdown content of the artifact.')
+})
+
+const updateArtifactSchema = z.object({
+	id: z.string().describe('Id of the artifact to update, from create_artifact or list_artifacts.'),
+	content: z.string().describe('New full markdown content, replacing the previous content.'),
+	name: z.string().optional().describe('New display title. Omit to keep the current one.')
+})
+
+const listArtifactsSchema = z.object({})
+
+const readArtifactSchema = z.object({
+	id: z.string().describe('Id of the artifact to read.')
+})
+
+function tooLarge(content: string): string | undefined {
+	const bytes = new TextEncoder().encode(content).length
+	if (bytes <= MAX_ARTIFACT_BYTES) return undefined
+	return `Content is too large (${bytes} bytes, limit ${MAX_ARTIFACT_BYTES}). Shorten or split it.`
+}
+
+const UNAVAILABLE = 'Artifacts are only available inside an AI session.'
+
+export const artifactTools: Tool<{}>[] = [
+	{
+		def: createToolDef(
+			createArtifactSchema,
+			'create_artifact',
+			'Create a markdown artifact in the current session.'
+		),
+		showDetails: true,
+		fn: async ({ args, toolId, toolCallbacks, helpers }) => {
+			const parsed = createArtifactSchema.parse(args)
+			const h = helpers as ArtifactToolHelpers
+			const sessionId = h.sessionId
+			if (!h.artifacts || !sessionId) {
+				toolCallbacks.setToolStatus(toolId, { content: UNAVAILABLE, error: UNAVAILABLE })
+				return JSON.stringify({ success: false, error: UNAVAILABLE })
+			}
+			const sizeError = tooLarge(parsed.content)
+			if (sizeError) {
+				toolCallbacks.setToolStatus(toolId, { content: sizeError, error: sizeError })
+				return JSON.stringify({ success: false, error: sizeError })
+			}
+			const artifact = await h.artifacts.create(sessionId, {
+				name: parsed.name,
+				content: parsed.content,
+				kind: 'md',
+				chatId: h.getChatId?.()
+			})
+			h.openArtifact?.(artifact.id, artifact.name)
+			toolCallbacks.setToolStatus(toolId, { content: `Created artifact "${artifact.name}"` })
+			return JSON.stringify({ success: true, id: artifact.id, name: artifact.name })
+		}
+	},
+	{
+		def: createToolDef(
+			updateArtifactSchema,
+			'update_artifact',
+			'Overwrite an existing markdown artifact by id.'
+		),
+		showDetails: true,
+		fn: async ({ args, toolId, toolCallbacks, helpers }) => {
+			const parsed = updateArtifactSchema.parse(args)
+			const h = helpers as ArtifactToolHelpers
+			const sessionId = h.sessionId
+			if (!h.artifacts || !sessionId) {
+				toolCallbacks.setToolStatus(toolId, { content: UNAVAILABLE, error: UNAVAILABLE })
+				return JSON.stringify({ success: false, error: UNAVAILABLE })
+			}
+			const sizeError = tooLarge(parsed.content)
+			if (sizeError) {
+				toolCallbacks.setToolStatus(toolId, { content: sizeError, error: sizeError })
+				return JSON.stringify({ success: false, error: sizeError })
+			}
+			const updated = await h.artifacts.update(
+				parsed.id,
+				{ content: parsed.content, name: parsed.name },
+				{ sessionId }
+			)
+			if (!updated) {
+				const error = `No artifact found with id "${parsed.id}".`
+				toolCallbacks.setToolStatus(toolId, { content: error, error })
+				return JSON.stringify({ success: false, error })
+			}
+			h.openArtifact?.(updated.id, updated.name)
+			toolCallbacks.setToolStatus(toolId, { content: `Updated artifact "${updated.name}"` })
+			return JSON.stringify({ success: true, id: updated.id, name: updated.name })
+		}
+	},
+	{
+		def: createToolDef(
+			listArtifactsSchema,
+			'list_artifacts',
+			"List the current session's artifacts (id, name, kind)."
+		),
+		fn: async ({ toolId, toolCallbacks, helpers }) => {
+			const h = helpers as ArtifactToolHelpers
+			const sessionId = h.sessionId
+			if (!h.artifacts || !sessionId) {
+				toolCallbacks.setToolStatus(toolId, { content: UNAVAILABLE, error: UNAVAILABLE })
+				return JSON.stringify({ success: false, error: UNAVAILABLE })
+			}
+			const items = await h.artifacts.listForSession(sessionId)
+			toolCallbacks.setToolStatus(toolId, {
+				content: `Listed ${items.length} artifact${items.length === 1 ? '' : 's'}`
+			})
+			return JSON.stringify(
+				items
+					.sort((a, b) => b.updatedAt - a.updatedAt)
+					.map((a) => ({ id: a.id, name: a.name, kind: a.kind }))
+			)
+		}
+	},
+	{
+		def: createToolDef(
+			readArtifactSchema,
+			'read_artifact',
+			"Read an artifact's full markdown content by id."
+		),
+		fn: async ({ args, toolId, toolCallbacks, helpers }) => {
+			const parsed = readArtifactSchema.parse(args)
+			const h = helpers as ArtifactToolHelpers
+			const sessionId = h.sessionId
+			if (!h.artifacts || !sessionId) {
+				toolCallbacks.setToolStatus(toolId, { content: UNAVAILABLE, error: UNAVAILABLE })
+				return JSON.stringify({ success: false, error: UNAVAILABLE })
+			}
+			const artifact = await h.artifacts.get(parsed.id)
+			// An id from another session reads as absent — list_artifacts is session-scoped.
+			if (!artifact || artifact.sessionId !== sessionId) {
+				const error = `No artifact found with id "${parsed.id}".`
+				toolCallbacks.setToolStatus(toolId, { content: error, error })
+				return JSON.stringify({ success: false, error })
+			}
+			toolCallbacks.setToolStatus(toolId, { content: `Read artifact "${artifact.name}"` })
+			return JSON.stringify({
+				id: artifact.id,
+				name: artifact.name,
+				kind: artifact.kind,
+				content: artifact.content
+			})
+		}
+	}
+]
diff --git a/frontend/src/lib/components/copilot/chat/artifacts/artifactsDB.test.ts b/frontend/src/lib/components/copilot/chat/artifacts/artifactsDB.test.ts
new file mode 100644
index 0000000000..442d9ea080
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/artifacts/artifactsDB.test.ts
@@ -0,0 +1,145 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { IDBFactory } from 'fake-indexeddb'
+import type { PersistedArtifact } from './artifactsDB'
+
+// The user-scoping subscription is BROWSER-gated; the node test env reports false.
+vi.mock('esm-env', async (orig) => ({
+	...(await orig<typeof import('esm-env')>()),
+	BROWSER: true
+}))
+
+// Stub $lib/stores + $lib/utils (userScopedStorage's only deps here) to keep their heavy
+// svelte/app-store graphs out of the per-test cold transform.
+vi.mock('$lib/stores', async () => {
+	const { writable } = await import('svelte/store')
+	return { userStore: writable(undefined) }
+})
+vi.mock('$lib/utils', () => ({ getLocalSetting: () => undefined, storeLocalSetting: () => {} }))
+
+function artifact(over: Partial<PersistedArtifact> = {}): PersistedArtifact {
+	return {
+		id: 'a1',
+		sessionId: 's1',
+		chatId: 'c1',
+		kind: 'md',
+		name: 'Doc',
+		content: '# hi',
+		createdAt: 0,
+		updatedAt: 0,
+		...over
+	}
+}
+
+// artifactsDB memoises its DB handle at module scope. Reset the module and install a
+// fresh IDBFactory before each test, then import through this helper so every test
+// opens its own empty database. The DB is namespaced by email, so seed a user.
+let userStore: { set: (v: unknown) => void }
+async function freshDb() {
+	vi.resetModules()
+	;(globalThis as any).indexedDB = new IDBFactory()
+	userStore = (await import('$lib/stores')).userStore as never
+	userStore.set({ email: 'a@x.com' })
+	return await import('./artifactsDB')
+}
+
+let db: Awaited<ReturnType<typeof freshDb>>
+beforeEach(async () => {
+	db = await freshDb()
+})
+
+describe('artifactsDB', () => {
+	it('derives filename and mime type from the artifact kind', () => {
+		expect(db.artifactFilename({ name: 'Plan', kind: 'md' })).toBe('Plan.md')
+		expect(db.artifactFilename({ name: 'Page', kind: 'html' })).toBe('Page.html')
+		expect(db.artifactMimeType('md')).toBe('text/markdown')
+		expect(db.artifactMimeType('html')).toBe('text/html')
+	})
+
+	it('round-trips an artifact through put/get', async () => {
+		await db.putArtifact(artifact({ id: 'x', name: 'Plan', content: 'body' }))
+		expect(await db.getArtifact('x')).toMatchObject({ id: 'x', name: 'Plan', content: 'body' })
+	})
+
+	it('get returns undefined for a missing id', async () => {
+		expect(await db.getArtifact('nope')).toBeUndefined()
+	})
+
+	it('put overwrites an existing record by id', async () => {
+		await db.putArtifact(artifact({ id: 'x', content: 'v1', updatedAt: 1 }))
+		await db.putArtifact(artifact({ id: 'x', content: 'v2', updatedAt: 2 }))
+		expect(await db.getArtifact('x')).toMatchObject({ content: 'v2', updatedAt: 2 })
+		expect(await db.listArtifactsForSession('s1')).toHaveLength(1)
+	})
+
+	it('lists only the requested session, and returns [] for an unknown one', async () => {
+		await db.putArtifact(artifact({ id: 'a', sessionId: 's1' }))
+		await db.putArtifact(artifact({ id: 'b', sessionId: 's1' }))
+		await db.putArtifact(artifact({ id: 'c', sessionId: 's2' }))
+		expect((await db.listArtifactsForSession('s1')).map((a) => a.id).sort()).toEqual(['a', 'b'])
+		expect(await db.listArtifactsForSession('missing')).toEqual([])
+	})
+
+	it('deletes a single artifact', async () => {
+		await db.putArtifact(artifact({ id: 'a' }))
+		await db.deleteArtifact('a')
+		expect(await db.getArtifact('a')).toBeUndefined()
+	})
+
+	it('deletes every artifact for a session, leaving others intact', async () => {
+		await db.putArtifact(artifact({ id: 'a', sessionId: 's1' }))
+		await db.putArtifact(artifact({ id: 'b', sessionId: 's1' }))
+		await db.putArtifact(artifact({ id: 'c', sessionId: 's2' }))
+		await db.deleteArtifactsForSession('s1')
+		expect(await db.listArtifactsForSession('s1')).toEqual([])
+		expect((await db.listArtifactsForSession('s2')).map((a) => a.id)).toEqual(['c'])
+	})
+
+	it('isolates artifacts between users on the same browser', async () => {
+		await db.putArtifact(artifact({ id: 'a', sessionId: 's1' }))
+		// A different user sees an empty, separate database...
+		userStore.set({ email: 'b@x.com' })
+		expect(await db.listArtifactsForSession('s1')).toEqual([])
+		await db.putArtifact(artifact({ id: 'b', sessionId: 's1' }))
+		// ...and switching back reveals only the first user's artifact.
+		userStore.set({ email: 'a@x.com' })
+		expect((await db.listArtifactsForSession('s1')).map((x) => x.id)).toEqual(['a'])
+	})
+
+	it('degrades gracefully when IndexedDB is unavailable', async () => {
+		vi.resetModules()
+		delete (globalThis as any).indexedDB
+		;(await import('$lib/stores')).userStore.set({ email: 'a@x.com' } as never)
+		const noDb = await import('./artifactsDB')
+		// Reads return empty; writes/deletes are no-ops rather than throwing.
+		await expect(noDb.putArtifact(artifact())).resolves.toBeUndefined()
+		expect(await noDb.getArtifact('a1')).toBeUndefined()
+		expect(await noDb.listArtifactsForSession('s1')).toEqual([])
+		await expect(noDb.deleteArtifact('a1')).resolves.toBeUndefined()
+		await expect(noDb.deleteArtifactsForSession('s1')).resolves.toBeUndefined()
+	})
+
+	it('swallows a write failure when the DB handle exists but the op rejects', async () => {
+		// The handle is present, but put/delete reject — the QuotaExceededError-shaped failure
+		// the plain no-handle test can't reach. Must not throw at the caller.
+		vi.resetModules()
+		vi.doMock('idb', () => ({
+			openDB: async () => ({
+				put: async () => {
+					throw new DOMException('quota', 'QuotaExceededError')
+				},
+				delete: async () => {
+					throw new DOMException('quota', 'QuotaExceededError')
+				}
+			}),
+			deleteDB: async () => {}
+		}))
+		try {
+			;(await import('$lib/stores')).userStore.set({ email: 'a@x.com' } as never)
+			const failing = await import('./artifactsDB')
+			await expect(failing.putArtifact(artifact())).resolves.toBeUndefined()
+			await expect(failing.deleteArtifact('a1')).resolves.toBeUndefined()
+		} finally {
+			vi.doUnmock('idb')
+		}
+	})
+})
diff --git a/frontend/src/lib/components/copilot/chat/artifacts/artifactsDB.ts b/frontend/src/lib/components/copilot/chat/artifacts/artifactsDB.ts
new file mode 100644
index 0000000000..ad10ddb216
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/artifacts/artifactsDB.ts
@@ -0,0 +1,108 @@
+// Scoped by sessionId (fixed for the session's life), not chatId: a session follows its
+// active chat's rotation, so chatId-keying would drop artifacts on each new conversation.
+import { type DBSchema as IDBSchema } from 'idb'
+import { userScopedDb } from '$lib/userScopedDb'
+
+export type ArtifactKind = 'md' | 'html'
+
+export interface PersistedArtifact {
+	id: string
+	sessionId: string
+	chatId?: string
+	kind: ArtifactKind
+	name: string
+	content: string
+	createdAt: number
+	updatedAt: number
+}
+
+export function artifactFilename(a: Pick<PersistedArtifact, 'name' | 'kind'>): string {
+	return `${a.name}.${a.kind === 'html' ? 'html' : 'md'}`
+}
+
+export function artifactMimeType(kind: ArtifactKind): string {
+	return kind === 'html' ? 'text/html' : 'text/markdown'
+}
+
+interface ArtifactsSchema extends IDBSchema {
+	items: {
+		key: string
+		value: PersistedArtifact
+		indexes: { 'by-session': string }
+	}
+}
+
+// User-scoped like the chat-history store these are keyed against: no cross-user
+// co-residency on a shared browser.
+const dbh = userScopedDb<ArtifactsSchema>('copilot-artifacts', {
+	version: 1,
+	upgrade(db) {
+		const store = db.createObjectStore('items', { keyPath: 'id' })
+		store.createIndex('by-session', 'sessionId')
+	}
+})
+
+function getDB() {
+	return dbh.whenReady()
+}
+
+export async function putArtifact(artifact: PersistedArtifact): Promise<void> {
+	const db = await getDB()
+	if (!db) return
+	try {
+		// A rejected write (most likely QuotaExceededError) leaves the artifact usable for the
+		// session but unpersisted — degrade like the reads rather than throwing at the caller.
+		await db.put('items', artifact)
+	} catch (err) {
+		console.error('Could not persist artifact', err)
+	}
+}
+
+export async function getArtifact(id: string): Promise<PersistedArtifact | undefined> {
+	const db = await getDB()
+	if (!db) return undefined
+	try {
+		return await db.get('items', id)
+	} catch (err) {
+		console.error('Could not read artifact', err)
+		return undefined
+	}
+}
+
+export async function listArtifactsForSession(sessionId: string): Promise<PersistedArtifact[]> {
+	const db = await getDB()
+	if (!db) return []
+	try {
+		return await db.getAllFromIndex('items', 'by-session', sessionId)
+	} catch (err) {
+		console.error('Could not read artifacts', err)
+		return []
+	}
+}
+
+export async function deleteArtifact(id: string): Promise<void> {
+	const db = await getDB()
+	if (!db) return
+	try {
+		await db.delete('items', id)
+	} catch (err) {
+		console.error('Could not delete artifact', err)
+	}
+}
+
+export async function deleteArtifactsForSession(sessionId: string): Promise<void> {
+	const db = await getDB()
+	if (!db) return
+	try {
+		const tx = db.transaction('items', 'readwrite')
+		const index = tx.store.index('by-session')
+		let cursor = await index.openCursor(sessionId)
+		while (cursor) {
+			await cursor.delete()
+			cursor = await cursor.continue()
+		}
+		await tx.done
+	} catch (err) {
+		console.error('Could not delete artifacts for session', err)
+	}
+}
diff --git a/frontend/src/lib/components/copilot/chat/artifacts/artifactsState.svelte.ts b/frontend/src/lib/components/copilot/chat/artifacts/artifactsState.svelte.ts
new file mode 100644
index 0000000000..43e6bbe72a
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/artifacts/artifactsState.svelte.ts
@@ -0,0 +1,134 @@
+import { randomUUID } from '$lib/utils/uuid'
+import {
+	deleteArtifact,
+	getArtifact,
+	listArtifactsForSession,
+	putArtifact,
+	type ArtifactKind,
+	type PersistedArtifact
+} from './artifactsDB'
+
+export interface CreateArtifactInput {
+	name: string
+	content: string
+	kind?: ArtifactKind
+	chatId?: string
+}
+
+export interface UpdateArtifactInput {
+	name?: string
+	content?: string
+}
+
+/**
+ * Reactive view of the active session's artifacts, owned by AIChatManager (like
+ * AttachedFilesStore). The consumer drives which session is loaded via setSession(); the
+ * write tools mutate through create/update/remove, which persist and update the in-memory
+ * list in one step.
+ */
+export class SessionArtifactsStore {
+	artifacts = $state<PersistedArtifact[]>([])
+	loading = $state(false)
+
+	#sessionId: string | undefined
+	// A later load always wins, even if an earlier DB read resolves after it.
+	#seq = 0
+
+	/** Load the given session's artifacts into the reactive list, if it changed. */
+	async setSession(sessionId: string | undefined): Promise<void> {
+		// Skip same-id resyncs: in-memory owns the loaded session, so a DB reload would
+		// drop artifacts whose best-effort persist failed.
+		if (sessionId === this.#sessionId) return
+		this.#sessionId = sessionId
+		await this.#load()
+	}
+
+	async #load(): Promise<void> {
+		const token = ++this.#seq
+		const id = this.#sessionId
+		if (!id) {
+			this.artifacts = []
+			this.loading = false
+			return
+		}
+		this.loading = true
+		const items = await listArtifactsForSession(id)
+		if (token !== this.#seq) return
+		this.artifacts = sortByUpdatedDesc(items)
+		this.loading = false
+	}
+
+	// Bump #seq so an in-flight #load (snapshot taken before this write) can't clobber it;
+	// that load early-returns without clearing loading, so clear it here.
+	#applyWrite(next: PersistedArtifact[]): void {
+		this.#seq++
+		this.artifacts = next
+		this.loading = false
+	}
+
+	async get(id: string): Promise<PersistedArtifact | undefined> {
+		// In-memory first: a write whose persist silently failed (quota) is still readable here.
+		return this.artifacts.find((a) => a.id === id) ?? (await getArtifact(id))
+	}
+
+	async listForSession(sessionId: string): Promise<PersistedArtifact[]> {
+		if (sessionId === this.#sessionId) return [...this.artifacts]
+		return sortByUpdatedDesc(await listArtifactsForSession(sessionId))
+	}
+
+	/** Persist a new artifact for `sessionId` and reflect it in the list if that session is loaded. */
+	async create(sessionId: string, input: CreateArtifactInput): Promise<PersistedArtifact> {
+		const now = Date.now()
+		const artifact: PersistedArtifact = {
+			id: randomUUID(),
+			sessionId,
+			chatId: input.chatId,
+			kind: input.kind ?? 'md',
+			name: input.name,
+			content: input.content,
+			createdAt: now,
+			updatedAt: now
+		}
+		await putArtifact(artifact)
+		if (sessionId === this.#sessionId) {
+			this.#applyWrite(sortByUpdatedDesc([artifact, ...this.artifacts]))
+		}
+		return artifact
+	}
+
+	/**
+	 * Merge changes into an existing artifact. Returns undefined if `id` is unknown, or if
+	 * `opts.sessionId` is given and the artifact belongs to a different session.
+	 */
+	async update(
+		id: string,
+		input: UpdateArtifactInput,
+		opts?: { sessionId?: string }
+	): Promise<PersistedArtifact | undefined> {
+		const existing = this.artifacts.find((a) => a.id === id) ?? (await getArtifact(id))
+		if (!existing) return undefined
+		if (opts?.sessionId !== undefined && existing.sessionId !== opts.sessionId) return undefined
+		const updated: PersistedArtifact = {
+			...existing,
+			name: input.name ?? existing.name,
+			content: input.content ?? existing.content,
+			updatedAt: Date.now()
+		}
+		await putArtifact(updated)
+		if (updated.sessionId === this.#sessionId) {
+			this.#applyWrite(sortByUpdatedDesc(this.artifacts.map((a) => (a.id === id ? updated : a))))
+		}
+		return updated
+	}
+
+	async remove(id: string): Promise<void> {
+		await deleteArtifact(id)
+		// Guard on presence: a no-op remove must not invalidate an in-flight load.
+		const next = this.artifacts.filter((a) => a.id !== id)
+		if (next.length !== this.artifacts.length) this.#applyWrite(next)
+	}
+}
+
+function sortByUpdatedDesc(items: PersistedArtifact[]): PersistedArtifact[] {
+	return [...items].sort((a, b) => b.updatedAt - a.updatedAt)
+}
diff --git a/frontend/src/lib/components/copilot/chat/artifacts/artifactsState.test.ts b/frontend/src/lib/components/copilot/chat/artifacts/artifactsState.test.ts
new file mode 100644
index 0000000000..6558d158dd
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/artifacts/artifactsState.test.ts
@@ -0,0 +1,216 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { IDBFactory } from 'fake-indexeddb'
+import { SessionArtifactsStore } from './artifactsState.svelte'
+import * as db from './artifactsDB'
+
+// The user-scoping subscription is BROWSER-gated; the node test env reports false.
+vi.mock('esm-env', async (orig) => ({
+	...(await orig<typeof import('esm-env')>()),
+	BROWSER: true
+}))
+
+// Stub $lib/stores + $lib/utils (userScopedStorage's only deps here) to keep their heavy
+// svelte/app-store graphs out of the per-test cold transform.
+vi.mock('$lib/stores', async () => {
+	const { writable } = await import('svelte/store')
+	return { userStore: writable(undefined) }
+})
+vi.mock('$lib/utils', () => ({ getLocalSetting: () => undefined, storeLocalSetting: () => {} }))
+
+// The DB module memoises its handle at module scope. A fresh IDBFactory per test only
+// isolates data once the handle is reset, so reset modules and re-import both together.
+// The DB is namespaced by email, so seed a user.
+async function fresh() {
+	vi.resetModules()
+	;(globalThis as any).indexedDB = new IDBFactory()
+	;(await import('$lib/stores')).userStore.set({ email: 'a@x.com' } as never)
+	const dbMod = await import('./artifactsDB')
+	const { SessionArtifactsStore: Store } = await import('./artifactsState.svelte')
+	return { dbMod, store: new Store() }
+}
+
+let store: SessionArtifactsStore
+let dbMod: typeof db
+beforeEach(async () => {
+	;({ store, dbMod } = await fresh())
+})
+
+describe('SessionArtifactsStore', () => {
+	it('loads the current session, newest-updated first', async () => {
+		await dbMod.putArtifact(mk({ id: 'old', sessionId: 's1', updatedAt: 1 }))
+		await dbMod.putArtifact(mk({ id: 'new', sessionId: 's1', updatedAt: 2 }))
+		await dbMod.putArtifact(mk({ id: 'other', sessionId: 's2', updatedAt: 3 }))
+
+		await store.setSession('s1')
+		expect(store.artifacts.map((a) => a.id)).toEqual(['new', 'old'])
+		expect(store.loading).toBe(false)
+	})
+
+	it('empties the list for an undefined session id', async () => {
+		await dbMod.putArtifact(mk({ id: 'a', sessionId: 's1' }))
+		await store.setSession('s1')
+		expect(store.artifacts).toHaveLength(1)
+
+		await store.setSession(undefined)
+		expect(store.artifacts).toEqual([])
+	})
+
+	it('a later setSession wins over an earlier in-flight load', async () => {
+		await dbMod.putArtifact(mk({ id: 'a', sessionId: 's1' }))
+		await dbMod.putArtifact(mk({ id: 'b', sessionId: 's2' }))
+
+		// Start both loads without awaiting the first; the last-started must win.
+		const first = store.setSession('s1')
+		const second = store.setSession('s2')
+		await Promise.all([first, second])
+		expect(store.artifacts.map((a) => a.id)).toEqual(['b'])
+	})
+
+	it('a create is not clobbered by an in-flight load with a stale snapshot', async () => {
+		// Hold the load open with a stale (empty) snapshot until after the create lands.
+		let releaseLoad!: (items: db.PersistedArtifact[]) => void
+		const held = new Promise<db.PersistedArtifact[]>((r) => (releaseLoad = r))
+		const spy = vi.spyOn(dbMod, 'listArtifactsForSession').mockReturnValueOnce(held)
+
+		const loading = store.setSession('s1') // #load starts, hangs on `held`
+		const created = await store.create('s1', { name: 'X', content: 'x' })
+		releaseLoad([]) // the load resolves late, snapshot predates the create
+		await loading
+		spy.mockRestore()
+
+		expect(store.artifacts.map((a) => a.id)).toEqual([created.id])
+		// The superseded load early-returns; the create must have cleared `loading`.
+		expect(store.loading).toBe(false)
+	})
+
+	it('create persists and prepends when the session is loaded', async () => {
+		await store.setSession('s1')
+		const created = await store.create('s1', { name: 'Plan', content: '# hi' })
+
+		expect(created.kind).toBe('md')
+		expect(store.artifacts.map((a) => a.id)).toEqual([created.id])
+		// Persisted: switching away and back reloads it from the DB.
+		await store.setSession('other')
+		await store.setSession('s1')
+		expect(store.artifacts.map((a) => a.name)).toEqual(['Plan'])
+	})
+
+	it('a same-session resync keeps an artifact whose persist failed', async () => {
+		await store.setSession('s1')
+		const created = await store.create('s1', { name: 'A', content: 'x' })
+		// Simulate a persist that never landed: drop it from the DB, keep it in memory.
+		await dbMod.deleteArtifact(created.id)
+		// A routine resync (chat rotation / global-mode reconfig) must not reload it away.
+		await store.setSession('s1')
+		expect(store.artifacts.map((a) => a.id)).toEqual([created.id])
+	})
+
+	it('create stamps the provenance chatId when supplied', async () => {
+		await store.setSession('s1')
+		const created = await store.create('s1', { name: 'Plan', content: 'x', chatId: 'c9' })
+		expect(created.chatId).toBe('c9')
+	})
+
+	it('create persists to another session without touching the loaded list', async () => {
+		await store.setSession('s1')
+		const created = await store.create('s2', { name: 'Elsewhere', content: 'x' })
+		expect(store.artifacts).toEqual([])
+		expect((await dbMod.listArtifactsForSession('s2')).map((a) => a.id)).toEqual([created.id])
+	})
+
+	it('update merges changes, bumps updatedAt, and persists', async () => {
+		await store.setSession('s1')
+		const created = await store.create('s1', { name: 'Plan', content: 'v1' })
+
+		const updated = await store.update(created.id, { content: 'v2' })
+		expect(updated?.content).toBe('v2')
+		expect(updated?.name).toBe('Plan')
+		expect(updated!.updatedAt).toBeGreaterThanOrEqual(created.updatedAt)
+		expect((await dbMod.getArtifact(created.id))?.content).toBe('v2')
+	})
+
+	it('update falls back to the DB when the target is not in the loaded list', async () => {
+		const created = await store.create('s2', { name: 'Off', content: 'v1' })
+		await store.setSession('s1') // s2 is not loaded
+
+		const updated = await store.update(created.id, { name: 'Renamed' })
+		expect(updated?.name).toBe('Renamed')
+		expect(updated?.content).toBe('v1')
+	})
+
+	it('update returns undefined for an unknown id', async () => {
+		await store.setSession('s1')
+		expect(await store.update('nope', { content: 'x' })).toBeUndefined()
+	})
+
+	it('get resolves from the in-memory list even when the DB lacks the record', async () => {
+		await store.setSession('s1')
+		const created = await store.create('s1', { name: 'A', content: 'x' })
+		// Simulate a persist that never landed: drop it from the DB, keep it in memory.
+		await dbMod.deleteArtifact(created.id)
+		expect((await store.get(created.id))?.id).toBe(created.id)
+	})
+
+	it('get falls back to the DB for an artifact outside the loaded list', async () => {
+		const created = await store.create('s2', { name: 'B', content: 'y' })
+		await store.setSession('s1') // s2 not loaded
+		expect((await store.get(created.id))?.id).toBe(created.id)
+		expect(await store.get('nope')).toBeUndefined()
+	})
+
+	it('listForSession returns the in-memory list for the loaded session, even when the DB lacks it', async () => {
+		await store.setSession('s1')
+		const created = await store.create('s1', { name: 'A', content: 'x' })
+		await dbMod.deleteArtifact(created.id) // persist "failed": gone from DB, kept in memory
+		expect((await store.listForSession('s1')).map((a) => a.id)).toEqual([created.id])
+	})
+
+	it('listForSession reads the DB for a session that is not loaded', async () => {
+		await store.create('s2', { name: 'B', content: 'y' })
+		await store.setSession('s1') // s2 not loaded
+		expect((await store.listForSession('s2')).map((a) => a.name)).toEqual(['B'])
+		expect(await store.listForSession('s1')).toEqual([])
+	})
+
+	it('update refuses an artifact from a different session when scoped by sessionId', async () => {
+		const created = await store.create('s2', { name: 'Off', content: 'v1' })
+		expect(await store.update(created.id, { content: 'v2' }, { sessionId: 's1' })).toBeUndefined()
+		// Unchanged in the DB.
+		expect((await dbMod.getArtifact(created.id))?.content).toBe('v1')
+		// Correct scope still updates.
+		expect(await store.update(created.id, { content: 'v2' }, { sessionId: 's2' })).toBeDefined()
+	})
+
+	it('update distinguishes an omitted field from an explicit empty string', async () => {
+		await store.setSession('s1')
+		const created = await store.create('s1', { name: 'Plan', content: 'body' })
+
+		// Omitting content leaves it untouched...
+		expect((await store.update(created.id, { name: 'Renamed' }))?.content).toBe('body')
+		// ...but an explicit empty string blanks it.
+		expect((await store.update(created.id, { content: '' }))?.content).toBe('')
+	})
+
+	it('remove deletes from the DB and the loaded list', async () => {
+		await store.setSession('s1')
+		const created = await store.create('s1', { name: 'Plan', content: 'x' })
+
+		await store.remove(created.id)
+		expect(store.artifacts).toEqual([])
+		expect(await dbMod.getArtifact(created.id)).toBeUndefined()
+	})
+})
+
+function mk(over: Partial<db.PersistedArtifact> = {}): db.PersistedArtifact {
+	return {
+		id: 'a1',
+		sessionId: 's1',
+		chatId: 'c1',
+		kind: 'md',
+		name: 'Doc',
+		content: '# hi',
+		createdAt: 0,
+		updatedAt: 0,
+		...over
+	}
+}
diff --git a/frontend/src/lib/components/copilot/chat/global/core.ts b/frontend/src/lib/components/copilot/chat/global/core.ts
index 738de05caf..3254f555f8 100644
--- a/frontend/src/lib/components/copilot/chat/global/core.ts
+++ b/frontend/src/lib/components/copilot/chat/global/core.ts
@@ -82,6 +82,8 @@ import type { ContextElement } from '../context'
 import { getDatatableTools } from '../datatableTools'
 import { fileTools } from '../files/fileTools'
 import type { AttachedFilesStore } from '../files/attachedFiles.svelte'
+import { artifactTools } from '../artifacts/artifactTools'
+import type { SessionArtifactsStore } from '../artifacts/artifactsState.svelte'
 import { UserDraft } from '$lib/userDraft.svelte'
 import { emptySchema } from '$lib/utils'
 import { inferArgs } from '$lib/infer'
@@ -928,7 +930,8 @@ Rules:
 - Building a data pipeline: call open_preview(kind="pipeline", path="<folder>") as the FIRST step, before creating any node — this opens the pipeline editor the user reviews in. path is the folder, not an item; an empty or not-yet-created folder is fine (create_folder first if needed, then open it). Opening it registers build_pipeline_node / edit_pipeline_node — use ONLY those to add or change pipeline nodes, never write_script for a pipeline node — they apply directly as unsaved drafts on the canvas (no separate accept/reject step) that the user reviews and deploys. Do not write pipeline scripts without first opening the editor.
 - When debugging a running raw app, call get_app_runtime_logs to read the live preview's browser console output. It needs the raw app preview open (open_preview kind="raw_app").
 - get_app_runtime_logs only shows the app's browser console. For the server-side logs of a backend runnable the app invoked (a backend.<id> call), call list_app_runs to get that run's job_id from the live preview, then get_job_logs with it. Use this when a backend call errors or returns something unexpected.
-- open_page opens its page as a tab in the side-panel preview next to the chat — the only way to show one of these pages there (open_preview only handles editable items). Changing filters on a page already open updates that same tab; only pass new_tab when the user explicitly asks for a separate tab.`
+- open_page opens its page as a tab in the side-panel preview next to the chat — the only way to show one of these pages there (open_preview only handles editable items). Changing filters on a page already open updates that same tab; only pass new_tab when the user explicitly asks for a separate tab.
+- create_artifact saves a persistent markdown document (a planning doc, design write-up, spec, or other longer structured output) shown in the session preview panel. Prefer it over a long inline reply for content the user will revisit; keep brief answers inline. To revise one, call list_artifacts then read_artifact for the current content, then update_artifact to overwrite it — never create a second artifact for the same document.`
 			: ''
 	}
 
@@ -2835,6 +2838,7 @@ export const globalTools: Tool<{}>[] = [
 			return deleteAppRunnable(parsed, ctx)
 		}
 	},
+	...artifactTools,
 	{
 		def: createToolDef(
 			openPreviewSchema,
@@ -2916,7 +2920,11 @@ export const SESSION_PREVIEW_TOOL_NAMES = new Set([
 	'get_preview_status',
 	'close_page',
 	'get_app_runtime_logs',
-	'list_app_runs'
+	'list_app_runs',
+	'create_artifact',
+	'update_artifact',
+	'list_artifacts',
+	'read_artifact'
 ])
 
 /**
@@ -2964,6 +2972,10 @@ export type GlobalToolHelpers = SessionToolHelpers & {
 	// (possibly forked) workspace while $workspaceStore stays on the navigation workspace,
 	// so permission gating (open_page) must read this, not the global store.
 	operatingWorkspace?: string
+	// Wired only for session chats (see AIChatManager): the artifact tools are session-gated.
+	artifacts?: SessionArtifactsStore
+	getChatId?: () => string | undefined
+	openArtifact?: (artifactId: string, name: string) => void
 }
 
 function sessionIdFromCtx(ctx: { helpers?: unknown }): string | undefined {
diff --git a/frontend/src/lib/components/markdownProse.ts b/frontend/src/lib/components/markdownProse.ts
new file mode 100644
index 0000000000..bc943aa42b
--- /dev/null
+++ b/frontend/src/lib/components/markdownProse.ts
@@ -0,0 +1,36 @@
+/**
+ * Shared prose (Tailwind typography) stacks for markdown renders, one source of
+ * truth so surfaces don't each roll their own and drift apart. Compose at the
+ * call site with layout-only classes (padding, width, bg); anything typographic
+ * belongs here.
+ *
+ * - 'xs': micro scale for dense secondary panes (chat reasoning blocks)
+ * - 'sm': compact chat-bubble scale (assistant messages, flow/app chat, settings)
+ * - 'doc': same rhythm and body size as 'sm', with a taller heading ramp
+ *   (lg/base/sm) and semibold headings for document-like surfaces (artifacts)
+ */
+
+// Kept as literal template parts: Tailwind's scanner reads class names verbatim
+// from this file, so every token must appear as plain text.
+// content-none strips the typography plugin's decorative backticks around
+// inline code (code::before/::after), which read as literal ` characters.
+// [&>:first-child]:mt-0 re-applies the plugin's first-block reset, which our
+// explicit prose-headings:mt-* would otherwise override (note: the composed
+// variant prose-headings:first: attaches :first-child to the wrapper — wrong).
+const base =
+	'prose dark:prose-invert max-w-full break-words [&>:first-child]:mt-0 prose-a:break-words prose-code:break-words prose-code:before:content-none prose-code:after:content-none prose-code:bg-surface-secondary/50 prose-code:rounded prose-code:px-1 prose-code:py-0.5 prose-code:font-normal prose-table:block prose-table:max-w-full prose-table:overflow-x-auto'
+
+// One vertical rhythm for sm/doc; heading margins stay per-preset (fixed, not
+// the plugin's em-based ones) so 'doc' can breathe more between sections.
+const rhythm = 'prose-sm leading-snug prose-ul:!pl-6'
+
+const bodyXs =
+	'text-primary prose-p:text-primary prose-li:text-primary prose-p:text-xs prose-li:text-xs prose-code:text-xs prose-pre:text-xs prose-table:text-xs'
+
+export const markdownProse = {
+	xs: `${base} prose-sm leading-snug prose-ul:!pl-5 prose-p:text-2xs prose-li:text-2xs prose-code:text-2xs prose-pre:text-2xs prose-headings:font-medium prose-headings:text-secondary prose-headings:mt-2 prose-headings:mb-1 prose-h1:text-2xs prose-h2:text-2xs prose-h3:text-2xs prose-h4:text-2xs prose-h5:text-2xs prose-h6:text-2xs prose-strong:text-secondary`,
+	sm: `${base} ${rhythm} ${bodyXs} prose-headings:mt-3 prose-headings:mb-1 prose-headings:font-medium prose-headings:text-emphasis prose-h1:text-sm prose-h2:text-xs prose-h3:text-xs prose-h4:text-xs prose-h5:text-xs prose-h6:text-xs`,
+	doc: `${base} ${rhythm} ${bodyXs} prose-headings:mt-8 prose-headings:mb-2 prose-headings:font-semibold prose-headings:text-emphasis prose-h1:text-lg prose-h2:text-base prose-h3:text-sm prose-h4:text-xs prose-h5:text-xs prose-h6:text-xs prose-pre:bg-transparent prose-pre:p-0`
+} as const
+
+export type MarkdownProseSize = keyof typeof markdownProse
diff --git a/frontend/src/lib/components/sessions/PreviewRouterPicker.svelte b/frontend/src/lib/components/sessions/PreviewRouterPicker.svelte
index 80d09b6004..da656bf8ef 100644
--- a/frontend/src/lib/components/sessions/PreviewRouterPicker.svelte
+++ b/frontend/src/lib/components/sessions/PreviewRouterPicker.svelte
@@ -14,7 +14,7 @@ only ever navigates between items) doesn't grow a Pages section.
 
 <script lang="ts">
 	import { untrack } from 'svelte'
-	import { Compass } from 'lucide-svelte'
+	import { Compass, FileText } from 'lucide-svelte'
 	import { resource } from 'runed'
 	import { workspaceStore } from '$lib/stores'
 	import RowIcon from '$lib/components/common/table/RowIcon.svelte'
@@ -29,7 +29,15 @@ only ever navigates between items) doesn't grow a Pages section.
 	} from '$lib/components/workspaceTree'
 	import { listGlobalDrafts } from '$lib/components/copilot/chat/global/userDraftAdapter'
 	import { isGlobalAiEnabled } from '$lib/components/copilot/chat/global/gate'
-	import { PREVIEW_PAGES, pageHref, pageKey, type PreviewTarget } from './previewRouter'
+	import type { PersistedArtifact } from '$lib/components/copilot/chat/artifacts/artifactsDB'
+	import {
+		PREVIEW_PAGES,
+		artifactKey,
+		isArtifactKey,
+		pageHref,
+		pageKey,
+		type PreviewTarget
+	} from './previewRouter'
 
 	type Kind = WorkspaceItemKind
 	type DrillPickerHandle = {
@@ -52,6 +60,9 @@ only ever navigates between items) doesn't grow a Pages section.
 		// list root items and miss fork-only ones. Falls back to $workspaceStore
 		// for non-session consumers.
 		workspaceId?: string
+		// Session artifacts to surface as an "Artifacts" branch; omitted or empty
+		// hides the branch (non-session consumers, sessions without artifacts).
+		artifacts?: PersistedArtifact[]
 	}
 
 	let {
@@ -62,7 +73,8 @@ only ever navigates between items) doesn't grow a Pages section.
 		externalFilter,
 		autoFocus = true,
 		flush = false,
-		workspaceId
+		workspaceId,
+		artifacts
 	}: Props = $props()
 
 	const kinds: Kind[] = ['flow', 'script', 'app']
@@ -137,8 +149,30 @@ only ever navigates between items) doesn't grow a Pages section.
 		children: PREVIEW_PAGES.filter((p) => p.path !== '/').map(pageLeaf)
 	})
 
+	// Session artifacts, when present, get their own branch between Pages and the
+	// workspace items so they're pickable (and searchable) like any destination.
+	const artifactsBranch = $derived<DrillBranch<PreviewTarget> | undefined>(
+		artifacts && artifacts.length > 0
+			? {
+					type: 'branch',
+					key: 'artifacts',
+					label: 'Artifacts',
+					icon: FileText,
+					searchGroup: true,
+					children: artifacts.map((a) => ({
+						type: 'leaf' as const,
+						key: artifactKey(a.id),
+						label: a.name,
+						icon: FileText,
+						data: { type: 'artifact', id: a.id, name: a.name }
+					}))
+				}
+			: undefined
+	)
+
 	const tree = $derived<DrillNode<PreviewTarget>[]>([
 		pagesBranch,
+		...(artifactsBranch ? [artifactsBranch] : []),
 		...tagItems(
 			buildWorkspaceTree({
 				loaded: loader.loaded,
@@ -150,7 +184,17 @@ only ever navigates between items) doesn't grow a Pages section.
 		)
 	])
 
-	const computedInitialScope = untrack(() => legacyScopeToPath(initialScope, kinds))
+	// An artifact highlight lives under the 'artifacts' branch, which the legacy
+	// {kind, dir} scope can't express — open the picker inside that branch so the
+	// active artifact is actually visible and highlighted (not the first root row).
+	// Keyed on the highlight's shape alone: the branch itself may not have
+	// materialized yet (artifacts hydrate from IndexedDB after tabs restore), and
+	// the drill entries fill in reactively once it does.
+	const computedInitialScope = untrack(() =>
+		initialHighlight && isArtifactKey(initialHighlight)
+			? ['artifacts']
+			: legacyScopeToPath(initialScope, kinds)
+	)
 </script>
 
 {#snippet leafIcon(leaf: DrillLeaf<PreviewTarget>)}
diff --git a/frontend/src/lib/components/sessions/PreviewTabHost.svelte b/frontend/src/lib/components/sessions/PreviewTabHost.svelte
index 7ee4b02b12..4972785b78 100644
--- a/frontend/src/lib/components/sessions/PreviewTabHost.svelte
+++ b/frontend/src/lib/components/sessions/PreviewTabHost.svelte
@@ -14,6 +14,7 @@
 	import FlowEditorView from './FlowEditorView.svelte'
 	import RawAppEditorView from './RawAppEditorView.svelte'
 	import PipelineEditorView from './PipelineEditorView.svelte'
+	import ArtifactViewer from '../copilot/chat/artifacts/ArtifactViewer.svelte'
 
 	let {
 		tab,
@@ -57,6 +58,13 @@
 	)
 	const isActiveSession = $derived(!!session && sessionState.currentSessionId === session.id)
 
+	// Resolved live from the session's store so an update_artifact re-renders the panel.
+	const artifact = $derived(
+		slot.kind === 'artifact'
+			? runtime?.manager.artifacts.artifacts.find((a) => a.id === slot.id)
+			: undefined
+	)
+
 	let frame: HTMLIFrameElement | undefined = $state()
 
 	// Pages whose theme we mirror on live toggles. Regular apps are the only item
@@ -105,6 +113,21 @@
 	const visibility = $derived(
 		active ? 'z-10 opacity-100 pointer-events-auto' : 'z-0 opacity-0 pointer-events-none'
 	)
+
+	let flashing = $state(false)
+	let flashTimer: ReturnType<typeof setTimeout> | undefined
+	// Guard against the effect's non-pulse reruns (tab/runtime changes) firing a flash.
+	let lastPulseNonce = -1
+	$effect(() => {
+		const pulse = runtime?.previewTabs.focusPulse
+		if (!pulse || pulse.nonce === lastPulseNonce) return
+		lastPulseNonce = pulse.nonce
+		if (pulse.id !== tab.id) return
+		flashing = true
+		clearTimeout(flashTimer)
+		flashTimer = setTimeout(() => (flashing = false), 800)
+	})
+	$effect(() => () => clearTimeout(flashTimer))
 </script>
 
 {#if slot.kind === 'editor' && mounted && runtime}
@@ -141,6 +164,21 @@
 			/>
 		{/if}
 	</div>
+{:else if slot.kind === 'artifact' && mounted}
+	<div class="absolute inset-0 flex flex-col min-h-0 bg-surface {visibility}" aria-hidden={!active}>
+		{#if artifact}
+			<ArtifactViewer {artifact} />
+		{:else if !runtime?.manager.artifacts.loading}
+			<div class="p-4 text-sm text-tertiary">This artifact is no longer available.</div>
+		{/if}
+		<!-- Overlay: the source editor's opaque bg would cover a ring on the container. -->
+		<div
+			class="pointer-events-none absolute inset-0 z-30 ring-2 ring-inset ring-border-accent transition-opacity duration-300 {flashing
+				? 'opacity-100'
+				: 'opacity-0'}"
+			aria-hidden="true"
+		></div>
+	</div>
 {:else if mounted}
 	<iframe
 		bind:this={frame}
diff --git a/frontend/src/lib/components/sessions/SessionChangesBar.svelte b/frontend/src/lib/components/sessions/SessionChangesBar.svelte
index 1bf47117cb..e133dcffea 100644
--- a/frontend/src/lib/components/sessions/SessionChangesBar.svelte
+++ b/frontend/src/lib/components/sessions/SessionChangesBar.svelte
@@ -1,14 +1,8 @@
 <script lang="ts">
-	import {
-		Archive,
-		ExternalLink,
-		GitPullRequestClosed,
-		MoveRight,
-		Pencil,
-		Trash2
-	} from 'lucide-svelte'
+	import { Archive, ExternalLink, GitPullRequestClosed, MoveRight, Trash2 } from 'lucide-svelte'
 	import { Button } from '$lib/components/common'
 	import Badge from '$lib/components/common/badge/Badge.svelte'
+	import SessionStatusPopover from './SessionStatusPopover.svelte'
 	import WorkspaceFamilyPicker from './WorkspaceFamilyPicker.svelte'
 	import { isPremiumStore, userStore, userWorkspaces, workspaceStore } from '$lib/stores'
 	import { canCreateFork } from '$lib/utils/editInFork'
@@ -16,10 +10,12 @@
 	import { sessionState, type Session } from './sessionState.svelte'
 	import { getRuntime } from './sessionRuntime.svelte'
 	import SessionDiffDrawer from './SessionDiffDrawer.svelte'
+	import { TOKEN_TRIGGER_CLASS } from './SessionStatusToken.svelte'
 	import { useWorkspaceDrafts } from '$lib/workspaceDrafts.svelte'
-	import { badgeCounts, buildDeployItems } from './sessionDeployModel'
+	import { badgeCounts, badgeOf, buildDeployItems } from './sessionDeployModel'
 	import { useExistingMaskKeys } from './sessionDeployModel.svelte'
 	import JobsSegment from '$lib/components/copilot/chat/JobsSegment.svelte'
+	import ArtifactsSegment from '$lib/components/copilot/chat/artifacts/ArtifactsSegment.svelte'
 
 	// Unified session bar: surfaces what the CURRENT chat changed — pending
 	// drafts and deployed items — as one count badge per status that opens the
@@ -123,9 +119,9 @@
 	// Opening the drawer re-fetches its own data, so it can show fresher state
 	// than the badge just clicked (e.g. "1 draft" that was deployed elsewhere in
 	// the meantime). Re-sync the dock alongside so the two never disagree.
-	function openDrawer() {
+	function openDrawer(focusKey?: string) {
 		refreshDock()
-		diffDrawer?.open()
+		diffDrawer?.open(focusKey)
 	}
 
 	// The dock counts are computed from the same pure model over this chat's
@@ -175,25 +171,20 @@
 	// Background jobs the chat started (rendered as the Jobs segment). The session
 	// bar shows if there are edits OR jobs; each segment hides when its side is empty.
 	const hasJobs = $derived((runtime?.manager.backgroundJobs.length ?? 0) > 0)
-</script>
+	const hasArtifacts = $derived((runtime?.manager.artifacts.artifacts.length ?? 0) > 0)
 
-{#snippet dock()}
-	<!-- One count badge per row status, same vocabulary/colors as the drawer's
-	     badges (draft/deployed) so the bar reads at a glance. Display-only: the
-	     enclosing Edits segment button opens the drawer. -->
-	<div class="flex items-center gap-1 shrink-0">
-		{#if dockCounts.draft > 0}
-			<Badge small color="indigo">
-				{dockCounts.draft} draft{dockCounts.draft === 1 ? '' : 's'}
-			</Badge>
-		{/if}
-		{#if dockCounts.deployed > 0}
-			<Badge small color="green">
-				{dockCounts.deployed} deployed
-			</Badge>
-		{/if}
-	</div>
-{/snippet}
+	const editsCount = $derived(dockCounts.draft + dockCounts.deployed)
+	const editsLabel = $derived(`${editsCount} edit${editsCount === 1 ? '' : 's'}`)
+	let editsOpen = $state(false)
+
+	// Only draft-vs-deployed drives the color: stale/failed live in the drawer's
+	// deploy model, not here.
+	const editsColorClass = $derived(
+		dockCounts.draft > 0
+			? '!bg-indigo-100 !text-indigo-800 hover:!bg-indigo-200 dark:!bg-indigo-700/40 dark:!text-indigo-100 dark:hover:!bg-indigo-600/40'
+			: '!bg-green-100 !text-green-700 hover:!bg-green-200 dark:!bg-green-700/40 dark:!text-green-100 dark:hover:!bg-green-600/40'
+	)
+</script>
 
 {#if committedId && isUnavailable}
 	<!-- Committed workspace is no longer in the user's list (deleted, archived,
@@ -240,57 +231,55 @@
 			</Button>
 		</div>
 	</div>
-{:else if committedId && (showBar || hasJobs)}
-	<!-- Segmented session bar: an Edits segment (what the AI changed this session)
-	     and a Jobs segment (background jobs it started), sharing one border box.
-	     The Edits segment (or, in its absence, a flex-1 spacer) fills the left so the
-	     Jobs segment stays pinned to the right whether or not there are edits. Fork
-	     identity / sync status lives inside the modal. -->
-	<div
-		class="flex h-[38px] items-stretch overflow-hidden rounded-md border bg-surface-tertiary text-xs"
-	>
+{:else if committedId && (showBar || hasArtifacts || hasJobs)}
+	<div class="flex items-center gap-3 rounded-md border bg-surface-tertiary px-2 py-2 text-xs">
 		{#if showBar}
 			{#if deletionOnly && compareHref}
-				<!-- Deleted items have no drawer row; the pending fork→parent removal is
-				     reviewed on the compare page, so the segment links there instead. -->
+				<!-- Deleted items have no drawer row, so this token links to the compare
+				     page (where the fork→parent removal is reviewed) rather than opening
+				     a popover. -->
 				<a
 					href={compareHref}
 					target="_blank"
 					rel="noopener noreferrer"
 					title="This chat's edits were deletions — review and promote them on the compare page"
-					class="flex min-w-0 flex-1 items-center gap-1.5 px-3 hover:bg-surface-hover"
+					class={TOKEN_TRIGGER_CLASS}
 				>
-					<Pencil class="h-3.5 w-3.5 shrink-0 text-secondary" />
-					<span class="shrink-0 font-normal text-primary">Edits</span>
-					<span
-						class="ml-auto inline-flex items-center gap-1 truncate text-2xs font-medium text-accent"
-					>
-						Review deletions <ExternalLink class="h-3 w-3 shrink-0" />
-					</span>
+					<span class="truncate font-normal text-secondary">Edits</span>
+					<ExternalLink class="h-3 w-3 shrink-0 text-tertiary" />
 				</a>
 			{:else}
-				<!-- Raw <button> (like the other clickable session rows/segments, e.g.
-				     SessionPicker/WorkspaceFamilyPicker): a full-width bar segment, not a
-				     discrete design-system action control. aria-haspopup marks the drawer. -->
-				<button
-					type="button"
-					class="flex min-w-0 flex-1 items-center gap-1.5 px-3 hover:bg-surface-hover"
-					title="Edited by the chat during this session"
-					aria-haspopup="dialog"
-					onclick={openDrawer}
+				<SessionStatusPopover
+					bind:open={editsOpen}
+					label={editsLabel}
+					title="Edited this session"
+					items={dockItems}
+					itemKey={(item) => item.key}
+					rowTitle={(item) => item.displayPath}
+					onPick={(item) => openDrawer(item.key)}
+					triggerClass={`${TOKEN_TRIGGER_CLASS} ${editsColorClass}`}
+					widthClass="w-96"
+					maxHeightClass="max-h-[min(9rem,50vh)]"
 				>
-					<Pencil class="h-3.5 w-3.5 shrink-0 text-secondary" />
-					<span class="shrink-0 font-normal text-primary">Edits</span>
-					<span class="ml-auto">{@render dock()}</span>
-				</button>
+					{#snippet row(item)}
+						<span class="min-w-0 flex-1 truncate font-mono font-normal text-primary">
+							{item.displayPath}
+						</span>
+						{#if badgeOf(item) === 'draft'}
+							<Badge small color="indigo">
+								{item.draftOnly ? 'Draft only' : 'Draft'}
+							</Badge>
+						{:else}
+							<Badge small color="green">Deployed</Badge>
+						{/if}
+					{/snippet}
+				</SessionStatusPopover>
 			{/if}
-		{:else}
-			<!-- No edits: a spacer fills the left so the Jobs segment stays right-aligned. -->
-			<div class="flex-1"></div>
+		{/if}
+		{#if hasArtifacts}
+			<ArtifactsSegment />
 		{/if}
 		{#if hasJobs}
-			<!-- standalone={false}: renders just the chip trigger as a full-height
-			     segment; the border box above provides the chrome. -->
 			<JobsSegment />
 		{/if}
 	</div>
diff --git a/frontend/src/lib/components/sessions/SessionDiffDrawer.svelte b/frontend/src/lib/components/sessions/SessionDiffDrawer.svelte
index ff50e8d438..fe5ab2d199 100644
--- a/frontend/src/lib/components/sessions/SessionDiffDrawer.svelte
+++ b/frontend/src/lib/components/sessions/SessionDiffDrawer.svelte
@@ -74,8 +74,8 @@
 			(chatId ? `&from_session=${encodeURIComponent(chatId)}` : '')
 	)
 
-	export function open() {
-		inner?.open()
+	export function open(focusKey?: string) {
+		inner?.open(focusKey)
 	}
 </script>
 
diff --git a/frontend/src/lib/components/sessions/SessionStatusPopover.svelte b/frontend/src/lib/components/sessions/SessionStatusPopover.svelte
new file mode 100644
index 0000000000..05fb841db5
--- /dev/null
+++ b/frontend/src/lib/components/sessions/SessionStatusPopover.svelte
@@ -0,0 +1,145 @@
+<script lang="ts" generics="T">
+	import type { Snippet } from 'svelte'
+	import Popover from '$lib/components/meltComponents/Popover.svelte'
+	import SessionStatusToken, { TOKEN_TRIGGER_CLASS } from './SessionStatusToken.svelte'
+
+	// Shared shell for the session status-line popovers (Edits / Artifacts / Jobs):
+	// one trigger token, one header, one keyboard-navigable row list — so styling
+	// and behavior improvements land on all three segments at once.
+	let {
+		open = $bindable(),
+		label,
+		title,
+		items,
+		itemKey,
+		onPick,
+		rowTitle,
+		row,
+		actions,
+		customTrigger,
+		ariaLabel,
+		triggerClass = TOKEN_TRIGGER_CLASS,
+		placement = 'top-start',
+		closeOnOtherPopoverOpen = true,
+		usePointerDownOutside = false,
+		widthClass = 'w-80',
+		maxHeightClass = 'max-h-[min(10rem,50vh)]'
+	}: {
+		open: boolean
+		/** Trigger token text; also the default aria-label. */
+		label: string
+		/** Header line above the list ("… this session"). */
+		title: string
+		items: T[]
+		itemKey: (item: T) => string
+		/** Primary row activation; the popover closes itself first. */
+		onPick: (item: T) => void
+		rowTitle?: (item: T) => string
+		/** Content of the row's primary button. */
+		row: Snippet<[T]>
+		/** Trailing per-row action buttons (outside the primary button). */
+		actions?: Snippet<[T]>
+		/** Replaces the default SessionStatusToken trigger. */
+		customTrigger?: Snippet
+		ariaLabel?: string
+		/** Full class of the popover trigger (defaults to the token chrome). */
+		triggerClass?: string
+		placement?: 'top-start' | 'top-end'
+		closeOnOtherPopoverOpen?: boolean
+		usePointerDownOutside?: boolean
+		widthClass?: string
+		maxHeightClass?: string
+	} = $props()
+
+	function pick(item: T) {
+		open = false
+		onPick(item)
+	}
+
+	// Roving focus over the rows' primary buttons.
+	let listRoot = $state<HTMLDivElement | undefined>(undefined)
+
+	function rowButtons(): HTMLButtonElement[] {
+		return listRoot
+			? Array.from(listRoot.querySelectorAll<HTMLButtonElement>('button[data-status-row]'))
+			: []
+	}
+
+	function focusAt(index: number) {
+		const buttons = rowButtons()
+		if (buttons.length === 0) return
+		const wrapped = ((index % buttons.length) + buttons.length) % buttons.length
+		buttons[wrapped]?.focus()
+	}
+
+	function handleListKeydown(e: KeyboardEvent) {
+		if (e.key !== 'ArrowDown' && e.key !== 'ArrowUp' && e.key !== 'Home' && e.key !== 'End') {
+			return
+		}
+		const buttons = rowButtons()
+		if (buttons.length === 0) return
+		// The active element may be a row's trailing action button: resolve to its
+		// row so vertical navigation moves rows, not focusables.
+		const active = document.activeElement as HTMLElement | null
+		const current = buttons.findIndex((b) => b === active || b.parentElement?.contains(active))
+		e.preventDefault()
+		if (e.key === 'ArrowDown') focusAt(current < 0 ? 0 : current + 1)
+		else if (e.key === 'ArrowUp') focusAt(current < 0 ? buttons.length - 1 : current - 1)
+		else if (e.key === 'Home') focusAt(0)
+		else if (e.key === 'End') focusAt(buttons.length - 1)
+	}
+</script>
+
+<Popover
+	bind:isOpen={open}
+	{placement}
+	enableFlyTransition
+	{closeOnOtherPopoverOpen}
+	{usePointerDownOutside}
+	class={triggerClass}
+	contentClasses="!bg-surface"
+	triggerAttrs={{ 'aria-label': ariaLabel ?? label, 'aria-haspopup': 'dialog' }}
+>
+	{#snippet trigger()}
+		{#if customTrigger}
+			{@render customTrigger()}
+		{:else}
+			<SessionStatusToken {label} expanded={open} />
+		{/if}
+	{/snippet}
+
+	{#snippet content()}
+		<div class="flex {widthClass} flex-col text-xs">
+			<div class="px-3 pt-2 pb-0.5 text-2xs text-hint">{title}</div>
+			<!-- svelte-ignore a11y_no_noninteractive_element_interactions (keydown only routes arrows to the row buttons) -->
+			<div
+				role="list"
+				class="{maxHeightClass} overflow-y-auto py-1"
+				bind:this={listRoot}
+				onkeydown={handleListKeydown}
+			>
+				{#each items as item (itemKey(item))}
+					<div
+						class="flex items-center gap-2 py-1 pl-3 pr-2 hover:bg-surface-hover focus-within:bg-surface-hover"
+						role="listitem"
+					>
+						<button
+							type="button"
+							data-status-row
+							class="flex min-w-0 flex-1 items-center gap-2 text-left font-normal focus:outline-none"
+							title={rowTitle?.(item)}
+							onclick={() => pick(item)}
+						>
+							{@render row(item)}
+						</button>
+						{#if actions}
+							<div class="flex shrink-0 items-center gap-1.5">
+								{@render actions(item)}
+							</div>
+						{/if}
+					</div>
+				{/each}
+			</div>
+		</div>
+	{/snippet}
+</Popover>
diff --git a/frontend/src/lib/components/sessions/SessionStatusToken.svelte b/frontend/src/lib/components/sessions/SessionStatusToken.svelte
new file mode 100644
index 0000000000..560d8b9b07
--- /dev/null
+++ b/frontend/src/lib/components/sessions/SessionStatusToken.svelte
@@ -0,0 +1,29 @@
+<script module lang="ts">
+	// Shared trigger styling so every status-line token (Edits, Artifacts, Jobs)
+	// stays visually uniform from one source.
+	export const TOKEN_TRIGGER_CLASS =
+		'inline-flex min-w-0 items-center gap-1.5 rounded px-1.5 py-0.5 text-xs text-secondary hover:bg-surface-hover'
+</script>
+
+<script lang="ts">
+	import { ChevronUp } from 'lucide-svelte'
+
+	// No <button>/onclick — the enclosing melt Popover owns the trigger and its click.
+	let {
+		label,
+		expanded = false
+	}: {
+		label: string
+		expanded?: boolean
+	} = $props()
+</script>
+
+<span class="inline-flex min-w-0 items-center gap-1.5">
+	<span class="min-w-0 truncate font-normal">
+		{label}
+	</span>
+	<ChevronUp
+		size={14}
+		class={`shrink-0 transition-transform duration-150 ${expanded ? 'rotate-180' : ''}`}
+	/>
+</span>
diff --git a/frontend/src/lib/components/sessions/WorkspaceDiffDrawer.svelte b/frontend/src/lib/components/sessions/WorkspaceDiffDrawer.svelte
index 360c08a9f3..d66a92dcdb 100644
--- a/frontend/src/lib/components/sessions/WorkspaceDiffDrawer.svelte
+++ b/frontend/src/lib/components/sessions/WorkspaceDiffDrawer.svelte
@@ -143,7 +143,7 @@
 		)
 	}
 
-	export function open() {
+	export function open(focusKey?: string) {
 		loadedDiffs = {}
 		mountedRows = {}
 		folderOpen = {}
@@ -151,6 +151,34 @@
 		model.load()
 		drawer?.openDrawer()
 		setTimeout(() => searchInputEl?.focus(), 50)
+		if (focusKey) void focusItem(focusKey)
+	}
+
+	// model.load()'s draft fetch is async, so poll real frames (not ticks — the
+	// fetch is wall-clock) until the item lands in model.items, then force-mount its
+	// row so scrollToDiff has an anchor even below the fold on a cold drawer.
+	async function focusItem(focusKey: string) {
+		let frames = 0
+		let item = model.items.find((i) => i.key === focusKey)
+		while (!item && frames++ < 120) {
+			await new Promise<void>((r) => requestAnimationFrame(() => r()))
+			item = model.items.find((i) => i.key === focusKey)
+		}
+		if (!item) return
+		await tick()
+		// Force-mount bypasses use:lazyMount, which is what fetches the diff values.
+		mountedRows[item.key] = true
+		if (item.deployKind === 'raw_app') {
+			// Loading rekeys the app leaf to a folder at its displayPath, so highlight
+			// that key once loaded (as expandApp does), not the now-stale item.key.
+			await loadDiffFor(item)
+			await tick()
+			revealDiff(item, folderKeyFor(item.displayPath))
+		} else {
+			void loadDiffFor(item)
+			await tick()
+			revealDiff(item, item.key)
+		}
 	}
 
 	// ── Badge presentation ─────────────────────────────────────────────────────
diff --git a/frontend/src/lib/components/sessions/previewRouter.test.ts b/frontend/src/lib/components/sessions/previewRouter.test.ts
index 51bfc1bc8f..c79cf4df3e 100644
--- a/frontend/src/lib/components/sessions/previewRouter.test.ts
+++ b/frontend/src/lib/components/sessions/previewRouter.test.ts
@@ -1,5 +1,12 @@
 import { describe, it, expect } from 'vitest'
-import { draftFriendlyLeaf, parsePreviewItemRoute, resolvePreviewTab } from './previewRouter'
+import {
+	artifactUrl,
+	draftFriendlyLeaf,
+	parseArtifactRoute,
+	parsePreviewItemRoute,
+	previewLocationLabel,
+	resolvePreviewTab
+} from './previewRouter'
 
 describe('parsePreviewItemRoute', () => {
 	it('maps edit/get routes to item kinds', () => {
@@ -97,4 +104,39 @@ describe('resolvePreviewTab', () => {
 	it('routes the bare pipeline list page to the iframe fallback', () => {
 		expect(resolvePreviewTab('/pipeline')).toEqual({ kind: 'iframe' })
 	})
+
+	it('routes an artifact url to the artifact slot by id (ignoring the name hash)', () => {
+		expect(resolvePreviewTab('artifact:abc%20123#My%20Doc')).toEqual({
+			kind: 'artifact',
+			id: 'abc 123'
+		})
+	})
+})
+
+describe('artifact route', () => {
+	it('round-trips id and name through artifactUrl → parseArtifactRoute, including special chars', () => {
+		for (const [id, name] of [
+			['abc', 'Onboarding plan'],
+			['id-with-dash', 'weird # % / name'],
+			['x', 'artifact:not-an-id#nope'],
+			['y', '']
+		] as const) {
+			expect(parseArtifactRoute(artifactUrl(id, name))).toEqual({ id, name })
+		}
+	})
+
+	it('parses a hash-less artifact url to an empty name', () => {
+		expect(parseArtifactRoute('artifact:abc')).toEqual({ id: 'abc', name: '' })
+	})
+
+	it('returns null for non-artifact urls', () => {
+		expect(parseArtifactRoute('/scripts/edit/f/foo/bar')).toBeNull()
+		expect(parseArtifactRoute('/runs')).toBeNull()
+		expect(parseArtifactRoute('artifactx:abc')).toBeNull()
+	})
+
+	it('labels an artifact tab by its name, falling back to "Artifact" when unnamed', () => {
+		expect(previewLocationLabel(artifactUrl('abc', 'My Doc'))).toBe('My Doc')
+		expect(previewLocationLabel('artifact:abc')).toBe('Artifact')
+	})
 })
diff --git a/frontend/src/lib/components/sessions/previewRouter.ts b/frontend/src/lib/components/sessions/previewRouter.ts
index e9aec2637e..b5e7520265 100644
--- a/frontend/src/lib/components/sessions/previewRouter.ts
+++ b/frontend/src/lib/components/sessions/previewRouter.ts
@@ -21,6 +21,7 @@ import type { SessionTargetKind } from './sessionRuntime.svelte'
 export type PreviewTarget =
 	| { type: 'page'; href: string; label: string }
 	| { type: 'item'; item: WorkspaceItem }
+	| { type: 'artifact'; id: string; name: string }
 
 export type PreviewPage = { label: string; path: string; icon: DrillIcon }
 
@@ -97,6 +98,8 @@ export function matchPreviewPage(path: string): PreviewPage | undefined {
  * page, run detail, or item path. Shared by the sessions tab strip and the
  * close_page matcher so both name a tab the same way. */
 export function previewLocationLabel(url: string): string {
+	const artifact = parseArtifactRoute(url)
+	if (artifact) return artifact.name || 'Artifact'
 	const page = matchPreviewPage(url)
 	if (page) return page.label
 	const trigger = triggerLabelForPath(url)
@@ -150,6 +153,24 @@ export function parsePipelineRoute(fullPath: string): string | null {
 	return m ? decodeURIComponent(m[1]) : null
 }
 
+// The id (before the hash) is the artifact's stable routing identity; the name rides in
+// the hash so the tab strip labels it without a store lookup.
+export function parseArtifactRoute(url: string): { id: string; name: string } | null {
+	const m = url.match(/^artifact:([^#]+)(?:#(.*))?$/)
+	if (!m) return null
+	return { id: decodeURIComponent(m[1]), name: m[2] ? decodeURIComponent(m[2]) : '' }
+}
+
+export function artifactUrl(id: string, name: string): string {
+	return `artifact:${encodeURIComponent(id)}#${encodeURIComponent(name)}`
+}
+
+/** Drill-picker leaf key for an artifact, shared by the picker tree and the
+ * active-tab highlight so a pick and a highlight agree on identity. */
+export const artifactKey = (id: string) => `artifact:${id}`
+
+export const isArtifactKey = (key: string) => key.startsWith('artifact:')
+
 // How a preview tab should render: as an in-process live editor or an iframe
 // fallback. Any editable item of a wrappable kind (script, flow, raw app) mounts
 // its per-(kind,path) cell editor; a `/pipeline/<folder>` route mounts the
@@ -158,9 +179,12 @@ export function parsePipelineRoute(fullPath: string): string | null {
 // other route) stays an iframe.
 export type PreviewSlot =
 	| { kind: 'editor'; editorKind: SessionTargetKind | 'pipeline'; path: string }
+	| { kind: 'artifact'; id: string }
 	| { kind: 'iframe' }
 
 export function resolvePreviewTab(url: string): PreviewSlot {
+	const artifact = parseArtifactRoute(url)
+	if (artifact) return { kind: 'artifact', id: artifact.id }
 	const pipelineFolder = parsePipelineRoute(url)
 	if (pipelineFolder) return { kind: 'editor', editorKind: 'pipeline', path: pipelineFolder }
 	const route = parsePreviewItemRoute(url)
diff --git a/frontend/src/lib/components/sessions/sessionPreviewTabs.svelte.ts b/frontend/src/lib/components/sessions/sessionPreviewTabs.svelte.ts
index 67d411b306..2be87131d2 100644
--- a/frontend/src/lib/components/sessions/sessionPreviewTabs.svelte.ts
+++ b/frontend/src/lib/components/sessions/sessionPreviewTabs.svelte.ts
@@ -2,7 +2,9 @@ import { base } from '$lib/base'
 import { randomUUID } from '$lib/utils/uuid'
 import { editPathFor, type WorkspaceItem } from '$lib/components/workspacePicker'
 import {
+	artifactUrl,
 	matchPreviewPage,
+	parseArtifactRoute,
 	parsePipelineRoute,
 	parsePreviewItemRoute,
 	previewLocationLabel,
@@ -43,9 +45,11 @@ function isEditorTabFor(url: string, target: SessionTarget): boolean {
 	return slot.kind === 'editor' && slot.editorKind === target.kind && slot.path === target.path
 }
 
-// URL a tab should load for a destination: a page's href, or an item's edit route.
+// URL a tab should load for a destination: a page's href, an item's edit route, or an artifact's scheme.
 function targetUrl(target: PreviewTarget): string {
-	return target.type === 'page' ? target.href : `${base}${editPathFor(target.item)}`
+	if (target.type === 'page') return target.href
+	if (target.type === 'artifact') return artifactUrl(target.id, target.name)
+	return `${base}${editPathFor(target.item)}`
 }
 
 // Point a tab at a new destination. Clears `friendlyLabel` (bound to the previous
@@ -151,6 +155,8 @@ export class SessionPreviewTabs {
 	#activeId = $state('')
 	#collapsed = $state(false)
 	#previewSize = $state<number | undefined>(undefined)
+	// Ephemeral UI signal — not part of the persisted snapshot.
+	#focusPulse = $state({ id: '', nonce: 0 })
 	readonly #adapter: PreviewTabsAdapter
 	readonly #flushDelay: number
 	#flushHandle: ReturnType<typeof setTimeout> | undefined
@@ -183,6 +189,15 @@ export class SessionPreviewTabs {
 	get previewSize(): number | undefined {
 		return this.#previewSize
 	}
+	get focusPulse(): { id: string; nonce: number } {
+		return this.#focusPulse
+	}
+
+	// The nonce makes each call a fresh value, so re-clicking the same active tab
+	// still fires the flash.
+	pulseFocus(id: string): void {
+		this.#focusPulse = { id, nonce: this.#focusPulse.nonce + 1 }
+	}
 
 	setPreviewSize(size: number): void {
 		if (this.#previewSize === size) return
@@ -226,6 +241,18 @@ export class SessionPreviewTabs {
 				return { status: same ? 'focused' : 'opened' }
 			}
 		}
+		// Dedupe artifacts by id, not full url: an update may have changed the name the url carries.
+		if (target.type === 'artifact') {
+			const existing = this.#tabs.find((t) => parseArtifactRoute(t.url)?.id === target.id)
+			if (existing) {
+				const same = existing.url === url
+				existing.url = url
+				existing.loc = url
+				this.#activeId = existing.id
+				this.#flush()
+				return { status: same ? 'focused' : 'opened' }
+			}
+		}
 		// Focus the tab currently *showing* this destination instead of opening a
 		// duplicate. Matched on the observed `loc`, not `url`: a tab that was
 		// opened here but navigated away no longer counts as showing it.
@@ -274,6 +301,18 @@ export class SessionPreviewTabs {
 				return
 			}
 		}
+		// Same by-id artifact dedupe as open(): focus (and re-point, in case the
+		// name changed) the tab already viewing this artifact instead of turning
+		// the active tab into a duplicate viewer.
+		if (target.type === 'artifact') {
+			const existing = this.#tabs.find((x) => parseArtifactRoute(x.url)?.id === target.id)
+			if (existing && existing.id !== t.id) {
+				retargetTab(existing, url)
+				this.#activeId = existing.id
+				this.#flush()
+				return
+			}
+		}
 		retargetTab(t, url)
 		this.#flush()
 	}
@@ -323,6 +362,11 @@ export class SessionPreviewTabs {
 		this.#flush()
 	}
 
+	closeArtifact(artifactId: string): void {
+		const tab = this.#tabs.find((t) => parseArtifactRoute(t.url)?.id === artifactId)
+		if (tab) this.close(tab.id)
+	}
+
 	setCollapsed(collapsed: boolean): void {
 		if (this.#collapsed === collapsed) return
 		this.#collapsed = collapsed
@@ -414,16 +458,19 @@ export function describePreview(tabs: SessionPreviewTab[], activeId: string): st
 	if (tabs.length === 0) return 'No preview tabs are open in the side panel.'
 	const lines = tabs.map((t) => {
 		const where = t.loc || t.url
+		const artifact = parseArtifactRoute(where)
 		const page = matchPreviewPage(where)
 		const pipelineFolder = parsePipelineRoute(where)
 		const route = parsePreviewItemRoute(where)
-		const label = page
-			? `page "${page.label}"`
-			: pipelineFolder
-				? `pipeline "${pipelineFolder}"`
-				: route
-					? `${route.raw_app ? 'raw_app' : route.kind} "${route.itemPath}"`
-					: stripBase(where)
+		const label = artifact
+			? `artifact "${artifact.name || 'Artifact'}"`
+			: page
+				? `page "${page.label}"`
+				: pipelineFolder
+					? `pipeline "${pipelineFolder}"`
+					: route
+						? `${route.raw_app ? 'raw_app' : route.kind} "${route.itemPath}"`
+						: stripBase(where)
 		const live = resolvePreviewTab(t.url).kind === 'editor' ? ', live editor' : ''
 		const active = t.id === activeId ? ', active' : ''
 		return `- ${label}${live}${active}`
diff --git a/frontend/src/lib/components/sessions/sessionPreviewTabs.test.ts b/frontend/src/lib/components/sessions/sessionPreviewTabs.test.ts
index 436b909e21..4458ab8cbe 100644
--- a/frontend/src/lib/components/sessions/sessionPreviewTabs.test.ts
+++ b/frontend/src/lib/components/sessions/sessionPreviewTabs.test.ts
@@ -8,7 +8,7 @@ import {
 	type PreviewTabsAdapter,
 	type PreviewTabsSnapshot
 } from './sessionPreviewTabs.svelte'
-import type { PreviewTarget } from './previewRouter'
+import { artifactUrl, type PreviewTarget } from './previewRouter'
 import type { SessionPreviewTab } from './sessionState.svelte'
 import { base } from '$lib/base'
 
@@ -53,6 +53,7 @@ const pipelineTarget2: PreviewTarget = {
 	href: `${base}/pipeline/sales`,
 	label: 'sales'
 }
+const artifactTarget: PreviewTarget = { type: 'artifact', id: 'art1', name: 'Plan' }
 
 beforeEach(() => {
 	vi.useFakeTimers()
@@ -225,6 +226,44 @@ describe('SessionPreviewTabs.open', () => {
 		o.open(dndAppTarget)
 		expect(o.tabs[0].url).toBe('/apps/edit/u/me/legacy')
 	})
+
+	it('opens an artifact tab keyed by its synthetic url and reveals the panel', () => {
+		const o = owner({ collapsed: true })
+		const res = o.open(artifactTarget)
+		expect(res.status).toBe('opened')
+		expect(o.tabs).toHaveLength(1)
+		expect(o.tabs[0].url).toBe(artifactUrl('art1', 'Plan'))
+		expect(o.collapsed).toBe(false)
+	})
+
+	it('dedupes an artifact by id: re-opening focuses the same tab', () => {
+		const o = owner()
+		o.open(artifactTarget)
+		const id = o.tabs[0].id
+		const res = o.open(artifactTarget)
+		expect(res.status).toBe('focused')
+		expect(o.tabs).toHaveLength(1)
+		expect(o.activeId).toBe(id)
+	})
+
+	it('re-points the same tab (no duplicate) when the artifact was renamed', () => {
+		const o = owner()
+		o.open(artifactTarget)
+		const id = o.tabs[0].id
+		const res = o.open({ type: 'artifact', id: 'art1', name: 'Renamed plan' })
+		expect(o.tabs).toHaveLength(1)
+		expect(o.tabs[0].id).toBe(id)
+		expect(o.tabs[0].url).toBe(artifactUrl('art1', 'Renamed plan'))
+		// URL changed (name), so the tab content differs → 'opened', not 'focused'.
+		expect(res.status).toBe('opened')
+	})
+
+	it('opens separate tabs for different artifact ids', () => {
+		const o = owner()
+		o.open(artifactTarget)
+		o.open({ type: 'artifact', id: 'art2', name: 'Other' })
+		expect(o.tabs).toHaveLength(2)
+	})
 })
 
 describe('SessionPreviewTabs.navigate', () => {
@@ -291,6 +330,32 @@ describe('SessionPreviewTabs.navigate', () => {
 		expect(o.tabs[0].url).toBe(`${base}/pipeline/sales`)
 	})
 
+	it('focuses the tab already viewing the artifact instead of duplicating the viewer', () => {
+		const o = owner()
+		o.open(artifactTarget)
+		const artifactTabId = o.activeId
+		o.open(pageTarget)
+		const pageTabId = o.activeId
+		o.navigate({ type: 'artifact', id: 'art1', name: 'Renamed plan' })
+		expect(o.tabs).toHaveLength(2)
+		expect(o.activeId).toBe(artifactTabId)
+		// Focus moved and the viewer tab picked up the rename; the page tab kept its url.
+		expect(o.tabs.find((t) => t.id === artifactTabId)?.url).toBe(
+			artifactUrl('art1', 'Renamed plan')
+		)
+		expect(o.tabs.find((t) => t.id === pageTabId)?.url).toBe('/runs')
+	})
+
+	it('retargets the active tab in place to an artifact', () => {
+		const o = owner()
+		o.open(pageTarget)
+		const tabId = o.activeId
+		o.navigate(artifactTarget)
+		expect(o.tabs).toHaveLength(1)
+		expect(o.activeId).toBe(tabId)
+		expect(o.tabs[0].url).toBe(artifactUrl('art1', 'Plan'))
+	})
+
 	it('drops a stale friendly label when the tab is retargeted', () => {
 		const o = owner()
 		o.open(flowTarget)
@@ -340,6 +405,22 @@ describe('SessionPreviewTabs.select / close / setCollapsed', () => {
 		expect(o.activeId).toBe('')
 	})
 
+	it('closeArtifact closes the tab showing that artifact, leaving others', () => {
+		const o = owner()
+		o.open(artifactTarget) // id 'art1'
+		o.open(scriptTarget)
+		expect(o.tabs).toHaveLength(2)
+		o.closeArtifact('art1')
+		expect(o.tabs.map((t) => t.url)).toEqual(['/scripts/edit/u/me/foo'])
+	})
+
+	it('closeArtifact is a no-op for an unknown artifact id', () => {
+		const o = owner()
+		o.open(artifactTarget)
+		o.closeArtifact('nope')
+		expect(o.tabs).toHaveLength(1)
+	})
+
 	it('toggles collapsed', () => {
 		const o = owner({ collapsed: false })
 		o.setCollapsed(true)
@@ -520,6 +601,14 @@ describe('describePreview', () => {
 		expect(out).toContain('page "Runs"')
 		expect(out).not.toContain('live editor')
 	})
+
+	it('labels an artifact tab by name, not the raw artifact url', () => {
+		const url = artifactUrl('uuid-1', 'My Plan')
+		const out = describePreview([{ id: 'a', url, loc: url }], 'a')
+		expect(out).toContain('artifact "My Plan"')
+		expect(out).not.toContain('artifact:uuid-1')
+		expect(out).not.toContain('live editor')
+	})
 })
 
 describe('selectPreviewTabsToClose', () => {
@@ -552,3 +641,16 @@ describe('selectPreviewTabsToClose', () => {
 		expect(selectPreviewTabsToClose(tabs, { all: false, match: 'nonexistent' })).toEqual([])
 	})
 })
+
+describe('SessionPreviewTabs.pulseFocus', () => {
+	it('sets the id and advances the nonce, re-firing for the same id', () => {
+		const o = owner()
+		expect(o.focusPulse).toEqual({ id: '', nonce: 0 })
+		o.pulseFocus('tab-a')
+		expect(o.focusPulse).toEqual({ id: 'tab-a', nonce: 1 })
+		o.pulseFocus('tab-a')
+		expect(o.focusPulse).toEqual({ id: 'tab-a', nonce: 2 })
+		o.pulseFocus('tab-b')
+		expect(o.focusPulse).toEqual({ id: 'tab-b', nonce: 3 })
+	})
+})
diff --git a/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts b/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts
index 9f2b750989..c8f523e799 100644
--- a/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts
+++ b/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts
@@ -425,6 +425,20 @@ function createRuntime(session: Session): SessionRuntime {
 		})
 	}
 
+	manager.openArtifact = (id, name) => {
+		// Capture before open() un-collapses / re-activates: flash only when the tab
+		// was already the displayed one (nothing else visibly changes).
+		const wasDisplayed = !previewTabs.collapsed
+		const prevActive = previewTabs.activeId
+		const { status } = previewTabs.open({ type: 'artifact', id, name })
+		if (status === 'focused' && wasDisplayed && previewTabs.activeId === prevActive) {
+			previewTabs.pulseFocus(previewTabs.activeId)
+		}
+	}
+	manager.closeArtifact = (id) => previewTabs.closeArtifact(id)
+	// Key the store before any configureGlobalMode runs, so a new session's first create shows at once.
+	void manager.artifacts.setSession(session.id)
+
 	// Pipeline target state lives on the runtime (not the PipelineEditorView
 	// component) so the in-session drafts survive hide/show of the editor pane —
 	// the pane unmounts on hide, and a component-local store would be discarded.
diff --git a/frontend/src/lib/components/sessions/sessionState.svelte.ts b/frontend/src/lib/components/sessions/sessionState.svelte.ts
index 946f589444..606ef69c27 100644
--- a/frontend/src/lib/components/sessions/sessionState.svelte.ts
+++ b/frontend/src/lib/components/sessions/sessionState.svelte.ts
@@ -22,6 +22,7 @@ import { workspaceRootId } from './sessionScope.svelte'
 import { type DBSchema, type IDBPDatabase } from 'idb'
 import { userScopedDb } from '$lib/userScopedDb'
 import { deleteItemsForSession } from '../copilot/chat/files/attachedFilesDB'
+import { deleteArtifactsForSession } from '../copilot/chat/artifacts/artifactsDB'
 
 // Switch the global workspace iff the target differs from the active one
 // and is non-empty. Centralises the "session needs its workspace in focus"
@@ -488,6 +489,7 @@ export async function reconcileSessionsLifecycle(): Promise<void> {
 				// GC linked files too, matching deleteSession — a record-only delete
 				// here would orphan the session's attached-file blobs/handles.
 				void deleteItemsForSession(s.id)
+				void deleteArtifactsForSession(s.id)
 				deletedIds.add(s.id)
 				continue
 			}
@@ -579,6 +581,7 @@ export async function deleteSessionsForWorkspace(workspaceId: string): Promise<v
 		// GC linked files too (matches deleteSession) so a workspace teardown
 		// doesn't leave the sessions' attached-file blobs/handles orphaned.
 		void deleteItemsForSession(id)
+		void deleteArtifactsForSession(id)
 	}
 	sessionState.sessions = sessionState.sessions.filter((s) => !ids.has(s.id))
 	if (sessionState.currentSessionId && ids.has(sessionState.currentSessionId)) {
@@ -966,8 +969,9 @@ export function deleteSession(id: string) {
 		sessionState.currentSessionId = sessionState.sessions[0]?.id
 	}
 	void deleteSessionRecord(id)
-	// GC any linked files persisted for this session.
+	// GC any linked files and artifacts persisted for this session.
 	void deleteItemsForSession(id)
+	void deleteArtifactsForSession(id)
 }
 
 export function setSessionChatId(sessionId: string, chatId: string) {
diff --git a/frontend/src/lib/components/sessions/sessionStateIndexedDb.test.ts b/frontend/src/lib/components/sessions/sessionStateIndexedDb.test.ts
index 2b301a9d33..b7d2c853f7 100644
--- a/frontend/src/lib/components/sessions/sessionStateIndexedDb.test.ts
+++ b/frontend/src/lib/components/sessions/sessionStateIndexedDb.test.ts
@@ -15,6 +15,14 @@ vi.mock('../copilot/chat/files/attachedFilesDB', async (orig) => ({
 	deleteItemsForSession: deleteItemsForSessionMock
 }))
 
+const { deleteArtifactsForSessionMock } = vi.hoisted(() => ({
+	deleteArtifactsForSessionMock: vi.fn()
+}))
+vi.mock('../copilot/chat/artifacts/artifactsDB', async (orig) => ({
+	...(await orig<typeof import('../copilot/chat/artifacts/artifactsDB')>()),
+	deleteArtifactsForSession: deleteArtifactsForSessionMock
+}))
+
 // sessionState imports WorkspaceService; these tests don't touch the network.
 vi.mock('$lib/gen', async (orig) => {
 	const actual = await orig<typeof import('$lib/gen')>()
@@ -398,11 +406,14 @@ describe('sessionState IndexedDB persistence', () => {
 		await vi.waitFor(() => expect(sessionState.sessions.length).toBe(2))
 
 		deleteItemsForSessionMock.mockClear()
+		deleteArtifactsForSessionMock.mockClear()
 		await deleteSessionsForWorkspace('wsX')
 
-		// Both deleted sessions' linked files must be GC'd, not just their records.
+		// Both deleted sessions' linked files and artifacts must be GC'd, not just their records.
 		const cleaned = deleteItemsForSessionMock.mock.calls.map((c) => c[0]).sort()
 		expect(cleaned).toEqual(['f1', 'f2'])
+		const cleanedArtifacts = deleteArtifactsForSessionMock.mock.calls.map((c) => c[0]).sort()
+		expect(cleanedArtifacts).toEqual(['f1', 'f2'])
 	})
 
 	it('does not persist a per-session unarchive when the workspace is gone (resurrection guard)', async () => {
diff --git a/frontend/src/lib/components/workspaceSettings/AiSkillsSettings.svelte b/frontend/src/lib/components/workspaceSettings/AiSkillsSettings.svelte
index 199da77c4b..78e7989c3f 100644
--- a/frontend/src/lib/components/workspaceSettings/AiSkillsSettings.svelte
+++ b/frontend/src/lib/components/workspaceSettings/AiSkillsSettings.svelte
@@ -9,6 +9,7 @@
 	import Checkbox from '../common/checkbox/Checkbox.svelte'
 	import Markdown from 'svelte-exmarkdown'
 	import { gfmPlugin } from 'svelte-exmarkdown/gfm'
+	import { markdownProse } from '$lib/components/markdownProse'
 	import ToggleButton from '../common/toggleButton-v2/ToggleButton.svelte'
 	import ToggleButtonGroup from '../common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import SettingCard from '../instanceSettings/SettingCard.svelte'
@@ -563,14 +564,7 @@
 				{#if viewParsed.description}
 					<p class="text-xs text-secondary">{viewParsed.description}</p>
 				{/if}
-				<div
-					class="border rounded-md p-3 overflow-auto max-h-[60vh] prose prose-sm dark:prose-invert max-w-full leading-snug space-y-2 prose-ul:!pl-6
-						prose-p:text-xs prose-li:text-xs prose-code:text-xs prose-pre:text-xs
-						prose-code:break-words prose-a:break-words
-						prose-headings:font-medium prose-headings:text-emphasis prose-headings:mt-3 prose-headings:mb-1
-						prose-h1:text-sm prose-h2:text-xs prose-h3:text-xs prose-h4:text-xs prose-h5:text-xs prose-h6:text-xs
-						prose-table:block prose-table:max-w-full prose-table:overflow-x-auto prose-table:text-xs"
-				>
+				<div class="border rounded-md p-3 overflow-auto max-h-[60vh] space-y-2 {markdownProse.sm}">
 					<Markdown md={viewParsed.instructions} plugins={[gfmPlugin()]} />
 				</div>
 			</div>
diff --git a/frontend/src/routes/(root)/(logged)/sessions/+page.svelte b/frontend/src/routes/(root)/(logged)/sessions/+page.svelte
index 1e0bd25333..b2021b5e9b 100644
--- a/frontend/src/routes/(root)/(logged)/sessions/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/sessions/+page.svelte
@@ -46,8 +46,10 @@
 	import { setToolCompletionListener } from '$lib/components/copilot/chat/shared'
 	import { base } from '$lib/base'
 	import {
+		artifactKey,
 		matchPreviewPage,
 		pageKey,
+		parseArtifactRoute,
 		parsePreviewItemRoute,
 		previewLocationLabel,
 		type PreviewTarget
@@ -343,6 +345,12 @@
 	// Page path shown after the workspace breadcrumb — the active tab's observed
 	// location, so the breadcrumb tracks where the user browses inside the tab.
 	const displayPath = $derived(owner?.activeTab?.loc ?? owner?.activeTab?.url ?? `${base}/`)
+	// Artifacts have no workspace page, so "Open in workspace" can't resolve for them.
+	const activeArtifact = $derived(owner?.activeTab ? parseArtifactRoute(owner.activeTab.url) : null)
+	const activeTabIsArtifact = $derived(activeArtifact != null)
+	// The active session's artifacts, surfaced as an "Artifacts" branch in the
+	// preview pickers.
+	const sessionArtifacts = $derived(activeRuntime?.manager.artifacts.artifacts ?? [])
 	// Writes to the tab's own session model: a hidden warm session's iframe can
 	// finish loading while another session is shown, and its location must not
 	// land on the visible session's tabs.
@@ -456,7 +464,9 @@
 			? leafKeyFor(parsedRoute.kind, parsedRoute.itemPath)
 			: currentPage
 				? pageKey(currentPage.path)
-				: undefined
+				: activeArtifact
+					? artifactKey(activeArtifact.id)
+					: undefined
 	)
 	let activeTabPickerOpen = $state(false)
 
@@ -636,17 +646,19 @@
 							<!-- Open-in-full-page + full-screen toggle, floating over the top-right
 								     corner to mirror the collapse control. -->
 							<div class="absolute top-1 right-1 z-30 flex items-center gap-0.5">
-								<a
-									href={withWorkspaceParam(
-										owner?.activeTab?.loc || owner?.activeTab?.url || `${base}/`,
-										previewWorkspace
-									)}
-									title="Open in workspace"
-									aria-label="Open in workspace"
-									class="inline-flex items-center justify-center w-6 h-6 rounded text-tertiary hover:text-primary hover:bg-surface-hover"
-								>
-									<ExternalLink size={14} />
-								</a>
+								{#if !activeTabIsArtifact}
+									<a
+										href={withWorkspaceParam(
+											owner?.activeTab?.loc || owner?.activeTab?.url || `${base}/`,
+											previewWorkspace
+										)}
+										title="Open in workspace"
+										aria-label="Open in workspace"
+										class="inline-flex items-center justify-center w-6 h-6 rounded text-tertiary hover:text-primary hover:bg-surface-hover"
+									>
+										<ExternalLink size={14} />
+									</a>
+								{/if}
 								<button
 									type="button"
 									onclick={() => (fullscreen = !fullscreen)}
@@ -699,6 +711,7 @@
 													initialHighlight={activePickerHighlight}
 													{currentItem}
 													workspaceId={previewWorkspace}
+													artifacts={sessionArtifacts}
 													onPick={(t) => {
 														activeTabPickerOpen = false
 														navigatePreviewTo(t)
@@ -727,6 +740,7 @@
 										{#snippet content()}
 											<PreviewRouterPicker
 												workspaceId={previewWorkspace}
+												artifacts={sessionArtifacts}
 												onPick={(t) => {
 													newTabOpen = false
 													openInNewTab(t)
@@ -801,6 +815,7 @@
 											{#snippet content()}
 												<PreviewRouterPicker
 													workspaceId={previewWorkspace}
+													artifacts={sessionArtifacts}
 													onPick={(t) => {
 														emptyStateNewTabOpen = false
 														openInNewTab(t)

From 0694b84da7bbb9404fd386e3ce109a574a0e9c93 Mon Sep 17 00:00:00 2001
From: hugocasa <hugo@casademont.ch>
Date: Thu, 16 Jul 2026 11:19:19 +0200
Subject: [PATCH 010/171] fix(frontend): surface real tool call errors in AI
 chat (#10146)

---
 .../copilot/chat/ToolExecutionDisplay.svelte  | 10 ++--
 .../components/copilot/chat/shared.test.ts    | 39 +++++++++++++++
 .../src/lib/components/copilot/chat/shared.ts | 48 +++++++++++++++----
 .../components/copilot/chat/workspaceTools.ts | 31 ++----------
 4 files changed, 90 insertions(+), 38 deletions(-)

diff --git a/frontend/src/lib/components/copilot/chat/ToolExecutionDisplay.svelte b/frontend/src/lib/components/copilot/chat/ToolExecutionDisplay.svelte
index f0865cfde1..cf0cf40fda 100644
--- a/frontend/src/lib/components/copilot/chat/ToolExecutionDisplay.svelte
+++ b/frontend/src/lib/components/copilot/chat/ToolExecutionDisplay.svelte
@@ -29,8 +29,12 @@
 	)
 	const autoCollapseDetails = $derived(message.autoCollapseDetails !== false)
 
+	// An errored tool must be expandable even if it never opted into details,
+	// otherwise the error set on its status would be invisible.
+	const detailsAvailable = $derived(message.showDetails === true || message.error !== undefined)
+
 	let isExpanded = $derived(
-		(message.showDetails && (!isSuccessful || !autoCollapseDetails)) ||
+		(detailsAvailable && (!isSuccessful || !autoCollapseDetails)) ||
 			(message.isStreamingArguments && hasParameters) ||
 			(message.isLoading && message.needsConfirmation)
 	)
@@ -57,7 +61,7 @@
 				message.needsConfirmation ? 'opacity-80' : ''
 			)}
 			onclick={() => (isExpanded = !isExpanded)}
-			disabled={!message.showDetails && !message.isStreamingArguments}
+			disabled={!detailsAvailable && !message.isStreamingArguments}
 		>
 			<div class="flex items-center gap-2">
 				{#if message.isLoading && !message.needsConfirmation}
@@ -67,7 +71,7 @@
 					{message.content}
 				</span>
 
-				{#if message.showDetails || message.isStreamingArguments}
+				{#if detailsAvailable || message.isStreamingArguments}
 					<ChevronRight
 						class={twMerge(
 							'w-3 h-3 text-secondary transition-transform duration-150',
diff --git a/frontend/src/lib/components/copilot/chat/shared.test.ts b/frontend/src/lib/components/copilot/chat/shared.test.ts
index 1b77e060c4..fcd848c60d 100644
--- a/frontend/src/lib/components/copilot/chat/shared.test.ts
+++ b/frontend/src/lib/components/copilot/chat/shared.test.ts
@@ -211,6 +211,45 @@ describe('processToolCall', () => {
 		expect(result.content).toBe(error)
 	})
 
+	it('surfaces the real error in the tool status when the tool throws', async () => {
+		const { createToolDef, processToolCall } = await import('./shared')
+		const apiError = Object.assign(new Error('Bad Request'), {
+			status: 400,
+			body: { error: { message: 'script not found at path f/scripts/missing' } }
+		})
+		const setToolStatus = vi.fn()
+
+		const result = await processToolCall({
+			tools: [
+				{
+					def: createToolDef(z.object({}), 'run_script', 'Run script'),
+					fn: vi.fn().mockRejectedValue(apiError)
+				}
+			],
+			toolCall: {
+				id: 'call_err',
+				type: 'function',
+				function: { name: 'run_script', arguments: '{}' }
+			},
+			helpers: {},
+			workspace: 'test-workspace',
+			toolCallbacks: {
+				setToolStatus,
+				removeToolStatus: vi.fn()
+			}
+		})
+
+		const expectedError = 'script not found at path f/scripts/missing'
+		expect(setToolStatus).toHaveBeenLastCalledWith(
+			'call_err',
+			expect.objectContaining({
+				isLoading: false,
+				error: expectedError
+			})
+		)
+		expect(result.content).toBe(`Error while calling tool: ${expectedError}`)
+	})
+
 	it('continues to confirmation when pre-confirmation validation passes', async () => {
 		const { createToolDef, processToolCall } = await import('./shared')
 		const fn = vi.fn().mockResolvedValue('ok')
diff --git a/frontend/src/lib/components/copilot/chat/shared.ts b/frontend/src/lib/components/copilot/chat/shared.ts
index 197f0d018f..60b85e16de 100644
--- a/frontend/src/lib/components/copilot/chat/shared.ts
+++ b/frontend/src/lib/components/copilot/chat/shared.ts
@@ -629,6 +629,37 @@ async function callTool<T>({
 
 type MaybePromise<T> = T | Promise<T>
 
+const MAX_TOOL_ERROR_LENGTH = 2000
+
+/** ApiError from the generated client carries the server's message in `body`,
+ * not `message` — dig it out so tool failures show the real cause. Capped so a
+ * verbose error body (e.g. an HTML error page) can't flood the chat context. */
+export function formatToolError(error: any): string {
+	const bodyMessage =
+		error?.body?.error?.message ??
+		error?.body?.message ??
+		(typeof error?.body?.error === 'string' ? error.body.error : undefined)
+	const body =
+		bodyMessage ??
+		(typeof error?.body === 'string'
+			? error.body
+			: error?.body !== undefined
+				? stringifyErrorBody(error.body)
+				: undefined)
+	const message = String(body || error?.message || error)
+	return message.length > MAX_TOOL_ERROR_LENGTH
+		? message.slice(0, MAX_TOOL_ERROR_LENGTH) + '... (truncated)'
+		: message
+}
+
+function stringifyErrorBody(body: unknown): string {
+	try {
+		return JSON.stringify(body)
+	} catch {
+		return String(body)
+	}
+}
+
 export async function processToolCall<T>({
 	tools,
 	toolCall,
@@ -735,17 +766,12 @@ export async function processToolCall<T>({
 			})
 		} catch (err) {
 			console.error(err)
+			const errorMessage = formatToolError(err)
 			toolCallbacks.setToolStatus(toolCall.id, {
 				isLoading: false,
 				isStreamingArguments: false,
-				error: 'An error occurred while calling the tool'
+				error: errorMessage
 			})
-			const errorMessage =
-				typeof err === 'object' && 'message' in err
-					? err.message
-					: typeof err === 'string'
-						? err
-						: 'An error occurred while calling the tool'
 			result = `Error while calling tool: ${errorMessage}`
 		}
 		const toAdd = {
@@ -756,10 +782,16 @@ export async function processToolCall<T>({
 		return toAdd
 	} catch (err) {
 		console.error(err)
+		const errorMessage = formatToolError(err)
+		toolCallbacks.setToolStatus(toolCall.id, {
+			isLoading: false,
+			isStreamingArguments: false,
+			error: errorMessage
+		})
 		return {
 			role: 'tool' as const,
 			tool_call_id: toolCall.id,
-			content: 'Error while calling tool'
+			content: `Error while calling tool: ${errorMessage}`
 		}
 	}
 }
diff --git a/frontend/src/lib/components/copilot/chat/workspaceTools.ts b/frontend/src/lib/components/copilot/chat/workspaceTools.ts
index 5f069f1322..5609ab1321 100644
--- a/frontend/src/lib/components/copilot/chat/workspaceTools.ts
+++ b/frontend/src/lib/components/copilot/chat/workspaceTools.ts
@@ -28,6 +28,7 @@ import {
 import { z } from 'zod'
 import {
 	createToolDef,
+	formatToolError,
 	type CreatedResourceTriggerKind,
 	type Tool,
 	type ToolCallbacks,
@@ -237,30 +238,6 @@ function parseWithExplicitErrors<T>(schema: z.ZodType<T>, value: unknown, label:
 	return result.data
 }
 
-function formatApiError(error: any): string {
-	const bodyMessage =
-		error?.body?.error?.message ??
-		error?.body?.message ??
-		(typeof error?.body?.error === 'string' ? error.body.error : undefined)
-	const body =
-		bodyMessage ??
-		(typeof error?.body === 'string'
-			? error.body
-			: error?.body !== undefined
-				? stringifyErrorBody(error.body)
-				: undefined)
-	const message = body || error?.message || String(error)
-	return error?.status ? `HTTP ${error.status}: ${message}` : message
-}
-
-function stringifyErrorBody(body: unknown): string {
-	try {
-		return JSON.stringify(body)
-	} catch {
-		return String(body)
-	}
-}
-
 function setToolError(toolCallbacks: ToolCallbacks, toolId: string, error: unknown): string {
 	const errorMessage = error instanceof Error ? error.message : String(error)
 	toolCallbacks.setToolStatus(toolId, {
@@ -302,7 +279,7 @@ const createScheduleTool: Tool<any> = {
 					}
 				})
 			} catch (error) {
-				throw new Error(`Invalid schedule or timezone: ${formatApiError(error)}`)
+				throw new Error(`Invalid schedule or timezone: ${formatToolError(error)}`)
 			}
 
 			toolCallbacks.setToolStatus(toolId, {
@@ -325,7 +302,7 @@ const createScheduleTool: Tool<any> = {
 				})
 				return JSON.stringify(toolResult)
 			} catch (error) {
-				throw new Error(`Failed to create schedule "${requestBody.path}": ${formatApiError(error)}`)
+				throw new Error(`Failed to create schedule "${requestBody.path}": ${formatToolError(error)}`)
 			}
 		} catch (error) {
 			return setToolError(toolCallbacks, toolId, error)
@@ -383,7 +360,7 @@ const createTriggerTool: Tool<any> = {
 				return JSON.stringify(toolResult)
 			} catch (error) {
 				throw new Error(
-					`Failed to create ${triggerConfig.label} "${requestBody.path}": ${formatApiError(error)}`
+					`Failed to create ${triggerConfig.label} "${requestBody.path}": ${formatToolError(error)}`
 				)
 			}
 		} catch (error) {

From 4ee1d32101eb527ef707c3c4af456892f0a059ab Mon Sep 17 00:00:00 2001
From: hugocasa <hugo@casademont.ch>
Date: Thu, 16 Jul 2026 13:31:10 +0200
Subject: [PATCH 011/171] feat: display openai reasoning summaries in ai chat
 (#10147)

* feat(frontend): display openai reasoning summaries in ai chat with unverified-org fallback

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(frontend): scope hidden-thinking hint per workspace/provider and skip summary on explicit reasoning-off

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(frontend): compose responses fallbacks in either error order and track all unavailable summary keys

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
---
 .../copilot/chat/AIChatDisplay.svelte         |   2 +-
 .../copilot/chat/AIChatManager.svelte.ts      |  53 +++++++
 .../components/copilot/chat/chatLoop.test.ts  | 140 +++++++++++++++++-
 .../lib/components/copilot/chat/chatLoop.ts   | 140 ++++++++++++++----
 .../copilot/chat/openai-responses.ts          |  22 +++
 5 files changed, 324 insertions(+), 33 deletions(-)

diff --git a/frontend/src/lib/components/copilot/chat/AIChatDisplay.svelte b/frontend/src/lib/components/copilot/chat/AIChatDisplay.svelte
index 9ede1565e0..cefe798165 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatDisplay.svelte
+++ b/frontend/src/lib/components/copilot/chat/AIChatDisplay.svelte
@@ -643,7 +643,7 @@ the panel, or the Escape-to-stop focus check would wrongly reject them. -->
 											: aiChatManager.currentReasoningActive &&
 												  !aiChatManager.currentReply &&
 												  !aiChatManager.currentReasoning
-												? 'Thinking'
+												? (aiChatManager.reasoningHiddenIndicatorLabel ?? 'Thinking')
 												: undefined}
 								/>
 							{/if}
diff --git a/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts b/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
index 5384c7dc0b..30802b446c 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
+++ b/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
@@ -154,6 +154,21 @@ const AI_AUTONOMY_MODE_STORAGE_KEY = 'ai-chat-autonomy-mode'
 const LEGACY_AUTO_ACCEPT_TOOL_CONFIRMATIONS_STORAGE_KEY = 'ai-chat-yolo-mode'
 const WEB_SEARCH_ERROR_HINT =
 	'Web search is unavailable for this provider/model/key. Disable web search in workspace settings and try again.'
+// The full explanation is shown once per browser; afterwards the hidden
+// thinking is only hinted at discreetly in the typing indicator.
+const REASONING_SUMMARY_WARNED_STORAGE_KEY = 'ai-chat-reasoning-summary-unverified-warned'
+
+function providerDisplayName(provider: string): string {
+	return provider === 'azure_openai' ? 'Azure OpenAI' : 'OpenAI'
+}
+
+function reasoningSummaryUnavailableMessage(provider: string): string {
+	const verifyHint =
+		provider === 'azure_openai'
+			? 'To display it, verify your organization with your provider, then reload this page.'
+			: 'To display it, verify your organization in the OpenAI platform settings (Settings > General), then reload this page.'
+	return `This model is reasoning, but your ${providerDisplayName(provider)} organization is not verified to generate reasoning summaries, so its thinking stays hidden. ${verifyHint}`
+}
 
 export enum AIMode {
 	SCRIPT = 'script',
@@ -326,6 +341,30 @@ export class AIChatManager {
 	currentReply = $state<string>('')
 	currentReasoning = $state<string>('')
 	currentReasoningActive = $state<boolean>(false)
+	// The provider reasons but refuses to stream summaries (unverified OpenAI
+	// organization) — drives the discreet "Thinking (hidden)" indicator. Keyed
+	// by workspace:provider like the chat-loop fallback cache, so the hint never
+	// carries over to a provider or workspace whose summaries work. A list, not
+	// a scalar: several workspace/provider pairs can be unavailable at once, and
+	// the chat loop only notifies on first detection per pair.
+	private reasoningSummaryUnavailableFor = $state<string[]>([])
+
+	private reasoningSummaryKey(provider: string): string {
+		return `${this.operatingWorkspace ?? ''}:${provider}`
+	}
+
+	/** Label for the live "Thinking" indicator when thinking stays hidden for
+	 * the current workspace/provider, undefined otherwise. */
+	get reasoningHiddenIndicatorLabel(): string | undefined {
+		if (this.reasoningSummaryUnavailableFor.length === 0) {
+			return undefined
+		}
+		const provider = getCurrentModel().provider
+		if (!this.reasoningSummaryUnavailableFor.includes(this.reasoningSummaryKey(provider))) {
+			return undefined
+		}
+		return `Thinking (hidden, ${providerDisplayName(provider)} org not verified)`
+	}
 	// Smooths the provider's bursty delivery into continuous typing by revealing
 	// buffered text a slice per frame. The reply and the reasoning/thinking stream
 	// each get their own reveal (independent buffers, both append to their own
@@ -1716,6 +1755,18 @@ export class AIChatManager {
 		}
 	}
 
+	private notifyReasoningSummaryUnavailable = () => {
+		const provider = getCurrentModel().provider
+		const key = this.reasoningSummaryKey(provider)
+		if (!this.reasoningSummaryUnavailableFor.includes(key)) {
+			this.reasoningSummaryUnavailableFor = [...this.reasoningSummaryUnavailableFor, key]
+		}
+		if (getLocalSetting(REASONING_SUMMARY_WARNED_STORAGE_KEY) !== 'true') {
+			storeLocalSetting(REASONING_SUMMARY_WARNED_STORAGE_KEY, 'true')
+			sendUserToast(reasoningSummaryUnavailableMessage(provider), 'warning', [], undefined, 10000)
+		}
+	}
+
 	private chatRequest = async ({
 		messages,
 		abortController,
@@ -1735,6 +1786,7 @@ export class AIChatManager {
 		systemMessage?: ChatCompletionSystemMessageParam
 		onWebSearchUnavailable?: () => void
 	}) => {
+		const onReasoningSummaryUnavailable = () => this.notifyReasoningSummaryUnavailable()
 		try {
 			// Use JS getters so runChatLoop re-reads tools/helpers/systemMessage/modelProvider
 			// on each iteration. This is critical for changeModeTool (Navigator → Script/Flow)
@@ -1784,6 +1836,7 @@ export class AIChatManager {
 					this.skipResponsesApi = true
 				},
 				onWebSearchUnavailable,
+				onReasoningSummaryUnavailable,
 				getPendingUserMessage: () => {
 					const pendingPrompt = this.pendingPrompt
 					if (!pendingPrompt) return undefined
diff --git a/frontend/src/lib/components/copilot/chat/chatLoop.test.ts b/frontend/src/lib/components/copilot/chat/chatLoop.test.ts
index 93acdfbd86..b9581e3d74 100644
--- a/frontend/src/lib/components/copilot/chat/chatLoop.test.ts
+++ b/frontend/src/lib/components/copilot/chat/chatLoop.test.ts
@@ -12,7 +12,8 @@ const mocks = vi.hoisted(() => ({
 	parseOpenAIResponsesCompletion: vi.fn(),
 	getAnthropicCompletion: vi.fn(),
 	parseAnthropicCompletion: vi.fn(),
-	resolveRequestReasoning: vi.fn()
+	resolveRequestReasoning: vi.fn(),
+	resolveEffectiveReasoning: vi.fn()
 }))
 
 vi.mock('../lib', () => ({
@@ -22,7 +23,8 @@ vi.mock('../lib', () => ({
 }))
 
 vi.mock('../reasoningRegistry', () => ({
-	resolveRequestReasoning: mocks.resolveRequestReasoning
+	resolveRequestReasoning: mocks.resolveRequestReasoning,
+	resolveEffectiveReasoning: mocks.resolveEffectiveReasoning
 }))
 
 vi.mock('./openai-responses', () => ({
@@ -50,12 +52,14 @@ function createConfig({
 	workspace,
 	modelProvider = { provider: 'openai', model: 'gpt-4.1' },
 	callbacks = createCallbacks(),
-	onWebSearchUnavailable
+	onWebSearchUnavailable,
+	onReasoningSummaryUnavailable
 }: {
 	workspace: string
 	modelProvider?: ReasoningProviderModel
 	callbacks?: ChatLoopConfig['callbacks']
 	onWebSearchUnavailable?: ChatLoopConfig['onWebSearchUnavailable']
+	onReasoningSummaryUnavailable?: ChatLoopConfig['onReasoningSummaryUnavailable']
 }): ChatLoopConfig {
 	const messages: ChatCompletionMessageParam[] = [{ role: 'user', content: 'search this' }]
 
@@ -73,7 +77,8 @@ function createConfig({
 		},
 		workspace,
 		maxIterations: 1,
-		onWebSearchUnavailable
+		onWebSearchUnavailable,
+		onReasoningSummaryUnavailable
 	}
 }
 
@@ -291,6 +296,133 @@ describe('runChatLoop web search fallback', () => {
 	})
 })
 
+describe('runChatLoop reasoning summary fallback', () => {
+	beforeEach(() => {
+		vi.resetAllMocks()
+		mocks.providerSupportsWebSearch.mockReturnValue(false)
+		mocks.resolveRequestReasoning.mockReturnValue('high')
+		mocks.resolveEffectiveReasoning.mockReturnValue('high')
+		mocks.parseOpenAIResponsesCompletion.mockResolvedValue({
+			shouldContinue: false,
+			tokenUsage
+		})
+	})
+
+	it('retries once without the summary on the unverified-org error and caches per workspace/provider', async () => {
+		const onReasoningSummaryUnavailable = vi.fn()
+		const workspace = `workspace-${randomUUID()}`
+		const modelProvider: ReasoningProviderModel = { provider: 'openai', model: 'gpt-5.1' }
+
+		mocks.getOpenAIResponsesCompletion
+			.mockRejectedValueOnce(
+				Object.assign(
+					new Error('Your organization must be verified to generate reasoning summaries.'),
+					{
+						status: 400,
+						param: 'reasoning.summary',
+						code: 'unsupported_value',
+						error: { type: 'invalid_request_error' }
+					}
+				)
+			)
+			.mockResolvedValue({})
+
+		await runChatLoop(createConfig({ workspace, modelProvider, onReasoningSummaryUnavailable }))
+
+		expect(mocks.getOpenAIResponsesCompletion).toHaveBeenCalledTimes(2)
+		expect(mocks.getOpenAIResponsesCompletion.mock.calls[0][3]).toEqual(
+			expect.objectContaining({ reasoningSummary: true })
+		)
+		expect(mocks.getOpenAIResponsesCompletion.mock.calls[1][3]).toEqual(
+			expect.objectContaining({ reasoningSummary: false })
+		)
+		expect(onReasoningSummaryUnavailable).toHaveBeenCalledTimes(1)
+		expect(mocks.getCompletion).not.toHaveBeenCalled()
+
+		// Cached: a later run in the same workspace skips the summary outright,
+		// but a different model on the same provider shares the cache entry.
+		await runChatLoop(
+			createConfig({
+				workspace,
+				modelProvider: { provider: 'openai', model: 'o3' }
+			})
+		)
+
+		expect(mocks.getOpenAIResponsesCompletion).toHaveBeenCalledTimes(3)
+		expect(mocks.getOpenAIResponsesCompletion.mock.calls[2][3]).toEqual(
+			expect.objectContaining({ reasoningSummary: false })
+		)
+	})
+
+	it('composes with the web-search fallback when the errors arrive web-search first', async () => {
+		mocks.providerSupportsWebSearch.mockReturnValue(true)
+		const onReasoningSummaryUnavailable = vi.fn()
+		const onWebSearchUnavailable = vi.fn()
+		const workspace = `workspace-${randomUUID()}`
+		const modelProvider: ReasoningProviderModel = { provider: 'openai', model: 'gpt-5.1' }
+
+		mocks.getOpenAIResponsesCompletion
+			.mockRejectedValueOnce(
+				Object.assign(new Error("Hosted tool 'web_search' is not supported with this model"), {
+					status: 400,
+					error: { type: 'invalid_request_error' }
+				})
+			)
+			.mockRejectedValueOnce(
+				Object.assign(
+					new Error('Your organization must be verified to generate reasoning summaries.'),
+					{
+						status: 400,
+						param: 'reasoning.summary',
+						code: 'unsupported_value',
+						error: { type: 'invalid_request_error' }
+					}
+				)
+			)
+			.mockResolvedValue({})
+
+		await runChatLoop(
+			createConfig({
+				workspace,
+				modelProvider,
+				onReasoningSummaryUnavailable,
+				onWebSearchUnavailable
+			})
+		)
+
+		expect(mocks.getOpenAIResponsesCompletion).toHaveBeenCalledTimes(3)
+		expect(mocks.getOpenAIResponsesCompletion.mock.calls[0][3]).toEqual(
+			expect.objectContaining({ webSearch: true, reasoningSummary: true })
+		)
+		expect(mocks.getOpenAIResponsesCompletion.mock.calls[1][3]).toEqual(
+			expect.objectContaining({ webSearch: false, reasoningSummary: true })
+		)
+		expect(mocks.getOpenAIResponsesCompletion.mock.calls[2][3]).toEqual(
+			expect.objectContaining({ webSearch: false, reasoningSummary: false })
+		)
+		expect(onWebSearchUnavailable).toHaveBeenCalledTimes(1)
+		expect(onReasoningSummaryUnavailable).toHaveBeenCalledTimes(1)
+		expect(mocks.getCompletion).not.toHaveBeenCalled()
+	})
+
+	it('does not request a summary when reasoning is explicitly off via a disable token', async () => {
+		// gpt-5.1+ reasoning is turned off with the explicit 'none' effort on the
+		// wire, while the effective reasoning resolves to undefined.
+		mocks.resolveRequestReasoning.mockReturnValue('none')
+		mocks.resolveEffectiveReasoning.mockReturnValue(undefined)
+		mocks.getOpenAIResponsesCompletion.mockResolvedValue({})
+		const workspace = `workspace-${randomUUID()}`
+
+		await runChatLoop(
+			createConfig({ workspace, modelProvider: { provider: 'openai', model: 'gpt-5.1' } })
+		)
+
+		expect(mocks.getOpenAIResponsesCompletion.mock.calls[0][3]).toEqual(
+			expect.objectContaining({ reasoningEffort: 'none', reasoningSummary: false })
+		)
+	})
+})
+
 describe('runChatLoop lastIterationUsage', () => {
 	beforeEach(() => {
 		vi.resetAllMocks()
diff --git a/frontend/src/lib/components/copilot/chat/chatLoop.ts b/frontend/src/lib/components/copilot/chat/chatLoop.ts
index edf5be4d07..cd1421dd0b 100644
--- a/frontend/src/lib/components/copilot/chat/chatLoop.ts
+++ b/frontend/src/lib/components/copilot/chat/chatLoop.ts
@@ -6,7 +6,11 @@ import type {
 	ChatCompletionUserMessageParam
 } from 'openai/resources/chat/completions.mjs'
 import { getCompletion, parseOpenAICompletion, providerSupportsWebSearch } from '../lib'
-import { resolveRequestReasoning, type ReasoningProviderModel } from '../reasoningRegistry'
+import {
+	resolveEffectiveReasoning,
+	resolveRequestReasoning,
+	type ReasoningProviderModel
+} from '../reasoningRegistry'
 import { getAnthropicCompletion, parseAnthropicCompletion } from './anthropic'
 import { usesAnthropicMessagesApi } from '../modelConfig'
 import { getOpenAIResponsesCompletion, parseOpenAIResponsesCompletion } from './openai-responses'
@@ -48,6 +52,12 @@ export interface ChatLoopConfig {
 	skipResponsesApi?: boolean
 	onSkipResponsesApi?: () => void
 	onWebSearchUnavailable?: () => void
+	/**
+	 * Called when the provider refuses to generate reasoning summaries (OpenAI
+	 * gates them behind organization verification). The request is retried
+	 * without summaries, so reasoning happens but stays hidden.
+	 */
+	onReasoningSummaryUnavailable?: () => void
 	/** Return a pending user message to inject between iterations, or undefined. */
 	getPendingUserMessage?: () => ChatCompletionUserMessageParam | undefined
 	/**
@@ -107,10 +117,24 @@ export function truncateToToolPairedPrefix(
 const unsupportedWebSearchCache = new Set<string>()
 const WEB_SEARCH_UNAVAILABLE_STATUS_CODES = new Set([400, 403, 404])
 
+// Reasoning-summary availability is an org-level property of the provider
+// credentials (OpenAI organization verification), not of the model — key by
+// workspace + provider. In-memory on purpose: a page reload re-probes, so a
+// freshly verified organization starts getting summaries again.
+const unsupportedReasoningSummaryCache = new Set<string>()
+const REASONING_SUMMARY_UNAVAILABLE_STATUS_CODES = new Set([400, 403])
+
 function getWebSearchCacheKey(workspace: string, modelProvider: ReasoningProviderModel): string {
 	return [workspace, modelProvider.provider, modelProvider.model].join(':')
 }
 
+function getReasoningSummaryCacheKey(
+	workspace: string,
+	modelProvider: ReasoningProviderModel
+): string {
+	return [workspace, modelProvider.provider].join(':')
+}
+
 function isRecord(value: unknown): value is Record<string, unknown> {
 	return typeof value === 'object' && value !== null
 }
@@ -193,6 +217,44 @@ function shouldRetryWithoutWebSearch(err: unknown): boolean {
 	return status === undefined || WEB_SEARCH_UNAVAILABLE_STATUS_CODES.has(status)
 }
 
+function getErrorParam(err: unknown): string | undefined {
+	if (!isRecord(err)) {
+		return undefined
+	}
+	const candidates = [err.param]
+	if (isRecord(err.error)) {
+		candidates.push(err.error.param)
+	}
+	return candidates.find((param): param is string => typeof param === 'string')
+}
+
+// Unverified OpenAI organizations get a 400 on the reasoning.summary param
+// ("Your organization must be verified to generate reasoning summaries").
+function shouldRetryWithoutReasoningSummary(err: unknown): boolean {
+	const status = getErrorStatus(err)
+	if (status !== undefined && !REASONING_SUMMARY_UNAVAILABLE_STATUS_CODES.has(status)) {
+		return false
+	}
+	if (getErrorParam(err) === 'reasoning.summary') {
+		return true
+	}
+	const message = getErrorText(err).toLowerCase()
+	return (
+		message.includes('reasoning.summary') ||
+		/verified to (?:generate|stream) reasoning summar/.test(message)
+	)
+}
+
+function markReasoningSummaryUnsupported(
+	cacheKey: string,
+	err: unknown,
+	onReasoningSummaryUnavailable?: () => void
+) {
+	unsupportedReasoningSummaryCache.add(cacheKey)
+	console.warn('Reasoning summaries unavailable; retrying without them:', err)
+	onReasoningSummaryUnavailable?.()
+}
+
 function markWebSearchUnsupported(
 	cacheKey: string,
 	err: unknown,
@@ -212,6 +274,7 @@ export async function runChatLoop(config: ChatLoopConfig): Promise<ChatLoopResul
 		workspace,
 		maxIterations,
 		onSkipResponsesApi,
+		onReasoningSummaryUnavailable,
 		getPendingUserMessage,
 		onBeforeIteration
 	} = config
@@ -275,6 +338,14 @@ export async function runChatLoop(config: ChatLoopConfig): Promise<ChatLoopResul
 		const parseOptions = { workspace, provider: modelProvider.provider }
 
 		if (isOpenAI) {
+			const reasoningSummaryCacheKey = getReasoningSummaryCacheKey(workspace, modelProvider)
+			// Gate on the effective (not request) reasoning: an explicit off resolves
+			// to a truthy disable token like 'none' on the request side, and asking
+			// for a summary on a non-reasoning request would 400 on unverified orgs.
+			let reasoningSummary =
+				resolveEffectiveReasoning(modelProvider) !== undefined &&
+				!unsupportedReasoningSummaryCache.has(reasoningSummaryCacheKey)
+
 			const runOpenAIResponses = async (useWebSearch: boolean): Promise<boolean> => {
 				const completion = await getOpenAIResponsesCompletion(
 					messageParams,
@@ -284,7 +355,8 @@ export async function runChatLoop(config: ChatLoopConfig): Promise<ChatLoopResul
 						forceModelProvider: modelProvider,
 						openaiClient: clients.openai,
 						webSearch: useWebSearch,
-						reasoningEffort
+						reasoningEffort,
+						reasoningSummary
 					}
 				)
 				const continueCompletion = await parseOpenAIResponsesCompletion(
@@ -302,35 +374,47 @@ export async function runChatLoop(config: ChatLoopConfig): Promise<ChatLoopResul
 
 			let useCompletionsApi = skipResponsesApi
 			if (!skipResponsesApi) {
-				try {
-					if (!(await runOpenAIResponses(webSearch))) {
-						break
-					}
-				} catch (err) {
-					let fallbackError = err
-					if (webSearch && shouldRetryWithoutWebSearch(err)) {
-						markWebSearchUnsupported(webSearchCacheKey, err, config.onWebSearchUnavailable)
-						try {
-							if (!(await runOpenAIResponses(false))) {
-								break
-							}
-							continue
-						} catch (retryErr) {
-							fallbackError = retryErr
+				// Retry the Responses call disabling whichever optional feature the
+				// provider rejected (reasoning summary, web search) in the order the
+				// errors arrive — a turn can hit both, either one first. Each retry
+				// permanently disables one feature, so this loops at most twice.
+				let useWebSearch = webSearch
+				let outcome: 'break' | 'continue' | undefined
+				let fallbackError: unknown
+				while (outcome === undefined) {
+					try {
+						outcome = (await runOpenAIResponses(useWebSearch)) ? 'continue' : 'break'
+					} catch (err) {
+						if (reasoningSummary && shouldRetryWithoutReasoningSummary(err)) {
+							markReasoningSummaryUnsupported(
+								reasoningSummaryCacheKey,
+								err,
+								onReasoningSummaryUnavailable
+							)
+							reasoningSummary = false
+						} else if (useWebSearch && shouldRetryWithoutWebSearch(err)) {
+							markWebSearchUnsupported(webSearchCacheKey, err, config.onWebSearchUnavailable)
+							useWebSearch = false
+						} else {
+							fallbackError = err
+							break
 						}
 					}
-
-					console.warn(
-						'OpenAI Responses API failed, falling back to Completions API:',
-						fallbackError
-					)
-					const errorMessage = getErrorText(fallbackError)
-					if (errorMessage.includes('Responses API is not enabled')) {
-						skipResponsesApi = true
-						onSkipResponsesApi?.()
-					}
-					useCompletionsApi = true
 				}
+				if (outcome === 'break') {
+					break
+				}
+				if (outcome === 'continue') {
+					continue
+				}
+
+				console.warn('OpenAI Responses API failed, falling back to Completions API:', fallbackError)
+				const errorMessage = getErrorText(fallbackError)
+				if (errorMessage.includes('Responses API is not enabled')) {
+					skipResponsesApi = true
+					onSkipResponsesApi?.()
+				}
+				useCompletionsApi = true
 			}
 
 			if (useCompletionsApi) {
diff --git a/frontend/src/lib/components/copilot/chat/openai-responses.ts b/frontend/src/lib/components/copilot/chat/openai-responses.ts
index 426e1e76e2..f66d50bb09 100644
--- a/frontend/src/lib/components/copilot/chat/openai-responses.ts
+++ b/frontend/src/lib/components/copilot/chat/openai-responses.ts
@@ -159,6 +159,7 @@ export async function getOpenAIResponsesCompletion(
 		openaiClient?: OpenAI
 		webSearch?: boolean
 		reasoningEffort?: string
+		reasoningSummary?: boolean
 	}
 ) {
 	const { provider, config } = getProviderAndCompletionConfig({
@@ -174,6 +175,13 @@ export async function getOpenAIResponsesCompletion(
 		options?.reasoningEffort
 	)
 
+	// Reasoning summaries make the model's thinking renderable in the chat, but
+	// OpenAI rejects the request (400 on reasoning.summary) for organizations
+	// that haven't completed verification — callers opt in and fall back.
+	if (options?.reasoningSummary && responsesConfig.reasoning) {
+		responsesConfig.reasoning = { ...responsesConfig.reasoning, summary: 'auto' }
+	}
+
 	// Enable OpenAI's built-in web search tool. The proxy forwards the body
 	// verbatim, so this reaches OpenAI as a native server-side tool.
 	if (options?.webSearch && providerSupportsWebSearch(provider)) {
@@ -291,6 +299,20 @@ export async function parseOpenAIResponsesCompletion(
 		textContent += event.delta
 	})
 
+	// Stream the reasoning summary (present when the request asked for
+	// reasoning.summary) into the thinking display. Summaries arrive as
+	// separate parts; join them as paragraphs.
+	let reasoningSummaryParts = 0
+	runner.on('response.reasoning_summary_part.added', () => {
+		reasoningSummaryParts++
+		if (reasoningSummaryParts > 1) {
+			callbacks.onReasoningDelta?.('\n\n')
+		}
+	})
+	runner.on('response.reasoning_summary_text.delta', (event) => {
+		callbacks.onReasoningDelta?.(event.delta)
+	})
+
 	// Handle new output items (including function calls)
 	runner.on('response.output_item.added', (event) => {
 		const item = event.item

From cc305b1d97eea020c2e1015abeec274f8a04a467 Mon Sep 17 00:00:00 2001
From: Guilhem <guilhemlemouel@gmail.com>
Date: Thu, 16 Jul 2026 13:36:01 +0200
Subject: [PATCH 012/171] refactor(frontend): reorder sidebar settings menu,
 move logout to user submenu (#10149)

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
---
 .../components/sidebar/SettingsMenu.svelte    | 63 ++++++++++---------
 1 file changed, 34 insertions(+), 29 deletions(-)

diff --git a/frontend/src/lib/components/sidebar/SettingsMenu.svelte b/frontend/src/lib/components/sidebar/SettingsMenu.svelte
index 421800cb60..d44c3b0364 100644
--- a/frontend/src/lib/components/sidebar/SettingsMenu.svelte
+++ b/frontend/src/lib/components/sidebar/SettingsMenu.svelte
@@ -136,8 +136,32 @@
 
 	// Account / instance actions gathered under one "Settings" dropdown, shared by
 	// the session rail and the global sidebar so both expose the same entry point.
-	// User sits just above Logout so the account-scoped entries read as one block.
-	const items = $derived<Item[]>([
+	// Logout lives inside the user submenu with the other account-scoped entries.
+	// Workspace- and instance-scoped entries anchor the bottom of the menu,
+	// instance settings last.
+	const workspaceInstanceItems = $derived<Item[]>([
+		...(!canManageWorkspace && !workspaceSettingsTarget
+			? [
+					{
+						displayName: 'Leave workspace',
+						icon: LogOut,
+						type: 'delete' as const,
+						action: () => (leaveWorkspaceModal = true)
+					}
+				]
+			: []),
+		// Fork deletion is a global-sidebar action on the active workspace, so keep it
+		// out of the session rail's per-target settings entry (`workspaceSettingsTarget`).
+		...(currentWsIsFork && !workspaceSettingsTarget
+			? [
+					{
+						displayName: 'Delete forked workspace',
+						icon: Trash2,
+						type: 'delete' as const,
+						action: () => deleteForkModal?.openModal()
+					}
+				]
+			: []),
 		...(canManageWorkspace
 			? [
 					workspaceSettingsTarget
@@ -163,35 +187,15 @@
 						action: () => goto(SUPERADMIN_SETTINGS_HASH)
 					}
 				]
-			: []),
-		...(!canManageWorkspace && !workspaceSettingsTarget
-			? [
-					{
-						displayName: 'Leave workspace',
-						icon: LogOut,
-						type: 'delete' as const,
-						action: () => (leaveWorkspaceModal = true)
-					}
-				]
-			: []),
-		// Fork deletion is a global-sidebar action on the active workspace, so keep it
-		// out of the session rail's per-target settings entry (`workspaceSettingsTarget`).
-		...(currentWsIsFork && !workspaceSettingsTarget
-			? [
-					{
-						displayName: 'Delete forked workspace',
-						icon: Trash2,
-						type: 'delete' as const,
-						action: () => deleteForkModal?.openModal()
-					}
-				]
-			: []),
+			: [])
+	])
+
+	const items = $derived<Item[]>([
 		{
 			displayName: 'Help',
 			icon: HelpCircle,
 			submenuItems: helpItems,
-			extra: helpPing,
-			separatorTop: true
+			extra: helpPing
 		},
 		{
 			displayName: 'Switch theme',
@@ -218,10 +222,11 @@
 								disabled: true
 							}
 						]
-					: [])
+					: []),
+				{ displayName: 'Logout', icon: LogOut, action: () => logout() }
 			]
 		},
-		{ displayName: 'Logout', icon: LogOut, action: () => logout() }
+		...workspaceInstanceItems.map((item, i) => (i === 0 ? { ...item, separatorTop: true } : item))
 	])
 
 	const logsItems = $derived<Item[]>([

From 7fda6a05345d14f62dc2124d682650d50eecbe98 Mon Sep 17 00:00:00 2001
From: Guilhem <guilhemlemouel@gmail.com>
Date: Thu, 16 Jul 2026 13:36:45 +0200
Subject: [PATCH 013/171] feat(frontend): flatten workspace pickers, whole-tab
 picker trigger (#10145)

* fix(frontend): open session preview picker from whole tab, anchor to tab edge

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat(frontend): flatten session preview picker to workspace home level

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat(frontend): flatten chat context picker workspace tree

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(frontend): show root loading state in flat drill pickers

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(frontend): make tab-strip keyboard activation work inside dnd zones

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(frontend): return focus to tab after active-tab picker closes

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(frontend): move focus with selection on arrow-key tab navigation

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
---
 .../src/lib/components/DrillPicker.svelte     | 17 ++++-
 .../common/tabs/DraggableTabs.svelte          | 46 ++++++++----
 .../copilot/chat/ChatContextPicker.svelte     | 48 ++++++-------
 .../sessions/PreviewRouterPicker.svelte       | 34 ++++++---
 .../src/lib/components/workspaceTree.test.ts  | 71 +++++++++++++++++--
 frontend/src/lib/components/workspaceTree.ts  | 40 ++++++++---
 .../(root)/(logged)/sessions/+page.svelte     | 37 +++++++---
 7 files changed, 219 insertions(+), 74 deletions(-)

diff --git a/frontend/src/lib/components/DrillPicker.svelte b/frontend/src/lib/components/DrillPicker.svelte
index a03a0af39e..556374463e 100644
--- a/frontend/src/lib/components/DrillPicker.svelte
+++ b/frontend/src/lib/components/DrillPicker.svelte
@@ -61,6 +61,10 @@ leaves and ignores the current scope.
 		 * — needed in internal-filter mode where the host can't observe the
 		 * picker's own search box otherwise. */
 		onFilterChange?: (filter: string) => void
+		/** Loading indicator for the ROOT level (scope `[]`), which has no
+		 * branch to carry a `loading` flag. Needed by flat workspace layouts
+		 * whose root entries only exist once items are fetched. */
+		rootLoading?: boolean
 	}
 
 	let {
@@ -75,7 +79,8 @@ leaves and ignores the current scope.
 		branchIcon,
 		leafSecondary,
 		onScopeChange,
-		onFilterChange
+		onFilterChange,
+		rootLoading = false
 	}: Props = $props()
 
 	let searchInput: TextInput | undefined = $state()
@@ -341,7 +346,7 @@ leaves and ignores the current scope.
 		})
 	})
 
-	const branchLoading = $derived(currentBranch?.loading ?? false)
+	const branchLoading = $derived(currentBranch ? (currentBranch.loading ?? false) : rootLoading)
 </script>
 
 <SearchItems
@@ -515,6 +520,14 @@ leaves and ignores the current scope.
 						</button>
 					{/if}
 				{/each}
+				{#if branchLoading}
+					<!-- More rows are still being fetched (flat-layout roots surface
+					     entries only as their kinds load — e.g. Pages present, dirs
+					     pending). The empty case is handled above. -->
+					<div role="status" class="px-3 py-1.5 text-xs text-tertiary flex items-center gap-2">
+						<Loader2 size={14} class="animate-spin" /> Loading…
+					</div>
+				{/if}
 			</div>
 		{/if}
 	</div>
diff --git a/frontend/src/lib/components/common/tabs/DraggableTabs.svelte b/frontend/src/lib/components/common/tabs/DraggableTabs.svelte
index 905759f391..9b2d75b132 100644
--- a/frontend/src/lib/components/common/tabs/DraggableTabs.svelte
+++ b/frontend/src/lib/components/common/tabs/DraggableTabs.svelte
@@ -34,6 +34,10 @@
 		onSelect: (id: string) => void
 		onClose?: (id: string) => void
 		onReorder?: (newOrder: TabItem[]) => void
+		/** Called instead of `onSelect` when the already-active tab is clicked or
+		 * activated via Enter/Space — lets the active tab host a secondary affordance
+		 * (e.g. toggling the breadcrumb picker rendered in `tabAccessory`). */
+		onActiveClick?: (id: string) => void
 		/** Extra classes for the outer tab strip. */
 		class?: string
 		/** Render inside the scroll row, right after the last tab (e.g. a "+" new-tab
@@ -42,8 +46,10 @@
 		/** Render after the right-pinned tabs, outside the scroll area so it stays
 		 * pinned (e.g. a "Split with Preview" toggle). */
 		trailing?: import('svelte').Snippet
-		/** Render inside each tab, after the label and before the close button (e.g. a
-		 * per-tab chevron/breadcrumb picker). Receives the tab and whether it's active. */
+		/** Render inside each tab (after the label; receives the tab + isActive). Clicks
+		 * bubble to the tab unless the accessory stops them. The tab is position:relative
+		 * so an `absolute inset-0 pointer-events-none` child can anchor a whole-tab
+		 * popover — a *clickable* overlay would break dnd (no drags from nested buttons). */
 		tabAccessory?: import('svelte').Snippet<[TabItem, boolean]>
 	}
 
@@ -53,6 +59,7 @@
 		onSelect,
 		onClose,
 		onReorder,
+		onActiveClick,
 		class: c = '',
 		afterTabs,
 		trailing,
@@ -69,6 +76,7 @@
 	// Local list the dnd zone owns. `consider` updates only this (mid-drag it
 	// holds svelte-dnd-action's shadow placeholder); we commit to the parent on
 	// `finalize` so the placeholder never leaks into a sibling bar.
+	let stripEl = $state<HTMLElement | undefined>(undefined)
 	let dndMiddle = $state<TabItem[]>(untrack(() => middle))
 	let isDragging = false
 	$effect(() => {
@@ -89,29 +97,44 @@
 
 	function tabClasses(isActive: boolean) {
 		return twMerge(
-			'group inline-flex items-center gap-1.5 px-2.5 h-7 text-xs rounded-md select-none cursor-pointer whitespace-nowrap transition-colors focus:outline-none focus-visible:ring-1 focus-visible:ring-border-selected focus-visible:ring-inset',
+			'group relative inline-flex items-center gap-1.5 px-2.5 h-7 text-xs rounded-md select-none cursor-pointer whitespace-nowrap transition-colors focus:outline-none focus-visible:ring-1 focus-visible:ring-border-selected focus-visible:ring-inset',
 			isActive
 				? 'bg-surface-tertiary text-emphasis'
 				: 'bg-transparent text-hint hover:text-secondary'
 		)
 	}
 
+	function activate(tab: TabItem) {
+		if (tab.id === activeId && onActiveClick) onActiveClick(tab.id)
+		else onSelect(tab.id)
+	}
+
+	// Runs as a DIRECT capture listener: svelte-dnd-action's item-wrapper handler
+	// swallows Enter/Space (keyboard drag) before Svelte's root-delegated keydown
+	// would fire, so the tab must claim its keys first via stopPropagation.
 	function handleKeydown(e: KeyboardEvent, tab: TabItem) {
+		if (e.target !== e.currentTarget) return // let nested controls (close ×) act
 		if (e.key === 'Delete' || e.key === 'Backspace') {
 			if (tab.closable !== false) {
 				e.preventDefault()
+				e.stopPropagation()
 				onClose?.(tab.id)
 			}
 		} else if (e.key === 'ArrowLeft' || e.key === 'ArrowRight') {
 			const idx = tabs.findIndex((t) => t.id === tab.id)
 			const next = e.key === 'ArrowLeft' ? idx - 1 : idx + 1
 			if (next >= 0 && next < tabs.length) {
-				onSelect(tabs[next].id)
 				e.preventDefault()
+				e.stopPropagation()
+				onSelect(tabs[next].id)
+				// Selection moved — follow with focus, else the next arrow press
+				// recomputes from this (stale) tab and Delete closes the wrong one.
+				stripEl?.querySelector<HTMLElement>(`[data-tab-id="${CSS.escape(tabs[next].id)}"]`)?.focus()
 			}
 		} else if (e.key === 'Enter' || e.key === ' ') {
 			e.preventDefault()
-			onSelect(tab.id)
+			e.stopPropagation()
+			activate(tab)
 		}
 	}
 
@@ -129,23 +152,20 @@
 	<!-- svelte-ignore a11y_click_events_have_key_events -->
 	<div
 		role="tab"
+		data-tab-id={tab.id}
 		aria-selected={isActive}
 		tabindex={isActive ? 0 : -1}
 		class={twMerge(tabClasses(isActive), tab.closable !== false && 'pr-1')}
-		onclick={() => onSelect(tab.id)}
+		onclick={() => activate(tab)}
 		onauxclick={(e) => handleAuxClick(e, tab)}
-		onkeydown={(e) => handleKeydown(e, tab)}
+		onkeydowncapture={(e) => handleKeydown(e, tab)}
 	>
 		{#if Icon}
 			<Icon size={12} class={tab.iconClass} />
 		{/if}
 		<span class={twMerge('truncate max-w-[180px]', tab.labelClass)}>{tab.label}</span>
 		{#if tabAccessory}
-			<!-- The accessory is its own control (e.g. a picker): a click on it must not
-				 also select/re-select the tab, mirroring the close button below. -->
-			<!-- svelte-ignore a11y_click_events_have_key_events -->
-			<!-- svelte-ignore a11y_no_static_element_interactions -->
-			<span class="inline-flex items-center" onclick={(e) => e.stopPropagation()}>
+			<span class="inline-flex items-center">
 				{@render tabAccessory(tab, isActive)}
 			</span>
 		{/if}
@@ -165,7 +185,7 @@
 	</div>
 {/snippet}
 
-<div class={twMerge('flex items-center bg-surface', c)}>
+<div bind:this={stripEl} class={twMerge('flex items-center bg-surface', c)}>
 	<!-- 4px bar to match the strip's `pb-1` reserve. -->
 	<ScrollableX class="flex-1 min-w-0 pt-1 pl-1 pb-1" style="--wm-scrollbar-size: 4px;">
 		<div class="flex items-center" role="tablist">
diff --git a/frontend/src/lib/components/copilot/chat/ChatContextPicker.svelte b/frontend/src/lib/components/copilot/chat/ChatContextPicker.svelte
index 45a81113a3..b1449710e4 100644
--- a/frontend/src/lib/components/copilot/chat/ChatContextPicker.svelte
+++ b/frontend/src/lib/components/copilot/chat/ChatContextPicker.svelte
@@ -4,15 +4,15 @@ AI chat `@`-mention dropdown. Mounts the generic `DrillPicker` with a
 unified tree:
 
   Diffs / Modules / Databases / Workspace
-                                     ├── All / Flows / Scripts / Apps
-                                     │       └── f/scope/sub/leaf …
+                                     ├── u/user / f/folder …
+                                     │       └── sub/leaf … (kinds mixed)
 
 The Diffs / Modules / Databases branches are synthesized from the chat's
 in-memory `availableContext`. The Workspace branch delegates to
-`buildWorkspaceTree` so the picker shares the workspace caching machinery
-with the standalone picker used by `EditorHeader`. The Apps branch only
-appears in GLOBAL chat and lists raw (code-based) apps; visual apps are
-excluded.
+`buildWorkspaceTree` (flat layout — the workspace home's first level, no
+kind grouping) so the picker shares the workspace caching machinery with
+the standalone picker used by `EditorHeader`. Apps only appear in GLOBAL
+chat and list raw (code-based) apps; visual apps are excluded.
 
 On a workspace-leaf pick, emits a reference-only `WorkspaceScriptElement` /
 `WorkspaceFlowElement` / `WorkspaceAppElement` (path + title + summary).
@@ -263,7 +263,8 @@ Content is materialized at message-prep time by `AIChatManager` — see PR #9216
 			const wsChildren = buildWorkspaceTree({
 				loaded: loadedForTree,
 				kinds: WORKSPACE_KINDS,
-				loadingKind: loader.loadingKind
+				loadingKind: loader.loadingKind,
+				layout: 'flat'
 			}) as DrillNode<ChatLeafData>[]
 			// Workspace-only (e.g. global chat with no diffs/modules/dbs): skip
 			// the redundant 'Workspace' row and surface its children at the root.
@@ -273,7 +274,8 @@ Content is materialized at message-prep time by `AIChatManager` — see PR #9216
 				key: 'workspace',
 				label: 'Workspace',
 				icon: Layers,
-				children: wsChildren
+				children: wsChildren,
+				loading: WORKSPACE_KINDS.some((k) => loader.loadingKind[k])
 			})
 			return branches
 		})()
@@ -326,15 +328,14 @@ Content is materialized at message-prep time by `AIChatManager` — see PR #9216
 
 	function handleScopeChange(scope: string[]) {
 		// Two possible layouts:
-		//   (a) WRAPPED   — `['workspace', 'kind:all', ...]` — chat with Diffs /
+		//   (a) WRAPPED   — `['workspace', 'dir:all:...', ...]` — chat with Diffs /
 		//       Modules / Databases branches alongside Workspace.
-		//   (b) UNWRAPPED — `['kind:all', ...]` or `['dir:flow:...']` — chat
-		//       with only the workspace branch (global chat). The redundant
-		//       'workspace' wrapper is collapsed in the tree builder.
+		//   (b) UNWRAPPED — `['dir:all:...', ...]` — chat with only the workspace
+		//       branch (global chat). The redundant 'workspace' wrapper is
+		//       collapsed in the tree builder.
 		// Empty scope `[]` is the picker root: in (a) it's the chat root
 		// (don't preload — user hasn't entered Workspace yet), in (b) it's
-		// the workspace root itself (preload so kind branches don't render
-		// empty-without-spinner).
+		// the workspace root itself.
 		if (scope.length === 0) {
 			if (isWorkspaceOnly) loader.ensureAll()
 			return
@@ -342,15 +343,9 @@ Content is materialized at message-prep time by `AIChatManager` — see PR #9216
 		if (scope[0] === 'files') return // synthesised from attached files — no fetch
 		const inWorkspace = scope[0] === 'workspace' || isWorkspaceOnly
 		if (!inWorkspace) return // diffs / modules / databases — synthesised, no fetch
-		const path = scope[0] === 'workspace' ? scope.slice(1) : scope
-		// Entering Workspace (wrapped: scope=['workspace']) or its 'All' sub-
-		// branch: preload every kind so the kind branches each show their
-		// spinner/items without a per-drill delay.
-		if (path.length === 0 || path[0] === 'kind:all') {
-			loader.ensureAll()
-			return
-		}
-		loader.ensureForScopeSegment(path[0])
+		// Flat workspace layout: every level is a cross-kind merge, so any
+		// workspace scope needs all kinds loaded.
+		loader.ensureAll()
 	}
 
 	// Close the picker on Escape. The badge popover's melt-ui handles Esc
@@ -386,10 +381,7 @@ Content is materialized at message-prep time by `AIChatManager` — see PR #9216
 {/snippet}
 
 {#snippet branchIcon(branch: DrillBranch<ChatLeafData>)}
-	{#if branch.key === 'kind:flow' || branch.key === 'kind:script' || branch.key === 'kind:app'}
-		{@const k = branch.key.slice(5) as WorkspaceItemKind}
-		<RowIcon kind={k} size={12} />
-	{:else if branch.icon}
+	{#if branch.icon}
 		{@const Icon = branch.icon}
 		<Icon size={12} class="shrink-0 text-tertiary" />
 	{/if}
@@ -407,4 +399,6 @@ Content is materialized at message-prep time by `AIChatManager` — see PR #9216
 		'kind' in leaf.data ? relativizeWorkspacePath(leaf.data.path, scope) : undefined}
 	onScopeChange={handleScopeChange}
 	onFilterChange={loader.onFilterChange}
+	rootLoading={isWorkspaceOnly &&
+		WORKSPACE_KINDS.some((k) => !loader.loaded[k] && loader.loadingKind[k])}
 />
diff --git a/frontend/src/lib/components/sessions/PreviewRouterPicker.svelte b/frontend/src/lib/components/sessions/PreviewRouterPicker.svelte
index da656bf8ef..4673d8f4d4 100644
--- a/frontend/src/lib/components/sessions/PreviewRouterPicker.svelte
+++ b/frontend/src/lib/components/sessions/PreviewRouterPicker.svelte
@@ -1,12 +1,14 @@
 <!--
 @component
-Preview "router" picker — a `WorkspaceItemDrillPicker` superset used by the
-session preview breadcrumb. Same drill model and workspace-item branches, plus
-a leading "Pages" branch (Home, Runs, Workspace settings, …) so the breadcrumb
-can route the preview iframe to non-item pages too, not just scripts/flows/apps.
+Preview "router" picker — a `WorkspaceItemDrillPicker` sibling used by the
+session preview breadcrumb. The root mirrors the workspace home's first level:
+a leading "Pages" branch (Runs, Schedules, Workspace settings, …) followed by
+the `f/<folder>` / `u/<user>` directories flattened across kinds (no
+Flows/Scripts/Apps grouping — leaves carry kind icons instead).
 
 Kept separate from `WorkspaceItemDrillPicker` so the editor breadcrumb (which
-only ever navigates between items) doesn't grow a Pages section.
+only ever navigates between items, grouped by kind) doesn't grow a Pages
+section or the flat layout.
 -->
 <script lang="ts" module>
 	export type Scope = { kind: 'flow' | 'script' | 'app' | 'all'; dir?: string } | undefined
@@ -96,6 +98,13 @@ only ever navigates between items) doesn't grow a Pages section.
 		() => kinds
 	)
 
+	// The flat root is the union of every kind's folders, so there's no
+	// per-kind drill step left to lazy-load from — fetch everything up front
+	// (module-cached; the picker only mounts when its popover opens).
+	$effect(() => {
+		if (effectiveWorkspace) untrack(() => loader.ensureAll())
+	})
+
 	// Surface AI-created drafts the same way the editor picker does so in-flight
 	// chat-scaffolded items are navigable (see WorkspaceItemDrillPicker).
 	const KIND_TO_DRAFT_TYPE = { flow: 'flow', script: 'script', app: 'app' } as const
@@ -179,7 +188,8 @@ only ever navigates between items) doesn't grow a Pages section.
 				kinds,
 				currentItem,
 				loadingKind: loader.loadingKind,
-				extraItemsByKind
+				extraItemsByKind,
+				layout: 'flat'
 			})
 		)
 	])
@@ -193,8 +203,12 @@ only ever navigates between items) doesn't grow a Pages section.
 	const computedInitialScope = untrack(() =>
 		initialHighlight && isArtifactKey(initialHighlight)
 			? ['artifacts']
-			: legacyScopeToPath(initialScope, kinds)
+			: legacyScopeToPath(initialScope, kinds, 'flat')
 	)
+
+	// The flat root has no branch to carry a per-kind loading flag — surface
+	// the first-fetch state at the picker level instead.
+	const rootLoading = $derived(kinds.some((k) => !loader.loaded[k] && loader.loadingKind[k]))
 </script>
 
 {#snippet leafIcon(leaf: DrillLeaf<PreviewTarget>)}
@@ -207,10 +221,7 @@ only ever navigates between items) doesn't grow a Pages section.
 {/snippet}
 
 {#snippet branchIcon(branch: DrillBranch<PreviewTarget>)}
-	{#if branch.key === 'kind:flow' || branch.key === 'kind:script' || branch.key === 'kind:app'}
-		{@const k = branch.key.slice(5) as Kind}
-		<RowIcon kind={k} size={12} />
-	{:else if branch.icon}
+	{#if branch.icon}
 		{@const Icon = branch.icon}
 		<Icon size={12} class="shrink-0 text-tertiary" />
 	{/if}
@@ -233,4 +244,5 @@ only ever navigates between items) doesn't grow a Pages section.
 		if (scope.length > 0) loader.ensureForScopeSegment(scope[0])
 	}}
 	onFilterChange={loader.onFilterChange}
+	{rootLoading}
 />
diff --git a/frontend/src/lib/components/workspaceTree.test.ts b/frontend/src/lib/components/workspaceTree.test.ts
index 9698da9f71..194025806a 100644
--- a/frontend/src/lib/components/workspaceTree.test.ts
+++ b/frontend/src/lib/components/workspaceTree.test.ts
@@ -71,11 +71,11 @@ describe('buildWorkspaceTree', () => {
 				kinds: ['flow'],
 				loadingKind: {}
 			})
-			// At the top we should see the scope dirs (f/demo, u/alice) directly,
+			// At the top we should see the scope dirs (u/alice, f/demo) directly,
 			// not a single 'kind:flow' branch wrapping them.
 			expect(tree.every((n) => isBranch(n) && n.key.startsWith('dir:flow:'))).toBe(true)
-			// f-scopes come before u-scopes
-			expect(tree.map((n) => n.key)).toEqual([dirKey('flow', 'f/demo'), dirKey('flow', 'u/alice')])
+			// u-scopes come before f-scopes
+			expect(tree.map((n) => n.key)).toEqual([dirKey('flow', 'u/alice'), dirKey('flow', 'f/demo')])
 		})
 	})
 
@@ -125,8 +125,8 @@ describe('buildWorkspaceTree', () => {
 				kinds: ['flow'],
 				loadingKind: {}
 			})
-			// Top-level: f/demo (folder scope), u/alice (user scope)
-			expect(tree.map((n) => n.key)).toEqual([dirKey('flow', 'f/demo'), dirKey('flow', 'u/alice')])
+			// Top-level: u/alice (user scope), f/demo (folder scope)
+			expect(tree.map((n) => n.key)).toEqual([dirKey('flow', 'u/alice'), dirKey('flow', 'f/demo')])
 			const demo = findBranch(tree, dirKey('flow', 'f/demo'))
 			// Children: nested folder `sub` first, then leaf `a`
 			expect(childKeys(demo)).toEqual([
@@ -299,6 +299,57 @@ describe('buildWorkspaceTree', () => {
 			expect(JSON.stringify(noOpts)).toEqual(JSON.stringify(emptyExtras))
 		})
 	})
+
+	describe('flat layout', () => {
+		it('roots the cross-kind scope dirs directly (no All / kind branches)', () => {
+			const tree = buildWorkspaceTree({
+				loaded: {
+					flow: [item('flow', 'f/demo/a'), item('flow', 'u/alice/b')],
+					script: [item('script', 'f/demo/c')]
+				},
+				kinds: ['flow', 'script'],
+				loadingKind: {},
+				layout: 'flat'
+			})
+			// u-scopes before f-scopes, keyed under the 'all' namespace.
+			expect(tree.map((n) => n.key)).toEqual([dirKey('all', 'u/alice'), dirKey('all', 'f/demo')])
+		})
+
+		it('mixes every kind inside the same scope dir', () => {
+			const tree = buildWorkspaceTree({
+				loaded: {
+					flow: [item('flow', 'f/demo/a')],
+					script: [item('script', 'f/demo/b')]
+				},
+				kinds: ['flow', 'script'],
+				loadingKind: {},
+				layout: 'flat'
+			})
+			const demo = findBranch(tree, dirKey('all', 'f/demo'))
+			expect(childKeys(demo)).toEqual([
+				leafKeyFor('flow', 'f/demo/a'),
+				leafKeyFor('script', 'f/demo/b')
+			])
+		})
+
+		it('applies extras and currentItem like the by-kind layout', () => {
+			const tree = buildWorkspaceTree({
+				loaded: { flow: [item('flow', 'f/demo/a')], script: [] },
+				kinds: ['flow', 'script'],
+				loadingKind: {},
+				extraItemsByKind: { script: [item('script', 'f/demo/draft')] },
+				currentItem: item('flow', 'f/demo/a'),
+				layout: 'flat'
+			})
+			const demo = findBranch(tree, dirKey('all', 'f/demo'))
+			const leaves = demo.children.filter(isLeaf)
+			expect(leaves.map((l) => l.key)).toEqual([
+				leafKeyFor('flow', 'f/demo/a'),
+				leafKeyFor('script', 'f/demo/draft')
+			])
+			expect(leaves[0].current).toBe(true)
+		})
+	})
 })
 
 describe('legacyScopeToPath', () => {
@@ -333,6 +384,16 @@ describe('legacyScopeToPath', () => {
 			dirKey('flow', 'f/demo')
 		])
 	})
+
+	it('flat: returns [dirKey under all] for a dir scope, ignoring the kind', () => {
+		expect(legacyScopeToPath({ kind: 'flow', dir: 'f/demo' }, ['flow', 'script'], 'flat')).toEqual([
+			dirKey('all', 'f/demo')
+		])
+	})
+
+	it('flat: returns [] without a dir', () => {
+		expect(legacyScopeToPath({ kind: 'all' }, ['flow', 'script'], 'flat')).toEqual([])
+	})
 })
 
 describe('relativizeWorkspacePath', () => {
diff --git a/frontend/src/lib/components/workspaceTree.ts b/frontend/src/lib/components/workspaceTree.ts
index e7da20b62d..454b1c08df 100644
--- a/frontend/src/lib/components/workspaceTree.ts
+++ b/frontend/src/lib/components/workspaceTree.ts
@@ -48,10 +48,10 @@ function buildDirForest(items: WorkspaceItem[]): DirNode[] {
 		cur.leaves.push(it)
 	}
 	const scopes = Array.from(scopeRoots.values()).sort((a, b) => {
-		// `f/` (folder) scopes before `u/` (user) scopes; alphabetical within.
-		const af = a.fullPath.startsWith('f/') ? 0 : 1
-		const bf = b.fullPath.startsWith('f/') ? 0 : 1
-		if (af !== bf) return af - bf
+		// `u/` (user) scopes before `f/` (folder) scopes; alphabetical within.
+		const au = a.fullPath.startsWith('u/') ? 0 : 1
+		const bu = b.fullPath.startsWith('u/') ? 0 : 1
+		if (au !== bu) return au - bu
 		return a.fullPath.localeCompare(b.fullPath)
 	})
 	const sortNode = (n: DirNode) => {
@@ -141,6 +141,7 @@ function withExtras(
 
 /** Build the workspace drill tree.
  *
+ *  Default `by-kind` layout:
  *  - One branch per kind in `kinds` (`Flows` / `Scripts` / `Apps`),
  *    each containing the kind's path hierarchy.
  *  - When `kinds.length > 1`, prepend an `All` branch that merges items
@@ -148,6 +149,12 @@ function withExtras(
  *    leaves don't appear twice in global-search results.
  *  - When `kinds.length === 1`, return the single kind branch's children
  *    directly so the user lands on folders without a redundant level.
+ *
+ *  `flat` layout:
+ *  - No kind grouping — the root IS the workspace home's first level: the
+ *    `f/<folder>` / `u/<user>` scope dirs of the cross-kind merge, mixing
+ *    every kind's items inside. Callers must eager-load all kinds (there is
+ *    no per-kind drill step left to lazy-load from).
  */
 export function buildWorkspaceTree(opts: {
 	loaded: Partial<Record<WorkspaceItemKind, WorkspaceItem[]>>
@@ -160,9 +167,11 @@ export function buildWorkspaceTree(opts: {
 	 * (e.g. AI-created localStorage drafts surfaced by the workspace adapter).
 	 * Extras whose path matches an already-loaded item are dropped. */
 	extraItemsByKind?: Partial<Record<WorkspaceItemKind, WorkspaceItem[]>>
+	layout?: 'by-kind' | 'flat'
 }): DrillNode<WorkspaceItem>[] {
 	const { loaded, kinds, currentItem, extraItemsByKind } = opts
 	const loadingKind = opts.loadingKind ?? {}
+	const layout = opts.layout ?? 'by-kind'
 
 	function kindBranch(k: WorkspaceItemKind): DrillBranch<WorkspaceItem> {
 		const raw = withExtras(loaded[k] ?? [], k, extraItemsByKind)
@@ -182,14 +191,23 @@ export function buildWorkspaceTree(opts: {
 
 	if (kinds.length === 0) return []
 
+	const mergedItems = () =>
+		kinds.flatMap((k) =>
+			withCurrent(withExtras(loaded[k] ?? [], k, extraItemsByKind), k, currentItem)
+		)
+
+	if (layout === 'flat') {
+		const items = mergedItems()
+		const dirs = items.length > 0 ? buildDirForest(items) : []
+		return dirs.map((d) => dirToBranch(d, 'all', currentItem))
+	}
+
 	if (kinds.length === 1) {
 		return kindBranch(kinds[0]).children
 	}
 
 	// Cross-kind 'all' branch — flagged so search doesn't double-count leaves.
-	const allItems = kinds.flatMap((k) =>
-		withCurrent(withExtras(loaded[k] ?? [], k, extraItemsByKind), k, currentItem)
-	)
+	const allItems = mergedItems()
 	const allDirs = allItems.length > 0 ? buildDirForest(allItems) : []
 	const allBranch: DrillBranch<WorkspaceItem> = {
 		type: 'branch',
@@ -208,9 +226,15 @@ export function buildWorkspaceTree(opts: {
  * (BreadcrumbSegment / EditorHeader) onto the new generic `string[]` path. */
 export function legacyScopeToPath(
 	scope: { kind: WorkspaceItemKind | 'all'; dir?: string } | undefined,
-	kinds: WorkspaceItemKind[]
+	kinds: WorkspaceItemKind[],
+	layout: 'by-kind' | 'flat' = 'by-kind'
 ): string[] {
 	if (!scope) return []
+	// Flat layout: no kind branches at all — scope dirs live at root and are
+	// always keyed under the cross-kind 'all' namespace.
+	if (layout === 'flat') {
+		return scope.dir ? [dirKey('all', scope.dir)] : []
+	}
 	// Single-kind mode: there's no kind branch at root; scope's `kind` is
 	// implicit. Only the dir (if any) makes it to the path.
 	if (kinds.length === 1) {
diff --git a/frontend/src/routes/(root)/(logged)/sessions/+page.svelte b/frontend/src/routes/(root)/(logged)/sessions/+page.svelte
index b2021b5e9b..0146acb436 100644
--- a/frontend/src/routes/(root)/(logged)/sessions/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/sessions/+page.svelte
@@ -243,6 +243,10 @@
 		owner?.close(id)
 		const sid = activeRuntime?.sessionId
 		if (sid) mountedTabKeys.delete(tabKey(sid, id))
+		// The active tab is excluded from the picker's pointerdown-outside (so a
+		// label click can toggle it); without this, closing the active tab would
+		// carry the open picker over to the newly active one.
+		activeTabPickerOpen = false
 	}
 	function reorderTabs(next: TabItem[]) {
 		owner?.reorder(next.map((t) => t.id))
@@ -675,36 +679,49 @@
 							</div>
 
 							<!-- Tab strip: open preview pages, shared with the raw-app editor
-								     (DraggableTabs). The active tab hosts its own breadcrumb picker via
-								     the accessory chevron; the "+" trailing opens the router picker.
+								     (DraggableTabs). Clicking the active tab (label or accessory chevron)
+								     toggles its breadcrumb picker; the "+" trailing opens the router picker.
 								     Left/right padding clears the floating collapse/fullscreen buttons. -->
 							<DraggableTabs
 								tabs={previewTabItems}
 								activeId={owner?.activeId ?? ''}
 								onSelect={selectTab}
+								onActiveClick={() => (activeTabPickerOpen = !activeTabPickerOpen)}
 								onClose={closeTab}
 								onReorder={reorderTabs}
-								class="h-8 border-b border-light bg-surface-secondary/50 {fullscreen
+								class="session-preview-tab-strip h-8 border-b border-light bg-surface-secondary/50 {fullscreen
 									? 'pl-1.5'
 									: 'pl-9'} pr-16"
 							>
 								{#snippet tabAccessory(_tab, isActive)}
 									{#if isActive}
+										<!-- Any active-tab click toggles the picker (`onActiveClick`); the tab
+										     is excluded from pointerdown-outside so toggle doesn't race close.
+										     The trigger is an inert whole-tab overlay (anchor only — clickable
+										     would break dnd reorder); the chevron is purely visual. -->
 										<Popover
 											placement="bottom-start"
 											usePointerDownOutside
-											excludeSelectors=".drawer"
+											excludeSelectors=".drawer, .session-preview-tab-strip [role='tab'][aria-selected='true']"
 											disableFocusTrap
 											closeOnOtherPopoverOpen
 											enableFlyTransition
 											bind:isOpen={activeTabPickerOpen}
 											openFocus="[data-workspace-picker-search]"
 											contentClasses="flex flex-col overflow-hidden"
-											class="flex items-center shrink-0 cursor-pointer text-tertiary hover:text-primary"
+											class="absolute inset-0 pointer-events-none"
+											triggerAttrs={{
+												'aria-label': 'Change preview',
+												tabindex: -1,
+												// The inert trigger only ever receives focus from melt's
+												// close-time restore; hand it straight to the tab so
+												// arrow/Delete tab shortcuts keep working.
+												onfocus: (e: FocusEvent) =>
+													(e.currentTarget as HTMLElement)
+														.closest<HTMLElement>('[role="tab"]')
+														?.focus()
+											}}
 										>
-											{#snippet trigger()}
-												<ChevronDown size={12} />
-											{/snippet}
 											{#snippet content()}
 												<PreviewRouterPicker
 													initialScope={activePickerScope}
@@ -719,6 +736,10 @@
 												/>
 											{/snippet}
 										</Popover>
+										<ChevronDown
+											size={12}
+											class="shrink-0 text-tertiary group-hover:text-primary"
+										/>
 									{/if}
 								{/snippet}
 								{#snippet afterTabs()}

From 568dbbee852d59986581b0d16f5ac3e06d6bad6a Mon Sep 17 00:00:00 2001
From: Guilhem <guilhemlemouel@gmail.com>
Date: Thu, 16 Jul 2026 14:56:57 +0200
Subject: [PATCH 014/171] fix(frontend): show friendly draft path for
 draft-only items in pickers (#10136)

* fix(frontend): show friendly draft path for draft-only items in pickers

* fix(frontend): dedupe current draft item and scope tab picker by friendly path

* fix(frontend): key live draft picker entries by storage path

* fix(frontend): fall back to the current leaf when the picker highlight key vanishes

* fix(frontend): remount session tab picker when the friendly scope arrives

* fix(frontend): stamp staged tab path for deployed items with undeployed renames

* fix(frontend): expose staged flow/raw-app renames through the live draft registration
---
 .../src/lib/components/DrillPicker.svelte     |  13 +-
 .../WorkspaceItemDrillPicker.svelte           |  37 ++++--
 .../copilot/chat/ChatContextPicker.svelte     |  10 +-
 .../copilot/chat/global/core.test.ts          |  64 +++++++++-
 .../copilot/chat/global/userDraftAdapter.ts   |  27 ++++-
 .../copilot/chat/global/workspaceItems.ts     |   8 ++
 .../components/sessions/FlowEditorView.svelte |   7 +-
 .../sessions/PreviewRouterPicker.svelte       |  36 ++++--
 .../sessions/RawAppEditorView.svelte          |   6 +-
 .../sessions/SessionEditorTarget.svelte       |  16 ++-
 .../sessions/sessionPreviewTabs.svelte.ts     |  28 +++--
 .../sessions/sessionPreviewTabs.test.ts       |  10 +-
 .../sessions/sessionState.svelte.ts           |  18 ++-
 .../components/workspaceItemsLoader.svelte.ts |   3 +-
 .../src/lib/components/workspacePicker.ts     |  26 +++-
 .../src/lib/components/workspaceTree.test.ts  | 114 ++++++++++++++++++
 frontend/src/lib/components/workspaceTree.ts  |  47 ++++++--
 .../(root)/(logged)/sessions/+page.svelte     |  37 ++++--
 18 files changed, 428 insertions(+), 79 deletions(-)

diff --git a/frontend/src/lib/components/DrillPicker.svelte b/frontend/src/lib/components/DrillPicker.svelte
index 556374463e..49a6fe0b8e 100644
--- a/frontend/src/lib/components/DrillPicker.svelte
+++ b/frontend/src/lib/components/DrillPicker.svelte
@@ -178,10 +178,21 @@ leaves and ignores the current scope.
 	let highlightedKey = $state<string | undefined>(untrack(() => initialHighlight))
 	let highlightedId = $derived(highlightedKey ? idFor(highlightedKey) : undefined)
 
+	// Visible leaf flagged `current`, if any. When the highlight's key vanishes
+	// (rows replaced under it — e.g. the workspace tree swapping a synthetic
+	// current-item leaf for the loaded storage-keyed row, whose key differs),
+	// this is the right anchor to fall back to: resetting to the first row
+	// would make Enter silently target an unrelated sibling.
+	const currentLeafKey = $derived(
+		isSearching
+			? (searchedItems ?? ([] as typeof searchItems)).find((r) => r.leaf.current)?.leaf.key
+			: entryList.find((e) => e.type === 'leaf' && e.node.current)?.key
+	)
+
 	$effect(() => {
 		if (navKeys.length === 0) return
 		if (!highlightedKey || !navKeys.includes(highlightedKey)) {
-			highlightedKey = navKeys[0]
+			highlightedKey = currentLeafKey ?? navKeys[0]
 		}
 	})
 
diff --git a/frontend/src/lib/components/WorkspaceItemDrillPicker.svelte b/frontend/src/lib/components/WorkspaceItemDrillPicker.svelte
index 8ff680ef70..3ec635f08b 100644
--- a/frontend/src/lib/components/WorkspaceItemDrillPicker.svelte
+++ b/frontend/src/lib/components/WorkspaceItemDrillPicker.svelte
@@ -16,12 +16,19 @@ would be surprising.
 	import { workspaceStore } from '$lib/stores'
 	import RowIcon from '$lib/components/common/table/RowIcon.svelte'
 	import { untrack } from 'svelte'
-	import { type WorkspaceItem, type WorkspaceItemKind } from './workspacePicker'
+	import {
+		workspaceItemDisplayPath,
+		type WorkspaceItem,
+		type WorkspaceItemKind
+	} from './workspacePicker'
 	import { useWorkspaceItemsLoader } from './workspaceItemsLoader.svelte'
 	import DrillPicker from './DrillPicker.svelte'
 	import type { DrillBranch, DrillLeaf } from './drillPicker'
 	import { buildWorkspaceTree, legacyScopeToPath, relativizeWorkspacePath } from './workspaceTree'
-	import { listGlobalDrafts } from '$lib/components/copilot/chat/global/userDraftAdapter'
+	import {
+		getGlobalDraftStoragePath,
+		listGlobalDrafts
+	} from '$lib/components/copilot/chat/global/userDraftAdapter'
 	import { isGlobalAiEnabled } from '$lib/components/copilot/chat/global/gate'
 	import { resource } from 'runed'
 
@@ -98,15 +105,24 @@ would be surprising.
 	)
 	function aiDraftsForKind(k: Kind): WorkspaceItem[] {
 		const targetType = KIND_TO_DRAFT_TYPE[k]
+		const ws = effectiveWorkspace
 		return (globalDraftsResource.current ?? [])
 			.filter((d) => d.type === targetType)
-			.map((d) => ({
-				path: d.path,
-				summary: d.summary ?? '',
-				kind: k,
-				// `raw_app` lives on the draft envelope for legacy/raw-app distinction.
-				raw_app: k === 'app' ? !!(d.value as { files?: unknown })?.files : undefined
-			}))
+			.map((d) => {
+				// A live entry's `path` is the editor's friendly effective path —
+				// display-only, so picking a leaf keyed by it would route to a 404.
+				// Re-key to the storage path (identity, dedupe against the loaded
+				// row, navigation) and demote the friendly path to `draftPath`.
+				const storagePath = ws ? getGlobalDraftStoragePath(ws, targetType, d.path) : d.path
+				return {
+					path: storagePath,
+					draftPath: storagePath !== d.path ? d.path : d.draftPath,
+					summary: d.summary ?? '',
+					kind: k,
+					// `raw_app` lives on the draft envelope for legacy/raw-app distinction.
+					raw_app: k === 'app' ? !!(d.value as { files?: unknown })?.files : undefined
+				}
+			})
 	}
 
 	const extraItemsByKind = $derived<Partial<Record<Kind, WorkspaceItem[]>>>(
@@ -154,7 +170,8 @@ would be surprising.
 	{flush}
 	{leafIcon}
 	{branchIcon}
-	leafSecondary={(leaf, scope) => relativizeWorkspacePath(leaf.data.path, scope)}
+	leafSecondary={(leaf, scope) =>
+		relativizeWorkspacePath(workspaceItemDisplayPath(leaf.data), scope)}
 	onScopeChange={(scope) => {
 		if (scope.length > 0) loader.ensureForScopeSegment(scope[0])
 		// Single-kind layout has no kind branch at root — `buildWorkspaceTree`
diff --git a/frontend/src/lib/components/copilot/chat/ChatContextPicker.svelte b/frontend/src/lib/components/copilot/chat/ChatContextPicker.svelte
index b1449710e4..d2cf1dfee6 100644
--- a/frontend/src/lib/components/copilot/chat/ChatContextPicker.svelte
+++ b/frontend/src/lib/components/copilot/chat/ChatContextPicker.svelte
@@ -27,7 +27,11 @@ Content is materialized at message-prep time by `AIChatManager` — see PR #9216
 	import type { FlowModule } from '$lib/gen/types.gen'
 	import DrillPicker from '$lib/components/DrillPicker.svelte'
 	import type { DrillBranch, DrillIcon, DrillLeaf, DrillNode } from '$lib/components/drillPicker'
-	import { type WorkspaceItem, type WorkspaceItemKind } from '$lib/components/workspacePicker'
+	import {
+		workspaceItemDisplayPath,
+		type WorkspaceItem,
+		type WorkspaceItemKind
+	} from '$lib/components/workspacePicker'
 	import { useWorkspaceItemsLoader } from '$lib/components/workspaceItemsLoader.svelte'
 	import { buildWorkspaceTree, relativizeWorkspacePath } from '$lib/components/workspaceTree'
 	import { getFileIcon } from '$lib/components/icons/fileIcon'
@@ -396,7 +400,9 @@ Content is materialized at message-prep time by `AIChatManager` — see PR #9216
 	{leafIcon}
 	{branchIcon}
 	leafSecondary={(leaf, scope) =>
-		'kind' in leaf.data ? relativizeWorkspacePath(leaf.data.path, scope) : undefined}
+		'kind' in leaf.data
+			? relativizeWorkspacePath(workspaceItemDisplayPath(leaf.data), scope)
+			: undefined}
 	onScopeChange={handleScopeChange}
 	onFilterChange={loader.onFilterChange}
 	rootLoading={isWorkspaceOnly &&
diff --git a/frontend/src/lib/components/copilot/chat/global/core.test.ts b/frontend/src/lib/components/copilot/chat/global/core.test.ts
index d65452f1d9..849f462701 100644
--- a/frontend/src/lib/components/copilot/chat/global/core.test.ts
+++ b/frontend/src/lib/components/copilot/chat/global/core.test.ts
@@ -220,10 +220,15 @@ vi.mock('$lib/gen', async () => {
 			listDrafts: vi.fn(async () =>
 				Array.from(backendDrafts.entries()).map(([key, value]) => {
 					const idx = key.indexOf(':')
+					const path = key.slice(idx + 1)
+					// Like the real endpoint: friendly path from the draft JSON, only
+					// when set and different from the storage path.
+					const draftPath = (value as any)?.draft_path
 					return {
 						kind: key.slice(0, idx),
-						path: key.slice(idx + 1),
+						path,
 						summary: (value as any)?.summary,
+						...(draftPath && draftPath !== path ? { draft_path: draftPath } : {}),
 						draft_only: true,
 						created_at: '2026-06-15T00:00:00Z'
 					}
@@ -263,6 +268,7 @@ import { UserDraftDbSyncer } from '$lib/userDraftDbSyncer.svelte'
 import {
 	clearGlobalDrafts,
 	deleteGlobalDraft,
+	listGlobalDrafts,
 	persistGlobalDraft,
 	readGlobalDraftValue,
 	saveGlobalAppDraft
@@ -1606,6 +1612,62 @@ describe('global AI tools', () => {
 			expect(draft.parent_version).toBe(5)
 		})
 
+		it('keeps a draft-only app friendly draft_path through the save whitelist on chat edits', async () => {
+			// A renamed draft-only app parks its typed name in the draft's
+			// `draft_path`. A chat edit round-trips the value through
+			// normalizeAppDraftValue — dropping the field there would rename the
+			// app back to its `draft_<uuid>` storage key.
+			seedBackendDraft('raw_app', 'u/admin/draft_abc', {
+				summary: 'a',
+				files: { '/index.tsx': 'old' },
+				runnables: {},
+				data: { tables: [] },
+				draft_path: 'u/admin/my_pretty_app'
+			})
+
+			await callGlobalTool('write_app_file', {
+				path: 'u/admin/draft_abc',
+				file_path: '/index.tsx',
+				content: 'new'
+			})
+
+			const draft = getBackendDraft<any>('raw_app', 'u/admin/draft_abc', { workspace: WORKSPACE })
+			expect(draft.files['/index.tsx']).toBe('new')
+			expect(draft.draft_path).toBe('u/admin/my_pretty_app')
+		})
+
+		it('lists a live raw app staged rename as draftPath even when registered at the storage key', async () => {
+			// Flow/raw-app renames live in the value's `draft_path` while `path`
+			// stays the storage key; a live registration whose effectivePath is the
+			// storage key must not hide the staged rename from listGlobalDrafts —
+			// the pickers regroup the item under it.
+			const storageKey = 'u/admin/draft_live1'
+			const staged = 'f/team/renamed_app'
+			seedBackendDraft(
+				'raw_app',
+				storageKey,
+				{
+					summary: '',
+					files: { '/App.tsx': 'export default () => null' },
+					runnables: {},
+					data: { tables: [] },
+					draft_path: staged
+				},
+				{ workspace: WORKSPACE }
+			)
+			UserDraft.setLiveEditorDraft({
+				workspace: WORKSPACE,
+				itemKind: 'raw_app',
+				storagePath: storageKey,
+				effectivePath: storageKey
+			})
+
+			const items = await listGlobalDrafts(WORKSPACE)
+			const app = items.find((i) => i.type === 'app' && i.path === storageKey)
+			expect(app?.draftPath).toBe(staged)
+			expect(app?.isLiveDraft).toBe(true)
+		})
+
 		it('blocks deploying an app draft started from an older deployed version', async () => {
 			seedStaleAppDraft('f/apps/stale', 1)
 			mockDeployedApp('f/apps/stale', 2)
diff --git a/frontend/src/lib/components/copilot/chat/global/userDraftAdapter.ts b/frontend/src/lib/components/copilot/chat/global/userDraftAdapter.ts
index 342717f26e..32cf08d229 100644
--- a/frontend/src/lib/components/copilot/chat/global/userDraftAdapter.ts
+++ b/frontend/src/lib/components/copilot/chat/global/userDraftAdapter.ts
@@ -67,7 +67,10 @@ function normalizeAppDraftValue(value: AppDraftValue): AppDraftValue {
 		custom_path: value.custom_path,
 		// Carry the fork-base version through the whitelist — it is dropped on every
 		// save otherwise, which would defeat the stale-draft check.
-		parent_version: value.parent_version
+		parent_version: value.parent_version,
+		// Same for the friendly path of a draft-only app: dropping it here would
+		// rename the app back to its `draft_<uuid>` storage key on every chat edit.
+		draft_path: value.draft_path
 	}
 }
 
@@ -133,6 +136,10 @@ function scriptDraftToWorkspaceItem(path: string, draft: NewScript): WorkspaceIt
 	return {
 		type: 'script',
 		path,
+		// The session editor parks a rename in the draft's `draft_path` (see
+		// sessionDraftCodecs.ts); surface it so lists/pickers show the friendly
+		// name instead of the `draft_<uuid>` storage key.
+		draftPath: (draft as NewScript & { draft_path?: string }).draft_path,
 		summary: draft.summary,
 		language: draft.language,
 		value: draft.content,
@@ -145,6 +152,7 @@ function flowDraftToWorkspaceItem(path: string, draft: Flow): WorkspaceItem {
 	return {
 		type: 'flow',
 		path,
+		draftPath: (draft as Flow & { draft_path?: string }).draft_path,
 		summary: draft.summary,
 		// The persisted flow draft carries `version_id` (the deployed head it was
 		// forked from, pinned at fork by writeDraft/the editor) — the flow analog
@@ -165,6 +173,7 @@ function appDraftToWorkspaceItem(path: string, draft: AppDraftValue): WorkspaceI
 	return {
 		type: 'app',
 		path,
+		draftPath: value.draft_path,
 		summary: value.summary,
 		parentVersionId: value.parent_version,
 		value,
@@ -266,7 +275,14 @@ function userDraftEntryToWorkspaceItem(
 				: undefined
 		}
 	}
-	return item && isLiveDraft ? { ...item, isLiveDraft: true } : item
+	if (!item) return undefined
+	// Drop a draftPath that just repeats `path` (no extra display information),
+	// keep it otherwise — including on live entries: a live editor that
+	// registers its storage key as the effective path (flow/raw-app renames
+	// live in the value's `draft_path`, not `path`) must not hide the staged
+	// rename from lists and pickers.
+	const draftPath = item.draftPath === item.path ? undefined : item.draftPath
+	return isLiveDraft ? { ...item, draftPath, isLiveDraft: true } : { ...item, draftPath }
 }
 
 function liveDisplayPath(
@@ -473,6 +489,7 @@ function backendDraftRowToWorkspaceItem(
 		kind: string
 		path: string
 		summary?: string
+		draft_path?: string
 	}
 ): WorkspaceItem | undefined {
 	if (!(GLOBAL_DRAFT_KINDS as readonly string[]).includes(row.kind)) return undefined
@@ -506,6 +523,12 @@ function backendDraftRowToWorkspaceItem(
 	return {
 		type,
 		path: displayPath,
+		// The row's friendly path (from the draft JSON) names the item; only a
+		// draft_path that repeats the display path adds nothing. Kept even for
+		// live rows — a live registration whose effective path is the storage key
+		// (flow/raw-app renames live in the value's `draft_path`, not `path`)
+		// must not hide the staged rename.
+		draftPath: row.draft_path === displayPath ? undefined : row.draft_path,
 		summary: row.summary,
 		value: undefined,
 		isDraft: true,
diff --git a/frontend/src/lib/components/copilot/chat/global/workspaceItems.ts b/frontend/src/lib/components/copilot/chat/global/workspaceItems.ts
index a8196a5054..21a1c883c3 100644
--- a/frontend/src/lib/components/copilot/chat/global/workspaceItems.ts
+++ b/frontend/src/lib/components/copilot/chat/global/workspaceItems.ts
@@ -75,6 +75,10 @@ export type AppDraftValue = {
 	// Fork base: the deployed app version this draft was started from, pinned at
 	// fork. The app analog of a script's parent_hash / a flow's version_id.
 	parent_version?: number
+	// User-typed friendly path while the app is parked at a `…/draft_<uuid>`
+	// storage path (see RawAppDraft in sessions/appDraftCodec.ts). Must
+	// round-trip through chat writes or an edit erases the chosen name.
+	draft_path?: string
 }
 
 export type ResourceDraftState = {
@@ -99,6 +103,10 @@ export type VariableDraftState = {
 export type WorkspaceItem = {
 	type: WorkspaceItemType
 	path: string
+	/** Friendly display path for a draft parked at a `…/draft_<uuid>` storage
+	 * path (the draft value's `draft_path`). Display-only — `path` is the key
+	 * drafts are stored and routed under. */
+	draftPath?: string
 	summary?: string
 	language?: ScriptLang
 	triggerKind?: TriggerKind
diff --git a/frontend/src/lib/components/sessions/FlowEditorView.svelte b/frontend/src/lib/components/sessions/FlowEditorView.svelte
index 845c6e2bdc..5977c802ec 100644
--- a/frontend/src/lib/components/sessions/FlowEditorView.svelte
+++ b/frontend/src/lib/components/sessions/FlowEditorView.svelte
@@ -77,7 +77,12 @@
 	{onNavigate}
 	{isActiveSession}
 	isActiveTab={active}
-	effectivePath={() => cell.store.val?.path ?? path}
+	effectivePath={() =>
+		// A flow's typed rename lives in `draft_path` (`val.path` is the storage
+		// key), unlike scripts where `val.path` is the typed name — without it the
+		// live-draft registration hides a staged rename from lists and pickers.
+		((cell.store.val as { draft_path?: string } | undefined)?.draft_path || cell.store.val?.path) ??
+		path}
 >
 	{#snippet editor()}
 		<!-- customUi hides the in-editor "Flow AI Chat" button: the session already
diff --git a/frontend/src/lib/components/sessions/PreviewRouterPicker.svelte b/frontend/src/lib/components/sessions/PreviewRouterPicker.svelte
index 4673d8f4d4..58647481fe 100644
--- a/frontend/src/lib/components/sessions/PreviewRouterPicker.svelte
+++ b/frontend/src/lib/components/sessions/PreviewRouterPicker.svelte
@@ -20,7 +20,11 @@ section or the flat layout.
 	import { resource } from 'runed'
 	import { workspaceStore } from '$lib/stores'
 	import RowIcon from '$lib/components/common/table/RowIcon.svelte'
-	import { type WorkspaceItem, type WorkspaceItemKind } from '$lib/components/workspacePicker'
+	import {
+		workspaceItemDisplayPath,
+		type WorkspaceItem,
+		type WorkspaceItemKind
+	} from '$lib/components/workspacePicker'
 	import { useWorkspaceItemsLoader } from '$lib/components/workspaceItemsLoader.svelte'
 	import DrillPicker from '../DrillPicker.svelte'
 	import type { DrillBranch, DrillLeaf, DrillNode } from '$lib/components/drillPicker'
@@ -29,7 +33,10 @@ section or the flat layout.
 		legacyScopeToPath,
 		relativizeWorkspacePath
 	} from '$lib/components/workspaceTree'
-	import { listGlobalDrafts } from '$lib/components/copilot/chat/global/userDraftAdapter'
+	import {
+		getGlobalDraftStoragePath,
+		listGlobalDrafts
+	} from '$lib/components/copilot/chat/global/userDraftAdapter'
 	import { isGlobalAiEnabled } from '$lib/components/copilot/chat/global/gate'
 	import type { PersistedArtifact } from '$lib/components/copilot/chat/artifacts/artifactsDB'
 	import {
@@ -114,14 +121,23 @@ section or the flat layout.
 	)
 	function aiDraftsForKind(k: Kind): WorkspaceItem[] {
 		const targetType = KIND_TO_DRAFT_TYPE[k]
+		const ws = effectiveWorkspace
 		return (globalDraftsResource.current ?? [])
 			.filter((d) => d.type === targetType)
-			.map((d) => ({
-				path: d.path,
-				summary: d.summary ?? '',
-				kind: k,
-				raw_app: k === 'app' ? !!(d.value as { files?: unknown })?.files : undefined
-			}))
+			.map((d) => {
+				// A live entry's `path` is the editor's friendly effective path —
+				// display-only, so picking a leaf keyed by it would route to a 404.
+				// Re-key to the storage path (identity, dedupe against the loaded
+				// row, navigation) and demote the friendly path to `draftPath`.
+				const storagePath = ws ? getGlobalDraftStoragePath(ws, targetType, d.path) : d.path
+				return {
+					path: storagePath,
+					draftPath: storagePath !== d.path ? d.path : d.draftPath,
+					summary: d.summary ?? '',
+					kind: k,
+					raw_app: k === 'app' ? !!(d.value as { files?: unknown })?.files : undefined
+				}
+			})
 	}
 	const extraItemsByKind = $derived<Partial<Record<Kind, WorkspaceItem[]>>>(
 		Object.fromEntries(kinds.map((k) => [k, aiDraftsForKind(k)]))
@@ -239,7 +255,9 @@ section or the flat layout.
 	{leafIcon}
 	{branchIcon}
 	leafSecondary={(leaf, scope) =>
-		leaf.data.type === 'item' ? relativizeWorkspacePath(leaf.data.item.path, scope) : undefined}
+		leaf.data.type === 'item'
+			? relativizeWorkspacePath(workspaceItemDisplayPath(leaf.data.item), scope)
+			: undefined}
 	onScopeChange={(scope) => {
 		if (scope.length > 0) loader.ensureForScopeSegment(scope[0])
 	}}
diff --git a/frontend/src/lib/components/sessions/RawAppEditorView.svelte b/frontend/src/lib/components/sessions/RawAppEditorView.svelte
index e5f9dfe30e..cda34b9dac 100644
--- a/frontend/src/lib/components/sessions/RawAppEditorView.svelte
+++ b/frontend/src/lib/components/sessions/RawAppEditorView.svelte
@@ -96,7 +96,11 @@
 	{onNavigate}
 	{isActiveSession}
 	isActiveTab={active}
-	effectivePath={() => cell.store.val?.path ?? path}
+	effectivePath={() =>
+		// A raw app's typed rename lives in `draft_path` (`val.path` is the storage
+		// key), unlike scripts where `val.path` is the typed name — without it the
+		// live-draft registration hides a staged rename from lists and pickers.
+		(cell.store.val?.draft_path || cell.store.val?.path) ?? path}
 >
 	{#snippet editor()}
 		{#if cell.store.val}
diff --git a/frontend/src/lib/components/sessions/SessionEditorTarget.svelte b/frontend/src/lib/components/sessions/SessionEditorTarget.svelte
index 332433a928..95fd67ef3e 100644
--- a/frontend/src/lib/components/sessions/SessionEditorTarget.svelte
+++ b/frontend/src/lib/components/sessions/SessionEditorTarget.svelte
@@ -128,12 +128,20 @@
 	// typed/auto name. The page can't read the runtime cell reactively (it lives
 	// outside the page's reactive root), but this editor — handed `runtime` as a
 	// prop — can, so it mirrors the name onto the tab model the page does observe.
-	// Only for a never-deployed item still parked at a `…/draft_<uuid>` storage
-	// path; a deployed/real path keeps the plain location label.
+	// The label only applies to a never-deployed item still parked at a
+	// `…/draft_<uuid>` storage path; a deployed/real path keeps the plain
+	// location label.
 	$effect(() => {
 		const v = cell.store.val as { path?: string; draft_path?: string } | undefined
-		const label = draftFriendlyLeaf(path, v?.draft_path ?? v?.path)
-		runtime.previewTabs.setEditorFriendlyLabel({ kind, path }, label)
+		const friendly = v?.draft_path ?? v?.path
+		const label = draftFriendlyLeaf(path, friendly)
+		// The full staged path rides along whenever it differs from the tab's
+		// route (storage) path — not just when it yielded a label: a DEPLOYED
+		// item with a staged rename is also regrouped under the typed folder by
+		// the picker tree (via the live-draft overlay's `draftPath`), so the
+		// breadcrumb picker needs it to scope where the item is displayed.
+		const staged = friendly && friendly !== path ? friendly : undefined
+		runtime.previewTabs.setEditorFriendlyLabel({ kind, path }, label, staged)
 	})
 
 	// Debounced loading affordance for a breadcrumb swap: while the loaded path
diff --git a/frontend/src/lib/components/sessions/sessionPreviewTabs.svelte.ts b/frontend/src/lib/components/sessions/sessionPreviewTabs.svelte.ts
index 2be87131d2..c88387d1b4 100644
--- a/frontend/src/lib/components/sessions/sessionPreviewTabs.svelte.ts
+++ b/frontend/src/lib/components/sessions/sessionPreviewTabs.svelte.ts
@@ -52,13 +52,15 @@ function targetUrl(target: PreviewTarget): string {
 	return `${base}${editPathFor(target.item)}`
 }
 
-// Point a tab at a new destination. Clears `friendlyLabel` (bound to the previous
-// editor's item): a new editor re-stamps it, and navigating to a plain page must
-// drop the stale name so the tab falls back to the location label.
+// Point a tab at a new destination. Clears `friendlyLabel`/`friendlyPath`
+// (bound to the previous editor's item): a new editor re-stamps them, and
+// navigating to a plain page must drop the stale name so the tab falls back
+// to the location label.
 function retargetTab(tab: SessionPreviewTab, url: string): void {
 	tab.url = url
 	tab.loc = url
 	tab.friendlyLabel = undefined
+	tab.friendlyPath = undefined
 }
 
 // Strip the query params the sessions preview injects into iframe URLs
@@ -385,15 +387,21 @@ export class SessionPreviewTabs {
 		this.#flush()
 	}
 
-	// Stamp the friendly display label for the editor tab hosting `target` (the
-	// live editor knows the item's typed/auto name once its cell loads, which the
-	// page can't read reactively from the runtime cell). Matched on the tab's
-	// commanded `url` — the stable per-(kind,path) editor identity. Transient, so
-	// no persist/flush: it's recomputed when the tab remounts.
-	setEditorFriendlyLabel(target: SessionTarget, label: string | undefined): void {
+	// Stamp the friendly display label (and full friendly path, which scopes the
+	// breadcrumb picker) for the editor tab hosting `target` (the live editor
+	// knows the item's typed/auto name once its cell loads, which the page can't
+	// read reactively from the runtime cell). Matched on the tab's commanded
+	// `url` — the stable per-(kind,path) editor identity. Transient, so no
+	// persist/flush: they're recomputed when the tab remounts.
+	setEditorFriendlyLabel(
+		target: SessionTarget,
+		label: string | undefined,
+		friendlyPath?: string
+	): void {
 		const t = this.#tabs.find((x) => isEditorTabFor(x.url, target))
-		if (!t || t.friendlyLabel === label) return
+		if (!t || (t.friendlyLabel === label && t.friendlyPath === friendlyPath)) return
 		t.friendlyLabel = label
+		t.friendlyPath = friendlyPath
 	}
 
 	// Persist a pending write immediately, cancelling the debounce. Called on
diff --git a/frontend/src/lib/components/sessions/sessionPreviewTabs.test.ts b/frontend/src/lib/components/sessions/sessionPreviewTabs.test.ts
index 4458ab8cbe..a43e31247e 100644
--- a/frontend/src/lib/components/sessions/sessionPreviewTabs.test.ts
+++ b/frontend/src/lib/components/sessions/sessionPreviewTabs.test.ts
@@ -356,14 +356,20 @@ describe('SessionPreviewTabs.navigate', () => {
 		expect(o.tabs[0].url).toBe(artifactUrl('art1', 'Plan'))
 	})
 
-	it('drops a stale friendly label when the tab is retargeted', () => {
+	it('drops a stale friendly label and path when the tab is retargeted', () => {
 		const o = owner()
 		o.open(flowTarget)
-		o.setEditorFriendlyLabel({ kind: 'flow', path: 'u/me/bar' }, 'luminous_flow')
+		o.setEditorFriendlyLabel(
+			{ kind: 'flow', path: 'u/me/bar' },
+			'luminous_flow',
+			'u/me/luminous_flow'
+		)
 		expect(o.tabs[0].friendlyLabel).toBe('luminous_flow')
+		expect(o.tabs[0].friendlyPath).toBe('u/me/luminous_flow')
 		// Navigating the same tab to a plain page must clear the flow's name.
 		o.navigate(pageTarget)
 		expect(o.tabs[0].friendlyLabel).toBeUndefined()
+		expect(o.tabs[0].friendlyPath).toBeUndefined()
 	})
 })
 
diff --git a/frontend/src/lib/components/sessions/sessionState.svelte.ts b/frontend/src/lib/components/sessions/sessionState.svelte.ts
index 606ef69c27..1c38838787 100644
--- a/frontend/src/lib/components/sessions/sessionState.svelte.ts
+++ b/frontend/src/lib/components/sessions/sessionState.svelte.ts
@@ -132,10 +132,20 @@ export type Session = {
 
 // One preview tab: `url` is the URL we command the iframe to load, `loc` the
 // last observed location (see the sessions page for the url/loc split).
-// `friendlyLabel` is a transient display override the live editor stamps for a
-// never-deployed item parked at `…/draft_<uuid>` (its typed/auto name); not
-// persisted (hydrate rebuilds tabs field-by-field), recomputed on next mount.
-export type SessionPreviewTab = { id: string; url: string; loc: string; friendlyLabel?: string }
+// `friendlyLabel` / `friendlyPath` are transient overrides the live editor
+// stamps; not persisted (hydrate rebuilds tabs field-by-field), recomputed on
+// next mount. `friendlyLabel` names a never-deployed item parked at
+// `…/draft_<uuid>` (its typed/auto name). `friendlyPath` is the item's full
+// staged path whenever it differs from the tab's route path — draft-parked OR
+// a deployed item with an undeployed rename — and scopes the breadcrumb
+// picker into the folder the picker tree displays the item under.
+export type SessionPreviewTab = {
+	id: string
+	url: string
+	loc: string
+	friendlyLabel?: string
+	friendlyPath?: string
+}
 
 // Sessions live in one per-user IndexedDB, one record per session in the
 // `sessions` store keyed by `id`. IndexedDB is the sole store — no localStorage
diff --git a/frontend/src/lib/components/workspaceItemsLoader.svelte.ts b/frontend/src/lib/components/workspaceItemsLoader.svelte.ts
index 4ac65f805b..b31b7f82c5 100644
--- a/frontend/src/lib/components/workspaceItemsLoader.svelte.ts
+++ b/frontend/src/lib/components/workspaceItemsLoader.svelte.ts
@@ -28,7 +28,8 @@ function itemsEqual(a: WorkspaceItem[] | undefined, b: WorkspaceItem[]): boolean
 			item.path === b[i].path &&
 			item.summary === b[i].summary &&
 			item.kind === b[i].kind &&
-			item.raw_app === b[i].raw_app
+			item.raw_app === b[i].raw_app &&
+			item.draftPath === b[i].draftPath
 	)
 }
 
diff --git a/frontend/src/lib/components/workspacePicker.ts b/frontend/src/lib/components/workspacePicker.ts
index 92ea48af20..e88417b5a2 100644
--- a/frontend/src/lib/components/workspacePicker.ts
+++ b/frontend/src/lib/components/workspacePicker.ts
@@ -7,6 +7,17 @@ export type WorkspaceItem = {
 	summary: string
 	kind: WorkspaceItemKind
 	raw_app?: boolean
+	/** User-typed friendly path for a draft-only item parked at a
+	 * `…/draft_<uuid>` storage path (the backend lists' `draft_path`).
+	 * Display-only: `path` stays the storage key and is what URLs and
+	 * dedupe must use — routing to the friendly path 404s. */
+	draftPath?: string
+}
+
+/** Path to display (and group by) in pickers: the friendly draft path when
+ * the item has one, else the real path. */
+export function workspaceItemDisplayPath(item: Pick<WorkspaceItem, 'path' | 'draftPath'>): string {
+	return item.draftPath ?? item.path
 }
 
 /** Display label for kinds — used in the picker rows and search section headers. */
@@ -109,10 +120,11 @@ export async function loadKind(
 				includeDraftOnly: true,
 				withoutDescription: true
 			})
-			items = flows.map((f: Flow) => ({
+			items = flows.map((f: Flow & { draft_path?: string }) => ({
 				path: f.path,
 				summary: f.summary ?? '',
-				kind: 'flow' as const
+				kind: 'flow' as const,
+				draftPath: f.draft_path
 			}))
 		} else if (kind === 'script') {
 			const scripts = await ScriptService.listScripts({
@@ -120,21 +132,23 @@ export async function loadKind(
 				includeDraftOnly: true,
 				withoutDescription: true
 			})
-			items = scripts.map((s: Script) => ({
+			items = scripts.map((s: Script & { draft_path?: string }) => ({
 				path: s.path,
 				summary: s.summary ?? '',
-				kind: 'script' as const
+				kind: 'script' as const,
+				draftPath: s.draft_path
 			}))
 		} else {
 			const apps = await AppService.listApps({
 				workspace,
 				includeDraftOnly: true
 			})
-			items = apps.map((a: ListableApp) => ({
+			items = apps.map((a: ListableApp & { draft_path?: string }) => ({
 				path: a.path,
 				summary: a.summary ?? '',
 				kind: 'app' as const,
-				raw_app: a.raw_app ?? false
+				raw_app: a.raw_app ?? false,
+				draftPath: a.draft_path
 			}))
 		}
 		// Only commit if the cache version hasn't changed since we started —
diff --git a/frontend/src/lib/components/workspaceTree.test.ts b/frontend/src/lib/components/workspaceTree.test.ts
index 194025806a..3e1dabd7a5 100644
--- a/frontend/src/lib/components/workspaceTree.test.ts
+++ b/frontend/src/lib/components/workspaceTree.test.ts
@@ -178,6 +178,41 @@ describe('buildWorkspaceTree', () => {
 			expect(leaf.secondary).toBeUndefined()
 		})
 
+		it('labels and groups a draft-only item by its friendly draftPath, keyed by storage path', () => {
+			const draft = { ...item('app', 'u/admin/draft_abc123'), draftPath: 'f/marketing/dashboard' }
+			const tree = buildWorkspaceTree({
+				loaded: { app: [draft] },
+				kinds: ['app'],
+				loadingKind: {}
+			})
+			// Grouped under the friendly folder, not u/admin.
+			expect(tree.map((n) => n.key)).toEqual([dirKey('app', 'f/marketing')])
+			const marketing = findBranch(tree, dirKey('app', 'f/marketing'))
+			const leaf = marketing.children[0]
+			if (!isLeaf(leaf)) throw new Error('expected leaf')
+			// Displayed by the friendly path; keyed (and navigated) by storage path.
+			expect(leaf.label).toBe('f/marketing/dashboard')
+			expect(leaf.key).toBe(leafKeyFor('app', 'u/admin/draft_abc123'))
+			expect(leaf.data.path).toBe('u/admin/draft_abc123')
+		})
+
+		it('uses the friendly draftPath as secondary when a summary is present', () => {
+			const draft = {
+				...item('script', 'u/admin/draft_xyz', 'My Script'),
+				draftPath: 'u/admin/my_script'
+			}
+			const tree = buildWorkspaceTree({
+				loaded: { script: [draft] },
+				kinds: ['script'],
+				loadingKind: {}
+			})
+			const admin = findBranch(tree, dirKey('script', 'u/admin'))
+			const leaf = admin.children[0]
+			if (!isLeaf(leaf)) throw new Error('expected leaf')
+			expect(leaf.label).toBe('My Script')
+			expect(leaf.secondary).toBe('u/admin/my_script')
+		})
+
 		it('marks the currentItem leaf with current=true', () => {
 			const tree = buildWorkspaceTree({
 				loaded: { flow: [item('flow', 'f/demo/a'), item('flow', 'f/demo/b')] },
@@ -218,6 +253,45 @@ describe('buildWorkspaceTree', () => {
 			expect(paths).not.toContain(leafKeyFor('flow', 'f/demo/old'))
 		})
 
+		it('does not duplicate a draft-only row whose friendly draftPath is the current live path', () => {
+			// Editor open on a renamed draft-only script: currentItem.path is the
+			// friendly path while listScripts returns the storage-path row carrying
+			// the same friendly path as draftPath. One leaf, marked current.
+			const loadedDraft = {
+				...item('script', 'u/admin/draft_abc'),
+				draftPath: 'u/admin/my_script'
+			}
+			const tree = buildWorkspaceTree({
+				loaded: { script: [loadedDraft] },
+				kinds: ['script'],
+				loadingKind: {},
+				currentItem: item('script', 'u/admin/my_script')
+			})
+			const admin = findBranch(tree, dirKey('script', 'u/admin'))
+			expect(admin.children.map((c) => c.key)).toEqual([leafKeyFor('script', 'u/admin/draft_abc')])
+			const leaf = admin.children[0]
+			if (!isLeaf(leaf)) throw new Error('expected leaf')
+			expect(leaf.current).toBe(true)
+		})
+
+		it('drops the storage-path row via draftPath during a mid-rename', () => {
+			// Renaming a draft-only item: savedPath is the old friendly path, which
+			// the loaded row only knows as its draftPath. The stale row must go so
+			// only the live (typed) entry shows.
+			const loadedDraft = {
+				...item('script', 'u/admin/draft_abc'),
+				draftPath: 'u/admin/old_name'
+			}
+			const tree = buildWorkspaceTree({
+				loaded: { script: [loadedDraft] },
+				kinds: ['script'],
+				loadingKind: {},
+				currentItem: { ...item('script', 'u/admin/new_name'), savedPath: 'u/admin/old_name' }
+			})
+			const admin = findBranch(tree, dirKey('script', 'u/admin'))
+			expect(admin.children.map((c) => c.key)).toEqual([leafKeyFor('script', 'u/admin/new_name')])
+		})
+
 		it('does not re-inject when the live entry already exists in loaded', () => {
 			const tree = buildWorkspaceTree({
 				loaded: { flow: [item('flow', 'f/demo/a', 'Original')] },
@@ -284,6 +358,46 @@ describe('buildWorkspaceTree', () => {
 			expect(keys).toContain(leafKeyFor('script', 'f/demo/b'))
 		})
 
+		it('drops a live-cell extra at the friendly path when a loaded row carries it as draftPath', () => {
+			// listApps returns the draft-only row at its storage path with the
+			// friendly path in draftPath; the live editor cell surfaces the same
+			// draft as an extra keyed by the friendly path. One leaf, not two.
+			const loadedDraft = { ...item('app', 'u/admin/draft_abc'), draftPath: 'u/admin/dashboard' }
+			const tree = buildWorkspaceTree({
+				loaded: { app: [loadedDraft] },
+				kinds: ['app'],
+				loadingKind: {},
+				extraItemsByKind: { app: [item('app', 'u/admin/dashboard')] }
+			})
+			const admin = findBranch(tree, dirKey('app', 'u/admin'))
+			expect(admin.children.map((c) => c.key)).toEqual([leafKeyFor('app', 'u/admin/draft_abc')])
+		})
+
+		it('folds a mid-rename live extra into the stale loaded row: one storage-keyed leaf under the typed folder', () => {
+			// Session picker while a rename's autosave is pending: listApps still
+			// carries the pre-rename friendly path, the live cell extra (re-keyed to
+			// the storage path by the picker) carries the typed one, and the tab's
+			// currentItem is the storage path. The typed name must win, on a single
+			// leaf that navigates via the storage path — never the display path.
+			const staleLoaded = { ...item('app', 'u/admin/draft_abc'), draftPath: 'u/admin/old_name' }
+			const liveExtra = { ...item('app', 'u/admin/draft_abc'), draftPath: 'f/marketing/new_name' }
+			const tree = buildWorkspaceTree({
+				loaded: { app: [staleLoaded] },
+				kinds: ['app'],
+				loadingKind: {},
+				extraItemsByKind: { app: [liveExtra] },
+				currentItem: item('app', 'u/admin/draft_abc')
+			})
+			expect(tree.map((n) => n.key)).toEqual([dirKey('app', 'f/marketing')])
+			const marketing = findBranch(tree, dirKey('app', 'f/marketing'))
+			expect(marketing.children.map((c) => c.key)).toEqual([leafKeyFor('app', 'u/admin/draft_abc')])
+			const leaf = marketing.children[0]
+			if (!isLeaf(leaf)) throw new Error('expected leaf')
+			expect(leaf.current).toBe(true)
+			expect(leaf.data.path).toBe('u/admin/draft_abc')
+			expect(leaf.label).toBe('f/marketing/new_name')
+		})
+
 		it('is a no-op when extras are absent or empty', () => {
 			const noOpts = buildWorkspaceTree({
 				loaded: { flow: [item('flow', 'f/demo/a')] },
diff --git a/frontend/src/lib/components/workspaceTree.ts b/frontend/src/lib/components/workspaceTree.ts
index 454b1c08df..3a922ef45b 100644
--- a/frontend/src/lib/components/workspaceTree.ts
+++ b/frontend/src/lib/components/workspaceTree.ts
@@ -4,6 +4,7 @@ import {
 	KIND_LABEL,
 	kindKey,
 	leafKeyFor,
+	workspaceItemDisplayPath,
 	type WorkspaceItem,
 	type WorkspaceItemKind
 } from './workspacePicker'
@@ -21,11 +22,13 @@ type DirNode = {
 	leaves: WorkspaceItem[]
 }
 
-/** Build the path-hierarchy from a flat list of workspace items. */
+/** Build the path-hierarchy from a flat list of workspace items. Items are
+ * placed by their display path, so a draft-only item shows up under its
+ * friendly folder rather than the `u/<user>/draft_<uuid>` storage location. */
 function buildDirForest(items: WorkspaceItem[]): DirNode[] {
 	const scopeRoots = new Map<string, DirNode>()
 	for (const it of items) {
-		const parts = it.path.split('/')
+		const parts = workspaceItemDisplayPath(it).split('/')
 		if (parts.length < 3) continue
 		const scopeFp = parts.slice(0, 2).join('/')
 		let node = scopeRoots.get(scopeFp)
@@ -56,13 +59,21 @@ function buildDirForest(items: WorkspaceItem[]): DirNode[] {
 	})
 	const sortNode = (n: DirNode) => {
 		n.children.sort((a, b) => a.name.localeCompare(b.name))
-		n.leaves.sort((a, b) => a.path.localeCompare(b.path))
+		n.leaves.sort((a, b) => workspaceItemDisplayPath(a).localeCompare(workspaceItemDisplayPath(b)))
 		n.children.forEach(sortNode)
 	}
 	scopes.forEach(sortNode)
 	return scopes
 }
 
+/** True when `p` names this item — its storage path or its friendly draft
+ * path. A draft-only editor's live/saved paths are the friendly path while
+ * the loaded row sits at the storage path, so matching on `path` alone would
+ * treat them as two different items. */
+function itemMatchesPath(it: WorkspaceItem, p: string | undefined): boolean {
+	return p !== undefined && (it.path === p || it.draftPath === p)
+}
+
 /** Inject the currently-edited item at its live path, dropping the saved
  * entry when a draft rename is mid-flight. Only applies to items of the
  * same kind. */
@@ -74,9 +85,9 @@ function withCurrent(
 	if (!currentItem || currentItem.kind !== k) return items
 	const drafted =
 		currentItem.savedPath && currentItem.savedPath !== currentItem.path
-			? items.filter((it) => it.path !== currentItem.savedPath)
+			? items.filter((it) => !itemMatchesPath(it, currentItem.savedPath))
 			: items
-	if (drafted.some((it) => it.path === currentItem.path)) return drafted
+	if (drafted.some((it) => itemMatchesPath(it, currentItem.path))) return drafted
 	return [
 		...drafted,
 		{
@@ -92,12 +103,14 @@ function itemToLeaf(
 	it: WorkspaceItem,
 	currentItem: (WorkspaceItem & { savedPath?: string }) | undefined
 ): DrillLeaf<WorkspaceItem> {
-	const isCurrent = !!currentItem && currentItem.kind === it.kind && currentItem.path === it.path
+	const isCurrent =
+		!!currentItem && currentItem.kind === it.kind && itemMatchesPath(it, currentItem.path)
+	const display = workspaceItemDisplayPath(it)
 	return {
 		type: 'leaf',
 		key: leafKeyFor(it.kind, it.path),
-		label: it.summary || it.path,
-		secondary: it.summary ? it.path : undefined,
+		label: it.summary || display,
+		secondary: it.summary ? display : undefined,
 		data: it,
 		current: isCurrent
 	}
@@ -126,8 +139,10 @@ function dirToBranch(
 /** Merge AI-created in-memory drafts (or any caller-provided extras) into a
  * kind's loaded list. The chat tools / session previews scaffold items via
  * `UserDraft` before the user deploys; those should be navigable from the
- * picker. Existing items (same path) win so backend metadata (summary etc.)
- * isn't clobbered. */
+ * picker. An extra matching a loaded item (by storage or friendly path — else
+ * one draft renders as two leaves) is folded into it: the loaded row wins on
+ * backend metadata (summary etc.), but the extra's `draftPath` is overlaid
+ * when set — a live editor cell knows a rename before the backend list does. */
 function withExtras(
 	items: WorkspaceItem[],
 	k: WorkspaceItemKind,
@@ -135,8 +150,16 @@ function withExtras(
 ): WorkspaceItem[] {
 	const extras = extraItemsByKind?.[k]
 	if (!extras || extras.length === 0) return items
-	const known = new Set(items.map((it) => it.path))
-	return items.concat(extras.filter((d) => !known.has(d.path)))
+	const leftover = new Set(extras)
+	const merged = items.map((it) => {
+		const ex = extras.find((d) => itemMatchesPath(it, d.path) || itemMatchesPath(it, d.draftPath))
+		if (!ex) return it
+		leftover.delete(ex)
+		return ex.draftPath !== undefined && ex.draftPath !== it.draftPath
+			? { ...it, draftPath: ex.draftPath }
+			: it
+	})
+	return leftover.size > 0 ? merged.concat([...leftover]) : merged
 }
 
 /** Build the workspace drill tree.
diff --git a/frontend/src/routes/(root)/(logged)/sessions/+page.svelte b/frontend/src/routes/(root)/(logged)/sessions/+page.svelte
index 0146acb436..7062e8fc8d 100644
--- a/frontend/src/routes/(root)/(logged)/sessions/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/sessions/+page.svelte
@@ -425,9 +425,13 @@
 	const parsedRoute = $derived(parsePreviewItemRoute(displayPath))
 
 	// Split the item path into breadcrumb dirs + leaf, mirroring EditorHeader:
-	// scope (`f/<folder>` | `u/<user>`) → subfolders → item name.
+	// scope (`f/<folder>` | `u/<user>`) → subfolders → item name. Prefers the
+	// tab's friendly path (a draft-only item's typed name): the picker tree
+	// groups such an item under its friendly folder, so dirs derived from the
+	// `…/draft_<uuid>` storage path would scope the picker into a folder the
+	// item isn't displayed in.
 	const segments = $derived.by(() => {
-		const itemPath = parsedRoute?.itemPath
+		const itemPath = owner?.activeTab?.friendlyPath ?? parsedRoute?.itemPath
 		if (!itemPath) return null
 		const parts = itemPath.split('/')
 		if (parts.length < 3) return null
@@ -723,17 +727,24 @@
 											}}
 										>
 											{#snippet content()}
-												<PreviewRouterPicker
-													initialScope={activePickerScope}
-													initialHighlight={activePickerHighlight}
-													{currentItem}
-													workspaceId={previewWorkspace}
-													artifacts={sessionArtifacts}
-													onPick={(t) => {
-														activeTabPickerOpen = false
-														navigatePreviewTo(t)
-													}}
-												/>
+												<!-- The picker snapshots its scope at mount, but `friendlyPath` is
+												     stamped async once the editor cell loads — a picker opened
+												     before the stamp is scoped to the `draft_<uuid>` storage
+												     folder while the tree groups the draft under its friendly
+												     folder. Remount on the scope dir so it re-lands on the item. -->
+												{#key activePickerScope?.dir ?? ''}
+													<PreviewRouterPicker
+														initialScope={activePickerScope}
+														initialHighlight={activePickerHighlight}
+														{currentItem}
+														workspaceId={previewWorkspace}
+														artifacts={sessionArtifacts}
+														onPick={(t) => {
+															activeTabPickerOpen = false
+															navigatePreviewTo(t)
+														}}
+													/>
+												{/key}
 											{/snippet}
 										</Popover>
 										<ChevronDown

From 4e0fd4db5589f91426ca025184da7b977d5a16d6 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Thu, 16 Jul 2026 14:58:26 +0200
Subject: [PATCH 015/171] feat(alerts): include disk total and top consumers in
 low-disk alert (#10144)

* feat(alerts): include disk total and top consumers in low-disk alert

Point ee-repo-ref at the companion windmill-ee-private commit.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(alerts): pass alert message lazily from the min-version check

simple_alert_helper now takes the error message as a future so callers can
put diagnostic work behind it. Update this call site and point ee-repo-ref
at the companion windmill-ee-private commit.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore: point ee-repo-ref at rebased EE branch

Rebase onto EE main so the pin keeps the SAML metadata fixes (394ad23)
that the previous ref carried, and pick up the mount-scoped consumer walk.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore: bump ee-repo-ref for bind-mounted file exclusion

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore: update ee-repo-ref to 4d7aafdba33a879b3c60d390c960e57679da9e87

This commit updates the EE repository reference after PR #667 was merged in windmill-ee-private.

Previous ee-repo-ref: 08d3aa4c5bf630d15a28289cca62a0f1da7b7386

New ee-repo-ref: 4d7aafdba33a879b3c60d390c960e57679da9e87

Automated by sync-ee-ref workflow.

* chore: point ee-repo-ref at the merged EE work plus the test fix

ee#667 squash-merged, so the previous pin was a branch commit no longer
reachable from EE main. Point at ee#669, which branches from EE main and
carries the /proc test-portability fix.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore: update ee-repo-ref to d8a7ac6ae97642a7f4928e6be6846a32dabf4e26

This commit updates the EE repository reference after PR #669 was merged in windmill-ee-private.

Previous ee-repo-ref: 5526aedd73654b9aa4086dae0441b9687ff6415d

New ee-repo-ref: d8a7ac6ae97642a7f4928e6be6846a32dabf4e26

Automated by sync-ee-ref workflow.

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
---
 backend/ee-repo-ref.txt                    | 2 +-
 backend/windmill-common/src/min_version.rs | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index 27c0e3ebfa..b7ddee0eb5 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-394ad23242de429aef4074cc1dc28867dac95870
+d8a7ac6ae97642a7f4928e6be6846a32dabf4e26
diff --git a/backend/windmill-common/src/min_version.rs b/backend/windmill-common/src/min_version.rs
index 2b1a218f23..45d356bb44 100644
--- a/backend/windmill-common/src/min_version.rs
+++ b/backend/windmill-common/src/min_version.rs
@@ -203,7 +203,7 @@ pub async fn update_min_version(
                 Connection::Sql(db) => {
                     for worker_name in &_worker_names {
                         crate::ee::simple_alert_helper(
-                            format!("Worker {worker_name} version {current} is below minimum keep-alive version {min_keep_alive}. Upgrade immediately."),
+                            async { format!("Worker {worker_name} version {current} is below minimum keep-alive version {min_keep_alive}. Upgrade immediately.") },
                             format!("Worker {worker_name} version {current} is now at or above minimum keep-alive version {min_keep_alive}."),
                             &format!("worker-below-min-keep-alive-{worker_name}"),
                             || current < min_keep_alive,

From 3bd9f0593866740935f79c8b2c1cb92829059105 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Thu, 16 Jul 2026 15:21:54 +0200
Subject: [PATCH 016/171] fix(alerts): identify server replica in low-disk
 alert + per-host dedup tag (#10143)

* fix(alerts): identify server replica in low-disk alert + per-host dedup tag

The server-mode low-disk alert keyed its dedup tag on the mountpoint alone,
so `simple_alert_helper` mapped every server replica onto a single alert row
per mountpoint. With more than one replica that row flaps every monitor pass:
a replica seeing low disk raises the alert while a replica seeing healthy disk
recovers it. The alert text also could not say which replica tripped.

The fix lives in windmill-ee-private (`low_disk_alerts` in
windmill-common/src/ee.rs) and appends the hostname to both the message and
the dedup tag, mirroring the worker branch.

Also add a regression test pinning the server tag as per-host, and correct the
monitor cadence comments: iterations are LISTEN_NEW_EVENTS_INTERVAL_SEC
(10s by default), not 30s, so "~60s (2 iterations * 30s)" was wrong on both
factors.

* fix(alerts): widen healthchecks.check_type so per-host disk tags fit

Alert tags embed a mountpoint and a hostname, both unbounded, but check_type
was varchar(50). create_alert only logs the insert error while the
notification still fires, so an overflowing tag re-alerts every monitor pass
and never records recovery state.

The server tag overflows for ordinary pod-length hostnames, and the existing
worker tag already overflows for every tracked mount except "/". Widening the
column fixes both; bounding the hostname would not, since the mountpoint alone
can consume the budget.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore: update ee-repo-ref to b3d01f2c0d2c0714ae95b8a348af22b0fcc30ee4

This commit updates the EE repository reference after PR #666 was merged in windmill-ee-private.

Previous ee-repo-ref: ccd1e42cf6b2d051ca17074fbdf5b80a46cffe0f

New ee-repo-ref: b3d01f2c0d2c0714ae95b8a348af22b0fcc30ee4

Automated by sync-ee-ref workflow.

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
---
 ...9ff7994ee40d3953b9f772d0e0ab999bccb7b.json |  2 +-
 backend/ee-repo-ref.txt                       |  2 +-
 ...248_widen_healthchecks_check_type.down.sql |  2 +
 ...80248_widen_healthchecks_check_type.up.sql |  4 ++
 backend/src/monitor.rs                        | 18 +++---
 backend/summarized_schema.txt                 |  2 +-
 .../windmill-common/tests/low_disk_alerts.rs  | 57 +++++++++++++++++++
 7 files changed, 76 insertions(+), 11 deletions(-)
 create mode 100644 backend/migrations/20260716080248_widen_healthchecks_check_type.down.sql
 create mode 100644 backend/migrations/20260716080248_widen_healthchecks_check_type.up.sql
 create mode 100644 backend/windmill-common/tests/low_disk_alerts.rs

diff --git a/backend/.sqlx/query-27920aaa55666ffc14a36a247f89ff7994ee40d3953b9f772d0e0ab999bccb7b.json b/backend/.sqlx/query-27920aaa55666ffc14a36a247f89ff7994ee40d3953b9f772d0e0ab999bccb7b.json
index 26a8ba2ee2..03e920f705 100644
--- a/backend/.sqlx/query-27920aaa55666ffc14a36a247f89ff7994ee40d3953b9f772d0e0ab999bccb7b.json
+++ b/backend/.sqlx/query-27920aaa55666ffc14a36a247f89ff7994ee40d3953b9f772d0e0ab999bccb7b.json
@@ -5,7 +5,7 @@
     "columns": [],
     "parameters": {
       "Left": [
-        "Varchar"
+        "Text"
       ]
     },
     "nullable": []
diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index b7ddee0eb5..4ab559ac13 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-d8a7ac6ae97642a7f4928e6be6846a32dabf4e26
+b3d01f2c0d2c0714ae95b8a348af22b0fcc30ee4
diff --git a/backend/migrations/20260716080248_widen_healthchecks_check_type.down.sql b/backend/migrations/20260716080248_widen_healthchecks_check_type.down.sql
new file mode 100644
index 0000000000..86e8d787dc
--- /dev/null
+++ b/backend/migrations/20260716080248_widen_healthchecks_check_type.down.sql
@@ -0,0 +1,2 @@
+-- Rows written since the up migration may exceed 50 chars; truncate so the cast succeeds.
+ALTER TABLE healthchecks ALTER COLUMN check_type TYPE varchar(50) USING left(check_type, 50);
diff --git a/backend/migrations/20260716080248_widen_healthchecks_check_type.up.sql b/backend/migrations/20260716080248_widen_healthchecks_check_type.up.sql
new file mode 100644
index 0000000000..697d5577ab
--- /dev/null
+++ b/backend/migrations/20260716080248_widen_healthchecks_check_type.up.sql
@@ -0,0 +1,4 @@
+-- Alert tags embed unbounded components (mountpoint, hostname), so they overflowed
+-- varchar(50). create_alert only logs the insert error while the notification still
+-- fires, so an overflowing tag re-alerts every monitor pass and never recovers.
+ALTER TABLE healthchecks ALTER COLUMN check_type TYPE text;
diff --git a/backend/src/monitor.rs b/backend/src/monitor.rs
index 6632e3b3a8..714ebcda8d 100644
--- a/backend/src/monitor.rs
+++ b/backend/src/monitor.rs
@@ -3255,9 +3255,10 @@ pub async fn monitor_db(
         }
     };
 
-    // run every ~60s (2 iterations * 30s). Enterprise feature: core logic is
-    // in `crate::ee` (OSS gets a no-op stub); gated on a valid Enterprise
-    // license, mirroring how `audit_log()` itself is license-aware.
+    // run every 2 iterations (~20s at the default LISTEN_NEW_EVENTS_INTERVAL_SEC).
+    // Enterprise feature: core logic is in `crate::ee` (OSS gets a no-op stub);
+    // gated on a valid Enterprise license, mirroring how `audit_log()` itself
+    // is license-aware.
     let export_audit_logs_to_object_store_f = async {
         #[cfg(feature = "parquet")]
         if server_mode && iteration.is_some() && iteration.as_ref().unwrap().should_run(2) {
@@ -3281,11 +3282,12 @@ pub async fn monitor_db(
         }
     };
 
-    // run every ~60s (2 iterations * 30s). Enterprise feature: the active
-    // `// freshness` backstop lives in windmill-queue's `freshness_watchdog`
-    // (`private`); OSS gets a no-op stub. Runtime-gated on an Enterprise
-    // license like the audit export above. Safe on concurrent servers — the
-    // watchdog claims per-script state rows atomically before pushing.
+    // run every 2 iterations (~20s at the default LISTEN_NEW_EVENTS_INTERVAL_SEC).
+    // Enterprise feature: the active `// freshness` backstop lives in
+    // windmill-queue's `freshness_watchdog` (`private`); OSS gets a no-op stub.
+    // Runtime-gated on an Enterprise license like the audit export above. Safe
+    // on concurrent servers — the watchdog claims per-script state rows
+    // atomically before pushing.
     let pipeline_freshness_watchdog_f = async {
         if server_mode
             && !*DISABLE_FRESHNESS_WATCHDOG
diff --git a/backend/summarized_schema.txt b/backend/summarized_schema.txt
index 380adf679e..e8bf76d763 100644
--- a/backend/summarized_schema.txt
+++ b/backend/summarized_schema.txt
@@ -99,7 +99,7 @@ group_: workspace_id(char), name(char), summary(text), extra_perms(jsonb)
   FK: (workspace_id) -> workspace(id)
 group_permission_history: id(bigint), workspace_id(char), group_name(char), changed_by(char), changed_at(ts), change_type(char), member_affected(char)
   FK: (workspace_id, group_name) -> group_(workspace_id, name)
-healthchecks: id(bigint), check_type(char), healthy(bool), created_at(ts)
+healthchecks: id(bigint), check_type(text), healthy(bool), created_at(ts)
 http_trigger: path(char), route_path(char), route_path_key(char), script_path(char), is_flow(bool), workspace_id(char), edited_by(char), email(char), edited_at(ts), extra_perms(jsonb), authentication_method(authentication_method), http_method(http_method), static_asset_config(jsonb), is_static_website(bool), workspaced_route(bool), wrap_body(bool), raw_string(bool), authentication_resource_path(char), summary(char), description(text), error_handler_path(char), error_handler_args(jsonb), retry(jsonb), request_type(request_type), mode(trigger_mode), labels(text[])
 input: id(uuid), workspace_id(char), runnable_id(char), runnable_type(runnable_type), name(text), args(jsonb), created_at(ts), created_by(char), is_public(bool)
   FK: (workspace_id) -> workspace(id)
diff --git a/backend/windmill-common/tests/low_disk_alerts.rs b/backend/windmill-common/tests/low_disk_alerts.rs
new file mode 100644
index 0000000000..d6cc1e5009
--- /dev/null
+++ b/backend/windmill-common/tests/low_disk_alerts.rs
@@ -0,0 +1,57 @@
+//! Regression test for the server-mode low-disk alert dedup tag.
+//!
+//! ## Requirements
+//!
+//! - PostgreSQL database running locally
+//! - Enterprise features enabled
+//!
+//! ## Running the tests
+//!
+//! ```bash
+//! cargo test -p windmill-common --test low_disk_alerts --features private,enterprise -- --ignored --nocapture
+//! ```
+
+#[cfg(all(feature = "private", feature = "enterprise"))]
+mod tests {
+    use sqlx::{Pool, Postgres};
+    use windmill_common::ee::low_disk_alerts;
+    use windmill_common::utils::HOSTNAME;
+
+    /// The server tag must carry the hostname: `simple_alert_helper` keys one alert row per
+    /// tag, so a host-less tag lets a replica seeing low disk and a replica seeing free disk
+    /// raise and recover the same row every monitor pass.
+    ///
+    /// The hostname is forced to a pod-length name so the tag runs past 50 chars, which
+    /// `check_type` must stay wide enough to hold: `create_alert` only logs the insert
+    /// error while the notification still fires, so a tag that does not fit re-alerts every
+    /// pass and never recovers. Asserting the row persists pins the width and the shape.
+    #[ignore = "requires database setup - run with --ignored flag"]
+    #[sqlx::test(migrations = "../migrations")]
+    async fn server_low_disk_tag_is_per_host(db: Pool<Postgres>) {
+        // Both statics are lazy and read on first access inside the call below.
+        std::env::set_var("FORCE_HOSTNAME", "windmill-server-7d9f8b6c4d-x2k9p");
+        // Force every mount to read as low so the server branch raises.
+        std::env::set_var("MIN_FREE_DISK_SPACE_MB", "999999999999");
+
+        low_disk_alerts(&db, true, false, vec![]).await;
+
+        let tags: Vec<String> = sqlx::query_scalar(
+            "SELECT check_type FROM healthchecks WHERE check_type LIKE 'low-disk-v2-server@%'",
+        )
+        .fetch_all(&db)
+        .await
+        .unwrap();
+
+        assert!(
+            !tags.is_empty(),
+            "expected at least one server low-disk alert; an alert whose tag does not fit \
+             check_type is dropped here while its notification still fires"
+        );
+        for tag in &tags {
+            assert!(
+                tag.ends_with(&format!("@{}", *HOSTNAME)),
+                "server tag {tag} is not per-host; replicas would share one alert row"
+            );
+        }
+    }
+}

From 7d5009e3928bb200150eb998ed0b3016c3395987 Mon Sep 17 00:00:00 2001
From: Diego Imbert <70353967+diegoimbert@users.noreply.github.com>
Date: Thu, 16 Jul 2026 15:48:11 +0200
Subject: [PATCH 017/171] fix: heartbeat job ping during s3object
 materialization in SQL executors (#10152)

* fix: heartbeat job ping during s3object materialization in SQL executors

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KrFtZjXc8GB6VtSMVJFXjE

* chore: update ee-repo-ref.txt

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KrFtZjXc8GB6VtSMVJFXjE

* chore: update ee-repo-ref to e19948fa2974a7d89bec12957fc6d9fa0a421da8

This commit updates the EE repository reference after PR #668 was merged in windmill-ee-private.

Previous ee-repo-ref: a3828dcd67f026c0e983a1a5dc5c5b33af3c3120

New ee-repo-ref: e19948fa2974a7d89bec12957fc6d9fa0a421da8

Automated by sync-ee-ref workflow.

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
---
 backend/ee-repo-ref.txt                       |  2 +-
 .../windmill-worker/src/bigquery_executor.rs  | 23 +++++++++------
 backend/windmill-worker/src/mssql_executor.rs | 17 +++++------
 backend/windmill-worker/src/mysql_executor.rs | 23 +++++++++------
 backend/windmill-worker/src/pg_executor.rs    | 14 ++++++++--
 .../windmill-worker/src/snowflake_executor.rs |  2 ++
 backend/windmill-worker/src/sql_s3_input.rs   |  8 ++++++
 backend/windmill-worker/src/worker_utils.rs   | 28 +++++++++++++++++++
 8 files changed, 88 insertions(+), 29 deletions(-)

diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index 4ab559ac13..25c70cdf3c 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-b3d01f2c0d2c0714ae95b8a348af22b0fcc30ee4
+e19948fa2974a7d89bec12957fc6d9fa0a421da8
\ No newline at end of file
diff --git a/backend/windmill-worker/src/bigquery_executor.rs b/backend/windmill-worker/src/bigquery_executor.rs
index 8a80de25ef..b383b22966 100644
--- a/backend/windmill-worker/src/bigquery_executor.rs
+++ b/backend/windmill-worker/src/bigquery_executor.rs
@@ -412,15 +412,20 @@ pub async fn do_bigquery(
         let s3_obj: windmill_types::s3::S3Object = serde_json::from_value(raw).map_err(|e| {
             Error::ExecutionErr(format!("Invalid S3Object for arg `{}`: {e}", arg.name))
         })?;
-        let json_text =
-            crate::sql_s3_input::fetch_s3object_as_json_text(client, &job.workspace_id, &s3_obj)
-                .await
-                .map_err(|e| {
-                    Error::ExecutionErr(format!(
-                        "Failed to fetch S3 object for arg `{}`: {e}",
-                        arg.name
-                    ))
-                })?;
+        let json_text = crate::sql_s3_input::fetch_s3object_as_json_text(
+            client,
+            conn,
+            job.id,
+            &job.workspace_id,
+            &s3_obj,
+        )
+        .await
+        .map_err(|e| {
+            Error::ExecutionErr(format!(
+                "Failed to fetch S3 object for arg `{}`: {e}",
+                arg.name
+            ))
+        })?;
         bigquery_args.insert(arg.name.clone(), Value::String(json_text));
         arg.otyp = Some("string".to_string());
     }
diff --git a/backend/windmill-worker/src/mssql_executor.rs b/backend/windmill-worker/src/mssql_executor.rs
index f3df3ea3b4..a5b4a06509 100644
--- a/backend/windmill-worker/src/mssql_executor.rs
+++ b/backend/windmill-worker/src/mssql_executor.rs
@@ -237,14 +237,15 @@ pub async fn do_mssql(
         let s3_obj: S3Object = serde_json::from_value(raw).map_err(|e| {
             Error::ExecutionErr(format!("Invalid S3Object for arg `{}`: {e}", arg.name))
         })?;
-        let json_text = fetch_s3object_as_json_text(authed_client, &job.workspace_id, &s3_obj)
-            .await
-            .map_err(|e| {
-                Error::ExecutionErr(format!(
-                    "Failed to fetch S3 object for arg `{}`: {e}",
-                    arg.name
-                ))
-            })?;
+        let json_text =
+            fetch_s3object_as_json_text(authed_client, conn, job.id, &job.workspace_id, &s3_obj)
+                .await
+                .map_err(|e| {
+                    Error::ExecutionErr(format!(
+                        "Failed to fetch S3 object for arg `{}`: {e}",
+                        arg.name
+                    ))
+                })?;
         mssql_args.insert(arg.name.clone(), Value::String(json_text));
     }
 
diff --git a/backend/windmill-worker/src/mysql_executor.rs b/backend/windmill-worker/src/mysql_executor.rs
index b7234b7912..dcec77e298 100644
--- a/backend/windmill-worker/src/mysql_executor.rs
+++ b/backend/windmill-worker/src/mysql_executor.rs
@@ -242,15 +242,20 @@ pub async fn do_mysql(
         let s3_obj: windmill_types::s3::S3Object = serde_json::from_value(raw).map_err(|e| {
             Error::ExecutionErr(format!("Invalid S3Object for arg `{}`: {e}", arg.name))
         })?;
-        let json_text =
-            crate::sql_s3_input::fetch_s3object_as_json_text(client, &job.workspace_id, &s3_obj)
-                .await
-                .map_err(|e| {
-                    Error::ExecutionErr(format!(
-                        "Failed to fetch S3 object for arg `{}`: {e}",
-                        arg.name
-                    ))
-                })?;
+        let json_text = crate::sql_s3_input::fetch_s3object_as_json_text(
+            client,
+            conn,
+            job.id,
+            &job.workspace_id,
+            &s3_obj,
+        )
+        .await
+        .map_err(|e| {
+            Error::ExecutionErr(format!(
+                "Failed to fetch S3 object for arg `{}`: {e}",
+                arg.name
+            ))
+        })?;
         job_args.insert(arg.name.clone(), Value::String(json_text));
     }
 
diff --git a/backend/windmill-worker/src/pg_executor.rs b/backend/windmill-worker/src/pg_executor.rs
index 98c1b5bba7..0b84af81b9 100644
--- a/backend/windmill-worker/src/pg_executor.rs
+++ b/backend/windmill-worker/src/pg_executor.rs
@@ -768,7 +768,15 @@ pub async fn do_postgresql(
     // Materialize any `(s3object)` args into JSON text and rebind them as `jsonb` so
     // `otyp_to_pg_type` picks the right binding. Must run before the param map is
     // built below.
-    materialize_s3object_args(&mut sig.args, &mut pg_args, client, &job.workspace_id).await?;
+    materialize_s3object_args(
+        &mut sig.args,
+        &mut pg_args,
+        client,
+        conn,
+        job.id,
+        &job.workspace_id,
+    )
+    .await?;
 
     let reserved_variables =
         get_reserved_variables(job, &client.token, conn, parent_runnable_path).await?;
@@ -982,6 +990,8 @@ async fn materialize_s3object_args(
     sig_args: &mut [Arg],
     args_map: &mut HashMap<String, Value>,
     client: &AuthedClient,
+    conn: &Connection,
+    job_id: Uuid,
     workspace_id: &str,
 ) -> error::Result<()> {
     for arg in sig_args.iter_mut() {
@@ -998,7 +1008,7 @@ async fn materialize_s3object_args(
         let s3_obj: S3Object = serde_json::from_value(raw).map_err(|e| {
             Error::ExecutionErr(format!("Invalid S3Object for arg `{}`: {e}", arg.name))
         })?;
-        let json_text = fetch_s3object_as_json_text(client, workspace_id, &s3_obj)
+        let json_text = fetch_s3object_as_json_text(client, conn, job_id, workspace_id, &s3_obj)
             .await
             .map_err(|e| {
                 Error::ExecutionErr(format!(
diff --git a/backend/windmill-worker/src/snowflake_executor.rs b/backend/windmill-worker/src/snowflake_executor.rs
index d3d4555f40..cc05adecf8 100644
--- a/backend/windmill-worker/src/snowflake_executor.rs
+++ b/backend/windmill-worker/src/snowflake_executor.rs
@@ -567,6 +567,8 @@ pub async fn do_snowflake(
                 })?;
             let json_text = crate::sql_s3_input::fetch_s3object_as_json_text(
                 client,
+                conn,
+                job.id,
                 &job.workspace_id,
                 &s3_obj,
             )
diff --git a/backend/windmill-worker/src/sql_s3_input.rs b/backend/windmill-worker/src/sql_s3_input.rs
index 937a21fa20..e3a5b25411 100644
--- a/backend/windmill-worker/src/sql_s3_input.rs
+++ b/backend/windmill-worker/src/sql_s3_input.rs
@@ -12,6 +12,7 @@
 
 use anyhow::Context;
 use windmill_common::client::AuthedClient;
+use windmill_common::worker::Connection;
 use windmill_types::s3::S3Object;
 
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
@@ -44,9 +45,16 @@ fn detect_format(key: &str) -> InputFormat {
 ///   uniformly assume an array shape.
 pub async fn fetch_s3object_as_json_text(
     client: &AuthedClient,
+    conn: &Connection,
+    job_id: uuid::Uuid,
     workspace_id: &str,
     obj: &S3Object,
 ) -> anyhow::Result<String> {
+    // This runs before the executor's polling loop starts, so heartbeat the job ping
+    // to keep a slow download/decode from tripping the zombie monitor.
+    let _ping_heartbeat =
+        crate::worker_utils::JobPingHeartbeat::start(conn, job_id, "s3object materialization");
+
     let bytes = client
         .download_s3_file(workspace_id, &obj.s3, obj.storage.clone())
         .await
diff --git a/backend/windmill-worker/src/worker_utils.rs b/backend/windmill-worker/src/worker_utils.rs
index b325f3cf08..a36ad4c348 100644
--- a/backend/windmill-worker/src/worker_utils.rs
+++ b/backend/windmill-worker/src/worker_utils.rs
@@ -346,6 +346,34 @@ pub async fn ping_job_status(
     }
 }
 
+/// Keeps the job's ping fresh during phases that run before the executor's own polling
+/// loop starts (volume setup, s3object materialization, ...). Without it, a slow wait or
+/// download with no ping in between can exceed ZOMBIE_JOB_TIMEOUT (default 60s) and get
+/// the job falsely restarted as a zombie.
+pub(crate) struct JobPingHeartbeat(tokio::task::JoinHandle<()>);
+
+impl JobPingHeartbeat {
+    pub(crate) fn start(conn: &Connection, job_id: Uuid, context: &'static str) -> Self {
+        let conn = conn.clone();
+        JobPingHeartbeat(tokio::spawn(async move {
+            // 10s stays well under the 60s zombie timeout
+            let mut interval = tokio::time::interval(std::time::Duration::from_secs(10));
+            loop {
+                interval.tick().await;
+                if let Err(e) = ping_job_status(&conn, &job_id, None, None).await {
+                    tracing::warn!("failed to ping job {job_id} during {context}: {e}");
+                }
+            }
+        }))
+    }
+}
+
+impl Drop for JobPingHeartbeat {
+    fn drop(&mut self) {
+        self.0.abort();
+    }
+}
+
 pub(crate) async fn queue_vacuum(conn: &Connection, worker_name: &str, hostname: &str) {
     match conn {
         Connection::Sql(db) => {

From fa03984a14bb71f0ea2a27bfa23339a9d0d8e86b Mon Sep 17 00:00:00 2001
From: Guilhem <guilhemlemouel@gmail.com>
Date: Thu, 16 Jul 2026 15:48:24 +0200
Subject: [PATCH 018/171] fix(ai): show the question in askUserQuestion
 tool-call labels (#10153)

---
 .../components/copilot/chat/AIChatManager.svelte.ts  |  8 ++++++--
 .../src/lib/components/copilot/chat/anthropic.ts     |  2 +-
 .../lib/components/copilot/chat/global/core.test.ts  |  6 +++---
 .../src/lib/components/copilot/chat/global/core.ts   | 12 +++++++-----
 .../lib/components/copilot/chat/openai-responses.ts  |  2 +-
 frontend/src/lib/components/copilot/chat/shared.ts   |  3 +++
 frontend/src/lib/components/copilot/lib.ts           |  2 +-
 7 files changed, 22 insertions(+), 13 deletions(-)

diff --git a/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts b/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
index 30802b446c..ebc925588b 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
+++ b/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
@@ -1312,7 +1312,7 @@ export class AIChatManager {
 			if (message.role === 'tool' && message.tool_call_id === toolId && message.userQuestion) {
 				return {
 					...message,
-					content: `User answered question: ${answerSummary}`,
+					content: `Asked: ${message.userQuestion.question} — ${answerSummary}`,
 					isLoading: false,
 					userQuestion: {
 						...message.userQuestion,
@@ -2996,7 +2996,11 @@ export class AIChatManager {
 				return {
 					...message,
 					isLoading: false,
-					content: messageText,
+					// A question's card disappears once canceled, so keep the question
+					// itself readable in the collapsed header.
+					content: message.userQuestion
+						? `Asked: ${message.userQuestion.question} — ${messageText}`
+						: messageText,
 					error: messageText,
 					userQuestion: message.userQuestion
 						? { ...message.userQuestion, canceled: true }
diff --git a/frontend/src/lib/components/copilot/chat/anthropic.ts b/frontend/src/lib/components/copilot/chat/anthropic.ts
index b6e7e57a17..2c19a611a0 100644
--- a/frontend/src/lib/components/copilot/chat/anthropic.ts
+++ b/frontend/src/lib/components/copilot/chat/anthropic.ts
@@ -143,7 +143,7 @@ export async function parseAnthropicCompletion(
 
 				callbacks.setToolStatus(toolId, {
 					isLoading: true,
-					content: `Calling ${toolName}...`,
+					content: tool?.streamingLabel ?? `Calling ${toolName}...`,
 					toolName,
 					isStreamingArguments: shouldStream,
 					showFade: tool?.showFade,
diff --git a/frontend/src/lib/components/copilot/chat/global/core.test.ts b/frontend/src/lib/components/copilot/chat/global/core.test.ts
index 849f462701..407870433d 100644
--- a/frontend/src/lib/components/copilot/chat/global/core.test.ts
+++ b/frontend/src/lib/components/copilot/chat/global/core.test.ts
@@ -3250,7 +3250,7 @@ describe('global AI tools', () => {
 		expect(callbacks.setToolStatus).toHaveBeenLastCalledWith(
 			'test-askUserQuestion',
 			expect.objectContaining({
-				content: 'User answered question: python3',
+				content: 'Asked: Which script language should be used? — python3',
 				isLoading: false,
 				result: 'python3',
 				userQuestion: expect.objectContaining({ selectedChoices: ['python3'] })
@@ -3288,7 +3288,7 @@ describe('global AI tools', () => {
 		expect(callbacks.setToolStatus).toHaveBeenLastCalledWith(
 			'test-askUserQuestion',
 			expect.objectContaining({
-				content: 'User answered question: bun, go',
+				content: 'Asked: Which languages should be supported? — bun, go',
 				isLoading: false,
 				result: '- bun\n- go',
 				userQuestion: expect.objectContaining({ selectedChoices: ['bun', 'go'] })
@@ -3362,7 +3362,7 @@ describe('global AI tools', () => {
 		expect(callbacks.setToolStatus).toHaveBeenLastCalledWith(
 			'test-askUserQuestion',
 			expect.objectContaining({
-				content: 'User answered question: use deno instead',
+				content: 'Asked: Which script language should be used? — use deno instead',
 				result: 'use deno instead',
 				userQuestion: expect.objectContaining({ selectedChoices: ['use deno instead'] })
 			})
diff --git a/frontend/src/lib/components/copilot/chat/global/core.ts b/frontend/src/lib/components/copilot/chat/global/core.ts
index 3254f555f8..f9ba044f0a 100644
--- a/frontend/src/lib/components/copilot/chat/global/core.ts
+++ b/frontend/src/lib/components/copilot/chat/global/core.ts
@@ -2133,6 +2133,7 @@ export const globalTools: Tool<{}>[] = [
 			'askUserQuestion',
 			'Ask the user a question with proposed answers and wait for their selected or custom answer before continuing.'
 		),
+		streamingLabel: 'Asking the user a question...',
 		fn: async ({ args, toolId, toolCallbacks }) => {
 			const parsed = askUserQuestionSchema.parse(args)
 			const userQuestion = {
@@ -2142,7 +2143,7 @@ export const globalTools: Tool<{}>[] = [
 			}
 
 			toolCallbacks.setToolStatus(toolId, {
-				content: parsed.question,
+				content: `Asking user: ${parsed.question}`,
 				userQuestion,
 				isLoading: true
 			})
@@ -2162,7 +2163,7 @@ export const globalTools: Tool<{}>[] = [
 			if (!selected?.length) {
 				const message = 'Question cancelled by user'
 				toolCallbacks.setToolStatus(toolId, {
-					content: message,
+					content: `Asked: ${parsed.question} — cancelled by user`,
 					userQuestion: { ...userQuestion, canceled: true },
 					isLoading: false,
 					error: message
@@ -2176,12 +2177,13 @@ export const globalTools: Tool<{}>[] = [
 			// ("Yes, immediately") stays unambiguous to the model reading it back.
 			const answerText =
 				selected.length === 1 ? selected[0] : selected.map((c) => `- ${c}`).join('\n')
-			// The collapsed tool-header is a human glance, not model input, so the picks
-			// read as a compact comma list there instead of a stacked bullet list.
+			// The collapsed tool-header is a human glance, not model input, so it carries
+			// the question plus the picks as a compact comma list (not a bullet list) —
+			// it is the only place the exchange stays readable in the transcript.
 			const answerSummary = selected.join(', ')
 
 			toolCallbacks.setToolStatus(toolId, {
-				content: `User answered question: ${answerSummary}`,
+				content: `Asked: ${parsed.question} — ${answerSummary}`,
 				userQuestion: {
 					...userQuestion,
 					selectedChoices: selected
diff --git a/frontend/src/lib/components/copilot/chat/openai-responses.ts b/frontend/src/lib/components/copilot/chat/openai-responses.ts
index f66d50bb09..3a83595f8f 100644
--- a/frontend/src/lib/components/copilot/chat/openai-responses.ts
+++ b/frontend/src/lib/components/copilot/chat/openai-responses.ts
@@ -337,7 +337,7 @@ export async function parseOpenAIResponsesCompletion(
 			callbacks.onMessageEnd()
 			callbacks.setToolStatus(`${item.id}`, {
 				isLoading: true,
-				content: `Calling ${item.name}...`,
+				content: tool?.streamingLabel ?? `Calling ${item.name}...`,
 				toolName: item.name,
 				isStreamingArguments: shouldStream,
 				showFade: tool?.showFade,
diff --git a/frontend/src/lib/components/copilot/chat/shared.ts b/frontend/src/lib/components/copilot/chat/shared.ts
index 60b85e16de..02f92519b7 100644
--- a/frontend/src/lib/components/copilot/chat/shared.ts
+++ b/frontend/src/lib/components/copilot/chat/shared.ts
@@ -820,6 +820,9 @@ export interface Tool<T> {
 	autoCollapseDetails?: boolean
 	streamArguments?: boolean
 	showFade?: boolean
+	/** Header shown while the model is still streaming this call's arguments,
+	 * before `fn` runs and sets a real status. Defaults to "Calling <name>...". */
+	streamingLabel?: string
 }
 
 /** Status of a job the chat started and tracks in the jobs tray. Mirrors the
diff --git a/frontend/src/lib/components/copilot/lib.ts b/frontend/src/lib/components/copilot/lib.ts
index 88afa58b7d..2b261a21e0 100644
--- a/frontend/src/lib/components/copilot/lib.ts
+++ b/frontend/src/lib/components/copilot/lib.ts
@@ -1176,7 +1176,7 @@ export async function parseOpenAICompletion(
 					// Display tool call with streaming parameters if enabled
 					callbacks.setToolStatus(toolCallId, {
 						isLoading: true,
-						content: `Calling ${funcName}...`,
+						content: tool?.streamingLabel ?? `Calling ${funcName}...`,
 						toolName: funcName,
 						isStreamingArguments: shouldStream,
 						showFade: tool?.showFade,

From 24750e6ef1a1a975e0063df6809774f913b5d01b Mon Sep 17 00:00:00 2001
From: hugocasa <hugo@casademont.ch>
Date: Thu, 16 Jul 2026 15:48:50 +0200
Subject: [PATCH 019/171] fix(raw-apps): prevent and surface the silent blank
 screen from an unmounted #root (#10150)

* fix(raw-apps): prevent and surface the silent blank screen from an unmounted #root

An `index.tsx` written as a bare `export default function App() {...}` with
no mount call builds and runs without throwing: the preview executes the
bundle against an empty `<div id="root">` and auto-renders nothing, so the
JSX never runs, nothing reaches the console or the runtime-error overlay,
and the app is blank with no diagnostic.

Prevent it: the raw-app system prompt and the in-chat app prompt now state
that `index.tsx` is the mount entrypoint, show the mount shim for React,
Svelte and Vue, and call out that a bare component fails silently.

Surface it: when a build still mounts nothing, the preview harness posts
`emptyRender` and the editor shows an error overlay naming the missing
call. The harness reports only when nothing is on screen AND the app never
looked `#root` up, so an app that mounted but paints nothing yet (a fetch
in flight, an unresolved Suspense) is never flagged; `renderAppeared`
withdraws the overlay if a deferred mount lands late.

The handlers stay dormant until the builder tarball that emits these
messages is pinned via `ui_builder_artifact.json`.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore(raw-apps): pin the UI builder artifact that emits emptyRender

Activates the "Nothing was mounted" overlay: the pinned tarball predates
the harness change, so the host handlers were dormant until now.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore: drop a screenshot accidentally committed at the repo root

Not referenced anywhere; the PR's screenshots are hosted externally.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(raw-apps): make the unmounted-app guidance framework-aware

The detector fires for every raw-app framework, but the overlay and the
prompts named React's `index.tsx` and `createRoot` unconditionally. Svelte
and Vue apps mount from `index.ts` via `mount` / `createApp`, so the
guidance pointed at a nonexistent entrypoint and an unavailable API.

Derive the entrypoint and mount call from the app's files, keyed off file
extensions rather than the template filenames, which users rename.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 cli/src/guidance/skills.gen.ts                | 16 ++++-
 frontend/scripts/ui_builder_artifact.json     |  4 +-
 .../lib/components/copilot/chat/app/core.ts   | 12 +++-
 .../components/raw_apps/RawAppEditor.svelte   | 58 ++++++++++++++++++-
 system_prompts/auto-generated/prompts.ts      | 16 ++++-
 .../auto-generated/skills/raw-app/SKILL.md    | 16 ++++-
 system_prompts/base/raw-app.md                | 16 ++++-
 7 files changed, 128 insertions(+), 10 deletions(-)

diff --git a/cli/src/guidance/skills.gen.ts b/cli/src/guidance/skills.gen.ts
index d081b84599..c4e6b19afd 100644
--- a/cli/src/guidance/skills.gen.ts
+++ b/cli/src/guidance/skills.gen.ts
@@ -5585,7 +5585,21 @@ A raw app has three logical parts:
 
 ### Entrypoint
 
-\`index.tsx\` is the bundling entrypoint. It typically renders a top-level \`App\` component. The bundler is esbuild.
+The entrypoint is \`index.tsx\` for React and \`index.ts\` for Svelte and Vue. It is both the bundling entrypoint (the bundler is esbuild) and the **mount** entrypoint: the preview executes the bundle against an empty \`<div id="root">\` and auto-renders nothing, so the entrypoint must mount a top-level \`App\` itself. Keep the UI in \`App.tsx\` / \`App.svelte\` / \`App.vue\` and keep the entrypoint as the mount shim.
+
+React (\`index.tsx\`):
+
+\`\`\`tsx
+import React from 'react'
+import { createRoot } from 'react-dom/client'
+import App from './App'
+
+createRoot(document.getElementById('root')!).render(<App />)
+\`\`\`
+
+Svelte (\`index.ts\`): \`mount(App, { target: document.getElementById('root')! })\`. Vue (\`index.ts\`): \`createApp(App).mount('#root')\`.
+
+**Never replace the entrypoint with a bare component** (\`export default function App() { ... }\` and no mount call). A component that is defined but never mounted renders a blank screen with **no error thrown** — it never executes, so nothing reaches the console or the error overlay. If an app renders blank, check that the entrypoint still mounts \`App\` into \`#root\`.
 
 **Always begin every React file (\`.tsx\`/\`.jsx\`) that uses JSX with \`import React from 'react'\`.** esbuild uses the classic JSX transform, so \`React\` must be in scope wherever JSX appears — a missing import compiles fine but throws \`React is not defined\` at runtime, leaving a blank screen.
 
diff --git a/frontend/scripts/ui_builder_artifact.json b/frontend/scripts/ui_builder_artifact.json
index b901dc9bc0..81a4a11a3f 100644
--- a/frontend/scripts/ui_builder_artifact.json
+++ b/frontend/scripts/ui_builder_artifact.json
@@ -1,5 +1,5 @@
 {
 	"baseUrl": "https://pub-06154ed168a24e73a86ab84db6bf15d8.r2.dev",
-	"version": "f8cecf9",
-	"sha256": "2a79b838e21e06abe06119263872afbe83c4a13f7aa72c722af3e34b819f0ce3"
+	"version": "17406f1",
+	"sha256": "405143b5b7c9f9e789f7f25dd2a435ecf7f5344b01e517e14e505f6817281c95"
 }
diff --git a/frontend/src/lib/components/copilot/chat/app/core.ts b/frontend/src/lib/components/copilot/chat/app/core.ts
index 599a77e906..b4fae2649a 100644
--- a/frontend/src/lib/components/copilot/chat/app/core.ts
+++ b/frontend/src/lib/components/copilot/chat/app/core.ts
@@ -924,7 +924,17 @@ export function prepareAppSystemMessage(customPrompt?: string): ChatCompletionSy
 ## App Structure
 
 ### Frontend
-- The frontend is bundled using esbuild with entrypoint \`index.tsx\`
+- The frontend is bundled using esbuild, with entrypoint \`index.tsx\` for React and \`index.ts\` for Svelte and Vue
+- The entrypoint is also the **mount** entrypoint: nothing is auto-rendered, so it must mount a top-level \`App\` into \`#root\` itself. Keep the UI in \`App.tsx\` / \`App.svelte\` / \`App.vue\` and keep the entrypoint as the mount shim:
+  \`\`\`tsx
+  import React from 'react'
+  import { createRoot } from 'react-dom/client'
+  import App from './App'
+
+  createRoot(document.getElementById('root')!).render(<App />)
+  \`\`\`
+  (Svelte \`index.ts\`: \`mount(App, { target: document.getElementById('root')! })\`; Vue \`index.ts\`: \`createApp(App).mount('#root')\`.)
+- **Never replace the entrypoint with a bare component.** A component that is defined but never mounted renders a blank screen with **no error** — it never executes, so nothing throws. If an app renders blank, check that the entrypoint still mounts \`App\` into \`#root\`.
 - Frontend files are managed separately from backend runnables
 - The \`wmill.d.ts\` file is generated automatically from the backend runnables shape
 - Begin every React file (\`.tsx\`/\`.jsx\`) that uses JSX with \`import React from 'react'\`. Raw apps bundle with the classic JSX transform, so \`React\` must be in scope wherever JSX is used — a missing import compiles fine but throws \`React is not defined\` at runtime.
diff --git a/frontend/src/lib/components/raw_apps/RawAppEditor.svelte b/frontend/src/lib/components/raw_apps/RawAppEditor.svelte
index 0be384169e..36988384f7 100644
--- a/frontend/src/lib/components/raw_apps/RawAppEditor.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppEditor.svelte
@@ -291,6 +291,29 @@
 	let buildError = $state<string | undefined>(undefined)
 	// Latest uncaught runtime error thrown by the rendered app; cleared on next build.
 	let runtimeError = $state<string | undefined>(undefined)
+	// Set when a build ran cleanly but never mounted anything into #root — the
+	// entrypoint defines a component without ever mounting it. Cleared on next build.
+	let emptyRender = $state(false)
+	// The repair hint above has to match the app's framework: only React apps have
+	// an `index.tsx` and `createRoot`; Svelte and Vue mount from `index.ts`. Keyed
+	// off file extensions rather than exact template filenames, which users rename.
+	let mountHint = $derived.by(() => {
+		const paths = Object.keys(files ?? {}).map((p) => p.replace(/^\//, ''))
+		const entrypoint = paths.find((p) => /^index\.(tsx|jsx|ts|js)$/.test(p))
+		if (paths.some((p) => p.endsWith('.svelte'))) {
+			return {
+				entrypoint: entrypoint ?? 'index.ts',
+				call: "mount(App, { target: document.getElementById('root')! })"
+			}
+		}
+		if (paths.some((p) => p.endsWith('.vue'))) {
+			return { entrypoint: entrypoint ?? 'index.ts', call: "createApp(App).mount('#root')" }
+		}
+		return {
+			entrypoint: entrypoint ?? 'index.tsx',
+			call: "createRoot(document.getElementById('root')!).render(<App />)"
+		}
+	})
 	let logsCollapsed = $state(false)
 	let logsDiv: HTMLDivElement | undefined = $state(undefined)
 	$effect(() => {
@@ -1099,6 +1122,18 @@
 			return
 		}
 
+		// The build ran without mounting the app, so the preview is blank with
+		// nothing to report — surfaced as a hint naming the missing mount call.
+		// `renderAppeared` withdraws it if a mount lands after the grace window.
+		if (fromPreview && e.data.type === 'emptyRender') {
+			emptyRender = true
+			return
+		}
+		if (fromPreview && e.data.type === 'renderAppeared') {
+			emptyRender = false
+			return
+		}
+
 		// Uncaught error/rejection from the rendered app — surfaced in the preview
 		// overlay so a runtime crash isn't a silent blank error.
 		if (fromPreview && e.data.type === 'runtimeError') {
@@ -1198,11 +1233,12 @@
 		}
 	}
 
-	// Feed a build into the inline preview iframe. Clears any prior runtime-error
-	// overlay first: a fresh render supersedes the old crash, and if the new
-	// render throws again app-preview.html re-posts `runtimeError`.
+	// Feed a build into the inline preview iframe. Clears the previous run's
+	// overlays first: a fresh render supersedes the old crash or blank, and
+	// app-preview.html re-posts if the new render fails the same way.
 	function feedPreviewIframe(build: { css: string; js: string }) {
 		runtimeError = undefined
+		emptyRender = false
 		previewIframe?.contentWindow?.postMessage(
 			{ type: 'preview', css: build.css, js: build.js },
 			'*'
@@ -1967,6 +2003,22 @@
 											>
 										</Alert>
 									</div>
+								{:else if emptyRender}
+									<div class="absolute top-12 left-2 right-2 z-20 isolate" role="alert">
+										<Alert
+											type="error"
+											title="Nothing was mounted"
+											class="relative before:absolute before:inset-0 before:-z-10 before:rounded-md before:bg-surface before:content-['']"
+										>
+											<span class="text-xs">
+												The build succeeded but nothing mounted into <code>#root</code>. Add a mount
+												call to <code>{mountHint.entrypoint}</code>:
+												<code class="block mt-1 whitespace-pre-wrap break-all"
+													>{mountHint.call}</code
+												>
+											</span>
+										</Alert>
+									</div>
 								{/if}
 								{#if logs}
 									<div
diff --git a/system_prompts/auto-generated/prompts.ts b/system_prompts/auto-generated/prompts.ts
index 6842ed1218..c3a606291a 100644
--- a/system_prompts/auto-generated/prompts.ts
+++ b/system_prompts/auto-generated/prompts.ts
@@ -611,7 +611,21 @@ A raw app has three logical parts:
 
 ### Entrypoint
 
-\`index.tsx\` is the bundling entrypoint. It typically renders a top-level \`App\` component. The bundler is esbuild.
+The entrypoint is \`index.tsx\` for React and \`index.ts\` for Svelte and Vue. It is both the bundling entrypoint (the bundler is esbuild) and the **mount** entrypoint: the preview executes the bundle against an empty \`<div id="root">\` and auto-renders nothing, so the entrypoint must mount a top-level \`App\` itself. Keep the UI in \`App.tsx\` / \`App.svelte\` / \`App.vue\` and keep the entrypoint as the mount shim.
+
+React (\`index.tsx\`):
+
+\`\`\`tsx
+import React from 'react'
+import { createRoot } from 'react-dom/client'
+import App from './App'
+
+createRoot(document.getElementById('root')!).render(<App />)
+\`\`\`
+
+Svelte (\`index.ts\`): \`mount(App, { target: document.getElementById('root')! })\`. Vue (\`index.ts\`): \`createApp(App).mount('#root')\`.
+
+**Never replace the entrypoint with a bare component** (\`export default function App() { ... }\` and no mount call). A component that is defined but never mounted renders a blank screen with **no error thrown** — it never executes, so nothing reaches the console or the error overlay. If an app renders blank, check that the entrypoint still mounts \`App\` into \`#root\`.
 
 **Always begin every React file (\`.tsx\`/\`.jsx\`) that uses JSX with \`import React from 'react'\`.** esbuild uses the classic JSX transform, so \`React\` must be in scope wherever JSX appears — a missing import compiles fine but throws \`React is not defined\` at runtime, leaving a blank screen.
 
diff --git a/system_prompts/auto-generated/skills/raw-app/SKILL.md b/system_prompts/auto-generated/skills/raw-app/SKILL.md
index 624fdc97ac..2251af985f 100644
--- a/system_prompts/auto-generated/skills/raw-app/SKILL.md
+++ b/system_prompts/auto-generated/skills/raw-app/SKILL.md
@@ -249,7 +249,21 @@ A raw app has three logical parts:
 
 ### Entrypoint
 
-`index.tsx` is the bundling entrypoint. It typically renders a top-level `App` component. The bundler is esbuild.
+The entrypoint is `index.tsx` for React and `index.ts` for Svelte and Vue. It is both the bundling entrypoint (the bundler is esbuild) and the **mount** entrypoint: the preview executes the bundle against an empty `<div id="root">` and auto-renders nothing, so the entrypoint must mount a top-level `App` itself. Keep the UI in `App.tsx` / `App.svelte` / `App.vue` and keep the entrypoint as the mount shim.
+
+React (`index.tsx`):
+
+```tsx
+import React from 'react'
+import { createRoot } from 'react-dom/client'
+import App from './App'
+
+createRoot(document.getElementById('root')!).render(<App />)
+```
+
+Svelte (`index.ts`): `mount(App, { target: document.getElementById('root')! })`. Vue (`index.ts`): `createApp(App).mount('#root')`.
+
+**Never replace the entrypoint with a bare component** (`export default function App() { ... }` and no mount call). A component that is defined but never mounted renders a blank screen with **no error thrown** — it never executes, so nothing reaches the console or the error overlay. If an app renders blank, check that the entrypoint still mounts `App` into `#root`.
 
 **Always begin every React file (`.tsx`/`.jsx`) that uses JSX with `import React from 'react'`.** esbuild uses the classic JSX transform, so `React` must be in scope wherever JSX appears — a missing import compiles fine but throws `React is not defined` at runtime, leaving a blank screen.
 
diff --git a/system_prompts/base/raw-app.md b/system_prompts/base/raw-app.md
index 004302cc74..63f26de115 100644
--- a/system_prompts/base/raw-app.md
+++ b/system_prompts/base/raw-app.md
@@ -14,7 +14,21 @@ A raw app has three logical parts:
 
 ### Entrypoint
 
-`index.tsx` is the bundling entrypoint. It typically renders a top-level `App` component. The bundler is esbuild.
+The entrypoint is `index.tsx` for React and `index.ts` for Svelte and Vue. It is both the bundling entrypoint (the bundler is esbuild) and the **mount** entrypoint: the preview executes the bundle against an empty `<div id="root">` and auto-renders nothing, so the entrypoint must mount a top-level `App` itself. Keep the UI in `App.tsx` / `App.svelte` / `App.vue` and keep the entrypoint as the mount shim.
+
+React (`index.tsx`):
+
+```tsx
+import React from 'react'
+import { createRoot } from 'react-dom/client'
+import App from './App'
+
+createRoot(document.getElementById('root')!).render(<App />)
+```
+
+Svelte (`index.ts`): `mount(App, { target: document.getElementById('root')! })`. Vue (`index.ts`): `createApp(App).mount('#root')`.
+
+**Never replace the entrypoint with a bare component** (`export default function App() { ... }` and no mount call). A component that is defined but never mounted renders a blank screen with **no error thrown** — it never executes, so nothing reaches the console or the error overlay. If an app renders blank, check that the entrypoint still mounts `App` into `#root`.
 
 **Always begin every React file (`.tsx`/`.jsx`) that uses JSX with `import React from 'react'`.** esbuild uses the classic JSX transform, so `React` must be in scope wherever JSX appears — a missing import compiles fine but throws `React is not defined` at runtime, leaving a blank screen.
 

From 7b813d1f74baef200d9f1387e02925083b79b265 Mon Sep 17 00:00:00 2001
From: hugocasa <hugo@casademont.ch>
Date: Thu, 16 Jul 2026 15:49:20 +0200
Subject: [PATCH 020/171] fix(frontend): sanitize job result markup, gate it on
 unsandboxed public apps (#10127)

* fix(frontend): sanitize html and svg result rendering

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore(frontend): add dompurify to lockfile root deps

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(frontend): keep sanitizing rich results on public app surfaces

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(frontend): gate risky app markup on unsandboxed public surfaces

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(frontend): derive app markup isolation from the real origin

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* style(frontend): use the design-system danger alert for the markup gate

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 frontend/package-lock.json                    |  1 +
 frontend/package.json                         |  1 +
 .../src/lib/components/DisplayResult.svelte   | 77 +++++++++++--------
 .../lib/components/MarkupApprovalGate.svelte  | 30 ++++++++
 .../display/AppDisplayComponent.svelte        |  6 +-
 .../display/AppDisplayComponentByJobId.svelte |  6 +-
 .../apps/components/display/AppHtml.svelte    | 34 ++++++--
 .../components/apps/editor/PublicApp.svelte   |  5 +-
 .../src/lib/components/apps/markupTrust.ts    | 42 ++++++++++
 9 files changed, 157 insertions(+), 45 deletions(-)
 create mode 100644 frontend/src/lib/components/MarkupApprovalGate.svelte
 create mode 100644 frontend/src/lib/components/apps/markupTrust.ts

diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 1c1b983cfb..aa769a69b8 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -41,6 +41,7 @@
 				"d3-zoom": "^3.0.0",
 				"date-fns": "^2.30.0",
 				"diff": "^7.0.0",
+				"dompurify": "^3.3.1",
 				"driver.js": "^1.3.0",
 				"esm-env": "^1.0.0",
 				"fast-equals": "^5.0.1",
diff --git a/frontend/package.json b/frontend/package.json
index a9838a73a4..135116b908 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -116,6 +116,7 @@
 		"d3-zoom": "^3.0.0",
 		"date-fns": "^2.30.0",
 		"diff": "^7.0.0",
+		"dompurify": "^3.3.1",
 		"driver.js": "^1.3.0",
 		"esm-env": "^1.0.0",
 		"fast-equals": "^5.0.1",
diff --git a/frontend/src/lib/components/DisplayResult.svelte b/frontend/src/lib/components/DisplayResult.svelte
index ae44015cb8..49a72e0e13 100644
--- a/frontend/src/lib/components/DisplayResult.svelte
+++ b/frontend/src/lib/components/DisplayResult.svelte
@@ -46,6 +46,9 @@
 	import { userStore } from '$lib/stores'
 	import ResultStreamDisplay from './ResultStreamDisplay.svelte'
 	import { twMerge } from 'tailwind-merge'
+	import DOMPurify from 'dompurify'
+	import MarkupApprovalGate from './MarkupApprovalGate.svelte'
+	import type { MarkupTrust } from './apps/markupTrust'
 
 	const TABLE_MAX_SIZE = 5000000
 	const DISPLAY_MAX_SIZE = 100000
@@ -85,7 +88,10 @@
 
 	interface Props {
 		result: any
-		requireHtmlApproval?: boolean
+		/** How to treat `result.html` / `result.svg`. Defaults to sanitizing, which is
+		 * what every non-app caller wants. Low-code app display components pass
+		 * `getAppMarkupTrust()`. */
+		markupTrust?: MarkupTrust
 		filename?: string | undefined
 		disableExpand?: boolean
 		jobId?: string | undefined
@@ -110,7 +116,7 @@
 
 	let {
 		result,
-		requireHtmlApproval = false,
+		markupTrust = 'sanitize',
 		filename = undefined,
 		disableExpand = false,
 		jobId = undefined,
@@ -132,7 +138,6 @@
 		loading = false,
 		growVertical = false
 	}: Props = $props()
-	let enableHtml = $state(false)
 	let s3FileDisplayRawMode = $state(false)
 
 	// Build the image/PDF source URL for an S3 object. When `appPath` is set
@@ -433,6 +438,15 @@
 		}
 	}
 
+	// An html/svg result is attacker-authored: any member can return one and a
+	// higher-privileged user may view it. Every `{@html}` of result markup must go
+	// through here, or it becomes stored XSS (GHSA-gh2j-49rx-4464). `approval` renders
+	// verbatim too, so it must stay behind MarkupApprovalGate at the call site.
+	function renderResultMarkup(markup: string | { filename: string; content: string } | undefined) {
+		const str = contentOrRootString(markup) || ''
+		return markupTrust === 'sanitize' ? DOMPurify.sanitize(str) : str
+	}
+
 	function handleArrayOfObjectsHeaders(json: any) {
 		// handle possible a first row of headers
 		if (
@@ -690,7 +704,7 @@
 				<DisplayResult
 					{noControls}
 					result={res}
-					{requireHtmlApproval}
+					{markupTrust}
 					{filename}
 					{disableExpand}
 					{jobId}
@@ -790,30 +804,16 @@
 					/>
 				{:else if !forceJson && resultKind === 'html'}
 					<div class="h-full">
-						{#if !requireHtmlApproval || enableHtml}
-							{@html result.html}
+						{#if markupTrust === 'approval'}
+							<MarkupApprovalGate>
+								{#snippet children()}
+									<!-- eslint-disable-next-line svelte/no-at-html-tags -->
+									{@html renderResultMarkup(result.html)}
+								{/snippet}
+							</MarkupApprovalGate>
 						{:else}
-							<div class="font-main text-sm">
-								<div class="flex flex-col">
-									<div class="bg-red-400 py-1 rounded-t text-white font-bold text-center">
-										Warning
-									</div>
-									<p
-										class="text-primary mb-2 text-left border-2 !border-t-0 rounded-b border-red-400 overflow-auto p-1"
-										>Rendering HTML can expose you to <a
-											href="https://owasp.org/www-community/attacks/xss/"
-											target="_blank"
-											rel="noreferrer"
-											class="hover:underline">XSS attacks</a
-										>. Only enable it if you trust the author of the script.
-									</p>
-								</div>
-								<div class="center-center">
-									<Button unifiedSize="md" variant="default" on:click={() => (enableHtml = true)}>
-										Enable HTML rendering
-									</Button>
-								</div>
-							</div>
+							<!-- eslint-disable-next-line svelte/no-at-html-tags -->
+							{@html renderResultMarkup(result.html)}
 						{/if}
 					</div>
 				{:else if !forceJson && resultKind === 'map'}
@@ -842,11 +842,26 @@
 						/>
 					</div>
 				{:else if !forceJson && resultKind === 'svg'}
-					<div
-						><a download="windmill.svg" href="data:text/plain;base64,{btoa(result.svg)}">Download</a
+					{@const svgMarkup = contentOrRootString(result.svg) || ''}
+					<div>
+						<a
+							download="windmill.svg"
+							href="data:image/svg+xml;charset=utf-8,{encodeURIComponent(svgMarkup)}">Download</a
 						>
 					</div>
-					<div class="h-full overflow-auto">{@html result.svg} </div>
+					<div class="h-full overflow-auto">
+						{#if markupTrust === 'approval'}
+							<MarkupApprovalGate>
+								{#snippet children()}
+									<!-- eslint-disable-next-line svelte/no-at-html-tags -->
+									{@html renderResultMarkup(result.svg)}
+								{/snippet}
+							</MarkupApprovalGate>
+						{:else}
+							<!-- eslint-disable-next-line svelte/no-at-html-tags -->
+							{@html renderResultMarkup(result.svg)}
+						{/if}
+					</div>
 				{:else if !forceJson && resultKind === 'gif'}
 					<div class="h-full">
 						<img
@@ -1281,7 +1296,7 @@
 				<DisplayResult
 					{noControls}
 					{result}
-					{requireHtmlApproval}
+					{markupTrust}
 					{filename}
 					{jobId}
 					{nodeId}
diff --git a/frontend/src/lib/components/MarkupApprovalGate.svelte b/frontend/src/lib/components/MarkupApprovalGate.svelte
new file mode 100644
index 0000000000..e813827461
--- /dev/null
+++ b/frontend/src/lib/components/MarkupApprovalGate.svelte
@@ -0,0 +1,30 @@
+<script lang="ts">
+	import { Button } from './common'
+	import Alert from './common/alert/Alert.svelte'
+
+	// Shown instead of runnable-authored markup on the public app surfaces, where the
+	// app's author and its viewer are different people and the app is not sandboxed.
+	// Enabling the app's sandbox isolates the markup and removes this prompt.
+	let { children }: { children: import('svelte').Snippet } = $props()
+	let approved = $state(false)
+</script>
+
+{#if approved}
+	{@render children()}
+{:else}
+	<Alert type="error" title="This content is not rendered">
+		<div class="flex flex-col items-start gap-2">
+			<p>
+				Rendering it can expose you to <a
+					href="https://owasp.org/www-community/attacks/xss/"
+					target="_blank"
+					rel="noreferrer"
+					class="underline">XSS attacks</a
+				>. Only enable it if you trust the author of this app.
+			</p>
+			<Button unifiedSize="sm" variant="default" on:click={() => (approved = true)}>
+				Enable rendering
+			</Button>
+		</div>
+	</Alert>
+{/if}
diff --git a/frontend/src/lib/components/apps/components/display/AppDisplayComponent.svelte b/frontend/src/lib/components/apps/components/display/AppDisplayComponent.svelte
index c2ac250948..8346e3a3b2 100644
--- a/frontend/src/lib/components/apps/components/display/AppDisplayComponent.svelte
+++ b/frontend/src/lib/components/apps/components/display/AppDisplayComponent.svelte
@@ -5,11 +5,11 @@
 	import { initConfig, initOutput } from '../../editor/appUtils'
 	import type { AppInput } from '../../inputType'
 	import {
-		IS_APP_PUBLIC_CONTEXT_KEY,
 		type AppViewerContext,
 		type ComponentCustomCSS,
 		type RichConfigurations
 	} from '../../types'
+	import { getAppMarkupTrust } from '../../markupTrust'
 	import RunnableWrapper from '../helpers/RunnableWrapper.svelte'
 	import { initCss } from '../../utils'
 	import ResolveStyle from '../helpers/ResolveStyle.svelte'
@@ -35,7 +35,7 @@
 		configuration
 	}: Props = $props()
 
-	const requireHtmlApproval = getContext<boolean | undefined>(IS_APP_PUBLIC_CONTEXT_KEY)
+	const markupTrust = getAppMarkupTrust()
 	const { app, worldStore, componentControl, workspace, appPath, isEditor } =
 		getContext<AppViewerContext>('AppViewerContext')
 
@@ -128,7 +128,7 @@
 				workspaceId={workspace}
 				{result}
 				{result_stream}
-				{requireHtmlApproval}
+				{markupTrust}
 				disableExpand={resolvedConfig?.hideDetails}
 				appPath={isEditor ? undefined : $appPath}
 				forceJson={resolvedConfig?.forceJson}
diff --git a/frontend/src/lib/components/apps/components/display/AppDisplayComponentByJobId.svelte b/frontend/src/lib/components/apps/components/display/AppDisplayComponentByJobId.svelte
index 750aff3df7..5bfbcd2581 100644
--- a/frontend/src/lib/components/apps/components/display/AppDisplayComponentByJobId.svelte
+++ b/frontend/src/lib/components/apps/components/display/AppDisplayComponentByJobId.svelte
@@ -3,11 +3,11 @@
 	import { twMerge } from 'tailwind-merge'
 	import { initConfig, initOutput } from '../../editor/appUtils'
 	import {
-		IS_APP_PUBLIC_CONTEXT_KEY,
 		type AppViewerContext,
 		type ComponentCustomCSS,
 		type RichConfigurations
 	} from '../../types'
+	import { getAppMarkupTrust } from '../../markupTrust'
 	import { initCss } from '../../utils'
 	import JobLoader from '$lib/components/JobLoader.svelte'
 	import type { Job } from '$lib/gen'
@@ -33,9 +33,9 @@
 		render
 	}: Props = $props()
 
+	const markupTrust = getAppMarkupTrust()
 	const { app, worldStore, workspace, appPath, isEditor } =
 		getContext<AppViewerContext>('AppViewerContext')
-	const requireHtmlApproval = getContext<boolean | undefined>(IS_APP_PUBLIC_CONTEXT_KEY)
 
 	let resolvedConfig = $state(
 		initConfig(
@@ -147,7 +147,7 @@
 			<DisplayResult
 				workspaceId={workspace}
 				{result}
-				{requireHtmlApproval}
+				{markupTrust}
 				disableExpand={resolvedConfig?.hideDetails}
 				appPath={isEditor ? undefined : $appPath}
 				forceJson={resolvedConfig?.forceJson}
diff --git a/frontend/src/lib/components/apps/components/display/AppHtml.svelte b/frontend/src/lib/components/apps/components/display/AppHtml.svelte
index 3975a54cf5..2ed78c5a44 100644
--- a/frontend/src/lib/components/apps/components/display/AppHtml.svelte
+++ b/frontend/src/lib/components/apps/components/display/AppHtml.svelte
@@ -6,6 +6,8 @@
 	import { initCss } from '../../utils'
 	import RunnableWrapper from '../helpers/RunnableWrapper.svelte'
 	import ResolveStyle from '../helpers/ResolveStyle.svelte'
+	import MarkupApprovalGate from '$lib/components/MarkupApprovalGate.svelte'
+	import { getAppMarkupTrust } from '../../markupTrust'
 
 	interface Props {
 		id: string
@@ -23,16 +25,26 @@
 		render
 	}: Props = $props()
 
+	const markupTrust = getAppMarkupTrust()
 	const { app, worldStore, mode } = getContext<AppViewerContext>('AppViewerContext')
 
-	const outputs = initOutput($worldStore, untrack(() => id), {
-		result: undefined,
-		loading: false
-	})
+	const outputs = initOutput(
+		$worldStore,
+		untrack(() => id),
+		{
+			result: undefined,
+			loading: false
+		}
+	)
 
 	let result: string | undefined = $state(undefined)
 
-	let css = $state(initCss($app.css?.htmlcomponent, untrack(() => customCss)))
+	let css = $state(
+		initCss(
+			$app.css?.htmlcomponent,
+			untrack(() => customCss)
+		)
+	)
 </script>
 
 {#each Object.keys(css ?? {}) as key (key)}
@@ -66,7 +78,17 @@
 		>
 			<div class="w-full h-full overflow-auto">
 				{#key result}
-					{@html result}
+					{#if markupTrust === 'approval'}
+						<MarkupApprovalGate>
+							{#snippet children()}
+								<!-- eslint-disable-next-line svelte/no-at-html-tags -->
+								{@html result}
+							{/snippet}
+						</MarkupApprovalGate>
+					{:else}
+						<!-- eslint-disable-next-line svelte/no-at-html-tags -->
+						{@html result}
+					{/if}
 				{/key}
 			</div>
 		</RunnableWrapper>
diff --git a/frontend/src/lib/components/apps/editor/PublicApp.svelte b/frontend/src/lib/components/apps/editor/PublicApp.svelte
index 92cde8788b..8995684e28 100644
--- a/frontend/src/lib/components/apps/editor/PublicApp.svelte
+++ b/frontend/src/lib/components/apps/editor/PublicApp.svelte
@@ -51,8 +51,9 @@
 	// Use workspace from props or from app.workspace_id (for custom path responses)
 	let effectiveWorkspace = $derived(workspace ?? app?.workspace_id)
 
-	// HTML results from runnables only need viewer approval on the public
-	// surfaces (untrusted distribution); the in-workspace viewer never gated them.
+	// On the public surfaces (untrusted distribution) runnable-authored html/svg needs
+	// the viewer's approval before it renders, unless the app sandbox isolates it. The
+	// in-workspace viewer renders it verbatim. See getAppMarkupTrust.
 	setContext(IS_APP_PUBLIC_CONTEXT_KEY, !inWorkspace)
 
 	// WIN-2006: inside the opaque viewer iframe, navigations to other routes
diff --git a/frontend/src/lib/components/apps/markupTrust.ts b/frontend/src/lib/components/apps/markupTrust.ts
new file mode 100644
index 0000000000..2cabcfe065
--- /dev/null
+++ b/frontend/src/lib/components/apps/markupTrust.ts
@@ -0,0 +1,42 @@
+import { BROWSER } from 'esm-env'
+import { getContext } from 'svelte'
+import { IS_APP_PUBLIC_CONTEXT_KEY } from './types'
+
+/**
+ * How a component should treat runnable-authored `html`/`svg` markup.
+ *
+ * - `sanitize`: strip scripts/handlers first. The default everywhere outside an app
+ *   (job results, previews, flows), where the markup's author and its viewer are
+ *   different users.
+ * - `trusted`: render verbatim, so dynamic svg/html keeps working.
+ * - `approval`: render verbatim, but only after the viewer opts in.
+ */
+export type MarkupTrust = 'sanitize' | 'trusted' | 'approval'
+
+/**
+ * True when this document has an opaque origin, i.e. it is the app sandbox's iframe
+ * and markup rendered here cannot reach the viewer's Windmill session.
+ *
+ * Read the real origin rather than a `wm_embed`/framing signal: those are set by
+ * whoever framed us, so a hostile page could claim to be the sandbox while running
+ * on the Windmill origin with the viewer's cookies. The origin can't be faked the
+ * same way — anyone who makes it opaque has, by doing so, given up the session
+ * access this gate exists to protect.
+ */
+function isOpaqueOrigin(): boolean {
+	return BROWSER && window.origin === 'null'
+}
+
+/**
+ * Trust level for markup rendered by a low-code app component. Call during init.
+ *
+ * An app renders its own author's markup, so it is `trusted` — except on the public
+ * surfaces, where the app is distributed to untrusted viewers. There it needs the
+ * viewer's approval, unless the app is sandbox-isolated, in which case the markup
+ * can't reach the viewer's session and needs no gate.
+ */
+export function getAppMarkupTrust(): MarkupTrust {
+	const isPublic = getContext<boolean | undefined>(IS_APP_PUBLIC_CONTEXT_KEY)
+	if (!isPublic) return 'trusted'
+	return isOpaqueOrigin() ? 'trusted' : 'approval'
+}

From 51d8db6602bc192879e50b54a5fe6b6b8beb63f4 Mon Sep 17 00:00:00 2001
From: hugocasa <hugo@casademont.ch>
Date: Thu, 16 Jul 2026 15:55:44 +0200
Subject: [PATCH 021/171] feat: automatic git-to-windmill sync (polling,
 webhooks, in-app PRs + checks) (#9552)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* docs: add design doc for automatic git-to-windmill pull sync

* docs: add migration plan and implementation phases to git-sync pull design

* feat(git-sync): add auto_pull settings schema and pull enqueue primitive

Adds AutoPullSettings/AutoPullMode/AutoPullStatus on GitRepositorySettings
(workspace_settings.git_sync JSONB), the GIT_SYNC_PULL_SCRIPT_PATH constant,
and should_pull/effective_poll_interval_s helpers with unit tests. Exports the
EE enqueue_git_pull_job primitive. Foundation for repo→Windmill auto-pull.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(git-sync): poll repos and auto-pull new commits into the workspace

Phase 1 of automatic repo → Windmill sync. A monitor task (EE-licensed,
single-replica via advisory lock) git ls-remotes each auto-pull-enabled
repository ~every minute and enqueues a pull when the tracked branch moves,
reusing the {workspace_id}:git_sync concurrency key so pulls serialize with
in-flight push commits.

- windmill-store: background (no-authed) resolver get_git_repo_head_for_autopull
  that resolves the repo resource (incl. $var: refs) and ls-remotes; GitHub-App
  repos are skipped here and will sync via webhooks (phase 2).
- monitor.rs: poll/reconcile/persist with optimistic sha advance and failure
  status; targeted jsonb update so concurrent settings edits aren't clobbered.
- edit_git_sync_repository: preserve server-owned auto_pull state on UI save.
- openapi: AutoPullSettings/AutoPullMode/AutoPullStatus + auto_pull field.
- frontend: per-repo "Automatically deploy changes from Git" toggle with last
  sync status; demote the GitHub Actions link to an advanced CI option.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(git-sync): wire webhook lifecycle + receiver; share reconcile logic

OSS side of phase 2 auto-pull webhooks:
- edit_git_sync_repository creates/removes the repo webhook on save (EE-gated,
  best-effort → falls back to polling).
- monitor poller now delegates to the shared windmill_git_sync reconcile/persist
  helpers (also used by the webhook receiver), removing duplicated logic.
- export the shared reconcile/persist/failure helpers; bump EE ref.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore(git-sync): bump EE ref for phase 3 in-app PR creation

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(git-sync): show webhook vs polling status on the auto-pull toggle

When a repo has an active webhook (auto_pull.webhook_id set), the status line
reads "instant via webhook"; otherwise it reads the ~1-minute polling cadence.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(git-sync): post PR diff check on dry-run completion (phase 4)

Worker completion hook in process_completed_job: when a DeploymentCallback job
carrying the __git_sync_pr_check marker finishes, parse the dry-run SyncResponse
and patch the GitHub check run with the diff summary (success/neutral/failure).
Export enqueue_git_pull_dry_run; bump EE ref.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore(git-sync): bump EE ref (drop unused GHES webhook_secret)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* revert(git-sync): defer phase 4 PR diff checks (OSS side)

Remove the worker completion hook that posted the PR check run, drop the
enqueue_git_pull_dry_run re-export and the orphaned sqlx cache, bump EE ref.
Phases 1-3 (polling, webhooks, in-app PR creation) are unaffected.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Revert "revert(git-sync): defer phase 4 PR diff checks (OSS side)"

This reverts commit 0137d3ca489983b22870e15f442613bd55e79e99.

* chore(git-sync): point EE ref at restored phase 4 commit

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore(git-sync): bump EE ref for clone_ref dry-run

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore(git-sync): bump init-repository hub script to v28784

Picks up the clone_ref param (windmill-integrations#158) so the phase 4 PR-check
dry-run can clone the PR head. Backward compatible; manual pull/push and the
automated pull/poller/webhook all move to the same published version.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore(git-sync): bump EE ref for auto-pull admin-permissioning fix

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore(git-sync): bump EE ref for superadmin pull fallback

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(git-sync): refresh auto-pull tooltip; bump EE ref for webhook secret encryption

The auto-pull toggle tooltip claimed GitHub App repos would sync via
webhooks "in a future update"; webhook delivery now works, so describe
the webhook-vs-polling behavior accurately. Bump the EE ref to pick up
encrypting the webhook HMAC secret at rest.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(git-sync): poll app-backed repos in auto/polling mode

The auto-pull poller skipped app-backed repos (the ls-remote head check
can't authenticate a tokenless URL), so auto- and polling-mode app repos
never synced when their webhook wasn't live. Wire the poller to fetch the
head via the GitHub API for app repos and reconcile. Bump the EE ref.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* feat(git-sync): auto-pull UI — direction split, delivery mode, fallback notice

Reorganize the repository card into two clearly labeled directions:
"Push to Git on deploy (Windmill → Git)" and "Pull from Git (Git →
Windmill)". In the pull section:
- new connections default to auto-pull enabled (webhook with polling
  fallback); existing repos load with auto-pull off and are unchanged
- a Delivery selector chooses "Webhook with polling fallback" or
  "Polling only (air-gapped)"
- a notice surfaces webhook_error when delivery falls back to polling
- a reminder to remove any pre-existing GitHub Action that pushed into
  Windmill, to avoid conflicting double-syncs

Adds the webhook_error field to AutoPullSettings (+ openapi) and bumps
the EE ref.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* feat(git-sync): clearer push indicator + gate webhook delivery to app repos

- Push-on-deploy is shown with a check icon + concise line (via the
  shared GitSyncModeDisplay, restyled from the oversized "Sync:" text);
  the setup wizard reuses it without the check (pre-save preview).
- The delivery-mode selector only shows for GitHub App-backed repos;
  token-based repos show a "webhooks require the GitHub App (managed or
  GHES)" note with a docs link and poll instead. Bumps the EE ref.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* feat(git-sync): fork auto-sync (phase 5) + live deploy check (phase 6)

Phase 5 — fork auto-sync configured at the parent (replaces the *-to-forks
GitHub Actions):
- Add fork_open_prs + fork_pull_sync to GitRepositorySettings (openapi + UI).
- UI: two "Forks of this workspace" toggles in the repo card, gated on
  app-backed and not-a-fork; serialize the flags on save.
- On fork creation, strip the inherited auto_pull block (and fork_* flags) from
  the copied git_sync repo: a fork must not carry the parent's webhook id (it
  would delete the parent's hook on disable) or self-poll on top of the parent's
  fan-out. Push-direction config + installation are still inherited unchanged.

Phase 6 — live deploy status check on the commit (Cloudflare-style): an
in-progress "Windmill" check on the head commit that flips to "Deployed N
changes"; completion handled by the generalized git-sync check hook.

Bump EE ref for the phase 5-6 EE implementation.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm

* chore(git-sync): bump EE ref for PAT auto-pull mode normalization

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm

* fix(git-sync): address PR review findings

- webhook_secret: redact from the settings API response and Debug output (still
  persisted encrypted); it's a server-only HMAC key the UI never needs.
- poller: honor each repo's effective poll interval (relaxed ~10 min when a
  webhook is live) instead of probing every ~60s tick.
- settings save: roll back a just-created webhook if the settings transaction
  doesn't commit, so a failed save can't orphan a hook.
- auto-pull head check: fail SSH remotes with an actionable message (background
  polling has no SSH identity) instead of a confusing ls-remote error.
- deploy/PR check summary: a pull result carrying neither changes nor a settings
  diff now falls back to the unsummarized path instead of a false "in sync".
- UI: reset isGithubApp on resource change / failed fetch so webhook + fork
  controls can't show for the wrong repo.
- tests: cover parse_git_sync_changes and format_change_list edge cases.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm

* fix(git-sync): correct feature gating for OSS builds

- monitor.rs: keep the AUTO_PULL_LAST_POLL static, slack const, and
  poll_git_auto_pull_inner all behind #[cfg(feature = "private")] (an inserted
  static had split the cfg off the function, ungating it in OSS builds).
- edit_git_sync_repository: the webhook create/rollback block references
  windmill_common::git_sync_ee (private module), so gate it on
  all(enterprise, private) instead of enterprise only.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm

* chore(sqlx): cache workspace_diff query pulled in from origin/main

Re-merged origin/main (advanced past the earlier merge); regenerate the offline
sqlx entry for the new workspace_comparison test query so SQLX_OFFLINE builds
(cargo_test) pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm

* fix(git-sync): address Codex review findings (webhook cleanup on delete)

- Deleting a git-sync repository now tears down its managed GitHub webhook
  (deletion bypassed the sync_repo_webhook lifecycle, orphaning the hook so
  GitHub kept delivering to the instance).
- Worker completion hook rolls back the optimistic auto-pull sha on job failure
  (OSS side of the EE change) + caches the new marker query. Bump EE ref.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm

* fix(git-sync): delete repo webhook after the removal commits

Codex re-review nits:
- delete_git_sync_repository deleted the webhook before the settings transaction
  committed; a failed save would then leave the repo pointing at a hook that no
  longer exists (sync_repo_webhook treats a set webhook_id as live and won't
  recreate it). Capture the hook id, commit the DB removal, then delete the hook.
- Reword a fork-copy comment to drop drafting-history wording per AGENTS.md.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm

* fix(git-sync): reconcile the edit-path webhook after the settings commit

Codex nit: edit_git_sync_repository ran sync_repo_webhook before the transaction
committed. The rollback only covered created hooks, but sync_repo_webhook also
deletes a hook on disable/switch-to-polling — a commit failure then left the DB
with a webhook_id whose hook was already gone (and it wouldn't be recreated).
Save + commit first, then reconcile the webhook against the durable config and
persist any hook id/secret change (best-effort). Bump EE ref.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm

* fix(git-sync): preserve webhook secret on whole-config save + default on visible add

Codex nits:
- edit_git_sync_config saved the client config verbatim, so the webhook_secret
  redacted from the GET response would be dropped (breaking delivery). Preserve
  server-owned auto-pull state (webhook id/secret, synced sha, last status) per
  repo from the existing settings, matching edit_git_sync_repository.
- addSyncRepository (the visible add path) didn't set the auto_pull default, so
  new sync repos added from the UI came up with auto-deploy off. Match
  addRepository's default (webhook + polling fallback).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm

* refactor(git-sync): drop fork_pull_sync (parent-level keep-forks-in-sync)

Removes the "Keep forks in sync with the tracked branch" toggle and its
fan-out. Pulling the tracked branch straight into every fork was the
inconsistent piece; the consistent model is per-fork branch sync (each
fork tracks its own wm-fork/** branch), which is a separate follow-up.
fork_open_prs is kept. Also tightens the fork toggle-section spacing.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm

* fix(git-sync): detect dev workspaces in CLI fork branch derivation

isForkWorkspace / computeGitSyncDeployBranch keyed off the wm-fork- id
prefix. Dev workspaces are forks with a custom, prefix-less id, so their
wm-fork/** branch was never derived or created. Detect them via
parent_workspace_id too (which the backend already passes), mirroring the
backend's `parent.is_some() || wm-fork- prefix` rule.

Pairs with the hub-script clone-flag fix (windmill-integrations#163); both
take effect once the CLI is released and the pinned version is bumped.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm

* fix(git-sync): reconcile webhooks on full-config save

edit_git_sync_config preserved server-owned webhook fields but never
created or deleted the managed GitHub webhook, so enabling auto-pull
through the whole-config endpoint only polled, and disabling or removing
a repo left an orphan hook still delivering. Mirror the per-repository
endpoint: after the commit is durable, reconcile every saved repo's
webhook (sync_repo_webhook) and delete the hooks of repos the save
removed, including the clear-whole-config case. Addresses the Codex nit.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm

* fix(git-sync): address Codex nits (webhook orphan on cleared auto_pull, fork detection)

- edit_git_sync_config: also delete a repo's old webhook when the save drops
  the repo OR clears its auto_pull. Webhook fields are only preserved onto a
  Some auto_pull, so a save that present-but-clears a repo would otherwise
  orphan its hook.
- GitSyncRepositoryCard: isFork now uses parent_workspace_id OR the wm-fork-
  prefix (was AND), matching the backend/CLI rule, so prefix-less dev
  workspaces are detected as forks and don't show the parent fork-PR toggle.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm

* docs(git-sync): update design doc for the dropped fork_pull_sync

Phase 5 documented "Keep forks in sync with the tracked branch"
(fork_pull_sync) and its fan-out as implemented; that feature was removed.
Rewrite the section to reflect what ships (fork_open_prs), note the drop +
the per-fork-branch follow-up, and remove the stale fan-out mentions
elsewhere. Addresses the Codex nit.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm

* fix(git-sync): redact webhook secrets from workspace export; fix doc endpoints

- Export (P1): strip the server-owned auto_pull state (webhook secret/id/error
  + synced sha + last pull status) from git_sync before it is written into an
  export's settings.json for both settings formats. The HMAC webhook secret
  must never leave the server (matching the GET-settings redaction), and a
  re-imported workspace must not inherit another install's hook/sync state.
- Docs: the webhook receiver is a single per-workspace endpoint
  /api/w/{workspace}/github_app/webhook (host-aware for managed + self-managed);
  update the stale push_webhook/{id} and instance-global /api/github_app/webhook
  references.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm

* fix(git-sync): skip deleted/archived workspaces in the auto-pull poller

The poller scanned workspace_settings directly, so an archived (soft-deleted)
or renamed-away workspace — whose settings row persists — kept polling and
could enqueue a pull into a dead workspace. Join workspace and require
NOT deleted. The EE webhook receiver gets the same filter (ee ref bumped).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm

* fix(git-sync): never trust client-supplied server-owned auto-pull fields

Both write endpoints (edit_git_sync_repository, edit_git_sync_config)
persisted caller-supplied auto_pull.webhook_id / webhook_secret /
webhook_error / last_synced_sha / last_pull_status when adding a repo or
newly enabling auto-pull, letting a client inject a webhook id/secret or
fake sync state. Strip those server-owned fields from the request up front;
existing repos re-derive them from the DB (carried over), new ones start
clean and the server (re)creates the webhook.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm

* fix(git-sync): merge webhook fields post-commit instead of clobbering the row

The post-commit webhook reconcile in edit_git_sync_repository and
edit_git_sync_config wrote the whole pre-reconcile git_sync snapshot back
after the main save committed. A concurrent git-sync edit or poller status
write that landed in the gap could then be dropped by the stale snapshot.
Re-read the current row and merge only the reconciled webhook id/secret/error
for the repos the reconcile actually changed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm

* feat(git-sync): parent-managed fork sync + PR-on-deploy toggles

Fork sync (push-on-merge-to-forks parity): a parent-level
auto_pull.sync_forks toggle routes changes on each fork's wm-fork/** branch
into that fork workspace, via the parent's existing webhook and one extra
fork-heads listing per poll tick (git ls-remote pattern for token repos,
git/matching-refs for app-backed). Fork state is a server-written
status-only auto_pull blob on the fork's own repo entry; the fork's card
shows a read-only "managed in the parent workspace" line with its branch
and last pull status. Dev workspaces (prefix-less ids) use the same branch
parsing (unit-tested in windmill-common).

PR-on-deploy: opening PRs for Windmill-pushed branches moves into the
deploy pipeline, per repo toggle (promotion_open_prs on the promotion
repo; parent-level fork_open_prs for fork deploys). The push job carries a
marker and the job-completion hook derives the pushed branch (helper
unit-tested against the CLI formula) and opens the PR outbound, so it
works without inbound webhooks; the webhook-side wm_deploy PR arm is
removed. The documented open-pr-* GitHub Actions remain valid alternatives
(PR creation is idempotent).

Fork guards: promotion mode, enabled auto-pull, and fork_open_prs are
rejected on fork workspaces (they are parent-managed; a fork's deploys
always target its wm-fork/** branch) and the promotion card is hidden in a
fork's settings. Enabling auto-pull now also requires EE, and the
post-commit webhook reconcile persists the normalized delivery mode.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm

* feat(git-sync): dev workspaces sync with their environment-label branch

A dev workspace's git branch is its environment label verbatim (dev/
staging, default dev) — a first-class env branch like the documented
push-on-merge-staging layout — instead of the wm-fork/** form. The label
rides the deploy job args (backend → hub script → CLI
--dev-workspace-label), the PR completion hook derives the same head, the
webhook/poller route label branches into the matching dev-workspace child
(poller lists them alongside wm-fork/* via extra ls-remote refs / per-label
API lookups), and manual pulls from the UI pass clone_ref accordingly. The
CLI refuses to deploy when the label branch equals the checked-out tracked
branch, which would otherwise commit fork content straight to it.

Because the branch is keyed on the label, the label is now immutable after
creation: set at create/attach only, the set_dev_workspace_label endpoint
is removed and the settings tab shows it read-only.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm

* feat(git-sync): nested fork routing + fork-of-dev branch rooting

A fork of a dev workspace now roots its wm-fork/** branch on the dev's
environment-label branch (the content it diverged from) and its PR merges
back into that branch: the backend passes parent_dev_workspace_label with
the deploy (parent row joined in both enqueue paths), the CLI gains
--parent-dev-workspace-label and checks it before the wm-fork- prefix
fallback when rooting a fork-of-a-fork branch, and the PR completion hook
uses it as the PR base.

Fork sync routing covers the whole live descendant chain of the
webhook/poller workspace (recursive, depth-capped) instead of direct
children only, and fork_open_prs is resolved at the root ancestor — only
the root can hold auto-pull config, so grandchild forks sync through it.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm

* feat(git-sync): PR deploy-preview comment, clearer check copy, app-only hints

- The PR diff completion hook maintains one managed comment on the PR
  (Cloudflare deploy-preview style: workspace, status, commit, collapsible
  change list), upserted per synchronize via a hidden marker. The check run
  stays for required-check gating.
- A settings difference in the diff summary is worded by cause: the PR
  changes wmill.yaml, vs pre-existing drift between the repo's wmill.yaml
  and the workspace, vs undetermined (neutral wording).
- Deploy-status check titles name the target workspace ("Deployed 2
  change(s) to staging"), since GitHub shows a head commit's checks on any
  PR containing it and a bare "Deployed" read as if the PR had deployed.
- Token-based repos see a hint pointing at the open-pr-on-commit /
  open-pr-on-fork-commit workflows where the app-only PR toggles would be;
  an API-set toggle on a non-app repo now logs a warning naming the
  fallback; the design doc lists app-only features and their degradation.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm

* fix(git-sync): EE-gate auto-pull UI, fork pull clone_ref, no-op push PR gate

- CE: the auto-pull and fork-PR toggles are disabled with an EE badge, and
  new sync repos only default them on when licensed (basic git sync is
  available on CE since #8493, but auto-pull is EE and the backend rejects it)
- The pull modal passes clone_ref for wm-fork- forks (wm-fork/<tracked>/<id>)
  so a manual pull fetches the fork branch instead of the tracked branch head
- PR-on-deploy skips no-op pushes: when the push script reports pushed=false
  (e.g. the deploy was caused by an auto-pull), the completion hook no longer
  ensures a PR, so closed PRs aren't recreated by the sync loop

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm

* chore: refresh package-lock after main merge (windmill-utils-internal 1.8.2)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm

* test: auto-pull e2e integration tests; fix PR comment table formatting

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm

* fix(git-sync): runtime license gate for auto-pull saves; user/group promotion-branch parity

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm

* fix(git-sync): explain in-sync PR verdicts with the repo's sync filter scope

A PR that only touches files outside the repository's include paths gets
"In sync", which reads as a wrong verdict; the check summary (and managed
comment) now name the filters, e.g. "Only files matching this repository's
sync filters deploy on merge: `f/**` (excluding `f/pat/**`)."

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm

* feat(git-sync): clearer card copy/structure; surface PR-creation failures

- Fork sync toggle renamed and kept in the pull section; the fork PR toggle
  moves to the push section with a note that push settings apply to forks
- Fork/dev workspaces' push section names their actual branch instead of the
  tracked-branch line; promotion repos hide the pull direction (promotion
  pushes deploy branches on top of a sync-mode setup)
- Promotion mode line describes the wm_deploy/** branch + merge-to-promote
  flow; workflow-fallback hints lead with the how-to and link to the docs;
  test connection button demoted from accent per brand guidelines
- New server-owned open_pr_error on repo settings: the deploy completion hook
  records why a PR couldn't be opened (e.g. app permission not yet approved)
  and clears it on the next success; shown as a warning under the PR toggles

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm

* fix: cfg-gate scope-note helper (dead code on OSS builds)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm

* fix(git-sync): license-gate preserved auto-pull; attach strips parent-only settings

- edit_git_sync_repository re-checks the runtime Enterprise gate against the
  EFFECTIVE repo state after preservation: the older-client arm copies the
  existing auto_pull back, which the request-side check never saw
- attach_dev_workspace now mirrors the fork-creation copy on the attached
  workspace's own git sync: promotion repos dropped, auto_pull/fork PRs/PR
  error stripped, and any managed webhook deleted after commit (the attached
  workspace is parent-managed and must not keep pulling its old tracked branch)
- integration test: attaching an auto-pull-enabled workspace strips it

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm

* fix(git-sync): detach clears standalone parent; reject label == tracked branch

- detach_dev_workspace clears parent_workspace_id for prefix-less (attached
  standalone) workspaces so they stop classifying as forks and deploying to
  wm-fork/** branches; wm-fork- re-designated forks keep their parent; cache
  invalidations mirror attach
- dev-workspace create/attach reject an environment label that equals a
  git-sync repository's tracked branch (prod's or the candidate's): deploys
  would target the very branch the repo syncs from, and the CLI guard would
  fail every push job after the fact
- CLI unit tests: prefix-less fork beats wm_deploy derivation; isForkWorkspace
  parent-id argument

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm

* chore(git-sync): bump hub script pins (push 28786, pull 28785)

Published from windmill-integrations #163 with windmill-cli@1.753.1-gitsync.0:
dev-workspace label deploys, fork-of-dev rooting, fork checkout on the
existing remote branch, and the pushed-flag result.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm

* fix(git-sync): no parent-only defaults on fork repos; rename strips webhook state

- addSyncRepository skips the auto_pull/fork_open_prs defaults on fork/dev
  workspaces where the backend rejects them (saving a new sync repo from an
  EE fork 400'd deterministically)
- change_workspace_id strips webhook id/secret/error from the copied git_sync
  and deletes the stale GitHub hooks post-commit: they deliver to the old
  (archived) workspace URL, so the new workspace would report a live webhook
  while polling at the relaxed interval; next save re-registers cleanly
- EE: PR diff checks for contributor-fork PRs clone the synthetic
  pull/<n>/head ref (head.ref doesn't exist in the base repo)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm

* chore(git-sync): bump pull script pin to hub/28787 (synthetic PR ref support)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm

* fix(git-sync): targeted jsonb update for open_pr_error (no full-blob clobber)

The full read-modify-write raced the poller's concurrent last_synced_sha /
last_pull_status writes on the same column; mirror the EE status writer and
update only the matching repository element's open_pr_error key.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm

* style(git-sync): inline EE badge on gated toggles (matches settings nav)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm

* copy(git-sync): both directions in page/card descriptions; clearer promotion flow

- Page header and sync-card description mention the pull direction, not only
  push-on-deploy
- Promotion description walks the actual flow (wm_deploy/** branch, merge to
  promote, sync the target workspace) and points at the PR toggle / workflow;
  the Git Promotion docs link now also shows on configured cards, not only in
  the empty state

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm

* fix(git-sync): resolve branch-less resources' default branch for fork sync

A git resource without an explicit branch polled as the bare "HEAD" ref,
which the fork/dev-label fan-out cannot scope (wm-fork/<branch>/*), so fork
sync silently never ran on polling-only repos. Resolve the remote's default
branch name with `ls-remote --symref HEAD` (one call for name + head sha);
"HEAD" only remains when resolution fails. The polling e2e test now uses a
branch-less resource to cover this shape.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm

* fix(git-sync): runtime license gate for in-app PR creation

promotion_open_prs/fork_open_prs are rejected on save without an Enterprise
plan (like auto_pull), and the deploy completion hook re-checks the plan
before opening PRs so flags stored while licensed stop driving GitHub calls
after a lapse.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm

* feat(git-sync): app-aware pull defaults, always webhook delivery, token-repo guidance

- Pull-from-Git defaults on only for app-backed repos (applied when the
  selected resource resolves); polling is opt-in for token repositories,
  with a warning alert recommending the GitHub App (instant pull + in-app
  PRs) or the sync GitHub workflow
- App repos always use webhook delivery with polling fallback: the delivery
  selector is gone and a stored polling mode is normalized back to auto
- Post-save modal reflects the auto-pull state instead of telling the user
  to turn on a toggle that is already on
- Non-app PR hints recommend the GitHub App explicitly

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm

* copy(git-sync): single info box for token-repo pull guidance

Merges the instant-pull recommendation with the GitHub Action conflict note,
shown only for non-app repos; app repos need neither, and the redundant
'instant webhook sync requires' line is gone.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm

* copy(git-sync): keep the GitHub Action conflict note on app repos

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm

* copy(git-sync): anchor docs links to their exact sections

GitHub App references point at integrations/git_repository#github-app, the
workflow hints at deploy_gh_gl#github-actions-setup, and the sync workflow
at git_sync#github-actions (all anchors verified against the live docs).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm

* copy(git-sync): fork workflow hint links to git_sync#github-actions

open-pr-on-fork-commit is documented on the git_sync page, not deploy_gh_gl.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm

* fix(git-sync): fork PRs are opt-in on new connections too

Only auto-pull and fork sync default on for new app-backed connections;
opening pull requests stays a deliberate per-repo decision.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm

* feat(git-sync): default the managed PR on for new app-backed promotion repos

A promotion deploy's wm_deploy/** branch exists to be merged; without a PR
it's an orphaned branch. Fork PRs stay opt-in. Also scope the sync-repo
auto-pull default to sync mode so promotion repos can't pick it up.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm

* docs(git-sync): GHES self-managed app permission setup

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm

* docs(git-sync): frame permission update against GitHub Actions, not polling

Existing installations don't have polling; their git-to-Windmill direction
runs on GitHub Actions today, so the approval text describes the update as
replacing those workflows and notes every feature is opt-in.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm

* copy(workspaces): drop 'cosmetic' qualifier from dev-workspace label UI

* chore: update ee-repo-ref to 9b2a6375f838436cf68cff449cc9bc621cca5281

This commit updates the EE repository reference after PR #632 was merged in windmill-ee-private.

Previous ee-repo-ref: 99eef24e2f0402b9a997cde5f67be52ee5d54b0e

New ee-repo-ref: 9b2a6375f838436cf68cff449cc9bc621cca5281

Automated by sync-ee-ref workflow.

* fix(git-sync): reject '/' in fork and dev workspace ids

* fix(git-sync): bound auto-pull git probes with a per-command timeout

* fix(git-sync): persist webhook reconcile via targeted jsonb updates

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
---
 .github/workflows/git-sync-test.yml           |   3 +
 ...96bd4378988af6447feeafd243262c246a9f5.json |  22 +
 ...c780a5ac35fa7639c4ee3a449b693add24241.json |  28 +
 ...ebfa9cee08b93e0562beb629d84c4c689f4e7.json |  24 +
 ...246fd2bdf9e3fce89852120aa4ad4ad6abfc3.json |  26 +
 ...d2817e9ba0b3a66f7eb4fc1177764563a0665.json |  23 +
 ...1f48da6fe47bc29b6987cf60edd56bb1663b6.json |  46 +
 ...8ad89b2f17a9d3ef4659c2d2284415177b32c.json |  28 +
 ...ad146e2ca8c1cd7c10891fe21a7638aedc381.json |  22 +
 ...e6b88daa38ba272d22f846bd4267a134c404c.json |  16 +
 ...93c4e64166a6d4d999911dfab743c43bdac35.json |  46 +
 ...36bd19923e0b0581efbae448197d6accf01f3.json |  16 +
 ...f697438aaa8de6233756a3227cb1e4b2fef4e.json |  14 +
 ...57a9b31539b7fd146e0cff4aa701d06cc6846.json |  23 +
 ...c45a1eed3aec6d60de7bc894b78189c76da72.json |  34 +
 ...b4da42c00d072a908412a214ab231df784b8f.json |  22 +
 ...570a14d22ed2a776efa111ad53aa9e77eadf1.json |  26 +
 ...78f7253e4470287810d7ee13b8519f54b997f.json |  22 +
 ...c85a1166294ea655e934baf5e3e1daa0fac1a.json |  17 +
 ...3abaf747aef7078ae57b0373f06c70b6f2f9f.json |  82 ++
 ...a72e61719fae68aa4b42730f9076f3bd97441.json |   2 +-
 backend/Cargo.lock                            |   1 +
 backend/Cargo.toml                            |   1 +
 backend/src/monitor.rs                        | 320 +++++++
 .../windmill-api-workspaces/src/workspaces.rs | 656 +++++++++++--
 .../src/workspaces_extra.rs                   |  60 ++
 backend/windmill-api/openapi.yaml             |  88 +-
 backend/windmill-api/src/workspaces_export.rs |  33 +-
 backend/windmill-common/src/workspaces.rs     | 299 +++++-
 backend/windmill-git-sync/src/lib.rs          |   4 +-
 backend/windmill-store/src/resources.rs       | 267 +++++-
 .../windmill-worker/src/result_processor.rs   | 862 ++++++++++++++++++
 cli/src/commands/sync/sync.ts                 |  73 +-
 cli/src/utils/git.ts                          |  49 +-
 cli/test/git_unit.test.ts                     |  41 +
 docs/git-sync-github-app-permissions.md       |  34 +
 docs/git-sync-pull-design.md                  | 655 +++++++++++++
 frontend/package-lock.json                    |  50 +-
 .../lib/components/DevWorkspaceSetting.svelte |  33 +-
 .../git_sync/GitSyncContext.svelte.ts         |  34 +-
 .../git_sync/GitSyncModalManager.svelte       |   1 +
 .../git_sync/GitSyncModeDisplay.svelte        |  40 +-
 .../git_sync/GitSyncRepositoryCard.svelte     | 349 ++++++-
 .../components/git_sync/GitSyncSection.svelte | 147 +--
 .../git_sync/GitSyncSuccessModal.svelte       |  58 +-
 .../git_sync/PullWorkspaceModal.svelte        |  30 +-
 .../CreateWorkspaceInner.svelte               |   3 +-
 frontend/src/lib/hubPaths.json                |   2 +-
 integration_tests/test/git_sync_test.py       | 355 +++++++-
 .../test/wmill_integration_test_utils.py      |  23 +
 50 files changed, 4744 insertions(+), 366 deletions(-)
 create mode 100644 backend/.sqlx/query-020cc73e39782e7be50a146373096bd4378988af6447feeafd243262c246a9f5.json
 create mode 100644 backend/.sqlx/query-0bb3de62f920a4f6c5da6f0a7bfc780a5ac35fa7639c4ee3a449b693add24241.json
 create mode 100644 backend/.sqlx/query-0e016aaa6842767ac636e5b3e1febfa9cee08b93e0562beb629d84c4c689f4e7.json
 create mode 100644 backend/.sqlx/query-17cdf02b4912078459526205849246fd2bdf9e3fce89852120aa4ad4ad6abfc3.json
 create mode 100644 backend/.sqlx/query-1b32339718406531acd2d051386d2817e9ba0b3a66f7eb4fc1177764563a0665.json
 create mode 100644 backend/.sqlx/query-1c018b483795d9d33baa7be2ee41f48da6fe47bc29b6987cf60edd56bb1663b6.json
 create mode 100644 backend/.sqlx/query-3202bed875693ae923f496272cd8ad89b2f17a9d3ef4659c2d2284415177b32c.json
 create mode 100644 backend/.sqlx/query-3451cbd6a783da68324f64c2e95ad146e2ca8c1cd7c10891fe21a7638aedc381.json
 create mode 100644 backend/.sqlx/query-3b7498768197d7e002c3965ad16e6b88daa38ba272d22f846bd4267a134c404c.json
 create mode 100644 backend/.sqlx/query-69d0c59bb11a01ffe9934f62feb93c4e64166a6d4d999911dfab743c43bdac35.json
 create mode 100644 backend/.sqlx/query-71faf95db96589e5554882e1dd036bd19923e0b0581efbae448197d6accf01f3.json
 create mode 100644 backend/.sqlx/query-824464f9d9b39980fee7d9fe8c6f697438aaa8de6233756a3227cb1e4b2fef4e.json
 create mode 100644 backend/.sqlx/query-8e20b696db308f780744d775bc257a9b31539b7fd146e0cff4aa701d06cc6846.json
 create mode 100644 backend/.sqlx/query-a5fbc70721ea71796cf8e180688c45a1eed3aec6d60de7bc894b78189c76da72.json
 create mode 100644 backend/.sqlx/query-ba6ffe7fb86878e23f69e9c7636b4da42c00d072a908412a214ab231df784b8f.json
 create mode 100644 backend/.sqlx/query-bfbc368c751c8532792ae0a77ed570a14d22ed2a776efa111ad53aa9e77eadf1.json
 create mode 100644 backend/.sqlx/query-c92c08a4b4c06d087c2590081db78f7253e4470287810d7ee13b8519f54b997f.json
 create mode 100644 backend/.sqlx/query-ea1895df5a6afa5af59c3771291c85a1166294ea655e934baf5e3e1daa0fac1a.json
 create mode 100644 backend/.sqlx/query-f02977ee5df3d8f734fb32836583abaf747aef7078ae57b0373f06c70b6f2f9f.json
 create mode 100644 docs/git-sync-github-app-permissions.md
 create mode 100644 docs/git-sync-pull-design.md

diff --git a/.github/workflows/git-sync-test.yml b/.github/workflows/git-sync-test.yml
index 3ff7d8b85c..3c4d37622a 100644
--- a/.github/workflows/git-sync-test.yml
+++ b/.github/workflows/git-sync-test.yml
@@ -180,6 +180,9 @@ jobs:
           DENO_PATH: deno
           BUN_PATH: bun
           NODE_BIN_PATH: node
+          # The auto-pull poller's SSRF guard rejects localhost git remotes;
+          # the tests' Gitea runs on localhost.
+          ALLOW_LOCAL_GIT_REMOTES: "true"
         run: |
           ./target/debug/windmill &
           echo "Waiting for Windmill to be ready..."
diff --git a/backend/.sqlx/query-020cc73e39782e7be50a146373096bd4378988af6447feeafd243262c246a9f5.json b/backend/.sqlx/query-020cc73e39782e7be50a146373096bd4378988af6447feeafd243262c246a9f5.json
new file mode 100644
index 0000000000..6ab08ab29a
--- /dev/null
+++ b/backend/.sqlx/query-020cc73e39782e7be50a146373096bd4378988af6447feeafd243262c246a9f5.json
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT args->'__git_sync_auto_pull' FROM v2_job WHERE id = $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "?column?",
+        "type_info": "Jsonb"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "020cc73e39782e7be50a146373096bd4378988af6447feeafd243262c246a9f5"
+}
diff --git a/backend/.sqlx/query-0bb3de62f920a4f6c5da6f0a7bfc780a5ac35fa7639c4ee3a449b693add24241.json b/backend/.sqlx/query-0bb3de62f920a4f6c5da6f0a7bfc780a5ac35fa7639c4ee3a449b693add24241.json
new file mode 100644
index 0000000000..1451621b1e
--- /dev/null
+++ b/backend/.sqlx/query-0bb3de62f920a4f6c5da6f0a7bfc780a5ac35fa7639c4ee3a449b693add24241.json
@@ -0,0 +1,28 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        SELECT\n            (elem->>'installation_id')::bigint as installation_id,\n            elem->>'github_base_url' as github_base_url\n        FROM workspace_settings,\n        LATERAL jsonb_array_elements(git_app_installations) AS elem\n        WHERE workspace_id = $1\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "installation_id",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 1,
+        "name": "github_base_url",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      null,
+      null
+    ]
+  },
+  "hash": "0bb3de62f920a4f6c5da6f0a7bfc780a5ac35fa7639c4ee3a449b693add24241"
+}
diff --git a/backend/.sqlx/query-0e016aaa6842767ac636e5b3e1febfa9cee08b93e0562beb629d84c4c689f4e7.json b/backend/.sqlx/query-0e016aaa6842767ac636e5b3e1febfa9cee08b93e0562beb629d84c4c689f4e7.json
new file mode 100644
index 0000000000..6f5d84d2d6
--- /dev/null
+++ b/backend/.sqlx/query-0e016aaa6842767ac636e5b3e1febfa9cee08b93e0562beb629d84c4c689f4e7.json
@@ -0,0 +1,24 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "WITH RECURSIVE descendants AS (\n                   SELECT id, 0 AS depth FROM workspace\n                   WHERE parent_workspace_id = $1 AND NOT deleted\n                   UNION ALL\n                   SELECT w.id, d.depth + 1 FROM workspace w\n                   JOIN descendants d ON w.parent_workspace_id = d.id\n                   WHERE NOT w.deleted AND d.depth < 10\n               )\n               SELECT id as \"id!\" FROM descendants WHERE (id = $2 OR id = $3)\n               ORDER BY (id = $2) DESC LIMIT 1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id!",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "0e016aaa6842767ac636e5b3e1febfa9cee08b93e0562beb629d84c4c689f4e7"
+}
diff --git a/backend/.sqlx/query-17cdf02b4912078459526205849246fd2bdf9e3fce89852120aa4ad4ad6abfc3.json b/backend/.sqlx/query-17cdf02b4912078459526205849246fd2bdf9e3fce89852120aa4ad4ad6abfc3.json
new file mode 100644
index 0000000000..bc2e6a6f63
--- /dev/null
+++ b/backend/.sqlx/query-17cdf02b4912078459526205849246fd2bdf9e3fce89852120aa4ad4ad6abfc3.json
@@ -0,0 +1,26 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT COALESCE(username, split_part(email, '@', 1)) AS \"username!\", email FROM password WHERE super_admin = true AND disabled = false ORDER BY email LIMIT 1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "username!",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "email",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      null,
+      false
+    ]
+  },
+  "hash": "17cdf02b4912078459526205849246fd2bdf9e3fce89852120aa4ad4ad6abfc3"
+}
diff --git a/backend/.sqlx/query-1b32339718406531acd2d051386d2817e9ba0b3a66f7eb4fc1177764563a0665.json b/backend/.sqlx/query-1b32339718406531acd2d051386d2817e9ba0b3a66f7eb4fc1177764563a0665.json
new file mode 100644
index 0000000000..a409f83519
--- /dev/null
+++ b/backend/.sqlx/query-1b32339718406531acd2d051386d2817e9ba0b3a66f7eb4fc1177764563a0665.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT id FROM workspace WHERE parent_workspace_id = $1 AND NOT deleted AND is_dev_workspace AND COALESCE(dev_workspace_label, 'dev') = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "1b32339718406531acd2d051386d2817e9ba0b3a66f7eb4fc1177764563a0665"
+}
diff --git a/backend/.sqlx/query-1c018b483795d9d33baa7be2ee41f48da6fe47bc29b6987cf60edd56bb1663b6.json b/backend/.sqlx/query-1c018b483795d9d33baa7be2ee41f48da6fe47bc29b6987cf60edd56bb1663b6.json
new file mode 100644
index 0000000000..6449a361e6
--- /dev/null
+++ b/backend/.sqlx/query-1c018b483795d9d33baa7be2ee41f48da6fe47bc29b6987cf60edd56bb1663b6.json
@@ -0,0 +1,46 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT w.parent_workspace_id, w.is_dev_workspace, w.dev_workspace_label,\n                  p.is_dev_workspace as \"parent_is_dev_workspace?\", p.dev_workspace_label as \"parent_dev_label?\"\n           FROM workspace w LEFT JOIN workspace p ON p.id = w.parent_workspace_id\n           WHERE w.id = $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "parent_workspace_id",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "is_dev_workspace",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 2,
+        "name": "dev_workspace_label",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 3,
+        "name": "parent_is_dev_workspace?",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 4,
+        "name": "parent_dev_label?",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      true,
+      false,
+      true,
+      false,
+      true
+    ]
+  },
+  "hash": "1c018b483795d9d33baa7be2ee41f48da6fe47bc29b6987cf60edd56bb1663b6"
+}
diff --git a/backend/.sqlx/query-3202bed875693ae923f496272cd8ad89b2f17a9d3ef4659c2d2284415177b32c.json b/backend/.sqlx/query-3202bed875693ae923f496272cd8ad89b2f17a9d3ef4659c2d2284415177b32c.json
new file mode 100644
index 0000000000..0a833ba620
--- /dev/null
+++ b/backend/.sqlx/query-3202bed875693ae923f496272cd8ad89b2f17a9d3ef4659c2d2284415177b32c.json
@@ -0,0 +1,28 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT username, email FROM usr WHERE workspace_id = $1 AND is_admin = true AND operator = false AND disabled = false ORDER BY username LIMIT 1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "username",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "email",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      false
+    ]
+  },
+  "hash": "3202bed875693ae923f496272cd8ad89b2f17a9d3ef4659c2d2284415177b32c"
+}
diff --git a/backend/.sqlx/query-3451cbd6a783da68324f64c2e95ad146e2ca8c1cd7c10891fe21a7638aedc381.json b/backend/.sqlx/query-3451cbd6a783da68324f64c2e95ad146e2ca8c1cd7c10891fe21a7638aedc381.json
new file mode 100644
index 0000000000..a5275d2ed1
--- /dev/null
+++ b/backend/.sqlx/query-3451cbd6a783da68324f64c2e95ad146e2ca8c1cd7c10891fe21a7638aedc381.json
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "WITH RECURSIVE up AS (\n               SELECT id, parent_workspace_id, 0 AS depth FROM workspace WHERE id = $1\n               UNION ALL\n               SELECT w.id, w.parent_workspace_id, up.depth + 1\n               FROM workspace w JOIN up ON w.id = up.parent_workspace_id\n               WHERE up.depth < 10\n           )\n           SELECT git_sync FROM workspace_settings\n           WHERE workspace_id = (SELECT id FROM up WHERE parent_workspace_id IS NULL LIMIT 1)",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "git_sync",
+        "type_info": "Jsonb"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      true
+    ]
+  },
+  "hash": "3451cbd6a783da68324f64c2e95ad146e2ca8c1cd7c10891fe21a7638aedc381"
+}
diff --git a/backend/.sqlx/query-3b7498768197d7e002c3965ad16e6b88daa38ba272d22f846bd4267a134c404c.json b/backend/.sqlx/query-3b7498768197d7e002c3965ad16e6b88daa38ba272d22f846bd4267a134c404c.json
new file mode 100644
index 0000000000..266c75fad3
--- /dev/null
+++ b/backend/.sqlx/query-3b7498768197d7e002c3965ad16e6b88daa38ba272d22f846bd4267a134c404c.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n            UPDATE workspace_settings\n            SET git_sync = jsonb_set(\n                git_sync,\n                '{repositories}',\n                (SELECT jsonb_agg(\n                    CASE WHEN elem->>'git_repo_resource_path' = $2\n                          AND jsonb_typeof(elem->'auto_pull') = 'object'\n                        THEN jsonb_set(elem, '{auto_pull}',\n                             ((elem->'auto_pull') - 'webhook_id' - 'webhook_secret' - 'webhook_error') || $3)\n                        ELSE elem END)\n                 FROM jsonb_array_elements(git_sync->'repositories') AS elem)\n            )\n            WHERE workspace_id = $1\n              AND jsonb_typeof(git_sync->'repositories') = 'array'\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Jsonb"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "3b7498768197d7e002c3965ad16e6b88daa38ba272d22f846bd4267a134c404c"
+}
diff --git a/backend/.sqlx/query-69d0c59bb11a01ffe9934f62feb93c4e64166a6d4d999911dfab743c43bdac35.json b/backend/.sqlx/query-69d0c59bb11a01ffe9934f62feb93c4e64166a6d4d999911dfab743c43bdac35.json
new file mode 100644
index 0000000000..a8651b5a73
--- /dev/null
+++ b/backend/.sqlx/query-69d0c59bb11a01ffe9934f62feb93c4e64166a6d4d999911dfab743c43bdac35.json
@@ -0,0 +1,46 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT w.parent_workspace_id, w.is_dev_workspace, w.dev_workspace_label,\n                      p.is_dev_workspace as \"parent_is_dev_workspace?\", p.dev_workspace_label as \"parent_dev_label?\"\n               FROM workspace w LEFT JOIN workspace p ON p.id = w.parent_workspace_id\n               WHERE w.id = $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "parent_workspace_id",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "is_dev_workspace",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 2,
+        "name": "dev_workspace_label",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 3,
+        "name": "parent_is_dev_workspace?",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 4,
+        "name": "parent_dev_label?",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      true,
+      false,
+      true,
+      false,
+      true
+    ]
+  },
+  "hash": "69d0c59bb11a01ffe9934f62feb93c4e64166a6d4d999911dfab743c43bdac35"
+}
diff --git a/backend/.sqlx/query-71faf95db96589e5554882e1dd036bd19923e0b0581efbae448197d6accf01f3.json b/backend/.sqlx/query-71faf95db96589e5554882e1dd036bd19923e0b0581efbae448197d6accf01f3.json
new file mode 100644
index 0000000000..76c7a0baa7
--- /dev/null
+++ b/backend/.sqlx/query-71faf95db96589e5554882e1dd036bd19923e0b0581efbae448197d6accf01f3.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n            UPDATE workspace_settings\n            SET git_sync = jsonb_set(\n                git_sync,\n                '{repositories}',\n                (SELECT jsonb_agg(\n                    CASE WHEN elem->>'git_repo_resource_path' IN ($2, '$res:' || $2)\n                        THEN CASE WHEN $3::text IS NULL THEN elem - 'open_pr_error'\n                             ELSE jsonb_set(elem, '{open_pr_error}', to_jsonb($3::text), true) END\n                        ELSE elem END)\n                 FROM jsonb_array_elements(git_sync->'repositories') AS elem)\n            )\n            WHERE workspace_id = $1\n              AND jsonb_typeof(git_sync->'repositories') = 'array'\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "71faf95db96589e5554882e1dd036bd19923e0b0581efbae448197d6accf01f3"
+}
diff --git a/backend/.sqlx/query-824464f9d9b39980fee7d9fe8c6f697438aaa8de6233756a3227cb1e4b2fef4e.json b/backend/.sqlx/query-824464f9d9b39980fee7d9fe8c6f697438aaa8de6233756a3227cb1e4b2fef4e.json
new file mode 100644
index 0000000000..5ab90a6a4e
--- /dev/null
+++ b/backend/.sqlx/query-824464f9d9b39980fee7d9fe8c6f697438aaa8de6233756a3227cb1e4b2fef4e.json
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE workspace SET is_dev_workspace = false,\n         parent_workspace_id = CASE WHEN id LIKE 'wm-fork-%' THEN parent_workspace_id ELSE NULL END\n         WHERE id = $1",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "824464f9d9b39980fee7d9fe8c6f697438aaa8de6233756a3227cb1e4b2fef4e"
+}
diff --git a/backend/.sqlx/query-8e20b696db308f780744d775bc257a9b31539b7fd146e0cff4aa701d06cc6846.json b/backend/.sqlx/query-8e20b696db308f780744d775bc257a9b31539b7fd146e0cff4aa701d06cc6846.json
new file mode 100644
index 0000000000..978c4646ae
--- /dev/null
+++ b/backend/.sqlx/query-8e20b696db308f780744d775bc257a9b31539b7fd146e0cff4aa701d06cc6846.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT value->>'branch' FROM resource WHERE workspace_id = $1 AND path = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "?column?",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "8e20b696db308f780744d775bc257a9b31539b7fd146e0cff4aa701d06cc6846"
+}
diff --git a/backend/.sqlx/query-a5fbc70721ea71796cf8e180688c45a1eed3aec6d60de7bc894b78189c76da72.json b/backend/.sqlx/query-a5fbc70721ea71796cf8e180688c45a1eed3aec6d60de7bc894b78189c76da72.json
new file mode 100644
index 0000000000..712cc41e54
--- /dev/null
+++ b/backend/.sqlx/query-a5fbc70721ea71796cf8e180688c45a1eed3aec6d60de7bc894b78189c76da72.json
@@ -0,0 +1,34 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT args->'__git_sync_pr_check' AS \"pr\", args->'__git_sync_deploy_check' AS \"deploy\",\n           args->>'repo_url_resource_path' AS \"repo_path\"\n           FROM v2_job WHERE id = $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "pr",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 1,
+        "name": "deploy",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 2,
+        "name": "repo_path",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid"
+      ]
+    },
+    "nullable": [
+      null,
+      null,
+      null
+    ]
+  },
+  "hash": "a5fbc70721ea71796cf8e180688c45a1eed3aec6d60de7bc894b78189c76da72"
+}
diff --git a/backend/.sqlx/query-ba6ffe7fb86878e23f69e9c7636b4da42c00d072a908412a214ab231df784b8f.json b/backend/.sqlx/query-ba6ffe7fb86878e23f69e9c7636b4da42c00d072a908412a214ab231df784b8f.json
new file mode 100644
index 0000000000..267efe9e63
--- /dev/null
+++ b/backend/.sqlx/query-ba6ffe7fb86878e23f69e9c7636b4da42c00d072a908412a214ab231df784b8f.json
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT DISTINCT COALESCE(dev_workspace_label, 'dev') as \"label!\"\n           FROM workspace\n           WHERE parent_workspace_id = $1 AND is_dev_workspace AND NOT deleted",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "label!",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "ba6ffe7fb86878e23f69e9c7636b4da42c00d072a908412a214ab231df784b8f"
+}
diff --git a/backend/.sqlx/query-bfbc368c751c8532792ae0a77ed570a14d22ed2a776efa111ad53aa9e77eadf1.json b/backend/.sqlx/query-bfbc368c751c8532792ae0a77ed570a14d22ed2a776efa111ad53aa9e77eadf1.json
new file mode 100644
index 0000000000..1d92609205
--- /dev/null
+++ b/backend/.sqlx/query-bfbc368c751c8532792ae0a77ed570a14d22ed2a776efa111ad53aa9e77eadf1.json
@@ -0,0 +1,26 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT ws.workspace_id, ws.git_sync\n           FROM workspace_settings ws\n           JOIN workspace w ON w.id = ws.workspace_id\n           WHERE NOT w.deleted\n             AND ws.git_sync IS NOT NULL\n             AND ws.git_sync->'repositories' @> '[{\"auto_pull\": {\"enabled\": true}}]'::jsonb",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "workspace_id",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "git_sync",
+        "type_info": "Jsonb"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      false,
+      true
+    ]
+  },
+  "hash": "bfbc368c751c8532792ae0a77ed570a14d22ed2a776efa111ad53aa9e77eadf1"
+}
diff --git a/backend/.sqlx/query-c92c08a4b4c06d087c2590081db78f7253e4470287810d7ee13b8519f54b997f.json b/backend/.sqlx/query-c92c08a4b4c06d087c2590081db78f7253e4470287810d7ee13b8519f54b997f.json
new file mode 100644
index 0000000000..46ce3af568
--- /dev/null
+++ b/backend/.sqlx/query-c92c08a4b4c06d087c2590081db78f7253e4470287810d7ee13b8519f54b997f.json
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT ws.git_sync FROM workspace_settings ws\n         JOIN workspace w ON w.id = ws.workspace_id\n         WHERE ws.workspace_id = $1 AND NOT w.deleted",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "git_sync",
+        "type_info": "Jsonb"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      true
+    ]
+  },
+  "hash": "c92c08a4b4c06d087c2590081db78f7253e4470287810d7ee13b8519f54b997f"
+}
diff --git a/backend/.sqlx/query-ea1895df5a6afa5af59c3771291c85a1166294ea655e934baf5e3e1daa0fac1a.json b/backend/.sqlx/query-ea1895df5a6afa5af59c3771291c85a1166294ea655e934baf5e3e1daa0fac1a.json
new file mode 100644
index 0000000000..206614b73e
--- /dev/null
+++ b/backend/.sqlx/query-ea1895df5a6afa5af59c3771291c85a1166294ea655e934baf5e3e1daa0fac1a.json
@@ -0,0 +1,17 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        UPDATE workspace_settings\n        SET git_sync = jsonb_set(\n            git_sync,\n            '{repositories}',\n            (SELECT jsonb_agg(\n                CASE WHEN elem->>'git_repo_resource_path' = $2\n                    THEN jsonb_set(\n                            jsonb_set(\n                                jsonb_set(elem, '{auto_pull}',\n                                          COALESCE(elem->'auto_pull', '{\"enabled\": false}'::jsonb), true),\n                                '{auto_pull,last_synced_sha}', $3, true),\n                            '{auto_pull,last_pull_status}', $4, true)\n                    ELSE elem END)\n             FROM jsonb_array_elements(git_sync->'repositories') AS elem)\n        )\n        WHERE workspace_id = $1\n        ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Jsonb",
+        "Jsonb"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "ea1895df5a6afa5af59c3771291c85a1166294ea655e934baf5e3e1daa0fac1a"
+}
diff --git a/backend/.sqlx/query-f02977ee5df3d8f734fb32836583abaf747aef7078ae57b0373f06c70b6f2f9f.json b/backend/.sqlx/query-f02977ee5df3d8f734fb32836583abaf747aef7078ae57b0373f06c70b6f2f9f.json
new file mode 100644
index 0000000000..f449de1836
--- /dev/null
+++ b/backend/.sqlx/query-f02977ee5df3d8f734fb32836583abaf747aef7078ae57b0373f06c70b6f2f9f.json
@@ -0,0 +1,82 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT\n            args->'__git_sync_open_pr' as \"marker\",\n            args->>'repo_url_resource_path' as \"repo_path\",\n            args->>'parent_workspace_id' as \"parent_workspace_id\",\n            args->>'dev_workspace_label' as \"dev_workspace_label\",\n            args->>'parent_dev_workspace_label' as \"parent_dev_workspace_label\",\n            COALESCE((args->'use_individual_branch')::bool, false) as \"use_individual_branch!\",\n            COALESCE((args->'group_by_folder')::bool, false) as \"group_by_folder!\",\n            COALESCE(args->'items'->0->>'path', args->>'path', '') as \"item_path!\",\n            COALESCE(args->'items'->0->>'parent_path', args->>'parent_path', '') as \"item_parent_path!\",\n            COALESCE(args->'items'->0->>'path_type', args->>'path_type', '') as \"path_type!\",\n            COALESCE(args->'items'->0->>'commit_msg', args->>'commit_msg', '') as \"commit_msg!\"\n        FROM v2_job WHERE id = $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "marker",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 1,
+        "name": "repo_path",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 2,
+        "name": "parent_workspace_id",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 3,
+        "name": "dev_workspace_label",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 4,
+        "name": "parent_dev_workspace_label",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 5,
+        "name": "use_individual_branch!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 6,
+        "name": "group_by_folder!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 7,
+        "name": "item_path!",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 8,
+        "name": "item_parent_path!",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 9,
+        "name": "path_type!",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 10,
+        "name": "commit_msg!",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid"
+      ]
+    },
+    "nullable": [
+      null,
+      null,
+      null,
+      null,
+      null,
+      null,
+      null,
+      null,
+      null,
+      null,
+      null
+    ]
+  },
+  "hash": "f02977ee5df3d8f734fb32836583abaf747aef7078ae57b0373f06c70b6f2f9f"
+}
diff --git a/backend/.sqlx/query-fc4583d1570f3a2a428bb28390ca72e61719fae68aa4b42730f9076f3bd97441.json b/backend/.sqlx/query-fc4583d1570f3a2a428bb28390ca72e61719fae68aa4b42730f9076f3bd97441.json
index 484dd23e2a..eb320264bc 100644
--- a/backend/.sqlx/query-fc4583d1570f3a2a428bb28390ca72e61719fae68aa4b42730f9076f3bd97441.json
+++ b/backend/.sqlx/query-fc4583d1570f3a2a428bb28390ca72e61719fae68aa4b42730f9076f3bd97441.json
@@ -21,7 +21,7 @@
       ]
     },
     "nullable": [
-      null,
+      true,
       null
     ]
   },
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index cd6af43c36..f8c671d63e 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -13935,6 +13935,7 @@ dependencies = [
  "windmill-parser-ts",
  "windmill-queue",
  "windmill-runtime-nativets",
+ "windmill-store",
  "windmill-test-utils",
  "windmill-trigger",
  "windmill-trigger-azure",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 9551690cf0..6d3451afb7 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -250,6 +250,7 @@ windmill-queue.workspace = true
 windmill-common = { workspace = true, default-features = false }
 windmill-object-store.workspace = true
 windmill-git-sync.workspace = true
+windmill-store.workspace = true
 windmill-api = { workspace = true, default-features = false }
 windmill-api-agent-workers = { workspace = true, optional = true }
 windmill-api-scripts.workspace = true
diff --git a/backend/src/monitor.rs b/backend/src/monitor.rs
index 714ebcda8d..14acebd13b 100644
--- a/backend/src/monitor.rs
+++ b/backend/src/monitor.rs
@@ -3282,6 +3282,17 @@ pub async fn monitor_db(
         }
     };
 
+    // Poll git-sync repositories for new commits and pull them into the
+    // workspace (repo → Windmill auto-pull). Runs every 2 iterations.
+    let git_auto_pull_f = async {
+        #[cfg(feature = "private")]
+        if server_mode && iteration.is_some() && iteration.as_ref().unwrap().should_run(2) {
+            if let Some(db) = conn.as_sql() {
+                poll_git_auto_pull(db).await;
+            }
+        }
+    };
+
     // run every 2 iterations (~20s at the default LISTEN_NEW_EVENTS_INTERVAL_SEC).
     // Enterprise feature: the active `// freshness` backstop lives in
     // windmill-queue's `freshness_watchdog` (`private`); OSS gets a no-op stub.
@@ -3332,10 +3343,319 @@ pub async fn monitor_db(
         manage_audit_partitions_f,
         export_audit_logs_to_object_store_f,
         cleanup_scheduled_job_deletions_f,
+        git_auto_pull_f,
         pipeline_freshness_watchdog_f,
     );
 }
 
+/// Advisory lock id ensuring only one server replica runs the git auto-pull
+/// poll at a time (adjacent to RESTART_LOCK_ID used for restart coordination).
+#[cfg(feature = "private")]
+const GIT_AUTO_PULL_LOCK_ID: i64 = 737_483_921;
+
+/// Poll every git-sync repository with auto-pull enabled and enqueue a pull when
+/// the tracked branch has new commits (repo → Windmill direction).
+///
+/// Runs on a single replica at a time (advisory lock) and only on
+/// Enterprise-licensed instances. Detection is `git ls-remote`; GitHub-App
+/// repositories are skipped here and sync via webhooks instead (phase 2).
+#[cfg(feature = "private")]
+pub async fn poll_git_auto_pull(db: &Pool<Postgres>) {
+    use windmill_common::ee_oss::{get_license_plan, LicensePlan};
+
+    if !matches!(get_license_plan().await, LicensePlan::Enterprise) {
+        return;
+    }
+
+    let mut lock_conn = match db.acquire().await {
+        Ok(c) => c,
+        Err(e) => {
+            tracing::error!("git auto-pull: failed to acquire connection: {e:#}");
+            return;
+        }
+    };
+    let locked: bool = match sqlx::query_scalar("SELECT pg_try_advisory_lock($1)")
+        .bind(GIT_AUTO_PULL_LOCK_ID)
+        .fetch_one(&mut *lock_conn)
+        .await
+    {
+        Ok(v) => v,
+        Err(e) => {
+            tracing::error!("git auto-pull: advisory lock failed: {e:#}");
+            return;
+        }
+    };
+    if !locked {
+        // Another replica is already polling this tick.
+        return;
+    }
+
+    if let Err(e) = poll_git_auto_pull_inner(db).await {
+        tracing::error!("git auto-pull: poll error: {e:#}");
+    }
+
+    if let Err(e) = sqlx::query("SELECT pg_advisory_unlock($1)")
+        .bind(GIT_AUTO_PULL_LOCK_ID)
+        .execute(&mut *lock_conn)
+        .await
+    {
+        tracing::error!("git auto-pull: advisory unlock failed: {e:#}");
+    }
+}
+
+#[cfg(feature = "private")]
+lazy_static::lazy_static! {
+    /// Last auto-pull poll time (unix secs) per `workspace|repo_path`, so each repo
+    /// is only probed once per its effective interval instead of every ~60s tick.
+    /// Bounded by the number of auto-pull repos; stale entries for removed repos are
+    /// harmless.
+    static ref AUTO_PULL_LAST_POLL: std::sync::Mutex<std::collections::HashMap<String, i64>> =
+        std::sync::Mutex::new(std::collections::HashMap::new());
+}
+
+/// Slack (seconds) subtracted from the effective interval so a repo whose interval
+/// equals the ~60s tick isn't skipped by tick jitter.
+#[cfg(feature = "private")]
+const AUTO_PULL_POLL_SLACK_S: i64 = 30;
+
+#[cfg(feature = "private")]
+async fn poll_git_auto_pull_inner(db: &Pool<Postgres>) -> error::Result<()> {
+    use windmill_common::workspaces::{AutoPullMode, WorkspaceGitSyncSettings};
+
+    // Join `workspace` and skip deleted/archived ones: their `workspace_settings`
+    // rows persist (archive is a soft delete, and change_workspace_id leaves the old
+    // id as an archived shell), so an auto-pull repo would otherwise keep polling and
+    // deploying into a dead workspace.
+    let rows = sqlx::query!(
+        r#"SELECT ws.workspace_id, ws.git_sync
+           FROM workspace_settings ws
+           JOIN workspace w ON w.id = ws.workspace_id
+           WHERE NOT w.deleted
+             AND ws.git_sync IS NOT NULL
+             AND ws.git_sync->'repositories' @> '[{"auto_pull": {"enabled": true}}]'::jsonb"#
+    )
+    .fetch_all(db)
+    .await?;
+
+    for row in rows {
+        let Some(git_sync) = row.git_sync else {
+            continue;
+        };
+        let settings: WorkspaceGitSyncSettings = match serde_json::from_value(git_sync) {
+            Ok(s) => s,
+            Err(e) => {
+                tracing::warn!(
+                    "git auto-pull: invalid git_sync settings for workspace {}: {e}",
+                    row.workspace_id
+                );
+                continue;
+            }
+        };
+
+        for repo in &settings.repositories {
+            let Some(auto_pull) = &repo.auto_pull else {
+                continue;
+            };
+            if !auto_pull.enabled || auto_pull.mode == AutoPullMode::Webhook {
+                continue;
+            }
+
+            // Honor the repo's effective poll interval (relaxed to ~10 min when a
+            // webhook is live) instead of probing every ~60s tick.
+            let interval_s = auto_pull.effective_poll_interval_s() as i64;
+            let poll_key = format!("{}|{}", row.workspace_id, repo.git_repo_resource_path);
+            let now = chrono::Utc::now().timestamp();
+            {
+                let mut last = AUTO_PULL_LAST_POLL.lock().unwrap();
+                if let Some(&t) = last.get(&poll_key) {
+                    if now - t < interval_s - AUTO_PULL_POLL_SLACK_S {
+                        continue;
+                    }
+                }
+                last.insert(poll_key, now);
+            }
+
+            let head = match windmill_store::resources::get_git_repo_head_for_autopull(
+                db,
+                &row.workspace_id,
+                &repo.git_repo_resource_path,
+            )
+            .await
+            {
+                Ok(Some(h)) => Ok(Some(h)),
+                // App-backed repos store a tokenless URL, so the ls-remote head
+                // check can't authenticate and returns None. Poll the head over
+                // the GitHub API with a minted installation token instead. This
+                // is the polling fallback/safety-net for auto- and polling-mode
+                // app repos whose webhook isn't live (unreachable instance,
+                // missing permission, or a dropped delivery). `webhook`-mode
+                // repos are skipped above and stay webhook-only.
+                Ok(None) => {
+                    #[cfg(feature = "enterprise")]
+                    {
+                        windmill_common::git_sync_ee::get_app_repo_head_for_autopull(
+                            db,
+                            &row.workspace_id,
+                            &repo.git_repo_resource_path,
+                        )
+                        .await
+                    }
+                    #[cfg(not(feature = "enterprise"))]
+                    {
+                        Ok(None)
+                    }
+                }
+                Err(e) => Err(e),
+            };
+
+            match head {
+                Ok(Some((git_ref, sha))) => {
+                    // Shared reconcile (also used by the webhook receiver):
+                    // checks should_pull, enqueues, and records status/failure.
+                    if let Err(e) = windmill_git_sync::reconcile_and_enqueue_pull(
+                        db,
+                        &row.workspace_id,
+                        repo,
+                        &git_ref,
+                        &sha,
+                        None,
+                    )
+                    .await
+                    {
+                        tracing::warn!(
+                            "git auto-pull: reconcile failed for {}/{}: {e:#}",
+                            row.workspace_id,
+                            repo.git_repo_resource_path
+                        );
+                    }
+
+                    // Parent-managed fork sync: list the fork branches' heads in
+                    // the same poll tick (one extra ls-remote / API call) and
+                    // route each into its fork workspace. Needs the concrete
+                    // tracked branch name to scope `wm-fork/<branch>/*`; a
+                    // branch-less resource resolves its default branch via
+                    // `ls-remote --symref`, so "HEAD" only remains when that
+                    // resolution failed.
+                    if auto_pull.sync_forks && git_ref != "HEAD" {
+                        poll_git_fork_branches(
+                            db,
+                            &row.workspace_id,
+                            &repo.git_repo_resource_path,
+                            &git_ref,
+                        )
+                        .await;
+                    }
+                }
+                Ok(None) => {}
+                Err(e) => {
+                    windmill_git_sync::record_auto_pull_failure(
+                        db,
+                        &row.workspace_id,
+                        &repo.git_repo_resource_path,
+                        &auto_pull.last_synced_sha,
+                        format!("head check failed: {e}"),
+                    )
+                    .await;
+                }
+            }
+        }
+    }
+
+    Ok(())
+}
+
+/// Poll-side half of parent-managed fork sync (`sync_forks`): list every
+/// `wm-fork/<base_branch>/*` head of the parent's repo and reconcile each into
+/// its fork workspace. Failures are logged, not recorded in the parent's pull
+/// status — the parent's own sync state is unaffected by a fork's.
+#[cfg(feature = "private")]
+async fn poll_git_fork_branches(
+    db: &Pool<Postgres>,
+    parent_w_id: &str,
+    repo_path: &str,
+    base_branch: &str,
+) {
+    // Dev-workspace children sync with their environment-label branch (`dev`/
+    // `staging`) rather than the `wm-fork/**` pattern, so their branches must be
+    // listed explicitly. A label equal to the tracked branch is excluded — the
+    // parent's own head check covers it.
+    let label_refs: Vec<String> = match sqlx::query_scalar!(
+        r#"SELECT DISTINCT COALESCE(dev_workspace_label, 'dev') as "label!"
+           FROM workspace
+           WHERE parent_workspace_id = $1 AND is_dev_workspace AND NOT deleted"#,
+        parent_w_id
+    )
+    .fetch_all(db)
+    .await
+    {
+        Ok(labels) => labels.into_iter().filter(|l| l != base_branch).collect(),
+        Err(e) => {
+            tracing::warn!(
+                "git fork sync: failed to list dev-workspace labels for {parent_w_id}: {e:#}"
+            );
+            Vec::new()
+        }
+    };
+
+    let fork_heads = match windmill_store::resources::get_git_repo_fork_heads_for_autopull(
+        db,
+        parent_w_id,
+        repo_path,
+        base_branch,
+        &label_refs,
+    )
+    .await
+    {
+        Ok(Some(heads)) => Ok(heads),
+        // App-backed repos list fork refs over the GitHub API, mirroring the
+        // parent head check's fallback.
+        Ok(None) => {
+            #[cfg(feature = "enterprise")]
+            {
+                windmill_common::git_sync_ee::get_app_repo_fork_heads_for_autopull(
+                    db,
+                    parent_w_id,
+                    repo_path,
+                    base_branch,
+                    &label_refs,
+                )
+                .await
+                .map(|heads| heads.unwrap_or_default())
+            }
+            #[cfg(not(feature = "enterprise"))]
+            {
+                Ok(Vec::new())
+            }
+        }
+        Err(e) => Err(e),
+    };
+    match fork_heads {
+        Ok(heads) => {
+            for (branch, sha) in heads {
+                if let Err(e) = windmill_git_sync::reconcile_fork_branch_pull(
+                    db,
+                    parent_w_id,
+                    repo_path,
+                    &branch,
+                    base_branch,
+                    &sha,
+                )
+                .await
+                {
+                    tracing::warn!(
+                        "git fork sync: reconcile failed for {parent_w_id}/{repo_path} branch {branch}: {e:#}"
+                    );
+                }
+            }
+        }
+        Err(e) => {
+            tracing::warn!(
+                "git fork sync: fork branch listing failed for {parent_w_id}/{repo_path}: {e:#}"
+            );
+        }
+    }
+}
+
 async fn vacuuming_tables(db: &Pool<Postgres>) -> error::Result<()> {
     sqlx::query!("VACUUM v2_job, v2_job_completed, job_result_stream_v2, job_stats, job_logs, job_perms, concurrency_key, log_file, metrics")
         .execute(db)
diff --git a/backend/windmill-api-workspaces/src/workspaces.rs b/backend/windmill-api-workspaces/src/workspaces.rs
index ba359cbffb..8aa1ff680c 100644
--- a/backend/windmill-api-workspaces/src/workspaces.rs
+++ b/backend/windmill-api-workspaces/src/workspaces.rs
@@ -158,7 +158,6 @@ pub fn workspaced_service() -> Router {
         .route("/create_fork", post(create_workspace_fork))
         .route("/attach_dev_workspace", post(attach_dev_workspace))
         .route("/detach_dev_workspace", post(detach_dev_workspace))
-        .route("/set_dev_workspace_label", post(set_dev_workspace_label))
         .route("/get_dev_workspace", get(get_dev_workspace))
         .route("/change_workspace_name", post(change_workspace_name))
         .route("/change_workspace_color", post(change_workspace_color))
@@ -747,6 +746,178 @@ async fn list_workspaces(
     Ok(Json(workspaces))
 }
 
+/// Strip the server-only webhook HMAC secret from a `git_sync` blob before it is
+/// returned to a client. The UI never needs it; it stays (encrypted) in the DB.
+fn redact_git_sync_webhook_secrets(git_sync: &mut serde_json::Value) {
+    if let Some(repos) = git_sync
+        .get_mut("repositories")
+        .and_then(|r| r.as_array_mut())
+    {
+        for repo in repos {
+            if let Some(auto_pull) = repo.get_mut("auto_pull").and_then(|a| a.as_object_mut()) {
+                auto_pull.remove("webhook_secret");
+            }
+        }
+    }
+}
+
+/// Zero the server-owned auto-pull fields (webhook id/secret/error, synced sha,
+/// last pull status) on a client-supplied `AutoPullSettings`. The client only
+/// controls `enabled` / `mode` / `poll_interval_s`; the rest is written by the
+/// server (webhook creation, poller) and must never be trusted from the request —
+/// otherwise a caller could inject a webhook id/secret or fake sync state.
+fn clear_client_supplied_auto_pull_state(
+    auto_pull: &mut windmill_common::workspaces::AutoPullSettings,
+) {
+    auto_pull.webhook_id = None;
+    auto_pull.webhook_secret = None;
+    auto_pull.webhook_error = None;
+    auto_pull.last_synced_sha = std::collections::HashMap::new();
+    auto_pull.last_pull_status = None;
+}
+
+/// A dev workspace deploys to a branch named after its environment label. If a
+/// git-sync repository's tracked branch carries that same name, dev deploys
+/// would write straight into the branch the workspace (or its prod) syncs
+/// from — the CLI refuses that push, so every deploy job would fail. Reject
+/// the label up front instead.
+async fn reject_dev_label_matching_tracked_branch(
+    db: &DB,
+    label: Option<&str>,
+    workspace_ids: &[&str],
+) -> Result<()> {
+    let label_branch = windmill_common::workspaces::dev_workspace_branch(label);
+    for w_id in workspace_ids {
+        let Some(settings) = sqlx::query_scalar!(
+            "SELECT git_sync FROM workspace_settings WHERE workspace_id = $1",
+            w_id
+        )
+        .fetch_optional(db)
+        .await?
+        .flatten()
+        .and_then(|v| serde_json::from_value::<WorkspaceGitSyncSettings>(v).ok()) else {
+            continue;
+        };
+        for repo in &settings.repositories {
+            let path = repo.git_repo_resource_path.trim_start_matches("$res:");
+            let branch: Option<String> = sqlx::query_scalar!(
+                "SELECT value->>'branch' FROM resource WHERE workspace_id = $1 AND path = $2",
+                w_id,
+                path
+            )
+            .fetch_optional(db)
+            .await?
+            .flatten();
+            if branch.as_deref() == Some(label_branch.as_str()) {
+                return Err(Error::BadRequest(format!(
+                    "The environment label '{label_branch}' matches the tracked branch of git-sync \
+                     repository '{path}' in workspace '{w_id}': deploys from the dev workspace go \
+                     to the '{label_branch}' branch and would overwrite the branch that repository \
+                     syncs from. Use the other label or change the repository's tracked branch."
+                )));
+            }
+        }
+    }
+    Ok(())
+}
+
+/// Reject parent-only git-sync settings on a fork workspace. Auto-pull, fork
+/// PRs, and promotion mode are all configured at the parent: repo → fork sync is
+/// routed by the parent's webhook/poller (`sync_forks`), a fork-owned auto-pull
+/// would register a second webhook on the same GitHub repo per fork, and a
+/// fork's deploys always go to its `wm-fork/**` branch so a promotion repo could
+/// never take effect there.
+async fn reject_parent_only_git_sync_settings_on_fork<'a>(
+    db: &DB,
+    w_id: &str,
+    mut repos: impl Iterator<Item = &'a windmill_common::workspaces::GitRepositorySettings>,
+) -> Result<()> {
+    let offending = repos.find_map(|r| {
+        if r.auto_pull.as_ref().is_some_and(|a| a.enabled) {
+            Some("Auto-pull")
+        } else if r.use_individual_branch.unwrap_or(false) {
+            Some("Promotion mode")
+        } else if r.fork_open_prs {
+            Some("Opening PRs for fork deploys")
+        } else {
+            None
+        }
+    });
+    let Some(offending) = offending else {
+        return Ok(());
+    };
+    let parent = sqlx::query_scalar!(
+        "SELECT parent_workspace_id FROM workspace WHERE id = $1",
+        w_id
+    )
+    .fetch_optional(db)
+    .await?
+    .flatten();
+    if parent.is_some() || w_id.starts_with(windmill_common::workspaces::WM_FORK_PREFIX) {
+        return Err(Error::BadRequest(format!(
+            "{offending} cannot be configured on a fork workspace: it is managed from the parent workspace's git sync settings"
+        )));
+    }
+    Ok(())
+}
+
+/// Persist only the reconciled webhook fields (id/secret/error/mode) for `changed`
+/// repos, one targeted JSONB update per repo (same pattern as the EE auto-pull
+/// status writer). The webhook reconcile runs after the main save has committed,
+/// so a read-modify-write of the whole blob would clobber a poller status write
+/// or another settings save landing in the gap. `mode` is carried too: the
+/// reconcile normalizes webhook -> polling for repos that can't register hooks,
+/// and losing that would leave the poller skipping a webhook-mode repo that has
+/// no webhook. A repo whose `auto_pull` was concurrently removed is left alone.
+#[cfg(all(feature = "enterprise", feature = "private"))]
+async fn persist_reconciled_webhook_fields(
+    db: &DB,
+    w_id: &str,
+    changed: &[(String, windmill_common::workspaces::AutoPullSettings)],
+) -> Result<()> {
+    for (path, new_ap) in changed {
+        let mut patch = serde_json::Map::new();
+        patch.insert(
+            "mode".to_string(),
+            serde_json::to_value(&new_ap.mode).map_err(|e| Error::internal_err(e.to_string()))?,
+        );
+        if let Some(id) = new_ap.webhook_id {
+            patch.insert("webhook_id".to_string(), serde_json::json!(id));
+        }
+        if let Some(secret) = &new_ap.webhook_secret {
+            patch.insert("webhook_secret".to_string(), serde_json::json!(secret));
+        }
+        if let Some(err) = &new_ap.webhook_error {
+            patch.insert("webhook_error".to_string(), serde_json::json!(err));
+        }
+        let patch = serde_json::Value::Object(patch);
+        sqlx::query!(
+            r#"
+            UPDATE workspace_settings
+            SET git_sync = jsonb_set(
+                git_sync,
+                '{repositories}',
+                (SELECT jsonb_agg(
+                    CASE WHEN elem->>'git_repo_resource_path' = $2
+                          AND jsonb_typeof(elem->'auto_pull') = 'object'
+                        THEN jsonb_set(elem, '{auto_pull}',
+                             ((elem->'auto_pull') - 'webhook_id' - 'webhook_secret' - 'webhook_error') || $3)
+                        ELSE elem END)
+                 FROM jsonb_array_elements(git_sync->'repositories') AS elem)
+            )
+            WHERE workspace_id = $1
+              AND jsonb_typeof(git_sync->'repositories') = 'array'
+            "#,
+            w_id,
+            path,
+            patch,
+        )
+        .execute(db)
+        .await?;
+    }
+    Ok(())
+}
+
 async fn get_settings(
     authed: ApiAuthed,
     Path(w_id): Path<String>,
@@ -803,9 +974,13 @@ async fn get_settings(
     .await
     .map_err(|e| Error::internal_err(format!("getting settings: {e:#}")))?;
 
-    let settings = not_found_if_none(settings, "workspace settings", &w_id)?;
+    let mut settings = not_found_if_none(settings, "workspace settings", &w_id)?;
     tx.commit().await?;
 
+    if let Some(git_sync) = settings.git_sync.as_mut() {
+        redact_git_sync_webhook_secrets(git_sync);
+    }
+
     Ok(Json(settings))
 }
 
@@ -2662,6 +2837,40 @@ fn cleanup_legacy_git_sync_settings_in_memory(
 #[cfg(not(feature = "enterprise"))]
 const CE_GIT_SYNC_MAX_USERS: i64 = 2;
 
+/// Auto-pull is licensed per plan, not just per build: the poller only serves
+/// Enterprise plans at runtime, so the save path must reject the setting too —
+/// otherwise an EE binary without the plan could still register a webhook and
+/// receive webhook-driven pulls.
+#[cfg(feature = "enterprise")]
+async fn check_git_sync_ee_license(feature: &str) -> Result<()> {
+    if !matches!(
+        windmill_common::ee_oss::get_license_plan().await,
+        windmill_common::ee_oss::LicensePlan::Enterprise
+    ) {
+        return Err(Error::BadRequest(format!(
+            "{feature} requires an Enterprise license"
+        )));
+    }
+    Ok(())
+}
+
+#[cfg(feature = "enterprise")]
+async fn check_auto_pull_license() -> Result<()> {
+    check_git_sync_ee_license("Automatic pull from git").await
+}
+
+/// In-app PR creation (promotion/fork deploy branches) drives GitHub API calls
+/// from the deploy completion hook; runtime-gate it like auto-pull.
+#[cfg(feature = "enterprise")]
+async fn check_open_prs_license<'a>(
+    mut repos: impl Iterator<Item = &'a windmill_common::workspaces::GitRepositorySettings>,
+) -> Result<()> {
+    if repos.any(|r| r.promotion_open_prs || r.fork_open_prs) {
+        check_git_sync_ee_license("Opening pull requests from Windmill").await?;
+    }
+    Ok(())
+}
+
 #[cfg(feature = "enterprise")]
 async fn check_git_sync_access(_db: &DB, _w_id: &str) -> Result<()> {
     Ok(())
@@ -2762,11 +2971,113 @@ async fn edit_git_sync_config(
     )
     .await?;
 
+    // The whole-config save only writes the DB below; the managed GitHub webhooks
+    // are reconciled after the commit is durable (like the per-repository endpoint):
+    // `post_commit` carries the saved repos to reconcile + the hooks of repos this
+    // save removed, to delete.
+    #[cfg(all(feature = "enterprise", feature = "private"))]
+    let post_commit: Option<(WorkspaceGitSyncSettings, Vec<(String, i64)>)>;
+
     if let Some(mut git_sync_settings) = new_config.git_sync_settings {
+        // Client-supplied server-owned auto-pull state is never trusted: strip it up
+        // front, then existing repos re-derive it from `existing` below and new repos
+        // stay clean.
+        for repo in git_sync_settings.repositories.iter_mut() {
+            if let Some(ap) = repo.auto_pull.as_mut() {
+                clear_client_supplied_auto_pull_state(ap);
+            }
+            repo.open_pr_error = None;
+        }
+        reject_parent_only_git_sync_settings_on_fork(
+            &db,
+            &w_id,
+            git_sync_settings.repositories.iter(),
+        )
+        .await?;
+        // Auto-pull is EE-only (see edit_git_sync_repository).
+        #[cfg(not(feature = "enterprise"))]
+        if git_sync_settings
+            .repositories
+            .iter()
+            .any(|r| r.auto_pull.as_ref().is_some_and(|a| a.enabled))
+        {
+            return Err(Error::BadRequest(
+                "Automatic pull from git is an Enterprise Edition feature".to_string(),
+            ));
+        }
+        #[cfg(feature = "enterprise")]
+        if git_sync_settings
+            .repositories
+            .iter()
+            .any(|r| r.auto_pull.as_ref().is_some_and(|a| a.enabled))
+        {
+            check_auto_pull_license().await?;
+        }
+        #[cfg(feature = "enterprise")]
+        check_open_prs_license(git_sync_settings.repositories.iter()).await?;
+        // Preserve server-owned auto-pull state (webhook id/secret, synced sha, last
+        // status) that the redacted GET response omits — otherwise a whole-config
+        // save from the UI would drop the webhook secret (breaking delivery) or
+        // clobber what the poller/webhook layer wrote.
+        let existing: Option<WorkspaceGitSyncSettings> = sqlx::query_scalar!(
+            "SELECT git_sync FROM workspace_settings WHERE workspace_id = $1",
+            &w_id
+        )
+        .fetch_optional(&mut *tx)
+        .await?
+        .flatten()
+        .and_then(|v| serde_json::from_value(v).ok());
+        // Repos present before but absent from this save: their webhooks won't be
+        // reconciled below (no longer listed), so capture them for deletion.
+        #[cfg(all(feature = "enterprise", feature = "private"))]
+        let removed_webhooks: Vec<(String, i64)> = existing
+            .as_ref()
+            .map(|e| {
+                e.repositories
+                    .iter()
+                    .filter_map(|old| {
+                        let hook = old.auto_pull.as_ref().and_then(|a| a.webhook_id)?;
+                        // The save carries the hook forward (reconciled below) only
+                        // when the repo is still present AND still has auto_pull — the
+                        // preservation loop copies webhook fields only onto a Some
+                        // auto_pull. Otherwise (repo dropped, or auto_pull cleared) the
+                        // hook would orphan, so delete it.
+                        let carried = git_sync_settings
+                            .repositories
+                            .iter()
+                            .find(|n| n.git_repo_resource_path == old.git_repo_resource_path)
+                            .map(|n| n.auto_pull.is_some())
+                            .unwrap_or(false);
+                        (!carried).then_some((old.git_repo_resource_path.clone(), hook))
+                    })
+                    .collect()
+            })
+            .unwrap_or_default();
+        if let Some(existing) = &existing {
+            for repo in git_sync_settings.repositories.iter_mut() {
+                let Some(old) = existing
+                    .repositories
+                    .iter()
+                    .find(|r| r.git_repo_resource_path == repo.git_repo_resource_path)
+                else {
+                    continue;
+                };
+                repo.open_pr_error = old.open_pr_error.clone();
+                if let (Some(new_ap), Some(old_ap)) =
+                    (repo.auto_pull.as_mut(), old.auto_pull.as_ref())
+                {
+                    new_ap.webhook_id = old_ap.webhook_id;
+                    new_ap.webhook_secret = old_ap.webhook_secret.clone();
+                    new_ap.last_synced_sha = old_ap.last_synced_sha.clone();
+                    new_ap.last_pull_status = old_ap.last_pull_status.clone();
+                }
+            }
+        }
+
         // Clean up legacy workspace-level settings if all repos are migrated
         cleanup_legacy_git_sync_settings_in_memory(&mut git_sync_settings, &w_id);
 
-        let serialized_config = serde_json::to_value::<WorkspaceGitSyncSettings>(git_sync_settings)
+        let serialized_config = serde_json::to_value(&git_sync_settings)
             .map_err(|err| Error::internal_err(err.to_string()))?;
 
         sqlx::query!(
@@ -2776,7 +3087,37 @@ async fn edit_git_sync_config(
         )
         .execute(&mut *tx)
         .await?;
+        #[cfg(all(feature = "enterprise", feature = "private"))]
+        {
+            post_commit = Some((git_sync_settings, removed_webhooks));
+        }
     } else {
+        // Clearing the whole config removes every repo — delete all their webhooks.
+        #[cfg(all(feature = "enterprise", feature = "private"))]
+        {
+            let existing: Option<WorkspaceGitSyncSettings> = sqlx::query_scalar!(
+                "SELECT git_sync FROM workspace_settings WHERE workspace_id = $1",
+                &w_id
+            )
+            .fetch_optional(&mut *tx)
+            .await?
+            .flatten()
+            .and_then(|v| serde_json::from_value(v).ok());
+            let removed_webhooks: Vec<(String, i64)> = existing
+                .map(|e| {
+                    e.repositories
+                        .iter()
+                        .filter_map(|old| {
+                            old.auto_pull
+                                .as_ref()
+                                .and_then(|a| a.webhook_id)
+                                .map(|h| (old.git_repo_resource_path.clone(), h))
+                        })
+                        .collect()
+                })
+                .unwrap_or_default();
+            post_commit = Some((WorkspaceGitSyncSettings::default(), removed_webhooks));
+        }
         sqlx::query!(
             "UPDATE workspace_settings SET git_sync = NULL WHERE workspace_id = $1",
             &w_id,
@@ -2787,6 +3128,37 @@ async fn edit_git_sync_config(
 
     tx.commit().await?;
 
+    // Post-commit: reconcile each saved repo's managed webhook to match the config
+    // and delete the webhooks of repos this save removed. Best-effort — a failure
+    // leaves polling on.
+    #[cfg(all(feature = "enterprise", feature = "private"))]
+    if let Some((mut settings, removed_webhooks)) = post_commit {
+        let mut changed: Vec<(String, windmill_common::workspaces::AutoPullSettings)> = Vec::new();
+        for repo in settings.repositories.iter_mut() {
+            let before = serde_json::to_value(&repo.auto_pull).ok();
+            if let Err(e) = windmill_common::git_sync_ee::sync_repo_webhook(&db, &w_id, repo).await
+            {
+                tracing::warn!("git auto-pull: webhook sync error: {}", e);
+            }
+            if serde_json::to_value(&repo.auto_pull).ok() != before {
+                if let Some(ap) = repo.auto_pull.as_ref() {
+                    changed.push((repo.git_repo_resource_path.clone(), ap.clone()));
+                }
+            }
+        }
+        if let Err(e) = persist_reconciled_webhook_fields(&db, &w_id, &changed).await {
+            tracing::warn!("git auto-pull: webhook field persist error: {}", e);
+        }
+        for (path, hook_id) in removed_webhooks {
+            if let Ok(url) = windmill_common::git_sync_ee::resolve_repo_url(&db, &w_id, &path).await
+            {
+                let _ =
+                    windmill_common::git_sync_ee::delete_repo_webhook(&db, &w_id, &url, hook_id)
+                        .await;
+            }
+        }
+    }
+
     // Trigger git sync for git sync settings changes
     handle_deployment_metadata(
         &authed.email,
@@ -2808,7 +3180,7 @@ async fn edit_git_sync_repository(
     Extension(db): Extension<DB>,
     Path(w_id): Path<String>,
     ApiAuthed { is_admin, username, .. }: ApiAuthed,
-    Json(new_config): Json<EditGitSyncRepository>,
+    Json(mut new_config): Json<EditGitSyncRepository>,
 ) -> Result<String> {
     require_admin(is_admin, &username)?;
     check_git_sync_access(&db, &w_id).await?;
@@ -2816,6 +3188,46 @@ async fn edit_git_sync_repository(
     // Validate the resource path format
     validate_git_repo_resource_path(&new_config.git_repo_resource_path)?;
 
+    // Server-owned auto-pull state (webhook id/secret + sync status) is never
+    // accepted from the client — the webhook layer and poller own it. Strip it so an
+    // existing repo re-derives it from the DB (carried over below) and a new one
+    // starts clean.
+    if let Some(ap) = new_config.repository.auto_pull.as_mut() {
+        clear_client_supplied_auto_pull_state(ap);
+    }
+    new_config.repository.open_pr_error = None;
+    reject_parent_only_git_sync_settings_on_fork(
+        &db,
+        &w_id,
+        std::iter::once(&new_config.repository),
+    )
+    .await?;
+
+    // Auto-pull is EE-only: CE builds compile neither the poller nor the webhook
+    // reconciler, so accepting the setting would silently do nothing.
+    #[cfg(not(feature = "enterprise"))]
+    if new_config
+        .repository
+        .auto_pull
+        .as_ref()
+        .is_some_and(|a| a.enabled)
+    {
+        return Err(Error::BadRequest(
+            "Automatic pull from git is an Enterprise Edition feature".to_string(),
+        ));
+    }
+    #[cfg(feature = "enterprise")]
+    if new_config
+        .repository
+        .auto_pull
+        .as_ref()
+        .is_some_and(|a| a.enabled)
+    {
+        check_auto_pull_license().await?;
+    }
+    #[cfg(feature = "enterprise")]
+    check_open_prs_license(std::iter::once(&new_config.repository)).await?;
+
     // Promotion mode: EE only
     #[cfg(not(feature = "enterprise"))]
     if new_config.repository.use_individual_branch.unwrap_or(false) {
@@ -2893,8 +3305,32 @@ async fn edit_git_sync_repository(
         .find(|repo| repo.git_repo_resource_path == new_config.git_repo_resource_path);
 
     if let Some(existing_repo) = repo_found {
-        // Update existing repository
-        *existing_repo = new_config.repository;
+        // Update existing repository, but preserve server-owned auto-pull state
+        // (synced sha, last pull status, webhook id/secret) so a settings save
+        // from the UI cannot revert what the poller/webhook layer wrote.
+        let mut updated = new_config.repository;
+        updated.open_pr_error = existing_repo.open_pr_error.clone();
+        match (updated.auto_pull.as_mut(), existing_repo.auto_pull.as_ref()) {
+            (Some(new_ap), Some(old_ap)) => {
+                new_ap.last_synced_sha = old_ap.last_synced_sha.clone();
+                new_ap.last_pull_status = old_ap.last_pull_status.clone();
+                new_ap.webhook_id = old_ap.webhook_id;
+                new_ap.webhook_secret = old_ap.webhook_secret.clone();
+            }
+            // UI omitted auto_pull (e.g. older client): keep existing config.
+            (None, Some(_)) => {
+                updated.auto_pull = existing_repo.auto_pull.clone();
+            }
+            _ => {}
+        }
+        // The request-side license gate above only saw the submitted config; the
+        // preservation can resurrect an enabled auto_pull (None arm), so re-check
+        // the effective state before it gets written and reconciled.
+        #[cfg(feature = "enterprise")]
+        if updated.auto_pull.as_ref().is_some_and(|a| a.enabled) {
+            check_auto_pull_license().await?;
+        }
+        *existing_repo = updated;
     } else {
         // Repository doesn't exist, add it as a new repository
         git_sync_settings.repositories.push(new_config.repository);
@@ -2903,8 +3339,13 @@ async fn edit_git_sync_repository(
     // Clean up legacy workspace-level settings if all repos are migrated
     cleanup_legacy_git_sync_settings_in_memory(&mut git_sync_settings, &w_id);
 
-    // Save the updated configuration
-    let serialized_config = serde_json::to_value::<WorkspaceGitSyncSettings>(git_sync_settings)
+    // Save the updated configuration first, then reconcile the GitHub webhook to
+    // match it *after* the commit is durable (phase 2). Reconciling before the
+    // commit could leave the DB pointing at a hook that no longer matches if the
+    // save then failed (e.g. a delete on disable); post-commit reconciliation
+    // cannot. The pre-edit webhook id/secret are carried over above, so the
+    // committed row stays consistent until the reconcile persists any change.
+    let serialized_config = serde_json::to_value(&git_sync_settings)
         .map_err(|err| Error::internal_err(err.to_string()))?;
 
     sqlx::query!(
@@ -2914,9 +3355,34 @@ async fn edit_git_sync_repository(
     )
     .execute(&mut *tx)
     .await?;
-
     tx.commit().await?;
 
+    // Post-commit: create/remove the webhook to match the saved config and persist
+    // the resulting hook id/secret. Best-effort — a failure leaves polling on.
+    #[cfg(all(feature = "enterprise", feature = "private"))]
+    {
+        let mut changed: Vec<(String, windmill_common::workspaces::AutoPullSettings)> = Vec::new();
+        if let Some(repo) = git_sync_settings
+            .repositories
+            .iter_mut()
+            .find(|r| r.git_repo_resource_path == new_config.git_repo_resource_path)
+        {
+            let before = serde_json::to_value(&repo.auto_pull).ok();
+            if let Err(e) = windmill_common::git_sync_ee::sync_repo_webhook(&db, &w_id, repo).await
+            {
+                tracing::warn!("git auto-pull: webhook sync error: {}", e);
+            }
+            if serde_json::to_value(&repo.auto_pull).ok() != before {
+                if let Some(ap) = repo.auto_pull.as_ref() {
+                    changed.push((repo.git_repo_resource_path.clone(), ap.clone()));
+                }
+            }
+        }
+        if let Err(e) = persist_reconciled_webhook_fields(&db, &w_id, &changed).await {
+            tracing::warn!("git auto-pull: webhook field persist error: {}", e);
+        }
+    }
+
     // Trigger git sync for individual repository update/add
     handle_deployment_metadata(
         &authed.email,
@@ -2979,6 +3445,18 @@ async fn delete_git_sync_repository(
         WorkspaceGitSyncSettings::default()
     };
 
+    // Capture the repo's managed webhook id; the hook itself is deleted only after
+    // the DB removal commits (below), so a failed save can't leave the repo pointing
+    // at a hook that no longer exists. Deletion bypasses the sync_repo_webhook
+    // lifecycle, so GitHub would otherwise keep delivering to an orphaned hook.
+    #[cfg(all(feature = "enterprise", feature = "private"))]
+    let webhook_to_delete: Option<i64> = git_sync_settings
+        .repositories
+        .iter()
+        .find(|r| r.git_repo_resource_path == request.git_repo_resource_path)
+        .and_then(|r| r.auto_pull.as_ref())
+        .and_then(|a| a.webhook_id);
+
     // Check if repository exists and remove it
     let original_count = git_sync_settings.repositories.len();
     git_sync_settings
@@ -3021,6 +3499,21 @@ async fn delete_git_sync_repository(
 
     tx.commit().await?;
 
+    // Removal is durable now — best-effort delete the GitHub webhook.
+    #[cfg(all(feature = "enterprise", feature = "private"))]
+    if let Some(hook_id) = webhook_to_delete {
+        if let Ok(url) = windmill_common::git_sync_ee::resolve_repo_url(
+            &db,
+            &w_id,
+            &request.git_repo_resource_path,
+        )
+        .await
+        {
+            let _ =
+                windmill_common::git_sync_ee::delete_repo_webhook(&db, &w_id, &url, hook_id).await;
+        }
+    }
+
     // Trigger git sync for repository deletion
     handle_deployment_metadata(
         &authed.email,
@@ -4540,6 +5033,18 @@ async fn update_workspace_settings(
         .into_iter()
         .filter(|r| !r.use_individual_branch.unwrap_or(false))
         .take(1)
+        .map(|mut r| {
+            // Auto-pull and fork PRs are parent-owned and must not be inherited:
+            // the fork would otherwise carry the parent's webhook id (turning off
+            // auto-pull on the fork would delete the parent's webhook). A fork
+            // still inherits the push-direction config and the installation.
+            // Repo → fork sync is driven by the parent's webhook/poller
+            // (`sync_forks`), which routes the fork's `wm-fork/**` branch into it.
+            r.auto_pull = None;
+            r.fork_open_prs = false;
+            r.open_pr_error = None;
+            r
+        })
         .collect();
 
     let serialized_config = serde_json::to_value::<WorkspaceGitSyncSettings>(git_sync_settings)
@@ -5351,7 +5856,8 @@ async fn create_workspace_fork_branch(
     if nw.is_dev_workspace {
         validate_dev_workspace_id(&nw.id)?;
         // Reject a bad cosmetic label before any git branch is created (acted on in create_workspace_fork).
-        normalize_dev_workspace_label(nw.dev_workspace_label.clone())?;
+        let label = normalize_dev_workspace_label(nw.dev_workspace_label.clone())?;
+        reject_dev_label_matching_tracked_branch(&db, label.as_deref(), &[&w_id]).await?;
         ensure_dev_parent_is_root(&db, &w_id).await?;
         // Reject before creating any git branch if the parent already has a dev workspace,
         // otherwise the deferred branch-creation job leaves a dangling branch on the synced repos.
@@ -5673,7 +6179,10 @@ async fn create_workspace_fork(
     validate_workspace_name(&nw.name)?;
     // Cosmetic label only applies to dev workspaces; a non-dev fork stores NULL.
     let dev_workspace_label = if nw.is_dev_workspace {
-        normalize_dev_workspace_label(nw.dev_workspace_label.clone())?
+        let label = normalize_dev_workspace_label(nw.dev_workspace_label.clone())?;
+        reject_dev_label_matching_tracked_branch(&db, label.as_deref(), &[&parent_workspace_id])
+            .await?;
+        label
     } else {
         None
     };
@@ -5983,6 +6492,14 @@ async fn attach_dev_workspace(
     // The id is interpolated into a `wm-fork/<branch>/<id>` branch name like any fork.
     validate_dev_workspace_id(&dev_w_id)?;
     let dev_workspace_label = normalize_dev_workspace_label(req.dev_workspace_label.clone())?;
+    // The attached workspace keeps its own sync repos and prod keeps its config;
+    // the label branch must not collide with either side's tracked branch.
+    reject_dev_label_matching_tracked_branch(
+        &db,
+        dev_workspace_label.as_deref(),
+        &[&prod_w_id, &dev_w_id],
+    )
+    .await?;
 
     let dev = sqlx::query!(
         r#"SELECT parent_workspace_id, deleted FROM workspace WHERE id = $1"#,
@@ -6065,6 +6582,45 @@ async fn attach_dev_workspace(
     .execute(&mut *tx)
     .await?;
 
+    // The attached workspace is now parent-managed like any fork: its own
+    // auto-pull (and webhook), fork PRs, and promotion repos must not stay
+    // live — they'd keep pulling/pushing against its pre-attach tracked
+    // branch. Mirror the fork-creation copy: keep sync repos only, strip the
+    // parent-only fields, and delete any managed webhook after commit.
+    #[allow(unused_mut)]
+    let mut stripped_webhooks: Vec<(String, i64)> = Vec::new();
+    if let Some(git_sync) = sqlx::query_scalar!(
+        "SELECT git_sync FROM workspace_settings WHERE workspace_id = $1",
+        &dev_w_id
+    )
+    .fetch_optional(&mut *tx)
+    .await?
+    .flatten()
+    {
+        if let Ok(mut settings) = serde_json::from_value::<WorkspaceGitSyncSettings>(git_sync) {
+            settings
+                .repositories
+                .retain(|r| !r.use_individual_branch.unwrap_or(false));
+            for r in settings.repositories.iter_mut() {
+                if let Some(hook) = r.auto_pull.as_ref().and_then(|a| a.webhook_id) {
+                    stripped_webhooks.push((r.git_repo_resource_path.clone(), hook));
+                }
+                r.auto_pull = None;
+                r.fork_open_prs = false;
+                r.open_pr_error = None;
+            }
+            let serialized =
+                serde_json::to_value(&settings).map_err(|e| Error::internal_err(e.to_string()))?;
+            sqlx::query!(
+                "UPDATE workspace_settings SET git_sync = $1 WHERE workspace_id = $2",
+                serialized,
+                &dev_w_id
+            )
+            .execute(&mut *tx)
+            .await?;
+        }
+    }
+
     if req.lock_prod_deploy || req.lock_prod_forking {
         lock_prod_workspace(
             &mut tx,
@@ -6090,6 +6646,17 @@ async fn attach_dev_workspace(
     // The dev workspace's parent just changed (none -> prod); drop its cached fork->parent mapping
     // so per-workspace job tags route to the prod family immediately rather than after the TTL.
     windmill_queue::tags::invalidate_fork_parent_cache(&dev_w_id);
+    // Best-effort: the hooks captured before the strip above are unreachable now
+    // (their auto_pull is gone), so remove them from GitHub.
+    #[cfg(all(feature = "enterprise", feature = "private"))]
+    for (path, hook_id) in stripped_webhooks {
+        if let Ok(url) = windmill_common::git_sync_ee::resolve_repo_url(&db, &dev_w_id, &path).await
+        {
+            let _ =
+                windmill_common::git_sync_ee::delete_repo_webhook(&db, &dev_w_id, &url, hook_id)
+                    .await;
+        }
+    }
     // Drop the cached ancestor chains too — the workspace existed BEFORE the attach, so a
     // cached empty chain reads as "not a fork" and its ducklake jobs would write the shared
     // lake until the TTL. Descendants' chains also gained the new root.
@@ -6119,51 +6686,6 @@ async fn attach_dev_workspace(
     ))
 }
 
-#[derive(Deserialize)]
-struct SetDevWorkspaceLabel {
-    #[serde(default)]
-    dev_workspace_label: Option<String>,
-}
-
-/// Change the cosmetic display label ('dev' | 'staging') of the current workspace, which must itself
-/// be a dev workspace. Purely visual (badge text + wording); requires admin of the dev workspace.
-async fn set_dev_workspace_label(
-    authed: ApiAuthed,
-    Extension(db): Extension<DB>,
-    Path(w_id): Path<String>,
-    Json(req): Json<SetDevWorkspaceLabel>,
-) -> Result<String> {
-    require_admin(authed.is_admin, &authed.username)?;
-    let label = normalize_dev_workspace_label(req.dev_workspace_label)?;
-
-    let mut tx = db.begin().await?;
-    let updated = sqlx::query_scalar!(
-        "UPDATE workspace SET dev_workspace_label = $1 WHERE id = $2 AND is_dev_workspace RETURNING id",
-        label,
-        &w_id,
-    )
-    .fetch_optional(&mut *tx)
-    .await?;
-    if updated.is_none() {
-        return Err(Error::BadRequest(format!(
-            "Workspace '{w_id}' is not a dev workspace"
-        )));
-    }
-
-    audit_log(
-        &mut *tx,
-        &authed,
-        "workspaces.set_dev_workspace_label",
-        ActionKind::Update,
-        &w_id,
-        label.as_deref(),
-        None,
-    )
-    .await?;
-    tx.commit().await?;
-    Ok(format!("Updated dev workspace label for {w_id}"))
-}
-
 /// Reverse [`attach_dev_workspace`] / clear the dev designation: unset the dev flag and remove the
 /// prod lock. The workspace keeps its `parent_workspace_id` (it remains an ordinary fork).
 async fn detach_dev_workspace(
@@ -6194,8 +6716,14 @@ async fn detach_dev_workspace(
     }
 
     let mut tx = db.begin().await?;
+    // A wm-fork- workspace re-designated as dev returns to being a plain fork
+    // (keeps its parent); a standalone workspace that was attached returns to
+    // being standalone — with the parent kept it would still classify as a
+    // fork and deploy to wm-fork/** branches forever.
     sqlx::query!(
-        "UPDATE workspace SET is_dev_workspace = false WHERE id = $1",
+        "UPDATE workspace SET is_dev_workspace = false,
+         parent_workspace_id = CASE WHEN id LIKE 'wm-fork-%' THEN parent_workspace_id ELSE NULL END
+         WHERE id = $1",
         &dev_w_id
     )
     .execute(&mut *tx)
@@ -6222,6 +6750,20 @@ async fn detach_dev_workspace(
     tx.commit().await?;
 
     windmill_common::workspaces::invalidate_protection_rules_cache(&prod_w_id);
+    // The parent link may just have been cleared (standalone workspace that was
+    // attached): drop the caches that resolved it, mirroring attach.
+    windmill_queue::tags::invalidate_fork_parent_cache(&dev_w_id);
+    windmill_common::workspaces::invalidate_fork_ancestor_chain_cache(&dev_w_id);
+    for id in windmill_common::workspaces::list_fork_descendants(&db, &dev_w_id).await? {
+        windmill_common::workspaces::invalidate_fork_ancestor_chain_cache(&id);
+    }
+    #[cfg(feature = "cloud")]
+    {
+        windmill_common::workspaces::invalidate_billing_workspace_cache(&dev_w_id);
+        for id in windmill_common::workspaces::list_fork_descendants(&db, &dev_w_id).await? {
+            windmill_common::workspaces::invalidate_billing_workspace_cache(&id);
+        }
+    }
 
     Ok(format!(
         "Detached dev workspace {} from {}",
diff --git a/backend/windmill-api-workspaces/src/workspaces_extra.rs b/backend/windmill-api-workspaces/src/workspaces_extra.rs
index 6b4ace5f0a..7ef55be497 100644
--- a/backend/windmill-api-workspaces/src/workspaces_extra.rs
+++ b/backend/windmill-api-workspaces/src/workspaces_extra.rs
@@ -115,6 +115,53 @@ pub(crate) async fn change_workspace_id(
     .execute(&mut *tx)
     .await?;
 
+    // The managed git-sync webhooks deliver to /api/w/{old_id}/... — a URL the
+    // renamed workspace no longer answers on (the old id is archived and the
+    // receiver skips it). Strip the webhook fields from the new row so polling
+    // resumes at the normal interval and the next settings save re-registers a
+    // hook with the new URL; the stale hooks are deleted after commit.
+    #[allow(unused_mut)]
+    let mut stale_webhooks: Vec<(String, i64)> = Vec::new();
+    if let Some(git_sync) = sqlx::query_scalar!(
+        "SELECT git_sync FROM workspace_settings WHERE workspace_id = $1",
+        &rw.new_id
+    )
+    .fetch_optional(&mut *tx)
+    .await?
+    .flatten()
+    {
+        if let Ok(mut settings) = serde_json::from_value::<
+            windmill_common::workspaces::WorkspaceGitSyncSettings,
+        >(git_sync)
+        {
+            let mut changed = false;
+            for r in settings.repositories.iter_mut() {
+                if let Some(ap) = r.auto_pull.as_mut() {
+                    if let Some(hook) = ap.webhook_id {
+                        stale_webhooks.push((r.git_repo_resource_path.clone(), hook));
+                    }
+                    changed |= ap.webhook_id.is_some()
+                        || ap.webhook_secret.is_some()
+                        || ap.webhook_error.is_some();
+                    ap.webhook_id = None;
+                    ap.webhook_secret = None;
+                    ap.webhook_error = None;
+                }
+            }
+            if changed {
+                let serialized = serde_json::to_value(&settings)
+                    .map_err(|e| Error::internal_err(e.to_string()))?;
+                sqlx::query!(
+                    "UPDATE workspace_settings SET git_sync = $1 WHERE workspace_id = $2",
+                    serialized,
+                    &rw.new_id
+                )
+                .execute(&mut *tx)
+                .await?;
+            }
+        }
+    }
+
     info!("Duplicating workspace_key table");
     sqlx::query!(
         "INSERT INTO workspace_key SELECT $1, kind, key FROM workspace_key WHERE workspace_id = $2",
@@ -744,6 +791,19 @@ pub(crate) async fn change_workspace_id(
 
     tx.commit().await?;
 
+    // Best-effort: the hooks stripped above still exist on GitHub pointing at
+    // the old workspace URL; remove them (resources already live under the new id).
+    #[cfg(all(feature = "enterprise", feature = "private"))]
+    for (path, hook_id) in stale_webhooks {
+        if let Ok(url) =
+            windmill_common::git_sync_ee::resolve_repo_url(&db, &rw.new_id, &path).await
+        {
+            let _ =
+                windmill_common::git_sync_ee::delete_repo_webhook(&db, &rw.new_id, &url, hook_id)
+                    .await;
+        }
+    }
+
     // The children's parent_workspace_id changed (old root -> new root); invalidate their fork-parent
     // routing cache and their billing-workspace mapping so jobs route + meter under the renamed root
     // rather than the old (archived) one, instead of waiting for the caches' TTLs. Deeper descendants
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index a731822c54..83051377e3 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1274,32 +1274,6 @@ paths:
                   - id
                   - name
 
-  /w/{workspace}/workspaces/set_dev_workspace_label:
-    post:
-      summary: set the cosmetic display label (dev/staging) of this dev workspace
-      operationId: setDevWorkspaceLabel
-      tags:
-        - workspace
-      parameters:
-        - $ref: "#/components/parameters/WorkspaceId"
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              type: object
-              properties:
-                dev_workspace_label:
-                  type: string
-                  enum: [dev, staging]
-      responses:
-        "200":
-          description: dev workspace label updated
-          content:
-            text/plain:
-              schema:
-                type: string
-
   /workspaces/exists:
     post:
       summary: exists workspace
@@ -29933,9 +29907,71 @@ components:
           type: array
           items:
             $ref: "#/components/schemas/GitSyncObjectType"
+        auto_pull:
+          $ref: "#/components/schemas/AutoPullSettings"
+        promotion_open_prs:
+          type: boolean
+        fork_open_prs:
+          type: boolean
+        open_pr_error:
+          type: string
+          description: server-owned, last failure opening a PR for a deploy branch of this repo
       required:
         - git_repo_resource_path
 
+    AutoPullMode:
+      type: string
+      enum:
+        - auto
+        - webhook
+        - polling
+
+    AutoPullStatus:
+      type: object
+      properties:
+        synced_sha:
+          type: string
+        at:
+          type: integer
+          format: int64
+        job_id:
+          type: string
+          format: uuid
+        success:
+          type: boolean
+        error:
+          type: string
+      required:
+        - at
+        - success
+
+    AutoPullSettings:
+      type: object
+      properties:
+        enabled:
+          type: boolean
+        mode:
+          $ref: "#/components/schemas/AutoPullMode"
+        poll_interval_s:
+          type: integer
+        sync_forks:
+          type: boolean
+        webhook_id:
+          type: integer
+          format: int64
+        webhook_secret:
+          type: string
+        webhook_error:
+          type: string
+        last_synced_sha:
+          type: object
+          additionalProperties:
+            type: string
+        last_pull_status:
+          $ref: "#/components/schemas/AutoPullStatus"
+      required:
+        - enabled
+
     MetricMetadata:
       type: object
       properties:
diff --git a/backend/windmill-api/src/workspaces_export.rs b/backend/windmill-api/src/workspaces_export.rs
index 839057b4b9..5cf198c08b 100644
--- a/backend/windmill-api/src/workspaces_export.rs
+++ b/backend/windmill-api/src/workspaces_export.rs
@@ -1422,6 +1422,35 @@ pub(crate) async fn tarball_workspace(
         .await?;
 
         // Use v2 format only if explicitly requested, otherwise use v1 (legacy) for backward compatibility
+        // Server-owned auto-pull state (the HMAC webhook secret + hook id/error and
+        // the synced-sha / last-pull status) must never leave the server: keep it out
+        // of export archives and synced repos, and don't let a re-imported workspace
+        // inherit another install's hook/sync state. Mirrors the GET-settings redaction.
+        fn redact_git_sync_for_export(git_sync: Option<Value>) -> Option<Value> {
+            let mut git_sync = git_sync?;
+            if let Some(repos) = git_sync
+                .get_mut("repositories")
+                .and_then(|r| r.as_array_mut())
+            {
+                for repo in repos {
+                    if let Some(auto_pull) =
+                        repo.get_mut("auto_pull").and_then(|a| a.as_object_mut())
+                    {
+                        for field in [
+                            "webhook_secret",
+                            "webhook_id",
+                            "webhook_error",
+                            "last_synced_sha",
+                            "last_pull_status",
+                        ] {
+                            auto_pull.remove(field);
+                        }
+                    }
+                }
+            }
+            Some(git_sync)
+        }
+
         let settings_str = if settings_version.as_deref() == Some("v2") {
             let settings = SimplifiedSettings {
                 auto_invite: row.auto_invite,
@@ -1431,7 +1460,7 @@ pub(crate) async fn tarball_workspace(
                 success_handler: row.success_handler,
                 ai_config: row.ai_config,
                 large_file_storage: row.large_file_storage,
-                git_sync: row.git_sync,
+                git_sync: redact_git_sync_for_export(row.git_sync),
                 default_app: row.default_app,
                 default_scripts: row.default_scripts,
                 name: row.name.clone().unwrap_or_default(),
@@ -1502,7 +1531,7 @@ pub(crate) async fn tarball_workspace(
                 error_handler_muted_on_cancel,
                 ai_config: row.ai_config,
                 large_file_storage: row.large_file_storage,
-                git_sync: row.git_sync,
+                git_sync: redact_git_sync_for_export(row.git_sync),
                 default_app: row.default_app,
                 default_scripts: row.default_scripts,
                 name: row.name.unwrap_or_default(),
diff --git a/backend/windmill-common/src/workspaces.rs b/backend/windmill-common/src/workspaces.rs
index a8c6e26f0e..14dbfdf11d 100644
--- a/backend/windmill-common/src/workspaces.rs
+++ b/backend/windmill-common/src/workspaces.rs
@@ -167,7 +167,12 @@ pub enum ObjectType {
     DatatableMigration,
 }
 
-pub const LATEST_GIT_SYNC_SCRIPT_PATH: &str = "hub/28719/sync-script-to-git-repo-windmill";
+pub const LATEST_GIT_SYNC_SCRIPT_PATH: &str = "hub/28786/sync-script-to-git-repo-windmill";
+
+/// Hub script that applies a repository's state back into a workspace
+/// (the repo → Windmill / "pull" direction). Same script the UI runs from
+/// `PullWorkspaceModal` with `pull: true`; the slug's `:` is percent-encoded.
+pub const GIT_SYNC_PULL_SCRIPT_PATH: &str = "hub/28787/git-sync%3A-init-repository-windmill";
 
 /// Prefix used to identify fork workspaces. A workspace whose id starts with this string is a
 /// fork of another workspace.
@@ -190,6 +195,39 @@ pub fn validate_dev_workspace_id(id: &str) -> error::Result<()> {
     validate_workspace_branch_id(id, false)
 }
 
+/// Split a fork git branch `wm-fork/<base_branch>/<suffix>` into `(base_branch, suffix)`.
+///
+/// Inverse of the CLI/hub-script `forkBranchName`. The suffix is a workspace id
+/// fragment and can't contain `/` (enforced by [`validate_fork_workspace_id`] /
+/// [`validate_dev_workspace_id`] at every fork/dev creation and attach path), while
+/// the base branch may (`release/v2`), so the split is on the last separator.
+/// Returns `None` for anything else.
+pub fn parse_fork_branch(branch: &str) -> Option<(&str, &str)> {
+    let rest = branch.strip_prefix("wm-fork/")?;
+    let idx = rest.rfind('/')?;
+    let (base, suffix) = (&rest[..idx], &rest[idx + 1..]);
+    if base.is_empty() || suffix.is_empty() {
+        return None;
+    }
+    Some((base, suffix))
+}
+
+/// Workspace ids that could own a fork branch with this suffix: a generated fork
+/// (`wm-fork-<suffix>`, whose branch strips the id prefix) or a dev workspace
+/// (prefix-less id used verbatim). Ordered generated-fork first so an ambiguous
+/// suffix resolves deterministically.
+pub fn fork_branch_workspace_id_candidates(suffix: &str) -> [String; 2] {
+    [format!("{WM_FORK_PREFIX}{suffix}"), suffix.to_string()]
+}
+
+/// Git branch a dev workspace syncs with: its environment label verbatim, as a
+/// first-class top-level branch (`dev`, `staging` — the classic env-branch
+/// layout), defaulting to `dev` when the label is unset. Throwaway forks use
+/// the namespaced `wm-fork/<base>/<suffix>` form instead.
+pub fn dev_workspace_branch(label: Option<&str>) -> String {
+    label.filter(|l| !l.is_empty()).unwrap_or("dev").to_string()
+}
+
 /// The `workspace.name` column is `character varying(50)`, so a name longer than 50 characters
 /// triggers a raw `value too long for type character varying(50)` SQL error on insert. Validate
 /// up front to return a clear message instead.
@@ -244,12 +282,13 @@ fn validate_workspace_branch_id(id: &str, require_fork_prefix: bool) -> error::R
     if id.contains("@{") {
         return reject("cannot contain '@{'");
     }
-    if id.contains("//") {
-        return reject("cannot contain '//'");
-    }
     for ch in id.chars() {
         match ch {
-            ':' | '~' | '^' | '?' | '*' | '[' | '\\' | ' ' => {
+            // '/' is git-legal in a branch but banned here: the id becomes the last
+            // component of `wm-fork/<base_branch>/<id>` and `parse_fork_branch` splits
+            // that branch on the last '/' (the base branch itself may contain '/'),
+            // so a slash in the id would make the fork unroutable for auto-sync.
+            ':' | '~' | '^' | '?' | '*' | '[' | '\\' | ' ' | '/' => {
                 return reject(&format!("contains forbidden character '{}'", ch));
             }
             c if c.is_ascii_control() || c == '\u{7f}' => {
@@ -258,18 +297,16 @@ fn validate_workspace_branch_id(id: &str, require_fork_prefix: bool) -> error::R
             _ => {}
         }
     }
-    // Each slash-separated component cannot start with '.' or end with '.lock'.
-    for component in id.split('/') {
-        if component.starts_with('.') {
-            return reject("a path component cannot start with '.'");
-        }
-        if component.ends_with(".lock") {
-            return reject("a path component cannot end with '.lock'");
-        }
+    if id.starts_with('.') {
+        return reject("cannot start with '.'");
     }
     Ok(())
 }
 
+fn is_false(b: &bool) -> bool {
+    !*b
+}
+
 #[derive(Serialize, Deserialize, Debug)]
 pub struct GitRepositorySettings {
     #[serde(skip_serializing_if = "Option::is_none")]
@@ -283,6 +320,27 @@ pub struct GitRepositorySettings {
     pub group_by_folder: Option<bool>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub settings: Option<GitSyncSettings>,
+    /// Configuration for automatically pulling changes from the git repository
+    /// back into the workspace (repo → Windmill direction). Absent means the
+    /// reverse direction is not automated (the historical behaviour).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub auto_pull: Option<AutoPullSettings>,
+    /// Open a PR when a deploy pushes a `wm_deploy/**` branch of this promotion
+    /// repo (app-backed only; runs from the deploy callback so it works without
+    /// inbound webhooks). Off by default so upgrades don't change behavior.
+    #[serde(default, skip_serializing_if = "is_false")]
+    pub promotion_open_prs: bool,
+    /// Parent-level: open a PR when a fork of this workspace deploys to its
+    /// `wm-fork/**` branch (app-backed only; the fork's deploy callback reads
+    /// this from the parent). Off by default.
+    #[serde(default, skip_serializing_if = "is_false")]
+    pub fork_open_prs: bool,
+    /// Server-owned: the last failure opening a PR for a deploy branch of this
+    /// repo (e.g. the GitHub App installation hasn't approved the pull-request
+    /// permission). Written by the deploy completion hook, cleared on the next
+    /// successful PR; never accepted from clients.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub open_pr_error: Option<String>,
 }
 
 impl GitRepositorySettings {
@@ -314,6 +372,128 @@ impl GitRepositorySettings {
     }
 }
 
+/// How auto-pull triggers are delivered for a repository.
+#[derive(Serialize, Deserialize, Debug, Clone, Copy, Default, PartialEq, Eq)]
+#[serde(rename_all = "lowercase")]
+pub enum AutoPullMode {
+    /// Try to create a repo webhook; fall back to polling if the instance is not
+    /// reachable from GitHub or the app lacks the webhook permission.
+    #[default]
+    Auto,
+    /// Webhook delivery only (no polling fallback).
+    Webhook,
+    /// Polling only (`git ls-remote` on an interval).
+    Polling,
+}
+
+/// Outcome of the most recent auto-pull attempt, surfaced in the UI.
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct AutoPullStatus {
+    /// Commit sha the workspace was last synced to.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub synced_sha: Option<String>,
+    /// Unix timestamp (seconds) of the attempt.
+    pub at: i64,
+    /// Job id of the pull run, if one was enqueued.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub job_id: Option<uuid::Uuid>,
+    pub success: bool,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+}
+
+/// Per-repository configuration for automatic repo → Windmill pull sync.
+///
+/// Stored inside `GitRepositorySettings` (workspace_settings.git_sync JSONB).
+/// Webhook fields are populated in phase 2; phase 1 exercises the polling path
+/// only, but the full shape is defined up front to avoid a second schema change.
+#[derive(Serialize, Deserialize, Clone, Default)]
+pub struct AutoPullSettings {
+    /// Default so a server-written status-only blob (fork workspaces, which never
+    /// enable auto-pull themselves) parses even without the field.
+    #[serde(default)]
+    pub enabled: bool,
+    #[serde(default)]
+    pub mode: AutoPullMode,
+    /// Polling interval in seconds. Defaults to `DEFAULT_AUTO_PULL_POLL_INTERVAL_S`
+    /// when polling without an active webhook, relaxed once a webhook is live.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub poll_interval_s: Option<u32>,
+    /// Parent-level: also pull each live fork of this workspace from its own
+    /// `wm-fork/<branch>/<id>` branch when that branch moves (webhook or poll),
+    /// the managed equivalent of the `push-on-merge-to-forks` GitHub Action.
+    /// Configured once on the parent; forks never enable auto-pull themselves.
+    #[serde(default, skip_serializing_if = "is_false")]
+    pub sync_forks: bool,
+    /// GitHub repository webhook id (managed-app, phase 2).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub webhook_id: Option<i64>,
+    /// HMAC secret for the repo webhook, encrypted at rest (managed-app, phase 2).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub webhook_secret: Option<String>,
+    /// Why the repo has no active webhook while one was requested (auto/webhook
+    /// mode): instance base URL unset, app missing the webhook permission, etc.
+    /// Surfaced in the UI as a "falling back to polling" warning; `None` when the
+    /// webhook is live or the repo is polling-only.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub webhook_error: Option<String>,
+    /// Last synced commit sha per tracked git ref (e.g. `refs/heads/main`).
+    #[serde(default, skip_serializing_if = "std::collections::HashMap::is_empty")]
+    pub last_synced_sha: std::collections::HashMap<String, String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub last_pull_status: Option<AutoPullStatus>,
+}
+
+// Manual Debug so the HMAC `webhook_secret` (even encrypted) never lands in logs.
+impl std::fmt::Debug for AutoPullSettings {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("AutoPullSettings")
+            .field("enabled", &self.enabled)
+            .field("mode", &self.mode)
+            .field("poll_interval_s", &self.poll_interval_s)
+            .field("sync_forks", &self.sync_forks)
+            .field("webhook_id", &self.webhook_id)
+            .field(
+                "webhook_secret",
+                &self.webhook_secret.as_ref().map(|_| "<redacted>"),
+            )
+            .field("webhook_error", &self.webhook_error)
+            .field("last_synced_sha", &self.last_synced_sha)
+            .field("last_pull_status", &self.last_pull_status)
+            .finish()
+    }
+}
+
+/// Default polling interval when a webhook is not active.
+pub const DEFAULT_AUTO_PULL_POLL_INTERVAL_S: u32 = 60;
+
+/// Relaxed polling interval used as a safety net while a webhook is active.
+pub const WEBHOOK_AUTO_PULL_POLL_INTERVAL_S: u32 = 600;
+
+impl AutoPullSettings {
+    /// Effective polling interval in seconds, honouring the explicit override and
+    /// relaxing to `WEBHOOK_AUTO_PULL_POLL_INTERVAL_S` when a webhook is live.
+    pub fn effective_poll_interval_s(&self) -> u32 {
+        self.poll_interval_s.unwrap_or_else(|| {
+            if self.webhook_id.is_some() {
+                WEBHOOK_AUTO_PULL_POLL_INTERVAL_S
+            } else {
+                DEFAULT_AUTO_PULL_POLL_INTERVAL_S
+            }
+        })
+    }
+
+    /// Whether a freshly observed `(git_ref, head_sha)` warrants enqueuing a pull.
+    ///
+    /// A trigger (poll or webhook) is only a hint: we pull when auto-pull is
+    /// enabled and the observed head differs from the last sha we synced for
+    /// that ref. Re-observing the same head (e.g. a redundant poll, or the
+    /// commit our own deploy callback just pushed back) is a no-op.
+    pub fn should_pull(&self, git_ref: &str, head_sha: &str) -> bool {
+        self.enabled && self.last_synced_sha.get(git_ref).map(String::as_str) != Some(head_sha)
+    }
+}
+
 #[derive(Serialize, Deserialize, Debug)]
 pub struct GitSyncSettings {
     pub include_path: Vec<String>,
@@ -1783,6 +1963,33 @@ async fn transform_json_unchecked(
 mod tests {
     use super::*;
 
+    #[test]
+    fn test_parse_fork_branch() {
+        // Generated fork (`wm-fork-abc`) and dev workspace (`staging`) forms.
+        assert_eq!(parse_fork_branch("wm-fork/main/abc"), Some(("main", "abc")));
+        assert_eq!(
+            parse_fork_branch("wm-fork/main/staging"),
+            Some(("main", "staging"))
+        );
+        // Base branch may itself contain slashes; the suffix never does.
+        assert_eq!(
+            parse_fork_branch("wm-fork/release/v2/abc"),
+            Some(("release/v2", "abc"))
+        );
+        assert_eq!(parse_fork_branch("main"), None);
+        assert_eq!(parse_fork_branch("wm-fork/main"), None);
+        assert_eq!(parse_fork_branch("wm-fork/main/"), None);
+        assert_eq!(parse_fork_branch("wm-fork//abc"), None);
+        assert_eq!(parse_fork_branch("wm_deploy/main/abc"), None);
+    }
+
+    #[test]
+    fn test_fork_branch_workspace_id_candidates_prefers_generated_fork() {
+        let [first, second] = fork_branch_workspace_id_candidates("abc");
+        assert_eq!(first, "wm-fork-abc");
+        assert_eq!(second, "abc");
+    }
+
     #[test]
     fn test_validate_fork_workspace_id_accepts_valid() {
         validate_fork_workspace_id("wm-fork-test-allow").unwrap();
@@ -1808,6 +2015,9 @@ mod tests {
             "wm-fork-test[allow",
             "wm-fork-test\\allow",
             "wm-fork-test\nallow",
+            // '/' is git-legal but banned: it would break the parse_fork_branch
+            // last-'/' split that routes auto-pull into the fork workspace.
+            "wm-fork-test/allow",
         ] {
             assert!(
                 validate_fork_workspace_id(bad).is_err(),
@@ -1858,6 +2068,59 @@ mod tests {
         assert!(validate_fork_workspace_id(&long_id).is_err());
     }
 
+    fn auto_pull(enabled: bool, synced: &[(&str, &str)]) -> AutoPullSettings {
+        AutoPullSettings {
+            enabled,
+            mode: AutoPullMode::Auto,
+            poll_interval_s: None,
+            sync_forks: false,
+            webhook_id: None,
+            webhook_secret: None,
+            webhook_error: None,
+            last_synced_sha: synced
+                .iter()
+                .map(|(r, s)| (r.to_string(), s.to_string()))
+                .collect(),
+            last_pull_status: None,
+        }
+    }
+
+    #[test]
+    fn test_should_pull_on_new_or_changed_sha() {
+        let s = auto_pull(true, &[("refs/heads/main", "aaa")]);
+        // unchanged head → no pull
+        assert!(!s.should_pull("refs/heads/main", "aaa"));
+        // moved head → pull
+        assert!(s.should_pull("refs/heads/main", "bbb"));
+        // never-seen ref → pull
+        assert!(s.should_pull("refs/heads/dev", "ccc"));
+    }
+
+    #[test]
+    fn test_should_pull_respects_enabled_flag() {
+        let s = auto_pull(false, &[]);
+        assert!(!s.should_pull("refs/heads/main", "bbb"));
+    }
+
+    #[test]
+    fn test_effective_poll_interval() {
+        let mut s = auto_pull(true, &[]);
+        assert_eq!(
+            s.effective_poll_interval_s(),
+            DEFAULT_AUTO_PULL_POLL_INTERVAL_S
+        );
+        // explicit override wins
+        s.poll_interval_s = Some(15);
+        assert_eq!(s.effective_poll_interval_s(), 15);
+        // with a live webhook and no override, relax to the webhook interval
+        s.poll_interval_s = None;
+        s.webhook_id = Some(42);
+        assert_eq!(
+            s.effective_poll_interval_s(),
+            WEBHOOK_AUTO_PULL_POLL_INTERVAL_S
+        );
+    }
+
     #[test]
     fn test_fork_ducklake_metadata_schema_shape() {
         let s = fork_ducklake_metadata_schema("wm-fork-my-feature-42", "main");
@@ -1931,10 +2194,12 @@ mod tests {
 
     #[test]
     fn test_fork_data_path_prefix_isolation() {
-        // Fork/dev ids are git-branch-safe and may contain `/`: `wm-fork-a/b` is a valid id.
-        // Its data prefix must NOT nest inside `wm-fork-a`'s, or deleting `wm-fork-a` would
-        // sweep the sibling's files via the object-store prefix listing.
-        assert!(validate_fork_workspace_id("wm-fork-a/b").is_ok());
+        // New fork/dev ids can't contain `/` (it would break the parse_fork_branch
+        // last-'/' split), but ids created before that ban may still exist, so the
+        // data-path mangling must keep handling them: `wm-fork-a/b`'s prefix must
+        // NOT nest inside `wm-fork-a`'s, or deleting `wm-fork-a` would sweep the
+        // sibling's files via the object-store prefix listing.
+        assert!(validate_fork_workspace_id("wm-fork-a/b").is_err());
         let a = fork_data_path("lake", "wm-fork-a");
         let ab = fork_data_path("lake", "wm-fork-a/b");
         assert!(
diff --git a/backend/windmill-git-sync/src/lib.rs b/backend/windmill-git-sync/src/lib.rs
index 6c1b9bf89b..b7c714e5c8 100644
--- a/backend/windmill-git-sync/src/lib.rs
+++ b/backend/windmill-git-sync/src/lib.rs
@@ -14,7 +14,9 @@ pub mod git_sync_oss;
 
 #[cfg(feature = "private")]
 pub use git_sync_ee::{
-    handle_deployment_metadata, handle_deployment_metadata_batch, handle_fork_branch_creation,
+    enqueue_git_pull_dry_run, enqueue_git_pull_job, handle_deployment_metadata,
+    handle_deployment_metadata_batch, handle_fork_branch_creation, persist_auto_pull_state,
+    reconcile_and_enqueue_pull, reconcile_fork_branch_pull, record_auto_pull_failure,
 };
 
 #[cfg(not(feature = "private"))]
diff --git a/backend/windmill-store/src/resources.rs b/backend/windmill-store/src/resources.rs
index c70314430d..c77b0874ec 100644
--- a/backend/windmill-store/src/resources.rs
+++ b/backend/windmill-store/src/resources.rs
@@ -2568,6 +2568,13 @@ async fn validate_git_url(url: &str) -> Result<()> {
     let host = extract_host_from_git_url(url)
         .ok_or_else(|| Error::BadRequest("Could not parse hostname from git URL".to_string()))?;
 
+    // CI/dev escape hatch: integration tests run their git remote (a Gitea
+    // container) on localhost, which the network-target checks below reject.
+    // Scheme and option-injection validation above still applies.
+    if std::env::var("ALLOW_LOCAL_GIT_REMOTES").is_ok_and(|v| v == "true" || v == "1") {
+        return Ok(());
+    }
+
     if host == "localhost" || host.ends_with(".local") || host == "[::1]" {
         return Err(Error::BadRequest(
             "Git URLs targeting localhost or local network are not allowed".to_string(),
@@ -2781,6 +2788,26 @@ async fn get_git_ssh_cmd(
     Ok((Some(git_ssh_cmd), file_paths))
 }
 
+/// Run a git remote probe with a hard per-command deadline. The auto-pull poller
+/// walks every repository sequentially in one monitor pass, so a single
+/// unresponsive remote must not stall the whole pass (or leave a hung child
+/// process behind — `kill_on_drop` reaps it when the timeout fires).
+const GIT_PROBE_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(60);
+
+async fn run_git_probe(mut git_cmd: Command, what: &str) -> Result<std::process::Output> {
+    git_cmd.kill_on_drop(true);
+    match tokio::time::timeout(GIT_PROBE_TIMEOUT, git_cmd.output()).await {
+        Ok(output) => {
+            output.map_err(|e| Error::internal_err(format!("Failed to execute git command: {}", e)))
+        }
+        Err(_) => Err(Error::internal_err(format!(
+            "git {} timed out after {}s",
+            what,
+            GIT_PROBE_TIMEOUT.as_secs()
+        ))),
+    }
+}
+
 async fn get_repo_latest_commit_hash(
     git_resource: &GitRepositoryResource,
     git_ssh_command: Option<String>,
@@ -2806,10 +2833,7 @@ async fn get_repo_latest_commit_hash(
     }
     git_cmd.stderr(Stdio::piped());
 
-    let output = git_cmd
-        .output()
-        .await
-        .map_err(|e| Error::internal_err(format!("Failed to execute git command: {}", e)))?;
+    let output = run_git_probe(git_cmd, "ls-remote").await?;
 
     if !output.status.success() {
         let stderr = String::from_utf8(output.stderr)
@@ -2843,6 +2867,219 @@ async fn get_repo_latest_commit_hash(
     Ok(commit_hash)
 }
 
+/// Resolve a workspace git-sync repository and return its current head commit
+/// for the tracked branch, for background auto-pull polling (no authed user).
+///
+/// Returns `Ok(Some((ref_spec, sha)))` for a pollable repo, or `Ok(None)` for
+/// repos that cannot be polled in-process — currently GitHub-App-backed repos,
+/// which authenticate via an installation token at clone time and sync via
+/// webhooks instead. Credentials embedded in the resource URL (including
+/// `$var:` references) are resolved with the system identity, bypassing
+/// per-user ACLs, since the poller runs without an authenticated request.
+pub async fn get_git_repo_head_for_autopull(
+    db: &DB,
+    w_id: &str,
+    git_repo_resource_path: &str,
+) -> Result<Option<(String, String)>> {
+    use windmill_common::db::DbWithOptAuthed;
+
+    let resource_path = git_repo_resource_path
+        .strip_prefix("$res:")
+        .unwrap_or(git_repo_resource_path);
+
+    let dba: DbWithOptAuthed<'_, ApiAuthed> = DbWithOptAuthed::DB {
+        db: db.clone(),
+        audit_author: windmill_common::audit::AuditAuthor {
+            username: "git_sync_auto_pull".to_string(),
+            email: windmill_common::users::SUPERADMIN_SYNC_EMAIL.to_string(),
+            username_override: None,
+            token_prefix: None,
+        },
+    };
+
+    // allow_cache=true so repeated polls reuse the interpolated value instead of
+    // re-decrypting any `$var:` secret in the URL (and writing an audit row) on
+    // every tick.
+    let value =
+        get_resource_value_interpolated_internal(&dba, w_id, resource_path, None, None, true)
+            .await?
+            .ok_or_else(|| {
+                Error::BadRequest(format!(
+                    "Git repository resource '{}' not found",
+                    resource_path
+                ))
+            })?;
+
+    if value
+        .get("is_github_app")
+        .and_then(|v| v.as_bool())
+        .unwrap_or(false)
+    {
+        return Ok(None);
+    }
+
+    let git_resource: GitRepositoryResource = serde_json::from_value(value)
+        .map_err(|e| Error::BadRequest(format!("Invalid git repository resource: {}", e)))?;
+
+    // The SSH identity is supplied per-call in the authed commit-hash path; the
+    // background poller has none, so an SSH remote can't authenticate here. Fail
+    // with an actionable message instead of a confusing ls-remote auth error —
+    // these repos should use an HTTPS token URL or the GitHub App for auto-pull.
+    let url = git_resource.url.trim_start();
+    if !url.starts_with("http://") && !url.starts_with("https://") {
+        return Err(Error::BadRequest(
+            "Automatic pull can't authenticate an SSH git remote in the background. Use an HTTPS URL with an embedded token, or connect the repository through the GitHub App.".to_string(),
+        ));
+    }
+
+    if let Some(branch) = git_resource.branch.as_deref().filter(|s| !s.is_empty()) {
+        let branch = branch.to_string();
+        let sha = get_repo_latest_commit_hash(&git_resource, None).await?;
+        return Ok(Some((branch, sha)));
+    }
+
+    // No explicit branch: resolve the remote's default-branch NAME along with
+    // its head in one call. Fork sync needs the concrete name to scope
+    // `wm-fork/<branch>/*`, so a bare "HEAD" ref would silently disable it.
+    validate_git_url(&git_resource.url).await?;
+    let mut git_cmd = Command::new("git");
+    git_cmd.args(["ls-remote", "--symref", &git_resource.url, "HEAD"]);
+    git_cmd.stderr(Stdio::piped());
+    let output = run_git_probe(git_cmd, "ls-remote --symref HEAD").await?;
+    if !output.status.success() {
+        let stderr = String::from_utf8(output.stderr)
+            .unwrap_or_else(|_| "Failed to decode stderr".to_string());
+        return Err(Error::BadRequest(format!(
+            "Error resolving git repo HEAD: {}",
+            stderr
+        )));
+    }
+    let stdout = String::from_utf8(output.stdout)
+        .map_err(|e| Error::internal_err(format!("Failed to decode git output: {}", e)))?;
+    let (branch, sha) = parse_ls_remote_symref_head(&stdout);
+    let sha = sha.ok_or_else(|| {
+        Error::BadRequest(format!(
+            "No HEAD found in repository '{}'",
+            git_resource.url
+        ))
+    })?;
+    Ok(Some((branch.unwrap_or_else(|| "HEAD".to_string()), sha)))
+}
+
+/// Parse `git ls-remote --symref <url> HEAD` output: the `ref:` line names the
+/// default branch, the plain line carries its head sha.
+fn parse_ls_remote_symref_head(stdout: &str) -> (Option<String>, Option<String>) {
+    let mut branch = None;
+    let mut sha = None;
+    for line in stdout.lines() {
+        let mut parts = line.split_whitespace();
+        match (parts.next(), parts.next()) {
+            (Some("ref:"), Some(target)) => {
+                if let Some(name) = target.strip_prefix("refs/heads/") {
+                    branch = Some(name.to_string());
+                }
+            }
+            (Some(hash), Some("HEAD")) => {
+                sha = Some(hash.to_string());
+            }
+            _ => {}
+        }
+    }
+    (branch, sha)
+}
+
+/// List the head sha of every `wm-fork/<base_branch>/*` branch — plus any
+/// `extra_refs` (dev workspaces' environment-label branches, e.g. `dev`,
+/// `staging`) — of a workspace git-sync repository in one `git ls-remote` call,
+/// for parent-managed fork sync polling. Same auth model and app-repo exclusion
+/// as [`get_git_repo_head_for_autopull`]: returns `Ok(None)` for
+/// GitHub-App-backed repos (polled over the API instead) and errors on SSH
+/// remotes.
+pub async fn get_git_repo_fork_heads_for_autopull(
+    db: &DB,
+    w_id: &str,
+    git_repo_resource_path: &str,
+    base_branch: &str,
+    extra_refs: &[String],
+) -> Result<Option<Vec<(String, String)>>> {
+    use windmill_common::db::DbWithOptAuthed;
+
+    let resource_path = git_repo_resource_path
+        .strip_prefix("$res:")
+        .unwrap_or(git_repo_resource_path);
+
+    let dba: DbWithOptAuthed<'_, ApiAuthed> = DbWithOptAuthed::DB {
+        db: db.clone(),
+        audit_author: windmill_common::audit::AuditAuthor {
+            username: "git_sync_auto_pull".to_string(),
+            email: windmill_common::users::SUPERADMIN_SYNC_EMAIL.to_string(),
+            username_override: None,
+            token_prefix: None,
+        },
+    };
+    let value =
+        get_resource_value_interpolated_internal(&dba, w_id, resource_path, None, None, true)
+            .await?
+            .ok_or_else(|| {
+                Error::BadRequest(format!(
+                    "Git repository resource '{}' not found",
+                    resource_path
+                ))
+            })?;
+
+    if value
+        .get("is_github_app")
+        .and_then(|v| v.as_bool())
+        .unwrap_or(false)
+    {
+        return Ok(None);
+    }
+
+    let git_resource: GitRepositoryResource = serde_json::from_value(value)
+        .map_err(|e| Error::BadRequest(format!("Invalid git repository resource: {}", e)))?;
+    let url = git_resource.url.trim_start();
+    if !url.starts_with("http://") && !url.starts_with("https://") {
+        return Err(Error::BadRequest(
+            "Automatic pull can't authenticate an SSH git remote in the background. Use an HTTPS URL with an embedded token, or connect the repository through the GitHub App.".to_string(),
+        ));
+    }
+    validate_git_url(&git_resource.url).await?;
+    validate_git_ref(base_branch)?;
+
+    let mut git_cmd = Command::new("git");
+    git_cmd.args([
+        "ls-remote",
+        &git_resource.url,
+        &format!("refs/heads/wm-fork/{}/*", base_branch),
+    ]);
+    for r in extra_refs {
+        validate_git_ref(r)?;
+        git_cmd.arg(format!("refs/heads/{}", r));
+    }
+    git_cmd.stderr(Stdio::piped());
+    let output = run_git_probe(git_cmd, "ls-remote (fork branches)").await?;
+    if !output.status.success() {
+        let stderr = String::from_utf8(output.stderr)
+            .unwrap_or_else(|_| "Failed to decode stderr".to_string());
+        return Err(Error::BadRequest(format!(
+            "Error listing fork branches: {}",
+            stderr
+        )));
+    }
+    let stdout = String::from_utf8(output.stdout)
+        .map_err(|e| Error::internal_err(format!("Failed to decode git output: {}", e)))?;
+    let heads = stdout
+        .lines()
+        .filter_map(|line| {
+            let mut parts = line.split_whitespace();
+            let sha = parts.next()?;
+            let branch = parts.next()?.strip_prefix("refs/heads/")?;
+            Some((branch.to_string(), sha.to_string()))
+        })
+        .collect();
+    Ok(Some(heads))
+}
+
 #[cfg(all(
     feature = "enterprise",
     any(feature = "nats", feature = "kafka", feature = "sqs_trigger")
@@ -2878,6 +3115,28 @@ mod tests {
     use windmill_common::audit::AuditAuthor;
     use windmill_common::db::DbWithOptAuthed;
 
+    #[test]
+    fn parse_symref_head_resolves_default_branch() {
+        let out = "ref: refs/heads/main\tHEAD\n7ddb8cec9a0000000000000000000000000000aa\tHEAD\n";
+        assert_eq!(
+            parse_ls_remote_symref_head(out),
+            (
+                Some("main".to_string()),
+                Some("7ddb8cec9a0000000000000000000000000000aa".to_string())
+            )
+        );
+        // Detached/unknown symref: sha still parses, branch stays None.
+        let out2 = "1234567890000000000000000000000000000000\tHEAD\n";
+        assert_eq!(
+            parse_ls_remote_symref_head(out2),
+            (
+                None,
+                Some("1234567890000000000000000000000000000000".to_string())
+            )
+        );
+        assert_eq!(parse_ls_remote_symref_head(""), (None, None));
+    }
+
     fn test_db_with_opt_authed(db: DB) -> DbWithOptAuthed<'static, ApiAuthed> {
         DbWithOptAuthed::DB {
             db,
diff --git a/backend/windmill-worker/src/result_processor.rs b/backend/windmill-worker/src/result_processor.rs
index f2f36621a5..c2645f7cde 100644
--- a/backend/windmill-worker/src/result_processor.rs
+++ b/backend/windmill-worker/src/result_processor.rs
@@ -741,6 +741,654 @@ pub async fn handle_receive_completed_job(
     }
 }
 
+/// A git-sync check run threaded through a pull job: the PR diff preview (phase 4)
+/// or the live deploy status (phase 6). Both markers carry the same shape.
+#[cfg(all(feature = "enterprise", feature = "private"))]
+#[derive(serde::Deserialize)]
+struct GitSyncCheck {
+    check_run_id: i64,
+    repo_url: String,
+    #[serde(default)]
+    pr_number: Option<i64>,
+    #[serde(default)]
+    head_sha: Option<String>,
+    /// Whether the PR itself modifies wmill.yaml (None = undetermined); picks
+    /// the wording for a settings difference in the diff summary.
+    #[serde(default)]
+    wmill_yaml_changed: Option<bool>,
+}
+
+/// Parsed diff summary from a (dry-run or real) pull result. `None` when the
+/// result can't be parsed into the expected shape.
+#[cfg(all(feature = "enterprise", feature = "private"))]
+fn parse_git_sync_changes(result_raw: &str) -> Option<(Vec<(String, String)>, bool)> {
+    use serde::Deserialize;
+    #[derive(Deserialize)]
+    struct Change {
+        #[serde(rename = "type")]
+        change_type: String,
+        path: String,
+    }
+    #[derive(Deserialize)]
+    struct SettingsDiff {
+        #[serde(rename = "hasChanges", default)]
+        has_changes: bool,
+    }
+    #[derive(Deserialize)]
+    struct SyncResponse {
+        changes: Option<Vec<Change>>,
+        #[serde(rename = "settingsDiffResult")]
+        settings_diff_result: Option<SettingsDiff>,
+    }
+    let resp = serde_json::from_str::<SyncResponse>(result_raw).ok()?;
+    // A result carrying neither field isn't a recognizable diff; return None so the
+    // caller falls back to the unsummarized path instead of a false "in sync".
+    if resp.changes.is_none() && resp.settings_diff_result.is_none() {
+        return None;
+    }
+    let settings_changed = resp
+        .settings_diff_result
+        .map(|s| s.has_changes)
+        .unwrap_or(false);
+    Some((
+        resp.changes
+            .unwrap_or_default()
+            .into_iter()
+            .map(|c| (c.change_type, c.path))
+            .collect(),
+        settings_changed,
+    ))
+}
+
+#[cfg(all(feature = "enterprise", feature = "private"))]
+fn format_change_list(changes: &[(String, String)]) -> Vec<String> {
+    let mut lines = Vec::new();
+    for (change_type, path) in changes.iter().take(100) {
+        lines.push(format!("- `{}` {}", change_type, path));
+    }
+    if changes.len() > 100 {
+        lines.push(format!("- ... and {} more", changes.len() - 100));
+    }
+    lines
+}
+
+#[cfg(all(test, feature = "enterprise", feature = "private"))]
+mod git_sync_check_tests {
+    use super::{format_change_list, parse_git_sync_changes};
+
+    #[test]
+    fn parse_empty_changes_is_in_sync() {
+        // Present-but-empty diff → a real "in sync" result, not None.
+        let (changes, settings) = parse_git_sync_changes(r#"{"changes":[]}"#).unwrap();
+        assert!(changes.is_empty());
+        assert!(!settings);
+    }
+
+    #[test]
+    fn parse_missing_fields_is_none() {
+        // Neither field present → unrecognizable, falls back to the caller's path.
+        assert!(parse_git_sync_changes("{}").is_none());
+    }
+
+    #[test]
+    fn parse_unparseable_is_none() {
+        assert!(parse_git_sync_changes("not json").is_none());
+    }
+
+    #[test]
+    fn parse_changes_and_settings() {
+        let (changes, settings) = parse_git_sync_changes(
+            r#"{"changes":[{"type":"edited","path":"f/a"}],"settingsDiffResult":{"hasChanges":true}}"#,
+        )
+        .unwrap();
+        assert_eq!(changes, vec![("edited".to_string(), "f/a".to_string())]);
+        assert!(settings);
+    }
+
+    #[test]
+    fn format_truncates_over_100() {
+        let changes: Vec<(String, String)> = (0..150)
+            .map(|i| ("edited".to_string(), format!("f/{i}")))
+            .collect();
+        let lines = format_change_list(&changes);
+        assert_eq!(lines.len(), 101);
+        assert_eq!(lines.last().unwrap(), "- ... and 50 more");
+    }
+}
+
+/// When an auto-pull job (carrying `__git_sync_auto_pull`) fails, roll the
+/// optimistic `last_synced_sha` advance back to the pre-pull value so the commit
+/// is retried instead of being silently treated as synced, and record the failure.
+#[cfg(all(feature = "enterprise", feature = "private"))]
+async fn maybe_reconcile_git_sync_auto_pull(
+    db: &DB,
+    job_id: &uuid::Uuid,
+    workspace_id: &str,
+    success: bool,
+) {
+    if success {
+        return; // the optimistic synced state is already correct
+    }
+    let marker: Option<serde_json::Value> = match sqlx::query_scalar!(
+        "SELECT args->'__git_sync_auto_pull' FROM v2_job WHERE id = $1",
+        job_id
+    )
+    .fetch_optional(db)
+    .await
+    {
+        Ok(v) => v.flatten(),
+        Err(e) => {
+            tracing::error!("git auto-pull: failed to read job args: {e:#}");
+            return;
+        }
+    };
+    let Some(marker) = marker else {
+        return;
+    };
+    #[derive(serde::Deserialize)]
+    struct AutoPullMarker {
+        repo_resource_path: String,
+        #[serde(default)]
+        prev_synced: std::collections::HashMap<String, String>,
+    }
+    let Ok(m) = serde_json::from_value::<AutoPullMarker>(marker) else {
+        return;
+    };
+    windmill_git_sync::record_auto_pull_failure(
+        db,
+        workspace_id,
+        &m.repo_resource_path,
+        &m.prev_synced,
+        "auto-pull job failed".to_string(),
+    )
+    .await;
+}
+
+/// Branch a git-sync push job deployed to, mirroring the hub script's
+/// derivation: a dev workspace deploys to its environment-label branch
+/// (`dev`/`staging`), other fork workspaces to `wm-fork/<base>/<id-suffix>`,
+/// else the promotion `wm_deploy/**` formula (per-folder or per-item form).
+/// `None` when the deploy stays on the base branch (workspace-wide mode) and
+/// has no PR to open.
+#[cfg(all(feature = "enterprise", feature = "private"))]
+fn git_sync_deploy_pr_head_branch(
+    workspace_id: &str,
+    parent_workspace_id: Option<&str>,
+    dev_workspace_label: Option<&str>,
+    base: &str,
+    use_individual_branch: bool,
+    group_by_folder: bool,
+    item_path: &str,
+    item_parent_path: &str,
+    path_type: &str,
+) -> Option<String> {
+    if dev_workspace_label.is_some() {
+        return Some(windmill_common::workspaces::dev_workspace_branch(
+            dev_workspace_label,
+        ));
+    }
+    let is_fork = parent_workspace_id.is_some()
+        || workspace_id.starts_with(windmill_common::workspaces::WM_FORK_PREFIX);
+    if is_fork {
+        let suffix = workspace_id
+            .strip_prefix(windmill_common::workspaces::WM_FORK_PREFIX)
+            .unwrap_or(workspace_id);
+        return Some(format!("wm-fork/{base}/{suffix}"));
+    }
+    if !use_individual_branch {
+        return None;
+    }
+    // Mirrors the CLI's computeGitSyncDeployBranch: user/group objects are
+    // pushed to the base branch and never get their own wm_deploy branch.
+    if path_type == "user" || path_type == "group" {
+        return None;
+    }
+    let git_ref = if !item_path.is_empty() {
+        item_path
+    } else {
+        item_parent_path
+    };
+    if git_ref.is_empty() {
+        return None;
+    }
+    Some(if group_by_folder {
+        format!(
+            "wm_deploy/{workspace_id}/{}",
+            git_ref.split('/').take(2).collect::<Vec<_>>().join("__")
+        )
+    } else {
+        format!(
+            "wm_deploy/{workspace_id}/{}/{}",
+            path_type,
+            git_ref.replace('/', "__")
+        )
+    })
+}
+
+/// Whether the push job's result says a commit was actually pushed. `None`
+/// when the result doesn't carry the flag (hub script versions predating it).
+#[cfg(all(feature = "enterprise", feature = "private"))]
+fn git_sync_push_result_pushed(result: &str) -> Option<bool> {
+    serde_json::from_str::<serde_json::Value>(result)
+        .ok()?
+        .get("pushed")?
+        .as_bool()
+}
+
+/// When a git-sync push job carrying `__git_sync_open_pr` succeeds, open (or
+/// reopen) the PR for the branch it pushed: `wm-fork/<base>/<id>` for a fork
+/// deploy, `wm_deploy/**` for a promotion deploy. Runs outbound with the
+/// installation token, so it works regardless of webhook reachability.
+/// Best-effort: failures are logged, never propagated.
+#[cfg(all(feature = "enterprise", feature = "private"))]
+async fn maybe_open_git_sync_deploy_pr(
+    db: &DB,
+    job_id: &uuid::Uuid,
+    workspace_id: &str,
+    result: &str,
+) {
+    // A no-op push (workspace already matches the repo — e.g. the deploy was
+    // itself caused by an auto-pull) must not ensure a PR: it would recreate
+    // PRs the user closed and spam creation attempts with no diff.
+    if git_sync_push_result_pushed(result) == Some(false) {
+        return;
+    }
+    let row = match sqlx::query!(
+        r#"SELECT
+            args->'__git_sync_open_pr' as "marker",
+            args->>'repo_url_resource_path' as "repo_path",
+            args->>'parent_workspace_id' as "parent_workspace_id",
+            args->>'dev_workspace_label' as "dev_workspace_label",
+            args->>'parent_dev_workspace_label' as "parent_dev_workspace_label",
+            COALESCE((args->'use_individual_branch')::bool, false) as "use_individual_branch!",
+            COALESCE((args->'group_by_folder')::bool, false) as "group_by_folder!",
+            COALESCE(args->'items'->0->>'path', args->>'path', '') as "item_path!",
+            COALESCE(args->'items'->0->>'parent_path', args->>'parent_path', '') as "item_parent_path!",
+            COALESCE(args->'items'->0->>'path_type', args->>'path_type', '') as "path_type!",
+            COALESCE(args->'items'->0->>'commit_msg', args->>'commit_msg', '') as "commit_msg!"
+        FROM v2_job WHERE id = $1"#,
+        job_id
+    )
+    .fetch_optional(db)
+    .await
+    {
+        Ok(Some(r)) => r,
+        Ok(None) => return,
+        Err(e) => {
+            tracing::error!("git sync PR: failed to read job args: {e:#}");
+            return;
+        }
+    };
+    if row.marker.is_none() {
+        return;
+    }
+    // Runtime Enterprise gate, like the poller: the toggles may have been set
+    // while a license was active (or written directly), and this hook drives
+    // GitHub API calls with the installation token.
+    if !matches!(
+        windmill_common::ee_oss::get_license_plan().await,
+        windmill_common::ee_oss::LicensePlan::Enterprise
+    ) {
+        tracing::warn!(
+            "git sync PR: skipping PR creation for {workspace_id}: requires an Enterprise license"
+        );
+        return;
+    }
+    let Some(repo_path) = row.repo_path else {
+        return;
+    };
+
+    // Base = the tracked branch (resource branch, else the repo default). Also
+    // acts as the app-backed gate: PR creation needs the installation token.
+    let base = match windmill_common::git_sync_ee::get_app_repo_head_for_autopull(
+        db,
+        workspace_id,
+        &repo_path,
+    )
+    .await
+    {
+        Ok(Some((branch, _))) => branch,
+        Ok(None) => {
+            tracing::warn!(
+                "git sync PR: repo {repo_path} in {workspace_id} has a PR-on-deploy toggle set but is not GitHub-App-backed; skipping (connect the repo through the GitHub App, or use the open-pr-on-commit workflow)"
+            );
+            return;
+        }
+        Err(e) => {
+            tracing::warn!("git sync PR: could not resolve base branch for {repo_path}: {e:#}");
+            return;
+        }
+    };
+
+    let Some(head) = git_sync_deploy_pr_head_branch(
+        workspace_id,
+        row.parent_workspace_id.as_deref(),
+        row.dev_workspace_label.as_deref(),
+        &base,
+        row.use_individual_branch,
+        row.group_by_folder,
+        &row.item_path,
+        &row.item_parent_path,
+        &row.path_type,
+    ) else {
+        return;
+    };
+
+    let repo_url =
+        match windmill_common::git_sync_ee::resolve_repo_url(db, workspace_id, &repo_path).await {
+            Ok(url) => url,
+            Err(e) => {
+                tracing::warn!("git sync PR: could not resolve repo url for {repo_path}: {e:#}");
+                return;
+            }
+        };
+    // A fork of a dev workspace diverged from the dev's label branch, so its PR
+    // merges back there; everything else targets the tracked branch.
+    let pr_base = row.parent_dev_workspace_label.as_deref().unwrap_or(&base);
+    match windmill_common::git_sync_ee::ensure_pull_request(
+        db,
+        workspace_id,
+        &repo_url,
+        &head,
+        pr_base,
+        &row.commit_msg,
+    )
+    .await
+    {
+        Ok(()) => {
+            persist_git_sync_open_pr_error(db, workspace_id, &repo_path, None).await;
+        }
+        Err(e) => {
+            tracing::warn!(
+                "git sync PR: failed to open PR {head} -> {pr_base} for {repo_path}: {e:#}"
+            );
+            let msg: String = format!("{e:#}").chars().take(400).collect();
+            persist_git_sync_open_pr_error(db, workspace_id, &repo_path, Some(msg)).await;
+        }
+    }
+}
+
+/// Best-effort: record (or clear) the last PR-creation failure on the repo's
+/// settings so the toggle can explain a silent no-op in the UI (the usual
+/// cause is a GitHub App installation that hasn't approved the pull-request
+/// permission yet). Merges into a fresh read of the row, only writes on change.
+#[cfg(all(feature = "enterprise", feature = "private"))]
+async fn persist_git_sync_open_pr_error(
+    db: &DB,
+    workspace_id: &str,
+    repo_path: &str,
+    error: Option<String>,
+) {
+    // Single targeted update (like the EE auto-pull status writer): a full
+    // read-modify-write of the column would race the poller's concurrent
+    // last_synced_sha/last_pull_status writes and silently clobber them.
+    let bare_path = repo_path.trim_start_matches("$res:");
+    let result: error::Result<()> = async {
+        sqlx::query!(
+            r#"
+            UPDATE workspace_settings
+            SET git_sync = jsonb_set(
+                git_sync,
+                '{repositories}',
+                (SELECT jsonb_agg(
+                    CASE WHEN elem->>'git_repo_resource_path' IN ($2, '$res:' || $2)
+                        THEN CASE WHEN $3::text IS NULL THEN elem - 'open_pr_error'
+                             ELSE jsonb_set(elem, '{open_pr_error}', to_jsonb($3::text), true) END
+                        ELSE elem END)
+                 FROM jsonb_array_elements(git_sync->'repositories') AS elem)
+            )
+            WHERE workspace_id = $1
+              AND jsonb_typeof(git_sync->'repositories') = 'array'
+            "#,
+            workspace_id,
+            bare_path,
+            error.as_deref(),
+        )
+        .execute(db)
+        .await?;
+        Ok(())
+    }
+    .await;
+    if let Err(e) = result {
+        tracing::warn!("git sync PR: failed to persist open_pr_error for {repo_path}: {e:#}");
+    }
+}
+
+/// When a git-sync pull job carrying a check marker completes, post the outcome
+/// to its GitHub check run: the PR diff preview (`__git_sync_pr_check`, phase 4)
+/// or the live deploy status (`__git_sync_deploy_check`, phase 6).
+/// A one-line description of the repo's sync filters, appended to an "in sync"
+/// PR verdict: a PR that only touches files outside these paths deploys
+/// nothing on merge, which otherwise looks like a wrong verdict.
+#[cfg(all(feature = "enterprise", feature = "private"))]
+fn format_git_sync_scope_note(include: &[String], exclude: &[String]) -> Option<String> {
+    if include.is_empty() {
+        return None;
+    }
+    let fmt = |paths: &[String]| {
+        paths
+            .iter()
+            .map(|p| format!("`{p}`"))
+            .collect::<Vec<_>>()
+            .join(", ")
+    };
+    let mut note = format!(
+        "\n\nOnly files matching this repository's sync filters deploy on merge: {}",
+        fmt(include)
+    );
+    if !exclude.is_empty() {
+        note.push_str(&format!(" (excluding {})", fmt(exclude)));
+    }
+    note.push('.');
+    Some(note)
+}
+
+#[cfg(all(feature = "enterprise", feature = "private"))]
+async fn git_sync_repo_scope_note(
+    db: &DB,
+    workspace_id: &str,
+    repo_path: Option<&str>,
+) -> Option<String> {
+    let repo_path = repo_path?;
+    let settings = sqlx::query_scalar!(
+        "SELECT git_sync FROM workspace_settings WHERE workspace_id = $1",
+        workspace_id
+    )
+    .fetch_optional(db)
+    .await
+    .ok()?
+    .flatten()?;
+    let settings: windmill_common::workspaces::WorkspaceGitSyncSettings =
+        serde_json::from_value(settings).ok()?;
+    // Job args carry the bare resource path; stored settings keep the $res: prefix.
+    let repo = settings.repositories.iter().find(|r| {
+        r.git_repo_resource_path.trim_start_matches("$res:")
+            == repo_path.trim_start_matches("$res:")
+    })?;
+    let s = repo.settings.as_ref()?;
+    format_git_sync_scope_note(
+        &s.include_path,
+        s.exclude_path.as_deref().unwrap_or_default(),
+    )
+}
+
+#[cfg(all(feature = "enterprise", feature = "private"))]
+async fn maybe_post_git_sync_check(
+    db: &DB,
+    job_id: &uuid::Uuid,
+    workspace_id: &str,
+    success: bool,
+    result_raw: &str,
+) {
+    // Only git-sync pull jobs carry one of these markers; everything else no-ops.
+    let row = match sqlx::query!(
+        r#"SELECT args->'__git_sync_pr_check' AS "pr", args->'__git_sync_deploy_check' AS "deploy",
+           args->>'repo_url_resource_path' AS "repo_path"
+           FROM v2_job WHERE id = $1"#,
+        job_id
+    )
+    .fetch_optional(db)
+    .await
+    {
+        Ok(r) => r,
+        Err(e) => {
+            tracing::error!("git sync-check: failed to read job args: {e:#}");
+            return;
+        }
+    };
+    let Some(row) = row else {
+        return;
+    };
+    // A PR dry-run and a deploy pull are mutually exclusive markers.
+    let (is_deploy, marker) = match (row.pr, row.deploy) {
+        (Some(pr), _) => (false, pr),
+        (None, Some(deploy)) => (true, deploy),
+        (None, None) => return,
+    };
+    let Ok(check) = serde_json::from_value::<GitSyncCheck>(marker) else {
+        return;
+    };
+    // "In sync" on a PR that visibly changes files reads as a bug when those
+    // files are outside the repo's sync filters — say what the scope is.
+    let scope_note = if !is_deploy && success {
+        git_sync_repo_scope_note(db, workspace_id, row.repo_path.as_deref()).await
+    } else {
+        None
+    };
+
+    let (conclusion, title, summary): (&str, String, String) = if is_deploy {
+        // Phase 6: real deploy pull -> "Deployed N changes" / "In sync" / failure.
+        if !success {
+            (
+                "failure",
+                format!("Deploy to {} failed", workspace_id),
+                "Deploying the latest commit failed. See the job in Windmill for details."
+                    .to_string(),
+            )
+        } else {
+            match parse_git_sync_changes(result_raw) {
+                Some((changes, settings_changed)) if changes.is_empty() && !settings_changed => (
+                    "success",
+                    format!("In sync with {}", workspace_id),
+                    format!(
+                        "No changes to deploy to `{}` from this commit.",
+                        workspace_id
+                    ),
+                ),
+                Some((changes, settings_changed)) => {
+                    let mut lines = vec![format!(
+                        "Deployed {} change(s) to `{}`:\n",
+                        changes.len(),
+                        workspace_id
+                    )];
+                    lines.extend(format_change_list(&changes));
+                    if settings_changed {
+                        lines.push("\nWorkspace settings also changed.".to_string());
+                    }
+                    (
+                        "success",
+                        format!("Deployed {} change(s) to {}", changes.len(), workspace_id),
+                        lines.join("\n"),
+                    )
+                }
+                None => (
+                    "success",
+                    format!("Deployed to {}", workspace_id),
+                    format!("Windmill deployed the latest commit to `{}`.", workspace_id),
+                ),
+            }
+        }
+    } else {
+        // Phase 4: dry-run diff preview for a PR.
+        if !success {
+            (
+                "failure",
+                "Windmill diff failed".to_string(),
+                "The dry-run pull to compute the diff failed. See the job in Windmill for details."
+                    .to_string(),
+            )
+        } else {
+            match parse_git_sync_changes(result_raw) {
+                Some((changes, settings_changed)) if changes.is_empty() && !settings_changed => (
+                    "success",
+                    "In sync".to_string(),
+                    format!(
+                        "Merging this PR would make no changes to the workspace.{}",
+                        scope_note.as_deref().unwrap_or_default()
+                    ),
+                ),
+                Some((changes, settings_changed)) => {
+                    let mut lines = vec![format!(
+                        "Merging this PR would apply {} change(s) to the workspace:\n",
+                        changes.len()
+                    )];
+                    lines.extend(format_change_list(&changes));
+                    if settings_changed {
+                        lines.push(match check.wmill_yaml_changed {
+                            Some(true) => "\nThis PR changes wmill.yaml: pulling also applies the updated workspace settings.".to_string(),
+                            Some(false) => "\nIndependent of this PR, the workspace's git-sync settings differ from the repo's wmill.yaml and a pull updates them to match.".to_string(),
+                            None => "\nA pull also updates the workspace's git-sync settings to match the repo's wmill.yaml.".to_string(),
+                        });
+                    }
+                    (
+                        "neutral",
+                        format!("{} change(s) to deploy", changes.len()),
+                        lines.join("\n"),
+                    )
+                }
+                None => (
+                    "neutral",
+                    "Diff computed".to_string(),
+                    "Windmill computed a diff but could not summarize it.".to_string(),
+                ),
+            }
+        }
+    };
+
+    if let Err(e) = windmill_common::git_sync_ee::update_check_run(
+        db,
+        workspace_id,
+        &check.repo_url,
+        check.check_run_id,
+        conclusion,
+        &title,
+        &summary,
+    )
+    .await
+    {
+        tracing::error!("git sync-check: failed to update check run: {e:#}");
+    }
+
+    // Phase 4 also maintains ONE managed comment on the PR (Cloudflare
+    // deploy-preview style): upserted on every synchronize, so reviewers see the
+    // current diff without opening the Checks tab.
+    if !is_deploy {
+        if let Some(pr_number) = check.pr_number {
+            let marker = "<!-- windmill-diff -->";
+            let head = check
+                .head_sha
+                .as_deref()
+                .map(|s| &s[..s.len().min(7)])
+                .unwrap_or("latest");
+            let body = format!(
+                "{marker}\n### Windmill deploy preview\n\n| | |\n|---|---|\n| **Workspace** | `{workspace_id}` |\n| **Status** | {title} |\n| **Commit** | `{head}` |\n\n<details><summary>Details</summary>\n\n{summary}\n\n</details>"
+            );
+            if let Err(e) = windmill_common::git_sync_ee::upsert_pr_comment(
+                db,
+                workspace_id,
+                &check.repo_url,
+                pr_number,
+                marker,
+                &body,
+            )
+            .await
+            {
+                tracing::warn!("git sync-check: failed to upsert PR diff comment: {e:#}");
+            }
+        }
+    }
+}
+
 pub async fn process_completed_job(
     JobCompleted {
         job,
@@ -826,6 +1474,11 @@ pub async fn process_completed_job(
             from_cache.unwrap_or(false),
         )
         .await?;
+        #[cfg(all(feature = "enterprise", feature = "private"))]
+        if job.kind == JobKind::DeploymentCallback {
+            maybe_post_git_sync_check(db, &job_id, &workspace_id, true, result.get()).await;
+            maybe_open_git_sync_deploy_pr(db, &job_id, &workspace_id, result.get()).await;
+        }
 
         // Asset-trigger fan-out: best-effort, never propagates errors.
         // Internal eligibility checks gate to top-level Script/Preview runs;
@@ -933,6 +1586,11 @@ pub async fn process_completed_job(
             .await?;
             Arc::new(serde_json::value::to_raw_value(&wrapped).unwrap())
         };
+        #[cfg(all(feature = "enterprise", feature = "private"))]
+        if job.kind == JobKind::DeploymentCallback {
+            maybe_post_git_sync_check(db, &job.id, &job.workspace_id, false, result.get()).await;
+            maybe_reconcile_git_sync_auto_pull(db, &job.id, &job.workspace_id, false).await;
+        }
         if job.is_flow_step() {
             if let Some(parent_job) = job.parent_job {
                 tracing::error!(parent_flow = %parent_job, subflow = %job.id, "process completed job error, updating flow status");
@@ -1359,3 +2017,207 @@ pub fn extract_error_value(
         exit_code: Some(i),
     });
 }
+
+#[cfg(all(test, feature = "enterprise", feature = "private"))]
+mod git_sync_pr_tests {
+    use super::{git_sync_deploy_pr_head_branch, git_sync_push_result_pushed};
+
+    #[test]
+    fn user_and_group_items_get_no_promotion_branch() {
+        for path_type in ["user", "group"] {
+            assert_eq!(
+                git_sync_deploy_pr_head_branch(
+                    "ws",
+                    None,
+                    None,
+                    "main",
+                    true,
+                    false,
+                    "u/someone",
+                    "",
+                    path_type
+                ),
+                None
+            );
+        }
+    }
+
+    #[test]
+    fn scope_note_lists_filters() {
+        use super::format_git_sync_scope_note;
+        assert_eq!(format_git_sync_scope_note(&[], &[]), None);
+        assert_eq!(
+            format_git_sync_scope_note(&["f/**".into()], &[]).unwrap(),
+            "\n\nOnly files matching this repository's sync filters deploy on merge: `f/**`."
+        );
+        assert_eq!(
+            format_git_sync_scope_note(&["f/**".into(), "u/**".into()], &["f/pat/**".into()])
+                .unwrap(),
+            "\n\nOnly files matching this repository's sync filters deploy on merge: `f/**`, `u/**` (excluding `f/pat/**`)."
+        );
+    }
+
+    #[test]
+    fn push_result_pushed_flag() {
+        assert_eq!(
+            git_sync_push_result_pushed(r#"{"pushed": true}"#),
+            Some(true)
+        );
+        assert_eq!(
+            git_sync_push_result_pushed(r#"{"pushed": false}"#),
+            Some(false)
+        );
+        // Older hub script versions return null / no flag: undetermined.
+        assert_eq!(git_sync_push_result_pushed("null"), None);
+        assert_eq!(git_sync_push_result_pushed(r#"{"other": 1}"#), None);
+        assert_eq!(git_sync_push_result_pushed("not json"), None);
+    }
+
+    #[test]
+    fn fork_branch_wins_and_strips_the_id_prefix() {
+        // Generated fork id: branch suffix drops the wm-fork- prefix.
+        assert_eq!(
+            git_sync_deploy_pr_head_branch(
+                "wm-fork-abc",
+                Some("prod"),
+                None,
+                "main",
+                false,
+                false,
+                "",
+                "",
+                ""
+            ),
+            Some("wm-fork/main/abc".to_string())
+        );
+        // Dev workspace (prefix-less id, detected via parent): verbatim suffix.
+        assert_eq!(
+            git_sync_deploy_pr_head_branch(
+                "staging",
+                Some("prod"),
+                None,
+                "main",
+                false,
+                false,
+                "",
+                "",
+                ""
+            ),
+            Some("wm-fork/main/staging".to_string())
+        );
+        // Orphaned fork (parent deleted): the id prefix still identifies it.
+        assert_eq!(
+            git_sync_deploy_pr_head_branch(
+                "wm-fork-abc",
+                None,
+                None,
+                "main",
+                true,
+                false,
+                "f/x/y",
+                "",
+                "script"
+            ),
+            Some("wm-fork/main/abc".to_string())
+        );
+    }
+
+    #[test]
+    fn promotion_branch_matches_the_hub_script_formula() {
+        // Per-item form: wm_deploy/<ws>/<path_type>/<path with / -> __>.
+        assert_eq!(
+            git_sync_deploy_pr_head_branch(
+                "dev",
+                None,
+                None,
+                "main",
+                true,
+                false,
+                "f/folder/my_script",
+                "",
+                "script"
+            ),
+            Some("wm_deploy/dev/script/f__folder__my_script".to_string())
+        );
+        // Grouped-by-folder form: first two path segments joined by __.
+        assert_eq!(
+            git_sync_deploy_pr_head_branch(
+                "dev",
+                None,
+                None,
+                "main",
+                true,
+                true,
+                "f/folder/my_script",
+                "",
+                "script"
+            ),
+            Some("wm_deploy/dev/f__folder".to_string())
+        );
+        // Renamed object: falls back to the parent path.
+        assert_eq!(
+            git_sync_deploy_pr_head_branch(
+                "dev",
+                None,
+                None,
+                "main",
+                true,
+                false,
+                "",
+                "f/folder/old",
+                "script"
+            ),
+            Some("wm_deploy/dev/script/f__folder__old".to_string())
+        );
+    }
+
+    #[test]
+    fn no_branch_when_deploy_stays_on_base() {
+        // Workspace-wide mode commits straight to the tracked branch.
+        assert_eq!(
+            git_sync_deploy_pr_head_branch(
+                "dev", None, None, "main", false, false, "f/x/y", "", "script"
+            ),
+            None
+        );
+        // Promotion mode but no per-item ref (e.g. user/group objects).
+        assert_eq!(
+            git_sync_deploy_pr_head_branch("dev", None, None, "main", true, false, "", "", "user"),
+            None
+        );
+    }
+
+    #[test]
+    fn dev_workspace_label_branch_wins() {
+        // Dev workspaces deploy to their environment-label branch verbatim.
+        assert_eq!(
+            git_sync_deploy_pr_head_branch(
+                "staging-ws",
+                Some("prod"),
+                Some("staging"),
+                "main",
+                false,
+                false,
+                "",
+                "",
+                ""
+            ),
+            Some("staging".to_string())
+        );
+        // Label present even on a wm-fork-prefixed id: label still wins.
+        assert_eq!(
+            git_sync_deploy_pr_head_branch(
+                "wm-fork-x",
+                Some("prod"),
+                Some("dev"),
+                "main",
+                false,
+                false,
+                "",
+                "",
+                ""
+            ),
+            Some("dev".to_string())
+        );
+    }
+}
diff --git a/cli/src/commands/sync/sync.ts b/cli/src/commands/sync/sync.ts
index 65ce10eaad..2ff98dbb8d 100644
--- a/cli/src/commands/sync/sync.ts
+++ b/cli/src/commands/sync/sync.ts
@@ -2779,6 +2779,8 @@ export async function pull(
       gitDeployItems?: string;
       onlyCreateBranch?: boolean;
       parentWorkspaceId?: string;
+      devWorkspaceLabel?: string;
+      parentDevWorkspaceLabel?: string;
       gitCommitterEmail?: string;
       gitCommitterName?: string;
     },
@@ -2847,37 +2849,55 @@ export async function pull(
     }
     const clonedBranchName = getCurrentGitBranch() ?? "main";
 
-    // Fork workspaces force-disable use_individual_branch / group_by_folder
-    // (1:1 with the hub script's inner()).
-    const targetIsFork = isForkWorkspace(workspace.workspaceId);
+    // Fork / dev workspaces force-disable use_individual_branch / group_by_folder
+    // (1:1 with the hub script's inner()). Dev workspaces have a prefix-less id, so
+    // detect them via the parent-workspace id the backend passes.
+    const targetIsFork = isForkWorkspace(
+      workspace.workspaceId,
+      opts.parentWorkspaceId,
+    );
     const useIndividualBranch = targetIsFork
       ? false
       : !!opts.useIndividualBranch;
     const groupByFolder = targetIsFork ? false : !!opts.groupByFolder;
 
-    // Fork-of-a-fork: only when the parent workspace is itself a fork, root
-    // the new branch on the parent's fork branch (mirrors the hub script's
-    // `parent_workspace_id?.startsWith(FORKED_…)` gate).
-    if (opts.parentWorkspaceId && isForkWorkspace(opts.parentWorkspaceId)) {
-      const parentBranch = computeGitSyncDeployBranch({
-        workspaceId: opts.parentWorkspaceId,
-        items: deployItems,
-        useIndividualBranch,
-        groupByFolder,
-        clonedBranchName,
-      });
-      if (parentBranch && parentBranch !== clonedBranchName) {
-        checkoutGitSyncDeployBranch(parentBranch);
-      }
+    // Fork-of-a-fork: when the parent workspace is itself a fork, root the new
+    // branch on the parent's fork branch (the content this fork diverged from).
+    // A dev-workspace parent has a prefix-less id the prefix check can't see, so
+    // the backend passes its environment label; its branch is the label verbatim.
+    const parentBranch = opts.parentDevWorkspaceLabel
+      ? opts.parentDevWorkspaceLabel
+      : opts.parentWorkspaceId && isForkWorkspace(opts.parentWorkspaceId)
+        ? computeGitSyncDeployBranch({
+            workspaceId: opts.parentWorkspaceId,
+            items: deployItems,
+            useIndividualBranch,
+            groupByFolder,
+            clonedBranchName,
+          })
+        : null;
+    if (parentBranch && parentBranch !== clonedBranchName) {
+      checkoutGitSyncDeployBranch(parentBranch);
     }
 
     const deployBranch = computeGitSyncDeployBranch({
       workspaceId: workspace.workspaceId,
+      parentWorkspaceId: opts.parentWorkspaceId,
+      devWorkspaceLabel: opts.devWorkspaceLabel,
       items: deployItems,
       useIndividualBranch,
       groupByFolder,
       clonedBranchName,
     });
+    // A dev workspace whose environment-label branch equals the repository's
+    // tracked branch would silently commit the fork's content straight to the
+    // tracked branch. Refuse instead of deploying in place.
+    if (targetIsFork && deployBranch && deployBranch === clonedBranchName) {
+      log.error(
+        `Fork branch '${deployBranch}' equals the checked-out branch '${clonedBranchName}'; refusing to deploy a fork directly to the tracked branch. Use a different dev workspace label or tracked branch.`,
+      );
+      process.exit(1);
+    }
     if (deployBranch && deployBranch !== clonedBranchName) {
       checkoutGitSyncDeployBranch(deployBranch);
     }
@@ -3394,6 +3414,8 @@ export async function gitDeploy(
       groupByFolder?: boolean;
       onlyCreateBranch?: boolean;
       parentWorkspaceId?: string;
+      devWorkspaceLabel?: string;
+      parentDevWorkspaceLabel?: string;
       skipSecrets?: boolean;
       gitCommitterEmail?: string;
       gitCommitterName?: string;
@@ -3409,11 +3431,12 @@ export async function gitDeploy(
     }
   }
 
-  // Fork workspaces force-disable use_individual_branch / group_by_folder
-  // (1:1 with the hub script's inner()): a fork always syncs to its own
+  // Fork / dev workspaces force-disable use_individual_branch / group_by_folder
+  // (1:1 with the hub script's inner()): they always sync to their own
   // wm-fork/<branch>/<id> branch, and — critically — that disabling also
-  // flips the include/promotion derivation below.
-  const isFork = isForkWorkspace(opts.workspace ?? "");
+  // flips the include/promotion derivation below. Dev workspaces have a
+  // prefix-less id, so detect them via the parent-workspace id too.
+  const isFork = isForkWorkspace(opts.workspace ?? "", opts.parentWorkspaceId);
   const useIndividualBranch = isFork ? false : !!opts.useIndividualBranch;
 
   // Derive the include filters from the deployed items (replaces the hub
@@ -5304,6 +5327,14 @@ const command = new Command()
     "--parent-workspace-id <id:string>",
     "Parent workspace id, used to root a fork-of-a-fork branch",
   )
+  .option(
+    "--dev-workspace-label <label:string>",
+    "Environment label of a dev workspace (dev/staging); its deploys go to that branch",
+  )
+  .option(
+    "--parent-dev-workspace-label <label:string>",
+    "Environment label of the parent dev workspace; roots a fork-of-dev branch on it",
+  )
   .option("--skip-secrets", "Skip syncing only secrets variables")
   .option(
     "--git-committer-email <email:string>",
diff --git a/cli/src/utils/git.ts b/cli/src/utils/git.ts
index 65e4064a29..342222ed1b 100644
--- a/cli/src/utils/git.ts
+++ b/cli/src/utils/git.ts
@@ -107,25 +107,40 @@ export interface GitSyncDeployItem {
   commit_msg?: string;
 }
 
-// A workspace id of the form "wm-fork-<id>" is a fork workspace. The hub
-// script force-disables use_individual_branch / group_by_folder for forks
-// (a fork always syncs to its own wm-fork/<branch>/<id> branch), and that
-// disabling also changes the include/promotion derivation — so callers must
-// apply it BEFORE deriving includes, not just for branch naming.
-export function isForkWorkspace(workspaceId: string): boolean {
-  return workspaceId.startsWith(FORK_WORKSPACE_PREFIX);
+// A fork or dev workspace syncs to its own wm-fork/<branch>/<id> branch. The hub
+// script force-disables use_individual_branch / group_by_folder for these (that
+// disabling also changes the include/promotion derivation — so callers must apply
+// it BEFORE deriving includes, not just for branch naming).
+//
+// Fork-ness is "has a parent workspace" OR the "wm-fork-" id prefix. Regular forks
+// get an auto-generated `wm-fork-<slug>` id, but dev workspaces keep a custom id
+// with no prefix — so the prefix alone misses them. Mirrors the backend's
+// `parent.is_some() || starts_with(WM_FORK_PREFIX)` rule (the prefix also covers a
+// fork whose parent was deleted, since parent_workspace_id is ON DELETE SET NULL).
+export function isForkWorkspace(
+  workspaceId: string,
+  parentWorkspaceId?: string | null,
+): boolean {
+  return !!parentWorkspaceId || workspaceId.startsWith(FORK_WORKSPACE_PREFIX);
 }
 
-// Mirrors the hub script's get_fork_branch_name: "wm-fork-<id>" becomes
-// "wm-fork/<originalBranch>/<id>".
+// Mirrors the hub script's get_fork_branch_name. A dev workspace syncs with its
+// environment-label branch verbatim ("dev"/"staging" — a first-class top-level
+// branch; the backend passes the label with the deploy). A `wm-fork-<slug>`
+// throwaway fork id becomes "wm-fork/<originalBranch>/<slug>"; a prefix-less id
+// without a label falls back to "wm-fork/<originalBranch>/<id>".
 export function forkBranchName(
   workspaceId: string,
   originalBranch: string,
+  devWorkspaceLabel?: string | null,
 ): string {
-  return workspaceId.replace(
-    FORK_WORKSPACE_PREFIX,
-    `${WM_FORK_PREFIX}/${originalBranch}/`,
-  );
+  if (devWorkspaceLabel) {
+    return devWorkspaceLabel;
+  }
+  const branchPrefix = `${WM_FORK_PREFIX}/${originalBranch}/`;
+  return workspaceId.startsWith(FORK_WORKSPACE_PREFIX)
+    ? workspaceId.replace(FORK_WORKSPACE_PREFIX, branchPrefix)
+    : `${branchPrefix}${workspaceId}`;
 }
 
 // Pure branch-name resolution mirroring the hub script's git_checkout_branch.
@@ -133,6 +148,8 @@ export function forkBranchName(
 // workspace-wide mode, or user/group objects which never get their own branch).
 export function computeGitSyncDeployBranch(params: {
   workspaceId: string;
+  parentWorkspaceId?: string | null;
+  devWorkspaceLabel?: string | null;
   items: GitSyncDeployItem[];
   useIndividualBranch: boolean;
   groupByFolder: boolean;
@@ -140,14 +157,16 @@ export function computeGitSyncDeployBranch(params: {
 }): string | null {
   const {
     workspaceId,
+    parentWorkspaceId,
+    devWorkspaceLabel,
     items,
     useIndividualBranch,
     groupByFolder,
     clonedBranchName,
   } = params;
 
-  if (workspaceId.startsWith(FORK_WORKSPACE_PREFIX)) {
-    return forkBranchName(workspaceId, clonedBranchName);
+  if (isForkWorkspace(workspaceId, parentWorkspaceId)) {
+    return forkBranchName(workspaceId, clonedBranchName, devWorkspaceLabel);
   }
 
   if (items.length === 0) return null;
diff --git a/cli/test/git_unit.test.ts b/cli/test/git_unit.test.ts
index eb4772c6ee..4b6cf464e2 100644
--- a/cli/test/git_unit.test.ts
+++ b/cli/test/git_unit.test.ts
@@ -104,6 +104,19 @@ describe("computeGitSyncDeployBranch", () => {
     expect(branch).not.toBe("main");
   });
 
+  test("dev workspace (parent + label) deploys to the label branch", () => {
+    expect(
+      computeGitSyncDeployBranch({
+        ...base,
+        workspaceId: "staging-ws",
+        parentWorkspaceId: "prod",
+        devWorkspaceLabel: "staging",
+        useIndividualBranch: false,
+        items: [{ path_type: "script", path: "f/foo/bar" }],
+      })
+    ).toBe("staging");
+  });
+
   test("use_individual_branch=false -> null (stay on base/main, workspace-wide mode)", () => {
     expect(
       computeGitSyncDeployBranch({
@@ -173,12 +186,34 @@ describe("computeGitSyncDeployBranch", () => {
       })
     ).toBe("wm-fork/main/myfork");
   });
+
+  test("prefix-less fork (parent set, no label) beats the wm_deploy derivation", () => {
+    expect(
+      computeGitSyncDeployBranch({
+        workspaceId: "mydev",
+        parentWorkspaceId: "prod",
+        clonedBranchName: "main",
+        groupByFolder: false,
+        useIndividualBranch: true,
+        items: [{ path_type: "script", path: "f/foo/bar" }],
+      })
+    ).toBe("wm-fork/main/mydev");
+  });
 });
 
 describe("forkBranchName", () => {
   test("maps wm-fork-<id> to wm-fork/<branch>/<id>", () => {
     expect(forkBranchName("wm-fork-abc", "main")).toBe("wm-fork/main/abc");
   });
+
+  test("dev workspace label wins: the branch is the label verbatim", () => {
+    expect(forkBranchName("staging-ws", "main", "staging")).toBe("staging");
+    expect(forkBranchName("wm-fork-abc", "main", "dev")).toBe("dev");
+  });
+
+  test("prefix-less id without a label falls back to the wm-fork form", () => {
+    expect(forkBranchName("staging-ws", "main")).toBe("wm-fork/main/staging-ws");
+  });
 });
 
 describe("composeGitSyncCommitHeader", () => {
@@ -339,6 +374,12 @@ describe("isForkWorkspace", () => {
     // "wm-fork" without the trailing dash is the BRANCH prefix, not a ws id
     expect(isForkWorkspace("wm-fork")).toBe(false);
   });
+
+  test("a parent workspace id marks prefix-less ids (dev workspaces) as forks", () => {
+    expect(isForkWorkspace("mydev", "prod")).toBe(true);
+    expect(isForkWorkspace("mydev", undefined)).toBe(false);
+    expect(isForkWorkspace("wm-fork-abc", undefined)).toBe(true);
+  });
 });
 
 describe("gitSyncCommitMessage (mirrors hub git_push quirks)", () => {
diff --git a/docs/git-sync-github-app-permissions.md b/docs/git-sync-github-app-permissions.md
new file mode 100644
index 0000000000..f7f928f452
--- /dev/null
+++ b/docs/git-sync-github-app-permissions.md
@@ -0,0 +1,34 @@
+# Windmill GitHub App: why the new permissions
+
+Windmill is moving the git sync work it used to ask you to run as a GitHub Action
+into the app itself, so two-way sync works out of the box. That needs a few more
+permissions. They are all scoped to the repositories you install the app on, and
+they do not grant any new access to your code beyond what the app already has.
+
+| Permission (Read and write) | What it enables |
+| --- | --- |
+| Repository webhooks | Create a webhook so pushes deploy to your Windmill workspace instantly, replacing the push-to-Windmill GitHub Action. |
+| Pull requests | Open the promotion / fork pull requests for you, replacing the `gh pr create` GitHub Action. |
+| Checks | Post a "Windmill diff" check on a pull request showing what it would change in the workspace. |
+
+Windmill creates a per-repository webhook on each connected repo and sets its
+events (`push`, plus `pull_request` for checks) itself, so you do not need to
+change the app-level "Subscribe to events" list. The events are only available
+because the permissions above are granted.
+
+Approving is safe and reversible, and each feature is opt-in from the workspace's
+git sync settings. Existing sync and any GitHub Actions workflows keep working
+unchanged while the update is pending; if automatic pull is enabled on a
+repository before the webhook permission is granted, Windmill checks the tracked
+branch about every minute until it can register the webhook.
+
+## Self-managed apps (GitHub Enterprise Server)
+
+The features work identically through a self-managed app: every API call uses the
+app's own endpoint (`https://<ghes-host>/api/v3`). The difference is that there is
+no update to approve, since you own the app: grant the three permissions above in
+your app's settings (Settings → Developer settings → GitHub Apps → Permissions &
+events) and accept the permission update on the installation. Webhooks are still
+created per repository by Windmill, so the app-level "Subscribe to events" list
+needs no changes, and your Windmill base URL only needs to be reachable from the
+GHES host, not from the public internet.
diff --git a/docs/git-sync-pull-design.md b/docs/git-sync-pull-design.md
new file mode 100644
index 0000000000..8961b0f047
--- /dev/null
+++ b/docs/git-sync-pull-design.md
@@ -0,0 +1,655 @@
+# Design: Automatic git → Windmill sync (pull-based)
+
+Status: draft for review — exploration on branch `explore-git-sync-improvements`
+
+## 1. Problem
+
+Git sync is guided and automatic in one direction only. Windmill → repo is fully
+managed: every deploy enqueues a `deploymentcallback` job that runs the hub sync
+script and commits to the repo. The reverse direction (repo → Windmill) requires
+each customer to install a GitHub Action that runs `wmill sync push` with a
+long-lived Windmill token stored as a repo secret, against an instance URL that
+GitHub-hosted runners must be able to reach.
+
+This breaks down because each customer runs their own instance:
+
+| Customer setup                      | GH runner → instance | GitHub webhook → instance | Instance → GitHub |
+| ----------------------------------- | -------------------- | ------------------------- | ----------------- |
+| Windmill cloud                      | ✅                   | ✅                        | ✅                |
+| Self-hosted, public URL             | ✅                   | ✅                        | ✅                |
+| Self-hosted behind VPN/firewall     | ❌                   | ❌                        | ✅                |
+| GHES on the same private network    | ❌ (github.com runners) | ✅                     | ✅                |
+
+Only instance → GitHub outbound works for everyone. The current GH Action design
+sits in the worst column; it also requires manual workflow-file installation,
+token provisioning, and ongoing maintenance per customer.
+
+## 2. Current state (what already exists)
+
+The building blocks are mostly shipped:
+
+- **Instance-side pull already works.** `PullWorkspaceModal.svelte` runs the hub
+  init script (`hubPaths.gitInitRepo`) with `pull: true`, `dry_run` preview, and
+  `use_promotion_overrides` as a worker job. It clones the repo with the repo
+  credentials and applies the diff to the workspace. It is manual-only today.
+- **Managed GitHub App.** `windmill-sync-helper` (github.com / *.ghe.com) is
+  installed by the customer; installation tokens are minted by the customer
+  portal (`windmill-customer-service`, route `/github_sync/token`) against a JWT
+  the instance stores per installation (`workspace_settings.git_app_installations`,
+  token logic in `backend/windmill-common/src/git_sync_ee.rs`). The portal is
+  stateless: it keeps no installation registry and receives no webhooks.
+- **Self-managed app for GHES.** Customers create their own GitHub App; app id +
+  private key live in instance settings (`GhesAppSettings.svelte`,
+  `get_self_managed_installation_token`). The current setup checklist tells the
+  customer to leave the app webhook **inactive**.
+- **Webhook machinery.** The native GitHub trigger already creates/deletes repo
+  webhooks via the REST API (`windmill-native-triggers/src/github/external.rs`)
+  and GitHub HMAC (`X-Hub-Signature-256`) verification exists in
+  `windmill-trigger-http/src/http_trigger_auth.rs`.
+- **Loop prevention convention.** Windmill-authored commits carry a `[WM]`
+  prefix so CI can ignore them.
+- **Promotion plumbing.** The CLI implements `--promotion <branch>` resolving
+  `promotionOverrides` from `wmill.yaml`; the pull job already accepts
+  `use_promotion_overrides`. PR creation on `wm_deploy/**` branches is done by a
+  documented GH Action (`gh pr create`), not by Windmill.
+
+What is missing is only the **trigger** (push event → pull job), the **routing**
+(event ref → workspace), and **PR creation** moving instance-side for
+promotion/fork parity.
+
+## 3. Goals / non-goals
+
+Goals:
+
+- Zero-CI automatic repo → Windmill deployment: install app, pick repo, done.
+- Works for every connectivity profile, degrading gracefully from instant
+  (webhook) to near-real-time (polling).
+- Cover all documented setups: basic sync, multi-repo, promotion mode
+  (single- and cross-instance), workspace forks, local-dev git entry.
+- No new credentials handed to GitHub (no Windmill tokens as repo secrets).
+- Coexist with customer CI: customers who keep the GH Action lose nothing.
+
+Non-goals (this design):
+
+- Replacing customer CI pipelines (tests, lint, custom gates).
+- A central event-relay through the portal (delivering the managed app's
+  webhook centrally and forwarding to instances). Considered and rejected for
+  v1 in favor of programmatic repo webhooks; the portal stays a stateless token
+  minter. See §16 for the comparison.
+- GitLab/Bitbucket/Azure DevOps parity. The polling tier covers them
+  credential-wise; their webhook tiers are follow-ups.
+
+## 4. Design overview
+
+```mermaid
+flowchart LR
+  subgraph GitHub
+    R[Repo] -- "push event" --> W[repo webhook<br/>created via API]
+  end
+  subgraph Instance
+    W -- "HMAC-verified POST" --> E["/api/w/:ws/github_app/webhook"]
+    P[poller<br/>git ls-remote / schedule] --> REC
+    E --> REC[reconcile:<br/>ref match? sha moved?<br/>debounce]
+    REC --> J[pull job<br/>existing hub script, pull:true]
+    J --> WS[(workspace)]
+  end
+```
+
+One principle drives the security model: **webhooks and polls are hints, the
+pull is authoritative.** A trigger never carries content; it only causes the
+instance to compare the remote HEAD against `last_synced_sha` using its own
+credentials and enqueue the existing pull job if the branch moved. A forged or
+replayed trigger can only cause a cheap no-op reconcile.
+
+## 5. Trigger tier 1 — webhooks
+
+### 5.1 Managed app (github.com, GHE Cloud orgs)
+
+A GitHub App's own webhook URL is fixed app-wide (it points at the portal), so
+per-instance delivery uses **repository webhooks** created dynamically with the
+installation token (`POST /repos/{owner}/{repo}/hooks`). Requires adding the
+**Repository webhooks: read & write** permission to `windmill-sync-helper`
+(see §9).
+
+Flow when a repo is connected (or auto-pull is enabled on an existing repo):
+
+1. Instance generates a per-repo secret, stored in the repo's git-sync settings.
+2. Instance creates the webhook via API: events `["push"]` (later
+   `"pull_request"`, §11), URL
+   `{base_url}/api/w/{workspace}/github_app/webhook` (host-aware, so managed and
+   self-managed/GHES apps use the same per-workspace receiver), secret set.
+3. GitHub immediately delivers a `ping` event. If the ping is not received
+   within ~10 s, the instance deletes the hook and falls back to polling,
+   surfacing "instance not reachable from GitHub — using polling (interval Xm)"
+   in the UI. This doubles as an automatic reachability test; no guessing about
+   firewalls.
+4. Incoming deliveries are verified with `X-Hub-Signature-256` against the
+   stored secret (reuse the HMAC code from `http_trigger_auth.rs`), then handed
+   to the reconciler (§7).
+
+Webhook lifecycle: deleted when the repo is disconnected or auto-pull disabled
+(reuse the delete pattern from `workspace_integrations.rs`); recreated on
+settings change; orphan hooks are detectable via `GET /repos/.../hooks` filtered
+by our URL prefix.
+
+### 5.2 Self-managed app (GHES, *.ghe.com data residency)
+
+The customer owns the app, so the **app-level webhook** can point directly at
+the instance — no repo hooks needed, one webhook covers all installed repos:
+
+- `GhesAppSettings` gains a "Webhook secret" field; the setup checklist changes
+  from "Uncheck Active under Webhook" to "set webhook URL to
+  `{base_url}/api/w/{workspace}/github_app/webhook` (the per-workspace receiver),
+  subscribe to Push events, paste this generated secret".
+- That per-workspace endpoint verifies HMAC with the configured secret and
+  routes by repo full name + installation to matching workspaces (the routing
+  data is in `workspace_settings`).
+- GHES typically shares a network with the instance, so this works **air-gapped**
+  — the hardest github.com case is the easiest GHES case.
+
+Polish (optional, recommended): replace the 8-step manual app-creation checklist
+with the [GitHub App Manifest flow](https://docs.github.com/en/apps/sharing-github-apps/registering-a-github-app-from-a-manifest)
+(supported on GHES), which pre-configures permissions, events, and webhook
+URL/secret in one click and eliminates checklist drift.
+
+## 6. Trigger tier 2 — polling fallback
+
+For private instances, plain token/SSH credentials (no app), and
+permission-not-yet-approved installs:
+
+- Per auto-pull-enabled repo, on a configurable interval (default 60 s,
+  surfaced in settings), run `git ls-remote <repo> <tracked refs>` and compare
+  against `last_synced_sha` per ref. `ls-remote` is a single cheap round-trip;
+  no clone.
+- Implemented as an internal scheduled task keyed by repo settings id (not a
+  user-visible schedule), running on workers like other background jobs.
+- Polling is also the safety net under webhooks (missed deliveries, GitHub
+  outages): when a webhook is active, the poll interval relaxes (e.g. 10 min)
+  rather than turning off. This is the ArgoCD model: poll for correctness,
+  webhook for latency.
+
+## 7. Reconcile and pull semantics
+
+Routing — an event/poll result is `(repo, ref, head_sha, sender)`:
+
+- **Tracked branch** (basic sync): ref equals the repo settings branch →
+  pull into the owning workspace.
+- **Promotion target branch**: ref equals a repo's promotion target → pull with
+  `use_promotion_overrides: true` (resolves `promotionOverrides` from
+  `wmill.yaml`, mirroring CLI `--promotion`).
+- **Fork branches** `wm-fork/<parent-branch>/<fork-name>`: parse the branch
+  name, route to the fork workspace if it exists; ignore (log) if not.
+- **Anything else**: ignore.
+- Matching keys on repo + `workspace_id` — never `base_url` (avoids the known
+  internal-vs-public URL mismatch that breaks CLI workspace matching).
+- One repo may match several workspaces (team partitioning with different path
+  filters): fan out, each workspace pulls with its own filters; `wmill.yaml` in
+  the repo stays authoritative for include/exclude.
+
+Loop prevention (pull → deploys → deployment callback → commit → push event):
+
+1. Skip events whose sender is the app bot (`windmill-sync-helper[bot]` /
+   the GHES app's bot) or whose head commit message carries the `[WM]` prefix.
+2. Compare `head_sha` to `last_synced_sha` before enqueuing; the pull job
+   records the synced sha on success.
+3. Deploys applied by the pull job are tagged so the deployment callback can
+   skip the no-op commit (belt and braces — the diff should be empty anyway).
+
+Concurrency and debounce:
+
+- At most one pull job per (repo, workspace) at a time; rapid pushes coalesce
+  (same pattern as the 5 s deploy-callback batching, keyed on repo).
+- Pulls and in-flight Windmill → repo commits on the same branch serialize on
+  the same key to avoid races.
+
+Execution: reuse the existing pull path of the hub init script for v1. Two known
+fragilities to fix as part of making this an unattended automation:
+
+- The hub script pins a `windmill-cli` version; pin lag has caused 422s against
+  newer backends. The automated path must pin the CLI to the instance's own
+  version (or the pull logic moves into the backend natively as a v2).
+- Failures must be visible: pull jobs appear in the runs list like deployment
+  callbacks today (`/runs?job_kinds=deploymentcallbacks` equivalent), plus a
+  per-repo "last sync" status chip in git-sync settings and the workspace error
+  handler firing on repeated failures.
+
+## 8. Settings and schema
+
+Per-repo (`GitRepositorySettings`, `workspace_settings.git_sync`):
+
+```text
+auto_pull:           Option<AutoPullSettings>
+  enabled:           bool
+  mode:              "webhook" | "polling" | "auto"   (auto = try webhook, fall back)
+  poll_interval_s:   Option<u32>                       (default 60; 600 when webhook active)
+  webhook_id:        Option<i64>                       (GitHub hook id, managed app)
+  webhook_secret:    Option<String>                    (encrypted; per-repo, managed app)
+  last_synced_sha:   Option<map<ref, sha>>             (per tracked ref)
+  last_pull_status:  Option<...>                       (sha, time, job id, error)
+```
+
+Instance-level (GHES app config): `webhook_secret` alongside app id/private key.
+
+No new tables; everything extends existing JSONB settings. A migration is only
+needed if we decide `last_synced_sha`/status churn doesn't belong in
+`workspace_settings` (alternative: small `git_sync_pull_state` table keyed by
+workspace + repo path — decide at implementation review).
+
+New instance endpoints (EE):
+
+- `POST /api/w/{workspace}/github_app/webhook` — per-workspace hook receiver for
+  managed and self-managed apps (host-aware), HMAC-verified, returns 202.
+- Both are unauthenticated-but-verified endpoints; rate-limited; bodies are
+  treated as hints only (§4).
+
+## 9. GitHub App permission migration
+
+New permissions needed, bundled into **one** update (each update re-prompts
+every existing installation's org admin):
+
+| Permission                  | Used for                                  | Phase |
+| --------------------------- | ----------------------------------------- | ----- |
+| Repository webhooks: write  | dynamic repo hook create/delete           | 1     |
+| Pull requests: write        | instance-side PR creation (promotion/forks) | 2   |
+| Checks: write               | PR diff preview checks                    | 3     |
+
+App-only features and their fallbacks: instant webhook sync (falls back to
+polling), in-app PR creation for deploy branches (fall back to the
+`open-pr-on-commit` / `open-pr-on-fork-commit` workflows; the toggles are
+hidden for token repos and a set-but-inert toggle logs a warning), and the PR
+diff comment/check + deploy status check (no fallback: they need the Checks
+API and `pull_request` webhook deliveries). Token/PAT repositories keep the
+full pull direction via polling.
+
+Rollout behavior: until an org approves, webhook creation fails with a
+distinguishable error → the instance shows "approval pending" and stays on
+polling. Nothing breaks; latency is the only cost. The self-managed (GHES)
+checklist/manifest gains the same permissions — no central approval involved.
+
+## 10. Setup UX
+
+The git-sync wizard (`DetectionFlow` / repo card) gains a third guided
+direction after the existing "test connection" and "initialize repo" steps:
+
+- Toggle: **"Automatically deploy changes from Git"** (per repo).
+- On enable: try webhook (ping self-test) → show resulting mode and latency
+  ("instant via webhook" / "polling every 60s — instance not reachable from
+  GitHub"), with a re-test button.
+- The success modal's current "set up GitHub Actions" doc link becomes the
+  advanced/CI path, not the default instruction.
+- Promotion-mode repos additionally show "PRs will be opened by Windmill"
+  once §11 lands.
+
+## 11. Promotion & forks parity: PR creation moves instance-side
+
+Both PR-producing branches are pushed by Windmill's own deploys — `wm_deploy/**`
+(promotion) and `wm-fork/**` (fork deploys) — so opening the PR moves into the
+**deploy pipeline** itself, per repo toggle: the push job carries a
+`__git_sync_open_pr` marker and its completion hook opens (or reopens) the PR
+via the installation token once the push has landed. Outbound-only, so it works
+for every connectivity profile — no webhook required.
+
+- Promotion: `promotion_open_prs` on the promotion repo ("Open a pull request
+  for each deploy branch").
+- Forks: `fork_open_prs` on the **parent's** sync repo ("Open a pull request
+  when a fork deploys"), read by the fork's deploy callback — parent-owned like
+  `sync_forks`, zero fork-side setup.
+
+Both default on for newly configured repos and off in storage (upgrades don't
+change behavior). `ensure_pull_request` treats an existing PR as success, so the
+documented `open-pr-on-commit` / `open-pr-on-fork-commit` Actions can stay
+installed for custom titles/CI without duplicate PRs. The merge side is already
+covered by §7 routing (push event on the target branch).
+
+## 12. Later: PR diff preview checks
+
+With `pull_request` events (webhook tier) and `checks: write`: on PR
+opened/synchronized, run the existing `dry_run: true` pull and post the diff
+summary as a check run. This replicates the CI dry-run preview with zero
+customer CI and completes the "Cloudflare Pages" experience: install app →
+merges deploy, PRs show a Windmill diff. The commit-level "Deploying… →
+Deployed" status (the other half of the Cloudflare feel) is Phase 6.
+
+## 13. Coverage vs documented setups
+
+| Documented setup                         | Covered by                                            |
+| ---------------------------------------- | ----------------------------------------------------- |
+| Basic git sync (workspace ↔ branch)      | §5/§6 trigger + existing pull job                     |
+| Multi-repo primary/secondary             | per-repo toggle; secondaries stay push-only           |
+| Promotion mode, single instance          | §7 promotion routing + §11 PR creation                |
+| Promotion mode, cross-instance           | each instance triggers independently — strictly better than CI (no cross-instance tokens/URLs) |
+| Workspace forks (`wm-fork/**`)           | §7 fork routing + Phase 5 (parent-level `sync_forks`) |
+| PR dry-run preview                       | §12 (optional follow-up)                              |
+| Local dev, git as entry point            | ordinary push events; nothing special                 |
+| Customers with real CI gates             | unchanged; pull triggers are idempotent and coexist   |
+
+## 14. Migration of existing users
+
+The defining advantage of the repo-webhook approach: **existing git-sync users
+already have the managed app installed.** Migration is "grant one incremental
+permission," not "reconnect." The windmill → repo direction uses the app's
+`Contents: write` grant, which the new `Repository webhooks: write` permission
+does not touch — so nothing existing breaks whether or not a user migrates.
+
+Existing installs are enumerable from `workspace_settings.git_app_installations`
+(each `GitInstallation` carries `installation_id`, `account_id`, and
+`github_base_url`: `None` = managed github.com app, `Some` = self-managed/GHES).
+That split is the migration cohort boundary.
+
+**Cohort A — managed app, already installed (the majority).** Only gap is the
+`Repository webhooks: write` grant. GitHub keeps the old grants working while the
+new permission sits pending approval, so migration is lazy and never-blocking:
+
+1. Ship the app permission update + `auto_pull` settings defaulting **off**.
+   Zero observable change until a user opts in.
+2. Each managed-app repo gets an "Automatically deploy changes from Git" toggle
+   in the existing settings UI.
+3. On enable, the instance attempts webhook creation:
+   - **403 (approval pending)** → surface a deep link to the org's app
+     installation page to approve the new permission, and **start polling
+     immediately** so auto-pull works right now. The user is never blocked on
+     a GitHub org admin.
+   - **Success** → ping self-test → webhook mode (or polling if unreachable).
+4. The instance does not need to *hear* the approval. The
+   `installation` / `new_permissions_accepted` event goes to the app webhook
+   (the portal), not the instance — irrelevant here. The instance just retries
+   webhook creation on its next poll cycle and silently upgrades polling →
+   webhook once the grant lands. No portal state, no callback plumbing.
+
+**Cohort B — no app (plain `git_repository` resource, token/SSH).** Nothing to
+approve; flipping the toggle goes straight to polling with existing credentials.
+Optional upsell: "install the Windmill GitHub App for instant sync."
+
+**Cohort C — self-managed / GHES (`github_base_url: Some`).** Customer owns the
+app, so there is no central approval. App-level webhooks need no extra
+permission — migration is one documented step: paste the instance webhook URL +
+generated secret into their app settings (the `GhesAppSettings` checklist flips
+"leave webhook inactive" → "set this URL + secret"). Usually works air-gapped.
+
+Cross-cutting:
+
+- **Opt-in, not auto-flipped.** Do not silently enable pull on existing repos:
+  some are backup/secondary push-only targets, or hold content the owner does
+  not want deployed back. Surface a prominent "New: deploy automatically from
+  Git" prompt instead.
+- **Existing CI coexists.** A user already running `wmill sync push` via GH
+  Action keeps it; sha-idempotent triggers make double-firing harmless. Optional
+  cleanup: detect the workflow file via the Contents API and offer one-click
+  removal once webhook pull is confirmed.
+- **The unavoidable cost.** The permission bump nags *every* managed-app
+  installation (even users who never enable auto-pull) with a "requesting
+  updated permissions" prompt until approved or dismissed. No way around it for
+  a single shared app. Mitigation is clear permission-purpose copy; the nag is
+  cosmetic and does not break existing sync.
+- **Capability gating precedent.** `GitRepositorySettings::is_script_meets_min_version`
+  already gates behavior on the pinned hub-script version — a "this install's
+  app grant supports webhooks" capability flag fits the same pattern.
+
+## 15. Implementation plan
+
+Staged so each phase is independently shippable and reviewable. Phase 1 alone
+delivers automatic pull for every customer; webhooks are a latency upgrade.
+
+### Phase 1 — polling + reconcile + settings + UX (no app/permission changes)
+
+Backend (EE):
+
+- `GitRepositorySettings` (`backend/windmill-common/src/workspaces.rs`): add
+  `auto_pull: Option<AutoPullSettings>` (§8). Non-breaking JSONB addition.
+- Reconcile + enqueue: new function mirroring `push_git_sync_job`
+  (`windmill-git-sync/src/git_sync_ee.rs:896`) — given `(repo, ref, head_sha)`,
+  resolve matching workspace(s), compare against `last_synced_sha`, and enqueue
+  the pull job with the same 5 s debounce machinery. The pull job for v1 is the
+  existing `gitInitRepo` hub script run with `pull: true` (mirror the payload
+  `PullWorkspaceModal.svelte` already sends); record the synced sha on success.
+- Poller: register a periodic task in `backend/src/monitor.rs` (alongside the
+  other `tokio::time::interval` loops) that, per auto-pull-enabled repo, runs
+  `git ls-remote` for the tracked refs and feeds changes into the reconciler.
+- Pin the hub-script CLI to the instance version for the unattended path
+  (UI git-sync runs a version-pinned `windmill-cli`; pin lag has caused 422s
+  against newer backends).
+
+Frontend:
+
+- `GitSyncRepositoryCard.svelte`: per-repo "Automatically deploy changes from
+  Git" toggle + last-sync status chip; polling interval input.
+- Demote the `GitSyncSuccessModal.svelte` "set up GitHub Actions" link to an
+  advanced/CI option.
+
+Validation: pull jobs visible in the runs list; error handler fires on repeated
+failure. Tests: reconcile routing + sha-compare + loop-prevention (sender/`[WM]`).
+
+### Phase 2 — webhooks (managed app + GHES)
+
+Ops (precedes code): update `windmill-sync-helper` to request
+`Repository webhooks: write` (bundle `Pull requests: write` + `Checks: write`
+now too, to avoid a second nag for phases 3–4). Update permission-purpose copy.
+
+Backend (EE):
+
+- Receiver endpoint (§8): `POST /api/w/{workspace}/github_app/webhook`
+  (per-workspace, managed and self-managed), HMAC-verified — reuse
+  `X-Hub-Signature-256` validation from
+  `windmill-trigger-http/src/http_trigger_auth.rs`; routes added to
+  `git_sync_ee.rs` `workspaced_service` / `global_service`.
+- Webhook create/delete via installation token — reuse the REST pattern from
+  `windmill-native-triggers/src/github/external.rs` and the delete pattern from
+  `workspace_integrations.rs`. Ping self-test with reachability fallback (§5.1).
+- Lazy approval retry + 403 detection feeding the migration UX (§14 cohort A).
+
+Frontend:
+
+- Toggle now reports resulting mode/latency + re-test button; approval-pending
+  deep link.
+- `GhesAppSettings.svelte`: webhook-secret field + updated checklist (and,
+  optional, the App Manifest one-click flow, §5.2).
+
+### Phase 3 — PR creation instance-side (promotion + forks, toggled)
+
+- The deploy's push job carries a `__git_sync_open_pr` marker when the repo
+  opted in (`promotion_open_prs` on the promotion repo; parent-level
+  `fork_open_prs` for fork deploys); the job-completion hook
+  (`maybe_open_git_sync_deploy_pr` in `result_processor.rs`) derives the pushed
+  branch (fork branch wins, else the `wm_deploy/**` formula) and calls
+  `ensure_pull_request`. Outbound with the installation token, so no webhook
+  reachability is needed; app-backed repos only.
+- No-op pushes skip PR creation: the push script reports `pushed: false` when
+  nothing was committed (e.g. the deploy was itself caused by an auto-pull, so
+  the workspace already matches the repo), and the hook returns early — a PR
+  the user closed isn't recreated by the sync loop. Results without the flag
+  (older script pins) keep ensuring the PR.
+- Fork-branch routing edge cases (§7) hardened here.
+
+### Phase 4 — PR diff preview checks (optional)
+
+- Subscribe `pull_request` events; on open/synchronize run the existing
+  `dry_run: true` pull and post the diff as a check run (`checks: write`).
+- The same completion hook maintains ONE managed comment on the PR
+  (Cloudflare deploy-preview style: workspace, status, commit, collapsible
+  change list), upserted per synchronize via a hidden `<!-- windmill-diff -->`
+  marker so reviewers see the current diff without opening the Checks tab.
+
+### Phase 5 — fork sync, configured at the parent (replaces the `push-on-merge-to-forks` GitHub Action) — implemented
+
+**Scope rule: Windmill absorbs automation for events it originates or
+consumes; Actions remain for custom CI.** Of the documented CI/CD workflows:
+`push-on-merge` (repo → prod workspace) is phases 1–2 auto-pull;
+`push-on-merge-to-forks` (fork branch → fork workspace) is this phase; and the
+PR-opening workflows (`open-pr-on-commit` for `wm_deploy/**`,
+`open-pr-on-fork-commit` for `wm-fork/**`) react to branches Windmill itself
+pushes, so they move into the deploy pipeline as per-repo toggles (§11 / Phase
+3) and the Actions become optional alternatives. (A `fork_pull_sync` "fan the
+tracked branch out to every fork" draft was dropped: a fork syncs its *own*
+`wm-fork/**` branch, never `main` directly, and blind fan-out would clobber a
+dev workspace's local work.)
+
+**The premise.** `create_workspace_fork` copies the parent's resources (so the
+`git_repository` resource lands in the fork) and, via `clone_workspace_data` →
+`update_workspace_settings`, the parent's `git_app_installations` and `git_sync`
+(keeping the first sync-mode repo — WIN-1559). So a fork already pushes to its
+`wm-fork/<tracked>/<id>` branch on deploy. What it must **not** inherit is the
+`auto_pull` block: it carries the parent's `webhook_id`/`webhook_secret` (the
+repo webhook is parent-owned), so `update_workspace_settings` strips it. The
+server also rejects parent-only settings on a fork workspace (enabled
+`auto_pull`, promotion mode, `fork_open_prs`) — a fork's deploys always target
+its `wm-fork/**` branch, so none of them could take effect there, and fork sync
+is exclusively parent-managed.
+
+**Design: one parent-level toggle, `auto_pull.sync_forks` (default on when
+auto-pull is enabled).** Matches the Action model (configured once at the repo,
+fires for every `wm-fork/**` branch) and needs zero per-fork setup — no fork
+webhook, resource, or config; applies to current *and* future forks.
+
+How a fork branch change reaches the fork workspace (both delivery paths):
+
+- **Webhook**: the push to a fork branch (`wm-fork/<base>/<suffix>`, or a dev
+  workspace's label branch) lands on the **parent's** webhook.
+  `handle_github_git_sync_event` requires a `[WM]`-less head commit (a fork's
+  own deploy must not pull itself back) and `auto_pull.enabled && sync_forks`,
+  then calls `reconcile_fork_branch_pull`; branches that resolve to no live
+  child no-op.
+- **Polling**: the parent's poll tick also lists every `wm-fork/<tracked>/*` head
+  plus its dev-workspace children's label branches in one extra call — a
+  `git ls-remote` pattern (+ explicit refs) for token repos, `git/matching-refs`
+  (+ per-label head lookups) for app-backed — and reconciles each
+  (`poll_git_fork_branches` in `monitor.rs`).
+
+**Dev workspaces sync with their environment-label branch.** A dev workspace's
+branch is its label verbatim (`dev`/`staging` — the classic env-branch layout,
+matching the documented `push-on-merge-staging` Action), not the namespaced
+`wm-fork/**` form. The label is set at create/attach time and immutable
+afterwards (the branch is keyed on it; the old set-label endpoint was removed),
+defaulting to `dev`. The backend passes it with every deploy job
+(`dev_workspace_label` arg → hub script → CLI `--dev-workspace-label`), the PR
+completion hook derives the same branch, and the CLI refuses to deploy when the
+label branch equals the checked-out tracked branch (which would otherwise
+commit fork content straight to it).
+
+`reconcile_fork_branch_pull` (windmill-git-sync EE) is the shared routing core:
+resolve the branch to a **live descendant of this workspace** (recursive
+`parent_workspace_id` walk + `NOT deleted`, so a crafted branch name can't
+route a pull into an unrelated workspace) — the `wm-fork/<base>/<suffix>` form
+via `parse_fork_branch` (windmill-common), or an environment-label branch via
+a dev-workspace label lookup — then load the fork's own repo entry and run the
+shared `reconcile_and_enqueue_pull` with the fork's per-ref dedup state and a
+`clone_ref` override so the pull job clones the fork branch instead of the
+resource's tracked branch. Descendants (not just direct children) because
+**forks of a dev workspace** also sync through the root's webhook/poller —
+only the root can hold auto-pull config. A fork-of-dev roots its `wm-fork/**`
+branch on the dev's label branch and its PR merges back into it (the backend
+passes `parent_dev_workspace_label` with the deploy; `fork_open_prs` is
+resolved at the root ancestor).
+
+State lives with the fork: its repo entry carries a server-written status-only
+`auto_pull` blob (`last_synced_sha` keyed by the fork branch, `last_pull_status`;
+`enabled` stays false). `persist_auto_pull_state` creates that blob when missing.
+The fork's repo card shows a read-only "managed in the parent workspace" line
+with the fork branch name plus the last pull status; the enable/disable control
+exists only on the parent's card.
+
+Perms: the toggle is parent-workspace admin (whoever edits the parent's
+`git_sync`) — the same bar as "who set up the repo secret + workflow." No
+per-fork authorization; matches the Action ergonomics.
+
+Non-goals for v1: per-fork opt-out on the parent (default is all forks; add an
+exclusion list later if asked); per-fork include/exclude filters (the pull
+applies the repo's `wmill.yaml` like any pull).
+
+### Phase 6 — live deploy status check on the commit (Cloudflare-style) — implemented
+
+Replicate the Cloudflare Pages deploy status: a **check run** that appears in the
+commit/PR checks strip, starting `in_progress` ("Deploying…") and flipping to
+`completed`/`success` ("Deployed"). This is *not* a GitHub Action — it's posted
+via the Checks API, so it reuses the Phase 4 machinery
+(`create_check_run`/`update_check_run`) and the `checks: write` grant already
+requested. No new permission, no customer CI. The check lands on the head commit
+of the tracked branch — exactly where Cloudflare's "Deployed to production" sits.
+
+Today the deploy path posts nothing back: `create_check_run`
+(`"status": "in_progress"`) and `update_check_run`
+(`"status": "completed"` + conclusion + output) already exist and are used for
+the PR **dry-run** diff, but the real deploy pull (tracked-branch push/merge)
+doesn't create one. Phase 6 runs that same two-step on the deploy path.
+
+Flow:
+
+1. On a tracked-branch push/poll that triggers a deploy pull, `create_check_run`
+   on the head sha: name **"Windmill"** (vs "Windmill diff" for PR checks),
+   `in_progress`, title "Deploying…", with a **`details_url`** to the Windmill
+   run / workspace. Keep the returned `check_run_id`.
+2. Thread `check_run_id` + `repo_url` into the pull job — same marker channel as
+   the PR dry-run (add a `__git_sync_deploy_check` marker distinct from the
+   PR-check marker so the completion hook knows which kind).
+3. On completion (generalize `maybe_post_git_sync_pr_check` in
+   `result_processor.rs`), `update_check_run` → `completed`, conclusion
+   `success` ("Deployed N changes to `<workspace>`" / "In sync, no changes") or
+   `failure` with the error summary.
+
+Backend (EE) touch points:
+
+- `create_check_run`: add a caller-supplied name + a `details_url` param (small
+  signature change; PR path keeps "Windmill diff").
+- Deploy trigger (tracked-branch case in `handle_github_git_sync_event`, plus the
+  poller reconcile): best-effort create the `in_progress` check and carry the id
+  into the job payload. App-backed only; never block the deploy on it.
+- Completion hook: handle the deploy-check marker alongside the PR-check marker.
+
+> Implementation note. The `in_progress` check is created inside
+> `reconcile_and_enqueue_pull` (one place covers both the webhook and poller
+> paths), best-effort and app-backed-only, then threaded to the pull job as a
+> `__git_sync_deploy_check` marker. `create_check_run` gained `name` +
+> `details_url` + `output_title` (the PR path keeps `"Windmill diff"`, no
+> details/output). The completion hook `maybe_post_git_sync_pr_check` was
+> generalized to `maybe_post_git_sync_check`, reading either marker. If the pull
+> can't even be enqueued, the in-progress check is closed as failed so it doesn't
+> hang.
+
+Gating / edges: app-backed only (needs the installation token + `checks: write`;
+PAT/polling repos skip silently); skip self-caused/no-op pulls (`[WM]`/bot,
+sha unchanged) so it doesn't post a check for Windmill's own commits; one check
+per `(repo, head_sha, workspace)` — when several workspaces pull the same commit,
+name each with its workspace to disambiguate.
+
+Optional richer variant — GitHub **Deployments / Environments**. Instead of (or
+alongside) the check run, create a Deployment (`POST /repos/.../deployments`) +
+status (`POST /repos/.../deployments/{id}/statuses`) so the deploy shows in the
+repo's **Environments** timeline ("Production → Deployed"). Needs
+`deployments: write` — a *new* grant and another approval nag — so keep it
+opt-in / later. The check-run version is the cheap default and matches the visual
+Cloudflare parity without a new permission.
+
+## 16. Alternatives considered
+
+**Portal as webhook proxy (the rejected "option 2").** Subscribe the managed app
+to push events — delivered centrally to `stats.windmill.dev` — and forward them
+to instances. Its only genuine advantages are (a) zero-friction enablement for
+existing installs, since app-level events need no new permission (no per-org
+approval, unlike repo-webhook creation), and (b) central delivery observability.
+Against that: it does **not** improve reachability (the portal forwards to the
+same instance URL GitHub would hit, so private instances need polling either
+way); app-level events fire for every push to every installed repo, org-wide, so
+portal cost scales with customers' total push volume rather than synced repos;
+the portal becomes stateful (installation→instance registry) and
+availability-coupled, losing its current stateless-token-minter property; full
+push payloads (commit messages, author emails) transit Windmill infrastructure;
+and the instance cannot verify portal signatures, whereas repo webhooks get
+per-repo HMAC. The one advantage that stings — the permission-bump nag — is
+mitigated contextually (approval shown in settings on enable) and covered by
+polling until approved. A narrow portal variant (portal stores events; private
+instances poll `/github_sync/events` with their existing installation JWT) is
+the only thing that would lower latency for unreachable instances; parked unless
+demanded.
+
+## 17. Open questions
+
+- Does `last_synced_sha`/pull-status churn stay in `workspace_settings` JSONB
+  or move to a dedicated table? (Write frequency vs settings-blob contention.)
+- Exact debounce window for pull coalescing (reuse 5 s like deploy callbacks,
+  or longer since clones are heavier?).
+- Should phase 1 polling default to on for newly connected repos, or strictly
+  opt-in? (Opt-in proposed; revisit after adoption data.)
+- GHE Cloud orgs with IP allowlists: confirm hook deliveries to customer
+  instances aren't filtered; the ping self-test catches it operationally either
+  way.
+- v2: move pull execution from the hub script into the backend natively
+  (removes CLI pinning and hub round-trip entirely)?
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index aa769a69b8..6452137d53 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -879,7 +879,6 @@
 			"version": "1.11.2",
 			"resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.11.2.tgz",
 			"integrity": "sha512-TC8MkTuZUtcTSiFeuC0ksCh9QIJ5+F21MvZ4Wn4ORfYaFJ/0dsiudv5tVkejgwZlwQ39jL9WWDe2lz8x0WglOA==",
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"dependencies": {
@@ -891,7 +890,6 @@
 			"version": "1.11.2",
 			"resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.11.2.tgz",
 			"integrity": "sha512-kyOl3X0DuTiT1h2ft8r2fYO8JYtU9a9Xis/zBSiGArNaagCOWx90N1k2wxp18czFDH+OgcWGb5ZP/XMt3dcyPA==",
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"dependencies": {
@@ -902,7 +900,6 @@
 			"version": "1.2.2",
 			"resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-1.2.2.tgz",
 			"integrity": "sha512-c95qOXkHdydNKhscBTebqEC1CVAZpyqOfVfBzQ1qgzyl3gfeldUjIggDbIZgDKsHLgnsM+igH7TJ/eAasaVuMA==",
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"dependencies": {
@@ -1418,7 +1415,6 @@
 			"version": "1.1.4",
 			"resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.4.tgz",
 			"integrity": "sha512-3NQNNgA1YSlJb/kMH1ildASP9HW7/7kYnRI2szWJaofaS1hWmbGI4H+d3+22aGzXXN9IJ+n+GiFVcGipJP18ow==",
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"dependencies": {
@@ -1567,7 +1563,6 @@
 			"cpu": [
 				"arm64"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1584,7 +1579,6 @@
 			"cpu": [
 				"arm64"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1601,7 +1595,6 @@
 			"cpu": [
 				"x64"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1618,7 +1611,6 @@
 			"cpu": [
 				"x64"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1635,7 +1627,6 @@
 			"cpu": [
 				"arm"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1652,7 +1643,6 @@
 			"cpu": [
 				"arm64"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1669,7 +1659,6 @@
 			"cpu": [
 				"arm64"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1686,7 +1675,6 @@
 			"cpu": [
 				"ppc64"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1703,7 +1691,6 @@
 			"cpu": [
 				"s390x"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1720,7 +1707,6 @@
 			"cpu": [
 				"x64"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1737,7 +1723,6 @@
 			"cpu": [
 				"x64"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1754,7 +1739,6 @@
 			"cpu": [
 				"arm64"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1771,7 +1755,6 @@
 			"cpu": [
 				"wasm32"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"dependencies": {
@@ -1790,7 +1773,6 @@
 			"cpu": [
 				"arm64"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1807,7 +1789,6 @@
 			"cpu": [
 				"x64"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -2113,7 +2094,6 @@
 			"version": "0.10.2",
 			"resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.2.tgz",
 			"integrity": "sha512-RoBvJ2X0wuKlWFIjrwffGw1IqZHKQqzIchKaadZZfnNpsAYp2mM0h36JtPCjNDAHGgYez/15uMBpfGwchhiMgg==",
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"dependencies": {
@@ -7349,7 +7329,7 @@
 			"version": "1.21.7",
 			"resolved": "https://registry.npmjs.org/jiti/-/jiti-1.21.7.tgz",
 			"integrity": "sha512-/imKNG4EbWNrVjoNC/1H5/9GFy+tqjGBHCaSsN+P2RnPqjsLmv6UD3Ej+Kj8nBWaRAwyk7kK5ZUc+OEatnTR3A==",
-			"dev": true,
+			"devOptional": true,
 			"license": "MIT",
 			"bin": {
 				"jiti": "bin/jiti.js"
@@ -7884,7 +7864,6 @@
 			"cpu": [
 				"arm64"
 			],
-			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -7905,7 +7884,6 @@
 			"cpu": [
 				"arm64"
 			],
-			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -7926,7 +7904,6 @@
 			"cpu": [
 				"x64"
 			],
-			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -7947,7 +7924,6 @@
 			"cpu": [
 				"x64"
 			],
-			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -7968,7 +7944,6 @@
 			"cpu": [
 				"arm"
 			],
-			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -7989,7 +7964,6 @@
 			"cpu": [
 				"arm64"
 			],
-			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -8010,7 +7984,6 @@
 			"cpu": [
 				"arm64"
 			],
-			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -8031,7 +8004,6 @@
 			"cpu": [
 				"x64"
 			],
-			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -8052,7 +8024,6 @@
 			"cpu": [
 				"x64"
 			],
-			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -8073,7 +8044,6 @@
 			"cpu": [
 				"arm64"
 			],
-			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -8094,7 +8064,6 @@
 			"cpu": [
 				"x64"
 			],
-			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -12782,21 +12751,6 @@
 				}
 			}
 		},
-		"node_modules/svelte-check/node_modules/picomatch": {
-			"version": "4.0.5",
-			"resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.5.tgz",
-			"integrity": "sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==",
-			"dev": true,
-			"license": "MIT",
-			"optional": true,
-			"peer": true,
-			"engines": {
-				"node": ">=12"
-			},
-			"funding": {
-				"url": "https://github.com/sponsors/jonschlinkert"
-			}
-		},
 		"node_modules/svelte-eslint-parser": {
 			"version": "0.43.0",
 			"resolved": "https://registry.npmjs.org/svelte-eslint-parser/-/svelte-eslint-parser-0.43.0.tgz",
@@ -13536,7 +13490,7 @@
 			"version": "5.9.3",
 			"resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
 			"integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
-			"dev": true,
+			"devOptional": true,
 			"license": "Apache-2.0",
 			"bin": {
 				"tsc": "bin/tsc",
diff --git a/frontend/src/lib/components/DevWorkspaceSetting.svelte b/frontend/src/lib/components/DevWorkspaceSetting.svelte
index 2537105c72..bc1f65ed1b 100644
--- a/frontend/src/lib/components/DevWorkspaceSetting.svelte
+++ b/frontend/src/lib/components/DevWorkspaceSetting.svelte
@@ -57,7 +57,6 @@
 	// Cosmetic display label chosen when attaching an existing workspace as dev.
 	let attachLabel = $state<'dev' | 'staging'>('dev')
 	let busy = $state(false)
-	let labelBusy = $state(false)
 
 	// If this workspace already blocks direct deploy / forking through an existing protection rule, keep
 	// the matching lock toggle on but locked: attaching only manages its own reserved dev-workspace rule,
@@ -153,22 +152,6 @@
 		}
 	}
 
-	async function setLabel(label: 'dev' | 'staging') {
-		if (!$workspaceStore || label === devLabelKey(currentWs?.dev_workspace_label)) return
-		labelBusy = true
-		try {
-			await WorkspaceService.setDevWorkspaceLabel({
-				workspace: $workspaceStore,
-				requestBody: { dev_workspace_label: label }
-			})
-			usersWorkspaceStore.set(await WorkspaceService.listUserWorkspaces())
-		} catch (e: any) {
-			sendUserToast(`Failed to update display label: ${e?.body ?? e}`, true)
-		} finally {
-			labelBusy = false
-		}
-	}
-
 	async function detach(devId: string) {
 		if (!$workspaceStore) return
 		busy = true
@@ -194,15 +177,11 @@
 			<b>{parentId}</b>. Promote changes from the home page banner or the Compare &amp; Deploy page.
 		</p>
 		<div class="text-2xs text-secondary">
-			Cosmetic label: <Badge color="indigo" small>{devBadgeText(currentLabel)}</Badge>
-			<button
-				type="button"
-				disabled={labelBusy}
-				class="text-secondary hover:text-primary hover:underline disabled:opacity-50"
-				onclick={() => setLabel(currentLabel === 'staging' ? 'dev' : 'staging')}
-			>
-				Change to {currentLabel === 'staging' ? 'dev' : 'staging'}
-			</button>
+			Environment: <Badge color="indigo" small>{devBadgeText(currentLabel)}</Badge>
+			<span class="ml-1">
+				Set when the workspace is created or attached. Git sync deploys to the
+				<span class="font-mono">{currentLabel}</span> branch.
+			</span>
 		</div>
 		<div>
 			<Button
@@ -254,7 +233,7 @@
 			/>
 		</div>
 		<div class="text-2xs text-secondary">
-			Cosmetic label: <Badge color="indigo" small>{devBadgeText(attachLabel)}</Badge>
+			Label: <Badge color="indigo" small>{devBadgeText(attachLabel)}</Badge>
 			<button
 				type="button"
 				class="text-secondary hover:text-primary hover:underline"
diff --git a/frontend/src/lib/components/git_sync/GitSyncContext.svelte.ts b/frontend/src/lib/components/git_sync/GitSyncContext.svelte.ts
index f17cdd23d4..c69245b0e5 100644
--- a/frontend/src/lib/components/git_sync/GitSyncContext.svelte.ts
+++ b/frontend/src/lib/components/git_sync/GitSyncContext.svelte.ts
@@ -45,7 +45,7 @@ export type GitSyncSettings = {
 export type ModalState = {
 	push: { idx: number; repo: GitSyncRepository; open: boolean } | null
 	pull: { idx: number; repo: GitSyncRepository; open: boolean; settingsOnly?: boolean } | null
-	success: { open: boolean; savedWithoutInit?: boolean } | null
+	success: { open: boolean; savedWithoutInit?: boolean; autoPullOn?: boolean } | null
 }
 
 export type ValidationState = {
@@ -179,7 +179,10 @@ export function createGitSyncContext(workspace: string) {
 			use_individual_branch: repo.use_individual_branch,
 			group_by_folder: repo.group_by_folder,
 			settings: repo.settings,
-			exclude_types_override: repo.exclude_types_override
+			exclude_types_override: repo.exclude_types_override,
+			auto_pull: repo.auto_pull,
+			promotion_open_prs: repo.promotion_open_prs,
+			fork_open_prs: repo.fork_open_prs
 		}
 	}
 
@@ -198,7 +201,13 @@ export function createGitSyncContext(workspace: string) {
 			exclude_types_override: [],
 			legacyImported: false,
 			isUnsavedConnection: true,
-			collapsed: false
+			collapsed: false,
+			// New connections default to pulling changes from Git (webhook with a
+			// polling fallback), forks included. Existing repos load without
+			// auto_pull and stay off until an admin opts in, so upgrades never
+			// start auto-deploying.
+			auto_pull: { enabled: true, mode: 'auto', sync_forks: true },
+			fork_open_prs: true
 		})
 		gitSyncTestJobs.push({
 			jobId: '',
@@ -273,8 +282,8 @@ export function createGitSyncContext(workspace: string) {
 		closeModal('pull')
 	}
 
-	function showSuccessModal(savedWithoutInit?: boolean) {
-		activeModals.success = { open: true, savedWithoutInit }
+	function showSuccessModal(savedWithoutInit?: boolean, autoPullOn?: boolean) {
+		activeModals.success = { open: true, savedWithoutInit, autoPullOn }
 	}
 
 	function closeSuccessModal() {
@@ -501,7 +510,10 @@ export function createGitSyncContext(workspace: string) {
 					use_individual_branch: repoToSave.use_individual_branch,
 					group_by_folder: repoToSave.group_by_folder,
 					settings: repoToSave.settings,
-					exclude_types_override: repoToSave.exclude_types_override
+					exclude_types_override: repoToSave.exclude_types_override,
+					auto_pull: repoToSave.auto_pull,
+					promotion_open_prs: repoToSave.promotion_open_prs,
+					fork_open_prs: repoToSave.fork_open_prs
 				}
 			}
 		})
@@ -516,7 +528,7 @@ export function createGitSyncContext(workspace: string) {
 			repoToSave.detectionState = undefined
 			repoToSave.extractedSettings = undefined
 			// Show success modal for new connections
-			showSuccessModal(savedWithoutInit)
+			showSuccessModal(savedWithoutInit, repoToSave.auto_pull?.enabled === true)
 		}
 	}
 
@@ -672,6 +684,9 @@ export function createGitSyncContext(workspace: string) {
 			legacyImported: false,
 			isUnsavedConnection: true,
 			collapsed: false
+			// Pull-from-Git defaults are applied by the repository card once the
+			// selected resource resolves: only app-backed repos (instant webhook
+			// delivery) default to auto-pull on; polling is opt-in for token repos.
 		})
 		gitSyncTestJobs.push({
 			jobId: '',
@@ -698,7 +713,10 @@ export function createGitSyncContext(workspace: string) {
 			exclude_types_override: [],
 			legacyImported: false,
 			isUnsavedConnection: true,
-			collapsed: false
+			collapsed: false,
+			// New promotion repos default to opening the PR in-app when a deploy
+			// pushes its wm_deploy/** branch (app-backed repos only at runtime).
+			promotion_open_prs: true
 		})
 		gitSyncTestJobs.push({
 			jobId: '',
diff --git a/frontend/src/lib/components/git_sync/GitSyncModalManager.svelte b/frontend/src/lib/components/git_sync/GitSyncModalManager.svelte
index 15e23f7e1e..05925d6e26 100644
--- a/frontend/src/lib/components/git_sync/GitSyncModalManager.svelte
+++ b/frontend/src/lib/components/git_sync/GitSyncModalManager.svelte
@@ -104,5 +104,6 @@
 	<GitSyncSuccessModal
 		bind:open={gitSyncContext.activeModals.success.open}
 		savedWithoutInit={gitSyncContext.activeModals.success.savedWithoutInit}
+		autoPullOn={gitSyncContext.activeModals.success.autoPullOn}
 	/>
 {/if}
diff --git a/frontend/src/lib/components/git_sync/GitSyncModeDisplay.svelte b/frontend/src/lib/components/git_sync/GitSyncModeDisplay.svelte
index 94c77a5974..214a87a01f 100644
--- a/frontend/src/lib/components/git_sync/GitSyncModeDisplay.svelte
+++ b/frontend/src/lib/components/git_sync/GitSyncModeDisplay.svelte
@@ -1,25 +1,37 @@
 <script lang="ts">
+	import { CheckCircle2 } from 'lucide-svelte'
 	import type { GitSyncRepository } from './GitSyncContext.svelte'
 
-	let { mode, targetBranch, repository } = $props<{
+	// `active` shows a check to signal the direction is live on a saved
+	// connection; omit it for pre-save previews (e.g. the setup wizard).
+	let {
+		mode,
+		targetBranch,
+		repository,
+		active = false
+	} = $props<{
 		mode?: 'sync' | 'promotion' | null
 		targetBranch: string | undefined
 		repository?: GitSyncRepository | null
+		active?: boolean
 	}>()
 </script>
 
-<div class="text-base">
-	{#if mode === 'promotion'}
-		<div
-			><span class="font-bold">Promotion:</span> Creating branches whose promotion target is {targetBranch? `'${targetBranch}'` :
-				"the repo's default branch"}</div
-		>
-		{#if repository?.group_by_folder}
-			<div class="text-sm text-primary mt-1">Grouped by folder</div>
-		{/if}
-	{:else if targetBranch}
-		<div><span class="font-bold">Sync:</span> Syncing back to branch '{targetBranch}'</div>
-	{:else}
-		<div><span class="font-bold">Sync:</span> Syncing back to the repo's default branch</div>
+<div class="flex items-start gap-1.5 text-2xs text-secondary">
+	{#if active}
+		<CheckCircle2 size={14} class="mt-px shrink-0 text-green-600" />
 	{/if}
+	<span>
+		{#if mode === 'promotion'}
+			On deploy, changes are pushed to a <span class="font-mono">wm_deploy/…</span>
+			branch{#if repository?.group_by_folder}
+				(grouped by folder){/if}; merging it into {#if targetBranch}<span
+					class="font-medium text-primary">{targetBranch}</span
+				>{:else}the repo's default branch{/if} promotes the change.
+		{:else}
+			Matching changes are committed to {#if targetBranch}<span class="font-medium text-primary"
+					>{targetBranch}</span
+				>{:else}the repo's default branch{/if} on every deploy.
+		{/if}
+	</span>
 </div>
diff --git a/frontend/src/lib/components/git_sync/GitSyncRepositoryCard.svelte b/frontend/src/lib/components/git_sync/GitSyncRepositoryCard.svelte
index ba5dbf4a03..06d28969ba 100644
--- a/frontend/src/lib/components/git_sync/GitSyncRepositoryCard.svelte
+++ b/frontend/src/lib/components/git_sync/GitSyncRepositoryCard.svelte
@@ -17,9 +17,11 @@
 	import DetectionFlow from './DetectionFlow.svelte'
 	import { sendUserToast } from '$lib/toast'
 	import { fade } from 'svelte/transition'
-	import { workspaceStore } from '$lib/stores'
+	import { workspaceStore, userWorkspaces, enterpriseLicense } from '$lib/stores'
 	import type { GitSyncRepository } from './GitSyncContext.svelte'
 	import GitSyncModeDisplay from './GitSyncModeDisplay.svelte'
+	import Toggle from '$lib/components/Toggle.svelte'
+	import EEOnly from '$lib/components/EEOnly.svelte'
 	import { ResourceService, VariableService } from '$lib/gen'
 
 	let {
@@ -49,9 +51,56 @@
 	const validation = $derived(idx !== null ? gitSyncContext.getValidation(idx) : null)
 	const gitSyncTestJob = $derived(idx !== null ? gitSyncContext.gitSyncTestJobs?.[idx] : null)
 	let confirmingDelete = $state(false)
+
+	// Enable/disable automatic repo → workspace pulls, managing the optional
+	// auto_pull object without binding into a possibly-undefined value.
+	function setAutoPullEnabled(enabled: boolean) {
+		if (!repo) return
+		if (enabled) {
+			repo.auto_pull = {
+				...(repo.auto_pull ?? {}),
+				enabled: true,
+				mode: repo.auto_pull?.mode ?? 'auto',
+				sync_forks: repo.auto_pull?.sync_forks ?? true
+			}
+		} else if (repo.auto_pull) {
+			repo.auto_pull = { ...repo.auto_pull, enabled: false }
+		}
+	}
+
+	// Parent-level fork auto-sync (phase 5). Configured on the parent workspace's
+	// repo and applied to all of its forks, so hide it when the current workspace
+	// is itself a fork.
+	const currentWorkspaceData = $derived($userWorkspaces?.find((w) => w.id === $workspaceStore))
+	// A fork or dev workspace: has a parent, or carries the wm-fork- id prefix
+	// (which survives if the parent is deleted). Mirrors the backend/CLI rule.
+	const isFork = $derived(
+		($workspaceStore?.startsWith('wm-fork-') ?? false) ||
+			!!currentWorkspaceData?.parent_workspace_id
+	)
+	function setSyncForks(v: boolean) {
+		if (repo?.auto_pull) repo.auto_pull = { ...repo.auto_pull, sync_forks: v }
+	}
+	function setForkOpenPrs(v: boolean) {
+		if (repo) repo.fork_open_prs = v
+	}
+	function setPromotionOpenPrs(v: boolean) {
+		if (repo) repo.promotion_open_prs = v
+	}
+
 	let targetBranch = $state<string | undefined>(undefined) // Default to main, will be updated when resource is available
+	// The branch this fork workspace syncs with, mirroring the CLI/hub-script
+	// naming: a dev workspace uses its environment-label branch verbatim
+	// (dev/staging); a wm-fork-<slug> throwaway fork keeps only the slug.
+	const forkBranch = $derived(
+		currentWorkspaceData?.is_dev_workspace
+			? (currentWorkspaceData?.dev_workspace_label ?? 'dev')
+			: `wm-fork/${targetBranch ?? 'main'}/${($workspaceStore ?? '').replace(/^wm-fork-/, '')}`
+	)
 	let resourceInfo = $state<{ url?: string; error?: string } | null>(null)
 	let loadingResourceInfo = $state(false)
+	// Only GitHub App-backed repos can register webhooks; PAT repos poll only.
+	let isGithubApp = $state(false)
 
 	// Update target branch when repository changes
 	$effect(() => {
@@ -82,9 +131,12 @@
 		const abortController = new AbortController()
 
 		async function loadResourceInfo() {
-			if (repo?.git_repo_resource_path && !repo.isUnsavedConnection && $workspaceStore) {
+			if (repo?.git_repo_resource_path && $workspaceStore) {
 				loadingResourceInfo = true
 				resourceInfo = null
+				// Clear stale app state up front so a resource change or a failed
+				// fetch can't leave webhook/fork controls showing for the wrong repo.
+				isGithubApp = false
 				try {
 					const resource = await ResourceService.getResource({
 						workspace: $workspaceStore,
@@ -94,6 +146,39 @@
 					if (!abortController.signal.aborted && resource?.value) {
 						// Extract git URL from resource value
 						const value = resource.value as Record<string, any>
+						isGithubApp = value?.is_github_app === true
+						// A newly added sync connection defaults to pulling from Git only
+						// when the repository is app-backed (instant webhook delivery).
+						// Polling is opt-in for token repositories, and fork/dev workspaces
+						// never get the parent-only defaults (the backend rejects them).
+						// EE-only.
+						if (
+							repoMode === 'sync' &&
+							repo.isUnsavedConnection &&
+							isGithubApp &&
+							!isFork &&
+							$enterpriseLicense &&
+							repo.auto_pull === undefined
+						) {
+							repo.auto_pull = { enabled: true, mode: 'auto', sync_forks: true }
+						}
+						// Promotion deploys push wm_deploy/** branches that exist to be
+						// merged; without a PR the deploy is an orphaned branch. Default
+						// the managed PR on where Windmill can open it (app-backed).
+						// Fork PRs stay opt-in everywhere.
+						if (
+							repoMode === 'promotion' &&
+							repo.isUnsavedConnection &&
+							isGithubApp &&
+							$enterpriseLicense &&
+							repo.promotion_open_prs === undefined
+						) {
+							repo.promotion_open_prs = true
+						}
+						// Webhook with polling fallback is the only delivery for app repos.
+						if (isGithubApp && repo.auto_pull?.mode === 'polling') {
+							repo.auto_pull = { ...repo.auto_pull, mode: 'auto' }
+						}
 						let gitUrl = value?.url || value?.git_url
 
 						if (gitUrl && typeof gitUrl === 'string') {
@@ -156,6 +241,7 @@
 				}
 			} else {
 				resourceInfo = null
+				isGithubApp = false
 			}
 		}
 
@@ -202,9 +288,9 @@
 	const displayDescription = $derived(
 		variant === 'primary-sync' || variant === 'primary-promotion'
 			? mode === 'sync'
-				? `Changes will be committed directly to the ${targetOrDefaultBranch} branch`
+				? `Deploys are committed to the ${targetOrDefaultBranch} branch, and new commits to it can deploy back into this workspace automatically`
 				: mode === 'promotion'
-					? `Changes will be made to new branches whose promotion target is the ${targetOrDefaultBranch} branch of the repo to promote to. Remember to also setup Git Sync between the promotion workspace and repo for changes to be deployed when these branches are merged.`
+					? `Each deploy in this workspace pushes its changes to a dedicated wm_deploy/** branch of the repository instead of committing to ${targetOrDefaultBranch} directly. Merging that branch into ${targetOrDefaultBranch} promotes the change: the workspace that syncs ${targetOrDefaultBranch} deploys it on merge, so set up Git Sync there. Windmill can open the pull request for each deploy branch (toggle below), or use the open-pr-on-commit workflow.`
 					: null
 			: null
 	)
@@ -371,7 +457,7 @@
 			{#if !emptyString(repo.git_repo_resource_path)}
 				<Button
 					disabled={emptyString(repo.git_repo_resource_path)}
-					variant="accent"
+					variant="default"
 					onclick={runGitSyncTestJob}
 					size="xs"
 				>
@@ -486,17 +572,120 @@
 				</GitSyncFilterSettings>
 
 				{#if !repo.isUnsavedConnection}
-					<div class="flex justify-between items-start">
-						<!-- Display mode settings as prominent text -->
-						<div class="flex-1 mr-4">
-							<GitSyncModeDisplay mode={repoMode} {targetBranch} repository={repo} />
+					{#if !emptyString(repo.git_repo_resource_path) && !repo.legacyImported}
+						<!-- Direction 1: Windmill -> Git (commit/push on deploy) -->
+						<div class="mt-4 border-t border-gray-200 pt-3 dark:border-gray-700">
+							<div class="flex justify-between items-start gap-4">
+								<div class="flex-1">
+									<div class="text-sm font-semibold text-emphasis mb-1">
+										Push to Git on deploy (Windmill → Git)
+									</div>
+									{#if !isFork}
+										<GitSyncModeDisplay mode={repoMode} {targetBranch} repository={repo} active />
+									{/if}
+								</div>
+								<Button
+									size="xs"
+									variant="default"
+									onclick={() => idx !== null && gitSyncContext.showPushModal(idx)}
+									startIcon={{ icon: Upload }}
+								>
+									Push to repo
+								</Button>
+							</div>
+							{#if repoMode === 'promotion' && isGithubApp}
+								<div class="mt-2">
+									<Toggle
+										checked={repo.promotion_open_prs ?? false}
+										options={{
+											right: 'Open a pull request for each deploy branch',
+											rightTooltip:
+												'After a deploy pushes its wm_deploy/** branch, Windmill opens a pull request to the target branch. Runs from the deploy itself, so it works without inbound webhooks.'
+										}}
+										on:change={(e) => setPromotionOpenPrs(e.detail)}
+									/>
+								</div>
+							{:else if repoMode === 'promotion' && !repo.isUnsavedConnection}
+								<div class="text-2xs text-secondary mt-2">
+									To open a pull request for each deploy branch, set up the
+									<a
+										href="https://www.windmill.dev/docs/advanced/deploy_gh_gl#github-actions-setup"
+										target="_blank"
+										class="text-blue-500 hover:underline font-mono">open-pr-on-commit</a
+									>
+									workflow in the repository. Recommended: connect the repository through the
+									<a
+										href="https://www.windmill.dev/docs/integrations/git_repository#github-app"
+										target="_blank"
+										class="text-blue-500 hover:underline">GitHub App</a
+									> and Windmill opens them automatically.
+								</div>
+							{/if}
+							{#if repoMode === 'sync' && isFork}
+								<div class="text-2xs text-secondary mt-2">
+									Deploys from this workspace are pushed to the
+									<span class="font-mono">{forkBranch}</span> branch of the shared repository, not to
+									the tracked branch.
+								</div>
+							{:else if repoMode === 'sync' && !isFork}
+								<div class="text-2xs text-secondary mt-2">
+									These push settings also apply to forks of this workspace: an item deployed in a
+									fork is pushed to the fork's own
+									<span class="font-mono">wm-fork/…</span> branch instead of the tracked branch.
+								</div>
+								{#if isGithubApp}
+									<div class="mt-2">
+										<Toggle
+											checked={repo.fork_open_prs ?? false}
+											disabled={!$enterpriseLicense}
+											options={{
+												right: 'Open a pull request when an item is deployed in a fork',
+												rightTooltip:
+													"After an item deployed in a fork is pushed to the fork's wm-fork/** branch, Windmill opens a pull request to the tracked branch of the shared repository. Runs from the deploy itself, so it works without inbound webhooks."
+											}}
+											on:change={(e) => setForkOpenPrs(e.detail)}
+										>
+											{#snippet right()}
+												{#if !$enterpriseLicense}<EEOnly />{/if}
+											{/snippet}
+										</Toggle>
+									</div>
+								{:else}
+									<div class="text-2xs text-secondary mt-2">
+										To open pull requests when an item is deployed in a fork, set up the
+										<a
+											href="https://www.windmill.dev/docs/advanced/git_sync#github-actions"
+											target="_blank"
+											class="text-blue-500 hover:underline font-mono">open-pr-on-fork-commit</a
+										>
+										workflow in the repository. Recommended: connect the repository through the
+										<a
+											href="https://www.windmill.dev/docs/integrations/git_repository#github-app"
+											target="_blank"
+											class="text-blue-500 hover:underline">GitHub App</a
+										> and Windmill opens them automatically.
+									</div>
+								{/if}
+							{/if}
+							{#if repo.open_pr_error}
+								<div class="mt-2">
+									<Alert type="warning" title="Last pull request couldn't be opened" size="xs">
+										{repo.open_pr_error} If this mentions permissions, the GitHub App installation may
+										not have approved the pull-request permission yet.
+									</Alert>
+								</div>
+							{/if}
 						</div>
 
-						<!-- Manual sync section for existing repos -->
-						{#if !emptyString(repo.git_repo_resource_path) && !repo.legacyImported}
-							<div class="flex flex-col">
-								<div class="text-sm text-secondary mb-2">Manual workspace content sync</div>
-								<div class="flex gap-2">
+						<!-- Direction 2: Git -> Windmill (pull / auto-deploy). Promotion repos
+						     push deploy branches on top of a sync-mode setup; the pull
+						     direction belongs to that sync repo, so it's hidden here. -->
+						{#if repoMode === 'sync'}
+							<div class="mt-4 border-t border-gray-200 pt-3 dark:border-gray-700">
+								<div class="flex justify-between items-start gap-4">
+									<div class="text-sm font-semibold text-emphasis"
+										>Pull from Git (Git → Windmill)</div
+									>
 									<Button
 										size="xs"
 										variant="default"
@@ -505,18 +694,123 @@
 									>
 										Pull from repo
 									</Button>
-									<Button
-										size="xs"
-										variant="default"
-										onclick={() => idx !== null && gitSyncContext.showPushModal(idx)}
-										startIcon={{ icon: Upload }}
-									>
-										Push to repo
-									</Button>
 								</div>
+								{#if isFork}
+									<!-- Fork sync is parent-managed: no control here, only status. -->
+									<div class="text-2xs text-secondary mt-2">
+										Automatic sync from Git is managed in the parent workspace's git sync settings.
+										When enabled there, changes to this fork's
+										<span class="font-mono">{forkBranch}</span> branch deploy here automatically.
+									</div>
+									{#if repo.auto_pull?.last_pull_status}
+										<div class="text-2xs text-secondary mt-2">
+											{#if repo.auto_pull.last_pull_status.success}
+												Last synced{repo.auto_pull.last_pull_status.synced_sha
+													? ` to ${repo.auto_pull.last_pull_status.synced_sha.slice(0, 7)}`
+													: ''}.
+											{:else}
+												<span class="text-red-600 dark:text-red-400">
+													Last sync failed{repo.auto_pull.last_pull_status.error
+														? `: ${repo.auto_pull.last_pull_status.error}`
+														: ''}.
+												</span>
+											{/if}
+										</div>
+									{/if}
+								{:else}
+									<Toggle
+										checked={repo.auto_pull?.enabled ?? false}
+										disabled={!$enterpriseLicense}
+										options={{
+											right: 'Automatically deploy changes from Git',
+											rightTooltip:
+												'Windmill deploys new commits from the tracked branch into this workspace. Repositories connected through the GitHub App sync instantly via webhooks with a polling fallback; token-based repositories are checked about every minute.'
+										}}
+										on:change={(e) => setAutoPullEnabled(e.detail)}
+									>
+										{#snippet right()}
+											{#if !$enterpriseLicense}<EEOnly />{/if}
+										{/snippet}
+									</Toggle>
+									<div class="mt-1">
+										<Toggle
+											disabled={!repo.auto_pull?.enabled}
+											checked={!!(repo.auto_pull?.enabled && repo.auto_pull?.sync_forks)}
+											options={{
+												right: 'Automatically sync forks with git branches',
+												rightTooltip: repo.auto_pull?.enabled
+													? "When a fork's wm-fork/** branch changes in the repository (for example after merging the tracked branch into it), Windmill deploys those commits into the fork workspace. Configured once here, applied to every fork of this workspace."
+													: 'Requires automatic deploy from Git to be enabled above.'
+											}}
+											on:change={(e) => setSyncForks(e.detail)}
+										/>
+									</div>
+								{/if}
+								{#if !isGithubApp && !loadingResourceInfo}
+									<div class="mt-2">
+										<Alert type="info" title="Instant pull recommended" size="xs">
+											Pull for this repository checks the tracked branch about every minute;
+											longer gaps make drift and merge conflicts more likely. For instant pull,
+											connect the repository through the
+											<a
+												href="https://www.windmill.dev/docs/integrations/git_repository#github-app"
+												target="_blank"
+												class="text-blue-500 hover:underline">GitHub App</a
+											>
+											(which also lets Windmill manage pull requests), or push changes into
+											Windmill with the
+											<a
+												href="https://www.windmill.dev/docs/advanced/git_sync#github-actions"
+												target="_blank"
+												class="text-blue-500 hover:underline">sync GitHub workflow</a
+											>. If you already push changes with a GitHub Action, keep either the
+											Action or automatic pull, not both, so they don't fight over deploys.
+										</Alert>
+									</div>
+								{/if}
+								{#if repo.auto_pull?.enabled}
+									{@const viaWebhook = repo.auto_pull?.webhook_id != null}
+									{#if isGithubApp}
+										<div class="mt-2">
+											<Alert type="info" title="Already pulling with a GitHub Action?" size="xs">
+												If you previously set up a GitHub Action to push changes into Windmill,
+												remove it now so the two don't fight over deploys.
+											</Alert>
+										</div>
+									{/if}
+									<div class="text-2xs text-secondary mt-2">
+										{#if repo.auto_pull?.last_pull_status}
+											{#if repo.auto_pull.last_pull_status.success}
+												Last synced{repo.auto_pull.last_pull_status.synced_sha
+													? ` to ${repo.auto_pull.last_pull_status.synced_sha.slice(0, 7)}`
+													: ''}.
+												{viaWebhook
+													? ' Syncing instantly via webhook.'
+													: ' Checking the tracked branch about every minute.'}
+											{:else}
+												<span class="text-red-600 dark:text-red-400">
+													Last sync failed{repo.auto_pull.last_pull_status.error
+														? `: ${repo.auto_pull.last_pull_status.error}`
+														: ''}.
+												</span>
+											{/if}
+										{:else}
+											{viaWebhook
+												? 'Connected via webhook. New commits to the tracked branch deploy instantly.'
+												: 'Checking the tracked branch about every minute. New commits deploy automatically.'}
+										{/if}
+									</div>
+									{#if isGithubApp && repo.auto_pull?.webhook_error}
+										<div class="mt-2">
+											<Alert type="warning" title="Falling back to polling" size="xs">
+												{repo.auto_pull.webhook_error}
+											</Alert>
+										</div>
+									{/if}
+								{/if}
 							</div>
 						{/if}
-					</div>
+					{/if}
 				{/if}
 			{/if}
 		{:else}
@@ -580,7 +874,14 @@
 					</div>
 				</div>
 				{#if displayDescription}
-					<p class="text-xs text-secondary">{displayDescription}</p>
+					<p class="text-xs text-secondary"
+						>{displayDescription}
+						{#if mode === 'promotion'}
+							<a target="_blank" href="https://www.windmill.dev/docs/advanced/deploy_gh_gl"
+								>Learn more about Git Promotion</a
+							>
+						{/if}</p
+					>
 				{/if}
 			</div>
 			{@render repositoryContent()}
diff --git a/frontend/src/lib/components/git_sync/GitSyncSection.svelte b/frontend/src/lib/components/git_sync/GitSyncSection.svelte
index 8041c734da..42e147453c 100644
--- a/frontend/src/lib/components/git_sync/GitSyncSection.svelte
+++ b/frontend/src/lib/components/git_sync/GitSyncSection.svelte
@@ -5,7 +5,7 @@
 	import { setGitSyncContext } from './GitSyncContext.svelte'
 	import GitSyncRepositoryCard from './GitSyncRepositoryCard.svelte'
 	import GitSyncModalManager from './GitSyncModalManager.svelte'
-	import { enterpriseLicense, workspaceStore } from '$lib/stores'
+	import { enterpriseLicense, workspaceStore, userWorkspaces } from '$lib/stores'
 	import { WorkspaceService } from '$lib/gen'
 	import { sendUserToast } from '$lib/toast'
 	import { untrack } from 'svelte'
@@ -42,6 +42,13 @@
 
 	const gitSyncAllowed = $derived(gitSyncStatus.enabled)
 	const isFreeTier = $derived(gitSyncAllowed && !$enterpriseLicense)
+	// Fork/dev workspaces never run promotion mode: their deploys always go to
+	// the fork's own wm-fork/** branch, so a promotion repo could never take
+	// effect (the backend rejects it too). Mirrors the backend/CLI fork rule.
+	const isFork = $derived(
+		($workspaceStore?.startsWith('wm-fork-') ?? false) ||
+			!!$userWorkspaces?.find((w) => w.id === $workspaceStore)?.parent_workspace_id
+	)
 	const hasConfiguredRepos = $derived(
 		gitSyncContext?.repositories?.some((r) => r.git_repo_resource_path) ?? false
 	)
@@ -88,7 +95,7 @@
 {:else}
 	<SettingsPageHeader
 		title="Git Sync"
-		description="Connect the Windmill workspace to a Git repository to automatically commit and push scripts, flows, and apps to the repository on each deploy."
+		description="Connect the Windmill workspace to a Git repository: each deploy commits scripts, flows, and apps to the repository, and new commits to the repository can automatically deploy into the workspace."
 		link="https://www.windmill.dev/docs/advanced/git_sync"
 	>
 		{#snippet actions()}
@@ -204,81 +211,83 @@
 					{/if}
 				{/if}
 
-				<!-- Primary Promotion Repository (EE only) -->
-				<div class="mt-6">
-					<GitSyncRepositoryCard
-						variant="primary-promotion"
-						mode="promotion"
-						idx={primaryPromotion?.idx ?? null}
-						repository={primaryPromotion?.repo ?? null}
-						onAdd={() => gitSyncContext.addPromotionRepository()}
-						isCollapsible={false}
-						showEmptyState={primaryPromotion?.repo === null}
-					/>
+				<!-- Primary Promotion Repository (EE only; not on forks) -->
+				{#if !isFork}
+					<div class="mt-6">
+						<GitSyncRepositoryCard
+							variant="primary-promotion"
+							mode="promotion"
+							idx={primaryPromotion?.idx ?? null}
+							repository={primaryPromotion?.repo ?? null}
+							onAdd={() => gitSyncContext.addPromotionRepository()}
+							isCollapsible={false}
+							showEmptyState={primaryPromotion?.repo === null}
+						/>
 
-					<!-- Secondary Promotion Repositories -->
-					{#if primaryPromotion && !primaryPromotion.repo?.isUnsavedConnection}
-						{#if secondaryPromotion.length > 0 || secondaryPromotionExpanded}
-							<div class="mt-4">
-								<button
-									class="flex items-center gap-2 text-sm text-secondary hover:text-primary transition-colors"
-									onclick={() => (secondaryPromotionExpanded = !secondaryPromotionExpanded)}
-								>
-									{#if secondaryPromotionExpanded}
-										<ChevronDown size={16} />
-									{:else}
-										<ChevronRight size={16} />
-									{/if}
-									Secondary promotion repositories ({secondaryPromotion.length})
-								</button>
-
-								{#if secondaryPromotionExpanded}
-									<div class="mt-3 space-y-3">
-										{#if secondaryPromotion.length === 0}
-											<div class="text-sm text-secondary italic">
-												No secondary promotion repositories configured
-											</div>
+						<!-- Secondary Promotion Repositories -->
+						{#if primaryPromotion && !primaryPromotion.repo?.isUnsavedConnection}
+							{#if secondaryPromotion.length > 0 || secondaryPromotionExpanded}
+								<div class="mt-4">
+									<button
+										class="flex items-center gap-2 text-sm text-secondary hover:text-primary transition-colors"
+										onclick={() => (secondaryPromotionExpanded = !secondaryPromotionExpanded)}
+									>
+										{#if secondaryPromotionExpanded}
+											<ChevronDown size={16} />
 										{:else}
-											{#each secondaryPromotion as { repo, idx } (repo.git_repo_resource_path)}
-												<div class="pl-4">
-													<GitSyncRepositoryCard variant="secondary" {idx} isSecondary={true} />
-												</div>
-											{/each}
+											<ChevronRight size={16} />
 										{/if}
+										Secondary promotion repositories ({secondaryPromotion.length})
+									</button>
 
-										{#if !hasUnsavedSecondaryPromotion}
-											<div class="pl-4">
-												<Button
-													size="xs"
-													variant="default"
-													startIcon={{ icon: Plus }}
-													onclick={() => gitSyncContext.addPromotionRepository()}
-												>
-													Add secondary promotion
-												</Button>
-											</div>
-										{/if}
+									{#if secondaryPromotionExpanded}
+										<div class="mt-3 space-y-3">
+											{#if secondaryPromotion.length === 0}
+												<div class="text-sm text-secondary italic">
+													No secondary promotion repositories configured
+												</div>
+											{:else}
+												{#each secondaryPromotion as { repo, idx } (repo.git_repo_resource_path)}
+													<div class="pl-4">
+														<GitSyncRepositoryCard variant="secondary" {idx} isSecondary={true} />
+													</div>
+												{/each}
+											{/if}
+
+											{#if !hasUnsavedSecondaryPromotion}
+												<div class="pl-4">
+													<Button
+														size="xs"
+														variant="default"
+														startIcon={{ icon: Plus }}
+														onclick={() => gitSyncContext.addPromotionRepository()}
+													>
+														Add secondary promotion
+													</Button>
+												</div>
+											{/if}
+										</div>
+									{/if}
+								</div>
+							{:else}
+								<!-- Collapsed state when no secondary promotion repos exist -->
+								{#if !hasUnsavedSecondaryPromotion}
+									<div class="mt-2">
+										<button
+											class="text-xs text-primary hover:text-secondary transition-colors"
+											onclick={() => {
+												secondaryPromotionExpanded = true
+												gitSyncContext.addPromotionRepository()
+											}}
+										>
+											+ Add secondary promotion repository
+										</button>
 									</div>
 								{/if}
-							</div>
-						{:else}
-							<!-- Collapsed state when no secondary promotion repos exist -->
-							{#if !hasUnsavedSecondaryPromotion}
-								<div class="mt-2">
-									<button
-										class="text-xs text-primary hover:text-secondary transition-colors"
-										onclick={() => {
-											secondaryPromotionExpanded = true
-											gitSyncContext.addPromotionRepository()
-										}}
-									>
-										+ Add secondary promotion repository
-									</button>
-								</div>
 							{/if}
 						{/if}
-					{/if}
-				</div>
+					</div>
+				{/if}
 			{/if}
 		</div>
 
diff --git a/frontend/src/lib/components/git_sync/GitSyncSuccessModal.svelte b/frontend/src/lib/components/git_sync/GitSyncSuccessModal.svelte
index 5beddd05c6..32dc68a0f4 100644
--- a/frontend/src/lib/components/git_sync/GitSyncSuccessModal.svelte
+++ b/frontend/src/lib/components/git_sync/GitSyncSuccessModal.svelte
@@ -5,13 +5,10 @@
 	interface Props {
 		open: boolean
 		savedWithoutInit?: boolean
+		autoPullOn?: boolean
 	}
 
-	let {
-		open = $bindable(false),
-		savedWithoutInit = false
-	}: Props = $props()
-
+	let { open = $bindable(false), savedWithoutInit = false, autoPullOn = false }: Props = $props()
 </script>
 
 <Modal bind:open title="Git Sync Connection Saved" class="sm:max-w-4xl" cancelText="Close">
@@ -23,7 +20,9 @@
 			</div>
 			<div>
 				<h3 class="text-lg font-semibold text-primary">Git sync connection saved successfully!</h3>
-				<p class="text-sm text-secondary mt-1">Your repository is now configured to receive changes from Windmill.</p>
+				<p class="text-sm text-secondary mt-1"
+					>Your repository is now configured to receive changes from Windmill.</p
+				>
 			</div>
 		</div>
 
@@ -32,26 +31,39 @@
 			<div class="bg-blue-50 border border-blue-200 rounded-lg p-4">
 				<h4 class="font-medium text-blue-900 mb-2">Repository saved without initialization</h4>
 				<p class="text-sm text-blue-800">
-					Only new changes will be pushed to this repository. Existing content in Windmill has not been initialized to the repository.
+					Only new changes will be pushed to this repository. Existing content in Windmill has not
+					been initialized to the repository.
 				</p>
 			</div>
 		{/if}
 
 		<!-- Optional setup section -->
-		<div class="bg-amber-50 border border-amber-200 rounded-lg p-4">
-			<h4 class="font-medium text-amber-900 mb-2 flex items-center gap-2">
-				<ArrowRight class="h-4 w-4" />
-				Optional: Enable automatic deployment from Git to Windmill
-			</h4>
-			<p class="text-sm text-amber-800 mb-3">
-				To automatically deploy changes from your Git repository back to Windmill (when PRs are merged), you can set up GitHub Actions or similar CI/CD workflows.
-			</p>
+		{#if autoPullOn}
+			<div class="bg-green-50 border border-green-200 rounded-lg p-4">
+				<h4 class="font-medium text-green-900 mb-2 flex items-center gap-2">
+					<ArrowRight class="h-4 w-4" />
+					Pull from Git is on
+				</h4>
+				<p class="text-sm text-green-800">
+					New commits to the tracked branch deploy into this workspace automatically. You can
+					adjust this anytime on the repository card.
+				</p>
+			</div>
+		{:else}
+			<div class="bg-amber-50 border border-amber-200 rounded-lg p-4">
+				<h4 class="font-medium text-amber-900 mb-2 flex items-center gap-2">
+					<ArrowRight class="h-4 w-4" />
+					Deploy changes from Git back to Windmill
+				</h4>
+				<p class="text-sm text-amber-800 mb-3">
+					Turn on "Automatically deploy changes from Git" on the repository to have Windmill pull
+					new commits into this workspace for you.
+				</p>
 			<div class="flex flex-col gap-2">
-				<p class="text-sm text-amber-700">This setup enables:</p>
-				<ul class="text-sm text-amber-700 ml-4 list-disc space-y-1">
-					<li>Automatic deployment to Windmill when PRs are merged</li>
-					<li>Full bidirectional sync between Git and Windmill</li>
-				</ul>
+				<p class="text-sm text-amber-700">
+					Prefer to control deployment from your own pipeline (tests, custom gating, deploy on PR
+					merge)? Set up GitHub Actions or similar CI/CD workflows instead.
+				</p>
 				<div class="mt-3">
 					<a
 						href="https://www.windmill.dev/docs/advanced/deploy_gh_gl#github-actions-setup"
@@ -59,11 +71,11 @@
 						class="text-sm text-amber-700 hover:text-amber-900 underline flex items-center gap-1"
 					>
 						<ExternalLink class="h-3 w-3" />
-						Learn more
+						Learn more about CI-based deployment
 					</a>
+					</div>
 				</div>
 			</div>
-		</div>
-
+		{/if}
 	</div>
 </Modal>
diff --git a/frontend/src/lib/components/git_sync/PullWorkspaceModal.svelte b/frontend/src/lib/components/git_sync/PullWorkspaceModal.svelte
index 37af944362..94845aa646 100644
--- a/frontend/src/lib/components/git_sync/PullWorkspaceModal.svelte
+++ b/frontend/src/lib/components/git_sync/PullWorkspaceModal.svelte
@@ -12,8 +12,8 @@
 		Edit3
 	} from 'lucide-svelte'
 	import GitDiffPreview from '../GitDiffPreview.svelte'
-	import { JobService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
+	import { JobService, ResourceService } from '$lib/gen'
+	import { workspaceStore, userWorkspaces } from '$lib/stores'
 	import { sendUserToast } from '$lib/toast'
 	import hubPaths from '$lib/hubPaths.json'
 	import { jobManager } from '$lib/services/JobManager'
@@ -147,6 +147,29 @@
 			const workspace = $workspaceStore
 			if (!workspace) return
 
+			// A dev workspace pulls from its environment-label branch (dev/staging)
+			// and a fork from its wm-fork/<tracked>/<id> branch, not the resource's
+			// tracked branch. clone_ref falls back to the tracked branch in the
+			// pull script when the override branch doesn't exist yet.
+			const currentWs = $userWorkspaces?.find((w) => w.id === workspace)
+			const isFork = workspace.startsWith('wm-fork-') || Boolean(currentWs?.parent_workspace_id)
+			let cloneRef: string | undefined = undefined
+			if (currentWs?.is_dev_workspace) {
+				cloneRef = currentWs.dev_workspace_label ?? 'dev'
+			} else if (isFork) {
+				try {
+					const resource = await ResourceService.getResource({
+						workspace,
+						path: gitRepoResourcePath
+					})
+					const trackedBranch = (resource.value as any)?.branch
+					if (trackedBranch) {
+						cloneRef = `wm-fork/${trackedBranch}/${workspace.replace(/^wm-fork-/, '')}`
+					}
+				} catch (e) {
+					console.warn('Could not resolve tracked branch for fork pull:', e)
+				}
+			}
 			const payload = {
 				workspace_id: workspace,
 				repo_url_resource_path: gitRepoResourcePath,
@@ -155,7 +178,8 @@
 				only_wmill_yaml: settingsOnly,
 				settings_json: JSON.stringify(uiState),
 				use_promotion_overrides:
-					currentGitSyncSettings?.repositories?.[repoIndex!]?.use_individual_branch === true
+					currentGitSyncSettings?.repositories?.[repoIndex!]?.use_individual_branch === true,
+				...(cloneRef ? { clone_ref: cloneRef } : {})
 			}
 
 			const jobId = await JobService.runScriptByPath({
diff --git a/frontend/src/lib/components/workspaceSettings/CreateWorkspaceInner.svelte b/frontend/src/lib/components/workspaceSettings/CreateWorkspaceInner.svelte
index da709f548d..b085649b89 100644
--- a/frontend/src/lib/components/workspaceSettings/CreateWorkspaceInner.svelte
+++ b/frontend/src/lib/components/workspaceSettings/CreateWorkspaceInner.svelte
@@ -794,8 +794,7 @@
 						<Toggle bind:checked={createAsDevWorkspace} options={{ right: 'Dev workspace' }} />
 						{#if createAsDevWorkspace}
 							<div class="text-2xs text-secondary">
-								Cosmetic label: <Badge color="indigo" small>{devBadgeText(devWorkspaceLabel)}</Badge
-								>
+								Label: <Badge color="indigo" small>{devBadgeText(devWorkspaceLabel)}</Badge>
 								<button
 									type="button"
 									class="text-secondary hover:text-primary hover:underline"
diff --git a/frontend/src/lib/hubPaths.json b/frontend/src/lib/hubPaths.json
index 2ae15d931b..4c76bf3001 100644
--- a/frontend/src/lib/hubPaths.json
+++ b/frontend/src/lib/hubPaths.json
@@ -1,6 +1,6 @@
 {
 	"gitSyncTest": "hub/28184/git-repo-test-read-write-windmill",
-	"gitInitRepo": "hub/28229/git-sync%3A-init-repository-windmill",
+	"gitInitRepo": "hub/28787/git-sync%3A-init-repository-windmill",
 	"slackErrorHandler": "hub/28241/workspace-or-schedule-error-handler-slack",
 	"emailErrorHandler": "hub/19795/workspace-or-error-handler-email",
 	"slackRecoveryHandler": "hub/28239/slack/schedule-recovery-handler-slack",
diff --git a/integration_tests/test/git_sync_test.py b/integration_tests/test/git_sync_test.py
index 97d8ff03a6..c0c9fb47e9 100644
--- a/integration_tests/test/git_sync_test.py
+++ b/integration_tests/test/git_sync_test.py
@@ -19,7 +19,12 @@ def unique_name(prefix: str = "git-sync-test") -> str:
     return f"{prefix}-{uuid.uuid4().hex[:8]}"
 
 
-class TestGitSync(unittest.TestCase):
+class GitSyncTestBase(unittest.TestCase):
+    """Shared fixture + helpers for git sync e2e tests (no tests of its own).
+
+    setUpClass binds the client and cleanup lists on each concrete subclass,
+    so every test class gets its own Windmill client and cleanup scope."""
+
     _client: WindmillClient
     _gitea: GiteaClient
     _repos_to_cleanup: list
@@ -72,7 +77,8 @@ class TestGitSync(unittest.TestCase):
 
     def _setup_git_sync_resource(self, repo_name: str, branch: str = "main") -> str:
         """Create a git_repository resource pointing to the Gitea repo.
-        Returns the resource path."""
+        An empty branch leaves the field unset (repo default). Returns the
+        resource path."""
         resource_path = f"u/admin/git_sync_{repo_name.replace('-', '_')}"
         docker_url = self._gitea.get_docker_clone_url(repo_name)
         self._client.create_resource(
@@ -80,7 +86,7 @@ class TestGitSync(unittest.TestCase):
             resource_type="git_repository",
             value={
                 "url": docker_url,
-                "branch": branch,
+                **({"branch": branch} if branch else {}),
                 "is_github_app": False,
             },
             update_if_exists=True,
@@ -167,6 +173,56 @@ class TestGitSync(unittest.TestCase):
         except Exception:
             pass
 
+    def _wait_until(self, predicate, timeout: int, interval: int = 5, message: str = ""):
+        """Poll predicate() until it returns truthy or timeout (seconds) elapses.
+        Exceptions from the predicate count as 'not yet' (transient API errors)."""
+        start = time.time()
+        last_error = None
+        while time.time() - start < timeout:
+            try:
+                if predicate():
+                    return
+                last_error = None
+            except Exception as e:
+                last_error = e
+            time.sleep(interval)
+        suffix = f" (last error: {last_error})" if last_error else ""
+        self.fail(f"Timed out after {timeout}s: {message}{suffix}")
+
+    def _find_repo_settings(self, resource_path: str) -> dict:
+        """Return this workspace's stored git sync settings for the given resource."""
+        settings = self._client.get_workspace_settings()
+        for repo in (settings.get("git_sync") or {}).get("repositories", []):
+            if resource_path in repo.get("git_repo_resource_path", ""):
+                return repo
+        return None
+
+    def _deploy_seed_script(self, name_prefix: str) -> str:
+        """Deploy a script and wait for its push to git. Returns the script path."""
+        initial_count = self._client.count_deployment_callback_jobs()
+        script_path = f"u/admin/{unique_name(name_prefix)}"
+        self._client.create_script(
+            path=script_path,
+            content=ts_script("return 'seed'"),
+            language="bun",
+        )
+        self._client.wait_for_sync_jobs(initial_count, min_new=1)
+        time.sleep(3)
+        return script_path
+
+    def _repo_script_file(self, repo_name: str, script_path: str, branch: str = None) -> str:
+        """Find the .ts file for a deployed script in the repo."""
+        repo_dir = self._clone_repo(repo_name, branch=branch)
+        files = self._list_repo_files(repo_dir)
+        matching = [f for f in files if script_path in f and f.endswith(".ts")]
+        self.assertTrue(
+            len(matching) > 0,
+            f"Expected '{script_path}' .ts file in repo files: {files}",
+        )
+        return matching[0]
+
+
+class TestGitSync(GitSyncTestBase):
     # ──────────────────────────────────────────────────
     # Core happy-path tests
     # ──────────────────────────────────────────────────
@@ -735,3 +791,296 @@ class TestGitSync(unittest.TestCase):
             len(fork_branches) > 0,
             f"Expected a wm-fork branch in the repo after forking, got: {branches}",
         )
+
+
+class TestGitSyncAutoPull(GitSyncTestBase):
+    """Auto-pull (git → Windmill, EE): polling, fork-branch routing, settings
+    semantics. Webhook delivery and PR features need a GitHub App and are
+    covered by manual verification instead."""
+
+    # The poller visits repos about once a minute; a pull then runs as a job.
+    # Two poll cycles + job execution, with slack for a loaded CI runner.
+    PULL_TIMEOUT = 240
+
+    def _seed_wmill_yaml(self, repo_name: str, branch: str = "main"):
+        """Commit a minimal wmill.yaml: the pull CLI requires one in the repo.
+        Real setups get it from the init/settings-push flow; pushes alone
+        don't write it."""
+        self._gitea.create_file(
+            repo_name,
+            "wmill.yaml",
+            "defaultTs: bun\n"
+            "includes:\n"
+            '  - "**"\n'
+            "excludes: []\n"
+            "codebases: []\n"
+            "skipVariables: true\n"
+            "skipResources: true\n"
+            "skipResourceTypes: true\n"
+            "skipSecrets: true\n"
+            "includeSchedules: false\n"
+            "includeTriggers: false\n",
+            branch=branch,
+        )
+
+    def _configure_auto_pull(self, resource_path: str, sync_forks: bool = False):
+        """Single sync repo with auto-pull enabled in polling mode."""
+        auto_pull = {"enabled": True, "mode": "polling"}
+        if sync_forks:
+            auto_pull["sync_forks"] = True
+        self._client.configure_git_sync({
+            "repositories": [{
+                "git_repo_resource_path": f"$res:{resource_path}",
+                "use_individual_branch": False,
+                "group_by_folder": False,
+                "settings": {
+                    "include_type": ["script"],
+                    "include_path": ["**"],
+                },
+                "auto_pull": auto_pull,
+            }],
+        })
+
+    def test_polling_applies_remote_commit(self):
+        """A commit pushed to the tracked branch is deployed into the workspace
+        by the poller, the pull status is recorded, and the resulting no-op
+        push callback does not add a commit (no sync loop)."""
+        repo_name, _ = self._create_test_repo()
+        # Branch-less resource: the poller resolves the repo's default branch
+        # via ls-remote --symref (a bare HEAD ref would disable fork scoping).
+        resource_path = self._setup_git_sync_resource(repo_name, branch="")
+        self._configure_single_repo_sync(resource_path, include_type=["script"])
+
+        # Seed the repo through a normal deploy, then find the script's file.
+        script_path = self._deploy_seed_script("autopull")
+        script_file = self._repo_script_file(repo_name, script_path)
+        self._seed_wmill_yaml(repo_name)
+
+        self._configure_auto_pull(resource_path)
+
+        # External commit on the tracked branch (not [WM]-prefixed).
+        self._gitea.create_file(
+            repo_name, script_file, ts_script("return 'pulled from git'")
+        )
+
+        self._wait_until(
+            lambda: "pulled from git" in self._client.get_script_content(script_path),
+            timeout=self.PULL_TIMEOUT,
+            message=f"workspace script {script_path} was not updated from git",
+        )
+
+        # Pull status is recorded on the repo settings.
+        repo_settings = self._find_repo_settings(resource_path)
+        status = (repo_settings.get("auto_pull") or {}).get("last_pull_status") or {}
+        self.assertTrue(
+            status.get("success"),
+            f"Expected successful last_pull_status, got: {repo_settings.get('auto_pull')}",
+        )
+
+        # The pull-caused deploy triggers a push callback; since the workspace
+        # now matches the repo it must not create a commit (loop safety).
+        time.sleep(10)
+        repo_dir = self._clone_repo(repo_name)
+        last_msg = self._get_last_commit_message(repo_dir)
+        self.assertIn(
+            script_file,
+            last_msg,
+            f"Expected the external commit to stay the branch head (no [WM] "
+            f"loop commit), got: {last_msg!r}",
+        )
+
+        # A whole-config resave without server-owned fields (what a UI/CLI
+        # round-trip sends) must not clobber the recorded pull state.
+        self._configure_auto_pull(resource_path)
+        repo_settings = self._find_repo_settings(resource_path)
+        status = (repo_settings.get("auto_pull") or {}).get("last_pull_status") or {}
+        self.assertTrue(
+            status.get("success"),
+            f"Expected last_pull_status to survive a config resave, got: "
+            f"{repo_settings.get('auto_pull')}",
+        )
+
+    def test_fork_branch_commit_deploys_into_fork(self):
+        """With sync_forks on the parent, a commit on a fork's wm-fork/** branch
+        is deployed into the fork workspace and leaves the parent untouched."""
+        repo_name, _ = self._create_test_repo()
+        resource_path = self._setup_git_sync_resource(repo_name)
+        self._configure_single_repo_sync(resource_path, include_type=["script"])
+
+        script_path = self._deploy_seed_script("forkpull")
+        script_file = self._repo_script_file(repo_name, script_path)
+        # Seed before the fork branch is created so the branch inherits it.
+        self._seed_wmill_yaml(repo_name)
+
+        self._configure_auto_pull(resource_path, sync_forks=True)
+
+        # Create the fork (branch first, then workspace), like the UI does.
+        fork_id = f"wm-fork-{uuid.uuid4().hex[:8]}"
+        self._fork_workspaces_to_cleanup.append(fork_id)
+        job_ids = self._client.create_workspace_fork_branch(fork_id, f"Fork {fork_id}")
+        if job_ids:
+            self._client.wait_for_jobs_by_ids(job_ids, timeout=90)
+            time.sleep(3)
+        self._client.create_workspace_fork(fork_id, f"Fork {fork_id}")
+
+        fork_branch = f"wm-fork/main/{fork_id[len('wm-fork-'):]}"
+        self._gitea.create_file(
+            repo_name, script_file, ts_script("return 'fork only'"),
+            branch=fork_branch,
+        )
+
+        fork_client = WindmillClient(workspace=fork_id)
+        self._wait_until(
+            lambda: "fork only" in fork_client.get_script_content(script_path),
+            timeout=self.PULL_TIMEOUT,
+            message=f"fork workspace {fork_id} did not receive the fork-branch commit",
+        )
+
+        # The parent workspace must not see the fork-branch content.
+        self.assertNotIn(
+            "fork only",
+            self._client.get_script_content(script_path),
+            "Parent workspace received a commit from a fork branch",
+        )
+
+    def test_settings_normalization_and_redaction(self):
+        """Webhook mode on a token repo is persisted as polling; server-owned
+        webhook fields are never exposed; legacy repos gain no auto_pull key."""
+        repo_name, _ = self._create_test_repo()
+        resource_path = self._setup_git_sync_resource(repo_name)
+
+        # Token-based repos can't register webhooks: a webhook-mode save is
+        # normalized to polling and that normalization is persisted.
+        self._client.configure_git_sync({
+            "repositories": [{
+                "git_repo_resource_path": f"$res:{resource_path}",
+                "use_individual_branch": False,
+                "group_by_folder": False,
+                "settings": {"include_type": ["script"], "include_path": ["**"]},
+                "auto_pull": {"enabled": True, "mode": "webhook"},
+            }],
+        })
+        repo_settings = self._find_repo_settings(resource_path)
+        auto_pull = repo_settings.get("auto_pull") or {}
+        self.assertEqual(
+            auto_pull.get("mode"),
+            "polling",
+            f"Expected webhook mode to normalize to polling on a token repo: {auto_pull}",
+        )
+        self.assertNotIn("webhook_secret", auto_pull)
+        self.assertIsNone(auto_pull.get("webhook_id"))
+
+        # A repo saved without auto_pull stays without it (legacy round-trip).
+        self._configure_single_repo_sync(resource_path, include_type=["script"])
+        repo_settings = self._find_repo_settings(resource_path)
+        self.assertIsNone(
+            repo_settings.get("auto_pull"),
+            f"Legacy repo config unexpectedly gained auto_pull: {repo_settings}",
+        )
+
+    def test_fork_rejects_parent_only_git_sync_settings(self):
+        """Fork workspaces cannot enable auto-pull, promotion mode, or
+        fork-PR creation on their own git sync settings."""
+        repo_name, _ = self._create_test_repo()
+        resource_path = self._setup_git_sync_resource(repo_name)
+        self._configure_single_repo_sync(resource_path, include_type=["script"])
+
+        fork_id = f"wm-fork-{uuid.uuid4().hex[:8]}"
+        self._fork_workspaces_to_cleanup.append(fork_id)
+        self._client.create_workspace_fork(fork_id, f"Fork {fork_id}")
+        fork_client = WindmillClient(workspace=fork_id)
+
+        base_repo = {"git_repo_resource_path": f"$res:{resource_path}"}
+        rejected = [
+            {**base_repo, "auto_pull": {"enabled": True, "mode": "polling"}},
+            {**base_repo, "use_individual_branch": True},
+            {**base_repo, "fork_open_prs": True},
+        ]
+        for repo in rejected:
+            response = fork_client.edit_git_sync_repository(
+                f"$res:{resource_path}", repo
+            )
+            self.assertEqual(
+                response.status_code,
+                400,
+                f"Expected 400 saving {repo} on a fork, got "
+                f"{response.status_code}: {response.content.decode()}",
+            )
+
+    def test_attach_dev_workspace_strips_auto_pull(self):
+        """Attaching a workspace as a dev workspace strips its own auto-pull:
+        dev/fork sync is parent-managed, so a pre-attach auto-pull must not
+        keep pulling the old tracked branch."""
+        candidate_id = f"it-dev-cand-{uuid.uuid4().hex[:8]}"
+        self._fork_workspaces_to_cleanup.append(candidate_id)
+        candidate = WindmillClient(workspace=candidate_id)
+
+        repo_name, _ = self._create_test_repo()
+        resource_path = f"u/admin/git_sync_{repo_name.replace('-', '_')}"
+        candidate.create_resource(
+            path=resource_path,
+            resource_type="git_repository",
+            value={
+                "url": self._gitea.get_docker_clone_url(repo_name),
+                "branch": "main",
+                "is_github_app": False,
+            },
+            update_if_exists=True,
+        )
+        candidate.configure_git_sync({
+            "repositories": [{
+                "git_repo_resource_path": f"$res:{resource_path}",
+                "use_individual_branch": False,
+                "group_by_folder": False,
+                "settings": {"include_type": ["script"], "include_path": ["**"]},
+                "auto_pull": {"enabled": True, "mode": "polling"},
+            }],
+        })
+
+        response = self._client._client.post(
+            f"/api/w/{self._client._workspace}/workspaces/attach_dev_workspace",
+            json={"dev_workspace_id": candidate_id, "dev_workspace_label": "dev"},
+        )
+        self.assertEqual(
+            response.status_code // 100,
+            2,
+            f"attach_dev_workspace failed: {response.content.decode()}",
+        )
+
+        repo_settings = None
+        for repo in (candidate.get_workspace_settings().get("git_sync") or {}).get(
+            "repositories", []
+        ):
+            if resource_path in repo.get("git_repo_resource_path", ""):
+                repo_settings = repo
+        self.assertIsNotNone(repo_settings, "candidate lost its sync repo on attach")
+        self.assertIsNone(
+            repo_settings.get("auto_pull"),
+            f"auto_pull survived the attach: {repo_settings}",
+        )
+
+    def test_webhook_receiver_ignores_unknown_deliveries(self):
+        """An unsolicited webhook delivery (no registered hook) is not an error
+        and enqueues nothing."""
+        initial_count = self._client.count_deployment_callback_jobs()
+        response = self._client._client.post(
+            f"/api/w/{self._client._workspace}/github_app/webhook",
+            json={"ref": "refs/heads/main", "after": "0" * 40},
+            headers={
+                "X-GitHub-Event": "push",
+                "X-GitHub-Hook-ID": "999999999",
+                "X-Hub-Signature-256": "sha256=" + "0" * 64,
+            },
+        )
+        self.assertLess(
+            response.status_code,
+            500,
+            f"Webhook receiver errored on unknown delivery: "
+            f"{response.status_code} {response.content.decode()}",
+        )
+        time.sleep(3)
+        self.assertEqual(
+            self._client.count_deployment_callback_jobs(),
+            initial_count,
+            "Unknown webhook delivery enqueued a job",
+        )
diff --git a/integration_tests/test/wmill_integration_test_utils.py b/integration_tests/test/wmill_integration_test_utils.py
index 93730f0d31..1ae3be1ded 100644
--- a/integration_tests/test/wmill_integration_test_utils.py
+++ b/integration_tests/test/wmill_integration_test_utils.py
@@ -466,6 +466,29 @@ class WindmillClient:
             raise Exception(response.content.decode())
         return response.content.decode()
 
+    def edit_git_sync_repository(self, git_repo_resource_path: str, repository: dict):
+        """POST the per-repository git sync settings endpoint. Returns the raw
+        response so callers can assert on rejections (e.g. fork guards)."""
+        return self._client.post(
+            f"/api/w/{self._workspace}/workspaces/edit_git_sync_repository",
+            json={
+                "git_repo_resource_path": git_repo_resource_path,
+                "repository": repository,
+            },
+        )
+
+    def get_workspace_settings(self) -> dict:
+        response = self._client.get(f"/api/w/{self._workspace}/workspaces/get_settings")
+        if response.status_code // 100 != 2:
+            raise Exception(response.content.decode())
+        return response.json()
+
+    def get_script_content(self, path: str) -> str:
+        response = self._client.get(f"/api/w/{self._workspace}/scripts/get/p/{path}")
+        if response.status_code // 100 != 2:
+            raise Exception(response.content.decode())
+        return response.json().get("content", "")
+
     def get_completed_jobs(self, job_kinds: str = None, success: bool = None):
         params = {"per_page": 1000}
         if job_kinds:

From 2f6c35b15bf70f17eb8ff08281e0ecf8313e7b35 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Thu, 16 Jul 2026 16:39:33 +0200
Subject: [PATCH 022/171] fix(self-host): unbreak self-hosted Caddy after the
 caddy-l4 syntax change (#10156)

* fix(self-host): accept pre-2.11 Caddyfiles in the caddy-l4 image

The Caddyfile is a bind-mounted file the user owns, so `docker compose pull`
updates the image but never their config. #10106 and #10113 changed the syntax
the image requires (native caddy-l4 `route { proxy { upstream } }`, and a
non-empty `bind`), which strands every existing self-host on their next pull:

  Error: adapting config using caddyfile: parsing caddyfile tokens for 'layer4':
  wrong argument count or unexpected line ending after 'proxy', at line 4

Normalize legacy Caddyfiles in the entrypoint instead. Only rewrite when the
config cannot be used as-is, and on any failure exec caddy against the user's
original file so it reports a real error against what they wrote.

The bind rewrite is not cosmetic: an empty `bind {$ADDRESS}` adapts and
validates cleanly on caddy >= 2.9 but drops the whole HTTP site, so a
syntax-only shim would trade a restart loop for a container that boots clean
and serves nothing on :80.

The reference for correctness is the image published before #10106
(sha-989c9e6): whatever it adapts today is what self-hosters run, so the shim
must reproduce it byte for byte. docker/test-caddy-compat.sh asserts that over
five legacy variants, plus the :80 listener under an unset ADDRESS, every
--config spelling, relative and glob imports, and the no-op on the current
Caddyfile.

Details worth knowing:
- `to a b` becomes one `upstream` per address; `upstream a b` would be a single
  upstream with two dials, which is a different load-balancing topology.
- The rewrite lands next to the original, because caddy resolves `import`
  relative to the importing file and a glob import would otherwise silently
  expand to nothing.
- The image has no ENTRYPOINT and CMD ["caddy", ...], so an existing
  `command:` override starts with a `caddy` token the entrypoint absorbs.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(self-host): route ws_mp and ws_debug to the extra gateway

reverse_proxy only reads its first argument as a matcher, so

  reverse_proxy /ws/* /ws_mp/* /ws_debug/* http://windmill_extra:3000

adapts to a single /ws/* route whose upstreams are `ws_mp/*:80`,
`ws_debug/*:80` and `windmill_extra:3000`. LSP therefore round-robins across
two garbage hostnames and connects only one time in three, while /ws_mp/* and
/ws_debug/* match no route at all and fall through to windmill_server:8000.

Use a named matcher so all three paths reach the gateway. Verified with traffic
against separate windmill_server and windmill_extra backends: before, /ws/lsp
fails and /ws_mp/room reaches windmill_server; after, all three reach the
gateway with the path preserved and /user/login still reaches windmill_server.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore(self-host): pin the caddy-l4 image to an explicit version

:latest and the bind-mounted ./Caddyfile it has to agree with are updated by
different mechanisms, so they drift. Publish an explicit version alongside
:latest and pin docker-compose.yml to it, so a checkout is self-consistent:
compose, Caddyfile and image version now move together in one commit.

CI fails the build when docker/caddy-l4.version and the docker-compose.yml pin
disagree, and runs the compatibility-shim tests before publishing. The path
filter now covers the entrypoint, the normalizer, the Caddyfile and
docker-compose.yml, so a change to any guarded input actually triggers the
workflow rather than leaving the check unrun.

:latest keeps being published, since existing deployments reference it and that
is how they pick up the compatibility shim.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(self-host): make the caddy-l4 version tag publishable before the pin merges

docker-compose.yml pins an exact tag, but the version tag was gated on the
default branch, so the tag only appeared after the pin had already merged.
Between the merge and the build finishing, a fresh `docker compose up -d` off
main fails with "manifest unknown", and a failed build leaves main permanently
referencing an image that does not exist.

Drop the gate so the tag can be published from the branch via
workflow_dispatch before merging the pin. The version is immutable, so
republishing it from main is a no-op, and only pushes to main and manual
dispatch run this workflow, so a branch cannot claim the tag by accident.
:latest stays gated on main.

Also check the version file against the caddy version the Dockerfile pins.
Without it, a caddy bump that forgets the version file publishes a tag naming
the wrong caddy.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(self-host): do not log Caddyfile contents from the compat shim

The shim logged a unified diff of the rewrite, which carries three lines of
context around each change. A Caddyfile is user-owned and can hold basic_auth
hashes, proxy Authorization headers or TLS provider tokens, and container logs
are routinely shipped off the host, so normalizing a customized config could
copy secrets into them. Reproduced with a basic_auth bcrypt hash landing in the
log as context around the bind rewrite.

Log the number of rewritten lines and the path to the rewritten file instead.
It sits next to the original, so an operator can diff it themselves.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .github/workflows/build-caddy-l4-image.yml |  51 ++++++
 Caddyfile                                  |   8 +-
 docker-compose.yml                         |   5 +-
 docker/DockerfileCaddyL4                   |  11 ++
 docker/caddy-compat-normalize.awk          |  61 +++++++
 docker/caddy-l4.version                    |   1 +
 docker/entrypoint-caddy.sh                 | 181 +++++++++++++++++++++
 docker/test-caddy-compat.sh                | 146 +++++++++++++++++
 8 files changed, 461 insertions(+), 3 deletions(-)
 create mode 100644 docker/caddy-compat-normalize.awk
 create mode 100644 docker/caddy-l4.version
 create mode 100755 docker/entrypoint-caddy.sh
 create mode 100755 docker/test-caddy-compat.sh

diff --git a/.github/workflows/build-caddy-l4-image.yml b/.github/workflows/build-caddy-l4-image.yml
index e4cfdf8112..a26f1df2cc 100644
--- a/.github/workflows/build-caddy-l4-image.yml
+++ b/.github/workflows/build-caddy-l4-image.yml
@@ -10,6 +10,14 @@ on:
       - main
     paths:
       - docker/DockerfileCaddyL4
+      - docker/entrypoint-caddy.sh
+      - docker/caddy-compat-normalize.awk
+      - docker/caddy-l4.version
+      - docker/test-caddy-compat.sh
+      - Caddyfile
+      # The version check below reads the pin out of docker-compose.yml, so a
+      # compose-only bump has to trigger this workflow or the check never runs.
+      - docker-compose.yml
       - .github/workflows/build-caddy-l4-image.yml
 
 permissions: write-all
@@ -20,6 +28,35 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - uses: depot/setup-action@v1
+
+      # docker-compose.yml pins an exact tag, and the Caddyfile it must agree
+      # with lives in the same checkout. Fail the build rather than publish a
+      # version nothing references, which is how :latest drifted from the
+      # Caddyfile in the first place.
+      - name: Resolve and check image version
+        id: version
+        run: |
+          set -euo pipefail
+          version="$(tr -d '[:space:]' < docker/caddy-l4.version)"
+          pinned="$(grep -oE 'caddy-l4:[^[:space:]"]+' docker-compose.yml | head -1 | cut -d: -f2-)"
+          caddy="$(grep -m1 -oE '^FROM caddy:[0-9]+\.[0-9]+\.[0-9]+' docker/DockerfileCaddyL4 | cut -d: -f2)"
+          if [ "$version" != "$pinned" ]; then
+            echo "docker/caddy-l4.version is '$version' but docker-compose.yml pins '$pinned'" >&2
+            echo "Bump both together." >&2
+            exit 1
+          fi
+          # Otherwise a caddy bump that forgets the version file publishes a tag
+          # that names the wrong caddy.
+          case "$version" in
+            "$caddy"-*) ;;
+            *)
+              echo "docker/caddy-l4.version is '$version' but the Dockerfile pins caddy '$caddy'" >&2
+              echo "The version must be <caddy-version>-<revision>." >&2
+              exit 1
+              ;;
+          esac
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
       - name: Docker meta
         id: meta-ee-public
         uses: docker/metadata-action@v5
@@ -29,8 +66,22 @@ jobs:
           tags: |
             type=sha
             type=ref,event=branch
+            # Not gated on the default branch: docker-compose.yml pins this tag,
+            # so it has to be publishable from a branch (workflow_dispatch)
+            # before the pin merges, or main would reference a tag that does not
+            # exist yet. The version is immutable, so republishing from main is
+            # a no-op. Only branch pushes to main and manual dispatch run this
+            # workflow, so a branch cannot claim the tag by accident.
+            type=raw,value=${{ steps.version.outputs.version }}
             type=raw,value=latest,enable={{is_default_branch}}
 
+      # The shim rewrites config a self-hoster never sees, so a silent
+      # regression here strands them on a restart loop or a dead :80.
+      - name: Test the legacy-Caddyfile compatibility shim
+        run: |
+          docker build -f docker/DockerfileCaddyL4 -t caddy-l4:ci ./docker
+          docker/test-caddy-compat.sh caddy-l4:ci
+
       - name: Login to registry
         uses: docker/login-action@v3
         with:
diff --git a/Caddyfile b/Caddyfile
index 07496bdbfb..3008c93855 100644
--- a/Caddyfile
+++ b/Caddyfile
@@ -16,8 +16,12 @@
         # site, silently disabling the HTTP proxy while the :25 layer4 listener stays up.
         bind {$ADDRESS:0.0.0.0 ::}
 
-        # Extra services: LSP, Multiplayer, Debugger (windmill_extra gateway)
-        reverse_proxy /ws/* /ws_mp/* /ws_debug/* http://windmill_extra:3000
+        # Extra services: LSP, Multiplayer, Debugger (windmill_extra gateway).
+        # reverse_proxy only reads its first argument as a matcher, so listing
+        # several paths inline turns the rest into upstream addresses. The paths
+        # have to go through a named matcher.
+        @extra path /ws/* /ws_mp/* /ws_debug/*
+        reverse_proxy @extra http://windmill_extra:3000
 
         # Search indexer, Enterprise Edition (windmill_indexer:8002)
         # reverse_proxy /api/srch/* http://windmill_indexer:8002
diff --git a/docker-compose.yml b/docker-compose.yml
index 60be2185b0..93fbf28e8d 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -190,7 +190,10 @@ services:
     logging: *default-logging
 
   caddy:
-    image: ghcr.io/windmill-labs/caddy-l4:latest
+    # Pinned: this image and the ./Caddyfile next to it are version-coupled, so
+    # they have to move together. Bump docker/caddy-l4.version in the same
+    # commit as any Caddyfile change.
+    image: ghcr.io/windmill-labs/caddy-l4:2.11.4-1
     restart: unless-stopped
     # Configure the mounted Caddyfile and the exposed ports or use another reverse proxy if needed
     volumes:
diff --git a/docker/DockerfileCaddyL4 b/docker/DockerfileCaddyL4
index d2d7bb418f..62bcca1b4b 100644
--- a/docker/DockerfileCaddyL4
+++ b/docker/DockerfileCaddyL4
@@ -10,3 +10,14 @@ RUN xcaddy build \
 FROM caddy:2.11.4-alpine
 
 COPY --from=builder /usr/bin/caddy /usr/bin/caddy
+
+COPY caddy-compat-normalize.awk /usr/local/lib/caddy-compat/normalize.awk
+COPY entrypoint-caddy.sh /usr/local/bin/entrypoint-caddy.sh
+RUN chmod +x /usr/local/bin/entrypoint-caddy.sh
+
+# The base image has no ENTRYPOINT and puts `caddy` in CMD, so setting an
+# ENTRYPOINT here both resets CMD (restated below) and changes what a user's
+# existing `command:` override means. The entrypoint absorbs a leading `caddy`
+# token so both forms keep working.
+ENTRYPOINT ["/usr/local/bin/entrypoint-caddy.sh"]
+CMD ["run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]
diff --git a/docker/caddy-compat-normalize.awk b/docker/caddy-compat-normalize.awk
new file mode 100644
index 0000000000..00cd4a7b20
--- /dev/null
+++ b/docker/caddy-compat-normalize.awk
@@ -0,0 +1,61 @@
+# Rewrites a pre-2.11 Windmill Caddyfile to the form caddy >= 2.9 with native
+# caddy-l4 requires. Two rewrites, both no-ops on a current Caddyfile so this is
+# idempotent:
+#
+#   layer4 { :25 { proxy { to X } } }  ->  layer4 { :25 { route { proxy { upstream X } } } }
+#   bind {$ADDRESS}                    ->  bind {$ADDRESS:0.0.0.0 ::}
+#
+# The second is not cosmetic: an empty bind makes caddy >= 2.9 drop the whole
+# HTTP site, so without it a legacy Caddyfile boots clean and serves nothing on
+# :80 while :25 keeps working.
+#
+# Only the layer4 block and that one literal bind token are touched; a proxy
+# already nested in a route block is left alone.
+
+BEGIN { depth = 0; inL4 = 0; l4depth = 0; inRoute = 0; rdepth = 0; inProxy = 0; pdepth = 0 }
+{
+  line = $0
+
+  if (line ~ /^[[:space:]]*bind[[:space:]]+\{\$ADDRESS\}[[:space:]]*$/) {
+    sub(/\{\$ADDRESS\}/, "{$ADDRESS:0.0.0.0 ::}", line)
+    print line
+    next
+  }
+
+  if (!inL4 && line ~ /^[[:space:]]*layer4[[:space:]]*\{/) { inL4 = 1; l4depth = depth; print; depth++; next }
+  if (inL4 && line ~ /^[[:space:]]*route[[:space:]]*\{/) { inRoute = 1; rdepth = depth; print; depth++; next }
+
+  if (inL4 && !inRoute && !inProxy && line ~ /^[[:space:]]*proxy[[:space:]]*\{[[:space:]]*$/) {
+    match(line, /^[[:space:]]*/); ind = substr(line, 1, RLENGTH)
+    print ind "route {"
+    print ind "\tproxy {"
+    inProxy = 1; pdepth = depth; depth++
+    next
+  }
+
+  # `to a b` is two load-balanced upstreams, whereas `upstream a b` is a single
+  # upstream with two dial addresses. Emit one `upstream` per address to keep
+  # the adapted JSON identical.
+  if (inProxy && line ~ /^[[:space:]]*to[[:space:]]+/) {
+    match(line, /^[[:space:]]*/); ind = substr(line, 1, RLENGTH)
+    nf = split(line, parts, /[[:space:]]+/)
+    for (i = 1; i <= nf; i++) if (parts[i] == "to") break
+    for (j = i + 1; j <= nf; j++) if (parts[j] != "") print "\t" ind "upstream " parts[j]
+    next
+  }
+
+  n = gsub(/\{/, "{", line); m = gsub(/\}/, "}", line); depth += n - m
+
+  if (inProxy && depth == pdepth) {
+    match(line, /^[[:space:]]*/); ind = substr(line, 1, RLENGTH)
+    print "\t" line
+    print ind "}"
+    inProxy = 0
+    next
+  }
+
+  if (inRoute && depth <= rdepth) inRoute = 0
+  if (inL4 && depth <= l4depth) inL4 = 0
+
+  if (inProxy) print "\t" line; else print line
+}
diff --git a/docker/caddy-l4.version b/docker/caddy-l4.version
new file mode 100644
index 0000000000..ef9fe858b5
--- /dev/null
+++ b/docker/caddy-l4.version
@@ -0,0 +1 @@
+2.11.4-1
diff --git a/docker/entrypoint-caddy.sh b/docker/entrypoint-caddy.sh
new file mode 100755
index 0000000000..65355296f3
--- /dev/null
+++ b/docker/entrypoint-caddy.sh
@@ -0,0 +1,181 @@
+#!/bin/sh
+# The Caddyfile is a bind-mounted file the user owns, so `docker compose pull`
+# updates this image but never their config. Caddy >= 2.9 with native caddy-l4
+# rejects the syntax we shipped before 2026-07, which would strand every
+# existing self-host on a pull. Normalize legacy Caddyfiles here instead.
+#
+# Rewrite only when the config cannot be used as-is, and never fail closed: on
+# any failure, exec caddy against the user's original file so it reports a real
+# error against what they wrote. A shim that exits, or that claims a rewrite it
+# did not apply, is worse than no shim at all.
+set -eu
+
+NORMALIZE_AWK=/usr/local/lib/caddy-compat/normalize.awk
+NORMALIZED_DIR=/tmp/caddy-compat
+DOCS_HINT="https://github.com/windmill-labs/windmill/blob/main/Caddyfile"
+
+log() { echo "caddy-compat: $*" >&2; }
+
+# The image had no ENTRYPOINT and CMD ["caddy", "run", ...], so an existing
+# `command:` override in a user's compose file starts with `caddy`. Accept it
+# with or without that leading token.
+if [ "${1:-}" = "caddy" ]; then
+	shift
+fi
+
+# caddy accepts --config X, --config=X, -c X, -c=X and -cX. Record which form
+# was used and at which position, so the rewritten path can be substituted back
+# in the same form rather than by matching on the string.
+config=""
+config_idx=0
+config_form=""
+envfile=""
+prev=""
+i=0
+for arg in "$@"; do
+	i=$((i + 1))
+	case "$arg" in
+	--config=*) config="${arg#--config=}"; config_idx=$i; config_form="eq-long" ;;
+	-c=*) config="${arg#-c=}"; config_idx=$i; config_form="eq-short" ;;
+	-c?*) config="${arg#-c}"; config_idx=$i; config_form="attached" ;;
+	esac
+	case "$prev" in
+	--config | -c) config="$arg"; config_idx=$i; config_form="space" ;;
+	--envfile) envfile="$arg" ;;
+	esac
+	case "$arg" in
+	--envfile=*) envfile="${arg#--envfile=}" ;;
+	esac
+	prev="$arg"
+done
+
+# With no explicit --config, caddy resolves its own default relative to the
+# working directory. Guessing at that path risks inspecting a different file
+# than the one caddy will load, so leave it alone.
+if [ "$config_idx" -eq 0 ] || [ ! -r "$config" ]; then
+	exec caddy "$@"
+fi
+
+# The shim's own validate has to see the same env expansion caddy will.
+validate_config() {
+	if [ -n "$envfile" ]; then
+		caddy validate --config "$1" --adapter caddyfile --envfile "$envfile" 2>&1
+	else
+		caddy validate --config "$1" --adapter caddyfile 2>&1
+	fi
+}
+
+original_err=""
+normalized=""
+
+dump_failure() {
+	log "---------------- caddy-l4 compatibility shim ----------------"
+	log "Your Caddyfile could not be used as-is, and the compatibility"
+	log "rewrite did not produce a valid config either. Caddy will now"
+	log "run against your original file and report its own error below."
+	log ""
+	log "Config:     $config"
+	log "Normalized: ${normalized:-<not produced>}"
+	log "Reference:  $DOCS_HINT"
+	if [ -n "$original_err" ]; then
+		log ""
+		log "Error validating your Caddyfile as written:"
+		echo "$original_err" | sed 's/^/caddy-compat:   /' >&2
+	fi
+	if [ -n "${1:-}" ]; then
+		log ""
+		log "Error from the compatibility rewrite:"
+		echo "$1" | sed 's/^/caddy-compat:   /' >&2
+	fi
+	log ""
+	log "Most likely fix: replace your Caddyfile with the current one from"
+	log "the Windmill repo, then re-apply your customizations on top."
+	log "-------------------------------------------------------------"
+}
+
+# A bare `bind {$ADDRESS}` adapts and validates cleanly, it just silently drops
+# the HTTP site at runtime, so validate alone cannot decide this.
+needs_rewrite=0
+if ! original_err=$(validate_config "$config"); then
+	needs_rewrite=1
+	log "'$config' is not valid for this caddy version, attempting compatibility rewrite"
+else
+	original_err=""
+fi
+if grep -Eq '^[[:space:]]*bind[[:space:]]+\{\$ADDRESS\}[[:space:]]*$' "$config"; then
+	needs_rewrite=1
+	log "'$config' has a bare 'bind {\$ADDRESS}', which caddy >= 2.9 treats as an"
+	log "empty bind and drops the entire HTTP site; attempting compatibility rewrite"
+fi
+
+if [ "$needs_rewrite" -eq 0 ]; then
+	exec caddy "$@"
+fi
+
+# caddy resolves `import` relative to the directory of the file containing it,
+# so the rewritten file has to stay next to the original. Falling back to a
+# different directory would make an exact import fail and, worse, make a glob
+# import silently match nothing and drop whatever it pulled in.
+config_dir=$(dirname "$config")
+sibling="$config_dir/.caddy-compat.Caddyfile"
+# `touch`, not `: >`: a redirection failure on a special builtin is fatal to the
+# shell even inside an `if`, which would kill the shim instead of falling
+# through to caddy.
+if touch "$sibling" 2>/dev/null; then
+	normalized="$sibling"
+elif grep -Eq '^[[:space:]]*import[[:space:]]' "$config"; then
+	log "'$config_dir' is not writable and '$config' uses 'import', whose relative"
+	log "paths would not resolve from anywhere else. Refusing to rewrite rather than"
+	log "silently drop imported config."
+	dump_failure ""
+	exec caddy "$@"
+elif mkdir -p "$NORMALIZED_DIR" 2>/dev/null; then
+	normalized="$NORMALIZED_DIR/Caddyfile"
+else
+	log "nowhere writable to put the rewritten config, skipping the rewrite"
+	dump_failure ""
+	exec caddy "$@"
+fi
+
+if ! awk_err=$(awk -f "$NORMALIZE_AWK" "$config" 2>&1 >"$normalized"); then
+	dump_failure "$awk_err"
+	exec caddy "$@"
+fi
+
+if ! normalized_err=$(validate_config "$normalized"); then
+	dump_failure "$normalized_err"
+	exec caddy "$@"
+fi
+
+# Report a count and a path, never the config itself: a Caddyfile can hold
+# basic_auth hashes, proxy Authorization headers or TLS provider tokens, and
+# container logs are routinely shipped off the host.
+# busybox diff defaults to unified output while GNU diff defaults to normal, so
+# match changed lines in either format without matching a +++/--- header.
+changed="$(diff "$config" "$normalized" 2>/dev/null | grep -cE '^([<>]|[+-][^+-])' || true)"
+log "'$config' uses a deprecated Windmill Caddyfile syntax and was adapted at"
+log "startup: $changed line(s) rewritten. Diff it against '$normalized' to see"
+log "exactly what changed. Copy the current Caddyfile from $DOCS_HINT"
+log "to silence this; the shim will be removed in a later release."
+
+# caddy now reads the rewritten file, so `--watch` follows it rather than the
+# bind-mounted original, and `caddy reload --config /etc/caddy/Caddyfile` would
+# reload the un-normalized file. Both are non-default; a legacy config that
+# needs this shim should be replaced rather than live-edited.
+i=0
+for arg in "$@"; do
+	i=$((i + 1))
+	if [ "$i" -eq "$config_idx" ]; then
+		case "$config_form" in
+		space) set -- "$@" "$normalized" ;;
+		eq-long) set -- "$@" "--config=$normalized" ;;
+		eq-short) set -- "$@" "-c=$normalized" ;;
+		attached) set -- "$@" "-c$normalized" ;;
+		esac
+	else
+		set -- "$@" "$arg"
+	fi
+	shift
+done
+
+exec caddy "$@"
diff --git a/docker/test-caddy-compat.sh b/docker/test-caddy-compat.sh
new file mode 100755
index 0000000000..b8be14f0f9
--- /dev/null
+++ b/docker/test-caddy-compat.sh
@@ -0,0 +1,146 @@
+#!/usr/bin/env bash
+# Regression tests for the caddy-l4 legacy-Caddyfile compatibility shim.
+#
+# The reference for "correct" is the image published before #10106
+# (REFERENCE_IMAGE): whatever config it adapts today is what existing
+# self-hosters are running, so the shim must reproduce it byte for byte.
+#
+# Usage: docker/test-caddy-compat.sh [image-tag]
+set -euo pipefail
+
+IMAGE="${1:-caddy-l4:test}"
+REFERENCE_IMAGE="${REFERENCE_IMAGE:-ghcr.io/windmill-labs/caddy-l4:sha-989c9e6}"
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+WORK="$(mktemp -d)"
+trap 'rm -rf "$WORK"' EXIT
+
+pass=0
+fail=0
+ok() { printf '  \033[32mok\033[0m   %s\n' "$1"; pass=$((pass + 1)); }
+no() { printf '  \033[31mFAIL\033[0m %s\n' "$1"; fail=$((fail + 1)); }
+
+# SELinux-labelled hosts (Fedora) reject plain bind mounts into containers.
+MOUNT_OPTS=()
+if command -v getenforce >/dev/null 2>&1 && [ "$(getenforce 2>/dev/null)" != "Disabled" ]; then
+	MOUNT_OPTS=(--security-opt label=disable)
+fi
+
+adapt() { # adapt <image> <caddyfile> [env...]
+	local image="$1" file="$2"
+	shift 2
+	local env_args=()
+	local e
+	for e in "$@"; do env_args+=(-e "$e"); done
+	# The `caddy` prefix is how the pre-#10106 image is invoked (no ENTRYPOINT,
+	# CMD ["caddy", ...]); the shim accepts it too, which this exercises.
+	docker run --rm "${MOUNT_OPTS[@]}" "${env_args[@]}" \
+		-v "$file:/etc/caddy/Caddyfile:ro" "$image" \
+		caddy adapt --config /etc/caddy/Caddyfile 2>/dev/null
+}
+
+# The legacy Caddyfile as shipped before #10106, which is what a self-hoster who
+# has never touched their config still has on disk.
+cat >"$WORK/legacy.Caddyfile" <<'EOF'
+{
+	layer4 {
+		:25 {
+			proxy {
+				to windmill_server:2525
+			}
+		}
+	}
+}
+
+{$BASE_URL} {
+        bind {$ADDRESS}
+        reverse_proxy /ws/* /ws_mp/* /ws_debug/* http://windmill_extra:3000
+        reverse_proxy /* http://windmill_server:8000
+}
+EOF
+
+echo "==> equivalence with the pre-#10106 image (ADDRESS set, so bind is neutral)"
+docker pull -q "$REFERENCE_IMAGE" >/dev/null 2>&1 || true
+if ! docker image inspect "$REFERENCE_IMAGE" >/dev/null 2>&1; then
+	echo "  skipped: $REFERENCE_IMAGE unavailable"
+else
+	# Each variant is a plausible user modification of the legacy Caddyfile.
+	make_variant() {
+		case "$1" in
+		stock) cat "$WORK/legacy.Caddyfile" ;;
+		custom_smtp) sed 's|to windmill_server:2525|to mailhog:2626|' "$WORK/legacy.Caddyfile" ;;
+		multi_upstream) sed 's|to windmill_server:2525|to a:2525 b:2525|' "$WORK/legacy.Caddyfile" ;;
+		extra_listener) sed 's|\t\t:25 {|\t\t:587 {\n\t\t\tproxy {\n\t\t\t\tto windmill_server:2525\n\t\t\t}\n\t\t}\n\t\t:25 {|' "$WORK/legacy.Caddyfile" ;;
+		extra_directive) sed 's|reverse_proxy /\*|encode gzip\n\treverse_proxy /*|' "$WORK/legacy.Caddyfile" ;;
+		esac
+	}
+	for name in stock custom_smtp multi_upstream extra_listener extra_directive; do
+		make_variant "$name" >"$WORK/v.Caddyfile"
+		a="$(adapt "$REFERENCE_IMAGE" "$WORK/v.Caddyfile" 'BASE_URL=:80' 'ADDRESS=0.0.0.0')"
+		b="$(adapt "$IMAGE" "$WORK/v.Caddyfile" 'BASE_URL=:80' 'ADDRESS=0.0.0.0')"
+		if [ -n "$a" ] && [ "$a" = "$b" ]; then ok "$name: adapted config identical"; else no "$name: adapted config differs"; fi
+	done
+fi
+
+echo "==> the HTTP site must survive an unset ADDRESS (#10113: validate cannot catch this)"
+listen="$(adapt "$IMAGE" "$WORK/legacy.Caddyfile" 'BASE_URL=:80' | grep -o '"listen":\[[^]]*\]' | head -1)"
+case "$listen" in
+*:80*) ok "legacy Caddyfile still binds :80 (${listen})" ;;
+*) no "legacy Caddyfile dropped the HTTP site (listen=${listen:-none})" ;;
+esac
+
+echo "==> the shipped Caddyfile must be untouched by the shim"
+noise="$(docker run --rm "${MOUNT_OPTS[@]}" -e BASE_URL=':80' \
+	-v "$REPO_ROOT/Caddyfile:/etc/caddy/Caddyfile:ro" "$IMAGE" \
+	adapt --config /etc/caddy/Caddyfile 2>&1 >/dev/null | grep -c 'caddy-compat' || true)"
+[ "$noise" -eq 0 ] && ok "no rewrite on the current Caddyfile" || no "shim fired on the current Caddyfile"
+
+echo "==> every --config form must load the rewritten file"
+check_form() {
+	local label="$1"
+	shift
+	local out
+	out="$(docker run --rm "${MOUNT_OPTS[@]}" -e BASE_URL=':80' \
+		-v "$WORK/legacy.Caddyfile:/etc/caddy/Caddyfile:ro" "$IMAGE" "$@" 2>&1 >/dev/null |
+		grep -E '"file":' | head -1 || true)"
+	case "$out" in
+	*caddy-compat*) ok "$label" ;;
+	*) no "$label (loaded: ${out:-nothing})" ;;
+	esac
+}
+check_form '--config PATH' adapt --config /etc/caddy/Caddyfile
+check_form '--config=PATH' adapt --config=/etc/caddy/Caddyfile
+check_form '-c PATH' adapt -c /etc/caddy/Caddyfile
+check_form '-c=PATH' adapt -c=/etc/caddy/Caddyfile
+check_form '-cPATH' adapt -c/etc/caddy/Caddyfile
+
+echo "==> relative imports must survive the rewrite"
+# caddy resolves `import` against the directory of the file holding it, so a
+# rewrite that relocates the config would break an exact import and make a glob
+# import silently expand to nothing.
+mkdir -p "$WORK/withimport"
+sed 's|reverse_proxy /\* http://windmill_server:8000|import extra.caddy\n\treverse_proxy /* http://windmill_server:8000|' \
+	"$WORK/legacy.Caddyfile" >"$WORK/withimport/Caddyfile"
+echo 'reverse_proxy /imported/* http://imported_backend:9999' >"$WORK/withimport/extra.caddy"
+printf 'reverse_proxy /globbed/* http://globbed_backend:9998\n' >"$WORK/withimport/glob-one.caddy"
+sed -i 's|import extra.caddy|import extra.caddy\n\timport glob-*.caddy|' "$WORK/withimport/Caddyfile"
+imported="$(docker run --rm "${MOUNT_OPTS[@]}" -e BASE_URL=':80' \
+	-v "$WORK/withimport:/etc/caddy" "$IMAGE" \
+	adapt --config /etc/caddy/Caddyfile 2>/dev/null)"
+case "$imported" in
+*imported_backend:9999*) ok "exact import survives" ;;
+*) no "exact import lost after rewrite" ;;
+esac
+case "$imported" in
+*globbed_backend:9998*) ok "glob import survives" ;;
+*) no "glob import silently dropped after rewrite" ;;
+esac
+
+echo "==> a config the shim cannot fix must still reach caddy's own error"
+broken="$(docker run --rm "${MOUNT_OPTS[@]}" --read-only -e BASE_URL=':80' \
+	-v "$WORK/legacy.Caddyfile:/etc/caddy/Caddyfile:ro" "$IMAGE" \
+	run --config /etc/caddy/Caddyfile --adapter caddyfile 2>&1 | grep -c '^Error:' || true)"
+[ "$broken" -ge 1 ] && ok "read-only rootfs still execs caddy and reports its error" || no "read-only rootfs swallowed caddy's error"
+
+echo
+echo "passed: $pass   failed: $fail"
+[ "$fail" -eq 0 ]

From 0e547adf23b615f0caccc88eb9101bb0604bb51b Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Thu, 16 Jul 2026 17:22:28 +0200
Subject: [PATCH 023/171] fix(migrations): grant zombie_job_counter to windmill
 roles (#10159)

The zombie_job_counter table (20250205131522) was never granted explicitly
to windmill_user / windmill_admin. The generic GRANT ALL ON ALL TABLES in
20250205131523 swallows failures via EXCEPTION WHEN OTHERS, and the
ALTER DEFAULT PRIVILEGES it sets only covers objects created by that same
role, so external-database deployments whose migration runner differs from
the init-script runner leave the table ungranted.

This stayed invisible while the table was only reached through ON DELETE
CASCADE, which bypasses caller permissions. 20260625092813 replaced those
cascades with explicit DELETEs in delete_jobs(), which run as the invoking
role and fail with "permission denied for table zombie_job_counter".

Same fix already applied to notify_event (20260619091631), script_trigger
(20260619112847) and dispatch_event (20260701080313).

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 ...t_zombie_job_counter_to_windmill_roles.down.sql |  2 ++
 ...ant_zombie_job_counter_to_windmill_roles.up.sql | 14 ++++++++++++++
 2 files changed, 16 insertions(+)
 create mode 100644 backend/migrations/20260716151337_grant_zombie_job_counter_to_windmill_roles.down.sql
 create mode 100644 backend/migrations/20260716151337_grant_zombie_job_counter_to_windmill_roles.up.sql

diff --git a/backend/migrations/20260716151337_grant_zombie_job_counter_to_windmill_roles.down.sql b/backend/migrations/20260716151337_grant_zombie_job_counter_to_windmill_roles.down.sql
new file mode 100644
index 0000000000..ab9357e09e
--- /dev/null
+++ b/backend/migrations/20260716151337_grant_zombie_job_counter_to_windmill_roles.down.sql
@@ -0,0 +1,2 @@
+REVOKE ALL ON zombie_job_counter FROM windmill_user;
+REVOKE ALL ON zombie_job_counter FROM windmill_admin;
diff --git a/backend/migrations/20260716151337_grant_zombie_job_counter_to_windmill_roles.up.sql b/backend/migrations/20260716151337_grant_zombie_job_counter_to_windmill_roles.up.sql
new file mode 100644
index 0000000000..b8db8dfb0d
--- /dev/null
+++ b/backend/migrations/20260716151337_grant_zombie_job_counter_to_windmill_roles.up.sql
@@ -0,0 +1,14 @@
+-- The zombie_job_counter table (migration 20250205131522) was created relying on
+-- ALTER DEFAULT PRIVILEGES to grant access to windmill_user and windmill_admin.
+-- Those default privileges only apply to objects created by the role that set
+-- them (migration 20250205131523), so deployments whose migration runner is a
+-- different role leave zombie_job_counter ungranted. The table used to be
+-- reached only through ON DELETE CASCADE, which bypasses caller permissions,
+-- but 20260625092813_drop_v2_job_side_table_cascades replaced that cascade with
+-- an explicit DELETE in delete_jobs (windmill-common/src/jobs.rs) which runs as
+-- the invoking role and fails with "permission denied for table
+-- zombie_job_counter". Grant explicitly to guarantee access regardless of who
+-- ran the migrations (same fix as notify_event in 20260619091631,
+-- script_trigger in 20260619112847 and dispatch_event in 20260701080313).
+GRANT ALL ON zombie_job_counter TO windmill_user;
+GRANT ALL ON zombie_job_counter TO windmill_admin;

From 4e63ca2cd429ecf55f27a431dfb2c0fd85e2c8c8 Mon Sep 17 00:00:00 2001
From: hugocasa <hugo@casademont.ch>
Date: Thu, 16 Jul 2026 17:23:24 +0200
Subject: [PATCH 024/171] gate PR ready on clean agent-driven review rounds
 (#10157)

* feat(ci): gate PR ready on clean review rounds driven from draft

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ci): robust review-round wait loop, require codex evidence for marker skip

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ci): require pre-marker codex evidence, fail open on marker fetch errors

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
---
 .agents/skills/pr/SKILL.md            |  39 +++++++-
 .agents/skills/pr/review-round.sh     | 129 ++++++++++++++++++++++++++
 .github/workflows/codex-pr-review.yml |  33 +++++++
 .github/workflows/pi-pr-review.yml    |  33 +++++++
 .github/workflows/pr-ready-review.yml |  47 ++++++++++
 docs/autonomous-mode.md               |   2 +
 6 files changed, 281 insertions(+), 2 deletions(-)
 create mode 100755 .agents/skills/pr/review-round.sh

diff --git a/.agents/skills/pr/SKILL.md b/.agents/skills/pr/SKILL.md
index 61758550b2..51cd2305c3 100644
--- a/.agents/skills/pr/SKILL.md
+++ b/.agents/skills/pr/SKILL.md
@@ -1,18 +1,19 @@
 ---
 name: pr
 user_invocable: true
-description: Open a draft pull request on GitHub. MUST use when you want to create/open a PR.
+description: Open a draft pull request on GitHub and drive CI review rounds until it is ready. MUST use when you want to create/open a PR.
 ---
 
 # Pull Request Skill
 
-Create a draft pull request with a clear title and explicit description of changes.
+Create a draft pull request with a clear title and explicit description of changes, then drive it through CI review rounds to ready.
 
 ## Instructions
 
 1. **Analyze branch changes**: Understand all commits since diverging from main
 2. **Push to remote**: Ensure all commits are pushed
 3. **Create draft PR**: Always open as draft for review before merging
+4. **Drive review rounds**: trigger CI reviews on the draft and only flip to ready once every verdict is a go (see "Review rounds" below)
 
 ## PR Title Format
 
@@ -124,6 +125,40 @@ and continue once they confirm it's done.
    )"
    ```
 9. Return the PR URL to the user
+10. Drive the PR through CI review rounds to ready (see "Review rounds" below)
+
+## Review rounds (draft → ready)
+
+A PR leaves draft **only after a clean CI review round**. Never run `gh pr ready` before that.
+
+1. **Trigger a round and wait for it**: launch the waiter as a background Bash task (a round takes 10–30 min; you are woken when it exits — do not stop the session or poll in the foreground while it runs):
+
+   ```bash
+   bash .agents/skills/pr/review-round.sh <PR_NUMBER>
+   ```
+
+   It comments `/review` on the PR — which runs the Codex, Claude and Pi CI reviewers even on a draft — waits for the spawned `PR Review Commands` workflow run(s) to complete, then prints one verdict line per reviewer and saves the full review comments to files.
+
+2. **Judge the round.** Codex is mandatory; Claude, Pi and cubic count whenever they posted. Every review starts with one of the three `REVIEW.md` verdicts:
+   - Codex verdict missing → the round is void: comment `/codex` on the PR, wait for it the same way, and judge again.
+   - Any **"Should address issues before merging"** → fix the P0/P1 findings (and the nits while you're there), commit, push, and start a new round (step 1).
+   - Only **"Mergeable, but should ideally address nits"** and/or **"Good to merge"** → fix the nits too; a nit that is wrong or genuinely not worth fixing may instead be dismissed by replying to the review comment with your reasoning. Push nit-only fixes without starting another full round.
+
+3. **Flip to ready with the marker comment.** The review workflows skip the redundant `ready_for_review`-triggered round when the PR author has posted a marker naming the current head SHA **and** the PR's latest Codex review *posted before the marker* has a non-blocking verdict (reviewer evidence — a bare marker with no round behind it, or one whose last pre-marker Codex verdict is "Should address issues", skips nothing). Keep the prefix exact and use the full 40-char SHA of the head you are flipping:
+   - every verdict was "Good to merge" (head unchanged since the round):
+
+     `✅ Review round clean @ <head-sha>`
+
+   - nit-only round, nits fixed or dismissed afterwards (head may have moved past the reviewed SHA — say so):
+
+     `✅ Review round clean @ <head-sha> — nit-only verdicts at <round-sha>; nits addressed in <commit sha(s)> / dismissed in review replies`
+
+   ```bash
+   gh pr comment <PR_NUMBER> --body "✅ Review round clean @ $(git rev-parse HEAD)"
+   gh pr ready <PR_NUMBER>
+   ```
+
+   If any P0/P1 finding is unaddressed or the head moved for reasons other than nit fixes, do **not** post the marker or flip — run another round instead.
 
 ## EE Companion PR (when `*_ee.rs` files were modified)
 
diff --git a/.agents/skills/pr/review-round.sh b/.agents/skills/pr/review-round.sh
new file mode 100755
index 0000000000..a2dfa526a0
--- /dev/null
+++ b/.agents/skills/pr/review-round.sh
@@ -0,0 +1,129 @@
+#!/usr/bin/env bash
+# Trigger a CI review round on a PR and wait for it to finish.
+#
+# Usage: bash .agents/skills/pr/review-round.sh [PR_NUMBER]
+#   PR_NUMBER defaults to the current branch's PR.
+#
+# Comments `/review` on the PR (works on drafts), waits for the spawned
+# "PR Review Commands" workflow run(s) to complete, then prints one verdict
+# line per reviewer and saves each full review comment to a file. A round
+# takes 10-30 minutes: run this in the background and act on its output when
+# it exits, per the pr skill ("Review rounds").
+set -euo pipefail
+
+REPO=${REPO:-$(gh repo view --json nameWithOwner --jq .nameWithOwner)}
+PR=${1:-$(gh pr view --json number --jq .number)}
+
+# Timestamp of the trigger comment, straight from GitHub, so local clock skew
+# can't make the run/comment filters below miss part of the round.
+TRIGGER_TIME=$(gh api "repos/$REPO/issues/$PR/comments" -f body='/review' --jq .created_at)
+echo "Review round triggered on $REPO#$PR at $TRIGGER_TIME"
+
+# Retry wrapper for one-off gh/API hiccups: a 45-minute wait must not die on
+# a single transient failure.
+retry() {
+  local attempt
+  for attempt in 1 2 3; do
+    if "$@"; then return 0; fi
+    sleep 10
+  done
+  return 1
+}
+
+# The /review comment spawns one "PR Review Commands" run holding the
+# claude/codex/pi jobs. Runs aren't linked to a PR, so wait on every run of
+# that workflow created after the trigger: a concurrent round on another PR
+# can only delay the answer, never truncate it. Every issue comment on any PR
+# spawns a fast-completing parse run of the same workflow, so the round's own
+# run may briefly lag the listing while unrelated runs already show completed:
+# require the all-completed state to hold past a floor and across two
+# consecutive polls before trusting it.
+DEADLINE=$(( $(date +%s) + 45 * 60 ))
+NO_RUN_DEADLINE=$(( $(date +%s) + 5 * 60 ))
+MIN_WAIT_UNTIL=$(( $(date +%s) + 3 * 60 ))
+STABLE=0
+FAILURES=0
+while :; do
+  if RUNS=$(gh run list --repo "$REPO" --workflow=pr-review-commands.yml \
+      --created ">=$TRIGGER_TIME" --limit 100 --json status); then
+    FAILURES=0
+  else
+    FAILURES=$(( FAILURES + 1 ))
+    if [ "$FAILURES" -ge 5 ]; then
+      echo "ERROR: listing workflow runs failed $FAILURES times in a row; aborting the wait." >&2
+      exit 1
+    fi
+    echo "WARNING: listing workflow runs failed (attempt $FAILURES/5); retrying in 60s." >&2
+    sleep 60
+    continue
+  fi
+  TOTAL=$(jq length <<<"$RUNS")
+  PENDING=$(jq '[.[] | select(.status != "completed")] | length' <<<"$RUNS")
+  NOW=$(date +%s)
+  if [ "$TOTAL" -gt 0 ] && [ "$PENDING" -eq 0 ] && [ "$NOW" -gt "$MIN_WAIT_UNTIL" ]; then
+    STABLE=$(( STABLE + 1 ))
+    if [ "$STABLE" -ge 2 ]; then
+      break
+    fi
+  else
+    STABLE=0
+  fi
+  if [ "$TOTAL" -eq 0 ] && [ "$NOW" -gt "$NO_RUN_DEADLINE" ]; then
+    echo "ERROR: no 'PR Review Commands' run appeared within 5 minutes of the /review comment; check that the comment author has write access and the workflow is enabled." >&2
+    exit 1
+  fi
+  if [ "$NOW" -gt "$DEADLINE" ]; then
+    echo "WARNING: review round still pending after 45 minutes; reporting whatever has been posted so far." >&2
+    break
+  fi
+  sleep 60
+done
+
+OUT_DIR=$(mktemp -d -t review-round-XXXXXX)
+COMMENTS_RAW=$(retry gh api "repos/$REPO/issues/$PR/comments?per_page=100" --paginate)
+jq -s --arg t "$TRIGGER_TIME" '[.[][] | select(.created_at > $t)]' \
+  <<<"$COMMENTS_RAW" > "$OUT_DIR/comments.json"
+# cubic posts through the PR reviews API, not issue comments.
+REVIEWS_RAW=$(retry gh api "repos/$REPO/pulls/$PR/reviews?per_page=100" --paginate)
+jq -s --arg t "$TRIGGER_TIME" '[.[][] | select((.submitted_at // "") > $t)]' \
+  <<<"$REVIEWS_RAW" > "$OUT_DIR/pr-reviews.json"
+
+VERDICT_RE='(Good to merge|Mergeable, but should ideally address nits|Should address issues before merging)'
+
+body_by_header() {
+  jq -r --arg h "$1" '[.[] | select(.body // "" | contains($h))] | last | .body // empty' \
+    "$OUT_DIR/comments.json"
+}
+body_by_login() {
+  jq -r --arg l "$1" '[.[] | select(.user.login == $l)] | last | .body // empty' \
+    "$OUT_DIR/comments.json"
+}
+report() { # <reviewer-name> <comment-body>
+  local name=$1 body=$2 verdict
+  if [ -z "$body" ]; then
+    echo "$name: (no review posted this round)"
+    return
+  fi
+  printf '%s\n' "$body" > "$OUT_DIR/$name.md"
+  verdict=$(printf '%s\n' "$body" | grep -m1 -oE "${VERDICT_RE}.*" | sed 's/\*\*//g' || true)
+  echo "$name: ${verdict:-(review posted but no verdict line; read $OUT_DIR/$name.md)}"
+}
+
+echo
+echo "=== Review round verdicts for $REPO#$PR (posted after $TRIGGER_TIME) ==="
+CODEX_BODY=$(body_by_header '## Codex Review')
+report codex "$CODEX_BODY"
+report claude "$(body_by_login 'claude[bot]')"
+report pi "$(body_by_header '## Pi Review')"
+CUBIC_BODY=$(jq -r '[.[] | select(.user.login | test("^cubic(-dev-ai)?(\\[bot\\])?$"; "i"))] | last | .body // empty' \
+  "$OUT_DIR/pr-reviews.json")
+if [ -z "$CUBIC_BODY" ]; then
+  CUBIC_BODY=$(jq -r '[.[] | select(.user.login | test("^cubic(-dev-ai)?(\\[bot\\])?$"; "i"))] | last | .body // empty' \
+    "$OUT_DIR/comments.json")
+fi
+report cubic "$CUBIC_BODY"
+echo
+echo "Full round output: $OUT_DIR (comments.json, pr-reviews.json, one .md per reviewer)"
+if [ -z "$CODEX_BODY" ]; then
+  echo "WARNING: Codex verdict missing - the round is incomplete. Re-trigger with a '/codex' PR comment and wait again." >&2
+fi
diff --git a/.github/workflows/codex-pr-review.yml b/.github/workflows/codex-pr-review.yml
index 68bea1d715..26b2d9aae8 100644
--- a/.github/workflows/codex-pr-review.yml
+++ b/.github/workflows/codex-pr-review.yml
@@ -82,6 +82,7 @@ jobs:
           EVENT_BODY: ${{ github.event.pull_request.body }}
           EVENT_FORK: ${{ github.event.pull_request.head.repo.fork }}
           EVENT_AUTHOR: ${{ github.event.pull_request.user.login }}
+          EVENT_ACTION: ${{ github.event.action }}
         run: |
           if [ -n "$INPUT_PR_NUMBER" ]; then
             PR_JSON=$(gh pr view "$INPUT_PR_NUMBER" --repo "${{ github.repository }}" \
@@ -113,6 +114,38 @@ jobs:
             echo "skip=true" >> "$GITHUB_OUTPUT"
             exit 0
           fi
+          # An agent-driven PR flips to ready only after a clean /review round on
+          # a draft, marked by an author comment naming the head SHA (pr skill,
+          # "Review rounds"). Re-reviewing that same head on ready_for_review is
+          # redundant. The marker alone is author attestation, so also require
+          # reviewer evidence: a Codex review (posted by github-actions[bot], not
+          # forgeable by the author) that predates the marker and carries a
+          # non-blocking verdict. Comment-triggered and synchronize runs never
+          # skip. Keep the three copies of this check in sync (pr-ready-review /
+          # codex-pr-review / pi-pr-review); a shared local action would need the
+          # repo checked out before the check, which the fork paths here
+          # deliberately avoid.
+          if [ "$EVENT_ACTION" = "ready_for_review" ] && [ -z "$INPUT_PR_NUMBER" ]; then
+            # Fetch failures fail open (no skip): an API hiccup must run the
+            # review, never skip it or fail the job.
+            COMMENTS=$(gh api "repos/${{ github.repository }}/issues/$PR_NUMBER/comments?per_page=100" --paginate | jq -s '[.[][]]') || COMMENTS='[]'
+            MARKER_TIME=$(jq -r --arg author "$PR_AUTHOR" --arg marker "✅ Review round clean @ $HEAD_SHA" \
+              '[.[] | select(.user.login == $author) | select(.body | contains($marker)) | .created_at] | min // empty' <<<"$COMMENTS")
+            CODEX_VERDICT=''
+            if [ -n "$MARKER_TIME" ]; then
+              # Only Codex evidence that predates the marker counts: the ready-
+              # triggered Codex run itself posts after the flip and must not
+              # vouch for a sibling reviewer's skip.
+              CODEX_VERDICT=$(jq -r --arg mt "$MARKER_TIME" \
+                '[.[] | select(.user.login == "github-actions[bot]") | select(.body | contains("## Codex Review")) | select(.created_at < $mt)] | last | .body // ""' <<<"$COMMENTS" \
+                | grep -m1 -oE '(Good to merge|Mergeable, but should ideally address nits|Should address issues before merging)' || true)
+            fi
+            if [ -n "$MARKER_TIME" ] && [ -n "$CODEX_VERDICT" ] && [ "$CODEX_VERDICT" != "Should address issues before merging" ]; then
+              echo "Clean review round marker found for $HEAD_SHA with pre-marker non-blocking Codex verdict; skipping redundant review."
+              echo "skip=true" >> "$GITHUB_OUTPUT"
+              exit 0
+            fi
+          fi
           # PR title/body are attacker-controlled free text. Use an unguessable
           # per-run delimiter so a fork can't embed a fixed heredoc terminator to
           # inject extra outputs — e.g. is_fork=false (last-write-wins), which
diff --git a/.github/workflows/pi-pr-review.yml b/.github/workflows/pi-pr-review.yml
index 03c9599480..2f143663c8 100644
--- a/.github/workflows/pi-pr-review.yml
+++ b/.github/workflows/pi-pr-review.yml
@@ -75,6 +75,7 @@ jobs:
           EVENT_BODY: ${{ github.event.pull_request.body }}
           EVENT_FORK: ${{ github.event.pull_request.head.repo.fork }}
           EVENT_AUTHOR: ${{ github.event.pull_request.user.login }}
+          EVENT_ACTION: ${{ github.event.action }}
         run: |
           if [ -n "$INPUT_PR_NUMBER" ]; then
             PR_JSON=$(gh pr view "$INPUT_PR_NUMBER" --repo "${{ github.repository }}" \
@@ -106,6 +107,38 @@ jobs:
             echo "skip=true" >> "$GITHUB_OUTPUT"
             exit 0
           fi
+          # An agent-driven PR flips to ready only after a clean /review round on
+          # a draft, marked by an author comment naming the head SHA (pr skill,
+          # "Review rounds"). Re-reviewing that same head on ready_for_review is
+          # redundant. The marker alone is author attestation, so also require
+          # reviewer evidence: a Codex review (posted by github-actions[bot], not
+          # forgeable by the author) that predates the marker and carries a
+          # non-blocking verdict. Comment-triggered and synchronize runs never
+          # skip. Keep the three copies of this check in sync (pr-ready-review /
+          # codex-pr-review / pi-pr-review); a shared local action would need the
+          # repo checked out before the check, which the fork paths here
+          # deliberately avoid.
+          if [ "$EVENT_ACTION" = "ready_for_review" ] && [ -z "$INPUT_PR_NUMBER" ]; then
+            # Fetch failures fail open (no skip): an API hiccup must run the
+            # review, never skip it or fail the job.
+            COMMENTS=$(gh api "repos/${{ github.repository }}/issues/$PR_NUMBER/comments?per_page=100" --paginate | jq -s '[.[][]]') || COMMENTS='[]'
+            MARKER_TIME=$(jq -r --arg author "$PR_AUTHOR" --arg marker "✅ Review round clean @ $HEAD_SHA" \
+              '[.[] | select(.user.login == $author) | select(.body | contains($marker)) | .created_at] | min // empty' <<<"$COMMENTS")
+            CODEX_VERDICT=''
+            if [ -n "$MARKER_TIME" ]; then
+              # Only Codex evidence that predates the marker counts: the ready-
+              # triggered Codex run itself posts after the flip and must not
+              # vouch for a sibling reviewer's skip.
+              CODEX_VERDICT=$(jq -r --arg mt "$MARKER_TIME" \
+                '[.[] | select(.user.login == "github-actions[bot]") | select(.body | contains("## Codex Review")) | select(.created_at < $mt)] | last | .body // ""' <<<"$COMMENTS" \
+                | grep -m1 -oE '(Good to merge|Mergeable, but should ideally address nits|Should address issues before merging)' || true)
+            fi
+            if [ -n "$MARKER_TIME" ] && [ -n "$CODEX_VERDICT" ] && [ "$CODEX_VERDICT" != "Should address issues before merging" ]; then
+              echo "Clean review round marker found for $HEAD_SHA with pre-marker non-blocking Codex verdict; skipping redundant review."
+              echo "skip=true" >> "$GITHUB_OUTPUT"
+              exit 0
+            fi
+          fi
           # PR title/body are attacker-controlled free text. Use an unguessable
           # per-run delimiter so a fork can't embed a fixed heredoc terminator to
           # inject extra outputs — e.g. is_fork=false (last-write-wins), which
diff --git a/.github/workflows/pr-ready-review.yml b/.github/workflows/pr-ready-review.yml
index eb634977d1..c41ccafa9a 100644
--- a/.github/workflows/pr-ready-review.yml
+++ b/.github/workflows/pr-ready-review.yml
@@ -48,12 +48,55 @@ jobs:
       pull-requests: read
       id-token: write
     steps:
+      # An agent-driven PR flips to ready only after a clean /review round on a
+      # draft, marked by an author comment naming the head SHA (pr skill, "Review
+      # rounds"). Re-reviewing that same head on ready_for_review is redundant.
+      # The marker alone is author attestation, so also require reviewer evidence:
+      # a Codex review (posted by github-actions[bot], not forgeable by the author)
+      # that predates the marker and carries a non-blocking verdict. Comment-
+      # triggered (workflow_call) and opened runs never skip. Keep the three
+      # copies of this check in sync (pr-ready-review / codex-pr-review /
+      # pi-pr-review); a shared local action would need the repo checked out
+      # before the check, which the codex/pi fork paths deliberately avoid.
+      - name: Check clean-round marker
+        id: marker
+        if: github.event_name == 'pull_request' && github.event.action == 'ready_for_review'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          PR_AUTHOR: ${{ github.event.pull_request.user.login }}
+        run: |
+          # Fetch failures fail open (skip=false): an API hiccup must run the
+          # review, never skip it or fail the job.
+          COMMENTS=$(gh api "repos/$REPO/issues/$PR_NUMBER/comments?per_page=100" --paginate | jq -s '[.[][]]') || COMMENTS='[]'
+          MARKER_TIME=$(jq -r --arg author "$PR_AUTHOR" --arg marker "✅ Review round clean @ $HEAD_SHA" \
+            '[.[] | select(.user.login == $author) | select(.body | contains($marker)) | .created_at] | min // empty' <<<"$COMMENTS")
+          CODEX_VERDICT=''
+          if [ -n "$MARKER_TIME" ]; then
+            # Only Codex evidence that predates the marker counts: the ready-
+            # triggered Codex run itself posts after the flip and must not vouch
+            # for a sibling reviewer's skip.
+            CODEX_VERDICT=$(jq -r --arg mt "$MARKER_TIME" \
+              '[.[] | select(.user.login == "github-actions[bot]") | select(.body | contains("## Codex Review")) | select(.created_at < $mt)] | last | .body // ""' <<<"$COMMENTS" \
+              | grep -m1 -oE '(Good to merge|Mergeable, but should ideally address nits|Should address issues before merging)' || true)
+          fi
+          if [ -n "$MARKER_TIME" ] && [ -n "$CODEX_VERDICT" ] && [ "$CODEX_VERDICT" != "Should address issues before merging" ]; then
+            echo "Clean review round marker found for $HEAD_SHA with pre-marker non-blocking Codex verdict; skipping redundant review."
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "skip=false" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Checkout repository
+        if: steps.marker.outputs.skip != 'true'
         uses: actions/checkout@v5
         with:
           fetch-depth: 1
 
       - name: Check EE access
+        if: steps.marker.outputs.skip != 'true'
         id: ee
         env:
           EE_TOKEN: ${{ secrets.WINDMILL_EE_PRIVATE_ACCESS }}
@@ -80,6 +123,7 @@ jobs:
         run: ./backend/substitute_ee_code.sh --copy --dir ./windmill-ee-private
 
       - name: Resolve PR number
+        if: steps.marker.outputs.skip != 'true'
         id: resolve
         env:
           GH_TOKEN: ${{ github.token }}
@@ -99,6 +143,7 @@ jobs:
           echo "pr_author=$PR_AUTHOR" >> "$GITHUB_OUTPUT"
 
       - name: Fetch prior PR discussion
+        if: steps.marker.outputs.skip != 'true'
         id: prior
         env:
           GH_TOKEN: ${{ github.token }}
@@ -117,6 +162,7 @@ jobs:
           ' prior-comments.json > prior-comments.md
 
       - name: Read review prompt
+        if: steps.marker.outputs.skip != 'true'
         id: review-prompt
         env:
           EXTRA_PROMPT: ${{ inputs.extra_prompt }}
@@ -140,6 +186,7 @@ jobs:
           } >> "$GITHUB_ENV"
 
       - name: Automatic PR Review
+        if: steps.marker.outputs.skip != 'true'
         uses: anthropics/claude-code-action@v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
diff --git a/docs/autonomous-mode.md b/docs/autonomous-mode.md
index dea2aa24ee..95d68136a6 100644
--- a/docs/autonomous-mode.md
+++ b/docs/autonomous-mode.md
@@ -65,6 +65,8 @@ After code changes compile and type-check, verify the feature works:
 
 When done, directly open or update a **draft PR** against `main` once the work and validation are complete. Do not stop at a local summary or ask a human to create the PR manually.
 
+Then drive the PR through CI review rounds to ready, per the `pr` skill ("Review rounds"): run `.agents/skills/pr/review-round.sh` as a background task, let its completion wake you, address the findings, and repeat until every reviewer verdict is a go — then post the clean-round marker comment and `gh pr ready`. Do not end the session at an unreviewed draft or while a round is pending; waiting on the background waiter costs nothing.
+
 In your final summary, provide:
 - What was changed and why (files modified, approach taken)
 - What checks passed (cargo check, npm run check, etc.)

From 4fc3f304c632eda15876c28cb6f473a799a41f48 Mon Sep 17 00:00:00 2001
From: Diego Imbert <70353967+diegoimbert@users.noreply.github.com>
Date: Thu, 16 Jul 2026 17:47:12 +0200
Subject: [PATCH 025/171] feat(forks): add "Hide unchanged drafts" toggle to
 fork deploy-draft tab (#10022)

A fork clones the parent workspace's drafts on creation, so the fork's
Deploy-draft tab listed all of them as deployable even though the fork
never touched them. Add a "Hide unchanged drafts" toggle (fork-only, on
by default) that hides drafts identical to the parent's.

Backend: the drafts-list endpoint accepts an optional `compare_to_workspace`
(honored only when it is the workspace's actual parent) and flags each row
with `unchanged_from_parent` via a jsonb-equality subquery against the
parent's draft at the same (path, kind, owner).

Frontend: the fork compare page passes its parent as the compare workspace;
CompareDrafts renders the toggle and filters out unchanged rows, which also
drops them from the selection/deploy count.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 backend/windmill-api/openapi.yaml             |  8 +++
 backend/windmill-api/src/drafts.rs            | 50 +++++++++++++++-
 .../src/lib/components/CompareDrafts.svelte   | 58 +++++++++++++------
 frontend/src/lib/workspaceDrafts.svelte.ts    | 23 ++++++--
 .../(logged)/forks/compare/+page.svelte       | 13 ++++-
 5 files changed, 124 insertions(+), 28 deletions(-)

diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 83051377e3..a923956f4c 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -8572,6 +8572,11 @@ paths:
           description: List every draft in the workspace (all users), not just the current user's own + legacy rows. Other users' rows come back with `mine=false` (view-only).
           schema:
             type: boolean
+        - name: compare_to_workspace
+          in: query
+          description: A fork passes its parent workspace id here to have each row flagged with `unchanged_from_parent`. Ignored unless it is exactly this workspace's parent.
+          schema:
+            type: string
       responses:
         "200":
           description: the user's drafts
@@ -8607,6 +8612,9 @@ paths:
                     mine:
                       type: boolean
                       description: The row belongs to the current user (own draft or the legacy no-owner row) and is therefore actionable. Always true in the default listing; with `all_users=true`, other users' rows are false (view-only).
+                    unchanged_from_parent:
+                      type: boolean
+                      description: Only present when `compare_to_workspace` was passed. True when this draft is identical to the parent's draft at the same path/kind/owner (cloned in on fork and never edited here).
                     draft_users:
                       description: |
                         Draft authors at this (path, kind) — the legacy NULL-email row surfaced as a null username.
diff --git a/backend/windmill-api/src/drafts.rs b/backend/windmill-api/src/drafts.rs
index ffc94d5b46..a4ebf74ec0 100644
--- a/backend/windmill-api/src/drafts.rs
+++ b/backend/windmill-api/src/drafts.rs
@@ -64,6 +64,11 @@ pub struct DraftListItem {
     /// so it defaults to `false` when read from the row.
     #[sqlx(default)]
     pub can_write: bool,
+    /// `true` when this draft is identical (jsonb-equal) to the parent's draft at
+    /// the same (path, kind, owner). `None` unless the request passed a valid
+    /// `compare_to_workspace`.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub unchanged_from_parent: Option<bool>,
     /// The listed row belongs to the authed user (own draft or the legacy
     /// no-owner row) and is therefore actionable by them. Always `true` in the
     /// default (own-drafts) listing; only meaningful with `all_users=true`,
@@ -77,6 +82,10 @@ pub struct ListDraftsQuery {
     /// List every draft in the workspace (all users), not just the authed
     /// user's own + legacy rows. Other users' rows come back with `mine=false`.
     pub all_users: Option<bool>,
+    /// A fork passes its parent workspace id here to have each row flagged with
+    /// `unchanged_from_parent`. Honored only when it is this workspace's actual
+    /// `parent_workspace_id` (enforced in `list_drafts`).
+    pub compare_to_workspace: Option<String>,
 }
 
 /// Every draft the authed user has in this workspace, across all kinds — the
@@ -97,9 +106,31 @@ async fn list_drafts(
         return Ok(Json(vec![]));
     }
     let all_users = query.all_users.unwrap_or(false);
+    // Only honor `compare_to_workspace` when it is genuinely this workspace's
+    // parent (a fork comparing against its source). Any other value is dropped
+    // so the value-equality subquery can't be used to probe an unrelated
+    // workspace's draft contents.
+    let compare_to_workspace = match &query.compare_to_workspace {
+        Some(candidate) => {
+            let parent: Option<String> = sqlx::query_scalar::<_, Option<String>>(
+                "SELECT parent_workspace_id FROM workspace WHERE id = $1",
+            )
+            .bind(&w_id)
+            .fetch_optional(&db)
+            .await?
+            .flatten();
+            if parent.as_deref() == Some(candidate.as_str()) {
+                Some(candidate.clone())
+            } else {
+                None
+            }
+        }
+        None => None,
+    };
     let rows = sqlx::query_as::<_, DraftListItem>(&list_drafts_query(all_users))
         .bind(&w_id)
         .bind(&authed.email)
+        .bind(&compare_to_workspace)
         .fetch_all(&db)
         .await?;
     // Per-row permission gating:
@@ -149,8 +180,10 @@ async fn list_drafts(
 /// `deployed_table()` (shared single source — can't drift from the access
 /// check). Table names come from the closed enum, never user input. Kinds
 /// with no path-keyed table get no arm and fall to `ELSE true`.
-/// `$1` = workspace_id, `$2` = email. With `all_users` the owner filter is
-/// dropped so every workspace draft is listed (others' rows get `mine=false`).
+/// `$1` = workspace_id, `$2` = email, `$3` = the parent workspace to compare
+/// against (nullable; drives `unchanged_from_parent`). With `all_users` the
+/// owner filter is dropped so every workspace draft is listed (others' rows get
+/// `mine=false`).
 fn list_drafts_query(all_users: bool) -> String {
     let mut case = String::from("CASE d.typ::text\n");
     for kind in UserDraftItemKind::ALL {
@@ -221,7 +254,18 @@ fn list_drafts_query(all_users: bool) -> String {
                   ) AS draft_path,
                   (d.email IS NULL) AS legacy_draft,
                   (d.email = $2 OR d.email IS NULL) AS mine,
-                  {case} AS draft_only
+                  {case} AS draft_only,
+                  -- value is a `json` column (no `=` operator), so compare as jsonb.
+                  CASE WHEN $3::text IS NULL THEN NULL::bool
+                       ELSE EXISTS(
+                         SELECT 1 FROM draft pd
+                         WHERE pd.workspace_id = $3
+                           AND pd.path = d.path
+                           AND pd.typ = d.typ
+                           AND pd.email IS NOT DISTINCT FROM d.email
+                           AND pd.value::jsonb = d.value::jsonb
+                       )
+                  END AS unchanged_from_parent
            FROM draft d
            WHERE d.workspace_id = $1{owner_filter}
            ORDER BY d.path, d.typ,
diff --git a/frontend/src/lib/components/CompareDrafts.svelte b/frontend/src/lib/components/CompareDrafts.svelte
index 2614adf445..b37ba4fcac 100644
--- a/frontend/src/lib/components/CompareDrafts.svelte
+++ b/frontend/src/lib/components/CompareDrafts.svelte
@@ -94,6 +94,9 @@
 		 * actionable. Other users' rows (shown when "Show all drafts" is on) are
 		 * view-only: you can't deploy/discard someone else's draft. */
 		mine: boolean
+		/** Fork only: true when this draft is identical to the parent's (inherited
+		 * on fork, never edited here). Drives "Hide unchanged drafts". */
+		unchanged_from_parent?: boolean
 	}
 	function getItemKey(kind: string, path: string): string {
 		return `${kind}:${path}`
@@ -133,11 +136,16 @@
 	let showAll = $state(false)
 	const allDrafts = useWorkspaceDrafts(
 		() => (showAll ? currentWorkspaceId : undefined),
-		() => true
+		() => true,
+		() => (isFork ? parentWorkspaceId : undefined)
 	)
 	const sourceItems = $derived(showAll ? allDrafts.items : draftItems)
 	const loading = $derived(showAll ? allDrafts.loading : draftsLoading)
 
+	// On by default: a fork inherits the parent's drafts on creation, and those
+	// (unrelated to the fork's own work) are the common case worth hiding.
+	let hideUnchanged = $state(true)
+
 	// The list (and, in the default view, the Draft Count) come from the Workspace
 	// Drafts module; deploy/discard invalidate the resource, so the list refetches
 	// and deployed items drop off without a manual reload here.
@@ -164,10 +172,11 @@
 			.filter((u): u is string => !!u && u !== currentUsername)
 	}
 
-	// The backend already returns exactly the rows for the current view (own +
-	// legacy, or every user's with "Show all drafts"), so there's no client-side
-	// filtering — `visibleItems` is just the mapped list.
-	const visibleItems = $derived(items)
+	// The backend returns exactly the rows for the current view; the only
+	// client-side filter is "Hide unchanged drafts".
+	const visibleItems = $derived(
+		isFork && hideUnchanged ? items.filter((i) => i.unchanged_from_parent !== true) : items
+	)
 
 	// A row is actionable when it isn't already deployed this session, the user has
 	// write permission, AND it's their own draft (you can't deploy someone else's
@@ -546,20 +555,35 @@
 			onDeselectAll={deselectAll}
 			emptyMessage={loading
 				? 'Loading drafts…'
-				: showAll
-					? 'No drafts in this workspace'
-					: 'No drafts you authored in this workspace'}
+				: isFork && hideUnchanged && items.length > 0
+					? 'All drafts are unchanged from the parent workspace. Turn off "Hide unchanged drafts" to show them.'
+					: showAll
+						? 'No drafts in this workspace'
+						: 'No drafts you authored in this workspace'}
 		>
 			{#snippet selectAllActions()}
-				<Toggle
-					bind:checked={showAll}
-					size="xs"
-					options={{
-						right: 'Show all drafts',
-						rightTooltip:
-							"Show every user's drafts in this workspace, not just yours. Others' drafts are view-only — you can only deploy or discard your own."
-					}}
-				/>
+				<div class="flex items-center gap-4">
+					{#if isFork}
+						<Toggle
+							bind:checked={hideUnchanged}
+							size="xs"
+							options={{
+								right: 'Hide unchanged drafts',
+								rightTooltip:
+									"Hide drafts identical to the parent workspace. A fork inherits the parent's drafts when it's created; those are unrelated to the changes made in this fork."
+							}}
+						/>
+					{/if}
+					<Toggle
+						bind:checked={showAll}
+						size="xs"
+						options={{
+							right: 'Show all drafts',
+							rightTooltip:
+								"Show every user's drafts in this workspace, not just yours. Others' drafts are view-only — you can only deploy or discard your own."
+						}}
+					/>
+				</div>
 			{/snippet}
 
 			{#snippet header()}
diff --git a/frontend/src/lib/workspaceDrafts.svelte.ts b/frontend/src/lib/workspaceDrafts.svelte.ts
index 90a7cf9542..32345bd103 100644
--- a/frontend/src/lib/workspaceDrafts.svelte.ts
+++ b/frontend/src/lib/workspaceDrafts.svelte.ts
@@ -47,13 +47,22 @@ export interface DraftItem {
 	 * `allUsers` listing surfaces other users' rows as `false` (view-only).
 	 * Defaults to true when the field is absent (older backend). */
 	mine: boolean
+	/** Only set when listed with a `compareToWorkspace` (a fork comparing against
+	 * its parent): true when this draft is identical to the parent's — cloned in
+	 * on fork and never edited here. Undefined when no comparison was requested. */
+	unchanged_from_parent?: boolean
 }
 
 export async function getDraftItems(
 	workspace: string,
-	allUsers: boolean = false
+	allUsers: boolean = false,
+	compareToWorkspace?: string
 ): Promise<DraftItem[]> {
-	const rows = await DraftService.listDrafts({ workspace, allUsers: allUsers || undefined })
+	const rows = await DraftService.listDrafts({
+		workspace,
+		allUsers: allUsers || undefined,
+		compareToWorkspace
+	})
 	return rows.map((r) => ({
 		kind: r.kind,
 		path: r.path,
@@ -64,7 +73,8 @@ export async function getDraftItems(
 		raw_app: r.kind === 'raw_app',
 		can_write: r.can_write ?? true,
 		draft_users: r.draft_users,
-		mine: r.mine ?? true
+		mine: r.mine ?? true,
+		unchanged_from_parent: r.unchanged_from_parent
 	}))
 }
 
@@ -92,14 +102,15 @@ export interface WorkspaceDraftsHandle {
  */
 export function useWorkspaceDrafts(
 	workspace: () => string | undefined,
-	allUsers: () => boolean = () => false
+	allUsers: () => boolean = () => false,
+	compareToWorkspace: () => string | undefined = () => undefined
 ): WorkspaceDraftsHandle {
 	const res = resource(
 		() => {
 			const ws = workspace()
-			return { ws, all: allUsers(), v: ws ? (versions[ws] ?? 0) : 0 }
+			return { ws, all: allUsers(), compare: compareToWorkspace(), v: ws ? (versions[ws] ?? 0) : 0 }
 		},
-		async ({ ws, all }) => (ws ? getDraftItems(ws, all) : [])
+		async ({ ws, all, compare }) => (ws ? getDraftItems(ws, all, compare) : [])
 	)
 	return {
 		get items() {
diff --git a/frontend/src/routes/(root)/(logged)/forks/compare/+page.svelte b/frontend/src/routes/(root)/(logged)/forks/compare/+page.svelte
index 6670be1225..da67c50fad 100644
--- a/frontend/src/routes/(root)/(logged)/forks/compare/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/forks/compare/+page.svelte
@@ -92,8 +92,17 @@
 	// Draft count drives the "Deployed ↔ draft" toggle badge. Reads the shared
 	// Workspace Drafts resource — count ≡ the draft list, and it refreshes itself
 	// when a deploy/discard invalidates the workspace.
-	const drafts = useWorkspaceDrafts(() => currentWorkspaceId)
-	const draftCount = $derived(drafts.count)
+	const drafts = useWorkspaceDrafts(
+		() => currentWorkspaceId,
+		() => false,
+		() => (isFork ? (parentWorkspaceId ?? undefined) : undefined)
+	)
+	// On a fork, match the badge to the default deploy-draft view, which hides
+	// drafts unchanged from the parent (else a fresh fork shows a count over an
+	// empty list).
+	const draftCount = $derived(
+		isFork ? drafts.items.filter((d) => d.unchanged_from_parent !== true).length : drafts.count
+	)
 
 	// Keys (`kind:path`) of fork items that are deployed *and* carry a pending
 	// draft (has_draft, i.e. not draft_only). CompareWorkspaces uses this to flag

From c55ac5326fbb4532f22b7250a58b69396a4c868a Mon Sep 17 00:00:00 2001
From: hugocasa <hugo@casademont.ch>
Date: Fri, 17 Jul 2026 00:14:37 +0200
Subject: [PATCH 026/171] fix(raw-apps): full code ui builder improvements

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
---
 frontend/scripts/ui_builder_artifact.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/frontend/scripts/ui_builder_artifact.json b/frontend/scripts/ui_builder_artifact.json
index 81a4a11a3f..e8cc43672c 100644
--- a/frontend/scripts/ui_builder_artifact.json
+++ b/frontend/scripts/ui_builder_artifact.json
@@ -1,5 +1,5 @@
 {
 	"baseUrl": "https://pub-06154ed168a24e73a86ab84db6bf15d8.r2.dev",
-	"version": "17406f1",
-	"sha256": "405143b5b7c9f9e789f7f25dd2a435ecf7f5344b01e517e14e505f6817281c95"
+	"version": "3246b18",
+	"sha256": "4b0be80f586bc57f91965a15bceba0a37a2ae8b727a70d8ab30d9c5e0b75f115"
 }

From 91d6606868d0e9c5f78ab48a592ef95ffaeeca61 Mon Sep 17 00:00:00 2001
From: Alexander Petric <alpetric@users.noreply.github.com>
Date: Fri, 17 Jul 2026 00:15:34 +0200
Subject: [PATCH 027/171] fix(mcp): push granular scope patterns into SQL so
 scoped scripts/flows aren't truncated (#10140)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix(mcp): push granular scope patterns into SQL so scoped scripts/flows aren't truncated

MCP `list_tools` fetched scripts/flows capped at the 100 newest by
`created_at` and only *then* filtered by the token's granular
folder/custom scope in Rust. In a workspace with more than 100
scripts/flows, in-scope items outside that newest-100 window were
truncated before the scope filter ran, so a folder- or custom-scoped
token could see zero tools even though matching items existed.

Push the scope patterns into the query via a new `PathFilter::Patterns`
(mirroring `is_resource_allowed`: `*` disables filtering, exact paths
match by equality, `x/*` matches the folder or its subtree, empty grants
nothing) so the filter applies before the `ITEMS_FETCH_MAX_LIMIT` cap.
The existing hashed-name resolution path keeps its prefix behavior via
`PathFilter::Prefix`, and the Rust post-filter stays as defense in depth.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(mcp): warn in scope selector when a scope exceeds the MCP tool cap

The server exposes at most ITEMS_FETCH_MAX_LIMIT (100) scripts and 100
flows per token; a scope matching more silently drops the overflow, which
bloats the assistant's context with a partial, arbitrary tool set.

McpScopeSelector now computes how many scripts/flows the current scope
would expose (per type, mirroring the backend's is_resource_allowed) and
shows a warning Alert when either exceeds the cap, so the user can narrow
the scope before generating the URL/token. An async sequence guard keeps
rapid scope changes from applying stale counts.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(mcp): address review — dedup count fetches, boundary-aware folder counting, fix copy

Follow-up to the MCP scope-selector truncation warning:

- Reuse a single per-type (scripts/flows) cache for both the preview list and
  the exposed count, instead of a second concurrent fetch of the same rows.
- Count a folder scope against the `f/{folder}/*` subtree (via the same
  boundary-aware matcher), so a folder like `team` no longer over-counts a
  sibling like `team2` and falsely warns.
- Custom-mode counts are derived synchronously from the already-loaded
  scripts/flows — no fetch.
- Reword the warning to "most recent" (flows are ordered by edited_at, not
  created_at).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(mcp): anchor folder count fetch at the folder boundary

Follow-up to review: the folder count fetched the unbounded prefix
`f/{folder}` (backend `path LIKE 'f/{folder}%'`), so a prefix-sharing
sibling like `f/team2` shared the page. With a page limit, enough newer
sibling rows could fill the first page ahead of the target folder's older
rows; the client-side boundary filter then dropped them all, wrongly
suppressing the warning and emptying the preview.

Fetch `f/{folder}/` instead so the backend prefix (`LIKE 'f/{folder}/%'`)
is anchored at the folder boundary and never returns siblings. The
client-side matcher stays as a backstop for folder names whose LIKE
wildcards (`_`, `%`) can still let the backend prefix over-match.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
---
 backend/windmill-api/src/mcp/core.rs          |  10 +-
 backend/windmill-api/src/mcp/utils.rs         | 114 ++++++++++-
 backend/windmill-mcp/src/server/backend.rs    |  26 ++-
 backend/windmill-mcp/src/server/mod.rs        |   2 +-
 backend/windmill-mcp/src/server/runner.rs     |  23 ++-
 .../components/mcp/McpScopeSelector.svelte    | 186 ++++++++++++------
 6 files changed, 283 insertions(+), 78 deletions(-)

diff --git a/backend/windmill-api/src/mcp/core.rs b/backend/windmill-api/src/mcp/core.rs
index db1644379d..cdf1f0b3a3 100644
--- a/backend/windmill-api/src/mcp/core.rs
+++ b/backend/windmill-api/src/mcp/core.rs
@@ -12,7 +12,7 @@ use windmill_mcp::common::transform::apply_key_transformation;
 use windmill_mcp::common::types::{
     FlowInfo, HubScriptInfo, ResourceInfo, ResourceType, SchemaType, ScriptInfo, WorkspaceInfo,
 };
-use windmill_mcp::server::{BackendResult, EndpointTool, ErrorData, McpBackend};
+use windmill_mcp::server::{BackendResult, EndpointTool, ErrorData, McpBackend, PathFilter};
 
 use crate::auth::AuthCache;
 use crate::db::ApiAuthed;
@@ -78,7 +78,7 @@ impl McpBackend for WindmillBackend {
         auth: &ApiAuthed,
         workspace_id: &str,
         favorites_only: bool,
-        path_prefix: Option<&str>,
+        path_filter: Option<PathFilter<'_>>,
     ) -> BackendResult<Vec<ScriptInfo>> {
         let scope_type = if favorites_only { "favorites" } else { "all" };
         get_items::<ScriptInfo>(
@@ -87,7 +87,7 @@ impl McpBackend for WindmillBackend {
             workspace_id,
             scope_type,
             "script",
-            path_prefix,
+            path_filter,
         )
         .await
         .map_err(|e| ErrorData::internal_error(e.message, None))
@@ -98,7 +98,7 @@ impl McpBackend for WindmillBackend {
         auth: &ApiAuthed,
         workspace_id: &str,
         favorites_only: bool,
-        path_prefix: Option<&str>,
+        path_filter: Option<PathFilter<'_>>,
     ) -> BackendResult<Vec<FlowInfo>> {
         let scope_type = if favorites_only { "favorites" } else { "all" };
         get_items::<FlowInfo>(
@@ -107,7 +107,7 @@ impl McpBackend for WindmillBackend {
             workspace_id,
             scope_type,
             "flow",
-            path_prefix,
+            path_filter,
         )
         .await
         .map_err(|e| ErrorData::internal_error(e.message, None))
diff --git a/backend/windmill-api/src/mcp/utils.rs b/backend/windmill-api/src/mcp/utils.rs
index de0ad9d4da..70a4c6c1f4 100644
--- a/backend/windmill-api/src/mcp/utils.rs
+++ b/backend/windmill-api/src/mcp/utils.rs
@@ -15,7 +15,7 @@ use windmill_common::scripts::{get_full_hub_script_by_path, Schema};
 use windmill_common::utils::{query_elems_from_hub, StripPath};
 use windmill_common::worker::to_raw_value;
 use windmill_common::{DB, HUB_BASE_URL};
-use windmill_mcp::server::{BackendResult, ErrorData};
+use windmill_mcp::server::{BackendResult, ErrorData, PathFilter};
 use windmill_mcp::{HubResponse, HubScriptInfo, ItemSchema, ResourceInfo, ResourceType};
 
 use crate::db::ApiAuthed;
@@ -24,6 +24,43 @@ use crate::HTTP_CLIENT;
 // items max limit
 const ITEMS_FETCH_MAX_LIMIT: usize = 100;
 
+/// Escape LIKE wildcards so a literal path is matched as a prefix, not a pattern.
+fn escape_like(s: &str) -> String {
+    s.replace('\\', "\\\\")
+        .replace('%', "\\%")
+        .replace('_', "\\_")
+}
+
+/// Build the SQL condition matching any MCP scope pattern, mirroring
+/// `is_resource_allowed`. Returns `None` when no filter should be applied (a `*`
+/// pattern grants everything); `Some("false")` when the list is empty (grants
+/// nothing); otherwise an OR of per-pattern `o.path` conditions.
+fn scope_patterns_condition(patterns: &[String]) -> Option<String> {
+    if patterns.iter().any(|p| p == "*") {
+        return None;
+    }
+    if patterns.is_empty() {
+        return Some("false".to_string());
+    }
+    let conds: Vec<String> = patterns
+        .iter()
+        .map(|p| {
+            if let Some(prefix) = p.strip_suffix("/*") {
+                // A subtree pattern matches the folder itself or anything under it.
+                let subtree = format!("{}/%", escape_like(prefix));
+                format!(
+                    "({} OR {})",
+                    "o.path = ?".bind(&prefix),
+                    "o.path LIKE ? ESCAPE '\\'".bind(&subtree),
+                )
+            } else {
+                "o.path = ?".bind(p)
+            }
+        })
+        .collect();
+    Some(format!("({})", conds.join(" OR ")))
+}
+
 // ============================================================================
 // Database utilities
 // ============================================================================
@@ -135,7 +172,7 @@ pub async fn get_items<T: for<'a> sqlx::FromRow<'a, sqlx::postgres::PgRow> + Sen
     workspace_id: &str,
     scope_type: &str,
     item_type: &str,
-    path_prefix: Option<&str>,
+    path_filter: Option<PathFilter<'_>>,
 ) -> Result<Vec<T>, ErrorData> {
     let mut sqlb = SqlBuilder::select_from(&format!("{} as o", item_type));
     let fields = vec!["o.path", "o.summary", "o.description", "o.schema"];
@@ -155,12 +192,17 @@ pub async fn get_items<T: for<'a> sqlx::FromRow<'a, sqlx::postgres::PgRow> + Sen
         sqlb.and_where("(o.auto_kind IS NULL OR o.auto_kind <> 'lib')");
     }
 
-    if let Some(prefix) = path_prefix {
-        let escaped = prefix
-            .replace('\\', "\\\\")
-            .replace('%', "\\%")
-            .replace('_', "\\_");
-        sqlb.and_where("o.path LIKE ? ESCAPE '\\'".bind(&format!("{}%", escaped)));
+    match path_filter {
+        None => {}
+        Some(PathFilter::Prefix(prefix)) => {
+            let escaped = format!("{}%", escape_like(prefix));
+            sqlb.and_where("o.path LIKE ? ESCAPE '\\'".bind(&escaped));
+        }
+        Some(PathFilter::Patterns(patterns)) => {
+            if let Some(cond) = scope_patterns_condition(patterns) {
+                sqlb.and_where(cond);
+            }
+        }
     }
 
     sqlb.order_by(
@@ -781,4 +823,60 @@ mod tests {
             "?path=u%2Falice%2Fmy%20script"
         );
     }
+
+    fn strings(v: &[&str]) -> Vec<String> {
+        v.iter().map(|s| s.to_string()).collect()
+    }
+
+    #[test]
+    fn scope_patterns_condition_wildcard_disables_filter() {
+        // A `*` pattern grants everything, so no SQL condition should be added.
+        assert_eq!(scope_patterns_condition(&strings(&["*"])), None);
+        assert_eq!(scope_patterns_condition(&strings(&["f/team/*", "*"])), None);
+    }
+
+    #[test]
+    fn scope_patterns_condition_empty_matches_nothing() {
+        // An empty pattern list grants no items of this type.
+        assert_eq!(scope_patterns_condition(&[]), Some("false".to_string()));
+    }
+
+    #[test]
+    fn scope_patterns_condition_exact_path() {
+        assert_eq!(
+            scope_patterns_condition(&strings(&["u/admin/my_script"])),
+            Some("(o.path = 'u/admin/my_script')".to_string())
+        );
+    }
+
+    #[test]
+    fn scope_patterns_condition_subtree() {
+        // `f/team/*` matches the folder itself or anything beneath it, mirroring
+        // resource_matches_pattern. Underscores in the prefix are LIKE-escaped.
+        assert_eq!(
+            scope_patterns_condition(&strings(&["f/team/*"])),
+            Some("((o.path = 'f/team' OR o.path LIKE 'f/team/%' ESCAPE '\\'))".to_string())
+        );
+    }
+
+    #[test]
+    fn scope_patterns_condition_mixed_ored() {
+        assert_eq!(
+            scope_patterns_condition(&strings(&["u/admin/one", "f/team/*"])),
+            Some(
+                "(o.path = 'u/admin/one' OR (o.path = 'f/team' OR o.path LIKE 'f/team/%' ESCAPE '\\'))"
+                    .to_string()
+            )
+        );
+    }
+
+    #[test]
+    fn scope_patterns_condition_escapes_like_wildcards() {
+        // A subtree prefix containing `%`/`_` must be escaped so it isn't treated
+        // as a LIKE pattern; the exact-match arm is quoted verbatim by bind.
+        assert_eq!(
+            scope_patterns_condition(&strings(&["f/a_b/*"])),
+            Some("((o.path = 'f/a_b' OR o.path LIKE 'f/a\\_b/%' ESCAPE '\\'))".to_string())
+        );
+    }
 }
diff --git a/backend/windmill-mcp/src/server/backend.rs b/backend/windmill-mcp/src/server/backend.rs
index 96a2bed8df..e42c0dacfc 100644
--- a/backend/windmill-mcp/src/server/backend.rs
+++ b/backend/windmill-mcp/src/server/backend.rs
@@ -16,6 +16,24 @@ use crate::server::endpoints::EndpointTool;
 /// Result type for backend operations using rmcp's ErrorData directly
 pub type BackendResult<T> = Result<T, ErrorData>;
 
+/// How a script/flow listing is narrowed by path at the SQL layer, *before* the
+/// `ITEMS_FETCH_MAX_LIMIT` cap applies.
+///
+/// This must be pushed into the query, not applied in Rust after the fetch: the
+/// listing is capped to the newest N rows, so a granular token whose in-scope
+/// items are not among those N would have them truncated away before any Rust
+/// filter ran (returning zero tools even though the items exist).
+#[derive(Debug, Clone, Copy)]
+pub enum PathFilter<'a> {
+    /// Raw `LIKE '{prefix}%'` prefix — used to resolve a hashed tool name back to
+    /// its full path.
+    Prefix(&'a str),
+    /// MCP scope patterns (`*`, an exact path, or an `x/*` subtree). Mirrors
+    /// `is_resource_allowed`: a `*` pattern matches everything, an empty list
+    /// matches nothing.
+    Patterns(&'a [String]),
+}
+
 /// Authentication context required by the MCP server
 pub trait McpAuth: Send + Sync + Clone + 'static {
     /// Get the username
@@ -62,22 +80,22 @@ pub trait McpBackend: Send + Sync + Clone + 'static {
     // Listing Operations
     // ─────────────────────────────────────────────────────────────────
 
-    /// List scripts, optionally filtered to favorites only and/or by path prefix
+    /// List scripts, optionally filtered to favorites only and/or by path
     async fn list_scripts(
         &self,
         auth: &Self::Auth,
         workspace_id: &str,
         favorites_only: bool,
-        path_prefix: Option<&str>,
+        path_filter: Option<PathFilter<'_>>,
     ) -> BackendResult<Vec<ScriptInfo>>;
 
-    /// List flows, optionally filtered to favorites only and/or by path prefix
+    /// List flows, optionally filtered to favorites only and/or by path
     async fn list_flows(
         &self,
         auth: &Self::Auth,
         workspace_id: &str,
         favorites_only: bool,
-        path_prefix: Option<&str>,
+        path_filter: Option<PathFilter<'_>>,
     ) -> BackendResult<Vec<FlowInfo>>;
 
     /// List resource types in workspace
diff --git a/backend/windmill-mcp/src/server/mod.rs b/backend/windmill-mcp/src/server/mod.rs
index d5d49bc746..da7032418b 100644
--- a/backend/windmill-mcp/src/server/mod.rs
+++ b/backend/windmill-mcp/src/server/mod.rs
@@ -12,7 +12,7 @@ pub mod tools;
 
 // Re-export main types
 pub use crate::common::types::{McpToken, MultiWorkspaceMcp, WorkspaceInfo};
-pub use backend::{BackendResult, McpAuth, McpBackend};
+pub use backend::{BackendResult, McpAuth, McpBackend, PathFilter};
 pub use endpoints::{
     endpoint_tool_to_mcp_tool, endpoint_tool_to_mcp_tool_multi, is_endpoint_read_only,
     list_workspaces_tool, EndpointTool,
diff --git a/backend/windmill-mcp/src/server/runner.rs b/backend/windmill-mcp/src/server/runner.rs
index dd810269d9..5db32faedb 100644
--- a/backend/windmill-mcp/src/server/runner.rs
+++ b/backend/windmill-mcp/src/server/runner.rs
@@ -10,7 +10,7 @@ use crate::common::transform::{
     reverse_transform, reverse_transform_key,
 };
 use crate::common::types::{McpToken, MultiWorkspaceMcp, ResourceInfo, ToolableItem, WorkspaceId};
-use crate::server::backend::{McpAuth, McpBackend};
+use crate::server::backend::{McpAuth, McpBackend, PathFilter};
 use crate::server::endpoints::{
     endpoint_tool_to_mcp_tool, endpoint_tool_to_mcp_tool_multi, list_workspaces_tool,
 };
@@ -273,11 +273,23 @@ impl<B: McpBackend> Runner<B> {
         // mutating action), so skip the script/flow/hub/resource fetches
         // entirely — they would only be discarded below.
         if !read_only {
+            // For granular tokens, push the scope patterns into the SQL query so
+            // in-scope items survive the fetch cap (see `PathFilter`). The Rust
+            // filter below still runs as a defense-in-depth check. Non-granular
+            // (favorites/all) tokens are already narrowed by the favorites join
+            // or intentionally unfiltered.
+            let script_filter = scope_config
+                .granular
+                .then(|| PathFilter::Patterns(scope_config.scripts.as_slice()));
+            let flow_filter = scope_config
+                .granular
+                .then(|| PathFilter::Patterns(scope_config.flows.as_slice()));
+
             let (scripts, flows, resource_types, hub_scripts) = tokio::try_join!(
                 self.backend
-                    .list_scripts(auth, workspace_id, favorites_only, None),
+                    .list_scripts(auth, workspace_id, favorites_only, script_filter),
                 self.backend
-                    .list_flows(auth, workspace_id, favorites_only, None),
+                    .list_flows(auth, workspace_id, favorites_only, flow_filter),
                 self.backend.list_resource_types(auth, workspace_id),
                 async {
                     if let Some(ref apps) = scope_config.hub_apps {
@@ -456,11 +468,12 @@ impl<B: McpBackend> Runner<B> {
             (type_str, version_id, true)
         } else {
             let path_prefix = extract_path_prefix_from_hashed(name.as_ref());
+            let path_filter = path_prefix.as_deref().map(PathFilter::Prefix);
             let favorites_only = scope_config.favorites;
             let matched_path = if type_str == "script" {
                 find_matching_path(
                     self.backend
-                        .list_scripts(auth, workspace_id, favorites_only, path_prefix.as_deref())
+                        .list_scripts(auth, workspace_id, favorites_only, path_filter)
                         .await
                         .map_err(|e| ErrorData::internal_error(e.message, None))?,
                     name.as_ref(),
@@ -468,7 +481,7 @@ impl<B: McpBackend> Runner<B> {
             } else {
                 find_matching_path(
                     self.backend
-                        .list_flows(auth, workspace_id, favorites_only, path_prefix.as_deref())
+                        .list_flows(auth, workspace_id, favorites_only, path_filter)
                         .await
                         .map_err(|e| ErrorData::internal_error(e.message, None))?,
                     name.as_ref(),
diff --git a/frontend/src/lib/components/mcp/McpScopeSelector.svelte b/frontend/src/lib/components/mcp/McpScopeSelector.svelte
index cf95617790..3ff1ab3d95 100644
--- a/frontend/src/lib/components/mcp/McpScopeSelector.svelte
+++ b/frontend/src/lib/components/mcp/McpScopeSelector.svelte
@@ -1,5 +1,5 @@
 <script lang="ts">
-	import { Badge, Button } from '$lib/components/common'
+	import { Alert, Badge, Button } from '$lib/components/common'
 	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
 	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import Popover from '$lib/components/Popover.svelte'
@@ -20,6 +20,12 @@
 
 	let { workspaceId, scope = $bindable(), initialScope, readOnly = false }: Props = $props()
 
+	// Mirrors ITEMS_FETCH_MAX_LIMIT in backend/windmill-api/src/mcp/utils.rs: the
+	// server exposes at most this many scripts and this many flows (per type) as
+	// MCP tools, taking the most recently created. A scope matching more than this
+	// silently drops the overflow, so we warn at configuration time.
+	const MCP_TOOL_FETCH_LIMIT = 100
+
 	// Endpoints we can actually advertise to a read-only MCP token. Mirrors the
 	// runner's filter (only GET endpoints).
 	const visibleEndpointTools = $derived(
@@ -59,7 +65,7 @@
 	let loadingRunnables = $state(false)
 	let includedRunnables = $state<string[]>([])
 
-	let runnablesCache = new SvelteMap<string, string[]>()
+	let runnablesCache = new SvelteMap<string, { scripts: string[]; flows: string[] }>()
 
 	function parsePatterns(input: string): string[] {
 		return input
@@ -267,7 +273,11 @@
 		folder: string | undefined
 	) {
 		if (!workspace) return []
-		const pathStart = folder ? `f/${folder}` : undefined
+		// Trailing slash so the backend prefix (`o.path LIKE 'f/{folder}/%'`) is
+		// anchored at the folder boundary — otherwise a sibling like `f/team2`
+		// shares the `f/team` prefix and its newer rows can fill the page ahead
+		// of the target folder's rows.
+		const pathStart = folder ? `f/${folder}/` : undefined
 		const scripts = await ScriptService.listScripts({
 			starredOnly: favoriteOnly,
 			workspace,
@@ -283,7 +293,11 @@
 		folder: string | undefined
 	) {
 		if (!workspace) return []
-		const pathStart = folder ? `f/${folder}` : undefined
+		// Trailing slash so the backend prefix (`o.path LIKE 'f/{folder}/%'`) is
+		// anchored at the folder boundary — otherwise a sibling like `f/team2`
+		// shares the `f/team` prefix and its newer rows can fill the page ahead
+		// of the target folder's rows.
+		const pathStart = folder ? `f/${folder}/` : undefined
 		const flows = await FlowService.listFlows({
 			starredOnly: favoriteOnly,
 			workspace,
@@ -293,28 +307,31 @@
 		return flows.map((x) => x.path)
 	}
 
-	async function getScriptsAndFlows(
-		favoriteOnly: boolean = false,
+	// Fetch scripts+flows for a scope, cached and split by type so the same data
+	// feeds both the preview list and the truncation count (no duplicate fetch).
+	// The `f/{folder}/` fetch prefix already anchors at the folder boundary; the
+	// extra filter only guards a folder name whose LIKE wildcards (`_`, `%`) let
+	// the backend prefix over-match (e.g. `a_b` also matching `axb`).
+	async function fetchScriptsAndFlows(
 		workspace: string,
+		favoriteOnly: boolean,
 		folder: string | undefined
-	) {
+	): Promise<{ scripts: string[]; flows: string[] }> {
 		const cacheKey = `${workspace}-${favoriteOnly}${folder ? `-${folder}` : ''}`
-		if (runnablesCache.has(cacheKey)) {
-			includedRunnables = runnablesCache.get(cacheKey) || []
-			return
-		}
-		try {
-			loadingRunnables = true
-			const [scripts, flows] = await Promise.all([
-				getScripts(favoriteOnly, workspace, folder),
-				getFlows(favoriteOnly, workspace, folder)
-			])
-			const combined = [...scripts, ...flows]
-			runnablesCache.set(cacheKey, combined)
-			includedRunnables = combined
-		} finally {
-			loadingRunnables = false
+		const cached = runnablesCache.get(cacheKey)
+		if (cached) return cached
+		let [scripts, flows] = await Promise.all([
+			getScripts(favoriteOnly, workspace, folder),
+			getFlows(favoriteOnly, workspace, folder)
+		])
+		if (folder) {
+			const pattern = [`f/${folder}/*`]
+			scripts = scripts.filter((p) => matchesAnyPattern(p, pattern))
+			flows = flows.filter((p) => matchesAnyPattern(p, pattern))
 		}
+		const result = { scripts, flows }
+		runnablesCache.set(cacheKey, result)
+		return result
 	}
 
 	async function loadAllScriptsAndFlows(workspace: string) {
@@ -331,45 +348,52 @@
 		}
 	}
 
-	// Load runnables based on mode
-	$effect(() => {
-		if (workspaceId) {
-			if (selectedMode === 'folder') {
-				if (selectedFolders.length > 0) {
-					loadRunnablesForFolders(workspaceId, selectedFolders)
-				} else {
-					includedRunnables = []
-				}
-			} else {
-				getScriptsAndFlows(selectedMode === 'favorites', workspaceId, undefined)
-			}
+	// Load the preview list AND the exposed per-type counts for non-custom modes
+	// from a single (cached) fetch — no duplicate requests. A sequence guard drops
+	// stale async results when the scope changes faster than the fetches resolve.
+	let runnablesSeq = 0
+	async function loadRunnablesAndCounts() {
+		const seq = ++runnablesSeq
+		const ws = workspaceId
+		if (!ws || selectedMode === 'custom') return
+		if (selectedMode === 'folder' && selectedFolders.length === 0) {
+			includedRunnables = []
+			exposedScriptCount = 0
+			exposedFlowCount = 0
+			return
 		}
-	})
-
-	async function getCachedRunnables(workspace: string, folder: string): Promise<string[]> {
-		const cacheKey = `${workspace}-false-${folder}`
-		if (runnablesCache.has(cacheKey)) {
-			return runnablesCache.get(cacheKey) || []
-		}
-		const [scripts, flows] = await Promise.all([
-			getScripts(false, workspace, folder),
-			getFlows(false, workspace, folder)
-		])
-		const combined = [...scripts, ...flows]
-		runnablesCache.set(cacheKey, combined)
-		return combined
-	}
-
-	async function loadRunnablesForFolders(workspace: string, folders: string[]) {
+		loadingRunnables = true
 		try {
-			loadingRunnables = true
-			const results = await Promise.all(folders.map((f) => getCachedRunnables(workspace, f)))
-			includedRunnables = [...new Set(results.flat())]
+			let scripts: string[]
+			let flows: string[]
+			if (selectedMode === 'folder') {
+				const perFolder = await Promise.all(
+					selectedFolders.map((f) => fetchScriptsAndFlows(ws, false, f))
+				)
+				scripts = [...new Set(perFolder.flatMap((r) => r.scripts))]
+				flows = [...new Set(perFolder.flatMap((r) => r.flows))]
+			} else {
+				const r = await fetchScriptsAndFlows(ws, selectedMode === 'favorites', undefined)
+				scripts = r.scripts
+				flows = r.flows
+			}
+			if (seq !== runnablesSeq) return
+			includedRunnables = [...scripts, ...flows]
+			exposedScriptCount = scripts.length
+			exposedFlowCount = flows.length
 		} finally {
-			loadingRunnables = false
+			if (seq === runnablesSeq) loadingRunnables = false
 		}
 	}
 
+	$effect(() => {
+		// React to scope inputs (non-custom modes load list + counts together).
+		selectedMode
+		selectedFolders
+		workspaceId
+		loadRunnablesAndCounts()
+	})
+
 	// Load all scripts/flows for custom mode
 	$effect(() => {
 		if (selectedMode === 'custom' && workspaceId) {
@@ -415,6 +439,52 @@
 				: `You do not have any scripts or flows in the selected folder(s).`
 	)
 
+	// How many scripts / flows the current scope would expose, per type, so we can
+	// warn when it exceeds MCP_TOOL_FETCH_LIMIT (the server caps each type).
+	let exposedScriptCount = $state<number | undefined>(undefined)
+	let exposedFlowCount = $state<number | undefined>(undefined)
+
+	// Mirror the backend's is_resource_allowed: `*`, an exact path, or an `x/*`
+	// subtree (matching the folder itself or anything beneath it).
+	function matchesAnyPattern(path: string, patterns: string[]): boolean {
+		for (const p of patterns) {
+			if (p === '*' || p === path) return true
+			if (p.endsWith('/*')) {
+				const prefix = p.slice(0, -2)
+				if (path === prefix || (path.startsWith(prefix) && path[prefix.length] === '/')) {
+					return true
+				}
+			}
+		}
+		return false
+	}
+
+	// Custom-mode counts are computed synchronously from the already-loaded
+	// allScripts/allFlows plus the current selections/patterns — no extra fetch.
+	$effect(() => {
+		if (selectedMode !== 'custom') return
+		const scriptPatterns = parsePatterns(customScriptPatterns)
+		const flowPatterns = parsePatterns(customFlowPatterns)
+		const scriptMatches = scriptPatterns.length
+			? allScripts.filter((p) => matchesAnyPattern(p, scriptPatterns))
+			: []
+		const flowMatches = flowPatterns.length
+			? allFlows.filter((p) => matchesAnyPattern(p, flowPatterns))
+			: []
+		exposedScriptCount = new Set([...selectedScripts, ...scriptMatches]).size
+		exposedFlowCount = new Set([...selectedFlows, ...flowMatches]).size
+	})
+
+	const truncationWarning = $derived.by(() => {
+		if (readOnly) return undefined
+		const parts: string[] = []
+		if ((exposedScriptCount ?? 0) > MCP_TOOL_FETCH_LIMIT)
+			parts.push(`${exposedScriptCount} scripts`)
+		if ((exposedFlowCount ?? 0) > MCP_TOOL_FETCH_LIMIT) parts.push(`${exposedFlowCount} flows`)
+		if (parts.length === 0) return undefined
+		return `This scope matches ${parts.join(' and ')}. Only the ${MCP_TOOL_FETCH_LIMIT} most recent of each type are exposed as MCP tools; the rest are omitted. Narrow the scope to avoid overloading the assistant's context.`
+	})
+
 	function selectAllScripts() {
 		selectedScripts = [...allScripts]
 	}
@@ -468,6 +538,12 @@
 		</ToggleButtonGroup>
 	</div>
 
+	{#if truncationWarning}
+		<Alert type="warning" size="xs" title="Too many tools for this scope">
+			{truncationWarning}
+		</Alert>
+	{/if}
+
 	{#if selectedMode === 'folder'}
 		<div>
 			<span class="block mb-1 text-emphasis text-xs font-semibold">Select Folders</span>

From 6131f7d2aebbddc26a0e3b06c034b6df5fae18cf Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 17 Jul 2026 00:22:56 +0200
Subject: [PATCH 028/171] chore(main): release 1.761.0 (#10148)

* chore(main): release 1.761.0

* Apply automatic changes

---------

Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>
---
 CHANGELOG.md                                  |  27 ++
 backend/Cargo.lock                            | 252 +++++++++---------
 backend/Cargo.toml                            |   4 +-
 .../parsers/windmill-parser-wasm/Cargo.lock   |  48 ++--
 .../parsers/windmill-parser-wasm/Cargo.toml   |   2 +-
 backend/windmill-api/openapi.yaml             |   2 +-
 benchmarks/lib.ts                             |   2 +-
 cli/src/core/constants.ts                     |   2 +-
 frontend/package-lock.json                    |  54 +++-
 frontend/package.json                         |   2 +-
 lsp/Pipfile                                   |   2 +-
 openflow.openapi.yaml                         |   2 +-
 .../WindmillClient/WindmillClient.psd1        |   2 +-
 python-client/wmill/pyproject.toml            |   2 +-
 typescript-client/jsr.json                    |   2 +-
 typescript-client/package.json                |   2 +-
 version.txt                                   |   2 +-
 17 files changed, 241 insertions(+), 168 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ed3e5e116b..7b65e78e8b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,32 @@
 # Changelog
 
+## [1.761.0](https://github.com/windmill-labs/windmill/compare/v1.760.1...v1.761.0) (2026-07-16)
+
+
+### Features
+
+* **ai-sessions:** CRUD markdown artifacts in sessions ([#10046](https://github.com/windmill-labs/windmill/issues/10046)) ([0ea5705](https://github.com/windmill-labs/windmill/commit/0ea570570e65abf64b3b171e592a8dd3eea0b105))
+* **alerts:** include disk total and top consumers in low-disk alert ([#10144](https://github.com/windmill-labs/windmill/issues/10144)) ([4e0fd4d](https://github.com/windmill-labs/windmill/commit/4e0fd4db5589f91426ca025184da7b977d5a16d6))
+* automatic git-to-windmill sync (polling, webhooks, in-app PRs + checks) ([#9552](https://github.com/windmill-labs/windmill/issues/9552)) ([51d8db6](https://github.com/windmill-labs/windmill/commit/51d8db6602bc192879e50b54a5fe6b6b8beb63f4))
+* display openai reasoning summaries in ai chat ([#10147](https://github.com/windmill-labs/windmill/issues/10147)) ([4ee1d32](https://github.com/windmill-labs/windmill/commit/4ee1d32101eb527ef707c3c4af456892f0a059ab))
+* **forks:** add "Hide unchanged drafts" toggle to fork deploy-draft tab ([#10022](https://github.com/windmill-labs/windmill/issues/10022)) ([4fc3f30](https://github.com/windmill-labs/windmill/commit/4fc3f304c632eda15876c28cb6f473a799a41f48))
+* **frontend:** flatten workspace pickers, whole-tab picker trigger ([#10145](https://github.com/windmill-labs/windmill/issues/10145)) ([7fda6a0](https://github.com/windmill-labs/windmill/commit/7fda6a05345d14f62dc2124d682650d50eecbe98))
+
+
+### Bug Fixes
+
+* **ai:** show the question in askUserQuestion tool-call labels ([#10153](https://github.com/windmill-labs/windmill/issues/10153)) ([fa03984](https://github.com/windmill-labs/windmill/commit/fa03984a14bb71f0ea2a27bfa23339a9d0d8e86b))
+* **alerts:** identify server replica in low-disk alert + per-host dedup tag ([#10143](https://github.com/windmill-labs/windmill/issues/10143)) ([3bd9f05](https://github.com/windmill-labs/windmill/commit/3bd9f0593866740935f79c8b2c1cb92829059105))
+* **frontend:** sanitize job result markup, gate it on unsandboxed public apps ([#10127](https://github.com/windmill-labs/windmill/issues/10127)) ([7b813d1](https://github.com/windmill-labs/windmill/commit/7b813d1f74baef200d9f1387e02925083b79b265))
+* **frontend:** show friendly draft path for draft-only items in pickers ([#10136](https://github.com/windmill-labs/windmill/issues/10136)) ([568dbbe](https://github.com/windmill-labs/windmill/commit/568dbbee852d59986581b0d16f5ac3e06d6bad6a))
+* **frontend:** surface real tool call errors in AI chat ([#10146](https://github.com/windmill-labs/windmill/issues/10146)) ([0694b84](https://github.com/windmill-labs/windmill/commit/0694b84da7bbb9404fd386e3ce109a574a0e9c93))
+* heartbeat job ping during s3object materialization in SQL executors ([#10152](https://github.com/windmill-labs/windmill/issues/10152)) ([7d5009e](https://github.com/windmill-labs/windmill/commit/7d5009e3928bb200150eb998ed0b3016c3395987))
+* **mcp:** push granular scope patterns into SQL so scoped scripts/flows aren't truncated ([#10140](https://github.com/windmill-labs/windmill/issues/10140)) ([91d6606](https://github.com/windmill-labs/windmill/commit/91d6606868d0e9c5f78ab48a592ef95ffaeeca61))
+* **migrations:** grant zombie_job_counter to windmill roles ([#10159](https://github.com/windmill-labs/windmill/issues/10159)) ([0e547ad](https://github.com/windmill-labs/windmill/commit/0e547adf23b615f0caccc88eb9101bb0604bb51b))
+* **raw-apps:** full code ui builder improvements ([c55ac53](https://github.com/windmill-labs/windmill/commit/c55ac5326fbb4532f22b7250a58b69396a4c868a))
+* **raw-apps:** prevent and surface the silent blank screen from an unmounted #root ([#10150](https://github.com/windmill-labs/windmill/issues/10150)) ([24750e6](https://github.com/windmill-labs/windmill/commit/24750e6ef1a1a975e0063df6809774f913b5d01b))
+* **self-host:** unbreak self-hosted Caddy after the caddy-l4 syntax change ([#10156](https://github.com/windmill-labs/windmill/issues/10156)) ([2f6c35b](https://github.com/windmill-labs/windmill/commit/2f6c35b15bf70f17eb8ff08281e0ecf8313e7b35))
+
 ## [1.760.1](https://github.com/windmill-labs/windmill/compare/v1.760.0...v1.760.1) (2026-07-15)
 
 
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index f8c671d63e..64427a820c 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -1532,7 +1532,7 @@ version = "0.71.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5f58bf3d7db68cfbac37cfc485a8d711e87e064c3d0fe0435b92f7a407f9d6b3"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "cexpr",
  "clang-sys",
  "itertools 0.13.0",
@@ -1552,7 +1552,7 @@ version = "0.72.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "993776b509cfb49c750f11b8f07a46fa23e0a1386ffc01fb1e7d343efc387895"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "cexpr",
  "clang-sys",
  "itertools 0.13.0",
@@ -1595,9 +1595,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.13.0"
+version = "2.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4388bee8683e3d04af747c73422af53102d2bd24d9eadb6cbc100baef4b43f8"
+checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
 dependencies = [
  "serde_core",
 ]
@@ -1761,9 +1761,9 @@ dependencies = [
 
 [[package]]
 name = "borsh"
-version = "1.7.0"
+version = "1.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f3f6da4992df95bbcd9af42a6c7dcb994498fc9048230405f3b36ff7cd3f145"
+checksum = "a88b7ea17d208c4193f2c1e6de3c35fe71f98c96982d5ced308bdcc749ff6e1f"
 dependencies = [
  "borsh-derive",
  "bytes",
@@ -1772,9 +1772,9 @@ dependencies = [
 
 [[package]]
 name = "borsh-derive"
-version = "1.7.0"
+version = "1.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3ae8fb4fb5740e4b2c4884ff95f5f32f5e8479db1e8fd8eb49ddbe09eb09bb7c"
+checksum = "d8f347189c62a579b8cd5f80714efa178f52e461dc2e6d701d264f5ff22e566c"
 dependencies = [
  "once_cell",
  "proc-macro-crate",
@@ -2124,9 +2124,9 @@ checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 
 [[package]]
 name = "cfg_aliases"
-version = "0.2.1"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
+checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
 
 [[package]]
 name = "chacha20"
@@ -4674,7 +4674,7 @@ version = "25.12.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "35f6839d7b3b98adde531effaf34f0c2badc6f4735d26fe74709d8e513a96ef3"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "rustc_version 0.4.1",
 ]
 
@@ -6182,7 +6182,7 @@ version = "0.7.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9080b15e63775b9a2ac7dca720f7050a8b955e092ea0f6020a4a80f69998cdc0"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "cfg-if",
  "libc",
 ]
@@ -6674,7 +6674,7 @@ version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b9e668df13f2e97f3eed52d9301f6b1c4c1ccfccc30eab9e6628e4a8c1fc3546"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "bytes",
  "lazy_static",
  "libgssapi-sys",
@@ -6723,7 +6723,7 @@ version = "0.1.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c943259e342f1e06ff2da7a83eabdfe7f92ce10262688dbf1895ff0b3e6e4652"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "libc",
  "plain",
  "redox_syscall 0.9.0",
@@ -7356,7 +7356,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0f27695f286b461da077b8c2f72f47feaa04ce3c3f9c0976257410e90e21208a"
 dependencies = [
  "base64 0.22.1",
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "btoi",
  "byteorder",
  "bytes",
@@ -7415,7 +7415,7 @@ version = "0.27.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2eb04e9c688eff1c89d72b407f168cf79bb9e867a9d3323ed6c01519eb9cc053"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "cfg-if",
  "libc",
 ]
@@ -7426,7 +7426,7 @@ version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "71e2746dc3a24dd78b3cfcb7be93368c6de9963d30f43a6a73998a9cf4b17b46"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "cfg-if",
  "cfg_aliases",
  "libc",
@@ -7438,7 +7438,7 @@ version = "0.30.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "74523f3a35e05aba87a1d978330aef40f67b0304ac79c1c00b294c9830543db6"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "cfg-if",
  "cfg_aliases",
  "libc",
@@ -7450,7 +7450,7 @@ version = "0.31.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "cfg-if",
  "cfg_aliases",
  "libc",
@@ -7899,7 +7899,7 @@ version = "6.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0cc3cbf698f9438986c11a880c90a6d04b9de27575afd28bbf45b154b6c709e2"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "libc",
  "once_cell",
  "onig_sys",
@@ -7958,7 +7958,7 @@ version = "0.10.81"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77823a27f0babb03091cb9ed9ef80af3b39dbc82f97e8fa530374b7dafd87a45"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "cfg-if",
  "foreign-types",
  "libc",
@@ -8909,7 +8909,7 @@ version = "0.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cc5b72d8145275d844d4b5f6d4e1eef00c8cd889edb6035c21675d1bb1f45c9f"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "chrono",
  "flate2",
  "hex",
@@ -8923,7 +8923,7 @@ version = "0.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "239df02d8349b06fc07398a3a1697b06418223b1c7725085e801e7c0fc6a12ec"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "chrono",
  "hex",
 ]
@@ -9010,7 +9010,7 @@ version = "0.9.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "57206b407293d2bcd3af849ce869d52068623f19e1b5ff8e8778e3309439682b"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "getopts",
  "memchr",
  "unicase",
@@ -9304,7 +9304,7 @@ version = "11.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "498cd0dc59d73224351ee52a95fee0f1a617a2eae0e7d9d720cc622c73a54186"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
 ]
 
 [[package]]
@@ -9418,7 +9418,7 @@ version = "0.5.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
 ]
 
 [[package]]
@@ -9427,7 +9427,7 @@ version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c5102a6aaa05aa011a238e178e6bca86d2cb56fc9f586d37cb80f5bca6e07759"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
 ]
 
 [[package]]
@@ -9474,9 +9474,9 @@ dependencies = [
 
 [[package]]
 name = "regex"
-version = "1.13.0"
+version = "1.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a0e75113e14dc5acb068cd0786884f214f1312650a3d36d269f5c4f3cdee8a2"
+checksum = "f020237b6c8eed93db2e2cb53c00c60a8e1bc73da7d073199a1180401450218d"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -9486,9 +9486,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.15"
+version = "0.4.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f388202e4b80542a0921078cc23b6333bcf1409c1e3f86404cae4766a6131db"
+checksum = "8fcfdb36bda0c880c5931cdc7a2bcdc8ba4556847b9d912bca70bc94708711ad"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -9994,7 +9994,7 @@ version = "0.38.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fdb5bc1ae2baa591800df16c9ca78619bf65c0488b41b96ccec5d11220d8c154"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "errno",
  "libc",
  "linux-raw-sys 0.4.15",
@@ -10007,7 +10007,7 @@ version = "1.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "errno",
  "libc",
  "linux-raw-sys 0.12.1",
@@ -10461,7 +10461,7 @@ version = "2.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "897b2245f0b511c87893af39b033e5ca9cce68824c4d7e7630b5a1d339658d02"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "core-foundation 0.9.4",
  "core-foundation-sys",
  "libc",
@@ -10474,7 +10474,7 @@ version = "3.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "core-foundation 0.10.1",
  "core-foundation-sys",
  "libc",
@@ -11210,7 +11210,7 @@ dependencies = [
  "atoi",
  "base64 0.22.1",
  "bigdecimal",
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "byteorder",
  "bytes",
  "chrono",
@@ -11255,7 +11255,7 @@ dependencies = [
  "atoi",
  "base64 0.22.1",
  "bigdecimal",
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "byteorder",
  "chrono",
  "crc",
@@ -11530,7 +11530,7 @@ version = "15.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "65c25af97d53cf8aab66a6c68f3418663313fc969ad267fc2a4d19402c329be1"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "is-macro",
  "num-bigint",
  "once_cell",
@@ -11586,7 +11586,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "017d06ea85008234aa9fb34d805c7dc563f2ea6e03869ed5ac5a2dc27d561e4d"
 dependencies = [
  "arrayvec",
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "either",
  "num-bigint",
  "phf 0.11.3",
@@ -11908,7 +11908,7 @@ version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "01198a2debb237c62b6826ec7081082d951f46dbb64b0e8c7649a452230d1dfc"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "byteorder",
  "enum-as-inner",
  "libc",
@@ -11936,7 +11936,7 @@ version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a13f3d0daba03132c0aa9767f98351b3488edc2c100cda2d2ec2b04f3d8d3c8b"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "core-foundation 0.9.4",
  "system-configuration-sys",
 ]
@@ -12852,7 +12852,7 @@ checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
 dependencies = [
  "async-compression",
  "base64 0.22.1",
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "bytes",
  "futures-core",
  "futures-util",
@@ -13475,9 +13475,9 @@ checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
 [[package]]
 name = "uuid"
-version = "1.23.5"
+version = "1.24.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ea5fab0d6c3c01ae70085a09cb03d4c7a1d6314e2b3e075392783396d724ca0a"
+checksum = "bf3923a6f5c4c6382e0b653c4117f48d631ea17f38ed86e2a828e6f7412f5239"
 dependencies = [
  "getrandom 0.4.3",
  "js-sys",
@@ -13492,7 +13492,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "33995a1fee055ff743281cde33a41f0d618ee0bdbe8bdf6859e11864499c2595"
 dependencies = [
  "bindgen 0.71.1",
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "fslock",
  "gzip-header",
  "home",
@@ -13870,7 +13870,7 @@ dependencies = [
 
 [[package]]
 name = "windmill"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -13955,7 +13955,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-ai"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "async-stream",
  "async-trait",
@@ -13988,7 +13988,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-alerting"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14001,7 +14001,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "argon2",
@@ -14139,7 +14139,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-agent-workers"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14162,7 +14162,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-assets"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14177,7 +14177,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-auth"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14203,7 +14203,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "reqwest 0.12.28",
  "serde",
@@ -14213,7 +14213,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-configs"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14230,7 +14230,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-debug"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "axum 0.8.9",
  "base64 0.22.1",
@@ -14252,7 +14252,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-embeddings"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14275,7 +14275,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flow-conversations"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14291,7 +14291,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flows"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14312,7 +14312,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-groups"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14333,7 +14333,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-inputs"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14347,7 +14347,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-integration-tests"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -14382,7 +14382,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-jobs"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14407,7 +14407,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-npm-proxy"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "axum 0.8.9",
  "flate2",
@@ -14425,7 +14425,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-openapi"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14447,7 +14447,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-schedule"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14467,7 +14467,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-scripts"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14504,7 +14504,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-settings"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14532,7 +14532,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-sse"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "lazy_static",
  "serde",
@@ -14544,7 +14544,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-users"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "argon2",
  "axum 0.8.9",
@@ -14569,7 +14569,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workers"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14583,7 +14583,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workspaces"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14618,7 +14618,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -14632,7 +14632,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14651,7 +14651,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "aes-gcm",
  "aho-corasick",
@@ -14668,7 +14668,7 @@ dependencies = [
  "axum 0.8.9",
  "backon",
  "base64 0.22.1",
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "bytes",
  "chrono",
  "chrono-tz",
@@ -14753,7 +14753,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-dep-map"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "chrono",
  "itertools 0.14.0",
@@ -14772,7 +14772,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "regex",
  "serde",
@@ -14787,7 +14787,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "astral-tokio-tar",
@@ -14811,7 +14811,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-jseval"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -14828,7 +14828,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -14844,7 +14844,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-mcp"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -14865,7 +14865,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-native-triggers"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -14896,7 +14896,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-oauth"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "arc-swap",
@@ -14921,7 +14921,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-object-store"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "async-stream",
@@ -14955,7 +14955,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-operator"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -14973,7 +14973,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -14982,7 +14982,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -14994,7 +14994,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15006,7 +15006,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -15018,7 +15018,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15030,7 +15030,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15042,7 +15042,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -15053,7 +15053,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15064,7 +15064,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15076,7 +15076,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -15087,7 +15087,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15109,7 +15109,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15121,7 +15121,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15135,7 +15135,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -15152,7 +15152,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15165,7 +15165,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -15177,7 +15177,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15195,7 +15195,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -15211,7 +15211,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -15227,7 +15227,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -15238,7 +15238,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15277,7 +15277,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-runtime-nativets"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "const_format",
@@ -15317,7 +15317,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "getrandom 0.3.4",
  "wasm-bindgen",
@@ -15328,7 +15328,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-store"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15362,7 +15362,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-test-utils"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15386,7 +15386,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15419,7 +15419,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-azure"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15452,7 +15452,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-email"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15472,7 +15472,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-gcp"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15506,7 +15506,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-http"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15542,7 +15542,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-kafka"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15565,7 +15565,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-mqtt"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15589,7 +15589,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-nats"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -15613,7 +15613,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-postgres"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15648,7 +15648,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-sqs"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15676,7 +15676,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-websocket"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15701,10 +15701,10 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "chrono",
  "hex",
  "itertools 0.14.0",
@@ -15720,7 +15720,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "async-once-cell",
@@ -15830,7 +15830,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker-volumes"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "bytes",
  "futures",
@@ -16081,7 +16081,7 @@ version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d24d6bcc7f734a4091ecf8d7a64c5f7d7066f45585c1861eba06449909609c8a"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "widestring",
  "windows-sys 0.52.0",
 ]
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 6d3451afb7..9aa5717bb0 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.760.1"
+version = "1.761.0"
 authors.workspace = true
 edition.workspace = true
 
@@ -87,7 +87,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal", "./parsers/windmill-parser-wasm"]
 
 [workspace.package]
-version = "1.760.1"
+version = "1.761.0"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.lock b/backend/parsers/windmill-parser-wasm/Cargo.lock
index f71ebedbe4..74e913c46b 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.lock
+++ b/backend/parsers/windmill-parser-wasm/Cargo.lock
@@ -6191,7 +6191,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill-common"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "aho-corasick",
  "anyhow",
@@ -6272,7 +6272,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -6284,7 +6284,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "convert_case",
  "serde",
@@ -6293,7 +6293,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6305,7 +6305,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6317,7 +6317,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -6329,7 +6329,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6341,7 +6341,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6353,7 +6353,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -6364,7 +6364,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6375,7 +6375,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6387,7 +6387,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6398,7 +6398,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -6420,7 +6420,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6432,7 +6432,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6446,7 +6446,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "convert_case",
@@ -6463,7 +6463,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6476,7 +6476,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -6488,7 +6488,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6506,7 +6506,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -6522,7 +6522,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6538,7 +6538,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wasm"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "getrandom 0.2.17",
@@ -6570,7 +6570,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -6581,7 +6581,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.760.1"
+version = "1.761.0"
 dependencies = [
  "anyhow",
  "bitflags",
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.toml b/backend/parsers/windmill-parser-wasm/Cargo.toml
index 24903d6edb..c29d4c8bd4 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.toml
+++ b/backend/parsers/windmill-parser-wasm/Cargo.toml
@@ -12,7 +12,7 @@ resolver = "2"
 members = ["."]
 
 [workspace.package]
-version = "1.760.1"
+version = "1.761.0"
 edition = "2021"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index a923956f4c..2d976d1df9 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.760.1
+  version: 1.761.0
   title: Windmill API
 
   contact:
diff --git a/benchmarks/lib.ts b/benchmarks/lib.ts
index 34a898542d..30bc6e4a1d 100644
--- a/benchmarks/lib.ts
+++ b/benchmarks/lib.ts
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.760.1";
+export const VERSION = "v1.761.0";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({
diff --git a/cli/src/core/constants.ts b/cli/src/core/constants.ts
index 305a1836be..b51700e5a6 100644
--- a/cli/src/core/constants.ts
+++ b/cli/src/core/constants.ts
@@ -10,4 +10,4 @@ export const WM_FORK_PREFIX = "wm-fork";
 // (e.g. utils.ts) can read it without importing main.ts and creating a circular
 // dependency (main → workspace → utils → main) that triggers a TDZ.
 // Re-exported from main.ts for backwards compatibility.
-export const VERSION = "1.760.1";
+export const VERSION = "1.761.0";
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 6452137d53..3f5484438c 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.760.1",
+	"version": "1.761.0",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "@windmill-labs/components",
-			"version": "1.760.1",
+			"version": "1.761.0",
 			"hasInstallScript": true,
 			"license": "AGPL-3.0",
 			"dependencies": {
@@ -879,6 +879,7 @@
 			"version": "1.11.2",
 			"resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.11.2.tgz",
 			"integrity": "sha512-TC8MkTuZUtcTSiFeuC0ksCh9QIJ5+F21MvZ4Wn4ORfYaFJ/0dsiudv5tVkejgwZlwQ39jL9WWDe2lz8x0WglOA==",
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"dependencies": {
@@ -890,6 +891,7 @@
 			"version": "1.11.2",
 			"resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.11.2.tgz",
 			"integrity": "sha512-kyOl3X0DuTiT1h2ft8r2fYO8JYtU9a9Xis/zBSiGArNaagCOWx90N1k2wxp18czFDH+OgcWGb5ZP/XMt3dcyPA==",
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"dependencies": {
@@ -900,6 +902,7 @@
 			"version": "1.2.2",
 			"resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-1.2.2.tgz",
 			"integrity": "sha512-c95qOXkHdydNKhscBTebqEC1CVAZpyqOfVfBzQ1qgzyl3gfeldUjIggDbIZgDKsHLgnsM+igH7TJ/eAasaVuMA==",
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"dependencies": {
@@ -1415,6 +1418,7 @@
 			"version": "1.1.4",
 			"resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.4.tgz",
 			"integrity": "sha512-3NQNNgA1YSlJb/kMH1ildASP9HW7/7kYnRI2szWJaofaS1hWmbGI4H+d3+22aGzXXN9IJ+n+GiFVcGipJP18ow==",
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"dependencies": {
@@ -1563,6 +1567,7 @@
 			"cpu": [
 				"arm64"
 			],
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1579,6 +1584,7 @@
 			"cpu": [
 				"arm64"
 			],
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1595,6 +1601,7 @@
 			"cpu": [
 				"x64"
 			],
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1611,6 +1618,7 @@
 			"cpu": [
 				"x64"
 			],
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1627,6 +1635,7 @@
 			"cpu": [
 				"arm"
 			],
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1643,6 +1652,7 @@
 			"cpu": [
 				"arm64"
 			],
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1659,6 +1669,7 @@
 			"cpu": [
 				"arm64"
 			],
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1675,6 +1686,7 @@
 			"cpu": [
 				"ppc64"
 			],
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1691,6 +1703,7 @@
 			"cpu": [
 				"s390x"
 			],
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1707,6 +1720,7 @@
 			"cpu": [
 				"x64"
 			],
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1723,6 +1737,7 @@
 			"cpu": [
 				"x64"
 			],
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1739,6 +1754,7 @@
 			"cpu": [
 				"arm64"
 			],
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1755,6 +1771,7 @@
 			"cpu": [
 				"wasm32"
 			],
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"dependencies": {
@@ -1773,6 +1790,7 @@
 			"cpu": [
 				"arm64"
 			],
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1789,6 +1807,7 @@
 			"cpu": [
 				"x64"
 			],
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -2094,6 +2113,7 @@
 			"version": "0.10.2",
 			"resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.2.tgz",
 			"integrity": "sha512-RoBvJ2X0wuKlWFIjrwffGw1IqZHKQqzIchKaadZZfnNpsAYp2mM0h36JtPCjNDAHGgYez/15uMBpfGwchhiMgg==",
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"dependencies": {
@@ -7329,7 +7349,7 @@
 			"version": "1.21.7",
 			"resolved": "https://registry.npmjs.org/jiti/-/jiti-1.21.7.tgz",
 			"integrity": "sha512-/imKNG4EbWNrVjoNC/1H5/9GFy+tqjGBHCaSsN+P2RnPqjsLmv6UD3Ej+Kj8nBWaRAwyk7kK5ZUc+OEatnTR3A==",
-			"devOptional": true,
+			"dev": true,
 			"license": "MIT",
 			"bin": {
 				"jiti": "bin/jiti.js"
@@ -7864,6 +7884,7 @@
 			"cpu": [
 				"arm64"
 			],
+			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -7884,6 +7905,7 @@
 			"cpu": [
 				"arm64"
 			],
+			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -7904,6 +7926,7 @@
 			"cpu": [
 				"x64"
 			],
+			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -7924,6 +7947,7 @@
 			"cpu": [
 				"x64"
 			],
+			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -7944,6 +7968,7 @@
 			"cpu": [
 				"arm"
 			],
+			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -7964,6 +7989,7 @@
 			"cpu": [
 				"arm64"
 			],
+			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -7984,6 +8010,7 @@
 			"cpu": [
 				"arm64"
 			],
+			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -8004,6 +8031,7 @@
 			"cpu": [
 				"x64"
 			],
+			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -8024,6 +8052,7 @@
 			"cpu": [
 				"x64"
 			],
+			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -8044,6 +8073,7 @@
 			"cpu": [
 				"arm64"
 			],
+			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -8064,6 +8094,7 @@
 			"cpu": [
 				"x64"
 			],
+			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -12751,6 +12782,21 @@
 				}
 			}
 		},
+		"node_modules/svelte-check/node_modules/picomatch": {
+			"version": "4.0.5",
+			"resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.5.tgz",
+			"integrity": "sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==",
+			"dev": true,
+			"license": "MIT",
+			"optional": true,
+			"peer": true,
+			"engines": {
+				"node": ">=12"
+			},
+			"funding": {
+				"url": "https://github.com/sponsors/jonschlinkert"
+			}
+		},
 		"node_modules/svelte-eslint-parser": {
 			"version": "0.43.0",
 			"resolved": "https://registry.npmjs.org/svelte-eslint-parser/-/svelte-eslint-parser-0.43.0.tgz",
@@ -13490,7 +13536,7 @@
 			"version": "5.9.3",
 			"resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
 			"integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
-			"devOptional": true,
+			"dev": true,
 			"license": "Apache-2.0",
 			"bin": {
 				"tsc": "bin/tsc",
diff --git a/frontend/package.json b/frontend/package.json
index 135116b908..d7541af7bf 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.760.1",
+	"version": "1.761.0",
 	"scripts": {
 		"dev": "vite dev",
 		"dev:ui-builder": "mv static/ui_builder static/ui_builder.dev-disabled 2>/dev/null || true ; trap 'mv static/ui_builder.dev-disabled static/ui_builder 2>/dev/null || true' EXIT ; vite dev",
diff --git a/lsp/Pipfile b/lsp/Pipfile
index 98820f3272..017325033b 100644
--- a/lsp/Pipfile
+++ b/lsp/Pipfile
@@ -4,7 +4,7 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-wmill = ">=1.760.1"
+wmill = ">=1.761.0"
 sendgrid = "*"
 mysql-connector-python = "*"
 pymongo = "*"
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index 634e6387ea..687cf148ab 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1,7 +1,7 @@
 openapi: '3.0.3'
 
 info:
-  version: 1.760.1
+  version: 1.761.0
   title: OpenFlow Spec
   contact:
     name: Ruben Fiszel
diff --git a/powershell-client/WindmillClient/WindmillClient.psd1 b/powershell-client/WindmillClient/WindmillClient.psd1
index 01313ddfea..b1065fc8db 100644
--- a/powershell-client/WindmillClient/WindmillClient.psd1
+++ b/powershell-client/WindmillClient/WindmillClient.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'WindmillClient.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '1.760.1'
+    ModuleVersion     = '1.761.0'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()
diff --git a/python-client/wmill/pyproject.toml b/python-client/wmill/pyproject.toml
index be4b577ecc..fd1b6c11aa 100644
--- a/python-client/wmill/pyproject.toml
+++ b/python-client/wmill/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill"
-version = "1.760.1"
+version = "1.761.0"
 description = "A client library for accessing Windmill server wrapping the Windmill client API"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/typescript-client/jsr.json b/typescript-client/jsr.json
index 9ca1a210d7..329b0408e9 100644
--- a/typescript-client/jsr.json
+++ b/typescript-client/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@windmill/windmill",
-  "version": "1.760.1",
+  "version": "1.761.0",
   "exports": "./src/index.ts",
   "publish": {
     "exclude": ["!src", "./s3Types.ts", "./sqlUtils.ts", "./client.ts"]
diff --git a/typescript-client/package.json b/typescript-client/package.json
index b3d040dc46..be72cec08e 100644
--- a/typescript-client/package.json
+++ b/typescript-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.760.1",
+  "version": "1.761.0",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "homepage": "https://github.com/windmill-labs/windmill/tree/main/typescript-client#readme",
diff --git a/version.txt b/version.txt
index 1a33933b31..5e7b269992 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.760.1
+1.761.0

From be57dd91e40551ff0d6fbbeccd97e2b98589c5b9 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 17 Jul 2026 15:09:24 +0200
Subject: [PATCH 029/171] fix(ansible): keep persistent-connection socket path
 under the AF_UNIX limit (#10167)

* fix(ansible): keep persistent-connection socket path under the AF_UNIX limit

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(ansible): root socket dir at WINDMILL_DIR and verify we own it

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(ansible): fail closed on an untrusted socket root and honor commented section headers

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(ansible): validate the socket root after creating it, not before

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(ansible): root socket dir at sticky /tmp so the image's 0777 windmill dir cannot disable it

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(ansible): only sweep socket dirs the worker could have created

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(ansible): drop the configurable socket root, fixing its ancestor and sweep hazards

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(ansible): require the socket root be usable, not just safe

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(ansible): do not override a control_path_dir the job set itself

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* refactor(ansible): drop the dead parent-creation step for the fixed /tmp root

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 backend/windmill-worker/Cargo.toml            |   5 +-
 .../windmill-worker/src/ansible_executor.rs   | 737 +++++++++++++++++-
 backend/windmill-worker/src/worker.rs         |   3 +
 .../windmill-worker/src/worker_lockfiles.rs   |   2 +-
 4 files changed, 724 insertions(+), 23 deletions(-)

diff --git a/backend/windmill-worker/Cargo.toml b/backend/windmill-worker/Cargo.toml
index 14aeb734ed..5b1047a153 100644
--- a/backend/windmill-worker/Cargo.toml
+++ b/backend/windmill-worker/Cargo.toml
@@ -115,8 +115,9 @@ hmac.workspace = true
 pem = { workspace = true, optional = true }
 rsa = { workspace = true, optional = true }
 urlencoding.workspace = true
-# `fs` adds flock(2) for the cross-process Python install lock (shared cache mounts)
-nix = { workspace = true, features = ["fs"] }
+# `fs` adds flock(2) for the cross-process Python install lock (shared cache mounts);
+# `user` adds geteuid(2) to verify ownership of the ansible socket-dir root
+nix = { workspace = true, features = ["fs", "user"] }
 bytes.workspace = true
 reqwest.workspace = true
 reqwest-middleware.workspace = true
diff --git a/backend/windmill-worker/src/ansible_executor.rs b/backend/windmill-worker/src/ansible_executor.rs
index 92bffe0cf0..708250dac6 100644
--- a/backend/windmill-worker/src/ansible_executor.rs
+++ b/backend/windmill-worker/src/ansible_executor.rs
@@ -55,6 +55,190 @@ const WINDMILL_ANSIBLE_PASSWORD_FILENAME: &str = ".windmill.ansible_vault_passwo
 
 const DELEGATE_GIT_REPO_TARGET: &str = "delegate_git_repository";
 
+/// Usable bytes in `sockaddr_un.sun_path` (108 minus the NUL). An ABI constant, not a
+/// filesystem limit — which is why only the socket breaks while every regular file in the
+/// same job dir is fine.
+const AF_UNIX_PATH_LIMIT: usize = 107;
+
+/// Root for the per-job dir in which ansible's persistent-connection plugins
+/// (`network_cli`, `httpapi`, `netconf`) bind their unix socket, named after a digest of the
+/// connection. `sockaddr_un.sun_path` caps the whole socket path at [`AF_UNIX_PATH_LIMIT`],
+/// which the job dir alone already exhausts, so the socket dir must stay short and cannot
+/// live under `ANSIBLE_HOME` (which Windmill pins into the job dir).
+///
+/// Fixed, and directly under `/tmp`, for two reasons that are easy to undo by accident:
+/// `/tmp`'s sticky bit is what stops another uid renaming our root away, the one property
+/// [`prepare_socket_root`] needs from a parent; and every component of a fixed path is one
+/// nobody can point elsewhere, so trusting the root does not mean trusting an ancestor
+/// chain. Notably NOT under `WINDMILL_DIR`: the shipped image chmods that tree to a
+/// non-sticky 0777 so any UID can write it (`Dockerfile`, "Make directories
+/// world-accessible for any UID"), which is exactly the parent an attacker can swap entries
+/// in.
+const PERSISTENT_CONTROL_PATH_ROOT: &str = "/tmp/wm-pc";
+
+/// Ansible's env var for `[persistent_connection] control_path_dir`.
+const ANSIBLE_CONTROL_PATH_DIR_ENV: &str = "ANSIBLE_PERSISTENT_CONTROL_PATH_DIR";
+
+/// The budget this whole change exists to protect: root + `/` + a 32-char job uuid + `/` +
+/// a socket name, allowing a full 40-char sha1 (ansible truncates it far shorter today, but
+/// a custom control path may not).
+const _: () = assert!(PERSISTENT_CONTROL_PATH_ROOT.len() + 1 + 32 + 1 + 40 <= AF_UNIX_PATH_LIMIT);
+
+/// Cleared when the root cannot be trusted (see [`prepare_socket_root`]), which makes jobs
+/// stop naming it and fall back to ansible's own `{ANSIBLE_HOME}/pc` default — inside the
+/// job dir, so worker-owned. Network playbooks then fail on the path length as they did
+/// before this dir existed, which beats handing an attacker the socket a device session
+/// runs over. Defaults to trusted: the check runs at worker start, before any job.
+static SOCKET_ROOT_TRUSTED: std::sync::atomic::AtomicBool =
+    std::sync::atomic::AtomicBool::new(true);
+
+/// Socket dir for `job_id`, or `None` when the root is untrusted. Per-job on purpose:
+/// socket names hash host+credentials, so concurrent jobs sharing a dir would reuse each
+/// other's connection daemon.
+fn persistent_control_path_dir(job_id: &Uuid) -> Option<String> {
+    SOCKET_ROOT_TRUSTED
+        .load(std::sync::atomic::Ordering::Relaxed)
+        .then(|| format!("{PERSISTENT_CONTROL_PATH_ROOT}/{}", job_id.simple()))
+}
+
+/// Whether `name` is one this module could have created, i.e. `Uuid::simple` (32 hex, no
+/// hyphens). Belt to the root check's braces: nothing else should ever be in there.
+fn is_persistent_control_path_dir_name(name: &str) -> bool {
+    name.len() == 32 && Uuid::try_parse(name).is_ok()
+}
+
+/// Removes the job's socket dir on the way out. It lives outside `job_dir`, so the
+/// worker's job-dir sweep does not cover it.
+struct PersistentControlPathGuard(String);
+
+impl Drop for PersistentControlPathGuard {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+/// Claim the socket-dir root at worker start, then reap dirs left behind by workers that
+/// died before their guard could run.
+#[cfg(unix)]
+pub async fn prepare_persistent_control_path_root() {
+    // A play holds its socket dir for as long as it runs, touching the mtime only when
+    // connections open, so anything younger than the longest permitted job may still be
+    // live — including on another worker sharing this host.
+    let stale_after = std::time::Duration::from_secs(
+        windmill_common::worker::MAX_TIMEOUT.saturating_add(24 * 60 * 60),
+    );
+    prepare_socket_root(PERSISTENT_CONTROL_PATH_ROOT, stale_after).await
+}
+
+/// Reject a root that another local user could control, and mark it untrusted so jobs stop
+/// naming it. Returns without sweeping in that case.
+///
+/// SECURITY: the root sits in a world-writable `/tmp`, so a local user who wins the race to
+/// create it owns the parent of every job's socket dir —
+/// enough to hand ansible a socket of their choosing (a device session, credentials and
+/// all, runs over it), or to swap in a symlink and redirect the sweep's path-based
+/// `remove_dir_all` onto a target of their choosing, as the worker's uid. Three things must
+/// hold: the root is a real directory (`symlink_metadata` reports the link's own type
+/// without following it, so `is_dir()` cannot be satisfied by a symlink), we own it and
+/// nobody else can write it, and its parent cannot be used to replace it — which needs the
+/// parent either not writable by others, or sticky, since the sticky bit is exactly what
+/// stops a non-owner renaming an entry out of a shared dir. The root is validated after the
+/// create attempt, never before: anything else races whoever creates it first.
+#[cfg(unix)]
+async fn prepare_socket_root(root: &str, stale_after: std::time::Duration) {
+    use std::os::unix::fs::{MetadataExt, PermissionsExt};
+
+    let untrusted = |reason: String| {
+        tracing::error!(
+            "Refusing to use the ansible persistent-connection socket root at {root}: {reason}. \
+             Ansible network playbooks on this host will keep failing with `AF_UNIX path too \
+             long` until this is resolved."
+        );
+        SOCKET_ROOT_TRUSTED.store(false, std::sync::atomic::Ordering::Relaxed);
+    };
+
+    if let Some(parent) = std::path::Path::new(root).parent() {
+        // Resolved, not `symlink_metadata`: what matters is the mode of the directory the
+        // entries actually live in, and a symlinked parent is normal (macOS `/tmp`).
+        match tokio::fs::metadata(parent).await {
+            Ok(meta) => {
+                let mode = meta.permissions().mode();
+                if mode & 0o022 != 0 && mode & 0o1000 == 0 {
+                    return untrusted(format!(
+                        "its parent {} is writable by other users and not sticky (mode={:o}), \
+                         so they could replace the root",
+                        parent.display(),
+                        mode & 0o7777
+                    ));
+                }
+            }
+            Err(e) => return untrusted(format!("cannot stat its parent: {e}")),
+        }
+    }
+
+    // Non-recursive on purpose: `recursive` reports success for a path that already
+    // exists, which under a sticky parent (where others may still *create* the
+    // not-yet-existing `pc`, only not rename ours away) would hand us whatever another uid
+    // raced into place. Create-or-EEXIST, then validate whatever is actually there.
+    match tokio::fs::DirBuilder::new().mode(0o700).create(root).await {
+        Ok(()) => {}
+        Err(e) if e.kind() == std::io::ErrorKind::AlreadyExists => {}
+        Err(e) => return untrusted(format!("it could not be created: {e}")),
+    }
+
+    match tokio::fs::symlink_metadata(root).await {
+        Ok(meta) if meta.is_dir() => {
+            let mode = meta.permissions().mode();
+            // Trusted means usable as well as safe: without owner rwx ansible cannot create
+            // its per-job dir, and a trusted-but-unusable root would hand every network
+            // playbook a permission error instead of the working fallback.
+            if meta.uid() != nix::unistd::Uid::effective().as_raw()
+                || mode & 0o022 != 0
+                || mode & 0o700 != 0o700
+            {
+                return untrusted(format!(
+                    "it is not owned by this worker, is writable by others, or is not \
+                     writable by us (uid={}, mode={:o})",
+                    meta.uid(),
+                    mode & 0o7777
+                ));
+            }
+        }
+        Ok(_) => {
+            return untrusted(
+                "it is not a directory (possibly a symlink planted by another local user)"
+                    .to_string(),
+            )
+        }
+        Err(e) => return untrusted(format!("it could not be stat'd: {e}")),
+    }
+
+    let Ok(mut entries) = tokio::fs::read_dir(root).await else {
+        return;
+    };
+    while let Ok(Some(entry)) = entries.next_entry().await {
+        // Only reap what we could have created. Nothing else should ever be in a root we
+        // made 0700 ourselves, but this is a recursive delete running as the worker's uid:
+        // cheap to bound by name, expensive to get wrong.
+        if !entry
+            .file_name()
+            .to_str()
+            .is_some_and(is_persistent_control_path_dir_name)
+        {
+            continue;
+        }
+        // `DirEntry::metadata` does not traverse symlinks, so a planted link is never
+        // followed here either.
+        let stale = match entry.metadata().await.and_then(|m| m.modified()) {
+            Ok(modified) => modified.elapsed().is_ok_and(|e| e > stale_after),
+            Err(_) => false,
+        };
+        if stale {
+            let _ = tokio::fs::remove_dir_all(entry.path()).await;
+        }
+    }
+}
+
 lazy_static::lazy_static! {
     static ref TEMPLATE_RE: regex::Regex = regex::Regex::new(r"\{\{\s*([A-Za-z_][A-Za-z0-9_]*)\s*\}\}").unwrap();
 }
@@ -903,6 +1087,7 @@ pub fn create_ansible_cfg(
     reqs: Option<&AnsibleRequirements>,
     job_dir: &str,
     vault_password_file_exists: bool,
+    job_id: &Uuid,
 ) -> error::Result<()> {
     let mut passwords_cfg = String::new();
     if vault_password_file_exists {
@@ -922,6 +1107,9 @@ pub fn create_ansible_cfg(
             passwords_cfg.push_str(&format!("vault_identity_list = {password_files}\n"));
         }
     }
+    let persistent_cfg = persistent_control_path_dir(job_id)
+        .map(|dir| format!("[persistent_connection]\ncontrol_path_dir = {dir}\n"))
+        .unwrap_or_default();
     let ansible_cfg_content = format!(
         r#"
 [defaults]
@@ -931,7 +1119,7 @@ home={job_dir}/.ansible
 local_tmp={job_dir}/.ansible/tmp
 remote_tmp={job_dir}/.ansible/tmp
 {passwords_cfg}
-"#
+{persistent_cfg}"#
     );
 
     write_file(job_dir, "ansible.cfg", &ansible_cfg_content)?;
@@ -939,6 +1127,15 @@ remote_tmp={job_dir}/.ansible/tmp
     Ok(())
 }
 
+/// The section a header line opens, if it is one. Mirrors configparser's `SECTCRE`
+/// (`\[(?P<header>.+)\]`, matched not fullmatched, `.+` greedy): the name runs to the
+/// *last* `]`, and anything after it — an inline comment, say — is ignored.
+fn parse_ansible_cfg_section_header(trimmed: &str) -> Option<&str> {
+    let rest = trimmed.strip_prefix('[')?;
+    let end = rest.rfind(']')?;
+    Some(rest[..end].trim())
+}
+
 /// Read a colon-separated path list (e.g. `roles_path`, `collections_path`) from
 /// the `[defaults]` section of an ansible.cfg. Returns the raw entries as written,
 /// unresolved. Deliberately minimal: no inline-comment or continuation handling,
@@ -949,10 +1146,8 @@ fn parse_ansible_cfg_path_list(content: &str, key: &str) -> Option<Vec<String>>
     let mut in_defaults = false;
     for line in content.lines() {
         let trimmed = line.trim();
-        if trimmed.starts_with('[') && trimmed.ends_with(']') {
-            in_defaults = trimmed[1..trimmed.len() - 1]
-                .trim()
-                .eq_ignore_ascii_case("defaults");
+        if let Some(section) = parse_ansible_cfg_section_header(trimmed) {
+            in_defaults = section.eq_ignore_ascii_case("defaults");
             continue;
         }
         if !in_defaults || trimmed.starts_with('#') || trimmed.starts_with(';') {
@@ -978,6 +1173,29 @@ fn parse_ansible_cfg_path_list(content: &str, key: &str) -> Option<Vec<String>>
     None
 }
 
+/// Whether `section` declares `key` in an ansible.cfg. Same deliberately minimal
+/// parsing as [`parse_ansible_cfg_path_list`], for a scalar key in a named section.
+fn ansible_cfg_declares(content: &str, section: &str, key: &str) -> bool {
+    let mut in_section = false;
+    for line in content.lines() {
+        let trimmed = line.trim();
+        if let Some(header) = parse_ansible_cfg_section_header(trimmed) {
+            in_section = header.eq_ignore_ascii_case(section);
+            continue;
+        }
+        if !in_section || trimmed.starts_with('#') || trimmed.starts_with(';') {
+            continue;
+        }
+        let sep = trimmed.find('=').into_iter().chain(trimmed.find(':')).min();
+        if let Some(sep) = sep {
+            if trimmed[..sep].trim().eq_ignore_ascii_case(key) {
+                return true;
+            }
+        }
+    }
+    false
+}
+
 /// Prepend Windmill's dependency install dir to the repo cfg's declared path list.
 /// Relative entries from the repo cfg are resolved against `cfg_dir` to match how
 /// ansible resolves them relative to the config file's own directory.
@@ -1006,6 +1224,8 @@ async fn build_ansible_cfg_override_envs(
     job_dir: &str,
     vault_password_file_exists: bool,
     reqs: Option<&AnsibleRequirements>,
+    job_id: &Uuid,
+    job_envs: &HashMap<String, String>,
 ) -> error::Result<Vec<(String, String)>> {
     let mut envs = vec![
         ("ANSIBLE_CONFIG".to_string(), cfg_path.to_string()),
@@ -1053,6 +1273,18 @@ async fn build_ansible_cfg_override_envs(
         ))
     })?;
 
+    // Persistent-connection socket dir: only a default. Unlike ANSIBLE_HOME this value is
+    // not runtime-bound, so a repo that picks its own dir keeps it — and so does a job that
+    // sets the env var itself, which these overrides are applied after and would otherwise
+    // silently outrank.
+    if !ansible_cfg_declares(&cfg_content, "persistent_connection", "control_path_dir")
+        && !job_envs.contains_key(ANSIBLE_CONTROL_PATH_DIR_ENV)
+    {
+        if let Some(dir) = persistent_control_path_dir(job_id) {
+            envs.push((ANSIBLE_CONTROL_PATH_DIR_ENV.to_string(), dir));
+        }
+    }
+
     envs.push((
         "ANSIBLE_ROLES_PATH".to_string(),
         resolve_and_prepend_path(
@@ -1606,7 +1838,8 @@ pub async fn handle_ansible_job(
         None => false,
     };
 
-    create_ansible_cfg(reqs.as_ref(), job_dir, vault_password_file_exists)?;
+    create_ansible_cfg(reqs.as_ref(), job_dir, vault_password_file_exists, &job.id)?;
+    let _control_path_guard = persistent_control_path_dir(&job.id).map(PersistentControlPathGuard);
 
     // When the run delegates to a git repo that ships its own ansible.cfg, that
     // file becomes the effective config (ansible loads exactly one config file and
@@ -1628,6 +1861,8 @@ pub async fn handle_ansible_job(
                 job_dir,
                 vault_password_file_exists,
                 reqs.as_ref(),
+                &job.id,
+                &envs,
             )
             .await?
         }
@@ -1941,6 +2176,10 @@ async fn get_resource_or_variable_content(
 mod tests {
     use super::*;
 
+    fn no_job_envs() -> HashMap<String, String> {
+        HashMap::new()
+    }
+
     fn args_from_json(v: serde_json::Value) -> HashMap<String, Box<RawValue>> {
         let serde_json::Value::Object(map) = v else {
             panic!("expected object");
@@ -2027,12 +2266,40 @@ mod tests {
             vault_id: vec!["dev@vault_pass.txt".to_string()],
             ..Default::default()
         };
-        create_ansible_cfg(Some(&reqs), job_dir, false).unwrap();
+        create_ansible_cfg(Some(&reqs), job_dir, false, &Uuid::new_v4()).unwrap();
         let cfg = std::fs::read_to_string(dir.path().join("ansible.cfg")).unwrap();
         assert!(cfg.contains("vault_identity_list = dev@vault_pass.txt"));
         assert!(!cfg.contains("library"));
     }
 
+    /// The socket ansible binds under `control_path_dir` must fit `sun_path` (107
+    /// usable bytes), which the job dir alone blows past — hence a short dir outside
+    /// `ANSIBLE_HOME`.
+    #[test]
+    fn test_create_ansible_cfg_control_path_dir_fits_af_unix_limit() {
+        let dir = tempfile::tempdir().unwrap();
+        let job_dir = dir.path().to_str().unwrap();
+        let job_id = Uuid::new_v4();
+        let flag = TrustFlag::lock();
+        flag.set(true);
+        create_ansible_cfg(None, job_dir, false, &job_id).unwrap();
+
+        let cfg = std::fs::read_to_string(dir.path().join("ansible.cfg")).unwrap();
+        let control_path_dir = persistent_control_path_dir(&job_id).unwrap();
+        assert!(cfg.contains("[persistent_connection]"));
+        assert!(cfg.contains(&format!("control_path_dir = {control_path_dir}")));
+        // The whole point: the socket dir must escape the job dir, whose length is what
+        // blows the budget.
+        assert!(!control_path_dir.starts_with(job_dir));
+
+        // dir + `/` + socket name, budgeted at a full 40-char sha1 (ansible truncates
+        // it far shorter today, but a custom control path may not).
+        assert!(
+            control_path_dir.len() + 1 + 40 <= AF_UNIX_PATH_LIMIT,
+            "socket path would exceed sun_path: {control_path_dir}"
+        );
+    }
+
     #[test]
     fn test_create_ansible_cfg_rejects_vault_id_injection() {
         let dir = tempfile::tempdir().unwrap();
@@ -2042,7 +2309,7 @@ mod tests {
             ..Default::default()
         };
         // Defense-in-depth boundary: a poisoned entry must error before any config is written.
-        assert!(create_ansible_cfg(Some(&reqs), job_dir, false).is_err());
+        assert!(create_ansible_cfg(Some(&reqs), job_dir, false, &Uuid::new_v4()).is_err());
         assert!(!dir.path().join("ansible.cfg").exists());
     }
 
@@ -2161,7 +2428,7 @@ collections_path : a/col:b/col
         std::fs::write(repo.join("play.yml"), play).unwrap();
 
         // Windmill's own generated cfg (the negative-control config that exists today).
-        create_ansible_cfg(None, job_dir, false).unwrap();
+        create_ansible_cfg(None, job_dir, false, &Uuid::new_v4()).unwrap();
 
         let playbook = format!("{DELEGATE_GIT_REPO_TARGET}/play.yml");
         let run = |envs: Vec<(String, String)>| {
@@ -2185,10 +2452,16 @@ collections_path : a/col:b/col
 
         // With the override: ANSIBLE_CONFIG points at the repo cfg and roles_path
         // is honored, so the role runs.
-        let envs =
-            build_ansible_cfg_override_envs(cfg_path.to_str().unwrap(), job_dir, false, None)
-                .await
-                .unwrap();
+        let envs = build_ansible_cfg_override_envs(
+            cfg_path.to_str().unwrap(),
+            job_dir,
+            false,
+            None,
+            &Uuid::new_v4(),
+            &no_job_envs(),
+        )
+        .await
+        .unwrap();
         let after = run(envs);
         let stdout = String::from_utf8_lossy(&after.stdout);
         assert!(
@@ -2213,15 +2486,30 @@ collections_path : a/col:b/col
             vault_id: vec!["dev@vault_pass.txt".to_string()],
             ..Default::default()
         };
-        let envs = build_ansible_cfg_override_envs(cfg_path, job_dir, true, Some(&reqs))
-            .await
-            .unwrap();
+        let job_id = Uuid::new_v4();
+        let flag = TrustFlag::lock();
+        flag.set(true);
+        let envs = build_ansible_cfg_override_envs(
+            cfg_path,
+            job_dir,
+            true,
+            Some(&reqs),
+            &job_id,
+            &no_job_envs(),
+        )
+        .await
+        .unwrap();
         let map: std::collections::HashMap<_, _> = envs.into_iter().collect();
 
         assert_eq!(
             map.get("ANSIBLE_CONFIG").map(|s| s.as_str()),
             Some(cfg_path)
         );
+        // The repo cfg declares no control_path_dir, so Windmill's short default applies.
+        assert_eq!(
+            map.get("ANSIBLE_PERSISTENT_CONTROL_PATH_DIR"),
+            persistent_control_path_dir(&job_id).as_ref()
+        );
         assert_eq!(
             map.get("ANSIBLE_HOME"),
             Some(&format!("{job_dir}/.ansible"))
@@ -2261,14 +2549,423 @@ collections_path : a/col:b/col
         // are not silently dropped when the env override replaces the cfg value.
         std::fs::write(&cfg_path, "[defaults]\ncollections_paths = my_cols\n").unwrap();
 
-        let envs =
-            build_ansible_cfg_override_envs(cfg_path.to_str().unwrap(), job_dir, false, None)
-                .await
-                .unwrap();
+        let envs = build_ansible_cfg_override_envs(
+            cfg_path.to_str().unwrap(),
+            job_dir,
+            false,
+            None,
+            &Uuid::new_v4(),
+            &no_job_envs(),
+        )
+        .await
+        .unwrap();
         let map: std::collections::HashMap<_, _> = envs.into_iter().collect();
         assert_eq!(
             map.get("ANSIBLE_COLLECTIONS_PATH"),
             Some(&format!("{job_dir}:{}/my_cols", repo_dir.to_str().unwrap()))
         );
     }
+
+    /// These overrides are applied after the job's own env, so a default that ignores what
+    /// the job set would silently outrank it. Not runtime-bound, so the job wins.
+    #[tokio::test]
+    async fn test_build_ansible_cfg_override_envs_keeps_job_env_control_path_dir() {
+        let dir = tempfile::tempdir().unwrap();
+        let job_dir = dir.path().to_str().unwrap();
+        let repo_dir = dir.path().join(DELEGATE_GIT_REPO_TARGET);
+        std::fs::create_dir_all(&repo_dir).unwrap();
+        let cfg_path = repo_dir.join("ansible.cfg");
+        // Cfg is silent on control_path_dir; the job env is not.
+        std::fs::write(&cfg_path, "[defaults]\nroles_path = my_roles\n").unwrap();
+
+        let job_envs = HashMap::from([(
+            ANSIBLE_CONTROL_PATH_DIR_ENV.to_string(),
+            "/tmp/job-picked".to_string(),
+        )]);
+
+        let flag = TrustFlag::lock();
+        flag.set(true);
+        let envs = build_ansible_cfg_override_envs(
+            cfg_path.to_str().unwrap(),
+            job_dir,
+            false,
+            None,
+            &Uuid::new_v4(),
+            &job_envs,
+        )
+        .await
+        .unwrap();
+
+        assert!(
+            !envs.iter().any(|(k, _)| k == ANSIBLE_CONTROL_PATH_DIR_ENV),
+            "must not override a control_path_dir the job set itself"
+        );
+    }
+
+    #[tokio::test]
+    async fn test_build_ansible_cfg_override_envs_keeps_user_control_path_dir() {
+        let dir = tempfile::tempdir().unwrap();
+        let job_dir = dir.path().to_str().unwrap();
+        let repo_dir = dir.path().join(DELEGATE_GIT_REPO_TARGET);
+        std::fs::create_dir_all(&repo_dir).unwrap();
+        let cfg_path = repo_dir.join("ansible.cfg");
+        std::fs::write(
+            &cfg_path,
+            "[defaults]\nroles_path = my_roles\n\n[persistent_connection]\ncontrol_path_dir = /tmp/my_pc\n",
+        )
+        .unwrap();
+
+        let envs = build_ansible_cfg_override_envs(
+            cfg_path.to_str().unwrap(),
+            job_dir,
+            false,
+            None,
+            &Uuid::new_v4(),
+            &no_job_envs(),
+        )
+        .await
+        .unwrap();
+        let map: std::collections::HashMap<_, _> = envs.into_iter().collect();
+        assert_eq!(map.get("ANSIBLE_PERSISTENT_CONTROL_PATH_DIR"), None);
+    }
+
+    /// `SOCKET_ROOT_TRUSTED` is process-global and cargo runs tests in parallel: hold this
+    /// while reading or flipping it, and the default is restored on the way out.
+    struct TrustFlag(#[allow(dead_code)] std::sync::MutexGuard<'static, ()>);
+
+    impl TrustFlag {
+        fn lock() -> Self {
+            static LOCK: std::sync::Mutex<()> = std::sync::Mutex::new(());
+            Self(LOCK.lock().unwrap_or_else(|e| e.into_inner()))
+        }
+        fn set(&self, trusted: bool) {
+            SOCKET_ROOT_TRUSTED.store(trusted, std::sync::atomic::Ordering::Relaxed);
+        }
+        fn get(&self) -> bool {
+            SOCKET_ROOT_TRUSTED.load(std::sync::atomic::Ordering::Relaxed)
+        }
+    }
+
+    impl Drop for TrustFlag {
+        fn drop(&mut self) {
+            SOCKET_ROOT_TRUSTED.store(true, std::sync::atomic::Ordering::Relaxed);
+        }
+    }
+
+    #[cfg(unix)]
+    fn backdate(path: &std::path::Path, age: std::time::Duration) {
+        let times = std::fs::FileTimes::new().set_modified(std::time::SystemTime::now() - age);
+        std::fs::File::open(path).unwrap().set_times(times).unwrap();
+    }
+
+    /// The sweep only reaps what no live job can own: a play may hold its socket dir for
+    /// the whole of MAX_TIMEOUT without touching the mtime again. And it only ever touches
+    /// names it could have created itself.
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn test_prepare_socket_root_sweeps_only_stale_dirs() {
+        let dir = tempfile::tempdir().unwrap();
+        let root = dir.path().join("wm-pc");
+        std::fs::create_dir(&root).unwrap();
+
+        let stale = root.join(Uuid::new_v4().simple().to_string());
+        let live = root.join(Uuid::new_v4().simple().to_string());
+        let foreign = root.join("someone-elses-data");
+        for p in [&stale, &live, &foreign] {
+            std::fs::create_dir(p).unwrap();
+        }
+        backdate(&stale, std::time::Duration::from_secs(48 * 60 * 60));
+        backdate(&live, std::time::Duration::from_secs(12 * 60 * 60));
+        backdate(&foreign, std::time::Duration::from_secs(48 * 60 * 60));
+
+        let _flag = TrustFlag::lock();
+        prepare_socket_root(
+            root.to_str().unwrap(),
+            std::time::Duration::from_secs(24 * 60 * 60),
+        )
+        .await;
+
+        assert!(!stale.exists(), "dir older than the cutoff must be reaped");
+        assert!(live.exists(), "a dir a live job may still own must be kept");
+        assert!(
+            foreign.exists(),
+            "a stale dir we never created must be left alone"
+        );
+    }
+
+    #[test]
+    fn test_is_persistent_control_path_dir_name() {
+        assert!(is_persistent_control_path_dir_name(
+            &Uuid::new_v4().simple().to_string()
+        ));
+        // Hyphenated form is not what we create, so it is not ours to delete.
+        assert!(!is_persistent_control_path_dir_name(
+            &Uuid::new_v4().to_string()
+        ));
+        assert!(!is_persistent_control_path_dir_name("someone-elses-data"));
+        assert!(!is_persistent_control_path_dir_name(""));
+    }
+
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn test_prepare_socket_root_creates_root_private() {
+        use std::os::unix::fs::PermissionsExt;
+
+        let dir = tempfile::tempdir().unwrap();
+        let root = dir.path().join("wm-pc");
+        let flag = TrustFlag::lock();
+        flag.set(true);
+        prepare_socket_root(root.to_str().unwrap(), std::time::Duration::from_secs(1)).await;
+
+        let meta = std::fs::metadata(&root).unwrap();
+        assert!(meta.is_dir());
+        // Owning the root 0700 is what stops another local user replacing it later.
+        assert_eq!(meta.permissions().mode() & 0o777, 0o700);
+        assert!(flag.get(), "a root we created ourselves is trusted");
+    }
+
+    /// The root must be validated *after* the create attempt, not before: under a sticky
+    /// parent another uid may still win the race to create the not-yet-existing `pc`
+    /// (sticky stops them renaming ours away, not creating it first), and a create that
+    /// tolerates `AlreadyExists` would otherwise hand us their directory unchecked.
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn test_prepare_socket_root_validates_raced_creation() {
+        use std::os::unix::fs::PermissionsExt;
+
+        let dir = tempfile::tempdir().unwrap();
+        let parent = dir.path().join("windmill");
+        std::fs::create_dir(&parent).unwrap();
+        std::fs::set_permissions(&parent, std::fs::Permissions::from_mode(0o1777)).unwrap();
+
+        // Stand in for the racer's dir: present before we look, and not exclusively ours.
+        let root = parent.join("pc");
+        std::fs::create_dir(&root).unwrap();
+        std::fs::set_permissions(&root, std::fs::Permissions::from_mode(0o777)).unwrap();
+
+        let flag = TrustFlag::lock();
+        flag.set(true);
+        prepare_socket_root(root.to_str().unwrap(), std::time::Duration::from_secs(1)).await;
+
+        assert!(
+            !flag.get(),
+            "a root raced into place under a sticky parent must not be trusted"
+        );
+    }
+
+    /// Safe but unusable is still not trusted: ansible cannot create its per-job dir under
+    /// a root we cannot write, and naming it anyway would swap the working fallback for a
+    /// permission error on every network playbook.
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn test_prepare_socket_root_refuses_unwritable_root() {
+        use std::os::unix::fs::PermissionsExt;
+
+        let dir = tempfile::tempdir().unwrap();
+        let root = dir.path().join("wm-pc");
+        std::fs::create_dir(&root).unwrap();
+        std::fs::set_permissions(&root, std::fs::Permissions::from_mode(0o500)).unwrap();
+
+        let flag = TrustFlag::lock();
+        flag.set(true);
+        prepare_socket_root(root.to_str().unwrap(), std::time::Duration::from_secs(1)).await;
+
+        assert!(!flag.get(), "a root we cannot write must not be trusted");
+        // Let the tempdir clean itself up.
+        std::fs::set_permissions(&root, std::fs::Permissions::from_mode(0o700)).unwrap();
+    }
+
+    /// A root we do not exclusively own may have been pre-planted by another local user,
+    /// who then controls the parent of every job's socket dir — and could swap a symlink
+    /// in after this check, redirecting the sweep's path-based `remove_dir_all`.
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn test_prepare_socket_root_refuses_world_writable_root() {
+        use std::os::unix::fs::PermissionsExt;
+
+        let dir = tempfile::tempdir().unwrap();
+        let root = dir.path().join("wm-pc");
+        std::fs::create_dir(&root).unwrap();
+        std::fs::set_permissions(&root, std::fs::Permissions::from_mode(0o777)).unwrap();
+
+        // UUID-named, so survival proves the trust check stopped the sweep rather than the
+        // name filter.
+        let stale = root.join(Uuid::new_v4().simple().to_string());
+        std::fs::create_dir(&stale).unwrap();
+        backdate(&stale, std::time::Duration::from_secs(48 * 60 * 60));
+
+        let _flag = TrustFlag::lock();
+        prepare_socket_root(
+            root.to_str().unwrap(),
+            std::time::Duration::from_secs(24 * 60 * 60),
+        )
+        .await;
+
+        assert!(
+            stale.exists(),
+            "must not sweep a root that others can write to"
+        );
+    }
+
+    /// The root must hang off `/tmp`, whose sticky bit is what protects it. The trap this
+    /// guards: the shipped image chmods the whole `WINDMILL_DIR` tree to a non-sticky 0777
+    /// so any UID can write it, so parenting the root there would make it untrusted and
+    /// silently disable this fix in the standard image while every local test still passed.
+    #[test]
+    fn test_control_path_root_hangs_off_tmp() {
+        assert_eq!(
+            std::path::Path::new(PERSISTENT_CONTROL_PATH_ROOT).parent(),
+            Some(std::path::Path::new("/tmp"))
+        );
+    }
+
+    /// A parent that others can write (and that is not sticky) lets them rename the root
+    /// away and drop a symlink in its place after the checks — so the root cannot be
+    /// trusted no matter how it currently looks.
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn test_prepare_socket_root_refuses_writable_parent() {
+        use std::os::unix::fs::PermissionsExt;
+
+        let dir = tempfile::tempdir().unwrap();
+        let parent = dir.path().join("windmill");
+        let root = parent.join("pc");
+        std::fs::create_dir_all(&root).unwrap();
+        // UUID-named, so survival proves the trust check stopped the sweep rather than the
+        // name filter.
+        let stale = root.join(Uuid::new_v4().simple().to_string());
+        std::fs::create_dir(&stale).unwrap();
+        backdate(&stale, std::time::Duration::from_secs(48 * 60 * 60));
+        std::fs::set_permissions(&parent, std::fs::Permissions::from_mode(0o777)).unwrap();
+
+        let flag = TrustFlag::lock();
+        flag.set(true);
+        prepare_socket_root(
+            root.to_str().unwrap(),
+            std::time::Duration::from_secs(24 * 60 * 60),
+        )
+        .await;
+
+        assert!(stale.exists(), "must not sweep under a replaceable parent");
+        assert!(
+            !flag.get(),
+            "an untrusted root must be marked so jobs stop naming it"
+        );
+    }
+
+    /// A sticky parent (like /tmp itself) is fine: the sticky bit is what stops a
+    /// non-owner renaming our root out of it.
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn test_prepare_socket_root_accepts_sticky_world_writable_parent() {
+        use std::os::unix::fs::PermissionsExt;
+
+        let dir = tempfile::tempdir().unwrap();
+        let parent = dir.path().join("windmill");
+        let root = parent.join("pc");
+        std::fs::create_dir_all(&parent).unwrap();
+        std::fs::set_permissions(&parent, std::fs::Permissions::from_mode(0o1777)).unwrap();
+
+        let flag = TrustFlag::lock();
+        flag.set(true);
+        prepare_socket_root(
+            root.to_str().unwrap(),
+            std::time::Duration::from_secs(24 * 60 * 60),
+        )
+        .await;
+
+        assert!(root.is_dir(), "root must be created under a sticky parent");
+        assert!(flag.get());
+    }
+
+    /// Fail closed: when the root is untrusted the cfg must not name it, so ansible falls
+    /// back to its own `{ANSIBLE_HOME}/pc` default inside the worker-owned job dir.
+    #[test]
+    fn test_create_ansible_cfg_omits_untrusted_control_path_dir() {
+        let dir = tempfile::tempdir().unwrap();
+        let job_dir = dir.path().to_str().unwrap();
+
+        let flag = TrustFlag::lock();
+        flag.set(false);
+        create_ansible_cfg(None, job_dir, false, &Uuid::new_v4()).unwrap();
+
+        let cfg = std::fs::read_to_string(dir.path().join("ansible.cfg")).unwrap();
+        assert!(!cfg.contains("control_path_dir"));
+        assert!(!cfg.contains("[persistent_connection]"));
+    }
+
+    /// A symlinked root must never be swept: `remove_dir_all` through it would delete
+    /// whatever the link points at, as the worker's uid.
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn test_prepare_socket_root_refuses_symlinked_root() {
+        let dir = tempfile::tempdir().unwrap();
+        let victim = dir.path().join("victim");
+        // UUID-named, so survival proves the symlink was not followed rather than the name
+        // filter sparing it.
+        let victim_child = victim.join(Uuid::new_v4().simple().to_string());
+        std::fs::create_dir_all(&victim_child).unwrap();
+        backdate(&victim_child, std::time::Duration::from_secs(48 * 60 * 60));
+
+        let root = dir.path().join("wm-pc");
+        std::os::unix::fs::symlink(&victim, &root).unwrap();
+
+        let _flag = TrustFlag::lock();
+        prepare_socket_root(
+            root.to_str().unwrap(),
+            std::time::Duration::from_secs(24 * 60 * 60),
+        )
+        .await;
+
+        assert!(
+            victim_child.exists(),
+            "sweep must not follow a symlinked root"
+        );
+    }
+
+    /// configparser matches `\[(?P<header>.+)\]` without anchoring the end of the line, so
+    /// a header with anything trailing it is still that section — and missing it here
+    /// would silently override the user's own control_path_dir.
+    #[test]
+    fn test_ansible_cfg_section_header_with_trailing_text() {
+        assert_eq!(
+            parse_ansible_cfg_section_header("[persistent_connection] ; note"),
+            Some("persistent_connection")
+        );
+        assert_eq!(parse_ansible_cfg_section_header("not a header"), None);
+        // Greedy `.+` runs to the last `]`.
+        assert_eq!(parse_ansible_cfg_section_header("[a]b]"), Some("a]b"));
+
+        assert!(ansible_cfg_declares(
+            "[persistent_connection] ; note\ncontrol_path_dir = /tmp/mine\n",
+            "persistent_connection",
+            "control_path_dir"
+        ));
+        assert_eq!(
+            parse_ansible_cfg_path_list("[defaults] # note\nroles_path = my_roles\n", "roles_path"),
+            Some(vec!["my_roles".to_string()])
+        );
+    }
+
+    #[test]
+    fn test_ansible_cfg_declares_scoped_to_section() {
+        let cfg = "\
+[defaults]
+control_path_dir = /wrong/section
+
+[persistent_connection]
+# control_path_dir = /commented
+connect_timeout = 30
+";
+        assert!(!ansible_cfg_declares(
+            cfg,
+            "persistent_connection",
+            "control_path_dir"
+        ));
+        assert!(ansible_cfg_declares(
+            cfg,
+            "persistent_connection",
+            "connect_timeout"
+        ));
+    }
 }
diff --git a/backend/windmill-worker/src/worker.rs b/backend/windmill-worker/src/worker.rs
index 69642cd4ea..2a4541b095 100644
--- a/backend/windmill-worker/src/worker.rs
+++ b/backend/windmill-worker/src/worker.rs
@@ -2006,6 +2006,9 @@ pub async fn run_worker(
 
     create_directory_async(&worker_dir).await;
 
+    #[cfg(all(feature = "python", unix))]
+    crate::ansible_executor::prepare_persistent_control_path_root().await;
+
     if is_sandboxing_enabled() {
         let _ = write_file(
             &worker_dir,
diff --git a/backend/windmill-worker/src/worker_lockfiles.rs b/backend/windmill-worker/src/worker_lockfiles.rs
index d98a2cd2e0..5c695ac64f 100644
--- a/backend/windmill-worker/src/worker_lockfiles.rs
+++ b/backend/windmill-worker/src/worker_lockfiles.rs
@@ -2468,7 +2468,7 @@ async fn ansible_dep(
 
     let ansible_lockfile;
 
-    create_ansible_cfg(Some(&reqs), job_dir, false)?;
+    create_ansible_cfg(Some(&reqs), job_dir, false, job_id)?;
 
     if let Some(collections) = reqs.roles_and_collections.as_ref() {
         install_galaxy_collections(

From 97f44770698eb3dd9e296012360b7d9a4492e28d Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 17 Jul 2026 15:13:36 +0200
Subject: [PATCH 030/171] feat(forks): let a fork's creator manage developers
 on it without being an admin (#10166)

* feat(forks): let a fork's creator manage developers on it without being an admin

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(forks): bind the fork-creator grant to the member's parent username and lock the delete

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 ...5702eba0b0d674b99f952af94487b3e54211c.json |  23 ++
 ...3021ae3e99a5a61ea1c944c1df1368746dfa5.json |  76 ++++++
 ...c5aed4273f9f3977144d7c564be07504af9af.json |  23 ++
 ...e3f746cc8f1909f94a15bd8cde33ce974caa7.json |  29 +++
 .../tests/fixtures/fork_member_grant.sql      |  33 +++
 .../tests/fork_member_grant.rs                | 187 ++++++++++++++
 backend/windmill-api-users/src/users.rs       |  53 +++-
 .../windmill-api-workspaces/src/workspaces.rs |  83 +++++-
 backend/windmill-api/openapi.yaml             |   4 +-
 backend/windmill-common/src/workspaces.rs     |  29 +++
 .../settings/ForkMemberSettings.svelte        | 239 ++++++++++++++++++
 frontend/src/lib/stores.ts                    |   1 +
 .../(logged)/workspace_settings/+page.svelte  |  68 ++++-
 13 files changed, 828 insertions(+), 20 deletions(-)
 create mode 100644 backend/.sqlx/query-67d86d334029276d78bf8fa14b25702eba0b0d674b99f952af94487b3e54211c.json
 create mode 100644 backend/.sqlx/query-88a134e4ca82d5ce0334977c7713021ae3e99a5a61ea1c944c1df1368746dfa5.json
 create mode 100644 backend/.sqlx/query-931b2a18250879b0bbd0bec2c88c5aed4273f9f3977144d7c564be07504af9af.json
 create mode 100644 backend/.sqlx/query-be927c5174436cb9574bacc7cb4e3f746cc8f1909f94a15bd8cde33ce974caa7.json
 create mode 100644 backend/windmill-api-integration-tests/tests/fixtures/fork_member_grant.sql
 create mode 100644 backend/windmill-api-integration-tests/tests/fork_member_grant.rs
 create mode 100644 frontend/src/lib/components/settings/ForkMemberSettings.svelte

diff --git a/backend/.sqlx/query-67d86d334029276d78bf8fa14b25702eba0b0d674b99f952af94487b3e54211c.json b/backend/.sqlx/query-67d86d334029276d78bf8fa14b25702eba0b0d674b99f952af94487b3e54211c.json
new file mode 100644
index 0000000000..9a3cbd6703
--- /dev/null
+++ b/backend/.sqlx/query-67d86d334029276d78bf8fa14b25702eba0b0d674b99f952af94487b3e54211c.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT username FROM usr\n         WHERE workspace_id = $1 AND email = $2 AND NOT operator AND NOT disabled",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "username",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "67d86d334029276d78bf8fa14b25702eba0b0d674b99f952af94487b3e54211c"
+}
diff --git a/backend/.sqlx/query-88a134e4ca82d5ce0334977c7713021ae3e99a5a61ea1c944c1df1368746dfa5.json b/backend/.sqlx/query-88a134e4ca82d5ce0334977c7713021ae3e99a5a61ea1c944c1df1368746dfa5.json
new file mode 100644
index 0000000000..7cfe9aa070
--- /dev/null
+++ b/backend/.sqlx/query-88a134e4ca82d5ce0334977c7713021ae3e99a5a61ea1c944c1df1368746dfa5.json
@@ -0,0 +1,76 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT workspace.id, workspace.name, usr.username, workspace_settings.color, workspace.parent_workspace_id,\n                workspace.is_dev_workspace, workspace.dev_workspace_label,\n                workspace.owner AS \"created_by?\",\n                CASE WHEN usr.operator THEN workspace_settings.operator_settings ELSE NULL END as operator_settings,\n                usr.disabled\n         FROM workspace\n         JOIN usr ON usr.workspace_id = workspace.id\n         JOIN workspace_settings ON workspace_settings.workspace_id = workspace.id\n         WHERE usr.email = $1 AND workspace.deleted = false",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "name",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "username",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 3,
+        "name": "color",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 4,
+        "name": "parent_workspace_id",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 5,
+        "name": "is_dev_workspace",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 6,
+        "name": "dev_workspace_label",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 7,
+        "name": "created_by?",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 8,
+        "name": "operator_settings",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 9,
+        "name": "disabled",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      false,
+      true,
+      true,
+      false,
+      true,
+      false,
+      null,
+      false
+    ]
+  },
+  "hash": "88a134e4ca82d5ce0334977c7713021ae3e99a5a61ea1c944c1df1368746dfa5"
+}
diff --git a/backend/.sqlx/query-931b2a18250879b0bbd0bec2c88c5aed4273f9f3977144d7c564be07504af9af.json b/backend/.sqlx/query-931b2a18250879b0bbd0bec2c88c5aed4273f9f3977144d7c564be07504af9af.json
new file mode 100644
index 0000000000..10de699b74
--- /dev/null
+++ b/backend/.sqlx/query-931b2a18250879b0bbd0bec2c88c5aed4273f9f3977144d7c564be07504af9af.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT parent_workspace_id FROM workspace\n         WHERE id = $1 AND owner = $2 AND parent_workspace_id IS NOT NULL AND NOT deleted",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "parent_workspace_id",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      true
+    ]
+  },
+  "hash": "931b2a18250879b0bbd0bec2c88c5aed4273f9f3977144d7c564be07504af9af"
+}
diff --git a/backend/.sqlx/query-be927c5174436cb9574bacc7cb4e3f746cc8f1909f94a15bd8cde33ce974caa7.json b/backend/.sqlx/query-be927c5174436cb9574bacc7cb4e3f746cc8f1909f94a15bd8cde33ce974caa7.json
new file mode 100644
index 0000000000..cde9284501
--- /dev/null
+++ b/backend/.sqlx/query-be927c5174436cb9574bacc7cb4e3f746cc8f1909f94a15bd8cde33ce974caa7.json
@@ -0,0 +1,29 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT email, is_admin FROM usr where username = $1 AND workspace_id = $2 FOR UPDATE",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "email",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "is_admin",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      false
+    ]
+  },
+  "hash": "be927c5174436cb9574bacc7cb4e3f746cc8f1909f94a15bd8cde33ce974caa7"
+}
diff --git a/backend/windmill-api-integration-tests/tests/fixtures/fork_member_grant.sql b/backend/windmill-api-integration-tests/tests/fixtures/fork_member_grant.sql
new file mode 100644
index 0000000000..bd1fd11788
--- /dev/null
+++ b/backend/windmill-api-integration-tests/tests/fixtures/fork_member_grant.sql
@@ -0,0 +1,33 @@
+-- `test2` (a non-admin developer of test-workspace) has forked it. The fork's `usr` row copies the
+-- non-admin role they hold in the parent, which is the situation the fork-creator grant exists for.
+INSERT INTO workspace (id, name, owner, parent_workspace_id) VALUES
+	('wm-fork-test', 'fork of test-workspace', 'test2@windmill.dev', 'test-workspace');
+
+INSERT INTO workspace_settings (workspace_id) VALUES ('wm-fork-test');
+
+INSERT INTO workspace_key (workspace_id, kind, key) VALUES ('wm-fork-test', 'cloud', 'test-key');
+
+INSERT INTO group_ (workspace_id, name, summary, extra_perms) VALUES
+	('wm-fork-test', 'all', 'All users', '{}');
+
+INSERT INTO usr (workspace_id, email, username, is_admin, role) VALUES
+	('wm-fork-test', 'test2@windmill.dev', 'test-user-2', false, 'User'),
+	-- An admin of the fork, whom its creator must not be able to remove.
+	('wm-fork-test', 'test@windmill.dev', 'test-user', true, 'Admin');
+
+-- An operator of the parent: the eligibility bar for being added to the fork is developer-or-above
+-- there, so this user must be rejected.
+INSERT INTO password (email, password_hash, login_type, super_admin, verified, name, username)
+	VALUES ('test4@windmill.dev', 'not-a-real-hash', 'password', false, true, 'Test User 4', 'test-user-4');
+
+INSERT INTO usr (workspace_id, email, username, is_admin, operator, role) VALUES
+	('test-workspace', 'test4@windmill.dev', 'test-user-4', false, true, 'Operator');
+
+-- add_user resolves the instance-wide username from `password`.
+UPDATE password SET username = 'test-user-2' WHERE email = 'test2@windmill.dev';
+UPDATE password SET username = 'test-user-3' WHERE email = 'test3@windmill.dev';
+
+-- With automated username creation off, `add_user` takes the username from the caller. That branch
+-- is what the fork creator must not be able to steer, so the tests run against it.
+INSERT INTO global_settings (name, value) VALUES ('automate_username_creation', 'false'::jsonb)
+	ON CONFLICT (name) DO UPDATE SET value = EXCLUDED.value;
diff --git a/backend/windmill-api-integration-tests/tests/fork_member_grant.rs b/backend/windmill-api-integration-tests/tests/fork_member_grant.rs
new file mode 100644
index 0000000000..8789391854
--- /dev/null
+++ b/backend/windmill-api-integration-tests/tests/fork_member_grant.rs
@@ -0,0 +1,187 @@
+use serde_json::json;
+use sqlx::{Pool, Postgres};
+
+use windmill_test_utils::*;
+
+fn client() -> reqwest::Client {
+    reqwest::Client::new()
+}
+
+/// `test2` created the fork `wm-fork-test` but is only a developer in it.
+const FORK_OWNER_TOKEN: &str = "SECRET_TOKEN_2";
+/// `test3` is a developer of the parent and of the fork, but created neither.
+const FORK_MEMBER_TOKEN: &str = "SECRET_TOKEN_3";
+
+fn as_user(builder: reqwest::RequestBuilder, token: &str) -> reqwest::RequestBuilder {
+    builder.header("Authorization", format!("Bearer {token}"))
+}
+
+async fn add_user(
+    port: u16,
+    w_id: &str,
+    token: &str,
+    body: serde_json::Value,
+) -> reqwest::Response {
+    as_user(
+        client().post(format!(
+            "http://localhost:{port}/api/w/{w_id}/workspaces/add_user"
+        )),
+        token,
+    )
+    .json(&body)
+    .send()
+    .await
+    .unwrap()
+}
+
+fn developer(email: &str) -> serde_json::Value {
+    json!({ "email": email, "is_admin": false, "operator": false })
+}
+
+/// The creator of a fork may manage developers on it without being an admin of it, and may do
+/// nothing beyond that. A fork clones its parent wholesale (secrets included), so each of these
+/// bounds is what keeps the grant from becoming a way for any developer to widen access to the
+/// parent's data or to mint an admin.
+#[sqlx::test(migrations = "../migrations", fixtures("base", "fork_member_grant"))]
+async fn test_fork_creator_can_only_manage_developers_on_their_fork(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    // Seating an eligible member on someone else's username is what would hand them that user's
+    // cloned private assets. `test-user-4` is the target that matters: a fork clones the parent's
+    // `u/test-user-4/` scripts, variables and secrets but not their membership, so the username is
+    // free of the unique constraint on `usr` and the squat would otherwise land.
+    let resp = add_user(
+        port,
+        "wm-fork-test",
+        FORK_OWNER_TOKEN,
+        json!({ "email": "test3@windmill.dev", "username": "test-user-4", "is_admin": false, "operator": false }),
+    )
+    .await;
+    assert_eq!(
+        resp.status(),
+        403,
+        "fork creator cannot choose the username a member joins under"
+    );
+
+    // The creator adds a developer of the parent as a developer of their fork.
+    let resp = add_user(
+        port,
+        "wm-fork-test",
+        FORK_OWNER_TOKEN,
+        developer("test3@windmill.dev"),
+    )
+    .await;
+    assert_eq!(resp.status(), 201, "fork creator can add a developer");
+
+    // They join under the username they hold in the parent, which is the `u/` namespace the fork
+    // cloned for them.
+    let username: String = sqlx::query_scalar(
+        "SELECT username FROM usr WHERE workspace_id = 'wm-fork-test' AND email = 'test3@windmill.dev'",
+    )
+    .fetch_one(&db)
+    .await?;
+    assert_eq!(
+        username, "test-user-3",
+        "added member keeps their parent username"
+    );
+
+    // ... but never as an admin.
+    let resp = add_user(
+        port,
+        "wm-fork-test",
+        FORK_OWNER_TOKEN,
+        json!({ "email": "test4@windmill.dev", "is_admin": true, "operator": false }),
+    )
+    .await;
+    assert_eq!(resp.status(), 403, "fork creator cannot add an admin");
+
+    // ... nor anyone who is only an operator of the parent, which would widen their access.
+    let resp = add_user(
+        port,
+        "wm-fork-test",
+        FORK_OWNER_TOKEN,
+        developer("test4@windmill.dev"),
+    )
+    .await;
+    assert_eq!(
+        resp.status(),
+        403,
+        "fork creator cannot add an operator of the parent"
+    );
+
+    // ... nor anyone from outside the parent workspace.
+    let resp = add_user(
+        port,
+        "wm-fork-test",
+        FORK_OWNER_TOKEN,
+        developer("outsider@windmill.dev"),
+    )
+    .await;
+    assert_eq!(
+        resp.status(),
+        403,
+        "fork creator cannot add a non-member of the parent"
+    );
+
+    // The grant covers the fork alone, not the workspace it was forked from.
+    let resp = add_user(
+        port,
+        "test-workspace",
+        FORK_OWNER_TOKEN,
+        developer("test4@windmill.dev"),
+    )
+    .await;
+    assert_eq!(
+        resp.status(),
+        403,
+        "fork creator gains nothing on the parent workspace"
+    );
+
+    // ... and belongs to the creator, not to every member of the fork.
+    let resp = add_user(
+        port,
+        "wm-fork-test",
+        FORK_MEMBER_TOKEN,
+        developer("test4@windmill.dev"),
+    )
+    .await;
+    assert_eq!(
+        resp.status(),
+        403,
+        "a fork member who did not create it gains nothing"
+    );
+
+    // Removing is the counterpart of adding: allowed for the developer they just added...
+    let resp = as_user(
+        client().delete(format!(
+            "http://localhost:{port}/api/w/wm-fork-test/users/delete/test-user-3"
+        )),
+        FORK_OWNER_TOKEN,
+    )
+    .send()
+    .await
+    .unwrap();
+    assert_eq!(resp.status(), 200, "fork creator can remove a developer");
+
+    // ... but not for an admin of the fork.
+    let resp = as_user(
+        client().delete(format!(
+            "http://localhost:{port}/api/w/wm-fork-test/users/delete/test-user"
+        )),
+        FORK_OWNER_TOKEN,
+    )
+    .send()
+    .await
+    .unwrap();
+    assert_eq!(
+        resp.status(),
+        403,
+        "fork creator cannot remove an admin of the fork"
+    );
+
+    Ok(())
+}
diff --git a/backend/windmill-api-users/src/users.rs b/backend/windmill-api-users/src/users.rs
index ff0e8e754e..b98bc6f414 100644
--- a/backend/windmill-api-users/src/users.rs
+++ b/backend/windmill-api-users/src/users.rs
@@ -1850,6 +1850,39 @@ pub async fn delete_workspace_user_internal(
     Ok(())
 }
 
+/// Non-admin path for `delete_workspace_user`: the creator of a fork may remove non-admin members
+/// from the fork they created, so that adding the wrong collaborator is theirs to undo rather than
+/// an admin's. Never on a root workspace, and never against an admin of the fork — the counterpart
+/// of the add grant, whose bounds are spelled out on `add_user` in `windmill-api-workspaces`.
+///
+/// `target_is_admin` must come from a row locked by the caller's deletion transaction: the grant
+/// turns on the target not being an admin, so a promotion committing between the check and the
+/// delete would remove an admin after all. `None` (no such member) is left to the caller's 404,
+/// which is raised only after this returns so that a non-creator cannot probe who exists.
+async fn authorize_fork_owner_delete_user(
+    tx: &mut Transaction<'_, Postgres>,
+    w_id: &str,
+    authed: &ApiAuthed,
+    username_to_delete: &str,
+    target_is_admin: Option<bool>,
+) -> Result<()> {
+    if windmill_common::workspaces::fork_owned_by(&mut **tx, w_id, &authed.email)
+        .await?
+        .is_none()
+    {
+        return Err(Error::RequireAdmin(authed.username.clone()));
+    }
+
+    if target_is_admin == Some(true) {
+        return Err(Error::PermissionDenied(format!(
+            "as the creator of fork {w_id} you cannot remove {username_to_delete}, who is an admin \
+             of it"
+        )));
+    }
+
+    Ok(())
+}
+
 async fn delete_workspace_user(
     authed: ApiAuthed,
     Extension(db): Extension<DB>,
@@ -1857,17 +1890,27 @@ async fn delete_workspace_user(
 ) -> Result<String> {
     let mut tx = db.begin().await?;
 
-    require_admin(authed.is_admin, &authed.username)?;
-
-    let email_to_delete_o = sqlx::query_scalar!(
-        "SELECT email FROM usr where username = $1 AND workspace_id = $2",
+    // Locked so that the authorization below and the delete it guards see the same row.
+    let target = sqlx::query!(
+        "SELECT email, is_admin FROM usr where username = $1 AND workspace_id = $2 FOR UPDATE",
         username_to_delete,
         &w_id,
     )
     .fetch_optional(&mut *tx)
     .await?;
 
-    let email_to_delete = not_found_if_none(email_to_delete_o, "User", &username_to_delete)?;
+    if !authed.is_admin {
+        authorize_fork_owner_delete_user(
+            &mut tx,
+            &w_id,
+            &authed,
+            &username_to_delete,
+            target.as_ref().map(|t| t.is_admin),
+        )
+        .await?;
+    }
+
+    let email_to_delete = not_found_if_none(target, "User", &username_to_delete)?.email;
 
     delete_workspace_user_internal(
         &w_id,
diff --git a/backend/windmill-api-workspaces/src/workspaces.rs b/backend/windmill-api-workspaces/src/workspaces.rs
index 8aa1ff680c..74b31c1410 100644
--- a/backend/windmill-api-workspaces/src/workspaces.rs
+++ b/backend/windmill-api-workspaces/src/workspaces.rs
@@ -514,6 +514,10 @@ struct UserWorkspace {
     pub parent_workspace_id: Option<String>,
     pub is_dev_workspace: bool,
     pub dev_workspace_label: Option<String>,
+    /// Creator of the workspace (`workspace.owner`). On a fork it identifies the forker, who gets a
+    /// narrow membership grant over it even without being an admin — the UI keys the fork members
+    /// screen off this.
+    pub created_by: Option<String>,
     pub disabled: bool,
 }
 
@@ -4298,6 +4302,7 @@ async fn user_workspaces(
         UserWorkspace,
         "SELECT workspace.id, workspace.name, usr.username, workspace_settings.color, workspace.parent_workspace_id,
                 workspace.is_dev_workspace, workspace.dev_workspace_label,
+                workspace.owner AS \"created_by?\",
                 CASE WHEN usr.operator THEN workspace_settings.operator_settings ELSE NULL END as operator_settings,
                 usr.disabled
          FROM workspace
@@ -7174,6 +7179,72 @@ If you do not have an account on {}, login with SSO or ask an admin to create an
     ))
 }
 
+/// Non-admin path for `add_user`: the creator of a fork may bring collaborators into the fork they
+/// created, so a team can work on it without an admin of the fork having to step in. The grant is
+/// deliberately narrow, because a fork holds a full clone of its parent (secrets included) and the
+/// creator may be an ordinary developer:
+/// - only on a fork they created, never on a root workspace;
+/// - only as a developer, so it can never mint an admin (nor an operator, which would need the
+///   workspace's operator settings to be meaningful);
+/// - only for someone who is already a developer or admin of the parent, so pulling them into the
+///   fork cannot widen who can read the parent's data.
+///
+/// Anything outside those bounds stays an admin's call. Returns the username the new member must be
+/// given in the fork.
+async fn authorize_fork_owner_add_user(
+    db: &DB,
+    w_id: &str,
+    authed: &ApiAuthed,
+    nu: &NewWorkspaceUser,
+) -> Result<String> {
+    let parent = windmill_common::workspaces::fork_owned_by(db, w_id, &authed.email)
+        .await?
+        .ok_or_else(|| Error::RequireAdmin(authed.username.clone()))?;
+
+    if nu.is_admin || nu.operator {
+        return Err(Error::PermissionDenied(format!(
+            "as the creator of fork {w_id} you can only add members as developers; ask an admin of \
+             {w_id} for any other role"
+        )));
+    }
+
+    let parent_username = sqlx::query_scalar!(
+        "SELECT username FROM usr
+         WHERE workspace_id = $1 AND email = $2 AND NOT operator AND NOT disabled",
+        parent,
+        nu.email,
+    )
+    .fetch_optional(db)
+    .await?;
+
+    let Some(parent_username) = parent_username else {
+        return Err(Error::PermissionDenied(format!(
+            "as the creator of fork {w_id} you can only add developers or admins of its parent \
+             workspace {parent}; {} is not one, so only an admin of {w_id} can add them",
+            nu.email
+        )));
+    };
+
+    // Ownership of a `u/<username>/` path is decided by the username alone, and the fork holds a
+    // clone of every such path from the parent. Seating the new member on a username other than
+    // their own would therefore hand them that parent user's cloned scripts, variables and secrets
+    // — so their parent username is the only one they may be given here, whatever the caller asked
+    // for (`add_user` otherwise lets the caller choose it when AUTOMATE_USERNAME_CREATION is off).
+    if nu
+        .username
+        .as_deref()
+        .is_some_and(|u| !u.is_empty() && u != parent_username)
+    {
+        return Err(Error::PermissionDenied(format!(
+            "as the creator of fork {w_id} you cannot choose the username of a member you add; {} \
+             joins as '{parent_username}', the username they already have in {parent}",
+            nu.email
+        )));
+    }
+
+    Ok(parent_username)
+}
+
 async fn add_user(
     authed: ApiAuthed,
     Extension(db): Extension<DB>,
@@ -7181,8 +7252,6 @@ async fn add_user(
     Path(w_id): Path<String>,
     Json(mut nu): Json<NewWorkspaceUser>,
 ) -> Result<(StatusCode, String)> {
-    require_admin(authed.is_admin, &authed.username)?;
-
     #[cfg(not(feature = "enterprise"))]
     if w_id == "admins" {
         return Err(Error::BadRequest(
@@ -7192,6 +7261,12 @@ async fn add_user(
 
     nu.email = nu.email.to_lowercase();
 
+    let fork_owner_username = if !authed.is_admin {
+        Some(authorize_fork_owner_add_user(&db, &w_id, &authed, &nu).await?)
+    } else {
+        None
+    };
+
     #[cfg(feature = "enterprise")]
     if let Some(msg) =
         windmill_common::ee_oss::check_seat_cap_for_new_user(&db, &nu.email, nu.operator).await?
@@ -7227,7 +7302,9 @@ async fn add_user(
     .flatten()
     .unwrap_or(true);
 
-    let username = if automate_username_creation {
+    let username = if let Some(username) = fork_owner_username {
+        username
+    } else if automate_username_creation {
         if nu.username.is_some() && nu.username.unwrap().len() > 0 {
             return Err(Error::BadRequest(
                 "username is not allowed when username creation is automated".to_string(),
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 2d976d1df9..668cdae8cc 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -847,7 +847,7 @@ paths:
 
   /w/{workspace}/users/delete/{username}:
     delete:
-      summary: delete user (require admin privilege)
+      summary: delete user (require admin privilege, except for the creator of a fork removing a non-admin member of the fork)
       operationId: deleteUser
       tags:
         - user
@@ -3026,7 +3026,7 @@ paths:
 
   /w/{workspace}/workspaces/add_user:
     post:
-      summary: add user to workspace
+      summary: add user to workspace (require admin privilege, except for the creator of a fork adding a developer/admin of its parent workspace as a developer of the fork)
       operationId: addUser
       tags:
         - workspace
diff --git a/backend/windmill-common/src/workspaces.rs b/backend/windmill-common/src/workspaces.rs
index 14dbfdf11d..33c80cea4b 100644
--- a/backend/windmill-common/src/workspaces.rs
+++ b/backend/windmill-common/src/workspaces.rs
@@ -652,6 +652,35 @@ pub async fn fork_subtree_height(db: &crate::DB, w_id: &str) -> Result<i64> {
     Ok(height)
 }
 
+/// Parent id of `w_id` when `email` is the creator of that fork, `None` otherwise (including for a
+/// root workspace, which has no creator in this sense).
+///
+/// The creator is recorded as `workspace.owner`, but the `usr` row they get in the fork is copied
+/// from the parent — so a forker who is not an admin of the parent is not an admin of the fork they
+/// just created either, and cannot bring anyone in to work on it. Being the creator therefore grants
+/// a narrow membership right over the fork; the callers own the exact bounds of that grant (see
+/// `add_user` in `windmill-api-workspaces`).
+///
+/// Unauthenticated helper: reads workspace hierarchy for any `w_id`, so callers must already be
+/// authorized for that workspace (or run in trusted server-side code). Takes any executor so that a
+/// caller can run it inside the transaction whose writes the grant authorizes.
+pub async fn fork_owned_by<'e, E: sqlx::Executor<'e, Database = sqlx::Postgres>>(
+    db: E,
+    w_id: &str,
+    email: &str,
+) -> Result<Option<String>> {
+    let parent = sqlx::query_scalar!(
+        "SELECT parent_workspace_id FROM workspace
+         WHERE id = $1 AND owner = $2 AND parent_workspace_id IS NOT NULL AND NOT deleted",
+        w_id,
+        email
+    )
+    .fetch_optional(db)
+    .await
+    .map_err(|e| Error::internal_err(format!("checking fork ownership of {w_id}: {e:#}")))?;
+    Ok(parent.flatten())
+}
+
 /// Ids of every fork/dev workspace anywhere under `w_id` (excludes `w_id` itself), including live
 /// descendants beneath a soft-deleted intermediate. Used to invalidate per-workspace caches for a
 /// whole subtree after its ancestor is reparented.
diff --git a/frontend/src/lib/components/settings/ForkMemberSettings.svelte b/frontend/src/lib/components/settings/ForkMemberSettings.svelte
new file mode 100644
index 0000000000..6b75018cae
--- /dev/null
+++ b/frontend/src/lib/components/settings/ForkMemberSettings.svelte
@@ -0,0 +1,239 @@
+<script lang="ts">
+	import { Alert, Badge, Button, Section, Skeleton } from '$lib/components/common'
+	import SettingsPageHeader from '$lib/components/settings/SettingsPageHeader.svelte'
+	import ConfirmationModal from '$lib/components/common/confirmationModal/ConfirmationModal.svelte'
+	import DataTable from '$lib/components/table/DataTable.svelte'
+	import Head from '$lib/components/table/Head.svelte'
+	import Cell from '$lib/components/table/Cell.svelte'
+	import Popover from '$lib/components/meltComponents/Popover.svelte'
+	import Select from '$lib/components/select/Select.svelte'
+	import type { User } from '$lib/gen'
+	import { UserService, WorkspaceService } from '$lib/gen'
+	import { userStore, userWorkspaces, workspaceStore } from '$lib/stores'
+	import { sendUserToast } from '$lib/toast'
+	import { Bot, UserMinus, UserPlus } from 'lucide-svelte'
+	import { untrack } from 'svelte'
+
+	const parentWorkspaceId = $derived(
+		$userWorkspaces.find((w) => w.id === $workspaceStore)?.parent_workspace_id ?? undefined
+	)
+
+	let members: User[] | undefined = $state(undefined)
+	// Parent members the fork's creator is allowed to bring in: developers and admins there. The
+	// backend enforces the same rule; this only keeps the picker from offering rejected candidates.
+	let candidates: User[] = $state([])
+	let selectedCandidate: string | undefined = $state(undefined)
+	let adding = $state(false)
+	let removeConfirmedCallback: (() => void) | undefined = $state(undefined)
+
+	const candidateItems = $derived(
+		candidates
+			.filter((c) => !members?.some((m) => m.email === c.email))
+			.map((c) => ({ value: c.email, label: `${c.username} (${c.email})` }))
+	)
+
+	async function loadMembers(workspace: string): Promise<void> {
+		const loaded = await UserService.listUsers({ workspace })
+		if (workspace !== $workspaceStore) return
+		members = loaded
+	}
+
+	async function loadCandidates(workspace: string, parent: string): Promise<void> {
+		try {
+			const parentMembers = await UserService.listUsers({ workspace: parent })
+			if (workspace !== $workspaceStore) return
+			candidates = parentMembers.filter((u) => !u.operator && !u.disabled)
+		} catch (e) {
+			console.warn('Failed to list the parent workspace members:', e)
+			if (workspace === $workspaceStore) {
+				candidates = []
+			}
+		}
+	}
+
+	async function addCandidate(workspace: string): Promise<void> {
+		if (!selectedCandidate) return
+		adding = true
+		try {
+			await WorkspaceService.addUser({
+				workspace,
+				requestBody: { email: selectedCandidate, is_admin: false, operator: false }
+			})
+			sendUserToast(`Added ${selectedCandidate} as a developer of this fork`)
+			selectedCandidate = undefined
+			await loadMembers(workspace)
+		} catch (e) {
+			console.error('Failed to add member:', e)
+			sendUserToast(`Failed to add member: ${e}`, true)
+		} finally {
+			adding = false
+		}
+	}
+
+	async function removeMember(workspace: string, username: string): Promise<void> {
+		try {
+			await UserService.deleteUser({ workspace, username })
+			sendUserToast(`Removed ${username} from this fork`)
+			await loadMembers(workspace)
+		} catch (e) {
+			console.error('Failed to remove member:', e)
+			sendUserToast(`Failed to remove member: ${e}`, true)
+		}
+	}
+
+	$effect(() => {
+		const workspace = $workspaceStore
+		const parent = parentWorkspaceId
+		untrack(() => {
+			// A workspace switch keeps this component mounted, so everything keyed to the previous fork
+			// goes: a pending removal would otherwise carry that fork's username into this one, where
+			// the same username can be a different person.
+			members = undefined
+			candidates = []
+			selectedCandidate = undefined
+			removeConfirmedCallback = undefined
+			if (workspace && parent) {
+				loadMembers(workspace)
+				loadCandidates(workspace, parent)
+			}
+		})
+	})
+</script>
+
+<SettingsPageHeader
+	title="Members {members != undefined ? `(${members.length})` : ''}"
+	description="Add collaborators to the fork you created."
+	link="https://www.windmill.dev/docs/core_concepts/roles_and_permissions"
+/>
+
+<Alert type="info" title="You created this fork">
+	You are not an admin of this workspace, so you can only add developers or admins of
+	<b>{parentWorkspaceId}</b> as developers of this fork, and remove the ones who are not admins here.
+	Ask an admin of this workspace for any other membership change.
+</Alert>
+
+<div class="pt-6"></div>
+
+<Section>
+	{#snippet action()}
+		<Popover placement="bottom-end">
+			{#snippet trigger()}
+				<Button
+					variant="accent"
+					unifiedSize="md"
+					nonCaptureEvent={true}
+					startIcon={{ icon: UserPlus }}
+				>
+					Add collaborator
+				</Button>
+			{/snippet}
+			{#snippet content()}
+				<div class="flex flex-col w-[28rem] p-4 gap-2">
+					<span class="text-sm leading-6 font-semibold">Add a collaborator</span>
+					<span class="text-xs text-secondary">
+						They join as a developer of this fork. Only members of
+						<b>{parentWorkspaceId}</b> who are developers or admins there can be added.
+					</span>
+					<Select
+						items={candidateItems}
+						bind:value={selectedCandidate}
+						placeholder={candidateItems.length > 0
+							? 'Select a member'
+							: 'No one left to add from the parent workspace'}
+						clearable
+					/>
+					<Button
+						variant="accent"
+						unifiedSize="md"
+						disabled={!selectedCandidate || adding || !$workspaceStore}
+						onClick={() => addCandidate($workspaceStore!)}
+					>
+						Add as developer
+					</Button>
+				</div>
+			{/snippet}
+		</Popover>
+	{/snippet}
+
+	<DataTable>
+		<Head>
+			<tr>
+				<Cell head first>Email</Cell>
+				<Cell head>Username</Cell>
+				<Cell head>Role</Cell>
+				<Cell head last><span class="sr-only">Actions</span></Cell>
+			</tr>
+		</Head>
+		<tbody>
+			{#if members}
+				{#each members as member (member.email)}
+					{@const { email, username, is_admin, operator } = member}
+					<tr class="bg-surface">
+						<Cell first>
+							{#if member.is_service_account}
+								<span class="flex items-center gap-1.5 max-w-[220px]" title={email}>
+									<Bot size={16} class="text-blue-500 shrink-0" />
+									<span class="truncate">{email}</span>
+								</span>
+							{:else}
+								<span class="block truncate max-w-[220px]" title={email}>{email}</span>
+							{/if}
+						</Cell>
+						<Cell>
+							<span class="block truncate max-w-[120px]" title={username}>{username}</span>
+						</Cell>
+						<Cell>
+							<Badge color="blue">
+								{is_admin ? 'Admin' : operator ? 'Operator' : 'Developer'}
+							</Badge>
+						</Cell>
+						<Cell last>
+							<Button
+								unifiedSize="sm"
+								variant="subtle"
+								destructive
+								disabled={is_admin || email === $userStore?.email}
+								title={is_admin
+									? 'Only an admin of this workspace can remove an admin'
+									: email === $userStore?.email
+										? 'Leave the workspace from the workspace menu instead'
+										: undefined}
+								startIcon={{ icon: UserMinus }}
+								onClick={() => {
+									const workspace = $workspaceStore!
+									removeConfirmedCallback = () => removeMember(workspace, username)
+								}}
+							>
+								Remove
+							</Button>
+						</Cell>
+					</tr>
+				{/each}
+			{:else}
+				{#each new Array(4) as _, i (i)}
+					<tr class="border">
+						<td colspan={4}><Skeleton layout={[[4]]} /></td>
+					</tr>
+				{/each}
+			{/if}
+		</tbody>
+	</DataTable>
+</Section>
+
+<ConfirmationModal
+	open={Boolean(removeConfirmedCallback)}
+	title="Remove member"
+	confirmationText="Remove"
+	on:canceled={() => {
+		removeConfirmedCallback = undefined
+	}}
+	on:confirmed={() => {
+		removeConfirmedCallback?.()
+		removeConfirmedCallback = undefined
+	}}
+>
+	<span>
+		Are you sure you want to remove this member from the fork? Anything they own here stays behind
+		under their user path.
+	</span>
+</ConfirmationModal>
diff --git a/frontend/src/lib/stores.ts b/frontend/src/lib/stores.ts
index 0449796d21..476afa8027 100644
--- a/frontend/src/lib/stores.ts
+++ b/frontend/src/lib/stores.ts
@@ -44,6 +44,7 @@ export interface UserWorkspace {
 	parent_workspace_id?: string | null
 	is_dev_workspace?: boolean
 	dev_workspace_label?: string | null
+	created_by?: string | null
 	disabled: boolean
 }
 
diff --git a/frontend/src/routes/(root)/(logged)/workspace_settings/+page.svelte b/frontend/src/routes/(root)/(logged)/workspace_settings/+page.svelte
index 19fa4f2553..54b03d9b9c 100644
--- a/frontend/src/routes/(root)/(logged)/workspace_settings/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/workspace_settings/+page.svelte
@@ -15,6 +15,7 @@
 
 	import Tooltip from '$lib/components/Tooltip.svelte'
 	import WorkspaceUserSettings from '$lib/components/settings/WorkspaceUserSettings.svelte'
+	import ForkMemberSettings from '$lib/components/settings/ForkMemberSettings.svelte'
 	import SettingsPageHeader from '$lib/components/settings/SettingsPageHeader.svelte'
 	import { WORKSPACE_SHOW_SLACK_CMD, WORKSPACE_SHOW_WEBHOOK_CLI_SYNC } from '$lib/consts'
 	import {
@@ -339,8 +340,22 @@
 			encryptionKeyValidationError = validation.error
 		}
 	})
+	const currentWorkspace = $derived($userWorkspaces.find((w) => w.id === $workspaceStore))
+	const canAdmin = $derived(($userStore?.is_admin ?? false) || Boolean($superadmin))
+	// The creator of a fork gets the fork members screen even when they are not an admin of it:
+	// their `usr` row is copied from the parent, so forking as an ordinary developer leaves them
+	// unable to bring anyone in to collaborate. Nothing else on this page opens up — the backend
+	// only grants them developer memberships on the fork they created.
+	const isForkOwner = $derived(
+		Boolean(currentWorkspace?.parent_workspace_id) &&
+			currentWorkspace?.created_by === $userStore?.email
+	)
+
 	// All state derived from URL - no local state needed
 	let tab = $derived.by(() => {
+		if (!canAdmin) {
+			return 'users' as const
+		}
 		const selectedTab = $page.url.searchParams.get('tab') as
 			| 'users'
 			| 'slack'
@@ -762,8 +777,19 @@
 	})
 
 	$effect(() => {
+		// `canAdmin` is read as a dependency, not inside untrack: $userStore is repopulated
+		// asynchronously after a workspace switch, so the run triggered by the switch can still see
+		// the previous workspace's role. Re-running once it lands is what loads the settings for an
+		// admin who switched in from a workspace where they were not one.
+		const admin = canAdmin
 		if ($workspaceStore) {
 			untrack(() => {
+				// `getSettings` and the OAuth config are admin-only and carry integration secrets. A fork
+				// creator reaches this page for the members screen alone, which needs none of them.
+				if (!admin) {
+					loadedSettings = true
+					return
+				}
 				loadSettings()
 				loadSlackOAuthConfig()
 				loadGlobalOAuthSettings()
@@ -1117,13 +1143,12 @@
 	// The Dev workspace tab is only meaningful on a root workspace (to pair/manage a dev) or on a
 	// dev workspace itself (to see its prod / detach). Hide it for ordinary forks — pairing isn't
 	// available there and the backend would reject it.
-	const currentWsForDevTab = $derived($userWorkspaces.find((w) => w.id === $workspaceStore))
 	const showDevWorkspaceTab = $derived(
-		!currentWsForDevTab?.parent_workspace_id || (currentWsForDevTab?.is_dev_workspace ?? false)
+		!currentWorkspace?.parent_workspace_id || (currentWorkspace?.is_dev_workspace ?? false)
 	)
 
 	// Navigation groups for sidebar
-	const navigationGroups = $derived([
+	const adminNavigationGroups = $derived([
 		{
 			items: [
 				{
@@ -1300,10 +1325,29 @@
 			]
 		}
 	])
+
+	// A fork's creator manages its members through the same screen, but nothing else about the
+	// workspace is theirs to change, so they get the Members entry alone.
+	const navigationGroups = $derived(
+		canAdmin
+			? adminNavigationGroups
+			: [
+					{
+						items: [
+							{
+								id: 'users',
+								label: 'Members',
+								aiId: 'workspace-settings-users',
+								aiDescription: 'Members of the fork you created'
+							}
+						]
+					}
+				]
+	)
 </script>
 
 <CenteredPage wrapperClasses="pb-0 h-screen" handleOverflow={false} class="flex flex-col h-full">
-	{#if $userStore?.is_admin || $superadmin}
+	{#if canAdmin || isForkOwner}
 		<PageHeader title="Workspace settings: {$workspaceStore}">
 			{#snippet titleActions()}
 				{#if $workspaceStore}
@@ -1338,7 +1382,11 @@
 						{#if !loadedSettings}
 							<Skeleton layout={[1, [40]]} />
 						{:else if tab == 'users'}
-							<WorkspaceUserSettings />
+							{#if canAdmin}
+								<WorkspaceUserSettings />
+							{:else}
+								<ForkMemberSettings />
+							{/if}
 						{:else if tab == 'deploy_to'}
 							<SettingsPageHeader
 								title="Link this workspace to another staging / prod workspace"
@@ -1382,12 +1430,12 @@
 							/>
 							<WorkspaceRulesets />
 						{:else if tab == 'premium'}
-							{#if currentWsForDevTab?.parent_workspace_id}
+							{#if currentWorkspace?.parent_workspace_id}
 								<Alert type="info" title="Billing is managed on the parent workspace">
-									This workspace is a fork of <b>{currentWsForDevTab.parent_workspace_id}</b>. It
-									runs on the parent's plan and its executions count toward the parent's usage and
-									bill, so there is no separate subscription here. Manage billing, seats, and quotas
-									from the parent workspace's settings.
+									This workspace is a fork of <b>{currentWorkspace.parent_workspace_id}</b>. It runs
+									on the parent's plan and its executions count toward the parent's usage and bill,
+									so there is no separate subscription here. Manage billing, seats, and quotas from
+									the parent workspace's settings.
 								</Alert>
 							{:else}
 								<PremiumInfo {customer_id} {plan} />

From dcb9e40ea237c3744611ac6e83ff5ecc6528e697 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 17 Jul 2026 15:44:57 +0200
Subject: [PATCH 031/171] fix(extra): make the extra container runnable as a
 non-root UID (#10173)

* fix(extra): make extra container runnable as a non-root UID

The root-run installs in DockerfileExtra inherit UV_CACHE_DIR
(/tmp/windmill/cache/uv) and XDG_CACHE_HOME (/pyls/.cache) from the base
image and write to them *after* the base image's world-writable pass,
leaving ~320 root-owned 0755 dirs. A non-root UID then fails to debug:

  uv venv failed: Failed to write to the client cache
  Caused by: Permission denied (os error 13)
    at path "/tmp/windmill/cache/uv/simple-v21/pypi/.tmpWxWzTi"

Re-apply the base image's world-writable convention after the installs,
and add the windmill UID/GID 1000 account the app image already has so
runAsUser: 1000 resolves to a real user with a writable $HOME. The
entrypoint also wrote $NETRC to the 0700 /root under `set -e`, killing
the container at startup; redirect $HOME when it is not writable.

Verified against the published image as root, uid 1000, and uid 4567:0:
all four services start and `windmill prepare-deps` succeeds in each.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(extra): scope the HOME fallback per-UID and cover non-root in CI

Review findings on the previous commit:

- `${HOME:-/root}` was used in the writability test but not the assignment,
  so an unset HOME (writable /root, redirect skipped) silently wrote the
  netrc to `/.netrc` instead of `/root/.netrc`. Normalize HOME once.
- `mkdir -p` succeeds on a dir owned by another UID, so a root-created
  /tmp/windmill-home on a shared /tmp reintroduced the startup death this
  fix exists to prevent. Scope the fallback to /tmp/windmill-home-$(id -u).
- The extra image's smoke test only ran as root, so nothing exercised the
  non-root path this PR is about. Add a --user 1000 run of the same suite
  plus a prepare-deps assertion, which is where the EACCES surfaced.

Also correct the DockerfileExtra comment: the proven requirement is the uv
cache, not runtime writes by gopls.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(extra): keep /tmp/monaco code read-only for non-root UIDs

Review nit: /tmp/monaco holds node_modules (code, not cache), so it is not
covered by the base image's world-writable cache convention. Give it a+rX
files with 777 dirs -- enough for the go.mod / ruff.toml the entrypoint and
pyls_launcher write into it -- instead of a+rw on every file.

/tmp/windmill and /pyls/.cache keep a+rw: that is the base convention for
caches (DockerfileSlimEe:69 chmod -R a+rw /tmp/windmill/cache; Dockerfile:339
"cache files already have 666"), and uv rewrites cache entries in place.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore(extra): drop the non-root CI smoke test

Reverts publish_extra.yml to its root-only smoke test; the DockerfileExtra
and entrypoint fix is unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 docker/DockerfileExtra     | 17 +++++++++++++----
 docker/entrypoint-extra.sh | 25 +++++++++++++++++++------
 2 files changed, 32 insertions(+), 10 deletions(-)

diff --git a/docker/DockerfileExtra b/docker/DockerfileExtra
index 190f65caba..b0e4bd8ad7 100644
--- a/docker/DockerfileExtra
+++ b/docker/DockerfileExtra
@@ -124,10 +124,19 @@ WORKDIR /app
 COPY docker/entrypoint-extra.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 
-# Set permissions
-RUN chmod -R a+rX /usr/local && \
-    chmod -R a+rX /pyls && \
-    chmod -R a+rX /debugger
+# Non-root 'windmill' user with UID/GID 1000 to match the app image, so
+# `runAsUser: 1000` resolves to a real account with a writable $HOME.
+# No USER directive: the image still starts as root by default.
+RUN addgroup --gid 1000 windmill && \
+    adduser --disabled-password --gecos "" --uid 1000 --gid 1000 windmill
+
+# The root-run installs above write into the base image's UV_CACHE_DIR
+# (/tmp/windmill/cache/uv) after the base already made it world-writable, leaving
+# root-owned 0755 dirs that make uv fail EACCES for a non-root UID. /pyls/.cache
+# (XDG_CACHE_HOME, incl. DENO_DIR) and /tmp/monaco are written at runtime too.
+RUN chmod -R a+rX /usr/local /pyls /debugger /multiplayer /tmp/monaco && \
+    chmod -R a+rw /tmp/windmill /pyls/.cache && \
+    find /tmp/windmill /pyls/.cache /tmp/monaco -type d -exec chmod 777 {} +
 
 # Expose all service ports
 EXPOSE 3000 3001 3002 3003
diff --git a/docker/entrypoint-extra.sh b/docker/entrypoint-extra.sh
index 385db124fb..a06901e25c 100644
--- a/docker/entrypoint-extra.sh
+++ b/docker/entrypoint-extra.sh
@@ -21,16 +21,29 @@ cleanup() {
 
 trap cleanup SIGTERM SIGINT
 
+# An arbitrary non-root UID gets HOME=/ and cannot write the image's 0700 /root, so
+# redirect $HOME before anything writes under it (netrc below, plus the bun/npm/go
+# caches in the services). Keep the fallback UID-scoped: a leftover dir from a
+# different UID on a shared /tmp is not writable. Root keeps HOME=/root.
+HOME="${HOME:-/root}"
+if [ ! -w "$HOME" ]; then
+    echo "[entrypoint] HOME=$HOME is not writable for UID $(id -u), using HOME=/tmp/windmill-home-$(id -u)"
+    HOME="/tmp/windmill-home-$(id -u)"
+    mkdir -p "$HOME"
+fi
+export HOME
+
 # Setup NETRC if provided (for LSP)
 if [ -n "$NETRC" ]; then
-    echo "$NETRC" > /root/.netrc
-    chmod 600 /root/.netrc
+    echo "$NETRC" > "$HOME/.netrc"
+    chmod 600 "$HOME/.netrc"
 fi
 
-# Setup cache directory for LSP
-if [ -d /root/.cache ]; then
-    export XDG_CACHE_HOME=/root/.cache
-    cp -r /pyls/.cache /root/.cache 2>/dev/null || true
+# Setup cache directory for LSP (falls back to the image's world-writable
+# XDG_CACHE_HOME=/pyls/.cache when $HOME/.cache isn't mounted)
+if [ -d "$HOME/.cache" ]; then
+    export XDG_CACHE_HOME="$HOME/.cache"
+    cp -r /pyls/.cache "$HOME/.cache" 2>/dev/null || true
 fi
 
 # Setup Monaco temp directory for LSP

From 396fb1c4752b2b93ef0ec9d0c9c6be05aa403eef Mon Sep 17 00:00:00 2001
From: Alexander Petric <alpetric@users.noreply.github.com>
Date: Fri, 17 Jul 2026 15:57:00 +0200
Subject: [PATCH 032/171] feat(otel-tracing-proxy): trust internal endpoints
 with untrusted CAs (#10139)

* [ee] feat(otel-tracing-proxy): trust internal endpoints with untrusted CAs

Add `insecure_upstream_hosts` and `upstream_ca_certs` to the HTTP Request Tracing
settings so the OTEL tracing proxy can reach internal endpoints with untrusted or
private-CA certificates while keeping them traced. Wires the two settings through
the worker config and live reload, adds the inputs to the instance settings UI,
and pulls in the rustls upstream-client deps (hyper-rustls/tokio-rustls/rustls/
rustls-native-certs/rustls-pemfile; hyper-http-proxy switched to its rustls
feature).

The proxy-side implementation lives in the companion EE PR.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore: bump ee-repo-ref to otel_ca companion commit

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(otel-tracing-proxy): expose new fields in declarative config; bump ee-ref

Addresses code-review findings:
- Add `insecure_upstream_hosts` and `upstream_ca_certs` to the declarative
  `OtelTracingProxySettings` in instance_config.rs so operator/GitOps-managed
  installs can set them and reconciliation no longer drops values saved via the UI.
- Restore the trailing newline on ee-repo-ref.txt and bump it to the companion
  EE commit carrying the strict host-matching / port-ordering fixes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore: update ee-repo-ref to 51e50629f48dbc4f5520a787b4bdfb76f4cd38d3

This commit updates the EE repository reference after PR #665 was merged in windmill-ee-private.

Previous ee-repo-ref: 49f458e4446395e98915c220baa757ab3b2ed2d8

New ee-repo-ref: 51e50629f48dbc4f5520a787b4bdfb76f4cd38d3

Automated by sync-ee-ref workflow.

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
---
 backend/Cargo.lock                            |  9 ++--
 backend/Cargo.toml                            |  5 ++-
 backend/ee-repo-ref.txt                       |  2 +-
 backend/src/monitor.rs                        |  6 ++-
 .../windmill-common/src/instance_config.rs    |  9 ++++
 backend/windmill-worker/Cargo.toml            |  8 +++-
 backend/windmill-worker/src/worker.rs         | 11 +++++
 .../src/lib/components/InstanceSetting.svelte | 45 +++++++++++++++++++
 8 files changed, 86 insertions(+), 9 deletions(-)

diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index 64427a820c..a278882d38 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -5814,12 +5814,9 @@ dependencies = [
  "http 1.4.2",
  "hyper 1.10.1",
  "hyper-rustls 0.27.9",
- "hyper-tls",
  "hyper-util",
- "native-tls",
  "pin-project-lite",
  "tokio",
- "tokio-native-tls",
  "tokio-rustls 0.26.4",
  "tower-service",
 ]
@@ -15747,7 +15744,7 @@ dependencies = [
  "hmac",
  "hudsucker",
  "hyper-http-proxy",
- "hyper-tls",
+ "hyper-rustls 0.27.9",
  "hyper-util",
  "itertools 0.14.0",
  "jsonwebtoken 8.3.0",
@@ -15777,6 +15774,9 @@ dependencies = [
  "reqwest-middleware",
  "rsa",
  "rust_decimal",
+ "rustls 0.23.35",
+ "rustls-native-certs 0.8.4",
+ "rustls-pemfile 2.2.0",
  "serde",
  "serde_json",
  "sha2 0.10.9",
@@ -15786,6 +15786,7 @@ dependencies = [
  "tiberius",
  "tokio",
  "tokio-postgres",
+ "tokio-rustls 0.26.4",
  "tokio-stream",
  "tokio-util",
  "tracing",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 9aa5717bb0..b8277d852a 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -681,5 +681,8 @@ rumqttc = { version = "0.24.0", features = ["use-native-tls"]}
 strum = { version = "0.27", features = ["derive"] }
 strum_macros = "0.27"
 hudsucker = { version = "0.22", features = ["rcgen-ca", "native-tls-client"] }
-hyper-http-proxy = { version = "1", default-features = false, features = ["native-tls"] }
+hyper-http-proxy = { version = "1", default-features = false, features = ["rustls-tls-native-roots"] }
+hyper-rustls = { version = "0.27", default-features = false, features = ["http1", "http2", "ring", "tls12"] }
+tokio-rustls = { version = "0.26", default-features = false, features = ["ring", "tls12"] }
+rustls-native-certs = "0.8"
 rcgen = "0.13"
diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index 25c70cdf3c..adf0644740 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-e19948fa2974a7d89bec12957fc6d9fa0a421da8
\ No newline at end of file
+51e50629f48dbc4f5520a787b4bdfb76f4cd38d3
diff --git a/backend/src/monitor.rs b/backend/src/monitor.rs
index 14acebd13b..0392e128b3 100644
--- a/backend/src/monitor.rs
+++ b/backend/src/monitor.rs
@@ -1061,12 +1061,16 @@ pub async fn reload_otel_tracing_proxy_setting(conn: &Connection) {
                 if current.enabled != new_settings.enabled
                     || current.enabled_languages != new_settings.enabled_languages
                     || current.no_proxy_hosts != new_settings.no_proxy_hosts
+                    || current.insecure_upstream_hosts != new_settings.insecure_upstream_hosts
+                    || current.upstream_ca_certs != new_settings.upstream_ca_certs
                 {
                     tracing::info!(
-                        "OTEL tracing proxy settings changed: enabled={}, languages={:?}, no_proxy_hosts={:?}",
+                        "OTEL tracing proxy settings changed: enabled={}, languages={:?}, no_proxy_hosts={:?}, insecure_upstream_hosts={:?}, upstream_ca_certs={}",
                         new_settings.enabled,
                         new_settings.enabled_languages,
                         new_settings.no_proxy_hosts,
+                        new_settings.insecure_upstream_hosts,
+                        if new_settings.upstream_ca_certs.as_deref().unwrap_or("").trim().is_empty() { "unset" } else { "set" },
                     );
                     *current = new_settings;
                 }
diff --git a/backend/windmill-common/src/instance_config.rs b/backend/windmill-common/src/instance_config.rs
index bb56d5d0cc..74b0647d82 100644
--- a/backend/windmill-common/src/instance_config.rs
+++ b/backend/windmill-common/src/instance_config.rs
@@ -641,6 +641,15 @@ pub struct OtelTracingProxySettings {
     /// pin their own CA (kubectl, helm, terraform providers, aws cli for EKS, etc.).
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub no_proxy_hosts: Option<String>,
+    /// Comma-separated host/IP patterns for which the MITM proxy skips upstream TLS
+    /// verification. Unlike `no_proxy_hosts` the hosts stay traced — only the proxy's own
+    /// upstream certificate check is disabled.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub insecure_upstream_hosts: Option<String>,
+    /// Extra CA certificates (PEM bundle) added to the MITM proxy's upstream trust store,
+    /// on top of the system roots, so internal endpoints signed by a private CA verify.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub upstream_ca_certs: Option<String>,
 }
 
 /// Script language identifier (for instance config use).
diff --git a/backend/windmill-worker/Cargo.toml b/backend/windmill-worker/Cargo.toml
index 5b1047a153..bdc6ec49d6 100644
--- a/backend/windmill-worker/Cargo.toml
+++ b/backend/windmill-worker/Cargo.toml
@@ -13,7 +13,7 @@ default = []
 private = ["windmill-worker-volumes/private", "windmill-queue/private", "windmill-common/private", "windmill-dep-map/private", "windmill-runtime-nativets?/private"]
 mcp = ["windmill-ai/mcp", "dep:windmill-mcp"]
 prometheus = ["dep:prometheus", "windmill-common/prometheus"]
-enterprise = ["windmill-queue/enterprise", "windmill-git-sync/enterprise", "windmill-common/enterprise", "windmill-worker-volumes/enterprise", "windmill-runtime-nativets?/enterprise", "dep:pem", "dep:rsa", "dep:tokio-util", "dep:opentelemetry-proto", "dep:prost", "dep:hudsucker", "dep:rcgen", "dep:hyper-http-proxy", "dep:hyper-tls", "dep:hyper-util"]
+enterprise = ["windmill-queue/enterprise", "windmill-git-sync/enterprise", "windmill-common/enterprise", "windmill-worker-volumes/enterprise", "windmill-runtime-nativets?/enterprise", "dep:pem", "dep:rsa", "dep:tokio-util", "dep:opentelemetry-proto", "dep:prost", "dep:hudsucker", "dep:rcgen", "dep:hyper-http-proxy", "dep:hyper-rustls", "dep:tokio-rustls", "dep:rustls", "dep:rustls-native-certs", "dep:rustls-pemfile", "dep:hyper-util"]
 mssql = ["dep:tiberius"]
 mssql-kerberos = ["mssql", "tiberius/integrated-auth-gssapi"]  # Linux/Unix integrated auth
 mssql-winauth = ["mssql", "tiberius/winauth"]  # Windows integrated auth
@@ -144,7 +144,11 @@ bollard = { workspace = true, optional = true }
 oracle = { workspace = true, optional = true }
 hudsucker = { workspace = true, optional = true }
 hyper-http-proxy = { workspace = true, optional = true }
-hyper-tls = { workspace = true, optional = true }
+hyper-rustls = { workspace = true, optional = true }
+tokio-rustls = { workspace = true, optional = true }
+rustls = { workspace = true, optional = true }
+rustls-native-certs = { workspace = true, optional = true }
+rustls-pemfile = { workspace = true, optional = true }
 hyper-util = { workspace = true, optional = true }
 rcgen = { workspace = true, optional = true }
 
diff --git a/backend/windmill-worker/src/worker.rs b/backend/windmill-worker/src/worker.rs
index 2a4541b095..ece7b03ee7 100644
--- a/backend/windmill-worker/src/worker.rs
+++ b/backend/windmill-worker/src/worker.rs
@@ -283,6 +283,17 @@ pub struct OtelTracingProxySettings {
     pub enabled_languages: HashSet<ScriptLang>,
     #[serde(default)]
     pub no_proxy_hosts: Option<String>,
+    /// Comma-separated host/IP patterns for which the MITM proxy skips upstream TLS
+    /// verification. Unlike `no_proxy_hosts` (which bypasses the proxy entirely, so the
+    /// request goes untraced), these hosts stay traced — only the proxy's own upstream
+    /// certificate check is disabled. Same suffix-matching semantics as `no_proxy_hosts`.
+    #[serde(default)]
+    pub insecure_upstream_hosts: Option<String>,
+    /// Extra CA certificates (PEM bundle) added to the MITM proxy's upstream trust store,
+    /// on top of the system roots. Lets the proxy verify internal endpoints signed by a
+    /// private CA without disabling verification.
+    #[serde(default)]
+    pub upstream_ca_certs: Option<String>,
 }
 
 #[cfg(feature = "prometheus")]
diff --git a/frontend/src/lib/components/InstanceSetting.svelte b/frontend/src/lib/components/InstanceSetting.svelte
index 10e117bb42..95040a7b1f 100644
--- a/frontend/src/lib/components/InstanceSetting.svelte
+++ b/frontend/src/lib/components/InstanceSetting.svelte
@@ -753,6 +753,51 @@
 									upstream relay (e.g. through a corporate proxy).
 								</p>
 							</div>
+							<div class="flex flex-col gap-1">
+								<label
+									for="otel_tracing_proxy_insecure_upstream_hosts"
+									class="block text-xs font-semibold text-emphasis"
+								>
+									Insecure upstream hosts (skip TLS verification)
+								</label>
+								<TextInput
+									inputProps={{
+										type: 'text',
+										placeholder: '10.0.0.5,*.internal,git.corp.example',
+										id: 'otel_tracing_proxy_insecure_upstream_hosts',
+										disabled: !$enterpriseLicense
+									}}
+									bind:value={$values[setting.key].insecure_upstream_hosts}
+								/>
+								<p class="text-xs text-tertiary">
+									Comma-separated host/IP patterns the proxy still traces but for which it skips
+									upstream TLS certificate verification. Use for internal endpoints with
+									self-signed or otherwise untrusted certificates — unlike NO_PROXY above, these
+									requests stay traced. Same matching as NO_PROXY (<code>example.com</code> matches
+									subdomains; <code>.example.com</code> matches subdomains only).
+								</p>
+							</div>
+							<div class="flex flex-col gap-1">
+								<label
+									for="otel_tracing_proxy_upstream_ca_certs"
+									class="block text-xs font-semibold text-emphasis"
+								>
+									Upstream CA certificates (PEM)
+								</label>
+								<textarea
+									id="otel_tracing_proxy_upstream_ca_certs"
+									disabled={!$enterpriseLicense}
+									rows="4"
+									placeholder={'-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----'}
+									bind:value={$values[setting.key].upstream_ca_certs}
+								></textarea>
+								<p class="text-xs text-tertiary">
+									Extra CA certificates added to the proxy's upstream trust store, on top of the
+									system roots. Use this to trace internal endpoints signed by a private CA while
+									keeping certificate verification enabled — preferred over the insecure list above
+									when you have the CA.
+								</p>
+							</div>
 						{/if}
 					</div>
 				{:else if setting.fieldType == 'object_store_config'}

From 1edee8aa34503d2892c1ef7b1deabf99e4b528b4 Mon Sep 17 00:00:00 2001
From: hugocasa <hugo@casademont.ch>
Date: Fri, 17 Jul 2026 18:05:38 +0200
Subject: [PATCH 033/171] perf: lazy-load session preview editor views for
 snappy AI sessions switch (#10172)

* perf: lazy-load session preview editor views to speed up AI sessions switch

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix: stop editor prefetch chain on session page destroy and swallow chunk-load failures

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
---
 .../components/sessions/PreviewTabHost.svelte | 83 ++++++++++++-------
 .../(root)/(logged)/sessions/+page.svelte     | 35 ++++++++
 2 files changed, 88 insertions(+), 30 deletions(-)

diff --git a/frontend/src/lib/components/sessions/PreviewTabHost.svelte b/frontend/src/lib/components/sessions/PreviewTabHost.svelte
index 4972785b78..d41c06c123 100644
--- a/frontend/src/lib/components/sessions/PreviewTabHost.svelte
+++ b/frontend/src/lib/components/sessions/PreviewTabHost.svelte
@@ -8,12 +8,9 @@
 		type SessionPreviewTab
 	} from './sessionState.svelte'
 	import type { SessionRuntime } from './sessionRuntime.svelte'
+	import { Loader2 } from 'lucide-svelte'
 	import { resolvePreviewTab, parsePreviewItemRoute } from './previewRouter'
 	import { withMenuHidden } from './sessionMode.svelte'
-	import ScriptEditorView from './ScriptEditorView.svelte'
-	import FlowEditorView from './FlowEditorView.svelte'
-	import RawAppEditorView from './RawAppEditorView.svelte'
-	import PipelineEditorView from './PipelineEditorView.svelte'
 	import ArtifactViewer from '../copilot/chat/artifacts/ArtifactViewer.svelte'
 
 	let {
@@ -130,38 +127,64 @@
 	$effect(() => () => clearTimeout(flashTimer))
 </script>
 
+{#snippet editorLoading()}
+	<div class="flex-1 flex items-center justify-center text-tertiary">
+		<Loader2 class="animate-spin" />
+	</div>
+{/snippet}
+
 {#if slot.kind === 'editor' && mounted && runtime}
 	<div class="absolute inset-0 flex flex-col min-h-0 bg-surface {visibility}" aria-hidden={!active}>
+		<!-- Dynamic imports: the live editors pull in the heaviest module graphs in
+		     the app (FlowBuilder, ScriptBuilder/Monaco, the raw-app editor, the
+		     pipeline graph). Loading them only when an editor tab first mounts keeps
+		     the /sessions route chunk thin, so entering session mode stays snappy. -->
 		{#if slot.editorKind === 'flow'}
-			<FlowEditorView
-				{runtime}
-				path={slot.path}
-				{workspaceId}
-				{onNavigate}
-				{isActiveSession}
-				{active}
-			/>
+			{#await import('./FlowEditorView.svelte')}
+				{@render editorLoading()}
+			{:then Module}
+				<Module.default
+					{runtime}
+					path={slot.path}
+					{workspaceId}
+					{onNavigate}
+					{isActiveSession}
+					{active}
+				/>
+			{/await}
 		{:else if slot.editorKind === 'script'}
-			<ScriptEditorView
-				{runtime}
-				path={slot.path}
-				{workspaceId}
-				{onNavigate}
-				{isActiveSession}
-				{active}
-				{fullscreen}
-			/>
+			{#await import('./ScriptEditorView.svelte')}
+				{@render editorLoading()}
+			{:then Module}
+				<Module.default
+					{runtime}
+					path={slot.path}
+					{workspaceId}
+					{onNavigate}
+					{isActiveSession}
+					{active}
+					{fullscreen}
+				/>
+			{/await}
 		{:else if slot.editorKind === 'pipeline'}
-			<PipelineEditorView {runtime} path={slot.path} {workspaceId} {isActiveSession} {active} />
+			{#await import('./PipelineEditorView.svelte')}
+				{@render editorLoading()}
+			{:then Module}
+				<Module.default {runtime} path={slot.path} {workspaceId} {isActiveSession} {active} />
+			{/await}
 		{:else}
-			<RawAppEditorView
-				{runtime}
-				path={slot.path}
-				{workspaceId}
-				{onNavigate}
-				{isActiveSession}
-				{active}
-			/>
+			{#await import('./RawAppEditorView.svelte')}
+				{@render editorLoading()}
+			{:then Module}
+				<Module.default
+					{runtime}
+					path={slot.path}
+					{workspaceId}
+					{onNavigate}
+					{isActiveSession}
+					{active}
+				/>
+			{/await}
 		{/if}
 	</div>
 {:else if slot.kind === 'artifact' && mounted}
diff --git a/frontend/src/routes/(root)/(logged)/sessions/+page.svelte b/frontend/src/routes/(root)/(logged)/sessions/+page.svelte
index 7062e8fc8d..958ad92fc3 100644
--- a/frontend/src/routes/(root)/(logged)/sessions/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/sessions/+page.svelte
@@ -70,6 +70,41 @@
 	// iframe context and refuse to mount when embedded.
 	const embedded = typeof window !== 'undefined' && window.self !== window.top
 
+	// Warm the lazily-loaded editor views (see PreviewTabHost) once the page is
+	// idle: entering session mode stays instant, and by the time the user opens
+	// an editor tab its chunk is usually already cached. Sequential so the
+	// prefetch trickles instead of fanning out four heavy graphs at once.
+	$effect(() => {
+		if (embedded || !globalEnabled) return
+		// Once the chain has started, cancelling the idle handle no longer helps —
+		// the disposed check between imports is what stops a user who left session
+		// mode from pulling the remaining graphs on whatever page they went to.
+		// (An import already in flight can't be aborted; only the tail is skipped.)
+		let disposed = false
+		const prefetch = async () => {
+			const loaders = [
+				() => import('$lib/components/sessions/ScriptEditorView.svelte'),
+				() => import('$lib/components/sessions/FlowEditorView.svelte'),
+				() => import('$lib/components/sessions/RawAppEditorView.svelte'),
+				() => import('$lib/components/sessions/PipelineEditorView.svelte')
+			]
+			for (const load of loaders) {
+				if (disposed) return
+				await load()
+			}
+		}
+		// Best-effort warming: swallow chunk-load failures — the {#await} on the
+		// actual open path surfaces (and retries) them.
+		const run = () => void prefetch().catch(() => {})
+		const hasIdle = 'requestIdleCallback' in window
+		const handle = hasIdle ? window.requestIdleCallback(run) : window.setTimeout(run, 2000)
+		return () => {
+			disposed = true
+			if (hasIdle) window.cancelIdleCallback(handle)
+			else window.clearTimeout(handle)
+		}
+	})
+
 	const sessionName = $derived(page.url.searchParams.get('session_name') ?? '')
 
 	// Unfiltered resolution by name — drives the "session not found" fallback and

From 9762089fcbdb33dbf453d22342661e5857b2ad7e Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 17 Jul 2026 18:08:10 +0200
Subject: [PATCH 034/171] fix(schedules): re-arm enabled schedules left with no
 queued occurrence (#10174)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix(schedules): re-arm enabled schedules left with no queued occurrence

* fix(schedules): lock schedule row while re-arming and report outcome

* fix(schedules): make reconcile lock cancellation-safe, re-check armed under lock

Address review feedback on the schedule reconciler:

- Use a transaction-scoped advisory lock (pg_try_advisory_xact_lock) instead of
  a session-scoped one. monitor_db runs under a 600s timeout; on cancellation a
  session lock on a pooled connection would be stranded, wedging reconciliation
  on every replica. An xact lock releases when its transaction is dropped.
- rearm_schedule re-checks for a queued occurrence under the row lock and
  returns NoOp if already armed, closing the scan→lock window that could
  double-push across a cron boundary. Add a regression test.
- Make reconcile_unarmed_schedules private (its only caller is in monitor.rs)
  and document its system-only contract.
- Log the disable only after the guarded UPDATE actually disables the schedule.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(schedules): never disable from reconciliation and cap re-arms per pass

---------

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
---
 ...c87be642091a2f8a6973d001e59be892a984d.json |  26 +++
 backend/src/monitor.rs                        | 193 +++++++++++++++++-
 backend/windmill-queue/src/schedule.rs        | 115 +++++++++++
 backend/windmill-queue/tests/schedule_push.rs | 121 ++++++++++-
 4 files changed, 453 insertions(+), 2 deletions(-)
 create mode 100644 backend/.sqlx/query-2756fab586489be33a3031fabfdc87be642091a2f8a6973d001e59be892a984d.json

diff --git a/backend/.sqlx/query-2756fab586489be33a3031fabfdc87be642091a2f8a6973d001e59be892a984d.json b/backend/.sqlx/query-2756fab586489be33a3031fabfdc87be642091a2f8a6973d001e59be892a984d.json
new file mode 100644
index 0000000000..f9cf82a9fd
--- /dev/null
+++ b/backend/.sqlx/query-2756fab586489be33a3031fabfdc87be642091a2f8a6973d001e59be892a984d.json
@@ -0,0 +1,26 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT s.workspace_id, s.path\n         FROM schedule s JOIN workspace w ON w.id = s.workspace_id AND NOT w.deleted\n         WHERE s.enabled IS TRUE\n             AND NOT EXISTS (\n                 SELECT 1 FROM v2_job_queue q JOIN v2_job j USING (id)\n                 WHERE j.workspace_id = s.workspace_id\n                     AND j.trigger_kind = 'schedule'\n                     AND j.trigger = s.path\n                     AND j.runnable_path = s.script_path\n                     AND j.parent_job IS NULL\n             )",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "workspace_id",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "path",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      false,
+      false
+    ]
+  },
+  "hash": "2756fab586489be33a3031fabfdc87be642091a2f8a6973d001e59be892a984d"
+}
diff --git a/backend/src/monitor.rs b/backend/src/monitor.rs
index 0392e128b3..d1c7a78059 100644
--- a/backend/src/monitor.rs
+++ b/backend/src/monitor.rs
@@ -108,7 +108,11 @@ use windmill_common::{
 };
 #[cfg(feature = "parquet")]
 use windmill_object_store::reload_object_store_setting;
-use windmill_queue::{cancel_job, get_queued_job_v2, SameWorkerPayload};
+use windmill_queue::{
+    cancel_job, get_queued_job_v2,
+    schedule::{find_unarmed_schedules, rearm_schedule, RearmOutcome},
+    SameWorkerPayload,
+};
 use windmill_worker::{
     result_processor::handle_job_error, JobCompletedSender, JobIsolationLevel,
     OtelTracingProxySettings, SameWorkerSender, WorkspaceRegistryMap, BUNFIG_INSTALL_SCOPES,
@@ -3286,6 +3290,15 @@ pub async fn monitor_db(
         }
     };
 
+    // run every 30 iterations (~5min at the default LISTEN_NEW_EVENTS_INTERVAL_SEC).
+    let reconcile_unarmed_schedules_f = async {
+        if server_mode && iteration.is_some() && iteration.as_ref().unwrap().should_run(30) {
+            if let Some(db) = conn.as_sql() {
+                reconcile_unarmed_schedules(&db).await;
+            }
+        }
+    };
+
     // Poll git-sync repositories for new commits and pull them into the
     // workspace (repo → Windmill auto-pull). Runs every 2 iterations.
     let git_auto_pull_f = async {
@@ -3349,9 +3362,144 @@ pub async fn monitor_db(
         cleanup_scheduled_job_deletions_f,
         git_auto_pull_f,
         pipeline_freshness_watchdog_f,
+        reconcile_unarmed_schedules_f,
     );
 }
 
+/// Advisory lock id ensuring only one server replica reconciles schedules at a
+/// time (adjacent to GIT_AUTO_PULL_LOCK_ID).
+const SCHEDULE_RECONCILE_LOCK_ID: i64 = 737_483_922;
+
+/// Consecutive reconciliation passes an enabled schedule must be observed with no
+/// queued occurrence before it is re-armed. The next occurrence is pushed in the
+/// same transaction that completes the previous one (or, for flows, on entry to
+/// step 0), so an unarmed schedule is normally only ever a mid-flight push or a
+/// push being retried. Requiring two passes keeps the reconciler from racing
+/// those and double-pushing an occurrence.
+const SCHEDULE_RECONCILE_STRIKES: u8 = 2;
+
+/// Most schedules re-armed in one pass, so a large first-pass backlog is drained
+/// over several passes instead of enqueuing every occurrence at once.
+const SCHEDULE_RECONCILE_MAX_PER_PASS: usize = 50;
+
+lazy_static::lazy_static! {
+    /// `(workspace_id, path)` -> consecutive passes seen with no queued occurrence.
+    /// Bounded by the number of enabled schedules; entries drop as soon as a
+    /// schedule is seen armed again.
+    static ref UNARMED_SCHEDULES: Mutex<std::collections::HashMap<(String, String), u8>> =
+        Mutex::new(std::collections::HashMap::new());
+}
+
+/// Re-arm enabled schedules that have no queued occurrence.
+///
+/// Every path that completes a scheduled job is supposed to push the next
+/// occurrence atomically, but a run that dies through an abnormal path (a flow
+/// whose status update fails and is later force-completed by zombie detection,
+/// say) can skip that push and leave the schedule enabled yet dead forever. This
+/// is the backstop: without it the only recovery is a manual disable/enable.
+///
+/// Replicas each run their own passes (staggered by `rd_shift`) and each keep
+/// their own strike tally, so the scan cost is per-replica. That is deliberate:
+/// scanning inside the advisory lock is what makes a double-push impossible —
+/// whoever holds it re-reads the unarmed set, so a schedule another replica just
+/// re-armed is seen armed and its tally dropped, rather than pushed twice.
+///
+/// Not an authorization boundary: it re-arms schedules across every workspace, so
+/// this is a system caller (the monitor loop) only.
+async fn reconcile_unarmed_schedules(db: &Pool<Postgres>) {
+    // Transaction-scoped advisory lock, not session-scoped: monitor_db runs under a
+    // 600s timeout, and if it fires the whole future is dropped mid-pass. A session
+    // lock taken on a pooled connection would then ride that connection back into the
+    // pool still held, wedging reconciliation on every replica until the process
+    // restarts. An xact lock is released when its transaction ends — including the
+    // rollback a dropped `Transaction` performs — so cancellation can't strand it.
+    // The tx is held open only to own the lock; the scan and re-arm run on separate
+    // pool connections.
+    let mut lock_tx = match db.begin().await {
+        Ok(tx) => tx,
+        Err(e) => {
+            tracing::error!("schedule reconcile: failed to begin lock tx: {e:#}");
+            return;
+        }
+    };
+    let locked: bool = match sqlx::query_scalar("SELECT pg_try_advisory_xact_lock($1)")
+        .bind(SCHEDULE_RECONCILE_LOCK_ID)
+        .fetch_one(&mut *lock_tx)
+        .await
+    {
+        Ok(v) => v,
+        Err(e) => {
+            tracing::error!("schedule reconcile: advisory lock failed: {e:#}");
+            return;
+        }
+    };
+    if !locked {
+        // Another replica is already reconciling this tick.
+        return;
+    }
+
+    if let Err(e) = reconcile_unarmed_schedules_inner(db).await {
+        tracing::error!("schedule reconcile: {e:#}");
+    }
+
+    // Ends the transaction and releases the xact lock; a plain drop would too.
+    if let Err(e) = lock_tx.rollback().await {
+        tracing::error!("schedule reconcile: releasing lock failed: {e:#}");
+    }
+}
+
+/// Record this pass's unarmed schedules against `seen` and return those that have
+/// now struck out. An armed observation drops the schedule's tally entirely, so
+/// the strikes a re-arm rests on are always consecutive.
+fn strike_unarmed(
+    seen: &mut std::collections::HashMap<(String, String), u8>,
+    current: std::collections::HashSet<(String, String)>,
+) -> Vec<(String, String)> {
+    seen.retain(|k, _| current.contains(k));
+    current
+        .into_iter()
+        .filter(|k| {
+            let strikes = seen.entry(k.clone()).or_insert(0);
+            *strikes = strikes.saturating_add(1);
+            *strikes >= SCHEDULE_RECONCILE_STRIKES
+        })
+        .collect()
+}
+
+async fn reconcile_unarmed_schedules_inner(db: &Pool<Postgres>) -> error::Result<()> {
+    let current = find_unarmed_schedules(db).await?.into_iter().collect();
+    let mut to_rearm = strike_unarmed(&mut UNARMED_SCHEDULES.lock().unwrap(), current);
+
+    // The first pass on an instance that has never been swept can find a large
+    // backlog; re-arming it all at once would enqueue that whole backlog in one
+    // go. The overflow keeps its tally and is picked up next pass.
+    if to_rearm.len() > SCHEDULE_RECONCILE_MAX_PER_PASS {
+        tracing::warn!(
+            "schedule reconcile: {} schedules have no queued occurrence, re-arming {} this pass and the rest on later passes",
+            to_rearm.len(),
+            SCHEDULE_RECONCILE_MAX_PER_PASS
+        );
+        to_rearm.truncate(SCHEDULE_RECONCILE_MAX_PER_PASS);
+    }
+
+    for (w_id, path) in to_rearm {
+        match rearm_schedule(db, &w_id, &path).await {
+            Ok(outcome) => {
+                if outcome == RearmOutcome::Rearmed {
+                    tracing::warn!(
+                        "schedule reconcile: re-armed enabled schedule {path} in {w_id}, which had no queued occurrence"
+                    );
+                }
+                UNARMED_SCHEDULES.lock().unwrap().remove(&(w_id, path));
+            }
+            Err(e) => tracing::error!(
+                "schedule reconcile: could not re-arm schedule {path} in {w_id}: {e:#}"
+            ),
+        }
+    }
+    Ok(())
+}
+
 /// Advisory lock id ensuring only one server replica runs the git auto-pull
 /// poll at a time (adjacent to RESTART_LOCK_ID used for restart coordination).
 #[cfg(feature = "private")]
@@ -5390,3 +5538,46 @@ mod retention_overrides_tests {
         assert!(parse_retention_overrides(over_cap).is_err());
     }
 }
+
+#[cfg(test)]
+mod strike_unarmed_tests {
+    use super::strike_unarmed;
+    use std::collections::{HashMap, HashSet};
+
+    fn key(path: &str) -> (String, String) {
+        ("ws".to_string(), path.to_string())
+    }
+
+    fn set(paths: &[&str]) -> HashSet<(String, String)> {
+        paths.iter().map(|p| key(p)).collect()
+    }
+
+    /// The strike threshold is the only thing keeping the reconciler from racing
+    /// an in-flight push: `push_scheduled_job`'s own `already_exists` guard keys
+    /// on the same columns as the scan, so it is false by construction whenever a
+    /// schedule is found unarmed.
+    #[test]
+    fn rearms_only_after_consecutive_unarmed_passes() {
+        let mut seen = HashMap::new();
+        assert!(strike_unarmed(&mut seen, set(&["a"])).is_empty());
+        assert_eq!(strike_unarmed(&mut seen, set(&["a"])), vec![key("a")]);
+    }
+
+    #[test]
+    fn armed_observation_resets_the_tally() {
+        let mut seen = HashMap::new();
+        assert!(strike_unarmed(&mut seen, set(&["a"])).is_empty());
+        // `a` is armed again on this pass, so its strike must not carry over.
+        assert!(strike_unarmed(&mut seen, set(&[])).is_empty());
+        assert!(strike_unarmed(&mut seen, set(&["a"])).is_empty());
+        assert_eq!(strike_unarmed(&mut seen, set(&["a"])), vec![key("a")]);
+    }
+
+    #[test]
+    fn tallies_are_per_schedule() {
+        let mut seen = HashMap::new();
+        assert!(strike_unarmed(&mut seen, set(&["a"])).is_empty());
+        assert_eq!(strike_unarmed(&mut seen, set(&["a", "b"])), vec![key("a")]);
+        assert_eq!(strike_unarmed(&mut seen, set(&["b"])), vec![key("b")]);
+    }
+}
diff --git a/backend/windmill-queue/src/schedule.rs b/backend/windmill-queue/src/schedule.rs
index 2b5aef96a5..55944b08ca 100644
--- a/backend/windmill-queue/src/schedule.rs
+++ b/backend/windmill-queue/src/schedule.rs
@@ -597,6 +597,121 @@ pub async fn push_scheduled_job<'c>(
     Ok(tx) // TODO: Bubble up pushed UUID from here
 }
 
+/// Enabled schedules with no occurrence in the queue, as `(workspace_id, path)`.
+///
+/// Every path that completes a scheduled job pushes the next occurrence in the
+/// same transaction (for flows, on entry to step 0), so an enabled schedule
+/// always has a queued occurrence — a run in progress is itself one. A run that
+/// dies through an abnormal path can skip that push though, leaving the schedule
+/// enabled yet dead until it is manually disabled and re-enabled. This is how the
+/// monitor spots that state; see `rearm_schedule` for the recovery.
+///
+/// Not an authorization boundary: it reports schedules across every workspace, so
+/// this is for system callers (the monitor's reconciliation pass) only and its
+/// result must never be returned to a user unfiltered.
+pub async fn find_unarmed_schedules(db: &DB) -> Result<Vec<(String, String)>> {
+    let rows = sqlx::query!(
+        // Query plan: the anti-join builds from `v2_job_queue` (only pending and
+        // running jobs) rather than probing `v2_job` once per schedule.
+        "SELECT s.workspace_id, s.path
+         FROM schedule s JOIN workspace w ON w.id = s.workspace_id AND NOT w.deleted
+         WHERE s.enabled IS TRUE
+             AND NOT EXISTS (
+                 SELECT 1 FROM v2_job_queue q JOIN v2_job j USING (id)
+                 WHERE j.workspace_id = s.workspace_id
+                     AND j.trigger_kind = 'schedule'
+                     AND j.trigger = s.path
+                     AND j.runnable_path = s.script_path
+                     AND j.parent_job IS NULL
+             )"
+    )
+    .fetch_all(db)
+    .await?;
+    Ok(rows.into_iter().map(|r| (r.workspace_id, r.path)).collect())
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub enum RearmOutcome {
+    /// The next occurrence was pushed.
+    Rearmed,
+    /// Nothing to do: the schedule was deleted or disabled since it was found.
+    NoOp,
+}
+
+/// Push the next occurrence of a schedule that has none queued.
+///
+/// Only ever starts a schedule, never stops one: re-arming something that did not
+/// need it costs one extra run, whereas wrongly disabling one is the silent
+/// permanent stoppage this whole mechanism exists to prevent. So an occurrence
+/// that cannot be pushed is logged and left alone — the schedule is already not
+/// running, and `try_schedule_next_job` still disables on the completion path,
+/// where the population is limited to actively-cycling schedules. Keep it that
+/// way: this sweeps *every* enabled schedule, including ones broken long before
+/// this code existed and never swept before.
+///
+/// Not an authorization boundary: it pushes under the schedule's own
+/// `permissioned_as` identity for any `(w_id, path)`, so this is for system
+/// callers (the monitor's reconciliation pass) only. A caller acting for a user
+/// MUST already have enforced their permissions on `w_id` and `path`.
+pub async fn rearm_schedule(db: &DB, w_id: &str, path: &str) -> Result<RearmOutcome> {
+    let mut tx = db.begin().await?;
+    // Lock the row for the whole push: an edit or a disable committing between the
+    // read and the push would otherwise leave a queued occurrence for a schedule
+    // that is disabled, or one built from superseded settings.
+    let schedule = sqlx::query_as::<_, Schedule>(
+        "SELECT workspace_id, path, edited_by, edited_at, schedule, timezone, enabled, script_path, is_flow, args, extra_perms, email, permissioned_as, error, on_failure, on_failure_times, on_failure_exact, on_failure_extra_args, on_recovery, on_recovery_times, on_recovery_extra_args, on_success, on_success_extra_args, ws_error_handler_muted, retry, no_flow_overlap, summary, description, tag, paused_until, cron_version, dynamic_skip, labels FROM schedule WHERE path = $1 AND workspace_id = $2 FOR UPDATE",
+    )
+    .bind(path)
+    .bind(w_id)
+    .fetch_optional(&mut *tx)
+    .await?;
+    let Some(schedule) = schedule else {
+        return Ok(RearmOutcome::NoOp);
+    };
+    if !schedule.enabled {
+        return Ok(RearmOutcome::NoOp);
+    }
+    // Re-check for a queued occurrence now that the row is locked: a normal
+    // completion, an edit, or a re-enable could have pushed one between the unarmed
+    // scan and this lock. push_scheduled_job only dedups the exact computed
+    // scheduled_for, so re-arming a schedule that has since become armed and crossed a
+    // cron boundary would queue a second root occurrence. Mirrors the anti-join in
+    // find_unarmed_schedules.
+    let already_armed: bool = sqlx::query_scalar(
+        "SELECT EXISTS (
+             SELECT 1 FROM v2_job_queue q JOIN v2_job j USING (id)
+             WHERE j.workspace_id = $1
+                 AND j.trigger_kind = 'schedule'
+                 AND j.trigger = $2
+                 AND j.runnable_path = $3
+                 AND j.parent_job IS NULL
+         )",
+    )
+    .bind(w_id)
+    .bind(path)
+    .bind(&schedule.script_path)
+    .fetch_one(&mut *tx)
+    .await?;
+    if already_armed {
+        return Ok(RearmOutcome::NoOp);
+    }
+    match push_scheduled_job(db, tx, &schedule, None, None).await {
+        Ok(tx) => {
+            tx.commit().await?;
+            Ok(RearmOutcome::Rearmed)
+        }
+        // An occurrence that can never be pushed (runnable gone, quota blown) is
+        // reported, not acted on — see the note above on why this never disables.
+        Err(err @ (error::Error::NotFound(_) | error::Error::QuotaExceeded(_))) => {
+            tracing::error!(
+                "Could not re-arm schedule {path} in {w_id}: {err}. Leaving it enabled; it will not run until the cause is fixed."
+            );
+            Ok(RearmOutcome::NoOp)
+        }
+        Err(err) => Err(err),
+    }
+}
+
 pub async fn get_schedule_opt<'c>(
     e: impl PgExecutor<'c>,
     w_id: &str,
diff --git a/backend/windmill-queue/tests/schedule_push.rs b/backend/windmill-queue/tests/schedule_push.rs
index e11ced23bc..9ac2e3a143 100644
--- a/backend/windmill-queue/tests/schedule_push.rs
+++ b/backend/windmill-queue/tests/schedule_push.rs
@@ -10,7 +10,9 @@ mod schedule_push {
     use windmill_common::scripts::ScriptHash;
     use windmill_common::users::username_to_permissioned_as;
     use windmill_queue::jobs::{try_schedule_next_job, MiniCompletedJob};
-    use windmill_queue::schedule::push_scheduled_job;
+    use windmill_queue::schedule::{
+        find_unarmed_schedules, push_scheduled_job, rearm_schedule, RearmOutcome,
+    };
 
     fn make_schedule(overrides: impl FnOnce(&mut Schedule)) -> Schedule {
         let mut s = Schedule {
@@ -1762,4 +1764,121 @@ mod schedule_push {
         assert!(!row_exists, "managed schedule row must be deleted");
         Ok(())
     }
+
+    // -----------------------------------------------------------------------
+    // find_unarmed_schedules / rearm_schedule: recovery for a schedule left
+    // enabled with no queued occurrence (a run that died on an abnormal path
+    // skipped its next-occurrence push). Without this the chain stays dead
+    // until the schedule is manually disabled and re-enabled.
+    // -----------------------------------------------------------------------
+
+    async fn insert_schedule(db: &Pool<Postgres>, path: &str, script_path: &str, enabled: bool) {
+        sqlx::query(
+            "INSERT INTO schedule (workspace_id, path, edited_by, edited_at, schedule, timezone, enabled, script_path, is_flow, email, extra_perms, ws_error_handler_muted, no_flow_overlap, permissioned_as)
+             VALUES ('test-workspace', $1, 'test-user', now(), '0 0 */5 * * *', 'UTC', $3, $2, false, 'test@windmill.dev', '{}', false, true, 'u/test-user')",
+        )
+        .bind(path)
+        .bind(script_path)
+        .bind(enabled)
+        .execute(db)
+        .await
+        .unwrap();
+    }
+
+    #[sqlx::test(migrations = "../migrations", fixtures("base", "schedule_push"))]
+    async fn test_find_unarmed_schedules(db: Pool<Postgres>) -> anyhow::Result<()> {
+        insert_schedule(&db, "f/system/test_schedule", "f/system/test_script", true).await;
+        insert_schedule(&db, "f/system/disabled", "f/system/test_script", false).await;
+
+        // No occurrence queued yet: the enabled schedule is unarmed, the disabled one is ignored.
+        assert_eq!(
+            find_unarmed_schedules(&db).await?,
+            vec![(
+                "test-workspace".to_string(),
+                "f/system/test_schedule".to_string()
+            )]
+        );
+
+        // Once an occurrence is queued it is armed and must not be reported —
+        // re-arming it would double-push the occurrence.
+        let tx = db.begin().await?;
+        let tx = push_scheduled_job(&db, tx, &make_schedule(|_| {}), None, None).await?;
+        tx.commit().await?;
+        assert_eq!(count_queued_jobs(&db).await, 1);
+        assert!(find_unarmed_schedules(&db).await?.is_empty());
+        Ok(())
+    }
+
+    #[sqlx::test(migrations = "../migrations", fixtures("base", "schedule_push"))]
+    async fn test_rearm_schedule_pushes_next_occurrence(db: Pool<Postgres>) -> anyhow::Result<()> {
+        insert_schedule(&db, "f/system/test_schedule", "f/system/test_script", true).await;
+
+        assert_eq!(
+            rearm_schedule(&db, "test-workspace", "f/system/test_schedule").await?,
+            RearmOutcome::Rearmed
+        );
+
+        assert_eq!(count_queued_jobs(&db).await, 1);
+        assert!(find_unarmed_schedules(&db).await?.is_empty());
+        Ok(())
+    }
+
+    #[sqlx::test(migrations = "../migrations", fixtures("base", "schedule_push"))]
+    async fn test_rearm_schedule_skips_disabled(db: Pool<Postgres>) -> anyhow::Result<()> {
+        // A disable that lands between the scan and the re-arm must win: pushing an
+        // occurrence for a disabled schedule would resurrect a schedule the user
+        // just turned off.
+        insert_schedule(&db, "f/system/test_schedule", "f/system/test_script", false).await;
+
+        assert_eq!(
+            rearm_schedule(&db, "test-workspace", "f/system/test_schedule").await?,
+            RearmOutcome::NoOp
+        );
+        assert_eq!(count_queued_jobs(&db).await, 0);
+        Ok(())
+    }
+
+    #[sqlx::test(migrations = "../migrations", fixtures("base", "schedule_push"))]
+    async fn test_rearm_schedule_never_disables(db: Pool<Postgres>) -> anyhow::Result<()> {
+        insert_schedule(&db, "f/system/bad_schedule", "f/system/nonexistent", true).await;
+
+        // Reconciliation only ever starts a schedule. An unpushable occurrence is
+        // reported and left alone: this sweeps every enabled schedule in the
+        // instance, so disabling here would turn a wrong invariant into the exact
+        // silent stoppage the reconciler exists to undo.
+        assert_eq!(
+            rearm_schedule(&db, "test-workspace", "f/system/bad_schedule").await?,
+            RearmOutcome::NoOp
+        );
+
+        assert_eq!(count_queued_jobs(&db).await, 0);
+        let (enabled, error): (bool, Option<String>) = sqlx::query_as(
+            "SELECT enabled, error FROM schedule WHERE workspace_id = 'test-workspace' AND path = 'f/system/bad_schedule'",
+        )
+        .fetch_one(&db)
+        .await?;
+        assert!(enabled, "reconciliation must never disable a schedule");
+        assert!(error.is_none());
+        Ok(())
+    }
+
+    #[sqlx::test(migrations = "../migrations", fixtures("base", "schedule_push"))]
+    async fn test_rearm_schedule_skips_already_armed(db: Pool<Postgres>) -> anyhow::Result<()> {
+        // An occurrence can be queued (a normal completion, an edit, a re-enable)
+        // between the unarmed scan and rearm_schedule acquiring the row lock. Re-arming
+        // then would double-push, since push_scheduled_job only dedups the exact
+        // computed scheduled_for.
+        insert_schedule(&db, "f/system/test_schedule", "f/system/test_script", true).await;
+        let tx = db.begin().await?;
+        let tx = push_scheduled_job(&db, tx, &make_schedule(|_| {}), None, None).await?;
+        tx.commit().await?;
+        assert_eq!(count_queued_jobs(&db).await, 1);
+
+        assert_eq!(
+            rearm_schedule(&db, "test-workspace", "f/system/test_schedule").await?,
+            RearmOutcome::NoOp
+        );
+        assert_eq!(count_queued_jobs(&db).await, 1);
+        Ok(())
+    }
 }

From 2ff5a918d54074bc340b6e92222e9f5bb4369ba0 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 17 Jul 2026 18:18:54 +0200
Subject: [PATCH 035/171] feat(worker-tags): add `*` fork marker to
 workspace-scoped custom tags (#10177)

* feat(worker-tags): add `*` fork marker to workspace-scoped custom tags

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* test(worker-tags): pin fork-marker tag admission through real lineage

Also render WorkspaceMatcher in its authored form in the operator-facing
"not in the allowed CUSTOM_TAGS" error, and correct the authorization note
on workspace_with_fork_ancestors.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(worker-tags): gate fork-lineage tag lookup on workspace membership

exists_workers_with_tags is a global route whose workspace is a query
param. Resolving its fork lineage for a caller who is not a member
disclosed whether an arbitrary workspace descends from one named by a
tag(parent*) rule. Require membership before the lineage lookup, and
sharpen the workspace_with_fork_ancestors contract accordingly.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore(sqlx): add offline cache for fork-marker test INSERT query

The new test_fork_marker_tag_admission_through_lineage integration test
inserts a fork workspace with a bind-parameterized query that had no
cached entry, failing the SQLX_OFFLINE=true CI build.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 ...27d1e30b63c946a4eb640e55850100c3edd3c.json |  14 ++
 backend/tests/worker.rs                       |  63 +++++-
 backend/windmill-api-workers/src/lib.rs       |  23 ++-
 backend/windmill-common/src/jobs.rs           |  14 +-
 backend/windmill-common/src/worker.rs         | 195 ++++++++++++++++--
 backend/windmill-common/src/workspaces.rs     |  15 ++
 .../lib/components/AssignableTagsInner.svelte |  23 ++-
 7 files changed, 312 insertions(+), 35 deletions(-)
 create mode 100644 backend/.sqlx/query-be21088e8b88e01b50a544f220e27d1e30b63c946a4eb640e55850100c3edd3c.json

diff --git a/backend/.sqlx/query-be21088e8b88e01b50a544f220e27d1e30b63c946a4eb640e55850100c3edd3c.json b/backend/.sqlx/query-be21088e8b88e01b50a544f220e27d1e30b63c946a4eb640e55850100c3edd3c.json
new file mode 100644
index 0000000000..a0697321be
--- /dev/null
+++ b/backend/.sqlx/query-be21088e8b88e01b50a544f220e27d1e30b63c946a4eb640e55850100c3edd3c.json
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace (id, name, owner, parent_workspace_id)\n         VALUES ($1, $1, 'test-user', 'test-workspace')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "be21088e8b88e01b50a544f220e27d1e30b63c946a4eb640e55850100c3edd3c"
+}
diff --git a/backend/tests/worker.rs b/backend/tests/worker.rs
index 2349d476b7..3140cd2d7f 100644
--- a/backend/tests/worker.rs
+++ b/backend/tests/worker.rs
@@ -5338,9 +5338,10 @@ async fn test_duckdb_ffi(db: Pool<Postgres>) -> anyhow::Result<()> {
 /// This validates that `check_tag_available_for_workspace_internal` is properly called
 /// when pushing jobs from worker_flow.
 #[sqlx::test(fixtures("base"))]
+#[serial]
 async fn test_flow_substep_tag_availability_check(db: Pool<Postgres>) -> anyhow::Result<()> {
     use windmill_common::worker::{
-        CustomTags, SpecificTagData, SpecificTagType, CUSTOM_TAGS_PER_WORKSPACE,
+        CustomTags, SpecificTagData, SpecificTagType, WorkspaceMatcher, CUSTOM_TAGS_PER_WORKSPACE,
     };
 
     initialize_tracing().await;
@@ -5354,7 +5355,10 @@ async fn test_flow_substep_tag_availability_check(db: Pool<Postgres>) -> anyhow:
             "restricted-tag".to_string(),
             SpecificTagData {
                 tag_type: SpecificTagType::NoneExcept,
-                workspaces: vec!["other-workspace".to_string()],
+                workspaces: vec![WorkspaceMatcher {
+                    id: "other-workspace".to_string(),
+                    include_forks: false,
+                }],
             },
         )]),
     }));
@@ -5404,6 +5408,61 @@ async fn test_flow_substep_tag_availability_check(db: Pool<Postgres>) -> anyhow:
     Ok(())
 }
 
+/// The `*` fork marker only grants through a real `parent_workspace_id` lineage lookup, which the
+/// parse-level unit tests cannot reach: they hand `applies_to_workspace` a synthetic chain, so a
+/// regression in the lookup or in the `is_fork_scoped()` gate that skips it would pass them.
+#[sqlx::test(fixtures("base"))]
+#[serial]
+async fn test_fork_marker_tag_admission_through_lineage(db: Pool<Postgres>) -> anyhow::Result<()> {
+    use windmill_common::jobs::check_tag_available_for_workspace_internal;
+    use windmill_common::worker::{CustomTags, CUSTOM_TAGS_PER_WORKSPACE};
+
+    initialize_tracing().await;
+
+    // The ancestor chain is cached process-wide by workspace id, so use one no other test takes.
+    let fork = "wm-fork-tagmarker";
+    sqlx::query!(
+        "INSERT INTO workspace (id, name, owner, parent_workspace_id)
+         VALUES ($1, $1, 'test-user', 'test-workspace')",
+        fork
+    )
+    .execute(&db)
+    .await?;
+
+    CUSTOM_TAGS_PER_WORKSPACE.store(std::sync::Arc::new(CustomTags::from(vec![
+        "forky(test-workspace*)".to_string(),
+        "bare(test-workspace)".to_string(),
+    ])));
+
+    // test2 is not a superadmin, who would bypass the scope check entirely.
+    let email = "test2@windmill.dev";
+
+    for (w_id, tag) in [("test-workspace", "bare"), ("test-workspace", "forky")] {
+        assert!(
+            check_tag_available_for_workspace_internal(&db, w_id, tag, email, None)
+                .await
+                .is_ok(),
+            "{tag} should be available in the workspace it names"
+        );
+    }
+    assert!(
+        check_tag_available_for_workspace_internal(&db, fork, "forky", email, None)
+            .await
+            .is_ok(),
+        "a `*` tag must be granted to a fork through its parent lineage"
+    );
+    assert!(
+        check_tag_available_for_workspace_internal(&db, fork, "bare", email, None)
+            .await
+            .is_err(),
+        "an unmarked tag must not reach a fork of the workspace it names"
+    );
+
+    CUSTOM_TAGS_PER_WORKSPACE.store(std::sync::Arc::new(CustomTags::default()));
+
+    Ok(())
+}
+
 #[cfg(all(feature = "quickjs", feature = "python"))]
 #[sqlx::test(fixtures("base"))]
 async fn test_whileloop_propagates_inner_iterator_eval_failure(
diff --git a/backend/windmill-api-workers/src/lib.rs b/backend/windmill-api-workers/src/lib.rs
index d65316555e..f33e12470f 100644
--- a/backend/windmill-api-workers/src/lib.rs
+++ b/backend/windmill-api-workers/src/lib.rs
@@ -21,6 +21,7 @@ use windmill_common::{
     jobs::{HIDE_WORKERS_FOR_NON_ADMINS, TAGS_ARE_SENSITIVE},
     utils::{paginate, Pagination},
     worker::{ALL_TAGS, CUSTOM_TAGS_PER_WORKSPACE, DEFAULT_TAGS, DEFAULT_TAGS_PER_WORKSPACE},
+    workspaces::workspace_with_fork_ancestors,
     DB,
 };
 
@@ -161,9 +162,25 @@ async fn exists_workers_with_tags(
         let has_devops_role = require_devops_role(&db, &authed.email).await.is_ok();
         if !has_devops_role {
             if let Some(ref workspace) = tags_query.workspace {
+                // This route is global, so the workspace is an unauthorized query param: check
+                // membership before reading its lineage, which would otherwise disclose whether
+                // an arbitrary workspace descends from one named by a `tag(parent*)` rule.
+                let is_member = sqlx::query_scalar!(
+                    "SELECT EXISTS(SELECT 1 FROM usr WHERE workspace_id = $1 AND email = $2 AND NOT disabled)",
+                    workspace,
+                    &authed.email
+                )
+                .fetch_one(&db)
+                .await?
+                .unwrap_or(false);
+                if !is_member {
+                    return Ok(Json(std::collections::HashMap::new()));
+                }
+
                 // Filter to only tags visible in this workspace
+                let chain = workspace_with_fork_ancestors(&db, workspace).await?;
                 let custom_tags = CUSTOM_TAGS_PER_WORKSPACE.load();
-                let allowed_tags = custom_tags.to_string_vec(Some(workspace.clone()));
+                let allowed_tags = custom_tags.to_string_vec(Some(&chain));
                 tags.retain(|t| allowed_tags.contains(t));
             } else {
                 // No workspace provided and not superadmin - return empty
@@ -222,10 +239,12 @@ async fn get_custom_tags(
 
 async fn get_custom_tags_for_workspace(
     _authed: ApiAuthed,
+    Extension(db): Extension<DB>,
     Path(w_id): Path<String>,
 ) -> JsonResult<Vec<String>> {
+    let chain = workspace_with_fork_ancestors(&db, &w_id).await?;
     let tags_o = CUSTOM_TAGS_PER_WORKSPACE.load();
-    let all_tags = tags_o.to_string_vec(Some(w_id));
+    let all_tags = tags_o.to_string_vec(Some(&chain));
     Ok(Json(all_tags))
 }
 
diff --git a/backend/windmill-common/src/jobs.rs b/backend/windmill-common/src/jobs.rs
index 2178d9a023..d73637026a 100644
--- a/backend/windmill-common/src/jobs.rs
+++ b/backend/windmill-common/src/jobs.rs
@@ -20,6 +20,7 @@ use crate::{
     users::username_to_permissioned_as,
     utils::{StripPath, HTTP_CLIENT},
     worker::{to_raw_value, CUSTOM_TAGS_PER_WORKSPACE, WINDMILL_DIR},
+    workspaces::workspace_with_fork_ancestors,
     FlowVersionInfo, ScriptHashInfo, Tag,
 };
 
@@ -343,8 +344,8 @@ lazy_static::lazy_static! {
     ).unwrap_or(false);
 }
 
-pub async fn check_tag_available_for_workspace_internal<'c>(
-    db: impl sqlx::PgExecutor<'c>,
+pub async fn check_tag_available_for_workspace_internal(
+    db: &DB,
     w_id: &str,
     tag: &str,
     email: &str,
@@ -361,7 +362,14 @@ pub async fn check_tag_available_for_workspace_internal<'c>(
     if custom_tags_per_w.global.contains(&tag.to_string()) {
         is_tag_in_workspace_custom_tags = true;
     } else if let Some(specific_tag) = custom_tags_per_w.specific.get(tag) {
-        is_tag_in_workspace_custom_tags = specific_tag.applies_to_workspace(w_id);
+        // Only a fork-scoped tag can match through the lineage, so every other tag keeps the
+        // ancestor lookup off the push path entirely.
+        let chain = if specific_tag.is_fork_scoped() {
+            workspace_with_fork_ancestors(db, w_id).await?
+        } else {
+            vec![w_id.to_string()]
+        };
+        is_tag_in_workspace_custom_tags = specific_tag.applies_to_workspace(&chain);
     }
 
     match is_tag_in_scope_tags {
diff --git a/backend/windmill-common/src/worker.rs b/backend/windmill-common/src/worker.rs
index ea2b5455f3..eb339b56f8 100644
--- a/backend/windmill-common/src/worker.rs
+++ b/backend/windmill-common/src/worker.rs
@@ -52,10 +52,10 @@ impl CustomTags {
                 let tag_name = cap.get(1).unwrap().as_str().to_string();
                 let workspace_str = cap.get(2).unwrap().as_str();
                 let tag_type = SpecificTagType::from_regex_string(workspace_str);
-                let workspaces: Vec<String> = workspace_str
+                let workspaces: Vec<WorkspaceMatcher> = workspace_str
                     .split(tag_type.corresponding_separator())
                     .filter(|s| !s.is_empty())
-                    .map(str::to_string)
+                    .map(WorkspaceMatcher::parse)
                     .collect();
                 if workspaces.is_empty() {
                     tracing::warn!("Ignoring tag `{}` with empty exclusion/inclusion list", e);
@@ -70,11 +70,13 @@ impl CustomTags {
         Self { global, specific }
     }
 
-    pub fn to_string_vec(&self, filter_with_workspace: Option<String>) -> Vec<String> {
-        let specific = if let Some(workspace) = filter_with_workspace {
+    /// `filter_with_workspace` is the workspace's id chain (see [`SpecificTagData::applies_to_workspace`]);
+    /// `None` re-emits the authored `tag(ws1+ws2)` strings for the settings editor.
+    pub fn to_string_vec(&self, filter_with_workspace: Option<&[String]>) -> Vec<String> {
+        let specific = if let Some(chain) = filter_with_workspace {
             self.specific
                 .iter()
-                .filter(|(_, tag_data)| tag_data.applies_to_workspace(&workspace))
+                .filter(|(_, tag_data)| tag_data.applies_to_workspace(chain))
                 .map(|(tag, _)| tag.clone())
                 .collect::<Vec<String>>()
         } else {
@@ -82,7 +84,12 @@ impl CustomTags {
                 .iter()
                 .map(|(tag, tag_data)| {
                     let separator = tag_data.tag_type.corresponding_separator();
-                    let mut workspaces = tag_data.workspaces.join(&*separator.to_string());
+                    let mut workspaces = tag_data
+                        .workspaces
+                        .iter()
+                        .map(|w| w.to_string())
+                        .collect::<Vec<_>>()
+                        .join(&*separator.to_string());
                     if tag_data.tag_type == SpecificTagType::AllExcluding {
                         // the AllExcluding tag syntax has a leading separator
                         workspaces.insert(0, separator);
@@ -95,19 +102,86 @@ impl CustomTags {
         all_tags.into_iter().chain(specific.into_iter()).collect()
     }
 }
+
+/// Marker suffixed to a workspace id inside a custom tag's scope (`mytag(prod*)`) to extend the
+/// entry to that workspace's forks. `*` cannot appear in a workspace id (the `proper_id` check
+/// constraint restricts them to `^\w+(-\w+)*$`), so it can never collide with a real id.
+pub const FORK_SCOPE_MARKER: char = '*';
+
+/// One workspace entry in a custom tag's scope. Bare (`prod`) matches that workspace only;
+/// with the [`FORK_SCOPE_MARKER`] (`prod*`) it also matches its forks, transitively.
+///
+/// The marker is opt-in in BOTH scope forms so that no existing tag string changes meaning:
+/// `sensitive(^prod)` keeps excluding only `prod` itself, and `sensitive(^prod*)` is how you
+/// exclude its forks too.
+#[derive(Clone, Serialize, Deserialize, PartialEq)]
+pub struct WorkspaceMatcher {
+    pub id: String,
+    pub include_forks: bool,
+}
+
+impl WorkspaceMatcher {
+    fn parse(entry: &str) -> Self {
+        match entry.strip_suffix(FORK_SCOPE_MARKER) {
+            Some(id) => Self { id: id.to_string(), include_forks: true },
+            None => Self { id: entry.to_string(), include_forks: false },
+        }
+    }
+
+    fn matches(&self, workspace_id: &str, fork_ancestors: &[String]) -> bool {
+        workspace_id == self.id
+            || (self.include_forks && fork_ancestors.iter().any(|a| *a == self.id))
+    }
+}
+
+impl std::fmt::Display for WorkspaceMatcher {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(&self.id)?;
+        if self.include_forks {
+            f.write_str(FORK_SCOPE_MARKER.encode_utf8(&mut [0u8; 4]))?;
+        }
+        Ok(())
+    }
+}
+
+/// Renders the authored `prod` / `prod*` form rather than the struct fields: `CustomTags` is
+/// `{:?}`-dumped into the "tag is not in the allowed CUSTOM_TAGS" error operators see.
+impl std::fmt::Debug for WorkspaceMatcher {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        std::fmt::Debug::fmt(&self.to_string(), f)
+    }
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
 pub struct SpecificTagData {
     pub tag_type: SpecificTagType,
-    pub workspaces: Vec<String>,
+    pub workspaces: Vec<WorkspaceMatcher>,
 }
 
 impl SpecificTagData {
-    pub fn applies_to_workspace(&self, workspace_id: &str) -> bool {
+    /// `chain` is the workspace itself followed by its fork ancestors, nearest-first, as built by
+    /// `workspaces::workspace_with_fork_ancestors`. Pass a single-element slice when
+    /// [`Self::is_fork_scoped`] is false: the ancestors cannot affect the outcome then.
+    pub fn applies_to_workspace(&self, chain: &[String]) -> bool {
+        let Some((workspace_id, fork_ancestors)) = chain.split_first() else {
+            return false;
+        };
+        let matched = self
+            .workspaces
+            .iter()
+            .any(|w| w.matches(workspace_id, fork_ancestors));
         match self.tag_type {
-            SpecificTagType::AllExcluding => !self.workspaces.contains(&workspace_id.to_string()),
-            SpecificTagType::NoneExcept => self.workspaces.contains(&workspace_id.to_string()),
+            SpecificTagType::AllExcluding => !matched,
+            SpecificTagType::NoneExcept => matched,
         }
     }
+
+    /// Whether any entry carries the fork marker, i.e. whether resolving the workspace's fork
+    /// lineage can change what [`Self::applies_to_workspace`] returns. Lets hot callers skip the
+    /// lineage lookup for the (overwhelmingly common) fork-agnostic tag.
+    pub fn is_fork_scoped(&self) -> bool {
+        self.workspaces.iter().any(|w| w.include_forks)
+    }
 }
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
 pub enum SpecificTagType {
@@ -295,12 +369,14 @@ lazy_static::lazy_static! {
     //    ^([\w-]+)         # Group 1: tag name
     //    \(                # Literal '('
     //    (                 # Group 2: the full workspace list
-    //      (?:[\w-]+\+)*[\w-]+     # NoneExcept pattern: ws1+ws2
-    //      |                      # OR
-    //      (?:\^[\w-]+)+          # AllExcluding pattern: ^ws1^ws2
+    //      (?:[\w-]+\*?\+)*[\w-]+\*?   # NoneExcept pattern: ws1+ws2*
+    //      |                          # OR
+    //      (?:\^[\w-]+\*?)+           # AllExcluding pattern: ^ws1^ws2*
     //    )
     //    \)$               # Closing ')'
-    static ref CUSTOM_TAG_REGEX: Regex = Regex::new(r"^([\w-]+)\(((?:[\w-]+\+)*[\w-]+|(?:\^[\w-]+)+)\)$").unwrap();
+    //
+    // The optional `*` after each workspace id is the fork marker, see [`WorkspaceMatcher`].
+    static ref CUSTOM_TAG_REGEX: Regex = Regex::new(r"^([\w-]+)\(((?:[\w-]+\*?\+)*[\w-]+\*?|(?:\^[\w-]+\*?)+)\)$").unwrap();
 
     pub static ref DISABLE_BUNDLING: bool = std::env::var("DISABLE_BUNDLING")
     .ok()
@@ -2332,6 +2408,19 @@ mod tests {
     use super::*;
     use std::collections::HashMap;
 
+    fn matcher(id: &str) -> WorkspaceMatcher {
+        WorkspaceMatcher { id: id.to_string(), include_forks: false }
+    }
+
+    fn fork_matcher(id: &str) -> WorkspaceMatcher {
+        WorkspaceMatcher { id: id.to_string(), include_forks: true }
+    }
+
+    /// A workspace id chain: the workspace itself, then its fork ancestors nearest-first.
+    fn chain(ids: &[&str]) -> Vec<String> {
+        ids.iter().map(|s| s.to_string()).collect()
+    }
+
     #[test]
     fn test_bash_sandbox_image_annotation() {
         // `# sandbox <image>` selects the container runtime and returns the image.
@@ -2430,14 +2519,14 @@ mod tests {
             "feat".to_string(),
             SpecificTagData {
                 tag_type: SpecificTagType::NoneExcept,
-                workspaces: vec!["ws1".to_string(), "ws2".to_string()],
+                workspaces: vec![matcher("ws1"), matcher("ws2")],
             },
         );
         expected.insert(
             "hotfix".to_string(),
             SpecificTagData {
                 tag_type: SpecificTagType::AllExcluding,
-                workspaces: vec!["ws3".to_string(), "ws4".to_string()],
+                workspaces: vec![matcher("ws3"), matcher("ws4")],
             },
         );
 
@@ -2480,7 +2569,7 @@ mod tests {
 
         let data = tags.specific.get("urgent").unwrap();
         assert_eq!(data.tag_type, SpecificTagType::NoneExcept);
-        assert_eq!(data.workspaces, vec!["ws1", "ws2"]);
+        assert_eq!(data.workspaces, vec![matcher("ws1"), matcher("ws2")]);
     }
 
     #[test]
@@ -2493,7 +2582,7 @@ mod tests {
 
         let data = tags.specific.get("legacy").unwrap();
         assert_eq!(data.tag_type, SpecificTagType::AllExcluding);
-        assert_eq!(data.workspaces, vec!["ws1", "ws2"]);
+        assert_eq!(data.workspaces, vec![matcher("ws1"), matcher("ws2")]);
     }
 
     #[test]
@@ -2510,10 +2599,10 @@ mod tests {
         let input = vec!["urgent(ws1+ws2)".to_string()];
         let tags = CustomTags::from(input);
 
-        let output = tags.to_string_vec(Some("ws1".to_string()));
+        let output = tags.to_string_vec(Some(&chain(&["ws1"])));
         assert_eq!(output, vec!["urgent"]);
 
-        let output_none = tags.to_string_vec(Some("ws3".to_string()));
+        let output_none = tags.to_string_vec(Some(&chain(&["ws3"])));
         assert!(output_none.is_empty());
     }
 
@@ -2522,10 +2611,10 @@ mod tests {
         let input = vec!["legacy(^ws1^ws2)".to_string()];
         let tags = CustomTags::from(input);
 
-        let output = tags.to_string_vec(Some("ws3".to_string()));
+        let output = tags.to_string_vec(Some(&chain(&["ws3"])));
         assert_eq!(output, vec!["legacy"]);
 
-        let output_excluded = tags.to_string_vec(Some("ws1".to_string()));
+        let output_excluded = tags.to_string_vec(Some(&chain(&["ws1"])));
         assert!(output_excluded.is_empty());
     }
 
@@ -2543,6 +2632,68 @@ mod tests {
         assert_eq!(result, vec!["foo", "legacy(^ws1^ws2)", "urgent(ws1+ws2)"]);
     }
 
+    #[test]
+    fn test_fork_marker_parses_and_round_trips() {
+        let tags = CustomTags::from(vec![
+            "urgent(prod*+ws2)".to_string(),
+            "legacy(^prod*)".to_string(),
+        ]);
+
+        let urgent = tags.specific.get("urgent").unwrap();
+        assert_eq!(
+            urgent.workspaces,
+            vec![fork_matcher("prod"), matcher("ws2")]
+        );
+        assert!(urgent.is_fork_scoped());
+
+        let legacy = tags.specific.get("legacy").unwrap();
+        assert_eq!(legacy.workspaces, vec![fork_matcher("prod")]);
+
+        // The settings editor re-emits what it parsed; dropping `*` here would silently widen
+        // an excluding tag / narrow an including one on every save.
+        let mut result = tags.to_string_vec(None);
+        result.sort();
+        assert_eq!(result, vec!["legacy(^prod*)", "urgent(prod*+ws2)"]);
+    }
+
+    #[test]
+    fn test_fork_marker_extends_none_except_to_forks_only_when_present() {
+        let fork = chain(&["wm-fork-x", "prod"]);
+        let nested = chain(&["wm-fork-y", "wm-fork-x", "prod"]);
+
+        let marked = CustomTags::from(vec!["urgent(prod*)".to_string()]);
+        let marked = marked.specific.get("urgent").unwrap();
+        assert!(marked.applies_to_workspace(&chain(&["prod"])));
+        assert!(marked.applies_to_workspace(&fork));
+        assert!(marked.applies_to_workspace(&nested));
+        assert!(!marked.applies_to_workspace(&chain(&["wm-fork-z", "other"])));
+
+        // Without the marker a fork must NOT inherit the parent's tag.
+        let unmarked = CustomTags::from(vec!["urgent(prod)".to_string()]);
+        let unmarked = unmarked.specific.get("urgent").unwrap();
+        assert!(unmarked.applies_to_workspace(&chain(&["prod"])));
+        assert!(!unmarked.applies_to_workspace(&fork));
+        // Gates the ancestor lookup, so a wrong answer here silently disables the marker.
+        assert!(!unmarked.is_fork_scoped());
+    }
+
+    #[test]
+    fn test_fork_marker_extends_all_excluding_to_forks_only_when_present() {
+        let fork = chain(&["wm-fork-x", "prod"]);
+
+        // Pre-existing exclusions keep their exact meaning: only `prod` itself is excluded.
+        let unmarked = CustomTags::from(vec!["legacy(^prod)".to_string()]);
+        let unmarked = unmarked.specific.get("legacy").unwrap();
+        assert!(!unmarked.applies_to_workspace(&chain(&["prod"])));
+        assert!(unmarked.applies_to_workspace(&fork));
+
+        let marked = CustomTags::from(vec!["legacy(^prod*)".to_string()]);
+        let marked = marked.specific.get("legacy").unwrap();
+        assert!(!marked.applies_to_workspace(&chain(&["prod"])));
+        assert!(!marked.applies_to_workspace(&fork));
+        assert!(marked.applies_to_workspace(&chain(&["other"])));
+    }
+
     #[test]
     fn test_dedicated_worker_tag_short() {
         let tag = dedicated_worker_tag("demo", "u/alice/script");
diff --git a/backend/windmill-common/src/workspaces.rs b/backend/windmill-common/src/workspaces.rs
index 33c80cea4b..972cc0a028 100644
--- a/backend/windmill-common/src/workspaces.rs
+++ b/backend/windmill-common/src/workspaces.rs
@@ -1420,6 +1420,21 @@ pub async fn fork_ancestor_chain(db: &crate::DB, w_id: &str) -> Result<Vec<Strin
     Ok(chain)
 }
 
+/// `w_id` followed by its fork ancestors, nearest-first: the id sequence to match a
+/// workspace-scoped rule against when the rule can extend to a fork subtree.
+///
+/// Reads lineage for any `w_id` with no authorization check, like [`fork_ancestor_chain`], so the
+/// caller must already be authorized for `w_id`: routes that take it from the path get that from
+/// `ApiAuthed`, but a caller-supplied id must be membership-checked first. Otherwise even using
+/// the chain only for a scoping decision discloses whether an arbitrary workspace descends from
+/// one the rule names.
+pub async fn workspace_with_fork_ancestors(db: &crate::DB, w_id: &str) -> Result<Vec<String>> {
+    let mut chain = Vec::with_capacity(4);
+    chain.push(w_id.to_string());
+    chain.extend(fork_ancestor_chain(db, w_id).await?);
+    Ok(chain)
+}
+
 pub async fn get_ducklake_from_db_unchecked(
     name: &str,
     w_id: &str,
diff --git a/frontend/src/lib/components/AssignableTagsInner.svelte b/frontend/src/lib/components/AssignableTagsInner.svelte
index cfca54bc99..cda34487af 100644
--- a/frontend/src/lib/components/AssignableTagsInner.svelte
+++ b/frontend/src/lib/components/AssignableTagsInner.svelte
@@ -37,9 +37,14 @@
 
 	const dispatch = createEventDispatcher()
 
-	const customTagRegex = /^([\w-]+)\(((?:[\w-]+\+)*[\w-]+|(?:\^[\w-]+)+)\)$/
+	// Mirrors CUSTOM_TAG_REGEX in backend/windmill-common/src/worker.rs — keep both in sync.
+	const customTagRegex = /^([\w-]+)\(((?:[\w-]+\*?\+)*[\w-]+\*?|(?:\^[\w-]+\*?)+)\)$/
 	const dynamicTagRegex = /\$args\[((?:\w+\.)*\w+)\]/
 
+	function formatWorkspace(w: { id: string; includeForks: boolean }) {
+		return w.includeForks ? `${w.id} (and its forks)` : w.id
+	}
+
 	let dynamicTag = $derived.by(() => {
 		let r = newTag.trim()
 		if (r == '') return undefined
@@ -51,14 +56,16 @@
 		let r = newTag.trim()
 		if (r == '') return undefined
 		let matched = r.match(customTagRegex)
-		console.log(matched)
 		let tag = matched?.[1]
 		let workspaces_raw = matched?.[2]
 		let tag_type = workspaces_raw?.includes('^') ? 'exclude' : 'include'
 		if (tag_type == 'exclude') {
 			workspaces_raw = workspaces_raw?.slice(1)
 		}
-		let workspaces = workspaces_raw?.split(tag_type == 'include' ? '+' : '^')
+		let workspaces = workspaces_raw?.split(tag_type == 'include' ? '+' : '^').map((w) => {
+			const includeForks = w.endsWith('*')
+			return { id: includeForks ? w.slice(0, -1) : w, includeForks }
+		})
 		if (!workspaces_raw || workspaces_raw?.length == 0) {
 			return undefined
 		}
@@ -163,14 +170,14 @@
 				<div>
 					<b>Workspaces:</b>
 					{#if extractedCustomTag.tag_type == 'include'}
-						{extractedCustomTag.workspaces?.join(', ')}
+						{extractedCustomTag.workspaces?.map(formatWorkspace).join(', ')}
 					{:else}
-						All workspaces except {extractedCustomTag.workspaces?.join(', ')}
+						All workspaces except {extractedCustomTag.workspaces?.map(formatWorkspace).join(', ')}
 					{/if}
 				</div>
 			</div>
 		{:else if newTag.trim()}
-			{#if newTag.includes('(') || newTag.includes(')') || newTag.includes('+') || newTag.includes('^') || ((newTag.includes('.') || newTag.includes('$args[')) && !dynamicTag)}
+			{#if newTag.includes('(') || newTag.includes(')') || newTag.includes('+') || newTag.includes('^') || newTag.includes('*') || ((newTag.includes('.') || newTag.includes('$args[')) && !dynamicTag)}
 				<div class="text-2xs text-primary p-2 bg-surface-secondary rounded border">
 					<div class="font-medium mb-1 text-red-500">Invalid tag</div>
 					<div>
@@ -219,6 +226,10 @@
 			To exclude 'workspace1' and 'workspace2' from a tag, use
 			<pre class="inline text-emphasis">tag(^workspace1^workspace2)</pre>
 			<br />{#if variant !== 'drawer'}<br />{/if}
+			Forks of a workspace do not get its tags. Suffix a workspace with
+			<pre class="inline text-emphasis">*</pre>
+			to also cover its forks, e.g. <pre class="inline text-emphasis">tag(workspace1*)</pre>
+			<br />{#if variant !== 'drawer'}<br />{/if}
 			For
 			<a
 				href="https://www.windmill.dev/docs/core_concepts/worker_groups#dynamic-tag"

From 7d2c5ceb0fb8609aa58a1e28e61ae8ce86e48208 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 17 Jul 2026 19:22:31 +0200
Subject: [PATCH 036/171] fix(flows): make updateFlow body path optional so AI
 can update flows (#10176)

* fix(mcp): default a body field to its same-named path param so updateFlow works

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* docs: trim mcp path-param fallback helper comment

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* refactor(mcp): keep path params un-mangled so update tools take plain `path`

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(flows): default update_flow body path from URL via EditFlow

Harmonizes updateFlow with the EditVariable/EditResource/EditApp convention: the
flow to update is identified by the URL, so the body path is optional and only
needed to rename. Fixes the 422 at the API layer for every client (MCP, the
in-app AI chat, raw HTTP), not just the MCP tool schema.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* refactor(mcp): drop redundant body-path fallback now that the server defaults it

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* docs: fix stale generator comment after removing mcp body-path fallback

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(flows): mark updateFlow body path optional in the openapi contract

Adds an `EditFlow` schema (path optional) for the update route so the public
contract matches the server; createFlow keeps `OpenFlowWPath` (path required).
Also trims two test comments to record constraints rather than history.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
---
 .../generate_mcp_tools.py                     | 31 ++++---
 backend/windmill-api-flows/src/flows.rs       |  6 +-
 backend/windmill-api/openapi.yaml             | 33 ++++++-
 .../src/mcp/auto_generated_endpoints.rs       | 85 ++++--------------
 backend/windmill-api/src/mcp/core.rs          |  1 -
 backend/windmill-api/src/mcp/utils.rs         | 65 ++++++++++++--
 backend/windmill-mcp/src/server/endpoints.rs  |  2 -
 backend/windmill-types/src/flows.rs           | 65 ++++++++++++++
 frontend/src/lib/mcpEndpointTools.ts          | 86 ++++---------------
 9 files changed, 213 insertions(+), 161 deletions(-)

diff --git a/backend/generate_mcp_endpoints_tools/generate_mcp_tools.py b/backend/generate_mcp_endpoints_tools/generate_mcp_tools.py
index b120a00d39..20ea1a0a6c 100644
--- a/backend/generate_mcp_endpoints_tools/generate_mcp_tools.py
+++ b/backend/generate_mcp_endpoints_tools/generate_mcp_tools.py
@@ -165,13 +165,14 @@ def extract_separate_schemas(parameters: List[Dict[str, Any]], request_body: Opt
 
     conflicts = (path_keys & query_keys) | (path_keys & body_keys) | (query_keys & body_keys)
 
-    path_field_renames = {}
     query_field_renames = {}
     body_field_renames = {}
 
     for field in conflicts:
+        # The path parameter keeps the plain name: it identifies the item, is what a
+        # caller reaches for first, and matches the non-colliding endpoints (`getFlowByPath`
+        # takes `path`). Only the other locations carry a suffix.
         schemas_and_renames = [
-            (path_params_schema, path_keys, '__path', path_field_renames),
             (query_params_schema, query_keys, '__query', query_field_renames),
             (body_schema, body_keys, '__body', body_field_renames),
         ]
@@ -197,11 +198,26 @@ def extract_separate_schemas(parameters: List[Dict[str, Any]], request_body: Opt
                 # Store the reverse mapping: renamed -> original
                 renames_map[new_name] = field
 
+        # A body field colliding with a same-named path parameter (`path` on the update
+        # endpoints) holds the new value and differs only when moving the item, so it must
+        # stay optional; the server defaults it from the URL path when the caller omits it.
+        if field in path_keys and field in body_keys and body_schema:
+            body_name = field + '__body'
+            if 'required' in body_schema:
+                body_schema['required'] = [r for r in body_schema['required'] if r != body_name]
+            prop = body_schema['properties'].get(body_name)
+            if isinstance(prop, dict):
+                existing_desc = prop.get('description', '').rstrip('. ')
+                prop['description'] = (
+                    f"{existing_desc}. Defaults to `{field}` when omitted; "
+                    f"set it only to change the {field}."
+                ).lstrip('. ')
+
     # Return None for empty schemas
     path_params_schema = path_params_schema if path_params_schema and path_params_schema.get('properties') else None
     query_params_schema = query_params_schema if query_params_schema and query_params_schema.get('properties') else None
 
-    return (path_params_schema, query_params_schema, body_schema, path_field_renames, query_field_renames, body_field_renames)
+    return (path_params_schema, query_params_schema, body_schema, query_field_renames, body_field_renames)
 
 # Cache for loaded external files
 _external_file_cache: Dict[str, Dict[str, Any]] = {}
@@ -453,7 +469,7 @@ export const mcpEndpointTools: EndpointTool[] = [];
         method = tool['method'].upper()
 
         # Generate separate schemas
-        path_params_schema, query_params_schema, body_schema, path_field_renames, query_field_renames, body_field_renames = extract_separate_schemas(
+        path_params_schema, query_params_schema, body_schema, query_field_renames, body_field_renames = extract_separate_schemas(
             tool['parameters'], tool['requestBody'], spec, tool['required_fields'], base_path,
             tool.get('include_fields'), tool.get('opaque_fields'), tool.get('include_query_params')
         )
@@ -462,7 +478,6 @@ export const mcpEndpointTools: EndpointTool[] = [];
         path_params_ts = json.dumps(path_params_schema, indent=8) if path_params_schema else "undefined"
         query_params_ts = json.dumps(query_params_schema, indent=8) if query_params_schema else "undefined"
         body_schema_ts = json.dumps(body_schema, indent=8) if body_schema else "undefined"
-        path_field_renames_ts = json.dumps(path_field_renames, indent=8) if path_field_renames else "undefined"
         query_field_renames_ts = json.dumps(query_field_renames, indent=8) if query_field_renames else "undefined"
         body_field_renames_ts = json.dumps(body_field_renames, indent=8) if body_field_renames else "undefined"
 
@@ -476,7 +491,6 @@ export const mcpEndpointTools: EndpointTool[] = [];
         pathParamsSchema: {path_params_ts},
         queryParamsSchema: {query_params_ts},
         bodySchema: {body_schema_ts},
-        pathFieldRenames: {path_field_renames_ts},
         queryFieldRenames: {query_field_renames_ts},
         bodyFieldRenames: {body_field_renames_ts}
     }}"""
@@ -497,7 +511,6 @@ export interface EndpointTool {{
     pathParamsSchema?: object;
     queryParamsSchema?: object;
     bodySchema?: object;
-    pathFieldRenames?: Record<string, string>;
     queryFieldRenames?: Record<string, string>;
     bodyFieldRenames?: Record<string, string>;
 }}
@@ -529,7 +542,7 @@ pub fn all_tools() -> Vec<EndpointTool> {{
         method = tool['method'].upper()
 
         # Generate separate schemas
-        path_params_schema, query_params_schema, body_schema, path_field_renames, query_field_renames, body_field_renames = extract_separate_schemas(
+        path_params_schema, query_params_schema, body_schema, query_field_renames, body_field_renames = extract_separate_schemas(
             tool['parameters'], tool['requestBody'], spec, tool['required_fields'], base_path,
             tool.get('include_fields'), tool.get('opaque_fields'), tool.get('include_query_params')
         )
@@ -537,7 +550,6 @@ pub fn all_tools() -> Vec<EndpointTool> {{
         path_params_rust = schema_to_rust_value(path_params_schema)
         query_params_rust = schema_to_rust_value(query_params_schema)
         body_schema_rust = schema_to_rust_value(body_schema)
-        path_field_renames_rust = schema_to_rust_value(path_field_renames if path_field_renames else None)
         query_field_renames_rust = schema_to_rust_value(query_field_renames if query_field_renames else None)
         body_field_renames_rust = schema_to_rust_value(body_field_renames if body_field_renames else None)
 
@@ -551,7 +563,6 @@ pub fn all_tools() -> Vec<EndpointTool> {{
         path_params_schema: {path_params_rust},
         query_params_schema: {query_params_rust},
         body_schema: {body_schema_rust},
-        path_field_renames: {path_field_renames_rust},
         query_field_renames: {query_field_renames_rust},
         body_field_renames: {body_field_renames_rust},
     }}"""
diff --git a/backend/windmill-api-flows/src/flows.rs b/backend/windmill-api-flows/src/flows.rs
index a9376d02ed..ff555113c3 100644
--- a/backend/windmill-api-flows/src/flows.rs
+++ b/backend/windmill-api-flows/src/flows.rs
@@ -47,7 +47,7 @@ use windmill_common::HUB_BASE_URL;
 use windmill_common::{
     db::UserDB,
     error::{self, to_anyhow, Error, JsonResult, Result},
-    flows::{Flow, FlowWithStarred, ListFlowQuery, ListableFlow, NewFlow},
+    flows::{EditFlow, Flow, FlowWithStarred, ListFlowQuery, ListableFlow, NewFlow},
     jobs::JobPayload,
     schedule::Schedule,
     utils::{http_get_from_hub, not_found_if_none, paginate, Pagination, RunnableKind, StripPath},
@@ -1007,7 +1007,7 @@ async fn update_flow(
     Extension(db): Extension<DB>,
     Extension(webhook): Extension<WebhookShared>,
     Path((w_id, flow_path)): Path<(String, StripPath)>,
-    Json(nf): Json<NewFlow>,
+    Json(ef): Json<EditFlow>,
 ) -> Result<String> {
     if authed.is_operator {
         return Err(Error::NotAuthorized(
@@ -1015,6 +1015,8 @@ async fn update_flow(
         ));
     }
     let flow_path = flow_path.to_path();
+    // The URL identifies the flow being updated; the body path is only needed to rename.
+    let nf = ef.into_new_flow(flow_path);
     check_scopes(&authed, || format!("flows:write:{}", flow_path))?;
 
     if let RuleCheckResult::Blocked(msg) = check_deploy_rules(
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 668cdae8cc..18a9120356 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -10775,7 +10775,7 @@ paths:
           application/json:
             schema:
               allOf:
-                - $ref: "#/components/schemas/OpenFlowWPath"
+                - $ref: "#/components/schemas/EditFlow"
                 - type: object
                   properties:
                     deployment_message:
@@ -29097,6 +29097,37 @@ components:
                 type: string
           required:
             - path
+    # Like OpenFlowWPath but `path` is optional: on update the flow is identified by
+    # the URL, so the body path is only needed to rename it. Kept as a separate schema
+    # (rather than making OpenFlowWPath.path optional) so createFlow still requires path.
+    EditFlow:
+      allOf:
+        - $ref: "../../openflow.openapi.yaml#/components/schemas/OpenFlow"
+        - type: object
+          properties:
+            path:
+              type: string
+            tag:
+              type: string
+            ws_error_handler_muted:
+              type: boolean
+            priority:
+              type: integer
+            dedicated_worker:
+              type: boolean
+            timeout:
+              type: number
+            visible_to_runner_only:
+              type: boolean
+            on_behalf_of_email:
+              type: string
+            preserve_on_behalf_of:
+              type: boolean
+              description: "When true and the caller is a member of the 'wm_deployers' group, preserves the original on_behalf_of_email value instead of overwriting it."
+            labels:
+              type: array
+              items:
+                type: string
 
     FlowPreview:
       type: object
diff --git a/backend/windmill-api/src/mcp/auto_generated_endpoints.rs b/backend/windmill-api/src/mcp/auto_generated_endpoints.rs
index d44484f9db..fda5966e30 100644
--- a/backend/windmill-api/src/mcp/auto_generated_endpoints.rs
+++ b/backend/windmill-api/src/mcp/auto_generated_endpoints.rs
@@ -26,7 +26,6 @@ pub fn all_tools() -> Vec<EndpointTool> {
         ]
 })),
         body_schema: None,
-        path_field_renames: None,
         query_field_renames: None,
         body_field_renames: None,
     },
@@ -54,7 +53,6 @@ pub fn all_tools() -> Vec<EndpointTool> {
         ]
 })),
         body_schema: None,
-        path_field_renames: None,
         query_field_renames: None,
         body_field_renames: None,
     },
@@ -124,7 +122,6 @@ pub fn all_tools() -> Vec<EndpointTool> {
                 "description"
         ]
 })),
-        path_field_renames: None,
         query_field_renames: None,
         body_field_renames: None,
     },
@@ -147,7 +144,6 @@ pub fn all_tools() -> Vec<EndpointTool> {
 })),
         query_params_schema: None,
         body_schema: None,
-        path_field_renames: None,
         query_field_renames: None,
         body_field_renames: None,
     },
@@ -160,13 +156,12 @@ pub fn all_tools() -> Vec<EndpointTool> {
         path_params_schema: Some(serde_json::json!({
         "type": "object",
         "properties": {
-                "path__path": {
-                        "type": "string",
-                        "description": "(path parameter)"
+                "path": {
+                        "type": "string"
                 }
         },
         "required": [
-                "path__path"
+                "path"
         ]
 })),
         query_params_schema: Some(serde_json::json!({
@@ -205,12 +200,9 @@ pub fn all_tools() -> Vec<EndpointTool> {
                 },
                 "path__body": {
                         "type": "string",
-                        "description": "The path to the variable (body parameter)"
+                        "description": "The path to the variable (body parameter). Defaults to `path` when omitted; set it only to change the path."
                 }
         }
-})),
-        path_field_renames: Some(serde_json::json!({
-        "path__path": "path"
 })),
         query_field_renames: None,
         body_field_renames: Some(serde_json::json!({
@@ -253,7 +245,6 @@ pub fn all_tools() -> Vec<EndpointTool> {
         "required": []
 })),
         body_schema: None,
-        path_field_renames: None,
         query_field_renames: None,
         body_field_renames: None,
     },
@@ -307,7 +298,6 @@ pub fn all_tools() -> Vec<EndpointTool> {
         "required": []
 })),
         body_schema: None,
-        path_field_renames: None,
         query_field_renames: None,
         body_field_renames: None,
     },
@@ -362,7 +352,6 @@ pub fn all_tools() -> Vec<EndpointTool> {
                 "resource_type"
         ]
 })),
-        path_field_renames: None,
         query_field_renames: None,
         body_field_renames: None,
     },
@@ -385,7 +374,6 @@ pub fn all_tools() -> Vec<EndpointTool> {
 })),
         query_params_schema: None,
         body_schema: None,
-        path_field_renames: None,
         query_field_renames: None,
         body_field_renames: None,
     },
@@ -398,13 +386,12 @@ pub fn all_tools() -> Vec<EndpointTool> {
         path_params_schema: Some(serde_json::json!({
         "type": "object",
         "properties": {
-                "path__path": {
-                        "type": "string",
-                        "description": "(path parameter)"
+                "path": {
+                        "type": "string"
                 }
         },
         "required": [
-                "path__path"
+                "path"
         ]
 })),
         query_params_schema: None,
@@ -433,12 +420,9 @@ pub fn all_tools() -> Vec<EndpointTool> {
                 },
                 "path__body": {
                         "type": "string",
-                        "description": "The path to the resource (body parameter)"
+                        "description": "The path to the resource (body parameter). Defaults to `path` when omitted; set it only to change the path."
                 }
         }
-})),
-        path_field_renames: Some(serde_json::json!({
-        "path__path": "path"
 })),
         query_field_renames: None,
         body_field_renames: Some(serde_json::json!({
@@ -473,7 +457,6 @@ pub fn all_tools() -> Vec<EndpointTool> {
         "required": []
 })),
         body_schema: None,
-        path_field_renames: None,
         query_field_renames: None,
         body_field_renames: None,
     },
@@ -535,7 +518,6 @@ pub fn all_tools() -> Vec<EndpointTool> {
         "required": []
 })),
         body_schema: None,
-        path_field_renames: None,
         query_field_renames: None,
         body_field_renames: None,
     },
@@ -548,7 +530,6 @@ pub fn all_tools() -> Vec<EndpointTool> {
         path_params_schema: None,
         query_params_schema: None,
         body_schema: None,
-        path_field_renames: None,
         query_field_renames: None,
         body_field_renames: None,
     },
@@ -646,7 +627,6 @@ pub fn all_tools() -> Vec<EndpointTool> {
         "required": []
 })),
         body_schema: None,
-        path_field_renames: None,
         query_field_renames: None,
         body_field_renames: None,
     },
@@ -699,7 +679,6 @@ Creates a new version of an existing script when called with the same path and t
                 "language"
         ]
 })),
-        path_field_renames: None,
         query_field_renames: None,
         body_field_renames: None,
     },
@@ -722,7 +701,6 @@ Creates a new version of an existing script when called with the same path and t
 })),
         query_params_schema: None,
         body_schema: None,
-        path_field_renames: None,
         query_field_renames: None,
         body_field_renames: None,
     },
@@ -754,7 +732,6 @@ Creates a new version of an existing script when called with the same path and t
         "required": []
 })),
         body_schema: None,
-        path_field_renames: None,
         query_field_renames: None,
         body_field_renames: None,
     },
@@ -789,7 +766,6 @@ Creates a new version of an existing script when called with the same path and t
         "required": []
 })),
         body_schema: None,
-        path_field_renames: None,
         query_field_renames: None,
         body_field_renames: None,
     },
@@ -816,7 +792,6 @@ Creates a new version of an existing script when called with the same path and t
         "description": "The arguments to pass to the script or flow",
         "additionalProperties": true
 })),
-        path_field_renames: None,
         query_field_renames: None,
         body_field_renames: None,
     },
@@ -886,7 +861,6 @@ Creates a new version of an existing script when called with the same path and t
         "required": []
 })),
         body_schema: None,
-        path_field_renames: None,
         query_field_renames: None,
         body_field_renames: None,
     },
@@ -921,7 +895,6 @@ Creates a new version of an existing script when called with the same path and t
         "required": []
 })),
         body_schema: None,
-        path_field_renames: None,
         query_field_renames: None,
         body_field_renames: None,
     },
@@ -967,7 +940,6 @@ Creates a new version of an existing script when called with the same path and t
         ],
         "description": "Top-level flow definition containing metadata, configuration, and the flow structure"
 })),
-        path_field_renames: None,
         query_field_renames: None,
         body_field_renames: None,
     },
@@ -980,13 +952,12 @@ Creates a new version of an existing script when called with the same path and t
         path_params_schema: Some(serde_json::json!({
         "type": "object",
         "properties": {
-                "path__path": {
-                        "type": "string",
-                        "description": "(path parameter)"
+                "path": {
+                        "type": "string"
                 }
         },
         "required": [
-                "path__path"
+                "path"
         ]
 })),
         query_params_schema: None,
@@ -1015,18 +986,14 @@ Creates a new version of an existing script when called with the same path and t
                 },
                 "path__body": {
                         "type": "string",
-                        "description": "(body parameter)"
+                        "description": "(body parameter). Defaults to `path` when omitted; set it only to change the path."
                 }
         },
         "required": [
                 "summary",
-                "value",
-                "path__body"
+                "value"
         ],
         "description": "Top-level flow definition containing metadata, configuration, and the flow structure"
-})),
-        path_field_renames: Some(serde_json::json!({
-        "path__path": "path"
 })),
         query_field_renames: None,
         body_field_renames: Some(serde_json::json!({
@@ -1061,7 +1028,6 @@ Creates a new version of an existing script when called with the same path and t
         "required": []
 })),
         body_schema: None,
-        path_field_renames: None,
         query_field_renames: None,
         body_field_renames: None,
     },
@@ -1099,7 +1065,6 @@ Creates a new version of an existing script when called with the same path and t
                 "policy"
         ]
 })),
-        path_field_renames: None,
         query_field_renames: None,
         body_field_renames: None,
     },
@@ -1112,13 +1077,12 @@ Creates a new version of an existing script when called with the same path and t
         path_params_schema: Some(serde_json::json!({
         "type": "object",
         "properties": {
-                "path__path": {
-                        "type": "string",
-                        "description": "(path parameter)"
+                "path": {
+                        "type": "string"
                 }
         },
         "required": [
-                "path__path"
+                "path"
         ]
 })),
         query_params_schema: None,
@@ -1139,12 +1103,9 @@ Creates a new version of an existing script when called with the same path and t
                 },
                 "path__body": {
                         "type": "string",
-                        "description": "(body parameter)"
+                        "description": "(body parameter). Defaults to `path` when omitted; set it only to change the path."
                 }
         }
-})),
-        path_field_renames: Some(serde_json::json!({
-        "path__path": "path"
 })),
         query_field_renames: None,
         body_field_renames: Some(serde_json::json!({
@@ -1174,7 +1135,6 @@ Creates a new version of an existing script when called with the same path and t
         "description": "The arguments to pass to the script or flow",
         "additionalProperties": true
 })),
-        path_field_renames: None,
         query_field_renames: None,
         body_field_renames: None,
     },
@@ -1269,7 +1229,6 @@ Creates a new version of an existing script when called with the same path and t
                 "language"
         ]
 })),
-        path_field_renames: None,
         query_field_renames: None,
         body_field_renames: None,
     },
@@ -1390,7 +1349,6 @@ Creates a new version of an existing script when called with the same path and t
         "required": []
 })),
         body_schema: None,
-        path_field_renames: None,
         query_field_renames: None,
         body_field_renames: None,
     },
@@ -1557,7 +1515,6 @@ Creates a new version of an existing script when called with the same path and t
         "required": []
 })),
         body_schema: None,
-        path_field_renames: None,
         query_field_renames: None,
         body_field_renames: None,
     },
@@ -1596,7 +1553,6 @@ Creates a new version of an existing script when called with the same path and t
         "required": []
 })),
         body_schema: None,
-        path_field_renames: None,
         query_field_renames: None,
         body_field_renames: None,
     },
@@ -1628,7 +1584,6 @@ Creates a new version of an existing script when called with the same path and t
         "required": []
 })),
         body_schema: None,
-        path_field_renames: None,
         query_field_renames: None,
         body_field_renames: None,
     },
@@ -1841,7 +1796,6 @@ You should get the schema of the script or flow before creating the schedule to
                 "args"
         ]
 })),
-        path_field_renames: None,
         query_field_renames: None,
         body_field_renames: None,
     },
@@ -2047,7 +2001,6 @@ You should get the schema of the script or flow before updating the schedule to
                 "args"
         ]
 })),
-        path_field_renames: None,
         query_field_renames: None,
         body_field_renames: None,
     },
@@ -2070,7 +2023,6 @@ You should get the schema of the script or flow before updating the schedule to
 })),
         query_params_schema: None,
         body_schema: None,
-        path_field_renames: None,
         query_field_renames: None,
         body_field_renames: None,
     },
@@ -2102,7 +2054,6 @@ You should get the schema of the script or flow before updating the schedule to
         "required": []
 })),
         body_schema: None,
-        path_field_renames: None,
         query_field_renames: None,
         body_field_renames: None,
     },
@@ -2168,7 +2119,6 @@ You should get the schema of the script or flow before updating the schedule to
         "required": []
 })),
         body_schema: None,
-        path_field_renames: None,
         query_field_renames: None,
         body_field_renames: None,
     },
@@ -2198,7 +2148,6 @@ You should get the schema of the script or flow before updating the schedule to
         "required": []
 })),
         body_schema: None,
-        path_field_renames: None,
         query_field_renames: None,
         body_field_renames: None,
     }
diff --git a/backend/windmill-api/src/mcp/core.rs b/backend/windmill-api/src/mcp/core.rs
index cdf1f0b3a3..5d78536d86 100644
--- a/backend/windmill-api/src/mcp/core.rs
+++ b/backend/windmill-api/src/mcp/core.rs
@@ -295,7 +295,6 @@ impl McpBackend for WindmillBackend {
             workspace_id,
             args_map,
             &endpoint_tool.path_params_schema,
-            &endpoint_tool.path_field_renames,
         )?;
         let query_string = build_query_string(
             args_map,
diff --git a/backend/windmill-api/src/mcp/utils.rs b/backend/windmill-api/src/mcp/utils.rs
index 70a4c6c1f4..7bca92dd57 100644
--- a/backend/windmill-api/src/mcp/utils.rs
+++ b/backend/windmill-api/src/mcp/utils.rs
@@ -295,7 +295,7 @@ pub async fn get_hub_script_schema(path: &str, db: &DB) -> Result<Option<Schema>
 // ============================================================================
 
 /// Look up the original field name from a field_renames map.
-/// field_renames maps renamed_key -> original_key (e.g. {"path__path": "path"}).
+/// field_renames maps renamed_key -> original_key (e.g. {"path__body": "path"}).
 fn get_original_name(renamed_key: &str, field_renames: &Option<Value>) -> String {
     field_renames
         .as_ref()
@@ -373,20 +373,17 @@ pub fn substitute_path_params(
     workspace_id: &str,
     args_map: &serde_json::Map<String, Value>,
     path_schema: &Option<Value>,
-    path_field_renames: &Option<Value>,
 ) -> BackendResult<String> {
     let mut path_template = path.replace("{workspace}", workspace_id);
 
     if let Some(schema) = path_schema {
         if let Some(props) = schema.get("properties").and_then(|p| p.as_object()) {
             for (param_name, _) in props {
-                // param_name may be renamed (e.g. "path__path"), get original for URL placeholder
-                let original_name = get_original_name(param_name, path_field_renames);
-                let placeholder = format!("{{{}}}", original_name);
+                let placeholder = format!("{{{}}}", param_name);
                 match args_map.get(param_name) {
                     Some(param_value) => {
                         if let Some(str_val) = param_value.as_str() {
-                            validate_path_param_value(&original_name, str_val)?;
+                            validate_path_param_value(param_name, str_val)?;
                             path_template = path_template.replace(&placeholder, str_val);
                         }
                     }
@@ -675,6 +672,60 @@ mod tests {
         );
     }
 
+    // updateFlow-shaped: `path` is both a path parameter and a body field. The path
+    // parameter keeps the plain name; only the body side is mangled.
+    fn update_flow_schemas() -> (Option<Value>, Option<Value>, Option<Value>) {
+        (
+            Some(json!({
+                "type": "object",
+                "properties": { "path": { "type": "string" } },
+                "required": ["path"]
+            })),
+            Some(json!({
+                "type": "object",
+                "properties": {
+                    "summary": { "type": "string" },
+                    "value": { "type": "object" },
+                    "path__body": { "type": "string" }
+                },
+                "required": ["summary", "value"]
+            })),
+            Some(json!({ "path__body": "path" })),
+        )
+    }
+
+    #[test]
+    fn build_request_body_maps_body_path_alias_for_rename() {
+        // The mangled body field carries the *new* path when renaming; it must reach the
+        // API under its original name `path`. (An omitted `path__body` is intentionally
+        // absent from the body; the server defaults it from the URL path parameter.)
+        let (path_schema, body_schema, body_renames) = update_flow_schemas();
+        let args: serde_json::Map<String, Value> = json!({
+            "path": "f/team/my_flow",
+            "path__body": "f/team/renamed_flow",
+            "summary": "s",
+            "value": {}
+        })
+        .as_object()
+        .unwrap()
+        .clone();
+
+        let body = build_request_body(
+            "POST",
+            &args,
+            &body_schema,
+            &body_renames,
+            &path_schema,
+            &None,
+        )
+        .expect("body should be built");
+        assert_eq!(
+            body.as_object().unwrap().get("path"),
+            Some(&json!("f/team/renamed_flow")),
+            "path__body must be sent as `path` so a rename takes effect"
+        );
+    }
+
     #[test]
     fn build_request_body_get_has_no_body() {
         let body_schema = Some(json!({ "type": "object", "additionalProperties": true }));
@@ -745,7 +796,6 @@ mod tests {
             "dev",
             &args,
             &path_schema,
-            &None,
         );
         assert!(
             result.is_err(),
@@ -767,7 +817,6 @@ mod tests {
             "dev",
             &args,
             &path_schema,
-            &None,
         )
         .expect("legitimate path should substitute");
         assert_eq!(result, "/w/dev/scripts/get/p/u/alice/my_script");
diff --git a/backend/windmill-mcp/src/server/endpoints.rs b/backend/windmill-mcp/src/server/endpoints.rs
index c3a50f9715..9e3adffc0b 100644
--- a/backend/windmill-mcp/src/server/endpoints.rs
+++ b/backend/windmill-mcp/src/server/endpoints.rs
@@ -21,7 +21,6 @@ pub struct EndpointTool {
     pub path_params_schema: Option<serde_json::Value>,
     pub query_params_schema: Option<serde_json::Value>,
     pub body_schema: Option<serde_json::Value>,
-    pub path_field_renames: Option<serde_json::Value>,
     pub query_field_renames: Option<serde_json::Value>,
     pub body_field_renames: Option<serde_json::Value>,
 }
@@ -215,7 +214,6 @@ mod tests {
                 "required": []
             })),
             body_schema: None,
-            path_field_renames: None,
             query_field_renames: None,
             body_field_renames: None,
         }
diff --git a/backend/windmill-types/src/flows.rs b/backend/windmill-types/src/flows.rs
index 0c95b9612b..7e70dc5acd 100644
--- a/backend/windmill-types/src/flows.rs
+++ b/backend/windmill-types/src/flows.rs
@@ -145,6 +145,57 @@ impl NewFlow {
     }
 }
 
+/// Body for updating an existing flow. Mirrors `NewFlow`, but `path` is optional: the
+/// flow to update is identified by the URL, so the body only needs `path` to rename it.
+/// This matches the `EditVariable` / `EditResource` / `EditApp` convention and lets a
+/// caller update in place without restating the path.
+#[derive(Debug, Deserialize)]
+pub struct EditFlow {
+    #[serde(default)]
+    pub path: Option<String>,
+    pub summary: String,
+    pub description: Option<String>,
+    #[serde(deserialize_with = "validate_flow_value")]
+    pub value: Box<RawValue>,
+    pub schema: Option<Schema>,
+    pub tag: Option<String>,
+    pub dedicated_worker: Option<bool>,
+    pub timeout: Option<i32>,
+    pub deployment_message: Option<String>,
+    pub visible_to_runner_only: Option<bool>,
+    pub on_behalf_of_email: Option<String>,
+    pub preserve_on_behalf_of: Option<bool>,
+    pub ws_error_handler_muted: Option<bool>,
+    #[serde(default)]
+    pub labels: Option<Vec<String>>,
+    #[serde(default)]
+    pub skip_draft_deletion: Option<bool>,
+}
+
+impl EditFlow {
+    /// Resolve into a `NewFlow`, defaulting the target path to `current_path` (the flow's
+    /// URL path) when the body omits it. A body `path` that differs renames the flow.
+    pub fn into_new_flow(self, current_path: &str) -> NewFlow {
+        NewFlow {
+            path: self.path.unwrap_or_else(|| current_path.to_string()),
+            summary: self.summary,
+            description: self.description,
+            value: self.value,
+            schema: self.schema,
+            tag: self.tag,
+            dedicated_worker: self.dedicated_worker,
+            timeout: self.timeout,
+            deployment_message: self.deployment_message,
+            visible_to_runner_only: self.visible_to_runner_only,
+            on_behalf_of_email: self.on_behalf_of_email,
+            preserve_on_behalf_of: self.preserve_on_behalf_of,
+            ws_error_handler_muted: self.ws_error_handler_muted,
+            labels: self.labels,
+            skip_draft_deletion: self.skip_draft_deletion,
+        }
+    }
+}
+
 fn validate_retry(retry: &Retry, module_id: &str) -> anyhow::Result<()> {
     if retry.exponential.attempts > 0 && retry.exponential.seconds == 0 {
         return Err(anyhow::anyhow!(
@@ -1233,6 +1284,20 @@ mod tests {
     use super::*;
     use serde_json::json;
 
+    #[test]
+    fn edit_flow_defaults_path_from_url_and_renames_when_given() {
+        // An omitted body path resolves to the URL path; an explicit body path renames.
+        let ef: EditFlow =
+            serde_json::from_value(json!({ "summary": "s", "value": { "modules": [] } })).unwrap();
+        assert_eq!(ef.into_new_flow("f/team/my_flow").path, "f/team/my_flow");
+
+        let ef: EditFlow = serde_json::from_value(
+            json!({ "path": "f/team/renamed", "summary": "s", "value": { "modules": [] } }),
+        )
+        .unwrap();
+        assert_eq!(ef.into_new_flow("f/team/my_flow").path, "f/team/renamed");
+    }
+
     #[test]
     fn flow_value_ignores_notes_and_groups() {
         // FlowValue should parse successfully even when notes/groups are present —
diff --git a/frontend/src/lib/mcpEndpointTools.ts b/frontend/src/lib/mcpEndpointTools.ts
index 8a46163009..336c24cefc 100644
--- a/frontend/src/lib/mcpEndpointTools.ts
+++ b/frontend/src/lib/mcpEndpointTools.ts
@@ -10,7 +10,6 @@ export interface EndpointTool {
     pathParamsSchema?: object;
     queryParamsSchema?: object;
     bodySchema?: object;
-    pathFieldRenames?: Record<string, string>;
     queryFieldRenames?: Record<string, string>;
     bodyFieldRenames?: Record<string, string>;
 }
@@ -36,7 +35,6 @@ export const mcpEndpointTools: EndpointTool[] = [
         ]
 },
         bodySchema: undefined,
-        pathFieldRenames: undefined,
         queryFieldRenames: undefined,
         bodyFieldRenames: undefined
     },
@@ -64,7 +62,6 @@ export const mcpEndpointTools: EndpointTool[] = [
         ]
 },
         bodySchema: undefined,
-        pathFieldRenames: undefined,
         queryFieldRenames: undefined,
         bodyFieldRenames: undefined
     },
@@ -134,7 +131,6 @@ export const mcpEndpointTools: EndpointTool[] = [
                 "description"
         ]
 },
-        pathFieldRenames: undefined,
         queryFieldRenames: undefined,
         bodyFieldRenames: undefined
     },
@@ -157,7 +153,6 @@ export const mcpEndpointTools: EndpointTool[] = [
 },
         queryParamsSchema: undefined,
         bodySchema: undefined,
-        pathFieldRenames: undefined,
         queryFieldRenames: undefined,
         bodyFieldRenames: undefined
     },
@@ -170,13 +165,12 @@ export const mcpEndpointTools: EndpointTool[] = [
         pathParamsSchema: {
         "type": "object",
         "properties": {
-                "path__path": {
-                        "type": "string",
-                        "description": "(path parameter)"
+                "path": {
+                        "type": "string"
                 }
         },
         "required": [
-                "path__path"
+                "path"
         ]
 },
         queryParamsSchema: {
@@ -215,12 +209,9 @@ export const mcpEndpointTools: EndpointTool[] = [
                 },
                 "path__body": {
                         "type": "string",
-                        "description": "The path to the variable (body parameter)"
+                        "description": "The path to the variable (body parameter). Defaults to `path` when omitted; set it only to change the path."
                 }
         }
-},
-        pathFieldRenames: {
-        "path__path": "path"
 },
         queryFieldRenames: undefined,
         bodyFieldRenames: {
@@ -263,7 +254,6 @@ export const mcpEndpointTools: EndpointTool[] = [
         "required": []
 },
         bodySchema: undefined,
-        pathFieldRenames: undefined,
         queryFieldRenames: undefined,
         bodyFieldRenames: undefined
     },
@@ -317,7 +307,6 @@ export const mcpEndpointTools: EndpointTool[] = [
         "required": []
 },
         bodySchema: undefined,
-        pathFieldRenames: undefined,
         queryFieldRenames: undefined,
         bodyFieldRenames: undefined
     },
@@ -372,7 +361,6 @@ export const mcpEndpointTools: EndpointTool[] = [
                 "resource_type"
         ]
 },
-        pathFieldRenames: undefined,
         queryFieldRenames: undefined,
         bodyFieldRenames: undefined
     },
@@ -395,7 +383,6 @@ export const mcpEndpointTools: EndpointTool[] = [
 },
         queryParamsSchema: undefined,
         bodySchema: undefined,
-        pathFieldRenames: undefined,
         queryFieldRenames: undefined,
         bodyFieldRenames: undefined
     },
@@ -408,13 +395,12 @@ export const mcpEndpointTools: EndpointTool[] = [
         pathParamsSchema: {
         "type": "object",
         "properties": {
-                "path__path": {
-                        "type": "string",
-                        "description": "(path parameter)"
+                "path": {
+                        "type": "string"
                 }
         },
         "required": [
-                "path__path"
+                "path"
         ]
 },
         queryParamsSchema: undefined,
@@ -443,12 +429,9 @@ export const mcpEndpointTools: EndpointTool[] = [
                 },
                 "path__body": {
                         "type": "string",
-                        "description": "The path to the resource (body parameter)"
+                        "description": "The path to the resource (body parameter). Defaults to `path` when omitted; set it only to change the path."
                 }
         }
-},
-        pathFieldRenames: {
-        "path__path": "path"
 },
         queryFieldRenames: undefined,
         bodyFieldRenames: {
@@ -483,7 +466,6 @@ export const mcpEndpointTools: EndpointTool[] = [
         "required": []
 },
         bodySchema: undefined,
-        pathFieldRenames: undefined,
         queryFieldRenames: undefined,
         bodyFieldRenames: undefined
     },
@@ -545,7 +527,6 @@ export const mcpEndpointTools: EndpointTool[] = [
         "required": []
 },
         bodySchema: undefined,
-        pathFieldRenames: undefined,
         queryFieldRenames: undefined,
         bodyFieldRenames: undefined
     },
@@ -558,7 +539,6 @@ export const mcpEndpointTools: EndpointTool[] = [
         pathParamsSchema: undefined,
         queryParamsSchema: undefined,
         bodySchema: undefined,
-        pathFieldRenames: undefined,
         queryFieldRenames: undefined,
         bodyFieldRenames: undefined
     },
@@ -656,7 +636,6 @@ export const mcpEndpointTools: EndpointTool[] = [
         "required": []
 },
         bodySchema: undefined,
-        pathFieldRenames: undefined,
         queryFieldRenames: undefined,
         bodyFieldRenames: undefined
     },
@@ -708,7 +687,6 @@ export const mcpEndpointTools: EndpointTool[] = [
                 "language"
         ]
 },
-        pathFieldRenames: undefined,
         queryFieldRenames: undefined,
         bodyFieldRenames: undefined
     },
@@ -731,7 +709,6 @@ export const mcpEndpointTools: EndpointTool[] = [
 },
         queryParamsSchema: undefined,
         bodySchema: undefined,
-        pathFieldRenames: undefined,
         queryFieldRenames: undefined,
         bodyFieldRenames: undefined
     },
@@ -763,7 +740,6 @@ export const mcpEndpointTools: EndpointTool[] = [
         "required": []
 },
         bodySchema: undefined,
-        pathFieldRenames: undefined,
         queryFieldRenames: undefined,
         bodyFieldRenames: undefined
     },
@@ -798,7 +774,6 @@ export const mcpEndpointTools: EndpointTool[] = [
         "required": []
 },
         bodySchema: undefined,
-        pathFieldRenames: undefined,
         queryFieldRenames: undefined,
         bodyFieldRenames: undefined
     },
@@ -825,7 +800,6 @@ export const mcpEndpointTools: EndpointTool[] = [
         "description": "The arguments to pass to the script or flow",
         "additionalProperties": true
 },
-        pathFieldRenames: undefined,
         queryFieldRenames: undefined,
         bodyFieldRenames: undefined
     },
@@ -895,7 +869,6 @@ export const mcpEndpointTools: EndpointTool[] = [
         "required": []
 },
         bodySchema: undefined,
-        pathFieldRenames: undefined,
         queryFieldRenames: undefined,
         bodyFieldRenames: undefined
     },
@@ -930,7 +903,6 @@ export const mcpEndpointTools: EndpointTool[] = [
         "required": []
 },
         bodySchema: undefined,
-        pathFieldRenames: undefined,
         queryFieldRenames: undefined,
         bodyFieldRenames: undefined
     },
@@ -976,7 +948,6 @@ export const mcpEndpointTools: EndpointTool[] = [
         ],
         "description": "Top-level flow definition containing metadata, configuration, and the flow structure"
 },
-        pathFieldRenames: undefined,
         queryFieldRenames: undefined,
         bodyFieldRenames: undefined
     },
@@ -989,13 +960,12 @@ export const mcpEndpointTools: EndpointTool[] = [
         pathParamsSchema: {
         "type": "object",
         "properties": {
-                "path__path": {
-                        "type": "string",
-                        "description": "(path parameter)"
+                "path": {
+                        "type": "string"
                 }
         },
         "required": [
-                "path__path"
+                "path"
         ]
 },
         queryParamsSchema: undefined,
@@ -1024,18 +994,14 @@ export const mcpEndpointTools: EndpointTool[] = [
                 },
                 "path__body": {
                         "type": "string",
-                        "description": "(body parameter)"
+                        "description": "(body parameter). Defaults to `path` when omitted; set it only to change the path."
                 }
         },
         "required": [
                 "summary",
-                "value",
-                "path__body"
+                "value"
         ],
         "description": "Top-level flow definition containing metadata, configuration, and the flow structure"
-},
-        pathFieldRenames: {
-        "path__path": "path"
 },
         queryFieldRenames: undefined,
         bodyFieldRenames: {
@@ -1070,7 +1036,6 @@ export const mcpEndpointTools: EndpointTool[] = [
         "required": []
 },
         bodySchema: undefined,
-        pathFieldRenames: undefined,
         queryFieldRenames: undefined,
         bodyFieldRenames: undefined
     },
@@ -1108,7 +1073,6 @@ export const mcpEndpointTools: EndpointTool[] = [
                 "policy"
         ]
 },
-        pathFieldRenames: undefined,
         queryFieldRenames: undefined,
         bodyFieldRenames: undefined
     },
@@ -1121,13 +1085,12 @@ export const mcpEndpointTools: EndpointTool[] = [
         pathParamsSchema: {
         "type": "object",
         "properties": {
-                "path__path": {
-                        "type": "string",
-                        "description": "(path parameter)"
+                "path": {
+                        "type": "string"
                 }
         },
         "required": [
-                "path__path"
+                "path"
         ]
 },
         queryParamsSchema: undefined,
@@ -1148,12 +1111,9 @@ export const mcpEndpointTools: EndpointTool[] = [
                 },
                 "path__body": {
                         "type": "string",
-                        "description": "(body parameter)"
+                        "description": "(body parameter). Defaults to `path` when omitted; set it only to change the path."
                 }
         }
-},
-        pathFieldRenames: {
-        "path__path": "path"
 },
         queryFieldRenames: undefined,
         bodyFieldRenames: {
@@ -1183,7 +1143,6 @@ export const mcpEndpointTools: EndpointTool[] = [
         "description": "The arguments to pass to the script or flow",
         "additionalProperties": true
 },
-        pathFieldRenames: undefined,
         queryFieldRenames: undefined,
         bodyFieldRenames: undefined
     },
@@ -1278,7 +1237,6 @@ export const mcpEndpointTools: EndpointTool[] = [
                 "language"
         ]
 },
-        pathFieldRenames: undefined,
         queryFieldRenames: undefined,
         bodyFieldRenames: undefined
     },
@@ -1399,7 +1357,6 @@ export const mcpEndpointTools: EndpointTool[] = [
         "required": []
 },
         bodySchema: undefined,
-        pathFieldRenames: undefined,
         queryFieldRenames: undefined,
         bodyFieldRenames: undefined
     },
@@ -1566,7 +1523,6 @@ export const mcpEndpointTools: EndpointTool[] = [
         "required": []
 },
         bodySchema: undefined,
-        pathFieldRenames: undefined,
         queryFieldRenames: undefined,
         bodyFieldRenames: undefined
     },
@@ -1605,7 +1561,6 @@ export const mcpEndpointTools: EndpointTool[] = [
         "required": []
 },
         bodySchema: undefined,
-        pathFieldRenames: undefined,
         queryFieldRenames: undefined,
         bodyFieldRenames: undefined
     },
@@ -1637,7 +1592,6 @@ export const mcpEndpointTools: EndpointTool[] = [
         "required": []
 },
         bodySchema: undefined,
-        pathFieldRenames: undefined,
         queryFieldRenames: undefined,
         bodyFieldRenames: undefined
     },
@@ -1847,7 +1801,6 @@ export const mcpEndpointTools: EndpointTool[] = [
                 "args"
         ]
 },
-        pathFieldRenames: undefined,
         queryFieldRenames: undefined,
         bodyFieldRenames: undefined
     },
@@ -2050,7 +2003,6 @@ export const mcpEndpointTools: EndpointTool[] = [
                 "args"
         ]
 },
-        pathFieldRenames: undefined,
         queryFieldRenames: undefined,
         bodyFieldRenames: undefined
     },
@@ -2073,7 +2025,6 @@ export const mcpEndpointTools: EndpointTool[] = [
 },
         queryParamsSchema: undefined,
         bodySchema: undefined,
-        pathFieldRenames: undefined,
         queryFieldRenames: undefined,
         bodyFieldRenames: undefined
     },
@@ -2105,7 +2056,6 @@ export const mcpEndpointTools: EndpointTool[] = [
         "required": []
 },
         bodySchema: undefined,
-        pathFieldRenames: undefined,
         queryFieldRenames: undefined,
         bodyFieldRenames: undefined
     },
@@ -2171,7 +2121,6 @@ export const mcpEndpointTools: EndpointTool[] = [
         "required": []
 },
         bodySchema: undefined,
-        pathFieldRenames: undefined,
         queryFieldRenames: undefined,
         bodyFieldRenames: undefined
     },
@@ -2201,7 +2150,6 @@ export const mcpEndpointTools: EndpointTool[] = [
         "required": []
 },
         bodySchema: undefined,
-        pathFieldRenames: undefined,
         queryFieldRenames: undefined,
         bodyFieldRenames: undefined
     }

From a9fc9f74b2c5b280cc087f0bfbac50112081c5e8 Mon Sep 17 00:00:00 2001
From: Guilhem <guilhemlemouel@gmail.com>
Date: Fri, 17 Jul 2026 19:23:31 +0200
Subject: [PATCH 037/171] fix(ai): unbreak session chat compaction for
 Anthropic models (#10171)

* fix(ai): cap chat compaction summary output so Anthropic non-streaming calls succeed

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* test: pin the compaction summarizer's maxTokensCap

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ai): cap testKey completion so Anthropic key tests pass the SDK pre-flight

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
---
 .../lib/components/copilot/chat/AIChatManager.svelte.ts    | 7 ++++++-
 .../src/lib/components/copilot/chat/AIChatManager.test.ts  | 3 +++
 frontend/src/lib/components/copilot/lib.ts                 | 7 +++++--
 3 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts b/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
index ebc925588b..2853c392f5 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
+++ b/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
@@ -1002,12 +1002,17 @@ export class AIChatManager {
 	): Promise<'ok' | 'empty' | 'aborted' | 'error'> => {
 		this.compacting = true
 		try {
+			// Cap the summarizer's output at the budget already reserved for the
+			// summary. Without a cap the model's default max_tokens applies, and the
+			// Anthropic SDK rejects non-streaming requests whose max_tokens implies
+			// >10 minutes of generation (~21k tokens) before anything is sent.
 			const raw = await getNonStreamingCompletion(
 				[
 					...sanitizeToolCallArguments(prefix),
 					{ role: 'user', content: getCompactionSummaryPrompt() }
 				],
-				abortController
+				abortController,
+				{ maxTokensCap: SUMMARY_OUTPUT_RESERVE_TOKENS }
 			)
 			const formatted = formatCompactSummary(raw ?? '')
 			if (!formatted) {
diff --git a/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts b/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts
index 94270d0e6a..3ca57f948d 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts
+++ b/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts
@@ -1143,6 +1143,9 @@ describe('AIChatManager manual compaction', () => {
 		expect(summaryReq[0].content).toBe('q1')
 		expect(summaryReq[3].content).toBe('a2')
 		expect(summaryReq[4].content).toContain('detailed summary')
+		// The summarizer's output must stay capped: without it the model default
+		// applies and the Anthropic SDK rejects the non-streaming call pre-flight.
+		expect(mocks.getNonStreamingCompletion.mock.calls[0][2]).toEqual({ maxTokensCap: 8000 })
 
 		// Nothing kept verbatim: messages collapse to just the summary user message.
 		expect(manager.messages).toHaveLength(1)
diff --git a/frontend/src/lib/components/copilot/lib.ts b/frontend/src/lib/components/copilot/lib.ts
index 2b261a21e0..6670789404 100644
--- a/frontend/src/lib/components/copilot/lib.ts
+++ b/frontend/src/lib/components/copilot/lib.ts
@@ -487,7 +487,9 @@ export async function testKey({
 	// getNonStreamingCompletion routes Anthropic-Messages-API models (native
 	// Anthropic and Claude on Azure Foundry) through the Anthropic SDK and
 	// everything else through OpenAI chat completions, so the test exercises the
-	// same request shape the feature actually sends.
+	// same request shape the feature actually sends. The cap keeps max_tokens
+	// under the Anthropic SDK's non-streaming pre-flight limit (~21k tokens),
+	// which would otherwise reject the request before it is sent.
 	await getNonStreamingCompletion(messages, abortController, {
 		apiKey,
 		workspace,
@@ -495,7 +497,8 @@ export async function testKey({
 		forceModelProvider: {
 			model: modelToTest,
 			provider: aiProvider
-		}
+		},
+		maxTokensCap: METADATA_MAX_TOKENS
 	})
 }
 

From d0aa7dca13aedfec90b7e023954cc824dafa3d34 Mon Sep 17 00:00:00 2001
From: hugocasa <hugo@casademont.ch>
Date: Fri, 17 Jul 2026 19:24:07 +0200
Subject: [PATCH 038/171] fix: parse all names in grouped go param declarations
 (#10165)

* fix: parse all names in grouped go param declarations

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* chore: bump windmill-parser-wasm-go to 1.761.0

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
---
 backend/parsers/windmill-parser-go/src/lib.rs | 69 +++++++++++++++++--
 cli/bun.lock                                  |  4 +-
 cli/package-lock.json                         |  8 +--
 cli/package.json                              |  2 +-
 frontend/package-lock.json                    | 58 ++--------------
 frontend/package.json                         |  2 +-
 6 files changed, 77 insertions(+), 66 deletions(-)

diff --git a/backend/parsers/windmill-parser-go/src/lib.rs b/backend/parsers/windmill-parser-go/src/lib.rs
index 0f340943aa..2a2d8c310d 100644
--- a/backend/parsers/windmill-parser-go/src/lib.rs
+++ b/backend/parsers/windmill-parser-go/src/lib.rs
@@ -25,17 +25,23 @@ pub fn parse_go_sig(code: &str) -> anyhow::Result<MainArgSignature> {
             .params
             .list
             .iter()
-            .map(|param| {
+            .flat_map(|param| {
                 let (otyp, typ) = parse_go_typ(&param.typ);
-                Arg {
-                    name: get_name(param),
-                    otyp,
-                    typ,
+                // a single field can declare several like-typed params: `func main(a, b string)`
+                let names: Vec<String> = if param.name.is_empty() {
+                    vec!["".to_string()]
+                } else {
+                    param.name.iter().map(|y| y.name.to_string()).collect()
+                };
+                names.into_iter().map(move |name| Arg {
+                    name,
+                    otyp: otyp.clone(),
+                    typ: typ.clone(),
                     default: None,
                     has_default: false,
                     oidx: None,
                     otyp_inferred: false,
-                }
+                })
             })
             .collect_vec();
         Ok(MainArgSignature {
@@ -267,6 +273,57 @@ func main(x int, y string, z bool, l []string, o struct { Name string `json:"nam
 
         Ok(())
     }
+
+    #[test]
+    fn test_parse_go_sig_grouped_params() -> anyhow::Result<()> {
+        let code = r#"
+package main
+
+func main(a, b string, c int) {
+}
+"#;
+        assert_eq!(
+            parse_go_sig(code)?,
+            MainArgSignature {
+                star_args: false,
+                star_kwargs: false,
+                args: vec![
+                    Arg {
+                        otyp: Some("string".to_string()),
+                        name: "a".to_string(),
+                        typ: Typ::Str(None),
+                        default: None,
+                        has_default: false,
+                        oidx: None,
+                        otyp_inferred: false,
+                    },
+                    Arg {
+                        otyp: Some("string".to_string()),
+                        name: "b".to_string(),
+                        typ: Typ::Str(None),
+                        default: None,
+                        has_default: false,
+                        oidx: None,
+                        otyp_inferred: false,
+                    },
+                    Arg {
+                        otyp: Some("int".to_string()),
+                        name: "c".to_string(),
+                        typ: Typ::Int,
+                        default: None,
+                        has_default: false,
+                        oidx: None,
+                        otyp_inferred: false,
+                    },
+                ],
+                auto_kind: None,
+                has_preprocessor: None,
+                ..Default::default()
+            }
+        );
+
+        Ok(())
+    }
 }
 
 #[test]
diff --git a/cli/bun.lock b/cli/bun.lock
index a745acbcba..7c76732a90 100644
--- a/cli/bun.lock
+++ b/cli/bun.lock
@@ -21,7 +21,7 @@
         "tar-stream": "^3.1.7",
         "windmill-parser-wasm-asset": "1.749.0",
         "windmill-parser-wasm-csharp": "1.510.1",
-        "windmill-parser-wasm-go": "1.510.1",
+        "windmill-parser-wasm-go": "1.761.0",
         "windmill-parser-wasm-java": "1.510.1",
         "windmill-parser-wasm-nu": "1.510.1",
         "windmill-parser-wasm-php": "1.647.1",
@@ -294,7 +294,7 @@
 
     "windmill-parser-wasm-csharp": ["windmill-parser-wasm-csharp@1.510.1", "", {}, "sha512-qm09YmnbeYHLwYn1jUnObVzPhYO9NZKMlIO7nlo7zPJBXqksgG5fK/KCtwGw9rChrnz+DsvM9wP5FhrwRLMtwQ=="],
 
-    "windmill-parser-wasm-go": ["windmill-parser-wasm-go@1.510.1", "", {}, "sha512-HOkk6LXK0wrwvkn+zjm3Gxo90HmyL6TYqmLo2yp8fZuppy7GOngT27zwYeBtwONiPyvDKskzoqPQoEfd8VuUsQ=="],
+    "windmill-parser-wasm-go": ["windmill-parser-wasm-go@1.761.0", "", {}, "sha512-jNM0kh0U5uSetwBVSmueFs91GTdbn/tffny2XB1LrrSUElP5i+PK7i12zrWNT2q9JUK2L215CbmyfNmkacbo1Q=="],
 
     "windmill-parser-wasm-java": ["windmill-parser-wasm-java@1.510.1", "", {}, "sha512-Zle+JZT/ZwUArUVacUudYlS+CaHp2lSnkqD/IhWaRUG+gcv26VbERnrrHPonqXbVMS+eA9ElfXrFM5j0ukaXUw=="],
 
diff --git a/cli/package-lock.json b/cli/package-lock.json
index a9d72696b2..328cfa2d64 100644
--- a/cli/package-lock.json
+++ b/cli/package-lock.json
@@ -22,7 +22,7 @@
         "tar-stream": "^3.1.7",
         "windmill-parser-wasm-asset": "1.749.0",
         "windmill-parser-wasm-csharp": "1.510.1",
-        "windmill-parser-wasm-go": "1.510.1",
+        "windmill-parser-wasm-go": "1.761.0",
         "windmill-parser-wasm-java": "1.510.1",
         "windmill-parser-wasm-nu": "1.510.1",
         "windmill-parser-wasm-php": "1.647.1",
@@ -1422,9 +1422,9 @@
       "integrity": "sha512-qm09YmnbeYHLwYn1jUnObVzPhYO9NZKMlIO7nlo7zPJBXqksgG5fK/KCtwGw9rChrnz+DsvM9wP5FhrwRLMtwQ=="
     },
     "node_modules/windmill-parser-wasm-go": {
-      "version": "1.510.1",
-      "resolved": "https://registry.npmjs.org/windmill-parser-wasm-go/-/windmill-parser-wasm-go-1.510.1.tgz",
-      "integrity": "sha512-HOkk6LXK0wrwvkn+zjm3Gxo90HmyL6TYqmLo2yp8fZuppy7GOngT27zwYeBtwONiPyvDKskzoqPQoEfd8VuUsQ=="
+      "version": "1.761.0",
+      "resolved": "https://registry.npmjs.org/windmill-parser-wasm-go/-/windmill-parser-wasm-go-1.761.0.tgz",
+      "integrity": "sha512-jNM0kh0U5uSetwBVSmueFs91GTdbn/tffny2XB1LrrSUElP5i+PK7i12zrWNT2q9JUK2L215CbmyfNmkacbo1Q=="
     },
     "node_modules/windmill-parser-wasm-java": {
       "version": "1.510.1",
diff --git a/cli/package.json b/cli/package.json
index 589bc52271..ba8a702526 100644
--- a/cli/package.json
+++ b/cli/package.json
@@ -30,7 +30,7 @@
     "tar-stream": "^3.1.7",
     "windmill-parser-wasm-asset": "1.749.0",
     "windmill-parser-wasm-csharp": "1.510.1",
-    "windmill-parser-wasm-go": "1.510.1",
+    "windmill-parser-wasm-go": "1.761.0",
     "windmill-parser-wasm-java": "1.510.1",
     "windmill-parser-wasm-nu": "1.510.1",
     "windmill-parser-wasm-php": "1.647.1",
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 3f5484438c..555aba4ba1 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -82,7 +82,7 @@
 				"vscode-ws-jsonrpc": "~3.5.0",
 				"windmill-parser-wasm-asset": "1.749.0",
 				"windmill-parser-wasm-csharp": "1.510.1",
-				"windmill-parser-wasm-go": "1.510.1",
+				"windmill-parser-wasm-go": "1.761.0",
 				"windmill-parser-wasm-java": "1.510.1",
 				"windmill-parser-wasm-nu": "1.510.1",
 				"windmill-parser-wasm-php": "1.647.1",
@@ -879,7 +879,6 @@
 			"version": "1.11.2",
 			"resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.11.2.tgz",
 			"integrity": "sha512-TC8MkTuZUtcTSiFeuC0ksCh9QIJ5+F21MvZ4Wn4ORfYaFJ/0dsiudv5tVkejgwZlwQ39jL9WWDe2lz8x0WglOA==",
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"dependencies": {
@@ -891,7 +890,6 @@
 			"version": "1.11.2",
 			"resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.11.2.tgz",
 			"integrity": "sha512-kyOl3X0DuTiT1h2ft8r2fYO8JYtU9a9Xis/zBSiGArNaagCOWx90N1k2wxp18czFDH+OgcWGb5ZP/XMt3dcyPA==",
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"dependencies": {
@@ -902,7 +900,6 @@
 			"version": "1.2.2",
 			"resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-1.2.2.tgz",
 			"integrity": "sha512-c95qOXkHdydNKhscBTebqEC1CVAZpyqOfVfBzQ1qgzyl3gfeldUjIggDbIZgDKsHLgnsM+igH7TJ/eAasaVuMA==",
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"dependencies": {
@@ -1418,7 +1415,6 @@
 			"version": "1.1.4",
 			"resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.4.tgz",
 			"integrity": "sha512-3NQNNgA1YSlJb/kMH1ildASP9HW7/7kYnRI2szWJaofaS1hWmbGI4H+d3+22aGzXXN9IJ+n+GiFVcGipJP18ow==",
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"dependencies": {
@@ -1567,7 +1563,6 @@
 			"cpu": [
 				"arm64"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1584,7 +1579,6 @@
 			"cpu": [
 				"arm64"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1601,7 +1595,6 @@
 			"cpu": [
 				"x64"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1618,7 +1611,6 @@
 			"cpu": [
 				"x64"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1635,7 +1627,6 @@
 			"cpu": [
 				"arm"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1652,7 +1643,6 @@
 			"cpu": [
 				"arm64"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1669,7 +1659,6 @@
 			"cpu": [
 				"arm64"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1686,7 +1675,6 @@
 			"cpu": [
 				"ppc64"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1703,7 +1691,6 @@
 			"cpu": [
 				"s390x"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1720,7 +1707,6 @@
 			"cpu": [
 				"x64"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1737,7 +1723,6 @@
 			"cpu": [
 				"x64"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1754,7 +1739,6 @@
 			"cpu": [
 				"arm64"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1771,7 +1755,6 @@
 			"cpu": [
 				"wasm32"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"dependencies": {
@@ -1790,7 +1773,6 @@
 			"cpu": [
 				"arm64"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1807,7 +1789,6 @@
 			"cpu": [
 				"x64"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -2113,7 +2094,6 @@
 			"version": "0.10.2",
 			"resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.2.tgz",
 			"integrity": "sha512-RoBvJ2X0wuKlWFIjrwffGw1IqZHKQqzIchKaadZZfnNpsAYp2mM0h36JtPCjNDAHGgYez/15uMBpfGwchhiMgg==",
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"dependencies": {
@@ -7349,7 +7329,7 @@
 			"version": "1.21.7",
 			"resolved": "https://registry.npmjs.org/jiti/-/jiti-1.21.7.tgz",
 			"integrity": "sha512-/imKNG4EbWNrVjoNC/1H5/9GFy+tqjGBHCaSsN+P2RnPqjsLmv6UD3Ej+Kj8nBWaRAwyk7kK5ZUc+OEatnTR3A==",
-			"dev": true,
+			"devOptional": true,
 			"license": "MIT",
 			"bin": {
 				"jiti": "bin/jiti.js"
@@ -7884,7 +7864,6 @@
 			"cpu": [
 				"arm64"
 			],
-			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -7905,7 +7884,6 @@
 			"cpu": [
 				"arm64"
 			],
-			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -7926,7 +7904,6 @@
 			"cpu": [
 				"x64"
 			],
-			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -7947,7 +7924,6 @@
 			"cpu": [
 				"x64"
 			],
-			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -7968,7 +7944,6 @@
 			"cpu": [
 				"arm"
 			],
-			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -7989,7 +7964,6 @@
 			"cpu": [
 				"arm64"
 			],
-			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -8010,7 +7984,6 @@
 			"cpu": [
 				"arm64"
 			],
-			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -8031,7 +8004,6 @@
 			"cpu": [
 				"x64"
 			],
-			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -8052,7 +8024,6 @@
 			"cpu": [
 				"x64"
 			],
-			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -8073,7 +8044,6 @@
 			"cpu": [
 				"arm64"
 			],
-			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -8094,7 +8064,6 @@
 			"cpu": [
 				"x64"
 			],
-			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -12782,21 +12751,6 @@
 				}
 			}
 		},
-		"node_modules/svelte-check/node_modules/picomatch": {
-			"version": "4.0.5",
-			"resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.5.tgz",
-			"integrity": "sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==",
-			"dev": true,
-			"license": "MIT",
-			"optional": true,
-			"peer": true,
-			"engines": {
-				"node": ">=12"
-			},
-			"funding": {
-				"url": "https://github.com/sponsors/jonschlinkert"
-			}
-		},
 		"node_modules/svelte-eslint-parser": {
 			"version": "0.43.0",
 			"resolved": "https://registry.npmjs.org/svelte-eslint-parser/-/svelte-eslint-parser-0.43.0.tgz",
@@ -13536,7 +13490,7 @@
 			"version": "5.9.3",
 			"resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
 			"integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
-			"dev": true,
+			"devOptional": true,
 			"license": "Apache-2.0",
 			"bin": {
 				"tsc": "bin/tsc",
@@ -14332,9 +14286,9 @@
 			"integrity": "sha512-qm09YmnbeYHLwYn1jUnObVzPhYO9NZKMlIO7nlo7zPJBXqksgG5fK/KCtwGw9rChrnz+DsvM9wP5FhrwRLMtwQ=="
 		},
 		"node_modules/windmill-parser-wasm-go": {
-			"version": "1.510.1",
-			"resolved": "https://registry.npmjs.org/windmill-parser-wasm-go/-/windmill-parser-wasm-go-1.510.1.tgz",
-			"integrity": "sha512-HOkk6LXK0wrwvkn+zjm3Gxo90HmyL6TYqmLo2yp8fZuppy7GOngT27zwYeBtwONiPyvDKskzoqPQoEfd8VuUsQ=="
+			"version": "1.761.0",
+			"resolved": "https://registry.npmjs.org/windmill-parser-wasm-go/-/windmill-parser-wasm-go-1.761.0.tgz",
+			"integrity": "sha512-jNM0kh0U5uSetwBVSmueFs91GTdbn/tffny2XB1LrrSUElP5i+PK7i12zrWNT2q9JUK2L215CbmyfNmkacbo1Q=="
 		},
 		"node_modules/windmill-parser-wasm-java": {
 			"version": "1.510.1",
diff --git a/frontend/package.json b/frontend/package.json
index d7541af7bf..795304bc1e 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -157,7 +157,7 @@
 		"vscode-ws-jsonrpc": "~3.5.0",
 		"windmill-parser-wasm-asset": "1.749.0",
 		"windmill-parser-wasm-csharp": "1.510.1",
-		"windmill-parser-wasm-go": "1.510.1",
+		"windmill-parser-wasm-go": "1.761.0",
 		"windmill-parser-wasm-java": "1.510.1",
 		"windmill-parser-wasm-nu": "1.510.1",
 		"windmill-parser-wasm-php": "1.647.1",

From ae3d9ce2c031beeafc4e8156e0c85f163647af0f Mon Sep 17 00:00:00 2001
From: hugocasa <hugo@casademont.ch>
Date: Fri, 17 Jul 2026 19:34:17 +0200
Subject: [PATCH 039/171] fix(mcp): apply token scopes consistently across mcp
 endpoint tools (#10162)

* fix(mcp): apply token scopes consistently across mcp endpoint tools

Endpoint-tool authorization is now shared between single- and
multi-workspace modes, honors the token's script/flow path patterns for
every path-taking tool, and the JWT minted for proxied endpoint calls
carries scopes derived from the caller's own.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* chore(mcp): review nits: restore create_http_request doc, reword comments

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
---
 backend/windmill-api/src/mcp/utils.rs     | 120 ++++-
 backend/windmill-mcp/src/server/runner.rs | 546 ++++++++++++++++++----
 2 files changed, 545 insertions(+), 121 deletions(-)

diff --git a/backend/windmill-api/src/mcp/utils.rs b/backend/windmill-api/src/mcp/utils.rs
index 7bca92dd57..d68afe826d 100644
--- a/backend/windmill-api/src/mcp/utils.rs
+++ b/backend/windmill-api/src/mcp/utils.rs
@@ -518,6 +518,42 @@ pub fn build_request_body(
     }
 }
 
+/// Scopes to embed in the JWT minted for a proxied MCP endpoint request. The MCP
+/// runner already authorized *which* endpoint may be called; this bounds *what
+/// the resulting internal request can do*.
+///
+/// - Unscoped caller (cookie / full-privilege token): unscoped JWT.
+/// - Scope-restricted caller whose own scopes already authorize the route: keep
+///   those scopes verbatim, so the target handler's per-path `check_scopes` still
+///   enforces the caller's path caps (e.g. a `variables:read:u/admin/safe/*`
+///   token can't read `u/admin/secret` via the getVariable proxy).
+/// - Otherwise the caller has no route scope for this domain (the common
+///   `mcp:`-only token): mint a least-privilege scope for exactly this route,
+///   failing closed if the route can't be resolved.
+fn jwt_scopes_for_proxied_route(
+    caller_scopes: Option<&[String]>,
+    method: &str,
+    route_path: &str,
+) -> BackendResult<Option<Vec<String>>> {
+    let caller_restricted =
+        caller_scopes.is_some_and(|s| s.iter().any(|x| !x.starts_with("if_jobs:filter_tags:")));
+    if !caller_restricted {
+        return Ok(None);
+    }
+    if windmill_api_auth::scopes::check_scopes_for_route(caller_scopes, route_path, method).is_ok()
+    {
+        return Ok(caller_scopes.map(|s| s.to_vec()));
+    }
+    let scope =
+        windmill_api_auth::scopes::scope_for_route(method, route_path).ok_or_else(|| {
+            ErrorData::internal_error(
+                "Could not derive route scope for proxied MCP endpoint".to_string(),
+                None,
+            )
+        })?;
+    Ok(Some(vec![scope]))
+}
+
 /// Create HTTP request with authentication
 pub async fn create_http_request(
     method: &str,
@@ -541,31 +577,12 @@ pub async fn create_http_request(
         }
     };
 
-    // Bound the minted JWT to exactly this proxied route so a scope-restricted
-    // MCP token can't be widened into a full-privilege blank check. The
-    // endpoint-name gate (in the MCP runner) already authorized *which* endpoint
-    // may be called; this constrains what the resulting request can do. Unscoped
-    // callers (cookie / full-privilege tokens) keep an unscoped JWT to preserve
-    // existing behavior. A scope-restricted caller whose route can't be resolved
-    // fails closed.
-    let caller_restricted = api_authed
-        .scopes
-        .as_deref()
-        .is_some_and(|s| s.iter().any(|x| !x.starts_with("if_jobs:filter_tags:")));
-    let scopes = if caller_restricted {
-        let parsed = reqwest::Url::parse(url)
-            .map_err(|e| ErrorData::internal_error(format!("Invalid proxied URL: {}", e), None))?;
-        let scope =
-            windmill_api_auth::scopes::scope_for_route(method, parsed.path()).ok_or_else(|| {
-                ErrorData::internal_error(
-                    "Could not derive route scope for proxied MCP endpoint".to_string(),
-                    None,
-                )
-            })?;
-        Some(vec![scope])
-    } else {
-        None
-    };
+    // Scope the minted JWT to the proxied route so a scope-restricted MCP token
+    // can't be widened into a full-privilege blank check. See
+    // `jwt_scopes_for_proxied_route`.
+    let parsed = reqwest::Url::parse(url)
+        .map_err(|e| ErrorData::internal_error(format!("Invalid proxied URL: {}", e), None))?;
+    let scopes = jwt_scopes_for_proxied_route(api_authed.scopes.as_deref(), method, parsed.path())?;
 
     // Add authorization header
     let authed = Authed::from(api_authed.clone());
@@ -620,6 +637,59 @@ mod tests {
     use super::*;
     use serde_json::json;
 
+    fn scopes(list: &[&str]) -> Vec<String> {
+        list.iter().map(|s| s.to_string()).collect()
+    }
+
+    #[test]
+    fn proxy_jwt_unscoped_caller_keeps_none() {
+        // No scopes, or filter-tags-only, is treated as unscoped -> unscoped JWT.
+        assert_eq!(
+            jwt_scopes_for_proxied_route(None, "GET", "/api/w/ws/variables/get/u/a/b").unwrap(),
+            None
+        );
+        let ft = scopes(&["if_jobs:filter_tags:foo"]);
+        assert_eq!(
+            jwt_scopes_for_proxied_route(Some(&ft), "GET", "/api/w/ws/variables/get/u/a/b")
+                .unwrap(),
+            None
+        );
+    }
+
+    #[test]
+    fn proxy_jwt_bare_mcp_token_falls_back_to_route_scope() {
+        // A token whose only authority is its mcp: scope has no variables route
+        // scope, so the JWT gets a least-privilege route scope for this request.
+        let s = scopes(&["mcp:endpoints:getVariable"]);
+        assert_eq!(
+            jwt_scopes_for_proxied_route(Some(&s), "GET", "/api/w/ws/variables/get/u/admin/secret")
+                .unwrap(),
+            Some(scopes(&["variables:read"]))
+        );
+    }
+
+    #[test]
+    fn proxy_jwt_mixed_token_passes_through_caller_route_scope() {
+        // The caller's route scope is preserved so the target handler's per-path
+        // check_scopes enforces the cap; the coarse route match here is path-blind.
+        let s = scopes(&["mcp:endpoints:getVariable", "variables:read:u/admin/safe/*"]);
+        assert_eq!(
+            jwt_scopes_for_proxied_route(Some(&s), "GET", "/api/w/ws/variables/get/u/admin/secret")
+                .unwrap(),
+            Some(s.clone())
+        );
+    }
+
+    #[test]
+    fn proxy_jwt_run_script_bare_mcp_falls_back_to_jobs_run_scripts() {
+        let s = scopes(&["mcp:scripts:f/team/*", "mcp:endpoints:*"]);
+        assert_eq!(
+            jwt_scopes_for_proxied_route(Some(&s), "POST", "/api/w/ws/jobs/run/p/f/team/deploy")
+                .unwrap(),
+            Some(scopes(&["jobs:run:scripts"]))
+        );
+    }
+
     #[test]
     fn build_request_body_passthrough_forwards_script_args_minus_path() {
         // runScriptByPath-shaped body: additionalProperties, no declared props.
diff --git a/backend/windmill-mcp/src/server/runner.rs b/backend/windmill-mcp/src/server/runner.rs
index 5db32faedb..ee6540520e 100644
--- a/backend/windmill-mcp/src/server/runner.rs
+++ b/backend/windmill-mcp/src/server/runner.rs
@@ -12,7 +12,7 @@ use crate::common::transform::{
 use crate::common::types::{McpToken, MultiWorkspaceMcp, ResourceInfo, ToolableItem, WorkspaceId};
 use crate::server::backend::{McpAuth, McpBackend, PathFilter};
 use crate::server::endpoints::{
-    endpoint_tool_to_mcp_tool, endpoint_tool_to_mcp_tool_multi, list_workspaces_tool,
+    endpoint_tool_to_mcp_tool, endpoint_tool_to_mcp_tool_multi, list_workspaces_tool, EndpointTool,
 };
 use crate::server::tools::create_tool_from_item;
 use rmcp::handler::server::ServerHandler;
@@ -126,20 +126,176 @@ impl<B: McpBackend> Runner<B> {
     }
 }
 
-/// The run-by-path endpoint tools execute an arbitrary script/flow named by a
-/// `path` argument. In multi-workspace mode they are the only way to run
-/// scripts/flows, so their authorization must honor the `mcp:scripts:` /
-/// `mcp:flows:` path scopes (not the generic endpoint scope) — otherwise a
-/// granular token could run items outside its allowed paths. Returns the scope
-/// resource type ("script"/"flow") for these endpoints, `None` otherwise.
-fn run_by_path_scope_kind(endpoint_name: &str) -> Option<&'static str> {
+/// How an endpoint tool interacts with the token's `mcp:scripts:` / `mcp:flows:`
+/// path scopes.
+enum EndpointPathPolicy {
+    /// Executes the script/flow named by the `path` argument. Gated by the
+    /// script/flow scope alone (an endpoint scope is not enough to run things):
+    /// in multi-workspace mode these are the only way to run scripts/flows, so a
+    /// granular token must not run items outside its allowed paths.
+    RunByPath(&'static str),
+    /// Reads/writes the script/flow named by the listed path arguments. The
+    /// endpoint scope grants the capability; when the token also carries path
+    /// patterns for `kind`, every listed argument must match them.
+    PathArgs { kind: &'static str, fields: &'static [&'static str] },
+    /// Affects scripts without taking a checkable path (delete-by-hash) or
+    /// executes arbitrary code (preview). Unavailable to path-confined tokens —
+    /// allowing these would bypass the path patterns entirely.
+    Unconfinable(&'static str),
+}
+
+fn endpoint_path_policy(endpoint_name: &str) -> Option<EndpointPathPolicy> {
+    use EndpointPathPolicy::*;
     match endpoint_name {
-        "runScriptByPath" => Some("script"),
-        "runFlowByPath" => Some("flow"),
+        "runScriptByPath" => Some(RunByPath("script")),
+        "runFlowByPath" => Some(RunByPath("flow")),
+        "getScriptByPath" | "deleteScriptByPath" | "createScript" => {
+            Some(PathArgs { kind: "script", fields: &["path"] })
+        }
+        "getFlowByPath" | "deleteFlowByPath" | "createFlow" => {
+            Some(PathArgs { kind: "flow", fields: &["path"] })
+        }
+        // updateFlow addresses the flow via the URL path and can move it to the
+        // path given in the body — both must stay within scope.
+        "updateFlow" => Some(PathArgs { kind: "flow", fields: &["path__path", "path__body"] }),
+        "deleteScriptByHash" | "runScriptPreviewAndWaitResult" => Some(Unconfinable("script")),
         _ => None,
     }
 }
 
+/// Whether the token restricts `kind` ("script"/"flow") to specific paths. A
+/// `*` pattern grants every path (see `is_resource_allowed`), so it does not
+/// count as confinement.
+fn path_confined(scope_config: &crate::common::scope::McpScopeConfig, kind: &str) -> bool {
+    if scope_config.all {
+        return false;
+    }
+    let patterns = match kind {
+        "script" => &scope_config.scripts,
+        "flow" => &scope_config.flows,
+        _ => return false,
+    };
+    !patterns.is_empty() && !patterns.iter().any(|p| p == "*")
+}
+
+fn require_path_arg<'a>(
+    endpoint_tool: &EndpointTool,
+    args: &'a Value,
+    field: &str,
+) -> Result<&'a str, ErrorData> {
+    args.get(field)
+        .and_then(|v| v.as_str())
+        .filter(|s| !s.is_empty())
+        .ok_or_else(|| {
+            ErrorData::invalid_params(
+                format!(
+                    "Missing required '{}' argument for tool '{}'.",
+                    field, endpoint_tool.name
+                ),
+                None,
+            )
+        })
+}
+
+/// Whether an endpoint tool is in scope for *listing*. Run-by-path endpoints are
+/// gated by the script/flow scope (`has_any` — the token can run at least one
+/// path of that kind); unconfinable endpoints are hidden from path-confined
+/// tokens (their calls would always be denied); every other endpoint by the
+/// endpoint-name scope.
+fn endpoint_tool_in_scope(
+    scope_config: &crate::common::scope::McpScopeConfig,
+    endpoint_tool: &EndpointTool,
+) -> bool {
+    let endpoint_allowed =
+        !scope_config.granular || scope_config.is_allowed("endpoint", &endpoint_tool.name);
+    match endpoint_path_policy(&endpoint_tool.name) {
+        Some(EndpointPathPolicy::RunByPath(kind)) => scope_config.has_any(kind),
+        Some(EndpointPathPolicy::Unconfinable(kind)) => {
+            endpoint_allowed && !path_confined(scope_config, kind)
+        }
+        _ => endpoint_allowed,
+    }
+}
+
+/// Authorize an endpoint-tool *call* against the token's MCP scopes and
+/// read-only flag. Shared by single- and multi-workspace modes so both enforce
+/// the same rules — otherwise a granular token could run items outside its
+/// allowed paths through the single-workspace path. Run-by-path endpoints
+/// (runScriptByPath/runFlowByPath) are gated by the script/flow scope for the
+/// requested `path` (the endpoint-name scope alone is insufficient); other
+/// endpoints by the endpoint-name scope, with script/flow path arguments
+/// additionally confined to the token's path patterns when it has any; and
+/// non-GET endpoints are refused for read-only tokens.
+fn authorize_endpoint_call(
+    scope_config: &crate::common::scope::McpScopeConfig,
+    endpoint_tool: &EndpointTool,
+    args: &Value,
+    read_only: bool,
+) -> Result<(), ErrorData> {
+    match endpoint_path_policy(&endpoint_tool.name) {
+        Some(EndpointPathPolicy::RunByPath(kind)) => {
+            let path = require_path_arg(endpoint_tool, args, "path")?;
+            // No `granular` gate: is_allowed already encodes every mode — true for
+            // mcp:all, pattern-matched for granular scopes, and false for
+            // mcp:favorites (a favorites token can't run an arbitrary path).
+            if !scope_config.is_allowed(kind, path) {
+                return Err(ErrorData::internal_error(
+                    format!("Access denied: {} '{}' not in token scope", kind, path),
+                    None,
+                ));
+            }
+        }
+        policy => {
+            if scope_config.granular && !scope_config.is_allowed("endpoint", &endpoint_tool.name) {
+                return Err(ErrorData::internal_error(
+                    format!(
+                        "Access denied: endpoint '{}' not in token scope",
+                        endpoint_tool.name
+                    ),
+                    None,
+                ));
+            }
+            match policy {
+                Some(EndpointPathPolicy::PathArgs { kind, fields })
+                    if path_confined(scope_config, kind) =>
+                {
+                    for field in fields {
+                        let path = require_path_arg(endpoint_tool, args, field)?;
+                        if !scope_config.is_allowed(kind, path) {
+                            return Err(ErrorData::internal_error(
+                                format!("Access denied: {} '{}' not in token scope", kind, path),
+                                None,
+                            ));
+                        }
+                    }
+                }
+                Some(EndpointPathPolicy::Unconfinable(kind))
+                    if path_confined(scope_config, kind) =>
+                {
+                    return Err(ErrorData::internal_error(
+                        format!(
+                            "Access denied: endpoint '{}' is not available to a token restricted to specific {} paths",
+                            endpoint_tool.name, kind
+                        ),
+                        None,
+                    ));
+                }
+                _ => {}
+            }
+        }
+    }
+    if read_only && !crate::server::is_endpoint_read_only(endpoint_tool) {
+        return Err(ErrorData::internal_error(
+            format!(
+                "Access denied: endpoint '{}' is not read-only and this token is restricted to read-only operations",
+                endpoint_tool.name
+            ),
+            None,
+        ));
+    }
+    Ok(())
+}
+
 fn find_matching_path<T: ToolableItem>(candidates: Vec<T>, request_name: &str) -> Option<String> {
     candidates
         .into_iter()
@@ -373,10 +529,13 @@ impl<B: McpBackend> Runner<B> {
             }
         }
 
-        // Add endpoint tools from the generated MCP tools, filtered by scope
+        // Add endpoint tools from the generated MCP tools, filtered by scope.
+        // Uses the same run-by-path-aware gate as multi-workspace mode so a
+        // granular token only sees runScriptByPath / runFlowByPath when it can
+        // actually run scripts / flows.
         let endpoint_tools = self.backend.all_endpoint_tools();
         for endpoint_tool in endpoint_tools {
-            if scope_config.granular && !scope_config.is_allowed("endpoint", &endpoint_tool.name) {
+            if !endpoint_tool_in_scope(scope_config, &endpoint_tool) {
                 continue;
             }
             if read_only && !crate::server::is_endpoint_read_only(&endpoint_tool) {
@@ -403,27 +562,9 @@ impl<B: McpBackend> Runner<B> {
         let endpoint_tools = self.backend.all_endpoint_tools();
         for endpoint_tool in &endpoint_tools {
             if endpoint_tool.name.as_ref() == name.as_ref() {
-                // Validate endpoint scope
-                if scope_config.granular
-                    && !scope_config.is_allowed("endpoint", &endpoint_tool.name)
-                {
-                    return Err(ErrorData::internal_error(
-                        format!(
-                            "Access denied: endpoint '{}' not in token scope",
-                            endpoint_tool.name
-                        ),
-                        None,
-                    ));
-                }
-                if read_only && !crate::server::is_endpoint_read_only(endpoint_tool) {
-                    return Err(ErrorData::internal_error(
-                        format!(
-                            "Access denied: endpoint '{}' is not read-only and this token is restricted to read-only operations",
-                            endpoint_tool.name
-                        ),
-                        None,
-                    ));
-                }
+                // Authorize against the token's MCP scopes and read-only flag,
+                // including the run-by-path path check (shared with multi mode).
+                authorize_endpoint_call(scope_config, endpoint_tool, &args, read_only)?;
 
                 // This is an endpoint tool, call via backend
                 let result = self
@@ -580,16 +721,7 @@ impl<B: McpBackend> Runner<B> {
 
         let endpoint_tools = self.backend.all_endpoint_tools();
         for endpoint_tool in endpoint_tools {
-            // Run-by-path tools are gated by script/flow scope (they run an
-            // arbitrary path); every other endpoint by the endpoint scope.
-            let allowed = match run_by_path_scope_kind(&endpoint_tool.name) {
-                Some(kind) => scope_config.has_any(kind),
-                None => {
-                    !scope_config.granular
-                        || scope_config.is_allowed("endpoint", &endpoint_tool.name)
-                }
-            };
-            if !allowed {
+            if !endpoint_tool_in_scope(scope_config, &endpoint_tool) {
                 continue;
             }
             if read_only && !crate::server::is_endpoint_read_only(&endpoint_tool) {
@@ -641,59 +773,13 @@ impl<B: McpBackend> Runner<B> {
                 )
             })?;
 
-        // Authorize the tool. Run-by-path endpoints (runScriptByPath /
-        // runFlowByPath) run an arbitrary `path` and must be checked against the
-        // script/flow scope for that path — the endpoint scope alone would let a
-        // granular token run items outside its allowed paths.
-        match run_by_path_scope_kind(&endpoint_tool.name) {
-            Some(kind) => {
-                let path = args
-                    .get("path")
-                    .and_then(|v| v.as_str())
-                    .filter(|s| !s.is_empty())
-                    .ok_or_else(|| {
-                        ErrorData::invalid_params(
-                            format!(
-                                "Missing required 'path' argument for tool '{}'.",
-                                endpoint_tool.name
-                            ),
-                            None,
-                        )
-                    })?;
-                // No `granular` gate: is_allowed already encodes every mode —
-                // true for mcp:all, pattern-matched for granular scopes, and
-                // false for mcp:favorites (a favorites token can't run an
-                // arbitrary path, only its enumerated favorites).
-                if !scope_config.is_allowed(kind, path) {
-                    return Err(ErrorData::internal_error(
-                        format!("Access denied: {} '{}' not in token scope", kind, path),
-                        None,
-                    ));
-                }
-            }
-            None => {
-                if scope_config.granular
-                    && !scope_config.is_allowed("endpoint", &endpoint_tool.name)
-                {
-                    return Err(ErrorData::internal_error(
-                        format!(
-                            "Access denied: endpoint '{}' not in token scope",
-                            endpoint_tool.name
-                        ),
-                        None,
-                    ));
-                }
-            }
-        }
-        if read_only && !crate::server::is_endpoint_read_only(endpoint_tool) {
-            return Err(ErrorData::internal_error(
-                format!(
-                    "Access denied: endpoint '{}' is not read-only and this token is restricted to read-only operations",
-                    endpoint_tool.name
-                ),
-                None,
-            ));
-        }
+        // Authorize the tool against the token's MCP scopes and read-only flag
+        // (shared with single-workspace mode). Run-by-path endpoints
+        // (runScriptByPath / runFlowByPath) run an arbitrary `path` and are
+        // checked against the script/flow scope for that path — the endpoint
+        // scope alone would let a granular token run items outside its allowed
+        // paths.
+        authorize_endpoint_call(scope_config, endpoint_tool, &args, read_only)?;
 
         // Workspace-scoped endpoints need an explicit target workspace and a
         // per-workspace auth; global endpoints (e.g. docs) use the base identity.
@@ -746,3 +832,271 @@ impl<B: McpBackend> Runner<B> {
         )]))
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::common::scope::{parse_mcp_scopes, McpScopeConfig};
+    use serde_json::json;
+    use std::borrow::Cow;
+
+    fn cfg(scopes: &[&str]) -> McpScopeConfig {
+        parse_mcp_scopes(&scopes.iter().map(|s| s.to_string()).collect::<Vec<_>>()).unwrap()
+    }
+
+    fn ep(name: &'static str, method: &'static str) -> EndpointTool {
+        EndpointTool {
+            name: Cow::Borrowed(name),
+            description: Cow::Borrowed(""),
+            instructions: Cow::Borrowed(""),
+            path: Cow::Borrowed("/w/{workspace}/jobs/run/p/{path}"),
+            method: Cow::Borrowed(method),
+            path_params_schema: None,
+            query_params_schema: None,
+            body_schema: None,
+            path_field_renames: None,
+            query_field_renames: None,
+            body_field_renames: None,
+        }
+    }
+
+    // The core invariant: a folder-scoped token (mcp:endpoints:* +
+    // mcp:scripts:f/team/*, as the folder-scope UI emits) must not run a script
+    // outside its allowed folders via runScriptByPath — mcp:endpoints:* alone
+    // must never authorize an arbitrary path.
+    #[test]
+    fn run_by_path_call_enforces_script_scope() {
+        let config = cfg(&[
+            "mcp:scripts:f/team/*",
+            "mcp:flows:f/team/*",
+            "mcp:endpoints:*",
+        ]);
+        let tool = ep("runScriptByPath", "POST");
+
+        assert!(
+            authorize_endpoint_call(&config, &tool, &json!({"path": "f/team/deploy"}), false)
+                .is_ok()
+        );
+        assert!(
+            authorize_endpoint_call(&config, &tool, &json!({"path": "f/secret/admin"}), false)
+                .is_err()
+        );
+    }
+
+    #[test]
+    fn run_by_path_call_requires_path_arg() {
+        let tool = ep("runFlowByPath", "POST");
+        assert!(authorize_endpoint_call(&cfg(&["mcp:all"]), &tool, &json!({}), false).is_err());
+    }
+
+    #[test]
+    fn run_by_path_flow_scope_independent_of_script_scope() {
+        // A flow-only token can run flows by path but not scripts by path.
+        let config = cfg(&["mcp:flows:f/team/*", "mcp:endpoints:*"]);
+        assert!(authorize_endpoint_call(
+            &config,
+            &ep("runFlowByPath", "POST"),
+            &json!({"path": "f/team/x"}),
+            false
+        )
+        .is_ok());
+        assert!(authorize_endpoint_call(
+            &config,
+            &ep("runScriptByPath", "POST"),
+            &json!({"path": "f/team/x"}),
+            false
+        )
+        .is_err());
+    }
+
+    #[test]
+    fn non_run_by_path_gated_by_endpoint_scope() {
+        let get_var = ep("getVariable", "GET");
+        assert!(authorize_endpoint_call(
+            &cfg(&["mcp:endpoints:getVariable"]),
+            &get_var,
+            &json!({"path": "u/a/b"}),
+            false
+        )
+        .is_ok());
+        // A granular token without the endpoint scope is denied.
+        assert!(authorize_endpoint_call(
+            &cfg(&["mcp:scripts:f/team/*"]),
+            &get_var,
+            &json!({"path": "u/a/b"}),
+            false
+        )
+        .is_err());
+        // mcp:all (non-granular) allows any endpoint.
+        assert!(authorize_endpoint_call(&cfg(&["mcp:all"]), &get_var, &json!({}), false).is_ok());
+    }
+
+    #[test]
+    fn read_only_refuses_non_get_endpoint() {
+        // Reaches the read-only check via mcp:all so scope isn't the blocker.
+        assert!(authorize_endpoint_call(
+            &cfg(&["mcp:all"]),
+            &ep("createResource", "POST"),
+            &json!({}),
+            true
+        )
+        .is_err());
+        assert!(authorize_endpoint_call(
+            &cfg(&["mcp:all"]),
+            &ep("getVariable", "GET"),
+            &json!({"path": "u/a/b"}),
+            true
+        )
+        .is_ok());
+    }
+
+    #[test]
+    fn listing_run_by_path_needs_runnable_scope() {
+        let tool = ep("runScriptByPath", "POST");
+        // An endpoint-only token cannot run any script, so the tool isn't listed.
+        assert!(!endpoint_tool_in_scope(&cfg(&["mcp:endpoints:*"]), &tool));
+        // A script-scoped token can, so it is listed.
+        assert!(endpoint_tool_in_scope(
+            &cfg(&["mcp:scripts:f/team/*"]),
+            &tool
+        ));
+        assert!(endpoint_tool_in_scope(&cfg(&["mcp:all"]), &tool));
+        // Non-run-by-path endpoints are governed by the endpoint scope.
+        let get_var = ep("getVariable", "GET");
+        assert!(endpoint_tool_in_scope(
+            &cfg(&["mcp:endpoints:getVariable"]),
+            &get_var
+        ));
+        assert!(!endpoint_tool_in_scope(
+            &cfg(&["mcp:scripts:f/team/*"]),
+            &get_var
+        ));
+    }
+
+    // A folder-scoped token must not read/write/delete scripts or flows outside
+    // its allowed paths through the non-run endpoint tools either.
+    #[test]
+    fn path_arg_tools_confined_by_path_patterns() {
+        let config = cfg(&[
+            "mcp:scripts:f/team/*",
+            "mcp:flows:f/team/*",
+            "mcp:endpoints:*",
+        ]);
+        for name in ["getScriptByPath", "deleteScriptByPath", "createScript"] {
+            let tool = ep(name, "POST");
+            assert!(
+                authorize_endpoint_call(&config, &tool, &json!({"path": "f/team/x"}), false)
+                    .is_ok(),
+                "{name} should allow in-scope path"
+            );
+            assert!(
+                authorize_endpoint_call(&config, &tool, &json!({"path": "f/secret/x"}), false)
+                    .is_err(),
+                "{name} should deny out-of-scope path"
+            );
+            // Confinement can't be verified without the path argument.
+            assert!(
+                authorize_endpoint_call(&config, &tool, &json!({}), false).is_err(),
+                "{name} should require the path argument when confined"
+            );
+        }
+        for name in ["getFlowByPath", "deleteFlowByPath", "createFlow"] {
+            let tool = ep(name, "POST");
+            assert!(
+                authorize_endpoint_call(&config, &tool, &json!({"path": "f/team/x"}), false)
+                    .is_ok(),
+                "{name} should allow in-scope path"
+            );
+            assert!(
+                authorize_endpoint_call(&config, &tool, &json!({"path": "f/secret/x"}), false)
+                    .is_err(),
+                "{name} should deny out-of-scope path"
+            );
+        }
+    }
+
+    // A token that never expressed path patterns (endpoints-only) is not
+    // confined: the endpoint scope alone authorizes any path.
+    #[test]
+    fn path_arg_tools_unconfined_without_path_patterns() {
+        let config = cfg(&["mcp:endpoints:*"]);
+        for name in ["getScriptByPath", "createScript", "deleteFlowByPath"] {
+            assert!(authorize_endpoint_call(
+                &config,
+                &ep(name, "POST"),
+                &json!({"path": "f/anywhere/x"}),
+                false
+            )
+            .is_ok());
+        }
+        // A `*` pattern grants every path, so it doesn't confine either.
+        let star = cfg(&["mcp:scripts:*", "mcp:endpoints:*"]);
+        assert!(authorize_endpoint_call(
+            &star,
+            &ep("createScript", "POST"),
+            &json!({"path": "f/anywhere/x"}),
+            false
+        )
+        .is_ok());
+    }
+
+    // updateFlow both addresses a flow (URL path) and can move it (body path):
+    // a confined token must have both within scope.
+    #[test]
+    fn update_flow_checks_target_and_destination_paths() {
+        let config = cfg(&["mcp:flows:f/team/*", "mcp:endpoints:*"]);
+        let tool = ep("updateFlow", "POST");
+        assert!(authorize_endpoint_call(
+            &config,
+            &tool,
+            &json!({"path__path": "f/team/a", "path__body": "f/team/b"}),
+            false
+        )
+        .is_ok());
+        // Moving a flow out of the allowed folder is denied.
+        assert!(authorize_endpoint_call(
+            &config,
+            &tool,
+            &json!({"path__path": "f/team/a", "path__body": "f/secret/a"}),
+            false
+        )
+        .is_err());
+        // Touching a flow outside the allowed folder is denied.
+        assert!(authorize_endpoint_call(
+            &config,
+            &tool,
+            &json!({"path__path": "f/secret/a", "path__body": "f/team/a"}),
+            false
+        )
+        .is_err());
+    }
+
+    // Tools that can't be path-checked (delete-by-hash) or execute arbitrary
+    // code (preview) would bypass path confinement, so a path-confined token is
+    // denied them entirely — and doesn't see them listed.
+    #[test]
+    fn unconfinable_tools_denied_for_path_confined_token() {
+        let confined = cfg(&["mcp:scripts:f/team/*", "mcp:endpoints:*"]);
+        for name in ["deleteScriptByHash", "runScriptPreviewAndWaitResult"] {
+            let tool = ep(name, "POST");
+            assert!(authorize_endpoint_call(&confined, &tool, &json!({}), false).is_err());
+            assert!(!endpoint_tool_in_scope(&confined, &tool));
+            // Without script path patterns the tools stay available.
+            assert!(
+                authorize_endpoint_call(&cfg(&["mcp:endpoints:*"]), &tool, &json!({}), false)
+                    .is_ok()
+            );
+            assert!(authorize_endpoint_call(&cfg(&["mcp:all"]), &tool, &json!({}), false).is_ok());
+            assert!(endpoint_tool_in_scope(&cfg(&["mcp:endpoints:*"]), &tool));
+        }
+        // Flow-only confinement doesn't affect script-kind unconfinable tools.
+        let flow_confined = cfg(&["mcp:flows:f/team/*", "mcp:endpoints:*"]);
+        assert!(authorize_endpoint_call(
+            &flow_confined,
+            &ep("deleteScriptByHash", "POST"),
+            &json!({}),
+            false
+        )
+        .is_ok());
+    }
+}

From 7a139ab23e034321554d0c85540d54251e61cc72 Mon Sep 17 00:00:00 2001
From: hugocasa <hugo@casademont.ch>
Date: Fri, 17 Jul 2026 19:36:51 +0200
Subject: [PATCH 040/171] feat(ai-chat): image attachments and agent raw-app
 screenshots (#10130)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* feat(ai-chat): add image attachments and agent raw-app screenshots

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* docs(ai-chat): generalise take_screenshot fidelity caveat

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(ai-chat): keep compaction boundary on a displayed user message

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(raw-apps): count line boxes by vertical overlap, not rect count

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(ai-chat): enforce vision gating and bound image attachments

Refuse images on known text-only models instead of warning and sending them
anyway; cap input bytes before decode; keep clipboard text when it accompanies
a bitmap; don't queue a message whose images can't ride the plain-text queue.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* perf(ai-chat): trim take_screenshot schema and shrink the card's copy

Move the fidelity caveat from the tool def onto the tool result: the def is
re-sent every global iteration (~258 tok), while the caveat only matters once a
capture exists. Keep a downscaled copy in displayMessages when it is actually
smaller — those are never compacted and are re-cloned on every saveChat.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(ai-chat): carry attached images through the message queue

Enter during a streaming turn queued the text and silently dropped the images,
so the auto-send was not the message the user submitted. The queue now holds
both, moved together via takeQueue/clearQueue/restoreQueue so none of the three
flush sites, the dequeue-to-composer path, or the two conversation-switch drops
can leak one without the other.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(ai-chat): gate screenshots on vision, narrow when the tool fires

take_screenshot buffered an image unconditionally, so a text-only model got an
image_url and rejected the turn; the attach-time check never covered it, nor a
model switched after attaching. Gate before capture and again at send.

Only reach for the tool when the user raises how the app looks, rather than
after every UI edit.

A collapsed preview keeps the iframe mounted at zero width, passing the ready
checks and then failing inside the rasteriser as '[object Event]'. Name it.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(ai-chat): hold sending while attachments decode

addImages read the free-slot count before its await and appended after it, so a
send during the ~50-800ms decode cleared images while the closure still wrote to
them, landing the picture on the following message; two drops also claimed the
same slots and could pass the cap. Reserve slots up front, block sending until
they resolve, and show a placeholder so the held send is explained.

Keep only a bounded copy in the transcript: displayMessages are never compacted
and are re-cloned on every save. Measured 6.1x smaller per attachment.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(ai-chat): route screenshots to the visible tab, resend full-res on retry

Every mounted raw-app editor claimed the runtime's single screenshot slot, so
take_screenshot could capture a background tab's app; ownership now follows the
visible tab and only the owner releases it.

restartGeneration resent displayMessages' images, which became a 384px thumbnail
when the transcript copy was bounded — retries downgraded the model's own input.
Recover the sent parts from the API message instead.

Move modelSupportsVision to modelConfig: it was untestable behind lib.ts's monaco
import chain, and the denylist missed bundled text-only defaults (Groq/Together
Llama 3.3, Foundry Phi-4 and Mistral-Large). Llama 3.2 and Phi-4 split by variant,
so both are matched narrowly. Pinned against the shipped defaultModels.

Decode attachments one at a time and derive the preview from the bounded copy: a
12MP bitmap is ~48MB and the batch was held live at once, decoded twice each.

The attach tooltip claimed nothing is uploaded, which is untrue for images.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(ai-chat): keep images out of text-only turns and bound the queue

The vision gate only dropped the current turn's images, so history's image parts
still went out after a switch to a text-only model and failed the request; strip
the outbound copy instead, leaving history intact for a switch back.

queueMessage had no cap, and each queued send clears the composer for another
eight, so repeated sends stacked an unbounded batch into one message.

Editing a message resent displayMessages' bounded copy, downgrading the model's
own input; retries recovered the full-size one but then re-persisted it at full
resolution. storedImages pairs the API message with its transcript entry so both
paths resend the original and re-persist the bounded copy.

Reserve image slots before awaiting text attachments: the gap left sending
enabled with an image pending, measured ~90ms for a 40-file drop, now ~8ms
regardless of batch size.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(ai-chat): treat deepseek-v4 as text-only

deepseek-v4-pro ships as a bundled default and the gate let images through to
it, so an attachment would fail the turn. DeepSeek's vision line is deepseek-vl.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(ai-chat): drop a rejected image instead of wedging the conversation

A provider that refuses an image leaves it in history, so every later turn
resends it and fails identically: the chat is stuck until the user edits the
message or starts over, and Retry re-sends the same image. The vision gate only
knows the models we ship, so this is the net for the rest. Strip the parts on an
image-related rejection and say so; unrelated failures keep the image.

Verified at the wire that no provider rejects a base64 data URL: anthropic
(source.base64), openai/gpt-4o (input_image), googleai and aws_bedrock/claude
(image_url passthrough) all 200 and read the image.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(ai-chat): match text-only models exactly, from provider API docs

The gate guessed by substring over model names, which answers the wrong
question. What matters is whether a provider's API accepts image parts, not
whether the model can see: DeepSeek V4 ships vision in its chat product that its
API has no content type for, and o3-mini gained vision in ChatGPT the API never
exposed. Neither is inferable from a name.

Substrings also block working models. 'mistral-large' matches Mistral Large 3,
which takes images; 'phi-4' matches Phi-4-multimodal, which does too. A wrong
entry blocks with no override, while a missing one costs a turn and recovers via
the rejection path, so the list is now exact ids only, each backed by a provider
doc.

Verdicts verified against provider API docs rather than recall. Live-checked
where a doc was contradicted: Bedrock's compatibility matrix claims no Anthropic
model is served over chat completions, but it serves images fine.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(ai-chat): stop retry resurrecting a rejected image

The rejection fallback strips the image from history but leaves the bubble's
thumbnail so the user can still see what they sent. storedImages fell back to
that thumbnail when the API message had no parts, so Retry re-attached the very
image the provider had just refused and failed identically — the conversation
stayed wedged through the one control offered to escape it.

Found by retrying in the UI; unit tests, wire tests and four review passes all
missed it, since it only exists between two separate fixes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(ai-chat): harden image rejection recovery and drop-path attachment

* fix(ai-chat): fix image drop race, mid-turn vision gate, retry aliasing

* fix(ai-chat): key vision denylist by provider, flatten alpha before jpeg

* feat(ai-chat): offer take_screenshot on chromium only, ask for one elsewhere

* feat(ai-chat): image-only sends and click-to-expand image previews

* fix(ai-chat): capture screenshots at 2x and expand tool images full-res

* feat(frontend): expandable image previews in composer and result views

* fix(ai-chat): image-only send edge cases from review round

* fix(ai-chat): keep image-only drafts on rollback, track failing model id

* fix(ai-chat): gate rejection recovery on the failing iteration's model

* refactor(ai-chat): record iteration model via onBeforeIteration, trim tests

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ai-chat): restore composer draft when beforeSend preflight fails

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ai-chat): bound cumulative outbound image bytes per request

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ai-chat): make the image byte bound part-granular so over-cap turns keep a subset

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ai-chat): evict newest-first within a message in the image byte bound

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ai-chat): prune over-cap images from stored history, not just requests

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ai-chat): bound history at every save boundary, keep thumbnail pairing across eviction

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ai-chat): slot-align storedImages so the bubble expands the right image after eviction

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ai-chat): match rejection keywords as whole words so provisioning errors keep images

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ai-chat): match input_image rejections, restore images refused by non-GLOBAL modes

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ai-chat): defer non-GLOBAL image refusal restore past the composer clear

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ai-chat): persist full tool screenshots for post-reload expansion

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* refactor(ai-chat): persist chat images out-of-band via blob-store refs

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ai-chat): scope image blobs per chat and stop cap-eviction rotation

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ai-chat): keep blob-cap chronology across drop-oldest compaction

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* refactor(ai-chat): derive blob eviction from the saved record, not write times

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ai-chat): serialize chat history DB writes per manager

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ai-chat): pin queued history writes to the enqueue-time user database

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ai-chat): delete stale image blobs only after the chat record commits

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ai-chat): don't double-restore a queued image-only draft on vision refusal

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ai-chat): label image-only chats and evicted image-only bubbles

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ai-chat): keep the in-memory chat mirror hydrated for DB-less sessions

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ai-chat): converge the chat mirror to refs after a successful DB commit

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ai-chat): guard mirror convergence against rewinding newer saves

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ai-chat): invalidate pending convergences on identity re-init, keep retry image names

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ai-chat): bound the screenshot raster before rasterization

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* refactor(ai-chat): drop the no-IndexedDB in-memory image fallback

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
---
 frontend/package-lock.json                    |   7 +
 frontend/package.json                         |   1 +
 .../src/lib/components/DisplayResult.svelte   |  17 +-
 .../src/lib/components/S3FilePreview.svelte   |   4 +-
 .../common/image/ExpandableImage.svelte       |  81 ++
 .../copilot/chat/AIChatDisplay.svelte         |  83 ++-
 .../copilot/chat/AIChatInput.svelte           | 182 ++++-
 .../copilot/chat/AIChatManager.svelte.ts      | 377 ++++++++--
 .../copilot/chat/AIChatManager.test.ts        | 690 +++++++++++++++++-
 .../copilot/chat/AIChatMessage.svelte         |  50 +-
 .../copilot/chat/ContextTextarea.svelte       |  19 +
 .../copilot/chat/HistoryManager.svelte.ts     | 337 ++++++++-
 .../copilot/chat/HistoryManager.test.ts       | 589 +++++++++++++++
 .../copilot/chat/QueuedMessageChip.svelte     |  23 +-
 .../copilot/chat/ToolExecutionDisplay.svelte  |  12 +
 .../components/copilot/chat/anthropic.test.ts |  39 +-
 .../lib/components/copilot/chat/anthropic.ts  |  42 +-
 .../components/copilot/chat/chatLoop.test.ts  | 105 +++
 .../lib/components/copilot/chat/chatLoop.ts   |  24 +-
 .../copilot/chat/global/core.test.ts          |  23 +-
 .../components/copilot/chat/global/core.ts    | 107 ++-
 .../copilot/chat/imageUtils.test.ts           | 173 +++++
 .../lib/components/copilot/chat/imageUtils.ts | 273 +++++++
 .../copilot/chat/openai-responses.test.ts     |  39 +
 .../copilot/chat/openai-responses.ts          |  22 +-
 .../components/copilot/chat/shared.test.ts    |  36 +
 .../src/lib/components/copilot/chat/shared.ts |  42 ++
 .../src/lib/components/copilot/lib.test.ts    |  38 +
 frontend/src/lib/components/copilot/lib.ts    |   8 +-
 .../src/lib/components/copilot/modelConfig.ts |  66 ++
 .../components/raw_apps/RawAppEditor.svelte   | 115 ++-
 frontend/src/lib/components/raw_apps/utils.ts |   5 +
 .../sessions/RawAppEditorView.svelte          |  19 +-
 .../sessions/sessionRuntime.svelte.ts         |  50 +-
 frontend/src/lib/isChromiumBrowser.test.ts    |  45 ++
 frontend/src/lib/utils.ts                     |  15 +
 36 files changed, 3595 insertions(+), 163 deletions(-)
 create mode 100644 frontend/src/lib/components/common/image/ExpandableImage.svelte
 create mode 100644 frontend/src/lib/components/copilot/chat/imageUtils.test.ts
 create mode 100644 frontend/src/lib/components/copilot/chat/imageUtils.ts
 create mode 100644 frontend/src/lib/components/copilot/chat/openai-responses.test.ts
 create mode 100644 frontend/src/lib/isChromiumBrowser.test.ts

diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 555aba4ba1..32bf5ec54a 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -55,6 +55,7 @@
 				"mdast-util-find-and-replace": "^3.0.2",
 				"mermaid": "^11.15.0",
 				"minimatch": "^10.0.1",
+				"modern-screenshot": "^4.7.0",
 				"monaco-editor": "npm:@codingame/monaco-vscode-editor-api@=25.0.0",
 				"monaco-languageclient": "10.6.0",
 				"monaco-vim": "^0.4.1",
@@ -9360,6 +9361,12 @@
 			"dev": true,
 			"license": "MIT"
 		},
+		"node_modules/modern-screenshot": {
+			"version": "4.7.0",
+			"resolved": "https://registry.npmjs.org/modern-screenshot/-/modern-screenshot-4.7.0.tgz",
+			"integrity": "sha512-9YxN+ddPSMMlhylOv25VHzXrl9u67QRxoh7+SEewGtgUw7t6hHTrjptSDJUSne9oG4Xk/h2cwG15nIt4Hc9ujg==",
+			"license": "MIT"
+		},
 		"node_modules/monaco-editor": {
 			"name": "@codingame/monaco-vscode-editor-api",
 			"version": "25.0.0",
diff --git a/frontend/package.json b/frontend/package.json
index 795304bc1e..6b6d7d01ee 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -130,6 +130,7 @@
 		"mdast-util-find-and-replace": "^3.0.2",
 		"mermaid": "^11.15.0",
 		"minimatch": "^10.0.1",
+		"modern-screenshot": "^4.7.0",
 		"monaco-editor": "npm:@codingame/monaco-vscode-editor-api@=25.0.0",
 		"monaco-languageclient": "10.6.0",
 		"monaco-vim": "^0.4.1",
diff --git a/frontend/src/lib/components/DisplayResult.svelte b/frontend/src/lib/components/DisplayResult.svelte
index 49a72e0e13..9505bbe210 100644
--- a/frontend/src/lib/components/DisplayResult.svelte
+++ b/frontend/src/lib/components/DisplayResult.svelte
@@ -4,6 +4,7 @@
 	import { Highlight } from 'svelte-highlight'
 	import { json } from 'svelte-highlight/languages'
 	import { copyToClipboard, parseS3Object, roughSizeOfObject } from '$lib/utils'
+	import ExpandableImage from '$lib/components/common/image/ExpandableImage.svelte'
 	import { base } from '$lib/base'
 	import { downloadViaClient, shouldDownloadViaClient } from '$lib/utils/downloadFile'
 	import { appendViewToken } from '$lib/viewToken'
@@ -827,7 +828,7 @@
 					</div>
 				{:else if !forceJson && resultKind === 'png'}
 					<div class="h-full">
-						<img
+						<ExpandableImage
 							alt="png rendered"
 							class="w-auto h-full"
 							src="data:image/png;base64,{contentOrRootString(result.png)}"
@@ -835,7 +836,7 @@
 					</div>
 				{:else if !forceJson && resultKind === 'jpeg'}
 					<div class="h-full">
-						<img
+						<ExpandableImage
 							alt="jpeg rendered"
 							class="w-auto h-full"
 							src="data:image/jpeg;base64,{contentOrRootString(result.jpeg)}"
@@ -864,7 +865,7 @@
 					</div>
 				{:else if !forceJson && resultKind === 'gif'}
 					<div class="h-full">
-						<img
+						<ExpandableImage
 							alt="gif rendered"
 							class="w-auto h-full"
 							src="data:image/gif;base64,{contentOrRootString(result.gif)}"
@@ -1080,7 +1081,12 @@
 								{/key}
 							{:else if s3object?.s3?.endsWith('.png') || s3object?.s3?.endsWith('.jpeg') || s3object?.s3?.endsWith('.jpg') || s3object?.s3?.endsWith('.webp')}
 								<div class="h-full mt-2">
-									<img alt="preview rendered" class="w-auto h-full" src={s3DisplayUrl(s3object)} />
+									<ExpandableImage
+										alt="preview rendered"
+										title={s3object?.s3}
+										class="w-auto h-full"
+										src={s3DisplayUrl(s3object)}
+									/>
 								</div>
 							{:else if s3object?.s3?.endsWith('.pdf')}
 								<div class="h-96 mt-2 border">
@@ -1145,8 +1151,9 @@
 								{:else if s3object?.s3?.endsWith('.png') || s3object?.s3?.endsWith('.jpeg') || s3object?.s3?.endsWith('.jpg') || s3object?.s3?.endsWith('.webp')}
 									{#if seeS3PreviewFileFromList == s3object?.s3}
 										<div class="h-full mt-2">
-											<img
+											<ExpandableImage
 												alt="preview rendered"
+												title={s3object?.s3}
 												class="w-auto h-full"
 												src={s3DisplayUrl(s3object)}
 											/>
diff --git a/frontend/src/lib/components/S3FilePreview.svelte b/frontend/src/lib/components/S3FilePreview.svelte
index 2a7c3977cd..cbad09f879 100644
--- a/frontend/src/lib/components/S3FilePreview.svelte
+++ b/frontend/src/lib/components/S3FilePreview.svelte
@@ -19,6 +19,7 @@
 	} from '$lib/gen'
 	import { displayDate, displaySize, emptyString } from '$lib/utils'
 	import { twMerge } from 'tailwind-merge'
+	import ExpandableImage from '$lib/components/common/image/ExpandableImage.svelte'
 
 	interface Props {
 		fileKey: string | undefined
@@ -243,11 +244,12 @@
 			</div>
 		{:else if fileMetadata?.fileKey.endsWith('.png') || fileMetadata?.fileKey.endsWith('.jpg') || fileMetadata?.fileKey.endsWith('.jpeg') || fileMetadata?.fileKey.endsWith('.webp')}
 			<div>
-				<img
+				<ExpandableImage
 					src={`/api/w/${$workspaceStore}/job_helpers/load_image_preview?file_key=${encodeURIComponent(
 						fileMetadata.fileKey
 					)}${storageQS}`}
 					alt="S3 preview"
+					title={fileMetadata.fileKey}
 				/>
 			</div>
 		{:else if fileMetadata?.fileKey.endsWith('.pdf')}
diff --git a/frontend/src/lib/components/common/image/ExpandableImage.svelte b/frontend/src/lib/components/common/image/ExpandableImage.svelte
new file mode 100644
index 0000000000..8fbe7774e8
--- /dev/null
+++ b/frontend/src/lib/components/common/image/ExpandableImage.svelte
@@ -0,0 +1,81 @@
+<script module lang="ts">
+	let openViewers = 0
+
+	/**
+	 * Whether an expanded viewer is currently on screen. Components that treat a
+	 * click elsewhere in the document as "dismiss me" MUST consult this: the viewer
+	 * portals to `body`, so clicking it is not DOM-contained by whatever opened it
+	 * and would otherwise read as an outside-click — closing the thing underneath.
+	 */
+	export function isImageViewerOpen(): boolean {
+		return openViewers > 0
+	}
+</script>
+
+<script lang="ts">
+	import { twMerge } from 'tailwind-merge'
+	import Modal2 from '../modal/Modal2.svelte'
+
+	interface Props {
+		/** Source of both the inline thumbnail and the expanded view. */
+		src: string
+		/** Names the image, and the expanded view when no `title` is given. */
+		alt?: string
+		/** Heading of the expanded view; defaults to `alt`. */
+		title?: string
+		/** Classes for the inline thumbnail — sizing, border, radius. */
+		class?: string
+	}
+
+	let { src, alt = '', title, class: className = '' }: Props = $props()
+
+	let isOpen = $state(false)
+
+	$effect(() => {
+		if (!isOpen) return
+		openViewers++
+		return () => {
+			openViewers--
+		}
+	})
+
+	function expand(e: Event) {
+		// Thumbnails are commonly rendered inside a click target of their own (the
+		// AI chat's user bubble opens the message editor on click); expanding must
+		// not trigger those too.
+		e.stopPropagation()
+		isOpen = true
+	}
+</script>
+
+<!-- The image itself carries the role rather than sitting in a wrapping button:
+     callers size it with percentage heights that resolve against their own
+     container, and an extra auto-height box between the two would break them.
+     `alt` names it and Enter/Space activate it, so the role is honoured. -->
+<!-- svelte-ignore a11y_no_noninteractive_element_to_interactive_role -->
+<img
+	{src}
+	{alt}
+	class={twMerge('cursor-zoom-in', className)}
+	role="button"
+	tabindex="0"
+	title="Click to expand"
+	onclick={expand}
+	onkeydown={(e) => {
+		if (e.key === 'Enter' || e.key === ' ') {
+			e.preventDefault()
+			expand(e)
+		}
+	}}
+/>
+
+<Modal2
+	bind:isOpen
+	title={title || alt || 'Image'}
+	fixedHeight="adaptive"
+	css={{ popup: { style: 'width: auto;' } }}
+>
+	<!-- Capped, never stretched: the image keeps its natural size up to the
+	     viewport bound, so a small source gains room without turning blurry. -->
+	<img {src} {alt} class="max-h-[75vh] max-w-[80vw] object-contain mx-auto" />
+</Modal2>
diff --git a/frontend/src/lib/components/copilot/chat/AIChatDisplay.svelte b/frontend/src/lib/components/copilot/chat/AIChatDisplay.svelte
index cefe798165..6aec1f3ba8 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatDisplay.svelte
+++ b/frontend/src/lib/components/copilot/chat/AIChatDisplay.svelte
@@ -45,10 +45,13 @@
 	import type { SelectedContext } from './app/core'
 	import AttachedFilesBar from './files/AttachedFilesBar.svelte'
 	import { type FileToAttach } from './files/attachedFiles.svelte'
+	import { isImageFile } from './imageUtils'
 	import {
 		hasFileSystemAccess,
 		pickDirectory,
 		handlesFromDataTransfer,
+		isDirectoryHandle,
+		isFileHandle,
 		readDroppedEntries
 	} from './files/fsAccess'
 	import { sendUserToast } from '$lib/toast'
@@ -270,9 +273,10 @@
 
 	// File attachment is GLOBAL-mode only.
 	const canAttachFiles = $derived(aiChatManager.mode === AIMode.GLOBAL && !disabled)
-	// Steers the OS file picker toward text formats (soft hint; content sniff is authoritative).
+	// Steers the OS file picker toward text + image formats (soft hint; images attach to
+	// the message, other files link as text context after a content sniff).
 	const TEXT_FILE_ACCEPT =
-		'text/*,.txt,.csv,.tsv,.json,.jsonl,.ndjson,.md,.markdown,.log,.yaml,.yml,.toml,.ini,.cfg,.conf,.env,.xml,.html,.htm,.css,.js,.mjs,.cjs,.ts,.tsx,.jsx,.py,.rb,.rs,.go,.java,.kt,.c,.h,.cpp,.cc,.cs,.php,.sh,.bash,.zsh,.sql,.svelte,.vue,.dockerfile'
+		'image/*,text/*,.txt,.csv,.tsv,.json,.jsonl,.ndjson,.md,.markdown,.log,.yaml,.yml,.toml,.ini,.cfg,.conf,.env,.xml,.html,.htm,.css,.js,.mjs,.cjs,.ts,.tsx,.jsx,.py,.rb,.rs,.go,.java,.kt,.c,.h,.cpp,.cc,.cs,.php,.sh,.bash,.zsh,.sql,.svelte,.vue,.dockerfile'
 	let fileInputEl = $state<HTMLInputElement | null>(null)
 	let folderInputEl = $state<HTMLInputElement | null>(null)
 	let dragDepth = $state(0)
@@ -358,17 +362,32 @@
 		e.preventDefault()
 		const dt = e.dataTransfer
 		if (!dt) return
+		// Images attach to the message; other files link as text context. Images are
+		// reserved from dt.files BEFORE any await (a send mid-ingestion would land
+		// them on the next message), and dt.files is the only place a disk-less drag
+		// exists — a cross-tab image resolves every getAsFileSystemHandle() to null.
+		const flatFiles = Array.from(dt.files ?? [])
+		const topLevelImages = flatFiles.filter(isImageFile)
+		const imageWork: Promise<unknown>[] = []
+		if (topLevelImages.length > 0) {
+			imageWork.push(aiChatInput?.addImages(topLevelImages) ?? Promise.resolve())
+		}
 		if (canUseFsAccess) {
 			// getAsFileSystemHandle calls are kicked off synchronously inside this call.
 			const handles = await handlesFromDataTransfer(dt)
-			for (const h of handles) {
-				if (h.kind === 'directory') {
-					// Folders link as a live handle.
-					await addDirHandle(h as FileSystemDirectoryHandle)
-				} else {
-					// Files are always snapshotted (handle discarded).
-					await handleAddFiles([{ file: await (h as FileSystemFileHandle).getFile() }])
-				}
+			// No handles → nothing beyond dt.files exists; its text files are all there is.
+			// Handle-backed files are top-level by definition, so their images are
+			// already reserved above — only text files remain to route.
+			const looseFiles =
+				handles.length === 0
+					? flatFiles
+					: await Promise.all(handles.filter(isFileHandle).map((h) => h.getFile()))
+			// Files are always snapshotted (handle discarded).
+			const textFiles = looseFiles.filter((f) => !isImageFile(f))
+			if (textFiles.length > 0) await handleAddFiles(textFiles)
+			// Folders link as a live handle.
+			for (const h of handles.filter(isDirectoryHandle)) {
+				await addDirHandle(h)
 			}
 		} else {
 			// Fallback (no File System Access API): snapshot dropped files AND folders by walking
@@ -376,14 +395,33 @@
 			// (they're only valid during this event) before its first await; if it yields nothing
 			// (no entry API), fall back to the flat dt.files.
 			const entries = await readDroppedEntries(Array.from(dt.items ?? []))
-			if (entries.length > 0) await handleAddFiles(entries)
-			else if (dt.files.length > 0) await handleAddFiles(dt.files)
+			const source: FileToAttach[] = entries.length > 0 ? entries : flatFiles
+			// Only top-level images attach to the message, and those were already
+			// reserved from dt.files before the walk — drop them here so they aren't
+			// re-reported as skipped non-text. Folder-nested images are deliberately
+			// NOT attached (the FSA path never extracts folder contents either); they
+			// ride the text ingestion and are summarized as skipped.
+			const textEntries = source.filter((entry) => {
+				const file = entry instanceof File ? entry : entry.file
+				const nested = !(entry instanceof File) && entry.path?.includes('/')
+				return !isImageFile(file) || !!nested
+			})
+			if (textEntries.length > 0) await handleAddFiles(textEntries)
 		}
+		await Promise.all(imageWork)
 	}
 
-	function onFileInputChange(e: Event) {
+	async function onFileInputChange(e: Event) {
 		const input = e.currentTarget as HTMLInputElement
-		if (input.files && input.files.length > 0) void handleAddFiles(input.files)
+		if (input.files && input.files.length > 0) {
+			const picked = Array.from(input.files)
+			const imageFiles = picked.filter(isImageFile)
+			const textFiles = picked.filter((f) => !isImageFile(f))
+			// Reserved before the text work is awaited — see onPanelDrop.
+			const imageWork = imageFiles.length > 0 ? aiChatInput?.addImages(imageFiles) : undefined
+			if (textFiles.length > 0) await handleAddFiles(textFiles)
+			await imageWork
+		}
 		input.value = '' // allow re-selecting the same file
 	}
 
@@ -504,7 +542,7 @@ the panel, or the Escape-to-stop focus check would wrongly reject them. -->
 		>
 			<div class="flex flex-col items-center gap-1 text-blue-600 dark:text-blue-300">
 				<Plus size={24} />
-				<span class="text-sm font-medium">Drop files to attach</span>
+				<span class="text-sm font-medium">Drop files or images to attach</span>
 			</div>
 		</div>
 	{/if}
@@ -797,7 +835,11 @@ the panel, or the Escape-to-stop focus check would wrongly reject them. -->
 						{#if canAttachFiles}
 							<DropdownV2
 								items={() => [
-									{ displayName: 'Attach file', icon: FileText, action: () => linkFiles() },
+									{
+										displayName: 'Attach file or image',
+										icon: FileText,
+										action: () => linkFiles()
+									},
 									{
 										// A real (live) link needs the File System Access API; without it the
 										// folder is only snapshotted, so call it "Add folder", not "Link folder".
@@ -825,9 +867,12 @@ the panel, or the Escape-to-stop focus check would wrongly reject them. -->
 											<div class="max-w-64 text-xs">
 												<p class="font-semibold">Attach files or link a folder</p>
 												<p class="mt-1">
-													Nothing is uploaded. Files are kept locally in your browser; a folder is
-													linked live from disk. The assistant lists, searches, and reads them on
-													demand — their contents aren't sent unless it reads them.
+													Text files stay in your browser, and a folder is linked live from disk.
+													The assistant lists, searches, and reads them on demand, so their contents
+													are sent only when it reads one.
+												</p>
+												<p class="mt-1">
+													Images are sent with your next message, so the assistant can see them.
 												</p>
 											</div>
 										{/snippet}
diff --git a/frontend/src/lib/components/copilot/chat/AIChatInput.svelte b/frontend/src/lib/components/copilot/chat/AIChatInput.svelte
index 8f39b78a27..07d6b03b36 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatInput.svelte
+++ b/frontend/src/lib/components/copilot/chat/AIChatInput.svelte
@@ -11,11 +11,23 @@
 	import { tick, untrack, type Snippet } from 'svelte'
 	import Portal from '$lib/components/Portal.svelte'
 	import { zIndexes } from '$lib/zIndexes'
-	import { ArrowUp, Square } from 'lucide-svelte'
+	import { ArrowUp, Loader2, Square, X } from 'lucide-svelte'
 	import { Button } from '$lib/components/common'
 	import { sendUserToast } from '$lib/toast'
 	import { type PasteAttachment } from './pasteTokens'
 	import { chatDraft, expanded } from './chatDraft'
+	import {
+		fileToAttachedImage,
+		isImageFile,
+		MAX_ATTACHED_IMAGES,
+		MAX_IMAGE_BYTES,
+		type AttachedImage
+	} from './imageUtils'
+	import { modelSupportsVision } from '../modelConfig'
+	import { tryGetCurrentModel } from '$lib/aiStore'
+	import ExpandableImage, {
+		isImageViewerOpen
+	} from '$lib/components/common/image/ExpandableImage.svelte'
 
 	const aiChatManager = getAiChatManager()
 
@@ -27,6 +39,7 @@
 		placeholder?: string
 		initialInstructions?: string
 		initialPastes?: PasteAttachment[]
+		initialImages?: AttachedImage[]
 		editingMessageIndex?: number | null
 		onEditEnd?: () => void
 		className?: string
@@ -56,6 +69,7 @@
 		placeholder,
 		initialInstructions = '',
 		initialPastes = undefined,
+		initialImages = undefined,
 		editingMessageIndex = null,
 		onEditEnd = () => {},
 		className = '',
@@ -129,6 +143,77 @@
 	})
 	// Collapsed big-paste blobs referenced by tokens in `instructions`.
 	let pastes = $state<PasteAttachment[]>(untrack(() => initialPastes ?? []))
+	// Per-message image attachments (drag/drop/paste), GLOBAL mode only. One-shot:
+	// they attach to the next send and clear, unlike the persistent attached-files store.
+	let images = $state<AttachedImage[]>(untrack(() => initialImages ?? []))
+	// Images being decoded right now. Holds off sending so a message can never go
+	// out without an attachment the user already dropped, and reserves cap slots
+	// against a concurrent drop.
+	let pendingImages = $state(0)
+
+	/** Attach dropped/pasted image files (downscaled + bounded). GLOBAL mode only. */
+	export async function addImages(files: (File | Blob)[]) {
+		if (aiChatManager.mode !== AIMode.GLOBAL) return
+		const imageFiles = files.filter(isImageFile)
+		if (imageFiles.length === 0) return
+		// tryGetCurrentModel returns undefined instead of throwing: this runs from a
+		// drop/paste handler that can't surface a rejection.
+		const model = tryGetCurrentModel()
+		// Only known text-only models fail this, so attaching would certainly 400 the
+		// next turn — refuse rather than warn and send it anyway.
+		if (model && !modelSupportsVision(model.provider, model.model)) {
+			sendUserToast(`${model.model} can't read images. Switch to a vision model first.`, true)
+			return
+		}
+		// Count decodes already in flight: two drops that both read `images.length`
+		// before either resolves would each claim the same free slots and overshoot
+		// the cap.
+		const remaining = MAX_ATTACHED_IMAGES - images.length - pendingImages
+		if (remaining <= 0) {
+			sendUserToast(`You can attach up to ${MAX_ATTACHED_IMAGES} images.`, true)
+			return
+		}
+		const oversized = imageFiles.filter((f) => f.size > MAX_IMAGE_BYTES)
+		if (oversized.length > 0) {
+			const mb = Math.round(MAX_IMAGE_BYTES / 1_000_000)
+			sendUserToast(`${oversized.length} image(s) over ${mb}MB were skipped.`, true)
+		}
+		const usable = imageFiles.filter((f) => f.size <= MAX_IMAGE_BYTES)
+		if (usable.length === 0) return
+		const batch = usable.slice(0, remaining)
+		if (batch.length < usable.length) {
+			sendUserToast(
+				`You can attach up to ${MAX_ATTACHED_IMAGES} images; ${usable.length - batch.length} were skipped.`,
+				true
+			)
+		}
+		// Claim the slots before awaiting, and hold sending until they resolve:
+		// decoding takes ~50-800ms, and a send during it would clear `images` while
+		// this closure still appends to it, landing the picture on the next message.
+		pendingImages += batch.length
+		try {
+			// One at a time: a decoded bitmap costs ~4 bytes per pixel (a 12MP photo is
+			// ~48MB), so decoding the whole batch at once would hold every one of them
+			// live simultaneously.
+			const added: AttachedImage[] = []
+			let failed = 0
+			for (const file of batch) {
+				try {
+					added.push(await fileToAttachedImage(file))
+				} catch {
+					failed++
+				}
+			}
+			if (added.length > 0) images = [...images, ...added]
+			if (failed > 0) sendUserToast(`Could not attach ${failed} image(s).`, true)
+		} finally {
+			pendingImages -= batch.length
+		}
+	}
+
+	function removeImage(index: number) {
+		images = images.filter((_, i) => i !== index)
+	}
 
 	// App mode @ mention state
 	let showAppContextTooltip = $state(false)
@@ -190,19 +275,40 @@
 	}
 
 	// Restore composer contents after a rolled-back turn. No-op when the user
-	// already typed a new draft — restoring would clobber it.
-	export function restoreInstructions(value: string, restoredPastes: PasteAttachment[] = []) {
-		if (instructions.trim()) return
+	// already drafted something new — typed text or attached images (including
+	// ones still decoding) — restoring would clobber it.
+	export function restoreInstructions(
+		value: string,
+		restoredPastes: PasteAttachment[] = [],
+		restoredImages: AttachedImage[] = []
+	) {
+		if (instructions.trim() || images.length > 0 || pendingImages > 0) return
 		instructions = value
 		pastes = restoredPastes
+		images = restoredImages
 		focusInput()
 	}
 
 	/** Put text back into the textarea (queued-message delete, or restore
 	 * after a cancelled/errored turn), prepended to any draft so nothing
-	 * the user typed is lost. */
-	export function prependText(text: string) {
-		instructions = instructions.trim() ? `${text}\n\n${instructions}` : text
+	 * the user typed is lost. Restored images join whatever is already
+	 * attached, up to the cap — dropping them would lose the attachment
+	 * silently, which is the whole reason the queue carries them. */
+	export function prependText(text: string, restoredImages: AttachedImage[] = []) {
+		// An image-only restore has empty text; prepending it would only add blank lines.
+		if (text) {
+			instructions = instructions.trim() ? `${text}\n\n${instructions}` : text
+		}
+		if (restoredImages.length > 0) {
+			const merged = [...images, ...restoredImages]
+			if (merged.length > MAX_ATTACHED_IMAGES) {
+				sendUserToast(
+					`You can attach up to ${MAX_ATTACHED_IMAGES} images; ${merged.length - MAX_ATTACHED_IMAGES} restored image(s) were dropped.`,
+					true
+				)
+			}
+			images = merged.slice(0, MAX_ATTACHED_IMAGES)
+		}
 		focusInput()
 	}
 
@@ -215,6 +321,10 @@
 
 	function clickOutside(node: HTMLElement) {
 		function handleClick(event: MouseEvent) {
+			// An expanded image chip renders in a portal, so clicks in it land outside
+			// this node without being outside the composer. Dismissing on them would
+			// discard the edit the user opened the image from.
+			if (isImageViewerOpen()) return
 			if (node && !node.contains(event.target as Node)) {
 				onClickOutside()
 			}
@@ -296,25 +406,31 @@
 	}
 
 	function sendRequest() {
+		// The send button is disabled while decoding, but Enter reaches here directly.
+		// Sending now would drop the in-flight images onto the following message.
+		if (pendingImages > 0) {
+			return
+		}
 		if (aiChatManager.loading) {
 			// Queue the message instead of silently discarding it — it is
 			// auto-sent when the streaming turn completes successfully.
 			// Editing-while-loading keeps the old discard behavior. Paste
 			// tokens are expanded into the queued text (the queue is plain
 			// strings), so the full content survives the auto-send.
-			if (editingMessageIndex === null && instructions.trim()) {
-				aiChatManager.queueMessage(expanded(chatDraft(instructions, pastes)))
+			if (editingMessageIndex === null && (instructions.trim() || images.length > 0)) {
+				aiChatManager.queueMessage(expanded(chatDraft(instructions, pastes)), images)
 				contextTextareaComponent?.clearForSend()
 				instructions = ''
 				pastes = []
+				images = []
 			}
 			return
 		}
 		if (editingMessageIndex !== null) {
-			aiChatManager.restartGeneration(editingMessageIndex, instructions, pastes)
+			aiChatManager.restartGeneration(editingMessageIndex, instructions, pastes, images)
 			onEditEnd()
 		} else {
-			aiChatManager.sendRequest({ instructions, pastes })
+			aiChatManager.sendRequest({ instructions, pastes, images })
 			// clearForSend() pre-zaps the textarea's mention-sync so the wipe
 			// doesn't drop `selectedContext` before `AIChatManager.beforeSend`
 			// snapshots it. Only mounted in SCRIPT/FLOW/GLOBAL — APP and the
@@ -323,6 +439,7 @@
 			contextTextareaComponent?.clearForSend()
 			instructions = ''
 			pastes = []
+			images = []
 		}
 	}
 
@@ -538,7 +655,8 @@
 
 {#snippet sendStopButton()}
 	{@const isLoading = loading ?? aiChatManager.loading}
-	{@const sendDisabled = disabled || instructions.trim().length === 0}
+	{@const sendDisabled =
+		disabled || (instructions.trim().length === 0 && images.length === 0) || pendingImages > 0}
 	<Button
 		variant="subtle"
 		unifiedSize="md"
@@ -575,6 +693,42 @@
 	{/if}
 {/snippet}
 
+{#snippet imageChipsRow()}
+	{#if images.length > 0 || pendingImages > 0}
+		<div class="flex flex-row flex-wrap items-center gap-1.5 mb-1">
+			{#each images as image, i (i)}
+				<div class="relative group">
+					<!-- The chip is a 48px object-cover crop, so the expanded view is the only
+					     way to check what was actually attached before sending it. -->
+					<ExpandableImage
+						src={image.dataUrl}
+						alt={image.name ?? 'attached image'}
+						class="h-12 w-12 object-cover rounded border border-border-light"
+					/>
+					<button
+						type="button"
+						title="Remove image"
+						class="absolute -top-1.5 -right-1.5 bg-surface-secondary border border-border-light rounded-full p-0.5 opacity-0 group-hover:opacity-100 transition-opacity"
+						onclick={() => removeImage(i)}
+					>
+						<X size={10} />
+					</button>
+				</div>
+			{/each}
+			<!-- Placeholders for images still being decoded. Sending is held until they
+			     land, so the row has to show that something is on its way. -->
+			{#each { length: pendingImages } as _, i (i)}
+				<div
+					class="h-12 w-12 rounded border border-border-light bg-surface-secondary flex items-center justify-center"
+					title="Preparing image..."
+				>
+					<Loader2 size={14} class="animate-spin text-tertiary" />
+				</div>
+			{/each}
+		</div>
+	{/if}
+{/snippet}
+
 <div
 	use:clickOutside
 	class="relative mt-1"
@@ -590,11 +744,15 @@
 		{#if showContext}
 			{@render contextPickerRow()}
 		{/if}
+		{@render imageChipsRow()}
 		<div class="relative">
 			<ContextTextarea
 				bind:this={contextTextareaComponent}
 				bind:value={instructions}
 				bind:pastes
+				onImageFiles={aiChatManager.mode === AIMode.GLOBAL
+					? (files) => void addImages(files)
+					: undefined}
 				{availableContext}
 				{selectedContext}
 				placeholder={modePlaceholder}
diff --git a/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts b/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
index 2853c392f5..f86db724d8 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
+++ b/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
@@ -45,6 +45,7 @@ import { prepareScriptUserMessage } from './script/core'
 import { prepareNavigatorUserMessage } from './navigator/core'
 import { sendUserToast } from '$lib/toast'
 import { workspaceAIClients, getNonStreamingCompletion } from '../lib'
+import { modelSupportsVision } from '../modelConfig'
 import { getKnownModelContextWindow } from '../modelConfig'
 import {
 	getCompactionSummaryPrompt,
@@ -57,6 +58,13 @@ import type { UserDraftItemKind } from '$lib/gen'
 import { maskKey } from '$lib/components/sessions/modifiedItemsMask'
 import { getStringError } from './utils'
 import { type PasteAttachment } from './pasteTokens'
+import {
+	type AttachedImage,
+	imagesFromContent,
+	MAX_ATTACHED_IMAGES,
+	messagesHaveImageParts,
+	stripImagePartsFromMessages
+} from './imageUtils'
 import { chatDraft, expanded } from './chatDraft'
 import type { FlowModuleState, FlowState } from '$lib/components/flows/flowState'
 import type { CurrentEditor, ExtendedOpenFlow } from '$lib/components/flows/types'
@@ -128,6 +136,9 @@ function prefersInstantReveal(): boolean {
 // schema changes from mode switches, and the estimate's chars/4 error.
 const COMPACTION_TRIGGER_RATIO = 0.8
 const COMPACTION_TARGET_RATIO = 0.7
+// Flat per-image token estimate for a downscaled (≤1568px) vision image. Used instead
+// of chars/4 on the base64 data URL, which would overcount by ~50x.
+const IMAGE_TOKEN_ESTIMATE = 1200
 // Headroom reserved within the target budget for the summary message itself, so
 // the summary + kept tail + overhead land under the target ratio.
 const SUMMARY_OUTPUT_RESERVE_TOKENS = 8000
@@ -274,6 +285,32 @@ function appendWebSearchErrorHint(message: string, shouldAppend: boolean): strin
 	return `${message}${separator}${WEB_SEARCH_ERROR_HINT}`
 }
 
+/**
+ * Whether a provider rejected the request over an image it could not take. The
+ * vision gate only knows the models we ship, so this is the net for the rest:
+ * every provider words it differently, hence matching on the subject rather than
+ * a code. Only consulted when the outbound request actually carried an image, so
+ * an unrelated error mentioning "image" cannot trigger it on its own.
+ */
+function isImageRejection(err: unknown, models: (string | undefined)[] = []): boolean {
+	let message = (err instanceof Error ? err.message : String(err)).toLowerCase()
+	// Vision-capable model ids often contain the subject words themselves
+	// (llama-3.2-90b-vision-instruct, Phi-4-multimodal-instruct) and providers echo
+	// the id in unrelated errors (rate limits, capacity). A match inside the id
+	// would treat those as rejections and destroy good images, so drop the ids
+	// before matching — only the error's own wording counts. Callers pass every
+	// model the turn may have used: the error can come from the model selected at
+	// send time OR the one currently selected (switchable mid-flight).
+	for (const model of models) {
+		if (model) message = message.replaceAll(model.toLowerCase(), '')
+	}
+	// Whole words only: "provisioning"/"provisioned" contain "vision", and a
+	// transient capacity error must not destroy good images. image_url and
+	// input_image are the content-part names providers echo in schema errors
+	// ('_' is a word char, so \bimage\b alone would miss them).
+	return /\bimages?(_url)?\b|\binput_image\b|\bvision\b|\bmultimodal\b/.test(message)
+}
+
 function getSendRequestErrorMessage(err: unknown, webSearchUnavailable: boolean): string {
 	const errorMessage =
 		err instanceof Error ? err.message : typeof err === 'string' ? err : undefined
@@ -306,6 +343,11 @@ export class AIChatManager {
 	// the turn finishes (clean completion or user cancel). Ephemeral — never
 	// saved to displayMessages or history.
 	queuedMessage = $state<string>('')
+	// Images attached to that message. Kept beside the text rather than inside it
+	// because the queued chip renders `queuedMessage` as a plain string. Always
+	// move the two together — #takeQueue/#clearQueue/#restoreQueue exist so no
+	// call site can drop one and auto-send a message the user never wrote.
+	queuedImages = $state<AttachedImage[]>([])
 	// Jobs the chat started that detached into the background (global/sessions
 	// chat only). Rendered in the jobs tray, persisted with the chat, and advanced
 	// by a single background poller. See registerJob / #pollBackgroundJobs.
@@ -380,6 +422,16 @@ export class AIChatManager {
 	})
 	displayMessages = $state<DisplayMessage[]>([])
 	messages = $state<ChatCompletionMessageParam[]>([])
+	/** Images buffered by tools (e.g. take_screenshot) during the current tool batch,
+	 * keyed by toolId. Drained by appendPendingToolImages into a follow-up user message
+	 * after the batch. Cleared at each turn start so an aborted batch can't leak. */
+	private pendingToolImages = new Map<string, AttachedImage[]>()
+	/** Model of the most recent loop iteration, recorded via onBeforeIteration.
+	 * The selector stays switchable mid-flight, so when a request fails neither
+	 * the send-time nor the currently-selected model necessarily names the one
+	 * whose request is being classified (A→B→C switches). Reset at each turn
+	 * start, consumed by image-rejection recovery. */
+	private lastIterationModel: ReturnType<typeof getCurrentModel> | undefined = undefined
 	/** Provider-reported context size of the last committed turn (prompt +
 	 * completion of its latest completion — exact, includes system prompt and
 	 * tools), or undefined whenever no report describes the current history
@@ -901,6 +953,15 @@ export class AIChatManager {
 			const tokenPerCharacter = 4
 			if (typeof message.content === 'string') {
 				acc += message.content.length / tokenPerCharacter
+			} else if (Array.isArray(message.content)) {
+				// Multimodal content: chars/4 for the text parts, a flat estimate per image
+				// (a base64 data URL is huge as text but only ~1.1-1.6k tokens as vision input,
+				// so JSON.stringify here would overcount by orders of magnitude).
+				for (const part of message.content as any[]) {
+					if (part?.type === 'text') acc += (part.text?.length ?? 0) / tokenPerCharacter
+					else if (part?.type === 'image_url') acc += IMAGE_TOKEN_ESTIMATE
+					else acc += JSON.stringify(part).length / tokenPerCharacter
+				}
 			} else if (message.content) {
 				acc += JSON.stringify(message.content).length / tokenPerCharacter
 			}
@@ -970,12 +1031,15 @@ export class AIChatManager {
 		}
 		this.messages = this.messages.slice(drop)
 		// User display messages carry the index of their API message so restart
-		// can rewind to it; re-base them on the compacted history. A message
-		// whose API counterpart was dropped clamps to 0: everything before it
-		// was dropped too (compaction only removes prefixes), so restarting
-		// from it restarts from an empty history.
+		// can rewind to it; re-base them on the compacted history. A message whose
+		// API counterpart was dropped goes negative — deliberately NOT clamped to
+		// 0, which would alias it to the first surviving message and let
+		// storedImages hand a retry that message's images. Negative reads as
+		// "counterpart gone": storedImages finds nothing there, and restart maps
+		// it to an empty history (everything before it was dropped too, since
+		// compaction only removes prefixes).
 		this.displayMessages = this.displayMessages.map((m) =>
-			m.role === 'user' ? { ...m, index: Math.max(0, m.index - drop) } : m
+			m.role === 'user' ? { ...m, index: m.index - drop } : m
 		)
 		return freed
 	}
@@ -1008,7 +1072,9 @@ export class AIChatManager {
 			// >10 minutes of generation (~21k tokens) before anything is sent.
 			const raw = await getNonStreamingCompletion(
 				[
-					...sanitizeToolCallArguments(prefix),
+					// Strip image blobs from the summarizer input — the summary text stands in
+					// for them, so re-sending base64 to the summarizer only wastes tokens.
+					...stripImagePartsFromMessages(sanitizeToolCallArguments(prefix)),
 					{ role: 'user', content: getCompactionSummaryPrompt() }
 				],
 				abortController,
@@ -1097,9 +1163,16 @@ export class AIChatManager {
 			tailTokens += t
 			keepFrom = i
 		}
-		// The tail must start on a user message — move the boundary forward over
-		// any leading tool/assistant messages, folding them into the prefix.
-		while (keepFrom < last && this.messages[keepFrom].role !== 'user') {
+		// The tail must start on a user message the transcript also shows — move the
+		// boundary forward over leading tool/assistant messages, and over synthetic
+		// user messages that carry no display entry (the image follow-ups
+		// appendPendingToolImages injects). Landing on one would slice `messages`
+		// and `displayMessages` at different turns, silently dropping the cards in
+		// between from the visible history.
+		const shownUserIndices = new Set(
+			this.displayMessages.filter((m) => m.role === 'user').map((m) => m.index)
+		)
+		while (keepFrom < last && !shownUserIndices.has(keepFrom)) {
 			keepFrom++
 		}
 
@@ -1109,11 +1182,10 @@ export class AIChatManager {
 			return false
 		}
 
-		// The user message at the boundary has a display counterpart with the same
-		// index; resolve it before any mutation so a corrupt transcript can never
-		// result from an unexpected miss.
+		// Exact index, never >=: a miss must fail the compaction, because resolving
+		// to a later turn would slice the transcript short of the kept API tail.
 		const displayKeepFrom = this.displayMessages.findIndex(
-			(m) => m.role === 'user' && m.index >= keepFrom
+			(m) => m.role === 'user' && m.index === keepFrom
 		)
 		if (displayKeepFrom === -1) {
 			this.consecutiveCompactionFailures++
@@ -1199,12 +1271,15 @@ export class AIChatManager {
 		// epilogue (loading gated its capture): auto-send after a successful
 		// compaction or a deliberate user cancel — the user is ready to move on —
 		// while a failed/empty compaction or a programmatic cancel leaves it queued.
-		if ((result === 'ok' || this.wasCancelledByUser()) && this.queuedMessage) {
-			const next = this.queuedMessage
-			this.queuedMessage = ''
-			const accepted = await this.sendRequest({ instructions: next })
+		if ((result === 'ok' || this.wasCancelledByUser()) && this.#hasQueuedMessage()) {
+			const next = this.#takeQueue()
+			const accepted = await this.sendRequest({
+				instructions: next.text,
+				images: next.images,
+				queued: true
+			})
 			if (accepted === false) {
-				this.queuedMessage = next
+				this.#restoreQueue(next)
 			}
 		}
 	}
@@ -1338,33 +1413,67 @@ export class AIChatManager {
 
 	/** Queue the message typed while a turn is streaming. There is only ever
 	 * one queued message; pressing Enter again appends the new text as another
-	 * line so it all goes out as a single message. */
-	queueMessage(text: string) {
+	 * line so it all goes out as a single message, and its images accumulate
+	 * alongside it. */
+	queueMessage(text: string, images: AttachedImage[] = []) {
 		const trimmed = text.trim()
-		if (!trimmed) {
+		// An image with no text is still a message; only a fully empty send is ignored.
+		if (!trimmed && images.length === 0) {
 			return
 		}
-		this.queuedMessage = this.queuedMessage ? `${this.queuedMessage}\n${trimmed}` : trimmed
+		if (trimmed) {
+			this.queuedMessage = this.queuedMessage ? `${this.queuedMessage}\n${trimmed}` : trimmed
+		}
+		if (images.length > 0) {
+			const merged = [...this.queuedImages, ...images]
+			if (merged.length > MAX_ATTACHED_IMAGES) {
+				sendUserToast(`Only the first ${MAX_ATTACHED_IMAGES} images are kept.`, true)
+			}
+			this.queuedImages = merged.slice(0, MAX_ATTACHED_IMAGES)
+		}
 	}
 
-	/** Remove the queued message and put its text back into the input. */
-	dequeueMessage() {
-		if (!this.queuedMessage) {
-			return
-		}
-		const message = this.queuedMessage
+	/** Whether anything is waiting in the queue — an image-only message has empty text. */
+	#hasQueuedMessage(): boolean {
+		return this.queuedMessage !== '' || this.queuedImages.length > 0
+	}
+
+	/** Detach the queue for sending. Text and images always leave together. */
+	#takeQueue(): { text: string; images: AttachedImage[] } {
+		const taken = { text: this.queuedMessage, images: this.queuedImages }
+		this.#clearQueue()
+		return taken
+	}
+
+	#clearQueue() {
 		this.queuedMessage = ''
-		this.restoreToInput(message)
+		this.queuedImages = []
 	}
 
-	/** Put text the user typed back where they can see it: into the input
+	/** Put a taken queue back after an auto-send bailed before becoming a turn. */
+	#restoreQueue(queued: { text: string; images: AttachedImage[] }) {
+		this.queuedMessage = queued.text
+		this.queuedImages = queued.images
+	}
+
+	/** Remove the queued message and put it back into the input, images included. */
+	dequeueMessage() {
+		if (!this.#hasQueuedMessage()) {
+			return
+		}
+		const queued = this.#takeQueue()
+		this.restoreToInput(queued.text, queued.images)
+	}
+
+	/** Put what the user typed back where they can see it: into the input
 	 * when it's mounted, otherwise back into the queue so it reappears with
 	 * the chat panel instead of being silently dropped. */
-	private restoreToInput(text: string) {
+	private restoreToInput(text: string, images: AttachedImage[] = []) {
 		if (this.aiChatInput) {
-			this.aiChatInput.prependText(text)
+			this.aiChatInput.prependText(text, images)
 		} else {
 			this.queuedMessage = text
+			this.queuedImages = images
 		}
 	}
 
@@ -1751,12 +1860,13 @@ export class AIChatManager {
 		modelLenAfterUser: number,
 		instructions: string,
 		pastes: PasteAttachment[],
-		restoreToInput: boolean = true
+		restoreToInput: boolean = true,
+		images: AttachedImage[] = []
 	) => {
 		this.displayMessages = this.displayMessages.slice(0, displayLenAfterUser - 1)
 		this.messages = this.messages.slice(0, modelLenAfterUser - 1)
 		if (restoreToInput) {
-			this.aiChatInput?.restoreInstructions(instructions, pastes)
+			this.aiChatInput?.restoreInstructions(instructions, pastes, images)
 		}
 	}
 
@@ -1791,6 +1901,10 @@ export class AIChatManager {
 		systemMessage?: ChatCompletionSystemMessageParam
 		onWebSearchUnavailable?: () => void
 	}) => {
+		// Fresh batch for this turn — drop any images an aborted prior turn left buffered.
+		this.pendingToolImages.clear()
+		// Stale from a prior turn it would misattribute a pre-first-iteration failure.
+		this.lastIterationModel = undefined
 		const onReasoningSummaryUnavailable = () => this.notifyReasoningSummaryUnavailable()
 		try {
 			// Use JS getters so runChatLoop re-reads tools/helpers/systemMessage/modelProvider
@@ -1866,7 +1980,8 @@ export class AIChatManager {
 					}
 					return undefined
 				},
-				onBeforeIteration: async (tools) => {
+				onBeforeIteration: async (tools, _helpers, modelProvider) => {
+					this.lastIterationModel = modelProvider
 					for (const tool of tools) {
 						if (tool.setSchema) {
 							await tool.setSchema(this.helpers)
@@ -1985,9 +2100,14 @@ export class AIChatManager {
 			addBackCode?: boolean
 			instructions?: string
 			pastes?: PasteAttachment[]
+			images?: AttachedImage[]
 			mode?: AIMode
 			lang?: ScriptLang | 'bunnative'
 			isPreprocessor?: boolean
+			/** Auto-send of a queued draft: on preflight failure the caller re-queues
+			 * it, so the composer restore must not also fire (the draft would exist
+			 * twice — queue chip and composer). */
+			queued?: boolean
 		} = {}
 	) => {
 		// Returns whether the input was consumed: true when it was sent as a chat
@@ -2003,10 +2123,17 @@ export class AIChatManager {
 			lang: options.lang,
 			isPreprocessor: options.isPreprocessor
 		})
-		if (options.instructions) {
+		// Explicitly-passed instructions win even when empty: an image-only send
+		// carries '' and must not inherit stale text a failed or cancelled earlier
+		// turn left in this.instructions.
+		if (options.instructions !== undefined) {
 			this.instructions = options.instructions
 		}
-		if (!this.instructions.trim()) {
+		// Only a truly empty draft is dropped here. An image with no text is a
+		// valid GLOBAL-mode message; outside GLOBAL an image-bearing draft must
+		// still get past this guard to reach the refusal below, which puts it
+		// back in the composer instead of silently losing it.
+		if (!this.instructions.trim() && (options.images?.length ?? 0) === 0) {
 			return false
 		}
 		// Built-in session commands run locally instead of becoming a chat turn.
@@ -2049,6 +2176,42 @@ export class AIChatManager {
 		// Context elements and the snapshot are attached after beforeSend (see below).
 		const isFirstUserTurn = !this.displayMessages.some((message) => message.role === 'user')
 		const pastes = options.pastes ?? []
+		// Images ride only on GLOBAL turns, but the composer stays mounted across
+		// a mode switch, so chips attached in GLOBAL can arrive with a send in any
+		// mode. Refuse and restore rather than silently dropping attachments the
+		// user can see. This sits past the awaits above on purpose: the composer
+		// clears itself synchronously right after calling sendRequest, so an
+		// earlier restore would be wiped. Queued drafts are the caller's to
+		// restore (it re-queues on false).
+		if ((options.images?.length ?? 0) > 0 && this.mode !== AIMode.GLOBAL) {
+			sendUserToast('Switch back to the chat mode to send images. Your message was kept.', true)
+			if (!options.queued) {
+				this.aiChatInput?.restoreInstructions(this.instructions, pastes, options.images ?? [])
+			}
+			return false
+		}
+		// Non-GLOBAL sends with images were refused above. The vision check is
+		// repeated here, not just at attach time: the model can be switched to a
+		// text-only one after attaching, and sending the image then fails the turn.
+		const requestedImages = options.images ?? []
+		const sendModel = tryGetCurrentModel()
+		const modelIsBlind = !!sendModel && !modelSupportsVision(sendModel.provider, sendModel.model)
+		if (requestedImages.length > 0 && modelIsBlind) {
+			// An image-only message has nothing left once the images are dropped —
+			// put them back in the composer instead of silently discarding them
+			// (the input already cleared itself optimistically on send). Queued
+			// drafts are the caller's to restore (it re-queues on false).
+			if (!this.instructions.trim()) {
+				sendUserToast(`${sendModel.model} can't read images. Switch to a vision model first.`, true)
+				if (!options.queued) this.restoreToInput('', requestedImages)
+				return false
+			}
+			sendUserToast(
+				`${sendModel.model} can't read images; sending without the ${requestedImages.length} attached image(s).`,
+				true
+			)
+		}
+		const images = modelIsBlind ? [] : requestedImages
 		const optimisticIndex = this.displayMessages.length
 		this.loading = true
 		// Create the abort controller before the (possibly slow) beforeSend pre-flight,
@@ -2063,11 +2226,14 @@ export class AIChatManager {
 				role: 'user',
 				content: this.instructions,
 				pastes: pastes.length > 0 ? pastes : undefined,
+				// Same objects as the API message's parts: sharing the exact data URL
+				// lets the history's blob store persist one copy for both.
+				images: images.length > 0 ? images : undefined,
 				index: this.messages.length // matching with actual messages index. not -1 because it's not yet added to the messages array
 			}
 		]
 		// Undo the optimistic bubble + loading/label. Shared by the beforeSend-failure and
-		// pre-flight-cancel paths below; the input keeps the message text either way.
+		// pre-flight-cancel paths below; callers put the message back in the composer.
 		const rollbackOptimisticSend = () => {
 			this.displayMessages = this.displayMessages.filter((_, i) => i !== optimisticIndex)
 			this.loading = false
@@ -2080,9 +2246,13 @@ export class AIChatManager {
 				// beforeSend commits the session's workspace before the first
 				// message hits the backend. If it throws, sending anyway would
 				// silently target the wrong workspace (typically the parent), so
-				// abort and tell the user — their message text stays in the input.
+				// abort and put the message back in the composer (which cleared
+				// itself optimistically on send).
 				console.error('AIChatManager beforeSend hook failed', e)
 				rollbackOptimisticSend()
+				if (!options.queued) {
+					this.aiChatInput?.restoreInstructions(this.instructions, pastes, images)
+				}
 				sendUserToast(
 					`Could not prepare the session before sending: ${
 						e instanceof Error ? e.message : String(e)
@@ -2104,13 +2274,16 @@ export class AIChatManager {
 		// message auto-sends it) or restore this prompt to the composer so it isn't lost.
 		if (this.abortController.signal.aborted) {
 			rollbackOptimisticSend()
-			if (this.wasCancelledByUser() && this.queuedMessage) {
-				const next = this.queuedMessage
-				this.queuedMessage = ''
-				const accepted = await this.sendRequest({ instructions: next })
-				if (accepted === false) this.queuedMessage = next
+			if (this.wasCancelledByUser() && this.#hasQueuedMessage()) {
+				const next = this.#takeQueue()
+				const accepted = await this.sendRequest({
+					instructions: next.text,
+					images: next.images,
+					queued: true
+				})
+				if (accepted === false) this.#restoreQueue(next)
 			} else {
-				this.aiChatInput?.restoreInstructions(this.instructions, pastes)
+				this.aiChatInput?.restoreInstructions(this.instructions, pastes, images)
 			}
 			return true
 		}
@@ -2183,6 +2356,7 @@ export class AIChatManager {
 			// not the expanded LLM text, plus the rollback anchor after the user turn.
 			const sentInstructions = this.instructions
 			const sentPastes = pastes
+			const sentImages = images
 			// The LLM gets the full pasted content; the display message above keeps
 			// the compact tokens + registry so the bubble can render/expand chips.
 			const oldInstructions = expanded(chatDraft(this.instructions, pastes))
@@ -2232,7 +2406,8 @@ export class AIChatManager {
 					break
 				case AIMode.GLOBAL:
 					userMessage = prepareGlobalUserMessage(modelInstructions, oldSelectedContext, {
-						workspace: this.operatingWorkspace
+						workspace: this.operatingWorkspace,
+						images: sentImages
 					})
 					break
 				case AIMode.APP:
@@ -2318,6 +2493,11 @@ export class AIChatManager {
 					onMessageEnd: () => void
 				}
 			} = {
+				// The full history goes to the loop, image parts included, even on a
+				// known text-only model: runChatLoop strips them per iteration for
+				// whatever model that iteration runs on, so a mid-loop switch in either
+				// direction (vision→text or text→vision) sees the right view. A copy
+				// stripped here instead could never be un-stripped by a later iteration.
 				messages: [...this.messages],
 				abortController: this.abortController,
 				callbacks: {
@@ -2381,7 +2561,16 @@ export class AIChatManager {
 					requestUserQuestion: this.requestUserQuestion,
 					onItemModified: (kind, path) => this.recordModifiedItem(kind, path),
 					onItemDeployed: (kind, from, to) => void this.renameModifiedItem(kind, from, to),
-					onItemDiscarded: (kind, path) => void this.removeModifiedItem(kind, path)
+					onItemDiscarded: (kind, path) => void this.removeModifiedItem(kind, path),
+					attachToolImage: (toolId, image) => {
+						const existing = this.pendingToolImages.get(toolId) ?? []
+						this.pendingToolImages.set(toolId, [...existing, image])
+					},
+					takePendingToolImages: () => {
+						const images = [...this.pendingToolImages.values()].flat()
+						this.pendingToolImages.clear()
+						return images
+					}
 				}
 			}
 
@@ -2438,13 +2627,14 @@ export class AIChatManager {
 				// When the user cancelled with a message queued, that message is
 				// about to auto-send (see the flush below) — drop the rolled-back
 				// prompt instead of restoring it to the input so the handoff is clean.
-				const willAutoSendQueued = this.wasCancelledByUser() && !!this.queuedMessage
+				const willAutoSendQueued = this.wasCancelledByUser() && this.#hasQueuedMessage()
 				this.restoreUnsentTurn(
 					displayLenAfterUser,
 					modelLenAfterUser,
 					sentInstructions,
 					sentPastes,
-					!willAutoSendQueued
+					!willAutoSendQueued,
+					sentImages
 				)
 				if (this.displayMessages.length === 0) {
 					// saveChat no-ops on an empty transcript; the chat persisted earlier
@@ -2499,6 +2689,38 @@ export class AIChatManager {
 			// re-committing would duplicate the turn's messages.
 			if (!turnOutcomeHandled) {
 				this.commitInterruptedTurn(collectedMessages, partialReply)
+				// The turn is kept as context, images and all — but a provider that just
+				// refused an image would refuse it again on every later turn, wedging the
+				// conversation with no way out but editing the message or starting over.
+				// Drop the parts so the text still gets an answer; the bubbles keep their
+				// thumbnails, so the user can still see what they sent. Gated on the
+				// history, not this turn's attachments: the refused image can also be a
+				// screenshot follow-up or an earlier turn's upload (an unlisted text-only
+				// model gets the full history).
+				// The failing request is the last iteration's — the loop strips image
+				// parts per iteration, so that request carried them only if ITS model
+				// passed the vision gate. The send-time flag is only the fallback for a
+				// failure before the first iteration read the model (a turn can start on
+				// a known text-only model and switch mid-loop to an unlisted blind one).
+				const failingModel = this.lastIterationModel
+				const requestCarriedImages = failingModel
+					? modelSupportsVision(failingModel.provider, failingModel.model)
+					: !modelIsBlind
+				if (
+					requestCarriedImages &&
+					messagesHaveImageParts(this.messages) &&
+					isImageRejection(err, [
+						sendModel?.model,
+						tryGetCurrentModel()?.model,
+						failingModel?.model
+					])
+				) {
+					this.messages = stripImagePartsFromMessages(this.messages)
+					sendUserToast(
+						`${tryGetCurrentModel()?.model ?? 'The model'} could not read the attached image(s), so they were removed from the conversation. Your message was kept.`,
+						true
+					)
+				}
 				// Any prior report no longer describes the history (a partial turn
 				// was just committed); clear it so readers estimate instead. When
 				// the failure WAS a context-length error, that high estimate forces
@@ -2531,14 +2753,17 @@ export class AIChatManager {
 		// empty-response rollback, or a programmatic cancel (panel teardown,
 		// save-and-clear) leaves it in place as a card so it isn't fired into a
 		// failed or torn-down turn.
-		if ((turnCommittedCleanly || this.wasCancelledByUser()) && this.queuedMessage) {
-			const next = this.queuedMessage
-			this.queuedMessage = ''
-			const accepted = await this.sendRequest({ instructions: next })
+		if ((turnCommittedCleanly || this.wasCancelledByUser()) && this.#hasQueuedMessage()) {
+			const next = this.#takeQueue()
+			const accepted = await this.sendRequest({
+				instructions: next.text,
+				images: next.images,
+				queued: true
+			})
 			if (accepted === false) {
 				// The auto-send bailed before becoming a turn (e.g. beforeSend
 				// failed); keep it as the queued message instead of losing it.
-				this.queuedMessage = next
+				this.#restoreQueue(next)
 			}
 		}
 		// A background job may have finished mid-turn: its note missed this turn's
@@ -2584,10 +2809,29 @@ export class AIChatManager {
 		this.inlineAbortController?.abort(cancelReason)
 	}
 
+	/**
+	 * The images of a stored user turn as the model saw them. Anything resending
+	 * a turn (retry, edit) must read them from here, never from the transcript
+	 * bubble: a provider rejection strips them from history while the bubble
+	 * keeps its copy so the user can still see what they sent — resending that
+	 * copy would re-attach the image the provider just refused.
+	 */
+	storedImages(displayMessageIndex: number): AttachedImage[] | undefined {
+		const shown = this.displayMessages[displayMessageIndex]
+		if (!shown || shown.role !== 'user') return undefined
+		// The wire format has no filename; recover it from the bubble's entry
+		// (same attachment order) so a retried/edited image keeps its name — the
+		// history title of an image-only chat derives from it.
+		return imagesFromContent(this.messages[shown.index]?.content)?.map((image, i) =>
+			shown.images?.[i]?.name ? { ...image, name: shown.images[i].name } : image
+		)
+	}
+
 	restartGeneration = (
 		displayMessageIndex: number,
 		newContent?: string,
-		pastes?: PasteAttachment[]
+		pastes?: PasteAttachment[],
+		images?: AttachedImage[]
 	) => {
 		const userMessage = this.displayMessages[displayMessageIndex]
 
@@ -2595,11 +2839,19 @@ export class AIChatManager {
 			throw new Error('No user message found at the specified index')
 		}
 
+		// Read while both arrays are intact: storedImages pairs the API message with
+		// its transcript entry, and the truncations below drop them.
+		const sentImages = this.storedImages(displayMessageIndex)
+
 		// Remove all messages including and after the specified user message
 		this.displayMessages = this.displayMessages.slice(0, displayMessageIndex)
 
-		// Find corresponding message in actual messages and remove it and everything after it
-		let actualMessageIndex = this.messages.findIndex((_, i) => i === userMessage.index)
+		// Find corresponding message in actual messages and remove it and everything
+		// after it. A negative index marks a message whose API counterpart was
+		// removed by drop-oldest compaction — everything before it went too, so
+		// restarting from it restarts from an empty history.
+		let actualMessageIndex =
+			userMessage.index < 0 ? 0 : this.messages.findIndex((_, i) => i === userMessage.index)
 
 		if (actualMessageIndex === -1) {
 			throw new Error('No actual user message found to restart from')
@@ -2615,7 +2867,10 @@ export class AIChatManager {
 
 		// Resend the request with the same instructions
 		this.instructions = newContent ?? userMessage.content
-		this.sendRequest({ pastes: pastes ?? userMessage.pastes })
+		this.sendRequest({
+			pastes: pastes ?? userMessage.pastes,
+			images: images ?? sentImages
+		})
 	}
 
 	fix = () => {
@@ -2648,7 +2903,7 @@ export class AIChatManager {
 		this.cancel('saveAndClear')
 		// Drop any message queued in this conversation so it can't auto-send into
 		// the fresh chat or linger as a card across the switch.
-		this.queuedMessage = ''
+		this.#clearQueue()
 		// The tray + poller belong to the conversation being left; the just-saved
 		// chat keeps its persisted jobs (save() omits the arg → fallback preserves).
 		this.clearBackgroundJobs()
@@ -2675,11 +2930,11 @@ export class AIChatManager {
 	}
 
 	loadPastChat = async (id: string) => {
-		const chat = this.historyManager.loadPastChat(id)
+		const chat = await this.historyManager.loadPastChat(id)
 		if (chat) {
 			// Drop any message queued in the current conversation so it doesn't
 			// auto-send into the loaded one or linger as a card across the switch.
-			this.queuedMessage = ''
+			this.#clearQueue()
 			// Stop the poller for the conversation being left before swapping in the
 			// loaded chat's jobs below.
 			this.clearBackgroundJobs()
diff --git a/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts b/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts
index 3ca57f948d..f4379b6e90 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts
+++ b/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts
@@ -3,6 +3,7 @@ import type { FlowAIChatHelpers } from './flow/core'
 import type { CurrentEditor } from '$lib/components/flows/types'
 import type { ReviewChangesOpts } from './monaco-adapter'
 import type { ChatCompletionMessageParam } from 'openai/resources/chat/completions.mjs'
+import type { AttachedImage } from './imageUtils'
 import { AIChatManager, AIMode, AIAutonomyMode } from './AIChatManager.svelte'
 import { runChatLoop } from './chatLoop'
 
@@ -493,7 +494,611 @@ describe('AIChatManager queued messages', () => {
 		manager.dequeueMessage()
 
 		expect(manager.queuedMessage).toBe('')
-		expect(input.prependText).toHaveBeenCalledWith('line one\nline two')
+		expect(input.prependText).toHaveBeenCalledWith('line one\nline two', [])
+	})
+
+	const img = (n: string): AttachedImage => ({
+		dataUrl: `data:image/png;base64,${n}`,
+		mediaType: 'image/png',
+		name: n
+	})
+
+	it('carries queued images through to the auto-send', async () => {
+		replyWith('done')
+		const manager = createManager(createInputMock())
+		manager.mode = AIMode.GLOBAL // sendRequest only assembles images in GLOBAL
+		manager.queueMessage('look at this', [img('a')])
+
+		await manager.sendRequest({ instructions: 'first' })
+
+		// The auto-sent turn must carry the whole submitted message — queueing must
+		// not send the text alone and drop its images.
+		expect(mocks.runChatLoop).toHaveBeenCalledTimes(2)
+		const autoSent = manager.displayMessages.find(
+			(m) => m.role === 'user' && m.content === 'look at this'
+		)
+		expect(autoSent && 'images' in autoSent ? autoSent.images : undefined).toEqual([img('a')])
+		expect(manager.queuedImages).toEqual([])
+	})
+
+	// Attaching is refused on a text-only model, but the model can be switched
+	// after attaching (or a screenshot buffered), and sending the image then fails
+	// the whole turn. The send path re-checks rather than trusting the attach gate.
+	it('drops images when the model in use cannot read them', async () => {
+		replyWith('done')
+		const manager = createManager(createInputMock())
+		manager.mode = AIMode.GLOBAL
+		// a real bundled default, so this exercises the actual gate rather than a mock
+		mocks.tryGetCurrentModel.mockReturnValue({ provider: 'groq', model: 'llama-3.3-70b-versatile' })
+
+		await manager.sendRequest({ instructions: 'look', images: [img('a')] })
+
+		const bubble = manager.displayMessages.find((m) => m.role === 'user')
+		expect(bubble && 'images' in bubble ? bubble.images : undefined).toBeUndefined()
+		expect(mocks.sendUserToast).toHaveBeenCalledWith(
+			expect.stringContaining("can't read images"),
+			true
+		)
+		mocks.tryGetCurrentModel.mockReturnValue(model)
+	})
+
+	// displayMessages hold a 384px transcript copy; retrying must resend the
+	// model's own 1568px image, not a thumbnail of its previous input.
+	it('resends the model-resolution image on retry, not the transcript thumbnail', async () => {
+		replyWith('done')
+		const manager = createManager(createInputMock())
+		manager.mode = AIMode.GLOBAL
+		manager.messages = [
+			{
+				role: 'user',
+				content: [
+					{ type: 'text', text: 'look' },
+					{ type: 'image_url', image_url: { url: 'data:image/png;base64,FULLRES' } }
+				] as any
+			},
+			{ role: 'assistant', content: 'bad answer' }
+		]
+		manager.displayMessages = [
+			{
+				role: 'user',
+				content: 'look',
+				index: 0,
+				images: [{ dataUrl: 'data:image/png;base64,THUMB', mediaType: 'image/png' }]
+			},
+			{ role: 'assistant', content: 'bad answer' }
+		]
+
+		manager.restartGeneration(0)
+		await vi.waitFor(() => expect(mocks.runChatLoop).toHaveBeenCalled())
+
+		const resent = mocks.runChatLoop.mock.calls[0][0].messages.at(-1)
+		const urls = (resent.content as any[])
+			.filter((p) => p.type === 'image_url')
+			.map((p) => p.image_url.url)
+		expect(urls).toEqual(['data:image/png;base64,FULLRES'])
+	})
+
+	// The loop, not the send, owns the vision strip: it re-applies it per iteration
+	// for whatever model that iteration runs on, so a mid-loop switch in either
+	// direction sees the right view. A copy stripped at send time could never be
+	// un-stripped when the user switches text-only → vision during the turn.
+	it('passes the full history to the loop even on a text-only model', async () => {
+		replyWith('done')
+		const manager = createManager(createInputMock())
+		manager.mode = AIMode.GLOBAL
+		manager.messages = [
+			{
+				role: 'user',
+				content: [
+					{ type: 'text', text: 'earlier turn' },
+					{ type: 'image_url', image_url: { url: 'data:image/png;base64,OLD' } }
+				] as any
+			},
+			{ role: 'assistant', content: 'ok' }
+		]
+		mocks.tryGetCurrentModel.mockReturnValue({ provider: 'groq', model: 'llama-3.3-70b-versatile' })
+
+		await manager.sendRequest({ instructions: 'plain text follow-up' })
+
+		const sent = mocks.runChatLoop.mock.calls[0][0].messages
+		const anyImage = sent.some(
+			(m: any) => Array.isArray(m.content) && m.content.some((p: any) => p.type === 'image_url')
+		)
+		expect(anyImage).toBe(true)
+		mocks.tryGetCurrentModel.mockReturnValue(model)
+	})
+
+	// Empty instructions are a valid image-only send; they must override, not
+	// keep, text a failed or cancelled earlier turn left in this.instructions.
+	it('does not attach stale instructions to an image-only send', async () => {
+		replyWith('done')
+		const manager = createManager(createInputMock())
+		manager.mode = AIMode.GLOBAL
+		manager.instructions = 'text from a failed earlier turn'
+
+		await manager.sendRequest({ instructions: '', images: [img('a')] })
+
+		const sent = mocks.runChatLoop.mock.calls[0][0].messages.at(-1)
+		const text = Array.isArray(sent.content)
+			? sent.content
+					.filter((p: any) => p.type === 'text')
+					.map((p: any) => p.text)
+					.join('\n')
+			: sent.content
+		expect(text).not.toContain('text from a failed earlier turn')
+	})
+
+	// The failing request may have used the model selected at send time, not the
+	// currently selected one — a mid-flight switch must not stop its id being
+	// excluded from the rejection match.
+	it('does not strip images when the error echoes the send-time model after a mid-flight switch', async () => {
+		const manager = createManager(createInputMock())
+		manager.mode = AIMode.GLOBAL
+		mocks.tryGetCurrentModel.mockReturnValue({
+			provider: 'openrouter',
+			model: 'meta-llama/llama-3.2-90b-vision-instruct'
+		})
+		mocks.runChatLoop.mockImplementation(async () => {
+			// the user switches models while the request is in flight...
+			mocks.tryGetCurrentModel.mockReturnValue({ provider: 'openai', model: 'gpt-4o' })
+			// ...and the in-flight model fails with an unrelated error echoing its id
+			throw new Error('429 Rate limit reached for meta-llama/llama-3.2-90b-vision-instruct')
+		})
+
+		await manager.sendRequest({ instructions: 'look at this', images: [img('a')] })
+
+		const stillThere = manager.messages.some(
+			(m: any) => Array.isArray(m.content) && m.content.some((p: any) => p.type === 'image_url')
+		)
+		expect(stillThere).toBe(true)
+		mocks.tryGetCurrentModel.mockReturnValue(model)
+	})
+
+	// Queuing clears the composer, so its own counter resets; the cap has to hold
+	// on the queue or repeated sends stack an unbounded batch into one message.
+	it('caps images accumulated across repeated queued sends', () => {
+		const manager = createManager()
+		for (let i = 0; i < 4; i++) {
+			manager.queueMessage(`msg ${i}`, [img(`a${i}`), img(`b${i}`), img(`c${i}`)])
+		}
+		expect(manager.queuedImages.length).toBe(8)
+	})
+
+	// A rejected image stays in history, so every later turn resends it and fails
+	// the same way — the conversation wedges with no way out but editing or /clear.
+	it('removes the image from history when the provider rejects it', async () => {
+		const manager = createManager(createInputMock())
+		manager.mode = AIMode.GLOBAL
+		mocks.runChatLoop.mockImplementation(async () => {
+			throw new Error('400 Invalid image content')
+		})
+
+		await manager.sendRequest({ instructions: 'look at this', images: [img('a')] })
+
+		const stillThere = manager.messages.some(
+			(m: any) => Array.isArray(m.content) && m.content.some((p: any) => p.type === 'image_url')
+		)
+		expect(stillThere).toBe(false)
+		// the prompt itself survives, so a follow-up still has the text as context
+		expect(manager.messages.length).toBeGreaterThan(0)
+		expect(mocks.sendUserToast).toHaveBeenCalledWith(
+			expect.stringContaining('could not read the attached image'),
+			true
+		)
+	})
+
+	// An unrelated failure must not strip a perfectly good image.
+	it('keeps the image when the failure is unrelated', async () => {
+		const manager = createManager(createInputMock())
+		manager.mode = AIMode.GLOBAL
+		mocks.runChatLoop.mockImplementation(async () => {
+			throw new Error('429 rate limit exceeded')
+		})
+
+		await manager.sendRequest({ instructions: 'look at this', images: [img('a')] })
+
+		const stillThere = manager.messages.some(
+			(m: any) => Array.isArray(m.content) && m.content.some((p: any) => p.type === 'image_url')
+		)
+		expect(stillThere).toBe(true)
+	})
+
+	// Vision model ids often contain the rejection subject words themselves, and
+	// providers echo the id in unrelated errors. A rate limit must not read as an
+	// image rejection just because the model is called "...-vision-instruct" —
+	// the strip it would trigger is permanent (retry refuses the transcript copy).
+	it('keeps the image when a transient error merely echoes a vision model id', async () => {
+		const manager = createManager(createInputMock())
+		manager.mode = AIMode.GLOBAL
+		mocks.tryGetCurrentModel.mockReturnValue({
+			provider: 'openrouter',
+			model: 'meta-llama/llama-3.2-90b-vision-instruct'
+		})
+		mocks.runChatLoop.mockImplementation(async () => {
+			throw new Error('429 Rate limit reached for model meta-llama/llama-3.2-90b-vision-instruct')
+		})
+
+		await manager.sendRequest({ instructions: 'look at this', images: [img('a')] })
+
+		const stillThere = manager.messages.some(
+			(m: any) => Array.isArray(m.content) && m.content.some((p: any) => p.type === 'image_url')
+		)
+		expect(stillThere).toBe(true)
+	})
+
+	// The refused image is not always this turn's attachment: an unlisted
+	// text-only model receives the full history, so a screenshot follow-up or an
+	// earlier upload can be the part it chokes on. Without the strip, every later
+	// send resubmits it and fails identically — a wedge with no self-correction.
+	it('removes historical images from history when the provider rejects them on a text turn', async () => {
+		const manager = createManager(createInputMock())
+		manager.mode = AIMode.GLOBAL
+		// e.g. a take_screenshot follow-up from an earlier turn
+		manager.messages = [
+			{
+				role: 'user',
+				content: [
+					{ type: 'text', text: 'Screenshot of the app preview:' },
+					{ type: 'image_url', image_url: { url: 'data:image/png;base64,SHOT' } }
+				] as any
+			},
+			{ role: 'assistant', content: 'looks good' }
+		]
+		mocks.runChatLoop.mockImplementation(async () => {
+			throw new Error('400 this model does not support image input')
+		})
+
+		await manager.sendRequest({ instructions: 'plain text follow-up' })
+
+		const stillThere = manager.messages.some(
+			(m: any) => Array.isArray(m.content) && m.content.some((p: any) => p.type === 'image_url')
+		)
+		expect(stillThere).toBe(false)
+		expect(mocks.sendUserToast).toHaveBeenCalledWith(
+			expect.stringContaining('could not read the attached image'),
+			true
+		)
+	})
+
+	// The rejection fallback strips the image from history but leaves the bubble's
+	// thumbnail. Retry must not resurrect it, or the retried turn fails identically
+	// and the conversation is wedged after all.
+	it('does not resend an image the fallback already stripped', async () => {
+		replyWith('done')
+		const manager = createManager(createInputMock())
+		manager.mode = AIMode.GLOBAL
+		// post-rejection shape: history stripped to text, transcript still shows it
+		manager.messages = [{ role: 'user', content: 'look at this\n[image omitted]' }]
+		manager.displayMessages = [
+			{ role: 'user', content: 'look at this', index: 0, images: [img('thumb')] }
+		]
+
+		manager.restartGeneration(0)
+		await vi.waitFor(() => expect(mocks.runChatLoop).toHaveBeenCalled())
+
+		const resent = mocks.runChatLoop.mock.calls[0][0].messages.at(-1)
+		const hasImage =
+			Array.isArray(resent.content) && resent.content.some((p: any) => p.type === 'image_url')
+		expect(hasImage).toBe(false)
+	})
+
+	// The wire format has no filename; a retried/edited image must recover it
+	// from the bubble's entry — an unnamed resend would downgrade an image-only
+	// chat's filename-derived history title to the generic fallback.
+	it('storedImages recovers attachment names from the transcript bubble', () => {
+		const manager = createManager()
+		manager.messages = [
+			{
+				role: 'user',
+				content: [
+					{ type: 'text', text: 'look' },
+					{ type: 'image_url', image_url: { url: 'data:image/png;base64,FULL' } }
+				] as any
+			}
+		]
+		manager.displayMessages = [
+			{
+				role: 'user',
+				content: 'look',
+				index: 0,
+				images: [
+					{ dataUrl: 'data:image/png;base64,FULL', mediaType: 'image/png', name: 'mockup.png' }
+				]
+			} as any
+		]
+
+		expect(manager.storedImages(0)).toEqual([
+			{ dataUrl: 'data:image/png;base64,FULL', mediaType: 'image/png', name: 'mockup.png' }
+		])
+	})
+
+	// Drop-oldest removes the API counterpart but the transcript keeps the bubble.
+	// Its restart index must not alias to a surviving message, or retrying/editing
+	// the dropped prompt would silently attach that other turn's images.
+	it("does not serve another turn's images for a message dropped by drop-oldest compaction", () => {
+		const manager = createManager()
+		manager.messages = [
+			{ role: 'user', content: 'old prompt' },
+			{ role: 'assistant', content: 'old answer' },
+			{
+				role: 'user',
+				content: [
+					{ type: 'text', text: 'new prompt' },
+					{ type: 'image_url', image_url: { url: 'data:image/png;base64,NEW' } }
+				] as any
+			},
+			{ role: 'assistant', content: 'new answer' }
+		]
+		manager.displayMessages = [
+			{ role: 'user', content: 'old prompt', index: 0 },
+			{ role: 'assistant', content: 'old answer' },
+			{ role: 'user', content: 'new prompt', index: 2, images: [img('thumb')] },
+			{ role: 'assistant', content: 'new answer' }
+		]
+
+		// frees the first turn (user + assistant), keeps the image-bearing one
+		manager.compactOldestMessages(1)
+
+		expect(manager.messages.length).toBe(2)
+		// the dropped message resolves no images...
+		expect(manager.storedImages(0)).toBeUndefined()
+		// ...while the surviving one still resolves its own
+		expect(manager.storedImages(2)?.[0]?.dataUrl).toBe('data:image/png;base64,NEW')
+	})
+
+	// Enter with an image but no text must send, not silently discard the image
+	// (the input clears itself optimistically, so a bail on empty text loses it).
+	it('sends an image-only message in GLOBAL mode', async () => {
+		replyWith('done')
+		const manager = createManager(createInputMock())
+		manager.mode = AIMode.GLOBAL
+
+		await manager.sendRequest({ instructions: '', images: [img('a')] })
+
+		expect(mocks.runChatLoop).toHaveBeenCalled()
+		const sent = mocks.runChatLoop.mock.calls[0][0].messages.at(-1)
+		const hasImage =
+			Array.isArray(sent.content) && sent.content.some((p: any) => p.type === 'image_url')
+		expect(hasImage).toBe(true)
+	})
+
+	it('still ignores a send with no text and no images', async () => {
+		replyWith('done')
+		const manager = createManager(createInputMock())
+		manager.mode = AIMode.GLOBAL
+
+		await manager.sendRequest({ instructions: '' })
+
+		expect(mocks.runChatLoop).not.toHaveBeenCalled()
+	})
+
+	// With no text, dropping the images leaves nothing to send — they must go back
+	// to the composer (which already cleared itself optimistically), not vanish.
+	it('restores the images when an image-only send meets a text-only model', async () => {
+		replyWith('done')
+		const input = createInputMock()
+		const manager = createManager(input)
+		manager.mode = AIMode.GLOBAL
+		mocks.tryGetCurrentModel.mockReturnValue({
+			provider: 'groq',
+			model: 'llama-3.3-70b-versatile'
+		})
+
+		await manager.sendRequest({ instructions: '', images: [img('a')] })
+
+		expect(mocks.runChatLoop).not.toHaveBeenCalled()
+		expect(input.prependText).toHaveBeenCalledWith('', [img('a')])
+		mocks.tryGetCurrentModel.mockReturnValue(model)
+	})
+
+	// A refused queued draft is the caller's to restore (it re-queues on false) —
+	// a composer restore on top would leave the same attachment in both places.
+	it('does not double-restore a queued image-only draft refused by a text-only model', async () => {
+		const input = createInputMock()
+		const manager = createManager(input)
+		manager.mode = AIMode.GLOBAL
+		mocks.tryGetCurrentModel.mockReturnValue({
+			provider: 'groq',
+			model: 'llama-3.3-70b-versatile'
+		})
+
+		const accepted = await manager.sendRequest({
+			instructions: '',
+			images: [img('a')],
+			queued: true
+		})
+
+		expect(accepted).toBe(false)
+		expect(mocks.runChatLoop).not.toHaveBeenCalled()
+		expect(input.prependText).not.toHaveBeenCalled()
+		expect(input.restoreInstructions).not.toHaveBeenCalled()
+		mocks.tryGetCurrentModel.mockReturnValue(model)
+	})
+
+	// A→B→C: the loop can run an iteration on a model that is neither the
+	// send-time one (A) nor the currently-selected one (C) by the time the
+	// failure is classified. The failing iteration's id (B) must be excluded
+	// from the rejection match too.
+	it('does not strip images when the error echoes an intermediate model (A→B→C)', async () => {
+		const manager = createManager(createInputMock())
+		manager.mode = AIMode.GLOBAL
+		const a = { provider: 'openai', model: 'gpt-4o' }
+		const b = { provider: 'openrouter', model: 'meta-llama/llama-3.2-90b-vision-instruct' }
+		const c = { provider: 'anthropic', model: 'claude-sonnet-4-6' }
+		mocks.getCurrentModel.mockReturnValue(a)
+		mocks.tryGetCurrentModel.mockReturnValue(a)
+		mocks.runChatLoop.mockImplementation(async (config: any) => {
+			// an iteration starts on B...
+			await config.onBeforeIteration?.([], config.helpers, b)
+			// ...the user switches to C while B's request is in flight...
+			mocks.getCurrentModel.mockReturnValue(c)
+			mocks.tryGetCurrentModel.mockReturnValue(c)
+			// ...and B fails with an unrelated error echoing its id
+			throw new Error('429 Rate limit reached for meta-llama/llama-3.2-90b-vision-instruct')
+		})
+
+		await manager.sendRequest({ instructions: 'look at this', images: [img('a')] })
+
+		const stillThere = manager.messages.some(
+			(m: any) => Array.isArray(m.content) && m.content.some((p: any) => p.type === 'image_url')
+		)
+		expect(stillThere).toBe(true)
+		mocks.getCurrentModel.mockReturnValue(model)
+		mocks.tryGetCurrentModel.mockReturnValue(model)
+	})
+
+	// The Responses converter sends images as input_image parts, and '_' is a
+	// word character — the whole-word regex must still catch that spelling.
+	it('recovers when the provider rejects the input_image content part', async () => {
+		const manager = createManager(createInputMock())
+		manager.mode = AIMode.GLOBAL
+		mocks.runChatLoop.mockRejectedValue(
+			new Error("400 Invalid value: content part type 'input_image' is not supported")
+		)
+
+		await manager.sendRequest({ instructions: 'look at this', images: [img('a')] })
+
+		const stillThere = manager.messages.some(
+			(m: any) => Array.isArray(m.content) && m.content.some((p: any) => p.type === 'image_url')
+		)
+		expect(stillThere).toBe(false)
+	})
+
+	// The composer stays mounted across a mode switch, so chips attached in
+	// GLOBAL can ride a send in any mode — they must be restored, not dropped.
+	it('refuses and restores an image-bearing send outside GLOBAL mode', async () => {
+		const input = createInputMock()
+		const manager = createManager(input)
+		manager.mode = AIMode.NAVIGATOR
+
+		const pending = manager.sendRequest({ instructions: 'find it', images: [img('a')] })
+		// The composer clears itself synchronously right after calling sendRequest:
+		// a restore issued before that point would be wiped by the clear.
+		expect(input.restoreInstructions).not.toHaveBeenCalled()
+		const accepted = await pending
+
+		expect(accepted).toBe(false)
+		expect(mocks.runChatLoop).not.toHaveBeenCalled()
+		expect(input.restoreInstructions).toHaveBeenCalledWith('find it', [], [img('a')])
+	})
+
+	// A refused queued draft is the caller's to restore (it re-queues on false) —
+	// a composer restore on top would duplicate it.
+	it('does not double-restore a queued image draft refused outside GLOBAL mode', async () => {
+		const input = createInputMock()
+		const manager = createManager(input)
+		manager.mode = AIMode.NAVIGATOR
+
+		const accepted = await manager.sendRequest({
+			instructions: 'queued one',
+			images: [img('a')],
+			queued: true
+		})
+
+		expect(accepted).toBe(false)
+		expect(input.restoreInstructions).not.toHaveBeenCalled()
+		expect(input.prependText).not.toHaveBeenCalled()
+	})
+
+	// "provisioning"/"provisioned" contain the word "vision" — a transient
+	// capacity error must not be classified as an image rejection.
+	it('does not strip images on a provisioning error', async () => {
+		const manager = createManager(createInputMock())
+		manager.mode = AIMode.GLOBAL
+		mocks.runChatLoop.mockRejectedValue(
+			new Error('503 model provisioning failed, please retry later')
+		)
+
+		await manager.sendRequest({ instructions: 'look at this', images: [img('a')] })
+
+		const stillThere = manager.messages.some(
+			(m: any) => Array.isArray(m.content) && m.content.some((p: any) => p.type === 'image_url')
+		)
+		expect(stillThere).toBe(true)
+	})
+
+	// A turn can start on a known text-only model (send-time flag says "no images
+	// go out") and switch mid-loop to an UNLISTED blind model whose iteration does
+	// carry the history's images. When that model rejects them, recovery must fire
+	// — the send-time flag alone would skip it and wedge every later send.
+	it('recovers when a turn starts text-only but an unlisted blind model rejects mid-loop', async () => {
+		const manager = createManager(createInputMock())
+		manager.mode = AIMode.GLOBAL
+		manager.messages = [
+			{
+				role: 'user',
+				content: [
+					{ type: 'text', text: 'earlier' },
+					{ type: 'image_url', image_url: { url: 'data:image/png;base64,OLD' } }
+				] as any
+			},
+			{ role: 'assistant', content: 'ok' }
+		]
+		const knownBlind = { provider: 'groq', model: 'llama-3.3-70b-versatile' }
+		const unlistedBlind = { provider: 'customai', model: 'my-internal-llm' }
+		mocks.getCurrentModel.mockReturnValue(knownBlind)
+		mocks.tryGetCurrentModel.mockReturnValue(knownBlind)
+		mocks.runChatLoop.mockImplementation(async (config: any) => {
+			// mid-loop switch to a model the deny-list doesn't know...
+			mocks.getCurrentModel.mockReturnValue(unlistedBlind)
+			mocks.tryGetCurrentModel.mockReturnValue(unlistedBlind)
+			await config.onBeforeIteration?.([], config.helpers, unlistedBlind)
+			// ...its request carries the images and the provider rejects them
+			throw new Error('400 this model does not support image input')
+		})
+
+		await manager.sendRequest({ instructions: 'plain follow-up' })
+
+		const stillThere = manager.messages.some(
+			(m: any) => Array.isArray(m.content) && m.content.some((p: any) => p.type === 'image_url')
+		)
+		expect(stillThere).toBe(false)
+		mocks.getCurrentModel.mockReturnValue(model)
+		mocks.tryGetCurrentModel.mockReturnValue(model)
+	})
+
+	// Images evicted from requests by the byte bound must not keep their full
+	// data URLs in stored history: provider-reported usage excludes them, so
+	// compaction would never prune them and every save re-clones the payload.
+	// The bubble and the API message must share the exact same data URL — the
+	// history's blob store dedups them to a single record on save, so a
+	// transcript-side copy (e.g. a downscale) would double the stored bytes.
+	it('sends and displays the same image copy', async () => {
+		replyWith('done')
+		const manager = createManager(createInputMock())
+		manager.mode = AIMode.GLOBAL
+
+		await manager.sendRequest({ instructions: 'look', images: [img('a')] })
+
+		const bubble = manager.displayMessages.find((m) => m.role === 'user') as any
+		const sent = mocks.runChatLoop.mock.calls[0][0].messages.at(-1)
+		const sentUrl = sent.content.find((p: any) => p.type === 'image_url').image_url.url
+		expect(bubble.images[0].dataUrl).toBe(sentUrl)
+	})
+
+	it('queues an image-only message and restores it on dequeue', () => {
+		const input = createInputMock()
+		const manager = createManager(input)
+		manager.queueMessage('', [img('a')])
+
+		expect(manager.queuedMessage).toBe('')
+		expect(manager.queuedImages).toEqual([img('a')])
+
+		manager.dequeueMessage()
+
+		expect(manager.queuedImages).toEqual([])
+		expect(input.prependText).toHaveBeenCalledWith('', [img('a')])
+	})
+
+	it('drops queued images when the conversation is switched away', async () => {
+		const manager = createManager(createInputMock())
+		manager.queueMessage('stale', [img('a')])
+
+		await manager.saveAndClear()
+
+		// images must not survive into the next conversation
+		expect(manager.queuedMessage).toBe('')
+		expect(manager.queuedImages).toEqual([])
 	})
 
 	it('re-queues instead of dropping when the input is unmounted', () => {
@@ -610,6 +1215,23 @@ describe('AIChatManager queued messages', () => {
 		expect(input.prependText).not.toHaveBeenCalled()
 	})
 
+	// The composer clears itself optimistically on send, so a preflight failure
+	// must put the whole draft back — images can't just be re-dropped from memory.
+	it('restores text and images to the composer when beforeSend rejects a direct send', async () => {
+		const input = createInputMock()
+		const manager = createManager(input)
+		manager.mode = AIMode.GLOBAL
+		manager.beforeSend = vi.fn().mockRejectedValue(new Error('workspace fork failed'))
+
+		const accepted = await manager.sendRequest({ instructions: 'look', images: [img('a')] })
+
+		expect(accepted).toBe(false)
+		expect(mocks.runChatLoop).not.toHaveBeenCalled()
+		expect(input.restoreInstructions).toHaveBeenCalledWith('look', [], [img('a')])
+		// the optimistic bubble is rolled back
+		expect(manager.displayMessages).toHaveLength(0)
+	})
+
 	it('drops the queued message when switching conversations (no cross-chat leak)', async () => {
 		const manager = createManager(createInputMock())
 
@@ -904,7 +1526,7 @@ describe('AIChatManager context compaction', () => {
 		expect(manager.messages.map((m) => m.role)).toEqual(['user', 'user'])
 	})
 
-	it('re-bases display message indices and clamps fully-compacted ones to 0', () => {
+	it('re-bases display message indices, marking fully-compacted ones negative', () => {
 		const manager = new AIChatManager()
 		manager.messages = [
 			{ role: 'user', content: 'a'.repeat(400) }, // ~100 estimated tokens
@@ -920,8 +1542,11 @@ describe('AIChatManager context compaction', () => {
 		]
 		manager.compactOldestMessages(150)
 		expect(manager.messages.map((m) => m.content)).toEqual(['c', 'd'])
+		// A dropped message's index goes negative rather than clamping to 0:
+		// 0 would alias it to the first surviving message, and storedImages
+		// would serve that message's images to a retry of this one.
 		expect(manager.displayMessages.map((m) => ('index' in m ? m.index : undefined))).toEqual([
-			0,
+			-2,
 			undefined,
 			0,
 			1
@@ -1031,6 +1656,59 @@ describe('AIChatManager context compaction', () => {
 		expect(manager.contextUsage).toBeUndefined()
 	})
 
+	// A take_screenshot follow-up is a `user` message with no display counterpart
+	// (appendPendingToolImages injects it). It must never become the tail
+	// boundary: `messages` and `displayMessages` would then be sliced at
+	// different turns and the cards in between would vanish from the transcript
+	// while the model still sees them.
+	it('never lands the tail boundary on a screenshot follow-up that has no display counterpart', async () => {
+		mocks.getCurrentModel.mockReturnValue(gpt4oModel)
+		mocks.tryGetCurrentModel.mockReturnValue(gpt4oModel)
+		mocks.getNonStreamingCompletion.mockResolvedValue('<summary>SUMMARY TEXT</summary>')
+		const manager = new AIChatManager()
+		manager.messages = [
+			{ role: 'user', content: 'OLD1' + 'a'.repeat(100_000) },
+			{ role: 'assistant', content: 'OLD2' + 'b'.repeat(100_000) },
+			{ role: 'user', content: 'OLD3' + 'c'.repeat(100_000) },
+			{ role: 'assistant', content: 'toolTurn', tool_calls: [] as any },
+			{ role: 'tool', content: 'Screenshot captured', tool_call_id: 't1' } as any,
+			// the synthetic follow-up: user role, image parts, NO display entry
+			{
+				role: 'user',
+				content: [
+					{ type: 'text', text: 'Screenshot(s) of the app preview:' },
+					{ type: 'image_url', image_url: { url: 'data:image/png;base64,AAAA' } }
+				] as any
+			},
+			// sized so the tail budget breaks just above OLD3: the backward walk
+			// stops at index 3, and the forward snap then lands on the synthetic
+			// user message at 5 — the case this test exists for.
+			{ role: 'assistant', content: 'afterShot' + 'g'.repeat(120_000) },
+			{ role: 'user', content: 'recentQ' + 'h'.repeat(120_000) }
+		]
+		manager.displayMessages = [
+			{ role: 'user', content: 'old1', index: 0 },
+			{ role: 'assistant', content: 'old2' },
+			{ role: 'user', content: 'old3', index: 2 },
+			{ role: 'assistant', content: 'afterShot' },
+			{ role: 'user', content: 'recentQ', index: 7 }
+		]
+		manager.contextUsage = 110_000 // over the 0.8 * 128k trigger
+		manager.instructions = 'next question'
+
+		await manager.sendRequest()
+
+		// Whatever survived summarization, the two views must agree: any assistant
+		// turn the model can still see must still be visible to the user.
+		const keptAfterShot = manager.messages.some(
+			(m) => typeof m.content === 'string' && m.content.includes('afterShot')
+		)
+		const shownAfterShot = manager.displayMessages.some(
+			(m) => m.role === 'assistant' && m.content.includes('afterShot')
+		)
+		expect(shownAfterShot).toBe(keptAfterShot)
+	})
+
 	it('falls back to drop-oldest when summarization fails', async () => {
 		mocks.getCurrentModel.mockReturnValue(gpt4oModel)
 		mocks.tryGetCurrentModel.mockReturnValue(gpt4oModel)
@@ -1382,7 +2060,7 @@ describe('AIChatManager sendRequest lifecycle', () => {
 		expect(manager.displayMessages.some((m) => m.role === 'user')).toBe(false)
 		expect(manager.messages.some((m) => m.role === 'user')).toBe(false)
 		// ...and its text is handed back to the composer.
-		expect(restoreInstructions).toHaveBeenCalledWith('do a thing', [])
+		expect(restoreInstructions).toHaveBeenCalledWith('do a thing', [], [])
 		expect(manager.loading).toBe(false)
 	})
 
@@ -1411,7 +2089,7 @@ describe('AIChatManager sendRequest lifecycle', () => {
 
 		expect(manager.displayMessages).toHaveLength(0)
 		expect(manager.messages.some((m) => m.role === 'user')).toBe(false)
-		expect(restoreInstructions).toHaveBeenCalledWith('do a thing', [])
+		expect(restoreInstructions).toHaveBeenCalledWith('do a thing', [], [])
 		expect(manager.loading).toBe(false)
 	})
 
@@ -1513,7 +2191,7 @@ describe('AIChatManager sendRequest lifecycle', () => {
 		expect(manager.messages.some((m) => m.role === 'assistant')).toBe(false)
 		expect(manager.displayMessages.some((m) => m.role === 'assistant')).toBe(false)
 		expect(manager.displayMessages.some((m) => m.role === 'user')).toBe(false)
-		expect(restoreInstructions).toHaveBeenCalledWith('think hard', [])
+		expect(restoreInstructions).toHaveBeenCalledWith('think hard', [], [])
 		expect(manager.loading).toBe(false)
 	})
 
diff --git a/frontend/src/lib/components/copilot/chat/AIChatMessage.svelte b/frontend/src/lib/components/copilot/chat/AIChatMessage.svelte
index 4e2df28a50..57be8d9628 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatMessage.svelte
+++ b/frontend/src/lib/components/copilot/chat/AIChatMessage.svelte
@@ -12,6 +12,7 @@
 	import CompactionBoundary from './CompactionBoundary.svelte'
 	import { messageDraft, segments } from './chatDraft'
 	import { lineCountLabel } from './pasteTokens'
+	import ExpandableImage from '$lib/components/common/image/ExpandableImage.svelte'
 
 	const aiChatManager = getAiChatManager()
 
@@ -81,6 +82,7 @@
 					bind:selectedContext
 					initialInstructions={message.content}
 					initialPastes={message.pastes}
+					initialImages={aiChatManager.storedImages(messageIndex)}
 					{editingMessageIndex}
 					onClickOutside={() => (editingMessageIndex = null)}
 					onKeyDown={(e) => {
@@ -100,23 +102,37 @@
 						><ToolExecutionDisplay message={message as ToolDisplayMessage} /></div
 					>
 				{:else}
-					<div
-						class="text-xs px-3 py-2 w-fit max-w-[min(32rem,100%)] bg-surface-accent-selected text-accent rounded-lg relative group break-words"
-					>
-						{#each segments(messageDraft(message)) as seg}{#if seg.type === 'text'}<span
-									class="whitespace-pre-wrap">{seg.value}</span
-								>{:else if expandedPastes.has(seg.att.id)}<button
-									type="button"
-									class="my-0.5 px-1.5 py-0.5 rounded bg-surface-secondary text-secondary text-2xs"
-									onclick={(e) => togglePaste(e, seg.att.id)}
-									>{lineCountLabel(seg.att.lines)} · click to collapse</button
-								><span class="block whitespace-pre-wrap mt-1">{seg.att.content}</span>{:else}<button
-									type="button"
-									class="px-1.5 py-0.5 rounded bg-surface-secondary text-secondary text-2xs"
-									onclick={(e) => togglePaste(e, seg.att.id)}
-									>Pasted {lineCountLabel(seg.att.lines)} · click to expand</button
-								>{/if}{/each}
-					</div>
+					{#if message.role === 'user' && message.images && message.images.length > 0}
+						<div class="flex flex-row flex-wrap gap-1.5 mb-1">
+							{#each message.images as image, i (i)}
+								<ExpandableImage
+									src={image.dataUrl}
+									alt={image.name ?? 'attached image'}
+									class="max-h-40 max-w-[min(20rem,100%)] rounded-lg border border-border-light"
+								/>
+							{/each}
+						</div>
+					{/if}
+					{#if message.content.trim() !== '' || !(message.images && message.images.length > 0)}
+						<div
+							class="text-xs px-3 py-2 w-fit max-w-[min(32rem,100%)] bg-surface-accent-selected text-accent rounded-lg relative group break-words"
+						>
+							{#each segments(messageDraft(message)) as seg}{#if seg.type === 'text'}<span
+										class="whitespace-pre-wrap">{seg.value}</span
+									>{:else if expandedPastes.has(seg.att.id)}<button
+										type="button"
+										class="my-0.5 px-1.5 py-0.5 rounded bg-surface-secondary text-secondary text-2xs"
+										onclick={(e) => togglePaste(e, seg.att.id)}
+										>{lineCountLabel(seg.att.lines)} · click to collapse</button
+									><span class="block whitespace-pre-wrap mt-1">{seg.att.content}</span
+									>{:else}<button
+										type="button"
+										class="px-1.5 py-0.5 rounded bg-surface-secondary text-secondary text-2xs"
+										onclick={(e) => togglePaste(e, seg.att.id)}
+										>Pasted {lineCountLabel(seg.att.lines)} · click to expand</button
+									>{/if}{/each}
+						</div>
+					{/if}
 				{/if}
 			</div>
 		{/if}
diff --git a/frontend/src/lib/components/copilot/chat/ContextTextarea.svelte b/frontend/src/lib/components/copilot/chat/ContextTextarea.svelte
index c6f3268e50..777331e808 100644
--- a/frontend/src/lib/components/copilot/chat/ContextTextarea.svelte
+++ b/frontend/src/lib/components/copilot/chat/ContextTextarea.svelte
@@ -35,6 +35,8 @@
 		 * from the textarea. The host should drop the matching entry from
 		 * selectedContext (only items with `deletable !== false` are reported). */
 		onRemoveContext?: (contextElement: ContextElement) => void
+		/** Called with image files found in a paste, so the host can attach them. */
+		onImageFiles?: (files: File[]) => void
 		className?: string
 		onKeyDown?: (e: KeyboardEvent) => void
 	}
@@ -49,6 +51,7 @@
 		onSendRequest,
 		onAddContext,
 		onRemoveContext,
+		onImageFiles,
 		className = '',
 		onKeyDown = undefined
 	}: Props = $props()
@@ -300,6 +303,22 @@
 	// widened over overlapped tokens so pasting onto a chip replaces it whole.
 	function handlePaste(e: ClipboardEvent) {
 		const text = e.clipboardData?.getData('text/plain') ?? ''
+		// Image paste (screenshots, copied images) → hand off to the host to attach.
+		// Only when the clipboard carries no text: spreadsheet and browser copies put a
+		// bitmap alongside the text, and pasting a cell range must paste the cells, not
+		// a picture of them. An OS screenshot carries the image alone, so it still lands
+		// here. `onImageFiles` is unset outside GLOBAL, where attaching is unsupported —
+		// the paste must then fall through to text rather than be swallowed.
+		if (!text.trim() && onImageFiles) {
+			const imageFiles = Array.from(e.clipboardData?.files ?? []).filter((f) =>
+				f.type.startsWith('image/')
+			)
+			if (imageFiles.length > 0) {
+				e.preventDefault()
+				onImageFiles(imageFiles)
+				return
+			}
+		}
 		if (!text || !shouldCollapsePaste(text)) return
 		e.preventDefault()
 		const ta = e.currentTarget as HTMLTextAreaElement
diff --git a/frontend/src/lib/components/copilot/chat/HistoryManager.svelte.ts b/frontend/src/lib/components/copilot/chat/HistoryManager.svelte.ts
index d24246b711..beb3424998 100644
--- a/frontend/src/lib/components/copilot/chat/HistoryManager.svelte.ts
+++ b/frontend/src/lib/components/copilot/chat/HistoryManager.svelte.ts
@@ -3,14 +3,23 @@ import type { ChatJob, DisplayMessage } from './shared'
 import { expanded, messageDraft } from './chatDraft'
 import { createLongHash } from '$lib/editorLangUtils'
 import { userScopedDb, type UserScopedDbMigrateDeps } from '$lib/userScopedDb'
+import { scopedKey } from '$lib/userScopedStorage'
 import type { ChatCompletionMessageParam } from 'openai/resources/index.mjs'
 import type { PersistedContextUsage } from './tokenUsage'
+import { IMAGE_OMITTED_PLACEHOLDER, type AttachedImage } from './imageUtils'
+import { randomUUID } from '$lib/utils/uuid'
 
 // Base IndexedDB name; userScopedDb namespaces the effective DB by the logged-in
 // user's email so chat messages are never physically shared across users on a
 // shared browser. The bare name is also the legacy (pre-namespacing) DB, claimed
 // once on first login.
 const DB_NAME = 'copilot-chat-history'
+// v3 adds the images blob store (replacing v2's short-lived toolImages store).
+const DB_VERSION = 3
+/** Newest image blobs kept per chat; each is a bounded (≤1568px) data URL. */
+const MAX_IMAGES_PER_CHAT = 30
+/** Marks a persisted image whose bytes live in the `images` store. */
+const IMAGE_REF_PREFIX = 'wm-image:'
 
 interface ChatSchema extends IDBSchema {
 	chats: {
@@ -37,12 +46,46 @@ interface ChatSchema extends IDBSchema {
 			backgroundJobs?: ChatJob[]
 		}
 	}
+	// Image bytes, out-of-band from the chat record on purpose: the record is
+	// re-cloned into IndexedDB on every saveChat, while a blob is written once
+	// and read again only when its chat is reloaded. The persisted message
+	// arrays carry `wm-image:<id>` refs in place of the data URLs; swapping
+	// happens entirely inside this class (dehydrate on save, hydrate on load),
+	// so live chat state never sees a ref.
+	images: {
+		key: string
+		value: {
+			id: string
+			chatId: string
+			dataUrl: string
+			savedAt: number
+		}
+		indexes: { 'by-chat': [string, number] }
+	}
 }
 
 function createChatStore(db: IDBPDatabase<ChatSchema>): void {
 	if (!db.objectStoreNames.contains('chats')) {
 		db.createObjectStore('chats', { keyPath: 'id' })
 	}
+	// v2 briefly kept full-resolution tool screenshots in their own store; the
+	// general blob store below covers them now.
+	if ((db.objectStoreNames as DOMStringList).contains('toolImages')) {
+		db.deleteObjectStore('toolImages' as never)
+	}
+	if (!db.objectStoreNames.contains('images')) {
+		const store = db.createObjectStore('images', { keyPath: 'id' })
+		store.createIndex('by-chat', ['chatId', 'savedAt'])
+	}
+}
+
+/** All image-blob primary keys owned by a chat (via the [chatId, savedAt] index). */
+function imageKeysForChat(db: IDBPDatabase<ChatSchema>, chatId: string) {
+	return db.getAllKeysFromIndex(
+		'images',
+		'by-chat',
+		IDBKeyRange.bound([chatId, -Infinity], [chatId, Infinity])
+	)
 }
 
 // Shared across all HistoryManager instances. Each instance owns its own
@@ -97,7 +140,7 @@ export function __resetLegacyChatClaimForTesting(): void {
 // the `get` is O(1) on the `id` keyPath.
 export async function readChatModifiedItems(chatId: string): Promise<string[] | undefined> {
 	const dbh = userScopedDb<ChatSchema>(DB_NAME, {
-		version: 1,
+		version: DB_VERSION,
 		upgrade: createChatStore,
 		migrate: migrateLegacyChatDb
 	})
@@ -118,7 +161,7 @@ export default class HistoryManager {
 	// HistoryManager per AIChatManager (the singleton + one per session runtime),
 	// so the handle must be per-instance — not a module singleton.
 	private dbh = userScopedDb<ChatSchema>(DB_NAME, {
-		version: 1,
+		version: DB_VERSION,
 		upgrade: createChatStore,
 		migrate: migrateLegacyChatDb
 	})
@@ -145,6 +188,55 @@ export default class HistoryManager {
 	// session-tagged chats are excluded from history.
 	private sessionId: string | undefined = $state(undefined)
 
+	// chatId+dataUrl → stable blob id, so every save of the same conversation
+	// maps an image to the record written the first time (write-once) instead of
+	// minting a new one per save. Hydration seeds it back, so a reloaded chat
+	// re-saves under its original ids too. Scoped by chat: each blob record has
+	// exactly one owning chat, so the same image pasted into two chats becomes
+	// two records — sharing one would let chat A's deletion or cap eviction
+	// destroy bytes chat B still references.
+	private imageIdByUrl = new Map<string, string>()
+
+	private imageIdKey(chatId: string, dataUrl: string): string {
+		return chatId + '\n' + dataUrl
+	}
+
+	// Blob writes, stale-blob deletes, and the record put span several IndexedDB
+	// transactions, and saveChat has concurrent callers (turn saves, the
+	// modified-items and background-jobs writers). Interleaved, an older save's
+	// delete pass can remove a blob a newer save just verified, landing the
+	// newer record with a dangling ref — so every DB write runs through this
+	// per-manager queue. A failed write is rethrown to its caller without
+	// wedging the queue.
+	private dbWriteQueue: Promise<unknown> = Promise.resolve()
+
+	private enqueueDbWrite<T>(op: (db: IDBPDatabase<ChatSchema>) => Promise<T>): Promise<T | void> {
+		// A write belongs to the user who initiated it: capture the scoped DB name
+		// now and skip execution if the logged-in user changed while queued —
+		// resolving the handle only at execution time would write this user's chat
+		// into the NEXT user's database on an in-place account switch.
+		const name = scopedKey(DB_NAME)
+		const exec = async () => {
+			if (!name || scopedKey(DB_NAME) !== name) return
+			const db = await this.dbh.whenReady()
+			if (!db || db.name !== name) return
+			return op(db)
+		}
+		const run = this.dbWriteQueue.then(exec, exec)
+		this.dbWriteQueue = run.catch(() => {})
+		return run
+	}
+
+	/** Drop cached blob ids of every chat but the given one, so the map doesn't
+	 *  pin past chats' data URL strings in memory for the whole session (a
+	 *  reopened chat re-seeds its ids through hydration). */
+	private pruneImageIds(keepChatId: string) {
+		const prefix = keepChatId + '\n'
+		for (const key of this.imageIdByUrl.keys()) {
+			if (!key.startsWith(prefix)) this.imageIdByUrl.delete(key)
+		}
+	}
+
 	private pastChats = $derived(
 		Object.values(this.savedChats)
 			.filter((c) => c.id !== this.currentChatId)
@@ -153,6 +245,9 @@ export default class HistoryManager {
 	)
 
 	async init() {
+		// (Re)initializing adopts a new identity's history: drop the previous
+		// identity's cached blob ids with it.
+		this.imageIdByUrl.clear()
 		// whenReady() is email-gated (returns undefined before the user is known —
 		// all callers run post-login, and the singleton re-inits via onUserChange),
 		// runs the legacy migration once, and reopens automatically on user change.
@@ -194,10 +289,7 @@ export default class HistoryManager {
 		const snapshot = $state.snapshot(existing)
 		const updated = { ...snapshot, sessionId }
 		this.savedChats = { ...this.savedChats, [chatId]: updated }
-		// Resolve the DB via the handle (not a cached ref) so a write always lands
-		// in the current user's DB, even after an in-place user switch.
-		const db = await this.dbh.whenReady()
-		if (db) await db.put('chats', updated)
+		await this.enqueueDbWrite((db) => db.put('chats', updated))
 	}
 
 	getPastChats() {
@@ -216,6 +308,168 @@ export default class HistoryManager {
 		return this.savedChats[id]?.backgroundJobs
 	}
 
+	/**
+	 * Swap every inline image (data URL) in the given message arrays for a
+	 * `wm-image:<id>` ref, mutating them in place — callers pass a clone bound
+	 * for IndexedDB, never live chat state or the in-memory savedChats mirror.
+	 * Returns the id → dataUrl map of every image the arrays reference, plus
+	 * every reference (pre-existing refs included) in walk order —
+	 * persistImageBlobs ranks ids by their newest reference, so the transcript
+	 * walks FIRST: it is always whole and chronological, while drop-oldest
+	 * compaction removes old API messages, which would misorder a dropped
+	 * message's still-displayed image.
+	 */
+	private dehydrateImages(
+		chatId: string,
+		actualMessages: ChatCompletionMessageParam[],
+		displayMessages: DisplayMessage[]
+	): { blobs: Map<string, string>; refs: string[] } {
+		const blobs = new Map<string, string>()
+		const refs: string[] = []
+		const refFor = (url: string): string => {
+			// Already a ref (a record that was never rehydrated): it still counts
+			// as a reference — omitting it would let the stale-delete pass reclaim
+			// its blob — but there are no bytes to (re)write.
+			if (url.startsWith(IMAGE_REF_PREFIX)) {
+				refs.push(url.slice(IMAGE_REF_PREFIX.length))
+				return url
+			}
+			const key = this.imageIdKey(chatId, url)
+			let id = this.imageIdByUrl.get(key)
+			if (!id) {
+				id = randomUUID()
+				this.imageIdByUrl.set(key, id)
+			}
+			blobs.set(id, url)
+			refs.push(id)
+			return IMAGE_REF_PREFIX + id
+		}
+		for (const message of displayMessages) {
+			if (message.role === 'user' && message.images) {
+				for (const image of message.images) {
+					if (image.dataUrl.startsWith('data:') || image.dataUrl.startsWith(IMAGE_REF_PREFIX)) {
+						image.dataUrl = refFor(image.dataUrl)
+					}
+				}
+			} else if (
+				message.role === 'tool' &&
+				(message.imageUrl?.startsWith('data:') || message.imageUrl?.startsWith(IMAGE_REF_PREFIX))
+			) {
+				message.imageUrl = refFor(message.imageUrl)
+			}
+		}
+		for (const message of actualMessages) {
+			if (!Array.isArray(message.content)) continue
+			for (const part of message.content as any[]) {
+				if (
+					part?.type === 'image_url' &&
+					(part.image_url?.url?.startsWith('data:') ||
+						part.image_url?.url?.startsWith(IMAGE_REF_PREFIX))
+				) {
+					part.image_url.url = refFor(part.image_url.url)
+				}
+			}
+		}
+		return { blobs, refs }
+	}
+
+	/**
+	 * The record's newest MAX_IMAGES_PER_CHAT distinct images, ranked by their
+	 * LAST reference — the exact set of blobs the chat should own once the
+	 * record is committed. The saved record is the single source of truth:
+	 * deriving the set from it (rather than from persisted write times) keeps
+	 * eviction deterministic and idempotent when turns are truncated, identical
+	 * bytes are re-attached, or compaction rewrites the arrays. A ref outside
+	 * the kept set hydrates to the omitted-image placeholder.
+	 */
+	private keptImageIds(refs: string[]): Set<string> {
+		const keep = new Set<string>()
+		for (let i = refs.length - 1; i >= 0 && keep.size < MAX_IMAGES_PER_CHAT; i--) {
+			keep.add(refs[i])
+		}
+		return keep
+	}
+
+	private async writeKeptImageBlobs(
+		db: IDBPDatabase<ChatSchema>,
+		chatId: string,
+		blobs: Map<string, string>,
+		keep: Set<string>
+	) {
+		for (const id of keep) {
+			const dataUrl = blobs.get(id)
+			if (dataUrl !== undefined && (await db.getKey('images', id)) === undefined) {
+				await db.put('images', { id, chatId, dataUrl, savedAt: Date.now() })
+			}
+		}
+	}
+
+	private async deleteStaleImageBlobs(
+		db: IDBPDatabase<ChatSchema>,
+		chatId: string,
+		keep: Set<string>
+	) {
+		for (const key of await imageKeysForChat(db, chatId)) {
+			if (!keep.has(key)) await db.delete('images', key)
+		}
+	}
+
+	/**
+	 * Resolve every `wm-image:` ref in the chat clone back to its data URL,
+	 * in place. A missing blob (evicted by the per-chat cap, or IndexedDB
+	 * unavailable altogether) degrades the API part to the omitted-image
+	 * placeholder and drops the transcript copy — a ref must never leak into
+	 * bubbles or outgoing requests. Inline data URLs (records persisted before
+	 * the blob store) pass through untouched.
+	 */
+	private async hydrateImages(
+		db: IDBPDatabase<ChatSchema> | undefined,
+		chatId: string,
+		actualMessages: ChatCompletionMessageParam[],
+		displayMessages: DisplayMessage[]
+	) {
+		const load = async (ref: string): Promise<string | undefined> => {
+			const id = ref.slice(IMAGE_REF_PREFIX.length)
+			const dataUrl = (await db?.get('images', id))?.dataUrl
+			if (dataUrl) this.imageIdByUrl.set(this.imageIdKey(chatId, dataUrl), id)
+			return dataUrl
+		}
+		for (const message of actualMessages) {
+			if (!Array.isArray(message.content)) continue
+			const content = message.content as any[]
+			for (let i = 0; i < content.length; i++) {
+				const part = content[i]
+				if (part?.type === 'image_url' && part.image_url?.url?.startsWith(IMAGE_REF_PREFIX)) {
+					const dataUrl = await load(part.image_url.url)
+					content[i] = dataUrl
+						? { ...part, image_url: { ...part.image_url, url: dataUrl } }
+						: { type: 'text', text: IMAGE_OMITTED_PLACEHOLDER }
+				}
+			}
+		}
+		for (const message of displayMessages) {
+			if (message.role === 'user' && message.images) {
+				const images: AttachedImage[] = []
+				for (const image of message.images) {
+					if (!image.dataUrl.startsWith(IMAGE_REF_PREFIX)) {
+						images.push(image)
+						continue
+					}
+					const dataUrl = await load(image.dataUrl)
+					if (dataUrl) images.push({ ...image, dataUrl })
+				}
+				message.images = images.length > 0 ? images : undefined
+				// An image-only bubble that lost every image would render empty —
+				// say what happened instead.
+				if (!message.images && !message.content.trim()) {
+					message.content = IMAGE_OMITTED_PLACEHOLDER
+				}
+			} else if (message.role === 'tool' && message.imageUrl?.startsWith(IMAGE_REF_PREFIX)) {
+				message.imageUrl = await load(message.imageUrl)
+			}
+		}
+	}
+
 	async saveChat(
 		displayMessages: DisplayMessage[],
 		messages: ChatCompletionMessageParam[],
@@ -231,12 +485,22 @@ export default class HistoryManager {
 			// expanding collapsed-paste tokens so it reads as text rather than the
 			// chip label + its zero-width id chars.
 			const existingTitle = this.savedChats[this.currentChatId]?.title
+			const titleSource = displayMessages.find((m) => m.role !== 'summary') ?? displayMessages[0]
+			const derivedTitle = expanded(messageDraft(titleSource)).slice(0, 50)
+			// An image-only first turn has no text to derive from — fall back to the
+			// attachment's filename so the History menu entry isn't blank.
+			const imageFallback =
+				titleSource.role === 'user' && titleSource.images?.length
+					? (titleSource.images[0].name ?? 'Image attachment')
+					: ''
+			// A hydrated omission marker is not user text — deriving from it would
+			// overwrite the filename title an evicted image-only chat was given.
 			const title =
 				displayMessages[0].role === 'summary' && existingTitle !== undefined
 					? existingTitle
-					: expanded(
-							messageDraft(displayMessages.find((m) => m.role !== 'summary') ?? displayMessages[0])
-						).slice(0, 50)
+					: derivedTitle.trim() && derivedTitle !== IMAGE_OMITTED_PLACEHOLDER
+						? derivedTitle
+						: imageFallback || existingTitle || ''
 			// we don't want to save the snapshot in the history
 			const updatedChat = {
 				actualMessages: $state.snapshot(messages),
@@ -273,13 +537,38 @@ export default class HistoryManager {
 							}
 						: {})
 			}
+			// The mirror mirrors what the DB holds (refs — the snapshot is
+			// dehydrated below before either sees it): a reopened chat hydrates
+			// through the store, reseeding stable blob ids. When IndexedDB is
+			// unavailable the writes no-op and hydration degrades the refs to
+			// omitted-image placeholders — like every other userScopedDb consumer,
+			// history simply doesn't persist there.
+			const { blobs, refs } = this.dehydrateImages(
+				updatedChat.id,
+				updatedChat.actualMessages,
+				updatedChat.displayMessages
+			)
 			this.savedChats = {
 				...this.savedChats,
 				[updatedChat.id]: updatedChat
 			}
-
-			const db = await this.dbh.whenReady()
-			if (db) await db.put('chats', updatedChat)
+			await this.enqueueDbWrite(async (db) => {
+				// Write order is the crash-safety story: kept blobs land before the
+				// record that references them, and stale blobs are deleted only after
+				// the new record is committed. A failure at any step leaves the last
+				// committed record fully hydratable — at worst orphan blobs linger
+				// until the next successful save's delete pass reclaims them.
+				const keep = this.keptImageIds(refs)
+				await this.writeKeptImageBlobs(db, updatedChat.id, blobs, keep)
+				await db.put('chats', updatedChat)
+				// Best-effort: the record is already committed, so a failed cleanup
+				// (e.g. a user switch closed this handle mid-op) must not turn a
+				// successful save into a rejection — the orphans are reclaimed by
+				// the next successful save's pass.
+				await this.deleteStaleImageBlobs(db, updatedChat.id, keep).catch((err) =>
+					console.error('Could not prune stale image blobs', err)
+				)
+			})
 		}
 	}
 
@@ -292,20 +581,32 @@ export default class HistoryManager {
 	) {
 		await this.saveChat(displayMessages, messages, contextUsage, modifiedItems, backgroundJobs)
 		this.currentChatId = createLongHash()
+		this.pruneImageIds(this.currentChatId)
 	}
 
 	deletePastChat(id: string) {
 		this.savedChats = Object.fromEntries(
 			Object.entries(this.savedChats).filter(([key]) => key !== id)
 		)
-		void this.dbh.whenReady().then((db) => db?.delete('chats', id))
+		void this.enqueueDbWrite(async (db) => {
+			await db.delete('chats', id)
+			const keys = await imageKeysForChat(db, id)
+			await Promise.all(keys.map((key) => db.delete('images', key)))
+		}).catch((err) => console.error('Could not delete chat', err))
 	}
 
-	loadPastChat(id: string) {
+	async loadPastChat(id: string) {
 		const chat = this.savedChats[id]
-		if (chat) {
-			this.currentChatId = id
-			return chat
-		}
+		if (!chat) return
+		this.currentChatId = id
+		this.pruneImageIds(id)
+		// Hand back a hydrated clone: the stored record keeps its refs (matching
+		// what the DB holds) while the live chat gets real data URLs. Hydration
+		// runs even without a DB so refs degrade to placeholders instead of
+		// leaking into bubbles and requests.
+		const snapshot = $state.snapshot(chat) as typeof chat
+		const db = await this.dbh.whenReady()
+		await this.hydrateImages(db, id, snapshot.actualMessages, snapshot.displayMessages)
+		return snapshot
 	}
 }
diff --git a/frontend/src/lib/components/copilot/chat/HistoryManager.test.ts b/frontend/src/lib/components/copilot/chat/HistoryManager.test.ts
index 540dfaf72e..ffcc065157 100644
--- a/frontend/src/lib/components/copilot/chat/HistoryManager.test.ts
+++ b/frontend/src/lib/components/copilot/chat/HistoryManager.test.ts
@@ -90,6 +90,449 @@ describe('HistoryManager legacy chat-history migration', () => {
 		expect(hm.getAllSavedChats()).toEqual([])
 	})
 
+	it('persists image bytes out of the chat record and hydrates them back on load', async () => {
+		const png = 'data:image/png;base64,FULLBYTES'
+		const hm = new HistoryManager()
+		await hm.init()
+		const chatId = hm.getCurrentChatId()
+		await hm.saveChat(
+			[
+				{ role: 'user', content: 'look', images: [{ dataUrl: png, mediaType: 'image/png' }] },
+				{ role: 'tool', tool_call_id: 't1', content: 'shot', imageUrl: png }
+			] as DisplayMessage[],
+			[
+				{
+					role: 'user',
+					content: [
+						{ type: 'text', text: 'look' },
+						{ type: 'image_url', image_url: { url: png } }
+					]
+				}
+			] as ChatCompletionMessageParam[]
+		)
+
+		// The chat record holds refs, not bytes — and the shared data URL of the
+		// bubble, tool card, and API part dedups to a single blob record.
+		const db = await openDB('copilot-chat-history::admin@test')
+		const record = await db.get('chats' as never, chatId)
+		expect(JSON.stringify(record)).not.toContain('FULLBYTES')
+		expect((record as any).actualMessages[0].content[1].image_url.url).toMatch(/^wm-image:/)
+		expect(await db.count('images' as never)).toBe(1)
+		db.close()
+
+		// A fresh instance (reload) hydrates the refs back to the original bytes.
+		const reloaded = new HistoryManager()
+		await reloaded.init()
+		const chat = await reloaded.loadPastChat(chatId)
+		expect((chat?.actualMessages[0].content as any[])[1].image_url.url).toBe(png)
+		expect((chat?.displayMessages[0] as any).images[0].dataUrl).toBe(png)
+		expect((chat?.displayMessages[1] as any).imageUrl).toBe(png)
+	})
+
+	it('re-saving the same conversation does not mint new blob records', async () => {
+		const png = 'data:image/png;base64,STABLE'
+		const display = [
+			{ role: 'user', content: 'x', images: [{ dataUrl: png, mediaType: 'image/png' }] }
+		] as DisplayMessage[]
+		const hm = new HistoryManager()
+		await hm.init()
+		await hm.saveChat(display, [] as ChatCompletionMessageParam[])
+		await hm.saveChat(display, [] as ChatCompletionMessageParam[])
+
+		const db = await openDB('copilot-chat-history::admin@test')
+		expect(await db.count('images' as never)).toBe(1)
+		db.close()
+	})
+
+	it('caps stored blobs per chat; an evicted ref hydrates to the omitted placeholder', async () => {
+		const hm = new HistoryManager()
+		await hm.init()
+		const chatId = hm.getCurrentChatId()
+		const urlFor = (i: number) => `data:image/png;base64,IMG${String(i).padStart(2, '0')}`
+		const messages = [] as ChatCompletionMessageParam[]
+		for (let i = 0; i <= 30; i++) {
+			messages.push({
+				role: 'user',
+				content: [{ type: 'image_url', image_url: { url: urlFor(i) } }]
+			} as ChatCompletionMessageParam)
+			await hm.saveChat([{ role: 'user', content: 'x' }] as DisplayMessage[], messages)
+		}
+		// Re-saving the over-cap chat must not resurrect the evicted oldest blob
+		// (its live data URL is still in the arrays): a re-put would stamp it
+		// newest and push the eviction onto a newer image, and repeated saves
+		// would rotate the hole toward the latest attachment.
+		await hm.saveChat([{ role: 'user', content: 'x' }] as DisplayMessage[], messages)
+		await hm.saveChat([{ role: 'user', content: 'x' }] as DisplayMessage[], messages)
+
+		const reloaded = new HistoryManager()
+		await reloaded.init()
+		const chat = await reloaded.loadPastChat(chatId)
+		expect((chat?.actualMessages[0].content as any[])[0]).toEqual({
+			type: 'text',
+			text: '[image omitted]'
+		})
+		expect((chat?.actualMessages[1].content as any[])[0].image_url.url).toBe(urlFor(1))
+		expect((chat?.actualMessages[30].content as any[])[0].image_url.url).toBe(urlFor(30))
+	})
+
+	it('keeps blob chronology when drop-oldest compaction removed old API counterparts', async () => {
+		const hm = new HistoryManager()
+		await hm.init()
+		const chatId = hm.getCurrentChatId()
+		const urlFor = (i: number) => `data:image/png;base64,IMG${String(i).padStart(2, '0')}`
+		// Transcript keeps all 31 bubbles; drop-oldest compaction pruned the API
+		// history down to the newest 4 image messages.
+		const display = Array.from({ length: 31 }, (_, i) => ({
+			role: 'user',
+			content: 'x',
+			index: i - 27,
+			images: [{ dataUrl: urlFor(i), mediaType: 'image/png' }]
+		})) as DisplayMessage[]
+		const messages = Array.from({ length: 4 }, (_, i) => ({
+			role: 'user',
+			content: [{ type: 'image_url', image_url: { url: urlFor(27 + i) } }]
+		})) as ChatCompletionMessageParam[]
+		await hm.saveChat(display, messages)
+		await hm.saveChat(display, messages)
+
+		const reloaded = new HistoryManager()
+		await reloaded.init()
+		const chat = await reloaded.loadPastChat(chatId)
+		// The oldest transcript image is the one over the cap...
+		expect((chat?.displayMessages[0] as any).images).toBeUndefined()
+		// ...never a newer one that merely lost its API counterpart ordering.
+		expect((chat?.actualMessages[0].content as any[])[0].image_url.url).toBe(urlFor(27))
+		expect((chat?.displayMessages[30] as any).images[0].dataUrl).toBe(urlFor(30))
+	})
+
+	it('truncated turns release their blobs from the cap', async () => {
+		const hm = new HistoryManager()
+		await hm.init()
+		const chatId = hm.getCurrentChatId()
+		const urlFor = (i: number) => `data:image/png;base64,IMG${String(i).padStart(2, '0')}`
+		const imageMsg = (i: number) =>
+			({
+				role: 'user',
+				content: [{ type: 'image_url', image_url: { url: urlFor(i) } }]
+			}) as ChatCompletionMessageParam
+		const display = [{ role: 'user', content: 'x' }] as DisplayMessage[]
+		// Fill the cap exactly, then retry/edit truncates the tail to 5 messages
+		// and adds one replacement image. The truncated turns' blobs must stop
+		// counting against the cap — image 0 is among the newest 6 *referenced*
+		// images and must survive.
+		await hm.saveChat(
+			display,
+			Array.from({ length: 30 }, (_, i) => imageMsg(i))
+		)
+		await hm.saveChat(display, [...Array.from({ length: 5 }, (_, i) => imageMsg(i)), imageMsg(99)])
+
+		const db = await openDB('copilot-chat-history::admin@test')
+		expect(await db.count('images' as never)).toBe(6)
+		db.close()
+
+		const reloaded = new HistoryManager()
+		await reloaded.init()
+		const chat = await reloaded.loadPastChat(chatId)
+		expect((chat?.actualMessages[0].content as any[])[0].image_url.url).toBe(urlFor(0))
+		expect((chat?.actualMessages[5].content as any[])[0].image_url.url).toBe(urlFor(99))
+	})
+
+	it('re-attaching identical bytes ranks the image by its newest reference', async () => {
+		const hm = new HistoryManager()
+		await hm.init()
+		const chatId = hm.getCurrentChatId()
+		const urlFor = (i: number) => `data:image/png;base64,IMG${String(i).padStart(2, '0')}`
+		const imageMsg = (url: string) =>
+			({
+				role: 'user',
+				content: [{ type: 'image_url', image_url: { url } }]
+			}) as ChatCompletionMessageParam
+		const display = [{ role: 'user', content: 'x' }] as DisplayMessage[]
+		const reused = 'data:image/png;base64,REUSED'
+		// The reused image appears first, 30 distinct images follow, then it is
+		// attached again. Its newest reference makes it one of the newest 30
+		// distinct images, so the eviction must land on the oldest of the middle
+		// ones — not on the image the user just re-attached.
+		const messages = [
+			imageMsg(reused),
+			...Array.from({ length: 30 }, (_, i) => imageMsg(urlFor(i))),
+			imageMsg(reused)
+		]
+		await hm.saveChat(display, [messages[0]])
+		await hm.saveChat(display, messages)
+
+		const reloaded = new HistoryManager()
+		await reloaded.init()
+		const chat = await reloaded.loadPastChat(chatId)
+		expect((chat?.actualMessages[0].content as any[])[0].image_url.url).toBe(reused)
+		expect((chat?.actualMessages[31].content as any[])[0].image_url.url).toBe(reused)
+		expect((chat?.actualMessages[1].content as any[])[0]).toEqual({
+			type: 'text',
+			text: '[image omitted]'
+		})
+		expect((chat?.actualMessages[2].content as any[])[0].image_url.url).toBe(urlFor(1))
+	})
+
+	it('a save overlapping an older save keeps every blob its record references', async () => {
+		const hm = new HistoryManager()
+		await hm.init()
+		const chatId = hm.getCurrentChatId()
+		const X = 'data:image/png;base64,XBYTES'
+		const Y = 'data:image/png;base64,YBYTES'
+		const display = [{ role: 'user', content: 'x' }] as DisplayMessage[]
+		const msg = (url: string) =>
+			({
+				role: 'user',
+				content: [{ type: 'image_url', image_url: { url } }]
+			}) as ChatCompletionMessageParam
+		await hm.saveChat(display, [msg(X)])
+
+		// An overlapping pair: the older snapshot no longer references X (retry
+		// truncation), the newer one re-references it (as its newest image) and
+		// adds Y. Un-serialized, the older save's delete pass removes X's blob
+		// after the newer save verified its existence and moved on, landing the
+		// winning record with a dangling ref.
+		const older = hm.saveChat(display, [
+			{ role: 'user', content: 'no images' } as ChatCompletionMessageParam
+		])
+		const newer = hm.saveChat(display, [msg(Y), msg(X)])
+		await Promise.all([older, newer])
+
+		const reloaded = new HistoryManager()
+		await reloaded.init()
+		const chat = await reloaded.loadPastChat(chatId)
+		expect((chat?.actualMessages[0].content as any[])[0].image_url.url).toBe(Y)
+		expect((chat?.actualMessages[1].content as any[])[0].image_url.url).toBe(X)
+	})
+
+	it('reopening a rotated chat reuses its blob records on the next save', async () => {
+		const hm = new HistoryManager()
+		await hm.init()
+		const chatId = hm.getCurrentChatId()
+		const png = 'data:image/png;base64,STABLEBYTES'
+		await hm.save(
+			[
+				{ role: 'user', content: 'x', images: [{ dataUrl: png, mediaType: 'image/png' }] }
+			] as DisplayMessage[],
+			[] as ChatCompletionMessageParam[]
+		) // rotates to a fresh chat, pruning the id cache
+
+		const before = await openDB('copilot-chat-history::admin@test')
+		const idsBefore = await before.getAllKeys('images' as never)
+		before.close()
+
+		// Reopening must reseed the stable blob id — a re-save that minted a new
+		// id would rewrite every blob (and delete the old ones) on each reopen.
+		const chat = await hm.loadPastChat(chatId)
+		await hm.saveChat(chat!.displayMessages as DisplayMessage[], chat!.actualMessages)
+
+		const after = await openDB('copilot-chat-history::admin@test')
+		const idsAfter = await after.getAllKeys('images' as never)
+		after.close()
+		expect(idsAfter).toEqual(idsBefore)
+	})
+
+	it('the same image in two chats gets two owned blobs; deleting one chat spares the other', async () => {
+		const png = 'data:image/png;base64,SHAREDBYTES'
+		const display = [
+			{ role: 'user', content: 'x', images: [{ dataUrl: png, mediaType: 'image/png' }] }
+		] as DisplayMessage[]
+		const hm = new HistoryManager()
+		await hm.init()
+		const chatA = hm.getCurrentChatId()
+		await hm.save(display, [] as ChatCompletionMessageParam[]) // rotates to a new chat
+		const chatB = hm.getCurrentChatId()
+		await hm.saveChat(display, [] as ChatCompletionMessageParam[])
+
+		const db = await openDB('copilot-chat-history::admin@test')
+		expect(await db.count('images' as never)).toBe(2)
+		db.close()
+
+		hm.deletePastChat(chatA)
+		await vi.waitFor(async () => {
+			const d = await openDB('copilot-chat-history::admin@test')
+			const count = await d.count('images' as never)
+			d.close()
+			expect(count).toBe(1)
+		})
+
+		const reloaded = new HistoryManager()
+		await reloaded.init()
+		const chat = await reloaded.loadPastChat(chatB)
+		expect((chat?.displayMessages[0] as any).images[0].dataUrl).toBe(png)
+	})
+
+	it("deletes a chat's image blobs along with the chat", async () => {
+		const hm = new HistoryManager()
+		await hm.init()
+		const chatId = hm.getCurrentChatId()
+		await hm.saveChat(
+			[
+				{
+					role: 'user',
+					content: 'x',
+					images: [{ dataUrl: 'data:image/png;base64,GONE', mediaType: 'image/png' }]
+				}
+			] as DisplayMessage[],
+			[] as ChatCompletionMessageParam[]
+		)
+
+		hm.deletePastChat(chatId)
+
+		await vi.waitFor(async () => {
+			const db = await openDB('copilot-chat-history::admin@test')
+			const count = await db.count('images' as never)
+			db.close()
+			expect(count).toBe(0)
+		})
+	})
+
+	it('loads pre-blob-store records with inline data URLs untouched', async () => {
+		const png = 'data:image/png;base64,LEGACYINLINE'
+		const hm = new HistoryManager()
+		await hm.init()
+		// Simulate a record persisted before the blob store existed.
+		const db = await openDB('copilot-chat-history::admin@test')
+		await db.put(
+			'chats' as never,
+			{
+				id: 'legacy1',
+				title: 'legacy',
+				lastModified: 1,
+				actualMessages: [
+					{ role: 'user', content: [{ type: 'image_url', image_url: { url: png } }] }
+				],
+				displayMessages: [
+					{ role: 'user', content: 'x', images: [{ dataUrl: png, mediaType: 'image/png' }] }
+				]
+			} as never
+		)
+		db.close()
+
+		const reloaded = new HistoryManager()
+		await reloaded.init()
+		const chat = await reloaded.loadPastChat('legacy1')
+		expect((chat?.actualMessages[0].content as any[])[0].image_url.url).toBe(png)
+		expect((chat?.displayMessages[0] as any).images[0].dataUrl).toBe(png)
+	})
+
+	it("a failed record put cannot orphan the previous record's blobs", async () => {
+		const png = 'data:image/png;base64,SURVIVES'
+		const hm = new HistoryManager()
+		await hm.init()
+		const chatId = hm.getCurrentChatId()
+		await hm.saveChat(
+			[
+				{ role: 'user', content: 'x', images: [{ dataUrl: png, mediaType: 'image/png' }] }
+			] as DisplayMessage[],
+			[] as ChatCompletionMessageParam[]
+		)
+
+		// Make the next `chats` put fail (quota/connection failure), on a save
+		// whose record drops the image — its blob is now stale, but deleting it
+		// before the record commit would corrupt the still-current OLD record.
+		const probe = await openDB('probe-proto', 1, {
+			upgrade: (d) => {
+				d.createObjectStore('s')
+			}
+		})
+		const proto = Object.getPrototypeOf(
+			probe.transaction('s' as never, 'readwrite').objectStore('s' as never)
+		)
+		probe.close()
+		const origPut = proto.put
+		let failNext = true
+		proto.put = function (this: { name: string }, ...args: unknown[]) {
+			if (this.name === 'chats' && failNext) {
+				failNext = false
+				throw new Error('simulated quota failure')
+			}
+			return origPut.apply(this, args)
+		}
+		try {
+			await expect(
+				hm.saveChat(
+					[{ role: 'user', content: 'no image' }] as DisplayMessage[],
+					[] as ChatCompletionMessageParam[]
+				)
+			).rejects.toThrow('simulated quota failure')
+		} finally {
+			proto.put = origPut
+		}
+
+		const reloaded = new HistoryManager()
+		await reloaded.init()
+		const chat = await reloaded.loadPastChat(chatId)
+		expect((chat?.displayMessages[0] as any).images[0].dataUrl).toBe(png)
+	})
+
+	it('drops queued writes when the user switches before they execute (no cross-user leak)', async () => {
+		const hm = new HistoryManager()
+		await hm.init()
+		const display = [
+			{
+				role: 'user',
+				content: 'private to A',
+				images: [{ dataUrl: 'data:image/png;base64,LEAKBYTES', mediaType: 'image/png' }]
+			}
+		] as DisplayMessage[]
+		// Enqueue two writes under user A, then switch identity before either
+		// executes. Resolving the DB handle at execution time would write A's
+		// chat and image blob into B's database.
+		const first = hm.saveChat(display, [] as ChatCompletionMessageParam[])
+		const second = hm.saveChat(display, [] as ChatCompletionMessageParam[])
+		userStore.set(asUser('other@test'))
+		await Promise.all([first, second])
+
+		const db = await openDB('copilot-chat-history::other@test')
+		const chats = db.objectStoreNames.contains('chats') ? await db.count('chats' as never) : 0
+		const images = db.objectStoreNames.contains('images') ? await db.count('images' as never) : 0
+		db.close()
+		expect(chats).toBe(0)
+		expect(images).toBe(0)
+	})
+
+	it("a save finishing after another user's init cannot leak into their mirror", async () => {
+		const hm = new HistoryManager()
+		await hm.init()
+
+		// The save passes enqueueDbWrite's identity checks under user A; the
+		// account switches (and re-inits, as the platform does on user change)
+		// while its transaction is still running. The committed save must still
+		// resolve (the switch closes A's handle, failing only the best-effort
+		// cleanup tail) and its convergence must not merge A's record into B's
+		// freshly adopted mirror.
+		const probe = await openDB('probe-proto2', 1, {
+			upgrade: (d) => {
+				d.createObjectStore('s')
+			}
+		})
+		const proto = Object.getPrototypeOf(
+			probe.transaction('s' as never, 'readwrite').objectStore('s' as never)
+		)
+		probe.close()
+		const origPut = proto.put
+		let initDone: Promise<void> | undefined
+		proto.put = function (this: { name: string }, ...args: unknown[]) {
+			if (this.name === 'chats' && !initDone) {
+				userStore.set(asUser('other@test'))
+				initDone = hm.init()
+			}
+			return origPut.apply(this, args)
+		}
+		try {
+			await hm.saveChat(
+				[{ role: 'user', content: 'private to A' }] as DisplayMessage[],
+				[] as ChatCompletionMessageParam[]
+			)
+		} finally {
+			proto.put = origPut
+		}
+		await initDone
+
+		expect(hm.getAllSavedChats()).toEqual([])
+	})
+
 	it('writes land in the current user DB after an in-place user switch', async () => {
 		const hm = new HistoryManager()
 		await hm.init()
@@ -115,6 +558,119 @@ describe('HistoryManager legacy chat-history migration', () => {
 	})
 })
 
+describe('HistoryManager image-only chats', () => {
+	it('titles an image-only chat from its attachment instead of leaving it blank', async () => {
+		const hm = new HistoryManager()
+		await hm.init()
+		const id = hm.getCurrentChatId()
+		await hm.saveChat(
+			[
+				{
+					role: 'user',
+					content: '',
+					images: [
+						{ dataUrl: 'data:image/png;base64,A', mediaType: 'image/png', name: 'mockup.png' }
+					]
+				}
+			] as DisplayMessage[],
+			[] as ChatCompletionMessageParam[]
+		)
+		expect(hm.getAllSavedChats().find((c) => c.id === id)?.title).toBe('mockup.png')
+	})
+
+	it('keeps the filename title when the evicted bubble re-saves as an omission marker', async () => {
+		const hm = new HistoryManager()
+		await hm.init()
+		const id = hm.getCurrentChatId()
+		await hm.saveChat(
+			[
+				{
+					role: 'user',
+					content: '',
+					images: [
+						{ dataUrl: 'data:image/png;base64,A', mediaType: 'image/png', name: 'mockup.png' }
+					]
+				}
+			] as DisplayMessage[],
+			[] as ChatCompletionMessageParam[]
+		)
+		// Post-reload shape of an evicted image-only first bubble: the omission
+		// marker as content, images gone. Re-saving must not adopt the marker as
+		// the chat's title.
+		await hm.saveChat(
+			[
+				{ role: 'user', content: '[image omitted]' },
+				{ role: 'user', content: 'follow-up' }
+			] as DisplayMessage[],
+			[] as ChatCompletionMessageParam[]
+		)
+		expect(hm.getAllSavedChats().find((c) => c.id === id)?.title).toBe('mockup.png')
+	})
+
+	it('shows an omission marker when an evicted image-only bubble reloads', async () => {
+		const hm = new HistoryManager()
+		await hm.init()
+		const chatId = hm.getCurrentChatId()
+		const urlFor = (i: number) => `data:image/png;base64,IMG${String(i).padStart(2, '0')}`
+		// 31 image-only turns: the oldest exceeds the blob cap, so its bubble
+		// reloads with no image AND no text — it must say what happened instead
+		// of rendering empty.
+		const display = Array.from({ length: 31 }, (_, i) => ({
+			role: 'user',
+			content: '',
+			index: i,
+			images: [{ dataUrl: urlFor(i), mediaType: 'image/png' }]
+		})) as DisplayMessage[]
+		await hm.saveChat(display, [] as ChatCompletionMessageParam[])
+
+		const reloaded = new HistoryManager()
+		await reloaded.init()
+		const chat = await reloaded.loadPastChat(chatId)
+		expect((chat?.displayMessages[0] as any).images).toBeUndefined()
+		expect((chat?.displayMessages[0] as any).content).toBe('[image omitted]')
+		expect((chat?.displayMessages[1] as any).images[0].dataUrl).toBe(urlFor(1))
+		expect((chat?.displayMessages[1] as any).content).toBe('')
+	})
+})
+
+describe('HistoryManager without IndexedDB', () => {
+	it('degrades cleanly: refs never leak into bubbles or message content', async () => {
+		// whenReady() resolves undefined when opens fail (private browsing,
+		// blocked, corrupt). History then simply doesn't persist — like every
+		// other userScopedDb consumer — but a reloaded chat must degrade its
+		// unresolvable refs to omitted-image placeholders, never hand raw
+		// `wm-image:` URLs to an <img> or an outgoing request.
+		;(globalThis as any).indexedDB = {
+			open: () => {
+				throw new Error('blocked')
+			}
+		}
+		const hm = new HistoryManager()
+		await hm.init()
+		const chatId = hm.getCurrentChatId()
+		const png = 'data:image/png;base64,MEMORYONLY'
+		await hm.saveChat(
+			[
+				{ role: 'user', content: 'x', images: [{ dataUrl: png, mediaType: 'image/png' }] }
+			] as DisplayMessage[],
+			[
+				{
+					role: 'user',
+					content: [{ type: 'image_url', image_url: { url: png } }]
+				}
+			] as ChatCompletionMessageParam[]
+		)
+
+		const chat = await hm.loadPastChat(chatId)
+		expect((chat?.displayMessages[0] as any).images).toBeUndefined()
+		expect((chat?.actualMessages[0].content as any[])[0]).toEqual({
+			type: 'text',
+			text: '[image omitted]'
+		})
+		expect(JSON.stringify(chat)).not.toContain('wm-image:')
+	})
+})
+
 describe('HistoryManager title across compaction', () => {
 	it('keeps the original title once a summary boundary leads the transcript', async () => {
 		const hm = new HistoryManager()
@@ -142,6 +698,39 @@ describe('HistoryManager title across compaction', () => {
 	})
 })
 
+describe('HistoryManager mirror convergence under concurrent metadata saves', () => {
+	it('an older save completing mid-stream cannot erase newer metadata', async () => {
+		const hm = new HistoryManager()
+		await hm.init()
+		const id = hm.getCurrentChatId()
+		const display = [{ role: 'user', content: 'x', index: 0 }] as DisplayMessage[]
+		const job = { id: 'job1', status: 'running' } as unknown as ChatJob
+
+		// s1 carries modifiedItems; s2 (overlapping) carries backgroundJobs and
+		// inherits s1's modifiedItems from the mirror. Awaiting s1 lets its
+		// convergence run while s2 is still queued — it must not rewind the
+		// mirror, or s3's backgroundJobs fallback below reads the stale record
+		// and permanently erases the job.
+		const p1 = hm.saveChat(display, [] as ChatCompletionMessageParam[], undefined, ['script:a'])
+		const p2 = hm.saveChat(display, [] as ChatCompletionMessageParam[], undefined, undefined, [job])
+		await p1
+		const p3 = hm.saveChat(display, [] as ChatCompletionMessageParam[], undefined, [
+			'script:a',
+			'script:b'
+		])
+		await Promise.all([p2, p3])
+
+		expect(hm.getModifiedItems(id)).toEqual(['script:a', 'script:b'])
+		expect(hm.getBackgroundJobs(id)).toEqual([job])
+
+		const db = await openDB('copilot-chat-history::admin@test')
+		const record = (await db.get('chats' as never, id)) as any
+		db.close()
+		expect(record.modifiedItems).toEqual(['script:a', 'script:b'])
+		expect(record.backgroundJobs).toEqual([job])
+	})
+})
+
 describe('HistoryManager modified-items mask persistence', () => {
 	const msgs = [{ role: 'user', content: 'hello', index: 0 }] as DisplayMessage[]
 
diff --git a/frontend/src/lib/components/copilot/chat/QueuedMessageChip.svelte b/frontend/src/lib/components/copilot/chat/QueuedMessageChip.svelte
index 3d40225360..a6e6c248e6 100644
--- a/frontend/src/lib/components/copilot/chat/QueuedMessageChip.svelte
+++ b/frontend/src/lib/components/copilot/chat/QueuedMessageChip.svelte
@@ -11,15 +11,30 @@
 	const aiChatManager = getAiChatManager()
 </script>
 
-{#if aiChatManager.queuedMessage}
+<!-- Image-only queues have empty text; without the image row the queued draft
+     would be invisible — undismissable, then auto-sent as a surprise turn. -->
+{#if aiChatManager.queuedMessage || aiChatManager.queuedImages.length > 0}
 	<div
 		class="mb-1 flex flex-row items-start gap-1 rounded-md bg-surface-input px-3 py-2 opacity-60"
 		title={aiChatManager.queuedMessage}
 	>
 		<div class="min-w-0 grow">
-			<p class="text-xs text-secondary whitespace-pre-wrap line-clamp-2">
-				{aiChatManager.queuedMessage}
-			</p>
+			{#if aiChatManager.queuedImages.length > 0}
+				<div class="flex flex-row flex-wrap gap-1 {aiChatManager.queuedMessage ? 'mb-1' : ''}">
+					{#each aiChatManager.queuedImages as image, i (i)}
+						<img
+							src={image.dataUrl}
+							alt={image.name ?? 'queued image'}
+							class="h-6 w-6 object-cover rounded border border-border-light"
+						/>
+					{/each}
+				</div>
+			{/if}
+			{#if aiChatManager.queuedMessage}
+				<p class="text-xs text-secondary whitespace-pre-wrap line-clamp-2">
+					{aiChatManager.queuedMessage}
+				</p>
+			{/if}
 		</div>
 		<Button
 			variant="subtle"
diff --git a/frontend/src/lib/components/copilot/chat/ToolExecutionDisplay.svelte b/frontend/src/lib/components/copilot/chat/ToolExecutionDisplay.svelte
index cf0cf40fda..2a99ad0429 100644
--- a/frontend/src/lib/components/copilot/chat/ToolExecutionDisplay.svelte
+++ b/frontend/src/lib/components/copilot/chat/ToolExecutionDisplay.svelte
@@ -10,6 +10,7 @@
 	import ToolContentDisplay from './ToolContentDisplay.svelte'
 	import ToolMessageActions from './ToolMessageActions.svelte'
 	import AskUserQuestionDisplay from './AskUserQuestionDisplay.svelte'
+	import ExpandableImage from '$lib/components/common/image/ExpandableImage.svelte'
 
 	interface Props {
 		message: ToolDisplayMessage
@@ -82,6 +83,17 @@
 			</div>
 		</button>
 
+		<!-- Image a tool produced (e.g. take_screenshot) — shown inline, not gated on expand. -->
+		{#if message.imageUrl}
+			<div class="my-1">
+				<ExpandableImage
+					src={message.imageUrl}
+					alt="App preview screenshot"
+					class="max-h-48 max-w-full rounded border border-border-light"
+				/>
+			</div>
+		{/if}
+
 		<!-- Expanded Content -->
 		{#if isExpanded}
 			<div
diff --git a/frontend/src/lib/components/copilot/chat/anthropic.test.ts b/frontend/src/lib/components/copilot/chat/anthropic.test.ts
index 9c9a4d0bb0..1d2dad57b3 100644
--- a/frontend/src/lib/components/copilot/chat/anthropic.test.ts
+++ b/frontend/src/lib/components/copilot/chat/anthropic.test.ts
@@ -14,7 +14,8 @@ vi.mock('../reasoningRegistry', () => ({
 }))
 
 vi.mock('./shared', () => ({
-	processToolCall: vi.fn()
+	processToolCall: vi.fn(),
+	appendPendingToolImages: vi.fn()
 }))
 
 describe('convertOpenAIToAnthropicMessages', () => {
@@ -139,6 +140,42 @@ describe('convertOpenAIToAnthropicMessages', () => {
 		expect(content[1]).toMatchObject({ type: 'tool_use', id: 'tool_old', name: 'list_resources' })
 	})
 
+	it('converts a user message with an image_url part to an Anthropic base64 image block', () => {
+		const messages: ChatCompletionMessageParam[] = [
+			{
+				role: 'user',
+				content: [
+					{ type: 'text', text: 'what is this?' },
+					{ type: 'image_url', image_url: { url: 'data:image/png;base64,AAAABBBB' } }
+				]
+			} as any
+		]
+
+		const { messages: out } = convertOpenAIToAnthropicMessages(messages)
+
+		expect(out).toHaveLength(1)
+		expect(out[0].role).toBe('user')
+		const content = out[0].content as any[]
+		expect(content[0]).toMatchObject({ type: 'text', text: 'what is this?' })
+		expect(content[1]).toMatchObject({
+			type: 'image',
+			source: { type: 'base64', media_type: 'image/png', data: 'AAAABBBB' }
+		})
+		// The trailing block is the image — the ephemeral cache breakpoint may land on it
+		// (cache_control is valid on image blocks).
+		expect(content[1].cache_control).toEqual({ type: 'ephemeral' })
+	})
+
+	it('keeps a plain string user message unchanged (no array wrapping)', () => {
+		// Non-trailing so the last-block cache_control wrapping doesn't obscure it.
+		const messages: ChatCompletionMessageParam[] = [
+			{ role: 'user', content: 'just text' },
+			{ role: 'assistant', content: 'ok' }
+		]
+		const { messages: out } = convertOpenAIToAnthropicMessages(messages)
+		expect(out[0].content).toBe('just text')
+	})
+
 	it('caches a trailing tool result even when the prior turn used no captured content', () => {
 		const messages: ChatCompletionMessageParam[] = [
 			{ role: 'user', content: 'q' },
diff --git a/frontend/src/lib/components/copilot/chat/anthropic.ts b/frontend/src/lib/components/copilot/chat/anthropic.ts
index 2c19a611a0..209a3b7a83 100644
--- a/frontend/src/lib/components/copilot/chat/anthropic.ts
+++ b/frontend/src/lib/components/copilot/chat/anthropic.ts
@@ -16,8 +16,40 @@ import type { MessageStream } from '@anthropic-ai/sdk/lib/MessageStream'
 import type { AIProviderModel } from '$lib/gen'
 import { getProviderAndCompletionConfig, workspaceAIClients } from '../lib'
 import { applyReasoningToConfig } from '../reasoningRegistry'
-import { processToolCall, type Tool, type ToolCallbacks } from './shared'
+import { appendPendingToolImages, processToolCall, type Tool, type ToolCallbacks } from './shared'
 import { anthropicUsageToChatTokenUsage, type ChatTokenUsage } from './tokenUsage'
+import { parseImageDataUrl } from './imageUtils'
+
+const ANTHROPIC_IMAGE_MEDIA_TYPES = new Set(['image/jpeg', 'image/png', 'image/gif', 'image/webp'])
+
+/**
+ * Convert an OpenAI user-message content array (text + image_url parts) to Anthropic
+ * content blocks. Returns a plain string when the content is a lone text part so
+ * simple messages stay unchanged. Non-image/text parts are dropped.
+ */
+function openAIUserContentToAnthropic(content: unknown): string | any[] {
+	if (typeof content === 'string') return content
+	if (!Array.isArray(content)) return JSON.stringify(content)
+	const blocks: any[] = []
+	for (const part of content) {
+		if (part?.type === 'text' && typeof part.text === 'string') {
+			blocks.push({ type: 'text', text: part.text })
+		} else if (part?.type === 'image_url' && part.image_url?.url) {
+			const { mediaType, base64 } = parseImageDataUrl(part.image_url.url)
+			if (!base64) continue
+			blocks.push({
+				type: 'image',
+				source: {
+					type: 'base64',
+					media_type: ANTHROPIC_IMAGE_MEDIA_TYPES.has(mediaType) ? mediaType : 'image/png',
+					data: base64
+				}
+			})
+		}
+	}
+	if (blocks.length === 1 && blocks[0].type === 'text') return blocks[0].text
+	return blocks
+}
 
 interface ParsedCompletionResult {
 	shouldContinue: boolean
@@ -310,6 +342,7 @@ export async function parseAnthropicCompletion(
 			messages.push(messageToAdd)
 			addedMessages.push(messageToAdd)
 		}
+		appendPendingToolImages(messages, addedMessages, callbacks)
 		return { shouldContinue: true, tokenUsage }
 	}
 
@@ -367,8 +400,7 @@ export function convertOpenAIToAnthropicMessages(messages: ChatCompletionMessage
 		if (message.role === 'user') {
 			anthropicMessages.push({
 				role: 'user',
-				content:
-					typeof message.content === 'string' ? message.content : JSON.stringify(message.content)
+				content: openAIUserContentToAnthropic(message.content)
 			})
 		} else if (message.role === 'assistant') {
 			// Replay a captured assistant turn verbatim so its thinking-block signatures
@@ -443,8 +475,8 @@ export function convertOpenAIToAnthropicMessages(messages: ChatCompletionMessage
 	// block of the last message. Each continuation only appends a tool result plus the
 	// next turn, so everything up to here is read from cache — which is what keeps
 	// replaying assistant turns verbatim (web-search results included) affordable.
-	// cache_control is valid on text/tool_use/tool_result blocks, but a thinking or
-	// redacted_thinking block must never be modified, so skip the breakpoint there.
+	// cache_control is valid on text/tool_use/tool_result/image blocks, but a thinking
+	// or redacted_thinking block must never be modified, so skip the breakpoint there.
 	if (anthropicMessages.length > 0) {
 		const lastMessage = anthropicMessages[anthropicMessages.length - 1]
 		if (typeof lastMessage.content === 'string') {
diff --git a/frontend/src/lib/components/copilot/chat/chatLoop.test.ts b/frontend/src/lib/components/copilot/chat/chatLoop.test.ts
index b9581e3d74..b0bfa8b8ca 100644
--- a/frontend/src/lib/components/copilot/chat/chatLoop.test.ts
+++ b/frontend/src/lib/components/copilot/chat/chatLoop.test.ts
@@ -570,3 +570,108 @@ describe('runChatLoop history sanitization', () => {
 		expect((poisoned as any).tool_calls[0].function.arguments).toContain('trunc')
 	})
 })
+
+describe('runChatLoop per-iteration vision gating', () => {
+	beforeEach(() => {
+		vi.resetAllMocks()
+		mocks.providerSupportsWebSearch.mockReturnValue(false)
+		mocks.resolveRequestReasoning.mockReturnValue(undefined)
+	})
+
+	// The loop owns the vision strip entirely — the caller passes the full
+	// history even for a known text-only model (see AIChatManager.chatRequest).
+	it('strips image parts from the first iteration on a known text-only model', async () => {
+		const config = createConfig({
+			workspace: `workspace-${randomUUID()}`,
+			modelProvider: { provider: 'groq', model: 'llama-3.3-70b-versatile' }
+		})
+		config.messages.splice(0, config.messages.length, {
+			role: 'user',
+			content: [
+				{ type: 'text', text: 'earlier turn' },
+				{ type: 'image_url', image_url: { url: 'data:image/png;base64,IMG' } }
+			]
+		} as any)
+		mocks.getCompletion.mockResolvedValue({})
+		mocks.parseOpenAICompletion.mockResolvedValue({ shouldContinue: false, tokenUsage })
+
+		await runChatLoop(config)
+
+		expect(mocks.getCompletion).toHaveBeenCalled()
+		expect(JSON.stringify(mocks.getCompletion.mock.calls[0][0])).not.toContain('image_url')
+	})
+
+	// The model selector stays enabled while the loop runs, and the loop re-reads
+	// the model each iteration. The vision gate has to be re-applied at the same
+	// cadence: filtering once at send start would ship the history's image parts
+	// to a text-only model the user switched to mid-turn.
+	it('strips image parts when the model switches to a text-only one mid-loop', async () => {
+		const config = createConfig({ workspace: `workspace-${randomUUID()}` })
+		config.maxIterations = 2
+		config.messages.splice(0, config.messages.length, {
+			role: 'user',
+			content: [
+				{ type: 'text', text: 'look at this' },
+				{ type: 'image_url', image_url: { url: 'data:image/png;base64,IMG' } }
+			]
+		} as any)
+		// vision model on the first iteration, known text-only on the second
+		let iteration = 0
+		Object.defineProperty(config, 'modelProvider', {
+			get: () =>
+				iteration === 0
+					? { provider: 'openai', model: 'gpt-4.1' }
+					: { provider: 'groq', model: 'llama-3.3-70b-versatile' }
+		})
+		mocks.getOpenAIResponsesCompletion.mockResolvedValue({})
+		mocks.parseOpenAIResponsesCompletion.mockImplementation(async () => {
+			iteration++
+			return { shouldContinue: true, tokenUsage }
+		})
+		mocks.getCompletion.mockResolvedValue({})
+		mocks.parseOpenAICompletion.mockResolvedValue({ shouldContinue: false, tokenUsage })
+
+		await runChatLoop(config)
+
+		// the vision iteration carries the image...
+		const first = mocks.getOpenAIResponsesCompletion.mock.calls[0][0]
+		expect(JSON.stringify(first)).toContain('image_url')
+		// ...the text-only iteration must not
+		expect(mocks.getCompletion).toHaveBeenCalled()
+		const second = mocks.getCompletion.mock.calls[0][0]
+		expect(JSON.stringify(second)).not.toContain('image_url')
+	})
+
+	// A history whose images together exceed the provider request-size limit gets
+	// the whole request rejected with a 413 the vision-rejection fallback cannot
+	// classify — the loop must keep the outbound copy under the byte cap.
+	it('drops the oldest images when the history exceeds the total byte cap', async () => {
+		const config = createConfig({ workspace: `workspace-${randomUUID()}` })
+		const bigImage = () => ({
+			type: 'image_url',
+			// two of these exceed MAX_TOTAL_IMAGE_BYTES (12MB decoded)
+			image_url: { url: 'data:image/png;base64,' + 'A'.repeat(9_000_000) }
+		})
+		config.messages.splice(
+			0,
+			config.messages.length,
+			{ role: 'user', content: [{ type: 'text', text: 'old' }, bigImage()] } as any,
+			{ role: 'assistant', content: 'ok' },
+			{ role: 'user', content: [{ type: 'text', text: 'new' }, bigImage()] } as any
+		)
+		mocks.getOpenAIResponsesCompletion.mockResolvedValue({})
+		mocks.parseOpenAIResponsesCompletion.mockResolvedValue({ shouldContinue: false, tokenUsage })
+
+		await runChatLoop(config)
+
+		const sent = mocks.getOpenAIResponsesCompletion.mock.calls[0][0] as any[]
+		const users = sent.filter((m) => m.role === 'user')
+		// the oldest message's image is stripped to a placeholder...
+		expect(users[0].content.some((p: any) => p.type === 'image_url')).toBe(false)
+		expect(JSON.stringify(users[0].content)).toContain('[image omitted]')
+		// ...the newest keeps its image part
+		expect(users[1].content.some((p: any) => p.type === 'image_url')).toBe(true)
+		// the stored history is untouched
+		expect((config.messages[0] as any).content.some((p: any) => p.type === 'image_url')).toBe(true)
+	})
+})
diff --git a/frontend/src/lib/components/copilot/chat/chatLoop.ts b/frontend/src/lib/components/copilot/chat/chatLoop.ts
index cd1421dd0b..49afb03a55 100644
--- a/frontend/src/lib/components/copilot/chat/chatLoop.ts
+++ b/frontend/src/lib/components/copilot/chat/chatLoop.ts
@@ -12,7 +12,8 @@ import {
 	type ReasoningProviderModel
 } from '../reasoningRegistry'
 import { getAnthropicCompletion, parseAnthropicCompletion } from './anthropic'
-import { usesAnthropicMessagesApi } from '../modelConfig'
+import { modelSupportsVision, usesAnthropicMessagesApi } from '../modelConfig'
+import { boundImagePartBytes, stripImagePartsFromMessages } from './imageUtils'
 import { getOpenAIResponsesCompletion, parseOpenAIResponsesCompletion } from './openai-responses'
 import type { Tool, ToolCallbacks } from './shared'
 import { sanitizeToolCallArguments } from './toolCallArguments'
@@ -65,8 +66,13 @@ export interface ChatLoopConfig {
 	 * lets the caller recover partial output if the loop throws or is aborted.
 	 */
 	addedMessages?: ChatCompletionMessageParam[]
-	/** Called before each iteration (e.g. to refresh tool schemas). */
-	onBeforeIteration?: (tools: Tool<any>[], helpers: any) => Promise<void>
+	/** Called before each iteration (e.g. to refresh tool schemas, or to record
+	 * which model the iteration is about to use). */
+	onBeforeIteration?: (
+		tools: Tool<any>[],
+		helpers: any,
+		modelProvider: ReasoningProviderModel
+	) => Promise<void>
 }
 
 export interface ChatLoopResult {
@@ -315,7 +321,7 @@ export async function runChatLoop(config: ChatLoopConfig): Promise<ChatLoopResul
 			!unsupportedWebSearchCache.has(webSearchCacheKey)
 
 		if (onBeforeIteration) {
-			await onBeforeIteration(tools, helpers)
+			await onBeforeIteration(tools, helpers, modelProvider)
 		}
 
 		const pendingUserMessage = getPendingUserMessage?.()
@@ -329,9 +335,17 @@ export async function runChatLoop(config: ChatLoopConfig): Promise<ChatLoopResul
 		// so background paths (metadata/autocomplete) never inherit it.
 		const reasoningEffort = resolveRequestReasoning(modelProvider)
 
+		// Checked per iteration, like the model itself: the selector stays enabled
+		// while the loop runs, and a switch to a known text-only model mid-turn
+		// would otherwise send it the history's image parts and fail the turn.
+		// The byte bound is also per iteration because screenshots taken by tools
+		// grow the history mid-loop (see MAX_TOTAL_IMAGE_BYTES).
+		const visibleMessages = modelSupportsVision(modelProvider.provider, modelProvider.model)
+			? boundImagePartBytes(messages)
+			: stripImagePartsFromMessages(messages)
 		const messageParams = [
 			systemMessage,
-			...sanitizeToolCallArguments(messages),
+			...sanitizeToolCallArguments(visibleMessages),
 			...(pendingUserMessage ? [pendingUserMessage] : [])
 		]
 		const toolDefs = tools.map((t) => t.def)
diff --git a/frontend/src/lib/components/copilot/chat/global/core.test.ts b/frontend/src/lib/components/copilot/chat/global/core.test.ts
index 407870433d..cf859efd34 100644
--- a/frontend/src/lib/components/copilot/chat/global/core.test.ts
+++ b/frontend/src/lib/components/copilot/chat/global/core.test.ts
@@ -3691,8 +3691,27 @@ describe('session-only preview tools gating', () => {
 		expect(names).toContain('get_preview_status')
 		expect(names).toContain('get_app_runtime_logs')
 		expect(names).toContain('list_app_runs')
-		// session set is the full globalTools
-		expect(names.length).toBe(globalTools.length)
+		// The session set is the full globalTools minus capability-gated tools:
+		// this environment is not Chromium, so take_screenshot is withheld (DOM
+		// capture is only faithful on Blink).
+		expect(names).not.toContain('take_screenshot')
+		expect(names.length).toBe(globalTools.length - 1)
+	})
+
+	it('offers take_screenshot inside a session only on Chromium', () => {
+		vi.stubGlobal('navigator', {
+			userAgentData: { brands: [{ brand: 'Chromium', version: '138' }] },
+			userAgent: 'stubbed'
+		})
+		try {
+			const names = toolNames(true)
+			expect(names).toContain('take_screenshot')
+			expect(names.length).toBe(globalTools.length)
+			// still session-only, even on Chromium
+			expect(toolNames(false)).not.toContain('take_screenshot')
+		} finally {
+			vi.unstubAllGlobals()
+		}
 	})
 
 	it('mentions open_preview / get_app_runtime_logs / list_app_runs in the system prompt only when preview tools are enabled', () => {
diff --git a/frontend/src/lib/components/copilot/chat/global/core.ts b/frontend/src/lib/components/copilot/chat/global/core.ts
index f9ba044f0a..b177233de4 100644
--- a/frontend/src/lib/components/copilot/chat/global/core.ts
+++ b/frontend/src/lib/components/copilot/chat/global/core.ts
@@ -46,6 +46,10 @@ import {
 } from '$lib/components/raw_apps/templates'
 import { DEFAULT_DATA as DEFAULT_RAW_APP_DATA } from '$lib/components/raw_apps/dataTableRefUtils'
 import { appSourceToDraftValue } from '$lib/components/raw_apps/rawAppDraftValue'
+import { dataUrlToImagePart, normalizeImageDataUrl, type AttachedImage } from '../imageUtils'
+import { modelSupportsVision } from '../../modelConfig'
+import { tryGetCurrentModel } from '$lib/aiStore'
+import { isChromiumBrowser } from '$lib/utils'
 import {
 	applyEditableFlowJsonToFlow,
 	buildEditableFlowJson,
@@ -192,6 +196,8 @@ export type GlobalActiveEditorContext = {
 export type GlobalUserMessageOptions = {
 	workspace?: string
 	activeEditor?: GlobalActiveEditorContext
+	/** Images attached to this message; delivered as image_url content parts. */
+	images?: AttachedImage[]
 }
 
 const itemTypeSchema = z.enum(ITEM_TYPES)
@@ -805,6 +811,8 @@ const listAppRunsSchema = z.object({
 		.describe('How many of the most recent backend runs to return, newest first. Defaults to 20.')
 })
 
+const takeScreenshotSchema = z.object({})
+
 const FRAMEWORK_KEYS = [
 	'react19',
 	'react18',
@@ -930,6 +938,11 @@ Rules:
 - Building a data pipeline: call open_preview(kind="pipeline", path="<folder>") as the FIRST step, before creating any node — this opens the pipeline editor the user reviews in. path is the folder, not an item; an empty or not-yet-created folder is fine (create_folder first if needed, then open it). Opening it registers build_pipeline_node / edit_pipeline_node — use ONLY those to add or change pipeline nodes, never write_script for a pipeline node — they apply directly as unsaved drafts on the canvas (no separate accept/reject step) that the user reviews and deploys. Do not write pipeline scripts without first opening the editor.
 - When debugging a running raw app, call get_app_runtime_logs to read the live preview's browser console output. It needs the raw app preview open (open_preview kind="raw_app").
 - get_app_runtime_logs only shows the app's browser console. For the server-side logs of a backend runnable the app invoked (a backend.<id> call), call list_app_runs to get that run's job_id from the live preview, then get_job_logs with it. Use this when a backend call errors or returns something unexpected.
+${
+	isChromiumBrowser()
+		? `- When the user raises how a raw app looks (something is off, or they want the design or layout improved), call take_screenshot to see what they are looking at before changing anything. Reach for it when the request is about appearance, not to review your own edits, which you can read back from the code. It needs the raw app preview open (open_preview kind="raw_app").`
+		: `- When the user raises how a raw app looks (something is off, or they want the design or layout improved) and their description alone isn't specific enough to pinpoint the problem, ask them to paste or drop a screenshot of it into the chat before changing anything.`
+}
 - open_page opens its page as a tab in the side-panel preview next to the chat — the only way to show one of these pages there (open_preview only handles editable items). Changing filters on a page already open updates that same tab; only pass new_tab when the user explicitly asks for a separate tab.
 - create_artifact saves a persistent markdown document (a planning doc, design write-up, spec, or other longer structured output) shown in the session preview panel. Prefer it over a long inline reply for content the user will revisit; keep brief answers inline. To revise one, call list_artifacts then read_artifact for the current content, then update_artifact to overwrite it — never create a second artifact for the same document.`
 			: ''
@@ -2908,6 +2921,54 @@ export const globalTools: Tool<{}>[] = [
 			return result.aiResult
 		}
 	},
+	{
+		def: createToolDef(
+			takeScreenshotSchema,
+			'take_screenshot',
+			// Keep this short: every global session iteration re-sends it. How to read
+			// the result belongs on the result, where only a real capture pays for it.
+			'Capture a screenshot of the raw app preview currently open in this AI session and attach it as an image so you can see the rendered UI. Use it when the user raises how the app looks, whether reporting a problem or asking for the design improved, rather than to check your own edits. The image is attached in the following message. Requires the raw app preview open (open_preview kind="raw_app").'
+		),
+		showDetails: true,
+		fn: async (ctx) => {
+			// A known text-only model would reject the follow-up image message and fail
+			// the turn, so refuse before capturing rather than buffer an image it can
+			// never read. The model is re-read here because it can change between turns.
+			const model = tryGetCurrentModel()
+			if (model && !modelSupportsVision(model.provider, model.model)) {
+				const cannotSee = `${model.model} cannot read images, so a screenshot would be discarded. Ask the user to describe what looks wrong, or to switch to a model that supports images.`
+				ctx.toolCallbacks.setToolStatus(ctx.toolId, {
+					content: `${model.model} cannot read images`,
+					error: cannotSee
+				})
+				return cannotSee
+			}
+			ctx.toolCallbacks.setToolStatus(ctx.toolId, { content: 'Capturing screenshot...' })
+			const result = await getSessionScreenshot(sessionIdFromCtx(ctx))
+			if (!result.dataUrl) {
+				ctx.toolCallbacks.setToolStatus(ctx.toolId, {
+					content: result.uiMessage ?? 'Screenshot unavailable',
+					error: result.error
+				})
+				return result.error ?? 'Could not capture the app preview.'
+			}
+			// Normalize (downscale + png/jpeg) so history/context never carry a full-res blob;
+			// buffered here and flushed as a follow-up user image message once the tool batch
+			// completes (see appendPendingToolImages).
+			const image = await normalizeImageDataUrl(result.dataUrl)
+			ctx.toolCallbacks.attachToolImage?.(ctx.toolId, image)
+			// The card shows the same copy the model gets; sharing the exact data URL
+			// lets the history's blob store persist one copy for both.
+			ctx.toolCallbacks.setToolStatus(ctx.toolId, {
+				content: 'Screenshot captured',
+				imageUrl: image.dataUrl
+			})
+			return (
+				'Screenshot captured; the image is attached in the following message.\n\n' +
+				'It is rebuilt from the DOM rather than captured from the screen, so it can differ from what the user sees, and it differs by browser. Treat what you see as real and fix it. Before dismissing anything as a capture artifact, read the source for that element and name the specific cause; if you cannot, it is a real bug. If you are still unsure, say what looks wrong and ask the user to screenshot it themselves and drag the image into the chat rather than guessing.'
+			)
+		}
+	},
 	// Workspace-scoped datatable tools (unrestricted: no whitelist, no creation policy)
 	...getDatatableTools(),
 	// Read-only tools over files the user attached to the conversation
@@ -2923,6 +2984,7 @@ export const SESSION_PREVIEW_TOOL_NAMES = new Set([
 	'close_page',
 	'get_app_runtime_logs',
 	'list_app_runs',
+	'take_screenshot',
 	'create_artifact',
 	'update_artifact',
 	'list_artifacts',
@@ -2935,9 +2997,16 @@ export const SESSION_PREVIEW_TOOL_NAMES = new Set([
  * global side-panel chat.
  */
 export function globalToolsFor({ sessionPreview }: { sessionPreview: boolean }): Tool<{}>[] {
-	return sessionPreview
+	const tools = sessionPreview
 		? globalTools
 		: globalTools.filter((t) => !SESSION_PREVIEW_TOOL_NAMES.has(t.def.function.name))
+	// DOM capture re-renders the app through the engine's SVG-image path, which is
+	// only faithful on Blink — Gecko/WebKit shift text spacing and wrapping (font
+	// fallback, sub-pixel rounding). Elsewhere the tool is withheld entirely and
+	// the system prompt tells the agent to ask the user for a screenshot instead.
+	return isChromiumBrowser()
+		? tools
+		: tools.filter((t) => t.def.function.name !== 'take_screenshot')
 }
 
 type WriteDraftCtx = {
@@ -3149,6 +3218,28 @@ function getSessionAppRuns(
 	return Promise.resolve(listAppRunsHandler({ sessionId, limit }))
 }
 
+export type SessionScreenshotResult = { dataUrl?: string; error?: string; uiMessage?: string }
+export type ScreenshotHandler = (req: {
+	sessionId: string | undefined
+}) => Promise<SessionScreenshotResult>
+
+let screenshotHandler: ScreenshotHandler | undefined
+
+export function setScreenshotHandler(handler: ScreenshotHandler | undefined): void {
+	screenshotHandler = handler
+}
+
+function getSessionScreenshot(sessionId: string | undefined): Promise<SessionScreenshotResult> {
+	if (!screenshotHandler) {
+		return Promise.resolve({
+			error:
+				'Error: take_screenshot is only available inside an AI session with a raw app preview open. Ask the user to open the raw app preview (open_preview kind="raw_app"), then try again.',
+			uiMessage: 'Screenshot unavailable'
+		})
+	}
+	return screenshotHandler({ sessionId })
+}
+
 // Registered by the session runtime to reload the open preview after a chat
 // deploy. Undefined outside a session.
 export type DeployedInSessionHandler = (req: {
@@ -5264,6 +5355,20 @@ export function prepareGlobalUserMessage(
 
 	content += `## INSTRUCTIONS:\n${instructions}`
 
+	const images = options.images ?? []
+	if (images.length > 0) {
+		// Multimodal message: the text block plus one image_url part per attachment.
+		// The provider converters translate image_url for Anthropic/Responses; the
+		// OpenAI-compatible path sends it as-is.
+		return {
+			role: 'user',
+			content: [
+				{ type: 'text', text: content },
+				...images.map((img) => dataUrlToImagePart(img.dataUrl))
+			]
+		}
+	}
+
 	return {
 		role: 'user',
 		content
diff --git a/frontend/src/lib/components/copilot/chat/imageUtils.test.ts b/frontend/src/lib/components/copilot/chat/imageUtils.test.ts
new file mode 100644
index 0000000000..136c556258
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/imageUtils.test.ts
@@ -0,0 +1,173 @@
+import { describe, expect, it } from 'vitest'
+import type { ChatCompletionMessageParam } from 'openai/resources/index.mjs'
+import {
+	boundImagePartBytes,
+	captureScale,
+	fileToAttachedImage,
+	imagesFromContent,
+	MAX_IMAGE_BYTES,
+	messagesHaveImageParts,
+	parseImageDataUrl,
+	stripImagePartsFromMessages
+} from './imageUtils'
+
+describe('fileToAttachedImage size bound', () => {
+	// Decoding allocates ~4 bytes per pixel before the downscale can run, so an
+	// oversized file must be refused up front.
+	it('rejects a file over the byte cap', async () => {
+		const blob = { size: MAX_IMAGE_BYTES + 1, type: 'image/png' } as unknown as Blob
+		await expect(fileToAttachedImage(blob)).rejects.toThrow(/too large/i)
+	})
+})
+
+describe('parseImageDataUrl', () => {
+	it('splits media type and base64 payload', () => {
+		expect(parseImageDataUrl('data:image/png;base64,AAAA')).toEqual({
+			mediaType: 'image/png',
+			base64: 'AAAA'
+		})
+		expect(parseImageDataUrl('data:image/jpeg;base64,ZZ==')).toEqual({
+			mediaType: 'image/jpeg',
+			base64: 'ZZ=='
+		})
+	})
+
+	it('defaults to png and empty payload on a malformed url', () => {
+		expect(parseImageDataUrl('not-a-data-url')).toEqual({ mediaType: 'image/png', base64: '' })
+	})
+})
+
+describe('stripImagePartsFromMessages', () => {
+	it('replaces image parts with a placeholder and collapses to a string', () => {
+		const messages: ChatCompletionMessageParam[] = [
+			{
+				role: 'user',
+				content: [
+					{ type: 'text', text: 'look at this' },
+					{ type: 'image_url', image_url: { url: 'data:image/png;base64,HUGEBLOB' } }
+				]
+			} as any
+		]
+		const out = stripImagePartsFromMessages(messages)
+		expect(out[0].content).toBe('look at this\n[image omitted]')
+	})
+
+	it('leaves image-free messages untouched (same reference)', () => {
+		const messages: ChatCompletionMessageParam[] = [{ role: 'user', content: 'plain' }]
+		const out = stripImagePartsFromMessages(messages)
+		expect(out[0]).toBe(messages[0])
+	})
+})
+
+describe('boundImagePartBytes', () => {
+	const imgMsg = (payloadChars: number, text: string): ChatCompletionMessageParam =>
+		({
+			role: 'user',
+			content: [
+				{ type: 'text', text },
+				{
+					type: 'image_url',
+					image_url: { url: 'data:image/png;base64,' + 'A'.repeat(payloadChars) }
+				}
+			]
+		}) as any
+
+	it('returns the same array when everything fits', () => {
+		const messages = [imgMsg(100, 'a')]
+		expect(boundImagePartBytes(messages, 1000)).toBe(messages)
+	})
+
+	const imageParts = (m: ChatCompletionMessageParam) =>
+		(m.content as any[]).filter((p) => p?.type === 'image_url').length
+
+	it('strips the oldest images first once the cap is exceeded', () => {
+		// 1000 base64 chars ≈ 750 bytes each: the newest fits alone, both together don't
+		const messages = [
+			imgMsg(1000, 'old'),
+			{ role: 'assistant', content: 'ok' } as ChatCompletionMessageParam,
+			imgMsg(1000, 'new')
+		]
+		const out = boundImagePartBytes(messages, 1000)
+		expect(imageParts(out[0])).toBe(0)
+		expect(JSON.stringify(out[0].content)).toContain('[image omitted]')
+		expect(out[1]).toBe(messages[1])
+		expect(imageParts(out[2])).toBe(1)
+	})
+
+	// An over-cap batch on the CURRENT turn must keep the subset that fits, not
+	// silently send a text-only message while the composer showed attached images.
+	// The newest parts win: for screenshot follow-ups the last image is the app's
+	// current state.
+	it('keeps the newest fitting subset when the newest message alone exceeds the cap', () => {
+		const url = (marker: string) => ({
+			type: 'image_url',
+			image_url: { url: 'data:image/png;base64,' + marker.repeat(1000) }
+		})
+		const messages = [
+			{
+				role: 'user',
+				content: [{ type: 'text', text: 'batch' }, url('A'), url('B'), url('C')]
+			} as any
+		]
+		const out = boundImagePartBytes(messages, 1600)
+		// 750 bytes each against a 1600-byte cap: the two NEWEST fit, the oldest drops
+		const content = out[0].content as any[]
+		expect(content[1]).toEqual({ type: 'text', text: '[image omitted]' })
+		expect(content[2].image_url.url).toContain('B')
+		expect(content[3].image_url.url).toContain('C')
+	})
+})
+
+describe('messagesHaveImageParts', () => {
+	it('detects an image part anywhere in the history', () => {
+		const messages: ChatCompletionMessageParam[] = [
+			{ role: 'user', content: 'plain' },
+			{
+				role: 'user',
+				content: [{ type: 'image_url', image_url: { url: 'data:image/png;base64,A' } }]
+			} as any
+		]
+		expect(messagesHaveImageParts(messages)).toBe(true)
+	})
+
+	it('is false for string content and image-free part arrays', () => {
+		const messages: ChatCompletionMessageParam[] = [
+			{ role: 'user', content: 'plain' },
+			{ role: 'user', content: [{ type: 'text', text: 'also plain' }] } as any
+		]
+		expect(messagesHaveImageParts(messages)).toBe(false)
+	})
+})
+
+describe('imagesFromContent', () => {
+	it('recovers image parts and skips text (including the omitted placeholder)', () => {
+		const content = [
+			{ type: 'text', text: 'look' },
+			{ type: 'image_url', image_url: { url: 'data:image/jpeg;base64,AAAA' } },
+			{ type: 'text', text: '[image omitted]' },
+			{ type: 'image_url', image_url: { url: 'data:image/png;base64,BBBB' } }
+		]
+		expect(imagesFromContent(content)).toEqual([
+			{ dataUrl: 'data:image/jpeg;base64,AAAA', mediaType: 'image/jpeg' },
+			{ dataUrl: 'data:image/png;base64,BBBB', mediaType: 'image/png' }
+		])
+	})
+
+	it('is undefined for string content and image-free part arrays', () => {
+		expect(imagesFromContent('plain')).toBeUndefined()
+		expect(imagesFromContent([{ type: 'text', text: 'plain' }])).toBeUndefined()
+	})
+})
+
+describe('captureScale', () => {
+	it('captures small targets above CSS resolution, capped at 2x', () => {
+		expect(captureScale(400)).toBe(2)
+	})
+
+	it('never yields a raster larger than MAX_IMAGE_EDGE, even below 1x', () => {
+		// A tall scrolling app body: rasterising at >=1x would allocate an
+		// unbounded canvas only for normalize to shrink or reject it.
+		expect(captureScale(10_000) * 10_000).toBe(1568)
+		expect(captureScale(10_000)).toBeLessThan(1)
+	})
+})
diff --git a/frontend/src/lib/components/copilot/chat/imageUtils.ts b/frontend/src/lib/components/copilot/chat/imageUtils.ts
new file mode 100644
index 0000000000..eb8dd3b8ec
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/imageUtils.ts
@@ -0,0 +1,273 @@
+/**
+ * Image handling shared by the two multimodal chat features: user-attached images
+ * (drag/drop/paste, GLOBAL mode) and the app agent's `take_screenshot` tool.
+ *
+ * Every image the model sees passes through here first so it is bounded in BOTH
+ * dimensions (≤ MAX_EDGE longest side — beyond this the provider downscales anyway
+ * and just bills more tokens) and bytes. Bounding bytes matters because the data URL
+ * rides every request (stateless APIs resend the whole history) and is persisted in
+ * the chat history's blob store. Everything is rasterised to PNG/JPEG so exotic
+ * inputs (SVG, WebP, HEIC where the browser can decode it) become a media type all
+ * providers accept.
+ */
+import type {
+	ChatCompletionContentPartImage,
+	ChatCompletionMessageParam
+} from 'openai/resources/index.mjs'
+
+/** Longest-edge cap. Matches the point past which vision models downscale server-side. */
+export const MAX_IMAGE_EDGE = 1568
+/** Above this many bytes a PNG re-encodes to JPEG to keep history/storage bounded. */
+const PNG_SIZE_CAP = 700_000
+/**
+ * Refuse a file this large before reading it. Decoding allocates ~4 bytes per pixel
+ * — a 12MP photo is ~48MB of bitmap — and the downscale below can only run once that
+ * bitmap exists, so the cap has to bite before the read, not after.
+ */
+export const MAX_IMAGE_BYTES = 20_000_000
+/** Decoded-pixel ceiling, in case a small file expands to an absurd bitmap. */
+const MAX_IMAGE_PIXELS = 40_000_000
+/**
+ * Images one message may carry. Enforced wherever a message is assembled, not just
+ * at the composer: queuing clears the composer, so its own count would reset and let
+ * repeated sends stack an unbounded batch into a single message.
+ */
+export const MAX_ATTACHED_IMAGES = 8
+
+export type ImageMediaType = 'image/png' | 'image/jpeg'
+
+/** A model-ready image: a normalised (bounded, png/jpeg) data URL plus its media type. */
+export type AttachedImage = {
+	dataUrl: string
+	mediaType: ImageMediaType
+	/** Original filename when it came from a user file; absent for screenshots. */
+	name?: string
+}
+
+/** Stands in for a stripped or evicted image part in message content. */
+export const IMAGE_OMITTED_PLACEHOLDER = '[image omitted]'
+
+/**
+ * Recover the model's own images from an API message's content parts. Anything
+ * resending a turn (retry, edit) must read images from here, never from the
+ * transcript bubble: a provider rejection strips them from history while the
+ * bubble keeps its copy so the user can still see what they sent — resending
+ * that copy would re-attach the image the provider just refused.
+ */
+export function imagesFromContent(content: unknown): AttachedImage[] | undefined {
+	if (!Array.isArray(content)) return undefined
+	const images = (content as any[]).flatMap((part): AttachedImage[] => {
+		if (part?.type !== 'image_url' || typeof part?.image_url?.url !== 'string') return []
+		const dataUrl = part.image_url.url as string
+		return [
+			{
+				dataUrl,
+				mediaType:
+					parseImageDataUrl(dataUrl).mediaType === 'image/jpeg' ? 'image/jpeg' : 'image/png'
+			}
+		]
+	})
+	return images.length > 0 ? images : undefined
+}
+
+/**
+ * Raster scale for a DOM screenshot of a target whose longest CSS edge is
+ * `cssEdge`. Above CSS resolution (up to 2×) for small targets — the SVG
+ * re-render is vector, so the extra scale is real detail, not interpolation —
+ * but never a raster larger than MAX_IMAGE_EDGE: normalize would downscale the
+ * excess away, and rasterising an oversized body (a tall scrolling app) at ≥1×
+ * first can allocate a tab-freezing canvas. Sub-1× output is deliberate.
+ */
+export function captureScale(cssEdge: number): number {
+	return Math.min(2, MAX_IMAGE_EDGE / Math.max(1, cssEdge))
+}
+
+export function isImageFile(file: File | Blob): boolean {
+	return typeof file.type === 'string' && file.type.startsWith('image/')
+}
+
+/** Byte size of a base64 data URL's payload (4 base64 chars → 3 bytes). */
+function base64Bytes(dataUrl: string): number {
+	const comma = dataUrl.indexOf(',')
+	const b64 = comma >= 0 ? dataUrl.slice(comma + 1) : dataUrl
+	const padding = b64.endsWith('==') ? 2 : b64.endsWith('=') ? 1 : 0
+	return Math.max(0, Math.floor((b64.length * 3) / 4) - padding)
+}
+
+function loadImage(src: string): Promise<HTMLImageElement> {
+	return new Promise((resolve, reject) => {
+		const img = new Image()
+		img.onload = () => resolve(img)
+		img.onerror = () => reject(new Error('Could not decode image'))
+		img.src = src
+	})
+}
+
+function blobToDataUrl(blob: Blob): Promise<string> {
+	return new Promise((resolve, reject) => {
+		const reader = new FileReader()
+		reader.onload = () => resolve(reader.result as string)
+		reader.onerror = () => reject(reader.error ?? new Error('Could not read file'))
+		reader.readAsDataURL(blob)
+	})
+}
+
+/** PNG by default (lossless — crisp for the common UI-screenshot/diagram case); fall
+ *  back to JPEG only when the PNG would blow the size cap (photographic content). */
+function encodeCanvas(canvas: HTMLCanvasElement): { dataUrl: string; mediaType: ImageMediaType } {
+	const png = canvas.toDataURL('image/png')
+	if (base64Bytes(png) <= PNG_SIZE_CAP) {
+		return { dataUrl: png, mediaType: 'image/png' }
+	}
+	// JPEG has no alpha channel and canvas encoders composite transparent pixels
+	// onto black, which hides dark strokes in a transparent diagram. Flatten onto
+	// white before encoding.
+	const flat = document.createElement('canvas')
+	flat.width = canvas.width
+	flat.height = canvas.height
+	const ctx = flat.getContext('2d')
+	if (ctx) {
+		ctx.fillStyle = '#ffffff'
+		ctx.fillRect(0, 0, flat.width, flat.height)
+		ctx.drawImage(canvas, 0, 0)
+	}
+	return {
+		dataUrl: (ctx ? flat : canvas).toDataURL('image/jpeg', 0.82),
+		mediaType: 'image/jpeg'
+	}
+}
+
+/**
+ * Downscale a data URL to ≤ MAX_IMAGE_EDGE on its longest side and re-encode to
+ * png/jpeg. Used by both the file-attach path and the screenshot tool.
+ */
+export async function normalizeImageDataUrl(
+	dataUrl: string,
+	name?: string,
+	maxEdge: number = MAX_IMAGE_EDGE
+): Promise<AttachedImage> {
+	const img = await loadImage(dataUrl)
+	const srcW = img.naturalWidth || img.width
+	const srcH = img.naturalHeight || img.height
+	if (!srcW || !srcH) throw new Error('Image has no dimensions')
+	if (srcW * srcH > MAX_IMAGE_PIXELS) throw new Error('Image resolution is too large')
+	const scale = Math.min(1, maxEdge / Math.max(srcW, srcH))
+	const w = Math.max(1, Math.round(srcW * scale))
+	const h = Math.max(1, Math.round(srcH * scale))
+	const canvas = document.createElement('canvas')
+	canvas.width = w
+	canvas.height = h
+	const ctx = canvas.getContext('2d')
+	if (!ctx) throw new Error('Canvas 2D context unavailable')
+	ctx.drawImage(img, 0, 0, w, h)
+	return { ...encodeCanvas(canvas), name }
+}
+
+/** Read a user-provided image file and produce a bounded, model-ready AttachedImage. */
+export async function fileToAttachedImage(file: File | Blob): Promise<AttachedImage> {
+	if (file.size > MAX_IMAGE_BYTES) throw new Error('Image file is too large')
+	const name = file instanceof File ? file.name : undefined
+	const dataUrl = await blobToDataUrl(file)
+	return await normalizeImageDataUrl(dataUrl, name)
+}
+
+/** Split a data URL into its media type and base64 payload (for the Anthropic converter). */
+export function parseImageDataUrl(url: string): { mediaType: string; base64: string } {
+	const match = /^data:([^;,]+)?(;base64)?,(.*)$/s.exec(url)
+	if (!match) return { mediaType: 'image/png', base64: '' }
+	return { mediaType: match[1] || 'image/png', base64: match[2] ? match[3] : '' }
+}
+
+/** Build the OpenAI-format image content part that all three provider paths convert from. */
+export function dataUrlToImagePart(dataUrl: string): ChatCompletionContentPartImage {
+	return { type: 'image_url', image_url: { url: dataUrl } }
+}
+
+/** Whether any message still carries an image_url content part. */
+export function messagesHaveImageParts(messages: ChatCompletionMessageParam[]): boolean {
+	return messages.some(
+		(message) =>
+			Array.isArray(message.content) &&
+			(message.content as any[]).some((part) => part?.type === 'image_url')
+	)
+}
+
+/**
+ * Total decoded image bytes one request may carry. Providers reject the whole
+ * request body over a size limit (20MB on Bedrock, 32MB direct Anthropic), and
+ * that 413 never mentions images, so the vision-rejection fallback cannot
+ * recover it — each request must stay under the limit in the first place.
+ * Compaction cannot be relied on for this: it triggers on estimated tokens,
+ * and images are cheap in tokens relative to their bytes. 12MB decoded is
+ * ~16MB of base64 on the wire, safely under the tightest limit with text.
+ */
+export const MAX_TOTAL_IMAGE_BYTES = 12_000_000
+
+/**
+ * Keep the request's cumulative image bytes under the cap by stripping the
+ * OLDEST image parts first (the newest images are the ones the conversation
+ * is about). Part-granular so a single over-cap batch keeps the subset that
+ * fits — the newest message never silently loses all its images (one bounded
+ * image alone cannot exceed the cap). Returns the input array unchanged when
+ * everything fits.
+ */
+export function boundImagePartBytes(
+	messages: ChatCompletionMessageParam[],
+	cap: number = MAX_TOTAL_IMAGE_BYTES
+): ChatCompletionMessageParam[] {
+	let total = 0
+	const drops = new Map<number, Set<number>>()
+	for (let i = messages.length - 1; i >= 0; i--) {
+		const content = messages[i].content
+		if (!Array.isArray(content)) continue
+		// Parts walk in reverse too: within a message they are in attachment order,
+		// and for screenshot follow-ups the last one is the app's current state.
+		for (let j = (content as any[]).length - 1; j >= 0; j--) {
+			const part = (content as any[])[j]
+			if (part?.type !== 'image_url' || typeof part?.image_url?.url !== 'string') continue
+			total += base64Bytes(part.image_url.url)
+			if (total > cap) {
+				if (!drops.has(i)) drops.set(i, new Set())
+				drops.get(i)!.add(j)
+			}
+		}
+	}
+	if (drops.size === 0) return messages
+	return messages.map((message, i) => {
+		const drop = drops.get(i)
+		if (!drop) return message
+		return {
+			...message,
+			content: (message.content as any[]).map((part, j) =>
+				drop.has(j) ? { type: 'text', text: IMAGE_OMITTED_PLACEHOLDER } : part
+			)
+		} as ChatCompletionMessageParam
+	})
+}
+
+/**
+ * Replace image_url content parts with a short text placeholder, collapsing the
+ * remaining parts back to a plain string. Used to keep base64 blobs out of the
+ * summarizer request during compaction (the summary text then stands in for them).
+ */
+export function stripImagePartsFromMessages(
+	messages: ChatCompletionMessageParam[]
+): ChatCompletionMessageParam[] {
+	return messages.map((message) => {
+		if (!Array.isArray(message.content)) return message
+		let hadImage = false
+		const text = (message.content as any[])
+			.map((part) => {
+				if (part?.type === 'text') return part.text ?? ''
+				if (part?.type === 'image_url') {
+					hadImage = true
+					return IMAGE_OMITTED_PLACEHOLDER
+				}
+				return ''
+			})
+			.filter(Boolean)
+			.join('\n')
+		if (!hadImage) return message
+		return { ...message, content: text } as ChatCompletionMessageParam
+	})
+}
diff --git a/frontend/src/lib/components/copilot/chat/openai-responses.test.ts b/frontend/src/lib/components/copilot/chat/openai-responses.test.ts
new file mode 100644
index 0000000000..a91ddc5a17
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/openai-responses.test.ts
@@ -0,0 +1,39 @@
+import { describe, expect, it, vi } from 'vitest'
+import { toResponsesContent } from './openai-responses'
+
+// openai-responses.ts pulls in the chat client/registry layer at import time; the
+// helper under test is pure, so stub those side-effecting modules away.
+vi.mock('../lib', () => ({
+	createOpenAIProxyClient: vi.fn(),
+	getAiProxyBaseURL: vi.fn(),
+	getProviderAndCompletionConfig: vi.fn(),
+	providerSupportsWebSearch: vi.fn(),
+	workspaceAIClients: {}
+}))
+
+vi.mock('../reasoningRegistry', () => ({
+	applyReasoningToConfig: vi.fn()
+}))
+
+vi.mock('./shared', () => ({
+	processToolCall: vi.fn(),
+	appendPendingToolImages: vi.fn()
+}))
+
+describe('toResponsesContent', () => {
+	it('passes a plain string through unchanged', () => {
+		expect(toResponsesContent('hello')).toBe('hello')
+	})
+
+	it('maps text parts to input_text and image_url parts to input_image (string url)', () => {
+		const out = toResponsesContent([
+			{ type: 'text', text: 'describe this' },
+			{ type: 'image_url', image_url: { url: 'data:image/png;base64,ZZZZ' } }
+		]) as any[]
+
+		expect(out).toEqual([
+			{ type: 'input_text', text: 'describe this' },
+			{ type: 'input_image', image_url: 'data:image/png;base64,ZZZZ' }
+		])
+	})
+})
diff --git a/frontend/src/lib/components/copilot/chat/openai-responses.ts b/frontend/src/lib/components/copilot/chat/openai-responses.ts
index 3a83595f8f..ec3f9dad38 100644
--- a/frontend/src/lib/components/copilot/chat/openai-responses.ts
+++ b/frontend/src/lib/components/copilot/chat/openai-responses.ts
@@ -13,7 +13,7 @@ import {
 	workspaceAIClients
 } from '../lib'
 import { applyReasoningToConfig } from '../reasoningRegistry'
-import { processToolCall, type Tool, type ToolCallbacks } from './shared'
+import { appendPendingToolImages, processToolCall, type Tool, type ToolCallbacks } from './shared'
 import type { ResponseStream } from 'openai/lib/responses/ResponseStream.mjs'
 import type { AIProviderModel } from '$lib/gen'
 import { openAIResponsesUsageToChatTokenUsage, type ChatTokenUsage } from './tokenUsage'
@@ -48,6 +48,23 @@ function setOpenAIWebSearchStatus(
 }
 
 // Conversion utilities for Responses API
+
+/**
+ * Translate Chat-Completions message content to Responses-native content. Strings
+ * pass through; a content-part array maps text→input_text and image_url→input_image
+ * (Responses takes image_url as a plain string, not the {url} object).
+ */
+export function toResponsesContent(content: unknown): unknown {
+	if (!Array.isArray(content)) return content
+	return content.map((part) => {
+		if (part?.type === 'text') return { type: 'input_text', text: part.text }
+		if (part?.type === 'image_url' && part.image_url?.url) {
+			return { type: 'input_image', image_url: part.image_url.url }
+		}
+		return part
+	})
+}
+
 function convertMessagesToResponsesInput(messages: ChatCompletionMessageParam[]): {
 	instructions?: string
 	input: Array<any>
@@ -100,7 +117,7 @@ function convertMessagesToResponsesInput(messages: ChatCompletionMessageParam[])
 			input.push({
 				type: 'message' as const,
 				role: m.role === 'developer' ? 'developer' : m.role === 'assistant' ? 'assistant' : 'user',
-				content: m.content
+				content: toResponsesContent(m.content)
 			})
 		}
 	}
@@ -462,6 +479,7 @@ export async function parseOpenAIResponsesCompletion(
 			messages.push(messageToAdd)
 			addedMessages.push(messageToAdd)
 		}
+		appendPendingToolImages(messages, addedMessages, callbacks)
 		return { shouldContinue: true, tokenUsage }
 	}
 
diff --git a/frontend/src/lib/components/copilot/chat/shared.test.ts b/frontend/src/lib/components/copilot/chat/shared.test.ts
index fcd848c60d..459ff6f5da 100644
--- a/frontend/src/lib/components/copilot/chat/shared.test.ts
+++ b/frontend/src/lib/components/copilot/chat/shared.test.ts
@@ -937,3 +937,39 @@ describe('trimJob', () => {
 		expect(job.result).toBe(42)
 	})
 })
+
+describe('appendPendingToolImages', () => {
+	// Tool results are string-only, so tool-produced images ride a follow-up
+	// user message appended after the whole tool batch. It must land in BOTH
+	// arrays (messages = sent next iteration, addedMessages = committed to
+	// history) and drain the buffer exactly once — a second flush appending the
+	// same screenshots again would duplicate them in history.
+	it('appends one user message to both arrays and drains the buffer once', async () => {
+		const { appendPendingToolImages } = await import('./shared')
+		let pending = [{ dataUrl: 'data:image/png;base64,SHOT', mediaType: 'image/png' as const }]
+		const toolCallbacks = {
+			setToolStatus: vi.fn(),
+			takePendingToolImages: () => {
+				const taken = pending
+				pending = []
+				return taken
+			}
+		}
+		const messages: any[] = []
+		const addedMessages: any[] = []
+
+		appendPendingToolImages(messages, addedMessages, toolCallbacks as any)
+
+		expect(messages).toHaveLength(1)
+		expect(messages[0]).toBe(addedMessages[0])
+		expect(messages[0].role).toBe('user')
+		expect(messages[0].content[1]).toEqual({
+			type: 'image_url',
+			image_url: { url: 'data:image/png;base64,SHOT' }
+		})
+
+		appendPendingToolImages(messages, addedMessages, toolCallbacks as any)
+		expect(messages).toHaveLength(1)
+		expect(addedMessages).toHaveLength(1)
+	})
+})
diff --git a/frontend/src/lib/components/copilot/chat/shared.ts b/frontend/src/lib/components/copilot/chat/shared.ts
index 02f92519b7..1ffcf769e9 100644
--- a/frontend/src/lib/components/copilot/chat/shared.ts
+++ b/frontend/src/lib/components/copilot/chat/shared.ts
@@ -18,6 +18,7 @@ export const SPECIAL_MODULE_IDS = {
 } as const
 import { get } from 'svelte/store'
 import type { PasteAttachment } from './pasteTokens'
+import { dataUrlToImagePart, type AttachedImage } from './imageUtils'
 import type { CodePieceElement, ContextElement, FlowModuleCodePieceElement } from './context'
 import { workspaceStore } from '$lib/stores'
 import type { ExtendedOpenFlow } from '$lib/components/flows/types'
@@ -468,6 +469,9 @@ export type UserDisplayMessage = BaseDisplayMessage & {
 	// Collapsed big-paste blobs referenced by tokens in `content`. Lets the
 	// bubble render/expand chips; the LLM message stores the expanded text.
 	pastes?: PasteAttachment[]
+	// Images the user attached to this message (drag/drop/paste), rendered as
+	// thumbnails in the bubble. The LLM message carries them as image_url parts.
+	images?: AttachedImage[]
 }
 
 export type CreatedResourceTriggerKind =
@@ -539,6 +543,8 @@ export type ToolDisplayMessage = {
 	showFade?: boolean
 	actions?: ToolDisplayAction[]
 	userQuestion?: UserQuestionDisplay
+	/** Data URL of an image the tool produced (e.g. take_screenshot), shown on the card. */
+	imageUrl?: string
 }
 
 export type AssistantDisplayMessage = BaseDisplayMessage & {
@@ -796,6 +802,32 @@ export async function processToolCall<T>({
 	}
 }
 
+/**
+ * Flush images buffered by tools during a batch (via toolCallbacks.attachToolImage)
+ * as ONE follow-up user message, appended to both `messages` (sent on later
+ * iterations) and `addedMessages` (committed to history). Call this once per
+ * completion, right after the whole tool loop — never mid-batch, so every tool_call
+ * id is already answered by its tool result before this non-tool message. The image
+ * parts ride the same `image_url` carrier that the provider converters translate.
+ */
+export function appendPendingToolImages(
+	messages: ChatCompletionMessageParam[],
+	addedMessages: ChatCompletionMessageParam[],
+	toolCallbacks: ToolCallbacks
+): void {
+	const images = toolCallbacks.takePendingToolImages?.() ?? []
+	if (images.length === 0) return
+	const message: ChatCompletionMessageParam = {
+		role: 'user',
+		content: [
+			{ type: 'text', text: 'Screenshot(s) of the app preview:' },
+			...images.map((img) => dataUrlToImagePart(img.dataUrl))
+		]
+	}
+	messages.push(message)
+	addedMessages.push(message)
+}
+
 export interface Tool<T> {
 	def: ChatCompletionFunctionTool
 	fn: (p: {
@@ -939,6 +971,16 @@ export interface ToolCallbacks {
 	onItemDeployed?: (itemKind: UserDraftItemKind, storagePath: string, deployedPath: string) => void
 	/** A tool discarded a draft: the chat's touch on the item is undone. */
 	onItemDiscarded?: (itemKind: UserDraftItemKind, storagePath: string) => void
+	/**
+	 * Buffer an image a tool produced (e.g. take_screenshot). Tool results are
+	 * string-only and OpenAI forbids images in tool messages, so buffered images are
+	 * flushed as a follow-up user message once the whole tool batch is answered (see
+	 * appendPendingToolImages) — appending mid-batch would leave sibling tool_call ids
+	 * unanswered before a non-tool message.
+	 */
+	attachToolImage?: (toolId: string, image: AttachedImage) => void
+	/** Drain every image buffered this batch (insertion order), clearing the buffer. */
+	takePendingToolImages?: () => AttachedImage[]
 }
 
 export function createToolDef(
diff --git a/frontend/src/lib/components/copilot/lib.test.ts b/frontend/src/lib/components/copilot/lib.test.ts
index ccc8b85a65..17a7ad6508 100644
--- a/frontend/src/lib/components/copilot/lib.test.ts
+++ b/frontend/src/lib/components/copilot/lib.test.ts
@@ -14,6 +14,7 @@ import { parseFimCompletionChoice } from './fim'
 import {
 	getKnownModelContextWindow,
 	getModelContextWindow,
+	modelSupportsVision,
 	requiresMaxCompletionTokens
 } from './modelConfig'
 import { supportsAutocomplete } from './utils'
@@ -255,3 +256,40 @@ describe('model context windows', () => {
 		expect(getModelContextWindow('some-custom-model')).toBe(128000)
 	})
 })
+
+describe('modelSupportsVision', () => {
+	// One listed pair pins the lookup mechanism (exact pair match, case-insensitive
+	// model ids); the set's contents are data, not behavior.
+	it('refuses images on a listed provider:model pair', () => {
+		expect(modelSupportsVision('groq' as any, 'llama-3.3-70b-versatile')).toBe(false)
+		expect(modelSupportsVision('azure_foundry' as any, 'DeepSeek-R1')).toBe(false)
+	})
+
+	// The reason this is an exact-match set. Each of these WOULD be wrongly blocked
+	// by a substring of an entry above, and each takes images via its API.
+	it.each([
+		['azure_foundry', 'Mistral-Large-3'], // substring of 'mistral-large-2411'
+		['azure_foundry', 'Phi-4-multimodal-instruct'], // substring of 'phi-4'
+		['openrouter', 'meta-llama/llama-3.2-90b-vision-instruct'], // 'llama-3.2-...'
+		['groq', 'meta-llama/llama-4-scout-17b-16e-instruct'],
+		['groq', 'qwen/qwen3.6-27b']
+	])('does not let a text-only id shadow the vision model %s/%s', (provider, model) => {
+		expect(modelSupportsVision(provider as any, model)).toBe(true)
+	})
+
+	// Permissive by design: a wrong "no" blocks a working model with no override,
+	// while a wrong "yes" costs one turn and the failure path recovers it.
+	it('allows unknown and custom models', () => {
+		expect(modelSupportsVision('customai' as any, 'some-internal-vlm')).toBe(true)
+		expect(modelSupportsVision('deepseek' as any, 'deepseek-v9-sees-everything')).toBe(true)
+		expect(modelSupportsVision(undefined, undefined)).toBe(true)
+	})
+
+	// The reason entries are keyed by provider, not id alone: an id proves nothing
+	// about a different endpoint. A Custom AI deployment serving a vision model
+	// under a colliding name must not inherit another provider's verdict.
+	it("does not apply one provider's text-only verdict to another provider's model", () => {
+		expect(modelSupportsVision('customai' as any, 'deepseek-chat')).toBe(true)
+		expect(modelSupportsVision('customai' as any, 'llama-3.3-70b-versatile')).toBe(true)
+	})
+})
diff --git a/frontend/src/lib/components/copilot/lib.ts b/frontend/src/lib/components/copilot/lib.ts
index 6670789404..ed36c8e42d 100644
--- a/frontend/src/lib/components/copilot/lib.ts
+++ b/frontend/src/lib/components/copilot/lib.ts
@@ -17,7 +17,12 @@ import { EDIT_CONFIG, FIX_CONFIG, GEN_CONFIG } from './prompts'
 import { requiresMaxCompletionTokens, usesAnthropicMessagesApi } from './modelConfig'
 import { applyReasoningToConfig } from './reasoningRegistry'
 import { formatResourceTypes } from './utils'
-import { processToolCall, type Tool, type ToolCallbacks } from './chat/shared'
+import {
+	appendPendingToolImages,
+	processToolCall,
+	type Tool,
+	type ToolCallbacks
+} from './chat/shared'
 import { hasValidToolCallArguments } from './chat/toolCallArguments'
 import {
 	getNonStreamingOpenAIResponsesCompletion,
@@ -1260,6 +1265,7 @@ export async function parseOpenAICompletion(
 			messages.push(messageToAdd)
 			addedMessages.push(messageToAdd)
 		}
+		appendPendingToolImages(messages, addedMessages, callbacks)
 	} else if (malformedFunctionCallError) {
 		// Malformed function call with no tool calls - create artificial tool call to inform AI
 		const fakeToolCallId = generateRandomString()
diff --git a/frontend/src/lib/components/copilot/modelConfig.ts b/frontend/src/lib/components/copilot/modelConfig.ts
index af0dd942b2..62e5a3542a 100644
--- a/frontend/src/lib/components/copilot/modelConfig.ts
+++ b/frontend/src/lib/components/copilot/modelConfig.ts
@@ -72,3 +72,69 @@ export function getModelContextWindow(model: string) {
 	// Trim/compaction logic needs a number; assume a conservative window when unknown.
 	return getKnownModelContextWindow(model) ?? 128000
 }
+
+/**
+ * Best-effort check that a model can accept image input. There is no per-model vision
+ * metadata in the codebase, so this is deliberately permissive: it returns true unless
+ * the model is a known text-only one that would 400 on an image part. Used to gate the
+ * image-attach affordance and the screenshot follow-up; when unsure it allows the image
+ * (the user explicitly attached it — better to try than to silently drop it).
+ */
+export function modelSupportsVision(
+	provider: AIProvider | undefined,
+	model: string | undefined
+): boolean {
+	if (!provider) return true
+	return !TEXT_ONLY_MODELS.has(`${provider}:${(model ?? '').toLowerCase()}`)
+}
+
+/**
+ * Models whose provider API refuses image content, matched by exact
+ * `provider:model` pair — not by id alone, because an id proves nothing about a
+ * different endpoint (a Custom AI deployment may serve a vision model under a
+ * name that collides with someone's text-only id, and there is no override).
+ *
+ * The question is not whether a model can see, but whether its provider's API
+ * accepts image parts — the two diverge, and the divergence is invisible from a
+ * name: DeepSeek V4 ships vision in its chat UI while its API has no image
+ * content type, and o3-mini gained vision in ChatGPT that the API never exposed.
+ * So this is a cache of one provider's API surface at one moment, and it rots.
+ * Wrong entries are asymmetric: a missing one costs a single turn and
+ * self-corrects (the request fails, the image is dropped, the user is told),
+ * while a wrong one blocks a working model with no override. Hence exact pairs
+ * only, and only where a provider doc says so.
+ *
+ * Substrings are specifically avoided: `mistral-large` would also match
+ * Mistral Large 3, which does take images, and `phi-4` would match
+ * Phi-4-multimodal, which does too.
+ */
+const TEXT_ONLY_MODELS = new Set([
+	'openai:o1-mini',
+	'openai:o3-mini',
+	'azure_openai:o1-mini',
+	'azure_openai:o3-mini',
+	'mistral:codestral-latest',
+	// deepseek — vision exists in their chat product, not in the API
+	'deepseek:deepseek-v4-pro',
+	'deepseek:deepseek-v4-flash',
+	'deepseek:deepseek-chat',
+	'deepseek:deepseek-reasoner',
+	'groq:llama-3.3-70b-versatile',
+	'groq:llama-3.1-8b-instant',
+	// gpt-oss (text-only everywhere it is hosted) — on groq it succeeds the two
+	// llama defaults above, which retire 2026-08-16
+	'groq:openai/gpt-oss-120b',
+	'groq:openai/gpt-oss-20b',
+	'openrouter:openai/gpt-oss-120b',
+	'openrouter:openai/gpt-oss-20b',
+	'togetherai:openai/gpt-oss-120b',
+	'togetherai:openai/gpt-oss-20b',
+	// azure_foundry serves DeepSeek-V4-Pro under the same id as deepseek's API
+	'azure_foundry:deepseek-v4-pro',
+	'azure_foundry:deepseek-r1',
+	'azure_foundry:llama-3.3-70b-instruct',
+	'azure_foundry:phi-4',
+	'azure_foundry:mistral-large-2411',
+	'openrouter:meta-llama/llama-3.2-3b-instruct:free',
+	'togetherai:meta-llama/llama-3.3-70b-instruct-turbo'
+])
diff --git a/frontend/src/lib/components/raw_apps/RawAppEditor.svelte b/frontend/src/lib/components/raw_apps/RawAppEditor.svelte
index 36988384f7..f97bef9706 100644
--- a/frontend/src/lib/components/raw_apps/RawAppEditor.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppEditor.svelte
@@ -23,7 +23,8 @@
 		type RawAppRuntimeLogEntry,
 		type RawAppRuntimeLogRequester,
 		type RawAppRunSummary,
-		type RawAppRunsProvider
+		type RawAppRunsProvider,
+		type RawAppScreenshotRequester
 	} from './utils'
 	import DarkModeObserver from '../DarkModeObserver.svelte'
 	import RawAppSidebar from './RawAppSidebar.svelte'
@@ -37,6 +38,7 @@
 		InspectorElementInfo
 	} from '../copilot/chat/app/core'
 	import { createAppSelectedContext, type AppCodeSelectionElement } from '../copilot/chat/context'
+	import { captureScale, MAX_IMAGE_EDGE } from '../copilot/chat/imageUtils'
 	import { rawAppLintStore } from './lintStore'
 	import { dbSchemas } from '$lib/stores'
 	import {
@@ -125,6 +127,7 @@
 		onOpenOthersDrafts?: () => void
 		onRuntimeLogRequester?: (requester: RawAppRuntimeLogRequester | undefined) => void
 		onRunsProvider?: (provider: RawAppRunsProvider | undefined) => void
+		onScreenshotRequester?: (requester: RawAppScreenshotRequester | undefined) => void
 		// Restoring an older deployment from the history drawer. A callback prop
 		// (not `on:restore` forwarding): forwarding a `createEventDispatcher`
 		// event up through these runes-mode components silently drops it.
@@ -166,6 +169,7 @@
 		onOpenOthersDrafts,
 		onRuntimeLogRequester = undefined,
 		onRunsProvider = undefined,
+		onScreenshotRequester = undefined,
 		onRestore,
 		onSavedNewAppPath,
 		condensedHeader = false
@@ -1352,12 +1356,121 @@
 		return out.reverse()
 	}
 
+	// Only values whose non-wrapping counterpart collapses whitespace identically.
+	// `pre-line`/`break-spaces` have no such counterpart: forcing them to nowrap
+	// would eat their preserved newlines, so they are left to re-wrap.
+	const NON_WRAPPING_EQUIVALENT: Record<string, string> = {
+		normal: 'nowrap',
+		'pre-wrap': 'pre'
+	}
+
+	// getClientRects yields a rect per contained node, not per line box, so the
+	// count alone says nothing: `a <b>b</b>` is two rects on one line. Rects
+	// sharing a line overlap vertically, and `top` alone would split a line that
+	// mixes font sizes — so count vertically disjoint runs.
+	function countLines(range: Range): number {
+		const rects = Array.from(range.getClientRects()).filter((r) => r.width > 0 || r.height > 0)
+		if (rects.length === 0) return 0
+		rects.sort((a, b) => a.top - b.top)
+		let lines = 1
+		let lineBottom = rects[0].bottom
+		for (const r of rects) {
+			if (r.top >= lineBottom) {
+				lines++
+				lineBottom = r.bottom
+			} else {
+				lineBottom = Math.max(lineBottom, r.bottom)
+			}
+		}
+		return lines
+	}
+
+	// A box that shrink-wraps its text can have zero sub-pixel slack (a 208.59px box
+	// holding a 208.59px text run). The capture re-runs layout in whole pixels, so
+	// the text no longer fits, wraps, and is then clipped out of the box entirely.
+	// Pinning runs that are already single-line is a no-op on the live DOM but stops
+	// the re-layout from re-deciding where they break.
+	function pinSingleLineText(root: HTMLElement): () => void {
+		const doc = root.ownerDocument
+		const view = doc.defaultView
+		if (!view) return () => {}
+		// Measure every candidate before mutating any of them: interleaving reads and
+		// writes forces a synchronous reflow per element.
+		const pending: Array<[HTMLElement, string]> = []
+		const walker = doc.createTreeWalker(root, NodeFilter.SHOW_ELEMENT)
+		let node: Node | null
+		while ((node = walker.nextNode())) {
+			const el = node as HTMLElement
+			if (!(el instanceof view.HTMLElement)) continue
+			const hasOwnText = Array.from(el.childNodes).some(
+				(c) => c.nodeType === Node.TEXT_NODE && (c.textContent ?? '').trim() !== ''
+			)
+			if (!hasOwnText) continue
+			const replacement = NON_WRAPPING_EQUIVALENT[view.getComputedStyle(el).whiteSpace]
+			if (!replacement) continue
+			const range = doc.createRange()
+			range.selectNodeContents(el)
+			if (countLines(range) !== 1) continue // already wraps — leave its breaks alone
+			pending.push([el, replacement])
+		}
+		const restores = pending.map(([el, replacement]) => {
+			const prev = el.style.getPropertyValue('white-space')
+			const prio = el.style.getPropertyPriority('white-space')
+			el.style.setProperty('white-space', replacement, 'important')
+			return () => {
+				if (prev) el.style.setProperty('white-space', prev, prio)
+				else el.style.removeProperty('white-space')
+			}
+		})
+		return () => restores.forEach((r) => r())
+	}
+
+	// Capture the live preview as a PNG data URL. The preview iframe
+	// (/ui_builder/app-preview.html) is same-origin with no sandbox, so its rendered
+	// document is reachable and can be serialized from here. There is no native
+	// element-screenshot API; modern-screenshot reconstructs the DOM into an SVG
+	// foreignObject, so a WebGL canvas is only captured when its context was created
+	// with preserveDrawingBuffer. Lazy-imported so the library only loads on demand.
+	const captureScreenshot: RawAppScreenshotRequester = async () => {
+		const target = previewIframe?.contentDocument?.body
+		if (!previewIframe || !previewIframeLoaded || !target) {
+			throw new Error('App preview is not ready')
+		}
+		// Collapsing the preview leaves the iframe mounted and populated at zero
+		// width, which passes every check above and then fails inside the rasteriser
+		// as an opaque decode error. Name the cause so the agent can act on it.
+		if (!target.clientWidth || !target.clientHeight) {
+			throw new Error(
+				'The app preview is collapsed, so there is nothing to capture. Ask the user to expand the preview panel, then try again.'
+			)
+		}
+		const { domToPng } = await import('modern-screenshot')
+		// Above CSS resolution for small previews (a 1× capture of a ~900px preview
+		// reads blurry next to the live render), sub-1× for oversized bodies — see
+		// captureScale. maximumCanvasSize is the belt over that math: the rasterised
+		// box can exceed the body's client size, and an unbounded canvas on a tall
+		// scrolling app can freeze the tab before normalize ever bounds the pixels.
+		const scale = captureScale(Math.max(target.clientWidth, target.clientHeight))
+		const restore = pinSingleLineText(target)
+		try {
+			return await domToPng(target, {
+				backgroundColor: '#ffffff',
+				scale,
+				maximumCanvasSize: MAX_IMAGE_EDGE
+			})
+		} finally {
+			restore()
+		}
+	}
+
 	onMount(() => {
 		onRuntimeLogRequester?.(requestRuntimeLogs)
 		onRunsProvider?.(getRuns)
+		onScreenshotRequester?.(captureScreenshot)
 		return () => {
 			onRuntimeLogRequester?.(undefined)
 			onRunsProvider?.(undefined)
+			onScreenshotRequester?.(undefined)
 			for (const requestId of Array.from(pendingRuntimeLogReqs.keys()))
 				resolvePendingRuntimeLogRequest(requestId, undefined)
 		}
diff --git a/frontend/src/lib/components/raw_apps/utils.ts b/frontend/src/lib/components/raw_apps/utils.ts
index c0fba48e18..12dc7d87d4 100644
--- a/frontend/src/lib/components/raw_apps/utils.ts
+++ b/frontend/src/lib/components/raw_apps/utils.ts
@@ -137,6 +137,11 @@ export type RawAppRunSummary = {
 }
 export type RawAppRunsProvider = () => RawAppRunSummary[] | undefined
 
+/** Capture the live raw-app preview as a PNG data URL. Rejects when the preview
+ * isn't ready. Registered by the editor, dispatched by the session runtime for the
+ * global `take_screenshot` tool. */
+export type RawAppScreenshotRequester = () => Promise<string>
+
 export function formatAppRunsForChat(runs: RawAppRunSummary[]): string {
 	return JSON.stringify(runs, null, 2)
 }
diff --git a/frontend/src/lib/components/sessions/RawAppEditorView.svelte b/frontend/src/lib/components/sessions/RawAppEditorView.svelte
index cda34b9dac..d276c6a93b 100644
--- a/frontend/src/lib/components/sessions/RawAppEditorView.svelte
+++ b/frontend/src/lib/components/sessions/RawAppEditorView.svelte
@@ -9,7 +9,8 @@
 	import { invalidateWorkspaceDrafts } from '$lib/workspaceDrafts.svelte'
 	import type {
 		RawAppRuntimeLogRequester,
-		RawAppRunsProvider
+		RawAppRunsProvider,
+		RawAppScreenshotRequester
 	} from '$lib/components/raw_apps/utils'
 
 	let {
@@ -83,6 +84,21 @@
 	function registerRunsProvider(provider: RawAppRunsProvider | undefined) {
 		runtime.setAppRunsProvider(provider)
 	}
+
+	// The preview host keeps every opened tab mounted, so registering on mount would
+	// leave a background tab owning the runtime's single screenshot slot and
+	// take_screenshot would capture an app the user isn't looking at. Ownership
+	// follows the visible tab instead, and only the owner may release it.
+	let screenshotRequester = $state<RawAppScreenshotRequester | undefined>(undefined)
+	function registerScreenshotRequester(requester: RawAppScreenshotRequester | undefined) {
+		screenshotRequester = requester
+	}
+	$effect(() => {
+		const requester = screenshotRequester
+		if (!active || !requester) return
+		runtime.setScreenshotRequester(requester)
+		return () => runtime.clearScreenshotRequester(requester)
+	})
 </script>
 
 {#if cell.saved.val}
@@ -141,6 +157,7 @@
 				defaultSplitWithPreview={false}
 				onRuntimeLogRequester={registerRuntimeLogRequester}
 				onRunsProvider={registerRunsProvider}
+				onScreenshotRequester={registerScreenshotRequester}
 			/>
 		{/if}
 	{/snippet}
diff --git a/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts b/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts
index c8f523e799..81abca977b 100644
--- a/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts
+++ b/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts
@@ -60,6 +60,7 @@ import {
 	setGetPreviewStatusHandler,
 	setGetRuntimeLogsHandler,
 	setListAppRunsHandler,
+	setScreenshotHandler,
 	setOpenPagePreviewHandler,
 	setOpenPreviewHandler
 } from '$lib/components/copilot/chat/global/core'
@@ -69,7 +70,8 @@ import {
 	type RawAppRuntimeLogEntry,
 	type RawAppRuntimeLogRequester,
 	type RawAppRunSummary,
-	type RawAppRunsProvider
+	type RawAppRunsProvider,
+	type RawAppScreenshotRequester
 } from '$lib/components/raw_apps/utils'
 import { getNonStreamingMetadataCompletion } from '$lib/components/copilot/lib'
 import type { DisplayMessage } from '$lib/components/copilot/chat/shared'
@@ -174,6 +176,10 @@ export interface SessionRuntime {
 	requestRuntimeLogs(limit: number): Promise<RawAppRuntimeLogEntry[] | undefined>
 	setAppRunsProvider(provider: RawAppRunsProvider | undefined): void
 	getAppRuns(): RawAppRunSummary[] | undefined
+	setScreenshotRequester(requester: RawAppScreenshotRequester | undefined): void
+	/** Release the slot only if `requester` still owns it. */
+	clearScreenshotRequester(requester: RawAppScreenshotRequester): void
+	requestScreenshot(): Promise<string | undefined>
 	// Discard the local draft + force-reload the editor, so the preview matches
 	// the deployed version. Used by editor onDeploy + the chat deploy handler.
 	syncPreviewWithDeployed(
@@ -446,6 +452,7 @@ function createRuntime(session: Session): SessionRuntime {
 
 	let runtimeLogRequester: RawAppRuntimeLogRequester | undefined = undefined
 	let appRunsProvider: RawAppRunsProvider | undefined = undefined
+	let screenshotRequester: RawAppScreenshotRequester | undefined = undefined
 
 	return {
 		sessionId: session.id,
@@ -775,6 +782,19 @@ function createRuntime(session: Session): SessionRuntime {
 		},
 		getAppRuns() {
 			return appRunsProvider ? appRunsProvider() : undefined
+		},
+		setScreenshotRequester(requester) {
+			screenshotRequester = requester
+		},
+		clearScreenshotRequester(requester) {
+			// Tabs unmount in any order and several stay mounted at once, so a
+			// departing tab must not unregister whichever one now owns the slot.
+			if (screenshotRequester === requester) {
+				screenshotRequester = undefined
+			}
+		},
+		async requestScreenshot() {
+			return screenshotRequester ? screenshotRequester() : undefined
 		}
 	}
 }
@@ -1047,6 +1067,34 @@ setListAppRunsHandler(({ sessionId: callerSessionId, limit }) => {
 	}
 })
 
+setScreenshotHandler(async ({ sessionId: callerSessionId }) => {
+	const sessionId = callerSessionId ?? sessionState.currentSessionId
+	const runtime = sessionId ? runtimes.get(sessionId) : undefined
+	if (!runtime) {
+		return {
+			error:
+				'Error: take_screenshot is only available inside an AI session. Tell the user screenshots can only be captured from a session preview.',
+			uiMessage: 'Screenshot unavailable'
+		}
+	}
+	try {
+		const dataUrl = await runtime.requestScreenshot()
+		if (dataUrl === undefined) {
+			return {
+				error:
+					'No raw app preview is open for this session, so there is nothing to screenshot. Next step: call open_preview with kind="raw_app" and the app path, wait for it to load, then call take_screenshot again.',
+				uiMessage: 'Screenshot unavailable'
+			}
+		}
+		return { dataUrl }
+	} catch (e) {
+		return {
+			error: `Could not capture the app preview: ${e instanceof Error ? e.message : String(e)}`,
+			uiMessage: 'Screenshot failed'
+		}
+	}
+})
+
 export function getSessionChatStatus(runtime: SessionRuntime): SessionChatStatus {
 	const m = runtime.manager
 	if (m.loading) return 'streaming'
diff --git a/frontend/src/lib/isChromiumBrowser.test.ts b/frontend/src/lib/isChromiumBrowser.test.ts
new file mode 100644
index 0000000000..59e325e407
--- /dev/null
+++ b/frontend/src/lib/isChromiumBrowser.test.ts
@@ -0,0 +1,45 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { isChromiumBrowser } from './utils'
+
+// Gates Chromium-only capabilities (DOM screenshot capture). A wrong "true" on
+// Gecko/WebKit re-enables the capture path whose spacing/wrapping artifacts the
+// gate exists to avoid; a wrong "false" on Chromium silently drops the tool.
+describe('isChromiumBrowser', () => {
+	afterEach(() => {
+		vi.unstubAllGlobals()
+	})
+
+	it('detects Chromium via userAgentData brands (any Chromium-based browser)', () => {
+		vi.stubGlobal('navigator', {
+			userAgentData: {
+				brands: [
+					{ brand: 'Not-A.Brand', version: '99' },
+					{ brand: 'Chromium', version: '138' },
+					{ brand: 'Microsoft Edge', version: '138' }
+				]
+			},
+			userAgent: 'anything'
+		})
+		expect(isChromiumBrowser()).toBe(true)
+	})
+
+	it('falls back to the UA string when userAgentData is absent (older Chromium)', () => {
+		vi.stubGlobal('navigator', {
+			userAgent:
+				'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36'
+		})
+		expect(isChromiumBrowser()).toBe(true)
+	})
+
+	it('is false on Firefox ("Chrome/" never appears in a Gecko UA)', () => {
+		vi.stubGlobal('navigator', {
+			userAgent: 'Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0'
+		})
+		expect(isChromiumBrowser()).toBe(false)
+	})
+
+	it('is false with no navigator at all (SSR)', () => {
+		vi.stubGlobal('navigator', undefined)
+		expect(isChromiumBrowser()).toBe(false)
+	})
+})
diff --git a/frontend/src/lib/utils.ts b/frontend/src/lib/utils.ts
index fd57862f3b..3dd3c722bf 100644
--- a/frontend/src/lib/utils.ts
+++ b/frontend/src/lib/utils.ts
@@ -844,6 +844,21 @@ export function isMac(): boolean {
 	return navigator.userAgent.indexOf('Mac OS X') !== -1
 }
 
+/**
+ * True on Chromium-based browsers (Chrome, Edge, Brave, Opera, ...). Gates
+ * capabilities that are only faithful on Blink, e.g. DOM screenshot capture.
+ * userAgentData is itself Chromium-only; the UA fallback covers Chromium
+ * versions predating it ("Chrome/" never appears in Gecko or WebKit UAs).
+ */
+export function isChromiumBrowser(): boolean {
+	if (typeof navigator === 'undefined') return false
+	const brands = (navigator as any).userAgentData?.brands
+	if (Array.isArray(brands)) {
+		return brands.some((entry) => typeof entry?.brand === 'string' && /chromium/i.test(entry.brand))
+	}
+	return /chrome\//i.test(navigator.userAgent)
+}
+
 export function getModifierKey(): string {
 	return isMac() ? '⌘' : 'Ctrl+'
 }

From 8828341a2b0912cbf44d6c6d81b4f4e30c5fe631 Mon Sep 17 00:00:00 2001
From: Guilhem <guilhemlemouel@gmail.com>
Date: Fri, 17 Jul 2026 19:48:08 +0200
Subject: [PATCH 041/171] fix(frontend): scope session pipeline trigger editors
 to the session workspace (#10032)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix(frontend): scope session pipeline trigger editors to the session workspace

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(frontend): hoist triggerWorkspace decl above GCP init-time getBaseUrl call

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(frontend): scope nested trigger pickers to the session workspace

The triggerWorkspace resolver scoped direct trigger CRUD calls to the
session's (forked) workspace, but nested pickers still defaulted to the
nav `$workspaceStore`: in a fork session, resource lists/creation,
variable creation, and path-existence checks ran against the parent
workspace while save/delete targeted the fork — misleading options and
false path-validation failures.

Thread `wsId` into the nested controls of the 9 pipeline-canvas kinds:
- `<Path workspaceOverride={wsId}>` (8 editors) — path + folder checks
- `<ResourcePicker workspace={wsId}>` (6 config sections; add the
  resolver to MqttEditorConfigSection, which lacked `wsId`)
- SQS `<VariableEditor workspace={wsId}>` — variable creation

Also drop the per-site `wsId` rationale comment repeated across ~20
files; the invariant is documented once in triggerWorkspace.ts.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(frontend): scope trigger runnable picker to the session workspace

The runnable picker (`ScriptPicker`, reached via `TriggerRunnablePicker`
and directly in the schedule editor) listed scripts/flows/apps from the
nav `$workspaceStore` with no override, so a forked session offered the
parent workspace's runnables when attaching a script/flow to a trigger.

Add an optional `workspace` prop to `ScriptPicker` (defaults to
`$workspaceStore` → no change for existing callers), pass it through
`TriggerRunnablePicker`, and wire `wsId` from the 7 trigger editors that
use it plus the schedule editor's 3 direct pickers.

Completes the nested-picker workspace scoping; the excluded kinds
(azure/http/websocket/native) keep their own ScriptPickers unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(frontend): scope trigger error-handler, folder default, and runnable actions

Follow-up to the trigger-workspace scoping: three subtrees still read the
nav `$workspaceStore` in a forked session.

- ErrorOrRecoveryHandler (via TriggerRetriesAndErrorHandler in the 7 in-scope
  editors): add a `workspace` prop (defaults to `$workspaceStore`) and route
  handler lookup/schema, Slack/Teams settings, test jobs, and run links
  through it, so the error handler is resolved/tested/saved in the session
  workspace instead of A while the trigger lives in B.
- useFolderDefaultPermissionedAs: accept an optional workspace getter so a
  `f/...` trigger's default permissioned-as is read from the session
  workspace, not the nav one (PermissionedAsLine passes `() => wsId`).
- ScriptPicker actions: scope the View drawer (`getScriptByPath`) and
  `FlowPathViewer` to `effectiveWorkspace`, and carry `?workspace=` onto the
  Edit/View routes when an explicit override is set (the layout consumes the
  param, same mechanism as editInFork). The param is only appended when a
  workspace override is passed, so existing callers' links are unchanged.

Also consolidate the repeated workspace-scoping comment in
PipelineTriggerEditors (the invariant lives in triggerWorkspace.ts).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(frontend): scope error-handler/schedule nested consumers to the session workspace

Address CI Codex review on #10032 — the error-handler and schedule
subtrees still had nested consumers reading the nav workspace:

- ErrorOrRecoveryHandler: pass the resolved workspace to its own nested
  `ScriptPicker` (custom-handler list + View/Edit) and add a `workspace`
  prop to `ChannelSelector` (Teams channel listing); carry the acting
  workspace onto the "create from template" link.
- ScheduleEditorInner: pass `workspace={wsId}` to the error/recovery/
  success `ErrorOrRecoveryHandler` panels, `workspaceId={wsId}` to
  `WorkerTagPicker`, and the workspace query param onto the dynamic-skip
  template link.

Template-link and picker overrides only diverge from `$workspaceStore`
when a session override is set, so non-session callers are unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../src/lib/components/ChannelSelector.svelte | 20 +++----
 .../components/ErrorOrRecoveryHandler.svelte  | 43 +++++++++-----
 .../src/lib/components/ScriptPicker.svelte    | 35 +++++++----
 .../AssetGraph/PipelineTriggerEditors.svelte  | 13 +++--
 .../flows/content/FlowPathViewer.svelte       |  7 ++-
 .../sessions/PipelineEditorView.svelte        | 11 ++--
 .../triggers/PermissionedAsLine.svelte        | 14 +++--
 .../triggers/TestTriggerConnection.svelte     | 17 +++---
 .../TriggerRetriesAndErrorHandler.svelte      |  5 +-
 .../triggers/TriggerRunnablePicker.svelte     |  3 +
 .../triggers/TriggerSuspendedJobsModal.svelte |  5 +-
 .../components/triggers/TriggerTokens.svelte  |  9 ++-
 .../EmailTriggerEditorConfigSection.svelte    |  7 ++-
 .../email/EmailTriggerEditorInner.svelte      | 14 +++--
 .../gcp/GcpTriggerEditorConfigSection.svelte  | 15 +++--
 .../triggers/gcp/GcpTriggerEditorInner.svelte | 14 +++--
 .../kafka/KafkaTriggerEditorInner.svelte      | 16 +++--
 .../kafka/KafkaTriggersConfigSection.svelte   |  6 +-
 .../mqtt/MqttEditorConfigSection.svelte       | 12 +++-
 .../mqtt/MqttTriggerEditorInner.svelte        | 14 +++--
 .../nats/NatsTriggerEditorInner.svelte        | 14 +++--
 .../nats/NatsTriggersConfigSection.svelte     |  8 ++-
 .../postgres/CheckPostgresRequirement.svelte  |  5 +-
 .../PostgresTriggerEditorInner.svelte         | 27 +++++----
 .../postgres/PublicationPicker.svelte         | 11 ++--
 .../triggers/postgres/SlotPicker.svelte       |  7 ++-
 .../schedules/ScheduleEditorInner.svelte      | 58 ++++++++++++-------
 .../sqs/SqsTriggerEditorConfigSection.svelte  | 15 +++--
 .../triggers/sqs/SqsTriggerEditorInner.svelte | 14 +++--
 .../components/triggers/triggerWorkspace.ts   | 29 ++++++++++
 .../webhook/WebhooksConfigSection.svelte      | 11 ++--
 .../useFolderDefaultPermissionedAs.svelte.ts  | 13 +++--
 32 files changed, 346 insertions(+), 146 deletions(-)
 create mode 100644 frontend/src/lib/components/triggers/triggerWorkspace.ts

diff --git a/frontend/src/lib/components/ChannelSelector.svelte b/frontend/src/lib/components/ChannelSelector.svelte
index 3211fe914a..d7a720d877 100644
--- a/frontend/src/lib/components/ChannelSelector.svelte
+++ b/frontend/src/lib/components/ChannelSelector.svelte
@@ -21,6 +21,9 @@
 		showRefreshButton?: boolean
 		onError?: (error: Error) => void
 		onSelectedChannelChange?: (channel: ChannelItem | undefined) => void
+		/** Workspace to list Teams channels from; defaults to the nav
+		 * `$workspaceStore`. A forked session passes its acting workspace. */
+		workspace?: string
 	}
 
 	let {
@@ -33,9 +36,12 @@
 		teamId,
 		showRefreshButton = true,
 		onError,
-		onSelectedChannelChange
+		onSelectedChannelChange,
+		workspace = undefined
 	}: Props = $props()
 
+	let effectiveWorkspace = $derived(workspace ?? $workspaceStore)
+
 	let isFetching = $state(false)
 	let loadedChannels = $state<ChannelItem[]>([])
 	let loadedForTeamId = $state<string | undefined>(undefined)
@@ -88,7 +94,7 @@
 		isFetching = true
 		try {
 			const response = await WorkspaceService.listAvailableTeamsChannels({
-				workspace: $workspaceStore!,
+				workspace: effectiveWorkspace!,
 				teamId: teamId
 			})
 
@@ -130,10 +136,7 @@
 						clearable
 						disabled={disabled || !teamId}
 						loading={isFetching}
-						bind:value={
-							() => selectedChannel?.channel_id,
-							(newId) => setSelectedChannelById(newId)
-						}
+						bind:value={() => selectedChannel?.channel_id, (newId) => setSelectedChannelById(newId)}
 					/>
 				{:else}
 					<Select
@@ -147,10 +150,7 @@
 						{placeholder}
 						clearable
 						disabled={disabled || displayChannels.length === 0}
-						bind:value={
-							() => selectedChannel?.channel_id,
-							(newId) => setSelectedChannelById(newId)
-						}
+						bind:value={() => selectedChannel?.channel_id, (newId) => setSelectedChannelById(newId)}
 					/>
 				{/if}
 			</div>
diff --git a/frontend/src/lib/components/ErrorOrRecoveryHandler.svelte b/frontend/src/lib/components/ErrorOrRecoveryHandler.svelte
index e34085c37e..330275ee75 100644
--- a/frontend/src/lib/components/ErrorOrRecoveryHandler.svelte
+++ b/frontend/src/lib/components/ErrorOrRecoveryHandler.svelte
@@ -81,6 +81,10 @@
 		customHandlerKind?: 'flow' | 'script'
 		customTabTooltip?: import('svelte').Snippet
 		noMargin?: boolean
+		/** Workspace for handler lookup / settings / test jobs. Defaults to the
+		 * nav `$workspaceStore`; a trigger editor in a forked session passes its
+		 * acting workspace so the handler is resolved and saved there. */
+		workspace?: string
 	}
 
 	let {
@@ -94,9 +98,20 @@
 		customScriptTemplate,
 		customHandlerKind = $bindable('script'),
 		customTabTooltip,
-		noMargin = false
+		noMargin = false,
+		workspace = undefined
 	}: Props = $props()
 
+	let effectiveWorkspace = $derived(workspace ?? $workspaceStore)
+	// Carry the acting workspace onto the "create from template" route when an
+	// explicit override is set, so a forked session creates the handler script
+	// there. `customScriptTemplate` already has a query string (`?hub=…`).
+	let templateHref = $derived(
+		workspace
+			? `${customScriptTemplate}&workspace=${encodeURIComponent(workspace)}`
+			: customScriptTemplate
+	)
+
 	let customHandlerSchema: Schema | undefined = $state()
 	let slackHandlerSchema: Schema | undefined = $state()
 	let teams_team_name: string | undefined = $state(undefined)
@@ -113,7 +128,7 @@
 	const CHANNEL_KEY = 'channel'
 
 	async function loadSlackResources() {
-		const settings = await WorkspaceService.getPublicSettings({ workspace: $workspaceStore! })
+		const settings = await WorkspaceService.getPublicSettings({ workspace: effectiveWorkspace! })
 		if (!emptyString(settings.slack_name) && !emptyString(settings.slack_team_id)) {
 			workspaceConnectedToSlack = true
 			slack_team_name = settings.slack_name
@@ -124,7 +139,7 @@
 	}
 
 	async function loadTeamsResources() {
-		const settings = await WorkspaceService.getPublicSettings({ workspace: $workspaceStore! })
+		const settings = await WorkspaceService.getPublicSettings({ workspace: effectiveWorkspace! })
 		if (!emptyString(settings.teams_team_name) && !emptyString(settings.teams_team_id)) {
 			workspaceConnectedToTeams = true
 		} else {
@@ -155,11 +170,11 @@
 				: WorkspaceService.runTeamsMessageTestJob
 
 		let submitted_job = await testJobFunction({
-			workspace: $workspaceStore!,
+			workspace: effectiveWorkspace!,
 			requestBody: {
 				hub_script_path: handlerPath,
 				channel: channel,
-				test_msg: `This is a notification to test the connection between ${platform} and Windmill workspace '${$workspaceStore!}'`
+				test_msg: `This is a notification to test the connection between ${platform} and Windmill workspace '${effectiveWorkspace!}'`
 			}
 		})
 
@@ -171,7 +186,7 @@
 		tryEvery({
 			tryCode: async () => {
 				const testResult = await JobService.getCompletedJob({
-					workspace: $workspaceStore!,
+					workspace: effectiveWorkspace!,
 					id: connectionTestJob!.uuid
 				})
 				connectionTestJob!.in_progress = false
@@ -180,7 +195,7 @@
 			timeoutCode: async () => {
 				try {
 					await JobService.cancelQueuedJob({
-						workspace: $workspaceStore!,
+						workspace: effectiveWorkspace!,
 						id: connectionTestJob!.uuid,
 						requestBody: {
 							reason: 'Slack message not sent after 10s'
@@ -219,8 +234,8 @@
 			} else {
 				let scriptOrFlow: Script | Flow =
 					customHandlerKind === 'script'
-						? await ScriptService.getScriptByPath({ workspace: $workspaceStore!, path: p })
-						: await FlowService.getFlowByPath({ workspace: $workspaceStore!, path: p })
+						? await ScriptService.getScriptByPath({ workspace: effectiveWorkspace!, path: p })
+						: await FlowService.getFlowByPath({ workspace: effectiveWorkspace!, path: p })
 				schema = scriptOrFlow.schema as Schema
 			}
 			if (schema && schema.properties) {
@@ -278,7 +293,7 @@
 	}
 
 	$effect(() => {
-		if ($workspaceStore) {
+		if (effectiveWorkspace) {
 			loadSlackResources()
 			loadTeamsResources()
 		}
@@ -377,6 +392,7 @@
 						bind:scriptPath={handlerPath}
 						bind:itemKind={customHandlerKind}
 						allowRefresh={isEditable}
+						workspace={effectiveWorkspace}
 						clearable
 					/>
 
@@ -385,7 +401,7 @@
 							btnClasses="ml-4 whitespace-nowrap"
 							variant="default"
 							size="xs"
-							href={customScriptTemplate}
+							href={templateHref}
 							disabled={!isEditable}
 							target="_blank"
 						>
@@ -493,7 +509,7 @@
 
 									<a
 										target="_blank"
-										href={`${base}/run/${connectionTestJob.uuid}?workspace=${$workspaceStore}`}
+										href={`${base}/run/${connectionTestJob.uuid}?workspace=${effectiveWorkspace}`}
 										class="inline-flex items-center gap-1"
 									>
 										{connectionTestJob.uuid}
@@ -550,6 +566,7 @@
 								containerClass="flex-grow"
 								minWidth="200px"
 								placeholder="Search Teams channels"
+								workspace={effectiveWorkspace}
 								teamId={teams_team_guid}
 								selectedChannel={handlerExtraArgs['channel']
 									? {
@@ -585,7 +602,7 @@
 								Message sent via Windmill job
 								<a
 									target="_blank"
-									href={`${base}/run/${connectionTestJob.uuid}?workspace=${$workspaceStore}`}
+									href={`${base}/run/${connectionTestJob.uuid}?workspace=${effectiveWorkspace}`}
 								>
 									{connectionTestJob.uuid}
 								</a>
diff --git a/frontend/src/lib/components/ScriptPicker.svelte b/frontend/src/lib/components/ScriptPicker.svelte
index 803684f49e..ccc3f04be7 100644
--- a/frontend/src/lib/components/ScriptPicker.svelte
+++ b/frontend/src/lib/components/ScriptPicker.svelte
@@ -30,6 +30,10 @@
 		allowEdit?: boolean
 		allowView?: boolean
 		clearable?: boolean
+		/** Workspace to list runnables from. Defaults to the navigation
+		 * `$workspaceStore`; pass the session's acting workspace so a forked
+		 * session lists its own scripts/flows/apps rather than the parent's. */
+		workspace?: string
 	}
 
 	let {
@@ -42,9 +46,15 @@
 		allowRefresh = false,
 		allowEdit = true,
 		allowView = true,
-		clearable = false
+		clearable = false,
+		workspace = undefined
 	}: Props = $props()
 
+	let effectiveWorkspace = $derived(workspace ?? $workspaceStore)
+	// Only carry the workspace onto Edit/View routes when an explicit override
+	// was passed, so existing callers' links are unchanged.
+	let wsParam = $derived(workspace ? `?workspace=${encodeURIComponent(workspace)}` : '')
+
 	let items: { value: string; label: string }[] = $state([])
 	let drawerViewer: Drawer | undefined = $state()
 	let drawerFlowViewer: Drawer | undefined = $state()
@@ -58,7 +68,7 @@
 	async function loadItems(): Promise<void> {
 		if (itemKind == 'flow') {
 			items = (
-				await FlowService.listFlows({ workspace: $workspaceStore!, withoutDescription: true })
+				await FlowService.listFlows({ workspace: effectiveWorkspace!, withoutDescription: true })
 			).map((flow) => ({
 				value: flow.path,
 				label: `${flow.path}${flow.summary ? ` | ${truncate(flow.summary, 20)}` : ''}`,
@@ -67,7 +77,7 @@
 		} else if (itemKind == 'script') {
 			items = (
 				await ScriptService.listScripts({
-					workspace: $workspaceStore!,
+					workspace: effectiveWorkspace!,
 					kinds: kinds.join(','),
 					withoutDescription: true
 				})
@@ -76,7 +86,7 @@
 				label: `${script.path}${script.summary ? ` | ${truncate(script.summary, 20)}` : ''}`
 			}))
 		} else if (itemKind == 'app') {
-			items = (await AppService.listApps({ workspace: $workspaceStore! })).map((app) => ({
+			items = (await AppService.listApps({ workspace: effectiveWorkspace! })).map((app) => ({
 				value: app.path,
 				label: `${app.path}${app.summary ? ` | ${truncate(app.summary, 20)}` : ''}`
 			}))
@@ -84,7 +94,7 @@
 	}
 
 	$effect(() => {
-		itemKind && $workspaceStore && untrack(() => loadItems())
+		itemKind && effectiveWorkspace && untrack(() => loadItems())
 	})
 	let darkMode: boolean = $state(false)
 </script>
@@ -99,7 +109,7 @@
 
 <Drawer bind:this={drawerFlowViewer} size="900px">
 	<DrawerContent title="Flow {scriptPath}" on:close={drawerFlowViewer.closeDrawer}>
-		<FlowPathViewer path={scriptPath ?? ''} />
+		<FlowPathViewer path={scriptPath ?? ''} workspace={effectiveWorkspace} />
 	</DrawerContent>
 </Drawer>
 
@@ -158,7 +168,7 @@
 						target="_blank"
 						variant="default"
 						size="xs"
-						href="{base}/flows/edit/{scriptPath}">Edit</Button
+						href="{base}/flows/edit/{scriptPath}{wsParam}">Edit</Button
 					>
 				{/if}
 				{#if allowView}
@@ -181,7 +191,7 @@
 						target="_blank"
 						variant="default"
 						size="xs"
-						href="{base}/apps/edit/{scriptPath}"
+						href="{base}/apps/edit/{scriptPath}{wsParam}"
 					>
 						Edit
 					</Button>
@@ -192,7 +202,7 @@
 						size="xs"
 						target="_blank"
 						startIcon={{ icon: Code }}
-						href="{base}/apps/get/{scriptPath}"
+						href="{base}/apps/get/{scriptPath}{wsParam}"
 					>
 						View
 					</Button>
@@ -206,7 +216,7 @@
 						target="_blank"
 						variant="default"
 						size="xs"
-						href="{base}/scripts/edit/{scriptPath}"
+						href="{base}/scripts/edit/{scriptPath}{wsParam}"
 					>
 						Edit
 					</Button>
@@ -217,7 +227,10 @@
 						size="xs"
 						startIcon={{ icon: Code }}
 						on:click={async () => {
-							const { language, content } = await getScriptByPath(scriptPath ?? '')
+							const { language, content } = await getScriptByPath(
+								scriptPath ?? '',
+								effectiveWorkspace
+							)
 							code = content
 							lang = language
 							drawerViewer?.openDrawer()
diff --git a/frontend/src/lib/components/assets/AssetGraph/PipelineTriggerEditors.svelte b/frontend/src/lib/components/assets/AssetGraph/PipelineTriggerEditors.svelte
index 3022063c4e..0a32929720 100644
--- a/frontend/src/lib/components/assets/AssetGraph/PipelineTriggerEditors.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/PipelineTriggerEditors.svelte
@@ -22,6 +22,7 @@
 	import EmailTriggerEditor from '$lib/components/triggers/email/EmailTriggerEditor.svelte'
 	import ScheduleEditor from '$lib/components/triggers/schedules/ScheduleEditor.svelte'
 	import WebhookEditor from '$lib/components/triggers/webhook/WebhookEditor.svelte'
+	import { setTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
 
 	// Owns the native-trigger drawer wiring for the pipeline canvas: the nine
 	// editor instances, the create/edit dispatch by kind, and the delete
@@ -34,8 +35,12 @@
 	// (matching the previous `{#if mode === 'edit'}` wrapper). The webhook
 	// editor stays mounted in every mode — its node is clickable in view mode
 	// too (informational endpoint URLs/token).
-	type Props = { onUpdate: () => void; mountTriggerEditors: boolean }
-	let { onUpdate, mountTriggerEditors }: Props = $props()
+	type Props = { onUpdate: () => void; mountTriggerEditors: boolean; workspace?: string }
+	let { onUpdate, mountTriggerEditors, workspace: triggerWorkspace }: Props = $props()
+
+	// Register the trigger-workspace resolver for the whole editor subtree (the
+	// nine editors + the delete handler below). See triggerWorkspace.ts.
+	setTriggerWorkspace(() => triggerWorkspace ?? $workspaceStore)
 
 	let kafkaEditor: KafkaTriggerEditor | undefined = $state()
 	let mqttEditor: MqttTriggerEditor | undefined = $state()
@@ -115,9 +120,9 @@
 	}
 
 	async function confirmDeleteAttachedTrigger() {
-		if (!triggerDeleteTarget || !$workspaceStore) return
+		const workspace = triggerWorkspace ?? $workspaceStore
+		if (!triggerDeleteTarget || !workspace) return
 		const { kind, path: triggerPath } = triggerDeleteTarget
-		const workspace = $workspaceStore
 		triggerDeleteLoading = true
 		try {
 			switch (kind) {
diff --git a/frontend/src/lib/components/flows/content/FlowPathViewer.svelte b/frontend/src/lib/components/flows/content/FlowPathViewer.svelte
index 649a4d9f6c..35b9be6ec4 100644
--- a/frontend/src/lib/components/flows/content/FlowPathViewer.svelte
+++ b/frontend/src/lib/components/flows/content/FlowPathViewer.svelte
@@ -15,12 +15,15 @@
 		path: string
 		noSide?: boolean
 		fillAvailableHeight?: boolean
+		/** Explicit workspace override; takes precedence over the flow-editor
+		 * `opWorkspace` context and the nav `$workspaceStore`. */
+		workspace?: string
 	}
 
-	let { path, noSide = false, fillAvailableHeight = false }: Props = $props()
+	let { path, noSide = false, fillAvailableHeight = false, workspace = undefined }: Props = $props()
 
 	const flowEditorContext = getContext<FlowEditorContext>('FlowEditorContext')
-	let opWs = $derived(flowEditorContext?.opWorkspace?.() ?? $workspaceStore)
+	let opWs = $derived(workspace ?? flowEditorContext?.opWorkspace?.() ?? $workspaceStore)
 
 	let flow: Flow | undefined = $state(undefined)
 
diff --git a/frontend/src/lib/components/sessions/PipelineEditorView.svelte b/frontend/src/lib/components/sessions/PipelineEditorView.svelte
index 3334427725..b1e461eb32 100644
--- a/frontend/src/lib/components/sessions/PipelineEditorView.svelte
+++ b/frontend/src/lib/components/sessions/PipelineEditorView.svelte
@@ -392,14 +392,13 @@
 
 <!-- Native trigger editor drawers (schedule/kafka/webhook/…), shared with the
      route page; opened imperatively from the canvas via the handlers above.
-     KNOWN LIMITATION: the whole native-trigger editor subsystem reads the global
-     `$workspaceStore` and exposes no workspace override, so trigger create/edit/
-     delete here targets the nav workspace — NOT this view's `workspaceId`.
-     SessionPicker intentionally does not switch `$workspaceStore` on activation,
-     so for a forked-workspace session these writes go to the wrong workspace.
-     Fixing it means threading a workspace override through the trigger editors. -->
+     `workspace={workspaceId}` scopes every trigger backend call to THIS
+     session's (possibly forked) workspace — a session never switches the global
+     `$workspaceStore` (SessionPicker), so without this the editors would write
+     to the nav workspace. -->
 <PipelineTriggerEditors
 	bind:this={triggerEditors}
 	mountTriggerEditors
+	workspace={workspaceId}
 	onUpdate={() => graphRes.refetch()}
 />
diff --git a/frontend/src/lib/components/triggers/PermissionedAsLine.svelte b/frontend/src/lib/components/triggers/PermissionedAsLine.svelte
index 33b50eb850..73d1220166 100644
--- a/frontend/src/lib/components/triggers/PermissionedAsLine.svelte
+++ b/frontend/src/lib/components/triggers/PermissionedAsLine.svelte
@@ -5,6 +5,7 @@
 	} from '$lib/components/OnBehalfOfSelector.svelte'
 	import { useFolderDefaultPermissionedAs } from '$lib/components/useFolderDefaultPermissionedAs.svelte'
 	import { userStore, workspaceStore } from '$lib/stores'
+	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
 	import { AlertTriangle } from 'lucide-svelte'
 
 	interface Props {
@@ -21,6 +22,8 @@
 	}
 
 	let { permissionedAs, onPermissionedAsChange, path = undefined }: Props = $props()
+	const triggerWs = getTriggerWorkspace()
+	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
 
 	const canPreserve = $derived(
 		$userStore?.is_admin || ($userStore?.groups ?? []).includes('wm_deployers')
@@ -28,7 +31,10 @@
 
 	const myPermissionedAs = $derived($userStore?.username ? `u/${$userStore.username}` : undefined)
 
-	const folderDefault = useFolderDefaultPermissionedAs(() => path)
+	const folderDefault = useFolderDefaultPermissionedAs(
+		() => path,
+		() => wsId
+	)
 
 	let onBehalfOfChoice = $state<OnBehalfOfChoice>(undefined)
 	let customPermissionedAs = $state<string | undefined>(undefined)
@@ -66,7 +72,7 @@
 			permissionedAs !== effectivePermissionedAs
 	)
 
-	const shouldRender = $derived(!!$workspaceStore && (permissionedAs !== undefined || canPreserve))
+	const shouldRender = $derived(!!wsId && (permissionedAs !== undefined || canPreserve))
 
 	// For non-admin users editing a trigger owned by someone else: signal that
 	// permissioned_as will change to the current user (backend ignores preserve for non-admins).
@@ -93,12 +99,12 @@
 	}
 </script>
 
-{#if shouldRender && $workspaceStore}
+{#if shouldRender && wsId}
 	<div class="flex items-center gap-1.5 text-2xs text-tertiary mb-4">
 		<span>Permissioned as</span>
 		{#if canPreserve}
 			<OnBehalfOfSelector
-				targetWorkspace={$workspaceStore}
+				targetWorkspace={wsId}
 				targetValue={permissionedAs}
 				selected={onBehalfOfChoice}
 				onSelect={handleSelect}
diff --git a/frontend/src/lib/components/triggers/TestTriggerConnection.svelte b/frontend/src/lib/components/triggers/TestTriggerConnection.svelte
index 92cc39fa3a..ec2ec5eb4b 100644
--- a/frontend/src/lib/components/triggers/TestTriggerConnection.svelte
+++ b/frontend/src/lib/components/triggers/TestTriggerConnection.svelte
@@ -10,6 +10,7 @@
 		GcpTriggerService
 	} from '$lib/gen'
 	import { workspaceStore } from '$lib/stores'
+	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
 	import { sendUserToast } from '$lib/toast'
 	import Button from '../common/button/Button.svelte'
 
@@ -26,6 +27,8 @@
 		noButton = false,
 		testLoading = $bindable(false)
 	}: Props = $props();
+	const triggerWs = getTriggerWorkspace()
+	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
 
 	const kindToName: { [key: string]: string } = {
 		websocket: 'WebSocket',
@@ -48,37 +51,37 @@
 		try {
 			if (kind === 'websocket') {
 				promise = WebsocketTriggerService.testWebsocketConnection({
-					workspace: $workspaceStore!,
+					workspace: wsId!,
 					requestBody: args as any
 				})
 			} else if (kind === 'nats') {
 				promise = NatsTriggerService.testNatsConnection({
-					workspace: $workspaceStore!,
+					workspace: wsId!,
 					requestBody: args as any
 				})
 			} else if (kind === 'kafka') {
 				promise = KafkaTriggerService.testKafkaConnection({
-					workspace: $workspaceStore!,
+					workspace: wsId!,
 					requestBody: args as any
 				})
 			} else if (kind === 'mqtt') {
 				promise = MqttTriggerService.testMqttConnection({
-					workspace: $workspaceStore!,
+					workspace: wsId!,
 					requestBody: args as any
 				})
 			} else if (kind === 'sqs') {
 				promise = SqsTriggerService.testSqsConnection({
-					workspace: $workspaceStore!,
+					workspace: wsId!,
 					requestBody: args as any
 				})
 			} else if (kind === 'postgres') {
 				promise = PostgresTriggerService.testPostgresConnection({
-					workspace: $workspaceStore!,
+					workspace: wsId!,
 					requestBody: args as any
 				})
 			} else if (kind === 'gcp') {
 				promise = GcpTriggerService.testGcpConnection({
-					workspace: $workspaceStore!,
+					workspace: wsId!,
 					requestBody: args as any
 				})
 			}
diff --git a/frontend/src/lib/components/triggers/TriggerRetriesAndErrorHandler.svelte b/frontend/src/lib/components/triggers/TriggerRetriesAndErrorHandler.svelte
index c4d599652f..86dbf31e46 100644
--- a/frontend/src/lib/components/triggers/TriggerRetriesAndErrorHandler.svelte
+++ b/frontend/src/lib/components/triggers/TriggerRetriesAndErrorHandler.svelte
@@ -14,7 +14,8 @@
 		errorHandlerSelected = $bindable(),
 		error_handler_path = $bindable(),
 		error_handler_args = $bindable(),
-		retry = $bindable()
+		retry = $bindable(),
+		workspace = undefined
 	}: {
 		optionTabSelected: 'error_handler' | 'retries' | string
 		itemKind: 'script' | 'flow'
@@ -23,6 +24,7 @@
 		error_handler_path: string | undefined
 		error_handler_args: Record<string, any>
 		retry: Retry | undefined
+		workspace?: string
 	} = $props()
 </script>
 
@@ -39,6 +41,7 @@
 		isEditable={can_write}
 		errorOrRecovery="error"
 		showScriptHelpText={true}
+		{workspace}
 		bind:handlerSelected={errorHandlerSelected}
 		bind:handlerPath={error_handler_path}
 		toggleText="Alert channel on error"
diff --git a/frontend/src/lib/components/triggers/TriggerRunnablePicker.svelte b/frontend/src/lib/components/triggers/TriggerRunnablePicker.svelte
index 208645182f..c6b0986226 100644
--- a/frontend/src/lib/components/triggers/TriggerRunnablePicker.svelte
+++ b/frontend/src/lib/components/triggers/TriggerRunnablePicker.svelte
@@ -18,6 +18,7 @@
 		isOperator: boolean
 		promptText?: string
 		promptClass?: string
+		workspace?: string
 		// Per-trigger "Create from template" button (hub URL, variant and any
 		// extra guard/tooltip differ per trigger kind, so the caller owns it).
 		createButton?: Snippet
@@ -32,6 +33,7 @@
 		isOperator,
 		promptText = 'Pick a script or flow to be triggered',
 		promptClass = 'text-xs mb-1 text-primary',
+		workspace = undefined,
 		createButton
 	}: Props = $props()
 </script>
@@ -52,6 +54,7 @@
 			bind:scriptPath
 			allowRefresh={canWrite}
 			allowEdit={!isOperator}
+			{workspace}
 			clearable
 		/>
 		{@render createButton?.()}
diff --git a/frontend/src/lib/components/triggers/TriggerSuspendedJobsModal.svelte b/frontend/src/lib/components/triggers/TriggerSuspendedJobsModal.svelte
index 8ad0bf6e6f..98bff3c722 100644
--- a/frontend/src/lib/components/triggers/TriggerSuspendedJobsModal.svelte
+++ b/frontend/src/lib/components/triggers/TriggerSuspendedJobsModal.svelte
@@ -20,6 +20,7 @@
 	} from '$lib/gen/types.gen'
 	import Button from '../common/button/Button.svelte'
 	import { workspaceStore } from '$lib/stores'
+	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
 	import { JobService, TriggerService } from '$lib/gen'
 	import { sendUserToast } from '$lib/toast'
 	import Cell from '$lib/components/table/Cell.svelte'
@@ -48,13 +49,15 @@
 	}
 
 	let { triggerKind, triggerPath, onToggleMode, hasChanged, runnableConfig }: Props = $props()
+	const triggerWs = getTriggerWorkspace()
+	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
 
 	let shouldShowModal = $state(false)
 	let queuedJobs = $state<QueuedJob[]>([])
 	let selectedJobs = $state<Set<string>>(new Set())
 	let loading = $state(false)
 	let processingAction = $state(false)
-	let workspace = $workspaceStore!
+	const workspace = $derived(wsId!)
 	let currentPage = $state(1)
 	let perPage = $state(20)
 	let hasMorePages = $derived(queuedJobs.length === perPage)
diff --git a/frontend/src/lib/components/triggers/TriggerTokens.svelte b/frontend/src/lib/components/triggers/TriggerTokens.svelte
index 11d0bfca74..044b89022a 100644
--- a/frontend/src/lib/components/triggers/TriggerTokens.svelte
+++ b/frontend/src/lib/components/triggers/TriggerTokens.svelte
@@ -3,6 +3,7 @@
 
 	import { FlowService, ScriptService, UserService, type TruncatedToken } from '$lib/gen'
 	import { userStore, workspaceStore } from '$lib/stores'
+	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
 	import { getContext } from 'svelte'
 	import { Skeleton } from '../common'
 	import Label from '../Label.svelte'
@@ -16,6 +17,8 @@
 	}
 
 	let { isFlow, path, labelPrefix }: Props = $props()
+	const triggerWs = getTriggerWorkspace()
+	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
 
 	const { triggersCount } = getContext<TriggerContext>('TriggerContext')
 
@@ -23,8 +26,8 @@
 
 	export async function listTokens() {
 		tokens = isFlow
-			? await FlowService.listTokensOfFlow({ workspace: $workspaceStore!, path })
-			: await ScriptService.listTokensOfScript({ workspace: $workspaceStore!, path })
+			? await FlowService.listTokensOfFlow({ workspace: wsId!, path })
+			: await ScriptService.listTokensOfScript({ workspace: wsId!, path })
 		if (labelPrefix == 'email') {
 			$triggersCount = { ...($triggersCount ?? {}), default_email_count: tokens?.length }
 		} else {
@@ -40,7 +43,7 @@
 	}
 
 	run(() => {
-		$workspaceStore && listTokens()
+		wsId && listTokens()
 	})
 </script>
 
diff --git a/frontend/src/lib/components/triggers/email/EmailTriggerEditorConfigSection.svelte b/frontend/src/lib/components/triggers/email/EmailTriggerEditorConfigSection.svelte
index 54940b5710..3a60d3be71 100644
--- a/frontend/src/lib/components/triggers/email/EmailTriggerEditorConfigSection.svelte
+++ b/frontend/src/lib/components/triggers/email/EmailTriggerEditorConfigSection.svelte
@@ -3,6 +3,7 @@
 	import Required from '$lib/components/Required.svelte'
 	import Section from '$lib/components/Section.svelte'
 	import { userStore, workspaceStore } from '$lib/stores'
+	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
 	// import { page } from '$app/state'
 	import { getEmailAddress, getEmailDomain } from './utils'
 	import { isCloudHosted } from '$lib/cloud'
@@ -34,6 +35,8 @@
 		isDraftOnly = true,
 		showTestingBadge = false
 	}: Props = $props()
+	const triggerWs = getTriggerWorkspace()
+	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
 
 	let validateTimeout: number | undefined = undefined
 
@@ -59,7 +62,7 @@
 	}
 	async function emailTriggerExists(local_part: string, workspaced_local_part: boolean) {
 		return await EmailTriggerService.existsEmailLocalPart({
-			workspace: $workspaceStore!,
+			workspace: wsId!,
 			requestBody: {
 				local_part,
 				trigger_path: initialTriggerPath,
@@ -85,7 +88,7 @@
 	})
 
 	let fullEmailAddress = $derived(
-		getEmailAddress(local_part, workspaced_local_part, $workspaceStore ?? '', emailDomain ?? '')
+		getEmailAddress(local_part, workspaced_local_part, wsId ?? '', emailDomain ?? '')
 	)
 
 	$effect.pre(() => {
diff --git a/frontend/src/lib/components/triggers/email/EmailTriggerEditorInner.svelte b/frontend/src/lib/components/triggers/email/EmailTriggerEditorInner.svelte
index 1af45e9f2f..b56f7f4d12 100644
--- a/frontend/src/lib/components/triggers/email/EmailTriggerEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/email/EmailTriggerEditorInner.svelte
@@ -13,6 +13,7 @@
 		type TriggerMode
 	} from '$lib/gen'
 	import { usedTriggerKinds, userStore, workspaceStore } from '$lib/stores'
+	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
 	import { canWrite, capitalize, emptyString, sendUserToast } from '$lib/utils'
 	import Section from '$lib/components/Section.svelte'
 	import { Loader2 } from 'lucide-svelte'
@@ -49,6 +50,8 @@
 		trigger = undefined,
 		customSaveBehavior = undefined
 	} = $props()
+	const triggerWs = getTriggerWorkspace()
+	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
 
 	// Form data state
 	let initialPath = $state('')
@@ -93,7 +96,7 @@
 	const draftSync = useTriggerDraftSync({
 		itemKind: 'trigger_email',
 		path: () => initialPath,
-		workspace: () => $workspaceStore,
+		workspace: () => wsId,
 		drawerLoading: () => drawerLoading,
 		getCfg: () => emailConfig,
 		applyCfg: (c) => loadTriggerConfig(c as Partial<EmailTrigger>),
@@ -229,7 +232,7 @@
 			return { overlay: undefined, noDeployed: false }
 		}
 		const s = await EmailTriggerService.getEmailTrigger({
-			workspace: $workspaceStore!,
+			workspace: wsId!,
 			path: initialPath,
 			getDraft: true
 		})
@@ -255,7 +258,7 @@
 				initialPath,
 				saveCfg,
 				edit,
-				$workspaceStore!,
+				wsId!,
 				!!$userStore?.is_admin || !!$userStore?.is_super_admin,
 				usedTriggerKinds
 			)
@@ -299,7 +302,7 @@
 			// excludes workspaced_local_part=false) — no fork-conflict warning.
 			await EmailTriggerService.setEmailTriggerMode({
 				path: initialPath,
-				workspace: $workspaceStore ?? '',
+				workspace: wsId ?? '',
 				requestBody: { mode: newMode }
 			})
 			sendUserToast(`${capitalize(newMode)} email trigger ${initialPath}`)
@@ -372,6 +375,7 @@
 				<div class="flex flex-col gap-2">
 					<Label label="Path">
 						<Path
+							workspaceOverride={wsId}
 							bind:dirty={dirtyPath}
 							bind:error={pathError}
 							bind:path
@@ -389,6 +393,7 @@
 			{#if !hideTarget}
 				<Section label="Target">
 					<TriggerRunnablePicker
+						workspace={wsId}
 						{fixedScriptPath}
 						bind:itemKind
 						bind:scriptPath={script_path}
@@ -435,6 +440,7 @@
 						</Tabs>
 						<div class="mt-4">
 							<TriggerRetriesAndErrorHandler
+								workspace={wsId}
 								{optionTabSelected}
 								{itemKind}
 								{can_write}
diff --git a/frontend/src/lib/components/triggers/gcp/GcpTriggerEditorConfigSection.svelte b/frontend/src/lib/components/triggers/gcp/GcpTriggerEditorConfigSection.svelte
index b650dbe3b1..f7bc924d8f 100644
--- a/frontend/src/lib/components/triggers/gcp/GcpTriggerEditorConfigSection.svelte
+++ b/frontend/src/lib/components/triggers/gcp/GcpTriggerEditorConfigSection.svelte
@@ -16,6 +16,7 @@
 	import { base } from '$lib/base'
 	import Toggle from '$lib/components/Toggle.svelte'
 	import { workspaceStore } from '$lib/stores'
+	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
 
 	import { Button, Url } from '$lib/components/common'
 	import { RefreshCw } from 'lucide-svelte'
@@ -24,6 +25,11 @@
 	import Select from '$lib/components/select/Select.svelte'
 	import { safeSelectItems } from '$lib/components/select/utils.svelte'
 
+	// Declared before `DEFAULT_PUSH_CONFIG` / the `base_endpoint` prop default,
+	// which call `getBaseUrl()` (a `wsId` reader) during component init.
+	const triggerWs = getTriggerWorkspace()
+	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+
 	let topic_items: string[] = $state([])
 	let subscription_items: string[] = $state([])
 	let loadingTopic = $state(false)
@@ -39,7 +45,7 @@
 			try {
 				loadingTopic = true
 				topic_items = await GcpTriggerService.listGoogleTopics({
-					workspace: $workspaceStore!,
+					workspace: wsId!,
 					path: gcp_resource_path
 				})
 			} catch (error) {
@@ -54,7 +60,7 @@
 			try {
 				loadingSubscription = true
 				subscription_items = await GcpTriggerService.listAllTgoogleTopicSubscriptions({
-					workspace: $workspaceStore!,
+					workspace: wsId!,
 					path: gcp_resource_path,
 					requestBody: {
 						topic_id
@@ -123,7 +129,7 @@
 		}
 	})
 	function getBaseUrl() {
-		return `${window.location.origin}${base}/api/gcp/w/${$workspaceStore!}`
+		return `${window.location.origin}${base}/api/gcp/w/${wsId!}`
 	}
 
 	$effect(() => {
@@ -132,7 +138,7 @@
 
 	$effect(() => {
 		if (emptyStringTrimmed(subscription_id) && !emptyStringTrimmed(path)) {
-			subscription_id = `windmill-${$workspaceStore!}-${path.replaceAll('/', '_')}`
+			subscription_id = `windmill-${wsId!}-${path.replaceAll('/', '_')}`
 		}
 	})
 </script>
@@ -148,6 +154,7 @@
 			<Subsection label="Connection setup">
 				<div class="flex flex-col gap-1 mt-2">
 					<ResourcePicker
+						workspace={wsId}
 						resourceType="gcloud"
 						bind:value={
 							() => gcp_resource_path,
diff --git a/frontend/src/lib/components/triggers/gcp/GcpTriggerEditorInner.svelte b/frontend/src/lib/components/triggers/gcp/GcpTriggerEditorInner.svelte
index be3947fca0..b2effb2c93 100644
--- a/frontend/src/lib/components/triggers/gcp/GcpTriggerEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/gcp/GcpTriggerEditorInner.svelte
@@ -4,6 +4,7 @@
 	import DrawerContent from '$lib/components/common/drawer/DrawerContent.svelte'
 	import Path from '$lib/components/Path.svelte'
 	import { usedTriggerKinds, userStore, workspaceStore } from '$lib/stores'
+	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
 	import { canWrite, capitalize, emptyString, sendUserToast } from '$lib/utils'
 	import { withForkConflictRetry } from '$lib/utils/forkConflict'
 	import { Loader2 } from 'lucide-svelte'
@@ -106,6 +107,8 @@
 		onReset?: () => void
 		cloudDisabled?: boolean
 	} = $props()
+	const triggerWs = getTriggerWorkspace()
+	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
 
 	let hasChanged = $derived(!deepEqual(getGcpConfig(), originalConfig ?? {}))
 	const gcpConfig = $derived.by(getGcpConfig)
@@ -113,7 +116,7 @@
 	const draftSync = useTriggerDraftSync({
 		itemKind: 'trigger_gcp',
 		path: () => initialPath,
-		workspace: () => $workspaceStore,
+		workspace: () => wsId,
 		drawerLoading: () => drawerLoading,
 		getCfg: () => gcpConfig,
 		applyCfg: loadTriggerConfig,
@@ -204,7 +207,7 @@
 		}
 		try {
 			const s = await GcpTriggerService.getGcpTrigger({
-				workspace: $workspaceStore!,
+				workspace: wsId!,
 				path: initialPath,
 				getDraft: true
 			})
@@ -256,7 +259,7 @@
 			initialPath,
 			cfg,
 			edit,
-			$workspaceStore!,
+			wsId!,
 			usedTriggerKinds
 		)
 		if (isSaved) {
@@ -318,7 +321,7 @@
 				(force) =>
 					GcpTriggerService.setGcpTriggerMode({
 						path: initialPath,
-						workspace: $workspaceStore ?? '',
+						workspace: wsId ?? '',
 						requestBody: { mode: newMode, force }
 					}),
 				'GCP Pub/Sub trigger'
@@ -462,6 +465,7 @@
 			<div class="flex flex-col gap-4">
 				<Label label="Path">
 					<Path
+						workspaceOverride={wsId}
 						bind:dirty={dirtyPath}
 						bind:error={pathError}
 						bind:path
@@ -478,6 +482,7 @@
 			{#if !hideTarget}
 				<Section label="Runnable">
 					<TriggerRunnablePicker
+						workspace={wsId}
 						{fixedScriptPath}
 						bind:itemKind
 						bind:scriptPath={script_path}
@@ -583,6 +588,7 @@
 								</div>
 							{:else}
 								<TriggerRetriesAndErrorHandler
+									workspace={wsId}
 									{optionTabSelected}
 									{itemKind}
 									{can_write}
diff --git a/frontend/src/lib/components/triggers/kafka/KafkaTriggerEditorInner.svelte b/frontend/src/lib/components/triggers/kafka/KafkaTriggerEditorInner.svelte
index b9e6b6e05e..a8d891c91d 100644
--- a/frontend/src/lib/components/triggers/kafka/KafkaTriggerEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/kafka/KafkaTriggerEditorInner.svelte
@@ -7,6 +7,7 @@
 	import TriggerRunnablePicker from '$lib/components/triggers/TriggerRunnablePicker.svelte'
 	import { KafkaTriggerService, type ErrorHandler, type Retry, type TriggerMode } from '$lib/gen'
 	import { usedTriggerKinds, userStore, workspaceStore } from '$lib/stores'
+	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
 	import { canWrite, capitalize, emptyString, sendUserToast } from '$lib/utils'
 	import { withForkConflictRetry } from '$lib/utils/forkConflict'
 	import Section from '$lib/components/Section.svelte'
@@ -66,6 +67,8 @@
 		onDelete = undefined,
 		onReset = undefined
 	}: Props = $props()
+	const triggerWs = getTriggerWorkspace()
+	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
 
 	let drawer: Drawer | undefined = $state()
 	let is_flow: boolean = $state(false)
@@ -131,7 +134,7 @@
 	const draftSync = useTriggerDraftSync({
 		itemKind: 'trigger_kafka',
 		path: () => initialPath,
-		workspace: () => $workspaceStore,
+		workspace: () => wsId,
 		drawerLoading: () => drawerLoading,
 		getCfg: () => kafkaConfig,
 		applyCfg: loadTriggerConfig,
@@ -260,7 +263,7 @@
 			return { overlay: undefined, noDeployed: false }
 		}
 		const s = await KafkaTriggerService.getKafkaTrigger({
-			workspace: $workspaceStore!,
+			workspace: wsId!,
 			path: initialPath,
 			getDraft: true
 		})
@@ -304,7 +307,7 @@
 			initialPath,
 			cfg,
 			edit,
-			$workspaceStore!,
+			wsId!,
 			usedTriggerKinds
 		)
 		if (isSaved) {
@@ -333,7 +336,7 @@
 		resetLoading = true
 		try {
 			await KafkaTriggerService.resetKafkaOffsets({
-				workspace: $workspaceStore!,
+				workspace: wsId!,
 				path: initialPath
 			})
 			sendUserToast(
@@ -355,7 +358,7 @@
 				(force) =>
 					KafkaTriggerService.setKafkaTriggerMode({
 						path: initialPath,
-						workspace: $workspaceStore ?? '',
+						workspace: wsId ?? '',
 						requestBody: { mode: newMode, force }
 					}),
 				'Kafka trigger'
@@ -510,6 +513,7 @@
 			<div class="flex flex-col gap-4">
 				<Label label="Path">
 					<Path
+						workspaceOverride={wsId}
 						bind:dirty={dirtyPath}
 						bind:error={pathError}
 						bind:path
@@ -526,6 +530,7 @@
 			{#if !hideTarget}
 				<Section label="Runnable">
 					<TriggerRunnablePicker
+						workspace={wsId}
 						{fixedScriptPath}
 						bind:itemKind
 						bind:scriptPath={script_path}
@@ -643,6 +648,7 @@
 						</Tabs>
 						<div class="mt-4">
 							<TriggerRetriesAndErrorHandler
+								workspace={wsId}
 								{optionTabSelected}
 								{itemKind}
 								{can_write}
diff --git a/frontend/src/lib/components/triggers/kafka/KafkaTriggersConfigSection.svelte b/frontend/src/lib/components/triggers/kafka/KafkaTriggersConfigSection.svelte
index 697f185215..4cf4225fd9 100644
--- a/frontend/src/lib/components/triggers/kafka/KafkaTriggersConfigSection.svelte
+++ b/frontend/src/lib/components/triggers/kafka/KafkaTriggersConfigSection.svelte
@@ -4,6 +4,7 @@
 	import Subsection from '$lib/components/Subsection.svelte'
 	import SchemaForm from '../../SchemaForm.svelte'
 	import { workspaceStore } from '$lib/stores'
+	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
 	import TestTriggerConnection from '../TestTriggerConnection.svelte'
 	import TestingBadge from '../testingBadge.svelte'
 	import { untrack } from 'svelte'
@@ -25,6 +26,8 @@
 		can_write = true,
 		showTestingBadge = false
 	}: Props = $props()
+	const triggerWs = getTriggerWorkspace()
+	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
 
 	const kafkaConfigSchema = {
 		$schema: 'http://json-schema.org/draft-07/schema#',
@@ -51,7 +54,7 @@
 
 	function setGroupId() {
 		if (!kafkaCfg.group_id) {
-			kafkaCfg.group_id = `windmill_consumer-${$workspaceStore}-${path.replaceAll('/', '__')}`
+			kafkaCfg.group_id = `windmill_consumer-${wsId}-${path.replaceAll('/', '__')}`
 		}
 	}
 
@@ -71,6 +74,7 @@
 			<div class="block grow w-full">
 				<Subsection label="Connection">
 					<ResourcePicker
+						workspace={wsId}
 						resourceType="kafka"
 						bind:value={kafkaResourcePath}
 						disabled={!can_write}
diff --git a/frontend/src/lib/components/triggers/mqtt/MqttEditorConfigSection.svelte b/frontend/src/lib/components/triggers/mqtt/MqttEditorConfigSection.svelte
index 4768f77008..0381417c03 100644
--- a/frontend/src/lib/components/triggers/mqtt/MqttEditorConfigSection.svelte
+++ b/frontend/src/lib/components/triggers/mqtt/MqttEditorConfigSection.svelte
@@ -16,6 +16,8 @@
 	import Tooltip from '$lib/components/Tooltip.svelte'
 	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import TestingBadge from '../testingBadge.svelte'
+	import { workspaceStore } from '$lib/stores'
+	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
 
 	interface Props {
 		can_write?: boolean
@@ -37,6 +39,9 @@
 		showTestingBadge = false
 	}: Props = $props()
 
+	const triggerWs = getTriggerWorkspace()
+	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+
 	const isValidSubscribeTopics = (subscribe_topics: MqttSubscribeTopic[]): boolean => {
 		if (
 			subscribe_topics.length === 0 ||
@@ -61,7 +66,12 @@
 		{/snippet}
 		<div class="flex flex-col w-full gap-12">
 			<Subsection label="Connection setup">
-				<ResourcePicker resourceType="mqtt" disabled={!can_write} bind:value={mqtt_resource_path} />
+				<ResourcePicker
+					workspace={wsId}
+					resourceType="mqtt"
+					disabled={!can_write}
+					bind:value={mqtt_resource_path}
+				/>
 				{#if !emptyStringTrimmed(mqtt_resource_path)}
 					<TestTriggerConnection kind="mqtt" args={{ mqtt_resource_path, client_version }} />
 				{/if}
diff --git a/frontend/src/lib/components/triggers/mqtt/MqttTriggerEditorInner.svelte b/frontend/src/lib/components/triggers/mqtt/MqttTriggerEditorInner.svelte
index 7a6a561877..3411c8d979 100644
--- a/frontend/src/lib/components/triggers/mqtt/MqttTriggerEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/mqtt/MqttTriggerEditorInner.svelte
@@ -6,6 +6,7 @@
 	import Path from '$lib/components/Path.svelte'
 	import TriggerRunnablePicker from '$lib/components/triggers/TriggerRunnablePicker.svelte'
 	import { usedTriggerKinds, userStore, workspaceStore } from '$lib/stores'
+	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
 	import { canWrite, capitalize, emptyString, sendUserToast } from '$lib/utils'
 	import { withForkConflictRetry } from '$lib/utils/forkConflict'
 	import Section from '$lib/components/Section.svelte'
@@ -76,6 +77,8 @@
 		onReset = undefined,
 		cloudDisabled = false
 	}: Props = $props()
+	const triggerWs = getTriggerWorkspace()
+	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
 
 	let mqtt_resource_path: string = $state('')
 	let drawer: Drawer | undefined = $state(undefined)
@@ -120,7 +123,7 @@
 	const draftSync = useTriggerDraftSync({
 		itemKind: 'trigger_mqtt',
 		path: () => initialPath,
-		workspace: () => $workspaceStore,
+		workspace: () => wsId,
 		drawerLoading: () => drawerLoading,
 		getCfg: () => mqttConfig,
 		applyCfg: loadTriggerConfig,
@@ -260,7 +263,7 @@
 				return { overlay: undefined, noDeployed: false }
 			}
 			const s = await MqttTriggerService.getMqttTrigger({
-				workspace: $workspaceStore!,
+				workspace: wsId!,
 				path: initialPath,
 				getDraft: true
 			})
@@ -318,7 +321,7 @@
 			initialPath,
 			cfg,
 			edit,
-			$workspaceStore!,
+			wsId!,
 			usedTriggerKinds
 		)
 		if (isSaved) {
@@ -342,7 +345,7 @@
 				(force) =>
 					MqttTriggerService.setMqttTriggerMode({
 						path: initialPath,
-						workspace: $workspaceStore ?? '',
+						workspace: wsId ?? '',
 						requestBody: { mode: newMode, force }
 					}),
 				'MQTT trigger'
@@ -485,6 +488,7 @@
 			<div class="flex flex-col gap-4">
 				<Label label="Path">
 					<Path
+						workspaceOverride={wsId}
 						bind:dirty={dirtyPath}
 						bind:error={pathError}
 						bind:path
@@ -501,6 +505,7 @@
 			{#if !hideTarget}
 				<Section label="Runnable">
 					<TriggerRunnablePicker
+						workspace={wsId}
 						{fixedScriptPath}
 						bind:itemKind
 						bind:scriptPath={script_path}
@@ -671,6 +676,7 @@
 								</div>
 							{:else}
 								<TriggerRetriesAndErrorHandler
+									workspace={wsId}
 									{optionTabSelected}
 									{itemKind}
 									{can_write}
diff --git a/frontend/src/lib/components/triggers/nats/NatsTriggerEditorInner.svelte b/frontend/src/lib/components/triggers/nats/NatsTriggerEditorInner.svelte
index f92f5537c2..37513b6f1a 100644
--- a/frontend/src/lib/components/triggers/nats/NatsTriggerEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/nats/NatsTriggerEditorInner.svelte
@@ -6,6 +6,7 @@
 	import TriggerRunnablePicker from '$lib/components/triggers/TriggerRunnablePicker.svelte'
 	import { NatsTriggerService, type ErrorHandler, type Retry, type TriggerMode } from '$lib/gen'
 	import { usedTriggerKinds, userStore, workspaceStore } from '$lib/stores'
+	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
 	import { canWrite, capitalize, emptyString, sendUserToast } from '$lib/utils'
 	import { withForkConflictRetry } from '$lib/utils/forkConflict'
 	import Section from '$lib/components/Section.svelte'
@@ -63,6 +64,8 @@
 		onDelete = undefined,
 		onReset = undefined
 	}: Props = $props()
+	const triggerWs = getTriggerWorkspace()
+	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
 
 	let drawer: Drawer | undefined = $state(undefined)
 	let is_flow: boolean = $state(false)
@@ -115,7 +118,7 @@
 	const draftSync = useTriggerDraftSync({
 		itemKind: 'trigger_nats',
 		path: () => initialPath,
-		workspace: () => $workspaceStore,
+		workspace: () => wsId,
 		drawerLoading: () => drawerLoading,
 		getCfg: () => natsConfig,
 		applyCfg: loadTriggerConfig,
@@ -256,7 +259,7 @@
 			return { overlay: undefined, noDeployed: false }
 		}
 		const s = await NatsTriggerService.getNatsTrigger({
-			workspace: $workspaceStore!,
+			workspace: wsId!,
 			path: initialPath,
 			getDraft: true
 		})
@@ -297,7 +300,7 @@
 			initialPath,
 			cfg,
 			edit,
-			$workspaceStore!,
+			wsId!,
 			usedTriggerKinds
 		)
 		if (isSaved) {
@@ -335,7 +338,7 @@
 				(force) =>
 					NatsTriggerService.setNatsTriggerMode({
 						path: initialPath,
-						workspace: $workspaceStore ?? '',
+						workspace: wsId ?? '',
 						requestBody: { mode: newMode, force }
 					}),
 				'NATS trigger'
@@ -482,6 +485,7 @@
 			<div class="flex flex-col gap-4">
 				<Label label="Path">
 					<Path
+						workspaceOverride={wsId}
 						bind:dirty={dirtyPath}
 						bind:error={pathError}
 						bind:path
@@ -496,6 +500,7 @@
 			{#if !hideTarget}
 				<Section label="Runnable">
 					<TriggerRunnablePicker
+						workspace={wsId}
 						{fixedScriptPath}
 						bind:itemKind
 						bind:scriptPath={script_path}
@@ -544,6 +549,7 @@
 						</Tabs>
 						<div class="mt-4">
 							<TriggerRetriesAndErrorHandler
+								workspace={wsId}
 								{optionTabSelected}
 								{itemKind}
 								{can_write}
diff --git a/frontend/src/lib/components/triggers/nats/NatsTriggersConfigSection.svelte b/frontend/src/lib/components/triggers/nats/NatsTriggersConfigSection.svelte
index 22ffe22e64..60dd2309de 100644
--- a/frontend/src/lib/components/triggers/nats/NatsTriggersConfigSection.svelte
+++ b/frontend/src/lib/components/triggers/nats/NatsTriggersConfigSection.svelte
@@ -2,6 +2,7 @@
 	import Section from '$lib/components/Section.svelte'
 	import Subsection from '$lib/components/Subsection.svelte'
 	import { workspaceStore } from '$lib/stores'
+	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
 	import ResourcePicker from '$lib/components/ResourcePicker.svelte'
 	import SchemaForm from '$lib/components/SchemaForm.svelte'
 	import TestTriggerConnection from '../TestTriggerConnection.svelte'
@@ -34,6 +35,8 @@
 		can_write = true,
 		showTestingBadge = false
 	}: Props = $props()
+	const triggerWs = getTriggerWorkspace()
+	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
 
 	let otherArgsValid = $state(false)
 	let globalError = $derived(
@@ -99,10 +102,10 @@
 
 	function setStreamAndConsumerNames() {
 		if (!natsCfg.stream_name) {
-			natsCfg.stream_name = `windmill_stream-${$workspaceStore}-${path.replaceAll('/', '__')}`
+			natsCfg.stream_name = `windmill_stream-${wsId}-${path.replaceAll('/', '__')}`
 		}
 		if (!natsCfg.consumer_name) {
-			natsCfg.consumer_name = `windmill_consumer-${$workspaceStore}-${path.replaceAll('/', '__')}`
+			natsCfg.consumer_name = `windmill_consumer-${wsId}-${path.replaceAll('/', '__')}`
 		}
 	}
 
@@ -124,6 +127,7 @@
 			<div class="block grow w-full">
 				<Subsection label="Connection">
 					<ResourcePicker
+						workspace={wsId}
 						resourceType="nats"
 						bind:value={natsResourcePath}
 						{defaultValues}
diff --git a/frontend/src/lib/components/triggers/postgres/CheckPostgresRequirement.svelte b/frontend/src/lib/components/triggers/postgres/CheckPostgresRequirement.svelte
index 07cfd2209f..194d932c7a 100644
--- a/frontend/src/lib/components/triggers/postgres/CheckPostgresRequirement.svelte
+++ b/frontend/src/lib/components/triggers/postgres/CheckPostgresRequirement.svelte
@@ -3,6 +3,7 @@
 	import Tooltip from '$lib/components/Tooltip.svelte'
 	import { PostgresTriggerService } from '$lib/gen'
 	import { workspaceStore } from '$lib/stores'
+	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
 	import { sendUserToast } from '$lib/toast'
 	import { emptyString } from '$lib/utils'
 
@@ -15,7 +16,7 @@
 		}
 		try {
 			const invalidConfig = !(await PostgresTriggerService.isValidPostgresConfiguration({
-				workspace: $workspaceStore!,
+				workspace: wsId!,
 				path: postgres_resource_path
 			}))
 
@@ -54,6 +55,8 @@
 	}
 
 	let { can_write, postgres_resource_path, checkConnection = undefined }: Props = $props();
+	const triggerWs = getTriggerWorkspace()
+	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
 </script>
 
 {#if postgres_resource_path}
diff --git a/frontend/src/lib/components/triggers/postgres/PostgresTriggerEditorInner.svelte b/frontend/src/lib/components/triggers/postgres/PostgresTriggerEditorInner.svelte
index 70494c30f5..2426ef79a7 100644
--- a/frontend/src/lib/components/triggers/postgres/PostgresTriggerEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/postgres/PostgresTriggerEditorInner.svelte
@@ -14,6 +14,7 @@
 		type TriggerMode
 	} from '$lib/gen'
 	import { usedTriggerKinds, userStore, workspaceStore } from '$lib/stores'
+	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
 	import { canWrite, emptyString, emptyStringTrimmed, sendUserToast } from '$lib/utils'
 	import { withForkConflictRetry } from '$lib/utils/forkConflict'
 	import Section from '$lib/components/Section.svelte'
@@ -84,6 +85,8 @@
 		onDelete = undefined,
 		onReset = undefined
 	}: Props = $props()
+	const triggerWs = getTriggerWorkspace()
+	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
 
 	let drawer: Drawer | undefined = $state(undefined)
 	let is_flow: boolean = $state(false)
@@ -168,7 +171,7 @@
 	const draftSync = useTriggerDraftSync({
 		itemKind: 'trigger_postgres',
 		path: () => initialPath,
-		workspace: () => $workspaceStore,
+		workspace: () => wsId,
 		drawerLoading: () => drawerLoading,
 		getCfg: () => postgresConfig,
 		applyCfg: loadTriggerConfig,
@@ -191,7 +194,7 @@
 			const message = await PostgresTriggerService.createPostgresPublication({
 				path: postgres_resource_path,
 				publication: publication_name as string,
-				workspace: $workspaceStore!,
+				workspace: wsId!,
 				requestBody: {
 					transaction_to_track: transaction_to_track,
 					table_to_track: relations
@@ -211,7 +214,7 @@
 			creatingSlot = true
 			const message = await PostgresTriggerService.createPostgresReplicationSlot({
 				path: postgres_resource_path,
-				workspace: $workspaceStore!,
+				workspace: wsId!,
 				requestBody: {
 					name: replication_slot_name
 				}
@@ -391,7 +394,7 @@
 			return { overlay: undefined, noDeployed: false }
 		}
 		const s = await PostgresTriggerService.getPostgresTrigger({
-			workspace: $workspaceStore!,
+			workspace: wsId!,
 			path: initialPath,
 			getDraft: true
 		})
@@ -402,7 +405,7 @@
 		// Deployed config + publication become the `originalConfig` baseline.
 		const deployedPublication = await PostgresTriggerService.getPostgresPublication({
 			path: deployedTrigger.postgres_resource_path,
-			workspace: $workspaceStore!,
+			workspace: wsId!,
 			publication: deployedTrigger.publication_name
 		})
 		loadTriggerConfig({ ...deployedTrigger, publication: deployedPublication })
@@ -417,7 +420,7 @@
 				? deployedPublication
 				: await PostgresTriggerService.getPostgresPublication({
 						path: effective.postgres_resource_path,
-						workspace: $workspaceStore!,
+						workspace: wsId!,
 						publication: effective.publication_name
 					})
 		return { overlay: { ...effective, publication: effectivePublication }, noDeployed }
@@ -451,7 +454,7 @@
 			initialPath,
 			cfg,
 			edit,
-			$workspaceStore!,
+			wsId!,
 			usedTriggerKinds
 		)
 		if (isSaved) {
@@ -475,7 +478,7 @@
 		try {
 			loading = true
 			let templateId = await PostgresTriggerService.createTemplateScript({
-				workspace: $workspaceStore!,
+				workspace: wsId!,
 				requestBody: {
 					relations,
 					language,
@@ -498,7 +501,7 @@
 				(force) =>
 					PostgresTriggerService.setPostgresTriggerMode({
 						path: initialPath,
-						workspace: $workspaceStore ?? '',
+						workspace: wsId ?? '',
 						requestBody: { mode: newMode, force }
 					}),
 				'postgres trigger'
@@ -530,7 +533,7 @@
 		if (postgres_resource_path) {
 			loadingPostgres = true
 			PostgresTriggerService.getPostgresVersion({
-				workspace: $workspaceStore!,
+				workspace: wsId!,
 				path: postgres_resource_path
 			})
 				.then((version: string) => {
@@ -660,6 +663,7 @@
 			{/if}
 			<Label label="Path">
 				<Path
+					workspaceOverride={wsId}
 					bind:dirty={dirtyPath}
 					bind:error={pathError}
 					bind:path
@@ -674,6 +678,7 @@
 			{#if !hideTarget}
 				<Section label="Runnable">
 					<TriggerRunnablePicker
+						workspace={wsId}
 						{fixedScriptPath}
 						bind:itemKind
 						bind:scriptPath={script_path}
@@ -721,6 +726,7 @@
 				<div class="flex flex-col gap-8">
 					<div class="flex flex-col gap-2">
 						<ResourcePicker
+							workspace={wsId}
 							disabled={!can_write}
 							bind:value={postgres_resource_path}
 							resourceType={'postgresql'}
@@ -949,6 +955,7 @@
 						</Tabs>
 						<div class="mt-4">
 							<TriggerRetriesAndErrorHandler
+								workspace={wsId}
 								{optionTabSelected}
 								{itemKind}
 								{can_write}
diff --git a/frontend/src/lib/components/triggers/postgres/PublicationPicker.svelte b/frontend/src/lib/components/triggers/postgres/PublicationPicker.svelte
index 7513ed457d..a7a06b04d4 100644
--- a/frontend/src/lib/components/triggers/postgres/PublicationPicker.svelte
+++ b/frontend/src/lib/components/triggers/postgres/PublicationPicker.svelte
@@ -7,6 +7,7 @@
 	import type { Relations } from '$lib/gen'
 	import { PostgresTriggerService } from '$lib/gen/services.gen'
 	import { workspaceStore } from '$lib/stores'
+	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
 	import { sendUserToast } from '$lib/toast'
 	import { emptyString } from '$lib/utils'
 	import { RefreshCw } from 'lucide-svelte'
@@ -30,6 +31,8 @@
 		transaction_to_track = $bindable([]),
 		disabled = false
 	}: Props = $props();
+	const triggerWs = getTriggerWorkspace()
+	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
 
 	let loadingPublication: boolean = $state(false)
 	let deletingPublication: boolean = $state(false)
@@ -39,7 +42,7 @@
 			loadingPublication = true
 			const publications = await PostgresTriggerService.listPostgresPublication({
 				path: postgres_resource_path,
-				workspace: $workspaceStore!
+				workspace: wsId!
 			})
 
 			items = publications
@@ -55,7 +58,7 @@
 			updatingPublication = true
 			const message = await PostgresTriggerService.updatePostgresPublication({
 				path: postgres_resource_path,
-				workspace: $workspaceStore!,
+				workspace: wsId!,
 				publication: publication_name,
 				requestBody: {
 					table_to_track: relations,
@@ -75,7 +78,7 @@
 			deletingPublication = true
 			const message = await PostgresTriggerService.deletePostgresPublication({
 				path: postgres_resource_path,
-				workspace: $workspaceStore!,
+				workspace: wsId!,
 				publication: publication_name
 			})
 			items = items.filter((item) => item != publication_name)
@@ -94,7 +97,7 @@
 		try {
 			const publication_data = await PostgresTriggerService.getPostgresPublication({
 				path: postgres_resource_path,
-				workspace: $workspaceStore!,
+				workspace: wsId!,
 				publication: publication_name
 			})
 			transaction_to_track = [...publication_data.transaction_to_track]
diff --git a/frontend/src/lib/components/triggers/postgres/SlotPicker.svelte b/frontend/src/lib/components/triggers/postgres/SlotPicker.svelte
index 25f0863330..ef3ac720ef 100644
--- a/frontend/src/lib/components/triggers/postgres/SlotPicker.svelte
+++ b/frontend/src/lib/components/triggers/postgres/SlotPicker.svelte
@@ -4,6 +4,7 @@
 	import { safeSelectItems } from '$lib/components/select/utils.svelte'
 	import { PostgresTriggerService } from '$lib/gen'
 	import { workspaceStore } from '$lib/stores'
+	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
 	import { sendUserToast } from '$lib/toast'
 	import { emptyString } from '$lib/utils'
 	import { RefreshCw } from 'lucide-svelte'
@@ -21,6 +22,8 @@
 		postgres_resource_path = '',
 		disabled = false
 	}: Props = $props();
+	const triggerWs = getTriggerWorkspace()
+	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
 
 	let deletingSlot: boolean = $state(false)
 	let loadingSlot: boolean = $state(false)
@@ -30,7 +33,7 @@
 			loadingSlot = true
 			const result = await PostgresTriggerService.listPostgresReplicationSlot({
 				path: postgres_resource_path,
-				workspace: $workspaceStore!
+				workspace: wsId!
 			})
 
 			let exist = false
@@ -63,7 +66,7 @@
 			deletingSlot = true
 			const message = await PostgresTriggerService.deletePostgresReplicationSlot({
 				path: postgres_resource_path,
-				workspace: $workspaceStore!,
+				workspace: wsId!,
 				requestBody: {
 					name: replication_slot_name
 				}
diff --git a/frontend/src/lib/components/triggers/schedules/ScheduleEditorInner.svelte b/frontend/src/lib/components/triggers/schedules/ScheduleEditorInner.svelte
index 7801889406..162cc51cf2 100644
--- a/frontend/src/lib/components/triggers/schedules/ScheduleEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/schedules/ScheduleEditorInner.svelte
@@ -44,6 +44,7 @@
 	import TextInput from '$lib/components/text_input/TextInput.svelte'
 	import { twMerge } from 'tailwind-merge'
 	import PermissionedAsLine from '../PermissionedAsLine.svelte'
+	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
 
 	let {
 		useDrawer = true,
@@ -135,12 +136,17 @@
 				emptyString(errorHandlerExtraArgs['channel'])) ||
 			!can_write
 	)
+	const triggerWs = getTriggerWorkspace()
+	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+	// Carry the acting workspace onto "create from template" routes when a
+	// session override is set, so the script is created in the session workspace.
+	const wsParam = $derived(triggerWs?.() ? `&workspace=${encodeURIComponent(wsId!)}` : '')
 	const scheduleCfg = $derived.by(getScheduleCfg)
 
 	const draftSync = useTriggerDraftSync({
 		itemKind: 'trigger_schedule',
 		path: () => initialPath,
-		workspace: () => $workspaceStore,
+		workspace: () => wsId,
 		drawerLoading: () => drawerLoading,
 		getCfg: () => scheduleCfg,
 		applyCfg: loadScheduleCfg,
@@ -228,15 +234,15 @@
 			let defaultErrorHandlerMaybe = undefined
 			let defaultRecoveryHandlerMaybe = undefined
 			let defaultSuccessHandlerMaybe = undefined
-			if ($workspaceStore) {
+			if (wsId) {
 				defaultErrorHandlerMaybe = (await SettingService.getGlobal({
-					key: 'default_error_handler_' + $workspaceStore!
+					key: 'default_error_handler_' + wsId!
 				})) as any
 				defaultRecoveryHandlerMaybe = (await SettingService.getGlobal({
-					key: 'default_recovery_handler_' + $workspaceStore!
+					key: 'default_recovery_handler_' + wsId!
 				})) as any
 				defaultSuccessHandlerMaybe = (await SettingService.getGlobal({
-					key: 'default_success_handler_' + $workspaceStore!
+					key: 'default_success_handler_' + wsId!
 				})) as any
 			}
 
@@ -305,7 +311,7 @@
 			let s: Schedule | undefined
 			if (schedule_path) {
 				const resp = await ScheduleService.getSchedule({
-					workspace: $workspaceStore!,
+					workspace: wsId!,
 					path: schedule_path,
 					getDraft
 				})
@@ -385,9 +391,9 @@
 			runnable = undefined
 			try {
 				if (is_flow) {
-					runnable = await FlowService.getFlowByPath({ workspace: $workspaceStore!, path: p })
+					runnable = await FlowService.getFlowByPath({ workspace: wsId!, path: p })
 				} else {
-					runnable = await ScriptService.getScriptByPath({ workspace: $workspaceStore!, path: p })
+					runnable = await ScriptService.getScriptByPath({ workspace: wsId!, path: p })
 				}
 			} catch (err) {}
 		} else {
@@ -400,9 +406,9 @@
 			sendUserToast(`Setting default error handler is an enterprise edition feature`, true)
 			return
 		}
-		if ($workspaceStore) {
+		if (wsId) {
 			await ScheduleService.setDefaultErrorOrRecoveryHandler({
-				workspace: $workspaceStore!,
+				workspace: wsId!,
 				requestBody: {
 					handler_type: 'error',
 					override_existing: overrideExisting,
@@ -429,9 +435,9 @@
 			sendUserToast(`Setting default recovery handler is an enterprise edition feature`, true)
 			return
 		}
-		if ($workspaceStore) {
+		if (wsId) {
 			await ScheduleService.setDefaultErrorOrRecoveryHandler({
-				workspace: $workspaceStore!,
+				workspace: wsId!,
 				requestBody: {
 					handler_type: 'recovery',
 					override_existing: overrideExisting,
@@ -456,9 +462,9 @@
 			sendUserToast(`Setting default success handler is an enterprise edition feature`, true)
 			return
 		}
-		if ($workspaceStore) {
+		if (wsId) {
 			await ScheduleService.setDefaultErrorOrRecoveryHandler({
-				workspace: $workspaceStore!,
+				workspace: wsId!,
 				requestBody: {
 					handler_type: 'success',
 					override_existing: overrideExisting,
@@ -492,7 +498,7 @@
 		}
 		try {
 			const s = await ScheduleService.getSchedule({
-				workspace: $workspaceStore!,
+				workspace: wsId!,
 				path: initialPath,
 				getDraft: true
 			})
@@ -591,7 +597,7 @@
 		const previousPath = initialPath
 		const scheduleCfg = getScheduleCfg()
 		deploymentLoading = true
-		const isSaved = await saveScheduleFromCfg(scheduleCfg, edit, $workspaceStore!)
+		const isSaved = await saveScheduleFromCfg(scheduleCfg, edit, wsId!)
 		if (isSaved) {
 			draftSync.discard(previousPath, scheduleCfg)
 			onUpdate?.(scheduleCfg.path)
@@ -698,7 +704,7 @@
 				(force) =>
 					ScheduleService.setScheduleEnabled({
 						path: initialPath,
-						workspace: $workspaceStore ?? '',
+						workspace: wsId ?? '',
 						requestBody: { enabled: nEnabled, force }
 					}),
 				'schedule'
@@ -754,7 +760,7 @@
 							variant="default"
 							disabled={!allowSchedule || pathError != '' || emptyString(script_path)}
 							on:click={() => {
-								runScheduleNow(script_path, path, is_flow, $workspaceStore!)
+								runScheduleNow(script_path, path, is_flow, wsId!)
 							}}
 						>
 							Run now
@@ -813,6 +819,7 @@
 						<label for="path" class="text-xs font-semibold text-emphasis">Path</label>
 						{#if !edit && !trigger?.isPrimary}
 							<Path
+								workspaceOverride={wsId}
 								bind:dirty={dirtyPath}
 								bind:this={pathC}
 								checkInitialPathExistence={!edit}
@@ -930,6 +937,7 @@
 							Pick a script or flow to be triggered by the schedule<Required required={true} />
 						</p>
 						<ScriptPicker
+							workspace={wsId}
 							disabled={(initialScriptPath != '' && !initNewPath) || !can_write}
 							initialPath={initialScriptPath}
 							kinds={['script']}
@@ -949,6 +957,7 @@
 						</Alert>
 						<div class="my-2"></div>
 						<ScriptPicker
+							workspace={wsId}
 							disabled
 							initialPath={script_path}
 							scriptPath={script_path}
@@ -1085,6 +1094,7 @@
 					</div>
 
 					<ErrorOrRecoveryHandler
+						workspace={wsId}
 						isEditable={can_write}
 						errorOrRecovery="error"
 						showScriptHelpText={true}
@@ -1179,6 +1189,7 @@
 						</div>
 					{/snippet}
 					<ErrorOrRecoveryHandler
+						workspace={wsId}
 						isEditable={!disabled}
 						errorOrRecovery="recovery"
 						bind:handlerSelected={recoveryHandlerSelected}
@@ -1268,6 +1279,7 @@
 						</div>
 					{/snippet}
 					<ErrorOrRecoveryHandler
+						workspace={wsId}
 						isEditable={!disabled}
 						errorOrRecovery="success"
 						bind:handlerSelected={successHandlerSelected}
@@ -1337,6 +1349,7 @@
 						<Label label="Dynamic skip script">
 							<div class="flex flex-row">
 								<ScriptPicker
+									workspace={wsId}
 									disabled={!can_write}
 									bind:scriptPath={dynamicSkipPath}
 									kinds={['script']}
@@ -1348,7 +1361,7 @@
 										btnClasses="ml-4 whitespace-nowrap"
 										variant="default"
 										size="xs"
-										href="/scripts/add?hub=hub%2F19822%2Fwindmill%2Fdynamic_skip_template"
+										href="/scripts/add?hub=hub%2F19822%2Fwindmill%2Fdynamic_skip_template{wsParam}"
 										disabled={!can_write}
 										target="_blank"
 									>
@@ -1368,7 +1381,12 @@
 					label="Custom script tag"
 					tooltip="When set, the script tag will be overridden by this tag"
 				>
-					<WorkerTagPicker bind:tag popupPlacement="top-end" disabled={!can_write} />
+					<WorkerTagPicker
+						bind:tag
+						workspaceId={wsId}
+						popupPlacement="top-end"
+						disabled={!can_write}
+					/>
 				</Section>
 			{/if}
 		{:else}
diff --git a/frontend/src/lib/components/triggers/sqs/SqsTriggerEditorConfigSection.svelte b/frontend/src/lib/components/triggers/sqs/SqsTriggerEditorConfigSection.svelte
index 3ee60502ff..6aa7b025cc 100644
--- a/frontend/src/lib/components/triggers/sqs/SqsTriggerEditorConfigSection.svelte
+++ b/frontend/src/lib/components/triggers/sqs/SqsTriggerEditorConfigSection.svelte
@@ -14,6 +14,7 @@
 	import { Button } from '$lib/components/common'
 	import { VariableService, type AwsAuthResourceType } from '$lib/gen'
 	import { workspaceStore } from '$lib/stores'
+	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
 	import TestingBadge from '../testingBadge.svelte'
 	import MultiSelect from '$lib/components/select/MultiSelect.svelte'
 	import { safeSelectItems } from '$lib/components/select/utils.svelte'
@@ -39,9 +40,11 @@
 		message_attributes = $bindable([]),
 		showTestingBadge = false
 	}: Props = $props()
+	const triggerWs = getTriggerWorkspace()
+	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
 
 	async function loadVariables() {
-		return await VariableService.listVariable({ workspace: $workspaceStore ?? '' })
+		return await VariableService.listVariable({ workspace: wsId ?? '' })
 	}
 	let itemPicker: ItemPicker | undefined = $state()
 	let variableEditor: VariableEditor | undefined = $state()
@@ -82,9 +85,13 @@
 						</ToggleButtonGroup>
 
 						{#if aws_auth_resource_type === 'credentials'}
-							<ResourcePicker resourceType="aws" bind:value={aws_resource_path} />
+							<ResourcePicker workspace={wsId} resourceType="aws" bind:value={aws_resource_path} />
 						{:else if aws_auth_resource_type === 'oidc'}
-							<ResourcePicker resourceType="aws_oidc" bind:value={aws_resource_path} />
+							<ResourcePicker
+								workspace={wsId}
+								resourceType="aws_oidc"
+								bind:value={aws_resource_path}
+							/>
 						{/if}
 						{#if isValid}
 							<TestTriggerConnection kind="sqs" args={{ aws_resource_path, queue_url }} />
@@ -183,4 +190,4 @@
 	{/snippet}
 </ItemPicker>
 
-<VariableEditor bind:this={variableEditor} on:create={itemPicker.openDrawer} />
+<VariableEditor bind:this={variableEditor} workspace={wsId} on:create={itemPicker.openDrawer} />
diff --git a/frontend/src/lib/components/triggers/sqs/SqsTriggerEditorInner.svelte b/frontend/src/lib/components/triggers/sqs/SqsTriggerEditorInner.svelte
index 01e4a28e29..d1dc39eb14 100644
--- a/frontend/src/lib/components/triggers/sqs/SqsTriggerEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/sqs/SqsTriggerEditorInner.svelte
@@ -4,6 +4,7 @@
 	import DrawerContent from '$lib/components/common/drawer/DrawerContent.svelte'
 	import Path from '$lib/components/Path.svelte'
 	import { usedTriggerKinds, userStore, workspaceStore } from '$lib/stores'
+	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
 	import { canWrite, capitalize, emptyString, sendUserToast } from '$lib/utils'
 	import { withForkConflictRetry } from '$lib/utils/forkConflict'
 	import { Loader2 } from 'lucide-svelte'
@@ -68,6 +69,8 @@
 		onDelete = undefined,
 		onReset = undefined
 	}: Props = $props()
+	const triggerWs = getTriggerWorkspace()
+	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
 
 	let drawer: Drawer | undefined = $state(undefined)
 	let is_flow: boolean = $state(false)
@@ -107,7 +110,7 @@
 	const draftSync = useTriggerDraftSync({
 		itemKind: 'trigger_sqs',
 		path: () => initialPath,
-		workspace: () => $workspaceStore,
+		workspace: () => wsId,
 		drawerLoading: () => drawerLoading,
 		getCfg: () => sqsConfig,
 		applyCfg: loadTriggerConfig,
@@ -238,7 +241,7 @@
 				return { overlay: undefined, noDeployed: false }
 			}
 			const s = await SqsTriggerService.getSqsTrigger({
-				workspace: $workspaceStore!,
+				workspace: wsId!,
 				path: initialPath,
 				getDraft: true
 			})
@@ -282,7 +285,7 @@
 				(force) =>
 					SqsTriggerService.setSqsTriggerMode({
 						path: initialPath,
-						workspace: $workspaceStore ?? '',
+						workspace: wsId ?? '',
 						requestBody: { mode: newMode, force }
 					}),
 				'SQS trigger'
@@ -307,7 +310,7 @@
 			initialPath,
 			cfg,
 			edit,
-			$workspaceStore!,
+			wsId!,
 			usedTriggerKinds
 		)
 		if (isSaved) {
@@ -464,6 +467,7 @@
 			<div class="flex flex-col gap-4">
 				<Label label="Path">
 					<Path
+						workspaceOverride={wsId}
 						bind:dirty={dirtyPath}
 						bind:error={pathError}
 						bind:path
@@ -480,6 +484,7 @@
 			{#if !hideTarget}
 				<Section label="Runnable">
 					<TriggerRunnablePicker
+						workspace={wsId}
 						{fixedScriptPath}
 						bind:itemKind
 						bind:scriptPath={script_path}
@@ -529,6 +534,7 @@
 						</Tabs>
 						<div class="mt-4">
 							<TriggerRetriesAndErrorHandler
+								workspace={wsId}
 								{optionTabSelected}
 								{itemKind}
 								{can_write}
diff --git a/frontend/src/lib/components/triggers/triggerWorkspace.ts b/frontend/src/lib/components/triggers/triggerWorkspace.ts
new file mode 100644
index 0000000000..290db9da37
--- /dev/null
+++ b/frontend/src/lib/components/triggers/triggerWorkspace.ts
@@ -0,0 +1,29 @@
+import { getContext, setContext } from 'svelte'
+
+const TRIGGER_WORKSPACE_KEY = 'triggerWorkspace'
+
+/**
+ * Context seam letting the native-trigger editors operate on a workspace other
+ * than the globally-active `$workspaceStore`. An AI session can run against a
+ * (possibly forked) workspace that differs from the nav workspace WITHOUT
+ * switching `$workspaceStore` (see `SessionPicker`), so a host that embeds the
+ * trigger editors in that context registers a resolver here.
+ *
+ * Every workspace-scoped backend call / navigation inside the trigger subtree
+ * reads its workspace via {@link getTriggerWorkspace} and falls back to
+ * `$workspaceStore` when no resolver is set — the default everywhere outside
+ * such a host, so behavior there is unchanged. Mirrors the AI chat manager's
+ * `operatingWorkspace` resolver.
+ */
+export function setTriggerWorkspace(resolver: () => string | undefined): void {
+	setContext(TRIGGER_WORKSPACE_KEY, resolver)
+}
+
+/**
+ * The trigger-workspace resolver set by an embedding host, or `undefined` when
+ * none is set (fall back to `$workspaceStore`). Read once during component init;
+ * use in a `$derived`: `const ws = $derived(triggerWs?.() ?? $workspaceStore)`.
+ */
+export function getTriggerWorkspace(): (() => string | undefined) | undefined {
+	return getContext<(() => string | undefined) | undefined>(TRIGGER_WORKSPACE_KEY)
+}
diff --git a/frontend/src/lib/components/triggers/webhook/WebhooksConfigSection.svelte b/frontend/src/lib/components/triggers/webhook/WebhooksConfigSection.svelte
index 9bdf67ab94..36bb8e36d5 100644
--- a/frontend/src/lib/components/triggers/webhook/WebhooksConfigSection.svelte
+++ b/frontend/src/lib/components/triggers/webhook/WebhooksConfigSection.svelte
@@ -19,6 +19,7 @@
 	import { base } from '$lib/base'
 	import TriggerTokens from '../TriggerTokens.svelte'
 	import { workspaceStore, userStore } from '$lib/stores'
+	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
 	import UserSettings from '../../UserSettings.svelte'
 	import { generateRandomString } from '$lib/utils'
 	import TextInput from '$lib/components/text_input/TextInput.svelte'
@@ -42,8 +43,10 @@
 		triggerTokens = $bindable(undefined),
 		scopes = []
 	}: Props = $props()
+	const triggerWs = getTriggerWorkspace()
+	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
 
-	const WEBHOOK_BASE_URL = `${location.origin}${base}/api/w/${$workspaceStore}/jobs`
+	const WEBHOOK_BASE_URL = $derived(`${location.origin}${base}/api/w/${wsId}/jobs`)
 
 	let baseWebhookUrl = $derived.by(() => {
 		let webhookUrlPath: string
@@ -222,7 +225,7 @@ function waitForJobCompletion(UUID) {
     try {
       const endpoint = \`${
 				location.origin
-			}/api/w/${$workspaceStore}/jobs_u/completed/get_result_maybe/\${UUID}\`;
+			}/api/w/${wsId}/jobs_u/completed/get_result_maybe/\${UUID}\`;
       const checkResponse = await fetch(endpoint, {
         method: 'GET',
         headers: ${JSON.stringify(headers(), null, 2).replaceAll('\n', '\n\t\t\t\t')}
@@ -265,7 +268,7 @@ ${
 		? 'echo -E $RESULT | jq'
 		: requestType === 'async'
 			? `
-URL="${location.origin}/api/w/${$workspaceStore}/jobs_u/completed/get_result_maybe/$UUID"
+URL="${location.origin}/api/w/${wsId}/jobs_u/completed/get_result_maybe/$UUID"
 while true; do
   curl -s -H "Authorization: Bearer $TOKEN" $URL -o res.json
   COMPLETED=$(cat res.json | jq .completed)
@@ -287,7 +290,7 @@ done`
 		token = e.detail
 		triggerTokens?.listTokens()
 	}}
-	newTokenWorkspace={$workspaceStore}
+	newTokenWorkspace={wsId}
 	newTokenLabel={`webhook-${$userStore?.username ?? 'superadmin'}-${generateRandomString(4)}`}
 	{scopes}
 />
diff --git a/frontend/src/lib/components/useFolderDefaultPermissionedAs.svelte.ts b/frontend/src/lib/components/useFolderDefaultPermissionedAs.svelte.ts
index 785115e74c..9ff7e32024 100644
--- a/frontend/src/lib/components/useFolderDefaultPermissionedAs.svelte.ts
+++ b/frontend/src/lib/components/useFolderDefaultPermissionedAs.svelte.ts
@@ -12,13 +12,18 @@ import { workspaceStore, userStore } from '$lib/stores'
  * switch or permission change. Uses `runed`'s `resource()` which handles race conditions
  * and loading state automatically.
  */
-export function useFolderDefaultPermissionedAs(pathGetter: () => string | undefined) {
+export function useFolderDefaultPermissionedAs(
+	pathGetter: () => string | undefined,
+	// The acting workspace; defaults to the nav `$workspaceStore` when omitted so
+	// a forked session resolves the folder default from its own workspace.
+	wsGetter?: () => string | undefined
+) {
 	// Subscribe to the stores so the effect re-runs on changes.
-	let workspace = $state<string | undefined>(undefined)
+	let navWorkspace = $state<string | undefined>(undefined)
 	let user = $state<any>(undefined)
 
 	$effect(() => {
-		const unsubWs = workspaceStore.subscribe((w) => (workspace = w))
+		const unsubWs = workspaceStore.subscribe((w) => (navWorkspace = w))
 		const unsubUser = userStore.subscribe((u) => (user = u))
 		return () => {
 			unsubWs()
@@ -27,7 +32,7 @@ export function useFolderDefaultPermissionedAs(pathGetter: () => string | undefi
 	})
 
 	const folderResource = resource(
-		() => ({ path: pathGetter(), workspace, user }),
+		() => ({ path: pathGetter(), workspace: wsGetter?.() ?? navWorkspace, user }),
 		async ({ path, workspace, user }) => {
 			const canPreserve =
 				user?.is_admin || user?.is_super_admin || (user?.groups ?? []).includes('wm_deployers')

From 0b6bd376dbda437cae14176345e1964d294cd0c0 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 17 Jul 2026 18:11:49 +0000
Subject: [PATCH 042/171] ci: drop stale path_field_renames from mcp runner
 test constructor

#10176 removed `path_field_renames` from `EndpointTool`, while #10162 added a
new `ep()` test constructor in runner.rs that still set it. Each passed CI
against its own base, but together on main the test build fails with E0560.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 backend/windmill-mcp/src/server/runner.rs | 1 -
 1 file changed, 1 deletion(-)

diff --git a/backend/windmill-mcp/src/server/runner.rs b/backend/windmill-mcp/src/server/runner.rs
index ee6540520e..f9d8c5d876 100644
--- a/backend/windmill-mcp/src/server/runner.rs
+++ b/backend/windmill-mcp/src/server/runner.rs
@@ -854,7 +854,6 @@ mod tests {
             path_params_schema: None,
             query_params_schema: None,
             body_schema: None,
-            path_field_renames: None,
             query_field_renames: None,
             body_field_renames: None,
         }

From 3ffce7e2cc5dcda518bd4526bbecf70e063cac69 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 17 Jul 2026 20:15:13 +0200
Subject: [PATCH 043/171] chore(main): release 1.762.0 (#10175)

* chore(main): release 1.762.0

* Apply automatic changes

---------

Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>
---
 CHANGELOG.md                                  |  27 +++
 backend/Cargo.lock                            | 168 +++++++++---------
 backend/Cargo.toml                            |   4 +-
 .../parsers/windmill-parser-wasm/Cargo.lock   |  48 ++---
 .../parsers/windmill-parser-wasm/Cargo.toml   |   2 +-
 backend/windmill-api/openapi.yaml             |   2 +-
 benchmarks/lib.ts                             |   2 +-
 cli/src/core/constants.ts                     |   2 +-
 frontend/package-lock.json                    |  54 +++++-
 frontend/package.json                         |   2 +-
 lsp/Pipfile                                   |   2 +-
 openflow.openapi.yaml                         |   2 +-
 .../WindmillClient/WindmillClient.psd1        |   2 +-
 python-client/wmill/pyproject.toml            |   2 +-
 typescript-client/jsr.json                    |   2 +-
 typescript-client/package.json                |   2 +-
 version.txt                                   |   2 +-
 17 files changed, 199 insertions(+), 126 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7b65e78e8b..d53116ea90 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,32 @@
 # Changelog
 
+## [1.762.0](https://github.com/windmill-labs/windmill/compare/v1.761.0...v1.762.0) (2026-07-17)
+
+
+### Features
+
+* **ai-chat:** image attachments and agent raw-app screenshots ([#10130](https://github.com/windmill-labs/windmill/issues/10130)) ([7a139ab](https://github.com/windmill-labs/windmill/commit/7a139ab23e034321554d0c85540d54251e61cc72))
+* **forks:** let a fork's creator manage developers on it without being an admin ([#10166](https://github.com/windmill-labs/windmill/issues/10166)) ([97f4477](https://github.com/windmill-labs/windmill/commit/97f44770698eb3dd9e296012360b7d9a4492e28d))
+* **otel-tracing-proxy:** trust internal endpoints with untrusted CAs ([#10139](https://github.com/windmill-labs/windmill/issues/10139)) ([396fb1c](https://github.com/windmill-labs/windmill/commit/396fb1c4752b2b93ef0ec9d0c9c6be05aa403eef))
+* **worker-tags:** add `*` fork marker to workspace-scoped custom tags ([#10177](https://github.com/windmill-labs/windmill/issues/10177)) ([2ff5a91](https://github.com/windmill-labs/windmill/commit/2ff5a918d54074bc340b6e92222e9f5bb4369ba0))
+
+
+### Bug Fixes
+
+* **ai:** unbreak session chat compaction for Anthropic models ([#10171](https://github.com/windmill-labs/windmill/issues/10171)) ([a9fc9f7](https://github.com/windmill-labs/windmill/commit/a9fc9f74b2c5b280cc087f0bfbac50112081c5e8))
+* **ansible:** keep persistent-connection socket path under the AF_UNIX limit ([#10167](https://github.com/windmill-labs/windmill/issues/10167)) ([be57dd9](https://github.com/windmill-labs/windmill/commit/be57dd91e40551ff0d6fbbeccd97e2b98589c5b9))
+* **extra:** make the extra container runnable as a non-root UID ([#10173](https://github.com/windmill-labs/windmill/issues/10173)) ([dcb9e40](https://github.com/windmill-labs/windmill/commit/dcb9e40ea237c3744611ac6e83ff5ecc6528e697))
+* **flows:** make updateFlow body path optional so AI can update flows ([#10176](https://github.com/windmill-labs/windmill/issues/10176)) ([7d2c5ce](https://github.com/windmill-labs/windmill/commit/7d2c5ceb0fb8609aa58a1e28e61ae8ce86e48208))
+* **frontend:** scope session pipeline trigger editors to the session workspace ([#10032](https://github.com/windmill-labs/windmill/issues/10032)) ([8828341](https://github.com/windmill-labs/windmill/commit/8828341a2b0912cbf44d6c6d81b4f4e30c5fe631))
+* **mcp:** apply token scopes consistently across mcp endpoint tools ([#10162](https://github.com/windmill-labs/windmill/issues/10162)) ([ae3d9ce](https://github.com/windmill-labs/windmill/commit/ae3d9ce2c031beeafc4e8156e0c85f163647af0f))
+* parse all names in grouped go param declarations ([#10165](https://github.com/windmill-labs/windmill/issues/10165)) ([d0aa7dc](https://github.com/windmill-labs/windmill/commit/d0aa7dca13aedfec90b7e023954cc824dafa3d34))
+* **schedules:** re-arm enabled schedules left with no queued occurrence ([#10174](https://github.com/windmill-labs/windmill/issues/10174)) ([9762089](https://github.com/windmill-labs/windmill/commit/9762089fcbdb33dbf453d22342661e5857b2ad7e))
+
+
+### Performance Improvements
+
+* lazy-load session preview editor views for snappy AI sessions switch ([#10172](https://github.com/windmill-labs/windmill/issues/10172)) ([1edee8a](https://github.com/windmill-labs/windmill/commit/1edee8aa34503d2892c1ef7b1deabf99e4b528b4))
+
 ## [1.761.0](https://github.com/windmill-labs/windmill/compare/v1.760.1...v1.761.0) (2026-07-16)
 
 
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index a278882d38..b8c5da6c3d 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -784,9 +784,9 @@ dependencies = [
 
 [[package]]
 name = "aws-lc-rs"
-version = "1.17.1"
+version = "1.17.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4342d8937fc7e5dd9b1c60292261c0670c882a2cd1719cfc11b1af41731e32ad"
+checksum = "116fb6b3a2b6afe22b9ee35064c2ec3db155447019396bc02f2db35de4579dee"
 dependencies = [
  "aws-lc-sys",
  "untrusted 0.7.1",
@@ -795,9 +795,9 @@ dependencies = [
 
 [[package]]
 name = "aws-lc-sys"
-version = "0.42.0"
+version = "0.43.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d9ceb1da931507a12f4fccea479dccd00da1943e1b4ae72d8e502d707361444"
+checksum = "43103168cc76fe62678a375e722fc9cb3a0146159ac5828bc4f0dfd755c2224c"
 dependencies = [
  "cc",
  "cmake",
@@ -8702,9 +8702,9 @@ dependencies = [
 
 [[package]]
 name = "portable-atomic"
-version = "1.13.1"
+version = "1.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49"
+checksum = "3d20d5497ef88037a52ff98267d066e7f11fcc5e99bbfbd58a42336193aacec3"
 
 [[package]]
 name = "postgres-native-tls"
@@ -13867,7 +13867,7 @@ dependencies = [
 
 [[package]]
 name = "windmill"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -13952,7 +13952,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-ai"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "async-stream",
  "async-trait",
@@ -13985,7 +13985,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-alerting"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -13998,7 +13998,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "argon2",
@@ -14136,7 +14136,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-agent-workers"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14159,7 +14159,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-assets"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14174,7 +14174,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-auth"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14200,7 +14200,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "reqwest 0.12.28",
  "serde",
@@ -14210,7 +14210,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-configs"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14227,7 +14227,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-debug"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "axum 0.8.9",
  "base64 0.22.1",
@@ -14249,7 +14249,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-embeddings"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14272,7 +14272,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flow-conversations"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14288,7 +14288,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flows"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14309,7 +14309,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-groups"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14330,7 +14330,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-inputs"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14344,7 +14344,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-integration-tests"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -14379,7 +14379,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-jobs"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14404,7 +14404,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-npm-proxy"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "axum 0.8.9",
  "flate2",
@@ -14422,7 +14422,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-openapi"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14444,7 +14444,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-schedule"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14464,7 +14464,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-scripts"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14501,7 +14501,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-settings"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14529,7 +14529,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-sse"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "lazy_static",
  "serde",
@@ -14541,7 +14541,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-users"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "argon2",
  "axum 0.8.9",
@@ -14566,7 +14566,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workers"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14580,7 +14580,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workspaces"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14615,7 +14615,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -14629,7 +14629,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14648,7 +14648,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "aes-gcm",
  "aho-corasick",
@@ -14750,7 +14750,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-dep-map"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "chrono",
  "itertools 0.14.0",
@@ -14769,7 +14769,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "regex",
  "serde",
@@ -14784,7 +14784,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "astral-tokio-tar",
@@ -14808,7 +14808,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-jseval"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -14825,7 +14825,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -14841,7 +14841,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-mcp"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -14862,7 +14862,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-native-triggers"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -14893,7 +14893,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-oauth"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "arc-swap",
@@ -14918,7 +14918,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-object-store"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "async-stream",
@@ -14952,7 +14952,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-operator"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -14970,7 +14970,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -14979,7 +14979,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -14991,7 +14991,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15003,7 +15003,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -15015,7 +15015,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15027,7 +15027,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15039,7 +15039,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -15050,7 +15050,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15061,7 +15061,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15073,7 +15073,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -15084,7 +15084,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15106,7 +15106,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15118,7 +15118,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15132,7 +15132,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -15149,7 +15149,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15162,7 +15162,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -15174,7 +15174,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15192,7 +15192,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -15208,7 +15208,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -15224,7 +15224,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -15235,7 +15235,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15274,7 +15274,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-runtime-nativets"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "const_format",
@@ -15314,7 +15314,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "getrandom 0.3.4",
  "wasm-bindgen",
@@ -15325,7 +15325,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-store"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15359,7 +15359,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-test-utils"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15383,7 +15383,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15416,7 +15416,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-azure"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15449,7 +15449,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-email"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15469,7 +15469,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-gcp"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15503,7 +15503,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-http"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15539,7 +15539,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-kafka"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15562,7 +15562,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-mqtt"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15586,7 +15586,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-nats"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -15610,7 +15610,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-postgres"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15645,7 +15645,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-sqs"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15673,7 +15673,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-websocket"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15698,7 +15698,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "bitflags 2.13.1",
@@ -15717,7 +15717,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "async-once-cell",
@@ -15831,7 +15831,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker-volumes"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "bytes",
  "futures",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index b8277d852a..af4cecad5e 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.761.0"
+version = "1.762.0"
 authors.workspace = true
 edition.workspace = true
 
@@ -87,7 +87,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal", "./parsers/windmill-parser-wasm"]
 
 [workspace.package]
-version = "1.761.0"
+version = "1.762.0"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.lock b/backend/parsers/windmill-parser-wasm/Cargo.lock
index 74e913c46b..5debc9f25b 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.lock
+++ b/backend/parsers/windmill-parser-wasm/Cargo.lock
@@ -6191,7 +6191,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill-common"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "aho-corasick",
  "anyhow",
@@ -6272,7 +6272,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -6284,7 +6284,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "convert_case",
  "serde",
@@ -6293,7 +6293,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6305,7 +6305,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6317,7 +6317,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -6329,7 +6329,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6341,7 +6341,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6353,7 +6353,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -6364,7 +6364,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6375,7 +6375,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6387,7 +6387,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6398,7 +6398,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -6420,7 +6420,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6432,7 +6432,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6446,7 +6446,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "convert_case",
@@ -6463,7 +6463,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6476,7 +6476,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -6488,7 +6488,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6506,7 +6506,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -6522,7 +6522,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6538,7 +6538,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wasm"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "getrandom 0.2.17",
@@ -6570,7 +6570,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -6581,7 +6581,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.761.0"
+version = "1.762.0"
 dependencies = [
  "anyhow",
  "bitflags",
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.toml b/backend/parsers/windmill-parser-wasm/Cargo.toml
index c29d4c8bd4..f6b4a5f999 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.toml
+++ b/backend/parsers/windmill-parser-wasm/Cargo.toml
@@ -12,7 +12,7 @@ resolver = "2"
 members = ["."]
 
 [workspace.package]
-version = "1.761.0"
+version = "1.762.0"
 edition = "2021"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 18a9120356..21dd2b3134 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.761.0
+  version: 1.762.0
   title: Windmill API
 
   contact:
diff --git a/benchmarks/lib.ts b/benchmarks/lib.ts
index 30bc6e4a1d..d094f0d380 100644
--- a/benchmarks/lib.ts
+++ b/benchmarks/lib.ts
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.761.0";
+export const VERSION = "v1.762.0";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({
diff --git a/cli/src/core/constants.ts b/cli/src/core/constants.ts
index b51700e5a6..05379f512e 100644
--- a/cli/src/core/constants.ts
+++ b/cli/src/core/constants.ts
@@ -10,4 +10,4 @@ export const WM_FORK_PREFIX = "wm-fork";
 // (e.g. utils.ts) can read it without importing main.ts and creating a circular
 // dependency (main → workspace → utils → main) that triggers a TDZ.
 // Re-exported from main.ts for backwards compatibility.
-export const VERSION = "1.761.0";
+export const VERSION = "1.762.0";
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 32bf5ec54a..e9a1333dd7 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.761.0",
+	"version": "1.762.0",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "@windmill-labs/components",
-			"version": "1.761.0",
+			"version": "1.762.0",
 			"hasInstallScript": true,
 			"license": "AGPL-3.0",
 			"dependencies": {
@@ -880,6 +880,7 @@
 			"version": "1.11.2",
 			"resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.11.2.tgz",
 			"integrity": "sha512-TC8MkTuZUtcTSiFeuC0ksCh9QIJ5+F21MvZ4Wn4ORfYaFJ/0dsiudv5tVkejgwZlwQ39jL9WWDe2lz8x0WglOA==",
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"dependencies": {
@@ -891,6 +892,7 @@
 			"version": "1.11.2",
 			"resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.11.2.tgz",
 			"integrity": "sha512-kyOl3X0DuTiT1h2ft8r2fYO8JYtU9a9Xis/zBSiGArNaagCOWx90N1k2wxp18czFDH+OgcWGb5ZP/XMt3dcyPA==",
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"dependencies": {
@@ -901,6 +903,7 @@
 			"version": "1.2.2",
 			"resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-1.2.2.tgz",
 			"integrity": "sha512-c95qOXkHdydNKhscBTebqEC1CVAZpyqOfVfBzQ1qgzyl3gfeldUjIggDbIZgDKsHLgnsM+igH7TJ/eAasaVuMA==",
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"dependencies": {
@@ -1416,6 +1419,7 @@
 			"version": "1.1.4",
 			"resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.4.tgz",
 			"integrity": "sha512-3NQNNgA1YSlJb/kMH1ildASP9HW7/7kYnRI2szWJaofaS1hWmbGI4H+d3+22aGzXXN9IJ+n+GiFVcGipJP18ow==",
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"dependencies": {
@@ -1564,6 +1568,7 @@
 			"cpu": [
 				"arm64"
 			],
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1580,6 +1585,7 @@
 			"cpu": [
 				"arm64"
 			],
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1596,6 +1602,7 @@
 			"cpu": [
 				"x64"
 			],
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1612,6 +1619,7 @@
 			"cpu": [
 				"x64"
 			],
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1628,6 +1636,7 @@
 			"cpu": [
 				"arm"
 			],
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1644,6 +1653,7 @@
 			"cpu": [
 				"arm64"
 			],
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1660,6 +1670,7 @@
 			"cpu": [
 				"arm64"
 			],
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1676,6 +1687,7 @@
 			"cpu": [
 				"ppc64"
 			],
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1692,6 +1704,7 @@
 			"cpu": [
 				"s390x"
 			],
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1708,6 +1721,7 @@
 			"cpu": [
 				"x64"
 			],
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1724,6 +1738,7 @@
 			"cpu": [
 				"x64"
 			],
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1740,6 +1755,7 @@
 			"cpu": [
 				"arm64"
 			],
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1756,6 +1772,7 @@
 			"cpu": [
 				"wasm32"
 			],
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"dependencies": {
@@ -1774,6 +1791,7 @@
 			"cpu": [
 				"arm64"
 			],
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1790,6 +1808,7 @@
 			"cpu": [
 				"x64"
 			],
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -2095,6 +2114,7 @@
 			"version": "0.10.2",
 			"resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.2.tgz",
 			"integrity": "sha512-RoBvJ2X0wuKlWFIjrwffGw1IqZHKQqzIchKaadZZfnNpsAYp2mM0h36JtPCjNDAHGgYez/15uMBpfGwchhiMgg==",
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"dependencies": {
@@ -7330,7 +7350,7 @@
 			"version": "1.21.7",
 			"resolved": "https://registry.npmjs.org/jiti/-/jiti-1.21.7.tgz",
 			"integrity": "sha512-/imKNG4EbWNrVjoNC/1H5/9GFy+tqjGBHCaSsN+P2RnPqjsLmv6UD3Ej+Kj8nBWaRAwyk7kK5ZUc+OEatnTR3A==",
-			"devOptional": true,
+			"dev": true,
 			"license": "MIT",
 			"bin": {
 				"jiti": "bin/jiti.js"
@@ -7865,6 +7885,7 @@
 			"cpu": [
 				"arm64"
 			],
+			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -7885,6 +7906,7 @@
 			"cpu": [
 				"arm64"
 			],
+			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -7905,6 +7927,7 @@
 			"cpu": [
 				"x64"
 			],
+			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -7925,6 +7948,7 @@
 			"cpu": [
 				"x64"
 			],
+			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -7945,6 +7969,7 @@
 			"cpu": [
 				"arm"
 			],
+			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -7965,6 +7990,7 @@
 			"cpu": [
 				"arm64"
 			],
+			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -7985,6 +8011,7 @@
 			"cpu": [
 				"arm64"
 			],
+			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -8005,6 +8032,7 @@
 			"cpu": [
 				"x64"
 			],
+			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -8025,6 +8053,7 @@
 			"cpu": [
 				"x64"
 			],
+			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -8045,6 +8074,7 @@
 			"cpu": [
 				"arm64"
 			],
+			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -8065,6 +8095,7 @@
 			"cpu": [
 				"x64"
 			],
+			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -12758,6 +12789,21 @@
 				}
 			}
 		},
+		"node_modules/svelte-check/node_modules/picomatch": {
+			"version": "4.0.5",
+			"resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.5.tgz",
+			"integrity": "sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==",
+			"dev": true,
+			"license": "MIT",
+			"optional": true,
+			"peer": true,
+			"engines": {
+				"node": ">=12"
+			},
+			"funding": {
+				"url": "https://github.com/sponsors/jonschlinkert"
+			}
+		},
 		"node_modules/svelte-eslint-parser": {
 			"version": "0.43.0",
 			"resolved": "https://registry.npmjs.org/svelte-eslint-parser/-/svelte-eslint-parser-0.43.0.tgz",
@@ -13497,7 +13543,7 @@
 			"version": "5.9.3",
 			"resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
 			"integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
-			"devOptional": true,
+			"dev": true,
 			"license": "Apache-2.0",
 			"bin": {
 				"tsc": "bin/tsc",
diff --git a/frontend/package.json b/frontend/package.json
index 6b6d7d01ee..8b27877d35 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.761.0",
+	"version": "1.762.0",
 	"scripts": {
 		"dev": "vite dev",
 		"dev:ui-builder": "mv static/ui_builder static/ui_builder.dev-disabled 2>/dev/null || true ; trap 'mv static/ui_builder.dev-disabled static/ui_builder 2>/dev/null || true' EXIT ; vite dev",
diff --git a/lsp/Pipfile b/lsp/Pipfile
index 017325033b..ee15206a9a 100644
--- a/lsp/Pipfile
+++ b/lsp/Pipfile
@@ -4,7 +4,7 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-wmill = ">=1.761.0"
+wmill = ">=1.762.0"
 sendgrid = "*"
 mysql-connector-python = "*"
 pymongo = "*"
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index 687cf148ab..6f294f7a08 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1,7 +1,7 @@
 openapi: '3.0.3'
 
 info:
-  version: 1.761.0
+  version: 1.762.0
   title: OpenFlow Spec
   contact:
     name: Ruben Fiszel
diff --git a/powershell-client/WindmillClient/WindmillClient.psd1 b/powershell-client/WindmillClient/WindmillClient.psd1
index b1065fc8db..3376aba566 100644
--- a/powershell-client/WindmillClient/WindmillClient.psd1
+++ b/powershell-client/WindmillClient/WindmillClient.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'WindmillClient.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '1.761.0'
+    ModuleVersion     = '1.762.0'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()
diff --git a/python-client/wmill/pyproject.toml b/python-client/wmill/pyproject.toml
index fd1b6c11aa..55e530d3ce 100644
--- a/python-client/wmill/pyproject.toml
+++ b/python-client/wmill/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill"
-version = "1.761.0"
+version = "1.762.0"
 description = "A client library for accessing Windmill server wrapping the Windmill client API"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/typescript-client/jsr.json b/typescript-client/jsr.json
index 329b0408e9..fa175073c1 100644
--- a/typescript-client/jsr.json
+++ b/typescript-client/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@windmill/windmill",
-  "version": "1.761.0",
+  "version": "1.762.0",
   "exports": "./src/index.ts",
   "publish": {
     "exclude": ["!src", "./s3Types.ts", "./sqlUtils.ts", "./client.ts"]
diff --git a/typescript-client/package.json b/typescript-client/package.json
index be72cec08e..efe817f368 100644
--- a/typescript-client/package.json
+++ b/typescript-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.761.0",
+  "version": "1.762.0",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "homepage": "https://github.com/windmill-labs/windmill/tree/main/typescript-client#readme",
diff --git a/version.txt b/version.txt
index 5e7b269992..498e219d5d 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.761.0
+1.762.0

From 203f6c69dd24fc055a4bf604315aa757f35d0565 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 17 Jul 2026 21:26:40 +0200
Subject: [PATCH 044/171] fix(worker): gate ansible socket-dir name check to
 unix (#10180)

is_persistent_control_path_dir_name is only referenced from
prepare_socket_root, which is #[cfg(unix)]. On Windows nothing used it,
so -D dead-code failed the build. Gate the function and its unit test to
unix, matching the reaping code they support.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 backend/windmill-worker/src/ansible_executor.rs | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/backend/windmill-worker/src/ansible_executor.rs b/backend/windmill-worker/src/ansible_executor.rs
index 708250dac6..d3e71d8fdb 100644
--- a/backend/windmill-worker/src/ansible_executor.rs
+++ b/backend/windmill-worker/src/ansible_executor.rs
@@ -103,6 +103,7 @@ fn persistent_control_path_dir(job_id: &Uuid) -> Option<String> {
 
 /// Whether `name` is one this module could have created, i.e. `Uuid::simple` (32 hex, no
 /// hyphens). Belt to the root check's braces: nothing else should ever be in there.
+#[cfg(unix)]
 fn is_persistent_control_path_dir_name(name: &str) -> bool {
     name.len() == 32 && Uuid::try_parse(name).is_ok()
 }
@@ -2693,6 +2694,7 @@ collections_path : a/col:b/col
         );
     }
 
+    #[cfg(unix)]
     #[test]
     fn test_is_persistent_control_path_dir_name() {
         assert!(is_persistent_control_path_dir_name(

From c82056cfde93ab0e26cf82aa4f7650c060565542 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 17 Jul 2026 22:48:15 +0200
Subject: [PATCH 045/171] fix(schedules): stop disabling schedules on transient
 push errors (#10179)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix(schedules): stop disabling schedules on transient push errors

A scheduled flow whose next-occurrence push failed after retry exhaustion
used to be disabled, killing a healthy schedule over a transient DB blip
(pool contention, statement timeout). Now that the unarmed-schedule
reconciler exists (#10174), transient failures no longer disable: the
current occurrence runs to completion and the reconciler re-arms the next
occurrence once this run leaves the queue.

In the flow schedule-push path after retry exhaustion we now branch on the
error: QuotaExceeded/NotFound still disable (the schedule's own fault, and
rearm_schedule would otherwise leave them enabled-yet-unarmed forever),
while transient errors are only reported and the flow continues.

The previous iteration returned a SchedulePushZombieError to force a zombie
restart; that is removed, because zombie detection cancels (does not
restart) same-worker flows, so it would have lost the current run of a
same-worker scheduled flow. The now-obsolete SchedulePushZombieError type
and its catch in worker.rs are deleted.

Fixes WIN-2198

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(schedules): back off and surface repeated reconciler re-arm failures

The unarmed-schedule reconciler retried a schedule that could not be
re-armed on every pass, forever, logging only to the server. With the flow
schedule-push path no longer disabling on non-transient errors, a
persistently-broken push (bad stored cron/timezone/args, lapsed license
key) now stays enabled and would spin in that loop silently.

The reconciler now tracks consecutive re-arm failures per schedule:
exponential back-off (2, 4, 8, … passes, capped) between retries so a
broken schedule is not hammered, and after 3 consecutive failures it
surfaces the cause once (records schedule.error + raises a critical alert)
without disabling. Both reset the moment the schedule re-arms, which also
clears the recorded error.

Verified end-to-end on a running server: a flow schedule with a corrupted
cron stays enabled, retries back off, the error is surfaced after the
third failure, and it re-arms and clears the error once the cron is fixed.

Fixes WIN-2198

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 ...de907889fdfab77fa3af85a96ddaa068af733.json |  16 ++
 ...59703e5029536898469a484ebed23d6226e82.json |  15 ++
 backend/src/monitor.rs                        | 124 ++++++++++++-
 backend/windmill-queue/tests/schedule_push.rs | 166 ------------------
 backend/windmill-worker/src/worker.rs         |  21 +--
 backend/windmill-worker/src/worker_flow.rs    |  65 ++++---
 6 files changed, 185 insertions(+), 222 deletions(-)
 create mode 100644 backend/.sqlx/query-392681cc6aa1ed2119d33aa68c8de907889fdfab77fa3af85a96ddaa068af733.json
 create mode 100644 backend/.sqlx/query-72b44f728dea65b0542cb72244259703e5029536898469a484ebed23d6226e82.json

diff --git a/backend/.sqlx/query-392681cc6aa1ed2119d33aa68c8de907889fdfab77fa3af85a96ddaa068af733.json b/backend/.sqlx/query-392681cc6aa1ed2119d33aa68c8de907889fdfab77fa3af85a96ddaa068af733.json
new file mode 100644
index 0000000000..247a7d23f3
--- /dev/null
+++ b/backend/.sqlx/query-392681cc6aa1ed2119d33aa68c8de907889fdfab77fa3af85a96ddaa068af733.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE schedule SET error = $1 WHERE workspace_id = $2 AND path = $3 AND enabled IS TRUE",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "392681cc6aa1ed2119d33aa68c8de907889fdfab77fa3af85a96ddaa068af733"
+}
diff --git a/backend/.sqlx/query-72b44f728dea65b0542cb72244259703e5029536898469a484ebed23d6226e82.json b/backend/.sqlx/query-72b44f728dea65b0542cb72244259703e5029536898469a484ebed23d6226e82.json
new file mode 100644
index 0000000000..85f309bedc
--- /dev/null
+++ b/backend/.sqlx/query-72b44f728dea65b0542cb72244259703e5029536898469a484ebed23d6226e82.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE schedule SET error = NULL WHERE workspace_id = $1 AND path = $2 AND enabled IS TRUE",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "72b44f728dea65b0542cb72244259703e5029536898469a484ebed23d6226e82"
+}
diff --git a/backend/src/monitor.rs b/backend/src/monitor.rs
index d1c7a78059..916e46403e 100644
--- a/backend/src/monitor.rs
+++ b/backend/src/monitor.rs
@@ -3382,12 +3382,42 @@ const SCHEDULE_RECONCILE_STRIKES: u8 = 2;
 /// over several passes instead of enqueuing every occurrence at once.
 const SCHEDULE_RECONCILE_MAX_PER_PASS: usize = 50;
 
+/// Consecutive failed re-arm attempts after which a schedule's persistent failure
+/// is surfaced once (its `error` recorded + a critical alert). Most re-arm
+/// failures are a transient blip that clears on the next attempt; a schedule that
+/// keeps failing has a real cause (bad stored cron/timezone/args, lapsed license)
+/// and would otherwise be enabled-yet-silently-dead.
+const SCHEDULE_REARM_ALERT_THRESHOLD: u32 = 3;
+
+/// Cap on the exponential back-off (in reconcile passes) between re-arm retries of
+/// a schedule that keeps failing. Without a back-off a permanently-failing push
+/// retries every pass forever; the delay grows 2, 4, 8, … up to this cap and
+/// resets the moment the schedule re-arms.
+const SCHEDULE_REARM_MAX_BACKOFF_PASSES: u32 = 32;
+
+/// State for a schedule that keeps failing to re-arm: paces retries and drives the
+/// one-time visibility so the loop is neither hot nor silent.
+#[derive(Default)]
+struct RearmFailureState {
+    consecutive_failures: u32,
+    /// Reconcile passes still to skip before the next attempt (exponential back-off).
+    cooldown_passes: u32,
+    /// Whether the persistent failure has already been surfaced.
+    surfaced: bool,
+}
+
 lazy_static::lazy_static! {
     /// `(workspace_id, path)` -> consecutive passes seen with no queued occurrence.
     /// Bounded by the number of enabled schedules; entries drop as soon as a
     /// schedule is seen armed again.
     static ref UNARMED_SCHEDULES: Mutex<std::collections::HashMap<(String, String), u8>> =
         Mutex::new(std::collections::HashMap::new());
+
+    /// `(workspace_id, path)` -> back-off/visibility state for schedules that keep
+    /// failing to re-arm. Entries drop as soon as a schedule re-arms or is no
+    /// longer unarmed (armed, disabled, deleted).
+    static ref SCHEDULE_REARM_FAILURES: Mutex<std::collections::HashMap<(String, String), RearmFailureState>> =
+        Mutex::new(std::collections::HashMap::new());
 }
 
 /// Re-arm enabled schedules that have no queued occurrence.
@@ -3467,8 +3497,25 @@ fn strike_unarmed(
 }
 
 async fn reconcile_unarmed_schedules_inner(db: &Pool<Postgres>) -> error::Result<()> {
-    let current = find_unarmed_schedules(db).await?.into_iter().collect();
-    let mut to_rearm = strike_unarmed(&mut UNARMED_SCHEDULES.lock().unwrap(), current);
+    let current: std::collections::HashSet<(String, String)> =
+        find_unarmed_schedules(db).await?.into_iter().collect();
+    let mut to_rearm = strike_unarmed(&mut UNARMED_SCHEDULES.lock().unwrap(), current.clone());
+
+    // Back off schedules that keep failing to re-arm (bad stored cron/timezone/args,
+    // lapsed license): skip those still cooling down, and forget state for any that
+    // are no longer unarmed. Without this a permanently-failing push is retried
+    // every pass forever.
+    {
+        let mut failures = SCHEDULE_REARM_FAILURES.lock().unwrap();
+        failures.retain(|k, _| current.contains(k));
+        to_rearm.retain(|k| match failures.get_mut(k) {
+            Some(state) if state.cooldown_passes > 0 => {
+                state.cooldown_passes -= 1;
+                false
+            }
+            _ => true,
+        });
+    }
 
     // The first pass on an instance that has never been swept can find a large
     // backlog; re-arming it all at once would enqueue that whole backlog in one
@@ -3490,11 +3537,76 @@ async fn reconcile_unarmed_schedules_inner(db: &Pool<Postgres>) -> error::Result
                         "schedule reconcile: re-armed enabled schedule {path} in {w_id}, which had no queued occurrence"
                     );
                 }
-                UNARMED_SCHEDULES.lock().unwrap().remove(&(w_id, path));
+                UNARMED_SCHEDULES
+                    .lock()
+                    .unwrap()
+                    .remove(&(w_id.clone(), path.clone()));
+                // Clear the error we recorded once it re-arms, so a recovered
+                // schedule stops showing a stale failure.
+                let was_surfaced = SCHEDULE_REARM_FAILURES
+                    .lock()
+                    .unwrap()
+                    .remove(&(w_id.clone(), path.clone()))
+                    .is_some_and(|s| s.surfaced);
+                if was_surfaced {
+                    if let Err(e) = sqlx::query!(
+                        "UPDATE schedule SET error = NULL WHERE workspace_id = $1 AND path = $2 AND enabled IS TRUE",
+                        w_id,
+                        path
+                    )
+                    .execute(db)
+                    .await
+                    {
+                        tracing::error!(
+                            "schedule reconcile: could not clear error for {path} in {w_id}: {e:#}"
+                        );
+                    }
+                }
+            }
+            Err(e) => {
+                tracing::error!(
+                    "schedule reconcile: could not re-arm schedule {path} in {w_id}: {e:#}"
+                );
+                let should_surface = {
+                    let mut failures = SCHEDULE_REARM_FAILURES.lock().unwrap();
+                    let state = failures.entry((w_id.clone(), path.clone())).or_default();
+                    state.consecutive_failures += 1;
+                    state.cooldown_passes = (1u32 << state.consecutive_failures.min(5))
+                        .min(SCHEDULE_REARM_MAX_BACKOFF_PASSES);
+                    let surface = !state.surfaced
+                        && state.consecutive_failures >= SCHEDULE_REARM_ALERT_THRESHOLD;
+                    state.surfaced |= surface;
+                    surface
+                };
+                // Surface without disabling: record the error for the owner (schedule
+                // stays enabled) and raise a critical alert. rearm_schedule never
+                // disables, so this is the only signal a persistently-broken schedule
+                // gives beyond server logs.
+                if should_surface {
+                    if let Err(err) = sqlx::query!(
+                        "UPDATE schedule SET error = $1 WHERE workspace_id = $2 AND path = $3 AND enabled IS TRUE",
+                        e.to_string(),
+                        w_id,
+                        path
+                    )
+                    .execute(db)
+                    .await
+                    {
+                        tracing::error!(
+                            "schedule reconcile: could not record error for {path} in {w_id}: {err:#}"
+                        );
+                    }
+                    report_critical_error(
+                        format!(
+                            "Schedule {path} in workspace {w_id} is enabled but has repeatedly failed to re-arm and will not run until the cause is fixed: {e:#}"
+                        ),
+                        db.clone(),
+                        Some(&w_id),
+                        None,
+                    )
+                    .await;
+                }
             }
-            Err(e) => tracing::error!(
-                "schedule reconcile: could not re-arm schedule {path} in {w_id}: {e:#}"
-            ),
         }
     }
     Ok(())
diff --git a/backend/windmill-queue/tests/schedule_push.rs b/backend/windmill-queue/tests/schedule_push.rs
index 9ac2e3a143..3ac4cd2bd9 100644
--- a/backend/windmill-queue/tests/schedule_push.rs
+++ b/backend/windmill-queue/tests/schedule_push.rs
@@ -1429,172 +1429,6 @@ mod schedule_push {
         }
     }
 
-    // ===================================================================
-    // Zombie detection tests — verify that a flow left in queue after
-    // SchedulePushZombieError meets the restart criteria in monitor.rs
-    // ===================================================================
-
-    // -----------------------------------------------------------------------
-    // When both schedule push AND post-retry disable fail, the flow job stays
-    // in v2_job_queue as a zombie. This test simulates that state and verifies:
-    //
-    // 1. The zombie detection query (from handle_zombie_flows) finds the flow
-    // 2. The flow meets restart criteria: first module is WaitingForPriorSteps
-    //    and same_worker is false
-    // 3. After the restart UPDATE, the flow is re-queued (running=false)
-    // 4. The schedule remains enabled for retry on next flow execution
-    // -----------------------------------------------------------------------
-
-    #[sqlx::test(migrations = "../migrations", fixtures("base", "schedule_push"))]
-    async fn test_zombie_flow_after_schedule_push_failure_meets_restart_criteria(
-        db: Pool<Postgres>,
-    ) -> anyhow::Result<()> {
-        use windmill_common::flow_status::{FlowStatus, FlowStatusModule};
-
-        let flow_job_id = uuid::Uuid::new_v4();
-        let now = Utc::now();
-        let stale_ping = now - chrono::Duration::minutes(5);
-
-        // Schedule still enabled — simulates both push and disable failing
-        sqlx::query(
-            "INSERT INTO schedule (workspace_id, path, edited_by, edited_at, schedule, timezone, enabled, script_path, is_flow, email, extra_perms, ws_error_handler_muted, no_flow_overlap, permissioned_as)
-             VALUES ('test-workspace', 'f/system/test_schedule', 'test-user', now(), '0 0 */5 * * *', 'UTC', true, 'f/system/test_flow', true, 'test@windmill.dev', '{}', false, false, 'u/test-user')"
-        )
-        .execute(&db)
-        .await?;
-
-        // Flow job in v2_job (kind=flow, triggered by schedule, same_worker=false)
-        sqlx::query(
-            "INSERT INTO v2_job (id, workspace_id, created_at, created_by, permissioned_as, permissioned_as_email, kind, runnable_path, trigger, trigger_kind, same_worker, visible_to_owner, tag)
-             VALUES ($1, 'test-workspace', $2, 'test-user', 'u/test-user', 'test@windmill.dev', 'flow', 'f/system/test_flow', 'f/system/test_schedule', 'schedule', false, false, 'flow')"
-        )
-        .bind(flow_job_id)
-        .bind(now - chrono::Duration::minutes(5))
-        .execute(&db)
-        .await?;
-
-        // Queue entry: running=true (worker caught SchedulePushZombieError and returned Ok)
-        sqlx::query(
-            "INSERT INTO v2_job_queue (id, workspace_id, created_at, scheduled_for, running, started_at, tag, suspend)
-             VALUES ($1, 'test-workspace', $2, $2, true, $3, 'flow', 0)"
-        )
-        .bind(flow_job_id)
-        .bind(now - chrono::Duration::minutes(5))
-        .bind(now - chrono::Duration::minutes(4))
-        .execute(&db)
-        .await?;
-
-        // Stale ping — older than the 60s zombie transition timeout
-        sqlx::query("INSERT INTO v2_job_runtime (id, ping) VALUES ($1, $2)")
-            .bind(flow_job_id)
-            .bind(stale_ping)
-            .execute(&db)
-            .await?;
-
-        // Flow status at step 0, first module = WaitingForPriorSteps
-        // This is the initial state of a flow that hasn't started any steps yet
-        let flow_status = serde_json::json!({
-            "step": 0,
-            "modules": [{"type": "WaitingForPriorSteps", "id": "a"}],
-            "failure_module": {"type": "WaitingForPriorSteps", "id": "failure"},
-            "retry": {"fail_count": 0, "failed_jobs": []},
-            "cleanup_module": {"flow_jobs_to_clean": []}
-        });
-
-        sqlx::query("INSERT INTO v2_job_status (id, flow_status) VALUES ($1, $2::jsonb)")
-            .bind(flow_job_id)
-            .bind(&flow_status)
-            .execute(&db)
-            .await?;
-
-        // Run the same zombie detection query from handle_zombie_flows (60s timeout)
-        let zombie_flows = sqlx::query_as::<_, (uuid::Uuid, String, Option<bool>, Option<String>)>(
-            r#"
-            SELECT
-                j.id, j.workspace_id, j.same_worker,
-                COALESCE(s.flow_status, s.workflow_as_code_status)::text AS flow_status
-            FROM v2_job_queue q
-            JOIN v2_job j USING (id)
-            LEFT JOIN v2_job_runtime r USING (id)
-            LEFT JOIN v2_job_status s USING (id)
-            WHERE q.running = true AND q.suspend = 0 AND q.suspend_until IS null
-                AND q.scheduled_for <= now()
-                AND (j.kind = 'flow' OR j.kind = 'flowpreview' OR j.kind = 'flownode' OR j.kind = 'singlestepflow')
-                AND r.ping IS NOT NULL
-                AND r.ping < NOW() - ('60' || ' seconds')::interval
-                AND q.canceled_by IS NULL
-            "#,
-        )
-        .fetch_all(&db)
-        .await?;
-
-        assert_eq!(zombie_flows.len(), 1, "zombie flow must be detected");
-        let (id, _ws, same_worker, flow_status_json) = &zombie_flows[0];
-        assert_eq!(*id, flow_job_id);
-
-        // Replicate the exact branching logic from handle_zombie_flows (monitor.rs:2711-2754).
-        // Only flows matching the restart condition get restarted; others are cancelled.
-        let status = flow_status_json
-            .as_deref()
-            .and_then(|x| serde_json::from_str::<FlowStatus>(x).ok());
-        let should_restart = !same_worker.unwrap_or(false)
-            && status.is_some_and(|s| {
-                s.modules
-                    .get(0)
-                    .is_some_and(|x| matches!(x, FlowStatusModule::WaitingForPriorSteps { .. }))
-            });
-
-        assert!(
-            should_restart,
-            "flow must match the restart branch (not the cancel branch) in handle_zombie_flows"
-        );
-
-        // Apply the restart action — same UPDATE as handle_zombie_flows
-        sqlx::query(
-            "UPDATE v2_job_queue SET running = false, started_at = null
-             WHERE id = $1 AND canceled_by IS NULL",
-        )
-        .bind(flow_job_id)
-        .execute(&db)
-        .await?;
-
-        // Flow is re-queued for processing
-        let (running, started_at): (bool, Option<chrono::DateTime<Utc>>) =
-            sqlx::query_as("SELECT running, started_at FROM v2_job_queue WHERE id = $1")
-                .bind(flow_job_id)
-                .fetch_one(&db)
-                .await?;
-        assert!(!running, "flow must not be running after zombie restart");
-        assert!(
-            started_at.is_none(),
-            "started_at must be null after zombie restart"
-        );
-
-        // Schedule still enabled — will be retried when flow re-executes
-        let enabled: bool = sqlx::query_scalar(
-            "SELECT enabled FROM schedule WHERE workspace_id = 'test-workspace' AND path = 'f/system/test_schedule'",
-        )
-        .fetch_one(&db)
-        .await?;
-        assert!(
-            enabled,
-            "schedule must remain enabled for retry after zombie restart"
-        );
-
-        // Flow job is NOT in v2_job_completed (it was never completed with error)
-        let completed_count: i64 =
-            sqlx::query_scalar("SELECT COUNT(*) FROM v2_job_completed WHERE id = $1")
-                .bind(flow_job_id)
-                .fetch_one(&db)
-                .await?;
-        assert_eq!(
-            completed_count, 0,
-            "flow must not be in completed_job — it's a zombie, not an error"
-        );
-
-        Ok(())
-    }
-
     // -----------------------------------------------------------------------
     // push_scheduled_job: reserved ducklake-maintenance prefix
     // -----------------------------------------------------------------------
diff --git a/backend/windmill-worker/src/worker.rs b/backend/windmill-worker/src/worker.rs
index ece7b03ee7..1b11d735c3 100644
--- a/backend/windmill-worker/src/worker.rs
+++ b/backend/windmill-worker/src/worker.rs
@@ -149,7 +149,7 @@ use crate::{
     pwsh_executor::handle_powershell_job,
     result_processor::{handle_job_error, process_result, start_background_processor},
     schema::schema_validator_from_main_arg_sig,
-    worker_flow::{handle_flow, SchedulePushZombieError},
+    worker_flow::handle_flow,
     worker_lockfiles::{
         handle_app_dependency_job, handle_dependency_job, handle_flow_dependency_job,
     },
@@ -1602,7 +1602,7 @@ const STATUS_DESCRIPTION_MAX_LEN: usize = 512;
 #[derive(Debug)]
 pub enum JobOutcome {
     /// Job ran cleanly, was forwarded as a flow, was a no-op (test workspace),
-    /// or was suspended waiting for child jobs (WAC v2 / schedule zombie).
+    /// or was suspended waiting for child jobs (WAC v2).
     /// All of these leave the span `Status` `Unset`.
     Completed,
     /// Job was attempted but its execution returned an error; the failure has
@@ -3819,7 +3819,7 @@ pub async fn handle_queued_job(
                 // Not a preview: fetch from the cache or the database.
                 _ => cache::job::fetch_flow(db, &job.kind, job.runnable_id).await?,
             };
-            match Box::pin(handle_flow(
+            Box::pin(handle_flow(
                 job,
                 &flow_data,
                 db,
@@ -3836,19 +3836,8 @@ pub async fn handle_queued_job(
                 false,
             ))
             .warn_after_seconds(10)
-            .await
-            {
-                Err(err) if err.downcast_ref::<SchedulePushZombieError>().is_some() => {
-                    tracing::error!(
-                        "Schedule push zombie: {err}. Leaving flow job in queue for zombie detection to restart."
-                    );
-                    Ok(JobOutcome::Completed)
-                }
-                other => {
-                    other?;
-                    Ok(JobOutcome::Completed)
-                }
-            }
+            .await?;
+            Ok(JobOutcome::Completed)
         } else {
             return Err(Error::internal_err(
                 "Could not handle flow job with agent worker".to_string(),
diff --git a/backend/windmill-worker/src/worker_flow.rs b/backend/windmill-worker/src/worker_flow.rs
index 10e8218a77..21f4ce6925 100644
--- a/backend/windmill-worker/src/worker_flow.rs
+++ b/backend/windmill-worker/src/worker_flow.rs
@@ -108,17 +108,6 @@ lazy_static::lazy_static! {
         quick_cache::sync::Cache::new(1024);
 }
 
-#[derive(Debug)]
-pub struct SchedulePushZombieError(pub String);
-
-impl std::fmt::Display for SchedulePushZombieError {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        write!(f, "{}", self.0)
-    }
-}
-
-impl std::error::Error for SchedulePushZombieError {}
-
 /// Helper function to write itered data to separate table
 /// Returns None if data was written to separate table, Some(itered) if it should be stored in JSONB
 async fn write_itered_to_db(
@@ -2913,38 +2902,46 @@ pub async fn handle_flow(
             .sleep(tokio::time::sleep)
             .await;
 
-            // Non-retryable errors (QuotaExceeded, NotFound) are handled inside
-            // try_schedule_next_job (schedule disabled, returns None), so they never
-            // reach here. This handles only transient errors after retry exhaustion.
             if let Err(err) = schedule_push_result {
-                tracing::error!(
-                    "Could not push next scheduled job for {} after retries: {err}. Disabling schedule.",
-                    schedule.path
-                );
-                if let Err(disable_err) = sqlx::query!(
-                    "UPDATE schedule SET enabled = false, error = $1 WHERE workspace_id = $2 AND path = $3",
-                    err.to_string(),
-                    &flow_job.workspace_id,
-                    &schedule.path
-                )
-                .execute(db)
-                .await
-                {
+                if matches!(err, Error::QuotaExceeded(_) | Error::NotFound(_)) {
+                    // try_schedule_next_job disables on these, so reaching here means
+                    // its own disable write failed. Retry it: rearm_schedule turns
+                    // these into NoOp, so without disabling here the schedule would
+                    // stay enabled yet never run.
+                    if let Err(disable_err) = sqlx::query!(
+                        "UPDATE schedule SET enabled = false, error = $1 WHERE workspace_id = $2 AND path = $3",
+                        err.to_string(),
+                        &flow_job.workspace_id,
+                        &schedule.path
+                    )
+                    .execute(db)
+                    .await
+                    {
+                        report_error_to_workspace_handler_or_critical_side_channel(
+                            &mini_job,
+                            db,
+                            format!(
+                                "Could not push next scheduled job for {} and could not disable schedule: {disable_err}",
+                                schedule.path,
+                            ),
+                        )
+                        .await;
+                    }
+                } else {
+                    // Transient error (DB contention, timeout) after retry exhaustion:
+                    // not the schedule's fault. Report it but leave the schedule
+                    // enabled; the current occurrence runs to completion and the
+                    // unarmed-schedule reconciler re-arms the next one. Do not
+                    // fail/requeue: a same-worker zombie would be canceled, losing it.
                     report_error_to_workspace_handler_or_critical_side_channel(
                         &mini_job,
                         db,
                         format!(
-                            "Could not push next scheduled job for {} and could not disable schedule: {disable_err}",
+                            "Could not push next scheduled job for {} after retries: {err}. Leaving it enabled for the unarmed-schedule reconciler to re-arm.",
                             schedule.path,
                         ),
                     )
                     .await;
-                    return Err(SchedulePushZombieError(
-                        format!(
-                            "Could not push or disable schedule {} after retries",
-                            schedule.path
-                        ),
-                    ).into());
                 }
             }
         } else {

From 252ffd0401dee21c841b086007f92f7f1d09eeee Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 17 Jul 2026 22:52:46 +0200
Subject: [PATCH 046/171] chore(main): release 1.762.1 (#10181)

* chore(main): release 1.762.1

* Apply automatic changes

---------

Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>
---
 CHANGELOG.md                                  |   8 +
 backend/Cargo.lock                            | 160 +++++++++---------
 backend/Cargo.toml                            |   4 +-
 .../parsers/windmill-parser-wasm/Cargo.lock   |  48 +++---
 .../parsers/windmill-parser-wasm/Cargo.toml   |   2 +-
 backend/windmill-api/openapi.yaml             |   2 +-
 benchmarks/lib.ts                             |   2 +-
 cli/src/core/constants.ts                     |   2 +-
 frontend/package-lock.json                    |   4 +-
 frontend/package.json                         |   2 +-
 lsp/Pipfile                                   |   2 +-
 openflow.openapi.yaml                         |   2 +-
 .../WindmillClient/WindmillClient.psd1        |   2 +-
 python-client/wmill/pyproject.toml            |   2 +-
 typescript-client/jsr.json                    |   2 +-
 typescript-client/package.json                |   2 +-
 version.txt                                   |   2 +-
 17 files changed, 128 insertions(+), 120 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d53116ea90..3417027613 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,13 @@
 # Changelog
 
+## [1.762.1](https://github.com/windmill-labs/windmill/compare/v1.762.0...v1.762.1) (2026-07-17)
+
+
+### Bug Fixes
+
+* **schedules:** stop disabling schedules on transient push errors ([#10179](https://github.com/windmill-labs/windmill/issues/10179)) ([c82056c](https://github.com/windmill-labs/windmill/commit/c82056cfde93ab0e26cf82aa4f7650c060565542))
+* **worker:** gate ansible socket-dir name check to unix ([#10180](https://github.com/windmill-labs/windmill/issues/10180)) ([203f6c6](https://github.com/windmill-labs/windmill/commit/203f6c69dd24fc055a4bf604315aa757f35d0565))
+
 ## [1.762.0](https://github.com/windmill-labs/windmill/compare/v1.761.0...v1.762.0) (2026-07-17)
 
 
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index b8c5da6c3d..a2b0587dc0 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -784,9 +784,9 @@ dependencies = [
 
 [[package]]
 name = "aws-lc-rs"
-version = "1.17.2"
+version = "1.17.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "116fb6b3a2b6afe22b9ee35064c2ec3db155447019396bc02f2db35de4579dee"
+checksum = "00bdb5da18dac48ca2cc7cd4a98e533e8635a58e2361d13a1a4ee3888e0d72f1"
 dependencies = [
  "aws-lc-sys",
  "untrusted 0.7.1",
@@ -13867,7 +13867,7 @@ dependencies = [
 
 [[package]]
 name = "windmill"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -13952,7 +13952,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-ai"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "async-stream",
  "async-trait",
@@ -13985,7 +13985,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-alerting"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -13998,7 +13998,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "argon2",
@@ -14136,7 +14136,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-agent-workers"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14159,7 +14159,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-assets"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14174,7 +14174,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-auth"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14200,7 +14200,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "reqwest 0.12.28",
  "serde",
@@ -14210,7 +14210,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-configs"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14227,7 +14227,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-debug"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "axum 0.8.9",
  "base64 0.22.1",
@@ -14249,7 +14249,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-embeddings"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14272,7 +14272,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flow-conversations"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14288,7 +14288,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flows"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14309,7 +14309,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-groups"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14330,7 +14330,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-inputs"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14344,7 +14344,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-integration-tests"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -14379,7 +14379,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-jobs"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14404,7 +14404,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-npm-proxy"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "axum 0.8.9",
  "flate2",
@@ -14422,7 +14422,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-openapi"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14444,7 +14444,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-schedule"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14464,7 +14464,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-scripts"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14501,7 +14501,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-settings"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14529,7 +14529,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-sse"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "lazy_static",
  "serde",
@@ -14541,7 +14541,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-users"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "argon2",
  "axum 0.8.9",
@@ -14566,7 +14566,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workers"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14580,7 +14580,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workspaces"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14615,7 +14615,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -14629,7 +14629,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14648,7 +14648,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "aes-gcm",
  "aho-corasick",
@@ -14750,7 +14750,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-dep-map"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "chrono",
  "itertools 0.14.0",
@@ -14769,7 +14769,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "regex",
  "serde",
@@ -14784,7 +14784,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "astral-tokio-tar",
@@ -14808,7 +14808,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-jseval"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "futures",
@@ -14825,7 +14825,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -14841,7 +14841,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-mcp"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -14862,7 +14862,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-native-triggers"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -14893,7 +14893,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-oauth"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "arc-swap",
@@ -14918,7 +14918,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-object-store"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "async-stream",
@@ -14952,7 +14952,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-operator"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "futures",
@@ -14970,7 +14970,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -14979,7 +14979,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -14991,7 +14991,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15003,7 +15003,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -15015,7 +15015,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15027,7 +15027,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15039,7 +15039,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -15050,7 +15050,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15061,7 +15061,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15073,7 +15073,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -15084,7 +15084,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15106,7 +15106,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15118,7 +15118,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15132,7 +15132,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -15149,7 +15149,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15162,7 +15162,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "serde",
@@ -15174,7 +15174,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15192,7 +15192,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -15208,7 +15208,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -15224,7 +15224,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "serde",
@@ -15235,7 +15235,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15274,7 +15274,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-runtime-nativets"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "const_format",
@@ -15314,7 +15314,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "getrandom 0.3.4",
  "wasm-bindgen",
@@ -15325,7 +15325,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-store"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15359,7 +15359,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-test-utils"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15383,7 +15383,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15416,7 +15416,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-azure"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15449,7 +15449,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-email"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15469,7 +15469,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-gcp"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15503,7 +15503,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-http"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15539,7 +15539,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-kafka"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15562,7 +15562,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-mqtt"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15586,7 +15586,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-nats"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -15610,7 +15610,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-postgres"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15645,7 +15645,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-sqs"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15673,7 +15673,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-websocket"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15698,7 +15698,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "bitflags 2.13.1",
@@ -15717,7 +15717,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "async-once-cell",
@@ -15831,7 +15831,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker-volumes"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "bytes",
  "futures",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index af4cecad5e..040bef7fc4 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.762.0"
+version = "1.762.1"
 authors.workspace = true
 edition.workspace = true
 
@@ -87,7 +87,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal", "./parsers/windmill-parser-wasm"]
 
 [workspace.package]
-version = "1.762.0"
+version = "1.762.1"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.lock b/backend/parsers/windmill-parser-wasm/Cargo.lock
index 5debc9f25b..c6776acc37 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.lock
+++ b/backend/parsers/windmill-parser-wasm/Cargo.lock
@@ -6191,7 +6191,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill-common"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "aho-corasick",
  "anyhow",
@@ -6272,7 +6272,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -6284,7 +6284,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "convert_case",
  "serde",
@@ -6293,7 +6293,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6305,7 +6305,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6317,7 +6317,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -6329,7 +6329,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6341,7 +6341,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6353,7 +6353,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -6364,7 +6364,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6375,7 +6375,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6387,7 +6387,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6398,7 +6398,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -6420,7 +6420,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6432,7 +6432,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6446,7 +6446,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "convert_case",
@@ -6463,7 +6463,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6476,7 +6476,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "serde",
@@ -6488,7 +6488,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6506,7 +6506,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -6522,7 +6522,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6538,7 +6538,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wasm"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "getrandom 0.2.17",
@@ -6570,7 +6570,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "serde",
@@ -6581,7 +6581,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.762.0"
+version = "1.762.1"
 dependencies = [
  "anyhow",
  "bitflags",
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.toml b/backend/parsers/windmill-parser-wasm/Cargo.toml
index f6b4a5f999..ec01c72a78 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.toml
+++ b/backend/parsers/windmill-parser-wasm/Cargo.toml
@@ -12,7 +12,7 @@ resolver = "2"
 members = ["."]
 
 [workspace.package]
-version = "1.762.0"
+version = "1.762.1"
 edition = "2021"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 21dd2b3134..afc5fe1006 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.762.0
+  version: 1.762.1
   title: Windmill API
 
   contact:
diff --git a/benchmarks/lib.ts b/benchmarks/lib.ts
index d094f0d380..aab12ce891 100644
--- a/benchmarks/lib.ts
+++ b/benchmarks/lib.ts
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.762.0";
+export const VERSION = "v1.762.1";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({
diff --git a/cli/src/core/constants.ts b/cli/src/core/constants.ts
index 05379f512e..c35ef043e0 100644
--- a/cli/src/core/constants.ts
+++ b/cli/src/core/constants.ts
@@ -10,4 +10,4 @@ export const WM_FORK_PREFIX = "wm-fork";
 // (e.g. utils.ts) can read it without importing main.ts and creating a circular
 // dependency (main → workspace → utils → main) that triggers a TDZ.
 // Re-exported from main.ts for backwards compatibility.
-export const VERSION = "1.762.0";
+export const VERSION = "1.762.1";
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index e9a1333dd7..04358fb631 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.762.0",
+	"version": "1.762.1",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "@windmill-labs/components",
-			"version": "1.762.0",
+			"version": "1.762.1",
 			"hasInstallScript": true,
 			"license": "AGPL-3.0",
 			"dependencies": {
diff --git a/frontend/package.json b/frontend/package.json
index 8b27877d35..fab35c7881 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.762.0",
+	"version": "1.762.1",
 	"scripts": {
 		"dev": "vite dev",
 		"dev:ui-builder": "mv static/ui_builder static/ui_builder.dev-disabled 2>/dev/null || true ; trap 'mv static/ui_builder.dev-disabled static/ui_builder 2>/dev/null || true' EXIT ; vite dev",
diff --git a/lsp/Pipfile b/lsp/Pipfile
index ee15206a9a..0cd04c08d0 100644
--- a/lsp/Pipfile
+++ b/lsp/Pipfile
@@ -4,7 +4,7 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-wmill = ">=1.762.0"
+wmill = ">=1.762.1"
 sendgrid = "*"
 mysql-connector-python = "*"
 pymongo = "*"
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index 6f294f7a08..68c2832c5e 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1,7 +1,7 @@
 openapi: '3.0.3'
 
 info:
-  version: 1.762.0
+  version: 1.762.1
   title: OpenFlow Spec
   contact:
     name: Ruben Fiszel
diff --git a/powershell-client/WindmillClient/WindmillClient.psd1 b/powershell-client/WindmillClient/WindmillClient.psd1
index 3376aba566..4e6912fac3 100644
--- a/powershell-client/WindmillClient/WindmillClient.psd1
+++ b/powershell-client/WindmillClient/WindmillClient.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'WindmillClient.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '1.762.0'
+    ModuleVersion     = '1.762.1'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()
diff --git a/python-client/wmill/pyproject.toml b/python-client/wmill/pyproject.toml
index 55e530d3ce..ad96b11b5e 100644
--- a/python-client/wmill/pyproject.toml
+++ b/python-client/wmill/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill"
-version = "1.762.0"
+version = "1.762.1"
 description = "A client library for accessing Windmill server wrapping the Windmill client API"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/typescript-client/jsr.json b/typescript-client/jsr.json
index fa175073c1..0e89fc58df 100644
--- a/typescript-client/jsr.json
+++ b/typescript-client/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@windmill/windmill",
-  "version": "1.762.0",
+  "version": "1.762.1",
   "exports": "./src/index.ts",
   "publish": {
     "exclude": ["!src", "./s3Types.ts", "./sqlUtils.ts", "./client.ts"]
diff --git a/typescript-client/package.json b/typescript-client/package.json
index efe817f368..6d5e2f98ba 100644
--- a/typescript-client/package.json
+++ b/typescript-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.762.0",
+  "version": "1.762.1",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "homepage": "https://github.com/windmill-labs/windmill/tree/main/typescript-client#readme",
diff --git a/version.txt b/version.txt
index 498e219d5d..9fd908779f 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.762.0
+1.762.1

From cba5f0d8a8c2261a190d0f10396a6ad6aed89366 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Sat, 18 Jul 2026 08:39:22 +0200
Subject: [PATCH 047/171] fix(scripts): populate auto_kind from draft JSON for
 draft-only scripts (#10183)

The scripts list endpoint (include_draft_only=true) only populated
auto_kind for the pipeline case, leaving library draft-only scripts
(no `main` function) with auto_kind: null even though the frontend
saves auto_kind: "lib" into the draft JSON. This made it impossible
to distinguish library draft-only scripts from regular ones without a
separate per-script API call.

Fall back to the auto_kind saved in the draft value after the
content-derived pipeline check, which keeps priority since it mirrors
the deploy-time computation.

Fixes WIN-2199

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 backend/windmill-api-scripts/src/scripts.rs | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/backend/windmill-api-scripts/src/scripts.rs b/backend/windmill-api-scripts/src/scripts.rs
index fd9899ea10..16ca652b07 100644
--- a/backend/windmill-api-scripts/src/scripts.rs
+++ b/backend/windmill-api-scripts/src/scripts.rs
@@ -417,11 +417,19 @@ async fn list_scripts(
             // A draft-only pipeline node (`// pipeline`) has no deployed row to carry
             // auto_kind, so compute it from the draft content — mirroring the create
             // path — so the home page folds it into its pipeline like a deployed member.
+            // Otherwise fall back to the `auto_kind` the frontend saved into the draft
+            // (e.g. `lib` for scripts without a `main`); the content-derived pipeline
+            // annotation keeps priority since it mirrors the deploy-time computation.
             let auto_kind = v
                 .get("content")
                 .and_then(|s| s.as_str())
                 .filter(|c| parse_pipeline_annotations(c).in_pipeline)
-                .map(|_| "pipeline".to_string());
+                .map(|_| "pipeline".to_string())
+                .or_else(|| {
+                    v.get("auto_kind")
+                        .and_then(|s| s.as_str())
+                        .map(|s| s.to_string())
+                });
             rows.push(ListableScript {
                 hash: ScriptHash(0),
                 path: row.path,

From f6e36f862e5ac950ed6cfa9344cc3679184c6fe7 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Sat, 18 Jul 2026 08:49:41 +0200
Subject: [PATCH 048/171] chore(schedules): lower reconciler re-arm back-off
 cap to 8 passes (#10182)

Follow-up to #10179. The exponential back-off between reconciler re-arm
retries of a persistently-failing schedule capped at 32 passes (~2.7h at
the default 5-min reconcile cadence). Lower the cap to 8 (~40min) so a
schedule fixed out of band (a lapsed license renewed, a bad cron corrected
directly in the DB) auto-recovers within a few passes, while still cutting
the retry rate sharply versus retrying every pass. Fixes via the UI/API
re-arm immediately and are unaffected.

Fixes WIN-2198

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 backend/src/monitor.rs | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/backend/src/monitor.rs b/backend/src/monitor.rs
index 916e46403e..35d057ab12 100644
--- a/backend/src/monitor.rs
+++ b/backend/src/monitor.rs
@@ -3391,9 +3391,10 @@ const SCHEDULE_REARM_ALERT_THRESHOLD: u32 = 3;
 
 /// Cap on the exponential back-off (in reconcile passes) between re-arm retries of
 /// a schedule that keeps failing. Without a back-off a permanently-failing push
-/// retries every pass forever; the delay grows 2, 4, 8, … up to this cap and
-/// resets the moment the schedule re-arms.
-const SCHEDULE_REARM_MAX_BACKOFF_PASSES: u32 = 32;
+/// retries every pass forever; the delay grows 2, 4, 8 and holds at this cap, and
+/// resets the moment the schedule re-arms. Kept small so a schedule fixed out of
+/// band (the UI/API re-arms immediately) still auto-recovers within a few passes.
+const SCHEDULE_REARM_MAX_BACKOFF_PASSES: u32 = 8;
 
 /// State for a schedule that keeps failing to re-arm: paces retries and drives the
 /// one-time visibility so the loop is neither hot nor silent.

From d5b0a1b5c738c6ad873a5caef15c902e6922f335 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Sat, 18 Jul 2026 08:49:56 +0200
Subject: [PATCH 049/171] chore(main): release 1.762.2 (#10184)

* chore(main): release 1.762.2

* Apply automatic changes

---------

Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>
---
 CHANGELOG.md                                  |   7 +
 backend/Cargo.lock                            | 156 +++++++++---------
 backend/Cargo.toml                            |   4 +-
 .../parsers/windmill-parser-wasm/Cargo.lock   |  48 +++---
 .../parsers/windmill-parser-wasm/Cargo.toml   |   2 +-
 backend/windmill-api/openapi.yaml             |   2 +-
 benchmarks/lib.ts                             |   2 +-
 cli/src/core/constants.ts                     |   2 +-
 frontend/package-lock.json                    |   4 +-
 frontend/package.json                         |   2 +-
 lsp/Pipfile                                   |   2 +-
 openflow.openapi.yaml                         |   2 +-
 .../WindmillClient/WindmillClient.psd1        |   2 +-
 python-client/wmill/pyproject.toml            |   2 +-
 typescript-client/jsr.json                    |   2 +-
 typescript-client/package.json                |   2 +-
 version.txt                                   |   2 +-
 17 files changed, 125 insertions(+), 118 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3417027613..17158dcad9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.762.2](https://github.com/windmill-labs/windmill/compare/v1.762.1...v1.762.2) (2026-07-18)
+
+
+### Bug Fixes
+
+* **scripts:** populate auto_kind from draft JSON for draft-only scripts ([#10183](https://github.com/windmill-labs/windmill/issues/10183)) ([cba5f0d](https://github.com/windmill-labs/windmill/commit/cba5f0d8a8c2261a190d0f10396a6ad6aed89366))
+
 ## [1.762.1](https://github.com/windmill-labs/windmill/compare/v1.762.0...v1.762.1) (2026-07-17)
 
 
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index a2b0587dc0..e05ce5b763 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -13867,7 +13867,7 @@ dependencies = [
 
 [[package]]
 name = "windmill"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -13952,7 +13952,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-ai"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "async-stream",
  "async-trait",
@@ -13985,7 +13985,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-alerting"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -13998,7 +13998,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "argon2",
@@ -14136,7 +14136,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-agent-workers"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14159,7 +14159,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-assets"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14174,7 +14174,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-auth"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14200,7 +14200,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "reqwest 0.12.28",
  "serde",
@@ -14210,7 +14210,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-configs"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14227,7 +14227,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-debug"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "axum 0.8.9",
  "base64 0.22.1",
@@ -14249,7 +14249,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-embeddings"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14272,7 +14272,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flow-conversations"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14288,7 +14288,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flows"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14309,7 +14309,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-groups"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14330,7 +14330,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-inputs"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14344,7 +14344,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-integration-tests"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -14379,7 +14379,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-jobs"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14404,7 +14404,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-npm-proxy"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "axum 0.8.9",
  "flate2",
@@ -14422,7 +14422,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-openapi"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14444,7 +14444,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-schedule"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14464,7 +14464,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-scripts"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14501,7 +14501,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-settings"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14529,7 +14529,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-sse"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "lazy_static",
  "serde",
@@ -14541,7 +14541,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-users"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "argon2",
  "axum 0.8.9",
@@ -14566,7 +14566,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workers"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14580,7 +14580,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workspaces"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14615,7 +14615,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -14629,7 +14629,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14648,7 +14648,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "aes-gcm",
  "aho-corasick",
@@ -14750,7 +14750,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-dep-map"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "chrono",
  "itertools 0.14.0",
@@ -14769,7 +14769,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "regex",
  "serde",
@@ -14784,7 +14784,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "astral-tokio-tar",
@@ -14808,7 +14808,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-jseval"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "futures",
@@ -14825,7 +14825,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -14841,7 +14841,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-mcp"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -14862,7 +14862,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-native-triggers"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -14893,7 +14893,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-oauth"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "arc-swap",
@@ -14918,7 +14918,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-object-store"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "async-stream",
@@ -14952,7 +14952,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-operator"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "futures",
@@ -14970,7 +14970,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -14979,7 +14979,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -14991,7 +14991,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15003,7 +15003,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -15015,7 +15015,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15027,7 +15027,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15039,7 +15039,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -15050,7 +15050,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15061,7 +15061,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15073,7 +15073,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -15084,7 +15084,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15106,7 +15106,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15118,7 +15118,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15132,7 +15132,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -15149,7 +15149,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15162,7 +15162,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "serde",
@@ -15174,7 +15174,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15192,7 +15192,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -15208,7 +15208,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -15224,7 +15224,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "serde",
@@ -15235,7 +15235,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15274,7 +15274,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-runtime-nativets"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "const_format",
@@ -15314,7 +15314,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "getrandom 0.3.4",
  "wasm-bindgen",
@@ -15325,7 +15325,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-store"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15359,7 +15359,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-test-utils"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15383,7 +15383,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15416,7 +15416,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-azure"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15449,7 +15449,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-email"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15469,7 +15469,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-gcp"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15503,7 +15503,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-http"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15539,7 +15539,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-kafka"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15562,7 +15562,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-mqtt"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15586,7 +15586,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-nats"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -15610,7 +15610,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-postgres"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15645,7 +15645,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-sqs"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15673,7 +15673,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-websocket"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15698,7 +15698,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "bitflags 2.13.1",
@@ -15717,7 +15717,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "async-once-cell",
@@ -15831,7 +15831,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker-volumes"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "bytes",
  "futures",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 040bef7fc4..713465827c 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.762.1"
+version = "1.762.2"
 authors.workspace = true
 edition.workspace = true
 
@@ -87,7 +87,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal", "./parsers/windmill-parser-wasm"]
 
 [workspace.package]
-version = "1.762.1"
+version = "1.762.2"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.lock b/backend/parsers/windmill-parser-wasm/Cargo.lock
index c6776acc37..97cdb02cba 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.lock
+++ b/backend/parsers/windmill-parser-wasm/Cargo.lock
@@ -6191,7 +6191,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill-common"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "aho-corasick",
  "anyhow",
@@ -6272,7 +6272,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -6284,7 +6284,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "convert_case",
  "serde",
@@ -6293,7 +6293,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6305,7 +6305,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6317,7 +6317,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -6329,7 +6329,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6341,7 +6341,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6353,7 +6353,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -6364,7 +6364,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6375,7 +6375,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6387,7 +6387,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6398,7 +6398,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -6420,7 +6420,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6432,7 +6432,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6446,7 +6446,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "convert_case",
@@ -6463,7 +6463,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6476,7 +6476,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "serde",
@@ -6488,7 +6488,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6506,7 +6506,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -6522,7 +6522,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6538,7 +6538,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wasm"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "getrandom 0.2.17",
@@ -6570,7 +6570,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "serde",
@@ -6581,7 +6581,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.762.1"
+version = "1.762.2"
 dependencies = [
  "anyhow",
  "bitflags",
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.toml b/backend/parsers/windmill-parser-wasm/Cargo.toml
index ec01c72a78..deb9491e94 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.toml
+++ b/backend/parsers/windmill-parser-wasm/Cargo.toml
@@ -12,7 +12,7 @@ resolver = "2"
 members = ["."]
 
 [workspace.package]
-version = "1.762.1"
+version = "1.762.2"
 edition = "2021"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index afc5fe1006..39f3df1206 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.762.1
+  version: 1.762.2
   title: Windmill API
 
   contact:
diff --git a/benchmarks/lib.ts b/benchmarks/lib.ts
index aab12ce891..802316a9ad 100644
--- a/benchmarks/lib.ts
+++ b/benchmarks/lib.ts
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.762.1";
+export const VERSION = "v1.762.2";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({
diff --git a/cli/src/core/constants.ts b/cli/src/core/constants.ts
index c35ef043e0..01c79956b1 100644
--- a/cli/src/core/constants.ts
+++ b/cli/src/core/constants.ts
@@ -10,4 +10,4 @@ export const WM_FORK_PREFIX = "wm-fork";
 // (e.g. utils.ts) can read it without importing main.ts and creating a circular
 // dependency (main → workspace → utils → main) that triggers a TDZ.
 // Re-exported from main.ts for backwards compatibility.
-export const VERSION = "1.762.1";
+export const VERSION = "1.762.2";
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 04358fb631..3091e12842 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.762.1",
+	"version": "1.762.2",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "@windmill-labs/components",
-			"version": "1.762.1",
+			"version": "1.762.2",
 			"hasInstallScript": true,
 			"license": "AGPL-3.0",
 			"dependencies": {
diff --git a/frontend/package.json b/frontend/package.json
index fab35c7881..70770abe31 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.762.1",
+	"version": "1.762.2",
 	"scripts": {
 		"dev": "vite dev",
 		"dev:ui-builder": "mv static/ui_builder static/ui_builder.dev-disabled 2>/dev/null || true ; trap 'mv static/ui_builder.dev-disabled static/ui_builder 2>/dev/null || true' EXIT ; vite dev",
diff --git a/lsp/Pipfile b/lsp/Pipfile
index 0cd04c08d0..75ececd4b7 100644
--- a/lsp/Pipfile
+++ b/lsp/Pipfile
@@ -4,7 +4,7 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-wmill = ">=1.762.1"
+wmill = ">=1.762.2"
 sendgrid = "*"
 mysql-connector-python = "*"
 pymongo = "*"
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index 68c2832c5e..25ffabc645 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1,7 +1,7 @@
 openapi: '3.0.3'
 
 info:
-  version: 1.762.1
+  version: 1.762.2
   title: OpenFlow Spec
   contact:
     name: Ruben Fiszel
diff --git a/powershell-client/WindmillClient/WindmillClient.psd1 b/powershell-client/WindmillClient/WindmillClient.psd1
index 4e6912fac3..1fb552c36d 100644
--- a/powershell-client/WindmillClient/WindmillClient.psd1
+++ b/powershell-client/WindmillClient/WindmillClient.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'WindmillClient.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '1.762.1'
+    ModuleVersion     = '1.762.2'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()
diff --git a/python-client/wmill/pyproject.toml b/python-client/wmill/pyproject.toml
index ad96b11b5e..199af5ca5f 100644
--- a/python-client/wmill/pyproject.toml
+++ b/python-client/wmill/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill"
-version = "1.762.1"
+version = "1.762.2"
 description = "A client library for accessing Windmill server wrapping the Windmill client API"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/typescript-client/jsr.json b/typescript-client/jsr.json
index 0e89fc58df..3b8cc6508e 100644
--- a/typescript-client/jsr.json
+++ b/typescript-client/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@windmill/windmill",
-  "version": "1.762.1",
+  "version": "1.762.2",
   "exports": "./src/index.ts",
   "publish": {
     "exclude": ["!src", "./s3Types.ts", "./sqlUtils.ts", "./client.ts"]
diff --git a/typescript-client/package.json b/typescript-client/package.json
index 6d5e2f98ba..7a099c09df 100644
--- a/typescript-client/package.json
+++ b/typescript-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.762.1",
+  "version": "1.762.2",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "homepage": "https://github.com/windmill-labs/windmill/tree/main/typescript-client#readme",
diff --git a/version.txt b/version.txt
index 9fd908779f..d2c7eba15c 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.762.1
+1.762.2

From 42da20ae9743eab2f86b8f9c261ee567f8bbb0c5 Mon Sep 17 00:00:00 2001
From: Guilhem <guilhemlemouel@gmail.com>
Date: Sat, 18 Jul 2026 15:13:27 +0200
Subject: [PATCH 050/171] feat(ai): gate data pipelines in sessions behind a
 dev flag (#10178)

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
---
 .../copilot/chat/AIChatManager.svelte.ts      |  1 +
 .../copilot/chat/global/core.test.ts          | 65 +++++++++++++++++++
 .../components/copilot/chat/global/core.ts    | 42 ++++++++++--
 .../copilot/chat/global/pipelineGate.ts       | 36 ++++++++++
 .../components/sessions/previewRouter.test.ts | 21 ++++--
 .../lib/components/sessions/previewRouter.ts  |  8 ++-
 6 files changed, 162 insertions(+), 11 deletions(-)
 create mode 100644 frontend/src/lib/components/copilot/chat/global/pipelineGate.ts

diff --git a/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts b/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
index f86db724d8..8d4803cda0 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
+++ b/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
@@ -1624,6 +1624,7 @@ export class AIChatManager {
 			// workspace instead, so leave it unset there — allowedOpenPages reads the store.
 			...(this.isSessionChat
 				? {
+						isSessionChat: true,
 						sessionId: this.sessionId,
 						operatingWorkspace: this.operatingWorkspace,
 						artifacts: this.artifacts,
diff --git a/frontend/src/lib/components/copilot/chat/global/core.test.ts b/frontend/src/lib/components/copilot/chat/global/core.test.ts
index cf859efd34..7d2a5b4ed2 100644
--- a/frontend/src/lib/components/copilot/chat/global/core.test.ts
+++ b/frontend/src/lib/components/copilot/chat/global/core.test.ts
@@ -3416,6 +3416,71 @@ describe('folder tools', () => {
 	})
 })
 
+describe('session pipeline gate', () => {
+	const FLAG = 'wm_dev_session_pipelines'
+	afterEach(() => {
+		localStorage.removeItem(FLAG)
+	})
+
+	it('replaces the session prompt pipeline guidance with the alpha notice by default', () => {
+		const content = prepareGlobalSystemMessage(undefined, { previewTools: true }).content as string
+		expect(content).toContain('Data pipelines are in alpha and NOT yet available in this chat')
+		expect(content).not.toContain('call get_instructions with subject "pipeline"')
+		expect(content).not.toContain('Building a data pipeline: call open_preview')
+	})
+
+	it('restores the session pipeline guidance when the dev flag is set', () => {
+		localStorage.setItem(FLAG, '1')
+		const content = prepareGlobalSystemMessage(undefined, { previewTools: true }).content as string
+		expect(content).toContain('call get_instructions with subject "pipeline"')
+		expect(content).toContain('Building a data pipeline: call open_preview')
+		expect(content).not.toContain('Data pipelines are in alpha and NOT yet available in this chat')
+	})
+
+	it('leaves the standalone (non-session) chat pipeline guidance ungated', () => {
+		const content = prepareGlobalSystemMessage(undefined, { previewTools: false }).content as string
+		expect(content).toContain('call get_instructions with subject "pipeline"')
+		expect(content).not.toContain('Data pipelines are in alpha and NOT yet available in this chat')
+	})
+
+	it('refuses get_instructions(pipeline) in a session but not outside one', async () => {
+		const inSession = await callGlobalTool('get_instructions', { subject: 'pipeline' }, undefined, {
+			isSessionChat: true,
+			sessionId: 'session-1'
+		})
+		expect(inSession).toContain('data pipelines are in alpha')
+
+		const outsideSession = await callGlobalTool('get_instructions', { subject: 'pipeline' })
+		expect(outsideSession).not.toContain('data pipelines are in alpha')
+
+		// The eval harness passes a sessionId to standalone (non-session) chats;
+		// only the explicit isSessionChat marker may engage the gate.
+		const standaloneWithSessionId = await callGlobalTool(
+			'get_instructions',
+			{ subject: 'pipeline' },
+			undefined,
+			{ sessionId: 'eval-session' }
+		)
+		expect(standaloneWithSessionId).not.toContain('data pipelines are in alpha')
+	})
+
+	it('refuses open_preview(kind=pipeline) while gated', async () => {
+		const handler = vi.fn(() => 'opened')
+		setOpenPreviewHandler(handler)
+		try {
+			const gated = await callGlobalTool('open_preview', { kind: 'pipeline', path: 'my_folder' })
+			expect(gated).toContain('data pipelines are in alpha')
+			expect(handler).not.toHaveBeenCalled()
+
+			localStorage.setItem(FLAG, '1')
+			const opened = await callGlobalTool('open_preview', { kind: 'pipeline', path: 'my_folder' })
+			expect(opened).toBe('opened')
+		} finally {
+			setOpenPreviewHandler(undefined)
+		}
+	})
+})
+
 describe('prepareGlobalSystemMessage', () => {
 	it('keeps global chat draft instructions concise and user-facing', () => {
 		const message = prepareGlobalSystemMessage()
diff --git a/frontend/src/lib/components/copilot/chat/global/core.ts b/frontend/src/lib/components/copilot/chat/global/core.ts
index b177233de4..495d0637d2 100644
--- a/frontend/src/lib/components/copilot/chat/global/core.ts
+++ b/frontend/src/lib/components/copilot/chat/global/core.ts
@@ -152,6 +152,7 @@ import {
 	setEphemeralSecretVariableDraftValue,
 	type DraftPersistResult
 } from './userDraftAdapter'
+import { isSessionPipelinesEnabled, SESSION_PIPELINES_GATED_MESSAGE } from './pipelineGate'
 
 const ITEM_TYPES = [
 	'script',
@@ -903,6 +904,12 @@ const buildGlobalSystemPrompt = (
 ) => {
 	const folderGuidance = buildFolderGuidance(username, folderCtx)
 	const folderGuidanceBlock = folderGuidance ? `\n${folderGuidance}` : ''
+	// `previewTools` doubles as "this is a session chat" — sessions are the only
+	// chats that get the preview tool set, and the only surface the gate covers.
+	const pipelinesGated = previewTools && !isSessionPipelinesEnabled()
+	const pipelineBullet = pipelinesGated
+		? `- Data pipelines are in alpha and NOT yet available in this chat. A "data pipeline" is a DAG of independent annotated scripts wired by storage assets — it is not a flow. If the user asks for a data pipeline (or to ingest/transform/materialize data across steps in one), tell them that data pipelines are in alpha and will be handled by the chat soon — do not build one (no annotated pipeline scripts, no get_instructions with subject "pipeline"), and do not build a flow as a substitute.`
+		: `- A "data pipeline" is NOT a flow: it is a DAG of independent scripts in one folder, wired by storage assets (DuckLake/data tables/S3) and triggers via top-of-file \`pipeline\` / \`on <ref>\` annotation comments written in each script's comment syntax (\`--\` for SQL, \`#\` for Python/Bash, \`//\` for TS — a \`//\` line in a SQL node is a syntax error). When the user asks for a data pipeline (or to ingest/transform/materialize data across steps), call get_instructions with subject "pipeline" and build annotated script drafts — do not build a flow.`
 	return `You are Windmill's global workspace assistant.
 
 The current user's workspace username is "${username}".
@@ -925,7 +932,7 @@ Rules:
 - Variable values are never readable. For secrets, create a secret variable and reference it from resources as "$var:path/to/variable".
 - Use search_resource_types before write_resource.
 - Use get_instructions before writing scripts, flows, resources, or apps. For scripts, pass the target language.
-- A "data pipeline" is NOT a flow: it is a DAG of independent scripts in one folder, wired by storage assets (DuckLake/data tables/S3) and triggers via top-of-file \`pipeline\` / \`on <ref>\` annotation comments written in each script's comment syntax (\`--\` for SQL, \`#\` for Python/Bash, \`//\` for TS — a \`//\` line in a SQL node is a syntax error). When the user asks for a data pipeline (or to ingest/transform/materialize data across steps), call get_instructions with subject "pipeline" and build annotated script drafts — do not build a flow.
+${pipelineBullet}
 - After creating or editing a script or flow draft, run test_run_script, test_run_flow, or test_run_step with representative args before reporting that it works. These tools prefer drafts, so testing does not require deployment.
 - Use list_runs to find recent runs (optionally filtered by path, creator, label, or status), then get_job_logs with a returned id to inspect a specific run's logs — without starting a new test run.
 - Use open_page to show a workspace page with filters applied — Runs, Schedules, Variables, Resources, Assets, Audit logs, or Workspace settings on a specific tab (e.g. "open the failed runs of f/foo/bar", "open the schedule for X", "open the git sync settings"). Only the pages listed for this user in the tool are available; don't offer pages that aren't listed. Don't use it as a substitute for list_runs when you just need the data yourself.
@@ -934,8 +941,12 @@ Rules:
 - Keep context targeted.${
 		previewTools
 			? `
-- After writing or substantially editing a script / flow / app draft, show it via open_preview(kind, path) so the user sees the editor and live preview right next to the chat. First check whether it is already shown: if unsure, call get_preview_status. Only call open_preview (or offer to) when no preview is open or it is showing a different item — don't re-open a preview already showing the item you just edited.
-- Building a data pipeline: call open_preview(kind="pipeline", path="<folder>") as the FIRST step, before creating any node — this opens the pipeline editor the user reviews in. path is the folder, not an item; an empty or not-yet-created folder is fine (create_folder first if needed, then open it). Opening it registers build_pipeline_node / edit_pipeline_node — use ONLY those to add or change pipeline nodes, never write_script for a pipeline node — they apply directly as unsaved drafts on the canvas (no separate accept/reject step) that the user reviews and deploys. Do not write pipeline scripts without first opening the editor.
+- After writing or substantially editing a script / flow / app draft, show it via open_preview(kind, path) so the user sees the editor and live preview right next to the chat. First check whether it is already shown: if unsure, call get_preview_status. Only call open_preview (or offer to) when no preview is open or it is showing a different item — don't re-open a preview already showing the item you just edited.${
+					pipelinesGated
+						? ''
+						: `
+- Building a data pipeline: call open_preview(kind="pipeline", path="<folder>") as the FIRST step, before creating any node — this opens the pipeline editor the user reviews in. path is the folder, not an item; an empty or not-yet-created folder is fine (create_folder first if needed, then open it). Opening it registers build_pipeline_node / edit_pipeline_node — use ONLY those to add or change pipeline nodes, never write_script for a pipeline node — they apply directly as unsaved drafts on the canvas (no separate accept/reject step) that the user reviews and deploys. Do not write pipeline scripts without first opening the editor.`
+				}
 - When debugging a running raw app, call get_app_runtime_logs to read the live preview's browser console output. It needs the raw app preview open (open_preview kind="raw_app").
 - get_app_runtime_logs only shows the app's browser console. For the server-side logs of a backend runnable the app invoked (a backend.<id> call), call list_app_runs to get that run's job_id from the live preview, then get_job_logs with it. Use this when a backend call errors or returns something unexpected.
 ${
@@ -2127,8 +2138,19 @@ export const globalTools: Tool<{}>[] = [
 			'get_instructions',
 			'Get authoring guidance for scripts, flows, data pipelines, resources, apps, or the datatable SQL SDK (wmill.datatable()) used inside runnables.'
 		),
-		fn: async ({ args, toolId, toolCallbacks }) => {
+		fn: async (ctx) => {
+			const { args, toolId, toolCallbacks } = ctx
 			const parsed = getInstructionsSchema.parse(args)
+			// Session chats (explicit isSessionChat helper) don't get pipeline
+			// authoring while pipelines are gated; the standalone global chat keeps it.
+			if (
+				parsed.subject === 'pipeline' &&
+				isSessionChatFromCtx(ctx) &&
+				!isSessionPipelinesEnabled()
+			) {
+				toolCallbacks.setToolStatus(toolId, { content: 'Data pipelines are in alpha' })
+				return SESSION_PIPELINES_GATED_MESSAGE
+			}
 			const label =
 				parsed.subject === 'script' && parsed.language
 					? `${parsed.subject} (${parsed.language})`
@@ -3047,12 +3069,20 @@ export type GlobalToolHelpers = SessionToolHelpers & {
 	artifacts?: SessionArtifactsStore
 	getChatId?: () => string | undefined
 	openArtifact?: (artifactId: string, name: string) => void
+	// Explicit "this chat is an AI session" marker for session-scoped gating
+	// (the pipeline gate). Do NOT infer it from `sessionId`: the eval harness
+	// passes a sessionId to its standalone (non-session) chats too.
+	isSessionChat?: boolean
 }
 
 function sessionIdFromCtx(ctx: { helpers?: unknown }): string | undefined {
 	return (ctx.helpers as GlobalToolHelpers | undefined)?.sessionId
 }
 
+function isSessionChatFromCtx(ctx: { helpers?: unknown }): boolean {
+	return (ctx.helpers as GlobalToolHelpers | undefined)?.isSessionChat === true
+}
+
 function operatingWorkspaceFromHelpers(helpers: unknown): string | undefined {
 	return (helpers as GlobalToolHelpers | undefined)?.operatingWorkspace
 }
@@ -3087,6 +3117,10 @@ function openSessionPreview(
 	if (!openPreviewHandler) {
 		return 'Error: open_preview is only available inside an AI session. Tell the user to switch to a session to view the preview, or describe the item textually.'
 	}
+	// open_preview only exists in sessions, so no sessionId check is needed here.
+	if (args.kind === 'pipeline' && !isSessionPipelinesEnabled()) {
+		return SESSION_PIPELINES_GATED_MESSAGE
+	}
 	return openPreviewHandler({ ...args, sessionId })
 }
 
diff --git a/frontend/src/lib/components/copilot/chat/global/pipelineGate.ts b/frontend/src/lib/components/copilot/chat/global/pipelineGate.ts
new file mode 100644
index 0000000000..e397b23b42
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/global/pipelineGate.ts
@@ -0,0 +1,36 @@
+/**
+ * Dev-only gate for data pipelines inside AI sessions.
+ *
+ * Data pipelines are in alpha: a session chat must not build them for regular
+ * users yet — it tells the user pipelines will be handled by the chat soon
+ * instead. Developers/QA enable the session pipeline surface in their browser
+ * with:
+ *
+ *     localStorage.setItem('wm_dev_session_pipelines', '1')
+ *
+ * and reload the page. To disable, remove the key or set it to anything else.
+ *
+ * Only the session surface is gated: the standalone global side-panel chat and
+ * the full-page /pipeline editor keep their pipeline support (the eval harness
+ * exercises the former in Node, where this gate must never engage). When
+ * pipelines ship in sessions, replace every call to
+ * `isSessionPipelinesEnabled()` with `true` and delete this file. The
+ * references are intentionally narrow (the session system-prompt bullets, the
+ * get_instructions/open_preview execution guards, and the session preview
+ * router) so the rip-out is a small grep.
+ */
+const STORAGE_KEY = 'wm_dev_session_pipelines'
+
+export function isSessionPipelinesEnabled(): boolean {
+	if (typeof localStorage === 'undefined') return false
+	try {
+		return localStorage.getItem(STORAGE_KEY) === '1'
+	} catch {
+		return false
+	}
+}
+
+/** Tool result returned when a gated session chat still tries a pipeline
+ * action — instructs the model to deliver the alpha notice instead. */
+export const SESSION_PIPELINES_GATED_MESSAGE =
+	'Not available: data pipelines are in alpha and this chat cannot build them yet. Tell the user that data pipelines are in alpha and will be handled by the chat soon. Do not write annotated pipeline scripts manually, and do not build a flow as a substitute.'
diff --git a/frontend/src/lib/components/sessions/previewRouter.test.ts b/frontend/src/lib/components/sessions/previewRouter.test.ts
index c79cf4df3e..67c2fa8192 100644
--- a/frontend/src/lib/components/sessions/previewRouter.test.ts
+++ b/frontend/src/lib/components/sessions/previewRouter.test.ts
@@ -93,12 +93,21 @@ describe('resolvePreviewTab', () => {
 		expect(resolvePreviewTab('/apps/edit/f/a/b')).toEqual({ kind: 'iframe' })
 	})
 
-	it('routes a pipeline folder to the pipeline editor kind', () => {
-		expect(resolvePreviewTab('/pipeline/my_folder')).toEqual({
-			kind: 'editor',
-			editorKind: 'pipeline',
-			path: 'my_folder'
-		})
+	it('routes a pipeline folder to the pipeline editor kind when session pipelines are enabled', () => {
+		localStorage.setItem('wm_dev_session_pipelines', '1')
+		try {
+			expect(resolvePreviewTab('/pipeline/my_folder')).toEqual({
+				kind: 'editor',
+				editorKind: 'pipeline',
+				path: 'my_folder'
+			})
+		} finally {
+			localStorage.removeItem('wm_dev_session_pipelines')
+		}
+	})
+
+	it('routes a pipeline folder to the iframe fallback while session pipelines are gated', () => {
+		expect(resolvePreviewTab('/pipeline/my_folder')).toEqual({ kind: 'iframe' })
 	})
 
 	it('routes the bare pipeline list page to the iframe fallback', () => {
diff --git a/frontend/src/lib/components/sessions/previewRouter.ts b/frontend/src/lib/components/sessions/previewRouter.ts
index b5e7520265..7c388f9e7f 100644
--- a/frontend/src/lib/components/sessions/previewRouter.ts
+++ b/frontend/src/lib/components/sessions/previewRouter.ts
@@ -13,6 +13,7 @@ import {
 } from 'lucide-svelte'
 import type { DrillIcon } from '$lib/components/drillPicker'
 import type { WorkspaceItem, WorkspaceItemKind } from '$lib/components/workspacePicker'
+import { isSessionPipelinesEnabled } from '$lib/components/copilot/chat/global/pipelineGate'
 import type { SessionTargetKind } from './sessionRuntime.svelte'
 
 /** What the preview breadcrumb picker can route to: a static workspace page
@@ -185,8 +186,13 @@ export type PreviewSlot =
 export function resolvePreviewTab(url: string): PreviewSlot {
 	const artifact = parseArtifactRoute(url)
 	if (artifact) return { kind: 'artifact', id: artifact.id }
+	// While session pipelines are gated, a /pipeline/<folder> tab stays a plain
+	// iframe: mounting the in-realm pipeline editor would register the pipeline
+	// canvas tools on the session chat, un-gating it through the back door.
 	const pipelineFolder = parsePipelineRoute(url)
-	if (pipelineFolder) return { kind: 'editor', editorKind: 'pipeline', path: pipelineFolder }
+	if (pipelineFolder && isSessionPipelinesEnabled()) {
+		return { kind: 'editor', editorKind: 'pipeline', path: pipelineFolder }
+	}
 	const route = parsePreviewItemRoute(url)
 	if (!route) return { kind: 'iframe' }
 	const editorKind: SessionTargetKind | undefined =

From 4bddefc5182f9117f1656a1fc7458ae55be1e379 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Sun, 19 Jul 2026 09:28:30 +0200
Subject: [PATCH 051/171] wire topBar.path and editablePath customUi in
 FlowBuilder (#10187)

Mirror the ScriptBuilder whitelabel pattern in FlowBuilder so the
`customUi.topBar.path` and `customUi.topBar.editablePath` options actually
take effect:

- add `editablePath?: boolean` to `FlowBuilderWhitelabelCustomUi.topBar`
- gate the EditorHeader block on `customUi?.topBar?.path != false` and pass
  `pathEditable`/`summaryEditable` (the latter wires the pre-existing but
  unused `editableSummary` flag)
- hide the Path field in FlowSettings when `topBar.editablePath` is false

Defaults are unchanged (`!= false`), so non-whitelabel flows still show the
path header and settings field.

Fixes WIN-2200

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../src/lib/components/FlowBuilder.svelte     | 26 +++++++++++--------
 frontend/src/lib/components/custom_ui.ts      |  1 +
 .../flows/content/FlowSettings.svelte         |  2 +-
 3 files changed, 17 insertions(+), 12 deletions(-)

diff --git a/frontend/src/lib/components/FlowBuilder.svelte b/frontend/src/lib/components/FlowBuilder.svelte
index f6a10a48d1..12423e19b2 100644
--- a/frontend/src/lib/components/FlowBuilder.svelte
+++ b/frontend/src/lib/components/FlowBuilder.svelte
@@ -1129,17 +1129,21 @@
 					: 'max-h-12'}"
 			>
 				<div class="flex flex-row items-center gap-2 min-w-0">
-					<div class="min-w-0 overflow-hidden">
-						<EditorHeader
-							bind:summary={flowStore.val.summary}
-							bind:path={$pathStore}
-							savedPath={initialPath}
-							onBehalfOfEmail={$savedOnBehalfOfEmail}
-							hidePath={condensedHeader}
-							workspaceId={autosaveWorkspace}
-							onNavigate={(item) => onNavigate?.(item)}
-						/>
-					</div>
+					{#if customUi?.topBar?.path != false}
+						<div class="min-w-0 overflow-hidden">
+							<EditorHeader
+								bind:summary={flowStore.val.summary}
+								bind:path={$pathStore}
+								savedPath={initialPath}
+								onBehalfOfEmail={$savedOnBehalfOfEmail}
+								summaryEditable={customUi?.topBar?.editableSummary != false}
+								pathEditable={customUi?.topBar?.editablePath != false}
+								hidePath={condensedHeader}
+								workspaceId={autosaveWorkspace}
+								onNavigate={(item) => onNavigate?.(item)}
+							/>
+						</div>
+					{/if}
 					{#if opWorkspace && indicatorPath !== undefined}
 						<AutosaveIndicator
 							workspace={opWorkspace}
diff --git a/frontend/src/lib/components/custom_ui.ts b/frontend/src/lib/components/custom_ui.ts
index a04c9ea4b5..917cd8714d 100644
--- a/frontend/src/lib/components/custom_ui.ts
+++ b/frontend/src/lib/components/custom_ui.ts
@@ -3,6 +3,7 @@ import type { SupportedLanguage } from '$lib/common'
 export type FlowBuilderWhitelabelCustomUi = {
 	topBar?: {
 		path?: boolean
+		editablePath?: boolean
 		export?: boolean
 		history?: boolean
 		aiBuilder?: boolean
diff --git a/frontend/src/lib/components/flows/content/FlowSettings.svelte b/frontend/src/lib/components/flows/content/FlowSettings.svelte
index f2034a456d..7ec74be14a 100644
--- a/frontend/src/lib/components/flows/content/FlowSettings.svelte
+++ b/frontend/src/lib/components/flows/content/FlowSettings.svelte
@@ -137,7 +137,7 @@
 				<!-- prettier-ignore -->
 				<LabelsInput bind:labels={(flowStore.val as any).labels} class="-mt-4" />
 
-				{#if !noEditor}
+				{#if !noEditor && customUi?.topBar?.editablePath != false}
 					<Label label="Path">
 						<Path
 							autofocus={false}

From 2d77e742077b71be192a04ed9e85d4a024dc7f91 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Sun, 19 Jul 2026 09:30:49 +0200
Subject: [PATCH 052/171] fix(cli): stop emitting
 has_on_behalf_of/has_permissioned_as: false on pull (#10188)

With syncBehavior v1 the pull strips the user-specific on_behalf_of_email /
permissioned_as from metadata and keeps a boolean marker so a later push can
preserve remote ownership. The marker was written unconditionally as
`!!<field>`, so every ownerless script, flow, schedule and trigger (the vast
majority) got a `has_on_behalf_of: false` / `has_permissioned_as: false` line,
producing a spurious diff on every pull.

Absence of the marker already means "no owner" everywhere it's read on push, so
only emit the key when true.

Fixes WIN-2201

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 cli/src/commands/sync/sync.ts             | 22 +++++++--
 cli/test/pull_on_behalf_of_marker.test.ts | 58 +++++++++++++++++++++++
 2 files changed, 76 insertions(+), 4 deletions(-)
 create mode 100644 cli/test/pull_on_behalf_of_marker.test.ts

diff --git a/cli/src/commands/sync/sync.ts b/cli/src/commands/sync/sync.ts
index 2ff98dbb8d..7a78623870 100644
--- a/cli/src/commands/sync/sync.ts
+++ b/cli/src/commands/sync/sync.ts
@@ -1008,7 +1008,11 @@ function ZipFSElement(
             }
 
             if (stripOnBehalfOf) {
-              (flow as any).has_on_behalf_of = !!(flow as any).on_behalf_of_email;
+              // Only emit the flag when set; a `false` here is the default and
+              // would produce a spurious diff for every ownerless flow.
+              if ((flow as any).on_behalf_of_email) {
+                (flow as any).has_on_behalf_of = true;
+              }
               delete (flow as any).on_behalf_of_email;
             }
 
@@ -1293,7 +1297,11 @@ function ZipFSElement(
               parsed["codebase"] = undefined;
             }
             if (stripOnBehalfOf) {
-              parsed["has_on_behalf_of"] = !!parsed["on_behalf_of_email"];
+              // Only emit the flag when set; a `false` here is the default and
+              // would produce a spurious diff for every ownerless script.
+              if (parsed["on_behalf_of_email"]) {
+                parsed["has_on_behalf_of"] = true;
+              }
               delete parsed["on_behalf_of_email"];
             }
             // Modules are stored as files in __mod/ folder, not in metadata
@@ -1340,13 +1348,19 @@ function ZipFSElement(
               if (stripOnBehalfOf) {
                 const isSchedule = p.endsWith(".schedule.json");
                 const isTrigger = p.endsWith("_trigger.json");
+                // Only emit the flag when set; a `false` here is the default and
+                // would produce a spurious diff for every ownerless schedule/trigger.
                 if (isSchedule) {
-                  parsed["has_permissioned_as"] = !!parsed["permissioned_as"];
+                  if (parsed["permissioned_as"]) {
+                    parsed["has_permissioned_as"] = true;
+                  }
                   delete parsed["permissioned_as"];
                   delete parsed["email"];
                   delete parsed["edited_by"];
                 } else if (isTrigger) {
-                  parsed["has_permissioned_as"] = !!parsed["permissioned_as"];
+                  if (parsed["permissioned_as"]) {
+                    parsed["has_permissioned_as"] = true;
+                  }
                   delete parsed["permissioned_as"];
                   delete parsed["edited_by"];
                 }
diff --git a/cli/test/pull_on_behalf_of_marker.test.ts b/cli/test/pull_on_behalf_of_marker.test.ts
new file mode 100644
index 0000000000..6c33379d69
--- /dev/null
+++ b/cli/test/pull_on_behalf_of_marker.test.ts
@@ -0,0 +1,58 @@
+import { expect, test } from "bun:test";
+import { readFile, writeFile } from "node:fs/promises";
+import { withTestBackend } from "./test_backend.ts";
+import { addWorkspace } from "../workspace.ts";
+import { setClient } from "../src/core/client.ts";
+
+// Regression guard for WIN-2201: with syncBehavior v1 the pull strips
+// `on_behalf_of_email` and keeps only a boolean marker. That marker must be
+// emitted ONLY when an owner exists — writing `has_on_behalf_of: false` for the
+// (overwhelmingly common) ownerless script produced a spurious diff on every pull.
+test("pull omits has_on_behalf_of for ownerless scripts", async () => {
+  await withTestBackend(async (backend, tempDir) => {
+    await addWorkspace(
+      {
+        remote: backend.baseUrl,
+        workspaceId: backend.workspace,
+        name: "obo_marker_test",
+        token: backend.token,
+      },
+      { force: true, configDir: backend.testConfigDir },
+    );
+    setClient(backend.token, backend.baseUrl);
+
+    await writeFile(
+      `${tempDir}/wmill.yaml`,
+      `defaultTs: bun\nsyncBehavior: v1\nincludes:\n  - "**"\nexcludes: []`,
+      "utf-8",
+    );
+
+    const scriptPath = "f/test/no_owner";
+    const createResp = await backend.apiRequest!(
+      `/api/w/${backend.workspace}/scripts/create`,
+      {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          path: scriptPath,
+          content: `export async function main() { return 1; }`,
+          language: "bun",
+          summary: "no owner",
+          description: "",
+        }),
+      },
+    );
+    expect(createResp.status).toBeLessThan(300);
+
+    const pullResult = await backend.runCLICommand(
+      ["sync", "pull", "--yes"],
+      tempDir,
+      "obo_marker_test",
+    );
+    expect(pullResult.code).toEqual(0);
+
+    const meta = await readFile(`${tempDir}/${scriptPath}.script.yaml`, "utf-8");
+    expect(meta).not.toContain("has_on_behalf_of");
+    expect(meta).not.toContain("on_behalf_of_email");
+  });
+});

From 89948bb441dd7c08d20128645ebd0dc9da5b6b56 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Sun, 19 Jul 2026 10:40:29 +0200
Subject: [PATCH 053/171] chore(git-sync): bump hub scripts to
 windmill-cli@1.762.3 (#10189)

---
 backend/windmill-common/src/workspaces.rs | 4 ++--
 frontend/src/lib/hubPaths.json            | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/backend/windmill-common/src/workspaces.rs b/backend/windmill-common/src/workspaces.rs
index 972cc0a028..76d1d2b488 100644
--- a/backend/windmill-common/src/workspaces.rs
+++ b/backend/windmill-common/src/workspaces.rs
@@ -167,12 +167,12 @@ pub enum ObjectType {
     DatatableMigration,
 }
 
-pub const LATEST_GIT_SYNC_SCRIPT_PATH: &str = "hub/28786/sync-script-to-git-repo-windmill";
+pub const LATEST_GIT_SYNC_SCRIPT_PATH: &str = "hub/28790/sync-script-to-git-repo-windmill";
 
 /// Hub script that applies a repository's state back into a workspace
 /// (the repo → Windmill / "pull" direction). Same script the UI runs from
 /// `PullWorkspaceModal` with `pull: true`; the slug's `:` is percent-encoded.
-pub const GIT_SYNC_PULL_SCRIPT_PATH: &str = "hub/28787/git-sync%3A-init-repository-windmill";
+pub const GIT_SYNC_PULL_SCRIPT_PATH: &str = "hub/28789/git-sync%3A-init-repository-windmill";
 
 /// Prefix used to identify fork workspaces. A workspace whose id starts with this string is a
 /// fork of another workspace.
diff --git a/frontend/src/lib/hubPaths.json b/frontend/src/lib/hubPaths.json
index 4c76bf3001..c3819ecc32 100644
--- a/frontend/src/lib/hubPaths.json
+++ b/frontend/src/lib/hubPaths.json
@@ -1,6 +1,6 @@
 {
 	"gitSyncTest": "hub/28184/git-repo-test-read-write-windmill",
-	"gitInitRepo": "hub/28787/git-sync%3A-init-repository-windmill",
+	"gitInitRepo": "hub/28789/git-sync%3A-init-repository-windmill",
 	"slackErrorHandler": "hub/28241/workspace-or-schedule-error-handler-slack",
 	"emailErrorHandler": "hub/19795/workspace-or-error-handler-email",
 	"slackRecoveryHandler": "hub/28239/slack/schedule-recovery-handler-slack",

From 60a7a23a045ee0643f035971551074e283ebcf91 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Sun, 19 Jul 2026 10:45:40 +0200
Subject: [PATCH 054/171] chore(main): release 1.763.0 (#10186)

* chore(main): release 1.763.0

* Apply automatic changes

---------

Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>
---
 CHANGELOG.md                                  |  12 +
 backend/Cargo.lock                            | 415 +++++++++---------
 backend/Cargo.toml                            |   4 +-
 .../parsers/windmill-parser-wasm/Cargo.lock   |  48 +-
 .../parsers/windmill-parser-wasm/Cargo.toml   |   2 +-
 backend/windmill-api/openapi.yaml             |   2 +-
 benchmarks/lib.ts                             |   2 +-
 cli/src/core/constants.ts                     |   2 +-
 frontend/package-lock.json                    |   4 +-
 frontend/package.json                         |   2 +-
 lsp/Pipfile                                   |   2 +-
 openflow.openapi.yaml                         |   2 +-
 .../WindmillClient/WindmillClient.psd1        |   2 +-
 python-client/wmill/pyproject.toml            |   2 +-
 typescript-client/jsr.json                    |   2 +-
 typescript-client/package.json                |   2 +-
 version.txt                                   |   2 +-
 17 files changed, 265 insertions(+), 242 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 17158dcad9..995c31a083 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,17 @@
 # Changelog
 
+## [1.763.0](https://github.com/windmill-labs/windmill/compare/v1.762.2...v1.763.0) (2026-07-19)
+
+
+### Features
+
+* **ai:** gate data pipelines in sessions behind a dev flag ([#10178](https://github.com/windmill-labs/windmill/issues/10178)) ([42da20a](https://github.com/windmill-labs/windmill/commit/42da20ae9743eab2f86b8f9c261ee567f8bbb0c5))
+
+
+### Bug Fixes
+
+* **cli:** stop emitting has_on_behalf_of/has_permissioned_as: false on pull ([#10188](https://github.com/windmill-labs/windmill/issues/10188)) ([2d77e74](https://github.com/windmill-labs/windmill/commit/2d77e742077b71be192a04ed9e85d4a024dc7f91))
+
 ## [1.762.2](https://github.com/windmill-labs/windmill/compare/v1.762.1...v1.762.2) (2026-07-18)
 
 
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index e05ce5b763..d8da1f0400 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -189,9 +189,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.103"
+version = "1.0.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a4385e2e34eb35d6b3efe798b9eb88096925d87726c0798709bf56d9ed84af3"
+checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
 
 [[package]]
 name = "ar_archive_writer"
@@ -681,13 +681,13 @@ dependencies = [
 
 [[package]]
 name = "async-trait"
-version = "0.1.89"
+version = "0.1.91"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb"
+checksum = "ae36dc4177970ef04fde5178d3e2429882def40e57a451f919c098f72baa6cec"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.119",
+ "syn 3.0.0",
 ]
 
 [[package]]
@@ -1715,7 +1715,7 @@ dependencies = [
  "serde_json",
  "serde_repr",
  "serde_urlencoded",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "tokio",
  "tokio-util",
  "tower-service",
@@ -2005,7 +2005,7 @@ dependencies = [
  "rand_distr",
  "rayon",
  "safetensors",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "yoke",
  "zip",
 ]
@@ -2023,7 +2023,7 @@ dependencies = [
  "rayon",
  "safetensors",
  "serde",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
 ]
 
 [[package]]
@@ -2085,9 +2085,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.2.67"
+version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e17dd265a7d0f31ef544e1b20e03add05d3b45b491b633b10d67145d2acc1a38"
+checksum = "c89588d05638b5b4594a3348a2d6c20277e43a7f5c5202b05cc56888475a47b8"
 dependencies = [
  "find-msvc-tools",
  "jobserver",
@@ -3492,7 +3492,7 @@ dependencies = [
  "swc_sourcemap",
  "swc_visit",
  "text_lines",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "unicode-width 0.2.2",
  "url",
 ]
@@ -3537,7 +3537,7 @@ dependencies = [
  "smallvec",
  "sourcemap",
  "static_assertions",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "tokio",
  "url",
  "v8",
@@ -3584,7 +3584,7 @@ dependencies = [
  "sha2 0.10.9",
  "signature",
  "spki",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "tokio",
  "uuid",
  "x25519-dalek",
@@ -3676,7 +3676,7 @@ dependencies = [
  "rustls-webpki 0.102.8",
  "serde",
  "serde_json",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "tokio",
  "tokio-rustls 0.26.4",
  "tokio-socks",
@@ -3708,7 +3708,7 @@ dependencies = [
  "rand 0.8.5",
  "rayon",
  "serde",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "winapi",
  "windows-sys 0.59.0",
 ]
@@ -3782,7 +3782,7 @@ dependencies = [
  "serde",
  "sha2 0.10.9",
  "socket2 0.5.10",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "tokio",
  "tokio-vsock",
  "url",
@@ -3803,7 +3803,7 @@ dependencies = [
  "strum",
  "strum_macros",
  "syn 2.0.119",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
 ]
 
 [[package]]
@@ -3815,7 +3815,7 @@ dependencies = [
  "deno_error 0.6.1",
  "percent-encoding",
  "sys_traits",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "url",
 ]
 
@@ -3842,7 +3842,7 @@ dependencies = [
  "serde_json",
  "sys_traits",
  "temp_deno_which",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "url",
  "winapi",
  "windows-sys 0.59.0",
@@ -3883,7 +3883,7 @@ dependencies = [
  "opentelemetry_sdk 0.27.1",
  "pin-project",
  "serde",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "tokio",
 ]
 
@@ -3911,7 +3911,7 @@ dependencies = [
  "rustls-tokio-stream",
  "rustls-webpki 0.102.8",
  "serde",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "tokio",
  "webpki-roots 0.26.11",
 ]
@@ -3954,7 +3954,7 @@ dependencies = [
  "flate2",
  "futures",
  "serde",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "tokio",
  "uuid",
 ]
@@ -4817,9 +4817,9 @@ checksum = "e6d5a32815ae3f33302d95fdcb2ce17862f8c65363dcfd29360480ba1001fc9c"
 
 [[package]]
 name = "futures"
-version = "0.3.32"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b147ee9d1f6d097cef9ce628cd2ee62288d963e16fb287bd9286455b241382d"
+checksum = "a88cf1f829d945f548cf8fec32c61b1f202b6d93b45848602fc02af4b12ad218"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -4832,9 +4832,9 @@ dependencies = [
 
 [[package]]
 name = "futures-channel"
-version = "0.3.32"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07bbe89c50d7a535e539b8c17bc0b49bdb77747034daa8087407d655f3f7cc1d"
+checksum = "262590f4fe6afeb0bc83be1daa64e52657fe185690a958af7f3ad0e92085c5ae"
 dependencies = [
  "futures-core",
  "futures-sink",
@@ -4842,15 +4842,15 @@ dependencies = [
 
 [[package]]
 name = "futures-core"
-version = "0.3.32"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e3450815272ef58cec6d564423f6e755e25379b217b0bc688e295ba24df6b1d"
+checksum = "2cd50c473c80f6d7c3670a752354b8e569b1a7cbfdc0419ec88e5edad85e0dc7"
 
 [[package]]
 name = "futures-executor"
-version = "0.3.32"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baf29c38818342a3b26b5b923639e7b1f4a61fc5e76102d4b1981c6dc7a7579d"
+checksum = "6754879cc9f2c66f88c6e5c35344bb0bdb0708b0352b1201815667c7eabc7458"
 dependencies = [
  "futures-core",
  "futures-task",
@@ -4870,9 +4870,9 @@ dependencies = [
 
 [[package]]
 name = "futures-io"
-version = "0.3.32"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cecba35d7ad927e23624b22ad55235f2239cfa44fd10428eecbeba6d6a717718"
+checksum = "4577ecaa3c4f96589d473f679a71b596316f6641bc350038b962a5daf0085d7a"
 
 [[package]]
 name = "futures-lite"
@@ -4889,9 +4889,9 @@ dependencies = [
 
 [[package]]
 name = "futures-macro"
-version = "0.3.32"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e835b70203e41293343137df5c0664546da5745f82ec9b84d40be8336958447b"
+checksum = "2d6d3cde68c518367be28956066ddfef33813991b77a55005a69dae04bf3b10b"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -4900,21 +4900,21 @@ dependencies = [
 
 [[package]]
 name = "futures-sink"
-version = "0.3.32"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c39754e157331b013978ec91992bde1ac089843443c49cbc7f46150b0fad0893"
+checksum = "e34418ac499d6305c2fb5ad0ed2f6ac998c5f8ca209b4510f7f94242c647e307"
 
 [[package]]
 name = "futures-task"
-version = "0.3.32"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393"
+checksum = "b231ed28831efb4a61a08580c4bc233ec56bc009f4cd8f52da2c3cb97df0c109"
 
 [[package]]
 name = "futures-util"
-version = "0.3.32"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6"
+checksum = "a77a90a256fce34da66415271e30f94ee91c57b04b8a2c042d9cf3220179deaa"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -5331,7 +5331,7 @@ checksum = "9758a950dc61a15bc65162f72f5bec7e8efde91f102dc7dce7317f67019a6ba9"
 dependencies = [
  "anyhow",
  "strum",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "unic-ucd-category",
 ]
 
@@ -5543,7 +5543,7 @@ dependencies = [
  "reqwest 0.12.28",
  "serde",
  "serde_json",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "tokio",
  "ureq",
  "windows-sys 0.60.2",
@@ -5568,7 +5568,7 @@ dependencies = [
  "once_cell",
  "rand 0.9.0",
  "serde",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "tinyvec",
  "tokio",
  "tracing",
@@ -5592,7 +5592,7 @@ dependencies = [
  "resolv-conf",
  "serde",
  "smallvec",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "tokio",
  "tracing",
 ]
@@ -5886,7 +5886,7 @@ dependencies = [
  "tokio",
  "tokio-rustls 0.26.4",
  "tower-service",
- "webpki-roots 1.0.8",
+ "webpki-roots 1.0.9",
 ]
 
 [[package]]
@@ -6351,7 +6351,7 @@ dependencies = [
  "jsonptr",
  "serde",
  "serde_json",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
 ]
 
 [[package]]
@@ -6364,7 +6364,7 @@ dependencies = [
  "pest_derive",
  "regex",
  "serde_json",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
 ]
 
 [[package]]
@@ -6504,7 +6504,7 @@ dependencies = [
  "serde",
  "serde_json",
  "serde_yaml",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "tokio",
  "tokio-util",
  "tower 0.5.3",
@@ -6528,7 +6528,7 @@ dependencies = [
  "serde",
  "serde-value",
  "serde_json",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
 ]
 
 [[package]]
@@ -6566,7 +6566,7 @@ dependencies = [
  "pin-project",
  "serde",
  "serde_json",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "tokio",
  "tokio-util",
  "tracing",
@@ -7313,7 +7313,7 @@ dependencies = [
  "quote",
  "syn 2.0.119",
  "termcolor",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
 ]
 
 [[package]]
@@ -7338,7 +7338,7 @@ dependencies = [
  "rand 0.10.2",
  "serde",
  "socket2 0.6.5",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "tokio",
  "tokio-native-tls",
  "tokio-util",
@@ -7370,7 +7370,7 @@ dependencies = [
  "serde_json",
  "sha1",
  "sha2 0.10.9",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "uuid",
 ]
 
@@ -7584,7 +7584,7 @@ dependencies = [
  "num-format",
  "serde",
  "serde_json",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "typetag",
  "windows-sys 0.48.0",
 ]
@@ -7839,7 +7839,7 @@ dependencies = [
  "serde",
  "serde_json",
  "serde_urlencoded",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "tokio",
  "tracing",
  "url",
@@ -8032,7 +8032,7 @@ dependencies = [
  "futures-sink",
  "js-sys",
  "pin-project-lite",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "tracing",
 ]
 
@@ -8107,7 +8107,7 @@ dependencies = [
  "opentelemetry_sdk 0.30.0",
  "prost",
  "reqwest 0.12.28",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "tokio",
  "tonic 0.13.1",
  "tracing",
@@ -8188,7 +8188,7 @@ dependencies = [
  "percent-encoding",
  "rand 0.9.0",
  "serde_json",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "tokio",
  "tokio-stream",
 ]
@@ -8879,9 +8879,9 @@ dependencies = [
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.106"
+version = "1.0.107"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
 dependencies = [
  "unicode-ident",
 ]
@@ -8936,7 +8936,7 @@ dependencies = [
  "lazy_static",
  "memchr",
  "parking_lot",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
 ]
 
 [[package]]
@@ -9088,7 +9088,7 @@ dependencies = [
  "rustc-hash 2.1.3",
  "rustls 0.23.35",
  "socket2 0.6.5",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "tokio",
  "tracing",
  "web-time",
@@ -9111,7 +9111,7 @@ dependencies = [
  "rustls 0.23.35",
  "rustls-pki-types",
  "slab",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "tinyvec",
  "tracing",
  "web-time",
@@ -9133,9 +9133,9 @@ dependencies = [
 
 [[package]]
 name = "quote"
-version = "1.0.46"
+version = "1.0.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dfbc457d0c7a0759a614551b11a6409e5951f6c7537be1f1b7682b9ae9230368"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
 dependencies = [
  "proc-macro2",
 ]
@@ -9446,27 +9446,27 @@ checksum = "a4e608c6638b9c18977b00b475ac1f28d14e84b27d8d42f70e0bf1e3dec127ac"
 dependencies = [
  "getrandom 0.2.17",
  "libredox",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
 ]
 
 [[package]]
 name = "ref-cast"
-version = "1.0.25"
+version = "1.0.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f354300ae66f76f1c85c5f84693f0ce81d747e2c3f21a45fef496d89c960bf7d"
+checksum = "216e8f773d7923bcba9ceb86a86c93cabb3903a11872fc3f138c49630e50b96d"
 dependencies = [
  "ref-cast-impl",
 ]
 
 [[package]]
 name = "ref-cast-impl"
-version = "1.0.25"
+version = "1.0.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7186006dcb21920990093f30e3dea63b7d6e977bf1256be20c3563a5db070da"
+checksum = "2c9283685feec7d69af75fb0e858d5e7378f33fe4fc699383b2916ab9273e03c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.119",
+ "syn 3.0.0",
 ]
 
 [[package]]
@@ -9574,7 +9574,7 @@ dependencies = [
  "wasm-bindgen-futures",
  "wasm-streams",
  "web-sys",
- "webpki-roots 1.0.8",
+ "webpki-roots 1.0.9",
 ]
 
 [[package]]
@@ -9633,7 +9633,7 @@ dependencies = [
  "http 1.4.2",
  "reqwest 0.13.1",
  "serde",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "tower-service",
 ]
 
@@ -9652,7 +9652,7 @@ dependencies = [
  "reqwest 0.13.1",
  "reqwest-middleware",
  "retry-policies",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "tokio",
  "tracing",
  "wasmtimer",
@@ -9766,7 +9766,7 @@ dependencies = [
  "serde",
  "serde_json",
  "sse-stream",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "tokio",
  "tokio-stream",
  "tokio-util",
@@ -10297,7 +10297,7 @@ dependencies = [
  "quick-xml",
  "rand 0.9.0",
  "serde",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "url",
  "uuid",
 ]
@@ -10517,9 +10517,9 @@ checksum = "1bc711410fbe7399f390ca1c3b60ad0f53f80e95c5eb935e52268a0e2cd49acc"
 
 [[package]]
 name = "serde"
-version = "1.0.228"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
 dependencies = [
  "serde_core",
  "serde_derive",
@@ -10570,22 +10570,22 @@ dependencies = [
 
 [[package]]
 name = "serde_core"
-version = "1.0.228"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.228"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.119",
+ "syn 3.0.0",
 ]
 
 [[package]]
@@ -10644,13 +10644,13 @@ dependencies = [
 
 [[package]]
 name = "serde_repr"
-version = "0.1.20"
+version = "0.1.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "175ee3e80ae9982737ca543e96133087cbd9a485eecc3bc4de9c1a37b47ea59c"
+checksum = "8d3b1629de253c70a0508c3899572da79ca359fdab27c7920ff00406df418906"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.119",
+ "syn 3.0.0",
 ]
 
 [[package]]
@@ -10684,7 +10684,7 @@ dependencies = [
  "num-bigint",
  "serde",
  "smallvec",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "v8",
 ]
 
@@ -10910,7 +10910,7 @@ checksum = "0d585997b0ac10be3c5ee635f1bab02d512760d14b7c468801ac8a01d9ae5f1d"
 dependencies = [
  "num-bigint",
  "num-traits",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "time",
 ]
 
@@ -11151,7 +11151,7 @@ dependencies = [
  "serde_json",
  "sha2 0.10.9",
  "smallvec",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "tokio",
  "tokio-stream",
  "tracing",
@@ -11237,7 +11237,7 @@ dependencies = [
  "smallvec",
  "sqlx-core",
  "stringprep",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "tracing",
  "uuid",
  "whoami",
@@ -11278,7 +11278,7 @@ dependencies = [
  "smallvec",
  "sqlx-core",
  "stringprep",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "tracing",
  "uuid",
  "whoami",
@@ -11304,7 +11304,7 @@ dependencies = [
  "serde",
  "serde_urlencoded",
  "sqlx-core",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "tracing",
  "url",
  "uuid",
@@ -11850,6 +11850,17 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "syn"
+version = "3.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2fac314a64dc9a36e61a9eb4261a5e9bbfbc922b27e518af97bc32b926cf967"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
 [[package]]
 name = "sync_wrapper"
 version = "1.0.2"
@@ -12015,7 +12026,7 @@ dependencies = [
  "tantivy-stacker",
  "tantivy-tokenizer-api",
  "tempfile",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "time",
  "typetag",
  "uuid",
@@ -12198,11 +12209,11 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "2.0.18"
+version = "2.0.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
+checksum = "09a43598840e33d5b0331f38c5e30d13bb11c11210a4b58f0d9b18a5a5eefcd9"
 dependencies = [
- "thiserror-impl 2.0.18",
+ "thiserror-impl 2.0.19",
 ]
 
 [[package]]
@@ -12218,13 +12229,13 @@ dependencies = [
 
 [[package]]
 name = "thiserror-impl"
-version = "2.0.18"
+version = "2.0.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
+checksum = "43cbfe0cf76104d42a574802844187e84a305e531ed54455f11fbde0f10541cd"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.119",
+ "syn 3.0.0",
 ]
 
 [[package]]
@@ -12899,7 +12910,7 @@ checksum = "050686193eb999b4bb3bc2acfa891a13da00f79734704c4b8b4ef1a10b368a3c"
 dependencies = [
  "crossbeam-channel",
  "symlink",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "time",
  "tracing-subscriber",
 ]
@@ -13122,9 +13133,9 @@ dependencies = [
 
 [[package]]
 name = "twox-hash"
-version = "2.1.2"
+version = "2.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ea3136b675547379c4bd395ca6b938e5ad3c3d20fad76e7fe85f9e0d011419c"
+checksum = "8464ec13c3691491391d9fce00f6416c9a48e46972f72d7865688be2080192c9"
 
 [[package]]
 name = "typed-path"
@@ -13146,9 +13157,9 @@ checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
 
 [[package]]
 name = "typetag"
-version = "0.2.22"
+version = "0.2.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c5a897b12c6c1151ad0b138b8db50252dc301f93bc3b027db05eec82aeed298c"
+checksum = "c90e86058a30d42a1a928dfb4b49bb33c98c3a2b4909492e6b0881cd94798ec2"
 dependencies = [
  "erased-serde",
  "inventory",
@@ -13159,13 +13170,13 @@ dependencies = [
 
 [[package]]
 name = "typetag-impl"
-version = "0.2.22"
+version = "0.2.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf808357c6ed7e13ba0f3277ec8d8f21b2d501274895104263985330c726c1c5"
+checksum = "f153acc4e99a5f2a5aefa09fb078be54e26271b2813f6041200b224c098d8328"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.119",
+ "syn 3.0.0",
 ]
 
 [[package]]
@@ -13704,7 +13715,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e51cf5f08b357e64cd7642ab4bbeb11aecab9e15520692129624fb9908b8df2c"
 dependencies = [
  "deno_error 0.6.1",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
 ]
 
 [[package]]
@@ -13749,15 +13760,15 @@ checksum = "974fa1e325e6cc5327de8887f189a441fcff4f8eedcd31ec87f0ef0cc5283fbc"
 dependencies = [
  "bytes",
  "http 1.4.2",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "url",
 ]
 
 [[package]]
 name = "webpki-root-certs"
-version = "1.0.8"
+version = "1.0.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d46a5a140e6f7afeccd8eae97eff335163939eac8b929834875168b29b3d267"
+checksum = "b96554aa2acc8ccdb7e1c9a58a7a68dd5d13bccc69cd124cb09406db612a1c9b"
 dependencies = [
  "rustls-pki-types",
 ]
@@ -13768,14 +13779,14 @@ version = "0.26.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9"
 dependencies = [
- "webpki-roots 1.0.8",
+ "webpki-roots 1.0.9",
 ]
 
 [[package]]
 name = "webpki-roots"
-version = "1.0.8"
+version = "1.0.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf85cb06032201fa7c6f829d7db5a7e5aa45bcc0655327713065f6f0576731bf"
+checksum = "7dcd9d09a39985f5344844e66b0c530a33843579125f23e21e9f0f220850f22a"
 dependencies = [
  "rustls-pki-types",
 ]
@@ -13867,7 +13878,7 @@ dependencies = [
 
 [[package]]
 name = "windmill"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -13952,7 +13963,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-ai"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "async-stream",
  "async-trait",
@@ -13985,7 +13996,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-alerting"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -13998,7 +14009,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "argon2",
@@ -14136,7 +14147,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-agent-workers"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14159,7 +14170,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-assets"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14174,7 +14185,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-auth"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14200,7 +14211,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "reqwest 0.12.28",
  "serde",
@@ -14210,7 +14221,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-configs"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14227,7 +14238,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-debug"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "axum 0.8.9",
  "base64 0.22.1",
@@ -14249,7 +14260,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-embeddings"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14272,7 +14283,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flow-conversations"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14288,7 +14299,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flows"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14309,7 +14320,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-groups"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14330,7 +14341,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-inputs"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14344,7 +14355,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-integration-tests"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -14379,7 +14390,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-jobs"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14404,7 +14415,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-npm-proxy"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "axum 0.8.9",
  "flate2",
@@ -14422,7 +14433,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-openapi"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14444,7 +14455,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-schedule"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14464,7 +14475,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-scripts"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14501,7 +14512,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-settings"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14529,7 +14540,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-sse"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "lazy_static",
  "serde",
@@ -14541,7 +14552,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-users"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "argon2",
  "axum 0.8.9",
@@ -14566,7 +14577,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workers"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14580,7 +14591,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workspaces"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14615,7 +14626,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -14629,7 +14640,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14638,7 +14649,7 @@ dependencies = [
  "serde",
  "serde_json",
  "sqlx",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "tokio",
  "tracing",
  "uuid",
@@ -14648,7 +14659,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "aes-gcm",
  "aho-corasick",
@@ -14726,7 +14737,7 @@ dependencies = [
  "systemstat",
  "tar",
  "tempfile",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "tikv-jemalloc-ctl",
  "tokio",
  "tokio-postgres",
@@ -14750,7 +14761,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-dep-map"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "chrono",
  "itertools 0.14.0",
@@ -14769,7 +14780,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "regex",
  "serde",
@@ -14784,7 +14795,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "astral-tokio-tar",
@@ -14808,7 +14819,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-jseval"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -14825,7 +14836,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -14841,7 +14852,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-mcp"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -14862,7 +14873,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-native-triggers"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -14893,7 +14904,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-oauth"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "arc-swap",
@@ -14918,7 +14929,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-object-store"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "async-stream",
@@ -14952,7 +14963,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-operator"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -14962,7 +14973,7 @@ dependencies = [
  "serde_json",
  "serde_yml",
  "sqlx",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "tokio",
  "tracing",
  "windmill-common",
@@ -14970,7 +14981,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -14979,7 +14990,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -14991,7 +15002,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15003,7 +15014,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -15015,7 +15026,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15027,7 +15038,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15039,7 +15050,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -15050,7 +15061,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15061,7 +15072,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15073,7 +15084,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -15084,7 +15095,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15106,7 +15117,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15118,7 +15129,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15132,7 +15143,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -15149,7 +15160,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15162,7 +15173,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -15174,7 +15185,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15192,7 +15203,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -15208,7 +15219,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -15224,7 +15235,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -15235,7 +15246,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15262,7 +15273,7 @@ dependencies = [
  "serde_urlencoded",
  "sql-builder",
  "sqlx",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "tokio",
  "tracing",
  "ulid",
@@ -15274,7 +15285,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-runtime-nativets"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "const_format",
@@ -15314,7 +15325,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "getrandom 0.3.4",
  "wasm-bindgen",
@@ -15325,7 +15336,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-store"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15359,7 +15370,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-test-utils"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15383,7 +15394,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15416,7 +15427,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-azure"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15436,7 +15447,7 @@ dependencies = [
  "serde_json",
  "sha2 0.10.9",
  "sqlx",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "tokio",
  "tokio-util",
  "tracing",
@@ -15449,7 +15460,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-email"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15469,7 +15480,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-gcp"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15488,7 +15499,7 @@ dependencies = [
  "serde",
  "serde_json",
  "sqlx",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "tokio",
  "tokio-util",
  "tonic 0.13.1",
@@ -15503,7 +15514,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-http"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15526,7 +15537,7 @@ dependencies = [
  "sha1",
  "sha2 0.10.9",
  "sqlx",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "tokio",
  "tracing",
  "windmill-api-auth",
@@ -15539,7 +15550,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-kafka"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15562,7 +15573,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-mqtt"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15574,7 +15585,7 @@ dependencies = [
  "serde",
  "serde_json",
  "sqlx",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "tokio",
  "tracing",
  "windmill-api-auth",
@@ -15586,7 +15597,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-nats"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -15610,7 +15621,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-postgres"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15630,7 +15641,7 @@ dependencies = [
  "serde",
  "serde_json",
  "sqlx",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "tokio",
  "tokio-postgres",
  "tokio-stream",
@@ -15645,7 +15656,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-sqs"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15661,7 +15672,7 @@ dependencies = [
  "serde",
  "serde_json",
  "sqlx",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "tokio",
  "tracing",
  "windmill-api-auth",
@@ -15673,7 +15684,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-websocket"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15698,7 +15709,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "bitflags 2.13.1",
@@ -15717,7 +15728,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "async-once-cell",
@@ -15831,7 +15842,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker-volumes"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "bytes",
  "futures",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 713465827c..ec1cf6201a 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.762.2"
+version = "1.763.0"
 authors.workspace = true
 edition.workspace = true
 
@@ -87,7 +87,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal", "./parsers/windmill-parser-wasm"]
 
 [workspace.package]
-version = "1.762.2"
+version = "1.763.0"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.lock b/backend/parsers/windmill-parser-wasm/Cargo.lock
index 97cdb02cba..7cdad91ae3 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.lock
+++ b/backend/parsers/windmill-parser-wasm/Cargo.lock
@@ -6191,7 +6191,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill-common"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "aho-corasick",
  "anyhow",
@@ -6272,7 +6272,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -6284,7 +6284,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "convert_case",
  "serde",
@@ -6293,7 +6293,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6305,7 +6305,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6317,7 +6317,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -6329,7 +6329,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6341,7 +6341,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6353,7 +6353,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -6364,7 +6364,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6375,7 +6375,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6387,7 +6387,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6398,7 +6398,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -6420,7 +6420,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6432,7 +6432,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6446,7 +6446,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "convert_case",
@@ -6463,7 +6463,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6476,7 +6476,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -6488,7 +6488,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6506,7 +6506,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -6522,7 +6522,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6538,7 +6538,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wasm"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "getrandom 0.2.17",
@@ -6570,7 +6570,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -6581,7 +6581,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.762.2"
+version = "1.763.0"
 dependencies = [
  "anyhow",
  "bitflags",
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.toml b/backend/parsers/windmill-parser-wasm/Cargo.toml
index deb9491e94..9fd7646dec 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.toml
+++ b/backend/parsers/windmill-parser-wasm/Cargo.toml
@@ -12,7 +12,7 @@ resolver = "2"
 members = ["."]
 
 [workspace.package]
-version = "1.762.2"
+version = "1.763.0"
 edition = "2021"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 39f3df1206..e5bc24d360 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.762.2
+  version: 1.763.0
   title: Windmill API
 
   contact:
diff --git a/benchmarks/lib.ts b/benchmarks/lib.ts
index 802316a9ad..793d2837f1 100644
--- a/benchmarks/lib.ts
+++ b/benchmarks/lib.ts
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.762.2";
+export const VERSION = "v1.763.0";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({
diff --git a/cli/src/core/constants.ts b/cli/src/core/constants.ts
index 01c79956b1..0811c18360 100644
--- a/cli/src/core/constants.ts
+++ b/cli/src/core/constants.ts
@@ -10,4 +10,4 @@ export const WM_FORK_PREFIX = "wm-fork";
 // (e.g. utils.ts) can read it without importing main.ts and creating a circular
 // dependency (main → workspace → utils → main) that triggers a TDZ.
 // Re-exported from main.ts for backwards compatibility.
-export const VERSION = "1.762.2";
+export const VERSION = "1.763.0";
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 3091e12842..42ebc783f7 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.762.2",
+	"version": "1.763.0",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "@windmill-labs/components",
-			"version": "1.762.2",
+			"version": "1.763.0",
 			"hasInstallScript": true,
 			"license": "AGPL-3.0",
 			"dependencies": {
diff --git a/frontend/package.json b/frontend/package.json
index 70770abe31..b940c9eeb9 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.762.2",
+	"version": "1.763.0",
 	"scripts": {
 		"dev": "vite dev",
 		"dev:ui-builder": "mv static/ui_builder static/ui_builder.dev-disabled 2>/dev/null || true ; trap 'mv static/ui_builder.dev-disabled static/ui_builder 2>/dev/null || true' EXIT ; vite dev",
diff --git a/lsp/Pipfile b/lsp/Pipfile
index 75ececd4b7..7a075c57a7 100644
--- a/lsp/Pipfile
+++ b/lsp/Pipfile
@@ -4,7 +4,7 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-wmill = ">=1.762.2"
+wmill = ">=1.763.0"
 sendgrid = "*"
 mysql-connector-python = "*"
 pymongo = "*"
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index 25ffabc645..6f42e214ca 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1,7 +1,7 @@
 openapi: '3.0.3'
 
 info:
-  version: 1.762.2
+  version: 1.763.0
   title: OpenFlow Spec
   contact:
     name: Ruben Fiszel
diff --git a/powershell-client/WindmillClient/WindmillClient.psd1 b/powershell-client/WindmillClient/WindmillClient.psd1
index 1fb552c36d..c97ebc9576 100644
--- a/powershell-client/WindmillClient/WindmillClient.psd1
+++ b/powershell-client/WindmillClient/WindmillClient.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'WindmillClient.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '1.762.2'
+    ModuleVersion     = '1.763.0'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()
diff --git a/python-client/wmill/pyproject.toml b/python-client/wmill/pyproject.toml
index 199af5ca5f..7c42484438 100644
--- a/python-client/wmill/pyproject.toml
+++ b/python-client/wmill/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill"
-version = "1.762.2"
+version = "1.763.0"
 description = "A client library for accessing Windmill server wrapping the Windmill client API"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/typescript-client/jsr.json b/typescript-client/jsr.json
index 3b8cc6508e..8850db5c63 100644
--- a/typescript-client/jsr.json
+++ b/typescript-client/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@windmill/windmill",
-  "version": "1.762.2",
+  "version": "1.763.0",
   "exports": "./src/index.ts",
   "publish": {
     "exclude": ["!src", "./s3Types.ts", "./sqlUtils.ts", "./client.ts"]
diff --git a/typescript-client/package.json b/typescript-client/package.json
index 7a099c09df..1ca391ffc6 100644
--- a/typescript-client/package.json
+++ b/typescript-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.762.2",
+  "version": "1.763.0",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "homepage": "https://github.com/windmill-labs/windmill/tree/main/typescript-client#readme",
diff --git a/version.txt b/version.txt
index d2c7eba15c..1de8885f2d 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.762.2
+1.763.0

From f32d7702bcb592a70f5cf7e01f9e830047645240 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Mon, 20 Jul 2026 07:31:02 +0200
Subject: [PATCH 055/171] fix(inputs): add ownership check to saved-input args
 read endpoint (#10194)

`get_args_from_history_or_saved_input` looked up saved-input rows by
`id + workspace_id` only, without checking ownership or `is_public`. The
`input` table has no RLS policy, so any authenticated workspace member
could read another member's private saved-input args (which may hold
credentials) just by knowing the UUID, even though `inputs/list` already
scopes to `is_public OR created_by = caller`.

Add `AND (is_public IS true OR created_by = $4)` to both `input`-table
queries in the handler (the `?input=true` single-query branch and the
default `v2_job UNION ALL input` branch), matching the predicate already
used by `list_saved_inputs`.

The `v2_job` branches are already covered by the table's RLS policies
enforced via `SET LOCAL ROLE windmill_user` in `UserDB::begin()`, so they
are left unchanged.

Fixes WIN-2202

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 ...3d9d316e6cf0437c4efcdeae45fba0f240fc1175bf003.json} |  7 ++++---
 ...fe086dd55f62df8b7f510b4c478818ff8ab1a11d7d5ea.json} |  7 ++++---
 backend/windmill-api-inputs/src/lib.rs                 | 10 ++++++----
 3 files changed, 14 insertions(+), 10 deletions(-)
 rename backend/.sqlx/{query-a22146c0a924e5a1a99bc72775399a8c3db31b57ae9ded5bff55f44321c3f3c2.json => query-cb26dc8e09c0525963c3d9d316e6cf0437c4efcdeae45fba0f240fc1175bf003.json} (68%)
 rename backend/.sqlx/{query-55002cccf17e32af5b077a17707122cfeeeebf5a9392c6798a486274d8d233d5.json => query-ef57c1622cc57e4485ffe086dd55f62df8b7f510b4c478818ff8ab1a11d7d5ea.json} (75%)

diff --git a/backend/.sqlx/query-a22146c0a924e5a1a99bc72775399a8c3db31b57ae9ded5bff55f44321c3f3c2.json b/backend/.sqlx/query-cb26dc8e09c0525963c3d9d316e6cf0437c4efcdeae45fba0f240fc1175bf003.json
similarity index 68%
rename from backend/.sqlx/query-a22146c0a924e5a1a99bc72775399a8c3db31b57ae9ded5bff55f44321c3f3c2.json
rename to backend/.sqlx/query-cb26dc8e09c0525963c3d9d316e6cf0437c4efcdeae45fba0f240fc1175bf003.json
index daeaccb715..dce702a619 100644
--- a/backend/.sqlx/query-a22146c0a924e5a1a99bc72775399a8c3db31b57ae9ded5bff55f44321c3f3c2.json
+++ b/backend/.sqlx/query-cb26dc8e09c0525963c3d9d316e6cf0437c4efcdeae45fba0f240fc1175bf003.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT CASE WHEN pg_column_size(args) < 40000 OR $3 THEN args ELSE '\"WINDMILL_TOO_BIG\"'::jsonb END as args FROM input WHERE id = $1 AND workspace_id = $2",
+  "query": "SELECT CASE WHEN pg_column_size(args) < 40000 OR $3 THEN args ELSE '\"WINDMILL_TOO_BIG\"'::jsonb END as args FROM input WHERE id = $1 AND workspace_id = $2 AND (is_public IS true OR created_by = $4)",
   "describe": {
     "columns": [
       {
@@ -13,12 +13,13 @@
       "Left": [
         "Uuid",
         "Text",
-        "Bool"
+        "Bool",
+        "Text"
       ]
     },
     "nullable": [
       null
     ]
   },
-  "hash": "a22146c0a924e5a1a99bc72775399a8c3db31b57ae9ded5bff55f44321c3f3c2"
+  "hash": "cb26dc8e09c0525963c3d9d316e6cf0437c4efcdeae45fba0f240fc1175bf003"
 }
diff --git a/backend/.sqlx/query-55002cccf17e32af5b077a17707122cfeeeebf5a9392c6798a486274d8d233d5.json b/backend/.sqlx/query-ef57c1622cc57e4485ffe086dd55f62df8b7f510b4c478818ff8ab1a11d7d5ea.json
similarity index 75%
rename from backend/.sqlx/query-55002cccf17e32af5b077a17707122cfeeeebf5a9392c6798a486274d8d233d5.json
rename to backend/.sqlx/query-ef57c1622cc57e4485ffe086dd55f62df8b7f510b4c478818ff8ab1a11d7d5ea.json
index f9d007d4c1..bd2d3cefda 100644
--- a/backend/.sqlx/query-55002cccf17e32af5b077a17707122cfeeeebf5a9392c6798a486274d8d233d5.json
+++ b/backend/.sqlx/query-ef57c1622cc57e4485ffe086dd55f62df8b7f510b4c478818ff8ab1a11d7d5ea.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT CASE WHEN pg_column_size(args) < 40000 OR $3 THEN args ELSE '\"WINDMILL_TOO_BIG\"'::jsonb END as args FROM v2_job WHERE id = $1 AND workspace_id = $2\n            UNION ALL\n            SELECT CASE WHEN pg_column_size(args) < 40000 OR $3 THEN args ELSE '\"WINDMILL_TOO_BIG\"'::jsonb END as args FROM input WHERE id = $1 AND workspace_id = $2",
+  "query": "SELECT CASE WHEN pg_column_size(args) < 40000 OR $3 THEN args ELSE '\"WINDMILL_TOO_BIG\"'::jsonb END as args FROM v2_job WHERE id = $1 AND workspace_id = $2\n            UNION ALL\n            SELECT CASE WHEN pg_column_size(args) < 40000 OR $3 THEN args ELSE '\"WINDMILL_TOO_BIG\"'::jsonb END as args FROM input WHERE id = $1 AND workspace_id = $2 AND (is_public IS true OR created_by = $4)",
   "describe": {
     "columns": [
       {
@@ -13,12 +13,13 @@
       "Left": [
         "Uuid",
         "Text",
-        "Bool"
+        "Bool",
+        "Text"
       ]
     },
     "nullable": [
       null
     ]
   },
-  "hash": "55002cccf17e32af5b077a17707122cfeeeebf5a9392c6798a486274d8d233d5"
+  "hash": "ef57c1622cc57e4485ffe086dd55f62df8b7f510b4c478818ff8ab1a11d7d5ea"
 }
diff --git a/backend/windmill-api-inputs/src/lib.rs b/backend/windmill-api-inputs/src/lib.rs
index 348b434eea..8764736e83 100644
--- a/backend/windmill-api-inputs/src/lib.rs
+++ b/backend/windmill-api-inputs/src/lib.rs
@@ -246,10 +246,11 @@ async fn get_args_from_history_or_saved_input(
     let result_o = if let Some(input) = g.input {
         if input {
             sqlx::query_scalar!(
-                "SELECT CASE WHEN pg_column_size(args) < 40000 OR $3 THEN args ELSE '\"WINDMILL_TOO_BIG\"'::jsonb END as args FROM input WHERE id = $1 AND workspace_id = $2",
+                "SELECT CASE WHEN pg_column_size(args) < 40000 OR $3 THEN args ELSE '\"WINDMILL_TOO_BIG\"'::jsonb END as args FROM input WHERE id = $1 AND workspace_id = $2 AND (is_public IS true OR created_by = $4)",
                 job_or_input_id,
                 w_id,
-                g.allow_large.unwrap_or(true)
+                g.allow_large.unwrap_or(true),
+                authed.username
             )
             .fetch_optional(&mut *tx)
             .await?
@@ -267,10 +268,11 @@ async fn get_args_from_history_or_saved_input(
         sqlx::query_scalar!(
             "SELECT CASE WHEN pg_column_size(args) < 40000 OR $3 THEN args ELSE '\"WINDMILL_TOO_BIG\"'::jsonb END as args FROM v2_job WHERE id = $1 AND workspace_id = $2
             UNION ALL
-            SELECT CASE WHEN pg_column_size(args) < 40000 OR $3 THEN args ELSE '\"WINDMILL_TOO_BIG\"'::jsonb END as args FROM input WHERE id = $1 AND workspace_id = $2",
+            SELECT CASE WHEN pg_column_size(args) < 40000 OR $3 THEN args ELSE '\"WINDMILL_TOO_BIG\"'::jsonb END as args FROM input WHERE id = $1 AND workspace_id = $2 AND (is_public IS true OR created_by = $4)",
             job_or_input_id,
             w_id,
-            g.allow_large.unwrap_or(true)
+            g.allow_large.unwrap_or(true),
+            authed.username
         )
         .fetch_optional(&mut *tx)
         .await?

From 70359e3a76d2e1fa5994acce4909753410c80664 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Mon, 20 Jul 2026 07:32:52 +0200
Subject: [PATCH 056/171] fix(schedules): apply scope-path filtering to
 schedule list endpoints (#10192)

`list_schedule` and `list_schedule_with_jobs` returned every schedule in
the workspace regardless of the token's declared scope. A token limited
to `schedules:read:<prefix>/*` could enumerate all schedule paths (and
their script paths, cron expressions and recent job outcomes) through
these two endpoints, while `get_schedule` correctly rejected them.

Apply `build_scope_path_predicate(&authed, "schedules", "read")` to the
returned rows, mirroring scripts, flows, apps, resources and variables.
In `list_schedule` the filter runs after the draft-only append so both
deployed and draft rows are covered.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 backend/windmill-api-schedule/src/lib.rs | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/backend/windmill-api-schedule/src/lib.rs b/backend/windmill-api-schedule/src/lib.rs
index 573c47e355..e9ca4d54fe 100644
--- a/backend/windmill-api-schedule/src/lib.rs
+++ b/backend/windmill-api-schedule/src/lib.rs
@@ -16,7 +16,9 @@ use serde::{Deserialize, Serialize};
 use sql_builder::{prelude::Bind, SqlBuilder};
 use sqlx::{Postgres, Transaction};
 use std::str::FromStr;
-use windmill_api_auth::{check_scopes, maybe_refresh_folders, require_super_admin, ApiAuthed};
+use windmill_api_auth::{
+    build_scope_path_predicate, check_scopes, maybe_refresh_folders, require_super_admin, ApiAuthed,
+};
 use windmill_audit::audit_oss::audit_log;
 use windmill_audit::ActionKind;
 use windmill_common::DB;
@@ -911,6 +913,9 @@ async fn list_schedule(
         }
     }
 
+    let allowed = build_scope_path_predicate(&authed, "schedules", "read");
+    rows.retain(|r| allowed(&r.path));
+
     Ok(Json(rows))
 }
 
@@ -958,7 +963,10 @@ async fn list_schedule_with_jobs(
     .fetch_all(&mut *tx)
     .await?;
     tx.commit().await?;
-    Ok(Json(rows))
+    let allowed = build_scope_path_predicate(&authed, "schedules", "read");
+    Ok(Json(
+        rows.into_iter().filter(|r| allowed(&r.path)).collect(),
+    ))
 }
 
 // SELECT id, title AS item_title, t.tag_array

From b5e69ffba6afd49d147e9b5e88e2d7020c09142f Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Mon, 20 Jul 2026 07:50:50 +0200
Subject: [PATCH 057/171] fix(security): enforce token scope filtering on
 folder list endpoints (#10193)

* fix(security): enforce token scope filtering on folder list endpoints

* fix: apply folder scope filtering before pagination

* fix: keep SQL pagination for unrestricted tokens on folder lists

* fix: bound scoped folder-list scan with chunked pagination

* fix: use keyset pagination for scoped folder-list scan

* refactor: reduce folder scope fix to the minimal predicate filter

* chore: drop folder list scope test
---
 backend/windmill-api-groups/src/folders.rs | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/backend/windmill-api-groups/src/folders.rs b/backend/windmill-api-groups/src/folders.rs
index 67997bc965..5e204a6f2c 100644
--- a/backend/windmill-api-groups/src/folders.rs
+++ b/backend/windmill-api-groups/src/folders.rs
@@ -15,7 +15,7 @@ use axum::{
 };
 use lazy_static::lazy_static;
 use regex::Regex;
-use windmill_api_auth::{check_scopes, ApiAuthed, AuthCache, Tokened};
+use windmill_api_auth::{build_scope_path_predicate, check_scopes, ApiAuthed, AuthCache, Tokened};
 use windmill_audit::audit_oss::{audit_log, AuditAuthorable};
 use windmill_audit::ActionKind;
 use windmill_common::DB;
@@ -109,6 +109,7 @@ async fn list_folders(
     let (per_page, offset) = paginate(pagination);
     let mut tx = user_db.begin(&authed).await?;
 
+    let allowed = build_scope_path_predicate(&authed, "folders", "read");
     let rows = sqlx::query_as!(
         Folder,
         "SELECT workspace_id, name, display_name, owners, extra_perms, summary, created_by, edited_at, default_permissioned_as, labels FROM folder WHERE workspace_id = $1 ORDER BY name asc LIMIT $2 OFFSET $3",
@@ -117,7 +118,10 @@ async fn list_folders(
         offset as i64
     )
     .fetch_all(&mut *tx)
-    .await?;
+    .await?
+    .into_iter()
+    .filter(|r| allowed(&format!("f/{}", r.name)))
+    .collect::<Vec<_>>();
     tx.commit().await?;
 
     Ok(Json(rows))
@@ -131,6 +135,7 @@ async fn list_foldernames(
     let (per_page, offset) = paginate(pagination);
     let mut tx = user_db.begin(&authed).await?;
 
+    let allowed = build_scope_path_predicate(&authed, "folders", "read");
     let rows = sqlx::query_scalar!(
         "SELECT name FROM folder WHERE workspace_id = $1 ORDER BY name asc LIMIT $2 OFFSET $3",
         w_id,
@@ -138,7 +143,10 @@ async fn list_foldernames(
         offset as i64
     )
     .fetch_all(&mut *tx)
-    .await?;
+    .await?
+    .into_iter()
+    .filter(|name| allowed(&format!("f/{}", name)))
+    .collect::<Vec<_>>();
 
     tx.commit().await?;
 

From 83a354f831cbc1821f2316e6d4e1c7f7a2cd7cdb Mon Sep 17 00:00:00 2001
From: hugocasa <hugo@casademont.ch>
Date: Mon, 20 Jul 2026 11:31:51 +0200
Subject: [PATCH 058/171] feat: expose windmill api endpoint catalog to global
 ai chat (#10199)

* feat: expose windmill api endpoint catalog to global ai chat

* fix: guard variable reads and deletes in ai chat api catalog

* fix: clarify api catalog prompt example for run result access

* fix: block deleteScriptByHash and document resource read boundary
---
 .../chat/global/apiCatalogTools.test.ts       | 229 +++++++++++
 .../copilot/chat/global/apiCatalogTools.ts    | 369 ++++++++++++++++++
 .../components/copilot/chat/global/core.ts    |   7 +-
 3 files changed, 604 insertions(+), 1 deletion(-)
 create mode 100644 frontend/src/lib/components/copilot/chat/global/apiCatalogTools.test.ts
 create mode 100644 frontend/src/lib/components/copilot/chat/global/apiCatalogTools.ts

diff --git a/frontend/src/lib/components/copilot/chat/global/apiCatalogTools.test.ts b/frontend/src/lib/components/copilot/chat/global/apiCatalogTools.test.ts
new file mode 100644
index 0000000000..470b396b53
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/global/apiCatalogTools.test.ts
@@ -0,0 +1,229 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { listMcpToolsMock } = vi.hoisted(() => ({
+	listMcpToolsMock: vi.fn()
+}))
+
+vi.mock('../shared', () => ({
+	createToolDef: (_schema: unknown, name: string, description: string) => ({
+		type: 'function',
+		function: { name, description, parameters: {} }
+	})
+}))
+
+vi.mock('$lib/gen', () => ({
+	McpService: {
+		listMcpTools: listMcpToolsMock
+	}
+}))
+
+import { apiCatalogTools, clearApiCatalogCache } from './apiCatalogTools'
+
+const CATALOG = [
+	{
+		name: 'listWorkers',
+		description: 'List workers',
+		instructions: 'List all workers with their ping status',
+		path: '/workers/list',
+		method: 'GET',
+		query_params_schema: {
+			type: 'object',
+			properties: { page: { type: 'integer' }, per_page: { type: 'integer' } }
+		}
+	},
+	{
+		name: 'getJob',
+		description: 'Get job details',
+		instructions: '',
+		path: '/w/{workspace}/jobs_u/get/{id}',
+		method: 'GET',
+		path_params_schema: {
+			type: 'object',
+			properties: { workspace: { type: 'string' }, id: { type: 'string' } },
+			required: ['workspace', 'id']
+		}
+	},
+	{
+		name: 'deleteSchedule',
+		description: 'Delete a schedule',
+		instructions: '',
+		path: '/w/{workspace}/schedules/delete/{path}',
+		method: 'DELETE',
+		path_params_schema: {
+			type: 'object',
+			properties: { workspace: { type: 'string' }, path: { type: 'string' } },
+			required: ['workspace', 'path']
+		}
+	},
+	{
+		name: 'createFlow',
+		description: 'Create a flow',
+		instructions: '',
+		path: '/w/{workspace}/flows/create',
+		method: 'POST'
+	},
+	{
+		name: 'getVariable',
+		description: 'Get variable',
+		instructions: '',
+		path: '/w/{workspace}/variables/get/{path}',
+		method: 'GET'
+	},
+	{
+		name: 'deleteScriptByHash',
+		description: 'Delete a script by hash',
+		instructions: '',
+		path: '/w/{workspace}/scripts/delete/h/{hash}',
+		method: 'POST',
+		path_params_schema: {
+			type: 'object',
+			properties: { workspace: { type: 'string' }, hash: { type: 'string' } },
+			required: ['workspace', 'hash']
+		}
+	},
+	{
+		name: 'runFlowByPath',
+		description: 'Run flow by path',
+		instructions: 'Trigger a run of a deployed flow',
+		path: '/w/{workspace}/jobs/run/f/{path}',
+		method: 'POST',
+		path_params_schema: {
+			type: 'object',
+			properties: { workspace: { type: 'string' }, path: { type: 'string' } },
+			required: ['workspace', 'path']
+		},
+		body_schema: {
+			type: 'object',
+			properties: { args: { type: 'object' } }
+		}
+	}
+]
+
+function createToolCallbacks() {
+	return {
+		setToolStatus: vi.fn(),
+		removeToolStatus: vi.fn()
+	} as any
+}
+
+function getTool(name: string) {
+	const tool = apiCatalogTools.find((entry) => entry.def.function.name === name)
+	if (!tool) throw new Error(`${name} tool not found`)
+	return tool
+}
+
+async function run(name: string, args: Record<string, unknown>) {
+	const raw = await getTool(name).fn({
+		args,
+		workspace: 'test-ws',
+		helpers: {},
+		toolCallbacks: createToolCallbacks(),
+		toolId: 'tool-1'
+	})
+	return JSON.parse(raw)
+}
+
+beforeEach(() => {
+	vi.clearAllMocks()
+	clearApiCatalogCache()
+	listMcpToolsMock.mockResolvedValue(CATALOG)
+	vi.unstubAllGlobals()
+})
+
+describe('search_api_endpoints', () => {
+	it('matches on name/path tokens, plural-insensitively, and excludes covered endpoints', async () => {
+		const result = await run('search_api_endpoints', { query: 'worker' })
+		expect(result.matches.map((m: any) => m.name)).toEqual(['listWorkers'])
+		expect(result.matches[0].endpoint).toBe('GET /workers/list')
+		expect(result.matches[0].params).toEqual(['page', 'per_page'])
+		expect(result.matches[0].instructions).toContain('ping status')
+
+		const flows = await run('search_api_endpoints', { query: 'create flow' })
+		expect(flows.matches.map((m: any) => m.name)).not.toContain('createFlow')
+		expect(flows.covered_by_dedicated_tools).toContain('createFlow → use write_flow')
+	})
+
+	it('returns endpoint categories when nothing matches', async () => {
+		const result = await run('search_api_endpoints', { query: 'kubernetes' })
+		expect(result.matches).toEqual([])
+		expect(result.hint).toContain('workers')
+		expect(result.hint).toContain('jobs')
+	})
+})
+
+describe('call_api_get', () => {
+	it('rejects covered, unknown, and non-GET endpoints with a pointer', async () => {
+		const covered = await run('call_api_get', { name: 'createFlow' })
+		expect(covered.error).toContain('write_flow')
+
+		const unknown = await run('call_api_get', { name: 'nope' })
+		expect(unknown.error).toContain('search_api_endpoints')
+
+		const mutating = await run('call_api_get', { name: 'runFlowByPath' })
+		expect(mutating.error).toContain('call_api_endpoint')
+
+		const deleting = await run('call_api_endpoint', { name: 'deleteSchedule' })
+		expect(deleting.error).toContain('delete_workspace_item')
+
+		const byHash = await run('call_api_endpoint', { name: 'deleteScriptByHash' })
+		expect(byHash.error).toContain('delete_workspace_item')
+		const search = await run('search_api_endpoints', { query: 'delete script' })
+		expect(search.matches.map((m: any) => m.name)).not.toContain('deleteScriptByHash')
+	})
+
+	it('refuses variable reads so variable values never reach the model', async () => {
+		const result = await run('call_api_get', { name: 'getVariable' })
+		expect(result.success).toBe(false)
+		expect(result.error).toContain('never readable')
+
+		const search = await run('search_api_endpoints', { query: 'variable' })
+		expect(search.matches.map((m: any) => m.name)).not.toContain('getVariable')
+	})
+
+	it('returns the endpoint schema when a required path param is missing', async () => {
+		const result = await run('call_api_get', { name: 'getJob' })
+		expect(result.success).toBe(false)
+		expect(result.error).toContain('id')
+		expect(result.schema.path_params_schema.required).toContain('id')
+	})
+
+	it('substitutes path params and sends the rest as query params', async () => {
+		const fetchMock = vi.fn().mockResolvedValue({
+			ok: true,
+			headers: new Headers({ 'content-type': 'application/json' }),
+			json: async () => [{ worker: 'w1' }]
+		})
+		vi.stubGlobal('fetch', fetchMock)
+		const result = await run('call_api_get', { name: 'listWorkers', params: { page: 2 } })
+		expect(fetchMock).toHaveBeenCalledWith('/api/workers/list?page=2', { method: 'GET' })
+		expect(result).toEqual({ success: true, data: [{ worker: 'w1' }] })
+	})
+})
+
+describe('call_api_endpoint', () => {
+	it('requires confirmation and executes mutating endpoints with a body', async () => {
+		expect(getTool('call_api_endpoint').requiresConfirmation).toBe(true)
+		const fetchMock = vi.fn().mockResolvedValue({
+			ok: true,
+			headers: new Headers({ 'content-type': 'text/plain' }),
+			text: async () => 'job-id-1'
+		})
+		vi.stubGlobal('fetch', fetchMock)
+		const result = await run('call_api_endpoint', {
+			name: 'runFlowByPath',
+			params: { path: 'u/me/myflow' },
+			body: { args: { n: 1 } }
+		})
+		expect(fetchMock).toHaveBeenCalledWith('/api/w/test-ws/jobs/run/f/u%2Fme%2Fmyflow', {
+			method: 'POST',
+			headers: { 'Content-Type': 'application/json' },
+			body: JSON.stringify({ args: { n: 1 } })
+		})
+		expect(result).toEqual({ success: true, data: 'job-id-1' })
+	})
+
+	it('redirects GET endpoints to call_api_get', async () => {
+		const result = await run('call_api_endpoint', { name: 'listWorkers' })
+		expect(result.error).toContain('call_api_get')
+	})
+})
diff --git a/frontend/src/lib/components/copilot/chat/global/apiCatalogTools.ts b/frontend/src/lib/components/copilot/chat/global/apiCatalogTools.ts
new file mode 100644
index 0000000000..be4ca892d8
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/global/apiCatalogTools.ts
@@ -0,0 +1,369 @@
+import { z } from 'zod'
+import { McpService, type EndpointTool } from '$lib/gen'
+import { createToolDef, type Tool } from '../shared'
+
+/**
+ * Generic access to the backend's MCP endpoint catalog (the endpoints marked
+ * `x-mcp-tool` in openapi.yaml) as three small static tools — search, GET
+ * call, mutating call — instead of one registered tool per endpoint. Search
+ * results carry parameter names and usage instructions; full parameter schemas
+ * enter the model's context only when a call fails validation. This keeps the
+ * per-iteration tool-schema cost constant.
+ */
+
+// Endpoints whose job a dedicated global tool already does, plus the variable
+// read endpoints. Hidden from search and refused at call time: the authoring
+// and delete ones would bypass the draft lifecycle (conflict detection,
+// explicit deploy, draft cleanup on delete), the variable reads would expose
+// variable values to the model (getVariable even decrypts secrets by default),
+// and the rest are exact duplicates that would fragment behavior across two
+// code paths. getResource stays available: resource values are readable in
+// this chat by design (read_workspace_item returns them too) — secrets belong
+// in variables referenced as "$var:path", which a plain get leaves unresolved.
+const COVERED_ENDPOINTS: Record<string, string> = {
+	getVariable: 'read_workspace_item (variable values are never readable in chat)',
+	listVariable: 'list_workspace_items (variable values are never readable in chat)',
+	deleteScriptByPath: 'delete_workspace_item',
+	deleteScriptByHash: 'delete_workspace_item',
+	deleteFlowByPath: 'delete_workspace_item',
+	deleteSchedule: 'delete_workspace_item',
+	deleteVariable: 'delete_workspace_item',
+	deleteResource: 'delete_workspace_item',
+	createScript: 'write_script',
+	createFlow: 'write_flow',
+	updateFlow: 'patch_flow_json or write_flow',
+	createApp: 'init_app and the app draft tools',
+	updateApp: 'write_app_file / write_app_runnable',
+	createVariable: 'write_variable',
+	updateVariable: 'write_variable',
+	createResource: 'write_resource',
+	updateResource: 'write_resource',
+	createSchedule: 'write_schedule',
+	updateSchedule: 'write_schedule',
+	searchDocs: 'search_docs',
+	readDocsPage: 'read_docs_page',
+	listJobs: 'list_runs',
+	getJobLogs: 'get_job_logs',
+	runScriptPreviewAndWaitResult: 'test_run_script'
+}
+
+const MAX_SEARCH_RESULTS = 10
+const MAX_DESCRIPTION_CHARS = 200
+const MAX_INSTRUCTIONS_CHARS = 400
+const MAX_RESULT_CHARS = 20_000
+
+let catalogCache: { workspace: string; endpoints: EndpointTool[] } | undefined
+
+async function loadCatalog(workspace: string): Promise<EndpointTool[]> {
+	if (catalogCache?.workspace !== workspace) {
+		const endpoints = await McpService.listMcpTools({ workspace })
+		catalogCache = { workspace, endpoints }
+	}
+	return catalogCache.endpoints
+}
+
+export function clearApiCatalogCache() {
+	catalogCache = undefined
+}
+
+function tokenize(text: string): string[] {
+	return text
+		.replace(/([a-z0-9])([A-Z])/g, '$1 $2')
+		.toLowerCase()
+		.split(/[^a-z0-9]+/)
+		.filter((t) => t.length > 1)
+}
+
+// Cheap plural-insensitive comparison so "workers" matches "worker" and vice versa.
+function tokenMatches(token: string, queryToken: string): boolean {
+	const strip = (t: string) => (t.length > 3 && t.endsWith('s') ? t.slice(0, -1) : t)
+	return strip(token) === strip(queryToken)
+}
+
+function pathSegments(path: string): string[] {
+	return path.split('/').filter((seg) => seg && seg !== 'w' && !seg.startsWith('{'))
+}
+
+// Name and path tokens identify the operation; description tokens only support it.
+function scoreEndpoint(endpoint: EndpointTool, queryTokens: string[]): number {
+	const nameTokens = [...tokenize(endpoint.name), ...pathSegments(endpoint.path).flatMap(tokenize)]
+	const descTokens = tokenize(`${endpoint.description} ${endpoint.instructions}`)
+	let score = 0
+	for (const qt of queryTokens) {
+		if (nameTokens.some((t) => tokenMatches(t, qt))) score += 3
+		else if (descTokens.some((t) => tokenMatches(t, qt))) score += 1
+	}
+	return score
+}
+
+function schemaPropertyNames(schema: unknown): string[] {
+	const properties = (schema as { properties?: Record<string, unknown> } | null | undefined)
+		?.properties
+	return properties ? Object.keys(properties).filter((k) => k !== 'workspace') : []
+}
+
+function truncate(text: string, max: number): string {
+	return text.length > max ? text.slice(0, max) + '…' : text
+}
+
+function summarizeEndpoint(endpoint: EndpointTool) {
+	const params = [
+		...schemaPropertyNames(endpoint.path_params_schema),
+		...schemaPropertyNames(endpoint.query_params_schema)
+	]
+	const bodyParams = schemaPropertyNames(endpoint.body_schema)
+	const instructions = endpoint.instructions.trim()
+	return {
+		name: endpoint.name,
+		endpoint: `${endpoint.method.toUpperCase()} ${endpoint.path}`,
+		description: truncate(endpoint.description, MAX_DESCRIPTION_CHARS),
+		...(instructions ? { instructions: truncate(instructions, MAX_INSTRUCTIONS_CHARS) } : {}),
+		...(params.length > 0 ? { params } : {}),
+		...(bodyParams.length > 0 ? { body_params: bodyParams } : {})
+	}
+}
+
+function endpointSchemaHelp(endpoint: EndpointTool) {
+	return {
+		name: endpoint.name,
+		endpoint: `${endpoint.method.toUpperCase()} ${endpoint.path}`,
+		path_params_schema: endpoint.path_params_schema ?? undefined,
+		query_params_schema: endpoint.query_params_schema ?? undefined,
+		body_schema: endpoint.body_schema ?? undefined
+	}
+}
+
+async function resolveEndpoint(
+	workspace: string,
+	name: string
+): Promise<{ endpoint: EndpointTool } | { error: string }> {
+	const covered = COVERED_ENDPOINTS[name]
+	if (covered) {
+		return { error: `"${name}" is covered by the dedicated ${covered} tool — use it instead.` }
+	}
+	const catalog = await loadCatalog(workspace)
+	const endpoint = catalog.find((e) => e.name === name)
+	if (!endpoint) {
+		return {
+			error: `Unknown endpoint "${name}". Use search_api_endpoints to find the endpoint name.`
+		}
+	}
+	return { endpoint }
+}
+
+async function executeEndpoint(
+	endpoint: EndpointTool,
+	workspace: string,
+	params: Record<string, unknown>,
+	body?: unknown
+): Promise<string> {
+	let url = `/api${endpoint.path.replace('{workspace}', encodeURIComponent(workspace))}`
+	const queryParams = new URLSearchParams()
+	for (const [key, value] of Object.entries(params)) {
+		if (value === undefined || value === null) continue
+		if (url.includes(`{${key}}`)) {
+			url = url.replace(`{${key}}`, encodeURIComponent(String(value)))
+		} else {
+			queryParams.append(key, String(value))
+		}
+	}
+	const unresolved = [...url.matchAll(/\{([^}]+)\}/g)].map((m) => m[1])
+	if (unresolved.length > 0) {
+		return JSON.stringify({
+			success: false,
+			error: `Missing required path parameter(s): ${unresolved.join(', ')}`,
+			schema: endpointSchemaHelp(endpoint)
+		})
+	}
+	const search = queryParams.toString()
+	if (search) url += `?${search}`
+
+	const method = endpoint.method.toUpperCase()
+	const fetchOptions: RequestInit = { method }
+	if (body !== undefined && method !== 'GET') {
+		fetchOptions.headers = { 'Content-Type': 'application/json' }
+		fetchOptions.body = JSON.stringify(body)
+	}
+
+	const response = await fetch(url, fetchOptions)
+	const raw = response.headers.get('content-type')?.includes('application/json')
+		? await response.json()
+		: await response.text()
+	if (!response.ok) {
+		return JSON.stringify({
+			success: false,
+			status: response.status,
+			error: typeof raw === 'string' ? raw : JSON.stringify(raw),
+			// 4xx usually means wrong arguments — echo the schema so the model can
+			// self-correct in the next call without a separate schema-fetch tool.
+			...(response.status >= 400 && response.status < 500
+				? { schema: endpointSchemaHelp(endpoint) }
+				: {})
+		})
+	}
+	const result = JSON.stringify({ success: true, data: raw })
+	if (result.length <= MAX_RESULT_CHARS) return result
+	return JSON.stringify({
+		success: true,
+		truncated: true,
+		data: (typeof raw === 'string' ? raw : JSON.stringify(raw)).slice(0, MAX_RESULT_CHARS),
+		note: `Result truncated to ${MAX_RESULT_CHARS} characters. Use filter or pagination parameters to narrow it.`
+	})
+}
+
+const searchApiEndpointsSchema = z.object({
+	query: z
+		.string()
+		.describe(
+			'Keywords matched against endpoint names, paths, and descriptions (e.g. "workers", "queue", "run flow"). Jobs are called "runs" in the UI.'
+		)
+})
+
+const callApiGetSchema = z.object({
+	name: z.string().describe('Endpoint name as returned by search_api_endpoints'),
+	params: z
+		.record(z.string(), z.any())
+		.optional()
+		.describe(
+			'Path and query parameter values, keyed by parameter name. The workspace parameter is filled automatically.'
+		)
+})
+
+const callApiEndpointSchema = z.object({
+	name: z.string().describe('Endpoint name as returned by search_api_endpoints'),
+	params: z
+		.record(z.string(), z.any())
+		.optional()
+		.describe(
+			'Path and query parameter values, keyed by parameter name. The workspace parameter is filled automatically.'
+		),
+	body: z
+		.record(z.string(), z.any())
+		.optional()
+		.describe('JSON request body, when the endpoint takes one')
+})
+
+export const apiCatalogTools: Tool<{}>[] = [
+	{
+		def: createToolDef(
+			searchApiEndpointsSchema,
+			'search_api_endpoints',
+			'Search the Windmill REST API endpoint catalog for operations no dedicated tool covers (workers, queue state, job details, running deployed items, deletions, ...). Returns endpoint names to pass to call_api_get or call_api_endpoint.'
+		),
+		fn: async ({ args, workspace, toolId, toolCallbacks }) => {
+			const parsed = searchApiEndpointsSchema.parse(args)
+			toolCallbacks.setToolStatus(toolId, { content: 'Searching API endpoints...' })
+			const catalog = await loadCatalog(workspace)
+			const queryTokens = tokenize(parsed.query)
+			const available = catalog.filter((e) => !COVERED_ENDPOINTS[e.name])
+			const scored = available
+				.map((endpoint) => ({ endpoint, score: scoreEndpoint(endpoint, queryTokens) }))
+				.filter((s) => s.score > 0)
+				.sort((a, b) => b.score - a.score || a.endpoint.name.localeCompare(b.endpoint.name))
+			const coveredHits = catalog
+				.filter((e) => COVERED_ENDPOINTS[e.name] && scoreEndpoint(e, queryTokens) > 0)
+				.map((e) => `${e.name} → use ${COVERED_ENDPOINTS[e.name]}`)
+
+			if (scored.length === 0) {
+				const categories = [...new Set(available.map((e) => pathSegments(e.path)[0]))].sort()
+				const result = JSON.stringify(
+					{
+						matches: [],
+						hint: `No endpoint matched. Available endpoint categories: ${categories.join(', ')}. Retry with different keywords, or use a dedicated tool if one covers the need.`,
+						...(coveredHits.length > 0 ? { covered_by_dedicated_tools: coveredHits } : {})
+					},
+					null,
+					2
+				)
+				toolCallbacks.setToolStatus(toolId, { content: 'No matching API endpoint', result })
+				return result
+			}
+			const top = scored.slice(0, MAX_SEARCH_RESULTS)
+			const result = JSON.stringify(
+				{
+					matches: top.map((s) => summarizeEndpoint(s.endpoint)),
+					...(scored.length > top.length
+						? {
+								note: `${scored.length - top.length} more match(es) — refine the query to see them.`
+							}
+						: {}),
+					...(coveredHits.length > 0 ? { covered_by_dedicated_tools: coveredHits } : {})
+				},
+				null,
+				2
+			)
+			toolCallbacks.setToolStatus(toolId, {
+				content: `Found ${top.length} API endpoint(s) for "${parsed.query}"`,
+				result
+			})
+			return result
+		}
+	},
+	{
+		def: createToolDef(
+			callApiGetSchema,
+			'call_api_get',
+			'Call a read-only GET endpoint from the API catalog by name. Use search_api_endpoints first to find the endpoint name; a failed call returns the parameter schema.'
+		),
+		showDetails: true,
+		fn: async ({ args, workspace, toolId, toolCallbacks }) => {
+			const parsed = callApiGetSchema.parse(args)
+			const resolved = await resolveEndpoint(workspace, parsed.name)
+			if ('error' in resolved) {
+				toolCallbacks.setToolStatus(toolId, { content: resolved.error, error: resolved.error })
+				return JSON.stringify({ success: false, error: resolved.error })
+			}
+			if (resolved.endpoint.method.toUpperCase() !== 'GET') {
+				const error = `"${parsed.name}" is a ${resolved.endpoint.method.toUpperCase()} endpoint — use call_api_endpoint for mutating calls.`
+				toolCallbacks.setToolStatus(toolId, { content: error, error })
+				return JSON.stringify({ success: false, error })
+			}
+			toolCallbacks.setToolStatus(toolId, { content: `Calling ${parsed.name}...` })
+			const result = await executeEndpoint(resolved.endpoint, workspace, parsed.params ?? {})
+			const ok = JSON.parse(result).success === true
+			toolCallbacks.setToolStatus(toolId, {
+				content: ok ? `Called ${parsed.name}` : `Call to ${parsed.name} failed`,
+				result,
+				...(ok ? {} : { error: `Call to ${parsed.name} failed` })
+			})
+			return result
+		}
+	},
+	{
+		def: createToolDef(
+			callApiEndpointSchema,
+			'call_api_endpoint',
+			'Call a mutating (POST/PUT/PATCH/DELETE) endpoint from the API catalog by name; the user is asked to confirm. Use search_api_endpoints first to find the endpoint name; a failed call returns the parameter schema.'
+		),
+		requiresConfirmation: true,
+		confirmationMessage: (args) => `Call API endpoint ${args?.name ?? ''}`,
+		showDetails: true,
+		fn: async ({ args, workspace, toolId, toolCallbacks }) => {
+			const parsed = callApiEndpointSchema.parse(args)
+			const resolved = await resolveEndpoint(workspace, parsed.name)
+			if ('error' in resolved) {
+				toolCallbacks.setToolStatus(toolId, { content: resolved.error, error: resolved.error })
+				return JSON.stringify({ success: false, error: resolved.error })
+			}
+			if (resolved.endpoint.method.toUpperCase() === 'GET') {
+				const error = `"${parsed.name}" is a GET endpoint — use call_api_get (no confirmation needed).`
+				toolCallbacks.setToolStatus(toolId, { content: error, error })
+				return JSON.stringify({ success: false, error })
+			}
+			toolCallbacks.setToolStatus(toolId, { content: `Calling ${parsed.name}...` })
+			const result = await executeEndpoint(
+				resolved.endpoint,
+				workspace,
+				parsed.params ?? {},
+				parsed.body
+			)
+			const ok = JSON.parse(result).success === true
+			toolCallbacks.setToolStatus(toolId, {
+				content: ok ? `Called ${parsed.name}` : `Call to ${parsed.name} failed`,
+				result,
+				...(ok ? {} : { error: `Call to ${parsed.name} failed` })
+			})
+			return result
+		}
+	}
+]
diff --git a/frontend/src/lib/components/copilot/chat/global/core.ts b/frontend/src/lib/components/copilot/chat/global/core.ts
index 495d0637d2..28c594a1e6 100644
--- a/frontend/src/lib/components/copilot/chat/global/core.ts
+++ b/frontend/src/lib/components/copilot/chat/global/core.ts
@@ -152,6 +152,7 @@ import {
 	setEphemeralSecretVariableDraftValue,
 	type DraftPersistResult
 } from './userDraftAdapter'
+import { apiCatalogTools } from './apiCatalogTools'
 import { isSessionPipelinesEnabled, SESSION_PIPELINES_GATED_MESSAGE } from './pipelineGate'
 
 const ITEM_TYPES = [
@@ -936,6 +937,7 @@ ${pipelineBullet}
 - After creating or editing a script or flow draft, run test_run_script, test_run_flow, or test_run_step with representative args before reporting that it works. These tools prefer drafts, so testing does not require deployment.
 - Use list_runs to find recent runs (optionally filtered by path, creator, label, or status), then get_job_logs with a returned id to inspect a specific run's logs — without starting a new test run.
 - Use open_page to show a workspace page with filters applied — Runs, Schedules, Variables, Resources, Assets, Audit logs, or Workspace settings on a specific tab (e.g. "open the failed runs of f/foo/bar", "open the schedule for X", "open the git sync settings"). Only the pages listed for this user in the tool are available; don't offer pages that aren't listed. Don't use it as a substitute for list_runs when you just need the data yourself.
+- For a Windmill operation no other tool covers (workers, queue state, a run's result or args, running deployed items, ...), use search_api_endpoints to find a REST endpoint, then call_api_get for reads or call_api_endpoint for mutations (the user is asked to confirm those). Always prefer a dedicated tool when one exists; endpoints for authoring or deleting scripts, flows, apps, schedules, resources, or variables are not available through the API catalog tools — use the draft tools and delete_workspace_item instead.
 - When a required decision is ambiguous, use askUserQuestion with two to ten clear proposed answer strings instead of guessing. The user can also type a custom answer when none of the proposed answers fit. Set multiSelect: true only when the answers can genuinely co-apply and the user may pick several (not mutually exclusive).
 - When the user asks you to remember a lasting preference, always/never do something, or change/stop a behavior going forward, call update_user_instructions to persist it. It edits only the USER INSTRUCTIONS block (not WORKSPACE INSTRUCTIONS). Keep each instruction concise; do not use it for one-off requests scoped to the current task.
 - Keep context targeted.${
@@ -2994,7 +2996,10 @@ export const globalTools: Tool<{}>[] = [
 	// Workspace-scoped datatable tools (unrestricted: no whitelist, no creation policy)
 	...getDatatableTools(),
 	// Read-only tools over files the user attached to the conversation
-	...fileTools
+	...fileTools,
+	// Search + call access to the backend API endpoint catalog, for operations
+	// no dedicated tool covers
+	...apiCatalogTools
 ]
 
 // Tools that only make sense inside an AI session (they drive the session's

From 1abfe49f7e4a1dd667462d5be289e02befc0ee03 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Mon, 20 Jul 2026 12:33:14 +0200
Subject: [PATCH 059/171] stop the app editor crashing on a grid-less draft
 (#10203)

* fix(apps): default a missing grid so the app preview does not crash

* fix(apps): migrate the adopted draft so the editor matches the viewer

* docs: tighten grid-normalization comments to durable constraints

* test: drop the migrateApp grid-default test
---
 .../lib/components/apps/editor/AppEditor.svelte | 10 +++++++++-
 frontend/src/lib/components/apps/migrateApp.ts  | 17 +++++++++++++----
 2 files changed, 22 insertions(+), 5 deletions(-)

diff --git a/frontend/src/lib/components/apps/editor/AppEditor.svelte b/frontend/src/lib/components/apps/editor/AppEditor.svelte
index 64cc94f551..8ef4ffbf95 100644
--- a/frontend/src/lib/components/apps/editor/AppEditor.svelte
+++ b/frontend/src/lib/components/apps/editor/AppEditor.svelte
@@ -127,7 +127,15 @@
 	if (appDraftHandle) UserDraft.stopSync('app', appDraftPath)
 	// Prefer a prior-session autosave over the prop (the route seeds an empty
 	// template on `new_draft=true`; it calls `UserDraft.remove` to force a reset).
-	const stateApp = $state(untrack(() => appDraftHandle?.draft ?? app))
+	// A draft is a stored value that can predate any schema migration, so whichever
+	// value is adopted needs the same normalization as the prop above.
+	const stateApp = $state(
+		untrack(() => {
+			const adopted = appDraftHandle?.draft ?? app
+			migrateApp(adopted)
+			return adopted
+		})
+	)
 	const appStore = writable<App>(stateApp)
 	// Mirror `stateApp` mutations into the autosave cell. The first mirror is the
 	// seed — `acquireEntry`'s `skipNextWrite` swallows it; later writes POST.
diff --git a/frontend/src/lib/components/apps/migrateApp.ts b/frontend/src/lib/components/apps/migrateApp.ts
index 7e6d4f12cb..323d020d60 100644
--- a/frontend/src/lib/components/apps/migrateApp.ts
+++ b/frontend/src/lib/components/apps/migrateApp.ts
@@ -4,10 +4,11 @@ import { allItems } from './editor/appUtilsCore'
 
 /**
  * Normalize an `App` in place to the current schema: default `hiddenInlineScripts`
- * type, migrate the legacy `doNotRecomputeOnInputChanged` flag, and default
- * `fullHeight` on every grid item. Lives in its own light module (no app-editor
- * component imports) so non-editor callers — e.g. the localStorage→DB draft
- * migration — can reuse it without pulling the whole `apps/utils` graph.
+ * type, migrate the legacy `doNotRecomputeOnInputChanged` flag, default a missing
+ * `grid`, and default `fullHeight` on every grid item. Lives in its own light
+ * module (no app-editor component imports) so non-editor callers, e.g. the
+ * localStorage→DB draft migration, can reuse it without pulling the whole
+ * `apps/utils` graph.
  */
 export function migrateApp(app: App) {
 	;(app?.hiddenInlineScripts ?? []).forEach((x) => {
@@ -22,6 +23,14 @@ export function migrateApp(app: App) {
 		}
 	})
 
+	// A stored app value can have no `grid` at all: a persisted draft row is the
+	// confirmed case, and the editor renders a draft in place of the deployed
+	// value. The grid components dereference it unguarded, so normalize it here,
+	// the one hook every load path runs through.
+	if (!Array.isArray(app.grid)) {
+		app.grid = []
+	}
+
 	allItems(app.grid, app.subgrids).forEach((x) => {
 		gridColumns.forEach((column: number) => {
 			if (x?.[column]?.fullHeight === undefined) {

From 71f2d47cb4ff331cbcc7843bf0704ddb63cb77db Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Mon, 20 Jul 2026 12:33:40 +0200
Subject: [PATCH 060/171] feat: cap queued jobs per concurrency key on cloud
 (#10197)

* feat: cap queued jobs per concurrency key on cloud

* fix: close preprocessed-flow bypass and bound concurrency cap scan

* fix: only cap concurrency keys with an active concurrent_limit

* chore: only load concurrency key cap setting when cloud hosted

* fix: reject queued-job import on cloud
---
 ...1f7f387f5055c47f493271d26731336257384.json |  10 +-
 ...b8babd50b1092d4ad70e022431bdcf32e378f.json |  14 ++
 ...a3e10d8d524fbaaa8eddf74f12a906b3c8306.json |  16 ++
 ...3f8e3cddfbaf598536f1753f0824f84604826.json |  12 ++
 ...153c43903f929ae5d62fbba12610f89c36d55.json |   2 +-
 ...2023ecc0b3122501b72ec7f825966419759ac.json |  23 +++
 ...82f9afac8b6db79668cbdb188719c5a5de6da.json |  15 ++
 ...a72e61719fae68aa4b42730f9076f3bd97441.json |   2 +-
 backend/src/main.rs                           |  50 ++++---
 backend/src/monitor.rs                        |  58 +++++++-
 backend/windmill-api-jobs/src/jobs_export.rs  |  10 ++
 .../windmill-common/src/global_settings.rs    |   5 +
 backend/windmill-common/src/worker.rs         |  10 ++
 backend/windmill-queue/src/jobs.rs            | 139 +++++++++++++++++-
 .../tests/concurrency_key_queue_depth_test.rs | 105 +++++++++++++
 backend/windmill-worker/src/worker_flow.rs    |   8 +-
 .../src/lib/components/instanceSettings.ts    |  12 ++
 17 files changed, 446 insertions(+), 45 deletions(-)
 create mode 100644 backend/.sqlx/query-0bd853be57b43a7820cc1d73d92b8babd50b1092d4ad70e022431bdcf32e378f.json
 create mode 100644 backend/.sqlx/query-20ae664da5ebd70a6d37609f6b9a3e10d8d524fbaaa8eddf74f12a906b3c8306.json
 create mode 100644 backend/.sqlx/query-521367aaea7beefe4ff9cdb66273f8e3cddfbaf598536f1753f0824f84604826.json
 create mode 100644 backend/.sqlx/query-694d787e06b5ef9fbb5ca1315652023ecc0b3122501b72ec7f825966419759ac.json
 create mode 100644 backend/.sqlx/query-7ef0e3f0fdbda1ec514a621c73782f9afac8b6db79668cbdb188719c5a5de6da.json
 create mode 100644 backend/windmill-queue/tests/concurrency_key_queue_depth_test.rs

diff --git a/backend/.sqlx/query-07168aaf14cb6beff0ad4274b441f7f387f5055c47f493271d26731336257384.json b/backend/.sqlx/query-07168aaf14cb6beff0ad4274b441f7f387f5055c47f493271d26731336257384.json
index d29a18c691..e7ed0aee65 100644
--- a/backend/.sqlx/query-07168aaf14cb6beff0ad4274b441f7f387f5055c47f493271d26731336257384.json
+++ b/backend/.sqlx/query-07168aaf14cb6beff0ad4274b441f7f387f5055c47f493271d26731336257384.json
@@ -46,11 +46,11 @@
       ]
     },
     "nullable": [
-      true,
-      true,
-      true,
-      true,
-      true,
+      false,
+      false,
+      false,
+      false,
+      false,
       true,
       true
     ]
diff --git a/backend/.sqlx/query-0bd853be57b43a7820cc1d73d92b8babd50b1092d4ad70e022431bdcf32e378f.json b/backend/.sqlx/query-0bd853be57b43a7820cc1d73d92b8babd50b1092d4ad70e022431bdcf32e378f.json
new file mode 100644
index 0000000000..f0e1c853d8
--- /dev/null
+++ b/backend/.sqlx/query-0bd853be57b43a7820cc1d73d92b8babd50b1092d4ad70e022431bdcf32e378f.json
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO v2_job (id, workspace_id, tag) VALUES ($1, 'test-workspace', 'other')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Uuid"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "0bd853be57b43a7820cc1d73d92b8babd50b1092d4ad70e022431bdcf32e378f"
+}
diff --git a/backend/.sqlx/query-20ae664da5ebd70a6d37609f6b9a3e10d8d524fbaaa8eddf74f12a906b3c8306.json b/backend/.sqlx/query-20ae664da5ebd70a6d37609f6b9a3e10d8d524fbaaa8eddf74f12a906b3c8306.json
new file mode 100644
index 0000000000..04e663f7c3
--- /dev/null
+++ b/backend/.sqlx/query-20ae664da5ebd70a6d37609f6b9a3e10d8d524fbaaa8eddf74f12a906b3c8306.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO v2_job_queue (id, workspace_id, scheduled_for, tag, running)\n             VALUES ($1, 'test-workspace', now() + ($2::bigint::text || ' s')::interval, 'other', $3)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Int8",
+        "Bool"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "20ae664da5ebd70a6d37609f6b9a3e10d8d524fbaaa8eddf74f12a906b3c8306"
+}
diff --git a/backend/.sqlx/query-521367aaea7beefe4ff9cdb66273f8e3cddfbaf598536f1753f0824f84604826.json b/backend/.sqlx/query-521367aaea7beefe4ff9cdb66273f8e3cddfbaf598536f1753f0824f84604826.json
new file mode 100644
index 0000000000..9acef34c47
--- /dev/null
+++ b/backend/.sqlx/query-521367aaea7beefe4ff9cdb66273f8e3cddfbaf598536f1753f0824f84604826.json
@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM v2_job_queue",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "521367aaea7beefe4ff9cdb66273f8e3cddfbaf598536f1753f0824f84604826"
+}
diff --git a/backend/.sqlx/query-5a219a2532517869578c4504ff3153c43903f929ae5d62fbba12610f89c36d55.json b/backend/.sqlx/query-5a219a2532517869578c4504ff3153c43903f929ae5d62fbba12610f89c36d55.json
index 713ccb9dd3..36ddb8ab9f 100644
--- a/backend/.sqlx/query-5a219a2532517869578c4504ff3153c43903f929ae5d62fbba12610f89c36d55.json
+++ b/backend/.sqlx/query-5a219a2532517869578c4504ff3153c43903f929ae5d62fbba12610f89c36d55.json
@@ -15,7 +15,7 @@
       ]
     },
     "nullable": [
-      null
+      true
     ]
   },
   "hash": "5a219a2532517869578c4504ff3153c43903f929ae5d62fbba12610f89c36d55"
diff --git a/backend/.sqlx/query-694d787e06b5ef9fbb5ca1315652023ecc0b3122501b72ec7f825966419759ac.json b/backend/.sqlx/query-694d787e06b5ef9fbb5ca1315652023ecc0b3122501b72ec7f825966419759ac.json
new file mode 100644
index 0000000000..5b69718bfd
--- /dev/null
+++ b/backend/.sqlx/query-694d787e06b5ef9fbb5ca1315652023ecc0b3122501b72ec7f825966419759ac.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT count(*) FROM (\n            SELECT ck.job_id FROM concurrency_key ck\n            WHERE ck.key = $1 AND ck.ended_at IS NULL\n            LIMIT $2\n        ) s WHERE EXISTS (\n            SELECT 1 FROM v2_job_queue q WHERE q.id = s.job_id AND q.running = false\n        )",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "count",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Int8"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "694d787e06b5ef9fbb5ca1315652023ecc0b3122501b72ec7f825966419759ac"
+}
diff --git a/backend/.sqlx/query-7ef0e3f0fdbda1ec514a621c73782f9afac8b6db79668cbdb188719c5a5de6da.json b/backend/.sqlx/query-7ef0e3f0fdbda1ec514a621c73782f9afac8b6db79668cbdb188719c5a5de6da.json
new file mode 100644
index 0000000000..fd30017ca3
--- /dev/null
+++ b/backend/.sqlx/query-7ef0e3f0fdbda1ec514a621c73782f9afac8b6db79668cbdb188719c5a5de6da.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO concurrency_key (key, job_id) VALUES ($1, $2)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Uuid"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "7ef0e3f0fdbda1ec514a621c73782f9afac8b6db79668cbdb188719c5a5de6da"
+}
diff --git a/backend/.sqlx/query-fc4583d1570f3a2a428bb28390ca72e61719fae68aa4b42730f9076f3bd97441.json b/backend/.sqlx/query-fc4583d1570f3a2a428bb28390ca72e61719fae68aa4b42730f9076f3bd97441.json
index eb320264bc..484dd23e2a 100644
--- a/backend/.sqlx/query-fc4583d1570f3a2a428bb28390ca72e61719fae68aa4b42730f9076f3bd97441.json
+++ b/backend/.sqlx/query-fc4583d1570f3a2a428bb28390ca72e61719fae68aa4b42730f9076f3bd97441.json
@@ -21,7 +21,7 @@
       ]
     },
     "nullable": [
-      true,
+      null,
       null
     ]
   },
diff --git a/backend/src/main.rs b/backend/src/main.rs
index 43502a1980..2bc536200e 100644
--- a/backend/src/main.rs
+++ b/backend/src/main.rs
@@ -40,14 +40,14 @@ use windmill_common::{
     global_settings::{
         AI_CONFIG_SETTING, APP_WORKSPACED_ROUTE_SETTING, AUDIT_LOG_RETENTION_DAYS_SETTING,
         BASE_URL_SETTING, BUNFIG_INSTALL_SCOPES_SETTING, BUN_INSTALL_MIN_RELEASE_AGE_SETTING,
-        CRITICAL_ALERTS_ON_DB_OVERSIZE_SETTING, CRITICAL_ALERTS_ON_TOKEN_EXPIRY_SETTING,
-        CRITICAL_ALERT_MUTE_UI_SETTING, CRITICAL_ERROR_CHANNELS_SETTING, CUSTOM_TAGS_SETTING,
-        DEFAULT_TAGS_PER_WORKSPACE_SETTING, DEFAULT_TAGS_WORKSPACES_SETTING,
-        DISABLE_PASSWORD_LOGIN_SETTING, EMAIL_DOMAIN_SETTING, ENV_SETTINGS,
-        EXPOSE_DEBUG_METRICS_SETTING, EXPOSE_METRICS_SETTING, EXTRA_PIP_INDEX_URL_SETTING,
-        FORK_WORKSPACE_TAG_APPEND_FORK_SUFFIX_SETTING, HTTP_ROUTE_WORKSPACED_ROUTE_SETTING,
-        HUB_API_SECRET_SETTING, HUB_BASE_URL_SETTING, INDEXER_SETTING,
-        INSTANCE_EVENTS_WEBHOOK_SETTING, INSTANCE_PYTHON_VERSION_SETTING,
+        CONCURRENCY_KEY_MAX_QUEUED_SETTING, CRITICAL_ALERTS_ON_DB_OVERSIZE_SETTING,
+        CRITICAL_ALERTS_ON_TOKEN_EXPIRY_SETTING, CRITICAL_ALERT_MUTE_UI_SETTING,
+        CRITICAL_ERROR_CHANNELS_SETTING, CUSTOM_TAGS_SETTING, DEFAULT_TAGS_PER_WORKSPACE_SETTING,
+        DEFAULT_TAGS_WORKSPACES_SETTING, DISABLE_PASSWORD_LOGIN_SETTING, EMAIL_DOMAIN_SETTING,
+        ENV_SETTINGS, EXPOSE_DEBUG_METRICS_SETTING, EXPOSE_METRICS_SETTING,
+        EXTRA_PIP_INDEX_URL_SETTING, FORK_WORKSPACE_TAG_APPEND_FORK_SUFFIX_SETTING,
+        HTTP_ROUTE_WORKSPACED_ROUTE_SETTING, HUB_API_SECRET_SETTING, HUB_BASE_URL_SETTING,
+        INDEXER_SETTING, INSTANCE_EVENTS_WEBHOOK_SETTING, INSTANCE_PYTHON_VERSION_SETTING,
         JOB_DEFAULT_TIMEOUT_SECS_SETTING, JOB_ISOLATION_SETTING, JWT_SECRET_SETTING,
         KEEP_JOB_DIR_SETTING, LICENSE_KEY_SETTING, MAVEN_REPOS_SETTING, MAVEN_SETTINGS_XML_SETTING,
         MONITOR_LOGS_ON_OBJECT_STORE_SETTING, NO_DEFAULT_MAVEN_SETTING,
@@ -122,20 +122,21 @@ use windmill_worker::{
 };
 
 use crate::monitor::{
-    initial_load, load_disable_password_login, load_fork_workspace_tag_append_fork_suffix,
-    load_keep_job_dir, load_metrics_debug_enabled, load_preview_tags_override,
-    load_require_preexisting_user, load_retention_period_overrides, load_tag_per_workspace_enabled,
-    load_tag_per_workspace_workspaces, load_workspace_fairness_duration_secs,
-    load_workspace_fairness_enabled, load_workspace_fairness_max_percent,
-    load_workspace_fairness_min_total, monitor_db, reload_app_workspaced_route_setting,
-    reload_audit_log_retention_days_setting, reload_base_url_setting,
-    reload_bun_install_min_release_age_setting, reload_bunfig_install_scopes_setting,
-    reload_critical_alert_mute_ui_setting, reload_critical_alerts_on_token_expiry_setting,
-    reload_critical_error_channels_setting, reload_extra_pip_index_url_setting,
-    reload_http_route_workspaced_route_setting, reload_hub_api_secret_setting,
-    reload_hub_base_url_setting, reload_instance_events_webhook_setting,
-    reload_job_default_timeout_setting, reload_job_isolation_setting, reload_jwt_secret_setting,
-    reload_license_key, reload_npm_config_registry_setting, reload_nsjail_tmp_backing_setting,
+    initial_load, load_concurrency_key_max_queued, load_disable_password_login,
+    load_fork_workspace_tag_append_fork_suffix, load_keep_job_dir, load_metrics_debug_enabled,
+    load_preview_tags_override, load_require_preexisting_user, load_retention_period_overrides,
+    load_tag_per_workspace_enabled, load_tag_per_workspace_workspaces,
+    load_workspace_fairness_duration_secs, load_workspace_fairness_enabled,
+    load_workspace_fairness_max_percent, load_workspace_fairness_min_total, monitor_db,
+    reload_app_workspaced_route_setting, reload_audit_log_retention_days_setting,
+    reload_base_url_setting, reload_bun_install_min_release_age_setting,
+    reload_bunfig_install_scopes_setting, reload_critical_alert_mute_ui_setting,
+    reload_critical_alerts_on_token_expiry_setting, reload_critical_error_channels_setting,
+    reload_extra_pip_index_url_setting, reload_http_route_workspaced_route_setting,
+    reload_hub_api_secret_setting, reload_hub_base_url_setting,
+    reload_instance_events_webhook_setting, reload_job_default_timeout_setting,
+    reload_job_isolation_setting, reload_jwt_secret_setting, reload_license_key,
+    reload_npm_config_registry_setting, reload_nsjail_tmp_backing_setting,
     reload_nsjail_tmpfs_size_setting, reload_otel_tracing_proxy_setting,
     reload_pip_index_url_setting, reload_retention_period_setting,
     reload_sandbox_image_cache_max_setting, reload_sandbox_image_default_registry_setting,
@@ -1879,6 +1880,11 @@ async fn process_notify_event(
                         tracing::error!("Error loading workspace fairness min total: {e:#}");
                     }
                 }
+                CONCURRENCY_KEY_MAX_QUEUED_SETTING => {
+                    if let Err(e) = load_concurrency_key_max_queued(db).await {
+                        tracing::error!("Error loading concurrency key max queued: {e:#}");
+                    }
+                }
                 SMTP_SETTING => {
                     reload_smtp_config(db).await;
                 }
diff --git a/backend/src/monitor.rs b/backend/src/monitor.rs
index 35d057ab12..58af60c525 100644
--- a/backend/src/monitor.rs
+++ b/backend/src/monitor.rs
@@ -53,11 +53,12 @@ use windmill_common::{
     flow_status::{FlowStatus, FlowStatusModule},
     global_settings::{
         AUDIT_LOG_RETENTION_DAYS_SETTING, BASE_URL_SETTING, BUNFIG_INSTALL_SCOPES_SETTING,
-        BUN_INSTALL_MIN_RELEASE_AGE_SETTING, CRITICAL_ALERTS_ON_DB_OVERSIZE_SETTING,
-        CRITICAL_ALERTS_ON_TOKEN_EXPIRY_SETTING, CRITICAL_ALERT_MUTE_UI_SETTING,
-        CRITICAL_ERROR_CHANNELS_SETTING, DEFAULT_TAGS_PER_WORKSPACE_SETTING,
-        DEFAULT_TAGS_WORKSPACES_SETTING, DISABLE_PASSWORD_LOGIN, DISABLE_PASSWORD_LOGIN_SETTING,
-        EXPOSE_DEBUG_METRICS_SETTING, EXPOSE_METRICS_SETTING, EXTRA_PIP_INDEX_URL_SETTING,
+        BUN_INSTALL_MIN_RELEASE_AGE_SETTING, CONCURRENCY_KEY_MAX_QUEUED_SETTING,
+        CRITICAL_ALERTS_ON_DB_OVERSIZE_SETTING, CRITICAL_ALERTS_ON_TOKEN_EXPIRY_SETTING,
+        CRITICAL_ALERT_MUTE_UI_SETTING, CRITICAL_ERROR_CHANNELS_SETTING,
+        DEFAULT_TAGS_PER_WORKSPACE_SETTING, DEFAULT_TAGS_WORKSPACES_SETTING,
+        DISABLE_PASSWORD_LOGIN, DISABLE_PASSWORD_LOGIN_SETTING, EXPOSE_DEBUG_METRICS_SETTING,
+        EXPOSE_METRICS_SETTING, EXTRA_PIP_INDEX_URL_SETTING,
         FORK_WORKSPACE_TAG_APPEND_FORK_SUFFIX_SETTING, HUB_API_SECRET_SETTING,
         HUB_BASE_URL_SETTING, INSTANCE_PYTHON_VERSION_SETTING, JOB_DEFAULT_TIMEOUT_SECS_SETTING,
         JOB_ISOLATION_SETTING, JWT_SECRET_SETTING, KEEP_JOB_DIR_SETTING, LICENSE_KEY_SETTING,
@@ -86,7 +87,8 @@ use windmill_common::{
         load_env_vars, load_init_bash_from_env, load_periodic_bash_script_from_env,
         load_periodic_bash_script_interval_from_env, load_whitelist_env_vars_from_env,
         load_worker_config, reload_custom_tags_setting, store_pull_query,
-        store_suspended_pull_query, Connection, WorkerConfig, DEFAULT_TAGS_PER_WORKSPACE,
+        store_suspended_pull_query, Connection, WorkerConfig, CLOUD_HOSTED,
+        CONCURRENCY_KEY_MAX_QUEUED, CONCURRENCY_KEY_MAX_QUEUED_DEFAULT, DEFAULT_TAGS_PER_WORKSPACE,
         DEFAULT_TAGS_WORKSPACES, FORK_WORKSPACE_TAG_APPEND_FORK_SUFFIX, INDEXER_CONFIG,
         PREVIEW_TAGS_OVERRIDE, SCRIPT_TOKEN_EXPIRY, SMTP_CONFIG, WINDMILL_DIR, WORKER_CONFIG,
         WORKER_GROUP, WORKSPACE_FAIRNESS_DURATION_SECS, WORKSPACE_FAIRNESS_ENABLED,
@@ -291,6 +293,13 @@ pub async fn initial_load(
         if let Err(e) = load_workspace_fairness_enabled(db).await {
             tracing::error!("Error loading workspace fairness enabled: {e:#}");
         }
+
+        // Only the cloud reads this cap, so don't spend a query loading it anywhere else.
+        if *CLOUD_HOSTED {
+            if let Err(e) = load_concurrency_key_max_queued(db).await {
+                tracing::error!("Error loading concurrency key max queued: {e:#}");
+            }
+        }
     }
 
     if server_mode {
@@ -610,6 +619,10 @@ const WORKSPACE_FAIRNESS_MAX_PERCENT_DEFAULT: u32 = 50;
 const WORKSPACE_FAIRNESS_DURATION_SECS_DEFAULT: u32 = 10;
 const WORKSPACE_FAIRNESS_MIN_TOTAL_DEFAULT: u32 = 4;
 
+/// The cap is used as a SQL `LIMIT`, so it must survive the `u32 -> i64` widening without
+/// becoming absurd; `u32::MAX` is already far beyond any queue depth worth allowing.
+const CONCURRENCY_KEY_MAX_QUEUED_MAX: u64 = u32::MAX as u64;
+
 pub async fn load_workspace_fairness_enabled(db: &DB) -> error::Result<()> {
     // Match the convention used by `load_preview_tags_override` /
     // `load_fork_workspace_tag_append_fork_suffix`: on transient DB errors, leave the in-memory
@@ -697,6 +710,39 @@ pub async fn load_workspace_fairness_min_total(db: &DB) -> error::Result<()> {
     Ok(())
 }
 
+pub async fn load_concurrency_key_max_queued(db: &DB) -> error::Result<()> {
+    // See `load_workspace_fairness_max_percent` for the Err / None / invalid policy.
+    match load_value_from_global_settings(db, CONCURRENCY_KEY_MAX_QUEUED_SETTING).await? {
+        Some(serde_json::Value::Number(n)) => {
+            // `0` is a meaningful value here (disable the cap), so unlike the fairness knobs
+            // the lower bound is 0 rather than 1.
+            let v = n
+                .as_u64()
+                .map(|u| u.min(CONCURRENCY_KEY_MAX_QUEUED_MAX) as u32)
+                .unwrap_or_else(|| {
+                    // Warn rather than silently defaulting: `-1` and `"0"` are plausible
+                    // attempts to disable the cap, and both would otherwise land on 10000.
+                    tracing::warn!(
+                        "{CONCURRENCY_KEY_MAX_QUEUED_SETTING}={n} is not a non-negative integer, \
+                         falling back to {CONCURRENCY_KEY_MAX_QUEUED_DEFAULT}. Set 0 to disable."
+                    );
+                    CONCURRENCY_KEY_MAX_QUEUED_DEFAULT
+                });
+            CONCURRENCY_KEY_MAX_QUEUED.store(v, Ordering::Relaxed);
+        }
+        other => {
+            if let Some(v) = other {
+                tracing::warn!(
+                    "{CONCURRENCY_KEY_MAX_QUEUED_SETTING}={v} is not a number, falling back to \
+                     {CONCURRENCY_KEY_MAX_QUEUED_DEFAULT}. Set 0 to disable."
+                );
+            }
+            CONCURRENCY_KEY_MAX_QUEUED.store(CONCURRENCY_KEY_MAX_QUEUED_DEFAULT, Ordering::Relaxed);
+        }
+    }
+    Ok(())
+}
+
 pub async fn load_fork_workspace_tag_append_fork_suffix(db: &DB) -> error::Result<()> {
     let value =
         load_value_from_global_settings(db, FORK_WORKSPACE_TAG_APPEND_FORK_SUFFIX_SETTING).await;
diff --git a/backend/windmill-api-jobs/src/jobs_export.rs b/backend/windmill-api-jobs/src/jobs_export.rs
index 0b188c0fa0..4f481fbd54 100644
--- a/backend/windmill-api-jobs/src/jobs_export.rs
+++ b/backend/windmill-api-jobs/src/jobs_export.rs
@@ -19,6 +19,7 @@ use windmill_common::{
     jobs::{is_safe_log_file_path, JobKind, JobStatus, JobTriggerKind},
     scripts::ScriptLang,
     utils::{paginate, paginate_without_limits, require_admin, Pagination},
+    worker::CLOUD_HOSTED,
 };
 
 use windmill_api_auth::ApiAuthed;
@@ -435,6 +436,15 @@ pub async fn import_queued_jobs(
 ) -> error::Result<String> {
     require_admin(authed.is_admin, &authed.username)?;
 
+    // Self-hosted migration/restore tool. It writes queue rows straight to the DB, bypassing the
+    // push path and every admission check that lives there, so it has no place on multi-tenant
+    // cloud where those checks are what keep one workspace from swamping the shared pool.
+    if *CLOUD_HOSTED {
+        return Err(error::Error::BadRequest(
+            "Importing queued jobs is not available on the cloud".to_string(),
+        ));
+    }
+
     let mut tx = user_db.begin(&authed).await?;
 
     for job in jobs {
diff --git a/backend/windmill-common/src/global_settings.rs b/backend/windmill-common/src/global_settings.rs
index 0ee326ce6b..bbe7dbb9b5 100644
--- a/backend/windmill-common/src/global_settings.rs
+++ b/backend/windmill-common/src/global_settings.rs
@@ -116,6 +116,11 @@ pub const WORKSPACE_FAIRNESS_MAX_PERCENT_SETTING: &str = "workspace_fairness_max
 pub const WORKSPACE_FAIRNESS_DURATION_SECS_SETTING: &str = "workspace_fairness_duration_secs";
 pub const WORKSPACE_FAIRNESS_MIN_TOTAL_SETTING: &str = "workspace_fairness_min_total_jobs";
 
+// Cloud-only ceiling on how many jobs may sit in the queue behind a single
+// concurrency key. `0` disables the cap. See `windmill-queue/src/jobs.rs`,
+// `check_concurrency_key_queue_cap`.
+pub const CONCURRENCY_KEY_MAX_QUEUED_SETTING: &str = "concurrency_key_max_queued_jobs";
+
 /// Global settings an agent worker (a remote worker connected over HTTP instead
 /// of to the database) must NEVER read through
 /// `GET /api/agent_workers/get_global_setting/{key}`. Every other key is served.
diff --git a/backend/windmill-common/src/worker.rs b/backend/windmill-common/src/worker.rs
index eb339b56f8..2c936ff0aa 100644
--- a/backend/windmill-common/src/worker.rs
+++ b/backend/windmill-common/src/worker.rs
@@ -210,6 +210,9 @@ impl SpecificTagType {
 pub const DEFAULT_CLOUD_TIMEOUT: u64 = 900;
 pub const DEFAULT_SELFHOSTED_TIMEOUT: u64 = 604800; // 7 days
 pub const MIN_PERIODIC_SCRIPT_INTERVAL_SECONDS: u64 = 60;
+/// Default for [`CONCURRENCY_KEY_MAX_QUEUED`]; also the value the setting loader restores when
+/// the setting is cleared or malformed.
+pub const CONCURRENCY_KEY_MAX_QUEUED_DEFAULT: u32 = 10_000;
 lazy_static::lazy_static! {
     pub static ref WORKER_GROUP: String = std::env::var("WORKER_GROUP").unwrap_or_else(|_| {
         #[cfg(not(feature = "enterprise"))]
@@ -337,6 +340,13 @@ lazy_static::lazy_static! {
     /// `should_admit_capped` is moot and "admit all" is the correct no-op.
     pub static ref WORKSPACE_FAIRNESS_ADMISSION_PPM: AtomicU32 = AtomicU32::new(10_000);
 
+    /// Cloud-only ceiling on the number of jobs queued behind a single concurrency key.
+    /// A concurrency-limited key drains at most `concurrent_limit` jobs per window, so a
+    /// producer pushing faster than that grows an unbounded backlog that no amount of
+    /// spare worker capacity can absorb. `0` disables the cap.
+    pub static ref CONCURRENCY_KEY_MAX_QUEUED: AtomicU32 =
+        AtomicU32::new(CONCURRENCY_KEY_MAX_QUEUED_DEFAULT);
+
 
     pub static ref SMTP_CONFIG: arc_swap::ArcSwap<Option<Smtp>> = arc_swap::ArcSwap::from_pointee(None);
     pub static ref INDEXER_CONFIG: arc_swap::ArcSwap<TantivyIndexerSettings> = arc_swap::ArcSwap::from_pointee(TantivyIndexerSettings::default());
diff --git a/backend/windmill-queue/src/jobs.rs b/backend/windmill-queue/src/jobs.rs
index 4ce45eb8c0..934b9b50b4 100644
--- a/backend/windmill-queue/src/jobs.rs
+++ b/backend/windmill-queue/src/jobs.rs
@@ -6281,14 +6281,23 @@ async fn push_inner<'c, 'd>(
         .unzip();
 
     if concurrency_settings.concurrent_limit.is_some() {
-        insert_concurrency_key(
+        let concurrency_key = resolve_concurrency_key(
             workspace_id,
             &args,
             &runnable_path,
             job_kind,
             concurrency_settings.concurrency_key.clone(),
+        );
+        #[cfg(feature = "cloud")]
+        if *CLOUD_HOSTED {
+            check_concurrency_key_queue_cap(&mut *tx, &concurrency_key).await?;
+        }
+        insert_resolved_concurrency_key(
+            &concurrency_key,
             &mut *tx,
             job_id,
+            &runnable_path,
+            workspace_id,
         )
         .await?;
     }
@@ -6617,16 +6626,14 @@ async fn push_inner<'c, 'd>(
     Ok((job_id, tx))
 }
 
-pub async fn insert_concurrency_key<'d, 'c>(
+fn resolve_concurrency_key<'d>(
     workspace_id: &str,
     args: &PushArgs<'d>,
     script_path: &Option<String>,
     job_kind: JobKind,
     custom_concurrency_key: Option<String>,
-    db: impl PgExecutor<'c>,
-    job_id: Uuid,
-) -> Result<(), Error> {
-    let concurrency_key = custom_concurrency_key
+) -> String {
+    custom_concurrency_key
         .map(|x| {
             let interpolated = interpolate_args(x.clone(), args, workspace_id);
             // In cloud mode, enforce workspace isolation by prefixing with workspace
@@ -6648,7 +6655,50 @@ pub async fn insert_concurrency_key<'d, 'c>(
             workspace_id,
             script_path.as_ref(),
             &job_kind,
-        ));
+        ))
+}
+
+/// Resolves the concurrency key, applies the cloud-only queue-depth cap, then registers the key.
+///
+/// `concurrent_limit: None` still registers the key but skips the cap: without a limit nothing
+/// serializes the key, so there is no backlog to bound. Callers register keys for tag
+/// interpolation alone, so the two are not interchangeable.
+///
+/// Takes a `Copy` executor because the cap runs a query before the insert on the same one. `push`
+/// cannot use this — it holds a `&mut Transaction` — so it performs the same three steps inline.
+pub async fn insert_concurrency_key_capped<'d, 'c, E: PgExecutor<'c> + Copy>(
+    workspace_id: &str,
+    args: &PushArgs<'d>,
+    script_path: &Option<String>,
+    job_kind: JobKind,
+    custom_concurrency_key: Option<String>,
+    concurrent_limit: Option<i32>,
+    db: E,
+    job_id: Uuid,
+) -> Result<(), Error> {
+    let concurrency_key = resolve_concurrency_key(
+        workspace_id,
+        args,
+        script_path,
+        job_kind,
+        custom_concurrency_key,
+    );
+    #[cfg(feature = "cloud")]
+    if *CLOUD_HOSTED && concurrent_limit.is_some() {
+        check_concurrency_key_queue_cap(db, &concurrency_key).await?;
+    }
+    #[cfg(not(feature = "cloud"))]
+    let _ = concurrent_limit;
+    insert_resolved_concurrency_key(&concurrency_key, db, job_id, script_path, workspace_id).await
+}
+
+async fn insert_resolved_concurrency_key<'c>(
+    concurrency_key: &str,
+    db: impl PgExecutor<'c>,
+    job_id: Uuid,
+    script_path: &Option<String>,
+    workspace_id: &str,
+) -> Result<(), Error> {
     sqlx::query!(
         "WITH inserted_concurrency_counter AS (
                 INSERT INTO concurrency_counter (concurrency_id, job_uuids)
@@ -6666,6 +6716,81 @@ pub async fn insert_concurrency_key<'d, 'c>(
     Ok(())
 }
 
+/// Counts jobs *waiting* behind `concurrency_key`, scanning at most `limit` rows.
+///
+/// Three constraints on the query below, each pinned by a test in
+/// `tests/concurrency_key_queue_depth_test.rs`:
+/// - Any `scheduled_for`: the limiter parks blocked jobs in the future, so a gated backlog is
+///   almost entirely future-dated and `scheduled_for <= now()` would never see it.
+/// - `running = false`: running jobs keep `ended_at` NULL, and counting them would charge a key
+///   for the concurrency it is licensed to use.
+/// - `LIMIT` inside the `EXISTS`, not outside: rows whose job left the queue without
+///   `add_completed_job` keep `ended_at` NULL forever (the retention sweep only matches
+///   `ended_at <= …`), so an outside `LIMIT` would let them be rescanned on every push.
+///
+/// Takes an already-resolved key and performs no authorization; `pub` only so the integration
+/// test can reach it. Never call it with a caller-supplied key — it would leak queue depth
+/// across workspaces.
+pub async fn concurrency_key_queue_depth<'c>(
+    db: impl PgExecutor<'c>,
+    concurrency_key: &str,
+    limit: i64,
+) -> Result<i64, Error> {
+    sqlx::query_scalar!(
+        "SELECT count(*) FROM (
+            SELECT ck.job_id FROM concurrency_key ck
+            WHERE ck.key = $1 AND ck.ended_at IS NULL
+            LIMIT $2
+        ) s WHERE EXISTS (
+            SELECT 1 FROM v2_job_queue q WHERE q.id = s.job_id AND q.running = false
+        )",
+        concurrency_key,
+        limit,
+    )
+    .fetch_one(db)
+    .warn_after_seconds(3)
+    .await
+    .map_err(|e| {
+        Error::internal_err(format!(
+            "Could not count queued jobs for concurrency_key={concurrency_key}: {e:#}"
+        ))
+    })
+    .map(|c| c.unwrap_or(0))
+}
+
+/// Rejects the push when `concurrency_key` already has `CONCURRENCY_KEY_MAX_QUEUED` jobs queued.
+///
+/// Caller must runtime-gate this on `*CLOUD_HOSTED`, and must call it from *every push path*
+/// that registers a concurrency key: a flow with a preprocessor is pushed with `concurrent_limit`
+/// cleared and only registers its key later from `worker_flow`, so gating `push` alone leaves
+/// trigger-driven flows uncapped.
+///
+/// `add_batch_jobs` writes keys directly and is deliberately exempt: it is superadmin-only, and a
+/// superadmin can set the cap to `0` anyway. `import_queued_jobs` is likewise exempt because it
+/// is rejected outright on cloud.
+#[cfg(feature = "cloud")]
+async fn check_concurrency_key_queue_cap<'c>(
+    db: impl PgExecutor<'c>,
+    concurrency_key: &str,
+) -> Result<(), Error> {
+    let cap = windmill_common::worker::CONCURRENCY_KEY_MAX_QUEUED
+        .load(std::sync::atomic::Ordering::Relaxed);
+    if cap == 0 {
+        return Ok(());
+    }
+    let cap = cap as i64;
+    let depth = concurrency_key_queue_depth(db, concurrency_key, cap).await?;
+    if depth >= cap {
+        return Err(Error::QuotaExceeded(format!(
+            "Too many jobs queued behind concurrency key '{concurrency_key}': at least {depth} \
+             jobs are already waiting and the limit is {cap}. Jobs sharing a concurrency key run \
+             at most `concurrent_limit` at a time, so this queue is growing faster than it can \
+             drain. Cancel the backlog, slow down the caller, or raise the concurrency limit."
+        )));
+    }
+    Ok(())
+}
+
 // pub async fn insert_debounce_key<'d, 'c>(
 //     workspace_id: &str,
 //     args: &PushArgs<'d>,
diff --git a/backend/windmill-queue/tests/concurrency_key_queue_depth_test.rs b/backend/windmill-queue/tests/concurrency_key_queue_depth_test.rs
new file mode 100644
index 0000000000..3689289bf4
--- /dev/null
+++ b/backend/windmill-queue/tests/concurrency_key_queue_depth_test.rs
@@ -0,0 +1,105 @@
+//! Regression guard for `concurrency_key_queue_depth`, which backs the cloud-only cap on how
+//! many jobs may queue behind a single concurrency key.
+//!
+//! Run with:
+//!   cargo test -p windmill-queue --test concurrency_key_queue_depth_test
+
+use sqlx::{Pool, Postgres};
+use uuid::Uuid;
+use windmill_queue::jobs::concurrency_key_queue_depth;
+
+/// Queues `count` jobs on `key`, all scheduled `offset_secs` from now.
+async fn seed_queued(db: &Pool<Postgres>, key: &str, count: usize, offset_secs: i64) {
+    seed(db, key, count, offset_secs, false).await
+}
+
+async fn seed(db: &Pool<Postgres>, key: &str, count: usize, offset_secs: i64, running: bool) {
+    for _ in 0..count {
+        let id = Uuid::new_v4();
+        sqlx::query!(
+            "INSERT INTO v2_job (id, workspace_id, tag) VALUES ($1, 'test-workspace', 'other')",
+            id,
+        )
+        .execute(db)
+        .await
+        .expect("seed v2_job");
+        sqlx::query!(
+            "INSERT INTO v2_job_queue (id, workspace_id, scheduled_for, tag, running)
+             VALUES ($1, 'test-workspace', now() + ($2::bigint::text || ' s')::interval, 'other', $3)",
+            id,
+            offset_secs,
+            running,
+        )
+        .execute(db)
+        .await
+        .expect("seed v2_job_queue");
+        sqlx::query!(
+            "INSERT INTO concurrency_key (key, job_id) VALUES ($1, $2)",
+            key,
+            id,
+        )
+        .execute(db)
+        .await
+        .expect("seed concurrency_key");
+    }
+}
+
+/// The property the cap depends on: jobs scheduled into the future count toward the depth.
+///
+/// The concurrency limiter re-queues a blocked job by pushing `scheduled_for` forward one full
+/// window at a time, so a backlog gated by a concurrency limit is almost entirely future-dated.
+/// A depth query narrowed to `scheduled_for <= now()` would report only the trickle the limiter
+/// has released and the cap would never fire on the runaway it exists to stop.
+#[sqlx::test(migrations = "../migrations")]
+async fn counts_future_scheduled_jobs(db: Pool<Postgres>) {
+    let key = "future-scheduled-count";
+    seed_queued(&db, key, 3, -10).await; // due now
+    seed_queued(&db, key, 7, 3600).await; // parked an hour out by the limiter
+
+    let depth = concurrency_key_queue_depth(&db, key, 1000)
+        .await
+        .expect("count depth");
+
+    assert_eq!(
+        depth, 10,
+        "depth must include future-scheduled jobs; counting only due jobs would report 3"
+    );
+}
+
+/// Running jobs are not backlog. They stay in `v2_job_queue` with `ended_at` still NULL, so
+/// counting them would charge a key for the concurrency it is licensed to use: a key whose
+/// `concurrent_limit` exceeds the cap would reject every push with nothing actually waiting.
+#[sqlx::test(migrations = "../migrations")]
+async fn ignores_running_jobs(db: Pool<Postgres>) {
+    let key = "running-not-backlog";
+    seed(&db, key, 6, -10, true).await; // executing right now
+    seed(&db, key, 2, 3600, false).await; // actually waiting
+
+    let depth = concurrency_key_queue_depth(&db, key, 1000)
+        .await
+        .expect("count depth");
+
+    assert_eq!(
+        depth, 2,
+        "only waiting jobs count; the 6 running ones must not"
+    );
+}
+
+/// A job that left the queue without going through `add_completed_job` leaves its
+/// `concurrency_key` row with `ended_at IS NULL` forever. Those must not count, otherwise a mass
+/// cancel or manual purge leaves the key permanently wedged above the cap with an empty queue.
+#[sqlx::test(migrations = "../migrations")]
+async fn ignores_rows_whose_job_left_the_queue(db: Pool<Postgres>) {
+    let key = "orphaned-rows";
+    seed_queued(&db, key, 4, 3600).await;
+    sqlx::query!("DELETE FROM v2_job_queue")
+        .execute(&db)
+        .await
+        .expect("purge queue");
+
+    let depth = concurrency_key_queue_depth(&db, key, 1000)
+        .await
+        .expect("count depth");
+
+    assert_eq!(depth, 0, "orphaned concurrency_key rows must not count");
+}
diff --git a/backend/windmill-worker/src/worker_flow.rs b/backend/windmill-worker/src/worker_flow.rs
index 21f4ce6925..f60fc94c0e 100644
--- a/backend/windmill-worker/src/worker_flow.rs
+++ b/backend/windmill-worker/src/worker_flow.rs
@@ -70,7 +70,7 @@ use windmill_common::{
 use windmill_queue::schedule::get_schedule_opt;
 use windmill_queue::{
     add_completed_job, add_completed_job_error, append_logs, get_mini_pulled_job,
-    insert_concurrency_key, interpolate_args,
+    insert_concurrency_key_capped, interpolate_args,
     report_error_to_workspace_handler_or_critical_side_channel, try_schedule_next_job, CanceledBy,
     FlowRunners, MiniCompletedJob, MiniPulledJob, PushArgs, PushIsolationLevel, SameWorkerPayload,
     WrappedError,
@@ -1552,12 +1552,13 @@ pub async fn update_flow_status_after_job_completion_internal(
             if concurrency_requires_args {
                 let args = PushArgs::from(fetched_args.as_ref().unwrap());
                 if let Some(ck) = concurrency_key {
-                    insert_concurrency_key(
+                    insert_concurrency_key_capped(
                         &flow_job.workspace_id,
                         &args,
                         &flow_job.runnable_path,
                         JobKind::Flow,
                         Some(ck),
+                        concurrent_limit,
                         db,
                         flow,
                     )
@@ -1567,12 +1568,13 @@ pub async fn update_flow_status_after_job_completion_internal(
                     tag = Some(interpolate_args(t, &args, &flow_job.workspace_id));
                 }
             } else if concurrent_limit.is_some() {
-                insert_concurrency_key(
+                insert_concurrency_key_capped(
                     &flow_job.workspace_id,
                     &PushArgs::from(&HashMap::new()),
                     &flow_job.runnable_path,
                     JobKind::Flow,
                     concurrency_key,
+                    concurrent_limit,
                     db,
                     flow,
                 )
diff --git a/frontend/src/lib/components/instanceSettings.ts b/frontend/src/lib/components/instanceSettings.ts
index 0c8ba77beb..b58eb329f7 100644
--- a/frontend/src/lib/components/instanceSettings.ts
+++ b/frontend/src/lib/components/instanceSettings.ts
@@ -426,6 +426,18 @@ export const settings: Record<string, Setting[]> = {
 			cloudonly: false,
 			ee_only: 'Workspace fairness is an Enterprise feature.',
 			hideInQuickSetup: true
+		},
+		{
+			label: 'Max jobs queued per concurrency key',
+			description:
+				'Rejects new jobs once this many are already queued behind one concurrency key. Jobs sharing a key run at most <em>concurrent limit</em> at a time regardless of spare worker capacity, so a caller pushing faster than the key drains grows a backlog no capacity can absorb. Scoped per key, so a runaway producer cannot block the rest of the workspace. Set 0 to disable. Default 10000.',
+			key: 'concurrency_key_max_queued_jobs',
+			fieldType: 'number',
+			placeholder: '10000',
+			storage: 'setting',
+			cloudonly: true,
+			ee_only: '',
+			hideInQuickSetup: true
 		}
 	],
 	'Object Storage': [

From 4f1d6360056f2edbb687f5ae79004168c96ea4aa Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Mon, 20 Jul 2026 13:10:26 +0200
Subject: [PATCH 061/171] fall back to createFlow when the update target does
 not exist (#10206)

FlowBuilder's deploy branches solely on the `newFlow` prop. When an embedder
mounts the builder with `newFlow` false for a flow that was never deployed,
Deploy issues `PUT /flows/update/{initialPath}` and the backend answers
`Flow not found at name <path>`, so the first deploy can never land.

Confirm against `GET /flows/exists/{path}` before taking the update branch,
and create instead when nothing is deployed there. The create path and the
full-page editor (where `newFlow` is derived from `no_deployed`) are
unchanged.

Fixes WIN-2206

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 frontend/src/lib/components/FlowBuilder.svelte | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/frontend/src/lib/components/FlowBuilder.svelte b/frontend/src/lib/components/FlowBuilder.svelte
index 12423e19b2..32767864a6 100644
--- a/frontend/src/lib/components/FlowBuilder.svelte
+++ b/frontend/src/lib/components/FlowBuilder.svelte
@@ -413,7 +413,22 @@
 			// loadingSave = false // del
 			// return
 
-			if (newFlow) {
+			// `newFlow` comes from the embedder, and updating a path that has no
+			// deployed flow 404s. Confirm with the server before taking the update
+			// branch so a first deploy still lands.
+			let isNewFlow = newFlow
+			if (!isNewFlow) {
+				try {
+					isNewFlow =
+						initialPath === '' ||
+						!(await FlowService.existsFlowByPath({ workspace: opWorkspace!, path: initialPath }))
+				} catch (err) {
+					// Unreachable check: keep the caller's intent rather than failing the deploy.
+					console.error('Could not check flow existence', err)
+				}
+			}
+
+			if (isNewFlow) {
 				await FlowService.createFlow({
 					workspace: opWorkspace!,
 					requestBody: {

From b448af1da7f6a351973724721e52682259212292 Mon Sep 17 00:00:00 2001
From: Guilhem <guilhemlemouel@gmail.com>
Date: Mon, 20 Jul 2026 14:33:45 +0200
Subject: [PATCH 062/171] feat(sessions): live DOM access for the raw-app
 preview in AI sessions (#10129)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* feat(sessions): live DOM access for the raw-app preview in AI sessions

Give the session chat read-only access to the rendered raw-app preview,
plus inspector-picked element chips synced bidirectionally with the preview.

- search_dom / read_dom tools: live, same-origin contentDocument reads by CSS
  selector (selector omitted = whole body), reusing the file engine over
  pretty-printed outerHTML (worker-guarded, bounded). Session-gated.
- Inspector picks become app_dom_selector context chips (selector-only); the
  model fetches content on demand. Chips shown even in GLOBAL/session mode.
- Multi-select chips synced with the preview: the chip list is the source of
  truth, pushed to the harness which renders one highlight per selector; add,
  chip-remove, and preview-× remove all stay in sync. Overlays stripped from
  search_dom output.

The ui_builder harness changes (multi-select highlights + unique nth-of-type
selectors) live in windmill-code-ui-builder and ship via the artifact re-pin.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(sessions): inline element prompt + inspector polish for raw-app DOM

Session preview:
- Add InlineElementPrompt: a floating mini-composer anchored top-left over a
  selected element; sends a chat turn scoped to that element (its chip is
  context). Autofocus + remount per selection, borderless input, label gutter
  so it clears the harness name+size pill.
- autosize action gains an optional minHeight (default 30) so the compact
  inline input renders a tight single line.
- Fix exiting select mode: Esc / inspector toggle-off now fully clear the
  session's DOM-selector chips (source of truth) so the overlays AND the inline
  prompt are dismissed together, instead of leaving them stranded.

Full-page raw-app editor:
- Add inspectorHoverOnly: the inspector highlights on hover (outline +
  name/size) but a click selects nothing — no persistent selection, no app-mode
  context pick, no inline prompt.

Context badges:
- ContextElementBadge gains a compact prop (passed only by AIChatMessage): the
  DOM-selector chip and tagged workspace items (app/script/flow) render smaller
  above a sent message, while every badge stays the same size in the composer.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(sessions): address Codex review P1s on raw-app DOM context

- Inline element prompt: queue the turn when the chat manager is already
  streaming (mirror the composer) instead of a concurrent sendRequest that
  would race the shared abortController / streaming buffers.
- DOM selector chips now carry the raw-app path they were picked from. Each
  preview tab renders/pushes only its own app's chips, and a tab clears
  cross-app chips when it becomes the active DOM target — a selector could
  otherwise silently resolve against whichever raw-app tab is active
  (search_dom/read_dom target the active preview).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore(raw-apps): re-pin ui_builder artifact to f79e1c3

Bumps the UI Builder artifact to the release built from ui_builder main
after windmill-code-ui-builder#18 merged (the multi-select DOM inspector
synced with the host chat). This is the artifact re-pin step that gates
merging this PR.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(sessions): inline-prompt vertical centering + auto-collapse DOM tools

- InlineElementPrompt: bias the textarea padding (pt-[5px] pb-[3px], same
  total) so the single line sits centered in the pill — the shared autosize
  floor otherwise adds slack at the bottom and the text read 1px high.
- search_dom / read_dom: drop the explicit `autoCollapseDetails: false` so the
  tool card collapses after a successful read like other tools (it was copied
  from get_app_runtime_logs, where staying open is intentional).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(sessions): address Codex review on raw-app DOM access

- [P1] Release the DOM-requester slot when the active raw-app tab is hidden.
  Preview tabs stay mounted, so switching to a flow/script/page (or another
  raw-app) tab left search_dom/read_dom targeting the now-hidden raw app. The
  slot is now claimed with a per-tab owner token and released via the effect
  cleanup; the runtime only lets the claiming tab clear it, so a set/release
  race between two raw-app tabs can't blank the new owner.
- [P2] Strip the inspector outline classes from the clone ROOT (the selected
  element), not just its descendants — querySelectorAll skips the root, so a
  scoped read of the selected element leaked inspector-picked in its outerHTML.
- [P2] Reword the AIChatDisplay context-chip comment to drop drafting-history
  narration ("now", "not as rows here") per AGENTS.md.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(sessions): scope a queued inline prompt to its own element (Codex P1)

An inline element prompt submitted while a turn was streaming got queued as
plain text; if the user selected another element before the queue flushed, the
queued turn snapshotted the new selection and sent scoped to the wrong element
(or none).

The queue now carries a context snapshot:
- queueMessage(text, context?) pins the selection present at submit time.
- sendRequest accepts contextOverride and uses it verbatim as the turn's
  selected context (feeds both the optimistic bubble and the API message).
- All three queue-flush sites thread the snapshot through and restore it if the
  auto-send bails.
- With an override, only the queued message's own DOM chips are consumed from
  the live selection — a newer selection made since is left intact — preserving
  the one-shot chip semantics.

onInlinePrompt snapshots getSelectedContext() when it queues.

(Codex's other P1 — full-page-editor hover-only no longer attaching elements to
App AI — is intentional per an explicit product decision, left unchanged.)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(raw-apps): restore full-page editor App-AI inspector context

Codex/Pi flagged a real regression: passing inspectorHoverOnly disabled the
full-page editor's existing App-AI (app-mode) inspector context. Clicking an
inspected element no longer set inspectorElement, so the app-mode
SelectedContext badge and the element attach in prepareAppUserMessage were
dead.

inspectorHoverOnly and the session path (onInspectorSelect) are mutually
exclusive — the flag was only ever set in the full-page/app-mode context, so it
only suppressed the app-mode path. Remove it entirely (prop, guard, and the
pass in +page.svelte), restoring the original click -> inspectorElement ->
app-mode context behavior. Session behavior is unchanged; the hover highlight
still works in both.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(sessions): snapshot inline-prompt context synchronously (Codex P1)

The immediate inline-prompt path called sendRequest without a context override,
so the selected element was read only after the async send preflight
(attached-file refresh, beforeSend, global-skill refresh). Picking another
element during that window attached the wrong one to the outgoing turn.

onInlinePrompt now snapshots the selection synchronously at submit time and
passes it as contextOverride on both the queued and immediate paths, so the
prompt always rides with the element it was scoped to.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(sessions): drop a queued inline prompt's DOM chips when the app changes

A queued inline prompt scoped to raw app A described A's elements, but the
runtime's single DOM requester targets whichever preview is active. Switching
to app B before the queue flushed left the turn describing A while search_dom /
read_dom would query B.

When a raw-app preview tab becomes active it now also strips the queued turn's
DOM chips belonging to other apps (dropQueuedDomContextForOtherApps), so a
queued prompt can't ask the model to read one app's selectors against another's
live DOM. Non-DOM queued context is preserved.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(sessions): scope inline prompt to its anchored element (Codex P1)

The inline prompt sits over a single element but snapshotted EVERY selected DOM
chip. With several elements selected (Shift-multi-select), a prompt shown over
B sent both A and B as context, so "change this button" couldn't identify which
one it meant.

onInlinePrompt now uses its anchored `selector` argument (previously ignored)
to keep only that element's DOM chip in the snapshot; non-DOM context is
preserved.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(sessions): preserve original context on edit/retry (Codex P1)

restartGeneration resent with the live selection, so editing or retrying an
element-scoped prompt lost its DOM selector (or adopted a newer one) — DOM
chips are one-shot and cleared from the live selection after the first send.

It now passes userMessage.contextElements as contextOverride, re-using the
exact context the message was originally sent with. undefined (modes that don't
attach contextElements) falls back to the live selection as before.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(sessions): route search_dom/read_dom to the selector's own app preview

The DOM requester was a single active-tab slot, so search_dom/read_dom always
read whichever preview was visible. A turn scoped to app A that read the DOM
after the user switched to app B would silently read B (Codex P1).

Preview tabs stay MOUNTED when hidden, so app A's DOM is still there — the fix
is to route by app instead of "active tab":

- Every mounted RawAppEditorView registers its DOM requester keyed by its app
  path (runtime holds a map, not one slot); the visible tab is tracked
  separately as the default target.
- search_dom / read_dom gain an `app_path` (surfaced per chip in the SELECTED
  DOM ELEMENTS block and the tool schema); the runtime routes the query to that
  app's still-mounted preview. No app_path → the active preview, or the only one
  open.
- If the named app's preview has been closed, the tool returns "The preview for
  X is no longer open…" so the chat can explain it, rather than reading the
  wrong app.

This makes the queued-context drop-on-switch (dropQueuedDomContextForOtherApps)
redundant — removed. The lightweight submit-time snapshot (which element the
message is about) is kept.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(sessions): address Codex review on DOM access (script strip + app-scoped chips)

- search_dom/read_dom: strip the app's compiled <script> bundle from the
  whole-body clone so queries only see rendered HTML, not source (P1).
- DOM chip add-dedup and removal now match both selector AND app path, so an
  identical selector in another app can't drop or block a chip (P2).
- Refresh stale single-slot requester comments to describe per-app routing;
  reword the foreign-chip reset to reflect why it stays (composer chips are
  unlabeled by app) (P2).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(sessions): scope DOM-chip clear to its app so a rebuild can't wipe another (Codex P2)

Every mounted preview emits inspectorClear on rebuild, routed to
onInspectorClearAll → clearSelectedDomElements(). Unscoped, a hidden app A
rebuilding cleared app B's active chip and highlight. clearSelectedDomElements
now takes an optional appPath; the preview-clear path passes its own path, while
post-send and foreign-reset clears stay unscoped.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(sessions): reject a <script>-root DOM query so the app bundle can't leak (Codex P2)

The descendant strip (querySelectorAll('script')) skips the clone root, so a
search_dom / read_dom query whose selector targets `script` serialized the whole
compiled bundle. Reject a script root with an explanatory result before cloning.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(sessions): union queued inline-prompt DOM context + reject inspector-label root (Codex)

- Multiple inline prompts queued during one stream accumulate their text, but
  queuedContext replaced (last wins) — dropping an earlier element's chip and
  misapplying its instruction. Union the DOM selector chips across queued prompts
  (non-DOM context still from the latest snapshot) (P1).
- search_dom/read_dom: reject an .inspector-label clone root, like the <script>
  root — the descendant strip skips the root, so a `.inspector-label` query
  would return inspector chrome (P2).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(sessions): restore consumed DOM chips when a turn is cancelled unsent (Codex P1)

DOM selector chips are consumed from the live selection before the request goes
out. If the user hits Stop before any usable output, restoreUnsentTurn put the
text/pastes/images back but not the chips, so resending the restored prompt lost
its element scope. Re-add the consumed chips on rollback (skipped on a queued-
message handoff, which carries its own context).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(sessions): edit box edits the message's own context, sends what it shows (Codex P1)

Editing a past message bound the edit box to the LIVE selection while the resend
carried the message's original contextElements — so the box showed one set of
chips (or none) but sent another, and add/remove in the box did nothing. The edit
box now edits a copy seeded from the message's own contextElements, and
restartGeneration sends that edited copy; a bare retry still falls back to the
original. Drops the now-unused selectedContext prop from AIChatMessage.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(sessions): keep DOM context coherent on dequeue/cancel + per-chip edit identity (Codex)

- dequeueMessage dropped the queued draft's pinned DOM context, so returning it
  to the composer sent the live selection instead. Restore the draft's context on
  dequeue (P1).
- Cancel-rollback re-added this turn's chips additively, mixing in chips selected
  mid-stream. Replace instead so the restored draft stays coherent — shared helper
  #restoreDomContext used by both paths (P1).
- The context chip row keyed/removed by (type, title); repeated DOM elements share
  a title (two button.btn), so editing a multi-select message gave duplicate keys
  and deleting one chip removed both. Identify DOM chips by (appPath, selector) (P1).

The queued-prompt instruction↔element association (Codex #1) is the accepted union
tradeoff and is unchanged.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(sessions): scope read_dom pagination + don't consume live chips on edit/retry

Codex P1s:
- read_dom's continuation note only renamed read_file, so following it with
  start_line alone dropped app_path/selector and re-read the active app's whole
  body instead of continuing inside the element.
- contextOverride also carries an edit/retry's replayed copy of an older
  message's context. Consuming it from the live ContextManager stripped an
  identical chip the user had since selected in the composer, leaving their
  draft unscoped. Overrides now declare their origin ('pinned' vs 'replay').

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(sessions): keep DOM context paired with the draft it belongs to

Restoring a draft's pinned DOM chips replaced the live selection unconditionally,
but both restore paths can leave a different draft in the composer:

- Cancel: an occupied composer declines the rolled-back text (restoreInstructions
  bails), yet the cancelled turn's chips still replaced the live ones — the draft
  the user typed during the stream kept its text but got retargeted.
- Dequeue: queued text is prepended onto an existing draft, so both instructions
  share one composer; replacing the chips dropped the standing draft's element.

restoreInstructions/prependText now report whether the composer took the text.
Cancel restores context only when it did; dequeue keeps both drafts' chips when
it merged into one.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(sessions): scope an inline prompt's chip filter to its own app

The filter narrowing a multi-select down to the anchored element matched on
selector alone. Selectors are generated per app and collide across them, so an
inline prompt in app B also carried app A's identically-named chip, leaving the
model two indistinguishable referents. Since draft restoration can now
legitimately hold chips from several apps, match (selector, appPath) — as the
sibling deselect/clear handlers in this file already do.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../copilot/chat/AIChatDisplay.svelte         |  12 +-
 .../copilot/chat/AIChatInput.svelte           |  99 +++++--
 .../copilot/chat/AIChatManager.svelte.ts      | 167 +++++++++--
 .../copilot/chat/AIChatManager.test.ts        | 203 ++++++++++++-
 .../copilot/chat/AIChatMessage.svelte         |  14 +-
 .../copilot/chat/ContextElementBadge.svelte   |  31 +-
 .../copilot/chat/ContextManager.svelte.ts     |  63 +++-
 .../copilot/chat/ContextTextarea.svelte       | 119 ++++----
 .../lib/components/copilot/chat/context.ts    |  46 ++-
 .../copilot/chat/global/core.test.ts          |  83 +++++-
 .../components/copilot/chat/global/core.ts    | 131 +++++++++
 .../raw_apps/InlineElementPrompt.svelte       |  74 +++++
 .../components/raw_apps/RawAppEditor.svelte   | 276 +++++++++++++++++-
 .../lib/components/raw_apps/rawAppDom.test.ts | 100 +++++++
 .../src/lib/components/raw_apps/rawAppDom.ts  | 184 ++++++++++++
 .../sessions/RawAppEditorView.svelte          | 118 ++++++++
 .../sessions/sessionRuntime.svelte.ts         |  83 ++++++
 17 files changed, 1681 insertions(+), 122 deletions(-)
 create mode 100644 frontend/src/lib/components/raw_apps/InlineElementPrompt.svelte
 create mode 100644 frontend/src/lib/components/raw_apps/rawAppDom.test.ts
 create mode 100644 frontend/src/lib/components/raw_apps/rawAppDom.ts

diff --git a/frontend/src/lib/components/copilot/chat/AIChatDisplay.svelte b/frontend/src/lib/components/copilot/chat/AIChatDisplay.svelte
index 6aec1f3ba8..aefa123713 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatDisplay.svelte
+++ b/frontend/src/lib/components/copilot/chat/AIChatDisplay.svelte
@@ -43,7 +43,6 @@
 	import JobsSegment from './JobsSegment.svelte'
 	import { getModifierKey } from '$lib/utils'
 	import type { SelectedContext } from './app/core'
-	import AttachedFilesBar from './files/AttachedFilesBar.svelte'
 	import { type FileToAttach } from './files/attachedFiles.svelte'
 	import { isImageFile } from './imageUtils'
 	import {
@@ -651,7 +650,6 @@ the panel, or the Escape-to-stop focus check would wrongly reject them. -->
 							{message}
 							{messageIndex}
 							{availableContext}
-							bind:selectedContext
 							bind:editingMessageIndex
 							isLast={messageIndex === messages.length - 1}
 						/>
@@ -756,12 +754,10 @@ the panel, or the Escape-to-stop focus check would wrongly reject them. -->
 					<JobsSegment standalone />
 				</div>
 			{/if}
-			{#if aiChatManager.mode === AIMode.GLOBAL}
-				<!-- In sessions, file chips sit above the fork/draft bar (inputPreface). Selected
-				     context gets no badge row here — items already appear as highlighted @mentions
-				     in the input (deleting the mention deselects), so showContext={false} below. -->
-				<AttachedFilesBar />
-			{/if}
+			<!-- Context chips (attached files + selected-context / DOM-selector) render
+			     inside the input box via AIChatInput → ContextTextarea's `leading` snippet;
+			     selected context also appears as @mentions in the input (deleting the
+			     mention deselects). Hence showContext={false} below. -->
 			{#if inputPreface}
 				{@render inputPreface()}
 			{/if}
diff --git a/frontend/src/lib/components/copilot/chat/AIChatInput.svelte b/frontend/src/lib/components/copilot/chat/AIChatInput.svelte
index 07d6b03b36..ce7b27c593 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatInput.svelte
+++ b/frontend/src/lib/components/copilot/chat/AIChatInput.svelte
@@ -2,8 +2,9 @@
 	import AppAvailableContextList from './AppAvailableContextList.svelte'
 	import ContextElementBadge from './ContextElementBadge.svelte'
 	import ContextTextarea from './ContextTextarea.svelte'
+	import AttachedFilesBar from './files/AttachedFilesBar.svelte'
 	import autosize from '$lib/autosize'
-	import type { ContextElement } from './context'
+	import type { AppDomSelectorElement, ContextElement } from './context'
 	import { AIMode } from './AIChatManager.svelte'
 	import { CHAT_INPUT_PADDING, getAiChatManager } from './aiChatManagerContext'
 	import { formatMention } from './mention'
@@ -230,6 +231,25 @@
 			aiChatManager.mode === AIMode.GLOBAL
 	)
 
+	const domSelectorChips = $derived(
+		(selectedContext ?? []).filter((c): c is AppDomSelectorElement => c.type === 'app_dom_selector')
+	)
+
+	// DOM selector chips can share a display title (two `button.btn` from repeated
+	// elements), so identify them by (appPath, selector) — keying or removing by
+	// title would collide, giving repeated chips one Svelte key and deleting them
+	// together. Other context types stay identified by (type, title).
+	function contextKey(c: ContextElement): string {
+		return c.type === 'app_dom_selector' ? `dom:${c.appPath}:${c.selector}` : `${c.type}:${c.title}`
+	}
+	function isSameContextElement(a: ContextElement, b: ContextElement): boolean {
+		if (a.type !== b.type) return false
+		if (a.type === 'app_dom_selector' && b.type === 'app_dom_selector') {
+			return a.selector === b.selector && a.appPath === b.appPath
+		}
+		return a.title === b.title
+	}
+
 	/** Append `@title` to the textarea so the button-picker path stays in
 	 * sync with the inline `@<word>` mention path — both leave a visible
 	 * token tied to the selectedContext entry, which the textarea diffs on
@@ -277,16 +297,21 @@
 	// Restore composer contents after a rolled-back turn. No-op when the user
 	// already drafted something new — typed text or attached images (including
 	// ones still decoding) — restoring would clobber it.
+	/** Returns whether the restore was taken: an occupied composer keeps its own
+	 * draft and declines, and the caller must then leave that draft's context
+	 * alone too — restoring context for text that was dropped would retarget the
+	 * draft the user is still writing. */
 	export function restoreInstructions(
 		value: string,
 		restoredPastes: PasteAttachment[] = [],
 		restoredImages: AttachedImage[] = []
-	) {
-		if (instructions.trim() || images.length > 0 || pendingImages > 0) return
+	): boolean {
+		if (instructions.trim() || images.length > 0 || pendingImages > 0) return false
 		instructions = value
 		pastes = restoredPastes
 		images = restoredImages
 		focusInput()
+		return true
 	}
 
 	/** Put text back into the textarea (queued-message delete, or restore
@@ -294,7 +319,11 @@
 	 * the user typed is lost. Restored images join whatever is already
 	 * attached, up to the cap — dropping them would lose the attachment
 	 * silently, which is the whole reason the queue carries them. */
-	export function prependText(text: string, restoredImages: AttachedImage[] = []) {
+	export function prependText(text: string, restoredImages: AttachedImage[] = []): boolean {
+		// Whether the restored text landed on top of a draft the user was already
+		// writing: both instructions now share one composer, so the caller must keep
+		// both their contexts rather than replacing one with the other.
+		const mergedIntoDraft = !!text && !!instructions.trim()
 		// An image-only restore has empty text; prepending it would only add blank lines.
 		if (text) {
 			instructions = instructions.trim() ? `${text}\n\n${instructions}` : text
@@ -310,6 +339,7 @@
 			images = merged.slice(0, MAX_ATTACHED_IMAGES)
 		}
 		focusInput()
+		return mergedIntoDraft
 	}
 
 	/** Insert a plain @filename mention for an attached file (used by the @ menu Files category). */
@@ -427,7 +457,16 @@
 			return
 		}
 		if (editingMessageIndex !== null) {
-			aiChatManager.restartGeneration(editingMessageIndex, instructions, pastes, images)
+			// In edit mode selectedContext is the edit box's own copy (seeded from the
+			// message's original chips), so send exactly what's shown — the user may
+			// have added or removed chips.
+			aiChatManager.restartGeneration(
+				editingMessageIndex,
+				instructions,
+				pastes,
+				images,
+				selectedContext
+			)
 			onEditEnd()
 		} else {
 			aiChatManager.sendRequest({ instructions, pastes, images })
@@ -676,15 +715,13 @@
 
 {#snippet contextPickerRow()}
 	{#if selectedContext.length > 0}
-		<div class="flex flex-row flex-wrap items-center gap-1 mb-1">
-			{#each selectedContext as element (element.type + '-' + element.title)}
+		<div class="flex flex-row flex-wrap items-center gap-1 px-2.5 pt-2">
+			{#each selectedContext as element (contextKey(element))}
 				<ContextElementBadge
 					contextElement={element}
 					deletable
 					onDelete={() => {
-						selectedContext = selectedContext?.filter(
-							(c) => c.type !== element.type || c.title !== element.title
-						)
+						selectedContext = selectedContext?.filter((c) => !isSameContextElement(c, element))
 						removeMention(element.title)
 					}}
 				/>
@@ -693,6 +730,24 @@
 	{/if}
 {/snippet}
 
+<!-- DOM selector chips (raw-app inspector picks) always show — even in GLOBAL/
+     session mode where the general context picker row is hidden (showContext=false). -->
+{#snippet domSelectorChipRow()}
+	{#if domSelectorChips.length > 0}
+		<div class="flex flex-row flex-wrap items-center gap-1 px-2.5 pt-2">
+			{#each domSelectorChips as element (contextKey(element))}
+				<ContextElementBadge
+					contextElement={element}
+					deletable
+					onDelete={() => {
+						selectedContext = selectedContext?.filter((c) => !isSameContextElement(c, element))
+					}}
+				/>
+			{/each}
+		</div>
+	{/if}
+{/snippet}
+
 {#snippet imageChipsRow()}
 	{#if images.length > 0 || pendingImages > 0}
 		<div class="flex flex-row flex-wrap items-center gap-1.5 mb-1">
@@ -741,10 +796,6 @@
 	}}
 >
 	{#if isContextEnabledMode}
-		{#if showContext}
-			{@render contextPickerRow()}
-		{/if}
-		{@render imageChipsRow()}
 		<div class="relative">
 			<ContextTextarea
 				bind:this={contextTextareaComponent}
@@ -758,9 +809,7 @@
 				placeholder={modePlaceholder}
 				onAddContext={(contextElement) => void addContextToSelection(contextElement)}
 				onRemoveContext={(element) => {
-					selectedContext = selectedContext?.filter(
-						(c) => c.type !== element.type || c.title !== element.title
-					)
+					selectedContext = selectedContext?.filter((c) => !isSameContextElement(c, element))
 				}}
 				onSendRequest={() => {
 					if (disabled) {
@@ -770,7 +819,21 @@
 				}}
 				{disabled}
 				{onKeyDown}
-			/>
+			>
+				{#snippet leading()}
+					{#if aiChatManager.mode === AIMode.GLOBAL}
+						<div class="px-2.5 empty:hidden">
+							<AttachedFilesBar />
+						</div>
+					{/if}
+					{#if showContext}
+						{@render contextPickerRow()}
+					{:else}
+						{@render domSelectorChipRow()}
+					{/if}
+					{@render imageChipsRow()}
+				{/snippet}
+			</ContextTextarea>
 			{#if !bottomRightSnippet}
 				<div class="absolute bottom-1 right-1">
 					{@render sendStopButton()}
diff --git a/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts b/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
index 8d4803cda0..bc9968561c 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
+++ b/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
@@ -320,6 +320,10 @@ function getSendRequestErrorMessage(err: unknown, webSearchUnavailable: boolean)
 	return appendWebSearchErrorHint(message, webSearchUnavailable)
 }
 
+/** A message queued while a turn streams: text, images and the pinned context
+ * snapshot always move together so a flush can't drop one. */
+type QueuedEntry = { text: string; images: AttachedImage[]; context: ContextElement[] | undefined }
+
 export class AIChatManager {
 	contextManager = new ContextManager()
 	historyManager = new HistoryManager()
@@ -343,6 +347,10 @@ export class AIChatManager {
 	// the turn finishes (clean completion or user cancel). Ephemeral — never
 	// saved to displayMessages or history.
 	queuedMessage = $state<string>('')
+	// Context snapshot to send WITH the queued message, when it must stay scoped to
+	// what was selected at queue time (e.g. an inline element prompt submitted mid-
+	// stream) rather than the live selection, which may change before the flush.
+	queuedContext = $state<ContextElement[] | undefined>(undefined)
 	// Images attached to that message. Kept beside the text rather than inside it
 	// because the queued chip renders `queuedMessage` as a plain string. Always
 	// move the two together — #takeQueue/#clearQueue/#restoreQueue exist so no
@@ -1276,6 +1284,7 @@ export class AIChatManager {
 			const accepted = await this.sendRequest({
 				instructions: next.text,
 				images: next.images,
+				contextOverride: next.context,
 				queued: true
 			})
 			if (accepted === false) {
@@ -1415,7 +1424,7 @@ export class AIChatManager {
 	 * one queued message; pressing Enter again appends the new text as another
 	 * line so it all goes out as a single message, and its images accumulate
 	 * alongside it. */
-	queueMessage(text: string, images: AttachedImage[] = []) {
+	queueMessage(text: string, images: AttachedImage[] = [], context?: ContextElement[]) {
 		const trimmed = text.trim()
 		// An image with no text is still a message; only a fully empty send is ignored.
 		if (!trimmed && images.length === 0) {
@@ -1431,6 +1440,31 @@ export class AIChatManager {
 			}
 			this.queuedImages = merged.slice(0, MAX_ATTACHED_IMAGES)
 		}
+		// Pin the context snapshot to the queued message. The queued text accumulates
+		// (several inline prompts can queue during one stream), so union the DOM
+		// selector chips too — replacing would drop an earlier prompt's element and
+		// misapply its instruction. Non-DOM context comes from the latest snapshot.
+		if (context && context.length > 0) {
+			if (!this.queuedContext) {
+				this.queuedContext = context
+			} else {
+				const merged = [...context]
+				for (const c of this.queuedContext) {
+					if (
+						c.type === 'app_dom_selector' &&
+						!merged.some(
+							(m) =>
+								m.type === 'app_dom_selector' &&
+								m.selector === c.selector &&
+								m.appPath === c.appPath
+						)
+					) {
+						merged.push(c)
+					}
+				}
+				this.queuedContext = merged
+			}
+		}
 	}
 
 	/** Whether anything is waiting in the queue — an image-only message has empty text. */
@@ -1438,9 +1472,13 @@ export class AIChatManager {
 		return this.queuedMessage !== '' || this.queuedImages.length > 0
 	}
 
-	/** Detach the queue for sending. Text and images always leave together. */
-	#takeQueue(): { text: string; images: AttachedImage[] } {
-		const taken = { text: this.queuedMessage, images: this.queuedImages }
+	/** Detach the queue for sending. Text, images and context always leave together. */
+	#takeQueue(): QueuedEntry {
+		const taken = {
+			text: this.queuedMessage,
+			images: this.queuedImages,
+			context: this.queuedContext
+		}
 		this.#clearQueue()
 		return taken
 	}
@@ -1448,12 +1486,39 @@ export class AIChatManager {
 	#clearQueue() {
 		this.queuedMessage = ''
 		this.queuedImages = []
+		this.queuedContext = undefined
 	}
 
 	/** Put a taken queue back after an auto-send bailed before becoming a turn. */
-	#restoreQueue(queued: { text: string; images: AttachedImage[] }) {
+	#restoreQueue(queued: QueuedEntry) {
 		this.queuedMessage = queued.text
 		this.queuedImages = queued.images
+		this.queuedContext = queued.context
+	}
+
+	/** Put a draft's pinned DOM selector chips back as the live selection, so the
+	 * restored draft and the selection stay coherent (its instruction targets the
+	 * element it was written for). No-op when the draft pinned no DOM chips, so a
+	 * plain-text draft leaves the live selection untouched.
+	 *
+	 * `keepExisting` when the restored text was merged into a draft the user was
+	 * already writing: that draft's own chips must survive alongside, or its
+	 * instruction — still sitting in the composer — would be retargeted at this
+	 * draft's element. Otherwise the restore replaces, since any chip selected
+	 * since belongs to a draft that is being replaced too. */
+	#restoreDomContext(context: ContextElement[] | undefined, keepExisting = false) {
+		const domChips = (context ?? []).filter((c) => c.type === 'app_dom_selector')
+		if (domChips.length === 0) return
+		const existing = keepExisting
+			? (this.contextManager?.getSelectedContext().filter((c) => c.type === 'app_dom_selector') ??
+				[])
+			: []
+		this.contextManager?.clearSelectedDomElements()
+		// addSelectedDomElement dedups on (selector, appPath), so a chip both drafts
+		// share collapses to one.
+		for (const c of [...domChips, ...existing]) {
+			this.contextManager?.addSelectedDomElement(c)
+		}
 	}
 
 	/** Remove the queued message and put it back into the input, images included. */
@@ -1462,19 +1527,24 @@ export class AIChatManager {
 			return
 		}
 		const queued = this.#takeQueue()
-		this.restoreToInput(queued.text, queued.images)
+		const mergedIntoDraft = this.restoreToInput(queued.text, queued.images)
+		// The queued draft pinned its own DOM context; restore it so sending from
+		// the composer targets the element the draft was written for, not whatever
+		// is selected now. If its text was prepended onto an existing draft, that
+		// draft's chips are kept too — both instructions now share one composer.
+		this.#restoreDomContext(queued.context, mergedIntoDraft)
 	}
 
 	/** Put what the user typed back where they can see it: into the input
 	 * when it's mounted, otherwise back into the queue so it reappears with
 	 * the chat panel instead of being silently dropped. */
-	private restoreToInput(text: string, images: AttachedImage[] = []) {
+	private restoreToInput(text: string, images: AttachedImage[] = []): boolean {
 		if (this.aiChatInput) {
-			this.aiChatInput.prependText(text, images)
-		} else {
-			this.queuedMessage = text
-			this.queuedImages = images
+			return this.aiChatInput.prependText(text, images) === true
 		}
+		this.queuedMessage = text
+		this.queuedImages = images
+		return false
 	}
 
 	focusInput() {
@@ -1863,12 +1933,12 @@ export class AIChatManager {
 		pastes: PasteAttachment[],
 		restoreToInput: boolean = true,
 		images: AttachedImage[] = []
-	) => {
+	): boolean => {
 		this.displayMessages = this.displayMessages.slice(0, displayLenAfterUser - 1)
 		this.messages = this.messages.slice(0, modelLenAfterUser - 1)
-		if (restoreToInput) {
-			this.aiChatInput?.restoreInstructions(instructions, pastes, images)
-		}
+		if (!restoreToInput) return false
+		// An occupied composer declines the restore and keeps its own draft.
+		return this.aiChatInput?.restoreInstructions(instructions, pastes, images) === true
 	}
 
 	private notifyReasoningSummaryUnavailable = () => {
@@ -2105,6 +2175,16 @@ export class AIChatManager {
 			mode?: AIMode
 			lang?: ScriptLang | 'bunnative'
 			isPreprocessor?: boolean
+			// Use this selected-context snapshot for the turn instead of the live
+			// contextManager. Set when flushing a queued message that captured its
+			// context at submit time; the live selection is left untouched.
+			contextOverride?: ContextElement[]
+			/** Where `contextOverride` came from. 'pinned' (default): the chips were
+			 * selected for THIS message, so they are consumed from the live selection
+			 * on send. 'replay': an edit/retry resending an older message's context —
+			 * those chips were consumed long ago, and removing them again would strip
+			 * an identical selection the user has since made in the composer. */
+			contextOverrideOrigin?: 'pinned' | 'replay'
 			/** Auto-send of a queued draft: on preflight failure the caller re-queues
 			 * it, so the composer restore must not also fire (the draft would exist
 			 * twice — queue chip and composer). */
@@ -2280,6 +2360,7 @@ export class AIChatManager {
 				const accepted = await this.sendRequest({
 					instructions: next.text,
 					images: next.images,
+					contextOverride: next.context,
 					queued: true
 				})
 				if (accepted === false) this.#restoreQueue(next)
@@ -2302,7 +2383,32 @@ export class AIChatManager {
 		// rollbacks leave it false so queued text is restored to the input.
 		let turnCommittedCleanly = false
 		try {
-			const oldSelectedContext = this.contextManager?.getSelectedContext() ?? []
+			// A queued message carries its own context snapshot (contextOverride); use
+			// it verbatim and leave the live selection alone (it belongs to whatever the
+			// user has selected since). Otherwise read the current selection.
+			const oldSelectedContext =
+				options.contextOverride ?? this.contextManager?.getSelectedContext() ?? []
+			// DOM selector chips are one-shot: they ride with this message (captured in
+			// oldSelectedContext) and render above it, but must not persist in the input
+			// for the next turn. Clearing here leaves oldSelectedContext untouched.
+			if (options.contextOverrideOrigin === 'replay') {
+				// Edit/retry: the override is a copy of an already-sent message's
+				// context, consumed on its original send. The live selection belongs to
+				// the composer's own draft — touching it here would strip it.
+			} else if (options.contextOverride) {
+				// Queued message: only the chips it carried are consumed. Drop just
+				// those from the live selection (still there if the user didn't
+				// re-select); a newer selection made since is left intact.
+				for (const c of options.contextOverride) {
+					if (c.type === 'app_dom_selector') {
+						// Match appPath too: another app's live chip can share this
+						// selector, and dropping it would discard a newer selection.
+						this.contextManager?.removeSelectedDomElement(c.selector, c.appPath)
+					}
+				}
+			} else {
+				this.contextManager?.clearSelectedDomElements()
+			}
 			if (this.mode === AIMode.SCRIPT || this.mode === AIMode.FLOW) {
 				this.contextManager?.updateContextOnRequest(options)
 			}
@@ -2629,7 +2735,7 @@ export class AIChatManager {
 				// about to auto-send (see the flush below) — drop the rolled-back
 				// prompt instead of restoring it to the input so the handoff is clean.
 				const willAutoSendQueued = this.wasCancelledByUser() && this.#hasQueuedMessage()
-				this.restoreUnsentTurn(
+				const textRestored = this.restoreUnsentTurn(
 					displayLenAfterUser,
 					modelLenAfterUser,
 					sentInstructions,
@@ -2637,6 +2743,18 @@ export class AIChatManager {
 					!willAutoSendQueued,
 					sentImages
 				)
+				// restoreUnsentTurn hands the text/pastes/images back for a resend, but
+				// the DOM selector chips were already consumed from the live selection
+				// before the request went out. Restore this turn's own chips so the
+				// resend keeps its element scope — replacing (not merging) any chips
+				// selected during the stream, so the restored draft stays coherent.
+				// Only when the composer actually took the text back: on a queued-message
+				// handoff, or when a draft typed during the stream made the composer
+				// decline, this prompt is dropped — restoring its chips would then
+				// retarget whatever draft is sitting there.
+				if (textRestored) {
+					this.#restoreDomContext(oldSelectedContext)
+				}
 				if (this.displayMessages.length === 0) {
 					// saveChat no-ops on an empty transcript; the chat persisted earlier
 					// this turn would linger in history and resurface the rolled-back
@@ -2759,6 +2877,7 @@ export class AIChatManager {
 			const accepted = await this.sendRequest({
 				instructions: next.text,
 				images: next.images,
+				contextOverride: next.context,
 				queued: true
 			})
 			if (accepted === false) {
@@ -2832,7 +2951,8 @@ export class AIChatManager {
 		displayMessageIndex: number,
 		newContent?: string,
 		pastes?: PasteAttachment[],
-		images?: AttachedImage[]
+		images?: AttachedImage[],
+		editedContext?: ContextElement[]
 	) => {
 		const userMessage = this.displayMessages[displayMessageIndex]
 
@@ -2866,10 +2986,19 @@ export class AIChatManager {
 		// error, which rewinds through here.
 		this.contextUsage = undefined
 
-		// Resend the request with the same instructions
+		// Resend with the message's context, not the live selection. DOM selector
+		// chips (and other context) are one-shot — cleared from the live selection
+		// after the first send — so reading the current selection would lose or swap
+		// the element the message was about. An edit passes `editedContext` (the edit
+		// box was seeded from this message's chips and the user may have changed
+		// them); a bare Retry passes nothing and falls back to the original
+		// contextElements. `undefined` for modes that don't attach context leaves the
+		// live-selection behavior. An empty array is a deliberate "no context".
 		this.instructions = newContent ?? userMessage.content
 		this.sendRequest({
 			pastes: pastes ?? userMessage.pastes,
+			contextOverride: editedContext ?? userMessage.contextElements,
+			contextOverrideOrigin: 'replay',
 			images: images ?? sentImages
 		})
 	}
diff --git a/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts b/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts
index f4379b6e90..58a2f0cd0a 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts
+++ b/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts
@@ -455,10 +455,12 @@ describe('AIChatManager queued messages', () => {
 		mocks.tryGetCurrentModel.mockReturnValue(model)
 	})
 
+	// The real composer reports whether it took the restore (an occupied one declines);
+	// default to an empty composer, which always takes it.
 	function createInputMock() {
 		return {
-			prependText: vi.fn(),
-			restoreInstructions: vi.fn(),
+			prependText: vi.fn().mockReturnValue(false),
+			restoreInstructions: vi.fn().mockReturnValue(true),
 			focusInput: vi.fn()
 		}
 	}
@@ -578,6 +580,57 @@ describe('AIChatManager queued messages', () => {
 		expect(urls).toEqual(['data:image/png;base64,FULLRES'])
 	})
 
+	it('an edit resends the edited context, a bare retry the original', async () => {
+		replyWith('done')
+		const manager = createManager(createInputMock())
+		manager.mode = AIMode.GLOBAL
+		const cm = manager.contextManager
+		cm.setSelectedDomElement({ selector: 'div.a', appPath: 'f/app', tagName: 'div' })
+		const chipA = cm.getSelectedContext()[0]
+		cm.setSelectedDomElement({ selector: 'div.b', appPath: 'f/app', tagName: 'div' })
+		const chipB = cm.getSelectedContext()[0]
+		cm.clearSelectedDomElements()
+
+		const seed = () => {
+			manager.displayMessages = [
+				{ role: 'user', content: 'style it', index: 0, contextElements: [chipA] },
+				{ role: 'assistant', content: 'ok' }
+			]
+			manager.messages = [
+				{ role: 'user', content: 'style it' },
+				{ role: 'assistant', content: 'ok' }
+			]
+		}
+		const sentChipSelectors = () =>
+			(manager.displayMessages.find((m) => m.role === 'user')?.contextElements ?? [])
+				.filter((c) => c.type === 'app_dom_selector')
+				.map((c) => c.selector)
+
+		// Edit swapped the chip A → B in the edit box: the resend carries B, not A.
+		seed()
+		manager.restartGeneration(0, 'style it', undefined, undefined, [chipB])
+		await vi.waitFor(() => expect(sentChipSelectors()).toEqual(['div.b']))
+
+		// A bare retry passes no edited context and falls back to the original A.
+		seed()
+		manager.restartGeneration(0)
+		await vi.waitFor(() => expect(sentChipSelectors()).toEqual(['div.a']))
+
+		// An edit/retry replays context that was consumed on its original send, so it
+		// must not touch the composer's own live selection — even when it holds the
+		// very same chip.
+		seed()
+		cm.setSelectedDomElement({ selector: 'div.a', appPath: 'f/app', tagName: 'div' })
+		manager.restartGeneration(0)
+		await vi.waitFor(() => expect(sentChipSelectors()).toEqual(['div.a']))
+		expect(
+			cm
+				.getSelectedContext()
+				.filter((c) => c.type === 'app_dom_selector')
+				.map((c) => c.selector)
+		).toEqual(['div.a'])
+	})
+
 	// The loop, not the send, owns the vision strip: it re-applies it per iteration
 	// for whatever model that iteration runs on, so a mid-loop switch in either
 	// direction sees the right view. A copy stripped at send time could never be
@@ -1196,6 +1249,94 @@ describe('AIChatManager queued messages', () => {
 		expect(input.restoreInstructions).not.toHaveBeenCalled()
 	})
 
+	it('restores consumed DOM selector chips when a turn is cancelled before output', async () => {
+		const manager = createManager(createInputMock())
+		manager.mode = AIMode.GLOBAL
+		manager.contextManager.setSelectedDomElement({
+			selector: 'div.card',
+			appPath: 'f/app',
+			tagName: 'div'
+		})
+		// The chip is consumed on send; while the turn streams the user selects a
+		// different element, then cancels before any usable output (rollback path).
+		mocks.runChatLoop.mockImplementationOnce(async ({ abortController }: any) => {
+			manager.contextManager.addSelectedDomElement({
+				selector: 'div.other',
+				appPath: 'f/app',
+				tagName: 'div'
+			})
+			abortController.abort('user_cancelled')
+			throw new Error('aborted')
+		})
+
+		await manager.sendRequest({ instructions: 'make it red' })
+
+		// Rollback restores THIS turn's chip and replaces the chip selected mid-stream,
+		// so the restored draft stays coherent (its instruction targets div.card only).
+		const chips = manager.contextManager
+			.getSelectedContext()
+			.filter((c) => c.type === 'app_dom_selector')
+		expect(chips.map((c) => c.selector)).toEqual(['div.card'])
+	})
+
+	it('restores a dequeued inline prompt’s pinned DOM context, replacing the live selection', () => {
+		const manager = createManager(createInputMock())
+		const cm = manager.contextManager
+		// Prompt A was queued with its own element pinned.
+		cm.setSelectedDomElement({ selector: 'div.a', appPath: 'f/app', tagName: 'div' })
+		manager.queueMessage('style A', [], [...cm.getSelectedContext()])
+		// The user then selects B in the live preview.
+		cm.setSelectedDomElement({ selector: 'div.b', appPath: 'f/app', tagName: 'div' })
+
+		// Returning the queued draft to the composer must restore A's context, not
+		// leave B's live selection (which would retarget the restored prompt).
+		manager.dequeueMessage()
+
+		const chips = cm.getSelectedContext().filter((c) => c.type === 'app_dom_selector')
+		expect(chips.map((c) => c.selector)).toEqual(['div.a'])
+	})
+
+	// Restoration is only coherent when the text it belongs to actually lands in the
+	// composer. Both cases below leave another draft sitting there, so replacing its
+	// chips would silently retarget an instruction the user is still writing.
+	it('leaves an occupied composer’s DOM context alone when it declines a cancelled prompt', async () => {
+		const input = createInputMock()
+		// The user typed a B-scoped draft during the stream, so the composer keeps it
+		// and declines the cancelled prompt's text.
+		input.restoreInstructions.mockReturnValue(false)
+		const manager = createManager(input)
+		manager.mode = AIMode.GLOBAL
+		const cm = manager.contextManager
+		cm.setSelectedDomElement({ selector: 'div.a', appPath: 'f/app', tagName: 'div' })
+		mocks.runChatLoop.mockImplementationOnce(async ({ abortController }: any) => {
+			cm.addSelectedDomElement({ selector: 'div.b', appPath: 'f/app', tagName: 'div' })
+			abortController.abort('user_cancelled')
+			throw new Error('aborted')
+		})
+
+		await manager.sendRequest({ instructions: 'style A' })
+
+		const chips = cm.getSelectedContext().filter((c) => c.type === 'app_dom_selector')
+		expect(chips.map((c) => c.selector)).toEqual(['div.b'])
+	})
+
+	it('keeps both drafts’ chips when a dequeued prompt is prepended onto an existing draft', () => {
+		const input = createInputMock()
+		// prependText merged the queued text on top of a draft already in the composer.
+		input.prependText.mockReturnValue(true)
+		const manager = createManager(input)
+		const cm = manager.contextManager
+		cm.setSelectedDomElement({ selector: 'div.a', appPath: 'f/app', tagName: 'div' })
+		manager.queueMessage('style A', [], [...cm.getSelectedContext()])
+		cm.setSelectedDomElement({ selector: 'div.b', appPath: 'f/app', tagName: 'div' })
+
+		manager.dequeueMessage()
+
+		// Both instructions now share one composer, so both elements stay in scope.
+		const chips = cm.getSelectedContext().filter((c) => c.type === 'app_dom_selector')
+		expect(chips.map((c) => c.selector).sort()).toEqual(['div.a', 'div.b'])
+	})
+
 	it('re-queues the message when its auto-send is rejected by beforeSend', async () => {
 		replyWith('done')
 		const input = createInputMock()
@@ -2399,3 +2540,61 @@ describe('AIChatManager background job completion', () => {
 		expect(manager.pendingJobNotes[0]).toContain('Background job job-1 for "run" succeeded')
 	})
 })
+
+describe('DOM selector chips scoped by app path', () => {
+	const domChips = (manager: AIChatManager) =>
+		manager.contextManager.getSelectedContext().filter((c) => c.type === 'app_dom_selector')
+
+	it('keeps same-selector chips from different apps and removes only the scoped one', () => {
+		const manager = new AIChatManager()
+		const cm = manager.contextManager
+		const base = { selector: 'div.card', tagName: 'div' }
+		cm.addSelectedDomElement({ ...base, appPath: 'f/app/a' })
+		cm.addSelectedDomElement({ ...base, appPath: 'f/app/b' })
+		// Same selector, different apps: both survive (dedup is per app path).
+		expect(domChips(manager)).toHaveLength(2)
+
+		// A selector-only removal would wipe both; scoping by appPath keeps app A's.
+		cm.removeSelectedDomElement('div.card', 'f/app/b')
+		const remaining = domChips(manager)
+		expect(remaining).toHaveLength(1)
+		expect(remaining[0].appPath).toBe('f/app/a')
+	})
+
+	it("a scoped clear (preview rebuild) drops only that app's chips", () => {
+		const manager = new AIChatManager()
+		const cm = manager.contextManager
+		cm.addSelectedDomElement({ selector: 'h1', appPath: 'f/app/a', tagName: 'h1' })
+		cm.addSelectedDomElement({ selector: 'button', appPath: 'f/app/b', tagName: 'button' })
+
+		// App A rebuilding must not wipe app B's active selection.
+		cm.clearSelectedDomElements('f/app/a')
+		const remaining = domChips(manager)
+		expect(remaining).toHaveLength(1)
+		expect(remaining[0].appPath).toBe('f/app/b')
+
+		// An unscoped clear (post-send / foreign reset) still drops everything.
+		cm.clearSelectedDomElements()
+		expect(domChips(manager)).toHaveLength(0)
+	})
+
+	it('unions DOM chips across inline prompts queued during one stream', () => {
+		const manager = new AIChatManager()
+		const cm = manager.contextManager
+		cm.setSelectedDomElement({ selector: 'div.a', appPath: 'f/app', tagName: 'div' })
+		const snapA = [...cm.getSelectedContext()]
+		cm.setSelectedDomElement({ selector: 'div.b', appPath: 'f/app', tagName: 'div' })
+		const snapB = [...cm.getSelectedContext()]
+
+		// Two element-scoped inline prompts queued while a turn streams. The earlier
+		// element's chip must survive so its instruction isn't retargeted to the later one.
+		manager.queueMessage('make A red', [], snapA)
+		manager.queueMessage('make B bigger', [], snapB)
+
+		const queuedSelectors = (manager.queuedContext ?? [])
+			.filter((c) => c.type === 'app_dom_selector')
+			.map((c) => c.selector)
+			.sort()
+		expect(queuedSelectors).toEqual(['div.a', 'div.b'])
+	})
+})
diff --git a/frontend/src/lib/components/copilot/chat/AIChatMessage.svelte b/frontend/src/lib/components/copilot/chat/AIChatMessage.svelte
index 57be8d9628..b1bf92de1b 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatMessage.svelte
+++ b/frontend/src/lib/components/copilot/chat/AIChatMessage.svelte
@@ -28,7 +28,6 @@
 
 	interface Props {
 		availableContext: ContextElement[]
-		selectedContext: ContextElement[]
 		message: DisplayMessage
 		messageIndex: number
 		editingMessageIndex: number | null
@@ -39,15 +38,22 @@
 		message,
 		messageIndex,
 		availableContext,
-		selectedContext = $bindable(),
 		editingMessageIndex = $bindable(null),
 		isLast = false
 	}: Props = $props()
 
+	// The edit box edits a copy of THIS message's original context, not the live
+	// selection: chips are one-shot and gone from the selection by edit time, so
+	// binding the live selection would show the wrong chips and let a submit send
+	// something other than what's displayed. Seeded on entering edit; the user's
+	// add/remove here rides along on submit (see restartGeneration).
+	let editContext = $state<ContextElement[]>([])
+
 	function editMessage() {
 		if (message.role !== 'user' || editingMessageIndex !== null || aiChatManager.loading) {
 			return
 		}
+		editContext = [...(message.contextElements ?? [])]
 		editingMessageIndex = messageIndex
 	}
 </script>
@@ -71,7 +77,7 @@
 		{#if message.role === 'user' && message.contextElements && editingMessageIndex !== messageIndex}
 			<div class="flex flex-row gap-1 mb-1 overflow-scroll no-scrollbar px-2">
 				{#each message.contextElements as element}
-					<ContextElementBadge contextElement={element} />
+					<ContextElementBadge contextElement={element} compact />
 				{/each}
 			</div>
 		{/if}
@@ -79,7 +85,7 @@
 			<div class="px-2 max-w-lg">
 				<AIChatInput
 					{availableContext}
-					bind:selectedContext
+					bind:selectedContext={editContext}
 					initialInstructions={message.content}
 					initialPastes={message.pastes}
 					initialImages={aiChatManager.storedImages(messageIndex)}
diff --git a/frontend/src/lib/components/copilot/chat/ContextElementBadge.svelte b/frontend/src/lib/components/copilot/chat/ContextElementBadge.svelte
index b42eae4835..326dcabd7b 100644
--- a/frontend/src/lib/components/copilot/chat/ContextElementBadge.svelte
+++ b/frontend/src/lib/components/copilot/chat/ContextElementBadge.svelte
@@ -19,9 +19,22 @@
 		contextElement: ContextElement
 		deletable?: boolean
 		onDelete?: () => void
+		/** Render context-picker / inspector picks (see COMPACT_TYPES) in a smaller
+		 * size — used above a sent message; the composer keeps every badge the
+		 * same size. */
+		compact?: boolean
 	}
 
-	let { contextElement, deletable = false, onDelete }: Props = $props()
+	let { contextElement, deletable = false, onDelete, compact = false }: Props = $props()
+
+	// Context-picker / inspector picks that render smaller above a sent message
+	// (the composer keeps every badge the same size).
+	const COMPACT_TYPES = new Set([
+		'app_dom_selector',
+		'workspace_app',
+		'workspace_script',
+		'workspace_flow'
+	])
 	const icon = ContextIconMap[untrack(() => contextElement).type]
 	let showDelete = $state(false)
 
@@ -34,9 +47,12 @@
 			contextElement.type === 'diff'
 				? contextElement.title.replace(/_/g, ' ')
 				: contextElement.title}
+		{@const small = compact && COMPACT_TYPES.has(contextElement.type)}
+		{@const iconSize = small ? 12 : 16}
 		<div
 			class={twMerge(
-				'border rounded-md px-1 py-0.5 flex flex-row items-center gap-1 text-primary text-xs font-normal cursor-default hover:bg-surface-hover hover:cursor-pointer max-w-48 bg-surface'
+				'border rounded-md flex flex-row items-center text-primary font-normal cursor-default hover:bg-surface-hover hover:cursor-pointer max-w-48 bg-surface',
+				small ? 'px-1 py-0 gap-0.5 text-2xs' : 'px-1 py-0.5 gap-1 text-xs'
 			)}
 			onmouseenter={() => (showDelete = true)}
 			onmouseleave={() => (showDelete = false)}
@@ -46,12 +62,12 @@
 		>
 			<button onclick={isDeletable ? onDelete : undefined} class:cursor-default={!isDeletable}>
 				{#if showDelete && isDeletable}
-					<X size={16} />
+					<X size={iconSize} />
 				{:else if contextElement.type === 'flow_module' || contextElement.type === 'flow_module_code_piece'}
-					<FlowModuleIcon module={contextElement as FlowModule} size={16} />
+					<FlowModuleIcon module={contextElement as FlowModule} size={iconSize} />
 				{:else}
 					{@const SvelteComponent = icon}
-					<SvelteComponent size={16} />
+					<SvelteComponent size={iconSize} />
 				{/if}
 			</button>
 			<span class="truncate" title={label}>{label}</span>
@@ -140,6 +156,11 @@
 				</div>
 				<ObjectViewer json={contextElement.columns} pureViewer collapseLevel={1} />
 			</div>
+		{:else if contextElement.type === 'app_dom_selector'}
+			<div class="p-2 max-w-96 text-xs overflow-auto">
+				<div class="text-tertiary mb-1">Selected preview element</div>
+				<div class="font-mono break-all">{contextElement.selector}</div>
+			</div>
 		{/if}
 	{/snippet}
 </Popover>
diff --git a/frontend/src/lib/components/copilot/chat/ContextManager.svelte.ts b/frontend/src/lib/components/copilot/chat/ContextManager.svelte.ts
index a728d1c96b..af3b402f9c 100644
--- a/frontend/src/lib/components/copilot/chat/ContextManager.svelte.ts
+++ b/frontend/src/lib/components/copilot/chat/ContextManager.svelte.ts
@@ -2,7 +2,7 @@ import { ResourceService, type Flow, type ListResourceResponse, type ScriptLang
 import { scriptLangToEditorLang } from '$lib/scripts'
 import { SQLSchemaLanguages, type DBSchemas } from '$lib/stores'
 import { diffLines } from 'diff'
-import type { ContextElement, FlowModuleElement } from './context'
+import { createAppDomSelectorElement, type ContextElement, type FlowModuleElement } from './context'
 import type { FlowModule } from '$lib/gen'
 
 import type { DisplayMessage } from './shared'
@@ -386,6 +386,67 @@ export default class ContextManager {
 		}
 	}
 
+	/**
+	 * Attach a raw-app preview element (picked via the inspector) as a selector chip.
+	 * Deduped by selector; the model reads the element live via search_dom / read_dom.
+	 */
+	addSelectedDomElement(info: {
+		selector: string
+		appPath: string
+		tagName: string
+		id?: string
+		className?: string
+	}) {
+		if (
+			this.selectedContext.find(
+				(c) =>
+					c.type === 'app_dom_selector' &&
+					c.selector === info.selector &&
+					c.appPath === info.appPath
+			)
+		) {
+			return
+		}
+		this.selectedContext = [...this.selectedContext, createAppDomSelectorElement(info)]
+	}
+
+	/** Replace all DOM selector chips with this single element (plain inspector pick). */
+	setSelectedDomElement(info: {
+		selector: string
+		appPath: string
+		tagName: string
+		id?: string
+		className?: string
+	}) {
+		this.selectedContext = [
+			...this.selectedContext.filter((c) => c.type !== 'app_dom_selector'),
+			createAppDomSelectorElement(info)
+		]
+	}
+
+	/** Remove one DOM selector chip (× on the chip or on the preview overlay).
+	 * Scope by appPath when known: two apps can generate the same selector, so a
+	 * selector-only match would drop another app's chip. */
+	removeSelectedDomElement(selector: string, appPath?: string) {
+		this.selectedContext = this.selectedContext.filter(
+			(c) =>
+				!(
+					c.type === 'app_dom_selector' &&
+					c.selector === selector &&
+					(appPath === undefined || c.appPath === appPath)
+				)
+		)
+	}
+
+	/** Drop DOM selector chips (one-shot per message — cleared after send). Pass
+	 * appPath to drop only one app's chips: a preview rebuild clears its own app,
+	 * and must not wipe a selection the user made in another still-mounted app. */
+	clearSelectedDomElements(appPath?: string) {
+		this.selectedContext = this.selectedContext.filter(
+			(c) => c.type !== 'app_dom_selector' || (appPath !== undefined && c.appPath !== appPath)
+		)
+	}
+
 	setFixContext() {
 		const codeContext = this.availableContext.find((c) => c.type === 'code')
 		const errorContext = this.availableContext.find((c) => c.type === 'error')
diff --git a/frontend/src/lib/components/copilot/chat/ContextTextarea.svelte b/frontend/src/lib/components/copilot/chat/ContextTextarea.svelte
index 777331e808..f3967fe402 100644
--- a/frontend/src/lib/components/copilot/chat/ContextTextarea.svelte
+++ b/frontend/src/lib/components/copilot/chat/ContextTextarea.svelte
@@ -1,6 +1,6 @@
 <script lang="ts">
 	import autosize from '$lib/autosize'
-	import { tick } from 'svelte'
+	import { tick, type Snippet } from 'svelte'
 	import type { ContextElement } from './context'
 	import { AIMode } from './AIChatManager.svelte'
 	import ChatCommandPicker from './ChatCommandPicker.svelte'
@@ -39,6 +39,8 @@
 		onImageFiles?: (files: File[]) => void
 		className?: string
 		onKeyDown?: (e: KeyboardEvent) => void
+		/** Rendered inside the input box, above the textarea (e.g. context chips). */
+		leading?: Snippet
 	}
 
 	let {
@@ -53,7 +55,8 @@
 		onRemoveContext,
 		onImageFiles,
 		className = '',
-		onKeyDown = undefined
+		onKeyDown = undefined,
+		leading
 	}: Props = $props()
 
 	const aiChatManager = getAiChatManager()
@@ -753,57 +756,71 @@
 	}
 </script>
 
-<div class="relative w-full scroll-pb-2 bg-surface">
-	<div
-		class={twMerge(
-			'textarea-input absolute inset-0 overflow-hidden pointer-events-none',
-			CHAT_INPUT_PADDING,
-			className
-		)}
-	>
-		<div style="transform: translateY({-scrollTop}px)" use:chipClickDelegate>
-			<span class="break-words">
-				{@html getHighlightedText(value)}
-			</span>
+<!-- The composer box: border + rounded live HERE (on the wrapper), not on the
+     textarea, so context chips can sit INSIDE the box, above the text. The
+     textarea's own @tailwindcss/forms border/ring is neutralized below. -->
+<div
+	class="w-full scroll-pb-2 bg-surface-input rounded-md border border-border-light focus-within:border-border-selected transition-colors"
+>
+	<!-- Context chips live inside the input box, above the textarea. The snippet
+	     self-guards (renders nothing when empty) so no blank row appears. -->
+	{@render leading?.()}
+	<div class="relative w-full">
+		<div
+			class={twMerge(
+				'textarea-input absolute inset-0 overflow-hidden pointer-events-none',
+				CHAT_INPUT_PADDING,
+				className
+			)}
+		>
+			<div style="transform: translateY({-scrollTop}px)" use:chipClickDelegate>
+				<span class="break-words">
+					{@html getHighlightedText(value)}
+				</span>
+			</div>
 		</div>
+		<textarea
+			bind:this={textarea}
+			onkeydown={handleKeyDown}
+			bind:value
+			use:autosize={{ maxHeight: '40vh' }}
+			rows={1}
+			oninput={handleInput}
+			onpaste={handlePaste}
+			onbeforeinput={handlePasteBeforeInput}
+			oncopy={handlePasteCopyCut}
+			oncut={handlePasteCopyCut}
+			ondragstart={handlePasteDragStart}
+			onscroll={(e) => {
+				scrollTop = e.currentTarget.scrollTop
+				// Keep the picker pinned to its anchor while the input scrolls
+				// internally (autoUpdate can't observe a virtual ref's scroll).
+				if (showContextTooltip || showCommandTooltip) updateAnchorRect()
+			}}
+			onblur={() => {
+				setTimeout(() => {
+					// Don't close if focus moved to inside the tooltip (e.g., search input)
+					if (tooltipElement?.contains(document.activeElement)) {
+						return
+					}
+					showContextTooltip = false
+					showCommandTooltip = false
+				}, 200)
+			}}
+			{placeholder}
+			class={twMerge(
+				'textarea-input resize-none caret-black dark:caret-white overflow-clip',
+				// The box (border/ring) lives on the wrapper; kill the textarea's own
+				// @tailwindcss/forms border, focus ring, and background so only the
+				// wrapper reads as the field.
+				'!border-transparent !bg-transparent !shadow-none focus:!border-transparent focus:!ring-0',
+				CHAT_INPUT_PADDING,
+				className
+			)}
+			class:transparent-text={value.length > 0}
+			{disabled}
+		></textarea>
 	</div>
-	<textarea
-		bind:this={textarea}
-		onkeydown={handleKeyDown}
-		bind:value
-		use:autosize={{ maxHeight: '40vh' }}
-		rows={1}
-		oninput={handleInput}
-		onpaste={handlePaste}
-		onbeforeinput={handlePasteBeforeInput}
-		oncopy={handlePasteCopyCut}
-		oncut={handlePasteCopyCut}
-		ondragstart={handlePasteDragStart}
-		onscroll={(e) => {
-			scrollTop = e.currentTarget.scrollTop
-			// Keep the picker pinned to its anchor while the input scrolls
-			// internally (autoUpdate can't observe a virtual ref's scroll).
-			if (showContextTooltip || showCommandTooltip) updateAnchorRect()
-		}}
-		onblur={() => {
-			setTimeout(() => {
-				// Don't close if focus moved to inside the tooltip (e.g., search input)
-				if (tooltipElement?.contains(document.activeElement)) {
-					return
-				}
-				showContextTooltip = false
-				showCommandTooltip = false
-			}, 200)
-		}}
-		{placeholder}
-		class={twMerge(
-			'textarea-input resize-none bg-transparent caret-black dark:caret-white overflow-clip',
-			CHAT_INPUT_PADDING,
-			className
-		)}
-		class:transparent-text={value.length > 0}
-		{disabled}
-	></textarea>
 </div>
 
 {#if showContextTooltip || showCommandTooltip}
diff --git a/frontend/src/lib/components/copilot/chat/context.ts b/frontend/src/lib/components/copilot/chat/context.ts
index cf41617f41..ce0c83cae6 100644
--- a/frontend/src/lib/components/copilot/chat/context.ts
+++ b/frontend/src/lib/components/copilot/chat/context.ts
@@ -7,7 +7,8 @@ import {
 	Code2,
 	TextSelect,
 	Table2,
-	LayoutDashboard
+	LayoutDashboard,
+	MousePointer2
 } from 'lucide-svelte'
 import BarsStaggered from '$lib/components/icons/BarsStaggered.svelte'
 import type { ScriptLang } from '$lib/gen/types.gen'
@@ -25,6 +26,7 @@ export const ContextIconMap = {
 	app_backend_runnable: Code2,
 	app_code_selection: TextSelect,
 	app_datatable: Table2,
+	app_dom_selector: MousePointer2,
 	workspace_script: Code2,
 	workspace_flow: BarsStaggered,
 	workspace_app: LayoutDashboard
@@ -142,6 +144,47 @@ export interface AppDatatableElement {
 	columns?: Record<string, string>
 }
 
+/**
+ * A DOM element the user picked in the raw-app preview inspector, attached to the
+ * chat as a lightweight selector reference. The element's HTML is NOT stored — the
+ * model reads it live via the `search_dom` / `read_dom` tools using `selector`.
+ */
+export interface AppDomSelectorElement {
+	type: 'app_dom_selector'
+	/** Full CSS selector path, passed verbatim to search_dom / read_dom. */
+	selector: string
+	/** Raw-app path the element was picked from. The selector only makes sense
+	 * against this app's preview, so chips are scoped to it (a session can have
+	 * several raw-app preview tabs, only one active at a time). */
+	appPath: string
+	/** Compact, space-free display label, e.g. "button#submit.primary". */
+	title: string
+	tagName: string
+	id?: string
+	className?: string
+}
+
+export function createAppDomSelectorElement(info: {
+	selector: string
+	appPath: string
+	tagName: string
+	id?: string
+	className?: string
+}): AppDomSelectorElement {
+	const tag = info.tagName.toLowerCase()
+	const firstClass = info.className?.trim().split(/\s+/)[0]
+	const title = `${tag}${info.id ? `#${info.id}` : ''}${firstClass ? `.${firstClass}` : ''}`
+	return {
+		type: 'app_dom_selector',
+		selector: info.selector,
+		appPath: info.appPath,
+		title,
+		tagName: tag,
+		id: info.id,
+		className: info.className
+	}
+}
+
 export function createAppSelectedContext(options: SelectedContext = {}): SelectedContext {
 	return {
 		...options
@@ -252,6 +295,7 @@ export type ContextElement = (
 	| AppBackendRunnableElement
 	| AppCodeSelectionElement
 	| AppDatatableElement
+	| AppDomSelectorElement
 	| WorkspaceScriptElement
 	| WorkspaceFlowElement
 	| WorkspaceAppElement
diff --git a/frontend/src/lib/components/copilot/chat/global/core.test.ts b/frontend/src/lib/components/copilot/chat/global/core.test.ts
index 7d2a5b4ed2..78d22e3fc8 100644
--- a/frontend/src/lib/components/copilot/chat/global/core.test.ts
+++ b/frontend/src/lib/components/copilot/chat/global/core.test.ts
@@ -260,6 +260,7 @@ import {
 	setDeployedInSessionHandler,
 	setGetPreviewStatusHandler,
 	setGetRuntimeLogsHandler,
+	setGetDomHandler,
 	setListAppRunsHandler,
 	setOpenPreviewHandler
 } from './core'
@@ -3734,6 +3735,62 @@ describe('prepareGlobalSystemMessage', () => {
 			expect(handler).toHaveBeenCalledWith({ sessionId: 'sess-runs', limit: 5 })
 		})
 	})
+
+	describe('search_dom / read_dom', () => {
+		afterEach(() => {
+			setGetDomHandler(undefined)
+		})
+
+		it('returns the session-only error when no handler is registered', async () => {
+			setGetDomHandler(undefined)
+			const searchResult = await callGlobalTool('search_dom', { pattern: 'foo' })
+			expect(searchResult).toContain(
+				'Error: search_dom and read_dom are only available inside an AI session.'
+			)
+			expect(searchResult).toContain('open the raw app preview')
+			const readResult = await callGlobalTool('read_dom', {})
+			expect(readResult).toContain(
+				'Error: search_dom and read_dom are only available inside an AI session.'
+			)
+		})
+
+		it('dispatches search_dom to the handler with a search query', async () => {
+			const handler = vi.fn(async () => ({
+				aiResult:
+					'Live DOM for selector "button": Found 1 matching line(s):\n3: <button>Go</button>',
+				uiMessage: 'Searched app DOM',
+				toolResult: 'match'
+			}))
+			setGetDomHandler(handler)
+			const result = await callGlobalTool(
+				'search_dom',
+				{ selector: 'button', pattern: 'Go', ignore_case: true },
+				toolCallbacks,
+				{ sessionId: 'sess-dom' }
+			)
+			expect(result).toContain('Found 1 matching line(s)')
+			expect(handler).toHaveBeenCalledWith({
+				sessionId: 'sess-dom',
+				query: { mode: 'search', selector: 'button', pattern: 'Go', ignoreCase: true }
+			})
+		})
+
+		it('dispatches read_dom to the handler with a read query (whole-page when no selector)', async () => {
+			const handler = vi.fn(async () => ({
+				aiResult: 'Live DOM for whole page (<body>): Showing lines 1-1 of 1.',
+				uiMessage: 'Read app DOM',
+				toolResult: 'dom'
+			}))
+			setGetDomHandler(handler)
+			await callGlobalTool('read_dom', { start_line: 2, end_line: 40 }, toolCallbacks, {
+				sessionId: 'sess-dom'
+			})
+			expect(handler).toHaveBeenCalledWith({
+				sessionId: 'sess-dom',
+				query: { mode: 'read', selector: undefined, startLine: 2, endLine: 40 }
+			})
+		})
+	})
 })
 
 describe('session-only preview tools gating', () => {
@@ -3746,6 +3803,8 @@ describe('session-only preview tools gating', () => {
 		expect(names).not.toContain('get_preview_status')
 		expect(names).not.toContain('get_app_runtime_logs')
 		expect(names).not.toContain('list_app_runs')
+		expect(names).not.toContain('search_dom')
+		expect(names).not.toContain('read_dom')
 		// other tools are still present
 		expect(names).toContain('write_script')
 	})
@@ -3756,9 +3815,11 @@ describe('session-only preview tools gating', () => {
 		expect(names).toContain('get_preview_status')
 		expect(names).toContain('get_app_runtime_logs')
 		expect(names).toContain('list_app_runs')
+		expect(names).toContain('search_dom')
+		expect(names).toContain('read_dom')
 		// The session set is the full globalTools minus capability-gated tools:
 		// this environment is not Chromium, so take_screenshot is withheld (DOM
-		// capture is only faithful on Blink).
+		// capture is only faithful on Blink). search_dom / read_dom are not gated.
 		expect(names).not.toContain('take_screenshot')
 		expect(names.length).toBe(globalTools.length - 1)
 	})
@@ -3788,6 +3849,26 @@ describe('session-only preview tools gating', () => {
 		expect(on).toContain('open_preview')
 		expect(on).toContain('get_app_runtime_logs')
 		expect(on).toContain('list_app_runs')
+		expect(off).not.toContain('search_dom')
+		expect(on).toContain('search_dom')
+		expect(on).toContain('read_dom')
+	})
+
+	it('renders a SELECTED DOM ELEMENTS block for app_dom_selector context', () => {
+		const message = prepareGlobalUserMessage('Fix the button', [
+			{
+				type: 'app_dom_selector',
+				selector: 'div.card > button.primary',
+				appPath: 'u/admin/my_app',
+				title: 'button.primary',
+				tagName: 'button',
+				className: 'primary'
+			}
+		])
+		const content = message.content as string
+		expect(content).toContain('## SELECTED DOM ELEMENTS')
+		expect(content).toContain('div.card > button.primary')
+		expect(content).toContain('search_dom')
 	})
 
 	// The instruction headers are matched by their distinctive parenthetical so the
diff --git a/frontend/src/lib/components/copilot/chat/global/core.ts b/frontend/src/lib/components/copilot/chat/global/core.ts
index 28c594a1e6..23f0166033 100644
--- a/frontend/src/lib/components/copilot/chat/global/core.ts
+++ b/frontend/src/lib/components/copilot/chat/global/core.ts
@@ -46,6 +46,7 @@ import {
 } from '$lib/components/raw_apps/templates'
 import { DEFAULT_DATA as DEFAULT_RAW_APP_DATA } from '$lib/components/raw_apps/dataTableRefUtils'
 import { appSourceToDraftValue } from '$lib/components/raw_apps/rawAppDraftValue'
+import type { RawAppDomQuery } from '$lib/components/raw_apps/rawAppDom'
 import { dataUrlToImagePart, normalizeImageDataUrl, type AttachedImage } from '../imageUtils'
 import { modelSupportsVision } from '../../modelConfig'
 import { tryGetCurrentModel } from '$lib/aiStore'
@@ -813,6 +814,42 @@ const listAppRunsSchema = z.object({
 		.describe('How many of the most recent backend runs to return, newest first. Defaults to 20.')
 })
 
+const domSelectorField = z
+	.string()
+	.optional()
+	.describe(
+		'CSS selector for the element to inspect in the live raw app preview. Omit to target the whole page (<body>). Prefer a selector from a DOM element chip the user attached. If it matches several elements, the first is used.'
+	)
+
+const domAppPathField = z
+	.string()
+	.optional()
+	.describe(
+		"Raw-app path of the element, from its `app_path` in the SELECTED DOM ELEMENTS block. Pass it so the RIGHT app's preview is read even if another preview tab is now visible; omit to use the currently active preview. If that app's preview has been closed, the tool says so."
+	)
+
+const searchDomSchema = z.object({
+	app_path: domAppPathField,
+	selector: domSelectorField,
+	pattern: z.string().describe('JavaScript regular expression to search the rendered HTML for.'),
+	ignore_case: z.boolean().optional().describe('Case-insensitive matching. Defaults to false.')
+})
+
+const readDomSchema = z.object({
+	app_path: domAppPathField,
+	selector: domSelectorField,
+	start_line: z
+		.number()
+		.int()
+		.optional()
+		.describe('1-based first line of the pretty-printed HTML to read. Defaults to 1.'),
+	end_line: z
+		.number()
+		.int()
+		.optional()
+		.describe('1-based last line to read. The window is capped at 200 lines.')
+})
+
 const takeScreenshotSchema = z.object({})
 
 const FRAMEWORK_KEYS = [
@@ -950,6 +987,7 @@ ${pipelineBullet}
 - Building a data pipeline: call open_preview(kind="pipeline", path="<folder>") as the FIRST step, before creating any node — this opens the pipeline editor the user reviews in. path is the folder, not an item; an empty or not-yet-created folder is fine (create_folder first if needed, then open it). Opening it registers build_pipeline_node / edit_pipeline_node — use ONLY those to add or change pipeline nodes, never write_script for a pipeline node — they apply directly as unsaved drafts on the canvas (no separate accept/reject step) that the user reviews and deploys. Do not write pipeline scripts without first opening the editor.`
 				}
 - When debugging a running raw app, call get_app_runtime_logs to read the live preview's browser console output. It needs the raw app preview open (open_preview kind="raw_app").
+- To inspect what actually rendered in a running raw app (verify an edit landed on screen, diagnose a blank/empty or wrong view, answer "what's showing"), use search_dom (regex over the live HTML) and read_dom (a line-numbered window). Pass a \`selector\` to scope to an element — prefer the selector from a DOM element chip the user attached — or omit it for the whole page. When a chip lists an \`app_path\`, pass it too so the RIGHT app is read (several previews can be open; a query without \`app_path\` hits the visible one). The DOM is read live and is never in context; no match means the element isn't rendered. Both need the raw app preview open.
 - get_app_runtime_logs only shows the app's browser console. For the server-side logs of a backend runnable the app invoked (a backend.<id> call), call list_app_runs to get that run's job_id from the live preview, then get_job_logs with it. Use this when a backend call errors or returns something unexpected.
 ${
 	isChromiumBrowser()
@@ -2945,6 +2983,60 @@ export const globalTools: Tool<{}>[] = [
 			return result.aiResult
 		}
 	},
+	{
+		def: createToolDef(
+			searchDomSchema,
+			'search_dom',
+			'Search the live rendered HTML of the raw app preview open in this AI session with a regex, returning matching lines with their line numbers. Use it to check what actually rendered (verify an edit landed, diagnose a blank/empty view). Scope to an element with `selector`, or omit it for the whole page. The DOM is read live, so it reflects the current state.'
+		),
+		showDetails: true,
+		fn: async (ctx) => {
+			const parsed = searchDomSchema.parse(ctx.args)
+			ctx.toolCallbacks.setToolStatus(ctx.toolId, { content: 'Searching app DOM...' })
+			const result = await getSessionDom(
+				{
+					mode: 'search',
+					appPath: parsed.app_path,
+					selector: parsed.selector,
+					pattern: parsed.pattern,
+					ignoreCase: parsed.ignore_case
+				},
+				sessionIdFromCtx(ctx)
+			)
+			ctx.toolCallbacks.setToolStatus(ctx.toolId, {
+				content: result.uiMessage,
+				result: result.toolResult
+			})
+			return result.aiResult
+		}
+	},
+	{
+		def: createToolDef(
+			readDomSchema,
+			'read_dom',
+			'Read a bounded window of the live rendered HTML of the raw app preview open in this AI session, pretty-printed and line-numbered. Scope to an element with `selector`, or omit it for the whole page. Use search_dom first to locate content, then read_dom to see a specific region. The DOM is read live.'
+		),
+		showDetails: true,
+		fn: async (ctx) => {
+			const parsed = readDomSchema.parse(ctx.args)
+			ctx.toolCallbacks.setToolStatus(ctx.toolId, { content: 'Reading app DOM...' })
+			const result = await getSessionDom(
+				{
+					mode: 'read',
+					appPath: parsed.app_path,
+					selector: parsed.selector,
+					startLine: parsed.start_line,
+					endLine: parsed.end_line
+				},
+				sessionIdFromCtx(ctx)
+			)
+			ctx.toolCallbacks.setToolStatus(ctx.toolId, {
+				content: result.uiMessage,
+				result: result.toolResult
+			})
+			return result.aiResult
+		}
+	},
 	{
 		def: createToolDef(
 			takeScreenshotSchema,
@@ -3011,6 +3103,8 @@ export const SESSION_PREVIEW_TOOL_NAMES = new Set([
 	'close_page',
 	'get_app_runtime_logs',
 	'list_app_runs',
+	'search_dom',
+	'read_dom',
 	'take_screenshot',
 	'create_artifact',
 	'update_artifact',
@@ -3257,6 +3351,32 @@ function getSessionAppRuns(
 	return Promise.resolve(listAppRunsHandler({ sessionId, limit }))
 }
 
+export type GetDomHandler = (req: {
+	sessionId: string | undefined
+	query: RawAppDomQuery
+}) => Promise<SessionToolResult>
+
+let getDomHandler: GetDomHandler | undefined
+
+export function setGetDomHandler(handler: GetDomHandler | undefined): void {
+	getDomHandler = handler
+}
+
+function getSessionDom(
+	query: RawAppDomQuery,
+	sessionId: string | undefined
+): Promise<SessionToolResult> {
+	if (!getDomHandler) {
+		return Promise.resolve({
+			aiResult:
+				'Error: search_dom and read_dom are only available inside an AI session. Tell the user the rendered DOM can only be read from a session preview, or switch to a session and open the raw app preview.',
+			uiMessage: 'DOM unavailable',
+			toolResult: 'DOM unavailable'
+		})
+	}
+	return getDomHandler({ sessionId, query })
+}
+
 export type SessionScreenshotResult = { dataUrl?: string; error?: string; uiMessage?: string }
 export type ScreenshotHandler = (req: {
 	sessionId: string | undefined
@@ -5392,6 +5512,17 @@ export function prepareGlobalUserMessage(
 		content += '\n'
 	}
 
+	const domSelectors = selectedContext.filter((c) => c.type === 'app_dom_selector')
+	if (domSelectors.length > 0) {
+		content += '## SELECTED DOM ELEMENTS\n'
+		content +=
+			"The user pointed at these elements in the live raw app preview. Their HTML is not included here — inspect it live with search_dom / read_dom, passing the element's `app_path` and `selector` so the right app's preview is read.\n"
+		for (const el of domSelectors) {
+			content += `- ${el.title} — app_path: ${el.appPath}, selector: ${el.selector}\n`
+		}
+		content += '\n'
+	}
+
 	content += `## INSTRUCTIONS:\n${instructions}`
 
 	const images = options.images ?? []
diff --git a/frontend/src/lib/components/raw_apps/InlineElementPrompt.svelte b/frontend/src/lib/components/raw_apps/InlineElementPrompt.svelte
new file mode 100644
index 0000000000..33a6617ace
--- /dev/null
+++ b/frontend/src/lib/components/raw_apps/InlineElementPrompt.svelte
@@ -0,0 +1,74 @@
+<script lang="ts">
+	import autosize from '$lib/autosize'
+	import { Button } from '$lib/components/common'
+	import { ArrowUp } from 'lucide-svelte'
+
+	let {
+		x,
+		y,
+		label,
+		onSend,
+		onClose
+	}: {
+		/** Fixed-position anchor (host viewport coords), top-left of the input. */
+		x: number
+		y: number
+		/** Short element label shown as the placeholder hint (e.g. "button.btn"). */
+		label: string
+		onSend: (prompt: string) => void
+		onClose: () => void
+	} = $props()
+
+	let value = $state('')
+	let textarea = $state<HTMLTextAreaElement | undefined>(undefined)
+
+	// Focus when the anchor first appears (the element was just selected).
+	$effect(() => {
+		textarea?.focus()
+	})
+
+	function submit() {
+		const v = value.trim()
+		if (!v) return
+		onSend(v)
+		value = ''
+	}
+</script>
+
+<!-- Floating mini-composer anchored to the selected element in the preview. Sends
+     the prompt to the session chat with that element as context. -->
+<!-- The whole pill is the field: the border/focus-ring lives on this box and the
+     send arrow sits inside it, centered against a single-line input. -->
+<div
+	class="fixed z-[10000] flex items-center gap-1 rounded-md border border-border-light bg-surface-input py-1 pl-1 pr-1 shadow-md transition-colors focus-within:border-border-selected"
+	style="left: {x}px; top: {y}px; width: 260px; max-width: calc(100vw - 16px);"
+	role="dialog"
+	aria-label="Prompt about the selected element"
+>
+	<textarea
+		bind:this={textarea}
+		bind:value
+		use:autosize={{ maxHeight: '120px', minHeight: 20 }}
+		rows={1}
+		placeholder={`Ask about ${label}…`}
+		class="min-w-0 flex-1 resize-none !border-0 !bg-transparent !shadow-none px-1.5 !pt-[5px] !pb-[3px] text-xs leading-tight !ring-0 focus:!border-0 focus:!ring-0 focus:outline-none"
+		onkeydown={(e) => {
+			if (e.key === 'Enter' && !e.shiftKey) {
+				e.preventDefault()
+				submit()
+			} else if (e.key === 'Escape') {
+				e.preventDefault()
+				onClose()
+			}
+		}}
+	></textarea>
+	<Button
+		size="xs2"
+		variant="accent"
+		iconOnly
+		startIcon={{ icon: ArrowUp }}
+		disabled={value.trim().length === 0}
+		on:click={submit}
+		title="Send"
+	/>
+</div>
diff --git a/frontend/src/lib/components/raw_apps/RawAppEditor.svelte b/frontend/src/lib/components/raw_apps/RawAppEditor.svelte
index f97bef9706..0ef8ac5a58 100644
--- a/frontend/src/lib/components/raw_apps/RawAppEditor.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppEditor.svelte
@@ -26,6 +26,8 @@
 		type RawAppRunsProvider,
 		type RawAppScreenshotRequester
 	} from './utils'
+	import { runDomQueryOnHtml, type RawAppDomQuery, type RawAppDomRequester } from './rawAppDom'
+	import InlineElementPrompt from './InlineElementPrompt.svelte'
 	import DarkModeObserver from '../DarkModeObserver.svelte'
 	import RawAppSidebar from './RawAppSidebar.svelte'
 	import type { Modules } from './RawAppModules.svelte'
@@ -127,6 +129,20 @@
 		onOpenOthersDrafts?: () => void
 		onRuntimeLogRequester?: (requester: RawAppRuntimeLogRequester | undefined) => void
 		onRunsProvider?: (provider: RawAppRunsProvider | undefined) => void
+		// Session preview only: expose a live DOM query requester (search/read the
+		// rendered preview by CSS selector) and forward inspector element picks so
+		// they can be attached to the session chat as selector context chips.
+		onDomRequester?: (requester: RawAppDomRequester | undefined) => void
+		// `additive` (Shift held) adds to the selection; otherwise it replaces it.
+		onInspectorSelect?: (info: InspectorElementInfo, additive: boolean) => void
+		// Session preview only: the chat's current DOM-selector chips (source of
+		// truth). Pushed into the preview so it renders one highlight per selector.
+		selectedDomSelectors?: string[]
+		onInspectorDeselect?: (selector: string) => void
+		onInspectorClearAll?: () => void
+		// Session preview only: send a prompt scoped to a selected element (via the
+		// inline mini-composer anchored over it in the preview).
+		onInlinePrompt?: (selector: string, prompt: string) => void
 		onScreenshotRequester?: (requester: RawAppScreenshotRequester | undefined) => void
 		// Restoring an older deployment from the history drawer. A callback prop
 		// (not `on:restore` forwarding): forwarding a `createEventDispatcher`
@@ -169,6 +185,12 @@
 		onOpenOthersDrafts,
 		onRuntimeLogRequester = undefined,
 		onRunsProvider = undefined,
+		onDomRequester = undefined,
+		onInspectorSelect = undefined,
+		selectedDomSelectors = [],
+		onInspectorDeselect = undefined,
+		onInspectorClearAll = undefined,
+		onInlinePrompt = undefined,
 		onScreenshotRequester = undefined,
 		onRestore,
 		onSavedNewAppPath,
@@ -1151,11 +1173,24 @@
 		// Inspector events come exclusively from the preview iframe.
 		if (fromPreview && e.data.type === 'inspectorSelect') {
 			inspectorElement = e.data.element as InspectorElementInfo
-			inspectorEnabled = false
+			// Session preview: forward the pick so it can be attached to the chat as a
+			// selector context chip (the app-mode SelectedContext path is separate).
+			// App mode picks one element then exits; the session stays on to keep
+			// picking (the chip list, not the harness, holds the selection). Shift
+			// held → add to the selection; a plain click replaces it.
+			if (onInspectorSelect) onInspectorSelect(inspectorElement, !!e.data.additive)
+			else inspectorEnabled = false
+			return
+		}
+		if (fromPreview && e.data.type === 'inspectorDeselect') {
+			// User clicked × on a selected overlay in the preview — drop that chip.
+			if (typeof e.data.selector === 'string') onInspectorDeselect?.(e.data.selector)
 			return
 		}
 		if (fromPreview && e.data.type === 'inspectorClear') {
 			inspectorElement = undefined
+			// A rebuild invalidates the selection — clear all session chips.
+			onInspectorClearAll?.()
 			return
 		}
 
@@ -1338,6 +1373,172 @@
 		})
 	}
 
+	// Live DOM inspection for the session chat. Same-origin: the preview iframe is a
+	// same-origin document (see the load listener below that reads its contentWindow),
+	// so we read `contentDocument` directly — no postMessage, no ui_builder change. The
+	// element is re-read on every call, so the model always sees the current render.
+	const requestDomQuery: RawAppDomRequester = async (query: RawAppDomQuery) => {
+		const doc = previewIframe?.contentDocument
+		if (!doc || !previewIframeLoaded) return undefined
+		const selector = query.selector?.trim()
+		let el: Element | null
+		let matchCount: number
+		if (selector) {
+			let matches: NodeListOf<Element>
+			try {
+				matches = doc.querySelectorAll(selector)
+			} catch (e) {
+				return {
+					text: `Invalid CSS selector "${selector}": ${e instanceof Error ? e.message : String(e)}`
+				}
+			}
+			matchCount = matches.length
+			el = matches[0] ?? null
+		} else {
+			el = doc.body
+			matchCount = el ? 1 : 0
+		}
+		if (!el) {
+			return {
+				text: `No element matches selector "${selector}". It may not be rendered yet, or the selector is wrong. Try a broader selector or omit it to read the whole page.`
+			}
+		}
+		// A <script> is source the browser executes, not rendered output; an
+		// `.inspector-label` is chrome this inspector injects. The descendant strips
+		// below can't reach either when it IS the clone root (querySelectorAll skips
+		// the root), so reject such a root here — otherwise a `script` query would
+		// serialize the whole compiled bundle and an `.inspector-label` query would
+		// return inspector chrome.
+		if (el.tagName.toLowerCase() === 'script') {
+			return {
+				text: `The "${selector}" selector matches a <script> element — source code the browser executes, not rendered output. Omit the selector to read the whole page, or target a rendered element.`
+			}
+		}
+		if (el.classList.contains('inspector-label')) {
+			return {
+				text: `The "${selector}" selector matches an inspector label — UI chrome injected by the element picker, not part of the app. Target a rendered app element instead.`
+			}
+		}
+		// Strip the inspector's own artifacts so the model never sees them: the
+		// label pills it injects into <body>, and the outline classes it adds to
+		// app elements (highlights are element outlines, not overlay nodes).
+		const clone = el.cloneNode(true) as Element
+		// The preview harness appends the compiled app bundle as a <script> under
+		// <body>. It is source, not rendered output: serializing it would let
+		// search_dom match strings that exist only in source and pollute / truncate
+		// read_dom's line window with bundle JS. Drop every script from the clone.
+		clone.querySelectorAll('script').forEach((n) => n.remove())
+		clone.querySelectorAll('.inspector-label').forEach((n) => n.remove())
+		// The outline classes sit on the selected element itself (the clone root),
+		// not only its descendants — querySelectorAll skips the root, so strip it too.
+		clone.classList.remove('inspector-hover', 'inspector-picked')
+		clone
+			.querySelectorAll('.inspector-hover, .inspector-picked')
+			.forEach((n) => n.classList.remove('inspector-hover', 'inspector-picked'))
+		const text = await runDomQueryOnHtml(clone.outerHTML, query, {
+			selector: selector ?? 'body',
+			tagName: el.tagName.toLowerCase(),
+			matchCount
+		})
+		return { text }
+	}
+
+	// ---- Inline "prompt this element" mini-composer (session preview only) ----
+	// Anchored over the most-recently selected element in the live preview. It's a
+	// host overlay (position: fixed in the top document) computed from the element's
+	// rect inside the same-origin preview iframe, repositioned as the preview scrolls.
+	let inlinePromptDismissed = $state(false)
+	let inlinePromptPos = $state<{ x: number; y: number } | undefined>(undefined)
+	let inlinePromptLabel = $state('')
+	const inlinePromptSelector = $derived(
+		onInlinePrompt && selectedDomSelectors.length > 0
+			? selectedDomSelectors[selectedDomSelectors.length - 1]
+			: undefined
+	)
+
+	function shortElementLabel(el: Element): string {
+		const tag = el.tagName.toLowerCase()
+		const id = el.id ? `#${el.id}` : ''
+		const cls =
+			typeof el.className === 'string'
+				? el.className
+						.trim()
+						.split(/\s+/)
+						.filter((c) => c && !c.startsWith('inspector-'))[0]
+				: undefined
+		return `${tag}${id}${cls ? `.${cls}` : ''}`
+	}
+
+	function updateInlinePromptPos() {
+		const sel = inlinePromptSelector
+		const doc = previewIframe?.contentDocument
+		if (!sel || !doc || !previewIframeLoaded || inlinePromptDismissed) {
+			inlinePromptPos = undefined
+			return
+		}
+		let el: Element | null
+		try {
+			el = doc.querySelector(sel)
+		} catch (_) {
+			el = null
+		}
+		if (!el) {
+			inlinePromptPos = undefined
+			return
+		}
+		const r = el.getBoundingClientRect()
+		const ir = previewIframe!.getBoundingClientRect()
+		// Hide while the element is scrolled outside the preview's visible area.
+		if (r.bottom < 0 || r.top > ir.height || r.right < 0 || r.left > ir.width) {
+			inlinePromptPos = undefined
+			return
+		}
+		const inputW = 260
+		const inputH = 42
+		// The harness draws the element's name+size pill ~20px above its top edge;
+		// clear it so the input sits above the label rather than covering it.
+		const labelGutter = 16
+		let top = ir.top + r.top - inputH - labelGutter
+		// No room above → drop it just below the element's top edge instead (the
+		// label is above the element, so this still doesn't cover it).
+		if (top < ir.top + 4) top = ir.top + Math.max(r.top, 0) + 4
+		// Anchored to the element's top-left edge (aligned with the name+size pill),
+		// clamped to the viewport.
+		let left = ir.left + r.left
+		left = Math.max(4, Math.min(left, window.innerWidth - inputW - 4))
+		inlinePromptPos = { x: left, y: top }
+		inlinePromptLabel = shortElementLabel(el)
+	}
+
+	// Reset the dismissed flag whenever the anchored element changes.
+	$effect(() => {
+		inlinePromptSelector
+		untrack(() => {
+			inlinePromptDismissed = false
+		})
+	})
+
+	$effect(() => {
+		// Recompute on selection change, preview (re)load, or dismiss; and keep the
+		// overlay pinned as the preview (or the host) scrolls/resizes.
+		inlinePromptSelector
+		selectedDomSelectors
+		previewIframeLoaded
+		inlinePromptDismissed
+		updateInlinePromptPos()
+		if (!previewIframe || !previewIframeLoaded) return
+		const win = previewIframe.contentWindow
+		const onScroll = () => updateInlinePromptPos()
+		win?.addEventListener('scroll', onScroll, true)
+		window.addEventListener('scroll', onScroll, true)
+		window.addEventListener('resize', onScroll)
+		return () => {
+			win?.removeEventListener('scroll', onScroll, true)
+			window.removeEventListener('scroll', onScroll, true)
+			window.removeEventListener('resize', onScroll)
+		}
+	})
+
 	const getRuns: RawAppRunsProvider = () => {
 		const out: RawAppRunSummary[] = []
 		for (const id of jobs) {
@@ -1466,10 +1667,12 @@
 	onMount(() => {
 		onRuntimeLogRequester?.(requestRuntimeLogs)
 		onRunsProvider?.(getRuns)
+		onDomRequester?.(requestDomQuery)
 		onScreenshotRequester?.(captureScreenshot)
 		return () => {
 			onRuntimeLogRequester?.(undefined)
 			onRunsProvider?.(undefined)
+			onDomRequester?.(undefined)
 			onScreenshotRequester?.(undefined)
 			for (const requestId of Array.from(pendingRuntimeLogReqs.keys()))
 				resolvePendingRuntimeLogRequest(requestId, undefined)
@@ -1511,7 +1714,10 @@
 			previewIframe?.contentWindow?.addEventListener(
 				'keydown',
 				(e) => {
-					if (e.key === 'Escape' && (inspectorEnabled || inspectorElement)) {
+					if (
+						e.key === 'Escape' &&
+						(inspectorEnabled || inspectorElement || selectedDomSelectors.length > 0)
+					) {
 						disableInspector()
 					}
 				},
@@ -1536,6 +1742,18 @@
 			iframe.contentWindow?.postMessage({ type: 'setFontSize', px: editorFontSize }, '*')
 		}
 	})
+	$effect(() => {
+		// Push the chat's DOM-selector chips into the preview (source of truth):
+		// the harness renders one highlight per selector. Re-posts on every
+		// selection change and on preview (re)load.
+		const selectors = selectedDomSelectors
+		if (previewIframe && previewIframeLoaded) {
+			previewIframe.contentWindow?.postMessage(
+				{ type: 'inspectorSetSelection', selectors: [...selectors] },
+				'*'
+			)
+		}
+	})
 	$effect(() => {
 		iframe && iframeLoaded && files && populateFiles()
 	})
@@ -1693,8 +1911,11 @@
 	function disableInspector() {
 		// Picking an element auto-clears `inspectorEnabled`, so Escape after a
 		// pick gets here with hover already off but the green selection still
-		// up. Bail only when there is genuinely nothing to dismiss.
-		if (!inspectorEnabled && !inspectorElement) return
+		// up. In a session the chat's DOM chips are the source of truth for the
+		// selection (highlights + the inline prompt), so a chip-only selection
+		// (picking already toggled off) must still be dismissable. Bail only
+		// when there is genuinely nothing to dismiss.
+		if (!inspectorEnabled && !inspectorElement && selectedDomSelectors.length === 0) return
 		inspectorEnabled = false
 		// `inspectorDisable` only stops hover/click; the green "selected"
 		// overlay from a prior pick persists until we explicitly clear it.
@@ -1702,6 +1923,12 @@
 		previewIframe?.contentWindow?.postMessage({ type: 'inspectorDisable' }, '*')
 		previewIframe?.contentWindow?.postMessage({ type: 'inspectorClear' }, '*')
 		inspectorElement = undefined
+		// Session mode: clear the chips too. Emptying the selection hides the
+		// inline prompt (it's driven by the chips) and drops the highlights (the
+		// push effect re-posts the now-empty set) — otherwise the overlays clear
+		// but the chips + inline prompt stay stranded.
+		onInspectorClearAll?.()
+		inlinePromptDismissed = true
 	}
 
 	// Escape exits inspect mode. We listen in the capture phase because a global
@@ -1709,7 +1936,10 @@
 	// iframe (separate document) is covered by its own listener on load.
 	$effect(() => {
 		const onEscapeCapture = (e: KeyboardEvent) => {
-			if (e.key === 'Escape' && (inspectorEnabled || inspectorElement)) {
+			if (
+				e.key === 'Escape' &&
+				(inspectorEnabled || inspectorElement || selectedDomSelectors.length > 0)
+			) {
 				disableInspector()
 				e.stopImmediatePropagation()
 				e.preventDefault()
@@ -2037,13 +2267,17 @@
 													: 'cursor-pointer bg-surface hover:bg-surface-hover border border-border-light text-primary w-7 h-7 rounded-md inline-flex items-center justify-center'}
 												aria-label="Toggle element inspector"
 												onclick={() => {
-													inspectorEnabled = !inspectorEnabled
-													previewIframe?.contentWindow?.postMessage(
-														{
-															type: inspectorEnabled ? 'inspectorEnable' : 'inspectorDisable'
-														},
-														'*'
-													)
+													if (inspectorEnabled) {
+														// Turning off is a full exit: stop picking and clear the
+														// selection + inline prompt (mirrors Escape).
+														disableInspector()
+													} else {
+														inspectorEnabled = true
+														previewIframe?.contentWindow?.postMessage(
+															{ type: 'inspectorEnable' },
+															'*'
+														)
+													}
 												}}
 											>
 												<MousePointerSquareDashed size={14} />
@@ -2167,6 +2401,24 @@
 	</div>
 </div>
 
+{#if inlinePromptPos && inlinePromptSelector && onInlinePrompt}
+	<!-- Key on the selector so selecting a different element remounts the input
+	     (fresh value + autofocus); repositioning on scroll keeps the same key so
+	     it never steals focus mid-scroll. -->
+	{#key inlinePromptSelector}
+		<InlineElementPrompt
+			x={inlinePromptPos.x}
+			y={inlinePromptPos.y}
+			label={inlinePromptLabel}
+			onSend={(prompt) => {
+				onInlinePrompt?.(inlinePromptSelector!, prompt)
+				inlinePromptDismissed = true
+			}}
+			onClose={() => (inlinePromptDismissed = true)}
+		/>
+	{/key}
+{/if}
+
 <style>
 	/* Remove the splitter from the inner content-area Splitpanes when we're
 	   not actually in split-with-preview mode (one pane is at 0%). The user
diff --git a/frontend/src/lib/components/raw_apps/rawAppDom.test.ts b/frontend/src/lib/components/raw_apps/rawAppDom.test.ts
new file mode 100644
index 0000000000..4b912069c7
--- /dev/null
+++ b/frontend/src/lib/components/raw_apps/rawAppDom.test.ts
@@ -0,0 +1,100 @@
+import { describe, expect, it } from 'vitest'
+import { prettyPrintHtml, runDomQueryOnHtml } from './rawAppDom'
+
+describe('prettyPrintHtml', () => {
+	it('breaks a single-line subtree into indented lines', () => {
+		const out = prettyPrintHtml('<div><button id="a">Go</button></div>')
+		expect(out).toBe(['<div>', '  <button id="a">Go</button>', '</div>'].join('\n'))
+	})
+
+	it('nests deeper for block children', () => {
+		const out = prettyPrintHtml('<ul><li>one</li><li>two</li></ul>')
+		expect(out).toBe(['<ul>', '  <li>one</li>', '  <li>two</li>', '</ul>'].join('\n'))
+	})
+
+	it('does not let void elements drift the indentation', () => {
+		// <img>/<input> have no closing tag; they must not increase depth.
+		const out = prettyPrintHtml('<div><img src="x"><input type="text"><button>Go</button></div>')
+		expect(out).toBe(
+			['<div>', '  <img src="x">', '  <input type="text">', '  <button>Go</button>', '</div>'].join(
+				'\n'
+			)
+		)
+	})
+})
+
+const META = { selector: 'div', tagName: 'div', matchCount: 1 }
+
+describe('runDomQueryOnHtml', () => {
+	it('searches the rendered HTML and returns matching line numbers', async () => {
+		const text = await runDomQueryOnHtml(
+			'<div><button id="a">Go</button></div>',
+			{
+				mode: 'search',
+				pattern: 'Go'
+			},
+			META
+		)
+		expect(text).toContain('Found 1 matching line(s)')
+		expect(text).toContain('Go')
+	})
+
+	it('reports no matches without throwing', async () => {
+		const text = await runDomQueryOnHtml(
+			'<div>hello</div>',
+			{
+				mode: 'search',
+				pattern: 'zzz-not-there'
+			},
+			META
+		)
+		expect(text).toContain('No matches')
+	})
+
+	it('reads a bounded, line-numbered window', async () => {
+		const text = await runDomQueryOnHtml(
+			'<div><button id="a">Go</button></div>',
+			{
+				mode: 'read'
+			},
+			META
+		)
+		expect(text).toContain('Showing lines 1-3 of 3')
+		expect(text).toContain('<button')
+	})
+
+	it('paginates a long read with a read_dom (not read_file) continuation note', async () => {
+		const items = Array.from({ length: 300 }, (_, i) => `<li>item ${i}</li>`).join('')
+		const text = await runDomQueryOnHtml(`<ul>${items}</ul>`, { mode: 'read' }, META)
+		expect(text).toMatch(/start_line=/)
+		expect(text).toContain('read_dom')
+		expect(text).not.toContain('read_file')
+	})
+
+	// Following a continuation note that omits the scope would silently re-read the
+	// active app's whole body instead of the element the read was paginating through.
+	it('repeats app_path and selector in the pagination note of a scoped read', async () => {
+		const items = Array.from({ length: 300 }, (_, i) => `<li>item ${i}</li>`).join('')
+		const text = await runDomQueryOnHtml(
+			`<ul>${items}</ul>`,
+			{ mode: 'read', appPath: 'f/app', selector: 'ul.list' },
+			META
+		)
+		expect(text).toMatch(
+			/Call read_dom again with app_path="f\/app", selector="ul.list", start_line=\d+/
+		)
+	})
+
+	it('notes when a selector matched multiple elements', async () => {
+		const text = await runDomQueryOnHtml(
+			'<button>a</button>',
+			{ mode: 'read' },
+			{
+				selector: 'button',
+				tagName: 'button',
+				matchCount: 3
+			}
+		)
+		expect(text).toContain('3 elements match')
+	})
+})
diff --git a/frontend/src/lib/components/raw_apps/rawAppDom.ts b/frontend/src/lib/components/raw_apps/rawAppDom.ts
new file mode 100644
index 0000000000..d76aba4b16
--- /dev/null
+++ b/frontend/src/lib/components/raw_apps/rawAppDom.ts
@@ -0,0 +1,184 @@
+/**
+ * Live DOM inspection for a raw-app preview, exposed to the AI session chat.
+ *
+ * The rendered app is NEVER inlined into the model's context. Instead a selected
+ * element is referenced by its CSS selector, and the model pulls only the slices it
+ * needs through the `search_dom` / `read_dom` tools — mirroring the attached-files
+ * design (see ../copilot/chat/files/fileTools.ts). The element's current `outerHTML`
+ * is re-read live on every call (host-side, same-origin), pretty-printed to lines,
+ * and run through the same bounded, worker-guarded engine the file tools use.
+ */
+import {
+	buildLineIndex,
+	numberLines,
+	readFile,
+	searchFilesInWorker,
+	type FileEntry,
+	type SearchHit
+} from '../copilot/chat/files/fileEngine'
+
+/** Regex search over a selected element's rendered HTML. */
+export type RawAppDomSearchQuery = {
+	mode: 'search'
+	/** Raw-app path to read from. Routes the query to that app's (still-mounted)
+	 * preview even when another tab is visible; omit to use the active preview. */
+	appPath?: string
+	/** CSS selector; omit for the whole `document.body`. */
+	selector?: string
+	pattern: string
+	ignoreCase?: boolean
+}
+
+/** Bounded line-window read of a selected element's rendered HTML. */
+export type RawAppDomReadQuery = {
+	mode: 'read'
+	appPath?: string
+	selector?: string
+	startLine?: number
+	endLine?: number
+}
+
+export type RawAppDomQuery = RawAppDomSearchQuery | RawAppDomReadQuery
+
+/** Formatted, model-ready text for a single DOM query. */
+export type RawAppDomResult = { text: string }
+
+/**
+ * Resolves a DOM query against the live preview. Returns `undefined` only when no
+ * preview is loaded (so the caller can distinguish "no running app" from "selector
+ * matched nothing", which is itself a useful, returned result).
+ */
+export type RawAppDomRequester = (query: RawAppDomQuery) => Promise<RawAppDomResult | undefined>
+
+/**
+ * Break a (typically single-line) `outerHTML` string into indented lines so the
+ * line-oriented file engine can search/read it meaningfully. Deliberately simple:
+ * one line per tag boundary, indented by nesting depth. It is not a faithful
+ * re-serializer (whitespace-sensitive nodes like <pre>/<textarea> are reflowed) —
+ * it exists only to give the model greppable, line-numbered structure.
+ */
+export function prettyPrintHtml(html: string): string {
+	// Split so every tag starts a new line; text between tags stays on its own line.
+	const withBreaks = html.replace(/>\s*</g, '>\n<')
+	const rawLines = withBreaks.split('\n')
+	const out: string[] = []
+	let depth = 0
+	for (const raw of rawLines) {
+		const line = raw.trim()
+		if (line === '') continue
+		const isClosing = /^<\//.test(line)
+		// A line that opens a tag but doesn't close it on the same line increases depth.
+		// Void elements (<img>, <input>, <br>…) have no closing tag, so they must not
+		// open a block — otherwise depth drifts and never recovers.
+		const opensBlock =
+			/^<[a-zA-Z]/.test(line) &&
+			!/\/>\s*$/.test(line) &&
+			!isClosing &&
+			!isVoidElement(line) &&
+			!isSelfContainedElement(line)
+		if (isClosing) depth = Math.max(0, depth - 1)
+		out.push('  '.repeat(depth) + line)
+		if (opensBlock) depth += 1
+	}
+	return out.join('\n')
+}
+
+// HTML void elements: serialized by outerHTML without a trailing slash and never
+// have a closing tag, so they are leaves for indentation purposes.
+const VOID_ELEMENTS = new Set([
+	'area',
+	'base',
+	'br',
+	'col',
+	'embed',
+	'hr',
+	'img',
+	'input',
+	'link',
+	'meta',
+	'param',
+	'source',
+	'track',
+	'wbr'
+])
+
+function isVoidElement(line: string): boolean {
+	const open = line.match(/^<([a-zA-Z][\w-]*)/)
+	return !!open && VOID_ELEMENTS.has(open[1].toLowerCase())
+}
+
+/** A single line that both opens and closes the same element (e.g. `<span>hi</span>`). */
+function isSelfContainedElement(line: string): boolean {
+	const open = line.match(/^<([a-zA-Z][\w-]*)/)
+	if (!open) return false
+	return new RegExp(`</${open[1]}\\s*>\\s*$`).test(line)
+}
+
+const DOM_ENTRY_NAME = 'dom'
+
+async function toEntry(prettyHtml: string): Promise<FileEntry> {
+	const file = new Blob([prettyHtml], { type: 'text/html' })
+	const { lineIndex, lineCount } = await buildLineIndex(file)
+	return { name: DOM_ENTRY_NAME, file, lineIndex, lineCount }
+}
+
+/** Header describing which element the result is for. */
+function header(meta: { selector: string; tagName: string; matchCount: number }): string {
+	const scope = meta.selector === 'body' ? 'whole page (<body>)' : `selector "${meta.selector}"`
+	const multi =
+		meta.matchCount > 1
+			? ` (${meta.matchCount} elements match; showing the first, <${meta.tagName}>)`
+			: ''
+	return `Live DOM for ${scope}${multi}:`
+}
+
+/** Arguments a paginating read_dom call must repeat to stay on the same element. */
+function continuationArgs(query: RawAppDomReadQuery, resumeAt: string): string {
+	const args: string[] = []
+	if (query.appPath) args.push(`app_path="${query.appPath}"`)
+	if (query.selector) args.push(`selector="${query.selector}"`)
+	args.push(`start_line=${resumeAt}`)
+	return args.join(', ')
+}
+
+/**
+ * Run a search/read query against an element's live `outerHTML`. Pure over its
+ * inputs (the DOM read happens in the caller) so it is unit-testable without a DOM.
+ */
+export async function runDomQueryOnHtml(
+	html: string,
+	query: RawAppDomQuery,
+	meta: { selector: string; tagName: string; matchCount: number }
+): Promise<string> {
+	const entry = await toEntry(prettyPrintHtml(html))
+	const head = header(meta)
+
+	if (query.mode === 'search') {
+		const result = await searchFilesInWorker([entry], query.pattern, {
+			flags: query.ignoreCase ? 'i' : ''
+		})
+		if (result.error) return `${head}\nError: ${result.error}`
+		if (result.hits.length === 0) {
+			return `${head}\nNo matches for /${query.pattern}/. Read the element with read_dom to see its structure.`
+		}
+		const body = result.hits.map((h: SearchHit) => `${h.line}: ${h.text}`).join('\n')
+		const footer = result.truncated
+			? '\n\n(Stopped at the result limit — refine your pattern.)'
+			: ''
+		return `${head}\nFound ${result.hits.length} matching line(s):\n${body}${footer}`
+	}
+
+	const res = await readFile(entry, { startLine: query.startLine, endLine: query.endLine })
+	// readFile's pagination note names read_file and carries start_line alone. read_dom
+	// is scoped: a continuation without app_path/selector re-reads the active app's whole
+	// body instead of the element, so the instruction must repeat the scope arguments.
+	const note = res.note
+		.replace(
+			/Call read_file again with start_line=(\d+) for more\./,
+			(_m: string, resumeAt: string) =>
+				`Call read_dom again with ${continuationArgs(query, resumeAt)} for more.`
+		)
+		.replace(/\bread_file\b/g, 'read_dom')
+	if (!res.text) return `${head}\n${note}`
+	return `${head}\n${note}\n\n${numberLines(res.text, res.startLine)}`
+}
diff --git a/frontend/src/lib/components/sessions/RawAppEditorView.svelte b/frontend/src/lib/components/sessions/RawAppEditorView.svelte
index d276c6a93b..a59ff5eb45 100644
--- a/frontend/src/lib/components/sessions/RawAppEditorView.svelte
+++ b/frontend/src/lib/components/sessions/RawAppEditorView.svelte
@@ -12,6 +12,8 @@
 		RawAppRunsProvider,
 		RawAppScreenshotRequester
 	} from '$lib/components/raw_apps/utils'
+	import type { RawAppDomRequester } from '$lib/components/raw_apps/rawAppDom'
+	import type { InspectorElementInfo } from '$lib/components/copilot/chat/app/core'
 
 	let {
 		runtime,
@@ -85,6 +87,116 @@
 		runtime.setAppRunsProvider(provider)
 	}
 
+	// This tab's live DOM query requester, registered in the runtime's per-app-path
+	// map below so search_dom / read_dom can reach it while it is mounted.
+	let domRequester = $state<RawAppDomRequester | undefined>(undefined)
+	function registerDomRequester(requester: RawAppDomRequester | undefined) {
+		domRequester = requester
+	}
+	// Register this tab's requester keyed by its app path. ALL mounted preview
+	// tabs register (hidden ones stay mounted), so a DOM-scoped turn reads its own
+	// app's live DOM even when another tab is visible — search_dom / read_dom route
+	// by the chip's app path.
+	$effect(() => {
+		const p = path
+		const r = domRequester
+		if (!r) return
+		runtime.registerDomRequester(p, r)
+		return () => runtime.unregisterDomRequester(p, r)
+	})
+	// The visible tab is the default target for a query that names no app path.
+	const domSlotOwner = {}
+	$effect(() => {
+		if (!active) return
+		runtime.setActiveDomApp(path, domSlotOwner)
+		return () => runtime.releaseActiveDomApp(domSlotOwner)
+	})
+
+	// An element picked in the preview inspector becomes a selector chip on the
+	// session chat (the model reads it live via search_dom / read_dom). Target
+	// this session's own manager (runtime.manager) — NOT the global singleton;
+	// the session chat is driven by the per-session AIChatManager.
+	function onInspectorSelect(info: InspectorElementInfo, additive: boolean) {
+		const el = {
+			selector: info.path,
+			// Scope the chip to THIS app: a selector only resolves against the app it
+			// was picked from, and a session can have several raw-app preview tabs.
+			appPath: path,
+			tagName: info.tagName,
+			id: info.id,
+			className: info.className
+		}
+		// Shift-click adds to the selection; a plain click replaces it (single-select).
+		if (additive) runtime.manager.contextManager.addSelectedDomElement(el)
+		else runtime.manager.contextManager.setSelectedDomElement(el)
+	}
+
+	// The chip list is the source of truth for the preview's highlights: push the
+	// current selectors down so the preview renders one highlight per chip. Only
+	// this app's chips (a foreign chip would resolve against the wrong preview).
+	const selectedDomSelectors = $derived(
+		runtime.manager.contextManager
+			.getSelectedContext()
+			.filter((c) => c.type === 'app_dom_selector')
+			.filter((c) => c.appPath === path)
+			.map((c) => c.selector)
+	)
+
+	// Chips route per app (each carries its app path) and highlights are filtered
+	// per app, so cross-app chips are technically safe. But the composer chip row
+	// shows every chip without an app label, so chips from two apps would be
+	// indistinguishable there. Keep the selection to a single app: when this tab
+	// becomes active, drop any chips belonging to a different app.
+	$effect(() => {
+		if (!active) return
+		const p = path
+		untrack(() => {
+			const foreign = runtime.manager.contextManager
+				.getSelectedContext()
+				.some((c) => c.type === 'app_dom_selector' && c.appPath !== p)
+			if (foreign) runtime.manager.contextManager.clearSelectedDomElements()
+		})
+	})
+
+	// Removals originating in the preview (× on an overlay) or on rebuild. Scope to
+	// this app: another preview tab can hold a chip with the same selector string.
+	function onInspectorDeselect(selector: string) {
+		runtime.manager.contextManager.removeSelectedDomElement(selector, path)
+	}
+	// Fired when this preview clears its inspector (toggle off, or a rebuild emits
+	// inspectorClear). Scope to this app: every mounted preview rebuilds
+	// independently, so an unscoped clear would wipe a selection made in another.
+	function onInspectorClearAll() {
+		runtime.manager.contextManager.clearSelectedDomElements(path)
+	}
+
+	// The inline mini-composer over a selected element sends a chat turn; the
+	// element is already an app_dom_selector chip, so it rides along as context.
+	// Mirror the composer: while a turn is streaming, queue it (a second concurrent
+	// sendRequest would race the shared abortController / streaming buffers) — it
+	// auto-sends when the current turn completes.
+	function onInlinePrompt(selector: string, prompt: string) {
+		// Snapshot the selection synchronously at submit time so a re-selection
+		// during the async send preflight (immediate path) or before the queue
+		// flushes (loading path) can't swap the context. Scope the DOM chips to the
+		// anchored element: the inline prompt sits over ONE element, so with several
+		// selected, drop the others (a multi-select would otherwise send every
+		// selector and the model couldn't tell which one the prompt is about).
+		// Match appPath too — selectors are generated per app and collide across
+		// them, and a restored draft can legitimately hold chips from several apps.
+		// Non-DOM context is kept.
+		const snapshot = runtime.manager.contextManager
+			.getSelectedContext()
+			.filter(
+				(c) => c.type !== 'app_dom_selector' || (c.selector === selector && c.appPath === path)
+			)
+		if (runtime.manager.loading) {
+			runtime.manager.queueMessage(prompt, [], snapshot)
+		} else {
+			void runtime.manager.sendRequest({ instructions: prompt, contextOverride: snapshot })
+		}
+	}
+
 	// The preview host keeps every opened tab mounted, so registering on mount would
 	// leave a background tab owning the runtime's single screenshot slot and
 	// take_screenshot would capture an app the user isn't looking at. Ownership
@@ -157,6 +269,12 @@
 				defaultSplitWithPreview={false}
 				onRuntimeLogRequester={registerRuntimeLogRequester}
 				onRunsProvider={registerRunsProvider}
+				onDomRequester={registerDomRequester}
+				{onInspectorSelect}
+				{selectedDomSelectors}
+				{onInspectorDeselect}
+				{onInspectorClearAll}
+				{onInlinePrompt}
 				onScreenshotRequester={registerScreenshotRequester}
 			/>
 		{/if}
diff --git a/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts b/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts
index 81abca977b..fa0dc52946 100644
--- a/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts
+++ b/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts
@@ -59,6 +59,7 @@ import {
 	setClosePreviewTabsHandler,
 	setGetPreviewStatusHandler,
 	setGetRuntimeLogsHandler,
+	setGetDomHandler,
 	setListAppRunsHandler,
 	setScreenshotHandler,
 	setOpenPagePreviewHandler,
@@ -73,6 +74,11 @@ import {
 	type RawAppRunsProvider,
 	type RawAppScreenshotRequester
 } from '$lib/components/raw_apps/utils'
+import type {
+	RawAppDomQuery,
+	RawAppDomRequester,
+	RawAppDomResult
+} from '$lib/components/raw_apps/rawAppDom'
 import { getNonStreamingMetadataCompletion } from '$lib/components/copilot/lib'
 import type { DisplayMessage } from '$lib/components/copilot/chat/shared'
 import type { ChatCompletionMessageParam } from 'openai/resources/index.mjs'
@@ -174,6 +180,15 @@ export interface SessionRuntime {
 	): Promise<void>
 	setRuntimeLogRequester(requester: RawAppRuntimeLogRequester | undefined): void
 	requestRuntimeLogs(limit: number): Promise<RawAppRuntimeLogEntry[] | undefined>
+	/** Register a mounted raw-app preview's DOM requester, keyed by app path.
+	 * ALL mounted preview tabs register (hidden ones stay mounted), so a
+	 * DOM-scoped turn can read its own app even when another tab is visible. */
+	registerDomRequester(appPath: string, requester: RawAppDomRequester): void
+	unregisterDomRequester(appPath: string, requester: RawAppDomRequester): void
+	/** The visible preview — the default target for a query with no app path. */
+	setActiveDomApp(appPath: string, owner: unknown): void
+	releaseActiveDomApp(owner: unknown): void
+	requestDom(query: RawAppDomQuery): Promise<RawAppDomResult | undefined>
 	setAppRunsProvider(provider: RawAppRunsProvider | undefined): void
 	getAppRuns(): RawAppRunSummary[] | undefined
 	setScreenshotRequester(requester: RawAppScreenshotRequester | undefined): void
@@ -451,6 +466,10 @@ function createRuntime(session: Session): SessionRuntime {
 	const pipelineEditorState = new PipelineEditorState()
 
 	let runtimeLogRequester: RawAppRuntimeLogRequester | undefined = undefined
+	// appPath → requester, one entry per mounted raw-app preview tab.
+	const domRequesters = new Map<string, RawAppDomRequester>()
+	let activeDomAppPath: string | undefined = undefined
+	let activeDomOwner: unknown = undefined
 	let appRunsProvider: RawAppRunsProvider | undefined = undefined
 	let screenshotRequester: RawAppScreenshotRequester | undefined = undefined
 
@@ -777,6 +796,43 @@ function createRuntime(session: Session): SessionRuntime {
 		async requestRuntimeLogs(limit) {
 			return runtimeLogRequester ? runtimeLogRequester(limit) : undefined
 		},
+		registerDomRequester(appPath, requester) {
+			domRequesters.set(appPath, requester)
+		},
+		unregisterDomRequester(appPath, requester) {
+			// Identity-guarded: a remount may already have replaced this entry.
+			if (domRequesters.get(appPath) === requester) domRequesters.delete(appPath)
+		},
+		setActiveDomApp(appPath, owner) {
+			activeDomAppPath = appPath
+			activeDomOwner = owner
+		},
+		releaseActiveDomApp(owner) {
+			// Owner-guarded so a set/release race between two tabs can't blank the
+			// new active app regardless of effect order.
+			if (activeDomOwner === owner) {
+				activeDomAppPath = undefined
+				activeDomOwner = undefined
+			}
+		},
+		async requestDom(query) {
+			if (domRequesters.size === 0) return undefined
+			// Route to the query's own app when specified (a DOM-scoped turn reads
+			// its element's app even when another tab is now visible), else the
+			// active preview, else the only one open.
+			const path =
+				query.appPath ??
+				activeDomAppPath ??
+				(domRequesters.size === 1 ? [...domRequesters.keys()][0] : undefined)
+			if (path === undefined) return undefined
+			const requester = domRequesters.get(path)
+			if (!requester) {
+				return {
+					text: `The preview for "${path}" is no longer open, so its DOM can't be read. Re-open that raw app in the session to inspect it.`
+				}
+			}
+			return requester(query)
+		},
 		setAppRunsProvider(provider) {
 			appRunsProvider = provider
 		},
@@ -1032,6 +1088,33 @@ setGetRuntimeLogsHandler(async ({ sessionId: callerSessionId, limit }) => {
 	}
 })
 
+setGetDomHandler(async ({ sessionId: callerSessionId, query }) => {
+	const sessionId = callerSessionId ?? sessionState.currentSessionId
+	const runtime = sessionId ? runtimes.get(sessionId) : undefined
+	if (!runtime) {
+		return {
+			aiResult:
+				'Error: search_dom and read_dom are only available inside an AI session. Tell the user the rendered DOM can only be read from a session preview, or switch to a session and open the raw app preview.',
+			uiMessage: 'DOM unavailable',
+			toolResult: 'DOM unavailable'
+		}
+	}
+	const result = await runtime.requestDom(query)
+	if (result === undefined) {
+		return {
+			aiResult:
+				'No raw app preview is running for this session, so the DOM cannot be read. Next step: call open_preview with kind="raw_app" and the app path, wait for it to load, then call search_dom or read_dom again. The DOM is read live from the running preview.',
+			uiMessage: 'DOM unavailable',
+			toolResult: 'DOM unavailable'
+		}
+	}
+	return {
+		aiResult: result.text,
+		uiMessage: query.mode === 'search' ? 'Searched app DOM' : 'Read app DOM',
+		toolResult: result.text
+	}
+})
+
 setListAppRunsHandler(({ sessionId: callerSessionId, limit }) => {
 	const sessionId = callerSessionId ?? sessionState.currentSessionId
 	const runtime = sessionId ? runtimes.get(sessionId) : undefined

From 542a4842a317a6607de973b4567bdb27dc088664 Mon Sep 17 00:00:00 2001
From: Guilhem <guilhemlemouel@gmail.com>
Date: Mon, 20 Jul 2026 15:47:04 +0200
Subject: [PATCH 063/171] feat(ai): live web-search source list on chat tool
 cards (#10210)

* feat(ai): live web-search source list on chat tool cards

* fix(ai): restrict web-search source links to http(s), respect user collapse

* fix(ai): read plural queries field for openai web-search labels
---
 .../copilot/chat/ToolExecutionDisplay.svelte  |   3 +
 .../chat/WebSearchSourcesDisplay.svelte       |  83 +++++++++++++
 .../components/copilot/chat/anthropic.test.ts |  20 ++-
 .../lib/components/copilot/chat/anthropic.ts  | 115 ++++++++++++++++--
 .../copilot/chat/openai-responses.test.ts     |  22 +++-
 .../copilot/chat/openai-responses.ts          |  84 +++++++++++--
 .../src/lib/components/copilot/chat/shared.ts |   7 ++
 7 files changed, 314 insertions(+), 20 deletions(-)
 create mode 100644 frontend/src/lib/components/copilot/chat/WebSearchSourcesDisplay.svelte

diff --git a/frontend/src/lib/components/copilot/chat/ToolExecutionDisplay.svelte b/frontend/src/lib/components/copilot/chat/ToolExecutionDisplay.svelte
index 2a99ad0429..59c9dcede4 100644
--- a/frontend/src/lib/components/copilot/chat/ToolExecutionDisplay.svelte
+++ b/frontend/src/lib/components/copilot/chat/ToolExecutionDisplay.svelte
@@ -10,6 +10,7 @@
 	import ToolContentDisplay from './ToolContentDisplay.svelte'
 	import ToolMessageActions from './ToolMessageActions.svelte'
 	import AskUserQuestionDisplay from './AskUserQuestionDisplay.svelte'
+	import WebSearchSourcesDisplay from './WebSearchSourcesDisplay.svelte'
 	import ExpandableImage from '$lib/components/common/image/ExpandableImage.svelte'
 
 	interface Props {
@@ -153,6 +154,8 @@
 
 					{#if visibleActions.length > 0}
 						<ToolMessageActions actions={visibleActions} />
+					{:else if message.webSearchSources?.length && !message.error}
+						<WebSearchSourcesDisplay sources={message.webSearchSources} />
 					{:else}
 						<ToolContentDisplay
 							title="Result"
diff --git a/frontend/src/lib/components/copilot/chat/WebSearchSourcesDisplay.svelte b/frontend/src/lib/components/copilot/chat/WebSearchSourcesDisplay.svelte
new file mode 100644
index 0000000000..ff71c44160
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/WebSearchSourcesDisplay.svelte
@@ -0,0 +1,83 @@
+<script lang="ts">
+	import { Globe } from 'lucide-svelte'
+	import { SvelteSet } from 'svelte/reactivity'
+	import type { WebSearchSource } from './shared'
+
+	interface Props {
+		sources: WebSearchSource[]
+	}
+
+	let { sources }: Props = $props()
+
+	// The URLs come from the provider's response: only render absolute http(s)
+	// ones — anything else (javascript:, data:, relative) must not become an
+	// href. Also dedupes; providers can surface the same page several times.
+	const uniqueSources = $derived(
+		Array.from(
+			new Map(
+				sources
+					.filter((s) => {
+						try {
+							return ['http:', 'https:'].includes(new URL(s.url).protocol)
+						} catch {
+							return false
+						}
+					})
+					.map((s) => [s.url, s])
+			).values()
+		)
+	)
+
+	function hostnameOf(url: string): string {
+		try {
+			return new URL(url).hostname.replace(/^www\./, '')
+		} catch {
+			return url
+		}
+	}
+
+	const failedFavicons = new SvelteSet<string>()
+
+	// Favicons come from Google's public favicon service, which discloses each
+	// consulted hostname to a third party from the user's browser — an accepted
+	// tradeoff for now (blocked/air-gapped environments degrade to the Globe
+	// icon via onerror). Hit gstatic directly rather than www.google.com/s2/
+	// favicons: the app is served with COEP require-corp, and the s2 redirect
+	// hop carries no Cross-Origin-Resource-Policy header, so the browser blocks
+	// the image. The gstatic endpoint itself responds with CORP: cross-origin.
+	function faviconUrl(hostname: string): string {
+		return `https://t3.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=https://${encodeURIComponent(hostname)}&size=64`
+	}
+</script>
+
+<div class="space-y-2">
+	<span class="text-2xs text-hint">Sources:</span>
+	<div class="flex flex-col max-h-40 overflow-y-auto">
+		{#each uniqueSources as source (source.url)}
+			{@const hostname = hostnameOf(source.url)}
+			<a
+				href={source.url}
+				target="_blank"
+				rel="noopener noreferrer"
+				title={source.url}
+				class="flex items-center gap-2 py-1 px-1.5 rounded hover:bg-surface-hover min-w-0"
+			>
+				{#if failedFavicons.has(hostname)}
+					<Globe class="w-3.5 h-3.5 shrink-0 text-tertiary" />
+				{:else}
+					<img
+						src={faviconUrl(hostname)}
+						alt=""
+						loading="lazy"
+						class="w-3.5 h-3.5 shrink-0 rounded-sm"
+						onerror={() => failedFavicons.add(hostname)}
+					/>
+				{/if}
+				<span class="text-2xs text-primary truncate">{source.title ?? hostname}</span>
+				{#if source.title}
+					<span class="text-2xs text-tertiary truncate shrink-0 max-w-32">{hostname}</span>
+				{/if}
+			</a>
+		{/each}
+	</div>
+</div>
diff --git a/frontend/src/lib/components/copilot/chat/anthropic.test.ts b/frontend/src/lib/components/copilot/chat/anthropic.test.ts
index 1d2dad57b3..1ac413973f 100644
--- a/frontend/src/lib/components/copilot/chat/anthropic.test.ts
+++ b/frontend/src/lib/components/copilot/chat/anthropic.test.ts
@@ -1,6 +1,6 @@
 import { describe, expect, it, vi } from 'vitest'
 import type { ChatCompletionMessageParam } from 'openai/resources/index.mjs'
-import { convertOpenAIToAnthropicMessages } from './anthropic'
+import { convertOpenAIToAnthropicMessages, partialWebSearchQuery } from './anthropic'
 
 // anthropic.ts pulls in the chat client/registry layer at import time; the
 // converter under test is pure, so stub those side-effecting modules away.
@@ -199,3 +199,21 @@ describe('convertOpenAIToAnthropicMessages', () => {
 		})
 	})
 })
+
+describe('partialWebSearchQuery', () => {
+	it('extracts the query prefix from JSON cut mid-string', () => {
+		expect(partialWebSearchQuery('{"query": "latest stable Post')).toBe('latest stable Post')
+	})
+
+	it('decodes escapes and never includes a trailing half-escape', () => {
+		expect(partialWebSearchQuery('{"query": "say \\"hi\\" to')).toBe('say "hi" to')
+		// Cut right after the backslash: the escape pair is incomplete, so the
+		// extracted prefix must stop before it rather than corrupt the label.
+		expect(partialWebSearchQuery('{"query": "say \\')).toBe('say ')
+	})
+
+	it('returns undefined when no query string has started', () => {
+		expect(partialWebSearchQuery('{"que')).toBeUndefined()
+		expect(partialWebSearchQuery('{"query": ')).toBeUndefined()
+	})
+})
diff --git a/frontend/src/lib/components/copilot/chat/anthropic.ts b/frontend/src/lib/components/copilot/chat/anthropic.ts
index 209a3b7a83..0c9f31e517 100644
--- a/frontend/src/lib/components/copilot/chat/anthropic.ts
+++ b/frontend/src/lib/components/copilot/chat/anthropic.ts
@@ -16,7 +16,13 @@ import type { MessageStream } from '@anthropic-ai/sdk/lib/MessageStream'
 import type { AIProviderModel } from '$lib/gen'
 import { getProviderAndCompletionConfig, workspaceAIClients } from '../lib'
 import { applyReasoningToConfig } from '../reasoningRegistry'
-import { appendPendingToolImages, processToolCall, type Tool, type ToolCallbacks } from './shared'
+import {
+	appendPendingToolImages,
+	processToolCall,
+	type Tool,
+	type ToolCallbacks,
+	type WebSearchSource
+} from './shared'
 import { anthropicUsageToChatTokenUsage, type ChatTokenUsage } from './tokenUsage'
 import { parseImageDataUrl } from './imageUtils'
 
@@ -62,23 +68,63 @@ function setAnthropicWebSearchStatus(
 	callbacks: ToolCallbacks & { onMessageEnd: () => void },
 	toolId: string,
 	status: WebSearchStatus,
-	errorCode?: string
+	details?: { errorCode?: string; query?: string; sources?: WebSearchSource[] }
 ) {
 	const isLoading = status === 'searching'
 	const failed = status === 'failed'
+	const sources = details?.sources
 	callbacks.onMessageEnd()
 	callbacks.setToolStatus(`anthropic_web_search:${toolId}`, {
-		content: failed ? 'Web search failed' : isLoading ? 'Searching the web...' : 'Searched the web',
-		error: failed ? `Web search failed${errorCode ? `: ${errorCode}` : ''}` : undefined,
+		content: failed
+			? 'Web search failed'
+			: isLoading
+				? details?.query
+					? `Searching the web for "${details.query}"...`
+					: 'Searching the web...'
+				: details?.query
+					? `Searched the web for "${details.query}"`
+					: 'Searched the web',
+		error: failed
+			? `Web search failed${details?.errorCode ? `: ${details.errorCode}` : ''}`
+			: undefined,
 		isLoading,
 		isStreamingArguments: false,
 		needsConfirmation: false,
 		toolName: 'web_search',
-		showDetails: false,
-		autoCollapseDetails: true
+		// Sources keep the card expanded (no auto-collapse) so the consulted
+		// pages surface live as each search completes mid-stream.
+		...(sources?.length
+			? { webSearchSources: sources, showDetails: true, autoCollapseDetails: false }
+			: {})
 	})
 }
 
+// The query streams as partial JSON ({"query": "..."} cut mid-string), so
+// JSON.parse fails until the block completes; regex out the string prefix to
+// label the card while the model is still typing the query.
+export function partialWebSearchQuery(partialJson: string): string | undefined {
+	const m = partialJson.match(/"query"\s*:\s*"((?:[^"\\]|\\.)*)/)
+	if (!m || !m[1]) return undefined
+	try {
+		return JSON.parse(`"${m[1]}"`)
+	} catch {
+		return undefined
+	}
+}
+
+function anthropicWebSearchSources(
+	content: Anthropic.Messages.WebSearchToolResultBlock['content']
+): { errorCode?: string; sources?: WebSearchSource[] } {
+	if (!Array.isArray(content)) {
+		return { errorCode: content?.error_code }
+	}
+	return {
+		sources: content
+			.filter((r) => r.type === 'web_search_result')
+			.map((r) => ({ url: r.url, title: r.title }))
+	}
+}
+
 export async function getAnthropicCompletion(
 	messages: ChatCompletionMessageParam[],
 	abortController: AbortController,
@@ -153,9 +199,16 @@ export async function parseAnthropicCompletion(
 	let error = null
 
 	let currentStreamingTool:
-		| { tempId: string; shouldStream: boolean; toolName: string }
+		| { tempId: string; shouldStream: boolean; toolName: string; isWebSearch?: boolean }
 		| undefined = undefined
 	let accumulatedJson = ''
+	// server_tool_use id → query, filled while the query streams; the paired
+	// web_search_tool_result block only carries tool_use_id.
+	const webSearchQueries = new Map<string, string>()
+	// Result blocks already surfaced from stream events: the end-of-turn message
+	// handler must not re-emit these — re-setting the status would re-expand a
+	// card the user collapsed in the meantime.
+	const surfacedWebSearchResults = new Set<string>()
 
 	completion.on('streamEvent', (event: RawMessageStreamEvent) => {
 		if (event.type === 'content_block_start') {
@@ -183,7 +236,26 @@ export async function parseAnthropicCompletion(
 					autoCollapseDetails: tool?.autoCollapseDetails
 				})
 			} else if (block.type === 'server_tool_use' && block.name === 'web_search') {
+				accumulatedJson = ''
+				currentStreamingTool = {
+					tempId: block.id,
+					shouldStream: false,
+					toolName: 'web_search',
+					isWebSearch: true
+				}
 				setAnthropicWebSearchStatus(callbacks, block.id, 'searching')
+			} else if (block.type === 'web_search_tool_result') {
+				// Server tool results arrive complete in content_block_start; surface
+				// the source list now, while the model is still streaming the rest of
+				// its turn, instead of waiting for the end-of-turn message event.
+				surfacedWebSearchResults.add(block.tool_use_id)
+				const { errorCode, sources } = anthropicWebSearchSources(block.content)
+				setAnthropicWebSearchStatus(
+					callbacks,
+					block.tool_use_id,
+					errorCode ? 'failed' : 'completed',
+					{ errorCode, query: webSearchQueries.get(block.tool_use_id), sources }
+				)
 			}
 		}
 	})
@@ -204,6 +276,15 @@ export async function parseAnthropicCompletion(
 	})
 
 	completion.on('inputJson', (partialJson: string) => {
+		if (currentStreamingTool?.isWebSearch) {
+			accumulatedJson += partialJson
+			const query = partialWebSearchQuery(accumulatedJson)
+			if (query) {
+				webSearchQueries.set(currentStreamingTool.tempId, query)
+				setAnthropicWebSearchStatus(callbacks, currentStreamingTool.tempId, 'searching', { query })
+			}
+			return
+		}
 		if (currentStreamingTool?.shouldStream && currentStreamingTool.tempId) {
 			// Accumulate the partial JSON
 			accumulatedJson += partialJson
@@ -233,6 +314,16 @@ export async function parseAnthropicCompletion(
 	})
 
 	completion.on('message', (message: Message) => {
+		// Final message blocks carry the complete query; overwrite whatever the
+		// partial-JSON extraction reconstructed during streaming.
+		for (const block of message.content) {
+			if (block.type === 'server_tool_use' && block.name === 'web_search') {
+				const query = (block.input as any)?.query
+				if (typeof query === 'string' && query.length > 0) {
+					webSearchQueries.set(block.id, query)
+				}
+			}
+		}
 		for (const block of message.content) {
 			if (block.type === 'text') {
 				const text = block.text
@@ -240,13 +331,17 @@ export async function parseAnthropicCompletion(
 				messages.push(assistantMessage)
 				addedMessages.push(assistantMessage)
 				callbacks.onMessageEnd()
-			} else if (block.type === 'web_search_tool_result') {
-				const errorCode = Array.isArray(block.content) ? undefined : block.content.error_code
+			} else if (
+				block.type === 'web_search_tool_result' &&
+				!surfacedWebSearchResults.has(block.tool_use_id)
+			) {
+				// Fallback for a result whose content_block_start was missed.
+				const { errorCode, sources } = anthropicWebSearchSources(block.content)
 				setAnthropicWebSearchStatus(
 					callbacks,
 					block.tool_use_id,
 					errorCode ? 'failed' : 'completed',
-					errorCode
+					{ errorCode, query: webSearchQueries.get(block.tool_use_id), sources }
 				)
 			} else if (block.type === 'tool_use') {
 				// Convert Anthropic tool calls to OpenAI format for compatibility
diff --git a/frontend/src/lib/components/copilot/chat/openai-responses.test.ts b/frontend/src/lib/components/copilot/chat/openai-responses.test.ts
index a91ddc5a17..d93e383db1 100644
--- a/frontend/src/lib/components/copilot/chat/openai-responses.test.ts
+++ b/frontend/src/lib/components/copilot/chat/openai-responses.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it, vi } from 'vitest'
-import { toResponsesContent } from './openai-responses'
+import { openAIWebSearchDetails, toResponsesContent } from './openai-responses'
 
 // openai-responses.ts pulls in the chat client/registry layer at import time; the
 // helper under test is pure, so stub those side-effecting modules away.
@@ -37,3 +37,23 @@ describe('toResponsesContent', () => {
 		])
 	})
 })
+
+describe('openAIWebSearchDetails', () => {
+	it('prefers the queries array over the deprecated singular query', () => {
+		expect(
+			openAIWebSearchDetails({ action: { type: 'search', queries: ['a', 'b'], query: 'old' } })
+		).toEqual({ query: 'a, b', sources: undefined })
+	})
+
+	it('falls back to the singular query when queries is absent', () => {
+		expect(openAIWebSearchDetails({ action: { type: 'search', query: 'solo' } }).query).toBe('solo')
+	})
+
+	it('keeps only url-shaped sources and returns undefined query when neither field is usable', () => {
+		expect(
+			openAIWebSearchDetails({
+				action: { type: 'search', queries: [], sources: [{ url: 'https://a.dev' }, { nope: 1 }] }
+			})
+		).toEqual({ query: undefined, sources: [{ url: 'https://a.dev' }] })
+	})
+})
diff --git a/frontend/src/lib/components/copilot/chat/openai-responses.ts b/frontend/src/lib/components/copilot/chat/openai-responses.ts
index ec3f9dad38..9db5baf42f 100644
--- a/frontend/src/lib/components/copilot/chat/openai-responses.ts
+++ b/frontend/src/lib/components/copilot/chat/openai-responses.ts
@@ -13,7 +13,13 @@ import {
 	workspaceAIClients
 } from '../lib'
 import { applyReasoningToConfig } from '../reasoningRegistry'
-import { appendPendingToolImages, processToolCall, type Tool, type ToolCallbacks } from './shared'
+import {
+	appendPendingToolImages,
+	processToolCall,
+	type Tool,
+	type ToolCallbacks,
+	type WebSearchSource
+} from './shared'
 import type { ResponseStream } from 'openai/lib/responses/ResponseStream.mjs'
 import type { AIProviderModel } from '$lib/gen'
 import { openAIResponsesUsageToChatTokenUsage, type ChatTokenUsage } from './tokenUsage'
@@ -30,23 +36,62 @@ const openAIWebSearchToolId = (itemId: string) => `openai_web_search:${itemId}`
 function setOpenAIWebSearchStatus(
 	callbacks: ToolCallbacks & { onMessageEnd: () => void },
 	itemId: string,
-	status: WebSearchStatus
+	status: WebSearchStatus,
+	details?: { query?: string; sources?: WebSearchSource[] }
 ) {
 	const isLoading = status === 'in_progress' || status === 'searching'
 	const failed = status === 'failed'
+	const sources = details?.sources
 	callbacks.onMessageEnd()
 	callbacks.setToolStatus(openAIWebSearchToolId(itemId), {
-		content: failed ? 'Web search failed' : isLoading ? 'Searching the web...' : 'Searched the web',
+		content: failed
+			? 'Web search failed'
+			: isLoading
+				? 'Searching the web...'
+				: details?.query
+					? `Searched the web for "${details.query}"`
+					: 'Searched the web',
 		error: failed ? 'Web search failed' : undefined,
 		isLoading,
 		isStreamingArguments: false,
 		needsConfirmation: false,
 		toolName: 'web_search',
-		showDetails: false,
-		autoCollapseDetails: true
+		// Sources keep the card expanded (no auto-collapse) so the consulted
+		// pages surface live as each search completes mid-stream.
+		...(sources?.length
+			? { webSearchSources: sources, showDetails: true, autoCollapseDetails: false }
+			: {})
 	})
 }
 
+// Pull query + consulted URLs out of a completed web_search_call item.
+// The pinned SDK types the action shapes (ResponseFunctionWebSearch.Search)
+// but its ResponseFunctionWebSearch interface predates the `action` property
+// itself, so the field must be read untyped and shape-checked.
+export function openAIWebSearchDetails(item: any): {
+	query?: string
+	sources?: WebSearchSource[]
+} {
+	const action = item?.action
+	// The current schema sends a `queries` array and may omit the deprecated
+	// singular `query`; support both so the label never falls back to the bare
+	// "Searched the web".
+	const queries: string[] = Array.isArray(action?.queries)
+		? action.queries.filter((q: any) => typeof q === 'string' && q)
+		: []
+	const query = queries.length
+		? queries.join(', ')
+		: typeof action?.query === 'string' && action.query
+			? action.query
+			: undefined
+	const sources = Array.isArray(action?.sources)
+		? action.sources
+				.filter((s: any) => typeof s?.url === 'string')
+				.map((s: any) => ({ url: s.url }))
+		: undefined
+	return { query, sources }
+}
+
 // Conversion utilities for Responses API
 
 /**
@@ -200,9 +245,12 @@ export async function getOpenAIResponsesCompletion(
 	}
 
 	// Enable OpenAI's built-in web search tool. The proxy forwards the body
-	// verbatim, so this reaches OpenAI as a native server-side tool.
+	// verbatim, so this reaches OpenAI as a native server-side tool. Sources
+	// (the URLs each search consulted) are only returned when asked for via
+	// `include` — they feed the expandable source list on the tool card.
 	if (options?.webSearch && providerSupportsWebSearch(provider)) {
 		responsesConfig.tools = [...(responsesConfig.tools ?? []), { type: 'web_search' }]
+		responsesConfig.include = [...(responsesConfig.include ?? []), 'web_search_call.action.sources']
 	}
 
 	const client = options?.openaiClient ?? workspaceAIClients.getOpenaiClient()
@@ -378,6 +426,25 @@ export async function parseOpenAIResponsesCompletion(
 		setOpenAIWebSearchStatus(callbacks, event.item_id, 'completed')
 	})
 
+	// The completed event above only carries item_id; the full item (with
+	// action.query and the requested action.sources) lands in output_item.done,
+	// mid-stream — surface the source list there rather than at end of turn.
+	// Track surfaced ids so the final-response sweep doesn't re-emit the status
+	// and re-expand a card the user collapsed in the meantime.
+	const surfacedWebSearchCalls = new Set<string>()
+	runner.on('response.output_item.done', (event) => {
+		const item = event.item as any
+		if (item?.type === 'web_search_call' && item.id) {
+			surfacedWebSearchCalls.add(item.id)
+			setOpenAIWebSearchStatus(
+				callbacks,
+				item.id,
+				item.status ?? 'completed',
+				openAIWebSearchDetails(item)
+			)
+		}
+	})
+
 	// Stream function call arguments incrementally
 	runner.on('response.function_call_arguments.delta', (event) => {
 		if (currentStreamingTool?.shouldStream && currentStreamingTool.itemId === event.item_id) {
@@ -453,8 +520,9 @@ export async function parseOpenAIResponsesCompletion(
 	const tokenUsage = openAIResponsesUsageToChatTokenUsage(finalResponse.usage)
 
 	for (const item of finalResponse.output ?? []) {
-		if (item.type === 'web_search_call') {
-			setOpenAIWebSearchStatus(callbacks, item.id, item.status)
+		if (item.type === 'web_search_call' && !surfacedWebSearchCalls.has(item.id)) {
+			// Fallback for a call whose output_item.done event was missed.
+			setOpenAIWebSearchStatus(callbacks, item.id, item.status, openAIWebSearchDetails(item))
 		}
 	}
 
diff --git a/frontend/src/lib/components/copilot/chat/shared.ts b/frontend/src/lib/components/copilot/chat/shared.ts
index 1ffcf769e9..d37b3eda2a 100644
--- a/frontend/src/lib/components/copilot/chat/shared.ts
+++ b/frontend/src/lib/components/copilot/chat/shared.ts
@@ -526,6 +526,12 @@ export function answeredChoices(q: UserQuestionDisplay): string[] | undefined {
 	return q.selectedChoices ?? (q.selectedChoice ? [q.selectedChoice] : undefined)
 }
 
+/** One page hit from a provider-side web search (OpenAI sources carry no title). */
+export type WebSearchSource = {
+	url: string
+	title?: string
+}
+
 export type ToolDisplayMessage = {
 	role: 'tool'
 	tool_call_id: string
@@ -543,6 +549,7 @@ export type ToolDisplayMessage = {
 	showFade?: boolean
 	actions?: ToolDisplayAction[]
 	userQuestion?: UserQuestionDisplay
+	webSearchSources?: WebSearchSource[]
 	/** Data URL of an image the tool produced (e.g. take_screenshot), shown on the card. */
 	imageUrl?: string
 }

From f4308cf033b75e9a69c1e21041ff97f3bfa1787c Mon Sep 17 00:00:00 2001
From: Guilhem <guilhemlemouel@gmail.com>
Date: Mon, 20 Jul 2026 17:32:59 +0200
Subject: [PATCH 064/171] feat(ai): expose get_db_schema tool in global chat
 (#10207)

* feat(ai): expose get_db_schema tool in global chat

* fix(ai): skip cross-workspace editor cache write in global get_db_schema

* test(ai): add global eval case for get_db_schema resource lookup
---
 ai_evals/cases/global.yaml                    | 28 +++++++++++
 .../components/copilot/chat/global/core.ts    |  7 +++
 .../components/copilot/chat/script/core.ts    | 46 +++++++++++--------
 3 files changed, 62 insertions(+), 19 deletions(-)

diff --git a/ai_evals/cases/global.yaml b/ai_evals/cases/global.yaml
index 775cfefa48..6781fb90b5 100644
--- a/ai_evals/cases/global.yaml
+++ b/ai_evals/cases/global.yaml
@@ -1533,3 +1533,31 @@
     - saves the plan as a markdown artifact via create_artifact rather than only replying inline
     - the artifact content has a title, a one-line summary, and three or four bullet steps for onboarding
     - does not create a flow or script draft yet
+
+- id: global-dbschema1-postgres-resource-tables
+  prompt: |-
+    I have a postgres resource at f/data/reports_pg in this workspace.
+    What tables does that database have?
+  initial: ai_evals/fixtures/frontend/global/initial/user_admin_empty.json
+  runtime:
+    maxTurns: 12
+  validate:
+    draftCountExactly: 0
+  toolExpect:
+    requiredToolsUsed:
+      - get_db_schema
+    forbiddenToolsUsed:
+      - write_script
+      - write_resource
+      - test_run_script
+      - deploy_workspace_item
+    toolCallArgs:
+      - tool: get_db_schema
+        field: resourcePath
+        stringIncludesAnyOf:
+          - f/data/reports_pg
+  skipJudge: true
+  judgeChecklist:
+    - fetches the schema through get_db_schema with the resource path f/data/reports_pg
+    - when the lookup fails, tells the user instead of inventing table names
+    - does not write scripts or resources to answer a read-only question
diff --git a/frontend/src/lib/components/copilot/chat/global/core.ts b/frontend/src/lib/components/copilot/chat/global/core.ts
index 23f0166033..49373af584 100644
--- a/frontend/src/lib/components/copilot/chat/global/core.ts
+++ b/frontend/src/lib/components/copilot/chat/global/core.ts
@@ -83,6 +83,7 @@ import {
 	type ToolDisplayAction
 } from '../shared'
 import { searchDocsTool, readDocsPageTool } from '../docs/core'
+import { createDbSchemaTool } from '../script/core'
 import type { ContextElement } from '../context'
 import { getDatatableTools } from '../datatableTools'
 import { fileTools } from '../files/fileTools'
@@ -969,6 +970,7 @@ Rules:
 - Use discard_local_draft to remove a draft, including the matching open editor draft. Use delete_workspace_item only to delete a deployed workspace item.
 - Variable values are never readable. For secrets, create a secret variable and reference it from resources as "$var:path/to/variable".
 - Use search_resource_types before write_resource.
+- Use get_db_schema with a database resource path to fetch its tables and columns before writing SQL (or a script querying that database).
 - Use get_instructions before writing scripts, flows, resources, or apps. For scripts, pass the target language.
 ${pipelineBullet}
 - After creating or editing a script or flow draft, run test_run_script, test_run_flow, or test_run_step with representative args before reporting that it works. These tools prefer drafts, so testing does not require deployment.
@@ -2789,6 +2791,11 @@ export const globalTools: Tool<{}>[] = [
 			)
 		}
 	},
+	createDbSchemaTool<{}>({
+		description:
+			'Fetch the schema (tables and columns) of a database resource by its path. Supports postgresql, mysql, ms_sql_server, snowflake and bigquery resources.',
+		updateEditorCache: false
+	}),
 	{
 		def: createToolDef(
 			readFlowModuleCodeSchema,
diff --git a/frontend/src/lib/components/copilot/chat/script/core.ts b/frontend/src/lib/components/copilot/chat/script/core.ts
index e706fe11f5..3d71ea333a 100644
--- a/frontend/src/lib/components/copilot/chat/script/core.ts
+++ b/frontend/src/lib/components/copilot/chat/script/core.ts
@@ -1,7 +1,6 @@
 import { ResourceService, JobService } from '$lib/gen/services.gen'
 import type { AIProvider, AIProviderModel, ResourceType, ScriptLang } from '$lib/gen/types.gen'
 import { capitalize, isObject, toCamel } from '$lib/utils'
-import { get } from 'svelte/store'
 import { compile, phpCompile, pythonCompile } from '../../utils'
 import type {
 	ChatCompletionSystemMessageParam,
@@ -460,10 +459,18 @@ export const resourceTypeTool: Tool<ScriptChatHelpers> = {
 	}
 }
 
-// Generic DB schema tool factory that can be used by both script and flow modes
-export function createDbSchemaTool<T>(): Tool<T> {
+// Generic DB schema tool factory shared by the script, flow and global modes
+export function createDbSchemaTool<T>(
+	opts: { description?: string; updateEditorCache?: boolean } = {}
+): Tool<T> {
+	const { description, updateEditorCache = true } = opts
 	return {
-		def: DB_SCHEMA_FUNCTION_DEF,
+		def: description
+			? {
+					...DB_SCHEMA_FUNCTION_DEF,
+					function: { ...DB_SCHEMA_FUNCTION_DEF.function, description }
+				}
+			: DB_SCHEMA_FUNCTION_DEF,
 		fn: async ({ args, workspace, toolCallbacks, toolId }) => {
 			if (!args.resourcePath) {
 				throw new Error('Database path not provided')
@@ -475,23 +482,24 @@ export function createDbSchemaTool<T>(): Tool<T> {
 				workspace: workspace,
 				path: args.resourcePath
 			})
-			const newDbSchemas = {
-				[args.resourcePath]: await getDbSchemas(
-					resource.resource_type,
-					args.resourcePath,
-					workspace,
-					(error) => {
-						console.error(error)
-					}
-				)
-			}
-			dbSchemas.update((schemas) => ({ ...schemas, ...newDbSchemas }))
-			const dbs = get(dbSchemas)
-			const db = dbs[args.resourcePath]
-			if (!db) {
+			const dbSchema = await getDbSchemas(
+				resource.resource_type,
+				args.resourcePath,
+				workspace,
+				(error) => {
+					console.error(error)
+				}
+			)
+			if (!dbSchema) {
 				throw new Error('Database not found')
 			}
-			const stringSchema = await formatDBSchema(db)
+			// The dbSchemas store is an editor cache keyed by resource path with no
+			// workspace dimension: a chat that may operate on a different workspace than
+			// the navigation one (global/session) must not write into it.
+			if (updateEditorCache) {
+				dbSchemas.update((schemas) => ({ ...schemas, [args.resourcePath]: dbSchema }))
+			}
+			const stringSchema = await formatDBSchema(dbSchema)
 			toolCallbacks.setToolStatus(toolId, {
 				content: 'Retrieved database schema for ' + args.resourcePath
 			})

From 38ceae1a098ae165c75f43aa9049b5afafdd3bac Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Mon, 20 Jul 2026 18:32:47 +0200
Subject: [PATCH 065/171] fix(db): grant schema usage and re-run windmill role
 grants (#10212)

* fix(db): grant schema usage and re-run windmill role grants

Migration 20250205131523 grants the windmill_user and windmill_admin
roles access to the schema and its tables, but its first statement is
LOCK TABLE pg_catalog.pg_roles, which requires superuser. On managed
Postgres (RDS, Cloud SQL) the migration user is not one, the lock
raises, and the block's EXCEPTION WHEN OTHERS handler downgrades the
failure to a NOTICE, so every GRANT after it is skipped. Core tables end
up ungranted and queries on a user_db transaction (SET LOCAL ROLE
windmill_user/windmill_admin) fail with "permission denied for table"
or, when schema USAGE was never granted, "relation does not exist".

Add a migration that re-runs those grants without the lock and without a
catch-all handler, and add the missing GRANT USAGE ON SCHEMA public to
init-db-as-superuser.sql, which PostgreSQL 15+ no longer implies for
PUBLIC. The init script also now creates windmill_admin before the table
grants so role membership is in place when they run.

Fixes WIN-2208

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* docs(db): correct schema-privilege rationale in grant migration

PostgreSQL 15 revoked CREATE, not USAGE, from PUBLIC on the public
schema, so USAGE is still granted by default there. The explicit grant
is what a hardened database that revoked it needs, not a PG15 default.
Also correct the description of what 20250205131523's failure actually
loses: 20221105003256 grants the tables outside any locked block, so the
gap is the ALTER DEFAULT PRIVILEGES covering later-created tables.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(db): grant only runner-owned objects to avoid aborting upgrade

GRANT ALL ON ALL TABLES IN SCHEMA raises a hard "permission denied for
table X" the moment the schema holds an object the migration runner does
not own (a superuser-installed extension such as PostGIS spatial_ref_sys,
or a co-located application table). With no catch-all handler that would
abort the whole upgrade -- a regression against 20250205131523, which
tolerated it only by swallowing every error.

Grant per-object over just the tables and sequences the runner owns,
which is exactly the set the GRANT can succeed on. Windmill's own tables
are all runner-owned, so coverage is unchanged; foreign objects are
skipped rather than aborted on. ALTER DEFAULT PRIVILEGES stays (it only
governs the runner's future objects, so it cannot conflict).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(db): guard each grant so the migration can never abort an upgrade

Wrap every grant in its own BEGIN/EXCEPTION/WARNING so no single failure
can abort the migration -- the opposite of 20250205131523's one
block-wide WHEN OTHERS, whose flaw was granularity: a single early
failure there silently skipped every remaining grant. Here each grant
that cannot be applied is isolated, re-raised as a named WARNING, and the
rest still run.

This closes the last abort paths: a grant on an object dropped by another
session between the catalog scan and the GRANT, USAGE on a schema the
runner cannot grant, or a missing role, now warn and continue instead of
failing the upgrade. On a clean owned schema the guards never fire (zero
warnings, verified). The owner filter stays so foreign objects are
skipped without even a warning; the guard is the backstop.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(db): also grant runner-owned views and materialized views

pg_tables returns only ordinary and partitioned tables, so the previous
loop left owned views (flow_workspace_runnables and any materialized
views) ungranted -- a coverage regression against the GRANT ... ON ALL
TABLES form, which grants views too. Those views are read through
user_db transactions, so windmill_user/windmill_admin need access.

Enumerate pg_class over the relkinds ALL TABLES covers (r, p, v, m, f),
keeping the ownership filter so foreign objects are still skipped.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(db): grant by effective authority, not owner-name equality

Filtering relations by pg_get_userbyid(relowner) = current_user skips
objects the runner can legally grant but does not own by name: after a
migration-credential rotation, tables and sequences stay owned by the
previous runner while the new runner grants through inherited membership
(or as a superuser). Owner-name equality would leave those ungranted and
their user_db access broken.

Filter by pg_has_role(current_user, owner, 'USAGE') instead -- objects
the runner owns directly, inherits ownership of, or reaches as superuser.
Genuinely foreign objects (owner the runner is not a member of) are still
skipped, so the per-object guards remain the backstop.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(db): scope grants by explicit membership, not superuser authority

pg_has_role treats a superuser as a member of every role, so a superuser
migration runner would grant windmill_user/windmill_admin access to every
co-located relation in the schema -- another application's tables, an
extension's tables -- not just Windmill's.

Compute the runner's role set from pg_auth_members (recursive explicit
membership) and grant only relations owned by it. This still covers the
credential-rotation case owner-name equality missed (the new runner is a
real member of the previous owner) without inheriting the superuser's
implicit authority over unrelated roles.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 ...hema_and_tables_to_windmill_roles.down.sql |   3 +
 ...schema_and_tables_to_windmill_roles.up.sql | 107 ++++++++++++++++++
 init-db-as-superuser.sql                      |  39 ++++---
 3 files changed, 132 insertions(+), 17 deletions(-)
 create mode 100644 backend/migrations/20260720131744_regrant_schema_and_tables_to_windmill_roles.down.sql
 create mode 100644 backend/migrations/20260720131744_regrant_schema_and_tables_to_windmill_roles.up.sql

diff --git a/backend/migrations/20260720131744_regrant_schema_and_tables_to_windmill_roles.down.sql b/backend/migrations/20260720131744_regrant_schema_and_tables_to_windmill_roles.down.sql
new file mode 100644
index 0000000000..0f778d3edf
--- /dev/null
+++ b/backend/migrations/20260720131744_regrant_schema_and_tables_to_windmill_roles.down.sql
@@ -0,0 +1,3 @@
+-- No down migration: revoking these grants leaves the instance unable to run
+-- any query on a user_db transaction. 20250205131523, which this re-runs, is
+-- likewise a no-op down.
diff --git a/backend/migrations/20260720131744_regrant_schema_and_tables_to_windmill_roles.up.sql b/backend/migrations/20260720131744_regrant_schema_and_tables_to_windmill_roles.up.sql
new file mode 100644
index 0000000000..33ac63804a
--- /dev/null
+++ b/backend/migrations/20260720131744_regrant_schema_and_tables_to_windmill_roles.up.sql
@@ -0,0 +1,107 @@
+-- Re-runs the grants of 20250205131523. Everything in that migration sits in
+-- one DO block whose first statement is LOCK TABLE pg_catalog.pg_roles, which
+-- a non-superuser cannot take; on managed Postgres (RDS, Cloud SQL) it raises
+-- and the block's single EXCEPTION WHEN OTHERS handler downgrades the failure
+-- to a NOTICE, so every GRANT after it is skipped.
+--
+-- Most tables survive that anyway, because 20221105003256 grants them outside
+-- any such block. What is lost is the ALTER DEFAULT PRIVILEGES, which is what
+-- covers tables created by later migrations. Those default privileges only
+-- apply to objects created by the role that set them, so a deployment whose
+-- migration runner never successfully ran them ends up with newer tables
+-- ungranted and writes on a user_db transaction (SET LOCAL ROLE windmill_user /
+-- windmill_admin) failing with "permission denied for table". That gap is why
+-- 20260619091631, 20260701083047 and 20260716151337 each had to patch one
+-- table by hand; re-establishing the default privileges under the current
+-- runner closes it for future tables instead.
+--
+-- Which relations to grant: only those owned by the migration runner or a role
+-- it is an explicit (recursive) member of. That membership set, owner_roles,
+-- comes from pg_auth_members, deliberately NOT pg_has_role -- Postgres treats a
+-- superuser as a member of every role, so pg_has_role would make a superuser
+-- runner grant the windmill roles access to every co-located object in the
+-- schema (another application's tables, an extension's tables). Explicit
+-- membership still covers the case that owner-name equality would miss: after a
+-- migration-credential rotation the objects stay owned by the previous runner
+-- while the new runner is a real member of it.
+--
+-- This migration must never abort an upgrade, so every grant is guarded
+-- individually. That is the opposite of 20250205131523's single block-wide
+-- WHEN OTHERS, whose flaw was granularity, not the mere presence of a handler:
+-- one early failure there silently skipped every remaining grant. Here each
+-- grant that cannot be applied is isolated and re-raised as a named WARNING, so
+-- the rest still run and the reason is visible in the migration log. The known
+-- failure modes this absorbs:
+--   * an object dropped by another session between the catalog scan and the
+--     GRANT (only possible when something outside the migration shares the DB).
+--   * USAGE on a schema the runner does not own (needed only where USAGE was
+--     revoked from PUBLIC, else the roles resolve no table and queries fail
+--     with "relation does not exist"); such a deployment needs
+--     init-db-as-superuser.sql run by a superuser.
+-- windmill_user and windmill_admin are guaranteed to exist: 20221105003256
+-- grants to both outside any handler, so any database that reached this
+-- migration already has them.
+DO
+$do$
+DECLARE
+    target_schema TEXT := current_schema();
+    obj TEXT;
+    owner_roles OID[];
+BEGIN
+    WITH RECURSIVE my_roles(oid) AS (
+        SELECT oid FROM pg_roles WHERE rolname = current_user
+        UNION
+        SELECT m.roleid FROM pg_auth_members m JOIN my_roles r ON m.member = r.oid
+    )
+    SELECT array_agg(oid) INTO owner_roles FROM my_roles;
+
+    BEGIN
+        EXECUTE format('GRANT USAGE ON SCHEMA %I TO windmill_user, windmill_admin', target_schema);
+    EXCEPTION WHEN OTHERS THEN
+        RAISE WARNING 'skipped GRANT USAGE on schema %: %', target_schema, SQLERRM;
+    END;
+
+    -- pg_class over the relkinds GRANT ... ON ALL TABLES covers -- ordinary (r),
+    -- partitioned (p), views (v), materialized views (m), foreign (f). pg_tables
+    -- would miss views such as flow_workspace_runnables, which are read through
+    -- user_db transactions and so must be granted too.
+    FOR obj IN
+        SELECT format('%I.%I', n.nspname, c.relname)
+        FROM pg_class c
+        JOIN pg_namespace n ON n.oid = c.relnamespace
+        WHERE n.nspname = target_schema
+          AND c.relkind IN ('r', 'p', 'v', 'm', 'f')
+          AND c.relowner = ANY(owner_roles)
+    LOOP
+        BEGIN
+            EXECUTE format('GRANT ALL ON TABLE %s TO windmill_user, windmill_admin', obj);
+        EXCEPTION WHEN OTHERS THEN
+            RAISE WARNING 'skipped GRANT on relation %: %', obj, SQLERRM;
+        END;
+    END LOOP;
+
+    FOR obj IN
+        SELECT format('%I.%I', n.nspname, c.relname)
+        FROM pg_class c
+        JOIN pg_namespace n ON n.oid = c.relnamespace
+        WHERE n.nspname = target_schema
+          AND c.relkind = 'S'
+          AND c.relowner = ANY(owner_roles)
+    LOOP
+        BEGIN
+            EXECUTE format('GRANT ALL ON SEQUENCE %s TO windmill_user, windmill_admin', obj);
+        EXCEPTION WHEN OTHERS THEN
+            RAISE WARNING 'skipped GRANT on sequence %: %', obj, SQLERRM;
+        END;
+    END LOOP;
+
+    -- Applies to future objects created by the runner (the FOR ROLE default),
+    -- so it cannot conflict with objects owned by anyone else.
+    BEGIN
+        EXECUTE format('ALTER DEFAULT PRIVILEGES IN SCHEMA %I GRANT ALL ON TABLES TO windmill_user, windmill_admin', target_schema);
+        EXECUTE format('ALTER DEFAULT PRIVILEGES IN SCHEMA %I GRANT ALL ON SEQUENCES TO windmill_user, windmill_admin', target_schema);
+    EXCEPTION WHEN OTHERS THEN
+        RAISE WARNING 'skipped ALTER DEFAULT PRIVILEGES in schema %: %', target_schema, SQLERRM;
+    END;
+END
+$do$;
diff --git a/init-db-as-superuser.sql b/init-db-as-superuser.sql
index f130986264..22e50b9ab2 100644
--- a/init-db-as-superuser.sql
+++ b/init-db-as-superuser.sql
@@ -1,21 +1,26 @@
 CREATE ROLE windmill_user;
 
-GRANT ALL
-ON ALL TABLES IN SCHEMA public 
-TO windmill_user;
-
-GRANT ALL PRIVILEGES 
-ON ALL SEQUENCES IN SCHEMA public 
-TO windmill_user;
-
-ALTER DEFAULT PRIVILEGES 
-    IN SCHEMA public
-    GRANT ALL ON TABLES TO windmill_user;
-
-ALTER DEFAULT PRIVILEGES 
-    IN SCHEMA public
-    GRANT ALL ON SEQUENCES TO windmill_user;
-
-
 CREATE ROLE windmill_admin WITH BYPASSRLS;
 GRANT windmill_user TO windmill_admin;
+
+-- USAGE is granted to PUBLIC on the public schema by default, so this is a
+-- no-op on a stock database. It matters on hardened ones that revoke it: the
+-- roles then cannot resolve any table and every query on a user_db transaction
+-- fails with "relation does not exist" rather than a permission error.
+GRANT USAGE ON SCHEMA public TO windmill_user, windmill_admin;
+
+GRANT ALL
+ON ALL TABLES IN SCHEMA public
+TO windmill_user;
+
+GRANT ALL PRIVILEGES
+ON ALL SEQUENCES IN SCHEMA public
+TO windmill_user;
+
+ALTER DEFAULT PRIVILEGES
+    IN SCHEMA public
+    GRANT ALL ON TABLES TO windmill_user;
+
+ALTER DEFAULT PRIVILEGES
+    IN SCHEMA public
+    GRANT ALL ON SEQUENCES TO windmill_user;

From 0e04bc6991486b2b2b05b13feed5b083e403ac80 Mon Sep 17 00:00:00 2001
From: hugocasa <hugo@casademont.ch>
Date: Mon, 20 Jul 2026 18:45:14 +0200
Subject: [PATCH 066/171] fix: steer ai chat away from draft-blind api catalog
 reads and runs (#10202)

* fix: steer ai chat away from draft-blind api catalog reads and runs

* fix: support api catalog tools in ai eval harness mock backend

* fix: block remaining draft-blind read and list endpoints in api catalog

* fix: scope eval fetch stub to handled benchmark api paths

* feat: add deployed version read option to read_workspace_item

* fix: include input schema in script workspace item reads

* feat: add pagination to list_workspace_items

* fix: paginate list_workspace_items per item type without cross-type loss

* fix: window draft overlay in list_workspace_items by page and limit

* refactor: simplify list draft overlay to capped page-1 merge

* fix: label server-synthesized draft-only rows as drafts in listings

* chore: fix stale eval comment and pin draft_only listing label
---
 ai_evals/adapters/frontend/mockBackend.ts     | 136 ++++++++++++++++++
 .../adapters/frontend/vitestAdapter.test.ts   |  23 ++-
 ai_evals/cases/global.yaml                    |  83 +++++++++++
 .../chat/global/apiCatalogTools.test.ts       |  23 +++
 .../copilot/chat/global/apiCatalogTools.ts    |  15 +-
 .../copilot/chat/global/core.test.ts          |  89 ++++++++++++
 .../components/copilot/chat/global/core.ts    | 132 ++++++++++++-----
 .../copilot/chat/global/workspaceItems.ts     |   2 +
 8 files changed, 465 insertions(+), 38 deletions(-)

diff --git a/ai_evals/adapters/frontend/mockBackend.ts b/ai_evals/adapters/frontend/mockBackend.ts
index f9023449a2..2ab8f47f37 100644
--- a/ai_evals/adapters/frontend/mockBackend.ts
+++ b/ai_evals/adapters/frontend/mockBackend.ts
@@ -10,6 +10,7 @@ import type {
 import type {
 	DataTableTables,
 	DataTableTableSchema,
+	EndpointTool,
 	GetDraftForUserResponse,
 	GetOwnDraftResponse,
 	ListDraftsResponse,
@@ -694,3 +695,138 @@ function buildBenchmarkApp(app: BenchmarkWorkspaceApp): AppWithLastVersion {
 		raw_app: true
 	}
 }
+
+// ============= API endpoint catalog (McpService.listMcpTools + raw fetch) =============
+// The global chat's API catalog tools list endpoints via McpService and execute
+// them with a plain relative fetch('/api/...'), which has no meaning in the
+// vitest environment. A representative slice of the real catalog is served here,
+// and `handleBenchmarkApiFetch` answers the executed calls.
+
+const BENCHMARK_MCP_TOOLS: EndpointTool[] = [
+	{
+		name: 'listWorkers',
+		description: 'List workers',
+		instructions: 'List all workers with their last ping and job counts.',
+		path: '/workers/list',
+		method: 'GET',
+		query_params_schema: {
+			type: 'object',
+			properties: { page: { type: 'integer' }, per_page: { type: 'integer' } }
+		}
+	},
+	{
+		name: 'listQueue',
+		description: 'List queued jobs',
+		instructions: '',
+		path: '/w/{workspace}/jobs/queue/list',
+		method: 'GET',
+		path_params_schema: {
+			type: 'object',
+			properties: { workspace: { type: 'string' } },
+			required: ['workspace']
+		}
+	},
+	{
+		name: 'runScriptByPath',
+		description: 'Run the deployed version of a script by path',
+		instructions: '',
+		path: '/w/{workspace}/jobs/run/p/{path}',
+		method: 'POST',
+		path_params_schema: {
+			type: 'object',
+			properties: { workspace: { type: 'string' }, path: { type: 'string' } },
+			required: ['workspace', 'path']
+		},
+		body_schema: { type: 'object', properties: {} }
+	},
+	{
+		name: 'runFlowByPath',
+		description: 'Run the deployed version of a flow by path',
+		instructions: '',
+		path: '/w/{workspace}/jobs/run/f/{path}',
+		method: 'POST',
+		path_params_schema: {
+			type: 'object',
+			properties: { workspace: { type: 'string' }, path: { type: 'string' } },
+			required: ['workspace', 'path']
+		},
+		body_schema: { type: 'object', properties: {} }
+	},
+	// Draft-covered endpoints, present so steering cases exercise the guard the
+	// way production does (hidden from search, refused at call time).
+	{
+		name: 'getScriptByPath',
+		description: 'Get a script by path',
+		instructions: '',
+		path: '/w/{workspace}/scripts/get/p/{path}',
+		method: 'GET'
+	},
+	{
+		name: 'createFlow',
+		description: 'Create a flow',
+		instructions: '',
+		path: '/w/{workspace}/flows/create',
+		method: 'POST'
+	},
+	{
+		name: 'deleteSchedule',
+		description: 'Delete a schedule',
+		instructions: '',
+		path: '/w/{workspace}/schedules/delete/{path}',
+		method: 'DELETE'
+	},
+	{
+		name: 'getVariable',
+		description: 'Get a variable',
+		instructions: '',
+		path: '/w/{workspace}/variables/get/{path}',
+		method: 'GET'
+	}
+]
+
+export function listBenchmarkMcpTools(): EndpointTool[] {
+	return BENCHMARK_MCP_TOOLS
+}
+
+const BENCHMARK_WORKERS = [
+	{
+		worker: 'wk-benchmark-1',
+		worker_instance: 'benchmark-host',
+		last_ping: 2,
+		started_at: BENCHMARK_TIMESTAMP,
+		jobs_executed: 42,
+		custom_tags: null,
+		worker_group: 'default',
+		wm_version: 'benchmark'
+	},
+	{
+		worker: 'wk-benchmark-2',
+		worker_instance: 'benchmark-host',
+		last_ping: 5,
+		started_at: BENCHMARK_TIMESTAMP,
+		jobs_executed: 17,
+		custom_tags: null,
+		worker_group: 'default',
+		wm_version: 'benchmark'
+	}
+]
+
+/** True when `handleBenchmarkApiFetch` has an answer for this `/api/...` url.
+ * Any other relative fetch must keep its normal (non-benchmark) behavior —
+ * intercepting it with a synthetic 404 sends the model into retry loops. */
+export function hasBenchmarkApiHandler(url: string): boolean {
+	const path = url.split('?')[0]
+	return path === '/api/workers/list' || /^\/api\/w\/[^/]+\/jobs\/queue\/list$/.test(path)
+}
+
+/** Answer a relative `/api/...` fetch issued by the API catalog executor. */
+export function handleBenchmarkApiFetch(url: string): Response {
+	const path = url.split('?')[0]
+	if (path === '/api/workers/list') {
+		return Response.json(BENCHMARK_WORKERS)
+	}
+	if (/^\/api\/w\/[^/]+\/jobs\/queue\/list$/.test(path)) {
+		return Response.json([])
+	}
+	return Response.json({ error: `no benchmark handler for ${path}` }, { status: 404 })
+}
diff --git a/ai_evals/adapters/frontend/vitestAdapter.test.ts b/ai_evals/adapters/frontend/vitestAdapter.test.ts
index 92e33414df..1532928bff 100644
--- a/ai_evals/adapters/frontend/vitestAdapter.test.ts
+++ b/ai_evals/adapters/frontend/vitestAdapter.test.ts
@@ -3,6 +3,20 @@ import { expect, it, vi } from 'vitest'
 import { mkdir, writeFile } from 'fs/promises'
 // @ts-ignore - Node.js path
 import { dirname, resolve } from 'path'
+import { handleBenchmarkApiFetch, hasBenchmarkApiHandler } from './mockBackend'
+
+// The API catalog executor issues relative fetch('/api/...') calls, which have
+// no meaning in the vitest environment — serve the ones the benchmark handles.
+// Every other relative fetch keeps its normal behavior (it fails the same way
+// it does without this stub) so unrelated tools see an unchanged environment.
+const ORIGINAL_FETCH = globalThis.fetch
+globalThis.fetch = (async (input: unknown, init?: RequestInit) => {
+	const url = typeof input === 'string' ? input : ((input as Request | URL | null)?.url ?? '')
+	if (typeof url === 'string' && hasBenchmarkApiHandler(url)) {
+		return handleBenchmarkApiFetch(url)
+	}
+	return ORIGINAL_FETCH(input as Parameters<typeof fetch>[0], init)
+}) as typeof fetch
 
 vi.mock('monaco-editor', () => ({
 	editor: {},
@@ -57,7 +71,8 @@ vi.mock('$lib/gen', async () => {
 		runBenchmarkDatatableSql,
 		runBenchmarkFlowByPath,
 		runBenchmarkScriptPreview,
-		updateBenchmarkDraft
+		updateBenchmarkDraft,
+		listBenchmarkMcpTools
 	} = await import('./mockBackend')
 
 	function wrapService<T extends object>(target: T, overrides: Record<string, unknown>): T {
@@ -299,6 +314,12 @@ vi.mock('$lib/gen', async () => {
 			queryResourceTypes: async (data: { workspace: string }) =>
 				hasBenchmarkWorkspace(data.workspace) ? [] : actual.ResourceService.queryResourceTypes(data)
 		}),
+		McpService: wrapService(actual.McpService, {
+			listMcpTools: async (data: { workspace: string }) =>
+				hasBenchmarkWorkspace(data.workspace)
+					? listBenchmarkMcpTools()
+					: actual.McpService.listMcpTools(data)
+		}),
 		VariableService: wrapService(actual.VariableService, {
 			existsVariable: async (data: { workspace: string; path: string }) =>
 				hasBenchmarkWorkspace(data.workspace) ? false : actual.VariableService.existsVariable(data),
diff --git a/ai_evals/cases/global.yaml b/ai_evals/cases/global.yaml
index 6781fb90b5..646a9e870d 100644
--- a/ai_evals/cases/global.yaml
+++ b/ai_evals/cases/global.yaml
@@ -1561,3 +1561,86 @@
     - fetches the schema through get_db_schema with the resource path f/data/reports_pg
     - when the lookup fails, tells the user instead of inventing table names
     - does not write scripts or resources to answer a read-only question
+
+# --- API catalog (search_api_endpoints / call_api_get / call_api_endpoint) ---
+# The harness serves the catalog and the executed calls itself (mock
+# listMcpTools + benchmark fetch handlers in adapters/frontend), so these cases
+# do not require an mcp-enabled eval backend.
+
+- id: global-test30-api-catalog-workers
+  prompt: |-
+    Are any workers online right now? Give me a quick summary of the workers and when they last pinged.
+  initial: ai_evals/fixtures/frontend/global/initial/user_admin_empty.json
+  runtime:
+    maxTurns: 8
+  validate:
+    draftCountExactly: 0
+  toolExpect:
+    requiredToolsUsed:
+      - search_api_endpoints
+      - call_api_get
+    forbiddenToolsUsed:
+      - call_api_endpoint
+      - write_script
+      - deploy_workspace_item
+    toolCallArgs:
+      - tool: call_api_get
+        field: name
+        stringIncludesAnyOf:
+          - listWorkers
+  # Read-only workspace inspection produces no draft; validate via tool use.
+  skipJudge: true
+  judgeChecklist:
+    - discovers the workers endpoint through the API catalog instead of guessing or fabricating
+    - reports worker status from the returned data
+
+- id: global-test31-draft-test-run-not-deployed
+  prompt: |-
+    Update `f/evals/global/format_greeting` so the provided name is uppercased in the greeting, then run it with name "ada" to check it works.
+    Keep it as an AI draft only; do not deploy or save it.
+  initial: ai_evals/fixtures/frontend/global/initial/format_greeting_script.json
+  runtime:
+    maxTurns: 10
+  validate:
+    draftCountExactly: 1
+    requiredDrafts:
+      - type: script
+        path: f/evals/global/format_greeting
+        language: bun
+        valueIncludes:
+          - toUpperCase
+  toolExpect:
+    requiredToolsUsed:
+      - test_run_script
+    forbiddenToolsUsed:
+      - call_api_endpoint
+      - deploy_workspace_item
+      - delete_workspace_item
+  # The judge only sees the drafts artifact and cannot observe runs, so it always
+  # docks the prompt's "run it" requirement — validate deterministically instead:
+  # draft content via valueIncludes, the test run via toolExpect (test_run_script
+  # required, call_api_endpoint forbidden).
+  skipJudge: true
+  judgeChecklist:
+    - creates an AI draft of f/evals/global/format_greeting with the name uppercased in the greeting
+    - does not deploy or save the draft
+
+- id: global-test32-delete-via-dedicated-tool
+  prompt: |-
+    Delete the deployed script `f/evals/global/send_report_digest` from the workspace — we don't use it anymore.
+  initial: ai_evals/fixtures/frontend/global/initial/report_digest_script.json
+  runtime:
+    maxTurns: 6
+  validate:
+    draftCountExactly: 0
+  toolExpect:
+    requiredToolsUsed:
+      - delete_workspace_item
+    forbiddenToolsUsed:
+      - call_api_endpoint
+      - search_api_endpoints
+      - write_script
+  # Deletion produces no draft; validate via tool use.
+  skipJudge: true
+  judgeChecklist:
+    - deletes the deployed script via delete_workspace_item rather than a raw API endpoint
diff --git a/frontend/src/lib/components/copilot/chat/global/apiCatalogTools.test.ts b/frontend/src/lib/components/copilot/chat/global/apiCatalogTools.test.ts
index 470b396b53..8158fe62b8 100644
--- a/frontend/src/lib/components/copilot/chat/global/apiCatalogTools.test.ts
+++ b/frontend/src/lib/components/copilot/chat/global/apiCatalogTools.test.ts
@@ -69,6 +69,13 @@ const CATALOG = [
 		path: '/w/{workspace}/variables/get/{path}',
 		method: 'GET'
 	},
+	{
+		name: 'getScriptByPath',
+		description: 'Get script by path',
+		instructions: '',
+		path: '/w/{workspace}/scripts/get/p/{path}',
+		method: 'GET'
+	},
 	{
 		name: 'deleteScriptByHash',
 		description: 'Delete a script by hash',
@@ -171,6 +178,22 @@ describe('call_api_get', () => {
 		expect(search.matches.map((m: any) => m.name)).not.toContain('deleteScriptByHash')
 	})
 
+	it('refuses draft-blind item reads and lists, pointing at the draft-aware tools', async () => {
+		for (const name of ['getScriptByPath', 'getResource', 'getSchedule']) {
+			const result = await run('call_api_get', { name })
+			expect(result.success).toBe(false)
+			expect(result.error).toContain('read_workspace_item')
+		}
+		for (const name of ['listScripts', 'listFlows', 'listResource', 'listSchedules']) {
+			const result = await run('call_api_get', { name })
+			expect(result.success).toBe(false)
+			expect(result.error).toContain('list_workspace_items')
+		}
+
+		const search = await run('search_api_endpoints', { query: 'get script' })
+		expect(search.matches.map((m: any) => m.name)).not.toContain('getScriptByPath')
+	})
+
 	it('refuses variable reads so variable values never reach the model', async () => {
 		const result = await run('call_api_get', { name: 'getVariable' })
 		expect(result.success).toBe(false)
diff --git a/frontend/src/lib/components/copilot/chat/global/apiCatalogTools.ts b/frontend/src/lib/components/copilot/chat/global/apiCatalogTools.ts
index be4ca892d8..db0b431967 100644
--- a/frontend/src/lib/components/copilot/chat/global/apiCatalogTools.ts
+++ b/frontend/src/lib/components/copilot/chat/global/apiCatalogTools.ts
@@ -17,12 +17,21 @@ import { createToolDef, type Tool } from '../shared'
 // explicit deploy, draft cleanup on delete), the variable reads would expose
 // variable values to the model (getVariable even decrypts secrets by default),
 // and the rest are exact duplicates that would fragment behavior across two
-// code paths. getResource stays available: resource values are readable in
-// this chat by design (read_workspace_item returns them too) — secrets belong
-// in variables referenced as "$var:path", which a plain get leaves unresolved.
+// code paths.
 const COVERED_ENDPOINTS: Record<string, string> = {
 	getVariable: 'read_workspace_item (variable values are never readable in chat)',
 	listVariable: 'list_workspace_items (variable values are never readable in chat)',
+	// The item read/list endpoints return deployed state only, blind to the user's
+	// drafts; read_workspace_item / list_workspace_items merge drafts, and for
+	// flows return the compact JSON that patch_flow_json matches against.
+	getScriptByPath: 'read_workspace_item (reads your draft when one exists; pass version: "deployed" for the deployed state)',
+	getFlowByPath: 'read_workspace_item (reads your draft when one exists; pass version: "deployed" for the deployed state)',
+	getResource: 'read_workspace_item (reads your draft when one exists; pass version: "deployed" for the deployed state)',
+	getSchedule: 'read_workspace_item (reads your draft when one exists; pass version: "deployed" for the deployed state)',
+	listScripts: 'list_workspace_items (it includes your drafts)',
+	listFlows: 'list_workspace_items (it includes your drafts)',
+	listResource: 'list_workspace_items (it includes your drafts)',
+	listSchedules: 'list_workspace_items (it includes your drafts)',
 	deleteScriptByPath: 'delete_workspace_item',
 	deleteScriptByHash: 'delete_workspace_item',
 	deleteFlowByPath: 'delete_workspace_item',
diff --git a/frontend/src/lib/components/copilot/chat/global/core.test.ts b/frontend/src/lib/components/copilot/chat/global/core.test.ts
index 78d22e3fc8..595eaaa15b 100644
--- a/frontend/src/lib/components/copilot/chat/global/core.test.ts
+++ b/frontend/src/lib/components/copilot/chat/global/core.test.ts
@@ -492,6 +492,42 @@ describe('global AI tools', () => {
 		])
 	})
 
+	it('reads the deployed state, skipping chat and DB drafts, with version: deployed', async () => {
+		await callGlobalTool('write_script', {
+			path: 'f/scripts/greet',
+			language: 'bun',
+			content: 'export async function main(renamed_input: string) {}'
+		})
+		vi.mocked(ScriptService.getScriptByPath).mockResolvedValueOnce({
+			hash: 1,
+			path: 'f/scripts/greet',
+			summary: 'Deployed greet',
+			content: 'export async function main(name: string) {}',
+			schema: { properties: { name: { type: 'string' } } },
+			language: 'bun',
+			kind: 'script',
+			draft: { content: 'export async function main(db_draft_input: string) {}' }
+		} as any)
+
+		const raw = await callGlobalTool('read_workspace_item', {
+			type: 'script',
+			path: 'f/scripts/greet',
+			version: 'deployed'
+		})
+		const item = JSON.parse(raw)
+
+		expect(ScriptService.getScriptByPath).toHaveBeenCalledWith({
+			workspace: WORKSPACE,
+			path: 'f/scripts/greet',
+			getDraft: false
+		})
+		expect(item.isDraft).toBe(false)
+		expect(item.schema).toEqual({ properties: { name: { type: 'string' } } })
+		expect(raw).toContain('main(name: string)')
+		expect(raw).not.toContain('renamed_input')
+		expect(raw).not.toContain('db_draft_input')
+	})
+
 	it('redacts variable draft values when reading workspace items', async () => {
 		await callGlobalTool('write_variable', {
 			path: 'f/secrets/api_key',
@@ -874,6 +910,59 @@ describe('global AI tools', () => {
 		])
 	})
 
+	it('forwards page to the list calls, capping page-1 drafts at limit per type', async () => {
+		await callGlobalTool('write_script', {
+			path: 'f/scripts/draft_a',
+			language: 'bun',
+			content: 'export async function main() {}'
+		})
+		await callGlobalTool('write_script', {
+			path: 'f/scripts/draft_b',
+			language: 'bun',
+			content: 'export async function main() {}'
+		})
+
+		const page1 = await callGlobalTool('list_workspace_items', {
+			types: ['script'],
+			limit: 1,
+			page: 1
+		})
+		const page2 = await callGlobalTool('list_workspace_items', {
+			types: ['script'],
+			limit: 1,
+			page: 2
+		})
+
+		expect(ScriptService.listScripts).toHaveBeenCalledWith(expect.objectContaining({ page: 2 }))
+		// Bounded on page 1, no draft rows on later pages; the capped-out draft
+		// stays reachable through the query filter.
+		expect(JSON.parse(page1)).toHaveLength(1)
+		expect(JSON.parse(page2)).toEqual([])
+		const byQuery = await callGlobalTool('list_workspace_items', {
+			types: ['script'],
+			query: 'draft_b'
+		})
+		expect(JSON.parse(byQuery).map((i: any) => i.path)).toEqual(['f/scripts/draft_b'])
+	})
+
+	it('applies limit per item type so a full page of one type cannot hide another', async () => {
+		vi.mocked(ScriptService.listScripts).mockResolvedValueOnce([
+			{ path: 'f/scripts/s1', language: 'bun' },
+			{ path: 'f/scripts/s2', language: 'bun', draft_only: true }
+		] as any)
+		vi.mocked(FlowService.listFlows).mockResolvedValueOnce([{ path: 'f/flows/f1' }] as any)
+
+		const raw = await callGlobalTool('list_workspace_items', {
+			types: ['script', 'flow'],
+			limit: 2
+		})
+
+		const items = JSON.parse(raw)
+		expect(items.map((i: any) => i.path)).toEqual(['f/scripts/s1', 'f/scripts/s2', 'f/flows/f1'])
+		// Server-synthesized draft-only rows must read as drafts, not deployed items.
+		expect(items.map((i: any) => i.isDraft)).toEqual([false, true, false])
+	})
+
 	it('lists and edits the live script editor draft through its effective path', async () => {
 		seedBackendDraft(
 			'script',
diff --git a/frontend/src/lib/components/copilot/chat/global/core.ts b/frontend/src/lib/components/copilot/chat/global/core.ts
index 49373af584..fdabb15bc7 100644
--- a/frontend/src/lib/components/copilot/chat/global/core.ts
+++ b/frontend/src/lib/components/copilot/chat/global/core.ts
@@ -295,7 +295,17 @@ const listWorkspaceItemsSchema = z.object({
 		.min(1)
 		.max(MAX_LIST_LIMIT)
 		.optional()
-		.describe('Maximum number of items to return. Defaults to 50 and is capped at 100.')
+		.describe(
+			'Maximum items per item type per page (for triggers, per trigger kind). Defaults to 50 and is capped at 100.'
+		),
+	page: z
+		.number()
+		.int()
+		.min(1)
+		.optional()
+		.describe(
+			'Page number, starting at 1. Each item type pages independently: request the next page while any type still returns a full page. Drafts appear on page 1 only, capped at limit per type.'
+		)
 })
 
 const readWorkspaceItemSchema = z.object({
@@ -303,7 +313,13 @@ const readWorkspaceItemSchema = z.object({
 	path: z.string().describe('Workspace path of the item to read.'),
 	trigger_kind: triggerKindSchema
 		.optional()
-		.describe('Required when type is trigger. Identifies which trigger service to call.')
+		.describe('Required when type is trigger. Identifies which trigger service to call.'),
+	version: z
+		.enum(['deployed'])
+		.optional()
+		.describe(
+			'Pass "deployed" to read the deployed workspace state even when a draft exists (e.g. to learn the deployed input schema before running the deployed version). Default reads your draft when one exists.'
+		)
 })
 
 const draftOverrideField = z
@@ -976,7 +992,8 @@ ${pipelineBullet}
 - After creating or editing a script or flow draft, run test_run_script, test_run_flow, or test_run_step with representative args before reporting that it works. These tools prefer drafts, so testing does not require deployment.
 - Use list_runs to find recent runs (optionally filtered by path, creator, label, or status), then get_job_logs with a returned id to inspect a specific run's logs — without starting a new test run.
 - Use open_page to show a workspace page with filters applied — Runs, Schedules, Variables, Resources, Assets, Audit logs, or Workspace settings on a specific tab (e.g. "open the failed runs of f/foo/bar", "open the schedule for X", "open the git sync settings"). Only the pages listed for this user in the tool are available; don't offer pages that aren't listed. Don't use it as a substitute for list_runs when you just need the data yourself.
-- For a Windmill operation no other tool covers (workers, queue state, a run's result or args, running deployed items, ...), use search_api_endpoints to find a REST endpoint, then call_api_get for reads or call_api_endpoint for mutations (the user is asked to confirm those). Always prefer a dedicated tool when one exists; endpoints for authoring or deleting scripts, flows, apps, schedules, resources, or variables are not available through the API catalog tools — use the draft tools and delete_workspace_item instead.
+- For a Windmill operation no other tool covers (workers, queue state, a run's result or args, ...), use search_api_endpoints to find a REST endpoint, then call_api_get for reads or call_api_endpoint for mutations (the user is asked to confirm those). Always prefer a dedicated tool when one exists; endpoints for authoring or deleting scripts, flows, apps, schedules, resources, or variables are not available through the API catalog tools — use the draft tools and delete_workspace_item instead.
+- runScriptByPath / runFlowByPath from the API catalog run the DEPLOYED version of an item. Use them only when the user explicitly asks to run the deployed version, and read the item with read_workspace_item version: "deployed" first so the arguments match the deployed input schema (a draft may have different inputs). To test something you are editing or just wrote, always use test_run_script, test_run_flow, or test_run_step — they run the draft.
 - When a required decision is ambiguous, use askUserQuestion with two to ten clear proposed answer strings instead of guessing. The user can also type a custom answer when none of the proposed answers fit. Set multiSelect: true only when the answers can genuinely co-apply and the user may pick several (not mutually exclusive).
 - When the user asks you to remember a lasting preference, always/never do something, or change/stop a behavior going forward, call update_user_instructions to persist it. It edits only the USER INSTRUCTIONS block (not WORKSPACE INSTRUCTIONS). Keep each instruction concise; do not use it for one-off requests scoped to the current task.
 - Keep context targeted.${
@@ -1062,7 +1079,10 @@ function scriptToItem(script: Script | NewScript, includeValue: boolean): Worksp
 		summary: script.summary,
 		language: script.language,
 		value: includeValue ? script.content : undefined,
-		isDraft: false
+		schema: includeValue ? (script as Script).schema : undefined,
+		// Listings with includeDraftOnly synthesize rows for editor drafts that
+		// have no deployed counterpart — label those honestly.
+		isDraft: (script as Script).draft_only ?? false
 	}
 }
 
@@ -1074,7 +1094,7 @@ function flowToItem(flow: Flow, includeValue: boolean): WorkspaceItem {
 		value: includeValue
 			? { value: flow.value, schema: flow.schema, groups: flow.value.groups ?? null }
 			: undefined,
-		isDraft: false
+		isDraft: (flow as Flow & { draft_only?: boolean }).draft_only ?? false
 	}
 }
 
@@ -1461,7 +1481,12 @@ function triggerToItem(
 type TriggerService = {
 	exists(args: { workspace: string; path: string }): Promise<boolean>
 	get(args: { workspace: string; path: string }): Promise<TriggerLike>
-	list(args: { workspace: string; pathStart?: string; perPage?: number }): Promise<TriggerLike[]>
+	list(args: {
+		workspace: string
+		pathStart?: string
+		perPage?: number
+		page?: number
+	}): Promise<TriggerLike[]>
 	create(args: { workspace: string; requestBody: any }): Promise<string>
 	update(args: { workspace: string; path: string; requestBody: any }): Promise<string>
 	delete(args: { workspace: string; path: string }): Promise<string>
@@ -1546,18 +1571,27 @@ async function readWorkspaceItem(
 	type: WorkspaceItemType,
 	path: string,
 	workspace: string,
-	triggerKind?: TriggerKind
+	triggerKind?: TriggerKind,
+	deployedOnly = false
 ): Promise<WorkspaceItem> {
 	switch (type) {
 		case 'script': {
-			// Prefer the DB draft (newer than the deployed version) when one exists.
-			const script = await ScriptService.getScriptByPath({ workspace, path, getDraft: true })
-			return scriptToItem((script.draft as Script | undefined) ?? script, true)
+			// Prefer the DB draft (newer than the deployed version) when one exists,
+			// unless the caller explicitly asked for the deployed state.
+			const script = await ScriptService.getScriptByPath({
+				workspace,
+				path,
+				getDraft: !deployedOnly
+			})
+			const draft = deployedOnly ? undefined : (script.draft as Script | undefined)
+			return scriptToItem(draft ?? script, true)
 		}
 		case 'flow': {
-			// Prefer the DB draft (newer than the deployed version) when one exists.
-			const flow = await FlowService.getFlowByPath({ workspace, path, getDraft: true })
-			return flowToItem((flow.draft as Flow | undefined) ?? flow, true)
+			// Prefer the DB draft (newer than the deployed version) when one exists,
+			// unless the caller explicitly asked for the deployed state.
+			const flow = await FlowService.getFlowByPath({ workspace, path, getDraft: !deployedOnly })
+			const draft = deployedOnly ? undefined : (flow.draft as Flow | undefined)
+			return flowToItem(draft ?? flow, true)
 		}
 		case 'schedule':
 			return scheduleToItem(await ScheduleService.getSchedule({ workspace, path }), true)
@@ -1598,7 +1632,8 @@ async function listWorkspaceItems(
 	types: WorkspaceItemType[],
 	workspace: string,
 	pathPrefix: string | undefined,
-	perPage: number
+	perPage: number,
+	page?: number
 ): Promise<WorkspaceItem[]> {
 	const items: WorkspaceItem[] = []
 
@@ -1607,6 +1642,7 @@ async function listWorkspaceItems(
 			workspace,
 			pathStart: pathPrefix,
 			perPage,
+			page,
 			includeDraftOnly: true,
 			withoutDescription: true
 		})
@@ -1618,6 +1654,7 @@ async function listWorkspaceItems(
 			workspace,
 			pathStart: pathPrefix,
 			perPage,
+			page,
 			includeDraftOnly: true,
 			withoutDescription: true
 		})
@@ -1628,7 +1665,8 @@ async function listWorkspaceItems(
 		const schedules = await ScheduleService.listSchedules({
 			workspace,
 			pathStart: pathPrefix,
-			perPage
+			perPage,
+			page
 		})
 		for (const schedule of schedules) items.push(scheduleToItem(schedule, false))
 	}
@@ -1638,7 +1676,8 @@ async function listWorkspaceItems(
 			const triggers = await triggerServices[kind].list({
 				workspace,
 				pathStart: pathPrefix,
-				perPage
+				perPage,
+				page
 			})
 			for (const trigger of triggers) items.push(triggerToItem(kind, trigger, false))
 		}
@@ -1648,7 +1687,8 @@ async function listWorkspaceItems(
 		const resources = await ResourceService.listResource({
 			workspace,
 			pathStart: pathPrefix,
-			perPage
+			perPage,
+			page
 		})
 		for (const resource of resources) items.push(resourceToItem(resource, false))
 	}
@@ -1657,7 +1697,8 @@ async function listWorkspaceItems(
 		const variables = await VariableService.listVariable({
 			workspace,
 			pathStart: pathPrefix,
-			perPage
+			perPage,
+			page
 		})
 		for (const variable of variables) items.push(variableToItem(variable))
 	}
@@ -1666,7 +1707,8 @@ async function listWorkspaceItems(
 		const apps = await AppService.listApps({
 			workspace,
 			pathStart: pathPrefix,
-			perPage
+			perPage,
+			page
 		})
 		for (const app of apps) items.push(appToItem(app, false))
 	}
@@ -2348,7 +2390,7 @@ export const globalTools: Tool<{}>[] = [
 		def: createToolDef(
 			listWorkspaceItemsSchema,
 			'list_workspace_items',
-			'List workspace items and drafts. Returns metadata only.'
+			'List workspace items and drafts. Returns metadata only, up to limit items per item type per page (default 50); pass page to continue past a full page.'
 		),
 		fn: async ({ args, workspace, toolId, toolCallbacks }) => {
 			const parsed = listWorkspaceItemsSchema.parse(args)
@@ -2361,24 +2403,37 @@ export const globalTools: Tool<{}>[] = [
 				types,
 				workspace,
 				parsed.path_prefix,
-				Math.min(limit, MAX_LIST_LIMIT)
+				Math.min(limit, MAX_LIST_LIMIT),
+				parsed.page
 			)
 			for (const item of workspaceItems) {
 				byKey.set(getWorkspaceItemKey(item.type, item.path, item.triggerKind), item)
 			}
 
-			for (const draft of await listGlobalDrafts(workspace)) {
-				if (!types.includes(draft.type)) continue
-				if (parsed.path_prefix && !draft.path.startsWith(parsed.path_prefix)) continue
-				byKey.set(getWorkspaceItemKey(draft.type, draft.path, draft.triggerKind), {
-					...draft,
-					value: undefined
-				})
+			// Drafts are not paginated server-side; overlay them on page 1 only,
+			// capped at `limit` per type, so results stay bounded and later pages
+			// never repeat a page-1 item as its draft twin. Chat draft counts are
+			// small — past the cap, a narrower path_prefix still finds any draft
+			// (it filters before the cap; query filters after).
+			if ((parsed.page ?? 1) === 1) {
+				const draftCountByType = new Map<string, number>()
+				for (const draft of await listGlobalDrafts(workspace)) {
+					if (!types.includes(draft.type)) continue
+					if (parsed.path_prefix && !draft.path.startsWith(parsed.path_prefix)) continue
+					const count = draftCountByType.get(draft.type) ?? 0
+					if (count >= limit) continue
+					draftCountByType.set(draft.type, count + 1)
+					byKey.set(getWorkspaceItemKey(draft.type, draft.path, draft.triggerKind), {
+						...draft,
+						value: undefined
+					})
+				}
 			}
 
-			const results = Array.from(byKey.values())
-				.filter((item) => itemMatches(item, parsed.query))
-				.slice(0, limit)
+			// No cross-type truncation: each type is already capped at `limit` rows by
+			// its own list call, and slicing the concatenation would silently drop the
+			// later types' rows while their next page skips past them.
+			const results = Array.from(byKey.values()).filter((item) => itemMatches(item, parsed.query))
 
 			toolCallbacks.setToolStatus(toolId, {
 				content: `Listed ${results.length} workspace item(s)`
@@ -2390,7 +2445,7 @@ export const globalTools: Tool<{}>[] = [
 		def: createToolDef(
 			readWorkspaceItemSchema,
 			'read_workspace_item',
-			'Read one workspace item or draft.'
+			'Read one workspace item or draft. Prefers your draft when one exists; pass version: "deployed" to read the deployed state instead.'
 		),
 		fn: async ({ args, workspace, toolId, toolCallbacks }) => {
 			const parsed = readWorkspaceItemSchema.parse(args)
@@ -2399,7 +2454,10 @@ export const globalTools: Tool<{}>[] = [
 				toolCallbacks.setToolStatus(toolId, { content: message, error: message })
 				return JSON.stringify({ success: false, error: message })
 			}
-			const draft = await getGlobalDraft(workspace, parsed.type, parsed.path, parsed.trigger_kind)
+			const draft =
+				parsed.version === 'deployed'
+					? null
+					: await getGlobalDraft(workspace, parsed.type, parsed.path, parsed.trigger_kind)
 			if (draft) {
 				toolCallbacks.setToolStatus(toolId, {
 					content: `Read draft ${parsed.type} "${parsed.path}"`
@@ -2410,7 +2468,13 @@ export const globalTools: Tool<{}>[] = [
 			toolCallbacks.setToolStatus(toolId, {
 				content: `Reading ${parsed.type} "${parsed.path}"...`
 			})
-			const item = await readWorkspaceItem(parsed.type, parsed.path, workspace, parsed.trigger_kind)
+			const item = await readWorkspaceItem(
+				parsed.type,
+				parsed.path,
+				workspace,
+				parsed.trigger_kind,
+				parsed.version === 'deployed'
+			)
 			toolCallbacks.setToolStatus(toolId, { content: `Read ${parsed.type} "${parsed.path}"` })
 			return JSON.stringify(serializeWorkspaceItemForRead(item), null, 2)
 		}
diff --git a/frontend/src/lib/components/copilot/chat/global/workspaceItems.ts b/frontend/src/lib/components/copilot/chat/global/workspaceItems.ts
index 21a1c883c3..c17e84cc8f 100644
--- a/frontend/src/lib/components/copilot/chat/global/workspaceItems.ts
+++ b/frontend/src/lib/components/copilot/chat/global/workspaceItems.ts
@@ -123,6 +123,8 @@ export type WorkspaceItem = {
 		| CreateResource
 		| CreateVariable
 		| AppDraftValue
+	/** Input schema of a script read (flows carry theirs inside `value`). */
+	schema?: unknown
 	isDraft: boolean
 	isLiveDraft?: boolean
 }

From 2b58df57fc5bae08155ffd7198643ed739e6a463 Mon Sep 17 00:00:00 2001
From: hugocasa <hugo@casademont.ch>
Date: Mon, 20 Jul 2026 18:47:25 +0200
Subject: [PATCH 067/171] feat(ai): extract prompt cache token usage from
 OpenAI and Azure providers (#10214)

* feat(ai): extract prompt cache token usage from OpenAI and Azure providers

Parse the nested cache token details OpenAI returns and thread them into
TokenUsage, matching the Anthropic and Bedrock providers.

- sse.rs: add OpenAIPromptTokensDetails / OpenAIInputTokensDetails and the
  optional prompt_tokens_details / input_tokens_details fields.
- other.rs (Chat Completions) and openai.rs (Responses): populate
  cache_read via .with_cache(cached_tokens, None).

OpenAI's prompt_tokens/input_tokens already include cached tokens (cached is
a subset), so total/prompt are unchanged; cache_read is recorded separately
for reporting. For the same reason the frontend token-usage conversions are
left as-is (adding cached would double-count); optional cache fields and a
clarifying comment are added to prevent a future incorrect Anthropic-style fix.

Fixes WIN-2207

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* test(ai): pin OpenAI/Azure cache-token deserialization paths

Add regression tests deserializing the real Chat Completions and Responses
usage payloads, guarding the prompt_tokens_details.cached_tokens /
input_tokens_details.cached_tokens paths against a silent rename.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* refactor(ai): extract to_token_usage() and test the cache mapping

Address review nit: move the usage->TokenUsage conversion into
OpenAIChatUsage::to_token_usage / OpenAIResponsesUsage::to_token_usage so
the providers call one method and the tests exercise the real mapping.
Tests now assert cache_read is populated while input/total are unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 backend/windmill-ai/src/providers/openai.rs   |  4 +-
 backend/windmill-ai/src/providers/other.rs    |  3 +-
 backend/windmill-ai/src/sse.rs                | 77 ++++++++++++++++++-
 .../lib/components/copilot/chat/tokenUsage.ts |  6 ++
 4 files changed, 84 insertions(+), 6 deletions(-)

diff --git a/backend/windmill-ai/src/providers/openai.rs b/backend/windmill-ai/src/providers/openai.rs
index 8a90d84658..8ddd752b70 100644
--- a/backend/windmill-ai/src/providers/openai.rs
+++ b/backend/windmill-ai/src/providers/openai.rs
@@ -518,9 +518,7 @@ impl QueryBuilder for OpenAIQueryBuilder {
         parser.parse_events(response).await?;
 
         // Convert OpenAI Responses usage to TokenUsage
-        let usage = parser
-            .usage
-            .map(|u| TokenUsage::new(u.input_tokens, u.output_tokens, u.total_tokens));
+        let usage = parser.usage.map(|u| u.to_token_usage());
 
         Ok(ParsedResponse::Text {
             content: if parser.accumulated_content.is_empty() {
diff --git a/backend/windmill-ai/src/providers/other.rs b/backend/windmill-ai/src/providers/other.rs
index f641daec64..790bcb6c28 100644
--- a/backend/windmill-ai/src/providers/other.rs
+++ b/backend/windmill-ai/src/providers/other.rs
@@ -269,8 +269,7 @@ impl QueryBuilder for OtherQueryBuilder {
         }
 
         // Convert OpenAI Chat Completions usage to TokenUsage
-        let usage = openai_usage
-            .map(|u| TokenUsage::new(u.prompt_tokens, u.completion_tokens, u.total_tokens));
+        let usage = openai_usage.map(|u| u.to_token_usage());
 
         Ok(ParsedResponse::Text {
             content: if accumulated_content.is_empty() {
diff --git a/backend/windmill-ai/src/sse.rs b/backend/windmill-ai/src/sse.rs
index 66ff7da9de..96692d0173 100644
--- a/backend/windmill-ai/src/sse.rs
+++ b/backend/windmill-ai/src/sse.rs
@@ -13,7 +13,7 @@ use crate::{
         AnthropicExtraContent, ExtraContent, GoogleExtraContent, OpenAIFunction, OpenAIToolCall,
     },
     query_builder::StreamEventSink,
-    types::StreamingEvent,
+    types::{StreamingEvent, TokenUsage},
 };
 
 #[derive(Deserialize)]
@@ -44,6 +44,14 @@ pub struct OpenAIChoice {
     pub delta: Option<OpenAIChoiceDelta>,
 }
 
+/// Nested prompt token details returned by the Chat Completions API.
+/// `cached_tokens` is the portion of `prompt_tokens` served from cache (a subset, not additive).
+#[derive(Deserialize, Debug, Clone, Default)]
+pub struct OpenAIPromptTokensDetails {
+    #[serde(default)]
+    pub cached_tokens: Option<i32>,
+}
+
 /// OpenAI Chat Completions API usage information (from final chunk with stream_options.include_usage)
 #[derive(Deserialize, Debug, Clone, Default)]
 pub struct OpenAIChatUsage {
@@ -53,6 +61,24 @@ pub struct OpenAIChatUsage {
     pub completion_tokens: Option<i32>,
     #[serde(default)]
     pub total_tokens: Option<i32>,
+    #[serde(default)]
+    pub prompt_tokens_details: Option<OpenAIPromptTokensDetails>,
+}
+
+impl OpenAIChatUsage {
+    /// cached_tokens is a subset of prompt_tokens, so input/total are reported as-is
+    /// and only recorded as cache_read for reporting.
+    pub fn to_token_usage(self) -> TokenUsage {
+        TokenUsage::new(
+            self.prompt_tokens,
+            self.completion_tokens,
+            self.total_tokens,
+        )
+        .with_cache(
+            self.prompt_tokens_details.and_then(|d| d.cached_tokens),
+            None,
+        )
+    }
 }
 
 #[derive(Deserialize)]
@@ -684,6 +710,14 @@ pub struct OpenAIUrlCitationEvent {
     pub title: Option<String>,
 }
 
+/// Nested input token details returned by the Responses API.
+/// `cached_tokens` is the portion of `input_tokens` served from cache (a subset, not additive).
+#[derive(Deserialize, Debug, Clone, Default)]
+pub struct OpenAIInputTokensDetails {
+    #[serde(default)]
+    pub cached_tokens: Option<i32>,
+}
+
 /// OpenAI Responses API usage information
 #[derive(Deserialize, Debug, Clone)]
 pub struct OpenAIResponsesUsage {
@@ -693,6 +727,19 @@ pub struct OpenAIResponsesUsage {
     pub output_tokens: Option<i32>,
     #[serde(default)]
     pub total_tokens: Option<i32>,
+    #[serde(default)]
+    pub input_tokens_details: Option<OpenAIInputTokensDetails>,
+}
+
+impl OpenAIResponsesUsage {
+    /// cached_tokens is a subset of input_tokens, so input/total are reported as-is
+    /// and only recorded as cache_read for reporting.
+    pub fn to_token_usage(self) -> TokenUsage {
+        TokenUsage::new(self.input_tokens, self.output_tokens, self.total_tokens).with_cache(
+            self.input_tokens_details.and_then(|d| d.cached_tokens),
+            None,
+        )
+    }
 }
 
 /// OpenAI Responses API response object (from response.completed event)
@@ -927,6 +974,34 @@ mod tests {
         assert_eq!(json["content"], "hmm");
     }
 
+    #[test]
+    fn openai_chat_usage_maps_cached_prompt_tokens() {
+        // Payload shape returned by OpenAI and Azure OpenAI Chat Completions.
+        // cached_tokens lives under prompt_tokens_details and is a subset of prompt_tokens,
+        // so it must land in cache_read while input/total stay as the provider reported them.
+        let usage: OpenAIChatUsage = serde_json::from_str(
+            r#"{"prompt_tokens":4819,"completion_tokens":1,"total_tokens":4820,"prompt_tokens_details":{"cached_tokens":4736,"audio_tokens":0}}"#,
+        )
+        .unwrap();
+        let token_usage = usage.to_token_usage();
+        assert_eq!(token_usage.cache_read_input_tokens, Some(4736));
+        assert_eq!(token_usage.input_tokens, Some(4819));
+        assert_eq!(token_usage.total_tokens, Some(4820));
+    }
+
+    #[test]
+    fn openai_responses_usage_maps_cached_input_tokens() {
+        // Payload shape returned by the OpenAI Responses API.
+        let usage: OpenAIResponsesUsage = serde_json::from_str(
+            r#"{"input_tokens":4819,"input_tokens_details":{"cache_write_tokens":0,"cached_tokens":4736},"output_tokens":2,"total_tokens":4821}"#,
+        )
+        .unwrap();
+        let token_usage = usage.to_token_usage();
+        assert_eq!(token_usage.cache_read_input_tokens, Some(4736));
+        assert_eq!(token_usage.input_tokens, Some(4819));
+        assert_eq!(token_usage.total_tokens, Some(4821));
+    }
+
     #[test]
     fn openai_delta_parses_reasoning_content() {
         // DeepSeek and similar stream reasoning under `reasoning_content`.
diff --git a/frontend/src/lib/components/copilot/chat/tokenUsage.ts b/frontend/src/lib/components/copilot/chat/tokenUsage.ts
index 51290f9269..0091e11227 100644
--- a/frontend/src/lib/components/copilot/chat/tokenUsage.ts
+++ b/frontend/src/lib/components/copilot/chat/tokenUsage.ts
@@ -70,12 +70,15 @@ export function anthropicUsageToChatTokenUsage(
 	}
 }
 
+// Unlike Anthropic, OpenAI's input_tokens already includes cached tokens
+// (input_tokens_details.cached_tokens is a subset), so it must not be added again.
 export function openAIResponsesUsageToChatTokenUsage(
 	usage:
 		| {
 				input_tokens?: number | null
 				output_tokens?: number | null
 				total_tokens?: number | null
+				input_tokens_details?: { cached_tokens?: number | null } | null
 		  }
 		| null
 		| undefined
@@ -90,12 +93,15 @@ export function openAIResponsesUsageToChatTokenUsage(
 	}
 }
 
+// Unlike Anthropic, OpenAI's prompt_tokens already includes cached tokens
+// (prompt_tokens_details.cached_tokens is a subset), so it must not be added again.
 export function openAICompletionsUsageToChatTokenUsage(
 	usage:
 		| {
 				prompt_tokens?: number | null
 				completion_tokens?: number | null
 				total_tokens?: number | null
+				prompt_tokens_details?: { cached_tokens?: number | null } | null
 		  }
 		| null
 		| undefined

From c8870d36aed2283bfa14419cd0bb346083f27b9c Mon Sep 17 00:00:00 2001
From: Guilhem <guilhemlemouel@gmail.com>
Date: Mon, 20 Jul 2026 20:27:56 +0200
Subject: [PATCH 068/171] fix(sessions): session bar badge readouts, job
 persistence, refresh bounce (#10217)

---
 .../copilot/chat/AIChatManager.svelte.ts      | 18 ++++++++++
 .../copilot/chat/AIChatManager.test.ts        | 31 +++++++++++++++++
 .../copilot/chat/JobsSegment.svelte           | 34 +++++++++++++++----
 .../src/lib/components/copilot/chat/shared.ts |  3 ++
 .../sessions/SessionChangesBar.svelte         | 11 ++++--
 .../(root)/(logged)/sessions/+page.svelte     |  7 +++-
 6 files changed, 95 insertions(+), 9 deletions(-)

diff --git a/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts b/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
index bc9968561c..b9649200ab 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
+++ b/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
@@ -627,8 +627,26 @@ export class AIChatManager {
 	updateJob = (jobId: string, update: Partial<ChatJob>) => {
 		const idx = this.backgroundJobs.findIndex((j) => j.jobId === jobId)
 		if (idx === -1) return
+		const wasTerminal = !this.isJobNonTerminal(this.backgroundJobs[idx].status)
 		this.backgroundJobs[idx] = { ...this.backgroundJobs[idx], ...update }
 		this.backgroundJobs = [...this.backgroundJobs]
+		// Persist on the transition to terminal: a job that completes inside the
+		// inline wait never hits the detach/poller persist paths, and would
+		// otherwise vanish from the tray on reload.
+		if (!wasTerminal && !this.isJobNonTerminal(this.backgroundJobs[idx].status)) {
+			void this.#persistBackgroundJobs()
+		}
+	}
+
+	/** Mark finished jobs as reviewed (their terminal status was shown in the
+	 * jobs popover) and persist, so the chip stays relaxed across reloads. */
+	markJobsReviewed = (jobIds: string[]) => {
+		const ids = new Set(jobIds)
+		if (!this.backgroundJobs.some((j) => ids.has(j.jobId) && !j.reviewed)) return
+		this.backgroundJobs = this.backgroundJobs.map((j) =>
+			ids.has(j.jobId) && !j.reviewed ? { ...j, reviewed: true } : j
+		)
+		void this.#persistBackgroundJobs()
 	}
 
 	/** A job left the inline wait — hand it to the background poller. */
diff --git a/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts b/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts
index 58a2f0cd0a..55bea0d7e6 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts
+++ b/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts
@@ -2539,6 +2539,37 @@ describe('AIChatManager background job completion', () => {
 		expect(manager.pendingJobNotes).toHaveLength(1)
 		expect(manager.pendingJobNotes[0]).toContain('Background job job-1 for "run" succeeded')
 	})
+
+	it('persists on the inline terminal transition and on review', async () => {
+		const manager = new AIChatManager()
+		manager.registerJob({
+			jobId: 'job-1',
+			toolCallId: 'tc-1',
+			kind: 'script',
+			label: 'run',
+			workspace: 'ws'
+		})
+		const saveChat = vi.spyOn(manager.historyManager, 'saveChat').mockResolvedValue(undefined)
+
+		// Inline completion reports through updateJob without ever detaching; the
+		// terminal transition alone must write the tray or the job vanishes on reload.
+		manager.updateJob('job-1', { status: 'running' })
+		expect(saveChat).not.toHaveBeenCalled()
+		manager.updateJob('job-1', { status: 'success' })
+		await vi.waitFor(() => expect(saveChat).toHaveBeenCalledTimes(1))
+		expect(saveChat.mock.calls[0][4]).toEqual([
+			expect.objectContaining({ jobId: 'job-1', status: 'success' })
+		])
+
+		// Reviewing persists the flag; re-reviewing is a no-op (no extra write).
+		manager.markJobsReviewed(['job-1'])
+		await vi.waitFor(() => expect(saveChat).toHaveBeenCalledTimes(2))
+		expect(saveChat.mock.calls[1][4]).toEqual([
+			expect.objectContaining({ jobId: 'job-1', reviewed: true })
+		])
+		manager.markJobsReviewed(['job-1'])
+		expect(saveChat).toHaveBeenCalledTimes(2)
+	})
 })
 
 describe('DOM selector chips scoped by app path', () => {
diff --git a/frontend/src/lib/components/copilot/chat/JobsSegment.svelte b/frontend/src/lib/components/copilot/chat/JobsSegment.svelte
index 9a6d505b8a..b8a59d5bc9 100644
--- a/frontend/src/lib/components/copilot/chat/JobsSegment.svelte
+++ b/frontend/src/lib/components/copilot/chat/JobsSegment.svelte
@@ -32,8 +32,21 @@
 	const queuedCount = $derived(
 		jobs.filter((j) => j.status === 'queued' || j.status === 'scheduled').length
 	)
-	const failureCount = $derived(jobs.filter((j) => j.status === 'failure').length)
-	const successCount = $derived(jobs.filter((j) => j.status === 'success').length)
+	// A finished job counts as reviewed once its terminal status has been shown in
+	// the open popover; a job that finishes while the popover is closed starts
+	// unreviewed. The flag lives on the job (persisted with it), so review state
+	// survives a reload.
+	$effect(() => {
+		if (!open) return
+		aiChatManager.markJobsReviewed(jobs.filter((j) => isTerminal(j.status)).map((j) => j.jobId))
+	})
+	// Only unreviewed jobs feed the terminal readout: an outcome the user already
+	// saw must not resurface on the chip when a later job finishes.
+	const unreviewed = $derived(jobs.filter((j) => !j.reviewed))
+	const allReviewed = $derived(jobs.length > 0 && unreviewed.length === 0)
+
+	const failureCount = $derived(unreviewed.filter((j) => j.status === 'failure').length)
+	const successCount = $derived(unreviewed.filter((j) => j.status === 'success').length)
 	const liveCount = $derived(jobs.filter((j) => !isTerminal(j.status)).length)
 	const hasLive = $derived(liveCount > 0)
 
@@ -70,9 +83,18 @@
 
 	// Aggregate chip readout, priority-ordered so the most action-worthy state
 	// wins the dot: approval > running > queued > failed > succeeded. A live run
-	// takes the dot even if an earlier job failed (failure resurfaces once idle).
+	// takes the dot even if an earlier job failed (an unreviewed failure
+	// resurfaces once idle). Once every finished job has been reviewed in the
+	// popover, the chip relaxes to a neutral executed-count.
 	const segment = $derived.by(
 		(): { dot: string; pulse: boolean; text: string; danger: boolean } => {
+			if (allReviewed)
+				return {
+					dot: 'bg-gray-400',
+					pulse: false,
+					text: `${jobs.length} job${jobs.length === 1 ? '' : 's'} executed`,
+					danger: false
+				}
 			if (approvalCount > 0)
 				return {
 					dot: dotClass('suspended'),
@@ -111,8 +133,8 @@
 					text: `${failureCount} failed`,
 					danger: true
 				}
-			// All terminal, none failed: green if anything actually succeeded, else gray
-			// (only canceled jobs left — a cancel isn't a success, so don't show green).
+			// All terminal, nothing unreviewed failed: green if anything unreviewed
+			// succeeded, else gray (only canceled left — a cancel isn't a success).
 			if (successCount > 0)
 				return {
 					dot: dotClass('success'),
@@ -123,7 +145,7 @@
 			return {
 				dot: dotClass('canceled'),
 				pulse: false,
-				text: `${jobs.length} canceled`,
+				text: `${unreviewed.length} canceled`,
 				danger: false
 			}
 		}
diff --git a/frontend/src/lib/components/copilot/chat/shared.ts b/frontend/src/lib/components/copilot/chat/shared.ts
index d37b3eda2a..e37ae1da7f 100644
--- a/frontend/src/lib/components/copilot/chat/shared.ts
+++ b/frontend/src/lib/components/copilot/chat/shared.ts
@@ -899,6 +899,9 @@ export type ChatJob = {
 	detached: boolean
 	/** Notify-only: whether its completion has been surfaced to the model yet. */
 	reported: boolean
+	/** Whether the user saw its terminal status in the jobs popover. Reviewed
+	 * outcomes stop driving the segment chip's status readout. Persisted. */
+	reviewed?: boolean
 	/** Trimmed snapshot of the last fetched Job (heavy fields stripped, see
 	 * `trimJob`), fed to `<JobStatusIcon>` so the tray badge matches the runs page
 	 * exactly. Always written together with `status` from the SAME job so the two
diff --git a/frontend/src/lib/components/sessions/SessionChangesBar.svelte b/frontend/src/lib/components/sessions/SessionChangesBar.svelte
index e133dcffea..1d2c9d95e0 100644
--- a/frontend/src/lib/components/sessions/SessionChangesBar.svelte
+++ b/frontend/src/lib/components/sessions/SessionChangesBar.svelte
@@ -15,6 +15,7 @@
 	import { badgeCounts, badgeOf, buildDeployItems } from './sessionDeployModel'
 	import { useExistingMaskKeys } from './sessionDeployModel.svelte'
 	import JobsSegment from '$lib/components/copilot/chat/JobsSegment.svelte'
+	import RowIcon from '$lib/components/common/table/RowIcon.svelte'
 	import ArtifactsSegment from '$lib/components/copilot/chat/artifacts/ArtifactsSegment.svelte'
 
 	// Unified session bar: surfaces what the CURRENT chat changed — pending
@@ -173,8 +174,13 @@
 	const hasJobs = $derived((runtime?.manager.backgroundJobs.length ?? 0) > 0)
 	const hasArtifacts = $derived((runtime?.manager.artifacts.artifacts.length ?? 0) > 0)
 
-	const editsCount = $derived(dockCounts.draft + dockCounts.deployed)
-	const editsLabel = $derived(`${editsCount} edit${editsCount === 1 ? '' : 's'}`)
+	// Drafts are what still needs action, so the token counts only them while any
+	// are pending; once none are left it turns green and counts the deployed.
+	const editsLabel = $derived(
+		dockCounts.draft > 0
+			? `${dockCounts.draft} draft${dockCounts.draft === 1 ? '' : 's'}`
+			: `${dockCounts.deployed} deployed`
+	)
 	let editsOpen = $state(false)
 
 	// Only draft-vs-deployed drives the color: stale/failed live in the drawer's
@@ -262,6 +268,7 @@
 					maxHeightClass="max-h-[min(9rem,50vh)]"
 				>
 					{#snippet row(item)}
+						<RowIcon kind={item.deployKind} path={item.path} size={14} />
 						<span class="min-w-0 flex-1 truncate font-mono font-normal text-primary">
 							{item.displayPath}
 						</span>
diff --git a/frontend/src/routes/(root)/(logged)/sessions/+page.svelte b/frontend/src/routes/(root)/(logged)/sessions/+page.svelte
index 958ad92fc3..a3f45f95fd 100644
--- a/frontend/src/routes/(root)/(logged)/sessions/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/sessions/+page.svelte
@@ -35,7 +35,7 @@
 	import { withWorkspaceParam } from '$lib/components/sessions/sessionMode.svelte'
 	import { enterSessionMode } from '$lib/components/sessions/sessionSwitch.svelte'
 	import type { SessionPreviewTabs } from '$lib/components/sessions/sessionPreviewTabs.svelte'
-	import { userWorkspaces, workspaceStore } from '$lib/stores'
+	import { userWorkspaces, usersWorkspaceStore, workspaceStore } from '$lib/stores'
 	import {
 		getOrCreateRuntime,
 		getRuntime,
@@ -130,6 +130,11 @@
 	// not-found UI below.
 	$effect(() => {
 		if (embedded || !sessionState.hydrated) return
+		// Family membership can't be judged before the workspace list arrives:
+		// workspaceRootId falls back to the raw id for workspaces it can't find,
+		// which makes a same-family session look foreign on a hard reload and
+		// would bounce the URL to another (or a brand-new) session.
+		if ($usersWorkspaceStore === undefined) return
 		// sessionInCurrentFamily reads these via get(), so track them explicitly.
 		$workspaceStore
 		$userWorkspaces

From 0593ff7d7d598af0b9f52d08bb22147e3a83e6e9 Mon Sep 17 00:00:00 2001
From: Guilhem <guilhemlemouel@gmail.com>
Date: Mon, 20 Jul 2026 20:28:09 +0200
Subject: [PATCH 069/171] feat(ai): add npm package search tool to global chat
 (#10204)

* feat(ai): add npm package search tool to global chat

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ai): encode npm search query before building registry URL

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* chore(ai-evals): add global-mode npm package search case

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
---
 ai_evals/cases/global.yaml                    | 31 +++++++++++++++++++
 .../components/copilot/chat/global/core.ts    |  3 ++
 .../components/copilot/chat/script/core.ts    |  7 +++--
 3 files changed, 39 insertions(+), 2 deletions(-)

diff --git a/ai_evals/cases/global.yaml b/ai_evals/cases/global.yaml
index 646a9e870d..f2ff64248f 100644
--- a/ai_evals/cases/global.yaml
+++ b/ai_evals/cases/global.yaml
@@ -1534,6 +1534,37 @@
     - the artifact content has a title, a one-line summary, and three or four bullet steps for onboarding
     - does not create a flow or script draft yet
 
+- id: global-npm1-script-search-package
+  prompt: |-
+    Find a good npm package for parsing RSS/Atom feeds and use it to create a draft Bun script
+    at `f/evals/global/fetch_feed`. The script should take a string `url` input and return the
+    feed title along with the titles of the 5 most recent items. Tell me which package you
+    picked and link its documentation. Leave it as an AI draft only; do not deploy.
+  initial: ai_evals/fixtures/frontend/global/initial/user_admin_evals_folder.json
+  runtime:
+    maxTurns: 12
+  validate:
+    draftCountExactly: 1
+    requiredDrafts:
+      - type: script
+        path: f/evals/global/fetch_feed
+        language: bun
+        valueIncludes:
+          - url
+  toolExpect:
+    requiredToolsUsed:
+      - search_npm_packages
+      - write_script
+    forbiddenToolsUsed:
+      - deploy_workspace_item
+      - delete_workspace_item
+  judgeChecklist:
+    - searches npm for a feed-parsing package before writing the code
+    - the draft Bun script imports the chosen npm package rather than hand-rolling an XML/RSS parser
+    - the script takes a url input and returns the feed title plus the recent item titles
+    - the reply names the chosen package and links its documentation
+    - the result stays as an AI draft and is not deployed
+
 - id: global-dbschema1-postgres-resource-tables
   prompt: |-
     I have a postgres resource at f/data/reports_pg in this workspace.
diff --git a/frontend/src/lib/components/copilot/chat/global/core.ts b/frontend/src/lib/components/copilot/chat/global/core.ts
index fdabb15bc7..fa3e93f56f 100644
--- a/frontend/src/lib/components/copilot/chat/global/core.ts
+++ b/frontend/src/lib/components/copilot/chat/global/core.ts
@@ -58,6 +58,7 @@ import {
 	validateEditableFlowJson
 } from '../flow/editableFlowJson'
 import { createInlineScriptSession } from '../flow/inlineScriptsUtils'
+import { searchNpmPackagesTool } from '../script/core'
 import {
 	getDatatableSdkReference,
 	getFlowPrompt,
@@ -986,6 +987,7 @@ Rules:
 - Use discard_local_draft to remove a draft, including the matching open editor draft. Use delete_workspace_item only to delete a deployed workspace item.
 - Variable values are never readable. For secrets, create a secret variable and reference it from resources as "$var:path/to/variable".
 - Use search_resource_types before write_resource.
+- When script or raw app code needs an external npm package you are not fully familiar with, use search_npm_packages to find it and get its documentation and type definitions. Link the package documentation in your answer when you rely on it.
 - Use get_db_schema with a database resource path to fetch its tables and columns before writing SQL (or a script querying that database).
 - Use get_instructions before writing scripts, flows, resources, or apps. For scripts, pass the target language.
 ${pipelineBullet}
@@ -2244,6 +2246,7 @@ export const globalTools: Tool<{}>[] = [
 		}
 	},
 	createSearchHubScriptsTool(false),
+	searchNpmPackagesTool,
 	searchDocsTool,
 	readDocsPageTool,
 	{
diff --git a/frontend/src/lib/components/copilot/chat/script/core.ts b/frontend/src/lib/components/copilot/chat/script/core.ts
index 3d71ea333a..f43b5ed370 100644
--- a/frontend/src/lib/components/copilot/chat/script/core.ts
+++ b/frontend/src/lib/components/copilot/chat/script/core.ts
@@ -537,7 +537,9 @@ export async function searchExternalIntegrationResources(args: { query: string }
 			return JSON.stringify(packagesSearchCache.get(args.query))
 		}
 
-		const result = await fetch(`https://registry.npmjs.org/-/v1/search?text=${args.query}&size=2`)
+		const result = await fetch(
+			`https://registry.npmjs.org/-/v1/search?text=${encodeURIComponent(args.query)}&size=2`
+		)
 		const data = await result.json()
 		const filtered = data.objects.filter(
 			(r: PackageSearchQuery) => r.searchScore >= SCORE_THRESHOLD
@@ -599,7 +601,8 @@ const SEARCH_NPM_PACKAGES_TOOL: ChatCompletionFunctionTool = {
 	}
 }
 
-export const searchNpmPackagesTool: Tool<ScriptChatHelpers> = {
+// Helpers-agnostic so both script mode and global mode can offer it.
+export const searchNpmPackagesTool: Tool<{}> = {
 	def: SEARCH_NPM_PACKAGES_TOOL,
 	fn: async ({ args, toolId, toolCallbacks }) => {
 		toolCallbacks.setToolStatus(toolId, { content: 'Searching for relevant packages...' })

From 87be041c091dd7fdd8c6be907a9b2894779f9ac0 Mon Sep 17 00:00:00 2001
From: hugocasa <hugo@casademont.ch>
Date: Mon, 20 Jul 2026 20:36:34 +0200
Subject: [PATCH 070/171] fix(git-sync): avoid percent-encoded colon in
 git-sync hub script path (#10213)

* fix(git-sync): avoid percent-encoded colon in git-sync hub script path

The git-sync init/detection hub script slug contained a colon stored as
`%3A` in the run-by-path URL. The generated API client re-encodes path
params with encodeURI, turning `%3A` into `%253A` (double-encoding). Some
hardened reverse proxies / WAFs reject double URL-encoding and return a
bare 400 before the request reaches Windmill, breaking git-sync repository
detection on those instances.

The hub resolves scripts by numeric id and ignores the slug, so dropping
the colon from the slug is behavior-neutral (same script, same id-keyed
worker cache) while producing a colon-free run URL.

Also force-cache GIT_SYNC_PULL_SCRIPT_PATH at build alongside
LATEST_GIT_SYNC_SCRIPT_PATH so the backend-driven pull script is always
baked into the image for airgapped workers, instead of relying on an
incidental hubPaths.json overlap.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore: bump ee-repo-ref for git-init slug match fix

Pulls in windmill-ee-private#676 so the EE is_git_init_script check matches
the colon-free git-init hub slug (GitHub App token grant for git-sync jobs).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore: bump ee-repo-ref for git-init slug helper + test

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore: update ee-repo-ref to a3adea1ffb406e709cc480871df58fab6c51aca1

This commit updates the EE repository reference after PR #676 was merged in windmill-ee-private.

Previous ee-repo-ref: cef4e008ef62dec434aa9bb3ec783db8aff6a1c1

New ee-repo-ref: a3adea1ffb406e709cc480871df58fab6c51aca1

Automated by sync-ee-ref workflow.

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
---
 backend/ee-repo-ref.txt                   |  2 +-
 backend/src/main.rs                       | 15 +++++++++++----
 backend/windmill-common/src/workspaces.rs |  7 +++++--
 frontend/src/lib/hubPaths.json            |  2 +-
 4 files changed, 18 insertions(+), 8 deletions(-)

diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index adf0644740..dcb517e0eb 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-51e50629f48dbc4f5520a787b4bdfb76f4cd38d3
+a3adea1ffb406e709cc480871df58fab6c51aca1
diff --git a/backend/src/main.rs b/backend/src/main.rs
index 2bc536200e..6a12250e53 100644
--- a/backend/src/main.rs
+++ b/backend/src/main.rs
@@ -290,11 +290,18 @@ async fn cache_hub_scripts(file_path: Option<String>) -> anyhow::Result<()> {
     create_dir_all(&*HUB_CACHE_DIR)?;
     create_dir_all(&*BUN_BUNDLE_CACHE_DIR)?;
 
-    // Ensure the latest git sync script is always cached, regardless of hubPaths.json contents
+    // Ensure the backend-hardcoded git sync scripts are always cached, regardless of
+    // hubPaths.json contents. These are run by backend-driven sync (not necessarily listed
+    // in hubPaths.json), so airgapped workers would otherwise miss them on a cache lookup.
     let mut all_paths: Vec<String> = paths.into_values().collect();
-    let latest_git_sync = windmill_common::workspaces::LATEST_GIT_SYNC_SCRIPT_PATH.to_string();
-    if !all_paths.contains(&latest_git_sync) {
-        all_paths.push(latest_git_sync);
+    for git_sync_path in [
+        windmill_common::workspaces::LATEST_GIT_SYNC_SCRIPT_PATH,
+        windmill_common::workspaces::GIT_SYNC_PULL_SCRIPT_PATH,
+    ] {
+        let git_sync_path = git_sync_path.to_string();
+        if !all_paths.contains(&git_sync_path) {
+            all_paths.push(git_sync_path);
+        }
     }
 
     for path in &all_paths {
diff --git a/backend/windmill-common/src/workspaces.rs b/backend/windmill-common/src/workspaces.rs
index 76d1d2b488..284ebeb896 100644
--- a/backend/windmill-common/src/workspaces.rs
+++ b/backend/windmill-common/src/workspaces.rs
@@ -171,8 +171,11 @@ pub const LATEST_GIT_SYNC_SCRIPT_PATH: &str = "hub/28790/sync-script-to-git-repo
 
 /// Hub script that applies a repository's state back into a workspace
 /// (the repo → Windmill / "pull" direction). Same script the UI runs from
-/// `PullWorkspaceModal` with `pull: true`; the slug's `:` is percent-encoded.
-pub const GIT_SYNC_PULL_SCRIPT_PATH: &str = "hub/28789/git-sync%3A-init-repository-windmill";
+/// `PullWorkspaceModal` with `pull: true`. The hub resolves by numeric id and
+/// ignores the slug, so the slug is kept free of characters that would be
+/// percent-encoded into the run URL (a `:` becomes `%3A`, which some hardened
+/// reverse proxies reject as double-encoding when the client re-encodes it).
+pub const GIT_SYNC_PULL_SCRIPT_PATH: &str = "hub/28789/git-sync-init-repository-windmill";
 
 /// Prefix used to identify fork workspaces. A workspace whose id starts with this string is a
 /// fork of another workspace.
diff --git a/frontend/src/lib/hubPaths.json b/frontend/src/lib/hubPaths.json
index c3819ecc32..b898ebe658 100644
--- a/frontend/src/lib/hubPaths.json
+++ b/frontend/src/lib/hubPaths.json
@@ -1,6 +1,6 @@
 {
 	"gitSyncTest": "hub/28184/git-repo-test-read-write-windmill",
-	"gitInitRepo": "hub/28789/git-sync%3A-init-repository-windmill",
+	"gitInitRepo": "hub/28789/git-sync-init-repository-windmill",
 	"slackErrorHandler": "hub/28241/workspace-or-schedule-error-handler-slack",
 	"emailErrorHandler": "hub/19795/workspace-or-error-handler-email",
 	"slackRecoveryHandler": "hub/28239/slack/schedule-recovery-handler-slack",

From 11bb37d7ca7fbd50cc66905f41851226a48e57fb Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Mon, 20 Jul 2026 20:39:48 +0200
Subject: [PATCH 071/171] fix(forks): show workspace settings link in sidebar
 for fork creators (#10216)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix(forks): show workspace settings link in sidebar for fork creators

PR #10166 grants a fork's creator developer-management access to the
workspace settings page, but every sidebar entry point to
/workspace_settings stayed gated on is_admin || superadmin, so a
non-admin fork creator could only reach the page by typing the URL.

Widen the four sidebar guards (SettingsMenu, SidebarContent,
WorkspaceMenu, WorkspaceScopeHeader) to also admit fork owners, via a
shared isForkOwner() helper mirroring the fork-owner check already on
the settings page and the backend authorize_fork_owner_add_user grant.

Fixes WIN-2210

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(forks): check fork ownership against the settings entry's target workspace

In session mode SettingsMenu's entry targets workspaceSettingsTarget,
which can differ from the active workspace, but the fork-owner guard was
checked against the active workspace — hiding the entry when the session
targets the user's fork, or exposing a dead link when only the active
workspace is theirs. Check ownership against the workspace the entry
actually points at.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../lib/components/sidebar/SettingsMenu.svelte   | 16 ++++++++++++----
 .../lib/components/sidebar/SidebarContent.svelte | 10 +++++++++-
 .../lib/components/sidebar/WorkspaceMenu.svelte  |  6 ++++--
 .../sidebar/WorkspaceScopeHeader.svelte          | 14 ++++++++++----
 frontend/src/lib/utils/workspaceHierarchy.ts     | 15 +++++++++++++++
 5 files changed, 50 insertions(+), 11 deletions(-)

diff --git a/frontend/src/lib/components/sidebar/SettingsMenu.svelte b/frontend/src/lib/components/sidebar/SettingsMenu.svelte
index d44c3b0364..8b5213da24 100644
--- a/frontend/src/lib/components/sidebar/SettingsMenu.svelte
+++ b/frontend/src/lib/components/sidebar/SettingsMenu.svelte
@@ -29,7 +29,7 @@
 	import DropdownV2 from '$lib/components/DropdownV2.svelte'
 	import ConfirmationModal from '../common/confirmationModal/ConfirmationModal.svelte'
 	import DeleteForkedWorkspaceModal from './DeleteForkedWorkspaceModal.svelte'
-	import { workspaceIsFork } from '$lib/utils/workspaceHierarchy'
+	import { workspaceIsFork, isForkOwner } from '$lib/utils/workspaceHierarchy'
 	import DarkModeObserver from '../DarkModeObserver.svelte'
 	import DiscordIcon from '../icons/brands/Discord.svelte'
 	import MenuLink from './MenuLink.svelte'
@@ -69,9 +69,6 @@
 	} = $props()
 
 	const currentWs = $derived($userWorkspaces?.find((w) => w.id === $workspaceStore))
-	const canManageWorkspace = $derived($userStore?.is_admin || $superadmin)
-	// Fork/dev workspaces are detected by their parent link, not the `wm-fork-` id prefix.
-	const currentWsIsFork = $derived(workspaceIsFork($workspaceStore, $userWorkspaces ?? []))
 
 	const settingsTargetWs = $derived(
 		workspaceSettingsTarget
@@ -79,6 +76,17 @@
 			: undefined
 	)
 
+	// The fork-owner grant must be checked against the workspace the settings entry
+	// actually points at — the session target when in session mode, else the active
+	// workspace — otherwise ownership of the wrong workspace could hide the entry or
+	// expose a dead link to a fork the user doesn't own.
+	const settingsWs = $derived(workspaceSettingsTarget ? settingsTargetWs : currentWs)
+	const canManageWorkspace = $derived(
+		$userStore?.is_admin || $superadmin || isForkOwner(settingsWs, $userStore?.email)
+	)
+	// Fork/dev workspaces are detected by their parent link, not the `wm-fork-` id prefix.
+	const currentWsIsFork = $derived(workspaceIsFork($workspaceStore, $userWorkspaces ?? []))
+
 	let leaveWorkspaceModal = $state(false)
 	let deleteForkModal = $state<DeleteForkedWorkspaceModal>()
 
diff --git a/frontend/src/lib/components/sidebar/SidebarContent.svelte b/frontend/src/lib/components/sidebar/SidebarContent.svelte
index abfd23f751..524c11072a 100644
--- a/frontend/src/lib/components/sidebar/SidebarContent.svelte
+++ b/frontend/src/lib/components/sidebar/SidebarContent.svelte
@@ -4,6 +4,7 @@
 		superadmin,
 		usedTriggerKinds,
 		userStore,
+		userWorkspaces,
 		workspaceStore,
 		isCriticalAlertsUIOpen,
 		enterpriseLicense,
@@ -11,6 +12,7 @@
 		tutorialsToDo,
 		skippedAll
 	} from '$lib/stores'
+	import { isForkOwner } from '$lib/utils/workspaceHierarchy'
 	import { syncTutorialsTodos } from '$lib/tutorialUtils'
 	import { SIDEBAR_SHOW_SCHEDULES } from '$lib/consts'
 	import {
@@ -400,6 +402,12 @@
 			return !page.url.pathname.includes(link.href) && !$usedTriggerKinds.includes(link.kind)
 		})
 	)
+	// Admins, superadmins, and fork creators reach workspace settings (the latter
+	// for the fork members screen; see isForkOwner / backend authorize_fork_owner_add_user).
+	const currentWs = $derived($userWorkspaces?.find((w) => w.id === $workspaceStore))
+	const canManageWorkspace = $derived(
+		$userStore?.is_admin || $superadmin || isForkOwner(currentWs, $userStore?.email)
+	)
 	let secondaryMenuLinks = $derived([
 		// {
 		// 	label: 'Workspace',
@@ -422,7 +430,7 @@
 					aiDescription: 'Button to navigate to account settings',
 					faIcon: undefined
 				},
-				...($userStore?.is_admin || $superadmin
+				...(canManageWorkspace
 					? [
 							{
 								label: 'Workspace',
diff --git a/frontend/src/lib/components/sidebar/WorkspaceMenu.svelte b/frontend/src/lib/components/sidebar/WorkspaceMenu.svelte
index e84f62daef..38eddb2b95 100644
--- a/frontend/src/lib/components/sidebar/WorkspaceMenu.svelte
+++ b/frontend/src/lib/components/sidebar/WorkspaceMenu.svelte
@@ -30,7 +30,7 @@
 	import { workspaceAIClients } from '../copilot/lib'
 	import { twMerge } from 'tailwind-merge'
 	import type { MenubarBuilders } from '@melt-ui/svelte'
-	import { buildWorkspaceHierarchy } from '$lib/utils/workspaceHierarchy'
+	import { buildWorkspaceHierarchy, isForkOwner } from '$lib/utils/workspaceHierarchy'
 	import { canCreateFork } from '$lib/utils/editInFork'
 	import { getContrastTextColor } from '$lib/utils'
 	import { workspaceRootId } from '$lib/components/sessions/sessionScope.svelte'
@@ -167,7 +167,9 @@
 
 	// The active workspace itself (fork included) — names the settings entry.
 	const activeWorkspace = $derived($userWorkspaces?.find((w) => w.id === $workspaceStore))
-	const canManageWorkspace = $derived($userStore?.is_admin || $superadmin)
+	const canManageWorkspace = $derived(
+		$userStore?.is_admin || $superadmin || isForkOwner(activeWorkspace, $userStore?.email)
+	)
 
 	// font-normal is explicit: href-less MenuItems render as <button>, which the
 	// global stylesheet makes semibold, unlike the <a> the href entries get.
diff --git a/frontend/src/lib/components/sidebar/WorkspaceScopeHeader.svelte b/frontend/src/lib/components/sidebar/WorkspaceScopeHeader.svelte
index 9b34819740..31762045f1 100644
--- a/frontend/src/lib/components/sidebar/WorkspaceScopeHeader.svelte
+++ b/frontend/src/lib/components/sidebar/WorkspaceScopeHeader.svelte
@@ -12,7 +12,11 @@
 	import { workspaceAIClients } from '$lib/components/copilot/lib'
 	import WorkspaceFamilyPicker from '$lib/components/sessions/WorkspaceFamilyPicker.svelte'
 	import WorkspaceScopeTrigger from '$lib/components/WorkspaceScopeTrigger.svelte'
-	import { findWorkspaceRoot, findWorkspaceDescendants } from '$lib/utils/workspaceHierarchy'
+	import {
+		findWorkspaceRoot,
+		findWorkspaceDescendants,
+		isForkOwner
+	} from '$lib/utils/workspaceHierarchy'
 	import { useForkableWorkspaces } from '$lib/utils/useForkableWorkspaces.svelte'
 
 	let { isCollapsed = false }: { isCollapsed?: boolean } = $props()
@@ -38,9 +42,11 @@
 	})
 	const rootLabel = $derived(`${forkCount} fork${forkCount === 1 ? '' : 's'}`)
 
-	// Settings link at the bottom of the picker — admin/superadmin only, scoped
-	// to the active workspace (fork or root).
-	const canManageWorkspace = $derived($userStore?.is_admin || $superadmin)
+	// Settings link at the bottom of the picker — admins, superadmins, and fork
+	// creators, scoped to the active workspace (fork or root).
+	const canManageWorkspace = $derived(
+		$userStore?.is_admin || $superadmin || isForkOwner(currentWs, $userStore?.email)
+	)
 	const settingsHref = $derived(canManageWorkspace ? `${base}/workspace_settings` : undefined)
 	const settingsLabel = $derived(`${currentWs?.name ?? effectiveId ?? 'Workspace'} settings`)
 
diff --git a/frontend/src/lib/utils/workspaceHierarchy.ts b/frontend/src/lib/utils/workspaceHierarchy.ts
index e1ff76f934..9c817f49e2 100644
--- a/frontend/src/lib/utils/workspaceHierarchy.ts
+++ b/frontend/src/lib/utils/workspaceHierarchy.ts
@@ -138,6 +138,21 @@ export function workspaceIsFork(
 	return allWorkspaces.find((w) => w.id === workspaceId)?.parent_workspace_id != null
 }
 
+/**
+ * Whether `userEmail` is the creator of a fork workspace. The fork creator gets workspace-settings
+ * access (the fork members screen) even when they are not an admin of it: forking as an ordinary
+ * developer copies their parent `usr` row, leaving them otherwise unable to bring collaborators in.
+ * Mirrors the backend `authorize_fork_owner_add_user` grant.
+ */
+export function isForkOwner(
+	workspace: UserWorkspace | undefined,
+	userEmail: string | null | undefined
+): boolean {
+	return (
+		Boolean(workspace?.parent_workspace_id) && !!userEmail && workspace?.created_by === userEmail
+	)
+}
+
 /**
  * The canonical dev workspace of a prod workspace, if any (at most one per prod). Used to redirect
  * edits from a locked prod workspace into its dev workspace. Disabled dev workspaces are excluded:

From f635bd5ae7bdf84c02ed6f939896e6bdf5206f60 Mon Sep 17 00:00:00 2001
From: "windmill-internal-app[bot]"
 <217088191+windmill-internal-app[bot]@users.noreply.github.com>
Date: Mon, 20 Jul 2026 20:43:03 +0200
Subject: [PATCH 072/171] chore: refresh vendored docs snapshot (#10068)

Co-authored-by: hugocasa <15649739+hugocasa@users.noreply.github.com>
---
 .../docs_snapshot/llms-full.txt.gz            | Bin 674196 -> 676445 bytes
 .../windmill-api/docs_snapshot/llms.txt.gz    | Bin 9144 -> 9116 bytes
 2 files changed, 0 insertions(+), 0 deletions(-)

diff --git a/backend/windmill-api/docs_snapshot/llms-full.txt.gz b/backend/windmill-api/docs_snapshot/llms-full.txt.gz
index cc52e79f2cf39799b37d179d98c12ae3ec37d93a..b453b899bb31301b17555dcc450ac88bb576dcf4 100644
GIT binary patch
delta 675257
zcmV(tK<vMilPTS#DX;+;f9q{rS-L2CU3iKpDtEF;G-}*r(z2?k#x~Qkq!cMDvsm7U
z01zNU0ue9*AVoLltDCc~&eh)Ma-ZAvVD%(t{G*voAizdec9of{mPJG}V>V-sIof|r
z*|I~ej_3hax<vF9i?F63Zl1A9EL<gwRjEJ|65q)BzeG3*VfavSf61E`kO^Be1pz@a
z1t)YB5^d}}^qf|X6N-r;G*NIOCY^ezPJWQJk&pTrksyowrV45&)I_8wW+<E(+qp%&
zWk`o(Nqo8gt|#wxPxD2_42r+&gCb%Qh0+u4gI2XXJ<aA9yUFHei>Mbioj&Y~yNUls
zOX!QaSpIG?&v+>GfBVOuTWba<Ob|IoedN7S^GHXhExyTHy#92u42ION&W3pC7MA=t
zxS_^9+6KjBrTt5qE@zeS5RS@|DBt-Ahwf)G^?<LS^Uhi$<}lAE84g-Io^*BQWx3Gg
z6E@DWIw9fu#1<<OCuXw=2Zljwqo;OuRJL9er@2boeDB<ne<3)yaV{ysj?9}Qt}59i
z`MW|uJ%oxe9HPu}iES&P7gIWrU7Vi;M~crzH;u@Rr&T^V1H8=vs8myHXpuK?cCFCW
z#&_u&PFgbuSRgTPG%vjgv9EAUC!%5YiMu^9)3iKaM4Q7!jv~>voSRvdlU`hmC%RMb
zd@2$t_>&mGf8PPhg1f^Emjn6cFbHcN8Jnd#j!Vi+WA~Wtm)Yh|;F>=X)BMSJ=1;~j
zsjHok6gxEM_c6u?$$ci^2XIb*A>(pfo5NQ}XGK+FOG>ODhv<s&Py;x{&+RD4F=5O?
znTxVu(dENz&MtZknRFMJK+0*K7;rWj_sen0-erV>e-~_(#SG2NC^}X%nT*~cad3Kv
z2&@qYn-Xu}&a{Q^K`whpA37__`EGJ{XN6KCS^Sf3qVcn4y=iGg?uWFf#CA7NiR`SH
zmKIAZv9apL)D0`KQtA}<y3LE1*N=dOaht_^H40Y5*B0>bsLpeA%^Ve0pLSFRw2W%e
zL9q6m1E#&2k{c8tv&piG73LtUB$E5%EHIq|Hz&s>r%bBx*Y;6%Bg5`mlQbJge;r0<
z3tS$TV>hUm$QcR{D##79X*5dgzlPTWtX;4q&;SI`C>n<iFS6`xUH#=EFg~+KJzxVK
zE!vo+{jrNF{qO(!zwcR&5uLmj;#PTdQkIo?)A+$wD+JGwWKRVqTIfC!WCC|OvvUfl
zP|i6!&U5L;EGq(bC-2f)$U*9He>aHxPC#ffANZS2m=i|L;+#wF1UBm+kGQ(=oYU-0
zIal00={U}Y^PC|E=4Zlwbs8A|gLYR9XF<<l#`m#oEi}bxRzP!_6j;>=tHE&kTsWYo
zD8_4>=5?fo@U++bve2z2x!AhbCG)<XTGVE|gb~Muu={UaL~R|8ApCTYe?aA9z#Fot
zELcs_yfC}6MOOWR<;+o9a<`5u5GG5#2aw7!=OC2qp>;ypb)1F=7EBGZ=w1HrJ^t@U
zOdlk`IB+u@)kyM^7;+YPWu~J<G9jVeh(MY{ck#-x`D>*EhB>pvP4O|s2~JR5BDjTB
zhq5J$Vg}7`7_EV9<(Ih-e@lb|7~l^ToXGJWU_(V;U!+F%C7V@q0$MG})=6=37nUyC
zrV1A%qN$Pw;7b$(3yd2mNqkmtgu6BxoOk#M*aUgS1ejwHY5UBNsAISL+KoO#sPW}U
zfSHq&K<CH0_dn^g{c_FQw1-WmZM#mXa$gGrgR6cn3AkA}Kk8=@fBs-r^%%yg*W(v<
z^^M-L$Er>5^rG*9u4o65mQ{i0{p;tSCm-G2PJUzs4i4ROJ_Da11!60G@@^&q=SO$p
z+*l;P`tkP%&!2TGI&G)N#rQ(o+5S0YXsn+D*ebd6S%|^)jcqXLe6_Ck_@g!e`Pt9b
z-x}Z+Rv;X-$b!&0e{kgRrWh}$!X^;Wvn4~<4>PO`AAw=7Ul)@R$?_wRrz1!@&6YE6
z6>6(FCo2T~I~E=+9dF?w=PYH&mYd{0OFqxVd$W@|%@$^EXe`9ujxB;B-3cDR1|V``
zz3qAwu;cIOB!S<+RLTQAbjr96#eGVS5gmq8^&C=yw60oS8<o>}F{-`FqACC`t<U~t
z?gG8*rr5G<=!_f`laL-Ee=eu2+_YN8eHgCK!Xi03v48mF;PA=g{>xX-p6xw+`Xr6c
z6pK7Ga7T_4`|&Mp_Mdw{V%dI94Y|NRCWZ^|ac~SEwuPqawyncynIPMwnZlU5PHS6?
z&j5Av07guLFQ&ZMVm`b+0bRY16!1>i?dLdkfrHYe$?L98>c4)5e|?vCNd?<jH|~u9
zmyZbHb8WlJAyC77tM`A(bN|`vwUdnvW<tt;1XoXVURs6&er^lRw38oy-i{d4iwimu
zr#urg`SaFQd{oetrTrFcaXJrTU|06~x&OYtx3#f4M(z*4Mhb8~U%0oyo3*)srAoK=
zr`qfGIs(U$Bi0tlfBGnSAwb1P8>_3a@m;DxH^Hg9tTe^Y@I`6m7uh>dH@m(Kh&tIy
zd%ctmIEO?@2Wr_)Z^<?5XucSBxAiMVwVGKf(1C0rLS`e|gTxYa3e;!Ys>GY21gf#f
ze~ZanKBEUHXXnX;RnSoKY)&5zgbio{#Fvtb97)S0V(K?Yf5aSQqhqJEYe(VH(4<vF
z6bp`{b7}_{ZR_hUh@m<)a)`%LI5&ynByd{Tf>in~SVG##n3LQ}b^%No3`>!`i>b>=
zBHo4DT@u%Hs7Usi=VKcB3AVd(3H3KiLtQ4Hn`h9su?}ud=el0NKqYe9wPY~~d?zY`
zE$#$455%v;f7Xq;Q2<vN9{<64wTjfLeHDRR0D;AeDVixG97xbA)F@)amD0|KO1y1{
z5F}>W6YG2>!X;COX=}oPb#z!x>2)a8x<r~{&Ug=%ZE&1cPMn?;H<zUG&Mnp#fRD&f
z+l(_mW_#45r~BKo*F2cr)BU#E0aHoVm*h%BG2z8*f2bN$g8@RIzu3xyh@I8~CRS1v
zHFE$5H<JT`g$e;G!9fXh%~g<W@z}zRdW6G-{y;1er@N~EjZNaouUki&9^kylMP5bE
z@($rZQKKO&07kWvX>4xoeF2-!EC#9wep8#`{!{TjQSn~b%ByKHhLa)1Qm08TN$D~E
zm!#&DMF?Rql+~ydj7|s$$Eyj9l{dV@RtrVfzhz0IFb1nAw5%*`f}N3jFZK}%qnN4H
zN$yPImBt|hWjukHj_~o>l2xSi&G(b<Ar^n{V-OF74<2<oZ)oFv2O!U<O!Trnlh+)1
zE_dmJ(gD(}Ge~232OOP`Ce|XNb|KoSl|F3!1s#2hi_UB=@hjr-S^FL5vc)V(kW`h&
z-+^{x-|2R{{E>%cxd4dEta5b{?4Xg{O>+m!$J2p5kHC;qM$pf=bJ?WGDy=QRasz)y
zUnBC4k31m&h<^~bz(IFS<U^ne9>%|PTHzn_*@u63@Fp&p44SggC>{`QgEvkp>?u{L
zAQd06``KnDjQNAmn#jzg$rj6EDYy@s0@gLKhq!NVQKy0apebWJgV4LWVPzAr#m>v0
zYDLBuDn&ZW%+*8^%pj{yTA@crC`*5ql-A_U_sM4W=({f7*whEDO|0R#hko`n=_t{m
z;F><{f~Y`Q<KAc>rq=KS-Lq`6%)7u4HCfQSOyIPt7KK+5+cy=-6RhJbPS(~;aJ({c
zyfWEeu-j4IgRv}kjggKq()cN<<}sB7>(h+g$^OiUXAk{K?ti}|X5+Vx7j1tP(7W-i
z4M;$vGT9FjV2B3)Z6kU}suRq8@LTn78}T$|)9O5*%QvG^88$L0%yJZ@ud8V*MEX=r
z9*y(DS-WBgv(u>UgwkND;Jd9VtwDiM1@OTqPsAiFadyhY9e_O8ET4CK`<AZ)=>#8v
zbwcA7Mss#Y>+`&-adi~>?>m2ABt;OqG*P*sVUH(uZ0&N+OtPFw#Q!39XS5B`r-lwL
zIQ2jWaP$b7xbGI9`lQgIUO`&uHe5u<g`jP_IMTvJ=!JrTthSWzpxZ}j*wDKCQaXt`
zyfK=;f7NT-8nN@V(MU;?_a2!;QRt2^^S%AR`Qt<n+t{eekP1buBtj5*tMxaJUWoaB
z9!PC_v)TKTkR%>|C{-nqrz(#xfOx_vlrP@-__i^-7t88I0UWtY@oxbPSrG-<lqrF)
zE_Bv4tyx*x+oq566Ulv?t9?F)J+IoEA1@WR`X~28LfIet5;95i|6=halwa2VPXq(k
z6NmyFJquHV2fq{%0EzO{aX!p%MTHXXba@`#<DfZC2V5k7X%}ifLibouSw9`ob8dOy
zZ|rdCCp_pSOADxQnsShg<Rr;4+pEJCNNyHd#MM5o;*-_3Ldm)4X+B=V7n{0G51AoC
z6bJCK^Wq1_+%8dDX$)CJ#a2HG-q<fm$09y>K>K~c!EWC!&EtB&-a*l+&veJNT3;CK
z6q*ntB;quGnmUHqNJ&FQOI2g#D`{5xa#BJco0RGwe4P&tSn9FU89-`mZQO;x1OX26
zP=}Gn<u6Xxkw2$p2QKbZ2lHh<l>h+7z~flgR?A&XySOayAhKR25SR%^bw@!qCH4<s
zcE9V6blV+kgB=9jAaXM0#E$w^)@+nKR%UMHX*COfm*SOO&iGhT@_x%bZi5kB-4Ja<
z_^7Prj{THaZ~jO)zZZEWGdY@HbZ8p%hq!1vTx-XLVLr`|v*Cpesr6zGEk^h4QWZ75
z*%sKw^GsP+m?4Wnxn46MPpZb&fafA?dIZp8+1qgD`CR-e0AzHlD`$Gmdv*glc3qM>
zaWYkZ);bCAdtW|zc6dOGsuAIj_YUd*J$(8^u4x@N6F#^zdNiAVj}HoFb|PhRFWywG
z`^%q>e;PmVpxZxjP|i;V{7X7OT#Mu}E%QQb>hEzFj{Ms}Q}H?Io=H7}o8;n9Wzko{
zYO*QBzau6)X=M$h_Z>t{LLTEvC$t9i9(SaFFRuk5Eh_g3Vg{r(Id&aFlj~Z=Sj5S}
zAD(iT3S2NZx>$cCkXV7uP7A|-`EKhL_Z;bV{;C)@G+1Kl>@#4qT1gLIs-#3pHxeU8
z!6ZI4A;DiXQDFtwWmUJZcU0{c*L@YJ7rJ+GU_ZCh`KG7!^^a;*`00h`V%nhn%$5#+
zcB822gE+vO@3(8`^yMQ{KE!RxW^DZ?{Q7Tdy;=E9oqGn0j%D5%@B*8t!{0Bk-F~`x
z>##Do)@NEt@%xGVX6@EJftez5np`Xj66n`G4pVa_kKeE}CY@MutxR@ctM!Dj7a>8|
z9-wV`4D$$(1pSP&6<tiK>$O_<H1?E#BfR83jp9m)@d^UG0qqId(Kl0>I<O=^I6xZe
zm^Hz2-IfTyPBbtlT3Nupd7Z6t4Pm!&G}qZymuxlCeL9Q<minHj{`XIwRdcmKDLsc-
z+0xT`*Pz^1dY*PFG+q^eKuWFgXpVG$yA<3p%qQj;i*~(EA1nxsviZZTDu&X3wcX39
zY~$d`(<hG(lbz&?m(Rb^=<TQb-|QbIcW!S8(cSGPe-Oe>qGT0r<%;$@(_mlP#~wX@
z_3UtKXB&f(JO}<bvg#I<eiYe+JXe5=&68-<SAEleNzbCK?F}=p>6J~lrN7Z*DDlTo
z^D(RsG#$smk!J@UB6fmzrE)8O?IQmbt=Z)+NYef+D<l%XyPS1-6ZYuuQF%U<Um`eb
zMvw*-_%^*@(Yx>dwE7{LW((jbEKYOchNm-$)bg1Gz9}|;E#?^`vBR8_r2X^LzJDMU
zal<MZ3htnNvn^2}(clEd04uaOFZksBCjJ`rManRSZn|PpbAIfu!n{a--3>`IFn}2~
z2d{vqENAdH3n<wrrxnb(z(;;+aT6=nge3CysKDhM8o`V?+3D531fQ>@M5jsT0g0`U
z)ec!MkqdqvQn3z66$~%ZC86Z>-qPKzK+>w)ZPkK=fQn2-`~XJfKvi2g`&=`tV210+
z))N8<+{bteRzER3QCMAn2y4<o*yuE0FxU(h^pfLJHzq6b!LiA}MLyJrIreF$ISv}f
zf-Q_wsZFQzae;``w6DrVM+1Ch$8kLD99d4Bxp4KKyYKecgT8ddP0bd!?`MY*Lg2ek
zgO^eZfj5!$)!`%Fw;b5;C;Hzv-#mW&)mPtqb8wJaHtBoG2JbI_p$2ECosudPYCwQr
z_AR#HSyBKvJLB`yL_B_oKqT7xCcoZHoJejaP+UifxS<@O=lclfd!V$j@DTncQA)zO
zJms#J8*D1Bl;uO>&qkv@AK|j;9qms&2A8SWqeKlFK`@q_t3;8c<tB{;&WK=lZ{Pjo
z_9u5fy>s_A{jXnt`>0ZR>*13x_n&=69OC7Zy~8I7tLZ9VY#|_Xlsw$0Ck~SrFZaLM
zd-<p2>nDF|(+#GJ!zX_{OrAZb|NrXg(-umDK6&=|Ga1hZ=%VdB*U85(pT7vZ7=4h1
zf!Yx)i5+5p+(o5isV5{%&>t;yO|0|5DIt;EXPkYx$i<s~2>5V?^%5B$=>>J6gfD7<
zA&g_u{dU8#-WF@No11H}(B-VI@ftv5#zrYm&Zs<$5|^{o#oYz4tp1zH-t;2i1Hw%W
zKCX1AMh1w^Fia7Qb|?$X0i$0z_KW^%UX@@nXvLvy_1y3NleMg2Euu0AajlS*E7Vh8
z*WK&TlG7i5E^GaUT17yqosm~Ayng(W_7bDSAk{3~KQC>Q$<b6+0t`B3<gmK@OPd&F
zWfu8tyX~TE5U&<+f@|!j5f@av(T>6^DRYF%_f~_beD^G!tiIj;N#^f;g7R85)6{_k
zY(?Z0C@;)r7`_n!-zC>`3lNtU`Kg4vuhU!V?D5)vdR=#=)lkK;fWA<v<7iISdWe3?
zO4OY*&wzsz686#+h6Gr#gyEZNyXb&&%wUfSXaH4;s8HP7eqdagn9Ij!lVT*ye=464
zXa5_?x&W%qdC7W2$_J_Z;!Uw_+OI~|xZ{q^#sxI)@SFw+-LwpFO-%rIaENnFI0=l)
zvw8V{?!x)t#4{H?a9+&0i1DHvmJ@wkK=koWRkJ&*rlWC(pbl-S>TodUf(wpnaNE|5
zde<g_7~%w--m~L9giUJ@F=z5>;R{TeSe`i6CivcZGUxtX*Pi`nv)X+~bDel5%}y8o
zc!4-|4Hw9nS$aMpDIeaM@$pCZ?sY!?`1b98ZEcmkoYrdi<6$9HpirYdWIT87e%ifF
z|L;!C?iX7BItV`_o-j(eufdN;4)80n%R%FFTI%wYYi_9Ez8xA~Es_!JWgl#gwLeJ^
zj%hY=G`oe6#13o0>a<~%c-vqc1FJR1kXH&)Vp%5+sK$IMZUCq*X%U~ZIi6?SQhMos
z)IsOZjHZeo@{x4_pFUkml)G&Zt^a8jkS*q~>Fl^~-%mC0r7SrFfHxDDufL`jgf~Qk
z8{_~WERjnI1mqTZ7X-s8$F8T*{F0#F;3z|m1h#jw>0J}>6{1hO*`2}N;l0sE`N!i=
z{yqK>>oc40`?5RAHe0P1Oty~}^T}_29tqN6Ia8;m)zgv8(SS)AXYvkszu1Xn#Bsd4
zI^)8)2=1@C>O3P2*{kGgW=lahjJ$p6j5)ZzUPq3-gvs$&Z@}aJ=Q=2Y(}MoIj)Nj#
zr@rwOu4<M-S;_ZetG@NM+;!boR(S0ScMZD!p_uH8pcbb&2ZTU%dl-742GwhSDS@4x
zr^R&nZf9o~@y!dn8~7$W@_xz>pJv172mJ70PLh^AJt+pW@6!e+Pq^7^qqzDdmf(LK
zjS53?n%W~zGdEPsc<Y7!9_L~?kX#XLK26++cHVN1gsoq)%Wk}@glr_CA?(W~kpo_y
zuk9N|?8Id4ox+;4=-sF5MwAABW<2$~9{6xFNZwal)}wYHK1(~Ido$s!>fcv&N0d=^
z@2}IIgC49j!;C%+=cXo6SGvQ+3Tg20yelf#%FLY6ew`Xmjqu2+^~J~S<Yxvs^nQ^$
z`B}%kFU|cL3_>m(26-${hE@yz`QU)MpUHs~cw~3zQf-CF77zuN;WLJRuIXq5A7Tb)
z;*tVT7+3PEL@yAhir`H;m&>xs$IA)NxM1~Y&T#N>+q5*?LKq{9dpa0awqT85AO++R
z_9Rv_D9o*m6;n>o(qsp&`^iD-T&gn6Jjl;r*!4do2FM38hT{!{2g4fm$q3P0%n?CY
zn+uMIHW)(W8D{6`eK!$*1ZYK7wCG5IU^&h|lZr9M3-}ZBlGOAL$w0HHVp=eb$rk6g
z2o_H}o{dV9UhJNwiPo4a4d)1l8_no_z9iwp-|<y!96qy?`}nV1)o4sJH9?mzrf20_
z14UJDEosU-eTE9)9M%b2i^B!roXSxSbSqIO&QB$iC0T7VL{9{NW}U;gN~P}_Y3>%s
zG9-i21I6$yttrwVwDymiCAJR8A}LaqpwTFnK#vXfZTY08UPziEC&$n_EI54qmPGGx
zG(jb&^J9)h+}Ux0z&3zMd@!sM8s}w*gpgpK#VhCrGvRWLYkbFocP&S%FRaHT0?|h*
zy816-Pog~~zZeRCi{l_ZSnZOe7|+cE2VQi%MC!(1PLmIWhHQX&6&#uuAT&%<+CX$E
zPud(_iOR$^M1g~)5=V7I-Id3Cscg-Ax9`$^mT1r_Nqea;n#nWhrkB?>EHt*{K=rq|
z<|!D7(d0^?f~GGlY0f8=+Ty-CJbXcv;wO4Br?Zvhn)suCfy;ko;*Wy#mz!s3Y*tJ<
zx}jJKRqUTxCUDvY<8XzdlHAl<d-MOTQDc6I_Ht9RPMzP01j5C=1EF*sFL$V^>V&Sd
znQn54m1c#$Mfh2Q<tceHJ(N~l2W}@k`I%ys@g@$4WwVOby1Vw%7Dr!SYeuSaHJo*a
zekK`U5^eH-@~P#}D!iv;HIlrrw=ZGP+blhts3bvDPe)=mX$T&(^XFDj+(Bl|A4!mV
ze!n~gn$tYv3~5CnV&oZra_K^j4V0$p<%<dD0Qs{8NB~@~dO59~PXd+AOujW7)mo9G
zEBW=Wlc-lO{Q6wJ3UM#}ntycr_U$$O4*W~*+=ozqfP`+w5!Hf9=$8vt^C3Z=p^3@g
z&H_jq;vDdzf~4<Rw223B)e@8miMva7mI~e}Lj>$c!Ugf_?u_#@x(iM&=nj@s`}4Tu
zf2tFcJJ>G&HWye<slQD9LD;S!O{6{-k6NbbUAi<4Mp4;KHs!mUsjE6cFYl6yUM=Tm
zmhtC*1tzrrMe&YPA4O8qW#`}!zwk7SmrwQ{fAa+4{cZ6Dbv6Gv1+qsp0$N}JtLv)Z
z<IaYH3+A;|h@)ATV?jPGP;l&t(BnX=qgSO%TIAw}R<aTpA=9}cg<0=?JXnY@!LYEL
zys;o^;jph+G0PdYr*-tg{%j8E`s7~UJsci?+>Ed%!S!%hLESEoT~M68B2wJBVJF#y
zBC@d8b5Es_hQd<z%#bK~Cag8m@Mb4APLmQG;9kX*S2?ZG4NAZm5V>cKQ1@?zpXh*s
zI^6A!Jwt5aY}=)l#Q3+igHyI;@?JLmz;+uVGfcy3KG>aonoF6P+!M~iktsaQ%X063
zUf&+5`t*FCcGhSTFOl1Yf;|M{l&3}(p<wVP>k`9_Sy|ftO)Z)qLPls71U`feQ1|yH
z?9_aa{zPnyK@Hg9!12yvWTx%@?-n$c@>!q$dq)y}s>P_7cCQS!rda|XHF$`6c=gs4
zV)?Noc$s?a!>qfZIk4%pd>Ii^^IEQdpdfWQHH;@<^T&;M8@tKJKW_@WNu+WoTQ%y@
z7Pp(fgAxbwKBEp^_PtN#d-X_b$tqdbx>9!!I2<LnIYN8Wjoo`cZ@Ovcfa^NMfI#@J
z-Npi&cIo~-v=f4KHe@ktY%yF~{;-wS(k`P*z+NWuf@!)6r+?v07K{ZGou7Pvo)jGW
zyqv9CW>&UsII!z%+5;RF!49yP(}-^MeGd4nvB2)7KCY-Yjgpfm1Nh=Mb~g|)*SUR%
z{%_-F4UR`8?a(B^GKhmf6(bZvoyFGT4);or*-*myj3IKGh+w7Fk`9526I7Q|SM%IN
z{#kaxim|unJqbYSV%*>NGViT_M+k0(GI6K=sdaZ;iU3FK2LSb&G5~zx){#S*Saam`
z-2;5$FqBG&QPnzfm4TaExZ8IRa0^m+IL5g$H0ib>5wRxSS`A{a7b1da+jG@@dI|{c
zAn-{^m{!QPtmJ&g<^bqVi|Hm`UpNrVp0ApiWif&R@dcrb?UR!ns6k+Vm(p}GZACy2
zVI)qKPsUy%t5@FPVm_7DToG_()gg!FWReX^wR5w^j}0P_3SqTE58gOqMB@ef*EyK1
zR<c7;w;T`}4Y?JRmDvu8o>fv}t#W|C(yP`{+${<2v0{b_wksfEB(!AHa$1Oq!XD|%
zfWvY|c&GDGr<09Fomzo^P+#?FyTvo00GRc9&sb|ICJ~i!R1k;Ch21P#M+)itK7G6=
zeMGe-EkGtxBU^41D^YRCrJBQRf)a)K;ylm8`aQ_O*piV7W~4yQrNK&7X=_VIsgHD%
zhY%k@C|u^)96j-n-{u!umxY!}!^L1TXVmzp1HIb!!h{#g+L#`HyZTaAT@ZQr{w*oa
zoqR<dDm24Y6`@Rao<mY~fTx9)B8)0(MA+&+%!>}?T%o)IroiFat|+fJe)C>5H>fv>
zvwzb9IKYFu#@fsh?(c$+)NXTgs~bCRHGU=8sxgS|mFi9*)3H=8-S@20kzfd-bYMVS
z!g0o4CzvE{x3?O95a>0YuM&NISaLNLk6U6@!VHJ%l9_2SRbDnZ39HZmYNvm<neqk~
z3eqjdEVxim#~XIps^yqfSnL&mJ{22wSv;oMIMvz%uCgV!xSoBt!V(7@CJ6Z(a$4nb
zKq?=c*O;6wuCL>1Ik&A0y<L4rk3urN<OCL^a<1Ps3fv!m(N1MJ3u4Fx+XbTYt<_kD
zMiSMfFtZ{ziYn~;uJ0jPu$&%5Z+CrtrMOHRE&G~UXdsA{T4=70jFmWBEp~sy@@S-^
zO!9ZDHPW2;(DXDhp}u?4#E7N`8BxtYYDIwJ`fO2aAGBUvkWjAwyA`b023p?m{+wW=
zY~am}YfSlnIGa>|g*kt(iM*wC>lTJ}*1*1$wD+Dq4U5<&Ndr+k5a4)(Ysa@TI{&0G
zIqQ9Gc=f?G)$fx8Ue{$gi_M>t&G_e53bm%K<xtwhF#q?q7LAZpPd)&a<8kp$4?nFx
z-{J#~#ZzB~FA&`{^VGh+KT2IZ4xf`W-zFMJ`R-hQt4e{TwzvR@C<=yJf{Gt&nWS@^
z2XW=isjpCIYaS6kiIB^Ld?Bexn|1<OPBIs*5}4L>vOR#37v<Xu8Zugy65e#=(BQZp
z(9X^y?X2HRC<?4aM<ilQ-a6-4^qh-5aR6X2n<}<oty8I)eAby|a5s_&I2hpPJRc`t
zJ=uGIoO02hXBzY^Un*yv32>0Ks`1R{8!OCcr>M9{Ndx^m-Nn3f@c|ki6qkt=VVQe7
z5JT^}t*RA#4$C938YT%UM!<S#^4tZs2z-U6YWNn$3h=B}jWSw50>s%}=XzT;Ho4t0
za4fEA7jEE7M37e81F+z$J3vouT;ppi5>Z2cjRn8qld>-Dv|4+i$XJQ_BCH7)6x)Wz
z?skh+M^yY(*Tic6j~iwZ?jcOW`;70>M!ELs`>j!pFGS5+rB|NYXQga7ThLUp_}R<J
zCbV!u>oTv&x~nrBz**ImB35Y37N*Kp+VX$e9eIk?bjFSv!ptElC0ayV5gGtmB?6#-
z!?9BKbD<v8tObh`Csv<lb3u3EgcL5b6!>+ri+J_9`dv49r7&TxJPVj9Ftbr&p|ucj
z==eqTPkT4V7p5?IhNDs~$otT)i6YW!?d-fDazI2zgN*}~a##)9-h~&hcBIx-2CjEr
zf2LXSvd8$SsJbG{skGP7nm)#DH9X6I9#1~Stt!|`6-8;T@gZ*2KgosQRSF2-b=UZL
zEvSsyt8fl&iMEO-SLd;L_Ey!h<{7+d^3cvTC-5e7hi0!ee`}@=?>9}K&fH-j4^>(g
zFt!9>R&kxBt!b=eZL`{}fu$q0GE{<m(2AuJHY()blhW)gIL4iEtL=-D3a^QO{IjkK
zxJ7*#4wYgNzI5g2ha5l3MY91_TMmoBr@J*IfluNUp%6=VEj&`4&Xba6NB!2ty!EHO
zZ=MEz368nUD|Q6K<n35Vyvf-}@(|VuG`{QBKlr|<Cp^-f<)>J;RgJg#<%no~17;d>
zpwZlYOKv~S=5GareU-zv1%cIn&)7VgVldoREWs=^-#g@{1})+c!Ub~_wrw#ReQO#5
zn|F4)rZEJjAh(wKNNsN#BM<tv6+Xq2v6F6dTZgK+YEupSu8r$ZHXANG<nV@j(`->S
zT(&%bhFhoKFPa*vzHfT?csN_(4?8;tijZ#OF~s!X5vd0&53F)unJ-9xJ;l@<X9nLW
zDO>ar<q+INjRS8rcn;9!w!rX)C6_pc=7p;#rB$W?y*mQ7Dwms*GAt`)qtuNDV;n+#
zwYynVN~)=nRPc@}x#1gC1M}|(Ev(!V_JH-M-&xKrzSpsBXR+-?y_!to^xxXEh{7Q?
zp(3$$a-kM5XyGevuRyJT*UFEB%ar>p7K^n6gR_{yg(N*{HQKUv*V(ex+6Zo-`Kz*D
zGaX!FWXNVkpAMfYFr%2cAe?o%S2tCyHB@mE6`0s54$+<Ww@ZNXqe7-Di#O&vy?%^h
zB5-zNFm{-+LSro-IiYjWm1c_-)F3WW68dhopx*M<XxzHgT!nXk{d`_(2lG`egGIc|
zs>p3$%e2T(3Nfv>i#Z$Y%}0sg-|G!BKxV$?DAD${28jnR9U~LsS41gl`m$zIUr<;|
z_lj96kjqr~Bc7urgq<!WL3Bo?Ew!wP4Q-C-OGfjO1Wt$+V(;Rc-GuAqs_&Jxr6#h3
zi)|=^B1;f{gOJF7pkju6zmczrDUGqIs%)GiN%(anZ&qPxJKJU9DFMiVNT{hY$az0#
z$S<>Q$yk;TsPpU96hDKO_^j+D|C#J2JITK#8_E6TLGn}5HHn5jmmmy02%E*S-hx)9
z;0LvmR@ztJn5eLL)yzzmZ2>pf-08UNz0naUqR0@Zi#KV1Xj8jdSx|)X4Xs!KM%y{N
z+r6`4(^dsD&{^&BR>O$5*{217YCn}kANGyDe4~G7L*wxQ-ZsoYA@F+_5<kJimv~Ms
zKtW4`zK)!$O0%3_a1<+^iflztRw{1{wrbvH7iQdr?5r$C!B>Tv9s-iZ{D74!h&+eM
zsmw-LgjZ{S$r&_rPP)V7qO+_58CnFZhyG;XwG<On{tnfuB+7xbD2$no`6(M@Y1I5x
z$NagSFS)e5Ixr^}XzTg>m}dKj+@BJI3$4@~<XM2Cwc4R1%g7ny-pMh~XzodcJjtRu
z3EGn=H7@RZnx77^{sQXk^2kp`<i-SQR0rDnHlG)N<BKL)WndMX1nh}JBe*E1e(TYG
z@6qG16g)4`A&nlq`lKu+PWzS`TPiJv&1wD?h~B8{ut|Jp=MhX`ZiGDUX@&4*cAv-f
zP{sCaK2BXOUOJN7*etH&^a>BJi{ZXXr6jGBmkm%HoK0P(D8a<Nvtt6ZX5tyK0S%!N
zESe*KbgM%8)4Piwe6f=7YLBU#p@n!Lj&_2X(qd%}j*G;o<Iw6I%#R#9_1S4~wI+pI
z!)Qj#46dl{Xz82mEyga5ZO)y^Hn%#xfjyq+!y^?)@wV9V28bn@zQ}uwXf$G_2yn+I
zx#SH!SvgNft=>E@oSmvnX<u6X>4*eb!#=WqdmQC*=T4tG+{f=)sbu>EiY2eBWzRQS
z6>Th9nF^s$;C?*IU$SS!1r+dc+C}9+cF~)GtK;jjq6_V?CR0n2`l`505R9)Rk$0fS
znE5rBQTAPxkq^TaO^L(DijjAHn9j3c`$!n^xk@aB1lWfmDy=PuAnN~3li$S7w(S6a
z?bb?pS|pY8ny~0H1(@|>p2f@CQVMfML6~^7-u-0`AdpTp+5Q#@K(M6u{Q{+q;X|@6
zxtf!p^*JeCzTwO9L_s<-2!Tn+!jK67Ewz%^9XT8_wC*uVZ9_`roIWcZA4k#Dd+91D
z0rV6%{+P1-C%9wkS`pdvk&mWLFS9p)E4&|~S}!#@OHUt%6_Vbos~o)g!Ft*dnZuNE
zEhiN0qa+HH7Du+rQtB$bR5BRqU@KX1p9o4pE%HWf2CK1%peURWBsfI7gc{y5%Hr0;
z*u&2p52*5qb5aUNRm!ti>jnm!M3vrvw*f7clmXgrh!-x8kHyF+z9jQ<OGZt9t$Ii&
zIpS^z{|w4ycIaf#bR`cPTv@_xu$w!c13RA0#bSyDu63N*$~CKi;Oa?Q)7E9&9QIrp
zJf4n@1dCh#f~&N@M})GJcb5j@N?KB0Cd4k6p!X|lX$dmHb&F|n2Ue<S$>mo3`^MF@
zBsBcea$4?@u%1?OU%Gwm>RKOvAVX#)J?0l@#;nxlN*bzjNqSsVp6jY!rorS`!LNBx
z3P-@FUE?NlC~%)MAqqFVq8b>t5S9bO7kZ0Q(xZDpl4G2E%^gX{JxNr6M4Dc*^lKVT
z!uK7GvX5MdlFNKCp&l}%fos*3H*MM|!>CG_4G>_7jXm^j9d$ZZC;7gA{vjw0qk#18
z2S4cU{cDo&HR*S4h1;tM(P%KDLXC^H-A!bnSiarnQWTF?=FTlLofXxIq^6`-Ok~3=
z4K-P0W#ivaZV`mToxhy#Fp!V2o#bhGY?%PC`*P%ZKI;rFI`~&nPO?Fcw5*dnW1tb3
zT3Ev5!Va7#OOoIIV?LFClmNIcZD&%JGlO4QEw(T!&We$Q3}=-X*Z^<`*v@8>L#|B3
z0-KVLei1W#4{o=X_pBi#uIYYdL75K%)pq@q#}9(ucHKP40P@y0o+d;pPqwnyL29Jb
zUgZNp$l4`JCYBv(H#$i-@!oIHq_bu_2s4(}M*7CauSn9}?RL9=8)$3eSM<32`oe?8
z*SAoz?2*<xFM3*;w!bL*)daa<k|xN1Z|q9b_ALKb9^*O|<wko0Ui@i3p+^OkZ9>;z
z6rc;7d6<k~&xDa_<LAw^Dev>AI+6lgeKZ9$n_etfR4LVtmQRDUP<f~elgdgqXxD*C
z{VU6+ne8jfy}}fKE-IGRfXL$RcW0Q>=#`CamyEPO#UguDC7MfGq%qOCZGH%lK~mnE
zav&wd>5qOfdca3&m4n%y6f|M;;R&ZLFux)ureG?-<6J5d@X~?#mh-S#q{23|dwe|4
zk28U5Kh}CD5Fqh|N)y0;Uk+Hjrk7n^`BA>eiis~7XhBndJkDC?rPW$&wZ2fXG{lfP
za-|q~vOnn;r<~3mO5avQem2TNWcj~r5y`NYB5*g@l4h7j3I!%sib|^MXa*7XUpJ}M
zpfs7|LlmLpdb`}m4_s4{JNcoCO0s$rOQNlo)!`Wzs<#F?z~ONs=DEduIb?*1BZ#-Q
zHvy!=uveacU_N+lNQtX>KkZIm^^JrIp7{G>6_2l7N6C|yudn9G_d`Xm;lr`A7JgWu
zy)7fma_~aUf|Wz<2Wt$RZl)$ziNn0`kzV?s<;||?uW5$-gN2S=IVNKj(JuaFG{rxM
zuIRKyKhmaJ&f)ZTuiMkLGFz;&*_ws=qb$NX7No9!F(!K>MW3vyh?-wp2Ds{3F`JZJ
zG_Xk*7IWWrUg|RQvzm=Je5yILsojtu!Tr`GFgQw+Ek<mpw%Hv<M;LG-rX9K1rsI>9
z@Rv^ywrRBDnGEK~Vx~%UH!&%9n>G<A+sd@~y;Kpav#hds(A9F_>gbBWOQOJG>(e}w
zrg$!Y%;WUJ=lj?~5F=l=n}Uv!+In#*{K&PoiQfp<+5sxnU5H?OK<Af%P>%}@pF~*7
z>1@$W8X!7CgpS8>iqMp{MbuMTlOk10kP^J85|{tN+9?5>en#{VVvueren{cKKeyLU
zY3D*q8m&+w3xCcu>tW+o5<`d>j*s&SAbRV6Ns68Qb^ruR?+PJIoPgy%<$AR$CDEx}
zOh!U(TBZ9!1WXORsPABGU-4rcg=rDK!gn)j!N(u>-Q)f6@ff!NgCioCWyib;0Gmu*
z<_M6IB|f5e#xJrkf*c#G7~7E3N2wu!w4*rwbWc5A4;8hL19yuBN8lwQdGgy^5=D%E
zB?T@#gF}HBR5%rPY}y54$_$4!gl!tF<d622B>z;YU|4y_cIcMoA!#(LgQ)HXoD+K2
zy5&m7y-6`h9i(QmvqKycKCPV{Fc#dD;pvD3hfR2dhDW=~ZTJu;6*HUZN_+!JmUNsB
z7abw7&Hz{-860=4IuKjt+pYlyafdg5b9Qo3DJh2lU>>9;e`lZfF^%VJk7TXwyr^=)
z!x|u|KbRZ^1jEi0$G!x!Kx|+w<vlb2gCrj#6-TTqEL{a)B(4y;QwH8g23%DsT8&Ky
z=SagIwPWPil}~pBvBko9TT7KzGPKM={j4Y`-DH0eLn<(OOS!CkQ3#iDvlU~1cCGfT
zeVM}0zNA9E3hJ+5Rk&LFITAAZZq*WY<=M6FkTRsk3lO#*M-4}jJvN$Obl9dykDky_
z&pq`9>ZwUErx|B27$lLlfsu2mj+85E+b~5t#7#Z5^l@3ywJ+$J=(;CcPzbBqVsE>)
z0_D*Smqs|u<?u3g5<bpNH9ahU-v}SYx0;@0QO_P+%T^T5OZ8*n4gm}C<}w2kWB`A_
z2-x|kBEAi`fZ<5FUByOt4up9i#RG`8J4Wh0!iw!8{3XVu8J_53Fr1X6l}O_`8dqNS
z0UFnqAnY&?nCB-Mga(oeZP#zXUUT%4Z+y3POP+v~O6#z#;F7sFwjfu374aC%`bnZ;
z3~Ym&bTT#_jpo!1u^e01EIhitx@f4%@Y-r+MW@uM@*!x>o{=eaOXID`^>C|+9Sh9-
zbWw!a?$@;FXdwuO)C!@_d1ka+<8^E@$`u056KJT)Mwkl=QCHV#j5v{R=*wuYGfxk|
za@Cx0Rhxnq7U}+w5c&Ln*46O)@J7ug>-Te@Rs_4+8N9AD6OK_fx1}uaT1GR^Lw#HO
zx}O6iGK-YEvc<we&n>FGJvPyAXTyKu$-DRe1Oju}>B)_c=A^__LF0)qg7qSOA`HSE
znyF_I@(RzdDw4`8L<OB(G%^hq8Jy<JA;KyEDhFx%yIyRwGey0BeO_${p5<=&T(yej
zM1T?qybMg`ORWVSr~=aGu7KJB9f>4o4bWaMLP-puqR5yO&N3)u?oly9%)9V{F3HlG
zj>C3<Y8UX!LiZd>H!oG&bS&3J=UBWKkBOx5IsC;4Wt>)$7{^P4DCIU+nza}<iEg9b
zFm@$%Vy>a5ENFy(5qVsaLMNu{&x?7kikwsev^IG?c`+q^p9Bq9;FmKA)DuwnKY7@w
z8f_$_C2%6JoTT!kKzkh*?`Rm>K4PE*?Wo%u_r_)Uo4(>x_N80X{2j*>rcHOZEva&d
zEE(?VEUOmlwV!U!&J~0=YV`?@%(BG^r-XD3>%EqfCv69RB*(Iu!IOy@$Og8}YvZQH
zyRA{FAmgR!0Bj(F<VZVGNPfgYn=~g93ePcLAZ)fEI9hQ_BSkw*6`~$=Mp=!p+U{5)
z4&zFRupNmVUft^%aIO-9|N7$L->Jy99zvFPqgwo;rN8idvUNEJXEfJgIm@+xlQ@<1
zJimhZk9&iEf=lPNT6SW1NCTXPSG*rC@~XGVZ83HNO%Vda9va#hyWq%D5_?fDIWU+*
znw!l?v;{o(=W|97(&e}U->7pX0h}Pd%!GY7U!sb%WGtO=+_~?ZAW3M}c})(^s(=I7
z9%F0_sSO;(G3zncRs8;?96M4-aXF|K#bUY0RY)^`6zcUS5o4j6vB$x`8@sTQs=^dl
zS?-yR$2d1L#$iP+c%tW@2bD)uJu(a?fM&ZeeO7a|qw&M>XNRAFwGzvEgSY|7><SMz
ztuM&TP2e77^n8Y@mv0reNL=25m6HxU#GDdgM7Vs#3MX_}Biv(n71=DrCu6jc7>}_O
zV~*s1jq$fTup)NYc?88kXqZoVUOr1*lL&c#To4amO4VE_Vq7yvcz4CPU^oEOYtiX2
zZoNg&JKF$9#l|M&5RBZRu}eQrmkT~u8z>w&IKGT9*u^CB>#EyOun45ClUi&H#nQWF
zcX28__Fh`kDq&G@>1o%(2N!O7g+(a&Y5nnky^g7*VarXHq-!+V;2DpaZLmSzyj45%
zWcq7sA|5A%jk(!phniX|nUJylimAAoK%2DI2){w;wK;8kB+Uh8c#$duUzTkEAKKs^
znmZ+eI>>~1A8ThV44aLe^?2=8%SB}y;A<@<$ADdfT3=DVgp>x*xPb=P95ZZinjva`
zD`iy}G9qhE!eSSl>qMQ4!p{NqpPv*_%0^NjV`!=|hv4cnw(GQbG`JDiDm`>EFFAux
z?IHF`TMQ-9#Ha!#sRKTn$iWzT8-`%7>3HRg3FgNRfvx64+3J_APL3zYTKMIfxzVHG
z*O%NU&dYZE=IM`yFJ+Edwx*#3=~AnI#Nh%)gqhpy`yI*)fIZAd&DdFic#Y`P!I=`7
zgEcqNtV32BoxL^~B^NeeJyj4&6jW!Wh}asEH)>XVvZA___=OJ6<=Y&jU;p;Hw^zT@
z*vqJMT@4zcx!ZfOANwkr7rZfqWHPbu9Ip_TC3#(FE_r$B@L5m{_D(e1cwSw95!Hqj
zaLFPoMwzBjy+<YD#+t-`$?{)+t^Zw8cI@(ifj@ImvcJ~<R1ZCY9tyv4+C(AGz)l;k
zv%d*%8Qx|0e+Y$;=p3f}tqeT9?{7Z{ia{T!S{`J`@>$82sCKgKA-1oFyMQShv#rrN
zk=k+yuy`-|aEKn@lLhl1w8?6J2m=7BE06<+`4uq5Kg)cmFFs9fLLjf%it3mZ0=pbe
zsy0}Kb@bNC58b~-`j~Jo;!Wm5^%@^;=%!|?uAZSv4iU+7ngM5Xu&MK>jz1~>+Vf#c
zbt49{HySl1p}Tzeb+e*)q-?$xHx~4HQN2YIUQP0@{w%v={eCIN<8<ABk$WjaHB<et
z!S!d-VAnYbV|Tw4KbAn6b&^N-uR<TNOLQdPA-(o|JeMR28VskRNWgS+x`YU7YSH<N
z5Ax>o!By#09SpQFJ6|we57PR4yprO#X9a?lBs<3#NWew820Ry0P;GN-HZM-Id7=JV
ztExR)&gn?WtL^UJz<h9jw9Ae63(WRWZFW8nMQVpJ)B;rv*d<oF*x;YTHWkG?+NQ%{
zEv=uyoBx+0Dqka3%HX6)lK>(|WlSQDK;*^ePWyIg^gd!mp(O&cG5he}+M#P3#;5-`
z&4;@kOo<oBLV)dB`DJgT&|D8DnBb|uRSq)B2TKN!>U3xb1KP=d>2*&SyxG&2ILYeo
zTX5G2;d<Ta8Wxh?=i3kJg^!IwP{#PhzSR6y%3yKa$s!!Gi}GqCd+2X|LOh~QGYb)9
zn`lbnEyLA}Q21H%o@j<xZ-MEg9ZdNuV2@zOaWLG7Z%?%#y;@p&-s)j#9B8!rXPXeq
zF1n7P=(1cR8N_ve>_pcvU#(b+uCNCMmc>;A)OCzS2)_BJvFM++p?{i!{%QI7;EHRk
ziYltr)fy}(N3q^&VN;7(r-h@;U;)=L(tqly|5Qu=sfGSi>HMdT`A?PdpBm&p6~^~b
z4`Z-iA5n5;=!`sCd3~)GF|!I6=?Vl&QH4=+iR37nXeEe$$ST{!AuuE9Z5<RwAaK`&
zco1(!e7<CJ`3^+oq4_edZfgXJ0EHRo&bFpGykKAx9=<@(TjVsjiUm5$--~&+Z#R<;
zhyKjVNfgq|z-Si;;$q6;%4;lEN9f~+7qdM4=A)=3!MWz6#$i&qW_KC>HRbB68f4y<
zp9~9RKlTuRvu8IX!5v+8MSm7S4}6QRvXH&%P_gP4Famc`%e>+P*=ST~j@s%cbY@)z
z9=xyDtjJJsi4N)LH$%4bM@mbB<2wv{5`Vzx-M{>Get|c&5P_S9paCY$+J-7exrT>w
z)QUr(5XA8+$Wf8(8-77zi9oND0tm6J0V%PWI~5OqBHtr$%Wm&p+jT04%f_UGwwz0o
z8Z(dMCEiL0dei84G<bVH`Gb#`U!A`3+QpWyddd0q{hB8fP3Qyk`U{mhSzrX7<VlIM
z*g_U{W_s>8YMNM|`fR{!x|9#Ist6Hq!;}J!zgo3bvHa(`*24I?UxLemnp!Qj*VSKY
z_|hVOsH%FI?F((bb^&^B0lj{GX_QrH88C(Z^nx#5YH+*ky>&UC;q=yZYk5Qyck0gF
zD@K4V)@o?e>+9E@%b+pV_!RFh(si%VnIzJ<{d_dCjxdWwc79NHcU>gK_SK6z;r!fN
zHx5U*s%d+X>5f?%5+p3{#TdgClO&JxqG^(U(kTbVHYt`@v=!y?KCH*uH16$4w`<~g
zyvw=dxniGR-UZi|6b`mc?l0eXQ%8;Z{8t$$2f+q7tdWL`#LKoK{RC0CTpMUrpG}+8
z*0l7uFVlBdg*(*{Jnk`j8L)jA`}>7`pF`+>*OwH#{_#owcoLxymeZ-wkyeX&97K<Q
zaF4=DwO2~AMdi`cCTf>CwV3#b(X`owxe~d}IUQd}WgX}YtDmBaoS6un!`YsHYOqHK
zcd1R(Q)Rml9eO_rdU_~v#{#V*5YkRU_saF-&876Fe3&!c__H;xWGNYJsr|`U$_z!#
z=_tU?AX$|S1l(98>aQMZVSCNd@ct`*(l*!keeSlgOq2u!Rq@w6YT-{N+4L-ss#eL;
z!0$a2m`(~;pK6#Di&xi4d6XFnR&SKE#&F&+O+QJt$!R%v8iiG0i8@|eW*dejp<Jc9
z1X(5fK#8AB6!Y;tGD?c5fqH|7Wugzni5&r;=5%)Ip6MJX_PGu<ZiTT&4vA2IkaLfD
zBDEaT+1=Y+lpC+gws<F}Tn~uk`r{L+?l&dTPs`O#vJ0ScF+|j(Nx2-2QFk#pTmt;I
z%}EERTz7$U(D>~keUbQwqE2@cBpnBNcv5m2gZt{q-s2}P50ZR(=AeFMoUQyFV?F5;
zpG#XPow%!io@J9|-uBn;MmO$%%0y_{o`ofxhf^<wy_Q2{?!wqUxIlj2)Hwc1BH9X~
zDVw?~cVg_1ulj_{mNIV89i9&o2c=n;z|T{r%~=(SSF__eyc+x{6U$Ps@Huhr>lj!U
z3}`XqDoXmbw%}Y{Ynb{04_EKOep^;A2g&a0V@8tjqJ!FW?m5YZ!~!#aBook)E6MbX
zdw_n=<q(#n<S7VZr6H*V#l_ONP7vDbI%VU8XGLGdFv9oSP>gF|W$*yY&iH@zx_D<k
z45mT3+Wjq=kFYzqzwITX|A@c-!_7bb!}Y)YL-gq{iul{(;^rUMGNyP{OPY4^_iA?<
zdc)uQDVbHv!FG%``}=Z#@Lp{44c_C|V?<fHp85nu`aW+KBt5l3LBOb%Tp}@Rah-cF
zVsVNbP7Kb;#JzTsDpGaoY7wr%r)J}$;ZLU?Z@Oy4n~tz?-|#TFG7f5ak>tSrQpJBg
z%q@QnZ{0llB0{47;IS5KVjhwY4<y?F?jX6!(OB1bR*3<#mbnFg&M_-yT7T)y_cw78
zI`lG3UMH+O5fq`|-(QIRc5tD!5H+XR=nYSIZ}?TMU(p#@Q~_Nzr02B$ReqSu%*g}Y
z_ciG2QJ7vb!)yu=SQ|YzLDJn{;zj_5Z9YnqYkdGoK(@bC9{vR%bs%=dX|af16X|q`
zx{z+hpYcx|(!6aMHIn4Vf2lL0CHHQ(iQ~LW?%ck;-M!9Nv&p3H5UP*Wp*k%G9scf?
z6u<#{p^rRtK$kKh-loA1v$2|HOWZ}~r_JVEdmtQZ5zn}vVfS4ccZk)cth0OV87?Z$
zGw0GI>6PnhV|?$WZ7TE<vfhAlcGogoqekJkceMpMO={R>)Zxq8e+l?T5+QBni%Fk&
zQjUXIK66h$6VJTWTe$2avareRJHH!!^wFn-&Ye3SjXT-xJHPGR9(;PY^Sk`xkM4{I
zpME;Leb<R{Uy91e&8YI!YSBffNo4~8uXaP_Rj(bNjCV0Asu`&YmmHqW#b>12Lt9GK
zv|YuAwqghKEF}Ane;dz5E-q1w9$fcqyv6~z9s}?i=h3weoplJ%@vyGHj9*B76<rRo
zN|hE>r0_tQUj|jL_8;%+h_Ce}xS8Yyu3>b*i-rrT+_X?*fG!hXf@AEz|DXRm$#y;9
zACoBkZ_9n`Zgy|np_jIk<WBc)rSA;b7l8&9J0*JO-r%F5f4+0C`%%TU67iNRQ<U7+
zG5L2s8h$)--?`KD&YhKaJ|2CN$9=26b9d#PPx4R4@ptgXa5vdA88KOT=hN|TZ|gg^
zyT7d(cjY{<*onitQsROu=J#WUlowYjb21~kOM=HdB}z>h6QUb8mwpKQtFdR0c%@q+
z`!X4>We=B&f69&3s@4~x;zKPeL)9!cbCH;!|G}<{cg^nF*RQ`1@t@E6f2*V~*INb$
zN;7y*2%NW#zO_R9TLEEjTN?q?7@i_(yJi!2);4iBY$76AeZdw_%3Lr(x|$+i#77~P
zv+e9Vo`1`NJ4Ndn6K)*B+Z~`9GAM-*TB{{j08pj!Rwwo4`(?hA4beywLwV&Ur^fY5
zdR<b>?vk^_M-OLuilp|ZWd7oB37wD`(D2Wnd>tB&p<+wBfkU-gdk#O!u4$<wdo(jK
zs6o28MRY}4g$9t=HhE8zidG+gU}IB*_oS|q@e-k;3=*;P{&;3kfBB<s@|@;`vGAvY
zNEcG_rf{p3X1LOxH4_;-o)(Duc@JyHgkQ7<0&@p$csGkdsZ|~$D1aK>QY(LDksVr`
zS%W&ZLj<^DZlJT0Ov2SXvcOu8Re?oi460|L4IiN?k$@5b;ja=`&21}x?fUAO?Ii75
zFZ>nEM_+qmSJ_|E*5UyY&SB*zTvV5Y84+KZzMX>gqnbiKUlh5(?G;m=mV_<8)g>tG
zn9JnI4RHl~ox|&cDWHSPqLbSZU}^M-M3aTFQz-P}suKG^rk;;u@|cV~k*iL=H9+ux
z>ExMfT6z9_NhM9D9+k3xPl+apy?}9!*yhPHci?N4XnM#;sLR)VFKa}noOS?rrdsQh
zcYuPVYd_?3)Ijr4Xo4AQsCrW=u;F&zO^rT`=GL(dkg|~n^?izQPys|}KP*2daJv!{
zF7W$B71hzXLTi2&cRSf~f1NV~uW$@SYGX$m{kWj*PYg4y^7&bRF=V*5adE5#Lu^76
zO<1SPs@p^R1Fw~4At#>ED8+y+<t$FSHQ;nGNW~y^oG*ZGSlOYwO-w+xJ2$n0LC&lw
zKc#iHl#JvNf^$oV9*wODia2qKH#pXWWK}xCnsIn5L#IZo#~{+ckgly^uwq3}Z?O5x
zbxLv4(kczn`>S++#qgl4g-=H)M^p0{*NPv)bx&JLkO%9xnDJ%je9sa!^d_G$$m1y_
zN^O!&kC*I*cLb~Sx|^hf<rIg->|$|JPVe!bCo}wWT;ji@e9Hd<B{h|=rl@*DG?OY;
z9l|rX5MMT_xN@ubL`KQ+q#S59mx$ZS+;U(UPtZ%9pIzF23ClbP2&wW#Q(dmO8WLl+
zS`j(LSaXnO;3<qK3{YsH2PyOEmt82HXf7(u?&Y~Ji^W&VL9(ZgG6*BV06Gay<K5(2
z16^$p6i7XVyhl48`~EU_GVVv@7V^Y3)b}DQ=CSm`oBw@k+7PX5&GT)CzmDBwo5R8H
z+Z^LtGJPh0jlD42+WSak&M?>V4aJ@)dm?a0sRK$j!*ZG&*)wYpEkC*E#N-gfa@SSE
zD#s3Q^)#EK{Bqjs`7a{@P|^ZOI6e^{03JZyZZ7ls03q|!a*=6n<(`k9m6+5B6<C6W
z@=+Kw?u^Wz5sN3yTQ;AC;$z-Y*=T}Itehv43hMlS1ux=gP(g<!ehU-f^ICUuJhAlU
zGn9@z%R3HeRx1WthzT>-IZ3@JqQbEp^1ujo@N#x)1ws<-)puLB_}@<OfaI>}1KZm%
z9P{2}c9OLm0ch1J8Zlk|Ot2{3{DLPevUh@LsgZSBqnj)Dot2X_F3@|R&i|tq??oOY
zJs#(Oalxmc6YLpB9G9<FYF@~hr{nlAaWgKyMmfX2vtzPSQPw?GE7lq0BRPppY><^l
zq%@;wY!gl2e6Papf!c?o4{=?zwVh?yODjC+dW}D1t)>4j0TVl~g4$iA#JDyd?|o^*
zAc6c8)s=S@bP|Ue_7FSDG2?2Jb}~0~jmzPaAX^rHPsu};An=MjC=kk}DfrF1%Cc!z
z_cf{aOPqw|c#P4tS@Geg_&D}eF@3pu&k)xv2UmG_s}ZYKFBv+UPGwRwN5qKfxDniK
zF$~ecLjOV?WXWzsTAtLk7p0yLSgcYxD@g_CW3ZglciIf&&BUZ3KAb9)COIbpjq)wh
zdg+*dJtiJ9?Yi#}FTH?Zfb#^#BbGSvI8rB^`rH%v>||b+3n^oMT8ug%7=#s1k}X*{
zr3m&9qQEQXBf*48QvaTNg$Hbs0vE-gugxaQilsbXxi1_$XEQPG{5<dQtIL_(YD*~%
zjC(X#5Iw^^EeYV<x8GQpsG^}tkj@ej$TReRL+OG^iQcBwNq$rR@{y*8pCP0_A1+-`
z={4EZE%$!My^m3JmNQzS4vMmF-*5vlvD}x3xYWS`&#Fq!Tf`6Om(`YsRf?A2n>9<_
zPJC6w`pR~KHR9;jwM#@zw%w{o?SO@@R<cD)v$`<UrN<V@t-)E2D^=wrcjTA!l7Ikz
zyFS%0xsQ(V_@4x1ZkYDjV%KH_Q&CYnm<mq*7m9uLa^Doz6tdQW1Mhl0L{|5RP>)G9
zpl-e-HBas(rFsi|Rf%r$96Ay_;TB4UbI4Ckx1rA53sgK5UK{LWG%zEbz-2Bgxv&P*
zy@Yx4OKY5MI9Rq<+2~8{Yy;;sISVC!GM%`w<@n<EX94#uDhYH8*{~LT@Q(I{l>WZY
zb}3%27w#folc;SL=<Ei~{5AHNdmPdPO9a;Wpbn-k@ZH;YKk3~5q;v0fN<$Dmd`eS{
zGBUJ)(h>3DmdgPr&#@PmSl9%fgd-?(s2XsMew`x7v;gY67^%SpTwgol>+R5ghU!?G
zv_h}BM!PLhJ6RO8eQ8xjm5XlBZDP9ptHVdhjJ{JUUUW%>NEAu(soEkSke<UCZKe<&
zq+6P7e(adY?tRen>4VRsRYGxAP!|L}D;5X0S)irMJnMNT=0BNA7!9*|C3QWSG6mGS
ztXN5<BW?osNJa{>*4yA(-{E$Db3I)W;n68>ojtPNe)l<x1TfH}jMIP(4{X2Y{oI%L
zQrh|Hc|JHP%eSe5T+T}DzzP*k>HJdG<~Qv&pHM_KTn8l!C_CAbMkRtb&MW2IWG+HY
zy-BNk#7get8ZnXwz58!-0G>Fhl>0gLNT%BREqTu#H{sSuK%0~DN|r5ue{j#<o;h?O
zoOx3X4dsbvz1)fi4-vdvNpO~cq<j{XYUPuoP=z72$xiD_)6$GjHHt~>jTp+5;*bNu
z;0xeXEIAOpc5>h_P**Q_QMaO{YWtO<Ki_8Kx2QzQ-r>-U7HVSy_0ODYe~nzyuv!q`
zuMz9|8b4ofdZj$(V<z2y@q}}zN$5jWv(tPoxlkcGOT^X9OJ^pJOIr#m5mK8EQHl?-
zzQnUgc;qKt!6+42Ih36}P((FZF}di!ofVQt!N($2Ilt<gT!+TqZ3R`2>JkDQ34Ip=
ziGV~a?5*ar|EllvoR5c#K1;V%pF6`dpbV3F&?vjOT>kepwp@jOt*gE)O@-%{KRD2V
zFT_X}&}_s})V}Na#Z}+aHVUMCEc(1Ps?WPU`J?MisL)<7)#zKTl@kPNz&cZfuWV7N
zRW{aa9nqVGAv9cwtCA%R&2rUx?3puf`Eo&FD#`YCkW9u_!q@p=kA$()!Q?{D3svUl
zoLI#0FDTN-@*32C387?7OBN%9ayg$qCR}b%jtWg6;+Y8TMK}@IJQSIQq#89JT5T<=
zr*aN!8F}SP_PyHI#81|}W$=#18pzJ=_E;Zr^PQ2tT^?i8*aX7ngQ=r`&FbUoTl-SL
zW?4o)H?MW#ggm#{!KJx~r%vBRH9U}pe?(-?TwR^g{AT5UGi5p3D-sPg&8Uvlw<&ft
z+P&>Ym6gPQq<)D>NCsrNH?+=^<cQaNO#z&{eZCtRgY;;0E9cK;IgD_^AL%)%&o;My
z@3(z<tgnyti)r7iq_x~ZPNvelLy6%L>@7}K#ko9B9xsP)pOTm(M9c*U5l1G6XFGYp
z27X?xgFiffbpkBTb=D+^j4y=9AvJuKd|C3d55ux=nPh!QA$r>fus&ad=5cIWjQ&|}
z%c^H-gB^0M*@JEd)x3#=LJ7T(|32W~)3Q^}a<NOf?R~!_fuWc_Q1i%Z-DjCOp=d+I
zg9xi`#TL<MKgA}|T@b05R4UXPixe0suerF~Jj-!^W0K&Fj8(9$gL3#bS8)?#XJaI<
z{yea>F_V*T@w{fWj^-oewF}1(Mcbj#Np=#vx3q<zu%Q!m6Ghw21V7Dr)y3kXn>-mw
zHB8brE<6KA*noU8*%CRGdOd~n5fNsj7y&T@94yz@OBh|CO|W@DS*xWw`gwFHb@Vh2
zv~I$Gmaa*Lq`Htf&jcEQnM?@8$+ETbmss~~OYt@59x@|d*Huaj3x(qe1LW8h$(Lu5
z<20o5IE3?Y&n$GQ_mQ>(F^}bb;0fBkx}k|Cpnle+@Y4(PX8{4hUkt0giTLTgySMKI
zI=k*0wDOoI0-5Hq#XkZ*6a5?*LL9dN@7c(Ic%lmAq7nmdX<ycVoBf0*q6ld&R5!3T
z#haDQ5Bw*0-X(`SUs0bO7QED|eZ%2IY7MV7X$y<pd$(`jPBmPTuTEIXbq9Zgc__?#
z#aZ*2m1}hRja=XKG~(q5q9#wXwq03^`PZWcMkZU>MkXX0TjP1pUB^Zd%t@b5@fo#$
zy7@G2l6$1AH|AZN+ZuD~f+qb-<&bG!U8C#xGDLvTI}kbr6f%Vr<`?@fo;=-u_JoeM
z)ViQsVZ_8fX!c5ojg-^4Su<>&k~??$Gvr)W*xz=p_E?JMw<<H=a41$=EW+vDmrtG@
z9&nH7@Ot!g@6}`J9}C+oTEO8(d}CyPoK#G7V$B3);~)(<F>{!APKK+N^D$s%q9l@H
z;byjq-3C11&jLeQ{9Gs<ceS855>7|n6>ES+@8yb}yO(`KRpi*3`>TP2)~=@Ffoecz
z7SB}hsJEci#JZJmQr9U{Q(lOVpN|6TZ$oFUfQil=c$qxjHpmPWroG`rd#EXYz17+d
zO1t-Q(DY#levsUkSLK(Fe%;ffgagj($1e&sTL~X~&%iO^$ZiA@8OwN3h&*+W*#Z85
z&1bhMzA6}gstxI6a(m~n6vRz>v<(r4Tpq_u_k^Ke2v2&Q8$1;WveYIU0<qp<ZQ#R`
zpsb(yWVrVQTVW+tw+f;=*u=PhYbNE^$S(?A41PUmS=aju&fT~l{eI9Ys(wkQ=Ly}h
zKOeY2c67G&BL{zM@Rv4rlMVgmMq922ALF~>$L*QuoBUMV3wzFbz>m1@Y_xvX;99k;
zZdshk_AV@P)RyBwiqBzs8mF7%6`fQ2EOd~dqa+Hd#6&IbsUcQFK6$%;c@#BLL`tih
z$Y*!hOv6{Afkr*wi_zccSsStMPCF=eORuoztU<3ADhgWdTULgJIw2w%x*_UMYK%ej
zIRqN?8kN7kV}X5YllvX3nIfE<=%Pg?mB_hHeE69l3P%*a_hS5&zG{ucOuw>g0hg6)
z*I@W{hsjm!Uc0i&?5&S~hYqbnl?7(ISFw2u+>B8FMKZoN=QsM3w$#wlT%A>O;+bfI
zLakvrbJ|PuvI;@<^66PY5AxB#%16+=F}W^60K0GSpBd>B-DA<#yOkm`u9;6go33>b
z{i1N^8z%N$brh{Xg`#DZlgJ0<F3N@@BuZ0dP^-Y0hvs;jFQ8_B(06)^Qnv-oc6!;Y
zu0HN_X^<u^<U1w7do2kM%5p(mF`G5fu_UHPO_)YwyNZ}3ho@P<=Q=9z-yt!*TGFTH
z7s-A7L#!wvzl{!?@05I!`}UP<h%|r4btf*#GWvTg8xf)@xV;oHG~G3dgV6n3U6a(v
z&qPZ5ZKLtqL^5uFoJa|m4(xpv#@tSLi}1h2F{9t}-x3%-tWL7|EDVJnEr)MM10N#I
z+S>P=a`PrTgC8+Hy{P2EX{CQihJwJ>PM7#Esiwn8E)8kO^{lKG$8@mEE3@*PP8`7P
z)B?2U%fUqulbu%6@_anW-sWi|k9!m{4r#`gIvp#ws(L4Xd~)TZz8>jUvW~T{>NoDW
zO#Y|?n8k+AXUl3<41ri=9WWo4@h3iALpkuu9(vxk`6aqwZiXagZ<_+}r#|bFZ8wEE
zbTWGUl3wy~9G~BMnRm7W3yL#jIs`g))iL9LpZM&CQvtrJ#L&ychRg@x3GB}U;K{;X
zp@J(>>M$37$BdX(rKU&NIWhBUtT$qe%Q*z1$%W>oIa`&EOmj)<PBGIA_^W<G^u&Hk
z%GmR%lwh(J%zwtWlQ3#7?w<n{=K+iuwLCMdRRDll84^jlR>*9|Q;T$nxe-=dLJ*|Y
zw<Mg`WiFU3Ip|=Zw(o_v^9cTjc2riBgY*>!k8U`BOFzrGY)JA^1>9CSi<|K%w5ye(
z>SQ6L2gEm*fZ?L|{k%!iFqY9RQ0RAAX;qK-)x6==C&kY9wu1>`!9kYOeoI5&8BX3J
z_jqf=AS`MEX<H&Fwm8d*|K1LAg_yG8lGIRWIiw`4M{-Gr9B_%rT?DJwHa2p!g4q7u
zmZ?U6$Mnc@(4|*;E*)c%4J!YOu`$&L-5X5GfdudQCJ|bR<ZJ+*%n^}ATTb$}^6Bs*
z0I4?!L}z4nPZjIJ(m(#V?;h`mj|cjqMA1WSPM+q+8GX{AL|@Di7O&#+aw>qQZgzOC
zux&;-7DK8~LRsZcHI0XZFwa9Bd9Yllzm>ax?c(Bpp{DU3I>lP;A(nWITY)N?^@Kh4
zya!A(Zeaa6O6pk(1kjG#mhcY;JkOHOs%vbv%f8|cAq(ukL{(-7e#2qH*9B)+9b|$;
zr0I{-Ri$~Ih9Ri}|AX{Q8}((1rlLPJ(a(X+Y=fTZR~49%>18t-KkAm;Ck@z=*ROzo
zErQZ`NQLh90B<?^6vyx=d8}JtPCf|j+D-TlztF<{UgqqzCg-)94h_XE+WHjm>!MQp
z^M6+-wI}~WRO-K4?Z**nKk{KLkaG5?pxALDm<KoKsAsA6CKh)A<KaYZ<^cchKqWZ3
zh~#~{(Mh`A1DFURhSo|EpktWV5N|Yp(l<7KMe6Hrx7*!7TN}Tk$K}@-K@8stw@H@0
zlYBZadZ&2>Ac_8>>{pX)_%`W`lFc7C`0tHfY22RW|H@<R^DQ^p8&CtL`Gg*o!*fE{
z;D@CP(4&!CkfDHGcDnKNW~!4}VKOUB!6J>3@_ZzO0*zVru;>;Giw77ZjZGhaY6gVr
z{zL5Z*1sMh^T}dloH(mNbZ{}y|L?o|5~2{jqG1Rx1OK3Sg7_SIQ?>3de>(nY{GfN=
zFgJfXMunW8H1MG3FpQi(ghcoE^M>$?t^sGi=QKK1Lw*fFc(1W(!hPnmz&X<!Vfck=
zrg>IfwEW5I0LQ!h9VV_>1iv+Z$WIIzD2RCtBWt@J8QRt8Iclhn!5~$zE(9J1cef)5
zS?qga$%ZA&z%3EFKjv$A0`)uypV>mRNe_`>jDXbRcyVYdUu9<^oUBe$;3i>_^pc5I
zR|}CxYc&bkVm#R;_w7OQh(kBtkyKlSd38jM{4SzqdUyI~6+%2Z?zvch!LkL4<)@WE
zWa{e*W<mTmDiP$Jay<5HZGm}=(UEh}jYWovV{E)!txv~LV!Td;;JFo+dQrmv4Ecux
z5X(vhRZXN0iXTexHkVst@edlD#h+B41MGH!a27VD{zqtg)(kh?ZS5~)l>HH`GIN;A
z{7Bmxx(b<^1Jvnzqf!umQ;<6(WY*C#V~m(3;Xxv;aef>dzUWD2$qYv#jt{G8z&mZg
z-~})dASHF01BES{U-$_ni8^P;AIsM4va{@IqH$}B?T*!3zAqKkrsKkV(~5=QismYW
z%3-PJ?}c9!-Z+{r5CGG2McoU<vNr%pWIHH!QL>fI=NTfYg&RtLh&a%tLL1p?IXcrG
zN0CxrOp666@UO$kpOocW&FD2lqAPB(wt18l;ONtZ8SXr%u$p-eU8YO?351wwoQH?e
z%~kDf>7~PJmk4UwvZ;`|Z{yz1PRk}_H#z#Qg>8yTbMh-H;<lTNvq_b=qC##>7rB^Q
zctZ=iDGW)yY@0oQSu5RUm-);=5I|HLgEmD}?INym;SFL4fq`X+JFq4NNfIIGndQ7#
zTx@GxzV<Fc9^(dNPjX+wR@%UPo8+Epw`<%y4lD?2@JVF}nC;Zs$~~u+m0HwtFb5o0
zIUUJSW_kOJ=K}V~QNNzwScXD9Ai&v!m09Uy8pO*CL0FZ4WcwN3%WA{n8*3VE2u7d{
z3;_RZ<({A|>TU{pI~plE4$LUD<Ax{UUA7*b=&3itf}GM)6tl^?_Oyxn8r9;>f5qrQ
zDv?aScpa|^JGLA~>Et5Vk9N4OMg?5&gRR;LxAtY3*2`X|FAMbB!aD8BDGiE_L`X{n
z5WgTNtdkOdo;;B#P!wLmeLlwT-072O(8urixaM+gLUA<il~bCJfU2PRx{#t*V18m}
zcHRt4ft_5mG&?`Ubbut~r7UmZrSIRer+wwrZA*=t=dCD9P_t}>Lc3u#MD8KBvDT1h
z18#+fzQLhZA&QMol2&lE^Y$AqTw23iD#p<HG2tSAgX~JOso_0SpBe;9##4jv8DI+q
zNHB4R@CTWmwg?-dpSIZ2YCJ{vAY!`CvWbSp=;ESsZ5)y0SGX}4XkvwG;{zTCxMXi?
zOocd&!=hAi9=nyeU7R%YuYtg7AW6XjiW<HfjWgz*VV3)f5zYqr9(5{WTh?C++3;_}
z@bs5|DVy=PW-U5_f#W2f%;KU8ah-5234q7kvHd@U22!r5n6B=E`V25bu@oa%_FXkS
zmG@)ZQAT!V#Dg#|#x=n8T{(XMNw)m<UvUN)UZGQ2&Em^uz=@%if-(r6=RqKy8f#Pa
zf>A`K!}*1Cu9t)HvKnT8y<xA;zzVc!;|!pGPF5Y+6hY*&^uf4&<!hQDgW5XH7OOA*
z&Fq4pjC)is-dz`vAIYH)<m3Rx>Km6i`8HQz$FPX<meYjcZ3?Sy_L9_0P5Uq<q#_WJ
z@-(R!z)}onngTU1S<4iJ2!;uk>~~F&e(yRvjK`gFg?sASfJCBn9Vg^Rd-@b3QFs4;
zCvZa8I=G^5m0oogaNXZ95}$RgO6^!%kSf`7Qssu!6g<4${ac-ZMfo<bGXm@azW%`6
zC<ki4LH6Pc0MfqAryBXNYK>#Deq;~*&C>uZC!OVdQY*rAAJ<>aClAtS1~^HO?r^TB
z8iZ&{IPz-A7zTb)84Ms|G#TTwDYCeKm>gZo6~y6QC`@Z;SM}$MJGEW#wwQIC2_#*&
z3sA_}=-penw>*-W9+lhOzdt^J8HmM!t7broRPif*HoAYmoDehMY+u)+0r&LZxoB*4
z!o)n-aaP2%X$D+bG@S(ZboYPG3_w<2FBR8kfS>+**N$p4z+Tj~yP!S;^7Q|ItX*K%
z^YmIX;6eMpIy`)l(0nXlOLuq+?c{|<^S6_)fiKohp6wkTw3CBB(0{&s^n!G)LGNHW
zXeZzN;qdUUbAr_QfGhrfof!!1zxrPH@16!osY%yM#Wn+e<bl#luXg{AcLAS<gLyU`
zo^-VAO(6)NeirmJgeP8}O#G97iCRQXxd1^B14GK*tehhYW1MH4c`ff+royP4Zu(l~
zgIpaXKr?rav+iGF2Bcf*ie4bsMKSm(+1YvQBb`xKgZ(#=$g2i`?#>Qd^H~8_zo%j+
z1v4nnF(g+^G$tZes9Ejp{>7*upPn_?$<q6D{ehPfZ#D;C1E!u`mz;rrpz{o-u{0bj
zG0!8cdP4d`m;g&t@E6-yG6w~$rLKrjFb7sc=mASfk79gYUtwtBeg9Hj%ezcC6d_Dj
z*vd{zL=*87@ZHf?8cfu!U~aGNZa_wnC*FG5O<vg7;Z-v*%5(<?8CFj@?vK7$Op?vs
zrkGyRo%p_k0?IK1zIM`o2b_Ut&kt8;VeRm&3*EmwH_YEH=2?vj{>n6<ER|uWp(t}p
zHF5}=Wv|w7p_sS%u$;R7aU1lNYTUH3esT%->wIgM;i)KqU$bjXH2!tIwG|hdbFS6B
zZUf}6g`Tz5uU_I<)9+mBS)-Bs)3f#u>qz^@^PAnwK@b=QS3LwbY$7dda*qTs1yB8r
z4EP_%AMg)n{{M%w_W#2f_iyOiuTHM;?f<>(;p@8cf!y2d%KtlKTEEnjQF1tc2lCi7
z5BM+c!TGB*u74bdjSg6$GSd1k*6V8Kv7;$V^tvWrt1-qg*#M%s$3>EQ*=$xB$X+s9
zD()YEu^V9C|I8~4hm@bUCLlSK?Fuc;zVeaB1(mGo4-Po@m&2F471!rr_uCXb4jf&m
z6y;L-INRH0f^)ee27i>yZ!Bzo)M*}xlrIubhO0Y~<4amVY$PJPBo*U$I0jN-vZv4)
zNe?g6PV{Nu^V}yQXO;hYM~cr1Oco;}+H#JHYRL7Ec+I4Uuq(ZYw=|a)2;*h>R_-ll
zT{m)>h*av*Xw^@_{U3#;F{Rk<n8{yWalJO@V=<RR=(f>TC3(I9m?Zmu-|0D5%F--W
zTq1W~9?!E=P7lI2s^zJI;Rj{y+LCe_RLT+Z26kuc6gQl~EIC=8X44MvKY0}A+2pN(
zUeJhS8KdRZHN{!Z-Sp$h$73QQH!yeX)2UqX^Ob?yM-94(<Wx_lW8CPt>z0WdyI6Ii
zga6&C55~0+zasOhudu0q&pp^?SYIuXh|E`kh>c!9Eshz1k6)h%O5%V2um3B^q!w52
zp0s@+Abmix0Inv;mJ8nkDB&mtLX1p?fcbF^#q<VyKG^1sZAl3}tu})UGt2E(%oQhc
z8^~z5Hp(qXXzz^5g&uV$q;saza{8FByugKYyVZIaU;~6nzODj)U>iPsrH*-a&c6f~
zKpY_q1mPGZa&|^?@}4~C_t8QR9yYr`Z}&7;-d&?s<$AKEpepiW+DrKb{#PFY^38Z$
zyrUk{Y6=b$ScVMKLAO-f>c7d(%3@T>m@X>7rsSjJyfXxP1XAX4Vq2L*+4N;O5rzsx
zjEXj_R4(drkNg*Z=t#|`l|pHCebJEUtcs^wpe308?4-gh179Uf=NIVh72pn(@vQQW
zzL^^2#3D)SUtvfJE=-I3DwkfRG_ND+rCpiYuA5m+8|OOaN<t5_N*EWHAoL}mcyuvp
z2Zj|KymLser}=KON%uB!mTm$qd6UbVBD+h_or=kVD_}K$V1A%MlVF^vwslPVMsw}9
zX)2Fk_wOVdJ3AX;C0<`G_PYo=BmpvG++>S|$Ng#a&|X-Kr1m@w;E@85VBDjL^Ch_{
ziUCT1A_bj!Jjsq}1XA9!bRq~de~19ve-<bcVR#3ZgNuaNBGQD2gJG**aCw~I!X9yg
z=mFsYcB$ommv3d{P7X8K>!yG!dihngdhJWLDb_9?sPU<G`Rn{5=<b(IMhza?L%#a0
zyQnYm%wlN+hRlq!X65ifM6dm6)A|M|ARUdNP-U5GEDB3?pv{4KAoYot0lQD0pp2^J
zNP<1L<VYRQi<}7bA}mviq{?QLvbL*f$Q85$%N@dhqFhi%y9H+H9$g1D7VyNtyg|EL
z5y5u39Fh8^Jv5u%jo{f@Lc^|^{gD%2Fq92_XCv8ym_jqOt#8mVEGu`d=iLaUYe}+7
zlZ*{Sccu0<Q$q7Fh@q|yAsE0eH_@S!M+F+&6T1rC65x<f2l;h3nq5W+i$o~@Iuihm
zGB7xQZQ${Z<}pV6LUsZ!!-`j8e9oM;>%N7Uz9NsocdSaZdoO5S_ykX#zo^{AU5(O%
zcVqc*9f>7d5KRX;HMOlxJ2#n)52wk-vX@QrcRfsbe`iDQIJaTbqxtj<Pqz3Fiowqs
zdZSf*_MScs#mR)F#&UWP4XxGKP5)&%N$C84lYXxB(mx3}7Z9EeNoBC$!Lf~lXV|eo
zo^)nO#Q&_;Rl#Unon&VR7eBAD44C=$QKQ*Z564=FHt3`u7l32}Tn(3Nb+p&z7Sn+8
z(`YX$eN*euG}NoRi0W-RKIMB<j8=CE_fo#*Hp-2^6>J)2l=>BIS9f_zEpTnf%Blf>
ztguokj|xmivGbzT;UdU!rv*9EH1|u8a<-E#{bcf+i2HFO{I)AXjba4UVyw>NaR$|!
z;!qf#u>KCTaTpJ<j@*dWV6!@SlafwZsQWr%pTbXLj>4c8<*Xxx3*>Z|`5-YtmG_HP
zMNmiO)Rt+L$KWdxF&yz0Uc0DG)3jZG6REZtqYO}UqkK4F8$`T`Re6cexsq)UZ<(!N
zg?<5wrdezRPC?B4t~rm`IV(`_LW}C*=ntk%Cz9)!?=p^fXn;@dgFqjoOv}do-4eB3
zG5K{+4ZbFBjJLp~0lfig1C8Qtm!|cRuASc=x`_n;c3v%1`Z#B#Kd~raIN?@*v>v5`
z<$2bbWpfDcooq0`PtxX-ub%8Zrlq`xk3J1M7kp1=%6g40j7rXHP}Eqdw8LszHu+kt
zXIQg6ivrgWcPPzuXsPyUM7+C1V`FQcbCR}`d@<~9x3VG1In*QQ!U%c4A;a?am!fEx
zmR3k?dq85b@61`of+%`=Cl!Ey8kta723hrF!>1MBZgft0rYo<uB0A#ue)R&nYSi&*
z(heD|uL~)50ThUqN;Y&zMF&SOaV*$MyNm_o>=JA{40Mfc`BpgoUEYi~h_?1q`q<oP
zxEl@T7LAfV-iaE9^UMpKTAUqHUA@`mbZx`84AoU<pckG8ZasK;w6th{Xa!~))*Qvs
zIph-`ffb;JUBs#j9atxrg*Pw?DuF!;wOcvTmi*@o<wc+~woJj&s8BxiMllmhwoZy;
z+Gh**n(&To;cmoch$FJ9NV|RI*==D(FO1`RQ5H`Z<M=q>b}T<-TNuh~&*;Nf-Q>Am
zuiJkEl<L@SeT2pi{rRVVBS%|o6o_mA+cJaSu=SC_qwzV<7j<8U9#LAnhk`6CwQM-C
zrR^k&lMJ5Jc@EYmt}Jh=joNM3n&s`)!Xy2G`?fO(OEqvW`Y4%_I>9FhTkN9Um`%<z
z`m99&cU!Nf#hB55y!Ay@*_ek2A)D)eiK9!EYFKgUV`9$53bwX?B8I6Pf@98MDR$Bw
zQTJ)7rx4JgM<mm-*l><2q*JzMxym?Lor=Db&#ag>3Q`4U*<9mCGiNgkBrCrVQ&^!;
z?5Appa2F4=fQ|69)Z%5%7Xk2RSjL>Go#m!%KIMJ{K?%HA>aZ`TwNpuC7;JDkSj=FU
zH8snNJY#Eld;kf5)~Q*>T|s1%gW$%QI>fWxHKu%hy>%=3@Biojt%Oe9*$hZ=6SK4F
zXJ->l2glPbaO2lO01dCAsJU%pfx^}xIms7=|KwbXrc##&p9-=Q?4)SNWZMpRbi36g
zgtqI)ED8axYI12eIVj*rQX=6^c%D16Pm2wyZDTDk_C)c2P`t}%^AK-#krB}b#EuK(
zCy3|yc+mnfCkuO9s3E_q-)wi2qu0%ntJuM>A-=YFcep}lVsj59K3Jtp{p@0ux~?9x
zs2{XuG#hLdBL#h!Eg6YCZ$)Z>5U{!o&`PSMl#j0C==^T$mM<>Xp~pJ@u?{`fk;k^3
z3{vwBdQYH#?J9TLsdcwz_jXRsW~(oM$6LUAzt7GxHHO=98Wb1zCSo>t&+`e_h~%O*
zyUAv^cY4v86obuHV2FY_d2?r{x6@rzo8R%Bz__h<=*;xDrS^ii2;lIc*0m(VrZapj
zO1cX0`C_P7hf7kCP9I{Vq<$ouc{NxTlhLMr6{hfiY=W;&$`P@I&33X$Y;(BK4-;Jy
z+qDlrd;a)I|H-p&sU2@Qv!P*T&``HGD<>C3Ta&8$1_Kax+$7R4ox~TG8c;Cdak+$H
zQbmrV8+zeu9=U2h<U(w0kD&?OmbF7Qqa?Y=tAE=?t;tEAO+RaiMGNSO@zrrwOdvYZ
zc3sqeUf_HTwY$Z4;Qb4)(4}5aTqe$2Vw0g?b}oa}PC3WH`djQiSiRlYxxh8BdV@`R
ztCwN^Yj{|URjVU4pMf7@-3%KyR&x+E-efmH;~jApG~P0aw(;iI`Nis(>Ry7?!NEhv
z9L)l9{3!Jby(8gW!N)3h@#s5TjyzT?_ZlyMJ73+unMdv?b;y0jc1mSNbl12a-jhzh
zj?^9&^6ey04}~u*$P$4Vto?CMt^O!XW%U$w_X1OAt?!Y+wBg>uFMa*i*il*iPSv=&
zN%FJ&<843BGI%lN_3w7MPK#!OC%<-Gr&)TudJ-pF@oB#;R)|s}3G`KW!bdA#a~G_C
z+*9dh<+_t?=+295z9_QE{h-Sa?73C3=ZY7qHH&unvR%G#moD99i?@FH+ye4HKN|_x
zqFF`ofSBL*Qv9eU!Uqz3D_ABT$#VL3TAuSaLlrB&6DnHaomMdY!2<s5D*9>hKrVPA
zu2~DF4}%QRJ^Dne^_q=gXJVOkb+#^le|c9*(@#n%6gYL3>sD*u3I^D@I;5vezi=Pt
zqD35HAxgG|db?UaUP$LSy16S9v7Bi!=q;`Y<lk^=D9fC&Yz4C<##U4U5)UJCi18l}
z;ZU*OUDKRc)7Es8wy$u)6@FDA-1;1APb!i;^_zol4qt40(@NNukIT?&Y!~c*`dYj=
z4cJW1Nwu(vYGjKB+5hp6e+(aI^NcG)5CnsS)rMJV99$r5(^YQtNeUs|%Aw**-LP+2
z0*c@$&Q>5bf~3LB!a!;j3Zyy%?S*YqG@($EQs5K}<$G>U*cdXh!lA6vkleO;1~1E5
zKCM5$9ako3SkQ{=aR%4dECnimE@A8l*R1^fxroHdN|A(ZS(OsEP7M<)rF(cvdBwQQ
zHllMqX0q>w%#J2i*CxD@hO+6xL8ok;hE*Ll1z1{&b_Nw9FiDS>t_(N7$w1^)6?ATp
ztNm4Y+K3hi2`VSK1Wc95(LC>Hmda&?8u%BqDWB1TWSDAO%LGYCi4HM;a-#%@E^dNJ
zvJ;AeYE_OKI0YBuE-GK0NDI@-^lnT`XFLsS<zy2u@(WA5F-{d0#6W_9P?s?`wcQ<{
zfS`BB@T$5hYQz|(s&(>nwi{i?r40^AqSYP1`H5V4U)6*pWwxzS!#TCMT{jI+E>?^x
zu5tZ(M@k|7C$z*4eL~WI@ss=S%6Eg#fB)D2exSEd*04j$_Wi^9Mc#QE_whIH!Ur1~
zJGO-PD<gI;70$cKYpFcKoJ9uJcS&2^4N{t6G}byge!@)zNPgoB2x)O!uFy#R?rDSc
zXI~Kol*6Rlg(?jwh|g%YfsjBlrn!<%z1rWbl8r|)F@C0qM0kCFHc*Xh!B!#Ym`EEv
zu+UXmKuo=zN~3aUh2VnAmGl@!kXsq6sU7-1r!nF*kQMP}1w>V|HNBm9HfpDr?bPRc
zOQK0qEU}ljQu(7_jMAR{EhL?8ht8}TQ}bmFq0qcnS;Hm2C=FCWVRCMDZ=^?nJQZL+
zaWw;!IckD_l3GcBIMMmBTFvC<O3~I}az7`Pd$KD+(1YX%1x1MvMtVi6%7apwO86&d
zUC`NjU;nU|`6g34`$pa6t4k8!7^o@6M7lBVk)(0($Ti0dbIrdoDYS<iTeT^*e2uQp
zd$FnVHIC)?`d6P@(AJ-`;PD5o`0G*=9SN*dX?0*GWx{8FC`%hgjQ+iDkT0Z!qjR77
zpHXX;R$}y~(`s$IWE>D%kY?q7Hnt|EcI!=9rc14I_#-L780;>0wh6UtsJQ>{`Y#Mz
z8{$`vTzjqnedfqyckP~RXjAsk-Cxur%dvXTE+nTH_THVl_oPGjY8~>+ef_?*5ozh_
zCEF*&)0BmOalj7V=ofT52}wEeyli7{NMx};9d<VoWnvq@FHfe)<1*jyrQYE=yNpGP
zYpsz>tNU2qOaiCpm26tyj5+mHO!bB=HDnq$WT!DRy&fx-A&t6?o9?BRPtC7SM3+t6
z+U*1l+{&J1B0I{G25m@8hDv?5tXlk*i<XvFrxkjC<Pue>7wS({X>`n?KEh^LVb`{5
z75J*<pvu2rV(o%vIAe;gR^G4$h^))VCF(Jq$TDlSbH3AYr`7%1k#7g~A<AM()zI@Y
zVPA7FSQ!OJEb7s9XV<Y?UH+-x&N2(p^uRgsO59S3^-{yw7I6jFwbay&n(*guV=GO^
zGa3kgi%PNjmcMf)Hl1Z>gn@IUCESIwq%y;fI{msxCRb6-CYgNNmxC49vS8Nk?k0Px
zK)K*Q%*;OL6-5e`yWe)HdMMw%i25%XdeUo-1z1^%#xX;aXRnSk@ziKJ9R3O!L<24s
zS`s_@z$Mes)~w$f?}%>Vb5R)%k^4eB3~{i38ewP!1$noNw;^KNY-~!sV_!t_!2Yb}
zC|9(aTJ4i|0jGb}`)yzD_UYZe+Dn5vn5L=~a~LuQ9LZYSviv@mJ&rCQB|#z#qsuz&
zaz{jS>i3*vas7ifZ}|Ku=bW{MmS{III8Jh(e?LfEN%#0U;h}3Eb*GT$;5NQn$x{@6
zbIz<Owf2SLLOIPZp9Xyzu5MPQ6F=gO$8?c&;NxPNvr}#Zdet|wd^+1F#jJVIzQJr#
z4D+=k_RkH<fjczzNXJ|-2xUY{87>E;#9=J%p!WoIl-c{uM0Mw*K0ndN7eZ><I(h=z
z#cW>CZhaz>(RW)t`V9l~_G+@HehABd-~n~RTTEuC6MH?B-CqEx+lXTO3jk|P_%~8?
z7*AiYla^76^;Y*rSO%_Cdb-k}uNS|ScM&Y4N&8(P)3k;Np$)1T<1Gh##tq7?1h-(6
zkXG7BD$$?#OExfvlD*4^OZkYQr*M#30FCo9Uo7WS7lbtkg4kfZt`@XKyO#`qohv1W
z$fUIfrIPYB+FKRtJX3g?51FIG0EZAnOoK?%D>Um@SGH-QT}<xYzWYh%_8s~^$#Ubc
z6Q8h^qvYcXos;zck=w$DI4a`pt5&i4N#GDkeK4)r<VAw0?KwGw0#2slo^Uc^*^_LL
zlRU=%h|MH_H!DcALE8R(!Jepp93PjrjgJd%>I&Bl=l4;3GD`@M2rQ5GlQ-pnBcfcB
zG&wS-G?>=m^RJ&g`}|j14IQ_B4~rz~@V!rN-`;L@yWOV#Zv2W{R0Yb6XBIB;UIw%?
z_p)!O;%1+!;Bw}#2CHjVQz5Me1#M!dl?QVyrt3<S$7}97<xU8*<oWJ@HuNR7=*3Ef
zH|n{kW5eFny%GDKJT7rfUiv4pSmvMK=YPEMucIiCOqBt~!sqvcACb9FaX3D|uYc@L
zmpFOlW(l$F8s@+EJXuzbl=nGKg!cuL<gIy&6H^u3jIJYys||WQ##sbU|3LxjuX(<H
zK!|udHJFCd2nL5Q1#nh>hdhULtv;dM_ktTzQ~f$jI9%B>Q|q=Wr8vKw2QFGtMf{-_
zyO$u9yJbpsjKL+wWe>i%7vhuLbjVI>;QbWBN9iR8n;m@dkaIy4%BZT!VUb0SxXV9o
zk`K1)dSLRKO{<2bSL%6*waL2O2i&o!JSQ9>!a8PtZYaDjH%>2q`gUt$En^Jm4$-bT
zdwVw^2YkGN46XTF!NjrkSDRyP{%l@_vn6-Bwe>ZK5@#teF~Lpxr3^Y4iQ~)M#l#3b
ziFxtHH!H}yuvr=>zT*xd=gGg~6pCw##K#bOxGiA8y#aY^-K@7Q2Fl8VIE#WlNp~3{
zWc{@8NADwkG(NU}8qcz$8YK7M#d+h#mOB2(bggshW`ZNVbs4%VTlOz>YW=l~sC;PE
z@dKZKH9+{Qn56EhHQ4a`W5-9@?in_q!KO6`o&J}vsuPY~fRIMfb5^Y3akW}s!N^-w
zVdNTT-kdeQ?t-upekj7D#?Q48E?cP=-30}<IrP<wj={r!97NkEjT&$R<p5FWxNLHy
zvRiGIkEW<qx+q%6$X)gke6eB#JSpn%2KRSkH`y2$(+OKF%Uo=Qq>L`vO~<@yquttY
zL)lPN2D%mu1g%K$9kM#i;wUfBlfl^N$sd2FOFFI%3~VxyFYu^>5BM?JMH`Z-POq6!
zB7q@5>3Sc3HL3|P3@TMK#F%9>8ggP4q=C5X3yzT2qc09q++Q%RiVLTkm*t|xRHlg;
zZH{cN!T>GWCo5U~ih@PoUChe~_EffL9j)XCBcuwyIEVySI@zocTkO$F=5X!d>VzL|
zjmiL?NBuT4m;**dg-ntdsn3HAWFv({U@Q3U?(U+0m?b0ul^t*N<|Lq6g6O$~{;XmI
z(#Ypf7<hUw!w75%MqoEt2g2v@_M!&3NyNDUXV1ax3C2t)<!q%5U~s7#78KvWL&)hF
zzYST5x1YkfHG`_D6cu8;wf+(qZ?ZzXu{giOfDbP;7SSad=J_Zjd4{aWCT{`J=?%Oq
zk(!Kuj)=rLj5<zXtQO^L#sZQD>_EV9Rq%`0Ae>W6^3!%Ad#V*+sNp`J74+JecaBR7
zqf;TXm_^qU4(x+987b<LlgJBfHQUTSjUM^#FW3Rdv0!D8`KW29%c&cBOSiG~d!8R>
zb7YXStL~f|p@%LcH?NqUm2Z))+M@1H%fyg>FF1LqEm@@QTTHvH^jVloFHbVSYqIIL
z5T`iOL9n0`CYxdVNqT<-!G^vfjfxR6UFseTKgcQrj*a+<lv+=SoZ;o)8;!*3DHj;s
zCts`~<QhI8V%Rw|mLINKTi+gVibp&74;=Bo&k@#63{K+Cun?%4k~}rs)C2Y??uGz=
zcg(d7ShXWA$KB*tLfN0Mkh#+b4wRMTb~f%|({p@e44+zh@T(vbUKjZnbtQ(ZtAWmK
zj2U$&#EV;nQ)|TZYk`A5%z;Z<()Z8qv}%}FU;;Nmin;{s%40dL#kZ12Y}zeb1;{7K
z@k9cuouvH}r!2CREl_Z%9W<XIWL@Qd-lXBbbmu5_lSxeRmi|DHD@mmrG`kzgfBuwg
zAjfC}QfW$;QvF<v5y%Ukb|Ji~Lqk8{0G+9Q`<t7$d=PH;NY;&id<k^G5ZBqz`wC5<
zmWHDQDzwfQF8Kui^8^pA-~lG5`TSVp+{>B!K-l)>&93x$1sG5pjZ*#4GA=lOV=*_c
zk|?*XFpz621^Gr@lAtx}l6J1ysC&MlQBE(cH_V{AH*8#xc!MwKzO=Tj+)=$%Y|xcP
z>!pLjW`zb_v-0zros9|DWkp(JjHr6eruf;QA>>h7I{;z5W;2Y}8gxg31YC#Y=XJZJ
zD6hUbmmByvpCMqMp7X2ic-Sa^xOv5=JiiZLiW!2-1PvL3U0dJ2D@|gL#;sZgY0#*p
zr(NA<T-PNk=%Qs@{`<fF_jde2j=>JT#z{(7e=2~Bsr+I@`K&>s68dnHRy9~6o^gXS
z3MO1H-K1%kcNI1Mb$$`F3j~9!r~71m!4+*BzK+QxhdOr4{^o``+8=&@=AV+~6h_&t
z^iI015zlza``IhQzGst(v<nQF>ZO97pmDxnC@AZ@{srQoxE+zJl~p82CaA>3`PM!`
zUF4SO-}Mc?T*A#eU6`Le=wp~&&f~}Lb^OuqKSV4!qYs^!-Y}%?TG;_=QvVDNH9w(V
zm=Kl9Wjiw@deBV=*MmNP+K)9&KD6Q~5KWq3JJ@T<U|OC%)ibh<Gf7&e7n84GN+f4l
zQIr4vU;p2L@*HHBe6j|wO&_Bxf=$f`-0MEGrH53M`cW*HDxqgw4-i|29f+blT>3rG
z-_g`=rDsC-_?P~9em<3ur4A!-VN~{>>C^fNmoAR>-4AX`3~7;nd?OeVBcEiRR3{mi
z3>DPO_{a>>?Wl48D`=hD{_$u0(~z3Zp@uQ6pR33tp9nFM03uQ>EK9fJ;qPnTgBBW>
z#Zg2$NkI&fFI4~xftMfz2ERYtS0X4U8A|`dkHzEV&?nrFj>b^0X<UM+tz~+Ll+T30
z!?KZDh#!I77ytr)TTKI%0wJmp9d}KcaJmHDQ1-GbN=2*nQWXi0^p~kZ0rh^f@?}7V
z*;EbL#dJ))%134{6OecW`?R*woh~)Z4M^pkE<Vk_9S9~Aa@d#PdgJd7F1#&JSi3U^
zh?S2oGOQ;W9dP0Lx4qMRks-{_qEa<-7+`cQHdYqLCkros3|$yZ*}S_RiJeqK=%MJe
zH%WVSDwtcRk3_TTRH{}h)=nk`v2#u)=ZM*`V89HydP5RT7f##iCf_LL<Dguev|tL=
zO2Ie;;6h-)As7axqijA(7~GxSTx9PQWtc{UvPgy<32PxNOfB{^RrxVCR9i|TImAn4
zD{>QVK0PCUXgUx|M#r=Pj7ko5tw5Ba&?RhgttvJa*-STC3<4D9I`A2r#d>0J4xxMH
zty>JQ1u2e5lz3Lfi6#si#W10M>0*WT>h;6Q1sL{qT~**y{gAh?KFR5_TF5M_3C6sC
zgS>^>B}Da*a9nMpf-gm=lb%=XDqJ3$y+Fb`-PMqPq${>aV(c-ZD<a3|IZV-(Hpwtd
zK}TUKBdRKdoiIY=YV{{uz^<FT8_iox@#WZ8gIZC{+YSp`V%U67yNyIQxKNU-mFS9k
zoV-?;e0;&@CgT_6#Gwdj3r?YCP}=~<e@hS3c3iu|>F4cMtWCGQ2HZ}ZE~xnKH2CGh
zoVjy<U@>l~aM*4+9jfhApY}SGg?3Fq-<H4#7SMLmmJ|ojTp1aWvuWG7s40O|wi(_@
zwWt8~Gsx0vX-T4jgXfF@V#7&51ty9`L?AL*s|Crgss-eQKnc^;0>s-m;dn0zn1gb<
zZtDqY2PAF6C~j-L+feE`?65b=+^oYvq2Nn@zv{~mH+@yCHt+XkCM`h#E3`t=wR+NF
zl8m}zI?PoaVe#4ev4d>(omCUh7P9YGt_l_mo7t9Acnw-LdT{|ZM1(}TA<mDA?R-z0
zoh;$g#X*ozH_!6c8VK{{6nf}X$QH@>2NE7+Dgncj^C5*u7$8lw_(-W1WjQho1g_VA
zkq97QcAcrVD1pyfQ9)M?9Vmm+l@hSz5lht<6)lb$%5Fv_7PEduN44$ndtynu+1Hp2
zUhyq{Ci)Va+HUrtBXC;Fr@-I6+fdK?;&%zMD4ILdvd-Yuc+_gJyJ2^fnZIA!&=%(m
zwVY@QMz;6pX|;XTOln`l{x@3)Z#J5L$lPPFyP`w}g7IlKEyl>pA_1Nrd`t4a_-xw<
zRbu;$NQ8@bi&PDAD!GTajW0-o1Kz6A>E*oJ_bN13x(Qe@SYCJBChH|f?xbCltkc&A
zXs3otsL?qrL$J)Xe(6?=v)8)sETcE>Jx<Rf6A)|w_B*0Dm`z(Bpd7XzWUFz1kgi;J
zZH!`!z3~8J0AN6$zhi8W_f=gz-%=aC)(<t{-keT;VVYnoN)x=^0JPS7o!HG*{Qi?!
zL)K2VOb&#W{{txwZT5OoN6tuKY>RoJCBX4>+1b}1ck5@Z|1d}2xa*f0q=7Cyf!<D|
z0^}2)>O+HG3(7)peGo()JKPsAUI!Irf0kK+bixM$ttr50TF<h=isl+=0J+D^d^!)#
zavscr8O_64Q0qCv%4?!*!BK3iUV`{IA_e%_cTj5ZnFKJCLSb<qrai&dY{vJ%;@(ZZ
z6?rPX|9Nsd<z(dHBs-nuBg_@G+D+tm?6{-KHO-0394ca8iTWr=-&-WQ;b3b?f0<HP
zykScegSzM<LBY_I{B&Ehmz+wZ>XChxCZlDAI3-$KhczQIT2GVivHQ~pjvixA!*xlL
zBZovVZ75X1n6!u+BB72t5xXL`wC1Chdu_?(ZAoyhh|ne@!8{Xhg@w+X7FA`Se94PB
zXTQM=Gvv}hnC+HTa)AUs&jp`}e-YfTlm>YcI_6&Sa|0L2b*JPdC{(9{UkqI)9LL0Q
z;$l>g`UOA$Lwt-wS<42%1Y5tgxLpC9I(kZf!{Uc)u=iP~Be%?r)>8rN+LBdX)pZ-w
zI|}fXJe!NphJJ~G4iP;qt=Db@YaG?b^8((ao4gJR??AWDGejtHGxE`ve|`&j3knPn
zeU_8rBM3J$Ewf6)fltKT%NYm56VqXK*aYY%36LzFadfa?PTSadChBz4@;fSuinbLn
z2iA%uXqB<GTCo$0R`_l1JXzUdkwIKyvk=EK3MID{2}~=y@YZR$?dQs>SX~Ta7j!y!
zOA!s#SNBftYmR~IzIT{ie`^5G0;r)K(Xn?zlN(%Vt)nJiTFv$1JZl={VoXmX4*dxh
zG4DeS?xMAaEqXR7F9aG5*7KZW-l)A);r-cvhrZAzHw#}&K`vbnUDYFJq}3!!4J6Z&
zUNgq8JS!DDLMp|!xKeB}b+L+}ma^g~yzcgVTvTF55S+<zP6{~@e+CSn;F>NCDV(pM
z_zi<r!Qz@tTT)x6UaF~^d_`lt(9q_2d7jaswo+ko{YGFlMIP&Tho>W{n#=Nf!-gSn
z5g0%Q7m?f2m9;h8dpi6dS<v(eoiAJ#7$tw_**P>`7xY=^$t^Vjv<?NsmFSmHu{k}x
zV0UOxUYM>x*|ze+fB3Eb(V)CATG9T8&2($6bXObc`Zm}eJN1>7!8NVQFiHz2*DNh8
zoV8_jg)=K9>?;fdh{!Y1`jk524c)z~T!9OX6NS;0vu7lPg==|shhF$rJ-ctGQdd`G
zg(@fJyC{Z4SL_{@D(qGu(0Pij{)XcG%E7U-vnzZ~5msIPe--B{ps)ne765skB0~Yf
z1Mr3W87xp}ISG!c3O>07OV8#PkXkE(BuX;V+)C9=`;cQN<9<2rD;g9gflJ+%a)hF5
z4Aer~p<*b;jZ6SOp^I%u`4CR-P!k@$xe%;cr9_SzW`ndZ1cQ)fEoW0UPYpFV5=Jp%
zc|*2OD|3!@e_C3rWo@k*4ypf+NhrWlTap$FQ-`5{&5q~Uh%367t7;`C)nQK6s~0ON
zdAEK*N6w+Y>L_7&6|9k1VlFRzAs<us-;&OP3{;(=93i|&EsFv`B_EVZnR(%mfq9Bk
zOorGZGX;_-VU8Hv{30rV3w6Ya;Hj3au!46|)k6C+f8UOk4U*kjM+Y<*Ii=(a<#8c6
zp&$1vxz(3jeZE!KqK_WAC<k`(@`u)F<@fIO-ITLtu1^PTvZD;q<50Dya6|&W12t}f
zxLuzl(HOBSnR-Eaku;0~+1YZTOFJ9`<+A{-b3sV{mNg_;={{&%LfZmQT`ksiy;DsF
ztsrjie{TG``Q#+6k$D}zy)k@KNd$6UopJ#3^W|bjs`6<G8<&<4x6g`bx$@Z;Vnvj~
zJE+cPH0)!SxdExCB5^5NV?|Njxw4A<o%}3~9&niz9l@}ii2|&19?nKof+dZkqHLY&
zB<)l=Qeh^X$fP^KEs%?#2?zQ`A#fA8Y26XAe^xdXmphdfq_PXQfb(fSQYp2an6yf_
z9+jsvYElYa!FRmKrW)dt4zlS~$FshHLntuBLT3&Ix|HRUX@esb<iC}^k@8Gcl?EY}
zDYKWWzM(Ud$isp6V{lPBiV?7Ky}~`+o^Zo@*`5t8+q1D!wr3+O+q2OI%=IYm3zb$J
ze}$pNedQP@YOa^y*_a*Uz3g34TKmm)f4V&>@e`H(>Gnpzidik%v-e`Z|LWz_-DGpa
z=PDH45cRND!e=8a;p4_C>us&Rp)qgtcHD6=fVoJ$V>>-bY>)-9H#WMn=`j)>Vc%KK
zCzkwBt5DSK@oIJ#uG)H3Y@JWIAhv1ce~60@xF3I}C%(yMcHq2EJ#{`18Y-zrd5hu;
zw<>$1a>>es!knv;-ij(8Z$<UY#31F=`LM2LP&`Zv=UE!pG$`stgw^^bm2TJ8c_%f0
zP09=1SxtGlPGxefy#7IIuHTX%3bsjbBHPXDu3x{2>y}+#TXTL*P4@Lw)~nT`f8$}<
zaoVhLQS|Rts-pWxq=@);t?N}Z_wV^q=HEpH%9A5knf$x8rO6MqhE8MYJ*g7F`CejQ
zlEML;OC3T%aD_ZB0F4@rt^%~$G6!qwKtt%-;p1;7f;qay^(o><xeV?5ie;{vZFIJ;
zG7@6L2Kly**i((Ffu3NIaBO1Ae~uCRy-*w8QIt>T$^ot|Kps>W*A(EUy5bHQv{utY
zq2i*lq0K`LIb3(8mXfkZZ7!&Z7&Z1~t$6!t9ddRWNjV8t3a|Q7Q2UjBHI+xgjlFf{
z&>a*BOnYleqe~$O{a#a4`z0TCPdOLICH2>x0gw~l<6^m@|9nB}bmekYf5X8OcVm;H
zb~CPy8OQ(fwX4gkOSbE_L4e#^X_Vt`o3?(d^$-D8EM^52Do?T*SDwb#B}afmL~Sb|
z*ifvNRgk)OoG)6d)u}<g`Fs%)v=4OE0AW}BvR3yJ=>h&Gcx(L$odp{D7t0AkcNgrD
zp>t(j)y`|4!tcj|eDGOae<yGN9z2n5&QzbY;IaB!7C_eYmh-*WU(x`Brgto)WJP0<
zDn$)%IKOT!+2RluH-B4~Bdcmu`V%MRPl0KY`iKboh5#$_;ly=Z;E+fo0+m|X{XcQ*
ztfX-8n3U<|g6cu5D0bW$kXj?>ml}vkp1?_lh-x#n1H{16!qw#Mf6hNH+r4Bsm1QL^
zIIi^Tr<;w3oLsJW1A%NDmh<K^-Hd@AmI-!7caG$Lr`2b1&=`y8N^R~(EB0*-|M#Vp
zMV*ulnv<}^+%ID3h&_T(5MJX`wyi(}PFOasv~9cGUZWwM!KGR;V&`ChpEM`QS5NjH
zr(G!q{xmFEA9OQJe^%3T;;hKfvIX}CPn;L@-Sn~pRL!)mI(lR6boRM9tJfsEfD9?h
zSiO9eNc&nFz2oYrb1XHnEvcmL>ZrRa>f5|Rjpxfs`6kx&MducGls_nV?!tq?2M5<G
zr*}~$-PcIB+FR`0@K&R4>*H?na0L)yi;f2AG_<&&b{{BTf74F5+_I037UUCV)j>68
zK4kbUU#pwl_zk80T2kt-o#X%kk<g6GYjq<5FKsG?4Odo64AyysjA1oD)cB-=YjY9n
zEnmU9bx8&5<a!mXTa9O_^GrwO=y$e))S(?$IGqX9(%@(hc9XAN#p~l(^x{}s7;E#K
z{UhE%$alBlf71#ovw;B%W8h;PJULt(a5STH8e%I>u5xv<gQE7t8T@t%=m8=F&-QfT
zk^`c))(l;-D0GBGM;RL-<7wk~UUSuWk0l1e5vHwD%Bf2$-Q=KQ=q^+!8(|O;iE=&o
z=!+N*N1JDZa7gi7)Q5C1&EDo6F2crV|8%i3ls3)Qe{8|yAW;%-Iq*uYlh{q3^6qRo
z=93X!9oP4sbtYgIFf~ic7<J<{4qjr+MY*gd7Yr9{%mTdqgpPN%%+vhnw7Ztz7|Rsj
z7M{5LbVgh>{1TmY>MRkokk)_y|NcL$9c{XYHg%h^)|kKzA=QE;@B=jpv`9gSF{SV~
zXnt8me*tS!>oB(Lpp6$KeZYb)c*Ih-+C#}OKO-(u$B~)mih5iuJn*Dv99_|nzp*MM
zE>6zLt1d59XiJijBDXT}mmpWCCHPo7lG3vi<@9h9ZPBf*&cRG--zkS?xl^?7(>$9B
z<%E2GMPTxZOeiA(SPROkYSpZYXkbyN9FP6Ee?|iMg|NBN{DRmpGdwN9jlZM9+qht1
z!1!1E0Q|~==6Jkh4m;1zp+f6Ht%^eJxMEc*AD&D#)L>Rt6-O~af@AO|TKZ$LNVFJo
zND!<BIdT&6AS7W&=hNI{n-!b01VC$ls>yWANj7JfEB8)F^*l27sms-?{(`mz-)g5r
ze=jw>6BO^TlpFOv)66pKgrbL!y6G|ZZ<2O-HhS=^f;<;<St0p8PC4BO*@TxG!X5Qx
zi*;gi-9a9g5D7#s%8`ddcDr8sQQg2AsF(|p1Xy%I7Pc>A_dZy34YC`s=$bzeLd!)Z
zL%<&}nz+!X<cjHa2PB8M#W{yU$f+7Ze<T2XVGM;}%64Tg|1c~k6NI2;(V2oAD=lys
zKOpF7h`8Y>D}>mn7xM1CK6Sce67Ks)`tse-oq4=0025V&)R-J`Q^`j+YU>ui)cJ^n
z@zJPL8?hHJm7B0z`8+V)Ta{b~kRHjapqXPJXa&_)uolc~%|Hbvx>B{vOC`?Wf9Mr3
zC;f*hic(wkJ}u(|W~tb(qx(Jl*7NRZj5Qk$V?}+yc+%wiWzJzQi{{Tq^|{3Le}bqI
z**Cs1ydGDn;ehm$j3Y4thDO8$fpY~OjbTB#FmPluTAkIEde0IS!H{+J+O|VBumWFL
za!u=F2l9M(?ShDwy#i+M7c8ife}!!b)j69PzMz9IFi1J>!YK@vGMlK}?)%$qar6N3
zok20p3^H5i{nu+JMMHXyW&X4#GFyj?2)UH-daC2u@%Gq0-u*7TP>jAqrC#(yL51B;
zD31$QKsnB#b%hs*zlh%+!OmbpgE`R+r;Q(~G*Kh%xMCm?`jIHO`3Nu)fBa`BjtcBv
ziF5on0pNR6aNoZ^w(r%rzcJky{Bl@aGC<@-nW|m4dxcDc!hmC|suFC#W=6_bs(R>&
zRbsAAFRoDyGULZ<wV&%<E=C@AdjIiihvjvVDtw>lNr|IEAukU=ER-37vgFfc_k$3I
zB3y@<^oN#}4xfy6Ja*Vje<neVp7vVrB&N>pVa|M!Vdp&|mbBfyNsq5a(_UW-;%|AU
zHX?9ex?BHdx3Hpi521f_I$Clmxuoa;U(}*HF}qivvw=u+oMrbfzAkPQfk<a8DZL-F
zDfU_&1T_(3#|v?n<0(6iVEgd1WBAstNUIuxgQL`Hz+(=oRkvQqe?+?18B49K7mvkN
zol9404>Qv%&!?{DS77Y}oH92Wnn(XEBi-PtvK!4+O<xdmh67@}(j@xZrip1g`|5((
zTlZ4Y#Z?5}lWG|?F~pTR-uULiDN-BwOtRq~y>s{8hJ5vUEY$@fg+WM{cQXk-pM)Py
z8rqUE-BCf;DpJVee_VHrciS5x`Nics9bs&|DNm+d+O^${%R6pVk*wKZ;mGbLE0mkq
zcRc=X?VzkeF}m*6SW}NfZ$dF8LOlruf0hkgzJpdiwRu=%b3hgcBgA|%;Iu&0WF|H$
zeitlVm2M%ZFWLMe#N~^+!Z95|KdhzzTRjw@TtVWE_%9vve<d=zK3L~#*Q)t(qZ9U*
z$)z`z5u*uhW*`T_eAn5>DBkA5mRvX0!Q-AlS9I<hXyvYKD=Y+_Qgko-7U@T$0&g7q
zXrf{5exEQDW3>pCpKiS#cdg4S3U9qKcf74!aqb|pC`R2_N03&W`_D^|zknLwixg#4
zSC;3#E)lMof3y`E)OrbD5~n)JC$m;-Z^3a+68>y<)2w>SxBVeti<)*$QiX!blH=kG
z)qv^zLa`Go2(9)yBQkT0{@Q`gQ@3@v2}9Sv0V<aqC`wfH5#mt)dIZY{`T_s*a8mT~
zH)3VG=lNi^?Q091pOo2Y(ah}S-WsY5YbN_WC=p9qfAd~~O6}VEnt=5$`aKW)Q+5p;
z&w~mvkIE_WedI8f(+)ch<P%(*f^X@Y%8u$C&>4e)J@1@~Lwisz)Hbq}zAN7iI{*D&
z|2y4I$^o1X64if%2<Hk7b6p3)bP1!M<9pjIR*ja!Jn&{deyG-Qb#cDh*BWH7*zSf~
z!AGiyf5U@Rg5w^4Ar%lU_$ctRPhC$ne9}eo2C2J#WG*B4Hy(}&Q7_}3Yp6&6zc0l`
zFIgs?<qp4={3l}FJM^NKb-!=(_dsvKNZlz$$^FCnMG<=LvlW|JlOogaL00V`c$Nf*
zQGPlr0f)2;D1-TOI(2qCH?Jlkm<^-sl(Wz1e-CeeNVONKW{c^nC^V?c?}r6UDkyMz
zse6fcu<LW`Ij~j<hebrFZnH{K7+X1PKMlkM+9k9<tEBVC<i+!YLnmW~WK;Cqt1?et
zB^#iRa$fu(MUIk(c{Zor#gqJ}=dWIN!ZN1t9GoJ19quxuNo+B`OVxJf7WJcY!Jm8%
zf9rjF1zST%(p-SsfhS>QM?!|O45r|6rK5s@Uuz80|2ZoLW>2Wcq6{9xR;=549odcC
zGxDws`4O_qE87fMqP|-&xh5;7rEpfbQSul{^0ViM#`&2nRyIw~woFg9T2Bgc!)mS$
z+yw_Nc{`UT#<P1%0@BQ-yNbL3PQ^*`e~3RBk+Rs_t;-im%Aw>78#kA5>J#^e-vx8h
zYrJC>D-rgxv5~T4vmOZN!0N!3xsJIwkV7aFI)V29>0`C-8uQxjx`Kj|)}{}K{vd;*
z=2+A~DIlsoa%^o)*4*uW$U)Ii-*+-}V5vF0x;Q-rlKYSY3zpO3`(@swHL#q>e{p41
z;)^9YoY2S*U<$p4;%T_6N{|-*X}?z)zHW#oF>bjgBRZq0$A4T4b<XG;$I?^IrSv>A
zq<(3bcQ?ZjkX8zvYNhrRJ=Mvk&H%YBzG9QGXKX<bqwy#Qx<^=5&O^``IvoQ#tVnld
zR5s2>itkS~r?+B}(9MF3k3-)ie@HTP5wk=El>li|8+PJ0fl2toGLYKl@Q-l3_hkzb
zr|)RE-Vy#jnU~Yzhv=DTQZ+fJhP-2?uY4AQnd0+lwbZEQ)rIB|32kQ-;(OV0djA~#
z5TF}Yh>)}b5yxo20S7YmGDGLss&Oz$0{ezU?F5_&p>&J$oUu%Oyi`}~f2QhqW@=$l
z>5+qB=BKc5H4MlPUNaTh)-}&X76WqdTO?2crn#I$wjZ99D8VlA1?4oV`Z~(tb(O;^
z=%BYo2&@vmiwt-9G>*?=y37M>jZ0NGl1MBMM?)Zbn#CO{c~$(3o=dfR`eIPuovAaS
z4$^50NC&W_@)-5wGyfU~f8{0!ele&g018@vnS!fXDe?^$ZsJfwJ%px#(%=uG6``-z
z|KvV`svoqP2Vi$ED*^u^1KbPEIdFeTVt-Q(Y%gU(jr64{>+XO^P)H?aAW|=MvF_vJ
zo<Q?dJ#D+6FD7e-(fn*w&QPKL<dA%y*b(f4-i%x6TPrKgf>feQf0nn-yVF@Z)l?`L
zzf;m3`B9||Q-M79^6yQu1xHy59m|)@gel((npWiC@p3xUvQWs!UlbFfD#@tUZ~@o8
zFYXhV=2&JbmsMzKiAL&PKY0ALc?`L78q|?>J~5g~o??l)I$4}fc$xMC8!*f6Ag{%`
zS(QTzHS=WR_+8<{f7~u&`8lnd%Pq``Ss=gDFZTvN?DW)EK;&s!OE<R`<m0E7B@D9~
zaG$TWkYd2xtk*<Ew9vwjT|ck2;4-i7v2<#U%GiWLTZ*9|0|RJ0Z^o_dUCpTdGHOUt
zf(Lz#ZT?&X7wKz#dt_^K*@GRR=N{YKZbgl`%FmpYJS+O(f5Bl>_JC_jAMy<$%sR8Y
z_RNl54jbhsh`W&F>l!7#*O!O;gA2~e?(<7qn`4FGuX=i5_HoK>wxL;8pZ~a7OlQl*
z=5Dgd2v?gwH}@dw0B;G*Kg|ddbu|+bp?T~36ZVAE2Lx6va^H=2)P*~@+sWny{c-m;
zb;AY1yx0$Gf1*MWl=LAYb=-?>-2qfJf;-OWIp&Kb44;%RHaHJ(WuBkKay~U+aHkI{
zxnmzk9|#R2S8Zcc0lDOZ+aPM)t?eVhqUZc~r^qTh9OgB~l_jZBdJ1U3O8i^KqG_|x
zuHDrXvv0ySgHCjkG$LxO(RP}2YWpGHSoW5q-`ZO-e>5A1Q`Vnu%RPSSV9iSn)FZEg
zSoqCLh;wkk`BAIwoDi?u!hibLZU|2|cSyI_W!=gy?H6M?UD60c64o}pUo+ZkTfzd|
z>}yI22gr^EEe6#wi5}=ddzEc;ThTkx+s#VsceZBoV7ycfPYaDXX3oSYdo-p-AAc(<
z4vFdNf7xFlWsBd6m^f3R#)}I-cO==;t@OFOwB<78`^)*{^G)nn+OTZ4I4P^e?r(43
zzP;IQ2^hrNeERt&>>6So)ay>Q(R=RqW@{VL4hj_Mhn2Oo91E1|&1Z&P*z^qU;9hJA
z4%mZXX|TncbL`7`9N>3wuY-lAR~cB6RC3w-e{0Ua)p<O)_ngyMF{r0yHZnvme)8a6
ztGd@O2XAOp_TW}^@AFNNY;RHa7*THVZb8Fg!`###0l>59)7yAtOIqQXd(8<#zRm`H
z1Aq4Y`-9D|^2x-PqW;%S5q7(5-mJCRPQthO3kRGrsk#PdAi_{UBzupjAbIt2zuJ|*
ze|z`o%zdD4+8BJ|R;U2WthVK)`}*^Nz76S;zCMCztG6zni%t1<!xS<_NbiGlN=lRr
zkeP`WQyxJ#IVf;4D4`gl)}8LBAN{s_yUh+9aaAi0k7m-Zu3WmE%(H^Ao062FXP+R6
zBy9vF6AUX~>IIIWxXw1`k*lS-@vemLe{-?bHkX=7QbhlxX2+oIAc@tAD=JiHQwtM-
z(Zw25*>C&ueqUed7t_A0PVLQcu#j}J4#)3{+4f$ioOk5ij=tNG+B@`|!NQK6{2>M{
z4m0HQbX7`@V@o-CMp)iAeYS0<k>2jk!Liggwy5T!)I54qZnXqWa43f?LxO1*e<z$y
z1w#l&o~!W3)jG3ru8^mqJn<9q0w<p6JN}inn*Ny9L70nxL#f4T##RZmVS;Alzw0{Y
zyba75oDg<E#S)$xFo{7aUlj!`klH@1jOO*?m)K^%P%EBO8-Y$7HHk$EF8q1)VLF*H
zox<m(ZWP<>`NIsD;A&<(yojhQe>9^86zUSL9eHBu1b&MT%*vnbtWp0Us}qjY>({10
zn;@F0241o^i-D1BNL?r*_p^j(YW%s2ff|DNs%}y0U$T@NK&1M7V_J?&_;NQM-0x)%
znqJ4Mb?5e$Ja(zF-LPP>s-2BSk($lj!VRAG^bwscWtS$4ZiU4X<cP-gf7VfW{X4bm
ze4cFlpLe>q)%*2)uA6Cy=0evSeoMwdlj44hhgQHSightcq^CfrNSv4Vc6V*oKckn9
zXkCkPcNco{cdbkuJyTVilg<Oc9T0=KzqQ>?9+vO!k1nRfo=3a8oPD^v%jd^~2g#2t
zNzsvu%tgx<X38YC2U4g6fA|U^Qm29Zw!5pR@YeRfeb%x@o_nw|hx4Nl(CeC+=I2`u
z_UoWL&9^p$az)hJpmpiX@wm0U-L5@(df|n>%b#qNFXLDE4L6$SZ?|ymXKzn*g?Ieo
z(2&0j(XO}nDCGqI(RK@?b@qo{WXg>4J`(+Qcliuw(Id7s0H6r&e`jyE*x2r7=UK5p
zzw~oRpL6DmiCpNj!*!)W;KZU)mTU1yANUcqHV=X!5NUTKeQ<*osLx9n%~m_HR%s3B
z;f=O{MfsN9yt#T&EA!?Q*e$5`G-J1DpUsOik{dBsyStCU*kogDf7g<DmE`e2kSvlP
z6JAM`B}q^rS$Q{Ef8O~d`MJgOVl(gFaP#A2{$Rq_%(SyQ*-T>vS6k|nG<QjB2f=V{
zj$J2Oj!r`w!GHgC>&FcY5-4+yc7dsfvC_qlKe~7KXQTG;>w0CTMM}P(Y_uAdMhhiH
z3j@_Q)Q)-FfhjAr8;NdgA2)K4o7x4YinfAjtqzWb28>Qff9z)+3QxwJ+uL9&&eK8X
z<el3p$ycp-euG}SP6zg`u+x9;J_o<<(Ju_)-tCGrNz0{J;s7SrPLyeWo6iTO!mQy&
zVmJ0Gp#9h|ATdG+Z(7ISmxFi_U(*9Dw7|omLL83G`m~^-K0UMbYgys8^!pR^TRMsV
zu5Ju83+uwNf8r+PProV9m|U}lT@#5c7KG#;dWnA@nHi)Na0c|z><laY4oocd4+PZB
z!A@a{Y>odg*HJ6UwOEhr7isrL3uD<$ihFmB<#1!W(SxqTYS?MyGSUfSF;&Bh%wXb|
zUomLEzN<_{KC+gXXrGCCKLX=un6(%45*(v)In>d#93AN5&-5w#to`2l^y4;@X|&+4
zpjH{kJYL^_?32N<7k?yjFeL6rz!4K69}0<+<AuzEbW{n!<rs0iN0J{0T2@I|L502m
zrLmvQ3i?x3p|%#F6*Rg+i!O?M#yPTzvx&1<1x%aTJt_6aQsD=d@2)Anv1?l=1LNkn
zGWFwtQM$G`#FAIVW?)NYRQj``|Kb?J<=tH@8y@#U-mmeRM1TLt0o{&nd5}bRd1H@M
zqFmrrZHcwl3@b1p(%wLwEYtdTlOK2g?dJ_C{JH&EEYL9-`>FP`di7j&m(%lkHrv|%
zJD9VF<-lg_MsxLZ?1?_CeyP5_r~+-<W3fj%_sZp1<Bp?$ukUgWngxvA!)0K1KppMs
zq(>q~a`ZT#mVf>Zm(-rnZl#-wrv2CRS_eaTKhO1|;$>0X=5@a7*J6jTPqaf%E<${q
zlP;*dJ1F1nnu$7f;g#|dNAhLKLob#Ad1X2~-EDplE1*vb1cd}J1{HbQ&i~!Gjy%XP
zCu<vDtgkFg3%tCDc-6J-9ZT>Vj!r=AM6L9;T~xE5jel{@$>%-}_lO3jDfsgX|2b?B
zy7Q*u&#802SDOIEDOM>w{yTQ>uWpjR2NypE^K&#b{iShr_LXc<p5+>rMy;CGn7T13
zzJsQQ(}|yRVv75=8x%t?rsmB-0PbcGGu<%cLw3u-$IQ4E+MeyO<(zHwYB7~?Fz!cI
zv4u%u-hbGX6d3Qio`r_>MLE`6oIW?@r=bZ7_Ht`x^#d>T&VCT>0(=yyWlx+SN8*qc
zO6vg0N_JkSn2t$)$VXyqm#tlO>`f9iMzt@geb=n~^__HE^{T4R(PVtNcUOBJUJHv=
z%yR+CK(L?TM5vimN<mun4GTPzTs$ERk@md_Jb$Rd%9z64))z(y%DIqfh031ptce@~
z(v!-A2`(Ls%`g)rE9HjD=As$$k(1-Bk_<wwS6{K`DSwv_rMazz#z#hrv@J)#T*8lO
z3v%TbGr3dST=LFE+|SF2Lq&+qm>uFG=xKnl9N9A)eKa3`9E3B6kB5teQ+fy-E>@K4
zMSpKq?=p0*0K@@o9Z*hBnQw7C_lF@+&yvq`s2NWZJ4+@PJkC%0`c~j(dXF!4{iMEl
z@}l$U-FsS_(CEPGKGHyD`3w(q<N^DDJs^{44cBMUtf<CQzM(aOiIo|pQik{t5lH@)
z2sv;yJB}zcQv#iZsPa^*dxL|4=Yl>OtAESL`!B7q%D&72AXnt!jy&AqhuI6)v7!?;
zVLVSqFA8yrMSDX6dwlU@Oq4tqRV?n%bDi)xZIX0#?C%#BBy+#aIbXNL*?VgycRI6+
zS%H#{dPiRqca+sgv9Nc%#&<e;$JJo9ujL(;3IHB$#a9rfcRVQv$h0W%Nxi|n2!Gyi
zH#+o2N8ac}Z){8I53)(7vZHBfh_&I|jb@GMTNa!o)Z=AlB}J8GitFv@apOMxwemb)
z4&2U`hFxKxS5{AR=4-gv-jLqto5|LJZI0;V31HovFz9(Vsz4!T*m3SGsaM2yr+^P5
z2j|Vtv;t$quVH(4sof5^(Yh!!2Y*OddnTM*5j<Uc;Wi9K!r-jn1OzU#z-)aaQQuX=
zr@K5SLVoRay_@F^qfr1inWy-ykw7!c*tBNCERjF+koLj`VZV{wcIxgdJD;lat*XkQ
zh7x59*IVAWZYOC*j4@(oMd8AzbdkZ(HGsm>3FKr|N!KOgS(F9GS49=mC4W@`g?C$W
z@`foF;k%q0QY@+(aqKS?Fk5QsG2Af?Zj!ec+RM|iBsGMN_>iQn!sBbsuE0};=F~3d
z2=X6RBC3xyg}`EhA;<29g3G)t7m}!K!6)^{yUA+>unan73y{CVIWL-~!FQc<ZbS0o
zrFl(bVdBD)T36dhj&K}#)qm%hCU!Ysy~pW0q(D~gS8qUUu!ny2fTl?w=rOg={UhQ?
zn-eFu<D^&3hxE>D2584QbIsS9Z6PRsp;Go*1%Rz{J}DI~-xUYuY@HcX0nrb`%mu)N
zU@SG_W`#0Lez%tSU8OM&QpyqwE)rtSoHXFGAc9K8R!)|Q(ZIZI3x7K~A!Vk054M!v
z%1t18Yfg`ARv*G<IL%Q8x~NVKd_u}*C?-L0kVw{;frGMQbFH)FgGp65a-MTh)YkJr
ztO@ZfcQ2DxTp76HeWaE4hn7|N&G!*j5@a)SS@E^vT)0jw$Qh*jwI|2p_9;t=ars2d
zh<Ip2+8k<<aYTnhmVbfzJ;{i5EZT`gv~hFe?tMu`<z(xwdgBC>NNXsTWlEc@?K(QS
zXzR<}u(o0NyhfnCcXdQ3_|<5kL%XBXL^|6Jt7W{D^rc1ij@MZ&8J0wOElQH$+?U~%
z{c*tMwd!oiww@WB64XRCx%feAfX_8IObj;F5Gds*nZTj6Tz@Qvl)h1+&5rNn`Bd~~
z(IpZ8!Lfb9$b6hp*j>pI6Z<UITtu+woMcm#)8&x2aul@S5Txb-egQqyr5%tVWGJ7a
z7M$cfYq(i2c)#P{?}@FzLu0e=(yc-iV0$YZ#BS@B=j?ZmBuOxvXlc9e!n=1Le15z8
z(e3cky?>{(?SD57=iKQ9HgGR^vP*Yc7Tg<ra`n>P)l2t+M3`>3%egT0uXAi6!Hx9p
zn3|wO;M~snRz!Kge%IX0Kt`&{(^v@RCIoU+G29*TaOfYs<4q;N$I3a8V<3UTGp?54
zTVt;R*Rh;u{fLm_<yn0oTBOgh3T`H6psi|k#;%;O7k`CVZiodJFpsfF=&-W2`@X`B
zw9jxO2ISyoZVsH=sl%EIJFybhy{^B>Eqrh{sgF}1oN^`dt{U#`VY%ATtCtOV-&BI+
z9FX?JjaZc!vUHtG8DXeqX4I_$PRzBr1ms;)toikB)1<K#$_&u6LNTzy#st4bkB(E<
zrlkybTYq1vZL1hdUUw$OWyinpHn;4Q36+-o(G{AyiDl8#X-HsBB7?K0M+XN<o%7vm
zuSxP1m>DD*C}UV8OmlOyKU}lfJKfuHvvgr?vshx+?zl^rx-@|Lg&!Kf%(JojZQcc#
zW+Q5kJK#h^J@utqhD3xAGLJS+OR_vQHOvkzCx1wwBo5o_{myQ;%#<0_#$&zA<=J<^
zgv6pD_^)!(0WQnI@5w+>?xVFg9U1AUKP;Io2NT-Eviy+-gKoN0Z;-pXLDE?SgcvDR
z%fV^E5%L9%k%MZF*w9)GNNq41%4tyzdmr`P4Ft59ba6{{m5vG--YRD0j)*B;YCa5L
z-G8m@cCxdh@9gZXd8@6SAxUhGY>OJEtSESmR%`56mHLb{A_cZ?m1iZ<e0O4^!3iu6
zV@b;~@lz!IYpbH8a-6%#2_U%Uv2>$@BI)&d`b6uNOQYBMMMUm{&+m2b+})s?(U?9@
zj_49Q#_<v=ly9`{iZJL0*cJZbba^`CoquwdV|;HV-^thAF=Xw;Y@X|OjT{e0BkU-e
zt>(2#hJ1xUA8QLyE?euW+V(IV8xp5F8q-^|QTH)j`T}wHTh>|^p*|MQs+p6cF`{Hf
z#c;8;?J?zz^0eqr<Yb3Y*f2z?3&X{w6d_RRwbeil0Ym0T3&D?CBV2%ao^fc6%6}$l
z_%tfX%(Dx&wFg2aOzz1?AKeZl$b43H<+I&#evIFp+w=s<i1sZnIJR1}gW}OtC$w6_
z<zi<?GUF~8Z0IV2X{9+Ez#8nbpIuXQJe~uq4mSTQ6K7?`BKIv$Xt5M!Q(~D8HWI~`
zqb)MK*iB>?G?5(B!-gbpv1X-1#eeg^*)ZaOD@sSeupQLDvuvV1-vB`~UB3fUThW-z
zOgRcwVz2nNT2C6XZJhd#XbS*%a7Y)T<<sR^x(V7Le%k@WmFQtaQ=RzQFrP2PkAlM`
zt`;C=k)%JaE3C@EW}6{#<!wIa96knFVw(=jDXx})*MQlbC<`L*;qjIoTYv0QlM2!}
zQj;*bNLENLBe~n6BEe`+3i=m&35EhtcuUG>zxY%C@a3z6!zYjXUp+rK{5-mSi!nuX
z6VJ3RyQYN%^WmG?fA;vvAN!A<ygdB8C(m{8T-AfAu`|rN!?_ecFd^X8w|0OFX=@px
zpz%udLoM)P@?BA#1mOgyZGQodq8>ckJKX>FiF5&xr>Pv2DL#btOqO#+gu*4!a>5&P
zULH7UEK<*H)>r#nGURCAp%^*m51rz7e%rS+DF=oWC8BX`M}g`Bl2v!~gdxo41&!g!
zsF0kd9{nEDt1x8!>w2?Kx2NRRXU&%;Zgb7E02{dF@j&W+D^257M1RL4Aud7aYj*1X
zP6@Ej&xGC{&uu`@`n@CfK~svNNxOdYYu#(KU*0mRu)*y*5n*wnlF0rG7Yr1d8I+CO
z$T1g4Q_|5&w3jSNo4j(ViaO=|!qB0D?sbzF_C4PP@0Il-Q!LwvJOBlBGFh>y1+q80
zc4-%j1IRawAswL(mw&y*EAZR?Y@X{weN+jVM-KX1ctLHi72B^fV*rntIZ?l800HpM
z@+=9VMminc(kk3^I*OOvTb$0kEgzu}xxvlc>)*N4Yno0kc`!2~&Y|b4s~fwUq?a^&
z|1^73&L7af#gzVS{6?w(O#)X{8oYC`bati(QY)VX%<Xy9l7GJmM7n08VDA`QC5#lU
z{uWtaUT<2-AZ##-LD71YbJ2mT1^$aVXsjafEk*J(MM{roVhWsIYBqfwG-_V2IF%O_
z>-c!4qpj@{-a=;(OQyufh*!F@wCc_waj0>Vk$%C4jsXz=68=J`^m_06hv6k$hqW^F
zOd3-E>GMZ>Pk;N5pS*ZNC)=|}`%ezmr1Neu_*KUocB5@oWa!kLRAD7iMwCNEH($xl
zaUDgHYH+}~Vylb@7Zaj4!mC`D*KKtAyq7qbXX^RMn!4#sUcmG+VkM8yF75%l1^?WU
zf9~>p;jeodSmHv0*T=3g28*a)zchX=Y-;sGKG^Xu5`V|$KX;>8wmZQn{#x;Dw1~d<
zVO-GSymWib;GEs5w7V`Gnmtx)1ERZ9<lI#(*Y+#X9({y1TlV5<c7r#BK<zL-_)DYj
zs{C&<@a~_HcYmJ9JCH6{Qlrie@MqM(fa^97E)Zb79mXxO?cvc=QUrMIX0)(#D1aaj
zIsF**`G3z8W%p+cv+F=O=n%*6@Cne7IU$LUg$A#mJ(TNF1YH=qp8VP=!nhp8vx%dc
zE_du{6yWw({~5|w4`r+K>h}(0yGi(3$dzIX(g){3T}7OAv}N!xcIb?wqbZ5<OJa-j
zJSf#32O$LEZs9b@$!S;4eK(G(_l*SD7HK``uz!sML$heJJGXEDA8z*}%|{ON<QcKf
z?i)`HVi;os{1mZtBODkb7s^|?tdCwVSx(hEC*$D^HI@H@i-J5<(DY?<1V+?m*Q+x4
zDCg6}%h6t;m|!Md=o`D#U6rTH&g|Nu48&&*WFlh5_m#|rEt+|G?8-kfQPS}ZP7^L|
zfPYjb2{*RLjWZjV4&sv70s_>)JKl5V{~2iZKQ7Qrj>GUcV9^0<LbI-Ra3x=GQC9p1
zc>@Wc<Vi4Xp;--Pw3TEwe)gk2U+)LkW9~}FD44LU*94XfXTBwV0`R=5?Omf5ivS@G
z`zjzZwl0y-z;Pf`zc7Be0KF!xg)90N$bU~{z42*wIv8aPC^RXTBcEZmOOz#Y20ktm
zXT>=O7mjq5E9VuS7<rvSFLX74rYKeQaC5sTLzp363jLg`#%}Pr%w6?m&)hUOYr#rT
zz`eS0scb`UAECTqd<K_I)e@MPr_OWAQ#(dtx$#J6U16|z1qT$rg#7^JkGZsq&VSUA
zFXp}mF^vez)|_h>sE8MA18xE>Y$sdV6?;V-N^yAQA!&z=!Igg=Ni+(C{O~eo!fNTC
zJ7BUdPwVJ7)+P*G!F=V{5c2Eo9jSnRwOZ4bxCmW2rrkWN3M=l6n7eu)>~%yShgiVU
z94#52<GTGgyD|5{ArAaaGB+g{oPU0?NZ{veRPqR!lZ_>YLJ3&{$gVr&E^01W8iDnb
zwcC6E?D<k^oVZ2jy&YM3wI^1$53^-<7Ig!_SL#??H<3`x3(W7Pm{u;tw$CvyBaI;8
z)gI|OqYL;5fB@OFs2`WmDT%Iu---@5*nx7cBpKECmecvM9184J)9#1L^nc}N2lv8c
zf29j%VbOHBnOb{#HO6~g5-Yqaj!Kj%N7KN0ZLz}jKw;5c%mdeMrTUQ{5#yWuEZ^AZ
z_JW|{?xNaAyUCttJZA!;<FbhdIci#oq!-v3S(1BM-_;t!i^G07L=lo)l|rdAac=&i
z;4Bw{tFE&aCbwE5aU`aSkAFFsH`;h!Z5z$Y8BY}r7F0t@2uCZFYepvKVeaap#J+`T
z`82zbNCi$esqN0yhW-WU1zR2n;)~K}068axMg4@6(RLywyiV!WQ$q~CWFSx0jy(b?
zHvG93oGuo0ngKfCT)`8@)CHp2N@g+LcJgcG?56oBo?}QV(w+&xseirSm2(#%GpR6^
z(`;5HX>Z(9H*;^<OC408R#lRfl3;egl~0xo%<38qn&U+qfsBO2SufLZGjaLu(|Rk}
z_Yu_=_Uycv2QKZD?Xhx40boUS^%$<r12n-&79H1GKeqm511Bb}z+CHdZ|o*?^<OsF
z1*<>)WrJp9hkhK<CV#|V-?ioH(p|-0-_gaNTl9ZQJDy*Q$1kwsgS>_5vfju+<cyS~
zOV}nVcl&@J6qm60K5!hRW2=T$EeHCSL-Jw(@Gb(@#b{DL$K96Bq>!T6MU$^`j*pEt
zJ%>L{E`oY*EJQOc)S_9gA=k88FI=dJJ{aq*EXiLHUXYCQY=5zw=UwkS!sec>cEhy%
zrmnbM+`zVLM?TWQ>L)%}JM0jJ1vWi$=lZYhRJSuLP*b3#sGZCPp2w!4K|ahZ<Y}FT
zAz$>Ha&i&G0a(cNmShoX;3NR8oUI_5hjkMahjBc6@lAm75$U29&SAIXn2zv84d}R~
zet{JDAoF3GY<~sCqv(<6S5ZJaIYw2U4-n46SW=Ew=$G}W3sU9SHXpJU#3lQ<Qa=h#
zZ4Bz#CR0u05m^I5<yOU**mt`0|9(ruV1~GLw+mI-tV)ha@M6r%cNeyloDmqIfctI4
z#*QUNIiYr*)6K1S+d%<S*JB-!a6~$8TD>0K>CWCBcYlM_j@>>QK4cvF<C9tcUGTrw
zzn@-|^W$CX$LFTuHnhV}I&;!A>YgniS8=nAF;Y`Yew+<2lJwc^)G%7@b9zkC)Z(he
zZAjroE8i(r^<p&2#Vm%BQ}ngvOv7l58r@W)-uae%bQ^{BpwGI5tjZNK2%ZiNg&%|_
z8^^kvq<@#p?(^5rp1kC(#C5xpR4*{?F{}8pSbVh{_>$+SU^PF^rdr>U<0L>PkF2Jw
z(&q@}5FynYD`{k>-Y_Yk%gNSY+5Ac{)-LY~^D*K>T~;SECF8={1uY;x9jhJE<9!|(
zKl~uIhz?#rHxKb6emdw}TV@lv!NX=P#HG)lmw!P?h|_2gZp^&PXh<S}+Tu7qDCkFs
z$PK$pSNo_QD)`m?ub#Yo;!;+mHht}cL<s6T#Kb{MUkPBW+Uesb&z^JCpl%2LefadC
z|7fp&aQOV?lhp8x<A74b@nJn|OZ`o};Eh=2&G=CyzR)zT1Pt&F>vLs_Am-#&@OQ`c
zM}PdetjVCRoEYh#&#2#CL85+9L}@2+vvfsxXBho4DK8R|Igcmr6YoJU_m5Bdc=;AK
zAHXF~OVM(v+gv|oYd9z6(v@}$>^D*=n&(41vS8VH6p9NP0y&vj@CxScu`_*EP49Tm
zV$i7YsJngb_M!yZ<S15#IT$q_hlp#gl79*>I!lx4Tz69AA|JANdxZCaKPVr((<ctb
zn6!28zH|g_@FvURLgZ@gZEGGHPhya$X4467@-#;=nDcD%)~OHyx)<9pV6l|IRzB3B
zu4uW0AeO|Jl1x&148zmyhM7v+I(V^PTxXQRtcp2jLgZ2#Hw?gbpW)Q#;9K&$8-H}e
z%1~;AxQ6`&4{MaSE*m`HdjiR5fqbxpALp^7E7=(L#JbbVPO~3)cMDK3p7ZPB`qAY{
zgYRQr93LaTRQQ>GHo~=V^%@3qTB#GO6n}oIB-qnNdu#jPDwbNfa5P|FPLxMh$(Ucf
z<hhFM+*UN!QAhG<zxU{IBE^%tR)4%gCkO}9S&?h*FA_*$edMp5=I~L>QPq$)Uf3Nh
z9^W6K!RK5-m4AweWAvg#WK}(dwCXD#V1LB@8Y95Y7a`TR!-})sDPpxPLN&GC;Ti$z
zsj-Dy<#>UOH_x~I9>-G&4t=3NNx$-&QWlza)>r1Tp_|$9JUb0`A(6%sNq;d5Uv-)J
zq%J37l`uoBnnbLKv;&Ujt&o)5_oU9cNc1F>kO!PMU*!U=cXYtB?&N$tZeND|A9p)+
zw}ZPKyW>;gU9~q^y=sxqoDS(m;EJBI%@Lodu403t=GwN=n2F@*5xb&Dx>3N*gM2dX
zd{rVdHn~)7;<E06_Dl?YQGd*W5KQn8-Miqp`QW51-?|di;dTlgRAzMN<?#u78c%5F
zCFIoTytG<-F5LOfosaH(gyrjCCOY_}t6RRUMOG@AKVNj7&Xn($ITWDzv2#LM&vh)2
za>k%8Ev9U8A_&&bHJgh^Cpq#_H4yR0p|Nn6?9`YC=?vG#e2JRaMt{d4SsJ}-v@6e{
z6%KA$qGVDdP$MeYyt|3T@vS39jgvhR4WO~l+rgk1?T5LvIS2;GQpmVW6+1Dgp{H5U
z5C=Iy8=(<vbI>l>;!9V#Q~^f|E9xZ1cK=^H#9E&}e!iRRjS%8L%FCqFdEnN9je1LH
z;6sF?RibnsOYFl)<bN9B28kyAOa6vgIf%$Yd9ZCpcn9rdt;qmc>X(yKVLs46PzBw-
zx$bdm&NEz>=&B2Nth>I|x|W1s$VRe~r8<39=D<rP-Nd%?kmz5G*6jJ<%=0LhKa?~$
z6k7L$<K%j#f}bOYxW>lut*0F1cBJU2(#flbrR=oRaT}e36o33i2Z6DI7LF@QYp?)Y
z_HzYiwb1#X5OrLLfNOrcHHZZgT|WzV)dJL08qc6E^R*j=KC#)*gElGt$doH27RsTj
zKgCk*oAT7fYptJ_sf_bCqGoF1oOtSl1wc<9BK(kTWB`}4m9@iGqhc53%rhKGgE@ri
zCs)M2wpi2I&VPgCwfk|P)(l*=<>xLzdv>@j5KRO6Fit%|fHHWLDBHRO<3ep=wqcwt
z#aYR4Cm>UYTPyZ<#jB4;;AT%Hk>u4>0N%2NW;BB3xo>Ovbj1S8R>(%ya>aa2oQ3OE
zF%G()4^O~sR50lm#wZ!eCH;?<UMDV_VQS}vrELO_&VRAK$we?A@b2oZ@Ns1eDqkYa
zd1vR5^aWz9%Hp#y&`ZkA?d&95YIEG?x4uMPO8u!y@sMa*cXoD@M>QEA?aEzq#&8U~
zy_zdt5Vwe<jU(zefv>S-7;&6^Oi3L*4C9%}s>bc@#Iy!V?k0PPPgI$P0||@|)|t5;
zh^ToAF@I?w5e~&-ArOUbkSGdI`zr35Xg8_XZjN3*fBE&ni@irr`p@>hdGcM)xpRs|
zewre2T0MI2WPgxMQ&XJ2<ik7J6B(B2rb)4>9HgD-C+y8sj;I#FJ>{Ovci8;yn1eCc
zBjd0jt89WQdKb#4H1Q`=W1?Mg$yp!*NJksr4u1-lVJRejdg!)c!{}si=gypbe%jF)
z-bp=I=6DoQ^VpJvIH8t63T{NY!LHd_*ys?*2UyLG7Cq2PSc(+ml6_!T3lDS>zrs5^
zEfPL(=Wy@kmroA+4`1#*d-T;VH`QvrDF^(Tz-;tqMB07BLC|dV<+SRcOUuD>x>$Bl
zj(@t63OclrPK$~|R_)Vj%CB}4tc_kos~y*B!qrKo8Ul-jzT2q$xNE0qZwMKf1iF7e
z`^Y^Zv!y#4?HX!>tGPh^-A#USKNA?vX7dEfa`LMme@s-^BsEoF&wl<n`Oo0#U;kQP
znCEn4Ot16GPe17^N(-Hb{1#1nH=1+2*MIryIxTiO3zA{;WFvT%QwzI52<yv^@17!n
z<`^$;)ZQMHv@JG>BF(5k{80C)((z`{veONJ{&{o5wWCyH|NC<P@T*r3#aO({V<5G4
zo-e9yc!!$sMPCkcmbOK)69l#MM7Aur8{LhRYcDm@=?~U+vD>=Sb==#9CF*hIa(@S!
z`DB~(vEf9{#P991y(9{nX60yHz^hVS!Wr;tM<3hnw(e4YSTifey5))6+a%MpDkpPX
z?h;OWbnxiq{)@x@i@n3IzLQi}JvK&5StGMl+@oXLcqYEdiB#N++6%#Xa>z{E&5{Z<
z16c!h19x4(96R<IU8i!c2F{0to_}YU3OJ+>OIK5rr6C5J9Y<9jNBLlR+z#Y6un!jO
zr1Fj=U*g6FIP^v$bK6bK5`ji5>n~g_+1&cu(YaR^|COg^{>ValS7^A{Im^=S#Af~V
z8-$*?O0H~p&9hUH<}{K-oq|#A=-Siu5*=!tHS{eOi85yRfX@=wR_=9)F@J~Pi`pdl
z!cZ$G0#fAcgj@nbtiEg_aE@tu3!@%#Y8$qhM2sYNc9R3Jl3)jTZOMhnG;3ZhhsII=
zm<>i<BdGC--~#$IZOyN95(qf{*XG5kZa&YYIh6LJkAl>eRY&ADD|{K9Eyq)dxW^}A
z)$vFN)%=0qYRWRl>FSd~`+vNXg|h?z!GYBq<8>d#7Tnj4cxfNm)TxgdPA_32E-bhc
zR4^ww!+=3_tBu514b=$4JwcGm`IIi66tft+CbghubuaIFfx_;9dv{<wM_YGv4oDu@
z04T{J+P|||=~u%??>0Sp*FPGd)3D$bLO^qZ-4nN7t^k*K7-%d+V}Ip@xuu#Wu&G7t
zWm(5Buh7&vf<A47uo0XuyLcpznJ3j-B@EqtG4N^V^mfAz(x6P}HXVfvt~ukib~><0
zMSJcp?Kz_!ucWUy>y4=nYXlegaw2lm=ndO@JgF}X;mB2kmYL*(LhbZCW$a;)G#{Bl
z3#|3S36c^VL&9s{WPcZC9~PmP5v%hly9BWYkUsF>zJu)%k(a;2N5IhI<@lwH#Bc_|
z4D4ZsBI0<nt%%rry@XdqnQnEnJ8iw+^+RuGu-SP6A9;(hCz?fogvk7YR~|xsg0D<)
z-eSOyy-$x`sUj7~E$54uJd1y-0Y)8h!-3X$xgyeWilZ~}cYk8<Y{##k2KZ-e#qu5j
zZ!?f@+mt%BIILMu7cnSri04_hKp1-49e*nfvbI~>mhUZ5mn+;dWR{W}MLb(WRxI7E
zs_{ZObWI?TU;tY{q`yTg5vcn_k5MFY4%zHMY#>VW3tY8s+aps@?4mV4yJ}hQ>uFb)
zwW29R4Mu`RS<h%?l45`K0?BWhlqElic@|v866-V<BZ(NGAVP=H<n4s_vIKDv`|#O0
z=O>tM&5q4nFC4a-6ay8x(c@^DXA1C)oa`e8JX>@ZiRe&v!r)RL&>x7XA@D~a((~9H
z1tyPZwWft4p%|-@U@4PYH|OybAxa-crv*o?l3IxXX0}+scF%tS?GkWsN!z?J@80VV
z?UBBJq%V)u;{z5a^E{TAf>x0PHmMR4<Bweg!K;07e~DGDgHX*;$c3G+#l*U9@_3$&
zquJ^t2g01(0fH(J3QQ-5GCbq#uJZv57K3q`!(->K3rFKE%j-43QKFQ_N{z~Oul6}-
z3Z0>ThS442s{4POo5_V(vU~<{B%TJs%u#)W%_80HK7X7gI@PMe2!E$Wa%*C3L2yBb
z<M2inni$w_s_aZ6kFfs`Ki`(Z8P1%@ryFam-Ed7vcJy}VG0Qk~c!Em?!>a|89z~#6
za_S4c-3}ySZY&&?t1vi!3&Q3jN47AuI~v%<Dj0mW2+V)Cym}4=N!kgX)%JtsZZliq
zK)0zt75fvJGsI~&+8Q+w8TRQ|ATrM;p$4)zS%##xP^~nq@!<nKJo_rSid!Xp4xI0D
zP>(a3$0C~xTfgAIhm(?}Wez2C_O@agf?P60$f7K1M^;M-13E6$d=5DG^7x`&ZVs?s
zG-Ze>BDH_=TFx>Pi+5|)TpF#0uBT4?(+OcZXuEI?7K@~7I*<s+#zIDpnTHA*-J~SB
zU{Y`{Kb=*)^JiHRo&0$3JOdc5b)>E3P>v#>qtNLmNFedF8j>lJJ7$<^fp!^l?h9v#
zRc4);G7c^_86OmpLlpgTVA3^bqO_xfN0KpAhthwMB(s@0PhGKa6A^?M1>5#scTM=)
zZbYJPE}J&B%fX68vTd(HXNLX&Zv2k**t48nLlc3yQnwn{;gJxvyt;O%)+n$GGvPOc
zqeb+Pu+$Om;LyEruxd7Q`E{@_YxN*=Dj1k3R*1blK?spG$=Q3(2@yZv_CI~cfdR@j
zv`2pp(NeYOl?f8=!L23w$tNE>auBoJARn{-qI<`mEG*<$5up=x)vydlGeM(YPBpj1
zux1Ri31*%)#wZCZ66)tQIfsZHg#7)Y&>&B?A9d@Im;U6WGnse53Z=HB#9|n)STtd%
zIFqWd;2vhVXI{XbgJv`I_<BL6km`bXgVuj#9j5hs|Jb1r9LNQmvfY6u?Aw^xL*k~z
zIm<0P$_Zw&sD2g{D<%jkS`nyOn4XS;%E2-yvBe|XhGUZ$r}(t2S(8`+eeFUruZXy6
z*U$6#=+F;ZI1~!cMxFJ-KX2VHV-IzyW~`(4mb3y}?T1)OotP^C9BieI+}z1C99MrK
z*|s%aSRc47R}3XEAwBfhtMCGB;+V!+FhH(dH_t3KFQ>)#OB#d8HftaRKI-cOAw>N<
z1&K1j)4M`k7(kU3BPY!uSx(So_^2(ouyYh=;c-3X2z<0J+M?AG@WFPAg_xcEO_i%?
zt|Kfy&FPao)3ED^#F7|Ad5~wPcc*`kfAw*Buqx$r0Tjdv$U_a2g=AgBcAV$OwChA*
zRK_mN@GD-qjH>;fMFzPW>++$XBf5Ot;9e~%ix2)l1PXATute98^hE(HC!+wfMKCq0
zRTeAe@jw+1_3ACK2iW<Jj9IOr#lB-^ywf=Wxt_p&WM@Eg8+ZFIeS+Iir(l2B%2_s9
za*mB=u}8w*279za32TxKazpV=c90dZ6CYw464&t;U+r)2Hblx@Px!P*o|@RXB5{fw
zdTp_j<(7%y1F;1QU#C?a=aQd=uHw^g;X{!aLhf8ULZI{#`lJ}=!;7I*0tXDvd<3N7
z3ns6wPts66iz7IsSkByJZN7g-nb%N4E%G-8R4xTYxdOXC5q6);w=1U3VYy@+j&md@
za;TJGLEj4&Zc?DO2etHw4mDz+iwo<2mx1D3HM4ka<~afdk|Vmj$jt*t6qqm80jYh`
z_s{n2*=UG2N%u7qO*F;H8R@Ihs;uD>Z0V$lcw2A)yDT6B%`<`pGv9x>Ar>EYc3wF4
zf~cm#X;*5}yn@cT!iy9XP`yxvbRP(&YJFSfW!Uk%{N-mQhqRzCos^*&ig)NkRvRCP
znHeFhh48>HH1wzg!VezYe=Pfnzs<p5?N~7tsizYp)BEr5KSsP%JVgQ@$`$3gcaq?+
zvjgCZS;#r1+rB5z0f2uv0M{mi4~e%Z8kbE-w4of13B9<b;t5ART0jt<=M-J~V_SN&
z&p~+%>c;RxXXs6>-3o!M#2D%F1|8@ltVhKaoKAFhqJjHhb05Q*PnT_(zx*9A!xb%G
z96<42Qd2REsm6CVVzQ<W{^xzX^q&tlkjDh|DDFW!h;<_(ykLJU0nTYuz9_Pt5ID(O
zk5%%#rLO_gNcd`px{Ob4Ct}Il!x&gD6Xzgx%w>{k%_8GRD&~0mSTwDz)}wG)0v2e-
zNhTsOuW3n-WGkN1<iG#d|3z!~1wSacsUcah)oN$Q8wSm*y|bflM)T^fJ_=(nNAV-u
z-L)g~i5yz|4KaV`r^R&D9C)G8H)FB+3)qPpGDa%i{3imHqgdo#l&STJR^S-6=dGAd
zHVm!X!u{MAvdYrbC9v`=3T7lJVA{Z4IMl`>rNdd>e~cJVY?7%bYx$5Q4nxeai1iu+
z;!v9BGYd`)pbvD=az+rnL+tp^2lORV|B39lLRiCTBpH9J>yInN@&%bAd4~fs-OX*O
z2?OTvkUyZXjNsuFVqIB}M%{rG`DS}($6kG*fh4-bbmOCFpt&q95gQD~r}^oCmY0`O
zOvo%IN#L(*ezUR%CDlqD>g5DhLWwaD7ZC&1b+Vxz_#{Mb`*5Zj9~BJ%=30%WVL6LU
zDqQN$gR+0JgjKS5t9JO|nw=m=8$Tk-jBW=m$tkWjaEBjzJDTP}icFqQiG&uRxwW?W
zohfQ#-B#GpozSL7lyI1C9&8|*vNI&Pr=5g^YZZksn;YRuSWDexr}s1Su@{+vYx-dX
z1_3@hT>O^B!K$|{-uZ@x#&+Gxtw}5biw;N<1+#y{n=mnh=+C(9xNJ*^V`aGr54A0@
zZCIb#qHRUyaWJZvp?(T(EnKYG%9*97G5WmynaV*5tWeg(0t+tK;}J5Odp>R0qr|)s
z?0KV+gF{K^{?3lHf9Z1JgwXJ}ER58vDdL9cF^R3ajH~7wXM(k~iJD(+E0fzeZKn&f
z;Cg>mG176cbr6})A4kcB8jH;Rp&<N^36<8TkzcVWVz?uETwt+QIMm8x^kHIIk0u2*
z>85j3pYhh7+u)ZRe-4wbfoy7JljU6<JY!sCz=|N56OEw)blnr-H(QmMo*kcQtFx*^
z_&66L{33FQ($;AMWtRsoj|gWT(1-NE5pI9b)fQy<r{!5*`C;nmlu4mcfeae?h;(ft
zidW@>i!s`GpfznuSjz}5Z4u`t3;{98$Lv#NREsOvYAi^)+!-(na0*u@LspyFF0GMN
zMpZk3*g`kHEXDZ|vELp<RlK@k7T?Nq(DmoB24Zkp5VNHEabmW{bq9XnesX}c6Cr=D
zx*dR>i`>qK*I8BkLGfW6!n97jY?|W{nXmu=_cm=ivRE;`&D?o2Qqoe|!CVNdZL3Bo
z-q|^kp@!c@vnNFxI2lbUs;c~?B}nnSV`BBGP&Idzuh4#w$$MN>%#QS?w-&zd6jr5%
zKln}Soc~-D@%Ut6Du<|WE237dYq5WIg{vdHch}ep1?qAdJxgn%V@a7-AIlOi!t<$O
zPUoYQqfUffSUA9*WdYc6X29Z5zRU?PDg83x796*->SBG%#x!IOwc#j%D%rp{z%2gr
zK0QwQqa60LTqB7v^_v<U?hSj9wJ$OW@Icg{97tBot1GdjiM+6^pneW6kf?tRb)PXN
z5F@}=y$hGWt>QKB8?hb`OH>R)6iPHyMX~t|GXYr#qOxU;TG<MlXV`q~-pbTFpSW2S
z7Xqg^%nR`HweF7w0Az_Fa!?ThQ=~CG7I9%C-3meT6y;C7bB;#5Rzar>$K3KRT=B-A
zGa!!Y3Rsr;QmTjnt|B=)zK(x)3%&|r9*9)oo=Z;y)7lF&4TMfPncxWaMJ)|%<S<aO
zSW5D?39%`-)3?U;SpdZK6I5eonj8>QfD3r8Tc&QppzXuYF(xPbqb)wps}GH$t4u#u
zB{!@La3Qb#c+_@yy#ZL`T-nJDJqx$krsp-zN)nx+iY|+e+*}q4OHF^ePA7CFcyA{<
z?o9n=*%WB|+7Nm38LDqkwVmAnE(=l<yp59PK^ZU(h7o)Mpy>ngp7FDRrzLXm-iv+O
z?ibr$dOpoyX=rXR3na~sFQQnA%PAbL*e^}2;~qokY<itThZzz}>Zf~460bk(d~-o+
zE0dWgW;k@D>O118ITL?Qg}B<x^T*jQR<P>_PysGd8e^Sm^zusABy;jIf|V$rogGdF
z4&)kb0A`Qry2<3x&9RZt4Hdo76F$Aab`vQ5hv~H*@@b;0shc)u8dwg5vU1MllsFWF
zoeEZi1tVr-t66v;e<4GnZGp`^rE_L7GC%q|!tDr+9Kji2WpjUU#LpK2O9=GBm;x%E
z(P^&rZ6&Q)Csy!+L`BxF&+`scvbhhWwIU2dGyiADS>a37;X=YWmP|Y|#c<qEqah!y
z>>8xQRpr`jEwwUV<QN$-uAs~}QC0i8Lxju@M(=Ev;pe?5A)5P$>tf6<yu=_b%zzp!
z&4FKI^4W(Ge_nrZP@8Be94yN=J(@dCdSkqH4RdnP7p9fz5E=iwzRQZmXPO*lZ!un#
zCL~IHj~ElcOu{oUm=Hz!MLt0}vuJg*1~bja#xeGWwnL)k1=iF@?MEQEbrK2Rv%S|g
zM6G-zXZNI-qHpQ1Xh-g*0hnGqE~Ob}Ka8XeOx?;sM@xS$9(Rt#$@)e`M-Ftk*-DD4
z(UNMy{&$NPzg+*Tv!7&R9gS@$iFvDAu!T0%V&;fWXb$3}WD0w&Z*L#+0^+$PUO=>w
z+SO#^<q}cN^wEOruL@!FXT8^D)hGoeSx`Hr83iJ6DJ82W_n|>pCUA%Gq%U&b{tZI3
z>`JF~WrBamyK=k+t|l+XZGnnCJB?r2l;f<fZnf11&t?-96%n(1jC943mfv&Jj)6n6
z*uc>?zla8}P7(gRiuyY{pE;Y11iZ%&IRm@2CW)SvA3evuNEm5evnHB-stTuq&6^Hj
zRoVR-!>xotDt}N5vta#^e(NG;o;rs+i}>(VOE!NA7}d+1)a)j&j7boesb_6H2DJ&d
zU|SgHb|^`4SY)+IDx1|RyacU-ByMoN5)TEoZ`0MyNM^RK8#$9=dSaU^gS*u1PhJ1r
z<}hASc-ZB->KPxXD$-GdLqc4qS_ohsHzr+z8t2<#-tIGkYD#ajHb)bk=>d|-`M#>C
zn#zB>Z3lF<C}%TYD+ZBPxtHa+@8RjN-gBvZK!X6d%$}9dG`K>30IMY1R8r>w-#%YB
zqpweQICQV+b3>d=E{|=jH4~hBqa%4R&0o7(ov`;h^j^ok#}01x4dal)JMEP<mTFl+
z3h3kI@a<FZc`lX}%84_sM@V<V!u47WCgXn^GFluW$eNF(I<yFA*hvGUrL!!jV-qzy
zIXp*Fmlg<RvDx8St9MJZ7wh%aQ^g)lG!jbo6&#(N5jBDVs@}!bFt95_$lD;CjUi`m
z9>%7xQTue@X|ZvIypdG*un+)8<#CxjeL(7x*J_Mp$<f2CI=NAS-jDhyYrdv5Z&-g8
zlrx)ek#0C04a#@PeeS@6G$^EOQDmbmM~V@4{noU!u~qnoV_o!0hfW{6N22a9o6Ck4
zzyPl5D8{GC5Z2$613fQ~rq!FQkWx^0KSgBQl9<g!-{sv#qmVAQ#iGaz0}(G;_lgK{
zzT^-o&ZX>dPVK^%%qprlu*xS3addxe5QQY<B1qxIqSbn#fnqWaC+Ud-=ch89LWq!g
zSUhkMr{T!t?Ci*-z!$+*D|}$r*QlqaPx8q`a47iC&+WRdo>U0mz1O{Sw^PyiNw-*_
zSXtkVuyeXHg+(<d`_B$g*Ut}9DjoR`<s<fw%W8?T#rP-Ok|QgAmsYknD5ihC>O`v)
zxumt@iW(dsB8vlt&HY6u%&+dWlV9C!GlDaN^?bhZt2-Ml8Qs04GfXxVm%F;CJ_Bs_
zbg{LG2`M+*xYniC&yMbVx4n^U{0a?hD86&8tLEglo~G8-&M<YJbD4svr~@+ZeB8iy
znV-%UQ1N|}QFBk89lre2i|2p)&kob%H%a>Fo5!g{U;9Z=Fv~64DHGO4(|0^t`u>0a
z*Z<yLogjmy^&gp@DKgz_F@HZU=BY#uitoV(T)NqJ{tK_nY^ATi5kwh4*FD@jc+#hS
zKY96V?`i+l%cs^Kk&)ks35{k*;TY0pD=Iz=%h8Yv#hp88G}!%)_i=x9UfMrr<%A|B
zZ8qY6@@Zf0M~3@T#6ft3I2gJ*f)7qhx;ULFkZ@`i3rx(#nohKuxgnJ60R|uKaAZWV
z<#V{$ZF<0w1U9O}&yizKd`Ys0+L|rg^lfd!7y@TfpPu>{Gu?&ErM@c96NRv?*!8}%
z^I|!f^iX*#8*&iiQ96H|lj4^)Vu2o)<?$q^e>!eP42*u8q3BUWCM5Ck1Xce~(T_C-
zu4r^oEd+BC=lmSu#TO>@&?pyqxm;A9Hre8&2=DrdR8I_+J7C#*{%Bt#hlJUnS*>l3
zIti@ziHxmaSe<M%LIAr+k9MdY6XWG=y_|}Pd!!dD@fE5DF@%3(MY4^6jMGhY#x#~x
z@_;Ka&mp#FHoy2RJlHDLb9QLqb|lrG4oqGou5+->U6_`^sh=ZT8R#*5#Ihxgr?arC
zKpgq7vqLfkmQWi5Yp9&IHm)q##I?&DEp6NOaFN*v51v)|a#VKwf`J1dXA$L0OsU0Z
zp!gIc_HmjjmC%2d8dtKlz$_5FpVEj%JUFf-wJb(NSEJ;%+hxK`ms1ouppPD_wFmg?
za20_l*fJK$3QFk?a8c)Lr>J&Z2Z{0@29<Mg_|v?-S*pRuOBXtAE9X-{v^0a5%XU1E
zGzQXL3a&-wYa&U*OoG!~$_}u*@(b4-)=IrbevOnz$=iR%xKPQh;4H^(@~mXgTv<9I
z6EWfe_({Y<1#X>|VfkF9+ICoE2-MNx_LICCW-}~-_)~e6(YIiU*;)}VbLCAexokJr
z6YeoQR@P~5m)2ZDePxSu=(j8o&PweAoc4}T*Aat8K<5iwa~<Ugo65y@<XmIsO7~5$
zXT_S&RW5%%|K1Fb4^`qdsUgm5AEA=SW}gMj6;VJ<%t4k)ceYR$W4OAJyDzgwmkOEI
zzG(>oJ0SfXJ>~eIV8B%+Z7`@oB>`rQX9=i?MpzO%W@`cry$JbCAMYRRJ$(A4|LoxR
zd;3p6A7_&)=c+0ijieutz{>+mKoFl}AIDiAzk`1>*^F6Mt|-dIcZv>BmMY_~Z7m`h
zs}`87b(%%UAhGoO(kN{acDZoPyeSkGXHOFIq*|_gxgqxV74K2LXWKz=xe%rpv6d}l
z<pKp`%WR}sIOWnJ(m3Ot6|}B!kJk)t2D(Dcw=)f%Up?03m_jZ?bOMhN>obRE{-WvZ
z3+#V$;uak-{!Vn-9ja@LX+=oeH_o968mwY`ly_c7MGcZwC&dsl@m8wj*XKS6(52i>
z+m0^MX?~v1Q_UulQ58Y|gHs!6-fUD`WXCEt><Tnys!nowII+Who_Ay-qu`saeY2Nl
z6TrNrc+kxB;w9o{*jI^J*n;1NI+o4g{4RgSxH--j91EGM**~>#qs&ARZN=7`Bp>Hg
zGZyn1x<ayo1{XMYI=9eGUKDKd=TJg!Ybz~IkN=&7*}ETqvP<H4%HRjZ>FILea)w3t
zKshXB%WyF3ZUZPDvEhcrInCbnal3yy2o|Rtk7;2fg<7W=UNa@Z5gi&JYH1f`aPxnW
z^?#<w6{;wx4}-lakOrmjw7hP4Bae9PFX<!C3iq_3lLMNcPL6OGTDY@f=wbC~mypoU
zFnYW$;Wm-t02zdac3``5WXRc_KIVNWfM^IBjEk@}^j5p)YU6>#Y361ES%dK4>G#WQ
zBB?1gTLNUUY%(h#bRrTqy>G2N=;?oTB0UC0?)XN6*BOXqx+s?t3n@`lwc=86kVXBr
zJ6y3UWrPV4%X_nObc!;axS=&Q2a|HpW?L}Ifv~V|Ok+q470!4%Lj-bai%YYow?Dak
zo7Sy~fA}H~fq{{Rr-yB=FjkRQ<}e6c1cxI0AxXDpu2PW_sV)kZ#(p)}Ie~w6$Z{L<
ztyBqt1lbv-R(>87lIHL7As7bR^68IB3E1<oNNDyVC;UMm##d;wz=m+1%}@EjC-yN}
zoQOZQD<90}gM#=g>eqBgfM%(W^?eZwsUa!*EpkH2zlj8K3doNUC>@_c`*_=lZ;2MX
zW)HvYUsfTdvMyF@T24ExWI%sRLz#OHBwvKRqC1tz?^E$FSIYsOpNBPrR5I{FpQ0^|
zvWsoAR+ybDudr<jadNt)P*~m1u)&b<2W?;m6psS2*(3VZ;|WJW+-^@A5jqSKke|FG
zjdEC^SX;^2%QrUO=GsEvx4^XndSB+gRnd-MM<l%?FqJz2M@A1!L#Kao%@?Y!x)F1h
z+8f?NdOi@bGIRl388Pidcc=M?VczZAh>WSkRn6a&!>XErr;fOSnmLUT&~!1=Xj7Ja
zWMkd_Ke#7%ZqpyWJAf=HCb=smP%Xz}ng|WLluSL#RA=B;L1++>lye}g(kvjJPM8PN
zhLPAkY{)7?Z5@(OIWK=o_C3yX-!kJ%U`I+{u@52m6w_t7thk2uTnh{5>}o8^Q6;%m
zj4s45sTNQ$oG;ni6G5WM0@6YOrmmc;hs?R6EvUfv9fJJQVWMa{s>;L+eKc1PT#K^-
zb2{@2R<q<wsHCek%Nry2<mM`{3tVy)q5}X{VZQLm8S+A=Iq-kOoWWEy1jxWCZ*!-9
z_dDp6R_RGyH}bkXj@g=Ir!(crmQlcayv^8UBDZMCVEYEb<ZcHbo)Y0sJ-V$Kj_z4D
zA5%Y?9;V)L2qI~&xkS^<B(TrooM^GmiV-3XdAkJbI3NW;fSv@iSPt`#5oJ+A%cMQ#
zS8_|^P@3nv5FCFi238<(O17O+oT9{Wm}FdNVSRhd19TCK=}@#$8iKl)YqQ$0CN9by
zNMUFIpmmaVHOlp;2J?hquyIqEAQ5pBiT|SEaBjGl6FKgx;`203Q?anOm{zr<x!T$D
zkSP++W6Yr~z<mD8E!gRkFW@=GA$La1FRR|R{v~{8>+XNY+wRc=UZ3^Petg?MOCy|L
z^5~~QvtN{e5L^H3?|!$f<>G6V-^J)i#K^v5TS6IN@*}n1>#ZN+i+F_kX!8(X#3R&a
z8;AHJ9-;N1afmO%5z3=hh}@rzjE*~zLcuK9yg6UI#{ntLu!Pu0GktER@dLkqeF)y{
z!pS`%5to0o?i7qjaw0WTgzIS~V}xyGDi}bQD=Gk;T8xS%s0$1ygckaem7aA%B@U9g
z91~VB!PghE5VYX?`AFG$7`1pB7CY-IFji*p!isNq&cJ`cXZRD+7#}@O0~9DwWPnP5
z4}T%Rh^n76!1}osG!p{Yjt0~MCqD$mvNOZTv6X-0xnhGWM?fw)TMe%NEh`S(%TL)M
z!4QsZhpx4qESA8!WVpYugwMU(Bx+x%-GHrf+<-hN%W)oJh)aoP7Fi)2ME4w&S6lif
zmO^^OdQG2UBxxO$8;pPYB%46AIy#^^Y<3~t`J~S&wG5sTtXmL8z@OSqI!PSHpB$m2
z5hQ<y_iou5*hWZ|{3#^2vOtx(+UT;_GYsvu$}@%f05xsp-Q#X@C$WZ;-_VcM)&88W
zVoJ7^T5y9nzXR-*!;Hg!49d8W1b|G%j2KAP1t$-s^n6MU_MiOmu>a!K!>9X?`d>f!
zQ>t3rfMjaebI|t}PrgY+NKLk09^C!-lWl*Kf|y@6e%Uqs``2F|uq#rG$McEl_jCit
z;7HInSy)mzEbf8I?jp9zi-#VD{1o6v0>8>Z5pRo;BE5GleV<Kja~3pZ!ko$QT)e7m
zab)@3+2_K~=L}1D=i}s*WZFfpB4FdZ7FzR-g<65l<I+Q3M;0iU`I+;ru{p6)yQ_cW
zi9sO>!|9N1nG);n6Q%Uo&P$4bS7F{t$qJSy6k>7eiAtIc6n3jRx)<{96vq@hTOp$k
zNI=WA7I)WmaF$)L0ZE6ahVZxwhSqXNF^trBR4Ud&U(bB(eoHO`v_({_N|_hw<HDEL
zKU>hog#kBZS8ho=S>?~6B*7QKn^u4Rm>$<xZ3ABaZMS8&V4MIe=Wh7mCL+MyT9|90
zzA#w>kE5PR+VM$b)D90NGgB+(_b85ljy_sp2q^J7&lu`9{CcJ6mNUV|*JRQ6=?#<b
zYHunnfR!zRZ5GdoP=vveSe1AlhJu*a2Ecz*Vdb%Vnj0h28`6-p&~9GCFbscQ&K*E0
za6F_Mtt`Mm;svhJf@U6ZMn&9*WGlc))Jwq}GOb9#joNTwA%puN7%ziC@w1Gl=@=k)
z0jeB5uPZBJ8g^$M%5+{#YbQH94qxA`D1$f%g1ifggsltd81x12pT#HPQx4u0Kc?4}
z%V{_b;gg<Vl%A=dyznAb$V7jXnoED>jL1tNN9YNILfIVw$_jc6)8@qTXoEft9FqPJ
zo(V*ca@9a?-3z3m*QLd{&jrAw2u~j`?9zYkwCO*0Va^gu3?~6|QlORj@iL=2%<I^q
z%IAaU!tiTfZb$1dZ&qP7^h45z4#Y;sA#%I{P13Gxs@+D{G1=a8jGTYH+x(22HM=Xy
z7D})#l0Q9v^|Jrs<^H#Ohfg3YkbIJM@V|#ozTAJ7ygWd`ZoZq)UA{y55C8k*+2h9h
zr0vu+IO{%je5;itbe``jCA8_M9UkE|J|V&jb|ieBut!uc8RHJFh79W8!WJUN>h2tU
zhkLppyUCG0Zydw@@!fyXcQiHfwCrEsg1aGPT)WYN>dM98V7r4&4MLz0#{vJ``jKmm
z(X_Prk8E;Ghxg*-bT`>#*=$p;ljO3yvS4zHG-rgc?@#HKJ13iT?dR>5`>GJa=Sg;+
z71js+s7<~$!x{(wX%p^#*<8y7E2_jlWJ2WcaGF=I=tDA5u9tr#B`)XFWW(g34U(O?
z&n;I`EqQV}0C|fH$H=3?AD!+Q^G25lc)8wYMoI^5&E*sXBRc0V9tEE?Wdncre%qHj
zeMW0{L3TcViQnf`D5R3JI<Bd@bEI@KZ{uoj3Or87(|E2bjwEsWL|WGembM{_SMy=2
zDul_tyGd&11I&Ml^Okdbg*4F{mt`;ebo|?Uqu<`8e+GlWz3kq-yTecK-Tvg`-;F;S
zj_>_0Z8L~r;VU^adO|*R9wBss9S-M8Tx|yj&A#F++3an?lJ!CQ)5|Y@e=_)TSUfL&
zfAH#u{X5T!eIoUj9}gexf3p8}_Q!7@(eKm6>_70k`2BzHy7|SO;oWa92B%*v{^NkI
zo&Lw!-~!KlyZF=VNwxo`EdJy4cV~b2YBU?1zFcIl-&IdfUrt77_jK~ZAMbwgcJO+#
z+<!B>J)C|!dHU%0v*DfJoejVI_To=}e0er3_CNWL(=V#w-B%U2{pHKaaQaR0e6kqP
zv(w?}@9uvLzjD9t4etGZKD_tv<WG0M9cQoqfN`7-?*6twyMOv4{eJW0-ZyW)x&8cb
zc>DR|x9I0b7~408!;5czcy<2G;oe8j|9HDQou2G{`G&UtVENU_(;vQl^mu;wAEz&0
zzWUt{e;D<TXLQ#7c5tvf+kZXz`jf*fdv{#EnRb7EyZFP~JNu6>-k$ege>IvueR2GH
z{(SMf<(Dt^UVQQR_CfXZ`>*>iI@vdO{_xwcUv>W2`8L1z{WpK;9L$#=@6Voe9v(lM
z4nCgV?pJqDUw+bgGMIdlzkBhgKfM0^7hgPk{fGYW%_oz`U)&x4>EP2lCueu}^FMrl
zUR8fzz53`+kMAtsyqesepWc~2`r+l*UoOAy6yMH&cRKpw;{4&=uYdP(@o;+b``evA
zKAm1vZ!W(1=+$Dm`11Rw-+%ib$NOJpgVVcTog9Dh?Ag=tSBu&B_}QNp^SAdV_a^Ti
z{i&M&?#=1rkN@M|WcqaY`q|0D$FJW#oJ@c7i~ZTB7mH8tojhH9diL=jzW%oS`iC!$
zU-kFjj{9GH`|kGPqfbYtug;!){p{rX@tg72&-SdK7Yog&nF65mmK`p{pWzI;eBQ^l
zDia&0hSra&KGlrv-nv_`OY~gsdex3&3=kZLXd3pFvM8_c$U*Xli&W#UBXBX4MtpzS
zlG&UA)}#qd>nauo+aCDmzH}wfZ)kNiL<86veIpJLn-O0dN_~W-#b{WJ%r9lgFltNY
zE-D8<(yrBy82U1p3^bl85V)&n<%H3oSeYhEa0;ohcgsF=#Yx(}Y<gV9T+oE@am{iP
zs1y`Va9xv(W2r^L-QgiDIMAXkzA1lR$)Z!QhJG@qMHcPc7yb#6#Vd9q-7|@JNIG~n
zD7C^hiu&ZO))V`HEBRYS8PIi7+}Y7qk>f7y9>ooNfCecHgvW1I80Z$i)4A7yYuuHW
z-<B?SR|=PXsG47ei|sC0i?E@7gs=)pJE`F=x{q!f@P@9!3XVSKBr_cd;68udt34A}
z7vR9W+7lALcDEnb$qJ@T@ya{;yz5lm3LR(42>d)&Ef8`74EoptEm(6aXv0!u%Wqbm
zo+Za7+*MPrm2+U~)Ef4_q621q=+I7lNr&)ht?F>VJFVkMoy~wYcRE~{GfH&^0}oc+
zy7b}-uKk$v#Y5~LKnL7`<$`}JA|iw-eudT(rqy;-!#iveUt5%Ob!x0~Gg_3L9j#8W
z=c+Mt`bpT#*2|y*($0>@V4do-tECC}gI`M61m<9#Y)PfpHm*JeR9e0mcDH@t;`G9m
ze&o>UZjEow%Gq+ldE@oE<VCHtc{do<!(G%Pg!~DxAKu{@z!w~UFn51dc)TA-S4Z?v
zHzEg|7Sy`(sa<Q(eguv6Rdt<b*)+Yh8gCv~yW}AT=~}h22cl9ua`>k_@2ka3;~ERT
zis`n5Qmy#6#E#%&PBqdF2bMaUzT^@`|9ZsHnPGvU9!F$)GUhE5KZOnC%eJmi?UpX6
zgN||an7940DRy$9m+*g-;E2{>zK%H`xLEKXTG0cR6e)6*Gz4!umle8%Kf1^II^OH@
zUwTG%PLs`jSFaS8Hu*O9u(Py}!09Us1(X|D!CBB*vnl1|)4Iqj1xp1@_y5n{-!8Y2
zWoe_>@5WW+Q2n+D4H6(Jsj8Y?(lkY~BzB1shoGvuhf@ZUK$3q%3q)d&fGBoVIo>}$
z5sq+#BaR*6u)~fx;RxS@|DQXV8}Kc7J?mqCBoY**Qup+ncWS1qi2T^OKh|D*eLhPH
z!+BmqbSB7pH7I=u^>e4{JUip5SD3<oOm>DGDn5}To%Y5<w=l)b<6Hs|s^>dn%41Lj
zSE}Iz{bjOt&@+GRMN!&u%psI;{$vHL;hC$ra20&cA?)hp>`bQ!WPW4yIsN53_V1o7
zdrAVbQ~~7Ddy4D5>_yHemn=IbmO@(TPjqm>g%b9V=8z%w#q>H%KEAWz>uI&;&tL3!
zIpB_ja5{#xb?5p_)`QN8Q@|jH=}=@@Zbx$OPoM$^oo0WPxHikd#jT5%TzGkMoM%H$
zDHjViP&#&HSC(tM$}`4)^8O>ISD(J=A~EoA|A*~UP8s~+_rcdrUmrjJ2~YgcIX&J#
zdM(x0u{ZmSIBL~&L;pY)#_M`2mrQx0wMZ7=Z3PBqr@sh<6&Zk^0s~Xb-T}ui+Zmdy
zR}ar-%hi96U0ZpOuc_BYQFo%_O={kH^J`RlH6Ezv<-EfxOdPd`jdKdB)iUEWC8R26
z9Gq8AL<@FM<2Sr<OI2ZAER!%I^W;=cZ;l1BvW|*tX-p#OpdTrp@Vn92J<9KPAdyv$
zu}qU7LX@wMJ}gHn-Gt1GtEW|nj8n(oL3=XULgIh4f>ZTIk_vo1Bb_{}nCx5%_J*Yv
zdu@o7vc-JPlM++2Wt+H-%E=PT^ej!|h!)9~MBCBDB&><WH1+)Gxlz3g-h+*3bfrGN
zBuvqpPA2@mT41d$r<aA_Wc)N7`+zc)gS>Guy-3m&k?F3GL`sjynM%hQ4lzs%UJK3_
za6o^BGmjd|W+eO3e>FtwYkI9W8a|cg<Q%PO!mq-Ur^#Bk`+}EAds_;&QKlWiRqvvw
zAwKk-w6OEAvrDsbOMg?rdrH~&ANRdl>&kDRHIo3=+%Q^F$wpv#WfW`b1a<NtkHh!3
z?ao^9dTZiPl9gpK7{!(UFg!u0()dAoXnKD+1ODIWJisItP<NtS=>q7LZuDs6J$zB9
zRqla21NhEw=?e#YqB5d8jfP-NaUB4dqZb@X!oUX3>UFn{hsceYH;SRx%*~66(MD=0
zek0XJp;)w5e4ZO0-qt=;ZWVy5%M$2S0bL?|dpr*ID*b?rd6wJ0)F|;QWK|4Znk0V=
za938E>rPYCU|LpW&wI(vUog{q`McLsWf5JeA&?x+Mw7v43Ih?2OD4?25ey;4`5a=>
zETfh4dh0|Oe;BZ*sAkDJ+q@7uGC|LmzmT%gjZ;JBH(EFLCTvgOghaTJE;}&HW;;-2
z`x$Qb1GL0dEX&hM@EN2<)42gd(nx>OHROkkL$MSDF9Z*?;nN9cu;rLXI2TG^I?2WC
zA~RcC)QMR^yOd-4y$hM+iyWVK%&RzGF)Ge|Vnh)(0|sY3e~E-PWlAQm?flD|<Ne;=
z{&%mBx`Oer{`EAQU&16r{p#_2y3%A%o4+6C@7jEk1-h@p(LC*-G!62)o_2p=e(8Me
zzyH+v&CKK?=1o4rFDjDCNg)x^EEJ!Os>aHezUzzdS|AB*C738q&I+(<J*>v$Mr^!+
zh4d<OV4lxeR3#}|6Nfg1<2$89uGb3EY7;9vYOrm(bD^pr@#c1=1WD3BiVLJMwe%|E
zI5oR2TP#y^$A|h`O*h<2<LrN|?9?{VY)6WFzb&tKT;21&ODDgn5tO1cGK|Gy&~R2r
z`oQW;r?a$}NFf=SY!QsML!impO3bB{jb(GT2Su_<o4T%&suaWTE>{AFu!!6pBvB6q
z!LL-&j?)y{+F>aB=q)4gez>1n>eHYAxQeNlu5H7+zAwQx=UN#T)W?6dyXjCCxstVm
z?+*`NzU+Pf`uN-K(a!F^2bQ#!Ei8$bCT?9v<f}%s?5MWlBN~IUTx{4?pW!@<Vo~}-
ziV>Dv;a?V^;gQ7=WwODCdp&a4;Y%NPE+uV+V>zqud)(pkczzvEr;+-QVFxJ3b?*zA
zDB95Dpkx4ts0oG|hdO_92DJO0*5Tex?rVqd*U}5J2c^DANI39|MFK({k?|~^t3m(N
zQ|~u-Ee7bEI=mYt%lbNq7qc>X4>@?w%(th)Ub8AcgLkbRaFcw}$(_j|m5|ckKWuMq
zbi#tV9kyq{4FY;hJ*y~FJF(c9;8>(}+FfB3w#v)CRWp-FZ+(B8cqt3sxHpw@05$J0
z%C^-kO7Y&5joS1B`cw)n2xu?OAf8Hf*%>mF*sN<0Np%$CpQkK@sfDF3_WM!qIzPKC
zinrA`@|0g{hE_ml)nE&GDF!FV9=EQMj<RDWEuNWp2K+tte3c#XTPf@;JihVs_uORJ
zBh}e%T5${6v4VdO<<5&G)2CNbp?Ha0h{1lRn|uw|^?+StT#&_tqjD^4%*1V2_av3S
z7%}{%a5u|Bl~)R2=CI=nE(3fg0>fXf0P))%R-`9Zuwb1?0A$+ro<qY-cM)z9J0xWu
z=EW3SFPf89vZeSa9#YGk<!5Xcup>WWw@Jiq*@CphVwZn|RDEHUG~}h*cVwWFGhn1f
z)E|4_B~1#Pt04h$Yp;RI9qx|Udnd>6S_6>M2_Ks*B6!xyzra$p=3ED!oqX~RH%@kr
zpYNaao*nPJ+I_Jt7Wf8-NFuatadw4#TsSIhV@hj)2qHGSoh;5svs$DA1i`lg$=bfG
z=QlBV*usDGV#E`+C62ctfnxJ~8uS`56Whi|JFF)bi}~;0J#tUTJSn#bCrY2-{%$8f
zxt~eGMQai+Veso8e@t|*&+_vguk_D9C;u8e{hQzD3$vUd((mxfPe17^%IVT){1#1n
zJDPL6m%g}5i)l)l8=cf^!L!VZ+X(gVsr;wO-1L9)TIFp<$y+0d$jTv|-Iy@0yWxJ&
zvfCLy|9pSVwWCyH|2#i9dGY3%?7?jwgL1NVc!!!`&7?xsY-GLSjDw=a6k`N!9qA#}
z8fy55sC*4=N|*0h-2e5mrDs$+JQkB$7iSvuY?!mmTD_TWSt5t1_pTTXLyun^E5eD_
zfKGohfk-<B1yDPEPd8_{FCAOiUd<`oV~$yE>*__iNGerC+@_{m^4%cwW!v>S-rj4`
z{$8uwp1S#TTRP%cwQC<XR%~pxfTVyi^IJP%l{%z2+)p)dVmsN|u-5J+-+LQU9$1~O
zoT-a`TO5^u0<gM%`u*V#8j^475B-<5tuTK~!FvXWMf+dfN7>$=&F>rVil$7^!NNdD
zQ+HliSrfYMbOa_G!|RVKzi_g*05PP+Ij^SsBxlWp(m2=6%hi^raZ8hgv1bv<HW2Xk
zX5E6>JSo#~^Nd(+p3GkL&JrWteSLU%aMC;6?{;^d??1USa|)WEF`S+fTZ@}oOP+uH
z@00)CztZ~r>kr8fKQPGOBzTMHm&6k|&B7tb(yE#5J{A|4q;E&lDJKrFUnk%;waehj
z)iCH|n2xR~<@2?ge&8cd@Gp|Go+iIm2Kf5T$<dpW;PLa3C)suGk3?-O*kCc^z-<jE
zW2?(}G*H+FPDqzfxWOEe8cHtJm1Tdvs`vbgo^Q*>ZAa_c7O0Q1jgBY(@PxE5`s4oU
z<(^Ehg!rht>4oDODamlZ-)w*J)mD2Wc)C)>i4LI~BJVWCM^Z1T=>@CLpg(;no-_#L
zvO~1O`S=(WVLv*D0wGZzfqa%ClsRq)5}O`Vwda(WI%*H9SpNFx<Elm|yAyx&|KB)6
zw|?v^ykDh)wU%<nGZEMFviV997P*Vv;!l44qwdq={crA(;8k|OuFB5O!SjyBp8R@U
zw)(GwCf1Ul64=u3mp|D`+8^mp_x;VzPw7t=_nVC>+i)Fz@@w~@Iu7z*=iGmtbN_YD
z{f~9d$w0i>*#_aC`i!R@d^3Nq*@OZX06a6MBswSn8BqG-+W@yK4H(f3!51~}v?P%t
zD>alAVOP7v?$7esg(y`F6Kr-GiO4TUG?zfm@tztscCkB(v#%A$%9k2qEMCNEvm#f{
zXA6Co^SXFQZWutayfFunec1w!EUns%M8t6vMszsM7&_cJoEVT^VDNvw;ozB4X7GsA
zIt`~OVXXopm%vC#mC@2no*pa(h*EgV`Iy1z3Wt|ut+}uut+ZJefi&X03n`MqfD-bi
zSfcw6)VcbA{-Axs(4sS|iiEqa2V51yo{-l?NoK7zfNGRj;xQ0_*ZUns4(AVqZ3!xJ
zP$dj6z?|n1+ytD#9&~@n%<EDD1?5Wn=OiNao0Vy3OROlgbLXQ}B<KVFUM_t`xYN;W
zbOk5ilyM}KKCY!Er)*v}&9&@P+{*s@YAg0OvIX^~U|)^&gMu<B^nlFXkRHr>Id{t=
zi+{=}T|cbf!>?3dXnNCwwav_Nkk16E0gY2*#TgvJX6qF4@S%Sxas242IWLzdRQso;
z>K;6h3}pZyr^$f_22=VL^lgwhKk&T?1MDmxiL)1v>=5nq6FY(XzWUHNvi|&>{GG_Y
zrsd@aj*V&ZBlgS3aq>fE_x3#!uIbBqN@%B1in33BS|b%{PDjz*;ANQ;tp~&}*{`7h
zhF1pVddV5tB=3LY;+xXO`GzySD(^h!EL*<Me=a>>#gO=seXi8(3LUM#I5{~==rsmC
z`#wMGYPpyr;?w}GY9-%h=WnxC@@nU#+e*6sO#gbmdqhX;S*Hsp*5N;&oX9@-ekovD
zIyElNs*&YB+E8}TWH7st*?gPdRF)!-Zu0Yii_Sr;kMe(2MZ+HluDkH@z=J1C!!;;E
z(00w9*i|P?%hwHKc%-3K_PVa^j-TZqc?zEEGlrf#=bFFb4v}M`>NXFen1gh>dS87U
z#)x)JkK_-XR&>!1J2e$;0^EfQKZRa?<{Z{{MOzHB^Lzk-Dq)V*Xni;3uL#u?h3IP(
zMV!o2dH#QC=WEuEAjN5M4_8Fa=gEaE43Ec{DGkNm6S)dW$m4O&Rp;pRoAO$?Pz%Mm
z<cu&xcj!Y{ItCEYa$%OsTvhB_f<(=ou|m0i1ti6az0FRo;m8<+(dCf`ZEAH}t7MI5
z-W+hj*-=(?fj0i3>aLbhN>$N(HdbY!5ez7~S37@0E6Z7+@WhR*X(%svb`R_JEe}Rc
zz<JS5{s7_aqR=FlIC`p;FidsQm&A#hX8Q(;F)psX3qKOyGG9Ddp|Lmw(uaIVgh;@9
zd^D2(Vl)Q#q3i6%6lGshO~eECYx*@8361Mx;cTuR(L9V(aCEwZ|M)xlhsa_kDvReq
zpkseE<ccv;V8rp|Dy%PoZ?{}br2vctJlkkpco);1t3K<eWu2xpuZi($8dBoYG--u)
zo8j0(fN%<5Pm=3!uK2Q5u^0(2<k%M!UuCJDDZy=V-&-`VH7?H-@DApUf+i44rT|+=
zeqrAcWOqU7;=Gjl@nlXY<g5#U_M|>T-;jTD1(58(g#=g1U`D0ORktsDizcF2RPqwF
zQDn`HQ0PH1pdUOqB5j=;wKx*j8orD{0KYqE?Nr5%P96xLMp8>eXacNP$V`HshX{Y+
zq_ny4uFD;B(zBFFUY<uOnLE$3E8QLPannQ~MbkYLbWxNLE;!DRYq+so46zzGY0Q6B
z0uQI7X^y&WrIi)&S(BCmLcEJJ%7fs<y8Tk36SS88J*9;c4si%_y0($z3o;8M@gyLY
zLxVlCx?;LBRIY7ARu1wR)J&+xvzrtU%2FI!)QoFO<q=U^t2T(K#(xs+bo0ruKI^0s
z$LR_`@E(mD0dDpZlZdlk!%zloC`x}2K>-jh((95gDycMPe-Sa-rR`Kl!|4r(maTMw
z7v6CeFXCg#gKyT$N-k8_2dN@Qb*%OAK2y>PS1fQ~zbtSl{UGdx%b3qcXQT0GZeyJr
z+LckIhMv$lFLh7k70W^TaMG(NGjX=~I3LDKfsb?6SUfij`HkFW?gnRPGTwg}P~~}~
zjHRB|mqUlOaE4GOG`{CSL^=L92cl}h2w~x2qoq88%pn8z_EHl=$p_Xh)wMMbT7dyv
zFG7m!Y8lx|LKn;HP7HUVUqzp&)Zh;0I`Evhhf;n>HHdKd>aE}qac{f>hw!GpXj0_J
zqWQos9vZ>~n?AXI`%+#Lt0sSeWa(Gahp>+&(={;zg-1bycBzt+#V}aD`S`}mdwKnf
z)96%d84WlbyQ;!xQjU~_D75&qiQ%w$pb~BfbHUs|a^5QJ;0*cmDyB)DYylNzC1+f1
zo7eAAkFWQF>ye)0MvEMt*c8|Dwz!d0f(@}i1q?)l?x2Fb?=5oy-f@2@*GaS>(Q+*>
z)Z8JReZ5~vRPQI9q+hWo_Zb<TTl}ueCR739FBwlm)#CBU&qQal_pZdoPTh0iq@XO<
z&IKp!V*5+nN-=gS_SL8ybbi~@C`Q++Ku%{-|INa?JI+8$=vyn<UChd2##%IH^>Ftn
z4Va$fd$etoux9iFuseTbnCv{?e|6HOFNl^<zLjwPvH6THMuIMj%-f6Hs_XG7`JR{Q
z#@TiyyVe$hlup!1ST3hP<h!d!Wsm`+N%YbZ^G?o+(TWeN<ZZ2(Epm+UB9gGig#$$x
z7sa&gaCsa!ihCN-Y#|y-$lc8NelhZ#4%;j@0AFX{4pO9?ThD*7k~y#?1nXC#)#IK>
zk##-y3~%+FrFG94`hiwr%)*t0c^hbn5AaoVA1x-06M@}$zDjywqBKp%%RHM+0{D-`
zH15>4hckLHBIQ|uQTXirXk4R9YM~dmP}8hX2>k{d^tvbD8(}R1566JveJzvArMF3<
z$>`!-q5roz20eewTSAG8oJ)-{6H>!m_n%+3H8nm$7uM4p+#f>ezyJ6Ds}Q>iKw6W!
zWwqOR2THjgD@uXl+yjm`FC$2itI>sJfzPy4)b&Yu&I<!eLO5JZ21MVmpf(+dBh>O_
zZE2Q^oI{I^xKFho%YYs{;Er>oJ5vox)MAit4qAS2P9%TvZ%8=_u2@u7pY#)F%|qrX
z1?QHBvksH&zb*0w)Y8g1;7;*YREB<mGeZE18{LuArdwW<OVW4XgOc-!Kh~-t1(LuP
z1F<%6%?NB_-)n3!yo16O4(>-1Hc%u*KHITRa`kdn!dM~ZOk}SA<Ciyiu_N#;%RSLD
zBd%Vee`$YPtJb1=y0e$b$C>RB)s_q>dpY9VLq;7XaR57NhJf-Ldm23?emWdW*)g?g
z`9i9``D<Ha$t=R~*bK&nF0}%?6cCox<JGlr0IA`30V@s)nzh8;S6bm3cIk0o0QB&O
zZLznbl%0Z01Pf3~#w2jEfG_l7C%y@0r0yYsV0wSWC&|%spEWSRWjSEd=|y`~beb)=
zi(t>>ttj#~<2M=H52}!AU$6}D(*g(TRUu*-5mdOt0+H9(Ui42)ToEACeJhI?6RxSg
z61M70W7ZELtV0IU3h2r+Lr|CfvLc4C%NS-*z-u%UHo!-+j900WtmZEN1|)8-L+h18
z89{%`y6@|1o3Sk1O)hDk3C^3jYQB(#FDjKM>m{n>usK^V32xX@f0o#@8h8QBXV7-Z
zx<hqwMPj7Od(T+36Nm`)-%S@lK+tT-Z)|><kcX@rf3I=Hu9aYQOoCoa92?nolU!UC
zn*O#tVw5#4T#JTRUNdhtr5swc&Yc&-V)K92xzYAnoYzT!Js=!{5Z%KnpcTq(T>;a2
zb`@H2m=D;*OKb@ufoPjDn;6<Lp<TIl{jxJhwi!O`Prp{>?2{8zfU&q31m`|+iJ>^V
zgY{|FwiFMYjlOI<30zKQ`PIROC>R1CtgHS#nEoZhua@G1OwY%VBY049n*OsNB>;c#
zU@yJN=OzO*D~f-x;F+nQs7WwlfJT}$5?XCCZ(V#b^n~4ExV_OZ_0^uPs|0!txfKk$
zX=(R!tACdBOx?t#q)O&1IakI*F7YrWImPR8C>Xk!NC6jdy&D^9M^0HcJ0TrmuJwLW
zaFTkkd8t{c`59<@^<+vaROoy))yaRnf{~7AxoPTQRiCTjx`kZ}MGW5^k_Bl~yCh1D
zX~M~I6J|NlPL|Wo`8g$;B+kGjB_Go3JRRp*IZyeU7mJLm2B@|59%o_GDVFhnl69_y
z5sHr5v8J~sU_mNXhD%pQBYd?S;ZVvZIaifyv4pmYJ=Sq_(MT>>Vx|Mt%6@;-SOPjw
zA@B|q&GT#^J#P7Ji%0;a7b3L$Ho}OCi6KO|?Hpk>DkPmy<nz2B4l}(R!9<U(ezp*s
z9e0x(RT<tdA@oH_nPnbjb|z8(PEGXT_<(xf_-}jiP){BTNs^Dw>_Y4Jv7Ly|<Cb?p
zxlv7|ux!DT%cB1WPC+Mph0}i-JGOzw%B)X>jJ<#%f|EM?K4@{b$|Pg01NXRl0kN3*
zx4*Y@vH(Lsyub5or@Jr7&UK|;#0_F}BLO!KUd`dDN!i&~T@Iuh24uFaM_T1eh-*#g
zdC418IDhJ<ARE#46#3stPbyhv%hI7Qtb;}@G&9&F&9()X_+VeKEb0flmV%sr_evib
z6<6M>uBX#9guSX!*40mDi9uP#vM3>DdY|}ME}6Wc64bv(WIkS)uKzKTcC!BM;w+y{
z=tL>i$^)bFsmkB}-Kkt?W5?5IIMr7gAdz2sXQb-Z2QBS<-%XD9x+)Ow{7ceFb{4Z@
zmeIZET*p2UXjY7fl&{oKON_REVZ;mu&7Xpj<|c}r(Lqrao+eWRf;XK_k4v(~YQb54
zgHlf5l|$4T3=9ggTrWw-nUoB$!^}GXI5{2rd&W_GYI<k0Hzh@{>?tO0RE50^M2(1f
zfXK8|%v=G>vLvwVv$BX$j2B?w4B&iiM~IzWwR}6YUZ@vJn2DzY^KQC-*wyHe0y2_+
zl$RqSw{4#ZaxcDPy_J_tW#Hmq*3rG)Mm8ONXL$`%4Y>NZaeFWkihZ})cuQT`rlz^E
z#ud#g#)s?(iEwsN$HTJ*<_vdSgxhxV5Sb;eVM(e$3=1{HDwo72qhhz0GwHRpt&I%?
zcApi+9QLWHJPAAO@XX$SvIVT<kt9+oC%DS7!+}}sMLxdb*wMM2Xif{Nkp{HfQ2i3O
z#3OHp2QbwQjXm}Jx{!*|A`1>w|6L_d1gfp!p56;$Aog~*EhwH>cEf*rop;pPO|x-{
z0a|Fd&-K(l92^WM-=+XkNW2kJKmTSnezImO2TP?sunp`lBK+Zh@3q6U@Y|0cJ=}6n
ztkpFuyQpn_eX>#akTCS%A(%V&;$vu=B;yQK2B(d;v@-_tv0ey$YYy&4_HLTGCb#bJ
zmWnOGTaO%Sk%uFMJ8x8qNC!~?Q3Q>K1ML%J?M(+i9kL=lI?GBRht$1CLAY5lm#v^N
za4x`&O@&nl(R5mW8h*TU^bu!%x9p5%i`qp6tQ7&7a%Wzk0<GhVV;D=U6tfHS6;-`!
zz}HgGZUwBCpig;<-V)HcCEt+*7YMvHhR8;!m5wlr6R;3FeY5nwV(z{G)3E-R&|~5$
z3{0o8D;Wlg73!c6!2#n~etdcGk-bM`>osaIo-vL6CUK8{1pEkgoXG`B$&bXu&HzVh
z3Dq*!<_%gd6{_{WhS3K{=ZwL??kHC^Ykisx-XhZkh0$AfgtOnHJ%2w}buaLz3@%Y4
zQ9#&Y;G=Bj{6zC&n!?3mrGQIEi{p3pOc<3a(ySL?LfeC|EH!h)CKib*SJ_(~YfGPQ
ztK})Pa`Hic@dg*qh}nf5-?bk&_Mj5I<tPiYfd^Hw+4QK}O6s%wuV@uzwf_f!q2WvH
zdBEr6`Jj`3Qn-dkK@qc-6_vzl1`jOC(5QO9^m+{!m5hUc-9XM!jdd#FKW>wPn8bu2
zq7PT=5ITw5Nu|m=D}r-m@+~G<iOr3TD^>vje?<R(Y5NLCUNB?VcD2G$(0%T9c?*)8
zMCi%rl(pahM$A<AVI^S5X|D?7$}g$yw`$T4^<?E%ktvL0`{D>sa11SQq+Q@h;9>2C
zSIP-c;6bj6Npt;~gUC4=_XCUvn4G?=J^u)!bFO{h?X{+bP{<}hAcpOM$$37TSxk+w
zg7vO{O8HIJ;^TUBW|R3C-WId8kL6W&<xt!z$*7kGspi1BNWHjNuw^SO%bct(LV&o*
z&%V;!oexr<aYHf3JX^5ibT21fqgEk1|Ik`c-!Cc~67hgc5jQz_%AG4NipoeKm}S|x
zcIDc4=M)Yz116>oI4&+mA~ikk>8+mJ>hZ0AC}IYN>!8Cn4h+$X-4kE>Z*l0GFpgIw
zAJ75lh)qsGmr;hm6%OPz#8EAV2pZ!6$&tlKa)1YBj=ri@49iBRLu_$6nlQ{D54wSC
z%DRJ#5GW<OoHXtm>Wa28<-Z&9SW>Vofn!-D&<77*k!ZNh<R))<F)2_QgOjqXIiJse
z?{faOA3QKQ2-o2|u)2v{e0$>L)-#-$TCbb^N|T%cYqWT#v!=72B~^$l8qPk<G__DT
zaP}_bX9!uk%W=*=4te}j&-BxpL%n`;K77>EXNh9M@<RMh>hCo_UMM(S;tgN)bjf1k
zFMNf2KRB)!NLzn=^B0YD(RW)B=QEanlsR#Ns8#X4`e6z&@sHncwl^Pr*?uUoU8Aa$
zg0qpo$`!+w1(irZQDgAOn}Po>B$^$^V_*PvB&bxW%j~A1Dkm;UeB2<%Mx1&Dw0>qb
zdc#?EKIek*@@$0rD1ll^-k`W86ZX}VNzd`<k=xTD%Qio?-8JlGmg8pmSVGc&ybM9Q
z?W5>$>WwBnU&S@t8N$m`;pHjw@)XOITC=G(o8ojxiBo7Xt+NGUGfHLmGLoPQ1R}eF
zkq;4U!6hC8z9LJDM{iuh=)_q7PmdRqRflkoItz)iHzg9|**{;*83TDSiRg0*g-X2u
zFArGw{iHBZ%~;U&kW2&@R4*HUJWI^}CV}9Y2Dlglz;F8{XSMMOi4!!-zJzqE7Vbd!
zt?e)ded#83l~ZzP^7g{5#0U7&pznnglJe@)GimTl)9`l#wHwRh4|h_+bD(eFyclY2
zL(DlB8jJc6z4kFQ+Fbg)oUI@AX?aCH`*`WIa;)F>$>)XW6wiy+l0X`NNK)?5$W+*L
zkj4OY4|elqu5~O#b|Kcy{P0`@UIV+6KsYoSbOwkFa#5K4vEKOA+N>PF7W{7uk~{=#
zLkMT>!*J6Vg`Om9jixV}gl&jJXIPoR=Y=cDRj^r}SV0zHVKY3S!4B|HU581?I;yrg
zMM9I66}u?fSH;jNj~wHFqoD|#L5u5aosJqs*0vk&?<Aao<lScbaeLDl1Vf?$;%@gc
zA8T<w|GVWy;u+^#g1fp11TWh_8RCfgf^Agd_pQ`NV+jo_elBs9R!jZ7Sa{CHho&rP
zTjff0rsU2^m(xT3NRqz7X?1ubKjT#rJA|A9!Fh(C(nSgU5IggKSy)l6pB`(JiTW4%
z-t7M={Yt9sC7bPy_J)TAInv4&VeK(-ZefAXGdN(+X#+GFR$gM|GDGc;9}!!CmCEp|
z7^NHpS)r%W$gmhJKvS6*I?QA^M!<0U$|@!(RxcfK9fr>*W&B-15|8UbXTCu4TQ)8`
z+J)55Q92%-&BUR9iedPKxUd*WFa?zYkRlgJcX!;FxpFhnPHpulcUB&lWw-RzXo%H)
z<*Fz5Tn#CI_|NhSHpXyy2F|kZww<M7s*Hj}WbLX5h1*~>SvAIW^c_2Z9$~s~`q&7g
zO?JJQ2sF#R3-4UB;a!5Q6ncp=GetNK=-@eaAdrto(Oyu0A0ltWCHDSmAxz=))xso>
z3z@H;hC`94r@CB^0i*ab2@P-og;)ISP8LlMz99^|oDYda;vFVu8H9eiTgSMLwQI*8
z)iXNfX0V3T_N`fCIEXo!R|T;weI@MmrUJky@5OICAC{0*14QZ1LT+OBc;}VmK#DQZ
zOG3)?AEv{9>?S!mc^OU5tYM#~9Xo5fU$BvnNAuiY8BWJH^gx4idcRJcI=tRYP_zD?
zB-*eA0Ynzmh_8xDH7Q7}=NjrQ7pSB2xuWI1IY`#sEbL6DAC&){_=l=ipGz#=Zlo2-
zG+FP<{T?!Y+tVAAObM^d%j%VjqHob<TAf-;k4ch$%rK9S`4)dOmVV=pa#C7dWA3Gz
z2HniXZQ*ilTM<b|?FEoD7tCfM!8}xJC1kE}7SC>6f_$Yi8dEA{6VBLQ%Dbw`4#i2p
z1#>yyCh$j;3XzV#a(zG$^?2b-sR9;|SlyN2&S!Z(_60xKs-ohjqFPDOYM9ha8HWcE
zvJ0nwBB-Ep9)u}bm9xP-g1-o3o#aF|OS_K4jIC{W;$Wvl=_EJvF*z_i1Zq0?q0l@d
zzQ2`>M_N6-TwDo$!nu`5<qt{0J+#fv7%mOvW0I<?9(X5Pmh^_|Op;fmP4~ei`f5Y2
z>{IGfCmtx=l2=)b_yuGEQP|o5R2&u>ccbBd>2yJs)P||310grS3s<>f9Qt{&3b<B^
z+-r%{)b~|r=zyq<KY^ZW*;A-x8YMWR*Gh%cD88M%phK2JCZr?}omuA#Mg|n&z%hIu
zOmm0)McYrSzpnwV*)UOIAxz}+h3s|ATt;9<+ZA;-ZbC{~R?q#K4`>G<*cIWH>|U^c
zZgJ_M(PXRzuY%@6f-w>qO{QbO%OuYr1f^M7iY&zmQW6AiEfi{wm9g+1F#4B*>Yn&5
z*7|MEtSq!Jh8<B`BG*zV-<Fl|at*UohjqmY(^BO?Qx87BM`WEiju$T3Vp%nYnZKvv
zuee`2_i>`;=5P}MC5ByjE+^gb*-X5Df!OmwAc^HxzC36N?q4_&p_->PcDVKMi%bU)
zU5O&q)5yn%vBQ>E>oZ1)fss=MWK+|YJ!BFV>62UVB6Zx#tJE4CxN<H@!E>?y=_{Nx
zwe*Sww7xlLH(tu#UzSe*5yfI3^PaV98s!?t>n?Lz^`cm_dd?;<%&sAf(%9{PYOccQ
zi7Pf$v|+(cVDOQiga)6o>LFuwN&GJ;7Zm1%YDQT!6n7|2R5Ea0#BD_mi4Cm01I-1*
z`^8+OOuDhqpw8s(r@Pa_&uKQBmL9fX8Y`lrKg;AdiCSk@xJif!+p}yu)u-dHx^SDS
zYWeYjH&q=JZnK(ZmoAB7BEY<VT4IVzFqI4B@X+U08HhK(=*^0;jxMMt5?a1p8_m^~
z`uzSB2r$SV>h<=0gr87LBv~Ls7Q%a%kncURpk_8Ahg@-Gf+sa-YE*hQxI8P7$s9}1
z88ZN8_K~>CX+EO-TxXUep(8JwG8rB@*=1{R2!rd7`$XHXusN4FT%r1Z<eEW>Vd1La
z7S*df2he*z`(ooTmqMMYJh%u4-u=_XY+6VzhL3SrRmjoM3r-PeD!G0kL?fc`B>f^^
zu@zm_M(IAk6?PnDIP8&>?}~fIR*lxwVLQA+&^|Igq<SOipel8q`q)Em;*<K)bONR$
z&80Qtlrc%Qt=|a&Se%%Du|{*>916Q(FZ$;(GQPdE378bC-<OiMxaLI?A;s#GN{R|T
ziK<e>fAkjvYAQ-G{#sRsN%PLk#9J-n3Yjl1ou{fCJt);;8M+{RXx&Z4^%7VnSn@Z{
zM&`D^X$uO$pk>a)Tj;3tf<Y-^QPs+`?3%Jz;kJ(0FaUB^NN}xx1xE@Dpr5?)#D2;Y
z+I4%7=&@LNIDOo1_92BBImwE6*Dzw>Z=3)JO=*YS*Y#ihN`2enOBDRE;EUFTgleSR
z!6saOYhC$H{EapG%@PX4T+T==1?bp{7#Dn)U0fi0$eHu!Ag;xfloys_Z7DNOz(*W2
z-g4_Lc29}6#Wz!bM^-ZD9GvGTs>Knv!`!lPiewEdyyi=b&*+{DxZ;m{uXHpz^)SYB
z!o3qQGk*Hhm$`1zQ~H3zG)d(HO^sLKq!M`VUGNM>!TD2CCy!x*XPo!Pr8UnuF2fqT
zhVtOv;IXq@uY|=rr&Zx@;TbR5x(0)TCJZE*cN?(t%VfBJkUS-5lKQ3ccXA>z&K-at
z#`#4y@DwFUnnE0xT5}Mg?f6QY1k2BSI%bm2KbnMGIC5oO<yU9Q7TNUAh;|5v71fG^
zfH28^h^8$mCmqd{4Xx8xpmdp>9|C5y5{|6!y3U(}=I^4nIb}!+x8|(f4kf{QB1w~t
z9SiwmiCYzaF>p!Y>T<ku{9m{Gy7QW-2GE?WQsH0CP`6u@mf2?_*S?Sg-b&VOQ*y$D
zu~qOqzAaWJ@C!K2TFJKva##mv6%^TD!d#^V=C7x(IkCO?^!5sEpsCU>4b?7LsI1%D
z8naeL4<Sz>I`2K@c&cfN#qt>3Y@Njwbl%hP=OE*MW+-UD>?q6@g7W?2d?2X*nwyN>
zcc1MsjI|F%Q7DAOLD_K{!h~%PyrN8iWUc0%s`g`Cez-xh-VF=<oCFIwa^b`YE+Q}C
z01zink0jVS2)nLklyC&UAh}=^s0cLXn6-d02{}1x!fYBPG?7MdJ~oIB-aLGmNL-fA
zp{`|rt-vM=h$s*~G+62i#Uw~v0_eu2IZKhY!Y5SH+ARP)@eil?Z|J0yWp+{>zaBj!
z@83(FA!}qY8;eBiie#$kL_LFN`jE+N9>t?^a2{9JR0Aw_tXjWe5h-EF7F$`$)+BFz
zrI*xBr^)tw!EAG*iMGPU$Va}e^C@!{CVAq2GZBYzKB`Qu^)48ba~A>Bm(LWX@193r
zccW}Htbnw`S#&mfH_k9t%mE03+EIqmw;3e(nUwOfdjvn>*#c?*3R5is`kV@-a5rX_
z%de*Mo7RdJ&p8Ak@Z=hzBL_7W*Kq3a0o_m5IX(}SKr9X#Hl8M1f97(&INSHxthg?J
z1uICb@7NZ;2i8NE1zK&HeT5{TaSr`?2xco~&6iu!Qso8Pf;k>B3#?J);%r!OqZYDR
zvU#LzYr{~#`x-L$E*merK~bX`^7GMq7tQXLtA0|~D+?4XPLt2SwFsZ~-DrNZ1}Sh}
zOa!-v!Tm4uY^?O@KQk40=-hzlnGZ34CYPHDuH~Vq=@PK7;L_MR@(^#7F?+EA#H)17
zCubt_)M)G#R=`u48;c$acOeD<IqnS?V+ki?v&RqgYJoF|og*5YYl%pt#Ni*=&N>@<
z(+JF0oDhCKruAhL2^$R&L_DM;hW?kzJM#C{d;QsIHrs|vBz1L5VAqaEsIx?W<2ZcQ
zXdGtmM^}q0xkGG8Dk>;KyFAp^yl)&p+TNbZjxb=OhFYU?A(7fvu7t)ZtoZdO=hj9K
zH>0?Zxq#55(}K9>O|#`wk4;6F_zMB)y3EH@(M9M9Vl;C;<XW_q7C=#=16S%pup>lT
z@d)ZAqvXu<s?`ek2B&Js3<t%3B|kXm&4$AnhMnK`<l&w^%(0F#Sv18_6IymaU=K>a
z1lbi1U_Kk*7g)cdquk(iwX^D1Mn&(ik-OIn*T{0Iccadhv;4e}vT9<}8jQ{$X$Zug
zL#ROwv%kjVV}`y(8Z=iFVaJ0+&WP4T+yfS77LVvXPMH2f<w?PC@bEl;G(-K){A%iL
zhhIyC_|wkU^p)Od__SY#7Qh}*f59<74jE@L=XBp^rR^_erFmufA{QC#?8XNPa=I(y
z)MR6?yPoRHe2fHbVcySf#0V(z(Sj4i^}_E%d$vZU<>o~&B|Wy2(v9Wbi*24e@<!jP
zeePr667H4x_&miy)=U_GeS&yBpKWgy$<aLRE<bL9y*?|3UaQpV3%=-|0A?!Y^{eXh
zeG*)(5vPAMYCM+)C<~vn5r%><xYC@8T7me>hxdqsESAk$+<S+hA_o@7we*j3<N(qr
zQ7Rot$@n?15Y>7Hmk#Km^g#|8j@uER(9W;gWV}IA3`NdXf~>lKCFv8?XNI9ifKuG}
zENT$1^Jf64(&wV<!m|K?LWg5E))MbkM;{bZF^BT>@5V2E6lwS*5p5)uMw)>KL+ysn
zt{sk{ZBQ4>Llb@JBPNUH*B+eTO!XmI2N31M$D%ArRDL#^r57-k4Qs}`)hi}vMaC}r
zV6gt3G>BFqChm=YCmunF`2IP>kdRnfB2aR4iO?PNzmnlpm3TuSuR%72A?Pe04m}++
z&Gox^h9dOulTLD@L2|oq+yx@F{r7`B9|lf#YK)rT>EKMLkd8S-JcH=OIT8X{A^jQ7
zVBBL_S_DvPM=f%GI>O+c@-xh5Y+wUlU*ZsKh~<HyqNj*|U137F3W#hL;wXKsknY%L
zRysDtB14s9iBja`_zb@P=swmXM}<CW+8lCX_7u(cbcr*C$HDDPD&h5&yEuC_5Jvoy
zPHzslD{Z3aN)UbRST)|hZv(wA8w-b;Jj&TmyOJT4yqS#VUfHxx(i|MgbnT4U@+Igc
z-crTYN3tk?tSe-dzE56<Q3b)DpMMo@q>j}HYr_vg9dBajrgfZ%Nz$g0?mF_gLc*we
zP1R(8r4%QhgHl6E$nBDaiSa5KLyZ{~CK-|p`GQV<HG+tYgt_6($q@?cxxy?d_Svbo
zWUjDhJ?ilz@b`z}V{-`rY5j`CTQw~4Kv2hZF+s|I?D9C8e+>!pGfnOhEx-3`IVHr`
zh@gYO%oxHjDvQCgy&*q&8x^z{3+RAduVVWV!~SWtH4<n7J%}%nV1v@C$Z6XNJaEpo
zq7E{Uf!NuI&CTY_-m*zp+kjPjnb7`5pM(5Lp&G#?CQ3k1jcC?cP~5BSi@b&C+M#*J
zB{sx=<J09)hp(H`5X6&B41egpenoqWOGx&8+}3E=57yjhu<vH5Co|N;^z>ZoeH*ZT
zz2&@I^>6muz~b{s5m)x1(Nc`Vn*%-GaC?mul5$M|=VuHX%6Vxks04?3i=BVNp;bej
z(bG{yjdt>eUGtk8p|w+2SO-Y-6a-{sfjcdKhV6;_E=a0jJv?!G>g^^#vm^Si7||s(
zK@2wo;)v#1`ovwgV~i;H;yM^WvxccTuEoVOH1jLuMs2f9Y$p%D5cw@x-`{VxlFdi@
zYj+>}$FV=n4>8A#q<zgL-5yS|OzK{RX~HQ?Y{(|^4@)zUeIVUb#Li3$;$;)5xrj1<
zPBgMJRNlFE0<BXqyMkoodkA~H6hPHlUc?)C&!qeivSLw4A(e+xeMsZ`&lYSk1BSbX
zp)Y0%-#NKRA&><4Muj(kWakLvhMhpmtcX3({1De>Epd5)vQJW&EB)#6afeF+$o&xR
zo7s@enbu5suR>ZdJyLWbnjobu7nKoz-)%Hb6>>AykXMAAeAScJd-^&uGM!<e#vNQ)
z2Jw-1AKFUL&r<=b8lwWmEobmuzs&8V#JYtNJcNhV?o%cxx$qt`LP{+bf0a?E9!6)F
z@`q6<GnH(jbVkxvdQmiuds$VDOO~;jy^ZMz2+GX(!>+Oseo5aQ2dpkxSabP*vM3lU
zie0hYhb>Kjdq#7bbmjRLLubA|*xOAw1viAsRC-LDtM;ZM{ir+(O9dNf?SQeu01iM>
zFDT3%d{y0t9qEi;)6Vlk*ZDUeBrh|(mJfTJOxTmWPj+$LxoLHO-J_{#G=56HVNLZX
z;=*1v|Ecj)D*xDj^%p(=O!mZoPwa7EU%bUS`VE8Uj`Is{3VO>pKcAaB$21Oe>BpRx
zr|j3XIKAWj=LaNMpefBygnn_b_vtO}?C$P&yS;Ds|I|C!YmxFHi4B7-C=DDUjE{At
zq%uDC$zSU3?;h`;;7cn%vu_x>KZ$2o3MZIpjmeYd(?ECCO?bS8rVdAclY>GghDA3x
z9k75B!huX2(ZbjnA-rF#^7M|Zyx$O?LIJcKZ1v{Fub~5JU3VrYLf~n<xvTl>vk$y`
zhOIhq4_9d5CrP}k|4indYbP&r80vWK#Qg>zDVLbad=B`|w_O&Ixo*e-hn~!D_>(7e
zyi<!za_i<7ZH6D8`zJ7eI!=AR?fHR!0`r~^)e$`B%v+(2@YN&K*L0;|i$6;OrTM~a
z$ntgowNyK#Rw53>&bw^ZnJp$Att_r-$=rzkNJsik%2)eUf(?3DOS_)kR_GUZQ2Od8
zjj=OR8eXD4Yw5vi&+ndFoxK&5XuR$RVU>Y`()9r$cnp~=Bqk+)qHSlwc5B@VmQf<L
zYnE|+oLeTGZ%jxrEZ8w;KlgiAB=`>N%qpw)GpPRQ5<pr3($)AzXZPT6uiLiGuP5K%
zg!ywEHhpj=7o5d-W>1eKTLR<d7ZJm=bNtF)rN319KG-?5C`ZJ*B3!}{%4d`9?7G|@
zWmntVn_CYbJ^tc<%ddXBvAMO4=Q}v0n;^N*V|2JzD=vKA$*lWAIK5q^4CBP#GFLpg
z%$H~eRCjJ=er{`)G!|CmS!J5Xyi-M~P_0I}hO0B)2G4hoB0{v#y!Geb?$>Zu)jRN(
z%f=Cri5CgqH4|dpFr`O6S5U$#T&noOgNLwD6ra%@Wg!}WGT`kngwW+gaS$isJlT?e
zG2>K9dM5zouFmi}0#r|H$65i0Z(s2IGuL|Sf#LHBeL9x}7bod0aj~Y0$^Y)~{&FwO
z*;52V6mwAwx)3qGFqyNm78<HZX9PGl95GqRKycVin5pNx-6#&kBGh$(>Xy#M1)t?I
z*Fhr2=Lpe%+g3XWN$BHj@>XacSOQU;kc{uX)O7}VjNAb!Y@S4V^$;rXA7^A;gC~$y
z%N_;)QH{kT5<?jN>})g#bbu~E>Gh#t-voO_mEI4V5A?jWP+-;(NA;@m59_P-+EE$d
zaeT5#Sqqe)n6}gI5s!WiZ&*s&Kf+b$B6F1WS9|z>uWHraEzsvix&2OGD|9<2i4t&)
zX=gorZ#aMQC;BHnJWTiYIu-{dol4jhG!Ve!OhbwS{s5vtxc3As;9RpG%~*9=%(=Qb
zyAp9s_{DLc4d-(;CI)AUTcKHC`B*0nSu8ft6!^m=B#fJt4SI|1L~#Xb%qA<-J+&Za
zk!YQN$8ZR|5~tmR{X@^9@=5!8^ma6*^~u`B?4pBTovtzf(#Pdwfc+J_5f}jTUTC<$
zG2<;%j&m?XVL2+*qbNh-{U7z`E>?mS<ap1u8Cuuo#S;0)KF81HgHVK;7mKqXjPh9!
zHhN>Bx%S)&8^~5q(QbN|i?b;H$EDpkxWgHLbrbzA$60x)CVIy8IV+I2t9q(LYNEb@
zs6PWM83baXkJRL2utaNDIcGydBHJ)}B6M(JsXc6z_CW^WL^!_Z`s8JAHJS>PI0p&+
z8F3@t{w}_AjUFM6;fh?NF|%7nU*k+gjwc8cJ8cAIvK~GiJVXsPKR+d4VzcQe5e2J%
z(TG0ou4_cM6=#Fm?ho-LlF?l1Iel^N;~DNoK=<rL-XZ)A><)Y*HOMI>{e8ZfFjEAz
z8lPMN1{8wTkcslvpm;Tck$pYLD-FY?`droTmu@66u3oYi%XR=)oAc$kq%3kaovQOv
z(!T)&QOruuY)2eLt2!?i#Ts^kSP2h*4q$1%v}w=ysEGx&OIg{VGGaTZrFd!Uo{@rx
z`8;E-4(@9@X=bxxrT`7$KrHArg98NRZ@Jcm#GcZbom)MoOf^Q*%t==A5>h|_>w$=z
zN&P{V`1#ZHbViC5Ny!VT#2#eTa!aze*8*Bt)39EY|CO9X>6TXWCDBxpW`g>EL#}FQ
zm{KE)?vlZ`zU=W~*W(!YDrz?Ku+Z=WpxQshyeLc=t;-9&=c?J#e=a5fS6Zk3G%Zyy
z%;8XV75%kZU3c#By|OHtnrqmyoDt>anQ}E`^Rw~U&5<G|jM(cl8>SGNZcH<fWPg@w
zsYk8lU@@)Mt=UW9x@NeD^3msig0(MS=hF0?pl|`u)I>w>*}{#Cgm#ApqGsvt>$RXH
zpX8KkkS?Z3Z7G0AVq1}D26}ZQfhc9ssyV4#_o@er5Z-+S5Y%a$7Xh$K#?e+j9weAd
zOaPXc`GKfMOm+9MG4=Glod?PsPZr2d0ySWiE<wyBWA+m(Wf{$bltK!B`Z#L8rx_qh
zbB>Cf_adMnErcFay>j{7pPI-m##&ju`)sMYzY3hpaz{dHHA7+BQ7h1`S;97M1dld`
zsKh~xr!Y2p?2^%msu$w#wjm;*GniHM+zDl2d&KS9Bu-QBPX*Y(i^kQ{sPj+6=AXz@
z&HFw<Uoo&Cwmcuracc8_5=xy0Tg?uCR5k}+vvj2H?!jTFyL0%mp8e5XN%^5CmWkr4
zUYT8ud2PzU=&F_p@*FE%xu}paTU;S@KkmhkRSQtKe)GPkk8@Xa_uIXY2gF`8K8)0*
zcHh!VaA<W%I=e5TZCL^E_*BasPa+d1xZ+zjm}}O2Xcuw06#h_u7#_JcXf)1R(rElK
z_{9S1>tm0Vr?M))Vok7ZR4_7$w+)8@#HC%AB$YSc1qA|crXyC$h`XFVTLd5+XNyU@
zyyWYX=~bM8LKpsAvbhPjUo9^3dF26Ia_xG=%fB|7DShmanDM0Z2U^6B1EGA_`!l^$
zkB@0zyh7V)fJG{Q!rbX@HoGV~$8`97)Hi?IgZH~0_VTmQ=Rcf!y1+*Ay_cQj?;5{&
z^BqU2y%&YEhLSW4hF!sJ_fGzv1i4jj%FPeA^J;pfmL&I3+|a9|Lw85tA+p8u2GJ_j
zBI39B+OWD4=*1R{2Ob?riJncS+Fm$e^1VLje>Uht0pr7eMFjkXlxXD*D&-%nF6F7c
z;mMzKA^bK1(A>MtjgA@7pit4>4!_o9D~;+1QbfkWXNAe3TFJVYC^y^me_s(@a&?yV
zt@it-uO06VLNv?7wBO$(>!RW^lC(inO7@mpBQ0oqX>KB8T{bAo1P%>=93U>>0R5UJ
z)u{8@h3gxCI3wu&k|W#10Z7L!%O|Bvr2<-H-$~Q&uf`u-lDc<vcD*?po<v4_fx`IX
zA9lXm>AiS;xc_sfeYMqzUoDGd7on*m$?Rlrh8B-=m8TTW4$-TsSy>LE;tor4F1sxq
zvfSxsWnj%pRia&RUl-%8Vvwj$r9&;WS_I&2!On?)r#PBjd9*KMZ<C0olPk)sCvCSa
zPd_WmB+)EB?r2eIE$8_}Rubu6q?*z?4wzp@{nR4GNIY}NW5$zkm}&n>gkncCiGO^=
zDPdbt7*5e<9mGzl#0rMEii#pbRxI@{sws7nv)h0{&~X5vp+WN&qB@NtmVHnyb6D+y
zYta#ZvG9~k>MVPESeR5VE;@g&MyikuV*m9WsbFHCOS3Si7)G^mh#K^)^7L8wG~zQE
zQnS)?__j%k6pNjNuo++>Lx;Z8g9tTW=lR9Wa=2_Y#x{!fE%Pv>*N2=1hb63S0g>z>
z8+jJ(lik2~X{qgfqR~m-m+fxYy*8yjFlBUq<-h_@OVna5-q#D!UwqZeMm>Eb+zaI-
zo0f1koGnHSM{B!Q<EpdSOfVSxKicHB912RyA%pzfR|7iAXZoyjLA(aCb>p;=BtIr=
z*2vm+vUYJfn6*d6S}R$z7IFFNCdE%&w&vyOY482}_iM?|t>vcNQ6JDmwcWv}+GM+b
z-KORmKg0!ljk7xx;c|-NQ?vlOc*eOfE{-v;WR4E`vA$*>kQm?Jd%gSZ{&8>j^{a0V
zp6jZPChrQiJ<3|Eucgl+wYJi1&(}p(%5>Gx%oNYL`<&b!`M`x|N2}`~Evr^m!Ih=g
zvw<cG!GobzF<9(Mh9={`7?6zrf?TM7qTnvg7`v9lzK3v<Nj?T`>tDk3AOjDgM^}Zh
ze%Z6<dh%RIv-1KdL5C+t2x`8XPn*e=81Td6)N~(7wbvdY3!*!QsnPS5;N6MDy;Q))
zyc)%Cx~5JKO)E)G^6cs(tZYu5N#}Uc_uu)<Jj1TcmjWv@ge!Z|DxGlMi%njCt_-Cu
z4K*^qhAB!>e|T&na#UJm-C(!U3u}hqPU4m7**(@9?yq|DK9SBhiy2(o3~F@aqh}>}
z_6kX2RdO-Hesl0CgyWOL)(+8nP2+D4)(pn%vv?z_Q)iqJ6UU2R>2KYn**o`jx2^7b
zqp@!`NSVKt(`Ts^+&%{rzvW1Ou;~bzlyBuTZQ6U>e#-5$5eH?re9gnAu*99C1L=su
zq@J;>vC!NJQbLI3(Fnfev<!|%VUwz+RxI;1xYa#s8G!4V8AP8JqcaB2RowN<QecgD
z867R8oQ>f$u>?<-8x*8Y#|$Y7bT9)xwivNQ4O%fU{xI1-TjEY)Q!Z<Nmf)UUN%=}@
z8>_j*B4WPPXmFZ5sgiV2VPx)GasxfjPv19-n3Rl+GPGt3gTR4`$B%zL&mCrwadEgE
z{2~d9>phZ$lgly8EFD0k#l#Y#p!F@vmF50!vmqM052WJRvP;^1{O;?ZEZA2C3^Y!j
zQ9-okaDZ*Z?{NX5B>5?SVdUqe63O?0e-M@@p?!(`k=XCM{lg8sK#~?d+?}(U^OLNA
zW)xh?-P?L_gt!+p@JiedaRXDids_o<3}A0%FW8iPOAidIZe;^g|3qB_4BfCZ9L})g
z!#0F@WO~PVqY@+U1!>^m3W$g!IzC@^(ZI8!AUztvsBc)B3+}Fe4=wfVoTRqAi3XTx
z1mR&~c={TTz=ms<L}WP5KbQa?Hzm=5Zv>{7eDY3pYx>l5mUHA&Q^GX>j{GjGl*M>Q
z3cqk1;)5c-H_&MBo8#AqPfW!9y<i<d%9gt?UUyHPfc3R6FdzQL(d*-rCy&4SQhvSZ
z?jOI}IoyB3v$oWK%F#}@`~B<Vy(igp+OuU6;oPcZu(_Pwn=C2?HE0F&95lKlh;8-&
zFVe%k2y%p4aHzwsTA+ZCSRD<<6syi9yB}|8Io_LV-g|VR1@|Ykbf`e{Zgkb>k{x(l
z7E_+bVD1Z)<2lmD!6I?GwRy%-fvJHu5`0u9U}rkb)jsEcxref@oI}XuI0^ds*IPb(
zNieE@Uwy%rkRMrI$HNevWtMYoiKJiGUSEusJSfsj015S+cVHgvL$(kueXQ>zfRJ72
zwmhc&T?m24dxhJjssHhQa{uQ><7pygj~_hP*6J+xX9i*LT*PHu3reS)`ueyNfK)p!
z<Sn`CNeg3taMeRzcCtx%ozFU(Up@Zn;lqEr96!k?O|z(wXwi>mwjb0Wr?YYNZ;RZI
zk8`hOnj8?pxj^=os*ftznPh2esg{91{&l|1ci$C8G(^z0hG2gqq?KZBWKxXYr@SKl
z-IL>&$v-Bq`_7xMmgR}N_s71-b)$JZYDhMWwzFS<4*D&5kG-b-?dyLNt=b-dKmk~$
z<D89r6-;v)^jOb(?r)b(-%0{kz%6ol4@Gs4FD>!xL!WSJV%R9CJwHDOh@#)wVjo~s
zA<XHJ1kdU<Vr{AJm{$l0st0Q~P!bD{kB$W!sM5jEomeAc_j9!{DiB=}fo?0#ZP`wO
z-D=H$tH83<x}bqd%_UiG1y2%cv^eo-Ga-4?fW=tA=Ag}7sFh|jtR@?6D-#y;Ic5rO
z{!~X57B-V$fS_(gR3J*?6r`Z!JGRwE(E^P4!+!f9nqT=QZNLmwT!5V=^%MLw0cvf+
zFUm|-jR|Z=EsOZBw=c5I<$J|otE41z$ZKhTP=bvHurQf22RRT%j);i|uHzz5E%Z%;
z_Lq<(bf6^>0vvL(n2Kdj=Yu;JOrCl1|6FhZ*s#mqCTf994<0PnczBu|N{M5v%TqVV
z2M;vX-{;l}daHJN-6~%Np>ZzaVLYO}bu$=~=;T1jg6d}SiMvDH1^K;tvnhGF2sOHY
z;*>qZaTNL%fJRqtfwd(V$+dooJ^c}2dunw%2xryToZ4Ao_t@HkeOLEOMZa-5a4m+G
z8LMZBE?=R~1*<r<Sjc4|+aN4qF(Dxaz&*gaXp_qFZgio=pX%3q=YSU&5i(<e+N1p|
zVmw>AcMiZXX?eLcoF73;Q6q)|zc$W)m5pz<=|kSqPOsa?9z5_cs=mX_V<tYpC(_He
z+F`HbwlrJE73^Hm_M`}s3?rTYBz$|8vtNYqyIio47u3a9(~pYm6dILkPuq-*YWgb{
zL^@AJK|saP5bwnszPwS>dM5B-8J8nV1u!};TBo4W;b+yI#V+3oP2uYpt9KNCz{t}~
ziYeiD$slwm)_~E-7v^k=erLu`_gPhy%oDbA&;#yh@5TPk-u`jduykoID|h<PZ=lyW
zPA+O7*KFm?c*#eY&yj1dk%5;q8G1u@K(Ux#aQ!<Py#)%d0}pTKpq1=Q5UMvF4K&ri
zl|0LbvjPUy?`RzPdo4YQVp7t7Zl*BqSz6}6oF#U<?FEF&2%fC{F?~I|*rt_$&*hKl
z{^Z>@Lxrs+ZRd6nY2giv0){9|ot@9JbGQkaK+eUEBVmQ8sW~H=l)aDa<;RgrzZky{
z>@9zf+F1aTdoRi6mmPYQ&sCkEHbWpecHGy?eVgmP%x5<0$7N*1$_C+oDM)1D^c7hu
zmLPDdLT80rW55S7=x!{5<jAg47X`x-o{%<6N*gWJZ{Wj%{+2J;Z*j|Q4u_lP<KEO=
z3cMP4(Z9F;`egrQGqjBkfR+QP**(KSSR!Ua&=ULGgmLVBOI{~{a_L@1#qXxIiPSf%
z!}EtMzW}6u7&!H3zD8?*3)`8z2_N7|PU2(y<Q$je3ErIgN@Z}Gc{g$OJbXVG@eUFN
z*uhNDsid3%+r{wyXy8t`t5G@V{I-Xf?7ZZ;t<95hTDQK=MKFr_cp3nr#t>K<RV!sp
zQT%e8te?nWTFFc9&!M!{TnWLXOqm18*%n31J}+pf5yWVjkAp&g!5KsJKt|stMt3or
z4v3?f-KHfbtw#?xzvKmY@BmZa;bzYk=XlZ{_^PG8K#);y|BukD_m6w8PhOI0cl`R~
z_3rDJPolRGF@x>gkFUzk*60yiBo2I;Gn`;(%^4QCV#15|nOqzn?LwkagD&m3Q(mgO
zET0e%;+(}DA>Jx~Wyg#Gt;E%6guj61D3!!;wS#|ky_m{s*qKx+bW#-2+8MZX#zkN0
zK$-$=Os)TlQs)$rHwPq-GhIf=U@Sb4Ix_a<i}cNwr6@2Yq1t&!mTqzG?V@C%L!+Ta
zSAx^$a?d>Mesxpdi*|F0xoaYxjZvb4rSeI7E!|H(o6+xoK!)wLSA?TvSJ08Ts^2`n
zm>F__ocf#qfoU?qL-BDW4h++FU9kAau(J;y?1;_;Yrd-?PvnXfekFi~zWU&{L|(v$
zJg0XmtfSJ12D1j5l&*i$Kc_?R5(Tzx_1oN)!-JDUIe@eSVkmPZ3zKz;+-ON49wOFS
z$#eSOGde4OTM1%=TFLIcR`P0rUuQSXZGT)FCGr`FT$W-HmXXaImC6ao6VK3IELUp?
z7UQG`y>_luVHKMHWgSM6C*ZG3Q_n@^)bHrp6U~C5i8K^=PSng$nrOl<M7Nz_RmhNa
z)B#WE$)z4$(o^fRC6c-GbDt{%AnD1UnJy^UADVoBz9=u}H8jb}Y))J#Wg_hItBs9K
zXdE4VL2K88&*U?y$H#w489x3qIF$j7E<rmCc`m6R9uYmb$klknRp_h{+8&)?P~yB`
z&(}4wE3%YHD1>3eu|)W#Rz#7ix&YAS6h~=(ga8a0=X5ca{ot@0(PdV=7}Sr*5%Mr;
z-CU}FVOR_nlCLFs$PRx|hhn9Qr2oR-ILG%LC*+yD#bAY`YY-WcEDOcB9h!|CWF2ql
zJ~1~yarU@TMxpP?=NQ_smDD00Hv58&?Ybsu!#RTiThxpT!}v&$N^|_pT{Q`s?+vRC
zC9Q`m%nJ8Xiv1FRB1-8lIrPIbKL9_p`mg<elbu&52jBgvcewM%-odNA{Xh0j4i5Kw
z-_zf(zwh<DV&S0Uu)-WXG(&Nqg7ff)7f8VbONOOOGSBrUt=}XIfbfLUNpU+9tAb2`
zKy9*l3~j5~pJwE(P*X9NpdVUQt*Yi|S-IR4)fPBRhcu265Ype%bj?|i`is`8#5G@k
zOu$p)I%f}JQ#3geZoo}|d$9rS3MC+FzGnrs&orS@@nxk>Ji5tX$AzT924%Pd%vp_e
z4I0l;zi1p*0i=&;Sd_2at>EZVv7(SNxmVDnd1ve6*BbC?K~#bWA%o*$!8`gxQkU4k
z=iqTYLuD)+Qfdd6EtZq#qxpiPKG(Q^(g@=ft+7~<d!bav!}_P@MG=p=aB%|1x_yOX
z2nEX`$rXNyj-uHOyS=$f##6+Ei<UY3lmSVL;KP*|36@BiH%8#VL74@|ZHa6lbpe||
zsOAsy%g`_f;{~Vlh0Ii;stc(V7qCID9C9%eCl=>!jAYfVfb)gVJ0#&^GKc_w4>B!E
z0`~sxvnHEiIIWHoRoy&(0=0(}elQV&9Uum8(>)}|D)&*GfwNpoYD<3WSbDE<!kdak
zETXedcY~AhKjkJ81d3m_iG*ruH<6T<6kK1-Fz`G?6hB+qR^h>_65Iv+LZ7yc!sGt0
zwVk{bqS4ry6q6ew!O}qRp@DOM*wA?F!VrOTjfjC65|-^8ZzmPKeWZ~}JZq7D#ch}a
zlDJSAr4g#>7t#!inSnBc;54&KaQctCx2Dkp{AJ%+3H<h9g-eLuVlB8;`rP*WHhNVx
z8t3&6)UjyBpxIb-x4FX|mVfHa0ai$iu7Rb={I3Va?hC-R0Q6Q2(d@Z@YSPo1`V9M(
zz2vS0kBRJSkI1i<UG@9!-R{vF*yLFlz<cao(YLsy+RV`T9g?#9Mu>m!?HsJX(sVic
z(48s)zE)%Nwp`{QMA8!H9VG;jkzDm^X)UGf#fOrUz2;bY^a&1OHz0pD_>V$--47Rf
z(6R<iD@zPvd1>U{xMb*m0EZ;8U(squgG4CwVvswSXs4HZ9Ang0@Th~!9dB#ofN)aj
zMF7yC<K|PRg)$CYp(j~<j>;A|Z)Y?3per>94BFwUI_B6W5$`qOEuXNp{*E?F0GAa7
zkL2ZtcGBwkGLov9FjgueuJkc%#u*pZx`K8?53fZo`qEt&>I~t31GuE2xLG4qiN99O
zi>M^&+Fo%zVFWtg>kG!v(K^mtyu%XVD^_y{<<C+TVgQFyOOe0q4QoH5w#?7zk8A{n
zVd-Z{#PDG;D#ozL<+of=Y=f<9!XkJsgRUru<+e+2GZsp(Pvxl7+Gir|FlVR(a`5St
zuA_i&D+AaJk`c~-Z?H<@N1TfgJI}6&TGeJLVuL302aI)RIt?Af;85dph4CKR^N5(h
zB*;%rs&c==#=7DV3rd#JGhA|xsbq7rcQKmx@H;dH*Pwic$)k0hfok1fmP7hA;lt+)
zRwKz(4<77jBwzBhel8w7fT-mhx!n*r<kQSxpMa)m<w*s92-8(7b(oscamQk`o~DUs
zg61HBZw@c>#eNrUGzEc}W{|Oc(LDWO4NLA5lT0wz_C|NSxG-!^{8{OaJsM&M<5>?e
zyW#~yK?1Pi`qBPjQ(v^yC4e6WVRmjvVJiyph(OLTuv~*Dy7eS&oXf1>jK>H9^{KMH
zqMW{-%Iu<l(trk7>^*}ob`0DT^xFL-4v<|;NIN4XZJ3ppeDL~Mx?++J=?LK{suE>8
z7>cQ=#Ao@^5>n^Flb#WD6ba)#{sA(M(ZxczBQ3MJ%Q5{A9vm+w$(|brf*Cm24(Y1G
zD_HFvqyN`A{@n_^|4@mzLZVg)<DvNx9cuwpE?yyjeiTU=!-1DgrF*3nbY%wxX=VAO
zbCctU>~N~H_*qcwbC5Bx71R$m4NyOZXFVz7DhV;c`q-jaHcT+khQO!GR!zQVIc=^1
z4u0!aH?M5p2M_kFJW-eQahfxtXE~wmIvX9Bs~6K`^Rbk%F1cVM?no;zi@2Ig+{)|m
zP*6pGIEqE>C^)>|g#jb0>dTm%5Wg<rnaOj^EMQ;ElsuB6JY4&6+Dd{sr-#IN#r3@g
ziz~KI({pF}O`#{1x0|YYRfhDEq5EZEy!bjfQ<R!vTz?u~Un=AFlWBGX5ui-gk;gi{
z=n-Kot|mRqQNIbZ3%fbAVtI*kSO!J=emX{f#Y#GiBn=r2^4vPCI-$L%$!7BHGakwq
ztZ%3t-F2melcS;-b2q#H{F1bP`o#^klF@LShc$;=Yz&Gnux(v}UXF;ch<vG$xcD=~
zDvS-3+{+Y#wr>j}P=a4={I_H=AB{(UQ2|d@L+}3f@qfdv;{xpT_dn_oPMA#`W(@Fu
z1}@;|IwZIuP|=8Qj<u)~U+8d+KW2$7Dc%l8+`DYBK&4oLXDApB^DkmWFClA`*wbpb
z^UX>#&Z_^A#v&c;qVxYOJR+n6V;j^tSgeE6s%)>1XN)bPtgiG~Q4*|C8gZ#Qy|_9U
z?*SrqMs1cX@Rq0y4aYHyDl9C_6Tg3dWrnz4#zs^12oK$DnK5L-OW?iR*MJtj%B<Lq
z1gyG_4`@cqzLqdZx)2N5JZ3RBIVOj%V&-2lMN>yCdO*Xh;brjFG}#96-c~oZ?hEq{
zNcjxg03OryB!J?edE4A*ZES3`lNaI%U=Ko>T!1b(%hJB&T4Dn&40BcjY@(lkGOnlJ
zurOWGEAb_Kh+)L=2Y<EEAYRI+>q{h3gql^O(dFPD521qClnB#`!Bkwz2B%{5q84hK
zb!RSQ=u-qHVy>Nsd>E;Bfu8KcD2I7ZaxwzpRt(oSp>Ct?7>ch8R^X1pa4j&WTtUDU
zvsI+b+WZr>R4^90ud*n0d66W4bmJhzK$(E5U5YaGAGfZW{t{r5o$hJRU&_Njtl!hI
zr22X@z$n<>-ky)9%QH>7kjXmKRU(0hrpNKQe^!Vj#$b$jqp|#ci1oeu@<1W<gL<|=
zJ^P^25uBHW2Ehc_4C0V=Df^{FrD}g^FB-62++|Fs2h5b=i5+I^VUH$%l|(h6MSDcD
zx+4&9ypujm(`?AHW{Q3{WireXMEf|;uAHuSlQRYx;@559Eh+r00i3)RU@oFsx&oaJ
zPtTRn%7|T^Ed<j{(#KVgTOKF&KmF3U8m3k=>lkyI(^;wIGA`KDR{?A!8G2SA3d_ZM
zjvV|)P<81W{3Wxv(eqV*`OfiIbrZ0@*}Z+~+iWuD$Pi-^9y^jXdIUR7?$5a+KDzW=
z0$_jyLb57{u48()MGMfap&P;5UWV}voN8hj^`Y2A#N1t?k@2XKPdXTL0zg<WZ}lb~
zDIuR{?+SJ^9PI7WXkWnb%1J&R#U_CkQfvd0a_j=2bX}p9sCegp)QwY?HE74<(~Q15
z8K#ySk!n{Q8}L~bQapTG3Dgyc^hQHx4bOO>z@=gF!MQXrjEG~t@~jM|HJnvM$s%$|
zVWh#y0^Y%3O+<kMO~}SnOQMIz?{GbK{L$xw=sH-^a82Ysd({`^r5eJoG_)WD#tM@k
z*f%knVf)SVscr^;C4h+!&Z_AhbJI*Zsgv7gI2cVNlS&41BZv;ZdP`hBxw>%;H3q}z
zr{oI`hn3}%aUl+5UPhoy-sXP_&fLdCeIu!W#<3%r#DmUUSH{F(6TUA&Hb!qW`~l%0
zSH(R4LEl4*+$ZU?AeXTQZHB}OcvL(huX;ywn7DGWup`iaME1`+k~fwm{e{Q+7iS~;
zsga3jRhiVDizmb;0SjC8+rpj)*+Tptr~S%+`gQXro#Hj%sPZ|}n6uF?lSoS)>lzsr
zKts7a-4^G`D5iJW4iXk&&7Ekt2zVlxY!>oCW)3ZEG{@hyT9*P2>E>wZj^-JhPGO&U
zJDN^yt`M?+#+DAXlnz1qI9is-#LZ5Urf4Gd*~WT7hhab6n1w$0K-}jDV8O+<7y;*l
zmkf!_BVcmsbH6>kK{{@GUh;n~ioPP91%^vA%r{jF^{ATCh(66{X1}daIyc$XxNoJO
z#at}lOeL=n+`FzBg|mPmPBWVLkj-4ag$N?f+9*PQC<~u8y8xI7{6S}C9uTj}?6yvj
zV9Lf;XnF!1ppR6xz6QVooKN{JQ9>TWaU+D5I1`L@$|AACeDJPZ0NFsT7?-z?cVy0F
zvc!h2aDp5==L6<6-3v4~6bmhOxYVKGj4Z?k7>PQ`RpUFNrPG;-3~{Fr0#<-UJnX@t
z(397Hr1VQRD<kh))5J4&gz9<XV1I+X<3$U|^}Nt*hTyQOOcN`ekm(LK$Z(Jr0wm!|
zgLjul)=g00{T?#!dzu7EA5LSyVkIAcGT>lX4>!2^Jesz*<&CqVm;+30nw)p8ZhFkc
zIvOypKz)kj`4Ac%4>F)vBXVoK<zn8L&C8pAk`<=m;C!6~i@Mev8LWp@4kTj}BFJzw
zce%eI@}VJsV21=7N4JU&*o@n$$Ks9VQ(}DtX?hye(bK*uaLLM9B9^u4L$|*~y@2$h
z83J*F^YRH3b7rCmX0+{gTajOM%m0;#hIvRW$pBwKpub3AoHJ@37->B`7_BhB888h`
zFr24qe?9oFy9-)zwx!Q9JFh1i8&DOE!D4W{!DJ=GrGsa3lU~8>137rzpX@Aoeb-Im
zt~%y49`&3xq_f$3SAzUg_gq+Cf~y6oFcc`?Elrz|^|`<STRkG>gc+g)^wP=Kmlu0n
zk4R2Dm8RSw6hDK@eYB*~jwN8+O-kZOHbqw?f5|`3mFsi(GNL5Z;HmpnQY1CE6pnd5
zLC?e~ak}Rp^R<GK-yo=}FeIxldipES=tFkkph41LPBGVx@!Ql&Xdaty7`eeT4JHMd
zZ&9cvuT_Wx4{=aVo^x`CV`<KXtVe}}`ayLc<(8VrH7paZV<gAI=sZqyx19VHb}+RW
zf0&t3$6>ONVU8b01c6@J%EPdCl^YhX9^EnhgmKn7RuU0t>kU-`;t$6;r-2xxZM%S)
z#dIjO<ElJctt=*7*@!~9hvT|Kxu>-xOLgLzP}#v7Tm)Q8Ix%FaX;`p9$IH;eLhaHz
zOq#_z9Mh1yN-K?GJ7tOYhdXBJCN<PFf4xlsKDa0$tooT$`_#R}H+?+{T^77{ft(VF
zR|;nOY9#?MvIEB^!3C)nIOzea`lE@Y8w|tdBH`7<vk8O2w3BBLCsWu586z4DQ@Fcp
zp-2oE31eXzS|LL_0rf43c65mKo*Ph$8<F;Qy9XbnyKNK?U!=`*&&@OYB$u9re@C*n
zqvH5gF&v$btaO^RerVSKp~A_h_Ee9bl6K>#&?vxYWXW8qk@tck1)z%e9D2<KiZl$n
z=>v^rig1kc31#?^F!@i^0HMenTol8vUaLZif!OXdfPBz`OG8dczApVQaP?G$ln%-&
zcR&&y-(*-how>xt(h6zpwA8<Gf0`fEuvG%m*Eoir_SHJ$s7)P9@K4QkB9!t?d@zrF
zR4c^G1qK1&*}WCxD`wVIXsmj3ATYziEgX+_*@!E5xvfGF)h)5$K17>Cp_5ZJ->y8#
znkMBa$_7gUK@i%dGc$79cafY<HB-S1!_KFm61NOqOtp`CArJ12CQ_M&f1e0WQ(FNf
z{HWP69Zk-2I+}(l>>sK2J2f!;=IX+N*8)iFYNke*<&BqS@|#yyewJ$h7q9UeQE0iw
z*aOQ)3C+MH$OJOj+!whCetZ(xd9r%-*z&T1>qQ(Di{m;T8(YGpR^X1As2Q6h@Q$M8
zx9P3Ejh4~>S>(7e=1|eYfB7AHB~;79mwg=DLuDpc5+i`*F0QP1SM#y}LxcPx-5qV;
zn4Lh06kgF;HYQDZ7z%n`f-`&-CxD0RSFhGTejK<V!pCE+{@G%#5xydBIEbtoO@}Ra
zCE(--m;XdmbzfsYVcTv=RYCU}PpsScCY5=oH`q5sx&8`uT3A~0f3<Dhr+uy1pw2>m
z_jXcroOS6$Z$~AdUFahp;%agb@p=+kNA+xFgHga0S=k-=qR5O-h_fsh?bLzhI9}9{
z@Phavd-5MV*nh9Fm*-J4xZ9|Oxx5|xlHc<A&9IP6iY6mQvW@UIcuBE9#McuxFy8W3
z_^q?Wq-k%Vj!6CYe>9@-a_Ks3kC(T7>v>UgU5%cr-#Xs!p47d?Ioq{;6u3_p9uv>T
zMZ5gB@v3nh-b63Bx2|q(d+XWg;-5KNr}Ea>zuop$cT!xRj}hQdnZxs2d)P(XkOjsD
zJuGi~>pAVy%gV@j=IdW^b7)nMDsxzF-tyL~Mg1yI7OPjef6*P$e#~ahtmESbTm-Y{
zSGONCx7u}i$A=d!En0P8HYVXtL&f&(<o^9eAhz>w4qn-&mPklmK!#3Ee`tuZfUCdO
zKa=|=jlyc1%2lo@HJoMV^Ul`B)<(Ly)sY+b=}m|z+gh)Heli{vH=e-$N~{U`^>*^(
z&vd~IhkXCKf9!GT$sV-2aX#w-V|%FJt%`41a5m(5@i{Ea->@WLHl$)E^)*HV1p7D(
zvDm}Ta*~B663;it;O?Olx(rp;^NbdMl+FAh1RRHNVmq4Y2L^HD^4^j^p@x{A6`GhP
zkqF#aHuto|A4j3o&tcN?At^8>KC|O62>jt-5}dk>fAp2~-I3|fzIBex0o6yRs|r8f
z6xnYol!MQQ9IiV1^(Z8wWxKKif6%QZ^+-fua@7xGSPU!U?ff^91>C)42mIO#gb%{z
zI3BL8`g|)G00U<RwhHxFyv)iu#5&O@EPXVL5UzR}*k=w?(-Z;Z>=K^~I2qFP7?oK3
zm?S?yf5d7heix{7?Gz!&)}E!(icB%Ja@&u3OF>^9l4^STnn%aGm%JP?^kn{SlwU`x
zAhHRFyZ9f8!fBYB9U+qGEN9<x00ai?mNJYXKzby4CTjN#!s4uqe9g>117p)HyN1Bt
zW_J*SU2u-ReoMRn7y0khFs$pxpI}pWI;WN*e-s1#4wKM&z)f2f-&ZS;-wkLiG}rr>
z94XPucoT+FXiacfn~b1DX7*w#y00Ds9nQCExOs&g{SS+)DHqN`1i1w>u%X^PMnV`%
zgKXI6Pj>S87%wya%rKveSSM-93#}T4(0bNW*vPL@Cxc<7l^*|@{N^`_@0CUoC|aj&
ze}5?e`1#E2q#A(K-OfGT9cNIi&~QDFl54mJV(n$47@tw-c#0}8>zpG)(*`&iPP2lX
zUviiO=TbQ=QV#Yt12d4?W+T>5X)f6~#@rczPzqzEWz<`VPJ!Z53!I;ny)6Osl`-z`
z>CtGKgUVKDQ(rvnP3?(rFwX8QeJqOUf41#SdtUbCHIya<GZ=}X#!#o@p6W-TIlOIk
zqGTmqYZs8ZY(MEBvHJwK5AegSkk7mKkQP964XW#aB_Zg5*Qsy0UM|+td_B-==Ws~4
zMl1<Rf&&>?tqaA}&0exj=TkE<+S;qI)hahzqDi4)$BUNkTO}?mG0y9txKAape@t{u
z#u#@7a%+y3e|Iq}3&SLDX~`{Mf6m0T;=1tWK)mjZK>r(UKNq(=CvU9WSM>j9<KhBh
z*u!*lGbLe6wpK^}({pc#^>e8q$@8Eig?QJHON1~>WN8*T3^`vj=Mc*<OHq4aW+6wg
z;(QWpCluj&mxs9bd|Bg8TzuEqe}OF{1htr58J7;z(y0sQ#An4>>J4EHcSlFDGaV&A
zl5puhx}6*|$kf;6T;h@BzfXV15~%iN=^;9S>4~31;79H1nX7;%CaUibdxt1Nwb!G$
z>V0$Ya=)LP*1`U-0IL167d+f^-L9#k!R+2B%}u(1=tf1s=4C@{ehEXZf2t4$R<-8S
zO*ske_nYlUk2l&I=~+I{+FNUlhTsU&Yw#nUFD3(Z0goo@@3(dCnmohVbw(1(Gg7lz
zl3ibGcg~A~6Gqos$^9RHChAHo>H_HBr)$e|we~~uBnjVi4T~9@rusXblJzxu2xZ3T
zKWEu&t-1WD)rwyKkw%Kbe`JrgewG*bX~4)7G-I@9*26b1f;Z*iCKJbeF`FdsjS3FV
zljZ)ioG0Nqt>m<S;k(;kfhO#iSSmV8R92XLE~#iR`MDr2G2~`y_iGYY<!@Q9`=3<V
z`yLx0nDLU_DW4EKwEI$ehJtbWNO~Pm4uGX_&D%3mALYdYHekRIf9NU!oXjvu+!NIh
z7C?_f#etk<n~Q?F>7z0BgC*@-)FJ1cDGsltx76%5t&z@gUX#L%TlkKN=eR2vq7n>x
z<+z}xG4i>iRSY;qvP1uQnVpGL+?_KY?;Op5eS!#UHkg}1-$fomhl1AwDv5-hAtM29
z!{WRW&tWf%zUO%2f7Ka|!_hn_+OT`j+1;}uc#PBTf_H}tNv}dkq6^|yf0Oo^Uqrvd
zDw8f)`~!Icate#atiew{=$jhl<rT>~^7N>T0A;xEgF5+Vz0=kyn-FBC+OQ5}$!{k9
zRs9~;7U%4kb!q3!6aYd+eDPYqvYbbH2FG;db3KAMWKpwae??qRQPGNKe>xt`w}p+k
zd|LS$d<%*eCm9tYG(qMufVp~ynaK*lXMBs!C&tJP0uKjAi{b@YVOs^n)<`Sq7K|1i
zRKS4jSmhL8ea<FR!*_O$fQezw2~D^MiX0Z21K@C?m&9AqvER>~qR0!3QI|#m_GJZ0
z@0(ujS5Mmre<Bih4*Vz7D;;YFQBmj2Fr&4kx#T|$`1zD0aTw88B(xaPcfi-U>?zl^
z=<ht=e|6Gr6KxVz_LFs;&1RCiXqYmNa1w#WMK@zQAr1$&j!M2l)h*QyzKd_NguVN6
z=gr=}^ubdGx>3K{8anj*xc^P<&Uh$%1PNWbwS3jve=uL1`_h)F>y&S4d}YTu!!D3z
z=&z=l_eYvJUvuua<B--ulR}jgJbA_h$S<nXNJBzk39C?r+A@ST1Gj*d1+x66Ov1`P
zNT2gk-f#rU5EDFY+M?DAO;FRZ)DshqI}Vx3qd2I?z4DUd;d{`W3s_z*MuR9QYEq=d
zEInJGf4cpcL1mohmbO5u@2B#9%I`O6g*)eT@V60r-C6KoO1Rejwy;Vms2Y;*6*wzi
zf1nFW??31#aoE3k<0QhN9W|^?#?;8Vg<@5PwD>ztUvNZ+WGT8j(||`gL)1fg3K-gt
zE4&@J#%l{x-xDvCk~&uw_w1%G)7+y8Sut7He{2Y}=z~5Q(`WQ7Z#zh|I`Vdu<lxgn
zxc0z8te`kyauYD>V8d!f2dG$OW2%)lQ*P5aE8%zKh8z_mHn6Ou_aS#A=u-Jf;$+jK
zxlylX^Y)N^TPY1E*o?!Rn2Bc1sZgdhc6pNvhy(IUj!*iD>%Az*7#T^YbD!6x6~b8d
ze+bN=mE2Vr1y4Um?rJ-M3!6ja=dPAU0G1)E?}aln-%b}ZK>d~)AARF1A3+*$-da_y
zrO*u)*fejAU2}t459&a-1XN3PZMQ;A4#i-ZnJpS-(C`4)KJ<oVDlWQKwKhv=J%=%7
z%dxMK;EgVMfF7$DGt3!>f=0WXwmKDne<{Q{H04XDHQB#+wqIA%H|H$%j}yxbF{#3v
zBP5KErECs*y9Q*<8SD9ot7Y89oA_{7{AmMS3G%Wd^82M3+2P<|(p^p4pDi!@KNW2^
z{=R7Yw4S&f$hP@cPKx^c_9enSy`6G@Sik3ta$NCYe(B3TxR{{NLf#AmL+2goe?89@
zlYsd2ly-tQ&crc-e4EK{l2dxt-$N)yc}X{H;8t%PR1H~v0?bL5=*nJDNDH=R#jG*R
z&lVRKf`Q5v1ULl~TKr@*o#wv0o-fV_E7*CmE{A&?F*$9Rv0%LVRi}e8q?S4^U-?ZE
ze?&zRwf;D8Lmbc$K7)YhXb=(oe>PZF;DM$)Nt&`{K0zji#J%Bw>?D1fAbF<l0gXjs
zFQNL38Kpy9Ic=-od4H%8-$gRN&NIoXRj4Un%19jDW@eyqxVdshG=ZyH|N7+hxBIW2
zwvw-51AeyC-3MIO)28KVsCX;EfFgtF*SIo9WWRME@y$1W1^R(m5aze_fBWAb_V|PM
zo5?@@Q*wV&^tf{L{Z{os^rUz2>ICI7U-qa=`UZ%NXwB6b-TrE0W8;3K`8(<G^7jMF
zWZS;J^zHDWr7z#*yCQUP(V&|+9n@QqQ3asBP^`KcP95lzC7pkG`>Qa0W$t1_b*2C3
z{rns3=L$lj%8j1Kjo>>He*kItakf|QdWmxR{kzTf!!O#KRk59DxRxd07<82pIQ%Q%
zFd7f`0j3c@wUT$-oo`HUz&Cn52%o)P^5jW!zt;oj==JU+I3`K%-I;mdX%rBx;UO4D
zz(cl^zGmR1SIK!>)2$sN=zo9*tXgWFofXU6IJL7ZT;(!0iAc93f9j_gbedLD!VzHQ
z01vY=<GiBkBmY4X8)vbi-nMWsSgkmqC!6JszHtI5)b#iFuaCd&9_{SztB$<H1EABP
zJX*~i^V@i&!sRlftwwNMc*H^k9YipWEf_s2i3(!<bD_r#gbQ$PdB4+lIXcRdd6Lhy
zAgRJ_ab)U*&76MNe{2$OF#l^M`H0=!YPS+Vl8Hv&Th+?s^jgFswPM#Aa~oQNR?Z2=
zmz73S{!+i4?6@+v@vK)MXDWK@XxMH%W6UoO<wmru&Sh!P>L}<?xV~HFcnIrj*c<@P
zVyd;8uW+&ORbBkj{WQl|8IZ8J=L<KV-IJY@{oc{e$%{Vce=>Q_FOv}p5bWCH7-21q
zD0K~Rxs{yP`1i)JO_L`7W;RZqB%zG6n2mqOxAAh9Zt7$0a&ac^yY;VH?&3I~T+pY}
z<YBYT#_aX`o%?ilam5Ac))Q%|T>^=DUH<m3wUY2kvyBp_+J-x~OFiKIjNF&k;=}nr
z!<Z^UgCCJLf2jjv3uHdK8cnh>3rlZa9sCif5p!_o(rsalKN}W}W&ZJG6*EX|vpzu@
z$3eMsf<2Ukl4c}8He6JqD@)JuV^&|d<%3GDEk&1!P7V)AeEptL3rmMe1RJacxYcX|
z+Cn&7=Kd%_fyznyY6N3xaXweme7cZ?CTcpBn6VDye{PQ8`Qd7-cGqBdI@D@!vniMf
z(Y6>|4I$tqYj>Z@HF=?SLj66*j-G^wD{HdU%(Q|;foPsBOv+)j#@U}1FT&x2ye2jA
zDods;X!|~1h5p}OVz~4rP4qV=q-bKt=L;RJIpS*%IdO)%*eEW&PBTF~^pee};!=#A
zBn*Q=f5O|T5TU0d^r`)B1n91Ez8H=QrX;qfh@{eSk{DYg8+Q;{f7{+#GBmqZdRVv~
zK6_7Qq$x7QgoVk-Ou+uC0Op@=t{DKFvsp%dhziz?FA9!{G#??Sqq!qPc00!e0z`}#
zK`hmJq$th{*Jrt5zhYL71cX|q9^6YSu`33Mf7H`#w5h?-1qs%iy(Sx75c;qjtb5qX
ze-m11KzKn-JKl|0*aqT6)->5|Z97@pXm7PQ)>^n4O+!gHPgz?2u^}P#Yd8(@3RaKb
z;H$6!<LdM}ODD7z{*IRAz)c}7e`|0(#N}WA=(g`SEMET{ye(4VK8NW-*2D|L=+pYh
zf6nZJdyC(QMoCi*X-m&$Z~4Lw{{8D8F~L8t{ovjQF>Jf>B{ggc-(1P5TK+|2S9m_+
zSn)HCZQ;3?bIC(LhkZj95gr6_$ODMc|H14ZpK(Q>Ehhg#3wjoQdBuAEZ*AdR$ZntR
z_vtj~>pOktd-F9irIe`zY`D`O2h|_)fBCZ+V=o=-?U#+lzORGiB?V^!p0ZEc2MC5Q
z6SJ4Ya^mZoH^8_WZ2cD^s#N67=V$yrvwFmIbVzQ=U?fkOO{Wp*rK+)B&acMzHk%FO
zaVXQtfuq8p8q4;aC&{W+Y&Z+ilO$ZZMkF32;bJ*ltzX97ncJF^;RyAn7`it(e<Rrv
zsK6iXY?!(>dcKVnO*7~uZT5PH;BR|UOQgp^?U5@m$WdfLce>oVW+7|5t))I#qJ&_S
z*t1;iX>q2~w`AQ{bEgrKPl^`D&afsZo^s!YSdFGvbm~E#9FJPb+r=5$kaLg->q_?m
zU>$BOu+MZ}%bzCI1TdyPD~Eykf4FYNjrzY$0$^-&ejFBnAZt?-Zw@9t3`EXUgrl)7
zhP8G{8?Tu>7ai?Vrssv=BHUCytWsb2CAJ>|NmYJ2Y0hiXGTeMBK`Bn9=JlE98k_IG
zAscFl0J<3?mwa>l`Y^e;9L!L?v>v`-8zwa%9?g<FJe}q_zo5!+ILE%se~Lv-HyX!p
zUM1Odo?dWt9A}CD<~O)v$k)kfyWRew(bzrQBi3(US^L4%w`5;63&FY;%)X-qOolme
zHcllVQfhv}z-=h5m)b-3)4E9QC+Q7e7F^17nsoB{fSA*~^ESVM-dpnR0V&8ydR}&4
zCSJ@vYvVi>ml-q8i|GZuf7S6<Q<QaR)8#fQO8k^0^k<S1OU-6P&PiG<e=c|%FY?#(
z!DRtq=`1;wS~Tg|&65wk`NM5J#n0Z>M*BT6$RSk0f+LXEsE;)LzE>7W4y5|_F#H0p
z)KP)XXEe?9)}O&0&L(B~5I95$eq{5vo9&HsL;oh}ZZy2ex9rk@e;D4Ddw4jz;=k$7
z_ixWMM8_^5)&<owa(88zVb{2yGumV`{QB1hw{~&nTAPx-Sftbu{$@t1hTX|ZPHo~$
zAQ=?s#RiqaF>BOH_g4`5(**b@+nl0qMo4zZOBLJt?Uk(e16oE*S?Tyed-diSXE)a~
z&S&D?vv~K*H_zf7e?uy}QBU1B__qIPPpr61vp6mPW9G<e4Dc)@LMpj{5IeRjUkei_
zO_w~?=}Yy+_RST5zwV476TrqSH`L@@2Z7pi2O8(Ys9~N%`xseBC8{K`hE*~Ue~FwC
z$*+GTVd>y-=lQ;hrr(=gs^TbI)ee7rTSZ^(!*<f{!0^_Ye;1vAl;oL=WczI=THDua
zda{fH1h35sr<_M$?zdT{<~SxpG{HA@#TcKawD3h;vi_dyWq;}1+&O;kx+&Ws>}o>}
zEjyxO;UWBGrai%%yDWw(MWjn&gcJ!1lgI-V?(RZ{$#RBYUP#4C5{$Sq+2mb5k;v+}
zn_OjE1is;Nf3~%Q1k#Fil5X0fRVk$ctOS!x5OM;s5ExbAz$$}b4}nC>Ynid2ZH_ww
za#P6-3I^7ni?eoPxyNC(D-u6Z^2${ua5&gY93iNI#nsximeXLoK!K@}G1zaS?{NIN
zD>5gNcyj2G_TC(PtXST%N!C&G1DupLh6m=RnkcOyf5F0V`UkHLPI}$l<AbA<zRRKh
z!16IBjeae_d3N8HHMQ!A*$}`kQZE=Yz}SxF1OGe|;CrCS<K-oC3}I7sb>9sUMWXV7
z!JL^=EIx6r5A|+@{JwSB&Y-uqUzKVa3@WtHpd$ieHx%28BuhnA3tvSs0H~H&(r>Bz
zq;>9$e<jrcc)?N)Ow++Me!#vcGuOwCRv$p`N1YBBV1Dj%PN7cbb6x}vMmNR#E)yF5
z>McgdE^J@tXVa!LWP7VMM}x4pAmBe!(tQetIqNhz%QW>`6CfXNXoFn2o!xTzGo!hj
zz$67Qr+uepP)%Z$whhB81O*LxA|TabI;SOIf8RL`T7$KsE@y+c+_+dZXas@V!;p-?
z?HBLRMS6ZV2b@GEe%RBBtWr%`fWKpmkch>*j+=L`7ty)L|4C(*P@>Z#m~k~c{+Q5$
z`$*}OSe;Y$QAIn@QlDp18OMPlC}IJOF>YZ3JzNV1iAIji%@vLvVDoblC=kj8ao0^*
ze_$f|@!kbLkw#Da9Jo1bcLtbRb+7ajHz9_Epr4Smcmu>bis(Stoa-11FGHClE<9>2
z#(bWmA|<18#2LcX*c6(qiNib3<~jyt2HGF9b0A|do1=29N;{qT)znL51JqepS4Qva
ztL)Fk>?!?sG@<`?>Lx<ufyf({TK^ule>XSV54My3E#G+9+uW>exF5B%b%%DgR<y$z
zw0$B@?0Y4legM^%rgIcVniGQ?XBQI6S=n`L5sMco08WmZ2E@HEjj#3nr-^+c`IMOm
zN+|H^+0GXDO)ZGZ({A16v0dibJJ>lnA1^||(*l)K7?c<{f3mom-t?PZ24#*CfAAkU
zj<R>fXvk?cs8naeMFQ9*vJj{T-OG$YOGali*|FTBChW`UUc^$Bq!~(8`hg;(x5Kgc
z9ze!D9o=F{VzG-0*(Q1}imlARZo5|8pdMnFxo|XQxBfrgqXl+Q!G0=#hJfZ+d1fyN
zy{upyS1jj^TmTTZIFLxhAs|Vbf5wjPm&s|hvox8KAo+L+qETItQ7u;p8FMR{!SpWQ
z?Xxvn#17&ISJSzKJ4;fLWPHnDSPDG4IXV!bO0zpmCo}9rjcBGRzT2EyG+gcy?jJlj
zIyiDJWIwV854aeh6U9Oi?qfwTOsH}d3(d0d)Q@cHo=kSC&7{_h;akpge`LC784X@F
zF<{EEa+OK)vnMg0Wd|f_lgus<&Ibi>BG;#$8@v$mLLWSs<rn#T<LM6`@VRPRTRww?
z7{Ax$uP0A7+m97gCNA~t!jEV%dM{t^?!4^n?H}#G+S`A%d$8Z_*XKL0vrs^jFwHm%
zfK3i@k#ZN1cEB>=FIoj<f0_Dn&t4Xwi4`paZX)s<Yf4`zX1R&uh$~@>w{2!2Vg{ko
z(bbc%5HNgPdSo+S)SZ~vM*(A{m-N%uobx)LjV@5aFOywZ*<K=nTbE*&zW4cXVQx8t
zSRydW2qYJSg$+W(7?#!nbcfjkfMr;W=Ofso;`dcXHdyM2C9+JUf6viY{E%qX4oY#<
z8TEMHK70<#{C<u@_})jF7p+^X?1VKo!d3P`4?>sC1D{+syBaIl_UP)Py>TVIEkF?b
zHZ=z@xZfn*-Gf7pEVX)Jd>x;`oeD|~(b^@DW08%*(UoNwV>lY(-u%X_LNlugex3_@
zdrcYT4;1lEc0=2Wf1xQb13h&$ma7cKjd}B{o`nWE#t~NhqnW_82sjPKtxC0w;$RQo
zbLLgl<J#>e2pYuYuU*TF+4yNEn~r#jJK2EbP@X!Cel2DzpQrEl8#_}iTUBtr$Bd&h
zCAOMh+`pn3>w}Lj4VVoROCtnpY(iS$O<DI+ORSE#&8zK7e*?fby)G6l*kzg_L}Uaw
zYY+bM@TGe=sNZA9jH^c&&8iPv>f`ghoi}?2bmZ*UA2?PL(pjY;23LT6?Ih#)gC#O#
z-sxDFtJBHCF(aIH7|$ZA2lV<aioqE5<^0<#5*{$f&FZ=UBCw*D49;mQ@<x1r^Opcl
zV_0xz&^A_+e_ISlw^O_oRC=>;{AXBj9Y)xm4P`4F3m2fUkj!Ks$k569&R=L|eaHD{
z!h-U+rNvLz0`?GWlyWVssw9|>u&%)FfaKk^S0t`oKnk7RtZ_G`@t}zx)-zm6y#ckC
z1s~8kz2!yuc=(dO<4Vf}w*r{?mPxn4?fa!9sp_D+e+rX7x|pQJWX)AK%g=%1F<G><
z>?|t9>%BFs>l!qQxuSVV$8p(u4E~gsWug7tw>mtL{n{eSabw?YS%^iB5jxO3@I!cn
zarZWUcw2v5HQ36GuYRz%rH`_vXIs=L_7$-J>hNHk;h2LIC<mH9xpa^meXJPXhUd?O
zDdskFe?z#>iik5Cafu543iFwBL_G4>NO;n<*qM_YM@vCG<~PYM?v*|~(}1<OThY`L
zTiB!%FI?8T?>N}l(Y&#Rkk)yHCrQO<_D7|pHoWpoksFb-<-vpPgpU@;wIpYj_PEFu
z&=h41c(9LysqGFT*}vgT#{&uW)+}RafYC6Oe>qyQa&aDQmGcC9YI)WYsdphIv1x1R
z8V-u7IFD%SCg0>k)v;pM=e!==>@HA)&sn%BZMn8%igex5A@*3T3Tukc=#H||vRLpD
z-R^FPbqu=w3GDuy&oz!fBF<8>IKITQQG&dfn?Kiw61nLK7`jv!<<5_s4$hT(9Q=f?
zf5Zqd`G92%T4Y#3F%w)MO6o=!R8XC<e?pJ+l}9;0PC>t}T9T8a4-RM9H4!R5&s>nc
ze=8H=RX_(EeW_ggw>Zj4X1LB~I5Js!?0eY`$lKFmH1W8N*GnPm;4_BU%n%jAcF;AB
zc%S5w7S6qfcNLY-R5un0++{0O+g6=Qf6r)4$Peo{nNxIbD;72C9@+e>Nh5>HqTmQ|
zM5LhpLOxh<iHw<mJSEbXgp;-cTcty0lg3@AP1eQ+*AEeauI<E3{}9;->C@!J$;naj
zg2*|at+iJT{?5{iuk{<A_l~oymSAv_C+i$E7qUWTGfZcdPyVoe&t<hJYvnD_e<U^O
zm&+VS5SF2=Qy=aoaXioGiFz#S1P`80-J>+0DamLx!qTo#f*hNMt-U6qyY>c=0J$q+
zGI4dzPVx!Ff8uf&-c-W}ri(NBM34(P3kqBdShU;w2p=B34|i<)6WIOkT~3-h*7~^)
zg4=eQiE_bqs)+cK#-Rv_m92Kke=(Yci00mUD0Hv}_PiEG;1WsI^#UzW^CMS8Cz@JJ
zPiI#P>s4}>BZA}8VApSSJx9XEW#v@!#B;bC^p0o2n6e*_d`l^@kkW=6a=}JSX0lj6
zc4C(d1%~KDS6errY5`={)YDRnvEi+D;zNH_c^!Dthe!rTX?8wW)Mvpwf0n(uV&g9F
z$TyXb+O{-;bK5yN%VuC2I>c&cT|hDymNJJerbR{_#22sJ?m>rp;ckwVByn^h>n9LR
z!ZCHZzFj0S%!?_Hq^-*>dELb|ckpsXU-?VTkT_)MJxT9#;Jt~T>d{7WHJU(9*X)A>
zPs`dx#%&R~%H{@h?{S2&f0eANKp--{^1rJmOR5wR9WYF0FeC?4rNJuowl!)Usmgl(
z9qpX#zDP8aMdLX##^=<^7JaS2wqW>hA2cy4E#Y0}%qH2%Cmggx=QIZ@5&2F8E6;$m
z+R2_YF_bB1Ot@VUI!O=&<>9-b-4Iq&E(pjGWAykA$HK6;WGDwGe`)V$`DHdfPl<<@
z^gWo-WI26KHVB!7HDG{GATz9S|8+#ewI;QEob&QXFirU8)fx5ma-?zRBbbhXEXUVm
zrWT}OWn8H9#-XM02e=Fwoxd_@42D-=-OcxWw#fSu0YqO_SEm#&;}T$qz^br7Cns7S
zoHvugdGLJyB=H)xf3FM0;R02{D6QN97d^poGZevsN!dUZbajOkb$~n$#u-KdmGO<&
zeMx{&>i02;%M@8(BO}<A5%a*3J$NvRd-C7`$C{K<ELC%V?AsU@(-#OP{)iy}p53hK
z-1?-j5|mQiteCLuoex1MfYq(?jF?Qq&k2dUAlZy@8NG!ue*n7;3tZb!;qun7NpE~g
zWuNJXedw7*Mrzk%_E1?y@VGpixd>1<(|X%Om@B%i%`YmDpu#F2V0^5|=-f#+MT&V@
zT5%bxLm9!WORY4{eVOGK9FJs29~*G<@d#<^b7eMcUtz<njBI)2oL~bb%cK=X9$rEU
z3yyc+O%3L9e{5amNhf($F!p?P_Ns%XpPoL0S06kersL!2kRg=6E2d@B3;i)w8+u^!
zy~1EfRb?eF3zm{cW3ry*gPi@TyrT<e43E7snv`4Vs>N6+nB<CW!F5DJSE&qNLMJdP
zAFF{0SsP8xXPE<?UDI9{voNwScq3UeEP|BpmHGxEf4U3Q71rwAU^y8l>BSR(Fa*TA
z>^R;lp}r^|3tZHz;+>rteh!T%(|ad&@qXzS1ry225r2FbJ|@MdVM-bzjZO<{ah5$C
z@k}{1``6h`$@NzuDUndbsJNI)678~ZDgZcJ%(+Ac55Si=m(SVw#rr$VuL?z>6|{ZD
z+IF9qf1!q!CR!aAR_Wl#@6Hvqs=nxP&!tM0e>(7m#l(~H<0(yK>Tbv`F%TtRkOm8u
z3e{Y3U9eUAs=~0RQ(4CfxAbLid6|5}#z(jk42MFgS25ZQd_FvQuoHa@o_l92@!zA3
zY@y#b39vUn;gzi$&=R%Eor!yhR@PC{1ag(ae<83akM(c55HsJRZF}H_`y%ydULuZ{
zJyq^(jNj3Oj?p>8G7EpG#G-SvCo>czV)83yql*zrE&{A(#8KpnQF%$rGrvX+X;(r{
zc9}mACGtS7VoF9;0fLtXi^^3r%0P68f_bFlw?}|HdK47-Tz1<w)pN|+P7tNNhQ-vB
ze^(+oF{XD}c2q>#N~cYT&sNilg|EpPZIQ4G3|-OLc)GO|YS`}m(k-!mK)HD1VLSN_
zMS{3=tgJOx3SgU8yo<^unbYyTWf~o=(h*uh+5%u1jq)Ok`Sf@ku2^+Tsw8U%Ba=O+
zSC2S0u_fC`sfF?SnS)mOvJwJ|nIbeOfBHjB2mOJ-p=wtOrGKTBkZ^no2l0Ik5;lOq
zLlet3Z5d=BSg5!r5Ye-Xj3iSFzjEkiR&gLZgYcz@A@DL+X($x%tO|l`nNS$9^HN#2
z84?(<g+;0Qo$!?gK{4OfC+m2&XU#5Fgl3UN#E*><vG-gP7A748PIEAPW^tXQe{wD$
zt`9Cps079ux!4Ufz8XN#68f!GtV#(T)fYMM*X3egu^$)dHe4m3oxI_yZODigmD5Kx
zV^<(ad%_t-5`L(POF8<Bi%QXMP7#*_VJXk&a^nnf2%rsBl{`il3U>SMOD;H%fF?n&
zW~zcr=zL$ehb#<sX~;5GmKKLDe?tWc9)rsqg)xUZ+I^qK!Y7%)N-)S+jt2eAXcPrY
z2)jpbv>r7PFSL`Rg+(MzfNRGu5<4o2iRA|l7BfCH(5`vUO4Vx+{6*W9CTr`91S<|2
z=F#B%xhf{a64t3Bn;RQfa*b{_^$dszfqq}one!KzNmv&onu1ol?Nixpf13HAgl5Jj
zF_u}U3zC#|?+1?&?JVG!DN2zEwD|c1zFL~z(L_NBHCWjlZrVfzR`4DC>|BJZm{|oT
zgc;d2wl6XY5X?&81hTHkU=Pd0dum=diZzTTIgDXiu)gq$%#fPJwiRLwxH4SK0wqid
zcTg<YFv?-gu2-;$mm=#te?xp9ytF$;bgVls&aP0ZgA=BtiieJgZ2^w%&KBdhD4iHe
z46w$ICJQ2LH2Vi>a)zm5@?%%vjrKce)YLw790e1lv14}e)HL)io87pYTQm`6)YxJ|
za_?}Y=}Yrj2CxE|g>Q2<9?eDroq_#vHZ64z;X@|{k(=xi-hWaVe+V;7i#g89xsf~q
zC(!_U)+zG=&mxg7-gY!d2gW6Ep@;maCNvd;!D320^9HYw0FG+sioU?#4fD}RUgQ}2
zLhCJ&yhz%}aGa~BvYuH<ESiJ|P8JX-(75db2|4B9ObOz2GHJ-nU@k9N&l8vnQvP8`
z(-@~e1SF?PX`Ujre`p#JbH;T($1x#~4BX^ci|e|c{rms%|HCbZjV1r<|1H_!igbBI
z=u0Uj9IE^0m`*k~ur$R)%B=FlN&@9pBG*f3h=-#I5zm$DhS+wt>1}*`D|wP^ZG>kT
zQe_~t+qG7Zog{miwA6&33;9$_9PVc7!Yb<CJj~v62Ow}ve}!tL9nb^2>-hs$u#&(!
z%5}l6Bt4Xv?jLP1mNd$)HJ_@yG|x|x^&`M9SLZog)n@XKE1sg>2HjJzWfW=WWe}pK
z*ZA?r+;c2K%hSt4nu;rGgom-kOYnVV>enCROAomd{O4AadcFCWe$%SZf;{#MA|@ip
zZ?v!sKdV;De<`{FZUSUdCLVmT3}()efiA=g6n17|L6`<NQ5t-;XHSfC7cv=sE?FlA
z{T6!*@+23};uBA+vWi;q;K4Ve_sBTTNb)3!8}rr0`5@_iuE#<POeKEj%D9U2^At})
zs}OxvWiPblgB3`L?C>=E^RKF}!0x7?Jvh*~)RboQf9t71%n5L$$>w&#hefh~@-pB@
zSomYlHhA$>=-F&-Y-}V$l7(T6;vz9Ew*@hbhZ{EgEgyxWLh%+Imx~$mXyM2K3k20|
zYx5wI4G{Fh4gReS!tCSB;PSk-NRNKm+KQg6Z2xU*tD{doNglPgl7Ii7{%4wOM|KY$
zC?|OAf46sLhiDj66g!Vd?y2~V+zfA_z+*N}`3$(u&n{7$?$()RYR$P#eZK5S<3=e?
zPUW%3)Bo7dKBxqxG?6{D>8FOx<$mvjA#QZOz=UkJzxdMaY<jkC7Wo-kpU3q4SM7&x
zzou-S+T19k&qCaq6~)yyP4ebOILpx_J={*df0sSxwrDvWy#={0P0uR<-{$?g74RY5
zq`GJ6l=v#R$?M1FxlNr1o;1uw&>qN%hPDY#<o4H<%m8F)+s50}wm$b&&2#9o0`BHR
zbQv;a=J&Ix(DeM1hrCEnHaEg(r0_}jp6O2<J)%+zho-ZBe(9v+QgZ<C9H*1>lTIE<
ze`p1!ir-Eg_P@22HH=6OpWjG}s@8|uRf-CA#ca(9aH`4ik>?~!;k=RvMbZU3y(Dr`
zB4I2uC{Ew{cxbPRd5grW63kMKaF-+)rBfT0tauTW$}mcO*iK&N@I}&DUwK}_8;I7_
zzhK-vI0$2V8m%suyo$cvkLGckw#rf`e_C|ZV3#8vXCxe2k{78<B$DxQ5K7?vVSb)1
z#`9{^eoy%p*^@oz1hafx!jRafv99dh!{ruGul$1RmlI`W<C{6l)zN|My6uQSFu~8p
zQp@t}rm9D@wczgro(}`7Ad+Q~hFWKvq)EFzAD-1f2~`zs5wCKHoEmojnRkRrfB)ER
z`U%*avK#7((^H9F_@lCiSWE%Yic<30Z5J-h#f+F1m9(Z3-X=i2yC>G4e);&nHR;yH
z1!Lip>KfWb0;Pb*$BiL2iiAADwBQYDjN_uf(T{{oo}u92uNIEOejMIRvMb_`Zb!C)
zfaD76sFMpKC6cD_r{pL@VH$*)fBcjLjLV6e8VK|gJ({LzqW`8}ha*3TpOSsUu3!uW
zX3w2Sw3l}R$>k@{QLB%FyS5+m8?ZX%DPzHCD%?*AO@FW)h2aQfQcm+Jcx%sn#kB!z
zqif=&xWXVUMvXyUd;E`fn)BPcq<b-6{VDlkBi-EE2n2Ic-fhkyrq1yaf2&I2YGmUJ
z?7qt@0bSHx8VF0`WmV;jh38jJ#fwHa(nG+B*Foo{svPVbBvcb+JiZdc!NZL!uT;aP
zV<SS{(L$n4QHPzm>g6meFU90{&psh`B(<V>o7Vuxz-SWiWO{-bNGX*^^*uOx)ik5}
zE1p|YSwRA!w#wwGJ>VCJe}1GvEXvgsBGF<pnwM4LbR^ong7o%NvibZO{d<E*YWI!Y
zFhs?lk}bZsX?I>CPmnG=mFru$zV1+VM8uzp5ryx~@(XHb4058S%EVS6<8FcyIItao
zT^3#^6A;df)N#0urrJ%RWJh1AE~$4BEkg(6=-p_z5GL%4Ss)L1e>z^2a!5M~Ot>W@
zph|IdaD}qvWXu-zg;z$BJi)UzQ_KO<j&G(GyRk5cNN#Qqu_|7gZLuB!a%DzrCAl6w
zfA){M*c$xJF)r_l@!~3XmQwZ$IfLbc2eJ^H5gmTv5b^U`cT_baF=%{+uW<YTw~>P2
z>DIeEJW8SSWjtT`fBS(1T01}j@zc0fX-VN@QS0AInGY@Tp$)=pCQ$|M&_T=E$fC5E
zJZHv?msq3z-~f32`Y>4skArflw3E+f#mw{xrTcef#J?de4~aRRpUdIkGTsKdJI)rv
z3q%*VNIHoyRKBG&!HK0M?-VDXlU|s^rVhvnWKE4n<&_0zf84;0HJgk58x4HJW|J|m
z*K!NBOCsVKEaTLz`<#y8zVsKk+9S)uBid-rZ5+6zGG>%t#hp*qvD+cuqble{QAkt?
zi)cb}M(R3%M;>3*HL(>mah8qQ7g9NnQ`-O0n3MHKbst_DJM9tXt-GiM10>`t^*0$~
zP0mJ=T09C^f2oj@sFA8aV1+Mc*#tILlI(any+p_#-|TE|7+6!TmU_06ds@jzsW+;!
zNNRQ>@YB>}Regca1j-ILa%jllgGD#v>5|C1q9{FpEc8h`vO|&Itz2MzEjby^s@|5W
zM3xB8n7xe(5U^gPmB)RSCn5up4u}*_j#fS$)g}(#f1WJdL`pw<Q>8eyZph*qbfj?m
zvI+I{3w&`%Zh+D;DvPnM{KvZGw25BOM9?t18`WYHJmDO6>JJV=)F3NM=+V-9A{`WP
z;aJ>S81f?)^=UB|zZ-{gjOmPk7p#C&?c(A_DpNV6FbmuOMGqjZ2s!#MUgd~`A)XWF
zhllm7f5RL+3F=B-zXLK_ejQc{y#7QGY4bmFg<-2!B7+D@`B+H}sr_YB6d>H#RGR09
z9YJIDafEXi1mN-kEkJZW?!!$C7bnRtMhqp+cE_WGJx;unK#Bu<^1*{7bw)cUH4Kx}
zx{T@-VHaQaf`@w!hBBNe9W>*PTA(dXN!3?de<shBG4pJSk@Hpe4?71hlP-1ata#6+
zPU<xv;^kaLo%uQDvK2)Z2J^8lNb=dZ3BCTogVP<922XAU58wK##|6Y|_zi#mdk4}d
zk(L5U!7>Z$HWEO<*3BytKL;WS7z!teR*gs8l@RIfqe+l^@)D)CfoUcN6ipU&mR~(S
ze_hzAVyD@CPJL3#i-A2>Z74dw9XGWyIFbD?Z^A9fK6dq#U|Pht?w@E$WXh=nXp#Xd
z65vwRS1?Rqs=^#85gF7~4)cunj?%6GfOEMQ5~ha2Yh-7gYTc0)tL+I_&@SZRutXTb
z!n5IRn5)_~=hUZH*k61u=@2+!IUN2Je<H<-er)vE9vRF)gxzL!ka+ZdQlzpA%{R_f
zjS*l~*>F-|q=jK~F+n)_Y{WXaE^CklXQwkH?!|<UB<T18lHx*k!`#K>z!j-;=gO;M
zJ{shZ&frw?#KGWbOS_+FILHNRC(nSDqkEpi6p3~DLfZkU!A^0O``|M#@`(cuf8-a?
zU0A14qkEhoQdA8WcT`VYf}2{i`fUvL8wn&CE`-mKA~P;-m_v(TtwCLq006ykoWrAx
zK#K50Lv8~?1LILs+cG1~4;-^ns)*y}LMu%KhXPcznZFqqrzo2)|0JrX17mRgLTF&;
zrQnXNc<7%R4cu9`v*uv0S-Yr`e|U&6A;*+#72;y+?9Bj)OFYX<l5^h!x~spKuzfZ_
znI;1HlFLJm@eqEdkSR+1wb{|<+nZdEBf_raoCdYlxTqZFMKs9*%~ivTq#8tj3b>}l
zoMb!Y9Kj0}!os1@@8DwR*VECkLznw*ZwIf{v!3eP`c!QTtS6I1$6EoZe=*gU&xd_m
z&l_IL6|6nJCy7pMn4#&!@U0G*Uo_1RfD7Aj=4z*}WpmC3F&AoBr-0wKAsL4WdyT=D
zR#7eqWV#_&JQ9IAm@s9~33cD5y<1GepbUB`NfJYPqCfXv?L2$A-+S|_`(o#KzegW_
zg47><sv$DZzVr$x%(P@ke^Ei?j<CwpWhivfM0zkl^<aPs&yV$)g#eh|ri>T3mRHb6
zAiE9(+p@W>{kX}l#`v=q=sf6`<Sn_*KX~BI1NH|;6f{ES&dL*jRZqm1E)OqRX8<*q
z8wyW?@UOX4Rc%UACLamzJXlQh8I59bug~48kLC{fah^}pvzruEe?|1Jg{3PldJU3&
zi#C)B?H02G?P6d7UGevW+CDtHHB(!IM2~X5?RHy52R8<~)Zlw>Dqjhz2;p{hrIP5M
zd&$>n)WQgO9sym;dZ)?W&dCnfBSN*pU;h~X{8=A4e7z?H2uU!JD=0j)f82Y1{QAw&
z6J2X9P@JyX2CI6-f7G?Zd9H3=U6jj5P3O{#+#`YITGxE|w;2BF!N*;3fO3IzTSM3Q
zyyIkJRsmjttGeP?g)fK6wz$FTF26)t^*H52&@lH*{}VNz!8YvtbhRPZ7v(}@s{@qI
zCbxLB#Glf{MI6yqR*=;@FdlA>L-QRMF1fiw74s}}l3INWe|QUG3hX4&tW}ax2lKJs
zY9k8Jde&ofw6ZrCldRR3`r>D!Y|?piMqOAaPQz~OL}Q+?r``1&3_Yb4cowLxF^jX3
z8wi@ivjGOME%rh8^~;@;gV(Qm-@M#;-hHx`rmPatoMh8<RupslO$Rdl`y3*AIALpz
zI#w%%rTX=afAw|x$|Rf_QN{dxw+!vLx;P9Xsv3H~x_|n9p(PDd3$VJH2lK+$dzk24
z(Z^Zp5Y5Gs?pTOq$&SAYXm;_OuNqaV!2@MwD4HvQEFuk9=KD~6>18cT4j?3M+s|{@
zqU&fZ8pu(^i<`KUbzWTL;LlBIFq}W4VEigq58R#5e`WQ&_cPnXdIJi8<5Xppq{BQ@
zqo6OERKfMEd2Ic5vMZR!m5LL5TpEnIZxCSUD|D_U{3|;?^#i&;9N+_Ag#|b^+*P**
zJpMDOWB}Ea)1eXRZ3=2&$q}UDRTI|ye7lT((C61+Fg=+qSeytc-^@PID@YcuE}<n0
z-_tTZe=oh&)X_q!p<}4H?2wot$Hh7YKm3bE$ivz3h`Za2cwOB*>z_2eAL3R{AGMg6
z<c-2u*s&m+O8EIQmjPX#F|w1|85D_vK^&J>NcYdVIklj7<h4R|UGTkqLR@FX`ME;~
zKN(F%0-%M|=dnb?c+iDa8;65p<N)Jupp_8Te>5=d@)2^1Cu$2Ny`3?lYzGf8hB7|6
zX)KL%H|+au>8(p|vB(|mI*kHu2=<psrklp?FwcGc`Y=_0rYFK#K3~jG-I)t=(DybU
zewnOqZhe*fW70i%{_VlbmrYmy0*>yhGvYT~(4PI2)b76&bS)3sgfQ>ANW6E-5%XQ{
zf1`=|hPJ0&R*1bz)OzyPw#JFhs<JefLRhdjnnvvAI0k<Qda<nt=%j8{&fy2=m?t%$
zPAo=`%}n!TU6bR@E+#2pp~Hi^B?DncuA4(nz^dn%+$n%D*N71(2d@sevip;cyyVJE
z;VmyaenVq{3k1Lz??y;gq0#nN2%wCzf0n2Si0N2Nf@(q}$RWF}MdCo9^04!JnoULn
zShYAFXfZ{Otjvd`#L;3f1(51qmaZaWW4RlK)f@JMA>z)tm3Ctv&1~Df?c}w&?WKqd
zvgeS#()fnYnB-&GK74EfolV=|-~apnJK1F+lNd=wSdvmavZuF``*)N-?{k~5e-#P|
zZkxDVCikl>?|!nR3^V76jvSVqt<7&2XN>%omz@{+`09g=8=KpeT4lGienN7b_Xh~0
zhV5v@c>o;>CJ`JZoQD;+TFfF|-Q-V1#}bYPwE-(T;b#;yW}DF~YiO7;YwW=B;u5f=
ziG0%YjCBdw2wEL$FhFED3r#C`e+6?0qB!~}Zvy&AvL2jVQQao38AarXkYR-gjcn0s
zo;p&91Jm3%%+9V=|M@BDI{oe^7A4B$<Nnd;r`ms#;8wEwv0MI;s3_Jg*JGM(a_|5B
z|M`DN{v>_=$&;lat3<$@buPkY*!~%Z6BAz<H{I;ix4*3M-a0*cEbQgwe_NnMt@HP4
z`p+l^*g(=Dg>!O_v#NlxvVGOkn`r<4@xT24{=ffcT38(qhf`d5^XQVJaqpQ~M{gYh
zYyUcg$|tag`l~ikU*mY_ZPx?+gy%9zCjp;HKClW)7MB{<<A%V|t>M5?cutI8u6!S&
zeM8Yow4KvvzCPNk+m1iWe?rh+!KVrrpQ(57vct?gyt&5+tbzwJvkASw4(>`<(X|^o
zF2SXE=-R3K{8)elq#BZ9w*(s2jNviOy%jr&Ealdwb4AS{0a2lk{V9M<4_(K!jKtGt
z3l4Y;tY)RY!)Ei~;U$N1@)tT11Ik{STK8qCVm%TszJ#G9jPa#%fBIQ|Q`ASZM2qU9
z!$=54xc0UAGU|kO=XK+~K%9u?6DF{fGb<#XL?0+!a6;@3liUB)Xq?JlwIcmRQCy7k
z&ZPV^9a2r!3u@zQim|NgbADb^#?^SIQF=Zq!oSI8v_F`F$%N=YewG}?nph7Iz7ZsD
zKDN0i&-_y2_+IJSe>rWPL?!;jYYnnkR@*h*MS}+<(urT$J$lnpZ%!);N0Mi1jDmhJ
zpv0`kprv_$LG-+MrRZ76f3`mP#IFwrM$jUe#Ie#((dK07APPqdP>BhJl`mdIDM)w2
zrFJHT1I&_|fq}86>Zp<qgnp?d`tsPEb?&D?QP?}^GHaI>e`3*yhd-};WE&Y*!OlIe
zp(WdB(UvKzJVGhM5rUE%6R(C-y06S)vM^kLWIdpbro3<;HX_x$JmVRd4$sY1cd1OU
z&SE7~La#c3Q1E9^c|zAcmP;ha!a1KUuFK<rBCaelXvFq5-lA63r~-WcDHV~SjOLS}
ze^97h`ACOmf2u7tYaX`cYi$G$6qwA@lbdPYmC(rbXNyVmZ`7YN`rlGto)NYFt-ep6
zTJ8Y$w5_Igr2LpJ%x8Iimo6~Y1zZCaJFJyEsQ^eox4&$KmN4IhAs)-tGFugvX^ufX
z2_4EWn~8NaqO4w><wG%xs6*W`GGSNH-yyV*G;y{aZ63w@Pk-c;)RY9<SlLwEN5qjh
zwIP1E;Ba~|11K6vf5t8JP}S;i^h|KebZ=l(J0!Y*HE9Sq<E!zeV)yN%jo*HO*OK)|
z$@9^(rguAJ=nI@Y)t>Z#O*?xh$g(Xl7F^zx962XkW;^-A!HE?GE2VlU9U8PflJ!4i
z?=smhyChFGU4N|RAHF+Gq~Tn{yzRR)L1<e{!S*I|J_>;Gc4kK$P0jVh(2m^n=oHXo
z1T!F}A!OW;PLM$%mMOtd{b2|08D*9T@=z(DAMkXaTo+uNQK&Lil)>7llCi+u&@g~N
zPTd)g&b91EHWjCgtbOn3Prc)p2ZskIy`66F@EJTFI)4ad_4eS-tL^~~r0Ub*QfnzY
zNr1;{P8L@=oh6!HMnWX5I-@1`U3?nXr-W~>g|fouQYCGp&(KQ~Oc4ViM+6D^dX|rG
zG}=t^IbpJ#a0!b@lV{XH@2NQE2?>g##Vzyqie&Q(&}E~3ik@tK@$johFvY)~X%|Ox
z*QZr4xqtD>A>JJ+cDsR|=4}1?WyKGD4oJA%u8w#X<fsZT(xud;G@qx-Hw;jsYxo9l
zRMG_yg}5yyT4rKZSwLg}4q8HHR|_dMdJg+7$V^iFuv*Z5R`0tC#AWH2>=my=AeS}M
z;<~gf0`thheHKor>~7tx5-KvWJjzNUr$hvTlYdG+0zDVSFmXQvP{l?dqcbfcg+@e<
zz_w&}Rf6&!quaxnTr{27&`r$lD4z)9v*CK;$Uk+AAFIHng6*}7>#alpMNV;j_%^5U
zSw6^^Kh0gx-;z68yb>(eEhbl4iJW1HR_l8ehH;8GJi(~}fk8$WybWwFWK((yhyG9*
zRDWGJZ!~6=h0eHx?ErXSMI@RMNWV@P?=$qLE}Zlvdh|_q|5&Z^cu*CRDuEj+anu*2
zq%#OL7xU#j9Hw-oSPPk{7-10Y!l;-otYe>%w-}w=;=ID9B|HYm0ox=+y?prt|E3ME
zVPeGGyMOBTcJ>YrUb%=P87aqxbwt1kjeqJB^NI4UsF~ya?&~+lyZh3NM)@Q~an&oC
zzh%QehtaW?tc2qg4i|Q2&3uddCr7(GM?ol*b!<8t%*X3T$31$4{<r()c>meKNmtU0
z-0%f40l1aaBuyj)r=wYc9V??pMX_xTW10Z`5s^jNbh<O69e4Y4%--LK13#K=o_|@H
z=)T~6UyC795o#PKn--+L-x$Iv2e~0?vEtKYQh<=i+sE??Y>;swqQe{FCqOz7fKHI%
z3iqtr^Bi@-Q5G&7z2IgxfvXa@De-hmkRmek`qt6DJ?kBjkv^ZSqw$Squ*2t07Ce*W
zLK`tBJ=3gg*X?xiRFqcQOc;ni6o2e^PS%;nvv=NdJdjs7%n|rUKdPLH0f>}9_-~rb
z3{=omnUJR~r=2#<lZz3$Q2l}eO4Uvec8mq;ht$%lw9Jb<gXUTtqw!fmv?$HifG~Ph
zx-owO#y|@=$(=1s4RPxcl{B?vz!l`@k`$W>a_NZ}*b2&pfUA?+RB$~X27gX-MJ%)g
zTl*>bMiG0LTq1fL>#sP+2~Ltp{z2bI?Cq%fKBC{;N}YktnZCclx~V1n|Mh<|OZ)N#
zH1ujIw#6P4GrhB>-Jz|+rDJ^A9>4Unt|1H02UxsvIsfL15owQ;<)7BjcO#MG(a?Ty
z7zW+?_#RcPhPAGSJIuG>xqrK<z8n!Bm<=wiMng>woupzYV&|$b4Mra2C<D$FP?Q)3
z>$G5Tp;4rC5SxyygO#MkdKsY^254ei%<@ak5ccNPt)&z{{oZOnzXZLAf8F&X`q;89
zopa}~t86s+h{bk`Y{9k<n|f7*hWJXn;vF)4(6<K<ps91>8lybY>wkH%C=vI{URiIl
zjb~H)#Oe70`xoG$-}X_B0l^oAD}7Ud{Hg~2N^JnOx+Lp;(qetOZC^}2N#$x%O(izJ
z1e<mXQfHY?dj6yRC2MWaBVo7>#Zz#K!+HX(3jPEqUpPBJmGV~A)Ab3MVK@_;9v(ap
zQXs-u8ftmls2)5h_<yC<^05&aj_#QYQ)Yd!9RgyFZm;kBp)_rpLG#X03sL5BR<ez`
zUYCCSWiNKF^|G>u$HT_|v{Zevt&Hd6X6sCgm6_pM*hn>MNi=m?+W?r(RNydd2T>6)
zrPIItMshLUiGf8Zk^0&PZMS{pqjFS?T#W<b9cO}m5?fL#bbnYSJe0TzZLyMIjXb4w
zF}Ac4Z@BI}ThQ;ld{VTM=k!0Akz1s$mZX2~-fJZ=*|p5L)Jl$C9O3TSO%rB@spMeG
zbZb>20p-n-0T;<*go&g-DuWg1DbcSt`-0G8ksP#_3}`?ePT03A9OcJ*dNK7EfA%3?
zkpdX*YF<WcQ-4jC{a~)_Synn{I7f18WBs5vYAF@P;oR9=!--{&0P{#pZd0txY^2u|
zO07tu)xIS5MTf8XU!?|n$Ac1EB^?}P#7TT;<}kS!7iS2XX$#-fRz0n1P}yLNf;AFR
z=8x67jo@u3p%qU%&}ig?%OY9hDXAYp%xpE7mHs83m4C*)#5F}SG3PI>OAeLAO0GF^
zTBq8#F)tgPj&I;+xxt`No_eTf<Kp6iaZFre5?8XWZUu&?5VRVFPQWXr&S4!D)ce6t
z6>G;ow<3z-i!XcfXv9J_I>7R5B@`x~8KS<J@rY!#=nPM=jb4u0FlDt;kwW&_iZgpX
zNM|+smVYMVHt&?=hhTH7hq|2Sb$gOgO)gwb2GOdlKj)CWu}*?3DV8e4W{>3)#D(xl
zcb5AUN%2>zvqTu#owJui--!YCIa7jFOF3Ve-W+?0f~~!7a8%Y<)6ZjNhSFrUxB5fU
zue#q^4*DP_ghN>g0aiGwd@3loh$G$%GB88WH-F<R`$^zXgo8U|H;RW?6Tn@1qAs_J
zH#&Wqd$IIYnQz6_@m&zfAF*QbTXgU$(kORw2k`59q4gnCu~=emRUDSBC!!lTV4omt
zCU(?wcf#OK3D5`MU_U++wtvNHgi$*yLlOi>!+kmm0u!W=Vitr#g>gy@M)6DI#zd+T
zcz>T;0>u=%&xeXFMT9-ZIJjD=B=$$~JKyCqU|U9d3i`rGzc(U{cz8+X|5E2K0EMBQ
zTv`Bj+4#ap=a=EFa__p9tnZi3gTWSXH-9duC#m%$2o@2nNHP0tuqIz(X1>kysUly%
zi;Ft3LmulsCrMZmBJ0sU%9LG4>;c3JjeoD&9Qee6AytQuV7IV4?3#oSaq$WguAZPv
z1^JxXr~!{NSIcYq%WHW_Re=*)Uz`e;MKSl$Y-&p9+BQHNhBPm;x%Qzz{52eJyKwbr
z%Fj{|z2ljhuAwpXY_rx_d`8gqKG?g&<TvgZkq<Yl@%nS$7oP(KBXiSQORqoJ;D3`%
zG|6Zyn1pNsQd?IEqm$1E9chc>P?{=%ez?)K<muC;*L|9Y#{D|m>UOX)X6KO<iaV~<
z$%<6a59caYS1zdsGe~Mv{r?8CR*-0b-W^0aVmJ^g9d*TIs?%X`F_I3kJ{CwBl%#Lo
zK8%m(v)o;kc6W#D78$kV9-13F9)E}epI>D+>Ptq|J(fg^+Y%8~?pw+^38}68MI`kR
zgfuON9A&wEt8;USd<0bh_<tXasWh=w#8vQ|?V3g7_2O8S?c_e^+4x!|94a5-0@+tN
z5}P{5WsdQ3h*43OuDGhJR%KDM{~g97v}5Dj(UL3ybZ|yP3fW|7_V17{P=EPw+ZBu{
z1ND8)0^i5uf+Zo*P-6CTF!3O=L9y6aq_J8}%V!0Uw`$>3U10ICl!Njma&S~?vbY8=
zK{%>fCcO~M&cI?)nL^B*jC$w$ZnFPvSH}FTn9s-g4D4>6>>M6MW3Ao<U6e^5Te(d-
z6dwdVf66`C=ttmr;=OZ7MSm;e1Cj^^rlKy;aAbVZOqM*A0(nEDki?5D5TK~9a0LX~
zcT-ZgcCNC&6qX*dwXyY(1KOgCVVY<(0q7o!J(#=+C|>IUD>RPgfW<>_^r;8<8(~66
zqY$KkH=ypXb+I%hTzDmph-<brRh#u<DH~RLjW|r>GOb5#(9t+lK!2PXaC+&AJZP3@
zGR_cXl#qmpYPXs^BGt$NM;4Yg>(|gh->`b9Eyn6Ob+Ml+PKczyQ5kEisA(;ElB|94
z`0>Lp)(pjm{sR=TQ={N&Kk3w7aB-(NRu|Z#?d+QV#|zC7v-#VygLle#2j9I|kdD@o
z_EKxFROBs5vfu)WW`7QnB>Cuj97O$#KobMVM2FgA$cY>d{ENUL?+guzPwhFS==)!y
z6!}lOVw>~A*Y;9<0w3%GqWnd{#Y1lcjY^X}cTg=M8lQ&V-S5nf^y%=RDQ8tU$m%fW
zUVuAgu2@#&uYB1P!7*-R*JR&R;E<g)6mL7PQ1@fJLTS~{w|_JhpS7GaPlZ?uG$x$s
zaWNzvkw|t`yN`Mq9_c~puQo<fuEzX`eL$@c)A2}a%Afj@%v}b(Bq?h!yP3+~uKV7@
zji}Hr-k~+Ncj69clm0eLQ^*eqagG%={}bSim2w5uSetR`G63_d*Bm$-!09T`i6W&5
zN;nY%F%7j38Gq&76RMNYQ&qTjH8Go=HG(<q)butt$YJ3#%Wg6QDm9!AP?kr&fi9i$
z`81$&Yfj&~q#r5&Xi9||Y)5>?3*2qzL*igCm_JV4Km$XFN@cd1M0bPE=9j%|xxC8C
z0?y?Wx_>zB2E`5RBh;c_1h6Jst0__1{kk{qHye$oiGNke;k<yd<}q*SpzfbSOdR70
zzXWnX>;y$a13+gI@Tkp%3z<0G;vtiLG0~C{s11KaO<v%hab}aHREsWE&PL!Do6oq%
z_L){-csBS$uDQ|H%J8l~KH$l+mpB2I^FqauBl0AY?)We;JoCuCN@B^uTwW^^1|eeI
z6Uha+7JoTZOCmowk-7zip}QK0qCbUDa{!s|lBt-#2OSfQF3zYM;~UZbW>P=deTJI`
zE)$y$6c;fvYera&rJjAzChjsRCac#?3N<VMCQ?a?%W^un_vYQl?0R3*Ygv?1P*hLd
zq3Wxueqv23UQnw6%ON+xIqj7tDN2j`4-<o|u78rPo4}XdqYzpPl>^4(QOR+6>i9f8
zq!tDRs&^#&>@M~_ALh#*<aXHp>7fKgA;hnKz+d*R{3EWJX0m>|J1!Q(<TrGbkl;%S
zY?(8E)?E%A>4)_WT}KV8W-}ZHiMv{Ybx@3n^b3oZz=nm2Gh+iy@%|=RA7sPf4Od47
z_kVO2FlNY}RWy@owv()Ki)WC5!u%+Ft!0LiX4dZbI--}XF$->`#TyUR(^|#qfWz~Y
zW9fslL#kk-7o+#V+G_1yOn@p=4q7NVdD$i5o8$#6QLNv#NFGC;-{tvG2ufz!ZpdMI
zWpM4`D7zrNq+PxvMqT^VeX$42N?K+3)PKp8EXiy2H(xYCtn>EFAbPi~R_#ey!)PVX
zcaK`h&R@7^_eg(8F9y>z!|!yG!-Go?zBwClYxKlI|K#i65N8<`boG3EGm>n+7y0}z
z9M$>_9lTs?cyDwuLLJH1gFKtGpn$SfkLx{MXE&|nJ0bvj;q`YfS^(DM)0Z1b&wr(j
zbSO=v1)6}ZpIS&uZ6JMz_tWCtW!kiQq2daf6!jH$wV-=duxLBWK{zX|<W<gf8A9Ul
zQ66^`8>Eu`Fgf+|gIC?&dYNKWbcmTgTg(;Z3Zf#HBV&=MC07)6YnkRbeWXhB%}6?u
zG&y&`Yt9bc=M&G{W0dum4m~o4Sbx<$H(QK#BhZUD$2NoVaLML7t8u=WZY9s3;mPBj
z!*+$NHF?LTh--~$Js0=AGFjh$`3&oVfA73})>M!|dB+_w>&JVvdeVOPpI_3Wiy1Mo
zmX|hYGI(8SnxiH4c_uuuXAVqu83rhG6o3Gt_iWD|`#zlA1Yu3EVFh@leSdSaoVH0Z
z`{C53s^XXMEIzG_`P7zz_;h8j9m;9q(<i0|dya&lz~&$`=Bcw{Q<x1&2jE9K%~o<s
z8^uqze~EcSTc8#AwesJ_cw8BcYa2h?S0e;X7Uy#@T1?V~CYYUK>-nd_kJ`i_FFQ>=
zMaCg^N82jFuc9R!bjap)!G9*9oXfl%M~q`113EA@QD2TCUAloX`hgXDsN0F&M3{WF
zu|#V{-NC}e7R$02jHFtH#=|fwvnfus14Fvsz!(BQ4g-?}3}Ogk>NXOD0i<ByIYvcG
z`k=%<;!s2s9nCF;z$Y%Dsy5eO5L`900DYo778QqKaT2LF)SCdfn}0Vd-vhH(DKK^*
zJG-=we@JI}i{p5?=u9CUPfokt*YL=XoI>qX*sU*n{7kRN7W2y`M>i8|va{DR%nz@u
z(*!*q&0j3e;I^FQ<D6QY3tB%3Gh%(-?Q--};LkC(&D-qgptPFHp?*xS1sQZL(W9;*
z7?5}=4vX^wsYP7Ouzxmtm|ASJucZI|i-VK>mj~UG-u|oay0A6Ur+fQ<+~0k}ek{7$
z!j;|EuTFLjUhN<Ec8~Y>_FtVG?7T$E7u;Rnfocx;vAz9ocHX=^p&QTXZN4ObuJx@>
z!M((U1=@}JmoH_6vQ}yCJPSt60j3e#a+Fv9+nCenB_%W?YJbZ$MSfOXL8#U66#*$^
zXi5t+L8z{H(+m~kBIhU^$eJmewS#X4qA64Qjwo~TT_nAx8lf;R3d8|sYP>Kc9Po%K
z7=h%`Rs=5<D@0Z@L}_HCg4=2F^It491$<qCOBD*KDD&W)4aAnJ$GWT-SSq3>PX#=E
zvjQulCSqws3x7rPW(z6V84hYqLDbmT)%VP_RNA(s-Z|kcG)77P_>j=^fo1OC)WJ_V
z8RV%TV?<*vMI_7Z0DmY!P1}w2(>jRx;DC<r{y=A0pTCax!{-Ke@dxQ+R)5rw0-4N;
zUNjmypi^$-2QKRfDJxREB#c~ec-6LT1-XgN*)-t>y?@Rp+E*JJ8$M$jde^#EnuB@@
zWf;fcyy-+9dF|oG#%6O#MO%7ii=>K!xf;Q=M`dzCa)EWLn8?Yx^%y;@bZ+bM)?-o8
zPmuvPw)(H`Sh3%o%^p9{a~DFn#>sb=#d!E3(~(SS$;TbC{chx;F{cySV<{%eaW2u;
zBR#*3YJYZb^|&!i(^A~Lxl~O$%m&*@pY!HBJ5w>Hu+dpfd)ai_SFOLeF6mK;?GakT
z9d_5@`eImUJQM<9;>Q}iv^UedaylqoDb{miu$YaVad(zow*^}To}mHTm*%&@tT4h#
zO>u~{sEH%_9N%)g3!iX5K1a*gk7yMCZ8V0F<$nV4W2t5VKQBP9r}!9sE3kuBuQU@n
zUEUR=@&Ee2@QF2XY3`>ic=(!)qgg2xt)VpIN6IzX`6*LC*-KfYSZJ~LI1Dy4WnbT-
zqNX(}YLv9QB*L=RcsBA?8JW0!Sb(cE>Uz*-c}JwKx&cJxTv#RzRU;Fxd3AW*oxIL+
z;eS$dQD85#AB*VlYV7dLYqHebh8NKeRrXNELE1~wVT-|nR9AKbTbZ?ki8>@CT{^aA
zIjxUhu^fo7Ro~#cKfXn@+_RTCD8RkK=7&g$C3%q)+m0!-`Fzk;v=By-*T}`FV-lU{
z;+-{;*%KkNkal!FvRT$Ob!C=(%do^63x8fn-$hkr^q)zeKgRk7zdcO)-yfX3NS^)a
zXs6pfe%b9SRuY5X1rriPU1mw&KhEv7EjFwKNV;ST&GTtXbL&Qk#V4`h!tlX3JQ8A$
zvODh6THMn$Z-36;)2S!>{CF{Ojryb)PIY<kAP4|Liw_>i0nFJ}#Anq6FN2UdUw>zE
zHL2@9YR}WBWsVqgqJ7a$`n}oktjANKb4X+G^dU+t;$}PjsUB^8p)q=njU1p6#%lVD
z4|(GV&CkFgF%#+VEX~T)tyY`lad6F5_Zm|?@b%I0!FLBQ_n+_Y^}^l#G)d1_zsk$t
z4^y6DF2;!gFG?Ss8ZnG%R%%H_M}NhanTkx9>?Jbg=y`XMi&)6Kp%2fGcV3+&@hi#6
z>*VXG6Sm)bG|5kYSAB^e{m?rSl15rT?aNl(rezM<f79K0zTY>~L|;5ZeWFj=nwj8>
zu{98K4ABfLIg4yYf?S?E5C*z9R;IXuWj%Pn&e*xPqY#OMOarFk-niy6Cx7bSk)$YI
zD`9VaQXY3s_T3`6dHG$xiMscfjKY&mgsbCt^0x0eqi*I>$Q6$H(5hE3RM#2OXcVd_
z<PXC_O_;Yo?*w4mnM^DQX6IV*QH30xdlYU4zKx&#buQR$daL=Vc}EZO8B{5^iCuT-
zfnmWbqDa+My6jYFQprF$vVVgkn)~!>I<s%!?xcS&@jV~gK;xN=)S)S4qy9x9!GnpF
zC&ke$W7Wr`khO!;<*JtzMp)fAJY~u2S4nsG#s1-rehHf)8eFTg!*n}1>jA>ZYOK%|
zn^i2T=uoN>Oshs7sDuNnSt+{Kli=h?ZeWhi{!ND&>RfC40*uSDkAE3>PM7ZoF1J7q
z0t@3e=u_-Fe4F1m6Y-~%yuPOmrPL5Wm1XV1*28MFEW<hU1?Nawmte4W!KEwDoQal^
zTB(fbzLn{A58s!#Vi%zOY2%n^v#CAQ3@bIvA!IKvuUj)KrXDD+-sKI1IGf~(?jm2f
z);MhE+smREyfz7cx__9FB&}<n`z6n1$zdfFO)Y~~n~mE^H~bk)(UFiwKqOLmyU>0Q
zz+(j=l7Ia^49xNNEonCBtH{VYo=JXgdHM=^-%7eKcf?FF9!pOGpl8iKEW=*u#4ZmO
z+OXuxaSS2#)$M2v-5h9=nB|n7)D{P+XdzZPYgN9Sx3en-^M8s55h=Set*%*9X;j7k
zm4!w>nAs`nS}>g!!|FlMRzXVWP?oO81>-`XyA_qUu|rm%JGc<{rq<S}M30**HH7`G
zJkq)i#v=%2|M=K-=k{Bj$zcIhchBeuvRc0>MByjdC@41+MY^h!*ikPVrmcRi4U~39
zH7HIV_ox!4)qh)@GUideG_q=eZI90obsD=3p&<`WMrh{}zXc(_uT8aL{)}Z`dj`hz
zW;R|6D)`vR@+l}C_aMupB*KP#m<6xNO~pi+A!{D)(NgT_jPVSEV~I|TM{ncGQ;y9B
zrYrWbMe&|0-fVxhk^I;&q@goZ0R8dTJ9~S_``zx(?ti-WrzidCT$h~(iCJyR={8K8
ztDbcaI)W36@;1z<AxwaEzb^1ZJcec9FVwH3@)a|Q(qOW);$7Yf>Su$e@hW*!^7>~o
zr8QBJkIP`;qwT~8&%2N|_faP=*Nu;e3};Co7bO~l<9CoE_HmR@2oQ7%E6Qr4J#Q%2
zi>8(SdVf<c#oD+SIc`b=NI7I;z-+e09u}IVVwyF;VK%#Pz#R@>`88$-6hcTp-hI3t
zCW~yt7u;w#vzv@VY*%t3m&uEhlcR1TLa62_LpwX2kITDGT1Tw#K(p)6Yt6*{ZYPH(
z?rCs$46)VLE^)1bGuCII*T54bmBANtVmORaz<*&VW@FshJ=|xgv0_k+TT($mmuiP8
zhEs$Yfy5<XV4%dhhdikjg;rEo3rlk`!$DtoJs^$oG3a67VJ9!Jg*eeo*E~3d6=g%E
zLFs>?m3tNNRT%EBu^^QiSxOoT5?|7%X-!<sFLbLtrE}O_f#^jS`hMo)X7QzVau_mg
z4SzClgw)@D^ypzfOw{QU`G^ri8ey>x@LDwRnF~mp3EK2Gib};9Zo*=$^0zPE%%zGy
zBCf&J;hSY7OTMi_`X|YYTq>7kK3|2yj4M3E4>vsKwAISIK&H<$yrDmrNBRzqopn@1
z(PBfnt8NpH=1zD4`pzyqzZ@U6EoT_gE`QA+oei_;+|bUaM3@Q#Gzvn>Y~ZfZnG4N`
z5vC-4iFY=scmQkhjS%^e;8AK=KIFFXJE;9&myGb_3JE$^6B53?U>!3Tw<(|f>-<a-
zVSyz!r*H5E^O6+U9)rr>f7t%=exu=qtt1(qDXc6@A%-MNE3QVCTC+anjmXR{E`Q{z
zfnRsPa>Nu2mR0M2!wzR@b~}*+TZ>AYO>}$nk;473qJ{idc=1wVFtF-KLa2b{cvRfs
zSr4Dy?vSkB8IR67Qx|a1;R-)^Oz6|U^!U-kE&ic27PM!FEni?J9>2Ej-dz$@ljP`i
z_vASVFFhE)zkhwax2;5Ql~<qGdw;eaf9o>O#`8-?pRneT?6sYo-rqgkOS>=jU%tHG
zO72fDNFIe9=_X0vxVgLkgT4c&=ImWIra9gyt)0<TUM#4o$E8~d(k_96`xqO&DjbE2
z6IcAEDOu2Sf{MGX7-cmyR$b}ambAJ!ESjyD;5*b0cNN5CFn3vITu^3YV}BuzQT8CG
z%6;2O_=k9d96;Nq+4N-XZuk*8dh>DcC2hDZ3Yt$v5AQ(|Xxq+hSC*rV_%Ih9rq@83
zPuxt=rbZL>?aml5cB$DO-}F4Cd_t_|6Iwvn=o93@t$VEoY)+IJR&1J|(5%kJlgdrU
z!$eH{=yuEMh=sX+N<)90fq$1D82LvvMS{&O1oy#r+c>H0gnCkQ%tg$@gED+J=JC*7
z(da<G3nly9|E7I8UC=A{H}416tQ^VK#-pze8y=t>+RXE3k}y`@kW~0Sxxe*%bpON5
z>X-2(nIm_Nj)-sfk9*ILU%xqeqKd^`7}hUhQ1@_l3tW5<3r^~~=6`Ao^RvZ8EBSVR
z|ETwe*Ux%;2Lg~S(L?-RXMQ#9L_MmU%lCp0XiP>ax!jP=U>GoryJ0nUO$>G#Oc~@q
zxtZXTo?g`emNpvRuDj^xPK-=4Yed2~y#c_xx1(Wn_!=l0GO-~$Y8a4I9b+6zkj|QD
zbZcy3Y$vb8$?#{ZrGGYJYqx`{A`M?OGsf}en2+)3;&OhS<KN;%6W11_B_u1H7~8sf
zP@XR?2Q%as)Ef%YJl|%cl!dC~`RCk~Tc5BiH`=xPa&t?!<$utglbLn*UP*{7zvlSn
zUu!SkiPC7+*^t0qzgfn$1BB=fByPcFztJ+U>C<abj-6&=UVmD!tB;G2;0M8|MSM9z
zaTj8MR>#sD876ZvV|fF?nmy`1G|w*D7|$~8YL~X<?g|>bx0(#^#gurjPQJWXLyz~C
zN%CHmD%UpG;>*?J;@<6~d9Q{#@7<9=@72@jy;?HWNwoVRMc%6+%6rRnc`qc*dv`i1
z?){Yxi+h#x;(y*>^T@dODW}H0PdqqajSd;@2e>pI7etR++3;<w@go(Rs;cEo=Syle
z_07f#Fsx2n2Kkv49Qw*??Iy76e~fm6p8o>X#=U+Q@jm&@Z<3>Iet9&b7T>S;;hVU#
z(C@yqB=FOnPttR&#b2i6_*VXAQ&8SE2X}AeBh{Vg#eX~LIzb4+$87ZQwP3@qlCL%r
z37z5429I7Aw9?Y>%MhNsCW_@3a*rBrvDIh<tio(>$z;K=tYVjT-!m1t(g-_XpO)_l
zDqPSVUCQuo%-O^a8KTiKn4`nqX*4*o%o%Pav{|B&1DC%<%h*eCjk72szo8NNL9pgh
z^tt&Lvw!)0<l_B9@`A1Z@8s+Za{_T(-uMXUGeC9aEP1)WEsiU1km#1@2+%l~IH2WL
zWIDE<E@cIoSr(;LAsND~TZmIvFn7yKKrF#G<Dz1Qqf#RT+bH4A26fk?ewrdeWN;~k
zBGX~tV{|2)Zp>w~Zkr(&pKtMEbV=*eU?r{t+<yoW&KiwxaM;)2i~F^Lu{vl3u_}wJ
zsd++99cu2Ul*V1okGS{pv8L9XN*6z4!&@JKzpRy}>jjCB+f*$qOPX9&j|=7HI#F3-
z5LqM9lJ`KHxixT(#kzOJ2<TFSJa^zP$fD(#FDb;fI1^<>qLSEo%m~5~qQ`#<mfj@4
zCV$FOcSxKf1lO6{_YhhOt{lFYtfow`$*L|>eFpPfwVmHW;VwZyy_Tag!1U(=W;`61
zwQi5QQs-rM&S{H5pubCLx*%4-^Pa!goL{y^j694pwLj8aGen}YpJ28iEii;?)KkJ|
zOpc}I7~3dJD#z4ZX0svJ0W{}Avi@)b{(nZ&C`!1+g&2Yq6Xi_(x(Vt_F<w`G&nIAI
zV{vtuk52dvsu7i3wbh2iYr$NS&)1~S29Um^2Mwy?h`p#}TiI^BdVR7lkgA9r8x@Pv
z%F$<>vOHJR+F|T5Z-oro!A9Bm&K4uqk*0J}BDAE^25C;#DT_Zn&dYorM<E0$pns_I
zpg1Q))Zl571V_^qB&IL~k)RJvxMqPAkJq3|M@!LF53cnh=h8-cK4{X9_?g`s_4wJX
zTfQ1}PlbjyYM^TDPlXQn*hy1;(C+G1nOz~{z-={^J7imFWXp<XqZ20a_#TV_!i#2c
z2^nbO9fGWhSR*75<L1b=YL}N1pMOD{V1zIYJW_U=4Qx4|hOD@GAs`pcO3DS0_c*9B
zml)fbWPX)qa5?8=*+RRH_jmRV_kTF$JTGj7t6YI4<cY?qi@Ah}phQ~ZjXeH?IsLhZ
zE>$Xw1U%1ZHb>b^4s;$dhfu2=@n<?SlNp;R5tL?!tA@1w+hR0$JHBc7xPS5qV(;hT
zk&o&;Ghla^w1EC`ha2uMe(2ggV2Q%vp{cP_k(})l;K~ktNo`p&W`!8gz%BtRl@Hou
zKF?R5*F)L$Bl%Yoep442`NZE1{_zh=s)c`EnSbq~>pHtdJY8DFb`VY<9H(AF^@}Hg
zY~i7sFCV(WxhVKa9)iIiHh&^-SrAjBCW^R?H1NC%niCLV5|Zu@5}O`G6iap?9X7OE
zll^^(IxvuaS*kW<9^KSFLV3IKD@CObC4CncZM16@ekB0M0s?#>lcU;8-}x*6uMV?(
zoTv^CW!WOWQ4P-l<c`1?g}~Iw`csmS><n(MPU}<*-R{GL6{Hn#k$+$HinBkHEZ)=N
zKfTe!Aq57(oyMF~c{<gnQ<|0eY;;Cy@G#}i0M<N}`b#N_O{5n^Gl(+hU>Xh{Lo=@8
zP!(wg1E7vu#F!$^E&?bF13}cdJrCgHGRGQ?-MSPdG%s<9)I)w)(vy%Ca6RGDkeax%
zDqSgg{r#)`W4!ObC4X4uWthI$3R9%w6tF0*#HasxJ*WZ5aX#ubsfLj#CG`96BaiPR
zllLSww!i8j)Yfa9vMTsF0$NvnrYX2os8X-#bxS&UB`f~6%)gKTR;K#J4{4DD5f8(J
zMoSL8OHQIjiD`-T8W2S(`G!m_t|IMg+3Ck<me0KWTR(j42Y;W5D~WwUeQ2L#eH_H!
z$wwO;n&xui{Em~`EEFQCjL&~f&2vXaG5M6#G0heGs8lnbT1N7CZpd)bAI)<sd`_Yb
zrzJUA{iEkSY5vLA^6=BXV!za7d$7%ov-0{C?XK_jhPIu{u<49x(k%G33}knU9Pf9;
zt<sO<WJ^64Cx19H4N|z6p|14YhaMV`C4ySHi-!64;6cBWO-I^xN2(I_HRE$J0Sppg
zGZ^!;CFja8S$~|0mX@5HyljFZkN~EoK&7U))i+x2t22n^u|Lc&Q2Kk==iuM|Vq*82
zTzOpQK2%#vsgW(kevQ(7dRI1v&)g6@lkQ?9Igyx>2!9c))WX~(n_~}gK}>q#h*$QX
z&QVj=>YF20*k$4IfZNOSG*nT{W-6MeWZkE6qh6yF;XJ3a>eA1Z8zYp>$>2tzpxI0|
z;%tCICXwc_9Q_4K(h!qymA%Jog}zzKu;P7ZdSOe@Zy`v~)pZSD?HCV$qTaM>Y$zwr
z)lzuP6o1N3Mr!LwE8$jBEPE>#DgbEJU~<fRxct&U_y{McO8Be|KoN#GNleWf%o;t_
z)c0dCaXo2sxjK}N&bibU>Qq^m%EDpnax>vwCmrgLdol^VDRTQj$a>jHc)EtYtFrDc
zdQ?seE|gbyA4}cC8n3*GrB}>^`Ui+A`Ycb2=zrPo9=zOtwY%SYvA^^3<VEl0>*rmi
z?^VnSk~)B#Y~78&z+?=F)9C^Vpg~0kU|F7gcvl6sMtA2(ZX_(cJkK=(1EKNT$ujqG
zQM20?#;M>Ad-*uK>56#>QKt!PU!!8^E^TfIhqqo<K*6KvSl7!+%&f-CuI(P~t+kRh
z$bVe;Z+eb@S8-lA1!#E$Yd<u?Alio<MC$@*C8pLz&pvdPg>M`fjN0ix#oNF{QX?;T
zW6MpD&}yqMs5DLzH-$GWa@l8o7Uh}tlTOmN;N*U?ZUtrWg;VM6>mA~ZcgNXlGEQ!F
zA^?%gASFFq>+v-PHD9Yfxz<#9FC3(SP=85O|0n0WNd~S@EK$B5MCjW)%+m#@z3xMu
zrH{y9mY$79V@?T})nKUR6nF`CF#Ino${nrYsXvT9wGhI+;5@U>26aloOGVrd`bpgc
z8e;cmGO%0(ON?;k3X;=f%TWbd)e7Lqhdt+7;4bo`5u7&{8g~K{eKxSSEzaVa1%J(C
zJ<7mhA#Ir5DCr4mosLle^+BgLXkMr28LZI`amlQl2V3hxT(1tx2J7X9%^y-#)m_B5
z<Z)llK|WV~a;@nLHE7^gn35IPi5RL+%6^s+x`qHluV|o}j|Zf^@p(o=U^NU@i@+~E
z$WpE`iHSXB#A+D1^$-sl$<Nw)w|`yCF7UgvwXyYR<I&cm%}0;u&(6nwk9E73zuP<B
z7JH!>xDI(w?C!)v3NSUfgpyW`j2{Cr<4FDD5h`R9oafKXv`pHA*_{2ulaifCTkT}m
z)>fDc>{XcQ%9q<HN_1EZQ7yCvEG-C(8kIpys7<&iXL8bXxOh^BMqV8gPJdWVsn!B*
zkJ=pBdGPAsgp`%zgQJrqie}QBB=e()>np8k*gx((9F3q*-#ExwcUeZqZ(jA@9PRC#
z?Duwedb|6_CkNjg?BeGR_2y*f_(VmJS`6b)uU7-lU6h50p;cB^M#_K*?7so3XH>02
zQV>Z7a|v;r-kEU;DD0hEhJSaobMm6kh0k+3E{BE)QbHFQm6u$%{onul|Gi9@a79Y1
z6~p%SU%l>~yzJrw-ILeH`%kod@>TH{qTH;$Mx#rY4-1V{lFW0hb}of9NyI6W->@`B
z^LK(?ZA-U~_y76Le)oiX@a)a2y_fq>q{wAC=A_25N`<^Jev@>&FMoMTdf$-XS;2{6
zQ*2C!JR9}pudDt3L-sDaU%F00R(hM?%%L5nqbp8~Oi95&HFg{>#4=`6@Qt-3WhY0J
zl8Md&2!;J&{+580AxXA_uIos7wfM>QpWl`VTR?Nx4DWAlJ$&@|i!Z;rpQMul=(E##
zY+GnN^Kj1r*A;_#B7d*5U4iCfDERKSpH!Y0@c~k@_QJ@%;}}W&4?Eu}kswbj$iR2N
zcl^Z3@tf|6JjZkzVP1P9%%5qNlVHHkV*nfMBt~W`*^r8ezC^9A3Usuhz(5#1GH3W>
zY|v^mq>X<gk>+L2#-ehW!`LC9z-Q}pymc-{Lz1Y0XR0NKX@BC_EOVpAoaif<K}@^D
zV%L(LzU6Fo!5QnWJIU#F<a4Sx^gbA#5&4(qvpg4zrCzY7nx3IL<3pc@vs1n)H5F8T
zzA7fiG#ZB+-=DGq6xP;+CiwL~q$sLrg&NcJX``Vivc8~GHEF!zF=;O@gXcat#^}Y=
zs?&T-3&G6T>wj^h2srxmHudesO8DN7Y4)~wn?@b*@255HAx>kc;7@Cfu}#I3_7M$)
z#M_8m$e-9q&?E8g(HZWGkA-N_JKuLdy#yJG6!h}9^uIw_*D?wzHdaDGbF2r~T3kQf
zhh#q*gcgsk#F?(Fh=3}K&8F2kC+-gERLrlJ=Dmb7e}A4&OApl)1ZxnnvYH3uoUmU(
zL-2-At&AiQW4BgtUk$t80-wCjg{6lkf&{iG6h(1yg!6?KM{+();+h8WN+-p2HseEL
zsdOrX<b;($Id(uKs-=gQN{!wEC{%~t)Ncl*Q+<>Y0|0oHuN{B*!^K@I1znlxYE|XF
zlN4D8m4D){G_*<~bS~ridg_X}rgyH&ifJ*xhp4b?BMoGvl_gB0nx(782w3TlE7n>q
z!rBy1evFM|*=wVZ!A7cc^0Or3Tv{VO)B{r(s1XFC+l{|{yw{CO+Eg)=R@Cch2L<$^
z+C8j7%l;Jvm|}J%gy`nlVpi^1nI`v)#8mLLZ-18F`<Osaf1WAiQ`wP$fdi$)cG5xg
z;buiKl84JWW~gvI-i#>K^l~lE7f&(E_YU3ynhRG@V8e`rK!AbBdsvDfh-(-k97hPG
zc%1t35^kGkR-t8A>TZrXUnnSpL;quAwIa$l7zJ$_0Di=EOS!|}9qqOd3rde@eJ=;}
zC4an;i<$}iyUv@&+R)@>^GZZ0<M2qx3|9Qe)fE=+i6aYGVTlj3hJ&a;Ux1hmL{9CL
zU}QJ{hWJMFYG%O`nqDruzPsg#n^E2|HC)?Tw00?wvOa&<mg<?%_8+&m-gBv^rfZkW
z^>*poX!MmkTB;54^T)%|y0J?KA{S4NHh<XwS6!}X-GZ+V&)U=_uI<Ch$634DtG#DO
zsuFQAbp89bR{1q4K69+`$nj_@da;XImRVq9#+_bQ4A8n(e6SR+jwD+6x_v<`mB&xK
zU7qowN*yAiN!e3ocyBR<2aSk7ofoNpD%BvZrl|K^U^BpcY;vH~l^CHgkwLUorGLKf
z%!NY-G~A-`o=dtx9BJlFu65yCpQs}>Me`c^U^mZfrP@%I1Sg>$1q^AcsxkcpZAKhM
zIGtknE%CqIF3hii%y>^D@UnC^EK{SlX2j&fw2;kq@@C2&XLm#_vw9~$;hSnch9&VE
zEq@|lO<ES-^9fiG<y&G?fp`c@pMRDnt~t{f3){lfwBgt6!YiwAPSRRq=Nx>!E@vgH
zd<ATetA@~E9h=4nNm}G0zI8JoBCU84OCLvia?5ebm{Au+F;rYKtwF^hqlQ)Qs$4}(
z8irJ^{B(VX3Vkb2d{|~VPOlQQEJG25)UpV-OPGXcE)OS}g>|^_a<}_327fOr0}<6>
zPPxNaP~bRY%Lk3rknsm~n%z*RaV5GxtkMkrhf-;XU0#eBnComd%Fo%c_HLA4GflB#
zAvF`6e}`lXp^1sB*p^r23-y@c(d(e(uH;!c=&Z2UBrO!z`OFBHD}l)h_+Xgj3cjV5
z9I>vtPI@?Wtr)<Hiv-41KY!3}xXl$@)sz=3pPvdMTKcS<7+LwYlnWyT6Vz@-v!W@y
z$*ThWx{ygwg#WPUsmtK05E92#@iJ?II!1(oz8aK{LsKH%WEa}&X43<h-~!=N*|@bl
zO_h%^qeL3YWj4*XNhhlmt|hA4O4g*1*mN<2A!u#M94|#LJ?4j8Zhyz+gYisI<yX4J
zTqfAao_l^1h2Ed!Gm?dgkN#64@~8e(48sW2Q9OL1Q|x|e<?C>Me_HZctxhs1Q`Z%5
z@d=Be^5nXC=*pZ6r{aNey}OKLr)w9g_zymweRpXGR(2hq%~H4rJklPEJhOCK0C@u7
z9h?;E49)4g>7Xxnc7HDmsXn}Wuy>rCanQMu=istH3Do5K9MpGF1f<vB+-URvbvD1~
zCzy7Wle<x;$hDD(mi6<Xy`W?+U-2%tyqJR{7wnHdNVg7--hE+JW=wXFJ2mxbX^V|>
zV*Nz0VJY*3xIC8&!gOz0^dx3!i{p_oQK~mJ4B|v0zEoCW{eL4WQz+%ZqaYNHhoLqq
zr7xY$g!+KtA$BX-`4{<+3e${5yZ5SV5T#hsN`QG~)d6Jr*5W;c>4sF`3>B;cCDf5c
zEmhPLMR}n#@sd8GjvA~AXv+%TaORUdwWFykKIC>ZIpY)^<i=COJJ8XzG}<@EuMd^q
zL<7<<9>fTb-GA;2%xhFFUCRJ*&W$~1*)x?7<8?M%9o`%qb%-oEilgsCJ3^}B8j8{^
z$w^boj5%9eTp*L#4K<S@z<m~2qG4tB0d)ge@DcI*fC2C*q+32(WUi5{W(Jzcnd9b&
z`56gNM01$nt*UA-y=6~1=q$692s<ft9yxT!wx0w#^M7l8hF$%m3dx12`C9mKDQ%if
zTgV}tjRtiRLJeXu6FGAS-cUt2Z22&A6<L4~hML4}zuIAyhYHD^yiSZqZS*T#6?&8}
zHx_YHx`hkGuqQ(#ath^3aK!}{M>gxWbj<7SN-2yHK49OkPqz&;e8(DTSwu46C@+-k
zprK>!u78=^3TNB=qP>|OZ{q7GszF3-J5*;YY&%&$^2O7>>yoPVu5*&3hFb*s8Y5eC
z20K@cznHKHKVdZWt0@XIp!O*9sGX3>vKbQQGXA-mM~euM?)*!#_sq+$V6kzLH*u2E
z0!Yos@L^qR)t}BanHQ0bp(mGxWy!qceBJ#0G=Jw9RbEyNL6d%ljgL4Y@O+fdLY_E0
zGoF}(N`o3zDv87B4DCmx&Vik#v=aafFQu&lkNCHFKIP7FSxh7?^Ii->teEf16ESyX
zB?Mz|@pLgN@dr=GEa}5m_2{B4#wqc>(xt1%L%Za+o7Z51=<Ptypd)=EOxgwPLH3bC
z&wu%{meS_kg`lHTB<eyl!3Op+8B9d&ihd?;1C)f5+~p3u#?KM{)!BWqbJTmux%lnN
z`PH~-1p&e!!MZ`9Oi{Q4qMl0Xejva)!_(u9D2!ceH(+r|he#fW(A$;gOepRaEhbnM
zD4qRp%jt;R)FUTc3nvhH5}gG@WZo&Vfq$**=GF!%IT)cZFwRKxhaT5Cr2eF;5F#dQ
zL>ui7;KA5d*O`?ht0q{FiwhC;|6D+lE@^5V>-PyXd(~N$rxD|>Q!y%r(K#=NlCO~+
zNbccr&j&<U51W^SlL(dT3P)h`2^TWqNDvzHqm7N{qqC%gIojAr4qhL1Rp6M5q<`n_
zZ9%yoSjmyD2yGryxvMk#&M~+>#stwBXGvtj_G@^|7Ybbs4{tlLMW|&eR69*ywpK=#
z28bQ<=Ge}ZIr92HERbQ>5*?uOA9^QsmsIGL5|6QTce!-p)-;NfQVIve+*hqvikqKl
zCX~b8tCicc;k!|p2R5Y8P_&p|7JoB0!6$|euU{SK=Wh5`2Pf$RZ@P~aa`+KJ!iwjK
zj+(9X01MvE4j;e6bbhdNSh<X&0|C}_V_5&OAJ*@UvMXm)P2;<2W7Vj3No?T*56f+z
zV`@8eIZx41@37ywAd|CPYlf8iSxltCAsz9f>N#<sbtT<c*n;QTdntjwK7TYR+%~d~
z!vKHD`;`!pvY3{p=P*nZW>wb_?Jmn7!H#Z8aGhj2U2rao<{v{DCtf0`3@pywvKT?4
zS>UK}1aQln{Ao5L<v@Cwc+?SB(3PX?-0OC@m+eaWI0Q4|!Lu9w+`OOzQ_Bdl)gq4V
z%sG$B>>zLsB+DL_1{%VStbcTwxqAe96>!oIV9hwYE4+QPoR^{;alkcE5!^uB;PQ@e
zs~0-V9y~Dm;>*PSN-hWbKmE_pae`7JxT5jH_*1{KcFV%7HQ-cu@ZdQY@RLBYVcDZS
zr*&DCJ(!5bqM7tZvoPr|NvzcOpd#4QztiXNA3iZr|GMNsh=`L<=YQckve~|lLqN)j
z%ENrJgu@l$zb6Hc?zZXEd(V(`(x(52z@>5zQOrZk3zSrJP|%Hp(YTpp{_iH^&!zAI
ztuM5;Pe<!uzP6pL?LgXGYw7hJ7AJ6>-9=~HdRDmyED{foWV6XO4Q^W>{d$&P(92J^
zzgGD$9Sxsu4>|pL`+w`<*(kL`5;t6F0!C5#Ia&-_=%wfTT+-YCL8_#-8+re5#U*4M
z>?P|gC#ddB@^9LA#dmh&Iv+0YEKCyDMBqLV5DnES0>%cmr8uR-K%jMZMI7Xn-+zrM
zvP86}KH88&ZQVDCkb1}a&ktU|s?ToQcBx);7wTxL*l+$t!GEuWNsiVhU!>PWVCm+X
zLlwKHMb^OKK(|3&6q2;C`@iizcpzBd5~6}ApHukKk4OkO;HT#|x05*H#+10R_?*2#
zb23at<(iLjli<TpASPhgtEBiSJn5$g$K9Pz_!f?3P6c922es3uS+t9ib>^*{yN)lb
z=P0qg*0c%P<$npuL?)v{4X-i#@z8JaX6YwErBZXuz@rd26nwpzVu5gRI`VPsG#Wo8
z`?DE!=O@x0#tSCrpBg`<@{j!&f6|lvqh%g_F6q4V{w^{BW2$0Xj~uQ>y^L4%KI0;4
zj>6IStHOSBP6lgwF!l8LnEuH!Pt;SPxdj2}c3-i&(0|qmSZH#QPx7dy^-sxnq$1FP
zfMs^&)rZUT8F0CuBEwEazGfhcG8;K(@d!~jYHMh%cFTx^#Q9*(m&$+fVe2%*DRUF9
zOf<=>ZWOPk;b!DcF~zWAfWiQ{_EBiGwGlxZQRSgVs;gRb^(_Hk7_$Y#D(*<&p(Qhj
zS>b$^34Z{O0-~nLn+Ye7a=*UGW*1hEO0P;#Ul_QfB5T-nI<$&Z)hRVhzn-LfIb0r*
zge$>;%1#mWB%+t(inQxY8yYod+Wz|cufFJg@rc9Pc8(9fcoZ!!wXk#i>fqJ$?c{re
zK00Aqj5bkeL8hZ>I1(2+Q!##oO0o07rOAe`yMNKQV&BT7rm>~BrBEH$l?p9@p*5ot
zMESbQ$av1tXSSz4!jbafXmRDtIn>>nW#HEkA)sc6We=dME$e6&tFJ*rRcBz!dHVu5
zR@pFD+56Ge;)=8YB0K1tUej><;|uOenXEtd*!;xEW)gv*o<_!fFUDhuhvDR>rfSJ%
zCx3(WU)?hwb|ArGJ`g(d_7oTmo?+iB#2U<3*debp2+!riii5~6ZF!5rz8sjhN{6r7
zJJ~|$cv!`A<!$NalDf=MYj?)JwJe5<s93?{m_&5&gfZ=fJOI`aJO0#-^iZMi)d$gX
z%T=MDR-N}ZV0O{RZt+v;bJ#Z9$-xmUZGQ-owAnrhI-?TM5(iABN9o*LTt^DXv@NcZ
z4v8~drBaFp-QDJ5?cnH=T4QK$Q`vD5)La9Wr}#fG2ARQ9G2|x2wd@n{ev2cJRfQDI
z>>le{=HqwO;)HDeD12HP7K7$pdeCL9o}*WgJcNF;zl&v+RdY2ir<f=$1PQ!?K7a7W
z`*mLmSN7AtDEy-4qgy1Wz9M!zh)CARc{_@@iYOhM=B9LbL{glu6qf=6fRm0^NboIu
zTOO6h;Ah%ZpJcU;A0riW4a=7Iq{Tbx<w5sk9|&7UIC6G)-X}S6Odw+h1L1n9MpEo*
z>;jBH>LhZRM1yqnd38~SrwSdRWq++wIuGF~>c`6lW<7Au&|>16VH(T=ywh9xkQ@xf
z+@X(1(yxo_+H6;(f+>fZatESWyH%1&v+<cXMO~@o+FbA?M-H6X%rgqdIo>_e#+8p>
zWm6OlL4k)cTVU(<x!Rtl0WWZ|1X1)rH)8JFNMyH0Kg{=E^76y?w5NytSbwjCC3HJ*
zq+Y`-sXYl<=pDG;?sz0oD7((7>B6CQUOodQXy01I^~EAxN`ZFeVQ|@$#$%RvyUv3f
zw~b0j*;Vx%ST_zO5|JIbPua_UOn<8N5^h?+(#IT434?f4KlIH9)jIls+{aM38gex9
zSNZ#S+{y6lSjh?HmFFX=vww-2uOl{9bFI?Njn$JYeUsK}xuuRKkeBW<s@~P~7Y;1=
z;0Fh|wQ7J>&8wo*viuOmpnXvjNC%%5Ck6D7qkV9^zt^KreG|qwOXx)1Be7^&l}GW$
z>!TA=b$4Fc8!JTDx<|tpwp;H<(v2%I9|%Is{g$F_1T_t}UP^k?34gOGQ2|4l61%iZ
zdw+)%jBNl|K&QWv{yU=SB<mc`J0D!GP+73sDym5{lw_gGQ>U`)5)olx1i-t|Y`$RA
zw3<3%Wav;VvPuOa!XSuBU0t{t9xihYKXv>%hVltf84&OQazY-*cCz_y_vj70c<slK
z%n#W~OM_R>ri4(NQ;k0UMW}xRVH=|0t>@nW=w@f9xKfIDBZzLuKC{ol4zx`N<wWHE
zLay=w$bs>jfn!f2K_)BKmv1T-egF1i7~5aJ+&S6ro)DeC+~4W$KkX;$aM6FbqS^9`
zteWgMWla?LdzM4N@h~PauyO?+<-;M8+8i<)7;m0Y&??aK)eRrSI7ol6lqhjSjq}+j
zv7YUZo*1^1Kkaud*k(5Ohc<+DqKT7Ti0|k%{RhX4`Yp}iYZ@My=w{;RC;=g9*#z}f
z)tFe5{vW!pU-iB@RE&>S(husVDyU^t&C1z&1GDefd(T|e+o!+BuNSYoC$Dx6_n&gf
zTsNivRF-3G$tRk!*pGivDWM;`NPB0ob9P5WJ4%2VeuW`U8W&WfZmP!{HoO7y(FV>1
zMoW8B7Y7#yr6{VJz>Fn*SB<xoFsf^Mo~*_eGb;S)Cqd@l?6c#@;Kk@<Epg?<0LJ={
z`S-CQjP)N!u{l-~+{`5n_8!D%QiA1_Og2A;^HDw?mSW#is)T=8^eUS$1Ededy9-nh
ztf>C9B~_vzO|Eyc)BU!$|Hu8^H#j+Z$FE=R_jZn7^#uW(oiIN(ezoREeb1kZYum|b
z<5$0;+rRqN8rB>hmI`lKYw=y?Ex7&hY(iTYOc!gwZ`*n#zhztC(&L9;$R$XihqCjm
zZ`!+{e^_d1@>hSssIY6-WV_lu&_T^*(|pj@eBhg+?;ZuW_%nR#XZ-sI>0xfHV@=X~
z^{U_1E4yu5+<lKdCfo^XN59mneKp+r%ddY{UT|waz?7E1uVk_`RSeB^#A+@kMXzdk
z0hEvlt`cX6oMLoKK8`zkqyy3i;QYHT5hSF2Skr)J_wawO?17XeQoO;rH?<TUJS{#%
zJiaJX80XThrDw`H@wKaT%0;&DC^a06S!Qfa7!^A~{17zoeocW9g>@M`;zu&CwI6is
z29U^GO0OwMB3*i{R}?1^R~p(?`XAa@<Jto^H5)z!%fR^8^7o`sVu~TC?96zEzP^R!
z@J?S-LG6E#s7lw2q&~i*Yj5km<|G|>Rp+xTB$YLDeC#ULIRZarD5q;Ag7QQtPgw&~
z;V(FzvIeHYmu5tTG%rUaogj@umj!R`1oA3g`6Elayz*<#G0<hdz&CEPULL%9^G90v
zpBq014o)YE*STJ51#`LecO{rt#NjO!hadhY5{G|nR{vwg;g6RxUln3~(F<Yaty=`m
zt;DU+FB3F%+URFpJ?y`}02*2&p3y_*62bBU&%M5?U7x2*Wc+?jLD2pxadNGT0!p4+
z_P^M8L@bvUeo)K=ZCGTqFG;q&DVs1xuK5s4eNlo)K3cl9K-tl}6*x=(2N5Y{B|n=;
zi9&x^CvF*K6+>YYrO_(F=EIFIx9Ww>Uo7GMy@+YQK++7i|MKffpPwKj>bn1DkP$-?
z{me4r?b4V3@LyB#THc%W%vE<7#8E%dat6Uh%=5O)a@VTk{A?l~wsJ+p!&d$e5b+`~
zlUmtMp7<{j@4rO6K*XE;U5a=@s{hF)y#Ifa!0s-AMZD=V+xGrT-1@BImcm{9Z(7=_
zA;-@rbZMu`d@#%BuU*$pf4GA*w$!oz63YIbg)(^0>qIe*;Q0F$!2UD3oPAKt-J~zP
zur0pf{>O_=hzb0g`(HmGt<Zq#<P+eeciMkPg2`=i$zN5-pb7d&(ZbWn-_lzM;;Mh~
z7KWGqp1p;C-$%P6g1@O1MZfwtJ*^!-xXbw*aEZU(!TfjT5DS9xs|R!xl=xo<_2)dO
zm*YL}cwh%F{-T3>>u-H<|Brp@2Fv!5r|<HD|BX-Kt@=}V>%UInUwR5J5yjv1G_HL8
zzamQRcz}ih@0KNl)bL!n7!J9ZANhX_y@}6c`XYdfeSP*05c&XGla!<K?TB?3RLN4H
zoorlfR>C-28aZvwaZZ@k)OE=-0u&HZjU@O}kyBnz^RRN@^MY|(><p|1F{k4*P24D^
zH=Gi(_o~~LMhwdgIX&}VWoLqAs3}fBC65vVUvfQGj*vP>A;<{WFRaRn6Zn6Fm05u+
z2nO#Uyk?TxEl|yc%Yu~K0(cXI<|Ds+xL_D!sf7|2R~-=((#ooeh0QUvQcyO(%0}ZT
z3b(zY*w0^(4Ezhq{owr`64tWbXxO+F2AjX7S;MD0-*$Z{H=UiciBu>ki}SevB}~#q
zDeZSM6!uBhrGe#wKurlTrZ0b<$|HMWv5NrP@SAb|egqg7$=JAi2RvFv=Um%R((5!e
zDM4y}UT5RCWwfrSYawg7ZHWks;yiT7(+rCqLcnJX8p4G(7_N%b=>`QOu({m^(41KY
zxDZ=n1`}L@eB!l9N5fUPPpP#iHDCfL9;pu3Xov)=r56%Go8UfvcPM}G-VQVZgF}`h
zNv);fk#efV;_9qr@>)*9n&OOqEX+8g)v-9u$=3h=-~TUL$#YJGJ_h1~hq7ZjuYd({
zRTQC*a&cA;W+NUrU_0dM?#qL_P{d$7QmRn&`;>pBbiHYS`1ugcz9mW>%*Vdbw~lln
zQSqMQ{DTh4DuTqL*Fk?5K|x*m)h;jPEyjtk??>-7!u)9iq%lNhIwObzE*sfjqC~$W
zO*v}+>)FLq`rD-H#1L{^p=@iI=JDGA#3E>xcB(b{uRwg!hBGda!;e4J8xAZ-dcxn<
zSLm=#1+npAc<J3$3UYJEr@g&LW$&GPMD|uX9WTHEc}?_|0(pPXmMt&23Z)F_c^<QL
z!%7B}sLNT<UT-gr@*<z7;oG%CtsSPTSc$}7P2vS|y5Y|GoxK{!?e4p}We{kL<8ZKt
zjHhy;>Ga?0hIK$W$e~PW=^+Uqqw-xb8V2eqR2vi<VO+%JInjgYlUH7Pn$kB1srE9u
zVf@8_d2V<rtt@|oBm31HUxW*VIu-<Mz$gX7aNt}OK3_-G(+j=%;gONFI7^;09gdGQ
z#8>W=Zx_;BJz1B6k|~tG_4o_D%#uf3LNmJKl5g&REl98K%G3M$paqC;e&J=u?&vQ#
zopF{iSPIwKIS5fwQEF!ydz6nmk`E&c(y|7GG=v-NS4Mx__waW#c|?6*J^pRfTv$F_
z1R`YX;p<2#D!|jO+uUWv7L7XlQBa{P0Xwk-FffS3;c+;1m*MCeGHCP}C$bp?-Dw0h
zT7T|sZS?4=_`G8fAsN$)5%4ksWMho(n+TrR?e$Y2%cm$8M-xmPf3fpfWF6~jdP#jr
z!@j5p)=z(zZzcaieL1$S^kp#51cebp*r`G@vTUu>85U<*|B|@fji1FP+p$X2ytQh3
zSO^d38e=!Nm(-){und|YZQq3x49{X_pgPD$^90Ab`OO$)4LvpMqGF@ssNg*KO3l51
z+Zm$M%$0p+9E|U%C4opgHBbaiY+c7KKJ_ldl+b_tymaCP-c-L#i}o7W4%Z`yzEPhX
zw8dY$4=IWiFbEUl(c5IW%tXwv193<72h?6VCq{RTj8R4ykXkhvyZNF!YR@gF`2hG9
z^!oPQsLEPN1vUN`oi=Df-r@nKIGgP_A%>QYrl~<s@BwXur5pYz9^U$xCsU_vF^&mq
zI;4Lyu=rIueHr<eF*vkHR>HNfqXKhu1mrWWn8~VlX(;!neJIH3@GQ;B)IUTk-}mG)
z%dXp!7L1z%E@wQyEkl^=r>ttYDJZG^?+;F1B+veY@So$CU8_r~&`loE)HGZN$Gl{%
z=m!FwK)>)|EmcdkLQ^H*AcOAZimhoyQlWn+0EVV%Ek9!{LFULP+vd97*gf9gIoVHO
zB6AOORnp(p-{S85t|6GD(F;H(tv-g{2=-|?xXiCIV_fq3o9@o@{p9tlq`UiK|8U0;
zN^07<^YhYk|5*dm@d~L}L!@ZAf#HKSh5=wrG{EO*h_}3*R7NdJ6@318_MVCB+YEm>
zy7E15+BE5PZE0%V!(XHODR-Zxyr(Nyq2@``FNi*KfI@1$2VY7~BtK&RPoE^4?MIuB
z+8d-N_)7B;@~^O>QfZYXl2I;b?er{>RcdGT9RCqmrR1D$vdQim#*2QieX1LWT~y-e
zFwjJk%=y`zbgZF*^e}*}7QzZJGL(PNo#bD7HiG(sPN2F+uckg6SYAunB9&&Tv1ZQ&
zYRlrf3WRY7v?i&sdM;UynofL3_)7L>U<>(?@~p_q5|-``8WRmmR@mt~eW?%J2G(j{
zm;=MEx*%ra=-@hgTnjHSvbPoKA1rcBAM(Is>=WTsC1YD}W^_41j`eZURW*O(_rZbH
zws+c2!shcE-(3+tsj5XI1gfQ;D5-6OzDk{k12KMVS0-O=B7W{2*RN<y9&NI6Lu*m`
z`+WI438q_m04{Jlh;@tId3|3xwCzUXN<A~jiq=xjK&kH;Z%V=Mj!fYm!j!k1{}e-}
zns&lFC@33RL4po9OIVfBaL9jx<4)X3vLW_k?6IJ1bOn@5D}FdjZG^1#aRy;F1Q?uJ
zYJx&DS$`=2n_O}-MDcn~i+N27#DUf@_BD<_;={hZ^g`O}sHrv`xb{-3TL`1|^Ml=1
z^72b9ud0A-QHe|`Ng^PRCoj8+R^+o<%K}p=!WKhrCv~IZ4>d{hqW^ywk9B6js0{nQ
zw+E@U$F$TywOBUps11f*!O`)_HXeQ7CXFWa;@WQE?^qkExi6Sz>0mURC2L<hf=oMG
zk5W1V`8a$>Pdrr^>Hj}_|GM4Am86TJzs;w}g1m}^8UQWHuI{EUbtp=*S*2Txba}bi
z-aryakZA!(R3;#bW%+-M{p&oy8T%Q|gRLhy@kPYEWhQPEq*ANp(On{d%z2F&Gp=8-
zb>3cLliI~|HOu`|CZ|Q{2&<~AWl9*n9o3jt+BM`O9g*g8)%5BySTWEYy;I+J<(=wy
zMDrb7+hXF31Fhs_jl#~x3GW=qt5YC&(S9)@?)3mqhBN~O^x}U%d!lrkawt;ZNJy@Z
zfq9paPBUQQV14wNYgkKkPeW|!H4BD&D4q~i^S9g%eF2K-7+*<fUZ<M`77#}Hvu^iQ
zFX7q&2Kmfjx-{<n>5DJ$-fX0Owgm=OKFAk!_o@CY5#%yCOVresp-rH1hkf?o&p@wu
zm(z)-dGZRiWNLp&m$laZC}YO(Q*wTi^<O5lz;3oz1AE(y;-R8;S_8|yFWS<j$x|i@
z<B$X`-XW!QRja8P%Wh$$^yBC1jy04LGh_2nANP{ZMTa%(Gko2aqQ4$1_P@o}&>gCm
z#$S``=x-SD+nvCd$#we`nrWk}g4$=*T}4rhS2nMybzOf=?WVK)(BMdOU^CvGf9o3V
z(KWcc-X+Qgo_RiM1{E({;VFGXuF;a$`)T|tz3}T->ke?~5g$wR`1x|Lwx~e`O(vOa
z)1@u!=qmk(B0jqPzV>TrsEn|}s}b#4pT&yeC`twu=f!67L&cfk-P%J>9jtMyVy=sw
z3{2EdOy7TY-clEh*s@~1f|2!YFP{39og>Bxg>PxL?NR!Q7{AQ;@WHxOT8#Y<Dj2Td
z$%?uy(*DXV+D;u8BY{-CPZ@g_cZ^qTkSb)WJWtn+hC>+pr%@C?6jxLTUoFgQ5Sd5h
z#vRg$%h}%T4xbyoeciT86S56d&4Lx9!s40H=%Rn`m4~?&M=5LrwC7;h5CDB2AxeB{
zg`?vK51*bMpZ?rEdVEZOb&nr>`}v+fHq@bCJgWM&Znx>`%grc`2T_|Ym*Q2^bV}pt
zVm#gBlan7GzK|ZVy?$qFxLj>V4Q%K!PmUB_lxXhAR7tgM*xq*nH$m-&`7^f<cn;xZ
zTjhTmlwU0a+H^<F`?6V$&r8eIFh<|``LB@gq)@?uhF@uUkprv3mmP`o0c{FnEKgJ7
zsmvk{A8>7qhp**A@T3^q4JSGiO9Hd#)pz-gRjI!__@-3ugcspEReepQn5p2%3xr@B
z_2{!=gFSMxF9{(Cx#1^m<<Y&Mnt|d%a%+E0hhWG>*F<_Xfo@U;&Q<nvrU1bFd(CtL
z#wL6eyb~PFE5W*!C!mIPZD9MimtI?91b7rOu7T(1RX(62#ifs8Bq*yYH5JONOAXfE
z^C_YvQQ1wwR7<yDXT8Z*hRasQ?fBQy0<!M%Q<X8z(zns}xEbAelYTmlM~<PHFaUpK
z6KK@hbMsVf=;lMad3yZ<vE28x?CcmfgSDxILV{ngK=II}Kku?sHv9a0liREuR*xHE
zT*QdqmL|P<^HehWB_EuR3p;mtTngwIb~-KoK8iR#``a~*g3;g{EB|d!D(&0qK9sD5
zs_{GL$n+wP2Ux_eEJW8Xg2iTs&&7Xw{%n8NBYg7k@x!Cj=(beSUfkZ^Ze?`4EwNJS
zKh3W#x12;5?64@6KhqK%GY)_7<#%yv#K5UV+}gR5@6HBQ@7phXx2$U!-?sVNCbStp
zE>}w+)wm^W$uQ?WaW1F->N{7pxFilAKZc*i_*9$~b&=B}@K5v>uW3(&O=5o-g^SVf
zDja*^8lx*zQ}8O4dXJqaLs;-3Axr5}PZD*u47=Dv&!w}l!rEC~!L$0XjxYbU>pk2x
z4+n7`5<I~iFdbAXwndzTFiG^}?$lb~?E)WYGg~si^Je{Y=_#gKTB}$*;1)#nf+p3!
z6lYw>nc5N?Q>spAdZ{P{Y2kkq%Ymv099E8+Z#COc)F?*j<X5f+CIz9V*`P3z!+1W6
zwXFI1WtP2+{?GsY|A_LDvF>4uY6>BYT}}>)pZ!hyjNU{K5*t(Ml|T!tpqWBwhyVHG
zi-+CQhffb#l1BM6u0HA333WtSEcc$bk~f!2vx2+czm+T7d-Ku52M>Q=9G*UW&^>+j
z*N0ELkB%QdL?evZZ^}~UnXXY;>Jr}XHFx;q=?~9dKp6lE1{$&hw`Fo|I0s6g!SY=|
zy-pxt^hep8HbCRKzsL6ziG0>TT$0q{reqG7T`5q)V?p;ifp|(&Am-u6l9UX(a_CuD
zR6#F1?f(SN*}FQoJ8XaG6e}gE>dDAjETsh-t8My6Jwj_IrAL`PX@=m<T980LDW7C)
zr;=%Cvg4#V4J|JYqPzM{*xh;^`t1t@N2U2YZ_)gYo(iqEcu;GOUeJ!Hx3ts9S*j}1
z-%;z%U01b`ui*n_6>N=Z^knW<`k7LzU?aq{P;TxTtWk_hdY6CN;s;jH*dwxP8S0Q^
zh1eFV(2`qCbJ9?WZpOb!xn39;l+hqcz&CN#a~<Z_oVA3J!Lr7ZQRR|QKG8u5-ou#$
zZqBEz>ZQe(xxKi|&FTezAPy&q2Ste~%5YdxT*g#8sCDbAHL0Fllne>l80^iS*lw#$
z;K!n$8F&a|)g*sun}zK*2~3V5fCFS#MQ4)C_B#f5wX^f3XwX5MDGSmAb6tBTOb6DF
zJD7Ur2n)}N(AoJ4QL)aRDCu6t;3y5M-T^-RIz>z;q&Ft3yI)3^bioxZBaO-8CY)HN
z?~yWsU}EZ~&oFtu3j;TLo|N<<+QSKH<Iv2Rx0?i~6Y+nN;o%#kHqpCXeb+Sg40Vl}
zGEPpOdB$mLkv@^aT_<$AwV%nxo_(KX7mx{WUGN_gq5~&}H4W2mR{g~f&tA@A`Yxk?
z@bUX}_QU)f4RCmfe)TxkujnA-tG~?0Q@&8?+h5J!_~Ea~HT@mGr0-wqpX@@>CB*k;
zIo%JVG&X<V)1TZ-JV^&*G{S%2tN%=A@gNz|cmI&T@Fgnzm~l+Z-}vD<JEV>u(DzgR
zGaWQ}E!CTWoPs<xA-dJIJv$i@(b3xl{;gS<_MMugkuUG3v-3Inr0>to-~2T1Npy0V
zB#1XPdsOge?*Y!Hb-xerv3<e+@KeaM!_WBFd+mQH9wi7zaBueYoAyON_MarlXzUFD
zrn91b!T<Q}>B5@E@R3?FORP_UE3$RUJ$YrmYG2qtd0~ii^htujy6B(y`f)mWnGBAR
zVKU-Bg<}6>p7vkfC-#bw{v99A@c}>mEiJ|%nOFE1Uz|*`tKleqi9r<R@21=nXGdHM
zPR@T5{Vt{9+I-q@Wzf+%LvCRkwgMK`6}-V{R`!_Q>AD<5r$@E)qz08|nRgT%<}506
z#ralkeW_1RE;nHXe>f8kK_3u2Biy4Xvd(mJ(d7D4<&v<mElf8N_a6I`;&Z-d6D@VB
zWu>KvCvoc{!#uoFcSZb4jGxMYjcHRfb}oO2#$k99yob{~U^QN^Wu+H>cxUJKZM8e;
z*RqDlle&GIME5i=NHT{;WK<zr>@avi6cR3#CFL`%BUcKagV`n{<T4i>p-y(o#nZId
z58RM`olU)ejXl;lgf4-#kWCUK6G+vshR)&0wbW>7=A=B}kCKG_hE4h)rJ+qX=p=ul
zU7Djsc4LKsxKh5{_jwD<$WO_+|Lu;enP%O%{Gw<@|Dg4Ip&<$It)NDXS*34&e)i*w
z?(x%;)5E7n55ME;;QPEo-M+?B?#r_E?4)JRya-5q#)xS%%?xkf=C!onoUk{WzP0AA
zU`-l;F^NY+B4@{Mc|!OCky9P*($Rkq3fZNFz$g5Bnq7c$8bU!0Yxz=lR62k&{=yXF
z!&l;qR|2+I=+2I}p2r(5r@ef8JDm5u*6V)YC61{q;oZ&`hO~&R+!fEjt$wJGe0Eyg
z{;l&7U7`E-jqc&$gYFA0s+tUlxQcy`!U~iuypLDFhK_}V8;5}@r2&4@vhjZkxwk?r
zPZ~4UibZJ|j)K@)$gz-<XW5Q>A3MA+4<IZarJ>DlkTtKMM{pTXXTFJH%<-P<>>Q2?
zv92^sDSJ-XpIn0iNapxQtQpTT3kJ_Qq+hEZc4IYZ?{LLC`6RLixDGes-il3c5{Yv1
zk`8n$`rqf->t>^6tCt$-1Z#h>!)f(}tsELSzg;!#1}9x4gRTfTMZ+AU_j|PLMs9q%
zAcqp;2bYkrK#BaOOQoeDA2qW!>f4a!F6C5v!8swVz)v(nXc#nRiHdB%@zhSif@yYx
zhADX3U}tn&0%K@{)#cIX@XP1=vKQRLcuns05_`sbcRQv8CA3zxow<L63yrN~5ni(j
z*wHbh8%CB2MQQOM@C`2G(NMxUaFiM{C&%t(NJrTqG0;VPSx4+1(JHWGt+~8+d3~Of
zXzUdW$Bf03!uH|RJbGcr<v)BVn%;^Rpq^sUf}ynRg1vx2!zywdAtnkO&9A{q<&P8O
z+ch3P`~LW8!!a4}rj&m{HBNL(efC3V!Le9@3{XmPv16`?TwwR5mb}QqdWH_oX}{<9
z57zZ=24K1|h#^4l5Qj8%K{OXVn~bi_L&y5F%4al?cd-z?_sU<e*c-DJQQh9^))u92
z!z=qeu8WNCCM!ew>)WmjX}&iUW+ukU;W1MpH5pd4_hZ4i+^T<)Fmr_8+kW$%&u5FK
z3oZ_%4_B~yCXui4fD@S%zMSn&u*$*qRdn9>w$b8kylvL}va^Hc+uub-$EBMKA)J9O
zup^ogo+J_N;H`Gs8hbX~aG6CYGO9WgXbRE&xJdguhcgm@&Qa%DvD#V|svtVyjiUEZ
zwk~=I@d$V^17m+Xomz{quZlr=tpuzx6Fdr{(ZbPa<#*VYG?Z1^j4MT&VBNir8g_wj
zFTY1ha{X3`sY*v;8EGuul?EuLQL{4*m>)dzU&oOI%nzNb<b2u`DmAu1_Gi<v<;AAc
z$7xdbS36w$1$3Ery>RH%jqhjA&QRT1vvMFiJYfu*`on(#$zsD%I!U@FXC9Nc7EjLE
zHZo{ZO5d|jvEjsULrql9TRI4JJCkk(mlmX4Yds0<3$$>y!P~bLWm68nh}5<>YmFMj
z#pQVx=cd%KAN_s%w$EKvv6sVS`+rJ8w)fQS+uDxmh(2F8n^Y^lX->oK+dgjsP{T&t
z$(ojXu0enJ8`_UWpS(fiUP~gG<8&AZiITkCs*|-3S)L{CV{{g8O<DoCnr^$+E{@l+
zs)%agqotUu(bE!3r0|oI`6TYmzB6YjyXLs)rW#&jmsxlXdl9`YbYw=VcDT%NqQepS
zS9YR*=VwUlXZx`+SnYeO?ybQ=bjDUB=S`?QW)^>@{?T@H0vjG5h9C(-&+90SS07h;
zXsf4{+FN*7(bt-1m6cX$+MZQk6&7Ztubz}opi1{!J%}{;cXAHp{>OXJ(2pOqR0gOV
zxA1rYwrBFeA1hk4C8rAXP=BZ%A0NW9^&OYtMZCE^O=9_2eW2ilTkkxXCzl*2ao{aI
zO!9xowvLjtX7}V+69csqbB0>snQ&&*zHLat4#Jc6u8)g&Ik$XRYOWrcrFSd<(g3gb
z2Yf1IZR*d2?r!Bo{PpnZ@q;IF9_Dl$a1`z?KLYA;UU>k#=a!JaI;)q`zdp0A1E9^>
z^(X3yByo}lXnJ$$ag{qnJUJzq&&KbT?-PG@dcMzFMIHZJKPS&X%nAkEvMa?0#9;<~
zum?m}rT&DN$yAQWe;%J6K6v<8&Ilin{a1IL1h)LJm{^RJr^SD8$#Jn^97_+3eQH}r
z#x__df4SaVo<4UQ<e}87P3{R_@gcJLKmVWqF9evRKhGIUProSNLxt6&j#S-(c|(7G
zqnCVdxIKz@eZ}HE9Y`B;<B<!DPu$Q?7JzDxL(Z-xkxD8^B*P?czN1@;TYXf*&}rEO
zWfwGL7On(GVpae#S{*w@_M0lq+r2ycOa)yD%ia${Kf3ym+&Z1h*?83a=Wqr)_Ilpn
z*1---LXLU+a0tBFi(8TQ(%>GMRce1O<rFSJYbCD;A6>#NOl;TAju+--hNGxP*enVB
zYNrGDR}&uMI4a<zV!xsb`(gdbFq2Lc@S#+(d4IAI+BJN|iI8Sgb!^4_=5ZBubWW0y
zIrNL}S!dvOC)zB|w$8K(m+LLnr~VrVj%FhD#BcXOZ^l#3TNj80I9C^JmbicIdoHj-
z3Cj=7?+JE;P?W`&1h$F0UIA-jH8pm8hF@W4kT&0Ia^w}wn8TGzi3RRRiTPi6uZL-H
z5FJLEktp1Es2D}!5<H*JW_npHJi+#etvtZNlS|I8ACKoin~?RI0i-jM06q3s=ym9V
zhu(`}*a>~kgia*6%a?F@aJzqsq9L>4Y@%$E7$3i!UgO^<=2IlI&@3UaNZyTZQ9RE~
z+GBl+*S)U!z39@YyYRFJ`CVGKM&kc=naFla8A_Fu=GkSM58Bf>pItj<2%(Il1c?ud
zdtTQS;t;Q;y|XVeqe+;GNd-r^RrLpNkxZ}y6N}$ow3l|04n}__eBFOTrY9yJL{$Ho
z#Gh|9XnEJ+4VmI0BngQdShfT=vI(Qqz|f8#hOMELoVAPy;8Oe*f5*`!@yu}pI=vl^
z7uFcVY4K-zxQl_^>Fw-1=ZHX#aEUo!9obXqkgFGoSLx@&Cy!-d+`e{68X1oc-<fnp
zdK*I|qAfkS+vFpa2kn0wm)8hMO{4TB?=y)+IVYiWMkZekk+~Yc1;1l_xG$xK7ewiU
zgM+I$2R$M4Ls(_uk~%nkU}TbUk#2pk)2?k;*c|H|I;m_-Lml+!6oNs~mj&W!`O9M6
zMg*?NwDJEMD<1PKPcJS|w0uc3+<<x0!143-hO7dTnF~qYG?{-|%2K=F&_EqvFpx;o
zfV>#Yfy>TwKun<4h<iK-A|;&*A$c!OiF3P5&I7H^D9aC`-COt0|LyMZPrLN%D4Se#
zgVqC3E+$L}2!(<7*Tuv~<Q@a^8<!fmoO`Q?t`hlIu6Gc|nD$ZwduOFCI@M06ahgNG
z5~{Sp-^Qci^f`a?3zr%(B;=6enBU_igD7od0EYF=>?o!Ti$OG!?qxPk<hsXS-C2Cz
zEhB(MW^%<kKXcdsQiCfG(l&M_T^TPK+Ncl%jf)e8(MUQ;?CVVJ<_Or7HT`@L*<?FS
z9GfGlZ-YanuZ6@SXF`^izc#VzwxWvcn_YJt3}J*i3M_w2m$qkiAS@gXa!%p0-mJJN
z#G~qZG4N!}jk+|V82*3BD9a=pn>8scf(ha1(uD1*)XW<zC;<UGGB7LVVHIga2UnzP
zC-y6Wo$ww&glXYDMBBNv0ryo$cwV)!Uo)=@;Jp;(HVkjGqau=3j#V6h)a)<m_<(rz
zObZK|ulRovU-W10*Y#`6=z=KFTX$``5k6{`LO&kVjnsap2c?saIfc{kPvn>KGigzC
zy4D(4p){A};CBGP?UphTY5Q63>>?4h`Xh@y-CR>9yLD-d=DK~Nx23ym&Hd?LwdN^Y
zw2Z1Sv>~f+Eu1!6pcXZEEeT8UWQ0fbyc;my_6L89Uop@_E%`aQR*Ce)I^)OjOQ4)_
zcAQ{<=80&@Vf{2KQL(gU6;a0eSHKeH@eN+_hSrue=`W0K%tx<Yn7#9-F5^wGBs&E(
zX~AgGp5X49X!`fZDMqdG&AC{3`q1ON8V)=%UJ!5L4h@=^TRn#k?Jc2w4(s?dyOIi3
zUXOoPfOj|$@}?=s#VdZ`iFNXzC)3Fnfj}o;p--vVgVL&PUo<&-d`uS#eb%&N&c>CO
z&m9V@gLPHP93dYDxa9Q11i}l{fJ;;bpA?dZ$>s&*-w2+y0mp$MvWOZ-rCBzbti8pE
zr$^~Ei1m|jsMLW;p~aw;PNsR%9^<J&)O&xOy*_XMpa1*+*W;lx0iiH#h+3$t)aEsd
z+HHDN0b)9x4q$Fj_mMO;?-SD{eeQKg8&&PsC8zOH*nZrl7j~qt8{?s@uqUg*dT40c
z`?`?56_v9u)sZ|Ha4-$&plNk-F4~4j_D=L;k<cgp#RlP`R6w72oJ7MbZVNN}WZ-{l
z@=C<Nff~8x((`1xPIKWrj(8x5c~XW-7Fr(+Y?>`^d6*sw-gO7PNaIgQce|Q+su6Fr
zTW+h@dU;n`#!fZO!s{h1vXOROB&3f*z2W~ErQ>u~n0j?|CnOWJrbrZH_C`TrRrtQE
zMf0aC?M{d*$x+XN*2L<egpc|fx?6w4yTDhhk(XK~&(1p5+_I=g4KeX9=c{I!mhgXK
z=<ei?u3P^3YO!!ZntD%|i^^5}dY55S5cFE}n?wfog1UM<q+LL&850g8?Ap2!dUlHI
zNuLzJ;*w6veE^y<^XCdplR=v_u&HH+J$;t_0tt<CCiywN34g^LXg(=8VYYwB6e)PD
z&p|)N-K5`6M+q&kUQ4hg<j~yJ2;+j+Tj2_egbJkyH9JF+O&wUK&oz~HSm#;J2?AL2
zWjvuom%<AGLEH`wUbPqiLQ=~_T}nNjXhyy2erY9vEjlIcSlFCN0h?w(faj|+$C_13
zPJ_1G;EOeQ=^!CAv_<-HSt5U$wB$0;I{X&B)NFL<#<Xpi4sdHq{Z9y|n*Sp=XXRPC
zJ!y)mF+;MtO~jRw+!-}URv(OzUeY$HISgIO_YZEehNjm`LRSOK=aLUA@x2D8dbRZ@
zG-0fmrGnf_M}AhVK}6pv`<=yfc2>?XLso}m=H(^-RCO_dBU?)9J3fDWvM<mE4@@T8
zlVmdIWWN3X_kNi3*VJI#U^!qu<KkkrST05`R^)_+3G-gd<hwp$F5Ey!dgJi<apZ||
z^5wrohg`qN{UG1FX@8%`(@Sl^3m>htbR^nV=LH>D4o&VHj?@d@0DYH!2&oBUd+u5c
zsfrX2Uj{8xSLt1*vbBE}<j5gW7ttRz6x*)LQyZkGzvvna295e;Tbo)-R7IP#i(1ME
zVoqlUI!YnkMC5lSQRj3)!$^f}NfF~p1W2?eBWn8Iod+%@(quczui-Elw`%=?_`4$$
z#HK)uD`4%UtE;>Z!7}hJAp0tEXyIqf=J?r1Io<AD*sRRq2FZV`4);<*ZjSAF2$&r$
z4i@c^h^CTy$wWqifHej-g0LCzU`d$u78beS4gt_$k|1gU&6^b4`+3aTmu;{`OUW2C
zd_DCUr36?weJ-}cmcl|CKzGq2HH$S|wjC{poDy-QG54m?v^F27zh%;j+cKP^emsp$
z)$;P@$@9ExkJo?YnQA2$M%j2^5?y%#G-}^~m8&zMf_*M~H-XmEijtIBdgD2!m0UHD
zVbpjIn@&LtNMp6FJme<^qkPazHRf2Bg=oV7RZlaqf2;E$eAO6c&(xD-#18segoJef
z#qD>z*!v>;wwYu}BGu}yGLe=Hp>+4FQ<X&_#x+3Z0~>$46FYGQ%^`N8b+sAB#}NIQ
za5fgD-H^H2+Vf;;I0b`s2PLans!rf@korgBbsFek)d#g`n|R<e7&u}SP(#@#Jz2yG
zaHDZ4Y@HxKCpAC~aFAj)wzpu}0WWthG5UaOQ21ekm&@htxEL5X9{0l2813uPS#T<W
zk5ZHBqe*}2XwR|l;|I;sttg%*Il-bFSi!%135u)9Pp>rMq(bFH4-E8%wKmm;Y1qYb
zP#sMVV&kcefuJrMYa?aU;9>lbjS~hb`SHc$#X%9hotk87Q&(*1n`%X^<c!*>7-6fF
z9ez_F4L`ZYRtkI9v|3Iy4T*JCo@o#Yqv%P{{$YP3_lE0H$tc!f9(l;m7^#p+d07_{
zN)2(WnG;#vVorYLcn6!7n4$WV4-6>|3h})5NV-I<hf71Hi)hyOrow>}OGqSS2$oJh
z90CbaTGt~Gi<z|}!i)VZC{#u}3JntnJZl?V`JJqdNJPdTsNY+Nrh+u|9N+HQJ+>HK
z9lC!zBr(2g`}l6({^>Xsw$LX&4h+$@H>SLsF&8^%B|b%$@QBXWU_t`=Yl6_zJ-aK-
zG6n4gThw$EWhVLl$jQ!gW0vECt%0hJY5}AS@Z<S4kr+pyzHbaEh3_Y=QkqcX1tYm)
zW8=JkX)ud)I(S%qwq?~){&HhvDi1>F_(6a1p~F*^xvwDSy=!Qycg`_+8f)cki<gHj
z)hz5Wi@yfVs=1pjg-l9&w{J60;O*Nj<gPM$ApXW()3n9+l&lUd{Hd?5+xW6jQ}>S-
zLls7Q-}Aps95c_Njs?l*eGl6vAYz_=3qgp~DO0)lC<kUTG;F^Ynig%AQYeftYW;s>
zE@blmd2O~pTD)FdH~vRei`D!URIe(TQr<D0@R&B{gMyE+?TtaJ?{`Pg;|I1O7}5>z
zB?Hz;XXl8EkG-3dW4n2;TSb3;U^_)4y5UAKRx0fh|JxK5#`^(FIgS~sD&UFiy>b~z
zQJItJ$o!3d7dye2t{>Q5@R)9TY&d^kh0YA4(7v-%!@b}deUE2`^Qb<sQxgKpY_wB0
z@PKy9{(bWuOD2VucyzlZ5P>HT{`!8on^g!uu-&rb+F1EkFlNt$XTI7kJTqR|bz&2w
zI`{q+Sc(YfV9hAN6Y>>hYXOtOBk$c_V_>Iy|GkWEX4so<tU=cHHr9OQw$*>Lw*jW!
zKydR;I?Y%7VO8kkb&Rs_M*A}Z-E=SC{dSp=ZMt0!@!Z=m_odsiz<ViQb?7k8Q|r2P
zKkWbgJd<(*D6GaMDw09XMoN+L8||gPf$Q&|gLMD!cF>J&(>-KpdT;yq^AaBFHju&W
zCB~+@JO3Q>HV^5;+Z`U(rW=1_O9U7^M89Z&%ix-JZ2bT)-U%3y8UVnzEW{IP7xjj1
zEL@nDD}@QYsKJSq_-#Cxt8aJo;^E=x!|2(I=*7e5j}MO?Mkf!CenhpY==kaB!|z`l
zo*qAY8hyiAtQd%&%UNmnyPeaYpFfPgrC)wL{b7gyR}25pmq$OIoIZbh5`5d$=XZ~u
zJ$)plf({?=>LV{6J~)2y@aVJ)EKPdG(vBj=&hyb?e|v?b?COet(RA|T$-^#9`PtJ4
zhcABazIgWd;R*G1{N(xL<D=u#org~k?>~O{fWA6?@#Djtqi0W^$Ygfyl6VO&b~uFs
zEd-0R%TfO?l3AW6>g|8NecQ%ITB;7BB7F&<w8sZt<;SPbP9Gj<R$UT(Q`s2ax9?o=
zJa1!=De6DWXy7VUau8}~=cnV-A0%C@i&8w%;YqYd=UeMVK0kax%lMa*XHWM|em*&U
z_~i4GAD;cx4R)Fq`NhN2lfB(VquXsZ(X4dxYmrTMnp%&Nvo?R+_Xk0{#}5t;09sDV
zLT}sUY%P6B22=B*T02qx(rW-y)<TYU`^1xIsmj{(r4H3F4K7OnI)ukNnQ*Fg`(jQn
zNc4iO3GAA<HB31Sr%fBx_5%#sL@PlJVboHgFU@zJ>%`A1uMU@vvdbeeUs~V04KL&{
z``jnp>U_CC$9#V>5jc&sD3Phs3UQYg*n(#-zCV0={GZHUx=#<EJltzWZ{9?^?Opt1
zo;o}_diEpzs}F!a@{6wa-Icf}B2(R*cgy`t93;F4%(;zll3VVhJ;rjltE<K+1*Z}!
z!fCScEIQ-mW704a7^g*l|KGd(UEwh^M5y6dvqx7_S^R(06~+eO=w2<0N*4o1_lUus
zPB#!WpcH4M?WUuFiervd*vqQQC=7xj$7X0Ay6<M!QeTG;xW(LyB`w~4Fli7x=l9(K
zEUY*!g%5_6BL=83oTKzZSzL*JI)3`#$?@aIT+Si#0E`^`Acu1Dmpv0L6oB<}0NGE;
zd4m&zyp?~G+FLFh)Fy))U|XP+K(7yjIfVo@oU;aYQGb*bak7*G>;4U(JQ6_36lWsb
zgI6`Q603yj;<>SQ*eh4YZ^P#Hm}=x*AXpUaf7C*aPyi%*O@ja{vAVc?OkkK75WK*_
zY;(tI@Vtx5I7B*-1n~pZ0D35>8PSuIlm7q=2Z?`<CQPvsCQQGba$xxbdIG5xgNFY&
z?;)znJ<u9;5<bi4F&%3u4wjw0E$77R(%eg%Ul$D=5W_-LG@JZZk%~gTxISP72R2AU
zG<Eh^dZmTJd_9eUZ7hi9Wmm7PLgU#hSj!Lq$xsdHEE$)YKhc2X+Ae%5mRqbsxmJ!L
zo=1Pb<)-;lQ*pN8J7H^vW4G-1L1lx|LAWWzMkOssD`s3>ru~p4ah8y@lwa#KV7;d=
zJ!B3G2VF$8$$3oo4hQixqGFEL3dfadiz2$Jh*FsE$q5sul&Lqj$%X88SGDr}FS;Vb
z7F||A`Ro0!x^!*(UpUej7j62j=`k@wYUO`5vfu+HjP4MNMapcPJ+x&(qlc0o_RHQr
zeFjoQ(^aX7`GlH0oYA$xMv*gMaH53c2nY!yAArFMbO3gixxsYC$ZE3C2E0a+h=}`Z
zKAz@=_aH0v6tu{Eqd6zs^O2^Ivn;}Ch(k!@-fz)wl8%ps;p}6PKSfrRgyG8929SRT
zzx+A;NeIJ!dG?EZ&9mtub#06vUnF#R2H)t5`s{brM=cW5ig##TyXV>9x{GPhv*%eh
z+WB2;(U+IZ)ZhduTCcuDhL)C+6a7z~ab3KA;;w;L@hBbe5oV!6w;DUximnh(tJ$z@
z4@T~y2EO$92i2dSzmWW?Guj8i_s@Uw-8u>DON>XJpcz|=uVzE}1voF`T<V98$8^Rq
zt^VefIHi%UG}6^Z7Bzl6lRDx29WjfmSYs$I0ovq0OG`7mLiGTV|K*fx_M=8ubLwmo
z7wPC)D;(v?h%@|9Q-`Zk0<sC|b!X47>2OUpVk39EQ+}zIlgQO_hWqt|U)_JG={tfw
z#6Q$G-vL`T0rO@ST4|fay_x#qth9SZ3L+2T9<mdI1bKe}UAc5f6tqLMbcS&=)y5I0
z0}SUADfNlicrIs1i@huP1X9{CE)dr?(A+QHzk%)?2F9Wj=~OJjnBC+3XLArA;A9LQ
z$OtOPm(IrLsR$f0tuwU&GG>394u6y}3=_}v%PxQFszDHWgysD)j8}<-Gbw}Ru<J+5
zC$LmPC{;>gn4KjwZBrPK7|idu0%Uws3sjdjZ|V8jB;gS<z~1$a=l`Cf==&(9;m)KM
zl!av8>1hYUER(i}op0#P0TNut$#)$kEPUvp95A1MoBpZ5YqV`r1B`zdpb$Ep+PNUy
zg@>8$WpuUIgt3%vwaIL6_sCm<KkPPziym@@F|EAJRSw329+(~K+1T0PS<E|J{L=3{
zax;~2fI4L$Bq+`Ei407-x5Opz1-iuw>LrO7vP#Oxc}r`a+F=6+I|k{=q;o-6YW)gh
zkK}rtcfP?})n7Xfu#JCh5reEsTPhaz=Xox5Gw^!2>78&D>8=Qui9s3#n8qLgiNzCR
z#t7Y<WU&`6^DUv&D+n`sC0Wr<t5jdwhIi%PU2U@?9~ZXG+jKv<iVb*%IiQ>cqz{@c
zu@A^~ihQ9wy||olLNAo3RBVCC>!d$d1^LtsO^yy$Mr;<uD%^i@$IT(&JC0xs+yavY
zaSEi+l=zOAwml!UT+VOBsD$l2NG2J!>Hd5p-gA=DFi1mS!@0fWZV8>VO+#&Mh;41!
zP+J<}de{9X=k%=4#oV>Gh?7N|akAf-m;Ek%H1>!4{%PCy_*rLGG#pPO&EOoV12rto
zU9ck8?)=1e3ax+dmTzhi@A-PP2Sp$W#Awm$0Ar2wHR#eyCI#!2vfNDe#=>CT6K5cX
z?T+#m9f7Qg8yTmjxnPN2lnIZH!7P4_k&dCm2@0{+2Tc{ZigQG1N@q;ukq9TnIybaY
zc!u*_U@ZNleC3;n6l1;#g)=@cvJpyL>G-PC_>36AXs>_ywUO%|$&waK(2(OtuM&&e
z<qx<Oomu#lbk<uv{978Y-e$C_w#9{PpI^7Rp*9+7GL*BntVN)sS)sZ^)51v>S~M#`
zHJe}^4v>k*?MWIS=^y6(4u9W)m!K!yY#dKX&8Fj{pcVV`eFsk=)74ADUWC)p9CwFn
z)N79Eb%1}ZmUGKYO6Sc4;D%2JU(a%v1`&+xiiz98S%4Dt7X^<H-PR#%)=yAxXx()7
zv;4O6Sp#AX?LhuaAiNp}q^o}RSpz)BeE19u<u-jdYjpT8(l`0rx&0P@{X$><zC-_~
zwBzLOGj8q1I81oE8C0PKpA>Ps0C)<3m!>nekqCbYa4e*`8~H&VfkUDsfn;B{aKD(J
z>tEyRZXlPipS66X-I+xuE_Ka-7@g>cgsXi7r<&L*bAAW*!gntdl8J<x0~7+*Ktoxu
z#&dQE-KDsY!92KJth?x;yK!!+0WMsj!8q>X9mVyo*3(R;!Z$qKloyH7#DNS1BUI7y
zAiRH6as@IPL<<=uS`|W|)l8GZ)VSj%87Ba-OAD^cQpj~|gXv_$9>?SJL5$m7z{8Dl
zRp4x&%K}p8vT#PyP<UAgB%<4%B?UV=oCiX`=xAzanyK&IuC0d(-O;Vk?#yB0>bjDr
zG)T<Lj1Pp&W5bXX1Jl700y4(XG9&27b;f@Rd5D*r)j-}@WHqH2UfLl&UKrVR3g=ip
zVf4y$(jUzS>M}@Pn-84h&H}rx)R`~~!0jx6|0TjQd(Nj-*1|uj+yq)6zO6$suZVF?
zrM3HjTNUY6#VIG{=LxQ=b39>$K^oyOne{Ifub(8GJibyloI=FWx55VD!by34B0+yC
zzuW2KhxQLrMBFCY9z^#O5~lO$8!n*sT_gI&#ijrb@M`}XFEdXEv`^jdPxrq8n;>oF
zQurOs>okx1FKZ1c=Gglu5EieS9n6*of*O#^3<D@??KqH(v0_GphCm|L5m8d+(}8#u
zR6@3dEK<Av3<M)>)G@nB22WdCfp35PQ_n^on#oJt@;tFWb@lZSIC?yt3yKi~uIix*
zG#MEW77}Ho(RD2FU083N2%Q*WcVRujd<9UTX%LzQoNpJNr_o3&z>AQ8vGN&kGYeN3
zs06$ebjif8vQ(i8&E)aP%r}@8pIN}ILELExA6HFEC&>2{nBj$C>!TQ$U^IVDpI=x_
znD<)t(c9*fv0m-c(P|DE{Xwi<nD;!t(7EWIN?bI*W`<r!kO*`Gc|9GftF%N|GG5;(
zO6S&Ul$%>ai_5O}_O0l}eB$Qv3PzEWA4-b>)*5pF@#RKB|Ce1bnFZEKWv$SZY0_he
zGAP^N+>W3;$lT^m&Xbrn!VG`0Wt}#0gmR^9L6`xV<eF$|kcgQ_G3RKzC&`Sj*&?}M
zK)L8Aptr)s$B2nOJ8Y>Nq<4!JEBeM5*I8!yuBYl|%1NJyEFk&NsJ%Fl*yWZjO{|k3
z21t5DQn-yXCKZ3`ECMiO;50^z(*e6c2GDs^b)b-Z03u|^!Ms1?Lf(HgKtN(r2QBLT
z74isat;S;Qq?6Fc&W{ZAo*9{ToV*5B1{Q3{P-OV&*X-Qf#%#8c+=)LTBiYv0Sng3W
zx!NrhQuS~<1^xq07ZTM4$rDza3oeAgOI7U9=6cJN7FO$=#CcBKf}udKSRe|FGeRFq
z4NL-tR_vS&ox{4rg+hO<QO!cESbCo@T0WbT^rD?XI78aPt2EChV+O}(rH}3ye+u=N
z``v%*@<Uynr+*ey%{Wjgg@_7fq^kt~YtMoBe?V%STF#TBJwFE^U-ZN2>2qENMNynZ
zFB2q_dUuRNQzTWgpr_8W*VG!1_U^xSO<-Nu!ZZfgA$x`I(ei)vFGUO!q(T!Sp>`%8
zqwb0h@-KV0@Kt-3wdt!izG`+1l%-@kn-W1vF$`=QM-Ca5x`q{1CE8xVzYO+oFFGsx
z;n#4(lL%EUUxLEhe4_!yTn!%>5If7H<cJXch{WefA!`9cNtw<etbpWbyh=ERk?ic;
zH@*_bOALv^3Oaw{t0V`4Yi=Q&SeEa(=6bG}1ha{oRg~aq7MJPNQn|T15c3GW15_D_
zC^_q?6{~=S9LEs1N!#v5TZg>gs|AIzK&hknys)44iB~22Fq-eL*Lw47meFkipQW0a
zh^FA}JI2BxtI=lXGB>p5q}<APf<{>R7x|Q<Z(MM2uvve0ufWaN+F|(=Tktzjn29mw
zF<0O2;)fm$|4sCWQJ3Ek!*tQGZ|HlH2O|An`qTqo?$H-N(7zIdnn%aaO(-h3Allvc
z@5qk42{{9A;u*Ge?irNj-rc*Xe8W#Mu8BS+rDoU{qD|!KE7Y)fnOx(U=MSH>iRWYk
zhOy<JP-1@@w^pXcx!8nqyU};2^K)%LVk+cT)R<)Yh3{5gz}`!e8z)`-Ui6}A%At{F
z9eMu-cfb1T&c8>8^xx6Fr~eSh-|v%|r5k>X8ZE%_+r-xOjc?HCcRd}KgfevJ6W1Ze
zcgUt=k0l#RVa$Vpi71#6G{Bs+dc*868HlWm$xMIi2oNh~z(hC~P<v<5ljGATEnjPq
zTh8qb!=20afZ6<5n8qzrAu(>DkmC-|8uE;Hj94bBP%6oh|CbYT*#2WwXVJ`+ee;G&
zSogVAjOpd5j!(k=Q|)O-!8E>Ye14}9+5c|U%StW!f>aO|0j(hi144l74&e5qb~4Xs
z*QS371fZRyf0;!My5vO7{9Jp(1U}!p)U(wja%ym=B5D;Pcd1B6;uB8DPH|1Q`nW%X
zy4+TX?}llx0ohyBkJ$i}!?b;#(6T313NxbJp8U(KCfe6;J4|oTQ%EVpv1;nzfBUb7
zns@%IaS;8N?ef1GE&3z_!7rch)s3*-raOO+mc@-U`r{uXZW%cL2qESVOn%MZ8)}%J
zv)1TBqmNrq8KByji;2~o{X1R!+ZCI(+`=l}!H~q(D2QHS<tjY?tjENaw0IkpK6t|n
zb}Y?-L+N*aYnVA4M2!jYtk;d-cP+0rl2yh)>97oqfdNZ*!E2%x@Hun9ow%+f%9MY=
zr&y0W(3*oI53FOpR=t889Jb0tNkeDzv<TrN=8Qr}LJj-$Pm*)tnt-O5&VcMW8nK02
zAw3vKQH-f$k_!u8z^4tK;*6U>3G=;<3G#oz@b3Sh<J+>Gi8i22BAz)tp%Xo_&_SpG
zSU{)0?1E??gknyWiKqxmM?NP$5|i}6T!-3!{MzZ{PQHf`MsWRD&n-AgiT#*j+_n5j
zwXr#oQs>Q(|Mznj>-}9XU|6<9kj|JH)7KE_3m8PDC<h2n;?p=lOw@urf$sp2xNJRs
za82i(ZXelq0IXXy>B~4D(1J)99CX80iJjtN;hQ+-6{QyD&QMDN?vzcn9#zFNUQ+gd
z8@KqLo2J5sEbpxFFitawB{cvHAv5<T3v@9X7w8;j@UCRj(pkJKhY`ONh{Y=N`Olf{
zqP3kJ8Doj-5(l)8>=u^!9%x-0Q&Z5CcO_CJ(L-Y1b_T<!ed!LPT^>_9XrTnf-dfEs
z;o6m019JhhlJGgI2KCq*n7$@~QEe}OL37!;IEnmCxA^3`As}Qk5%$bEFOlxSgz4W6
z&5NJr)2?U4(^5f+p&3AS>xykbPNYW|lUQqw|H)8^StvTVq{FI)d_~mgYV(9=yt?=>
z?|GBr60-CF-N}XGPkKU|1l#hqOp;e@&4~M#em|xZ6;}CcwqP1c!028k@WRV~z=W^&
zKEKoHd_L*XXxMw2UQ7_b9{nVBBnH8u^Ol;J1c3MoRsXG9K$a6$KmLKmOFf<t3D~=z
z%tBtwMryEc2d4f)Zd>K9VqH_GQmn>hPl7rC;Geygd$goOzXPrg1Sa29kglG)wtM;&
z<4Z#ZVDcoMBHUkx14$kdYQ(sI=4`^ZU#ZB8<xK!m+^2c&^-gGW`!hWB*W~(0WteZT
zlcLvT_;}tu9|j6_00Kc(${BW|Lqjj&&vc;XSbvr3=97^Lx3Pqqyhc!V3a?y&HLnw)
zrDRagkd}B>*s6hu%Ou9F%<?h{Y_O0F^8rmz+G<adtDbn0VBv!QSpa2!JJEC1VzEXj
z!J20S!J^REIku}sY%`&&NjQ&hf>VYSkP1R_)v8idY;ic$rK)Kf!(j3=?BOJWL3&FU
z>7Os29&({>HI0kKyl0~9<tpc*!=y?4^rU;cM`tuoVeAl&HJ{kZHog#nk{@jywjB?W
zAxs1^4El%zf#}1?xu#ry2xH<t&CFud+Kmn>7E5Ld@d!NXTFmPpF~s_0zJmcO4r3}%
z2WOMwR{%|^1!^tx(}CX>%T8Lm4ni8#P)|_7M<Q!6qY@iSM+w9V!Sb}Up&;HwX0WlL
z@G1}P<lg?d2rX>r!ne<pyp8L-BoE@Ay##BfM_%1w?<lc`Hj@K?liE)uQyA9w&^L5i
zRgR{Y{_~8FYyr}V6-!Nvyl7%p<XxVzyD+HShiTaoL>F47fwRYd5?LGd52rMliv__7
z|E?qK@`FV{18iJ0%Ov@@vFx)7^14*s8i`XzL%8MYwZ&Mh?<?aQpdAH<=L4B?&?k^1
zONQpap0dK=%oVDCO*sbN_N@AQ$?&%~$*hsl=6Fez7;Ao$8f#?hLow2cVk#Ptwb^!x
zOH-@Hd^5f79k4^1Ihmy;vu?8TrhFQk&8)~V(2H3m8Y>ow+|{GCyqFWw)5VOF*@`6O
zu%#xqe11+0b9y;#L1-JbAVbDc9$!hZI}#mdY;<SArm4k$rm(ddPSGz!3G{Dcb-#$$
z1qzcCcS3qye4*|aPb+JS3zHO_$$Z+x!1(yV2dm1E;3Q!YMwyy{HME{?*(6UTB1Q}!
zX8xMFSauH;a!Gkc-4_oJA3S+zE8GY}HN<DGyFmgJAlzdD87Vm$o;T8ALJjfP#{Nj_
z`|s-eHBFX(z7V*5E!yVb82rjn#Ou>UON-hbS^_f#VnJRG33)+O06!?cSQ8~fjnmnP
z&T|^;r3QE?5;~8hV@tU`l7Zov&wxjM*BD+QOvdM#rsH#3%+Ai?02xs*8<u9~lJR(E
zw{L4}w{M&F&cX&=G!0LI9~aho_g<HHRyIi`$iX~+(v?zUekL>CY2R(PNfc=FFgOJs
zdGX_fE}ix~ZOXu{lT7?)QZJg=c{n8Y!$$y|Z^@0!@3LIT0X@ixme~#gwSl^~T(p*s
z$xJWTd`=uDK>!4nAO3kUZ?Ju)?G}w*q0?l`3NS(bkX==l6`!kQWV1YN;sNLJnv8yr
zZY08g$BUkBiPOHtr4m|x{*@KeWW;A|h??;?3&Qj6ASkaumNj;VjwWpfCm?p^HNB-D
z#)5A5680(yY4j*wZ)fEjQn!dxiqB#1$S*WJ9)xd5U6#V=vsi^W?kAeQM8ko)NsWkH
z8D12MKlV<UcX&`T{s~gq%?PYPd^l7Sxr9xBh23+L-@|0&a^KO^VGt1_8&#B2RfCf`
zx7Ke%G4?ofAE=NK(kYKv?R}90#p0zi5yQ4joe&JM1$rT#B-y+eU30q+?Dq0AGzhfo
zz7?LJ5n{H|1|9`%bFquWZmcO@W`h<CJ+fVi+LSKm{g;oi)J$5Quv4Jx=jk+oHd&Z|
zcv~WZlr-#rAZlCR+=vkA9fsCmQ?1U4bz31Q47|<hk^?q&X+c3&U}Da)YF{U_wl|J}
zX~k8$5USWK;6er`txk=(iW~ne?iNqA{iis6z>K)r<mG}{nNI*#2grVv;*k6+M<MfH
zmV|kHGDEAJ))Mi~AI=<a(VIYSis*!YDDjuQ{d5ezT)ymVMf%7j&FfjKy_R-R+>quY
zTni0gM!Z}Y6=%f-jE}R|Yg$B!Ln0&jqH=IO5~Zzjlf373{``emOc5QmXhKj?5rJQ(
zAn?wYc=?5t)cK>^4nCDqX{WFQ&>A&(NK?6aYI4+fzCue_RoN1K35^};`<(lK7w`|T
z17{m^Yb2m<=6k;v><Jgcskx-ZIP*MDSST-G<=K&PVTBhTV?^1OcLlM7ja0itRBmLX
zL`YMcPoP0)6iv&D0)pNR+kr5)QFb1WqI+$B0^@Y{^{QAL=M-QA^Hi(7ISd1i?+FpJ
z0*S5JGR%!FqSo*b)LxaOCzOkSA4Ge+vGl7OSQ8rCM9n29=AajTu96wYEfGTe+NvCu
z+?4DYRwut#E-zsoce+G?U3?B>9!<H(XwPJzw_Gv{>vxy}z1v0r?Z8QZU>#>i$NNVQ
zqFA9!xu<_O6{{~UyB8x*h>~;A)`vYv7-1<)tCrtgSkI3i08N9eB->PfF0(?D{1+^q
z1ibzeHWpr?Bx%n8R^+`&mnlqOeaEwks7)dxUG;;cbQ)DYp<b9$#5XQ?0=__bJ%!WJ
z_suot)Zl%(!tiKUQ^~yzl6M&JDU(XVdJ3BeUOm(ccydX%6labU_EyTXY}O1)r}Fs3
zf&}SY%GU<fBsDzJ+~{n7TqCw6Immb&3`?&T6sfWi`=ob{)A<;J{A@1K<!G9Q;1|gL
z+2(U;b@=ndv}QyWF=^R8{gJx9cfEi_VVvWH!G4_MG3<J`ke1lg$icR}rQ&Id$4Frw
zK!>)Z&QVKKSOWzor^M6Hx@l9-;5lb4-lzX%d3y%$i;Y##J!zYN*@{K`GA^9#G<lV!
zQWWm?ZP@OLB%aB`#QHFG4ketA&tc;l8jaFt@-h#b*uv@jQ&zEO(N~;EB4@!0jm?NV
zQ9&(Sv1o6|>N?-=Ez%3|s8wOPG})amWE3Ri0|#ej_Y#WKV4!czkV&0zIWrXD>(iBi
zboD^P#aKn`N1+dYJ|y;f<Ck$hTfA1u>r}!~WC38-v$5V1?&a-|CeIJ;5jPc^B@|o)
z4Y{=h_`qPpz!E-Em$07Nfke2lpLfBHImsplL$63QB}EUJ6vt?rZ6k`kfYEJY`1$#@
zC~tbWcZ;ZWTN;kyU*E__^*=WSo3Gh%yjEr;A=CVw3v^(Ax$J4FHni)N;b+tWiBWeT
zehCt&p820VNpv!|xjQM+I`R$#FZ*~;#-eH1K58{dSVw;8ZuLCFj59FiNcclwQZ})a
z+?Z<wyE!x1W8M@wP3n$c+FE>JuqDxE^Dz|(%bwE}(|_UWOozf%Pt)FAW-bjvjkG+W
zP%~Gw4R%R?@h?4h_w-y$XKH%WQrFbj0DNu?uba4_f@_EmAG0uFNxEJl8(IShR_dNu
z)rOM5C74)-_Dww&8=0z+qT(zOREjH+veDF+vMi=LHXHFS!O=`RGT?aRN!jwSuN3PT
z#RM4VGxqO5$sDAzirf^PSF2XDpz-n#J3HU}q1}#uPM<w^cEHelC`N-+QTz+DN0Llv
zJhQ^ExuJh5thb`w{!RlYz{w;wVpwl|QHT`gcqSAq&811CyJie~2zj|wsJ>Ho2LA$2
zl#sWq%Ei@Xl8j2Hsay<M#6lqm=DZ>C3c)To4v$hV#^2hbG%ckDQ!8xNvsjc*LeCHY
zpB3VN@ElSA^D=IObf&LX4iNp?14RNYE3Z3YGDo)YMc?RHIcNR5o+>rv@CAlb;3VZL
zZ`aLXFPhSXcQ9XMqr`8-9uGfNQ+3TOPcN9Vz4s5LpnGoVt@;oT=-13sSWU*L1kmWo
zM!#cdxG5J?OF#uKk<zs$ltL6J^|3aVq~$DsSc<ovRaQZ5BzZ;VJx@IO+DeuN?ZyZ$
zeBVngYIi%IO^tj*Pb|@!3<+C}c8pMuT<zoBg$L*+PH{bk-XmCT@df+lGRYP*);_rn
z7)Wd^HG4TT+u`i8%<1NDSaeHg)q5f%>$PkE49m`vkYl?Q$w+&sGs#$?hYfA)CbBPo
ze@*R)O3bu^&^KvIR>kLU9bkd<WA?MEhEN!vqp{6-szTd$(mVJ_XZ~wTXe@(-a5`!-
zBGFyMbxm&}$}jAS8&;?eNFrIc8k6gcZ?DY685lSGM(f0ol87?H!w{fGDT0w`To;V8
zp)V-Gu-Gr==ggf<eMW(s<cKw~$|Uc9O%!8N29evBBc!A=j~5G$N}FPT=GZ?KPo-zH
zMv^_Ojzu<3Fmqx*35qoZ+ZoPQxA1VHu4<xC_B4oG$=+?Kqnx(OVGCuJV0;{Hx(!n`
zXK6l2`A#y?l}h5~_(&+ENo3*tjyZ7fKtX5Kb8yoP{-z4X2Csk(SjI-;8`m{|PqXYG
z;gFKTNN{HttF0?ug6vf_OV(NeosmAsN%!24aj{cJnJpV_plO)2r^Z6a+3+NfzD5c*
zt)~4x^W`*w@S(}7aO#_I%hpYked%GL?u6zab$J2jkWutl$nY$VeD+!lh-WTJ#1$*r
zO4(j%#!++gEtHhp{#dIJR7)m*rB^WABZw9dd)X*}5(Z_8#NeE1d>?Z49dps7Gxk#_
zxx{UemKh6H7Htge>YUx7oND7Q%T0`8HUL8<ZK#(9YLH{kp7?{)2r3f?*h9(=t~hZ`
z&NA^>s$d`YJ@91KZZHX@2gDR2hVGHI$I2ofKTw;oM0!flsK_@YL2>(k?ViZ_aZzOb
zRHPr<XyS#5*1f#{joIb<{LXj#J&j-Nm4E3OoM3HTvd0U*Uk4CnNJpPF$=aIe&=F`E
zH9T-4(NEr#IiE-pNdVo%60w^Voi$eO%Kf@Udn3zRYVy9GJolQ>rrzwlX$Sw6K5qKo
zn>D|)ztQ|{W*h!{BliA(oBl_wDQT#K<&O8AM9R1y@Vw^J3K8O*zLF?(Z0{8Z*iS@o
zuxynbA2V7`>*SnezHQaWTy%U@%g7UJ^5$d=?0;+<P-U6>yH=Ie@xMV)IxEh4dv25F
z<z9jJ<ucC<V7_?f#ap9wIV93abWWFN<iZr7urU{PQk4py2B@Qd<iKHu#9A8KkdQ4a
zcA4oJd<%UD!X3lWhHg8ZVF(%~S|m;_m(mr}t*0!qzV*O%j*tm}m?FHCSi|Eo?7L!Q
zdGlRxvES`#Q(ZLWKv9*2Jz?j8x99#~_vF_fkDCtKW1#~xxa`bL=&hlrB-SlV75UfP
zB}!E^{8uT%o@ktZTW(zzlE2N#Edn#)fXMjnx(MC>0*NCNk+C1tTG%QM%De1OlS~O1
zo!Lws(_}evT#y;yK!7kUi5kP9P-opb7^7RydM$PP)y>G7w*D5#0uzPD%4P9*BC3BK
z6E(uWc?rvbd60TRG3(=@fv8Dl!iyzMBy;6NFkreiChS;$!S{fRM2d{vsj4{9GDcJz
zmLXcWn3m|u*p=bzcB1>@ca_s4<_3P2M{C|U$r*~!;rs+cbK6=eVwS+H+mS$6Kr!&_
zVXJp?9Q5@(5$xC);k3epxKD?Ef*6*VcbhdivuX};1D3QnpEzT;q^6$gUovWz1#`D!
zy#EqE)rVGppw1<5EdlIM-eEx5v{*WK%{*KamZBfo$Zau=07RjyLrp@lXu0-;3};Jb
zB|v7(OrSrp;ALkl#9^53c`{>*EaYPe^aJ=D`;bk@sw7M}M`U1rD7@$&oI-nIof>g!
zNLWTrT}_H%B0wuvYFHT*g~2-2c<7r076nxpo5iVrN#tT?OxNH5v0+sqS+!5m$~n!!
zyvQNEVwliNMtK&4%M=kZO9X59+V_TKvg{%`BXTH}S^)?!lTEc@!MvTuBx|}gW?MVS
zq>$sxx~Rk97%LZ-1%~@iVS&Yb#ppFGp`Rx<yL=$&G#)(Zm?(v>N^?U3#EH7tr)dn*
zLMzIDC+xd*rp~dc?`aeYv3J|coR6;6HiXT4DnhGd%}N=MQDp-oGdf?66J!j&A%sk~
z5>6GB;NePBVx9xzGA(iNy2#8E2Mx+?J1EG2wCzb?&XwhoG-rHGzNjUdk_U6=f%%AC
zDKkh+UhvE^a*o!BZPG=rHP(Q4ZXt+k#13bF7ah?uV%SA8E2=?g<?%YXl55v^pcimp
zOvD0uHq|(^`eFX*Ue`PjSTO|5&<hqT)_C7NE&>F%WTWIX*i2m1Ec8lZ){^M8z1T(m
z(Rqz|1;Bg8ae!Uir|*%JYpO-GH1>QzcSv7=BD>wIu>^YoFczZj;5+25n&d>&-Z>3_
zH<?)^m__!w-9qPMSeQv71z(njN7n~7d|u2a7Cgj|0m|;+-|zOn;nqm+{PD%HTI(V5
zOC=#6D@aQX_Q6_<$N+toR=&mY^C$oDxP{qCR2Sb<F=JkhpeCm;6N4?pr`*mUi_TC>
z!d*@h#r!7#v~}ILfeA{>faIKbsYGvoBeNx=Pm+g?i4q%$w3{Svs(vi#N`^nypSd7-
z@m%G5-c9^U>(z4K6bTE#Fb8omkibG`Ch<<%hk;OixENB)Qq}BQETDsPJi`NZdJT~+
zlO($fa4o?;tEYh7bv}_B<XVoR$rHw5WJjRO+?h`$>HGk^09g6CI48q_@|uZ%AKy;W
zKcJeOgawp@)E2xjvNO{x6$3C`7&IbSG&0{x3O<7yTVx)jGMyYfxEm31z%+QXqkpUD
z5AL?LiFQFee{|hu{*2(CK{^(I<3fX3HUCZzLRYtiU2xNQ0!fQEFxA~q^b(W=AQF2n
z)FKR(FRs}Pd1C`_|LvYg%#195AQH+{yVh9R%90z=%rY|Cxe1(Uob-;nUTOT;FzQz}
zP=jwvX>QehQoRh!{<N)gcaSohgU-N6ybqL*RIUd2-21LR0@r$Kk0iPjQ8^k1Wk!7a
zwx0uMsq4a|>Mp*59E6BgQS?HcyvdtzA8r;~q9}cO1Ndt$^HJTmC5=pfvdCs5b`b80
zA}DNgWl2Q>tf5+HM1GX{8K-)*9ZVg5YD0m36_3~wp=|MMm%z#*6su-*zWd(s7QhJ4
z(<yGvY+yjV?L_o`P%j=YJGVNE$Bd7{!1FJSyVL1y^vtVN<R`D6T5p|k);;4C`bedW
zXz%1+vj+ezLm!%s?FkEiN<yA=p}_IUpp7MOD~<Lq(`iS89F559XWk>F^~y_x)0|^7
z-+{xHGab=_JZ4fCfj*9&T%&lCxx$^P%Z_Z%9t0H-%A$bh4SJpxvx_|OS|oxFH_zbu
z2tCMh0AxdtiZ==3G7Lc<tdnpMVymOXBJE51_{*dcA9tl!;BWhXw>6@}1#tMzvDzbU
zT5c>n=8f=}+e2<S(SB4ti)L>uGNMvEEPO13Pm~Zk(e3@;Jrll$LK@&*v#6vTPcH$;
zVc9E_nPr!80dOBvuPuCS6QT4L5~0lZZGOE;gU<7mcOH~#mrcl>^X9N*dYQl<#;86}
ze8quFgJxfI&s-{hJ#OfrB3Xp82YZj@uDwoXEyL2-YNMA^pnvFH^0joC&<!7tNGO#^
ztC|jj&Ws|!DmB9-6ds(W5tePuM?*HU?&hvw3$|buvKdbIL*sL4n3H4)o!ThXaQpPg
z@Cr7}%muC3%&~zN8$3seU*=IE_0tn;brfxkLI>y(-;pGLX722iLYYKv&0vdTv2{Q?
zF)xl<BrOHnH7eXPFXAO;NJ|t3L5&Uc1u=1nE+V51<G2O*1I#j+3|JUzMZM?GPEMl|
z?6N0cV>(@#O4le1T{jgA+7LvvNSLqnObht6u39NDNEG%W9%{vd8Oh)2kgrEl88Tq~
z&yXEEWA4a*@E!T=Dkd3G__r_Ocr1@iB#7xzUkI-UiMXbCiLY58-aF7WB&?&PL#P23
zAPj|E;4otE@>M#qL3O;&L00}WPVE5WsDWF*5hUDkybil`0R}9_9AiN6kWASODOaA$
zbBunRC`OjUSJEJt(v&1oKaM!-vL#6lY~5({+WY>0Pfj&=zD|RiV-Jc#&l58O<^v2m
z(<F$({E-7>!v1aMJV$>5KZV5a5rY9CU<%8^OBKY;&rIZz$vstD)hHb%{p-FB4+-Wj
zTg;_Fa8YWyq8wstCTu&mb9_;l>PnnljDfmX4ELawA~r`WxJBHijrZW8Cf<`?Ol-UD
zzt59@IR_a-G!g()5jM&grfMLcPPxWK$=1fKUes4;6V#c(Ka@oGd+qVH3n|o058q)@
zcCuMJcczB6+qY}Y4;Qy@tMy@=AT7fvG#Up1kOg}UF<-dyp&#O+UKja4|M&mnNR30v
zr4@E8F;B5383QyiwEDYJ!6QG?K3x#;gwhm$>U7gW!ZL$i*`eE0xh<@S<`B}T4eNcd
zYi?WK!{u$iuC#4q@*Y@Qk@d(jHi$`BYO-s{kD?YB3%BZazi?UWT64w)mUQS9GxEe?
z*V!n82vJVO#H+S6-Naf)Zr^T%G2>W-1EtVN0!xeekeEk<bh}x0apAOyN}*gYkP+E`
zh;r6W>CDipDqpJeNDoP?L~7LcMa@kRoDowzrY$m$3@+LW4~lM@Jku=Ywy+oiD3gil
zKuSS+F#cu-sTpUj(Rh19y>WO9MtsreUDdlC4nbHHN9J%X3^N#+y1-!*W02vf72w(N
zgCm1u$7ST0xBZ3a^b9{OfQ9+@Zk7&zf}}ZZ!qvKQHYEtX*Jblfu-dxSJwKG0uAi|h
z;)6H4GVpHsDO2-fQL;Go;01m0gq`8asM&vGGUEFcj+AKzol5MBi#lhsjIpQT`D<h6
z48r`tDo}k%B|QUq&1EfUtk*b65j!2=qFr;rZ}ED!_4T%Wz3D-09QIK%b`!9F|LK(f
zryJC1atPS5YtU<*X;RDv;dg8cqg#LCf>Z``S9uwMd2v2qk68|>pARH<MujPhMWQ;b
z?Y<>xP^P?uZogpN4mB9l_D$=3-?|!FlHh}wPWVb+iFEG9DItj*66r<U#az$88>&^P
z*@I^XBlUOu@RsB?_K*F780ma}lF}tEuz8Gr>ALQOTNc5oo#Y(TP-qOBe5I0%w-^@M
zhy(_l6?v|wPPZ9H8%qs@p>-%1{It7p7wsI^la5QHGBnD{k&?}qT_GHOuRBUfYRs=4
z&2;5mzv?v2%@vN84PfsI*4j-gNo7NAE)yV+fjljHfXBSd41<m&i6GX0&8cC&Hayt%
zh}a#{RQG8;H1(3^{BRpoA`vNuC^Un?Tw+>G#gQqKf9h=~qQ`r%-FNuZD*_UK!32Z?
zobB)lbp_AzG<jvJhtLmR+9J~dMj7pW(TeUMu`rqSJ58@GZoI>=ebx2^@zFE{3?oyl
z$nbEcE^E+*`79tPb>9Gg#uSj@8ibZkrt=v?2;#oiSnDwYWy*aQwsYGdzuS{CMux`2
zPOUkIL?ApYE~2h}k_$|;H?+>Co@isQGIobW#{}A)#Rt<Z_5w1@>uNhaoK9_VJ_aC`
z!8w7zU@OIvl23#Ef{&NH<X^jrf$Un0&i=!eO<7cQ<zLZQQD0wwMZj>5Bp$d>kDFUa
zlglH&k0fICjKshR3hEgLqGIY(FKtsQnT;hQzPilQ3OGm_jm>F7RU2DF46&zAp$H&E
zQvZ97!sy7sD_lgS4{+}VS{iH&{Vd4$0)Br`AMAM$nP<ZP%3pJ1XNa0a6`^GLZ0%!B
zY9<|+((v@*h55yQXD%K3!M?J$8}By1R-pE0LapAaU|CSGbnz;bqfhN3xK&s*>B<`H
zyfLuiyd4OW#9yZtO4^*g(hZ{hLQau+qdYx~Eb^}T9_HG_p<lV>pm&u$RQlELt1o%;
z6?pPv=7VnxCp53)OMP2m%<X;EiQ0Fd3{Eol9h)=cxi>X`au!Ui#ny$buC!Y1CzQDG
zozL+YSW;E=nDnFIR{;&~@wb1ap>Y6t!#397Yd>uJW|uzR>|CV7=Gu%koX01|`ah4c
z(moSmE}trBAwCaTYD*6Efj#3VDma^%33>zURoVw{ZQW@uX0G0hmCJ6-Wc`UAY|3m+
zm?VvLHTSZAF_nEJ4{NO#Mu>VPR&E#sa^V>!r@6#2E@N8&T@PvEzsnA&UN)iONGNmf
zzyw($Zbi39%(o_#*3Z1+)%Td@1^t%Kw#P1QduTf{ADBm)kKSZiXA_)IxMI>`Is&4&
zJm}?EpV^mP60dyj#24+0JRLCnX){vRC;HNbd1V8CmZ|Rq`q6ThS)JBL#Vt=YZrW}(
z2h*fT7clYTR~dVGii7BXx8v8Tx=$q>EsFCzX5ANG7F=tLu@LoRbeW9?79r0Ti~Cs`
zGJdsi0Oq0TD4Rulz)$6x8dyNmqO^qSk^c%93jJq!${S%NZ}1e5lljchmkDvy*nEm?
zj@8<KlHI0hNIO2SJ`nbF5Y>EH`)OT1w&8y~EPp58L|nOsmynCdMCQukDl+ov3|ed}
zy4Q-n{DtdS<>^0Q1Rxb14H>Nw;Vb9K$jcs>tNnv_(-H!^I~BW%&zC8b^g!rF-31;c
zc@f=w_^!81RZ+>1FZH!2#Gd1k=ge@U_XcEtqv!r|^6V*Be`eoro*03nz{@CeYYvIM
z0^cm89@RM(Ww<RRZA;n9=vvA1V6jB8?7wyCcqtL{7?!VtDsl_gAtclAlM+*OM=x`!
zyru}Ux)-ARJdlI1dq2*1ThZ?0bdu~w^v6k`OG)$Jhj|jyAG<F&B_2;kdk-HrSBxQl
zl18mI#ii{eT{`!5sGSFl+{*Sa1(o-o^pZvbAR%{isUb227Od1(kMoumJS}7zEu6^M
ziC=FbPqkf-pcYe<;db8Uug&Wg6A3pf_An!vo&B<6$<OY7)uR9V>Wg1=&7Dn)qch@M
zxy`M}?j>(!xH9$xuDVC;f8K=>tq|~kYu9U|+hKhLV8JS`UPmlsM9bKUyuZHsq80t?
zSHCP@TPL2ib1X4^e-k;)zU&KZuJ9A9-40mm@Zx(C6<xk1Y`YfYA8^lFNP*3sYMpdd
z0^Kmeq=(F2G<*v=+j34_kLKeEwmqGsnwX^AMaB}^+y~yM{aoO(bKE=Wj2FOvmsv6z
zoge_6E$$@$v$;NnFlqu_I$R%Wdc8A9hMYgWM*<#pGEcZj>)DPWz2A0xLTs>27e(08
zL8DdrX_UOCU+$E?wxglnerxbGiuccn6dEo1H}1cLCzX_B`x_U{<p+Lujd_3m=7s?_
zjb_Zm8qk5}G;=$g`uE}sey#L>&@WQOYLgYNU*6~kQ`Si0_WQE?m$9u0jOj(^Uiw&p
zobLe#<)pzzv2J!Gip9f+Lb5Dzn4k*OPtdZqrpyHV09vxddzTnj1z)!59Nk0sSy?YZ
zUFUqPUNcUF_FFlFxUy9H`ZazP%W2w|5h2Gq@PuCAS&4w$p2CSXyV~Y|Epx2&v*?}f
zo7Jl4gmq24;lV`(DyG>XEgkSZ*97p8^?{~HEov)9r{fq|I`(JBASe@K&e-~f?~T)<
zzyI%D{w|!DpIOd8`KwgYx*30LHawbTnh#)79jOUgwY)$wUVb&3`?z`shpO57H*d`q
zE2U@;p$C5>G56o~Rwz?{PBu8T={dMyI)X%zs8(&12W&z=+Osv&c+G7YHj^YwqzzqV
zxkV386isWTl)5U$L9%zIrTAp6mbS#eyv9b!wb6Kxyiro9kSi~r?R@sz&S#(DX5m|e
z{$%b>-1;xsC0(5vv21(`-hB|={c7hkV%y$3cf)rO3tW2V-WT+L&W>_<Z$xHR!H{-#
zKGWMUPYNy#x7Yl7=XZJe!?7H<qcb`&a?qEzNskFDX$s^!J8SK`J-5@SmZFwgWq2;=
zi=(KN@wM4Be4>_4wu!DZ5*xcHpJ9I><(9(nXh1;>KfXjV$x)DOv%~Kr$LF+UyTnb)
zGSQCuoUo_pBJh)cTU;o%LYOc>y#&OI&ZY(QtAeXu@rM(ASAvc`@l6ARH4g=$4#-+L
zw9(wY?>(1Xs<ZnH*-Fc|ui&jXIQZd|gYWQzgyGpAWVP^vEROsDH<3)$M|N6UmgbvA
z--IAds%+5OZqsmF|6VEC*D414I@|qfRq0*Z+*TUomRiPtJTAYk7WQt8bgM0RXHNM5
zM6w8@ZK8i-E7kpxdaBWid+C_u8SHZlwea+I8d&AVE1E=I0r6cTTfv+=Tic&UB)u=D
zGw0P_ZgcS_X$r#o!r&}V&p9N(9$yV39A`i^G=*pA2x{@I%vTi<7LRy#c&H1`vSnx$
ztvy+YMF|jpsSiyG!duM4ex%Posb1m&_c^#pwnNZLowl;2{jgPdgf#`zx#>I@L(Z-;
zhb0!Sb%3=``dcC?JC7H{>v=AE>u@z&K@qw!T><^q%)(7T11IGt?M<RC(Oc&&=kXk&
z$Z<W(+!|d0p2>lvY>%M4c?da0k64w)=G?#b<n=9o&BH0{xuA=jdrn**8{_8lc*r%%
z#Rzp%zKj2Qzy02GzJIh?@4xVG>CP7S;|MAB{n-R)(A9Y;8Lys))E70nnU5ZO6%pqI
zwC<if(~>Oy{*3>i>G71BZ+kv|%HwHtsPf;o&Ij5w;Y-=XEBm_TgW=zUSqAv1x4sAc
zd7NB-DscZ$8V_aPcQcP8j?A??@`Hp|Te?#3&U*T?)%m4O4b?U$!$`RAVjgQpuWV1M
zT^8Z8MX56gIjrSe6)T&VDsD0#6NXqz$qVBY7nt~#^kaBD?v>j4*h?TcPuyreUO%Pi
zp}Kw~mgp_}DGa@dji{!d;^y<gy<ej1a6Tq~$gA?;X8lZ(D^n1zet(b#N4K_t>buD<
z30(toJz7j}3rNcr0$H;k6FR%_{Aduo4Xclh`RyW}q=nXNP{V`3EZV>t^D6oorXxRi
zu-cD#K!BTU;z_L*vSdDLDj{+^;-XL$I&irTOmNP$l1<j_@QoVWSc`?;DyGk#r`Ps>
zWMRw3e6jKPs%UtToqE40`~oLWNW#5aSYEjzz(LW~%o7wV5o3-vCC%#Z)hNEe`~H3|
zi1&6y=p`YkAE8)iuWvuRLZogy>|8H&UwlUYMfM*%0lCG!1*>h=bK>l!LyNZR!K<3y
zxo0CrN>}J6DeK}sD=><KqbcLpR=Y2M-j-9!;H94}+mUfP`6(TczPE^p(gW#u4!BV~
z6<Adkw_MlLuxu;wd-8qcI6!@_(wn0!11E86U6rAku&t)VIh1HwmY~C%1c&4zMq0Ca
z#6anlL9*e5xW`BArWE0~ObfpGSlpRm!jw0Jy(7M>kYCzDd=Kg6&y&0lpBAuxhkryR
z^*+s6QnQxsXn`cEWt5-g11C<K{^O!AAe2SFxq2BKdtYOfUC@PgrerD&B!lGy3QzY7
zREf@$TmvP;>Db7lgfr9RN#lFoLt)ld#6@#kT9vG34d3`S<#fVE#H7Y?8~(J82UlIM
z`hs9Yn?{JSW?Y*Pl^P`VoJjG14A4)-HSPTCMGna?y6TkieUe{wi@%TRos?b-fvKkP
z_c@~#!cj1!^#D+*geMvfWsoTOejgbeH8*1cZj=ykE{E4Uh)%?(tI^%1Yu8(s0Co_<
zS;ia21Mvzz0xyMeeh`vykwtsB`dW7VnjKD1EO0|rIuD4P`v-}em^C4PbonIBWW!;R
ztTTt=WjZy5g?XJVV!n9lILosQZ&IB1FR8)9NdAntXxPB3qv)m7VgwlR{p-pQ49B}x
zv>Y2r>eaf)a=|6*^?F1EJ9Gzren*NF^51tOnI3<*r{mc<dHDF@(P?x$di3Ji6N5Ha
zL_huT@WsPumd<E%jvpU?|Mg+C`@eRhH*fGJ{V#oZeEj72lzKQgIDUE>J$v-%<RN{$
z%OAfM@1*qsg(v0)t{~Gu;0p>{-PKCAfqaZWm5R{(@Zk;5tU#9*oX}>b=0aKO!!tA#
zrmfYJ_nQ__2GusXnA3p6D6M2*3O4K(D+)1pf(aj+)hNx``+jSGtjYs&-QsH4sGJdr
zrCSTfk;ZJR9IJpo*GT#p1I3%6oue;3`HfLkivwgB53^p2PWhZm(&0}<q3cONRga<f
zdXhEAogO|v-iZA1(gvv?;lw_=02`g&8h+k&{kx0fZMN*O-Oy9JMOBDLG^+{CFWE8|
z+GHD`^F~?Hnwf)t)QOHnlv{othzQJakP-3Sa<dUdQKR8SBXLXNkZ!VTgBl9B*@*m>
zZaOZ`Gsxfu0<O_ub4$AZO_Z&8{idaUmQRv=bE`A&8ug7J!!7KZw)8gp#+nWwG;T;o
zyTzDz|E{q}qNRGuPT0N0PxqLT<<CyNvO@eho(lBs&3Em8p@Yei`$~L)UgMp$*XS7G
z5E{hIuM-t)J|dGg>klWbw%l1gB6ro(4dF$sg`9m$0zh!Fmb$pbPQ=>YIVZ3#nofbO
zA-EywkjrEk_<Rv0hFm7|*SP_X(PXn03em)`Qu=i-;ft9U4pDhfPz6oK3uIhB)ZhN7
z7>j2RQRppyZpO$KwW}jP>f_v|hW6J<2%&q|7>2FtZ3cmi10mcqhJ5gULmb%toqB1<
zbbrg=6_!9n(_wPh*?E$c+jJQY43x%bz5Y952=%@&yBV7xP~9J0Z&A(w3(1CTBhEN9
zi`WBZ*YHA?@gBG?Y6ITH=)RAUboDXOX#5wAB6A{tL-U8dZ={z5y;UDr(x*(cjfdO1
zDxO&BWpWLJOs-kDa9VkYP24U>Q3YcWEz5w33tCd##9V}fYO6p;eLa&eRna-JyA#mE
zg1tQ}ZRT|pg8ZyLTN<X!G0Md{LCWiIN+3AvNZc^O)FGO=D+s4KU?!_RScsow?u?@}
z*LYTcpJr_?zSJ-F&Iblw*XA-B77vA6j0KccJAOmOmGMgoYoyH4(vFY@48zz>eYq1I
z+P@|Cwf;5nm0Tq@!OB*SsuJv#9fEl%>cM;tOMTDch!J77{037CBxT3Lpt`W+k(&5J
zLf1m{`EUK%>yByc_uqR8D%Crs=6WT(h1j)!6r4T=)@NtWNb7CcVEb@CeIk(^W86=V
z2pEA^nV6ufIsP3Q`S?icvLKhlXq~zry;4U#y$tPRg1pAJqdVx<1LiT%W3Lv@6*Ta&
zxl!J11@D>Wg4BZzSh?g&&joPPkd|zX&$_f1M(PY;Zb|78q;zMp6tirJx+La<*5&kn
zM4yldf9#A#^Vjz2Fk!`G-gCAnwW;@nk0=nFR?6wQl&)%%J)vjUvhZQ%0}BMAC9J^g
zL{~nS5+BzUur6)YIwxXS*w*C)Rgp_dcGVlr%D&$Y-dMrgNYs|YX3MTBqFv$QF0mhl
z<xi+N=4i`c4}>Yxex&}y$s9!oJkxf65W06|r@60|DKX<t6j5w3&E(1#_cA}J1y#V3
zQ0v4L-wf_z^8jaN%TqkHHYehgpM1);b9qed=-#jQMFo+c+30khy_TQg|B~;yN}AM^
zw~}09d}$CP9z5tgdD8ir{_C0H$vM7#n?Fj9lQhP72XbJv$_t+=?J3Wu1EA1<LT;6x
zkB|+j<HMi9K;#>5B)49?`2PF*_jMS@eWu|B?W=LM&jDZz+=D-*5-0PLv&Zv3XX6<K
zXvCjc^=V2Ej{#kwr5eHc7j|QdCw3MoUn+#Z8@0<e?(+ltr9CTt)z_pf<oiJP=9q99
zDy|QyEIan+RG2QXH{wpV;T}1E0z2E6Tm=%I;>;FoH`Ia30%{8`>~E!$7+Q{lLp#<H
zRaGD^Pn>Zk6KZ)}<Z@sY98DZa2x5k;Q0$_P3#^wKDX4j!!z3ArkRf-ncUv2O(46ZF
z0V+9x2k%U(0B|{B$cI6a=byU98he?Hrk)gxl(|=o++=Iz)K6#vyb$nz7cH#J4o21-
zzlo#EJQ;r5unvLgG$g17k`umdOfunKjqfZ$^heoz@XdbwT`MwJ?*0&XS8DQ^4#JzK
z@M2wdcD%3alzK)FLh*G|T#A`94pt~=oYhMh>uMKSZqoe*wuF!;3Pn*{(f3a^RV=(H
zCx*X!hhnkFv#=*qd?T%YjWg=(C=2vXI2Pi}E*P}=d)*}_7MZL?95$%hQgVd-@Ql9G
zQt8>;9TCg7Kw?S+?WVJGMM_eD?NVTU7N1kkF?)dQ3f%b25#;+;biy9!@H<-5Nv5C5
z7K_XT-D2&GY>Z{&+RLFu>1<X(N?V@8DmZE^v~pkl{yeAqeO^d^wO096FxF55JCFN*
z$#f41vkK4YYX&I6<*<AErMa2!k>1~vMtaOH1;Q8a$`<!DIJUP4#nUHrNj>b9R%o^W
zN{%yA*xk)H{FNd1qGqL8cQF{hHn#5kIvh+5`0pB2=f~~Jt11Qpi#kA*2J10c)o~Sr
zxN;M7c?E99Q!x2|4vHtQVkuQ?ttEj<V)D9Nkbz{B__<@*%mpr3&1IHNqfs)Psf$1;
z`*BRiMm?t^{=1YpYHwqS4gE(&X0480%m8Oc29z6o#3FQS2C4l~?W*SVUb6kK1m-Tu
zxDXzrCk~if8_>cc2C>^}4c^N*-DXt4h{k|e2$Zp$R-vPR-wwL|qlK!c^?Sfre0lW0
zv4{f9mv>+5O4=XAWOM0I*`Pj%71euxZBM!DCsfefaDMiOb6pzF&oZ1>IJEt`!Tfxa
z!CY4dlgC#=?gReIqc8bFg+nD=HL)PnTJOtF^bGm$9Li<5iMvf(tg;O_B*sz#-BNf;
zZh8{~W}~ow%A}?P{hL_{dMurBVKuhhn-%Kv_g(&8CvoDQ3<J~sqbSYMY4y?P<sH+s
ztweg}VfK}V;ppZa48%3=hVmpEFjB?-7=L)%#-HDQ*QA-Z+Om^bf(TJg#g{+5Vd^*j
z{Y8?#h(z4ze5PtVSN;Wgw`?g%Q#?rEeKfnzi)+<?uf?H~Of7ql^Nj9>5zFh$;`Iw}
zT){Kjtqc;G?mlK_8&)2`B0HpVx5}Riu)O`Pmh`3a(kxF{?-}S9U3_8JT8gMI3@)>w
zw*$Yq5=cuN4e6aWtM_)T6{Qv>C#|;uuLg-9wpFQ=tu+H(2v;#bXB-tQ0a(h2%X4QO
zTWg$uzVu9y&}vMyzNHJZ*I+UqO}davva~kqUzGY{o7b>>Sw4+l2@2o-g#YpgTE6g>
zc^LOoV(6SPV1N&7mGpDaMw0Iq(T^`4L(^*s;S+5f?A+-{)~|tfwoZD_Bt)AsCed~}
z2Zn+^C&ANkelZ_gdl2aaHa&v6>g?Pl&OeoZ!dzTtMvF~h7|fy=n+pKg_xuOtq*yBm
zjlkBXcM%3sYZq|bbbE0`F_v20T^4DZ7An2qRXI;)S4lFl$gT$W&+o?GC0-4R5np?@
z_C%My@HQfNa3R^}!BZBb!YKygf-H5qHW`J3gGap)wAC;abxI13k`(DWAxY_P-W;rd
z^)F`4=v*#kUNqSfqgR7OPUhn=v^L{)2^U7i0D}osnDIyfg?%oEphF4J*Vom3%%*Zf
z!YLpEhBA+*cFF107gYN)-*vswlpobXdFLKnvY$ye(%P#IZJx_I&WyR-a1HUJc@`&+
zp+raFW6nL7P9&ngqltq8X=r-l0hxz?rHmo6v$a+c*9Jr=j<P_uq)syL{mQE?Er`uU
zwuNsReOoh323GX)pz~S&lF$B1V#p`;2>Umw$)Qb2MUGPUYoD87m|TscEL4~Yl`41C
zNfy;feF)`6WJ1RiQ;XhAC^g@dClo&Vmb+vdYqZ!1VeSrYT5-o2qA{CArdzdtOL5j7
z)}u1^wb!FGN3$N0SlSE^s)zhin0*T-CT6%|i5>0_+R~;m?%Hel@;{lMk5jIkJmwR{
zA5lnp>}xgdq17Un|1bjXOyGkxyThWURy}!CP1MX;)>r|jDB5AOT2~(R*gmp)(3R0j
z>;R-S2#KctbsU}4F2(u0MhcXF{xcFcQ0|lqbI9Zny!lpZAdDG9NQ)4?PBmO3$EeFf
z$ADUUXhEUGV|QKt;S9Nzku0jE)U{~~Luqrz?FyL%O>aoEuHCAIC%c+(>CSU|t_J#5
zw{pM+;lqn_Qp|HPmu>F^p$6RTBPBSDOad{yZXT^qY7k$5x)@K2D=vzEY;41pA8Ah;
zt(A_5*2+p^*4M-G4}GeP+H(gj8at2F1bbJ9>N?qUgVA@}4m#LiG>Xs%Gj9A{8a2MU
z!I+)FC3!uijgSCv6KY{+#I4_8KHP|RDZb!DLNqTPZx-|EyDsmBdci$Ozw~%@f~E$A
zq}}GEV<9(~Ur`<;{(}~Oo4>ND<i3xj3I{BvnW&SMo;IAUorFKzBT<}{;DAb7A-KMM
z<OZ8(eXHDxi7?^NBirhR^FT`ri10bRe?`I$<}%g4EAufwtTiY5aP=5H58K&r7N+3^
zGkG|U(~;X4B>RslGfCV-%cn8XN2`<Y`q^{_++@`{!B%6oPVirUl|lRAPAe8)AFYo1
zso%zi!<I%DEW1JtT=QYjzpDpAe^_e{S9v;{!TmgD02VsiV|w^nE`Nmc*w(7kJPJG7
z^qlD1RT*-W4%8sdfBBLle{s`ok%l)Nrw*bbG2r?w>`-Ay@7`>@5*UZkl7PlQc2edl
zDNK5TZD_-x`-3WfkDn`&@a2I&HXXAar!01z#33b5HoXLRFm-Ef7r9LCynO4Bx?AU9
zoV>orH=$rOxJcYc#{#=d|5iqf9~X_-UQ7U0fZamys_6}pB<!mj$q{Z8Y-V$<Gy-z|
zV`RpSsnw3%dv3ESh^Gl=HZzw>QyY_Zd0v$k!|4?k^jZ#ohL3!0=cWjho6L$7p{eRY
z_~yC=9?Bx&Ai7RskId`{Hax;IQa4BW!p`ndI`X6>2xpaj8`?+Agg8)<)s&osI+5t4
z5T9q<buDkKY`IZX82mjM&U^~(NLl?od{rKG`N@SRTprL_NFW`(dp;-qRzk_8eR*sn
z?(e-<J>|83@am#a@E0pMlF8+)(ShXkP4xvCMP<F~!QLI7-%T|&#n#>QLbcQ!UPv13
z>>X1R|6Dz)rH2<zfHfPTbR1E{)0Q&*`dOYJ`VpSRV*g&(KG3D(+vWIrKLV5&A@snI
znEX;et~mBf;`a;)$1J(XW9M_LPI3cxNw^s0^<&U~X>aj7SZHtI{HK;~y91o&-LJdh
zgSIv#0)KS%^a{hNqgfb3ea2uPk-$gj-6Qxz@lC0k0=ov2!USHI=WdK~u=Ki$j2vqQ
z>o6O%O&Yg+5f{o5VF7av9eA@{j)yxQGcA9-?jerPyUP~_(Hh>$aPUTDX*eL{gI^n+
z%KE&2gPyNl9jV!2>}o!85IaJ=DoDN?WW$<H0nARvi57ykRm|ptG*j_{zv{|Yewe}P
z5QDHemj&&8DYj#pdt1Ex_Gdx%8cQ9xY^346^|KkUxx=MLPBh`vG{!H}SufnQ-Rlko
z(_~PGOR&Ctb8Z&NNH=~<&IKG#PG&LCZFsML_6CTbV7quzJ+a~KyWWoaMYtvzE&l`C
z?9PtQyRll%i^xS;j2nD7mpG5-lCWV?cvq7k&cwRJQwn>XCGkK;&9VYdc2iM-$5E<w
zDC^=`OpUd)Y~NkAviy#<<=(*RSz&$1%3=>-KQP5}vKF<!_{`!3!<<-TH-Xwn<?EY&
zds&-b-$~c6aef^Gs*neXKm1YR^BUwxA_@}|M)bq!lgAs42z}6RX;m<Y`L-Cx{w+aY
zuEX(+ID---XaFM{#~ZP1yjC8PPHz8lHul3(@b$`3=|jx1ZnRR|X?2nEm+;rfO3B~B
za>-XKN9R50Mp%7&vjx=QFo&$RWtrrE^9PUEvOE}iBd0IdpgcUKKB_;UosG@KgJCW0
zu~R^jO{}9rK9+qHn%1(Cvy|WwUie5JVQ-sx9&}XY2|Ug&Aj<rjk)X+T`%!k$HCV%5
zngKm#hPciYsFiU1Y((HhN`pT07w(eh<+Z-ay!@ehPP|75O+sqVya=ZT*K}8Ze(>Fp
z-s9^`O&{gip~a;$^BUjCxZsV{o0(5Y!OXlJ?w((F>4z>2pq>Kli#Mjlr88bM#+y*9
zHx~(?t83e`2L?GQfI5NbTM0PVZ@Ty<h&%TmEyo9OVw=+m92XIIWG+&bXBRXO8=3gP
zBsY_6I+sKW`J#(2d>fqqVA!#L?T|w!CHi$}W9V!|%q{WCH_KVS-mZ<+c<1+JL$iUC
z#R40HiMf&ecg3HK8n%&!f;({0U2|!Sve}3oN>l#JzdHDfb#4!RkW0-QR~0_|MWPh(
z=dV6b(I3}n+B|71SZd3iUkjIFk7Re#NtOek)PPgjyqF6Je&R)VMIX9<_}~r5KCs4+
zyk~X7e{daax>p!Xd!!(_!Odf;CX4c*g_3>URk~ki5&1!X3GK^ED>3`a=nAdhq`rDd
z(fB^k=F{4wZdCK0BEBh|U8WNk1Z$GRr67-=ooQjuO#C>51F+E}ADH9;Hpa2lE_s~_
zz*_-zQqZ->TrTQLxl1~K1~7*_9mrW6vil+-X}AQ(pg?Tf1YxjE0#VGgE`OLTBnNt6
z7EiSQK@`tQxv30#FrBtX#4AVT%xC`6wXSX1S{9|Yw2kQK<Rk=eqj!L!Edg(57o+SP
z33+&!Sh9R<>#TrJa1=Jk?ID6~nx|Qw&aPb=fZvp!=jVCS1|~LtE%-P{31#!tRDRX`
zCkeYZSb4CfT-P87SmS2zs0vWm6FcL?JmBqG&!XM1;H*6}!bt5w`8OZAZ=XhrZSTtS
zWe#9=1h-RoRxoRg%_+QxI?*GY22xeo-YvIIl%yPeE&wI8)FJD<x>t~boQ(=T^-z!a
zf4Y6TzvE&mmWtDVI30nOqy7jJ@;Jv#f9Wu;$G-mF6f>VUyw&TW|B6h&5{>^pZm)+X
z2>}MngXo;j@C75JDyqv~I_VR27MC$y>@6aJxKG5?Y(?jSDsO(rvb3T+9;EYvew|%U
zNnVMkm)GWrVTL<9{Rc3hVmiOqzzzeSXmLRcP%$GMD0tg{s7y})kqV%aXgSnG#Fi$B
z%;bX1B^kjiu%puPIgTPA9=+{l{)AKGAzL69(?pz>PM{rIo45qS4z!6Yw1G*+@uh7&
zHU1d|5o&c0$K%WxBD=RwcyDj%6K!l&Q&V-4sDT>IriM7rtij{sq%cFgH>xeJDI2-q
z`74YDlJ1dz8C6cUkSYb%1Rd=u+*gZLltKY4zn3+0bJch`6e*G1O1>`WPDSXqxiDxA
z6J?WTLM3dgNtG5D8j*HSIJjKtXWGB}o)_ZZaS;8;J`U4Oiu6Lc?FAQz)vk3}#sW^0
zXGNhG-(;5N;@A~nE|UrxkC@$p208D99wd31D1RV-=sTt;q!j3#T(sn#;lK1^8C|0{
z3_G7QLf<h^%mvCuj>4pv=ejU1AJGjs$c)O9d0|j=$BDrRs;rIZB8o(h0Fpp$ztq4H
z2{;nRcy<H?8o-fEMD{;PM#J_GS%K5B9GyS<A-jS`(NeFWUbe)2$MXpmO5fpQrwNNJ
z$7_P(G|AJke}zD0=r~y7>5%6{o{T)l4eA_taU_L>69DJ=G%FbUYvjOtio~W*vJqNq
zgA?UzF*XmXL4o8P_@-i}m{TuMWaiY{yRxVeGW=jzxuliV*w+UpowJ0@pt*Dm3CL&O
z-LI^oJ~VNbf0-j0$mCYzYJH_B#TRzFdvZ1(&4Fjge=K-s=g`kub0~r|k;a3hc!?<0
zp?ki8N$=B2H=bnY2q*A=LjjjdPO#&Cy`Nga3edg4s(j8Mz-$o3LNfwe3&)XrWnmP3
z1nQ^5Vw9@RTA=hoLd2sv9Zgxogf>SPZyM(ce5d*8C`UEPS_;O|^kh)ce77Zjo@;Ba
z-3^mUe~_aUK+~{X7w1F`s2RrzTEsyU1p})fIR(9ixI{b@+pcTVFTbV;Py*=+Tp3+W
zc~p3($hNCGQy3+IXR2+f9=vI*X*J7hN8B%EAbf1aBaTF=D=OYoC&GIv*k{CMV09lD
zG|%ONgn7EHPdA;4T(}ZoL7_ccBlfwYJqs3Je_M<KRhAh{v{GpzC?XO3x2TRp`D<?M
z%;wQ9pRIkYNzJ5#0~6Ns#!q_nUH@-f0`T5$yxaU*Yi(JYTd$%=_}^(wNsATLK5V&<
zx2yNDs>H{#|JE!2@wNp(q;xIv3s<b7sgqFi)WX`v&tZ;@#)+xq-~+jJHd{qewJN2e
ze;JIOm^j^rasIMJDjHv+7kQFQ@DGX2t4d9v4OeW!rdN#s?6`&c66U|xbO{w>5@ZJv
z4U^>9*Q4;MWtFaraa0*1y4$o&$RmbIwAXv>Mw<Y^nu#nKqWKWk@-st~(qkOLYGOYm
z&%CxgE6(6x87;oMAu>w644|`c74M7sf5&kEH#jZ}hxp^fNC|H&%&Tuy)iQFDYrgmh
zVTgxANDILT-^&nV?swG)d5EWq*9U=xZg7sJeIFYwS+Q=vZAL5WA373L9@;rklz1oe
z9r%|K8WVqtNKBQ?OwEohw_@SYpG~3@b;ziG90+;_EN^BP%2lAX!dYzP1%^V-f1s#c
z(ho*-)Ikk0Qsnd}Z<Bl^$K-X=pL1P6wDf(Z;^mJo9+%pprDDZ0j8A9f%fh|@wq%`d
zOr;nYJK3KZCd-$4E=*m?1&^=Q<pURqmBmH5ivY<3fDWsgWS!Svt;Ishx~0Y<PyD!n
z0OAQ98`cuLsX)P9V(K*|l@<yIf1;F-c)mZ(GG!-dgRNUaVLpL%>Z)FmE=&}#euW}`
zJSFykt{qd*bn^gtM?}$E(F&Sfy8mx2m~Oue-8$s+_HybrD|XjWA2vlu;SfkMy>EVV
z>PCx8XTCm=ys_WE>#Zb{vtPXOV~k+~3||GOK|xVrL#ef#l=+ZC`*6SJe`#^(K-V;s
zRANPIaE?`s!|{zZ38ZGX*XI@MZYuZkL}L`*I3;iydyrZvY-~5B#kB!X+%WKFSUp|U
z=$S!Pu4lX}S7j0VTx*gV2*a~MB_TsZ^#IBp*Q4Se2ds>7boKiH7TG{W;>BOH^W#BH
z*=~&|TGS&}>ftMqQYM2@f08eeVM2)`@!yhy&e_DsF$bPl=YZmz4@59TTt~34hzZYC
ziuKW@rP<+p<e44~5ahOukA2(Ttq^4L6Yk_&!Xch!s9+t8M+yj0*RII8I*Of1ULdi1
zIwU-%IU<4X$k^(p4TQ%F9EOHkc)&J@CYmz3fL7T<se)}Rn#|Cwf04n6*Z736?t#XZ
zNEy6zoVeK|c)ypDjM?G4L2L8y7rd%H1}+btP@pn8?ull`$UWoGX~p%2FuJ`jTG5?W
zbXTg_du?&!otMdVU3(H#XBq-}d&z!{HpWF5iQtB~Q4Be~)s?|WRAq>sT_{w%l&*n8
z!<MY!U<pO!mO2{Ie~Zc_3Ofrsa;ZHPk)ATL{ILYtt<Ro?h2VU^cN4$2+*H1RcYLy#
zf3ldrYm0fA^i~<p-z?V(YE_k+C@$|%bJ=z=?zPmPEtv4%p>Findet%b{04L)IGro#
zWSQK5FG{6L5o1F#mY;|_qc~URpG7C9DMz|IGOP!(w+JYEe+`rai1S7(Y9Q{){M$|^
z_D{M+ys!CVbH$pNR;9EuVCSzG6Lpe~Z4Da^edlT_xh=pnC|BU^U-uD%hN`<pW*#8Q
zB4Y^n>>nfu#2n3>Oxi!5i1_?da=w3ba<XrGYtMN8ZHw!^9lh%<RIkmnukbGJ+(ZHM
z`7gbz;z*_6f3SXK&}F&4^^t^<Z%wB$&D}E5?C(7YeuZRI9>_-}6P;FSO)|<Qkn08t
zcyg7&+CM7}qW|5FU*l(#W#!;D5A7IVLWWkPX8jnU-j%D9Jk%-tEDae&Ivjv`2pJdA
zo<tC_my@ez*=pJ)F@gTGlEND~%<G$=-py5y16R35e>bpiznj~Zhvo0&o9Ndfo2+2$
zXHd;r(Y;pm<u9;#xhf{ykkMdrg8*!yw2g0wcheFAWBC^vN5_X%dGiCI8;LGWJW6tU
zs2slQEmM`LLU`q4IcOza4MYSsz8k$aAkvwkEoV}RbDRyNJbRwF*gHwXvWLXpJ#T!G
zb(;jMf5aD%)K+Ov{2FEs)<wI*V6FQb-LY2>>h@aTeqA8X-1xvF(LGxBRT9YA-LHsJ
z>Hoj_;uq~9?$74B__m{f=&H=bsb}k0v)`?&!?BTr%?#h~NLuFsIdMq^%H_KfMbk8K
zjtZ^bESXn(T)g6Ze$K@k2apLT091u2i9`+je@`}w^TRxeIV%B=7j$`&w%qKP6?!%`
z60Xq7$^rfMyAq7K;58#=vCP2o3~KNeGrDFcIMMt1QU@s^O)WCn3B)A}mAW;F$>O|9
z?OE6Ue;>ft6(U#796nj1{^wbuXrKQE!D9Jj=_wXJLOWDTWRe3`bKXQxOoTt@zHw?n
zf4^iwE*YzOruRKGx*PA>7VrFPvuAG(k5ZQ!uGS8zxS9E>VinprpklMzf;)WfD%w`V
zDHh8BScguhV{QYFV|gWVJ9RTOYa@HMZv2M735*vNv|@E$Gm4Jip@i5)C-aL7V*7f-
z*kG@l#dmoV);JE0<ckW|O(*F8F-bmUf1Q83U5}&(>GlUWDyYvSda4Mv+wb@iec+Ba
zD7lN>;+_~*e<Z4`XCXE7voFNV;yL(BgeY#F@E*5*o(oOT-qv+)8t$5gH3vNO%x#nq
zZnD@+{+D`y$1&ruN<R_HFm#>L{i5C~@z705*?~jk4Vn}}4WQ#D#4{y1E1GG@e_5_*
z%4UeuT@r_t9gmG84CQ4SF34Ag)o_XxwJ9Nc4gRU~x*;)F`mGH!L_6Mqv>pddHjx}N
z+`UtjH=0<}nhQ8^{iidMWrsAtJ1$q)N)ene9CIS6t?%2hQqO{&^{fAuf^JL(=#lHb
z2wb~7p$3;*J5u;NWSSxR1{3$@f6JBD9+{A3?+22ZL?Ue&*R@S_L&~D$o$|+<<d}AL
zzU)L#v#W3wcZ-_bGgnxC-CFWBWTrNCGt{2Y1pjZBpXfrB?3luy-C}+&zF+U;7}7U-
zdHhPO6BeaZbKq?eYFl1fAjktiQ?5-Hhr2fCqFfkyLvS1#5d_YQEWg&Ke_<4neq+v;
z6Fk+H_ht_?B?Ik|<j2=xJs|79>0^w>Di8XrNTe)-DEatHxziH+ai&?0K-BosPdv99
zBB(t{#D<W58EoRf=apfFwe7LWu%MghKjpqY)puJ}-))ulRa(DKI@teg9qd#gdY5Tn
zL?~tb%MWE0f1unHT-jo#e}T%8w2y#*)}5xa$CW8?v2OKdZ3F7YX1Y+RD(Onww7+pr
z9uKk7_SrA1<Zb=?O_^IUYcXfv@}ni8r!~HBx2zlbL>GrAY~m#KW>ZS0^A@KxZ4WM>
zl=GGd9DrTrV~#|lX)1*}S17(WN&5Ph$8#4(r1nFq-8?jv&H-2Le@)g8PGzH=jr^0)
z?M`qJi&VD78`v}$v~K@gx40|d{a<&YCoZJXh`|7|D{QP|6+S`2=$6H7y12`?4cvT-
zxXqP!tWNi%zFf@|1MYq3ZFY!_#s214h5k@vr8PF?t=G_*cAk`$tVW+c2pQpNpbCa(
zmt-!BU0{z^P~K^4f9ESGTg8X0)X#tO8dfWg#e#`_bZ4VH&zpb++%)>}9VKtQ4T8Xy
z;}kbBWlJh|U=iM6y{+u9#(J+XQSYxZPzN-l;atR<l8cz}cKGZkgSEz8pRK%j+-r!R
zP)+SnnAH@{iqeO<LKD?lvNLm8NZ+DF97I2!JZMD^e|*u3f4;x}ycHcC(#OLe>3{z6
z{Ac?3l>X=VDgAn1b2`^fy{3jYUvEHujgoRlW~>~F2yD0Z_xJgq<A=aLYCoWVhI#uD
z4f9<7`896;g=RCIwND@OZ%2px!qMTXadRJL+$cjETa%`&dX3-YhDP<x?CPb+#y62w
z{AzA2_20PLf3#HTVO!T}sagc?(@IbOZ3~Z_Y2}gn`WgS6awNEti<Au#9B!jSF!wM?
zQF0fbn!+F6h}|COt-E}JLHgEGsiHK_k4>0(Bu<_JTI2(7%LDS!{ckh6+=8DWWLqRY
zldQ*&CL>yqJ+_rv)e~PbzyLjnx0`7FkQFlIq37Ave?d?>J)X}pgk_7vLE>kyesWea
zgElsrk0*+z$Qpgi#`6VSTFtRRn>O#6yF_AqVW7<8D@e4oKBVRGdA7qF$Tu#_)3*&v
znkU22ne<fDr>}jFSI4UlFVFW5Ssj+AdoZC-N%6eqlu^OdgG_*-87Gg);vW(Bdp6a@
zmi<wxf5Fk_BsX2If+1SrLzw327}Z-|Cf7x)vS0!wnWPsJePD*YG&`Y5lZ+OjSiUbF
z9-cmoP7m)te%Omn{^K$4@CYaqz9Ot+eSu|aTNT^T6o>aQ>a-}>4QYUXWOv>;8z7pK
z?c8+0#&IY5+4}$ZZ97XbbePFP`A2>uR~&K=f1$7WRLYrpvz1-b6)Y~ndt=PWU_zP=
z?j1fpefYvmnq%n&Q&%x<WQCAP7#&6mO&^jC!+|QxQ9Im#(N1h`;4F_PMXdOu(Srw%
zqdjB8p=lccOEo;l{g*E0S<Tfwn@QC>sMw{W%VacFkI~xJ>9)L7G{wVe61YMHK<24q
ze=IOfF*tj*LD?ZPVii_eK|p=ht>+_61Sh5k2?bMpo)xo;JfZzs#3#S#>P&oA`Bk_0
z`>2+8-kM5_^n0@vojtkUV$<Vm)9OjI&1Q?XwtF(ku7;!dWwNcN3)3K4zn@<G$2`fe
zx7GN0dhvI(*KFCMUXi)~YkZn_?sP$jf0Bkyon|@7PAtjE?O&*Clc>Ygi|ifvalW>S
z<=YgoWP$n|jKw_7Y)9k-HwEw;WpoG-AjURA+LLEcw5?gc@owQC0v3~WVodS)Qzs-1
zqkt>qzGoASShFMIOGFIREtfE4w61A3osam6wFgc5@x0oaK5T`{ogMBaUeJfNf2Y2l
zjtsz;Fzo|~rQ9>_U3=$xPZ$R4^~Efsbm1%Dth@9oldQ@Jng$;V1J{%OB{4aqyW9Ee
zC1HkQgyK`z>W#S6$;)&qK>D)h?h2xf^brs^F<-|JGqgf~G#|KR^~(DZPEN|8(P4T5
zBRUTx!<Gkb>1<&eUcv&q;(+31f5Z_ZhnTCEZ!63y_GJo5%IDxP?k*K8`tmuN1Q07{
z@F3^sW0FH5sBJPe_tsjIIUf21lQOOt>7^r~eO%L7QcQMdn(Pq@Os(=4o+q97oOse{
zIgF`{HQWE;Yw=KZ0eOfP!w&(J7d?%E232q+3)1Wcbmq^mt;lSj@kHiqe-a$pNAny_
zLuYFl1bLntF{i9hcbI@|2Z=!HizD5V1OKb+q*G^+DBEc3)c^VVy|x$(y+5;QNfqXD
z-KiLY*9{?F-*{WL*=`s#yoQ~XyZDK7p^io|AVk(gRf-;tr?ly?EKVXP{<YZ02Q718
zovlEvA(5Ih$~10FdhBzLe`30OG-7XW5XHK<bNR(BB@sz990@|!ooEkf$)<)W3{fs;
z#IF$aE8VlQ{%w#7|FAFQ)-KY2pr%K&DWe0)+rzW=D6R3;Q!=?m03csXyYz!<y_>gd
zj&E*T7hP9^7YEYE6H^OYsutgH3QrKNY0GLeBvIkogOzjA*R6a(f1`QgDr84L;f6k9
z#dG5gmId<aZ7UEGTI(oY8-M+XL$_W?#Xfh!Htg=id6^{^ESClia|LwdOf%CE+e2in
zS{1!4v7D>A>izb6k7qWyF7Y5%MODC=!rmvq>_V{-0Q$9jkqrSCH~9^A^9Mz`Q4t})
z0ps6Jk~k-p{T3}3f6~HvoOeo=<Spl0L56bvSigO}1lG&95{pE|#mem+-^9I&1~<*D
z@_PFe)%Pj0>I2TK3Mh5G%&M)rv==5+ZPx|O{fyHIPd9WZu9?-Okdq|5j^|_HGEUQW
zDNWo@{Q9l?iC?eoXHcJ}wMjp<E?K{$_m(S^*X9a&Y`>Z-f5eL{;>1=jA=6~32d)h3
zzNp?qKKeC7+lyBOub>z&aZ(Aw8^BXHCI)xO=7VdxVci`ijc<BE>6op<(6rN7@2V=#
z=+j;GPVTDPw+&0aeOs%oZF)mkj3vJo@tRkH%-zoTRWeBx+py0*lq=EZG-oKY<_pfx
zii<QML3+w~e*hC?B$)z&Daa)z32{KTR}!<cDSd70?S(8xTvRe=dh&u5AEN&7vZ~&I
z&0hJ)fBg5=L&;rxAoyu(%kWkU@~uJ=!Avh}f*tW78z!XvJYkNs?T(nwb^LyQCVsc|
zZkUOd(wG0X;k}rMDP-y0Sj#SDde8FI@VIsHIy`)ze<*B#x??W`XN4jkZ?EAVZs4>x
z{s!B4pFTA^=>GAC95jVH>OBe*19N23$;@pi4w6a{Ub}J;m!Flx;6IILuMO!2&oV&=
z4OfJe5pl+RyF!XKS?U4fk-yj0ljA67f4`uMaji=ui%3H^P?&Xi8*0qufqxQ1KB>$f
zsLE_ffAyb<M)F}{m8_?Mhq1$|CojKP=A{}_bxOGMo6S~-wCrsRr$$%5(QwLg%gu&U
zE4FMp9=6EOlBvHsCJ29ZNu4{Mg`q$z!6=|`&;?y=xH?AMDP<>a0F;8^WTA|8qrLJW
zV+L<GoB%|2^MSbGh)`vuuC+0OO2aYXe4gZ{e;HZPNg_YDhf?VQj||OCoKEDMRGbfs
zq&$TSt#Y{XHB!rXLNgJc4P8Vbt9k<wiYsj2QGr%V&Wb+*20HLrRKDKGWW@2f^r{ob
z{H8V*$lQoMBaz?Ynx>-q`FxVpJ{gQYT!T@GW<PSXkx5QKv0X$--pqJpTA6AqOf}Z4
ze{L>{C=qo4Fcfs{UnR*){gc&d2K`lU#S{9PcZ2t0TRs@WB?GU!31sZ}mIy7nc6{<I
z`nNxQaYw&Ch#J@QU;D|E_F!=O!w(1J@j+1>oSdBeXQSoMFlyZW;_jXHojdI>{&afx
z-od?pKe+cr=Zi1Cz;m1}KrNr}Z1$Q)f3X$;j%QDz=5}W9OPl{)X0Ou8qmp#8$-J{b
z!11kdb`d<z1!?81B(AvVA@hSm)YpqKZ)Hjx3_4Gqbg;G&uj*PZH#?CJ$oKX~Z$wVQ
zdV@bxx^J%o&f*(r!x<qelV1ttGm;nz4w=c5WNYG?Hrka&E4}cghO)k^lM($Fe@j<>
z91ZE6_9%UsxEgK>%0Cf+LkXkAt9im)l#5rnRvF%0;-K)Yk$nuH6xI$Wn$~t;Vfd6#
z>6s$=`y69OXNAk|aus(y+^n6Q?}Qi3f%7pZDGBw5Q$IpoC9|`ibiEOwd^*Rye;Ly)
zIQnHT*cMu<8U4!fcUSSOfBENEf8Rbi{r*2spWQhe%%3zxX!X}`BY{<4Y~w}WhKMvg
z1d?fy<DDIo!esO5Xi1YiHt}T~0EQP_(TYWtk~O7{Ruct)U4k8NriMGBDXkgIp?-K$
zgZ{#w<#n3Oq<<MUC*Lh<FnFo-l?!U(w~z=R>2AW=d7NA=0$K#n=PuLHe;`jZ&h{yO
zHfLmK$I)pOG{-!p3v)6bBQPB!Vr5G{8pee-WCq6%%p=DSs=qqaCG%7nM9GsbCdq3d
z>{@WR0QHSk)LbF`6!p&>fsMf6y!zVpBjJ3Bt3(2~ISVnHcw;k36CS!<Ji0>RXl~wQ
zR|;>izuCK5$VRXQutJ8Ff6|GEM13VS4lXi7Io`mIhjRI}+z&yTrNodrDzJxV84=VS
zj@9(+_Ph3g$j<@Hs~b&;U${qZ%sJXlASn4E9P4NG&oJRU%Y3@CAC2@Rq{QEtd)pr}
zpGkd`2}F1Y=uP2mrg5%{RjKt7Ie6*6t^{GhrH3rC;4<8+aQB`Pe@S2`zOSR6AB!ZU
z+#*C~m{|^3e=Lq2jd`Q?U)8zWcR<tiPpbN8AU5Eusu?oR={eF#vw0EDYpUPs*uKva
z8>%jQCmW!>iNrjl8?WO7{<y(-X~yN<;NfV~y4q#R9wg`Ui=CYx?bX9yaGgk(O7iP`
zJe5-M*MZznA}khKe}qNRCC(i~x#lO+;V|K0%UMi{dgA2K2@D{EdYxY*IJx>DQP~A)
z;b2(yRxQ|N=*Zb@)Zo{+uYh3X%?t~gvTR{Y5jRbl?HLfm*SoFgB`Np<KwO4+2*wPA
zxV@K61KsSSSfL#fRCsAQYmgNI$tALYSbBP2c|r3GmAHojf8VVNgkmc?NokwoTt6L8
zUeU^)>su|hsZRl!7VtVvJXY5lkeemF$ST)h|MgNSY$pimr*+OI=UJQ&G`R(3l9j9>
z?A8f;Kg`b$cFvx;*R(&UC|%CaLkXOj@7*s-e74=Dzf3D_ZAB+_ICw==iPNld=gv;$
ztB5pFz5vt$f5gB7=R}8w_0#|1BlUduUi;47_T7JLtF@?&XZQ6(my^4sYV3bg+oM&D
zxHecGz22HyBn@_7vr43`|L>h0`=`LFT)K!9fX0g)Zywp`CN}+T5CdR`^3mFr{VCR(
zA=flNzO}>Hng}*CMBdydEG|W)3HzW$t2~K!J;MpHf5iUF39&U-w{enmR?P7TwZ}?^
zn}t2z`hx%a(-#)-6fb+d;dZ_x{s#6p=9IXR2<XoBRX)Ji+djb8{sI2k9pInk0KYPB
z(#rAu`6kErdh_G^^T&UDfBtlQKlbCBT}_~FsVcp-L#)kqO|vyUvF$bda&dW9^IQz~
zu>o0Nf3OP$mN1s`QiJ1p!SFYNcozNm;<4aIBt{oLyB`<HpT3Ne3F@^BbO#n-iTqm^
zy%*i{bVAIdizch}PnU3xMYH|r_(x@;%MnT6tc5%JPlzqses%S=08IZGfood{eAB~N
zx39|Dh{PVHVf^-H<+j4}j`J8Wh`o1z&Nay%e~(PU!U0vt(T#CigSnbwrgbyzyiXeD
zGQ5k=>rLhgw>?5N%v_aKa8I3o=6RLd(ytG|kR>?)g9dT_5~V~hE@!RiB2SVD{)w+w
z$_VF*1RTtjd-|u&wO~o7W?x?yt*98cqVXW2`Chc5*Q2$uaOuUUGFSA}`KR(>E@|a3
zf7#!x1!8=&@^og-Qkrg<+Oh+tg4esA>mZ2Qe2;TIPn;{}J?-m#K~g;K%Voa-Z(2Cl
zA4{>uDcbfRa232!iX*)*e#HPRL!e!nslJ!F#@yxmoob+=F!I~h6ccUDwabcxpv!Rt
zq^l+2Vjv9O2&37tz2D%Hx)T6UD=9=6f1fLY+;obJDSAo__}A8nFDqLvWb%%RkR;-f
z1&|(e1D+}eGrgNyB(km_v2J7Lx1mb2q?*DC#l~qi+tqDusGMx3qHJ4B;ZZ-$qUS*D
zQeO9FgOUU*g%|tDyXSliJ)F;kk(8ut<9RZ>N-AD#69;jw<@z|tPAKOzosE+Ee^J--
z@0Fw0hG*QcTA}#wN=;J7)a0GcY6^M0T=ZW#>LtpKQvtTB12}`)W<q=`njq9=wYkp-
z^IMhXo#C;5t(QsU>(Dh?h_)`5uOV1({WQM4gk4Q+`e%%KQ(5`VhnQUZ#!srP&3W=u
zX)E^ph4(`g)=EUmEF_ra!^acNe<;Y61>S&xy&o8!_lBh*REccLn9lm6tXPq2!jCk|
zjUVCLp!GKqKPj!(l=mwFnRD&3eub&)hv|4F{bF0l&qW(Kc~+#pj=afZUHes@1ww`_
zBBQGqsI*3Rp~NpSU}`YjjxWJy(}C3Pp3Ju=$V;PLX|&P{C#Lydg&}4(e?=%6pL0Yp
zUzP<;AqVF7eLkqD6r!SkSR<s+upwI=V{9rzcpaiNdEKs-;GPfrF60w|%cd4``VT3h
zQF0Y9tT$JF#vUlTuH8l&);{E3yTPoHB*P&h+V&Jndz=m8QOhDbLt&8wmZmf<%O&N@
z#o4NZ@Ut(>AZhV9IGj}se`a*@aIuD>P`f)Ho4)Ww7Bd-}NL2hS%c^AN=3XMWPWAY_
zPrYM%4wd(!X}rCf@vh}v;A0!1AO@j(#bKECm~Ff#33tgjLu2)zM1LDdx$j!04GhiU
zI5(1O-?0>1Z#XTDw<5_}xz5S7YnVH4u0?Lq=(&ce^4*Pd1B2zlf9lmfpvg+!=W(}<
zGFjELh6rc52pDvlH4-1#faf?cy8Nm;Lo0QY)FCZPA(4SW!)Ku2ijDQ*nC{f=q6Z{s
z(m@9VJ#gtH_r-Dqr-?pV#X9!d+!VWsn_NHS>tWqsKQ=)noa8?f@8^9Z`f!KOM{z&7
z%tiw(-o7rfh%B2qf2clLPhE?hB``Q8SlgAi^WqMJl-te<N7=eFyy3M_y#lt?;R61?
z9k3ezf}SDwMOL=XVsrCKsGHP5l@bNDiOc@hS3zMo%4Vx99T6ywqx<cjn)nnMjB;@>
zYR*f7q{F`#Qj>iq$r{YWT{D~Va5o&Ekw4;Y=2OWbW38GYe?7niS!>S|Ee{_T?<Fd*
zJWFZ$W)tn6^ULdBTwcE)?Y$MualOjt>s?-z|2#ijrOmBt$Tz$A)>Egqpe7$`5pG$2
zEGW#sblwmRwT?F;YNTV7;`^`Ljp*yBLAyKxMbY~0PY1(B7zoEz^&kQZ7lC{zRlvbs
z&Q1BMS)C!>f7PwAcFYZLhsuA>yk8-M<Dp6GY&p;?Tew{7@2TZ&EcYg-v?>3@U{7)F
zMD+l-Yj^@L#5U<zZf1f6g51`zSy}W}DN^g0`3f!XSW3=CPk?@5kJUR`S*;T!D?4U9
z81(1|NSdWKrSJj>+!I43O0<~z`hs5Y--!vW7^b5de-2Z#vTR|Gb!CfX6kF?`dWSSy
z0q9$6_g5;>Z&nwCf1d%^$|V1}A=4oYjWA2pR?<Id{iP~XVFZyLLV$aGq<au7dR#a$
zG9NSxU&Mm8kyf-8x6MGY(hxRwuV{Aa+)|ztx3*8pxTJ8Lj=1Eo=UwuFT%6~~I+~a>
z%E$_rf7W58S1@c4<-FLM_)1N7O_QY_Fm>;X#d#=RL3DkT!Q>cx1;sD&>{U9DNU0(^
z`%89SFEif#qWf!h9@L3VO?Lhn4@4v+^ETQiNwdpyke}o&T3GmV9OH8gXO9PUk;l`^
z7LwgzYvm!g;KS)BqZWkl9Km1dFglaJ;}Ij7f0p{yj?E*|HG7Oq9={dm-6C!z;<~*N
z*ha6N)qst)JNMCvxxplt$hj7O^zCu|N>Zr<Eq!Y!KW>_iM|2D|f0^wgyt>M8X=ikd
z=;*9{%FGRi#l+e1&a{%>mW;x0VHYml6FO&SEti?=uR0;aU`=fZuvM`XIEevoneT)9
zf4)@Up>A8=-CA3Y4={x7+AF9<&t5^Fl+mN7m8fV8&VYMYtkA_3j2TrUG&i=X<-!h3
zK^#`Fw_v;<T|BKz;)L}k84V;BLPHfz{o0lQUj>0DB%A=?itE5DI;(`Elq0Koba%T3
z!Ij46e)CN=F0g{}B_Xg+#3v`c{pIA@f78w<;M|V}IQRB#25XFGynI|UHg>0L2x3(E
zPM8z@^*4P%I4JrtO$7arlx{wR9UYEFt}hbVhC=ac_d@S4?<k%4b2_%4mduQrcW*6f
zy%i;Sp5=aLhHI}8ld|PX)Bl{5-R*)Hze5evfEw2uWY#E)D_~JjDSVBGtt}?Rf6S|W
zWNbztDjzWHMseH{gOgt*(f9E*+6>jXX8e*)GvWp>s6jtmUq+mak}(I?ZI6Be*Iwaj
zEwA+L{r0;N@N8M^!rbzf?=hRurj;jh`4_n)U{2)T4sd!ku28myP9-USV3_)Ltd2Wv
zxhPi_OD6Mi5p8SyJZ?0(y}`5De}uWGa3v8bIn0iBoCO>2eqtsC%@~cLESP07EvD^O
zc(qV(2El7;W1O3w)TccZH<SIkW`rf=*BZ?uP<+B@zRh`M$lw<E4sO82xM3IE>PB3O
z^AY_tSbi~Co1*1I2`9G86DTzPQj`L+mS{L^i}eH-Zz=fRE3I**;hQi4e<f2j-(x2s
zuLh*~Mgh0&lv&NFiPfn~jP#1?5sOYCNllWiS<4(iT9;ezYU@k-bsxf5YcG9K-yj+1
zwL#aRxyw7Q$I<nYRLIM^?r)wJxuCgsmL6HZdLOBJXGwK79&L><xh-n*^vPpcZ2Yy-
zVyh3aVVqewzSx9uqu=!%fA8U#K5CtPT`aJ5|6A;3U&L&eU4h`l2ix_aZ}#8vn^aIZ
z7FJvEKJ~u2yhCh_NcG!Bd|qUuIn?EB+Ws;cCBs?!E?;tOVso>k@!byzQD*e{Z~fWp
z4(<_1JimXle|hJ-p5BxGfxtn@lL<oK-h8UyxMl^%Ji)TiE-as|e|@ZyI`+c+QZCPE
zU*R0GueWEBep|D2ooza_5re8a>qti%8K^^UYE1M;#Od+qBSU@G%jgOw^x4Kzen9NF
zbVKBorcZ&eM7*tv>+CW6YvR4Hi9UP19$!b_Xo6HWVY%bm2ClX2s-rmQ)2x_1Ns1!A
zpdICtNxRzk?gZBoe?EPq0o>oAK{xhEc18cr`j?s;!VN%n;(=EtCFA+E*wM~OdSVCf
zV-i~ulD+nJKHJqsc3V52?Xf4f8GZX*^xMv7pQXb{zUgpC+_&F;8|_}oQ2F=I;t`2a
zd*-{Z@zwr5%4g7pTVyo_DFDYTyU12RugVU+`}@vkztbRCe|g-Y)_CGZTtLL=w#0?B
zFYtrXCYNnMJn7-{;{}2OEj&k@_Aj#{nTR<~WdN>H-Iv_9Kb)bRO#}$MxxN6wqx@(E
z2%X(Bv*Fre#RljYW!qk~xoohKQ%YD=-|K(<a!My-6HO${kj~Q_6>R!ksA*{i*qWUv
zbiKhFt-yx{e_d75w>E%8jqZLK#22BNx<0f7Yo5JKqMy<M@s5o;2~__pe&6c_YeEeN
ze#T=&9d3=gNMp8D<}dhjp*|uJFG2n=I1b)n_fsxKq-IxHluacwc&LYvAJPU6Y(s@c
z|41e?++y+^3lU=obpvjp7<0uO{3hwk+5o&g_gV^3e?+og`8_tB=H^BEf^G`TB`g*o
zKMP+B=f4q)#H;jMYWZZ;C^fe_8l?2XN5?vKdJB2yo8`H`?-fNgV7SYbtoMs~Ds0E1
zmA<LwCAOlId(YJDy<URv{wTZ1I>jrKpP`5PtpH(UgnuO>@OV5O{(RKZbKj!lyJ}?g
zxSfGEfBBM{Y#H1GYKa)g-mlY(79G46O`+M6KEOEc@%wvRJA@&R3L<8jT2rn%rpHI=
z%p0EC`{)Q|uK+g2S*<JBxxRzHe;~ovF+6tT4AWUDE%rQny($Bh$e0bkb=$iccFum}
z`8BvrAK@(>dc!5jeU~ApP0S^VtxT?ouf~Ofe{cWc>^ZEH@;s{|m9^c3Ya+w5i)OmE
znXWb?!E`Ho15^FZD$KCR(i`fJ@!n%rxNxXpJkY&=>xw7G45gb+y5@p)OzoC!t}TzZ
zEpeUC`!ADOXREsJTPwfq&6U^EeH02KLEW6KNhPM$uC!Y1hvk&uyU=7$3_<;JadaB~
ze|iPIDC+UI;7c5Y+^~%`S{y}UYC&<+><1Qy9il%>x4xT$1&4|LfVMXh8-n?EF4AFh
zm5i`p?w{&=|If4INwuw&;Zj5>p#={GplP)athREJ%!2Y@^aiYXrkYp0+q%<SY|E=t
zd^e0Tt<`JShHh7{7>)H9^YZmDmS*@%f8}Y`h2{!DE=(yXq!!o)NLQLwKqIM7Di|(L
zD(Le|h2cM5Rsl?5+hVdKZp*ZZiQ+GBmL~jRFt?d)7<xa>2dqcs&<fdF29pvS>1M9R
zZcFq=jhisi5qpi1B~pftjqYC?2YQP+h+^%JvsZkN`wUzq7a&cUmCB?ZoIkXde|k)d
z89#3ZW5KDc-#&Sb8{cZG^GW*md1AcZ!NxD~>S8r-;KU6<|K7@N`*0hJCNs3ySbA23
zVtDf%f|yq7W4}LYM~4RIUP`>N!)H#jfA|Yt)n11Wi2no+FHeXs(Mb|vl#i?Pv2#Bd
zYqa-8E4tH)?n(j&-@LA=jjmn$f0l37Z2Lp)yiBg^M)xWRd!UCRlk>0nBt1sV>Y0n1
zMj4*2Laffkd^*i?u3X3)iMSdLIHErVjQKJdccK@Sz6;yA?U3K?x!A~A^+@ZpXHuly
zgca*2xyTjyZMpanHv38Fct^3(){llrSW^JDXTR;a*k|^C)_LRTw(y)if4>$x&Nt^I
zfu^`GoJ@nKQ<9A3=baG2C*XXxIdC8mbZWX{H=uN)x7g}b_YKqBOJ4U6sD{peoBwJg
zvA4?K|B$Nt{I~g!cY!aD@GSVi1gq-r+zT5}-5#fozwdk^^|j6d16^_$Z!L(yvR&vk
zhFR7)i0<^FPN(DT0ypQ2e>0ypW5q6rQ*Co734_vcM2p<;-ZltHazq?3l0Ha#(|81&
z%NN;I<J0DtU3fyGqwK`<*MTQ>Mbwx5@7@<*lrbB|=_DP`$LjW^4yNhrWK^I`2@H1t
zR57}7gZpkU@I=Cb2X^a!+%Ei(01{QV;3m6p_uneJa4Bti%m3-Wf91RIJibULu@fxU
z<w%Vu@g%+wt-)vpjVNeOHH@)7sH(wLMrzsYG8+^Ju#*Hr_yGfQG4PE|kmH1p3kh0i
zm1K4)7%avmktrC`%piwP*$r-bv7uQSXki*5u6b3k^?<o(D;g!Dz>3MLcqviwc3PTG
z<&wNlJu@Q@Rp}VffA+6PTV&ZjEf*y*imKTK{5GG=YR|$N*fMu2C^CLXKd(cT6M3^j
z!l~QQau)mln6r@hRrogFg?meOLGEbS;HK<~-e5bb$ub}DE|`2tsn%0$jI(5~ijs`v
z!(?jHaZX2Wprx8WX%wqKr2eU(8*tm#!)=TL1Ku`3H`H`lf9Y4hufF8Xmv4X)^H^|0
zbQUC&J<cu+scy|dl3jFdlcgTmUE;o23vUS!Mv}As!h~^e0deUMXWlqAv3`5gTMNab
zcDf&%={KC@Cy=7I0?sL6=79b`p%ZNzooLY_8^-t~o^FdFj?t91h!N8tD;XaGur#wG
zMZ9e+Fl+She<r*NudSVV5De?1tH#5VTNXR}u8>OVLt(cMDIx$G+2kUf0ho2Ei6anY
z?|kJa(VO?pAxuDp<`d}2Aa%^-xeYq{>I<(U^Zt^4xTF8fvhf;5n@~8v=Q{ca-Vd8y
zV5y7qmlBq=KI}zcl_Ls63RPz%$Vo=$qYmF>vASXLe@*yZoeJ2+G?xe(j(@QX!$##S
z3pct^(9tHrNH+>eT1wqG#CdX29$*O`U!M>RDn>c6(3n^?Qg=rgbETTpnprk|oD63m
z&*+bQ8p`=Emhk^rJuLJ#=j0Nn$tM+RmLATt*(@8sVB4YB%bGpN+fmN1*YpxxVEIdw
z8QR`0e`ebA+m`!GKCQgeya!!Ae)a9mZa8^c0-mdFHP*QH%I|!9cc0Gi$geH+G05nQ
zN1%xf>!#D+l3;$uC%H`GL6ZO1B)a8)Tg=bR5AI7K0Wqd-=f5Vmy@z2Dz&Af}`s-B|
zX#kV(qB6z1g!_)mvNJK5ORt+?$xjjlOQ$28f8vn7+$o>w@BO0a5NXRHpIuKgp2c;0
zI+|aklV}fh*dCY&LaD{pitfH1H9tWDe1Zgc8%Tf(x8DjRK$Ts0Dun8VdL2|Kk`Dc7
zn&g|&Wm{e%`V1n*N^TZhDq{p~BK2oZ7d0KpzQP*WYZ*mYw{|B>W42Y6L-8lq@vW);
ze{M>;!X?m`fLa@D>k3u3OtIJ?+lgf=B#WAORdcOZf|6HWx!m^0d*ABx)~iWV`R|5R
zTfIoWO=bC2MQFBHtMvwY0FRET@id){lBH{R!^)DfVKZ)CYk2VAMzY4woh550rzR{Q
zyT$sk&xykVqt~jMiaN3e%%&S%ST=U!f2y&|Tw$hcY&g0#3dXw8g~ejGS}T?sh^nJo
zqfD$D9ZJL=y^{*D{wKc#of&1NIBZZ7R-P&szkA=K3yR|fZoLmobbRBBjCDLR5ELy_
z^x0P}_liPXO$dajxW0V&c%m7V<-liCO=ueA@fCaR-b8qkr9T<dS$~ujD+En`f21O0
z9^u=d^*0eeDXrHeauvQvv3?$xDG!6$csX2Ny?UFtB_n~jf@u;3$(uaXwO{2)z^P{|
zeYq5|063n6Hx3{ThFccS6dHSr5?WVU4BK}LJ6yjm!6==)lzGHPoCRDvz0iq{6?F4V
z%3bjbC=x6cr+5q^_IL?V^O-3)f8^vR8I){?uD0v~&iAqGeynw@3@c#xc73d<>{egu
z8%y|-fSvm_&>3opdo^$*x@kHFM5T;0F`dJ;RECu`v|XJ!uwLg38YD*Uv%hxJ$&e;P
z@~<pM%rYitAu-|JzI_7Ov48va0n?d%kw+b-EA{IwDjja-M={Ehrm(are=i+ci*NDU
z4`0Qj+V{ee2S83{ZE)RM2Rl0)4dl9$1npouW_F(@o&;n8kcEt;AoZpg$Zc+`ty}1v
zQ$f==sH-9EZs6^zIeMQGvOX27_*AUoBP~|3hF1P&EmeFQdU&l}{C()y;z#49I8}Xj
z9VK<ShFa2}ecibf#4+-8f8=fS%<}Ryo6e`pbYt|~_w?VjwBOavU%a_O?`41mPq%%u
zmRh^o?Ocpk>9lXm1sKSdD!bu`anQO|htx#adp3zq=KX$B6q<fcUp&N->Z!QpgVVW(
zAwsb5^dJN8yhQeEJNiCT31yy-=%c~Oprazk`YZ%tfw0OzF1W$af0l`bp;lsI!qhMr
zgB;zq>^(KY7eC$=3BX*a^owW+_(>HWZCDhc8@yV#0=znQ{wJ5H;mBVB0t-QpALBY~
z!3S|u-@^vcx}~&&jeQNqR=yD8q*i}hvv#UEW@{Ht)l<&;F6&c#K>c}2ePM2PI3M|X
zE%ah>GHy+=^_$cle<Jgl-9O$p3$<I+*t1xYTFRxS*j~`qhRT6A&<(VM+QEO)5B^7@
zL~W$0gh)|Nl82ZSPv(rRwx;6pCJNO9AW4}P@BC}Cr+leItJ^8b7Hx#DyhZ4Q8zCpW
zJH&)KSb=r(*&C0ttPy=3HSWiG!{8yyHf=NehciJ&aX-1te@3X}u)zpVywL>Z>siCC
zmX<!ZU{jq<N65x7HfAb?t)FS-$G{v9`Bo5xUTvcS?9+MMH9W*+z)~Amu6>IU&aw<C
zb=M}#QzG|XyS9<C;@tD;q?jc!tGbG3WTL+(s20=*3tkxbu_A!8$`BWvm9Rp65Kw7B
z-;`>-Aj7Bef2;F2-<C`<(binMoYu&Hd$-dt?x&*^f?8p&C|+7D8;TE{D^{0D4(g#8
z%HQWne%)&cIvc=hckXneBl8&VP=eKWkm%YJZDcx~BVJjb<CbhKFTvC%na=`{|M=o@
zXXkE*<#OFjI#RNk^qbgDCdrjx)ZOzRlt_x7bm1@pe`66>v56t!K=mwE8sKlNs~7Le
zrd?XK^n#bjR6aDR%Gpo~N%-BYj@ghM`RG8kLD4dG5wA;r30|l&0cxFMS67e(emxrE
zgPCT9f{ZHaUE#3<d>SN0%I=gWSsBvF11JNGic4%4BBb8Vyz+_b8~r5_-RnpSbJ&j3
zKoTp*e}=y+QDK1{>>b|yn!Vtgq1Gy((0H1OQK?}w7|@0(IzUU<@<=BLr|NK*>EvZ8
z($l{+!p@%R;Z?H%I1vw_@^u3Tqw<5#ZW<j)H|GKi{!AD5-s7i@0Z(&Dsk5G5Z*}8n
z!9;#(01JvZWv;}1{|EC+7U>x;@dxnAHCMg&e{ejVU316MjAyc<rkL$w5Ys92673xf
zn0b<xooPkAKfg?_zZDQgyw|&hH+vn;0k`23Z@gfMH)dFV{>9>$2tGvh5fO|)k`kw$
zY`2d~ZqxMOl^$7pqjhzKpvA7GWk>w5eI;hjZ1CuvSMMke11R3AW0IR-3h?`8>xVL^
zf9MjoJgq4SAjd-=4YZyjXF*jBcJ}bC|8uz(q(|cr7?RQOAUg6q&XV~}=a(ho%k<)s
z&BflySO1Qc8`N(qo>|{(MArct{ktP(CS)2j)AA^piEU&c;HC4FzBCv3ARV&f+NuwS
zfWn;Ewu45kRH8SCf#Do@knS9q`??O#fASXeT>ZIu;7d?q6~<>dLXdQV1vOF(wXk3n
zooHg%g?*Qn4)F*y5*o0v$%zLXI2Om!ijgT&)lm>9P!g+F5J<owTS0h1xY-l$y<n*P
zNU6_1oQaeqV#Ov#DiJYcTRD@(ZwNUoVbi#e=_bEn4=R3FJJMzwO;5HjTNLgmf7jV$
zz;d;x-Be_BIYvx;TrdXDYb>}Y>vaC-h#Y?K>YA6|X(b@F%9L%&nKEYC2ywREXXp_r
z7qw=Wx4!!7tGe<~bEK>g$tM*caJ~t=+{TM+eJLkH+I427EBc$|nFb(R^;7*UosrBd
zmJ(!!^9<j(OSN31g*$f3X)aN}f9}d!X*pVBg=RqiHlqEgfm4-C5P9SkY2sggohFNZ
z!oaG(m|`ZUFv)B%y|=DaB8%}XPmON2?qYaVj-#*v+BpVKvFJp54fn8Y``=JNoYa~|
zv-8H|csJ#Bb!;wRaGM%a*0rUGzgc98vfzEncbOBfOXo;EO}=8kzz8Bqe`(oOk`L!1
zIfcdnwh2s<0&V+{<9s<IC?=k~v=?xE4ui@yKJvZh-Qjv+ikRb|_UWr%=i{je6L4HH
zx|E{b8^zg`jNwM4%{@VG5z*^fZilm&omTZ24tM_4%}HJ^x+HmYr%66eNxP=Y!#59@
zd5Gvml1hPrG&^jKt6RQNf0ohoU!{du<Y_z;roCW7-mqEND5>^igvYQv@|uQ~BBGG?
zGal1eakD+jj77>W498kpf7cMIOd-Ofl$(Sn9b+6NucIpj;G0yNJQ)hC6uXK82eC1Y
zoN2uU4*8TnOW~fLL-47>#v%T1Yt}n%v#V{E`|tqD_?x9J!Pq=ne{}`=t#0ZHlt$YU
zWVyC4@M-O+KluVb`2s&YUtoz=m-+(Nl(jd8JgNBfHWRVe7p`kOUkeNn70H_B4SeYU
zH&GVNYp)Z|DU9e0tCg;a5fV0GM0T%x5!}b=ByicTUl+B45xlCW`1M=&6u(}lCtOK4
z>FJK^iJMr`%@R1lf7LK2Ydgv+zOtZNQb0>eDel^RPPY^ZMT6~Lyi;w}UA^UgMC$av
zTXFr`hpQKG*!HGZuxWVHOZfSM(SK~$aAls$!<E;I<+xdG*F`bP@1|g@pyGPWd|h;C
zyJA+m3RbY5pUdp-CqobkTh7<*?#GGA+fkg(lCk_;+MF2=e~}k^csN7`kJ#zA)m_YO
zmV1k;j*WGL8O(>!^T6f=S<pHk$IaR9hMd<B%8S}Sh0@kbC8~h`4u)G}x@d}8eDFwE
z7yYps)Q_JUrlUkSDSg<KeGY~}ne5ek(;wDH$1Hhr^&E0@=C~n|u5U43P0rSW8JyCE
z7)JYp`FMQYe<5N}!nb5q8MDIYZBX#wjuxEo;q!zb(95edx$0~eh2||mXf_Y)4$ef#
zA4b`1v^5~)skY|Y<-Ov+*WnfV;3bj%%J7_Ws~^=-ug0!${;*gPxeNmwyi<CwIEemt
zn-r3Qp%~e+1`{0DYoOi7mteA;=pk&O`Z0odASvZ|e`%;w_*oh<LH5<)8TL!kx<`96
zqWPA1Oj;<f*z8zxs=-61|Ew6d7S`IkkHy6qs&KCjTw?Dg0GEg5@8_H7*CLy&P`S@g
z<gyjrYeirF61pU~AyWo2H|43tFQ2oD!!abhr<NS1S&EP^PCS>hsO;~7P>&dT6OW#p
z*;bC=fAyAWD^lO~mFB^+2^~)DSCWi^e3Sgz8@)H6t8~`qkeR=nJbQ}#6)7r`C&tca
zq6F<xvF!bgpAorDf>q+H+?iXWJ?_EI!R8sR5QTMr*#e=;J(@7#le$2jeE+~B(LGxB
z<|;zH`xQ|t{r^{A{GvU?{n=a>-*yxb-BE>^e^_~EYoLv9&qNNk2=w??%;TBn>aE2%
zqUg8Zb!U#S=6@+nuHP?vz9hgK@@vt_@(U3J5SLlZ=vJHH=<MrDoy*yH)Ko0tK+Jf7
zLc-gUGID9mw#t^WQ91}JZ`av)_(f2eh=z4}SKQ>LItsVDzJ?-weDbS&@~eEneicKc
zf6E*y?+`<NU02IHgqL3q&zDYWZ2PN?`(LbZSO_awZyf?x#`<IU^6m;(#wKGhTZ<f@
z4aRWii>iwVO>8_4e+&py-CzuNYsSD$Y&r<GbV9g2QIF5&>u@s7kq>3!URk!*Hj4Sh
zg#>p<Xt3pXQ1WQWP$yQQm3@cP1~hqRe}ge}R@WDE(0rSt{fpDfvs|o8iz};Ztz((>
znadiMS>Gx4McFMTvWBA9Tf3}%{!ab#2>a8A!>UytT=HmZV7eC8x66%IdcnAYuNKNz
zdGJ&+N+eNCgTj#)!NQgQ)J6i9KTrv83))(ZdB0#9AC>G?nxoNfXW<4VDf>7Oe`^+5
z&G{=lbMFf*TQ(UK9iQ+DG1YDtOd;21yADvH(vy&1@Z~}RWQ&00$xeapd}caW5Mp<)
zYaie!JJ=k8_&Qb%!mPm{xX+XxkqEale7w*YZ_}gy9T9^6u}f=V7ftika6W>`ZgxU~
z_1r)iS+u|(n_5zx=q9*WYa&*!e~+5AJ(>6>$XeUL-P(dIEoodF9Blw=m;Sd9PkIAv
z>Bc#*2}<@Y7Isw1A!0SBX=P=jV-F{R+O}NhhD>Lp&??K9)*5Y1LEa$r;OteLr=ZOR
zW#zi&cNsddkvs`9ZZ`^{GL78?b^&95G^aPD%KR#tS%?L_0WP%e$Quh}e<g+JRYo=N
zSc1w%cf*}8zW85ZxVya2sfki}=VM<YTZbI6b3@VkW(Bo2jDffjdV`(d9tono&*|eq
zkFl%bS<^EwYa+RaK&2?LEH~+a-Pt)regV8DXUXfNKc7j`GcXiJLoNh9KOd#Vr2*qz
zXw{i!qqKkBWLJozbI5DJf8dn70QNd303Uc;K}He-gY8Dp2n}9xMH#y|QFvgwr4xYy
zB{3io87O9=At7L~D7Ghv4dxirr&)s37YFr=+8}MQ7UNr80`byJ5^+M!vWpAi2o2MZ
znrB6*V`(oLG}J9@o)z5UG9}Z#jIN{oXlYAEKpt|HY6}hEki|Hnf5u{woq3FXHT(c4
zt4xSeUd5y3)PN@n5&v#JnL0@^5U(7K;N>pA%zD)B%{$#~E&_?m7gEZ)NOAn$`ap4<
zp(C9MJ?n+&sWBi>VHaCdVW`QjX|mJ<t1j+~wW>ZlBtKX8S=0j8&_*hO8{Y=%K;57}
zI#nQ;<lEMTyGgLZe_K?E+bH~?re@qC8QGI3dcQS>S=Km+zP$Upfh=GLtsZNSaAg&X
z&Zp98ACd3pgR8l{PPOeDBA(WV#rYh92vrJhzk`dTdwz{_-CZ=ku-Ebcd_aT0WnzE2
z@wI{`Bq`M(hMoN-J72q?cseNGOKwazyrJAesCl=p?Z!seSIshg%zqb|Ki!X_)G1M9
zbUX-A0BUY6hqh4V7H1(%t|V;7R+ijx9~^gdR<Tt)^6j`|{g%9&bq*LY=VHjY*(wi4
zyIs?6U0;^-df!%=u5mxmzpRKzVRyx&;8H_0yKFvdF=NT5m_B0HIV2Myy;<S-so&G4
zVMu09or`q19;>XK*MFygq)$TW2N;l4rPqH#viEyR^{yD`Z<y%qWw9+z^L|iD^Ii)#
zX^k{**Li2l#^akf$8Kh3-q0XjpQTqJT`ya&g&>I^PM<t(kJ6V(R9q9Id~NV+u!_V1
zM<ZI`kp$C^<4{vMxreJ{tJ&3s-z0kA+bWt*89Pa@#qzfcb$=0gKrcLj)}eRL=lz$-
zjITZEP9EFjy7S*#-@vta+@G$!|9RJ5p9J9i5lC}Yc~N?fNw}uQD8R<ps4X%bm+wlA
z2Z8T5*NwU1?6r2RaU@u+l_x6$9A?>qo_Z~?0i8RN{GO@8ouTyG<=n%+az{|1?@SlT
z80G*o9YO9=PJd+Ip?0&0!ZsPGGd9D^S)?JH+E13+Vp0c2)!LSLZ}*6Q+_hyc+kmFm
z28v1xMG8PE+M8@%keIQ!L9`My%BkaK+<**oy|m<%%N}ZvcKPbM_)(_!gx>P|_|d!*
zv_$MXnJsAO0srRO5UMcuWL>~Xke9Tke6#7j`L@?_n15gQ9;&7<Jn1*P$@xF)$TEvU
zN5Hy4m&-@TGb0q)Gw0&Rs2SUI3V6UMd7T!l`bNqE?C+vgdN-*#o1MkM$bD$uL~h^&
zOelqnPtrnH#tbwVGjadFZgVXU56%tQ_>Cnr!y+elXH{HC0WpsUQ$Ro>m(iVhrL%*v
zM_QG_7JoL@@wrfl<zx5FK^xKg@z6LnJ=8zr(vB4XPaT?L0lYvZ+KDpCH{Mx=r01Vi
z-$1i$><{wzg2Ms^c{X(>0_GTA?=-q`&AOx43Ld+E5iLEdd@lpfT)0QF>DWL2uiuy`
z5mEJDzi+Va79Y~~yb;CQbq|ZezaN^Zgw(9H+<&Ws)o%hSuuX)4r549SVIst4OrE(G
zc5%qnv&$ls3Cw-i+1v!VSRCruC0tmjZsW)Ua7?a|l57}#V1$*}pq*F+ZL4w9E?oM=
zi;}LySum=)7Y-dqkj_WO1fzjHU^4??R2!UHlgG)?C^xD-w`utC$)|#IpKOmGyzTL1
zy?;`3?=&H@S~%{VCO_7dfeX0*`o_WaD!?&>w3IjV-rqEVZ2f9!Re;NAIULbu#?Oin
zz!qJ)MrAREX<p23Hb0Rw@Or5_%G9*Zvb7D9mRRMRucsHqtbNT44D`^pe^U$ZMhN3;
z6l+^jy7r$Fj3_|j6?uT6J+~_qbfw8s4}Yvqx-Yn3?u;fFk1!1sWOfU}!T4Mhj^@MW
z=(w_KrsCH)@v&IgSA3ZjSORKNG(G(y)_7_*ez=Naw1Rf=e1QX_+(_b}=esu)J9tGt
z$sV6%j}KJ#kO7{?=PQRtr>;CWCWix?WNcDbOz9^S@ZlmCXnzl#-)V;8j-HNfcz;>n
z9?<J89j|X;RIDU=tzSWJaXDP!#ZneT>gvJn<2-@@t7>)v_w3(p;+|b8r|>`&7t9W!
zbK`WMZQkb?TIlOk`&WFv<(rdR4BPkaP26Z7{IxlY&o{X>>G7Lhn!)5h-I<^6%ujb_
zz?(i@neXPxME#!+;>zTKZ0*Wi^MA%%=fV{7^zO@ake~<@2E4T!Q`+oGo8><E*7Uv!
z%Xgi}g%ok7Lwy?ldWB0b>hZUzMc2dg4Q;9+7oFGcMhc=gVu_4han03^|I<bHKk}k`
z@ApU@bXCpGaf2kon?ylMAsgi{G}dFxs|;PmldY8Z1CUTEl@u3R<mx%antygV8cxMi
z7rXrJ&>q+4Ckw;BeR~`uhi;8MYHP0Dwb4lz7J!qMHul8vTN_CCr7?bDc%LNu56}~5
zsB}FM``y$D+ECnnNA-i&MJL?^3Nrd)RYf&rE1Lt9ZZZskC|!n8y2&sW6k=OrHSR>E
zT5KEkUYlm|x3HStieb!4<$sXsjd&ZZhN(Hcp-0dwlZ0VpVWH#A7Nr6ddgEaPkwTm9
zN(HxdBhXZHQnmoy`o6TrKx$K&q*^kH5n&2|!t~>OYf0~gX|*e@R{Jsg>AtHJf5sK$
zOsKAKj2s5&;?q34$fX+b3UOyaPam7uQ<>+Yi}PI-N8Lv5*1M~y`hS)e?P)qQA<FC7
znDhk=+2s!|W>>Smf&j<2TD`w%T+7<S(-(r$9CEk<Y`!2hoYB=#iYV>RM==h92-HTS
zX-O8e=)V1HRCMVyH5^6`>jtG|J<M)%)Y<s=zdF(PIruL#+G$ph>iH^Z5$_wwSCix-
z##fznSC0<Qt>_6I#ecX~7q3O(TjRfVkVDr)5Z#LKT4y6zWHZ>}fA2#g=DG0(zSX|T
z!8wSIkrUC<VwP`($S6%YI!@`F<%^&&JB#;i?|7*5`!;HDn~kQydD?^~*FsfY4_$SC
zlwD+<;*~W`%V<nY9L9LS{DEG{gh?O(*<`8V_s+_>!9Hv`+J8Yb&qu8YpfSW<GBgvj
zr8)W2m#yg6X;S+=Mp*fJHTR*e<Zm7V&C2BHVCzzjxE`#o6%fvi=!vElkk$L&w}=?<
zXykaS6kXkfAVau%NYv9UTGdQ*Udu)&n+Arp%VabayBZ|JY(9&SE10%fdqX#R8zFUv
z*`-`?=|BsSseh#g;-!Ag-h4zNFp%aXt9=~h+C)uj*{F)C%O8?@Wo0|(6(evu6Q!$G
zW|RqjVUGvgd!8q+(rjMzSkCP|O<vD>nlng~B5`q$=5$qzu8nMpF#uTduy({AJUrUF
z$|k#Nmec@R*d;TQx;8;_5wGFZWjaa%U>Uk&iGNKv)_*Y}y(V8n_AYJP$0l^IFyb$k
z2G+jGm)Z6=u>&r+Hq}vqjWQ;G_n*;`y-`1vul$&zeerTsMr|^Q>K6pY!>Sv073y0F
z+NiGSDwOh)oFh%e^_z~1*<s&T!0r9hnCi)Fw4w$Mit$_Hok$Y1BO-TzH#qT`t^1!)
z6F+EQTz}xQDi&Tj%iUFl@mE;}zK**JDW8_%83Oat%&9%T0XA-nIk`<Ww^_C>j@@W)
zgMq*@vq3AEk?%a?WM0N4+1g#tO?IWpQV+ZV?u&&EHBJ18gNH}y<fTk0_E^ZVY@mHq
zmPTZsnJjHlSzBJxWS|$F{q1aO&x?aX8zko5v46jI(}@CZ%Pkc19mnDW6U*(}g35gR
z_JJl;>WiM7VL%x?X5p`Ahnx8k`_EB?OPlgolIE@O+Yd=@sD1BD;jeWyCy=w~tu?W+
zY1N(qUD|agU=_~7pi{%Ht(GO~$l;Uk@||1|w{II4-R;}5FB^LdeTmr`a@TYb%G~XY
ziGL-fY#N3zTSx{@&c93&+s8x;8z*s*CUhN7;~5b#UF}b^nbF%oE-~qVM0kTF#(>7@
z>u7L2iN{1gp~D5TvY9hb=o1uEA|ef)msO8wvxns~Dg~DBNi2cFhE9iRG8!m)42U^J
z`Q^VE9fZXb^kbR``gxgLn-5_}hoh0}i+@xR?xa}17kYnrN9n|$)A7VtnikBAns;w4
zYP}_@gx?vRgGX}8Yfad1*0QwS+_-H;nzhVfZ(*lac@qJSZ`RWIm#g;5AXO&S>y4Wi
zOAFW8h69e{D067AgE)WLqWkjVa@LA2U{=LH@%1Vr0^W;CJ#q8WQ<457*r(T|w|^Gn
zRx}<&)EjO2>(Scgieem<dqVS^_oz2UARp)*50WH}-`&#@;t`2$_MS~>rMUKnD%kYJ
zLy%xkuOL(91(hP)!??Nl&VG=A*Id%}(1-6cy%^{Dh&~#T6T!iJ49-GJ05Q*fj!p!}
zM_bmhHOrtwP{TM#Lh$YA*%avk(SI339N=C4!(Kr2%OH=hk{mzDU#8)s5uz+_@M_%(
z@aow4pIl~Fa%Q9KRg%;2KgxC30$#^Wu{kQpzoILzp&@UKxncBQy!dN&emwA9Ncy6J
zO)u(kQOIAd^uBH;t{%{}Q*o6uKx`0+osV{4yh37+G&`J+Jk915zivyXnSV)RXmvuO
zJtR!-d~cADZpT6<(bmDi!30vt1N$YdnR$W7!wYo|%b<Hv%y(*~&66>mJ|{uX;aTWJ
z&uPPpL{N1gwH;o3pQi&E1V}u-xS-En{%jAy8R|yBGEN&mAEX(d1^uckU&*sxc2YVa
z{TL8%n2eU{;eoG0s*mM4j(>NQscsnVD6f0bjx+#LZKLn!B-Fuj%Rp2)6yPg#%$*cQ
z;D@0YwI0uoAxIDAB0pZ>T{DPrTJ-n-z02R}j#@dLbQ(L~#j46_xDp?ml5*<GCRyM*
zPX@cG<W&WdyRmG=ZS@$z;+tpZztUK~>urSeAfv@0VACD#Icf6Qj(;F1j^^WuXtJnw
zHI8SR>)^^>3G5D?R4hM&e{2Og9*nD(ixDbGeK^`*o3*_Yjqhf&@Jg-EM1wP}G!LR5
zl>_z4E%gG|i)Q@95u&76MUj=q)jWv~zmFXI>Ugxb5}#$2<9CsBeqBfW`-qBp_pvr_
z7Xq+$a@qR`(s_rWKYv9M=l#n?w6$yE8+TjL?)__9c|||EOJGH?fNRGldvUjapQCIu
z9hG4^;%WniJ9R!x+IpZ~ej}2tIEf1jU#=S-N*{i@WaCUIWemb`e4wj!JV|HJQ$;9W
z$+zVCxIrLF>3U0pZe6zHNTd1#{wl^Zy@Ir)q<V{IF^Pdr%767_zoOK~o{_7~D;;`R
zg{xQpW`ygMD~ib1x3mF%U&6>V_4W~CBE6s+gASOJC*CP-L8!c9E2afy!j+{+rzRC@
zSvA}DOj|oA!atnoz&q+2-HrHq6<-(XjxbCJ-T;pY!G)l|h{wQVbTyAcS<_z5X{$--
zuy0usS^k<4R)73U-(qL?_;Zh^CY}xR+oCGNsfKG~%Y16@Ftnw$A;;0#edZR>fRt~9
zijO@DFgKqAeDYPIgIp`0Zxgv;spo%_J9Uva{+V)<s>r)^Of}B;H7pHf4&mn;;waaS
z$rboDPb|v(a4nTG7wcM*JjO*Wm2Ug8IV8B3*NBih-G5?Ew#mhoHp9$nE!S%F?aK^E
zpUk@gwVlTQinNpwha7dHhd36BdlDObS2#Mjam6ml6ML8dx0<M@8;|r3T&8^J+q=y2
z^dD%CR3mm|Yr6H~H(qJNiavkXr^{eK^I!Z1GzJ`CeUM)}p1ewnl$D4HS6A*G82Xmi
zadf><Y=2`yqGiV-a6RS$gXLfI<6I!O;<AjbPOa`L2?`v}N9<OD8%E;MricL5cr<of
zF(cw{dC4V5^)!PY-uHru`#Ln6N*QIay(E>LWx!~fC(XK`)$3{079Mk80cP@EJ6Ud<
z0t@4aE&!8*&fO3INHb^B19CZMUBrd?s0$Ic+<#faG*W!jmXTtaa{6Yq8oHgNjNtBA
zt<!BO*+McU46;Kcf42<ILMyT-x)oJU=_;X&o3&^i9y9X6Iy&3St$&N0`jxr#r69U8
zs>i25vHu={V%F^a-XRU%Hku2C3$`Yca9gHLTcBWN#afgvWG4Wg-qZ(xm)8b7I1R@0
zDSu?>6Wqav2X}C4OX#snWj)-m)v#gKr?LSO*y5$#S(aVseflAxqZs{^<)gtL{Gui9
z_;>tiuP9@@VRqg2vRZ4)9&bDKZ7oG!m;Txvk!Y85N?~O#=I8eB^K5X9e>v=Dx3$}k
zd4emA&-`9cV1|2JREOm#n_e3OZ|w#xG=IIVw!T?J@>;WQ-}Nj}3#Zf*+`kKH<(&;>
zCOvoFL4}vMt?E*WAPEf^e0i>8oZcvsB)s%Hw&>jm<~dVl`DfKRZ3Yv5aIc%9Y2rD2
zo=kd@pO#g1ZqpK{7Y?#H8<&hWJo6Y1_mIv?!cVl-I+|Qw+LqDu+b@-7U5*Q-+kaHW
zg>o(4L{Mr=r1xgxQfa)Ogr-kI(}yfH{gZK`-ZvuDvZ~Q54JleTdfmd&Ra~P|`RKLL
zR@bZ`?K-@l48dJAWqREi{#XK1k`!lmbDvAAGfv#&=x7HL#C1bWiuSfTjEBZ?@AtPQ
za3m|5gnQ|V#aPGP%}aA{P+NORaer)YbX6=O9OXDq;%#2Z(w^V883sPx;4*e8<;m+Q
zFygsbB&LN1?N!aK-{7L=Mi{qtjT<_g!l(QB)BXHm-p@*>Te+QY1WEO_ck_F@na#!g
zp6}(2Z{?fbS?2kV<;F_K$(GefYSB|8z4kE}_qlp=SyzF?363<Bmfny{$$!4O(UoL}
z1KlxdxK<jgZ>XBVe!8PR<?4QTxw^qg-cm)64ezP9EZ?#21tl<Pv@ty2jf!=IcZGoq
z27?HKLtRlyttQD&O!Mqj%BWwm^PCafLI?>5>J{pJ6=;E|!9S<7>jpD3jDdr3IFpRQ
zw+^Dl4?i4?#|^E0`6Pb*_J31S=;04!N^e!xWZ8voDP4@`cfY*kRO@)QQAJeq;~P%%
zKqE4fPV^I|FaBza>=4^*MO_d5WSPi8#FOW!wM+aFkN2nJ_jmc%7hB=v_R{75CNf(Y
ztXCk>@DdmDU??zT7Z+R1G}P8yyDYKr-z!vGGw>Qiv%J2k?#gd%V1HmP4f2y<@JV_7
z0F_rmrT-k&_5G=>9t=fY%=6OA;IX`>>XNKjVB}m`i+hWexRnpRy{cOE`?}fPNKIX~
z?KNj>+1`aWR_K@w9kRL_ixJK$m&LjOXB(&It8R+!qz8q+G)elhjl?T^*#Dm5p2-P(
z>t1}<Z#F%T^X*;1(tjGa8}Xm4sLKa$UDXl5;okZqQNcCx(5ZQ~DjN^?$$UJfTh*@3
ziv$hLXM*cv0o_(zv86G5RCjFsDyN*@FpN2$`0U7}GW@c4%ceCn)qo$dot}Pyg{R3&
zP2UA8O+V)5bDKW<=m#Bp&2y_eJFYj}-uo_%LQvn<%FBRU_J6t)Jt574Hq^_-V3oW;
zoId}cS>+)X11Tebt+ly&MbgrzOe4w_s>?QuU+QtWy37!Jnht1*jEo*nUd2-UP@7^J
zNvYRSGMrUb(n~SGJNjr2fT2xRScOp;s<)Gy$fP)%UAGfr!YVh}XnOImY&((ZbR@*I
zl>D_clC`?{VSn7IKzi5&L3)kl1H=4!pa0gMz3vop`hVw44&sokPuiX^Kuk%-2n;?^
zsTfG-7KAAMwHci$AJM~!U?rNleNOvnnvJIKf<-?yU2L}ACNS46H5$@Y4t8IcyF?M4
zeM=Hu`eOM8<N;?SMSX0}lAF<eyWmbeS2Sd5;Tez_{eNkfhqLMY?T|3|+I28j(chAb
zI2xt1tto`BsKKr@7_^RMwjbAkXYroBB+kpr<G$NaHN>FWcyWF0ux6|un}P_u9YvI1
zJKA?G1!BW+-{m?2x275Ao5<!R0#Xg?Q)0{7y0K*<%V%pJ3$^3ujnBnG#n--qtd{22
zx+ngLtAAH^->HLkZU5~%b=<B6mM+rJ=6a+-!_fwEqR}L0P+UgQvYBA7E?CDI8qSsy
zIp@evf0abjQAU^B2OVb|CU2MdKy7OI#&O2wR^RwnsusMXt1O*y5wT)>x2v?><+i)p
z_QF2hhjM8%Cy~n=B(1zQnSnG#dB@L$UYHyFs(;$`%@c%c8(Tk1IGbMYyWHT;>N~!=
zY9Hx!Z-^6(4wCcv#RZT<H>FDNO%fl>2hJ<s+4)J|Gj1u;=B_eMPvGJn{I0b&6p~EO
zZNP|9L;`z>Cy5<Rae#$;um(4T>War&)*x}3bGUtRnPoGr)W^Nd7|DwsB8HHSh+G&X
zw122%*h|uWI_YP5&b=uX@vU3lr~n<VW-L}*T3%*=H+Jecn`-m+Yn@TY<r|oZK~Fft
zi@ce@n!$PRCnPKEf7Kml6Kr}HgxsZxbOlwhix<32<uYWh3>tCy6ygezt{Mia3#2BC
z>cTNgAmW@yj$X}{@ecF0*$u}2Q6E3iihlydVdbhud$>xjNG;{Z^CT{ie4PzvrhppM
z^S_)tdm3HQy)-tKbWndXXtvB23U2*O*aaH{L|W6G9)v)6osjBTkRK;3>~2W*N!z_j
z>q?#EX*@cJ-1pJZiziqDi_sT7rVFBft@7neUx95<j2t8WneLXWHX!?hq!O?gpnpax
zTtg!A(irmR*>FA@**AoK@Ku*_|9QY3BVjAkiv*@9YVzb&GGYp6oWGwE(LyIufQJX=
zZ*X)zPdRc7*h2Ud!Kf(<oDbc!fvb}Zi9?E_i|PhUOZud)idZB<O^-Gi;1f((Q-Qz)
zI_A8f9pn-Su-oJV{K=jZZ>{N(oPX_19IbUF0UjvInWxF@8jlZ?7)M5dco-t_6&()+
zj9fU^7NA)#qgc@g4YUv&(-z6U%>$zpu+vB5ptRTIb<&^D_*4?%(v%s2=<LWE&Cs$@
zT5B)-JM|i^_B_p#HpV^!koKJY05TVx+4E6`IvhNhWYUkPBp)&8y2VLXO@Ab&%P&oM
z{KU1>i-|R2bPTMi(y<<Lx0rhQo&7LB|HWc!UCz(L)5LUn=ga-3e`ry=4DW*gzKNsD
zJQ;r5Fin7%f+iX?!O^#kNhY^><GTmRm~%T{7Sp(&e6t^a=j_)+PbiskGM@^bEacY<
zQ>Vg`KdAo9JmW@R=r@cE)_;s*iT`2vD3*w4x)6@oFHrr1$Q!{!T=Nn1{V2^7?i^E2
z`N<&wZ0M(Xk(6J)im#1hTrYH)jonOhZ@QE-t^&-GNPG@BSv%V^ggPyl5BOTM<A`5i
z%FpUnig}Coxo|Cw2hBBizFBwl5pOlRHo;hSYWT?vM6P+$dm=V7T7M6_432>r=H-cb
zdLC_H0gX{k^rHms9%umaV|Di{GtkED<oEA<b?5H>5Dm4_P}}^_l%s7b!GM8-Z|98F
zbHk4A(FQ<XuIuT?sn$Js>t4RxpL1K4UhEo^N<TM6Bjv7&3te#GmCu!fAM8X?J9?ZJ
z9A0Di`az^vY5Xe}Revxkk+FFw>RD@e53S%yE?$e5QF%ze^OVZcFUL~tvB&?KFQ4aW
zzud%s%;U){on4o{J^{*<IJW2)L160v_MLB`U}ADHnPG<CdULH=3%<-I@@TLshs1`j
zNphk0pQp(YluG&G<T9O#MR^=gqu!Hvia{Nji!vCOyFUG<OMl~&Km>i#KG@a(26-xY
zj~$wI4VwL}-Ck1@2@#n2jKwfRC4dj{h>Mjk<=ebQ48%i+KVuC7GH&5{C(lA9ape_S
zr!z}oAW`q(KtdnZDi6gzoS@S>#D`RReCSiO2jRlOAgbMJQ!JYMOM$LXGttbw>im`(
zDvFGl4sPG3MSo^L^CbN{+|>i>iSBdfT+^obc}~f<uSfytn#Tt2RN05U@9JLR;;G$v
zKC&<T_~LQtL8-9Hk56$B?W6puuGPQm*|blZFUk+^2>j+10M<oYvDlI_dS~3$Yda|e
zqSHO7BseuXoqt2@Sx&f>>p`!jR#g<G>#3sxma4oUf`73A*Wuv57B~}T%Q$dm$|A~L
zd&q_p*x?MZk~&03CL_^>+JA}|NN81I6)$uJ9bk5uXIB$jQ&Yg|N(%;wC3!uSVp|M(
z2jFlX*+n*EzQ(3Ehedau^kZ{D>)gERoody$C!3dD7o~>}Jt2PHD9Ai>uA)IyoyU`c
z>l@}oD1V%7@R|iPL|gZIzZN^viy8$xXzOeI!dwR}UC=x8oQ+dhEi*>1VR7xT!AYwa
z394rTgwWlY?14j{12Q-iw?wS+thb4n#!c{)?2*xVk-kBia#C({7BtH(U2(JzaW)Lt
z_rr3Nr2=M)R^ZPax<U5#^aM4dZ@-Iv+xd)+4S$`Z-y%c~Gk<9LC%+{}wdKy?@6osB
z5PrS$nf9{5>tFBu-qgKdPWTW^)1K<5M2fm{ur``m8Khrfzlbxi#%eHicapJ@?C=)(
zk&C@~F$(Tp^49CwgxE@UmE?d;RMip9TPZmemK>j_BTPYf%|z@>UNkXm=7DjPH)x{2
z#($GixP_h)m5t|x-|nm~xQq=eXie;{e#}{bD;hw{+9fqSLyWk7*+IF5W2I6H^OgDh
zR;&`-6+k7a3({vnIda<yk)oZe97b`7>0l>%=Arb6xav2_lnVF33?2ikgM16Bq(fpn
zNknB{p)MkyuXiln#aA&=Pk)4Dj}Aooy?<SEXYV#U(&yf9wS;LXQb{!Wz1d0rzPFnK
zK|LK1iT*A`$|mF#b(_`0prLo8EPF|}_sfJCkJjN835&%Wu3%(8%i?%IrYzO)r5=iB
zJDw=GQ<DDl#FSp(o<^aJM|3r%B_d)S!=fSkhMPgHPbK*#JU{knw|jh{IUa2_D}Pg;
zrM08ilWim>HZ|m`ld}a}RUoVva8@FY$FjDGCxunWxYTmZCBH$3!Z&w5D>1cfMzW)_
zG3u4501D0Lzv<t<x1!H~>k}c#AK82|<G>jr)6af)WEAY26`Vb7Kn|)I*rhp+;l{RV
zx6fYqmJRUJ_73tdj8V-Hs;_qJMSt1%71~p|khlU6pL1qOjIHBnMT=?pJGZbCWdNW3
z?vAuf^vpcUM@ou+bhNo{Iw<5SqjRdam|kN>?zC4_@#hX5-T~cu{N%Kg4x(?r{Z>vm
zy_OE6y+7C+5e?bh#|HAi>=n82ehV)}pMuu75)Yy~Wn$qVE*7?&FcBBU+<#;Rl?7t~
z^EEPe5#6y8Q#yt>MtBrlWJI(Q*N5$tLWz2A9IrB43_GjFEiCD6;@&pOjbmW2(O#KI
z<q1{_v4^1TB4a_-D7|9Ca^t9SB%>9FN82ZD&wXj=uE?ls*aFS?j*ad;(^~Us;qETO
zTO7BmoR(69(PAr9crMt^=6~xXtc6$S<edp!2;y!)$KKn^O0@nPsjia?5}iSOnSVIG
z=4Xfzo#_*x_&d>`qh0D_H#&&CukYe(QnT^(F3gF$zx>O;C^b6qjvB<^4-of9?RGNw
zW#vzL*Zhgse`(RP9D7e(@@)4GiL=QVSa5gwuL6HQ5#SRdPxIw3)PG^fDoYoit#8h%
zw@Ku3*Q<E2Vs$mZEuc4DCguCWSE~E=gkD`pSk$iilEcTKJB2kWV4k7J^Ow{~FR*=z
ze1}_0e>Ue1jV~c1n4T|kTHZmG(|V$;HY$8u3PX5$F-#yHJ?pY%o~1)Cv!uA`SO%G=
zfD!$Yo|xsJ`|FAGG=I=A)5)G%&yY8B_6sxJfc2}I!XKFA>8_R2W^UZbe8JbQ`(*Ck
zX7uMjM`yqIBHSbpPB5+SvkYkmv|$Cp3Ck;G7esylVDy9*du!`cT9_Q3(IWXi$>7P`
zvvP(>HHxR{U%gtmPH{^ncwulTFAyh?FMfP+Y`sjTH9FDy5`TT7pIFuw37R?H9-Z8t
zv2@TL6rBrRBkH?g?*YE!@+cQF%>7@BZ1QJq{oBuf3&-;NA4zPdZ)NDe_jW#Gmclo#
z89*m{DYq`0ANW$@GM{@rsrJd^!qPgiv$SsqwEea<c$?=1^gkkkuSKko8T0#Qw)T09
zf6tDJBZH)g=zkBy8h4-lb$7w&%EY5Klh1$i+9(gfvZ8M#21(S3;_QoGI<%hSgh;nz
zp7Ay7Q9L`aFL&rui#|>KuRtI(v6bs)u$t}o_j6jfl;%sk2<kunE}XQXq5`ZyzWy1e
z$&xzpD$VAFN77Zksp>_@1xt0}p(pvKW~VKUOWy`MlYf8CjPAr2g|URIaLEyaKLv`2
z3Zwyh_k>hq3U@NE%C_tA-c)S3F2>U?)#zI2m)Nj1%&)^AVQ;TvkNmwb$2l{`z2D4T
z%L>W7!;HTR8{qFzgfDPq%I6;LWlb-flN5{_zNDR~O?vS{iixpwIaYN^WBjvvWJQWH
zS`PbwReyq<dd`7Pbbmgp(e}IoJSF=?;Ra{yMrG5xd804k<Q~-<POd>X96=C9{C1*8
zr4V5D@0-7?4u4a3i1<dKa-uO{mV=2U<Vhkdoh=lnyHpvA-M`<buab$=0$fGhnJF*Z
zi?iN=Av5qbiEP5OnVQ^3;zVb0*72&=bfEEeI)5Ga3~tdVK>+FMSKW>KlWs6a>|{6?
zjK2XXO%#xD>`S*Qs_Ya)edM!MlxQ|VH(a;{-jmo9NS8Zovqk)CJb_L&N)YxJ=)6jF
zo{@NwjKA4%WPkK%dkgz#??a&F{;D^IDzvZp%h#Sl+awVlQjaxT_4p`c++)w28yqPS
zK7SqHe=?+|FH1G4blFvKf%2$~p|X85-<#2MVc%@<EZ+c@nt3>#=p+g9Z{(e25jS4C
zRyJu9mlR~#wiqs(E^JvNH07)_LNBwE*yA8-8FF4|YuO4&ue$T4LtH1}Ej@Z2*sc2{
z=uJE2qEW5rj$_Q$2v)b3fkDi>(YCTPvVS~67`{1KmxR|-*)r_y)|TKO0k)lm&OTXJ
zlO~+@Jp;MlkQ5~{xoINxF4>OKlk1MdY}F}#hxkU@p@%F_h#r!?y|~|>x7eY}=M5jD
zf8oy^Zg2n27hklZFPgtcM?X9=%n!V-7f*ZU7A$Q@$G0jMvt-JA(p+6vnOf&H(SP{}
z(ZnQ-^-3zASPkic2ek9EL@5K$kjS3fN$%|M@8;Apk8$Q<81Ug!p+j>O=YzMS`0#o#
zoalJw4qs7ERqu({C|7g~s$LK~vhwP7q8}$CXNFb@SgZWCWUTP|5cRw)!uTbcuta@1
z6RC+JGmg+$llpO*DgwvbI7gJ39e)oBXO^T79jV>AcVE&QoI3bhq^dI!I(tN{7GYJU
zi)3a5?LBd~xM0oWfosaMmizDW0pnO4`?ecbbAdyL1XlIwh+$y2iEkt#ibdbg%m}*3
zJ95K;sQZ~`4?FNW<KN75`ESe^f9Rz7Z*Lkf0&~Ygk$cRW%j$b|c@FHJ9e?SBU2as<
z_q#$D)Cgy9y~`_L6^LDbEW7plCeMW4EKzZ#n>TNwKd=fac0gap75$bU`*UYZZNa@v
z&-adC#f7s3(uWHlVtMuWLDcyCw{-A(!>YWxo#=%W+yzTkp^CaivqlhAhOD8Vwb%%f
zPv{L;<P9`y#=E*3diw&?h=1LL1#0tWqeKavp8Nt!3z1_F-=_Qx{qqeP()Fd!|MD-*
zz;avObb9zK{pD+QNG#c<&9=!%HNh^SC*3L9Dy8-4U%oY)CHGpmkNk`kN`kO@t*NkS
zNWH#xD|%cFfyY`RJib{MPM_2T&4ba(JDY{i%c#N#`esX$-m#$wS$~!AcOiMpr;FO?
zdSgHlk<11V7|!p|LZDBuO^WZcLPODNCPoq}!yUM&A$HBor!XHR1Bna5bZL!~QN}iN
z4mQsECc-+Lw26RTvXU`US1w4j9<&E}7Ni2`4XKOqBO(Kjp}P*_eo`1%3qT~&&HE}X
zV9)VOgED}_AdyY7!GFydR_$`qH45$E(K@>Z=gtuOwVNk4Z83|GiIf#CBTaI%;A}#S
zf=$e*WO3;Vg$u(|;Z+?*e_~^e$ti=ZcBd1aol2h2lKie)no88%xl7L<aVjRjLHG}%
z_^xKQ2H9;z_aM4Qk88#yJ+Fuh&FIUHm#HB6Jb<(?--zBs?SFpN@e&Ur%_A_Fl^iL_
z5GDFRTOVK|Fb_0${zQ#njZS9QB+^{a8-@JUM1H<oy}IQ5U^y84L6?pZ3U=MgyNZS(
z>tsNJ0BjIlCZnmuk*5y1hF^nzV8-wynat}(AjuTE{yYSOM=|9Yh>xCx=Lr*#WQy~?
z$RG?1iP{Yl5P!ZAF&&Wz)F{TN*%Y$IDpqpU+fnr6aVL^oNItx7qg#=QRTz_20NW#S
zJBsul@*QVGPJmX*PXOQ4V!m`1%%F~*WI}YYiYL&EcG@jUM86>P2@Z?v*`;V(f_2LJ
zig(;K(}U>arB@A*CH2||Z9N|MhPAdK!a)rdm^r=gS$}6ezABhZe%)_<hE6!<Wo;d~
zWS-feDvf)hhARd-KVwBwm(r=^(l8ycyuppL0>n<{+STOs;V@HMV$mFz%7LX$>B`M6
zEb5KKwiXt7#|)0tl0u<w)kru>#W7$yQ$xOC4VH7jKvj6AehEjZ0{g_?Qh3MCb_1%5
zN-W4GPJf<fGu#xCXBeCn$CJ(BFcvenoxbH01RHL&zYNvnD@R2B>B5y7*U*PoYT4}b
zl&&?z9-6A|LN8%BET@Ae944e;11j3h`r0BFVK%F3GwIP@3G)V=tHQ|FV523<S<K74
zgniu{jeXx>YdlKvH>PkjlqZHFX9f$di2kU-bASGef_DW}W_siTWxCmJj)ml_ne<*0
z^?oF9Lbq>AShAuEMF67*Nea9xlnTw?b2w~}o<=SH8*UI1?M%v8OKYc3E#ihmy^J}z
z5WSvY?50n##7mDl0a%K)RxAH%<VIx|j!iI#2wPK1oTa0)GX$k;sC{~i%IUOlTDowZ
zaDO9+-J~Sygz}a&f8X&yOJ3C;!fh+HUdL)J&03jc4O%rgQ63DB$!9aCEwnn>vuFGw
z+5!{C36Xc7QGZ<^F6R8u<YCBHv`@zmI{ZAFNJ|g~l5K*?>fj_r(+2pum|N3_f?oCQ
z#p)6?{rua7_wh0z42caB#Ob$;Olne2mVca5v5Ba|!UI2ZDG~mh5v6W3RqVH1Y0>Sf
z%TbLU%P`m3U~eJ1@nGO2yJ~a0&6=)`eCyq&9fpqPx~_xfcNa)}D%+AuD}Pk${&^>y
z^zMNb2%R4soQ=qR1f5J%myoLqysu!Cd~b>8_~_(>*yPzM@hj-fF6U&X-}DQK!hcvq
zSI^j-h#8yo=TK9(GKXH!n`!JNM+`Lg7oiaIUPQ{XB{C(PMypTda>?_oB6^a<B=%be
z=Tsw%p4G8PdewdH?&;=Mq|~$IRXjo${BLt(AvKiGylc74T-cH{^Mo%8RB&4TQp^Wu
ztgL&gAgk$Bq!T|t&Keh5{31(g3V#w%E9cdTchR1|$TaMw7gwFIwV}dVYGPMm<t(a(
zO`IK+GiGn!cJD&C!j0^O<Egyp1|1z43>~jPyL0=cvrf>cE<RfIw9`tqh(4`g9)8mp
zygt^d+kHHsE;cSpFe}+dbdo<L@gT{K5Ov9)%rGkSbUd^0p7c7BNpX|gynnV1e`SQR
zc~NP{LmWC!Y&C=l|3S+5lq4^YpFci%?jpgs>9Zr^B}ok^%iS-#{g?yMEcG@m1}?v8
zO?`*Qb?@Kp#%cE=AuXNRzJCV%W)5kT?921Ne8@%Ku-9iN;yLmTmK=+kqZKx*1rSVj
zvlLq>^wx68RF)oSE5NkjwtrJb2Sfsp2tziRkSs?((hYc;>Ei_h;{*>aqR>+T6kUsD
zlt(J2BIpW%=E&zTmjINnM3)GD7d(JtKYpWz(;q}9<p>{BW3eI>v^<XF<K0m|7N%k!
zNCY0!*wc<$!qb}dO^A)xbgXxV)ng1?)G8zf7HjWsa7+0EwbMtLk$)wFti9B@=SLL?
z#VSr>X}LGM(Nx_Ic|h$@v0~??_&$&FnZU#nQ2R*B{f^bJAz$;!2tL!XUk3o*?)fCd
zo??IxzR2<f*m9z9JPdC0gNQ!|<_IGtd07O4JXJ<<rk0&j>)ACpbr|i>W5uK?<@y<|
zk5`}LF3%HyGnowYfq!_=uMNVN2Mnl^oQKcxhqLObTzSQIjbh9<Y_$QE*`x5_!s6zC
zu8+-Icyc>CmU4(Jlz8IVEauS7D(xVy2tSD&UWp7O4X!R$@GtSJ_+(+cU>3#;>N@w4
zB*WT68G@88;T$McIYw>$sp-10n4>HdU5v7GxI8%fnl~SBsDD+x9ET{I`KZn$$_O-u
zX3+3ifA(60@P&BLhJ7c+%$GU2yP->;J}}vM`}@^ysFxi$QZqWPqwHc2fYog0ft#CN
zh`B5PuytgjV!C0}C=SZ{gYb)CmU%&0^hvzAzwfv&{^i@~j<h-C<LZ+-7_bP*Hb}J)
zbH7&(3=CqN4S$fMFKOLeL=g=por{CW_SBiqi_5(`O@qlb<K~&A?)u|9v$2`<xfR{{
zWtZRRphXO24D4jw+P}`(mu-er&>&x{nTkDxL96!f-5t}A4e^@9uhI*~aJ$H6S+nKC
zT^m~5a~QBJwijIA2NB$R^yg`O-bAy<6T5>ZHp^pL>VMI+b`X$8n(I;;^=!vhOyO!N
zyZ7UKS2z7sE~-*9+KLr;S&-mSo#<B_az|Vx2*jkNa4G6h-KDv+bAOThVRcY&ozc0>
z35W~4N=mHBiDC=XM44@%DSBOitOB++x%TlhCI2qXO`fxMdRAP<tiOyiTF-ItQn8-O
zO$-E4o`1C~Rx*dsl38zN_?zb=X$L>3Jw$HIot^5%c~*CGt~c^E?pGi9GR_f_!j~ZK
zS%I!Bvrd;NP+axp9ciBN8^KxPLf~Xx&zKiu$!VvNOKq-vW2rp0>a!gLbiz5236fq|
z<)OEL?gkE4wLgm`=|$3BAQ$-S=~WGQJ1K$%et%#!nqFbLH#E+LQ=mZ(4Jb-BH5D6u
z;5m|InC2UP@bH8eD>wi_eTTY$;ReH+Or(eo<d(&&v0Q#3jnBT<%_d!WPehr;Z9=5^
zPI4xEBa-aUBH4Vm&`I_*_@`&#i1JcTd|<T{UKZA)a)-Zn-i!9MiiR!Gx*S#s_qo<(
z#eYe$R>@P7k}r}|iR5;6*pA_;;SO;W!g`BI%i84{F2P?Vv9cgkr$;nyX5vB5-C5Q(
z?O89yLR$~4`LJ0@O10S@U-v8$cK8F}&yO$-_0S^=m30<m6x5g=IX=ClURt+?UdM2U
z2x6{{W;b>vBf5r}3x($v3q0<umGYHN%73Nrw6ZXFb#~81L~E=}EMM3um-3_+i`{`T
zX26sL(;?@02*pXX^4K6_TQe>CWtM3?^N0?@95zK`3Nz8R?@V1e4c%#cIp}21JPmiv
z`-ph3+(({0)IE6sB(boV0W)AvK=IZWxH%8XRx!^tM$-vRe?=&%#4{h`BOP0Jt$$Zo
z0_L4VXQ5+HUFkyIEsVqg7RZ-&99oX(3GeD&Q|5p*@l3~B7=ej(Z{waZ;*&@gxEuIq
z4tZjahy2`>Xf>B4l$HvIYO;d04fx}BGxH}ltIkTyw?Tb0V;XaIQZpNCPmscBpmHM`
zt~b~-vC^$%@@hpCyy@BUv1l;83xA4`Dg6!BSCQ^8p=T3?AUivmCDW;RZI+Iqkmt%p
zc#wSm%C+5DwN#vEVNSg?X=P-o3sft1$^p)6f5WGOgJ{&=ed^$7V9h`C;Av2s%6)3e
zHrQZjb%b!;k819%vpfl8wh?UAs_R~0OOlqUlW;!u|F)Gril!iRLdM3KxPRGs&?eqa
z?7~=ofDy?kF~)Gr$RM7$%^WN)Jr-8{zDx%sU2+Kkgm;R3jXaX<HM$Ya^B^Q(1qTC1
zqg$7_7?d1)Val&Hru;kiy2u(Q&VQMVW5#EP2=BWFoRyj{;mq=Tr!{C2V{j-PXZE+z
z4~F9S7T7kJnD}Qe`Um?ZKYuq5tb4Mey!ZvHZYCy~9;^QLRl?FO|A64C^5L5#RYqie
z5}3;NE~i9~Nft~=cpyF!4`&KLA5?A7lwI~=l!LiOh^DwoIHtmOugYgRX&2g6pSL|s
z0FvdCAOg$ci5>Oi&t9jTR+<h=jLXVueDD<#(Hgye+flR?MEt|^b$<};{w2Gd>>@XX
zL2mDUf$)3{#}C)BZ{T*!%#9jp(YwU(cd!yF@duN#J27TCP1Eyw<4#O9!?o2HmhOD4
z{^)FwT}@yO2Uko-e97Or(>33A@m;}gxA`;+o#D|QOWSoYcwoUIk*-o^*!J(~F*a1h
zT3rgGD=*=kbXlO}MSn#O^vX&}qXXj^SSFW<k7^T_O^7b<^>2ia%`G6l7if`iuF26>
zyzviXAmVVa7i^SQu|?StM>d0>W-hP2My-fA*$&c!HG`oxmuGztX2<I7>idWNW<g87
zWI8u>T9z|f@yFY0sDD^-udY%j^g%TlENRNdE-k%;cXnQ^pnpL7_LZsSQI0fma1OM?
z43No|aCy&^2=yd+vstxaE1eAw$g;_Ogr`F-<iWx?E3%eS@)L|a_|aSfg4pa61_k+f
z{^sJ>;7@jonII0ERC^?BmDZe(QqSbL82!Bw5Zxi|3lBV!_k4327rV3}R$2txAXo4^
z8X?D4Kh{ErLw~mDEw;ej@(o-#i~3`GmZ{-q>F`z@!pXJRv`WUiB@No6xJ+Q%**Uwv
zvBrgPKtyV+){y4s<8;<#INMN5Qomf~VqP4Y=2Oga;V}x}jxD5YNOBwBzokBYTBu#N
zLevxSrK<&Zx$L}*0CeOq-|F*f+gZ}05pGWe&;Zql7=PkVL$mnK+9ytJeD<tlFqn@R
z?~?(^a7ck;UBq_;ohO&^XviQU^Yc+!2sFm6X+}$Mtr2d{C{HWTE*^1zBCI*diN~Co
z0oAE9_qz61)@7JAhpwAr>#~(;O|f_b0d!$e*7_!*L6#KkW@5*++A0<2;p|1YE-Pum
zbl8>W%YXX+o>!Up9QRF1Dgi0uF4~?w3>tI=Y#CX#&}XZ~=Nrp*r_l)t)i-Xw&ke&2
zhkO><;f?UsP$_jbi?dBEUMi~dHDGT5J`Oh@@G6IgAsxKg6?`f_E;sMd943Vb^IcfP
zMAwNTQczzp8yKO1<d`3*`B#Y-*y<v66h^<|t$)A`?G2zJ3)zS`BhUKI@v;WHNFu74
zsRSPl20#w;+$Fuk!N5ItZSgCDQfNpY<Rj28Ia+$Jd%mPv)9v!zmgVXO3&NXS(~@zH
zKp>K;QKf(#4z=VA()EHZ<4Ls{tw^sA8z$wljAC0tkTXQ0ev%`$G#VI_g~ocBr+hQ2
z3x9xN1T!@j(VM2H3&!CxO}VPxCSjh_MOhqF#oA@MBqmx_#;xfq)#=%wbR?%})U7K-
z3GJNd^O7`OL(p(|%p?){_U#jW5=PfY#;kSZf-GC8fuJ72nN|k}A=z3OJ>I<@<FO%E
z`S$IHGH~5GHcw}z*|ZFoB%*7`_WS!{Ie*?XD~i;a;Tn<y<CU{O?kx7ftT4Z7mdrG_
zCkfcuWKeXP3Y*OJuu%5VNG7g-kOiB8y-hdwhi(>n`6?QxlR0C35`pwIwoGGhzvzjy
z(Oya_{9URj&eJ4MGm=-Vi=O-R?O02QrY6A5#C|ar6L16>oNov~=eLUUG8gtbE`L_F
zk{}ez(zOa6Gl}Mv6g}yDMNpU>M336*nQ^0@pN9B~p=wdg7aOaNf)1@hSs?Vl)GCuq
zH7;~n8IhThW=EX5V9i;gC3898w9UmQIGC(9N>zSg+>Y9nQAEE|<&z$Nz24OMQ8R7R
zgI8Wbda%sn{Mtp%8s=rX({e4Q7k@t{Y?t`Kt``J_=&zj}Q$f0ik3G+S;RTAZ`fG~}
z{`lfC!hfzOv-q_&IpXcTX*|1h0JoFm>NGz8^MNV8+?1~0xQgf~#|$i_u(0%-oi|=3
z=r_SX=1Xd&hu(Tpq1qNGKh>f|;pjVD4Z0@->P36TB;5=uLz7}6@J(LnSAVpH0;mQz
zkaP7jlsw<rc~}Z;<R#cuTml5K$rlTgv36Tr_}(j>5=m^Gw<+>PxGiBgvS>_V8l^`A
z+;Ns|I1WIrq)`Cf;i7qLVIpdYSnwIOQ>>%l73xMrZY2O4*vvm$=jFb8q3btvLPrtT
z)>@4e@^H|=VIQUQc%{~9B7ZiI2aOz0UZrxEt<^|s9uKE-17|3`_JB@V!Q;=9WTTgx
z)l(_tv*&QCS`sg5VXL-$B-24ptFMPg(t*8swQ~Od?ETwz8_BsX3|?<OMVj(&kum`4
zP-T13E_<^iRTY<|l9njB_HO<jKoUrjX#q$qBp`}DjPYOfP4`ugzJKU`iGHa4Bpq{p
zhlogkI#reJz1H&BdzFaHjEs!K7vFJCc>>)TZFz!eoe?2U3Zu4fJpD>0klwTHB#?dK
zw@t*p+>v+BZ@A%=vNhcfNOq_HmT%D1WJtGTXL9_uWPbjE6Vh?hY#Ha+;V`VJ*pf5u
z#g-B3T)A<arW>F_Nq;qFy-Z8}zHL@|PP1@HsC#160ha$e-0Zui%^HJTT6tH#X~Mva
z>!t8-d;i)k=Ux6`dpdC&XTtW|IB3=C=;G^TJxPble#-~yLIr(!(Z2{6Jq)SAJJl<?
zJ+!tqmzN$j%)3?uMf)>(ao83x$5tC>4$@8=_yDrh!*YWMD}P1+f?-uFqKR-j3!={H
zcpH$-hx<n0mtxLL+13@ABvxST9VCK5a?4WzsEFC+{8~pNE~uI%a=~tzAh)&Thu3e5
z$@RRP1;r<)@6r-~zQBu{2R^u2HhO-dXP5GsZY}W-;Z7<ZtC(d~9DQA2LT{S!ZqwW3
zzA&oDm!qf9bbpfG;m^EBRE0{EJP^noIAT})&d$qm-#=84b$XZ!HuP?*Ok=k@;%qz(
z_E$0}{5u~N{$#_lIT*bB&pR6I-qzuej(5gGbFwNpwq94MDImzc-26<%;EL7sFg06z
zGg>Rzs!Whh6WOE%zKXnL|9;1d{U!0qn_km1W`}>&%ztp8x@u79;Aq=p;dg(|;F#k#
z>cjk?EjpBdP8ybE1W@M8rxSZLo!Z=ngIEdGK5kY+6YrVW|DA?79bgp+Rk{4CW|`1K
z2V-Umiw;z6p08-(`!oMgNf3LM4~ZO9m(A77rUYT}2_Z0X=z)|e9Ie=B#_*vBjNQGb
zi)v$2{eMWNzL!LFzH<B8&bP!C1E2m;e5IyBai7R9iG7dp0ch;MHlVg9rw*OYe`?Nz
zpmtujmp(Rn=U%va9A|qF-ZkIbGoG)519)_i4$0j1oxknx{J<l{*N@({9<=*c`a%5E
zr~<8s=>TVBr1dpuUR7?&_Vu^bl|_7Zc8=QDf`82AVaZR3N=n+zDd0z~WzXyQq`0C_
zOy1peD;^fm_y4gbFh|sK;vg(`b{^$<bLPWcFQ+}k{oCpnpBYD#z9NDIC}b==0?nW6
z>9ia)%Zr0*-hXu>;6LA0X9q{mj}PFvZmzy$YX|b5AsdCljR~4m@&|kp@O{2oPCxQB
zuYX<~ADkekHcT{HV1Cx=$%E)Y-dH5R8p^dHe6C<tuIEGZnI(9uUfR-^+xvQZob+@=
z_bB`h<8=I`XdgJfdZEw$F8=bj9tZy0upEB(BQF;8Y|C!tTyLG~UZImgNZkic&&}qn
z*BuvU)->tF)1!f9H8NVdAdBaWt0N6nQhyHey6&JNXhuV)lq9(;%XDC-tz|oik?qmF
zx_zw)Q8Ba})2oGO5@sII9lTV~s@~YS0YX+6>o6hn6`&1;PdfB(DFEu4C17ASR_B81
z7DkWCH<G0kzmQo73~V!koq`n|2vQOABQ&KgqIBXf#+|0qPO`_K_)4hB0qxbZ{C|lg
zdEAP50VW$PJi)E_rednG1k*Y0>=cGVN5ME9h`rb{1~i|<bcs0V2ulDVnd6OPEF6ii
zHSVT?d%QknZxWb*Ft+PCp!!#^cM+N--6yJ9l4t9=VsjJR`THa%+>){B+rxc%xQ~bX
z{%hOEvwc3>*JrW$4IIrNem?>bZGWtf<oLiCSj7ldFCihK!*rFK09#BiS3SfbCA)qt
zE$)TyN)SLSCpiepfd_wt!)87)px{m;(?%k?tjI(XyP`bKWK7R0Os%91Ft@WM5+}%F
zHz>>fJKGFW11spNDZ-aDEVLLsZO($U81eO^AnRVQn#D*#&UsU}+}8^)41bZicp{DQ
zJrL%ST(C-$9g=L(w!;2EFm=!YSxnf>V)Ezv-Sqc{8M@$5u^KfC$%2cTZoZjqF;k8k
zyCYiE7I3}{qKCx@F@YW+o)<wX0AE0$zbIKPbKfqp$vb(r%(jCgN$&I}V=AX0M|Tv6
zBpwN52i<5M&Pi6yw(OCU%lbT=J}`fPI0c>S$<t{<jOti=P_&HV5M1%$1_s|kFUxoW
zf&PNu4ZMhDvsmaUF!MKZrwxkiqqr5`{Uy9bOYH2ousr*Mvl(=Zc|60?!DF^{*c&%=
zKiN0lcTGLOp8T{IKGCh~gVXVy;?%|V&Q@6H&~2W9AGW6ny9TJ=l`f-gj~RcUZnB6d
zR?<Z0Eo04lG)w6tzWng;Fs#X)r_Gzr%9o`s@(#3w^X|tpFBADPSHZdyq60uf2!vWT
zaGNt&@viO3Q*!O2KLumUF0Yo?Qj4=FyZe#~3f(Df*o;hRoUDjq>`5~0Jdk99&3W&B
zcyzj+34rt^E17y|KnUp&m>7SP7Dnm<H^3{h&BM|8wrV%f;ZHh6csfKtp68*@EQoI7
z8!5pfNqQc2YLYh^DnVSLF!rPF9yqydma8#gtN-eMnAMc((f`r^2dzD`3X0C(|FQok
zR?EXxux5T<Jk(r{ht1-8%PHIbN1cEB{y*sVKQCLd&MfNx@SmT3|Nnom`CqU8vrIp~
z|Mt-m!9LjFxAFbQ=fM=q3yC9aYeESr7#Rtk#(Abg9g9|>BKQ;9Q$emQy3)+x$NT>E
z;<n8HaR<>h>$#sU-lgmtg2liyn!wptHCX$EI?+vr!9VN#gSdh7e-b~32yfBt5l2F7
zt42Hy0{2X_5abU?tbl(8F?h#FO2M*>mY6DTGqme7<QRyZsW$JFp7D8P+BA*?x%Wes
zrGVAR{ex}a&pzMIzd!Ob-ZTdK@htlg`U%nA!VegXA8-uhyFPFbIA9xN5DC|99K_vr
zve`K$NeIS3ni;c=IlXkUD#H~H|A3JZ{_`~2Me-tqPXS_Pt)G8v17>LRyNs2cKvIde
zEtCxS(GycUX53?~Z#0-|8lBIPU{H^taxa6>TXRy=JJ6(aJ12RCoQo_mFH>(HRcGr9
z#VFjO?UycOKf!qEAoIJIX*&(m$2gs~CArWC^$%lsdN&;Zt=MC!y>9!)0P+bi{DYe*
zp+5$a{~gWzm}r0f=Npwv@9M~AQPba(gQ_pT{P-MH#&z{WF;Vrc_#is}wou#U=#l1Q
zJvY7q=Nz7=6gX)w+TyATohyZe!2MEjvF3n6pg(GidFgmA)WYdT%iHfMaqt;g-WVh}
zFT*_6<uVowSQHH1bHL1PQ^@+?XG&Ys8TUa>-Q_$UA5VV`@nQ><f5&(IkLPyy7<z|K
zA#!jYhoc{b$KmA%@i;t&{MCS%<G-EiTBa7%_1e5!5^aHyQrC7;Kc)3cy35<m4Zcw+
z6L#;0_bB5i>(I#k7gO1PF_rxnQ`sjlmAy*`bEqSC&gRH>lqDOk+a&51=W=?jY23+a
zT26pMPPc#bs+BzG9;4jBu2~j)m6{Gxqh=?mA!F^^@=2p!SdT)=HR$TpD&ew|mcQ&#
z=xv3|+)q9!1y#BB0T%p;ID`q0aB799cGEf1eLCuuh|C1-MdW70<<+YFcS&L|=+A2!
zMD}sHs8d}#-}72X5ns#l8e8ETgQhhg#5V2s)>VHbAhqcSr;Z=oore5;2%3DYXALZ-
z!TzFQmln|3K!=}Eq{-UdxgZu+Tg*c&K{n)e104t37mn98OOMznki6~Z_(|TH2c?@>
zIO>rtI1G0BT7HD9EHSvs*HXGTE`wOQxMT|98>WFD0q=1h_S%~Ybbm|}+30-iP13*z
zua<uvcm@W=s2oISI+2CV&9d-5Wue}XTAl1SOa7CMXWha@l>NKC+qR!V4nJ<&gd85E
zc=p#r;T%^1K$M{t#{j$!Qm|NG%ryvxah)=kKm{^Qg|j8y0<)lZVrL_t=`>-yMw%Ml
zC@=`<%sVp#<f6$V(Ur2c_Qh*7CH6Bh(35|v_gD>nlqlBtUXNv;#RLnf44Pga+7W{9
zUM9-Pc-gdKmq~I4kN%k;Zb2-g;aVnyYNe(LM)2)8(mg^Y%vZ}Wpip$C%{W%zvqKbw
zW-IlqXli<GG=|HyoVwr1Q3y7AVI+*=vzoWaV^IKA<Day6zoJ8*E~~XyYRw4jCI5fe
zm%c>s;i{YkdAC?L6nH(ghg;I{LS8CxT#%W<Q*>1+xmDA=4*gluPd91g{YCZmvc$;+
ze^^~Dadb25`*b|TKA|;<fAt;H-q}_*)gQMU!j>cFd}`?tJV6{RK|{m(My>!(pc1E}
zIRj^!c=NTChsU{67+D$J(C_hd-J*ZnI8h!>oAo3dh>x)y7Rx%QP(iIY?|;*@#0WbG
zzm1u89HCJpze+`1&<kekIh;a|#jlp62^hyp_|EDr01jsE80Cax>m>jd^OS{-AP^Dw
zf3aQy!T?I`6nSSCRG&g`4fV@8QJ7_M?o=MGp3_xYU8zohnJJQ)5irh@>T-W^5kvsX
z^`MzAo1k!em55GmLRlaPEaue83f9=a?wf?`IcRh&F%wx{E>Vvc;TTXA2d35Sda!L|
z=TR#BxYn>bHC^p$&kYj=KGHEc{YG-KzeIM#w#6DLg4CD66Ml3x>wBbRq(7kL^xxr#
z3A>&%cf-$pahbMuS!#;%zx02etv_z|A-`Ggx>}YfX72o&JiB!<MC^=X&TnlsT5{-u
zD@n;y&7#=YbAl+64l%h9D=_UuBA|AqKpQFqM7RYBMNBc#m0MZ`?mEaQ8CoORYJ>F$
z9mOytn&=qY_&6*Fbky)8a1gZ3xGp`(th<uwr)iOw8bk+PR;Cr0yT^Yd7Tz^4xWl*9
zt7_I0UEfgmL&w-rZg<iV$38Yo?~>TfT;DwGnu&7weIwbTmZYj>1!ovvBHAP-R04Qk
zSlykBB~fgWp16Z5>Qm^e<P-+6Xjv%HthhfY{s1#;`{4S(0?0gQ@hmFdu+@4AlP64{
z4G|;OdpN&jNb)J$$mV|=>^uk)rDNJ~$PSBdRnwITWoOe4a*;ZGZ)YCW3FR=^d}EHs
zn@r&{eBT@B_Ly{;KIe@z0=1x2Vj^VHHejUwWf--(gD}BExldHd_?&`9z2p(k18-)O
zO68ksvca6JWC|C)L5=H(dDyxpMT4@VqC(=gmO|?;GN7Sk=V^aBCP2L{-XzJ*##$lz
zNDqtgwP)1vw_+~>@`<1r>0cwcVPB5&xttaJ09gs+G9ve=v7?|a`3tcAts7B&<FzC?
zPme@d9`Yc+>h^QFaJ$evw7IckAXq8496^`6J&<r>BnA=HD@U*sZaPQyLvh2Wl=F<(
z_6T*yfV`Yes^x!{W_~q<XJ;X8ob#?Nt+Zm}oN&pQ-uSKsDfh%KDuP||ye`bA^~JKx
zqikw42zNS*?|m^k9M!w^uy-6Yj#J0?R_}N#0m-BR1yn`cubfS(t7|x!Cl6QtIB2zR
z<U3sbmh-Ete^_Ki4=htO6DQ9q#q+(nhww7WXG{d3?Aw0?E+`k!SC?3h`Y0U>b$cn*
z^=x2}2K|*ADqOwI_;vV49Kze?=ah1Yv^M>U6-{BK+=pn5MbJHcW4Ip<<xNIrw{J3^
zwxrB%nTZr>*AxNytlMv5j9;M=blXeeU_3NZ5**Q;;SJ6b2AG-<WH(jYAlLze`XHu8
zn>64+w{3s=0e0Hh?06D{o+(q%FJ1@jlOZ})XW}Y1R*-4sEkVrACviCVC|4U=?6mKQ
zp}Z@?=)oyRDTgolY!FXdISy8J3nsB79wxRzPaQ<~>9*|G>UK^U5i^LB`PedZT2Ntk
z&Z0M{v&vO{LE?lNz&3Zmc2dk_h*4bi4tF>Dj9GsLDBoH`PK3i}wbm0s;4esvq1_dP
zOC}9h!3G|aeE@dYcqQ~|il=eOxd?+fE}>V2h0^Jrt_0LjNy}0U!o@gkD|z!~R2OFh
ztADF75-5uZy_>ED2+^dLDRQHq)VOICG>B1<GGW>k&=1OscmaeHNoN8d71ryx0+eKq
zGAw_<17QL03|!+c{<2eO9YlXwPU>|~%|5%kcw5BRg42^vAPuB%K{LQ#;o0+spl*K-
zI@RZ!&k6EH@u&<3eGm{5SfAKm38r7LB`_i*TpQ`))>SoW#%r3#%Lc{5FB|92E!6|)
z1_FE-L1B3t6=dmdvsA5QG>{kQoWxZ$h+}`l?!^)6vs8q`6w@2V%@h^b7faZ=TZZcW
zk3whK94mMKJyQ6SuxdWa|EJp0kk8$U)Y*=w!VAaeNf^S5-Yy$~P)4n3i7_+pW{1M%
z7sFurt1c35oz*Qcv~s){#cqu1PvqAVw}uJ0TCyv0^_giP(?+U5RAo+E8*KkDC1-yU
zjUg!i^Po1Qx<XVT68DXr$^%7ZXthAB+prONigv5V*?WfSeJU4~mu#5Ms&hgku9tJS
zFHCKq;5Z4gWxdETClmHL^{yULhm%{A??BmBxMi5E5~^#vo44);rR|x0oy;CRJK=<(
zCLn2C+a@X@S3gV^v=v&P3$Vk-tm%J@#RSVbZ_Fwp#bauTEm5?vSTY_G47A9SPs(wn
zDe4;*;JIp4KT_@^zg2d3&uoB{(IvF-WiU68Jl9O$R5^Ae16Z$KJORf}v?<Es%WcKS
zgM8TJo#Mwl?eyfm)p$OFDLj6X0GXwlbf{!DV{fW*ce+;0z?n>9c>B)IXP$q4xxJo#
zQ^Nd8rh0f*&%^0BM0+V~gxI;sprei}XA65rXy@<2Bj$!AO++72uLI|{)u0O5lA>m_
z%(<1AH0WgBM{T>FVJR6`5<Y<K+%V=_hn$ShUnK}jSqIq?^L5eH9UmOK3G{?VEsOoN
zJU*82@AI?^tw&DIavm(?po4!*$($Xo!fIOC&tLfQJ`jcVvD~MyNYdDeLb6?k!`-z4
z{oZhgG&SJWFRWz0`)pj*t1t#<>u5Te2ZIxX+>zL%KlFuvp|yKNHC^Pee2O-A)&zZj
zZ(05OT3QWPz6$?3Z{F^QC;e-2+dy>vhnMwqvL~(hH@}S8n2F#Cnqq%FGjUSp;aq7T
zcAgjayulZ)i(7|XBS&90`X;)2r*D7b(s^jdpRbJ=B=mJC6@zh5w=5r7!@c4*ZW!QJ
zhr&W^<~+ro4(nV=*)M3N{p-oIZ+qfwUBb5}xVipzW{@Aojk9&Nqm7SU?pxOSV{R^X
zmMum`Gv9y7YL(@0z!HC76t~G$mRJV|Ajtc*08;dB7e6n~R!zBwmItzZ>+@^v%6vTy
zoA3U<Px60lyZ?OKu0xrcEy0i2gJ#$T<^F1bCFpx`JCU8WB}0;e=X?S?s=%IoG}{df
z>A7;Lu!G|1&FJ>F(dvDC4m$@jW$w!jmMw$vcOcp`-TF!S=WBm8uRlVqo`$D}@>JG@
z|1*z{t8SEPifAD$H9(eR{(m|RYleR;xdd4iQujkb_4H;83QMyMm&N1WUVqZ01@u2T
z^&W0`rtjS!`e(%t6qmF=WgIDwOYC%aOH}@6uZxju#_Rc7f;%;`W{};{BZaUt&RqL9
zXxBAG@T8j6{b_$3;$!5Tr9btyy^XgdFO$~@Su3>ia%I&gX1C2O9GFcgJ!sQ(R-Iog
z4V`PxWj@2(*7H?8O}?tCCYg5(4sQlt=FCx;!7C%nTQfW@RAk=pFjz5X5e5TMPD1D3
z)MF;RM1QOJcLYg#TMdCYxqWOjC-~C1JAt>RhkzN>mwtb{)tgvy*XeG#+bed@cK<js
z^N+b`PI9Ed-R-1`lQ!9i&n$WJBetO@T-xKs#k!tUIrI4k=UQvn$<v9`Xj77U*S};k
zC{YMDk#!OqIGpYkJ>p4Dxa2cxYPKYmqGqOFY~(kG-?lLf#w1forkjK_FUzRAIh_tt
z8@F#uFy?<ce;4b0N`)EAa<`;GXHDG1r<t+;C1^s1-YfwVrx@H)CwEzulUM|&wxjs!
zvsUt6YItQ;>MLZQ(r-+l+&Z;C+bx;XOj5sIh|8uE{bx#p{8@RtLLVcVnN$X5*0GRr
zysoZWWMPii%a$pb5=WGlKWuX4z51ud5wquw7ioWE?NQ_%5deyp5<n@vS2J7MPTG08
zq({NFo|Vh%k+^&GuWkt{H(9uu1qXU7|J}V&j;nB|_yG0RQ~B!?;<H}r08SjBtvBav
z{<3T@wQ>A2MLN?Skwhfi3GuIY&dg#_@1}NIlFjxs)9gS|-$?yAVikox-mR!e-V~mu
zSp9!pJ^A9^{RgA{-Zp?GXcp8|jYB28z-l-29rovq<LYikeIU9)w@sOI4E{j$G)3OX
z_F9n5I*=S)%LQSlRsfl=tW>y~$7K5SK-i!jEy-aK(<SBh{5OH+n@-C`#Krjl@Sf3M
z27|%hoc+vmXCklUW*Lz{pC^Y#H*?xLvW0&nZ&TvSzx)1($cC-0K}2LQI^1+G^LqA=
zA=JDq-z78b7<tiL9d4@jrI507iHDojLO4`xCovb4(daz#afUnPU_b1TZ>4vLtUOG`
zx3dG}_jw181(klIm$jhgZzi_Cb5e#|PT=kewQXbhWI-!lQ<u$)`qL4xy;?Y;(UyPG
zd9=Ojxr$1E#<CLmZCi2N%UpxBr*-p0@D3~cub2KQ8yvs!?i*J3$E<0C`$)zyeEz%j
zrlYOp*`Hw8Qub*rqSlX!;0yP(TS~SQkztc-^;}lL<&?`}O^7U1aq;T-hRP$aH~Ob5
zDSB^3QSn~|MgLV$^kHk|!|I8CxMF`Is662?99tIKHvX7|1dl8mU8seamHOd$3!Wf<
zSezPd%R3tgH?eP82J+*x;cO+t`KPA2Nv1g-2wJvDekaYp{5Ue~cg)Fu(PaM@P4<m6
z*(x&s0p!@<XJACNVmX$fluT|Ehm{qVZ``xZNCLuCwCifolGrEHNvG9nWrcqbVjiWg
z!{^wPW6fjv2=^g3^LQxFb(+aiU<84IMRNUFIWb=XQlidFjF(H?oZZ$+ztL^Ni&&*P
zB9@w+jEtAlaIMckDBgy}l+9<df{3XCS9*5)-~c}j@e{u$7Y|=1WdWy?YB6oDxq`w=
z4DuQ>ORnt44?Yz+rD23^xh8)fkj+M{TuB&$NI$Eljno`+_nd!f!o6eQm*h$3CxJj!
z{AS~2IPY{iU%hy;v0FYLCR3j*154=YJdd@1RP4$RyPhp42u!J~gOtCRBI@^HrE5`R
zIA_Es59jGPsEEa0J*Wn#C7lv)Tl}x~Aw6q550nWITr0g>c<(wh?0A3ryl6d>spM&<
zpa(%zR+D}`ci4WcLu6d{<=#)5?=I4}N#t)EyfM7ZqRe7<hEv~*Kg71~d|XWJHtNI3
zXDsIKPr|XqCglYmHrL@+nd|IXm2od%Qcvp{B^~M2mZBB$w~mWOySi7-oB8#uS-1NV
z4xsixn+~;P!s^X`hSq=HkPHHgA^g8E{9*H^`1s|SW=t=lK$2x9$=A!Y&wBFdnT!VI
z<RTfumh8sjx5d%q4Z=$k{4+E?@Pvamsyh{T3t?UWm-%cV&}_zBxlBhVenyFp>&wT<
z<sS8n(lgufn_93^PLEWG9nCmp>Cx5{)3pyj7gQ`&?ksfifz*FXhueuPAQ>k|7{-yE
z4YO-M8NvZ|P#*k7g*+&me+vua8Ej*85c{U5t{3(mx6qx;tm&xJ#35&9ju|Oq|K|6s
zQ0iN}dAMGRnX;QVu$w>~yr^*4d?Kpf5)XF({f?PdZExFbKAwwOp5e8kU<(NPQ2lmw
z-66^RbhZQNU+{nBauM{3<UsO5Ic6&W_P!t1P#<vplDN;BYb~|5Xvcg~E+-c9jCogH
zCK7HLzuw4q#j!4<!n@&DPVJt#jFMo-17}G`?Ps1wOAQ@$H{7%hRUfIexhk=@=#%(z
zT~7@sKBzmDwgUE?U{kMbIfp*`6u`GsrA{v8HTmkJ^n-tXaU3?D)On>^&(!MznVih-
z^pRRMF|-4Hoj)W!K6&(ezA~H+<8Y2s?H`7{S4~l7kgy|h`Ssh$>wOu!Fiad~ma?Sl
z?_p+TdX_pSHAzwL#}xJcv#?vY<f&snhm9$-DdvTBzIW4--#CGC6;BPXRqlh0QQ!wc
z#Bvslob!KLqNM9q3zxfVNy^h+RC2?z+YznYvW<7OtXD{-O<cC18E=seaDPA_a9H{*
z43gZ7uCoh~c|#CX>Q(VR&nM9nZI1i%xTUZ@-*&MPZB&S2hXSz2;e?#9eXkkoJZ3m#
zWv8H*=4=Vu9|uUgK1ab2eP3yT&qry&)U@BX!Q6j&lexWa-fda&xJrnP)e|m7loifz
zSiD*le2O9_0%_`oio|6XVQsC?cq*Cj?uR|p#=rEWiWOnj*#1B&3xhE8I%8q538UCb
zMs!#vmpk*tOc<Jjgresq%-RXLsO2G2r_BV*632SyQQ(q>o8(c{$-(oP<z*9F(4g_&
zSTuho4BO}SqAD>bN9}Ta;9GsLYC$=y#9u;@%^CE)lLFuVVjy^C51&1K{_NYw-@Y7v
zd-U`%w#Mj95I+MsdqSHdaf_|Smz_rBv^LU=ouW`TJ#;gSDi-E12P&n}-Q(l09?MqV
zGA`_?jLfeF#jAxUh>wCAwK^D&2X%d34gP;5{fSZ+<}Jdu9rkwwG^zd*8w7VuwtX9w
z4V9enX^rMtmCadD8xQW^z5k$p?_MAOw=Z%y@mQ$(p%1F3^oC|r+$E6cP1Ypb!e;n5
zWu(=IhyHNVpg`SPqZKm>pFjEvoA>#*Uwe@$TnzxQf$2omvqpy5sWrXLq#5eP>}Y@5
z56j8nandp(iE~&DJR?4m-e|9IY}i<DB{5ZoL8l@s7&8{{V(#l|RT2O0*^A#lelh&|
z#j{t>i_>cUrVgTsJJCQEwtULLXTKaKw+<cFp;I-b(BSOlDY{uLw;6l?GL&m-h<AkP
zuFl3T6NM&P%Toqjb$kgD&h>1U(U5=SUD8}3%^9hYo%c3=YR&j)wj2{UpqByy687#O
z0l5zIEF~?JCn&>G1(V1cRrs0-R?No5wqwTWtxh<qsc++Q5$0VoQ@xVei$^W3Q^Zqf
z-~2rh$H(Rw$C|qd3|h<F^O;oy-<%Y*MpIgG5=zri;yqFbFPNy|eeEU6Jgt8KGJNH|
z`*-gaZ|O)F6i0J4=fu$CVs>V}wK~G3UFE;=Mw!P(Hw9IV7$eJGt&2Mh{bF*?h*TK4
zJ(Z&9sg9xIKO*|)@DpOm^AN?)E7LwV^HlE+yRzaSWdV*+_2Txn1|hNJ_cUE}o<y}0
zaEl;m!&(j^oaXd)#WRIhK;?gAn`oZBWOUl-CQ9BGhNO=*ZfhqD;mI_p8pU4I6(zt@
zMe=44X>v=(V_T~hPmfHC>yqr;D^4E;RlHeFHgB8Ag>d6Ok&z!W8EfzK<mt=jTN<6M
z7PxgkBd#!|jL}D5q8b2;B#fdcW7s27vdm8S&a{K?n`@Yh^6#N_-&22DHd;)Nr<daF
z{HRlDWzQs!zjPK&{(x;ppgQI26s-OmSQje|K4})X;FL-#lp4f7I!~+ldUHT%E$f?^
z3t=u?L5|i`KFz;Nvb8iJ&p{)A`%-0jtyxN|b0Hq9_9q3Oq`W$-GIZj4OOgk!A=DET
zrjBdUI#Q<y!RjdqoezKetT}j5O&aO?8h<XspPDQcPU3P5wg4va;wr-k;ER)gN`4+|
zoyL)$LfZZg<YsAl=PF@=xUJl0YK=dEw~7_Z;YR^Co|SL)9>~>uzxdVSZ4nvO=87a3
z4Eix0Swb<k3Z@#zv^21G8e_!*0OV{92KZBJTHfSuN!E~7bn$;-xvmILF$qSqL#B--
z=KGfhOLc7E?RGhBJWTBfI0K_zF?s^W$B5EkbY%YL(H54>mwIaO25C|NE~0kbUWWmg
z-EQ@@QeLUWxx&m@927#>`Hn8@{7Bkm6B$0yLnHV!ZqIGq^rU^?c3E6J<2aPm?mt&s
z^5$X1BUpoenC*Xu9diI?xGP(r@e?jB4WD7*Rsp-JG#)HLBBe3070xag@f@WAU!#}b
zBN6aYtyEStq4Z(PYxu^x7O~A`za?1bx<M7d-?8iu?tAiD$KTKIty3gMBQRO|_Y|Z5
z_5b|;6hAM%9ED*UJ$(7%3ICAF6o2=7z7d@qN~~RqQ~ZCyjqg()f#eI*U;G;#^4`Dl
zM!Jtr{NN|)2S1Sy{xa#xdp=ouoqlxs@Wy9L9dz>5$q)X~G2*H&*YD@5Wn}W<7W#|#
zH2R>^Xm*=4EuZ~q1OF-=_*XLUFXCvtXWTh%>98k{8Z;LYsYd_n|MCAD$x!p3l3wMm
z@d%*U$%cPjB+NxYBqIDrGcSBo&={^A$V)QFOw)2eC5`6Jn3n4STzxpBALtT3E4tgn
z>BZGgq^<R0#yp@+VuV%Ni|`F^g7K)_u+jUe^TdPn57t*V${k%wpTz<AqLS?JlDKy1
zFL0!C(l$ruJ#(j>#uI&gBC!lMoAc7Px6mPXcD#S*r~mWl=@YCiEf3XlA}-KvE`<j}
zlz>ukos|+REthTXV8{nd6h3+J2dI1%Z;V>6Jm^wjea2%e^baBpo!;5Oj}P-7598eM
z!ww35Xa0Se3Nn}Z5x@pXHA`OP?(i582ycxpP53i2Eqh<0_3JZ4Rq-9{M%W~L?46?^
zBQSqNlTzxkwGoWSC%&NNL!J}xju%+<jOF6K^wFXNor1u(-X^G9r26UNqaIoCyaO>J
zZAl<MWww_*S%-Dj+mVYWi8RXJPQ@$;&E=$zN|>|_t#o4VEkxo9RruVV<U=_kmMmLM
zK7N?W?GISQ$_SB*dtcJq8nw~h;%59icm#h{M%U-(5Dk`#Z$Qy!)#|D;|M#h7=TDa9
z`D)8M?hbi{vO&aD5*Fj7eV4GO@IC|ez+|wB&5v$YpYQAQvitBolmlC^Q#;}`+&Pq#
zMVY4LQJa~UOY-D}Gq}mrkImmDkSCiXB8lRpIa>=N(k2kmW_9j=l5*=pI0I2u5aoXh
zLkuX`&rKWbPN2@J{mW7WWaKNH@O3bCR?1uu+N65+Ip^6&9v&VsZxpaq2m58_&5&VN
zcY+A2iSL5ZW8O33A|7coBek4pI4+W=J5yyLBRg^u3m*0;0C|%<-8@C=RN#7%6o#G9
ze(K(n&frU<o!b(^YtF@rw1jzTXF`APylV5(9CB2KV|1<GEX<r#xM&L+M<x|21a~#g
z+#3C0f;D=TFg{YD>$rxsq@Wa?jkyJ%np}5Ff7v%f9b@#PB}AsNa-fEhu>uQL=H??O
za9__aqenwJ+mR^Wn&~w$t|}I|c9P?MW<-vX&STkWmkon&%#JI*Pj;M%2d#gDy>sWe
zq?2o|;q>}los;Z8Cb2MrOd+t*$s~(Tas$o#`G;1b>~F*NZ|QIUFgNIUS`XpgoDT8R
z8@AF<S_v(mgmXG?8sFdxX5)Hi!%JX(V`;>KvDrDDx*A8a=E5R>xL&r<NEFQUio7a7
zMqLV*qIcodu|fvpB>kDTUkQH%KjrjBA1z$E5iz~nmod<x82S?;x;GlSt+jpe>pNt0
z34E^R<3q1$Yua$_^&A1UIWa5<)8ya8&^^*wWVbL{@1tnn$eEj7JJ*h;{soiV=hUM7
z={l8>d|g!wr<g=fqz@bMP47}#dVBonu^{FnT8dUqQ~J^H|K!gbbDV$CeY=%^1bqbm
z)dw^`%(T;OiA%+vrtTpv4dI$gr61{x#XZz7oDXp|>4u`Er)#LQZkgnslr&XQN9#;O
zFDe=r7!GCpglwF13h~LpwXj$=t40t8P~ax)C|D-cM#9y}T8hd%p;IV3EjMQ-WoTxX
zCq%j&tFLP*{ih%*5s!bEfRTm)%d&X*<d_Ffm}(@aMf`OvJT4ghUMx*hP;0=5wT9=(
zahGw}c!JG%tNVi@vh?`wNO*cI?<Wi{hq}AAH)`AHDR|j11H*3C4WOxNFV^#q+7h9q
zq23>@0L!h>u;o`mxJ{F;CnK5f5ZgN1kfvJux(b87(U%9qAa;Lq>m%rr98Pcc{Sr#P
zC+^gwO7^$K>0?EDg0%UV#3Ou7UyZ<h#n`|CRmm4-m5K1heVrz(lY2TJJ<o$^t!}fH
zEI3s<dSV8nmQ(!=$eEBz+X|QoD@B2n!=Xmxhjc~AFPa8hY)yu(lQa-7_syzR$&ytz
zn>A*9QKwg&5H5fJ#d<ouVOnrqs=U@ruTzPYJ=|Wt=i&WW@ES$DEF8d?t*ZBJKanU5
z#1p#5c05;C*yix~9N-^M$}=N=xOT_fy*xwgG&%P?Il5fFu2zdFR*n>(x2yG}Zn!o;
z$kF}|{}%{zUt~+gm56--x&Ml%T995E6ULAeIJp@8*2RD8A$T|4EU=?rRq0C22^{&W
z<@DzaxJwxRvOZtw-{3&dS~4w|_V)JF6+02B7ny&<vZ$2*`Sd*8NKo<{u$w=?uXhV~
z^yQ9zJ@5NSc-;e3w(pYh0pidkEX{h_S_Y6p6vz3Oy&-unN0MTx9Krf|KcmQF^bJp`
zBj-B(MvH$wy7$#Ki}h?KOvlVtHITfX`hkr0m<a8Xe&*i3Xufk_Mm1+|un1yzaM6$o
zZC|po6AJA|)x7D&bT>Zzf1cv+|MQPQ{hT)g__KBgNHUT)Cy}!+*ErtIJCwN}jrHVZ
zi~PZAI`Nz=*`kB%a`xV>%{y_U>jCk@1VbpO8Jd3(E*TyiA#=`^8nY0jG4Xgvx{dOx
zWLB#rRX35TEd1rj?OBa>FdA4XWO<X0Kd?uWkHQkNQ)?*Al-8S0ZN0oY-oC_tF+|6P
zUXeLm*O~beUA(N^tmjr%s+MU4wfXcd#EkULNAkPioz6dtKbs%K)Dix8N<}|@rYexX
z8sdNVp;(?)Jez9Z8i{#{r**0Jl4DH%MW6vqB}aGSk-urf*qOhl20D%m^QxAclHM71
z^p?;dqUrllE8>SyA<xwxJALH?Udb{G5|9@$bUQm~?IvCQ!l-C&emiSvR-j#3tF314
zD6-wfvRqtdFJV)B&8y@5C2Y@C^w61lhJ1gj@X++yQc&7$-O=iMn|0)?)e}{>uopKi
zN+%HuJ9t&TO`f1IL{GTy1*#krlCOmwI3dhy7fq0rbqgK{B|}O`BBIg~&XS<&V&EAI
zVLh`V<yBHgLbghaFBuPJ(j}4=w@r~`#vL6a3!clJ6mBJx$00p}Mo)(u45~1A7xRB$
zr_^Iq!?c1h$l9nJQZwwqu_*drbnxv{RLf<vG)L+&wl7xbYs%j63Y^Jy=GyNmm!|mn
z64(%NJ|)~~u4Q?%!5CQ9Z)`!IUM1uMF)Mw$xcL0@sJsr-+cRtN9B2RONYpPAU484w
z=mtr@aU&Dk(v%%ax24;^n@Ae6+o^w=zm!PL6a8p-Rb{M(HV)z)=-fx&K!Zv<PiH+t
z7K=TkR*NY9iCyxM=DZ_k1sf9Sut#1)*^13rGWAsx5{-WotLJ&i%IjheYS+QT+2rS<
za6Jc*{9paHkNV$Vk^94;!&dm;^?!d2pWpw4{}rG1*gx6-`1yD4MCF|+Q0jl^zjNoE
zvo9bcx^kvvP&F?}{+NX9lEYNYwK)RS!H)T7n*H?i6WisTUmrgI#d_X}6UcWG*T)k^
zd^E0vmSdHkdNIkrLyk7Bq)g18c1Hx;p=hbfH%SRith@R?pa0OK%c9ZrqDrHwBF*b+
z9!BP`tP&Dy9trbT^`Fb-M3H}%(g5}5H^vj*9AB3Du3FTq7f&|cyOuJf*8u%R#Dqa}
ztG1XZHBK`Z&Fe}i34>ka1C*9tc!KWc;+JGa_vm;hx@+OD#ZeyWk_Rnp7Fngeg?8}I
zDf-gSKblNZzx0h?kIxsXDs1P>y`ifyO$GQTmi#P@(ACg24s%6pP1Jv+%_98BVUoH5
z^ASMGua~XsCU61Kf?^Sec#@#+>xd_KXbwAIQ&l!efNfy>-@f_0hvpz-bxQt;-ibV!
zE#Xi4s}0XTixThwr}f|YU}l#_9&QsEHrjGnYR-2Qa!KVbTy-K}mtmc75~gK)nP=S-
zMQhi*dI&vcLB8EVHcEf7OTKK6C!=nc;*zc>s{Rjtw26ydq9h*`TSw`X7q=S{pAE07
zvtX;dPQ%<d8~S``-z}I1`}Y$05pZdx72X_u40S@J_C3DD_`l1kv$3@!{Sr?R^LzCD
ztq--J2zAmX=sBE)Ij`Z?k4Fd(%6PVDt+AeCu}i9tcz;G)=bL~2x`=qpAm(0>RQBHe
zffT$WEX!K64$OWtf9Jq;x<t7oth}RSzMs8;Wv0o_QE;lGRG>LPE>&3#!3`pK@PYFF
zC#S$ohgEkq>$@J1gi|~l!%9P=;$gn*G(rhq=v3fBE1I0kwE}>ux9{{jU9a#1wx71B
zweS?g$Px~T9<6_@KOM&=_CexkJ^ga+o9aToe8_UgV0EH6i!BZryX4OY_XMF%g1gD@
zsmb0N@d}b*(p(k-h}KR=OS~NEJHeC~#>~CUBXboqIv`jxg2eslE?=86@g67s<RqQq
zVN{(zIFo|u0{Td&g_k+4Id+Xr(Cv80!!Mka<!4IraW{YE4fqh+D7dZTI^aP3Ky%qE
zPM==~ePaIMjou$F_{5D3e%*X{V-JQG&5aFxS!x*WgPQtmh!XxA8$0>8Cm-I{=fn2j
zr#CevJj!zdNzmap2MNyjHB%D}9ND}v$tu9-6zzJUHI!SH3_Wm=zOhW7JRXLdkVIdS
zc6EnY7R`UzdZjr9=A)c+9yq0ER_+(vjhpf_Vs;OF<~`e35$`TyV@QJJ29{x-JcUa0
zdOk&hqYJZyRiT3k0+(~z%N!l#7sGYE{VmKka5NA`z7+doEH3tk>9C_3H_2?dDXm3l
zMP;Zh_7-zth|73T&+wx);df~Ydgoa<54#=t%CmoFZkiHyBY7+<C`%+%`foOp)J}BX
z%2#daO+M4*N6hrzw7MwA*Pqr|&Dr1HSLBVNtI29k_s}L_y~RuW>SKX<<M2}U8;)%g
zv=LB<zT1;@bG>tcB!>$uYKLz~;b}kmpb4klBqBi!lcwY?G5H_MJie1gVOo&s?r*JS
z`h$PpiU&K$q2fYLF?|U3;O~wppZ7&xG3ztwi{am^_e=M>M(3U*LPCHfzrRiSG@uNt
zpxavz`gU1O!kj<18~_j6CAD%fU(+Lrj*^N)utP(i_?aviq63pX)p{7O8%m^n5{)L)
z#)M0QIcqqvCy(kB7HD?80L@)F3D01v2X%jQP|YDe!c-jKjg#RdJTbUjsU9PzGjzeo
zA@37&yS4n~UXDgS`Z@JR<E_X+$7RH_@65Q;dmWs{(fR;tY3TfL(X^|J@Z`TwN3j77
z9*@$C4n>S^AVW=(TwK4F5f$W}sH5y~rk;B{#TSYj|7&mnK6^nt63mqXV&U$3+f#pk
z+4*ls2Q-xGU+?@k9J+@J7!v-(2PIc0XRwQsAKG?`)b_N2uxi7qnIu1flzlj^mWo|b
z4HwlcUjEy!cXp)CDXec~6*+Yww#=T5)?w0f&}#m-@TITX%13Z87#Kl%_&=h0?Z_@w
z9wR}n^3}GpBNXy+I`;h9J^<{C!pDDxf636)WXdcG9~u6Y3=IEH$3-4ahlRh~I4V0k
zK@*pccf!Ru3bDJPlmG43#u#t}j$~`k)7*MrYKC2~yjV*zOsn|)2GNgouk7G_I)mT%
z5Y%pYt6xej$iu_KU_W=zQyoUx`)InOZv?nfv8rWLX3}@Zr7ywt7*dBt>>+<mAwU-q
zTW%Oy6mzLes*R~&BjJt+v?;1{kRR6Nk=Hg{RICV4oDkps(H9!6bjdby$UQOS>s8j{
zECd^^n+=&D7GQX}^=R+53Z(O<aiUI<lZWXh@dtgv_IBfwy9!tTbt4a5H2T2T$(y#^
z4=p}H3>&YP)1u!N{cnohqji6H?^5w84~s9Wa1JhupMLjr`10BBAAh@B{GVZi?Edu2
zqm#$O<8NO+e(~+mli{luPl7U4A6y;aMj%I>JU@E)ID&w~VmV0q!B*f!`P07_{beyA
z7?AYsC#PS9nFZYW$F6M7(AI?=Img!JG-?<?e%<o(mKVMs*6P;STk3!N<$Y=qQKJ#s
zLw>B5uf*4DS%xg29mnov+0ONrG9&ofl03eMf_tex9ptug5zDgD9n{JeU^*&rOY3ns
ze8NtiNI_P+9bFQje#kT#pw3ZrmQftK5#pjIp?*`6aQKUxy}dpjyP%i(Vt3w%s=NDJ
zQ|Jgy@|%P5w;o?Je<Xj(f|tnTc$4XVSDI0I9o4pTN}ZG&gYt%A=ETKJDlm3`Zp3t<
zAG@meZ!C{3tK)v6-C{XP?F;EX@N~SIuE`f$zGUgV3A!5o)SN-F+=jl^cJ&>^M-~7#
zS#mYe?blj+p^=g8;gQ1Jz)fc`V9B1?t{CUNe7|Cx+<${&yt983^>-~tiJje~rnBVj
zcrXOZTCx`3__C?t!BC{Ec{rUedkQM8H)I1+s+wbOzyd!kMn4UAAO6N3843(DSJ|>+
zCUOR|jI6(vBN+I$&3jEMx#ZY$@H5?BVVZBZss2AGPT~TfOY|I|SPH<iaeG+RVbbcX
zRvJ<wbZ*iJ1U7$Ny*UPiePR?H>@l3{vkHFDx}Eu6a&auq8SXWvPyZB}&nQh=k`WvY
z{_e-Ut*4ugdtU~Bx8vS=^zp~N_4PxK`#-$n{=e68ACJWkKkgZ9DqF|$WFhn%8~f5w
zh^|2V6YMV(cOf}cQxg<kp1he&6O{MkmCRa|RUrC?IC_76oGi1=J(T92bp>e@8rwv1
zBCS&gisw*%lFuZ0TK)9tPe}!yy5-f0lw@uaGF#xeqIZcH|3c4fTdD8)`0e`Q0_me+
zIC|m8oeM#mrkL{Im=d_12JRK}&!ocfPUo2SE&9fGx3r-Y2;Y$WEB_=+eByP^J~oMN
zfhseGD>#1+n4hQ3yc{=q#*sgyC7aA^0Mc;Ao>$E?s=Oduk*d9NSB(v+bx1NwG)@Ad
zm_q3bXY09D2Bw)3=?t0c$KLDR35$<T7H~gJlBN8_swhr``QSOq_r}e%*n4vFd|xT*
zZVQ!VxNZq<rYCM2W2w%$bLZVnqf*$%FC2S7qiBEM*`=PB4+8^VP~4?KmT7JspJZ%g
zu)S(TM@A}qHagp)dtVuOlEy6Lm0@Ab05|SU^^#EJ3`x^%Qd81>ACIFj^8{NEL{ZGX
zaFOMUAnk74X68gGr}gSu>+;>%yYV*Hw-RkXl0w<-Va5tj@Fk(vJrt<?j9Y5|P|Sfa
zYYcyYSXdvcRCdMfmQj)w*jUnVtqhyAtp`^4uUPu@x~|X9<tk5^Ag_a*4l;QBT7C^@
zRdLZQrY-wN$j%r(fc{S^`OQ9P4*g|#(G)L}Al1Z>)1_wm0jB-C>g)uOD`ND=^<!o1
z8{-*QS)ze$AgtSI5TsPg)>B-YWfiPE>U@9ITMZaXvNk2<hivXGYxpyK%)_o^If)_}
zUv$(aQl%4K%_Hg>N!#`^ELiu9;_2R2$=1t6TbQcq4McQuNO0}8Rr(WEdCij)ZnZdL
zy=}AV2aOg6r00!+lV#`5m)9}jOeA2tA;i-CJio+NY&QVqA?M%=Pv$il+B|s8NK1cG
z4BRUm%S0CC5|Ii20y@_xw4;bd3?4!f6QCb128fI_zT7I1Qf4tTg$l2A`V@u2EvjMC
z%nhw4gV!>)<Q0pFT^23XJhaeLTgd_=g2hR#>g_@(4HUqOn}MEt8X(c=2x|>hIhV*2
z76EZe#H$n5Y<();S$g<5`>hzjO5T5JJlhh7@=_TVWMYT26D-u&**TIV2U#Rp<rOP$
z*lG;5bRsgTwvvd4UXgsJ5;MUn3AV>XjgM+>kugo#Q8tNXb%|`0H?g`h!%p*|7w*6~
zjXL)EL$DZ`rYzqfdq;Y1AYtAD%|UvKJtuP#(<)oz#3Tb*A!tVEIe-VOxJZ8vlf{B1
z@=C}drNzl|!!d|-{gNPh3E;mc!G8RnX#LqN6((sj{Z-Gxwv!@@EV;!Z7*2lTgR1jQ
zP5+a%w1K3ug@W*+0+91KI{Sf5D<^GO?Fsmf`_!|*wD<ZZ9lUxQhJBc(j;Z?Hd0zEz
z03G$CEDkFkKYSI1^A^0T%tL=E&&E?mlG|I!{pZO$LP<~Y^WsDRGG`P1TijEBsAmfL
zgj#+X`r<VF8Y7XI;5YSb&@3+w_7zZg-W?%p=cZ8!4MfzdUAx=H;8=Pd&#*)|`g%9K
zAjWgUBVf;^aIg$8t*XN&T-Fe=oucb7bP<c;=y;op@&2%^ttd8hBTs+ou)Xm63Onn=
zcfu^}uWB+}H3zTt$?(aMMH$~DO;X>q12YIX7}=|(W9EC`<?ei_<4ddyLwTE|lysg&
zV#KL6WBu3r>n75d0#S3aB$8g%9d}h{2yFSmt}HylqvM~2yT(%_oRdJBgb$Kx^PPf|
ztb`9-PW(AQP+(4o=EQ%^e-`HU5|{<d#*nWtoKm_TFGycKrA*awgP<v?%kTNLf}>;Z
z+`}oVcilSKQep@EI_$qHSOd#SAb6O&70!fp8|klpF|>3stjjdT#Y*&1eP6Y5a!E<7
zu^6D(`;??Q7K^zBu#LX_wU4WAb=e+e4SH5rc`KSga*xoYCHH@@rK2#9HHt><2+r~h
zeeZ<!%H&RM%kS*RJK5@2mLDT4v2Kwkc+0Y8`teuZ{XEWQxGR}kxhjkbxT4$&`1PSr
zVz>}zR3u0;ctLe-QtC7!c666|f_);ZzF*t!lxUKq4K%S?S&zo*;1EL^I3iqlgS>0*
zo3gz&z9ro*ZVG>hy>t4AS%A5amCQhPDriv@-JpzEGz-`YP^5z3UjolhHWFkZWT5aS
z!U?OHii2(9)2O@Djpc4D-^pchsw9hQyREL@2kWXpiPC}gQf+7yI-5;X&9~~UDe2rG
zlWl@$@?P0?aoLe;^4x6#-lRV!5L;X+@7+i{J1UHQ<W7H8PU{m}1g1!O{ZQHQV#W80
z7ro+J$hSX*FaOu|v<{N$#riC$U?(u)Wi*~QSJje#+h7flvSlR!({7g`ot@><meiw8
zUTJ9KJ7RlD<r~&!8>XOoTc3eeK`1UY1l58f{B>BzRy!a#vvgjiW5b(;<zqtNz2hi<
z{XUebODumv7D3h5tq@l5X)dzfJ&*_bTxcp6V_w&HMrAb&O=Q@ys1epA;3ZrPbO?6w
z4Q<jN#hA8?@m~xT4<#e@PPeqk1Ab^PlIP_|;CVA%^N_-!VxFtCSFY^-SJL)BNz%6a
zKmf;^=I(w_!$~`H)o^}{WMJsbA9jrEX=p;;q%?o&RBHecriXmwGbxv(7A}jRvaBoR
z0u_!Aaf;ro8Il5}eVtLEE4W=Iau^7hZj(A)7gDCs-;yko#4@x}t%wmrJ4)mdrPM3b
zW&#zXFTkw1Wtl472L0>sE-ZA`&M`7YRFPs&KzFIXu87o!t3j#ktD8{aQ6(wAY{Q}I
zT@-(qMA3v4s#M%O6q%lqX1-14)4P;sP0aDZv+yi(0O05nUflTLO_>aSuqo;Zg;Adl
zh;SS)n;^@=k<slXNq>aK(m1mO1_nqM#bY=rFx_INO2A#GP*8kiJGBwiQx-?0<4Vxk
z)Kig2_hjs?QU{&es|FVX&$uyoVkUQv>SlkS#|dn^0be(;V^tmj`OVhbMDh&`KjVG(
z$<`bRW}lgGESN}$7`JFK%+yb<vn|i2sq0+C&m&?0z<yFoalEk~h^l9YnODMvR-TC-
zP!@vorUf34-(TPnp4EzW$q)Ax3&+g%MH?PDvGa`z@~dN&B&8Nu=${)~gIG;5y}o}`
zlt5kV*D<Go`3)u-|JVQZ{|;6iH4i$m3r~bTk5w!&i(3;zp|3kDw8GYHNnFqjDPrS?
zf0N8hypkz2s4mhZESiNuA3Ne9VK1fh?Tk_aNYL<p8LD*xTo}J~1CKRPoIiNsz1u&~
zU4sH>6c%2iz}J_;Y^iCfp39<$Qs#fjzzoNvIdGCRm9YGd$sX=&(+ex$;H17(d2M7a
zh>~M~0Y`5l`UA8Q<7V^Hu>DO-V^Vw;=%-(`zL<*$@`>~^d_(oj>BP~DaEhDdLkDEr
zONgH&^e-BG=nyycCg4xBGCmyj2Muk2jNXVaio0PLA=5m+^WME-FpP(|&~<-c80MtX
ztfP(XK*~9Y^u1vhMmq1vmllXjqj!RudUTwGct6fpCoY#YLf%RMZ33r=_ro^`c!Y4I
z>6%p=i7DC9JBPMtABkJIO=^MmPXCY(i$ikWXxivF_Vt1OxE@d7ji3rEQG8C|O_mXF
z>4!lE+hd(<D@i@$hbNd3j1qrF*oYfeu5z4h@!`16knU&05GLEV>5)j34I|`ZV~}O#
zWU{m%C<O&h_n;DX)Kc-CV20yqPywDL8SZKQx^hAfI*2}$(jyG6RZwqBJKj=Wy)T-}
zDPxUdF5d9QyF=bHw0rV8uPvG{y!lu0t3=`CSTSr?IJq4oKqP!uvGso)v?HAmPP~`;
z19y;ma5bF<q5YSGJH<(P9dmUrnnr;<3E8%&7Zu&3zboz>{EaM#;S5h%aupq4!%^<G
zT1?krPPSU^dWquY%aW*O(;L^Z58s*Ixeo%~lAa0pV1njgYHebk$WX<@KXgnX6nS6<
zEw#_XRpQOmY@xY&A+~=Fp)X|H@$PGZxdtDpI156<LDh;PW6Siv4@dLdkx(<Zdqf9W
zbB<3{I$(Fi?a2`$u1~gbDu~<7^3&J|ZrS7e!qkj{D4kz+h@T7-An5O+x}~b1>Vl=-
z;I*@ha@{&Nc1+1dssFUFyXA~aN`N1KU}300!)Hal+e&-WQqq4HU^hQF2`A*L+Rw|O
zUmdr!w$?3uW~Xix^)!L8{fLC~4I$xC_zy0k*nS9Vrt|5vxe)VtR)u*Qe-vl;EwR}3
z$uKI9A9KdVYmjJ0S!Hat%`}>0MeCK@cukJgd_Jv2=u202_99TV0af<fpb2zpDr9ai
zi6*Og)9sq#pHhEs+^~qeMCJQ&+oaw$;}?iYV~Nu-wR!6-H?=L-V~zF9X!_cR?@-As
zTOzH-6|86#$=(e|{k^-hHtE}b>SM>(BF1(97f;Ri0W4311ekvv`aJbK_HiQz@8>@q
zWU?INU|B!{(L_BMF8We(CcR^n4{;_L=4_i@k+CzB#c6+Nd)`9%4?}YFJkcsPibW9U
zC>J%0NpB(g0A(T0CMz=GrNVhEKz{gydovvW3{EubR(!AFJxMGt2JlX!mL7v<4~FsA
zPG$bADv8JnWhD*%l@}%4uo~B!Evgk$76smSj=QD|EhnP^yODWNh?ZlvVak=!b1f7Y
zD5{SOOD2D7n^5?C=y&NJ%(}k$?gwx6twyy(!QSE0D2sHmRQMN*W?GN0)rc4aJXGC5
zSeiT_XGY%_j7#ccmMMS>;b)wUXU!WXd^3K@rlM)Ro>NbZcQ;1&9kkoWj}w0L{Xv1E
zB;d#=Ea;Cl!!fOoCmPFh`-HG?lU4?~tre8Dav^`k9V#hel+9}**za<sIOiop8s+@8
z6j33bnnda5?1m%`1<CYn_;ji?_kPtY?%%!tS#M*{fmwWtf-y9e^1JH??2*YgSY1~F
zQsB`c4N`8mv_;<;>Rp+aM}NER6>}QNbY0uDlJHH_8bh$2Pc~hZ9k(mz6`!D%)*F<Q
zK_h=tw=KyU&XDo-MrC0-52d)ggRQWxCDzqU*Z#^F)HsZ6p%}pV?dYxBCARIZ7OI{j
zqlj>nu<O-rvzbWgp)Ju=rzm*8E?&=}zs1z+QyMAcJ=Kno3q71}uHf3E=Vkb$x>O@_
zPi@qmh6j5FQ2(eK)Y=vv5<e9dyhBMz&bxn_RXS9!j(c24^hLRERK{4mt5o=t$dGw*
zn&m|~*QyYSI;Xui;Frs$X3|4U09in$zjXzB)~qCB9gfhexnNqWkAVi(A*z^Ao&&7V
zVA>E*iOBJbb!ubfi->Lvj$C&YwZ3sAj|{HcwPk814t{y7EQ->pYQzZ7b4DEH69s0f
zr}b=q9`d7IVtm3@t6^*%`|V+ZUJ6l(qf2@0&wy~e)DcZ<NTRt<q2l_%C#3i+sxZTy
z44+P;->DsVh5t)=8@Ed<mN|_;;khYJqVr*<qu;KbkszD(Y?G(^o6K@pi@vXu3YC?@
z^rqR39cx~WNa1FPsS%o>5=QdbdL>q)onbhCwP>x?l7iE&iOztwYrLp!wcK95A5;q1
z8CW|r&BcSFGhQ~WdMCcs*ou9D)KIp9QzttU)^8ueV{WxVVwX(|O>Cgzsd`D!kAr9u
z*%g#%MsGPKa{=4*+QTfaRH*0G%Z15_hn;ojj?*Hcps6Zn?VUTy5`=S{<s@JyV<snm
zwq-r5R~p!;#0Mg<>?IwC3nT@Q0m(!511ud?nRU%!aNBCCYYa<d04xc*Z-WpR{@;RD
z7pw%hmWNM+@;h`$v##%5ye(uqkma&q-b5JidSciog3RGi@E47`H-q^}=2>smCrR^T
zK*oC0f#yT&-tCys3!P^UutNti9%L?ml{Q%qGN_7_s`A0TP~p;@J0gkRCK!tJw{Y63
zJ9h?!sL^~PtLQ|~G)2`?s@;x-IVhe4J+EhH*)%h2S_#xlCw<xvqQf^0$~0CKa&&H#
zZGJ3Ine=!zE&t4&7n;wf_w;3jG=*{+R4iQ)2P^$)f7lB*9Mww<XL7xiU*z(Cb41vH
zJF`WS$tAh(QF#FsHfd%ezsTipkbPclZw3PK)}`FAKSY7bQydGLl^HZO=?_Q5KF27d
z!V;TK7*CRf@-`{dr@9NrR<AfKSF35&PcjEZPlQ0Q3@v)FR?fyuk63wzBTWGr^EfcQ
zHNxF-Rxc;PMy{?aSRz&<+XGgAji??|x0N3qecgHlycgEy(sp<gWI%HP{UR)z36?LS
zJJYanSfM4Zt+3;y-pR5i&!|1*cD68SVhbjxhBy|5axQ}HgmZgQCt>cjNT1O0v!(E@
z@PrN;Y0!igrt$E%W>L=}$~d4J9u6&=TBG1P-TW5YAmN>tW@epLVL8Zu+q$k@9@$E~
zdeLBL&huld(T>XLJ+IE|m6odG`@6DBR4`#zU<P<CC<o)$qGAe>d1!-Mn;|@^w{VF{
z6F7q;5Vb5Wufw}1BFRO}hZpnSmRb)$qJp8k(3G~eIbZQak1dICv|5M+l25|W2Qla8
z;Opk#`8UrGkP>t7B6RG3;NdMPYct=Ok>40p1KC-i@K@7wBhLgQATTn+XqQ5hsQ}Ql
zoWfxWO@Z0lsYOk9W7q_eK6O=f(sfgddDU5VJzXnvQ|XG+dw<;Tx!%y@J`}g^^#STl
z^xu-ee@$JWd1Esy#Kh?>t~4jwozFkxiUwZjTPIeVocc%f%a)^mxXnLzZ|JuT%a*Ri
z%)@5|>4;rif$*s<RA@r}oABDR9Z*`Kkqk*%+VQ96%pu3>WtLcH>C50kq900^tG2ao
zs9t4Qjtn6q(%2P7R_4bt?1#sXl)eTIb&Q#UN1goJ6G82|q?U+A!b+~Js)8z984D+^
z8o~w%D3Yrn6{u=|a#wJ42y$|Mt*kcd*}{}eRAYo)x#}bBdetWae`nwJRQl;iS8p*h
z>W&YR1Y7D2vkOS^jtZ(}8LNoKOBAv1&6tW8dUCm5!6XVcS+JO3fRew9mft>yiK!>c
zO5@NuJ(mMwf|<=3e4S==lEjUp{{>ZQGm>qOuZ`x_;yTiQ+8B#tthD0^QD-%6W$G+0
z9K-4A#(|!)ce;c(x5~WopAGd#u-WvoKvk7ya{N*=Ibw{eTIwV1y2T1SXv6ukNZbB=
z$e;AK@}nXH;ej#4il#{>x8EOD<#KvGY{OZoP1keO+xY(D%^I0VUE2CnALntOcM4Y<
zi5*ISb}W;Bm}SomUQO<g`FY~%kW&(SIpH9WsM!s~%qpwvQZiPm{e`JiNxO+>Rjv)n
zaOzxEteK%kB!BnyvcvdkLifQrG-CSlrmZ+(RmtmHsIDJ5v-Z=^;QPf_Si=&3Hm?NR
z(#VFc^w<kK$2x9p8kv>Yb%wE^nH|cuEH;H|T@bW?su+7Mem<NO;m(CdV|^t&jg1{2
z9()uyXsP+II#9f=r<7Xyhf78$L?h~bI^k)dpM@VzrNIt6?8l^4FwrNnuxYvuBaCO)
z@?SlSiQ8`(F!WemRcA&@_fY{uENjz&WztR_{XSPsd!$@fgUN?aqGXb`Dd!6wqzb`h
zAit%53a=fXZo!JC6PElIRfeb0l`_3swu3mF!yQVByn)MOedhWJuirqeBC@3!EQk)H
zZ*Ld_-hiz#o<#0U!d79OQ;#=`NZwmQqf7=71%6@4jxSThW3vV0c^tIhSs6ZPTe|(%
zjg&;+wCKpoPU|>H3=@2yc{8Wzmz+Va7*E=Nj<pehf26;Y&zD6;&MDfGlv4!_^uoQT
z9p!L9w%>byJj|46*LBOygEv8cE|b?u`q}agw8g!z%JO8td+Pe>X0fkwc~*y|wY*OC
z+(f}um6r;xD!Z!Z4u~4ZN5k5BQqImMC5GwihtCV4^|p?+JS$ZIiQk!<Pp_)F!I~L=
z(fKD<-634vgk<2>FOHtQlq|B?#SI+_zz!C2+as`pjg`Y(K%)?y7~ndT#p+ckFD~fi
zdQ)wyi~!$y5={)7Fv#{<*aGa6)s7flw`&@R&#Z+-IcXFD=II;J(O070G%0O@=E=UP
zmxNd&XM)F5NntRr|9xHg4QV7*%nh7>GoHdGD>uGNVWV_KDi@&3w-mQai&7)L)4{nV
zEiEfKW6jf5e9hEyEzrXV8{Et?%x{VpB8y@Xj-Ppx*)<4hPFL3swTI`V!Lin`2DL4W
zgQI}aK}xTjI9tHJECYbxcNA`Q>*fxno+ziP?swt}bk*VL@4%U<mncbfjzuzm+mOzb
zLA`XZVNBIguYiJ3)UU(g3Zy0>`sBMobxC9!x><q(-^eC!99;dtB?B4SX@RICfQDbg
ztV`<xbA`HIiC*@uITlx2C87Rpi@8)92j3SFoPfir2nCH$XWQD5_gGHS$pbscB-rAG
zQME=QH=~tlJW@WY=4=vou4g8HaI9iTssnKIU2d;S;IJW`Zyi%5Tzz+t0$^+{g?e%t
z=`RTEYEVdFSe6qWw{Tiat0bUjwtK=4lT&9YhWLzDM>vODI||yJov)RciP6nv8iK%a
zOifI^?wZdR25nAq;xcKFNB2@mPtElf&VfcM>fzAN{1j&Tn~R+OQ{}0DShsofPt#;Q
zd_>2TMlbH%;oGJ#bQ2eN?lHDQ+$ZSH9e0i~?TxA_V};_QsfihdhQ)QIo@*8O7KtLU
z%+fr$933i2^~%*<`pLvZGvlBz$2rwRm|963Drq_?!X(<7qvQA<6bGiD$-C5%BO7@R
z5@Nej+!J-jXP8A<Yi?wJ1Ho;f%3=`lMrtgwY!w50;Ysb0vev;x9X(H-QKD~Owi*Cu
zxU8q*eDuWAHVI#%v%2ntw+{o%$t>xhC0C%le|E#fbbR11D$MXU-}91J_J?YS<f#H>
z8lW4#3^)F%TEUwQ=71n%FNej?iXkeC&v2}@5<2-ViwH@qFZ?`z|J8hFC;T7kq~Rb+
zddzpX`qqAwPtZjP0g^=0(2fS`ta9RC!xJYlgHRQ^Zl#unl0A&#ilu0HsK9}6l$(A3
zbOakTCt2v})Jep3N&wS8h0f^8WH5&PRa*J9)HAc5^Ft8|ndM%HKLV$Ae-612l^T=j
z-S5nL256tRoW!YrsjIDWA(a|mKrE_8Sn9ejaV)d<W5WEKmS2$;u6vLpT(Fvf=fP~9
zguOr8+3|ngJlma#E%r)FHWy=KTAxwl?e3Gh4M$RJU;VpiP|eSzQKTI#V==mbjDEFV
z;yxVRHu;}2hWKI)>g?>q@Q#;)%MXKa@Exc-VqPI$SwWM37b|g#5Gs^NLAhY5ks~Vy
zvwb_MyeK6j1@N-H=ydC!!!t91le*KaI@)<CecfcG-DM0?q$zXuarUFi;?SRIXr%84
zy6XUmt?7A!7{XSJN?1l9eAb;rj<mjJ{4w|Js*=ckn2fN>n#4b-Wi^nUS7j}_pUOr+
zZz|&7B#HiiNL{ymK^;?tG*?7X{uV)r>jT~CnyzOq2b`yd6_W=1lO&8R6I%{Ce$9qm
zoM#bPx%?pI4?0^mC8HLJJJS<C%I#U!Jrc+yDIquwW8F+xFhAc4=4EvYqEYMU+-{Y>
zg_T7yl%-4Dpj>XoLJ7+oQ!i&dgvrI6$Q{hN7kvVM2aBv|UC;L@y*!O80X&iXAjM}R
z@BGb$v{#~S>$3J$oG0*m4ymIRaFM2V5XNlFqUNgQ(nDw(k|ldP62~q%%P@YXVH&aW
z6g{RD|3vtA*nm)<TZNKf!dW$Lv{cv#mChwgHZCjo#N4zVX|XYp0x3z`m*xkozoZb)
zgP7reMQ8OqJN~%jERGl57oNK7nM)T`7HU=v(v`5nhKSBH^E^BJjVC{4AH-0pr$}s^
zSgDr@=M~Kuo#%MXQY&vj8QM4Jq~XkCShG{l*1Vr~_F#HqiivTYw2@v-y3>k!w3%g{
zxYk$Aq`dY7C=7o#SY=F4(#0=1uRe8qE0~^ts}9h@)unr-qlXfK#TjfqgubKwu)ky2
zkYzoi{~xXsS<b<51!KTo60__v-Zlq(znC6gbeLr7q*y(Y`@Ag$D~`fhHAd+K3jpuj
zd6=zxTWLU{d^KmqQ<CK@OWs9+uFjJFm(cNKJqNpt?(6id-|rP$U}50>Ij;e+WQ&}C
z6({Wn5S{gs5bHaOhkH3YSo<TCe{d|HZat_lmM0%{fb2!W-T#b$9M8Xb{wYuwKQxpF
z{KB8ukB7HD@xdPoK4f1cm)4G&_ZR@HGfnj6LOnX}GrupV`NTp!jwcpMV8>y@e?svq
z%k3S+!V1r<8adeuNM4$ie?lh1u?dBLAZPYq_8uMgilaIFY>Rr_3yO7f0Sb(#HBO1C
zrwZ+>zL{0mitg?8yFKUztrYcMu*%tE$shh<MnEWAoz}tD1Q875_peUIYI<^9XzKa9
z3aWb_S5K`)W7BTs_s4`LyVa6+?j)66i1=X^FY5({;vqn^k>LT2wOOy+;z<vG7NqXH
zw?Zd*Anl7J2jd6@@>F&>N0Tj$JhH>lE!$`6K5>^fPywXo_tAR%`bkhK(&KDfCFH%K
zr?ae(X8`x=!6ZC94G(*I0?RGoN(!5x6tdvTI};W~I0)zMQ1cU$Gz3fh?pq6eX@N-+
z!IpvEu)Rq5v-`v3hK;q5tG=gyvu2Jl-rm&bL%lp)l<kToh39LG)i4N~jRWyn;({Rd
z4bj?}z<rviEn9){{Bwgc)cRjG-4TubG!CB6TjF6)?YE@(2NAF~m_I@NLL(HW)9XWu
z2x5{v{8-5s=clZJsH&MFluj%QN}<#?AV<O+=9bmAcmHyTdxm~bwhM@VT3{>n(^jWQ
z2DI_$OSX`zZ@hJKhSV7w&z>>3oILt{yN&zV#mW7l5>p+7qfGv}MIYI6yXqePi1yLX
z=q-;d!?pY!v~=St$*ef;aC+o^_>C!j{lvYA>U{}}z^X%3j&|5sYFgy!E$wxcSV69z
zHWx6o?BDyAdUO@-rFCL|BZwIhbNd;Cu+T3<fQp@%7JOVuQtqU&LYK6%K%*2z75;BL
zq1E*c_W=~2@XV`Yq`^;(5Qy$2Ev;fXY&nHVxCKPDPH`hVuSD#)Rl)2(1a+=L?`qgh
zkVN+eOvsCAB{3>tnOEYPIF~w5{RZ^>{=o9D=L{XS<+(BrU5Z$LVuqcvvc`cd&$P0}
zofjOPypr^2etlJ5dxAGIYk>*td|~5YX0SFjuXvGag7X4vft=D75=1Du9U>jv>Z2s$
zHosQVQhH*EeI1!$b`~<m5p1?#=$e21_p}HpMX{I6)K4m0vPU<-i7nkV3%$AFmw^y@
zIl+72JN0E9>>+)B8kLco7_Qa}(_SN_VkZX3yC1)NqE)jrA2pqxF(s=tWi^d+BuI&8
z<W)~G>C)P}`wmXzTq5P$x;^Y-_{#Q@TJIdsmr%NTMWB1~k{9MF-%4_q!|nKy_rBEZ
z$Z&@xO7i!|8`bO5)^s8XCgFZ}T=(@BZP{+w-vN_IXh|4<qFnFeqmqp1zww>V&JZw2
z)3sC0<yMnk=DXtM9I^;l-0A844iw;%#HJCaz%4a%_y+tGR?kMB8J54Txw<*n$Sw2L
z#k?|l)Ts@)nh;A6wVt+@;Y1OKS6qPHAw5h(FCCM-JxRWECyYd>vA+^0EcED1Bk4&m
zRI1d=7>cle6SiG1{V`D;ST)u`NKTjL&W=w*4o2Jo`bFJD7ZTYR?U4Gt;f~#eN|ybo
znP{kp9V^UUFQfKpSN-bzTx$h|)?m!gLE<mn0C3Slu@;f)1dUbm4y5P7K%BD3IR!n|
z3|JNM>W$1&eiLtU8qkwM^DWdJ)-tk$SdY|GFckiOOF+%Ti`Igepu8!Q9YP*dD=+0B
z{_^cs>pK5a13KH@Bu>J-IASVw@#g;EZt<iZhZ(pLoZFub19|%4!f6ZUr6eNe70gQm
z?`+p+PQ@`Op7LB*vP-jL=M^$t5b-5+!>ZNd49{K^@XxB7#3bx{HUbaP3!)I%FPb3f
zX4m$AQC876<lRG0(cyq^Z%NS!Hjkz_9T_CpR}o?HCU~$mttcK8U-G=QI=@XkKoki}
zme|>Kk-W1f#D&3Xs^_nJDhbEUnuY@MQJR>SE2r|OAco<&_f=iso}kNL+|cl6!LA4c
zG6b4Wr)6lm)tr`FPWaA}n-7F2yTwPt3Y`akQ6kMs7G2We&xTBv^A`t&J@O8G@MzpR
ztNQX}HR-c_r7!wJU+)e-+sW1syENztK~P#6Azz&Bx9{oJIF+EOR2pYd%Nq(v_GwK?
z^)mB!749S~4Y9(-1V|F=J^{!H`uq2Ti&HKQ*2b1o<%QNTr0k+_T+S;YTydrR1Gj#E
zy6J@!@^-h0RMys!7b=!@E5?k}F4e6|UCOMpsxX>kuW*#gPJyh6iT2q@xB9{I<e9uK
z6LC_${0>0V#F*%Q84A`&2|%3Nt(t7HJCt1GQjeU3F#x4R7ZRS1`L@uOFUmh#0-Hk#
zz>VtZ(r9D23t6On*`l@3Ngv~4IVNs@s_rDGX`15jp~jZ~xZUd7(xgcLTd7pfAbD||
zCfD8*`&-2|z;fxfNk0^c0OTXoI(Y-!`Y%NMe-=di!2pmsuc#AZyC>BxOxjcM<DR9W
zmKlz+rGaVcSEk>38k{fi_vojLX-gXUsyK~B1{9SWW~2cwYr>-HheTKwZ*78qmiS4)
ziu+7x+Wbs~?y+*2l>OZDdzE!46@<<<D(KybSX3YaOo60g09)Sk@rRN2%dmHbC@7hP
z&h;W-6TW{QMEZr{HYcdqlK3W)XcJcYgW#kS@tZyTkCwll^iBx|4Y3CI<}yi!@P*WN
z>VaP!x1Wgl8I|UE`c0t&i)nR#3e#{~gyF%E8MN~igf%#Xvxddqk{0zPhPSC{*tph<
zEAkb<_`YIaborm!ni2r`@R0{hO8cnjBVi3CfSD8v4T_rvSn&wIcTASqs*^fJXitHo
z?d*`j$5$C}ZZu<BwPLs+;Xb0$Dh=#=$&Qx;X<4g?ya^)TiW;N|Bx?D8Thac6sLDa}
zK*HsqIGRf_fG0533FYaJf)rprnYIudr0~6`SKY7wco>91!eWBb5UD6r|5M@({@6EM
zm17<I{ym`v{D_zACKL%VUta2@v*dQYKTGM0p!!t9eqg0QLO(x_2BW}u3CIy-OPXWM
z^ipLcH!45%>ar-TJCJgJ8k*9)XVT-wg5AWE3Wr;}ig?b<Ej@UD?JlqsN28I9;SS%p
zFw<iu*(n5ZMteIu|DFE{Gh58Ahm2zn@yp(<y$B5z;eUXzS?!(gep7`P_KLrRD}TfK
z$ewH~;E{G8&6*sX&v_|4i4OQX!@u|9{b@tHFPCBc)#W_AE_~5{jwcwh5X{D1^o{6h
z{n!nN)HF4!whY~sBpJ%U{k?}w$BPe?^<0PPeWMhlvc)o@)k*S)QVVtyXL~%*5YMb7
zjn*-&C2Ln45p=DIhn)Zs;<x9o<`;;K*=vE|nAXx?G>PZWX*fcEP`$?z&5zy}rdL3H
z+}IsQ@gn07d(r=Yr@^M&Nk=?qes<E+84Cr+R&I4JC`gLxqu=fUNz~+99YKt;u?$?m
zpEoIGHiysVqPOArPD3L$GrdUBrcL#{O1LoZ7PK0a6#6^T0=hl@`eo|l-DlDJ<5av+
zw7F+0zV=OBS~Xd&7lyU?zWCXHp=JN$(Xwq5{1;sI4*{2d{Z*5L=CG!eMq5pCZR!UC
ze`4|Pt)72L{<N9yb%T;&Ue?o<LN}e-ad>X1ikW+Vt9=-{N-JLMqA?YkJjQd2`?nLd
z7PF_={gG_T-QEYE0jl=(P3=pRx?3>U`Vaav2>K;6);3OujbY*$(HNvlf^M{@tAHNZ
zlW^_`_VxXLyZ0aLZ@5(7#}(y{WBT*t-Wy!3DPL6IdWpnSTNTC669N14;sw`4TYORc
zYH;^o+Jq4EgC4p!xc8uy1-xGLgV>zl2$4x_6*JZ#0eeCrXHnf{bpg{9xMJ0LSelm~
zwAHrfy+Xl2svA9+LFClu*M~Gv84{K=G1-X;v|%`ZLbRAqSsqGz0^aeoOls$<N|2Vk
zOGezI)*fr5^c>QVx8J%6%;UzTxD$3_@I7oX7!Vpu?tXw$N@zO4J90nhXz|3e_`Bps
zr4RPDruc;6k&_;EfamKetH&ZTn!&vs7L2cP8~4)JgqI>{l<9?Vn@Fx3f{@}z>A2ta
zK3b`Nle+MO-(7wo|JvBPU-D<kDRJ?M3I~lO2^7$$1e+4@A<+;LMw3%4g|U}l>r(p|
z5|Mp%V0JR09Qh<pREmz*R@KZvc=(Rmx$Fe`5oWjMA`9e8BhY1zzzU7VN67$jJB$Tg
zOg_(tP_S`<rUD6Oj8&=ci!uF8)e_5W&uQj=a0+Az4q6*%`fs|_dOv^*SuyD)+#WNc
zwq<+}3>eu)&=ro3CF=+q-T>u;(MTOMWy%xNI!G{lkSpA#sVR_+RQDzPU}@rUuW*N^
zlU3pMVq3`(%9JB2Q2L2E6(pM=>WM42g~Un;UbK#2CO6SzoZifjktCac7*)nUoP%P2
zLzDdo5{j7AVpp@H{XM)CcB*H@6rE=^_oJI?r(BTc%Hh0NS+&|aX%>jpMw@wI$-Df{
zmI=RCi7eq*Bt!zaRq8e42@(d_q~u+#imOutO^H#-n@Sh$xD<E1SD<Ef(o#B)RFew<
zPLL{keTin5O7dy$p$-2e8l%cCmi8}y7c*L}LTd)9vgZ8U$#5gok3kD5<f5)a6+VJ^
zHnVt;TFt_m(2vnD7Jnv%&6F@d1`jm{J+16ahyI=Qofi%BYOfnCu8rOs@kXN1C|KFG
zCBaLoKY<bOfcQiw!R})+*JRl&%s`$k!f0bMtl}<c($Q_)t&tN1HUc{8S<?G|NFK6j
zMQ#Qw02gvM=7WcIp-X~PWmpfwR)$y2tFfk-d*`t9DoI_Q^K9oN9(9IUHu>gghkvSX
zJyF}^!<fHgGFK}9OcYDzG6ssPlx;WD8?wLEJAsYDBjEANCwk^2%5DZ!9CZh2ARNlK
z1qVP25hH@s&Zabw0L#T1bPBD1!K0*l17<gBw3$wjeL=3W`fgDi5P+m5D}x&frINbw
z)JKu#gPQv*NyZmkqEE@iU+R;cwB0-{Uz*?Kx!chTVHO3eD!U`YA!s%3t6)BHlp8@g
z2=_Qr1Ld&bdCXfirpoDzwI#&fwt^nKZYBu-Nbk*y^#=*<su!PRnSu^~{*leQ2wEYT
zu2%-KGQLy*d+cn>QUxYk7^E2E`B@t2ZWH7}5TSFco(pJ>>rp8HNlrhXM8*wv>OI*v
zGMAm48+rEjwp4Y!9~F3;Y3e$)NtSv-fRksZs`yNB68x0wtN|unQT}NDGi-?l<w#*i
zp9#jn(eq;uJ=V)fA7S2q>r6}RV4h@>xVD@H1>dj)4Dm%ra5tpkiM-TAggkNmzmnDe
zH%V6iswQ~*R=kNHA!~i-hsj!3ybal721<`vN!fbHn^e(bw<0F>Y(ckx!F%csWi7}L
zod|z;cv#QRP4Xvlo~Z;ud#_dm;5GPWVbEzLoluyXLK6<?Vmr5gV{1*CKSRQAAd>-n
zyj(>f(>Ogklw3A;)tkgfNKKuwh8XVb7H;Zv!%gAW9Bh2GVQ4Zv11KyiOPMj=_ik)J
z*zKN3aUH!8G90^fDg(z8?&*n~k5tQy@JDI3AQ(8AI^^l--87*h$A_7S<iu`iBTTMM
z%pdgh3gasJb#fkmqMLEjvr}_r%q-_gVCz_{vNT-PlXQnjye$BoiTqC#W`h+^(Z_TC
zrOweGEAGOCYEOC62H_e{Yu!qR;<<m~=qm~Ok}EOq#6mpzw<n3xvhA)PD~t4p%&!y;
zi|W;XiqzBrJ@-Oxe(r#v4(4onx1Py}6rP%atQzCW<NBq4vHJ}EgsNjpMa`4hele8H
zh<2kBlAV>jd~-3Knl}K(c~I0PC`qIX<=OD}{BkJQ^OSyx&f|!~kXXaigQta4#<dxo
zJcPHFH~7IdC_3j;0#w#jWX6E}m<Z-$s|-X_QlXn?;&4Y|0z&#=^zN|4Gei92vmblp
zK438a1M66S)B~Dl>S_EYHD(B@xvVclx9EUHb`T+h?9)7u4w@lAfh)~+zXG9HXm;LL
zkguQ-Q-|oKVs-wj`C#Wr4hPS?{EC=*&BB-IIU+$)wK>p)OA~yiIoKlZV4Hk2y$V@W
z3b3fWn_T7Hv@SB_FEtsYzs1_2Z&ZS6&8(trtdk*ssHZF4gcCtn4-*Z>1<fsHsD@C$
zJ7JT%i%58a6irRANF`*S9CCZr;9^iLg5(f;b+KM)Xn-lPFibd9|Lgzy{}Rq7TsDl>
zM_bT<c6J_B?E(pxN^=r>Bl{>*eo(oTrLT;MeN1MPXu}FNZAv+{&LEgKvy~Dt@bJm8
zX6QP9J1seONqJ(qt)lcDg#SD#&mb%u0UT<zC5?zV_i^s2@9BT~59Xpb$U<G&6LCut
zJ%h;a#$lQ;edv+30xDKiRGghoT|{qycafm{zRS*cBVyCy_e(JOx0V6tV8-vO?{zav
zzO0N|x!6tbw~`na42CayS^)tQ&g@pXP?xWNMIi4UsUE(&)gBNOXg#b`*)d5%&t}s`
zYcdf(rMRL#bcCZ)yD`G?k__>)Ie8HTzkRZ<%*IYoSA?lml;yDLe&)_-hfcLKdKPPe
z+bUJ9S>3Ugajja9j;+Gz>u<ds3xE=Z-ieIW_vo*L07@FJ)6BLli1erMZ%s)te4adi
z7d`f$(TAMH#)rm#9W-OPsE-YG_%$XCZ<C0;Xa~|IU;r*WT?ac)8+pC|L<mpGfWqEN
ziFJVO;`9Cn321MEMls3K@zi@1CQ4zXV9YtFtQj*_T&b>sNSBNBp`4RVl1ny-+G?gI
z(8j~CAG#cdlFD*Y%QpD%LSvSVezeAav~#M0Onuwi-uKJ!@9DHWYc_zgF6vc3u}ed9
zZP=8c&YfPzV6b^Y)vP;pZ{Q{})k3HRgNZ}sV&@dK+40ygMAq(7dw|u{x7+$8oKP)?
zgu$on>e}mQ-@iEJqCVr9aT2{h^?Zs?$+p0<F;4ibAor@gmONt#qu?x0yfSHj3`LR3
zbNUMLb*A!_W6f7!>nomzkQiAhn38X9Jq&8EFcSZ27oF%$^e%`_GbKM!wGdtkk#yca
zctyhKB_WN6DfrcgM>dkdMo^>E$}`gA(%}SdWpmS;x7uwMKa_rSFxfotV2+KlON&0}
zq_L+N9Ci<X{YJA`f95y`PQ$H#-`jV7rR+iRTx`1t>rs)=AbL)6tJ#%nY6t2JX$5KO
zopEvbBp5Is@Y1ZXEPth3O5b=>eXzbUot@;3Uw(KHwfCV~tgHvgSm6&J4%P?sKY2#_
zUYr=6M7F&055H-Z$(KJ#!{=@r?oF$Ua(t~Z_AMcH(mC-SiCE98D;0HrWHEztwwnJC
zwt>LGC9|GwzU{NWt-tAzylc1WfgE#Se%65|$(P~J;+WwCer{%mV52+DQxsuG#Gloq
zxK9#c2ZXR4dJ`LMW`8O*H=$cXZ%>jKQ$kIZ0%qz54YoD3tY*!sQg#P?sGnR)ZC1v*
zKpx<}4Vd;R#>xCTBis#t?E|rj3Mk<FV`+eHH1l8};dbt+e8#V9zT-D~sPMJS9E?JA
zx(10fV{kz+5QTUKLm{bK>sj#3zSlnp>Xm3CUMQoPGxgj?#4;X1El^z|h5bC(7gxb>
zFd%eP%EC)iO*TIfei>-03|7-FQ3i4UAk%&Zd3NjR8OoYeMfpH~yh;FKZcMBo*wA>o
zSDZc+_KxD!yk4bCgGO-jEd7JYihBIG*sIU!oN>EYnLy+iygT^3NE=53vc2B*=wSPr
z{tQ9*W|A}2S*3fFzrlP%x;^s<V!TBRsL|7Bj~;&^&5kI$;7Q@?luP{D5lV|YPnI@O
zw*G`~+L945S4!Z2#TbH-6ouvV&C8e1J5OmWia~KaS*({+`w&~aJHlwzUYaF_VIsoN
zSIlGNGPD5_6!2!=hYJ!0JTx%vo@CW(9}l#7Nsi7oSa)MdXv$K~Y<Z`oW<SiAhA(>M
zTcxd6^vcJVXcdyb#`j4&^zu3Aj-WyLO_9M+l__Kvz$W*9ycREj=Kkm7^vVHE+`MuS
zAEBE{g{D-X&ALT|KFN8;ZjubdDPLc{t%bHO>#Bbn36P|QU?pzlWb76}s}Ezd^Q~i^
z=9}1g{Um51CCDmTG;R=Dc~Z~UZ$-Vd?5U##G6IF!!V=jy8>nOGW4cKS!fm8f?lDlX
zS_!!%>JAWpQGruNq|{eR{}G;A(hc5LNk}{NmXiqP*7>zD@!5$Woym&CGOV8^-&GcW
zTF*eO3kd)_{p94Eo<=!3L7ZyYtW_^7ZL2_J#Wax9(XF<<9O<SGOTi>+1Q`B&815Ll
zph<Ox`~=1uO8pd9g>ZfeD?N}hD&b32K11{5ith1$ZyvSU+4;J$CHbAU4b7t1JJ46{
zD_QOufgI8%O3*#DQ0)G^_!e4O(zRVC@J)=&DSYEWP~3*8LV+N0Q2UO~Ar#n<upl9&
z23WYl@4BewO#4m0TMHV{=#~b*vMLI3|9Se2!<fD)r|U|9Or_PYQ5A3~(7r~m$)f=!
zvbffN*#U?h2}jvHVLFu&>xrjANq*<3DVav*(0QYMr(1o^65Gl3yqqZxhdb2eg?#xS
z^z&tT(Z&vz?$=tC7fF^&c3^V&rqt_0Pnfh67U^vg9|}BkhpE*V-GT&fCY9^B|N7m_
z@O&^V!soSZ#0J*tPNpgFUC7)n^;W5>YfRjKu$w$eClgk(S#HA|)p4wW!sfinPf|Gq
zGy=J8BEz<g<seclz7x;VoujWGfBSOy^4aenfBVJmZ=_@8S=hk8-QD@}=;ZP6_}iC{
zUwnJ?WccdElW+%Rq@Nk#xCr;LggZ!INM580VGMAz9DjTKa(MFa#qsl(SvO)g$28%8
zR(9lQiXMv(6$TnIiC{L#97qwam|LfuZ&C0&BH~v-O;HNMp$W_`Gz)VOkWsRnS*&5>
zvx^xLQG(VFa%1Eun`;DPp<Pc7PM;w!QcU|U3PTHXj0ZAK&Z=d81v%N2L@?}*T9~1x
z5TOzV8^JCKX36Zj@5n~>lEK^SKaci*Z3#0?+#+wGMSc@LMe{eU2F7WK>T_{uy2mMK
znQvH0CyITt9%uDiV>}&S+U^yW>qGzuzpdAtbM+g+v1kE?0}cm!CIe)%%C>Y}g4<&R
zf5C_^8^!wNQLz_hlGpk_b=aki+p=r5X^#F|B(<JY=OxNi@ydPguY)xuh0{TQGtoez
z`4e~obX9@da<=9Vwj^vci^d_CkbMuW5LLqAXu*7?_q6LXKCANt)ko^HO3Yrp`bn`V
zHfXY>@@wVcXaRHAeHQgB0&$iX7insyG;q7+uvmyy#Ij5d8Dw(X_hly6Ol6Y-11bJ*
z93V{SzlAp203TSfZ9||)qIwj62;D4`KZG)1rrdtaAm!<8BLO2~lJ?ZIDO9^;6+f0&
zxZ3|I{&^by&$nUk{BdN&X>wa!E%iiiPZkxHswhikvbC}kM_z68of|#4@ns_I_=SR6
zf0}*~W#5eje7E%0ez;XVDo05c7_`{*1nyLT5plv@`cYA~h~0)c=#Nu>M*z-3F6g{f
zQLwdEzIwYLT->5YZRuqbRCn8ua_SQ)7wcnm5N^udE(f~VdFAThH$HN|?cQf>*Y=K*
zob_V7h=%Cm82h7K16*mPkO}Je_0!&Rpt<+1Ov4x@XX+?F_-gJFO|^(hgOGO0=J?l>
zXWtgzRcFOZUQ&vB9`J2{=V(ukEh=g+ySude8yCh75*D~=w9Z(&ZEB;b_0YT=EB|9e
zLvdvBZ#fa`4n~I6jfyQM<W%D8>0lRuL>u9|RH4pOM)R#DOnM5Me8WSzw&q_@F3)OJ
zNcjmEwqT3us+`#Bv{mCHAu3NtM^tf|VRx}p%oT`?8u_*mhaT{MgsE1JRk_eYO2Pw6
zk)-UGDE7j>tc72N-YBDo@A{P}K3fiN=!%%Yl8CY(2?mdhOb$TsT2NDY&w~O=8Dvg7
z8}n`U^1N#>+flwnnhgBd;yyRUiEq7k_wL=!x1`u0CPg-~0>jPA>xAROC0Eidx*t-1
za4m28R9|pCw8w9M6-I9cAMmkQQLO<0GS60X{5=6aK9QzFn9nf+6h?~0cSTa9WYF;f
z=1JX!(5qk!WCvJ@N5=XlHBpml+HRI5n1=vEn$!`iI^T1rv(<9%#m=WxlJ5vTDNhhr
z`6L_zt)y<Za_l$fnG0C?kPYdH!L%eOtd!mQWpI(o?C<P<JQR#lT9l`nj2RkB$AKMv
z2hWrY(S8xhBAqSo&yZ>PU*NMsa0D*UgiTLb^m@gks#=7D{<RV8;eoxct02VcFe1SQ
z|MwnSd;t&2vKI~swX*SwuyY<tY%DzGfl^h~9A#jf56uZjgJz_Q)$sVzK?$-0h@%d{
z7;c{6U@WJ9t<p`%>+<FY5#2xr^8LZ}bZ5x1Ao-1YJS;1Sn`DCWo(S9rDXI-w#s&Z!
zfzvIMPtj$nKW8&DK-acD`04VvAU^W-L7F=}mn;QU^C6?83}2F1yuXTrvt=@Trpi_*
z0IKtI@}zx5LzRtlI*j#(sF)MFJL@?UB=^Rb@O4RlDs>R;E9|3UwCprFDo}|vAtvNv
zQI$(~_E|R%WF(MyiFL+OjD!>?A4{=1CHW*AG+;<Uet*1E-tS0clFcP06<9v)6+P;I
zIk;0ip9TSS*&z4x5Qae&Ou);=Jp@h}xwW71Jm2kp@oxO$aF&-GwHv>uM=or0z4Bte
zoRkZHI;EM%>VTZZZgYOVtIothap&M~riuCc08w;_e^3XYzo*nU3VIP&lmu?mS$2Rg
zne6yQH6a2PQvg8h5?a_+rL^im0-KNOU<|a65n4_z_{ZU6?YQ1p^YLgH1c8Oco;cFu
z4w{wM^ml2SEtW(O;3Jsuy<#*AGJicAiJTvQp)6kijVM+#^X)W(@C#}Qo_VXc!Q7vf
zZ%6o!qj@n3b1*W8F4Rr`tO!vN<wX#1VF|5+d5y&Jy5)^NM4R(qPVQE{#o;56*tlmO
z^l)0PCzV2*o9`g$%v6l*(4mUHO!jv3HTs6LYj4BfAO`@xT27Oq>9-Z#{|Cj_&tLX`
zKbKuD5>B7?@eppsbO>$>FA>td5FQN*QzLVl;2UN`iuyz3X~*$ulK~5J&=px^eB-t;
z$$BXM)ND^d3|6Z)Uu4q20I9T_ZN?*dgLlgh>_PF}rJRWdgRHyTia6?(!{!333M^t0
zeA0!=%1rn%MUc1luKbV?*SH<w#h$Kzg7Blx(VkBdUdCzC`NmDDauEL9IPHu3gU|Wk
zg8^wSj=no7zN~^w8NcqnOLT$ohba%?pQ=!#qlhw)HPV+#&mI>m2w5UDDOhMybB#*1
zrv#z(WPs)hsDH7X)-7GGxA@<_tdnxO&%vJ?>>|Z+B7Eo}qyHTC5g01RL>3f(k~93f
zkALe{;$Xq3w8ISxU=^C1S!OUoa?@$Kki`4lmwMxFFe=|#x5tiYL)BOKO6_|H4aIsy
zo5#%~^{Q;W)_@+Xi;Jn4d^kEq_Jz%NU=NH4$ymSj0Ix`T@MXLeyn=YpwA`IkUIE>r
z9zH%TA6ti4OgcE^q8Iam1DSPywu+v`gCuQC%DYojM18<;ey}m2gHCQXG;55=7CbUT
z>{x|6#IFd%kc9R*m>_Hh>*}KofasV2@imM|xN2Z~2nt!;j%B1w6#My2?$LMCl6k;F
zt|lQQ)Cj0H%I$pT&hZ@NY8J7)bEoJR-w~f%lg{LEx6Yy$mJ6Oud>0*m%1JA)S_m7P
ze}g7>z0!xrJy&cCAcbiwPbx*TM0Kn1WMm(djB|KYu@aLhl}Ls<QrGkP-`5BU&#Lr8
zGFEOc`=(Yor{e(i5D3#rHIT?sGE=oMhNbjB=0!}jbP}qQDsft&YuIg(GEd$vZLPH8
zVs1*f=4VsBWUEvXW<-yFhS<(Nf*hz}p%^EEu-#pyjppuPB+TA!%`GDz!|mGYZbs4Y
zLMp83P-4BuHHWdM;lXxI<YHdpvgOvIXRlmdtY<L=9sMRqLz9jS%bbW-H!G8xR<)|7
zBOImaHPdEfI7Vt(tkz4I%JM!z+%yT#Bb0)0!c53qMwQ-a33Sna;nlV*t(35*A}{ew
z80ockWYv1rSzE!=R|sCodn8R6m5{6KN&3%hBPW=S$(~MFHmb8?B8kzS3ouB!(p4I^
zP}%c%-mtc#LZK@hXw=MfNYp6BUqL7IeJ&uci#>T4T*L7?KhUs;U+6HmFsYM1Z9byC
zWY@w~?e2-(Ab?bV%xo->PEaQ-Bz&J*N705liW~fY{a^oY#2XW(AV+(yTl0?_y6U&Y
zhDe-Md$QF^!Jb6A!aTktEzF7wtY%4S_^3v`7fF|Tq9_n_s}AB0zGGBlB5f2hznl{2
zsa>D-tpg-W5!lflwSs0D#-m($L`q2&kR!XQTFX4q0p=}#uDVS0M7O0_&b!@PFrUMI
z+%2RkM<2Le7+SPSBrSa5n5h?&R9+}TyNZ5+o@~ONft(9UUr%IQxLC~yQ%eI$;c4i%
zg>zVn_c4<^iPnrgcdmjyB(sgkK)lhnSTn5hR7`(Xr<R78nh(eTN&C=@u9~PqvsI%p
z^c{F8QQG2vfBoP8Ur|Kkk9oeP_|+ps61o>ORY|d)>|`>?p6vPd*T{&f!YB&r5bGMO
zTU^$E5|g7`89KDNiXJ}St}dC^G%Sl#+_Wbq*F*R{-vYg^Sv5f=-KTQ%`Mu$6yvX^1
z)I;9dwE9X<a^mLKdazmWA)GGZWla7Gd-BYE-q2iOk7ZAzGwKMJ(v-G%cC=ny#_CWO
z+d8&Sl3B+4idQe542owM#H$*)lGjP>)Q1B-i58cXvC*L&w5NN6;-Nbb@r3)h(%fGx
zeKG<-yFq{z#NWsC-<^YS{9FT|X#;k9=$9xd10jFXsI~J=Fx<m1cN>YKk`bIsxy##$
z;f0-@`y!FMpX7<exh!`1xU=&>V^GH~GZ2l->;S+-GSg0vr_EK<`Kp~T<jsmh&JD}n
zi$z5rNW8Vpx9vbtVjxoBADE%AuQhL_91h(Jx2Q=CO@Y{hF@w}IN0Jo@W!IafO1uP-
ziy(hYbN535WK^6^1aBHMq(OZ|GYV*l^gPsW$whg!xF%T`45^jWP73K@8zUkDQM*11
z0%H|1NyCSUgdS>tvoFhp_a>DOwE<wj_T2Fjk(EN{_0ymYx5dR8M`UUVFI``7hUcmk
zd<T}MB;Fixgj*<H!KZE!K}*-}#(YWnJY9eC#UAC^U&W-`-#HOmOTU75uwrwySi6m;
zD!&DT4ub(RLMx-NmA<wJ5u1&lv8T?eeK?Uud|7t8Sd?1V4}X|xa$#|sCbun6g5im-
zk#MxXFm_(x&YwIenzKKVK3+<BBsB4>q5NtEKErzMd}bYh{rrSX0_bA+@e~~7!zzE;
ze6a^;lD_=0zw?M|!*q4MB{h7L%`bx28G~I#7o}KNj;#qJn`1iO5}XeL?qNge)f7<6
z%NER@8q<@(#j=M5G+!kf#=b~&k)ZYkaTL~wP-^V&JWUXQ$!W{#!XRe#ev^;(SzIA#
zV|1A0FlQpp&N6NS)qo&8aOmR*S}%XxNv$h%lHm7GkzHn13SK5X4X-12URE@3awrTU
z_yE!XtmlPL%*k-eNCZtmAJbo{LCVo8@3L>75!r#}gT0BSxK1k1VR0MIvK9}KT!|&K
z^OtZa?Lu_y9u~VIa&~+8O~qXNIZVkssDN^nuu~Y!Hr#M}a3=`%WhqtYW}Sbw#hrsc
z_KJgp!VbCY!C^hwY&*OAZ${#S5qTwFFP}|WY9-4%>F|u?juCAky+iFntST8VMiDSf
zCg)3gE_7;Cg!LKT;d0CY8{Kw?L{1-=NfawI^Wc7ed|5&?hUZ?rI({TOLR=!4byG>U
zEazNSE3#s?UzwFAt8`;wsbqh)Pv!)G)xxNu^!K36aPD_3{QzIKnf0j&Pjb=Z&jGSd
z4uVQMyejL}P+R~9=W-Xe^Y462zWDs}yVb8gyL-2~|1W2s-J5(?{_@^0KKtw!zxe#~
z&%&>F@5ZTBO@UEH*M>N!RJ{?d<qZ~UK!!)#joS^33KKV8)rzZ&aUy?Y)1thdHYHNO
zG!8*wG_S7UmD98wzemNFacM@q6ftGVbk?2o-*)jERxvfcVK_}!<t~>z6%48EN3Nmv
zHKBlHEhQfd&1~$ou*r1wZ-1Naq2yhj%pAQ#boCNH3$N&IIqu`IA<bPjgs15pm)*nk
z(Y;I_jr}c&KxIy=Sb%>M#3Ld7|8ZS*f6tAhi}c*@JGk%bh3u~PbwTR1zTXV%n>K!L
z*R&nOg>dLs?8udE%CsBaheDqqxTt*~!Ji0E6iIqKOp@)?a-MpNf{YAW-{@*KlwCba
zv-{<Ry5Bn)xl)XN^4O(83VX4Y;yx%ReYv@BSBaPbolbJ;pzeQJV8NN+?++nEhq%~5
z+W;}n^?Y2Q7c;?tDlQbs)cSmUzQrr90Axghfs(-=Eh$O33X=@WCUFKSV3&AlJ2_nc
zqOe_ZF)6}M!f$m<ppU)O=3uDt$U_y8%%V?<Op_2V;d4=(wlbfF98{Jx;{p~rj!ePs
zd`-KUO06hkC1-!(1%T$HN$FD_8(CH!wUZNF^BQ6?0CYT|iVf=tn(!dCAf>8J#7}bY
z9A$v;EIARxdaQ`&kG^th0;&5GcUW#nO2&F<?K;>`JyU>LV5L<xddzzaiZ}mRhCcSo
zElo}BVU0*R9@7bVF}?mrnI9)^E+u`{(~-e0ju+ek`dxqY&<YiB{3g*?$_Om7>|`Om
zVRD`f@qi6y!;khe7km;lZ`E%+vb#tAULn!h?|C@g@8yez=k+w$ihkEtCw@;I^bs|b
zRL5oLE0-?P7bQ`$czXQwu^6@rTqK^s%o=g0I^G?5iw!xCJFF8eo-<fI;zE|?Ir_Ci
z-A4}`NUnbvg;RXxO0!pAJ5n5CH2^3~eSpDosg`txm#K4NR=yq9D+iL?6LY9n#GUiB
zd|S`fv&2xs5z)stN_LSy9P8yw(N)Z24Z)@qx<TDkhIMZsDVd^Y6NNquRrC?qPI7Z(
zH&PgBPF`c-Ub=C;Mvm#a;=5&~YcJ^{zz*9i1O|UI*$5ZK@Fj7*q@-gT5vF3yh@RxR
zi?C~!3hYc78GbH7{H(DCE`1yl?P@)KP4h4vJ>o#7bD<Iu$GT)&*p%$=JhY5CsRQ4f
zmDdKYuj0oOZ51fdd;po-NWoC?S-GDmx?O@o<gshO8$yaqtNDeYJNO5{JBBwx@Naf|
z8CrjDW^*eQhHEDV|7qRd9o&UK=aB+|A^bh=IZupt2)EvsTWxU)1JfG=l#Z`ro{Qv1
zNsTIYt!~gIDmG=C-W}Y-B;Fg`m3&~!Gud%G&hW7@gq7gSBKO|zwzz2$N0Cz(7^+Jl
z2}zPmJSinwi;$#f?bWeP67`I_O{meOkQRR^WapNJ>)Z^bfXSny87@=;aqijq&HSR#
zL?3^BQf(7WFyTnF$ip}e&C5n}bmEV4M)E@s;p6|dd{bXY+&k8+DJ*B6S$rSqAIO!F
zG)bQUOO~{NJJ6n%s7ip(`#V#frClZp^}JwBvmUh?KTqsQz$Ef15<#W6$+v&y;4yzV
ztsdsn<@Z{!fn6bo9OWI;lo$_tb-XbVtm`zFlL{l+Ny+YGE9b$Ip4R13Zzk)A_>j=0
zr>2W#bBPYU@>fL<gWViU&N6=m@?6SES~95Id6uz~4uJV7@GeU8+>@v8Y(0Fbw<je6
zPNLKX%|Q{D{2+5TeBzc1`htTinbv=W*C*bhRdnQxqQhrPs>iaL3B8sKy;0R|yw<bB
zlCQIPMuZ6Hq{<T{I;`E9ZE9|i2rk<}TMA2cEP!p@oElNsm?WOq46;>O4>fXMix#%o
zx9=fU5kkhCWc!v?XHk)~%aFm3=bo=Q?bFBMp5y4ykxj0(&{6D+CI8F8b0L48Z2@d^
ziEZTH`z-H>Yp`NjQ;Xbt8$M)}OsbN??~uZs$huuYre#S~oq+XW0I|3aquXKul@3xQ
z;}vfF(&6>O8^hRcK}NFtF<YY=`9-XRN`t6(d8E#>Z04rRi=4e`ir3Y3dzktDd189~
zUZ>{WZEp4En~s@!$zNh@r7eG<TxXscw#U4&D2xUV>NdK<v58)2N8MC4f27yy$O)$h
zV5wm+HLJy0tQMkRUNcBG$a{fN_~2f|(1bmtNl*!eiQyY2VUYo6J%)p9AkwCzWu=2l
zm0PLm>Qqx;v1ZtLx2Ht;hB(+7@(^!M0xP32Jef7AT#&>=Slcl`qRW4tHnHhO`n950
zjPoU-R`Ym^B<{u1BCG|5F0$Au_QR2_f7!ptt;Zp);T|lZ=<T1CVcThRn90YymT-6r
zx2`PvnB}F5!J{TjGlA`==}wLqDM3z8Nwr!rrd;DqOd0O1yF>w+RA=jp3tHjRM*l%5
zB+Ck9Vvq(+Sg9nSH?@CgAj)4BT?mXmCl2el8Dk=Io?F(5Q;7}|?D@6Obx%^8I5o9m
z30RD+1oQGM7>1rZXZEXT_b6(xxU2uLYF6bm{*8e{ZqIqMyvYRDc=NavZgJc_!XMQT
zNB=N;qZ}x5l~mLD<-txKa^m>x9u|KQXJdMA`1RiX2cM}MGW&mwaOv}3{8F!^--Bm<
zb@yJl@Hg{3zTyl76?^Pi-do)Ty)+4ad)(K21zBR<eqM@K9EdgW&<(S;8!#RKOR9_|
zBO3)Z)JNp_9Lmya2Rgq)4p^q8+z{N99LF{-JNGKq+GUA5R<lK{f+c2S#<Tog^2Hso
zXgT^}^5r9nPP~7rMJmbi{zDZe=Pi#!yKDc(&!piJK2w*RrlyAlRk$O)S_BCn_R(~=
z_}j=Mx}7{YJHV1mY&j?D$S)snO1(&S8f52RGncSW8ZD$_VX`KEB85XVq7AjJQGL6Q
zQ>SBU3AP61!JEotU1e}-aX>{;H6Qp`#22_&0jwgTMZ$lA#Y0>R2Z5J|pKFzjs;{5A
z$;Daa(YcYXS#y$n+uQ(MK%&2#1WMszf~Ho^XB>?Y?w{wYqH2}N2JTCuwQsAM@Wh&3
z^vJ|Mfvil~@?VK#rPb9#KO%%fY4dI&tySn+x<l2ism`*U<Txbwx)_#Kf<xaVcId^j
zT(A(!%cB5u*5(j@vm2?kvG70;z@)`Cjr>V7AlXB9reH%7ZNSdr<XlSh05!OKcD~Ev
zk57RF-AORCO+8DE21@@d2(!I4GdM{dR9IVxk!5uWujd<Y0XoT%C!EHlq7D+49j5P6
zMba-+zY8<kK-3xw#7Zwlkx_tN7?gsrq}EDexT(vCc213d1(7fX;nX5X(dDG(S(I?e
z$Wocv3E&&?v5hNdE@!93Q5Jc0TqUwH_WrDV-BpajR;kagHTB1<8U$JhLq%hBnN*!<
z_1eP30Ua<*4wfa6V;V%a+$ZB2q)q%7+~kqkO^@jWQ=VzA(AFUXOU-@`i%fEZ!CESH
zF|qnSE!pmW@V6_0bq_ouVOO5&0|^70h2=6-dw}efH4yEktEsmv8I4|X;UIy#$?v;B
zmrgKttwc!S>ZMx~lwc+}1Uz~FxMvsxsJ^od(hsVp9|)*;bU`z?Ar+jHq|&sPL4D{)
z!O@<0i&kWw`N`?yjZcPXmS=`xfGCkSZ@Rs~X-_SG%x&w3;?28>>AQ@qu5<A~(jCQ^
zEfry;tuoTbIR{!deFp9qp!S^G5Rx`)?j@(}P2998FEtUY<0eoP3}S2Ka*=DDTQri^
ztdukGB_TNT{xhz~ZVK)IGo<MjI}-Df>WL^A#4@pFVOW1%(LpmU=Vf|}p<wqMSYM8a
zGw7Iq3%Ym4O3u4E0)>;90^CUwwaw`(6olp(wXg&eRVn-unHRs_9I8EzjlqZzqdBRn
zjeWLF(Q})zbrW0zj5_ibHY^p)W&XN#&!HRbN<XafIy+JIWK!oc0fbeCJD*K!m70cS
zl)qCfR+bik!^jGv@7(#S0y-X`GLkoT2F|O0oaFcp6F>-SeKVdlU~?;xL+`TsI3ySY
zyPl$dp=)57R`#QZ*GjHJ_nY=F5}rHXxt=5F<;em=w_Zf>INoq31%S3>aH?m@{-RmX
zMi#fbYMJQ42DN&ux^w4Yxa9eJ^-}nqrLziaqK#^taxR`E^NgFaWxLWBR(fNij=;lz
zB87nG1W{d6M$G6M?v6`bk$QFmiOet(MB;cjCk~bo;8LJ;w>>f{5+*4@c4Jx&qq`Y#
zxsDL@8?FLYt*e%uFjM)8uj$s46d*k|ZE@y1U5M*mn+uqPIW9BDl~vXyywX;Ise_mZ
z=+mcFSmpI3GEU9phryrPL9@I#*biHOtPJPrtQ)@U#X{|6#l<ZU7kLJ5YHJ~*VlI@1
z+GcB2t>b2KjpJ-3+)JV<u9`)kF(znHbIDfZjkLYXt3vy()xf=^=*dc+DE}qh!0hMe
z#}+r!EiFvj*||0M+cF|<OIy)Ede{qLp(gx~1|G9n7aYgMgl#@BwhcBx{8CJRSSNnu
z_CmfWw$RgNjw<XP8W>kvbhxdiT928?hB-;H%g`E|^~&YL;z?LhJw+Jmkp#l<ofxc6
z6*WFe5kXOoGzflz$4T161jx)(dDK-Revz~vM=vrYXxW99>d3PWl#6G-k;J6<tk&5q
zBc85)rt&=DA+Ld=_6D8aE++$jqcCQ?pGs&1wq32;bYS#?AUblPwF*pUQz+6Ni!O@%
z^cX(fUZPg)J$?B6hB~#REX}B(Hp!Vg6=`a;2;4P8>WnFE;B)DR%`6a|X@to^p<67~
z5>+T0<4Ll`96@d3+feM<l)F)NEMq06EF^721hOO~j%$or#>JRkHBAeDmz)GaX+W)a
zP+62tx}K5gjz?FI3Vo(7=%R0yDLg5u2v>;+k-m#!7S6ue<mXRNg7&l=Gu<)#v|3K(
zH-(NrAd<Y5utK;9e;Qdf)o_ks^!&&+zjTJe!Y9pGGYi<y&d~YaSJ$qw!3B^W3OX3A
zv?4g#ZFDEVV?^9)6tE$GMDHgx4pDbXX)7ExHTnor7y<rpTrO4;eqq!{qN*!kc~VkC
zdFZMId7(4+1hPK8){3Tjd^hJ-P<SFm00UBOPmyXXBdTTqKK!hSL;}~STI^L96$0HB
zc(US1Yd<YG_!eHu`5HQaLB3}f^>jm+;+pF8=)aFPk4rJAG$&7gPbiWlChQ9%sem44
z7`9UOd|p%bn-;vGzS-jNN0lD37+qAWp}`>=-$`sYXk!bVt9ohiLN9@vOTMKSGv=zS
zI!9HN!a*hd>S@lc+V(Lx-`cm!mU5Zl$OG+Vu(Zc(6<3JdJDUto|FFj~z-Md0=4JH1
z{<D!isv^)avfn9xt%L|^4H>NdC8`DPIf-HVWDTla%lyQ_&O=FQ0|zDz65WQTHn&0K
z3;GW`#(yO`nOqu_HMj=g=h0jCdk(}qCIr|@w{LVFL<Uuzyrdfc^sD2i#okv^o6>(;
zPr}i;A72Zf(ja+viX+25q~MCT&b68Fn*NMU_3gad_mfY5&FO3`Z78g=O#z24rp=kk
zx*Pm2gVcu@(|J~cKf){~NqNR1I6se?rF$Ck`Sx~Yg`BKsGl0tmowJ@cK=gC>lpHK(
zOl?1W3?e(M3AUrHJ|W{54^B^LdYLJD6l<1)P0=q|WM&tRjdM;3{^|_=#!wn^$C(AD
z9_9`a!JaLDPREhP&irVc-%Ws@y%XKMUvcvug|@>YbYJ=C=vcxSj9*AN4pAxrlsOY8
zv8K}4@JI>jq>-Fn{WYzgOo&2fVr)lKQ-qsyuCb0<pde;~F)&wfKp~K4wkH`+Yn*O!
zT*m@$xZ-d^jDztYS2pUTRW-+*;pl!Ev;vfK_r$D!^E^N#?El*nEWED~h6w*Op|`PU
z_@yhP>Psf#m=InW`0ar;0wq$VZ%{}Hs-uVhojY{&J?C&ct3nH?wrncJDJ%{@xfxEr
z!^6W>y?~xsg#Wf?8^um`b06K?B;Rc-Dzy6idUe@|f%`HHlHyqHeYu|75xXC~yFmfY
zvaj5Kuhk;(H@{dj?TfF71TS&SuZ^JtslCeiY{7$Ch=oK=xlWKWu^ew$gPa9{tJT@=
z$*r~DA~{6899u5cvjq-YS6K2O6IM{k5d^_k30!i|x;Ck12q{gfMz}mMGQcxcww4XC
z!XxM$4lA#BoXu)c#Y$x#58cInU=5>&c9@2LnZ&te3a)~MQ32?K4zQSyz1gs!^Cj(u
zZ`PN|>^0+6^SWM*2I6p!Vn;<5WKL^}TaXth93RmKl|-*%N;#g=xQPOBQCOwQWwQFD
z@~@d!B1}5FOpQDFrb!jcJ)%d5>m!qvqD}1VyjmdotYF@iWujS!lEujKMxqg-SwPNz
zd{w{QMRvfpK6TRz%8B={=k7%=!YdZ4EgNzP%_nZYl!)Aj_V?Cu5H>6{$-y)G48l7x
z(g;r7k^eVARDYNaCuAVNiR6rK*w<+_1)1E#VQd?Iu=B5Q<mi!6dD@qw`y!5Ay{TgM
zfO&(3ZPp{e>O}2H_8$u51^7nUR$%CVxg<Je4M6AP@5|Rqc>rjUg?BV;?m2c{=k5n`
zw_TM7L|0e$`Lg4e_;AwqbJ|NCy*~VwEPY-0DlQe{z9C<QWlP}8^Yun3&-Eh92v2-0
z27L|)8Ta6(hhf(rEV7LQCb0`03_thy!ggJ+G+c$=69;O6%45&S5cmTY^ZF})+?RA)
z%sNxkL>$i4_{~>$3_&VfBT?w*xz6Nfkr*T%K@TTA!`XHlUlBtus$!~5tF|D+ZpqO(
zuB4JJJ#AFoL{3JMeFo7GY0$Aa&2*$uv&E1V!&QfiA#FEar;T#gAq`?qUnnj312wuG
z_Zd&C2RTC==_tSA<-uC`1T|QHn=&z!;!+eRtjwHCMycxAIiwfXH8(JgUzwuqN|gI^
zWF2P+fu2mxm)~|Zp%X<J#1s@=#aovs1Jyb`-Tt1Q>kfFYFnP~cY<uyCd{g=jw*TUW
z+WZbV^V*H?kY_(c$i4eR-tp=(J#aVAtc>{Bj;f5MnG(N>ht`d}$Un$`sYSZvAMem2
zee?}y)=y5q`iKuFBjI8(4AOSJ5M_Vs;~L<X@%AX)&ZhoPl8<e{M-*R41TL4;SvatW
zSr>>Q#AFL?%>_f6SfLM4e?sTJlFsc)wB*Xu4UhmY&g}0KMPy7#zva^chR_#ZXy!X3
z3+e8<VMtv{^2t+wl+${DZ>WEF3gEZw9EJ<pB&mlEU4hO%baZQ^qDWRs)HOVVLQ`de
zt}nSnMv<}C+_QR2l*Yz<+G^5;#NO6ELzshE4JTl8zGC~;yuWS_N<10tQ2=hgL1u$y
z>l}CjlL2r4w|?;@PCiiKDZ-Ah>fr@{AwY_m@O_lz{>?syuiz_x<%f}XI8u6iVyDmL
z>DXEQp)YOqVW8qj-WPo6vt<LkIeTfC{8c!kFDy?bXC3LXl2|hDVj5)qlW93CQ_c~m
zA$fjTd!*tM#>}Q+aMQpgK&KlcMpt2Jcj$o0LSodhKPLLQPU%6=J^Q}E;^zuPdhuZJ
z%i;tIC^fT9aBr4>P({3S^yl49(^WOToHt>-uMciTG<O@qZQoNa>OQ{-X(Da7iJwG8
zX-H%eC-in4cr>Fh@EfhwgA3k6ZC=OVLh|47{IdD?ZJhu{ToWF;2-i0@W`-lb?P<*1
zQZnPi5X7ev_L&=J(s*F;Bws2Bg9s}26FB^s*}ruRufmdln3aES=Is2L+<AZ}o$=;S
z_&BjjNu>Pz7^PSOd2yXF#t8dZYg;1RnM5*oP*eoV<JlD3BLQ4R!qU_!k;Ge8?E3q6
zRehFogEC&5P^3!qj69w_C-P*Ipgumlcki<YpB=opH!4Ku!>jah%iqz&clU(5Niq?&
zULmcGTSUKq66BNa7LvMYXC|34DxX4q3c*)Gm!L@Zaq#x|uF=I})&H#N-@kkRv;N)B
z`}ZD@C~+ivv;Uy~%YMskhdVyMd;i|QjP|L52nwmjtzzvz;ScJRK|~aJ0aZ}DgxDMi
z@R2Ph<#ckIi4Arm5Q!w5RuVDn!q*tZL%saS1WSj1z&AG7&gwJoPqMssc8tbBI@5B@
z8S?}jeVHSaGKghLx;vK*=~uG@fJdy{fb~)dRc(zE<Htr|A~>yg?mP)LT_1H~#qrTo
z$!S2@BB45hs2qj;CPB&HSJ%fAttJRRo>W1TUHPR^PYx0Wv2{S@HfrW%FdW4ax^n3@
zZv_{BI*r1Fy-7%Jsgq#9PF|ku4^T#a=Z+28SvXCrrH!t2HyxWGJw`#|qH_w~e0oH|
z;p`duaQDF3E@6<%)~*gPLX4$Qnq#O2m#f)yUz0^w%;j33)O*5u<3<U^IlPcUi?UW<
zAM1M=kg0;k^#EUYG&>``A8rQ1AHFN-4R5M{_$j98t9t-FD1dByJxCZHi*qK`r@-#E
z<uRUds0(3<+B<%6a#S1?kAHtsJZ~n7!@Ii1PY>@$7QV20h<I{Pj6yrZJEM#X-jiYW
zISJD@#F9qs(aNIMhEy|JRu^Gij5Ks-f9ftzi%d`>56CH03lDtioGa04XShrr{XQap
zv1=)NC4lN}WBQI(&qz7AVdI7=(Z}os#?@hb%ZVCdg6;D}uzhy#?*04yH}?<kj`n@4
z+ar=%b?>SBUapv{fyq^SgkEdSoW3_3>U|^g28nwqmJOxg!L3qqBwg&ERjcyQ-qyc2
zqv-A5{Z;?&FGmVeEPkAAbx-R#Q`^{o=DnwVD}PFRF1|U>_)!f@26&)I2_<WS>Wg`U
zS#&70Egyl|hDtH<Y$Yw|^WriaQT<&NqJyNd&>_D&$kj#@-A1Az1zl4Gmpw2_(!Y#v
zwiub+V(U;6%IUFV`uFOps^(n+CC8V5I7z^Vygy8>^R^HDfl&m#bvd52yI7xpO~aRk
zRtNd>@=e1xY=4Mv!_yqXgtS(NGLB(!0(p+JX}DfaM{a)V9gdzY1GT7!ucPE7GWh+N
zFk)cYrG4zfX|tXbs_lEY(Gw0wu}%<G%OeW60TnErOvUU^?Fo?yf9sdE+mkw-i@K$3
zeseEq%nf{x?ZIF4Uw@-2C6yX~*2DqFvb_WboHU`T>xf;D_1kaeeH)9vS7&@ZdVhA3
z8N%7I^sqhs5|@qaCnKV=wP&45=sl7`YEG;HP{cj6w88hSh_qBq7$q?DvU%&8OC*%s
z8;JrMmfn6wG>g@e^gmlkJuOqTCzF?&_7jF%0MtiTybp3C7I}-zf^H~(MRLUZF$QOY
zUFRqf-%O%pBHdWdB{j7yGSfxL6k|*B^+5v!oj8@(3oW+AATX|vx(C8P5ltVl6TuM#
z7jUVugREfMMgoPcZa`l5wVi>kGF?0Z(yOCIXvf$6!C)Xi>leo2>;KVz8IFtjs((!M
z$Q6(fKf7-@kpH7k3l3L7K(M%*)>s=0rxruTA?N6631@k}Qnkg7{{9tgnbFbl5crD2
zZyp~#di>(VNv(}S;#$JpsRG2q<2;BmjukZ~JC{#L0~LS4`lGOqioJ6XGiJi)nHD|g
zE<BV@rexlUlv0(>&qxVb3nh4&uI#QF9$9Va168Olyu9D8uBWl8I~<vpqSw}dIw$UR
z`q@~61m24ElBek~{h&TDM_Z%YXz)Y%!v^uIY?}0pZ8NvkX?J#i9ABBc#grjIM>0)W
z9t#1JqX2*4&^^qcxIfxgHuyn3WnrZ}uL+)HMsciaw5=g2s8qzy+^$B3#Z4BqYPS5I
z{)0iV)bD=TKUU{9&?oE@`!DX{&+vKu&+rfZ;Qo_xc~SL)?t5><bYyje!06P>UDa<q
zR%!kQHQJ9e;S$C<Wzhg3@yhZ!Hl@yn)!}EN_*j1|)m9;><XkY%iJcgJNCa^ykZH+j
zvA2aGic7W^p(m=<co1yAZ;}%Ti7jQ{VXFmxI*5+Toz7=`5#;o<<;7t*0D(35Kl+d7
zZw|?byITwnELLxryoy@`sl)P>*YoB~b4I$yoDQ~IZ3H_HGbZ*B3S*YAxmT4O@C^Cu
z*|vW&oF|0o&+E5>e0h0bN1YCw(SYdm$x$MKc*a_YI9e^s@C9?{%Te6hlv2AFdBw$J
zHe(9HTvU<lBjg<<ZG$~5A00Cv>UmJ8B&lbXW7C1kPuuWNkgyKjxg!P?Q?b^IfgFxg
zsTXgSlZ1r^Aw7P9&{rWJJB(DXTMKFw9$A03thrhu9bht2p$~2w#jjy@_WU}bs*R?z
znhKc7DXXi)N>S&Ce`x*!Wu<~ofF6MxUN~=(V>G_dKuzuGq;7_$bUBGoRU?`4QJM?h
z3XxHKEVsVvEq#_1%iJt9%Nhyhl*SI5S1V>tcth6HUS52fw!c6T1E`o=QdyOgJ{f-v
zcaJ3fFzM5-XBsf;bsk3fnX2WwI6^19TVb#@C7*?(Z-8dTG_#53ro<1B3gd@3>Ff*Q
z#W)XWWT}jU$=5gAKe?!93iyPaaD$L3<$J@phe@~$WBF|`bvRRnVC1##^|jEoqjpp^
zJ>KoO5kTC{g?OF8ILDfT*xMvAF-?DmPEZNjFt}&U+fRlh@aGwJ_P;bds()iko(TcZ
zRTI~R=lS-FQ@vAAMkL#H@&^5$9NhoqkR<f=>UvlQDIp2!2_(5Z+9xX+FNz9#`X)$}
znMPlK@ynt9nYxbqTrKOlNEykL5HM1zriKpTZxvw~krL^WQ>^GgIIXTzsylxvB^1|j
zso?}XprAUMAAhwJ8d)Mzb{Sf2EG}g3hKizpaCfLlV?)NUB!rdmw$=oII4n-pMf8yT
zz8?_ZQzzS4IDi?6dmA6T2*a{IOB5t#Bcoi67!LVclAGIh#Rs%mIxtith=8b}lOU!C
zVcc?V42HIZG`9fa5{oEKc58nJ)~Z>^k-utpKm?#`G5k|z{!m`kM}=Qi3<L^=XME6_
z^=`o55@wY8|DT#O&cOY<L(+L<2`Ef@J)O6ID(mS-uUUDlA6I=C6ur-q$Iv~Z-1&;p
zlbQ@c3Ek|eC|m5qzYOJ%p;RlTI28Cw8;IXPGyQGx8yH2u#W&C3HDZ4%aa`QGf8Mcu
zl)Ny7{wya+y#V`eC}}~-e&gjsK!D*m@3j)AVBKXEITkIIA~d&L)#v3HS)Ho$eZ^+!
zzrW^T1}ebs0q1Vz;kxofekw5ib#ZDrL7%!AvnZbJa7`W-U~eT-6oF9B-!!ikBOP@I
zkA4q2&4*8r0&=F)-&22VNNVlye)iS!mc2qW8%|fgPY5k4jOvPhX&8PEve(AyWj&R&
zQNe2!x7W0pXEk)CC6+3@EfbL2_oW`oo=*TtJ214;Cs`0=Ue0jF$*`qs=lGGJY;3`8
zY?e-a#Z{vkx{nSKut~`-_4_q4#?DtPFjBK-PQJADTwoB6bUA+}x@V_zup@|HCU4wB
za{Y4E_B6kefcIL6o-N^g1&h{`AxOY}Q`Z>8k@V-JJg*|y61yV81s}Fr)<&9a@+7JW
zhN3Uhr5C<)g_W<_=pu4lckCG!yAoxx3RehWXXUgWGjVZJ&XO8ckwhxllS-Nmp{@yz
zj_e<^*QviB5t4t$^G4Y_v3J9492Y0j7Aj_fD*jL^4N4~!RAc+jo#Y_Ab7y~G?2djP
zsg>JGxEk6dtN0YfE}w87-;+?aaI4=S8id%zykLF^(SIvzbd+sjaE@mNLN;<)LUKk2
zD#ORi9412`Q_-daO4xy^xjTHwe1zj*sjl6p^8sHa$5DTHLunN!rE+eL;#sU87Ek2-
z<AkmaMc^oXLO1j|pc^fit0R9i1#&mNV|O3V0Ex%Ch-Xj*Yk$i#=^eY0Et#wfzm%lj
zCFmMnvFgKsUHQE<ti*~s9sTzhM}%S}x2euDc|D4aLpPr<W`C0KN6_?Nhr15m{rEm<
z)KQfL8B%{5g}Lp-pPNYZLlCRd1gvWX1PObWiY2ctG*-KVOZ2?<e;d(`DRind3Sd0!
z0+&hW+QTPDuO2-P+eGEj>o6JZ4%tD7k9VBrf__2B@a5z;f{ol$jO5?$>=Z}<w(mHe
zggejM0qxrsv_qzTK&9BH3;%bx0eTF6>fX{TcGrKa^Zu`P_Xptxvpsp_kZ?dmOa3+9
z7{2+trPOoEFods2J_7Pl$LAp2jWx7~+_0c=VPu|{2y*CP{Sk-sGad|s@F$AUgz0;j
z<--2%cg0`+w!g123TX^kCul2tGG<`#r>36o*$ei6%{#-V&R$RICBKt*g+HJh?%C5p
zFa3WDD*Dz-0BZ@oRq?m@I2An~DtpTN&l~@SL6J_??F$~ap;JHkiO-6SnrR-F<#IA^
zw5CjJ{18kd!O+UNga-1|=5k0WmCCr1jP0Z;j576XJ#}Q#Y(PsO9tJJVJFdM5-L_BA
z)w27Y`a{Ig(;`=;cy@9UGm5MEMOYfY+tq)yA`eXJNrCj?*UZW}tHLS>x7a|OSRsp4
z@GL8u`CBtSf(+LDn;GlN!cn}MUQ08nevWwgWhDTCYC-H>AbmSb?Nn83siX4hml-}^
zZx5^Q&EV+Um*2d2_WbzaFzB4a-#`AJVLYOYlRTMU+n#eI$1jTA-CygE;TSrxSwDX)
zoX;}ZKXM-f-47Yc{-U`1YoCU;s=|}l@Ho&;s+I2e-|p@6#Z=nCxM*8y*0QLYG?ja@
zJrvEB|5mszi|!TT6%CWrEY__C^$PBvmyO7Ii227<w=n$S&VzNkJUFZ8DskgOpj+Xm
zBAq+jcy^5i{M>(z?Gupb5g<C2q%40rd0j7(`;=5pZypQ=d%lf+$KBad^hP1~x3J8D
zJdh{;hW|w2P@fljVNeE?q+fgyCP!4g-Qs6I!)OhHl@YH2*>`u}M<<=WFbBL{{vOs7
zkqLjh;VqsipET!F<gF>p$-r8ZmVTnsJ_y$T9&g`|jTE*h20`P{tH1VZ$wGhndH#yE
zyeNU>4Ts?74H=|%Y}b-`r_IIQ=%;^)ulbvD293NE6o2@i?}$!MR91T1gCM2D8N9c5
z23D}^{o;$?7H7#&A|GgXKi)no7u|cq9mx$8{kyySafa9@3~f52Hl`b5Jv#xjCtSP-
zY4fNe{sVHx#PX4f8+B4|o?3tT*=HwHa^N9i{r=M~^mYwJ{dGLV@}n+xQj4H<BeX-?
zIkug8Dj%c{YZ#Yyy1ByJLBA{aqB1AFEghWRhO}|8HFW6LmKX3>Wp)26E9}F69;wj)
z&Fil_f9?1C{{O?xX)0Ct>&45#(PnN{xDwM%;2=nIJf)S5ah2w_>QR5A1o%AM^|U0@
zBE6p&@K*U1mCPcnofR=VfG+e}54Vn+!D66(IFEXw9?9C-7YF@Z@DC*^!j0TP_=26x
zc2j?V1R>2Q09$`#ikAM|uP1{Q^84yov@WXapm>(?PoR@2wVAmI@=85vRczd6^w*33
zSn+4dM4>he_Elra@Zx{@EWUwKLRY|R>>!k-OMZ${m^eJ{2l`^+D|(NTj{D3H%0G5?
zkSDN&ZUr(<!`UF}#-1!;JFaElh1S>|y8PM$%8OQ<co=tS^}x?<<um<)lgN!a;vGf5
zA1vc=;P3wQFY=nd?S_>gJCyEXz+0Qv-P51n0J%P#gNbg^E1rKnfBfyyv1umZ8RYQT
z>G$in`=u+tP8hQ-!ODo<gAfwf3y$JK{&~v>@>a*6Z1mznce5kNB;-==6-`(PLABW!
z$9<trQ4VNsq#)Sk&jWQ{4bX&WjYeGk1)Cj!)pHMXzLzu*1Y!{AO*^0n6cZ=AUR2X?
z_MHAPZE=9$!+d|T_ZO!%N1F9+FQqisdD)j^EQ}T;JZ&@?Feuf%LK=!^9MDn~ty>-o
z(;+QzfV;g9Z@dbcLD0L;5B=cc$4=I>#h&}~&i7T4axV4f)Be3b+H4ljmlZRITC7Mo
z6;EUM_tTxkw>+rUm)rY#`+gdj+e<0xb(yquy|WX+ijIGHJZT{9X1BeJmWLU(?0rqE
zlsonlm*HN@O@TS{oW&Ssden@Ov@W!m8&QmVLpY{~D2_?G#P9h^!}Hs`Cx?>qZ|Bcu
z1yt@A+5cEXZJFj$N>S2-&B{<crnzB8r5HBgsO8??&#Wm)Q(MCS6^t$f@pCGTh=kS_
zr&~=j8%KY2{V7zBgu8~x6GML@izy|aU_jVBLXZbNF4ZfqVM-PPrE?IL=+%7F(v!nB
zteRl@wwFjHg4s7xKQ!=Xjrh<96SaEVzOF}G)G!v*<ru$2PQFc7Svkc?aV<P9f|+I+
z9+{#Nls=E*eZ1{SApkc5^B5*g!n8-!Mx4A!4Mu-F-dXmGNTQ+|-MKU18rP$^X8=U>
zK{y_d<YN<qr%l${W?&4XF4-wWunP}8f6@APcFgRrk6(WC>dWEFXTN{^ZTL#r>tccY
zx_j$4+i%19Z22<i$;G8;1w6QeBrd{|nZr@bAgCUN$8+5fqW3_Qy(y<cJ$sm*g?hwg
zhns)q&+>HZWt~Y6yoTMzqB`B(n9<!oVos%<jl0u9;f?7l;t`X77(YwUuy&4+z7K}k
zsV2#-XTfHw&y$&&F~1A>0Htmrrj*UK9zoYgvVeM)!vw6fWL`#;E~D6gRNjdiOmBG>
z<Q;U~Jq)i!rw^(L9DPZ373EM7crV6*{vdzuTc#W$XC%A=WiAjGqn{?&lIYh@%jHFT
z8b<4nqfS7Kj{_l+vFJ(_Iv}ejc|}kWdXig`@r{_6Ni@y)X7NO8*nPA=$T>Fks6>w$
zijFKVdPM?YDY@pjTDlp50VAYI9!$2MmG#Xd$@`9A51*d76Y=t81;)tAJ&-XqPW*r2
z=_XHbb3g=%?CT^519G8~0B14XhWKrtm};ZX##ZFNLY<R9?2^Mv@aQ9Epb_r~?hH|T
zdYyAk__hVnPiqAucPG7z32z9JUF7u|w05>`mewg`Ic9<7pg^fmigyVOxtR5KI>lie
z?N=|3mC#8P8J6=z>h|^r(%*u7dJunRLH|C0`h2iz4xp6|#_b!t(^B`_535MUIwBf_
zHf6V?sXx3oDe2I5&%pt<qs}y#6)MJsQH??-j-Y=m>P3YM+TMeq|B#_Pmea*$xqoOl
zP#(MIIfbM%4Oa*aM%9It3U=Sc1>PsQpDALU(ApBF>?fx>ml3?*G01fNVs3vjtw_nE
zwm%0rlOy8PS^uCn^rVZL0OGk7rcFfPO-CG*bt6aHM@4Y&59Pqy9=%1Q{~FXmmEH%5
za`^+tiSedK>+$PHUw%}>pAXxApKfjO)+DqxIonT&1Z3W^K_fPmdy^#FB<wsf)kxgB
znBq9oK=73Un^xsg@+DLimsWqdoAbnjQ-6tokuN`FXWg=g`udRC0<u9=g28OhWaBE*
zwOuu&MLIOFs!jQ{^--r_@H~G@<h||+t`q_~k(SVjUm!V3LW5Q0-JOR=m*ynZ{AIyj
z%k|H)7(IOU{C^f<m<IdB%V(U5k(_ih(a|g|dBj(Yf?m;t^Qktk)#iWu$Be#9(vft7
z@Ri02+E!jNZjd|{qPGkT<47!CDBgCQgyeuQU>_gQcmU+nBH7xJb6WDB+#SX2mTXk6
z;=Q9QIX}Y^VQ6M=pUMvJfRqC4j>(aDhG;4T@@q@5V7O^a=;5U#ZDTl)aieRPRkbw%
z$tf#^{6i?Q!qT8Qz`=hGub0twRtZfP=O-@If-RGRJUoirxS*gBv7TS-r%wX<nck%J
zcUz8gO=Zy~9Z%f|eD77<lZn44ERrxl;)K@??uk<hc6U}T6}%V)UStm|4#o6a<cP5%
zmkuB(Rk#~DK}zHqj(TK5t;)AWW@*Tr63tvYw|9H{*-GrI;<kUD;<qg#ONEw5r)?EF
zJ3&6V-t+5le_EfPAW~}zmJ|a>kw04kdy?uyiWSjL%U~(A+EF;>hV27-wDxYlQ>_U7
zz44iCH`A2C+E*#unsYwYLuvKel#bZeh+`|2P(dP)22*ALgm=`I?+t$W*{=q7A!E)2
zrg|yB$^aR;z0rS{QL!xRR<PFuKowC0uJ`kzt)~JlwO-)ENJc-GiaxH;eoX8PR-WW`
z)I#i<Em>7W2K4h3qmu`+9QWD>Uu^bBc6z(0$nzEYe8VV0B!)RVeU@k1C6s3$rBbqd
zq3omiKE!vweb8@~9sRN|Ig#N$S^oP<S4BvEk@0Dg9r1r*C8lCU1S47SBZUvgGG!Ym
zJMdaMB2A{Jq0m|aGh3iykM&<Yb=`_g5M)1Ofg;SJqC%c^*fh5#imGg{g(=g_i9=WW
z<RMq}hWs;8@8mjmshx!f`AN7|rpnfHQboFIDjqDZXv)n6`JZys8E~YN%#t?II^S$1
z;ouN`C3}Cvc}zj96IjN|2uS(CUpd00jw3#s>8%n@mLC<UuY0e8^gV=*Ki2{-BVLvr
z-qH0k3Pe%dfYT^74xAjGcLFkZZx}PUZTTMHrr|2_G)hmB(~ccz?c`_I^i;7E@9eq&
z$@d1vA4yg*r2t3|q6j!PvXfhFD5^(XkE4^vPac0id<h@q@wX?BU%XU$?a`~}kB(kG
zPE?v!^K%iAZ2gF3FSKRCmB>M>QO5zu#pPN;l_ZplLN9wrvQkk(KL#kd^zS(<Cl^}Q
zk!}|(+(?^hgD8WBJWnx|w5vjkah&Sj!h$|omRE4E5c4(qgXI)uf0<7wBNH~!m2V>1
z{V#uw!`u1DmZ`ynU6$#`44pcev1{dPz+<;&+3>wl{T;aa09x9T7*;%Fr&D_uck>26
z309F*dm4J9+@0`p;*-NEgn2aH70tsIhU9icj=@B7F_Be!u*s1^E7gufIa3l-bs=FO
zGf(knW|HCuL)DaD#PBI2$w+c%q!0lbla_x$+rT93Vf4YMO4lqe$~oyf&WIyeT{O#U
z<pg`=o7)Mzgz-Mv_U*^)`wi|5vCKBiIb@?NBht(s`oSzVepwJ>Qy?~VzRP}ppX`&5
zQYanmyND`j|E7>%^1j8g_UgjZs2m3M%I^KBB9b%=*d68p0LP}fRFef%fO-iI4f%f_
ztd!j+M7v72(XQ4@0@-1{vI7nElE8@)R%Ip(Y0V0+FPMcXB1Qg9#~ZJOO{Ik2UzKkf
zVfIj`qVMZfxjZ<xt98Qd90xvpWwH#}zE5kkgJYS}543(@w$oy^_sS`*V{UzJg}y0a
zRFu_GxKt_qUas{vmw)=Ygy~ORWvhR#Q+EwU1F(I6qGK1&59Rs1wM|Or(y#Kvw1D1h
zOPS%Z(F94Y9K>l~=sjAabz%eKazUCNd^N%6G;&{CwFxfdZ5vCOp{_(=UX|udQ45PW
zF?Zp>D>Y(ZAcw5@#mT|L0U(IUhpp%2x^u?^Fm7fwTZ%WS*IAamh|Wj!_yd3ANDQ?j
z8Hl}y%6Ir`G2wqDORZN(4riq#0RAP<yz5kIPG2Bb2}?<6`i3*1XACDryW)a9Ut<_S
zww2chVnYaKr4b@+;ht1Qx|OUsv?(XoTF9i<ir*g8<(0sw6pJRT-)qqm5uEQMIA2Xt
zreCS|ZBy>}6$`zHBJV?8Xg+^Ahxv82SZ(M4s6Z1O6n|#v9od_d*X{mh%D}IN)`Ou{
z94FhEZ|{ee`rcBX4Hc)|LgkNa8WS0*TlG^`&7#OSM^(SyPCnJeDkyV0ST0+X8nzK(
zK@Q(v43Rw}0xYKerr#YOu{sQe=LqdR_{HZ1#sGTG>0=;3g`+79|6_lFcKYL<gVS<x
z-22S$W&%bto2}<K3H1I!B1HHJ2+txFUJj<`VZB@|tCXnTwy)%SN~vkf=Ld#wDlWWJ
zOA?DO*r;3k<K8W~D|EQ;)7|!i>E8*w^zzk4F96r50w8g`C+j7TMli(^(I8#a+4FH}
z&OjD8MTDf-JCEK%Nc?}Gj$!b68dgR3UsoU_U;#iMSn6?uP<s<FuYG9s(~39C;o*E|
zQ^)bNEG<)e&%$X47l!XmDeRw60=1?LNcbWZ?Km;>K@IcpY@QNljZ@UOUef0{3U7q6
z2qebSa!!pht`+{&T_{14mT<t3u#W&-;jUtj@7h0v5Rz4dG5vof#}RiXD>lFX_mC;L
z_ZN3{(5b8Nb<yg`)+4bh`Dp?KCL|Hp6=1FeIGT%r#)-3_KtMjWCHKy?$x(dw7VD)A
z=rIF_d_7+?H9yXnq4-6?^*yr79PFzboRl?G?43MN2%O@}X>&#dxfK8JMDHJj=}=()
zSXX$8t5y18VcdVWboL|UIOi|j-eL1}yWSP(f-ZBzXyphO`Du@}X-UOEOR269;p~Tf
zq<CHbdh+bsV(;5W`0u`~nTe8AOo|cO5H;%n$j%^2=n3>c=3caius$^#2NWR56O+{!
z|1<or|MY49(IZvXeiOv_u%7%j{G)t}e+=dmV$ab>3s!&Dps@vc4`M~`yO+MxCFC;}
zCWTT^b(jvV2NryK$N_|GKG)O~-`kgs>GhzuCWJC&CM?ZMGEFrKj^<F5<tm|W@eyUv
zqbyD@!_k<gv~9u|+#lkeq256!W2)sO5wV~RhB=-(3Y5}nr(%vEhlK<n`o*_R6qo{-
z3-*R;awva-Ki!5}M-Z{`Y(<3!jb9Rr#P;R@jmL2l!n4?dGb`5;(MIAqFgVbw50TYU
z-LOSWr&#}tJ8e0fLMtQ)wa^qdsFqGd@!vkc0M^Y!!Z{yli6V182v5ngm)c7GNrpCN
zqBD#%kNBbJfh73R<FaMzI9h^XVj0^XD0sn767zpY!u($$-82`;Vcne^KYkjsLaTW&
zlEMrCK8Gar`0L=r;WMHij|vv6(1(%2dSB7n?G!fL4G-xa3JRx4YrLAtS+)2lrR;g%
zFhqhJ=%=DVWJ-=5V8{BGnvEHM6Ry(B#&8H#dFe%E!Sk41jVaHoFeRd`WctkCMeD{9
zi6wvG{5FIVGV^b%MkELBAHu(|%o!GSgV2rrGO=ULr{E;^xB(0A_)&bo79vMbQw3lX
z*)@AbufwsG$3a1C2Fk;TOci~=*{c+C!_h}o9})kF8cJ;!Iy+8->`fVoFV)|=USwbW
zvJnvQ^`bK%Jp<s!WxeW3kk3Br>aA?X&TM~Zoq*y81>Kv<tN2A@N|JSZ;DAKpZF4ON
zSz+`pn@Q_oqxFL2E{P_T+LDP0d0KstV)fxlf8xxD+aqpX{WJ#|>%f)Vpz!;2M5j!O
z;Qy(PnY@k7RyQ3q=hNyfZN(0SfR>pO^>E&<i9A1EyLo8`w*ws0kD<8}DPXE$OP_zp
zQF~Hf%==*;_fAfpX{A8vupdZ9X~>$}EbSUsURWCa8301SUpj%@_N)%DLqy}&d=K6B
z%A3Z)IEuQTf9m}{dA1!YDV!U_hIof5GZJio)=7FRb~^NUnE)Vd`Cd($S5J%j*Gr!O
z<;qKjK0?SQbZqs~K37~WHYYcCMYex=*l0_-^Y!VCIc$Sv1s4}$<Oco_UKWNXO}`&d
zf+$G+@;y_~b2l0BL6M-5BR_8Mnx1Eb7|%&NxDZswy3K*CCPR6uy&ZWCT9&%#?@Yx#
zEN-X!>bB7-B4UVhMvRt&r-m;Jd4gwkeZGDB_P?jk+Ys+VT#Zv<+<WiJ*#3XbM(Jt^
zO*qx+`Nm8b450FH+5SM5j4T5xGQM!kcckvlxQ9}30ig%RAxj+14nw5xLExsW?Hw78
zqBWumJVzR@gZSrs>9|}rh7QQLb(R<7x6M+&Q!#yXJ4A1P3kQ+MAU8J}*XU-)1$Og^
zjO<Mxp;Z$;Qi9%N#N*V}*6M%Em5@HJoNhSjKGsV}+#hhyu^ypcJjT*F6bmg~MK*Eh
z!$59DCdyT_3<k;(6AbWgSCw#|perGLU7z?Co!@(Am9z31%Sh_9{t$^A^XrY<$ND>R
z9}-a({q|=SBgJ8$2Rok)irpif2AN73iCxA#H<vL(pOeY(V%nUQ(;<InPvW1O_udw=
zqtlb8FQ4bu`bRqtW~;@%WRY^nZBMq<+<lS!0`p*mO=-jinmD8Jh@>c-s+%}#L;oFS
zZD;4pYxB06%&^i5ZW;09V1&~O2MIzjVM*>{Fy*WwMf<8x$Xe(b!mgQ$1ZxDoCaiKE
zu)^gKg}~a6cV(rNk3@ecBnAzOZ-Uq*G5VQ*g5;cXz&vwv`$r6tb2<94OqC@_>a6LA
zA&lWX*an~A;if5}9}~UnE>;hVhc6x<y?i|U?%9jqpFBT$_;~o@@xQ$~e(`vC^6L5H
z7e|kt9)D|)_O*uCZY82ud1@(2Hk|iPx;~Pb_*oFh7?pN}a9w|o10&)XBe5y4dPbEg
zgdtp&BY`2$g#t1UB0jv2ukZRkk`$_?KI`&pFAbFW=)jVWdR~|x<zmM`Ya9xIT#t|;
z1a}fdz!60ykw&>g((GFQE}7ZM_B~I9$GTwqA8id+%`mQ>TnLnjO!0dxmrJ**o~yRr
z^DqmHcIcb)W@CTUC`;7Ca}B#%_RUz4SN&Rk;_Ab_jeG{}Mg-2YWwU!CDa#3#@h&5K
z9H-5T7#qoQ?hec5y%-8Jb2%N6@Lt7-?D!;6Qi*w)VPQdL!Cs`IL_6FVP3tJ`gZiaQ
zQjBF42BJ|ka!RIaj~^$yLF2H#PVj-!yP+em@%y&lj&FbbEtgSp-br6{x-AJu8a02v
zQsFL}U}!=*oJz`DxGxHl4;3=mRLx!XWpjpPVY!gc)|T7llU`n$6y36Xbm(_gpoq^*
zuzKSvY9-}ed$;l^v@D_3&?iGXgtcS$NFONN6rRdvIt_Ex%XCJ6&|`SD`T0DEf4nX0
zQ}L<W^_G8__)R}-qGaRcb=qN}&Lw^qRp}@w%GMCLb(zk6t7@{I6!H(g*TLhY$J*K0
zquoLAt@p0!&;|%lt71`l21=R0ojZKE1C+9uf&xKIn!$F7WLcD@_NX#rLsoUGxf{)r
zCc?zd9@wLgsPy;6NVeyTJ#i_EG;`adwUcvJ3Wa}Hk}M*|15+gAS)Y8k3VgXRu$4vT
z;{NcFLUBB5Nc$_2@(75_c2`zOr~Xx<114jztS-vsWU7k4blr`d-}+*c4qq%wLWFlG
z<FZ}^MZR81jXU%+-kF$IP((CEv1jSnVE7hNBTIxzBF5qS{#-4ae$aE<RiXzT`T`L2
zO<RA$iP$U{YzQJ56LTugd(q~8r7#nczakeBxuC!7ljr+Fym3eg7z^?+QmZfK-8YGW
z7(_chSX=0k3uSDcrFi1GE>RYz?8*mp%OG<VMu0frTxUr~2H@UZFVgu?)k<Z9RhFKf
zJUo87>52N)uq|g(zP}yUv#ppDwEC97uhf6^^B+nQccnltvE(;dlek0=+zb`}dOR$m
zeQLssjuvLABDh-Yeif`q#uMen-|b3Ttz^@+v??WEF*ZeJKJ8`FT;WO}X<=LKLasS$
zCU+H<lQ2JMN$YDciq&FA-zzS|1_;_MqjY0S)DzWWF02yQekuy4t@TbSDJ=HWGlzc#
zGa)aWu)~Na+O=#+MPTb}f0L0>{}(i!o{-Wr0A&~E>sico%h$&i0oU<pj;!}19Zx3E
z?Ll(DU&A~1Q!cEw;9^@f9doX;bY!(YVUz0jnj;P}Rp)_He?EEk_3^jEN6(%f9e;ZR
zvyW~cd`(XBvueCa9i-OEB$22=5<7o>QxImCVl@*(qnvlHrvU*sn4CXjUX1?xNWUQ|
zSLht|gdS?ct$#^B>2Ksvgg-q^*U6S;SZkp*?Y>j}F&H=IF{d?d3VwT?#6H#a#$cys
zDI@NSiLH&rHPVStdd<pfp$)Y!%}fHIr*?grGL;Zl2Pa2QpKNosQ<!m;;EsQfk!rpk
zrJs<YQZ+N_IGA-3`JznH^$L;M2`kpdw{NLV1jyKBSZwsn0!POWbZPEGjww%>k-LI^
zz<iK-q)_l!rkF6&b`c}TdBCViI0x4CCuj2pE85!`vK`e`W9zSu)9l`SWbCe1=7ofi
z=OqdS_QGQ_W1B?|oxnw`2poS9{sdvrWb-T*LY7CWFM{PTMbi8Td}pQVQ<`*kiUr!2
za_Pk);`@hRhxm1fU%ShTZz52WfUJdu0${NT1DY=?AnBv1G3c2@>=3DY8otV3)G5&E
zmcIXzue||aeQz2h`}kUm?v~|6KMYzQWN4TL86CO^nJn;UTRBNdrFwsADMYOfIgvzh
zzPyIa6kQEF>nC;UrmU!f=>;c2MV^&n1V0!el_=~~{3NDuIFC`hoDVF^Ib;2nR5{Nl
zW)r+R_BWsSn^}vd8bR6VsM-sY24wZ-eMqX=!(d>p+@w!B4wbMO*HOLNd@GY)J!6De
zfI6@a45EMQIK5{EJX?RzInTofk5gzI1)|cy+un$opH_MpQ>ErMfUd14`);i@*j@k^
zHm4p3NDrn~BR{X23#t;G;<8^18Rtfk9OwoWRPE(u)h&??onY;<ESXklR5^iCgGk`e
zyzvKGv^K<v*UXU?AzD4QlpqZ43#k{^Uw7D|#CaErS&-X7wrPLb^|j}B0Kz%Txlmm9
z^>l(&mEa6)sSk-W-h+O2NmdcA&}#vc5#=H%T&-G5j7CYNax1CS;UX0O$YDa62E*;L
znl3OwlZdS<;dqqiQM0A@#?X~21!IB-Cw{X01}~15gy|WZvhT?nx!qZ5aoY<JktM8T
zp5L<DT(PG@Gn{{?$de#8(WPcEiaH*N)u5CG^|2>I)KeK@tT~GFLix{X5LFoQLASRo
zJM6Dyi)-QZ#s`0}%(`VC*SAOaBV-Ho9<Si*evn35q=wxb^_}2GeumO#nxfO$L8-$p
zd5IF62<@Wg817TnWYijNtj@z-tHg=oeDPrzt)e3;J>7q*Sg$I`7NTlIb`)muD~O-9
zg<3<eKw<+6OkKbNZ3CKVt;%NpXSrB;9<uva9C)61Wu~%PpTTnk{Z{f`PZN?pp}M+1
zEbC$9w#f=CBwflCc1W0I6;2*d0}zx@F}}y1snRIWzGt>bjVdbKaJ*9vc^AH`kQ4S8
zqj>s<6TyEoWY)L4hyk2At%u}N8$t!UH+<8gp}yajSA=XRUJh7g^2Z8QDGk3L>)Owx
zp!lZ8f5DpKn;sVV%5`wc3P4AXk$HKb9)#6U3(_~d6JJ8pDvlP5xM<^nmLx=<27T%M
zx*KGplt^t`;qOQSC7CJ8_*q@Np{k1i#l4Il>iK_9f(cTqsV9G!OFiE4Let-peSez6
za^8=in_>}F<7KtVOSceZ7K;)YmuKr$;uO7V^dyT3B*A!ddwKI%dv$zp^!&Ido&Zf3
zomu^4>}xB|4aRZYU%0PI4Ccm_l{h}4@}E_g<@DSXoKwa*4<zyB!w1)$a?FLK=aFXI
zc`bivJuIfGC2_%VxRcsWl*xT$g&Zd*X8B8BKO4q+$n<77{#%K!C_<QbBCXJKWhGqY
z3vpHtuBx*|aT^({vBv;;#6uE($*+CN*JxzoD11z~vnP;3wP2(GHA8pB1@VGt)!_6?
zc2-uiF8&?UJKSlxx}K(maoDk+VdD<7<gI_`VU&xlJeG|5LstzyysdkBQJ)-6>$7FK
zyiVi~(SCMz9z&x##mW8Q%7F|)KdOMp9K~aOd2BzmMCtoQ`Zm%fUV(gh0e{<kmD({$
z+@nI`5Kl+cFQbz`WXGJyjV;GNsj4T0f001Bl;V@|dRi{Id*9TJ*Dt?1R*z4(bE1Fx
znT@GbTc~^a?l73M=dvc{LPji>>mx#{1Abi{wl-<rLR@8GFX%kpvnaH{lY(d2^0XNH
zLSKuA>m`vnX_AZ*Ac5AB-TZAfKWenPPy_%%2lGMoWlIdd4YokO;WjMF+Z+3fXR8WY
zvKFyV+H><NV#Ec4f(~nvs<mW^Qq_M`kdU3Q?t>1@fzDDgvZiam(I*5@w@+{?PHxA;
zOuWI`qf?RmACq#k=~@senanTcBL2?pm(=yu27QWJ^{4v0yn#-8$sZf>**~pY<t7xf
zjjng)jdzEZ<A?B^om4>MZ3lV75VPHY{b{ExF$p9Nx}TlrzUun)+}W}~UhRKuE&Qvq
z@-6=zyR7u9?fdvw3$yR>R?C=?QMhRks?}AcB|_W!kb3=mjCw{KZ8_H*4R}SvHvIiM
zykgFZrUY5zk9)UX`-Oe1BSMi(r&{SM)=G-{iHpk9Ms%+!P4r;gFU#;a0=}AtY=->f
zhbL(F+pqv8#h&&i1@};6klcTbOJ+UN=x>_&{^o4wP#ZMibry;kPJ9QZz7fh3m~1y`
ze3yQz6%j0QFwty@2<laQj9voX;JyJMB2IA}{<V1S_{jRdoZ;m|{|DBVe&>J1=1(8+
zKQ{GP>*iwn@bP<YKr-4^VQ1!gI?`<FX_$mtSh&h@04AGc$!;!eoC<%~1Y|VDU;cql
z%ePyb+Sqj)O-Zq^j}@ojI4&@u+3`QOQSE%p|9-g1@CkXeyrx!~ObG4dbT(XDu%k?!
z0p)mw0LS<e9AZN7^Dx`BZ0=Q?KyKJ}Zo=U+pP+72-(e%0e=Ig|J_5zJvWsyg*~#E@
zihK8_u@gbCtvR{!5e<K$xkRpYn%ge%-aWM`CyX)Frl6#`M5F`sHj_)li)>z=Qjog1
zLKQYVG11yAYwhF8`S^T4CXxz<iMhgYxLOxaSLMaKrQt2)Gl#pV*-CCl-&{%ke_vPY
zN<DRIab*^^*{AN$boEz}N^=b*TsX|cN6(8$bk+3$YSv0c%cOshNIRW?4DZL(2xVgs
zL^Jd$&U17~TXANT;?fVP^bV)z<xV;%U+n($-tLZeNQbKpKi=QnkxqqwKiJ)o`crf&
z{QcSP4#T*ZhA(z!*Z#-u&Q3MHY{KcXSjg%4)A%3+*iSnz!chG*?M`tvE`BO6-i2P3
z7lJif`4^@+45oijSD$kUR+Al^=Hu1Wglqy^tg2jJU)s;#*zW`XKD?p*VxxQgdGS;K
zx=5WA$9-of*=u^j08c=$zh@^&vi&xFwhRm;$4g(=hrd$nj--O+D#d<Oe@dC|cO4un
z2TQs_)l2GL0j8;o3Bp$la!GN}?fUvx-jqQ7`ol83HbALM2RRIX_IknU5kvqF2$WN1
zsd&Y$)TOD$`Qpo?hnfb?+>h|DGZf{_wSam`n9JmQ=($MVzi1``aUJYP^s&!03!pFt
zDL9FJR<Ram$g)A>OesIJ>O;DB7pNr_pTtPZ>4HW(h)U$3ZVtjteU{Io+IZZwtAxNf
zzf)}rH787w<xkpwbbDY6vsxY8+Gu&dpcbtR8%*CYIi=4PntH0lEHC6&Wa7q`c(Ff+
zh~Ic#FF{%xQ#2N8p1wikX%<xUFmRKw6!r}CaXp<B(@M;I9j#eC>7(Wt1+JE!AZRl2
zMM16wsXYyQW}h_($9{z#qXJ)v_uoa0!E^ksw(ayf!9T@+Tk`uy_wE)y2hE832T^1)
zoj|Ryr&tX=SEp(_3a2g7Y3TI3hjRFR4w^0Uup(Hjn>;OvGhuxzdM~Im1eb;T&NG*?
zXzd8$9;E|cAVqZ4O(^8Y?*S!@6NW7jY`^-Pz!uC-Gn2|0#FZczm)lieA~+&8g18Yp
zhjS*^_=<ObpfV?dNqa#zPAvsRM8LmZv9g>zY8S}yyjnJ3Neok6F6XK)Pn(MiHTSax
zNZm}xdq^YG>U!<DGRM6aCcckv@5|a-IC$#D*M@gpHuFX!If>xAH@JWQ=SjBgC@h#q
zx?dh*BYH6CLW%E9#g7T51C<}I`1RjZ(-~tml#g$J%4yIF2G`|m3ZKa#P6Pb0Q@PEJ
z>N?2+kNrvvrWX)yNAt;-D%OPI)=w3C?P5(wn$9}B6NYCW-7^K+I>7(Y#tNa9I;$t)
zsK6I-?J#2eC*>%)wt87%i-{sYn8<JAaJi;%mdu!|QVP?^Csn6ak(h%pHcWjD!b!-{
zITq!AqW**6YabTNvvNGJT2%2;hEoNi@6Ej(pfMiuD|QUz0HcS4?=U&L`{FjxD?Abp
zi{JQx?mzx^2Mk9oP;NsPm=7C<_jDKTs@*@522s<D@oQ{fE`~jF#tYn(-~kNsWcQDx
z{adcZgW5O{Ah8AbNYGELZt)NV&aIW-nzzG$&XMHo*bw93SZuNbN@*A%mM1EV8#%9V
zrgcAY^Yies{JZcu;j18i@L&1NKdLwE6Xr}8-G@wFUk~vQn8J1~>;#xadDn>mv>Ztd
zg}>xC3f!W#6~FzE<q>-Qq9V&;vh?1y;B1iJF(^BcdCl}0e62{pW*QaNW{Ch<=W`-|
z4#ydxkHXEj;b>)j3=nLzY8E^4LMxrbF=)>9*zNroa}SeVpI>X^oi}=Wbc>()DVo>@
zrbS=SHJlDJl;Pi?1L?SO0G=3=9{UWK6|LLc@_G}oe_%Ja_#rh9T7Se16lG%YsFzQW
zJ&N+Ic~eEp=dxZEyAK)p_@*kStIJ(~qD{(p5H?g!vfP&@I_mVA?k#!lI@2?={=w;W
zDK`znA{b^4FdS8KQ3EiR|8UmT1Sk*EQ+I87x2GEdB02rqKknT!InY<#w$H;;MTdmC
z1V4;3ab5y&%Ma@FNZ+Do{9*R3(8yY*rd%glJHg|rY)+e2Kjr2lI~7(M_Yj<aJyb9t
z8rb|qtb-Yu;hF{Dfiy~=_C@%;XdItQ?ls<fJ9AOowkkAP3sxniE`_ar$nX8XPxqhw
z@A|)Oe!uVizv4$|^Pl^F;-PGUDMDAI*dB_`#yr}HkZ1en02=ap*W=4t_zSN}<VW4q
z9_1%}OKLKf<{&c6-v6D}<4xm#D0y|_r1*frd+#`Q+xw3(f{9OhJrjEtA8i~3!hE-V
zQNDLj*`@_7v{Al6{B+q1P%B7;^-r0w|9!^slNRMijH7LDBI>+#J7VvV*G-mhhwg0d
zbmoiX-+2T3|A29PHXg4R;q(r=DGaCogN#!x(tkyFuo}H|bWK_odlMvowgr=PzjI#e
zFx>zA|Infy8frl$gp)`;R!#oq5@1bjaqsgmVxLP0`oZ0qWQxCmEB2h>U@IA9PN4Qw
z9Ez=gN?!@n%tl|;%@0VD$y(X9HX?oM#zh`?>qU5;$w3&R>&$i>+%S&WC{}OBRc9mK
zwA1(aGe<NT$6x-C<0!p<X+L@lqcmPgwmbF7Z3Cz1b1MlLv<8DcE`trDKvWtIOmhkb
zzOTDsS38)`uB{R-4&6uY>)3Mmf&)dT(UQU&5Abwn?<HHi=p+0*^xb<<e7^rrb6#ss
zf2r<#bCMLFtV92`NI{M^A|1ecy>^ZUzP202uUoC_R@;5Oifj#kVNEX+Z`ZOK{4<PW
zH;1R3UVzNwa<;RRCfa0|1ZX%(nu$^-JFsAV+CtKh3L~Lz+3O%`Vr+LLr>qwBz|0=+
z)?6?h%}F&E12yYTM_wdk1zrbLuCmuz05<(XR3<Uv2_Uw|<Oq3iR|-OuG9>HpjRwBJ
zxE-&=f^W@3Zb@~2o4FW!BRV%mgmy^6Q3@a!J_;W2JxgmEB|B6@0m%*?fhYm!BSP4=
zC0&fA5v%wj1RL-MBFP<}tB|9CFF>jQryntakNa(iIUnkrkBVn6^7jk&38@-@dcV&l
z63OH2G`JymOVUv`8jO8nvH2c#<trqq)$v)wIG`a9&vo^G??Sz^yg(JT!1`SZCWiW}
z%VIa`GB^)_FVd{6UIlfV9mPGupsBMly6DuL5L8vbdXKBbSyHJp+|owY^s~2%`gKKc
zy_c-$(YmK;)4XmifqYta(plup+8g15;5v_()QG507>^oXhO-@+AI`CE28ISy_AJvH
zab);Sx*yPgvl+x8l}^9iH}u#ScE~m(hZ&)x?e|L+yxzA@2)=CX=?R<3mrSPY#nm|q
zL%nTn?tk#Ilh6j+2^Zti+napoDH)g4yx85U2?0#-^ZYAO6F~(m{Y-Y+7XXTx&eq_M
zOk_yv=69^PV&rmgRESSqAQI(`*SB@uQk1dDJyAV>M?vS+;qw-TkffuY<L3pvSJGKZ
zjlu4X@_UCtJu80pv!e5B(APG9g!cBE;>Nco)AlaSmg}-RV}p%PPCoa0cKNqOTxT~9
z)Gs>&^)X9u%h%v@GRd%p`!qlBTAq%@q&}zrR56WY7q?r#8YGe%U%lnW@YNz&C_%!6
z5$k||G%)R2a|Mvrs`+zRj(#w=;oK44lhu+%L7_#-uLYK1!`%T=VF*B>*eV`qh_rb6
z>f|L(eOaFv%rnDW%*>FELSG1IbJ%NK1~e};(=Wa5QmSX5L)eG(PXB2=TbMw%JWK*1
zFppBmjw&Pz*DIe-MSQY9w#}pD+G1LIF=i8gdVyL7Mpjd8MpMwdcES?lCW=>kgOBgS
zMO9c;zZevv;Ru)bigP;=oHjimwysi@O&4lw*@{pu*xijoYBys_EawXAea=8}y^?AV
ze)OfNAXLjPnvxJsJT1e#b87TJNbH@&;z|W0Gv4>Sx<wB#9vVX`T0uubooYR<nF!K<
z+bnR{Vipr(AzT0zQvPnp?#<kIIoR?PY&{fJrA09!Ff*7<y`c{)VC!L?F|AD?h9v)r
zMb%$gg)d6fD^%)+VLp=|xpKUs=6y^)eq+#CVD`3=1ufO9vD=$DC}j+WI;=F*Jp#Q8
zMLJ+sE|dogIfeJ`W=UVg{ja|i{Gx+@dw0X11~t&kLDgbXQ{sM}9agrMc6M1#B6*4q
zT~-;*hP2#;oZL{2G!-M(?-E1ZGD%}1#=*TI)@wV|dB_t#*9+odpsFi;a39=I?S3!K
zTWNDEL?`u%c}`lqAcusOu+R9Jct&{Ut;*zKNmhnWt1ubc!$~{(kCZtYw^a#$#6+va
z@0zBorA!9eKykbX2AfR1RpH6kXa;O(H;N8b`+B1GAY_a~eFJO;zs@I6l4V%6zCqFz
zE6<$rmB79vs6pdWORbFG`Z_B|(XmKYH+dp5Xbqu?;Aq%Nni#S>T2ojB)8V8a=$KT{
zAZe?wM^Xyu!P}&=DK)yR>0TFq<eSN9O8TK>8tBs`cGL6f!V6`zq_n+Tv`);g`eIJB
z61H2<aGF$>vqi82MqJPHqRO8c%wDAxfK!1vR(uXiS5Bsiw@9IpCVnLp6bX7&!rE?C
zE=SLg<q%bh3KgdhITPBWxN>b}(xhr_V!P{CkXqzMS)1c(35CSRJx-&4rkS_JJ15V9
zy704X+c<?$VGRR6-<-5fL<H-%ZXD@D0vwZe?Zj~rz6rg%EdtpbO%sq>iPPcE9lH~J
zy$-->wZANt??tfNUAtQlLUBxo7dBHSEA4XlVYJ*w!^)4QlYr(U&w}r*RdaD64mo)`
zn-uy{pa(4)XPd;Z?j}rsqSrY?f^9y+iRpM*b9*uSa<K2fETSkXb78N8n?sS246Buf
z>rC-1`qf>J2kw2QCt52$mC^bj$dzS%(1PRKH1gqah&4OBcW?C3BET$d7XV@?%x2(p
zT2&$kZdy;iL%37Z{Xtp%{@uab-m^ChLFcA#itr#m>h=&K_0Hyh=s<>i($@GYGTHYK
z8&chWb7xHAwi$8Q2~|7z54brvtXsCmFMMa@yFuF{N=E|HF`PHUc3O^K|0B1BoL3ur
zgWviA#|LhE-{FCK{;@{~da!YD;K$4@{UIAfk)!eO&AUXv-Q!#6^`}vbRxRguL#h0z
zgJd2ov5TZ&XJiR~S);fgwI8}0fx656Ra4#gA$HAAP9J7B*v|2~Gm^h6ei*-Z$mKS;
zsLwxU(~Zi}w*B_2Uwn2qIgF&LK(=1_civNnhli_rQJiqwG*ZfOP&}{addtqv>5bQN
zn6=M2L_@tX*i-vPICWmKRH$A#kvO&Z(svl1sV0d(ZF}E;<u>soxn-}at|Z!Ar)sNV
z8M@fmv~3dcG2guWA4v_}_IXjVgjb6U_`Zj(AXIG}x?mkYE0_PN4%?eG(a%l!lr4WO
zlcK8p-M_N{aCbzQIa+8Egk8f4_KA?MV{3{?9o|&>j-SOhggrWMR#n)Fn^!RuUsm9_
z^x8!AFriw1{Ul;q39eA${z^IG9h}Z$)$oiGCCfwvT$8J1DIPQCM5l=#{ykW9DG>eY
zs_6rUmj!B4pmVycri$e-BN*{!Df4GTGoQzG7^8a53Rqb#sWVE@yWj<wHFK~>*5f|D
zy>GAR>nr;3r1Zle_8Bqi>)_G7FSkTrj%`#frGy%Psb4%|!2oKsm-U;lYz`LdvuQmp
z!u8kXg{}*2j^H%rakI8hW4ubAQDoueCy#-4r9WTH!dG8_%kR41Pk*)E!S(IzP>RSg
z7ktgIE`uno=|sl4gRgd6>M26VafS^yPS@s3sq@=<YcJ*uSpaqh=@(=`QeVujgbAxF
zCk5bt(9bIP#p`xPP|rH7sB&pF73$P{QqImMC82kO0A9_~_ApG6%rVn9*7X#gduJ7(
z9DZ`F;ltCaCE#$vE-XI;U1oK;K12PEBwjeyQ9=M|ZYO;m>cYruXhgJvNGuQgbS6oN
zs36XY<DV&5en~{XH&R<<9@WTn@#I(nF)iSKce_~G;epYWIQp*VVS%pO%aNXP*BK~_
zWZ_u}aJhn?sueySmTSqHuHM=oZ5kLSFack~y1qZ|-Qpkkw*uzGi(&0qbUTJTd>q_0
zJ&I2xrN254VV@s(b<(svYvW(G=K6Z(9Gp#?vjgC%`aK7+>HWi4a|h|}D;5P#{lcVw
z#}HTyhXnv6^#(-Nd}zo9$cXFhJ9lpL4;!e%;`EPF+~X7Wx}x)N34ULl%*(QM&%eE)
zQ!c)&xDu5wS{8KY0S6f-#+eMP(hNKEVa~iO(%cRZFSd0+^&mqh)dpMdhqH-CnDs7^
zugCvlp{agV=m27HN)+7%^3*-HMSA3a>pnUDxHx|ZL{QtL3Zcomub}W;%xj1K9{B<q
zbvRMM9_q_3>J1TB!e!oh%Izu=(8LhO<gqMl#8{dZ+T-=k&e7a-tmJ3;{P8wr#U%bY
zE9StQ^L4%YW_|X3cG`ZXAx*>0&GLIND39|dI&G$qeo%*QxI{!s&=yNL#!#()fVkPL
zJwhNuW5~Cyh3jrFovR5MSy_kFj9FFXEXLbdz$NkRgjk2`FMl{5AzZrQ=8I}m`?>#M
z7^bP2*Rne8b|E~@AgPG`YeDs^a{9W>0K8Iw)y1*_S9t3PoTY%RCd6h;bs#TN{3$#(
zYt&K<^ZN+sftppEh_>dOC=q3UF-flHNa)5}1eOQ@lkTw$*dhBfNXffIja2OLF8HU@
z3A`6vZ@(7{O!!?3I!G!557QzP8DVI;@_7>5y>ka3d;K647S-g=9lra{oem)d@bSVm
zqc%2<@scQKwDH2(FgLba0W~bgR)?Rkg-No8^-;-QpjD;%Q0V%sC#D;JQCEe{$S6QL
z^s$T;*>E5MBJ4mdwreI^&>FvrGELesU1Kk_3>@!$W&C|@+}504rNa*PS!7<TEw#=v
z#}k5<FeX7qj@n#mHOwt{!TM)D3rNwRS_{ym@Tth(DWS`>0+k8Inj|rzVYa%;1yj-V
z3`t0&j=_vVTqQn#c(QGOW))N@*Y1QR$VNj_zUbb=nWa6ALmg=wam33zWTZm#%*RO7
zIe&+?F8k_hO&UmRT9f@%&G1kw^*-GjZM&7sQK0A%-V@HQgx)i{tBgK0P2d)kC)uP*
zo#I&Y;3T6>Tuu(ImSlQ#f-+@uVSbLWK+7W5#h^VDHw6Gv<{)5yk^CrQR%aF$RxDwD
zq;29BHWT<G9H<=Y7NQ#e$(T&VBO0_e>`WDH7z}?hc2oK$5-prUCqWJa!S(sFNyH&0
z!2g{cF6wRp^y!;}Rv%v2!+EsEt;wtEEYc(-i$~aR+X@*^DGjbTYGPWO92TPdkY5jH
zLX0BkKT4luCebl}!Hds1?!^z(UZ*EgXx%mpJC0qEoe#Rn21PP723<z;o4HHPG@f@p
zSOQzmnsG9FGAXPP`<L~~{;3J6RI4S)4^afucfy~f%X@xA?I)=Z%$&N)rZ2Yd{C>rr
zV3etss<eSiNELBjaR~jlaIB2;-gpm$ysI+bi1hM3BgzziejQWvK20ZNf|$kosAVK{
z(?PI?O^JhF@{b5kK&XUv(MTGCHcwHXFl<_sL?F>4v1v;sa!?!<&tDXZeictU=jTi`
zjEBbu4<8MRhe@ABNrtPM@N$|4t}V{0<wZ5g3_yA2d@3j_W{CQl&A6%W+<75qCYJ`B
zpFw>U3wI`eSWYAz3jz-i=TI=>5>OZ?$tq`VEN{TWEMm~^B<$f!W`EF8<;rzkrR+#a
zD%n?}Qf~4loRX4~aI)~)C6Anda`GEePNuFnn0<*~KJtg+AWnsn`~ct-)fjX=1Z_-m
zm=fYrhmoeiFvj`1xQ<5Hbt;Q+_EE}8^5<)xt6sr>BMhFcUZTs2tIP66;oXlf=KM1y
zAMOx!E9su@eh7#DLML?dJJ<7IubC#o9JfWY5?nWNTG^usHj#%>sKmrAu(^Bkjl;c^
z-9DdWE0$)wtmLJvOf%1H>Jx$N$HL*AI~o~yC_{~I(T8tH`tqqXDKV0xWGKVo(b$&=
zIP~a$YSzb}{V-#FeeX!Z1j_%7wqFS!Gtg=63rwUSJ1;c=`oe4c&aJ7#X73gkOWFZ*
zXkgEvw8KC4`3rRC-NMCubH^er-|?2vR~aG{Pe3qGkNug57>+4yG?7N}%T?#cO<wRD
zK1@Ce1qyfWoL~u^!AqkLp|MoLZL-ou%*xJx@`vNHkqqIk5ai~5Dk^_@4IWI<D|dFb
z{FtLvN5d*!m&p-XbCZ-IM6Q|NsL@hQAXv)bmF2vGZM?-|ty}b_<w1z7;&H`D6_(?h
zrk*6adS-x^rj4058SM$3>uk#>o*VAG+K5hW0t({_J<ddHHNTWIJgl5)pYe)L*JsRs
z*~KbQYS-^0xyh864COnsh`TcUYbMMmu)>>sjQ9Ic8YsTRJcpl_?i1IL_ry2TgP@y&
zC|cdQYW8F|?-w9UUy3$E$Lhl;#~Yr82gC8S?poMk?}?47bqVm3<8)X+<fey;`P27s
z*r>Bx&y6{Ko2ik)`0P3H(~?N-nJ5Q;kmAckFOrVHX)Q1D?W?;Cb-t@AcJH!OCOyrv
zYzZ316j#cvfw;mIZV^%13b=!D;mQGGZxM8-iuDr)SY{t9N=@2}ogG&~#QWHWC5J-2
zse0nBItN)_-nR8n%8wzHwKqyj^O{HBpR$MJ;jl`Sc3b_H?&uPG0TSda%Jpu4FT21%
z|1-nKWqpE#xxWmeat-eD3mB%;>xjOux;HFDX6J^JNzWx8PH}khiSr;#Xjq<(V}$%u
z+_k=Twy&BU97@MHtHpo(4l7Rdqw$ThA6ufDY*XwB<QQhJMdAeqnTI#`5d1#Cx-5?7
z$_?&Xa(bQ9zF@-gWFu^n2BM^YwisoeiLxxhQjITaOJS8hTL3ildfM@!x9Z{$4j=cK
ziBcI}V35c#VPBE@jIJ&9?P+ccoo}R(FrWM5uFpOEzq4Q@9^Ais|3UxWz5e~XeVNAt
z`Ona&GiBiEdhl=Wr~YPjAdRmJ@VKr%IUMip46U8*tyAP|{O-qwo~UGhg=;iaR*bjY
zzu_B|*l}J~pcxG2onFD#u4gD5ONxY?Tbei!=Hokheq21kyG$LE6%tkqiKT92y%ox1
zfiNkT2oo6TU0Tb5qjX~wxM07}si}jwwe5sc+FdG^UL!n8qUy7jbSV{Qms^Iu7mJef
zz04A+NeWsH;ioJcVeut@`WIm6P`=wvo0TRZdCmk@nlhbjStyDf8#eI8v^nzwMKL}o
zb4Wl%;?wz?W-2uh%c?3~hh9fUA<-*9d=N`byxUnFebOuG)Fv%L@}O1SZ*Rb}wYEN+
z0g=SP7O>#<QwLaSqGBf!;Nh^@t5x!MuiIhWfvr`1pfp`SO_YIu)%ymd_A$}yTB%P=
z*HxGqRUTv2A{;>qRyfF(LAY5?5?KHV`l2!(&9KblLE_%a7#eimxY1AjzEOuXa?L=p
zW9$d}TT%k0mC;Ybh4vIy<ghs(hClv@YTJLs-mwT_JzX)gDknHI&a{tVIg33{2jchD
z^<cXU$AoI$($AQGeA}uIaC0}sO0Aup(|2CKfta={_m%2pi?BI8N!d#`TJog8NbFWT
zM;hO57&ffP-AG8ayLo`@sy~J2MVT()9ucLsuFahM*tcxC%C^8wEDxO}EKIiDj&-tq
z<&?f@>>`cL4O0ODr@UdFSnWdGX<{*WTBq}oBUQe4tTerU|3?@pydfp>%=4p@u_E18
z7^*EFXKn1hYZ$jE2S4a(bJcXunqv3qhKR(2zNCxY=cwXMhH_6O^8R4=eW$slqe^*Y
zB(9!s%YE<B_$tqmZPm{Pa`%SWImt)utIe5u=h}YftZiv~H&;?ujNnut@cv{4btO3f
z(#Don`QIdezbgjalcGb$-m_}ev5{n3hFwr8B`HLk9^B{|`3P_J%O+Me==w`S83<ON
z>Ia;aV)Q-uTt9Xge#t5Gd|-pQ$cU2!f<JL&wUMDUvZdXxNslmZR!)4cc*rDvHU&rO
zbRGC|ye!*ogZEC>xlOGYwCk#L!3?S$_nK@Ba8^uzSBj?tUyQ{AOCf9q;;<HH>&rrC
zh12#f;bPK*+FUYVNhkYot|F)2y;U2g+tDNVsUkkr7sWB4KW4dB-gG8xqFa+lYQd}>
z3Lc4Vk6laKdvN!zq~{{OVQOR$`ZWi&Gex3NIc0N1709^QWNcfeBA@>2&Es(6T!zP<
z)Z<`(hEg5>sJeMcI}TmyPo;%^XrYf$>|c_M1Y=2rnjl%KE50j6K*BIKOU;^4g5JAB
z{y5~1Isd5dtUhn)>vQ`gvS`utx2YVTrvzTC0+*zL6reFJZjT@&drUzQ-r0;@PZC2v
znp|%`@7rk?|A;2Udzh(sPk)9A@^N2Q2WM1&DiX@1_veP8O;DEf3%h^>eVWs&=5;mK
zrUdJ=db@z%a!&>SFHxi<T!<JLxk@w+OR(HMLWg*Uu`%9qz5CHzUTCG?%=>JmFRkqB
zOc*UkJ&$2*Yr{x)<I80erlKuPJW&<Djo;sD^%?vE*;C@wjK+0mj5sDN3E`j&v=7aH
z)f}sCS&ge&!;>?xtz@!R#?@jsvD=zXcEOm72{@l6V}Ou7EMtVjqj<dW2KDVtukf1I
zv*1rpp1yqkv2)YTR*U@{BOfR5MY)_1y-gL-8&-nN6xQ4}87CA{-b3!QA9qo8*H9W=
z4V^sEY%8XEEQ0wOMDWy?3a5)1(P~J4-n8b_VWQ8i?095M)ERbZ*@nG)#VAz}Y*5)I
zX`5%|<U%uNv?*Rp$i5!j<zmvM<H-JJ<$P`sD%&5FML5`^c+e?3ucoay$q8>_d={q>
zgX7Z|lkB(^U>A$=)>jvM<?B+nPC1z%(R1JB@P-ul<X#*|BHkRa6Z-7EX?*H`3F@8M
z*{3yByr2Xy2>a3Rvu_mf-M8VDflyZIqV#W9T8yCeZ=V*Z%3%&ZtQQ@1aA=LF?*Gm=
zK<UrCFs%}|^JYR7i<rx#n{VX##~;e#e3S=`+j>L2%s_a?aV%~=L-p9?pnm80k`zLm
z<gJhABPZ4G9JSlqnz+5cO@&8)pI;p(2aqb7a^8$PH|HWe%}XL7x=qETZaE%;`S?R^
ziW#tv@|B8|u>QK<-?A9n&?OT7c9z$=-nOuCxA_46P`CA24dy=-S8AtOpW)9Ob<T%3
zwbXS==w_MLL$qtS1Q3M%K)&!>@d+w6r@@SB79YwseoOA&7h*!;<J{tZ+mw&)X>Uz-
zO2QJ}%zC?eT3rYfZbY=T#4xuA#bFck1T`i56HP<57FR)R?Oks=wpyx|nV1a^5nRU2
zLh*X?Z%<;jxTS$x(8wgc-(bXHN%n>&B&jGy4dcprW?!haKe(}v>e99sT6oVl-69wy
zC>F>v+DlkwEkTOCCWz;MWghO0cyjPWIPMWYN)Gup?Fg}=v1W4<;_SMJ>rV0zt`+Yy
z$v`a6z!*MG%*)e980VKvGY&TNmN|_dVI@ol=*^HShv@F7kJjVYQzT4%coX`>es4#t
zbIXZs%kwl-I<9?9N%7Gl(O}Ryn%0&J2R`9071iSe18EeTu}GzVEUeS`f;bAjbR4xX
zzyU0FO`hzk+jHw`*jPT6&4e7OAeUps;*z{~s^CtR%>ux;65+TKw7E)wGs@N4HQ}39
zX^dzz3q2vNP1z=j*TJ%^X5A)v5jQo-lo@jAVsSFb55)|Uo+e5E%^dRNSj)yeHTbI1
z-Uq>BlRX@R9ICm0hy`@A%8Mrz4&w0?9_%ovC$gbQDY;xC+Ajyh4V_F+q)icYCS^dw
zdvdhCw~^xB?fvinw)-FYw)?l0$Lq#h>0EIttKuicLmQ{3tb|sZaoT9cgFkrqeLh30
ztl#q)dY64e+UIJv0QYW+aj)w}B!|>0$QJ;4Tyg*e@=#HKK(CAEUBN0RqHSH-D#5_P
zLvRJHnzhC#y(?B&(8DWy&kI<j^atq$*ds<Rs2vpX@f{ZMCCFM?0Cj0}d+oTIS8a+N
zXq)2Zz2p*te#nO}9v{7YTs%5@dGzJc$z#t=@(2Cng(+D+y{*P;KxHa}w?uHW6T$$;
zMTo+==ix+u@4z;3nYeR8SFBsZS1+Cnb{xpoTVMuRtiqt(so3D7?sCG#k>w39!@M`M
zAbX<s5rncq&`%Py+n9<bkr-Df2i?XO7sChyh&K%vR})ocZDsJR5IG%Y(_ZIGBk|Mb
zDGuk=YJ7?G-xbfLsnTyK|M$)f9~!!E)jxWW@xbnX6urgjf-sUdDjwlOj;1*9F6h9P
z4}u5z3^@R3yj)&ya<PwIROj&872A5~12DqwTuC9Q)HguxwxM6uT&ypfBb*vGY6_@Y
z&55-NZ*Qbbmy(Wl&5oOn$-{L~FDj(!d}7dnDo4`Bt>W>^Clc6X>)`t(y`ZBHeThO~
zQSc^zX$O8+oa7~^c7e6hQ_8Wl4pd81q^P{pR=0w79(2Uh=hjQA{J(e*yPf!N4=IWs
zeHnA!+$akx^fdfcEyJd)|6IMJm0R&PKD{qlb0SnHqLw`g(oSrTd&76=VOqCM!3T|W
z*^OmD!#ri+Pm&q#4>byy_@vRj&?vM|ZnH3dz*2(%vhQ#nu==22F&yMpJp&+3uvvn3
zK5nM#*}RV&+^MzGlfhn*i(1l1g8|9I51Q0@?J3TSk{}vyn0|-K0E9E9*QOZu<MP1N
zhJnOwC_xl_QUor-!tF<x=i=l6qI^|3V^x^Wm6{JMAyjeH^N8+Q*btYq5}BZSOxVhQ
zxZNu5aGwDwujT5ixD(=-AXyj+!rp3@5IZZWZzGAXO+M9aMk#Zktb2l|C(&39`!Sh1
zC}ubX<}84kbJy%WeoHH$SG=^v*DIbh<z(OXktU`+qI^UK-1r*fj;hPWWdiy!5Bv6Y
z=-Q+%2hH;00Dm3WQ^Qi88eZV3{bKKb(b3oYkpzaBqKsoBP6Z7|PWhgpZ?ze+uU1E`
zSH!fU;u%ExVnPXu=dc*l<#67N*KGty>8=A9h=+Ww06^JD2yWMetJKyHn$97>vFIJG
z_MCWD25_ftg*byOSN8Y-%St*ji(qCwBDzTFAKaJWSy%_5Pgmt~;v$H#xI1@$9{Wm-
z&7kZ;7Old{c;8uvs1D`RPe-ZPxAI7_&Mrxm6;`Ki53|fr!K>io&VWm~RLuak;B51@
z6$!VH?jEwv^D{O3SuDLE>adRSnKA!CK$^n2RL{u|AgMie9#Yn56&7BDosKY%6<qf0
z=$n@Fi#3)FNbQ3OSg(>);Y>t-OUH1!tiY<K0UsUyQ;9qBRTTx&bz$+w_eCN1y@%kZ
z#Yj1$l<*1hd-K2u7M|phb`~5QVbA<0uVWW@%a>9x*cFLRrV`r%C2)B$Z@`zEXh{lR
zfXo+0fTX~Ep5i>}hP8=ca?(PzuyG0MdIW4g=&UUE%IV^=+&^UM`FIL{jk88EI!_=?
z+2`S{QYGD;mi$vo{eYBtqjchX9dSK_44Fwvd?ZYkAZdOs_d+i&tI3*YYfzY1wTiSq
zHMPbEClxrkJq^8XH}ELr1J4!r`v1?~zb&_QZEK_0web{VL32+MS^#*GWSi6WS`<Y|
zv?Wm{Da)RmE?^KCB!>lmV89pvDcaVqKR3BZC6&s~f00xrwJTMrO0H75%yk}Ry+HOO
zq<!ts4+8*2$)4-*|I4-36an<nM?bXQdOLp2-v~~U2(Y&QZRH0p<$b#gf9X~4E_hJM
z<J;VKpbimN2d(jJGRF0OnU~0{r;A6kBihMBobM}B+8BNm$}=&4(`lSpe*(>h^qE0k
z4lD28l9x-eNrni<JMwpn9%wY#hgAu}i+gy`SsX{%)C3m3lFC^LB3_e}hEz?MCmL&F
z48@P?vksQ8BeCz;U2WL{+i!t7S`N#jRZLp)sz#7KMNNoxywIBGC`};gD3);j7fUrZ
z&cS&n;#$ee09ZeNW>OyQRe&GVb;$>zr<ET#zakQ?CC2}f?sT8B^#)=UBHr}a78>d=
z=S4G>nS}<T10;aTeP}XUfUpR=LHH2nBd(M*S#^1{#3Z<@hV><{9Z49spenHDsvsN^
zQO{)`*#4jwKTNQAOHhMiSTNRw;o*~<R<aR|ZTciI!35BMm$!kH4Y)m$$a)Sp&QK%V
zBIq;*gO-#w*I;r<2&Un`X(!JyZ^cqg2W)!=ZxvN0drPOi7UadrK#7Hpl7nYEFGEtu
zM(1EIVaSu_?^%xciSQ{eK7x1jPg!tmG&vne4V<`x;Ta-U4_S27QpusJ>ghY>V9@zJ
zgC)ls<sE&0LAuUhPBlmqaX2!Nhd~@6N`Sa!-?<Rw3ehY~yVWEx4^BkxCQTT?8kC>%
zg?6ZZ$TaC5?LFJuJx+EHUcES8y-O23di8u&xL#+2KJI+?#6E5|lE;S!&y(S`Sk;p!
zhX=1-b{_tKpeZ$+bRMj)Kkp#%4=MGafvz?0dVA`BKm;?IU1#&&lhY1XR2NUIK(Yr5
zM|xKV!CiLJ<m-d|7y98eIXHZ@cbMpa^z!R!%dQo|>1^>3CzhL|4NkjB=hOT4Lntu1
zVOIxhZV&NpSfwb=AE!H-vonuh?zWy1T~BhH3nxB)2rieGIoC*P&Lm~pU6T!jA+ZsK
z`rllC-+bV7_9nurCahh)OeggBG%zwwI5O(<7B}$)hWJWJla2ND<jF(FJXW!(tqE}T
z0WrYq#bF5l<EDplM(qs#f*#bp9A_yTfL%cwRxJPJzx-EP2$A;ENaZ}Dv+#z?Mlowm
zrzTONA{0zaeHC_bX^L}P87jSG=k-w%p?=tZ0Xi4t2t+b$-a9@GXe}I?7%%<4q;xx_
z!}J%Dq_H<yZ*$Fo-!We2+6C!7dgRv{D6n{yN(2gC+%I7LVvlF)a<BRT@yt(WQ-;T}
z0w;)t&5^dswRj7sxTJa=_@FiH2bN*f*QzBf-1wP-8PdwVp+`L)ZjAB*i@_<8M<$AY
z2E<&kYHOOY27_qYq18_b6;c-8d@5}07d$QUK{go!6G^X6-awhiF#V~pOB5G}MT=|i
zS)V&^aRE%&E<DZ1LG>)tFsN3A8#lxU&N>mxpH7Y$=4Eefs}mfdKuE?K7LoEXB9Q|S
zLw&bFSzEzvrv_6fsXY^!fpdQ$LxC25=rXQ9qjhNnyhp9(XOq++=F}`QH%rT0ikPaa
zL6wq;7c}OZs@4d80A$jp!YZ+%r(S{TCC70ou6CLFaH|-SdvVl$#gth3x-JUv3X@1`
z%p$N+Kr{)ViWoG^d~tqkpn?;aZ4DJ&#U1v3mqEQ9CcTO@`JfXXACpdJ)7oi&)=S0A
zT$COoJ7ow!RXLpIJnwJ7px<O;J{b(ZrLIwp2p8e0DMV46nw#>9551t~TJVomHwu=B
zIS@*iY5vNDvp{iJNZ+5CSO-_ArjAuCB!Tx`-SwJnmx<UZRtMRlmiJXKJ`7v%NPisP
zN~4ALsV80mJcxY=xu|q1niPwFa@kw0u@{y^JVot>RuB_mRTK6{B1@`VNd58>K>%v0
zUBk_8;n@e(%#pQQ88(c5IKHWmu&x4}2GyMvB>^@cWpaYy<cemv1YwMkMq+syM!UhV
z%e8V#gVO^WJ;yML+?P*PV2|H!YcrSR?=8L(EPoIk?qv07tHBOe8rJ-OLvXUXZ#(6d
zcW1GGb>TB`s&eKRZl9>`mxF&7n~R+{hE#Sp5O6u!Pj{IKYMBqJ$b&4s06M^_MQo6r
zjjX63C$W0o#1>2x)?>_gk{`=0+0(9QA@V)=l*4`CFb9c4O%acnu{}ru_fSJk!U9fl
zV1)%6L?F|^AX@+rCsS>I*N(WZkZMt0p$h<_t*D>^)}wN-8?vEKi_COlNeUaEcP4bY
zJBsAeK}phV5+@CmTMcy7O~yq&nkqPsPEP}u_@a@4I!mJtahxI&Q_#L`KU4F^QAaL>
zL$_2t{Jc0~)*wdf)`yM@(GdQMf%m|cIlPv~sOSU{yHULW7XmVW^^%>Eb>SfEyHXl6
z6`a_N@h$}w`lqrO)qbsgQZKja+esacpS5YRhT+s}?*!HPAAAkP7_EZNsj-kCp-j%j
zj<ap~j7=^(rrRg9X3+=Ll^SG<bt!ZeuBK*(DV(RRCU2en<gD45Xg4<eZ5K#GVi`Yy
zxC~glrlk)dppKh=1`jY46x?Boh`rQMkztA&IP)zIhfDfB`Ys6s1Ll4Rbeb^a31@!m
zE<OcdzcVPZCtdUrp#(h!A8p5T(5K!->g|eUTe)3j*|DYaRmZ+^Os>+@aX2{!tWir!
zf#r5<$qkO?3}daRuik*&AA|gK0>i&a)WkS)k;x%HIadyUe{;0euCZ&9>om~R^1k=&
zrK1q5GvYTy%(|jJEa7OY8Q-7fMLt&b_97dM^{g=(T!7e9_53KvYp)b}zE_aYoHKmP
zW7xW2;88A27v=VQWKW&Syp34Shr>uVpSCGP8fzJ2Q6*vt@@AU_SFBoaP?kqe=&HLX
zu2?>FewDm`)ZsNadseS5UL(P=4<PV99!C8JF(b0{hoR5D&@E9FEy>&K4|-*})#8U5
zjF%|)OhkB&F`G+I?l6S3@~(}FFbby`d6_xUl%2kz0vIC~^kD*VdylSPUK8sYkrF3x
zSGETYAM?<ao$I>e<1FH=S(md3Bbk_uSHieB<X(t>0)r0<5P?rzfIpSu_HXmGQ2vZs
z0m+{*`;BDPm^LT+!v4f&6d1GIVdJzIELh0LIPyfoWCDPOT5Pq#ns@Z6Re59MFZ`l|
zi3R$OyrrLG6WAp*C;2Vv7#G~?O1ZVYwzk&Kh6RVCwDIkVz9r6L(2_u@+Hg{}1ikk?
zz4B6jU*jJ19NN8?TG?w~3u}ucpH$3KB8_+q*Jw!*WVuz_J$U&;vRX@$imh__lGYl@
z@j()<gm~oJ<DXZO)yD^i&v%ZK6@3VU<h!5#XUrtY_34v(z227la8>I;$bWp9cV?6P
zOZQh(J^uWy|I<CzsLB8GKR7t;-hkN7s(i110^iY=$m&Fa)(2+OkijXyU9Glb#2w2V
zV%r}Tl`;i#!H@!Yw6(2p7r%>pXs&8$AUw(f6r_hOU(3#UZozqaGn!W9AYMiCw+x4=
zL1%_Fl1b#}Sl<)Qz$p{0)3a0y`eV4VNBl!MHM^abhgb!-9AYY_Sbeh~M7lep{l<QO
zdo7}MJvJyZjWQ8TwwE)he9rF{{=CHn#LP|($n&aK$t(zM0Hhsh;zDp3855J`4yT~7
z^kzP3(LZS$4A6e!jPi>}F$^H3EgoFXQH#4x=k-~i;Z2%V-`!QhDkRz|zMQs09`0Uj
z7WqQ&1BT!0P3JGI_`<!3TPrsSwT5<oz(GEcO-9`)r{r_4O5poXkrvdE8?xgk=5+Se
zMps!&AR>ngQ0Ps1nMn$I%LxKuxGhmc_h|2!l$lPu-R>r*94SYH1Z;<jbs;zee~>)n
zYH`e1BeTJ`TwwYn<BOx`qWjql#*mBdq{ceRG6^!~r-5x#&sk{MY<j_|oI6T?@gd^l
zTu5ZeY#fp6pX35@ZkAZ|2ozBjLM;|^>FJ4xxrt87A~1H?-KwGb)x$)bq<YoD88{I5
zzJAsRbVWuaK7hf2!)hDJ&QZcRbu*MuT5uspQ^bAu`sv=`9(4gl1YvQ>S6?EEdoNkp
z`26#Gt@RE1KdHI2^Wst1?hD_4?EZW+8&UFb@A&oJ-iu_ty?&p6qdz_k8vZ;>iLyyg
z`y$!A7YPb->8|N?+~Hm>FhE<8huqQ@;$cBRj8cXyz3RA*BrJwp0)-@YTO-fAv~4(^
zJSIMJK5j>ZL1(?a(Rf=-lzzp*V<ks<IMPiBYqT^zQw-DQu@KxeiKbG2o+9Ci3r<N>
zH4A^gh*x4qQNDH1O}1Mjd~DROSzNP3+%dERZZqg;9P}fuw5iwi&2m0O5KPHOc90_u
zj6L<aq3nqfyM^l)VGURSVW`1)HPyqJ4miI+U8!Q&2(QYP#%4*D+jYfG9~#8v>egu1
zZ8lL#m{s4Hx)mjz4ad5Ft|A!$oq?yl(D>U9Mb<lRMd(lNQr=P1vW0B?(!crUsPTpg
zfUbUT5@@Z~&(7GdwAzqbXpBTzCSOXbK?jd^1S);fNyoVgvZqD=n%dO=HmbJ~Gq#GC
zws}^o%FB6Cr8jv-ZZRel7@Tn*u7;9u9p;|3NqV&=Pq8{vhm(hYUe-o*f1l*&NRa-u
zE=}v($sil8>f6-7N3xO&C*IcdI?wgb*v}6wGrLqd1jFaTW;DcUCV&WG;9B`%k!w?f
zjQySAYfWMu{TcK`ab2pM#~9>{^Tk$jIuS0Y68JQc#_I?sWH^hK8x6v9VZ)*J9E_mU
zL2vz%|Lo*_JR<pjmpGKfzB(hE`NcoaMmaH0|Dy?0_C-_wg5RCaYq`CBy#IXf=y>P(
zOWZ%xvbI<UUNjfSyh#>DF!{EtFSLvj6lL{PN=^pr(AN@*0`v{7`urRrWrF{oAfZv?
zoaqKHXG1|MU%LK_SCtgL<Kvy(r^!m?_Z3XNKOhBLGqjF>_h>necOE|5W87#u&pSu)
zO3M22H3{{Zo*&7T-5<1d4>_a<5j6e@yn)4ns)&nsg!iW`H-BB~=sTy^+y{%e?jofR
z&E)Cc4uW;)V##bv9=Wm;#<hJ^EVy}4{wT_bVH9lf+jNb=|I7dSe@cRF=g*$g`(Jfu
z`3vFk{<m;{^xdYU!zoxZF3@UWP778M#>*7cbTQTwc9Pp!Ps&j`rV%5YzPOStaVIva
z=qx~{0nKrI7vFi_iOZ=3H}Ro#)S}z9H7)obEAR*Ch^x|N#6pn2NXM=s1+k!(l_TI%
zyczDKD-u^O3Rt*XNodnYXb{WA$<gkkP0i@aQ0ZuYDEQ8ZROn3#wdLjT`daubU#1#G
zB83Dvm@<s-W&>Z_kZy%_%GPPjfW~O~H4f7BKs=UI9XclFCFoV}=5tQ#@nBZEI0&)G
zvD-|d?L<*wpQ_v4#hz7{UmSZ?Z+J?<H1?N;7KXtlwc5itdd?YEg}wRs#JO<DhRw*s
z5cr6HP+5ITEv-g#kz6A%$!w>FJ~?EKf;}Uy@Ld#*L~O9>{j|B{HL1sr`&C>MJLZ*e
zSLBQafmCf;9Sv3ODHKSMVKpCkv?MBBBxRH0tBO&WPy(?&lfaE?5Jyr7pBi#0^(;;;
zP=CHgbxjPu<$VBZN~uBAJe$6UQtbr$*-j3BB>K$-ycK`{csI7pq;W(W9TSB}rt>YO
z*W*HnJ_5#p;++XBuypIZT;(_i8V&*}a)ke)6oI*a-LX`4$qdD$&uDcxvC~t3H%L^x
z39Oc~$f@wYr`hxhNu`<@a+PtMB-Z~k4dwI;hIG*BxW{q9^zX$Q$;>Gc{QY)XjvLN@
zX}}}fSYLl~>LyR~y|+%pGn&DAz;TnCpVRLMmu$PD@X139T1zy*Ghx6KDfd~c9n65Q
zIvF4s?1HEl%pL!_z(~eVquWHHD!IhrFiXpsC@qQHr3iKdM<>RIP~Cg&x4bf4$?{39
znL8zej8nw%<EY@!C=S8rT0)7{d<?jMQagE_se8T^7;-u0!kYWCZJ~Q`qy3g&<Je<G
zmiG0ON#uYTxV*5-8RD4MZ?Z})5oG>CAmK41lEF^r^WcE?P>9kC(qjn1AT>~Lm)vSj
zh|AUG!~2Bx?yHw<yEyu0|7G&*VE3E7M_nt*Eq+Es3n0oB+>X``HygV~?!U2rvJv43
zlhwnQM-8E^5mtII4?#fkBpWz=>|>bgOd5WVa}t#!e`LC|b<=U(Ea*E~OP=QJ#bj?L
zF>{D|*2sZKO&p|E`Cg_7KA3VbF6&0haJX1{7gTfXfeQzUL4hq7q!2_9NkWFiyYls+
z7t=6EIp9z>U1*z>#oWCeGj1q<QH8kcd+FF-#ijv!pT;TsdhmW^CBFy%hQ1EA*K+Me
z%L<zeiefBIPOeC*`MlYg0!V9chC@4GGL@`ECG)nFU&HwM0tg{rPBpc`SCR_12GZ`R
z7^0F?a1pYRbT$g+CH#y5bUpox^>#cH3yWMv9?wj!xS=F1uytxG!8-_lE)Iqu1$4wg
z6jU3q1fRgJi&BS9NC|eWYWualLW-g$I_lNA`M_>>&Om|uH!Mce3r#AJIu!H+;><WX
z5tL24O`IN8OwG@VVBLWRuvb`*&Fq3ilV1?sHPE_31>5Jq99cqxKErYOVD4BWa}D{$
zVWW)fwu?IhX$!xS#6z)v59E`i>#R>5TEs5+MJ6?_HMFuXb^US=cLfOpvEjCg6M(R0
zmn?0wM-G=bsR#X>`WpDcnBbX;2}Da;SK_WW0}9F+OAAV}G$(pj<N9n|jLh68n4k#s
zy%bYvKANk{oF;Wa5vB>ypz0(w6dFcA-y_U<HicEz$(48&(-p^mjd9)*SPVMBEDYgU
z!^m7zz7&E1!Lx6bbD^(QgA)M@rpN^w4U%OI(L1}bW$ol?aRt?}sqsa*g#J%CEzcwp
zPjHeQWZDZ#0CM1*T)A+2&=oyuDKHUo4+ed$ULN)3OLeS@f6tDhmT)d-;*GsjHUg%@
z#AO!PK{ydr)Ek<A7iy!I)CCD!=12{QfW<E;z=gx*s(bhXUI-VR%zCK(sC(=OiXyhz
z1YwZCjT4C;W83y{hE*`cHTcXqu|My*+Cz=-`f&^<L{39RDYZQ7R7DYSOUdaMnHEsg
z$p?3hb^71JJ(YauJ;gPrTDYp>>}`=^nwlI~8XAH09m-IDq|42O!Tr9Q?iPZG%&S_<
zb#Y~*#TAX_Un24UoJvT%Iy;KWl$?uZ-%%j;we^ltPlr?V`0KR|wmNAYlHmI=*Zkp3
zB;ZHcs6Z~ScoIJ7HJcsr9V~u@3i;w2^%F@}<tw0XJHkf}seRoHh~1V1)*|Avq-daK
z+IOERvOyMqoDfsV`<x%<d}Z2DjvX+=1^R-{xRf^IbE$fS#)H!cs13>czo6wDBXtsg
zJNZ_1H0YTQ?#O`lRiHll_E|G|e$D?p%+K-2HHV;_8Z<ts+h(Wi7p&BlGw?;9vFsU#
zWKCRfsZAF=$_GfP8;nR`)WWnXO&}wNrxq}Kp|VVWMo)~2iY;Vuw9Fx+fX!f#4o~~(
z`=owOqY9F!(yOu~Pl`wHDUNbsCXV_2XQpTMd^nWWNnx+{N!Bny6J|{Dmeo-(LHT%H
z!o@xacU~%#W2*Anm7p#Ko$wRb@!ntX=MI`RKn-1a(>A{7wr{v_!Vz`k>+s?^_V>0t
zsT!<*Tq~=zg0rD9)^X7<*X$?BTvD`Q{VFs-H@rTKL=1rIYmy+b&&{@`zw`YLOP;Lq
zadCdGhp0ZMkvZ^4F+-<QXR=eMUH$k0^^?R(I;Z;Oqp*{Cty1lzH$4YSDd(-75C{0c
zI#yS?C7`59w5!wfTxnV^?woGJlWL3iDyt%YS@`3j#fPG@dz|g1XPO~!1TG-ZR#@S2
zXgYyVGz!EpH9V>z<uaA*UxVXyi0q5@;5a>BwDujE;j-nYN7O+5+zh?*M<17RI8_8N
z#=zAo^?8t39{g}=mrY;EvT8CGNj4I;N`?g(xYgBS#N}MI8sra2Y!wTdI-KY&5ff;C
zdK9}kg6-0Aout=cTw;Y)XndxG1J&j_fY-g1)O{{i-rqi36aSYTu(W=QMyJ|{eE=QT
zbbGdj*h*{FtBV7UPY`nV;YrZ=6^Tqtx?hCv`D*(MEW%e^@kHqa`5++|DTO{tdP>2(
zjD<6`V>3z!iBY)I{XRjQ%qEehil<h8oRF*0+6Fok5Q|fIqeXV%VY&ma_5*9gJduhh
zUrbCBaVa^a6<_L00N4B(b(eeyTMay4u|><w41lxx=Fq|EB!PG$7b>Cp+shJSdt%?d
zf8TFw$NiRPbJwB8*IUk1<i1qIDM#wC?6w9BT2RhT9p0KhAWrmly1d5(Qh?2WG%3SH
zXiF?CWSRw&VSgZNrb`wH$xEdJLDjb+jhL84^q#WmBUdGePa_25C9W=JvYNHe+e!D1
zxh=SY?shV~hJ!#2;&$Xk=dq*_E>eW;vVy>@KKW%6bYVRgbgaSyVUejiNp}P=QKouX
zRW8V08id6V1ZTiMfi*>(&5~+=?eH`(LYFrY`{kC>BNjB$@4|gT7GJdB{}w8b#Nqtm
zT8|hZd6mMoz!8+mir}<sD7wG%T(a{@2ro^#A>p<2QI}(H>G?MZ_Cgdxm(zsj{lpqJ
zO){K+O<m%`Z%O>j#vEPP)GZ^$!-m~_NLWhIm^O@kZ7tE^b6if`&QnT%gCo=T05d?$
zzoe%1LP2yCCAC)s(DL>IXuEc=od8AzCb}TLeKGU(SH{WmJLAXIJGO2u*Q%whS|tAH
z-!1O5(O#ef#3>teS7|=4`Ir_{q9is(2a)qs`J0Y@qdARHD;3)26~r?WjuvT;E^P?5
z!ayjNvX1PAXFk_s2jQZ7R?#w8e|G_g)LY*bisbT;5--i##%wH+Riw$R{{8sMzoPA=
z5!dH_uW7bjJCL$_?EH6C{AMnzBP3ba%0im~*IHIzsc<zd8gJ#B0}xf$S6ZoHZuxY#
z(GGe0eBrpDTp6FBv#=;^9Cf^<XSKtjz9VLToOKjeH+zW`Zyqy-DAZA_f1QM1OUL)N
zI^*!mND_h`EzinDJAbkn*pFyawlA>mBK$9diO`9G!8zzJJWc~C)~H6PsEl(oL~i`_
z`1oZqo#f}|EX7=9rx!)>#xP|CR6~B{Vh52!caok>6`~PAbRX%@MK7!>TQ7@x=5GY8
zv>E&`SDus|5U5KU>anawe=Arw@MHO=Wzh1rOL9vr5Rh|!`{DC~R~P0R^A@7{FjH4U
z^%<>08h1Kh7HCr^-I*30w1}kw4kXy~mypboErB#g!Jrd4{;FW77lMn}E!E{!?Ix=%
zB?U1Y8e<`C_|>R}i`XS`%UrP675>4gB8du)4ky5fkx&~q+Okchf7Mc%w8~yF)(F*D
z(#MMTt0?bQ*8t~`>wbuIz(Z<QHrDT}aU`uv)a1tv8W=EA;PCwU^jd2Gow(dyLE8wb
z3*EBxkW^u+QYCvx5eLdf3?}1#o}N$AVY|FMC;qjpeZAq&kCOJsuc8Ya=Ri0FtvFYx
zI<pks)7x;3j%YzOe^@lV5{l|eg~n8MYLW*Kk8}6#4h@8l4J`>cPBFQAS8q%Xfi+ow
z;$F_Ubc!W#$>CUE{6njiynME^yZ7|q*`vL~Z4wk2MpLAC!PZB7s)fv?b1#jjL`zW&
zPE*pLLx_m_5$h}Mc3VnH<8#)p>-k7pt*>Y+=jVexv=?^Vf45RlYrb_|&8mKgC1VZ@
z2KhPTU^~=WkyoHeNf_XO4M6Ni7<1OoR6OqH_%xpt`}4(&rPc>(I1|h#?>x547x8%t
zvqE|rd$P1<Oe*Y7&{Nuu+SCFzQS}CV)$&T5bwgKqbrJIk6XuWUVXK!QWX6Yq7KCn(
zTryL_LudP&e*=+IFh0`hG)0I2O+f1Ea1;R0-Gj$Cz+Hw<J>Y3ob6ItQ6XZIBSd)z$
zA5pmHXW4m5SD`#ytG#qpewx-HhpPFMKs|%2s^q6b#^a(>AsnTe`>R|Px9kM~4rrHq
zAygJoNsG6E4pio-STTK&rjtv~#M}UEbPQNC9%tzUe_ZqK-Fi5qI-SMJS+`gaB^wzk
z!>P0BC>aEgW4)2d1}Jq2b2uY<ow(Xdx|GKE+m&+iQ+}yo!*lkuwloWrQ}JZ+%vl}c
zhe8g-hI(8<T%T7LBtQ<NW{$oLPGfx?EaQARqT7|yh^|yVX~rThZ)3(=XTNaP1Dqc4
zWdpTme`%QI9t7eEGy53krH98jlSoopL2v2gHN2Fxu}nPE#&MLn<r6vkxGIH_&2Ix2
zEpp#>^xI0gdDl8DGs!6pmYJf9YLWp_9YBrPl#Qj6!Pu|ULUoFW%%qL2p~$jyWuZ#^
z^{96-DMl7nsZcNFknv$k%i&JAh_^4cE!T`Af2VO)jMWZ5x0Y>J?1Zs~Co>ME7^J6#
zAf)qCs&{e=jt26v&PeHNaYR}CSV-$GL9y?9lK@`BCRc4fD8Bs|e_1IwCkJ|?4Hg$Q
z)<3+kyGIKk&7N34Ad{z(xg6HO9B~C*+lby=Tai`yVgfh<16QX5cSN#Mt1JYh#GK7_
ze*moieMKB{*P~@ES7et{)*FT39Ku<8nsB6x)B=Wbrw7^~ilN(-^4g#v983f#{V1h`
zQ6C}ZTW+qUAE6W#c3UbplCsFYliq-D0NVkxB4LMyDrtT5p+|@bI`CM^Zk+vipd?cd
z$LcInI5(?tLf>%oNx&p{%8petX0GHJe{kZ?0{;BL%xVD{kR*$Q6vw~DT7yT27Z0a8
z2G5)--70h9Z#(W=$DAsyt!(Mez9R>_!cY8nODZd-c}Gh$aS~)uWR3mwaP{l$dKMKD
z6}dvr35%~)4ReezeU+H;mqLorpTNu3GC?d<saCB(C5V3T6B!nL6cj6s?Cb(te^BDk
ziPRzhz(e9HqUnXNZYr^Vl=Pk!%mggc^`%Y--zJVtX*CF!y)m=gqMdyQ&1J6@Vf6}r
zgc!tw<sio>+iKv8DM5?hRp~?RKar{#9;Vc(aT*8e6+;miA?-!=X-}^g6vX@kG(YB1
zU_#~vI$>$fS7_r}yzR9I9em$$f8Tdzc^O;$%(NorqK<ux8UYngebeI4VrEoPfmZ`_
znfD4>93)GjVlrZuB%&zjM9XPJ3cxUxC}t-Z2{cl5zoISiCcm>Y98^t`InCfHQW#*P
z1SUHz+ES|>&ABpl7-_%H&b#2DAqu#iXU-1q4K7~1Jp&M&Nt+gAOEO1)f4&>NM(a;y
zEOq)}G;2HT6Rvh)b%M=*?|L@SOh^~D3Qa+eWN9c5YNmB@#k=xxg)cVB$+`Sm^w*WC
zcH7BIToUe8rkH8CbKq?5>d?E=2fwg>m@%f08d2ZWK|%DT8XR;`sq4S4<Fbehw@li%
zvrtKOm)NV}SGA)%YEc^1e{Nvy|0<dPUg(Hz_rfjmvojVuvq`P?odcUR&SMs8LBTU|
zg9-S@)jRxe!-ZC#EV&QSQom}M>55rC*Y#MS+O{$FT^&MCa<Ozz@Vqy{Sh3jP=8dq<
z%yElY8G1&-o(idpz!B?N?~MnVwMk=%;1?J081>MG3lXh@n|^;@f86OyCHqJI^|*fd
z^&N~!chCQ<PMRac?xa#aV|$LH^9Ysu)M`6mNEpLo4N)IlYh8}ff-!NPhSZs7?VkBj
zp|DOQP6g-I37qj#OG#bFM<!bMJB3&!;M)~uAta~kC<1`oxx?X1?1mR<sfR=&+1QwN
znz<27Gqq~)ki+iSe+W~GHI=jgP61RAS_HI^9Pt`)ZlqEp6khp(qPGvzktnxBm>Cx|
z)%(0;NGXvm4XXD{#6&j?;9Vp8j9(CPVlKBiOS#~tknJQx8oy^|kn_>8EI+SAUivX>
z9Jc_SN;u3MeY_MnG~7&qp1~KD^0E_6l>-PXHy(ICL(SGcf9uHC9eh#%nEh#ZhiMd#
zyDhAIt3u2W8IiC$k~YZd9bMxS%m){mY*c2n_tS(cwmJvK-smzXEtJW`$!;I##mIbD
zouI3w?^yVCP?g+c>M1y{ZK*$eqMN{?%)+O$aj==}dXx^aD}2#rZ&^h00el*V=7acx
z;g<m$vs)<qe?1tkYDysjF<(@>zzKeffcmbebE?9Ar%&?kZ~Ap&@k@3n61~O(IP*hX
z!F4D>Lr0GI+0d!FQvDzG<q5s4E@htGXxz|m96(Rn`(MLYT2AXMnX6=rclNjB1&+&a
z#5g%OH>v!GA7sU_6aPW~`z_fS=gAT0bFYbac5R1_fBkPX{noPol4ZXoH$3zo=D%f=
z;57+LMpsvI=@R44nNP8uO$P1%NOVF}vEX}Jlh+4_-|QWB1pTG*RDaponTuly!Y~nT
zj=&@>>1n{@aiq(5=Jl$7t2NPZ?geY|{NT~vvZsQ3ZhlRMoQ<kA!nodN8?+<3@nt%g
z!8PoAf3Q5xreZSC^#Q-tzh`oJzIS}MzkAf#dGzS8`qYc+qSz0sS;jJHLra}V35b4w
z0?|eSojC1{!QNgHO~42@W3c)OkjGW_ShLR(9eE@<5p|fA>p=%OXJay;&u8oF8-M>b
zfl0pe`1$dor_NHCD;NB5An1WE9hGiVMk~^wf9oLLmVQ1PPXB|kmBnmUo`OV20v($~
zE{L;k(>AT!5i;)Tk_BZ~z0k^xMJk18T_wSgAZfK^ZDEr4``O5V`CP?%9~chR?z;VV
zTNJsE7cI(P51v2V-|KvR@UR0Ivx8U1{;93?8}1)i_QceKye2KmZ6%2SF_!nUi3qGD
zf0+ML3{P{%hm<Y%^S)%LWgO9tg-B1)XOO9B+2gB<XC)I64H@#RcFaM{(qwDBZ2Z18
zIRu*9;c>^W&5?VG9Y%|~+dq@vrh+Zw$0Y!#8o!sU=A%|%ad%48Y?k+(Pl1nLqlx8`
z!-{5ck7sF)+v;D9PL7`K?Y-=L`)cpif8N|v_iv&TpL#x&#G*kau(xKqa0;>CRH&T1
zqpFbt^O7?mt-M~!)ipDpqYgGdR!l!&GY6v`hG{?TKlD<5v2(ot-Ck$G-FyR=Ws|=q
z&w*l^)nJ}+dPVB(XBM$p&Q8NvK#<ZT?`iOaPc>o#3z!h#*X2oG!c`YM*bK5_f5$34
z{yb<V!)y7c<bOCn9e<Rg;_7U`&}FCj`OlVWn)Zn9PB|}jRD?m>cw566a2<q2n>aEf
zv|0$J>U?z>Oud>(xk!hOvf1v)gOxyLK%sLbS%JN^92o1jed9iU18M;ae6)Xf>wWyj
zQo(T|9m<pP!=OA{p9{>rDzmehf0m-oPG{%myfpvjx8?FR*?R%-#?Gr3M^ASS_c|~4
zA63_6mH8bV(LSW7NlT$|8`MCf=kd^pxSRUVtbn{mJ;Img;(iT>g)?OrsLyTEu1B-C
zOy&yreU$ZP47-4bUTQ!4_L4bQda2DjZXAsdT#`roN4zF4j=tX6e-=NrfAn6^#w88%
zw0J8;D*-~%c4mMsp6#ktOPlA2<>}`oADO#%on+bNrSA$rF|V;a@W(C5jr@+^)p_|t
z=kVG7^Znz_&Qa(2Lz(Bj_0JzHT!8QL37c3TTw^#|u#O?H=r&BA=MTl~F1@#Or92+7
z;F8z^%triZ*6%ix?ugD7fBwx!XOf??&Py{J^-?<WhiNXdH+q*eCk{*mgH68PKZeH!
zVob@|Jk8|m@18ewA$1!TjQJLecxP1pMAvgmpKeLu7C(Kf_1$@Kv=2Iq7J11E)6J}*
z^4-O|(-p9kMeDnx@I|)3|7P<xCbNHZ@Qkihs4mZTo*eP?S}l$oe`~dd>9{p1im81b
zlfcw!v6qd01hfmPg7oN-UCwESzi2j+EEUgs=teu&aG?bp4&G-vjDJrC^FbWP#&*2_
zV!!ip=lE&Jaq>~Vu)CM=MnJeg15x=U6^bUfkswDP9e9K(I)S!Ij#Zb)e-a0SWdt4^
zJV#jhl)XpgAGkm_e@*|{{_frjQrf=R`ypA~+f#-8J(~TqyvNuwfSqQMQrs0RfX~Jb
z#`fm0sStYX-|roL^lWGMo6gbxlNb9ho^+1(b`STC-)s3`dj}DLK-RGH!|K2t4S*;Q
zPp9rLf2K|3>QTC>4x@9Nw@Wl&h)x7-AY@tc`qxMb&(DzWf8VmO<rWNUEq<W!_f%AN
z4-UQ|rR~wd^PT+{x3vawC`!Q|Fc<h#yvZ{zgDEQNv>ANw;<X@ds#b4dYEj-eW6c$l
zoW#AqJDn_FlSg|m4r2D<pIV!hlQrTJYb3=N)ioI#D`7t}{caY-|0qW0<!9&R564gG
zqTy9p#TL8Rf6T1kuytX35U-9T*ljIX7x~4l3=s@F>P{pjlVgjeg$p|nwph*VTaec$
z58jcUTJp(<Dk!{))_7*yf%^Ykb#6h?vS?EWsV6<P|88shWC^uJ^mbm%pTTfl&;O%Q
z+xyn!<>CH!z+Ihx>PAP8e~=U-rx00TPr9%!5xPjLe>E%sq*(q3Ta$zDe^~g`d)EXH
zE?SZQ;B@k0@Az<c$x}D3$tasndae?$E=C#>$Rs-lLiY84KwjP1J$SME>hN&y#W7v&
zuU|Yn*m)%S!RGqX>ricE!}M)FoDBm@WIk%04LI)8=R+8mMl2pemrINM3G0VDU`xqr
zmVhOWe{ucSUz5cQ_Wg1W^Vmf;7GMZTf|%xK{n7U2zx$dzJ$SzNQEPGmqr11^>EVH@
z@I+k34>^SD-|70?XtT2T0y;o1_I9CM9|d;%RS_B+Yg@^xbkZ=tar!nmF}~PcIR|$e
zRPh@Z#o*t|nk;t&9=&?GcewND`TmPYXS$h8e|Cr}-ed|ZaaGI)eE>6wPJjUE36Mf1
z?(9-6UgeDVMM~^r6#V(mVZhkG_L?kL5!CtDdA+lL+&SDkdiCtsJ+*l||BeFa;`A`!
z-)V-JMdv6~jc8>u8+Gt|M{)&LP-$&k<o`x71~;7@_8)b`mKLwed)P_f^P*D}da@J*
ze_K{&lKo^+@&R78q*1WajHi~bS35aQ-=N$Mu`N`{>}9sbQlK=QoU8sSwdWLhFY6n&
zGuwO$G4Hi+%TJ(6?z}pF+BrV>X3u!Zd(Ms+<mR7+A0RD-Vw@vO5elW?F4oW_n156G
z_BMV2B9E5`uva}hcye?L9}*(|#KdoCfASi5@ds=FI=sg;zNattj*f_!k9VIwI(XuS
z7RJNakOU_Mr9MV5>v5V-zc|0Cu#;=uvevCEYZ&lZi%V9KW;+O~WtqzACcrivt|8Vz
z9N5vzon5T#x3BgO_d1?)o6E&H-kah9^^CR*GrQnX_TY-~+g?BKJm)GHot>Baf1Sts
z&-S3ET20&`oLha=6_nClfqj*utJuDX(uj<nCD#r|CGC7qx69EHtl8h~JllV?fBXZk
zn}Zi5xc-)GC3lm}d-OjK*5!Y66D0@C6!?5}nGW(krxTfD5t%$g0eJU3mxWrC9lC@$
zcGaTfw&<3=E*r@w%m2HXcJ^QJf7r1b2hSeagpO|ZjJmA#@`mZ;XS^xa1VJObRs2if
z9`}>s_bs2x`wv1enVo0P++;emLv&&h`Z6~u*-y(STsRRLJRMrDlkj^6{=q>iuU>Sd
zkV|KGr?b0vc)b63f0yTW+~N3@;B>n)!bfm-hoS2Qg_YQ>RJ4Wli!;f*f2~~aDJ$8P
zPlJLtp3;|(gmn}(`INBv$g5htv=t1XtemMEhqq=Gkqd^XU`Ng^mO>pn!Ke@RAMMIL
z)Y<#~<^CZbPMpkpp9QB<O~bm8+1qgr^#Ix55bE^sK~F$;A|YxGSbK)vOg&x{Go*X^
z*AqY63wJ1t3Q>nJ{Fxiwf2Pab{CSqs?;OvmNNlq)lKz3UNJMgqKtmwBA?`r0Q@%}B
zxgv)YqG%=-h-40+CdVmQv5H27+IYrt2!cCs4U@`K^z&X)r^5}HXf2=-mQk@ng7V^1
zR3Ld9#XfM)jD%jClkCC%*-?Nb6vSz;1L)uh3F&IfR{_JXRa2`Af1vKEFJ%w#|51W;
zmH`ie5vDm|xBJh(h8@1^T09yz=8O;$hr0jVW&a2QSIR;#vw951j`SSqH<}Y?!h`Lq
zebq`Wl$pX_uwN|<pJcCq^%UJjPxl|my|;IG)Ombx*m*(Bi7&jP8;PZvT;%;Mj0qC_
zatUW939u!42;)ptf8P0e{{_8(7$Txy=(J9U<27gY2qGZ8e(XGBjLXX&wG2gj;b|0V
z;)o3maA5ha8+F^Q?z70)G?0VWM|3JX8@sRGGv6Lj8V`h%mOZrlMsm6P@)Z;1X7c2r
zQ6>g?Y9&~Lntr{De9#YJW212$9_=3PzdVi@8Ti<ta-n&vf3^J*_+1Y@HmhR2A$56h
z9YZ;EZEaehj&AaZgK9`KNY5+7stJ@sHFc$|)fRm#NCu0OisHC4ab@|cMFya&r7;-k
zR6M<6DeDb#204=&Ajqyo-Hg1KPiu6Q^PxzkZXN)TxDKj|c^nVYDJ*I2AT4H33W4H)
za9nyNA%^xtfAS`Nn@^>Pzfz&jiI1E%Ff4QpH5jSyJbeaMp<5~s^UXj{{JgQZ`E&2t
z^}+i3_1nA{3_dN!7oR?O@%ir8kAB82c+6ITY<!UoIW^djbmLy7PSelW8J|sVZT}X2
zr=!B<w)#pWaW*QPX0(wLxndf18|L0~glowBV#@-pe<yP_?T>>dm@PS{(DKQ@I@&vY
zvGW`YH<_JgnC2_xV;|L@i@g3V@!sQcoH|Fpxj1WnM_&3sY3&Cgdi#&4<@&~_*?QW)
z-#WYZ`RA=qw@x3l?%(_Dv)1RE>4S~l{f*Bb^!wE8Yee9^XQR=l9`6{2oKLk%CYI(c
zPbx5}f1;Q%ST)CQTbGZY9lZXXW6co3MC!f({P5fKuF|N&Gyo{o*B%}m9RCsTMv%=d
zU&(KaR}XC#t=-4W=xF!p-lJE~_A0MX_zXBtm%Yu^Jr3SsKj8&Hd5s3d-$DZTo8W}$
zJBX~M7_9c^4j$>D&-Yn>fZlk-gQHt&lG9(0e`nyQ-y&xn=9Xl2wuXq3E8xr88In`u
z!L%?yoAq%ZJ6BhAt=F;F909k^p^V5aq{Yj_Bw%oC##&Rb&bhaAUhKX8yS!;tz{DC6
zwHzJqy%gf?nYD~Fl=@m%5Hzql$lqkiO1jcaR!&zq{eI<a#r1RW@aw%@cPY<07`LZ{
zf3>+UdTSe>p0wNTAC2CR;&aS<?{i>vW_Xm#Dwv!HpaLl#<uFcARL|s2O}I^h+s7rb
z`Mfo~?TWMcG6BI^u!>f4?eXD$^+Lkcc<DAi-Pru>-u=(-fBM<R<^%eltxfv&DYCR9
zR^{Z>6xI-;VUCJAV=$54MdpASVa-1Ee+U+?NJrb<GcO+Tt#JDb$AsVaUJ`S{kd(Q1
z=TB=INLbQuiex1Q#oj_Gh)eo>=cJrzN?Ol}n1pVP?Gl)ddduGxfCH%UKXgcoWDKQ2
zDzr*Pq%^9{@EZI`itbd9!5HzA3jhKp!MeO%g7ls6;g)MGkTp<T;qDThMj+HBe`{$d
z2-gzR&+sbYY#L3ul%=FLlI@f8qUa|iqM=Ot1uT9HE1_`ox<`RbdaEpNS@n*rddIK2
zYmTIA$+y-wEJ?TC=K>Nao^~O{(}H$Qufk{vMXj|5A-H!#x4fmiS}_u{mSDr#RgQ5b
zc|gh<0UgKa5{r730)oz@h$ytPf7wVpYQC%}aaNj)ls7ZMsHy2fR>U5g`=mhSFaDlp
zGaH-hVFd=972mVef#AI^b+Z?Q-7{8q+UMep%hx5k1|qOyu3I7u=B!Z5eqL%y;davf
z;+wr6zWVZu?{=QO+Cu@C*X)^)ue*i@6$+jUUyqxoYn|9r9J&g#IxGL8e^T7gNqaf+
z1A8eXmkmc*S<HtO0rLQsSWV;rC<=oiGAyPy&tVuZBO1reZ@d$9=y^a(x<GwyN!XDJ
zn|+C5%*#sF%%d9yr`f}9bcmW*Py+|2Z^`5YKup(SNs}PZQVb9Q5G{ZvWei+UECleF
zOp1xKaeX9m2m0vvKIVHpe|By(2R+HDPQGv{_Yq-^3z<zP*K0j3OoU9ypd#JDh<mxQ
z6OcHgSi73uuETC}Iw*Q?{B?8WDrYicJgM$|!%4Gi9`EuD5mu3)l3y;_RE!gz4u?|4
zQ0*CUX#`*ui>~gHziPFoRz()POcZ?T@$XkbL5f&S%i7u+3{dbff6a4Mv7c(GwQ!Af
zMQt%_wNE}lF6&evn!ij^_H3KCjy*!FjlZB7z3!0M?PL_-;6eM~gv2QW<ee8F=xi{c
z<`Zd)ZvRsI<Xs}fu*$<|B)>|BPouH%V$1DY^m;&koVl_%Qgpc(E2^Omo1~mJKfJoK
zGm>uPQIe~+Nv@W+e^rL>8NIYWg_9bxvI3_0!T%~vwv+kZ^=R|3Fh<O?y^_4cTx;*7
zzSlpT98a#3T}&MCQ?%$EUWE#(%5lm?&!hq{ZdQh-W_^()M!IxS#I2&4D@2V<XIhL~
z17IB{-K$|oAL=HgnhgNtJe_dBKVu-F#-3SU!dD0!60q&ge=n>7djTwkdBUkisV;*;
zs!z4#JqkU`l_ZO#3)yrKU3lG;efgrG0*qnOcQ1z~vh5n;6sMCn0&=8jz=or92=@-`
zz8_X}uo>1c%RH0gx)H>5{YV*8uJ6d3$aw<$I*+CMYf|Tj>)S*cbzIu?SN%D|jz5;U
z)SF3Nr%%6qf8qDztK?lXAssDwhk}-Jf{|vA%8~#D_GcF-c@;+_u`R}*N#gsWm%bWH
z9dGu`N;4Yd{q^;FlN+BE1+_X&C#Xp0C{kb&$K!$4VbyBKfbu-24H>`>j_T~NUC^zZ
zmVuhGD)8#qqNXz!G`)i9DrhvI@FXXObPVh={l!Ige=J9Wyc0Y|+lKrtHm87=eYIH7
zxnvo3kgkIaxhs{WM^omYUD;B6jY{rXCD4?S3+jKuwH6@O8E$-wPRDuX$<o2u;cj+Z
zgUg0!oppw<W3P`!H|V?M4rE}sl?uHHEa+bNofwA<&5cX9#1&gMMAuiuQ`X;n;U0!-
zQ04PVf6-P0UKQwNiaxl1mZ;{`49={Lh3^cURjhM9GQ12u5TS`l^j<s+>W~}9;6kNO
z6U^lk@8L>AK{8`eBe7Dtq0HfGu+SyQHD8KlPjStWZGmW0$}H#BoeNR9Wv(#PpaeK|
z3e{2J2;EEsiqQyPDw=F`^fL`6)UM;s8MaT&e|6d1#*f~YspYF*8ypxHN5slX{?d4o
zwLqff;+JqnHp>Y-h2lzp>;qpx)SkU8iofO@C}9&rTJw<oa{1^jE(*6>C-Ilbi9$JY
zHJ#Zv4pCL4UEqYq`-aSS!HH&}_;i*JrmY-x*Qc(^s>5jZQ;n{8H*Bt(-VSGYwRjN}
zf8p)!UB5_HOey(FsZfL$E(emH>Wz3^G7Po}jAvMI7U<X{8ofa=%Vi5IJ8%U1gnSpy
zlTU#>0L;u$2KVZrl!gl{E(;{diN>vpKE;n2TY<moTqLP-O>*3{)(gX%2NhHA-mSGX
z+kH*bwHFOpVKk{NLnNME$HOG{pxb;0f7E)Gzim*{9cK}vEsTo7gLQ{x;s2c6ctm6+
zpXb2#E6%3LF+<vaz?xPc{ovK*#}=+G!|Q*@>Mj_3u)3Tnr6xnSeDR<eau-qlfBX`Q
z0ra*Ddzq&ic>u$c1!uw%n2&SCTU@vzMnm$jW?PHIf>2PdMlk<Adaz<>Ek@B4f6b^=
zN<LiFj+X{R={Ef6Io<OSf?8yntt`TxULMMK=IbAqa|{NyQ_UP+#-|pqPQ|z{X?V!L
z%bke|Hv|o<h3bpEmB1&MoX@0c*L)FZ^&<5yh|!L!cOx!!pk$M7jf=EJ^frWlI};0X
zz<@F0m#$@CRq8ERv=Y;)Azmn`f6={=7u%*wfn-DbWN)e;7guNKhGmnx+YU6(`NReN
z-HSb@&*53Rsr*wvMJ_{CL!1u<&ABf1c7%_+z=s-2Nq8zRS(u{-Ut8S+HyF{Q6k8On
z@PL{NI_XrN8HEGFD769F@`2GYWpmzfpu$el(QQU)*LNqFq!TZAwyPYCe=0RurY_EC
zej1S=&|s2YKnomS1CnBzaQ2Pe8wtZbMEbp11L)+ek^<kY2shiwpMFK0Iqu?j^f#vP
zj<wCxYx>A*_0ASGD*F1TUqh05*R6fh_)Gk{F1*Ws`c<gsor^!C1^v^ne)HaS*$zPq
zwHht1*g~TIj$+w~))B*xf1cvrK6ytS(kel)RebEFLQev^=hhm90#HOSZWesi!>8Ib
z2hFK-C?8276qJjef+eAg7X@t;(?r^1$A`SpY6NoGRL5MWq|KRC0rOFh2X_>h;ymoT
zn5fKLx55RSq2`tnQk(UOL~GteqxRix4FC;yi$nkDUzlZ717`c_f8)@C8`t)2B9BlV
z74=9<t23alAP@5;%u7CIQ0h6e0t<cYEb@dH^#+5GA8KHU&7|_$%97_+8guFsz0LC_
z$P+R1<nSm{5H*!Q4vez6Wbx8=&)1^ibg4_LY7@_KVppZNW{WOtRYBkgVAx_^(7CSV
zmGfg(^OQ$vmhw^Jf6TE0QnbR`wIpdNmuQN}*<2(*5wUlpH%Fe`F88uPw&BO{b?2ss
zTcPN$1%#kFBjj`nuR$?pV>V<CAK9@;9Eg`!0e!L|(c2|MYNH^GNemUq<nG<0H~F~I
zgZROz`9PToU%851C52`SvF^=AOCQxIT?N{pO41^gDVQN!e<OGn>_KqV`D{d@h90X%
zSXI}#z*$&;HCbiT3sKAz#P!<MYyBoYdy~@ke|yB=9x>Kw(*X!K0b@r$J^%LjxS2fJ
zec6<~7AH7E_FIJ$tr!xmgqM;y*(kL!wVZQdPN#R~mE60w*wx^w_u9OInAw;gMSZqO
z5na4Yk`u!Ce+WTo6jDi9!qw_1zBm@<A@={pYtG_@2z5AQ6JH_99`Rnj7^Ph>^<%q(
zD&=XpRI=Naf?A=>Y$6FtRhdw2c8i-XIPOW5&OrY{FSl2wxsR$Y_yN7edKmX6TqSB*
z>4i&o-9lNCYHe9~Dx$><{I6`Y6dg)dIKC~MB7l)Be^d|*LuirMu9BbQKc_wj?KbK|
zg9mh&Ax%HxVHnH{mscp_fFVMnaXCeGq4R4?+Q>(j#T#=ERkShC`$9cr8R0KEUAI&`
zT6(*f<Q+*v&Ry(9_J1YqAz4iYnbJV@cw4nJ7xtm6A3`bLR)`0cJ8b0c7uJ^6y#LkO
z7vZB{e|5#`*G#(bKX>%Ewc&M3E&Q<1zX6*Lf14Jhrgj^@S8aR0(&L>N+(W3ueW1>F
zYh|p)Fge0H^%N~RwW&XV+Hg)$SNa8um^au*hsccU>WE(WN^x1Qz~^8Jlo%rxHxK>I
z3y;Z7YFPBZ-&G0IH{l&2X})W6@bCVkZLgv=e-ZDAUD}@4(4tOP_QI1KJCs%L(k&Am
zD>z>Zr2~$sFwKR(|4Zzdi$b+}4&|?M-?@q?<Df*n_@m)Fq``7*C1X^V43<LYe{hPM
zP7{&m%=TeG16!pR3zK1$?zu8-a8u7IR5mBEZZ2fk$-<&;$!yf8-@3CkVlH@ZgISW5
ze-u=(-DVIw5)RG+JxdQF<wVJw<Sa`G(HJ*Zz*;i7n77iRmwZ~o@`4sDS8=SUQ-7gr
zC5aRLVwKE`&H$Yq&^;3b2rxiLJP$u|2@IRDEf;lZRrNYqGUXpv?|6dXUt0Q0gCUTG
ztmgNO^DF^3={-9abMtkrg5U<7PcD_%f0i!Qhq}fVd2}jWey~r6(OVZys}zH)So9al
z8P!*_S?j}YeeQyd9lyh{hiAogs}EQFxPD($ELm_LE|)u^#D-g3<I8W*=;|anzOvv8
ztb_A+jXrd{TgHyn-_zO`-zA5<^0-7$yP_?@GbEv}%9b?3TP3vSMWpn8d!E+oe`s1-
zaX&3DPK$KXFPox<Tqj&2&radTo6?Ri7M|J<v^8lD&Lq@!#-@)nGokVu$98gI=zMfm
zB)gmoFrF0S^jz#EM{_4y89~Z%ADm5$Yw5wdB|*279mXf%Wwm=OlD$~nA0n_3(G$pb
zD1zs`PQ}#@d8}xcaV62V6|qkCe=Q}fBD0zAU;W$R^$`Lg#;YBKGQ@EVF7a#?;rkvq
zqG9!Pk36)`-V*Z$HrQ_YX(dZ^$>1zPJdUd#47BWph9_<(-6ziu9_~Er>>VB+9Cn`W
zym<6%?@)4i_AOo5r$2VvLX2KRBMI6^)&|;N^%`TJkwl+;fFgz}+ssCOf2X5``w_u-
zPHn_*a^gZ(jBk|{-%0~S`|uPm(5zx*XD)EXMYqPf0u#{^ks?$Wo(zgp5|!3I#)Y#W
z<`PM!x8d#|$kR=#Uo4u>)qR9V<0^^`^1;n}B95|EG4=7sszqz)zyu(y6N@4Gyh9B8
zqC*lgt;BUlevAT&?r793e>hk+k#ik{Tgz%YF1{#6@!rN~ab#kBe`Uy<nvRPpej<L*
zdxIbLgd(HglXs!}1fgw6fVUiQ#J+x91Ul!@cchz+baO{!FbVn_s0Ao`(SDeIfxFbi
zUJ?t3*34GinO!HD`YI)EOnzpK`JwN;=^_mI-AzT1q7$2zLBM+3e+QE*BmxcKsxXTu
zZOKNProkjY0vyA9^f|PY5ety1@87wd9Bnm|onIikJ{%wzlTrB!)XbHDjU#z5c<Y74
z?&cFzl^FnGDzH+@F*({wPG>NLmtp7ZeIxylc<s{n*mLdLCSS&UiJuminMKv7=I>XW
zEtnF-(8RmIwb$|ie*hyO33HKVUz`n#3j^ANdq_|%`n)g`(>w#+N#nA0)r7+b5XP25
zApHmH$<$EL{fl%BT*)x=Mk{O+UA_VXE`xo}d1`?p@@mQ8_#AJ2){$>J`fVp4b?g8H
z!GVatwA&Z7y{uEFJ?{ZyuCA$bw6{+DSsc=}C2@!v`l;G!f75~`t)6;Q^8|86LXqLP
z@)J<BExfchpf_J;PMP#tS*VQ#CGLIVMo5?;=DZQ9#jqj__b0x?Mwi(rXS6qBhXR?V
zr9i|B$WcJ46qAxV$-Fkymj#)@Jc8G2QFE<aX21m=y1|QxzJBk@!n3rPd@zEA^uv3K
zbP&$wasCkte==9K6_OOT<`l9N@_WRQgZpG4ca1{ru)*C(feX#ZvcXU^()z~gl%})U
zO)=EYDGjyjbDF_*f;q6guY2CZu#I3VtryQskxH12YEG{atZK`z=bY-Y&b8XZYoLa!
zT__2t*a^q(Fnq|73M?4Xyrs>9oHQYXkuY*k5G=<Cf4}pFdKH2++!_U$EycmE0SFH>
z+EAK;UQ!w>-3+MG3~tmY9bJnBJCGF+6>N`(nNK+OKauK}aHPBvJO}%38HbS51*hek
z?3xr435;iMe9h0h%g&|u=WGwgZ7Jdz5_@XD);_71Te$QM3=YGoo8a?0%J7uZTcvCq
zW5M}Jf1_-Mn5tb0oA6(xZcNNC<Q7;LJbO!RCfS7JB&<_?ZX&YL2J)BHifKf^gX~B<
z&6VZHwO1}vK<jfu2hy@*Ewz()x&_yY45k~+QZbZedR(GCyP^+n_Q8e{LwU8Ita4#2
z5%HLp$;LAd02ggmfn)dRJ63PU>E!2Gre8Ore-*Nq|F~Lib$BggtTv4~(c~f<U=c7V
z(9F@JZ_1E}L9qf*<p`QiZaPFZ$l$syA$sP`B9^%9iWb_xkYM@~u;>pu#CV{Uw(xo_
zrLom2CY2N2k{gZM$u<d`*9jlE4|<!}AwJ@LvTu5<CEE@EIx&INLE`6qHY`=Hkw-*!
ze~%tYa`>k#?k)tGbT~;t2Rx1zZPA<lDM|vh@N~;PE%l{X`f=Yijabi$*{E;K`Q#uL
zG6F*VASuQwl#|HzaFH}u61SJ{^|SX(YcNEUll5KdBCfZ*Hye=DXxG~mY$I9F4TMnU
zHH^YIV_-J}0s~%}HExso%1PuVh>*;Ze@&e%67^phKFd8h>({7nR|!25(+|#Vvj%CN
z10ji&-ip+NZml1O2zAo^f;Y%~`;+ajy1v+qIunQ)4vSxCsnd2bIbX|0tyf2)IK9qJ
z*AV}*M&r$UWv4jn@W<!-&-Wx}R3uC0s=%nS5weu0W>(gg5J))m<Iu%URlB71e|NV>
zsf*LH#bJGg?~fW1%sA7G<FItPntCRw?;_>PRRWaW43}<-B8&d6i*17t{SXV0JGVug
z;;vFY2Lt7!`35zYx0`w^l@Y#7TW*D|4(`8>d?hd$>7<O4c-mM@K>~{cd32QCqSQUT
zo@QlNW0W|KOWm(s8iP>xDqob$f30a@(7v(VZIEm+N_?VlaDnrEeI4E7Y3a$Du^)z~
z`S}dlb!9%CX%NaPbMJgqGy<2o5&{u&CJLP145T_{DeM=03r%U(au&wjUTL%!;Fm)k
zjtSXOc9+RQw!530FtKn>Y(~22q*7JsqY3>H_~om^XGZ6&mX60NrZp?De;-Ej6V+OE
zxkxE(I&gPQMd9+QV{yT^9owq%1MG^Xi?h}6u`D$5<G3#5h{K?(!`jyS!bwAHUv?Cv
z(Jhj^$vXYR#j0^Dd8D^KxaPDNNxG~`&tg^zgpwiTM}~2=4&_j`qk)&^do<^(JqAkV
z`%Be5u#MXv9Qb%7hS(_Ke{sYSy2+}PqS&^h(`4wqZDec0SR_O4HUhYVCyf0d-r-`<
z=a`+3F*pf^gk%a^KZ|>x|Bm<0;17oB2z(|$*Wso_%jpO%dy+?nf}j*TY4v=ox$2Vk
z0vV@@THp~8PJ)hajp-9x1rM`cI<{=yXq@zZE$o2|U>+)h(uD=Ve?-u9idi!#o?!v#
z(TlbrnaZp7(a+1<jyw391D@-PJE=>K{A1e|{X_jn7#uhtueLYdRqY+2uZXKiX^LnQ
ziB)1mXOl<?SX2^S3x)7`|DxaF-$_zy8Ra!vQXfrqOz>W66Kw!3`?;qsuwUZF2%{J9
zQmm*>6H($@Eu}w+e+$=N5C?8+q3|>AvH*XF2&dD%3hZV&M=qANXhiMg2ajhXIy18I
zN7n(!fE@>Cg5Y-EQe|%swm9LijM9QjW~c6${SfKr`mWM7z*l(1RZ1P7a*+i!s8q*e
zU>BG1p@i&){<WeBONoN{1Mq$SBC!;(-fb2Y?rUXj#ke}xfAHp*3iX+sKx@7&p-8TW
z<P?Kko1**i<ao9F1=n?!3xk8n+X3ry45>I%GZ<%Cm=%<b!0_#wiA>14Dd9JkvCCC3
z`_cNSg|HG#@``&2eq-~MoVisN;$7MUcnB^o%)b$A!bLHpL2&kec+|CPQB4MgSm_+N
zj2;V;e(0NYf0WVFtbzW+iOe47VWXv_%Ev*z$7wjq>G-7+t!;xH)!tMM63S;R357|5
z$upo)rY6nH^PZbrHlme$2Nj<#bk<W{G4hf<b+4g+>TiJs$T!%5Cw0m1O_v6<<Wd2Q
zyuiD)mt2N!!x!FLY*loe4yDxXma4v~!nBkCVrO65f8MX_nvZ&eSzo<#95AW}O3L!e
z5U8yxZKRn_ePi8966mH{A6o3eXa3Z?iW%&U8v4Rta)<ew%1nKwMD#1%A`d{8SoJxC
z3vd|qFtcc5W+>>KNtu1PO8EACF;S2(IRxrPF(dcYMKQ?S@ceUP_$1m6v479!cW5RK
zYTLude_n@>Y2mD&Aoabkrc;EipBAWDd^#x3*VLOT)kj;3B(KHlc@cA0FpYl6$1`^1
zvbgN-Mq&Mi-=*m~++o*FzVj9=j_F{T8^b;Exd9SjUsS9N%Tv&OG0rkqAQm28Bj5rR
zN&{2aRHk6|n&`@0_!L;iT+GF}^4iK5%4-cee}WY~+ep=(C)Gd~Im>d|foWnE3JJfc
zBC5MAxs#*a{pYquuCVatXC30e1HlpO<--s!g+4Zt)gwti0`uCP6lK}cYOnkDrsq5!
z1S>XJ4lUi}OdHIcQ%5gWJ_i`TOmygaaE=xU%>hj+I1Kj%e!}@bvfvRg*q!7XE?b-e
ze=eJD<dW8l(}s5()Py0xXdwpV1uWc;MKow(PyMFqR>J}*g|1}n;?-X<d6E>DS&t(M
zC7v>aFKomm92llAQ)jZyc5Yqb+1|YyL@!p-NLUl_R#x|OrbybsgY)S7EIAy!fxp^k
ztB7-F2PIOn<dH$y%Q^^>3P=mgfkY85e~T_shGgN}3ey4VXCkg)n6F0su1R)2!`<qA
zm9h~{A4sG-BM4ntl1|m=raucsRiW2X489D&<$ML3@b2-baM~RY8F2z-t2jFgb^v2O
z!22*)uDRl}x0=$|{;}MpIp>oUDvRjNs~gJqLU}=KJ2dDorX9V#IjBoxj$+Cre@Tfw
zbMq(RDPWc=>xUKK@PWH`c?xqWGCwR_ka((mXR^CS)*(8TH*g_1{O{g<B1d8V6e=IR
ziH*%4OyzwM0AE?1c5MqUe#QKT#WdSX_Q?eDE*sXp{&d5xh$$@^%6YoTXgI&=!A{lg
zVPIY#H9Z1jU&NTIvL+4HX)+^!f18z}X+&qspD2EVi54t*&r7MRB91my^lXZRsma0a
zFw3c9)nxustB#dE-o2a8KZ<O^pwb`5s9hFgAoIX8qzh+al&og;2v`~w>SQ76%7v?k
z7!;$JWk^qAM@#yXl&32aDzh)=PPBVWJQC{0<I77_j55+O=1v^=t=C@Nf6u&XVl2GK
z&o5A|Zo*PtwI*G-IA7`7&>x($&`zFP+G|ED%3>0COixKUiZraESX}~hpf_BA4MIj4
zO&8Q&TpEyR%k3if-WC~hh|rk8bI0TNBWKjC<m9lhFsqjzY;?L4(@RUtA(wgDazDs2
zTNdiWY?Phlh~JhpKzJSde<4Q(onT%-Qsb1s!YSlFgIKT$xGqn?xFbKhWR_YAOz%2i
zV3UkRBhTS1v{3R)MLA-whhPw6ElxI&Ow+74!ycg9U1~AmDm@ECB@^r<f8Gj*&9h$a
zl#WX(p;MgxnwGhfBopEh=T><!Gy|A?R@!YkHw$k@-5;GzQa2F>e@!p?*~ghu^Qf;*
zDo}hdr!ISoy8s+M7EetA@)kx!MYo@I<d9yWE}GJ(u}3XcU19TsPu|2p^KZxEguqAZ
zvIX$GQ7xlhkT)G*orbU$ulCy^ZXH4a#Wx8@D_g$8js(gFbzzS18<+n{Sw-s=90dIv
zO9tM^tn>B-V&*Eue=MjNV|8M@Xjhdb=sg;q>%lKVaAf)j45VgqK(hG->{Y!C7>94N
zYXJkH4u05q{!IIoz=72+j#W#(>Nap&d^0189c2)rMLMMKRwZBOc{-M&2Vqi<!Z`8(
zkE)St9JLnMb6rkAGcxOHk}LJ#9rL@-_U9C<txj){uVKide|@fs3xat=GM<$eYhx5E
z!XPCsUTRJiJuVEz^1!0S6%g~Q>Xd}xvgwcpBQMchq9_kbn~T$*nzv|>4HK!ekpd?i
zT%sUDb`{+0@p(~l3Wye`<t*nYKS*l<Z5RpAs#_SBt=p@8@!TY@4xd%1V3J{+QWzOd
z=Paffud>h=f8%U)Om`siQ?6q|(_yP243}1WQ5Xx3)i8skotMMV2{UDF)}?Sbw<BFh
z*V}T@L{te%uyT7eU!=LgFbC5Q)3ZeTfXINmu^1Yh?Vq?r&8I;9mmyN7*)g<;bX&q^
z<eq_zyPu5*#Wi=js->`Y;YTd#)!#h_s)ai?jW*9=f5AD@(Q`3U+~J8kR-%;@2zQ>b
z6_tGeqn<>sgw?Hi9f3-m9A+(<22)IOKcP!`HkD`>k|HF$urJax{oSABXNY2Zh^k}3
z#=y$tBv)QgjW}=^yZC`AaB$6jViLY+mFXhLmc~0?Fwz-UP|yfB{ju+(ju?f7j#M7N
z*0!yhe^_uXm{EyCRKkjT^FJfP8U*Lv40=#YiGR2z&AoQc?6YH(hj@rN;oFhr>f9Ns
z@K>-@65ti>UeAQ|`8qr;9N3VnzkiyZv(AuDz1IuEcS)jz_+YtLO=P%J<@gfZrRchh
zxoVDZ!O~OXuB@%iBs9&+5p3VMCYX3<HW_Rue|0Bdm~f$H&Ndy#x&R&vL+MC0MpVrx
zx0B8LpKq?Oa}C)$$<{g-eWlh&kkPs`9j(H>oqWC?RP(-*Y&bIJ?z!xArzBae!*R}?
z;pujAf1Q2<7&DDi^XDW7j=m=8r(;ZhTMG8ocu$^rMwqO6Lr;T#)cx(yPc&!994-B-
ze??!_<$1;zWUq_{7D>HC`mG#J$I$}nS12?<{o(KGx@ikYRWzN?KJ{M-d|2HU{GS&;
zI31K7D{g1AbU#{&$Do_=ouqmY&GvO<E&Hs~l#5_3IXXJ<*8%-f5S3o&?9MsTSpH5D
zq$$<qtCp1DYvujA{wO?Pu7P}QjkrRlf1V)gHNmmCsE{FPlSq{=+tM2rWvy7_p>3{R
zZm!{vy6b>T(^Yzqw)%WJ&P(otTlxpFfQT}$K1)|(-d7yaY8RIqYxbD$NQBAl<fJao
zB5{Wnm7{j)Po|*ykGk;Tg^LBBW&>Fa{M8Zcabh&ZbTIB1Ft?5lgQG@tVGagte@EQD
zx3%%9jDu7ig!^|i1K%B##8OWe{DNw!{_Efn1pt3Af)g{NueCG|KFNSv$@zGue?b>-
z4YQ#>4@-&1Y+@`O55PlR>F)~QWxrUrn#D(}S;hy0JD1?Ewb6J8BMsEkoVmz2A9q*-
zuI%UddYp#`b4{YIv24_b(ql)vf4UAHq+jC$?b!9}1!7XIrez=C$b{;7%|H+zQmaL-
zS#T~*ost*ekO!=M{w7jpE6b-p`)$ICl3rW54-)3H<vyRzM(*!(-;C~u3;ztt(Uun|
zBEignZnh2@&~lN8Q3x;|X9cJI>lGnMlF(2+sq9Fl6&ua-A3ERd9MXeae?vu@a&B*j
z1K+ljPqEJ<mK1N8k~DzHA^{!V(2{;_P1EuXf8i3pbQfqGXKU2Ls(wI$77<297Tns_
z<NQHNaG7a`#0S>x%k-`P@}5guT&Q^kIaCb}%*1sr(x{jDNeuE2H-mH@*H3QJ?p#Ke
zO6AKmqy6b0Bd@BP5VC$IfAxk~XlD`D>FVzlVq?+IMB44`?OrONKkQAY&fKAoNVsGW
zidS$U@+nEvJELnaGKqg6P7n~wfr~2zrrspTn|JTifa4KDIBijK)$p!+(77v9#qq`>
zy|H9-j|RYQUE3LCwRW8i{b@EBTD2i~5u=@<brlkEiRyQfZ&95_e*h3_A*i4mxF!~`
zb1}|3hbL8YVQ6^}DSLsp^Y5f?2O{<z9a393l8ZV^+-tULi;qe;OFK{tgj4zN14L96
zF#-{<=H*S1L%zwb53{rI`y>$o%Ek7pE)z9jaWN1S-H$g*#oBD1Tg!hD&yJch^CDRS
zJews6Vb}PRI5q!6e~g#p2|owVDi`)-tdgE#9z_4c%st#)w+8MHUyQpo^1rrPnxnzh
z#o3I~I*X{m11AY>mJ#_Ggl)`byqz~9MpfdWU20OB4}m^>xU-wA!b+}*#3_sGu20xJ
zWH;3pX!wbHh6Jjdk}jQ6YQ6Dv%p|@u9*Z6vnf}$NW;SmzfAXkFQVtbYe1Gp*_Hi-Z
zS`w@WnxpJqaO6k?{Z6c@+sWld4R~+c{)rk%d8y<9%n`K>Mt|X1`k!m|6c&6t`K@-t
ziTuFxxbQSCJB#l<iA&Dmtxn+r-R*Yz+Y%k__IljBLiUI9rAW8apF<sPUXOdPE*I!?
z(fgJU_Ey8ye*x=Td5qdFXtr2I{6o~l-=!-4q3YrXsEo^Rkh%Ng*0;xb;qDOp?gV>x
zqg3ycTizybNHQfMiVIm?<5HMoK*9aMl|dY?x$lG(WRX*#ow`o(A-adWq1LgWmfbN<
z(vB^->R77yLc}LqY3X|>PCf4qt5_z@<4s~?&T+M8e_AinnNDLvH?7d5NF`>k7<1hm
z&a`HnTB*FLcD#!JOv~}iIieM5Cw@ygJ5_6XY)23LLV-EGOWGP8?Cyt~(1WO%sW?|S
zQpPDQ`f^B}qztOw;4JzGZgKApES@?r4bNL#Yj;Z)*XlYuU4*p`u4hfJMy$w=7_)Q1
z?PJiRe^rzHBaA81$64B^sh@Jpe)MZUV{EcU?LMj>NoWzrzi{cczJ}3*$Z9pMMx0jM
zaE?~xYd#U(#`Yg&sGYlUWo7Bf*Uvl8_ILMQ9PM?!+56%BM%~(n*cm>a-z-z}7w{P=
z6jqE#m%Km`QTP-bZi+(<==S*}b3h%P<o5M2e^OkuS~^e17ST*V=ut+J4@o2gVjZp8
z{_~wDd+%x@YOq>Gt2t73t_KXmbv9U__V{y%k8ASh+M>-@t{V`zH(Wg0Io^4=Lp%2B
z@Y$Dt`ZfIc&NYfR_Dddf@P%&(%Xa7G&e759gTqJEF8VCZE{nlzm<6Vj_QEl5-!!4^
ze@UT+7B2DJfm2<ttW$rd0DO&|CEHfO9t8mh(~Ij`xHAGkcH^epLHWidZ(P2^OUB^v
z2Rk9I07pQ$zo*b29c(SZtqw2Nl)G)(x~?8?1k-~g@~I}G8up6vZ$0SrL@nCev0~!G
zT4{d@e;Q{0+&^{eT(hZvd4AEGwDZF6z<?N*|9_Na+X$wqRfwbN^Jp<#VN4j@CKfB*
zjeY3tI4Q&KsUbsA2jdf|D5E`&I^}~i6RSn`Hs=E7NLOizv>?41ti4?j+g>h^Q=RCk
z=Jd!`YcgE8!!q83iPSd@(qjWF&+h)(?xUc8CszbVcM0`}%P}4Zpb9YoiI|SBU=ByP
zdw+K#?e5-9hDD!9IQ2FtU#e#m+tZMyp?8pv>~yy#uClv#^*%x*pwvKy3ObeQXPj3*
z3VezU3!Wa84002_O>WGg8UQ&{0&h{MoVGJaN?n7<$;hE{rwE%P71)QYn2S<i1Q)m{
z-(;Dq5%1<DeqjeSW_kpQnUy&Qp{XfsHGc|tV5gmtt3^5J!wt)u(@YmFB@6WX0brS7
zzsu($m4Ld(DPMsg<Km;>ftKFAv=qA9BUA$3I4@5c6!^{23nVG1OhoeOE1ISgksQpD
zR+e|dCv81v35B9ks@EjEuomjTR!PZ1pNnt^jmzIX=jgy2<dP2&HkLV0t6H(^B7b5^
z^{QtwpI*#PW6vaiwbV1|n7(_#ll|kTuO4;|c3vGn?Hujx9_}62J%VZw$gsFTyd`Bb
z;g6ynka${fznB}WdaJQB#*PcF@+Ovix5+Mte}SvO>{G!{Rayl3gxb0zqUg&xQi|)`
zr{NpKlGd(P^1ErAA4ofktP3|<6@M0(gKkS?i!B-Nv0*GQw>WBX+v(IP34RK8B%SjT
za3Swg6y6y)1opWlFHvI4O2weysvylzud;09>4j@5N1KZ{#@~E{->Q2rL5uGHsdYsI
z{w?_-L!jP^f+GQgf!Qzozx300&<T<<?`OSqQicx#Al{8ZA_@;#8Ds+cEq{5rfMwCE
zK8q%=k15zNTYaG{TMHSX4kl)mXMDaUQ;prVh|(a$Yl`6AsiePFS4fbd*c;_1-x8(7
zPTXlOY~B*D_|hGc7=zn%A>RPJm|P=#!LYh3(I%B6yq$D|GlD`L#NImTIPXYPe1jyj
z4qK}DQ%L>oi16{V@Xz)a7Ju#WRoivM<fHC=vn_PS=N%Id$~KHxo$*z_D;M-0M=5YM
z1J%7Nb+0UEQA?>$11)`t5ryt!kpjFiMWXzP1US!=4dl=E8C9bwrie-(D<Zeou*D#t
zK@@$pcUW1?@imU_H1zkS8kb!$*sm_)yGb#*DW(>7qBjBnCjp^pnSUcY!Q8L8<dG?F
zeYM}RR7AHRNDm6bB*k8(hu;;)qxDd6o5L9V8_uO1x+_dDO2@1y7iR`szF?~qHt5OT
zak56lwPy6Q=IB6Gz0kFj`O50*W`!YPlD%hdn-U$MxG0ioRxa{=%5}8J1Ih~zA116>
z@$DMRkimkz+Gk*zg?~}CO|9W;MlJ3H(Yu1(s3nGGz<rF}<-0^p*lC>rt2ZppBV5O0
zF^8mC85YrUpnk+@W3-i~gS3idxe_8?w%Kr8Mn~*CjwW=``>rfa>5iKfud!Rk*Isa}
zXkmn+@-AF6kMS3=U?3*ZKaVnrq`=0{g~tCj7YN@q>lQ94L4T;BKipPXbSB>d5l8gR
z*DzN47^HOu+JQW|(Ab4Oa=vp=Js^mh<|YhXq$u&)$AU0L-^cUxtwk~thax&hJ9%<J
zM5KT2k^GS84@^8<V`Np|E;na440*)U#03ZZ+Q}OM*79{v93k<8aR_Dbs743SH4LPi
zY*t#Vm^>F<D1UfNfdzjHi!g%?nitL8LSVn{gT*QOUxQo8InmsQFy>K(2EDtYA<RXx
z(^gBAhRb@yOZE9_Hi(}NqwxGpZV17{_$o1W_^J|Ihp)n@I-5Wgn-)>JhT4re!I2tx
zV#hP2oKDguPwwHjMGr2BYFqTmAb?H}Nf6<O2L|+$Z+{*H18VEVL43iJJ5k(UvdUhq
zxFD#m56^&>d?B?xCjQ%EJ-y7*3EU>q+V+ims7Oci+~Mhr%hj5sB^2%jsQCvtN0)z$
z0*N7JKDMF}cG>cT>7o^`7$lVN<%PWZX>z!?^XU1Whg=hlmED9(taymeXz|149jA1)
zD%w;_-hXLo;eyaa$E!)SRk*CM5yu2br8tJh12Y00i>Qmg&c`!`{rcU!KCtiyWO59W
z;tC<rxCA|;H0BqF?L`Fr$bq?Q2Ucz!g(DU|9=`s$rJ(k!-Ed_qBTx-^j9&bZzOa|U
z*jSA0Q4al=W8y;_J<pfYCkFIKv_<lbGV3^KGJj^f{M8bJMEo>kvtWYJais5-7&Md$
z9OL1Vs~s_9kr0q);fg)udaU3)VFP*C*UjsQD~Rj8g-;9Lk|^GAi7kKDk%yZ%5s1&O
z9j4<kuRg!cM`uP)?D+3JcMsXN57*?6K2Q@M15gObF^drJH4V%gKUk7mlI*p5eq%0Q
zgMSORSW+VE26O3Y1_F1RbUTYN967l2s3%QXY`SEi+oa(IP<A}!YA&9dAEIvugKj$v
zM^rau=;z<pxHDTpTt^m*);bS_-a(G+Rq_70DXGNlrwDW$6t;9<+~g`<OIj`A>|e0E
zga7^tuX#C(dbNckZ9s|;vrV{GnJXSd8Gkg(^;wfrdHlpckS#~NR1S~=Amp{mI?|Y~
zsc)xaaW0~noXzc0en93WLyTzR5Fj5c5tEKWtEKk&mirbOtV_@gTiBOqAj!?)ulx;u
z(roAOH~9)b#`(iO`6?WUUH!Oeeh6#k5^u~oOg8p`lvZ*Ui^t*F6?H0H*#Y=&uz$cl
z^%}=^YGC0Xn{&;bbX+HM{U(1-rWxm$*J=kqcw`93eCn$jfG;zq0<Fr4?y?<7`Ph-)
zgY(!-PM8d=9e-Hc;6g;&+S<`KEzVX3!MKA?f3K~R*fd_;_l$MU%0u{;bILpXxPPJ%
zA_z-)Nmm)7)G`)RwpR#>v|?^L{C}+2{LEGb#gIi=bKC5SCuMG-NohL@3k9gXB0s-C
z6|l*9KB|<GG9(KDfkz(UhFFmlj8$7RHo@6!)RPJ;g1Lq9b5ILAdma7(Ck?dDvr#4+
zi$wHI>6GJ`6mx{+4%a=S7`mFaZ3}H7p$Kq6z7;PZ`xac;S=ndcaP3rI+kc#UA5gh4
zy3TnAKM4}oEuLFpIR9h3UB`r;Fq)2jmaf7UD~fya-BGd&Dk2FUZamlrA8XZ8PS!q|
zYhbiSyx&P8mqgf?B?zzO+C}sl)!Fvsz~li_pCdm9knGS>lS2~T^pUOwb?}nf(DtfB
zqyJ-!x6Sp<t=7gyYjeFNqkmhIe>!fEvM_UVl+{^8zmEZ{7gFz;|AI4MORj@6P<+}_
zVvqT8oFk(wH+4jZ3G)$i7J7p%law<C+?Zx#27M{cri|Rjrgo3D$^I%WyI^l(d~1HL
zoYCb_DiXE;FEdo*NWiVoND~v7G`J*X?KPJ#4c+~MZ);m<j(Y*{<9`9CQtYh6vELo!
zf?n5keRkEm&1oA5se~z&!D#}hcQjnlQC67dmU6(3LyayONCm&P<N?9$1J8zNK7%R$
z6*cvz){mbU`uIXoc5Gu;c?QDd7-Q?2sJkak8*v3}SN#nW|8o#~SJEdwnW!9y075LU
zAk(6$j0*>oZvY*p;D6Kl-x;IUSS&HpS>@;`+T;mr<;-e$rS5lz60QmJ%~YV8XACid
zCZUk{=i~%fkNwIz$5-Zqj&LDkI-OY_;@5Bow(dN^eI~6zemY5o_Xu>mej$^L+F+VH
zQ)aAwf@f07#R_?=F<z~9vXE%O-|M%$oQN>NmmO;=i&|}K9Dk3=Qc6u?hiD+;<q7Cj
z#>C_b!@Wzu_w<*n@}|imG<EZudd75;l1JY3_`6Ip+^d#%OlG5LK5)347>*0h=(mI6
z3IMJ-a84d`1a2{|3KyFqUGPt|Ra)so4)lWdo0}c3RqP%h0#S#|RM^HmuxnH^{ZL}=
zWSMpJ)&yLPmVaT?y8y1Xv`dv;OgYNN0JX=8bjRlfC?GA2M~c{S2Q8`XG?J9BpnUA2
zp{>a?ZNt0gH`+NLbIlb760_n@!2m`qP65*u(AuqFZr|4xLtfG9#$y-<6kUWmXiBOX
zkyPDLQC%>TAzfVr@wZ}sg0OtzZ5p_(PzBDRlMd1uCVzgFWp7#=YdUGRF!9#m*u7#r
zk`t*lMdFd-(H>=kv)0psw=XcdXLFUHn_||{!deVb${fZ85Mc99M5NQYi|ZX?+h@XH
z<cE;A@W|Q%CZ;16=vC{Za*?<l2r9N=vozYLsmXBBjmGx{heEN!Mc*a+kIEn+P>L5C
z2Q5gp%zqJRMSQR=u<Np`(U8DJbii_eHid;OY#gx>UP0j^-S~^H6lhcTAIml_bB~7|
zTqB&|Db=!k5p`1i=pI!^Ri7Pe;iVslsF4G4*~KqB?rb)3H@^j@dydNzGZ$r%5Gz;Q
zYs%4J+{<dN)eYTKv(k@7s=Y^Brm%vxLsAdI3V+F5alH*0spt?50YNqzvC6+FRcv`(
zOLdDKS3^Q(7V1^MM?_;}qFCVytjMqSweKZL*aNyg=T$gWQXEpx06t}#i*4#5$q`&x
z_K4V%_@`m==(EqA<2OW^#{5VKm$(SAg}}Ky$++H^^6J^hqrs&(5NvT%@IQu8x9|MU
zpMSWo#_1><M7rq~rq{9tEpAYe_TBp+Gv?D^Bq<Ct2P5O3$!Y39rKwlngW^v|9pN^x
z*OnUC=&`M5$oasHKk8lU3tyV*f6NH<y2uFktSH;lq8QLf1bkkawa}~)j7=zcejH}+
z@Pq`S4eD{gjoHsmiy0e>KF*jSzDnQ6e1EU;XJJB&|DfP&kWXND8Y<A8<Np#E$KZmB
z+&eR<Z&!?(J)a)PnA)0(kPeaUrHPghQE|!{DOd1FUG_J3!R30?wk1M_7q2DS*w<R>
zBeNsD=CZ1$xS+DL(;Qeb(<zHnIh{=M%PaunN74?hEG{1@NY{hQi^Bpn78E@y?0?;W
zv2>|jOX7STqciZ&UT-#JH1NKUT9UWR3Ryky7;Vo0JvRW#bCsQ56vZ13FDv;qCK0l*
zxUtS1HARom6_va6l=Jv$ov9yN;m3eA)hBp0{9d;gQ^akhhP^qd!RSRx&t7o(gopwk
z`F9yPVRa3lQVV!QaECp5G3pONPJe|h$8h2~xI@bh*%~l9*~WS^T*mBD@2`nLVFK~U
zRiS^a6zfO1Z9VXQaf8aQLa4#gZ*Y65QG;y(z}OzP2b1GlMWg85L|2u>8B<C<3$VRO
z;V3raAakwJP9B;-!}WvC+;+xb+OPs>-)$G^gOnc^+zO5)A<eGX6p7q`4Sx?5SB%#k
zw{ij4*FutsrNUd<Kt=z!l^L|{#=wOL+zsSHUZ4ys2HzpnreTy}$FxX%hU;|&Lnr?H
zPh!!sf=ygQfDNE`?<y<1dzVYOWx9;8YR0qA5aE=n(!oY+em`*Jl<nKXLf<CA6|l+W
zv?3_6Q<}C2^4CnV(iC(y9DffF<|G^qFWtSZPWWA<)Qje|Y{+--GE1d?B@WtmvS75~
z&nu;xmc-l{J(*9D0WWpWaNHaR+*S|~(qfAtd-zhX?}Dv19j2X7FQ0QUfMg0&&o*e_
zD5YaTfw%ew#$}la8k=P-15&vKL>+rV^fN&CDcAbt>V^pRp?kX@V1MLI&7ne~%{AmC
zl5LHjaD>n$F@|r_vp1=*7yisa5)By=hw}|lsOKUbXCWbwUN=LGi~^+4J!UnYhbgdF
zcW}hHmZ-=ng0x~e7ejytfXRizIlF*4>gn#?M|RiIkEP<4>y3mgmKhtX;m*|rj=Ogk
z?kWQ8kal5M3+a_x5r3X=+lCO_ckCt3OZE%sA>}J7x&T+ofL6GE+j%Jm2OdQ_ICM)D
zY^&oS9~=z>d^hhyOl+CtY{_tKtZs||jTsfARya-$s<4?YoV@~RBQl!n`vf(LG|VEF
zDOMrxbH(Wfiz3Ws<0CQR5>5zEYk}xnm+6EtDm0Rqk;_wF0DrnFhIC?6rLW@bj96LI
z8@ouSbz!w`uIfNnp`a(QAoM>2b|sD?J({H;l)))NwxE@U#w7H#lRc5FSJQ@2-h!2?
zuBxtF$%Y7%eOQFy(XO60L=+DSYTmu85lZ1=f)!=Mu@+Pj2}yIPt^T)YN4j#P?@zff
z%mP?S37&zJ?|+U3%ZqYBGMg6B5A`Gy7qmyG<|@snc53xLWC@EXxSc!_@L~ykG11Xj
zniGSU$e$u$E|D)wH7H_e6XFG4`*tf0{n&%Nw>i6U>V~8FAd*k%l9+@<#=KGh++=L*
zi-N5eaGfQq8?F0p{(#D6p~FNct;oXi6Rp$F92jsqn}3j8CP=E!>8_p)eP`<}FJW<a
zyMlXX9kLJxBzc5_4TuJ^iB?d{N#&M4pA}s3QhI!_{*O_AJLl(<>|8S6=!9nm3<GaJ
z!+M`eLY(Bkfiv(Kif_SwUb5cdilt+7HDP0(E^D=2A;VJX&nYVbr>F}KIgx!`(h&R$
z$Fm87Ie+P%czA7Gq#0dZLLSBN6xD{YNj`FA{}FvW^y>EX0=zA-h-;X2q+B4`%~PX4
z|FKPHs>O!b^f68+1_Xaqj8+0R$9#nqthOX;qzWs@qjr^wI7iUG>NLAZFLPi@)qYD}
z3jI~1&p3qxMMi@_w7D3xN;uk|Tu4HfV~!<b@qa2<F9coLbi!T8LKtaWsE{&RQ&K?%
zGXRkg@(SEcC!9W!_kRpu<IKu#@qhFD1ux)I382pj!r<5nA*!igc?n`f6ui7gqCogH
z&)8Z$Nd7VGUuuY)YNc4kMvGsel8TFb;a5lyQ%l3Ht!ozs$Mq&mzhGK%8}90x#cv6x
zP=DKX6rfcwC1gsOzpKt7Njl-4X`$G&2-G_-i$Ul>Kv;ILb>NA@xQFT6d<cHyVznaf
zE!CI7R7JJs0030Pc5(<O%@TWMYXb94kvytQ*-57H8gTtMu)}oV^m&+elnE)GaK<)!
zxP+{f5t~|^{fU$gqB`PuCCd!4ni?VZiGR?%>0;Vdce~$`FZ`Y{yKFjrL+T)k3~nX_
zGti`N75N(Epm;smvLJ=KcEzf|G4aTn(pZlcb@5=`hCrR!eM)2Vqqk`pbeQsGtRh<>
zsG|q#eqwYbvHb#6K2HTm#$!`bRGe@)PbOj}7L1{axym!N%W7eQj8%%h<=k40Z-4Ga
zF-f4aFDDbDg>yDAX$qRHBHwv_DZ$@?OF$FYSYO|E`=j~vyyLLq$S|7~3WSMnbWUA7
znGuVl^PZ`|TJq8NuMx{W5obT|iDc%j78S{8USaS$)Kt+;MRZ1&RkNY*ww)X?gS_T=
zn#m-+ZgGLPNLvv_@3lv+0|wy+34fk%4IdkJ1$)9N{LzKH*>-Y;B^j|-m@$Szn;T+s
z=<<d)ZKR-$LsQe#>%!yob=|{V4YhDRd9gWw35+!`H{cJ@vyxRXtd&yK8?cO)Zz)y3
z9c`Q5UYc6Y^>E&x?&>64pmj(oY}r1ytxhynU0anZxuI03CgB%)l^SE`MSptMq&fL<
z$_B%Eap}j^J0c&n>|0zy4KLdV3}&HRFOt=8oQjki7!I!j;D1qZxJG?xF_)4|;%}d)
zB#W$+qIpQsNGs)zf~B#wRpMmXkOyd(wEiQ972D@ifWq|nOAeiNKlJH4KYykzpb1Cj
zwE50~t|L9t|DX$rgv4<X0e=aQD(?jGhc+_#)f>>a)xJB(M(5P)yT8=lIZ!VN->%U;
z#0Jw<eIxYq6T13;Y-}t3O2xF<R14;p3kRpq1PpV_ON`!T$j#2!3dE;O`t-@#I)e_r
z=8-iNp+{y|cQdThh%+60W9j6QlVEmVh+y;8kIApKkD1@CX7?xQ<bO92iGNLg!{^_k
zc}W}IxoFE)-LtZ74QleP#&d}t=Q+tF#uLQ9@^iMs5Za_4*LAZ(ZC0lNaVT0h!4c<(
zYX|LfS<+nc*;!AB+wpQ;2L()1hAj#DfT9i#dZJ$P8!fnc+)2WdfMCC(EL3`#TH-wH
z-l2D&c#p$kPlH6TEPt9n_{N|pqKlQba8l^#8dIvAzR7_J!DQpEh{uZ3G&haFhp!H%
zRK56GM$P>c@pW;4MM8#W8)Cyuue1JNp!}PkEAWa{U0RtlOQ_*ST<&=(wb6)Rm_UvT
zeKT8LUBrbmxXJ|~X|~R?NaK~7HXKi9M)qV;*$>CZ-72T$!hem@qB4&#%OH6ZntpWa
z2NoMK5-heKty=7SW7|{`7G4TX-Vh<h0`w!rgt@w?WVq5h#aV|w{MeOTpRp+@mioCJ
zKF!3x_63tZRP?V}UknR)F-d{^sw)FFi_V;7HXL)x%&a0cU2#l=3Ob5iCoti2e#X#&
z!{!+X=fyM~RDb2<%6m;CFmYV%U-UmwuS+_0()p5J=VkC4-cWl<oR?&~fm;4o&ouH2
zb+9>xOH7;y__1>>-)9K-WUHN)(Pp7AoH)XmioCCuIDsq5Pvzg)X-mDd#68V0p*F;)
z5P1b?%}EWRG>u4O1#S|kI<7=wO+^ytJ439~Nen=2;(s2uu<kkX)Lla~GR^vr&6(SY
zGv3v15a+j5nW!yNsZg|KUGA6HHsH|c2#F?8-XuiwzEe=ZINcyPLt+HS;$=R)){uMF
zLM4vrET5E9cskgIh}N5d!xmH_?e3`}<939!6~n#K*dI2B^wKfc5v*x-Q!L}jONC=|
z?B1>@`+vN4uVavH9rs<}I1`Ya9v{^SaYW4kTCxKh>$lqi>M7a)JBr(Z9xU6iPYUK`
z-bY>J;PuNkMV52$Cdr2k+(C<aU%c3OBS0)JriKGb9QOWt3)-b$-%#?=2XjAwU<dY#
zW6-rYH4sO}PT{8&(}pzQ-Qn8_(?s6G$@6cIkAIhM$!DG6&(rCm?O3wxTen?y0U2Mi
z^jqtdwLg;a+f%|rWaz~hY4);k&PIl#Evr8Q45>!Aro;@cNhfbRyd2nG%2bbt>wT<I
zE5R0!I2T6;l^-1wRB9v;YEy|DI#cL6Fqbh$SsRuehq7_hMICiF>iD9L3$Cu%A1>Ml
zm48-iS|a7W#ZewhpG;?lkpK@1JHR-K*dib%>ILs7bt0u%)~}&)UDPeEr!^5vyB2j|
zi2xBitU5|CVO9+ws;ze2=MH`D(vYwqzSO){J9pNx(~JulbI@3-OH!+J!VjLf@1($M
z$A@)9(XZ-ZST<aJKW+Jmq=A?3SyPgK-G9k-))8K@ro@^AUMrY8XaPx3lEj9ZdYSTx
z;q8w6;~b`pz%_cZj=pGQ(mSUwNEl9~@7h$N1baTO-b%%bttB3z2la;+0mjt2e~e~?
z*yuerfLZiRn#@KyJ)69Gwf~4_GG!SVL(Qf7NLsQxNl}3$5Ed1>1wX3Bwzq|e8h;}8
zi>AXu)u}+r&`}&i8jc^r5;SY->Ezmqirw!(AYIV5RSD+$mOi+q?V|lq2A~Y9oZc6G
zmcPdn60*f4$}#~@Dh*yiH=(`vgcHl~t`AH3P{CXC?(jy)+#G{x8W97O01w-pxeMgZ
z$EkR1!y;`}wn=lg^5Jj>)6undP=AJcp5d#C+QhvynwnQht4n=(Ps1uWdc%c=bbaMy
zI*Mu86^DyS_vn&@<)PM+IWI)$LytX1{DV_!aK>-uXfrMk&OLjQ0S$<nC7O0QL(*XB
z^L5c3J?*pjLF2fDc`QAy{rzI^yS+n_hBG9ztKl(+iH`2WLB`p{2)G;#u74S#xfQk>
zVznjEUp&vc(k$|7;Ol~N=D-J{&d>qrbC*(jCdB#Vu2)Yv!NTG*!^e3)WF5^kc+Hyu
z+LO}c)CMUAARG;zb(B+jvwZ1kil-S|ZXh6y{8rFed;oedXN@7Kfn%wCY&atHNyUT)
zl=^_GfPu?O1##&B6%5lv>3<SN`4BPja_@+PvfGS#%-BjCgBftxL(0Y3aDJ&fj!6kL
z6wz1%6a`xZt+AV2O%R#Ft|!Gzu%szyct!6GV`5=IvSX4}%L!C#b|Hu*#5ML1u&IVp
zRQVZ^1NFv7RI*W|&UsWrRL@>%p<5!GP!BpjizWctqrKT>fT*NmL4RHrqJhCkdF_yO
z5>?IktVBI$LAN-B*QAYS81{)<&ui3q*OK3J=mrluBIK6UE0*iCqhte0k@{WYY%JTI
z9kFllEW|Qi2N$pNH@vQ-jG{XIL?bKXTLXnH`ED{p)uKzq1*_$wR&W$0o^*dI79HlP
zAX7OrgKIIT`Eye}Hh&_N1k5-UoRr|PCevxqf85OFl*Fg^EMA{+_%%layQR_NTDst)
zpUPq+`0`ppHOhbt20x^0ZV-+opW0HOxvyR;Wk{XG6l6V!3nmXTw=`{oZ8K+dP~~>T
z^(CTa!0WZn!ravnVDZ|8XNg71*KCNx0^S@ZymU0Jsff+^eSed*WPO-tfy9u$cymxP
z%=^Jt81I#<+{;VcSZc^47z7@?X5_NtVh-t9)?P6FITRA`zOJ&5&gr$zP*d?C-JW0A
z8eSq#beR4m@GODI5v1gxJ1`C2tUz<%Q_N;Om@k40ggti>gCFEF;@YCyk%+10{h}7(
z*woS3Rk|u!j(-7;bi;FcNpj6k9rRz#1@BHWOQ+=Yp$io{W9b0$WN^<T)>`CzFuaps
zCL+*3=uGHNDp`gKehk$c=Zzj*JF-3DD2%sLD9<)A3Dy0y6QKBX+@ymPTK{Ov!^0%q
z*Uvl02jA?y=!*7Gb7v8(cT8M{Lpv1qD*PhCOfX*6Fn=V33jso`i6CL3Nrga5gG(%~
zMvRd(Pl?P6YbScs37Yd9=icnd59OLd49Q1MN6k5kDjckV$qlXrkDY0NZ#bEysHErY
z0PhE5M`gkysJ%GW>`w+Cf5RB`oI$_>o+BSnh=$TRDG%77SvrzyE1k}{3ns|=Kxl>w
zd8#ouLVwdI0=ZvQDjufSoa#0LG9I10Uqq3i0VB*b=R_v1ygH}_1CPXQ?;l|<lWCF>
zU8L{=LH4?kBpR7m9};k_bU^Gux8N!QrfTYw#$L<xwTPSG_4)-6*Cg?CNImR-2xZ93
z6@%n#yg(x6!#N3+i|8qOy9%}!Ij+nz@oMSR`G54*cn}vNj(Bm@YgL+v$m2FBu?cP1
z6h)G2qV%U6YWwxk!3%?(asUW&Bs7;N8;+;fSnG7EKO@d3Ed%&di@DM<zC1WOc44}*
zUgm4!bOpD2Ssaerl3Qq;=H4qML({y==%xNqKeuIIC(sr+qdDcUa`Tn9oE}DE&Zu+(
z6Mx&ySc*#fG!528;Ec8#LtvL(H%-WIzOWyV=ot6&!M!y&%GlaL48G_~Cd+r?ywK$x
zNoHrT4`raYNC?kWP!N@ddad?*7n7{86$3V@0II2wt3l#E!yR(ml7rRUZGzBH6O~X{
zz%QuIxU!(p-I$+`P?127qax=(8s=PFV1MAzJ5KW{=lk<KEt{ZemI_H@E#$re?aA;8
z9n}1oq>f1_shDL^jp3-RHo<~hF6<#2eU<pdh)}wUP<-0i^S+3H;K|52K|)m|h<mzO
z?c{aFQ9xQ+R`;l|{>mXdG>(ePc<Hp3L$!RXnfE2DmP2_b)`wu9ogB!KJ)#cG+<&q4
zSx4G*O8K?}kT@%b8Qs)(+=7_ABeZaq($&#-R3mmZ#=JyozJ$hKx<XpGak)OW@(+`F
z3y=VdEy(&%ll8B)PwL#dzMatDpVZ-4q`&KX`0@olH1YKir|8`OlGqpgD@m2TH~5Xy
z-sDs5lXn&qus_n`&|)QV0VG-pEPs+uqM#W~^w)$3PP!AVfdNc=s<9Piq*r-^o}#Mn
zaS@YTU%wZuO>ovGX<m9O5_Ir*L&Vm|uC#rpGNV6WR;r0=^>jw3&<ad7xjZ)8jgVJT
zc)3vRmOyI@E1)SB&0Bj}vWoEW?hYbxpNNWDOe~6|i+dR1I+LzMB2Bq>nSWP9`qF+6
z4uh9+|3Su&d0k3QS-jQ*0&B0vrpp(m8*49iG@4+7IRd4SE=i&W45oHK`T7M%IC}KW
zwkCYHr2|>iRr%29CacFsjR5aYTXiPYX0q-8fMB5{p9+AZ$&oTvO)=D=^1aT{Ze}31
z7`nWSjLRBwdzDW5qGu#Z&4034>h=rP423t+e&64H61Y~s8g}HNy1)fwhEX9n<+d*&
zAf3n^mTGY>sVGNBdu|eE;fsBN?vtR6c_>Aa@7Tu>{-y*p2pYHS*M_))l9Q*$$1f4}
zI?d+%UYi{_bvpR5;yC~+8qn}CilI9)I5S2wX_aECF=T6NyZ~?|h<`w^wx-8cl1^N~
z@meiq<UOOVyV~<>QYLAM4>Rb#tBvhs@p%DvV<rMUky<`uo9~y&3GuI$|K)%FKmPBM
zUB#i$4io9|Z=)5kxRqy`{JNbS(QqHbo1d4xqM7XO{B2~7{+IvxfBS#`|NVdd_lW0|
z=%sQyc}apZQ6Q%+Uw;P;|8Hn`Oky0yIh$nL$)}tD-~adHWObAN*=_ii|I`1IwT12E
zvt&5FNRD0yKm9+Fr?X*B@4DVj9^C&Q{4f89{}sCb&Z&~@10Dk2(2cfEv;N;C$3;KA
zCjLZMTGk_#d;4!A=IJZX3*JGRFDWE+&>wt8qq7(ANf{Mb4u73rkLTA+KD{3_gHe<F
z*kwrC@=Xq&{^@$q<OO`c$iXQF;(9?#dfO(q@e}&5|1TOU34fE~N{1xmf=eE$oYeiN
z;Rs(!xlB40sdIu70rv~gyEy-8F#nMJ%m3-W&`Qx$wNHNhORe?^+N}zq3~~|h1A=Mr
zC3(%~96$esK7SDf9}OV$S^bpF_4U^M_4T0yRgAE^>A+QzW|+}WK1n%=3+xg&>2&w3
zu4<K+M)KuXh+R4s;CB1EiGGuROrFzx+C+Z+Vz}B!?!rCXX#7QP+xaldntI$hKS3_W
zYsR_N@8iQF(SFK&b>%t}J6ReEiBFw@J3baVS-<fR)qk75;d_o!*z^_$s?z+u$0}~W
z;BZwM%pI}#_nQw|+;-`4b8VI!y0FQ6k6zgL#se5OeBUvQCvyA47(Vx*M^b8S{aABB
zyL=$?QAC42cGsUu_thOend|M%GAidj&eEQ5#yJ%wTCP&dM$HE&H<H#@l{11M<!17N
zl>Z;M!++r5C8x%f^#hno@%B2DqErlvC9H{RM03}qxvwDFofelFF)J5&eO46P$-T{m
zk=Az>Jo!NrTrQH$%{C5~CVikN>KNENS3CL8m%}IqdGFfbAmVR*wF>qfo4*<s$81p{
zJk&T|0k|Nk4nZI;dyscYf|!k9PQ|ap+;Ln;PJj4%u6rpE%ylLukL1BRsjb%>sED!x
zzpH})n<Vb$)rj+(I4U776@tf5QX-My8f0=0&RQsmal5x$aO2huqX@gaX(Ucmm8=R)
zubeAx5@f5!qZ7l@TzgkV$#RBW(7;?Z>N$Ju#%I2)R8U~Zq+R!}mb|N#kB|@sv#GwL
zj(;_*BUAw;=)z#`1@JLV2~SQ*Zy%K&))LDB!+Zb{?k9=RjtM}rK6LC+hb=!7*I~n1
zns}u(T^UI)7hGk8l@o9mdO+Nd&Zy@4Eg4r1d0zfdzT~9>tQ?K16O^~%V=3Tri=I%}
zSy(xV%^_^DOpb)hX=SOL9ZVK8KFJ2zC4aJ7^RuXYr@4YrQiDV<XC{X=9f;0y+>0wS
z;&V`#VvAXg^QlBH!TKZv;jjT(CnTzoHjp7xd|I;b#X&QsS1DUI70mQRb}e!Ukjs<F
zr=>Ty^x0^EmKJe?z<(RL!%2gd1x3k9zxa|JT4N`hw1>qn^i0|=Cg*F}sP*bd!hhyo
zXQyklB5Oxnx3~o-S4Toy*Iq#v)Plz04+<23wJ?A&^IY1zrSh0fOb#g4-3Ew#Izja=
zdT@;vWbJD0Z@)U~`P(~=-|Niq(`*crYKIg|YLfT=_Rdc(9gpKcK)~oyukDNJaBydu
zo(J9g-j{SveZM10+n=(boGo{xyMIrvIjm9vfkA_A>#^Y9x)x&dG7pQ31Lwj;SvqPu
z0F5&`+Zl1hE7k0o3{-!&$N!0VbBIQ!oDWtVH8#S0a)r`x5?aT&h%9@bg*FK5kG{Ri
zk~bqp++6YY0s-GCvl{JLM*ug1p)=5XHt|DW$FSuflpX^dD4qH&-Y{~8E`K>iY#(x%
zp=_;o1}{f1HNEuzEyfU7Kjh0A5k|*t^9^IMt<-Y8>~kGUri?SYpE%Typ910`=Fg|k
zF>Pz*-rK0by3}#@pxX}ON`1jSiRwd8XJ`jR;1^r(nXzQ_Xl+z5u=;Ii*1v<q{c*5{
zyoavJbi}F!gTu=2Rf_R>M1QM*dx?|Fo2Nogi2}W7J}Qf`T?cH#0fM%rh$rOiW=T5W
zh#xbQvYDEt8Vv+|#oKoGE);^}U>gOTo7YnVwm`A=EAhu(=82HRTA=ah&)(#p$z3#c
z5s$7->715LamrrhdP$jl<wMI|^sGI~uFg!B%jHcEaq}j!J|O{pDSvyItm>As%1s-l
zaV)>Ga9zi8!qzUYPzB3H#cn6l2_h;g|B?P+l+!fQ!5Ph5tX|BGq*E99O5O6%njhDx
z>qok!?O|%hEW|ulZ!YUre&6<&mh30*rL2JOQ<l+;uTkeq`;4!C0kBy72G4$}>y6E=
z<_#;X3}D-V+j`z7oqt8F6e`mF2hCe|7LPgXc9;!2q}#$5^XX@w-%JIrTRZ@FH7Y{P
z;M9@6jLFrJeKXh9lD-x)(qxqrIz&0F2O#orI<?#FcT1-ZuClEd<x%j~D&o8Ft9A;(
zfjdr10kEyU;Kpw4X{%&3*F6Hi7mW3WF^A%y=1DW_J%|F)#edI$LXO5DnIQ#%r&cC3
z2tj8mHMDgp4O<32q^k^(m1V{0Ckc<rNu8M0$@@r%lLJ9_2eVa)W*4v^dd$JwdJV@?
z)D_7iEd`|-T}y`ug@0dn9B__DkVQ{&D}A;{n@NzOhfek%*;CS3q<QAo7SNTtWGW3T
z^oXnS8XtBxKYwKefm~e_F4ZC$pFNmz@}R{I=%Wr4EyicSa9rL5I#KNRN+)v@UDBN)
z$18W1E)8L(Gc3`ko<Z%%!OsNPnGDf47~}>oDg&Ew%o=)77EV39uJCYAf7+a#h1!8Y
zXd<fDFYMgJ7R2RGO+xf(;X!{0#k`@vFlzMX{vh~s)_<ph&{aC}k^CCSqMb5@u^TlI
zZKOvzYd7>caZdbO^+X(NFdL3|l!En9oarT1&h@QrW0xSGg>=l&jT~Wu&T(Ddu!4M>
z`tm#~j616DXT0Gz(*@%5PT}*=)_Pz#clCYG@)6ON@pI7;og245tlHc!@`6QhebQkh
zG3thXrGLS~;c?HZ$m>{vXAS8U9cH81P&+Y!7Cmt7%cjfXk<@*ztYL&M*;%(Db$4{+
znJ9p(x&$LVnUyHWIkxA2Pc*DkVQO6ln55*T%G-mR`v&5lzpa;1|B_4l)_qs6?Pc%D
z%Z?5`8!w|ty+%~45j;~xN07s$F)6m+^T$aWRDbJ$MZAbc0;O!c{A>i*nYNTC8NYRI
z2l-oj<IT4ihZPgCO^Xi4$=-Z8bB#mxHO%=T>B^+c;MSQZ+Nw~A8_Co@H>hcPJ~t=&
zj`p!Edb!JbtjG&mv-8H+TV2npurWwaNugdsVmmG%PMR$n$09;g6Q@H4_jW(NJtx@(
zVt-sOC1!Ba7o%h(*HuM26CXpk4Yj75$x_QPy2?=tR7z0?L$e2T(jijD25|Z@W}+#X
zP%#%Nn12WL^6#Qt{=L<}zl+{h4>ruSjQ404t}v5b|D30%UN(?9N4bfqBsL&?;<i`9
z{+j&V`dnZiLvG5th3X6Xeo;&x7c*RaH-B|c;`bR^%{{Jh4L3inRqN*-e#r<gH#|75
zj+n=rmD_lqz>+HVOU7Y=W}f2w4705Tq40$uICCtq6ebbBg_(OJ!0E0KN>}Y^&c3K3
zJQvzp;Bl~eL8>iBIbzx|Z`NGDsexr?;nul_Yzw%^yez0;gN?bgv4eG_>ncB|nSU$B
z*r-T+!DWwk$RH!0wMzQ_{CC`6oB?Uc>aH5I<u+N&%mxo@V|`td-_>@AfP!q|yO)Q|
zXeYgnQJ(^7d0Ic=r{H;1rk;B|_d=co{_)(NF*Gl}WWjjoGW-~dNDGg!)SPG_uce{z
zZgHlNbNURpP7ji3kG8b5&3VveQ-6SM?K<omZiq&JA~Xk=(CG}Z^!&VoG+F1e?`hBC
z>Upq=(Qqp-rp7HxB~G?Zrb8e%qLeRFqgR1WXT3MsG<43=0KH>Y<BQ7=4|cx8gJ?0@
z5{;wfSB3`YOZfb57qI=-l0mg}P>m410y00O>R~GTnNG@&FLFbjb)+-N$$zrW?ue|g
z=sgQ)29xLZN7CL$+-vZNiWrjP&A4BX4JKTL8PviLi|CN{F9g3@_w*#}n6m*>5=K@n
z<9%~|bG@~(+3@~5%&8><XSXERQCrh?Yx0A7n59#nZmF3s;S1FXt<^eqq8}|0UwyY@
zV3lwTIKp6rZ%G(9>a3_&H-8ktq!t-xDVFn5@4f;e8^OANlHqnmUVL@<Ot=+0H%eQr
zrDF$=m77C_R={EDJHzB1)d5Y`G!0MSrdSW``l)u2;EKdb@ZHI^3~2GHEP7YUX;LPq
z<^cG1NY<qfz2}!&IaYop*G6zD7DN$T9N52%YZdtWK+)~WxgD`GLw_6-J->oY2UHLc
zt(EYYWal%)C}nSv#i{B36NNd@XcM^>%XzXQj&8?@!}IM!b8Zv!QtP;lIG6~)bE^85
zet1H`%A6&OC)#|a_DWS26~zT!HcZsBWv@NVT+(vM>4RJ(3Qq*YECc1F^W=o>tb$ir
zYB)NzUVb<mZGQ);Xn(AU0lr+V9$ibc|G<-OdC?Gts@=2Ff<$EF&z@ASvuUJed{Wo*
z2bt|d27usXC+rE~^H-i)Et3V2A{|X<!55#@gY$r=j};o1Gomu$6EG;iMO<(Mw117s
z!JmBcuIYQudv9*)T`Fxbm^fDjv-X0TvI3wn&WF6=Wi@_Z-G9z1{d)4F3Hh&`2|i>X
z>O=?x#DJZI0O=|QIyPW=<i-l%c#heDdsNda^sU#tgb1dQGe30UH{P(?&w7J2z(uO0
zt>uy>V)(aRw{ePi7%jJ?@@hr}Nin|QV!u$S&(ATqIXuge<ULomW-1|5d@1Zi71K&X
ziWctPRecW9w14n#{3Y9kzf?!XpF)@Ti_N)`tCNndW$<jMS#epND$MEtA!NC#MlkWw
zt2qvElu4;!t%K?LuH-&qgtWY<Xy8+I1j5R0z%)6`&iCG8Fj{THm1@x&L~@p6%u^H|
z6*h)UCz0|xE(w>#9A4%qm94szrx_Oz3dji_nttC<nt$xJ2nZ6C2pB@ec1TOLVuS_d
z)mz5(M!6ZAz+_#W{l!%t4=7j*pgH_XjL|_D`SK4b<JW6=1#68>tI6kU>8d&rjteh1
zDu$MyDm@!djB0<~(Y)I*k&@OTxCuxS)te@`<)llUsDCoT)rf9h@z_aGK5M@)i!{VM
zl2mC#fq(P`vo5Yq6kS(r{UZ6QH7#05jP{SRW)@+?7$&)^O=;T@CRv3IjMvCf<|~F2
znxSNjyBy%fNqM@hemori9X*YQc`|r3nw1vQsp1nf%@t`2ujo%CbIE9+SS>ox6?uqP
zCCcBIEoGrSb5bbDL{i;d1fVv{I0|N9Dv_cCbbr)SxVGL=0j0wgaro=C&5j})1m8t?
zTff;NF8}YhNS<2Ug!*Z{=fC7OO}Gxpbka?39FOtf<xS8J$!O`cdt*P!)o<=c%ak~f
z?jO5L$0Kl9)N4uix;A(H5a)j1yzIicaXh$ox;OV@H`9&%Ku~y3KYFd*yguOD@9Bqb
z!he$=Z`ul3X9a}szGvT;cO~m{J%wQOe)?%TG=Rr^%(fLRpsVYnF8l6{{WSHAZbSVh
zW*9xd{d8{Jbz7gCNrU=1d2~HGVo>bPSyBABdZ&L)95e5=1Sz|Le&{Rt)cOM4^sDY%
zKg>uTWuu~*Je++PFWKn$^pwT?q)D>F-ha{Y2le^@qQ$gxK1s(vU;I3{fl&o4{^J<c
zAHk&@i@KTryr&6wLJT7L+izeI-S>5}kgsqj?>(XKY2rA_jqKt*O{5c)ufKUDH~(I{
z4MToUlVEpl;1cg?!kw&gDwAwbI;l6RZK(-1Wa(S@$dX)ia7IU!{w>ZLAGbTd`+wZi
zp?_LjG2k_cJ;5o`&{s}sf$Yi}05F<ZqH(5t56<FIjM~r$1tBmkRpTi6lsbX+1H^~-
z9nxEf4)bSJlGq+9M-Pva=lg&9lX3p;scRSzf%LHlpL;i{^kHnjo4KDC5|Z?B^s_Zt
z*hl&E;3kUx!c;Qs-dEj#Zh}5cMSpAkYJV}qeuwK!;O45`a7l}6k%$G#i2V_+1Y6XP
zDFHqxaFwBXEE$bWSGUm??=YG{%cEK~+6g>%UMAip8XoMzKceb@yq_(1M8;EZY%E9V
zo2&y}v0dxhUb78BH%&0wfL=CmdOeBhshG|EPVh6fJhC#iN@LO(ZPi(;7k}~}&lpLN
z+g`9y)EtFAAt;@c>~!Z%;H{QT;}RGPPFGysopmEF4J=q57B)J)sL@^(qqJ8T^dR38
zN8diP+C%it?d@&27v<$pj7dx3G^$`_yM|7Wp?SSZEJQVDPuLEVOo!K<m^{8@%TthP
z`gS|1Hsbj9cDpSWEgG5(D}Q7Vfi}8Q1}3E-K83B&YGa^d%r;f;L+U;W^ztqf<bzH+
zn-(3Xuy<y81lEaq-Kv~FX4IsLq8BOWj}7<nBUSTu#S)<#anfa6(0z2%jqBHJY3Z7d
z_h|4r!mllX7;CsxyARUff4@p=K|TV28Q{_0c3-O-sRIpHL-t3)!GD}l--y9&e0T3H
z101Yz1}z@%+M=+<k@4($>~i2#Q0`ktCn=#2jydDpVelEs=bvHv5!hO!fzE)mZ$uXP
z?Jnd{$54UJ3~G6c9%v|V7tB*y<@b=}<l>D(m4auv{zBx9h`dU%LvhZ<<{mUR+aiAo
z(UuWM)l;R`*IBl>zki67l>KoAaxh%+`0P|IXtmn&&~&wkkTme1`ebOuJ3DiLz<hXC
zk`rucD>Ufcif>e{M<i&Oq1sn>qceFyq#S^#{T(bhV#ZJ9#Uz#n@x%dmP|O;Q?Zxcq
zVlI)umQYg(01;-TkQUnXR*mz8*2c%WWf}<!0mM29J*l_sWPh7DgN6aVV0EC0++$Yh
zA6k~&4h-?l<iLXdCaAvNR-9~S@%2TWyb-uEmZ-MVF&%0ixmof1c{%24ST@pE`ytS<
zM~T8(Nmnm%uU`~{K4LO&=t<!O<+``z0A=T;;X#H4rNfHw68W;~AnlNZ>3F5H_V%-e
zdq0k~UJ8DIQGaFX2!_EA1{-K{sKh%9&NcsN)PtGMpUSx&Lt^0GLoaINubS)26*RIw
z_<3hKP~qG0l(;(kf3N?A>edIUS^w?-$E%~92DI}$7iYus^le*#k9ybsFW|_NaNYjz
ziFSnjCjYrQ3s*-jCAT_I-$-&xxd>J}c_e(*A#x{Ux_{Y8QB3yB<RwXWSBM&46_2OY
zr#Xq>yEi>zH*4AojvNXGd~uxRC}M=tM-flnPFnO0y?9luAC2VCcQ!Wf{UzCh2%&$Q
zg@nx<%>>9X64gM0KmE@vN3zWL@?JB!PKOAx{+a&A*}|=tm*Rg;RuAbg(Xg;OdR1d}
zUKF08SAXg@7FH7-V&Q*BwBw}z-vW>P^wu8v|HfBGad$yG`eztG$W>;Jt+w;3uS;>#
z4I(zXPUpCl*(wND3XNBlQWR+v`00YMg4nu$rz^_xvdBoSWS`3nNx5y&BJ>>3{~%S)
zRqdE-Ww5)eoLfEryIAuVbkAPAe@Ck`x;FFee}D3-s!x$rb@p`BYF++U?5BZUS#@(W
z9I(O6C9vVvb7=w7t0I7Eo^XATkJHZETyL9``cAyl;}7?E=JD*@fe-ZOYhn#=wU&BW
zQ@cQieL~yGuabGTozxFR``kcz!6_ZC(-}%dYEaiZBD}e#n{@>!=`46at8;6WvbiPH
zl7A3D+MR3z7L0c;ajUdOpHXjEYdkOxSl9&kUyrpub%_W#+4v|Tn7s)nT6>3d*$+2s
zw*AN+OI>dp7bj{4qr%S^(|k6z2H%N;OaQ%HF&X`q#_C|?Z3E4I!vKoN26Dt&Cbs@8
z?`9)0pIXo|Yu*lRU64euZ}n*7<cG@cp??XNCGfrwek;Es>(?FDqa8E05IAVM(@Z5j
zA;Xj1XZv#r6k8~A5(<d4hbQkvl5R9bz1B71?!~j!P3SE$TM{BKYW$@uNHQBGvo%a%
zjql)AKUw*;9-V;t_OG@)!Rpk5CAo1$-o0CKNRyAmF{*o7tHqy%CtYL%<j%O@H-GVR
zMzs>0tgX*^e@mjSSIrw!qas6Ak5N_#Qgoj&(4|%%?~YhP5k(Di<s}KxQsbP?Nr6pL
zzGEAu+(wQ@)!4{qseE5`do5PM19rtZV3Ov98%-UN7)guoy)(CbT=-muCI?+VNIkkC
zig;vVaOY_R@u%W8E0eBwT$@+gYJVoW<wrC9(J@FM8-GIQZS`&P<(FS3E2rsXMPQf}
zX7uD&J!AYEer_6P)GzQ|^6p0lNp??B2mZm0;F-rov6B2_@|OPpI^lqC-)=K#_mF#y
zf8UDxkry+v^g9pN`u2JON^9iSPrk(JiSvv;!gt28Mc3O%Ds8gn$j&n$pnt##NDEWH
zw^@$>X-|Hw^RU20?%{6me1~x_MkR9N)N?u;<;Vxf>hFG(Zr^gBh;>-nsjO_&v0HEH
z$E`Jb_%(5l@_M_c!WE}!u3k5=tkp+0qepD<tF5-G9qSe_j&SIUjMnol{Sj>dE$$~{
zBH!ui+v`TKaUMQx{&?{D<9~=My#)Jn42RQp{h>e83)6B;P?@it{9p%49R!G`btlAG
zHG}8W?5fTtl(3IqEaK;Jc+l8VuctO;gRqa=53Tssx4<=T2i?5z7GK@A6T7zNO!L(#
zdfRtjz=12E{sFbK`JVP=q!xY9x&6TBA3Q;cpV-2^&81x7UU+JklYhQv5&una8`=d;
zL6Hb(g+r<mC2xyv2rBoU7nAF`U9lfl`x*SExF+Vd!v7>ImyOPedO7#7vVur=@sltw
zXgC-9N+$eCxa1738Lf+agNc7qS#<xLh`NK|xhMJ!@6-a!?AufDe=_Mmlu6(D9b}8G
zSVpV16%m~#^?*z(i+`x_@WEOdsYa`5#9DvXoPR>;HF`iPw*F4x?W;TBpH`}ko>sc8
z%WApn=qV9sWsNv8OH1L%Hzucg5mg`IaHxgiYMAw92;fe3ba|QiU@A$*oB>IfgTjph
zZCbQ$hHW-}qG>%&sVYsYQa2(AKtYu_SggBmyNFf-Kmn6GCx2AoQ2DR<^l&bdCA>~D
z9hsOJO8DLR2Ij(jW0#?Pv#@*T#@n8L)BQ9XpHDQa)gE4(1GeeVn<QugPFllC1aK)*
zm?Sd9#Z+>YF<l{D2E}`dYHnZVsnghQQrM*OZdis2cxN2Ivak%C3tX$@47#9`6A&1&
zBYx@U9r@JZN`Hv4%K?qK%-?jvWrVHlYT$a-^ij!d;pkHY@tJl3m>NY0SKJ2b1qILy
zN!f<nFEUwLF}IipoFfM`uas96R=K8@9_(w~c1_#&+XwxG`bteRVYHs1A{Dc9y5Mr|
zLD9Rm2Uat<VSq7W5;W2|0%0e1%8=0PV{eOUWok8108>D$zuAA^&s4P?NNaObui@7H
zgo{eZEsr`k316|lNw(`Jc8`7sj}xuQ=E`6Adpeyav)My@`^Tj!(x6fWf@GSCetpGB
ztwx$og)EY8+706<QYRL2G9xwa)<HH?4paqVa=pusokov!>%;51WMkH0psshh1Fk--
zq{OJh-1fZd>B)bG(V^F%@aF+rn=WM$v}~BGFANejV5qA!3ImEmuc4ryE@LBXsc<?2
zXc33c)yVrGx`-G;6a<IUe!{V$=~*U4tH;GaV*QK(e9)`zcgiLC8+Y)ER``mRdj(8<
zVf1faR#pPLk!r2F(6z!SP}l@HgUnEU6-&vW<10bz5m<j{>~zzohgyOsh^{x4{E9Z`
z-3nEig2nMQ5>QJ|U1x#?<giNeGK`o$&)!<HEtkVnH%S|SYa?tyznGm)wMO76S7s&V
zf`5r$0~Z|hEt#xA=>wiz0Alit(aJs!vt*#p`d*$X_8IQaNtU$`$^%q3HE`LQ(yTbV
zrr@aYe42j^1vAe_gyX18&eKu;3#~I>4046Yt;~tP?Id`c22Th0N9iE>m;dr#r8;L{
z0QEIq&qJc2!Komq3ur}p&QXYkf)TOZk)6+F;RcWLk(rj<lRAurVubT(Kx<QC;^Jo2
zOG*`icC<pC5{eOr#A&uJ{l%fdNQFkQXizqMl3stUfq+{KHH=Ww2DLJ$E}r<#-1yv|
zAU@*nV=LIZ%K7>7N#a4b6JNm(6`oZD;J?ZOI6lqfoAm5W+Du;T93M54=ieS5H<P1p
z>CY#-FPn)4eK$1Ll80)<vB%Km8dlCxqKsbzKsuTYON*Etqut%T`^+%*tZp&5x?6b;
z$6|l3J+<|YsKC>l`4q9kt{$zKV;K+}PjNV{7B#c7vp^7`&t1ks5+=`nC1wR&kzVKK
zgW%v2F(^5jRWa_<QParf=r@+4uCf5npsR;yO>!R%BHxOb%hgwEX;Yr3+L@)m1CMAv
zpCau|iqcTy`FNQjhgl5DU(kFrQq`rft(AXH;S%67xyz!Lo`St!TW`*6t2Qd<xt5dZ
zDndgb1N$*N0lYvfTC>Fnk-CF{rm>r10Q!hd(OI<MJO|7hNhUaty!JR}N?6$E-UVH3
z2AoeCVBkX=L5U{yZBSgVm8=~0Jj&2BA%(PmE@i(tFmQ|u66HeRM%I*;OE)}?u+)Dj
zcZc|>#eq*5p3L<p+u(XlR*!5YAInPOlsEk;Zu&#q^k=x~j&Rdizb_!}jv1Cpasl|I
ztge)PHN}JgG?DzRElSE*nRyRt5_-D;{+Zl6ml>3zH0eGQIqiFhL&ad4kK2qLg4itC
z5JdQL=8h*#L<oT(5&hmoC;#}OtD}Endmo&H2o8N}@8br3z!L-qjXeKQkHRi#J8xKs
z(Pf1c&sRaM#=nUMd9AOS7U$;!%RG}cU@2U04~-CY0Q=aP%RIYk%X=iOTnU$z%W3uK
z5V2o!f*aiwv*B1n7l8YC4hfAG2Y0fL#bdEs$Z5`0g~AX{I^a<XJwA3i@u`2JiPma6
z_Ox*b36A%qiu%~VB%~$hN4i?w#-(MbAMwfFak7TWJaNe!J>1NO{)s#Ia?F)^S*CZk
zg6E`<<}GD^HcU-NTKrlam+3%htAr7Sg+p5nW8`dRmL1~yx^yit>M72)teBII?%t)%
zrdvWq>4CojtO)VV(-nu;!pVO&X(gtxYq$c`5{unLu^Az>AyxsR_#omO6Y~tuH7WgF
zp%b)Qf{{Qt!zO?-(KhL#MPmz(r5H&&+*#Sw*=y1XGXf^_#XJR+<M@h_&nmur%#qs2
z0h&$DIAu&xZ|xlx<jy!67#i56F1}t#+;ZeDB`DVjM3-<JfjvnD?t_2V(<ZAg0C<(H
zVX9xcHOig-?2c|giL@v$r4yfV>Ix_K7_lRd55BGQ1POQjKB@+3GT@9DZ7H@OlFhFn
zSd<rXI**s%+5sXT937=p?usM;R|7{KzH+_G4bkVzu4l8-QCj9t^^(7tz=QD#9W(!O
zZ%@xjUOQ(<U)w&p<Z*v}Ie~$wqI&74d{qTk|D`9Z(qC033^X(WQKqSeXtRlwBK!(k
z50+IWIT8JGyEyfRM{?0j5MIKWK;vhmP6z{m>?K7rS)ga{e4&`5a)DLka?XNKwCyJM
z6mXPbHaX|@_vrpBzQL4b0r7yL7AQ|dng~ZMyNbJy^Vq%I>~Md@4j1L;*Q7XOCEz#`
zg1n)Nc^2t;d`ZtnP!3Sy{c6~;*BI+F+0y06#V9?iCE(#0Dpj6j-TZ!s&N2tlK)U9z
z#j_bQyE-Vv7zQuWgK`6ujfT?IFiS^eV9RCg$u2LuZVyq?kp&>OaERAX5LYkgtO$Pm
z;M#-c$c!)2zAJx2$Ne>9ql;`L?O8TBqrK>heRN2?B3K*Q7C(ZJZ<rp&)u8%4)NoH$
zyLY<{&1sAI?{Lu#$iYR_`v)v2{zpeA!AE{@&hl(4h-f6!*Pr*sAE&Gj@!%bAgMGgH
zGT>Kk4LF1J?%n64Uk;Gj!m=ZsB=E37vPw@i?%wsle<*+5K2R9Mv9@aG1<}jY-KY)R
zI0<U^dDKv5f7ysRhr^K-+mVRoE{^Znv*(&oN<t`+Z2l$-zyoR=W%V3ds8jQb(Fkh3
z_zlua;P+<I%_={AvO7pg;q;T}@#l7$uYq~s#sUDz?rcIF%D2KI_xQUu5k*5{gXsvK
z(Az^iL#cmB_x>f4b{zLx1hA8-Mf+(Gk*Vr|tvEoA6v2Xj(^`0>1;H5ZK{p52O)OA=
zD$iwD!nYES2&*?r2GnU<a)44MF{ve6DUgoEyhE}E*1^p}lRe2~t>n27zG7hmpEo(7
zc1s@d_Lwq+v4@%EjpiHX69;ka3UOLlI>qQC@tuF|x6ZbsDEBgACkNds<eew6%hrM>
z*L`j(jC)gI-S{d$nS4;E7SlWFw_rQHPRi>N7p;;juP~FRK|0GW)4u2&oB(&rgbmpW
zS$=OCaA_aXy*_r^91un?r4^=Yk$&U4Or!;cpw@95a{z_Sb8u28zi^|YA_MK*-0~OT
zAOn9ywaFv>fKG0DTJ+o9!-E$sUQUQ#!yB+yWniyw<&cV~Tb)=|SY&SU@98U~b?r&o
zsK}%SM6d(HJcc5y%uOcAd`oo!Q!wO9YgkOm<Pm3X785O)ozc05mG~-U>yNR^uwJhA
zk^9JLz7}ridXAYALtN{*hVU6}w38==!;*jgm`;>pS;4_x-o0yszI(T}Y1;eUyV^JH
z7VF5xc_QjOvq_)%-s=@JBFrt*Ipp`iiiRD%C?K0?RU5v6riDuPwR`j=mmQVF=p`K5
zCC)Od4)<&)i1lT_wux@ES;aUO7j8y3XgW}eK(hGRaGiC#zM|=AV(VAQ$-Zw}F1mjK
z11NOgu;Ev?P8SOsfc(#OEFqG)p`g`msCC^fG3zl%cA+}U()zy8V@OU}gJweHDVob;
zQLLrZI1A$9F5#<youBRvd@7u;!}(PhARoUoq;}GEH@dxBU29Bll`(YTR=TH77h-w5
znGzM?@9c6p{TKkg3afOT*6w>s-5G!5Rz_tYK8dO%vX1Jm1uy$OmF)jnsq_;ugM*#f
z^g?X_9A+_p#2M@&m6q+~>(GbolMH01WG*b(uvnox_XU=+Gn)*)TD(`41%BTKGklFF
z?p>6%XSr&A4>7E>m=a9;(0uN@cePivr4<#kk?e;vN~3zPJF9-H_8-v=&oO^G4!DzD
zv{)&vLq$)lNVGp~*>J2haGRYEna7+$?PRWoXDo<ikU%E0UvO#XxiNd0ml=gw@q;3b
zEe8t3YqES7uhzam_d(_Oy#E#J3?H<wS8Ky--v_?x(k?wjTz3jmPwB=k-IXlCLl?AK
z1HPv(AWtYxx+hfO0BmPQI7WZ#90(({`dk{yFM;EX&doC|-ek=87cg-s_OjRx0ZQd(
zR*z2s6wpvJn_*q}Ga)@=muXp<<Gx5QbMqZ?v%7coehF|3Lg1A)v((Tdb@wiJOU<N`
znr!7UzQeN)fkxOWlil6BZfqD9?=kD5(bwE95?+w+;A&ln);Zr0%BFu*8kJIDO+Rg6
zv9LrJ#TyY;VT}0*s`@8>)tB-s|NYhPB{c0aJ?(95Zh`8)5}Up3RRA^<5Ly;+IJvUV
zqrE2Gr({nunmLmbEdyQrl6gk`VpT*Y9$dGRW2_qZjtHM4R;=D+*TjuTSw#4U_+LZ^
z6MwQOc&RD@7V_q1*A9Pe@1ctvl%W=_o)v{rvTu44f$P9MrBoQZ3!O2VR>v)X^JeHV
zV$>VvrIB~h_u_aFPpugS&lDr;1}QUsVzNV|qUU`$htBhI>O$1i;=)T$bbBeOI`C(X
zB7N6|wTJ7qqjs9gYO%*^R3xV;ZB*gcvr;jQf?LGNZtuPRmJ)yTYw@-%9FD~NgcI~u
z<LoUdzygWe@w+FkxY&3c?PaOqWtgnr3=&`bjQ|<MtSMp;;kT$$QbL?2vyps$c>OY+
zUUZS0oVi>d8J|{b?uHeCyDs9V8B~IN_UyT)yLpVQxrvFs-cDX-0l!!vPD_Dx39``~
z#K3m#du+m(kF<X=_N<&<OD#;vH>*x>4d1{StDl{Nb&6s`)j5K`<oJSk2ekVo6Ac^e
z{LsbcU0&ql?O;<ligc36MHp-w-}YEqeU6SzQ#HY#XIUwAWngZS5Zi!u898y3a~6e4
zie5D2lY;dR<ked3Iovm}OHJ6mme56N43JH5;`@Qjp>}^kCQ?>8#)H{;iyF4r{~c%n
zVqy)=i$>LavhLpHAQPz*1semjGo{u^Ix6`s04<uxv_r<M0g<O!SWjwd0#C{r`(jp0
z7&eOo0N@&TLBf$@UP=n0sz;Bq@(sc<@lrAQwYh9pFVeL6hi#OdYngV%U&Y!L27Qc!
z#qC7MCs}_+bf!dspZv<yx!KN~2p-!|tmYW1O`YX~Fd?)~9O#I<lF}to&s?{lML)W4
z>3d>Zhywqe*L0n`d&gz+GzxQWv3OzGnXz0E4fW7uRUtobtBxY*sj|8ijg)>Dp)ZxB
zq%%`0f>x>ydX2Rq#foBqN0+}&f7d0@Z`q9L(CL4)U#TP>e2?T-KEk@&3l2(<`zi~N
z&=&9mt(HF{Sfj-DIQhc<!j5(@m`-^69IArcUD~c2D9r+I>Spek^>~t9a=jy@nYCRZ
zdR_o0AcBurK6I*K;$XkvSygY_sA7tVMV(|%j_tNZyhK6kkrm~Lco22<FaPELeCY(%
zpay?M$|=m<l0>)86^!u1tRo=1HVe1a%But#)+R;+)h%S<M#8eM$JperNWc8Q93ko!
zmm$~E6^=Cd=fIlaBaq6OfQziWmT|1OJLa??1<$_bz(<&oXgGN<`-c_j!B*;D{>%Rr
z0WUlxEH+cy<9uX+=<^eG4l<J}=hhrVU%r3g8RC?<pjJto=jxSN*3bF~G?eSq`jk*u
z(M*GqqRE7#?n(Yb=qamK#H8b$J(OauS|?deZJ8MSIee0hsufF^Ny;KjajE6o<uRLp
zr=<z=!L*f+BA17^?Wxy}#RlHzy3Kl}PYZh8fqlM%B)1hAyGLemF)t8h5wV-Ge|mpq
zR<^RVoVGSr>SCaAXXPws0_sPJ4PtL#fy-oSO-h)JWkj!~4AgY4tTiV%;6~&G1>zb1
zRFCK-uo1wCLw9hr02nRncBmO?VIHWFIf^Qnh~ybmWOfxw`+8}a=)xjhyz}gl2r;3(
zky*%ubuATy0|(W~hd}H!0?z})jCg;WB~dmA36&shj`Q}T5{T$BH7}Yh{WFHggeCUc
z;$9K@?jH+u{5n4oDfveOL<~FYzH+FQbdXJ^WeX9EqimpuUITHN7u(Iqk-6;>y|A@X
z`9!&PyuQBnkpBPe+qX-%+<C#O`_6<9iM**R!bUjpdBsz!*r3d;HpqPOD0P28n$dE{
z<sW$I2vJp5CDvI?ZW8)eMVSb#HYvu_&oA@-j05qg-$rxU)#{y}v7~haFR)-o6UJ<M
z+$nUZWYyWIxE2<R_o_aN*V|67Q^j3W*qH=ciQN}vD>!dJCb?MU38t+y%)0Xc;ZAsu
z{O+qe%eK0j!;D$wjDa8tWJ!Oy{UeEJB<2I>8|EZC`f`%ZSt6{e)Sop@9k`g_9=|04
z9xA|&1pM%~2nx|vdT|QpZ;3lprLR{Nn<)4xp-p)Xk3}a-?<8(WI$NaQQQIeoBeO=Q
z*L=yaMkp0p*rjXFJS7pV%d=r~eE8S}{gkYxL|>xHH5NT@@2ozLpfrE0Jd9V*_fu6&
zsT15j;RyVoUE`OK&$6qXQU7(CPY;>v&OJJoMod;$)XXL6>80)Vh4(bt6`?{~*-%fm
zb(Pqp>Z;0q34nHGxA*~WBwWTCy%L@i#(w*zvdZ!M-5T2vqV<W}%6e29MgZENX`eyy
zadhpm|AQs;Ow^V!Y$kt;=x&8z@xoTo0>+JH5yQp{7BYTB7BhUrEoIy=oYOHEJhyo{
z&K{R5^^e(7MoZxX5Ns*JX0j9x$TC=puvN4aabsDEu<?SWh#!%q2p@4v5j12%;jp<s
z2bnb=P9rqouMq+$bG4!uapgqLExLwVDtP2sabDVEoG8k*B$j_Zgbl!Oqs2ELV_zcg
zT*Gfs%{*$!_06lz+`KDX+hU15_myu#&MV)<oZPpn@ba*+>}c3{!H&j{7(e!p1iaWa
z6em1Vtp1#60LVw|r_6=AnVUvB9)~l~CJP4d8e)xgByNQ@S30PwpfbNs-~a}}j~F)x
z>OU%aGl%7bSAKuX;ro#owX>h}!)B-#ki#uIO;-2z-1X%ozGIT+alT1bopO2rgS|7f
zcxHJTmT$mU%Rk+{%a*V`uJjn%EQ>*;kvmr%a%y{1vsASCX?2<QIGB`8HWvIR=s9&w
z+?RZK=P(J4Jx$K=NJ{UouSN+wJOb-l5Xzrl^MHL4xv78THqtPnRSYBXoEN`MGM2Kw
zhPX-k{R00GTN}mRbzT(oW?;*g8mtx+@|J4FV`r4VX_yLDFHRQtP4cpwWo|Qqy6|4i
z);T?Qi&%*w(9NuvaBpQAb|zka!*|&P<#jEoG_cl{ZZ6J-Zw^4t1`bnSvve|I$1+Hi
z!#ImGVx)fvX+r?*2S&MCA9JCg<?UlZ(T6*CFDLnB+Jl-o$a~juAZp|k9ZSQ`m>Y5@
zM{2kKbFy0uhqF;W4La!Oq`*x2tU%_YOCsa7?>>F`eDjB=<;#Z+4xIR@(9+6}q%9Xz
zA8YOx2mzMYlPCG~>Fm^Zd`{}b?3DX;R%ntCO80+hO^7IrXI66yf}};|;UH<8kdMqt
zzA5Y)5zu^v%ZI(lZ>UA9`dOcS!+nVtM{SEm;C^%*N%71}4$)gUe8wvAK|<`Lghdoy
zqe{h<^riq=O_LNX3xj85KTW0qQOV8>`I8U|wngc-{0@nX6|0k<4st8vsr%qy$*-jI
zi~@fwtTDt%xMm;ofPnJApa9Yf-b1e@LRkgsLB@GEh(M<E-k?)8Ej5KfyldqfP1Y%A
zq<F&0SbYva2ml=Sra+$pF2jRM*(z){HT5s4BLLJ3CUvfwqA2MM?V$;rBzE!E`7qNP
zV@oA1oVL0CasX3JKLH5A<fiUj&o@V{j<tV3$aLH%$8j9{y+8oRMhkS+;&Lk-z7hPs
z!XXbkOK8yygt6anuJn->a*<t3#}~Zdlgx6uc>0pgL1M@w^H8lSQVm0Zk_5U-M^Ul*
zo17bB8!pHj7)#HZOkJwIsm7c}gUMHj7(MrV&p)oZB&L2R_?{Q0e)F?+UaKdVA%cI9
z=9|c<#B%vaC3Mgk5^sFMX)y{8^~fzCGfJE!d@l(v(Fx+WvF1HP;UP$KKrvx+yN377
z*bK7<;^!UA(vt3PUX{vlKo*-V(IQ&(9VkR-qta05<2$^Ybq%HxG_Dxgd33it4oq2&
zcrabe-(3HWrv#`BmJH;pEpb?m-PM1br>$mw8kirgj{>K+Fv_qA_qGUIE!W1@pna8{
zj`di;&UJnf^t0H^W+%cC`H8;{rs?TTtI>=WfdwtOED%uUCg%rGjIuD_H*|LN1@j1*
zVA&-ysLq_82*ZVvA2<w0kK+aru2>qB#NE4(lqHf(#u6$$56=ZMI8R^@k*R+?=u8TW
z_a{Ob()|ocG069VnWT}dB`2?l&)oJQ_`ynkN>WPsxz98RUM^*^fQHmWtwr~FA1u@w
zhmYG~Ms$_joEsq@=nPP&-9L9nf~8wQlNLS6y*<;ktth#Tm+c#R97_hix+XX1TB7zg
z{P~E>4pC=$CYc0Bteg2qj^uwR(_fF}FiWd9`4~|+OnACOJ9Z@Wv)J+QskUboz|P!0
z6ThKF=98fGgF|qyrN0Xc&|l=}b7%ykB)J4L<uhlqL2#6JX6K;3&GpT#2!#Tk)L-j}
z9*|Nk_3dP1;~hMynun~>FNol<1jdPgzgQGWkYIPWf%cpM#xMXZT*ZG4x(?ON@_Xq{
zh?`-~{A9;{B{Q$IlNH$Ge6!#s4n+V07>~J112Jzra}#yt#p39GXKh^*9qz<5I402b
zPJfb~iBPIw6rlt_H$~g;XZRLOQ{LS<z3#YjV!<AVtyctxCCKpfurmWyKoM1diw7BA
z9wJeYdI}asmt}YfyU~9t6xT`JC0W+hucDPI0S-425y+5>IKJU00M|1$RFFa$Ubn&V
zDu(!_0WIzg#JcKmIKy{g-!+rEB0b7C^&i976kY^{lAp_~bbf|F(Dx2tXIIm-9GZv<
z1(jUSg}I#iv+l+I$SxL9JYGu?Hel|K4W3G}A^S~@WDe4uM0kJ8%c_L{7gp|i*6@Q;
zBg7bt!=ao{)Zd;@qZ~V69$t;I$!gh9hmr=|*qQ;RV<NfnS8mJ}Qc%imXMxuq566mH
zxN@k;L(cZq5LbVydT2LDIP9RsotcLW#!Ti(BpE`p^FCYmKEo)!$cC0Qu((qwXe?zq
z{D>F<fP)-d03LsQGUoh~4n~&K9J=(TDj;Z>gd8RwmzB>=ldsduRB_sf<{4TDfpQ_X
zBachR>4QZOvJ~KFvig@^TOd383|ku8$SdW<m12V8>8ZobhX<R*u89I=FhCeY4=qrO
z$w*A%Y~;JqcKUSN!C)8$9mmH5AnJWXs`M16w6~MjnR9<nyOE!=BD7<L2bt`gtD&iY
zciQAC6?<Dy<57wY>iZ-Ll!kdmI}?I+@d*7|nM?*fl1HWSCh4dY2s1rL97_i7CKy*~
z(*5VIBI__;5Hi=5&|4cE;uPPvCK;=579Yf{V$l;|8qb4+Q1a$8{t#Mu&D&-f*2FdG
z+dbl&msWq$b=N{|%m=8{!rsjh@oj_S35zH)p<C~23z0gCqp1K5N3lR=h7&XgtsGma
z(HIkHI|vBl1idIt#091^^qEUOz;5Va+P3>;Z7o?zSJ<2rSSi>w^`0Tr07p$L-d6le
zUJ${g?x$y45AHqq^s|iqXEPOGYBc2uw$nu4%Ef;nPNg7O?HvP3CQEzW=$~yo=x?N_
z{r>vq*@M%YdlmKBt~O^u6G}no>_-~R!VW6^!4eRBk(_0zl>3bfUC_m!o))}4!o;$4
zXaUfSU8u@dnd4>YC@W^=;JVF1nU`%*vL|{nZqCxBZk<s(q|Z?BQfOAS0(FC-cbkdW
zI`w~kw0E$+%~_mR0RD046D%C~i4k%9gXWvr8qA~et2l8IrYkaz+;{>*;hsdi{J08>
zZI2PqP4V?s-yV|SmcnJOcj%0DrbUOiQO8?Vo#N%puG~!{;NV6sTI9@fw)2q-3H&(f
zk#aX3?XQ!MI=;U}Z*vn}J=$vEV$lS@G|GR-DB|Zh$lV=f7BnR1_T*?QiSzL3|H4?|
zwQ|dgtsb1&1KJ<}k3nsOv0;BFnWlt{Scl}u`W?~7Py7&BH79++M@`G1TRP|lx)j{c
z?5$y0S^Bf5ijW%YmdwLi%VESa9g=`Y(m|u?8@OmnEdM6~%DF^702WmaEfNbw^$~vo
zkuU31tS(oKj=?KRea&O{36y#i734Gj%Q>J4#)9>Lrhe$OQ1<owI-%F#oOog3j8CYE
zlX~!=PvQ!Kb~8CgMoT(i=;SEq55BLw)Y?B*ahUA|y_AJOzOa|mCs&ACO51XIFMk?W
z`0HiV%xNQ%u-P|Hmtpww0$u_zNa=t1!KWSl7}=U46B{S0A$dwf+RVKvKs*pReA$?4
zwJ2j`J~G>d=@FHj&IA;6=NGWShXW1(<!)FGf3ka|P5z#gCmGqefJpoTU!XBkKUVV1
zWr>lr&<v9PBbkCRMtJ>8!QD_xV1#<GQ<jF1aeuRu@}~$BL$3qIOv$DUW|n`CGaw*}
zIWZsP(`%--<rFbGE6&9nEhe^&j^9$FKVoH_prPuTx9L-IIwd8++<|r*!DTW{!<`Pu
zRQVs)e`Ebg{%}5jPs`Mg3jEX(;>&-@<jHNOMn&_y4&ybsjg`9_D@YtpbOEut)G=|2
zFC(y(K~n6`Gy0MCUtIf|n23MSd}6a%*7t1`5b!6B=7;70>MH{j7tJR_E@N^!0N8Dx
zRR(B9^j%B(@oOWdAWr$>YhpG|bSZXKrIaz}<$M+PV1+FYMkYmMdt~QFHAfojv``F6
zNh8iV`fs2SBNF<}&q(5x9=KD8?${$Hb}$*JM|iW)C$}mMevFX{3l4ujpm}Ys%XYQl
zz(MRjLV$^a`g$NeeE-cd4PNA~&Uw00|I!>G>YnjzC7I98vfuh3c)+OC;8DtCl}0dR
zz*-bID{0+;HFZrlkNex*IrcbWhCw#tsl`GfkfEP+jpv$rC(N35;P%X!gC=PB$gCA(
zG-|ggTmf}jFm+00fWChmGKoK)Uz+*D$qqB`o6zlN$Zrg{DNu$mp6DWi-A<8!IGb`_
zhTBaA#}+D^7FPn#Wyh>m`{Ey33{9P7BU13DQg7gb)$HwLch8MT2wxH)^3ft{|0<$%
zXp5k%`uE@u8|w-93s$-Az@8Y!(pg39B<R`TM17ae^71gb^Z9>gpWefDrz0&JNvrjh
zPxM&{bA(0^9m6Y3uCAhh-oQW<HqyAZ?=tZ+4_*D|4(H}QtKgt#l=u|$2iY*3-i9o5
zzB%X-Tj%*MZ@4mi;%b=p-%zb-#AQvI6}|g3t43Tw%@zW~&=d)S?`Ou4_Lp=%^;SUE
z(*xXZGrO<}L%e@kZ3JyOoB7F<;dRr}YJA?o7p;_Ul~!6xDbEJ1F6EYxbyqBMJZzAI
za$2po1j~)8`I3_4_$r)phOuTAEO9hs6^s7V@z!?j$TA71bEQGeprt`*YQQEc^Fs}p
zZkn8!*J|VQ4l&M)j$RiX!AOo=i+9Sc20H2re^7Ru%5Z-*&5DH`6U=lObckb8pa;Tp
ze1=|d!*E=WpC_kw6K|RXQ7*su^&xU3Vw8J5ROfJyvhK}eRACPfIiXB-8n8r~d>imb
z5agQzzb|*SMjEIOL6K~@T7y}4ic#&?+9&mL3(2f-POeQ0I7c#9(=>|b4*Zj~+V=J~
zq#`ISs#1T@;DQ!XXgb#E5$AN{eJ7P(A-g(7CFqg?{Z#tp6LYxsns<-0zXpO3PILkh
zxXR?4zBoaT3(5#&G7R247d28#Zla;hq>K7-#VkY^Uo=p0hK*1~p{Lkua*fH@J(z%g
z?I<8TA;(fRC*>?ajtI`+`|oL<w(m+7S^9H5(Hei`k{VIEBCXdd+f}rI2uY<Dl{;d8
zN0*2eQSHI7qXBd9e|NUV&DQSTUAx=0`VyHSb6aSZ6tqgZ=WFZ-+R(-*%5x!z{;(Z!
z)ffJ~%S-^j;r@rb*$O9%$}-~n-sozu2gf<)0%~rpz*5|~L54exw@FW~>9b7n?Ou7=
zZE}AHe6IODVfrmpEjzbOkpx-kg3C|hp}BC<G3!6FUz}?sd)8OmI}Zsbmo+4J9S0UG
z0nW+V=T@A?JE~rCRXjn<bPUx?lC<S7C&gP9(zaS-{MkrWP1bruWcBEwX|PhmdCAdb
zPq6+J1|_tA8p9pD_@R}+!7Jebx!eS9IY@s-Vch_CUZ1VbB5wP|;zfqvVbVA30$K8j
zI9k}H$VUEt*5hy(y)q1%gQ#UxXouXe8T>3!z>Mwyw}d&;6*c&6a?Z*(*98Y??Oh^=
zF8|Lz;eUQjo2T!(NxR(+CJKj3RHVlzWC$9_ujc7^*ELbrt_=lTa}dKlr}S`TY<qu@
zcsox>V-^9S;e06~Q#d~#txy@2gl=kD10Q2rS2<Mz&VxTUEzSn^-Sf3y`O9~DDz6lK
zTkv9&?#W7YY*(6zeX%KD{K#k?aQT&?Zl{aS5I0jb79pM^0H`hfNpL0+DMdp>oU<A#
zMuZ@TRgFBnmFKe*Nq1Sq8m}%2lE;5XE7L{R4<{d9af|4nGbCyz03m0Bg{=WYtJ=w%
z>^eaF#78=mq^23WAu$xe#^c#3u|x(337pauR4lrCMyRy(EIX%XT&Z-+X=SZmlb?Z?
zCS9IhYltKZK#OjmfY#WR#6kRlf!EE+YQyu)R90}etU1fwHCR`7fVnXdBc6YjL}<~w
zmBRD$Q86*rCmq_RFWPXVfcmm~zWkIr%Y$XXO~DJ%bl${L&quJ6x>>CKR`$`m?fs5M
zAg&D_4FjKe9D0M7YpcY-`I}o-qLCgZ!3BT5+OJ}x`@#(>?>WhwD+1~sIBD5gabSW*
z4#ub|Ks&+GG#c(ypPSsE#Grp&N7||O!jFe04_cNRI*^tfYpI=7px}8Og6T%HR9tA8
zo~Ba5s%*0lO}`~AX0m$5G14s4OU35gaahLG=FiP!_vkxdWes7AXeKWoJyxFtNfkfO
zGHup~R?G$?6aK8jO**IfD4hs80Stw_W-=$8?j8r%UO2-h@fsZ#UowB%sW{m~i!@6W
zr4^}2)Hf{BSz>if86%=}%8{;+l}%xI_^1NdFdgON*?^Pp)j$DyCn0tO0j1=+Uk)Kd
zN8*JX)vwIILb@s)2%3IaQ3%tuIP4OfJRKxXb1~)|hADaLv9BPnDg`gT)hm%6;$2v(
z#L-sp3&dEvv=>MsbUuHtQpQyPaEo>zmFiS1rAw3<h8fMPCFPKDAfRiu&RpBlskTa3
zB_p+RvIF;SVx}wA;C?=tNc<o4$lGeGjgZwGvbA5{ZlgvjNo=ZC-<+LATK%J~1J#<@
zv&G>9ih8ChV(As&g`NKU*Hdw89zFWTMZnpyN(DGDSOdWU)&hS&Y*W}?Tk9sT4)-;-
zPK)Polr>gN00p+S<rlgnU#)#X6Z(p!Iv4}G?uV{{s9FX0G%%priY_*!GH4ip2+mM;
zVLZKdOu!Vuc?&R!hrD&&a9v!ur#%<=A-uuV%$PE>wWx!p-O#YimxGiPBMmy#+T2%s
zP2)^-ltr$t%=dq@(nyj!%SXSwm*KU$apwD*TTZP(z2cu*5xO|a8DB}XD)WVIv_HM~
zS$n-1V8CgKQ{oAR8913}IZ4G`lvEob9B_x13giS&Z3^RRW}S%SA8!YOt4jKdYtV#}
zzZSJ=Sx8PF=fqjPbH+$2L^K&PpTKi+e;Zin{)n^j0wsTUC0ep=t-C3v+C@|h>Q}hX
zMSI9p2$?tTcL|Mg=8B!S)pF}genrFKo5|qS5wURkFyoA86M%4#t~=CfcAlrWfZ<iC
zIs1YXpKh|2bkQdVuXP)=l|FP6%@p`bkNAFA_*L%cfJaEE7F!zn@HHget{##<{VF}Y
z^M7^m>y&?vE8oC_90Kk@g5?6LDB~JRoY@FdEGK*!vGI%hZ0%Lg4o5HQ`4ooZO8z+<
zRyb1FmAc%o>PsjKDXB34Y0EH{tadT14j63*+p+j0cN;t@=;3Y*f?~?Lo$x^e+#g(K
z?lzDRObm)`FDl8Xxkn1$@~KdKl`DmcvD8=}Lxg{DYV!xH(`c*XzL-z*lZ>m6xHW^2
zkuIq9XzMW_W6Uo2;)v61yTPsF#PpzKw5wtwE)P@J);2qus=78U^-qtm#jl>{jyi<-
zA3Eg?V-dsA`^O=y-H)ZAkpULX1?*@OHaX-Gi^?gu04eP`Pp4G<geR!$L{fw=a7M83
zKt+G57D-#IVT|1+DcqL#%kF-|Bn^U=@Lmo=Y)gVpxJk$tk=QbehG%9Og7Adn7P1;<
z!(yV902HeiUc(@giH;g_J2(mil_?Rx#{!X0NQ2x?>IdCKIinIdivv_pOtD=ZtP;@t
zkb@jj*;uo5#Y<i-a6^yrJ2{xg32eOy$MJt~n1(}{DpD7=9<EBT8o}ggD5=by_f2X_
z;uV+`mx(KMIoeL#|72|~d1fMW@QRKtJTLYudf{g~km_rnfPkiPn=g};0d_pW%fhXy
zg^Ovw@t2xC+|R%~C-fXZBaTTqd?eqjQlkYgz_Fpm`dC~3T@72<bEM$W`_EUaPxF7v
zX{ra4ih?jmf61-51dc-OlY#1>yYe&#`z)KFP)2o{(MaUMN{4MI#H)>ltLy%syYcUA
zH&lKmEr-*%IJ%QrHUF9D_a=<gY9!KVKF>Di@Pvb)0f&-SET1)M-2Toj_Wkr)!gsLo
zc&4)J3#9aDDfpQ&i8<3~Lu><AX48MO)@LgXH=vt$XU1&4&o?)aT=9&6_|4yX(k31a
zx(R;VR?yyPgz{4x|IqfBVS+Vm)pXx)5t6WSF$nEulPOmQbT?Czt6@uQTx5W1nj!4O
zS-h;4FGRT@X7bi10$2x*S=Eh=i=_Xk>}0+>u4-!}<Jx(qeM34Kx8#{`yB>cy#Ga1Z
zBrBc!9$Q{vK7V|#AAN`xzHeLU^04|srW%r5y^-OhqOQE!7de#W=8pTmGs`Q9eh>lF
zf|kbC+U+GK+<8J{qgT`nhdfBvI?EZeV0z&*yEGk3z11s+=~bXfanCC@0Q{zuu`f|0
zJcdbn)zRqPcqG;K7!1dNi{O7#4S}GMIN;IP-FU}^owtJT8=7L7Pi=q?rN=$(QOBni
zX=f3);Z<6%aE%)VdzFl&i#TLV3;dj5zbhcPw7Zku1!;CYM5oG*I)j)UBF@^GX5-S7
ziQD1nM&@W&t`)83NB}|83?~$kLiEf^V`+EE#?lTu8#i>BY~0l8=JJ0|H*e~6Q?fbl
zc$BXXwQE*zXMc~1$DVxC@f?5pd+2ifCa=sbc-P14YF^e`D7vjYC7s<zp8mtiUzo{8
zt@LKfa<-kAxde-es}USTB%v?7p!ikolTc;~mU1<AoivlGAg2cMxY?ZG`rpcAKKjbC
zF2UEgF$=w~;#XBf!SH_}mAfiScv`QlVO?**8x~RIM2;yiG3}5gspV2*MDaJTB6qTI
z9Zf*vICU`ETMKEC+s+lgLgX5(j2Es7oH6rJKUw7JXmUv8$y3vQee1x2v3xXh(%Mng
zf(<v-d@@JsxR+%n!AHgMiCl=<ekHk4QtYqA+hV5Kz-C$|b!UGzHzRr7yW!1Qk-Id&
z#UZy65SgBGFo8zi)-_YG7nPBiGtyJDbFLge)k+fToy9`|P^z#(SYYWDfF$s7#rU)+
zte9K9K1vSuAMMsbp85>(Iatxy=Tw*Jb={}FmmCy=Frm@41JL#bSovP(c-T~wB+I72
zcRUTQg_8zWDUN^EVJT7hxusFMM0eRDv5C&PFeF=HWE&PjL%>GMF{`UA+o@Sql^xgv
zwGV1w`?&BO{*LfWl@98!a0(<V5)QX^0j|)VzMZZ#?K%3<^0qcsl6QZR<M>qbRTzEK
zC!TUeQofT(u#?N#;*PN@t#YeXOe%S6ExDYjovfMGNMe75jK#yW{}FvuM1raSz$?7W
zl~i{Vu5VZGBBaeNHHGM6vbnEUUM^k4z)Zq13=3=|ra#mBTx&Bo;F;jsx$Rs3;sbkw
z`sHC-B(IA42RQBmrdelWuhsUBpJ`-cT0&=MZ|zY0x1n#?JARk-PGro<G{S?@Q}_YI
zOv;B;Vz+<TrpjS|rq3*oAlkN`eP+^?BsMuSrCc4OR3P!h<m|1|bUZweWs;u4Q0kfK
z$)ji~1k>eHsbR6m31MXhmE}KDV3>d>YgppQ!n%+=Yeianvk7e93Rl*2xH3Uro|W&?
zs8Z;6K7$|Ko&^0mQIh^%`>Z3sbnr<vR3D^8{bGOViOkM<Q`>OcF`6s$JbBcG;pQCW
z;_Tnhg7WiGI8GsjFm}&M1t52T-pDXpUdY}yX&D_kp{7CHO-%E^nOe}I<R%sk3Ct;x
zrK9d3i4^bY(6^~}so}jrl)-`kgEEK+3z8Rn3*+>`t<yyi1id=zcRe0Zl;nV4B{`Bs
zfgykAcQDw85YvKPLD&ZOStS}5<YKX>C;LMVN(e~g9%!QzmCx$<3Q}mU30fzImAIB$
z^}uE=Eo$NvrLZdu4Jj^p|D!quxD!3z$@|*<c+6g<Vk9syf+VE5)z$pnSL~a<IaQ(Q
z>*-b$&84Z<oWXm+kI)8lgo$PABkwvjcb9*r$6Nn%N+5}t_FJ$ep6_rry?I#!=F5;o
zS_;xDoXe74Z%W4(!OeVBbSWvgk|1vW-bC^x`%=m5U2|(Nms;+ci3Q>o{jFF5WYu?q
z<Ve3#Zo{KwvD@#=4O#ol65?8Q#n`WDHN9?;5X@--CIz>X$5zYJC3Q)Gq##*|(S(0o
zE}bbHQsl)_3{u6RQ!~|?jN;5?Bdk3sc<-|0&*~Bca;_~*3~yloXo%xOHywV^tVFl$
zTJ1)NyaiA@*Gjkle&b8TeF)LpfB$~~dJlo$lkj5_|Mt88<F}~+)25^L3;FOu<@^{&
zp#3}Mb|{6m7QSu&EC@<#x&UwZB9MRK8zTWQ-Ta9tv2(chWdGm=2KC7&pV)hLd<^~m
zqd)X@JG;AkM@OA+_I~J~p!c}o2;;1`30B2PJ{XCO<H!Z?|Dl68+S@(cJH{a1JAyqc
zlC<#s2Z%qCa&depMzlFN-blL<&O6Z<=)+CC<#|5ZFQWbhxRHw-+8Y#1$qs*r!Yt=!
zDx)!2jYK{P0D91$oI1~i=1$+g^7;GMIDtD_cYGxCtnAQnU^n4&D2rpc&RVpb6V+#<
z{O1`oj+`wKXStNAUGj*js`8^og}P#b)w<h!cLew$E*}~**cBO)I69B?h8eKMz;GH*
z(NWJmtK;Djm(}S#jM|EXX$616i^+L9Ldq*TL{MB#Qg%9#oLljK7OZ<uX5w3^vWR5y
zvKu^ss7k8A2iZ9ejIBCYzU0wjSrzj@vI!!1mM!mbHiCV~7+Gbct8#~@g9Z;;h`^J;
zBw2m(YX4EgS5%eP>@Z?GolaYx)twz`HRX4;iBVfsNjtVn9^>RMKR17dg=3nKaM(X;
z&?H(9w0~E4T%q)3T#puwS*z`_Q@)pv(?MmZoPgsyct5|ajN6g2D@BI^&+lXCr)Pp-
zMc5^$874Gw-&XK&g#+UkO$L>C;%tZ*xnfd^Ahz(e8U$H!D1-i>)Xz$>cgPLUb_{rt
z=m%E(80B=Am8@A%vqpb~iv?V4A#j5_bLHZcoipb64V@<G#`e_Mn4QG;c1yG(xfv35
zuhn>-vCs!4kV`aqMS|mqvE4(4#~~%do%2yY)U5(Ih5@Ioz_1JZKJ=7GH&M<&v^*&w
zH4jPeM(<)f0#dVttUzJ5ayK0OY`=2s3c`SCAawRl**zloEn|Ohko)WF>!{}ls?yXt
zo)u7l08%J+A4aHTg3I30d1st6*kSNGP77+@8ahU7Ij2NeX9guvX6cZV6lKZa{89jf
zqb*$k3BcqQB`Qsvr;|QE0_<VQB$^0Y%_7s83oHcG4;`Ta_Y6RppkP~Dm8<~q(!~>E
zJz~vK7lL;p9r%Bh&WEIuPMc=MaKJlmG=WAv5FZ9R-*t(-D&eSRRTWc2XNYbqdWYtn
zIek@qvoU<_NiRhEayla4a6;aHl$xkp6ksN*slXK67Hj_ER=Hp}SKf|6Iu26Jm#F&&
z)4R;75tkcsO7W}xrdC9?>NC8u1q^^(l9RzBSG!h82ETuHV6)lkHq2DXH|*WJ#fTn2
z!5k}d;V6BWBS5}%{DohENh)ukb2S^i@z7>|oXTJ1ypPUXbYO-Nv!Ej}>0NlY5TZzk
zia^m;gaj5~38EP@JQ`l}Cd<ZdrquAw+M|aoH=BPi0`fV%)+(hEL!>b?)<!Tzhy~ug
zyI-|1(29RZt}2HD0}_8>ztl`}1f`NYwS#Aq8_`dzG<#s+pV2|QxO=x@6>7Dl(^$wx
z(T*gkKBi?|MWdm7qL^aB5K1v6^0{KC(xilxQWR6|Se>O1Wqm0T$^YoCPKv@ZGrK-B
zAjRn>evNE$!F=EXW-1Cx4+=-q)#$n|o0XlpO%s184CD(YRgo*CGSSw0$<<K`HPpg3
zmY%sv>k@*k<)|Fg7l<>Tihh)hW<$QROEax<lB+9QHk?gGoODU=po`~%N6s`0MQk>%
z)gER8P0*HIWqN3G!7!+5bbSy}vhW0g!=aL*9;HvN(7w=sB%Tp&zk%XV8@j+m7*~@C
zHlu%wug_NZM+)6$uef_RIAruLPElR;_40yhOPGX%UBMZUg~Z8c3?~L^7INC8%dfrg
zZF++3O+F}x=fy||f)M~C`O!D~FOz2nyWi|R>e3MzqR?)y3}GLEM}Sl*;Wk?N+XkY}
zB15ZNm5X@;7qeN%aT|AKl<HLIvf@RA-B5oph5r!`yoG$3^{Iz~OCo3HjkMmC{N!vS
z10O^;z;zx1a&g{#YkYxgjYTHf)n=u<Phh*3zWYr{7%F{M?*Jvy88Mtlnhx!7+(xN0
zzE~OgoilV)RdV&jhgn%MW8?<8<ic~c<_<@dIx>^ueKwJ{m@1GLWDPj+259k9D}sNu
zn%diSIn^~%Cf$3q{+1Y}2=QHbs`ac`p9&{oyQf~=rX(lRz`M^6UhE$q9Cn@^JUQwd
zyyzS}{CaQqxN}6`?Qv43B5Yu+XJ?$tbRFV&Ocf$<kmf^@<Y`ynI<d7^Yv@?h{$gXT
zp6+Fa=1_+4l7&bU&E#-~V&PAUT1|gzwk$E9-cZFwI%V!!mg3rEi*-LJsWK;pJm^Tw
zQPdM3b+#MFF!MvC#n8-@kQ~OjN98MeZ`j?gsEbbjvVP9YAnmRG4MEn^OkhEd9M8Cn
z`$)4drKtP#3LME`#=#lXDxEwPP#F*Q$gD8|M(`A0ySJ7>svmT=L4JYqjxK+*vqYga
zPC%Bfoe4qEXPAgNl_o`osBuJH`3oW*rUc|JNE1-78{D-P9bhC9x*hT!gPH(R5TQKq
zFSbOzCvlP$B=f2Gf`Fu&L;%uSGAiYY3&VobE&Ogvbs8RBpYxCSuII9DSpZ&emC2Y$
ze(FzvIza1TMN(zCVUvN_9HxIuUS*1O$ORyHr=h>o#Wx-@QIs<$i;uFYVU4qDOD#zH
zd?O(?mOnmCCt=3+s9;~+Ok%xA6N1td?6n3-E=Bh4Xv$#c=NXAZ{Po&qM<XVK@4U#Z
z?x%*x9s=iJnZbp^U^1l01!KcFGAyt1v*}2^_&t)v6#rbqZ(v|9)0uxjmZXd@1dhfu
z!$=IQP?GXB4~PB%sA(p^IF=OEq5J!}tyG~pc{uy9t=Q;H9j?{Q+hNR+ox@Lx4|>a1
z=e&4d?<_V*0N?416B5}4$cM&+8Xr;-P#_&S$LtSoP?VaAfF-?`zWmXtQ=*lt1xich
z_E=>T6A4vKH9JW_!2ExuqIr_3VojrTl^KnM@Kk@TxLq?5RRTVjhE3RO9P>t=f9~QD
zb-`HKM>@Pk4&wB%dKE+4;bAFMX;(xS_NOnu)SIH~Pzp#w-C$5J_pYX03YvNDM#<zp
zz8>c)^Yx*Am!ovdIIE0@VwZ`3stLx!@rW=R&B_ZE0!ZXqMLmBOc@H1m`k3e|oz#iw
zH~o;Bf>v?Ox0YZmX*&rm63(SDM4Y@I429!JZP*59I|Lm2Sz1mlcYRS~qMlwV#a_~>
zf|u}vba#}Zpt`cgq9-5;9uIQFs(aW2PU~AlLqZmV;!X8Qs%v^s4lI|ORK(^bRa8(%
zJ^L2m5TQ<bmS}%)pumvo7wD@JE>Q{04V6fh7+6e;F19qd*CfJ*@wzzeq?q)BV#<!b
z;x5_D>*8<&i-L>)IC)lR!oHqSR%)30Y(40xg2bkbP;|=A1P$sI_7hcfwP2MCq+m0a
zGhBsciYNz{HSLKS%B1+2)PF>^B;HhS>wuC*O9Z>RM1X&Y%m+sTd-Q|(FPvZaK|S@s
zBU+M6T#|3EYc*%G@d?Z$Z-HlWMKTyfs5vl@l1=`qq*+C0)jck9m#yr<(L92^TD;Vh
zxCjspL7b4JNRav!R>aP1GI&QaRlat$_NyDpe*Yb!6L>P+T1}4RVg$u1pd(ZfK#W#Y
z3Y<ffFtLB2FWmO(fSHRc4Th0?X}R3(Y;<|D^7?t_^}*pcM=y7F_f~!kLPt@M`z2j(
z<$@=U55C!ZvGQZP91rs8>Pma1Az2b%zdlYbIBZ{0jILST;~w)VOI;o`QT+7wKKb&S
z?3#zz{nM|004M7|zH3KcZ2b7H>)+@D*c2bfqvwBF@AA!#y@TEm^tQ><p3+tQYwZ(z
zU`u^j5<PpQA6L=hlL-ejY$q$TvXwzW-dJg(2GGvvI+5Sd%7}9tv#C<XpO%nD6Hf;8
zx1IbNE=_Z8ChzD03HjBL6L%E30RZLL1)0Ii%GWZJhZ^3x(ospIBQx<?1oNQg;?kKU
z?h$`<L_?uoIKsO{j|}<}=gsdZ`uI(9Lio3TkRLRi8S+2<j=1ABy2<j<il35%LfdAv
z0dTfjogiq>qLme1q&g02@s7?8@I6=A!m*75(+KvPzkObw(`xab?LVQyHT{(RQ~Q)A
zko?m>=?_DIn4M?AOMkTzo!h8j251?5hwFdz9R?60O7UjnB$qMND#)2BbCHX+wtp5o
z%5%X{L}Ub*1Pc_>vkDJHN9?mzP&l=Z0HoWQw5O99vqhuUc5Rtk(KI?(o6aw$R~e(6
zu^~;bcP(TCUd;7vz&scklHcoI8GAd08H2$&<<DnN!eDf*)ucFqge~CaUJ{4P(YJrk
z7;olU<2x-Ddo@sPRQ+k7deV?9?uwsf!cV)f{lUQEYNtgZf{(!IvJ4`XD`YJ<))QFw
z*t94w=i&ht&*0G}V=zk>GRMgunjoY&!e@i@Tv9z5mV-wZ&dbAzhlQf@e(xhoLh+N-
z14%&pj}ogavx*=;TBlcK76w-1Tjzh9o(pXVl2Ul}#nRwi*$iRHO7G6gedrF{on&~N
z?Cm-26!z~Bv^%)=7Y;M1a5f3w9}Nz{BJSPEs+A?$d41GOp6tG~s+1EpHc^|#f-*NO
ztpQ)L%n=IF6gg<X@mf)(r5~cgJY|q1?@Hs5-Y}W!vos?<?gp#M(6ni3;Uj+#ZGp>6
zqgohFQpXYlI#r5XYA#Yc=vJd=h(me!K(RxH^}d}vYx1p{V>qF<m^kIkp~9RoD$6Kq
zoljD(>8N+Qfsza4muv3&5BEr(K;W5rK^kqbRj_54C{}BaYbu>vKexI%MKhQ=zDbi3
zPVqz@!3aPuYmU2?N`ck`t$KeDC&3lhMO}qWn<eLBY-JW)HA3cd{xO&`N&41hmtbH2
zD+_7Cc{+OZO&OtWAMPC;^FAAPgVK`BY6x4_X%;$3T&(}BFJ;6OQ^$vaSzR(tLZ?pi
zF-tTWk;NSgB%$j<?hhQ=zJwh>dy--yER>%61r55`SE%fumwcp^C7XX{f`C(CVl4J2
ztEQnntUi_qW4*(|p6K3ar^ED@Vw7H$ZMqi3Xc!*Yay}6*To*g=I6ZAV#~4tfYwoO}
zm#W5=i2)?Y%68UtUz0AB!=uX^08K!$zc7&@p$c`$c!dK=P$hO6;bo9gq&s2>fX}xc
zxdq9IjusS;uSWu8(kheI_sPqD18UNGn$&k_R>dU$g%9#}@-Rz*i0~&9((6h6PY-vF
z_B#77j`t2<>^$qdI(%j_Xej&heXzzuUVHvSXXn+U{k<2vdv!0fSo#mU*sj%XT_*QF
zqZ2wqJkk%<O;EV@_=%CaYs%#$6=u+jL$B=QqpseDjwai2-EXb-yKtO;W^$kF9&A8X
zs<Zd~%l*S25N3PSC2{C7pA;ibE->hI)$E_R{k0AeHMIEH2fSnv2hd=8!&DE6hkEiX
zN)NlE=<1nZep=#);W@BWV#1lKfzBf8bh}=p8SL<bhx7nSWW3H!EvGfq6!7!T1UgSj
z|4Xmk&eP%c_ImK&Hr@$;cuo4XgTGnI5BlRp+LjqLwa+6dw~TP#Z9&<TFGvRn6B&Dv
zGIo4q+E}tc72^!Z1qe#LK!?y3sGwQ>=Stmjr4}I$=!a7h=(l2QDZvzALjwQWmi|}k
z^j%$Y^M%SSv!6tsPTueEm)t6*_PW9jgl3vA<xubj@sf6MWI9)W84|T*QCA&YlWx(M
z_1o`Iz3HB=?$ejLO=0iBW_?-rd!@bT_ysj8m_@^t#^H{g{lwKyjKvnuW&(7lIa!_M
z7fIIRNJv@|>tK}xBB?2#IgwH72_QR|yA@V>c(i%{ff!V!C-sT?(q=T5ORz1*Vm{^~
z<jc6P)UW3+-QB@|7mWUFQAx0N_EG1I<yA@L>=F;`Zj(}_QjKGY(JL&RjRRNpbsDY0
z1uOXCIm@)n{4|`snnXGM5wQnaaO4+7ho=q^ZPLxlvb)Xmq`zhoPT^j!nx&b1`1Se7
z6}!w&ey`gMJ-4W5WTJLSve%)QjIZ*2nJ{{<5r`Dpj1;qfcJx?Ys_;A&>96~1Mkjdi
zZhQMz^{4?O03R8I$38d%(Yvl(XU<NoF@sZihaXnmTGZu%qi>IV<WXE<Si-zwgZH8y
zyI=SkYI*;wZk>0DXi%4isZn$trpQPJ<_%4!+LV9y)CzoM-ecMLba1Zi=r5AHrWZpO
z?a$fCakp=O^1e3LtfXaag9E_Aj5`G?LdhBM(s^*=p>!~a2*(t_U1aF>`cRaVyNpjX
zT^C(>tm7VoG$gf;NSx_@VRZc!i;*lgwy#K(ZM_+hK)!}TWqH39MX_|lsvDeGZZ)(6
zBY~C8k>4-`#$fGAvMnv+*POJAuRwe9#Y!otWUGOHV#Z%cNR=;flqMw5O%e7J{tSPV
zm4=eKvV5i-frHnaNw#oVY1nkSwJTL+NUHQJdXZ=v>H=TNhtLiO;4;@K+FM~BeZoFg
zp5f3Kc`49Bf*OuY@;I{E0sn1-avh+RdxTns2gjBF<8s(pZzk9ayd>0&mIPr=o#=6^
zp`ulP19@<1Sb`f*&cjWu`(8R|5!dF7AYw2uorMe_E^f=X_ERNi(=>hg>F)#}p0g-8
z^$dg@EA-V~g-!*}e>~<8QKm{nB=J~<aXR(`B=M<FrfZ!s_=NSQ(R4oLS(uvL!OP02
zHzU5-Fw>|q2DXM`zejyknV)o)Zal20{??0sb_xNg*+n`y6RP%rGu&QmIPjct?!qN}
zgluhtI?F+?VD>}6EEFR?<_-1t7iRY{^cK%bjSTxfZrt7B-8o6G>+K_Yl2Hu~p}TA8
z@D$N1vr;28TwwyD)Z#Rqbp3({#U8TjuP;uY^zwuJ>!Vk{>~Flt_sjj^bo|%d{RjJh
zqyG4GcsNa8zb*Gi>uqW~?rl9s+oJ#U@T&Jqarta><NgnupHF*F9?!C)`#+s-uIJBo
zzrN_d{x&}tlzDIK@Rw)9$I~CaA77s4^85EkSNUJRzqs1}sd)S1mz|9lKmBlZaQte6
zo*V!0Jw5l+-q!O+uhtJ9oxgo?{EFUx{bJ*XoW?VJ{O0uaVD{}(KdxuP!$JS2;z9rD
z^NYVe*%+VZpI@B5{(9VhGPvx2|KhB-`QkeL{^9z;PvhC?#^=M+C!cT8-^0_*&+{L?
z-^W-7r>`H6Pj_$VpV#EO=?||5<@Z~E9rT8SVfy;JH~T-0*L$Py2GqyTr<-4YpQV^{
zzJK-n_~Om;<KESa-Sw;IPoBShcD%Fk!*GB4;?dr{=hqv97sr3SIC%2io4>x^zxVv7
z=NQA)58odav>y5U=CPmC+6~`c_BTG)XU4NW#<~0Ts5kt4qxbYVulo<!v%xy8-FLtI
z_4}`9KfK-;p#L9UV_x@eKkre0|FSon{zCiv(_fF!_OF*T*Na~M_2=!!&klB;m&c!8
z9nW^3KmYWi|JR34UfrKPAEjHDt*yu3eSccazP-Qu{nrmRz8inKclFuk)#u-A?mzCI
z-k<EX-nM>tG)Y^}`^TR>-n!h_ebKvoxN-UIy`PTC^Ow&a4?Aa%X6xyH&gR*E=i!6T
zzZn&q-#i@m@26+qe|Pcx)z#7Cd%s*C=9Af9`};>57tcO>`BV0ye15QhcHQcA9*-V(
z9`-JX?!Pau#>IoqtDk-<zdql(zctw0y?=G^^XU4sgX4Q=FP@C<U0+`wKfnL-(aSV1
z-yTdJ&W^r)^v(K{i`m0}jbD!bdhcN8$?nCdf4}w3RWbf~@WXJp{$lVVfA#A4hxGpR
z;Bfll?DX={<L9l5$+sI%4!+s_X0-9yXn6G9{cped>6g)GJG0LQFF*VF#jyD6%kTT&
zU%Z{%yMFohv*Fv<PtUVYdvA6g{`KtP*4roJ+1ZnOTMy1_wO>hp8>*9xg&Hj8!5Cf#
zRyr?eumV*ljzMitSczJo9@6(eayydxsNKe=>-Qf#SpWR~eg2XpJ^k|DXP<58mn2Q%
z?aW&KIrN-tZ!cpwsIJCvl-t|Fab#@Fdl&Z=H0WGr6BubR4|w4C7ZG&u?E1!MeH!7t
z*7|yHqqTnj^t5$<Z{xGAR(AhE`WdN<r=M+ZNpFxl@WirFN-HPNP}31fi2S8UBz__3
zhVx5j!iSrQbmYsm(f2y-prY%MK|b_zx?vH}>peIoa5`8BPTO#?h*qk~-5sur<kjIb
zHGqDM>?wo$`sz*fjSeI^o!-#>PxPRhADm)53CWCpeH0^qjgFiP#;f1fl7$02%aLbC
z61`?xYu5}4sIw{JaF?<0au>n}6O9GE(Np_7&pBQUczE`%+Lo(S9ec}a_u8)G<ke)b
zy;zDzsZ+g+w-;T;6<Af6MI?-F=XuilitQdH{?Hcqj3K_xP901hhWHYRL~eatt?$zU
zezltia8I9qW}(f6;3%R1OKH<7Lb9zMHiqc!(uU`%(0r3ZL3R}i0a_O@d{48|iXxid
zs$IL^76@d#`FJ9gsqj*z9A;tPNfa24#^(CQW@}@;wehK(n<J#`z?kfgTax@*^AH5}
zJrcco__fa13W2$ae%#?a75qqRvc1#_89(&W(x2&nx$sr|<71jJn~wN=hgPu9KYg(N
z>F4+E(|_yRAd8l5)!HJOsRup3i{4MPC-KCK-hagT)q6jaK2|RHo!cyW-L|m)1x&wr
z>n<FJR_XMg_1~r4wA<~<x9@86f8*aDjTd@t_XKBOs`H6{%T7{RnbKvN!K~F3TaIW8
zs>rE-BJ5-J;mB`e&N6$x9qIh7p+rzQT_XlHc`~EjT5~qTjwwAI+TWIYcMF9n+ZWT}
z;7<Hq>ncBM_(KDqR9Cj^S^g&Lx*=n%sseG=AEF-wS*xk~u{w?e8N62aJ?XYD-Xpz_
z?{05<!_HT7l-}1quvLAvy-nZTz14Gg)LoN*c+lNz^ENF9hQti~WJzG=ABW-eUJKgE
z%@(u8SwCB!&Es2jOkN4bwG^vMC>2^N7SpM!^P~OqVEUI(oB#9q^e=ViO`Gy^24?X8
zbjJLr+v-2vR{!DLR(4~MBre6oVSE~2WJ50M>VtlpL40mgqx40N(+D1zd~z2Z=fazR
z!6kNH?zc4-B3i}Z(@A~Tf2jXht6?qV?Hzg}t?QRj>m46mORdpZh8H{&KX4RB;JSx+
z4zl~z2lyvmb!xp>nRuF(7dbKLu^236l9z0|MBs{*+4$*-e!2`yn)s2Fl<Ar%J;~o_
zk4}-Q+!4>zmkTexI=9209j9lZ$&%K8OJ1qeMgk(=3qf9c>;KQ*zb&_sWm%%=bKxtz
zsjMczgoC<d<b}FqQ4%A9mAaKkMN~FR1~>pG=_wG7fCFMMLt$1={Q<qV*|uYLp8FTh
z`#EO&L+VS;8e`76)^Z0xQV~(ry~{Fp?G6!eEMM2T=5>rmj}BgcDQYpdHG~v@Zd&&<
zxsIiertZ@W-HP*0-bYV~5(I_edi(lEZ@S7)s42P|UMyu*gZQR(oz_<_7Ht0B-3w>{
z7)2|Q(W{vuldyi+iHut)bp>7^vQtVVD0BDh61+Y9a(8E&A%s?ofrPD1Pi;|W8f7zq
z^el)Med6ZWy>5%@CtmMyn2%w9$`o$L2)un}C(r4nQLE057xm07{kg96hmS}kPtpt2
zjz89))qmrZpYkztti6C`1Io$s&HlR=$Nl~1&)+`Y*7}Hh_kY*B>;Aucd%wSb_wIJ9
z{^&n`d;IuU?f(@yPMvy3*r@ADyysKKejjUu&JF-j5vDXGAFtgH?wQAbzw)E&w8G><
zKwdYwx4E;<KW3vfSJrixQhn5N9ofx`=6ZVX>UWj{4+$%mE0gHlu<-x)Is9-xaURwm
zt#Hj?N}`)5X879Hk_#DtBx2{|z2xt!?d0!$Urx5shwb+#+tMW&+V=anC9er!W~<(Z
zkL2Sr!LHR>guH*eU7z=VZR6}(uUN$Z?MxtOuix9dAMfqfcgc2_)dm;2TTVBoZESAp
zPeYbRAT^^WsAI+HmD79N54)1Z1+8gyN}&ab3KbXZxX!6E<a*je$fMoq$fCuw74$A7
z8@n?+zV)a!NG433j8N)-Sh%wN&nYjnlvm%jYKACT5!Fv~?X3@g+F!4+S&sV~tXD<u
z4_`?4Q!?IXzMZ~rXI<;bfAx@1&K6noJ#A}AVs?6oEGc2E-1l@{qGmve&~Y>gmYiw!
zb%d$Tdim^hAtW+a?j^LBX5}Su?uaD;sxsCh)1C(3@?36Aq*u<Jymk7}q4yFJ@Za?$
zu!{&*A*&~y)Z9ydc6OwYPgqm)k>b@$f;-8eiCpF($O12GJ%0e`KL^Jzy7G`4wd*HD
zo}e7&S~2E6*C#Ft1B<4{2fjA9(|Vock0hceZ_4qD=WpFz6|rY&{?X2kOes_#;?!71
z{ydk`6Gib7b<#b(9DSHz%<;1q84)ZzWPh)<KUu)bEmIJG5_@Z~TgWl?0AU174&{?r
z15Z3AMUH(BN!E8=k#h7pNsFYo3p2gXa%U)CfLxR)4n9UWC8Z{^GHp0R;Q`2SL;45j
zkC9ibAj=d!Qsw?oOa*sgwz`F*8WpL977hZL;rH!37;-9q2|P`?T%_e`>b6BXEWd9~
ze1!FNA8pxx{G%oPcPEfO;Lr0C!wElo;C^;=VSKh=v4_jFN&|sgTAjPmjZ+Wq+40;p
zp5YnbK>6YlRplbN$&RME47T|+OV?(Fh4O*1Vu7Mc*P-9I4mAq!eTl5~QE=rrSJi`b
zem@1IT$vJsIt4IkdPZ!*l({Ye<lJ%-h|lnad(qQ>;w(Uwj#-rCr@=l=tM4ZAu31?v
z0LYS7%NaLjI?ZwRN9SQmMqpM3MxK>y`<*2967rP6?S0RKFd^6u;uz?_^Jv#|bA0Qj
zpUdVt{ae@RS0x@J!kuknJ1MT?(-Qqn?W@#_RHyb#&&u%--p2G}Hd*GJ7;H3~mzQ|r
z`BS!k?My6pi@2wxvq%d1oqPE=<peN8?nNKvU$VcVtxn7se^wb7(A+D_<cAbeG}-z>
z+a5xegp`s*rz2RpPKqpNNhF#=OsP=^c8$ccVk1N$wA#o75K-e~W&F%SYPrAig)@UH
z30<LkddONW`&U#NwJHKLYMzu0D!%JXqJpx2rxnu7x>xomK`ceFmg^Er=dRq%_I)qZ
zX(>kmF(2HvcQ5pvt5F8{J~il`nLX5y5^+rr=H4)!SdO?NrCYwF<J!k+xpY~SBp3BE
z+zHA_V=E)>iAV(d(o7FNtMM&@Qc6E8f9wPgnxK!~=JP<~&vx(j<3E9L==B`Ql_Ji6
zO*S4&2kNk)_1kIH1$^^$b=|-ulTQX`oov=RMc1kY4o~3Y^Tqaf=TGWgpn$T+QanKr
zLMTl`H^t|s7)^ySN8ptdj0`oH-Q<MVisl%dJADnCA0z&HIkbK`1Aer7ug@p30_V%2
z??<O&WvRHYx&f2asgZJH1vu)co>9_&`1Ej#3du`e1(+NGlSBUg;*kYP=$`90Uw9j}
zL+?_hLh+B@N@IztA9*{o-j`+?OcpnNnxM*i_A|O9KTGkm)VhaPaWOb}1)UKE7VM`{
z>ZR5EH7A%e2$>^d%<BUDy+XjPL;EuR9YTPhba~1l;zp5SBT(;0u6g+ttCo#_D=B7t
z<=K<;{7E`n&Vfr2t|mljP$|8q^JTDkx^2)PfJ)=n%Uo|9HPSV`r<H}HLO+z$wI2x<
z3CKrcz@<`%DtD2>kgmITR(Vfl+rRMQdyhrvZ|`?W81VXLUXfPoHHezBkHG%sk{cx6
ze@)!Q8`Pm#!*n}tpI&w1rg#W{vwB3dda&C`+D8H{W5}ioFQTAUAS?>%f0dlDYo`;;
z{@eSZWf+zt{}o#wBg9q`U(wy=xSV$9_jmPlaqQveP9f|S<u0kik*I?Io~%~aM<e+w
ziGT}i{_=Fe7v|G+S(&w6?dnYI68XMk5LT=68ye*RdZLTU1bMohIUrDf&dy;18axa&
zItBY`C`Q2?ITs%y(d@}7mP7PSSSTkub>y_v)Z3UfB|39=g!`R4P-Hby6$%o9zr>x7
zdig3Y0C(NaD=R!Xk!4$DfNS#Ept<#P)7#}i5SBHH3%yS-vJYAoa<M|?ylM&9mSt(@
zTJlc9;cNm&P7dqTL)C+Sm}N+Tac=Wt0OqXI43Ac=ioN8G8W8S`s0GnYUO5w@M;k&y
z-u@Y{xF>C<#!xD)Kb$dcQs%CHaW$9%FwRjjZnvyFD#~zmUd)2DW{|3I7XmRSn!W(*
zF$9wDb8r3N)ktWyg1G=n_22c?W{B@O+svCR2!XW_({YV8!9;0)lufyTx$8iN<peHw
z1boPgd@7<@-i;F`)yA5REvCCzBtY<6W0vSWQA2l|!sFw9-jxUutL<^CoGvE;pj>vR
zqSLt@?z%Y%0u=}H4CB4XFWhY+a$StO|C&5+ns#m*yc7ej8`)+@V!^dqe=?&^%{587
zOJ?PaER3V`ve0sWEjpSAKVMGM#)hf`(w$E7?+cSm0mVvzEZG=pbOD~aQIaIrImzOZ
zZnHi27tVNb_nEWGG=u-$%*||d9yB6#m#KSf-8f<&+qyk!F3y^H`OEk=>7wmhn~hfl
zoQ0^aMbv!JlK~BRy=PR2(){re^Z`Z^tK^q)G4_&Y=Q*=~{czWq*d>&iQJ9s}ru)g?
z7dtx~@v->~C%Hgqg>D$QO5KyiYh-6<nrHL$ulc+bE8jIB;wKyf8AX$?sa}``1X|De
zqF8rb;(>Rgf)K4nxy-1)8lME^bup#0&x7vCaW<a;5zo-87=t8U=^88~YtI;6KS7yT
zD$*)q@WiKoeSF$iM#N|f#cK^wht3gb6f(&v*77<`YrqHf9;Bnia$J<Rr(3j1c6%8=
zTtl?TtuO@qj^V%N$YC?*`^Q2^PTYowX9Kc`t1fzuAm2k;jNSU`y~OUvn6!%jfOjZR
zn}kwSD(IEKz7Rp%^+OQ^IpKVZzf3hrDpBLtFC+keiv4P``U@!bf_)U3ugXg!&S0W&
zngsbu<}T4_L96vuiN^-3MB4-8=nkU8F;I0)F$7(A!<We(w3q1bsAiSR#F_1rwzG;p
zu*drMM1@(?0yLH*kHuek0qnH9XJS+O#Jb>CTqpa)lnl9b_Oz(Rh_vdY7~zf_>7Hg`
z&=N6!ygW#W>br>#pZXEC8L`^km4Y)}2O99R($FpG3p2ofK5XU0Fdbnih<mAwkyVIQ
z$xSJ5KSg{e#N%9N21f@k4xSw+JIR-CU%#{mzWw^(?LkuD$zT1zoQGok<Dkd*-Rmj)
ziyoj!cM`tjkE&X;hp&zf-X151uZ~|^qu=a*zj$|Wl(e`1u{=k}^8US!Hrb9NcJlO1
zsZ}8~t=)scJMZi<P<tmC57*4{Hc7Jk{)24^>#luPgVcAz=`vjm+X!b#<+@YU1xtv}
z`w1Qodz|<7_Kgz^fIl5XN9LnnVve-~Zi4%#eul4ace`T~YBBa`O8tDg^>If#`IWwZ
z)T!Qu)0Gw-9Qb7a_;~->*Fwt8sc=d{bKa8uqh!2z*jjnkfAj9>fd6gXIC|}bva{FX
zb5K%|<w74Tfck0Oo#vM{w>ZcTyddft<~0LA6uMQ7(arlYdrjFR58otu<f&D;BcDU;
zm;>J@N&9|yh6`VwIFPS;Y<!@Hyes^FaCN{Lt<GQukNzC8K%_!juaRBeEk-2okviAQ
zobA1fD|!8P=OJ(z-CLU{Bs|hul@%9P(rx}Ygstr-J^emp4E+;zBK1eMS_dq^84M^d
zdcEGj{Tq4e-%WIjyU#iUbZg*uy?jK7V`E~-#3rE~p*9UC=oBj*f^+&>L3+@CLoy&Y
z3LAsw<CO~#Q$(${brCxLr<8#M@NY-wRaz53>N&8@rU?9^`zVXz)34lv1GtDu&lxv&
z1j}RIY_wnbk3-ud*mzT45N_`iPy*If+w<hsI9IhKX7*MPd@;ra$Uh7hPb2vYyO6J!
zTr&kg?1~RGGvGkin~5qAF#V{17qI^WzyHFmfK^rr^@BF>%>N$g!A{osj#Pd8iItJ8
z+{SefB%y273qIx14!wH3u~ALN+4n_T=zq1B46yv+7ybu>uo1c|4{;gr*r2<y0bR|(
zHNTD?+0gAZU)A2d;b)s0UU@eh)&ZnU;IFK_Bs!h$UtN^1P}!(Dq>!h7LEs&qES1Wf
zN;*zKF-JSrMBGIdA*87I+JAGnx@UgIHL9A5mp?}$hwEy)Awxv>{OYZt&r-c2Taml?
zS>niILygCJ$9TA%e5nh?j?}Kfl}YFYx<cpW%)imgpH;m&(weK}-66{J-}?JSd*^Qz
zV*|VHdT|er&NtpLz9*W0z=tU23~1(9v4Ou82AW{xjcvY2Kz!SSo7Au9{t+pE-3>MH
z^^Dfv@WKwJ<6U&&%TCnQGXtFIzC;~v1jQ-;X0>$_(yW?;5Zr0DUjxn2MnyzpE17pK
z`bFmDPUQGN!GrUbj^L0`eZ3GzN(2B1(+{+aFx`k=R0Ul|dazx8#qLkBJ*Cmg%XA=_
zj|(A8aAxUggCb?s996AXKq(3UaH4LJ*+cTKwv4{3*HYCL4_QZ$_UEVBNRa5cF*yd{
z(>VhlI7^dBag<LhRojXwL4~X(#>Id?d{I;vN`?g^8(6mRjSTbC(g#;5t7z$JUWF8c
zrNN2<kd)a)l>$(IsPgd{Hjw*?1U8h|X~p^?AKR({R$z+28-xLIQN;SDOKVu_$)#6@
zNkTpzH!OJSJShex@I1Se12MjGhpHIyho|%GOe_%s?An8EdQ9B`S^)WH0xx-HHl|N0
zVb`q(qAu7miN>OAyheBDCIz10xE~?_+y|<p;K*0ry^T<RCfpfhJIktQJ-pmkg!D~T
z@+Q0WS3lTjMI!vD%LiB26ZftA?~jqO=@iyCjCkR`ueT%wq_tn)+uM73_?0tdRR!@Y
z&?LO!I<APZj`%?Ab4^%jgE;Vr>{OU{acdLZbVATuw=srpzAw5;Zi=)J2~&x1)*QZK
zid1@7{U6JJVytexzliE%<d|73ob}j_&JiC|+BTIf^E?eF92{9>u_!O6iW+SeaN#84
z7(lUbyehC0(k|@Wa_iDfZhMGs*d<9-N$03yZ@<#C93N;~b*b&_WPFO8l2KL+M<%py
zb`RFZDHpQJH7`Z${#3XB3?*HoE8tmK7^wM000AX`JIjbPl|&0yqLkUhBvAd$_{2LX
z59G0V)8gc~Zm>7`%!;+iPho4;#^t+SoHn}zbR0SiUEfeWlC*WxJN=E@zJoI>g&fr4
z+wa~y-#<R+CePh-#|L=M-Lkq~%%Tw9S@l8Ub7xeHsUr!JkB@b_$;z{e-e>WgLZM>c
zY6K~N_0-C0?PRg#+sqiTGuBTV+YknjJ4wTdeEm+$YKdp+WYxv~h27D?6|Gj@2~t_i
zr>^I<_Kv%JhkQ|E#+&44+32d{(Hr8>g*#K3ZGU~CyPOBm2nNbXWU#?tDP5!(EvItk
zPJ&>ykIqXZpseby+coOlrfxMYLzdQM!OLiWu59Zd=+f3Sz-twM1fXlKSx8$?+Ttju
zHQ%+%4s+7g1hHLOCyA*nDhu@-&pV8JI)&V*WTQ@ZSK}g0PkK}|sFx|$iuA6M5@Tpt
zdY4mWt$XnOlu(4$-1*K>jZd^C*#<tgb<MQ%g4obp;thUp@v4P@k%gXCTI*OiLP8IJ
z(<_O@t$Qya-c(N{H!_I+5V;-#5=HZ_<WVMGoit+@wzsYB+npgxOz!*7qFllVs!i?$
zR76nWslXKBEW_E@r$ZSTXF0VUX=COz#&Xkx^^56)f74*K?$+@6Enadb&{b>rZB>{A
zkT`^i{Os@S^b!PeFLGEIl^y?JRxsv&CgrY3Gm3U-FL@SI3o#>CMrEmh^$4N|phrB?
zhlm)hib6oNo0TdtylgKS!1r$8-F4FswugL;J6jgp^SRWF<D-bezz@n#x<Y-+9a6Dr
z*P#Oe)Yyw%K|D(GqHVl*yLKI47&mrn)yZG01$t>^BvBf+v2SH-4J}CvayplPuRw9j
zupiZ<6asW#2q!Lbn!V#CNnxZ8ma{?hynqAFT#uy)hgw?FJ`G6T$>7=B19vqi$NNuT
z91J851#5R^e8bS#R@$8BLYY!5TnE|yIO;U_0SMAQh>nmYgZ|}3KRht-x(!3d!ief8
zgqBTKAGYkNOkYJRRI&1+x57VvSw!@|P85x)Cmo>u(40|*X6i!c?o31Rt9yap)dQ0g
z&PHJROWUdEIVto8K}+y$4?5C$^mAmB0Y_;$nLxHyq(KIqwcYgWjFUD<j-;5nf47gU
z+4$CFsM;9@OFERq3U1yPUWN$uj~ulx14I2!h_Wh;df3PA05XS%VkW+SJxZV~%7CKv
zaH?N6=_QTZx9+~8yn2;ix~9Vd@f-}^&FH;;&i#kYF6xNJvTcJpDYUcWQLPx@hn!%2
z4T3zxO>GOm1cbNL;9&RWV^eLhaWKCXT|YZJZ`p<t#^X_FHrQL^;$ty};o<w*)yI$&
z#Y!`CYt@f1&M8uUoW&}CJlO8C<5im1w<c1phtOMXr?=gj=2N$;G>82vUxe>UW+ism
zhjZ~#EvJMR6T!e=U+JJc7eFyBAk@QKcXqm(6JuPFRYT+7_Po(1sx&k#;evX>+(qU#
z7>$}xPvE<3VQmpBa$1zwQrs;$D7;sk0>HSE95m$nDxH0_19=dCqJAj3i#rByEt7h#
z%Px6Z;ZfWT$S8uWa8o)}WeD?`XY&aXewS17iiaiTjKc{OM3Va<5?ref;*+DUYMeEk
zrEX9bL@bEMM<1kt^0IMu*4iea7kxQkv`d;lHIu|kfM+k92zXf+(VCuzJl_Zdx0tNq
z$$rpx;$Rm!e<G59WWoobGohoqkNiKM><;3@lWLTmo|aC39e4e_nRK*N!Vt{l^_uv$
zbo%pwLB>=O62OLM=|{-Mf;(GDdJv=F){~^Sob})y+D&@ck^DDjU}KX`cCY*29mU^;
zn|4(OY-|lLUE3PwM3XBaRZCWMkC^&st%|yFq%M;ax5CkX3%nm=!&3Su-Fn`!{Kho&
zxD&X)my*(aArU|C9<kb3;PQSfc<019f;0x`w}~^OJ^Q?m0WB^|pPe<X{f<3|uBAQM
z()XNdy21EpiRWI#*UnC;lx#le6l3@3f6M1($^@G(&TlF=9+Tjp2e=85$OsL|$~9Q|
z93W9^y+w+D=k_PcCvLKnBcZga3^TG{N9XEyRroO^8kJiw$_SKM1d^sC*DhYt;AxhX
zpe$oI{9-vtK8H~gK~<}`-&?iOF!TF@XjrpAR-cratKTo^`5~!YFU=1});ZmJLevH4
zc9_@ml9zz+jk<s0w747Y6u1D8c@dUpu&UICVO+X@j@}Ogit8Ph@*8hztM$zGZRGqL
zm)sNXR(3<mK~WY>wIXLn<f~9fV*83SHjP;;#Y&SJK8d`$<~aq=-oASdjf7Cv)G6GL
zc_?=0<>i`pU1V1fxb(lmFRg00Tv=*_#2KjK6t1*9!mOv^Rp68L6CXP!f+^VZI6=??
z&J3e}+`Y*O>07(7`5Pwm)|wE#`1gH&*w+tZ1zGQKdX~!XyRrl5K957s?v)ae>LpK=
z{<-!VPwA+64p@%yII?&nw!C~!3iJ@vtQyW>@t$e`)v`unswPqDO~`wPm%5o|PFX43
z<;D0ZRV~-6)cqzE=nE7}WoH0vkaxgN4c*&+e{)F9%5&I3fMC3_-%J1>5;7q}nD|QK
z{EYeUv;=GOW6B#nhwAc=rM|E1{iV{veS>l1|9KO_e`-Or(JqS^lz1Eb<VH-+h+M4}
zdg9h@DK9;F;nduzbS)d=Bw05iC{O*QSJCUc+gYE-`(~cg>sl3yTvDU<*O2lCH!dH4
z@E3%epO;tYT=4q^zB`;t-oDV}ddZRf^WP&Ew|Aqh+yGl>A3f--$xOD@l)Pm7tCp3l
zANsh1{cR6v(4qNTr5t}p$8l7%ZU;VWB~kRf);3mhp<*r$FmrGj8@0LSEGfd8#=~YL
zsxog(61=hP1>#-nU6Z8jh5g@hlz-uW9OX5WY&kOew`C}=TMkQ5ZV<fVWQiAcQ)cq*
zQ>u!wn}TBe`1aY!lmDpfWSxePoNP134CG0ao80_@smYViN=?R_fx0XVDCHa-a)-`l
zUbg*UrElhm+zUk(eK|PW15rjLA!5A}9K|Agbr4L8$$2^Au98JLt!LRdEoE+hjtwa}
zA9;arsU{Y@YZAPN_K4i5$US{3OsG943XdL0Y1?#htqhcIhy)BjQPHQ9rCw~2ckXYM
zW1281H(@?KgGNPT((bY3HN9^!Tt(7eO<h8qn(AQlRM7i@H=UQ|xEEn)FIbyjYge^O
z-jeV+JFO0mWRaWdowBsrBG=r1sM-tZv!rvIx}hcrt^xyS-JrSlhdBWVE_2JVH6Rb=
zg;#}6st<r@Kh2j5Xb9j2%FkpDf&Elq36=4fZCsE~9r+`&&$2r6tnLfT5)%v!sIyU0
zqE<S;yh@%TqmBH^PHSxm$m&$M%Y`j;n!I@NGSQ3#XXDUChbyesw>%7gOF=TGx+%jg
z;kUTP8I&wNQuHLSTj@H*NHgN_kU~*+(`2T6(FAb+o|I?3n#A$lX#*_o<UOjMSLKb|
zzfEBh2W67OFOyfVkCTIcK0G=;3Zn#?p&p9l==km7tFQRjt9LJ60I)D466LyY5V~CV
zxt~t`vek)ta`5tvcE?SBOy756|H%DNL?4B)fFwP6vTer|L(_kE>rY4r`GEYh@jbdJ
zGlMkO`ggvoe8B(Z9-{Qcg!kcEZ~IliSmGPnKKI=>$sG^xVT6Ed$J86bVhPN7>=@r)
zQPa8-L$P0OY3k0FNmvR_A313@9Dwbet_y94zD2kKB1eGx<=i`eo!%W1$i9fu|K8@a
z34P1@Zm-f^D|*MnzIB4)xA|ig!pMLgFX6hyE_O?tk@z!w%-M*(V*t}xX9raD<^|H3
z1kc~8=<aXmkDcT+hou7BWIxR58EYz*Q)c_+V+lU1p1Q|WO@q5tM<+`;G@jAbYELkF
z5qixXbL<x<>kw;yt4BmnD(gS}4)^-{x9eMMG<qCCS}rFSaIF+bM~VQFe*2(5D`q*Q
zcD37hf~|DmYFS=LQ8uYQB+<79an%ckJu88h)1+EA^ROrxPZAMVGRasI{hSfQBJSi!
zr$kv#_oA3jIgwjU64ani;aqW_PRH;!%$1!I{`;!bdXb5LxLdCx*RWa$^PJGeLPz;b
z`oO}BZ2XsuuIx2~RZN-rnMrNKfSEFDh5{So3Q5SPSw+|9>-o%e9d*Ny)}u+DO_#I1
zfD%?iM-ZEmuriD~HS8mk==Gg3$xoqRxyzT&>0HD!IA<IYRuQ&hCAqzlATn0(>9ZQ+
zPwQp<bVNCSPDlXfO8Pr9ezsn=vqto|tLd}s*SeJ&Z>w8btkDk|M(et!AVAXf@?%f&
z!>ig4B^UwygX&vj7h5om!E`EC4WT1VawGbmhW*_hyB~M<5`^ZlBcc_>`hCb}3ri0l
z=0X<8mG33bMF25H>vsv7;a<<il0Y_^BSQS{_*rLvZ?#*@EU&dN&I)ooC3hd3<5%54
zUMz|a0-qynj8tZ}n8Hb1o}MBTu@dG-vHBxdriLD<D&m@~pGHc?4M&H<#NRb`tQY0k
z*@UOl!r^rPzTkV=;q}t#0^n~fzLYfX3pY#HzwU4#XS<t>ogu{JDi$S-1d_w`?)++Y
zo=-J@NYWmh?5F=NOaFQ|{X;)}|LZ~Lp=^vAi7+R-%0AlF>-{Nm2IGT-3&7o3tItNd
zprt<ftKr(4K_?uzsq>Gl6F@q{>Dsfh`v{*r8T4v>vJ4f?PvIS9WHxAJJRC^Kmf44A
z?9Ct4G2R!lw5UV6khCBG{vshJZSUmmQZK82FZvhd6t-S}hH^3>p`9*q5%<xZ8vYEi
zSgfP~?P>yx_{A&B$pd8m0^S;-_`HPRjd#SjkoYfFtCt*DCqpSFf^w*Rtd<uSuqQJ~
zQ<JK^J+da_9QOTrMM0Y0cJ5>BW}OaxfqktX^Mg{iy?oMFIjzA7agV#DjapaoW7`FP
z<e^@|+aG28trf?68s|GN#$)4+po*p~RXV4kszJ%dJV*noBBX!5%%W@lFxS=cqwV^J
z<Qo?iMPH)PT=5iE{!&T~7XtiPA@`Mpt%{2gE)Rj6m&4d#%dI|-E?3XrTQ7RKiJVYM
z-7awk7!vZDmnuZ?S*aHMSqVt;ljtXZw^Fq3Xv_;SZUj-H-*=GS>CDacVE;I2e{=Bm
z=<xNc<nfba+R=14RBg@2QJ;doaI?}h%xNYAaL2=WAbWbTLC0D+d5C&px7B$S=~1!+
z27fpz&2U|?J)}27Xj@{5DiJt{G~i7E0`72D<r@?i%<=5}s`9}r*=b5>0*JkTxtvCK
z#Ua7xte9$+9)bDHjbSh~nW7;9?=x+_%~F}@?VT@Y+~rK^T6YU+UXUf(%3$0qP;cY3
zV{5o>u|I~Th}RpE6|->R_16q0IA56klAU5D3@(maTKq?Ix$C|Ds&Ns7-mkPqF-)Bd
zuUCtJLHTN&6Pk%Xn{1kb+`k2XfszU2Z7_w@VNz65qt@kH47EpKo<a<APt{a}gET^{
zwS;+aaYRLcL-%6RKjf#y_YAY3_+ta#^>*cR-Fe7GrxW7L`3L4#VHemcF|m!4o<+Dk
z+Nc@1b5B(=Ci)|NO5!j>qubT0<duZWEEzh<nrl!qXizp!EMgVRZtVGgRNp%~FJ?W-
zsrV9|Zcbq3y^1fyq`v)P-r>R!BRg&ogxsmeA$Pm#huxjz`1SMGd+@F0P7T5d!ezQz
z)ax|+cmrmflWy<_oUR)}JTa@&vb$+k+^p~H{%DC3L_MbN?mO_Ya+-E|c`7m6m&jj2
zmj#Se{HOPl<EN&mQl<reMN8nVJcxH_whV>QDJq1#BUqfgqBu>n$(10AM}?|@OH!3r
zcPvmJnMiH@R1|5e%?(8x#Wa92A3e}>AV>aNC^f!&bi=EKD3zr76bVoY^K2zvY|Knd
z^ZN+4+ohxzsF~^;Htx|1mx-PwbEzi+2<uO*m7+6j42VX{LliN87KWv|msA77wkk)N
zcuO%#8idapoxIit)DiW^LoorHKZez}ZYCtEoR8N8i)&NDhZh09OT579U8L42R&h4(
zHk=9^%Pr#$)q}o1wl4Ny$qs+YuaX!%@E1#Z0Pz<a?pwn@9pUglZ>q%Kup6(zZiIy!
zH{WWV)c&qR1}n#Zfv}h3>)nt6SX2$6%-puDO0(3XtShi^4QH2bUY~zraDn689r~-T
zHW>2wFHpm2J+yob<jv#lo|U0QNELfWPD2oz{+EJVoK{O(OsC9>*Yq_(z*Q_&tjY>%
zGc2LXSDsrf-!!N#Yk_0Y6cDdd!j@WJ)ekZ*a7^+5L0c<-V+D|Zp%v~kzr(KEt}s8#
z)!kD^u~&|iqvC9uI`!F2`weSO#ARLi%Kd6N>nJyhFVP6ne^Vpw+XB)}aPH$&8nC4t
z8sdI~jbJT{fHiwD?m$d{%i3HsCp9R3OG^#CI$sX!BG;Z*O!xcucRNBtvnXaE0)ASs
z{F+YQ%4mUq=$^89w!kmsrFX^?b${cl|Cr5Yk98~^W4@v7>rT2mk^FD?{TzP^{<Z{3
z5En|N_i*N>f_R&Js0+Rt)~}#uB1rGyb0v@k$j1-)oFB>d%_g*gy{=Tz5#W=uGfKLA
zaplv@!XEb2Cz5>N_B3L`sDI53XwoV7=h*B)x{7Rn1rgvCd$>-B#Rn`T>h@&DFe_5p
zf}g_+1T1h1jb)aRj>2Y0$?53Ip!t!Eu;JWA*F>#kOKOMN@5~4e!jYE^Vx&>wP)a{<
zIE-tT9Vcipze-P?hQE7@)8}E`d*SzT^nTKblSclX&YPQEWHWm2D%{X!Q&x3Brb)zd
z|G6W7qW=o-TgnF<uU<})i96vM=i{?HwF_mua#Y;4<kmrtNW4)r-FZ>26}svnW663{
z(ycc(No1G>>D~&}Bi@mkjH7kJwPWOwqQvIN#ylorG&SbTb?66BP$B?Ae|lg^Rbf+_
zHgUtYT$yU)EUr!YEp{eI-{aqKZ~dfQX|4Q!Z?P{;?GGFhS|;>Msr^laf2jRGi?HH9
zukQahDvrNVar`f%;^^%@_<di-XJ@xx1fr{&xAxzGo+CzsXiRgf^(<zC^ivR=D#owp
zU0Cs`Ya|Qn2G7GT)ZUVLzbM69OE(fzZ|JuL8=D8Z_^8!sjQfUrmL_ry?Bcc9&ClF_
z1TCk~5;ZZX>mEm*&Z=vO$%q#;^<0bh?tWD~ZGh&rrRtpV20Ax|B?Hzbf7uDJXyVxx
zz?Zproami~%ar)-e1M^qg@gq~N-+X)|E?wKxD}{KIkud+4Q3>HekpEBd?F&B4Qge?
z*R!(}HFlQX?!9~cHP_7Nk+u|d(iUugzED!xI78})^~{+*9@lCe9KR3;jZ)K5!d{3m
zAD1l&v|&-l@T#@0b&=}R&W3dMh?WLpZd^{c7d}2FAYlSWm&5lPrN-F_*t3=;2<W$R
z6=?okOYU*wUKOaWP+3#Y`NTH3m$a(~GLe#H4sZZ-M0<!lC9ix?&oM=!u7Y5HO?}3F
zBek6T(E6*kyiwlsdag6bh@FCVGWmeffR+8Uu3hpPZ&weT_;)wfMM+-}*^b5e>2neV
z$W<^^gsr_)Jj~m?W>kIDxA-51sxSXq_msX>u*5X00%0!V{7AS_&?t&ihGZA@`Q(M)
zdiMIwpA#Yf*1kM@{qEIqd#7`M&5U-E<JU<%6HcJbmW$r(yX~a?<?FXE_m7ip{n7R+
zp70&TpQ1ZxPwKy)JigbvfBz4?yRAEt#qs#@-QFL1_oRMdYip|~zWTsZj{gypufLoZ
zkNv;8iFAgahJX5>b(FANSkv9D0A-}IG7Bw~IC>yyU~acs8yLEx*eKC|@mh}KD8;^!
z7+)i#6n$}N_1HlQV%N{h@2@`RI=xdpNcp3VFGGaQq$o8tG&BkTBzt`;kYiRP1?hwf
zN^;e^CJ4MOVRSbpKZdzameDH<_a5)Z69THcOJzB9$IQ~eS7UOYHNpUzC69X&Uh^J(
zX}U2fsNF!H*92`WOS=qzn4HufkUHAmiIoxZB^v1&tm5_B@<yv;laAy?T&oo|Qqz<9
zTQ<pzH8I436}JE8FpfHhfV?OX$q9C2OoZGZ=)A2J_#1cwV-0BIkoe+if~p6^p1rJb
zJ*`9q;Dxe?E~kKtr7FBXIt8*B#)X91YF)3AcBJLsejxWA{BGBOshc;b^EVpBzx{nD
z3UCQYXhin7$`JYsnZ80T8If?xoBGk4Zp&HvpV#PJ9sfp(%{9!RI_q>XA?Lc=AV>AZ
z-$;&$DO{!K3u=i++^I8_dZtsQkoq|sqYG=G$th|qrvK}CMNi6=)alKBnP*3xjpU6n
z6K|bW71nEwk-Hv$IQ)+y)8(RR;7+%Av}puiDy@Yd=J^acuT<+19`JOqf_0%i|E!K{
zC?w3e?ItfbHJ79A5FGIL13kP&r5h^ZELO(eF%QLP(V#7k9D=N8YinMo<WLJ>Brs5Q
z_2#+cwyJe3#Ah&705dKD839Yc4NWMY{G)_Lm9+qAB8V)1;{xzFouX2C!ZS3wd+#o>
zXbrSdYDjv#u?J`Qf*l&{4l4U+T+~QVUOXjq4f2@&+c;l35%Q||PY7;-lyR%B|0URy
z)gK>GCyOwlopPeEyz#JQ)KZG7InB_(qEKwkm=&D;XYMqkoexf!NOdC0YFztKDijxT
zQk>=z1k=2KG>q)zFXeC(4xeDDV=^E_XrT=YcP8dnVrJ1t#SK_0PAVW7WroQnkzmT-
z>U6mUIE((O?M~NYisd!T=r^-qM@Le{q)oDF=`4oA#P*VtZ`{6Pj9UiX|7d@+ad&OH
z`K`+Z#4a?}0hMPtB`aN5!-1*r)I_LX!r6hL45Yb#fy%y>+Z(fLp524v7Zzkw@)-B{
zhC4`--B|4E)vl0;U@v;^?+Pn06Yv2A+mNO_`35&bo#lHdcfH18_>_c{GD$aJCa|0P
zL2p;)eISbaD5GR)d4Q-!hYF9<5U$MTr7e=C);nNFp|G160V>|6R){R<8_1jDu%vX0
zm_p-!HKgJ|6EdYmrL3AXD|4r44fJ8uE?j?tyeQRHLw=U31~Xq7q5JZrT2{bJYYIC(
z_Sp=JnN0#1=1Da{30ULtFZ%o#0V8MU(qcOHF3WX;kucb6E5IBa`64N|3QL=Un#+sW
zn+SplLWumV(d@vqO~ky8SuJC89wmCL{0z^3Y}?k^9>Cf6CFZmFoKG_)e7X*v6Xlr<
zn+i1Ce7(zjIP1XCij01#hwAF~5Q4F~D_08pbclXO+cr1y`r2tE$i0Vdg!)~K;GuI{
zC6GICXMSDF%b7>cHVCiFayc0jzv^PfoXwGJF)3r0qbhEZO1&}__F9gUAg}|XoVlBS
zoNK210#VT3=%-K*rgFtn$D4v>DxyfO<=8%|MVe?k{DLNtHQtXJzmq&I&SFCA+tXzK
z=QWJ}pGW}iw$Fhgym@+_FJr)tpz<r&2mRU59EtjD@wB!M+<n*;@Fe%2qlEu;TZIgH
z-H_khQJ#s~o4bjkx=YHM_e`AdO?4%I^h^XyUlE^n@Amb9{&&k_^noAmIx+m+B>o@{
ziLnYvlKDkPG9)UfzM_ME*30hq#oxN=eJ4Tx{j7HHiC)Do*0-JHi&3u=c|>_l&E}Le
zlVUi}h~}}D?fs758Lifd{WExKD*YtNbE)NnHCfTVbaGyfe4NgzpqkfZYchF%rP7Qj
zv8Bp#!s206f{CECRIzF~l=%<@Twpd}_m9-u>%)gqVi9&`I%M6E9nBsu-6-|M#_x2Q
zM_F?2?C-~0KCV5R^=h+G$?vvs93O8@OYt3UB~QfZwLhCZ+RdKOQa^IKdiu5N#)gTd
zBtBb0N!*2ApDLteM-Z%Pi7o(t1M!F1O)~7!TQsX%E!C~2X)s^Ga&e6}xsq?upiSbg
zVF0<t7iDVDKzB}s-YG?xHw`#Jsk{L1PZDRf$I6S>c`Bp%;Umw8g*q@K*MWZgB~m3B
zM2@<D2zNA=J^D-tvwEtwM8wdd2bKann0)b@2lrjCexoqqLH=c9eUG1i_Em0av5ww&
zg!UvDO1E~M-uumNfOuE!vLTzVX-y?Z)Wq(+`+xY&uF6;``D4YQ1YJ_qJJRT#PGc%&
zdldMBt7Gv8BW)d2)dVy;G!eJ7pmVDi@>dy)D|~L1pRp4kZ8VvS*y{e9!?pQVe$!oy
z@96WXeU@gk;`1_ReJ6f@YU-@L8n1oHQ2P?L5@1KMz4TjZlP6z`t#*W)HxMO#q}9QF
z<$F_0IzukZnLkr0oibGlpFtS7J6+bd4!s}-HJ==$yzC*5A!<v+g!3AU&hLap$3I8Q
zq}Ik^RW0-6m{bXKNH5JtvF<tr^xhZnEiUP9kq&E;b%EceLbEV`Pm5`K?~7Cr0jke@
zOPaiaMtEOwm60FuXB<8E<hAdF9+}?f%iw|X?d{jDh9nNvSlMdw_Qeqd=|T#BqKYQ(
zcEuFh>%%^*H7zG=Ql-A7R9Z^icVXEq_xesy!rZ;<{~dPX)IM5!>oOlIc!M_-KGX}s
z!!;P`rks7IFDu`Fo8(1@vJ?Kja#5ng>n=%4)eODIE!i)oKk=3vSq@Ir;$qhw_Y{Ap
z!#wrZrBk22xEEcRsB3ne&Fqd8Wne6`wr-wzxyfYh>TjxBUz3ey^n%zGp(_=OPQa$(
zHtYmErE-WI9zn)w-YMSy8NK(pYHydt7~D~6%VRm5w5iU2hh;Vg7^5&^ImK(9O-JWl
zc&W=t1eD-+j>oqa2yxTzMR8i~(xre~v#gu8jQWQNr+3}e>38^l-n%ngN&AvPt;JXC
zM!QNZH8*H?Iu}r?!=3zP!2IcouLk=l@c@jw?#`GN`DE`AJQA1XeEj4e@)`QKK<ain
zcNal#S*0j{<WKMSkY*aTD*iPdk`OI&bqJRM@@!f^wEk`jXKQOO*}843TV3}fC{*r8
zP^s`Ik`>T~^p#JHhk#zehtdmvsM-ZS)%lRtbZGcIjC0FCO1~A0AAUsnJqoSWZR6YF
zmf$(@Ss+%Y9tlSDyPFKq??F^3<1ccdvTIn#P7wZoY!<tEV69HPSN*cYdo{Yk$R*<Q
z_tk5066WO>GP>`?M|3wip_|~BYWw2KH%qs}FV=3ATEpIZ@k_N`1$T&R-rOX=RO`dy
zjDoAv@tl+E_LKN-Yuie<N?&{jSG(h(?Ik2>ZZ%rk>IfE1<Kt+{)j-7eoRaojNH#-#
z>QwW8=sX9*0r7g)eoc%CGbeDQys*tD?rLlkm4N^>_8~*^<05csI|;3(^t`;p2hR!W
z!F%#@oukB4F@#jopX6T+Kd-eFLNm$!WOkml{C6}_;rzwNf-m7_17SW8Zd8WqRt(9g
zG`SLpu!w~KadRo`xx|yq{Fexcgr1zr?QtJ}<NPhRix@%jeI6ujw<IjE3&cm^7c6-*
zn!*|RWao+%K>P>z>c#7(9}-8$RGf2w3DD2#7S}^n8XuP+u};LxU__t()$W1zFdIY1
z?Q{0}9SfMu${D=EGH(PlssVa4sa-i^5I}RsYiLm^b5aXC5t%7ImXnW?)H)`ug_78R
zff$zPREBH=n8aM~(}{b(h}KhQOOs$B)kt1J{q4k^1%UcQg-h}QJub!cW3kA0zxmyp
zm-qktb@k>cL+2-76^okPdge6DrIf$g7EGP;UirV=uIFX8@2Aab*0@nZ(qxFooyeL|
zPW)c6s|1RRpRWdbnS4Neoke*joMM`PtRUqPg3K6)c2J}4ky{{$E`}3{F(TxloFAVN
zikARbK&QW3bPTW@p|vG<^M#UJ*y?)<94((Cl1&wuIie^VeUf$J3?`w=#yv5j<KFHU
z_xmbHqglZ;yDg-EdzptMmaJ}gOYoDfLWb(MN@|#mH3B8vzJ(_cMXWNW_i)mxE-W$<
ze;v<30jek^Xd!Zax*Y_{`GqCN+M>^jdBNRqG9E7K1w?K+-Dm0qrgHr}J9Dcvk9Mtm
zz+$02T?aW((t#K!LnkJ2J@Cm1%9XnyZ<#K=oLftB6i_6lx6H~*U6~7aoK7UAwoVc;
z9`?%l8Oo@Fjx&}=Jwnd<!URt-AzPbPe|*OS$yt?h4Cd`w03x2nCJJk}vA3AO!CyC)
zBOv){71G7b*&xJ}(v8BHqxb~oW2wmrbTIKQT1uG81I8$Oib9_;BA!jlDTA6$dl-H2
zH3+}<P(tpXVJIN$onHA!iKH3VfPX1E;<J{5b8~k$3D<}vJx7E%ZWf-RG<5Y0e?(;v
za@?xT=ZzArMrG}0s+T-fZd=VDBX2RNp}2`omy?~EO!S*+jbBpt70N)HOU^Dw(7S}E
zS%<T00N_7!N6Hbq^u-9`%HnpKGC^3Y(EY{$+r3PKNZw;~SQ8Vq_<T8?l%o%oWwCh`
z!ZZap-{RzaDSZcp0wUei&l+RBe}4FWbETn!XUYm0^)hMCbEhY|uI&mCulujlQ1j`y
z1AxMrfB*z=Wo4Jn{2)rm|K)VS(<6kAOk7<^rpr{A{!q_bc_21wAm-m-6vB=88xPvo
z#0lIm&}(7-fQ}qsqQ$UB!M&Rfxgb^1%`~YMD3}p~v?t{2GSQK=TJ{tue=E`9qi4_W
zM`W&RyI76J_fvf)t=wHYxk{<ipwnZ(m{-ETmkNHf^x24madYwm%rZ+ZqnLXt;HO!Y
zy2t+FRMkon_XvulEMa;JZ0g-8dN$Q(J8~zlT!ImdrL*EwmShBNPl_-+LcXNzj~D<<
zwJ^bLJ4%+dJs~t2pK!Oye_%N+++hP~r+Yzvx|~e#Zxj>)KTrUZi0N4i(+@gcCfC@q
z+_G2aZr&rwF^-NeFq}QKsq3}VR419=l}C~jpeMm-e{cXc4@U9`QvV!Q*MqY9Gez~N
zMhR^-vD0dK5pqH$!yBm*SP~r<kS!L#ycLvRO?JG@=2L>h32dPufAApV*_b^lXU8H(
zsZs|tdzxKJ7CAwtvFf-HVXbirUVE}cJIR{{&LkiWL4pF8$I^b(5l+7>l=PnX=Q)-B
zFN6{)$O1B;-5yj8dm<o5^D>0qrAx>#lb@;u07z9T5ox`INghqGvn7icZ>lMY%_<)R
zrs_lP+KlPR>8cW*e^(3BPxundt-Lms61rmaFs@C))f`>axOC3)2*%m2F)z{WN(w4L
zgIsTroad97s3CRDmBlFvnY1V+GdUg4C5cvHD^i&;0lEk<ev&d1G7Q~qC%Di#ZVTm0
z)H5VHDD<I`pksGEW4yX+X#)zbznL$Z5|#t9)X2+^9$2Mxe^d<7jhXGbhV#^sZ2tyR
zHV0Ho1sfHty$N_#?j7zX%Cie1=I92Ay~-YCedvaAPR8SomRuoQ%)@<z*W9M|s+OeX
zsaFH8KEq?&k$(3_0ynT?cO&3dL9XX7Gm>`!PH{gr%jOJa6;p4tv1f+xf8~9n_O-%)
zTAI9UQBNpGe@;vN&h5uM*XNmAhjd2hiz>Elsp)#3KlE?%B+S$;?Y#!V7;)EqO5R9k
zJ|!=F9?>WFahj%y{=e=orwI?-pV5ihP5v?anCTzwr%N|w&+}>7k;m`gX;YY?B6pKF
zP+O1O8JZ|;8Eq){Wa?+F)`3Bqq7ht-ZP`EFWKFWxf0`sM%iuy^=-~@)Mx8<W(sfg|
z@uH3rQF^n&Zx8F#Lsc(rCsme<!D-e4Jez(_SFLbBm)sbEsWcX&c=K5f0I2zfl@r=a
zRgv|lw^+{FuAB%?gFsd*p0NFL2!*-fPB1PC68Q>sf*b!Hx0X0J%9(dT2x~bf$o&)%
z1O+qJe>Z@+gjVKq&SfS^v%Mj3l`j;NQ>(Ro?<K+SpZv15T2IybSzMMW4av{9KZ3P1
z^`1RNzU64@gi(=VQ<-A>P|@vCZ*A@x&(l7YeA<Q)tqzkjw`<SfJ%mezLr3UT`9CG!
zm#9N^eB(IJGD|*tz!4KhI}RNAI}dLqGu;4?f9K!<a5jfi+{pWyiRIL7cvvZ1fe5T_
zxaCarD6(3)M?NTGLyZSO3MxFaBeR?tn}1e!wART&0QjF@l!_sqjcpRbBIy&m!Xz`;
zi;)C;zOnmvv>r)=IcisOR+{W{Z6O|PB}w~UH`%7Dw(V^H!<Pp~$NMkeB-{7z-v4cS
zfA^mIzvSNCy}Ng}J78F9-*-;~RM|az&C_4#(+_TL`yShFbwJa!XctcTa#QU7-$mt1
z=IbLI05!#}RBS>A+mtx^#>+5RKN-#nP~QdR1K0<!s!IDf5L>udbR%r{nmJn-DZQGp
zlG-4_3q3vS*AW)tayEz^DaB&rsv?tlfBj<KYRUV<t3IakW>PWR8#3`65|9tvx6>AP
z%Xre$H-Gi^^}9F8(?9cBU7rV0g@o0(_{czA701qzEDI0WJCMzt{M&#39~%b3uVm`3
zdCG=6=n+msn;nRvvxSd-O))KM+t!{l1a&n|8Q`xQu80gJ1KlpH4~z^!*%;K8f2JDO
zz7*bxn#UvFAIEyTai5--?)1YOJlO+O{s(Whv9E(@8@QcnZgZ(-2#=K00ke7OWzg&>
z|7Cn!8XnHe!VF3Jl0L^{9$2wsHmw>0te3sPEn>Dw<dpI*pUC}kqh(|^VQ|Z|sZK9e
z{iW~Qcig9`|1{;NsrU&~kDi{!f95@^B#+M{#Ya>rmM`ddMRyjHAxoHWJ9hT-<b#=2
zg39gs<Trd!%{GOP@7?vv{`xfXRU;BpE`7-+(rICZ!;TUU^i}G8!M3;BjeS*f{<=T!
zgugmLKt=UFH~M+g<YvnYcB^6RrW%&I)|`77s3YqpFSR806C4t&ZfSvBe=vQl?tu2o
za{&f-rzNdiF>Oo9QX`yp=gIhUd{SM&P{cd>^E_${=ZH6;;iqVTF0(XVXt2j)gP*j}
z7A8rBL>1{+8qh}u?EGrM3S-&sDc(8%AoT&2Rz=*=k5DDRk5Dnd)XwtMeP*+X5v!D<
z0VH)-?&tC$9XtAAD!T{2f6(|Dp3{HIo8ngKsdNwEzxdWSc$I#1|Cvni&^QP4AJWtA
z*gx^{P5z=(fL$fU3!0(Y#>$h3kbQH}sJ-u_v}cU$-#lbEi#-;c^k%KoAfxp_7g-WA
zext}$Fxi#FNI6rq?Y#sn7*R;rYn4vD$gMr5jX^kiCaUT>Dk`}gf2Ib7W#K+Iv*Nl*
zRrCQkHJIn#+v}Ze8cPiJe$|XABiDt-Na$<BMaT6qQ7BG3f{$JQD<O*0>%I>fp1HfR
zy-Dqv#+-=ri_eH_F}ZS*u4c+8Q4A~J*bwbRA=U-kdsFk6XP5Ry-8I4aoa`p%lg2-r
zj_A)6CcY#WF6dq~e_&Hl+UAY$19leSk^vNhABTA}US7<?stL$|CTqvSQ@~dTf^Fqz
z9^+MQi-2FMT&W|GKLs}eWbS}{tQKdXgR&wWRkysMND<C%A&M+qFS08cT1smR#H#9b
zD-plxLw+UMBBH<bi}3*2G=R-@M_t+Z2x9H-@8yiac+p7Mf9Y{?(HBU94Liv)zkk_a
zj{moDl`aYaAQ>U^TYZ}Z>8jLig6tTJ`iN^UpBgW*+sPrVxIU!5(i{zh^>bP<e&K$j
z6p2nd6>ep5v4kCWI$CqS)*dR#YrWL3wktbK9$Z0o+&EGFo@{FSN3Xw3{_*wUtAYH|
z`Wq%j;3Q#<e@P>lA8}dQqvzQ;WSH@#PCcs<#wy3oLTd(pf{H0deq|0YU`}ei4D;?a
zg3{O<vRyFd{)bsnd0IF(s$~v)1YI0N-Vs_zfEiSFY1kUHJZGatyQ9C)%8&TBKcoYv
zM$h_k{|{6p&=|&5GlD@s$p8I6#4J(g7^P%KqHh8Pf8gQIT=$7jR-O0fIlhUGshtrt
z@uxS38v106{MperiK2F~$4=%Ir&sRWlT)tY84Sl=U5ToZ8Ld;wH^6ces>ke9v=+wE
znXAQ=I(X)eCYj`~fp`z3#cv~W^vKQUFNjfAA(l{2g%I<Lv!c9*R?jZpuFC2dhvb}8
z_p|Kre?)ARXe-Z`Dy`(uM)shb9>%mROXU)=H`IV;*bV|}D&Z09y7`8fyyk43w6SOK
zK`D$?=Zc6HXLT^Qv#Kk0PG(a5Ann`7Jc4ehn>ri)5W!JD4!mOYT}U%<5$xjRI`Ne8
zRiY@sqE6izWDP2UJ7`RogbIa(5Zty@dp5CTe-Diet2g<A9cqf1o17p)TH!)?%zwJ8
z06$}dg{R(b>ty}ca({35vR>|OQo%h2nyqGUYJ#H|J$wuA41hbQk~J~ol>oVBp7yXc
z$#9oX=LPPmutB|WgfNojL{$N(kd*Fjqr^<wyx~H&fQQ3HJJTg>CvM!jIOhu%<&ypI
zf9>{K5ea<RvpMbR-_exVN7)5)MD#B?N&a#1toJkhepF^o(;emQaS!9{Cfmy?AjyE{
zzb(E+_py6i_C%inaQ!9RU3t%R1$h{~msH+OPknj#;`rcg(*E}AgSQ8XeM4-Y$H_LY
z6K6ZfyX`MkQM^+v=#NR+;syBP;LBs)e}eeBwrP?vJM#KfeX`uk#<joqUp=qQPx1s$
zkodNbJEc{7MbMj)9Bt=*VO+yum0B{&xZS<I=ljP880!yy5B|6v9EAHXUZ{VNbh>q$
z5(3dMCb9@RLwu-1_`B-KX_O4=c3&UusYM$}$xzN}7KyoaD>a+8V~dMHjSm{_f0)hk
zZ0>WF8)*a>lUu^5cP*=Uc~f^QKroOOVqRvR0<@tc?u99ldVBa8jHTGgM_#Rk_)W-n
zS)qE45Icm9)K?|NsWP;|RL{lknh=1#h#j-gf%J7GqVvRh_1P9^Q*cU;qVN?nUe%c(
znyF@;bP4l>xA5)rkPiwmqFQ^@e~WnLMf1e{84)Q-YOJOhn1euW6*0aKSKJIqTU`oq
zGWB*P_Y6Va73!-J5*m!0AJhzA=Fz>@7A1$@=3q6iNjUo4h2JCku;MDK(+S0W1A!Ip
z^?HN~rd@=YFx{DML|<y=y{XV~&!)^cVpW<>`B?g{Y?C)R<H&90ZVVX!e^IiT6iV_P
zDTanJFb7^f7WZOUoGn3IhO2#7P4?7JbUYOS8Y;VDsyN$dIutW;0PukS#AM1uFx0$P
z(TzH&6qUk&yQQTti1dp0?K`rAZ0n@r4dxTTmYZiRqxUK{OT?%kV-Rkx9`W~22Bs;m
zeC}?eD`NptO+|KEnD0>rf2eV|gxfk7LJ-5Z8jBdh_+5XQOU{5CG-$*XGA)haDR@yW
zeMP-Ds1eQP$oa_UDIGP2g=0KS19OO>dTw9SzUNW6pHA3!Zx2;*jJgmNW=jHR%p^r8
zluXSa3J(`mQ+CK9m7!y@_mG*fA71haFSks9PsxF5!OX~zd<7Fbe~sLYMjl7lDxcJQ
zG4TJ|1p?phqTIzf>?tm{GgemO(QaA?b>wmW)IBQE<dXnpUVT36!yW%?kKWutA0sEq
z(E|`R4}4xxLyjoqxchT^z)>4QAe#9V%1;OWU#Gi^JiG7}wD{suWYz9+=5~}^%3cPc
zwda1Hp%v^p$!ylSe~dq1SUq&!f5om2RHCs>GaNqETsMQp-&B>&#qh~{xUs|P5v`Tn
zweYHMcr?(k91?qt{|k$VPvist%hpSyWObVeyRkaYX8B%}4pQZ3QnJECN!wmUo%;{1
zM+M!QlCYMWg7)6UY;naOA^WgQgfvKInIb)Mx%n--3ML*Jf7QKy-S0ihB}}?%LMFDJ
z{_xuOHq7xD(?1^mICOs?;i;qNf3oaCCuHXrVzF5k1qM%;g!bwoX#bG7emUc4bHBEe
zAKhN_K@P7!+-52|mc-_znC1LrA*c2N@g+-ra#xCzOev>LdQBdQ1yQ@+`nz-0OU^sS
zNI%<6<zOH&e;rLc&)`K0j05^5KI-(GEjTd&?Y5~1a%zkTJoXPGiEKH3%W0%iU~8ju
zXH%d!f;d@d?Q#TYr-GyxPljFo>DV3|_dNK&<Z=;HhPg5l|1elLQyH}+azRROWRRjv
z(On{^f*BmSYo?Z`3Pl~t>gQ_?g}Cu0`50HDq~N$Se=}G`-ygtMAG}^cY<3%}mQtjg
z*Oo}cT~ili3&0d2J`a3%AP|-;@p8kn--dK0ITR=1LceZs^fyp7mhn}7#+607A)>W@
zP)XWXaPP#-;FcD^2uq<78P^mo+w#lQ7^8LGER%{hN4MF9l~^p%@tt;s5WeQx0bEr@
zXxHCbfAl6sVq2q1v`}anNsjOmW%5m+?ayLfN_NAYw`(^+t#0372G&@6f0tcmZs0e|
zDjIC7(yAM(l-lxTr}NNkNbHOOlBZP(&@fu8_hNy(-V1%tyU|P&tGwR&t@(Dm0+kI>
z`l<_atJ{KMOfL<EK)qJ#m>iy(jR)G04Q;QRe+?$5tgErS)sLkwQzua6#;r(s;d3!Z
z=kBm-Q62D~$~AUft0mT+Y47H&G<zZ>IopweA4;u2<NmNjRj~!1dkcVOI-ZswZ&j$>
zImh9-kT8fDowy>=s=AgZ#e%T8#_-cH!OXko4uer<T|rsde1Sq+<VCr=HeT0`xn8#1
zf5TfH#3SamQ^XI>jX5CmYc};Zgj=tkPj~|iap*Afw(Az7yXATFxp(m1v-TS|9-Hm1
zsD56~hOP;6fZ%J3g_VUVZX>*NF`EeFBIgu)B{@~VI|HT0{>I%l<>Bwh^&N4$1hX#H
z?IG|5)rVp>lTgaO_^m>F6)~56D7}a>e}uWyCuR9T$=v*1iQBn7*pl6kn}bI(^029T
z%=qipptHu-l7{T=4~BiTQG$Xh6+YXQUDeqX6<~%Jz!K+$r*T6{gvRnArY0zCTU@#?
zk!1iM%TUsfRk3p`0-!EIs#fu1_`SU4V^Ss|x6){P8~^ZQ?(%c2&2-V(^9gbKe~NR-
z)#Fu*+4B>hDgbTp>%}vLp{0_2rwPvHfSE=rB<DkBOX^b<`T`*3dBBh7n7F~ivP(@F
zHlccK;s{1exU;T?N&Nu~0cl7mQo5e0uLEU~iz`_S>92V~xGQFh^K=Af=2&yruSV)q
zLDw>z#nWtxlpJVY5KL}I&hYYFf4~_^DT@nthb6>>L>)R|LRw`#!CCMvc<N|qLL@Gn
z@<f#8L7!r%j}s*RtNyrfI)~GwozXR4=HAX>Crl3ZBCNJIEJ}gRZ$7|a|6|GAUvEU7
zbXu)AE4-dEC?Z9in3x4AFqvFgMw;bOK|R%}*o!|?=SHSQGNBKsvDOY)e_LHm$G|cm
zj4Dx9xdkOMI{kTyP3n)f?FAMg@Bp}VAvlYOoLWk&C4?QHM~=u7e_p%=^S*uOyu1u)
zTytj^=tG^Py{^7fOHXV}l35=Ks+CZ698O(T3<|BEXV6Mq-Wo}EJL9n7vKQ$l9oYKy
zmNiF{0OtUh26onvHGw5Xf4YJ!C_PgOxp#WXtO%YQfr}rO<11wvM_z1Ij8!!g$KALb
zEwxglR@*jHB;%JWlfS7nyBpQQZcHH*3XOX9;md0>1v*{goCvyaI48I-B^@!F`~6to
zj_#N4c{Q2ZnJ@Lh(|g?8UF__x(vpVmf3Bfp(A5>ILAjB<8wnoOf9$gBtPt}NannkC
z@>OXo*v6_TS1gaT=J>h+$SM(-Ll73V1}>y7bS>{R3;F!*Fmytyo*F^|o(UCTors1=
z_YNGv<8aG_?5a@d_ei26Pj(-{i}ECLQ37C2Gp?Na2G&E%(KUE7q;C|Fw$Wo4MCJCb
zSKen?G4FbMJWi$ke`2kzBVKRId~&9b``~%3Zs>4;Rnr)amOMo2%8iE8bw8%vM5-WB
zu!_^GwtO8KPiyiQ@Q37NDtG0oEft3j_QcvzLE$A0q!CLpLWg3>!#6})ZBr}LKs`^G
zl0*i|NiDwc0r5oR-kLk&o>))5dF^b~*(o<Y>TS}Ebd~$pe_3ZYG>a^1@4~KW_f)}Q
z@x+#HM+`PG=s=x>qG4WDZu*Gs%-j~)y>dMm0*2KN^7byIOj*K_p(??3LiTEUV@~kT
z%s3`?fSVQk-v8TfX842PKK9zft-wjV0Y#rt9jk*kVE_z`hRw`yHGsd-q<bgNL$O;s
za<+89AV-3me{;;Tyr`m%?&(KPl>;LN2=X*)k<ufT2+Vq*Sc29g`tvArpLV5Ykhv$`
zC6{tGd=+<=oJikzW&HMceXSaZ3nToXGI2NFM4qg>rM;F$8XyY_UF0^?{ky(Qq0ShM
zHT>dk@=}<jNry^VYh{%<x|lVKE?6243|XD*MC5z&e~1tFVZ%Hb#EO&DwdmkBk3Uq~
z&a(?=$q2f3KEEg`$tgu}HuA43peWyJTCnI~%PKq5P>1D8RGMlT=+v@tDhCL#q1X#y
z^T>b()G0*63l;l%6m>o}X?sY+0~yPr@=5Yz5x*my(b{DbT6B}I5g+wBDuqxSDjweu
z5Ef{{f4V=Hu1F2>_?A1q3OEi8_zJCsq#Jl@W#An$L0YcS=5)!mq5k-Ij&RV~rPMyk
zLd@2Zt+4&%TX8Dcc677LfIM+(BevmiCElss>396L<f%;|43TeG$=_A0HO@~H_`Tbm
zJ*FUC=7^qG$zzsIPL(tGPVyyXgXMJ+PeI$*f0b(6D~U8CiPPtt!MFpllh>HEvDz-s
z+)NSrgFCg!Z1j2%WpDPRyR7Dz<<s_-_C^QLa~kSaH`%%zZV^Z9bkEZxpNe|Y)+akF
z+|7;I+|-+&GP^f*cfQ(PN#5;$2lUv*RU33QOLvX5PkY$9?M_DrpeIE=L9p<gyqzp7
ze_`VxNaA>-yt(6_P4Of}Y8#;zFoH512xo^JkvQ3&r?~QYnni#XoNFRimYipk(^U6I
z;G|;O<0$*+<n|tK6%|~Xs2&TbAf9|g&mU6pco&s{yG0I-niN~vNvUkp3i}SFg&{3i
z`-0Ki8I(-)+OBoR@u{!2WNt?#myb#we`jinPv&fy&Bp|Dszm>UGBHNY3Vad;;x&^+
zAyrD4PAA#lC=03GzU+`W9!1xW1VkC))moq@L%V?A0dt40DLnJ3xHKfu>UbpsuGRXS
zVqamY$b-BGe`S>C%(a1do~EIiD%Ed0zOq&@w&OA<kZa0Sg)60Mz{KdK6RMJ$e-M}4
zC1yNX2kCAz5Jc|ivk5ZV_q?>Umw99fqSvInqvXnv5{QJrr<Dj=mP2)=%s{}JSQQu^
zk!wveqCu86nWWA%mnR4n>9j-;^Pv=Pxsdue?s)vBBSYiO)7CsAab)Q>g9kz_(lLVl
zV^j!8yhAhKYN$v$c}2+Ys}w*Uf18CDxVJi&k^U!X>~r&sc_)r!p+`PK-t)miKG_E}
z88k6^Td&y+{JAF9<JBR#KJ!MLJKFFWRLrjD?iG6Oik@m5@oJAdv#T}GZWhJar=ebK
zIjboUFs#U5tJ=yK{r7ZWb9dJPRm)B9JUa!E38mjvy$MMlO{`?Wr(bFge;FHP|3nW%
z!MZ<5Zb28YIOW)#^Sn|Jde?>fil`QC^N+=tlpre;yrt2V*qH#UE0GC{pl??vuf9x?
z4+Cqi;Bd`4dMQ&?ab;k@vOF+<{0FH=YDJw@x}0HkF@YV4m~$giU=S&OQI?4Q<AanR
z(3h^EpW3v>uy+A4_93B-f830QUn>tCe=IQ9wkTa&H{rBme#4Q6HO^$qOK}yw-3maB
z-RdNR@@>&o7z!~?<shgdiI8#pq~>!~3|ZG^ut;5(it$gwN<+c10L2+d+f86|^0d|(
z|BPZ~jWcJu0r-ANGWH-cw4b|L1B-H&5ZPoFjU-)Hsy1Skjv+5~f9LC!E?9WXKSX}R
zMUMVqCN-C2k~tgPie7wnr=Glh$xsbZm_g73B%~N~+l2)IXg2YdR~!Wd83=144|Wob
z_5}oG2@Epv=d{Qt;}wLpxHjEg1s9c-dj|Y%MO?1jB#o?Y$;*e}RX1TQVB~Gh4v$d*
zd1;R=8NL%Uxdq2Sf5=6bTpc#eQ=%m9o>Xd>ThLVnV_X${vVRDtj$j|$zu(V_zQT#R
z`HC!A55?T@+|%<(<e{|6Y1D=%X7e24K@xsus2SCm{~}?vo)Fdf*kw>ad@!%8f_$D|
zKtY5tjV%{u74DFSo|zkE;#b7}G<4s(*zbz7%EG)8h2PYZe;@-gjNc<KC<B6Z8@pS0
zd?*-Ot*7}Fuw<+b{3qYEUe6&!SSA(~)@WzPU+J+;F3|2>k1+v|K8kn^24_H~t;lUT
z7C1LH;c2B6&<}zQA&-=jP!y;X_fF1GvL@c+1JQH2pPYy+#_99@uhfau_JN|He#_Wr
zOU*vOnM*xpf78xR^N#wrfBm0sL~<eu>6U2=VDSZ~XjxV&HF$Y)BplPsSv>rO5ZiOf
zLd#k`&pKwsG=Y*N>#&^3LxJyhJOmx{fCKyWAVK}M8^fOasevEMm>UZ!71F%HE1B1>
zkHnHsbVi*}^Wh<9#qu9IWv?Y9?S4;l>D5o0q+~Kne?p~PpV}+!@5ksZA5T+N?wim3
zS~HeP-5e&N6%?&&Ie4l;w5yKlOyVVitpU)rr0u$P#zYIzuEBdXfyvv29RiGrx%h`z
zz+PN*R>XZT%2J0Q5e-PAojy+>A|bY;U|A5D*)-Ofv;q;VKL)Ww>0;ZyQrrYtAwv8r
z>Ulu`e~xleo-w$r>J|n%(-?TjC<ct|lEIo+<=Dio)D7qvlKkLsSEjyZUyEYeAF|UA
z+3v-6i^c9Vi^!68tM97av(apq#j+i}KxUXw%JrD7qJ5bU-5K~GLAd1%UiprAWVf00
z#H&p`ft<RBVpOTENLy1n=8h)Q^^hQw&%u%hf3sCz-AkUb&Uc!7s3Lh;RPOxj#UX|E
za_SQ^Y_YCTZ~`2OHR5wmHlfH#ANsD#D(){_<X$c9``-)H#MAX{gkNtfsS2I(>|?Bj
z$Aj3r_6%CAFFDae_=tmi@*W?!S3bhao}6^$zfOX^=Qrc|6{HORjX2MHkC28&1`7TY
ze}dFgA{W*qYEX04Bow>HGkN<GEilG;xxE`n>xWpkMLAHEP9H6U-?HlRtW{Fn6q1zN
zdC#5FmEwV2H|jH|iFMefjt+WRF;zw1DeBWHO^ZbkdU_!i=A;PeD79ijIm#hjAQRwG
z5$Ae-;Gm&SGZ#(~Sc&>26;o#|YC@G{e>KMbn~v5E61|@azA^4v>rx6!yCtqp6eU3F
zU&2X_Th=li4`!tKPQIQXlk60#8KJyAjNUY=slSFko94nULkY+IN0xatBD9%gXRefM
z1$d@pfDq|G>(5v7=eza_3poxXfiGa8#W7$XACCY#!C2|T3F<tV=d@K~jnH-ue;<I!
zq3x!Y+N7RAsyc=&Xyd5irU7KoY+CV%hLw~J38g?=RXlH~KvPYwIeF*TU0d7;Gh^+h
z{>hFe0;&>+9?!C~y3<UU4I~$t$yavYYP_2cn(WfRFvI*wj7!b&;D7NmpqX2;3Go%?
z(d+P5Ka2^qBS{NkG-uwalTo5Xe{tU!q+=B}k8HW3j)2<n(c|TOYSt0W+0!&ic9Uf5
zm2$}_5i~eWKDU;SC51k8BpO^Rt~yMY^WsSeIzN6i)>QQ;dJBMIb+Gb_!8OH+3eFI8
zb*3Wgkv=cR<6I4eMjA8IYUP5#J-Df^5p5Z4ECs{|DY0U(9`BE1bT^ecf3{LuXjbdU
zyTR%meSPEOff_9$O}Vj(snql+@HJzr>mv6Loi&i*UO8O~#-O@qWOr-!5KzB#iJ~%_
zsrdX<L<bq+BeX)lBJvhY%nW0o441HNiv`tNE!q@?gWKn_sB%9)SQKoF+S=-cuOZQR
zx2Zv=j1_RR_cmwvtgpdKfBdxm_HLz5##Mz<FkwahDDz+Xf<pC3BZH*A%$yh4>?0=|
z)x30;G?Ewcaa0a(MI<^X7>H^#h}RUFg3kgp8y%Y$Y1J^J?P_U&E=71k#llM&<IGqh
zndh>s`SMC(Zrk%m625pV1$M>~blf>ptFZ(tV>R*@8Asa_M@a=ge>%_=2*ak!-oFZ0
zmHe-qEg}pXohfCN%Ni24t^S+FZne7$>#SkHeZEF^nA*|hI`9L%TEZRKj8)W92#hSt
zZ+tAFEfk$k$z@4XN7gb%Z+LxEK>k#8BJ`W<9FBW!0eBSDlRb#0bAVtcw2KYXvz#h^
z$)+>IhMK2_VW9a{e;@iu<&Q=3ib|o~BVJ!@n{Mr_c`?7b35~gK;`IGa?E=6!o=A(9
zY8q>$-8db2m`9vs!z(zjMJqL^MMEMr&9g>)8oYs7fDpV6L9i1mxm9fy>Gueb5IZ{`
z@+)w}%7y=L|N4L8>A4{Ol$y&A9>Ngn2*+?|N0CkoG0+6ue?qsZO)VgDG|1b=jW&>;
z^rd_|)FDPWe!4ku#Eg?b8r!bCL`F~9E8`gYYpD!l!Liki*&lX+`GHaI!WZDK!(FIL
zOVpa3x~meaznj#F%0Z>10rMIffV@3`-DiuqgCNU@tJbKd$wUp}t)q3V6f@OwewvLu
z__fU3hVw3je-T#U%vh2;xu-=S!e*JKxxAz@nn}>I(pr2WU~&LP$tEzWaNAc>ujV7G
zTaPfsPqqgBu)03+JS3;Pr)4?tsXbEcO5?0UiibZzt*|$KGIP-VD^L(~`F8z^az58W
z34ocw`h+U+Tb=^<r0jfo6p?+r@z-Iyuw^~y(y+7He-_vh`l0*m<XictBz^s+uiw;8
zDBGb=hpkKn49zd3YvkA?s%}2#Y=yHcefbk7I%=f$!D>@q^!eld#<t;$lBQqnA0Ndn
z$A7Oj{M$Z$xw&09x^&<#|LOQRZaDsXwc+3Q@zc!>#}Ek-6L{2q^Rv}={HAZMY<^Gm
zU8VisfBzOV9<{lN{#<SScYXKU%?+Q8X43bsp1n!lEQh;C%VFF$KHk{&ANua+o7;~3
zg7S`chfFq8_g(Bw)RRC*usfpLm4{)L_!yuT4o`iRx))G-Pasl1)rxvLzjXjtO{xYJ
zQRen1)X=#kq||a0nuXvvi|wZDwgh4y)2F}5e*}kQc-AK&9<lb>y6WGx7btVh39fNu
z(ah-<l51$Y@-r4n_n^rb{oc4SjRA{YvZF1;7g$z3IE@%!ZTf=Hc@}$HB^Zm5X4w^8
zz7i^8QX?I6Ixqaa`rI4%iW2Neg<05_HzI6zs@`~xsZ+}(pp{*@1%x+V6-g!wvmB3j
ze+p8T2Nm*4t}_Yi*qe8Dd`^UGC(|k$%@16&PQx6Fz!&ZTD~m<P)W7Mh#xJ^Iv3wS*
z6M$u=Sv#lY$Wzpd_kKAQ@1+IMe84w^p(WNPC6BaSiVJu76+#J35;?ti>wbPHz$4N7
z(f>j{fbzPoKVRgILRE>+GN$27rssM2f3X;E)?ecc(CDhwf9t*Dfz6(V^cYo?vaoNx
z15;A4SOlsS%CFz<iFrEBO=-~hS}<PRK(#<pbM4jQzBc(@!n%?;!%AE+(sd2iluAyD
zivlbttEG~X{A2Dp@63*q{n`xX#-Erfa#?sdO}7y>7o|h=xkd@*9``uv1C?lqf2tDT
zUcSc;@>q)J__AKEd8=a0H@B~;<fcT)ua7D%HdcD-sx_-T-ARC#q*3763B{SoA>pZM
zhaS9e#?04(IW}Qz^Lx|<XA`St5dBbiM@JTml`KJ$Au1hTx8~&=E$3AUfL2LnLFxXf
zoK({3dPsIS1tREEJ#SH_N4=+Tf07pVi4rRbm6#jUmsZW;jWb{0kpy>~oSEmA`T{rN
z{9`e)6e@9YI|VehmVMQsPs1EC1@WQ;>~Ls%khm+Z7dm2$S(@{SL{d0XG$%Y<aeE4E
zC@G}*SvDU}@N>80q)OT@FBWyXHsUkd4(-VM{5DahJ|T`m=tP)GJiVXfe>>t9E}2LI
z4;qA;lw4E-WShw>A{OLc;FifP&0@Vp@{rW**Oz&KVhTHcT%N@RIH`S@<_O$O0`qJl
zFZM|?4H|E$AF~zE37E)9=Hc)tYY*;T0L<k6IsV^!V50f<9Ok(cj;z>5MF5bKd^O$y
z#D|X&dVs=r>XVQM@urIre|q48%BQL%$ps~G)@gO!C2%v$Mtz&#Kliu79Xk=aa&!R!
z(s<3nHNs4K={E)wmB7Hs%WF@QVB@Szls#*5P3E_Y@^MGWM>WMt5!mV9KDfY4Iun$y
z?lg`ePux5oVfVU~MW#GN9Ri=4M`$VD7=+>FuuDXNpdfE^Mzm=jf2p`B2^)*9${MQB
z1S3_^(W7c9`6Y;__(mqG79q)LQOs0d!D*V5&^yk`jj#3t;Jdb*;@Wt?soGl@%By_2
zz?MT<w@x$Q7m(}}4h!ThdmgeEAbEy{{lR$so4U>}X&&4IVPi=;^qxBfvO2y(<k~T;
zE&}Q&u>_L3k7a;JfA{a{%X=i;&)u7}^_8Ne%3f}>k<Lp05dWuh()L5upt)4{lVpT1
z%F9gA>U9DE&qZy*DB~8)Ra5t!kvwD<nzG`vgfB9wgS6MMU$O=41QgYpL%<#~$RL_h
zc_~>fRW8vy)N)n+wnrrgK~D<Qk&v}1tUZGtFkf^Po%FOqe-leLesEVI;VLbZlEZsC
z0YWz3%DGi~6FbICf>-27F$_33Z0R}UiK;2pw?HqFKU^OZ@9q{q;36ff*982e{<+-g
zhja6T9ldxhxhBY_g@#5mp>Z}$1k_hN>_x4-iuYpS$*yYA%Q}40x5kA5UD^9G8^4Lq
zem9nbko$TPe+6S+$0rb_8XS;s!gc1KQr?4=O!siYhiroONODn3mtd(sc@xrT*F%`Z
zDW?o<#L)9WS61(9E&U*y(C(w`69bCQQ>oq<FU7pn91sR>Cpk1fC-?|i`>hR)GibPd
zsJdmX-fG@>G|7}nmbd8X9SIQ%S)HAEmijJAy*ol)e;mv&w$9|gN??vdHD+Kl&K9nP
z;WDaInN|66T&66n90ZN!k(P!^`?@a}Lk$lN0z#EK|HZ=`RNa%e%*6*#aR0)skh=%_
zNLcH;{`60mNI~pls$!>)sJyA<`rZ<*WiLKlQvSqV=2b(_y_|Yomz65q`k_!NvNKN9
zNZZH_f2GP%d`!6ORfxx6G{fL7v51otT%8L2BLV>nU`3%@<e4}<B|OVi=s+e{l7~jK
zUUVxt4XWc3XGaTz?DSIxh9nrZ`O$(CxAVzW5Fyi#AiI&^uO7JE`orux{DA1)^@~ss
z|AHKFqYtjnn35xPUJaff9_>GUanS$r?ZMI4f3FUXj{4v3A3yv0`RlI+$w@x_Sj@{Q
zF--~SWdI$&`CUKyu5aJfb_f70#G)kI^<0W8N<o0D$sx>RK~yAX0$n-*DYn#`b#O>A
z)tzKZdR{moq7f*lf=LIX4>|J<0mGE~BI{a$f6yqq5mSO<e|R=*LpO_Hwt#{D!H9@F
zfAe7F49zLIx^A#3-`pPSDOi^cmOsqJIuiFP8f*<3EiMBWh{!Vvs+gvzYl2VE%ExsE
z#^p-RP&{o`ZWYalx4yNM#7G>~)b+J=#&#}jj;XqeHqBmRA~vET#8X!<VKWvRK(a0?
zMu;_2OfYZ&?u&QxkE(&DdsF9XuWB;ze}q2$W6hl<j<Am?UY)dBRxZ=1l8KEx52>vv
zcq#w~R2t_fZBPQ3D|5QhxQQOc8wW{SJ$IdYa6U#hVb{dV8-tpBRhCk=<eBbeYq1DH
zoN`hl(QCeUGQn*yB^L#pcqo8zlcjXjaTiKst<RD(qWy>MM#mhrcxANrg*L-Hf1CT6
zrJ69z^J%@dN`k21Ah4hHn2X|vx!Rm2lXxHcSafi&q;HTBnys**d-bAyrMkqt_$fII
z#IEJi3QJwP0vm69>}5=ZWg^jT*l}ELp+1?8SG|mALoNxvmDR12$)4<=amnZ0Mj^{a
zja5bpK_UdJu04($n-6n^5v7j6e~rqi;WS*Rm$11(m;$4jFvSH*YYa;<dCNQ$cvZsq
zDLx`lJzp`jVON+|UimKeVtk<IEOhW}Ig*nsBMG!+N{kYD*YT-VB9Vo;&7#Zb%IQk<
zBtxjd3y<uoBZVZw$0Mvep4f$~LVju6%V`W0=qCWGPP&F6x`7laU9JH}e>S{1Yky{A
zs{PPD-27A5?Oi{PT^(8cc(mX@iNwhkh%inyq8aWRKp__kYSPixc-TB+!7a+kuCH11
zxJtpBh>uuIP<G+x^#zLfc|u;9kzZD6Q5o-1lJ|Dpb=lKdCDPM~WJRrj@1#>_5Kqlz
z-A+DzYD@z@XhIBklDtKNf1hjH^lQGU)#m!UcB|yw(c!DF7ytlRRp*BHT)RPBdn0Qv
zVleWw@8+`nCC;jA<`+4uuAN(*)!p5V&eqR3t80IDyR*9T)9cS_T{ySudbFO^RulY9
zb2A@a1EabQU$)mGN@{ZO>h0mPuMeL00fF;4iT90b(9Mi3d2OV)e+c{zde~|Sf~IT#
zYC1|zms82WBBF}_)t<WQJIN1(u=Da@ymxD95Qr`Zt-q52=$?C=#JF|=(M)0O2F(Tk
z)#eo+BtN?Cug%+<-u?xCYy9fEy-|BfkY6{vW&0KfI&K(N+2h(8_vSgXG)zKlca!by
zPWUvIK#|>nCa(t$f5fYP>{22qpnBI&UN?-efwCSTi7oN(vfR88%yn?$29kP|Uxhf{
z-~uxoji`uc1;Km0M){Vxv&>BpALKbAA{sGVWoPhJ7#>8#FkneK0lyFnOnED@KFbpI
zHOBR=^rkS~S50Q6icuonN=gX^_wU~SZF={M^xhYP2*#q8f5D3wf`9{IZm*kH4O<z6
zz`)jR&AW*Fqh%ipEBKC$39CTyMn(MdK+?5gG`}5q23@01=+<JH)udctX{d8sFsgn9
z3?ky-NO!eKqRPx-(SSfGG4so8PGb>9qZ^a!h-}hWi=oG1J~u4W+t@~use#Y}4c;ma
zFGSl_>)#{~f7d&w6B@_qnG=;uw<m;#I3Io3i_8OIv*so&XBo&cMbb(D;G*~*eQ8&?
zRWlEcBVZZHK%8L493{vP*fT4p0!P5)RZsJxFP2Je8nGicb)#Y&ftyoBsGOXj>&>20
zy8zBKC4Lobo5oW5823UCpiX3{^{K%iYNCXHtwuO6f9D9tk+OESxQeyOKjp5mnyuA5
z8d$vPhRLW$ioAyg&X_#P!g#I)9JLf4)|7cyPfUKxCViSqS5pIuN*FgLR_?XPiS{zg
z&$Ew3IXCo=sMe4>si>|5k0w_ESg(W;@F^(l%4W}ikNQqKK7X$?=0+_>VZ^;`dWwTH
zA<DxFe=q2nYs4yAk~pQJGV~8Eu9Ub6y%HfU-21QNvLN$(1ZucsO?}qDQ|(o?Do*dC
zD5omFT|W<qR*d{)?Z-^(3A@DZL}Yrb9sze=_Ix3f-3oCn6c0%^$tP7DJXGggJRJjl
zXv*x!sh{lJ$jEh<fPb=FYLbCZ2?OjT*~o22e;^U)xg|`fTauJ-Un0NpQ}R*@tzxFP
zO}W^QFnyl{L4}0eZZ;lUlo7mMf4DnvAN=8N<)3GMZS=&0yVbydc|l?^I_~-97Z>5X
zb9@J(#Bc7Ohi{nmI!0vS6Ei!I#QG+i3uuId5K^G=6Q<5`+>wJbO=qRTMwIh95tGj-
ze?i^b<fAzMqp4?+-PNr0vtE-oUaVD@4C`8MU8m;{z0dbSP=PgLHS%R%A`i7V#8;=R
z&C0c86b~x7noHt)eeYs@YRM|K%=+h`Vfw4n9u23;Ev8RE@dGW$@vNYj5l)B#qQ+Db
z5FJh*3B(iOCMM}NfhR1ELt#a4lU*K@e@Qm0l;ff_JTT2c$n3-tgEvYek;B7G9Czth
zCA|d>v$&)%7#Ti25BtDlJW&`=Gs*}iS0IuCoCRD80ZT^X8cv5G=-Ir^624eY^F%VQ
ze1&{X)tOvLD&nP9D*AdNjk<s9<Dotg&iz|)ZDnm<*CgIah@djU^oPED&_A1(f9}$#
z1(sGk#1==3ad|upR6%qAR_g{Qy}pf&WBR^&^Ddc{C73*jE|Om47XUP7Tp1ru^96pB
zx})gEDhO8jLeb)VM%E&OTh<M1=qB>wA+E<;Wp{anMAEVbGF^jfbF(m?XR~E3+3Ib+
zm|yuBM<DttdBjYUC&|g9aX!hef2<bxtwgCq;ZDStfStFqqpoNb2|GKQAYLmm54r)M
zf82Bo^mR%z=4G2oX7RikY!LDm*(ZJ43%oYZl@C`{>+5lmD@X}CMQWo{N1XuuYd$YE
zw<hMWJFd+wCq`#iYS1D<xV|7?grPdIqXTMWDVow9XVyp(j86&ojt;U<f4Ob6i=TNF
z>DC!|>&2w3^@HSIB>mimcu@jkW{m5+oIzHI(QxwY#i3PrWaEzrypDGt^hc8-K4>Ug
zbqW_L>evnu2><QB{||%K;=eg~%`^_7%tk2&>cSc6O-_Vd3Vj-^bm2FBzNjB{xCv)1
zcoqRS%R^6UAB{=f=d}2!e_buuuN0lq7kY+fOQ$<`8vO>+YN%Z&lp`8MlEDH_K|wqB
zrn+g{l^*qXhqC_IHoUlz{h`o7o8e!W^Xl<m(o_Z}sK*K^v8K+2J(Ne;t7}1J;zrS`
z+U8O<97ewuspw;o*#=m7iCehjL|*bfsr~Pc#QU4Du&A?3Z99cif1}R9;oL2DK3{oD
zIjX`~8gHRQdUN>Z;Kkvq1GjHnpLpAw@f8XeJ=ToIsI?+@usWuJbl!?PLicA&pS~g(
zT?=iW_YI2(bqoU1=W9@a3%3{cjQmKb&a3qlHHtX`Rwn@`!o6oDLGHYv`UPETf}3^y
zJWC3{VyX5d<!x$de_%#Y2kBJD)*}wTldd@Aorg&_9+MU=*PkQRDxYff*DhvK2kXSh
z*erU9kR@D)y=1UvRR`V`mJFgb1PL?Yp!UBycy)Y)Pj&~-UhKbnF5j}s3JyF&Uzhr1
z5(xOB<B0R!&CGH{sQ;`o%2no}uG!9V;%xWGv1uGVOfEfqfBG@xS09ThNu)38zd@t6
z<Lmnzxub*CV>_T;5n0EE=Cms?OS>^L5<#vA^>|XPf?(YaakVP}jtFle2GfkS0?8;y
z1IA_Yh{}+=(INA&;Z{;^Eb))A<Dl6_o{w)8`iqkden}|U%9^AmrRK$1{N>&8GwAU}
z8KniEPBPkFf7uZJ!-vl96_4h?)UK-be)e16z4E!bKFcLZP8r1j$Sx}+PE7ayX`rl0
zyEcE~ZTxNe;O>CQYwk;@=O>S3)}HJ=;!-?$T$^Vm;91duHw!e%Zh6Pk8jewW?sRz(
zf1;FmB~~dJ-5^=|$N6-69GMQyRX{ygq1Wb8*pmjZe>UIS$B%FoX(#o&EV`s5RjBZ|
zku^6;fP3=0PZ665!wsNs{5*J3+jPdv0>175Hz`Uja56wb3rQ{@+>kX&1uXVQz*}uQ
z<*2hkJF;Wx)-}%L*$;IIzB?qa51)TZj^MO)|9!1J+%*^FCufk$uKtv~S<cB}a}A4q
zaDBu;e_QZq$U=WoCk;I!VxFV=9KSpiV7FR2y5xm;P`8F?v-dP1gFdNG_EY3eiv3yg
zzPE<J60m1N{!r33EHigD<Hq-lKIoA%m7WYFySBz--U)d1kMyG_`n2Z?Zjugn>u@36
zI{kYzOm%F0ib|tpLS-(AO<@!ICH(c`9&SLpe{BN2z*yxCdl8O6H&p(2t$4p{_4i#Z
zYVT^%d^f5^?@GORSE{?a_1adkdps}&j|Uw@HI#!j5E(Wd>x$PfGe<A>6Y+bURR8kn
z;$J?U|I4TGdt3FDk{^3TsL(n%xLp<2`U0%Bm~yb+I^iTlu6dc^<OI+Z?3U8KebQS*
zf8q?T+l(*#%csjc|A7BqI91>r|FEm#p`cp~7Jq$=$%U$wE%;BS`to0H+dW1Wo%{ql
z1CP5KX+U1mRP(X<(?ORs%=|I>6_NbaQdw(0srBQHvtmxfB7Ki#k}a-SV5<`_kVipZ
zj+8Um%{ENrC{M>WC}+w~c%U>j)cppTf1;|24*2`WB3BtOc|4jp(FGf7P)_@zQ}+eW
z=P|-p|ME%f@qhUQcj&)-g4so9t7NevbDn`-&PznvXJBhS%T<(i+$qI4znGN^mbF<*
zDhrn^pDvy{;~*AvnJ|xtV%<)DzC;>>r!2Et4dyg>5p{BL4Xffq3R_Jv9RiwHf0%*;
zIH;Hh^*2~o5n_Ji8a76#sLQpN+Q-aJ)H8`nmb91(d}8DAHWT~Q$N6hGww5!uinv0B
zaaxhyz!MPQ+uVIS8Z9rDD4Yn}QbFP$xefOud6dStMvoingy==wl$QPbNiOr$qN-y9
z&6mb1-Zt)9ott|FZ~v4$lT2c#f3?<;=^w6n8e@@3?fO{Du0bIXfQy20;x_9tBQ)d7
ze33Dykh^8=ScQ=iRU;~J+`xEo;3N0Qa$0=1q;Pj?Kz|AcgZsCDqUPhiT>sQh@`-p}
z&x;v9cog9h`P-Cu_d?$m<*_pB{h?q5SlvJ3u0=UfWJ)_sEBWA?M^;M^fBqx^OZN@`
z{1^OVLU5UZes5*`q7y`+!utNLMJaD?H41I-No1VyySi+YEKgWWHzW{*Ra+O~i;mK|
zYfU7A*4K9;jm<X}#RNA716Q@F4bi|zyIRv3?P)DM2i4KtHS#mxDck8`1-ui!Hss)Z
z7raK<Z*Piea1T=gN6+n=fAf6Z-L%2;TzhBi8g@d*`-Hs{SXD?i<-5Vk-}MgKMo(xd
ztjV2`Xmu#Yv%E9pytIp{Po7ae1p^1K#67}%8Ksq%M=A@?jq8-&@1`H7L|cvGD)_-t
zKUWyaC_h5I)dE##hAtylGq>kzxdd7y6iUj(4hfuvAFHUkvDG?|e<TnO%YuV6Q*uSq
z&Q=Hy_ZkRm>eQ79yRq`B8xvPvU#1~ZE;wSNqLh<R53<RyuCp2c40@8T-rCJ#jqWX&
zK$``?!j&><I^Nwp@v}7gi~)?({4&{bmZ9wWY_fw=nT!Rt2J3PIo&m&o%#uhSlhd`w
z8rdZce6+k4bEs`8e|MUMVZ}AcNc=PF#TBpGCK=|ZHPy2lgY+j)f1ZoPSsYSR66C%d
z`5Qx{^=M4jT$><Qe{tB=B06KH!%a5LQvrn9*_o4P)OxYABM`2G6SV1$Lis)drEh{6
z2u;VmyLa!#@ng=#mwI?_-rsu6Ws9e?<#19|=V>`l=jCL=f9Xk`Qunc<sU(Y3EWlhj
z<xk}NnyirOIH>`@fB`;M4>ns>)Sy7QcuESRwlGrov<>%`ogJjf<!QDAdy@WqXJ=3O
z4_GWr0E4L3S&BYDkdck7Xavv<rlTYnP!&DP`bq_qlKwKrYeaM(d}<W@s6bh^YF(M(
z_58Y@h=GGEe<y|$IpMLjC;3^*k2*E875a!cQ%`nw%tqbW*=)KhQ2LDkBGP4V+aNF5
z*)thqowou>zhhp6aT@&?!+pgXRMGzS0*1~Ryv^<&Qc^CW>(Z0Sj4ESaA`H(AT9>c&
z;}uBs0&IgLdu`ljcS>f|qd$Q9%Am^G&{fwOw;fQ<e`ikgxPH?YNNADeOz7;4q1eO9
z=!L#UiWLTc0cYfLhzuJy?lfDt+eivQeJx@}PpRJll-h=lAjEt16GZ82Nu!9$f$~K5
z?l~kBwk^485F5hXWhqYX{*T0?fEG|Vizz#`Er4SO>6{L)QoHf}T_ATlagojdS3s!0
z6}v%FG)v!)=YQFm+ZgkhE^1iL=bB<7rWZPDmR5v(e&X7A-#%X~X4T&A?&alW?<`-q
z&wB1XyUO^b&4<Uv@<FdC-6OMd#<b7B8V{w?*h`6`uq#;}41CiI_&^vj*x7L}a$AKW
zf$=MmhExP#t}!11CVXZ0xo5g8s_-*f@<cA066P!<=6}}LB+!MF(+Km(patwVmu`B`
zOD1wF-W7?W77=@l2VID|ZndOc1kWs^LQ-nRaW!rGv*`~Md)E4^7!H9uBEL|tBXYDc
zt-4^itNi#43b=}A^+K&%KdsILEd(zYdkdjI9}a}h8@QySfy?xTS);>15JsXYQ|{t;
zL6nM19)C^R{!L<ER1veFf15&lNoD;g*GK>YIZlISmBmFiOXz{ZmT2mpo9@`oPf#>B
zsfs^O0kt}56z_sv_9kjRdyc>T3ABpcpB=cOh}gho4{aWDP;zmcAVj@RS1UcE#qTBo
zEms;`+yb1IezSn%#H<UIFKk48AbwvJ)6;q8gMYrvlZCs&ygguwtxvwD|B+DdJe%pu
zs0{7Znfs!02*Jk0U5GH;@QQat*TepXB6wPgjR}_^r=At-M^|qp1#hc}NY3hW=vin-
z1QemtAv?87z-TcHY0EOzD`vl+thi?fn|46+!A^2fxa(zZRAt7cFu;r9xDp$dzH*IW
z(0|KII0&sv*Th1(iZDeKYzq7?xbF(D!Z(wnUT=_59#IgUl}03{7R=CTyf>o1K?yi*
zYT(I<D4<k3y%ze5sO9a;Rc*Ob!vf8n8l$#6T82KwsX=fi%CN6%;$A?mT4t(8tZ+zT
z(@&hjCAlwBqKzsXA{o@_<jN}7`+HpO>3^FMGEFNe=YgS-WEqN-VbB)|h*Rfs_>uD@
z)HFd*OHk^p%qB*ua++s26{$PEss0;A6O}x8vr3Qa#`Gl7YKEX9=Y>JEthT=>y7AQ~
zq{`jc?dbt7I$Bg9l!+!kx;4RJw;46DxA4+Rsc~9|uxz!C=&;^PVtwjTZ@`{2`G0pY
zeY+!fHu~y(seCZG3V4#P*%e^Smq--WY_^jcR!9Sn2Qvdkc16vsJWf&spsD$ed^{q&
zRUFNf5qe08J>fK4gkXZ#Z47f0H7rh%r0Q*wG&wCS+Nn$}wolpeS((RNRHo$L+EFCT
zD2%9v$d8(gvF|8YEcW_3eQr+yHh)4#S+(PC6*&PKehDl_vWw|0pDG=Tq5@+db~O*s
z&4^|!Se&{WHkgHUv_yzir8bq!(82_zfofcwnKh(RkZF{cJp^;&^U9Qrwp-F-nkjW=
zL>=Hh*ne{fl$R_!0>KsLM~Jdr_o~^XSj6c4NPbr$laqM;yR{qheUd)W#DCO$G1&!Z
zE8y;h6{ZK`xe1;)(Lobb+G&0DVtzKVo>)dQ@dSyiwhNsd{lPQQmCFTv3~rVt5p}!f
z<7Jmlo-^f;xp>k=TOc>kla;grsvHk~-<M}hCGQv0z8&TG$Vn75Dmm>}5Bk^$gJie%
zxs;*~6fR3ALo%N0aXzCw41Za_y<Sf<R_aqX*o%SV0!)jugKX3ou(M50qNJai%-G<z
z6}66s-5;?L@Z_#$rlM&$n1|?!#S-S&h_1CL^T>)sy#vBdlT*_N@t`)IdpB26=vFft
zBfO&v@-V7g0f*apKAFWZ%)~65<hF6l=Z{2PEgsNQ`o^89l4;$?SAVnoNO=qC^e5=9
zrtlg8oQBnfvS=EUNpq!j&(Xc1mmOp-QpfhxmdzyUeZ>ec_AI#|l+o2G&jct|8FlK$
zT+nHu$-Y^*b}NklY(__JweI-{xaO)L=eZj)bb=@(pK1t7>o#o<_K%PEpM9Nd$C)*5
zk8TeXqQ@8zs0Bf?2Y;fj`sVY9-Q!fD-cm7AJKY8~->&=#nbL>XL|#RK+ku8_9G26v
zHsAaJ=@)Q@$VP-`TP_3RX{Z23N@`wIQ-5@uvJ|>-uJ3HF^&(93MMiC}bssK!$+J7n
zdCZXd-i|hl>zr(&jtJ_v2S>-0z>?`%E*4G;a@xD;`tB=FNq<8xgdmZ3<&LgEKG(JK
z6M_`F<Jb}OW;sx1!yLz$>8SfUU*cVw#<wuM*H{cbq@9KtV(aJ3|M1LUHR0WBJ?OdR
zoJ2k&_s98isQ#k14qCSpOd&9KQJL3$<+gKm<pjjVUNXR}Jew3wwkvw!Y_dE%<Brpd
z3`PbW3`?NE!hf^C%4uy(`9q=06{khW7?5qqtIkcV7SWEilv2-wVMjgmmc|sxIS@g+
zJX0Z6cZt{nT_~65nFZfPX;Cq5Iu=T}yZ%NBf}qv<as?pk+4E;%7^;cSobBL2m*7mv
zl9NV8ndG9}Mu@wU>Ql!oWlYn=0*eV|L{s}y$ROhxa(}(^uJ8EnReB}z7Qys8Jr#D+
zOgIrVdB@|TR4i(tmb`+=ZfVYNIriaO$lIOh)~x)eAKl05B*S7eMRn%+>fP<e$HZ6g
zpl|$u6_G35jTIvj-jPQ;tl1JW4=Gk|_D-~)8Mku_*uwo{oIFleI*bi?H!eL8mCfDA
zdy=6lT7P|u-uB1N#N>?Ar$Eus#{sWgJH=@-KiMkATkn%6iN5fC%Zb%ib2=`v@7wmM
zZw&2sI;JrhvZIVe8P9y}nH_&snE@4<dn{hHJ_R*0)x#2{od*o-H_URS5%2bHIdxWF
zEn~;+zk+FGQU@^ZXN!S~!}y~B(T`hklFee&+JB0Lmgqe$d(fF$s@(;UFzx(}b9YF)
zfejHZKqp+Q5Ba642@4A$Im2k~gf-?X=wjsu8tnQ~B3Vw&ojfHV@gn!<5(*cI3nOD$
zXyAg4<+i{psRSnXFZ(*YLe*d3dG}m&>OW!W6ii?hxyI>%LhFIwasy#Q^LYnCNLUV?
zTz`DH*=Aq?63cRr31~07Qdv7kbLfg)#$M*edk&YZc+f_9P0I}%5s{^iu;#KTtnm5e
zhO(;AxE=40TNNkY;uzYUQ%*&niD>L;@TysNwb31_-&2)<Bc!ue-zPBaveP_d7fPWH
zc0IfclJXc!`ap`wU;&S^pEn*AZlmy+Vt?s7spKY0OPq9f0t8h$WA1Zvp8_X@<~EO`
z@mBj|r*-3QYh^Q}KPezBAudAuTmW1aKi8GZ4HzZRYTmL4@S~VNL)S^%?==P25c$1R
zAW|uXcmRxUO=S+eK$RLUDm<1Ry#mbAiBt>KHVY%wjh$i}fyoO;`UfNW+ByrBE`LfS
z>gbCa=?d;I-6P!w)Q5-2WI|HJJncQZo*nd|&QpzdyH{^KZu*l=uRD-`MJn4O+#|q(
zXKTRHpiw7Ld5zKcl%y@%>`1;|)69*H=qdQAKW87@g_YDZg*&0aA<#vt;%xfRSI_1K
zIV3gEXsNaDeY47e5IfJ+DXvH=IDbI&U|j`}UN~UpW8ukx!Rl0-V&Tlp*}SCHZ@D6q
z;1iQ`+EyOu1fY9Jfg^f%5^(qYj%@?gdq7tdHdP~0HBRGNI<ss-MOY9@9um!R)%pII
z9`f6J;LB-4!r*fB(YC?<i{pd0gGfB7=Fi?TmQhPTc<8n+ve%*?XygLs9)H?Oj)4#@
z-or(*|NMFK?DdOxFJEDX1|2zzKy8+8$vi%k(<Uq2Hpy#5w{C4Ixf*iRE_#3RSs-1O
z3molPeGnZHP2bj;d?1xjmTMS3aXm6a2>HBW6!#(*)36*vehFn8vx4ZaAGw`-QPNH`
zAa%xuf!+8J=o-?scW+;GV}Fqs#uTYzDtJyUyeiKM=Z&w6JB_gn&Pso?LI=~@)AryL
zj<-QVg#fO8Pd!+2rMlE7%!G@TT-f{#yIDKOt6lR%R4?)nGpGloh(V?T;M9b-(_Kqw
zuc{~Fm$4qlD+>_3u4luXJ0&7D@uB#$Y}QL;Q~^J(kD(0qVqDfHx__y0l-+<6T5l5C
z*yF-oV(a`Fcz!$CKT2k24_k)Kxg!{yv$I}+di?h5gSQ7s&}aAdjt^ftyLSKO8>h%m
z%gc5r{wPfjU%BJ-&HjtzcggepKP!r*`3G#}3>Yf77nn-|-a4Hfr_3VY-OpylAa*@;
z_HM!Db{!m|p&vez{ePf_7fA|It6n0Wyq4>EUB)2&p#2_>_l&LVang=)`J6^^B&Jg*
z`QsmxyB-M;8aWflPu{~&dhfo#329I0q;uEW<K*7M<RSn4>tC~%_RBoL5^}=Y1M^Nm
zVn>{hJ>Cay$J1Y7bNELZVUK}^c$WY8U;FgEJid4L?f{^Ie}CsJv-W>+@932uI=ss-
zDS-|U0&NfUpkwXkIdXiQB>L44cwBU>AEgoL=}?FeY>?7rJd1v|{oD9hZ{mcL+XRmv
zKThs;oXMSMAMgMz7x<!Z3CWYf<<M@=JIUiG$-L)G)hD_PKr{TiA6smezpS?^T~2;b
zGZh(Pce`c+Ykw2TkM0C)#8z}YQlQ2V$%>-^@kW)Hz;@S0agoie({NAqq>QvUy>cIR
zdIW0R{+H=?r}cL+5+%3gV^mF@_h1XVX=t{FDd;p2AuHQ?(geO<GyG_hY$7lLil*^G
z?%OqourEZCAq|MUoZd4}&KU2JzgC!i)@0r&@}gg;f`1pp*;>`+b62x-tq6nHEqL5|
z$r0`^Ufx~*z;;!41%_C!dI1>*RmOGzV^*xYcJjz|@Pl6^hAhM%RV}V2mYcucV<5b4
z_(SzIe|0qkt%RcbuA2kz-mE!??t}%rQx~$u1%)i8$^XHv*pft&$)cyOs-A`_dO#LJ
zjWHsc`hSZsGp&}hKvYQYwcu{L$uZU9Q`+9+sHrw0mi^^?@_6euqH?RlhRlieo_~qC
zC@~LtMbE;I?X6w77^|(Wlx<g!f7qgs-P%j;b(1X-vF?xiU;L;;vG#kQeVmTlk)upr
zvc^Bwk@1m&NiUGlmLBabJK9?mZCkQgw)U)zAAhBdH4(hFZ)@wiBM~-;9Eh!M_}#xu
zw?vHLo8EYNF{>b<>R!8EKE*t@JMu%BYA@zCd;6k(2cL|}w$`R8aFUJpKqsCG`Nvuj
z7e?0*a6eUqHK*$)0T!P3`r1zyU(J_$;Z>s|Ju97{&MG)k-&InQTe;R~k<!E`|MN<L
zx_`U8;A*Sf#yYRne1{OTW%p`O`Qe80bq!#^1ReV<0*&oJegX+ws&?F7K%|oen%$^s
zsa|cQ2Efrjy$E_aeZK-285e$=sUjXuL^LzPEKH|4xZS?>@I4%6&P2Ft-zOvdfZAvR
zXUGpbH8{giedT2Jz?dLpc0UYij}F)r<9{$1xQ2c;x2?nB3FlH(NxcIWBcLE6(Loj^
zDiaM;7<$W~tjB2NjMImi6;)2h@l)Iyuz?iGmbb_}|BK)@D{LAXZi{S0e)^>uJ@<OQ
z`^|5AccnSg^)K?Of~2GAsr*p{a+Zl0_)YjwNg=IaKRi#|9n#AqW^fku34HFrQhyl~
zB%s=bXMTU>Cm5e1)KP$7TqWv8?1GjEVpntT-M5)waC#_PnH|}?nsp&*!-Jy-ulaYo
zdhmFQ`+iHpKMEwykG7K^2gD|da>vY<0jzMh5YHuaCL7xGqncCFG;U(TF$^5V|CB>l
z<z$|LYpX3Wb0q~Hmz_AQ5V>3|?SBGC)xH1R!g?#d&0JC?73hYY!|g&AP;t0Pi<M?>
zp$O|Q^gav)Zb|_h<U$A>6-*CM_jPcmr4jR>_Eg@iA<9&DNX=;*`Mq&BJj9JE1qkT*
zg`0hC_;jA<NWGXz=qFaJdLbi@+(*^VO^3VCR<5IMIud>+6bmqj>B;Rf1b^`vka3$O
z$lslvi+Wo-J46r=H;^SnsQ4N@dwZ~de2~1{fA;qEAc@Q4<C;0ZMkQcin~>eQfgKlZ
zTem96s@HV!WWR|ZAVSoaXbT{L%Au%Ge~$s{VL9f}v`)T$>$JN!FZQ4L{!$+h;_i0k
zq+7;<x556Axbg;dfG7Bbgnz9Vb^o;=YrY2}d55o#j`v@@80-#SyxxC~PmT_b@gMEQ
z@xjYC);thqjpq=_hLZK_(=QbMfO*U}VjmcFt6xY7+6uaUsDHH(pX3I~tU>C@Yy7WM
zDao%f{pfDnFq;e>^~c4>HfklhZhuWC^o;G%irznR`qs1kql4tzuYV6-B}1pS-A#`1
zPygV-izA?&?7A-xUOjgP^`<w?oJ2%u0JVjSY=Xw!p>$%qeedpFr}Oxp#1D0o`<-jr
ztSHU;INR-NK62uk&2ph!&+GaWa~=EigW=&$^5XF2;c+rmP3dsD9+?gwZvA@8a}_#i
zgQ6Q@=iJ$e&+rv0Q-369im)imb8=hs6n;%e%G~x2g8fARku#_YOUxNTCX0OClTfOx
zd3;p4$7NGT<hEUZsz~lK%$3$^Z1slrwXzk{ySXqLQr@Hxi$YoIF6FV^;!}l?ke+TU
z%m?Fw=NXA?ZEF)KFhw4Ky5BT+D-%UiJJ4#qD%BFCmo}y<oPRQ#{<Js~+=cp)i8_w#
zvNKc|&2u{y^vCi*Fka&MP6gvv>tlt6PjI^h>CsJJf%M^hApvH!f*nkT;l(<aY(uJ~
zL3cxHw$%FDA_<J}h$4O9_WdAHH!=twbej*f3`jsrJTSUnUShFYdhfjaSnyU0)4w9l
z_=9uJPZamN|9`T#)~3<p;Sb&%z^ecRCMz;eQZ}D0z1b%x7%`-9f`z&h3FqQMj!z^h
zQ+k5ty4_{D@LjV@UIr<N9EOzDn%xAez{|vmvkw^wvEACrk%<qA%?w4VkEXbRi;(p-
zB_5v^j?FN=-6$p<NNcq=g};PyQZlsVQ6CBXt|W0jg@0a_ybh7dQzTfrQYhcJaI?uJ
z5-2VUwJLD!@izrHJcwbY*e<d;pwS`Sd5%Ij1-%Vh2btQ@zHyeGz{e424V5}b#g?2@
zJh10`C0&PNfi3M1(_Dp3*LW)YYgT?B?T~l4CCo@l|24_KNBm7QZ}_wa*%4R@)t@;{
zF>-B;z<(o%qmrUQ;oaW;w}1Vg+Z_Si(~Q$92Vu;YMkO#}!umQmq0<N>h?qt!w^$1j
zBn2OU33AizwKELdFm?0=3`Aa3IR$|%CHi$<N{lp!2I!WRfTpUXXBCP;B{7hQA)C!L
zGGSR4yMZcGbpsJJO8LT~=KB6Grta6+Urdn+dVh=G)Y6YI99s7_w_bW)<(kcFJT0-F
z2<;zN6-RhhEK<Z?w0ebViA^0(u@<M%VIg@vX42XidEZGGz6Lq+HsG+@qrzY;X1(rR
z3|)#&>ycnFDAsKZn{#;k?DSJGiQY&x7*k6OqL_kFLf{%9lS>XDM(CpH_$#-47K?Dk
ztAC@NXBfm32E2Zi!^vN%a@P_UBXCFis$Jbq%8=<K*d;WRv-8DePFR1XYf|Rk7@d1x
zxXk8Cqk^rmw{p3zQ)*Z4XI#4wVMbq!3<0sQw4Tu;g%j|JjA({%FM7IWrPKN-Yf|5f
z9u}Lc0y0emamMIIZKWpVa!fKLk!*7zR)4Y_ak%EWYmu7i<Am9eh~RjqRL0aj80_aI
zqV?=R{{76!67k}**lGY(xgOBnw^<c~+8O4vzD%a*HkJ?qxfQ?O(<2a3O<vz?I0)O{
z?7w(-02RF*baa24-@Ds|UpUt2(|eud(G&L{(cxwM+xCmS@GK5LQH0#ccJFR?M1RZo
zPrA>N^20V1e)@Jdz5X|R-TmGd8{Q}EK;JFP1^hj$ui5Yp=ppyI$pg0j;6d-fgIfFU
z>pfi?Hv)d|o1TF@N?UDFfmyWu#=k)~sbU0IyTtSF^EtHjDzet<H}ZN7rfZ%D`Y3Z$
z;UA;?E0^;AY3)wO8PbZwx=`+tO@AwwTKUY#b7$r!X&z}XPp?-=sEd@A)@H&qjM-R=
zbSp>b0bWgZ;wg2CDi4|!A&L$`0L41Q^r)QqWE3s+=f=}9SO<E{nJT_#(WI|u-80wf
zT%8V4-Dp*#`wckL(S60qy<qWj?4Jip4i2Qg&FXDplOFmItK*Qq?z?k~vVZztBF7_$
zj=tc~kT}<4^qum7-S`21;iC%SSlKaW8VDclOH$ZPvIGAwep7yEy?b@|`c<<3;)QP>
zM~n8nTWRnY`a}9y&Y&JHuPUEt#lwyBD9@$QbRvecezXJid3tqT5PPKHs2D3BbXAX2
ze<MIWP-`?*L*1EfD<i0Jk$;1MNHi<efzd1*!o{yM5N1-ubN}+9FZxt(W$hBlu6gzP
z*iEL+%zkuD`2;?_`Iv@gsfmS;3*Z_hLj}wxs#V<PeyRcnk?_&UVL`$Lt8bR`Q>tg>
zbRFeFRPM&xEutGUJ;}XZl3_HL_IXiJwTM+9NkzBRZ!y53nFWSwrGMD+J}|YZ7%YM4
zL#acTyb-pnNVUua>_9w#yONJauZ!6Au$T#@h;#?P>6q>uD_m2jtbauPk91T0IdGpk
z{c0gk)aHgUTU3t^;dfNR#NdHL0vHo9odJLp!0ZzF&GFtLu%JX7{9VBQMT4RfRDBb`
z6`Eb8)O)l~)Nz;^(|=12wH|81T&CblhW~}pl*&`d!B38X9!}SSdIhywNC6ZHUdjVS
z5Bk6VNAmyszg{Wqv5-uVeq9K)oK&V>WV^$e^Vu+;#B86Q|5F?|0AksqjqYB(C8*|V
zia68jNMJtf;xP2rb5f*)>7oKZgYpEpMPHCb#)JI^7Ayx-tbg6^UfWt}I0mWUNIf`8
zA7+Fb6Aq@ZAv9koP$i*)qW)4)BK((=<C+IpFPp|53a_*;`tpUm_BKu6Wf9fp@f@x)
zf-$Jd6YZY5TX}&;nOM%!`JjT>C{g!eUIM{Hq8zFj2Gy#wTZ<<miW!+_bnh?aaGSY#
zG!H#IBQ+5!WPfx6kyk0Wi+ag3Md5IEZESVcp@a2>O63y2gr!!$S6VLCS?M8)N~4Wm
zvf<FwOUAfPg*jO{?6jOO?83Sl*I6}prH8>*dFDhqIEI*<H|Qn%WdCS?eSG|;W57Zf
zF!MzqwY}crm8m_rTLnzeJUKXn2CX~K8*VJB(-QhK_kVzf{6eBR6twy1y!fbGDPGl!
zg$b$>su&vD+k)O|Z-?;w2u5)8#Hq8?tr+QvVv)PTWpMv)-+$T159;7LlX99@t7>jA
z{dJq-my)M{apA5lr<icKAr@HERDOO?u+iL_H#7rlu|tZR&#mmvj#0$AD=fmG_*`r*
zP4E`yTYm#txnAkzdVvx-c>75DH!Gd2arbQE>?5Yp(z(^-uWJJd;-vO__^U@B8U>)|
zdFmfX`9O+(j)!UL!Qj)Vb0~m342nx!oG&9XkiV`J@d|dMxA!fFe}{OIJKS`>_`qX?
z@K;vi9_NM!1f(iPbT`0`Zonu*MaaHeEqTw5aDR2=5g_Y&PVG?4uJJ?Vgl^K%P~a@6
z(1@RtgLm%<Jb2UX1^uWsi~`NR$qUMFtYCYE;iiZ}tKx?C#EB0H@NwenlLQgC06gq!
zC7a-Vbb6a?quV4;f#`tgQ~aP`jM+$3fW#-FO!#^`w1CEwkO*(hxRts9v{zT+eN2Ft
z0Ds4L(o+x*QQ^b)dwX#4IdiAR<Q@pu!;<Z+#-gQz-Q?)txSPa5=YRXx|B1XhiS98?
zWlG#QaT{r2&tNA)q=SP>O&%-znMSEmSaWu|elE&ssEO*<=&`X~+T1tIt)NmFGJ84-
zn9YL4iucfL5s_ZSSY6`)o>_>(jszBhseiF@(DlKaaJ-8=yeq+ehvMcX;u%wD7h3Yn
zvmgLmmc1`GuN42LQvACxYeS26vo*zm(Le-}k$?|H4Bk0_ffu3jYW0icB1^7PnBH~~
zI*3odCP0OU?Lj`0`7D(3RX}&t{9ty|<Vpz541C8m#W<9%vN(ga7R749>gYg%#DAdZ
zf-9Ry6Jm^Th)9)+G+fz5GY&8=zoMzzhIQ5%)cFVb^~f1{r>999r=l~Ey)bAVn&go^
zIOsf-@*^@P#i~%lx@}~aXb)q*^PqYlDOrPP01U<u;)>~Z%sm?**Gg^IFKJNuU8iME
zil`#+gMK1$7q7_0SY8D_ZWLwRB!AT{2<R80p1(!=PI3vbAti0<WDWTHy4HDxhWc1O
z*C9!;`-CjeI!6DDQ#W@|@U|#?n%j<CXz<ipRuWy6lOzpiRPYNb%TH>akG*8DE%aZ%
zOYeTMjl4<7W+0+OpC8|UfUktQCVcnp{omnZVX_f^B>NFQS7saBC9kK-(|;~^gC7XP
zSB%5>G^poJ$PRV~zJ_U_afoS##n!F5Kw@|(bE-``A$G*EFK-)?rJC+wL<4+mT-A0v
z&9aZ31t=7)r5f`J)a|Z?i<wCir=w<bVPbRgfj?n<UJ@wd32r}HRDDp8bOsi{6?DA-
zRcf)%8bGr$GK%nTTudRNj(?7&v6zf@``*vE!DXSFx3+$I<F);hZ|&N|g@@s+j8@n)
zW=0P$s?NYWNCt~)(6E|>2}$h>rijcXl(Hb)f?L_z!Syco{JSN~c_m)2J4*u56Q3X=
zy4=vshPxozT9sXTqD6`a0nhQJ^xjt1tg?=zP0EVOhN2S*F>5ftXMcu7<LRK16C>JK
zD_^ucnU#}nr+NGawEtH^Ri90rT~Lg82TG$lb8hRMxuZ7i>{%%h_>RGLNJ=W+_Xu)0
zdy`QG{)l6BGyGSLF3$Bz3j~M}Bt35Oot<gvG+(iKDX)roLoVPXpbBtFqGYBA%QVI(
zGR0EqNi`Hj+}nCmJ%5OvT#za~fE%urEb+3-mGhNQKzmB-4d+EDO?DqqlX#Mxh=%b#
zIq@`B4K~_3XRPTfzRdsjuktUj(suyZf*0%2=w8=prtZZjHF~V~@e5HTZ$G^KJ6*HM
zT7oU**CM?Z*|ltd*v<A%f^ZwTyH?f<^eXZ)2*)~Z_C<4yH-C5OmjAnx1k$l2uSSUO
zpCi@T&}-mbZmfmo>3SJ$De94-StIs(=yM6EBdL3<oz=4AG=0OvzIjd0?13sI^s8rA
zAX4bx(Si(To2tp?`slPjlG$To>ErdPu_^zcd`{dM*_o>GC~{$kEZRFeS|o2w3i5NI
z2&+5>y+@(aet%lssdOkZWaY(ie$YyWsM8AI)xp}EPG{=XcI6QbhWWzj6w0>|atA>K
z9IMUoF!hDcU0Y6lNPf-a;e)rw?o4C+5x1NUomu1<_;SXOWf;F}dZ3T8c1g)xgMUot
zfsyF^l<C5p#*V&A8SV5%PQttPxlQmos3pb4#ZqRBX@7V~Ca-E1RwF~6*U_?4{2o^8
z@D;MBt*9?)`!|QcvF6Mdr*ea#&lK*xPGepIjD~bO78B?<=`ZANGxf=<A#&LT7)JM@
zxp=^x#FLJ|0h|y~v+zHR#`jbGGp(F8J-JG4ccfz{<fn81+sv*=phs&(&=Z(_7ek^D
zYo6?t$A4<E$N?PE3bB^as-ctEyK-caqfI$>(}s#pzYWABC9^Y?Yw1~69x#9Yn($l|
zpsOR&C8AX`)x-`4`qUOk>yF~9mdxU+y9nBfcC8cKoFX^LD{vly+i$FlD(tB4MB;Hz
z(^UhWrn-xf*7N-Ni-s2tJ2ChaviLw<W>uX&4u23+-qoPqIp!Bf=%1nV#EtB&+qVzB
zgIh=XQZ9%U9N#-KuC(z*8gWlTF=-Oh6;(vo2WzSa9GMF@QS0zIcXnzDKfTF%Qw=;4
zXnP>SC9=1=CLZdaAviGTsA+IkC^SkXiQmdpxq?0{sb2G8v5-70RL`mxeBI2{*f&=u
zAb&BAPIVy1TR{s1gIo5(Q)OZ>a|>~(M!1(;xD8#T!C-OQ1(D3b%Y(OHIqB?y8WEGa
zL_P|%a^~Gds7eJ3qTmo^^jZrNg_Ftd&eR*{a{zkyIFIX=+mC6(DeE?8G0j4`hvcTx
z&ZwGDzLs+-D4FR`-|f9?vP@R8Nfu{rUw>TDHL~7k+OXeNl_a*KZS<KDUfsgcYQ9aP
z?i_x}6o`X=K0G?c_q}>^2`ZJxnVUuTlP*|2&dYIfeDKf5nu4A@KX`Wda{op9-tSQ<
z(n76>>-V35N`#caaLD&0G?fecjog$0<%QQj*}BzhD2~QnOK$nZY{*9UM8`)5AAcvm
z@-w)%hwi$bh+Y6(l-H|2_E{s5|2Q6|yNQ<<ZLw!N-iWO&+o}T^4Xo))>#Mh~-@Qqm
z{uwpu_ch(*m7ADk@T*ujU_aNaQ&HA_o~sE)ocA`3WkVNJf3V{{<{6MJ8t8+{gSx9#
zY`LPcRzy8nlqhP14~DXG9bsA_-hYqOdoxcBY<$(9*GOxnYe-Ll9`vEmEk|?M^i|r6
zi6(6cdXbTUJPJMC;!D5OINli{*p@RA3cb~!=w1Zx%q$nLp?WgkapV32m@s|co#3Ys
zC%gvP%>fTP*E=Ilnt*!5m3J53O+b5vl)2Q{S8n=IK83F0C8Hh3NTAj@QGWyIzTQpb
zV~w;Q>^Aqip`ibVEWVS^zzJ`zqf~W4n|Z|myRAp8Ug$)+k9;sg?*$1vR7!YBWryL$
zZBcQwWUN+u8C`u&4qPxxC{9GFwv&^0GaIoH0=UUu>W8WSup>#<?ihY3W?={QlEX*`
zDk5Y<U)%ymFE2Xf>|7C`%zwG*NKTRad#}zm6lXxztH_N64QENNKPqJ>bs`yR?Lr46
zA9OrKV!IZx$MqS0?#Y9q-+MZtz#$XJWh}X19dXPWggQi6tS}my^oX#LX<V)eGb^f=
zs4|J%luisBo(81E8h#6W+GbUag!z$9FTc}$b#lBp#NXj*&lk#z>3_{-Tw@EANC`$X
z^WTiAMgvYzKm`f28Mbx$M69@WBbmw=v+pmHMBHEoPHW<9?CbzIKZ*<|+4o3EkeRNB
zoc(DZp%!Ht%qO3ZtY4r@O0ed;3VUMbyu3uR!y2DN&zT&)m%BFMEaVrrrMcu+lys&l
zw4L?5q?ep^S>V>QD1VhPz#us^202|xmSBJ1xvooJamwP(vWIIz?18wg8;9GiNRrM}
zMia*Yt@E=aTtvNwdJ+VXnE=;~XOggj*0YCxkd3Dnb?=PD7cWaQj)_|8Awp|_qp`oF
z&6B`SZOztlu6jUIXIeI<&dp|cPd)hg$s8~kh37sF-zrLIGk+YWFRG_e5W2V-4R5?T
z_E&w1oj>(2>aVSRhcF{QNacg3nN_IIYGv~pfy2tiA|^oZtcSEY^Lgmo%%4X09$>zI
zN>s<-1N*LZdXN1FH9W%W!#UA!46bxhI8k6qaKI?^xfKKNQ}WWotjq6_YDK<h3Bkt`
z8u&J3qiVK;&wqMq9!h_KdDp8X0~XWMas`*!-DC5zs+e>jt8Xy{*?{~4OyBB)D-j5Y
zPJ@?Xn)B@*cM5~K1f%K;x(;`C8hl7{ufn0mR74ETH7=>0TC>(=Su8)53!U}j)3H9d
z-Wf?pq|<E#8C>D!eF})*n9TI6wC<WXCUWW^QBq8@w|}5f=;l<F2(3fjzazDxJHd}F
zJ#dQ4>8h7FLUKn?W^qZ`G!2NX^h%1Cm2_b;UI9841xHrS_Y2s~Tr7}ibi8h?Z)JJC
zP5BTR8h~DiT)HUrPs5OORkW<E!AZjV{sI!6oxdn0qfbD}yR`yY*_;3LZvVyMmw(21
z`jUa)?tdh&zd3lDwBPK%Jw7}}b%wL|#Nqn-?Q{2y`!k?<I?MU!8N!|S29hB&FdK1T
z`K{0hA|I;Lx#%?wKK00J>dy99QZM{LBrlO0P0b`xGC;px?gjUB-rMHP&4Vkqql~gF
z0Z8vB8+)*4dN!k)QWm<|g$%rHh8r!fM?-k>Qh&`fp3PBEWIqR5IRac`LrMVT_Ehdj
zC%<#44-;0gVgb#bs+RrS<`9TKm23h5&=t4466)lFm+mI*(%Bcu06y!1(ddlIvng#l
zH;-8*d3kl?d3-;X$B3f|u-Kq;OV5zgDJNH8+o5|Xh}q3TKm5Wih5v=V*N<9ahLq$G
z<bU<TC3n=^7Djr)`WwQ(VkKFxaXt9|rKy1u&mq7<_9bNj@P4I>HLr>v?ZfC+@h-ne
z#8|Tc{H8O0Av#*UZ71U_szp<Bz)kLi0(?`FsU>@z;XDMQ)%*Xjwv$CUP_hN8{IqFv
z(Wss&&^x`w?msV87u`fuKj6#ykmv&_S$`q(#r>r+sR(T2!+gX%@Y7SJUya%T0MyzR
zaD8TQ`M@uoJ0tmFGI;gw#fyQHHG)lm^CC?ZRbOY5jXiz+`o+QiEB<>iU*>^U0A!K1
zlMEdNv+Pu)*SApQX*JX|O~YmHsNu$nk8H9#bV@!ssCbFc8N*D0Q&vUT@wVGdyMIL7
zv_XiBkM1)#?p|Y>yS>IjJW_VAk!h<Uf=tmCad}Wh-XlyM(jr2tffE-5X#*%w#=;-3
z@M*n$d(b#?0~+arTCBd&y(|oQTvXV2**r?s_ihfDzX;CQIk06B@#s4)l!K=WbsOxN
zI>D=*z-QV3@}O0;`VJsXkGxgd3xAs-Qt*c2QX?15!YKmKcB^%uIxLB9t9t)q&58R;
zi~e*q#w(Ws`c|#E657#GV46y_pWS9Zb=FxvP{O%rg`J>ysQ+Zvr+nq-^I?rFHiOmM
z=n!(w1%&^hd~Y51L)75HT~&8*VM%dBRdZOiL!3v=KjybmTjFMwRnhUH3V$UGnCVIZ
zT4m)K${5~>c18p|pmgWwY*{X)TW+;dK(ED1Mx)kvhN(q^8GecxM>(8RuOurYhz>NG
ziSk}r_Fql5_{g?WGhev2wix?Tm>=x7%5UW@smAv#Ig<0U_qlgyd?Q+4Zg;`e%lzF1
zwXP{cCq^iIbxzvGpawi#v48M7fl1Ma#q5q+y}ee%ZtAUnx9MurYdKMK!tqt96VSl<
zgD8;V6ezZpK*_+->CLP9%sG*{+Z;!iKZKXjuOF+Ms1q?|F?FwSl9-<KX4SWGl$nM0
zLZC6t*5=fB6;iHzsRhJ|lN`>KiIw6izm=k$*;PJYH6MVPQqQzR8GoKaV4UT~#w`Bn
zVo~c<(4u|!ddWM&jfi|KrXQr}?lgD(g4H%AR*wa)ub<w5*gN&{gVns8o_T_|L1WCt
zX%tNjIHNL{xbtFKqfB!eDusgQN+KUDVJ+vE*?gRG8W&)&+zZ5x9`jXH=21B((=v0a
ziTvbd9Bl7=<?4J$Zht%tD@;uRJ@ZoI3l~x-Dz^+PWpI(?O7lbqj@dxR^aNcYkDcDg
z6XwCX?tRP=+0e5=*V=TPMqh#&+qkX82pSrSpP0j@Xrw{C!p}S2Z($#&n(XDzl{<+v
z2s5(Pu<HI&6Fj_2#||xb%VoG-1YiOD>?OidKTD?FWIt%a?SE~Ihttu*9{(HxS@uHa
zZ`rflU;UJ3uE#DL_h=&k@WcJreIxJdW6o=KfOI1%Tl+_^zfAt|_2H|g08YlPQD<J4
zy~t7JF8nd*3HDz-uXP}Kf-l0Is8ahG%U5v8Rn$$tZ8)X&R^3m(j-<i{S5(@#eWUxD
zZueMdOFX8^=YJ7nlt4<hGxKq15s5+htQ4tsLM(1oP*%&+)8c#Ss=mh5`MTV++ItQD
z6xBMiD55gNxoBov`kGhC>Zt21a_iTU0DZQV4$hChQms=*iAbKXzc(nIoM?Dza7>%S
zU4l(Z|B2>zV8W|WIg?ayJCD@R+VRSWr)ePmq&C5VJAVUpX#jD83UAdMsIy2$%ZueC
zay11aV^9f&>@ziH;as*TQuHyrZ5OaPH0<azwj}KAWTe$_b<O#xu}-~xH3{7|hA)B~
znBM75%b*5tD2~mYowp2;?(9gsGN2Gp59#t2lC@W41bbsG;;kf4PSMF2&ae`%mGczU
zd0BhzrhgDnPi2v}2*9qKPw)L-lxJs?XpA~l+f_6h#_q)!N!z#83FuDqa*;>a=PaKw
zv~4Yd*4hkCy=%S6Brm>)8zbyWjtJelmgl3<b=lrPh-PG96{yS2huhS)E*<j0Pqez!
zx97fgHu7X#PiOWJBSljgGOUNqDHl~&>-))3Tz`xJ#3`jV3qks*nh+6&in0OW!K|>k
zyO(QKS=#z7a$4j;&829r2E(Qney3zOhk!>xa$NuX*^xS{+mZ4K=rwYtzwz3K&)`t)
z!<kcxIAYmza5WXRqGVG>f{CVp#xTgZidWuMWf0DiQw$~%v)1C`&X5Ta3kgw!1VblA
zB7aFTBM~!FFp!G|<8)9j+|gR!{o|zl&B5Cv__rTFNq%#`1A#dQy)gE>6{PCxtyNO_
znJUT@n-w>aB;1hCPRc0V35u)7c}68veq@;yi9qGgxGn}1udz)=DNYRBX)G2kszFA#
zt--(Jf1E}?rh@4HIh;ryh0)G;Ll%gl=zlYS08fpR>~LF^QzI=yx1FUx_a%d0*^~t1
zPW>k=psbIWX^jb=cEqX&bGMpfjmFg!u=`mykz9K8d&}Nk&0T5EEBydo66#2I(6gO{
zMv6-R&pAro@vr=g<D!}oi+)UJCyA-2{tWAt2lW{{!Hu&UB%7wB)P2G$75_*IGJk)i
z_E&B@sTOLyiprJsNeZ+WrAO8`kH5~sU&^6e91=kU{EXrfVRQzN6Yk5Moz>|!alTix
z{ToAX4<7L!Pm+H~9!2-}lYwHa*CXXVtmT_=b9@p>__gJ)ovtrJDQ8!PafIHWSF~1$
z?5J1$ND^;?uyd+VCM64!xip#-vwvaf3`-&at&UvP3+5o{-btg4;N}$Fv?28U@A~|m
z;O+dBR)N1m8RR74B@~-2N+Mnqz$UXGFEWbcLay@sk6S#J5y`cmTT0JL5>bTs6<z|}
z;8UfScA^kmOHyY8=M6CzyW)hWaDcau=Y7x&=FhWBGl%{mdGMR$|NH-m)_>ZU?EYpT
zLRTW2lC=phkGYnz0BBidm)ONlNJ1(H$mJPo?sOF;;MYVI4TkE9Z!GF%LsmWbO(&$f
zGC)uP_YamNjjlrlwH-Uf{_IRx-XU%*Og}3^Tv1~en5Zgt8DjMU3c{T6I}IZS_Kac4
z`N&60fkRIdRw-|g0fspmYk#%DdrgmcFL~vZk=hg1N>#7K7fe;Fc9*Jn&BjAI;LIZa
zYU7aeW18v)meefB6I>6n{nc25D@#U9N53!nR`CQ!u!`U)`&KzxR*#n4DG@}%$D%4&
z=QWLFrXsw?)T1H0bN|gDbd6l@VI;PO(tp)Ldr>NFbZ|KrOQCQvz<*hH3bvz*a}VCH
zf0xT#u3=hTK1@j_pH=y`a!cdH6^1<g#-B{h*p1WK-QDUH<;Kp6PyN7*ytV4H+$-o@
zr1r=8!CKxU3SU%&E6K^>on5WLjV{S<u$;PHnH3|E;;)grOyog5fs~jEpb&r$CEd2-
z74T+VXSLF#HWwUy?SGEy%P;!)g-HI-YYZ~~OEsuad9<_hRF}j}R-EbFv?Zj$xx@!g
zquG3@A9{QfUMR`Qf!kB_*&M_X2V=#W*mZx82o`;s3!+_Ht6G8_5BO^}_wl;q`FW15
zn`9rIzLDwaBpS24uj**xpAFGND4N~Hj;kdn_qx$9NHGrQ(|;#wMD>?Wf}OxFMcK#u
zL6RC~cvq9#A-8IipIWp)AKcaFs@z-VegaYPi6ANhkz&~=?Q$Ba^5pb#(rgrAGdn?H
zxaEd8osVnFMCcCaY^SGqI)eL^9KX5LD!#}Nz*A1}s*#^>%mW4_5~*6ZSurP7L2%_n
znArEo(Naydv47t<?N9{02CMjA#34a|4LORcevTB2PAtgIL!UC(gu{|lndaPt5J|OA
zhU_^3klz@3u-#-ThsFh8N5tNMU!@+fu0189OP~&wMl*P5cu40t<HtF}t?YB?6WL4M
z{(W0NTv2TTB~s)wpa){D%OD6xKGTt?WP3mh7H(OAw|~ID1keQkQV0`Rvj)Y$Lov%o
zxJ=#Qn8R!9_6oRzBk8KVE`@j)SsZ7b9;<_P1VAXCMdt_S4j?!=qFvid)}kn=k9C+w
zO^caqhdK?d63iJ}DKq$l+ig~gYA-r!vO>iKQDqwkUv!t~<cDr!ZLC*)w%6B&M3S$6
zmr(FDg@3&MP*iwBp^OEHFt-Ay1->nFp*?$XsM@YdiZBI{^GP85_q4h*0<Cr@>XG12
zK1tHFseAu6eQ<Z6Kzf3zJ$8a~QqC}&b!(Vkr_t9PWtcyz6<oAh`=^3Kv#vUemcn}b
zm%?JZvPu^9<hN^K1s=t#nX%Ufqc(#=p)M%9H-AwCm*F<w*@>Nex6ob8`rX-)vB6!N
z4VfiFno9!I8cd(hw%L!f7_5Xq9S@TzUsFfK0xYxAOx<s19s+DUhF}`cOHr_$9(l!o
zfaWyU;84gYMgIz)=`gbSOY@Jexka2lScfqWW;^^_vNQeAbPc3LfCQC_=WDev;!9mu
zG=H8dil6QctDRX_PE+4S_OW#3q|ui(<vg6|Y^>Ptaqm1LjK={D#kE!TQLcQ$P>r{x
zz-wzsUu}N`WV6CbKWn)_qE0p^kX{>zvWhuA+`8t}cEadFs0?Kj``V&Z{icGKiai{W
zm*^((W?!V!1DU&8zbKvyGm5`GWX6H_Tz?_e3T1C_)cV#fFs6`VkmE#rZ4kv^P8IgC
zTO&eB>1*?wM)@$EK>1L4Bw$JC#^@`amtOKU0ay%+biNZOv&Z>OR^@LJV-unQlYm7B
z6X*iVHnEsOGT47{eDHSAY1YnI7ou^L6WijqgD?mpUvS?=#4Kl`dB9uFoPo+}lYiV)
zrgHD;esD4<P3ELv$yC5r%aQv<1)Nlw!)|Ri0q~=!76v(JGqNZ%GDSr2t8NCIMo=t-
z;gKEeio*giR~>e|&pq(4XmtxIP&yD`_UgN30S#EX>=E?U84CrKIYEYF1}D;Rd3uUX
zBM^m!$8B_aZ!T1v9?C2m3pJB`pno-18VB+T!TPa!L3|0Fb_@s2FyW==B7D;9l1}3Y
zSe`>DV-jDsjP&lS8FSTp1HT@FdZtV)Edo$|Jxp#kX)zB%LoPTi79P$~0Ufm@hezm>
zaUpo9VMe(v@#Kfyo#goS^Vg7gxwD*{g}j&8p44;LxA~wdldek1X%xca%zxKpk53Dk
z=fcHo;-U_-zdHG9XA?8u^ZJfLl%y#=?M4le()mXLi?*Qq&hC%59CEz2I_#I_G#iz+
zLR6;883+-@TN;*G090iTqLq%;hK^g{R@&xlY@4oEA^aF?+acNw+ypYPZxxP-rwH}f
z412DsEtQrc$s7%(h)Ge(Z+|L^?NIJK)A@{{RK#0JnOe?0<U|>nOLDc%0|}SV&LO?G
zzLHEXiH`1xrGG^f*{*Bybvl8jnd&1Q&33k07o9bK>#;nkvKNHHfO#&|71en$tD*zR
zWL^K)xVEQ@Dp&|&ePS_~2CVCBh))ZxP-I3`NXyQZFs~xqmGE8ZM1Qo!mu~3Jp-uA_
z<6ec6C9S3Ky9;QDQRje8lD!c$Ka3NotKwaToq+r18T7z;QPB^CjazwdxOZUJcONxJ
zcDBk{oE`DbtwC>4rzhwQW`P=XQkEZ<vtTse0CY=VElH5F5o+uN(t2ISq}RK`K?v2?
zl|VIp21HYoX1MJ)s(++3GL7Rri;BTK(pMcbSXsd(z^BRc))J1yWa5>$y6bWSn2jR*
z!+9RLP?%wonhwHbV$%sUhHfHu<l$h}NKWe*_mdV_G$yi^@wmugm5TmsFF>?&nVTY&
zP5j1ga`}l}<FyfL_;*$i`C6^jYI#w;>I#=s7+havE#No}oPVr1HK~r5)j+fJz*)4)
z6g#VGf@k^dQiISU^5sP#tOh6JA(CvQ$M4&Q;}6*Wo@>E<+jGZEVEma0<_v6iUBR3N
z1{8=isypa?TAZc?u9vNsmZ#~(Rl4$UYBg?_IAz?StnK-RXu6-0r$%knDC$A|46(gx
z)zrrx7Q-#WNPqIz^fbf34Jmde)gG?5Hkh#XS%3<<#P0edb06%9o>uv=SOHZ%M?xcJ
z9Vdff8F#?iO4a|ZPDr^veBXna<IJHYU`>fmmN6)0{O|H1ODDYR1>}d|1JABN7T?kS
z5%)~zj==<B;Zvb#IUt+h+BWRE#x~=Nh@R$N<c(FeS%0dPeM<MTBmsnq({?5$mgL=m
zYavpjIx(n}ByK4B(9=IBul8Ra43y-8U8V;jx`7olT+Tacs&s)QX;hbwj*v4be(IGC
z%XZ?;LtVgi8^tcYD}~GgTM%tftJv<@Qt-7hS(&bY8dN}P8_#`$rZlv(qv${4JeN2e
zGvI)IxPORIzEBMvXTYsT;^6xgfB?o8OSOoyRKv?3Sr9UxT7uPdp)@e3#rHu8-q{&?
zl-OBWX}X*m3FCQjN>FVjV>UCN4rxmY^Z@>)U-DipXV@bv$Q4vW^U`{(m?Xn;StIYA
zY+a`~a@(0l-;)3foTAS_{+!!dH@3j0_zB1+hJR{Ok;Ic)m(b7@HGCDWxvUAd$F6RT
z(@b-|2<OfX3yNDzrwECK$C{B;MI2NoYGb`gS3&pP$gJ<C2T%NVVkzm*MRqYufOn{P
z^(Y5VDaq6LaisX_0uSAk4lK(d8ML!*G6Xul@RxZ$TVXxO7jgf5+yszEfgHRsp-FX_
zX@4WKdw^;v-Afe>rf5K}+F=`yonF}#9B$*xs6Hu2AU3UzMXMNNp;B1w{B+u&Kp^2Q
zeNb>#$tx9djKgz__iidwuDa_91R4QX8k(gW(Cg_YMNAzN218H)mk5!MQSLWY?fSbN
zYL8ViMba=?ci+S_qO=j~uAZNSt${=rA%9ah%#an3Qt92Tfi^UW24-UaFV5O%Z!=Fs
zhqNm%+uiBmyX{V>To4_h<{1?+C~AYonNV^Cuy5I$(~<(xL$^9PtqM}462HUFkj-w7
zsv29za@LLH<A*+Ea>|n`)mYIr5_CtAMf!U&t|B0Y2!yqst(<ZdKb8~vE(-YjEq~(;
zM^TikntiLUAU=yE?F3*BV^(4@ou%HWGJvRw*m6v6)N7Qt1f8h7G8Mc?f;`$6pJif?
zr|u%4p5yB-c)jiF<_Wi=dhwq{w!2k#flt90Wx38MxsnCfCnDcFw>$jc>IHC*%D;AY
ze6^SXpVC0`^jCYDG*X*FjnQgMDSsH9kh82NaTk_k_cwUv7U~`aBC^zjHFM8Bq{%<M
zXaaCwW|I#Q19T`9F=LG4P&Ai%*HqXw#sC9Xp}d%G0hdhIK>n*rQ<y3Pp_wfgwOd1q
znv!3;UGqJuSEXtR5RwC*e9hMMQB|MZ<HXlj$mR|*#$uNi<aCbmeA|^;7Jmx|f_l8Y
zqj+r|Q0CXU0w*L0Gsy~B##}?J4O9q^)#R9m;zv}_9U-tZrc7$L-G~6eJdCpWETyEm
z(~v9RdU@ef2ZWoExoZqC+a}lT==&Vy=ZCH{y00JiIrzR+;49gq_b!BX!q0`>@maHr
z_U=YkHGd)MFkUae>FaO$A%A*(Q?qzEb3u6q#F6dk0Y{QxC?*86tehG#xjLJmXc#;>
zklaaI;D~pRk9MDC)wyYKKn2`CI(7=Z<_hqW_TX1PxC;&GnC)J#*ZC2d43ZU9RH;9R
z+!1)=IMfCQI>AsHtbWEl&yAp?eB{m?Sx%BiX(GwV>2h8?=@HoBq<_2m83+a5%iTqf
z3)h&37!lOl9buI@mCBrbEr%E@|Cx@>RzR$XnTL(kh9Vl;=pX`K2#F&G=3$MX0129<
z1;ROL=t+QkljA6rODtFWD4}5W!VI;#$WlQ`x2C7J(FrcMoC4;Hs(t`rja4cZR}Wbl
z3ri05Oe~X-GF~kV5r5p$c&lyOtidy9<y51kYtHXH$u1h^$$B~c+0<|d0l7=H%8gwn
zpR(46tZ=cKDgqQ+=$c>qg3{}radLL8y5%3diK}L<XiplXHQc=bY(SI0R>giejr^%m
zl&{rt=P-3AGg=49?h_Tt3pn1P7C8@I0o!@9LkQw%kAXfV7oKOhO<jMZ48c27{M0fo
z;^06O6OedtK$Lp!3nr!huz4rcNG)9l{Nu>uIM>*B9L{7)moq)<>C&va!=c#OF@Dop
zUX5#w)u+mi&BNu6%*?f{H%-Vawq)oABrItx)#cBFc9odc=HCR68E4EWlhSy&*nOUz
zRSTu)mVq&4Up=r&a<6~YCNR1rs-WqCS_^N<(E_gNk#95&(_-6S>hJiHJts_t?uI?5
zDQneI&WhL8rEE3ThthJM;vtq0rlUOlSfzQc$FWrl(kSd1C2jp1kL$GNI|~@})zT9|
z{W!_G!|tfHISQl?rcYMIeEnCCL>KIX{`*OwU(u>sphWKCPwRi9F%uZ%OQ_CP0)uNi
z9P=7z3yA4ZKq@wgA|^1RFHLB}w;i6nLxU;E=!9aGpFubq!MHH65t&Zthb?_R1k0?H
zRGmoDiP~)0n>-PeLD*wnHL%!j;`Y0{p2ef}2;S)~x0Oj_5qSN|sWt=UMQB9*Yh}!V
z)Fze*6^5Ek5WjzMvpm7grB^SqcFh83vPF7M^$}qRxK3~*kyopu;Wl`8g#Vb1ky;=`
zxPe7E^^ttdt}ujgbsGR!!lwiU_krg76b2m*9%#K6y^{|>ODtxP%ypvx!y?UT)7_$Y
zd1%Gxn)+0)GY>V$!fs=AY>L0}%eeLo4rOyqdoL3FiDG|mh4^AKD%4(>G>s9XH#vMZ
z1>Tg$$l_7|_TT@9+%Qx@&4@vdQmNRc4&RNd(ham*O%rI3+}E0$0{e}L<<Rp`VfE0m
zQe~V>nh{pYoY54~!zA2O%<cMtY<HajoQQqkr0-=ak5~U81i9-G`QqQKi2U_mHU*{T
z&pvkVbUJ^}OfrJHP9Py&X#5ix{-i;#J=GPZ<a0QA5!QSrB5oXMCEuE_=oFb0>rR*C
zSVKSPI<v`1;bsC81DJ+gPZ)yW_sR_3ac|9Sy5`zCuFLO;_gQuIIvuKrzhOC6X1kpo
z^~QNDL(!rlK*Rbr)U2tHTk4f0X4-p@c*!bc#QA@`bnleI#!=v0tP&jgcM3p$<?ALY
zQK&A9D(}`o6SKzj??p)#@=H6Yno&Iad>riPz$@FB^iH_Re3k~#7iz~dk>h#YsXZ>;
zs${3g;Kq!08@i#vD{TFG%U^WZxTOT-uy$T(LSGeI5+wymTNj-KJF=pII4<*GNh}&b
zx+Z_NLmE7@gS!70=^Y|6d&YPt=g4UuQ&B3P3_`u{pmyLN!MIDM|EVYtavNi7pv=>U
z#a0Vj+#Kyo`Xa+xn)xfL8gb1wD)|2X3u-#FA^O+{VLSs1z`FVK9=>d`$Qb7dccU-8
z)k_k-YQ(9dmUxSYRF=q@Tz{}v$Ji2QFPVRm3o9HY&+3`+t8z+f8Da0<9x`Sl?=r{N
zkk&=ioXQk!_M)s7=ES>j_Z1-ll!|i=R#5U*a{}YgGiCvt@6LXxVNOT9qMACw%AW<V
z54S^^X1Q8`rgb`su#(D;)IT=NsaY-ElSr+i#Ug=TerA@)XIdy7!B-uZ5?7MTWe|Ul
zF%X7glkF!>=_o>AHHWn(8a>?<Su2`k?p=$+!!!N-g$PEI$grZvW6L3{mP2}(t^Ad$
z`!MHAe3zUaJoxtT_-is_+K11M4-)VBc1whVoJt-kojG&~Q?DVHVUs3{-4VPO_nu=k
z{m|qz(qB9Aw&^9$2xKms4+(RYKZbwfbc)07Mk8hFRYY*CZZx)}=SIs0MP1Lxan2i3
zU4>RzX1LmVRL6BpbDA&HX|9P}T*?2I&-Ge)%=@QHOI<&}7J>+1frMcd)x~{Ly9?n6
zCmFqK`v|&pVwu^o#$D}cn#v~ie63h0ny3l?j*59WfU$0FXqzH@U@a|?mrs9O5%=m*
zEGYKqC^j=oEkZHwcmab7?ktb$5s^zJH<Dx~3ZNfyL&Ds)^NSgoj>kxQ$JT^i9G@Vl
z^L7AqZ*a>>!{X@l`Jgp9-LcFN!A&NngeGj{sa(9`5A{iyic;omF-F&F(K$ny4awA)
zJawq1!A9nc46d<vH7#V4A;f<S9}=VGYDh3;qm+zIPhlM?eLh|_h}HT*z&rA8^IO^8
zwdnIVHSKRNQAJwxNL8{6E7wH*1@O1DuRS!d59oR<ry5Iw^s}fdgS}1e&sI|diASgm
zXWENLkCVF(gX;dx8g0zf_bl3?U8^uf=X?qU51oQzWOCT|3{ugXaAJSK`ARox)82+d
zV6Uk<*Rn8ir%6~-6iWCIqLK>RV)H=88Y#=eD?$(vJIa(?32U!(GXH+YTp@$Xm)$NM
z)b0uZE_cbZqi>kHg~%`?VqZ#A!32`$a0NxpQwD3nPEFzU@8El(ar-^k_Yd|db~I+T
z+V>k9M=<M1R+u*rNzH#X{4#_EpF1skE~?}HLUf^>o%<00@)vji^b|_;DLm$;MRLrr
zaTd9hf7|LB@eomt-1<{KXf6<(Z*wMAiyT_Gr2)gk7?*`_f?y5&UQ-q_Gb7Yjuot-x
z=#U4&a&*+|#)jNlz(U9^vE4HE^@ZHfcJ_esNp~H+9Q?6);(>oP>G$MB;#Zb&G@DrR
z71O8Y7sa&j%<WQF6}vDR+g}t!N>n%xDtKU!)UQ5QJEGz`GhU3b$Gvl6{0IKKD;@q3
zCCE;psk`L>JHmH)Bp{%ZuwcPN)i{Sr0`6B5W6<;7e4V5a#eNVGKh-T0-$@7M*GosH
zadWu>ceFZYM~r`d-SokUFN>0DY52eWzyB}wtF()8hyK?G_33R_9fgJz&?m8=1YZOD
zVUjaxl@vaH6Zs0AY(Bp-W;*P8k2}Z}VNI8917^sx;6Y`kF1C)~FXganKrS3<&!6{-
zx+?ML-ERgz;InQRMOWYV#~%lheSab|C9Ldo0aCf!=ZAlNeuyL_Z@;UZD>+3~K>C(O
zY^0Jw$JsDeE}iO!BGRPtX{sw-SMUQi9gEmGjcW!OU~W9CA9HhZL}q(TnOQZ4x;|GZ
zT2_HffFYA>5p1aD7jvmn+lay2&$WiSYffpi@CMFXSr<aA9vsxRst*<;T}$d?ad`#K
zftqaLy?lR*xKq-8c949m+{-#zB4xaO>L|EA3bsD(MdANiK6>Wn4s3B(VfNQ>XUPl;
zp`q+mdY#6@#a@)d;va<cpoP_yWH(cBDuEZ=_kE1i<MsY2bx(yzf-<R@>w%RuVgc#&
z5z^%8At+8Q_j#P2mm}_0mIvp#Kc%dl#SAVLF+6|QocvI8%7SrD*SekBoU0|>d8^iW
z(*Ab;O=mAEwh2yBs!lniZ6;-`9#~w-osnjejpT)Y5xbXLUnUy@;wmy3G$~)}KkS#Q
z$Hi;)e(~bdmHPSexuryQ03ShIaO2L%8YsWY9Lo``xvxKl2jt)(%ZSS9X>qokOUKK3
zoM?Zc%7D+l>Y>!*^)%YxUJpw?CGM28o0}9>9`2B~*DOb8Bk{|Z;zRRCO7`2Q<c;mF
zy=af?oYuCtdcUsOYoC(0VWRhLG0*7N>Lh<kULlpzQ?|>5C+!*@7MTQqjA9fATKa&w
zc~!3dnp0p%(sCaU=O_?B+NK1BJ|)N0oArMuf^nOVL&{ELu<kXB_y<-rhFATgzZkmp
z+o|hw3EXVCo`{SH*j6TEgJwuX0I2KrIvs6AB+4fcxlWlg!`GjzwTw18s@?CujH6Z|
zV0C@G3i~q%e+A0p7T`5>!)1dilQ#;B!X%YpP9Vd=h9WG{bYmI5)Y{lwxS}Y5{2YJ!
znNw5)I5tJ=iHbpq27BA&iy~xRu)Y}F1(oo%cRhH804~8>Y7MX2iIMY63LgBdNFwgb
z=2bNnh#7GEK>u+Pwmr^2vb*jA{VHE9w8W{X@E#U@d=v!YeEPANms2|Z#90-m0a5Or
zph;iyZ7-ra=KfEaW5&Dp@AmzdefEDMiml-9lt+OW*QxkL1%p8xq%!w-4oH6EsCsm8
zd6Dw>kKi#f$2que#WBOwvI%r^@4}xuBP#cZZ%UNo2T#Wnx~ah(LMY%3t2dkX2awLt
z9CMf~Kh|wU90co<hXfNV93Fe@!*cRb3ajNcsfOQuKcK_uT=;Z8!)Jj7>!g2RzR(d{
zKuW+p7dmG~I$Y0~x>8tqs;pk=*8x~;B*4Iq$sSC=wVI>CNlx~y6i}IIInE>R1Pg_*
zJq#m2!|L^<V33b%h};YHsJa#a3%TU@k$g*H586}iW8y$yr~?+sf2hTKI_}~uX3ZRC
z1Kwdwme*;dimZfGDp4Hdov?o$LJEcM%IK_^kqvReRo03UF+e^fw$)`{G93~)ZA;;0
zug-lY7~e*)!Vf-V<4(D|nCqyGZaP}6BRb6Y5-UBuyu9pP>YnepBQ3S3BX>Ik6#;?v
z%I7CnH5@Y6cxXFH;jUV(mvBG&ziUYZSbZ!8mW^%^)ZFRrY$Hd7WT}4%;LEsP#un6u
z#xl*O!V2sLkJ?HrnUSc{8b;OR5n`E7k`t?DkkoZl2T8URw&i49`8rQDHy2_Dm4`l>
zy0MQ~WfOtiBTdgEpNBxXu%Lv&OFFP9M$`}*NO%gfq{aOMDZ5bM*@3*p{p@5B5^n3!
z=WLpSyJAuDKl(`LIs$(dLk!)Rv2jzekS34f(Kk%z;PPG(>QB79p<MO6oB=|$mker|
z5=u3~;zDM6cx6Q*gCUBct{aAwwgsT<i}c=ax4q|gM_j#lQ$L#(+PikAwVJc>eE;~M
znX{puU&)8!bc-pkp*A<PqX!yKssSZ(h?2;TEeoc^Bkq8%Pbq(sgG!(0D3_bu$qUH>
z1lv)>FGi&pTd=3WBz*)p*S_LVxUM{yXxIZzRY@g`U#0HFsr{mpv>`u@C(Bop)@c}Q
z#|sC8sX_?A`1EuIZW;l&mM2r;JYvu&*>W?^h?5e2)7@FK$%+d)$cak_k@9@a5FZMt
z=0ac~D&B)z9KnB9y|h8`gGokv)W-}zPPSNZwu_yMEvwOr-Du%0(Hb>qTdkJ6MTou|
z5D@p^vT_FrEI)T@$bu~Y)5y2e=1hCgO}Z5}=@x&?Yx!|<nlDD@x;vrgMBE*GjFZvh
z0Q=R0KDJytjH#!GrM(r6VXGVF7G)FE+XBnz8UZIhLKA<1K7Ujaw0YxtLs#zKn6D(w
z&ZZ^&wmmq*ZQUd7$!jd}c4-{tP~aTVPxwp@6{6g&Yrz~Fye1lkoYE5sv~OzW0Swh$
z<%JlTRueArl>GBC9%4;m2d&?F;I4wN<{8*n_HMXt9&fQ@TS>3idq3#;umMBw&3Nw2
zBP%@w610Ejpi=QbWmm40XcB*SH+I#;WF`<OZ2dnWedm)W$rNuUOnQwe%4}^UaMi${
z``6$9IsN;K^zX;~BW&e?Jf{ew@q@>I|8?Wp<GX**#}$T@kAIbZ`}f~CCG7C%b%M{+
zt2~?U;$I#A^Kb9p)n6KHsee=a4t>VTgph`~^@x8tLR)xjx|=0!8L;5fM=Go!G@z|)
zbOG=PC$(;cpDIcCWPuinn1E=id8gd7t}g?HZ8t=B=}Ev1@#$jL9a&W4n{^TeZ=eH5
zl*3QS{%kfW#1sf?d;>3USlq>5-SiypzuHe0f0Y>u<G@V3JAQ@_-^%gTR0Jw#g);Zz
z`M-a<E!%?)xgdGcLV{(PJ9X7wa`*1ugS&}qNFtQ9L5F$WL8DlrFqikCYLP_DH{Eb-
z8gs)01+L;MS5yt|Y&Re$olo)OH6wy{E%|JU=?<btEc$DAzUJmH6dow5a&zy~Cx{J(
z#g9(~X^CT=S}OYA|9SWCFLwVP7!Crzfoy-c$6J4P|4U!KOrJkr?a&kh{1gDJ1#TC<
zU5-_YyR}F&!l$l6Y}|X#ib|M@V*8LN`u^UsIn<Dw_}#@R96{j|Wnk&_M#by5LNE{T
z5-N$;qIS1y7(kQKZED3H6=VhVqWk9yqtSq3p`?$9clrlyPQu<WbmCiX4Uq%5(35{4
z48k#uxS9Qmd@H~Z(+wvxI=_WG@-LmTb^+7jSG}w^?2Q1Ou#hFAmIrs0TMBm-W$-dN
z^^D=EOK0eg=+tqFqL7*fX7*E`oCVuGLm69JHe@%kKqE3OOD#>%=&T!SS2H~HS7@s%
zL<_$Ax0yJ|p0Bl9-QTIYxyEV%t=@m-(K8X*D+$^bs?ADqw_U-*E7`j<1hmF*WjTfM
z9+&%iboeqPDzpP<9w9_LRI;Y>NcVk+L+h?AnreQAPEQ#+mX+{d7FAs5n5Q<d2DOtw
zyEb$Ss_Mee&}-fAC9gxuF{|Uf6xfTb8{%x>tF8z|Nj)tgsqOMm(Iob*$h?1n>=}jX
zE&{3-jJeRJy5j<=gvE*KBrmep<6o%vSANiDZHWv~aI}!BM{L?LIbc+kRNqceLwl_U
zE3@Fw;9j)L$i_Na#JLG;4q!XbeF(`2M2G4|-H_lN0%Ata(ZNRKb=<RLcipajlY1rp
z*6Jtc(HJ?#kzN@&(M`qlN~C|%ndRP+^1f*4it8VV+^%P>lbGw;PDz>vOwLB3tJmdG
zNG&mF^H2|d6}2RUF<K^F2aj+%M0nEOr*73c1AUz)-NoqR@fV^6Kx@^C8QwObr&0Hf
zFCLN@(}fLRDY^=Eh)K3!`l-M4g6+vWLR6^ZTK=N|uh%I`V!ge|>UV!qcRe<e{6W{J
z->3Y(<G})Uc3wsvljtSj;?U6`;VP=t7#dC@pfO2rC{cVeA+vg!Q44HK;7o>OM^(&J
zzt?Q8t|STwt)&zL1TKs?!xZORB(Jv^-pHeCP~f~xKy{;`&zly%qOJ3vO=AHqP}0PD
zyCq<1s-tOkcwQ<{u-Si-c0M(RDjj=+0Lm|;O+bNIrcx}+;411fak{ED6}ULMK|UBu
zO<;tfTsAm7(U(I~(h#8+m84K)J9g+IfUGFR7w@g=(zyzl?@HdeZ(8Lb68A#i0B3X*
zN!738_vy``;J<;8B}#W%l<IRG*V1rTB#_WuByB`OISCNvqLhDigxuQRg)J=Un&POo
z;F-iJ<9A~*<S>dL_Sy-zJ?aY(${jixa?y*bru;J3EcK>4wHt4Ls<~Bh<^+pg;d;{-
ztl5+p*;O7eF2^N4pO86)Sg>PQI8%axYcA??s=Ue}x+gdyxsSIHA;y%DINIRELEBO?
z)tw`|6=_{N>!N=!@h`-Y$sb5YplRP$h98Nxz>`PHv~!}!0}>IgC`0XO^xM75=E9Z)
z)yA<iIJ1=8$S;DPSZdbJ4(>TdK~zr#e2Z@RwtQzY$bW8}_Vu_-M&D~Xa@WcS25B_?
zurg}h;E46qrEAfi1LczJ3PpHE8(SO1_Li60f?eS!N~(VzZ70?-ts^#BXr^21mUD~5
zt#<AZL}$H#Oj&BGeHfaIn}E-rXg4DHsS`NiKBRB0LFUk9<m1FtWn62GXk~+3W-Zlk
z@Vl*Jdg8(I^i7)>OGKHyEg8up*&t5_;cj2!(QLKeHR3wr=&V1gSwc~4N1>7mDgUJs
z6jYZgiSmC}W0!punXu*?hlg6BQPHqMxg0KT;cJzM^fivwj#XL_ySrG>KM+DCb&WQV
ziD()JOacMcurZ3Kf!3-9AFAd|Rq;tkht5<KWHQJRcZ4VTM+iixn4GX+r>-U8BjkYy
zqn_JBS4bIjHye3j4t-In(?`1@=FuFWnd7+r5&M5yLmIPT7k46xXN8b9{u7|PC*Lj0
z1*`hGCY0pOxKukBcz)@s(ASO@aJqSmqfy`vBg-WH93zjj4cx=q#i0gjZ3^j+SWW7e
zv}``nr*=gN+f|)Qt%=2zs*|CVSbQjuOE5l5kL4}oNp5#u%shC_l*J>0g*vCbE`Exz
z*}Q+TbTX(XFJENNG~6Urq!lKXIt5w^w-BquUr4q47zvV&FFj0c(&9I@!wh!Z<i)#|
z<dG$llnE+&^g#A_HiwInPzi8hWC$iNa<?Q+WWtp|(RT9bQ+<8-K^!#N?hJ(4O#{cm
z3O624G|sE}Nw$gFgZNc(AnN;VDT`w%Omu$?;HQ}qBhV+i$;-?~iL8BV-}o~(8Hm({
z>IT@Yn9>^t<Pb(f&30^{*Z6l@Rx-WBc!#??76RnyVcn6cRf}X$+-cZ8g0=D(VonyP
zJ~pauS&2I?Dpb7tpkpIMBT+|ux<1nQc~R0{i+xBAzBzbxY!OFYT}^YSxS8Tr7SMmo
zp8MpxWxm*c*lPV<c9|86IPQ1!;7dgPen?zf472{|<QN}f@bG|5d|3+}b{@8Vl#t(z
zlOW<FQFpZnuY2zQwpuzKCzkf>qgmOj%<+%L;0%9OIspzdIdyt7*K$oDm28newEiyc
z(@MPb`0gLJ9(p*{n)ak7Pv~{)@1%dzn5M_R>po1X1K92++uNP+X?&vN;OWE9S`7-C
zpSB31LLwrwf8j<q%64Dnm;FCGp}&<_Xu|>wKWAb7qlOcQ;C|JUY@L1)x_<QT<;(rI
zf4-sj)e@oAt9StJMaSa#GnFUvPC?3?ACj%`y1irz@w}}r!mi1W_;oA^<5+)*JotGt
zB>i(6vF%?O&63kjqsY$K_*Yx4r^=vJH&|lVc|iMS3UXD;gX#KAx<IX{lx_8NB=|An
zT0ix@*I*&Up=VHtH*&Jp$ezO!NUg9lc<=7kfQCV~2tL&nCpwJVQo?RdQHdO-{%(=N
zH}y5UlZyBgUCrj`5lUBYaw30fmM`X4wE`%5U9m6d4USt`msAv+NW`>NOmJtlU2gRx
z8)y|njwPQG5KvquEw>Mr>d!Q@>g1Po^R9h86>lfb{`2E6k*D>O(*NpBth9L|$xcGv
zCm0>k17f$FoK6IP2>)$-FS+)X5gva>r>DmXb<dO+;xKWNp$hy79?E}-g}@$@3daCO
zXixlqal3^UcfmEDkAt~nKcSxQMb5_}1Gds-K0GhW56oKrO<(_tGL)Gym7IKieEdeT
zhb_NZTdH>N_c8B%d|9tMlV5`Scw+Be`SHCzzwi4GYClg-zRib6CB06YT6lm?SA1q;
zD}TyPKV%zQ_@e&--*12X^{f5kqm4iQZQrTf)yChxac1rr**-V?{x|)ZKC+<=z#070
z=J)@uUwwDYPhbAi@$tsr{=R?l-D2~sef8`O3SD-Omcxxr{Gop~nr(jl{$Bw(M7=Kg
z3RJ=y_rcwMhG*9`C0_KCsWA0zY~fyCo><oeLu3W<-{&QAttEdtii$4W1K}9aacdzq
zU-3Z5xm-cGEMRL9#>iQnf1i(pcvNqva9R(wDBcp<MQ&TQCPlq}t+OAT9i}2Xs<XIK
zUM(pXLYam20daTpM7=xgYWX~5(0M+Y@tUQL1tcThc$!78B1nJdJ*T1Dt5U{C`oO|K
zrGF5tAOB`^zGQz=t3i#~_g2cs0gD7?7LANqg1-nhjfJX{!@wYsf8-W*p#FHzf5caD
zO%P1N+{>FZP#aI}T&SUoQ>WA!%Yuc9NsZY0v+5+LFa<BLw1zF64NLV@ga$QG<$3z7
z3Ye9=Iz3c12!f|?V(w01yg%;jqa+KP+g(&_R|1T)><oXLXGo7A1hMxUUCc<j3i~p?
zwb*T50mIyv<G3H4gyda2HfK`%(ifzw@$TKeTEzYDmhPVC$4)qtbxokvqR*qF*?zj5
z?mo|_B~R&z<O_e+OYZk2rFQ)bv^MrgG2x=o(%p7a*)1(^)V_*QTa!jO0;qK$eU2J+
z(|G?4;>Ldm-q!QMbp^fAjVZPA9+5_Ee=W%mH}-&*VrS5!##PX;M-E9qOB(!;4EK_I
zPF(IK_mdw7AvzbGxl19A2J;acyx&dkbp|M&a*8`!!N-HRh##;3eAcxqX*ONFNdAcq
z9ZV}yqn&4q#wY}T2A*SSH4rK}o1qHWsI?h!^Yni;9U?ej1c0+$%I$9y1Huws+qD0_
z8<cw5FTO3sClh+zVumyR2ecg&gkN?2M<^)}4}p0Kke{`jOu{1sv)W7El9%9-rANts
zpFH%BNw~7Q>A@fQ-%rU8{)Z4a&V+=bwiTLFaYWQa>)OMgITGrKtBtLHh1+lE<#^rG
zZZCgUH_yj^(6muSz4g2iDt9b;?V9=1&$SQDSKBMSPP_GR{p*s8>MZ=Rocks>4})6n
zXADCacUJcW@OUtr^2N#fsKs(tj8=bf<~GHwU#wqf^P!1k3SX6{r_Lm8e!g*V(87QI
z*aQ`R?bxa%<=pCTba(x6!}dCPAMHf3iT{7NI@$=A<d3VbnB>zljN_Jb;Vgn%Perti
zYT{^__oGb}A6ZspyVYFNPwIwF6bmxRng_Cl`(U_a#O9_`Yi|m_2~+GJN>=)wxI-kL
z36yT=g@SxJq1`wu_}|S^0JhRk-C^CEj>sG;raJ}5gUz#P)X)c<o91@;uB=u+{P=%`
z8|x3zL}(}aqNDcRFo5M#&e!Ze?N~pX6j`<QduXXB)9&-ZHEWv)e5&A1^fA}&p?#zZ
zKa$p-#LqhG%gx=qoB?o#ODm6_)c3>t+K&)DvSZShxS+EH=GApCQnq%k`<h<=c;mV|
z1NY}IdpI_0gibW7)o+a-ukVzvYfpdFA8$TVAOJ-=ryhc>*|Iv{a$|P?n8X*{4I(XS
zQ4uuyh^(&k?#EV#)499r9lh`tJ0sMofncrju$oR)7MT%D?wYYwxmNT?Z5mZQeA>~)
z0{0THO!%(0_FDc(IR!OZPtun2Gd1DpE+204u(fI%MBYIK>fh%D?#I1ePYQqPB+<>@
zgM#!+GNm0L*{nTy=T!HZQfkMuw3qzqhcG)o4mxQ0$JUS6hOu^c#5iYncXs0y(?k#i
zI-`JzDAO(RHwaU_mODZp9zQQei*E8lqPATv@xi~|P2E3Qt<l6yM)IvJ7Cl34|2wTl
zl(A?NCw^hyw}M*gB-x_XR7rpBU63L2uqudn8Xs~4%Qs#pY<#Ev``Rt^tvbgYAx*A`
zhR^SB(4Jd0t-00EmRqrwyk>MidE5ukPH#1EQHrk{d0i2%%|K9sqYWVn?`^k)s>j!L
zz;qk_VcLwnkUrsCy-f7x>qi>IeygS<BXck;Z@BzhD|&IOp$`{RnJ$0RgYma^{gu;o
zZ`E@u#h=x2uK?FO9xK1~ZRGcG*iZha@Ab!2dZS0(P~Nv1TJO5kU}|qP^p|pv?%S=m
zG6S*dx30~)4rt9DeRsPFg=T&09aq<)TTL}!&FQbH&+DFu_2)H*dsSs#yFkrJeD9C{
zOQ++0^TivlmbD|1PJ(}}$6scXD%Z)`q+hOE>PWp@_jO&nTsQQlav43t4Tq-W$%bm#
zd~mUxP4X~t@BI#6t6FY;O{`cpI~+~tt@agdi_bc!4N(%?53OJ~m=K}8V1Io4BI<5)
z#eLtu8r|*!gnIm0J#VPOt+gs}tEu|lbQ;!dbFOY{jo$0~PW^wktLpFj8wFcvFjjk4
z)?UJ0k451*;q$S&BSwK&Fyzm0?{@76(RC=Fg&Rx$_Sb;?X);Xy@>@^-wAJjk-U}8)
z?1L4RdQakX9ueXfP}vjp9kYFRk-Cq!-tT#RdA;7gLAkd7-T5gxc5LEp(B}UmUVF!@
z_`VbU#``m5KYV|K+e?)F)2+?gz9{=A+xTny{f}Fn2<D@+=iZi$$93PnKrT6J05Ob!
z8W4w7{Nl&jKXw1t%;j0hIq=ATXxa#-b0c?NWJ4b@U|A(I3@tt?ff}X52B)-i5VM&p
zPhlevA|>pK&MheuMB_e=Sk~g7AWwyu+QtwReJ8-$n|^-@>}=w)BJ@^|JRz84$sZC^
z;2*p9`uMMgpEU5K1(6xEYKn^jrOcM_+?>i<;%mU_F#;fA4&5B7IxclFnyV!BujpGh
zkvtxaVKWHpdb1FuPz6UA93s74z?t?ix%+M(oi?WdGwU{(40&~0*Zu}`x;~sHsM$A1
z)L4z>n*D#pB5Ky4R&M~w=Du=458c1-#bGx8EDDYmm!*^qR2GsSWcI@~@inP1kl30b
zL!+tNM%SJ)1nf@7ws41x>jRSAQj589PyVM0ulbOad6+f^r0juPMTl+{A8Pss*M-!s
za}Iuf-`9rH)-}C8jCQ*q+Q0h*)q`i(&Cp8VES`U<TG*`d!heUL+1ilV^_^cEQrZ|S
zTN?-16e!ymCR-OI+c1<`fb1uXWMgP-LtyOoVX+NCvFk!&>jGjM#vKR4t{Zl|HCi`>
z!LA8{-4Fu1eE{rM;jd<x;U|Q?u0OrCpw~~>HEXx|hG5saP}iD3S0l{z89}b=LtHlo
zxNd(R-uel_t<Mi_T^rc?@!D05Ls~y!Q8x#(t_x*d8_4>MFxKsYSho#fT@%3CFnN}*
zd#f3YF!!y$PG@!7f<0c&P`${1x=}fWcgv2l<Y)GwE;fUS!~t0QO*t8ZFlcqm?k;`O
z^;*T{+V5L`i`e~d6tVkTu<dWbw!a12{uY01`&+Q>Z^5>|1>61>Z2McVZ9}k4=FiIP
zZZ(Nsfxm7hR~2{vdsX1OUVra;^<B4jLwRqlQQKRQ!oGI=PA7kFddg)ifbhlt?m<TU
zRa=w4#U1}s#~o>|gzD_#BZ5%p%i&M0&1M6AHW1qT8h@U6G=BHz`?fXf9<4Xq@dSU~
zp3)F{ERavi(*WroP$_-MUm&7k5cJ59Vh{&(|Jk3-1jYq$;^b*(kVL{q0+#Aq$K@#X
zj6(()mqTKpq1qi3I;=+hD7BpEs{h?FpzZJua*?~6?`$sYREA?}{1CI56c^&PWa$Li
z91c#NRRx(P|I3LX<hx<JDf5+B)$)G~Oe_LN#YmKdEfLmpv)T9GGn}{enXMoe{UrI!
zACUp{dK3T&IDLDLb$pQx^U0cL0;~ivM!AY$O^EhUk5!(+9jqm*9ueqN);Y6vp4Zoz
z2vfFj1iC}T+j-_;JorAplop|s78Px5%{mGQ+z}YRB<%dW6m-{nz2w<M7+8Pv<Rlsc
zS-30A+f_IRXRZfscy810+HpuH*|73|xo^`v7v{rJhmg)+N<Ss^+smgP2f_yvM&nEe
z;EGe9A7+(EpG&7PbQMAF1(taIz&S_!3KT)^>O`EAAj)9!8;m*36xdyWZd=ZhbUYxj
z8)AY|B<;qEM(pjq)^B>rJ6?ai{(JTc{gBFFL%j8!s3a&^t+2D*`+eUY>f1vR;G2q~
z6w`)xq|U<VAbP%Gu&(2?vXE;EJ&4!Kbq^qMrxXi;^(8*|z8yMzvgnG#*aX`2T==Gp
zEmKa>VE@gVzI$env<W(tiPkhqPcxhe{`_OrBi$R$7b;$X<=Q3SB!7Rs|Lobp(b3`4
z7YEXi;n~MqqK!oIO3O>%ynFiM@L7M&Zxv1vgT7QbD99q{25~7|w|NH0kH+cH30pH2
zNM2Zi1O=$iQB7`R@AR%NCK`W#mW{_(=<vXoj^i2t((V{ULI(UIaq=8jCprR<i=(db
z9ugqK)0Do*!A5p49nF8QW{YG5{r!~8*aW>-h~MaA&R3=7%YRx9-IO~8v1+xxCDiLj
z2%ZzoZgAbhM1P%6E`Sm<Uwp=SPS4%1QvRyi9Zt%j&{*jQ_SCMtsdtrKxb1t&%n4wV
zSW-j0O<89jdYriDoUC^DSZi-@Pcd0r`?UqJbQ1o&0)V&z?qYuq*RHDEieKx=UX_+Y
z8Xy?a9%sA+zk11P1?bUhb_M|x%J~P$4$)Qa0#beb-m1ZRmS7N26+(ZCiSPQMc_IUz
z+(Lho`LrH)zo**23ap6kkYMqmws`L#fkPN7v>x3sU!T2x{inl&{`1!__YYqsCou)(
zM|W|clY-OoyMBN4UEjW|V`gj`a$CGk9j`hzXH^79)M<B198$V(yPIxV*`7K158AJH
zUVL#^@~GyrU_#cOLh6m20$=3MODR-WA{r)?74GZ-w;UX~OQ8y#lxLo45dS9IDt0?a
zN$rMEoe|CItn_wvu=86w3B2zqL%j;)wkdwOPSNNlZW4cSH=R%rjTUYK-?w3hEy_Lp
z=pSOm)esM!i9~s}Uz0V~iFH>G$)*YBdzu0iTA-=Cw6C`mHnnVrr2VQK=e@sF9qvjI
z$Ma>Se1FgOd(cfpMR@i4`9c5SpO4?}_n*1{J9vA1G)UHMRuc>7`kF$ufeX;z%8uV(
zk(t26hT?xA`cGGK7|WG*is@SUFPTHwHqLNZ{XY4(fBiq=W?E6VVGyOsn!!EZMIW7!
zlJ#c!Me8FVMe|A?@72EBtN%4G#W4ETFweq?5zyiRIU)|+_1aAa+OA$<^4Cie1rKZ@
z2d?Y7&8ujn?o;%}8WYPdO~lu*W<VB57q@MFbnbuSFuu^rC`<8}&jkTp%3f49jlW;<
z$&0HrJRFbWx(2x;-p~Ql?2dY@<jdNp06Bdv6w32uZcud~+Z#FqgJhnmyRo?w$M_7V
zp8QjG)(6iIp1%94|KjymkI{rr6^u7?m5*XXpIhv~q+N>kFc9glOKgpYP0%q=Q#2}?
z6;6M!^cCPQr1;q7-vc>_<D!~P0Ewd%bP-`X?N)mKqrTz|Dz|vs5YI;K`fkLx%9$|`
zo2UcAx)@OVyx3WQ&{kNNmy<;SD{u7{Z?*OnPP?XIkU|S$$K9wKf7?r5PxBz%?Cymr
zayHEr;S^ok+2P$~PwwoH=*fWWB=yp?bCrL26qRfB%G4{a_QFWdUX<|<-0GYGcxVv-
zj=XlmR%#!CWubPzD-lj~`zn2tLQgSTGsG~Nmn&o=&QOF^pC<bOxMq#=gb8;2o|5Rj
z3>s9t2+=VR7^0Kdj{0Tnqzy(8=!j33b86Z3Jxu6GA+Zvf2b(Z#3GTPIxp0ONs>^>f
zXYx|4d5VB2ua92yTpbz6G%;ro9rlk7p1nOd-h8z+n~IcMco%5-tkv@d@sF}uq4IO^
z?`gcc*QD~A8_d^5jepV@Dza&PPLRx=D`!tU8V=eZs3JXC)UPwqm&D)`Bt#E;7@w>N
z1Ag$&QP+*ILpH*fBmhC;b5%o$%Bp`4BFhk5g|n^IQYT()r$F+R^RsL!_?LpDy|Yt=
zHg<LZ#Th=Rfj*s;*+c+3<pCn%8x|RX*Z0wy;J)tc><K?d#KA-cb<wrA_G{$IRZgVn
z<jC#a8Mgn&(%m*&!iq6<t(r%W3_N=zPY1ogE~f6RoL@<-TR<g++1)&E^1gpT#g+w_
zOx}_<o+Rqn;JkplYM}K4Y!zdckL^)s?1Q3UP)(h(-G_5|pcba@rKG*PRXfPMr;Rgu
zE;Jb66ET;XE}9qPxsu07HOj(RPGYM~MIEr)SB2p(BFPMf3=Z6dR<=}{n(pKbbkxkR
z;W{BBRTn!uzlP*?V<V^Q&dz_D2C?g6kDP8HWo+<M+La~*%iH*j6=J`}k>z<+$Olm)
z0sA10E-K~H(W$4`cumhj!4O^V;wDA~h@JrYiEsMdmR8m5%X<51YqefEE9#6sJrzQ1
zDeOshR_0NzeQkmiEUaL0KfEAa{Gz@;Q05W#$Qo6HH7<<~MY6(=RUUt-jrW?L*-+u3
zj>h?V+FS)_S|Uny1>8u=$uOHoIEvUUXeb&jj>04t&JL&8jf>N(XeZDw9?|N^iuf0h
zIm`SR-klAF28!1xd?+1@f9t7zYV4;t#;TFogC(7pibPv^mNF4?(bmY;_=l2%?~96$
z->%TgYRH6@$Uv!Wl9hikB6A($9)M^eBBOQnoH)nJY2j|8<nXyr*x1-6S3;#|_lcVU
zfy}T?)>CamPNUxncw{QH0h4Tcw&XHf*Zkq9u&}egT8!1)62>9nmE8IQ>#OxwhR5mE
z5DOpL>Y8B7vpF7<0Tq*CapiP(`bFf)NZ!L`%%`1p<<$3zEJ}Z*wG!MvaBR4jNNk)p
z;m(dY8t^MzSnd{a58NYQzq^tyoR&NG%pUXH6U7RkKkvPromFLJwZXCLNwYmN3m7mx
z1o=@8-&Gur(!o!`@MXV!-@bzzK%YtF8G>1dXT+0g=%Co}f&;EPb)|kHr%0*l`hpC>
z0AZo>3WH7m9jJdG=(ZOPHgXkb$;q=9hr!Q=FzR%6@t2COwplj%;5OIpKh%A07=RO)
z)WeDVvZAqu5RZ@-)5%|5xgB=V1LKHoR`>3%S6`jBF%e#<b((P{w5Nlw-#uk4V2`#?
z93qOf^!x6~<JW&Wc;%kkhhdt}GdBX!5t|H1@Zo3Bjf8(=30HK2Y!Y>u#2;4YqJ-dU
zn`?Z^bmsuL3S;Wnvp3<Iu=+`HwTNQn73PVqALd7EQMH0FR(9k^m69^`yyNgviG`SV
z$g3GedQ1Extj;V1&sR2u6R|S6Z<hL6+rsQvOh=`^IH$2oS4Wtg%Zrq=W`sPXt7^6g
zTi1pU?QMT7Gs1x3b0)ix6lLAGm1*wZ{`LR0@MBglUUU5!2Yln!rTOlaow_m#uCW9q
zis@;INhZ)JWRP3LO4baf@b*H6=O@SAOU1~oK$zq;v*Sc(PD9#`AeT_;kN;ZC<fs@4
zL6~hFLr<!uJqK)8f9|>=wb6K1r}wrSDS1B6WG8=*=jBX|<M52lTD)_69?h8ABIXR2
z^s<6Ny=hA6>;`G_O)^r#aQc;<k$3}>?PjB~iAYg-Ney9m<!-DIO2MVIUhA9q&%i(*
z3HR6`XXvtW+07%eao6%nw<Jpgw+rWIts#u*lB=WAnT}sAmGHQ3FvO+OFkHwElrGmo
z`?h}yk(L%UC!GymyvElcgDCQk5YM!h-Hkz=m7Gw^5C``^sWoW7xe5Y&twUpQ@bc-w
z^XG@JzB=l^J^1qN!O_?K!&k=#Z@<}p0ki*T;FmIl4SLD92$N8`;>GRS97ld7x5P?<
z>Fj@rcDq@4@Y}n0;qxe+EJt-U6n3(J<UW7dBE>my+y0}|m?*79U}AnJ+5C*_SoKz>
zzz-I?Bg}`N!JFm)msT_nZ{EFl;r_8{9{jeE$!J$lFP_58(!j2SifpJg0*i8?e&zYn
zO^nmxe`>0fHPjCcZD?O5WwM%J(~6#dtItcK%Z>Rsr|!O7&U2L-Yu+ok4nq6p^b~*B
zChm6%`P}sei8W`?o2EQ>vl5&wc@?nT=cSX=u7S}xI72GiC>J0Agydwn+P6;6D+p5X
zb^*VKs;(&jV=&}p&~Cf_<<RkSpcE*dN>KgDhdmlGKN$e^IJ@d8X3SoAGKJ_V>?T$9
z_Pqhhu29XslRPgf2}dyb0h|Jp@(O>yQa2k@5ya+#D-^uv+LKDXX1v6F{*W|KQ_eMg
zshmp&lN!^}1SwB*R~v*8xaSTMl&q7mN~ieOitpt9-M)XM&qv~zvwN4@ruoEOP84Iv
zd9!7ME4(TtrQE$uZ6Es<1yjqj^W@|!_u-LKhE}~c_xfkWq7OwWekFRt5$k^l=s11O
zSwVN)ejKx@d-s7yfS?eP)yKXGzk#Wkxw&=w*LtO#5nKghuN*C%_z`<BkVp7!;OC|?
zdN`<*I!1*?IV=5Wv&QB#Dv4pvBr%S{Oti3f>TAR>*XQgVYPhtkf8Jv2^=pLFVS{n|
zKeM+0iKHnLsKdtY9%tS8z8rt4OU~KCPuv%4B-73gl+b7DQ3K8hzJXIM!ateHw8n3S
zt|?sUnln4eRSYq8_BTDBh7GTog?*d`fowM<wfN*sUh~Ex;l0`Pk5;WO+*>Sfg|BV>
zmlM}PTs$)O%IpBIl1@n9zJO23AX2b^)ZAcNi-r5!yP}xGc5%a$seXUD(m(aHHimDK
zGYV)?^IRQYS7bKD%7#&*8*1%_k&2^dnqx16?TnV&yxR1dSRHnH*672q{GRR!dD2={
ze-xiEchp$U!Z?u({YptoV~-5aM95Zwh39&||K`xG_n0|)m6xMkeW!HRbqXF54O?h3
zlX;?rJ-0$i(X`Z2XL5fXO#JSLB!VN{tps<l$%lhT=?EL!?dO(;skiKqKbH&QxxXN`
zpmnSlHQd5Xa*4%FBxj^N$ApcEX3UHVoNy1hb5&jp$soa1GkM%?`kLnD5Z=RQhr7?7
zdlI%D#`{bzZLH37xeYkpZ&gxbw3r`1)Nu5_6nVBK`^cNjdZ&MAk{|}|>?&lX(SY}(
zL|2D%@Ws0h#sp{$Ij3eX_;7@uW*qgBM+?c~u-iUJxQe=-x#3JDQ74HE_+mCGsJ^_7
zLbw>{I(<l#k{se7{IC}L73VB~pcc6i25Abyc!|0prW|se)jbEYJX2sK_`FVP=}lJ$
z+A_)+aj)y>-28v$!cxi+z9>f@yf7a}6FSR^h`!KGWcUul|JK$K&%uXPdt&v%`EB1l
z5H6kCePa}fwGMPOc>#!4(qGMgUqo8qayk~$xtx0XSWc}vHEJ*HqoqMF*?P(*RZD}H
zx!Pjv9dp06QHk5)9B#c)-SO16^U5z*uJA2cG*dOQ@mPNX;FvdaU%A~uC%xx&t4*eG
zzbrENI=hLKBaKB3bk=Agu3j@gtaL$BK9JY`)65Su*Q&m2sILt*+pj0kw_4G+@b|)G
z7nCcC(SJO8{VD>4lT`3>zAoFvNh8({ihuQR>J74P)C1HTxrLuDECj?|LbbS<kIBw_
zrKi~)oqB)YGABi`-LfmuZ4v%WvQ}tF-DF~QE-X&4+Op3F%|aGC#L(33+tYYL1OrYv
zr2Lz2F#%$>gq-pV(e}JMN>l=0vm)`1ogM!HYUZ2@)qZ;{+Rb@6Uv!c*iD@!VUS1vj
z(~E10ZfvDxCpew`-tNU!_1&b?ZJoR<r)TB!r?-Fq_5J&x06#0o!%jCjc|FUg`-ivx
z^>6R(x+`Ov74FCRV$^d(kp!wJhOZ=O9-_@}RO+@!9&$~!eAtA{X>v&(@t0Nj2)}Qg
zaPP`@UUSOCVzz#RSv!>%_saR%uBWDR{|7VI`xJDOiNXi&@|8`s=k8rX`FTI&{kwO6
zy;6U#5=TNMZ}-~5sro#2C_+wj>syBF`}Q5t1kx<^9veI_5fRs2VK@$@2LFHd{%yUD
zELjr-uLDov0mW<r+&G9jWdt*%+zg45n5k2WRA^_j)PR$4lAZ$KNH`z{GeZ5<Rp0bn
z&D6zQ%ro>i&oGa&pJdkmo7q~+9Uw(1BeH*X^;A~v5COQaqb*x@{B2GX(FHHP4>0+W
z;c2}nCrCMlIV$E|+}~h*I(d|b>Q=Xg72bSYm$#MDh5I@?PG>dd1G+9LYU9Vj8ipls
zg_phy$ila0`8bTByv}*#LPQ+Lk?;;{tn${odut#SS1al>L=GvAC(wP2VaZ{u&HsO%
zC02R6mq<f3H~)x*zk}#B&zL#lmh5o<wlP?Ce*4>jd>mjN%nqIoeB^bAgz$GuS03-`
z<L#t1WSwLE+(+hYe^K-qzI$AL7_t~#SgzL4{q3H&=j<2vT$~BzF-JQ=NlkSD0vq?D
zkYpyYl%R>9BH2N}67hyNKOr@Fw)lTAF416cU?bj$An_2Ak8Two#oX#7<;8i1`o2CR
zhpp)p#SgK_XN|@~=qb$SU=BM*8qulOvg7aiHwW>@K@qk?tLzo?4wU&WtzOjw-tHm5
z6HLHOow6QWTw;2KnVVsp=A%553-wUd<WHYxnOIQiGm)eCM56*Y>PICy7Ylzds|Oz~
zb*PYtG3xs?IdkNBziCVeM)I{x$cbI^Y<#~tEyU^Ad=O6P_x<#NM#=iXkS44F_Hwgl
z*rj1~23l&Lark@Z+0je@OT&XW_J4$i!&=;v0y`Omly!mzlT}i}$gEs7`MeQJ;$3RJ
zhi>H^d7kAndC6_?N&b_VtL}ddoEWZLDtfb88If0dxWnD`eaW@nsSb#tXpA)!U8CXm
z&f-nHp#*g0{br<RE;eaAzCsJm2n{#1VU{kIBioB*J~#;&AZSsMDziw0Un!iU>*T1$
z;g9B0=9=6Ji7s3geW6n2@g&aru_VP(75@g^$t4}zlEd%T%K8uoTIzrIQvx+MH}~X0
z>lz{w!xFz4HV}xc@fwnsDj_aWqaxKatA?S1zB3vb#zpa-<kc8{<J#Z;{>9Go-NDPp
zgCBQZKX6*eTS=6Q1yTi?)u<VXY7`yFnr;NXZ<Y*=*P$;A!Cn^F>4`+W6&e;!U|We=
z;d^J|VeEvW?kX-#3X^|)!r{+L3%Fq9$M73){_kJ!?!SEV`r+>2)y~1w2SW+Jfp@0#
z0Wvn24I5wb3<pnEX4rv?D6T8-UE^Gl`9{rtrIpt?6jo3#EeA}Vhb>HeR_RD5psN<x
zM~~xw`+Tq|15PD}C;N%fh@Y8|btAmm^*^_3Rp`-~1VeP>!ykWN{xH~kWS`!?eEp~W
zS33`PhwW%HA_M^N+P@Y@8&WXW^%m6tU)>-m8xSXjG~Ii><mGY!PqY8Vw<D`R&Q2EY
zP8G|;DEQtJWMQbv9g|E*m6{cdE`^d-N;pfE_&O3Z>~~w}M&mkk5141YJaSjc0-jwb
z205vi#N*D-uq%Ju6VZZ#Z;34nNsfn_p&9h$wXrML-c7dFjUJ14)pgw<u_}ghT6S}l
zElS5y9N{@O60b`yX=%RK+EK~WkpR%hr+<|QHnJ-VYev(UnOpPUheFXT^?aeeS)~>U
zC8(`_*=y@HAF*jM7CROysbp!4AH`s2WfzG5n!g{pyG(y&aBVqyT*PlxE8=EU@?L#o
zqa6gQJtW?$CO$(nMSiSKgE92y5O=HK*Z9rP19u;pLAp>AwwqW(&=H8PpeWVCP;#f*
z{Uw4Qv6-1OKN_Kxpk`=GBTX=t%KanxS(8!Y(9XAxQ(2dCGZ9L(aB&IQ<PSEH`|@Sq
zK2v^Htc`z5g)-4u8<83bz;SmtfD2^vWRQ$p#5EX;j<-~pokF1yI?4X?gIB6c+Zy4{
zC!a-ljYzxG<hlqQHAORosxVj)0YiFbYd{<B7NfA2GyJw9wDF0iDY}7}AtjPJb-60f
z*F{2($IFH75Prta6ujx883i3n__rsB6@Aq&SVMn|0`x99HkIaDL0lG*@3&GFmnSJ_
zn42ZIm?MHi-lu@wP|!*4Njq!`myeeINI(O^NO5{PHg`yKr=+E=sdm%t%Gsrot#6{G
z$^piY1DG-5H99zp^<&v6EesLlM<<KZ^?$hq_!F`D5<1ZJ@3&*{jr4e4lw#2j7G#TW
zJ(GXX(s+Ju?-*ri>qgr*5w2_#ua7l@WU4d4_MlExk-sT$j+}&Cbd*#oKYP1OpjXW~
zy#C=a0}w;%LiQ0E_<Io&PVfa%G&{*&6l2zsz{<H`!tt*3>5YOt1C}d3JdtwMzQq?~
zgO?7WGB;=`KW1~FyR87`)N*mWB|wbdx&?oxLI*3>YAX!nhQD`Bi0}nPIxj8C`h0!3
zh8{rUu8}Gm00fcxWJyK{)10rt{jr`UY!^aTWWhLOO7>ZSbn#V+AK=#kevNHGp|FLe
zoLexx=8>UUNO4OQL0voY(e+u2$(U!S8nwVMQyh@m9C$(xqe)yv>~Yv=78SX$2u6RO
zO|T9)$8V$AdqTkf%V}i%92d)x3H>7|p<xnruq0-pCOhSOcV$D$_xXIm2AdpKk3Q%7
zS+|pg&4V@-e&q0n<@DDsr=cQ3_EUDetgucAijKWKB3~e`OVNV=5`$P#z6cp9*W6o^
zLL#uB{&zR;eb)!!oH@BP|GOkcRg8Z`jv>1<(6ycHMsMFRV(?~eOO1d`QXDx_xbR6E
z7FPG`UlSH&2v2<gpBgR6ustD#b1GbLv7BA=xb~8#0s#>(yVJ=0l<G6m(1)0vl<O}r
zZ|MxlrOY_{P~;=8^ofwLgdLb+%OMo=FmQ#d*+e{WJ8FtawGiY9`IpC-UM_#!c_CmM
z?sT=r!c$%Xt<xJ#-8g-`E^|w@Cq2si${^-i#@1l9fymyj`}WE(5XezZpP7p`8(Ey!
z06jp$zj+lM8ED}p(T^BJFp5uE2t`2IDq8T}LgWj{61dQNiW&Hppd5>tZpD`!?{0Q2
zYci{AtjAP%44nSmsTDq=Ct)OhzpDFxsV=Sz`Sws_oMG$DET2FY+~{XStLw3G5gHs<
z*S<&gF}r9eoVexT3e@<yT%+<60+iT!2O5+7S*bME`07UTBohtHi3<!eU^C;ijD{gF
z!|tm={NVl2Xsg{&49Lfs6-A04b^G|rZHL}h=ZnR>mrpB*wyrgsNY6FfqJ<fMzHE86
z&)5GT5W4sOZ;PgOh<m>}CTp+<^GA>QvaRO-_y6-4Z+u0ZHXr#GzbLq6i%j92ZC<tZ
z{WK9d0-9P`6v$b%m-vdi-d3LdzW(HPqlPNkJg6<?86%b;qPT<HYx4PQysq&FU)K02
zt2bU=^G!*u%SN7FT?@S4BKAXn`?W;v2`VGwf{6He;v-{t>}j``Xbk=?k+Sa9d0sd!
zacE3O8CfmK@TO!L>O*9difraIad<X)mP<{DlC1C75^Aof8YvUhaq8j0aSIIQ03-ZJ
ztBPeR<A?${kB>{Q-kK4dvJr(U`AJ=@8fakRqD|Lnhe-K`dphybv{*ua6t)OL2zU^0
z8DI(~s*q07pYq9alI%UgJ3!5)xcwA?QS;<QcFq9&hv^tWu^NDH?y=*{Gym10TaE*l
z$9%*M!7eu^Uer*o9t)pA<CBU2r!<q5GIS#5KuRy=ny$?jBsog7jal%mEKxSrAS^ub
zS2%zyuxg|mVqmOcge(AmCyP)?8jU;COrj8;LCz&3{z*{`M28pOK>i-FZ8p<GN7v(`
znAHgMmJld@DH+TR-@3TQ5zZnDE!68egBUHv4BbPyr1)v%LH1Kh-D?riHZOT|C(q^0
z+zQk+fY~FK;^tdBS$6Qe0MS%Y*<I7_4CdTTD_01)Uc`<RT%|F82<6@ebR9VUy)U<d
zU3!|vk;NA%bVEc(;EHS+EwM}@&7T;kUC?bfF4RHi3l36_@qGbhXxIsNtR@7jGKyp4
z+Ea>ho#<Irn@a4Ck=2@7OFZM@JyjRbmN<0WlU=X}Or`732S=(`_rBiRZedDW7zJ>0
zFZm^6U_j*@^Z>+v`bt2^rigCO7a^VMP_B5B4r598-avk<hA1GFKsB@+r)r!Z&4Et9
z8~IT-E&5I?a$OFjaEaeZyWsyRTPd9p(EERc&D6Eg-Q4-lvYWDlW<ZnM7n7)5#VWrt
z3Fi>MUekSjgSKoB=TY67!?IGVQZ;5t_OG~mBa6C>0POI8lSlywXu6K=M6P<dH@JI;
zjIreP{TYadf^xX^-Q7FC%f7pLeDB+>(b3l3d-v|%{qFeoR(kj5x7pFn?{2&Q-2Lv}
zw|$@zI?XLKCU*LMIX~`uk5F%3-gvfk_oh1sY6t*UpVslvyN>klMA?8Tj-O28xep4p
zRp6t&yd1!PG0<w)V90S&;KS}M3azH&1a%KGPT8*ZMiZ|z*FXRJhW{G^ryJ5fI+ZH2
zB#Qfq|Ij-I^zq7wM1cRgwSt!3{Mo<yvH$bO!OuF~kIl}?v$%2x`N+EHEvM)6bT%mF
z1I(!P%P&cD3Y*=mGLd$rot1Tnr(_j}by8Q%hkF)(p0>^LU-W<oGys{mn*C;b4NSZn
zDz<3-nqRt4QmnvtQ+?t0YnQzFbM%5+W52+kAPN8evj4LY)W`l}G866>zuwU9DfZWK
zT)n$b!i>}wke4d17$+dAxN#RFb4?zR6HPITxiy+BgoQ`Fl%b+2c}nU>GwxT8%#hKM
z6AcD`L^w(YIKttwZ&U0?f3m^)m)iE~*V+v}4Xc=-oLi|@nbq$!a=8*ZOv8-Y2PkSL
z*XNh9yKkWZ-Kv$On%#Sve*i`pki9iF#a(@@NbD{=4o!fDf>*-Zfkl;<ZSysePaVg^
z)ejDwF5(S4imx31ylO-X*yi-YU6xX$*{mLaPP@$rO`>1&y~Dp2M-p3fbKw50T#nLO
z&-<U5s*aq$tUOL<P*$ODQa(OJq!Cm0xXh)ZCiYqKxwgFb28_o?tR~WCrK^&P$O+ui
zSQE)9XV`)hE==a>m*MYsts9KuaL;t1O?0u0U0KF%s;DL1ql+$^!6RKs^OuXh>z=}Y
zcL4~aYXCKEzijT#UQ)n69xtI0m}C@X@)DBD3-^oU&A&5UWRIc-R2PUS+nbxoqXH-l
zLW`2Wtp$C21pwlGr~-&HPx$PPzCwiwX6*gjpA*5VQCZf69Pu?BiY49K<{OQ#`h6O-
zY7aKPQp-hpo`RTZH+MS(`4E|IB9(7{Jbw9dqy77+h@X_YHcJ~{Yuq3-#30W5*>2q6
zZ};zS^=^IlyWY*n$o3P9#`qd3`)dY=Ut~y-DS3)noJpk1=1Jks)V$eA?%ekFrze**
zqto;gytK8ppW{(lo;B1AXsFVNAliGB@NRd1v>UHqzC6&Nru*NtoCrNmx@FRTeVR0Z
zCtl3+zo$}^=!eWPv3cSHqMFHnaRY09^TW>mu4LoC*m(wcnSMIU`{(^icvK%pd9Z|2
zW`J?vXuFHPA0nzyar3W#OS<y}kuU3)(~s`olUFbI4>*8pj}#9+6bkPiuzC=4fFv1!
zIRN_HDA{OEE~J85bK|pTNv_g=4;xeVzlqkk?^<>&x!Gu}-|8QCp1s-qtvBL&Lv-7a
z9iJ6R(=1*igD3umqih<yZ}O%TL<cpxuZdZrBygw&a#HWsU<F6$iokYKj_n;;Wj8Im
z;fd~|@X${)#s<18M>GfTr`9mK-;x#Uy+}Ye5dmK5O*4;EhQhdc;~Un0V;K0FMbhPo
z;M|c;&^^tjnbewjvqx6z?ko5Gz<)nj=Cvr~SAvg217bkzcVgk$qLO}Sig4Af!60$7
zD#eL?W;E0A;B_ABD&~PCKmqe0Oe%6H^Mb+#`s!dohnrl?E_!f6x_6M}*2{~2=2R}$
z?CPV((EtUwdS?sNPk<kP!j$93<~t&~gosTWrJ=PM@T1{(|0|;+h92b&ND~HVC@WSA
z9IA-FAy}G?iMWUpWEIW+HXg2ck%sY))xeW;EI2R;d=S5^=yv@=<W9Zv?Ku5JuHWA`
z+(r5FwbUbl>zQCylA^Qjt)ClT!E+jlB!7h)F_hx|3KNQc9UaAgWscn!WjTh~F>XME
zyrZwk^CMXK0kGKp&rm>twT<X+I$+HpDHpA+)^;><C|nQ;5C~=~h=N)xH~dv)daYDl
z*p8Jtb$)H6>>ZcJ>InLkks5nP)k1Rdx@aN5Xj!z1+$F0LNf{Er?ub3CLKv?2`RZ%H
z71)uZZ6J@;IH25r*DhO%W!)pHPXpaE{!DWYqFfCp>a9!J>PtVXSsYQ=XeAsD=dwB~
zshTyd0!A><gvZdkgde(PZKyV+VV6718TX)n8re3Ac`_2WeDp40DFSmaeE?sXO$*_N
zA-Tb~BQh+47q^A`Kh}#TO7Qd=Z*Zvx_E$0P<vtQzFB%VjO4(@q5XDrwDLFo63pFGs
zM#&OH%fj0Xeib>ZISQXf6%>OALP5gt^Tmp?7rUY(cH`wv8$@eEd7TqGAzIgtU6504
zR4_Bx3z3j|TIjP+qPEvRN_qA-6O8;8LrCpM17Isj5Kk!th514UEzdHiKYa64YG*pG
z`fsqbRL9qUbYC}Zh$so+hv}Hs-t<H9KI;NU{W+^#yZLEjzSZuVdG2O|S1+BBwtJ0P
z)i*5Osw6xok9~b8-v2mdixjl>xZkLxvpc#%eLi<aS-s8aeTP1ls({>cmX1&8&6Jv=
z6b98)?%r_R#{JW^YKl%EoMvM&R|A*oLKMoQ3#<2kZfPWXD<f2vxhUZT6a29v^{C(_
z$*&UjVUA8hf}=fRnP`#^gl0srdCn!guQKdA81|r&j~e2ld?cH^C`^U*DyCoyEpauN
zb>$qk3HXUaS;CrNs7p}=&S!9O2Jzjtg2UHJXK;^aBl8B@v->i$d39ov3DQrlY{{h9
z6QZ_%GwL2eptf-dEiWPa<uJNXY|U;BEIW64I`GR;H388(bqL_N>rn}wBnX_l%f5JW
zzAH%(W{)?y!FpSS3lT3<E!QOGFYk1tEx2@J0HrbI=cJPI%n&R{4=irwBPhfdreIh#
zYa?ho4Q+J{!9y&;KF?s-gF1|ypWgAw=}<F&41(YeyCYkjRmWCVgQm>S=dmtL5yVqo
z^dPiBgm6!FMd1Z~{#zbqYB!`I=O6A&X`=hQxKFox^4j{SPhavW!psVD4cWGkXe36&
zPMr!bmn0nUNJ~jmJ99uWkiy|wkdM2}qFT{L(fE^tZi4N1ArNDW%#szx5_>WYaN_KL
zPmu!rGqT%2os$kN8RlFKx=!f_xaKgQ=0nS&7lDlG1H+dMz(W_`wS|ZtciAa)yHA2S
zz#Jau<60CtZV+j9fLRVOu+?-AWO^`kkEo(W;gQtp&;x(<X~E1sD}7j@rA+X=Nh<D8
z?VMKILtx?j>gcbrFSQrdc0o9&ATINN$oOCqWpB!|ms$u|BNMGOkTk3Usyp%cLMxU+
zBt92FSb<0O0rG&!`l4NUQJi~~eH~dIF|c2#+kYuZvowfX=7bZ&ea(Ve2>JFW_WH_g
z)*ap{Ll}{}X>)@RGNvQ}<Mbp&i%Yg~F<qoTC1*}O7(+$ivhh$T&_02AWea?NC@>Kb
zB$3yax=K^JJ;c|(sGM13;gZj7C&TYOu|n;8(DRdG`~K)${v67LnHTAeR}Z2@{@S1}
zqhBV|!MS6Mk^6m!T)BL4g}xU2{>!S_tzCnyi8|y7Q#cXLN4D4cVtyc3S;ML|HUmaF
zPUW}Z+MNitR!nWC?|35^&-e;|080e2?$P{-65;4WqPa_dextOm@_m%^5HK7h?N)9?
zg>#d*Kn)}GvA>m=ieF<1Zg5k&(_-4ql^0xeF_36`C4`)5LdqQ1T5d5$2023(7|4@D
z1%OhVG7$oR?!~n{jM@|#e(UxidRszI(s{WO=<b0K)ETT`ORBVw^HCaq@Y+a!8lDua
ztQrk&rDapAaW=GpYbv1Cs;SIhNw*<5wK{<Sf9%uH;f2%0&r%qT$@f&!1(Ah|7MXw5
zxuqDi&kI7>0rQab(P-@F6N%Ntcb42m>#QNjd;5Won#AgtzvBIk@{=Q!FYWu0m5QFE
z(-iTC6#bve2eW@l76d?lNtRI|^H64bUb7(uf^iRQyW7C`Vh#VmhH(>EBLf}4K>E~s
zz)n^6(`;-LlLrH?3>#j^3_V8s!`E*fB?Uv436JN`r`?#i1q2^Ie$`}4OcG}l&=K#m
zi_%J~ibw~loEr#VFo9bYhW$T33!COP;PvjSXU0^H3OBn6#i9CtqO4mDT?P*b2hrK&
zhdEGh<^-1gB1|~f)<D}DL~UK(i)U*d!%#Am#f|P5dTi}y(FD+Vn`_}N)l-SX698XA
z_0QLK6v3J*Pmu&;fGa7eC|^)nz!Gn?%t?<{GM{s+S#&IbQcVjXN076lvhP!;VSPX?
zQ_f1h4aH7Qr#bb1lnR<t>yV3epkSbE`(5h>Ce|fgb+tp>L+6C25@9rG#`9xF(MLE(
zQW(h1VvOMs4LPL9ff@tJ*;?ciT&W#%#|ue!lBWmHpLICNj#hM?XBArqj3aTPOCRnN
z(*TuSB3h&+NRvDlK#6jCnh)6&;I-TBFe)8)Rx3j?&qFnT8Yd+FBHoSof4?M;qSXD*
z{ogOiu4*m+)c^hBX43Wl^JD3L`Tzd0xBr1|-AoRJY>$hvqhtT~ax!g)WqzG`1xx~q
zD1*vl-Sgboaqp5{8fx6a&q>pF(A>sH7$LWl!#lS+$+z!1NfWUP?(^+$JIU6qcge@(
z<M1EZC7s)U9KlpK{NJCPn0w}vvsynf_a?^g{vW5NGfLdl4iilB_P6pk=a;;5|L^lB
zSe=++z{T^^uiDp~AGKuBf5liQ`2?Ot^e&mGcEkDlt;8gC7u{SxcET^;`XAiPKg!G<
zbNOV`hxL{G!oIj{<!!f6<?Z&$PU=GK-;QlqfEWRPJck6t<r)EoI_FM)TbPV8?}!)}
zvfN7|5@}gGqF1?gH6rTQLHg@mhdD+oTi$kS(L|ipU{O#3Z&nD8ivuS*%4^Y=zIJ&k
zbcDO6cRe;8jRdV@EWKW@`461#D-Vak!??-VpY2af=DA_zeAZ;Fbxa6_d7RW!AX#-h
z`Y+Re7Yc_%L}_<XHkIJx*GJcW@!E68-XiqH{d37C;$Y7VB-cosI4PI&y2`9cK4jmj
z4Z9CcH*!Kui`{nQ5ym~c`9Z|(Eq+=wKcAg*Mzhfg0)s{;?c^F%nI^9uJ@(+)y=!l!
zYu^nPqWHZ#uSO?sr0g3h8#f@6U$gHQPee3->s_CST<i7Klws_lAz8F4-N+l2hlbZ$
z%D>Js%m@FpuQi`PzS_Ocgevnv>z_FxedTjz#QB`&APx85Yi`ezy~m%uJ+Af7oQ=Hk
z1=~}8!0x#JUT-?nWdFy{-W}IE4(0dm-v^Edf8WO+zXd0jDP{9HLMv|Y-}bd8#YY`~
z_bbb*CRUjgUy)rhu5)MWTL=x>48Gahn9!Y)&WZ(oDi`VTd;GAAx3`nZ@5#q6TM<rL
z^d+c;{G)vd7xpCr=)9&Cq*RbJBp|y*c!(r1t^c>kW;IDnTE`5`44_UNBt2n<$9(;Y
z2W$kdbcxnI=4GczI^%^pyNo*1#QkW0x}>BYz<MRXbf0;z&bXW7bm7Fjn;qBAbUShX
z{=FzBPTK1b0nTaFPC)#b58b`lyQh!c?rk}RIA4r2H>0Ocvv)I{r=xu7p1#|G)`Hz`
zUStHWMJW5cc%Qw^M~gEyEuSCiV?T^RB_H2?T$Pu^fH6qNV{SD*blr#c%DO0j0FN0g
zuB+Tuw%WQfahtKqr1%tKF8EOA3lyx6brs|n+MQ_MkUD~j1rDPk$_byR7iH|!^0t;T
zwyQ-@yuIYwCX<@2MJ8RwU8K{Bp^dN8VQiKNsU4Q8W<#_!vGc{|logA}B(;KqrW2{H
zsg>n)a18yj!XfVU6v;Ch*7cTuq4*$tQq3AX@Ju{@hrv9>3u+<IrE3?5VR4F<N>9F~
zr%VMkXX%+K>^C~5&0#Oz#M?T%@+_TMEjNMhq!kq4u-$9wmMz09P%xKvcypa8!9Olv
z#E-9N=l)p%!L(o^5Ya*ld~it=-EQUk5U-<I95Lb)7KgB$x;a{%i-xX$!y4SgWeKhf
zSH52L>lo-Y*xu6lJiUk(uU89;6e_MxO8F{{bC)l4=dxApTyI|`Nam4PQ)!@<KNS*m
z<seIZ3W}-AmErbeei1=w9!fy=XSug-4I~_Gy?<}p0CLs@^*(ci(@7+%H{jqT-3R>T
z5I-C`_D&xE?%j4n<9XkIXA{>O&(!_o&?h|p+<YZJB_>q7%HOBQXG>h2FlADBKqQZ&
zL45a|K{yM?w@w#l_;G)hWuxZD&J|5Q1U%v2)A=ZF^syt_{^K$H)oa_`Sx|Plvf&?=
zV<&>9%X!@JlX+T}{Z~bf+hbkJZs)UUnO)uVK2DXpU*neFrj9Lte|eLC%ui3p7qjKb
zN!;iQaN%+PahlIB*0%lhl{NdW5obunduq{(>u#Z*ctv;&%r`<(Z>~PwG*W+D2qZfW
zoMQzeIMFnI!N6BN2#lDgSv9_+0U+dmT3=(KHNaSNdL;EX{!+Qh;%?+z9m=R)7w5^#
zOV4qymZ8fxt#9pr>YsO#4y*fZJG`=^?>deDdHVkU<@6;lg$&o9!hxNKOHQM`jZ;|-
z%(}Sr{FuAgd&n!m&<Jti`4|ENNI@L0$Vd_C#1dEz-%0xan5A^&oVg>=l)tx{9sTQ;
z|Lb=1UBfTgp}x~eoKh|=zq34+rx4#5uP~9KfB;mhpjiWdZ88z?V(UDNi^Hg&zv^Dv
zroSTy#JVBrmcoVo&Zp3RefUsk3Qksp?bJ61?(6D4u6Z6C7#dpB$l3;?mv5N9qEi>K
zFp}6s=9A)jGB*pfy3(0-T_vF+>#vjNzesY&z<aj2k?r*p`kZV`F<*W2vpsK>lWS6_
zEVS$bHp#bt8lBU1&sI0eT~w7_f+}^bU8;HJ{`+nbMqS^c&v5;HYOB7$mw3gNy(XYU
z-#2~fez^x%HcR!C`ktA(`vqI~DW_x7DniZQ0K$jItO7!$MhUB{)Gm+te*3>aq1aNn
zkvywv!q$LCljqXp3tLb?%pL1`=5v`496Xq%YJFXQKg${|eu1m>Y7$b3Guf)pl6fb$
zgs4`Z20^V5`mf{Kz210ltsU>JOU8Rk4nVShTPeQ0Ei`TxssCZz#H+j|c!I4mT+{dl
z!=Zh`q6K-SHrqI^)~1Z~t+_xeX6Jxzj>^W_L^sOh&7M@$(f#oYRZ1{%$Q|h<5BGm`
z|F!UcrdN+1Gq7xy&i}T|^dU{;kx}`fNUZ6%bZ(b}qkNjqFDQZb%i9uiE;EunufL5Q
z-~B*a4db$yrFmA^h7#>O?6RnGiU=mL%q5_p6k_AN47DqLfWJgdSy2gHGDUg>WN=x<
zq;%{cpGi!p!6h>m`6Qp_z{|}4o^^cczKw)`oQuOTq!0~tjcb4V5X%o)h$kx<!8Hz)
zZ2@XAn+^2}S3u6WA7;0c7NU*87O)k+`0F3VE<DT9`BWs`bRor55NV(%5#a;Zxo;Sp
zuuA<FeenG#{~+!!{L#GR=0qbHJ>FV#U*c!w6c#?9qqMky>x}eysM1p(?PrD;TrN<5
zTszQU?J_*~;S{~TuPL;;9QK$l2~t3GIk3r>EX9?<2y4XOe<1W=?c5$ST%so>GFRt>
zpLITt73p+lqm%22Jnj`utwc=11nEh%IAgqwM-?COnt4hz!WySDLldsr>XkT#wbORv
z!K~fGYbNb}v^l?cVsoCJUUSYq0z%$@oaGY5|5>yDWJJUj^IwgPSib@<o^S=Gr|VYW
z#S>it1VHE#AV}eQYY;_EeEA|=BaGtmRah5Lv340SRICGDShEoLSy$r8p3(nleogv!
zujm4}S3Ya<pANdXeC}()FFZ)m{*Shs<%jESW*lU(Mw+@Lnquu*yM}ldept7E((XrH
zXoe%`C>hvr&2d)aCRWG#n*>R$o#?Ivef0Y5a?ND<fKFGU9dy1LX@2QlacB_>HOHHJ
z-t5-^GIy=8iq*CHXN6X*UB1^EKEkYana}DH%0piKn0d)#cG>D(5uLG4^!QI0fx*?P
zEf%9vde!6>_uZNm!<3BVEH1-;lbwZET()>oR*B{0I%V8@l{KSe9U=Xefg9@<L?^d{
zs1#I(v;No8kUiRrbB+p29g9%HzA)uz9oRH8j@I`PCmbPRNbE*y9<?-0D{zI~vfLrb
z(z4vuD1j_~UxQRC6?}ZTPAyTFJn}WgWf06C4TZ*$^)jYfW_hwj4f@P~N;INj$&^J2
z^F^LjidFZhdd@G7iqVA?e+Vt6Ys#nPWu?Lnz@O$U9DJM-+7+35GGv1xnpS6-#-Kp+
zDBE(R1qad4p1vWA_#B0S3Cq&=HJ&E&oz)Ay^rek<ZE!3??Y9HM0P7;O)-Rt=VeEw5
z#*Rl1c7FoTupJ<m{M_Py$$(s51qz_>7d}>|P<vD{IIzeit4?YKT>(dju|q1;BR$;^
zauuV+@d(sS856SnLV`QA9=SrR8?vyl6$OE!ArofNuuHx=lCHU1NvXdCkbM&2Q7(z>
zFfoMMS-UJ}JBQ(QSG;8JT7CB!CdD?3Qqf*;Tr8)+%VAg*5lA|JN#4tPibisNX5$9g
zqddsCI6YOgUjc_lMl9H%`Mz01<o3;Egn%(e&c&Q41NwBj1oD?_#2vH4mrUC%2mo2=
z-|eJT>mQT%PcoaYT99ka3bnNum7AMbaSdiDwOSZ}Iamms-=Qzr^2fIas|CjH4eWOy
zFP;(gd+^uuN|`u+`~XsrYqb-0*|jJDpFFuT98~*gd0=Uh35dEtkx@Hg?PRfpYm#UO
z>lU^fkd)bi-cIL5#HZM%;Hp5+uKZ>ll^q$E1oF8@Y{YJVSk8XUL_l!SvZh>1cZSo6
ziKKord&x6LFN`k$zMNzZ+Z=#CG8L;Ei}^*YZDWTNxgoiK%f1YlGE90iC4+xX5Mi;<
zgT+=XkcycQu{?P2&&2AQGv}KHR9JRQ$^~)i?%&gSv7F%#<xK9ckSN~`?1)b&KXQMA
zA%*K~qvW6zfrlx;xzzaPffPiih>{7x6G|g@SW2;M@D`b$N-AlYo@6|?T}pAnKZ>Qh
zs`BzZNZcKN)AynXpdL5(tcn2wXTo_@yHN2kQhk=sRhF&e>vM>!rXj@-;eT0HcohbE
zCJ+?)^aIS5ngi>W`>%z2g>@=@zme1tZJKdfwK$8!y6*CgxVXac?Jq%h7@Wv=rT@%Z
z(IaUCGbAgut>_*n(2Ce#EvZ%aZ{;fPNsaZ;Lm7jAqe^XRD>t_x4{XFszJnX#D9T@s
zTM~{NB!Mcw15L|wM3MknPb|DtkecLF5v4$=ex6MV1;a?)ImUs(y#dUKcmx5<DD19>
zG2BibzTVwA*bPW?gV(!%ezW&_cd-BF)$Z$^N6+_OpmMrDCcWTf2wTEvO|BX3fYlp3
zaCPE;xhZdVGw#SQT%u_auF>2;kHQ)skk+Fzm?P}UJpVwPU42h*q=p>QP|}|H_rC#x
zES+9JVH<Wr-F35%ANuIt(3aGg4N;HRt&b_fLzjoX-S)*3z@$XNxUdpcgz%nZi<B<N
z)=+VI21gf&PmU$4L0Tdl`7m6#;wZT@;5P$*d{e32GMc9+3*Kbznmx;B-pTN0&pRAU
ztYHy{g$V2!$`kXJ@&$rqP2FhgBO37SA+95eZc@?Z%^oo)%48!P;7)ztC9Kr%?uI)R
zMGTab5;!i@Mv?RBI^u;<j7RRYpQgtb;pS5}^cDL^_fK9*ps*B$^DAIC^El6z2I=B|
zI~R8JDEm;%B$(dO9sU+J1SX2(&+-l8E%HJ-SyC@~D4LX35Doq}x|z#GQK)aa36Nw8
za$)J3J?%M^m4p8~9SM|bDMiW5L$oZ}iAaMVa)FWpoK3_IkeuW{wL?kz!+otx{mjVg
z_Pv2ttF99mW2Ya^bB4n^_Lt2y-um``?*_;EwNqEKT1g~<Qa~|N;ycZGsd%&x(UaVu
zP#2G@wqU&^6*kL=oCM~n7)Pj%{Ml_|W@tu*_e>r}mzphs%wG4_)Sa%}A@b^nJPkXk
z5=0|xjAD^^LMTJvHw%LshjEKvYlRE-?La<Iua=r9F%$88PM&JpwLYy4Nra+*=vxd$
z@H2t{Exc5ouP0|5XH3Ds19&wQt)pObtW}{EgHR$@_aE*(Utx;3z8yG`am?wI$N40h
z3qH1!|M;)}EsoOz7fPD>^kklTwY8~Z^eX*Gr9d?#i0o6H!RZ{8FmxZPw=9sJOt(eh
z3<xJ+ac;N-1SJO1_U5LO^!84FOkz69z=_z##9ih2Y@F4pK$c-tH7j%~vIt4@9CvRk
zx+5RhI3HN)-7ZjMcx1caADN>+L1rUC#qYxJ&X=8jGM4lmRM&~7Lq@<6c0Kj69Vef}
zH?`F=#;Q&VMIue7a%!UI48@I+0+~E1Av4iEtUE@2!>uTFn3&r^p)cBh;+|8!F}8^r
zv+G)Gk%VgA1`%|kTEfz8Oa1Wtv{6=1fqz*FCyunzF%e5c346W2Kl74rD>oi9z*=@o
zr&A}El%;h|dQ{78bAR2#O{Wz)`ctN~Bckt)+$o1qz3vby(v~Zxlf<%SEDnN<MgEPl
zXS`5Z74}t0Hvs7s@$15W2gc)Rf_~$eUE5d|K~u-Fb8X~AVGbf|2bD0L%+!gopL~-w
z8Gns!u-aQ#PGPy%Va57QSn6rwRVLuA;#V!Mn~pkqtI<3M<i!=)pL&RuLCvWn8{iJ3
zl3MlrrE6u|#Ij#Csj2?@Jvvz~e;M0%*}K1kZ|3q>y-s}{tU|nh;FayG3I(>;X>yg)
z7jCmNx3W~FSlL;RLy+7YQ=cKh!~a<-J{i%g1)L69hAXseMK4yZlD#Bq42Oc7xTIF;
zWapDqibVLc#!1vf8gB@T^`P4EjgZfH<Sr@8Q5jAU5@`$<iu6=ynlMig`_(=SviAsu
zg%8Qjvr+Woks?KZUPpp4(aNUSXauVtI~nJbJZgU30(+jr>*e~JWno*opp=7UJ!#If
zU@y_Oefnfz82Q|Qo3*a!-1x=yW*!+hwF>eT8_N=R;BbCVdXf>Dp)@6YJ0o9h?u=G`
zMQX!5ga&x26v3!kR`uElUECk;PZpkeYpPi3#(@=+_@1MGjQEHr9E<s{HP(=+u-=v?
zmEWSm3zQ5|xx5Ag4(V;ixI5Q=3t_WiD(9?h78N^SV3D;M0u{Yn@Mf>S^UA5X++aoa
zTT>LFjL5^&cRMaP6Rt+P{X<TQH^T5q8*NNy_6{Z9YWW7jss`aYD#Zhm>qA2&FlSf<
zH*L^6Et-daua{F<+Pi~EF-3~%V1}~tB*i79=)rs$*Men^?*4TcEt~%=7LGT5{LBr<
zI|owM(%&;$=Cc0S&h@Mvc=XA&H7ix9@Y3UJpJ^`y;58Vq?X~X)=lrB^$D?Yz&Q4SB
zE;)Q9-kOTvChYOGJRD9o7<ne|#6bT6cO*bY;c|?BTqwoo`B`GVWwtt6HOh)rqpMbp
zmkN!k4l4*Uon$NVgOVXT`oHA|(*G5_Gg4tKOBbcNyGqxqIDldwN8FRV)QWvJRhLcj
zui{^E|JpP==0{uOuxX2)AABv5>x9>qq<T#Yk0tN5#T-2UC|jK4jt#q6p#@y^_0g9G
zDei=S%G6^_kMm>Xky#mOHQ>NchmkcJ^>5^&^MU4^a{$MLjcgQ22B|N>;Z7XZ!T7B?
zLSb+dW%RIE>-`fkIHO3!n+*K$;a>mYqhyxPGDkSE4|qg7B3)dDpnK|VLl_NLb7lB-
zsUQ9m9GrA4`|bvxBRXd7VjvtTcvqv-iGrbjEFzjb^v)Km3bb-JXvT=>tdvqA-_w1J
z(g3zyO&h|F456vls@gZx$N*j%?7=8$IXWVh;)2=<?upIKd;;1jrfztfo20+W45g%*
z9$**<&7MLLDw{*-fRQBjps!gbm0{q}L+Dj%R0oS;io9hpb(`8cEv6R}fQ&d{LyNY5
zpk&Otuf1~oAs;Q>k)nq<^1OIaFG$fQjAN5U7%{`mlI#6`DyXGWn1r`a^5*rkN`;Y|
z11%s&*6yT_adFYEM4{LiT}w*qu^<P?bi<`*;)EOjI6IYMR3@gbh-qRTuL-D79PEu)
zJPE>`mro%xm~9&4qokx}@lblleihSyzxL_Z-W-USN|2{7swn1h@3l@@e3vS#e#cq~
zrS_KpJt}MC#^AFLw5m<O?5>*dym%Vk6?fvRT7g3)3k?p6B8_sG6h);@iSyibj02VA
zankV0Lyae5+E#1l;j?zdUss1NRtWQ$vw(9Me9k(PhQu;;)B)|<5_#?PO9YdDlP?oY
z{xQP=T9|*f`1j!p#J}>o(kQNjODafL0dZzUDZUOd#rcv&2uR{SY;KZqIxg9IdG5%q
zy?qUnjW<p~5}UFy9G;DZ*`b_tx}1*HN38c@<jk#Do-l^D=xDyVdA-g}{oPpjpQdhN
zV$Ku>2lbToRu^Y&e<a;7rMn-0$z|j2x?~ttQ-D0*h^87{aO8L1EFEz=v&qz~3^YO$
zXMS;JrB7C?k2)o1?uBD_7)uQ>$De}t&GY9Of@tCK^t4>-;w)kUtC3t~@{b$SK9|6M
zGdoz))so=KFx_Q1o)nIqMa$g{e*Ij6Y2*gLU$U}3v`xk2XoFy(K1J$(s$1!*eaM%m
zq4HWfRu7&T$^c0)qA8gbI0n#&w|+3F2xIB^I~=<77{y;34NC7Kp=^|(1to)$LP~*S
zD>ZGjjEpAgRS7VbWs(?DUQIrkHY7({<smyBYt3aj6boAp_1q#G)QO2OJ<uqlhJ7)3
ze?HHT%<pb56s;_r*J56OA05h(1|!cGTo=9MZD<I$r_RR0r=-KMm|zfE;k~p0s_|Oo
zFX0!%W&eA8e9-?MPd^~4rhib4<-?Qy_wuKIERd<+^txD2J}yzR+aa#X=XpnU10~An
z6XtlW>_Dd8a>I7o)jaQ~ll1RVh1S1~hxF2=iP#FZ!#f@q&KID6QGV+E^wkL9VB=RD
zA0_JbF;H$uCoC&5K-Ad!Vfh?TwIA}3Te&Rcqox<hkz0lLN|$10gI?k-jSQK*%#Iq>
zOrp~#IZq{yUY%H${h2z|mf6qNECY7IoDrLzPH6S$^@&?O*DoYexAKgFkR`i6E#_%8
zqWp1upIdyfjF<j@rcP9-E}+5~SB**>s9cxTyQtJ>Wuc`1_&@&7VUiyg3^s7oG~CBI
zN9O<T>dSF(8-o}~nJBJg9!($FB9e+X0-uWaJ)3CK@tBgeT-;QIMPy*Ev~*mHekS{o
z)m-^~gP<%Nc=9}(F8%WZCn_(ssG<KgtiN#XDnV9|sI<O+CS5Hkn-Z!Km#UP>TEy}1
zT#}(FxI<YH=vbGZQPL4=|KiMR@{g}YhN`}-d(T_WYL+7UTgMV@2j0i@o?3ah&l$Ke
zEq@w^sLZS*6SlB!Z1UPC1}3j#Xs%7`$qX+-96J*6B6I+X5aQ4wiq0u4r}&bqrx&j=
z8+&Y?QNP50Wi*S&=I{Jq#k4NtVVD&HBRh=At{fRa3FE77L||>lUdpgGua`&I2P^x!
z{s0)QGD{6V4lFTi{eiIOH5cIZa#~TI8;$)H1$cej<r3DH_*F5#n1daQrV%@3w&;Z0
zYNL9sG5-LeXCtXQ70QYsT813KYOZ=WSQM1HKBIzvV^?Q#xF#v$NW_?%0GgLtg=2J~
zrm)3go*yk0$0EF{;^B3J4;8d-a}#&S=4OYhRk2YpWR7M-#qHdtxxmlf|7@k1;x#i<
zMW&-`S<IVS4%`ycR4e$MZASih_lJZ&s<*-I8FZ3Fi;OuPBBk|is`tEiASFXICV`pK
zshY%py(n3!30HBd)(sh~4eXQ*7%S4T7L+z-I7f`2My<1IcriK3eVXXXI!-d^f_XX7
zh$J7QtO4hC>v`)))ig4@dQd%v#cBCG&><-_=o$=J)M7(EMoFb%wH<cM$tes<?X~b^
z+DU<J79oUAgjtSFAPJ~w-DD>js)wO_R4j&nCi6i6F*#1EQ`uAVY+NaBS;hxK8U!cr
zn*CXu3}a(3uGY$uOdL5&A!;@)%i=g^FCldR3M`NNiaZsiIK|{=jHGV9E3+ykFnmiq
zthNi4SE}n1YGzXl)+oPp6#1FM%9t?^Y+Q3zVq_%k^|+8nvhj&k<tqt{L+hs_p-O3g
zY&AK0ULgXc_)EqaqX}7)PO4DFGfe=BBFjo)&mSmvh92@Hn4U#;)T}RFQ!6qfR8IJ*
zn09Fw6qa=hia#<~25y5#o@w21O*vJoD@}EaleUJKI@tn#7^%fOLV)4CD5JpTa$DRo
z(viCQNIj#a1j0vF5AWz@bY3LTS~eAb@`Pt|dWdT4q7YZ}Qv?Z4-H*kTg)w|eo16a0
zQ6Ux;4bNxHTriM_{vA2U2s9iC;e1To!`L+r&;-~oiIXbz^0=N^1CYj_b_dJRiMWpw
zHzbl+b^|Jfdha(k->&#)9IJoeexQtlD~aO1`{Fg@3f-@TrOXKVx|5QQHIDs%+#Bm1
zyYI+H-kF63iwN1s5ankpG+9QL7<Z6gq1V(l($?6tLLQ^}WM!&Q<q8SPcYXS7_pc9M
z>YlSD$UsH}l-fiFsywsNu0d4eg2O5ZLAZ4QDbCYrd6LcLc4P8@&q^|q@&TF<BrG@>
zM5n*2TgnFq!k1Ur<)DPpleA8Mr9~lhkf9_z%hw{|^J~lPTzMXoQd~G)*mMkzCuSX?
zYz@r!_9qS3^|9xa|Ho3$)7@M7n1=<7a;&B+vs0DpL&ht|?{NRJXnPUkY)e!rQl?T*
z3|dHv-HFijUOi&9PSUEBM`6jjRJ{0gW#IXaqanXOd_sGm9}^Z|OoRh}`|8q#_qN21
zDDQmVpYbnCHZP<1eQVj;ta87jxO9O+B@SCU<R899@kGKC%DN~cwa7dljaRq^)2ZVo
zPTZ*{p{unZNRKdV#wx;N@$0>0Lbku>nP?&g>`r`-%0*a>zjs%d(I$Y=;PZ8SgAVq5
z$_&7KVaOn9dC^@ING$SyUCq7R>V}IsSK-GbU@S6Cia-Hdo;TJqPqSR8<$qsc<K~=O
zhmwIK9hPB&{34xXKfxXxYSZgVmbKc*emW9!r%;fB8^W(%XU7FIdY-yZW0i?UaNKju
zCuxqLfDj%KL~Muzb2+!EgbafPsb9Nv>q~oFF_!U(nqet4xaMSk7r-&f_a$tHf$r2C
zQ`qKsS(ViD0d8u9o#zvZt2mvurzn=`*d%C1kqrPb>?8*sTrfZ<L@0aAoh){&*+=sX
z@We>o#gqW*pgA3Yc*v$@YM!k`;eOMJ7PAf|UFjN_@NCHU6hJ;$N?;smqGKaRayxGk
zsCw%-Wgsns@Y!g8`1-1;Aumra!jfZ=JL+{XaWW(=&PBJdI=yBt&;#qVm+?58nmcJ$
zEEphzgtT&r)pb%I;EvsF+zNn=2f^FRfjACmi_{?2YxVdcR4#d%14i)zPB6y8=T=o3
z@s)GxHbJ<SaUj^ma1+hOj^;&zVpf6Ap>RDGbGLgEAd)VBM4=J)o6z|gNZYLrMqq&Q
zDCe!=<3i%D?+&EblkPDR_p*_+Qwal+%ue{Vjx{ExwGU90j!;qAmR=>H1h$P5UFwmc
z7|1nZ&Y=#!6T9<836P`KA(sWFpSw;FsJQSBzcG{vxJ9PQIott<XJoV_iHA*$<Wzqv
zv4Ay3`JzaF-t1v~)AU1rDrd)r#|T!V4YM~(P|tCO0O~OV4bGNFoobd6R%nci4oL^@
z%`B4;Rpec3VpB|vQ+Gs|3Rn^We5>ci^;CDOYNl~h=Vs#4O(%tBCYC-Z+oHB^p$Wv#
zz}oHz9ZUj~^z}nZ`R%MI7bZqwKO8@GLluG1-b3Pl1LHddGzqqvY`#!=P)`KzkzRB)
zrlZkZje^u8WolYG$KPV!zIYTIt$f5Wb*3Rz^f|8TYA{QqvAw;WPfrS`ogU?+X2e)H
zMQIxqnF9}?Fz#d``@)3$99M>h02|D}w5ul45Jcz!Da7}AGEb@OFY~cjuPjlOj3_#<
z1)>puEw%B@Ug=?B#H@$(eT0GI{)9o>CfEXk`o8)Xr0Pj0c~ZE)pT6oOKcwYZCwX|I
zL*p@TFvksGV`4FIhC!|m&qr6)v>Utk<HR0lN%sb8@pje$#kMUJQ+@ZErXP5{-n&sC
zaW%C0+=ozrBC}|LL=6(SW&lZmT!NXNi3mD>!H|40u{DT>-HFX&+2YvlZ60&Rs7}dz
zCb(3rDwQdOVK`T4h82j2mYmMR^X%xXDBjC^cLw&cmg!QBjdw(HozQsqqAzSNFG<P_
z@@|&nahKMTIEe<|4)86LXR0mXf^!Sng&`_Prz?T6w+BvPt-eXte^kJ*(RZ55Y5z=r
zM5u0wAG*iVu+zq|=xv@>%I94D^1|JMKgFRF;2DQ!*-z;y{6-~tG1zDj^c<(9mTAKL
zspA;SBP7)K^}W8l)SdH82)`ZYM@)Fp+EgMTzM1Af3AdMl#6(0(i?Uq{$~vL#iV@N{
ztUpD<8f4jVg!U^9W<pyk8&e2ZI%kc4cz26x`hdTcSlIlrC=hGQxP>v-f6>{yMH|Wj
z4E?Ov)D^s<koPZN@XNY~-Ar%`A#I~f9_QJ3<gTqS-WSEf1f@}RCVTd+nz!ZnpP+?+
z<lgqB^ENjh38L`ZEPL->cGRgI{gUi2rz7{{{p6-+$@^Gb`SRYUpP=(||ILek@Z-*b
z_WIo2GjJPgObTx)bnK?)^pv?1n;0d6C>3JMl;M|7{I!U@47Z)9ltQDaF;I{kp3zp0
z$#5kh0buM(&0}g#cuZTU|JKnTI;wHPimB3@?$aWhB|oxMNVH2yXb1toKw#)3!_EG!
zVLSdMiZ;aEujNzxF;VNKX2B1C@7%aGBs)NPz^9&SSB`p=jCoSn8H}2z894`PU?WMo
z$>0xzZG;7BJ89x{z7mfDTadOf2$Fw=*zD+Pv!jWSPDY@-CO8gwx$%`Bus{gGHP(|p
zp1D47BaJgWk!(EM@E{5isM09)p{x@UiO?>kRq>6mz>N>*uRpIoyGxpXJO`Oei}{od
zxg+*ht0v<Wk{gg+QQHtY6SJEfzfp4qd-Vz>8kF|^uyh!es!zkaH=Yec3|7?A<9WU^
z1zE2fx?a&>YH?Fd_i!^Qj*pk~x#W*S9|`g_X3k;x%)E7D17By2C5-acu(oPp#n=+;
zM_~Y(Shj8sDyy68H8%Z!%W-0JJmq%U&<0Pn3@~JIJb(G3`}p<VjayEdSdK?hG=hCO
zK4Nn;CQ}`Zj*zohv&L_Ajl&9WyxoZLUSz?=GkH8NN+1K+p3_gDa7a3cD~Y(a?pt@?
ziajYzM|+Sx3%%f{t-B$9Qdd|lrbZJZc6;K^Whu6Bw2)0@-&&r3F@q<QZ?`)Zm`VT0
z`l0w?9AziCzKgl++sVSB97gbv);3I?PaHGNJJ$QUS+l{dJMPhz?45cFRvY24LuHUK
z*sXhbTZjRo{4c`k<HESAf&T)KO{RrPZKovqh6@SaYs66UP4K`n`DgtPS4u1jB;jLH
z{blVp*ZuJ~`5y;=Z&Hh{{7W+#{*v76-u<pBt!yS8cMAK-AJ&O$|Lp%^@Xzz<a^a<j
z<S*gR{{aU7)G6L&7(!+6w{HI@AH2$;A{bT%ztz3Hb=lybC2#*zkPSz@ZsoVSTerY+
z|G4v_`)K#!f8v#=22dxP->C@Sh3H-x{0+DEwZY%SU3HItI+|(*?z3_J8|!XWtXf@s
zu?y!HIG-j#VbpuG3^kH1wE&TTqBK$k^lp)T7Nc?ld!D5<wbyxTg-P<);Y~M-&HimS
z!OdiI=zbM^OD9}pu(05O`RClux`&cK3={tx296}h0(tQ6_gBx`E6=Mm6B@S}U-jbF
zUFpf*5wSvlBVBn#Uj6plD_&nC*IcVrtkK;Yx8qgH=WC_GPdD={v~rnP{E0@~3G4jv
z&9lzVn<w$k{SkKZxsw|HxEw12&Cc?an#`5WJ>LBR2eyAJZcIFID$>Di^f)`3FBJ{s
zQFbiYcvtR3ck3?Nj5nhgspw|F1zY8!F7{>7wym~*4`k7Eh(?qLnF~OHkTzCLx$xH8
zWM@zEU~Uc4+-zj-j;^4*5v(;E&pep7PoNbGN>DY$jBIh`&vT~x!s3J3M5>`#tX>fI
z!wlJqmsqg?o~t>_AMWUNDIkYINm|oSxtQTYi_4H%z0!FIpqX%-nRgUc`3N{m(3`~&
zkB|+2*qF9@$&<of8G6U^FhM}JC^QUVQn#`4B8K6olFtj%Yp-$3sYpmHw(vxW5k=se
z+x^JIH*DPQC69_FBS_D(<M(mdD(c_Mnd6Zf**9Gn()xSA?ai6sW<~ahVgX0Ru~=Nn
zUgJ(LdB{K-3!2||%R1C*4NU3EHT-Ki8>K#f!&PS`am#D>2{x)MN<UB(GRv}<gP=W?
z>rVMC{`&B_?N6ab2}Ct){cfQ9Hdqt``CdXBRvzDIdvhspx`Jo_vH)R{lO|Lh&gS`q
zCeIN4bVI-E`jiA&X9Ji!RPeRv4SwUF_u192YK?2wRD{5SQH4Pv7Onb5#r+e7HG2ks
zQu+`8Hf8Z9J<GWCk;q44y<h2o*bkLPVqg{h<*<&tCf^Ulo!0lgin)6s#O^3$!{5*v
zJG>zb>JcOG*x1bh(NF0?k-)r|JB2ZjR_Y7NOcnXg;?*>oy#A!+OT4V^oldn1`qD8!
zr_T}!!Mazmfgu>4{XPs;#TmRc(l|SRwHwsN0qX?~QxuH+jKdxtWq|-|^cQWRRO$0S
zOf-$;ULeh`C6j1|K=om)(iXuyBgh<2Dj`BdIB$jBUUDBXtp?bIGY#(foXg2g$MMd6
zS=}^**Bk2EJD)Hr(T|RJ-zlD2TaHK#&8Gnl`&huFC5qFcWfVeB)5IvfTHU~Z0Jx#i
zvi_aaK!uP2rvi*viE1Y*(VL9-0>>0}OzY|B0(n)(8nuAXe}9R9@228;jA!U3bEoH(
z?(GC=A;iZBfefr#YTMUkWuUJ9fVI85@;V@eszE++19SZ?ZUeku)=uJ;C3d04m1J$x
zQtq;1S&lEFI3a&&ET`QNm9_AHAjoB!kLoS*9Stcaa;R9jC7=lBNX%A;A*T4#%%*a9
z82DMf=UsHm538GY@$H)PqtD|2$t_!v8SI+noZJp?Ah#Dt!bmDBz9w1usry{TO7Pjn
zu5wT>Owf;i0^=EwR$zRO#y<+fzwL)V>MEO99skG=-(9AT&FKES!>2`mDl1`inA|>G
zF>jS9wdR^`Z!IQ4`PV!{;wrhQXJrh`@=Y>6(CFOue=g=otCkrFl<Cx`gv`=8B2dOX
z^_{B0w94HssahjIT(RrhhZ)rZ5h74Aif0IE0G^jz<<blTli~!$A%c5`Y9;61GAKs}
z!Jq=hJ}I;2^;(Uxyf%1$n2#$x$;S&8bD-o{C_=CCPl@G?`s{Dr?4qgq<=~&OoHq$U
zuth+O>L^<voC$qMQR(G$TbsAv*ufS$=;}AsF6=qY^9q+w*lO}}5`{<{T4Mm@GRYQa
z#i#=3Jc6L(C8WdXy)S~<>|G)x%<PzZij75oFOD#7muiIP;8>7<E(X{QS5sJ$>cd!-
zHCl*DADZ0AP<79WY*!<`RomFr=g|#=Me>SpfwOgpdp?8`;L{>K>bWgiwk2U4p*H!k
z<+-P8gJ<2oFjjqRN+8<NXxx0UQF7P90YeV6duWO>#a7DE7x=B|rGnmd?jh7w!7<n%
zERYNkcpQ{jBJuHmcJ~Osbz|{SS84rASgBZq5KtX2^~P)`QJ$^Qv>ivWAGCz9UIK*V
z%@$vibqiY2s4~1eU1`57&1)KP{YgDK;WC=dEKU^=Q3QNIJybUr6bm(#lCTOF$)O`N
z9|=>#UUL7Klpl%ZEm7mzFi@mk<naXmJgy`hZkU<VvrB=0Ch&es2sg*5&LV+pKJ(8t
zV8DY(4HZP|58jmegBoPSacu{>^)d*FX10W@jJaau3+XgqwneBIRKoIwRdUAWs8k1?
zSHkF><SQjI#CpY8(6o%i8P2j3Wnq+sL;@0SN;|a}r=GDqiEXciF;ZeH6)w(eQn7qj
zQPo0>c({CjJ4D${y~nFAnFR=}d@38ESQ{)OS&@ipf+cfGt<wRYALx(%47DqX=$fXb
z;y`tWq?WfYsTqgPGRTY(RDlU0n5mMSpfu8FK$R2OzP-~&;MMaS=^Dk!A~`@@X%x=r
z!Rq=FaVqyG)QCsOkwbFDCp#O-ldik(ZuMh~2Y)qxaM)<IHV_}ZS+3ny0K2XIL8C9P
zE-~i8@M@G}^80T~JiZs6G^3+`U}fsVu2SWy!r}<?ZXis1dmU{OZ(0<uq<rs$-Vf<G
zA93no1B75j2@Ah_;zbGs>cJr<(1}O9J=2ICKuIaj7|fuHC0e95MYI@}bto$vF`~B}
z;;{sOERiEIk<;C3ndTcDi~ZHQML;)F45$jQ@<}|mh=Mc+%(2|<MmO1azp})K<;iI@
zfn#E41qOK`D33l81|vgq?n4N{k_oSD4gTO<WN3{d2>B%%7X_?HMPVVXM#tE4R-QRE
zn%HQ2mI6&H1LHU2ln;rvKgs}2K(fCs5buFNgc0(ye`-R3u+19`Z_X7Qzh>M>W1UO#
zvDPh^>@+M9KggV_`y?UZ+*!9y-nzlXWR;0(Gq+{??OVV3L*L@y1oekod;2ewZ|~jQ
z3WQM7%hi@#ZfHCcP#&xRs_ukFg<6J-`7#@Jt{5;d$|jJ{U<|mV6+#Y@z!*r;@qzHD
z3IW<df6yCC(=ryZTn3DAH!FEy=r~4t+HTxi=>@?&=fe4ag1SStBcqC0AMFY=r$A;t
zx0_=?N``H<VWD{ThRU$O?~;{oFa%5j$zGn&33^{*TAVuY=HTI@^rF@NJs#`#c_`wu
zkhE^Pr!6k!9{yH$XWPBtbnsTx>V3pX{_;ywfBouSJNcOrFe+Z0IDIAiz5C{)_Q~^v
zwkQv$cKY1O(G+`8J1Zy79jCURSYAHWSMDe2d5YRactO8(kG3$~Hu}^teC=QPeM2iF
zfAUUHYbVvARfeciaWm$tO*3zjbyqlUrETzTJ%R)LD$?%d&#Soti49)mk498Id6MV{
ze<VPr*DH9<$OkxOm6SmBR#nfA=rtg@MAC|RER}aKU%pxqJZ93Xtbi6V*u72)M^-%_
z^?k$f85MvsO)XC3B8ZJ<rgI`~mL&l6NRLG13QrnNl-%T+K!G?`F+BQ?(xYOzsO1ED
zq|vxBtIPsyF+Fj6j?f6tUjR=}subZwe<RiD8gkSro`V#%1)&Xjpr!^gUyQt`A`yzx
zZv~_NNwVP=3x*^&&qUR;EM^O-oHRiuhRlp!Yj;H+Gq^8QkMzhtwyfMk9GKsA-PU&b
zU6;w`L4jR)p61DlabHU1qVe#(Zd<SaZP&Y;q=TsK+T+9zf~|~^dYl%%J}Q3Ff6Q?!
zT@^L|T~}!(G|qa!)hB5Hp@s<{3N?P~KVtujvUM0TIC1ik8uSZO*1Tzwr0)-nURF*T
zl9RscmrBmMX_wwCx?9!0V!QsL(C^71C}2=>v*TbJZ>+(5du67lbJchsE4;rGeYdJ;
zO-60>>rGRUxm_%ca+H9xjEg1pe?vQSmuZGLU1;!*HWjA8v!LgzHF{3sY71iY4R?h>
zYr~e*iBV4lb%z18F+9bJk@LEE6)mk{1@Nk32Ip+3nna_9r94rhC5Do?nO7zR61>}$
zSG)RTpzqb^H`-?9W*RSU3G!y;sbE_cuPPDqYT^yPT&6Gcy5PBzN?;f-e{m4p;XgeE
z(&{2I+#+g0+$>r&I;AmJbLy&C>~4XvANAb56%^H*gEJUT3g9&ijDN-E9ZZGB)CiLZ
zi5M`5Xk>v8#t<`k7m}ZseSMtwC-d_dboS?G?)}3Q`Ku#KF=H=|D4iOh2uYSY1%ZFD
z=;GWsezzQ5w9S8@)pf(7e_RDgtjh6YJr4|2=mtmq-bv-U^`d6&!4RTsS#W7wz%W}m
z&RaL*6I=mT38{jsuDV!_*JO7XQcZ=gd)$Cr2I_5za3f%O>I}<9pLT^sAdJnm{WhzF
zT@f0hV0kYe1ps)*50`W3F`dY{6Y`!FBb~n5Ct~wn4Rg@x88VCof3)mq2A+A_I`D&x
zL!`duLrT7`6IfJYX})yFc+OOKRtM2?b&K@0NxgR_I51xQJv^^Hc6Du$8;&=2-BU2(
zYOTMnwblLGGFxV)hQa&Uz-2V7nmOXdr-|cUFmbq(?0y^YH#HEido9M32_>+C)5?(J
zer0cz+Qm0sjRDp+f6}pp=!lbC)j2DutC<EN4;wQ$uh>`#SD{xAq@_bJQ0leQ(X7bf
z?KK$<@bncK4Vla7EbpByCgU4!U;6I7{*&E<{(1jre*!<^+j6i3^X&hek3O~&w;$hs
z-R*klNXPWL4;l@XM7ER9_bfGh_`+pxUk!NOkX+WwUcRFKe_MnAlR*(mj?(!TBEazd
z0pG8-rV+0ZI5{&r{1c$f5ND$)J-LRk_@{`1>iZydH^Z+@pb7c-C}qKxe8l8I$5xWz
z!^Ip$WBxQu{v{dy$N&BR^`2#rpQpz>-+b8G6gNGI3s4K_Q(!|Xo=;VQJq?O~rwnOj
zsNcY9VMnlTe`HauWXIXhllR$0S(zxijpr&+d6nt%E6kYXM`GBbj^&j9OH^0xx(Vw1
zy_-+Fw$*LaFj<81LhX7{bgF*A#;hA~S_o*0xaq;4OIR157L)ADOJRLUy{gZzigmq$
zTZD#m7gqig_pc#U*MfC?=6{RbnA|%7jlyyuiF_tTe~9@~0H^o}!4Q`KR&7NHK5ppC
z@d9Y8=!*Yw%_qYL!=AJSyc!gBIhMb=(pWo+U|7L62(8>0CM~<1ul6Vq?hGB+gedax
zuC^I6m4EAI==Qc*9&Ss&7{KiSXGj2)L#bXJtpPv?+tC=m9>(WH!M9}PdVSn_@@nOz
zL{GWnfASz%{kpc4T8~M`z$b!X=`pHA0xH9%$_zCn{|Hb#j%(iCh3#CCc&0u?DqmE}
znnxh$hBc%1lo7zq=1hoiLJA^&G=NfSR>q@o+={@Bnz5|3C8e1_g;vw5oVh+Auh3=f
zh?<4DSUjkc9Kv=b3ihI~YadvVsH{s!1azrue_auxsWASfO6>vGBPMm?Hj!_dIZUe*
z7KXOMmqmdD=e*DprIlXhf%afnejtPqb_dtLJQ49xtOIDno!&n$f!b19b)Hf-;J_&p
z`3ICRIK%@NuWG;vxbk{V6J5x2eTmxkAOD7T`cf0S7d1fX0um5$Gu<MTk=91gQzsvf
ze=mH>i<T6CSLSar&RPnoF_gvJj+_*&fywrP9y)?+Z!h~$mvjL@Gn7D*ofnVH+ObW`
zvsil(fR-)HoQ}w?xjUk>Vrr%E7=1^me=WJ>)Iz~Qa_j$$WJ9!vU_RuUSej09s4JXA
zs{{Hjf2B26+yB0wu4Ld!P#LBqO1pmPf9o^J5g4g2A+1^*{cSy*TnzZ;HlQeY2!=l5
zRZu912t`-|OOArlyDkCAGLZONKKiPXQFXBU?}C`%NYn9I5bo-4CLtePto}AqoA_Yj
zle+d^97x`mxn!dLet7xvnfxZCa|UI+-eyErE5Es0s;p&&`QPN)TK^lF)g|wle|di0
zIFF&)jiVpe{N@)XUNid*2#Wv&iGFj7Ja`ZFW6fB+c4f1V_s9!UP*=*zZ+R(pI@%Cx
z<8&I(=@NSRn*Q8-=1g0epBQl0ubBotK?xL7TlC%}n>e8_eIKKS7)?0MC%J4NB2CPG
zd$e<~E9)ZK#hTxEi$1K#3B<(?e`z|9IE1HnYUfSvO>p6A10wd_8>slPdIM?vedXS{
ztVG7jMGso^He5?@`Pu|IvId-Gv5$()!e_at$xiPuO1?S>w=%*4^<wi<!J!rFduFKY
zx1AO*-_>y0Z@7<Mm_s02FIL&46&d}PDQ%%oQQP7cQL;desm4lOn91W)e^pc&B|y-$
zGF1DGtFA@;#2F7-{!i|IfceVe+#LkXZzWDUYD(_=FeMWP!xPY&Rv}4ch_$LO99uTY
z7n*je7}~^QtRU)|VCB&Tohsrk?hkS8$wwl`73THvjd`RrgSs=&%LqnJrxYqEqDQ@z
zoxG+#5<jgf(zJ<Wv?GTBe{rR+R}xoEY<XP&*svP2blg3FZST1sE|Bxyo&m{I#8Eni
zWEC;%e7a=Zzrj0Eh~DZ>n1xT95b{cne1OFTPAnX%KFU(zwyanhQ7@m&)7cr36K%eZ
z$>)HWpQjpUG+i=N(@~ihlO?Q9s-KB55YV0D^g;qtQ3l2}OQd_>f32YBY;L-v>v-I9
zx<IFo;@7D5=hM8)w~1ZEoI(iI1WXfrbxc0Mm@#Hr7NMs-hzn?aA9Hx5&+^l=G29gl
z1dzFu8R9_}nc^za=Hn}?iPKaTZeJc`b?^&{D(K{yZCNotO{cyxr2944>0mMxu26`t
zN#IHKxC`JP)e7)ge=RpW&Q2C8(Hp;yQ>)@5S~=Amk88u%!HG_{FNY%<IX1*DoBye@
zeYVP0yWncdn40P2I>VU7OA7o!m8B)&R2|v!oaL|J0C??=lmP7JAY4n;TO3SQ5UVuj
z^@xxKTv{3!daqr?Vsb+`ZU)fNl@{aSwZ{1**Rm;FH*elFfAG7=oo5)$=cX8(Yy95K
zTm6(tq*K)KT`Xs@l|rpHHNv&aOn?2qyjB|DE8BKx5NF6=-SOZ)#MGu)4_a7H@-F4I
z*yGasv_cnyjfrp2Z7v0U*u~TuG|yHPIMdydM;bE*Hd)i;yb_nx;BY{eE5fwI`ng}w
zK_|(2r(W3Yf9hPjzdJrU`R;ee-+gzdJDx56_E$8<REo8YO^B5`l$VF@FX6x}-8WP&
zF+>yb`iCae#r1^WMhML<L<h{6pmhYNx@&;BSqrz*v6S!63O#fF2^Hc1#(V-9z{7tm
zEMSrx&+uO%2TT;IL)q*GeocW8g3H0Rx15P5QEx|#e+W$vOxN~PdVw!=0PH-P79hB9
zYm$m%;_ul^MFsWE*!YciWE016K7izhcwzf{o~j2!)>L#C?1yxmNz})XzYIkMk_*XA
z+euIBgid!4xueBAm9iKwJ!tPZyr#APlpU+-%kdbMzV<ERbst}%NbdEFxNXQV{-)>7
z0J&Pye{%|3pT~Ay^fa2lMkH;9?T2J&j2UkkN6966JIYhnbF6akL%AG1$E3KkGGv=k
za_Gw_6i0sr=hgKQ?cm#id^^x@2l;eOFvAUlD(lMAU42?s1CteSXn!lMjwfmD?mDJP
zs!`6Oi|1yyf13fD>j%m}LcbV#&#1=e34+$Mf70y&g#~+)@>B^CE*(cu*<C!C#ierS
z!Qu{$i|J_>q3GNfr;R}Rlk6yo-$=CvjnJrnAfnQFCiQ|i*J+XX5_ePL3L_Y{3=-ie
zJ7zti6Cs$;qZSaSt<ZvYWA#dxui)V{tsTGm4c`wq25z`N=2nHV(bzG#>@;R92Ksnb
ze~g1UA%dx+tD?5khoRKRb$w-Vagc)P#UF~<wLNX}bX&__2RD2!;S8~g|F<!@=WQ(@
z@Z|+M{x*hXsJuOh8oJ?FCT@C0-u%b^{@)xCHyY7b9$x#ER4{elb&}`%^3MhT`5`~0
zT+vDPr^WfnIDMZ<xs;;<o>%szAvr4Ve=s&Qc!T$Ef5~ZXTPcuoIbj>%_k^|f;qWLV
zj4_DUOY!(4H?$oviGGbvr!2g!Qao%d&l@W)=Pvv5wuG}wghFa!FJ(mP`RCvsN3gmx
zJDBJ`HxnmoCUE}d)9xgjpmZ}OAQ6|`Mm5;9TA%JCD+0@k!|!C+`^V*n#{TZJf8B=%
zjwy6v6W!z2FQ01}I-2wk^e}3|2<?|D-RmI?`X|<}L+K|Dgl2I6h~<Lf>d?cc4XS^0
z>$`i$-)8r^TPLGC-J7GEce|t8TgTnw-(_j`UAlGaXe;fxAvcF8hz68=r3pbPfo;@h
z1EDVa3{tNz#6+Cvv0v-3x1ysOe`WzLkfAKsa9de#7fwAj;8|LEb-Fz#-BGICc2X3`
zYv5;vrRpyVMug;}A)1%fcg+v~S{Bn`(o&JsT?j)rzad>!LpMT41Pi{Q1UB3jp|XNb
znpPqrB2skQCq*u^l=uF6(rz>!WyfPyf1D=6R(V_I+#Y&337;FG5;InQe_W)a(o07j
zu<c^RI^9W&sOm^yVo6|cBJ#N2Zr(kacwhe-%bzx5e!xO#4AW7LWC<;Ull*c2<%=#=
zUq1<69}@JpIMc$<r9{ywUmoQtG(9H}%Im5`3vzF-B7l|`lL@SD$LgUfjApipI-()J
zf#zB;@4ytJhWK^_l@AyRe|22&%=@Ke4)Qc&k7x;$TPo?AsgrP|k7V=!8?`+danr=;
z@{3GLSeQxz3d<^Z<Np6#TY>+&_b{_>wj|wnKsh%i0Qb9chfQG!*sCLkhOu;t6S-R7
zY;AAz>vpoUpZwHvM||(afgFEI!R_A<1>|r)bop<uuHWa&SGzATf4!D_shzytJ9wIC
zC&|V)y?nHxeZBZ`=k>#<JFi=}?%r+VCw#l%d%p<1Z(p}-bUQfM`Qh1aD|)Bn8b928
zw~;)2`RvW}7yEuVuXfznDr2e)$$pk`$#UuF?B=uO`Q!jOvLAPzz1eNeQKU(FWt(8+
zYkrnq@c>80`Mr7Ze`0t4pv9;E{ATy{Uj{p`U+?^-74<LUbdBgp{mraH{llmC@k5U(
zUfcNymb8V9(Z0rTwzu^zsSHn6{_(S&gM-}{E%uY#f8f^f_5SXFB=Lu~8{Y>Gjr#jA
z3?^b<QpC@lsXT=KNkI`k@Lu=1ZL&5_A|vz}&P#Tk2uGuAf6F{ba=f`7TD=lO@RqdW
zE{=_;qJi8lfzRPGly(rDohCbug(Lb9@m%h`SMnU$nZocfk9D4F0UYYGSP6uHr58Q6
z4#v6KvNri}|3_=CCE)&$9;jKn)i~oXFvuaG3B^{jxf5gB(lB{;$FpqwH67`f(<020
zojW0g>beNxf4}D_pDC^ZZ`^t2Ci~v;%TZwKG7TvospSQ6Z0XXQ=GZfoKQ1Y#A+%kd
zK1*jlE!i!LNI<;T%2}?MbK%;|EzbAS>&`u~xj8KsPG=MW1LcXmAs{dP1*n!GTW3dJ
zu#sxH_#-4>$<#KbM(!pj6J1(+jyCg!H%!U(x`8-Ze@b$NMe>JW;}lhElF{5<8+h<&
zdBQS{R7c#Z&Bp08GNoHX7C$GzID*=JfeE<o|Bj`5t42+VLv{^fDOJ$e+_X7jmr!dE
z!F=_nWO<;z_B`oI!6oL;njNheFDFyf<ZuIqC4729OJh<lj~IrZd)oo~#I3t^H+lYp
zZ<GDFe?D&~khGX4$dV4s`7}WULCT;!*VNYCdwAWwfziX%cV2ksMsl3xV`iB^sk~sZ
zXdZ9fV}_XCx~Z~ODHuOuUhg>qIS69WNhUCf(ebA@$Zg5fgM(Ly#0GU~W}k1;wdf>8
zDiwfk#2yvP1y_d|*|X)s1NL#%tvIJ8`#_^Xe<=lK5@_q%islL+|6@KHvsSWJ`Qo;j
zdFH8kliVt4K+ag!a>g`OXyEfqHied>X|}+mxmZLWRPoA<aaPiOK+8g?4(*BF^#hL_
zNXSRY=nfd+8JTaCLS}EhBVTP*L4t7`Fwd~kIAs*3kA{*^46U8|JUB!qiQgr&fgKs%
ze-eVg0%GkorhF(HVHC~Q);A#IoTNYHljQ`@-n#ego!fWs+`a2G4oAvE&_7wL5@7P=
z2P+{uRSz}T$h=@^hTAA+3MH*!^Z;RXN5eLXa67Rxb>AMVVlTO9{)h=rMF}Obi-I#c
zYCKQCkBN%?L%>5rM6DV}hO6S-P%Fq?f5_sZCMwvNI1q+z#)DMQ?gwDr?)k_{caqMN
z5_#X=x<iwSaAPScV5WC5FH2u0`=GFzqlnE-FJicFgo(zC#x!F)FXWG|edq|G7Pr{*
z)u3~RyIqE{jf*Osn3Jf=Cbgzxv0Oya7)r_HIl-zVg`u?+hC4Y@rdQDeQrgqYe}!?`
z4yzP<+Expn+~(=1s-_r=m+EyJQY?{ojk~ai4`06e3uPl*zCXNq_9rKI?(e=n7zX1B
zABM6WSy7VVt2YP3K3^XSAPE9f4j(O#-#_}{UF*ik{V_W7P8?C6JiCQV;|4r6PmY=q
zDN1E1GnJ7-)CTG8id|VVvMWkZf7DB~=DNkr$PnCJ&40CCugtn~IWr1T)JU$3j?u<u
z+ET}42i;lLoZ-ciF9=QG*hG1IyWj8idc)++>pdVriiDu6Q4b-(l^wDjE=_-1ms4?f
z0881rR0&&fZ%x2#1}YZz`N2tX@&^v7uj3P&^A=iaZC;GN(2f@sLWcoQe*jb!@naN)
zSiRYkICU-is}E9E!cUql7HklCoI88r4ZCbTl_sQ|;h38(*NhgCj4F@^95b(<r=Y?m
zWSMh;_s(Nf51mjS!`FArKaY34iyo_f_;6e-N0gYvX}*uzn@^<(-qlDru=_^U539>2
znev!ggktw7GOgS4Ru&01f7`=qLn|fVwr*)o9XNKScs;|H=z-US;z!8BQ`r=6h{keQ
z|N0tOxr7Fi?Xabk9B2rh*bfGcoM*hhD!!-6&ZM?CQsz}_(-u>o_KP|~`NHoG7&#NG
zkFzQMEaNodD*8&z-9kgU=IHvs13}}8VD?m^9{M`*L!WKj(WDarf1HRZy_vWH$^;~P
zFHk(j+zdtM5ln^R&5NSRTozz_Rcmfa(xf<ynJiL4Bda1ISMy39$JG!OwoJ3Q`S?GO
zvhpQ~F^Z>lRei<~7$Ojo5O_Scqp(>R!l`nWg-7IrRdc$rh}Vk&5zl00<Ml^Wg#Uo!
zfz@~aO5)<07cA}ie|*iB$w(s;^^uelPCd)5yhXtEmFlQ`{uR!7z1C)pAFjM94gi*~
z7bylQr*W3NlCUMH{>T6Ee=2SxaQ?BR*U!nlVNZ4y;<jB&id8_$W?)S*k8M`VbP*y`
zV)=bo;O7yc0C|5d8FKdYS^D_UlXVHq$?%b|<e|C7Rz`nRe{ty1@5IQ}DnIe7#%{s}
z`@*P~Jg(kvgN^=6l@hdn;*3g+vG<vU8h=@Y^{zp%c-V<<ew9?R)OGG9FXxsn8}tM2
zlzYrJ*4<Z4!O>Z}(Zta4cTX%gD4NdNw>H|w`%(gqJI!Fklhk|;Kj!qbNt|J)lw3G5
zQ)}CWC>>>yf6<D$H(zAuO)Kq1LBayVtP(^Jr9JEBi>UNjdlR;qF%MekEr3aT&w56W
zSEv-q@K@+K?lL&9WpGw1iiWXxuYn#jS!(yBhgHREJ_yk*sQu>FFnaP<<<VQUXKxuE
z{l3$9GTx;#28`@rTNZR^oW?*z!sS3wp=NhjHhL^{e>=g+YUd^3y}2!%cIDn}oy3t`
zMacF9X`Io?B!dtk$NfIO=*F23di)4`Vo}cqEIJpw`|8#rLe5VY9Gnqy_6;urO<%7(
zg{69c0xDBG@Mi_d6yzv#iBsAyV}Qz<g$#IS8HO>V2ymg8udcEuwQ<kHWgU&157owv
z?_}Hue`duLQ=^(|YM}^XQ;5M<h$|@b@SySpAQeCL^9-8qn?0$v>pl=E?@Y>?l0D|r
zs?75~WI9MC=ekfNkv>*M`b^!$f*e!&U|2iDGpLh3%!la@3pH2HX*vs>R%6AWXD&iG
z9>JU6IHhjK-9jB$LEIZ27$HnB)&@dQHKyTcf0q}CaS6llXS9;x!Gm*-MO@@dx~LxE
zL~5M~LX38a-Nlk-gJrHYNAwr$=t|1lp)Efb*&80B)~dR}t($`&|L~pYl4rjG6}l9Z
zXg9;|GVjWd%UoH9mtn)I`KyHU_SZ}V)PoQ#?Ek-*E+htaUn~bzU{l{tqVhdy8g-vn
zf4g*RNVXKEAJB#pi~}_CAq-&6+vM&964PSFUK|1I^wvzVn7f|}frLbK<P?^2nr-R7
zRbzQJ@5Uq1zTX;@1p6a;4X=Df8_AgK-=XT`G)EAXu-z^nXg-vZNbX4em+z@y{g(&L
zBo(cwq>(XoW13yWx4+6hZJ)hiBNfdme?aKS!3cUY<Cv9WtBDwKMoG2ue1)R!Icf1j
zpsHFHNA3|3Qc-7P!3Hr0Qbqx_f5#^%Z`<H<$w`UpIdoLcOlLD1rVR3CogJW~&WPr`
z)_N1J8isPSp0I`>D;kT~wCGH#N)3iHn|cq7@{=`&hv>Fbi2t!bCK^CZ1!h^2f5Ic0
z3AJ-1!VKl$6yHIO+J7<=VSNnr9~v@}Fda8rxY+z`G#4gg9y;S+ajYEQA~kd7wL%%I
z(Ug}@J&u{CVjtL|iBBA$#B_>L7m-cy6u3<}sgKr|*+{jd6wWgTdD&3J>Q9|}Dgt^q
z()EY6Hy_yVxdLA!UTh`Y)Y8Y&e`BT&1d|-cs!%s6_HW<knWxg2P$%VSo2$i!!GlOC
z0v-xg254tKa#!?O?p@KFo5S;os%7q%p?h3nt1n#&Gx7YG&lkv6l1m?hKFOyU@`P9^
zIU+|fk<@H1a;6Ev05&xj-h|18rTI|lqIAqCF25)@!wl~;jFN%;Fs2^9fAW3PRhG^d
zI0A54r=d=ErSa<qJBDw&>ss!j<*v5eWy`UNHJGZ^oZ6G6dH8HE=_e2O`VSu|gJMv5
zAr(csQEU}LjH7}byzDE%$-FBBR?f~0Z5q?;d>m;Ra)hW_YbuTiYm#hRt#KgKjH+Ux
zX+B3fvQAd{_w9ijVlhQ4e}f<}4`dE;_~`;rb$7Z%e5}p5tJfn814@z52(sjk54WaO
zF4(01vB1(eoHS}{6$8#c8R72}Y5=kM>g_&HFC0a_*7_u(w<tobyzUfh@RQ+Ac`-eH
zBJq61{Cf#SdB95MG1lDB?b@8*8tNQ<KgrHs;+6z)CW~yQ5o@a<fBL>U4ThzaVi?Du
zV0>=%{#YDYuvi?St409dFFObW6Fo%&A&-!tXhEh7J&+VJ{wf&J`lO00=V!S>tts}h
zULYMGsK!Jy18O<K8OqG{!;yM0Of+DgaaAaymGRT5td_6F8g1yJcuzrLyhvF9qZli0
zDMy5l(F7$OiT4=ee@E2g7D^zvB{usrI#3~33MC}_`@8=8Kqu5vL$-$?Ir%58%7RA)
z)2q<SExHr|V4VO}@OO6iG4EZevZ#Ba7Hz}_SPSu}_=CF;7FoHbU>_Wbj&%8k)JZ9>
z(PzLw6Yr|8fEL1g{ow3iAI#J8>?ogp*|}c$x8s&55Q_Q)f0|h@5e7^|QyDs5k*LUv
z6?clizbX2DkZX(gsrJq&emGy9b}kTtxLVSwTP7x5^CcC5P6?$>9oH$CC)wh{LN2)6
zl8xlV2WG~SWgFy#>DC98o=Z&*XSxnK*XHKi_>K|K(+7U3)HCiy3o%bbH>8G{`@+T|
zy1=$7G0z+if44aD(eVn3q5<ONp-g&Rr-b98t`D_r$uXtHS@REJ)^n6Ny1w%w)_5w-
zPT^K(J3F&kdA*`Cp($`OR;20A({o}sd<IU}7kEd+m_7eoFAO&9&~p>~euZl#X@Ns@
zz|r=R4&@HdpVE`}X(xHHbFkmBU|+{bpa1#bpp)$Xf7yNc<e__m@E?-xT=l1|9LuTF
zQ$#0k_HgueUhPG-34B;$>5rdNU3h))jwYrC&Ppj!U)A%tkfW{9+c<uFEW}f~x#z&9
z=Yw*Uaex|2BM~gI{a4hUvjPVN@drE?;&%=?hRT0m^As}%3CF_9?E#d4Lv|;ykRWeA
zV0YG~e{QoA{~R-6HCp33v}%=M%n~XRB}C~u;M_zv4VS596yMQP)S($M8^tJRsCQud
zQqjT6M5|fR5{7;|c3G261*~}*U|I1u;$4yD!>Y|1TlA|P7UvNOMAs&01+p?4W3suq
zJDDxQy1Azp#TsVIwctaZZ%WFISVTh74X;0qe<sl}?wGucWa@mbrB)8&#^jfJ`9n!g
z+1$L1q6+2aW-r<0WA;)i0=*xq@%1BwF+kRWt|tC$Fm$~yqLejvB#Mz#5?h2S15zyy
z1AnzwyBvT!S_xG^@YOsSIwqIbutfPzf5?2}U6n;xtezO~E9u4|ulSdhKjah2jQ7Wm
ze~1vg{bU#EtIw#`R~E7*K3onCF=6<Yct^ty%zl8Jcf4MTmV2Pn(Bc!uRK-ooiN$##
zuZW_Xc^;%8rC;CJtC#y|?X}&$dKQ9Jz!p?qmyPppKiYk^%e>=PE1Mfa7TKV@o`Hm;
zZr8n5C*L@zS8m*2f;jbt#wZB7UkJ7Xf95u@25Rj^A4tKLHtlHt41@{go`j|$bks(S
zIrX%tJd>)`8tGYTsIseXi#U=Df5==%PB&t&fT>{Tme=YH2iQfJLL+pXORUU#>O0jk
z>L@flJ(hCCCxEL#jNLr{;B=T%JyL2_O=T#-$7<<XwlJPjHaB;~^5Z2h$D-(ne*;)4
z=!$?nR(q2ME3Cc*lxutmGFAnVgcq0^pPKcS#l`A}i283F4x9sG8<ss42f^xdT1lDF
zNeC<7bUY#(3rkg8mJ6*?2py`$pApqRMm`Zuh|9b@vo%l(#gT8bpu83CB?2drs5UnP
zOC^A^W0I&gWLLlo8=4H_xU%{}e>gnVvf&ii6~JV3^O-<3@X1J+m6klIgz3c8LYmT`
zpyPBY9N+d@Aw;w2U5SvV;v?WI>H+N~&wZtPk1UX5$Bviq5rnWKA!_ZI5M*k4>4fDx
zbG&O2wC30(tX@Dbl$ZyW+JE9&<FXi?U%fc+<p(2FI8<SsxB^55*4wiZe-eNR0uDyu
zaWErqJ*O8E-wf;<1OJYn0wIby6c$u2i9su&2u3=B$1t_cn}vKuZ8DLdad#ENXZ%Nk
z)a)C;+G7cR$QH-Fw($^0g()p}VmMJ_+Yp(J2!(wMkww!c0drnajuK0=6>*Mh1<44D
zsnE;|0}e@LHfuSPyyWZOf8jBSYlV%5OCZcj2!OvRYRS(s(~sLf%YJ-3-2T~GB^2Pt
zcamibJGVRw03{XNq;qiXQ$#6?345rqA(%b&DEt8n82<G;J#4c{=@m^5=elC&(TdHn
zVl9KVlvgUl19*ZZ$hNnyWaC_;jzJ5LN5_c0RwGZNp~bXH3N5mPe`|4368$f3U!CYS
zN6tGx9YsB}*r}SxD$jF<+b8{C`0j7webP!i^k83OJXPh5VWJjSHjU-kMloXRW7(%J
z-k)4({4WQ%tcb%JtW#}3w#*)OdIjT?_>A8?&e)JwH~rMZF@_ab0`v7D=E3dQ<|-*y
zMP5;dQ5sIxQ`ezVe=J+iWy~{7()Mzxv@K7Xl|epulb-e9nz0cnI}-J6a}x*O(U$c$
zl2BW@f6UT5jMiHl3k&Fm^+<aq#W4rZ$dis#X=Z!<d4Uap=OsNK_`m(xaUZ;jPfQ#$
z6tE2`9pg`(oF6wbH2|kk^$v+_Yz-mcS!r3md7d4W)Y>cGf4+wTU-`z#)Me$1$=?>$
zcgnw2A2>a(_B2yFK=`s<TRV7@>&xesjZPG{NGQLdq6CTih-<iXyEgRTK{6VZcMM6$
zP}cBSxHtbSAd#|-od1Pccn~!s`Y%^I{ZLRV#RtiE(Ul)SxY6ge2m^abXRr!uhbRsL
zD8NCOM3Ik<f7$8rSQ{0PBljoEb8*V~VgT2`Fjxt~Mc_m7tuz{M04Y1G2OwXpyQMD|
zeT8{Oarc*BScZLBxs_pJ5RR*8JZ2CiyM1LD;ZEd{M71@{b}d8OMNEuLnu0~;NiwD#
zv1%w^Qk~VFki_BPDkrYK^=bawDg^tnec8LpNE{P<e{S9uSyFF0pB&LUs^yX<leFBf
z-Y~TbqjO?e5^l(AjP>S~5Y3CGGw@jr$2g21U9sZb8jvBtx?eRm%J71+wKOY^$ae%y
zVsu=Uqik0=x;J<W4+_~zJ~}TAn%Vp6xP#XLLLBg_`C%wh<GOCQ{WCpV29?s{CT%dB
z-{xjze}>2iyr?T{sTA&whgl8rji*?t;wVve;*X9cciwc7SLNEfa)aH=Sk$Ym2_8xo
z@FKJ97SspFHN>*x=ZK$Mf(^o-li9L78}^5&B0g+;ciZ8UeDQR7l<dg;WsR*SgKQ0q
zJylH3v5v3dIZJO3P!Aw8GfLF)ED-r1)t@&vf0xsEp&|28i{a~$JlziHi8F$$)Cj2~
z(^FDel>rd=PZNWlR;oEmFeJ&2=Z&MZjG>L`FjZ^A$cK_(J;g6Lbox{}$=NdVtd=uP
z0}Jsh5`ZY|lI2T<Q=h<q(Gy4(f1h6}DZpJkilhZZ6Jr^87QIiQB13SvtBb%cFA**-
ze|e>2Zo5LW8evj2aBsJaLR!6xbTVf1JCOillG%S(5hVRP%CTH6l(;YHm#BB0e~8{}
zU%f&@6>%*w#pzKfSlkP=Wsj>&vu!$&epEU|C%o?1Drg$4Ok!aQg^e`lUJw<O#!g{K
z*ILc)w=R#w=H^;f<xX1gCASQhSgVE7e-IPmfr2&h&0afX;o~r{3yHX<Ph^33Br%Gq
zzdJ-o+J$wfzX%(=Gf>}l#ly7DdgcK#E9_a#4!&kxT?NuK4055;x20+Ajw!j7Enq(8
zp*pG7H??_nl1chr<)aDRu_3g4wmcf=$28i|#_FR9N~?eiD`m_hX*SvudWmjWe-lM;
zFFCnWf{TWVjv+ezQCglgoLo6hx=)j4<-u+1==+10f7*TVpqc!aM&hlzFd+J>NL>Sy
z>p5XWZT#Q+J$}G?VJJw`pY^|w>Lxr8YXRmYIlrN9x6{OkhAFAK9l~%#Gh<B1->UDZ
zk>Xb!;2+rCeO-YtT!suQgOyrGe=%IL$Jj?G>&$JipjL3?rlE=~zp!|f;3?6N@ZsC%
z1NJ&hsxiC5Yzev%L%A~F3%s&!-wr9oaW0s9oH!53;fK$42P5h9^Sr@wUmu28pVcU@
zfuKs1eaD{VPb(}e!9rKOG2;W_E!A8PUpx8oir41u=eR4wwHW6|^OUf|f6PFKF)g+{
z@JeR!(u<keB1TN_Ghk{hbDJ-GFr{WCpk``(lzrHF-Mn54JD0+(R$WxNjrlTiB&owX
z-ci9&CSS95mvvvpJo`|*4+U;nit<REK%Ogk$rP4#bxSw~tztIgEMs#uqX^Y<uA>Yp
z;9)F4uI$QfYy@pT*uRJ~e~Fw)(M^NS#UCP8M)gAdSjiYuiv2Qw)LP<)XX=tZs3KV4
zx<B^VIpBj><>Pq<7qV}g)=IGa@rCd;ZO%Q~&^96*(ZbMCki+M3A;K94)BqN!JIYR|
z6o$+O#e+ob970rMREcOl?#9u&@{$pt*P_(5V;!)_w=e40Bu0|9f6@*kl-aTUu9Qhn
z)hLd6Kb9it5bMGiSW{0h4lFZ(H4>)B^NZOcMCeB$to}~+D0dhs45=TA9BD1-d&`Zq
zaP?bi!Ez%CT}OO-ySk3G)r*rC*D&O=-SaNdHCxfBd>?gRCV&(&v>>i`SCC&c(t*Pl
zO+(H>I&DDG>!@#Qf22}_?w#8?Nr*xjK3pb1zST?R!Y88zcO!_-(O6l?QeDWxk2Hr}
zC5ShBY78t3X7tK$Ct8a_g!sljw=SYlh$M6=GTzn>2Qo?o4%CXucv4ml3@@O%Z9SiB
zEZ44IkE}v&fQA-gCeLUH>*$?2jlg!H)l~cPNl`T0`apTve*+y^(YEj!_aB^h*PQj;
z+6WJCw13|yFZs#Z`Teil&<kINAu1YT`24u|aosDvhcYes`*RcOCGUiWIB47#5%qd3
z0Il7^%Y*@}LX9HX^I)e6v)b@*NobLGS2*8(Xp9TK&hT#NwUBo0u`ZryD}-(3>TZm3
zu-A#ib{K6Ff8{emK?R_mysX|n$?ue65Sn+<2sluc;A*~t=Z3S>Z6CDuw=pdM)GAI3
z5dj(mp1`U|HU=2whiqQ)m6g7^nQ!TmQ9CWlvpO0ZfV!3FwT5O6kvS_X`pG5bqj9dQ
zY-U5#fm93f9A3jVch@n+Mq};Qm3WTe2W2d8=6F<If6SvQol3n@@TVhLqMB3aZ!Uoy
zQ0(|{`RI@>nR!vqWwN4NwF}Z|l<U40?ecensF5Hp$295R?S|_ik(IO+5L_=~+7b|E
z9jeW<zR(n-h2K`4VYmpK^cG@YEamA;y|{;l=~{jk@K3Bgi_~l>!MWg~<i}3TbtiBn
z7g)KLe|7tEP8#0p<ujFfYBxQt6dnUT%t_ICmL>8w2z5zQL&pnaXy-l1o!T_d$vjGA
zUoc~VwmIwB2U#4MBUSv6YZH(UBirFM^L(I*02YXsmeZY&E_Ch0ioF+ng?<)Mpa55Q
zd?9C0S)`e5Tw`juNp|#A8qb#f)V-GV<*Q*-e~Q*mF}H{}J~`~Trj}D;>aFxyYy6}y
zAnn!GR~mMAKw+h9=2a)RZ-Qp5Xd7@%94R6Jf#fJR1QyUs!gZ&X;A6@V<pP&|0;p?8
z3_~(h8SqIY@q`iNiz=oDO^h=9keBN1L}g^%bSeXBbYQcWpi>Ts=z_FvxuJk$zE2ZJ
ze|#tRo0nEvr@xWj#3riC+;2_`3A<=M*uhVP?*G1@KA@&ANO_f7oNPeS{e^VB9^tkv
zc0pHP(4>=&ud?Jutc-@4!!!~|tsnVzzMN{5=LjLkKI56??9g8f00K&nn4H%jgUBHM
zjA!|Ki8T~pG>GAikoFMz@cCi6KSz3sf5ea1MSN7_FgzzNO+uVs_mEb#A>5p*`bb%t
zNHnn7NIWtl`O``DHft!U)z-ks7-0>5c6!t&=_u2sBu`ifI7JC~r$uQnkcNB6QzB<A
zIwpaf8($w{qpTCeK{+PluPH=9_0F@SSvz9JZU`lfk?xek9wns?y;xqoZ1Aj+f12H2
z(R-H!WSc%F+2$!9H=xlpw5BW5LV9kgip=mEe>-dkbXzzm^m560amIHkE8I!;XxEaM
zFm5e+vlzLh>$`ul`P|Ct`NDiK-{wG1GY?>Duj)>a?^Fx$h3a48pt%jW30#5(%g=jB
zd~HX|)6-N6c6e_Yyy_DD@1}FCf59-D_}|b%M=f02vDPllHI5iq9?qQ!wR}!427IS+
zXq@I<WuKTlt#dh%<Leam1wz+R{ngC?8kto?sNfw6=7v<;lahy&izpU)ZG<)4U*fXS
zt#E|-ZM+gl9WGQEmvMB0#?HFSkaY6}6O}w1t_;X2vfvrRCcGd`sp!<)f4X)1PLp@Z
zON$f?U2ksI$g0!?BxU4o6)qvI3Jt-30$`YWV+i<96)O3{&LoENTo2P3XoT^UR?;F=
za17)I<IzH*9b@23gF#l>wu?z{9mWc#%)k)_q@Z7MX3mXoi{modw$yK&PDPX%js_9P
zcPd+TVsV)5E6E}c8ou@$f6mh>6ENMys+pB^!%E3HvNLsw9vLyj@}aN)fb;}huhmf1
zU}~2PlpsIaO3@=L7#kjpRLqg-TBMHHjMPJU#jEQ@0q4)k-H6a;nRu|FvW8<>od|&-
z2riByU-s(+R$)|C1T2Ud&yMq%)8x4E1jjh3nn@yXRY3shnK12Ff6FwAkYTBXp3bpb
znyj}{P$>D2|NZ}wR9iwa$wP(CSs=tXbJFxN++34vluJ=f3%ddr1BK}<1RVFWJYs}>
zAJBX6p@KtL&}_T}60W!|D90p|+&qa<!fL^+$QV~bHvcGFoM*r;x8-OJAK9W|jz5Bm
z`hUtU<S%i*;^8)-f1n?y`M4{%#bOmN^V8`zaD-0`{@4~)dmyyNbPli=#p01w6m(a#
zt~e~rS#lHchzn&tmIRCwjay;vbB!BV#7^pDoQK7HCd0PQqpMnSs97}2IEJC!=7{5|
zHV|qi!Z!W^U%CB(K-SBPemgSX|LMo%!!6&YK-aoKJ*<SPe^@33b*uwQeE}pndGq>N
z5SeJht(DcID6TyTvN44@F@X9R3hD;c3R_h#_p*UMzCEC8l$E4vS;ibtWIJ~nPf?N>
z|M>P#`<}8GE!1~n(s<kj#?!R_*Yo$K)_S23E;Cz}0`%(coP3ljLO(C9?l^}*+>NCS
zy*bfyDHodxf7n7J-Y2X@Xx}?Ac7OjFQbzNWi(1UG7F$gYp6w^cjz>rZ+e{u-SFran
z$|%DDV+gsyzc?i%8yB-l-6|rA8~j#XkUdHihkm4d?Qy)W+Zv>S><-q%BxuwqS-CH3
zx1H>TdwJJRuTgvVNN(PmN-P{8PL15$d@kQb9u#R8e>c72lTX(bP80fsm^v@Bh_|%X
zHfg+LbF&?+Yu;f?gnlT(ZqycEj2Mx`^Os8wD%+`^RvgmW%i)kR@}xJ(Vbdy37IbB2
z)9$jgP`|P--UF0i>Lu$BryOTLGCP$9AETK`j^V~;otE1(__FpMb<9YQKj~@A$;(pv
z-iUfGf2FkPL)~LTPSAYpnw0UpYu(^<h|z(Ey172oJ@F5<+hMOA2|K+CHKK-3oc7%x
z?(@HryE&}ps7zH7B!MxoCG0Q_g%N)*ofL;43ZYLK#Bs2}RrXJI*S7bn>CyFJiTQHp
ziRi&Pgu)yu3l`kHp?dk|=0kZzu4G5ktm~REe~nKZGAm(nho2r>AShNzUQ1BOeNFq(
z-t@2BrwByM%r9;mB+9iDCk$J$Exl#}Zc$fpi^#scqAe9m9W&nfU*5dl9X#HBwEKGJ
zVE2(kMhqVBJ=-0szuWNr42Ax=%?fE|^VHF+hT;TckOcV^fYJ}67Sp4W4MY?rd=KmY
zf6(Y33BxB=7E^lA+e`?Jbws83yp#EY!(mnIqH#2-gjwpPS;-}s`jQPHn{cfwQUVaK
zTC<kLA-XHYs)JScMVCjCbl?|fc#MUE@a*=*%P$`SUGQ6pQ<EX=yg7LK^7Y=qUj|QK
z?jH=R_nCnU!8+*avT*W6pvz(kB^T5=fBZeYB=cMiRV6-U?v_H8iRDO(s~ZPh9yw7P
zC@#L1dTZxT`|az{zsxUvU#_8h^a(>{#GF<hiqKV98@=;s5?-_XTDw`ls+wUuUd^l+
zZIpHRFA0X777JdO#CcRtn^o13;1(UO2Gk;Hh6y}WkPIq7BG;nTJa*DKTwkr-e?I|*
z;ZM6A5f{z~I^R|}OkmcJ)N<xF*PjtoaeBG;=wT;zPNyqVC*p~li4OnD<qPUSZbe*o
z-tK$*@^jI#ysX~(AzP&FE2U=M!>dh1cky}IODE~yolpg;(f7Kl&h;<7eibF}b#|)7
ze4~TNSRmKwoIl#xTb5lU2zR%%f2N68s~PP;9@K}-DC{fsKh>m0h0R6d(X~$a1<$2p
zc)aR^unP#_3yqwuy`AS2t~=|wkET2-+8s@?wc$i1D3$Sw9TmU<tBc;LG6`S!RM*2}
z1~^fs*3Yq{Q+Jbiv7T~qCc-Aq?lTm4-d~8|_AAH<c<B<^&%kX^T8z~ae?uIRR=#O8
zUVA_wwWS!Cy4A+<QX_39^Y>D7tn_V0sPp-}Y7mt)-82LnF~R4^0Pbi~6jRqC4i~mU
z*jhc=&@|GrbUb3zkGdB7kW`*;G<F>0h`$nSjd^{7!H;g(=29q1MSc{L)xv6yl(bVv
z@qQJdlUoYWncJa6;djW-f289%pz`JlBj%03=;Vq3018)5PrGni?NlAX;xtHSVvv9E
zWtV9(V4@DLDO+EV;{N_q2HHS6LpV++dA0kzqE2-bn~!hGb=t1wJgFd*(b<*G4G>Mx
z9puHCt&Ge|CBxW3?5JI8dKF<2U|#|xv+VT5PryLZ=yK8Gr!Ca#f6YezH=Z7V0ipy>
zM>F}YI$C5C<hVP6lq<xjC@&f?0{XCK+9Bvo!1s%}UU7b;1PAldA(sON8jEa!@-_`m
zqmG)}h6l;kdLq#bXivgIyP#Csd)446@KZ0P5Sl&$CxQ_0n?2<+1`2tNBfGh|7adwy
z*j`TMEG|01h8=`ae{OgjNnCfANQSGr4vebjr@o5X@Ee#e+~eEdGpczQRTEBjBnH_>
z8AS4WTnVny8OyY~vs?Nf8L(CfTM*fI?$kD#^DE#-T2>DHrou@PuQ2=u10AXi!aG8C
zLJwAl_|%l;=SR5{D&`j}n0aBs(Nq-?k5Q_CeTW0x=p@35e<>#ZNv#+QFIFWOpOdHC
zpfrIPA>(hBJ7!p<G3TqGNpEg?JVj{+YDQT#(6f5OFrDQC$3rZ2I6HAIo(asx(BpSN
zfU}<3k)2C|q)I_^t`QH$T~^Nkg_OOMfFUF72O^nJu<5M+0pD5#%CEQym8{UDwVaBk
zHu8}^ZFOGMe^x@hM3w#srhQ5Q&Escl$5Q%k@I7B1K%Q`9P7ll|z~)uPVs!u}>3h)|
zotPy^SQMKbX^e8Gw=Zk95VLkO*~{#sl#w;|S^&PKz=dB|IU#hxi)Y)rC)By_V-O-2
zdnHmq<y!yTy1?H08&(r+7^0bmtoNV<^XV`J-}Fk9f5MNRfSizqKm~7hM7TIqV?)fV
zmGn6Gb#c7k{Dj=txWC4QPH;GV=x_{P<3`{7SDg|<3!2-+qgh>$D^nVD0mHAcZ~XO|
zvClJK4Ymkeqg*cq*OF8j6J1LMVeNxbOV);bk6wMJ*GG5P_d1Sqrel)MwKXAkT5iR%
zh1I47f9Z-qh2e#`x_X2#5r<2toED}Ly<uP}3Wgb%Ve7)0I*NFZlqpW$KvbJ%9_}q>
zE1?eyCH3`Moy4}S_r~}3%0O?r%H61;BU)51l`5sIHx!4f$Ii?Pxdd(K7L1{KzaxN+
zvI^3&A4nsB)T!TS<#EH>iGxdyrSjyckP;q5e`2ZTLWdlnO1XD1|49b!nwJxQuA-ag
zXsPE82W<Eaw9#P<AgVX7<pSzG%=<<kuHB_*di;Tqe#gsssi|5aPF@8;)*e;l%Zy^A
zMg6pZ8qH!JZb5H#OkUZ#dGltMxMhN7Q)r1~h=|qHZ>yag^azO(IBatC8a>V9w$<z;
zf2-f#YQEDrHU|AjwFas87N!?&0)*&C5t*bPK_3#RtRJJW8;R__B=QD1WD#L$vW*_i
zG$OxnY|i5tc`E^)!Gp~k#zH*lD34j?@L&C~h7><Gv?eGbb)*1X^~PZoLA4qbg8Yu+
zv@wgL(-DUw!`0x_DvQCl)~-c}o|Z5ce+t~f(|id3Wufv6J&^>l?Kl(Qld=DN@kt>s
zofi7Slc=XP&;O8?XDeBg<rRsO-xyDq)XC;IKkV%94)$Ig?7n`n^K9_u^)pRH#Di~N
zzW&qxtDT3t;m#%QU^EW4k|e(*fBjq1ohMRwUKgQoV(b1{HXiFj;B$%3jc=Yxe>L>v
ze)4ZWV;GgeHr>}v8}IJ)!?quD<6~oQiZrn<&^r{5v1^U_R=aQJxtkhZy>xoo?lq>U
z(L~G2cE%f-goou>!(zgbz`l@P!*Z}H4x;H2xO1st7)GoDe1LY(io$8ydy9(7WAeSv
z(|ffS9miE>9wW=v@A~NWnywWXe<GPe^92h!L7B;sGbVjMcOtTZ9!9{1Fr$i|@A-w6
zp_j_F=44bTZzgM9T4pUus}lg%FGj)t5WQb(tpbrIR<jujZi59cr}^KOSpZBv5A{|M
zksL}eT0!MBAKBABnUTq^@3GTJf+?b)iaah}W{nAyf~C*;@&;8b=ul8>e*#bBX(jMd
zz`lv3KbzHsRf^zGbL_%JP}a->rd70}5}o>}Pm^?{gQ@}*-0G+l!kIiCm#~YQky2Z$
z-^=h%Bp;7Za2(KwbsJULgbvqCgJiX&mCi=d8*`Dhpy8akBZ;uqQHB?NM#sEfqi6wd
zlh+DNDnZHP<-}qi-E|2of0$McWLlCVIjP<;^5PK!5sV%zg(n`Q!J#jm%-{|Y4!b)@
znZ;y68f18e1`x1dnC_WnGQ>g-_9M#vWVkks44LBahXqBXvHu_mTc?ikgsSKgD_oo`
z&Lt@VVKx~>U70Nh#=?rJJ9&Ak5HvtnF~b_-RpRu}548@N!zDX(f9flCpBMJM)HEvH
zqF1W=JaYp{5i4qVez4f_2xvAtJp^v)tja?GytY&T6fB422;$ZK&<%?pkuA<k>0q98
zLw1|{^~mj*$V}=n^S@}FF>wjJaDp?^K19vHkYz_Bs_=TH8Y0D_AOUsW$|+dwn!x7k
zZdq_y9*VY0pqi3de-O)Qys|u*3tuU{t4Q8-0+;Fg%wsWfL^v^E_dgo<iI$a092q1b
zd*guke6DZCX+l#3>Ma*q7QqTXT9zQK!Jq;_NV$LZpYHTRS5YK<2zZ}>!+O3b>0uR|
zZXe-o9H9(#T$ygpr#@Y=8Nu(~ZY9{Un4b7I;`$xUr@K3kf12T>V+aRvtxA0W)IWE`
z1A!izkk}{v&=9oh<`sgz!}v?L2&0YyuEv3nQ8{0KX%=J0uf8<<++L2_(LXG3l4(ec
z0A)a$zfXrh3)j2GmrAz7)*$>m&|l&-uDEz}x>%$@>j4=Ymem>wpPL>Ar!Lb+)afj`
z@Z+4BZXxE&X&Ri4Wq*oG9sny-!RK)?J=Ty)j!CV=@dR&wJCJW}a)W$2@E*Zh%>o76
z9vSzZ!d&D!>jaQmraH2ioYwEwF!SS-Y^Fnx!`Ox(m2yr+1VBW$<Z!t?$!8fD7RPw+
z_P{>JNrAe#-F({hKX>Iz<cWE2x2{lL`UrHIJcjbUqoiR%fq#IZD=Ev*I5||`(kN5x
zZ~#p@pK8Grma6Fmno<@KMLNgj;k8aWy%Sm;apHK7V`RIQwDuuth^o3!)2*BSmswU<
zCGXx$p8vq_LB8e{T`Xr|T!xX4dx^z1OU=lwMsrs6)NNu)?<9wzyDul88zDqo9`EYo
z?WDDTyQ5CtAAiQh5z0{PlQ1ZyU$`}%2nzL%yNPsL^krY&FAva%=c^S{L@n9e+}FtQ
z2g(gXGu3+4Wwr?MJNX0-5eqt3@S$kkN|YuYMb9t_pgK-N`Y#n4Imm5N@=P9%j(TM3
z5)+QoaprRxb#>^(zz-g+pm`}>mk}J#ARj&Ge=pyQC4b-1yv7Wet-*sf>m*1<kFsNT
zt<j2EXP-p5;LkB^qFnM}8da$0D4Rk9WG<Yn;KopD!p-;E#y|%5K)c;ezUQcu?|G(U
zsH3+KSr9Qh{9auYYQ3{lZ}RiJmpq5m;kNhIfBe_~=dHVUqwI{1x;`2CHXZpjPsg*f
zbn4nc9)E*>yyKB9D5Jr*KTNxS2U6Hh_kY1ZH@n~ApC0}*P%!1LL~zAZ@Pm!wvZJy4
zY)~H=t6V-xV1COO#cBChkV@&sbyWQ19$AIy`Q5;>lLmQNjJZD*>0l8Z08IVJJq4gg
z@iG}qsqmv=e=(W$F}wa`x{yDLnf`I+BnkNoG=J(T4H?@wJ#c$4gx*&_5%*6Rd`H%_
z@>~tL)WEKLjsTY<Vz#j}-Y$j&=arwxtg1~0+rWm@nPs>%g-$4PxP4Qku&_!r>tu(L
zY7$B>hSn|5n0v{irNk=w{gW6R=4e^)eOa;ZLBzAb6ss^Tsc9;}MnDMt<d2RH_SH8b
zpnn(rzCR$73o-=!r_o4~ld{K~3jzZwfwh`k9?4Z@+<mh{i$+f@|4vV7{hSo<1rsm%
z*lz#6@iCxtiA6BBAl+EovlF1{DrvR1X;|Yq0{ZUS{+s8`HtymRc^LmYkzuzser^`;
zn=+b@8|^R>(z}vM(y9<?*;Y|A0!bR`qkqGQD}C<SxS?%yLlf=bb%yER4<p*>?P!y<
zfi?TZb9DKp`Jcad=e%#-GjKD}$XF+}-z%PPrOlSndV9M{0yeKe42!wMpmb}qi^v5h
zw0oXO?NdG>hjxW{ZiM%V$s}l9+JVqp^q4df9uzrK`{9GI7}~-lj|`wGI;#F|m4Acl
z(V8jDDOspn{2PC_nm-4@4u`#7@7*w=Z|qEPLpy=_q?DCmOcU7U@RSs+!BdpWq$tlX
zR(dDy>zCxA!rTQhXYY~VD9aG&xOs;sf23>8UAsiYV<6LzzYbTP?};0Uue}hDk~rqn
zB}&_;H1UhTTC2xsdp%DGL+(QG7k}|Tiypx4b!7nA^uxOv_i$e!#B#2L5H`-^D4WbN
zbdTO|B3q+5tQMgkrpFW93ncT>lQ+MXLFvwMC}=_a#I>SlP6FQC{6R7>{k5y5ghM{}
zu~od8N^S9y{-X>=a?71y|5^qH8U!P2qMuL_E%#pNs-P`JXH&6CN7s~@rhk!@tuEMS
zuiwaGhf|w8`Jrv9qhv9%C_Bv@W&U?jBA!3GtLA`$;IT;vE8(yxfNyR-stF*v5(hzO
z38TxAaX1}yO%H3)R6`EemKlXBSS6Ux7F&!32?Ctl*VJXAfPye08eOdt_W6q3!2&j$
zn>#H2RiEPCNkyy_EnHF)ZGWM}AA7F*xJCi5?y8d*v}{;-K?_U<YahN?xJQ*UO|nHQ
z)!?vm9WhvFeQJagORAU%*Ft|xg6E$QD)wcGe44ShA5<zbZU@mRs=6hijy3@H4Dq*0
zsdY1fk-7>ryOq;HlQ<L2VX<VLSi4abs=!9K(As>x>m9n*y_;Rp%YTxCgJ&IyNOf$J
zU?^g`bmu~zfLJ;eKehIz3D-7sP{!)^n|WB4R$y8}ReC51K58Ll4Ks`7;Q&SZjy8q?
zDyPQS-Ng|!EqtN5NNN0p#NvEAsFX*jfP_{Wtl<b5Lo^?oL9shd_|pX)V#>Md88n8o
zO$mYH@A#z>h;ODFihq(6ym`o92doqldaMlatGE`qP1mm7%c_?95!=9!tO4{Q7L+*?
zb(Ob&@NJ1%H4Tatgvhx5dxYF<&~9Q`rY6Fm593`Sb`h5GmjFtM3fZr#<7C|eghNoO
z2-ZPh3wta_g5lFtYu&B%=HVf=s$6Kbr|Azm)@Ug4d5T5>Q-7`Hc6qq)tN4^wLkvo1
z=#fKQ(<LJ;nNutRgikECfSYLOFN$b)wJqc^+jt?-#oKQnjp6d(n&UCJEmDmEVX?{1
zYUog8tuq%%z4eyl0}ivFoU}=d8)%g2yn@T56^4SqK{A4_C<q3M#Xx(1RO!s#Gp(`F
zhz>yjutA<ibbkxjh)47EJo6wahdcCRk`LUyHBhf+bUDHm8fimv3Iq|L2B8}a<yI<h
zt<lHIWf;*;X;JhrVD9dWqvUln&jUb>h9j-myKpI&epgMBD6$ebzyu>mE?}UolxV9*
zjgbseseUvU+H&(-MkD!^*RzQtcQV*!ysWt9X5(URZhtic0ge!gYXeYal8g8w(24Du
z-HvW}K)V3>M{a)3vLiqv0+kd>*LHOPnMxLUEQ3Z9*uO2!A0e<`)@<K9p!_C{lpd>v
zrMoJ<R2iHMDhl+LV;|lWi$9M@TLmDD#wz=gal}9kLEy0BNta5=Fc9lNEMZPD!N-+r
z+Dm}St$!2*N^7{f9sK_5ZZ|o2`RL^~(nX;KXW6toD?D&WZTCVv3n@m(1W_`Yp{&un
zA7Zv6{zX5zZudd#?UFml3#RL20j`uj0^#~gCFr&~WvAWHSd_Y;A&xPAga?!qAV53%
zw9Kd>vZZacKSw`^FFo}Rn|(RzJ;uk8POKiV8Gm8^5nHACxhj@NEPBsr=qu*POYMrf
z46BC4mW<{Ih4mm2{;-_(gORVJgB@klLVkbb{?c#d3$es;loBGZX@O=%m7aCkUslYh
zu@$mnOkI=L;EkVwxT~sE<s#oG>#AuS3M93aR>=RiGtOafT1*t0v8B&M_GJnF$fN2p
zT7R*HnDbv?&Z7)&s8ni{ZU77gP6Za=IB^O!uR1YtB?ugJ4eYNTI;~h2ywciUSY0#l
znUCCxb$pqV{M^4Cw`6~b+=DxQ6^qo9ja(^S3U@6gi|qJpT0rQxa;%Gd<_0)LVVZ?R
zjDWf$@;7^<v_{EWz;+_jHwn)Qi8L%J+<&qgS#;a2U;xK|x;%QPzW8_0e+yoK8Q}m+
zD|%=xMo~vT?M$zl!~L-nj^DNVM{Y`eDM{c+3tx6wFH984d2+amIyK(!A60BA`}oC4
zr<2(L&(E<ZlTkY=CF>WRfi60df01!C8mx_4Ph^c`F+XW0^g!ngNtm|DVj8ed2!FW9
zWXTlS_Cm8;xgKy-#t9}l^q|FZK8-SAO?MrQn5<YL^6stA)mLCC1T1Tx1OFw$>)M{s
z60u9vcM^=^5zA@GwTfUeEW>_S2E;ses?W;yS)m^!==5l{Bv@WP^>AzMs5_?FINbk&
zV2!Oo2&`To#L)mbFe3A^hVKoywSVhh??`}=vf9QI&B@evVZG2&_oNFu3ebZfl)riX
z%&_4-Y;c52VL_I8&+Xu_KkG01-@|S`fb8}_|JKQgW7W83j5Oy9SrYONnc$6DprEX5
z|1py;RKC~BJvKB&Gl%t2#)Esg|2;mtUK?kE^fD_J9@IZ%fmQaB0wTv1f`1qV9Gn7S
zeQ34>fYww`m4;5LeIkVHc4zr?8l9q~#eH+ss{yw$s)%4<Sxi^$)fjAzrz)Kzb0DgT
z#8YiU)tFCnLEG1RkK#0wu=-I<tp=@`@;^NJ(Enave=rnMD6`XvMdgvpdq1-(4DkW-
zxj}AtQOy1gx!xLAl>mynhJV-S6VDG|FdK-&tN!l({%#_%H&?d6tTaAWZGgAtn<*ob
zqLAT;-u(V_{A{~N7hPL;pgS?>LNa#+3>~?QSa#t$aTqMskmv?rDx)u`C}llxn^yLm
zT=<-^0OE>CPZ3XPlq%MkC?;1E=}_aUJcBg%kO@zv2IPrI6Bk~OjDK=S&RkCYR6QOO
z_ULS0OpB#s=%~hPjM?7|%q5H-qsgs9TxFS?%J4?_d0D?z#Jr8`MAGCmMVnT%W$r0k
zasm}O4U!$@B-uYky^Jp;d(%l=4JjZdSIJtEZoYZ5_o&bLHRWEA8SlpvK9F1mn2%X4
z0K!V;HuV4)I^NCAXn!S~@U4@Us3I?=_|l-2dM=$Bv;eJ6$BS~^1UJe?d;wbm!g9`V
zTdQ;>tdAgvyD{*z2j>frkGfCsz$`s<xri*+?%xKjSV2lvE4kl6&2sZCpQUwZrMUDt
znaAZ=-kQW?=`91dXKUHRH~SA?@4Y%0yxKW<DyLhbXyWfHL4P)tYiT89EDl4L=r6`d
z4VQhv$35u}uR~+6WpMiukvRzuca_xy)+~TfXe6$3eHl5$5P8IHKc)bWSjH#22SX||
zj$>%Ft|aeEQP@gGDTXMO-rU^-moOhx*sm$bjE7tEUFPLNy_T#-LJr7!0I<&7yF*Z&
zZTMmF;+xld4}Xh^BR+Snw2l@<+Nwt?q}$1@kL`AQs1bK7<U+RsLG<Kvw3f-Mm-`1O
zSA0h4#^h%ApW{?$@}c0<z!X*}rU8{Nf9W<FKS1`!(@QH29tjqNWr@r~G@aFV1B@=x
zZ)uNC4kzhPSM<ADruEx_LC6j)PBGGIU29!!t?OE2nSaQxZ>?<x5|2VV2KHo7Bx)=?
z`G7pyn8WQYHp&1OjQY=Dt@OOrc{(;C*T5u=t<aQ77MU!_CA@pfc#lT%3lwz(*}2dV
zcp%LJi<vcUB1BF65clC^&T;1N0ch;9J3aX6Gs59=wTTg0**ReZIVK8MqnLT6Y0L^9
zxN&j(K7T<-21~&uB8b@xl<G}@sxM1#CD^D!CwvB_i{m@cShX$`z>KQd(N<c}`x~uf
zfWBy9pjB`wZ;;DNDUQY)!f}OLH*XFZk-aQs(q0u{D-s9Ib1s(D;4nKh3>KL@8Fk#!
zyVebPqHD|5#n)}vQ6O*xu=jX<((5je8#_b*;eSaMX*DY}o$L@B<@PuN5364wTJgPi
zwwR1>^gSRfvm>22)24${$~#&Dt^(j-hU&y7LKb1+)bCIr<YnRgwGTC`MG<X+#e{s>
z;)MMpQSGK-glpI*3T_1WcvOroEMOR$BTIxb!u&;3^(!SVC0>yQh~?*iz21wVy{Wpn
z(|<mh3HBEeXF{ir9!L%I>@=N^Si+?60L{@nD#*&G$n_G;cAP|5k}K#jN$cOAKkEqe
zI-!JkVkh0@e5|*P$2a4uzVTJ5-Bo+3#R){A{LAV@G6`Q2Z-)l=SE=Y4G3|QYT8x~$
z0T3u2@{jw`AVM6!@c5E$VV40Z3)GjqoPS9M)6qr4XDYHqDAdrPePkWX*JwZ)j6_~1
z&3e(wrW@`vR-&YoL35Z@coGl;gU=#=L-vfo{w|#wKy<81jY@+|syNRM-R4b~$Xt?I
zm*V>Rjz)lif>FlFE=6Lt^~jy+HP=vPiyGyz)v^i~bl3n+r_AEwx;SZ?7)h?JBY*8B
z&jFKOvYwS?-sX!2t-{&(;%mM2czzD|pC7#X+{?C{EM{#v;1<>2u`#g@N=-sn2qto4
znDkgV!ed4ME*Z(KO7YkfFV+vWVxm;&tZa7{z)REx<sI(s6-AP?^2#P=(%0$p8wB_G
z4EOVKF?QmD2ys!((xY^Asx|JlDS!TGaZs+s+c!CG!GoZkOsm*;xJ`!#VH(n8JZUX_
z_q)L{DtEe78l+AGjh&}A*ljnw->tmgX2$MAsdWn7Rz?ZCq5M??doW9BvQoMFk{|TQ
zSbT_nX@#MEFxUxFBtwA(Q<~$NPnKGKSvBkaiP^e7qk1)KJ1z_en<5kMU4JLEkEws+
zh8I(o7KFu-cD(jtg1b~)-v|-W685Z#6{Dy~Eejq!Q}|W3u%f!kj^gXMx`wh2a)~I+
zO5m9l-*7Mim-T&!EWxF6n4Z%NbXO0&9bQq<F=kDfv_TobwpOiDSY1NFQ+lHgWJc2f
zK(B(td2U!8!no(fY>wnZFMl<avHE<#`gw$MkR@2vrVOroTB{0PFZMlbNR@DLfK$X#
ztg)4<+a9*}d*fOU`rpqTd1kfp*~2PteY6w~xl)Bj#Fw-D^h~%HlWY{lt5yeG?>reR
z$%ecbq&zDm^hF5;`yknmmhc-|al8mMeU3a%W+RQN617f@#VBHw6MqgE6(`ht`10+}
z{wo;2dt2|M@^tv-);sSn@i-MCVjg2aXnFXGpvX!IWo)dx;nYc?4_<$QxS_Zs|1RpK
zAcAxyfPLfVj~mGq|I>$`CQX$EyYOahCw1|zS$%jtp|JjmERg||G<%M%p7%%Dq*!nN
zfZhJ6So8tRQ6L6zjDO7Eslk3k6R+2UuT1*t|NYiW^2M{%(-1FQ4Z@^G8nOQIWcT3u
zG~$FYTQI!$pLXB>pi=k!@7<IK`#X<!2f&cIcW1Es;^E6jyN?Et%^&D8RiHl@Mk}@K
zBL}Sa>B3hVm2wwhwsEPWwE{dUg*Spt7^*z%Jx9p;4;E#rU4QO!VzIL62jB{y%2jvK
zfU2-G*msuwXm^MT0+!*^eO@Ds46^mRLqwFlGnpF_I&LNYK9kf{tm%qa@q<%?gzc~T
zYfP<+HD)k#(1qE}h;=LBN~PDUI#zQUemcNR*Dy8+x+U6L)gI7~ZSpS)A8c*5y*`_F
zl7pq{%h#$qrhoQ)M=<;)necoL49AgL^Rz*47r^L-Xf!~mN9FR4vbdkVD5?tx4?UUz
zC5iKJt8=S!`(1MXLGp7G&os9a{Z8W+^fI2uS#|Cvrb0n8b|tOEr-h)c?c|x$at_^w
zytC{O)T!ieAx+H5hnOaHRBiwr_6*1J5T`ne8mR`1Tz^|l3DsV^Y)a12q8&*AdLzil
z%!&pEc<4Uzw1xrGVks45yf#qVMf@L2=CEtgXo5783h0N#Bk-P|R<mqnTh<_Y)mC+9
zdg0ddtCht(@ILMpFtI4j%<;_he1$Cc1r=i~7@*2jMY4cUa#CHQ(r47djv=e0qDIv^
z?$3(PkAEGFkh4%Re;AleB$_A|3HY)fY7BnZG9>`=IV>Yc+F#kHMa0ga%%4t~)F0q7
zq~Vj0BbBsJCL3tdJ`F$ela!aXNWY5;fNkRfPmPcRr)e>Ub2+26rF|*)qG};5Y$#cO
z2sfZ92F(mRHp3H5y|*T-{)8afISJP3iWAiG8Gm|C^AB>m$JVz%)^^r#AP-R(AzmMr
zw+#aEvp@+La+r3}V;5mQ-ST$Vsn1n}g05)D?l~E2dwoQOtd`H_v6$lD8ax4c(4A!e
zHYnt&Tl<YNzR8urVoT3fDM!Px!-D%LH#^&bUpPe;!ED6!Ye-Pw1sSaV0Jhu+TxD_r
z!GB&F#R2OilMD2t-;jw5M&SN!fdV&vu8LUnxD3U~{O2h>jg8+Plfv}82<Ktpk55>@
zfRJsD7cV?2pQBn2uvJx_xE1tIfNWscsxd~gB&(YV3m$+=%c5h7rs&fbMqd&8q`^QN
zVa-^%P*Lqi<J<=F^AIK-Xae32IP47L8-HB=uYP$hmqCdfIL*#AROk=Yj_&_^ci*wI
zj)xW$5OC#xA3S89<K25N9zJ{XXm<c;q21T}!*Ir=hzecDz8pi!92t?_g|A$MEDs;l
z7uG{f%YXKZwX!Xy3CHUh@B@G4ZQ#?F?}8YK98+`J%DdK$NNH))bYT?J3W)A0tA8Sy
zd+=A=Mh^6T+BxbR|4Vw`ZR5Wj-9Jj_|8k7K-5;{6=F>~JlO`Z1onY?%azDGjj^#V~
z5MegXPi<4wXX_n@63FpbCq*|Zlmea^KSeJ-M6c;ppNc$oJ{gENXMhHWqEsxTKo0CR
z;~W^##uO^gwv91Pmy@GRD=l<{@_(v#(K2$WN8Yg-sBRum4SiJ(^>oQjK_qGX-1w?l
z9ki31Z{6JLxbJ1F+-LXDSIwtT`rL=+Tj+hw##bMWUDq9z-u$IS9?@s5%X(wllCD7P
zJRG{gAV)eBj@LbiAA+njW%))&p1pZ*;gqt+55L>mx*5E6`1ky@SIkfQIDbZtBu|d<
zgm~+$8dR@1=}F5yv|P5eKJ~ge#rQbuX)3s{YH}&n!z0&e#~-ABgyys-#)f{9=qeBE
z^xP3Cj`K96;IE^#cs|N(OrG-A%YT3d<8gsBaFzFu%MZ;8Eeh%UzDhUOr$E<UquN9u
zyvi!e{I=`17C)#<_S|2<`+otP?^oVz?c$UBY|rTy+wD-%U!sZ%|M3242jCY;^WVF&
zG72=@R3@E#{FN9BGd+0-qp$|Qi%Ois+9<Z&`WJ59@}Su<SLbST+OXZz(3NV;%Id*G
z606m<TlHV-DRR0V5G`yQsH+?=#E(6Jo7}_jq{!ncmvnhTMIyi+D1QMNrA|7G5Q1!T
z=xMP?j72e%5FHLxUmE%n;DyvK;ri8DPFmu9`_u>ot?=f6TyS8re(ZlsPocs177#4c
zO-pD$(n4D?#3VGtT4+lxok}oMXXSS7tZspLIxD9n6mWD3h1B7}fuTb@UKa)8n`rW8
zcOf;aY(*+7s};$Zx_=(uL&dzZ=e5)1gBDlMj`o66@Mfkke+U+lS2Dou-6S7exvTHq
zy!AOpN(-&8-}ERUr3N<_Z4a`)yqT`DMTu9sCDlE?#oaKiBF1Z3#f*31iBj%b*;tTK
zArdhn%)o*zZn%0EuM2?dX?@^w5eJgXd)TOax~#^Yu?YK{$bU9gB6Y_H;9Jm#_KBd`
zY?86+cPYWE6`WZH6t{F1l6ep8My&dwOkWzZ&;c$)f9tyee;mk<nlH&Lel^x*Kg|R-
zPsic2<;(zMNz5|dGtC9(+zo+o;+Rkt05aUNOWtVY@Wds?vOrX|1)@O%vcXp7%ob;C
zG*b`4yDG-%DSvS-5nz)DyFf!nq`(BPbmCktN0kp9SHAGcp90-r*l?qCre)nU1rbbH
z5iRi=^!AQs_z9g7?QR$Zz+*fna1t!`C`oDdZeOd^f5^&y^!^R`yNkbt><@?YjOiL*
z)U>{PL;r0j{x_Q`Bra8@ewIoDZUH~yTqAEa`T3ijM}LoA@9yt^Y&5=#2AcFI7q<T3
z0op;bnW#ecCGNbhzH-FjgJ)(w*+hz&Rvoyqc|OuImYIb>Mn3RC+Es;8IdxKTQ~6p3
z-@n~^@#y*9vuA@RyD#FJp%2K_8ejE#y~bBs0em1d+TUd8AQBP1qQ$-0{`Th0o5l$b
zBIF3#dw(l=1|VVGh5u|mOTW*b=XRsCit@Tl=x}Fot9LULPX!>Mk0i_|5u0!W@rAi~
zyrhv`-$--}@QbwG%Zq;7hhaz{Tq2SBtXChU*qbE8u)vX_PVv>)?mm3G`@_?hFaI<c
zJl{Rod9-t|GZ+jjDT_XNGL8j_Qu(!|I4#hA)PJl%r(_C@2eKioP%~G;;NxTXmwaR*
zvbUz0rsNmG%L7W~<`b*Nb{%DUw~iPFI1dSAS$z$o@K!tSQZ`;PDN?I7lt;D5HP}z(
zRzE-^1SzLj5msco1s<0>ojh?;E$efIk4Z!c$^P<4_CeCA`)qq~>K+@gvw?h3Mvv*D
z$A7^j{yxABCLl2i%yVQAE0v*NWQNm@6d+vyZ=>@xThUw<XLq;}AGC;cyX@*;ar8EZ
zYxVs&ScfLqXQ)6e!6nS?l-$+IL4g>02sg#$$3-t=MYxb~Jhx$Lmhzc{3dVEj?nm)E
zY~2~KBHaMrR8l#;Nw*SQ>|5?t?AuaC&wq#ay?pWPF9w_>*y2G<s@n%cp6}j?m<-}t
zON#QUs)`x81FtnexwWcZe4&i8l4<kV$qC}dg@<F(m(4Uv<_h|jgi{muU4hUbK6%Pp
z6MEeUiDT3=eH4L-=Q<RDTqzh;na|}?0`rV=twSnd5;EZTs`}{h7|vWE8`vWqCVwD=
z0&tPJhBS^=_oY<}f$M3;P#ncu@%UPcQTV$Itd|_F(6dfl9>8u1B?AiV=72&)?B2q&
zUH`08=1{<puE4{6`&NQ}za99;;*ej7S4_+($5c2*0b2JWi<EKxIVXHkNe*TbpKRSU
zI>TWPYT09@ri}#;fMXmupG@>E*MDvdq*ddpgpQ#wHoV*l9%YF-jcBC~&gxb&=IwKm
z(gP~@<$38`E6-b5nv~gGRG+J%Y&}NATlAt5uVDW1gwgRQLEr&y$xWjpRuWx_?aERN
zmdJ^aMh0b>^|z6C(W*K_lHnhqSBX<z-4lq?MJEdx5%n&lXpn;}M9FHaM}HThK*y7{
z=Kx-(&Mk@A^fIZeqKFT2lhlre&`WfP?TIKlC%Shem^mXt+$_%7JG|ojxQ{>vJq5Bs
zm)C<&cWDctK(r4baoES1!V~JwyKPv=gw#8eqZ1Sz=3)CmiT67)PW1b_&+@7-7hPos
z0;38;hFNaqCE6?C-jS!3=zsCMSfH96K#|Db+m|$}QPF}o#a3OL^827TIdPYjYwyn8
zduWL%&oJ^S{!*<uc|3A4Up__4l0w&-0OqfPOXlgbbQC_Cb2}=Eu@g(S!F1`ri!#dm
z3+`p`=YhB2I2oUB?^mj0+Vg%o^GZaRm58Q&2oDUk+HVxEu%?;o?0-<u`#RygAdJHY
zQ%F;hUM02;Sy9Rqh`g9)iACTNH7vNWI3Xi>50U2xf}(kx7+r1B-(|Hm?bK&oO?wk$
zVgV?KmR?s(`tufLHI|#z^y=jlsQHzBS@)z3U}eLEE6po#pQ(;V@bh*B;l~?$U|-7R
zK6GpmDM350_99tY*?)X#`A1^kvj>ygy{)Q}VF&{B#wt1*O`VJe*XqBu?DAg7fe5#$
zHsOnzqZi_K?XV{Ff@Nz&`a8+TtTqcSCI&N9lUASluv|`155usNGp|Ansec&<)0V5c
z)kH$*RQcK5{NvjLi-D~sYK7D)jB{Pq7Nl5jYdd@x8G&VG-hZ{k@?(oapW^_(xhdYT
zcDm`btC@n`%DPK15Z>uZd+y0m*F=rB)tEz^p^rn+UmJ~wlFTY`cz)|cz>35{ImH%v
zVFIg~%hxoS0*EwQXnGCNs4ON;P&<1HBe+`Uq=UkIs;f3l`eXvSDCE?3C2(H^lO|*M
zkufkG#qktPQGeTg2ig|Zbzf7&Fb-HGZ{^ty4MeNmd6Fxs$iksu*?D~xiIBeQ-$;IO
z0+c5;1xUC5#eXYgx+D^bI0om$8(t6LvnY1!KO?^!IOr<OjdQ2rTpW)xyR@SYAmoMS
z?bD7F#j=mmHb1#m350W1n>({vXi`5&6Zqg-aQ|G{z<+Da!V9g$-$+yb8%3UH3HR$X
zdLXWyTEq5jwQ+tMcfg&zs+Xv$uJ#arBdz;yh;Xl^KCj#)LhMJ|<Ui}q$Y<=0fbp+y
zjQMZ7nl!gxfZ@5ln9?`o6Zq;$b(#xUYakn~ybC>6QUpg@9yptNt@symnmr8#^}?g^
zo5xX{sDFAH^^un3g^ieF`x0hdhL<j90?~;`4OW<9NE&gL({L2qo#1v7Hk+>>!RMx1
z`mw5!N1JI2L-(E7n;`<%!lfcFOPz0scVFNUA$kXqx~P=pvWi<#c`gI~eC@MX3Cbyn
z1ds*$cL$SVidvxqryWU^y^|$Ebq9DR%&>9D0)O*1fp-CpZzWItM&-$dB~XMn&Xz~j
zH`K)H4eI@^+qdr8J=e8wZBZG!+7%SNF7w>Gxa{n)MkUuO^y<WcbWxsV*#h|QS=lSj
z({jd$o#?0j>)ri>!M>q0KEyABef%VmJRYX28^Ls;T$^01dfzlE*<E1_r*7nK@^Iqt
zfqy>RXY>0U6rlKy`ZvG5{q1)*M_b<>r+0219iJTEIU1d$-`>n_-WiQ<rnhe0xqE#3
zPL{?4mokZcy{f_to-Ff`)R7y6&fJdPU>2Ld|KT>5e4R4FV3hg`f+7BeK#Xi+U`<$?
zD&|$&_dltWH7%G3s?mmqJq5=yq<sSoG=CWV2$jJqbk3Fn^(zpTL6DOhdJ@;bT$qU^
zr`6#wvc$6><ibfm7Lrim3j?Hz49<!&g1Ng9ztUDs<iaPZLL(PFK!fpIhX!b`ZaVs^
zpbQWi&WV~3WoKY&fTdT6LoFOEj)XYSAC@h61bPaiC(9i97ktjF)YG_iFTuAELw^`C
zggS#$6!VNC-=Wq(H!CH>^rw6x<t?{v-keZA*9pwv3qC|M>kSa?!0Fss@x@$xaCtEg
zfnWK&F@*bIv~=?yxZ^g2&X#evQ;AGcB$wR34>s0Ib{uCd3XMR}`D0{dgP`5a9!dcQ
za;)Hc3#skOQjb`YrsA$NJA&g4hku7?Ql&;kNm%T(5m|JhDFLoban^E(!m8?l4*8A*
zj4)E<M6zaW8j2mJ2Em!*2gOJsYI?~tdpGivYBO%M`?uW={BU9DDIKi`p%c#|6e2>{
z;K~re8^<Anoe|ZL-JGBrr}t3_SeXy<juOOeaf@QC5NJi^j?K&X5%G7?<bUp!ld)7I
z;FrO0G@FCPmJ2D2bL7^NOdC<lWCM==9euKlj5w&w6~l0LM?cL9cWK7?domd<jR3F|
zUtyd<46J~uo;gKkBW|akGYMD2KLiE?<ccT-`9(_7$jBEduKNlnC3?2hI+eHhjHxF)
zM4Ha0Twy@n%qu1K1oRONQhzvHsk<3T0Ug@`!91U+k%LZ0Wt!<}St<Jplb{3+K;Vdw
z>Wojd;yU(+ap3#A){V2`yt^p6@}5@lLBvzZZ|w^%Mmre-5pDPN;9%#;zG79I%Qcu;
zElA!3Bn%;}qTd+Or|wR)HuRLu#&F^NOS13yb@ypO6v8Wor%s(IBY(%75}4I8VC85t
zo^v{Jaq>>!bZ_>0$$mud!FlT6ic6Xl)tj+nbaTQm9Rw-a>xyE}Pzl*X*S%kuj&9vV
z)lwQfPsaf!RIR<nCmj6*9JhGzQTDMTbvxdvc}ZwTk<zNDH-N(x4zlr#I>(SX!Pl29
z0&xh**t1>P%QkWlPk-|ddcRNfz}#}(?Xz-*4852u*Yvm*u5~3got73i7PsqiYWKcW
z%2WfMZA8=@d6blAWcq_=O`b8eS!n6-Q8totiN5S?Hm@<vYD}dY;Yi;Z>A@(wUBDW2
z^@Poq3vpTD%Ord$wi;b-4Th=-R9F1S9a({ejscgM?RVlvOn=O>fRR|ln>%3%WHYKd
z7C>0XirtAG9@@5~RB)7cr~u`b@rey#M4UhWh=zRf>Wy_ng1yE|Tt1ch^i}nKKb06Y
zgWr%9fu0yXaeW#M#cip6?Nd<?tD$DSi^({6-XkgB>n=|4jPx5y`S7IlSKCn*h>GwR
z0m-5=inLrwH-GYM^vUa&Z(iMJ;n+cOGKl5x2SdfZBt=%tm|OzLHC2@1xYu4KoJV~|
z`B6T`rK5?xJm%^7w8B-GOf7MD1-LMPV8>bm*t_=3VpurA1aM4FI0K4+V|8w_e_A>z
zdFn(X$Ch?cNcn{uI#v8fT)yO?Mf?#&#Yw<>=|e^Z@_&BqM0Q^(W#Gl`dBz|Ocb{o;
zt;PeQw$_T+t)cF7Z~GC@s^ip(0O2k_kMtXw;NyK6#vm)x4~PbxL9hV(>C_rn6Uf6|
z5+Ix^J>UQv;9EYgGw4<T0F7CETlF6Wzb*^AI6x#;O{ti!l3%5HVNC`6VOCg7k~S3r
z)Ixp;j(=Zirs@@NGpik{U+qAN&+#Iij2k{=PtOH7g<}-R(sT;VsZ(xG&yMGams#IY
zH_Nusje8#I#9&r9^10Yn*f#gApe9?^rx4e6a!Ws}6~=1AvKo3BD#bd5)jhniwc)=J
zCbpg2x%u6_=M6RiTG>vPQ$X1vxfA{e_lqN^e1Bf>s+R`438L66#Pj|)KgS<G>Lbrz
zKH9x6YoXs%*oZEVxZd<Ou~~J(L2v|7vWV%TG#KO*84bB2PV2T`LD5ypup^;nLx8}6
zZv<H@mV!<33q|y1v#(7bwW`aKqn?HmJchU=@tMn#CDOsV#GmBNazDO$SOx&dq*c||
zlz+;Tg;N%@v047D6FFe!YbzyHoaO6?LCWC5e6h6Z=zR1%vVj=%r{FUzouacW1*zF@
zwO(tGf<*rFs#;B1`OmNY9C+RHR!vkn@`~-Y;}P-~<tF}BQzsZiEyh9jj9LjRj~ML0
zBZV5R-unk8O1oJNw2MKF-J&`>>YlTv&3|@s5aE_q9>fkG5@e?QO^PwF_`2k>-~Qw{
zw93wxjO5lpI=NyLr=MPkCttP<w+E-i6&(ZM=#yRlfGV(G()pbM+P`Y`i*t8e5!?Rh
z4e*ctHbW7kU^YFza6@^^({vcVTd`c;8wkol#WpAAKjA%W6fEIWGgI9Fm=z~+Wq%M&
zIAJ}Ifm3pvNGH8G_P3-ixm++&stOoP2E@+YrT-ay1FflbsgI#;i!M~NoPL^UmeXJP
zyjF%VJDYu)WS+kItRZ|maIIdWZ(Jmw?EJNR=(BqNZh&^L(S15);OZwwup`fX-Y(o6
zX!F+?$T6@pKfMhPZ+zYmwg%GhHGf9%*YrdB$^KC)>hnf$dw_<o(f@S$$=+Wqe{Fts
zW4dfB9Ufg=gAR`_K5zDS259&ivmY&w-;a(yeTBQn9{uoHW4Jpg|2AGfdFiyfRUHb`
z&fG{?-9qz3#whz-Xl!4q*32tq8;UMo!g(Q;#;O8N<x64qLFJ@}AKeV3^?yOl1VBTM
znnFq%!m4O8LAKK>XJY+J#pSJKf~8Y0TT0wc$jO;_RCjHoTprm71wRUKu|$oIjbRF8
zElT%`orAp}cL!8&B*6DDlA0r1wcF1-zZ*oq4eYndy~t8b7d0`kqRCKsD3fp33|egq
zr-l2~$+F+JeMNDgPFL(Z$ba#sk6%!E;zev7A*3FkJNiAeEvMuz5ZL&)G0=$QpOXKa
z&ePc${wSx#`N=qa@7_DgPZ|FVLt1+51oR`;RGbz`5ER&3JLm(JH7x>vQ@U;@-fCG}
z6e|&2itmS;DTND1y<~4u!R=lYr>En%Ch(iRbt_#fOi{JqOsnMV7Ju+&FZm;~KqdiV
z8#Z5}tBdZ#7PPpfYE5yObJaU~$xD2Bo@?C%Ex{lmm!`OgQagqFELNC$HAQ0GX$pFT
zZRe+1VfL9<@;yYKB2g-x{q5`$hEx+vJV9MUpyi|ce}48WvBv61NY0-e#Pf^atpD;_
z{qHBg)d2Jae_FAU=YM{aF?i<j$x-avlfTJ0jB|ZjYS#yUlTjGg{NyNJ^1)wCW{5`7
zP}KAEYTr&O^(2g?xtpTK4(Ta8Mx+RzC8tstnZnqf@;T*um+-kCSR_0dI^HCyj}d3}
z3693MjUgTyN4!jqsVpfSXs0=A8dmRxmCkK0SM+Q~ovTeqzkl@rlSw{ZmbO^MH2a5!
ze9h5(edx!*#-+eJ0qoiBfRY*m4c0!$2<SpcNhwbVCuI4At2_?f4$?wXZMPD`UDS$|
ziA@%@M(n4in4Q`9f$Phv(r<@&iR1~VU3)OZPl)$xu*?UyYS_qt3(?viCJ0pA)Ev`V
z@DN`!gucfsUVo0l(n8#Lc`;q2KPdvh>1^5Z&;P6c>z1O`vf%a5f2~;x;jv*zBhj(>
z`k1ceA;zY;@jo4pm!-OFCXxfqh^rakITk=H#8Cd%5G^}Q#t4iG!9=o0t|20>Mq{!r
z(ODdc#EduO<2%Wk&RAq+lp^C+H$Gp`m|QAQP6USOMt{2+k9+IpAcXDXiHf-H^SiC4
zL(UTRa9Ja@9wQpb!tBggEO@v%lw%VONYO_YnL0Fd4)yT<4QeGw)?Ca}4GtY&=-xWP
zdHGXU0!O-|>_dxRY_<bV1HaHZuj52(6TUAmd-GpmSja~0%A5Wzlq5oWGYW8mYUJTz
z!$+;Q{(o1b^T++`|G38p2-3~PW7W3njjXn@z7h5Rw%CZ(Yr;Wrvj{m|0E?1PwPLpD
z=8S)n1t&pxKe5|1O_tKaqvG+DlA~Iva~r5bt~cBL(x{MoF2pC^7F?v+Pw;2uSg%6L
zCkk-o<`sC>Xol2^mbu1`;6GHj?eE>$L6iaFQh!cP<kfmGLFw5D;7jI?ca$0N8je$z
zt>Y{<6yyjh6-ZiB!;!h{-XcUn#QB6B&nqaes?x7Sp<DH1b&r*T+MkXlSpIqbAs=U_
z45a#_DL#yoU>qUBK_z}uUFLG%xP$B7ED(8oN&YEgGwhkJ=$c2_;vBQuBE@apga+qz
zt$&o^9Ecy(mueV-(lJ&qgZ`Q^`Zdzk(gd`&@_HU}`#6tkfQU+0rj?s(t!7GjW4N!Q
ze9_k$HnQ$cQu?Wq3FJ4O9<w;k=FMJwmBk)*V|woYBQ7;R?$bwI4XPf<vvG7_r4d}&
zo14J5+}zww4AZC{E!bHdXcR2y)N(DA$bU)JBSW+&@gZU@@W4<9Nny;9s4{Mg0xErQ
z$6?))pn=182mS~3)>qLdRQ_0J)^U`5h)9QiEgY;|jR%uTwFvcagBIttClqeG`HsId
ziZIk4q}4+LdeE@dMP!Wfw2B=pmq!#BdEdRV)p7s172tNNq?)c%1vK=m5^+{3*MF+<
z3c<5(Wp(MT>3D3Hv+Rn<AhJVCZZv?8P|CeV+wNhAX40~iV?SEv$Ww~Nvv`#GbevBE
zC!<}eHpJXlz7_A1L2Q1ae`2&py*lk`TCA|?I0806r9>4d!UI>Sg$x`|r>9FvwXAvM
z)77n;S}Fr)9L;_sK&fzskL9~q9)EtvdhUbs(|SFSM;DF<p?Fn#%K64Z4|cLrU;v0Z
zlAApICdhl0xg#JX#nC=mk?BV3s@5C)wBD_m+I<6vNDRut%f>2+8m$7n&xasZbq9NK
zqIn{<2Q`=2(x!t%o>s0<J%Cdr_>8+@;sH1`2>2a%UOyoB&N1mz6l!pPLVxlJ<wh#n
zxf8RsU42bIMQ`gjY(!-Dco}@sH#TdyGR9$uZq+k=#mTKClB@{ic^R*{uWoF51|^>g
zn#p2bjL9N1k6aS_7NX6Vx+@<dnh8J*fng~>ciAsk2v8E3STPdyniWrjywg|J_y(Zc
zhweWw+z8$c8KdhK_@pSh@_&=ybiZ?|%pw-vE~8zgb*)6M71idaf{v@**uE}(V7OEY
z9m%<(D<VVO2UbqXJ91|!4hy8xt$}_AOu3Q2*4mP|Ov!Ia(ZHiBj#gTetEw0Y{Ld5s
z);?po8!FVLry<uW=u@TEmONj5!?>51B-MJ~sq19rXDMYjR=bj@Z+~Q=^V#-FNy@Sq
zf6&lM7XM4D2Y#azb)XPwKg2E+^eY*{8EDgcyR2;boMmKp0`6ck<S2%Y<DH;Bx^Asb
z9=vx&ex@A&eMS9qt7`HL-()(L2Wr}3Dal&FZHNf&YcVfKInGKIPE^F*MRCqfvhS$&
zJ;R}&=g0G+EKU~50e_Q|yp9qDxoR9)7!K@1ax1x&M(i8QJE|xxFTz=~QLYw(UnBTc
zQdgu%rVJ4GY_)pkpv3ppRF?P+NUOWTU^ezMso*7xvSwaRW{W&O>!z|eb3}Ajj7J+C
zEd{@zt8q2&PTmU$u$6^3Zc$3a9X8FdT0^SS;X|FN4j2)%(|>II=`y12%Qn1Rv#@bi
zkbJXlF*kVCCmO@PX3Ijp-mj9|a=BVzi7LmJ4kf4!dd$UJys9va^Y_{R<+X)I;}wjb
z%@^7Ey2Wa;PeK3-0P7+O!i;lHg2nfemM&E;f!K4Yf_X_}pf_V>yl2C)$U_DAT1wGx
ztMmTPgr)zS34co(hU(_RG+qxA0EihS8F?f~B%vnsV)Y6lI0UKbl9s_SHGEZn@&FD(
zK$pA+BI+ian>(ROn?4B)z7p0H0df`cF6N44nT~id49g4GK5<thX&sHz3ugf6+L{GJ
z=9;ZiX-`5lc^@8K#IDHA%~yM`5+t9DL+plo1H+nUr+?W`7$wknM5=b;(t8}EkVP4V
zhMJ@`U(Id@TMdn)<diIB#Wg9_)5`a`(<hdcpWV3LvjUf4LIGP=tYvv^K-E0oYPyLK
zFvOn2)3KA|$B35)TDH8qGTd*SIGt%@10(cE1eHd*l}6fvs-^dX<`a?UwBxK(cP|ZP
zGlmJ#6n~IDyRq<qkgqO?r|;HrDYJbT#koMb!z}2Oar-uS_VVG*v%#a?SGzAB?Y?-p
zx4S=Fdo?93+{<a#7gcI2M%TJ)%yNqy@qvXk8jf-kVWPY>R6kjN2S#irl!DflJbEyd
zq>#`pcZ|0utepTgsZbWg%E`rGCmHgG0O+=MTz^g^8)r6+OCIs!*_yj1pW7HH;*nEa
zXZeUSye=$kAkPgJ1x?$+L$1@J3S~P%f@m}jqfZiyc54uc81XTyDo5!ELO@xQh`lsx
z!kg#ntaCWZoOFlEZjGp0+PCUbehe!EA*L##1ZWWDNIu=h40cX2{eZ~sN#?kPKnURW
zI)94d@G(5EmMx<D7Yc4xRxh^zU}QNpG(DUb3cls%Zmn-uQr%+YkYlO!piko-1$Gcc
zxtjbJ-Xd7%=@J!p2%g|5O4wL2JuR??$O&6GUD36Uq&^Rk`sKOj#KpU0azSYKJ|2If
zBEP~~mCfIMY5@>Jns^lHNjeHCRr2EV*nbnysfZjrdga-2A-E)TW6q-z5|T!wS!>?R
zl52tJ4|(a<u%%4b{rUb|2Cu$dRaE1!!O)yBRe(-;OlJbjN?ihv)TFOe1l#`4@u!cG
zyU%qh*Ntzp1<zY#!Js#>9RR`UJ{x5pidhLVn&f3k1<qFpfw-0vUnD94kUaXq?SCNw
z*;9jOPCpd+h^q;KLA_FY5iL8W5r6#bOAzNGNSAg{Q$4DeiHq1B@K<6%rsKLuZRj&(
zN2(e-!Nv-}GUbk!sxC4yWB@Bu;MA8|E=ur_b9nK3l{r@fh7GJIJI&RwVYY$zR6DgU
zo0cMv2y(rXxuzMQgitCuo>*-%f`8-(NLbg$Nuf4QZJW``C~{c})DGiDVbE5v=a46V
zQe{Des3EFG%xEK*t0%9H5XYYY+I&CRK`uV=E3Ihl;w+@x`Tk_sLv(3Q6{BzHhaasz
z&Z`=ea|&mj?V+Ixr@opG20q>)hC2NqmoP`C2$k=(L8Fs6&v5RfO~^Sgr+?bk+0t*6
zyahy#_D1l{O}BRWWI6F8B8wA|S^dg2#vU))QHD<L-BbuzCqJ*-$d#MnpR<|P?b;0;
z{7jtNg;R5NbCX9amdAebw5o(P8sVY0Yf=E@q|D=pEoy^6<js${^HzpCfM=;cKzGqs
zE*051oeNfUjM487KCrbduYW;&7_l^9b%;=;&MlAZ(s4Sou4t;V{@71|1XK8NL9!PN
zZ}+bmLA^;>3IOqnal|?<ikZNzTU3ebbef$od;=<u#BEtxFvVhqsMwbE;+4I0`Q>)`
zQmMdfVH9Fl_i=A}QZQyXKfcl`=ARPT_3DOHYW?#v&m?b|nHHkT{D1k)9#Gx?vD6Ca
z%95htSjKQ`7|Vq;j1t_*?G`GEA0blhLhF>MZJsgoKk~N>d(tIT8St`N1VwNYBjlF}
z4VKW*A(0wpS6kTr(p^jdn;SvN_MEXPVM~Sy7Ng3Q({xq>|G=YrWs@9r_L8leKP5=g
zcd{8^0jCR=|Eh%)F@Mws_*G;z(PCLbcr+o#L*dF&V=AJooSZ?cagOSWJ4rL_lPyov
zjnrLvr;>(lWf}b%fl)g-Oo2Rl0V?4}4P3*J9O@Vf+rJg~fI6b|C(;^oc`O3Log2Xn
z!8{s`A5qFdrUY3yB$24>f)Y(p)J2r*R7UMs+=9<Z&4A^H1%FM&$`p4hru};ZZ9pod
z#2@5<#jogb+QTtVr83w4{?p|3?yF}4?-Uf`2xHr$Wv2-uB^V%=SDWb4Jnq}c0`Q-S
zToS<pgM7rRdC$|xfXaG)b<_@{;5ilMDUEtd79<>Z<<n^a5_dh9x!4d#+0oLSG6dL}
z5XCz37mm|S=zqL|Ou=~fM7~t0R~t_?CX2;ty2%qCRJ^&V3~O_9EfNHd@Z-GdgO8zu
zjuq6}{h6C<nDtb;$wP)9OD7LyG_DhgJhq3M&$#qR=x(~U#>)v)rgxIjJUutK3qWye
z99nhDM8Lw!cnP?|k`-oJ^6H-07@=NFNsSMZI<V4eFn<Mzfg5pJ$A9U7p*jg&T+{2&
z_Btly_y}g&V#5A$@5UFNKB^-(r2vASMt`UqJM~w!#-?p=Zn{-~g>ZO08cG(yhx`;=
zE;ffESq<YLnWH!&3?F5%a-bJ`9!YfbqAVk7>iSqLGWlfqa4{eM>qFi=7QyWH8-nUM
zY&U)G#eWPi`8rLC``tuhg|vCbXJYpv9LnStqx^|mwD5%sAgN4JIE>tZl|Y~WZR@TH
zpz7kEtGWEojIngOnG*pbf3f4(%XFOo-T$QfEGQ{nI)Qr}W0Oct{%qg7<|}P0T+iWk
z1(4_Z8pSMcK2i+!O3N0pzYe^mr}6D{o}CmLw|_~2j*&cu8O>=OU1)s=$c(rBg6V>@
zaKzRfL8lfkWwky4B^vT@8J^AnhCZ&(K*uXgyYkG2hEB!vQdg@}$FE*8pdpvu$?x{N
z<|w|7gIHItI&ejayurbDb@1(uf#!Iy{WYHR3ZYO077EEr1Dj5cq2=b03!U2&)<2D{
zPk-s8SWd+s1*3&ziXIp4t>S#zg!14dZixG%OxTyE9+>JjGB7FA*kIWMst|>1j7MSw
zGzKU#c&52k29ixb89PyGsZ}VP)UDh<&Qi7sU4s;4E7lN%1aRnO{z?Ff-Rc!%nFbNu
zG=M3(#!Vja)=?+k<N(LQZp>-uo2|4(gMUo1@YNTb{62T2K3@`DScIKfLD*QWNP%#6
z04KZs0^h%o`0-d%p-sv6Fv$?Bke8EkU0Dxog(GHE$cRQ2-l^b*T6H#c8Z89cby1wM
zLXCJ_;ktSx;qww`W{o<Q+p>6@fcXRZtb%&AojCYPmc*k&dywbpXuX#J&R2KW?0^4p
zXYZL)0H>p);wMKW=+i=gv|VgXS&>vUSgm7u+k$%K$E{Uv*Y+B@H9Z=y-`N16T4w7<
z&6*LuB)~5ov*?Q25x-njL}K^F&JWL=5dLES>CWrjf!hec_76|eap@GW7R2jy>-|fj
zK{=P~oF+LvV@AqyDuIFQ@X_8rdw-OLXJ?}9`6gGk1m(e{hN2D&;wqnQOPe<Oz5SQZ
zb`JJlz8E}y2Jl!k-tDpqK({+dQRk#s*ymY3a{pzZmirOx3h|Z4cu7jF;4-zLhl!nx
zaWnm5wG(CaEA~P$7ZpUxgfq6XbUN_z(uIq#tu95W`zL8wtF%FNE4iUN6@MQ}(ZMd8
z)NHQR6v&oE9b=7likhk7J74eIc8vRp{Y6udpaPGC<!NBhFrGi`VUKCp)v`!#S6IL?
zH3(DV&SBIYMqcuoHSm0n%DB7dmsW?zTimU!fp4pwoC0<~c9lt(lUBw~5GCc9!>$CW
zkqcacI1gOKJgZt+qel-_&VPs{jy!SzRyu@*ApRnX45r*^z-!&pqb?EPYbEB>faK>C
znp;nPz>NS}K&8K>8%QiecXStSn(5q3U~SjMlCGsP*{bx7vBa(2sk9c}x>cXTOIDmc
z>7I$fj7GFhj2Xe^jI1clV5FC}n6$R;x!?8WOCM|Zk{C?C3ZVbL-MaTYNZo&2x}@c9
zMS|n=JNIK-Ez3cAsg8sCqTHNu90WbL7D>)Nf;=HP*;+MzIjs&cwvm?9I#{vN>LqmK
zI13;~NE&6}vA^RgPS~C&<>Nw<m?EdGW1kV(8E$1cffK2<_2h>(4RAsmty}y|OnjJ!
zlhy<5QEiD?du9PG5A*Oy#Ib*&Sqyt<$Knj_r}c#m!tTrh+DERHF0n#V;XrB{1Xz5Y
zl&G*Pw#Y-HPDS|+)!#(f%jdSyjJ?py0<L#haS*QE5mU2U#z}4|ri&}+1M;wAD$MAs
zJN_dZV)dnJSfCpk9GTPrSSWj94tLr^6<S%~`OVaAVb5jAWWxPyVd#JUXPlXh7sZrm
z3mZO=V6PrE{kf%errKoJ9uip1+B_9=5*~_0J$g0fP^Ee?e>1RILR3#9$l?_qT4Rxc
znXd4@D#z?-EKI70CVu_F+V@vDUGZhSQ>@=tvBrI#^B7Z#PYcrV&EDNA>vxA>ToxV4
z_ozjitc!&pUz%sE>g<0+EJwbyq3|GUac(K)oQ-Fa(~FQFAJr&TENE$m@r@xGafurR
zK$Se(FE4Y$W(H|FkY?7l%|xwF10-SriKl(0<(1D<=6*=b?<hx_%F$A?hT*9(EzG#z
zh}qJ|63g0K9SHLJV^HjXx(yB@p0U{OcnJICzDB72x{!zgn)H8Hge2`)-N)2zTAt2*
z)}2BXFQGY7Y&=;`CHaVz!7S2KVT|DvEbZ9&TUVmt+(MpZ$L|>)Lgoo}IUYM<t(?f)
znnqKMv$@6veSP?L=b<JpGLSz#?#id`mX@pM1vrG4ywx5OMOW(2u#k=C$*8Y$S$Q2E
zVY2@7sg^JIz|((<&g^b~#4t*Jy>L?_V5j$&a=m#|3_bQOCx*hZPm6yksX!Vq`duZe
zrZSdtTr4z&aeU!n&z4A>7p)*#M6pvj!FQ~7DZ6sje}Pk8h7uMvIm{nGGqzvEx1(;2
z&c*D~qbwaEQdKa^R}YC5u=XxvA5!a{ILHtUnvOfk-V}dG>5e_qtLqfTc@|EbtoTko
z=i<VCT_c-$wh&W$g?=C}KsheQ5E1Yir-da+<rf%tG7JZz3@ef0l5Ir}0C`x1Lmhxs
zbiz6$T3Lz7e_AjqNyp%<Sk%#ZIzMr0+hU10C?5;~+Hw3oc&17^d|Y>j{$@!d%+9L|
zWkD!B%V&RO>>*i-f_GTSM7HLXmB^Qs=tyAph*ey2<}{=DQ>?b56_KnOt$EiD8KJ~z
z62Q^EYu&Ify4|y-TWr*PbA-_akC5)upl;&rl@S0h9&|NuKUPjjSD-(nteLx$7ue3V
z6scCWLljlD7&0fXtS<J};1qE{?y>qJNmSyqy_J7=ZV!&fc^|LH!(@*k#K}8s4(eIr
zBH%`)<8?LNf^2SjzB0;FTvVHza#MK+hDfrHcAg}`rfEVexFzSE1M$KweXuTTbD%$~
zd`tU;qxdqEPj;^&MDXp-{&QtM@K2ON|8Zn{IDW|yxb>OwN=s_x93)de_TrgOK_Vpd
zB65E_=f0LHRBu+hZ4_d}76+_eDp$BmpVcHVK7Tdo(|Re0ohaO^jYi5EyS{A(Jv>Sm
zX=^zjZ)-|xJNdcs6)!)Q?nv$@DQxHRFdl6GzVVfmo96>P)Gu$jFF&rdPna8!XbV91
z+n^D)u5bS=qTjZZ*B)onQ&f`E8q4}^Id*?iSnFmdx!X=YuIq!&i;I><F04$#-Kjly
zwY7%(n!OyS&21;&{H!m297faHK>FSWd;6;2Ph>gecBTI3JFnigp4GWa$(E4C<82Aq
zkYDt+Ev8>=NCA~+{Q|bRg6?4sh`ip7$lt(=%Dv10hA#24?E-@rgN_cp4I5ucFVcU~
zT{ax`D~sB04b`OOPRutyYw2(9*++M`XHJ%MC&=9;-~6l+*v_J|j`D_ENB5moyBA@s
z!Asqj=#zX2|5<)Lmuo|Q!mv8zupK|sjtoDX$VTJe@SKu}lURjl2cww8+hP^fb|Jd|
z#4qF}9w2_%+rbwP$1o+dSeo&ee}{h}9F^lCKlYqR%59Avs-KkAQP$51uyNZ~8AOgs
zlgr+8zhzUQg-+7cqtcYKa=3l>-N)6&*BlUS+o?@%YA4P0N5h|tW;-596KA98y0Kk|
zx`L)#U*{X#G`E0G_$c#|()8(>6BzMdh3im4L9I9oRCG*r?@?(*cx41iWP^V+oD#O(
z3_mnGPJo{rjnZvTOuZ@CW-l)bslwW7yB&~`ebK?jtCdq-r7>Hq>S3;Iu<!p@ILD;i
z%294a-|60;G{ZU8V|=(lg4%djJ;^_ZrL66{ye7x^3hm^UY9|_ulWQ#eIuS*Ht2Q@-
znA<1F!iBr}5tcSKEVYtJy?=kt<{ob493i3NBdn?<B5iO(kw*uZwB$^1z3f&b{05et
zf5{FE8KW}9nmsP&J1W0<y^7<=OJs2!rwkLk$QE!D#uCm?xz)4@p3(FJBe5dYrIpe?
zBGTW8^lQ}Lu2+RY+U4fvfkz<-^As2fBb&`lC<kAvbRDILUy`0tc(Z?(yeJ~W>RC1(
zsa~rt^j_nRSgO375$j^K=rHO~Y|*I5LoC0M+HB=nDV17v{|cUS2odqNWM-dW-SFx>
zoB9RpL>LVWNvOd>NRsWSaaRYd8^5h6XA$oqYNK!{SWPDrN6#!<+o@o)2)Yikx4SbZ
z#A(qlHSYq*t3LY1J?np3DQ&xU$nEHxg-hTFycM{*8O8DOa)wBaDCC_D|K3BC$>3z(
z5e%JUgmbO2UN(NGV_K#6%SMNtLi{Vu+AT4eTf2@gwZl1-feJYS3MBGJc#Yn0^$;6E
z6-lx@K1hzmJo_vB^^I@o!4a0w;r_#0h<F86S;G-3jZ0}&GdX{xcB_avcwu`PR8)xU
z`E+SE2GMvO#~5cP#NyK!Ty=ejSz)o}IEGLRcU}egRuLz7ZlcrS$i8En$Biq=c`D~i
zs{QJoAk6?^=v*@0{-{!ML<dLn99M85A;D&o39P3yKbio=fThU@*x#)??rvF11T4nE
zKC<k6WiYgfaR+~6W=sjr4}^v3(12i=Acj2oU+S#8@n%Y;(cOzaW!ewT=>Zz{lgfn$
zH`LiYlRAF3*6{-C!gZ2L{EXZ-6;|n&MJmT65pUJALv%^nqV<&!73M2~N!S!TTc9n5
zM31u?gddAr6JFZ*my&@IE^O?qWq>{C`xTahdV*uB=4^l8t=P%ug0*x!XPO;zoUAxC
z&Wk@-I4&yJdA2#Hki)(6n65f~nNN~A;f%9k=C$K+0G~f~VqI)nV;FrzOO%<nZr-e0
z&z7jfj_)nm%3U{s(eW8cq`0X+$!<o9@bt9W6Bo;l$QCJ9da3mh9Sem;<D0c%uQ_gO
zTN6nFjR}9VGDo;;E>4UQzeC|E)F*t|#JqdWcaJ)N1p4{<aNm;~j2Xn8lW&4R^$;O-
z2(Y5vtCUES*fh{+JWm0gn$`r_=x70#mh7OHyq0W43D*-V_$OqfH5Z1k)S>OX`=+;I
zb+}CZt0;J0ow!`H_z9`Hi%xREf4zRO&Lsg(9!r0(KPCT~Tm(Qwo2S@cDhp<r{5&c(
ztNP}qR|z~%2Y;rMkzbrzdH7&buiDT%zLucEuB9uubE^yJRQ?~FaChu>i7Fh8KIa^{
zIO1jO9YItP2R9*t)ml0~Wk^d|x1EfNr90~_r|gLZJT}fulg;GTI)h6(8nse;!=2xC
zFQ<QQxsUj=6FIQEV&cFqI-ST<thDSDp!*Mk(Wz!GkukPmqe$F3*k<_k@8}kT(^wNn
z>zla!$tLcF8HCr}gxjsu&GgeFxEE-h$bk|sSgsi2Tr+Q_sI4FhOLiY9L*HmzZWG!#
z=}#^OCj~6V{j)6naG_qWjgD?;2aBna*>-<&@8->p`<R|?CmW};<%at}`Dn0MI7R)o
z{A}1n+in#*T*l+&d=AKu0iEI7$=%x5?=$!C#)N-t)P5s$3LK%u`JluI+_JRp+=7+K
zX0G!Txu!KOG{4b_PIIU4wkz|$wQf7zBojZ!+intxOi>GwZY0*_CpnLpmID8|Q9XZb
z|E4D3<ASAzSL`d{5Cx_bpP^NYjGiF!vZFPx@$_852leT2P;>})1!()mCk_doIjX;V
z`x@`ws|=EFb1FC*pX&DBWv4>7g=^Fjvy`KR`_0R!yxHMHy7l)-zWgFRz29{7t-pH`
zzkl05Vnlv_OTSnl^ZR#Ke{l4DzbSuo-dz2)Lh5cbokly_E*ZE+G+b)jb0W3cg~A1;
z*DuhiG%PEv7|uL9-rN*D7U9W0p(Ku*Y#U;QSl_fRwK$wB0%k?sqE|%JC`G|G9ZS7Q
zutqsW(^pmO3COh#oI=Hvfb<f_k2r&4Bsp2`Ja5^_lBe8sH*uaSrl#cN$bf$w7l}=S
zb2lY-j3WynWZRJ_Q!pa9fu}PKB~fHPY9=~!c6&sy7^ZQ3!cU?r`Eu@v(Mj#@zk4I|
zG`OWIFZVjA-Ho18yqA3Qv%dc^SV<P{+eKNiod2BYV`!f7a0?cEo|zqQL%kt-<N3v@
zT1Geg_wI6#dv=<gCy!jet#*HJQS9x%+~>$!ZMpzfFTZ%|?N%6+wcGyv^~5`|+}BvG
z{<d7^qfa;lR(Pn6Yfywe8RW7len)C%?v=gx*<P#c1-7DU`uw?R4>q?G`?HfY7p41*
z?P<#XxKB;LLCue!=HNFVIhG#!NP?lrD@F=GLs^lhuzDQ$x(%gf4flV84YqK%7%i-F
z5C6I2HoNVa=o+eN`tLu-oL-@w_1hEEjgX8}eir#mG-M4e^&I3w8OiCuF|$uVE+c1+
z4|s<KIOeb<0OJJ$umr40g+y{2&C^$Nk3a>al~jGFlzYJ)e_0Bv54rd|vkPQ6I#3KJ
zX3Z6j*9EKT9%Wr&H8Fn!qy@xa&)i7J&A`Su-iX^NhZ`5gdls8}QB=olF&UyvM-0AV
z(<}=k9;^DmAEpb_L1V>;i*Fkt;UR9vr^qph|MyFH;p+eW5?Z_RG1q>Sh>}!3UGcwb
zKFIcWz4;Hr+Fw!VgarKMY2)7$YcXO2t7!@K@xQbP8NT*-DQ<tG084er`aHJFhN|1Y
zGQ#804;sf8xBn_c|G3xw0z(q6nF;dx-4Da0pA5-v@}hT|vQ{Y4a$XcjTOhgsBO@Vq
zuU&uK;>WNzaad2IbCy-lSXmkW!8NXDw*L&d^ZvD$a@@e7vUG9<{k&2bOI`hO)Jk>y
z2c~aV_qVEsueN{xqFBVdVC_?q-IF}>2Yh0XPEfBKjUTieORzr5i4%SknPNr0T4%U0
z$z*f0!bZSj45(P8q<reOr0i4;_IzD@Ry4uo(F=0v0Xu?Knq+7ms$HCH^hY^Kx6UKt
zo5;-SlhnHbm>qKL3vxI1(~}SbM|0s1jFmC?cxY7K=WBm|5RjXLGL*8gV&J&X5MwDd
zTNLCEmPFT-lQHLRZAO%2VdHZGpsXgjeu%;sCzC9kLh_13p)#UI<CR74$*tii^L@nC
zCrJyo7fr?kw!E=6MelA)txiZ;a$E9DRxi*YL-lyyRphnO3u@tYcmKKOp1ZT$lar+_
z%7^H?wM~EKBj2Pv`R2{uBW?7x-Ztye5<T9P%IfI_p{h><T#`v6UB^}Hmv2SlcFTQo
z0t$(vq@tP<TB$-p*Vso{??f>^Q$+^gSSR_Y>)ko+$o`MrvVysqpmGMp0mmg-SxjTR
zx>Q+7Yfkj%4<1+z5C>W8x@A0)r16@a+xIQE=No@9qJDxKHyQ^LT<VBuX0dtx9#t`F
zCT)~`Zl&h8xhveVS71FPUa(w9G90$#lLppAGG8wu%-sO<7KG_l!`{ycq&Q^qZ6`xK
z=TsLbKM&W(W@XcPuFWC0a!mkOuh+vb9ep%&oidZ~qYu8?<qwr<E{ekRp2KX*y?e|3
z-|c^QUWkp>zjfI7>MJg77)zUj*=lz#`{~x@KizIOzIqp{O7Q^JszR#CC=Fc0{IouV
zX=!`1VlDc)Nxg&`2{y+4ebVICU}u_ZB7$U6(xmLmC_k>Zy16ME)3lv&?H;(Txt3b9
z!=MTHLj+f;^kD!M`w*f|klCJ2GkSITHaCB#!+&ncKezqPR!>sP2U$gHgneD}^{w?^
z-`1~vNX{kX#+r40r$0HK`U=N`s{eNDir;F(TSIdekYl4IhPD3fJx881MQ$1i&yBxH
z947;^lYtJDzMz_d?SQqP1Q)DmPcUZ@!H`iz=fS=w?qV~P8ROr+rmbbqHP=F$>$raq
zzW444Fo{>*DLmGJ#2eVMylMVU1h`|T!&TxgOTVXnMc9zLI`J>B&)6V>@wMeAi^_Z}
zardiJ4nAw(ZMiOQhuli<vXB^=FCRsR;k3T<ZP&@im{I*~6YcoEK3>yyBOJ;`bQP~M
zwLcHLx5BS%^FGZ-WGC+@hmPDGwcmg4BzHQ=-A;0^ll-oeeA`LB>m*w@-`UaqA|eRE
zdY4mxm_QPl&&m`-IN_HO0L}52?Y`#>G8F&u6GI9QM#H&(dmS_RxvA4{ZU+i!>VVvL
z`q#&RrAAMB!@GqqiC%=S)W<JwZi<(^Qa6ThiGs{i3**!1A@QU}uK1O(CwG58NFYh-
z(ME@qvHjo}dX+5>#9e@Iq;ktSk?4<*)Z?RRK4}Lo-85fk$ia2|IYWJ&%Pqh5981AK
zs{H0>zCkmuvMu%b$I%Se3)qHFqaL#z53Vhvi$mH+#WdUatOKtreEDfdkAwN@derQ$
zD=VQ3(QIGA0#;hn>92O_kKcditY$rImJ8bWR7Y_bG}f~jRi#yYB1yyYC`CC^bA`xz
z$&bOzOT3{_d1{)afPQAe$SDaC@b4Cr(oa_Mh}{0I307Ty5?RwL)#|)H;tqO_1l@(0
zJ46hug9q<GPRnt++*`GLCotKQHL0qaKxGdz;ItkkD6v@<D_9TaVkCb?CTMkxS@Ku|
z^vuT0zz<10aXr@IHs7P0Y;nZtDHJf}(mWfF1T^O{{)7b!$a*VqIf*wf+J6BoLyJ9O
zWSmNae;>0@Hp0To<&naAdgNh0yjFf9AhHw0!I_{nQnVV~kNHr{rI;Q5ge)(Gd)%TC
z%H$*$?n!4~HZR4!W&3|Q>dS7r5yZ`o*z8f^I8-`~;B_!0eWK%mbljJ|kwQZJ+#l{F
z{Q~QVVsy#!`H%4uUV=Tex|m@})uYRi$pt~>*&PXfwe{`IoA~2-`V$Wt-9$)qW(a;9
z!j(@ixmI$5s~u-VF0>+n(yO>P#lFSSV2{|Zkd9bz@?#mxQlfuhv83+n7mgEn5)ir~
z46ui>^CKgUom(&<y~=ZOX;+%v#K<v(w3e1k!yvT(HhfHTBFcVD+!fL>AVRJG_s9L0
zFOq#X{7GuWjx`yod2%%D4{81z`c&1{?k+82N_$ATG*-e{F$XjC-^8TTm%k$#a^D;%
zR@2)v0(f!a1XO<lWoqq{tQJUp93p=c;JoawpgCEUtT;-Ft@`2PE!3#VOG$%8YN-wT
z(=6$RzSph1hc)?xC?H0tRyO@`xd<S29Tm^gUH{V$6(8>~u2QN$i)i3zv-Pzfrkzf9
z;9q_etYH469$mP0>hI0b>Q^7vdUs_6ZA>F}<i3?^*yMjx(L!HIxUfA=0njYeDn!^E
zs+CKi6^OuGU003yvJ+wgaQ$+N1Dbw!iy=!G-L@`C^{8yfhHMaI-q?@(+Fz*h!bb8D
zcAgk7YfTfG<3-!a;fA7^xNkNBgv!Rd<RjJ=E9d071Ao{V!wVy*RpP}`u4M;!&u^JT
zKGe(V>UDo|VpohClw%Uxcr);c=CdaU&zqeJ{1@HPI#kCv8ZmWN`|L?G?ca;m;98dU
zu6iZvNh0Io-h_}U1+A}USBfY@jH1A{D8DP`5;G<$1eE^(83nS@otFL)!uFMW%8}|K
z&q{gXQpys_`4vd#D>h`)#luRQ@9;e*9)0N=h`N8=cxR+{-4Hjo8Ys5vIp9^oeT~7@
zWcmtgBkQV$Oq?`h<|YqZCGA&xS-X#wkq5=t0>MI<7gGh}+w1;g+$SA|s9koS1aUal
zk#nX``tck#jTblHZPznAZBbTOvggQ$8^#<q-eEabq9($cxBoeeSPAC3>uqZ-9GIq5
zH?n{GKl`O<3ZXXLX=tMVW{_JtPGt(*7(dk5ar0x?zGg(`mo$dM<-R#=>gmFF5&wCo
zt$jp5-i<Hg%r~NqC(CQTyEbpWLBonJhVkawwBqr8Y{=1C>G9B-d1tW*H;gx5`bON%
zJBDWdvsv?J5>}mzY`c|sBf<zQ8g$W!o%4TJ5MM-Ezb<(xiA6(@)#0nQanbKwulUCr
zQM`+&*4q|>Chrb#Dz&LsvXc&(V7Hu>m!bWL^6|pJ($(^Sw-k}XeRE<M_<B}UlT=u4
z)u((U1#^hNAK~0Vn1heD5>39IG-(Mp;83}yv_VlS1Ds$~ONTXps#ZbCJxfnmn%RGZ
z5e-~A%@(iuz?=EFq<@3qsP(VKcR!PLORM3k8mv*KC)whH*|^0Kk*(jnepY(VD=b6N
zb>X%Hz#&<^+BR{8;?mGs<$2Ws0!!f1jjm@?dIjqS7Rjx$PtEn_7=NbT?1filZIsIJ
zDl41$qGXY=M`6HxmTYK4bmObqP-=fzX+n&dS%r3#i^?3ZLISWBuZVyqd&?%H6(nQb
zM=W5mxu(wrjG(o$P~v`Bn=Y{;{e^^qZ|~i?d6N#3>ta=`iDtb*p6VbIXdt^Xz?eVn
z?Z8vDI83yGucI)`TC**U<h;SxO+Jy8aktgAh$wzvns#q~2_?l12{B#W(4~Lmr1sn|
zC8)@X%ViXrio;=H++}_F!6c%q`tpUy))lg<-eD#ek*Y35O>kW5bw-)<m@zjNG2@G=
z!FCNxg|aRP<btGUs6YJbvBChMMus`niF8UNztgbChqbzYS0iGbTnlcHxJf|inWt*y
z0RR|N!_^dP#j<ci^w#pa*C>AvHw^<85H4x>3NRebd*h@JDQmFE(n&vCj0dxP#>;4<
z?T$C?uOBP^Sj(r<b|q{$ZdO+qSykgcWtaiMCpJ2wB>EI1NtB8bshsv@otBxR7_IlY
zcC_Emaky%_i^R+i6q4=JIg&mEqrS=tQ(^18f?^W&*=kl+8KtX_7Yu(&D4Xq;B+6`g
zf60xjH*_5uip{9jQM8>+0X({2flH}uD85?VO`AcGxa#{F36twp$66wh48(14JeHd8
z)VofdG{-SDH9$S`nrcBiDd8R9P`YW^6$nA)0%o7x++^7GH1~zSrO?3UCTh&gy#O=7
zwE7TWkSax3zEeWRNL7C(7{h%PJ|}~Xk)R4u#z}0tW)XatW6V)(Ir~#t?!6{nGv;g-
zm6T^_X@Gn?FHoWa7WI(jwYm9toG$cx)bHV{#0g%F|M+kJ@BjF3|JD8f#C>VB-CNW`
zd~d`Pa_{`N)puk$xJjW+CE<1Lab@*!YtEzf)L!t9b5q@{WXXT8p4WB9s7qKMVs*}_
zdf_v;+y9JNKG&M_iYF)x%6wb%3?TL&q&Q`%F_m(|Y02H{CAKaPwzl7`XtwRf71x3B
z?Os2gNc9@HO18Un6tX*EF&mem-CeV#czBKIHRb*{Dl0I%sI9;!E{AK}2sJ#e%b9-9
zPkMIIBsksuOYwiKs_%s<^38~IUm^-!GX3h(&n_C5O=1PSP5ThwHp5^uytPkv8BZW|
z`gve%jL=aiwvW}r!+Mbs5GVNN!)JRjps3g5^`J9aS%d9hwS%JR*eMb%1x88l1e{Bv
zup8(=6{}LPiI3mQ7_hEDH$kOHd7n_jdMP1vQ2z{=69|7*_IGY$M-vOQ+;}U(i>Ms*
zPDNC0v!=&vq4qXZ7i1!UzaV}|Ud}WlXKn5W-OBQ3>`?x-{#VO7x+1yg+6hUY^}m|`
zdu{fVdBlSQyo$6NdA+}I1>BCE4zEhzvUr3;E%xr7{}jL&l)OR;?<!O&<O|>qJDtsg
zz}o<P&h~%s>J>PAhzG^ab!TwQ%9E$Q+jg7*Ctx$g^_gB=wLlzzC5R6{u?2^(^uemW
zbnE88THrYJM8m`;MblamPV3lc01qpRVv6WiS%G>&`tVX32$6l2D%F0%T<y=Mfm-7G
z@G=_sQ+C0wxaBy^hjHAa)K8EN+8V4(s*LvPssVpga_fiH6+l3rM*GC1Z{R{Jqq*J+
zfaC4X=dKYe{p%$47`;j4<uo5_;#J0nbB6NF(o?H~y#^#K)WkTZ%FZ{-TFQo#?fUXF
z=HWh|aPMsK$)M?ZUcSG0X{n`paYbPX2q=(?|Ni}C<0u_%v{_T^oax}4acg65`XL?X
zl0|>D5yvU`oMzzV@_HMt%l0@)$76sAwm7v)|JIT{5*<&p$rmj6;iE24E0chSN=U_l
zt-lN=>s8=;*F-p2kL{L!w*C9h^_!Yx6&~mb+^ao@VR02#{ixiUL9x0wCd!<sNOm7l
zx1(m{S4>&uf)s!^oACzK-L26c$rd%&WRicZZctUQIcculAl;v<9JuvaIoe%ukjk#C
zTMwCw(0W))xH+=Win*REB=EC`r(NmD&lbt=SzE=xy=fvfB*d^{$57UK==-)XVGs9C
zM*&%)lWoWg;9wc#BSXNF1sf*mLMv`qq16S4>g(fbRYlgyCIY+_%Wgc?SjW^{A^d+H
zxwl7RUh_pD0|waj61rZgh4VLn_*S}mc($Crmw0(*c^$s1=WCR`Njm%gvG;G=ZJb%U
zD0rQCibyIuMJNGKq-3X)wp>LWY%5E)m7<hhwYj{&AP^+O0uV?9Ac|>wj5T_U-Z$M>
zd(;?xv-=hLCHhV3N&5f3Ip==}1So$}mUGqGt7`9+77_pXF#mb{=C%d}Fb?d&=h-$R
zz)Gf0j83qGfOT6t1g7c>@l&_R(YVJH^E-bNAy?N5G5)jpxu<{|Xn5>>;I(Xuvf)v#
z8z>tAH1~Qi8%|98qF^x8M3mY|sDkw-AJ#(xe)F4y#Uj5PfEu|4l!5NE_#=NNSN+)y
zV%W<{4y4TfkV&lDHcEsL5`Qwf+sD8A5dbi+7L%X<356c~?#H<hRn%+5m3#!h6`O{|
zTo5e{b#B)}&f4bVF^JdZ#HqSb<G+MPZw9*Xe09V3o;?jwybJWPIxIlj6|qCmNpTAB
zJh#Vq(|>baccCm%|B6oG8qR-tKf(|Tm=urOV*ViRe3;#EKU?$E!)g1C#RfpAvt$<y
zEv`-AbV4X>zpw-RupJ=f!(B-cw4yuI-9{Z-w}-?KmF&;DWFz=|uI6ok@itpbobz@6
z@K*$XxVs&?!Vk7u4=-D0@1}lL1m!hQV%8sU^;@|PczmlpFH&@Lx|@GuGv_gR{SOE)
zZ}CB+m`JayHI9C~b4N&VgkqyXpM1+0xm7AT|Gp(2#O?KP(WK2$M;>sVboobUPYnCo
z6XhoK4#~2rT72OvI1v!Cp>0NwG-;@5CSuUY=YosEIO?f;qX`|rj#smFNFDj{-GDkD
z9HIWIXF{;j+TREtC+2_VxV=C;{q}CW7<?4EYw=`rBHl%(`gH3@TTp!(<Ym~}5MuUG
zBb@eH?}HqTjgLd%0QpL^jd>{iXL`{6hiiqy-FnxfaZSg>*r?RKu@m8scGULuASU2a
z_KLu3$f)Ml{(8%cEhK_aD>~j0L$;u=l{^|pyv?}Q_3DH{yybr^+J*SOYk}|Oh=)ra
z&Uk$B`JPzsS3D@2G8gz)B{)?zmLz<MuGM~Y`9g_1ccQUH6>STKCzl%*P#v+n0q=>h
z<BGcb<mI!>Y?WpUaWc=lxN%i&f8pM#gL%1a&Jfq*%dNC$LP+$h*XyGE@mDWjJ{P`s
zK9J+n%*%4Ev^{?>0D3ugWEcNwM{kgCy->&a_lTiCa1-3b54QtHAd~GwXaThE%`E=2
zN)SviS(c2LeEyv>`Dj?U{J3xgH}TTuL87b0+PGQw#|!=Xz=@9+U`w0)SF|YWWGyt%
z%XFH7?QLv9*9x@oy?b{f#uv*WhG9*9$MD^@&=0@F-R*y9nBAL2h&DK?&3Smti2yA*
zTG=@Izdq08?@m&3K(U|nTW-nrd*<yKF4CJ4;b~mWv8IR{cA2)K9Z?P}X3B)zZRQ?Y
zAV09%!;|zzwJ>IOo0K(U!LGkbP1Z~<ljqH}^p$S@vI}YFpshR|vQ}QpL5Q&?pWtrV
zFfn2J`{aKc@2#D-Uh?km2G5mu-*z6u$z-_jcl~I=$B~Q4baOT$x{%@*e)?YZU{_NB
zYqz&{meMirg)wiq;%oY^Xv^aZ9x!I3a0QVwjk$pu`<)u+)$FBXmg;Ruf_Ft6{Awn?
zVJOWt`rVIGrvZ36&qeujf3N4&dw1KP2Z@t-Ssj0hZ}vOK5TaFl-!w!?^>i2%9gZ!d
zuNE1oG7h<(kFOrnbMGYnzQYP`=2wlZWklo(u+A#m4`dm$&$GJ?^@P_;NQv7$*`EC@
zsvRpMWTerWMH(^Y_I|J)Rp_^;s|#Uo)R#rXW7D-73RH2@w075>VQ*U%`n`HRTf@H_
z3$}mmPE7wYUj-|HBzkZ!rEl>Lowwx@toau=Ef5F6`_=NO%Y0#vSgS2(Jh&ucWSVf^
z60Rh%%kYzpbE~XHx?^tdqrZwAp0B0Ax}oN(=TAcGsR@e}DFbc!TF*|nM$z$U8J>li
z-R_0t^r3A(=5~$KwH-3Ap+;&^9yMLSTR49RNHohP9c|)gtWi*-7R?7)Na&W(&@H*!
z?ytK)Zwl`lE~{a^PDD2b`?XNd<`~>eA*x<MK)0?O&b*a=UTZ{Ae9qN_Y7S<jE@^E5
z;_S+ukR###HEiMsH8<6(0pij}wm;v4KDQ_Wg4nMG!55;{t^K4SFX^unX;n!j6ncNt
z#(VzaO7grRP$8ks?~Ybjcg`n;jw;$lE4AIvNLr6>$Fvnelo9yShas&u)bd0g|2I?f
zyq8i(ltH|8`?j$y+aFO|RjoBi?G@Lpsebk2G)lYGHi|SlZa?bt=fH3tN*ZxO$ij=2
z4=zl!Otp43zlq2Y!x)9?WS(Dw!3}>(iH&NL+ji@nAP|$G9f{slKmTdrNWW|DHlkD*
z41Q9L-J5}M$bm3$$fT*=cI8cfml_6ud1`CFzB1-I8FS*<_gta3FC;g-f#ta>_l(!U
zCD@+eQZJXqbPlcE?x+5b&mKh8{m*~+gRleGB@Kjc>JJ(l()CLNKa8di2N!?J_x~X7
z)0VA3Jpz8Z`Og%kS`P;jyf_i*WBkwV-d%}tj$niU=%W{zie^dn^_$;V4rZz!-ICnR
z?qr0~ox7!UPo#~gpY3wkiH(c3WH#^VFQUA`d%2BZd50DvM2(5x^GLbyD``yTRlVHa
zy87NYGJr$-z~6{pq*&SX0w;fy=1Cte?5HD(4Cj2`LWuo-QYu%QM^uGIk1+GZM`cZX
z-nao_CQXNxv^C%=`4gXvywh|%<7#zMC;Sg~4dP~#o3Oo?A!$r}3A#z?_1oaJ;qYF@
zPF)emqKQAtg$2Dxk~~evIM+CWlS_$S_EBrDW%H`c$8QitINrH8bO(QP2mR5lRGeN;
z^7_1UD|^1G0g-@&#OgZD(+_uO3$~Ffs$b_QAIE4!&fp!k=gNlG5RniKA8`Cj$yFhq
z;~IBUcdZv3UnGBITYwjL&p|T0NhR57lXla@wdNDvZ46zT+cbI~Fpk}!uXi1}defy`
zOo+#9whzbf!DT+3NOXT8<FOZoW~6W>#c>=L%Z5rEaKYyuD@dJt;(W}9JoE6@)^Mlo
z;|tx_zL1t<!K01S7M{+c#D%l0nQiWx`3s@HlZ1;{>fj)CMK;1)A>jqa01zwvqi4S9
z(XSHrm=v_1qT=ld1>157u4fW#&HJZmC-^#S&IvcYwDb|(?R<Z6=E$D=-?n^f*J>k4
zt@d$9t%jgSq*X%?aoawNot;y}{au;BP7kloTh|<a-1^N@<85xaIjd+UJPt1mF3=;T
z_$?HK_F-8M(T&)*G$NP33^B&zEMQX%;?t#35pr5|690sw@`y=?(4)A<Gg*P9%dQz}
zJ=+}D`_8aljlh3gKUT7Usw8(Sn1;bZmu)dPx6>?p<^!c{Rjh{B3frot^i20)Fu0wy
zTsek@e7Ge6b+~Tu@}>px_S^?aym7Id?D#0-2FkKeju<UV<6v4<w=zsT5yc5dOF~%~
zAdf;~qO@<vr?X>ARlXsSTaviVP%qaKxV0v2W44#}RBeBnlq#fY^ZC*mxu`a+=dylh
zGO{Sgg)Lvx_vW@3{e6|u;&Q&M21zQ5bScTNXg~m#@~{;ZH9{xen0viFr}-KR@gVzJ
z(O*5*>$*6*hTaRrG=Zt@t?MP?2{pC4@qIbG2I6a+VLhL0oK=Fpiq}=n(eaOR5>(a<
zI$%qGXKH_r{Y(KOv!9Uz*vE8zcvR374O9?7n=w%BAf739XA0T5J--4~OCVj|6Kk`3
zHP~h=D(g?kp};)tg`sES%r&set_zvz72fec+HdW<FjP8gkO=W?_A?ITz2F(YJHI3^
zjOcV3uq*XXinSLK)cR)RI0T$MMTt)#8I?lXA*FxFMECLp_LhT=L2q|F;_Z4P3(K>k
zsJ!bqyl5e+C-hfQP&Q(Q#aNE77H8PD)AH?BFN<>X27e?Fh9*vZ#EFtPsPi3h)SGbl
z?@ZJXD1fQAOHG|5iKGTso}X5~b;Yp%O?xf_%VW@KaX1I9w87%otRwk%(nlaQ3);qU
zRcwD+RBda7t;e5<uxSmu-x0uA>)cZus-9vA3$<%qiWVd0J8YNH44_pI3R)kp1>S~u
z+Pc`7WEx=Ni_?5mWKmmDYUqD5Z6TkcsiUNgkW&AMGJW(v8Odky3m*d-rISuu<j+P=
zqPFZjr==xA(!NEZk{Te{l9YOV0<AHTYk7aG)0xC)--k20Qdgw3Zp<@kU>SuahABrn
za0xzwU<}4Jh{Ik3_N&Xn8<m&Wz!G?yI#IVIu#2q+Z{zb!1t(?afA+%jgPzA=p^WMN
z*U1YXLW;gpLmN_j|B|fU4Lq7?R$C1*bgP%7s}2Y=zc^L2Ug~|k1x^C(1%9a~@!WsC
zII6lAML74`f{lCY0l>YhLUI!^*YF@jsJn9~(uw>d1>Ng_D#6GS3%?EABa?okeG_l)
zR*4rl8C#LKyVY&Vx`K7|0oUc`((cu(BDcOF|9XU`SODJYwIxmOb~XvUWEdW#$<6;E
z;;!S2h54?XSb`91+%q&NHx6WkN%emQ?*{tobefWEYl39@V&Z>b<<`83X)XD2OB_Sw
z4}!BQnO7`U(BAr&3ADdha^1WhlKf{)n#DA(EzGu?(jn6I1PK-y6?zQ}XE?$Bqa<EM
z(%r{vlv?GtaKXb*=AFAkglUy~e~p9~Em<(GBlp5;mi<>Gx0MtXt+^`ROYnbX%kLrf
zuBVjXKVH6<(EG*v3B8*+pyuK1bl!>m*l9<SYXczv#faJM5^@5ZZ4Z3XpfIa3tg*?;
zDN43XHuhYh$og_kUjE_=d3mjwg*Nj}i8<6XwC#7x%n`_TA~eSfvHMP`Id-+i75N8A
z&l?Y7h)ETGb+b_2$PL$)7cPHJ375p`k%fPURNWA&6K^itU%zBG7p+soRU^2HLTi62
zmMs4?X?x?+H3r$!C%naJ?cKg=4RKtMA;7FCB!?L8@sPAa#0;{7H}1bwnV%+rE{Ypt
zATt}LwAow4yDl`ylYnc8BQ1HZD=;<0#V(+tc+UeFTSR)2;)a9Kwc>wKhGh4%U2b(f
z=i<lJW9STW4N&1XDtTEhsVP(KW{q(gP>H22V`bSn_ma{^4HpH+RF8@T9L=#3%qF&<
z8S{Q|aWOD^^<Z4Q*%?=(ddEqK1u=}=Le@JM*48j>YjZE{zvGs<s{l&wo-fC)&>1l<
zFoJ+jcYu89nH_0}=~#aUnTQWreV#+|_mwXdxKk}R8ck#F3``zv2KydN9(ZC2Zmy}h
z`DR9~A??~k)IwmhikUmms1s#}k09)8vknoS*^ik(a~qZd9m25z0Cc`WKQ0pR=>D=Q
zN3SK+v(wofIC)A}p*j6KcR+H(n$^V;Y+jwMn2Qj>7ry!9&K`eSGIZv`XV%t5b8W38
z-R*2vEpt(%G4JHDPbtE=?`P9X^e#>^kDEIJ*AK}S{!E=fa^@;;6eC=qV7%&JcjCo>
zeAHN7(fxIjVhO0~WDpN?P|jjkqi=G&-Kv>N4sU1yPGGL5*GM7&udUQsNm_^;KQ^>-
zQJlbqY+gB5pxJ+nAIDeEH&x#_2Z=Se2?(#f9hZg&OVRB#z*09X%6d~Q?b|Q})lKW6
zv1RdUupPsVb@RkwTC8|X_d9)^Id|W^il2c?`h4&iyw7Gpef<1b^1}79<Mo|9?z#qE
z&1P&udtxhbbuj8O<@je;@ez+S6M!6R<zrE;VKive75abH3FE7@2XJp8!~AwpQs3x-
z%)WhL{V}z|R4%V%p<X-h;i8F-^hI;yumS2~5}yp$=wnIWR%b{0NR~6b!)s1t9}lHS
z3{c4Y;<aX?5LiOL4=H45<CZ(gz_V&@#?(g6$M)MokObUxnz-DSJ@l3Dc6~#)HXzID
zaU1?X8<Br|@Mdl!$DLTa{FIJk%)k+mS~(JmD(^RWS-loVHuW}J+u?UFgPm*Z*v%;=
zL5-PRYhu<You67;jqhCm*!C`kb}AK7-@Oj21s>v`vS)T)f65LoXG<qT|0J=eV6o(U
zLA0K&@=41t{tQ~B@I&XPfadwr+CMh_aGhTuIV*oTA_n6vrAEVUvKJ7Z|NZ~-|HA+N
zpZ^c{zm6jh83x?#p8$mem=2;^`^o;nGl)K7uf2z>Sr>h|EwIj#J-SwBS_H#)6x|>s
zqbBVkc&|3Utg^N?&nkFj#*H=q7vrfeipAl1;ojb4LFe^&_sXiBZ>pu^7hT_m(hk~r
z3EzKuWAq1lHWuqN?D&@SlkS@nWS65sml%>0WQY+P&glxL)@Q;NXUjw3VG!nWv4PuE
z+F3^ha>vllK(D7|4Z4rU9OvX_v8>t{q<{b4|Bo!@j=&r#lZDuZgmoj05Zc2cZS);a
zo}OTJBZu2@>r1vz;_!Ca5vuz6gWbVLgS&s7*=jn!#2<UR?yq`OzAl%2w=j#@1NWo*
zx#J|v`J`G-%9GC@++!VmYolWwciv=Yv};lnC}+0fS^7*<Tlw3vVld2qyF1wX<6uv7
z1Z+(zH`;T4xIfr+A9n3a!~c~<+>r18ad2;|1ALL6ZKSv*@etQ|rL{5Y@`d4@t^R-h
z_elY9W=H<X?*2HqZ=;!3vuaYE?dX5`d2jGZGLl=-L2G+O9-UWiNdA>LDbDjZWhFuJ
zCS;heS;Q|h55W4%uFW_$C^Kuw@s)1~n3luM-H?+Z04~lR$(yV2w80!?n)a3c=l0-q
z_V@SY0ncYkvCS|M)oIHzxULBpAVGgoWaGV^W`T#4ObHQk=~HHJ(r?j;I8G~HqAGH%
zI;?rX#a=PFLRj&Q4{*oll_<|<ReI|~^%h12{OQ-~)8|PS_^?Qj+swRtQ*9tWTS<I?
zOia#`SUDSXA$H=2&dL41(C&!r%~H9Ogszmqr$6zwhi8A(iTJ5Ein{LnDgS>`J>BW(
z-W-xrJo}^q;0CfQU6|*5-vGq`G_QFb=9i)0uh*shsN-kAVhWqGwrZ0)YpNdpTE=u)
z3fcm8MtRCL?-=JeXyv2+>Vf9TK8-y{M91Bu$8DmjLeqouf=Fzvd_Q|;%c{s40r|T*
zR&4^6Ud_kt&xlzBYJcqrUBQ2wA|;ox7y*FQDF8|l-?EtLBlWV#r~MPLg*BFcv-I4$
zU?%2$p&v6uu%gjeU`60gdqrSl$;Z};I6WJsQ$P(RwM-xtO;Bq+zaDGT7CftP?`3(e
zUJ-<MZWf+>>}TKIq48zd-DrNrn@t)C=uO@flWNZGZD;~~@)9RrZ5)39fJw+EEz3!{
zOy>E8NCVfI;}tp+Tw#FDLlfti5QJK%nv#uEL%0n5vd+Y3CSH=&Mg@x#oS$Z71rQJx
zFT=Z!iP``#M7!ZH7xZnZ-8;S{!Z~SDS=Vbswx2zMayNQkK}Mb2w7;(SGIasoXGcTI
zQ@z@J7VA_O*U)FV8c%;_HP~HGxR_$qEQ=-}>K#4^qk$3KiD0BQkZx5C(Hz_{^%1wS
zcK#bYJbVOP8|xL9`RfAc?uC1*$vKp#;!xmzs!0`Z>2v2++O6tTXqemIF>`EAz|t(U
zIJ_-Pca1Yw$Y@XaL@!M0YkScoodWul5gEK(UaB5Io_qnfc2$2{_%2hNH1#H~^uc(X
zP4zt3(lgy$^C@y;f({re%G&W_%)=nL=uBN^xnnQ#S<HU@A$>^Q#(u$xpRCR#n%tgJ
zO_4(A?C?zQ`{y!=k6V9#)n!NmlJaHz_W-TQodDlAJFPZp>gj5t$w(Q3SFLKteCHR*
zS=rL;gRo8)+0lQr)GMByt=s}Jw~GBF{yA=CRy-$6nP%pTYBIKlgjF;n#@AN+L)tCE
zn7~GSosJo?gpQBqzcVK-&n0n~R4Kxc-@PWOpqVK4xmt_>WvF|5sj!BT*B7N^A?J#+
zu2OQC2CPp?G<IQ;t*gnKA|e`{r*b-(Kqp^Qvs+5Frulzm;Rq)@k7&#;m%+azd|qpd
zQEYTRp`Xs!$DBZ<whdSPg5(u53&YN7qbcZecUC)QPH%h#M@Afq(^FdJH9xMC;lBoK
z(YkQXpTT?6q>wx&P7?1WTJBz!YVVaXs~QW`oV+-dR4`hC$Ts^prploq_NfxQMfy8V
z1otcICgp!nF%_q;sF@awWL~w2x)nn~+oBd#26t&q%b=TaZy;=LV3s?exv>}v6c?3p
zX~%P~^=dMvblZMM-lea;j_TEoH((r`&pUK(j+JyU-~?vszIftznRwfr3A*Om*sfFN
z<cejONdE#P#xx0XNUl}_WUX(S3G$>{l+aI#I3s`EiAd_Uu&WuBil)Y$06fL5F<qxG
z%DNcXzC#yD&y(2bG5E(S3~pr~`BMWXq7yM0%)7eIXc*(IC&>IEH&9~f<l_O^=T2u`
zIF^WhbV5p@s~832Z<2!JS2%gF0lpo7+{mH!vpaW8=>sPLs*A`DiO+0PR8$sHQ5~CH
zBwByN@(6o`wv-?9Z$Y%6(K@o?bI+|s^}pM!Yz_Ti#oOJv)5d_K=}pX7%PxA7{zaU4
z#NJ4-IA9eS3SHZ)d;JG@(B@E47o$Z1`#-}nKLB?k4G!Z5-_hRzJ;nLErkonS$rmLr
z)G$Y)XZaSUa!Y^d;;QDcrra%)Hf^c;-06S4oK6AUF`|3RYF7SjrI#*`NSLNqMG^2!
zdI!`sD19B>_YtY%Sh(9dO6ZD`xHFJX?eBPTL`Cnm!jef%X`6DSYbB(CNvZtmm`6@D
z$zBFGMo%02jrkf&f{KdZ5g0uD7^;#h_6Q!RR59hVFjcn~MPqR0d5l)*^FnC*nM8l8
zgyq3!@|O0=lQbs>EOUCTOmirjR?6zQ#zgB|WVa8WJbLlu<?!&}*~{D6QKZhy>`?HG
z-2dY+`W6mM%wSfFo{BG+i|GH#W!$;sznv^)E`@h}p@3+k#csV^-xYn(-AaCZAF4{k
z5|HVuRP#p5oDs4~vE)}mvC*5e-f({(<%In5YiRAXx4!-xFON92Yy7l@#sszBQiFJ+
z8|UVusbvw<M(BBWphAHo5>)Ql?#IJLWtTdlu+hb4;jRgdTz*FzR!BB=lV(DVE}8o}
znx^g>l?F25Rc)8&=&5yT#n-$Lc0U=~$owLwMD|I#Lb^J(vdAxY?w-f9^G1I*&03O6
z)#RRzULjfcHK*Hk%#^C6L$}j{hpZPrWr!{<7%r8)DeLkC+O<nbe|1!yo}N_s0>bQd
zR~Z6KKdJ{mmZL8nb%M2Eec^V8XXSDTHGVquN47E<>f*awpIP~LIfHm~Q(r0c5<wro
z61bt=J;OsJBwm!E(Dkr#1bTm3{#`D7q<i)emT2?&!U=B@to8z)J@y=Z^f6l0Ps4?N
zO6TwdZ?jwVGq}Rdc!K5?m{NL)#HT@R8m>P=*V;10I>ntDU!>`s><B9Fy0sis$h8dt
zocwAofVkXJ){B*u0SB@isrJ$h<GbR-v1u}p`@;+QE8gaa%a@Pors;o=nTPL|XGeAY
z=s_G;zk;u9v5?KWJ0$NlGzZ$&?pUOMF7?pqV+Q^=d~dzj!O7TDb0DW;Z*Q2FLw(KN
zj5nRUgQxwxrZZ&ZaN^qgR^R~+-Ibx6)Zx7@+r9V6P>=(LwS00!VQAF3buv=Cuf^jH
zyVqx;_+<%ek$#smE+T)|!F=v7(|nFlF_lRWo{*k%KOZ^gQs0%D=!Qqc9(P{E14frZ
zg#~|aWC|IfN}cri$xyzaOP;t}ln|^gZ~hbiKFSi^9bUl|wo<S3g_S}2C##=ra6gqx
z`q6NMhAiE2@yT_hVBF5i$5wEXGajAE_uIGR5KY7pPJb50K>vS;o|wYt)_YUJ{pp0k
zs)=oM{h4ie*hVi<%exMT+H7mR^p*r9M{hn|05MDiCIUUqLO2@!y~6+6Yb6k2P@N&~
zE`yX9q7`KF3AI!9n8D_aL+2^#pgE4Gk2?p(eU~uy!B=n5Lf>^HV5^~=kchWv?MzHp
z)<YliX*H(v-&%jaqiW)4gDL{@Y{a)fe%;);XiMEADeUi91pQT6pS!-67X?see4LW6
zTpPz9Rv~-3#7wBrbC>&a5)x-~zYhznV{$ayz_8~vzeJ~+Uv%T!t6}rwBjnp^G}1gg
zzA`O|Z+$SiJhzXliy3ee-30!(r_U1;4~@);)gQj*;9Gwkui*{<`@!SG{R^;6_^%^t
zV%g9NFgqC+&(M2Fcp}lgRmVWYK6q(I;ElSfEGp?Za=MymZimrpM_T8r1$1Ba0O4|~
z_ih{}v9XIheY6?6Fk$c{_X2Z&hE;MmY#{>Z@}lybGgC?wQ^tA4LfpQFr5r3q=TJt5
zb~@ieY-oQtf7K~R9N1gAu(`I9C+E0;X3MRpoL|9xiW-*S$+_sWZ6gtYscSN@!HuH>
zz8^e}8yx?lI9pBf1%t$}mtVW%;Z-=)BJsY)gs+yy(9&v_TW2RNv!~zV`sCrzQ1Na_
zPPAopkt4@P6llS8)w<Ygd&Z^SxT<3*o-8VqM>&6txI|i<R;p@B<srsj)pa#0sUz^~
z$%C5nX-L;`H5)t0JDB<Ewn4>=JUuxux;oZ}_A<tj6Va&_w!SHw`|BBG&u?eOzh778
zEI{4ni?S|us;DxY5bQ%1fB3GLI1Yz8m%yM!WuJ^o;Tm?_-y^USx>jPj@~<e)n&7Fr
zhrxec??@rW$(|I<OMn#~sV){ujWAp#{vvySp`UqRduACsUy7;Ijr9y}q3$2<d2p|#
zANXmxsF(Z71&EiOCN5J`vXDlEDo@4ceMr-)JT#-mSJ9MslugFM2F%T(I2L-w2zbVa
z3n`FbXzCFe&QrweX$-7R^5}6jLge%#u>^la@=uF&J7nDJc~vhXE;g)SzmUC3AzU@J
zS~g}!eKk1@E~k?YXStu9osSlSvfA-8o8%|;PBhPb(bkFvnWO%fm6Km*IO8`TWtd_g
za(&-D=hJRHaY@)Uoq_=r#jaajs>q^3-JUoiy8j>dvw`tS#UM_NZa{R*EWGC{*DZfl
zLjXWPzrRa;tq9gCONW1TLLE5hNkf``Em&!uxzjwWsaK=gaN($${{@4Sq~e&wy^kEJ
zRmK^k?K}RYxIo6nQX;}dIi;~(_39+VvMXsqbhfD`O($1_VT}7!EtwBZ^O~}3J5Jr<
zq2<TH9|-R!;Bkmo7y;XdCKyoa*2J9$Qs)nUpp*glj35~+Jd5TIDC^m6eLKL(^7Uw0
z8hJ#7iEvX1V->2w7Z|_~!RH~Kak6sW=6>`@Nm2G3<|hakMx6RINKLxtGCo=nQ0ey^
z{G`l@(;IZEb$0meqij!*3Z6dorIukM$Hu{-XDPiX$mQK+JPatl^5i(?#eF<_xqxSX
z>WGK?`)zwmmiRS!O+?Qp;|X(f|3v&E2DSc1P^l{Rdbq<mal);PePbw4V9N<+4YO3O
z7hD%ob@swGxURek91jHGU%h%{fVayat)M>gZM<1cu-7N*pC%V>JYK*Y$=E}8hNtr-
z#`*;X%3M;waP{17#D2Ox$~o>m3vYveFK?9O(bJtrk3A}j@}LJR*VSxUT1;XP|Bnt2
zzg@c|dw(4A-5geqG@M7*W9R7b;Ol4W<v$s^n?Df~%&43;eK&~e5J}ETbfO^*!mH_x
zmw{+d26Stw@B5;TT!p`^s<TPa%f2o_YN}JWNZ-B&Xuy}{@~hPe|NAUI5hh1}MLJ9(
zH0IWbKa>`NL};)z_2MX>hg}3jMMC2>td}#5O@iWpTIuGj%|!ab5boTeN64K!VI`g~
zDjYu&6;d5XE~fcgg19(7WB0CbB%+XZ`{*}&%$#sk-dkIqHNy2-6z7Nwd;^`kFKoM-
z+6i{=4_Rc0BF%kuq-$}hnqm)so(w0kenFQMM+sj7n_QMf_*w9t<phu^@W*#Fu;<Yt
zdRm0YcgmGo+n^Y;_?jbv2CS<eKP9R~!F!=f`qj+VE&#ngv!cNg_uO#@XA8ZX=GY)F
zih_Qsu8ot%!`KIUt_oB6B-y=#bU+m6W4HTwcZF_0ot-Z7+7Z1Gjkmvl50h4hrf-u$
zsE86|@~ZLq$ldN4eo6HeI6sH?+IRUED=B-~!QV0Xhm-2WbfCnOk?WZ~npCT?SB?f=
zR1PpvU2?IJ0(QSp+r9;Th*J^tIb&t(MV^ePMtU0+5npmOLefbrDMtsjSJ|&E#YcO?
zyl$%Pl}|PhG|y%<mp-C@tBzX)ZF48=@SYX;Ws7gj#F~Pbr!rrh6@B*_OyI_G)}*#j
zOD)Qi)iTv)j&gD2R5r~NG$4v1SJma&jISK!*m6n~5D*dgE<%<8v7>B-<v6*dUwXr(
zpIBY%SOFlERh3?z$D4;)h=)C2V7H>CDZBD&IYE9kdi@MW+&}PtpN}7Mv7Wqq=B^2T
zn7D5n2;c5d0m)!B*0tUlYaKZj1a_zm*?|PbEqqPNnoq$j)(l$EEa-07*o(idKs5m?
zcX|rD50_SK&N@aCuNjV<JL-pjc@`Xzyu#BF*?eM?;d+8?a|BTpDEZ{lT?Uoy<HIpd
zUB$t;pf_6#&#2OWxOm7ZvC4$r(J~8;&yOCbVKtrQ3w2O-_5Q*svYtnoA_M6v$1`<B
zAFhA^BBN5K#q2_w$yD9s<dyr&GsJkQrAqU0+rHnf1Mp0WSBZ5Z-&nlmdi_wH)Is}e
zqB0i9yyWdms)ur?Mk}-*nm-NYWDn(8k4cDtl!}9y>z?|5a?zHnPXlqcyw)W?9D~do
ziZLJp1xjO@1nuJt)5k<HF}kiz9fx=hp9Wgt(cvVAbN=q#yHl_m5v9_0Wym+47r2rd
zWFpx9If!NDRS(>xz-?PO-Pi3epTFv5z<`A%x>{Unn5=jlmNTDhqBfMkvT~%=|H!=+
zzV4!B%W8^$k><t`Qy)<c9f>@lugyl8PK=R5avekUK~CI^Tw8rNzP`$heFz+N*Io?A
zfLH!_MQfjj-`iLIzI%>BndZVLk6u3h0n!vbbR;#Hx+h`}JRfSLLY8-`n1EPWV=c8x
zPc_NORST+?UiReCA)k0%{BYwc^3)_N(b#()C~z)+NOq3HFY=mx4s6?v1q(;S8+RJ>
z8MMS;miu6JZ6fa8?0qR@e0OK}F2K12QAkews4@ge>LPM?;;mnE!{$X}X?-M~FB})Q
z1oL>t_eTj(BlIpVIh)IpJ->YZGzwXXHdYrUG<hwM3PsYAPMXg13HFZnaq?aR%1D8f
z%%fp{Mw4=FbHI@3YoLb)U(kbc(LX~flyL&^BMP<z^2c~G8m?wge3BJ&yX*C@4Cbf0
zEK+FHhHJ9dmz}aOmagu;ATLl2MV4BvOGnFMQot+k^84*u{@=W6RL%6s>oMsvl)K)#
z07I(l(}@x$p`lkG1M(sI#j2t(mTvZW_R{`;aR1)&W-tzLOCN1fVG#lr<kGDUK^AEw
zi;^dWDgFrQ=;!{AC{6bBXN?UPe?(I#S;)*uaf-)!HJ@l^_i||t!`D$EQB&f(f)`pH
z7^*iC<;B}mN`5JIi-OBzKAjhKi^VC>J4^~(=@M;>t3oPGi(<JRfzT7B#s~m4q-_g-
z=5-@B_Jr6FsyKQ&(`;;t$X6~#tEpGBd3QR3gStnhFOd91ymGC}LFKyD^{P<3OL$J6
z5+oy5!EqLFjvB+joC_y?^hgzhuN;BLLMHScS^}6J>Eko@3BW@1x@*-oc#wUoo$`9n
z@Szg4XS#zdDBy#juikT}oWa7as#oZLr@+741V9LTs?H33_KUX(0C<+4z%sQ!TI`u2
z?*?_Znx8Rg+Z*~f@G?MGKIc2+qziYRYACvCMapM>Jyr1>scM5MJt)wP5XZ8FBYfvm
zz@w)s%yFT&$2K^TK#YwmlxI@r=6$)fx`ka6{*{l&qvx;W<s{z{m^U|_11HRXW6N^)
zI^YcxVqSYq5ZY9Zl%93+V$1mr$_me&(zd<CRdJ^&aNg8bp1Te0FEn#Bc&~v%k_E+b
zl=UveeR~u*9y;@=b1bg?^SX|CK@4iB8-fb0Fc)jI?cX1{rEeO;aqsz>nGy;^_!D{g
z2m9h5e&~=H@=RMR0huE2EKyZ|wVU>Ch3Ii%2mR?c1<ZHQ6uCK^v2Fe6Sxj|wj!bC=
zhM8uJR}cq*v4hTar(Kb{N%87r<J2WdG-`<sRhc*+YCxd7qfL6EUr7<ffjTMAEkdLb
zid_r6wnEi2jAOXRv2M_-{5onAj`Z<6^db%6In}Im?sL>Pye{mwc?BbXU$V7B-}%UI
z<a>*0GFh*ZGJcV9Dv5WJ7=I8r*7=y-9=x}N!afg7MDbFWlnVmM*u6b7TEw%5kYXVr
zA<)C!ZV;3swe&|ef82j+2j=;L?h@iT<y%Z8pya`>*I#V#QSLVNd<;ZXRjgHx_s&@p
zOn}xv>`<T|p?x>@CX4WYUV>w`{peLUdywtvy7j+&*f*I4dKm@Z(?#8eNF=WiD(z;E
zUICPYx6Jl>`}4HWo-34XkA&$b{hOTjVJJs3QYUg{!g2X7KCvI1bgXUqzB&kM5=k;<
zA2>Pa_3pVsHL}pw>A<}>M=ix4nw@sv(=3wgNEAV%67sr?@Axu*zU^<y{Mt57K4^~6
zOYqN$9NmF|D&=w%@DK7oLa+gV?Tw&zRNc{7f`J)i2Z?W#n41aXgVzpC_0$*3&E?1(
z^f#z4-|dud4Y;$0abbb@f|_z^6Furi13S+r2sy&o#D00?f!zN5-OF`~_;HkH**#uE
zEaLEoi)F%2B(GY34{ImBpsqz(7<iwmDIU76Z66;EHg@8;-cbbul2Lxgqps#+Z19m+
z(1sy5GMym$L1DlaG(PI0inUf~Q!w(eZ^^gF%paBpMQp^ivZE~%!NC!S#b_<FZPQ+0
zQ*58qLX7Y1hDsF^1E=L%UsA+_cqi1*g1phlM@&HV-4Nq{ft$BhoR=G;aUFkGSdbFD
z=k)xlKU6tz+_qXG-8o`ZrF$sPbg`@CkhiXXJ_2TtB1+(Eu<9X}U#>(j2kIhN9FiP_
z$b=C&nT(4!J#u5+%sujfhJ?w~;;i5g04DNj+uFsQ;nZ0#1A`kf4FCozUL&TOpzSiE
zuknHLL-O)}F*W<bE<172=#BuuWY6Guc2Us%%u980Atvf)jYs_`h=JxUVV5!T$=e$S
z=evk7C@oW+K<LHdHqhNMlD*f7lg9CyjaJ<)dQls}4O`^yfX=pBnoIejfTCoqk`{Jm
zi?54Y7T?g8J1S>qV)yxwx*W$$L_iTT#ylv;QjNub(I^&+L$Q9WG3#ET&B(rkYuL0o
zIV`Zcc=hC{rU77dc%Ln4qA}^o-1Kdl?vr;7Wr*pk7ciY5bC(#{^^9(ZUzB>`^^bG9
zxaWa?c?E6=&V1t}V7Cs+RJeMi8(Ir=ywX=JiYN1ZL=LM$b=56~4&Jd_RB&;1XKn?V
zY~!kb*>UQvuNWP#{4If7Eo5+81U0a^dX;<Ky$J4?L|oC}*s8v2u^(CupgeI>+xjpE
z(tO_f;SCd2&LtcSZ>Mg|sjpgF#Bg1Bn)It{KM#FhTjF!W;QjOJ0t!iYVcdZwNR+!3
z37>W|53}vt&+>Yy&S|&J*FJK9jO8?_BxUx0&>TXYx6T5>ql3!9+m049^zBlTufXP{
zdTn!>#Dx}CQkAY2>+A-JTz1}{lF5etH9!rx=QqmXxI4%m!NlQuDo@jMT+ZB^h%;C~
zj6aC@R)Jb1tcZX@tW8Cwl5`EBk%FGy$y5A0q1?gsuH_@>7b(rx)eK4-T}iA<D*5z(
zJ<>@un7W-$?)XTqa`vX86E+t*muO434(HWay!KU>9y=ovxQa`1D11Q6SQM4SOd-_v
zCNR++x?6s%EFDp~FgnxEzFa^DD~qCr4zef!<kPTO$_%$nKT1MY-_|Xl(@Pq`6`x9Q
zb5iEXlc1FfEFBUhaBw<O3kk&#xa+BZ={D`@#wyR$P~UzJuR10^C~fnAc1D<OIt0y*
z#z3RnS5&{<l@PjgIp_JTm_P-3A<@ux?$|k?7%gWN*c$YPKC+CVa)jSF?sDDK``!Y(
zn76j>XFHTZUu|_cpkz*dD8Z1LU9pLHO#T(ViQco~&K=S{(JB^WwD;07)FldkQNY;E
zmI<imEkoQ_(8RPWi#P7PtRzJ4GO?Do4NqtoxIFgDk*<xOFcnNzNOb85l6u^^bBG54
z5|oqd>HfvTE`bj^kb9x@i{t`G70DC@9h^q&3H}CihfO4B4wmcS@Zh;%$jIFR8_zgb
z5xS6ameQIVrDw%?zcuAiZ4DuR8`^j^ku`sgape)psiQGWjODG&(Om_wU?v`s;E)-s
zqgk$cEgj2R)WJjs0L<**6h4!dL#gN6&liP14W2M~jtSHQs1|fB85I)x6$f^ce6h})
z=t&C=Ljo}qDx7UIP`n3SDa162z@&4{SC>zydUj9Z-vZ%S3lrk^uIx&Gl0m6eTpDB#
zFC(!aGS&&z%+K(`F3sq*kX&A}^ak$6U2->t(K%pPDcv$$HG1}u1I<Zau_-QI@o5Cd
z#D1=}k(H55A=j^xST+9!EsC>TMc`;+(sZ2kK%D#G&ThWkPg*P+5|QNJtKf@hVD^}c
zqnz@32@rrAjqdOu!xr*?EPA)$z56?V^tIKNb9AqdG?3ZhGbpa=dBq{S<&~)Jp%xdn
z@JXKNc<7Tzug+rT*y#din_=}TQag^#QI+$YaThc*tLyt^u?#PyJ&e)Q%y4$^dfAwn
z%^OaHddem1AP$E~bN`&OMmXt?18V!&-R!p=w!-e6Egn`p(lX_L+5Jys8IvU(MB4gI
zvuN`$#??Xpe7*(-el5XgIEyI|VsaMUCXAy^(DyV9Lwm(k|5XTvuvVLfC(p64VR_1k
zCGNNlE(7gfM*{dfdrF>;-8{j9qGsDRvBX0lPvp!7i*l=Z<&Tfdvl^}NOv=ONN;uYX
zF*?sA6fgFfM`WXaz_+b<HH1S`<T+Xl0V2d8UphJm$Fq7R=QQzJbURIn?!2hWC2^hT
z4b86gs`+i|Ip(z(pO73!n3zUIe8e&R@#gtri4c*B=MG#79hnZORBWLdJ;OiB)yVE!
zz+`zs9V0%?=OmcoR>5i6n4lOnGbp|K-D=n7l%Xb3z4hXM(SLZJ+tMUSG-$<Not@d?
z^l#KgLYC2xr3|d3Y*Z2!VJAJ8>D2ELy*l?*Z-sjvehg525*38pR{Bu_z0b?VxR3Ji
z!*a*q96Sg7IaU)~w$gIAp|EePcsr-8jOD=H)fnAsah6+D3PF7*;^*y|5x?@#*!7((
zS}@sf>_w4(^GwqnMNsvqZK-)rxli&282nvH+Im7)U0hj-pRL@-6Gn#1*4B!YCSoe)
z4jL^0Xn`@6gQJ-b%B4k4iG+P*xjb!y-~E)hfswZlCptD224lZEwClO?!9E0Gur>6k
zj?J6Zi(<Q=t2~QR<>>)$cn)L|W+ofqCizu$fp8grx*v@-6g^)ce8%uF)&?Pt1z|Vc
zG#yt2|9es3b3X(w!0)|d5TUM@bjN}+z;^+w1apPkq^U-spL4^Px}ok7rUQxT5&dcT
z!TmJ@gH?Kb3cvH<Eh_B0lgkNnHxc!>pxl~gszw*fbR>zZxM2l<3OW3)H{Y#BhTwP0
z_!~}tvtN`%Pbfx@^W1GY=rmoWFeS%f5b-Lex)#4jut>eBRpi5bRKIqmX!PYj@YKH)
zPbUT)N^ot>Lu?Hg)?x`Q3;h;6-Ov!tub^UZ7pb7LSH3<7N1olCjBhyB{33+KQ@FuD
zBByuj<h-0)8rA_Dg4qyP&~6v;8%83Oq*TOz6CYu&t?{0y<=2<$q?i?_rACFG@rK7p
zVd}sS4Gl}gE;oJ$P6|1@CwNwji11vH86OLTQyOO}#*OCQ$ngE(Mv@Vn>m)Wac}{Vo
zASg;L(WY9tUZ`%!HA}h?4LXm~5#;i&(@rrfF5ofCFu0G!!xU3|D67NZ51ZxYC&Fld
z5meF-S$ZPyQfePQT7OjHla<Z=;a2UHone{hz&BenSi>`>{=HOK$3zN6t%K|&A5%pq
z6xR4Vffoou-B`s2cSapyep5P8_^*F_{`KC!epNqz*j3^<Dc<DN?2XG6QNp3L37)K2
z)o2G0yq6pn0q37plz!}0nuQasN1Wk*L0EZfi@b`UH6XnH%tLKz)-5lt$D6D}7Ek2N
zQ*J5Cd_xc&Pk;p3ligp^UC2%j%&Y^yS-0ag7s^joJHoO&x)S3ew(*491LhDW;@6GS
z4-qssCWEAP#XKq+L+6J=-ZT)#mE5g_)l`o*FQl@gGrYG;M0uLNiKcP<;il7nCsnqW
zNh!Y{oA?C-8_B;%h-L|Noh(l&iCKLle$b32Z${7q9H|!d%0-M9kGaT8800;hqT;1=
ziMZ=vc&&(6PcBT*<7pP`iz;`#4qB?zl-!hFaVADU8EL`9RS%)+7sWpfTGP=briBv|
zPHv_$0HoNew#%!nUj>rvkaVGc$q+WkuzEu&Qjwd?6x?E9Mnq?(pVi0VJI~r+A4kFo
zw!9vMgsrL1!qp~c2-R90Z<4${uINZ@By<d*uX}BlFl|QOW?oIVN<1c9XQ)L_95FqI
zV4Fd3ICDJQ-(v;~=V`T|AE!U&e6mtTB;021l)5UM6h^8+BE3f{*GT$*D)c$A3qQ}{
zqae`QVYkB)o!Vo?Bb2;QiY?2knvb~_z~2$$Hbt2rRtcM2;C5)GVjdwyN#pVNPeo7!
z7!7lT#XWxNS|_?eV<cs51<9oa@|DkyQFvj}yrZmyjZoLC`tsZd=DCTQqRf=Em%7kL
z5+x`Ou8I~FRRb$Pl0&_Jyp`x{i9Vf{x~aGC5{klYcpm275jl@!I&W<VrD3Te_brFc
zW;C_INXnjs&fr)q5ay3#48{0ZqCIE%oAL}&(K<w&op9YjldS}+td6C-fdZN>3<^r0
zCBF5ixf?*4F9OuF=-})9?8uTN@&~gMDLA|QnB>hp0uEcFG+n}fc6NvOuhy~B2W}hF
z!o-EV3qZ)W<{4D+#R_>70mBgkN`lS~@hib3Q)sns3S_KMnWO+c%@>z?Dc2{@^KVwL
zl**K%=O{<;G6D}qm)Cy4^?vnqgS+j=bbKB9lEYOQ4^q)*TaY7vuc>&h7ZiqeUci^n
z)eDgH_51q$u|2ha<>I8gSZ!+Sqv2GF4ISAM*;}}#;bOJcqM1iFjcZs-fz(Ghf|cD+
zu?=Wemc)n33b!VIiSP0TkMW_8(BNcPw9#q+78FR)fHl9?+&jVN6(;c=v`cTXynybW
zk2FtpEaBboQpue<z2TiAtv4E{VvACI(fq`tRupWKa|QN)@Wd<-!(^~~SULbx0C_o-
zNofuAh%hx`OD$JM(#k!IyKmq6Gysd&ny=}<*4+g5<w#LAllJa&2@|Vj@OP1qT1{6e
zQS8yFNSGaY;Mb^+aX5}p%4QsGSe`2fva27p=5SJ;EF8THyUo75LMYvO<&<9(5DnZr
za`>j0SU~T8k>)L2U+u<0*&Axfp)Z*d<S$C1rbL2tz`ZAS&V>9C$smSvH2(m!jFTX9
zj+yqnYE>LjHK0wLB`agQ0qlRYsw0TQ>m4w7g_NVd)#?lEY9Ic2egA9S2lv<~)7WQV
zR59*SS+58|N7n{UHjd>A`oU*dWGr>kz9_u9EM~WV(>)kj{${-x0+AwNxCXk!gj$XV
zU$}?q97=q_zNzqI3ahQM!WvI+kD3=G_l0aH;n2!R+;^mzzXP8d#U8msKxYm2az+vO
zzQ)HqCR$?15}t;O@rY(LC|7AscC$$v_|s4(Kh$E@@pDr^TeU{Vdv}MXqqZu~%F}{Y
z<sAcm4$Wz-U)4pU?yeiDl=btJNTame{UH%g{Dhw5i-|awxh@{M&3oNwcUYhV0-@&C
zu+)(}zKzBHlNOhc;RRpSU{)NLaiCrXuD9nzCu?q(GJfWb5So}2#axyFesb=lvO=Tw
zN5dNBY@~;7k=^r0Pigd6!Y~KJNLtO+as`KfT9B1_J-!l|JaWz40n@DUd@TWn9!Emy
z2?=Jo41sA46ASct{v}j3fk%fvVu)|7hF;_8?hjdJ7?nvvO=EnwfNPd#M`vY-++1t*
zPebwg7@nOE&n9t$_6+9+t0<8haZqA}?aN1?u|n(4pnKMv<9Cy!32$#{-M-d!RLeVm
zJVx3aeaTb<i>&q<bo$lmgyR#KHg#ToJ#!MrxhTs8)&B!M7r9}NNB%J(mXXjCJ^!An
zrZC=ymhp`uEWLxTpY^iCM^C@L5ky{q-#uzXbgCcZhWUOpOp7;xBqYi*Im-h}OKp(L
z{wXO_6f$m4>iU(d-6dddEhW|(&e3ImK>5CLld;9YHyXrRc~&k>B95gvL*sEYOWo|g
ze6R4x9+lfZ67-PftH^Dsm<=w<*X7)C+WEjO=nnqciK-0684!xbUY5p8Ufo7ibi>WT
zm_@nlmharLw+lEhN6;=iEsN^8EJ94iSVHC^z}$31%<u}F#(sH>!tE~~J?~|I2j3kk
z%G+Qt=msZqO>-CPR<G0MQGyKjT*HIHa?w?EaK=KkEO23``QITK6(`xDX#PWm{GuM@
z{O*f;Oh_4bRF>12+GkcMW{zv?cKtEOi?Evb6?^jH`C5h)!{31$R=Rad1^4we;v>$T
zM0;W;t&_G~L3}cT<3rxnUcFC$KyUY8x`W_0AK{d0wT&CxK0I(c_N|l55@^iq@#V}3
zCx8Vb#1hgIM+eP@b@2SDBH%Ewy%Pb%igcjHJueXIm^GkSxJZTCg4PUeDbiTM2L8p7
z%}D{1l8m<>OjR-DYJ~8bB!k>ATuD6GK<ivb5JUA>ZHsmS3IxHxkF^DVBRst~0pc5K
z!}zq19b2%t6qdZ@LofJVMOWObI)k}OJlR@YIx0n1u@+<h7WjNwg539Ua*17@;prj`
z{@%>ilEb)YLlw<4iEn~6TnsMaffg{yd7o9O5<EL2bOcMkCH2IuRiQpacEh1!e1Yq|
zbln19LqibjX|8rlb;gK)5WWRZDtQHaVte9iH5N+|!1TQ9Qk0san4OCd6T`onM^iC{
zEz?{|PKwJ)L&#6*hFTVjL3Th>HkZ^Jbf4Q2sgr<V*>e|#AaWHX5I!jJ!<TH^gBtgk
zzNr^kzq)e3=xw8qW-I196x@t1lcXi1h5<mdFlj`*u6OuB-aT7?)(DN&2^Zi@s+l6T
z_53>V48ZI$bBro@FH^M%1&A=|Z@P9dD(b0k*+NbboEWkSaG9eQVLneU2i}j1w6%4n
zE>2v;A_-f!=F=Rdf8i@R&&zSPjqQViAl^W1GUCC}Xow6Ihaox^T+EWtg?(zmXO4#~
z75)q@M4_l6LyOCQ6|LjYLvJI0bvI5JNm!v}tuf%<-@);rg@ENMVPfKIU+=aCT7(!i
zqzCtLB#f&C)~8bUD00o(vKIOR;&4L0$d}2{(+!Pe7b@BqQYr_YNr@Py>FDD}4APYq
zR>=#g!5BSlroUtogX{};Yx}sh@kVLDs(P_;5SsV>3l1oMQq<a+y1^;A#lQPbeDVNb
zyyaa@Asgj7Ka9wxQis@pOOm58((Y`KeleIeBDcN9ZH{)?ZoP+0mgR2%E*sQO@VDkg
zwtPA<1P*$_tJN@vK{{B>84TthwVv8(iqSdT+9xSJus6`ryrYBnM62$_8Nq%Z#J>-S
zGlM>Ehy>Gr%Np@gk%{Ql)0@gLT{RG!_qTz>*TG8J_6n$l_o#U57)<y#!-dbN*7w^$
z#Rs&4BaudHZ@E{$j~?iI86M->GjHytH9XDJ;(`$UZalkpvtr6X73HvgxA)QA*BRA4
zZ;IIpZvPraOXsQIBZiCG1$xaUE@xu77hr(3GYY7Gu8;5j-^5vOHB%SUn$E`RxXvf!
zY*CIq>We?Tm13r{t#`aS=1jz=HiD$dF7iw7B`MeUyK~@LyHzbFF{c+@V)7(VT_*(_
ze1`=zE9NlK=^`74Wv&byn&B>hhnm2tJHVVmw>vhk4f7GqGqo**<|WbavW$I`VXUtr
zU$e-60N(dnc&;mq#}pT+R};;!t872@<x%nJ4&oeycruF<xBmuwTxjxioxP1YvXsRx
zjuK5aDFwHZF0s={Q4!YQcI}b*)njQ|rD?Q*lLv>ZbZ_EyPZIRe6Lddz`CNq*?*4QM
z%OY{S>gYgTK%JM|b!G?-`90iv(_S?cRzw7UdYN>AQmkAU0)zKBuyqN~sGjl9^6Y$3
zoIcpv$P#VAjqkzMtdd~at<O`=^s}A(^8jXp5L`y@8RDIRw3rM4!n>tG%v<4B`xJ+L
z22O`Gg5tm?(g2TmK$=5(hYLC*Szyq}y0#vYRl$;Op@%Pg)GyzJ#Y%Z#s`a46Qpa_F
zTUwP6d+I*poyg@qG>?$OrQ^y9AIv;wP=259sq&(M$!<aL1^?3yWkv3LCq;RQ8Sp{N
ziCTAx(?C!%D~+R*1`q0zwE=plQ(A~qp)(@`HR{~m(8TMk=Uqpy>oZD&nK}%BBpm@W
zG|{H539~0v^}0VUrd2n1eVkU*l3?+FztxO15z1(AH8wgTj(Cy^9_&ZhL$_(KsX&-B
z==f5!_1>#54Y$jqIF)thK;2c*Z(;q{0&=j;y-hBI$`lsH*f&#~`FQ#y<3YHo=G8d2
zz^cG_t|43{S4y+a^H~fK0Ii_YMCUQG6#GoJ<>?8YIEi;BE$e1ASk3o4zv*Xx?*W{6
z-TX7s{Jm@^hAp(TACcbgSAtFScI-$?7$a$_@wkbbD8v4T!X|nL!1$Dh6c@id8HLR0
zrWm9)s<3MB1wLwc?Oxato;pPeStE-q{gtR&P6gJBY2fS%Is(>0PXaMB@VJzq?c6`R
zxPQL-X!l=FPXD*N-|XGJ`$M;XXH(f#6m8KoElN15|ErIR{hxs<i|&*v@?e;(3)<|&
zp_dz)K1sDCNF=uaaotmq)|am5PM#tE$KLku%rO{d<j&gp>Vyl@UV3N#+KHMzAy?c=
zS28zdn%Y!CKqWQfju~%!#k%2%Xkq*2IV{oVDRVC=6X|Eje2Ujhe<;a+7rXm}Dq7FP
z7$(2SF9xyzprDqW^oq3rd%d&XqB^7virJfA+Bn+i;w3&p%ES+p?{QxPw+d-h6EQ}V
z;>DAL$6r6W!Kq-oeYV5cFY*maMNT|!AD{Pt%WxFo8Mud;hS9zoRbPMayWjg>ozwOH
z<SK;za!{wJ9|eB{s1Zkh$!?Veka(xD6LEpwndO6N_UOsWIBDdvNi%)!$!&2ggkG)-
z1?Q&3l!KN8mI@C?7{`r?B?sA`!H^^uA8szp$GDTVqIcak^sd_<ZY?(<c!><>6HMls
zk5H0KQp<}_r<q8_uzEm&p*Tn95{Z;R5tf3eY~7_3qwFG>lW<&rF%hC2EYS-c2^w2Z
z!aN9b#doENz)1^2C8!NAt1B47UXzs!cvi*~CufFnZNO!CALccV9TTk+5Mu*&Vv<%u
zRL=w|t6LJQ5XMoxjA_9T-DWQKE(L!VsW#VyG;5$-gY3zhV%EUfwIp@{`YTEXZGw6u
zg{urfz6S^aDx_b3aY!<awOP^ra4u-H9tE#QCzjfSXxUtFzVZp)Ar_)T4C<aky*?ww
zVPFS!$P|6w1oSyFP_NoRT9B;Ws22~5W`SG7a*3aLe2lUl%af`+SepOXzqT|u@;vdi
zjq@Nw%Wv>jACzA9gch$&W$PvE$nKwlhF629v8D)_^{P&PY5*q7UA>|HG;}`+HddqD
z?QSC{_ePlekifd_YeVb`kcrK>!~hj4z!zMsb_CI`CB@cs*Ji+gL*6=8TPF^+svDqy
z+mBw!mDF58X4rQZ(!2btG#cfXd-5b}%NRT$I`=3-2y0hxw?T2cd*?c&Dp9<UJoV1w
zv|Uipj&hHGORb(cp0r|0ddb9Rm9K343*>wFuFVvipoaWHMUSPDQ0tX}at88@#+%UB
z>1w7I8!v?HH{D7OY_#OmcRg6Rj_W~ockqz_i>D>`)=TcTmAk)Q4jAM$wKHvG5dnvB
z15<%obPou+45T+;F7Gu@kHwfJGyB-p-dLwA!-;Hv?M<s$+6ARtye%_2)#^xPV7_}y
zU5D_X*<mmHB>sATeK-dVDE2V+-7G%LwB;Z)Cu_lKH=X5K<-VR=W}ghQZ{k+vaKtIw
zlod+*rrAlg@scN3!UOx>4U#9HVUd)|w7TSk%g@}NNd7}ZT&>Az!YPzRB-052$j9R2
zWNtKn`Gl@WJ~?7KJyJhQh%+|H+bvBHi@^b<J2^`iz>W5<U>F}Ae0PZaX4jN2@{78E
zHk$Y8R@R>t)yzEyrNx)(dz~H|<@GKs{#{~7qBP-*`b@6Nk*fbg@@K05Bk8>w)q{o`
zoOsN+sqEm&yHR^vIEnbqGOu3`3AI3pdFTXx(45x(dT_p+PHq`s|IqikR@$=M(bUmG
zZ<J3|SE&T3^kJ;$4qTAY@W7kajO)DtF^kBm8T9l7BV<<6OIUnm)DI$|&&~kG#wO2T
zKb2KKn^Y&v!4&RW_P15F%wgzQ8&`M+6mnf(Cp&7$3L2p09f^<FZ%F*LPC?L!H_;w{
zu!B^lj5QM^kGG>kU^y<%t4R^^3dP~tvr53`o0zGNe8j-$(O@^Pn1HU(4kGp&Ix+{f
zhC94Y5?htMY*NpABCx@Fe2G!P3o(K#R)AT_W1h@3!Y<x`5PX#+K>tmNSC+7V+RVP?
zqREUrESMH+5k)w&Th-n$W#m;llXokBj85E1+N>!#mHZB^qci6EAp?PBFx$+n;h4ck
zdKKsmwC6YP|M&mqYrG-DhEUU%=fb^2Y`D`oK0dz8r<0CZR)MVP_)c!Kx3+GNPkPF2
z_uO8N$Ckyj1+Kc5cC*Y@#9SIQAcx!-P&d^(Q2w2PlEN}vV|H!?8>VPXh1F4i#>^VY
z)DtTFohhAg&ECEL$=7V!J;=hu(1}R;X&bRD+tq{JMT<9BcJfZ|J9_>eMU+^<e)iqB
zFaG7pi{Y0qzJ2xlf%NOYeRJ^g>0h4=zy9{|lLyPis=%J>QTtl(TJ)@a(stJFZ8~fB
z)h{#pEG(oIFg)iEa9BUtd{`TQn|AeX-NSC(+jO+<{j#GKpRD9Kah<L;zWW&8{WP_1
z#Ht&UUjO3DuzPp!K1RID5i9H8as^}u>;HilHd)o{oqrwl|C(1?(n9Ht_Td*Zq}lyg
z?>8Y$Rj+u_vo{m&z6MtwF#rI&WQ^AM9gtG4n^vy@1^w`r4j)hz-rT`|b>Fx9@rQfi
zCftaa$U0n$nhcFW{-5N<qG|R<Bqm))*U5X2_T%0A_c_{+Ia+D;>fv6Cy6o~c>bBa_
z{=!?gnO6U5bYk1_zyv#1Ti>|*ADeW<4#|Bz7Tx!{r+e>vPxt=wo^Du2<A{FgHI=kX
z=2XA;pI7!j=+iDQ_MyptV-&g}lLZ!2g|i@qn-EStmgOF%?A9){txKZWqbLn-Lz%`k
zgEd{u4`O$eRZk+_B>Wczd(9@)-WzEaPcAhzg&8Q0i6&eRaQ%-(c2>2e?;u$8McLj+
zP|<MJ5vvjhAfd#^a0Qg0d2?VnMk?m~$?Oe!EG95-d{rzE1+x}^65g0mslKquu=fK2
zi#x_)=w}p$vn^?7tJ65Fa)5L+;q+*w=%8%*BgmfJN1U9kW{tyVPo6v<{^iw^S1mR6
z?%v&!x8Uha!1kKSK>FEnI^JV<B*jBqtr;!KWU+}02U%ySa+o?{G#kwsZ5C>U*`Uhx
zOO$OdFXw8--GwTDJ#5{6_9R@q%p*DZ*p+nWWHXMV6?F|9Bv#^jo?o=9-VLB?xhNI8
z(8k%&kN-iu<qcRx`i%AjQzycPr6==P4{q63h_Mpy;u6`>+&|sPt&ntldt996?#hGg
z-0gZa=HTP3-_s54397y66^~kOR2H4%_w<g5)M5IASCmD6jo*5<`^UX*Tf$u*Jgrgm
zayps%1L(WzZ;f5`<8N_76&Q^Cy>lH$c^uVHDa3#dF=4|+TB>HS7J0<Ra)!yAE%F)s
zz7T_8ISApfwtF`vsd(Zro86t=yUX*C@@KX@Cmh~|z&(<3TkKt4hYTb@0s+aL_(NzX
zo+<4u$M8XaxCvzU(DrS8SAu0jE?Hub)JuIq=qGgs5!L@$2@i;T%CVsiU~p&|hP4Ix
z^@^o?lSV}Ynbe0+S};zd_(lkTX(+Q(7n2Ee!iX)J6#rC?AJ{K%Cx82RR*o-b_a>EO
zI@PQig2)-=2=bxZ=E!AM-g!QH&E$cR`>wYaD;<%4ZJAmC1})^}8}&IiE0Br6w41Lx
zk?beV6k&e?9}dH}A52UB7w<^vagR-)*J=uLE@AG?*0l^a0(-Fi<X;XmM2#)MJ-m2)
zNYCUGM)bkCT6%Ny_Gy&^<#=CTx^B->wH?KX6SUX4(IAZW9cDXsNQT90_y0y7Wh+jJ
z0;6+(1cI!A4i+__G0bUt5r%j97|>?ky$y*8=n?sRQMD#3Fn{kPlU`4(AiekyB+f(T
zR?^c18k*@qGT*&lR<|AX1GE%)bjn{XPV<pI=z`SLmU*n<%^3MDDzY~G;mq7w&ymF@
zJ9SrGpm?Rk-&W=5H6b{Ddt{>>*f{AGBfs8%RxGH4Bo1euW<E@4iSc_y2}1@fhF^Fq
z&xdvlQjT=%k$X$F5UrH``+xtpMsx*NmebZTY+5~uBr?BpMfHX|IbG#$n%og#?(_<>
zH51=Ix>$PplDM%QXbM?&S=MsVi7dZV_eM6M!KhMJ8dY{aijY$GM*U8A@JsVMjF6Ro
zQRB{?QIcZu&K-|Fo(@m49!!DFjyatmpSiE5fXhVY))S5Vv+7mP2QUh4PA^}2>nv>a
z;Q7-5qFm0HDKe*`b87ic<nbLz$e5d#+VpIO%2=fngR`*DrH$Z;QgXEAGAFkpN0L~V
znMeei+#L|P<-|YMNY=jLS$DH-$IzXBTNo}d#G@5qtKB$)NfHjr*pzs9SIo8}BxSBX
zW>Q9SL@GQV50IxyWy_V*mWC+lubW)^>$L&0@OgH<vdUW?#+z=wjBr<#1PblhM!f~w
z98k1mwb+#6R%Z688Ppg0I5TuhJ!$}w4Ut!TyEJs|v|LO*d#K#iv>f+Gmqhx1G3;zf
zb)cYc(zx<ncBv!Wli<7tvP3UJwUra3;!^yY;@i+8-X?pe^yGL{$$de{BcIcrM9Nj&
z+u7Z-+nUdilGsh9PR3FM1m9X%5J>{QVIh0|(j2wD$Q}g0?PJ%h=w5vD&rO_y7I`FO
zKf?B^TWWsIikXBkSEr|pNk_7OrE<!6jXQVNI(Gz3Uj;zZpZ3=Mp+`8c6Q8mN-kJu9
zrfE$DX=T6;p05oj=>dD_hcGTq%B2rX1TF_Mc~O}Xr_>IqdKZO|d{9>`b+5SsC%L<9
zg1;o*;tGWtuYKR5PPxbQyW%No9Ja`BT-}B9q_QF<0oOxblhk?Jt|Uc&pfm|IFCPFx
z<d8)u^|FxMoKtr$&j;Bzm0l%P8d(Zatf+Y1T*PAtm%zN}inmK!KwE^D2-`~MirnUO
z09gy4KszYklKc<^eTn3B*fpm2zWJrVL6rk0zE~VubZY&^rLtFZ^a=U2B}gJs*Mv8E
z&qbnIS17eNCF)B=UqC^B$wCv1*8>5-1~BdCRMOoFT97FP`kvQhN@tP4xJHDtGpGF~
zfmzS>=_$8%URRT1pnObULLhX~+jdQQEhM4WLOhn$nUluNQ-+Rz7Rc?xY~5L(pQ|Ug
zBw0wvad=V$e`7%v@Eh+Mt$u9LVPAX1lm|L55y(jt7U?r%zAG$$d!x9<beLD&XtbKU
z^K&VS>b*M$fUNI_s7!6t*e6S&rFmG?RWPqJ@1_{XyKjrL*%CkklkCsmz0`UoQ>`@-
zmn0uBWfV<56oNiH7OXpe{zro_)qJ!<ZN>x5h#V(BCuRw@&fScjf(;~z?@vFVFyY7N
z7`d^gIYE?8P6PsfZ9L8}TO&v)pIGK4Qn2WV=;3;~wia-H^AKi7rW4#4DC3UZMTKME
z2W{dZuF2)fCG^=?5v`m=af&;qQIrVB!FmD}ER5Xq;fX7PI!7mp?ek&tKS2rYj^+>5
ziMle%p#+rQ8ws!1-_?=X4Z3c$dIFT?adk2CZ2FOGy&PbFzZPJ)<tNWqJfGwy^O$>N
zII;D$XStf4=geG_gkv$ppmGNUcm*<|aHz2g6AhWiX|Sk9H*pV^*M7+iIm&<~LVQ?b
z=e8ZIwi1LE7^q2o?Zm9#%=ZWC-L_%QivS(6BTMlI%{cXkEQ+lw3ZHF!f(+^R?lO+B
z7iUIu+sO=ni~;YAP%ioopiQ49Qdg00h;l$kf}9~!Z>{*=63U3+LOSj?vSC9`46LJT
z{89(U3_cR@n5gqo*&u#=vu)~UnchXiz!V+<tcHfpm1ncn+!Av;F}*I}oxOzUjL^rZ
zE5`_03n@NbGnt}bTl>x555an95fhBC>0(&7gn1EvBdDfx0y<prb`C5dPoJYuo!9<z
zt%|4g+qO?jMXAV!(RKe@%;iNTvL_zo@-(jP=5Xob8WK!Ak_JXXM(iz~O4VU()P31b
zKYdL285OakNIksoClk?z%Bl1M!*W?n=Sx+e1$Ba-|0Pq(^L~x0Nd@EQWkJ2CPGMKh
zw}jw-v4T+hF=H`x5tYblrev0AW;RXc2n|ym!(l~C=2%lVj~!KF$d}||d`H?<g%qq+
z-NlF*ed63^HWe9Ev&>!>V?zd4yh*wDN#1%-54##=U`Ap?=X>`A-j!SSRzs6QV$U}E
zzKsN^FW@cex*t4$s#=v!=Xs=XN;2c35bu(ISdQz}v{0!|^|UCUc|C(%)0EX+<<nxx
z_*~vmO;4Ke=R#w0V`iw*;77rsp%9~o7rDD;A+{IPNU}y$vrmPX0dR7PbdGKg;8^?F
zi{ef7S|GsDill5TPEVnsjEc&In_VVw%Hjr461-$y8|XC*QMNicH!~j#x4r%4lb0cX
zV;g=_O*NHxsN_>}Q=hW(dEho^u@F3SwGIm<x^|o+_?TiGTmz`_6Q!p@Sy&i$!h0Ql
z`^Y;#Z?q5uYk*h^XU4!ZwE`LVlnJu;ML=kA7eSb6JTe3I;}2;N?YbDy-uvlSkURS5
zCG)?Is9p{$%dD`2RQAN0%6KE_XUVgF+YUg*4VV4)IJo{Bqew$^4b$Kt%2O<w3DR_F
zZ`Yeb-AgomUy|}wjFfS7^*e&g14s5N#ge~F!lfLyIIl|4IvhjLt&{aV-hWqq(bSn&
zF}KAK$>hvoI;F>7E7Qnyul%>MxX1EBvJXRiJiRo8*!US<Q*qI5KZr#WL0>(8DHK1-
zlu_!JHdAQ0)yPb-j<}Xn3l-c31H3MPW&O~@`wL@TuZN}3CF9G>MgL6P<znda9-@v7
zckGJ5>06<GKk^GxP=bYEY|~mqP8-xf0Sk|!p4&G2J-Q61f;+2QA<o-v$E+79;4<Do
z?2%(fBnpyQQ5Dwv&xhZBBWgx}AvM3!MrGSukBvZzc&;G-bNmzl1#c8o#w&<<2$wN|
zN0O%rdg6s?pA^hQCC3;XuY0daZEy(!=f{G&T5evNQB1Y}B54r86f7O(Mmy<Ytvx`d
z6DGxoL$oCe=%-i%C&PZ6P&kqAI{lzgfE_=3_2QZPO&&C)%hOxD9e(M53Fi;zDpdt(
z5sOdPU#;C<_U6&^SMEj#twTKu<XTHuLTR(-CDPD`dvV-P;GvpwvHKXyFTub=&EHjv
z7Bt*z3r42j!)0LUpj5C$P$gGS!!*a<aY~2V`AWehsiPn~wS}vqDT2D}H}M^_?cE@l
z6LM=WNakId1*zu}USOMlSI2FKqT1jvBX=34phe_xnJcT;H9fyahHaIaVVYeSh9qxC
z{+`&&l7T%@4y@nhkB9c1Ic<ix8^a$il0-=<VjrAs6xznr4KXSW)CSwB-k>KUelOA*
zELUKiY3*)V1t8g0fvCxO6ISn{isN^wIp9`dZIf@Fi1wneeH8J3I+8*5gs?h|xkN$!
zJA0y}-Zp1002AwpaLfBbagbvbPTIzzXh;0nCJY>e<Srl7$fG7i0audIS{DKBe%hvk
zjYGZX(S3(t@U=QUBVV~iSF8HhQ0a4l;WTMI#19X$?>to6l$zH@;Pk#m8E)@>35YuL
z^Ut>T__t`I5w@^@{W+ZH^gQwvi-Wnvt}@T*S0#VYCN4qV7@~y*^v_NNd~c8)eX|C;
z^Z{_9)c-7ocv?o-v6^8e1&@+h#RM>Z%yC(c8d@OtyhUy*KnQ9mpvt<zY6uXeWFtyo
zrabu6G>3JU_6q?3%GW`lJRSvLmWAIvqadvQ2?7P6{+nxmyf0l&3@CmQK(<A_q*`!I
zLaz4l^)@_lgCOah({AwmcLR28UcWYfz9liokTOt2`2~G*ps!ag<UKPI?RR#a=;ekL
z-XY1g<Bp&5yKamts_#SsusMaaKN$f(%oCeVcj~Mrkg$lXWAc^iwdM%FA{ESHbyCdw
z_wKs)v9l+CkQwHSxG4I@c^Zy$4C*gA1}fkA1PStL$&j{8{2FsLtMa-B=K&EL)Fi9u
zZ*EthA62xQJU+I1rB91uqTrWRgz1}6%LGrNc3-_nEIBVGa}G{@?XZr6&b>i)u<6*m
z&q*Pk$f#(-WRWE#I|#TRvU&um(!}+$gV6a^tKK?)4462Ra=BH&6g#J5pOD^El(J5k
zH4}~p?CYv}+ilewg;7^8<ghh<3ouo`4bj$d7lanPF4VYf`M1Nq)*kp9rV6*JYhDYu
z<h^%zWdnH-X)leXVT16M_oxoZveK0^1P0WKZAE-VA#Xuwj+_8IxmgoPK`dZQ6Zfaa
z1T3+CjgbNh%XGoXF7m}pnJ4iu%tr9-rcjVmyK+HEsG1dh_=jLLbM?nTG6Y(rm(@lR
z7NIlJYAoCDo(uTdv8M<_Ke}vmEh5-8z~1tiIy@|>B+LEY>uwW)a4EP|CW@GgxhnDH
zz_I%}oU<q?)nT0VXOh21TB?SA7Ky2>(cfo(htCe$@=*nk=OpWpghvT(PVgE)zO-it
zB4oQeM$pJ|N=>CZTT!M+bKIlyQdH{PPLS=KCs%z)Vr0Y9gxeNf(o3J}M29CTv)7g%
zjTRXjIa~@;=heOYJAdTnaCp%*hP}u)UCy9@VA_b~qFTX%bzW6VqK~>$;hmh72wswZ
z^mqq&0K%0^1u~O$<zbP9amz4wRiotVla+_g*EIx)dOn?C!HP!OHvf2VHE5m4G^?&=
zQV@7R>W(ERiKYRS#9La@{1baZ)0f2=tqGF!kN}#2SG1(PviWrav0plNbvnmUr(VD@
zi?h*XBjv<OpxqVMCvuvLk}GQJF*!kh)R|zI+zUA^MvJ^QoQ9y8+-Nh>pfa?Ck>`vX
z{2OLIlOojOXmYF7nU-cAG)=sr))Plv1cv?j-E7+@Hon{4cQOOx0mX)MGSTF_e)h}c
zcw0j0FzT@3VDF#rMy>C<*1syx&ij7B<EEf7A#LJv>7t*mB==a(?1FAU?ywMl)LzAh
z=X+86d#-%}C28+LvB{zTBm1O%z%?rFhV9;q+P&x6eO6su(WvPTHnf<DcZlRjG{i%p
zH_u3K4!oBV$W2$Sy!%&1KrOW?`dspM!+7IF5iE&Al5@N-yUPug;;LG`Czfj2p7qaW
z$(H3^|9=0I==;6(?|<C0?=g*k7rGjT${Z(fM)XShJ9qXCy~u|rG>p(9PO6e3X!j)}
z+KY5mK(*fFi_2b27pT*bU?ZTyyR+!nF{bq*oS(QyG7re_kt_*AdKLE>K56b1yS4tT
z*nB~Ug^xe0L|`Jnj3JJjE2$&YBs<|<AzOmyA|w-aB;?E;h+?5*4V)2w#`?&cg><~l
z{71#?2aVm~+-utxh+r~sau1hR&&wFYdwmQ)J&u|mGs?#l-rMU>O>T%-W1=@aAA=v^
zQi@IJCG?I@pGLN!0di&lDjjoTk{>=+Q;kBHCfSG$d0!u3c`Muotwu|qLTc{jvQ$eX
z+%sT$L@0r#1!5rBo7H50=17X=Vp2L?1pD7=$?z9{3b&u%?Z#|F!Tq1k9pzJb5E_*}
zaI{a$x6E)wtsPiBQ({>DQ9jGjyC*KMYRS??P(2LzoaI8r^^n!6&QFV2Ct%*!WwJfQ
zo>K!}y83FaO0Me)sODxdypA`(2R9AA!?5)~z)biUa{P126GUf!)v-H5<JFX{3fhj(
zK_sRd`SHmA8cm?*CBi&A+SIZu59Psd?mrE4{WJvc*p)Y|S}iC3nW45JR0w%))7*O&
z%c_}4Ma-rt!q`?dff<WnRNYOhEt>AKEklLKHW9BI`wItcJX~^Tj&tLa_XN7weG~i>
z5g#;D6I<*@L4x{!Q#c6M&3eK1Jb61hoH%9+5n1?eU&r0o!O@L6q}8~kEw2~Tf6$LJ
zCEwJS`h?9m6!pFjq)dPfyks?>tEID1FJz`&lw;(Bx#crn_n9l#k4p-49R->I?`gv|
z7B34JE<z3vO#$Lo`k^SAesQLz&5k?db8!^hRq!r6*N8fQ%C?Ib#(Ls&%$lo0Q_@Og
zAM*2FsB;`PgQOBMrf13<Vqq1Fg!Iw@Gdzkx9cFqNXbios^M?xVgvLMOjQP>&nYo6)
zND>_or|DsP?i$aan6xvf!M#n~j3_ZGVKcNeXkiZ3RKQ;U3?uJXi?h#<xe%NP*Ybx7
zzE04arCrN^EvtRppk(T6#=+eR>GOcy>v)aTyaUbY)7iVST3vA}x;;se3a&H>>b-L(
zPE994ha9&1u*^>eP>ep35G>KEj9UPMKzzT#_f*U|XZX7p_hh=%E=p27*SR=<$-3y`
z-np~3*5V^3!8cqoAA4h&1fu|)WdGLG2aK{xyio?7`vb<zf6isTZJQLivX`@y>g_;M
zspYJNfnEC8Hx`cq%PbZ$Mo^9Xw$&#o&eULI_FN)C1}+sOgV8)PNCxBx)sm!=rK7Uo
z2x-2#5GMzHkd^Si-!;;>-1WQU_o#7ge0Rj#*>rb`x68F_6V~w6i)Z3Ms=mc!NY3+x
zWDd0Soy64pe-Cj>bk6ZTNl&>g$~({b)eFH3bjUoe62s{WHCBbKGmJ<m5EVj}H?n=F
zRNfKlPK$0x!C~r`@M`Pbv1z_2&Wf4p8#pMqSkEGVnEWI`Im|N&%Fr1|cEOun10DSh
zF2dE^K}+|9k|(RJG=^7CNR99Q5LVfDUL}o7QMNL6e~l7?IbVp@8{36b?hVXBlHAN}
zw?b;}o=-O}4)#K|^0j%|uEh~$YjXvMRpf3yLA-{m8djRE^jbE>3h2;!nnI<9-nZ7o
zx5z|t0hM}#@NT}gU-_(OGJJ7%i8;WdCJPvDaui25@XQ_=+hW#V)jMip->LJw-nq#4
z?%ut-f4l4cr%Nu<TY$q7#<6}X%VMl{Ga5vdcRwUp`9+jRNK4yMb(hO9xd>UNm+(uw
zg1q>U=Rjv3RbzcMLyoE4j}&!B#T~-oxaBEGV4emwP&ho|zD_fICB_@w5j=tON<rd3
z?vKl}QiVwxc=R~PDZg{)pZil$_ttBC{GB^Je}UII{^vCoe|PWR{f|CA7P{u!5Ynj5
zn(C=?QZ0?`(8S*|0I4cp5xHtk#XzOt#VN*H4E-ft(=Eisq%)_4d|&$6C~dRFxz6O6
zqh2VI`D$*YchK|6ApME7PdKMVzDTI6?39xlae?J#eTNZU6pVmk%1K(u++Q80_n2IU
ze|wtltQ%!CkpgcT&W<1XK*PIi>h8bGrM@1JXB{O9`y<Y-_IlWzk$1bFJ<=woh1e>|
zZY-DJ>6qM;d~?fT*umFh%jZ!sA(L1Vshd-Mmv}b{asv~Ko-C>hI0fN}=3&qh2IR5v
zdW>=n1hCv|mFnfG8fqILOzX$lwrh&kf6L>q%HwRu{RaUo$KB@X@lj4Bg#|$i+=`7Z
zEp`#sQz*lVxATdr^(>Q>2#46)utSz=Ssq0nprlWGAZ=eFY!7JllLE>%>O^|F^lmE|
zVJFcwj=;D}eJl&F>n08?(WTIrOio%j1A4IZT=J>leIr!ax7Q|g<u7FBPRp4We^=zX
z+xqtsA{qt=;`xPVAv7+d8O9Mv4naTDeZ{&H0ZkG@XtzEZUQVl<0{~kh+EFeI0YWSF
zGS6KZ<K#)a0uR(nTBc9HEX1V2#?qIO%8}5ti+wg?7Z-e)TI?NXQoSkEve`E|59!d!
zM_nVbXrpi;I@(4?=UA+`M%-0Tf4~&fbU#(78f1tGxv@mC>*Hg5D>d9(OhAJkT2k?G
z7-g_OrZEc?H$jZl<90T-QHuk#*DOSAnk~E-gX&AKydeaPSbQTb&S1w+4*)OS6kb#<
z!bgYR`S%w@mTL4-<q`P&J{)ZV@nUDYLt2A|8tWBjb>5gkTNzUY15Ndre<6;}ySq0$
z@B}I3*?K@6%s_N!hNQ%$j3lU&OFB$7D-j&9tk*KmM-K2|3k;&95uF!IWn8(nz~qp;
zP*!%W0Uj<wB{7BPC_+JMbpGUuh(8SDNuzIGThX?}m0XV}a=S15`KIeXPkjutK$2q_
zg0FQ86^Bkt0d)J@Cj+l=e`Cp{7<Tq<Rpm87lpK@&Opu`@Z0=HxY_{6T#)#HQ<nTN!
z1kMSGzG0qhed9hQjs{z}(8<q@b=iW`<&vummpt`Ptt8Gjqq~d6$ea|8pY!RQ?aaF8
zRY?0pBJ@U#31s@B1Q=~(!`D(rda&8hO>*z}C3H;gUrRT$a2ni0e_zt_=e;bV1(Ju{
z`^ra$^&>E=a`4upRApgE9CwT|8pXZ(VE*>V5*7(*{U&M^<Wj>vhcrVB<35Fcehm9%
zSZK<H67x^ON8%was<c+q2DIX{sPTWuQwR(x;T5GJKAeDX%g@fFwJl(4<aMzR6DnHS
z>ip3(gq)jx5B`p$f7LQdetZ%mZ7M&}+LyN!Sc4kE5_y^(l$5#a>$;e+@J?P1wU%q)
zY4!!KwByV*@%s^_c=tLlD`eMpj{trc$`A6Mlrtv3s*~D1&1}y2RyTb2ZA5V@_wo`$
zhIq>La6@@OaBG={-fadLx%*+kCWGv8A>g9{HuNGFeXtW9e|X6}INeisLCcAHIdUpA
zHk^pjVINNdu`k505MgSQ%CUKz>7GoLKe(AHV&#b=-lOwEirkYT_8UqO7iNLKn)+T=
z4;aF$lW=cwX;V}}@(muhMTZA+WSn5l(**}7<zIzWtkwVe<kFKPDo^H)pARlyOg8=&
zY-YS?d>wfyf4OLMwdY3YrPoad+8+~2=NerDt_^LJOQ1Ar;%3=yQZoPsXmZwZUjy1{
zu4B(Rbqq_a=ibM%o_RgQPj<XSG3CbUmdyv6$7zudo{~XHS)skXp*z~TT<)SoEYN;*
zXWUkma6ooc{f74@shPGUA~#IT#alsAA}VuaF5|h7e^rC<%1A)BGNqG2|4!EeVn2JS
z2XYcti}QrUi>fhGM|UyxB}WW>S!-B{Zaz~;X4`e?`p@ZEdvqv=icOvg2R77vwL5o*
zdgO*gAmz_dcj|+lYt~OUaz`{l^Wb8G^Vc)G!D+G3NLshg?sl&xg$4ZZCdOkmC{pkc
zFMRMie-D$4HNtRx$MqqL(B6hY&>#7m*>ZT^%}3wz)w`-R!&;1^UXGw1kUy`##=Aqr
z6v~J8wa>O6uISbLxR_OLBaWV5I=*Li{Vw)~bJl2Y-Zl7Tb^XTf4bQ5L4Lx*R!u6ZF
zKXmlzd}CvWe|dKOwmurxf17MrKX@o0U`JIAe?<h=#SVPn(jSMCpD>Q)1K)J?a#5Z^
zrmy`C+S$D;q-!akq$g2OQJ&0Rm*O|Cw@z*<(bWolyiN?^#_ZvUSQI~lF^P0fDqZAE
z4Nm9_H4@Nvpjb-;t8}cK@Sr5If>$m+?z2iVVY3Fgw<GxA;FW8C_0(TqA04rVOw@EC
zfAThGY~Gv5T&t0_aK)RR6qK+?>bzs5HehBdVYi}GrsK<5J~auAQCLSp#RO5&(K;Z$
z;+MYv#qEvb`Hmj)E#B}t-;#g#-Lu&>xl7l4b#gkfh@Eq4u9piZP+Y<?Bf5!fy8uyE
zq|&})Ws8OD^pC#N!aStk(Yq_rwGLIoe<%UA5ukMKv$jeleN|@+g1;PeK5@Ms%;92@
zPj(JhHMmb9z3g1sv|LNX$FbJJo+EM-o>c-!D)AE{Cu1B_5vR`#42o%arBC@R5#W<S
z=TD%3NXg4dQO6;#d-N*G?Q+uU(%w)RWK;ya`{1HDnP<1xsvE{Nj7GY2QLf}pe<wUD
zygT-|`ee#-klZya-;`s(fgSx&owP9ycZUeDiAl!1q&NC%F3N=?3E^w0`zK4a!z2J{
z6!0M*$t58#$)hbm$DJ@DU|RW%nPaKecJKcYz^mM;m}KwZIFnO_6=5n27<G{3#<APg
zs#ayCM%Sy`o9u0H0Q4CeqQnVAf4<BPXqJ?<-KL2qhdx!Ha}i%<L9OoMyJMC!VJ(l6
zIQZxh#<jAH8{;UPrmS_$1IHmjtumwcn~#%RTM1I3Nj~>{zJ#B1$9-lHx7ztcs1jAM
z_0q-x<RB=-CD>_d(YJn0B_<=KH?R(?05&ba(v>wUHpr6ZN|#?r0@b}Kf5QHD40iOD
zK*w&2Sge<wlV6c#`@+~mqSsA$@*dNM3xNuV$K^<r_}TX3gD<;*Au48$A9`KRp{gEK
zi?bd4wPSUMxzrsJx38PU;MnfeNRnV-=<1L?JjsO;Q1AT=4Zx_*o<4R<_$0V?o!iYz
zmdYZB=A!naS7UgwP}comf34rHJyIBU&VxH7tLF>3ibpRrKBeW7-W&Sh74moFxT34N
zbM#luhSNqJhCWq}1Y{LXd|f6tz0)z3UI@PNS;ZwD3Q!c17ih$xBL{<qEpk~_8a({x
z{7tSLW$_mIG-@%az@2rjPcn^L(~4RtNwMRop{i8z!n(3iGiB`?e-FhOT37fi2HyL6
zQo2jAxa<hCf9m)K_G4imb;RK$x?M?yL`ub-Jl@y!7%g|IlOO1OS9urptCvbnL?=`6
zav<4|_(l$XEXO}<+i4yKo;#{cBn|>cQtENvx8dj9)tYuvGO8z#{H2flRI<rQNjnyy
zq(*ti>#G6DQ>gzJe?8%Oco+P{dh#qS;Q#_(%!%XHP9(IeL(4{FJ{G<(6s9~&HKD-e
zDOahI6+;nMGt=wFr$<<q5P{I?@S=rNMd02hF;j}^d7zpT>VrE}o{*Rve26`B)OL8;
zr#p=omHxX<!D{y<PUbJ**#CS81@}RMD7Ds>=A`TIe*88&e}(yLAxUG9Ps;}kDK(2G
zIY5qgdcIHczhB17f>$9Nkgm9-g>&G306%I7QFS$WBf6AvF{Pm_BBHLhKC$TF8zEN&
zCjwW;2g@k~A67pyo<a+c7byf9MA-0HCWwC7_Fq5gVxc_f+h0HFi-u>zVx24i_aoQ|
zZq7bX>)Y9Se{?`E)2+}H7a^3|cCs=wc-kD@ImMuuDpzvEy*hj{eEj5_Z--xe`(pUT
zvv0o}KKbjxv*RQL!&X-Yadj+1j~&1^nX5;ejfsP)c=y~ebli=R{N>ftNB{EY!)p#k
zZEtF(4vNDVfSQ@_dSu|v72>W^5U(n`Sd@zJ5$%Qdf4`E@X1B{7l%SOA-M7S`U@4~9
z2_8xIgIIx(H%q<=!Ry4tw%7QW9osWG6e@WvsQmtQ1-<Z2OQPiqZmoXQP72^HJzNsK
zTXc&14BZ)P9yG4GuV8j)&|)Di92L*7NC$5DL*_Z~xA#=DJj5AwbA^mbAWByn=v;kY
zy1UP9f9XqT7t~1Z(OL$mE&)bU1rVLPJ*OgL5h^9?=2{;7_29+RgNM(a48J+}`UzLa
ze>>VrK5l(~%$NufQf(oatZwCV@08;;bD%8-OExSk*?h7(1GtdF$Wi+bC<%hH;DDTZ
zzKD9@g!8Fyd$Dm_qzMh;l3JjIt`s<v0LLrGe=RIX(=sYkd4DCVhRjIr5xqfpK{}m-
z?1=xoIcs)Hn&>Jti?R{`Y&T@Jqs9C4eRf@}lmLDa>8&`9=(s6tfEx|ng+dFBX+0Y)
zJ6;JAAQd1>2^G+&Y68L%E>NPYzu>bE%Hg#;2EmVHh7it=sI%!`SZ1Gk<SH-9YNP%M
ze>ua~mS5FT7x|^+StE)tG}Sr_5lzWcqE_Jlaka%G#PvZVi|VK~tzE!y_7}~~UNj5@
zYw;GXDBKmrBP>LgKATi0^br-_mBaRRb+6;{Qb3IlA`t=yMQO4Cl9ui{E(JTv*So&>
zZ=9#&(QixYq>EzVp4_acNBJD|AA3fdf8soscrsbiT7|tGAvqdGcUt7NF?@E-9C0;1
zbf*sgevd0c#>2JQhrPCs74FLl_w&9eEc+*yeRhi?{R{Ejn1CtiyHfZKMo|GC=$me|
z>sM6FlWuQElhrcHoRwO-+)b!v?qHDDdG%ig%<&p@+a1T5!O!as7KuZU!>|>6e@Qr^
zf8HJJ{ppW`yIY-(Kq$KMm$Q)<K^W`0{dS)rpKvhx(NWhNDhO$H;1&~i3tk&|xQgwq
zFTVYDtC!v1>vl4AtWPSOwN~hMIzLP9SNA`nKes8cTIUuMs}5t&?)}a!etYmhC(-FR
zjwK#(S5nsck;)y0iELO)-=~$ke+&zZ_g+_%-*Uu$tQ)IzEp53342<<%u7JD$&_m<&
zRFzf*>l7)3Hx=e4S-D@_`DL74ep0<D1Y=#~EC?#V!l762e6^;?Odl&)=Eou>@ytM%
zBnHBm;}1c(itu?}<Zlqf{^aGe+CwO-GG(deOI)vdRW5xnJq&BY%S_p-e_4vn(dAed
z=dmr$G07rBEO>`4!K{w_kmOOm=MZ?oP`kd52RnjJc?{YlZ-sZw7b<Jx7t$bJdue0_
zy#iGo@TDWSQ-OFFi>D?3d@ipJ;on@laBuy+&pR0dzrgdg&9t>Uockt*+C=(pi|$sZ
z86BKf`-|9Y6YGooAhn0Sf40}{c7yr#k>jLqXm=e+6{$-nQvHXhHpJM-Ld{cX2#|8-
zdyzjtMYn3VbIeO?)^^F-s(KpNZj9u{yuv*(tDIa41g{Z7M!1Ome!QBEa|Ty?xVl;%
z3ZSYhrjviBg4RO9?ghlgRW!&`p9GEWbR(H}1R=$PmgJ@6LoTaff7!;ohLjmHI6KL>
z>&JnC@dnWh&{v*f4dz>}x_`dQIsyO<32cQiCuEK=4(cSEGnbzqCXM`9Ti2nimZ%e%
zg8;7c>UqWc)C5skz+F`lsSG$Jpy%m!{$5C3FXQ7@lF2<));O}qMO(!pBHsr%(PB0x
zJk>0i-~59d0B8=Le?KLg?l0yboOkomv2&}o3h<S+ZEExEa(Lc|mNW7mZuqw1egn<y
zv1!v{F(OL%B}`n{KV#SQxmnw>NR-f|WHxXapXlNnlAv5T%Qu)sIpe*sS-GCY1K`e`
zLoEp<hZj%32>wXD4APR2&Mhmv<<@bw68c(-BXD-iWk2@8e|bO@;h1#?s70w76X|J6
zAMEtjqcwUGKwcDpQ5SVfB5LGXsg|N<fQr9&WbSpfyx2y-d{UJ`R};+ZLu(lhdJR1%
zsfAxwV~};1(8tGjeUmsH$EzJjLl&iXog?QE$o6nni8tNxjqkky!G+jqUj4{d{)%&y
zTnkgPH0}oHfBNnV!eZ~ZAR_T@z97H;-QWmXwIoUU`RiPeiA4ON^5$C-g{t}m5)LKy
zom+b{-88O$S7wg4Iny8?UbzGHqBsusQOBXT5n4OmFUh?4A#TlYj~*oj?B=W+o;lf}
z@N{S8=}m6jaemx(**^LB{#}3H2w_dMN!+{qAAF(qfA{y7<(#alV<AP$w39t&&NiCI
zI!7D7L6`6m7iOrR#r09l5~^qy%|DN*c;Wj?g*pt@UtT$4DW>`Z3qaAgTO188<9Ar*
zWDqP!xXy5hi0_MJ@?}*`f))@e*(m^nyfdbEX$%0a4=>xON|bgJFwKbb$X2re^%+AD
zOLn!9e>>oe(n&iT5C<JbAS{f#&@jG>BY;XG*82}D$Gn#`*zc<!Kq>PeLNFYAX6IyX
z%#MJ3gRq7N#iQI~;)rQR8G?$<yjT=Dlge6%b=TNMw-w`j>CY3(t!5X5z+DnGlaR#<
zx_mHUa4+5X#)?U#DFHnHg|lIndI5r8dLIPke}>2I;*TY+P18s<NlfJDj5EN5ucJ!=
z(7vGn5vmWhdP|#{7i#@?&xz`tQ0!yDu**g*<*P;TFAhFG4PirXzZ{tC>5^fSQ=GF1
zTFs)w1-sRD9Lav3p)U_C3%GAO2|Rz=^QU)BJP}`vw>+r%0su5-8`hKs;=}?qVsln<
zf9H+_xk*6c=;)6u?OzF;%GJPBx`?f9tM(oWNAK`y>>XbdB|A{lDUy-~_N5K=L;_!r
z=TZ+DvA~(bn!3GE1`ira(hqp-Osb_}>YXbH91d7@G1zcWf`Q%?no1?8W+hicQ!NaV
z$h<ZY$q0zf(4+=4IHI7AzRur9@@J%Be~z@L(V*J&n!CfblOObkx2E~qzI4#9PWzz)
zQyxMshz|PF0a8&My$l^@;U&I#-%-2JKx#YeLKWEY-V(a~rd>#6T0bfR(D!aTJu$^~
zWECSrl^nvJ$QN5tZQ=cu66EoINN~fZJ*-Y+K3?}TUp7ve<8C$$w1vTm)`EI`f5{rZ
zse#*9tV9ci`k+VtqG}%aY|9<@a=MyE%Y}+t{u$YNjyED&-)%cIgROUw6rVx3;VL+5
zV_bXGyX7b8K5y8K!*r#-XzUEab=AJP{s>*UODzrGj<slVNw6O7^}gY2$ht#cx7nIk
zk;J)|Bab#Y?PEReu7Ve|0%?^*e|Q=Q9daC$(;_0&sqb*)#3QUWBS{u3KrRi4x~CoY
zqEvx?%vMPgn|R%l_~t1PSv*1C-L_yKx@SyK!Fqmz0(zJowYdzm(4+f*97ZLB(^za*
zI)3@|>nGp7dU<T=l*Eb61{QLEt>uR}YR)3{Tz^N(4b}bkwQe`!t)9?*e_UAgn;j%N
zo)4{Nv!$m3y>7aaz%b?6j8W{%pfryZ8fKqSbWNImEW=vcLvw$4QJkDt)$7D)>}s96
zjc|OmE;IuyQ>r_m6M<W)RUsxOt)aO*3WyeDRS~eCSuatN2o5yz>OvkJq~yRB5(R>Z
z?pEa(S!cxJ5xo8LS{?VLe;o!X`1G(5Br-ekOp%U)euMBElEIiekodFHe@yed;O4~J
zqA73*GG4<d?~d7&*oA8g`_U&u|2dANl2L}_qnZPaMVYWBhA@e{=Cos{DW81E=(24N
ziLHBjllto~9?WO)8H`-Xo0UO3zq1`wIz|9SGqP~$=921n#8luCf9KY+Fn5RJMSd#a
z{8FrGOOX|~6SF>W8MOP3&(WyUdNIA1F94)?pDQZ$;#RVq>><*9r*t*W_pmT`?Ogqo
z)%jK<BO>2aBfY^Lkav9qFp)C4af%Sg?m4bOV`>{8p6F;W%Crbo(l^Q9^>xQkRo}o7
z&cf5Yk&-%pq4{kyf7FD&rzUeKnl2qf^d$=<g`-lB98*vVAie3PIiOe%7pkz}msD{F
zu7o|zvg5E&JKVctmVOyj*3nA3<zpF)I*iy2cZ-$2^UiAF<JyQY@i=8b>Tz9r)Tnr&
zOn(9u$FaGdF-+G31PG(EOj{Gz%gCe6ztQAX)yN!NQ$nmEf4%27xkjnSm;QO2Z5M;H
zL2xF{-P-y;PL8|gx_L$@sT8c?R6@l$SbFD42tkN$Ft@sX_U$}?jYJlOXGpxR?lE<?
zRlhEgfpQC5g!RV12ic+g8il*?CCMdiJJwY+USjtyiX=w=2rP3ODIaS3;~`*UNVrZ{
z5XOh7kc7QRe<J6nr_nW~Dswe6Runey1>Avy&W}Sp;dxUO1o0Qfrb=?3r5^HS99$+K
zKb}?NB6!!5^J?NBgLNvQB1shw)8E77&_>p;a6HAcDZVjV;n8Z?te&2R0FRnjzn&B-
z&G2`qNeh@fbQK5eKcOs;1z*P-lJlmkB&d3%`A-^te`!MOL&SC$3-8Vo09mH_4@o7T
z*GF6s1RR+zphqvOYI2e<zTdvJlz(;iH4uk?HFRU@xf7^%0}>`)Vg+(7>Se?LxE@XR
z2J*E2v%7y)L&3}R$?T1H-ADaaXHw(If={Xcs&~Ki9&6^{7P?@xkZ)T~himi=5jKn$
zlb>1Xe_$jEF)5!*G(~q`ZP6A_;luEmprj7Ms^%}Sa#}y~96bqvae<FC(=ZRAAA|>Y
zxFyZ><?pq{m9N6lC^Cm1&xXi8HKQn?(dXGPsdywcHwJM_L-#(}NtAc}c{OL0Xn(Yz
zJ_p#WeRYx%cQ^6+?-Pxrn`runl6*)GsgF_ge}}ns5_+U{5-)$fLk?@7-_j5dqZ#ue
zousMzWEdJbak!d7TMYA@W33j;kzmVXGb5MBT1w#($-lZ1Q1D!z%$;wX1cNplGhErZ
zk|IaX9kc#^q4JEOL92Sn)KkMsrp!M2I{x?n=l@sqFRm8dr4jQ0=9*&nS0x->I9J{<
zf4+8O|NVws`mIp2e=aR|GyO+8G#SW~w*u%Gb#Bi%VH_L{{nvx9pZVh00k>uN4VBUz
z(GQxF#T|4&KxhyEN(YRkY^h(}>2aKgJUj&A2JgT>G&sZ^on&-4OWuzyX1Yw9MzQNi
z0cCC~<E-!A!Bcx=FpMKov7p=(NAjKBe?JZlc}7Jgo?>^)Uo!<H@Q3^=0D{hmr{NpX
zLhcXcry+lm!7xbL{cQ<W!>GQg1m+DK7}`81ydiL<E1}VG`^GOg_TWvf7eK7-aB_d1
z&m_NkXw70_%v;dPY94kXJJR}%pxhEP5NeNF<HM9JE+e2P0p6hnrWJQbUJkL)e{{R*
zPpI9YO*P1ChAO}-*5W{f(RzGYp$Z^GZ7TJ9szq83$x;^y;z&IyHDQ4^j>xO(*J%B~
z9sF9dLQ)#57E0wVYQ6e6oi{$WY*LbA53<K7*oys^zmeDika;Y>MPQ*ho^NUS#@$Ei
z4N2t4=Obv>xp*zv;}aS~30Gepe=)cV7*kk&C*|b=?3q43CZOmWDBW`sjx3Mdd87O0
zu$m3s!@MJ1cpY^dqAxWqI6tO#ksAzt4e--$Y?t|TV#bGhEd)T1IlVG~<y`_8BE%#~
z1{AcJOmSepY7B!!8b!aT(Xsh6^zyn3MuC-KUZw=O@#5c*HnT+|y}p7`f0~$YcMC6(
zRuaA_iaf1AmQw*cHsDmnMFp7xVPn^V#8|I+O*o6V=99&O>2Hv)kf33IRN{r-hx&Uu
zQpJWnJ(X3G7prZ}Z}O;-zxpuGnxyKI`=dw`+!Y8>cKp`jy<pg&6NCC;h%VL}Oa!z`
z^`^}0?M8Jj2N5ad$e%fhe^CCBZC9#Dkmx7j@_O0%YMRgbKz`PonNnIuZ!t$tgIq8!
z>-i+Vw1BB)xt#dy=t)lFN>adx82jp}G~oT_!P6Z_Id*N_;1W9>$5Fcf3h1?+?%TEH
zc=t)g7VCgjO9P#A#jA^1E6T=oSkCZk-<9f%2uFFrRqcj!A!6OUe=UhA20VT2){|bz
zUYje1C>{9t>SC~hX1jePaR4nN{X~I4M9acbNvw|i((T&nJuZBPTlIS`4WQe!6=#xA
zrCu&pBcE~9=L|d-oj)`*biVn5(&AH}y+V)>$8L&&_J6Ghc!L0B@5a#6Sz0NRs<*pq
ztr0mN9bLECp&!|LfBU{MduL1^>btccHi69OXWwnqiB-L=@|~3pAo~-G&f9=xE52z8
z3sp;Ky|*j`uRqHUk5g1i5-<xGZa_JO%`teTP131;j;3QjVLFF^+0$`(JU=#Nr5Ye|
zNz94m>a9IrQdll#qqa(2*IXEcNcgJ9O3gL;k)*_c+vy*wf9ZR(BPR1Uki)T~J1w{B
z;~`27eW~H9Y{qdWgG}9O16xA9@zV3Ik=L-HM8;9Ns37~bttiUW#Jj(b1OJ=7g(Ci7
zNtvo8h??B6T2Y`qbAR>W@!7Wk-CL%@i$kLgtRenQVEO+ChCl}$R8v33z5m^DR*nL2
zyQxw9!Cs5~f3~h9qA}=Oqz~0~<A_?UxkM-F)8*x=D4auWOlm|24_nK#m#Bd)WFt8x
z(Q<0;A*gnt<)!0hJy0&dW}uj1ctjK$5wkGe3}X}BYuL{S;GY3}Q>THDGG0xc750s|
z?0{$tA(in;-5io8ic817=w0O4AWm>(@}Q6xvEWq^e>E6ntunC1rLu-UTXkcwJ|5<M
zg0MZdMox7(5vVqv|23u9d;uRMq{{_l*CK|!QfH8MOda#d#I-mn8ShhXIIC!*(M@uE
z?b}ekc{uk7*{D{3bHD(}8xuhSPl|luA983u5>7EyCF6d0tsz_o>5Z%PqLO+L#kHsW
zJNB<(e-6R^zEa>8>@!i2DQ6cv&d<L+eCffFNh>{okvU}e@kZ?qH2v}XQf@$mxEGKI
z2KHjg`s;Nc$NG>D^fJVDM8o;8HEFI0ElU2$Zqeo%0g==Zcn4?(I1cPKH6ghwGa7u{
zrUnP$c^Z$2_Yq_HF6%&JLcf1NQUgKPIA+p{e*~grLyrkq)15otxMs26;=w&Fk|#ad
zOQ4!sIRYfCmD|sr0{9v1@;CI~>nV-vWe?peP~`5k9{|R%mwij(Lbm!~c4?{=&jVXO
z<M7j_VX4>JONcY5wl3}{g>aHg!y`<vQiT7fG91aC&MQ-3Zfq&SG>MEX{1X6A)A>^3
ze=5Z|tG)q-qa(2o+nzB<yq#sXR7`XeXEssz%)<cDlN%Ta(^#VuBTx|;40frf2*FMw
zU5;d$U+`lc1=&T6uR6M}wV3QU8gRD=0qs5@9{>r9vz6e3D&<v#h_%*(y-IwLBGc;a
z4|Cs%xy@$`DO;y`n=pBA_(NUIhBXU_e@K}x>eSE4&GKPkk(Gv7sz(3t2CdJ~JDb{?
z7+dg@BoD&>{p1CZG~Y+|pZ~|@ackAr|I5NZ|MUOW|Bq{>v=`^<>rx_<zRuqwub;RS
zhks?03b~&K|LdMBd7iTWT&ruWm5M30RuEwvqn2k21}r_6Hz>$M%KT<e>+E@6f7cht
z{IM-=w%)|`=9j>1%99Jms2F!0)04br`%XOh0^xJpaR2%EemDF5t=+x*pJq>HtEv6_
z3%-c^mfRB#-(UiI*=kYt=&IYx%K4l7Jz6WAp!hfUKZuQ!JagL0bLPLBW!uPs>V}22
zQZ@%`^-UF?g;c^6UK9_CdkF^rf6JaL55M_S0Bz-xyoc~O_`mpC3A@ZYsQ*-9vn(_n
zU-r`RofD#!Lqji;+R<^u;T&i050Q2Y?ewLczAxGBdNux1l3Zy%3ziG&z%bUq{}iiD
z8AUj>z7y$+sU{yMA*}8GuYXV<F((%XS`$jCJ|)}68g<vdOUP48^Cy>Ze@ys~x>mDG
z{o_9=-qmZR8P^PgnF<wgap%%_=mB%S^eNfApQfSq<AU!4)`MDPn1FVs676>!DY-Z3
zZ_*~c3P-U;=lLabqqb;tL?X8WNqE+LQK-W|!O%v_HA!7u`E81#m3;K-#j}0lsv-YJ
zXS7;Ovi^UO0h@Cma!)4Ce}VbD+_`8ZIUD73x-qYIT9zdHuYgbMf5q@RKwtGCfb9eK
zX`+e4c0k>3Yr%1L`$s^jZS80G_kO-DU}`Uu=>$MSrnvBQE-Y)Hcnu|sYdBG+DATU`
zk4Qs+kN5Wsk(OGtb{!hERU=oT{d1(Hq89jzW`Up;_Nq#C|Lb%Pf4t?R_8{VPvb^+|
zS^<I08%&SX#I!Lz%8dDAouIEdB{pWR=+quMv#NuSB>k0vS!}T#5+!+sRy1f6llkn2
zD2Q^|j#^|MDefT<)W0%P*L<})+3>~d#4V`+WB!xQBQF_Qxlx>|u(9qlb-(^qG7Ieo
zxDg^`BhOHtqCba@e@!=^Z4;ImE(r`KGi3-J`aW=OA~yM9vJ<hX51OCoIRHow&x^_A
z!!#+nt8Z2xrZw4(ubyAOwNHlg^ZCZvzF5^aID3B@E?oJIjXk<`gJZlq9Kjs7d1$cj
z+@QUC!yjCQD<*n!d4tyOyP2L`Zf@-cO?@<60DSeT({V7Pf7SH{jox)^J?m^fCSc_Z
z^_4+HGlS%jbXdmctHaAx>9Rn6najlp%WWnhJU4HYgj6dkA9EVi5%7TI{^Eok_p-Qb
zr0e>n`M^j~pF7$AY*Dy=+#g?G>VFS2`NzZZ>@VmUE_t)+;&hU~E)dz}Seyy|@pv_Q
z{rF+011Q^Kf5ODyM=zcnzP$eUK8D=2WI~p|oo~!s#yw}kmz(55yH?w>6Z*J%d?Gk&
zsyxZ}6TroYN##?C%_s{?;H@}^nWT9nGig4R!TqH9@Fq`acnE!}nJB;56?Na443L3>
ze4ZG8CJCnDu)qum;>x*rjfZ=i92ByGYRZ}jqo*5rf3Q}TsT2melfpGy(qHx3^Yx6u
zd(S$s7Vs0btd40?oY=N37C_|>jcKc*SxSV8e28+f5`xpRd1=^Et1FUYSB4rS6d}FB
zS1XP)LLwz)GQi=%2|q`Wv-!UI<Owl$ryz#3#K5H9!Y{+jv^BW$IR0MKvVawYJF#%%
zM_&~=f4%l@o%0{vC^n<vMrpXQG0I)Lj4QEf@fZ+mBe2^(u*!EMp2w)MhW@wnQlf*(
z+I)rZpMFxN;XNdh*-5p8Ar$juRy~CCF#_^5T>(U=NWT;StONehO+s~iHY*GJmC%->
zwGpn5$0D30aC^q<Lf=C+5PbG-*=lz8H!iFse}Cgv;Xo#*Dm&M`Y<K=+QA;f$MdLGy
zb0fbtR%|`C>gp4sfg&1zRX2mNHq9){b_Y;?0v}g=y6+DKEtd}6%}Bfm6h{gLbhToV
zUwW@-8Xi&P5?$=MF4mA`(Amf9z)30&z$V=SX!d?UWEjIei~;y`==c7RP<7hZCdB4|
zf9M&2n8hb3%aDt+83)hEpkY8dkOeF^;2MN8{i{G4{IURUgkwt#cJ?1D1Ut)+HdM1t
zZj{=uzv>Bqt>&jh9x2O4xsd$wb&R-7MOLjo^_HuW5TP@`Fpfi>4JOZs+y@y{0b4v@
zXdSVo&0Z}NcQMV)B|y>4&zQ|u3y=pUe;qn20@S?|g;xs%fDrA#<MY4Zr&sO^Qb@V&
z3L-Q$_MzlZS{bfFSrMPH;7DzHI4KGV26OBz{(ZBv9idX7vfipSP;*22(A={DHSp~c
zh<n*~$;3fO#0L~g7$M3AvaW>`BBsRM0raLgolK9R3EG+M4(A@OmMi)+UB-#7f3ggz
zRljyJMLQ^|V$b{oz(*O65x?np79L3sbyz(2RY^JuKZy}k8M5#={M8q>e2AONnla2;
z4{2#yN*2rg5P1}_cc9nhtkkTdZY?O`)d;u9XRIT7URUYa;d6wr$QKkd`>4+??)%Ih
zHC@}mpn|Y$KYID%*&hxmNXn9Fe;}%3%L!`aokSxaCtKooF+s}VtrfeH&*{83o74G4
zJWl6^435S9_@NT^C>nTs6a_AYDAyx~=BcKM3ONs&aBWwhPQSFY6-3C11C)X?RT(2S
zHcI4?Iyvvd_j&DijagbMsCIBrH~CWa=glkRS^o%z?ZQd2{$0{0S^4;Pe?My4zMstv
z(o7BRlQunYP5*o><7pXZf}yY|=xXP|--KpV9{VS~?MN1QtUipA8w{)Q=fkzso$Cxm
z<m+r9omRsDbk<fT@>q^mE1h*TXPvU9*4{X#_nxw(g_HfSB}JUnO`2b+2Y$IW)VR*E
z9hYk~BlqT3wtg0OWJnsyf4RQZ5(XP};Sc@vMDU}oIzm~?fPaPa6ar1aiMzuxYbKP7
zCXg<o<Xrlp?p!(YPc2Un<Im)DbUHUZwbs?qZZF&GW%qj7{qG0Nic)NE=c7>%y>+t(
zpCec#`vd;!Wp}$t=TB#Ku~;&MJu%^2RNzYOlhK}oIoL#=H~y>TfBo$xhD-5}SVY-g
zHEgs-I=!kUXpg$9GdUjG)*VYCOl7T^3H&BKb~=yZXd-hQCPSw0wt@;|TQa#V_s}-d
z1a9frwk$lhy}p&QxWeW;`rEaKtv$L7ibE9QJJS@Imq`;X(Q+Hb|0Jngczc;%ZZ%7|
zn+U=UpC{Fs$Wg%?e_K~(Qk*XP=e*M;SqhJ`6vC02F6c%OOCe;Lb(^ha2H71SSRaaH
zW=9Em&e&K2Juh|lk+pDx?BC0dia4CQzABztqFRpvAl}Z&CXsm1TpB1<u-3^>N`_T2
zA2M;6u{XsSf(etgs}XKhB%eyOMH93&nb_4?#1i;E_Rh)$e|!oF(uVLWoGxioxtrVa
z7cbgvow90K+%cfQmy9t4&7sVAL-Hp{FU%k>Nb<&*oGv71I_<_Is=`nGk_-TUv<90b
z(>W{O&;>(Aewr;@)0KxlevsYOw2S@ag698^WCTqhG>_rPU2JGYt_H2o+w~rjkr<H7
zQzmTo*!&w6e;!w1Mh;q_ivMGR3%AgWFB*}tAUbIo;A=46PpOXR%T>E@Goq8IQb2Q5
z(~|u@J1}*{PWF7^B%Wn6*tn@ZY0->Gi1D_j?N;52>PtFyPHv_*p@rZe{>jnj{A`g=
z*B=(EIn)vox!hVA5zO#CNxqRJ%^;FaOt$gN5LC6bf3O9Xj9IcsBmxgYRGN_*abU8p
z;rhAJTkG{wAUY?|w8{txzAN_5NGasuiZhKp^V1=~?1^Bc*VP1S3grvkrj+xNAvAVe
z>HnO)dhx85Y$)aIw6cQ{B}$4OmrmzfURQgC<~j3<`@AHE6(b_@e`q}_W%&OowO<%H
zo}A0|f2Z9vSN=GGky<g7+Fdy{BykkNeg=1{wGgIZ7;YmD-pl_AlWD1R+_e%7zR(Sx
zfm}%h|A`#-;LgGd`EzTp|Flp8e&dE(G!`zZB7V4Y8)Bg}N9s6K(?IkMO4IFksYySu
zn~{Qqr<0OQrIYft+A9gXJuQ%=xvZyIKO8d4e^B2f#d5KA>MhGE$PWoo&fb)H_SMUm
z&l83Bl7{*yG7dx`V>o)+n5M~&8?YSmazASBOx+9E>oX-=b$BtNl*yhN$}5SW)38bn
zZ#M8%uk8p*rfQ9Vt!AJ!7Ck&Ks`;ewNr<LJ=sC+ff?x6yScK=yIxYUgP*Gh-aK8s&
zf9I0n<T@@HI639tWo@{KKyB}M^MRA_r|x8qG}Pbi;mq~6&D|~f5)N|s^<gGixSiaI
zluu{4&XR{SA1lojeza2Rt0_T_?J+wRhFt8~>d%)h7c;qwU#4Ow_=M~4bZQ6>miHKx
zlgdTLp6L@<Y6c6_MsB&&x}{IY7TI`te<S4;*Qv#afAb^WH@VQg;4KyLfWNxh9P%sq
zGG_l^nh|-UNH%LpU!8hL?G5GEddD>_|MaMZcAXn9{VioB734#22tH=pAkntmbvMoG
z92cY#r8JmxfAP3=j$44@6ubHiJ?y(@2I{Qsur1vH1j0c)cqt`h0lUGw#7`maf7~MO
z0kl3_8k0gBBgw2g9b3snwj$lL@UCQ$E(z$h@XVRIE~kl22LUu`6{T#5!OV>g21+R=
z)ySVjaKY^t?<n0(%%@G1z-3vV(j7V;pN7SNoO1Ny=I)sGot?-I*df*kt%pwBYvdx2
zF3gs)nTy@69=EBRxpw^4xw`nVf0?EHmRb=z+J5_`u%;g*oisLGQ;KWOztgp2$t;KR
za`jSHmpUTK>v<FuAeALG(vmq0eHguFAag$g_*jxD%ew@j8!$GjlbQneGFft!GF?}4
zcfMJBXX_n(X#HF4Tesi}VQOMGiw48u#jTNnM~nw@@+?sz?Z)C>CaEt+e=EAGOBPGb
zd#7j+>i4a^M4d<=5gZCvZU+~9(Db>4mIco!i@3*Q0L(RUKz9e7Nje*eR2ZcncoIHL
z220Ltd_o|SJmeAQQoKbx#}#X0{7ZBQD6O9s7sVo)6h-t<JK}aCM%|Iu%b0@#p*@8i
z6GGDVYBm8Dzt;+g{m(2_f0A|M#oC^=>o}vNXTGF7XzMNDIRlKWCW}s82lPZRo<!5I
zkS-<GwHnH;MR5i=ORcxP+3}}$J+Tajp<O)cnoFY33<aqBX0{~BPtlfs=cI{->U9Vu
zU@emS?KeHq1-y*Y6SZ*=wPhh{=mE5%;k`Yw+&tBcco$l1$LFnre}@b(HX{F(Q^&{o
zc$tYNVLMr!2q5EX9+Z&1ko#xt3dp($vzbpcrw+B%*^wY%ZU)!vW=>{1w-pYW;FAib
zPLhGTK;ko;Yu*;RS+CD8@bl?qQNr7d#;SuuDAJBzs&X+T`7|bz2~;E^(cHS#Z}pf}
zjy=4Ir3*H5Bt-YJe+JvMD(e7z9PT+?Jl1DYTkf>0wzD;#9V-BkHmcwgrd`#VCbxq-
zLni^(!G9Jf<#GW>K8;p|vx9mSsekI&rjptl5;e{sdnE{rj$YZ3OZ7Z*fGA;|K>Ru_
zH1W(S@lQNtO1#DqQvy&q6FO{&d8=wnlXCt(PQV%E<&2YXf65EuGjTp`&43sD@X~zi
zLYsH&!fsK<z)ES}R&8n=4R~!;qM$RB4B>KdB1KoLTx8!cGC#rw>XC!OPZFB+S6byz
z?_f>2r-F@N<`!}^9uMtngm4^J5_m{6gwoZvc-OI@=XAWm>pi2K?>f%^l+-gi_=+z2
zTDYNn;WB%mf0+nR?!+MaB0XrtJ}K7W(MXJjk^l@KtNFqS-OGZga18&ZS*Gvq%dAFc
z-53H%0tAGWITpHfv}L0i0$5?|`{UG=bL2-$S2ztR)XK~hRGkoxQOx6#TgQkU*EU{`
zD^$%bI~&)OofWwuhrX1aQ$UJ^{aPV*H3usFC_^4;f5m3gtVu@tY2Z!S1CMk@kX+N<
zAK=VS(}>FEt&Y8An3>SD&D4vGE2>0#3G#RFNA$j=^nU~Ys82=g&P`tN)qhbarsToT
z$GL_B5GP;5_@{FpLo6vjEnS^O3wg4YIa$g}J*5Ol-T@ONQZm`sEg!}!GVxZYqmbrI
z#OI-<e=@MJ+uiI(1n3Gtqt5iz4MZom*Ql-zfzp=zfYSR>i$}NR-?zW-`BExi<3!c_
z*^fW>Ac7e(voD3ne|}#3`g7-J5u&~*X<@*=t0rg`bU)eE${*EE`0(eQKkn|`4LTXw
zpuT<W4&Jr?v-xztu?PSB-*yMPAAK^|`(I)+e}c5EOLQRy6xV^ybDtHi6rsEAQ`wR-
zTl=hiWPe7}*ox<|B@?-|K94O<gx{N=!!*vS&O9Hz2FFo4YQE^$jJ7+!kuBdkb2QqW
zC`V5l@$>$#v&!E@w?Wu(+wJXXK0gxArtfJqJ<Uf2#!GGyr{Oo^1nvIL_HCuU+`Rq2
ze{q5Y%Kr92Hgl4utN$Ba!5NgW?o;PCKX>f6_TEt`ta4@>HIP1g_}W<EY5uy{FqLk4
zh+JJ;cKN>>RCUYZCShkxxhrs#m88;&GmsUEFfO`WiyccX5Q(dTkb9%GHzfGr8{n@Y
z9_{RR`^YHy`vI<7ZMO(@i7b3&E&S!ye_u;z0JeNuy7vT2PZ0TCFN}^zL_4>Nb^Jm#
zRCMnBnr(QcH2;8dk~k#pX|5wfiCt?Xs^%~1^wjg2RJ|B=9G|u01~N_@OCNZCn^?@h
zr7!2s4!d;R4Rv6I)F)Hzcy2)+R(HdIWjW3WU!iEkRHU6$Z|&1bzHpTNH}1UFe`e~A
zsJFiD-V9Cd%$-r;TY{(8iMz%fe>-sx8zkBN@*6jb{p_~;-`lu~zd_0>QB?j0H~Z&L
zf2|jBcgOM^`;`V0mzXZ<<duv(AZvLxe!($d{j2uh5_|ocyZ>u!vAw5$Z;x(|&Z}}%
z?B4EW`p>=F-~Za%ySJmR%ypk5e_GqyWNRU~!S5rR1EztNft-7Y&|SB3-YptUH6X$V
z*+H%3qr8HM(=reotPLVm7NnMJ8xbx`l+5qX2-h;l$C#WYSfknyWM$~FVmMOPLCPJC
zT55m^$w2~$T}Q(f_p`074kbh|Hq#1D2DR`w{j41CXSuQ+zKr}I(Mz*Me}19XUi*C{
zm^%B}=lxD6#yh&2F?=L8u+8k@r)g{MEWaqG?proq32cw53TjKeC#p@TVsfH);lZ5D
z&-0Ul?|?hy2p?S^Va@zXk9_S1g8nrCgS-vH?P0Op_KkPD160^<j&F_my9qa&a;u#t
za@1BB9J7hxHUXWeG4e*ef1jJ}Hwp9y>ZY^lukde!ZP?FFRx|%Auh`J56v(KDkF_BN
z?PsU?q%Jz)xS2MPoM-x3?FRdiI3cS1q1Y()v)yo_MMvm<`sD6i|0|Ni4Mo|VHf@_Z
z#9;TMd5ZdQKUs$u{wZCrwng4w+lvy|Z|gtXH58)XY5&OMzxFKxf6^uiNKdIOk|XHf
zCm(ocn#1U~&cSbhQkjD_4mP2*5y3fWR(++oXOcIs7)NTa_ajX|^`j}=%2G)$xga9#
zyzTC<-D6(ww=G9n#K(J^k9E}4+q7L7I6!C`BPTg{J6{;#IBLI}-(PuMV1pWpHPwC$
zNA-95Pw$o*;X4khf5q7j6J+h|-QBy}-`(4h51r&-%XMv>9hs7FLO#MHO>UIv;S+#&
zI77gbXM{uujZ8<(>LJ)MQB<;9<ukHqM+=xKR43~O<z$D2s593jnm-LucBo~CzHBUT
zYzHCBaudB<neu*$6npdj$*#3%R<7w8V6~xwi21!$;PlD`f4!V(O%3j)9jQ>BHrYei
zWeFkS8Q*&D#!~du_sXn;9*~3fh)Z?8s*SA@wX<|$9Or5#77+?2FsO+g<fI60wB}5+
zaQ%T~%MUYn;UYIzk}=k%JP8Ke0E!=Dg_xUw^4*=5=Xx+0P<^pk!?dndiVH`?)f$z9
zHFOhocf%Krf8Sj@T8<#!%DyXvj|ANG(#*)>5%h*qgZesGt2$Shq_1}G-VKyI8c*8E
z+>HrdDEnFe-rXJ?=G~j;{(<h@lDg6T*!b%H%j|G&U{Aq3V?VZj{{H8-zP8B2zAkB_
zveA6sNjU)QlcgbJR%`|qtDi&r)%DqVB&oAutoGtIe-X4#bRS#Eo}*^~Y%ZrjiRxtx
z$g45cITJM6jz}_u!60tzY6tz4h_q9XPNZ1;?NLPZ)(sTVi4jX?RN5>)U%@?E{UJ5x
zE4D7+D$(`JXBs5uU(G`b`n0ll`go`HN`a9^g@itc0p=}WN8v_UtJf}{H#wFfJkgoN
zY)$USf4W7{C=W5j#S;n|E}!1LxkeEyHcZXFS2iRW=~|0mZrAH)NF(0n&hVK*3KKe(
zF5R;=x$K#HXtefF%uxVr31<?k3(l_`A@7H+JJwS}v^5zlE}Ao~^6#eB3x=Iv+4{2j
zfU5r02C>MvaQQBO*>``>U{ecf$xg?T`VfRQf6X-Bw9EZ6oB1t<l*Nu)%AK8nhC5aa
zx8REV$>t<`qc4u?UNJKAdf+0`-^MOB&!pbd*%fZO(ssX`HN0$mU86RJ<Da~zVrQnB
z*fCrY>O<-+q(mip({148Qr(q-MCVr0KpTn~>C0FgVp?esxP)pJd)HIb4X7cDtmzpX
ze~|}ARxW|(`{a_KBe83;a;u_zb-y9j$SaDuxUI|3LcgV0KPje^ysZUW<xMAMS_t+x
zbwgB!zw79PLnDU>`@<O2&=OCLk7GQtl;StlzHdB;*PqN42UNF25}GIech_ha%bMhL
zR2ftB{u*K|Nn1~t$xGcFG%2syL6DIhe_3Z&OTns+?wC~8X0MnA%k{Nf<E|xb*h%<O
zM;Gm0h$Sl`Z&dNLIQENitic_k=F)AxqLl#wq7AUfbc(Fd6TB#ojmTF?UDnp(U?L!$
zcrdSv%LFcgk!<;EHDt-)&B3G?Z}2banvBqFIRSowAJs__@q~Hp-?%GYE=+k?f1M6}
z)AE$*eAd3&%R>Kn8UI=tKf}5`sbD-0%^^L>N3YWrmAQF(AIBxM1P*8nf)5^0P|!vY
z#k(U8^k*Tws<}QdChn~a%NBdf&m=|`NP2IgBjHMMN`vfRLkYgGGHs2bNgP`IIi-8z
z52ESuIGZHkQrUo-RIr4Sz)=Hyf6+7JSMb$SJud-=9pFQ1Lx|zM_B&Z$z2o<@Bh7h8
zEOwiQ^nKtTfOlFbYE;<S-MxSJ-i|I_KU$YQzXv<Tw(MtDe(z#D5ybX~9@5@*hNL5b
zLoF;DK1BQojJ{8FX~l1eA6WD0j^Zw1sM?r9FFhFKkf+tyy`c&9Wg8sVe>&+!3i-gV
zvk-N&F<8Yzau*iyW(PsiOd3}m7%tw7=4IHAokWDw)wLW(YpMO)aJI>$%5R1OGDOyf
z2U|O<9nfBw>X4xzEwd%ut;VGd%khJ)+zoD4>t5*xEvBpYVC(s$0PH|`q|4eauoi8J
z^4Pnl-(pn<GvYn?am&%(f88x7{!`V8fDrt$Cn*tno!{tNHl*BVbtGrP(U#f-QAurr
zTi^G@@QlyG#T?+X{PW?~_pZ&Z_hf;dHx?{(Cec;k;ju%qO^Jf*W58+8nIGdiORWp~
zbnJ?6UTIxuSLU57ZOe=Hnk%gfec;yl&oxy=c;j~CWyUIFkyXQ@f9s6gRlbT?UN@{V
zZS3u9%qD*};GORngmRQ@<oDaRQp;*Lfka%kvsaNdn|W^%bG8`ij^ZPRUV?f4dVM6h
zGuc(zi(mjsK()V&c=(mb7kv?h-X>n`5Ydwh@82FV!Oq61*kCcZ<B}fS2%wfDQtw~S
zjqEp$321AT;(KCUyBU?i|9{<%PI`LGZwGn$w(muMbOiFMLCJmiRYxRU_~Aqp-~;L`
zZcIzwNle~FN&G@XANq6mA2x;-a;75)+LEtJq)o3*m)XlAhsVQJEa`i4mzr_CZoZ{;
z!dWKFWMf$3nY@{=l(D}jUn!Mu!dGg{p5{cERkMEU(7bWP1Qf~V?teoEm=$_m)1fR;
z++R5p81xe)Su7Se;%i%(N15{tn8zh5?CjqA)4h*&Vy1Cw8`Wotz&`TNZZd#}d0mcv
zN!K6mysNu^47Zvdw=20-j_Y0ADhvH8jA~*{zMATAQVpt;ar_9maTLTl+%k%-<V8P!
z$*Aw}^#)whI~b++;(wKX4R$H;OY$m-@_Upo#>10I<w(VY*xwt*Z!pce5L=OvEMG43
z(K&gQt=JscwAN{HbzOL=4aTX;-ps}We<=nS%7CF7ZbP?v8(Z3H^Y}>yeV~mzaxJzr
z#Iou&fZ{$sn^wa>>Oonlt3d5P^f^R`2%B1kmc-2rt?mv!-hWi;q#9qYEnWP7gTVl1
zJam_#aBIQu*IREmN(G~3?5OXS5yRvbU@f=GvHOp}Yx)mPUi<m@XERVV?jLX4VX=7Q
z&fWm*<=1jbURIByCiEKWWqIhPfiv9bq{ke**s}oX<PoXTKyLtrxG|`?&J(`hx}zSQ
z;-7^{_)o#$!+#0}**4?Am1_`<hiOUaUaQE2FWuX)DD%m_SD2-mS085P%^VhPrg4C?
z`l9ejU=r{0ykRg-*3?qn%q2-hOEjB%{;r6DbEE&N5XiV3*_{Y3EYq_bmV%lmKC6b&
zfx7Oo+8tys4Bj8+QTL9GJ##3#NG<iCvj;!i*R|I<5`WicJxYS1`CfqubihI9o+3KQ
z3UQ!eny%E5O?6`&H@UY70?U1VLm6vN|5ekul&(w#j!Wt8YQ03Z7=cUL-`{tK4=VE4
zn&9U$((oT34WfiA6e0PKl0=|~+qb@c>+83!_d`Ebf8gMfa{~u!;ZE-VX{T!dVP7b2
zOASQM%6~u?LvGS(J}#n;mDAPqp-1kptbi02L6+&i({#-*iS5f=n#Dqy*K7;1)RL83
z!WXu_g$JU7PdJ)IrL}s3gyclxto<&YYYi(Mp)i~gGnS9nPn2?tZUK2z{>SNL6|6_*
zNyN6THSuuE(z8nLXG#x8GQ1@1Gdep{ObQu|&wu~6WlFDootNQb5%=I^f^dK3ZF;oA
za3fe#9;D+J=`B9F%!a@Fk#~w?KZ-Z_`=5tcVfvV6X{lt_zyEn~Y@|ayCMFt?O2c$y
zZT2Fcdafmd`2e<s-|B*1@4(68CgA+dFnjY^Nl^>&Qm=>E58xsu31>IunhoiF7gM<&
z)PJ9E^sq_Ci(13G@qpi>fh($Kd)FGlUV2Au*GYoc(igA03~<#mang>3vv%K~w10E@
z2^08WmI%QJN`WCTEf1XquyZHTq&N^b38$+C-yM3b?1u<@NrQ#ZdL}-wpOvk2zYjt{
zy+(_qpdq|eaa!HA?(@18&r@KTgu=Y*{eR>!d}#bcYisXXP~TjL;lH{;nAkrTlBr#1
zn~_>>$-nym?d(OsU-C0d>h%UxQ@5zcf|<shR7h-9)u`M><`?*k+FZ%2J}H+=xTh*=
z)2N6Nq$@8-ENp-<g9y~phWLL8m=G9=f}qJX!rG%9@n6C=yHoX5&=ooPiR#`bpnt&E
zc&*M*ZfAGzPrEx^dE$@0l&Z~_ge8Mnn!S8&>bWX=BrnPJAIQB=?)xqe{k7ZpcsT(k
z2HEy3u#bx3usJp%;kF<+p7QN_L|x{Y(1;tq343Xp#9P_HCI(QwTj=><!pYIsZUm!q
zcX+a|-Fy~Icof!UeVwLOemK?g!hhI$f3Ap|6ZTE;hyh{Fl>ze5T)A1#!J8y;TH%q!
z!XlNXIF!B@^O@pj*Tmm^ANcHgC^efc#eZdR{ix};uHk+}NQ~udNOzW)g}8T$mD!6y
zQANw0OPf9*Jcgp$7EpRPhN{fbRZQPpe#s|>rGgjc-~ao+sV@%&P35-gsDD#NKf`qk
z?v0#>V2ujE?rP@!m;^Hlex+X2^GTkV-NIuZBD;@12Lgo>L|O7mckUb=JeAdS_n4^z
zcmFud%b`etxPf=>WZR@a%#ziwncdU(Mi~myv^*~-t8${5@f>TL><cBdJ9l*DU90MF
zxlfNRZkmwjnPWyZy&mBIi+{<f-$d7rlM^&qz--)?^)x1%G)1xA&AX0WR~BL4>3nN?
zdPCL@QxnQtot;epI{rxZ-K{oo$3q>r3CzS4p^T@Ufk0%(_^0r^Lp@!F!Wlb0DgYi%
z&vqP{fl+et;N#~JYHb<)ag`P6Yrddzv4ngEkGJH2#2q4GFog&}9)DorB_M|j8qJWn
zg3_!YU3w(c#&vLn=-eRs1rti7a!Vu+H%&0F?yYiS#3GMih5VSRnF5;O5Ksg%&(zxj
zu~{z@#NKQ>uj9dv{7(7Tp^JoQ+3~cPR*TDF>DY01YTbxVFTD@9=6#9jf?8r!<~~JU
zEH_Rg&T(t*XW}o!wSO~r!`vyl>@i-ZWJs_ZJW-Ia4C<KZuA7^KLNp1xMIBaOz%bZ{
z0bYj2>rUqh*GP|;XH#&c;!)hWGe|2+)Q^ma@L3D@O>XhF#84;>Y}|@6o@>7kbqkJx
z2vI3H6O?Bfz~;H`RqfGgJ#z6Sv$+5zO{kjKziic_6PAn~1AjfqVI?CLwglvl$Ak=p
zDPqa9WyI9ZRouqDmnU!69z{Z9sXQIKT?^d={89z%a-1{nP*30`7%JXlS|WE}Ky$~Q
z$cNrZZE0K5fndCvqr`HqYcROIT?)L)i)?uf><D5_gQW@x7sVp7X_a+IK8439U!CFb
z7mfpvL`Lad1%Gwq^*Zo3i7um<n!gtDfp$B5nlD&^36b=UEu)mg{HS}x)+n{|6vW%u
z3+Wv4kf7T`Tq73SG3gBBAtaoe%(wtB7|<;(7lI9%FwM1AvxhTu5Sj8sFC=Qh=1#|9
z_Woh*LGe-Knp|V<WKm5?2GX*CK2yU39>u{N*u)ZwUw=8CcxY$+(+N-_dzQjN@>giM
zPP}p4DP&r!=Dt9bA_~7JnC&Z2^$F?N-&V!SwZIex(3>9rxjHd3gjD$pOSqqpyV%W~
zDOLIgl_F12Rn)WFPAH<epm_!cHdBGhcPEj0I;>2{wuTjBJS8%D*#bqu8p%zQ)z@>c
z55CvRoqyV?wHt8f&aA=%>`2U!QO*`W_mA#_XW`da7uj3iVJ0l~)KDLiFgQItgDl3~
zj)GDZY?IRIa(UUGFL1xu(4P;#{U%&|VMP%ttl2f6p2n$<NV(k!0DLc1Z9R>H^@$Y)
zn<B6KOo#W9I{f9Lnh0pGJHHq9W>ZxLoScAIl7Af=BTbHZC`xkrT?axN7M@h0waR|B
z^_h(6^Q~jDuu*=-vi8P?)>Zsev+Gj%;3148?H6ndXR~S%$Xi$}@|%||;|L0p%15k`
zungQwYBo0vd$yWPWWa#5ZH_Dxjg1)7A_3hIYmHGaYY#InNj3zOWdZ_!N%a3^;d7r|
z`G5Y9nt2Rt?vGD~l3zOFIVmJH>%U;mCpCBjTWGU^ofJ@Gij{8yZQ%Cl3hR;{LY%;!
zWu&n^QU-ec^l3=4k9}^&&bF_s{8tR2J3AD!qD@vr>T=d{@fgv$C?qSk0k7~46sLfb
z)fo(;@<R6{AJ)>z{rlNtq_~|`7u#JiXMcVge4cJ)PZ1BQebh7wu6OOBdKf&Kjq_!m
zZS#L6Q^rYN7a!ku&o2_!j(v!!Tgk(F8u89Br)pxlWGSKqhId`q?b?!kPvEkm>(It!
z;DAjaDR^>M+wzAbAnw}&tdzSJMKN=Wwv<sFJne@<G8C`x#*PT9-AG6;pwWT5QGZXE
zgagrBNMPBIQbzUqMAuxlfT!wu18y8SH}qW2-c%!>-Z%EeiPtM(LUJ+eO(yxgE@1)l
zB${*aHxEb33lHoJtb~&lX5%O?8-5evK(q1yg&gWXx2oG`SY<)g5_^N&fkjo<-KbUI
z4JCGNy;9r7+qwG_{F|wSr%YnzSbqn{rV2=W5LpTJPy`w-D?KhvS}Pa4^AqKjPstFy
zDJIYpib)#xMI{G`?O_X0Av6^(!J>R)jZ3I{D|_hw?NziMI@|4IxopqLCPwYN7C|(!
z(GHsVK$-pn)vQ-d3L5mhfWRm3sR~@nJ!KgS9hCz`4rX8wbtiQ9ghpMIDu2p(vfAFx
zAnw-9k@-js9@yr-UI_~x#tIzR6aQD5bP+RUeku<Io2Ky7Heq^K-STN--PUP&rXu-5
zJdobC=9v*-{S92b!o;{8T(qDu#|#opxMU^@ns1*EGR|#^T5;FjM^b+jwM$4G>f!!T
zNH_mbpkuHFXX;PDd#w+xw13n~GJ`Z{6f<+SL7LGPI05M8d5aOi4%@p^=JGmfMn!vR
zb&C4Zr;8qtf5pHqriPtk?%Z*JK0t7Oz9?%frN)Q5m;YEOPCXa_?h|_7?7@Qv*=;Ix
zZy)zmY!}%_b31(gAlo}8FhVyNZMZ*IB#M<O43UT;Qfdz)WxPK#uz#T|48HogI5FY-
z?Hwmnob6~bP>a5hG1uK8K+p76c_U06;yqh3mAj>KVsvz_j^zq%Ya*JH>aFJaiW<au
z4tu5Th-uohnVM}*>dKK1b|KL=Y74^Rx&3OtO^(@&3`)&9*SnQ5A;}SH;0Xzc(EAaR
zCiN<zt8tfPQcSLQmw%&lKR}%1KA=@=@woMhyPh^*a-Ta+%C28{0eIn`_L@jhO-}y0
zoHHMUYYfH9Q}G?E^g{L8-iq2)n%h&s+ITOMK;tmNI611HP`J`iJH!k5t5Uyz++q;R
ze4QSOc65`u6s@<%%l==3Xh!`POLK`*ZKC*b2g}&O(-v-dZ+{Qmva;>)_6;0!GsCQ$
zjQ3#ItYV`b8<^u=qu(2(BC_1r^pHsh5|MmksKR#vB!5weH38Xf9v^%eY=OnhjnbVg
z*Np&<;jf*?^wBBC!+dl(a@S<Y%3T!~oLJ;`2-F4IEK4OI%ELh?a)vEtXQi=I$W^i^
zPssY!myQNb)qjvd#yd)iO1y~$ZtqfZSeEJ)$?OBApzjEt8pQrmG(B?#6v(F)ZZs%C
z?J22P@0l8!p5u$WRKHA;G&hTZvbV+CvZlK74C+p1l`odO!)eBWDKlVIr^}06nc{H;
zX}a$dD>N2Cs`(#LtY$7#>}W1Inyoph0qrq9x^sKtB!895NS}cWNW$fb80mhWi1w~r
zcGdCWtb#uzJx{}GB5Bp4ZGWQY$NZmaN#<e}NLz6|0bFqTgJ;7XSHH?7<Z(=wmXsvx
zCgpfbDjj76u5YX1UUw9#lS@%g3%y2)Pcn>iC*wi1lyoT}jZR2i&0JJt?+QsJhmS{d
z{|>=aJ%5co?`2<B?%!WM?;%v?obqIT0hR4Sy}2-M$VD0u6+nb?ul-!lmChuz9Fmbn
z$NNg=EXgSk3+^YwG{wD$<rjG!0K_#TE|N@1HY)i-`|qDL6_xxXm7$PiX4nJ8)u7u$
zE)0X4jHSa=;1x?Ve#&Etfx8P)o7tsYv}`Q1=zoL*lP|3;RhGE_|Mg5%qVdI%jTr>u
zDS#*H6Ci(NZ^~L+A4Zc^y<}Rp2_GR#;}IGD^;JGlXb)5Cm>Pl_%M)QA^93CwROEz)
z2}xj~1h<274s+0g{`hM2f+Ej=gYj%kpwTZSX*yme=oNZS#CfA$#!}638vS{sv|(nr
zM}GlTe#~*>-!kL<J9of991><T_{huHw#SS7tPd_uU^q$t7Vgz8PnU?j9K9C3)+`uk
zWG%er_yqHIy|EGX%SKuuup(q8rTn?LCLsO?_-|SemLi&>Xt|_br`Qqg$(=hrHE2#W
zhib8~-?pqQO(x1iZ{4}07JFGI*V~;ttA820ht*&tiiUpnxLN_zhqH^2V|0HQ5j*C^
z7O=S(_U}_WMTSxNWx4!nb<#hb<ZpNyzP3utIY`92YD5iDZf}dChP}ya*||uam2B7}
zKR(A6mB>LD!NY}N^X-z=V2)|=j?m*o`~P;7Ee!c9PYAHDcBL#o%LS22mVKc5Eq^oG
z`<2#h;YGngfbYTlyqHqF-kw9I6DE(E_?OrSoI$r)k2Y+U*ge$#GV@LpS)IQL)H@(w
zn;u-Itw|4wrxs3w&+NvrFCz;+O!T77`BHWeN5s)D6$%sdZ_7})T!CC5xj`=huu2dv
zQ@0TSRk<3phzpQ7sEv#nbCVdxx_><514Yvjt?-%|Q);82D(?=FI0CHf(c#kV)};)Y
zNdoT=YyLFkPnx6_j--pCa0jvydf-p7%(Z#`kU<k?#4#M@d^J(mhlojx2w}i>G_8td
zo_C~SL5$X3!0lFIC1~CxHv2g4k3nzTm;QKBfufRnx`E1>C&6HsJh_5>e}Cr=+HeO(
zln0+?pjpbcX#*Os3vZ;^rFa=6xz*gIcXiG*r?cFEY}>6CLtT0*Y!EThr~K>kP+$NP
zgaDkKS9LHv!Qx`=h#w7(XFbX%BF<nNNg)1SRpRbdS4lRI#B%38+y<ss^+p}-|LPbn
z$IW1g{$9=WjGmWg=QJeC?SBvrbuLW1e}Z9hPz$^J<*mE<j=vlsXzFYgAO_Jg`hm{H
zHP6`T0$IGrxkVIll>t3w(>z5$h<`mB(~<mv_TITxx$TY|Q)ot4&mjY5$4}fE&7F)k
zUM*xdxS0Xk5I#t=i9BjNne?!IyX2dKL-GPEpu`(ovbZ?Sct&Y;W`A0-xf<l++A2qX
zEr$tv0tX2((`1w4EC>INcKge!&+$)%d`8h-=Xk*SN{6Qs+l59S+p*V{N0Z999X*!B
z!o|vBSi0sT$Bd2_2v2c0s0LNQnmm21Y*0CKv|(9mtQt7-B-<oaSLGQjw>k*AN$3dV
z=0!u;_B75s1s&TtgMVMBJdHXNWW)ol&}Jl}wGbnrr$9c7rtn*CQN{QmJchJa>y@4{
ztFz}WxTc<aSXT4COe!`JxQC`tw!`x$DOVy!lNOG~-mgt;Ng!g=c*sU$dhTE2u$QtA
z?k8K>Qgk_inRxDwgY2+!G&~xPu_`8$(mm^LE2T1`IqT()qkro?Gerth)6<vNzs!2s
z$74)iu1P#r^~MQgT$AbY=3q$TfC6uVWYK%>@H(mf_|bAPIo>&bG!@@9Cn>x2aDu42
z)NUA2yPvACM77qn+t3A_dH;{>3-RsLD8^XpaBj|fKF~w`Kx-u^7P8=$hVed7Z<+**
z7g!v-W0!CqpnnZYZ1tLl2AiP+!=&Po)O?2*^Sw`YlC(qpdBu0r@so>bpRE6A*_U|8
zx{q_-7bR7n>ZNX+oOLj4Dtnm4RdwX=qw@)(UP0B*leEE?mJio{N;SyAG`ckJQnRLA
zNIog8U5!SoMcqhW`t;N!?_Nl}>pPO1ns78VU#u31Hh=WZ%5Y_qb8t?-t6JOCes9ZP
z^dh|ty~H6UI0^Yhj^%MkZ+$5?UX0CE30beFxqBj4(<JXT(=&T5f_Q|$9mlPbcx!<m
zLWW!FDJ4j0%bcMpfOcUVX_ZAdPRkh%L@6GxF+$*(@Wey<xj82M?obO4|F&|}gFo-=
z4HY#o`hP8G6wzV>;N@Da?ha{$<%i8Je_36>#e2iEYC}t%Z+#GEPd$WrHARaSua-Ko
zYU*BDFpas6i(Nki<)giicHo8IXMMc=2{f3-X71Bdzm8lFDNUsTlx?>J6d7={Bgd%T
zc!*=Ehe6(xK_Wcc4^%(fe>V-%dcS&@2n#M}r+<}2*hq*lVjRGksp~7XzrwhAH6ILq
zX(~3OiLTV67hh|1xTU+-aFa0mHL^xa;btn^?Sc7+3Ty1>)>s&BXyRSd3Blv<bQ*(1
z&-=+h7ZrjqG`JlB!^EF56$_obXdnSX(w!*8$_#W%d(rh;e{>RZ9KSwhKV=|x@&Z5{
zd4C`046Vl`*w%>u=Vm)$-DW5(mlCQ7R+rL`$URI})1&2mrg1}3lAy3=;_>e4!QIFw
zWLPsI9@`L)lSpjnJNnanF8iF=%bGP*MHhLGe3be+S?BxeA+|nZc@~da4OZchdXJmI
zwEDXnl2|i}S^w3cY{qxR$xdiv=SwGT6@NQVLbM`bm%lYDRQC!~SQEpS3*X$BU@H{$
zfI{yEYgF;3tX8!?u$%FClk9aS*Xvf>>Zb=nq!`GVgV+@2dh8?BIb@537$EcXdz-_A
zW=J5Kh;q7-v5k|wM~j71U@QowWC`R=ZlMc1j6}>nq9#X+1K|g>tp<2H?8nyKwto(D
zzfg=-u$^7E3o}1-FgrlUv!uGQ$%#a*dE~Q3bLN0g5fwVGo+5nEJNSHcM$0;t9JNJ?
z%d%YI>)~pUp2Vrj<7x(NefYOkUZ3A^E%b_Wz+&?mz|dk56cQD$GMYO|mVgO{#b1Ys
zkwDfD%W`#lK?N(38jRu#*&qy><$u)TdEN0`$bog@;G}dEP}Fy$N_>MMu$~mli=voC
zD?8|XSNNDDE~$Gtk#${SiH;tteSU1_wYJOm(Qs_VG>=s3Hh-e5x_k?1Uwy5uB!Vl1
zGEvdw$?&PalHk;NbT~oBl1N&Cm1YzfRnrqrztTVsZ=?Hr@LtVc8fvvIMt@+j&v>7X
zAa1wK_uf!=n&nWHwJj-VBTAs-KT+LK{Ccg8;n-p}IK-z$HfORZCZK4ZU%z4&hEEkU
zehs~HWIUlnK1vbTxi~FPaCUsO^&D;w06Ke?BazUo;J-nhx4u7?OV;dVYd0xxHb?0g
zv;*^zKeOLUopl0&Mu#jjlz&wXG-SOx2#Gozr{Gp36bmX$AZVGQ(e2yZP(O^P-1Z*0
zNNRMZv1XHH-SzhOFwqnnM2rdf{9IkVss%}$Vj0aXCaTtm#L$eG273PO!1xqm-4Zt?
z_VWNc!azZKg}W2o^v%^U?f2mRd`)*RG}c>bmSb+xAJoN7Ef7R}0e^lI?B<?5f6HVy
zlT6@bRF5ygB>wSdz?E<&k`CHiq^aQwt^>#`sk8SDy904vRj-kF)d#0*xJOxsG-i?x
z!oo^`IEOT*V@4b)W`O<JM%i|U`n8eujRc=YthQSBJlLwRY<xeWJlImPn{Cs&X8{53
zK1;+!WY6MyQfs@KMSp21r~*=}g}Epd4S#7RsGf_X&Ji9Dl6pzbwe0`{&k2Z0^2#~M
z;n>|92I+t>9qJ{lyz;CH+t_O)dkHRK0}&;X98orJ3unO<m=!b*BAFlEG-+6us7Ri#
zC|uqr`=U?fA}3w#(R-#GGh;cus2-!51g5s_@9r?H_7IVy?tjYepsS(OQC|nq(TKu8
z<<@$hkBYvNisA8g_?Kti0YlgiU~{M~9Znkb6hVmrv$gnGFiiuM`!mdiGt4?Wn%K<U
zk08{nmPI6IJ8?*&3swu!WoG_GrAU3~5ARLSwqAJ)>#H}ybEyOhUM{&@wZWM&dSUk3
zW02t*R?~vS?SH(I@Q7L!Y2^f}cA=Hy{4zRfr3PqrCIvE!#VH13#@r6K6Fd4M@d@S0
z$MO?RB2k;Os)N&;Hd-Nmam-wWcxBJjT?xT%j2tVKnbvSxsa*SDBn!k8sE>GNZa%Y4
z@CUkcC-<~g#YWR+!)t8`lpiQFaklB-CHbjC?ld=>j(`5huttx|Mp4}S3;nh%&llC|
zO!x!77O$S_ErE{Z+i&9c-&|-q1RE1ZGC7ghMskueLy3ek@V-PT-k{DG`Eo?IjTw`v
z`<hpHB30}Z<-i4$O(aV4x9OcM(pvaLjpY@{8xbhMWfh9jA`k+kXzNOTKNB05bf1tw
zf8ecfUw^|dnYHI8%}J^`yCNGJrxu(|TS37m+JK}I!>3#aJ>{d_9WK5qC%Ni<72ILw
z%KKdFKGvT0b!rRUd);?i1=ORu4<8LNLWErwNU{ctAX!nx@7Rcm!7{+FA`edwjjL`h
zU*#}meN$W@)M*LJjfLccR)9ZCv?&`Ep66`GHGdCa=)1eN&VBZd&fP>YA#~nH=Wc5K
zP^r((`}wlZ&N1)4b{>_Y;`*Bk5D=I?CL?}4a6PRkZq?U8O>(DXb>be`yPxdL*jm3j
z<>=%~AFcJ-n*PF$h3ccz)m*$%veR-Rz8POu6=cT82rs|R2*xP5vwQ!eKSFF}-)yTd
zUw^tyJn<;^%t)a@$ng2Q5W;*UXT01GVNVgBsT3bK12Zt^rdlrS*VXK-di;<MIp$0@
zBYx)D3JyqiSwKtqpmeBwy(r|FjhYkf7zn-iosHG#od^4$s5_MGLBw@S+{r_%sBrcE
zPr5BGX;kv?0Klrj3?qLRD7b;5(h&|ZV1L^G0#;EFdONH6*uqW>#fOMikLXri2wbYh
z-%?4-<s6^9fS3sc>fcyGJj)^cY3Dcjyd1j6E&THHr=8Ak1i(5h=L5yM9T=apZU5*F
z!e(uUe|A5$M!?g{k$vEVEg~Jeqjrd?ZFjrbPd{aMF${jF?L!o$yOZtSy?ZybSAULO
zL*J5pd^#S;?tbAo<(F=wwtZ(PZ!!m)_H!AWx&_|;F&iSO_>bA|&fIFaHh(6Dx5fe+
z^I{qSR1pS-Za2+`yK=jIO(-k7c~jXMclAEr<JALr*35~PeR0|-#(h8Hz83EGI$)#W
zv_f9mo4Ag^(Ol7~XVgqwd{&+oIDgnT6BQ@ER%pR(k9dvf{c^&V&<v5K+rnGx6p=Pj
zYN;1}F}YN)2Tk?tSGO`z(fsnP25+ld82W;^mSUHJH>J2ox{Jdc4RA_`+fWRPfub)$
zA8xVnw0|}1+ThbfySpD5ZIcX_3<p*>@R!s!Xlww)(*=@IF6{GfkFHqD4SyO|+X?au
zTUXTIviM>3ix8VUJeNzlS6O0H$F?e3V3gG~N_HA0IE}Op&yl#dTwdPn7|ngH(1MCh
zRC4KW@K=qO-uxuJj7!84L0c^}*xZ`lux$2OmTj#T7AsDsxn-l<>WRyF;HFjo!zY25
z(g_e)<o5u%V3IrHEIJ6d;D7o4gr9{=!yLCC9_(r(p=%ah<JqrHo&UC3`<1hNCbg<$
zIJ8{~jd$;=C!hP5D`RXt22n67QI~^md~E%c@_0!<K%YreWTmA+g-JMwb>}B@ckr&G
zc9Wy^LcAz$cCr>$DXt%@O!I`1UKD-t@@N`yHA*0wh=v54RHp4LMSrr7f>TVRm&>`B
zR`lE^5%Tt+*w1A(ugr`dohCDPs1u4x6OM-Da%S3$J;=E|rG75Bo`^&SIa&d+VN(+i
z|F^DV@U_sbu-&pwy>GOzcIq2vJa-v_J~XJ=HwHn$&GDPc$GT#2wW&9cJoi<f=kuaX
zG4ZEid)D-bFJhZGEq`B7<7k!=>`6~w7Tr2N-jT|i3>$P!9>40&9b^hNfPO?f;^^3R
zF^w?HkZyI<`ls*8rJ|p?g{zrT01WLCx*@WR)ynIAz3N8P=3(>Pu6^W})^Vb<TAcNm
zs(58uFF6Ho1U(+ftDGP|Q&Wa<qNS7Bpq-FGl_POuymRMyet(GrXj%ihN$)%E<x;)&
zb&^EOQKw5c+m*W7hpFluJ>NUmcF!E|b%E@%3$=PkJ}a=n`HbkwnM4@ei;j?iP)c|J
zkfNkJz)2MgJ#pJW0er22U*UK`uTq_!cA=#ouSQ1ECgtm5Ql3{8m4g#FTG#o+R^jL&
zCCab}7EDen&VRCxyYIxT)%db2`>$iQ<vD3o7gE`_PR7osVSJ0mQITVD@9q`n;^Ve+
zVXhYL%|Mz1iA9&Af^Z~dgg{~r++GzEf&)(js*dLuw~>2bMx?yPf$GVb!!oY`R|jEG
z#Y};Y$r**9ajfE~VMts`aKA9qNQ7Sw$Jrj;Re}A^f`7*`LgsPO%%#0F$Ai$^0<i&>
zyy+_PNBSswBOWCp1HhP|$}dmupl79%D-bW>tsnt@`Z!1n?z`V4*TjOmInFP|7~Y)x
zI@>YQ5<@MKBKl@e){nN${XG}*iWYzAYOcQ-{++p$#2y7smMti4*y>wd77MSu3%wAl
zMtbsz%YPQGMy|Yy_Y^vo?jFR=-H{IeTeiJ6?C!Bz9DF(o*Di@Yt31f=xqn7YJ;?Ul
z4}Q)MvX3-jiP=@yeXyUCdRcMRErz9e%)%|sT%pWR4rX)~e#)}!R`!!r-juoMCs=Q}
zKG{#MM!&!Be%kME{=eumYh;cu{3$!2aPYD1Q-8CMzW*m{?75$IKk<cCi=qVb)-G!7
zW&ia~cJIIKX^ngCr;qM$s<9W<xTiJlqmPgGHdVP7YTVZvAGx3IfAaCB8uvpDSJDWT
z7z#YY#n()o_Js4gZ9%PSR$hm4-s}t%<wQTLgj$Qj-GaQ$FBn19jwW{_&mm*{1T;aI
zPk-sVj_n#j))a%?$-6M?C7#PXFdN3FBp_M+Z?=dK=~qZChV%R^_dds~`IgbX#(K7U
z1leK@tC_f$?~3%*UVp3G-gdiF{#x66o7zTsv~A+W;iNzo%bN%nwN%l%B5UV@MaTkB
ziK}S3LEZ={x8%JS`bIfEv6m&1hosS|B!6x~+q-k8q@7coynxdC&@izGG3c3WSX68A
zf0#PDazT*oDszLJK)e>Vz(OX}71~=J38NU&^IXq<sOAt+i!FTg+>xd!u^EU1eeTbn
zW#i;Q-W?`68GYWFBXZ^}a^F9wOeLVwmId-qXRCdbG}$RYo0H+#kc6o_W_7;vaDP$c
zuNe=ik?QzWGdh_(ALKcD2DQPKn1=0%zf~dl-W(i-VH6sXK%3c7$fwmxazQ9vgJiC(
zOU$W|Vkn|E-C7*w7%kPG*gIj8U+Ixs={ZSswgkGyrJE$s)Om;%cM~uO%unj}2MDed
z_QAOTavAKS*HV8dk?WBP3f{y|!GB9v1}i8qq~)2rN~^gB4S|(G!!QWBNtpx+LD8&=
zIoMu+jH?xp#FIR728;P(s=j0hB4=h3!NrkKY(%FOOO=tt#a+j-I+>P4-H;++6_<<3
z$sgdJ?%nMRi^vRm^uLwG%qq5vh<wp+&8wyI2!PS-69ZDt0F@||br1oXn}5HHL@w#*
zihL^LeRS#A9d{O1P`iY6gD0=g51|Mq3RGS){LYXm1X&uhn9iBjCHu%`AbgfCtP`LX
z!St*BaU4DMhR`K<*I&H&owR_Fz;B00I_R=o3equ0uE|ai3ARv#@qM`$`b0`XP<H{a
z@O@c$20Cg@stMEcT>$|^Mt=f3u_j3o&ph$QFL3oCp5@~o+`+Sie+Pz>LS;I}Fd~8m
zABeAHMq@ZlBc55w`H_E!nqHnCOO}Ine@<oDeTdSXJF;g~wcWWR*F%Z3z7o7CXBE9-
zJ^$~1lITS^>G2BVC!gf7;Va37b>CGsFi-UpXuL*L9>Ck=T$5z+eSZrCSuFpQCXu>?
zS}*kmP(Rn?DQ4}V^wbb?{-u!IgmfteZJW3k#FV{soqvH`6%cLOfI)|jbiqe|2qbWt
z$xc@wG($wV$4`%X=tx{@eST6Q!zZ#6NPRM5Xrt%7Gl_=D#w1)mGwAJgH7?O&K)-uQ
z*fI}=(n1_K?po{sDt|`6C^l8UN5K=cQW|)U^{B<lnWJXnG78z+c0#yCP~t_hbS+!r
z3JeLS5p9a+f<#A2=cyYqL$2n~*GyY-tkH7@3B%YU3RwS%>sSh6xLJcVc;qxEno97J
z6g!O%7?LC+nfiO$Ih~67hzK7uDldJ|!E_4HDB6<L63B%Y-hZf2k67<$I4>4>AY_oD
zO<64?f8non25)N2ZpL}1kfR1>U`IVd){(T!y8}j#vmFpV@!J=rnGI0}mBe<aU$ggp
zGsJZ}MofHp=Z=mF4Zo_3ID{iGKlCIt)NF$U3jNAV4@Rcv;tX_~B3wJcx>cAd%WdGd
z6UGW%jeSh{v48o@ws=6ZqJaMc6F($T;RPfG2Qep2)qW*WSX5>G;7fx;eieZrE)Oxl
zEtuD?sNg5g*j^SpRty@~S^A+RbCdf%#P=b0gB_-Iwz`ctW<)=HrMW5`4>_sS1--9;
z;USZSA_a&V6o5g|wnnQ?%m;h$G=iG+f$0;{1Hi&hr+*qC5irBdduIXvWdjbzfzh#8
z=t+8gI~`nh!i}{aGh%G4h%Lj_45VRwCEXPs$~RfXP!=m_=Z`=Qa@$o~c}b3LAq>ep
zg44>G9b(&4Y{v2}Wp8BXB`4T#kG_=#kmR%Fb<^gHq5CRBi_33mJj>Tc50l6$4wrs_
zLaOA3n|~*{b}yI2fS1+>AjOCJU51d>!64+Q>M7mX{bb0a8L}@m)<po;<AktONl46u
ztgk;_mY((zVwYoUEg$ev`m4zT7{&b|KdN_W5+^9NLKL^+hREYqMZP*f!tzSKND6Y)
z_vA9Q1ki_A7{Kw0Xe2QyuMH)qpAb<5zNqC55q}Y6nn#v!tLZxt<LKP<(F|}q@@OV4
zMSm$6wyqN+T<A*_02LEds9uEjCGdo2xoPw{jUf8?2!<*RAOV_B_6_@{z-H}-C|yPd
z(Pue(`R(Ix1w0-^DVLZVx^>ruT9Ife%csae1ZhRGPWVO{kkZ6a%gM;XpAOIugkctb
zTYq7#c&3LDHYII=_`5F!y7o$H45>ky)yX=`Buyq4cU=$qlfWDC97$B+#IG<70P*4r
zd`aQBh;g>NPat`qk_q7kgvst8g5ruXP%MGV%#ch73hyf8eFEN)NaTxZ-WV6eT1r;>
zGg^yAvA0icXAF9SB-$zNP0M`It)jeb0e{6M8tYb)Qpq<>jx;{EK0#0mI~tw-p)aQ%
zudQuleOnMY^DS!^Odk?dh*XF9+4`n~JU>xXJC!9nodm~CpnwFKh9ujg|IC(lGu{c>
zw*BQ-U#r$tuG~^Q$eT%QB=ZwwI@K7lXN9<npzXrZP>>rZ8_kMEFvJGW%n+t5l7Ds#
zdbiKKnrCuQ1b8sp_Bb~54VVZp5YAh^;8C3x^mDy)=NWSOKwv~e&n&Tzt(ECl9Ct>-
z>8^^w2Qud4O@W&d!3+7D0ZXf(JXv!gn+((IC1)#ImMhQJP|6LF=Zk0SAVmtyVmv^E
ze2rcU(HzI4t1U+Lx!yDStjk&A&3}}m3aB(7p9*&4<{LWI%w<zprlI9<^1M4$&x9kG
z8AVd>F)WHfkE~{5AXlw~>RiCBX`(G1l<|!!>#vcPzUE6yF_NfQrXqPEiU7#S@y!W%
znK3B757x;AG)Or0xN!+1wcs9w<5jIz4VNcq^yFQzca^-0YSM4=ss<j1;eTs|qz%&_
zfC^I04K>Tsofcz_`$tr;vb{W18s{q?6aCGR1;VU9LHO#?jor;w+n@W#&Rr<6+nZZW
zCXE{SX^5YOteZpwd;dq}ppwKNlH|8u`V1g~L+>T$^{7P|kp>`|9<^}t1>HI{`c!S(
z8sv(zlmJ1$Oi@lry-YPX<$ps&er_H?5_$=dEtC1R{R-Kb7TKs+EG3y$A=neu>5^QV
zg7o6h=1Mm-SC8+>1S1gZv$MhybNSS%7DQ*Ms&2(6&vLIB0kc5`oev}Nd<HK|zL#_P
z4YHleIp5~7UZDU(LCCs`n2H~1h9RFDc;}uTnjsh~nvLtg?MN|o3x8kM8cyoEe?@OH
z(>R1tGf35-RdhSI1;9;#v@-?LmZIG&vakF;Vc369KVKgyE9wZq1Ox=k>xEGBPU%EQ
zwxbq6i@mrm9uSwYgry3Jqq#<p*1t%N`1|b007QMJ=CrMkhfuT+eb%Jms!Y80QQJ02
z0-t&MCglm7gsvM>j(=>gT18eQX$5O?AkOt+HBLz(yvw!3<C<@q><dbW;!u9Q=I$VM
z7pe`dG1;SLYxZjL^o!>gjszW&aQUKZ(NmicbK6HC6yd;U+h0gpT`XkJ2ThmpGKeQq
zPY?xCE4{g7nyFDtY#2_@0+bA$qXi4V16|Ztg~Lj?q!5i};eWloAvKu3v^!fWbx2%#
zD&vkq?}iyt(2O7ptmF2|QCC$A{hf}Lvt*!>wo8r6?(v%dc}A`#97qV}p-EGj(H?KU
z_lQ+<23u(v+K#1(cp8b1Mp6)j+RI>KF%?uE4Isc+W?L_cel)lLvSs`VH_p<cE{%8T
zDI{;DdNmsJMSr5i^LNhF&Jvc}<1es*ABA98`1&!-(ER=;`3e)iD2mtp-5s4Y6d-*~
zHtk3$fq@h6_}_2vjTgZJMiKAG+%SpypaQRGA-aaVxHNh<@8I2`dm~PTPD!x@(}o%y
z+-KW+YbrQOyz@@$wB<yL<HYUO=8{Y8b()>dn#Po2x_@v7rSM-bgK5MJ;vVgfDL9x6
zI(Sw~t~5F@kTDXAsDJ4r9g&pr7MAwcUMSA#YT=*zTD{Dopp->|J9HZBgsqir1@{TH
zpqQ}Hh>|toJmT<Vuf9hc6+_h){{9Q&r3fiT!$%^iQD~UvGpa};E;*t#H)E3{S_D2h
zX(#$4N`DttgQhbi;Z%eDW}0FgGEaa&q>bFN$_h!t@~KNvaJAt7q~=xroU5e={afr%
z8}1T#FX>e}Q^zc|z})lpm$gRs0fsK<z_y}<icWn%e6()z%_}vNRK30#uj*CwVbVkU
zn#!|E9!n2+C2WgfW5&@V>UL9%LsP`%*4D&ciht&Q38SO0Of=P<j0+)qu)aJ>%u*e$
zcOq@g<)fJ!G&4_~<UrzN`<R%xqjJ;xA)TrFiw-&V5EN8wdglb=H5+pX+x3NIglZC>
z9z#|`72S>`ZC4AdXdI%Js~8fDY?I&(+qM$D2z(&Tus1E1P5(kUz>3kFFT+g#p`c~|
z34hP^pYUA&3D0!}JePUpSl)?xGeJcbhNJwXLQwuKlAb;a^!q3HZlqX!BzF$f@p0!l
zQ-U=iJ-ipGJcb}unq%JHMF|VpuDgn5JSv<pFkX*pqdHO<FnS8Zh%;49ow;A?j-Raj
z!{v{*Xj0~@1^mbud4{MHn~nI({vxMXvwx~KyhvgPlMmrO@=m9b#B_U2kC8aa`hQ43
zbc7DJ;%lJF#%uG9i9V9pu!+*roy+8JVBwH0knC^j*WyM?I4-qYI*BD8Ekmq2z_6DR
zq|O9VhfY*nMzQQQ|JDKqHcFsUN0j^`93j-DklaQygL`sBTz?+=pVuCS@drSN8h>Q3
zW{5x&<}6kPt8Vlf3SlZk2<=Vb2F9dF6M~^q5ISAyyG~y^3l)C#RFpgGI_2hL_ordH
ztMU7md~uJ)v{Efk(yZFqzKVoyBo$5c*_Kfcx<xp#ctz*&V3E_Y``F$4)6?>8wp|R)
z2HElS62IElo#U>B6dn(US61<#QGZ7gfhh^+Ivydu%@b%xd{1e2=u1;wl|u!+R!wJL
z=z-;h(RjcSo!RAV#`|)zg2(k(y>6I>$2}x=EG6@E^JJpQ0F*=0akS15xuN<W`<_d(
z1c$<C`Qxw8y7|}!@M3xgXUDokgUft6IhL3{k>rpWqFClQ&^-Wmm7`0w0e`w%A@Yfa
z!k9)NGDXPbYgy>ic-6vs5R5CzPbP`S2(BOr83{uiS7)s4+I0@mG~(qPrK~@`AlX{h
z#|k;q(+GB0>{l~Q+{+^v!L$VBwk8>TQ|8%s#mONky;?xR!GBX{iG`=rc}75CqkLv=
zSw=ej_n`yXwxp5i_VoEm&3{DAei|oJM3<I+TReRvUx*$sVFHQABPi8$(!hIEjaC|1
zl8(gI_=4;OT_eUG)CUCyh-v$&@nX0ip2f?EU@rGY`Tyst+`04W>76^SpqR^LiaYB!
z@24zH1m!<@&9JoQZ!<Y(w#?V?bm7=(Mr-?wA=`wM><P#Za6sK74}WDI1|x5daO{2z
ze{lDAg0o}SS-R94&%O@BML*U<y>pxi5$f^o+ue4BU-;7w+w7!g&1*_bVh%R?I$T~(
z==ABT|EoP5j}8xe*-N+6c+-1Sk#i0@@V@9{|B#(csuRcGx#D(Cq|s;9h#{VD*sR<y
zo+kIxv7Ef~igs+Ek$?V#Ytuhr0FpLC0YVpp3fpQC@9C?jb<cYY(c42~&wG;JRF-*M
zFrlTZ_7}Q;dY^8Imj>YEqZh9p2X~QLBmKU#G;s3fi6%f;zWxaqZ{WDB0MUpT*^rOG
z7$;0s^vGhHOOJ4PFmL?8uIXN$Px2+EqQ=xscU|QXPk85At$&w7Q`TAT2`4?^)Wt1m
zR7LylX)Ox*`Lh%mi9bVuFHSLc?tD{RxUJI>oFlTvC$96EkDR=cZTr!82}StZqet#K
z)k1|d<u7=$5q~B1vqZpTGS*Aq7Vxo|gihqqjooh0J&NOm`b?4gx5XzWpLBKRGl<Zb
zH7AP~G5c1FOn)vT$A0R-OC_>LH-((%?7tB@2-agoZ%juRIcxqPb56>bmYtUmnnfN7
z2sJS5i&EXE&|KrTWTgItJbET$&Q(O+xi@qhnr4YUK6VtTKJSF<4TMd?Ur|o1NBJoT
zRV|rVfAGlx<UB!}J$u)t)Di;Le9n6z7~IF^BwNRq%zrjQBCx}|Bwz~B3`XuK?+8uZ
zNf}8-Rl^M_<rO;#Ny`Q@>qEQoZuPv|Bew1%EZ)$5NkUF?0mzSX`e84bDo^ECWYoaO
zlzWY1a3zVzGvIInytQJalN7^q6qsd!-4#9y=zJ2~Mf*raq@r_Pf7b#(_o%Nso>jBQ
zZ1Z`(Jb$nEGb-=!60sp=n}j7qOlS>l&Mb_SLkQe=aIPd;kjIiJ1&FVarqq;HHq&*+
zpD7JjCyv@LVQz@|d_}}IxFI)>zAnxjGg0m2x(>0^IePdWa-ezjL8}?AkjAk3#;>nC
zY>@fvxs1((@wFkopFF;^HYZ5vEsd}JB>75}jeodGo)D_Zkj`Kp6R|2`_qjCphW1;$
zw&1EM#x<FAg==GGO!ZP*W01V5FCllzo0l{zDps_5QQ8y*2f7x;int*l=CM$m%=P}f
zs47&YV_!P|{%`;1zyI5RcmF@MjzfA~xk<!;3AY4(kwVqBxhQp8E8?!D6+!Z}s(-6m
ztAD}?Fs@2BOsSZPLveM4ei0XQFh3jAf18BrK&<wQwe49@ZZJUBXUxOvn)<i3rZ5tF
zC5q6<)5n4!1=P^UkcuJV)!omI;{`m<{{4UdKa$Gf^RZ<B8W(*slHuUWTwzZdEftzn
zfWX5O>FrUzamgu8M{hEDwpj^FuA-AI1b?Tp6wjz+E@5^26P9#jSfh00O{9ay$!a@J
zSd$1~b^GCJ)=eAfxux3AwtVF+-`=U?^3R9F7@uE8?TO)|wUtmMG}Crm*i2O~&lUyF
zO<Pl}wk5~no61r9NYeoDxS}ux?`VBn2L^@XSWd@uF;}y20|{<CbzZ%|10|j00Dq4n
zB!U>&bdxP<QzE8uBT(1T%k}Nx2N;$1b*3HW2dwuyS&+hj9ooU#NI}6$;}293yA^R9
zhcCSq?u&uuDhWb7HkH%7$>|m8#aCv2c`SmQ7aiP7s6tmn>t7V7#ez0_qVlRN6@*81
zb|t~S!rhgcSno*^+@IDwU-#SAQh(t}hD=cqucvg^!6Ux!IJP-M=*c`MRb;i++pT64
z|KL#{HA=rtYf{FEB^!p)o7w}w^-yxMMeUtCo+KWpAT&$zyt73aSCfVT`z(Pu!9agK
zFxYNzVT2)s;*=1Nb^TYvm4M#sc8Vyq(c~hSeR5!f!OT2dB2p!;EgDt9N`E}KwIzo2
z?>q1yfQV0bZ_v?PfM}-s?|+S8|6E>ue|GQQjqlq#E?YQBdey!_Un~!;?oXtuL|2ln
z1^E`$lWLyA|3PbUEL|J}D=7mftd^giL55+4NTyhNw0tW?#XRJ93gU$Y%TQ<C6IU6{
z<I1}D0hOO?I!eOH#p}<sU4IB#1X$irn>pWgF7F0x?aet`uIjU(x_aWDMZd1iwZ(jo
zn$O#fy1$08-!19jWHlp;0e@5eW3A`M#jN^Ox*ofRLzj`$!H4lXU?1)&kmesc+4n|`
z-ycF;zM|>+T$|RUtiL=jE1Ny5wAmL=4qx7=;g1mxyd1(Q{cq=gn}1x<2OJ9C6w%sy
zhUG>bel)DF>_#{v?c?jq58eFqGHU)|dG;6ZRUfp6lfOkhe7nd;$QGbb?jN+HYJ3v)
zbU3RnPAB>658Fq58t=v-#hOEEhd%7C)KNEIB0%DX+kX9HeCGRkUR@N6!}DS?`LK6<
zUhi5DUp>E3)1M6I=YR97T0WoKJzv$!8#Vo>;lfq9qV0v<>w_6FjBZA}?+$aRcGc)7
z`Q=Gfy&hanZ3`aVx>+~7!%=;nFRognk<H^V?2I=%rhgocS!r|g(kO%p?d6-*hdn&A
zl{Sn-wKrRwd&3`Goh#bLXIq@r==I}=AM_48{_u4|kzTA$ZhuBufjQ^uTy;oK(01oJ
zBjSbi5QUT1_g0x>dIkjfh?oV)#b8OmywUMV3q)@kis1D$8CFnGl;?|?Ij<J<KZ>nk
zt*rWSctsLz+V*cKpP}eE?h;Nz{3@JWd6_YB0i3x6V?j7?qKeUMQxCE)RTZUiuLAm(
z8XHVo)i>vZ$bal0@_kJKpF<Gg_|&|4y$s`1G5FCDT{G}`Jym|V|9<tnYgz_PO@0t-
zTGBS5%qSH`N*+c{tKvDp&dyHOrpN)7hh!VkY$@uiwB7yGeUbDf>b3SDEl35*_SWH(
zXHOoz%<g1gy!iHO4f1^U^y{ZDv)>`P<`E^Q@7Y>X-G2>4`cR)W1yNZzsnq8*d6cIy
z4klu(O|ByYmELWfI^BVv?)Hx=$7OqWnL34?n3DU^r1U0~_tbC4HW#S2W2=lPQ-b@K
z*}JYXc?B~m{1tL|q#;;9tz11bF=;F~yj_|WS@GgEzkX__#j`!1M2HiX-U@c6tBq_$
zFn+&*TYur-0a!Mt&u6WW#e|GHT)FWs2=!N=R}9Yya;)JfyWRu_Dqo({?Z@>64Tg!H
z#|;zNakq1CKnDr6;00Hw-9Pp0U!O#NPak#eqr$qO6*WzL%{#LUE+!*K1ah&8tzGcz
zIfy}wON~RDEL$GZJGO19j;gc4Lb$WRL>R07V}JLl=;yh+5{{A%eyFQi^s}6}W&Jk#
z?ZDMef00t7x{gbI`Q)3IhwiXOzdd?(@aplC^tZ<cFWvw5@Y$0_*~n_~e}~@If5>g<
z^7Fs>pO<x{<HrNKtT5Bb<qq{L;oFNR2amtzFnD$aLfY;QQ*YAg8kt}tYW$0Aw6pot
z8h@2eMZpye!fFWC*kDD(HN{KAqVpl_#5Rgs>NHS82lB0IliGDlt=gr2pL&_k1k&j9
zV^+4=Wc;?R9K(KgAGxnGt#=N8?aw4pSF;|!g?baX5#Tpp*-<Zd)8g7s_zM$)sRr6t
zKlZ0s^eFb{v2Six^%2d^Q7~sFZ8HpT$A2E2;O!|EqO!Ub5A@Wdput`7tIB7JbKC@s
zG%zBAq68BoBjRfFH}dEKtnXd+?DV7Ry86_j+S;s~BtGVeUBiSk)eN5Ofx5%s=z;c?
zzKqG5A%9d6+z|y}%6BY-7o1t4h2>0j^k~U*9teV%77Y2pOH8vXOIp4;c$~Y1Dt}Lz
za)#PRVcXcW6MU!T*&@QyMd93nX@y-g=U8tAJx;Ftv3gG_`{qd7Y?+$%qcHqUcP!i(
z&*ZV8T5gZE&OkxQXJ>x5$DaHhV*=Rb#Y)knF#3b1u%6IWiw){4cw#^e=A#mf!fZ7m
zmTWn=eB1NXm}I;PlZZcVpM1~HG=Je(>%g)$kK;{QSIyH(%K$$>z`w%r1`hgo1OKyD
zkYVe}0bQ3de@`-ZS<s5rhr&`q*T^;)6q#^3Mo-3zOMtSmC?dLvWpcq-K!luV>O(6m
zbgJ)8!DlC{*?;{BvXoLp5w%k8-n8eMIXQbqFI!s%$)#mcPOF(9&gn-D<-WjfSx$fU
z*eB928MeMQv=6N;nX}+liws{9jJ{eb4k4`@1D`?pvGAN?lewIY*1{`t57L6zpE^K*
zx{km((${^%F~BE<AW-I4O{33O^?4jh(L53KpP#!zfoa8GmXknORL3kjZo27aj`viL
zk>I}4zZ_iZGo+K*WaJ7)c`&GtB%^<19eFK^fXdWjBnQVp78uGS!UH!h>m~l{8&cCL
z_}7Q(w4VB_ODc$(B5da)Cx1)E8_CqO6ln3<r!xT$qJS6KHqHPtw`YHF|52ZK_is4W
z${z+KwKA-XcPzEBJF?Vp_l%eN3mEN-I*=iW$i{v0lHI}cr&#4DZ;?EDed&MnoF_yK
zOZ^?fPu8}POXJDG{ixX%C;cjRsu3_n_vARK3)!sHVBZVAs0qE4u)oVWkr#uYXKQpT
z1CCx(z)IyRS7>h_z(oyC^ya+Zb=XqZpIf)bDmYHWbF=9n-C!bJo%@5f_a(()g57!(
zO?FLuG%$J*-`&<LYa;pM5b1yPo)UQ!_k=Md4K`?1gcBU3^k%Hpdxl%VMtX4$6oS%Y
zM@`AjBqvuXG2#g|MrHlL%K4|=Ku2q+`yP078TqJum-MPL2U240hz=fM!@oo`;$@i(
zDYBW@BGd0@TVG!W*Y>SW2kpSz?d51VljP-W%l#%@iZQ&OZK(^8{zZS^iSVb|#QB4;
zIj$i$lHIK!$9$oV0zb*Wva1c{{mlk*G8TTsc!x#IK#LI8yiPzou)X>u3Tx01tt_-B
zvki?MeUJE&vX-!X-&~-D(V+{i$lQ}5DI?CYXiVxd8Rd3aR}*rnOO3}U=q}z>3w&_1
z5tPSHC)@>h>-A%;=!}0F+R2i%n}5N7-iVp{%ny!SP8dKs@N$XF5?Qm#&Sz~^<5bwJ
zy<SZg@ALf)^|jMk+?2A^KQ*Alm(dG<avdjCY^Egj_IKUiM&*9owH^5L#nfJ^Z&hf8
z5bb2qW9e#HT9a$5cag#i9u=gphNYb0c5bUKRAGuAWV=pk|8akl(icVmSRzt&FD~aG
z(fR(!R)0QT)9iYs?zf5}7tGx<8P~ca{K+hYKBxt|)6%sR=zRCplNV1EZOe`Lce|Z$
zUp#*DB769+mP&o-4)5b9hmSfs%)L*8f+o@TF>-KZFueZNUgM$N?+RW4CGUu-Q!Fea
zIQ#`bCp}|vB*%YkyQ_mN5r*|`CD4yx{jSTssv%7EUqO2obYDRqcK7bxp$u#&gBfxO
zv9er>$C9xz4qMo61X6W-4Mi3aIBPGtFC_`}r5D>%AzxmkR24{`@pz*Me(c4PGcSg_
zmn)T!H9S-$ViPi=tE4{U;{94KbTbSo)LcF-H|Cnuj!=ICL>W+Qk?kX2fSfRsC}#b!
zhogL7ZY63UZLWn^If+Co^I7*+h0XCF8u@Yb>S-L|`SEa7t~*ug0x@J{gwX9eg4{It
zUao5z3KI*57@8YZr$e#L&VI}T?q5TI!zEj^h-|$pLVA0a1+;~W3KkRp76V9nJ(A|C
zrA(q|C}Mv~?y$z}Up<ZVFy*XodPYMu9eJc}wc&&W3U#hIuI8%~_nd_F(=ZMEI@0jo
zuaTA8uWv}_?p1O5%Jo5*c!Lj74kkNh^P?!<<{C_(b{;W;aVxTQN6`qqn2(eG$xsUO
z+$*-hB2GfD5K5)Y=GBX5ei{<6Ak^72>IjvU5UhVFOj@JE@vNrt*ZDF&$6~+c=FhJ`
z+*5P&9wYa}M2VY*i!$g3eD<`Q)tY%HN}Ph}(9k95uIMjXVktBfU*4_hWj|VCe<9>e
zl01zOG?y*ivC*B+ES2KtJNZuB)^WBCMgZD@e&A`tvM>kBxuskg0aUQ(L3gAuNyB0p
zayNfr!0kPM=4*YPj=~$c(@m2}zUNjdK*FM$)I?f5X$>c`v_<4^zXoZ&zPGJjM{$IG
zArUmS96|+2$;ZamYal8q%!@Vceja22-zYLkD@NVLc@?O<7Id$0U8${mTzOAt6%6Mv
z@7Ch*pk4FvnotREz8D@OJBoN42sfS2s@Z?#v|3S&`KHoYS(s2f2hj;$HIq+W-x1j<
z1T2AZT8fxi#~r4_!t?4M<>+SWIDwPYwgGLc9I}ANt0Tu&+Mz`5B#}3k+uD`va|?7E
z^+cg_;aL>%P9;9-hT@-wZ}yJWt=+NP^QI?AMHu98z|$~bi(;Es^VLMox#Y=HMC5<5
z@M?H-lxdJ_^jC3pVMZ5*mqm9Y7_q_As#8p4ix=u?zmJgCk^cIwo@SAlX&P|RY!9;M
zh9T)aYy`Ur&?Jg5(!>pnrJ951PnBps-FfubBb|%UCgpb+uG_@JI68B3Nvi^RcX#N%
z4e@OqJ;&>ypl(>Nx~Jf!;Hyz0Zoq$-099-@wP?Z!O`ZIsnv?(z)9?u(@{4yRVE)A=
z^q+L1YA`{3j~_jiNHH5bumL1#geR=fhXQ@eCpoYH0~I}e!M-D)Z4^HOUs5*eJ=xe(
zUp;QBv8Cqge-*kCH|$DyB@fl4pez=wWGFWgv`vh7b2YpR-`95_wglH42;qNYFIr1F
zwR{u6)4L*jHB!`vsOu`JTpD>Vyi+s{;H*R`fEGiomgX^Y=T5d0{`}<59kI)*=L}M?
zyu6-B5sPNxkGM#~?<E`O#DWuba)xOw9BAa30^>(y=NBLZjm!5~CW^TShD5hUcP17o
z;|*Kq9mdy?crBr{?ls*6%JF|$;h_&xxdWvm5@jxEU`a$1V@519IvfK()LnH)7iS=)
z1QQa^w-_A5KOE=)3YmasDC(7Um$;psOj<#qDE=~nGzbkTkO*k+4PEJWBUie3Vh5NN
zW|y~2?@-_)H_T7;M)>?gb;2;+0CCqkPi-y^ZSDD1v<(v<Fdw{+GEIN?@#(lZO%8p4
z@XVnCk_?x5{o2i$L1=1@PiKw#f38k2VKybmfUbFWb^R(Q*sC74oRl7;WFkfZblK$L
zc*S@vAQ6LeLuD*!wk7$%M)jL54%jW$<4QpgaR&#3L8n#Ur}NonhsjLc8PJIe`ZY!_
zsyFyb=r+W;L{~9zpyYo`b9Jtmp&x{F)iMTgdC_6WAFL>;HE_Q0Q=LLy=N?|h747jT
zDvFN#7nU-(KM05O9-CmqWw<DC+uc4;A?!B7w3o6E+R`Z;F<+!B@8>4-?q%CDnr`;s
zbLwZyQ~PNEgch0OP^yUrS9G}5q;QA$Y<o*qgAhgMtJ&-QtzLh&u|D*+KX;<D9X&<{
zpdrgrzr|@XH$ksAK7z`H?sZP&eJ20@-c8Pt4a9mD+t3bR1v32f<n$EI#@l{!*;TaW
zBhZ?Tgm@1iRcyOHUZITtl`A^A)E2`Kwwc|zEA#7RN8ig3u$DUDuIZ~k8<%fB*J|#5
ze71wXSy~Hhvon7+Flfi0x#8qv`wM?BK6k%;{*7C_&vx8D@W&H`QOaLC?z>gpN$P&K
zJgLT)p`{;1m+xeV?d=t3wcQE03a+2*b#eLN$JL-5|Ll4hfA0PXJJHXs-Ld_^08afS
z>N?B1-JioSLdWh8n_bsy?%n^KFQ=2vXTR<Dx$(k^W&MBt=bg`@D9s03%X;f`EEwQ5
z?Irmg^9pYti7z<5=)#9@;b{D>_=N{!8)Q%_`w`%$PoskAS@|&<4-d<yyr~)g_cIMV
zceDEOmOC_B6l>RdTslAQ7p@6@kIu<wjh(*c8A(n^dOm)<<&)17%@+Uoxp4|{0^HAQ
zrvkriI2eCF?x5M9JB@?kkHwEW<*A;ERuIorBDeySlh)fhKP{G*Z6=7`8kSpP2Z)^-
zsm2#}lN@<np3M{{Z=+iqvx^vA>nV`$ahoCSc<nK`nPqLCvRPRdpMhQ-eUJ0zPD}Q4
zQ0WE6RQxFwPj~$l`uWo+_{2L4kh=|la5HH}9%+Bdf3$4rqt|d?N|@NlqVasqLGk@0
zLX`%FQ9G@TH$hn^oE)vSzX+Q3reIViJQ*fb3#6-Mx84lx8Y|d00$as?|8C(EoT`%o
zrucW_QmMhguh0LVy+7M-BgxW*!Rx?NxS+@+pu`|jF=Qe_%AzEOf|VMWq!dy4^TZE0
z04IOxArOv)1EiP={p(!x`fvK8*XniF>Nn`izV5#6H>nrsSLpri!OYwNaF7&J74n=4
z5$@*Z=4RWr?eW{An1(;QJcVFIsz4DXXnQg#!_zH83kp@YVh0Y%vJls_B<~<9{x5hk
zPy`o~6QXG0!Dm+5Rgg6m;!UTtzAT$zp$mTiR2GKmxlFm~c2S`WA~=1J+tPH2=!%}U
zcQu$fj457~PjOjCLF8~TWOy+LV{tMUp}ERw8p|+&ZaV`kn`16{#*<v(8HSiDpi8al
zz++7L_~)SyP+LeJxe>IKi)CMpF;(!t7m29g`9_+;8Doq#P^8kC^y{UZmAiL0%}0OF
zYv#T4w8INIJ!0fof|6{;bJ+*s=5<MlB``*|P6!B99$+gkIA0vfvgS%zZTrjP!|;YG
z*uBA4b{4!~wHSUfo}T)p-mgM0r}68g=y4dp2J75l&K=3ZT=Ch3&nQmS>WH?&8b2<?
zi1}c*XxaZr)Nv7~E<EU}u()Cr+yZ~2l9-ZZ@nBx6SXjndV0Cjh5sQp6DcA98)UV}+
z6LQItoC)5rc=}<S;$r;c6)}GMR!;N!;eN}Ya)eF`@pb=T)ZT+jQWc}xY5WEtKX;KJ
zLmH<d>3DK2boe|Az=M|&dgL964BOKuQ3Q2q_0jKxvO@}(x`f7~t3nyMuS0)Fs2>!=
z%E5<M#5(f(mIgcqRDXG>BX@CSyrTx|6{%2zvWe{TB#5Fq^eq&t=xUp`)+<IXhZciD
zxJFRk%2I#=6$F_&%S8ZZtX+ouep8iY|Ekn2Gi;Ysr`EEZrQIuYmTHei@f^`KkFrTR
z%4V9GaAhu&*zH{q*7n|RkZFI<D{)EKS8G)!)Z+qXD~yTm4MD8-vRJR{zuLe$;h&YF
zn<4^)uCkYfO6H(4kck!P)Ed%rDJWEob!rx~KiWN9LH>vQ)f(`0BLk$@I!^U!KxGZ*
zEaChe@tB}ZQ5dMXL>6KlL>BB0%M&E+!H$kP>7|%L7E%Q0&`U1duDE{;GyqRSxb5>N
zYUL0M&bv@wutZ~(M!~z-^1dxJ*)9a($U)MO2NjRGHu@NqgJ`T86Z!T0r{kZF9<;y4
zp$Z1_)A2N$Pks_bh^|9V!}SLWyyh(c9i*H)dBd{K>3ipG=G?dfm63rC+fs!g!B%T$
zlf26a_`N`TewDh))9-(!HM@{J2rn*PZ&fhhz<@l*L*rGhigsFpV?R&&9)!N(d?P{9
z-U2T7N><tWP!rILvt)`O48s>F1;{z?n-x2O7(1ILoQyh-&(h;q?H$CL6%sbc9nuOT
zL#rT;r|?(NXJ=g2r&i?`#AMz?C+YFYi2jd#M(jN;Ry;s=GV^~8={AgpOjad~!TF40
z0aNZWh{Rt2De#A8$lhGu)T>?YVNc42;Q<C;cVU3GvOYt{fj)@uqo4_BoFYH%2*4re
zOVGok0?Pj7p!!nU(ia3C(02_^8WOXnj%hVLt;A$+Aui%&p`Q>a)Q%lB$24fTh)Z5J
z7~KRm^hq}1ro4Y(`cb>5Y||@D%AGqpU=*j+@p3LRjghnH)DUPQ3KvS(s5ULiUZO}j
zJdBJjN^6uH%`Bc;^6r9XY~EviE|a?KseA3fQ#gl0fGhBZ(fl(63#dfIWfVq3slKz%
zSjQR<%a%jiH5mNm`$0~4Z*{ax<Y(B2xW6Q8B1B-;Eo6TaFh#e~h(WM10}D^LA|_9+
zpL!8|BGQ@geWlVSTB&HUP!WH&rGzYjoV5;6z!cFwm_@gv6?;@ldMj*cGx`q2q>b~2
zpx(ozl*v}oG%LPmsf@9Za`ss_ki<g~)opU0L?m1Eg&`UY7Yj`AjAKh3Sh;I2Q!hz!
z;v`GQf{K61H#t%(eK86Ram~Htt|nxuw9OJ(!c$Ej?LwZd5VwzcE;6vRfXyJWIra>y
z!)ltGhWjj*bkg*iJQTuwV1_F?!r$+-VN0FkYUIuU>rP<QR^pI$=qa>+rfJ5?sTLKI
zobSt2P^k`s&UjoQKf^cw6ub(}t>{L`M4??i-7SB_t03-2)XGO%sK!l)WW-`O6w>z>
z`;eFy^zjlt^#O@raX*^|r7sb5C(r%q<`H;5dEscgSefR!B2pRmtW>ZDl2WN>IC!Oi
zQzOz+RpqRDt9H0pg(}VU8SxZZsi;P=id3oKj)R~sigRHg;nGrA2iL3LbG>>!995Xi
zEX;qTRgtXy?~@UVm|N0lp+s2lqFX`c2m7H^2$Q0J=78~~P+pI-bJ~E%+_4l>RCmi1
z1xbB$oqBUf%%4fM1QM&~GnXHyCumS5%P&TY>-ti+8`DHW?@5HsA`C0b!+<wLr9kLm
zv@5Hcq=(G5>#hTD3#6mtlR%}gNUy_^f$M+Ou3~S=(ZGi&&W7a{l`pz@yz3tC&eMFM
zb|TB|eyUIgi)He$V4(OJqw%E2V=<s{Q&`jJG~7ugj_1nyZC93ZL{+5=Us&nm&@&O6
z3%v|Khs$%YWi0)dpIO5dlfG~$Nv2~S)ks@uxT$H#siq4x&Dk7L*V-JMLlPZB<gtJ1
z3S5H{^;l-f;AG61`r<4vzEB3#JdKBm5Ay}ZjRnB0A?O}hH?w6TE}9*@#3AQQ<f5YR
zNLZLfBsV|Tr01G>k~Gu2>3$zG0#KgjFm|}2>{=>R;4>tk*owE&I}d}2v1JJYr?JH0
z&u%vEIvy&@TGLlmbE;!P7tXnOdl-K&tH}HBi?=P&yMB{=!BG6G%gzvcnx$L>omGCW
z*&?|$Y%*XI)pe+Oai{xS9q@d`axsSZ($%OcGA!MrYysqQUO-ae6PQPKDM~(%udb3d
z(Lp+EMc;D8`11tJ>o`-hkZgb3{pB;hA$4`(N0xHxE{p8zI69doNB65X0@#0j3L~fj
z%He)>oQVac`oNa;>vsIW>vWA$)wD%@&Ui{4dJt}tpicr+aJ1YKtNqI?8$qM3JQPrf
zALpkNd}cb9sZ?v~kVHttXiLGQ^LRY-6A{C#{~Bee*-P~->vN$DxTt~(Z$6=h&WCBr
z>^U7|QpjCudDE6A5sBw=M@WBw-eHm`=au06g9AzHDs%WBS74S+zA^Q6nAyOgUkA9-
znfwWhMvGX}MA1_Gwi0n7pg$I;g&PzPH`)G?TUS<rnv4oZg2lYyzc>z@+P<t>>MHFW
z(pEl;i&<-%UAd@C{xmz|C*a6JiiQS1+8fk%p;}-%D-;*+J(kOE5IuiQ(2M%n3_cEZ
zl=Kc16rl$l!D*rh#3W{Kb^UxX+6$hLV>|k_nV2i5_HFWtrs#)s(2f%?3n+h|pC(g|
zFZO-o<|#j7410S#AXXmbAbuI|sXHO~$9zn4#Hs)dOoC*6hxE!vPPBl2N?nvbho<Ck
zW^z+uDL!LfRZzvch97@H>m)a|pRSezb@{rregbK!?(KPnf(@qi|82~cQXGAWViC{+
z!e2BjA0sUK$y*w<Q4zK|Wp4w%ja42S{b`yHh;<w9KS@TD#iEcqa(;v_5u1Tkufcxk
zCnOVHVAk9Tvt1ChXNoTBoaWTj<gGvYL)pTl-KxA8FCj!fF<yVzI!d+v(V+`ASRy3d
z!)i25DQvRBtl7}Ju5>%PblXrZe>h~s0?Fp;k`aOCd;D7HFqo#AGbh%CyK>eD4Au*Y
zBUg>@wtv#y&Fgk*1pFi5Dm_CdDwSIj1Vv{e(AZA>lwMS0`tt@8x<N;v9C*q+kFyL1
z!>vQCami-tJ|};tEs!rc%<+MG;<Mpc3uhg^;PCF^bZm7c=v$qXwERrSo?EJnbHr0x
zu(cVRB}tlTUs(dY+j*W1<YZw&4!Lj5%B=cJ=}@fT_}20mFZ)Itd2o^(?n<2-GwO>t
zD0Bn;T^=dTz`)h|^;{&B&pYK4Bp?8JR9yY;v#r_=?2LapM$(pMJOViP8^SbW(jT+e
zQ9KJVE%XD*Q&?IRT?h}5(c5Ng51!?-Ll?{n-~H$R_5ao5#j*`<r?Ad@uFv9tW~Equ
zmJex^7*<y-58cZ3vGIF*rbnqS%#29X>oan>nM;9V-jjo31!JgM<0S`WBXAjruj^uz
zETQGvARB*yqv4cnM5DNmlFQ<bO+*<iyL|fD8%3^U{aPau0QFYWkvO>}vLQvyNQ*RM
zY(m<POkoSS7Z=C1>z?w$Ikze0V9pPnOey}{)JuUDjTl%W#*=t@nvGehlnFF_*=5Pm
zcef%vFM3a;mb8AVt^;?aDgBs3H-Gduto;q=%0GWU$wWAn6fqosBUGBARST2Uge&Nn
zi!%nnwoIR?+GdiRlm60CQmS|CRTKJf#736cT_ClQia-+8i5gd1zP#2D8KicXy$uT=
z<*W+DPE^RYT_^%38xUal<wQG|s%($)EbQCcCR|%sZ<XiZ86bhhrJHj8P&S$yI$6;$
zETVrM%PxJMvO_fsmvltq6CfaM(S!z2k5JG{mq%|TLuDUbcR~D?g*I?o!WcNoGzh0Z
zKhD`lG?gqvNXvAM?bE``*jm8K2b@S^xE4EyQko0*D3Xrv2Ll`87gEv|*&0mM&|Ut@
zYdp1(p<>oJ&_p!%^^nBwquFxf)!i=N>=J)jYc8}uN^bM5Iy&Kcw?nA5Y$(@rAIJwJ
zQyvQb$@{!OLnE7-R9-LSlUaH?O(@6zL22<gKZc5+XEyXhb?_xtsu6w(DF;kaajF3D
z2G^{IZjQW8Nm;}D5_bw6K2DF0*w>RxFCnubwW_mV3XlwF%RKW9`I~1*$9l^tNL+tX
zueT?_2|a4bdn)041igx9zMc1b_Cc9c{8q+<=BVoj0-_bieDGzbD##HEt?ZYyvAC3S
zmVrOq-e0yMagO;y-|8jGLpW%$W2ZoI7|sWYiSUQtgl61TRU>)MfhDrcyiNO+zVtzK
z2pi8ORw3#9vwLlcpd4G+iR45|Sy+E5mWWr(ihu|7hHqo3JbWs8Ow4O<_Z!iH*`}w7
zQ_f*uK=(35_=s&r(11gIeu_fFjK_euWUpYw>gGfg@!*8Rf)7zQh38W^$m8uN<vIJJ
z8&3yt6>{{K%vw#d5)jZnxWLI2aV@I6?$n?>sOy{^bIc=;Zj{8+u@ID)SG9jtL+$&#
z9W~Id<R7`J!Zq(XCI*R26(2@Q3{ors;MGl8WM;{#{V2;5Yliv+PnQBiX49aq=H-S$
zu!)zbOCL->zhOScj%t#S3U3o>>SM;xts!!1G)hM4zrgYU1vAg#(F^cPB7jGafOSa1
z1p7fy_GXZzXAld(QUY)vIz)d?NDyWbhb?Mn#EI0JZtPGG_F=^6A4iNM3^aSOPxEpd
zsdEfb^6bDMIylW0hk^sFYv;}~K{H={DM7_mon4uSq>v=cJ3;LN{yK~9I7HcQXCOWe
z`sfi}bC^u0UZEG#{BxHtcG;|?!epJ{u_d7sc5ks+qKNEHJVmKrzEgi9@xOEv-0aFt
z=|)O;=<pFxa>Cd@Y`Gr|#RF+r0YXj~H}*f1_14`}coW(6PZtl55M%;bESBg6u|j22
zto}^>uo8IoL#^E(WykGNJSW;{(hFWUH{1MtK5H5|HKj2TO8)}-T0A|*ww?kgXNB?G
z9t|zvd_3LQ49?Sbb31=HFZ}fk;Vw>1cK+Qi@o0oJ(*AUgkMP{Op5YtZ@-lPxO<WZ#
zPZT{u@viImDS%X|s*%Wi&m6Y0gcD)u1os=F7!YI<mkn}gj}}LDPX`oO4OoCN9jvbA
z5u0wTobf<JdvMnQq|%D;@-Mp647mf4_kz|1dE&@ni(zOTAmM+&@OfcrZ~S7jk$uDA
zOUvK(=PrkP%G)%~DST6n!EUEYcvIc1ZCL36CLYPtb<V}hvyzTUTyv0)S-*}Wr0vpx
zBCU0#I3;0Xg6W?O3m6HX=ff2tNx932FyXWmRiFY2zu1cMN|@toJ$z#Dp3zYg9mM09
zv;XLtDJBw`$!C9x1p`Bk5E051S173x2g>c)t{RVp|FCL&;a!w!s)%s}OY;>=-_^qd
zF|x(j1kEZ5C+Hh@{L!QwYJ<dKH0g!HYJ#aD#!E*bYFJ9!(ayEy<NB;?_ZOit>FHOy
zT=QUtLy+U4Suo(g!2TxFlo#A-yey~*59eo4Qc(>#@u`0R<0-TmTd+`@!3D9|K3d-C
zqx~1p6);%SKiz$<(=ZMfIrnR!i)>dG78wH^23Y!)r#Mofs_IU3;MO)`VI%UK%Qd}8
zJ_$>ddDjq(X>i<G*9}5g4_|D$i`a+{11=yUQdkow<}h3ACN^>&s;I!C?+>-xbRaZA
z=Wx9zZ$y978#eVsZsI(l%^q#b2_uM#>=(?P4b+JrEJ+)J3qL@T(l*OpX|7H_WYIAn
z=OD@Rgsl{&hBG&Z>40Q}vy_N`=jBt8%Drh<1$#-G%IB$u=4r5LBXDb(@6;tJmsh99
z5i3lK95Z2Jh>rXK|LFZ#LqZulvelMV-~{D>teJo9&u~83_<f-atFdn0r7^gbp4Ly2
zSph23`7HMwl|)J<(H|W$b{-gqLx0+JXssNbF59C-^uabMQ(|eme9vW<<Y-VRE+Vw^
z;Og?h{iQ2y^hgSMO`2=U<<N9BmU`Gm+7O<`%M;WH;|5Hj&<=PG<5?7r0-#67@pQ<N
zux)>2bhA-t#@X=WtZ*$DP{Y5?!DuQLfs?l_k;=GIp{or%yJ0yv`XLKFh)pGhZi2W{
zDJU3@(wi&e(RqA9LRcn#dL}VrrZkX(quSfmmC9hP93@9=Pti*p@~rd2-)RInb6);y
zNJ-jQG26aH%^Xd)aeSt@<!J9O<z5^n25^5%HaX36!LQ;i$3hpYCNTKq=9p=TmxZ5D
z2aVuGrW2MbRFOvblDj7k0*+8R;27o(F{?Mw>f+HnkwS!J?}6wlL8x<7lRP~-Xa(JZ
z{t&*zUI;#_RLEgCpqL%bpwnT-98ELSoJM3Jw;Tj@D8lggjK(xg3$D-0mqIn2v!;K0
zuHNC56}L+;mLPXha|vXpsehy=V*2>3_1*UVE>fPl&$plL^i(4@&_Xu}Y+_@X)SYX~
zS;4*F;Dcn!cpe2lMW6rpf+$mswccIKBG@&oEgcaV4#gVSM_R-xiTqv{Sz`_d9&&j+
z%}YXBZ1`ESfU#s^Wl}A|_`DukP}qORrk+JX*hkPb(CxJ;QmmUn<Yziua2pyGa?5a|
zv&=M_9|QC?Q&z}G(1}Fpv9c;A1la?eNfe&l8}3-I#atXx!_$=|Ou3aIGI}k|1st#w
zS-D6MY5>)XBMlIU7*9?(<dALu0mlh-DkoTnE9&K9;iD{*2*eD1sWT+F<IR6mNbp2E
z*le?~5*Hk4qP_xuC8B@x%HI;AfA>Dj)Nw3sG|Ax>`>CzSAx+ZY^#yiwd3$bs)|H!G
zzUhIokETh|q&AXuBnpm3(Y}1~_(d*yopjINEC=QlI<#ziRoEg91<vPEfMGOeGs-j(
z^jtZD!mm-Jy*Ezfj9kEh#sz=!(twd2;bbDR8-@`no#=3TiJpHcgOc?_q{pF}ze*o?
zSH4gc9Sz%pgNn^^rN%lPX0)@`J1})w1Xb~oFLeUFF^pfLk(zs48XMd(TcKKib`O3r
z*C<~ws)}6z*1>^ls4$sZoFB=`uFlD<pwX~>6&$gpu*G`Gf*^u2(BFTDR@SSGt6pbi
z`;~?sA{CugeJ#R-xEJ0>n*HTW0Y3h<o${?N%^Tk`3v;-u{^2&PtImL23%6|of0NY{
zy~;+^PzWHl8NhON8vn>rj8=EL%}EJtBd$~q-QT5dx1?XbCCfc^m2^<F1K0{6Y~CZD
z)w>|4bS8DbBwLOXw9tQ^Exd-A#d^55<a}Cq3vy9-O#TkX*Cwu@BPz?<?DN)d3VwK;
zaZh6GYDX~XSaa=B=~}Gc4nci@gp`rkx8<Z~jXN_#FR2WZ5*Je|FYfSs;SZbehir-G
zB&NfMYLzd|_dS_!v)OYOV&LrC!;Dlu2m(2S^wlzB%Dr|=J5hgVNG$ZqpJwNo#V)aQ
zr{e;dTsgAa@^_QklKfCycR%6M2r;{{9|LdW={#u#uZ%~dYrm4(u70HyHt>FrbR3!I
zqrtklhQ`>)a`hMZ^U%%p54GY5O7ym$5WD4~Xu+}C2n6)P01sXChA0w(@J6#gm2OI3
z|5;bB3lUtX#oK>kfVMSVirunKV+-mJ3Y%el%_(Q|30wfo<yi~zhKqip!*Ee+LpuM=
zFnJokNl)je!I+VQgTn2>9`&E0s<Dl~Y(NsPQ`^oaHYOD3(DUBm&>vz^DXHL+!%Up~
zyeH^vo)h0Sh;>#<g&%pbg}!26D_lB9miOq>iBHqdXor7|=wL)@Bx~7hFmFlxgd1-m
zXaX|gY3QDl$kv25?#z47RDiUwbpBAbvS@^fzeGA#Omg9ADL_!>!5;2vBNu(L`20rQ
z>&GH)>Ym}AHryHG_3Xo-8rAiD6pFE}cGplQ$`KiXqL<Li18Z(<R*ItMdQ)ter-<&+
zIu$Uara^xuJ11O)`Bs+VQ%FjAuXHO8+*P3iue~t;FFYh}07qVm=A83wc;wSjJY`!j
z+pmJGC1e++xtZU>h~_Yr?Qpx8i1p<q341NhwS~#}9KOLbt-0(&y<~=k2;~)r&hC9f
z^LyB_I&j@O?9W#@az5`OybjVWqL{?NG6#`yOj3XN0@&*iXqPxCL$k5wx$`G;Ziq#5
z_hB|oHRQoe|0{UK5-GWbROG`QJw0TK+!q;w#bSx!D?Ab*IOYs~E0Wz>sI_b2yQdqq
zC5X4gm5y5Kw79L8ns}xuF49)z3lx9gHNEl2hht|SMd_SI)$TrwEvN8Pe@Vmt{^rgR
zjgf!mqt%c`QkRGW|ENTp1<*v=NvImA%#AlO{h5oO<D+~-4tqK*QoJEqj9_|3X*uw4
z^MR`})68+PY4xJ(w>*pV!GpFUJbYY5G@v+GU%Ez8$QKVwg&m6wfv1gQQfRM-YPY!D
z(h<#g!g(P0MB*U@nS$T8EW-#rzlIX-j<$cX#gw3QPpcRu#@);(QU+v@Op(ju9OR*i
zgkb>$w^JjS7{>xu(wDxEH-M}OL-<fLykUh>ZXUr`_cPcCyj3&mG7xrMu3I{L&lFk<
zk2|#5Xz5HN<O;bfn_}HZCL}3{u7`T-7jxg6`G~gRBgTXH#zk4dA}Xg6iZBa{6y1Ll
zfKb!4&z5pJ2yx=8a%M8}kP!n03`fs?C}BP<Lc}5yyWV2!Lv67N_J~*G=>RS(#0O}2
znz5Ji<JOk~v&GTj9tl!9XG^26wz?B;u_99xs=NnITiwlO*TW#M=*lE!D<p-)^f3oI
z`S7-!wMMTh=!F%A+f4_0ly~Et^Phj)=kcH^i{9MS1Qi$Ph+=@tQtID3;&D~7KZic9
zLJBZ+=s7GN=ke&ZsxVrAsTfl(!6U`2?<<qOA*{gG>5837{<quM1;D9SyA8)XB|Azg
z*(6q~G3JugwE40Cjma1D5cA-av%F3u?>}Zh%lssO{cuoJQJA}4`~>1xr<s38qlyY>
zRHf<U&<hEIQdsRp-Gc<xW!di>(=`faK#nMnJmNebjY3f}UzqY#g1~=@ek!l>Ptnr?
zY=fYUxc{R^?%a8`d*_Zvpya`|wX{!=e)d!JxR8$;WWGptU?jacIA*q6aL+t>9=FM<
z8#O-k8{#OYe~I2^TwMXMB$j`s6prCfW!xTlrD6~ByAC{}PXIP29&2%yI?&#q%E@L8
z>pq(<f%uVkJw*X8V4v{Y%82v4yeAn-qyWGU;G9XnDMlIP{LH^~+&Ec}fHM{VfbJr0
zRqZ;4JAmbGc;FW-r?|ZhAI1UENkuvs+aB$|dhCJQaz(*}?j3D*4C;SLWimAo+E$#5
z;u(4gF}{AD=(z>tE#8)U?2jpNm^QpLhM6v#a<LsY=I+>{Qs%4y6CDcH(Vn7WtppH@
zKCk<n9SgWVXU+v>#EM}-<9j5CWU-(%6-(N3++y&Yl;3jLNl-C2Bxb`P(gkW6`_poa
z1FWTnC_7@bnTvT(+^&D|Qa$}P<h$nQs7Tn1C7y-*X(CA21wafE7fI(&0@f?JLXwl#
zH%yq`-rXQIZ7OLr2^aihQQ>qVzGVqt<qfdC+X(YJhndE?6kir~>Ta=RYTe5C<>m@+
zez8mKHZ0q-SfP0FC|X{#n1Rt;3P^CyC{kRjv@aOQDaea*QCojU3o)kG(j*tE87nlC
zM`S)v{{<LJnPv|S%P$?AWa%Ku)gr|eR7ayCXp>);VlD3A#RDR~<-q@y@#NIHtrYlN
zP*Nhd>Repd&`N!m*`QUKB|(PUon-l}^V!|IcNIaExzbiA+F5?=>vG7HIP6Lq%Lx|}
z<zXn2Z07@O83=#EsKY~Ds8@YuEra*1WN<s$3F_F@rU_RO$7t$T7BkRN2C_Naad~9{
zgP?rD|0?18E7rU{A1|r+a3Jh)p(>k9R|%{>UQ!TYbqB-5%EdfZzn^}$WVZ38F8vh7
zP-?T`^W2=<&{dv#StP8U-so|LFY@j=TsF-+u5MLD+<AY|Myu^+al>kIfmZHEVc{Vy
zY{hXhT-NG4{8cDwH6OcZuG~XeyQ}rEpQ{RFNu{a^KT@hLL-V;^vl?IcUr^wRizm4o
zAiKAfaB*zhwPHy>)QWr4i9Xwk-qro%?}!}&LZz0}OWjyyG4?>zf;YZfHYoiTxzGOu
zMYbeM_x^v|x5Qh94EMiz_wFC6(Ytp+9j%ki2PX;X=@8yV!>`-)yW;O^QmX4nG8<lI
z6Y6Yh@&<j;$;xnp_updn-aR1sFxrSWzHZC2VQ+;o6}q}heKl;D8(W{#?+x_LDZdB=
zzrS&M!9O-06sGH~6_xsHw4sxNx<4CHN8+xcztVpVfkO<+z9)&^g~5FzsOKcbrGh_c
zRy7qc*cY<XVDx4>&x2}{e5&<YZRY)`o;OoPSsfn%<eApZG?oAIYNsMkE-!hycywP;
z1XYtnoGpu8figQ>K+=5=QE$DcA*!5Is|P7~kmEhQxaVL5%GyI~k*}1$K^aWBQ|l>a
zF!z5n_ZfTv1ia1DLJg;OTh}JK!^R0diFs|RCU`gL^NHhEE0<N8qMa+;Mz*PLt~VeH
zrU4Ud3^LPHR<2DnQe|wzxUA8hhm{q~9Vk);66Y3WL-CY0tgQ#F^hHMKb76T#JFCG2
z>Ct;gNTg~AmhB2*0=)~yr=mhb^_Q9*u5f?#_s)Iia7Be&Sj^5*ADHvq#XG3sXtvI*
zai=-yM;8|Ctw~`L9@YxatTJ(ghnLZ0;Q%W?U?&;EMN^5JReYS+h_Du`Qzs;F&z^hw
zDUx^(cOR@E9@JZcXG0@lUZ&HqysD4M)8fevE_4j<p5IUfaBLSM+Qj&eGd3em3n+hz
z8)0E{$v-0sh@mzgWYpEn65dXeSP)z}zlwCaV?Gzl_K?JfG;w&I29yP2=Dm)<6|-e|
zI9vrh97qX_o12{`swqI5@g;zWV-OR1%9&qMDKiQ>cV;Tdz9?uD0ZRL$5UdP5$n|e~
zt7xcbMNd)z=wc?ONk!FXv_9!%bWwlRwIezmBp&h^qhH2d!etLiSN5dXXeavg?VESe
z|M&k9ZK3+&+c(69w%+wzrN>)`_SyoapXx;+@r5R!?dPzkhLhyJT8|p84MQ^!+KjIY
zE_j6*ImpmGP2V`1P##tgVJ(XmU#thaOIM-*NZkmSO7BlSWh?=L@|`>KC3k<AlS_K4
z;!Km`4cP!|+S9!K<7I1%1PROwebFh3CEYqyQ-t-zxFLM0YnNmVO6{-$dkj;~b3G8x
z7A>jFTjjQ+i+*czQIV<^MBcI}av<67N`)AkoHF9g;G?GAVd(=<WA|Ot7X7S=l$Rc9
z6^H2l{ivGeS+(P&7o|aJ+@gOQ(o7#qM#TsD5J;9kOQSf#TWi%n4662co-DMbb~S2W
zH<B*Qa)GW<P|V$tiCx|p^Shk~Igk>kzXUDzy_{OgY=$AiuEsA*&O)sxbJVMAb_CWz
ze3R!{K*mJu0HH`2GsEqJ4zr<}mrv@^Fq=!Y4h;)xFrn6jqU%8=Zh3#NR+LL5oWrAS
zTb=P!v$CNO4A<_7^`Jl{C^%9Liw}MoJq4WYmJghMa$+!T`5*}*9YL#NkWdu;?Gfji
zBXPv=3knGgUfAQXI6fds$Dx~N<80~<K=_5n&hLerCU{6@DSSk5q+J0yEt54&W&(oX
zV@*<q8`p|*w5(FWln#G3zc{G>g4f}yt%s%5IHro?=t$g|rf22;m0;o?uW3CvEkEl-
z4>=xj7A&H$?ooK=c}?1+eD=Nsc>MU>66yC;vrz4!7)%BGU(SAKrEO4~_wwYKK^OAd
zic&t;BC{)fToK`v)Y%J;{R&UUF(;K}N5MA)C*_Bk0JgmiU^{<Q+`nGb`ybSnn*g|<
zhrXYO@7a$km)oH&VSAY|Vey%V;WH1fc!pWfbL9~9*slLwc=EHY8`~|muWh*4UT(Pv
z#`az&j17sHx7zS=XQL5aVb<7QV%J#w;)g4~_~Es`_+jab`}D<j7H`NAx$!Z+xqpps
zet5laCI)fMg}#5ugeVz`wzAz&wS}oxW=M-Gw}@@j4lCu_i<eSNV`cNgbd$ug;cJJ>
z|9+^iAXFV_eZ{Kk@IQRrXtr-ku2-*Wp~}6pi+M{|73`J7!em-4+PYw?E4Zp7_}ax}
zS7<j0d&}qjSvn(O@4+K2PQA6LzkS`F1cth0gW^Rs)X;y@z_>l5B`#ja|0J1GB%sdH
z7GHDsOK&m7(y4vFDjif;wqmY-|7}2i?^d?W#*a8t^8Q=U1f4@gu3OW8lGY4}F0&T*
zU9T_iu)SnD+Dqm`ZHkx9v*<thvKe*=fuX$>wiPVl@V=Qsx8E&a1$Q5|(tROuHI;f@
zQ|5T%-I9L~GJEcI#`SQ?xE@|Hu7^v;RZtT?d{nfbmrYpo(@&8bWVjd#8c|(7a9Fy*
zBCa{A>#V+JOfFmfr7fES6z*L<ysuC0J#gz9Y9+)m?yY!a`AeAiSG;9`vXt|MM)>W(
z3Lls3@bZd{<r^!o$6qy*?>|Q`of>L-+0QmX4_ALo(8Hf+f-bof{H$N*<k*gml5@d5
zVrRrSBV8jAg^v@2LbpL2XvGUI%34v~004HVZPcy$A8)BUcOdlUQ7;fYR;fv0@)9Y-
zg0ntWb(hgNtsthi<^GuUrIJWw8b5b&n#=?izo-Z?;(VSfxF-^ck2%RzvEA7N+I!P0
zJcxgfMDb2BOy;52f^k$H(wB-wxnWvbZW?d1pgAt+_C(K#DDAIAk#vy8x!2QrPVMSB
zlp~8zK~;hzCIN$8xT3UC!%E9Z9x5fB#&4SHl>6fD-N~D;^eQ}eo#-xWpK@)2^vm&a
zC)#q&j;OQdQB3oF(TSQUQIj<Di+q-xHllxrNWXs;4-WYEHyP$~;~+WCVB#f-Yd@nk
z&PW%E$2kcd)AR_o)5^)F8yJSr6ioU~^trv0@tZr*?R)p`@dGWBew>~u_rLh!i||{T
zGq@q|ezmOct<TUo`YMP(%LgJ~zu1_C0ewWBAplTFblCAIJsvkX<FgYDI8aD#9LIk&
zuFc|<3g``e^xeD5UM1$Nx5ZWY^W;smxn<q-xdJ+MOjk+zO^4C#;cyt<Yfgzr&1o=S
z6kZKnY<kRHRNC0Q>pok>m(`zI{vx{3JfGqs{(JcfD6=Vj8#;?N|NJ2z=b`<zBB)Z+
ze42w?IKIS|B%FxPtb^H<2$j=8IOTsby4%{ygCTdgYG#L+XRTx6hiM|=yKf(Tj{jE}
ztdZ<sFbI3JZnT$d5)aZD&Gg;Y7sbKTOPicznGA#HTZV_VWDxiIf8IL!qOhTYNhuA>
z8ZY#G?Qh=t{EK@@U&zN0BTD3RJWYoo`FvsI7M$?b_2Tj;pC@191xqNvQH_76rlmx2
z`zXf$TYTxsy#gZuQ@kq_dG``>Szto|pKCG^;W+9<^T{Nc4&q$re8dGxnux9CLEdeB
zUYY?3XL!4Ms}?xp0(;(gmW|^<Mx1x!Su!5skJD_NaWJoLb(*+lf11RvI}!f_qH+!`
zE3IdK@RECb>VQ1dVNJg*EUSN(P1OZ-iO0L(IEUj~J7TZ7WZ13rZyy!i;dSdQ^v}MW
z2A=mM5Nv$1Fl^wQt5G!}rD{Dn=_9OgdF$|%dK-d3EOkKmK&(=m4G!<z#nBBgeTGKB
zk1ie0@_@Uy5tLb!P+Tk7GhiS@3(vLEy_j>3c54)n^I+qb`f)HgD@1?8%6Jy8GwwRy
zAOY=D#+_61@uvxif2elBbwBYkn!MRXSbEWfnyFQYT@k`^uWL<12hNd?JJwiZ!xJ&5
zzjLOuL<$M3QrTf(U32MQE{95}35|VJkQV*YN{M-U<jtEmHQM=k9kD(p1v{CS(<<UL
zh(cA6o*FEBC-i~YTuOhyYk%9gUhLFGixztIo+AtnZi>@W+ACc3J*qK4UN$~%nk8!%
z=da~O7|y?E{Te;CJLDJm0YbE8lOy_61ZkvYc-O|~j2x<w){)1~3qqukhZ7yeQ_lPH
zLOS|FhLfUUsSEgMgvy_b_0~BN&%i?sP9zIz=asAYUK6-3DD{6U1l44HD<uw^jvYuI
zojERa=^)`mzS!aBRVv>gou?r<p}F96+Rcc)!iwKHbg?xqF`^Yc$?zd}?s%XTgMuWT
z=Ydr#f5}61k^iM3SlJr(ZE@`p-Cddw!2!s~0ksEK<Qw1XO2&299_ZQw1t`5EUjsmk
zm1rV_`FAC}Smu9K{pLXn3(48$u!WhG67Y3lEJ`3gFO-$atjw~^2~CEHxM7tci74<z
z#*1+TLC&kxZ(-P~upqFEr^ZQ+0|zbca{Y47o^v@^@Tpm3zI^~qiG;EgT5-Q&Np}oN
z&oy3R{g^_eLr_edpTBdb5aS?wNb0zZvg5pmwCu<1w^Dz<+-QC}&e_CDTRkQI{h$By
ze?`5AyH5^w_IJ0R_UJ=Z?t7hFa8{V)|Eu0#w<n=P=)=3uU-tB}FfYCSa_2wX4UI4F
z#_s0svz>#N+t2oT4QEs6aTG%j3Eo!ZJ|q+R))Hyi_moMjyR}GU*4DBc<RZg-o{RJf
zTpi6CaVvl4s6&L7S#IUEIcN>5<XpbtnzcfLKKT37AeQmD%ijiLDce9ecI=<?1dtyZ
zuA|v4O9N#rHU^|qNCDa-@#c7%(5n}tVgh<W+y&E#!lGKua^@k1m)DRz;ba24ZvBGX
zFJoy@z_1)IYq3os|L3UEY`T~j8%}F-+`_Gcou_|0k6uQ1qHp$JJd0fJV42FJ7yFNQ
z_M?aYh&-7^k9Q6pMNfC1?Y<;w`>QYng&!$LpU7)1@TAa$^Aeq7UuBMlNDHYNcRW(O
zJ+%-MCN4DY*_>u3BiI0H^{;%EO0kssitvp@*iaDKmKP!z)LsOkh^SD^Mx_7&%Zn61
zYsG&svDgt;7M9a=${`>kDE4%@dO<)1?Isd*+-W@H*qER!pP1b|l`_rKN&kYs2N#fI
z#&zQzUiVb0uw{tWIK7ZJVzWNGp!NvX=>OASe3%~p9bGzHOebJ|oDgX*o;t~mwGJ?m
zmIsW7Nc2S~l43kpg(~V%#%*caIt8OpZcTrzsy;(iX+GCe#p?3}b=5R}R>1_?@~8#L
z;&0I@9&6nn%M7$SKt3}tY++}1F^%hqMxlU6UJH$Qe(HG_0~XKolZ8|*i(+Y7u8>}5
znG;XQ_F(jVtv)2@GFMVCTy`;GdYn;*T#+547A~SAd-7O^0kqiu*$Y#bdNMNnS<!zW
z!A?|Nbgfn^VLxgRCz2lrLMnu_SdnX@SNl&HjXdaIB`m%gRZlOP(y`+MT1kpE%iyCd
z`wMyOUz>RLK#B%Qmu>A!)4}$OxkQ$FWy1J*vT>%Fkod$Vr$hQBtFa+FmcXe(Y!~gV
zZwz-qv$Goo=&6{tCQquqS^9{femH+<<$;z2o=lVGk(3DnW@s=?w}XgUz5v$R(cI#S
zfa5~0c_aQ~xtlZ2ZpHb2*%BEf+S%*mAcKY88~O9>aw9t<Zl|*nHi%~nPJr|WVY#5U
z0x2v>p`3<=yDvk*2y}NSK~nFT)2)5%X=(lt!w!7V^hhhhhx4h2l~ChRd%}OUn$Sod
zV|<sw!?q)%=LR^Qmm(u$o&gRVFKi$y>=|Up7b6<+h{gpjX0%z=<`BS@HE#%AAB)MS
z<6?5V`u`dcpEyr4JzXkNuQ6FHcG%#8m&hn#{6p$XzEiXN@u28#hmUsKj~>f&$H<u=
zj<=BNN-8Ve>*8M7=0QYo>LGtNs9$K|K5=$?MLg`*RyR&992TowL}W64EP6MKx|%iX
z@ix8{P-3W<mO1mjNE=JC-+{65M4DOsmm;`XrQ$wPKnP=~-goXSRA{G}13)PWk8PLX
zLn>?TepMepp=^q9iz@AO20L(C&7u%=h_htGh3zb*-&fEfN@8C?UMPR(H69uQ!B95n
z5*ba%iGg5Gy)@}Uhp$&y>zhy%nQ#qutDEL#iR;q=D1wniX>>k{7pM^l$VMw5*fW1M
z;^E?L0WzINzcbl0G=M^gx_6DT`LI&?yVk)Diuh>O2XfXPp%Ltx9!VDGa2ZK<%vha>
zA!fU}W%-k2mmZI?g~We|`y`!xJMTB}?^6^_d6H$vBT1fmmJX&_o*m7igM$~AlF#GV
zY}~zj7Y6Ow2@TU@qQj7YF+R#pPv>LcAMVkL$TB5yj*?~b$?-HECJuY36&(g07iZ$K
z4{Qa5%#E=Cuu^-RuU7|*PnW@i9@J*g)+z!R-e9!zipQkWy90m!6sh(w^$=H22b{7d
zyq82qXUiHLHSyA5dx55o1gND9y^@ZPrm@QsZ%8ei!sEIqyv`@d=oIktQyhTT-jz)}
z)|AJD)%|VWCxT68QWkcIgeG{Kq?R2TNE)D0B%Kq7Pq~(zRu5bp<RYK#qEQ!(%C*)>
zl;_>gqIbqshO~bi)UH-eM*)za&Cd8Nr9+MXuI)bFsrzMCttK~)!fjjtz2?kdiyk@y
zBz52!IUQmPq64X9Twz%a8LS*I@3iWDjx9A1i5#HVT&wIP^QXcwo?nSm6eUL_ETmkq
zPU+0yz1U}0_5`W^!b*_w+Wj?p&h_i)SUzoenz9=8FeiVUW*P5U-fg0qCVs|qfX@s@
zb7s47boku?BY=5D)lKFo?ef!IY{t#*S<XVRYge8FXk((<91^2ZESf+mle&8<IxW)I
zmV&n7v_rcB6F)S-hEaKzjNleJ{LByD+Lj3yK)YJ^RNnnp6#G3>m<{3`$BKjJ$4!es
zf*~m!Hot#Ceqr#f3~>b{opC;&I!G&pm(a2puFob{Uu{`^+7Fp1If0D8U3CX<k#lG{
z3j5*YaCd{%^&BvEQ$eC#W{~$a`Tzkg%}CX5IIFsW@RSwyNmJaLByx=f@RvtL697oT
zZ^1{=m-BBjOHOABpb{gcs0lM)G|49HDi?E`ls1186!1cx9N>n1?K68F-Q!Y7fVi2I
zt>bEG#W3tE90T%(g<K_-5Hw!;qDA=nR+FUINBcWF&kw$R@iN+by8US9+ZRtC@9fKf
ztJH7Rz5roBp1;9f9v~TI4AM^Xe4epYGiM8N;Zyv88!Nw`pK_@|+6pPlQOzW+Zx|A>
z1dr5UNPDS&50Ez>F&G+KEK$n^npCcj7`LqZG$6x|j@r@oXmS$MzfY6ncyK}L$`FZ<
zXQ>o|qs?b};oiQwrt^~wDSh-`I_+o(Gt_9nyfi1HdEO)vYwD!6H^2Pz)))7__{-fb
z+CLniAce6>h+z#Y2SIkVH5+Sce=1)R^k}IIWd(eHpozDlX7hoX8eAo3Wi;5l0%?8~
zGGM?To1BS1CaDW-WjutY@9cg^Jmu;m&Y~BjSY9pRT8)}3_2TA2bz8-(a}qt1ih+_h
zA}#dlk*n2-%HZ30ZHa7n1b^wS1P3h6h-e4#DzG|!L75D10Ebw77f5dyb&WW?EkFRF
z8~{FlpX<xJNs#DAT`Zocuh`nptZ*ixCYl5}wlwHFcf9^WR|GRj3g{Fz4u8Ss-L73&
zJv}yLY$6)(cU(s#i0vTx53&%7gbQS!3x$!2tODOpB5oR^GOwIog8ywx=eF;aK+wT}
zWH-}@iZFd#pD<<o3f8$`c}0H>Sd<{g6h)+e78K&sU{}FXr1hjEOB)V1O^8!uIu9Ez
z$f)YaWY4{!sC6|OgQ>saewGO-xK$Wea6Oa+yLE#HU<WImD%1EJ_*2f*GT{v8IQqx-
zv!{_3#<POxp%Kp)=F#%Ja`wshpTt5~q^<e0ll@<E{uPnGt|&Ajz-{UlZ7AUWojZ?z
zp6(J$e)ecDctd8+abGJL(i{S=y-{ONDfT14hb|$07&Yt-Ma<Anr!$BJw}JOU#W#x?
z*OumvE=%HP5@1_#66z@Jv$=*2@7a8S>Q%_iR3Oar#6(Fk5eQzSgP5g%$JtDG&c%2Z
zzu`Om<Rm^zp=a@V+&691L7Pggax77Qa+Zx48Co{ug_RoPfGjSlG)+bc5EfaDJ?FZ{
zqwLH|EhWj2tIIXDBx1_v`{Co1WbtXBI}hao>x?PM`m?0{-IsgMw*K*LzV}dUr(y)S
zftFc!MTgvn@dnQe_^h^+D{{;4IYt+%KOK%Qp9Q6hgjluS<2geWTE)0hx~>&}`Qum?
z)ITdmys%N^G#-Oj7AjOT;6BI4OGuGcw51mvJ|@C={4g-+uqwsnfJq8}J?wL(j6X@k
zr}66>m3>4HBYMU_=w~MlWgEUKg=f<&TWWZPp&&6jHyk-KbpA}bF-(Y0%{Zc7JzQEG
z3s~F|cY;rz@q<#>o2y2hremOgu+Yx7&#}s$W<P>d3-FXyup=4hHe9TwHsH{P*J`!u
zwpx=>%u){5l~@s2v(?qI6NRDx$%U(2NW0+Ro)wX6c<rVU1Xi*A;|yU9^k*|D*9PZp
zkEHT!%wAp%e_>iF9FgJ`J=FSaK`q0Z5cq9*oDWBRyeS{2mT88sB2xH&Dr6fZ_L5}o
z7NwsM+sh?>Q&yf!RZKEEc<9VBt)t~58uz9NFJVpuQhBJ42QOgixBkT;#hx3j8>*32
z8qcMbqd%D9eHcWsW^jS{Xmy5B54aw^uNFoOhf-}@Y3SgdS{7{D`4e)1D&_NW;Zs%!
zjeqV6DcQKY>39ji>}}V7T~nGjwRyc&mvYp={mD-PRhkLjZ5-CAWodEz3R)~j-$Gr3
zJ^dsRY$J=d3RV%5!>~huAX4WLvOs_%60?S<z)`_h%P@cDj~A=ghf{|u>C9W=D1F1L
z{X7$sLV+(z4J}S%l4>tOPyqtQEP%+S-ql3B9zt+YOsBiGq6A)lHzS7Wj~}e&d+t;%
zzPxIxdQCKF9!NbjTQt}P8rlOuVQQ=?g!w_u=H#Z_N@Ggww8n-xNzCdoMm3Rh(O)7`
z5FN@<^-pXms78?WhuQhK?)B`|UHvJ#T*G#uYyRWCsfy;#rY;C(TYSsL_4){F6S1)E
zLM8oPWx|)WK`eoPlT&*giE3iQnE9|L!PzM5m`+`hz-(@{BuA)1;);KUagmDl=aJ&r
zlOw@#)J~)lSBWsFz<rVU`~d&eZ0t&NW*3kjP9OtIt-c^whS^81MLy{oN5Z^ZF$)5Z
ztP?IV^%Dp4wCW+odve!Dj4j0w((=8_dBvZ#9JLhi;f4i&L7<@H^^V#c#8LlB%#=1q
zm_tNYuoq87?&)h;9-RGdIdQf!&RQYMf`j{wgt$zq*i%t=iDNdzD(lMNR4R`0ifg6g
zYm06!b$Uw!;CJZ0^vH(t;Tw6lrbrQ>M*~*aTM|kJ|9}$?nOe<M$x$4}bV=^VA=^fg
z5}^BNFuHAj7aS@aV$hQ?L&N5SZoyWOaXf)>PA+pT?l~6(@NtWd`xeI>EgwOp6wg@u
zZu{x0or6jg)ixW^2D9r85-Tk-Hrm*_yY)r$?k4^JX!CC8?%fT>%BXEoYfgh{M3=Pw
zTwC9}y6;WyyHby~529HuC60?~t0Woc7LZ7kanC4!1A&Yra$cJ<rrBsTp9GXa9DLOp
z1xn~J8H~hF?W1*PtN`U^pD@Zs<;yYs$+<and~_7QTE-!1z6HI?i6K3EF=P+Ff<x9O
z3MVqoAg*L`e2g0J7FN8H9#($j^@ye0zvyBSDwXY*FSj3k8*P-@ZD6s6qpuuQ$&xXV
z*6#3sQjRN3XTwoT-~43%#j8EU$)c@a+0R<hi}Lv(Jb}atyP@i8AVw6L3&7|<!oqHR
zG}Ap|lZZo71`++||M`Dky+`?`63k^SZF=MbK5sG9LOOF|kbB#h?fC-TCy7~qig2Wp
zOqs-|)s}BrSZ$+=z&rw#h7Qzx0B?VhoQ_g|(5a2vfom@5(2ZN;I59jGnECKPz}h?)
ziN`4o%Q=ySUn8)V3j!rHLSHh-5{blYsA+eqS_OpesQ9Ixxy)GENX(jJM~)R!h8K^Q
zhHX?U^X;0D_9>$Y9JgXlmcT4|7t@)RZ{sOel3{Mc?74g()VzNu9{E|~oE!;Y#CczT
zch&?JfRNrUqKUU9&=ev631Q6XX@cy^GlbM@>JSmdb@bq}N)1gy%0r+7)g55hI$B*l
z@v8oCa&zu*Q|N<rZR@ixGd_kznLdGav(`dH9$5FHfgHxdW273?h@V4eh$j;cZa;YR
zc#DK8=rI@dM&t&N`-)<4i#>nbez6~a{g|a=XPCfOYnW7@$P^A#$*v1nJ6jqiR>RiU
zH&?aK689RWMd(aPRYPy2wW>59ZlhgvI>AJ{tpCN}jlfQ{DynPm+r38gFwRdJ(WBcO
zJSYMi!iD_jY>!2j{W(6T9ZTo<tYz=nRhw>5NQ8|N4VaCYqf3gNH-^eP+DN~D?q`__
zo`>4Ex4dG&`ffJA)>~?1oe>8GG1B6~qG!=LPGL|iZyT)B42np{C~}CP7$4v7<Dyu#
zLCIh<d)rEJti;Gw*1J(4h0#Q;1vUC{o(_C9uRa3bnHF5}Rfs(oRtNVG+?vl&-9^J-
z6pN)Q>r&0YoTv@)gN62DKV?#XKse}bb>+ONCC>Xo#V}rgpYoZ&b-P`aBa8tqG}rg#
zMO57sK~B_C<y*`_a&aY#Z}T<>*ckcLJ8Ubo)pnTpk)tmT8V3>1xGqbCm}PeE9jH|W
zHG1?<>do0&{utC9VY@I^O>tK8IRYd_wi9Eu2KzTca|4|S?BF`!%&%a7f=d>ldtDSQ
z=}Lka>vr_fd8zU%*KN=3tgP{gI5p%@&M!-k$LyJ@TUAId<TVt%l6`d3WRm4rPDwZ?
z!A9p-oiW_pAZ<uIfqMTnzVAWHrn7Z%s>#}RN9*=+pgz}3)};tYIj~IVmR4`QR^XFl
zSe|zD0DDC4!v@^{m!SNAc6y4qR*Qjmfv&7?SN*e9LHrGs*TdW`x$m?PO7F7Fc+O!x
zX{ZN679PGwPZoKe4N?#Li%OXZV!_o3j^N%Ta^*#W;x)1=Lt1`l&wwX75c+{d%_Nk%
z)+RWi)1ncb%uizpf?|!v5UBOb4y@d`uTAB5D*H<Xt0qPuYaZ}_nBAj@)SuZ*{27VF
z8EB;}mWQ#(y&#dZ#lzi;8A(aSK6yLfXUFM3=LsaGF#`P!(_S}p?$^N{Ac5K&I~I4w
z7hMvK6R~#$*z$$2#n@pEYoD-_i_XZs8wXXxam-AL!+PV0%_&i>WOTWq-Q~7ksn=z0
z9(xWTQ*<7t8Yqr`_*kM}r4ompO_$?Q-x!iwV(X_Ii>!wv4iWZC2K3_O5y<P%aO5kV
z>b^qY#!)cAa##5vG?F`aI?=Xfj0gF?4OeS<@nl(23c2A6%`diJR%4zX*zwf`mb~Rl
zJ-^VXtBu%22|w>1vBGJFoTzN|vVTV6b<nO@=!9jFnBx?G#T&^nkaXD0td#3ynsV%)
zo@%}-Sx~Rs-u*>a;&N6Ujr=ySqaXxgC{?1l&X=B9aC`5=1#p^Ni^biZN@L9ClLF1%
zc4XC@r>cxtIr-~#Z9)l#&$-KCRRundTnR>Rj7MIV#%H2MZO@K*mNYql4b#jCdv?&+
z(IiL^bVOKx>Rz#sX%OA3f)tZ5E2|AP^}_Z8$Ac(DK`~(H!6fDx*oz3dx-XohA-qnx
z4TK<=gUrLojZ;>$7e*eQmBM~!7ZWuR07tD*32WsETRd93m`OQak;!#BVs#-M!<s+>
z0FvFB&O6+d94_m@wW>&MFjtF)UD}bm?VJ_z%8oXFw_ZEZybTW22FvN%Rn{at?OJDC
zAkT#n#?A<5h<JI$6MQ##NIs-Wi^#?`&U5l|P8*^4*tk04Ryt0rTz(f)p%4AFLo<*Q
z#S}8){Fdl{^aQQ-fAm-hV3O!3L>>wC<)BakVyJKqYjKv{d>qC7`6!#`-5=BOk8yXF
zoFXBAD3Sa_eorTgz>Od+xZABCw=nVmmBG!8k)l^J#lp&T+&v>{5+mU{T*P8XSjX91
z%y&dYF$zccB6+xf9FO8R7ahZS8VO24Zcw{TK5RSKc#`JQ61Fi~dH?M692kR9By}yM
zqh|EuX_7<IU?R1rb_ORI-RC9jM4MY*w(in@|J$rY0ZK_nl(Gu)G^aYQ(~GXyuxyxd
zC)(0K`<ij97|ori`YmddRRQ_QP&Tq;GJw4)yhFpJKR+hso9BoKXY?>!vCdEPW9y|6
zy?tAn<ah66+HX~Ze!pjxm<F6OvAgl|5iPh;&<ONhO4zeZzZLVL3o^N|Q7CXejRXaM
z&|HT<QJ1V;MDN}iyfJAg)GmCFr3_CcDhm}UI6}`1EUcI2j4h!MPg?CcF|sdnG%Yj1
z3O|B)Q;j`fD;r4(MyOUFnn)HtyMAJU&zK79^xW4mFK;uJU=&+24=_R%P9wLf>0)SP
z-o8YuGs&j%ePUxdkB&1Zm<jObk?Kr;*0*7GxJ_8&?bc*`rO@DGYAvx&#2Jx{XODcC
zPAHR?2Iu0?^9E3wmWKzFgmDPZGE5$I;V%Y3f~Ct<ZxP#_V~-dE6bgX;*;2U7TR0T0
zLNW?_m<AFJFK967z;stvHq~a`GL3J_t)gh0Ak9sqG{P2gMez5gNV%LTLlbs?Pzm9`
zgZ_j=l<o>}HC+VxbmM7ZDD*RyV^Tw|?CC<!3L>&6OBnqF<vY2ikmk?QH5T;SehNsM
z*W;T(XQ;PeMX;ZU;3pgc$ZIUPFB!Zo=F2{W3ub$7S7B6`3dAH721VxQF$>{oCMLmr
zk_=pqHltcKSwza^ZziU8ouf~G6m<q07w{jhka$~3t^mLxjH8b-ZU`;)NF?Gt@L~Na
ze+SIL9LPC$e&6raV&{-WZ0DKIk-N|Zflja>DnT&x@H}n{^e;5cFphfKxYLUm5<n_X
zt3kPAB2<w=iOtITE~U-L-rtEfzKQceI+le#kQyPhAHRpgc!P;UVn`)_8QMdUIr(HI
zpSb75Dp5{ld5UI0S&ZU#Pn1x26BlW#vuZ=isUnh0@WEzP_5z-iA}C0f69H_2yVLf9
zUWxV%6-ah~we<A=YRue?gMu<zn4+Z2XbQrZ?Lf@~SjJwnDO?#}L2Ek_Jxz}mE?i?X
zlf0RjcQPKpna_4v4P&-{JXbbB1%e|spL;JblEWK^?#{{u-0HeEynw`nrwieo@I_4l
zxHBC>aT-ebK=!Q+=5(^TfEtV13CvDbKQo+#fYXb)wC}<olMC6lDa~*^Md2TTrw(lt
z%jQ&Hvmghk>S``E=KB&P?rZ$6-d;90OX<ySDoTg8G#NX1`h97CH|)zbVDc4`?Ab-Z
zdbHQ|e3h}8^Yn5&B1<kY6w}N+t^9o39&JThqimQ-<f%zUsYXn`+O-l-oStteC=OXm
zAe!S`<6*&JWe@?^WU)uCYIv`>2kED$WY6BebGyn&ilqfGaeO0-b^XL%qoqRWwj{HH
zs)84|&Kf4G#B`f~l<bjX%jyRXxv3bOj{^K7fqI$w5|9R4<VTAfDcMW`j_1BqND-(=
zwka%#Y4e;RSq*|@8a!bRdX|5@15fO{=3znBf<teB!40CaDz4P6Wgd!rF0pCwv6DK8
zU^@%L|0Zy1cmsz+#~GZYiNdZMv>Mke<ze&jGEPk7W3>i<@O(%xqPe+HP&XCLIomrs
z(Ii89Mv;=+Y&py8>cCS39}Pkdw1=Rq8hbl5vNj|FnZw{<ftIJ*7VWshR;%?x<u|M!
z$)@*Pf`}m<M*P?*(2WAaf$nUcD+mxHJ#K+}%A5HpPDixOiAy(B>^|Xq7O-qAhvotp
zW&+1~q%Goq3@*EvD|sP!ZzI>#uVAl9AluS8>1l>83Fj?C9&lz9bs4ERG|u~JNO;PO
zc%ZgF*dfW9JzLY%Bi2(Jl5@~Sq30-SrcuEbqrqM0T*23%kphcQpaq6DvXo^vFaf89
zIB`Y~w}9GiYV;Cy*e7qxS?HN8o@)qT6T68WR)Pe7-ve<w`e4!RHh0!!_-;^B)3vTE
z+TD4YCvLv|@OuG81qQVvhNik055k;xl?{F3`@B!2vCVA-wp=}`1qnPjnh>rf>2tl}
zx_Wj#$tHAWd9*9WBhyH*G63qr$GDMl1g^h4PX)kQe|uq3k007f8#CcQ0Vh-iwBXOc
zG|4@G?aO13vAHucg(#S`tnmDWHn|YDpLm27coU$#u>jrZm<$C>pD7&QOan+7LV(BB
z1RTmItEl)S85jI|P}T&AiN|ERxS!end=`2D=>t4$=S(AsvGt2iA@(CWq7?GTPqeIy
z`&OhwEt%(Oa+=v;rZ~Lu$O08Am50u$)F_RA)yxulC>1HN!Jm>I8RCpRB$+U?%no>O
zGz!XkCavREV7E9+gdf$tXcsIW*Xwj7X7Ax6AT-=xj~xxV`r7VtYrLG0Cyd<#mTK66
zUc_kVM;8I-93EQ0US$awpwCr+p>ro4&t)|(*iHcphn(>OvchguKPL^*8h9;YGZTq_
z&X8#Z?b4CZvs0rLqRc&JBb~6EX_5r%QaTV8Uf^u**VrdWi&{FPxB<Gku3zLMEu5nL
zF7bwx5;4q%883I8uv}vM;glmyFLS0iXv=_gX>NwFTlH^>pet@<*cass`TSQF9u9&H
zwV^j;!Nhl&4@V}bx}&}~ceko#NJ^f6hwHk0HpS<2)5o^n@3DLGm@(grr8;?_7ebRC
zvH0W38X5%i<-oIctr@&xkcgm&$4E0P`NK-$Ex(xcx<V*@z`4O$!8#;=+jz&RBCC4J
zqq9-NE>ta%ERL9w3NgNjG3IgS@TlOC`=NH58BG()qkHpZl2B~k0+X^yGtwh}8F9~}
zAx_^T04f#_1eJvaK)CR>s5m4NE@pz{gR*Y)MH7V^h-cE}f?HR-Y3!C~*8@w2T0vU#
zqhQ+cZpP3!5V}&*-2BRM5rvg|Lr#-92^;bzVbc668y|Yum>I}tHVw{e(3wJ?!7iI5
zlTvjvNk$7LnnsA}bQlP}<z@VT=+dvv#9U7R6(Gd~D9FKPXcEbdBRT=u!v5N&-dfQ@
z)G%dSw4hc5JMic6?D8H|uy#w~;?m@eqJ^jD-;^zTm6jRdZ>KY2)yl{h%aBloWpPA3
zi|*pdb0k`#P7Q8yI<HNh0;-F9&oyyRi4g;FHArQZ01*?d#NHrSVAh_07~}j@R?Qfc
ze;scoTXbwr2xDQvoZHyoW*LIx1a>p6MPIU4nPnw*YM&IIv2a&sl;HR=vDP*U#&!Rs
z(9?3tS!S=y^ONrD<f2S0>99M^W0mtX*e$4&j-PH+<v51G91)me>4nIRKev=h`*@B3
z^}rFL{_rP;-jIe!wca9sFwCTS&cU~+{gB&)8#@FE&^=bE^Eod%&}7uYRv-&%CX;!}
zY1?+Nc&8S0l5_%Tdb6%(A`U>5R~uB*9U1f;H!tETy>rJGR!Jq66K4PMP=VRN81LL^
zloS~m3bqLv!zL#342)RK=EI#QyU(K+dpplDhQ0mW@3vp=M1R|V`3K*vJp1<e(e~eW
zc6R^%`1{e{+WW7!PCono$=@Em+0VBQ&L^X9zI%Ca@y~32{_^jC+x?H}zqg-m4MzXm
z{@cUj<A0vK{_#a+@9)nZKK$aFo$b53+Yfi9&(5A~eG_l~_~Vl=AOE=X_xbt$lSey`
z$KU;Zu=(U}+JDu5{&sis;g7F(FOEJN{wY7H{AKgW$@$+NpMCqJzZdWP{hRNTmk<B`
zr@!_8asJ~hJAHa|`oBFB>l+Vu=lSE+pCSafRTlttH3t@bxq%d_K6%-yx;!m;l;<Do
zG!$Cy!N1svHtv3L_wELp(#z8>r&%!fAF!Lk%i)XV^X}Duamtl6Mmb~Y;s%^f#wcX;
zL?rCKfaX9GSvllbCoU2OKgJIgQwDJ9zPsrzW3=~w%udG9ZRW_BDqM37Fy6^DJ%dz7
z<L+WG_w^(6nInhN!_r#FaBXAgnR$eobFD((P{p!w7eNd6H<}r{CkL}{X^ekME*=4a
zfp*9JakjyKFN37;nl>N@<#5lyA~bg~ZL_m1by0G%V9~b62_9V(5#GhAm(R={Jm$#(
zB%}uGYKmrRX(PgRVLEnzi%$E)^gEsEaS+G^wpq5MXGdU<BA`J&(|Q+^c<>s*<WXRL
zf5I_P(IX%J#G;ThMlLZ4aQK8DfOEoy7kl2=5vIC-N%$Z335u~Y_zz88?o_nXOXV29
zJAS!Ht|;Ol?Q&1YNiv0b_IQ5LifLX?E{XbbH49V(6M>WuQB+tk1A;=Qi92Y=4)_o$
zmq-VY3}=iLHqtPO8A|94Eqf<$4zufImJCkD*(f`{0J$+5b37JM(?g|-a4wf6|7?EV
z4VwUeCPY581PQO*IY`~pB<3Y_DR{n0Zfb}T!vMO*DDo_~Kbw%ME05;WDWl{Tg8(^E
z!Xhj19(&&9P%=ETO>a-Vfipkh=)D(Iy7C@!k|QVLO9-jS%rn!(O?%*cdtyr8u&_B_
z%x5f+5vdE27Vbm20e!Kp*u6=IqfnlKJ}J<DW9k=?+y}TOG#>yu?SP~X%UF%=W9Ug|
z7i29<Ts%u&j7MiV-N}G~%Jm^7ZeQotV&-DOrFGb2*&r|Ev+3V$NZa|W9ZX`E6X*(8
zbT$DscQQL2-PYetGwL;i#!X17&A6#JRlF-$hpIcM@i4MEU>PO0;5KqP`_mFUv}}5R
zOw=nGp}}BV)Fkk*+b;#*LRN4(b{>{Q3XAZVP_H-brz3!+>mF{X8+(%FE-291!Tg%5
z|8*qTUNdjA*G(Tp>lVe$lxsD4`W|XHGxGs9eFeh1GpWej%%>y%x_|Ri(%}FxAMtEY
z_$g5_q}8@to63(*PgA-c-}@{ce0CInOOaSc80|2g1}9%iE+@#5&TYIu)P#dUEm^D5
zz*wHT&hS(%b;Urvu`t#_2UU8gy?4J9?Ea#$aC2EJjJTn0XpZ#KyCjmII332PuLTk&
z(j>*XIu4+u6}XYJYx_A7zL@hJ8h_x>i0x%Q`i1?jvrKTPnHw;Ki4vm=X)tYnWNxL=
z)7(olY(Ig!YN+tkZpgy_N@^w(E4%(#vg65H6pgUX)&jB?>s@))DbOT@I7zsgsoh&;
zV7bA<<9iUV$($=F1TJ)!niVjPz^bhb@jG~K+yt=BCsrC4*F=nddNG+vWU%qkGjaGV
z_%UMs2Q`D08{knEjEaUbt+HT$K6Mb2la{OlHgfp@5LM>con0`C7wmGX5Gz@_Xku4E
z@~9}51{{PxscUa{x{68T#oKBSl3BwniP+-YINaKQ3Y#Z*s-xY<E=n6HYLKNE5Q`&n
z)u$pn&n8wwab(=qqZVqDjg>ov=ajR0-^W<HFcYbAEiPfd`ET}SR&j8D^lbXOTZ?zM
z{M~ztckf-Q9{T3lv@5SK(f5kMT%)J0t9shHZcq2F>gk@}ZI&qIOH1rww=D6!AzZJR
zbJ){odXj}+;<!fP!SV&Z82XU2GyeAoD0rxo#lK*N%jPufd-D5eG>5XOY5=z$B$k$!
z%TlI%2%aaz!KaWHI=6;@{mqtIoxr2CBDf0`297POH<h1Ir-W4XpH_Ww^b@sdHk*<D
zmwxrm&U#TB|G0nYkJ=`7#256lm)Fr>6BlVXeK=Dt>iVet?nM05Pohi2x!7!_k<Q51
z>3H^_$6Yn~QcrHXDGD3tMQswynstCHO}nCR31-s2XOJ|5i)g8T6a2N-=C)VzWuT*o
zF*ueplx>TwjpLJ9IqPXliKhlouP<5_mtBk+#`pFuuCRyv-Mb#*mSPT%(*O&Vp7qsi
z3Wyna3G=Xu;`BQZ$t4f6)qo?oiV>v2-6bK~fvsSqz)Xyd?9&8=fwD=_37fT@ouEAW
z&W?q>(|(&;YzeG?({eSiFj$=(lFtDWJj(ipK51cv=5_P_Gr+<60zA=<xc-7dJgQxp
z0IP6CGb<iwqZT)yOU9OLnOJNW(_%z`R#oG}UAVtDnus~Z>OLhF$nUa>;{xV}V)hLK
zzkZtg&>^*`2L9|<yD~xt2AF6)6VuTQyMRw<xVcV}(L`N;)A&<lPoD!5d|0be7V^Ds
zvNXa{EogVb7hv$pZrLE@&I#6_xdjiA-7G~EznBJg36fe_4GOW%dCuHNO0j8Am0@g>
z%GWI+i}TP!D+yUH<f`Z;4mx4vT`ouFLzP`K7(%fq(+e&9LT?LSrU70mPiT^FJ{c*3
z-+88}xvq|X$t0UVP8l=)ip_ziGAGBgy;cCrXS7C!l`9{`ejn96r2erf_Q0=VyllvL
zNQ93ANcT||i>zJTDk@8!Yf&vN;Kpn>^uOdz+zaN1KC-yGRYhVIBcN!la*EhHE!pG%
zdYs@_NSgMAVTglj#35apPlA9vb*jZ$Dg=9Jrloa%#I9vvH!hV(DcZh2$jCDrK5sS9
zq?pHm#Ez%1>`rwKktZz<H4F{0P35IcK4%mhPT%Be02PvgX*mDXI&fO)z-CW!+}P<;
zh&CxHTfz&M`PO|iAu?#C7oJbhY2{R|kFnDuuN8Q%s_Iq{CF?|gL$jHWHF8AcdI<uS
zHL@IkC*Fq6t|{r6oWp4o&mSV8_U545^&Soj097Lj>++R7E)ZZ$J)RYFzgY#SF(eS8
zih=i~?3)qO)XQ4xRJO>^Ihz24=1Gh~D(adYs1sgo50f*F`EvGWCK8T$EV{cxF3Fa^
zT{cWfmHX9kZuBm*KOr`{iKs+hzcvhqOgX=QLj5<(1#rJ?W(<r%8z0A4FJH*rMJAP>
zz>8zpl)Z9Cy$0`^o*Ejv;r*cYF>CVyN*^~?{6;Q7$YO*--*_vr1S4aJ4B5TRGzSy)
zFGeP-zR}Z#ZaK+W0<T*(W2I}cTns+Ez2qT=QsQY^ylXKHAUWgH!NPhxL`QmRKxeyu
zwJk?e9VX>Qfl)hbN<Ssa_cWfta8ATC<^yo5{zEk`pd^F311BtPm^lqT53%37K^Gif
zEqVVH+NRWng<Q<uoTGG>`xJ;HuE#~o0HAZ*7q1-u!{lt_ku$d+9eWob4*Z~Y(Xwc&
zSs`_uzd4FeGeAmiKR?)g_;jcH=*9DYZ+4&bJU_;(9V4Vw|3BKT;Ptuy?PNA^hX3$(
z!^L9)P7!8)zpIK19B8$+)sb2fyjq;U$c@qx7`n$jrckf=YSziZ3fqjk&unOs`*Bhk
z4iTKj$Ky;2sV3fM)aB1*oe7UM7h>BiN|2Q;j;#?VQn(IUocb4H0Kv#R1)|}9?JrPj
zFbujSQPH?e4YFNhjkL<kbGMOupq`pAM$8G9nzTc8GMXPVCMH~!0P3Vad(dCm_dif~
zJQgiK@zK0mO&YL6qYH(1z0lyCOucI!^6P~afhd+0@S3Ws-yEhY`<@|EVV{jv8qFpR
zkB$&%%r1eD5&K>yrxUFse403a8fDl}H+SE@c(wyJX}_Poc(nbr`*P>mUU+qX=h=&w
zJ94?Mm5Y=(lgSCO%qi)Qg^d85DzS&U&%EM%jcSLzq74=!FjHmkhuUr1gnX@Dmq^K3
z%$r{Tf+UCTO!JkQNeg9TI9%8xm;~9W<>NDt0w%uX?BuGL!cM*DA+~sb!D?ex6M7Hj
za`^SkNM&HW|4YFN<}nX|I-=TH8n58vI1ZN`qCKm3$mPmT_?+;_Iy5z0rULtPbe3qL
zFRUSgcXK2$xTwNmmI$c7xO}yb1-TMjQ`l&M8x>+zJsVV(C#8Ra<%@HbNLtZT2+had
zZOuGL7?gH2YFLsCe|N5bl0xpnGsFz`c=uo%bo~6_-?w+4-e&>I&aKCqX2Q4wE;W@6
zZjRft909Kt{#qv2nj}%+!rWudIw4@yOSU)$);|&KI`52u@o$#SpbPmU#$oFP*a==}
z<H>>NW#p?Xm1Q|qsM)lm7C>kHvxW`zdGg8bdE!!o;72+Ss{TNKpxLn>U7aJG57m{5
zL^aeT=xO4Ect+C(%%=-0CA;ZP;w2W!!W);uNKmg!uWO&H?3&Ev<w8RdOoT${ZKDKs
zH?z|U!I|4ESbnjt@Ug9gG)*|QH}2Dpr51903Ej0?h-W$$+K^IyXY7Q{2l2$@vS7ms
z$Q!FN$PpBj@#v3#jQhbzR8KkVcV@|J)*>w2$`u^WX}gL?R&x+gyWS=HRU9g+AiWFD
zG#x*WW>b={{}lDuyxL>5L=I)U2#fl1WgiVsCej7_$c*Q50yU&ytzr}6=T+UIBi|X`
zt5m+RZDpXR3N*T;n_1lV=1?)s0{VaXo>Ue}vz3N?&h27<2h)idjOb`S)?&>zMLw^?
zoX~-B78stWe1Y}Fxg{y;E+qIokt7SBg#5^jRuOnEdL8MM2;ew*gVV*T7h_p_d*YVp
zIU$j~@sfL_wV=;ZEy&FqRFnT9@}L6H7_}vckD}yzJea|O6!rf1!|mq(7B~NOxA~VJ
z{`6^&SUN9%qa?0ydXw%B4$^bEnhq@r(P2>^iN-Vw#Ng@K*XdAJ)yieEVI065*mlk;
zE@AA$6q~Tm?3BUw<5Oj}YH{KgDJ=z#zFg67Fo_Hkc`aCGG3#@oQx8cX*^|iT)$m!y
zq>RPQ;D#65piBll;(9cyR^-OZxtM4nCQGi5-B*Zz$yobxm7q=3Fo%Gth#c$5j^y+5
z9Inn7xx9WYCkTI|rD+*n(gobztjqIw(3IJ2ZVIOG@?IHVm@RNKmRI7LRM{dna|=jf
zu#qGB;8x_h$4HqPW1%QGYatm~Y<ihi*EVjaHP2Um$KCF58XwI#7DM7s!oWi@c2`1U
zx2?y2KP0Bvif$-;Hy}h1A0{!ylCqY>(^1Ow<nzQrNb^HiU2*knf7aDT1sJp2GMJ{n
zR}XXjnbs;H2D3I4!zl2EL1>0JEHNY;NJL}(M&xRL9vHY2)9wi!AE@k66*IP`%}Yu<
zd|Ehg8d&)A1k56@FfETV;_A`1Lk!U}F$hV2<1mTPdB=-KZ&;lN^?CP{zL|&(N{6hV
z)I9B?+i)2f{T1tI71&D&qTct%Sn&Z-xdY(Q)7@p^tM|IZhr?GnKo1n;<z&)FlCax+
z3d{Yj19*p)s&K7HoWZ#*H5(kaxCnx)IXDOK^&GsF=C4Co>FAsJ6nskJ6UBgUX9-Gw
zxjHT?PMA{RzW1)(=e)AT(tXW<Z;Q7bF7>8F^){z;v^9^jdP5*+BwWoeJp4R73&MB}
zv%{h09f{-+PvKo=#|gKVc6zkX{sNRWNsE6~%bL|ehx~j>LMAYC%<|-p;l3am@;OCf
zHVI5TpIpnMfKRI_K%C+;P2y3L;r4ic#&HO;`pyv~9>YpY_%Ni-2jE%3FQ2)10qDh#
zw5&3d?gvAjF}A-#70V|tV9775mq0Ud3WGdyab-~DD)84Yl+cI{!@Agom~r|^{2JA=
z6*M`-_@C0LUnl?`zN}C%zVyMy2@a(Ka&YK|U7V)*fQHL$y4kpUGVi;7f?e-_V*D9T
z`g)bLk%~KJ<%%?j08rk8G)SU|Flab(NjS}>PLJe@TrArK+X(6pwg$|w;`mfY>G$4I
z8XiI^jav$SseB@k&NMF^SSrp-I!Jurr~ohll6~wB#jr;y_638EWz<QnHxyq`?{^#k
zfq3^(&>#qNl^3JX5XNKXLdFY!p~K3Cmun@MSVeijye|>w8Er`bLZf0ih=BJ8!o7H~
zdG|X_f*ugITdWtt&_yH_vwMrpz*7XMyxI++^#Isz)$FfX;bYgwd)Ump+HEi_jRXbo
zUx(*O{{%YuYGn4VH7Q^n(t-u^w7A+q%^VcfiQ3T~>I5I0;CydK&*wjXPYInqy$i_A
z*LY{4oKAFudOF}wQYa|so@U_r{DyUN*7b6J!FoBbAaL*g0`+q0>xwsOhrV{joBU*T
zof~@JL#`Psx%RSiEc}I!6gv}$Ufteo^VZC<HQUeULJ&s1V%lU*aXaEB?Cg<0@9Xsi
zym!{p{^Nf2)7`3=NEDxcnake9w3^uH|G}++ETsm*`E*2&yxr_H3kbRIs+EeAiDNP2
z{-?D8l1!R;)XXA;O0>sF7i*qJ)jzxiQ{-mvs?n#^jFe##+7Az-PlGO^`}d=*JJAn6
zL_hts?A|@x`-+t@9QCBZL{+w6?LU=Ml-M_p^IO#lfb^ENfm6VLwQE%?M;gpQ|CzYi
zuJCNsFwW>cP*Q@gh8kZSS5(^_pJlI;=J!c|AGsv7wVJP{DSv0wd`A2r8%9r(S-o|@
z&pl$(4}E^E&{2~^ZmL^%sx*PqXxY7ccdGU1Et_yTnZ1d;+m&<hPT&MDZC{>`cYZop
zcd5|Fi~aAAy5T&35TT02iK+a+uR>V$TdnNy+=cj|nxy5!mx@}ZN9+y3w6Q0Lp9Q^e
z$R{R|uUxv^QS^>DIZU~4mp3kdCp}=_dg&PobB90jf~@u9X#zW|l!z4J)cJ52qQY5i
zzr9wabm5zK?u3zqoYt$6fIi58BPo#Qt02CNCI|<^;WK4_$JZ;kV$8eVT36IsSJYZp
z)LK{6T36IsSJWz2)C$Uyh&xS+pl1RKrjNrrlufzkfV6Yr0O+*I5k+avwrG8b1oC8b
zByHGMBaIFV1*AV@?}6<VP%<jkc8Q16sRl?zbLVfdyo`A~jEPnbyjMihlho(TuZEpM
zr%YW5;y4$7c6rF=oxtoy>n*0`SyQ`dHr2OX7t0hotafDbV5@+Jz$HNV5`ZdCZ~(VR
z@t)KrQRyKY61L%x;OGg&^5I&~;{`fPaCx0IV}`rvXDMx60s2yh=uAL;MlNIZmr+Gd
z^J98svsxJ*jb>0vww5R*x4pkzu<Mk2&W2na#8N$fJWhK>#6_;j6n#qXs5;3|Y$U}>
zI8uYWY(Vq(CALQ#&;R4o%?ABv3;(&-LNP8Lt8Z*^6b^wP2+J366V4FqM7`CY+*42f
z!Y9-B66H160Uz}izOvU?HXE+2JX=r$+ke6HD6n9vJ2OMQriJ5>So3wv)E?iPr&QqY
z6`d`AFj|%A+uykXl?UBjht?N0#b^03F>oQ$!ykV5^f@w3=*r%Kgf+ZiZ_y8*(!Y)9
z)5o-ui~18aPsh~ed7tjx!xoNqIe(@3EQ3WVdUhdyybpzo`uBqA!O_68kkb7eT#w%Q
z%R@1WWf`1{B6W+hQV5-FRkq7?Z~MEal^ZyJTy55C_mK5K|Ih~kYKH!x{c#$P=r4)H
zM$6*t_M)0H5gsE9OLVIC5bA>y77rkpNvt%2QtWDUu~Vp3xzY9vAmjzOFY0}24@yKB
zE%ELwFV+>h?q*%NV87o@`+SZ{C~V2lV~Fi#!H%URdOq*@;K*X&kzscD)lnCGP`k!|
z$8S|a$r|fR`jshm+|{tW*sbMu4^-@HM8g$(cHFm$U)Z$~Y#^U7qy1DDtp-+GUt(E-
zf=4?RN^CNnRWLuoQ*KAwjBd{x1ByOhEf`{=Xq<Ijy(o>_bFk4E=ks)s5s5_)Nyg~M
zuhXjBCVc`aP56}0w&W5vNH;s`_S5Nq?BuVV$Tm#F%9NqF1?n5oGjFT%XI|xa#=&S#
zJhb{wnvOc0#`Cod=K(c8tY%Z1qbe@vx2iuh6rlj_UV0P%A=d=ir~4Ykb>QuzyV$JM
z2V!3vYFmO$>1CqjI&K#{En}IyR({e(fMi>RC&oXjeDaA*GA#yt5BKr$^@^5%d&6wl
zVtvnEZOJ!1k2$1eG~f!a3Xm!g%(YK3&Gl-~LzQdmfm_nNU(nlIt!l(?`;?|I`g9b&
zZKma)c-E4cVT9ZdjAs$7U(Pum9kulg%iGeJ8x@USQMB<qv%W48PK{r9F1ocLkA7AB
z{+A&vC_VT;dJB*Kk6s5ROa5Dbzx{S}lwbgy-})wq=XamRF+%sFPm}Rk>-%TjR|h-$
z&$plLRJ?_7l1>uvL478Veo}osM=;=nX!CU+cnLTN#T6`!_$QnAQQo1MPRBu)9ET|;
zA%~m{gOP7R%NbJ>91;yqd~8Gqe}9?+5P9d#AkjjT91MXYRataDd(+Z?K6W7)ByrC4
z(4X2H3{o`sE_{t(;By6*v0`DuUyCRDjE>C45ctft_jWsO^2YNn>1@e3$Ch>`Q6u|!
zlC}cSCiY#lbsyNjG);I!d#Px>Dn2*fN|JR)sTp(3N!Q3^$m!(7%5|bo#aQD<LYMrH
zcQzYbzL-<^QX~<_Q#OQuV*dVmjm=teipr+7z~n%@nIfqwXDyVj@mXQGY=Zp7#x*28
z&7fa6C??K3q_vp8aq;%7g~2_GSVFzH5c=?CS6g(oMHrW&?An<ZTwssti(K_$%t;Hk
z3dlTZVY2uud})i=0w@o&qob5DnO8u>U3VhuzpKz`4^0t|j}tL}o5{Giv|hqM41Ck%
zFg_H6mlxuUH8M=%i0$k)6xtr>-j|;7_E)aF!ZuSWCCKp6$hL@G=El(KuC%=RTaf<L
zWwsyyzN<PxfFHV!%(&Vq6J6tJ2qn=wL+xKjrmrK@3z6x!4!1SR!kaNe1Cv{<B{rsY
z^zu4-`Im}bzJ<PjBazcJLIUJTPc9JVFCXa4f?m2L(3#^~L=!IS{UV3SB9?cB){{_Q
zyA~IWwBm0pwFFha*5v1g8W0S+LGPhhL!tVj=qX-WDfr^Wiq@P@%vs7Opx9+y459XI
zJc670P!*GhG(wRCVX*|cuVpcrr@qL&ZAA0jJf=EsV>Ho!<81KSqrU(L4u&h{Zs2!;
zpKmId-_DT0@T0`u-$aU3R>)w@7(bb#a&Y{ZfrRUjI`BAia|alnGud#g1#=-Am#Zi~
z`YD4H5v!laqo8QK1CTW9gvAXYo_JXLM(3M^ZpqWFk9lJ3-Hviv15!?+uh}*K0INLC
zX0fZ!uGr3hym<qpl^?UdxPYT^{-cz@;eHylNC|CKQsn698D}>0IsRc#b-B<?$4$FM
zeGa(lp@>I*)iQ}0KLsZRzC7dESGEzM=eQipt1kUDrcXk``q!>x7Kc;?1u5lATy0eD
zn?c<qxUBCtm4locMm->$3dUP6EP>10$Brh8zIU^KE1=)7AB73@x(7m_XW9jTvSF4P
z)h@?jqs@AB6!`S(>oERx82>tqe;vlZ4&(n>!}uTF{&_<72iRN_IOa-k_@Ds&!$-IM
z)?=eu>okRlD<gpzCck9doaZ#i**LK=v}e>)GdpVPPY^Lg`+7Nk0DZgY0ck7&d<X9R
zk8UG>gm0Y<@ZUZgpraJyOOcSY%cabvC@wHqq1MFFoja3xpS1ZqceH9{^bA7&sRTi*
z=t<J}2tr1!Tn$$)Ll!5lHcDu<XX{LahWe<lory5WS7#yw>PJ!Y6R^)5+wk(@HD7cE
zRkJ|<3R$WUzEF@9dUKTar}0#48nJxhs3?qo#(>{G*YDKsqxl3TJ*fj49Bq7H6ozih
zAF}UANx1+#gunzrnVrPvFkgiE#y}9ld2XS^I*RA>C&|p$chdc5<s=$X{2{0?sEUG_
zYqGN6U8}YlZfHrr(8qEkox<?{3&oPRWsHUMW*soT4j5ktjIRU6*8$_}fbn&}_|F%A
zFuqdZE40xwIEbiybo=^|wATus9pshU)2KS0bDf%RaY~XtLkxbawfR|Vvs$T$wc+4`
z#FNvn3cp%U)A2v;l6&;4N<~x$nc<4WLy0D0ddOoM(o4XULLsSHsIC-J{2n1M4fD2~
zORQUUAQ65DGCCoGd(Pg~mnYLC2MQv8wfOvQonK_(R}pNQIURp3j@|_LO-%yJ8WLG{
zt6JBvs}+s^!9bfxJRVCNj`)j5^Qr25SlCXX7xyLO<Q(6z&5^D5gAZ%bi%8e5QG-K-
z0`T{}tG8Ze+_o0>2CE!|r`j0`QbXhkyREx+{*#w~$){CnlehM4<hA-cjM^T5c<0}U
z7fp%8X@}kCu*ZG=Q43mQ1*FMyi?o!Vt>^TWwarGfd3W>jnf<gX-Kvkg6TJ;Pe79sq
zCBsuPT?;RNu#_798dblg%i8~~YSf9UPn}QxR@Hxv>-SGYV^J+0AfPfZ8qQpwE)$|2
zJihpC)?qMXQM>JS2TPJ%Idxorm~^{H--ms1K!3KNXgo{Dq@m=szuc{Vb?J=0)DCDe
zt*@57RM)$*Y&<?pK@NgpURY@tO}n{u@A3gWx3!c<h@hF?m%Q82Vd;Ik)Ziv_RF9<<
z0Vr}(T`_d7<Y!gU21#K)`QClUXIigj13E-o+r!~w()?=8dsj>+9;9!7K{w@Tw8u1Z
z4^8A^n8fU32uyylGA?4IDY;vHm6(1p45xxJSr?3%%%|;CFrCG(B+5A#$~X}$XfEBD
z1a_Am7;KM~q?ZeM1nk_!X`*MVfRk>vB9XJ?;6tqKhnryhc};KFvNzCCj#4bc50ew1
z86b4x99D&}va(9qEMNwIhIJw;Ms!9*w|C73Q$o||qzzT-5R@W^KbP@A$N^WGr6!Cq
z3*!<DE&x16dOP9}VrMYA;J(4BxXdJ+I}8Esr4Q!~s6_Tk#BRorhQ)JOgI^I{YcQS<
zEP?m!7R1CoGmxmt=E0y%MPfrrEBbd>3$0LP!Tat?HmV(EmQ7rLk{Fv>mZe-sJ=$x^
z6T#hWTH9x|8o2#MYqNE?>PnUlVy+q#g#2WNe9qy?Ha-Sl!yw(}ApvKsfxpDe=kPda
z5#!%Y*yTF3@4r)MpQr*purJgGRy|Q&2mGxA{(gmkKlVdfpkGL+?q>D374cVsHtnZl
zw)$eEYe>^Ir0F_;7HS;}wT^{a$3p$;u}~Vg`?JJDNfa~Up_aVm{bQo0s2qyrjp;z-
zj*IDV@>&j!s{0V?Fy?y9#l=wT#C&K1Hr`;}{6NX>N!Ez=zTIm`z%|X{!QY>@ewA2r
zAFVOsss~}H_~Xk$#Sb+<qD7Q~NbBVUY15!uSzssNvJ~onEY_%SI0Kf1np?3QO~Le$
z<5BG<k>hn=o^a*@)~^+-P7<HII**TB<|PdZG78si8VWZAA91X;z}Fv*viUG9lg)8z
zhf8w~mWhpDc7^iFAu(*T00^dwLT9m7sd@9#uHw9_>^MklS;yk7k$Knga5qHel@0aL
z(0S$f=aWHyc}={?iuu!S1lDVOH6Bf<hmMF#bRB%Ty1;g;ff?DDrq_^mpC8Z;5BMl!
zNHzRhXs%G7PdKUg)ce`+LV9viFh5I7w@o^1TNAy`-GMYc&Z$GXMSKHG!zMVXCkfCi
zU|zLaG`E7;g<NP>uz=9Dh_^-jC*pFaS&kB*Tr>QCr|1NUIn7P2tDCX$g0(qUM8{FL
z|1dp|8r+(B`0zb>c#G}AaBoPy(v)+pJUO`qkf=7M9;Ltt<>m$#dKxwX^58}$B5xos
zoWf>I_lswx9$6{7D^!}ZGmUooe3G+Wu@(6MI){h@C3eYKEg!UodtFEGt)utW(R=IY
zy>;||o{QdFhwuG9@Lrec^D7`=i(!0^Rc!gip<ma6?G=J;j~X(N)sGw_5seYsFcJ;J
zTnT(~c*n)i0WJFQ8YS66?M#J`H9HQg#nYjhwZ@4izR+eULIz1mUWdcW2DEE|4Ky_8
zKA)95zdZkU?ub2yjyS>WI%OM|UphL@WaT=4!4gliY<9$1VUsyWmY4wI7j|%hMk3^q
z90&>sm$|3w4Cu@;?X7fX23#>Jv6MJwdt589xcS=E%SfU3=_c?hKi#7L{^$Sve`0+K
z)-Se8IRpHHB@FQc5c~OS=x$Gy6#5<wE<iq(vgUQ&<8=tie@%3$WyjfSz^O3o<N!f`
zjfHB#zo*cR+b)#mzgGCne@hIiWkkG&rTWdnQmuna*1;v~;F5K4$vU{?=L;@*lKnh^
zCC3?pN=m(d5XjDxY+dno?N>L98=|Z$F>VTK;o2R4Q+NDv_Av|P(t<51j7w}np<AfU
z7?Eg-M^meOQUzER7*VxCGC9_fSG0zIYONyJ)}tDVPc)=lDJrghLNd{We@7ib;%_}k
zW_YBI{J=cniV;tCUb<4I%6^?m_0|5<$|va&cX8`}G)_n8_7lzMJ0g`Jk^ZSWDca%=
zR~|(p3Y$6`7~iXW@~-m95N9HU;7RLYHoRy(8quoMczE7QfIT|O)bxP18EOlEupy08
z*(6{|4Ic8syi)nZjVY3%v_b<Zq>I^kLeFj8y~{(|`paJ$S{>*(k=hG6e>RWHm%oi3
z+~;Th_{W7iU*AVB;pA`y5X>09^OC_JQ|<Br4YNd=@yIHr*~c5!HDT8^Vb?(d>mY%3
zkia@fU>zi|hWPn?#Ry1pUI6odbDXUX2zZj+AQ<3DcCAo=OXcpP(^-}NndXC5nzjEq
z&t^%L#kq5SVKt~_WwwFlDDLO}*KyV)f~8}OMR$7A)&F5dO~tvIGkCv!XEJ;!=)bXo
zdC^#^FbUU($oWl{nQ^-ZO{!Bp%Cc&&@~*zLS3E*r)!IWPveCE*_Cun7PT{7!tVORV
z-QbyMy_n2u^*YbTStIH~&)|81qVb*Dd~4N(qHK7Je)pTQ2zw<WNDuST`z0_zP79bI
zyku)&kpIHKAkAoZ%xP3^hdLs=YO99zQ5}lx*yF;YN5`dv9a#0#R4Cl6lWI2*Tn>^J
zD&E=h0S*=tRVp9Fk5UPLrl^o3rowYN^|-KDGmBpz7OUziCD3aN;U>J*F%9s#gklL+
z5Ox;g)0i5ZH$m}BBAi61V3g2*Nf4iprDm)w1=PJni(vTGukaG%K*Wil!^6SoB!4+D
zSWYsv-c?|05QSV2$2pfb({mL*l!W9+**{NI^+^rl%{&!9QyE)-4$4V_FspJs+iRV5
zg;R$^F`RwLPN2}jB(?}T7!J6y<&hpI(I0ZunT=T>3>f@6E@&MW^j|M7XwQkTJ`AWR
z#jZhU)*v*$bi~gIGh&J1pm%yAMVL>KJb%MTG;^3+K=4npH4@DliDn%vv<?<p2Meu(
zg?{y5p?@bj`+35Dg?^--5iqpyh7YUDh3<;TGkB5U&XjGk(zeAz>7x8gxylwAtm|y8
zV~|`75)<nHi9mM0dsNywT~=v}%Wp9_{(t#MrT;orl9*SxN7o?~>kx`{2*o;tVjV)U
z4xw0wQ2fjx6f4B_Qj5hZNx1rv>m;%A(rznI6uT%o^qaJd)^U~{e~*$DsI7I3I0gRC
zR_o8LzgP<irkG;e^{2%BIs@8=@kM77RSzl^Esi8*lUPVZNuOfLB)PfAvanYCp}l{G
zwLXv_2^>jZ6>gw{3vpMipVDq~sS`dDvT0bANqVgX{WR>^dQe>mli6Z##r@!A?hbUC
z`|>_1hoYs0ir?{qf6a;FhO=SqO;ZvN=*X&A-I=(-e-ghUI_o#Ap*$=lW1s}Uk_FL{
zFMPv|hw?*Tqqo8@v%a2kJhZ=i_(ODL_ny;Mn8qo~STOp;`7ORxm&tg7HNYxsl_dOj
zm7C~sR4aA1xQeUsL((;7=zA85NJ-k)CWs_~-HRLKZT_cwf7fcwXss<$09q3ZZFz|%
zov0f9NqP<5{m8UaB^5E>@?E_m`jie`mp&4g=>7XqwOU90q-|QV1cj4?8fv__^vHZP
z!u@-9=@!VtzxW`5u52E?!rQ@GpooNP@uQ3Zv)Gzt|BgY(z%Kc0_lhBRClm0aJY&On
z1w$?GuHxDPe@R5Y*{;2<Hjk=}s5+d+$Jv<v;xWDZDjcTzneWrqL7y%9zZ$yIQL3X@
zT76ZKB0w(Yhm}WHQblU<M1{=`Mp@h+r7)mYWnVq?h)MwqRuL11^>Ne_I`2W==$&Qh
zu-A&V#~0uLvZEp}F8}aCHZL7EXUS9@&ej|8;dQa0e|1dJ2NoMTd_>$WPeWX2VtUPi
zUPatt{ex-|VSb5cXhf1G%y2EDsK>h0?yy5bZhAx#H2tZ5)ZWj3pkx1sO3&f5_$(Rw
zX*k8tRy=|Gtd&iV+whM!)4VA+PG+Ygm4<iEF8pJ(`ND_Nvx|1!Cx1zGYG7IH>G98R
zMSudkf9&Was=Of4or6S(KM<eX5#c@nTW&ZF(peFlG-2KO_lcBwxT~(hXo=;+nJ+j0
z+%=b?v!(><tsiAQYCeee-B0|IH}{<6|3<RY_Eh$C$j$@a;p)3s_7D?J04v01Wkt2Z
zEt7$nai73))oYz@wTpcWiCzY>-JIvrNL}?|e-V2FLk!8(AiqX*nnG1n5!om1AtfzW
zrb1G|hzqTk>ZYrLEMsAx@hG9Kt~Qk=A1V%))9frkkjIWj;FTKcoXMu3E0wS9{sUqU
zU+cgh@M)*N9;n>+bvk@-deKz+XyR+WZqqfp4NU^#!vk?NH1YfEw!3Q05YvT9fapuS
zf1=G<_Bt7V-FA26?QQ>h`&$M{;yk|BMyWr;Vd@wQ!wV_-ffHr@<%<VFUCk@LRlavR
zdQjZrs(G+8LIKBengMF(-`8GzVQ|fjjb_7tmir;!PyCIJ`n}>T6fXJ+C|>5i%8!5D
z_9XCoi*8#7sQq^eP%{I;Jngd6?~<Zve`YCIN35+Q)_#SuX-27tQS+o4-27b>PJ__m
zq!NyTVM%EnzqXEFTgR`h<JZ>lYwP&6Upszn@7ukfCwy&kGC}lOx&IFeUZXzOfLH5a
zGYd8&a#$l?-5l{Mxe4MG&GBl;s~{Gj=q3>a@Em){+vJvQoG-eX8e1+uM<+LIfA$Fn
z5cpi${xoJQXR3h(o&-X7HO(TMDe<M2dOM%MoDiQG*A5a;i(@y=3Bhrsgjg~y&P3hH
zC-FHnrBKHIG3zTby@a9ZC{&7~0h=E{HxM?ynCFvmK9{5NB(}Oxr-@Szi)uAa!x2QZ
z2!8&#3wJ9&mK*&PzCd~CwSmeof6Ggd$|_&~mAQPot#;EO?vSpT^C2^NAKDW;!r-@p
zLCQ_WEHj6Qo~r|$FZ9jbv)iGgKS{&PNNa8DzyEfx^+oHh-h;X_N!s#HlgH=Nx7mvh
zn1a15pB<C@{LfMJDLc>UT0EV`7tyDE{i(j#PX~?4C-AX<I*jf|n_Ktjf2YDMd<yq;
zwNQPaN_WKz|LGCkyx001y#bLe`t+DCFdkSXOq%_4_?2bFt|7M8@uBPZ&~<$1IzDtA
zAG(eYUB`!hbcn5!Nr0~fWx5<6O4k;{Ls<p5Hrf^>uIogIqTO14{HXHd8a8Vk;`W;i
zaVzdg4Pqk-<bf!;=oanie=cXeT*KVlHn$MBR*_A+y^r8tvmPwxGM){r<N?1=2JpL!
zJaMEa^u)rhjH{o3SLGaoft$9Un1uu{FT{ALr&MA%Y)0kKGN>-ce!SL{jW=elCXdCn
zB_me9lvtnyUch<Sas*W*hfCJ7E~~PJkXlFRTr)yPMKq5e<)pNgf9=;%I_oH%UnxpQ
zsTDywj!ylp-&lywI+SD`O0o_mS%;FWLrH$FP!bLb{F$OjxNi<9S$xX}#gs^YzsIl=
zUS0{U6yzM1>JHg#Ue1RpAU`f98-3ml8zV$iCVU;l^0NoAC_S&^SbpX>mW!V=jO98T
z=q6z;1)^9L*)q!}f6Wm%!_N`pf|Jud69%}btt}P;Dca#!n-0t=OGo)$@iTiDd%M4h
z*qKV@5C_F-sm)HW_8+#k=>HRG+`CK1Tr*GDYd4-XiKs>w#2uP=YjZrBy>3d|`t>7n
zlt7jQ<xDOrx0SBA28SWL<2@DLZ1}6?hGRr{U>CsqXa#2%f7=-6zmjQ%AApw`ihQkl
zM(WnIJ4)W9wA4`YNLd$C*o<_m4h*O;g?*oq7W@3^%fE^ACdIH()0(92Th)3e1O!<9
z@>;z$$wst0W*5X@XoKhcmioHZ-8v9w9f-3I#90U8tOIe@fjB-8N4B(>{aG_B7s<J`
zj@0=b7Q>SZf2#}P$^Dyz>4-t)T9G=^ROQ4huN1_~%567CdL1U;P+o6UZnHgv894?h
zsjcIq>?*^M)325*S9rG_41DBXOp>8T6613>6OSJwI+2DSbEwKN9n31XC*FmBUoLq`
zmW9)C)>VegLajid-5&Nkk$+S!;?%rfeNF=Lh~Ds!f8O7ZU#C^MNmFqDvn}~M>;Kr{
zchM`~R!J=yS36M^7xL;mX)@}FN_IawtY%XHZsBKstNMe2ywQqvJM?i--|ox5wY&93
zg+ywDvm4K9N7Z1{iwYQ>$Lw7j4L|`2M^Uj@PE+z0pYX0)4|=HLA?QCbeHPx*YSCy|
z7^cr?e?%kt|H-(<<Ehu>-M1mplPXK6v~yZC{E{@J23KhEJP&H2aTl}cMaRK?h_55E
zdV<Hv%sE4r7Zk)p$s4edC7o2CXZGWQ{*QL@LKo4kYGD$=!t9M~Pgr=O*NNWBUzk3f
z1wh)ViyushnTmHfiQb7rpGefHoyzkW@kJ;Bf37*{Ae;ccQj<>|C+DukTQ2z6i9XwU
zhj57CX?pW>n4lAsU-#FGJsk4mKSY1JA8qm-d1LP0=vun3JW3E5!jL#`W`4o>E<1Ja
z6T4_7<Fj;1%!|fetA78i`|4n4|M~W_ooYxk&;pr>a&~-(vgVNRwAI@xiRS67Dp-3h
zfBsRUGq{R3(p8aAt2|OPvQe*t<kmrQzk%A4?mYHzXL}bzq7r}^K8*9^8Hr}2o;NVz
zBy3Hz37?HBQTF}~iZlZwE;eUz0kCKH+G1Y3XuH<L$pte_e_{4vGbP;|N++DZYNU*V
z>rhwufK}_88#O$SBQ~tt3j(Qw?Y#Mde{;=AX@cv>;Su5u4^5Mz=BdVS;UTT)xs<-;
z_tLw1FI4C6(cge6?Fkk19;bkM<nIv!vCKHbdol2veF5Wi*x;?14_=tF0djGTB5%GA
z*J8<Zn(cR5GUJ!*r)=I0riHB^;@S(RX4TBd%1FGF#<9s_hGHDgypfZMZ0?)ne>OeE
zRv5Wy)7xMS*h)plwmlruv7Xo5qiWHkktK-;O#FM0&My3~f29+4xOZHyhji-)Iw){J
zS>N!%EOZQR?>izfqysmq{E)FEd54F1sAEI7hd%^T9gc<$_g*wVnymB|4H&Zb9Sb^o
zf&O||mDA&~-$SAoxzqbRzUVB>e{-<qY&PAcO2yNRe)l7`aLLe4NW}D?i%0o;>689^
z_s@6v;xOsYk2?|^dO!Mxl-nfuSTUD%wA1njYk-LQ)89(t7GC<UW54iH`|vBv+8&nb
z+AedGY<1;cuKry83B$tgv<&XL672_8qMclLigi1jiB*-5Z+-c~R`lWoe-6?O321%$
z?yu1kFdGP0x2i3{GUZ<CkdAeR@OvE{{R>4$FI!D0Ui5ajeAeO6>u~4~t*E<b3PW%w
z?HlG<pv?grH(!kTP-Y7zNB;y+X88PLlF&4OQ~ki)BBh0d7n<P_6rPs3<F&#|#A9>9
zdr@^u3s<4f+#XA~4qLcme>v^k@M0U3bRwQFIa_%+zOs5~4RbD>vHJ=MfYZJNeHWq1
z<Ip6jCV2Y)ugBT>n8RGo%X7H;VBGAw#@#q)?q9I)zcRZ0H*43UQBx<e+N^mf*_4z4
z>;v98ZVR#O{%^B5f8As5OMkeVq?qhr;`pLOK(nHtF&`X0pzcKWe~)q4v`kTYnuuW=
zDm#lCBN?O(k+w*ViA4bA>^w>2)uh!46s`CrbA_ji@=-REf_aENvME~{XLXIqJC6rV
zp`+%e_+pp$%6?hI>L;@}9nqHoiFh6TzmER@O;wd%WYNE&Jb(iU+fc<_*EJZSSet}4
zg8(9JkMr!Dmu!^2e@^UxIAVvmeuTGe`_$#YhSeeM``+f=2LH1u|7@{K9e>>`D3Q12
zZl%Khi*K@wWGSeGUdke&>XV}^>*&oY{Zn<Rfpo(p-`k}R)*NcuU3qDB@ICCIu~}d8
zNDwfE0E>a{-FOyeXOlQH@EfOCIiU27o#?^+do6ru_+f#<f2wK#(}#Wt+W$$l({gY3
zxwqDxYxO7oD%YotctzJd(9Ooz^xw~JINVLl4*h%2>(qI&Y<5}Z*xT8QKKtyhx9m-l
zNx`y5zngcdMZ1n@?^*mt%A=@Xl9!Nn#USMhFLdZ-BaXT+6GFH!V6nO(B?v8`TQ4#M
zo+Hh9Ik$*Le^d83Adk}?CiFCkd`Nv@qS4PB*f5R~7MF95DM3jVl}OS&pG!pKfW%!0
zR2G&8K?;EaBxk2*#D{$mh8#|v=y;U%NyfJC>tDFYA={U`&ktU1KYz5--TTMOZ(ls`
zez&uKu>0b9bf~Thj*BxR!s-ZzFS|i|Z*(Yyk#Ow4f1I~y$H!F=VmPJq1ml*FC#-z+
zsbn@BaNb3g!;J8SB!rxiNVQ_{y(l@I&?FlYZ#pJP6K74aH+!?$TSS)R;D;as1lq_r
zIUim4^a>ZCj1Ms;ImGx4I@ry)LjumB4GBT;0pj8{*&RuZ<ka#0F!jyHLw2R`WAV)G
z3^#2$e?li=qmi722=NLA&CUSK+BjR-XMAq?A%)x2K7dU&J}jpJO??byT8{S8XTx#D
z>iSS}Scd7*5q$<SV#d&qA1eW3HTd|>ra>Y_-q4QKha{GwaN>)$;+%vdHatl96J}GW
z>{LQ&FvH_up-Sss_{2EZ7{#&QH%xXkZ3{i%e>;z|`B-D#R<6F-yXY=0i7wdX#Z;o&
z&Q4wRaxVUHcyLcpu76#0Yf=NI#85^)aD=#TJmzcxi31hogGr^xT$h4_7ZJhrfi))h
z8WVh-$hl7BTqkm_6FGnFM9%%6Cx>&2c)k6Pm$`Yk@3$NVMMuyy!$HN`5vKHQ`%bhs
ze<Jn&goDgGa9YzRpOP?0@5p!>_8k{vCB|>DJMDMqpi<$#*2#}QNAlx-L9Mt5Gana%
zuv{ugF1Mnuo9-r!uT}5;Vp)-hr^^2eBt=d?UQXooxxnr4!KQQv2ILbYD=tA2BA3hh
zGY`goIsLk)5l*$b6n0gM27Y49d84vCe}S@)AbsuJNhvr;PdFW(SL@OK_VY&NHw@yv
zzbspDTCuq!PCBi-U!dJl%AuYMdu={NxJlJXJM?cq6_XULf3-n7EYGF7b!Z2(7vHK%
zk!+ernsQnO>ifygOLW_yg8<V0eU5;x`F`{-i8AJU8f!#*BWIf^{$L5PX8qPBe_Xns
z4bh?2ZFG0p#7+Zbf*4k{aWL|IA|i+-Fky`nR>bEVf&y9d0zty{0C(}fMi!zaAueVW
z?nj=lw%XIC^T-S4kGuQ(${YNkL_DH^Umz8a-ty}u<9)QeO8SbQDYLQ?6>}>u&%FDM
zWEYB>{{i`hzkUWG>*Md2L%2@=e_N;jt<(P&(*O3O9V2TxU{!6?<5lh~LUZrmAmeZU
zTFHK1ARJ8Ni)`#g!r^3e5lD#t%ChT;i^S~SK)T{6GY^r<$#EiUZ863zpYAI8Z8oB<
zMs$y*vZGN9;M<q`uXZXTIo{^@BKMid_CS0Z-#Lq?czZcf?DPUZIX?{Pe@3~rF>|T5
zv7eHfG(1AHS=vV@I(+=o&~dXw_J;m=BjKhT*h){(bANd7hY0qzSyDUJ5LIf2Xp2Nc
zT1igUNL3fATAO9CTh*ke2J0Q&`M96G(eJO<mqLAe6UK+>&p&sblY3ofo$$0G;puUR
zA6!g#V&j0DEK6$%(?Wtgf2dY;Ah5)`+j7%E6s=e+4vomdJj=}_jMFv4rfi>)p2055
zV$<-vX0xk3l*|U9`Mnr$`(6m+*N(Pl1D)q~|J{S^r;A+KxG_(lYUC1ezl2FOqUtRl
zYA<K(KI!pwW$VV3NV3>w9T_B6^o=>cRHfqC6~`R$1D>0IoCFU(e~3TaU#1p)wxKlB
zu^u%(8uk5+D0Y%P;gA*ko{CFWUUG&lCOZc`*modW6*OzeUTyK+Vx@-tuBgJx4nNnq
zrM6r5vY?AezCr~-08B-5eyQ_=iyYa$bhDiB8%c)41lHxnhTp%~|J%Xd_9IOV4h%h(
z!7YD?v4*|}`ASIMf449D6c-v{{xPe_lFsa2eBb{ansNTyriWBCq#!85a_t-uPWW0(
z5vc?zBA4=@HAMb8CuCJl$dj_EW%IM{bl$%RHGQ{aq-u+{R9N3NHvT#~{uhmo{|yDY
zKMvhn-p>XBtl;_Lc`CTLhIAwk9A^vNYwRv8`_~q7i<~g$e|%-?#9QJsyRHbe!VGbI
zOnYm#wM@i<L7`i6Rw+Ae4YE_lLud{1vubEn!0Y+c`}XC_JwC$de9o7+tE_hwllC}u
zpY<PWnVV4qgQCx6-F}rH3c^*juAN~Z{GB`!?t|7Zoy-MxwP<X>-9J3|gJA;^9n@~6
zd21ZkSc$CHf8AX%&!>4(J0(4-D{w1tuEk?(TXB7xR8)*QEzn7a<KU*b##CKRCoW7p
zkI%w0mipNjN?Af6QH^Q;UUL{<L@!@H<se5670jkCemAdEAG=xxDl7{JS4BK^p^=gf
zmrXAa#U@w6t$;2OftXBvOtNH8e3wl78D~boa{4fce+izF^hz4(46G~_^autc7)C>J
z1sm;$$hocPWhQPb{$%c2``{%<W<O-Nh92m>+uEuZgyfqzI?LFd7i>Y>RQ6Qm12mL>
zpj);%Ln;Y`<x*JdzWdM+EqEQ)x(;hyhqbQ5T7T)V*8h@Gtv>E-9n^Z`pjNC#J9;vW
zCntY@fBG{;xY9ei$9Tg(85r}DcYa{xD|PHQCSFUdBA%qJaWZSyqd!K6`cB_Shvi~p
ze|P0h)&)pDb`0*iiU@s8cB6n<+G(p}X5pbqVDP$rOePq_lCVtDIFmO5rppYnSaFoA
zzp}ZIUD@}e_&g@5l+ieA8@A!W4oDe^X_JV)e|xss*2FbQ=-p_bpHEH_)N{x?{Nt1D
zIZeq_n{=Yy!-OVf8hs7%qHEoCXW8py{Givs6C002rELPNaibG$5Pgoo1*n5ImUM$!
zy{mlkuKtxvOs8SDaI04TDo`laWenD34Ax}~)@2OVWeon?$1%3nVTwOnm}0rufKwG*
zf3*SA6>yqvJPMXcn{L#_C<^gqAtaGSq-#edUMD7zq@i|O&_3vo(0xjMy}2;%rJ8EH
zEmt82)kv0Yw;4)RAbs2INIG&`5;9+ZK3)Wqa5*{I*q#w{T^=gdkP=6ughhAs&fZeN
zMd$P$+R->xVWcy(R8j6gt})ah7(jAGf1oz}ouC(Yw6P*G1@2HE-=RpNci0)m6U#JJ
zHN~|l*s9gaWs;<>PM67}V^LrCqkCffrSGZUtJ(=)sBI4lEIiGIQJoYhlhbra5`YLr
zywibn;!FvzcB%VSB5cn@Scr%dpTF4xE;0IIadwssv%LN3+rlW`^%^|#DDq-$e^d=6
zRMcB2OQ_X|YcD`Tbr3#95mjVV7S}_<ftMd3M~4rIg3$Yc7g;yOOexH9DNmQr#fD@p
z)yNnw49w9Oh)N^R7<kv~MgJ})EvA>ld^RNF@G5^YZk?yE(>}~5toP$r`%!mKumNFv
zYs)jOlX~>;@mYLeb|@t}Awfw`e_}C(G_JvD&f50EJt;0XIraV*v7C)$^C<b#QBa6$
z;MdF%_$5@ly|;Tgbnq<qu)%NY=5k@Ilt%O;0$}HC%ofJ6Vw-HV+Rnl=%Qrm6anEsx
zo|2G29iLmIakL^YQfn4C?7$7_g*xYH*dQLW;b;d+)X)w+xQh}Xs92Q<e|<0U0>|ql
zO_0A1j5b{V8quB{&ckE?UawxE1l2plsdCQ2xq_iQk^?AJy;Fy|fu^Ju^HIa}813&I
zywpGi(Pb|%QW9<eI~YB5EYpk_J>$_faWHTSfqRd5Uji^ZYz;zH=A(ETeo<h+5$B%^
zBQC$9E}RwGk~##v1uEREf0aHRyho`?V6ox+Cr3x=0JIdT5G2U(x1()ml0HxRO&m`g
zeId|Nq@X@89wJjIdQV^JdrZeo6&tN{Ia@TIhJiMFyoq{lzxh2_;P>#=!Pst|zVdm{
zke=-|VECHl>YFY5j)sJ%Ir}ax>UCKcLYg^dHlMSdssVCU^UCN#e<O|<jmRR>JW~3J
zSkKZ~fZ(YoEUloYEC~}w)FEw;3{0mJ_3(QKKa(l&{_*p1QuwKN4`!q&pO)I_Me0}n
zLIl&k>eK##@2Bakc;)3Z9_N@ky`)ZQ!DF2=Ew&Y8ZR9}zZB=^@FJ{TpWPCh3`TIPX
z({~&I^fWoX=tb?QfA=V(bz8XcPq`4~awQcP_s$vP=S4mK10&-<UdGeognvp<n7jK-
z5?bBwM<b#P|19((_X~Eh>5Q*og5*(|bnWI5sZir&6m+~tPxRDv2Cugmje=i(3b6v^
z%k<<osreZPBMvp9=Wz{>_$mjFV1Y&RSNl&L(NatLX;E#Uf0gu9F4LjJc!b1Nd*PWC
z-e`@pa~G-*UdJAKK?*@S?qSM%k6%37;fg{u?jF1a*kJk{xxhg7AT4mFu{oD%mzL;?
zQ`5&JoCh>otGAf66HUONA&F#|j>~c?^L`T)he!v&PH90XVG&6v?dy`r^q|Kx=KOqg
zy5eBqOb!<_e=s=7(t$Y8iV=`1Lq*~!$MKO(hw9_vCq)Jb5d<+H931YX6UG~8z8}xH
zF^DHILkp%N8^M?B%d4oR0!Nw8Fj3}N&W%}-c!IPOAE$<-lcKGyQNf&TNh8Y}`GEY7
zk5=yHBNn@P|7;BhPrxyFhQ-a<NutCaalHRWh|-5Of9Ip54TM&>1v(W=fjVf*A%#}i
z%h@A>G{8%-w72ecH9N4Y+Iuh{IsqR<yYdEeB*cAEuiz?{CGwH~DF7k{BaU`r^72J!
z41cm%d?qjy$N6h<)4Q0{OQ(X#jtMiw7Z2v4=8FBXpH7?z>@{Go@R3QV!iZ8i01$F_
z;IFb6e}iqK9|{~$Act~7kJnE46OL#(TG6A0hPkPvGX(G?!$1Y?J>Gf#qWfrP|78zp
z48F=+4g2=+aWc+m-XP7zi2ofh2Z;r<uuyD?)ZC0UQkB2jwAbeGXwhLzishusj+7v6
z;&$+N(-CN0Ei7tqDH~bz^2fKcF#bmEQ<%>;e><8()`<A`RtH{5{c*1o9m?Gw*c$~<
zC1*`QgDyQT-87=Y^)0==Rl0spue0gllTV6$HOg1E7Ovc@eDcnGN!X`?BqBCGRuV}z
zfSv(0h|US`lc#22R+-h`6JL+rcaa%mWp8-d5KgXi!|fiI=@5BH7W2Tn{dq~rcx$4Z
ze{FMf%iQ&K=Q`58833EfqWzdx#Nbh#sdYn6Yb`!m{Zty`Mrc-P%4IeSaHM*B>+aUw
zCcRnP>*Mxm^!%YKs90qu;CwogT8UbivZ`qabQ)JXYK1Ab4zCu5ELn;APIp%zrEz~g
zP0KeejhOB(-g3?tzU}V5YXpO0o+O^kf13{ML*Fe7t*heI>bDnGa^)*Zw~MRru5>qC
z&ma8YD)L|5KZq~+&@&kV2FDP|M{rmM6R#LpIWYua;c&M*pJ?m~K+w_54nz_jia{I*
z9Ue+r;!wmN4e%|+iE(g-!d`PLmcrSVBd4jA;H0y$xY;euXF+NdmQujC{l(-(e=)L*
zKce{jUr5}n7ZS663$oeA;{Ita3&P89MLz&)jyx)8c36;5yh0ibiQAlo$Se8L{mCq~
z&w~9C^+wsTlrddr;{A83&Qx%C1QnVB_hC??X`O_(PQv>&OVk8zZq%q*LZrW;+`V-&
z$T}HhoeZ+ZIA3F&|6J)Hb6T#Se<ulqdgkPh@*6%d<%7B_;hoc!CPJTGPRBYw;^)99
z$2t~a$}wLSp-n=T0<M*;>-HuKU???^1@|>OxiDo4qj`!5j5U(^&5+FdzXp^!QN~Tt
z%;|1`WbR4JgPBtckU-D2Yt4$NjZ_Wn&pD2nW}n4Jsr^>}xFF}oMj=H$e~|&TFq~f&
z;rv-9Rltx`fip<(iRi2zYU)2Qx%x4kv<c6(?nEs&hn(y;Gw8>K>SN}+Li`DB8;<#P
zQx^nG-5g*YtGNtg9S4HiU89X4Asx%NQK{&HlX?s3Nql)Oiw6&bX29b&=sx`|H;Di*
z+yzOqp?L`^63(Zi&NWcle><x{+C$8X`|O*;D*@LPK(!;h(sg9$>F<K->u&>~_KxeY
zh5hdF**h%Dw3u!kG6u&}6mi)**MVh!$Mf*t2ACa0SHNb6R8WFv58JE}+Sdr}YlQYS
zLi-w_eT~q*MrgkoLOagU0HmEyT2M1YfZ(WIh1QM-ZUWd2x$#<<f9+^^J9-E~6lTnH
zoJJ;QMv^PBME*pxjmzZH+gvV<rwKx4L6KmlET$k6Uqui35NWm%ZTue(qPwlF&7xo{
z*SA_<sEB*pExKlRz;27?0!&Qrc!GCSZZj^0i$oKcsqs<vk&Ha6RKGw54`A<~r-N)n
zjO`&!Nk4v_2Ke`%e{JFKtp6kZ{Whwi$Z$2f|A2(|I42!Wvy*^hcUUF5YD861c}S_c
zRsErYlZsXDYQRE7p(8DZeO03Ys3|DgP21`ATa4>n)jf?Tpn%0R$_t|XR*Txu@ZQls
zG&1}%qUMU9PuwqoCT6DohR1g<Lnf10c#;i)h1XAx({bgKe@|{lyH?wn7tE0=6Ry&0
z0rmH4BxKfA27t4B5GBQjtIsq0aRI30S+vl>EzAQ*%Vq<7(ZvJ8%&_oCuR}8;f7-N2
zIN}0Oa>Zd0?>ztRa3jD&-uS`ICsZZLt4niBC6YJ{Xhvmqs!9S{I%67P5tM&w5EkCW
zcRccORn;dUf2u&+!&bSqs55yNV+ho}Xz(gWQD3iofRvRk+QK+=mGyx}XbKCRzkQ#P
zxh_HQ->?J$cww9Q-mh7K;HA^m_2>}~u4eY)0e6_QC?MR-imrPpPC(V6377aJ(_L&J
z`jwA{hF|$8p4D{)hWD+&01?fJ1*PH(r6XL==EaH&f5xqKPPp=d<J)WW`kxiOeqsIA
z!1e2JxoZN~uR-e9@o{UA`kR8(&)HU5!l{=Qmc|vAy`@55VB>SaWVnXsRIFfTwvcYP
zj+&$m3k>G?nC?l|yc#urcHiC-YX}`jDPa3H9^8*UYu$C%iKnGR-3iijar?{G-Qe!z
zc%xy*e_4lr+MQvB(mUbZBO-}{P;oojo2F-wtnq}a;bauV1-gR<&V`>kOTaKaBCP@X
zg3Pxnl8CpsbLR#B9c^}^y=2<-uVD2`a`@O2@C*4-^;0mAjfO3>?}R%DN(gNDnR1`9
z)rlmONJ&XP`lElrk_HQ-lYSOIt;rO%<oeczf7(IZXW=9#Rr3T~Qr1FtlC8NCL_^n0
za@2HSmUs>gJV@tRs21@JJ1W2%CMZt8=2OnHY}4-n^L0M*1PfpDQEfyxLFqljy_jJX
z=r0|+bbK#$MbG22^q6(kEV^@N*BUs9>p`@i95WPr!avaMKDt%EE)7EVe#Iee(lU-a
zf16wP{;j+OZJ9+i9otUgK}HL2b~a`7(sU^GOMJOkbOeFolClkfR3EGqGy7m&JTqUM
zZEow_GMp2{&Z9D^<jA-pO?Gr4xGK@}WX8^lLcW)HdS5<0XdfIrWoKDow9@sk1eV3(
zK21T8>&sqZP4m@k$^3$Tor)(JpkU~ofBy&zmxYz;7D}Pm+qIU13nDSo5TdBCkHX>(
z;$<*27P@{6mU;a`8pX5dlA;+VMfxBeesdVG6O_d$9HxR+ljhloS2e8TcB9G|<th*b
zPr-!?i&@u!Sl5AAhyJfa|JQXO)^#9$?ZAIpjh`v-A84pc-teJ;|6#2M3H+xsf2a`n
zU%+#f2OO9yT8r%H;q}l2QsTM@#5&2r(Tq=WAkikMBtMHr3B;CihQqpg#7&bF@{gCK
zu()x)=&BpCfH12`2$4%daDGdmN~$KH$q0@F!jPmem%#j-@0CU{Qc5g@_#=XnZL0Ys
zKIfv<f%5QU*5_l^;)!(>1L;w>e~oEmh%x@<G82A<81O?20>55>qHVl-Yh7DoU0Y*a
zTVq{YV_jQg9f7{Ct?^q9Fu#rxS8B5?%KSzJI9O}FUX(dCY`1T5RCw8z%<@ZSR!+zS
zP$(b8)8ni~0^x}3S05$P1NTBb4se@)6op&96pt^!RPRUC&DP!4pTDT`f7L0bm#*Dy
zec9TQOScu*pRWGz)U=9-+V6|e@6o~IzwwL!{+PYcu^bIH5;rOzq(G#=R4u`ep7DAy
zu}6mzW6>Wa5|+e07`aFs$uv=Uo5U5hY;&ksz+Cic2$c{D<hwf^`S&ZnhOh2)^5mbL
z&H?T6WS@R#r*e<SN!JsofAFL`enq?cP)1gB7aP%IRFtm&P?2LX+D~R0OMIFiJD^X#
zAVDvkDE)H-g)fe@RLJ>B*2RuQOqxdq)d-nR^j$LeI{ov5denU2K4G6@;J&7JJ<yjC
z%O1~0<6AY4g}BFRFC)%L*Kgm^E_I<dGYe3l8=b$t3&0M;0l9(je_bx)5k)Uv*ZgO?
zPZdzfTeYf>u6z6LR<%*+ukK%C({U$!gZ-~1W2^n~lsJH_5(yh5Lw2X*<66C5Y@EIB
zX49I?4h=wpm^FH&uTez{-_7i-TCe|AhV-s(AdO1{wJi?ugCexwJG#2H4ys-eRQ=JQ
z7Nh7Rf-P2}_m70$f3qSlD*mej)Wzm7b8kie&an0Bw=bL;ju-0jamk^<b5Zo4>g%M$
zgjzXD=hR0#VX)m6!eMxrh*#85flB4Y_=+%whSO1;p6UWA%H4?+bGTcMUsz`O+5B_Y
ze3@Nq7pPCZQ|8V=bOZe=zqbYdIEytRMsndK@s&u^o{XIrf2hY`CDDKW&;J#y4lLQZ
zs^`5HuRy!-jIKAVJAxiglxzNV=UZ<5t|FS(fxQ2na4)ASn|s7dFP^V{VjbqY4)gsr
zU@+6MBUs>GdQuH;R)1UQm!+5@3EKs=vyWmOOLXm6qHkgjJ#d~>dQoCQckaZ7Jseyt
zm+1|g2T@<{f5~WYF&HJex|FmvvuqfO<#;xIq*GCgEh(QI`5}JVT;lNL#J0y|qs$qy
z$~8v>cWO~}l0=t^J%@w-#;81^1Jq=?A)jz`kPPRXjXbu`qZ{d%U0z~g71Vfn#K|FS
zY~|#=pwgoR*2Ekf1MKbMBZ!`+cj2q?2Z`e2SvYR~e?U^9aI~>p47#&2af1sU%zgqF
zYa-w5!xk_a@j?cy)J2jY-Hbm|X2*&C@@^5Vr(wrfO`Z)p>w|(<YW-xJY8+-MO6eBy
z+VzPD1xuI2Mj^eBP=qE-iYxi9Ldt09k?s~H7zhUJzbKf8d>tA05hCMW85?Bc_Li~B
z%WZ;5e-#RDavrdl(28hhG`p~``9R{J%xb<4&0B}&tx<W`!FiVl=l$J{Fxt!V+3_?v
z`1{jF^z1_ZIf(e*hw1U(0Y2D>4#wH}(TEhuj~K?6|8s;WzMH+j5$z|#{3Jah0(n8K
z5y#Hs`QY{AhaVXJM=#{$dTs{Y!=m%_c!&e+e@e3zafvHnUy`a#=ivb=+a%L7tMMrD
zHmE!U2uIj~bkPxX!G%SHnq0>Rt}M<i&v*W~Y=&%R_&siNpnA}(as<imH0aQml{9bu
zq5u41bml~^(+5j<CLKFGJH=L~7ifSKA#RW&ZX`RJ@nRj&Vqx<Z+FJ{LhMsNa+zL<I
zf2{i_2BT~~Y#nFWvF0K5(__Z#R8MoTG~r8fyDS51p}Y-FUkE>}q-gG%B5#PD#?QQo
zAT(dwBjkOdz_Y}<OmmkmxMcV6pk#NsrS^bAJYskHHT_ZKLX&t&1C~?sl}Q@W9xGdo
z=t)NO2?h^T5Sli&D%qZaq5uql(14pPf99cSncDeKEPs=DkX-s<#tfpz55sTNr~nOZ
z@Dpesq*}1-1)GRv&Uy%9$5wxxB?Xq2e99&GzKW>K0CF!+06Bxs*^f}`s}=40#rk+<
zzexSZL1BGMP)5{szp=>OsJ3(?UR`AAv$o%;OZMp19c;FF5A(CUtT%Z0-d6iGfA7-M
z-OG0ImEGL^v)|Z_rMvp-F1~ELU0<(Pc$LJcrxm+Jl5ruGuG**-t4BZV$Khjyxi%l_
z8nK)EOB_`ZM)MYveEp!y^$Ed%JDtufop>u1jc^zQm8vVq73`#~t(;ma!ONHhuqYc>
zt|>m3W=qGhIGBlQjP@Ene-Es>e<Yh6hicXCHJkpNb=^x4pcJReirKL*i-qTk@wH~z
za<8_0+Y=4W&0Jz`Ix~x7QE*kGt{UO&3)$1<_7#`Mgl$UAQUkA>#@9axy?|0XJeW^-
z3Id)J^0IcW_n`t2Wj{}{aSL|(Rqe-Uz-^Vg3%;|t!-b-0u>0Xei4(&Qf4>(Mc#Ftl
zG$Y?8@z7+Xk5L*ij20$htRkSs9;w<Y%}8<)?TUIwm}L-8yfALOg2l4~Y2fb_KPi-b
z@?1<1!7NT7S8O)j@WbLrY%4c+znK4R3W2GJpbCw$X7UY2;FcX<P<<)r-Aq8JU<o5F
zmMIaB%N~q*oT6gm{*D8yf37p~t)`J&b2<yhZu=FwoLML*^C>I|xp&IiX37QQec2qk
z&?(Y_#oCJP!(pC<!h<4Ah*z5?DTEJ1rCeu0&PnWraFzFhjTi2`4o6$Xk?j}9JC=s-
z(USZto-(Z_ah{GY)ERf9?dI8&iDG^@mK70*f2e35OqJ12LkiYce@nxE{ID8^z>l!A
zGz30q#UeaM^;TSz0IZ$ZFic&<PvS9st5n)}i6Lb{=}&GLyANqd%|fZ6XdefpE)wE~
zsuHnfk<s0G1z;;<Y1E9$S)fpD?>UY800J=^)2Z)6`Q^D_&c9nJO#G@^m?Z3a#Xgs_
zbUJJ@8ikkDMk&e0e+My<4Q;Ri>;H6K9Za&By&l>jS4ptiknv2pH_J1ZGw#dP61Q(}
z!c4i#-xnX%A(vSwUtZvzZF#aQ^Ys4gQF{MaoUsl1UL4a;h~;3neDss7L_~iC;qx4p
z_LD<={3+U3&@=k;d$!ZjYJCGq>!bbeCmK~#{}<Vxk-t{He-++aZ1$1<$D=wSCZ-dj
z2$es1Xbrvjlm8BZ%8@_+fh9!~K3Ieu1I^It4^QH8GQ#e4&?hYQQwyPkq8`LCH8xiq
zJSuNdK+IrNdh@5~-o3kD{F0+$p|LbqNLl2V4L3vnui132535$o&MA3KEomLM8qrxA
zN0XDuvx{w@f2m+ta{GHywEM|;aKeUocL0-2eGz^iM&)>WFsjFPO^5c&kIEf1rMcS3
z!&|@XsN{rTt@Vl{;{6R%?{$6@wBp~_IZ_(>4bPMO1J4sNEPdnyC0~7@Ty~-a#QaMh
zElbas%MO`e>9kpK>|A#4L{~7?4`B5|I4gL4IHT?)f4b}_S~}2=b0%GTpzd(G>~y+n
zpdss(HwV1e^TOzvgDi{=X7eG5`j@ia!a#?88_^{PR&;~&^yeC=JEtx?!+r}hYD#S~
zL@fUay|teaRq<e1J<QH?hE<S8KpG42%51#;-<`3Yi)I~=@GAQ7za>-J16f|ewj-WO
zrxWqzf4Ndz+n@3@!Z@Y_D0`jYWnv<yKVD!QkzC$>d^K_In;S+R%o9X_1rGRdLNqR%
zsVP{!=k$B%&x_062CK=Kn+L1p9Vfbqy=Mn>`(S7PyPf@BonKCp$n;_&5-P7l<Y)Bd
z(*wJ&$A+is!rKoLmPO<W`)rP+_+LCKL?GdXe=`YIp#v&-;maw<a>=kmxVRNB+&$v!
z605!BF_%80P;)5Pfs-|58xWEv;N7=KQ)>ls%%+Imz(5BvkFvP)A8i-jbM=NQw)X+*
z%Lm>fY0fI3IPt;l#h_vC1-wxbPsb$@FBv!IIRw4-C>_t=1R`IPFEoeQfObd|EFDlO
ze^a_UnB&v`ig>^KL3{eY%`a{%88p45k~e2rbD>|?VP01e_I7y#Td|Rfew7ldbJ`*~
zYXPNDAL>*po2}^19Xl!7d%ABGG?0@bdf3&9;$i!`CsD(BtFndXxBrEhcG||Z9XiwE
zIv%&stDf8b`jAL<yp3CxdwBe6E>$zmf5Tnte(IH2U(YOASN5kNE`i_EV*#3(YnuUP
zqsKnxF<J3iW0j6O7AISyM&)URL~tC{1t|;$*?e3C4R!famvPt@a9EW&^6)!%?r27u
zyd;FRi8!aq4|In7*;#lf^<Jmrbk-9ngV)Ig9nAHW-MNYm)^V?$%m(e()Bfize+VtT
zFp_JEdE^ko(-Ib@bYGqc|DFJ)!NUJ%@${Gm?k&T2?mXr#*#6s`K5d*JABWEfOvfe+
zhUn8iNrWg>r}VqrRs%^ta>+`|KZ%cH`4&rh04cxl^<of0Zj&i+71FzlUZxoa(e(bd
z|M2tf-(I3PPH!nhCu^%A)@%@Cf5@l51}!58v&pB$R0@VFdMw;;+y0SVe&YT<wSGa3
zdo~Rgh6$TI_+?by)M5r#fa8plZ9-}V^>D+ercahOP(2C_+m;`f4@kR;dd7WiMcF4w
zd$>hQ*>1Nq)ZGo%J2OQbC}Z9(jqm)j%M{Vgus?%9_87x$^3{6F`vT25e|@>N;6{Nc
z?_(aY7yP~~1Af$HqkxN-T4fio=~|_QFHwH4p_i{vn*$xaa;frr9i93rO<S~I&{@~?
z!0wyR@BW1aqwah<3PmHPYikz$M~m7OWS>|2Pg{jA@nRCBEskC;^&Ty#h>s*9`pVvy
zzeE!`yTnwx>9E|?Yxa*Vf2GSZKj{IV99=#wmw!n@3}>`B9`}+RzF&q<nk^nItt-AH
zy5uE$*BSpM)0J^rO*)J&d&v{#9JDluxzcB74qGcp*lWhn2Ow$DYNyeqFA=u6)w-)H
z*sJ~B)}{Mo*_tf-kR{Yb>+dGZzjtxkN-yDkviw7qe~IcF;v!x3e?_I2%!F}7SG<Jz
zixTltQM$GICB&gM4FlO1O)j9BOe7o@^31uJ206Y*1BKz)Y^ij9uqY#HiGU6;@uMb@
zj5`4e)I(xSo{fUosDWH)Eu2yHmh^Psd3XpoWMt@qx^Vy?{Z1d-4e)lx0ydAifoZFu
zRf4L!+s~puMr^*Xe?||YYU#7`s`gdL^Q`_UdbGc@{c<OQn!WpIC)$4W=*6q&FRPlw
zsSla5qB*oUjtuiGgjRIrk;+UVe05dKHZ&g9ZgOb15yOW0Ip01)29}EoSkftnS!{^r
zOcQuI(R^&u9cUG~JB}Yi;FwH%)egt1-ZsEUcf;n7KEq#wfBnoVumT%Y(gayX<tVk%
z*O4en$|W7<Y%zbFjp<JxhrD!lL{D?r>%{;3MCjTtt|xMYBu|Se8;!=vIck)sS*$Gb
zt8jq;w`H^-n(Q!}<%N{@Q1+;bB@F}2tD4iw63pL{3rAm?=XoN0oH+od7*Tpv4R<Y(
z!DlT&(}x6tf8g=Q5_w>AfP52P>$5QIUtb^!A3)HMYfRTU8juwbtHm{A=nxI(vm#uU
zUoO~-7Ir5ocr=HXdpaP$28jYI1=wpwMF%JjE=g9g@5B&yC|nr3D-40Zz6>tXH^^EN
zThp<G+W2_seIIGPdsMh1@Agvxo799v)<n0U4BVpZe-XUnL{ECz3CYhIH~106=SCs<
zpGj~32EsF*>$%C7S?aZ-mmZi3%H$zOq4EJz&Z+uKmoMi&!j&_;APjY3I}q^0Fx8x6
zw3^hY$t%OjZfpaSj6uP>(NqPA;Gx+>!VL>p<y8nmtYo1u|3k*kp$GC4vz2gbuV&nQ
zrbNwff3Fuk!z?ACzOhI_Wrf2N`&Amp`zspnt$@70-f?YxM7VD^K-df<pCDnuxU_HQ
zP|#ppje1{a(_<XJ51L<Fr~I?mDod$L<n8wtv!m-t#*=xUsI4I4hwtROANtDjJI~{3
za+1ySWT{l?=hn9qfLAvJO;>6~*B8#`i*CPVe@?*yuLguedc7}P`kgKeW$8QNcyS<A
z?v*~~GCY!6*M6sl>93I3HQZj)G?%}*b)D}l%q_U*YAs<u8`%PqB07irh+(7s(R583
z`k30o_QJL`u?1GwC7YTUsfOAMx?vvd@y?~2ypX8igYN?}Px?OY-sH!p*>NPraRqC$
zf6Q=HY+Er}F4KL4eAqq)IUhT4EmUp7CZ4&YWPt=d5J$|?JPxao45wD&ZLaXuWKxoj
zbUxbQY_xkwoS<=g0V{f(4H(eKxuI-jcHP%_Aq<(DrS~M`Hnw(?mtG2RHT9iMKOuEh
zT5O+(i|sgrVJy3`ar^+j-UBrk<is#le^S<&8=C#n30IO?VW<9hLoN8EVwALn6*SQZ
zO3GH9rbq8Bs;5<a9Vr-29bKk)7F39$E{SUNra%_P58;r%L6O$oj6v`STrR8*1xE(o
z_NSJc^nz9;2T-}KM&lReGepNbb%h^iaPM+_^ovO{J~()4bBdn~<25Ck02&0_f6n#$
z;fK@qg|6cj<Dt(?r;>w{yaC|BK%i@YuXO>Z#6?NPgp?#Yu#_It_ZD!pmcE!?M*M^x
zALscfn&xrTq&pBdn~aL#M1<CaW}%52{tU;pUP1d3Qd6xf4}s?<7X@TDT}zu@&MMc8
zqDdl73-NBch@67I>gtV6%4W1jf3sNjV*b(J*;iD=8|--cswUQ^$*PhnrQe(2(9rX+
z5u^YxLI9mf0T19TfGJV*%<#u7A#Di*4!u$6OQ5(IRL}sxOHVjIOqvJ4^hT#WC+74z
zOkm@sf`J!?cw;aKXF){J-sFQX?Mh{YupjEzI<T3#v<oMuTs|1gv-ZP6e?sY%%j8L(
zmBN`R#U3oL;iDd(<@fN{GS-@#?%Zf7_e7L?D#|@<n4OxUt{Wt%W&gdm#bWz3{udCh
z6jp%k7NNIoTy9Zts4ch_+2@>-05%k$BDEg`Pv;BeasyzOB^f@NS8O$7@=X1B0&o!K
zJg!I)`X#c~o+PuPAxU7mfBj*({ry3thG5Owdi3<w!ONZfgXn?QMX?zgj1bB*6<|Pm
z%-wh-H-M9nB;zYaJJqL}@p;}f6SM#$d}HLugVdO-4Pr2i%ew(7QbFk0_`#<itRGsA
zRQ<vLEqcxM6k4Bs`T3v!a&POiyI=nKFRgjrL>ZsvX3Gsh!fQ~Wf3p=cG0~X7Y&)NS
zcJD9kVRFX(8kS{HV_^uytHcN5H6;EM1ThTb7a1`L4LZ@s8y$6tw{;?nl72`SCEjo*
zNcb0Sd$So4HacDQ0&w7w;6vsf`@JC9IP>_huVMiLJQg=DBQ+<k_B8Uy6oHB<CBzsk
zQQ>td#VEUp5fg(De`?{QK75^ykjsQ(z)lRv=Nz0OHL+txk10~N4;zPWwPdT_5}qVr
z2A9PEjH5$EJTN*a+EO#V$p^YMFpFy0|35bDgaB6Jx9Q)PaV~oIb^NPLZ8{gSn%4}i
zUu7b@Rw`AqWS+P*O{QR8xK>DY*~E06py9$ZAFSTnS0FB~e=Nk5$a0kgBgv@>$mCRL
z-Y(@HilOLo{DYwrm&3>MGp;eKr~rcmzE*2dFD>e%>>ZZZsWIv!sF~&QFIO~Gn^bp|
z>5cEF69xg4FHgdh+a-|+Iy&p{{e&iiT#|ns^3Rl!PMfF6DWIlFcWP!wO?qjwpS>wy
zt!QQC%Jbw6f1POp%IhJC42#Gx^erU3=*V-vnP^Fku*$V+gt3j#!#Ov!rV(QHT#dZo
zQKqzspqm9KGL0fM!)=ep(A*3VPi}MGs9sValiR0x(_QpYUAHY9Np1w*t=mpnqg%oQ
zOBj&8y4e-S9+IeNM!On=7YK6&gj$}G(=he9h@8=Ie*n7<iCJm-dd11S&MdDZL9!p?
zl+T0$1TG(#Hsgy(3MVYWW^B6>2)1qevJE`!y`bEwMUe$L0FV){{&bW1*JgCzl^%(w
z$9!jt?`&0epC9b(zl?UDzkCq^S0MUs`{}ElgQ)iDW~cLV=RaOHsBNc1_v_LA&dXQ(
z&v&0ce~Io0n0=LduQnq7W2;I-GvB>ahdA`XzCmcN8Vsf?m@7WEK<=<~L$mR?jB{dq
zRn_be81L1t6vfo7uBPg+6n!lCD3<`J1U!SC-GZuSyJNz5uc&dCDC%60CjTJ|)sbbY
z&4_8#7gvjKZ^4E-tFK-$>7=2p>+2<wCAvjie~PBrUxWO_46Ey#1uP=WYyFTl{kJ{a
zeYLZA3b^?tEBkMIx)HBhT<WcX*6U@xbXoIDm(_<Lf6&6}s)|IqY*GD+CdY6g*tL81
z(BTiorS4&^hy51*>G?I+4K4lYzxP&9fc|msI;3!2GLR${8FH_onHny6#XhAcDh?E*
zf8Pnm4nlc8gb@CE_5S|r^>+7P8_{3ie`nupId!nT=#RXhzpvH175E7XJKx9Wtla$z
z=Fo!_28$b;FTGeN4qadHw@@-Pmbx8*0PTUBi-L43dgcn50B$W1$yeA{0(-_jeJf{D
zpZj!@m{TA0Ne`!V;Y(1+JWH05hn)p|e;~3bKx+#9PGYJEq`)2kerNF;m$hhkd2GwY
z>)_*ZDzYyGWn^jkP{w6cq#zD#l0TyqE4%DzIU?(jhozvGuuQ{HQ1T|hcqnE>wmzA0
ztt}YP?cs5I(Dk<2@z7(50R-V>b~>uJidL`>;XZCh9koF!ZS1F;%98f`-VJ5Tf3GU9
z_8!CY%Z(0pUeeAPZPClLx9`8*+21K#+xqImkF6U@FiW)g_@?t6P~qj%`sua!{HHpN
zp9UiO&o9b3j7iiTh$U8*7~#P^W+uMM9={1@!~CA)m4`TM`MjUc(%F2LNU4!hBH~7V
zkG2UZ#H|ehtcz!cQQIoActN7%e~?QaiN_rmnDXh6Q}4Qi9N?KTSLmZ>X7U5To~|fW
z9u-!IyQ|sY>y?9@r#p{cMt7ob_Fp`U!oF(UR(S!Jq2}P*am?Oou<BtNj~INmR=}t}
zSO!%cp!L?ZM9%=$<EZBc(+k%R)g=1nsliATzCtP;VvRVc*?E>db}Adrf5faF4+A7#
z9WM2QC!2zm?`n6|dN1~Np5qRrI80$5bt+NWZ#vAA8Lr}P_vQA(r#tkEma#6t*Z@yJ
zu)l}T{ha*g|M|a&XjT_L{G8EisN?(|ox(K2(_$H>se}eM^LubZ5L=A%ruUxL1@jrU
zJG^mp;m=vNOMxx(WVvv42cYbQ5Pu;irp3rAB`N~{WSVk0cK?)C*l{#;3B4$JgR<MR
z4A?eFOYdzc8Q~o{%_vCt;^uvS?VhzdK@To{9q&y0M4>wVGNFm%QP#&k#B}C2_`uT(
zp5gYL#n&aJX{A5dkSnoIE`jur*vj5Cdvo!@1(AqMCg`YMC~aRf;n5euhJR0tTz2q+
zm`NMhZ__{&V<>HG<2qyGn;q7`e<g3hmCMlM1MrPwNu2iZoF`c}^n7Uh<;(3y-$oms
z(f~ShhU#oXW=LqNoy@lpZ6ClVSbO=8y`9Le)2UiqAW{e=K&N#yO_T93*E96Ph4ex_
zxSvVQillZgq=1oFO??-d_J440Y%Q!!H%(@9lFfX^?v(rK`hI%)J>W|n_`M#vTM@fQ
zl4E3*6k|YN%x9?1c0=f=YXp5?3!-U+(ra#hy76e#ogx&prgU9LhU#=m(lVXF%9k%4
zVW~qljibwADEy#+s&kVLZG_!?5Rc-ibm&GX7vFD$zDGnATj$ppA%BMC`pf+shM(+4
z7+*1&OFCRShc{Z36(d|ehw&AYdD#fVIlS4TB**dK0%S+KmMaF-7ow#fCV>8iGg2z}
zq`=j(idrg+lCZ-dfIEswT+mDwHthW?zQg$5rsIHH?yq}ap|*=MlTLI<((_g$y7z;y
z!pmN|f}#u3`RPShWPc@-&^O|ZMzqn#e+C=GkuPt&iFRA~&%KQW_HE6-DvTdLqUdc@
zrIBt{J5e=;=nqv1Kl=LP9)1j}(YwY%`^~WZR@k1DsCQ`o1O3OU4I^h2D$AVCG*>~)
zGh&>3hl3?eR#)ixvKz!P`l@8X!R`BNy4!W<19vGHFHuA)(0{|ur}1PWidgRtf9REi
zlL7%|;}3uM{#p0?7yExZ*xP=z^M^ldxX;~>&+QFr>x+-nPd&*->|J$&I7gvKJqfl1
z9F3AUX+Is|#3zYc&!ENQjU;$q`4AQZ5rOC&&)wr0vb1u%TLTyT5CmtWFd6*1*X(~h
zgo`lYusDvj)PJ(wMW^G<tD4`|ZnY>v(|21}Eiabj1clO`y9#MxfGd|?l2Q!P@?5L=
z&N;yWHXt9>({SmwvTHH~{*LCSW6^85Gz_s+sk<1TW$91>D1TH4Cq%>oBE6x3oTW%x
z4w=GwI!)7R6LDc^7AB5>VvruOhgDb?B%3)$Uy992Y=3whRNK@L1Jk;=B;Yt3H<Qx|
zFtvFhTiVRm57x@8BTM1rGQ<6Z3oJyn?Sn_VyNo(kZ$w&rxWS1OV-X^AEGDUF-5v~q
zNzAdI;|!%LXNf2(&@3)a``IY6bwap;;`|7C4YNdTa2z|SQk{S-qUr9DRY(s$4k$|V
zQ!dNH@P9ykj`=ViZ-sez54*zAZvHsfnO;uHe==r}cc~^hbBXPk^w&^x0kkwu-XI#B
z_xF#M$P7hzl#ChHz;_}MXB_ZAUphrSMXR5fTWMy?-Q+4&d<GRAszX}%i!Rr5oS$}S
zB{JS;&g}JvKQK{pcF7<9K;xaKw3E(~<76i6Y=4jdkBE4L@*Fg5M6M&|@TE@F>SawH
zM9T*uyvj;?g|<~^i0S!$dsr!3idZ6>qySw|by6v>SC#LmLZPqvkEt>MRj;bwgxj`L
z*q~6X5bb1qC#9np&&*==TtO0zb&$`np|_0EmUKL`N@3DP926Pi-WyByuF4>%@oO<`
z2Y+eF8gBIXp?%FfH~QmH#%v~7N+{$4wT<-!s5i)@6}<!G@93K;Itxl1D!!V;-sixL
zac31*C!a$E)74;v1b{`&oHa?e$z(FR_z>Fs*(mUDNy3nir>T}Nkd-_o7L<pj!+niZ
zrVKOQ=^`G-a7_sRdz0oaBZT>;T@W&KjDN*4pX7voHO`A?w5EN;(f-cCOBYbJEr&EM
z#hG#p;T}0h<-m6$22jq%%4jfj5w)+pKww-kEbaA}*bX*_l=xC4mLT;m^Ej1!qAxql
ztrGpL6fdY1D+8u$Sj+NFov2ro7(ac>kG$)(qHpEslc@#=fbV3Q%~83S3-o!`kAJ(S
z-xmcPURSz}oFIiwKs9D~rHUu5cXTA<)_M9mB{?jW%1QXurq*58nvN+XLGfe``0O*<
zhh@PaExnA`S|~}vy8-f7yA60}u2~e8ATkUIXV0kcl|5%biS9>lE0KnU%QQ6Tx5RYI
zp@-if;_$wOdHXAQK0?XTLMIwx7=K=yW|@G3DxOn!lAPN8$~*oJoW%^{=B%zh%Fk#q
z)=k629ej<)-HUjC;oG8!I(@V}Wsq;j=W%K^cw5RAYovtOvpf3InN@${8{lN@6Qn6D
z^uSGO0<7jcc{DO?56^fP-%fI6_~w1F;J6p7ZpOFOx<gl5P{zKZi|>evW`A_T)RO5m
zo7VN~Ew6zu);65YOM1lFKr$O?Uh>da!MjhU>XYSLB2aMkcN%aupXD41Je9=MSqRHB
zk|~l7_+cI%Eim)T?@(%7IpOu|=URQxpjKS_%gwu=x0NWG@wA`Lrt$QmDRGf-9Lg*;
zW!~~;P-d>>_RiH?;;Yh@_<yRjCB9nN5??KDiLaJyiLWZ}zN(Ns#|ax;+0_v}wm@yz
z?*t=j$eMMc10H3yWaLavv#+YM>LjSwZYj3k+h8qrm<FnX&cl+bY8ot<x2knnC!_AS
z5!;2{ITD{73v?C@tS*H9f(_7)+&x_~P126muXEoObkTueD+3$>G=H<drE?#_Z!+vR
z_)jc^CYAJCoZ!NjZ42{dnS8l18|5AC1^-ic(~jh>OOtmE{Y)J!BB|Y|w(1|BPB*vy
z@|mO4>r>~1&(ez6pf4tTMxF9>;^ZAZCY6B>UjFa)_@bisCi%r6n;dVUa&B-atjhW-
zo)3c&e4BnGHTR}^$A2vclP~|0T|tK>|8jdmR><!N{vGZIc{tn+!qiqB4;5ro$)3<X
zKo=YIimpWdcY-0;qvivil|ybrGxLKC{dV~n2&SZPB7j8`DcVH3L%|UhCgHw&`C%2m
zt3Nc{eN0PuAHT!<n5ghReixqCnJM(4*TQx(#bGPC61LH44}Tl!rBW+QKIT4bxokn~
zv3kX3)uQrAc+BZQ5T}&PB*|#^c|Kcmv*w;!ajed#E!`-}RIL3s3C=c%$IO&`ihWF+
zN*@VqOG;1YIG@q!5gw<f{Q!a^S;j4{s>11vCkJRpj~QjS3!bRX03gni7sFCyK{d=_
z%Du&=vax^*JAVOWaCi<GN>}=ZO$XyW1Tx&=-5*%O#NQAIF_Zu??gy0u*foSl=smT6
zrIVU=)4*8jbwS`I)}IPb{-IKm9w1MA{8Rahm8Wu%$t^7<%2T5`3s$R-hAOf+O<}NY
zZ%{w<uOy({UwFHU)K;O*0??4@Gl-613p%orKCKnfwts}rUL|u&D>>h2vvn90pEShA
z`-tD}>{~5uzppf1{F=%N0a_~PEHF(?R5E@^qF;3Xfjf*LmC&Vna5_(uAGM)Mo}M`E
z_q&Szu}l>AwJ6x4;}k@FBp6d5mN!&FZYcfd^>CCc#dXDE@$Z)TGgeW0Unt54AD<OI
zKb(LpoPUCMQ39l$VoMU^&yt#rIcRJ%rPt(N{P*JsG92TNUH#{kyIRUGuihb7NFBe<
z4!L}b=%?o8?NK27icm|Kk{1xn1i&ahEX&bqaXy^5&CTy?@*2;^9$l%u4dgDKXP4FH
zrD6I0;$2)T%gV(T4w0iIjul(k^+q7^m0HlXhJSGitFI6be-sM_0A7l~`YLdA@E<|6
zm#3j)e3MNd`Qj5DssB-8Fi+Fdlm@YRS8mYq%oDxFm)^<7D_8)4K2WfFIst;G9cO=X
ziK2hVho@JB=$VqHA0DfhD&#a607Z^ft<DAzKN_l`r86~*imJ_(OPCFj=%Q>*8iLeB
zoqy|n!#aFut5X^I)3^MJcRgVUI9=I_>&CG?I*%{%XyCY=%!T7~3ZWymK*V&Do)#KS
zcp8+`iGu%e8P1p2VmQ}OlT0_VnyO3%5czVs)OD9iTGJBNr8*Knx1b(5#<fyeIvQp1
zQgtb0SxfXIuL0?ZeT@U%kIp_o%~=Vee}7kKK1DXRj7J6Cmv$d*g3_F=P>>eJxu__y
zBDAF4N`+`i+og(;e%Z42c5gvpBQ>_RtbbPC>IGe?J4|!7E8K?xWywR-=7xF_uG}w3
zQP)+NsMV!96I_u6%c1HF`Y3Bg)aJ&T5gslpM>h7NiWC?!7fqN%r7F~r%2WTi41eS=
zS2K`pga~AjVsMw!u2&>o*Lg~oXI<Adjh#-v>@@vX5_&4=bq46SfpqC?oP=PrhmVuV
zC|e!zdAB>95_jgvgdsN#5HzX{^)O19c`Rw_mWl16b-hnU<4(o3q577^QyhMSAckNd
zNBG^|?BZWd($?JULsG25hVv0v!+($gehUa6!fz!weUt$RukuZjjOZjz1iWO~jBUV?
zHjA-oquL=tC|8GXd?6^p61d@u^8~>gcpl*c>;Vk4Y1-Wu`cOj{4^cPbq%TN~C$S=5
znWi2z?Q&C_6D{7u=sMR*a=$H4H2I0<EIy_o9S-8bNwV^Lw?6BlK^UHbSAP@tW?Rir
zD+sL)LE8Gf>l$~paj;-Y<Q_Tv)$Zzvu(j*XQ+}9p%={kUJ=F@DX*ttqqtIr9Q_Q08
zr3U;sc{BSfwDQaa(TH=I{jdNORJ0wl5=bBf<0CP4$x)&aNx(YD3!Z)=e8fWl;G7F4
z0St*Fa3ns0qgVi%5goeFD}Tj#AU;34WKMk~7t^7(52h88Y34925K|Hy&WF<vM$$o#
zhcBn;@v$X5$eV%=XL7f&JK?}apa~>G85D_3!MxM`n=l2s(gYWPU#Nht1g3D8!M~Ms
ziX7q){A1~ps~HP0QAzcmr2|9~(94~ZE9a_}#GUQXZ{}LZ5+(XlgnwIs^02U{g3w=p
zis7%u+jvrqZyx3+@wC9C@-p1{W|!M^vvHRWDZf3#d>@O6zyA4FZ!xGO^y7Iyh_ASC
zg%G*wU@B?@OuP(nlUwjdKcTmBki{9P3>t?*y}?0#!BPT4D`{-Ijfr;hL9q8y8n-&+
zCG=&QNPyQ#oD0&vqJIJ5c(QD$Sku9j=A*E~G5hB;`VV5^ftbt4ehi_a0Qe5@rGFtw
zQE6UmAckOM59*6)3V1xRg2dn{&0pc+88AtV!2Xm=<7J-FIo*)chctjN9V@7dyQ_mj
z6^@uh8AY~K2IE*AJush2KwEhFf!L97${1jb^*P1i{c1N4#DDQa0NOLUJwSMcz`kVq
z@BVX6QUeF674|;jp@8-mM)thgZA9!{#PGz=czB-lPqOUwCGn|UYZ7iXELbp4i>ocd
zPiX^I1h_890xs}}NI1cDxkOEZugkD7mU^<d`-|Ov#@!Yy5?woq9THkso|P9u^Q9G&
z?Az;bjUd-8YJaP;)wc4U?Enk2?aPi?@T1H9l_T_$j}gG0!Z+zSNfzlt)@={__8~ZH
ztEJAWbuoFDE(hORh-K{%4}6^FlTlp6t>yjAECE~+^<Gxo=KLdzu)(?-nGcfDh-Qsr
zUpW2RE@Eq<A)aO)3{*I=vrT~{Oan?_lfWU4-<54ff`1hdBF^(g<g%sE5sR1}7h@^d
zCv$L*YYAG>&7*{OGfmC`lBr236x3cx7+jKKGt08*6d}4SrHT-qycwXx4S&hz-RSP!
zyW$*@m$R(6z-S|jWgIX}u7h6=@miVh+>^Y48OKr4xA_=o`!3;{obQIP|0Yj_kJpMk
z_rO;|n1AR*Avj<`twPdv`&hO}mmf-orfY?Kh$Ru#b5_31zLBqKlr6)`F;=R4FXu$z
zlN71S=_bC<mJc20+_}St^8mECKOeX96TlfBJ|`ygBcKAt{D%s)2v-ZT(&<-gL^s-X
z4zq^&(jAe(cc_ja5xfYGqf=vwEVluUuiVO!cz>9(ltWUh-x4Wj(f5!rt4qIzje3aM
zbsq&x-QCAKji6qfW%c4<$F5=%A;&B;^f4(RsYonAzqO~?;5Fy-PLipAb$F7AX)M<~
zRS8%&4FW)E5>2o5ot-$yRi8%}%ZllI*5#Yspd@tR2tkw^pNCrQ7vFMtjgMLOuFcQ7
z;eP|jfb>*YJQzcn17ArTFCEC?iud+u(60-yq?%cw=lLO!>tf9(7|ut@@Ct#taN0Kz
z=gy(WkTdw}J)vA%u9g%;=D>#67h_>_q^q;20mwkEFRbMQauy--YswBbMI5Fp{_8E4
ztaH|f4j*Nx>~kCEcD=)=e?V#uemD(_<bML54QR47(1MeNwUh%rc40ozKdD~_68A^1
z`U|*($Ki7+5u}~7aM$o~e1Tq1`=3QPsk-q&i63>$M#_rNWIp34<H9bQ<z5iPTyj-f
zB<4yc4tx(on7>G=N~LbIz~SlyYZ?GI&ygs@adZ)vufg{{Xw7oP3)0^zOJBsNBY$L-
z9)crX!#0+W;=$|o=GLD-Yv;&gA$FG2E=QSf0E>*1QInh0MXFa8X3_P0n42(8Tc^y&
z3TQ8#VvOAZx@8C7CtTdI5CvEHB=8;4KxQrY>YvHrlv8-gTe|u_>1!!RMtgy98|mj%
zJ`oQEvC&q!w;B!L6aCgsq<=K%8h?_lI=+X%gL>(q1*Gkz$dn`jCbK;7q#zbULCI4{
z%1clwqidm3dN_$0#7NCGl2CiYc9c}c0`g-gI(()(>Uu^g+ka})wEYUf^trRp23?^y
zWVH|4=_!s5>)UWJbCE;+vk*bIbKU|L?d?D!uLlmv<sKWMRtL>5;2b4@(|>fP71L!E
z)ZOM1L&Vap1p+|abiA<Y*u(+|i=lO?8Ayn2lN0zrqmwx)1WgO;F_z@O`&Dw;ojHZw
zb8`-0n58o))`Mx5=b>D9RLrL!owa~^+T+ynLVACbL0@MlG*+vsV)oSeI3-cBP+I3i
zN`Zsv=YAdRf$V&oOh3TvT7UOxGOkYsmSx{N_g+fC5j0y#?-C<wR69J%LN$0{9DnX|
zLm7v(4Nbp#rCyi03DBHnip~qD>Vonb!cdun#!~}xL34#+v;^kSMcb}x+nuKcDM7^g
zX>NrpU<a715k8<7)e2GUWcnIK8|5pW>b{~+D5MC<UFFG09Ru#~wts?{crt-}td_z>
z>Eo`5A1d0IU2hv<-e>V>vAv2bu{N*=*h#JK?8UcysWJ{4b+r*2${6vBPRnTqy!34K
zvVV53I|<qqETNi^IWRPsnJ7&p4>MqFP)OFqT6e-6Vq7J|#1}l+)#B4jN&6Yk#UKGT
zWTqI>5u8{9gWtYr5`Wj@!m4&)HlGw|?zSVV<~&u+M%VLt-1D{xt{6V>`UhcQQ<hld
zDZ9i4jS%^-PA+OeqK+vo>OJO+NK)qEMAye>f~w+*^QfdL8~~j*Ih`QQE1Ym350Olj
zjE<xYn<k~vA+7gWnrH#A57~QQdtT$B|5RKxATMed$8yqL)PEFVz!_cBJk^{&OV~3e
zTCpwcprd5y@@m-Sbjn1k)M5m}E)Ut98CaQVy(NWe*3@pAO|)U~Og6-d#Rx!IFAv~u
zK~6w-CWr2ZUf&R-53Eg4gw8Wf_mW6Q({PJo9ZUbDU`I98ITp2QR!SWPcpcKc=-9WR
zT+1m>`u!y3RDa`MsG?HG^`4e^@QIv3Znz6d;9S<=(SAmn?Q{amujRAOd`VIjKfO_c
zB+Qxn@>5{LL!`yXbF0r1=UjLdff?=gIP1?<E2STT-$Z{*PWc|b8(n@xv&n593rD4C
zz{*=1*!PT=@lHsxDnV}$*AeuP|J!D@5=g1Oq=s=c1Ahh(Z7k|R3+pWl2kj??6S_ju
z!Sq7Vv?EV2;#8B-v03VbdD@IisV0G*CNFAPHaIJP9yShLxnh#K=@63_MVqZi7_jUJ
z1POk)-sU$ly<yAVKobfR<?zE82%|wJi5M<Tybm;0%{6v*e^lzjq;M4E*ifK?DJd0N
zgR}=2J%8Z}C&_36E@Hp~@CJ!S+KRqEfuV;ZQt&p@G7~W_pAZKfT`>O2=_xEGL(i6+
zv!W8&D`~j|S6zIkHF#Fhb$~u8D+KbrC7@%d-%>0I%*}+9U1&aIB&j!+@dtQ3IMaxB
zTA<=EvGg#s?|g^}$YjuT3O8Bq=3EP1d*njZB7bDIHAhsOT;oi(6Bo@IUldMv%u<WZ
z>5B$KJWE{80yOB?=H0u0SU^byQ*Hey>9yEKcm<!q#1<q01A}fAKu5rh)PfgguNIA1
zk|d$)z{j#Z5<-quBnz>j)pK&?<>KWDD(1yp!lrU~HO9%+&Tx|RDj&n=4eYUVuDEfW
zRe!W{9({x!iVw9~0M62aF_xd>4S>?p5vdvTG4H`L&E}1O@GH#BW=iZzHFGJaB6^LS
zMJxqQee6?@aR?d!a|KLGVvAVeb5C{~9iivRLRgM^3StpUuW2c~c3=*tnd>pZ*p@J6
zsULx1|BA<G<rDp;x00p(&Y4M&Ng*c~=YJ^^mvRTFq_W%3KxTwAC(W?_ZJFg!cHH*Y
z@lR9FvwA2Ifx`rjX5MPzJcT<TlBcH&ZUH`+^`<EawBRIVz|zEpN#<;JV(ZH!;d;4}
z32Pz$@~&bUI_v2k%tc^#vPeS(6{#~(PqA}dYEd|WPr=ZY9hM5jhUxBRRtqH*TYrGt
zkpN9DmC7AIvK`LBF(Zi9=L!4%!R4K<$(R5-Vu^kckRR1igUFD0v8Pj*)wDQ`FeZlT
zG-=`N&n=W8mGsPyHXZWm0<;*Gi*N7=jWShYt@;A|WY#^N#*=@Z{ByKiqw^MRcT|<o
z3PEI^+dEu@o{glZ!lVK;fWQCy!GH3V;o3{mz?};MfdrXQiBupZoYcXPo@Ojyj0jAa
z>tvV|PLk3gB5<vOw4pVUeBG~1!5`H0xI|o6H(3Z6q?g13iBqNlK31SsmYI2ZZm9~v
zaYpWAp|nV=ZebEcgIV^3s53k_Y$8@To_r8b5JZpoSDasp=RGz=5smeexqqrl+*rz6
zA_pqaRB)>p)B>M|g%-SsRDi&z;yK3kB2AbXK(`G$u-~9uA(RI=(jJYn`7k1#Wh`6j
zfK=S(w;88O1WxEgBn#q*^m_mm&xmMp3dD7ypLiN#yW+^`u`~c3aWv}jA1KmB+ojj%
zvP*h{hM|8Kylut_a|@1(mw(SC;|CRS%3*q>SA=U#!}R#7sUC(OcPg+vB^*=emql_#
zBTuhph%QXd0(FbfbRLgho7GQksGJ-a>qcjV_>eT7Gv^emcb2GF)ZXh-4KB?0@$83-
z&L_1Vd^E9H6VHZTybRsOGF2hqyPF$gm<|k#JDD5up-G=WT!BhN)PJ+gBhTRQ&h|yC
z8w$J5_DvT%J+8TxzKLo{>$ny5RD8R`YsIWqm1k;eI(k#Y-GAF`eZKX1>u$BDW@=Yb
zUEOUz=2Pn5UMpcbG!{qu1|aqjLW&hFK4eWEVdVI?9@To`VGUR*cSgwH%-Zzt$!V_+
z9*ix<ut%*WmJH@i9Dn-2Usbgkz~+{(=TF9zEs1lW(|I0`{_SkDb?=MTJ$^mj+qIm$
zX<iSk5I35~N+1pHioMF2z5W=f!KzYu8fb{5ZdwbqGqSm_!wBj0>iJ}7$-k$}hMe|U
zab(|$_UBS<oKBxw@6l{ZobFFij~Pi%0zMHPc_HDBa_DhXe19v%(`6a|M1fCeTz!Ce
z(j=pxAa0s+&niIh@<Lg0Edj^|C5Iw!HB3bdaJCTd(P8z)5V8!|9l%*}?#q?ZNe+Q#
zfg(6FD1;yZLI@3_su>k9?n)6oUto~6LMW~ssW%uJm#fZREtcN!Uf{SikDz+tmUJ_V
z`*^Vgk@*n+f`2o}*@aXrk(kUS@tDpSTTIvtcpnb(P?!u<bk5|P(t|UpN>N%g=wph)
zsGP-zrcbmWXs@G-I!%s~H%t^Tm}9zW7`;6K3h%i@e=bEL24OG`k@vI`GmaAGl`MoY
z*rCE22AGJQsQ14gZa4q8xcRTU&A<Hcr%!vPT+%k;nt!<v$i*helK8+1YH~aQ?4`4W
zHVg?%Bg{g|k@2t7p_ES6!@&C{iZLC<ko{R+tONrc`ZX({pwI!k0$z-9ZZdACL~#vK
zXfy3II0Jn?N!+J-A;FegkZ3gnU|p_qC&Q^8T{kL5+?OYD>U9!}vf%_D5&GEO6N~x9
z4KKDqNq;Be2F?vXFAr=+;bH0gnd2a76j8?7S7?YSD2OHuy&h-hEEsU2NMR0F+dwwE
zu5mZcS(PuEKuDXB*JabeNx}%;X;9@ssI6z6)ar7;sSOe^Yx(P-B!sla#Tq1{9ma=8
z6FQRBpJst7iZ#gIb#@m6KtU&u4sUS;K?Gt8n16ya+Bj&F<d|B7sgv@E=udh}9@VA^
zB8S9HpKCG;#PgX%#v*9SCT$^5tS!DsnI-1}S^Wsqh-I;(bf(-Qg)Omcty__2q-Nt}
z^!3o|Q-~2AW-WjVd9T_BC3%6r&9ZTY2zZpmp--KSxm@&Jqxhs4Et_azJ_diYC<oGu
z>3__gvd_<GHw=$ER0C<U+BAOev#vHO!sE(dn*LtBSm~R-suIR(XhYUII4%LZ#v&6~
zuaL|FM9T!_yY;(pJT_z_o{+3irRA!MRa@&bVKUh45kb0WupEQ9;yADHP63^^BCLGw
zEVhA==c7Qaf+@XWwVCqs?kRmU@ultrn19(Eh%m>w)J3=9GP0K#>!|Kerf3K-Cv2UR
zWTXY6rd~>1xS;$f&M2o5%?q|{cYr>6y1PsnxYwm~EF7PUI)xSPG^XuBS~t83O)($4
z2t!1HsxMe_(JGalGX^$g`x=NIx&Q|?BXANIh~vKwgH@t$Bte30NGdz|X#U^;;eRfy
zB*+KX#V|a|rnGKq>t=9dHTjKA+CNRnGH(Kwv3Z=;8&bVT{AOW3jfj^T;VMk4A;&a0
z*^!7`@pLwyh+&;uOS{(6<Tno+%8^DZa^KdeZ@-PyH#WRqKje0uRd#t+*?65+woWUP
zv@*+L@n{_Eq`7YXN};g1<0D<|<9}`YPIPd><q3kI5``^x4@y2n#{%{2jB*3QM_Tdu
z7GoT|LiZiBqZnciUzG*lXq5+p8QD<es2*+BUMbj=vr}mO^3j~N&Q<%m72RpSV+mop
zP~hlLYxNaTvv|>N#Bpz<ACw|<t%|kC5T>Hc3^7YW>6+&Y*onZZ_#Q9kE`RWLnv&Bd
zrn4zrrWxy7oBfL>lRcU=&jWK+lUm^#y<s9HkeX&2t{bm94Eb;|h%St64HVTIB}8AE
z<j6MMCArWmy|@9I-dmU}@)i+9^v6F&wMylaPrgaV8a@Sqj?{e-;o?x&)5l<#c&EzB
z+l^@B9X<Xv3E{MS_uuv|$A8!R)W7;&@7)7BcfM}N4`^uhcV(~#378jkl@!Lp%kAI|
z4>A7wax~T5yWJDSsAjZvk|i>pL-{l2v7Ju&n0YU*5xa+dM<IKtR1WR3KW@>lJ;)Yq
zjTj%W^8;me;(liAg_sWOYT!HB^f(@;|1#$}XPR<?lpyaHWB7cTwtsTGyN#$7J<Q;p
zWY|eHCMplJCL}m+@9hd-3eM?Z+7SDZ&BwqoaaZP0zh;~;ri5e}Ng62<akfWpdAt0M
z*U1GmF&@lmb|%3$-z5F%9P#p7ceg$xvBUx9a0j4<V5CNpRh#I-Bnx@9<;_)~N8YcF
zGw~`{A3T(!FFFzWY=1<wfMa$5%K4iSpYaY+^(pYYYxSxQLi}N^FI;4kQcw1-`*h1S
z(;kCdPE}l?Dhj5ymyXO`)r%+T-;#@-8iLil5L7Mx2{i)QG#ULQA!VpM6$H00Eno$N
zE4E1&tDGrS{6s29A|;d=kMo-U3+uhPvTj$_cU#sVTGG+Y{(mP$zj*HW+teiflPBb*
zG)fIfqWh1+|L7X~=4Fyr6It}Y=vBHZ%uHbqDGz}mN!%?L{+<MgIbbdphWSQFJI1<s
zw{;{n#pQ7CKE89uj`<_nt3$Ipz1n|j1Ozcg(h6prd&axAN({UzKzL$|W9go2F_0=6
zRom58#5;l74Sz1aoE#1Rb^PzUC$mhF4PNpv!M}aVNvVhfu^^}PtGAtT?S@fRp5Ck$
zN%{sfy-4HlN6&?-h1VzJk43`#eyro}Fe*~+tA(r`jzWx_%hAyglL5_~r`kP;n^^zr
z?PBicIo2+C|8rf-7=Z-C^ei2s&Y4oJRl_8eh~FL+-+#Y54vwMcMWPTr&QbhN!C5_-
zFh_mAv)VoEJ1U>mdfA`V_E0O$^q59vry-<RWEZ-MV#)MO=O1a>d^%@+*tH>(wK(?3
zUX}Q_6a9HRXc%t8SY5@aCs!PdC3I&Rxw(*BS4Yp#k7GaVOi?6?b2l6|;Vr>T1h&R-
zV+LFE=6`#0^>Os!r_f^IQNRD*^Dwz$Q@?+&JW?Vk4h$)5clv8S9l1a^qf4W_>&&Uq
zbn*ORZE(BT9SKuc@&=5QBy`wGqw+|1A1@9xY<ty6gFl0jx<NjU^OJrC;DZM;{5|da
zf%iT?z##lcU-PjaEsRtp&-Wbehl~_&{u^Z8(tn&H!Kn*N4^zA%9%J=kex!Sm-U~4J
zSuIjR5XcmPiFaTN_2Njm@P+(YbHP|eL|#n+YG@%p6&mcj>IJ5Jp1&VI#&h)e_XlMz
z{QW_|fY0+5sys7@_=2i*I+;sFGE<YdXe6${@XR%xXj)QeK^%PRo@kiQfO)mU=~>{^
zG=I240=ti{b2-62LzQ7*>D;|@2hSN3CgDe84MnbmqN91NVvd&*Tk_D0-N%oDCoMmK
z`kf;OYj^uu#HqE>SsF(#CdrtnTrK9Vh@d*UP_;TfGn38-9vGxDr{kkc0`h>_TB%5A
zGu)tXd$KEoKT4hbxwQ;oS<s3;Q-g0^bbnt|Q0aX@T9-EiI=M`Nr)k@F==8-S$&vg`
zghqe*EI)j{x!K`!-8$Ge6D^mXVIO*&Eh<ds`8HE6aVn8N3#t>%yxayS1H%Oc2p<)z
zK)`p343eIF#z0wYxPK%Sslc>}z#lMX30U|c^Gy8ufq6S^6nHWod0br^<pFz^+<#ch
zqm<j>V3}5RkiX0*r^#`d=t`s9mlkdky$Ppu+7wv$%2B?|Cec27S{`LnMBcO6q7hY}
zx1#UT>2W$v<7&OAm4=&&dC}6H_5MoO^*5NS7x1C~qq+A~{nNr9H~QaCOa6M#uCDbu
zkPR*7_H<k%mi_0ZFWHH}-YY&Olz+|g>MfO3ZbIYxeApO`;}>Wg@4uSGIfB0#nO`Dh
zeIVV>^X7Sy&zf7+`eh@pJc$1D|MLI&|NX!JZ_&<}!}W^u41a$fA{X*ZYvP6=V<XQ$
zpC6HQ##l4~1cr<GbaDygiIkI0)d(0kwqA)VDv-3I{NDQtTTMJlov<(kgnzq|)MeLK
z%3k@sqWEPJlzs{V>wMq2WUdDO-2z?)yY@&_>gD%(UN+&((Mu4EoLfvJl+U)>b%{1V
zq*szaorm89?+A@qoF@~G@Xxh!!Z;gq32F8}Ax53!iWRc0;J;%lD~W5X{ChsYun}p{
z9!$NY^lNgiJU4-7F6No(&wmH6lbMV3b7iPqEmVm;Da5qAS2W9SRBYpTmQal^%%?@$
zLD~5Jpltg44qym8UQcPix&JM<7yicoCssxwP3EqlP0mqm!-piS;J&}cWP8EtCp%jN
zx`+KN@=dAW6LKVr2JW%G*h}VeCfw^G=r7M4c89i-=Qnb1mARhP^ndDMQ-^zE<^f@I
zHMstTeoSeQ#Kqh=l_P^U6I1Saj7I3q5pjNwn~x<w%B6YGfzT?kbBV4PwI!UTeLMxT
zJei%2>X#0iSRm^6@ND-WNc5s6D*CivK0T0d85QV$JKK~^Rq^cPV0JNr1-r*m1jg;h
z$9Xen>2x-aN6i0{VSh8{_O#yluQu#B&}d9lZkZnQT9q!_laNtzEy<!=cf~f948`iR
zi>2yHwMEZZu7V33KCuK(7Of`PC}luS1TqRVXu*gDeXBfd)xx|T<hL~RK>2y7H9g)-
z((1d1Z+j@`qNwG|hgiQXP_>S;>{uO%zO0BBxSB9g4HZ&2o_{7MnVigK{Aw-FBR)dt
z4MQ!>T#lL_S!nvYb+{WuHd*Yw$D^jhx_II*@f6s=yPD@L6&*CDGY)4&#hrqA4MF#N
zi1ANEHZyNI7gc{Ew%tfWJ&azKhk<mL!0LRC8WSty*=+SWG#_*Oer~2g@VIvNEq;|~
zz~2a|z#a{3oquDlG2gUkEw1I+%%-W}qc|_wsoyF21#z#_vMDnd$*=5o3Py4*$5SvZ
z%Y9EbG)MgG_Pvi53h~QW`c{d9tOb<JRNrdtZD=gJdtlYUYN`ujg{5K7FuO>~VZ9&y
zGygKxIh(4hL4}{7Yq7R7e0fys$*<O%(^0QpkW8lIl7El-m0g20QtZ!)m#wlde6wOG
zlGjrl5MR^r(2FKleyWHhQl=~%@19-z&5bwUk8~CtjW}#<>pfYd_0XJd372$T?r$wH
z%HUoxh|c%J{E`McoDYbDOt*@LilRns_6l*55&vwm`GqkEkX!8lF{0g>hQDP}^uXo&
zYoIoxA%Bn@a<3WSHqisb=}KR;wuUTPLw;FH$hFN5e&vX^O|_ymlsR3gV2QI8yQ)N$
zM2ztyh4Bpk)YUc1uWPNgZxre0_ivxL)V{D_T%b=LI?wq>wGSL5GlAt30Bp^EkO6!Z
z^^l#>i)drc5*Mk-l?wq^?~+-Tcyg}L?{`CO{(o!rJ2lhcgVuB_AQ+`$R_uf6(0Owy
z*~;S=XX(cJ`Ntu%)%x{nh1y{o_JaVx@r_1N){l!?u>_`3f7rDgfZ4D_j1`1tnxz!*
z(I;POyl^>4!|S(;TCL^$g2clCd>|#e6Bv=5!|eFI&fcLt>$)kOw|cdB(&|$u{|tjL
zG=H<z!qI8kMi;YmkQam2MRm>TfWi4d%BUb{LqFHUVH848g(`~;@K@GXY#7&4R&=I*
zznaSLP+Pe)zS~yMBE8t#;WHE#B<et8u}8xwuE0W)OB7eWBADyC9BeYVWXyYR%r2@|
z8O;hU;09y%JMSiA*Li-(LA}A4`2uX?=6~S~C;oCzZrHLQUqv-N8af_>iQZjgM?J`l
zawL1SC3Mx-5f!4<9;Z1{Gv1GP+Ow{kGVheDfmkRPLauq1k?zrmpjKsy8iHVY&C?we
z(|#5>qQ3T5<A^IFepj=zUx9_KiuPU2g?<I5#iP{3*DfM^gRR6B_;jVU3Gb{`Y=26d
z9*Ftnf&CH2!WKEe_nL6)GgR~nwi1`?v)?}jHf2VXaAi^6TTk7*`<d;FZa<q9>n@6Z
zWM4$LfyFU)#fE?Z#rfSNHF8nv#|3r~Jf~jkgZaeg%^+TKdv_y`p6tD30CXT{n?-z<
z#HWCp?E`5RXgs52c$~1!y{W@(Qh&d7SK`g3S9+b^F&B5`L<>?Oq0vScBnzZmT1zwZ
z8>rWpEA;oclnDso=-)FyT)B;XC?LV<`1Nvzla9~QS<?RQ%e`k?|M)iFd$<rf`Ir=o
zVgLPjp*|{|JbqZ_gnTg=7dLNZ)8l1kZMZv|TCjslD!zESy?2Ri8wI^23V#}t$OsxH
zea0iLdI*yO0CDorE#iP|b6RZ%vkh~(*%cup4*)u}loAahoy<80oINnCL!eINAU|s$
zW13z|IxNuVxhl%PAmKh7W&P;D*)Q6sDGK>yN3&*(`%NOYz7**;$4Ddcl|tos;9{Zl
z5pJHN#m|A>dWtGb>L7rH!GFAI?A{bJN$&C8Ws>L)6t@5<-0)$~rzDuDehdWBsD}i{
zu6`$wqW<%L{;v=SJn9|nJl%Qp5+m4b;J;hZH~TN1MH~4&B7inmp47)T<Y_AbgcS!$
zKZ64^qR)}yr#h3=P(Mu3C0*si@~9emg%*W>F<v8I!NOqJlAq*3t$#x3#>LrVTLJ5-
zOdK{}E1hM!NY`?e>7HN@nIIMF)A^FhX<7$;k*sX&jz9v85=SVE3k+~mrdo{7B_Q39
zQc+WYzB70z&BOXwB4l`b-iI6S8a6G4Y3t3fIs-z&^ez8%eoBR!!$zff*t6aF=-@jJ
zy=S-$2w3sV;CXq-L4R#cyr5{=Wk8Vpf)1NE4TTP2d4{=JFd;T9e?D?Sv0@Q1!#m?y
z68q#{I!UAuf@F8o0z^`_HwA#Y?SCa%1|J9dB%9F!@O0~C$&`O_uj_6HGu&~6$H+j8
zJ#z}|`IKu&Ue%Fr%7m?OR?M?eSCzVc8oyrF%jPDkgQ3J2Dt{E~wDGn;DP%?RWAq@I
z?_A(Gz%J;J2D6i-*2%m-O7jz;K2Lgwr767nJ3#VU;5i<Ntxq@1MR9M6Tz;I)%o&Yh
z00|J?wAM+%VSP|`SYNvkO#aW&ZDAA5&Co}^^Jb8Y-s{{><jLF7Guz<OS@HaK<TT8Z
z93Z4xD@I}4p?_U19Gs;N9fGzCMVJ6a8#q%yRdV&8_*oeOjtE~?ja^mq37_G-{3;;O
zl=)*!3WOD&ueIKca@wKzr*058=b6@<QOHMNwj4sZ_~J9#ML^FOs{9RzUb)fK8%@0-
zvT1&b1m&r|47erkc=gQgc7CsnAr@3wVe~MrJUwl4H-FNzT+xp4!E~sg00iw3W>sTm
z6yc|qS$sd~aOU+Zp0xl<1qs;W8zYWbS#_(Rz$+p+d#)gO(9NY~)bVVWpLL*Enj>uI
z6~36AMjK1eu$OM$%Ym@9;++&w4d^Esx{R#Q?^N^=)(-B~Kgi)E)fT6@zS~QW{_T?t
zSEimpNq>&o;RLcxP`Fiow<Z@1Eg>Rw?QoCL=dK_8vegy5y5;dNg201~Q#AaJC#OH=
z;$4jgufd+t2JbIbVZPQFHUmKM730vEv!w#r_5turvu2Fp8t6K_pIkjJ-YnAbcWFMC
z!pO2E7KqO%0~lGfXW<f{-^&iKzjV>2tMxj&u77Q@md!`lcQX&T2N>X)jWO7coWv*t
z3AScb+dh6WO^4A-DXH-?d4p1?vq4LQ$%jk%pMaPB|JnP~^)`|#Z4~`&TtymXHwiY7
zoHWvwY-%VKZA~pwuJ&f@0g^zH%o2cvk$@<=to?i!vH$EFIKR&|oJ;wx<g9lM5s`@m
zCx1y*)%{hqy9&%9A~IsdiZ#B=*j$OT{xRCzc=4!JE-|o_jV?~vy)HM@J<7((^t=mt
zUM$XN!1`QfxR`mAUaYB<=$7*3{y1RhYa#E30&B^pfj}@B*tINgGzRH0p9HIX5bi`r
z=QD^GBt4|Fu0zX?9z-u`4qH2nxz%ho`G3D}AVE75Bflc@fuAJBZ=RUSj@NdlCxtYG
zf3#m{F~Ms|AtP~*g#&suv652UCC9UvWwa27HkbIt-Bv?~ih4Xjw|+-SubBJN$MLwj
zM{^|5(&uM+{0IZudnGfa?S4}`2~fiQ5ct8tF*Pz7#H@R93#(xd;fz1<Khe^L>woI0
zYL<SbcSPpWBD!2yxPZ%vU$D!lCvBhIoYJ0d?nJ|MygE2;wfzm%C*8eRFDyR8Bg2FK
zp?H>)#7PQg@GxeytDyDrFhU?#H#b`JG_i^PY*oVc9;_%l&`S8aB7JxDE2IS}Tz-_U
z`Zij?L#10%h^0GVj=GwS`@{JleSfebz~3van1tm?dbo*nt&J#!tsNB2{e6-N)|yS)
zp@70y>N?@E_4SAkvVdIqI)kUP40i-e;e+TupYQ)CulFjZqK!(0)YMM2l1!(``AUT9
z+1BE-bXKC~fPA=SWIi(*L+ME0-3&6)Y@eTdAkPad$-mr4;(fbX9B#b(Lw{wgg}z#T
zx;P9Pe&>hzI3IsVrwp+Jl`&`w<^=dH?7QbP1at@`(^9du!S!b!ZdJ0%yPQPPnz4J*
zkd;mcd~YY50{;xie8&wcCXzmxo%-8Ykl=PP%=+o-Mw{3<F>@@i)>@Ed*xcau`~ZYP
zc7lQ9pIJUjhWpFEU||&a$A3jpT=1fM;ggW7t0wjW`SL-mP7sGwe+bnd@g*!IgK_>Y
z(Yj=T{LRNy<cgzT>ohZMPg0&1bOeBzJB46D{BOx2yr=;1xWXs7qEeWRxLl?UG`7!+
zrMl8#%g~AqJ|3k`h+f~{e#PBXk7Az89e4YRN3tGk;ZbUaSqr9FdVdI4dW<-|C%}2F
z@VhIV%9ozKQhy$%3}w3Ew|o;l2Y`F{5qzChr#=@ZWzNOgJruldvCZEQOknw#)-OO?
zUb?6`nZq8gbTZqtJ1N5HR=f?$M=+m6a-Q+e+C%t~vy~4eJrnu2KM#Y)3YHgm2*C+_
z`)UU;r|6OfBNdnB{eP?&&xb=geQCYIGq~>DCSjzw_|#TG<Fb?61d&Tm?((F6$pakE
zJT`i`>>QT^DUkjCCmhv$C<>8_sh4M5N?;cChq;<Kj`Qk4d8Jdnyo-tp&U$zDc56?4
ze|nbBf0Ip@$pP+Rm3rk%DvdKu{wWfU83W2@)t;agY(+cK;eWgKWr9OGn#|6tgQwY}
zvu>5HMh_lZ2eKD&u@y6V_$pn&eg4mb2hqw3=t=&Huvc5HTCqdsOLx|FzsjE4i8gK`
znk=6ESC>j&ExhOqexGTg3gi>BDu0{I$H@)-!N>NlHdFQpLtQ2E<7B%QJE8lD)PCcK
zT}Xa$I-d>lvwyJ^eUf_$HlR<S_}3vGiw0aUXQqx2hC+RjFjDO8vJDG_EP;#T^sHFN
z1M3^xGU5)JDmrM(qUU@1DZQu^;2=erxGclKyNM*Q)s4<z*~cixGKP>Q)fEQPbf1aD
z+}ivpQqo3T7x0Kj7M){Xa6(<pk9hbzFq>&#q7pWG)_<7Nk6fg{xvz9^9DmA|m0&@r
z-;8T-#0Ck#A-SXMMCz^sNlO->1bM}2d_IREj}q)!saprk3&yI74!sZii)81uqr(?8
zojD>3;`I@J4%izh_IHi(;0y=-&8|v~b})K8(+Wk1zJTw)?Sjn~^XX*0YA5V7gQ#3d
zSP5CvihoN{PeO`&7N^)o5X&hs4y{D)LY8GyxTs}A2=f%jWnYWHS@i9E{Qm4Txgo^$
zv41;gsuJ$uu6w$5@5RY{5TIv<*^Hw(ta&8dr^(2|h~ea`WVMz;;QSDN=CEKtkShfS
z`}z1Hp}{wU)BFN4c%Km)d^2RtFA$RFFm&Hehkx}!tA_s=61Zj|U2mrAL6+vEEl*K4
z5Pe}E%%b(gUAzc**YXBJ45bjC8Z5X!6S5xWCnxEklZ_?o-4%(DddK4smtBGv(gNkv
zm*o?>sVKo}24Tba^JRKgiX;v~ZJ+g%oB60u_(f`f^Wme%GzLWbRCrG1ZjeT;SHgVy
zR(~YXw<tc>3F66^<DlxqoNYf0-s`_ci%(uK4p*?&oKvr`*5aT3VNS}2<4M^GV3LK8
zGpT8-211u>VZbBE#pzTIAdU5QRi!M<D;bh3BIu54tngN!FTvqnq11&T0kIcOHbZe0
zq@T8*Am-^ZCw#E+hiKRgfP_%<O73#C=YRcI<@UGk!ht-WbaT*dd5E=DOgK_2C}ra7
zj{KyROnhBrDQWU+C6mvtWb)8?gBTs$#q~N0I7&fnmS&594=X`EgZF)mWL630amCZd
zm6{eWS&WUWAegVE$8OGX`7V#x)ehU-?8^OaT{$r@>C)CkF+Nw)WU30F<Ru!DA%Asu
ztc9yIZLMupk2!>GKq3u_3ROo<Gty6SfeX2DQTxfffPkoQ!OXaeT(S4&<FUAxt!ycv
z>vFA8E<?!s{rNN~CUcd_F;$jnl`b!=J0=xl!2Pk}7Z!)9w*U3&!#wLxZg_}I!ZVDO
z*w>aAS2@WZzrFwph8oh;kz$UZMt`FJD*Ukn6J!@TN|~56E%mbauL~0GXaGOAG+jSW
zSCXu0f<l@43u4~UynGSNyIN4<8=@2ca<T-M;23wlly>lQr4ov|Fw<HF^)v2sb=Wj?
z3<l-Ue%0D{H8mlSxJ!G$<C${4-oJ5H4{!2^C1_!n!sBdEDo`SE@S#LHbAJvY+)4px
ze>WRk_+j-M(qQo&xc=vS*mpQX9y(0?C2d|k1$~-*po!?x*Dicq2(coMIrOwLAgc$3
z{w1xL`>=~vEc~#mebvwXVIr<}(@~NQFZi&he4kkTl-)6va%M|D^Ox{pbz3a_u*dw^
z)v563Uoq%m-T5@Tge&fr6MwAVzS+CN7yhgt#@3W2Uly`^Ho9ExdwxMHW;jmWkGD7O
zcTqZ|nsdrZxPyE8&zPR$5+kLQ?rNXEggsXNqNRK6ieL2eub5Xn2E@;AX0t!hSDpIt
z1b^4t&-hl5sEI#A^@A_0kIp;%gEf&5jnd^{1?GBhGF#~PS9{s7_J6Wp?Pb5(%f6Vs
z%%x!+=P2M>AVp#<krE*f`emERgiT(@MkdVoidHgd{wtcuvKdX|Bria?H$zQ6$!6WK
z32C%)U}dvXSOo3sQHZQE$Z+T%&B1_yU5MibL5<UVxPTh~^an{D<gg-a@e?6;PJF?A
zT$fN=(|UE$h)HNxSAVJ{KKkcz1@nPML;F}fZ5}A&;CetA+qWz8(vtlO;RUmSWaNJ3
zgxT!k72GKCC7h^q%^SG<`G?KMHJ4{;u!>T;lh2>>R^&|P(I}hEEUj+NskcjjA3<&@
zvUd)}6j{UCH@bsqay(<UE)SJy4WU&#nx)OKIjC?(U1*3Ec7GNfi%EqH&BRyEv8HEe
zd%<JbXzbA;jVM`SkXoRPLnxwQ205X=9I$XE=SJ0CEREh^S;9Oj?0rAHi+a*TsYFmo
z6`#T=UBW@!JRq%54}1BL0Oi$Z`SPr@L)2!1rg%E*U@G{VFe+M35p0G-k>z+wDn$l@
zaHVuC$C^Pcc7NnvhcAW@TyzUxM<=y^qWS=d65;JmI1ms?Fmsq1ht(*cevaWqPr-vH
z(+uH4>-66~H7-_Y-vZq!F{cllG}tw(w}xc#VI2-5G(vxa<1w9ahO^3V{H{vJez3<h
zH*;Tsy{N2=i$dTPHi#&t28W5ovBxD|(!&c9JY>BsE`ME7$+$zzm@9MPIn9hed^SC=
z(Dc2ojn1d}dV$Qn)p8MLQyYpFvX`N7<%Pq&*Fw(`V!w+Ei7I@%Sbv|Uz$xjV{Z4qR
zBZU>$+1rmN3auB=vC(oK_QHGq1s)IrDkdE@KBY_E(XGtv(li*_h%^UTArXrBJ~dzw
zzv(SmF@KqYjH8$}K%;Km<fO96#O6LthQ}_5Wr2EPD62EXi6~gepTnNf83MQ&>~ub5
z3D6JMR}m5pJYJ+~35{e2lZQ>UL39iW!V`TQX~ZGeUZR@Q;$ujo5AFoJU#7cmn*@8L
z0%}ttKtC~iTBN#9!f_ix`WMq_nM~WkBG(USrGE%lK9dtC7V&A970;RzIiU-6DLR{X
zx?KE|Ps*UESg`B()!<-J;t3CzL=G319bMW^l3$dK-wW=~EU$c*8zk|LSCWs!4MOHQ
z0sxM7C|e*neiw%%RGxF~RR8T#xd+dln%|MXiHolZEuJOQF>O!QHh9M|`Qd;&lBhsC
zO@9}6&h^je*s4~26YX&V6OPAqQm*XxEMMo{s2@@#09xj7;xPd>+{#qd(Ok|n`dz9g
zfHQqZeje@X{DLlwp(y!t(~p98hMD!I^uK(6pi`u3h=cUjou#?xbf+mF-$eZJ3@Q+W
zz@(VTq@y8?ULOF>Y^-*l;2_gXu<8<(SAX|F+mb;ABLG)GsJ}IuTqc!dK=&Gx@WX)a
zT8+<De<?!Ns$z~xe2e5l=OZ5eK)>zV%D!=8HT4_Jo2^RgDXAo#@)n>Aeqpnj1qd%J
zV?c`g^&GQCroDs}`)!GE<O11-UVHRX3J?9f$~_sxi#9A%zKW)OY=x;OXD@FVEaB?2
z@1B3|w*nT-$I1x@kYg~gYB*^YAoN12*gT~Q)iRf({6ktOwM~#rNy-?8TX({?p{?r)
zinyBeqZkW3PKv|vT5`Og&)RcD)f1EE=;vYZ<$zQa;2)DX^~gk~M;SgV*cRw;2wZsx
z>^LUp#PdJnZ1C^5Bml%|PD>78BDT$#OR9e{VI)NMXBDcbn~Z4H%WIJp`NX2TCt8gy
zK6yQA)t<d;k*3#@HB~Z5-HfY{aFSzxt*z~9JJG`$vZOCrTN8DjZ9GwP$?l3)aeDBF
z0M~k6%)Agrw_DA|b{u^x^x|k%Q-XGUs4-U~^|HI4t6q7sfLz<=e)pcpfA@#;leT|%
z8VV?ud3^yQy!!g-i&o<n=5~QAsZP1bla{O^jN1JWwXCfUllr*{4a(O(WUGM8I)AK?
zAVx<Sc%3APm>hLQl=!!#lX0*T7jZ3Z{Gy*vyeoh<5~EsGCZG+w9ZY+2%HtForpbG*
z84skZ!k@39{#d3g2ilM1l#^5JPtt!H?P91g2F5g^hnpJF_|<Rxr&R1`CDUS{RjCDy
zhN5#>f^e@I(-y!<<C0qYh1@-QnEvYSxv9Gc$y}#1K?_9O8?U7r%?_(;8fuj5`0+eB
zD))9@jdR_T)9%TzzIGbDM^tfB;^kMr(asl%mq+Aaz>o6zES8t*NtoW~1m=H0VIG1y
z7CqiufBb}a)+9N~hIBUb7FH6j^!<4xjK+Q?;hT}L28PNcUM&(-$f1s_B82E>bSZCY
z6IH6jHBXfIEA*Y?ZzD|h(MY6|1p<U+x5QOrR9NlmSGW1kMTCxkWExAA&u>Og+)zi$
zqF6(fK=J)W$d(}EDSYIDz;S<Voas+qT`B5Ix3}4h<1=}&+WXr<{ctC!Tg|k{!KQkz
zFPn{$r7ou0540L!v@BdBb0&^eHa*bAb%f~%yo4DyJs6n6)f$xd@VxENtD&qO<=K!V
zF<>snQp)S_g3qWSU?K~_O{js)6@bAY=ihvy<+%E~PyR*JZg4T@mj!>F*9MondpC$N
z|5rp@J=4U*CkmMG-|U|yCDbm7O~2^D8-=z1cPTD^t-^2`xL1v~t1t|PBwC(w>#i(`
z*t6CiMvu6?VhO2+RqCES-VX-)MQKUd@UEQETn^}8K2nEkjETgcPef9A>;@l>I@|w7
zI}jH2ht+0_h3|i3`1^mt!h0utd<4iCb>+#P3Es`kPDgv!9f$(@Q-2c5y)xQIcmVQk
zQ58J?z!<zdDkcCr5{RLt8NZ8t|0;<6?1Gs4@|zJ@@VcY1@7-k9l9{_5P?`%XDJ7YQ
zlGZ}DUSKexRm_K4%cAFpRE3;z(CIp77KtMKNCqc+`3W1aq33@}!P;qLUTmrV+m23%
zUQvfNpPs;NF*8hkb&5MfRe1;0&dmSNO>n?Y1QB**!r4y9CPPHKd7G{0Gsz?qcx)zE
zHm=75TZ@?Iymyl~v1m7bF}6j$Q42&MppV|KQO&<bHUApbtPxumFlj5uV%2Pw#eHV{
z^BF+zrGP5?D2sn;L^ID{B@JGS^926Hu*!I4Kmqp*cze52(YtU(bJ=j}XH$9OYELpo
zAWgxii3&^(fTi}LgiH5O+9exuaR&B*BO04=pBAF9Zx&PSPp<34Rl7O4YHYRd=Ig~*
z)4+>KKD&{;b87E$GyC+jBID@QvJkCr1%`E;<3|ilI7)w}qyy0hwdpW+wRyxHnohlO
za|wQzjpAp<8?a$q$*yeE@tMe7UpG<zM!;NOH^=^J5LV2}HOHBK=1a2gY{?#8P}$O|
z{JNyOuwCgc&{Rt=a~&fg$Q$jn@Q-fpF*mXGsvUjr?v?JqH_ZjagU|@^eV=RCq2Ut}
z<7LhVBietzMd?TR*;0|d<X)Jv#$bGsHo#jpp8Cy~Rfk|=jD(!|{bo?O!Rc4rWDiD9
zkq}@zPxB?-gh>+7>YD?pwuJbsR@5m~8sv(I?MNXZ+tL0o>A#o4CiEnSb4r;~jcX?1
zYm~_K(%}Y<Q)ob%a2TX<5UmVxaGgs8VtCNFSz3S1r<HkV$-&8?prrtGL|C9w>BXl{
zIrXCzt!`~>{QF`Thx5|f@#JT4;A-KR5fDn|69}b13Np`qOL%k{ER`Wa=|sx<LrsqO
z4!+^jY&w8^3zd+QW(vdotds?lA`Pe6gnAhd@@eO2nlPBXKAumxcI&yLPD{e+I4Y*4
zOOk(mY+9~;I!}cd<zaJ8Simt&6aOvhv`ba)V7jMBF-Zrds1a7#b{ERjURws2gP#O$
zd#r;eS|t+WBwnSnRVYI35D=to1z}p6cbr%u(>Qvap=#XNSs82A{fYuig@hC&3S)Fa
zOUyIkT0hN)gTjT9!pg^k!07l>#Geu!en@|&nXf@4K&7<~ldgM`XHuUGCEJXxZxSLD
z%n$~)@9S2=eRHUx>M80Sh}v>>EZLw(%kwMkeC9Zqr-4@v6}(rYrj%A?zn#&XAWuwl
z&b4CKIcE6r^F7}0C{jdcjX0ZjN##4^kaCu?X%5jYqw3CQOqXkGFH2-ytgS_>1x<f9
zO4GF?653~MwK*mk;f&rT(g9~?SzGNX)AWSPhnd{z<2}=UF2jcv$||M8;=~nn4tK`|
z>RDc+Y!|6;^3IYuURBis4!KaF5+amJWkH!Ug9(1Q`+E2Ji#8HvM%nuu&k_+NlVPSI
z!lK2I#HURZ*Q_^oam}-s#4$c7L+pQ^p(LzRryAf_+KW;|?0`<k1hOqH8V;{<9xa)G
zI6`69Oz}BEE2?}RK1zzyYk$wJE^*D%C5ynw#Eefp)hK$<g4Qr`@%hX*aV8*1GNXae
z`DWqB{A^Y=@7(M9N4oY%rO26^E$u%WN#zZkC>Kc&QUWrVupP+fZ_<7;aRPsVymxRd
zVFOU(le#-xZMV6!gQgTl6A39i@kLN$MHBphBecgQo9HN|J>t^mtZRV}lkjBA2PM%F
zTxTYgVPG^phN6i>pkidzk`#ZEpl_9EQ47NP+z(YPO`@-K%*8Yr@&Qe#O{Vm?;D3mS
z0{~bbXX(%xX3Lw#RqK?JPUnA8mtmS@Q0WYbL*8E%w%jHylX2QIHrtTAkfSuVzAsa(
zrdpQ!TD}jq#c(mBK=wNV&fCe!(4{c!7JOzm^<<7U+Er2FNbRLzNu_9qF@)gflA+`b
z2I%<^bvh%Ct&Uj3MTJwzBcgV2`;hC_;!|k8_zaIxU%BYRa*A8f7U+LCcZ*^1d(Hx0
zycc2o7#HA^Y=;^}wCbW*NlP6M0z|+l^A-{@kBEw}ucC^RUG#zqAthNHqxoAp<x*V!
zPDwK1KusJ^X7MDF@K$=3iJ{~<nRu}kP7%foFUH&>Ryf3ZLY4uz#Qv%1DmNi}R08Oh
z1STv1n1kkS?iLa*$(w)eFYsv`vWzJOeqrqMt9Ykt%=<JQPD+N;vvft4@RS4u#u^-Q
zwPP2FEh-2L=L1bGu;i4=?1kJ&#P#PjcVzU=)Lwj1Bff9;OPcV#cl));^cMgf-Vho6
z5~#v26jj09RDr3ZRYo-B0C4)jWeXJc@mgTim9Ht`_fQ{#2*H27h(%WW`Ip21EP?B}
zbkZ!uF_u6`H~Pi3`SvOSj?23#dE8eu4nV#~eskCVie6plzrXZrs#e?8z~sxFdC#u&
z_k!1F(cHVtty=b~Ld3!@uJh8$fHWvSws3qFscNS8`y0mQyKW?)TjQ*+(9QMYr=^?c
z*_e*1JtQct5BYz0Hm)HVHl7}*oS~EqO~W_L+CK616uRq&beK<gXLxeuZrI?%<v#FZ
z$+w^zNh=~5g8C9~_~QK3ZUyefS2RCJlM$zI%<!Yy;lKEPrCI67vXPf{^e=@9$j2df
z{WmW(Uxz<_5l;EFQDJ|1p=`3)yO{`lSmi{2FXeUtV_knnO)Nb~o|Vy^3(4Tn)6bpb
z!`;c`jF^m!SbtwK;-}*QY=f`>9?{N8)mn^Vk|@ZI0|(>GkGLi=;9I^VRUGbqzt4j`
zD=r*o-5eX#wVU4@j!0aA%_*N39t4}KsJl1X?#yF6Y-c~e@`$7TZ5?!{*j~zOsw1vM
zSpQ@@@9=+7cJd$dl)*aIkFt}0;P-{2E(-`unrFm;PjjtOe-%mLvqt=w4)6EhQFlzq
zef)*a(+gycS3waWDeAUZ!YK+QE4Ai*xe?QZ9S@;@yxEdL+l9__t7f*1Dk^p0j5sVD
zy#r}`T(EaPEVJ_YBStB^L5@21>jU|D$qxJ%+$(<!Af(KTCUba>TH9q7r+Ey0DVcLT
zO-Qky_c;k#A)v1R88Tv0t@7!BM=U=t9r53Cb`UT|lz2R5>Brf!Qy8N^AzgY}d?BiM
zGVi~a3S|TOr3K0^<`n@QL)GeNaznKLAJ3y#&v##cJ!0k&Yh^SHS*yxjI>%339Y1!p
zEiZr4=WFzl;A@5XzQB-urLj1uF}8fzWoB`eieq1xy_I3fR0Iz|-4@sdf&&<h?PL+q
z>~f5|;tPzp7W#b^g(yUeomA$VMAR=;n&JzL*kwk=waHd8-~YN%O4OI53Kw=0TZqo3
zTW{}X0XSc3#H8D$D6_?y9sRljdoyJJfO&tx4JDp^(yPwcXc*{utX@T5aK!IHZl;am
z_ay@Ieqbp>sb0*rQ+>a_@b)6fhW*oQG~qgz_Q!?XZFe|Cq$j)wjxfrHoFG~rL7Za<
zv#&E^7)l0H2}<xo?~e3pVD@^F!pSy0FNr_1X)-P(jxQOC8A&5GNh=`+m=-seC#ruV
zrj0Vl$1+a&eF;^Rj_E<#CsLgz!|b0hr~$XfnJ~T<RS?hrDC5PiD+(6g_sb_oIP7)+
zds`NdzR-xB<z)At5CtC%b2dJW?0P4`_0ADpH#?i%`pG$RWyD-19fM8rW0~qy9`N<8
zkzZiM^%Ze1qKcO}1k2@BZ@)Ho`;UKv10L=_X0t090R9y{2ZY60%0L$0h(}`bEbrSv
z!t4!@U-`5M?H3wZ@mV9@kEDk2`lu-WF}!@x#NEEC`g!??&uzfxR~m3dKAxt6pF=Ed
z@by20NBlAsUOY}O;ltr6Z8e-Dtu$Ty1T-9s_~VROlnh({xbTz?<YUgwP^*8N6M{4z
z%93RU8c4u3As~*FMCluhI2Zge8ZQ63n(RhuEHPTRF)$)}Gwsa8Ex+6~^`+(*M7g_%
z5u;#ql3iiMyHidYz;O)k_;8q=aO!F`9`-9yMXBcb`b6pSAHyq}vBWgg`H40lkN8b;
z-X{SF!=1{{OU#@9DwX;jlIDNkKh?mwNk}eL*<J(wMoItG{^yN2B?Xwriyv3wZhPa-
zh}3BkH`%o5%~KFBG*?Uj+g(s<AHk%eRmqu?B0=%}bt%V2T%2adGaWSlzIc{Vc^R3G
zigrdyUO$nriIQ#B)3pP&#~d?Yz1rjSgT3|JY<NUm9!4Xsj(DGq^wWRh>PGtSi5(ns
z`UZkW6_=bHq>Dm37p!I@msB(5D^AA05mk^B2!jK4fLVeEjeUdL7dQq(llKy%Y*;Hm
zXhq`JNCHne{fgM)NU~Uuui?>=5vSw9vuVZ$2uUu36Z(Cb>xMn+@EeQqq@qK8?K5xx
z#ldSH?PxZ+;wjA$bEJP5mGzKxNRvIyN#Th2i&*hfw8}3#;&Fa<JWSrRA*irFF4%iN
zyCY=(A9L!Dhs(dNa!M!XE_CEL8z*Bv{+y)n^^QCpF>Qv4jF^92W5fZD&sUw<>WDRE
zl*g>Uude+^-)7U4&*V@M{n{g*LRlA0uaG}3)b)&x)r_S|-%o!c9_xrdh_#~lkbS(=
zVd{^N(>#B#DSkhp*OW(mKwRl$nv5jGLw;Yy`5z*WE`*tUfICVMjQ3uD!B3JAXLM#r
zNDBYDf@6AryAvFfOHMrw?@0$IDN8~2DgR8Td6b?oh&>(j#f?Uc09+n0eq2d*Lx3C(
zh(0SFPOAK=sN#R^gqF29#hB;v^HK{-pqVm~ety;g02x53S#}Lqz=>z6qKOfs9^cr)
z8KgCerT#`qj6;3Z8mS};n-9QRR8IivwJ6Nt<VGg{YLc*a{xjzY>nN_2BCIpP=>;|K
zHgA|Re2w-0xvGHQEb;iiK^brf3`-{2U#0GHSO)eqb*X>GmcXDZPM71$Rw{~WHju+L
zrylLWAp5zp!P%L0(=Dzq`-T>`xjN2ju%Zi+)sLq0v`-4LYfN{4ae@1+W{*qXKmRV5
zaa?tuiy!ebu>ii%hP~n5`yzX4d3HbT3|B5qvw<z0fdij|IdI5z|MCm*5IINFFw6g0
zI!>8reA9o78%WaETU7n6Y|SIX+Shy*mrD{YE$#a{2vz4a3^y7xzlOS0WiKMk`Nn%u
zUbcqz#x;9ULaM`dU2t^(eLcBZOtm6k)ph?FKwqx8U-9lf5AV)7*l$E&BmZ{LRE5NX
zsDlv6T4E1E2$<yBu?7K#uq0KgXCJF7I7BXg`QLw}awMM;)q8B-V5=f+Pi;c1GH&c`
zfvqrlsR>L7bLK7xQsB=}OyO{%Y7u^YFF*4s<_B`6W6ZDbXP;v~jX?T^h0HH2RGOgJ
zeJ{|h?lAJJV$$MO=dSjU^36STP_TeRBNaISzX?jt?+Q|^Ld^2nRXHkI3GH*`9HxBc
z(Y}8l<KA4frcHZpbE~y%bl-AxTBdy7K3Lyu;?*YZHaEAnlcRozFSJT$sqfcz<mWNH
zu5Tu6+%beDY%mCAs^^F4cwH+!73-zIrA`_`{tv!Ppi>;61ce+g_zph)^Rsk{<YQFK
zA;ITRnJAl1s(iGJMi(UWgTFF&2srn_^Cy3ASVox82eZyTM_@RH|B<*q9iCQJ1a7Gk
zOEgCAD?NpXgI7bJ5T+;Kg!Rw|0ww6atJ>@xMk`zf5Mr_o{4ji;B~!8KNwlRuu-rE=
zZo-)wENhtdt*+fHbLy8l*T_p|zNs<In^=({@Cf2b5gn%L8mWa2?DE}u;6VKrcx!)L
zxj1iI%|hg<!|$*81>x(Q?wxQ5GL3$imdatn5IQ@}2TJb?ROl+WtN(56A%X-PFpi$e
zz7dE<eZGW5s3oGD@PRE*k{$uu$?m&^>zpC~obI2fA~A^U1KV0LS+PTpdC@hmy(#$g
zO`?ethtMN~VjxUf)5rPfh!JhHYM*~7CpOYx#uy)pwukj=9a?(6H8I!H2I?|Hq{S@l
zpN{ikev%>BSCJ98K4)M})c#4lP6p8wkdYX01$(Io0m2Fhvi;$Fu!O6yw+^J%(KVzY
zrXSP(+;Y%=Yb4~V246x;`lIU}*Nppzf(TYwZeW(2RXd2IM=8<XR3~}_Erfq&(SyCF
z*-T;*BFNpurlic-j=lG9!`UAWUj6my%YQqW{UJI{6H@6IrbaM<xK&P?^2k8`@WIQb
zE8u;;z+gT2>redlgHjIxp2)?F(a{B;1;TY2ja`K!(kc^1n7*kZ19mDGGh|jQM0d#G
zUdE=E9b*=qF)bfr>nC%7PQ!m7)tRHxHZwvw+B)8Cx84eXIdMAhqMZdb;24WYG25z`
zXucN5#i&+-H+ySy-JxQB2l+8kcpE7J0%!~tuBBq(W5Yx_ye`1b70wzU`(jWxIB812
zKrfQ_fDI8~5Qe~m20cO2Ob~bwqF3p`L}xGw)rC|ewCPPus_RQd*`|L<K3(CcO-$cb
zOgbqv^*NK^rD`9BF^6S;)mD|&7zRY;<DX8l<7`^Y(D-&7J<FZ;<-kJI@f>{UV%bWr
zkjTT`>bq$4R*Y&P5T%H-)AT_#n;&)Lub3oGKLb76K(XFMMMY}jwlu-J=07o?`BXsv
zSW12Ja^D+v*lCvxGlqZ8WB$r}(MC*--Jw3iOF*LofE#a7(w#Wp2@!!d5xoOId7u}w
zX7v;~2gpDOg@}4@z(0zfW~>3gSMP8G82rohEaIp1-5wY87K~pl%gIa#MwMjd%qcUq
zuuO2c@b+CTS|Rh{DJXN@IC?!yVLlr>VMWd@kqRSM2%VOM5deRsOmogSiRs5ofJ@N1
z9)ToKy2Ym%ysI<lkHr&5H9ai{({p4~JHWkT?l>8rw<8CCr1g3kPA_rC#%k~F+r202
zyTFj?5mgo(?asAV9a#4j#h-7`28mbWd|tFboA<bcsZqj85j7D3h;MoO=6N$Z%0IS)
zvdA_fm0MV5anOJ4p!^coi(^EK6|-)B+@;5DIO}@C@aY2Lz8^=A9RV(<HMYZ^ru1Bf
zXmvFVvP61jm`4&sJ^O8=@gg}tk`ml!3A^uzBhhAe06c=il=ZzCLnR|7F`5-dz(f`{
zO|vkr^C6@X2SUb5ggE+{YtddX7%4D0bqf4Y0P+opYQBFwRN>fPQV6@0%(CP8l#hKr
z59q_9=ry=y;rgcb{zC0x;|u^3E{8?0*ZYA^*-!WZcuV@i=Er9AfFV1XOoS!(819^Z
z#}&@niv_}gweUXRmaw*3gcOwSK#_Qh4s;^{QB3I@*YU~I`7qV`q$y8(Kbdf(qNyMp
zTvvfv;>~}^pVv>PGw?{dmrXKW7d|3<JyV3NX<MSk<y=SS&n!ib&%rTUZHSD9b0$z;
z!}J5_VBy1*FGz!^x(!ILlT*m!XC%5ZA+XsNYbED%I$-p}z`meRs}or*rXrpnB2!mc
ztHYLx%JC=jq;xc<Kc@-t1ENF`=bd=Le5eqBDJ6ecA-xGPI0pR#rV|$V-(;}^#TVnG
zeayTU9y8kS3UDLRbh~El7!{SMnipu6S#@_1_0aHfbls#*FMWSoA$}1FFeD}l8EKRP
z_&qB|y6`6mBpI`!os0vV9U^*qZZKqocv?Y>Mx#~(1<ODZ`T&WbvztLG!_P}CY*RsE
zrRjf;)Sq?@du4dRS}#PYCQsuKK?V3=FcaV{9<!{<^Txgap!oA7ju`pg1}bO{j;3wu
zR1)A&1Nczg;b{@lB-Mgk>3b9#-aseSC}ZSp0lvIQBbktPq$Df|bfO(hCc|?L$)9Oi
zfO+A|r_U87FCc9lDQU%0enAU<^MT1gy*huJM~=4L#t!P(!Px$OEOz4=+fLcq<NFDP
zA=~Ra%+4!&os&iX?4=_f%@27RUSiRKA@q(?_o5w5fA(jTe?w^jk;TY|<5+O{8anyC
zxd4{IW14*0fCJA{N;q+k-@H(p#lfkRU>7HolQ5j5rOJ>yqNt~)`WeNUjdP)C#}a=4
z?qVJj9}iNjIi0y?yu!8AWbQ4BVtbJuLfiSnsQXHe_M?2pxS^c0L~_L#`lb8gQm5|F
z)LFzAiWa-<XzN~b*eKy%?U)G_4MQHNo;AKfZvR?`jDMFFsOF@B<N+I4%5(!_u)2VJ
z>eHz7EV}$4qAi-8WZt66HdCTDVy%DII&2^?3A(j`wi@FWqiD3Bm!QZ6d2tLa9Oe<&
z5E&!O3*gwlXQz2E8NS~(pBBPy`9-Bz|1oBY-A9Z(YcHb_P<uf73cXo&EvdW|1>2#?
z#3Yp4#9KW*L*xG8#=Ce_oW#J%AO)na^-~-yB+rzP-VTJSQuURBVbkpyYWII6mBsO^
z5|E=zUsd`NeBOq@{nGa}8gw#%506)aQMY!eZ#3GSBr_PaNJ5)(&8<l`OjoBXP$_nz
z_}`;HuEzh~dbrY}=k<74_R7B8-ih!AzW}vw+0#$xUhwEFU-sZZz7q}t*bKBwmOcGn
z<Nq43#%rzr8n1vy#7|xw>^^^g-fGzA3MeYSRHVtYf4UmZLOTlQ$i86lo$$jJ-mz&~
ze62Ep3vbdSEWYGtX5o38i^Z2Jvs8JLUY({S2#=#58{&3a!7Qxo1al;%wpKS=IAwyV
zOW~b*NqewuuVOOjRX<gwSA!W`d{rle-Y!jAse$rzF19ht>2;gA(wl#7Iu~Ek`Jp#U
zbLd`=Ir@H;n<>w-Ym1ut)DSi2GfqF<&tKsDQyF0yr}$zAB8}#BK?P$s*y2gKOR{7F
z?0#_9QF1QkdFFJpxwI+3+M#Y-dqla(1?UMz;CtijoqClpj$WiB@{dngNussf^-r=a
zW~T=0G`!O2+1ZBa1$%$5`gJlHk1lxiQ6P4S#C1j@V?GpXzZh24_T?fj#6rwZ@|Tb>
zpknwmr4f)cfLqW3#oxm>OEtMvQm~3uiIz#Ac@?Eb^fpG)XMOTi%ArIYLNimZj2v41
zA;K?lerMhUHp%m8(Aw#ow0FR2&yx2ZzF0`r<aJ2OIAUjc42yqh#aab9{}7cf0Ms8=
zMBA2<Xm*Q3NhJJDq#D^9DNSw0#)V@S)})@Kz?j*V6>v4mSQ=x50TC8d@iDWDTIM7>
zjrb(QmJi8ro`M!KU2S-2o8O)dnr*$u)C^TQ@q;9hLq0$zaF9-DCgR1DzceiAk^}iN
z84-`?AgA5y`#yi+$_3nYy%FX&#^l{QbVRFF`_ms9#J$*6c8nOXSE8~1*!a!DvpWbp
zB~lpw!OS|}snUch4ww!W@6JH$A{oKnvnUdYXQ+r(PUuCeRq4od3Z4uty(7bYATzxK
zAyn$DV2#__DQ;mrkp0-**w#fVq*@QiH<8=P;zl+-*D8Ni>UxP|4!h(P&Vc!p_0i0^
z83i7QAxlcw(?R8z9Hv-hu77Hj9R8sfClc4J2!GfP*quA_ZO$?Q?-P7VK_MZf0NrN%
z&8`$(BF-ZvC~<--A&o;O<%kQ|AB_FVH3m?dqa7fwpX6e#96{&jD(w)thUrJoi<rf}
z9wwq|N49@$ufDgPD(}`;M~;mZ6dg<lS)v<>3xFJ(&VW<8yoJruB~#cpY<XB;XKH@U
zD^?fDp+#+pH!mdAhM}d3Qbo7=T6YRNg{ngPunZ8Tg%xh=Un<;_c+X>|Ui_BfslsmF
zaRmj;=%LF?-=>qVjzje{J3oN)x?Qj;Tm-|hGxUG<9oERf30yo*ff{HLgB^{MDQ%Y8
zwX&t!8zaNZB5XAti#d>~+!hCEZaj!FoE66QE53+$2*i`5a<ZE_NmxtC!WzgLwW=^j
z4b>3`4<&KK^JzGWI>{-Ju*#MJA9shO>j$5+!f5+ercupoY8f*~fCTSc^@Es`S)iv`
z484D_;LL@Xbgs0Cvj-iN9Dm`yFMq!G4JE~U5#*L+C$;6oPn<Q7A7%!_<u}Lakd1(_
z_`4zdV~{o_=`ADqiFnPSdTg_zm{;ti5_~+%C-|CxKQVhIE-+x8T8Q((CJ*5*@9Bk7
zSg;^h-7rATUiJ+w1j89hmUq)CR+d0s`GSAyR|Ut47h-3%=bt@vR>yJ0$XT6+uNFA_
zYi8F^li9T_dn8C42{wmjkXShD!mdzu1mjM#wJgPDA<M*du#jbvPiuO|&?G*+CU?QF
zS#46z*w>HO)Epcoyp4uAakN1vV>ib1hM~zi)`#?wDGNUs(nHkPaw#VdBd*uI8>WA_
zKIG_z5LYHh_bH9I6etWFyc_a9dDR+O;Cq6#=hv4J_wwmUiQ(M@TW^v7asNL%_v2Aq
zk@xXre09$ElXJYU#OQu<26q*{me`W3_jr+`@gm=ppK;Um+)TIIm3Z0LVq;6$7Z0vf
zT6o`zxcnP^XZ9iKpG(>WIzQmf9}<6cen4zY>FUzFe2+27=$8@DFK@=fYG5>(qt(D}
zR{2{kGN%hf!nN2n&*6BA>{YBQRKz-ZE0`JH5VJFguy77ygTRj_*(8NWzwkxwknBjy
z>qBK-E+AHa9Db}ryVATBA2|dPvFe}W!8*)>fXbRV^)djYk*HEj0vn#ULx+ESbd+bL
zg&^`AB@Xw~Gzey0{EWIfsdu}0rt6*wgG2=iVw(E!m%6mGx`kHU>!0sH2@V5)8eDc9
z)be@{3v+#z|1ZRQnl)1+3ZwsK|CDOz)Se<&K5jne)cHB9@_bnk2Vn;&ome_gKrFn0
zESt`ri0V%~Ph$MmYZQqb;;4V9u$?9FyJ%cB3wvYtf;T>gdeknSPUVZjFAj&{9^+!r
zX5D5E_E{6~5CO{4a<K?y$H^X*H^As6G>UjZ2HUb5TM<W(PxHKxU<w4Q4Cg17ZkDmx
z+#e35S)d2@_n!w{t8ajQ!3v3cjJ&GB63|Ed$JTu|@gw#<Y8`dXNx^?fC|Nt-9UQ#g
zhpdAi=wr-D#A-Y<p$IG)apK{D)wWoXB2rN(w{s1VTx=4O*6~@?^K0(ehE*l!(s|&<
zSugxVDjvGW;73F&bf}lkRGQ9Z-!t_eWWCZXC~n>~|Hz3;p*v!j9>e)JnVsAIq=x@$
z`LRnrNTn=!Y{|D=l{|laTZMngx39z{_V!c6iS`YC0%p9TB-RP~_RS<Ydsmxz@~A4W
z8OnFqsNsDF;18EUdo#)dJ;}K}QE>_jt0rwaJE`9W0g%IDK~_vk!$#|H<yJ#E9!WCx
z#O`dE6z>jo%$<b)Y_%oRL1nX9-WVYt28mZFCg@_#^J7Kyb^U*#w&hf%qJAPC0`7v5
zw|RvITBC+%@bxtPz@e{NE=B!FZYriEf_Xc0Y0$n!%d4bE8a@3I$V0PUwbZdSaOmsb
zFziXGJ)MmX*L+GQStreh?;13OedKD4j)=i*Z?w5$4u{68Uo7YdHOGh427=8X4f`_9
zHoRV={KDdt>QsNSV0?;!vO|{FIZXy8cmDP;EH!+T&dw0QZ=VVI+9+hH>0qNH&QxbO
zh*lmeDoheB5E2j6+FX%>+?vs4UxZM7rApN>OGpjs{DZ9S9dTUEF3f)PGeShzK*F>u
z2>$L6JJnUfF5bm*X1Th>oUawFt(6KHudQh=X+taWsJDOqG!frLHj7C^<Y-w0c$cwp
zl3@Q^C?!`9ZkY5gA=C7r>(qUKZLSOaTcu*hq=IZ2>uHs%JqI~`rhXk~>>F`qoHZrU
z=*TB7*VTt^loS09X<*^Jx}3hmg#r7r>=Sjx;Hr-#o=hz3idtu^HEXYF55v6@#vkdr
z`=lz{BU*oK9IU9JlvGiWToNce#-V}}!W3Rb)A4$a{B;Gp*3C4T`udw!R3geZuVl5l
znUcW6930h1$^Phfr4+_aDql3?EZC%~EW9{9%3-K23%-usgt1(~ehg=Gwm9uoN%G+N
z{(>aAAVQWbPJcJ4Y2wV~4ntDX2l1vD$og{*VJLq!y}0ON&nwEq<h&S#$Dax?gxdWC
z0JOOAY>E^gwuNH^ZdeuEqaLJz9&f%L_(P9}iHp%HNxH-@T8oP=2%0V$>$4aAJL+y6
zEPR#CF55yJ%26FAA2Kw$f3av8jpuw;FVM!;-Hpw=wPwbp!!+h#PjL4nr1ZG0-f}$;
zxio*0#^n3g<-nqQ>6P)kf_Q-&&E{hZ=jy@4ih1p|X>sY)CoyDz-^5kv-!6Np=M*u1
zI+)Sgo$j9dyhZ2DH3%DBDQenYTy*`A%ZBNm`wGKcY<ppt#5c>7Sy7qFiylHh-)NWz
zA-{Cl{Ykl(nqfL3@T0w8nEq*I1CQVAzUY7Kf4AG&yei+cEtD*47u%^BG~5J3LO4e0
z(|ybe3qIf(r^-VLXDsdy=LJJ1S^P4;+8DT5n{z%#Q{~(yX`Ia`B5yZ$e72u8Ua)i}
z*bUGz0!>WjD-OkAkue$#)S+pUD$VA1Q{wi6*vz@5xs1~@7ZBrxv^Zk9iz6@^EJuHS
zmygnShi4;FN+zVs(H|^?nZUKS_A)(NTMNahwKeH*ZA}pU)NNEWM41pIjf9J2>j(Kb
zRSoBx3C^_Xu7z0JO{fH|HMki(baWo|y4j!?txD`Fr=8|gt>H0_UNPs}8?+IggP0=X
zi>&@+Zj~E6H5~lN@robed6oc7RS|z%oIS*1ozCX!qxrbiR)a=Ki89eU8c#;5QI&Od
zy8c5Uj+CVT9{v*(ye0J215Pv=JW@3$L=O<&Iyl-<3iw0gHzbDy(XGGH^L{7#k!i?1
z$Y;ln9ZsJP-_f)Fn84%434>RZ>G&%_&wdNpB@W2_L!&{Hhb2mo8y_9d$FhIIoW9fe
z4ff%VeNG#px<&)m3|*9T${nIf05km2^1(@Wd)R1cfG=_Yd6PWgy&da^$D?Gj3Pghk
z52N1iek@`<^l1mbcvOG-lN`jKdad|}oQAa0UTOWoT9iUe)FjXoc#x0z%Bm>`w0^()
zk^B8bCmM}J=ATDEzi90Gg}8t98$YG|fS>Q!?%;*r_<62AW_ReRPu8{>l&a4TjvBxD
zM4v(=LAwk6XUEa%3T=!PM&aZ+ZOOpok3+usPCwUn$!h5)=H@q_=>KJc+<v5&WU{E=
zRUQfvZ|qld)&JxsbaN+XNfxvcgPUrHt$3ERIJ$}#K5^v==#dz(yrzF0_J?_q%0m{-
z{R+v3(QD2dvmJT(`kYtL@4U(RB;%kBjrgMrysYc3Qr;P}Z@m?15?VkDa{map0U}am
z1AEG*u+bQ~{W{3{vmk*@s6%hJqYC-ABO`sh#u;vrBlBjvDJ0vl^Ypm+V{y2G`z!B0
z?GTBdq_fo(3}vM)WZr-J)D(4rqZg^~!=`SO<~wet#s7A6AJTl#ji-Jk{$|_VC9;1Y
zEz_^&JAcDyT<>~PZN58f+Rg9<qxRYt>}L3a-ww5}436w!`AXUsJMLZD98IF|rr#U>
z9)Gm#0)7Ttq`E!iM$5gkxHArAOc=$xL%-1P+$*{#4u4!*qql$CG9IRbRr=d{_$2=0
zypNIA?;L4TH;n&`@_vz>LPuENG~9$sUD@e%SV%ZOgt{V~nK@FfvQ_dOgZ7lfqK2mH
zYHCVPo@Og(GM^@Z!thcejdo~=X2BC|0AovUB4@ftl0N*`Kg&wLxJ8ob$-D$KqNnm1
zYn#J7f8St~fU<w(W_4|iKA+(bIIXZ)TWfLD|JoW>i^P~tXcO{QwKRlpn@JXgn2-?{
zKvPaf#Cg|DNG)#BuQ|8d3ulENkmZw`KSoX74?9uwC6PIOHcI05lYW*K&FB*eH%J>h
zkM^Emf$_LdOY?Smv^}_U=ibrw<{-U2xP9;5@vW`<+ed$Rsnuxg9<xYFQ*R3`S#!wx
zI*+FF@z}2G1X3R?*m0IH&|{jg+#~4&^VaA+o=u0n=-;E>Q)J%s1o&B%{32yxkCW5j
zmJ3!+h&>%Fvn6tPgAT#uMX5X~mQJI)dg~!iyt5p>g8Z)zDL_?w+hEk(CrWJ^z8@zv
zaRdbW8$^GMcabFWX*9wH5E<u|Jfnj&Ow+?}8Dmnc!-6-7EQra(uEEIsPQc_E5+OLG
zG0|B6_}fm0F|muN(|Oovn2haBq26t@fCl6qYLrCt<!>}9W>){?C3fLPFvAzT#K{uo
zx~kgBcOvm~mBUABf=BetNisWK_7aJ@^1>vYYK?!e;v2ls2-m<~uA;G3vDg~HA}xCd
zH%qUS{Z?h?Ug(G8`|HL48+9I@<uCJ4qy;RmxhU4{b@!ta__o#?HGKO@eFQJ82Y$?d
z%w{)pV)BdBz<(SZRNa?c^4EnHqVTVT(yqSHREz(Zr*rV10}e$3qdGw17$h5YZ4NK4
z0bGA7e|Tvz;CwR6Bn^(MCFW<HBYNsA8_Z7I(JA#|^?EqrV?Ks^kli(!!~oBu_eBU~
zj)F0$3eK}&nQiST9n<R^R5m|y&VfQff$Z4hccjK-40pgd%tdkOL(WU7O&u}2oMipB
zW&~m)n2CDGG|Q)9OsT}B+-b2{_LWJdtR{aD4i?f?9<tvUu93X#H%5zd2Ac>!xr}n?
z9T<qB!ziU8x;Y14)XZ==!fY>(vKmR919J`8xolmXEuAUNrws$?+R;Ri?J79&7`w?@
zh7BLU?Sf_<)@})y9~Gf*wqN8;YJ$s4SGSDToG$I-QbZ=btp$XGpB?y`0d-aw`t*O&
z^09H9|1^n?;pyTk_E=oCzUUCGF%Yx>tg>jQQJr`q0QWU-d0;@nW}7Bw=HQQ)`jw@-
zE4h_zmid5?`rIhL6#ABJe$~`p=UQH{LISzC2xiEkGP}T}r1lm5M(t6Y7%FYPRsCoE
zwdyr%Ydg`t<q!DBEA8^T8lCneT77?t1cMe{<$@Agd9E@P41r&<Kn%BT+#0?K8`x%^
z9w>i4n*VD$JxYn%F6e>btfD83O@PX}>G(r7&BrXG%f^#E$A~znfq@l3-Ce9(h&p`f
zfXc`K)fx|&yJvEMM|yz6Tjn<Ll`vm#cZqUp5nI0*6&<=)+Vtl)-t_0T>Cb;__Wb$c
zmgoBIVfBstx^>#Gwa?Fg(rtcz<z3G6(DeZ%rTu+=@%DaQ$MC;0(S+23()KqZmT@Y{
znP{LwD!Ak+1rIJI5(&w7^x?45*#Pbc;yA1}9r-Heo)~0eAsiWob2hZ9@KT(b{|2TY
z=u4X@e9zSi>}~ll(bWruPC0*>50j~X*~xb$M3E3RT^R-&{?Ehu>rp9;{R^z;W*h-G
zxg)sA82d^Q{V|D7X;2Sb;tb5Dq_D)iCctcG0Of8rZeqJWXpVFF;AZrYi-#iV?T_op
zLynf)NAw(g)wMO((4@^K|ItD;ks>;)80M0jIT3sy3tvMiOl`8<W*vVm48R#OVs!Yp
z>U~<)in^)nza5xMJG2;3v06^0j`AZ82Oz!Mxyx)1li<xc7$Vm)RXES%j+ti?g=c_M
z2P&Zld%P@)gQp@|@TNJTmo42mm{cF2W(0M*g8G8#WD5X~aIrnfo-o?|$1tG4t43sP
zZr)m-xCXSQ#ZwW=jh}yB(3;Y8(8T)Y*8N-SD%N+{+D2<L=!kWuqkt!!pwGZw1G!yo
zMN7WcZB!R#sCBPcw~=&zrqNQaJ|?+0!3<fy^f7~EoTbB^Kbqb5;h$5sjLZ;i+?f*R
zi04IzSoy586(?s!u)}y`AmV^|+L=OT7^n;}%pV)SX+jo)`RsqHtv1{A5>7>W>GrMd
zE&K^1HrkM}@)Lt2v*O7p_+n8EQOFfnbv~puGilRx|D8>TJS-7l(0k;4v$7G5x^|c(
zm;jw$*Fazb-iL9wqaMcHGb5Qlk3P=$P`Kft<lYXNS~#BcddM^MQW&pX%(EHC<cQ^3
zl^Bmr!NF9lqbh$Kg;=kTq03v~xtU3-iM4)gKXY!aAIO!`YyCuh)ePG&oL&1Ba%aDA
z-fTGnsgf1zuCphiZz+Is9C;dF2o_tC5&L&JCG16)-Qv7e#pS_Al@Yq@^j`pKxKc6V
zo6rp0iz27K)CjLyZ?k6Ns#(UK)~}Rk>}rb%_?yHA9wmQM7m!oGR{vtp!_=QqDn4=$
z)1faK<D-19zumt<Gc*_81l~zt)wUKpv%I6HbH^1OkUAm`-S0S^^-pU{5nR?ezlq*a
zuR;VcDUZ}iwAaqjd54)N9_gHc7j~5C(o?ubJxm0mx-(41Cv%bvTUKPLRIf`5qof1i
z1eGdc2GxJJ6rD-HndDJ>2<Fy4PB%8eGb^MYB$3m97F*S_UUQ7M^b#(0ajDC%ml*HE
zGE&|Cd?Es(qX5Bhn-}WdE1?mN0QECfOiYLG6B;z-7}Z>6H41v~7J~zh%XcfqyEeOW
zzrK7|72az)A1_wTVyh<(Lb;X?88r?OIwz?sv$}t{AL8n`U2z$YS239vrvRRVQCjgi
z3U!sieF#H%VU}V^s763np=G<Gyx*Ts11XYEk|H0m3$;@)Jg`)|;-;C2`GKkuaCmV+
zAoe{u?tvx$Hcf|GmBtz2T~3;B-pylBe5hVQ+~}SX>CW;lt!LLdFOykWtjb0Bxrt1r
zuUda2RcR_0vqUMNjIYH-9@PCsf`0bFbaIq#>CB`|80v?WYYCP`CF%8IIf<kp23zps
zaFwG98xBM}7m&Fwt3WJ>-*e0)vHre{bR}(FO|+6x!hY1OdAHf(c_~+uX@gYsL0_ci
z@Wpw!NX4?n8J%~+$66LhX<Z-=E6iD9Rn>nEc!4nWNBkrWebtS|lU&gw8Nq-?W`U;k
zyBXBJVCjLlLK&77{v%v21Z_b4<4%M2Z|558VR##H-D%2ce7_#4|AUWIV{@+<9q~qN
zF4tG3k=?xto2#NT%H!qI(^Ec_5ORxmhr{fIL%*x0#X4+}-MvO*cWhmksFzD!aOHp0
z0K@}BSp@Ca>LyuN>qo--9?a@0HQQ%&*|C~T2C1vH8p$dYI{EY{5d&=W02#SvM+jg8
zEyQjf3l6?9r>V=sqgys3MLR+i$_b~*?~Y-$XP5D_JV#-J-Mx17B7-lMSpTzW{*N}d
z%{5^paV`hrsK+7EQT!qhM=IHPUk-nN?-v1DRg=~C6%hG;5x7?6YTDKOmVdd*(m1=6
z0Ke|K)@r2Mv(J-}`rCgk)!)V;kD<~?KV<Zq3*_M|-W%=!zLie#WUO^cyID#9e+3v&
z>?So(L(4C?o(S?Qq)wXiONZ@9@Qazmp_srBA3Px28g|pMGb1iT$Ey2QH5-2fcv-JX
z-IxE4_MUhXLU%qL)~xGe#z5s+G=oArSmaJn?ADcoCDzLxa(Sd34RcbQB3Mv4;6tD%
zT1(b7sK1xR!I|@6vsaUIv^WamuqYoB29PY@!|p8gu7Vq#r<36IZ$j&D`CRok%2KL-
zeF50ee1{V6-udEw<~sl4S9X6k2VGvt;|%vi=R(Ya(uDs~ozHu_FKUA~zTc1DJlPkB
z=lL|BCSGFVFyF~ED^f)Z(JJ>BRPXh#L{BBu>)q-){S92~7NZ!O;GnhcAgj0<*EBL`
z-V74&N|-A&bv9-UpNCxUrq*N-e7Gal@(ctTEbS@w`Xr;|pQ^v^@=t&2XdN+t#cUms
zJI{a;vd$HpQ6G}-#?--+M~G92PiLcHD=s6`fk9iDakz1&v(Au%_bQ9QI%cJ6Iir1y
z^T20swqMCtld341@utG22}y?VA|)549QgR$iG~($gt-iohBbJJLzNEq-t6yQJVojI
z!X^ht5ksh~XUV9;p}Kz^A}|YH?Wke7kV%SGu`F-!6qDh;%I$iN6bPd~eEQdYTG>Ig
z$D^B_-(W10e9+0{b?^l4o11>T#nl#huaeNn_OpxIrvWb#LN@41R5ENs1<i8*l)t@`
z_P4sm3{WMTJJ9~QM9n@Tp*WUcZS5(W((1OT+3!H^&T_Z57VUp2jto{$;tZ^E?!x1U
zxso#(dpz}BE!h+jN3gc$%4U}`lD!?GM|-qOYu#ff{Lb1Mds%S?J%00a_uy&tcK_*{
zXmrkReZP0`UG)6bv%QypXgqtf`|=>tx1)ns`ph51_qmO}pK;;<1{p+pm%{Xk71K1p
z+rUqe%+Sv!T!VjlmO#;W4_7v0v<ftOP<FdSTO8k8rHGd8GyUAo;Altv-#x7)89M_r
zk0T#u{qvH)If|NplRQ#5d$%?=w>p~}oz1(PN7dXXrpIR|-8|&<9V=?pe9DC)@zO4b
ziCFSebC)}2mvU)H{t0KtqGyunc!wx?N1y%UG(DlWAMStrQ8y%QkB2*hBdoyA9|uR7
zGqT{uI$i1DRtLVMhfVI_6aD+0xvFoKNTnv|MhM18Tj_6r#Y3bDa05UFUEJ((H982@
zf)a5oI8zE7(H4*aEsWh0cY9CLj6LK)B!#Ys@nt7t=8J3}cm2~18$xB3EG%GjjtF^4
z=<Xy({mp-^Z5J7^8PhZ>QviE_lZw}|6dpi-TYP|!wmjnl1ki<CtBntk_uaH0L!9P>
zugmJ;aW^CvHNX=g4+PVYPgG#jVmv+K8QnKepY6SR*$X2zxh5?01|(7YAROIn435W>
z$K^h%#TCHAF~<QaNg#W?NzVH;)*H#TQ+wAnQ;~ma^=et9)wjwvqX1NVn9NZnL@XL5
zi@6IqFr&6;TBD@@YM(yo@VDsjab*}+3re;@vDvw%m1b-CN2JtBmLuESwMhqw&4_dR
zCea}ueAjCz%E#3xe$O|bew>kDqHY0rpnOdZZ(W6lOa~LLdpgL9o2|OMsZCT@9M}98
z^0R+&mb-<{#+^|*LL@RHS4v11<W`oH#5A3RG4X8@Gl?36vsn6o=3mex^AN)5#3C7$
z0-;1|LYp3-FSf*f6rySC3WbQ84$7#_a6xuTw+%!m0B4bbg)aF;#0`(&Zs1?b{U4UC
z7zUQ0EY?cF<x!4?mL*~16`un{DDHV-QNn*@QcKq>;mzF$ifqS?ic!3HT$)J=@MWHZ
zarAaVhjwuqtj7{)u4^N6U23?yA+~TWB-gbOxh}P}-OvKJ1d1y}J95A`tZ7yr+o&@c
z*&=zH5w7m>>#CC2BbNnn)<bYz8-eRm6q%bLZ!Lk|x;FAw$+%cQdpAMcS^~LsZNz`A
zD-5rSv}I3SgtWB;YU|2KTX(ka-oGO4*(MiW=J2)9LhoWI<pqeXYa?u3VfH+-mKSZW
z#8?(FtF8@Mb%o*ahOt{hgIB?-3MGT$G&`Q%R5;L=zlp?1<Jv1r3VQR<?go_&%DTO^
zXfYI}BnUdZiM1b{&(aRk8x#*4G9rKNwjiCsynP&AG6_my=rF!dkIc>iL-qIjt+=tr
zR2NoW*V3dzR3ixca{$?p1hjmiU?v2W3S7Mb8u{?N$cpROVoUbnI4~-6DZL>5g98Lc
zTr!n`lAHycRlUlJFvbJhB~?fe1BG8N<p#MAtBQUg<x2%FFK<Z|hD2qbI+K52{4-fu
z>xwiuLN9J802d<u?(bKH-~IhS^eu`oiW<>9$Lwo`_gT}C#Ye>PBw?W?u9U)&98wpM
zuTTR;Hd_p##xQ>7;AsruO0hkdlWPS`f2ODQ3IWfb=^&MWWpk1RF0ya20tmES&c4Hv
zJdA5X)5s*^;7xeNL*Bf<eItL0Ew(|h``hr?m6QW)fNddA=8c+3Y9dRyL`;bnioT`@
zanmeC^wIb{N=EE!%(*^$5{oZ^nFu>MT{)Oa53JO?;7(Rqg(K1E91&Vnj&gvu1X#3f
z{}hHF0*w$chMbEq9%dt&!~u*^P>ig&FzJJX)Kc>^t^JEot9Ps4fK-2zPO<ImZ6Nhs
z0iQYa-!Oy~qHf>Z>&oYK_4B&fxF$I98`n}tU3mI<tL?^^euTA4%kgmc-is4@ZxjyC
z*EbMI8LtG=f_Q5yjslw4nRb%Uf$@XL;~&y-#uD~0ITtRiMrq+xTr@M0%IIfP&?YYx
zwPjUzP&8Y7-Q|EZ0|kFDEjgCNB@Z|NK7Hs;oT~liW)tj;{0sAo(FFc5o4y<rSV+lo
z7}C_KR?s<&>f1%>=pW`Mp@UVb#bf^;F*t)15(Yj6TQCF}vhKj2k24Y$JSV=UQhsY|
zy`}p0IeX+itJiX@umfU^ivDRjN+d8EY&!{emloePsLQD_TRnd^8D2hkTnBjpuP?Tj
zu==YP9J+Go&W&pDTwQ}lFvPt7KAkP-W7~G)0<_vol{9KzOv5$J>y6`F3YlncQa-wu
z&O2wMNOZP)t&5xYRY)q$yGkP3A}yM0v}{Z7wU#&UYqwmbY|HY=snh>iZJM3#&(4SG
zLi4yoyBfDtC+2@oThhEWT4~-_G$}#e3g<#d5CUSZwX~(?Nt&e-vfBJUUp4+1hEH9q
z`9{x;UTq1kyB_al?_wyspap7`IF;Y&B!!G}Z?K+15fXi2f4d!V9`x}LZNAxRM+eyn
zan9Bs=nzy9bEHLLxE!*WWM=aTqlGaZEVVP4ACZu&M9hD&BFX58F%HWo1M*PWRL&*W
z@aCBbd<OJeq`uhv*j22zy!kd`o&`x)Q$E_k#fbNPzeEZNAj&>?1e-*@-xs%Gccg}7
zN_M!_tZ|bY<e~Ub3FxCP>ZGvXnT28)bpUlhiocyb-fu&x!!%|yT}Kow#R20h`7ulq
z4k%}~Vyr#MKLK%n9A)D~E$=M5FPn&HZ+x87pe7_v)f~T@n*jML0E0YsM=;5l-ORsM
zh$rPLJ#a+7db4Vuy@ni=YBl*tl=o4pHcC|T_<5upg!ec-x<YPm8F~8f!oZw%poW*H
zWvQ^j-*d{Z&^ob^%LMQM1A-x@Fq784oaWlv`sO_sBhfW~|3|1-v+!#|bwI=Hp+x+@
zO&j;Ij1EZHUMdBf|4-zkA|KA>{BUIc8FCn8nRVG^XihL{*PrF$Y>NI(_YpN+8~44@
z{UJYsTGiz;oLzoPDE`Xrg6y4IM<XPDdb4Ej!o4gFJ)36LRByZNrAm9L<b@^aFdMQA
z$&;8O7>f9Rg{ps5!-MPVXSP1Laa_p+;XeGDc8EIb!|@j@ZhS36#n*`<UtY%-Rkieb
z$$qgJmtZYRB;{C!Mu!*CR&1dtV;2{`9Y>Gzi54Wrh0xS7O#1I{wjtzAZKApra4pye
z__MSLgzJU)g<{qn664I3$(fwNfqYJFI?JQ8<Xl33|K{0nP)?z=7*`oo7~Z<Wu6xcz
z2`#NhK;xIEan^Hw$5a7N(}vvO8fqm^zX$Z&8wbVHv_uuP1P9Vlj*!C%F;}o9J*Fgf
zsWb#R_hdS8M4#j&N%9A07U5_Gva<1q9ALrzWsCiFZM5-8bHS^10S-O;ILLk3w3wAy
z2p`;kYinLMNa(GxmN0PmE*6y>6n~4}?nSCJ9X@`(S3cafyZvDn@RA+*JbDf_8U!ZN
znwE*Slm8?a#oG6CG|kTtM#orhl1B8u|JVP6bvm98P5EJ9v=pgvyv!mRlTfX>KQKNh
zn7(DdGK3^Mb#P)qo{><PGzfEe@`xjIIlotbKbiYqb<^dJZV5V~E_)|J^S$VVzF|Ta
z_|GnpL{Br6frQzgp7R)b$LsF?I{kl_IYG}yB#8yko5^$yeUS?x_sInE#v#J@{g#uQ
zwlK86e6Pju%JV{#gk4HTKBlff-)n0!>;D$L_OXa4?gkVfUYwjnjed>-XO1q@j}sPu
zj#qn1c?IIvkQBDV(q8$mSd<pMNF*^Vc7XSe3oKdtmypMY!wrMjfdq+**=UD0A+Y!K
zFTP<#6|GnYi-?lQ=|rWqHT=n0qx2<fYmew#-g-*o3g-08YVTwI@u>5^|JVPgCn?sm
zz6OEL(qzOHI9M^{zc?<B!K4#`p6*G1kp$F7l+ehdq&RK#VbSgsQRhFS*RS>uqD5{A
zq+9oD^k0oA>U<Y9F|d59i6lGGqm=mKG~)67{ngtyor70@efqNLLgM`XorUs$Fp#rK
z6>)>F;(<uF9a>{aUY3sHIMy5Z;tt6L2OFDP+qZTfJr1w4!KTT+(gXUND~|bpkvWcw
zGXWf@!)h&G8IYcvL-pZ(PP^LRx?T7!Z%z+|&L-Az-pMDj!As94f!!MeqXwCvWJi<6
z#(_y0pE*DVH~<PlVe^Kd=jjFW<sX$PvkydhSJK=`ebDV+rWLtnL7chdUQW|duJRnV
zl}x$u0cVw57ap>%+=Yb5be3v=s^t{9wz+(fXr;b*siXr*brNpDrYh>mNAWG79`w91
zer?SuN34(V)`!y+;h|VIR=h_raN+S2QmCmDKl)WyB8hk|$4k<uk{n2!r^u++WI8-w
zm|fT9PeP2A@bO6U!9!z$PRx&Px!X3hPvx;GO$*=9suINg_y;fgdSripiTS8U-#<g!
zE|-CMFUW8)be%}!n7GLiCIJSy!ePGAdF0C~kv29X+2VbgPMARXSbJ<oBkUT8{w`^x
zzK^$i*V9e~m7lEvU~&u3#^=ds*jpj;&%wnCgxdnpI^3SU%5od+af%Gm1US>gI0f6G
zR8%rElDK)*JRow7!Py~yFcM;$M@*K3(tU9W%H(^I-F)?5VNMc{Fm;la9KEz2T4;(7
zm!^vVSCEuh-q1jXl5p7+%m6pSaq=NMNx}hY830LYkDkFA!&_I|P1p$DFiSGC5N*4w
zBgMIwNTv<#Qo2P`F3&g1g04Q_6lg+xyrL%@LZrO{xE^=EzIkhZ<Mz6u7IpIDj^{tX
zB}im<bhK0Xt3_OR1o=K)DEf3k2_<P*@+Do#Bx>oStMwFANcxECNL)LI@e4{XOZg%R
zTHT3OaQd#G#?VndINyo>vj6I3EbV2-=c_+z54|_9o;`gN{q9Hn`KcFuYDv){?a$#&
zJ+OF`I30gDT>1WgMHhJ>FLz%&U3sTZ0~K?apR95`KfUm~AMNc=J!(<I*`<6%KolG(
zGa2UR2+1+ZiI^n_^)wm_Ae;-u6Beb`Kh2V(2fQp*V9tk)-;_5@1NfW`Ek2KtHDzc`
zHGzwZOt2CccTi9!jY+y(g-u#wgM+d&flKC&ms%TyxVAfgeS0M|IZ!)za4tEU#c!F+
zX+v>%jWaz*wYwsYUJ_RcP6Dn7SEEw7Y8a}+II(~uCk2?@FCv}vv>mfq19}e2Cca6U
zy<B92b6-~kTauSp=?~8kUm$VeRL!R(NFq@<`)3*wi>3eY;UWdx67>ahmPxoDdhGyX
zp3ybj@wcph`fnR&_k@;@P5?91!ab1`T4ZGbuZ63D@osOZj8CUx1BA~qko=-6I;{<z
zJ6wW!19Ct8<el-`L#yuX^bLLM5<0nEW=0{c__OBErd}*e8okVM)^Zkkr-LnXIp4~%
zb!mpIN%I$b^Fz+(J-o^~DOd_<FYJ?$<I5uQV?Q*1CbLKq`y>GcYr06Bq+LjLMO#aj
znr%bsnc`GuPs^T)OUZMHZ}iQ0YKR%Klizh?bTX_$-Sz(LzWOvJf<hldQ_}cBdoinI
zfiiQSa3YG?y1|3#{A6iO5X=;5$H>0?iF{sXGeh_)gah=#anMA$>13Y+ZGvEHmL3&c
zRm>58eRy?E#ygEp^je&7rp%%|W9nywt@$6a;Mms(k(&8>ntcFYzw})^{G>!6!KR}}
z>9!RW5t5>&rs+gz1r%qA9$4Axs;RrkwD+E0Y$v-EA}sXm)gE(y-;lwot$rv<q{(i}
z(oTZFVl1Y#dNbC;K!5X$o;T|rQ@~k{j4r`{f`GE(^07Tx)(=RT5R;JqXMNqz7Vhv&
zhE!=p7;rCp@v&S{2dYi$835r>HBUKP(32b$eERP_Vfcz7RrN{VHZ~Z(q|jFOLCw<V
z6%7WR^Zn2pZzbr3Zzy#iXX&&tE5`?fpPr3Sw`w$L2+4HqQF`WpulPrzRhoZBF_UM1
zTTYh(;99URB$<r;97OR@K=}Jfcz!B4dAqOoEUXO9#G*_DBkWZbDlIx~8y<i9yNIK2
zxo*vvR@T`FaNZ<ZTtO1uXpleTM=F6JV$Fwqs_hK&=IJya=ksEC9>jM!6L9Qw5=3u1
z6`T2Pz;8k9f9^&83}ME|-@>7G+?+3ehoj*Fd=y(6mDnl@b*iabpK0F22@;oSC~Ir@
z_Hb*Jw-u^a*g;u7?}OdE%2Bf<(Y;3?WlK`v#tQH4MrJ}L4?lKY`>k(Z6!t0Kil}c`
z&_mXwmH_}`BN)Q5uQE4`>kGn4vky2?nA`CsVK1w}8kMvKB$U?b6m;Eh^3qj*nOVEU
z6<H%eO?NFFfO|ZMdR!YW!TY8%(BQcE;;QZK2M-=ZD>jEKElqu<t@drWv3L0JE={IX
zuH<eDoej}-Ser&IOmoxyk>7i`x>9RmM*Uac6r!i4AS!jEl`zE^DX@j|tag+h#jxKp
zc8YS3RZHF0$=eBL(NeQz{=>O{l9Xz0{8N-7=%zFc{s=a*miY)5E*Mw6vL}646+XFo
zq0(1c)K9H&tfr>@N}|7#=r5l{!veoD%f;Zm74LO(+0YBTM)n6{*XYDA>~BU4@MV1+
zxwaQ6wOu9Bc8NZ<%CCEECUkk+^n@vN*=#hlaIL4yKoIhEU%$B;UE&{qqe@4QE)-(5
zSxbq{R;9cwz3i!w9}zRkVN;%e*IKAYOXS!M$+1*-SLf=%B1w9}d{CM!cUyV_X;$ar
z%ET!vAxq6$raZV3y_W7E((M6=A|A{~lVbJ9CWhABDX;6NR{1S~lPVtk2;(&zJsre^
zFkpwz(pg8d%}>E+GChBP6UG;I*eMaXKuaaE8jVNihUeDyYHi^ZVi&%?tQiT~EUWhH
z_F#}mw$gr=pV7<HpnZ9wka8~*3&8hnqU%gDZhem$f1H)-u(BJ;0<^S(nh*5KihSrQ
zm2p0-9|Bj!$PfZr>ZOuN&kgQdFd6@glQ~$D+x?J}K2e+|9HkO}+>8<w;46X&<#v$I
zEP-INAX*G9eP1^-^2owmlwwH^@?h2y-(klUi*%p1Qwed@B^8ehLNca+{2a0Y0Lj5+
zKLz{u&vNzQOWwv5F#8=Seyp~Xon#QW*B2dUqF$oOhA<I!esrB9h$tM+soQt%-n+jM
z`=8Ca$Hh~GO>xwJCo0}>kE`PfIw8lIkmUR!8O}8Zm2t~~b2uRtbM^;uLyCcJHE<Sc
z<S$1NyJmXLX0KIhCGbgB=hn?C!_~mK9+;z-?yb0HCX*qD^`uN)rr_&ZtoFwI3>!k`
z#8GA~w&(=QL!0C%`#~Uv*=0Oa|8h2indR@hFP>`#7N?GX0*Y*$Op4PS7H4m1ci+Qi
z7I6o+9j|!&d=D|j`MBePjy^aKr8}B@##3@c?X@jJ<}F^Xp<k}c%oA93<E@HLoT$S;
z4fBqwD<K4<SnRBT*X;$*2H1)t{`QI5gt(T(Jg~c25wvCTDJ~S-d3ZhdQSDvmv9NB5
zk0D~0PbL9>g&T?)#Lb30%9}tT;o2oyio#7DK#-VK3PVv<ogHl?wa&s2Dvl-gd<Kgs
zs;N}8_H~=DA1o<=#^$WAjcM(=yWE0o?@}9T)J$B#sgW&BPeY0h+3R1^`n@jSk*2i{
zLXfB>H(Od7DybS-%^yOCoj>PzW3V?uU~y_49eG%P;r4(UodO#GfUIXR1h?-5S%-F=
zH+(t!f@U3J>fGE2tnx{wOvgi@8OECf_$r!$<=*_8z1wWT_A(FZp7-|Y{NmW5XP5!;
zuuO1MXH-I!PZNnZ6$12gyxg0xxgqWZnfB0`@M@fje+1^z<UB}g58>P-ypO>smP~}C
zT^!1PT3&y}^-9YnAx@Bmu5c8eOGb;6=fc$xwd;p`!31u0>>ZSskaxm)w3ank1(8};
zS(mMjynsd*)&|1kcd{4`DcD5gM&tWbqc_>Gd5Fr=kckoUKBb*9L?Xn|Fh5yW{#JG<
z(X=Rxl!`VBJw*Q&ozCf(0pkzze4?5CK1_#y+k}}+5j>^bUs?jc-xl<HyCon?iP)~W
z+MM`X4~^*t`0Cn%;^*4~7VnMud6AD1f54XMX)<<)Dg1J-x(l*@!UyVnqr^-!nDfdG
z>M0%YHIC>vbeZ#u#0OpGIWVHmxq^xu0)Ce<7J!c<4FWSIOi9QCltvveTFE8Ebq7{|
z<_;bViOS}LW4J~-d(3CtNL;-~HDQNUy`eow7&Pxpz}L_^&S`wMKWg^rt-IX-zRsU4
z!Cv(Zxs8UM8^k2^^f<^Y`U54&AxIjV@UDt-?ZU_hrDzOC@!v3ZgWVd+7<ay2D94%T
z-|q3q9=C^kZQrZ-Gs|<28@f05OR|)IZ0knjaQ9mKoP9EholV8OfY!!G4Ly2cjSZ5&
zXW7upYwTQFEu=*&H{W)-+)n0$6x@dZH`HhhUk_Eq>rrq_`qzA9yW|0Q;p9*ff66gy
zTdFw~>tgZJKN-P=`Jo5QUiRXw@GsH#>SfW7BohtZV1zU{5@#ieO(&Av;FSY^w@wzg
z7Du~Fo?!JvR(It5wzN03Mw>jBa(==z{Xybm%4rGZD0-hiM?zDmmbn>xyQg#NBRo#$
zM=o$7C=SOyZJy8_pb5#R?gd|=ZZiFrtH+LQ-rCq+*SQO|Dm_<iayqNBoGpzXqv804
z{PIKEy2_ArB#k{Txd$T?sna5Vu1!amY`|~uOw0UwrOn*dn49Uy9cP2Am>`SNVO*D~
zgtNRx`5+lex|X%ZZ4{D<<Igl1)QrS*H=?eHv7BrZ9BPk1@p23lsiTU75hNEPS=1z2
z*%>>b@mVabI<wtiX0?ACju;;0n!{m0(CdTd`h4Bk;ri&jTYg6If4%vC^g&aMO(vwt
z4Sh^!??F=`lXQPcI*$%gAJtpa2Tl96xwWnL)VA17rYA)g=E?^@Hs7b`o3Lc^LAu#&
zN4T;@S8i>6(znj(6S6)X;Pa7t?KsbYg52z%=2>6flb>77cl7%xneuJ1C+_05{Cw1W
zN6ogpJE~}et`_~4U~4dc`52j~ON6J$)T-As*);xZ%=RAaT9?l@J#_Wy7F%%reDBh9
z|D^ys`Vl#8o8fF@vN6|Dd9t5kuI(L~>*Z5TGrer0(IzB^piJ>$X)!O``1)|s;ip@r
z3Y-Xck=qjXr1F?_USKQYCE3?L^MQ}GkPI&!f;`*7vsW5`)k9H#3nPuAJcO8;pwo5y
z;Vm+O<aCyE^aUs`WEt)#b3q!8Et*?G;(;uY!(|GEJf`Hp@=hxCG)eC6Lc<KO$w8DT
zUx^2=$ExtpO0ZYT8)d~iK2}^Wda>2GY+SOZzUrW)3pb*Gjp%Hy;fOi&$%;)oKDEkQ
z^Fo)lIE}wNN4k`M9l6N{Y&&~Ke}+NG<mw1i9r(5am&azFlKgJj9of_&4#1b1!lE@-
zNP)7%UoN?GB|Se#Miqggl-nwjp@dnPq5#apn%r7%Nrg#E)oqg(G&0DdH^Xv@<@hS(
z8cGo+Eq?+HvziPm$sU#TS32+dnzN|wS=orA^fVbB)7L(KN5-j(nb*FrV2to~#)?J4
zSs>Xc0h@%BmSp#u<b*K%Q^VzK(Kj}IIX-VQ;HWw#hvW#0>swZ7uUt&&5VP^_5E<DH
zI_;fh%>4FH6H#Ourk5q_%TayT7nTg=zkP|-4{gsjHc8-j;kZpP#{>AT84a^S03wh9
ziJ3qcic3*{x>|;gRpG9d_?AVLWZ*b@tn<t(q9$gK{-uB+btdaL;_M-)S6r-WoGu$y
z!xSeEz93Pac9^ls9`xa62s6N*oop63Wg4$g@G>19cVPETeL3Qyl6%#~LtQ*ns)FfO
zk5lF&H}5iZJ!_*wF0P_?c_90*D(ddtF6T#!yRoK!m@nta1^yKPy(EM5x23d*QhtNW
zl`p5rm#jvl+)U3UzepLx)%CKid$$--qocAUvWt|{x~w7%UQE0Oox|sM#dyNs)WmB2
z=E7j2-~7hH_UR`_WUyW7ljSKK;1n+cbHma-c;9NN(pDrvYSCi-A@y;RoGx9Qa{77*
zcO>k8uF-hw^fO=G)6!kUCuybvrgye#lv!r9I%nJ*$sr*cZwWHV={3gT9j9e(<i?`>
z?eIcS1VBad{SN)l2_9UAR##o2Y{OEgvawMX`%jJCVUf3ykUj*DWk#!6O(lp+hj3Xg
z=yiqa+cFFv9~?cMPIDK(4D?TNHwygAG0L`oLVndV6<L5>VLatpU@6{J$B!GtbUp^(
z$%iEXr)f~jyaw~IR6Lu#v#B3fcv{lLy{Jedhfhn7*5Olabh){%Jrg=HaT2Pz@^Lxm
z*CwN)by(^3!%B*9ofr0Q*B<K1LnS2QGCarfs%=Jl7ve(EH&n*YDvgyh1M=xW*`GIm
zp+R8EB>W7Ow*HbIU4U*B7PBoh&t2WF#J8qMh^984lV*xAY|?DGt<(*g4vNVz85dn$
zyukSHD>4t|^$xw>ac579&b_qYy4j>orDy2JN9m*?314sd1F$K6q@%6S;$Vc-&r3nC
zCu(<D`dTQCy>9H2;b@XVyvRsr6??OPxO38iw!)y)&>?0s0;|?ceiH8IbzYPEUFl1m
zoWZd94LV$i`S&}Pp$?h>$J8tb?%2a!bG6WLa2}Z#X%fsa)pK4UY!^(w!zIvsiuU3D
zi-XtK$;1Ap7|kXvqvwUJZqzcfN{!6S-4ibN!M4J}yVn|qeV|O8oy<iG1<m$<d4kS^
zv!Gu}nbA4Xlt<1j8qX?THJwMTV#cfIV`%)O8YdB+YGB_kg=+joNKYAyGO=?0oWn1+
zQR@9`(V~)HAUGPn9UXy#bb*=}g%ZI$fVoi@yw=9Gw2MPVY+!Y?Za?4AI(~5a2SExU
zow@h5w0!y@udUd9g|_6~7FW)H({P}g$SC=^wtk7B6^RdqfhULse#nODi3Dz`E7J-2
zav=Zlx1CP(JR83+qE6>wqj5-wxJVA~JmA#@2fMx?GTa4kl%>@>x9+b)5#r);Y7%W!
zl(wBnaJ9;_R}*6t;C0bnzZqN?zeo)bcd3GPF~hO8(lIslKAVsRlyEhFT>Q1Z&%rF+
z7sSB32U9w4j)`htPxD#c&r!@$?nk&E+5O1h&zv|i9j7y2e3OL|D4ElIOzX|acr(1N
zBt!K7GM}j*jEBCs<rHDD5+4S+e@+U5<Vq?9aik-xrJpHf5JO8v$pS~Z8N(KFIuV3u
zeA(x~^xX&@aK~Z$q5G?U;rh|YuZQVZLf8EQ@P1do@cYtme!gT-1+$Omjc=4{1uZQ<
zAXWmrWLW<oe<pgg!dc9Qr0ePcNi%wEm8<^*WuZ#-em<v9j!UTfP8Xg~UlRSZzSFAa
zRQs%}(ep+6^!#+3pB)dA_vy`;s((9Zs>)vNdbuQ_dsm7Qj;(}$NmwDGRA+}j!9yZC
zg-;-k;jNJ}HbpQJJ(G4SprY3pQ>l!%ci|`$;Gv=A&>pTv<X+9*^o{G2g^G}Mog@l3
z7&5Q0o)kNZ#KQI^kxt$0U5zEWIa>n6zgT|ns(}2TS(oKn)%UKzOmAL@@7ml}&A(lr
zvtHs2ZiUQD96Wb_SvfEN@?(j|iXK|g?cf)Xv%^1wae!e7L_;?~l&>A0K39u8f1}~;
zqW~XZr5{Fb_ID%T-M>z<X|)0xgHME`TQWQWsi?)p|BA!&g~Ki$o_}t!?!z^P_q{b!
zTy1MC9(47?bI&c7BE8P=-n!~k!R*P!+TpqCke3XvRAKdh=8OBpRXw}f>`D2PN^dp8
z)8}d{dfaGu52HhNS=g0#phxbc2!;oJbD_7I;qi04u;N5QAT3?H?(k|C_YHL33yTBp
z|6@)>doz(lU$sW6!U$iiocerCROX<T+9Wx5Q12w9(=m>$j>78qnKZQkST5cE0^rI|
zt`1kuWBz4-ftCNf|NH`=(tqB6ZUof+jFXdWZ(05HsqV1(#9=N+TZ$YGbHy<dHsFEo
z3$EVdpv?7l94QLxET33NKD;aL>DOAj9nm&Gy_VvT6Mxm!&A^!H=00tlqx@s|v|S1x
zjY|v(IhHqMNcyTZQe{YdF@TEazw7u=P~|g3hA;7d9_iud<~=fst8pIrT;n_vGg4`w
z`4jS^pKRY>e}Cz$_%gg5I{s~o75GaF9`J81{ZuV?FrTn+a5GAFFZ+h7)U1~Sde$qY
z>IXF9aYudO-_nwCOUV${QC8+TUMZQ5EtxDR{w;P6>z(!l7kVj2R_&W#`&;MN-X*5P
z1iBZ0xP)D?1Zysg=~^DHaMao82zrC3+ZA&$C5wYAnGjZ5K?D>#QD&AfN}bI|sb<~_
zurETR&MoP}qP13*Mr%PNUmxZt*?6TIu4Vmmpq7g+lAM=|SFL3qLM&S&{gG4LW><@b
z;<>3`48qGGI6Ay!DaUIwRC&6VW<ZB6x0Mlp9|q5(M@R-N8^_yeJz$p1*zE58XX!_h
zK8Zh~TyiE^rEUyicHA^QnGcicVpB0YDfhFJac4eZ$DzKyQq%|0l|G@6_o^Xu(L*Wh
zMYPGQ0-w@8ywfP0e!*<4bFB@O<WWyHCy#NI6&<UG4v85kK~-YBLbF;7xueC9!Pn`3
z6#h2cVQov?IDGRt>Eg&!_G!uzF6e?}nsM}+quYEL>LwGcKIgvd$)l#aBRQI9h-gAk
zDMvo}?`K3p91Dn04G%@mgl4vqPfwDu))mmwA7MxiKbSbhvJG^3t#dk9sH!gUs~m;H
zD-#f^8xzoYI7Z}|#+e%fXW&(8MQq%E9CR8e*y*4Y5Y7>jZcOI_WX&JPAB9eE3OKm*
zH_stQNv#Vj%qY=DMiBtx*IY<689){{l#JR7p`^Xn%I)^m-_!HqpxQu>hSKvflUV(@
zp}^Z#agT?Gcedmt!-9!mK~r-%81hkPlm5@)ngj~XZlRI<UScScbH!FrxlbW~Jw(Xt
zX-N(~LM<**)!-rGBE_3O$%hDMl4>sO&C(Ci8j0ci=L{bUkPzu(<Wc||MRJ@DJxXm)
z)lBgtYeS_Lv#^Fw+E4IiHj}02;ybBAYN{W+Vd(`fEJ?Y9FU^Wr4L=O&%u*hdOM?9_
z8p8`$oG}|Wdec<)d@qi^Pc;L7g4rq>2JEDT=5d@X&4f$r^B@2y8JRJWHqMgqtQyND
zQDbWFuRu1~ceY7N=0uxfel*Hv!VfXJpfqLgI-zdminuKXfqeP(1FF~7kegk)cM<(>
z5&hQ&Gq0^Z_EFi6$*!$MzIENG`SjurwmO4pa#jW^0EAL9?Vqwj)iX|i(hIl$LSfL-
zmtC>%ZQ9)Er`$Kku!S77#O+GVEsRe`baL}1qqya!co9K6Eq!Ph<<4n4{nQF3bB1|v
zLWOlbeHn$4vUZl7yIgb5+}4Ih$qX0>^0Yt(DHkgiTE`1*ybbt*D-yfL30qqnDjejo
z|Do|4n)53|JmM(ZajkKG+B<**?U}y7p%oTHOmf~VoA`<3qk^N)G^Sc1pQb6|v;8P7
z|Ki%wtTr$U3pD|~BsVe=*`Xr4aPpEFUJcau+Y;FYI=LZe*rDCw6!Jntdi4baciY&I
z?R)6!+C62ojTDQC;QSl`waODn%UQq6Q1PjI2&v!Y2KGqNND-!g(npNeE`uS>PD7n8
z+PodT$i^fy7dBe)bapbl+nLF`0P)zo-5JS~*X*Sey#^Y~R`l4x_p<?;p1iP6KoxYh
zxHB&P?4+r(3nG-<X!0TYpGR+=@3Ty=85e>v!$CM7S@|4BQY}oncWY7hZgfz_V>&E4
zuBDE&6b5LwR6+57n)j4GW;i&yq3Z44c1=Bbw4i+J^-##y_d<h`c-S@l;$^=7AJ3iq
zxL{CnUH#lPB{z_(nU&mkUsfId8pYv1*TPg^K>ivwq|dcH@d)5?k`U*>==9QEv>Nas
zk!fJrqQ}QQQ!+}q#xC{X1tWM;a@SojimQy^BBz}=>GDZ`y5Rici-!7A|M^#*gMBFn
zc%hSZ!Tt6&^r&7mic%ENk`XL%p?W8I;^Vd42wt1|`csSm<^LAvK-AOA*5HCjDF51-
zmE_PUol=-&XchgCeY_c4<`<=bDl?`_6*nVYQ8uhawMBm{icD)|qXJq|WJm#5MN(0;
zJmiZ))z_JSTW)pjW|@I<<!4ri5v*A$8pB4*d>VvP8QRJK)5#2+zs_nBK{R#_9-0vU
zS+21{*tTmicypOhO>OwpCf5*{cS{m=1r5+OX<zEC36L)k8<-5W;y~iRPRfM?{?=a8
zkJQ-?kpEomCK%72nt8-)F$=ICf=v)dT#?iP1_V@p?4Gm$_EJ$!R`wrz^Y-@+K};bq
z6*rI(FSCDQXHDP;o0kej!C>R90rDbbRV*APX2KJ5@$_3Qzd-KP`Ty<V)6ryhuKi!!
zN{S~t@}$20Y8;H-x$Oe<FIpfjxg=V>OPAI<wJB70tI(jHIjIL<7=k7(AyQbeev_%X
z$a>FzG)Kw3>!Ruvyz^nydr6CYAb*Kkn7h0|alwe9>vITt|Jif3C}<hryX1A?MxrPD
z^u-e-1SZuR-TcbyyyY%_n_uhjgZi>Sw{kf6bR>gMW&ov{o&#m=1k=PdF=4dx`$v*x
zwY(BE7?6rcGbl8}JHjEY>I9m#F!r1ibtH>_8?nxry!j2O89-9bk7v?Yg^gD3dfvnD
z$0NI4l5cCPXe$P!iME;;@`{zGX#39Xn^f7Zj{U0jwyW>eRNk&W@>A5{c75uyepWH=
z$_IRfvfN>jI1W6xN%6l0Gn`KWG)p!~MRW#><E(7X(t48X@`+6-l*p{dy=mHZr7=B!
zd#_AN0EZCm`<!^0`3p7%S3(5GGv^h@9&^|KEpqF9PK%k4&BN<3bUdr_ko9V0<=Sg9
zCq&-(YT6Q*jm38)d#(=wX#t}1&>%_Qt!k>MU4S0X{6*7g6Ncg)YoAU0rx`D+&Z>LI
zRcCdD8LNfm*gqvr;@=Cg<w|GlzSNR`<ckNU!UZmYA7$w6e&`R>W71$Lgo+nyx4L#i
z_GGZ!U$%rRcX5ppu4Rt-*(F@Ld&a!Ge^CurchCr7xN5FSCQGZieh~m60QUf(hjfIC
zi{0Q7+UJ6j;YBUHUA<Iv9V}TgKG#w?>+52NJHn=5w^)9X^}`xE(SxWtON#e@4oiLj
zxJ$Uuj^`wd{g$hhP&2Dm`Jp8iQYkuy)zL-N99V&U(Z={>I!3j!3SJSvvoC(J7-?*Z
zLUE82gQc^sVAd$uPgYJw{iKf=8}&zDjU;%1rzMzPj|-*Ww8QGYzpRL=-(~IScR#w>
z{uESp`Q4BD^AlqOhjZgaNpCKH6Tl0+M!!Dwv?D3{fq%DtQ3Y{j>3+EdaczIzyc}*V
zhq-<^TxsUAa<~gMRzp(!X{*wH!`JtonC5CDv7~OB7r%EJ!C)KuzD<Ke*>?(^t8A-J
zvZ+h^VtW|Cv^`o@h`H^yS)Inf#q9T<G?d9%^EtJY!K6P)&WCvt6i-!u*#YhZ)Y%Og
z;f?F-mX3ugGIo6t1~1nAcPhfbANmU@!cg5_As~9C=z=`@iz&JwGgvOVAcEG#;Qm5l
zLazU3R$N$^xocEhklFjP<rbvP8`oO!;fXU>aWp7AT@}VfK>Fyl4f=uY$$U*{+<>X#
z=#Xt>SFG7Ug7#VQIh7lKIEwz~tJ)yeyOK>e86*?cNqB1h4=C)Qoca2N9fXVnK2c>X
zF7Lt>miE=g14C{mE{&!;t(*Q8t8c8&T>b3lXhh9@AiZcRIng47nnl-uyW9!y^xrDv
zZnJdS2jdfLydRPeiE3_uF|$e!$7OBFB#H(!ie@$d)b-}w?fbWXZ{5GWef!?lU4}vB
zX=s|-p^t6d-`Tvq)ky~b*u1^Db@1ld;6Fwm5B@PY86O|)Dtc;@r)~$hj--(?z}9O9
zWnvIjZdwZrHvgE+Tx9om3?uv~pAi|&9>zi8!?aJ6`yCf>{~iV0e=FmgX}v+448Azb
z=^*CI>A3TDUoIkl_F<OMF}D*Pmh`JD45Zn1&$|AkYNflO7t%p9RMKq5?(J-(N6GzL
zcegtCwg;P?TU+<j&QY?}?`-zB?%&@Y43c}d22HP^x%pcdP_wLCwJYDE;}ew}8PI-+
zb<@H(IFNpNjyvIHvpVDYi=-b+LN-eON#DxrJ4$I)ll7N>=~?&h#P^#{<$K4|J|*&=
zuz8?LMc0~>i|0cL%8HtE^BY^YI~!Y_&07bXcXl?nh-Bk?x9{HBzW;v-J!o|5+vyOG
zyI_;iQ4-Il2~6s8h)m;gI$NjSr|Y*j?j3L38r<$2Z4A=Rtvh!%>DM;>d4J>R=+6Dk
z&3<}!U0P3nX0xP!$`K@s1gFtqOmmZmf25-lg=Nwa7Vp7-@mMevPJE4v_ve~R^+HJO
zznc6o`~T@_{WBZT?~VUz)=@AzxOg-DaeeZzx^imSKpcW!JMfTz!i{m<-?_E_KHI<b
z<}b6&lUM)v$Jv{=>E8!`{mX|(8~>TVAO7vz|Gag7^!$Ejbo%=FQL*`FsWl(d6n)rg
zhICBrkCT8_Tn|^7`f^JKU4ON~{^!jGOAHk!^WGO}Sg1JEO{;t6b9(rLvPdEn;`4WJ
z-?@G7*4<n8?lrZ@u&>IhexU!Oiqll|@r5!qH>@}V#L^rwJe86fMXB11|AGZ~9E(qZ
zLyt9oWgl>!FmnE8%w<~_%h7Q8*RoiB-EuUlqF$pM4H9_P)*g`v+pi2nbURcmeIHb;
zLLyzcf(j>HsKF*^*jc3%JNg=BZ)$7Hs8jOlwPn=KzI}iD_Ig-TrfOJs)n&x89`-NO
z@)<qfS--5epQDydnZz!vWit~W_{Fts#54YXHOkloevOL@3GgRX3JG9XFWD{O<dAZ;
z0KF-38~>xrrj(~r+$#NKI_Q#;u1MS!f!Pb_OXQ<aMk-56bydYbkXjXlP9Ro?^<`SR
zX1lhPl4R~~+5mU;<;T=gr2&5KcOs94!lLzu&Wkw9Rb(sNjSdfs>z~)Oh+|$3`Q~PS
ze5dXS)Wa)HPxwz9$8b=giwF-cJoK*I;wS&7=nn5pQmRNCB5d^F0V=teKJ`EVjm8Ze
zS~BltPgd1~Wt9Y*yKF#WU%_dDK$UcC0z@hyg_%bQX0wg%Qql=S8YHQv^=plvUs{cy
zFYQ=%4&SBKcfhry-AgOST*C0#L$mvT#n`>nlDW#rAAOOLKl;KW|HW3p5mBU41qW))
z_tPwN++VFu&SFg5=hVq@VQ`;QCnxfCa-_YwIyoy}y--fIMo#qe)X0%3xU@!&h{~m;
z(n@ihQ6W;NMW8ROljEIEu1Jm`0PBk=a2u_{{w`zVFYq${5TGEHpwD#NnHOGvuor3H
z%x~)!@y$6~K0<x{G(YRia?TaX#^Oim=(C7^C>{****KlG_>2tprvZ{!#FW0%iv3b?
zboacH2O1`Iw&~;FD`Qa0`EfoU4@#Me7bhy3ZZj%WySaUDOKQU;VRaaD7rHVrAF{+g
zv!m~-tF8$~T9gaNyx6Y<>d@<d_QlPG6RE-6I91qqmMzAvSTajmb~bYANjBE<GcVW-
zRD7>d#v=U&^ia+#^<hXeS0q^<W*KT##}84I<ZTE}#5b{lW++Re(zXt(%fpf$n}0TG
z_Jwaj43dA=GSVeur&t&P5YFy9_M7nI8n1@KL&MbJ-zr=n8$Se#O8Pi|ALh_jHa70w
zdm>JQSvDJ{i?8x!X<fi&i>hJNA~6oM0mu1tUY&?+5AM&8th23+t?kan?atQiX!GvQ
zZTjEsg~#_sINiLB-R8mXsX;o*<K&-oNYQ!}bY2u}{mt-VvHoKJ@#a?dRY5b}-PqWQ
zf0&%OK2&zCelupg?Tv<iByxWe1*)#Z%tEy6FQnMax`ltyFOvPBl%AI=&@5Wde!^Nb
z3xVjrR;Bs1D$W1lRcR`F;%BW-vzP<$Q&y@eAO62qs`<52&DX6|1OFLKFT&7BWC7L6
zvDJiviNK;v7-JYy78=56j3m=eo5Cg)UQbwN-tW(+N?cyEWH7jYB{dVv#DApf_9N>4
zTZD{Y?CSR^RMKY^ADekJ0*nbDnVg5|v9<%yQI!#<bNWs=clM5Jb{njB6D{08qzvvS
z`(w4g*i<^k;fYYHna<RR#2ri(991|073wVK0kQ!h2%@wWja9H-CRr#f@pYmnS;5Ei
zV&8HfT5QRUfHA0l?rbnmLK>CPG}Plok7KyZwE(YW+Y>4Z=BVURbWYZ2gvjlqwEn%I
zP$`2**+Tmuxxb}T<8^3_{+|@gB5Y%&AQgQwA+6pQS=_b}?>&iV!!Y>H+8WeWmwDCN
z;f+$8i`Ay(D&|uSM%{(L9PK{gJl!|x2~CzRs#*@wiNO1R=vtI>!|)nCV(vX@4uey}
zvVW&XYqB@!RpQfm7L##yoMJIJM9zv^3jKfp2kDR)HA1)>N~~C4n=TQneV!BcimQ-G
z>`r2zOYN8yi-X6sUI}uhr!)bIz2^+F;r*;|$OIZZQ@D5bj>GSgU<kaxr-iqu%HwTk
z_w5}#-F>lt-`#)u=5KqCpLVI29xc#^Y?_Z5cGn_Cb@r{>ov3%ExR+kEsvpvl2A;ln
zx_gC}Nj*%~d)nvg-N#qyk65X_@^(LZ21YC2u=?!r<5snWY<xUT;*)+quFIwEEh!u(
zF38IYhe>wtH4BG*iBzmFP-5&L9YT*A-7u}$UiJ-tRZ^Pma+u33SJ;|RQwB#^hixj!
z&KyJ^a<1}&({#^O{iy=@xH0_9_&shMSAy?x6H>;7UTCCw#S&cqv$5*`=lpY};%5J|
zargfZs2~98#G{;7YY4oukS4d=A)=U{hPbZQHZu!5v4=>b0V0pLlODxot{S7{K!8!n
z!QeE1l5e@lR#ViAu?i&o)KM~xQGZ|`ILJ~&edcvE_i7y7ip2{VX1_Jp$LSfh*(`Yr
zkb%u9>$jmuv4^VE7Qlju*H7m@(Cx%!PqWA+f%E9W%J0O{9i+f(wmEBDrG!(<s8Xq|
zUG7oBlGKbTqH^$sewj+u5Dv1FX?8={4}H~t8mXR*e6ft1B(DH8tb`%Izm1cBLT^Gb
z$&VO(xR~WrXmBPovYJ`RFk>JLDJ`d^Gt<FI%HS{RIu^YlgCkIofzv@8{a@)ckJ1w^
zb9kI;+Efx9PgCj!g|Sv|N6#K{Sxf!0LhPs^Qg4{C!RAU*oqNT0&mXcJrFdl&+Vxw1
zTOjQNMpfU&a+PKjD*t-1?d`ype$h|HC^*U<bA=_{K@~Z+PZwp+l>myi&Gl91*;-Oa
zUJ!iry~%Kn6yT$I|9#5k>JDp->y?$PlR55n<(aNN)6K?Ro1+EjtMX}I8hBu0H;VS?
zl?n;XSh6!<MQ}+YB}S}-U!%o)v?PCj1$s4XJrkPY>?6?uZ>-)d8+1u0@Xbr|Qg253
zC2kb1ZUa7`3|aU$gr+d}QWE>}r|#E0Qn@2tf9CctgCroi-uA9y<powu>cZ)+`y$cv
zq@x#VCg_0`^kSPn+KT`Js)DJHQ<Q_630o*LkGhVC^}lA6FzTo`+m4kgF|Zzg190??
zhv)99A2lOMeM`5p{K|#d_V=I57xi#x_DIpAE9(c(_ahB5VHx*xC`6zEXQ%tK^C7?%
zdyKM&p0q_SBuDD;Y@Q6&w$Um0VN#uo>vbf%0A=#LgdU@wo^8FoC$;-0Ad@ncEUn7M
zyQ<oe)<_AqdbKm&lvnL7JR$Rclat}i4oG=Zo2VX-xEAP*_%lSlf_EcgoLokWAsrbt
z1Q&EdZu#d{2zd}!(+2r7f2QJOKWQPbFHm%gS3mZYL89GpMx?qGOS#l0nqs`UW=ODa
zCv^N4r#B+mxxMR}sgSK+^@OW$grp0JEu9Xr5pf<8;dKD0Gwz?$QVz0zA{6#mb^}9A
z)#o=LQ8)?$oZ&^cp$HWh9y!Wa=#56{>@;VT%flD>_#_8(a=bpm&%u%8CW~lnVe+M-
zlI;kL*No<E{e-YWuLwZ>pq|-ctxUHgUP!kWZH2B4E!Yg-5pl2Z=4T7N2sJid0r^1c
zCih&kJV6eC%|UcSS#)cE%ciciQ(pqu?beH7m#<&<_g{<<DqutOvdDEeD+F9y*7r+P
z|GgP+5X9u8#VO)7<hsBPI+@w*RVs<{j$#i1HDIo7tK7QBt*BTgPdc&>eJMdvF5z1X
zQ%=%ePRC?27HnhQE+9j{1B>#|N|?S3LY1G5`B2u<39jLNLHXi;7mwM~(ud=t(sG?3
zF#S+QB_=6kI!(@ni1-(Mx^89BGm4we<Wo{L%T1Zz906qsDNa2IP=XE8LzH%p2g&#x
ztK*bCNo9a!{&a4T*a7RJpS#>BHWg;$%foeu%M~FJLFJV}dYS|juX*qnsN&A{-TMp6
zec>RDAIL-8HT}1LhlY9=?QYL{eeb#wSnhJgfUvasO=j}3EGmu5szCLwC~hn0wwujx
zxt}bQminya=3OOE2xYDmH7zd{Z1+(A=o(T29)=PwU@#_d{wctl=F|T;0ruzG+CrT5
z3CZDesb1hR8-~eI;r?nq42lUNxO#2Pr@*A+6Heo!?d6Jpk^179(H>iP#$n|_@3ej|
zNg!|18S$_-%1oqF&W)jyeteIP_T6lXPTF+N5q|=_?qA`jPq@2-6!{qmy*Nlw{!K*d
zwKV~gg)B2oPZ2fxK}slc?FsZ$z>{o9yVR9^3;le%SF|u_D|`e1n1RMs`5aps&pAmo
zG{9#${r>KMbsLG3r|szRH}n<%@w^?qnPalw%#S1u<qa#T$@n~al5?pJj@Ts8Wk`p4
z0ka^DWS;TtKrCZOTmB9P9Fs6U8U|NH*&RoRQf*H{9L7*d*b2pi(_H0JXdt*ZY1fcm
z+9kQq<*N7w6S)3BFdDUUJWSJBto`OwSoYvPXQ=Ui<w?>kgpq_bIx<0twwF&Yrq9iN
z<Y;9~vJ@gTDNtv!FfEwSzwf?y&LfKsVThIc32K|r$ml{B7rI=rB?R8m2Kbodx+qXS
zk%Bj1PxhM>*%PQ@OXNHYz3#IR0$iZYIB<$lopc~>oG_`&j9@rChz%(lv#>s^!}KKS
zpUbR&Ib3K+1f4!j4=k7iL;cqnrol8h;eh)ANq|i3`B+n^+z=fNGeYs(J#}?rhiV`g
zg3U7^)}=>#Po6rhphA8~e@X!oMl$^4=X?A)76!MCtn%<%1T0Zh*+YePeU>36V3HU3
z@bl99o10zYKV2kFm2h&CA?;`mNOO>FBBMZmPE|(3es{Ku&{vBKK_8Sdd9!?wC>kU#
z*RZ~Y6q8HpM}l#T+1W72B%hR3dYmT+fZ{BJQb)q1-PbxyU}`ulEh%k_HC5})GQUO=
z`L{U{X_PC@HCx;100lzOj(o0*ek-Gis!4?vIohz}!k@ge+%rVzsxZ7kxxy5(0m3DJ
zFavt{Kc1rsBVu`is4i`<(4Ecu*;q^@;R9C1ofE9Uc3qmjAQH_vn<)8kPA9=JW+6r%
zHT5)QoLBi?M3)V-Q8pIf$RZd+g5#slv3|#Db)KX%VWJ#5Mwgk0K}N*b+tHy53YVaC
zP~z32yxaVNcw6U}6DB!2L;`O(19XgkN`)m7ztfdO!lKmHD0%N0V}c+*nr{xRCH9&o
zBkCv}2t_<*EnJh+P>XFhjJnqY01;ePgOz9QP#O6!8K2A%Cxk(1;nA)Z9wm;XOWh?E
zkj`CP4tFze9-4hRuZA24fug*U<EjA@LNr{dZ-0a>=;q;EpPL|7iDPK6VKL5svccD4
z$|IcoOliT3m>5ll6JpN+zs}KJ8gX7^1+u3Rf$2I{XXWMVAW5RYeUO;eL+Lfh1E><n
zb{F~5UCB+6n9gKclqrR0<B24|vh#E)bH!|^>+(=n;=+@h*TcSuj~Bta!0r-IH=5dx
zkJ2ZyU;KtUT|CuwPj%;6nKng#f?_C?;=)s2hEq9=n6(@ysKQ|lg@<!-@#)M>R*qnn
zo<ztiAF##Mk5=P7no0B_Rmm=P#SJ;Dpu^>$u`Is)h*Xl9=0|XG9QqL6dIGsL+?OW!
zP+d@dTP!woIfQ6i0OExafpw55J4M7GJ4BJ1<3H<Uio$(CQF}pTG0T^K_!D(o(%+Z>
zUWu?8&Q*%xU@#;mBEW!77H`;EIBD@nGRfl8*=X2mTbXQZtHE3nFRByU)tgnW><cVF
zlqtYF=@1;A%b}$4{>Rfqoc{AE%iU^qx4Lvf5q<*bT$v<XGAK)hxjhFuStxm6iuBLY
zc`5!`1~VIKIR+WTaq=O5=Nw;f10RU~w|!#pgEVp}Zv5%PtjkSwF;|=24+TiR<DOXn
zqrFTn(~3Bppe_pwp)4>`UO_73*|IngEz_%tpUHe)m$IX4MC>sI!~rbil2UwZ!QF-I
zt!R>^eNhF^Al?L(&JoHx2B1DkxJS@4Ggiq$)y{I95Nyg{2Hp~X1sbb5pR@v03>zm8
zqc3A)vA&|t7Lq<{8m5%D7hM#r=<S|k;PRkpuwL|@Nv(ppNQ6w7EFJL}+L3J#_1|+g
zyTotD6}^2NeoEViJF}owF1$j=uSDC!u{2CSTFonJm>H&{IXYA&H_!3XA|JB$$C1;C
z=xnx=!fk;}5iezb0ieF%gzjW2dAlK&GbWcEzOw2hl@I0+a(KoLWy)lm%Q|#t`TCTv
z8kZd38&@BokxvUwnxLC_Mwf-13R%%7!apJr;FRX#eZg;Hut-Nv<iRo@R=dJNFLK$Q
z5~D-)q4#_>*n>tcmyczpPnKl{GXOnuFJ09N#JwE_uaz5rv4(fSn3B=aAh}_~>&aQs
zwHBzo@AsqU{8#j$D1jAZNEp($0$LEvXI4Zw4&|8E&$SU87Q{Z1QS#4x%vLGsaJ^N=
zIS|&(RtpBcSM;tUEpsrJG<{~mU~|GOxTHb{3QwOQ>eVf?y-k|jx7iUr-|uH;R2AM0
z<NzeL@BuM@JOK+o#R2*~QZ)pU9}z!jSc`=3ARmPdUyonE?HqC5`BXx|IBjlk{gqsG
zS^(G1KFRZeq~&6lC1?5>r74S%%fX1XZcO~y9+p6)Nn$t9pONx4uFQuM<6~r5@Gy1i
z(y;_i<-W}*8;JE*rco>j#&ryaj&UIb5@JN049u8+eR8twNCkb2+(Fh9BDM0sTJn8D
zoXZ=YpvA=eu*&rPbKy6LO~*U~KT{r{IbxaJ655FQfxV`&B5^t0^DLc~GScWvGcJ>E
z_9ZdoMceV_CbY|$fC2MRc%Ipv=_$hzj_KooSGW2QQe3cq8nETu5>a4(&Fsv{3ie4#
z)xi0GMDaf=SRW_=q@iT#M~K5bl*DIe9136cyED>Y0ncXw_JTt3l5=cd_4M&pG`iKH
z={N~;CjEJy2AhpOcOaHa@5_`6>@=or5TB2RVI1BHAMT{15^a#E@!kB0O+eAAKZW>v
z2B-`%Vk2M{)1+^j-4O|VZAMp&Ai1AdOsT|w$Iwc^>;QoS&Ym&nV{xS{OGD{%b!qHU
zS9QWLl*i?B$~edZ1E2?mJ_Lwi!oM3YyWj3TdKEn&uEB=)y_Zj3>^*<3t?xv=x#yUO
zAYDJEc2&>rH3sQ%gbS<V9q^@=<ojpG(K!0!gJ{#I|0}2hXMaWMut*nfNi)RGHe1nu
zzx%(oS`F?+;D>e^)i-4P3Oyx=(Pt^!fM}8&_!93nU2QcHG6005qh67vCuuL>^EkSz
zB{(=a`Laf3dXEs`z>P+o>Fte;sMFt!Iv=9Wcc|}`zt8Bj;sA{Yzx)10_u$oEpT2BH
zhDM7^-@V#DAVnivKMRj6PBy1K-9?IjbXN+&tWVbGzu)@SKZSLo3&Bb?J>aN6qL`jE
z^)|7i&r)YYR#H=fMwzTqNk~wNGX=XsqfA{t9kIw6Yqg<P8Pv2LDJX{{BFr5Ptwcsa
zA0EDLg}BLVUO=%~*@?C`Haxi73c%p#B0e`B%tw=ART^$7z^_1}(XnDdQaaCnTN}6T
zy?BHpVU&`#d*0@=p7v`#9e9*@80Um*%2Ux8g&K*4_SsMy-QIZdh^x5Ks<xvKbV73p
zg=vm8kONX1()Wv8w#OL$jQNO}&I!kf57ItouTdMqX#`CboW^ef2}TA9!P5GSI1ykn
zSW$#g3yL8aapo$Q`n{OV0&dHH+_HYpUA}!jc4%7w1Ysxo9Sx;RL+SqY>ED|kV}vh1
z-+l4u$*$}p&8QRRCDh@z1Y*kQUcrTR+~7W>usX=xSC1zCEMWcjj*ZE#Zf>-C5e6z;
zVYS!k&<RmIpi4cpV;^hqa2mzy8`$2a1~#n$6-I=X^yDw?Kn|E$TU$kcFf}7-6|J?k
z2$#OW(NyRkfl!M`VSC0-jF*tahPAhzqytDKI5*`8a}QC+JLQ;@oiJ2or#^0F=dy5?
zovX*Y?C>BW8ZB>LntK{o;NHeM{HyAe-o6vxzO#7Q|8x6xynW#V{-3Qo@x9IRAZY!{
zgV?Ma#Qp8~{_P9;*xa~(A8%Z75Stsf;@j}Gf6vDr5<kQ{O)LVT`vY_0!--7?2P6Qj
zY^DSgkWhHJ^^=m0Tl$?VU%tizizKr^G^MbJ=<ar1w1iAIorKYn=$Vj;ZY>J{UqGP0
z+lUs4rPRp%TN}$e-?+bddFMnCx9h_({+7W*1sRlB*Xd%w?#VQnoEAH3f94wZhx39%
zF_DyRB0&<JX2ktH%*K%ZoSmikw^&bz?UgxVt8K>(Alhandl-@3;lNRf$jL18%l|6&
z<J(>LtRica4DBOzuklyG*9hE#u&c3<t36i$RA6d4E)FNIn!>e!O}S&892yY5E#|2}
zgoB%p#ZLwg4{f-WenlH8e}AzXQ8FAs6GZgl2U7mVGdDO+S|jbUgKF#u*cLBs%~y@n
z6Iv4vc@6D>tlt<jfP0ZGU7^7P;1LBcCrZJkaLATy8=|bhKJXr)l-7m-)A1{A9vNvz
zP)dM-Bsp&0t*LS)I~~<4EOvyT7MEFg9((2QrY4?#*hFYYB5Cmje+TpCG?a73Vj-zM
zVkj*Y6ovW|A16v;4W_72NJTHVjC@ONNswYoAu6+>j1mJ^SV^T}GN;!%XKDJrv$?Lc
z+A))DM@+V^@U2y9_I(wz`9QX@TjC=7$o$>Mvk1lq8-I5KtD-YW$%PmI0H>+sJBIed
zaE{G-nC1M8Hw*e?e{{KGPndnt?yF@{?|#S76hR+Bz}BhU>tHqYw>ncC$|21nT{=b-
zfx@AMWU5Z$0zxtXPD!Fordck){!x;Rq`qKIig+@d!%qoSo2xm(M8#&WvI$4Ua)1;K
z(i8`&OlxNdX9=T#e#n3bXB85>TgQ2|`?Or#G?3i!S!Onpe{WMhKz$Cge_Dh$8y$J6
zdC0@0U=D>nk76tGL1IbKm^Jefi#{v0Zyh7rjBni|RnEnrMO*RRc-uvy(Vv^Q;#+O+
zBiM?!Z^aufLTw}7+QRd?di3|5t$0JKL;$WOWh_c&mNJ}`BH(mLB>aPuWq~v!W(`p+
z$0<1RG-VXrf1+fI%$?P+YR%Bh5>-Qac3rInE$DT`#xM2i!izz>ME8W$7#_<jHYMPJ
z$EYbD^@qTl)PN)AeHI~irse|WVthg{K%XuGH|QdjvYD)ti%X-`>z}fPioF<StN~wK
z{6MTbw>?g1usdaAy0aP;JYQ0NKv1l3eU`$st6nJce+IejU>HNstLOLH+D_v)``HLa
zLDbQpJDp?Bc4KPg^2!|`vXtVkB>Pooz=c)tGUpQO5-V!Yb2>gdrQ?%(d=f-F7IXHt
zo87X!z2RJvZv5U-{4d^Lb6@Q|uoxQx&kGoCI=bE5Wbg>U=*?LMSjw?*QPjDB$P@I2
zF+9s{e~nEOq$WDiEfV+_L?YaPCNNz1^u}*~bHMR3tlSNN<C77yfyOOt%o&<g-f1%m
zX*RYBuB2Ae-Wws_kmma+8PX)7R<pRD3(Nppy`7Po6U}&{KrWdi+Z;Hnu0)RX*`)`+
z7~+W4!-p2fIeT?E&MFKK^1DLd%h7W`FzI{Be=Zk?P<zo&VijUlza#3lsOs2VJZS9U
zg;i@S+wjU%`B=cd`oA|fMr^_FsYt)ReNP*f62;c|!pgUiC!=nNnfOfX$U2>m2RPD0
zh0KlvM&f1`YcXV68ZXtJ-0}>wqiHhbwejglNhD_$iivQv0MfK2;hH|2r@)vI3v3nN
zf0k6ptr0MUuAXaP7B^^{H-JTI2*=f+Y2}~BVu>&M;Apw!)<<nHlWE39-75|viw6_O
zG-w*3gHFm5__;97*YS0HtJ`5ZV4>yo<0Rqg2awFf7RRB=e@Q+hT1R_Tc%C+u4p4UH
zS?;~#a7nYlkv73p;(#3-JBLo8nh$t0e~I-Z)$0xwf%943QFu0+VICFBASSn{Y1^1t
zKaANI0q5gn$l-Sy<Y$6PtU>u<1c|t37~>L-{$x7H{wZ2Vuzqbh-NUIYyNkRX9H_OU
zkra@qajS4|ZKp-iB8shHbSo}<Z-_N37^6qcRW_FnoMgb^LSo#s)WtIn&sYqre*^m#
z)*3qfXg*#Cq^?t}*?!ZkU$7<4(UcTWH9$X^0)Kpo(NsK(e0<8DQ_Cr$@m#VZ-_YX>
zQUS?w>6FGvJ<_O<daV6N`4MMc444X^mKf2F0MBJ&$(1NlbE%cqipM4amHY;d0Vvma
z%@zKTLqonKu`v34idb-eoLtmxf1;uo1H3J1ZLwSPX(^lv1GrM32Z+nfF8oxFl~Oim
z_|MZ30SAuQLqWnhe6_M|_}p{{FAgRM6XM!t-JVZocn^l>r30FI?P+$D%~DCtl461D
z8OK@D>b>F>Gaoe(1sw;8VhL0K`z%P6&V-#35h75SUy|8F6{y_8hL6rGe|*?PuCfE3
zZs(lp!BTiWl|m_1;fbcaEainUPn~E{VB3jaBtIZ*;M~x0Lul6t2!zuvknJD3>f1}A
zZzWS6OXR}`L$%1uF|t*kew=Y34z*<9AUr9=SgwEQs>ySy;Zl~6RGe#Lk}V!>jPE_g
zG`r#}G&R%ng_Pd9H|4-#e@l+uHnFlopjJK;0bn|NZpcg{y*Dn2k!N{zMq<lOAkDLl
zis6arVckOAWJb^MbS8s=5D#xBz=~@$;=sM6ans>T!IqT;;KsR*booiQn;LIObJj=+
zNtAGQGx>B9(>j3-;?F>OUoWQpbxfo)MZkg9;wR01P<c?z2>v-|f32uIXa)=aq_<gA
z9(AS*|ExDORGxLVCjYFnWmFzj+l4;akkAVasx+i@U2I2D1~@E*9S)Thx)in`E+Wi5
zxpLN9(11iw3^Iu`7-&M7)@7C$Lk<Q3zbGI1Ug#5O)D&X6F=eJ^3x8K7EC^_~M6BV^
z?Fc!hwBBNogOjine;Ncm6oEC+^mO+nU%)14<j3(})%FVsYLOxgsL6R1Gn!bKFqN<{
z7cAT2qrFb9oRAgEdPdItZ<2GJNDdc*=#1D!90iapLVZQ#i7K1cv_A><W**C?>p&|U
zq@)K}a)M95P=PT#OXeg<WfG!^tsUqE9ha?BiIlau6v;A(e>1Qf7I@2cs1Q=1DljIa
z;e`_}DM|cy$ATic(e;{^S{}V>5GWl%aL-|-9MUy=mPl3<i<#w>0jReE5#rw*r^FzD
zPg;JY!(&v}?~~nUj+R2Nuh*RS4xYY=NJSQ}(Kk#iDc7i?BkR^i0}&0~mmGYtcz<)F
z(O^2HepaP=e_?Xc%?1yeO#j^<KQ&{?v06nxEeUzBGvvX`e4Oef93ov}Vd(?>3#?!j
z^+DRvCjC#}>w_cCCl9_w`nFt}B`3v$!=~G9&3Ela3)&uyLo|EVrm##T2cD!d46pP5
z8Fapie__<eP5$*`_Nm!&kHECRmq$4Uy&Ak-wHnA=fB9EAP=F7*2jwOj?h)dBS@ba4
zC^t%{59wL+LSBCO(6`j6f8;^%gqSIm-<hrTi}E`?n!xWC+OP7v1yjA9Ys6`Y(J3E*
zCo2_SSDmH9^SU6*7n{q$w)hav=sRMW^hX<92kPm`i6V5DwB3;VIWu0^6W91*#x`(a
zTBM{+e=-d}<#b9l$UE6zqend_6yOO~GCPvlhu|x52*BimlNeT4i7Xvgc)3&*frb&6
zR&#+P+707~Vp_k5C60z3U&=AAC43765r^v*CTdnVlyM#}r8=%IGPSGnqJBM3ImDM<
z<}<Z_GsI4<t(6TK0MQ@FIVK<3dov$Dnh)Q<f6Tw9h3lyieKLeC0ikJ3TqLJt1Lzda
z+p0Pmo7-Rxou$EerCcJX2S&ZuyKi=%KY#lCfncC<`{M2$F1Cl#18Q8=8eG)I(6=pg
z<{r`0Hjt<w7lrZ4UYaolS3MztY@=?LFS^x5V8%|bwqD)n7kKPE0z0X0gMk2SqZZ8s
ze-^CJMEJk|*Z%`2PNL^a;RS{|wt!8fK6v*21_NhK5^QlyJoXW0nGHLfSE?9J{Bn>s
z5!Yl!hzHRpN5rNgl(Hv?Wk_uh_Hrz-czVUTfZ+lm3_+emT$c(F`aJ0g-HW9MP;tZS
z9rVyra7tat1ty}`jfZ>?f87<CNH+Csf8<F$8}SsOI2~L)L23h6nF#j6C>f|o??a+l
ze9dOQ%!kFVYj}7yVnL$rLhai46Ys){*pZ6_3FM~l&4w?rh-@4Z(7y45?d@JW>Sahn
zf3UeB@H(Xj?4mw%YoixOp5dLPt~fww@`aV2KX()Qv4qeJg<}YcE(Tt(-34ZAf7&!$
zRMY%DarEtciaC&E$g%2-kw||f7Yt3P*@=8%i-A}_#ol2@FOxMal!{BCE@+-iT9MxC
zX^!-=o{SQkR$>{F4|%3>G2%;5=nusuQUD4UE#rF(n4CGAzbKc}tqeA|(0-NAEyOp3
zu?<LX^CHb<ECn)2Ud&2Cp)6i!f0kUbl<Uo~^xk}kVn+RxnPt6pR%Suw%p+;#fB&!l
zm!2390paX(z;<>JGS5_Tg^nfEOCDwaR98{O=%-g`<nCZ|4(7PDcnhq@Zg`Cjp#;nY
z&ZgKRhRUVB`hgJ+vkRQA*k`Gj!BF{wK^K#f7Xh0B=?l`;N~LHm_vIo6e=zRXv@`%-
z{>M<l1k7Z|=pWh4*h8s{iL1k>xqX6lm)abVY!3CTq2IX^t!&5lRvHb<&Vd>*(SFs3
z$rTX&#m!q5c#dtfLn0y)5<A5#N0u|+`;ZUmy9!e&I?><=s#UVH{vnyJ53{57iTgCR
zHHkBn&6)nC+qbs2<c9a(f7spEul5g~y?MIdeZ9NC|NW~sPj<LQ4-Bu>C!RdoiEMk}
z1_{B#*(ujy*>Qy!3;K}5mB%lhboRe{`uzDyJ6f5L9$9eadDMC9K7Zw%zQY;yACln?
z>7a$RLozz;zn$o|U74m_Y>BQw<I-Vt1c9nNy>jdHAGVu!witY;e~>{dzPg{B@Qd)b
zH0l4u+VEc-!{Oh%wY9OagMW##%-px=!kMjFU1{y5Yb_wSV<}vQR8hayzx(m^_fI~#
z&sd-4`D{I|j#r;z{=FmrS-RG5o__oE@c{?OKiNIleYCs(wEOtg%a?R<@6}6`uJPpg
zkKw;_#qY@p7^8iRf6>OD-4zhmdU;UR&+}K$p6$JS#-(wdzUe-H`nRXl!QRVnU)2nV
zJJ);{P7a4s!V`?Fmqsu<wg;l|d^i*x*^2?}f0N)BFYR~@#sYORPN(y>6PA7SD<Vx<
z5&ttQ;-7C@`Dv0}*a+hKVk1Ibl9X9D8h^$&t^&PpnVqM_f33M=jZreJ$%_p#!3Y`+
z`p|9{{dBw0g9lNw+eHFbx7(EG%k9U!2QL{`$u{CrHa=f~m|9b%=uncA0-aMW)?s9-
z50U<2LjX{@Yc-7Z^4E)n-gmuSUCNSsd1P&^B*oMVGTuZFAEyg_(rBKu6mHg8sOYV&
zwYi>NhSbq1e`|VdsB!RCq3&jqMkp39=yRksW+MMU6wL<MLdk#*WW-QpTmi9vO0tp!
zD=<bNozIo5;2`djA(|kBGPflW#o5&rSOA`5_K~uU{WzNisKD)#eY;561N|W|Eg+Jt
zq)gW8lWS{%eayr%7h8R)tQeY1TmUL5re_@OdopGMf2|b^B^-|PhX;(<0D)!>Pu=3`
z_?6&5V+O%cT*b0lTd&!I66ncLyRB7l^*M(-z>kSWS$PU8M^Bb?;d*tL=C?$-CE?wi
z3~0{8(<*+HScodtLlUys%?r?~@yYD8&~sknRCq_|oM}>c5O)(tyFfD*5Uh5P4nt!l
z8807{e*iQ>NDFPsTxFqE#X?#vTV0G%W?19cmy)Fo(m9s%TSjgh*2G)3tuE_=i{8Z;
z6qV6?8&Hs5L9+G?<~XiN!zNapVvCja;Zkjlnrw3xFZ4wYk0x!FBnw)+<>p}*E>P<y
zQ<E*s&mFj^RJZXs1u#Czw&;*vyttQbF1*oqe_jN!xxVyAVJLO1^&v(XyKImqp6#uz
zRl{X#x0-B*U~(@>gSl}sjO-=b#?%qb_4LFC)Je9<@v%rP9y28lfMSU4rXSeIG6_SN
zXvoj<B_>|B$h~J<kJ#cDqT8L_KVaETtMwHII9Fa+7Mlsf76$WFj7bGHOGhJoa)mO$
zf9Erfs!^?-wStqyu?!YeRD^AL6&W>u>?m;>u?yel4sZ@A>yu4|ZR&z<IG@0gblZ40
z?cv!l9g_xCEVwlS0e;b&p*w7>rOIV89KBq{y#d%KVZlTTwDA&_nbjga$_5>-Nu;X`
zP6dN5hAnV_{VHdwKem|vl+3&3t&4P3f3~mk<0=O10o79j6j`EY3-1KDlzlNHvza%*
zEOH3C=!ju`{Mzxe9!^)+h^?$aj?r71`4OMVmHmiVLl<@BHj0)EHX#KZ$3-F<Xt0;W
z2DDmZ$;Oy5LNiaMpg!sOk~0T1mZt%u$sn09mAcs=dEtyh<Z_MGMZ{<z-Do_ie-oiB
z-gCn2YRu9~zyr<_Efra4mJ^7nBG1Y0E>j~TTZK6-voHc(wn?yDApow6JPr2?5rHE=
z%{o&EuAv0ZhHf{{Td>+^8ZI?XS#X0MNBWyA+5)W&47M<kbVz{ycFv+CuCgg>LMy33
zIZ~I+CEw`&@Cv2GglQxnXHo2Xe<&=A7)DM3X*o|dloV+MK;v2npw<0U7*F=8mA0>0
zkSlzEj>d-<8W_uF<kNIGK^X_Y^Nlrd7YRcg%Fk;PvK<TSQK}U`<&;h`@S!29Z%wm*
z!m2woVzTUw1AhYaQ!W`%=!d@G@GsN8N6E)*G#{xyZNg#+Y$2t75$+`Te+<SuCCb&X
zf;qwtW0&x?0@2f&&CEd8Ispij3`A*G<P&w?mP7i4p`IU2vjN7W5y9d}8Wxf;)sCJ#
zA{E=pdUMxYsh#sjNa@T_V!3a#Hm1#)i+(1C9-EIn)lv8enR2muI9FWS*AJO!0dl->
zeXAjOhg;?{AzMEPy3*vFe{jXhcz{xWn86oH+nOYs<GBD$=`6rtKR8J{TshW@j<@iw
zPi2*is%(=NmJ*^L`i9d)m@!~&gN(>BNJ;>vWW&?Lj0?!|_6Q{4aw6HJ92hHe&)%W4
z3^}I;>J-@ym$aHO?PeNqIw?5w4;AGgeFD5_PHYB1eKKLRBU~Dwe==e)nzc0n$wcIp
zNNoY=o!3@^g%B>R_XEerv;0e12~HRxUo9Xz-1tF|(OAb|?7)Ty4iCJXNnUfia@<Hc
z1N8FOOlz!3<Gl1;o1K<}E(<6G&WHRsOpA5NZS{Fr+<$!{R$Ejnh$ai#)#gThjs=TT
zbWHlpgfR#acq=rye@E$n&bTrU3W6uYRSCpT=xb+Yw4nD(;ecyvd{BCT<hFAvvVda8
zt>p?>JSoWm7PVf>TXaa&e>yx?2W!>y8YKHzH1!~3UyUX3pk0~`myI*FFaWSs^G*W;
zi$U7OcgQH?*m$V8$ub$7bw1bvaNz(f;u!Qdx?l&AbHBMEe@oZ$pe?1PD=pUYEG)0V
z4qWmKB3*V&YTSvoH{!dSw+o*dyAy5Qi?=toixPkzUA-IMxpfbOu^R;M%c(<R420{z
zD_2P;^U?i^*|rn3e1AK>xApsQ1ot=Ndz-)K0l0zQyBFWN|9i_Eo}ZjZg~C&rUCj)&
zRg{w#OXkMpe?>cXME6tMH&dU<5m)m-G%!d*U5^71J6hd}Z{7KQt5n<q7w>HRzNPAo
zi-|Ji0q8r}c(dqMeE;_E<7x_scE{E*4my*Zfq}N?`c6(zD`!Z1hZ%?R_U-uY_V3vP
z&g(7+eI=M3CL04FUE;%CoJ^-g(-*M80_jsrB72Pqf0u^qzTaE1OqSxU$hx8*v=})3
z%!K)!v|R$ur@I9V(YDLC_34h)?A;@{MuAAL0ltRQDDwohFx(@z<9oNtdu025ys>$w
zx<@we$9Ffjut!jYti2eUVELI9FpE{rwFG8;UYXcY3J(>Mq-+b7048fOY{jU+@zkd*
zg$^}}f8Eb8gk)iKj&y0>^n-!RNT<GqM-TEd+OB?Mgj;v>UVMAIv~_Q7##^^4Tldbr
z_}<+TwTEroxf^fZEwyo*cF|U)jjcQJUD`21&uljcD1@d2`n%;xx=A4|ddN`yIDR<S
z9LBw{e2VCn#?1x4a4~YyHgdU;O%|Gzks2hpf8I*NJYOD0g{^&obx>q))(ub-Yc@s5
zw5HL>LK(|Ox)mqShLFX5+We4u!2=c|$`(vniu_)Lhfmv>C?B!4c1SyOIWOHQ#%c&*
zE1+mkv@65hbJ?eKgsGCZ<K&Vuv<#gj3%sThbSttj>#Nm6MwyI1*cfb+OB?P4w6wVy
ze{bI2D%v5@(&=*leo>~c&AUWj+bmt%jzG{+6*Q*C+_!rFR(ua9K^WlWkBR$R@#cMZ
zB>4TRmZycY;lqiyh()Wn<6C#{5$zTzk-o9Hh3uAch9oPXIxLt!#zGigYf!t5&G0JI
z2E4eN%yB#s@TuU^qs>I@90F(@u{gtWf3jczfsNu(041MsxujDIb{=M|;fq@U`!6tz
zu5QE|TepgqGnxjwx=(VS+aWLlq<#yPY@Q`~Qw@d5!pyo^1$(xWS<IG;7TDE0+wsP2
zJ>IneA8p;Xv_pKtG)GM$xIM&7Qxh-ERY-!P)|p(rbix}o47&R@%J|Ar##MGxe-Bh)
zlJxS-@?}^Fjw85y6>$-@owZ#<ADtkAF|tf{E8e=hVF-qCh=&bM1#iVHx*Kn8-LhxQ
zTI49y&jHwdasn5}QF@w<2gcUR#|6&z?Yr^4jr)<uSJ<5?^vlUmOebEHoJ@#e6qxhm
z2;S}>XxSfi?4vb=pkbcB7gNsJf08_7-mR=93=>_g8A@7o^5f%TF_%CR%wbTl%;mR!
zD~8N`n`G|I-&c4!i3ROIR*N_9{2mG2#7D6aq61E?_HWRNY*+N1c#}0Ce-_-2H}Bmg
zig}{U#1;dVUToiGP6$#50a?T$Gyz|hdJX|wFXe9dd|vM@EHRiMR~tLye<)Q$wG+xA
z)efbU2oW$#76b7*7`jIpKE@&MU?YM9Z*LSWS>%~VY(ZbcR2mqV9$#L#!0!4h>$(x^
zDiy8p<?7fKuHg{kOL6@LPPZcy_Bj$g$SU0_=>>?$3(s8nOvR>K6~3TB8J0nv00L`c
z>$W2cY<V1E5-lyc*&ffIe|e&BXLU2ab7vc(irKK0dW3g!R&aon*p`?M-yF{}BGD78
zKj=QcEiM5CMWD5rA9eU~7oP3jv)FAvz;K;)YzDw@;zCK2Efafv{Juln3Yg`2s2Aw`
z2RerUA!Z|zax;mV;pyJoxK~yaoM2Lu?-f{I|MDfn#MXZ(O4e5&f8-!2I2YThzAvxi
zqIp5lBn?RNDv>Z%zy8{q1!#npU^OSQk`x@uyzZzl<2G-G47B^(xBZ!Xl~5pmUbAn}
zmhAqWJJoaBZ9ESW%bUkZqq>Xe{mppe?%iM<mjn=16wb0JkO1TE{^or@98pDajL*)p
zKGz~BIB3Xp%!yOBf2Ib<?1^-83jfrC*-p?&6tmH|I!B#5i(r^mST5xe%0EPtIi9{p
zs{UOzT4kI-<17>o&qcxuN>Y%@<MMINh!h5Pz<?HPqog(j2a|T^4#a$0JXrzM*f@n*
z5CzgEvf=O0V&D6{Scw7_p`m&VS`uV8xClM3%@jT+K^TeIe;kZ?afD;Zqi6H1srBcE
zlQm7bFmpe(dJ_(P#UH=MtJM(fa5_-v!9kNGgV6Pg8mT8!sdU125m(g2a9#qtg22;E
zrfDDbq(e&-ltA+q`$cdThG3RRxxIT&RjfemTP2z9HdHUMh;ljPI<S|Fs}qH>m}T3=
zIZ}+uBvH05f3&Ss1=rT%_{~7!m+FrG)bv4Fi(4GuTs9oDjOER}TWkbyaI$Kbl28ea
z;heJ3ngnFgdqwp4(vedob*CMjYgSirP8@ZlsXGo0#l-`9sRzLPLk90vZmXa)ijh`l
znk^p=#i>*e1#K+)uv8rMD0T=dk&a#F6?^{K@5~`^e{}kUSaSRZV~$8<M4{Oq1C%{<
zRV+z3Uf^L%Ga-TfJCd*iFYmS;A7z9f#szZ4Mdf4i;~AfZTFRjEa7lO?g>}UI!GW9v
zebb+M!XurVOgR7M*6rXRDjAxlJin!5;_kLTb=(FiFT0(U+wsPo?dln){w_oUX4o_L
ziHABRf0q`(Lu-UUAz+b^*SHcX!UaeOq3J@b(wM7^Nj->a$W@>7nog}iK=p{iK4ZsQ
z0u}?8aN@IDOLMhTHJqUs1>Mp!i`Dh}@!hT8mu$%G=r)N9<!gS4+R;7sRN<}{0Kw31
zZ(_&u4Vf<IxA)a6Dh`>dkHUqkE<{>tpte`ye?#TL(~qFEu`8?^JLJRfN=Tck0tVQ&
zTH46iqnQbewRx`RhK((F?-q{LvM;J#Yak`odFx)hu|a36Y1`PC?Yi%&<4<Mjj_cwM
z&mE&xy~8O_l_+|(l?I-eS=k{6>6Y}M-?su)&2~X(&DZ$BGE-~^S&%dJTJR3`eYi<m
zf4zMhUXYfVJAp2{;N1?fvBVMNqI^&@UM)AgX-;)u8vc|_vO$L^Ee&FM7=({EGC$<c
zM)oc;x??eCN8R=YT(1rfEgM&5oy~j1fqu^di~BZs5_6X`!Qw~<5?jXuzm?&roh4sY
zGw0(~PZfK#JYbLuA>-5r`Z8j4*`NYMe{H#Vg+ot<g8n{DCon9yO%P;?hWOS&HLJ7K
zAR_pL%JNuK#wWu$m>7=XSkj4Omt!23k)r{fX_bL-dgk+r<7js*nxt&4v}7*OaXY!x
zL}Sy`tD3hND2>!aO9>eG<w@v;<$Qx!hMIILp?&-;>_zvA3Xh~~w~D1al62dmf5alg
z`iT-w|0PveO@Ry5SnK3+6?PYf&Jlbj0w>$9x=t0e8yslKi6sC~30t`=-A8;d6)3$c
zq%UDXkKnePhG%KpV0CZbitpUH=a<*1sr1fe`XsBM5W(*h?dbB1AAS7Rz55!IdnLVD
z%-gr_;%hHWq^ZVGEw>5ydO<1`e=X{yQq-$t8t359yYb!o8r*U(-lmb2avQneY*29y
z^RKw{Un7fwVL1?_NL-iC0jGYHZ2L0ojZN_EvJgXOt)+)1u4HGHJ9Gp&O#%yYVn$;z
zBTs}^3B~9j(Pl~UFNsl3S#{vOL4fM9k0OXx@85~HHgTl+@R<9kQS^I_f0he;q}%bm
z?cWFXLU%@-D2{!4L7C8TVquPETM|88Wt4@)8$DRm)@^=Kr_5iHl*2>k6T}XnQli$;
zynv!!lcH5M46+(fHf;Ftfjm58!?XC-M!bDnVk1acy&K3_x<2g+J<F7e;+(p|Fz$p@
zN!g&KEnLPgX@K8wlpg20fA7NRc#Tyr*eIZmiK;Z`;1yVe3rsULnHS+1<zTb*9A=T0
zW-uF?N)w{xl=*8|n|U0Fv?D3tZKBzN2fm`ouilF9ZNMCXV;r9u7NuDwv2FYJWj}f%
zS}vzBF2cYDk#Tt-ZNPsr1~xCmoOUQ4S42|Uog$$RSwxid2|+8Be>6Vz_6YDHR@GTT
z5iv}!Gfzu#ezGXfWXjgaTfcADR0lv@OgZ?&q{}cer3?j&G}N3cO{leWD6p#~)wEPY
z!(vi{R9G4+Ql{zky7(Kq>k>u<W~W3$Wx(kjNy7-{yB$W`Ru{(Ex!M<G>5cP@3xHp4
z_>gRX^kaWGCz3JNf8a3A3@?udJyQq|EK(3FH$wT9&^NnGc;i}yC?8`9oiz{bh_$zB
ze{qMWB80Hv6p{yQR0f6v=EV+~FbXY*2=ygcDq2Noe{u55<|dsHTbm}pEC^S(HabqE
z5~eOu?<NL`h|>;qLK@l~qU2l7SYeze^tjWGzPnZO*?3Vle~1d=W6pm;nO9q;b0rFi
zHvLw7|IS_N|5m(xZ(D_>P5R8Os;FVz)aRcDGrZ{2Q1c8MEx7G^8SnxI$flr;`@xH)
zNLH~F-MJeC5$uhZLK8}sX$2igqJEs6ZdA0F9jO+LDTRt5dLYGx_Ak<^yued7*r?T~
z81X8JMWt+Ue;^hi6Xb0%e#J>;z4!Z2V9~lF(Fosi8v;pLp;?$hA;_S#wbR!^d~D}6
z!NGB+$9_NOGN^%nzg^N6ms$tgm8xhaN0cOo3Oif9y%FEORS8h5dM_6pwWxgRK3=Ry
zMG1F+rdNw1aB3>{eiM0o9rbxO^|UZmw_rw*sQ0@af6z-dX4Y7UBU@z=3&nyt+`;uO
z#uSH4vF@C3szHg}as508$0=?WHWU})jP|SU<p0{rcHWX)F|99PGteUzJgp9vN-Tx$
z0bWUW;4Vb_!6(Ihk|}hd7S0bS(Tm&nZbNEeVK5yX4UKWgF*wZg361a^36+ZTR|-V%
zfxrs^f9h35D>@bsH(z9>8r&0rT~{O6J!}ATQOGX3Yt&{O$UcG?Ml{F!{%(BxE*qSz
zq=!!mC#_Cyxdn>@q2d26YVB`<yJq$FcD#AJY>MNYJkDboYY7?+%q~X0G#U;8&QYC7
z0-KgP4#I~6l#3*cJFdnvgXC!(x8nPoejF^ue^c)&Wr}9RY27YW%wk1?v)Qc9wJ89$
z9G!tT)|9xRrwWz(%WmU^z+)~;5iY--4Q}4l$Zes;&c+?4##;<$#^W`HQiVw=v%yn(
zj-!P*ZkQvM;j1djM#&1`c<kXb=mi6xM6#ZPovUP+vHro3X%Z8M<Pg{;17T83t_HQi
ze+an?YK&Ei;xKZ38yG4<1fF%qvVcz!=KZcQd)#vgyWB8d3>Bgd-^H8W_9g%IOWNKF
zYtpqI*iuAamW*U4RS8^UfNfb9tS;5OUHK-UlB<JR4H#0oUUH{7r<mwct^2OJ`(pO7
zEAFGRGSON8eY6_j5k-d}U$*r4tAQ0qf8aoY_la~d;wB^@rkY{RWA?Cnms|U;Vuov9
z!LD~j<D3SNr7Is&1JrSAg;K0JtpXzVKV(yeQn6X18~mZ?uw4%vEU3(llYz3CC3n+D
z%x33qK@`1(r%0k`We9FDT#fPylp>-`r~xDaaOwsZc<qgD#UHt@QqL7uBJGRof4sM&
z%{$MId<}XHHOTFY*ouS*FfBs6Kp-|WSN*N`^6iW6_pjdk_34}aUWg$eX}?Ed01!#5
zumgsHkpj)gF@mUk1o0)Phl>dxa7Gt$Zi%R-gEQv4xhGCpGl-N!F3l%0RFIUedxL8u
zj@7hd#p*2$6gkhVsn8q+^`%@be`6+GuwTSAL?<|-xi;HJAWCpXiqE1HsY$9X4<zE_
zeQIS$kBI(d-e`ERjE)sspohCXBCd@dhUxJvcd*Jd>9ADFT(CTpn4!m)3dDyia}cz0
z)*ZPAR}(nQvp>^9a(svfi*6I=7e5#$Ms_k&q|KqSPkcPe(MoAV#hg&|f6ro=rV|Vs
z54b<D{pn*zMR1ne#QI|9_GH2@2lc~}aTO-m1N|wsAD6rVvK>roz_a@eXFBi*RyX2J
z#h3dw8(WoZ(DjrpTIiz2+xoqiazhkdh%Rg$Bng#vz`%({&7=A7eMbT+n>@A5lhtUL
zjLp6*<+AxipUj6QnU1_Ye}n^=rO=RL5{g$cO(zg&85s3L+78K1)9=*;9#-~q-==4U
z77OHBY<|^wu&W@+jUe)>NL%jX)w#^OGZT)W2{Tr-i^*OT6{uJcRJ#CXn$Eg@LLlX$
z#??426$F#y9Y#ZN-e>_tAzG1OZ$18)J5;_=_eCY&)1<Z#CmMz9e_vJ^offzc5HMCT
z)^*gikB-bxyt(mL{sgUbUt5PhT5`R!<Y{VWE2^z1k1+iE(G~weJ9n0}bNhaL?>g;l
zZq&DP|9*VuI_+$2Ec>o24~N^?UeeCiHQTwhq@C^io7ZaR_L6pP-M@3KcJ6E}Td(Vl
z=kAhr?%dzLRy+5Wf3$P=-u1rg{*rd?-MbrIj}ABL>G0ll=BME*Oqylh+fYP4yNaZ|
znjjejwqKD9F*dy?A~4Gh&~L?G6!69%8MW{c1#FrIrWG=9PJFd$Ws@3U%7>=%enYo!
zM=#y50*>zZYnZ=5qav~VBu7R24-nthHX(BGa~`;-sQ4o@e<!o@a089W>BC<X<K1L)
zXibYfR8ih9sZd{bM^=(Z7Hi2%SR;v=wJ2GO0F1um{NBvPmMundhF}W@a#uxqW2;A4
z7CzdIP9Q!w$kJJwj0zUpM3r`^TWty3323WgbqE}oY|pzO^D<FIB`&Y<0ua2r<B{M|
zL;l*8Y@TJafA8i;mzBA*HO=yxDmF%rK4IuflA}Eha$M}8N{#{KO{*4z(c#Ep%{|Us
zNuq@nwPemgScJqHv%{t)lccuXCO1@TsO2U{Y}?{2IT98pNnv_jMVh*_=!xjq7uP+h
zW|OvSh!0jT<Zq224J#;PJG6N@)JL`SRsr<*vnm+Jf6kedPXzR^X4_jqXwAEZ41GSa
zS_uAtsO|xG$M(QxeCytJy!n+jL4B>quUUeHqXvRXDtM}94>;>wQ>eDd^Vqy3MCe-a
zK~3{9<-R7k^ZoGvg8VrP0<=oQiPqy3we(zrXKaal#d<mD;Sh$f;I&Eth5vr<<&zhC
z&!1~!e>+ic?s*2Og41=zM3=k0hLxoI`mpd$(dBoft9GLX7=A2zuYTMQ$%jM+%U9Od
zulI%BSs_iC_15}`er&jsd8_iF{#xZzqv#WV?&5uEtP^}~XUhuqeQL<RS&3Jp+t}9#
z5{C>gxMr-fF@n9sx(^57YYCL<&U5zugmrn!f0>+G%2nK(f7yTavZQufksWhF2f!OU
zzKTd8=fh4wYaYvtE0PXU>4#IizeQ8V-%0;kg`GYojm5Hnd^1RI-?j%fH(Ct<!!h+p
z2}3P7(TTFbPL$~Uxo5N-2l2Wc@Mk!}cr<pW)P|L$KubrZDu|W#v_eKQJKc%q>j~}3
ze{o1S)%poFk921o$Xs{lB(L-%qYnt#|C5brn|ImY!N8l<A!4&M7PSOz5zE`Jxh-Fd
zX<sY^;d<t@+k6@}pMIQ7ccR_tG&yI`qs1~4)ge@NsLZMynmZ_8M*F7H2r|0W^<nvr
zzQmMkq<EiAy2nX2oTJ1Cztli1&?v!pe^-7dzgN7}gwn<xxhlm_r^)ebeQRTDqqDiS
zE;qPtOHPODj0?H^h)rraF+0&A>cPlY<wrlDm<VrP4lk9{vTnp}Gk!vq@`q~AW}(OP
zF#>EQz@j8?q@4C_yOVZ0`*}H>(h7rl-6)RUD!5J>o#y!<$hhDXYYtcsGpx&ge;Md#
zi#gYEsf2{&F3>|K^K6h_OEm4<+v-fJX>FH532FXmp`@(yghVBfeLF;e8V08D0V2Aw
zVq7+7K86p8KVp0e;YdUXMh+0%zc~6kicVl@+9JgC^MP9T&VU?-)DIeS+m}*T5SW6i
zRoH+uzJdo1clS_0>S$8W^Es=|e<vwe_lJD=ff04SE0v8tL#Zr#(#?$EF$BGES@pHG
zea>Cwfy0Emwnnu0cEU2=IW9^%H;wsQfr#IoOjH4WqiFCV3$pC8+2vH&Za(gkQ0Byw
zRte*XB)J&P2uLw&X21!;>=O0RdWtKJk@otmubaQpFT)&qHirKgetfswe+oJqJ(U#_
z3Dcus(X%k{Uq^U^?UhF**bp#5^RDGolhxO6iWaCv<kL8MG(TY>b*hAMoJz2<dm~}U
z*Wnz#pa1>8{-4Q^9Sg^Tq)mITkboMkW-qQXRf4cx<cn<*o{mqF6DC7^^Ivjc5YUPp
zKA|m<PX~Uwf&!>=i@%r%e+YHj|91EFi><$ZSG<12%f#5$E<Tm!v&{h`h*09ZX+{o5
zGxMSl3IWikssj7OIHnjH3J%bJXpK*Z|1=sqJ3IYE;!;#unr2er51#nOt2rB2>fUAZ
zO2UGRMCh>}>jSE*qjNchX!4Tbd4ZsrlqAwYKFm+fEtc&0^B01+e<9JtXXy~3Gtr0n
z5XIRw`Pi-6%njtvA+r%r+6Y0nB&g8iXUTLR>sibh%`JeBPm{4AN6}}qf{+M87N|&z
zH1hizazBGx0_KrETdB@Ya{;lQb25iOa~+>s7MhHdlYzs6FE)GOXJx4%vp!`Hfv>Ld
zMn(_R;_p*kar+`Ve-FfF_q(n3?TrmFtbiGUau^1tJP3NeKv-1jhj2Vh&MbwBUF?&5
z=7dM$cmnAmQ649Fqb+eJ19^xqz_Im#PGDOfL`O4`NO`$f9TymLl#D<z9FJzO-yF`!
z(kaGf->rS?kyj!Bo~JkNt28MKGjx#a*V1WLdWAG}*}g@}f02OHISrVD)Sax_)?hWs
z-A*Og3i7e!4rIv9$?GXD=3N1smYlGRdCjLPcssnmMUfU(x=#j(WPH*ph{I$9iO*sG
zszh_+gFw5-*+->|XE<T_bWu`Z5CW_ly1-Of0L&4*fbc|v48$l~ok8M_N5iZ?<noEE
zF=x|(SP4_-f7cV2Hb$UPZLsBn(4E2f);(egbBP;B27{@6BJ)OeSS924JU+(mrhUSR
zi-jav1hxp8QZ>>&{WwXaYE2MJF2pBcxI5-OMy}nf-8lez1j!ijCxDaI^CWoR+`b<i
zarp+>t!_K8E!lv=bo${*rEs)^L0!Kp1aPfNcm|KAe{>|LV_k3dqVv|1{SZJs;v7Nv
z6qb+4#Z^oSrH-UO(*z(D2k4W0n2~)GbXtzpo-)uo6U}#k-OK%%3%kinH~!Z;eh}0?
zpPO|1HBQYpat4xwKTy$P@vAEUYif5n1l9!YvGtsekW&i`h#_=e<0xN08s<mqumh|w
zZ?7e1f3b6I_(}&-eob^%JlSaekqf%z$6YIn(}f_^r3bqKEj(=QnDXA_?&i}WU26W(
z{&?7I>+M-iqjLA%U;Y8&z$9tW-9K{BV<ut4gY-C=4`G(ZUFIj6vUGHAHy>IPTr{`K
zT0!AQ#<%|XK0SZPT@(LsosydJsqK^z+QPlCe~BJz^y7#)UNYfh3;`xN*8-ARtSm5-
zJWTWrmQ|&O?{St62j;j@JFBDvD+OS#P>4au;_aK~M2UY_30JfUSu@0jicTe7dt#$v
z%hTX%z*cCW4Ud|8ms+O`6-L9@iF!&9T_MIE_*stxifrt!9JA0XANQCq3S~5S>m4Wk
zf6_gjW?S(cj^`Pl$PBx6E?>sh18@uO{Hc6P7TR4reAm{xr+!`N<{OSE{iD99&pupy
zw2K@I?1)R=p?U2d<%9DsK7*b;%JX4EZA=SOhQb7eM&7%sQNr;nQ;8?`_g^V4Y%*bX
zu0@?CT7_7!)~#f(At`k(GbB2sDPrM;fAwh5$gBtoUUkuP02=M5gY`|AQGKas+NoXX
ztW;cFL%o9ttYpY)6%o&zsSPk6sE(xpH5eIbF6=Sz+#?uPjAKM`#$B)o=Rr+5*#A%)
z8YPp@<7u?0MH;weI&z^iIq&G4tQXThy~8sd!y)Uol1ZH$ZZ1&UfZ_0GV>;$Cf3!Mm
zevIal1*SK&g3nXLfN@@5BDjyq%&d#)#{~by39=bS-)3ARCnq(C7gOhPZLKC)iDscu
z3Ra4uIF5zz_GTg+!C0fvFViW&Rb2+7!U6P702Qbi{YO&DY$!!?^q$!Af=8r#R<PIB
zw&LhDgVJJ%Z&4P_N1q?kOiJkie^x$jM0DS18=dgM4$W{Uq;1jAh%%=z4Fq@Ur!D#>
zqGorXo?1%#l6hQP+m88Q#tL(!><Lj8qpnQw#V?Z&*-0WsghQpB;-@B5^=S<pDW2Q;
z(A)p+)tiIv-iz1tpZ)HO-Pb*yk?FjcHApTsHF4oF<oXlSi5^6g)8j7nfAw4C)tDJR
z73tHO(SwIk(@i3sjGz8s({?M4UeSUP{bQOSLQep51*AS8LQKy~B420+`7K`G7r(Q_
zh@*vlIu*4NTUgOvm)fe@D`h$)OICM!ac{{MbhMf?;YNqaKS?-7sci%kcCa=<75MW>
z#zsuqo-jnNFFp*{t!?K8f4bwxV|_fv<3@&y4XKC1o2vkZ$?OrT;MB2K7qWQ-PadPJ
zF(8Z8sp)akJ%{F#aWYDdL|0@6@k?U5!;;W+w3&{qr>U!K^|R4-+<3%bI+>z&V0hx1
z?0x(8`SUVq*HCu#q00$-ah-(D7gs4Dcr(|23yFTl$(1P*Ev{v)e+39n7cY11<;4a;
zrW|)89_N!HNY7@2g+eQrR2B%HIb-~E>Y7@$nsn0>l10#H+hQNvn3tBqz_Lok_a%*y
zL?Qt)6?3GlQmN;5DRep-fhLbqk6(}cIG-3uEI)Ooj3CB$f=rIUbTNnNSs>8mLo^!(
zw&a=QVSx-#ga`(we-HIuagIZ!qp?GuzCM!&TfB&>$su7)hF=<(0A=s9CtO?$<pBFe
z<JGw2@J536qBGw~I4o~7)4&crmA=K%9`^3?{}@PSEV(Kb;%LjRXWNE^@#Yp;K215l
zQl-ER4nB+7{&<#5u^4JN(x-}3t)Iss3ydNuh|FM_#$w=ke`$*rE@8MdQeFg&PEJ2&
z0-lq2yk^CIc7?xKN<m{naK>*Oa)ql4C^kblMn}U2-0BCx<S>O40fob_qC3RR4UOpO
zQ!_ndvm5DkwHfuYk7$4IM8Es-`xnGGcAq^JuQ4p#-APW<bH1Zeue$1yZ(;sAo4}oD
zlZL2sw^>=Te`P~db%KrDJJEcM#3V2r@O4#BKt9%2C%U(>u_-rv3WdK5p7+2#f-6sU
z4|X5z?mz94rug7@KZbvPau2<D_2lUToe}#&;@w3zcTUg2k@rtJB&;3VAl*|^a%ZRK
z{K$uVI3IaWaHlfqJL|L2#Ge>C56n`-_2r~JPV5)+e~zYL&`p!T9ZyWg#hDbLROaxH
zIjl5A96eIigirjeXgAK(L1+mLC`~zKcnx{ec_+kbR|I<yEDZ^dD(Py_)tR@lP3b_5
z8<r1zrfDk>JPJltgE^88_Z0_*^_Wh!bD?nl342T9$KSd22}}}4P!fLp-R_eoZ=UY&
ze+nWXf8Y{HyT~y)kJitM^))_ri0=)H$<DSXg^2yXm8ZM367B`vpn(6xi(AV&NhTSN
z>{I{d!mhd(_FH*<@hzD;ytEMvb~Y@c^?nKg0soFC>B#<mpPu7SQ@P*hB1!^~E+7)X
zU|Yoz;)cw5Z;+xez-X0or9@IIj14XF?bagufB!BWjs$d~VBY`N`B6F@r(7Vr>}c~(
zUPFxPkoGz1Nc$~iH$~}afB;9d6i1aUBP?eSn7iz|1R~=|f{B@dhdF$QPhqT?Opy!w
zR5tg!RT6tM6sl>t<GkQPOS~1Gv)rtLcG4H@kQK9Lj{_iz7?CZ#Ajl<ky@5;Upf$Rn
ze_^wLTO~GKdX6YWztHmz`9{H~H+Q>Dj<V@!^~#5r$Uqq*%AT<Cy=-uq=8V)(<s7TM
zV2AWtrk5?qIvnv0=u>0}>K=(?kCaWnnFR8(_U#<a!)%m6RvW|VTciNR&8J+sZs^e8
zC6^a=y}Eq6!uhlOk?M*A+6YoDD;@Qme*mjb_ez9C0?%Qv);FZ}Kz+~)?wAM~Z^h-4
z0>hpouQ;8YB8(Ox$Re@_+n_B$AGYcY27NTohFU1N=uahAXRNBKp2-|Vn0&~yfk<9J
zkd`B;ZIPW4qvE=(cEftmz|un5Ux-IjMK;>sCN@Nx-r*j<5Fk^&Tm6O`=>*qWf34U;
zL}YoEORIbCBD?F0V9sh5S=VyU#P)rCE6l-^I1phfvK%HevOi8jiIC@j64FrO8;#!{
z+AyracdPNbj<;(=izmcmkYA+_MertEl$zm&!9Sgcad~dlMafp>yen>FFXRl8;z^uy
zfKZdw7mr#&0?@`r^x_eIL4jbXe<6LG^&HPy=7j?Rv+x&aXc@{W>`79k0{^ldUqWHL
zxZ}h1V;<mRcAz5zQ*+D;X!dm(QyZL?X9GkoAsujYAMz{sA(26^ScFeD^T;N+!O45W
z^n+DU4$w0N*i;6JL<C6>WC9UU-;4R0@IMmPmBndn#WY-+st3&S8|`R5e{+d>XA(|q
z9&u<;V^@~)G|g=Ig#{W2x=}2NL2uGyYDncs1N>VpT8o)o8ykiE3ONmTE^p}>aGcIG
zjTreA#moz(y!euz8J+-`A+B>T(dFnLF%pH7XxE`^OT>@+M9jDzGcsRo@5!`@0aAP^
z;a8DaXEG9ThHVS^ydb)fe{UMFPQv;KC@7?ECLgA5{Q8SLM*J*0Iq^_hnO_k)l*fvm
ztPXBR6#oiXQpn<%CuzLa>@1gXEz5-VT-3cm+mGda=Et5DGuo6){H)BrTUMPCL?MAG
z0O!dHuW%z0uEN0;m1K96{F9i<{<b)4{CN0_%d)^x8Zde;-aY3Ge+-M?pQcteMOg1Z
zb6Ks>4!w1_zrDT-gA*_J#N0gnQ(05lR#*bFsh5M|x9@f3JG%NEFs&~lfPTa6bZE9Z
zXsaW2Qo#>!wCu5TD2V^LMw@XARvsQT5-Kff9)Ok;P7SHZIRQ@ZL9JLV8WRUWFSCb$
zAJWW_$QJeLw8owue}`|Gc^)qq;-1rg$J}1^o~?sKfwOgV5FL6jG*Hu$dA_Zty6#aj
z4dzuYW|D2A2KvL$fVQN$J6+SE@ld!>`AJ6_Z3P9xm0sYUx|X5wL|*L5ixL)!u!!|a
zllE6JoA=+Vwqwf7pCmR?eN{GvmfWpQq;g1<cnvvK4%`u&e^1Z`G+^Sl$gH1=^PbTV
z+4{{w#ShgWzN?1rX~5~3L%!$0Ar^*_EUD-VJ}lO=u+wBR5swc-aX9dY9hCsyK$8;N
zNbRR7Qgc!XB!$m|rs8l9VL8_^mUA2r3Pr(7$F>1WzBxr&2C7(u;Ud>*8tey_^u{jj
zWtr8HfZ!*Be>oud7YGs{E`<6j3|!Y2s;C5CG3v-jSUQ|?fbEm0M+u7bZNbNh%-B)`
zoHS;z+w@JNl;QaN=PZ!zQJ%l=08g_OhM%w^62wVABJmx;X3z2*ir(&%zedE$q=Y0e
zPWEUl<H1q>@p>BtfnddYGI-zR*05Qw(Nhqve3lH~e~UXu#W!aJr%AA;xS1ysUCrv*
zUuny%QV*?Qx%t^xS3S!yxDJoFrQ-;3D3U<=713BYusq4iamJuYOtgONr0;W^W&V_8
zUA<3qinuZ<35;+%NZf+hB^6iXK&Wp<ZGs93Ax2G%6V-Uf06Bphwx<p#0mg7)+gxf6
z+mHGXe;6R?fz!G8-`#Y8RJayz8QRv6Q0yuFQ@0r?>Fpl&1+5`ti69cXBckjv@&lYM
z1MP4i#Rxb|dB(ph@N-y9%&TPe!m@(QY#`MMa?!ICiI#pT6Ov=*gDj7AO|gYr8c#b&
zhn?hPoC9~&sjF<F(qtG6P184piMa^5=tD+dfBu{p;q&J&u0l96=ymS2SpR06k2~^k
zM=q)0BnGksc%5S@?md=*B0d6Bptk5)4NO@*>}gBXS?>a0s()&|)p8Qn!TBVWID548
zXL)G7+!S{2cryB-;OU!?+(n<W9z09!v1d_}GBt{G1xy}`N~<58r2-l$0o`DVvOl2d
ze{wp&69xwl_LATA4sy?>v(55+h>-L*mEAQiejv_jr09YmEXcL%l2pHuCp)^=*yyIe
zjS{49L+xVKOu!?3lBi_DU?8tWWcC}C*wQSQD1ju}{|}IgNBL2M#C5hY@c8COnhPgf
z1)2zQF5I~r2JDmW$H30V7~KIw6eLlPf4*ikne`MuR0$`^deNapO4X0U#Zh(XO^!8$
z#1*9Sk)~XzD1sEh!p|UrJK+kqcwP;ReLYP%u%Ljhg!SJI@k`Yz!V7=M+i-%owzA?-
zKh)(y`8Teijyz<Z=2mE#S#`yNz))-fFpGzRGgQ>~E40u>U9w4`=V(u;tQV-3f2(Q%
z7?dC(J*biRIoUxbz3#eGa4*_tUKZ`X-lL=8oGVDdM#2umS#(&(?2<`Fk6z3GM?kp0
z5ak)|Eg%Y8bxxEpXR>xK{Hl(EI6TpJ2u@f!`b#0J#roFP*1EOQ0v`FqB|(L0JAd$%
zG+jq*5{ID-@sO+pLRl9}IOc~7#`Wmyx_|UnPt!zZ=_K0Ri5^R9K8v)`cx)ZOG@z92
zTa^tqNX->6B@J<WGDiRdPX+X8j^8q4@XWzb8n_W#P8^b@gQh~{h?E0kU3$jo=$v^A
z$2`|1CSF*=()z{;K;I~dB98ohN5q4ee$vN=(OWx>Z#@5RxOkc3eB94+`!g>Z%zxUD
z9y-j9ECS{={V6wSqFKq1>o__FPqIEu9p6=oq7Gs??(9Jpx)z?18Z_>qH~i<qQ_4?^
zxcJAASVdR=HYLv9-sijfa&uqpvSC{^ge0@4nerNq{*X?i$cS&%eUGMRE8%dgD_;Qb
zcG0rpv9^RZzQPf1v?05C*sTKkk$-QsqRvB-;rr@3ZZ?~5B$b+}3I(fh%;^y+$ZCQ#
z)0g}ZytF$#39@9RX?DUO{DdvIs8olrtNA3hZp6Dx=T7t>@NPDV<T8%IZUQo*+ozwK
z_ZSq}YAzudd!Lr%y!ol^-<##{&-3zoTU!h7Js#%sLHR{&sdM6xl|C2WeSbsb?p_tY
zD?*WJ`1lH1#u?9Q%+RB&t(Il&^Fy>>P@7;OLI1}lHpZMg;2_N=^*cgN%1KJsj+-xY
zH~TzUSb`tX&!@Qgsj;M`V$Lx+XbX?hr9Q{wtgT@%pBjy6p3g+7q2co;P#6GOtOrf)
zP#(~bcNPX8G*4KH?QF%jJAcPSqo;Z|Fugx$?m9tAQaRWsUqr0A3IjUIwMJTnz+!C<
z$Lw^@0@Z_6zf_3GWpgOWIaxX$0GOsKyv0$|zwnp~iBUfR>9d3;fHt_p$sAGxn@43M
z37gqN);|-oAx}zbE7El=t3aX&cZelTQLEzs<k;pEkiQdg#nM{Kf`8ldVe#NF7}UFV
z19g*LzwW-=eesmmr0HDZP(PsnHydyFpT6ntJt^JA@SBbOgWZFt-6wl*=pK0DY7-o)
z*=p=R-QVAP^|Jfz-gC6-pIav)5th`+2J!6Utl4<-=%UApcyQEgG?*_lLPeLj<f=$*
zb&SNd5s%&vvgs-?Lw|_zJ~)`p)3*3myZL+mv(-?n3=u{<V+JO4A!n;^p6)*HfH4jP
z$Y7R?kZmjHPm<-re@RcFvuLHzwup4oDIH-?RI)8IU@Ro{wmU=;`gsQrh`lPwxO&@6
zTbU@R=KAQIdiev6f0dZkKf@u`f{Dx$FUeN=Y7ab~1anQ1L4SN5J6pVWd^YU~H>{o<
z4{8sMReE7n7pbLlRwN(NK{p%Vm0+o3k{1RXOt{*Lk*_dWZGjb)p5Zkp=msC?;7;LS
zs6}^)-n5Q91M|-%j7e4b2=GHY5?4!j2+3s9Wj<r%-sVk6jXzKdZ@b3mn)U43&`-~b
zu1@*`Hx}KV;eWvKw|n&JqZg6xrXLWD)qa(xp8YVgKH5W^4fMN2_@IG_*x|coZv4P=
zZhwX?4ygK__FWGuf6If~Go6H8J$k5n!7_qz*qshMynIL}1hXAMJ0nIWkG_VJ97Hc4
zhJQT}{?K|Cc4OKW_?WOoVJaGlEVeW)14#er@?AfG3x8?FO=dg%ng_ve8HpzZA`$L1
z?#q`t>#(~L^H-K3KaQ<PYBs+7VeJNYV$4b%dPp!W|Ng)~+9;jy{zP&VO-H-?9SAjk
zPMSMWFe`za#VbR1<wtPG2157jr^!4%Q9|T^9Veo;qu?mO%EHvLBFeTMyfjyQI{v9y
zIV-+VJbwkJtxr?lx9Ru;VpK!}DWuNw2qwc}MyD}Qu=VXUjhe3$!7!wqt0~h(lh`bZ
z-tc325o_$rVe{FmSI?e5?UKUS{p-`eH{a2K<%15JDq1(+83U0UEZ#LusHP8iK;I}I
z-zC+E)~cIiO~0}=y*+#Sa(AywWZV7Q(>DiC|9^9Lk2`K6gsEBAn+f&J)+Oz}*n7Fx
zwOGN@*SIF$g@mNa6?WHZaE!MU;F$i!J6e>_^>wGw(a&WnovJTu3}mEn#w&<O+Bq&(
zN_U~ch4=CI3TZs3m<2iQd!?2Ktn7ZPcC`Z%nO3m@z~^?Nl|Xh{0d<y;kXD|hvkUYW
zmVeUuEr$bB>_q>J#q_c&+f1~Wf5wvSN5`o2aFnjDlvJB|g@w9L{BOmG*-?(R`lCGe
ziByZoX<Q)EPc38>Xixm*5bhUJ4S$S8A=y!ou|EW*XMI}_0}YDRr=8$MC{N)_E37)L
zL{0@_#VLFPYE$VAQJR8RR!nDFDfLu+kAD>=_u8l6V*|bEkXK`tKZn-zn8<at<+k4H
zZ}DKu@xMqk9BP_XrImK1OnoQn)#*vUQ$?v4l{F>bjw(vjk|;=V9P`-lJdOKP%Lo(4
z?yl-f`1<F=k*G}pO_tOqrY}~Sm|DwPQw_;}hSJ2X1uBzpi<PTsODoa8%j2J;D}T90
zzJR90U&9*GPITz`!MkuZ0!3+MK~Y-KhrGJ9Qc{=feyB99fQz{sWu*xWDuxSs)xFUs
z$|-42D=mH3D^VA|25pMoX~6wu)-LZuFjzi2WZxXb&+MEPz$`myvHveSY#V~3N6Z^c
z`v+L(0okg@hMs}ZD(#ojL8UiZa)0=S=d(6eIi%aQC-ha$W_4uXV2dlGvXd;<W4Zct
z&4BCP0WZ;uc7)RbPRm|B!B-4(aA_~$`3=Is>Alhr_7-$w2k(XLmCkKHZhMzorGFh4
zqC@XP4i1RvM?^EtrzpgufzY2=#1={{$_lTrt$J;EwI?d{&ieZAepCwn)PD=xf)2I^
zEtAF~dZP>`*eRmw{0UEhz`o6f>B2L#0p_#g&b^gZOtd>%m3MYHu$T+*qRU}A3)D01
zS{pAZYx`c))bCmSG1Q4(GFx8MiNFN*20O+e7L+C2({AnFr`nO~VOG2`J@mJ~)h3h}
z>`$YDC0gfxN$IS9%hE5Y{eKP}DXju4nM;--)H;>Q^qe#86V##_sNyu#4}%Z89e+Ny
z!w=o}TBeXD);7@pR<LteDC6l^l`)7Cm>&m9;4bTcKQ@+rcDQsEb%(y>g^39=!*8ht
zQ*2fAl_A<XVMsa{OP(!hd4Cc$FZ$D;qQiG(=u)S;wU%gfCJXVTmwz-nZ>DfGRr)xX
zUlzVDRNq2%?USX%m}hBg2kRLDHsCRF=l3X8LC5jhnt>8ZOOl_|yZA^EH!ZuGoYM{B
zh6aHniXA{E;x9sj0YVJEwWPl?BqfGi)>@mlH;?XZ-n)0NbNkNSv~%nD)}7A%&HEdj
z!SV5Cy4k;#rpE)e7k_(Q_To|Vvw?QoJg9k$ErSq|UG;DhZ;?l#<*_&Kk>GYRP17QJ
zoDPd@Uc^nC>X!n*3frL6<`Y+IbC-dTMAD(j(|`&&Qspp~_>K>pye=$)1Q+Mb7p1GM
zM#jQNgM@B%ADSw5eUl)?wyA#0$uvXg3(?#~D}uA+3oS_b(|;FN0N1sq0qGcAF?H+z
z_y2wD=TtLtGmUwX@Zp~GGWMeNsOMEw;PFh8N#RN$xFCto48aHkryvkXvLT}&x-Mpd
z_gO@%bSA}!`grm9wPpiy<l8CA>Or(sp(<tU@F04Fn00YpFdol%V4xemK9xA~R}jiU
zj7-pOCHx0Ls(-PYn|dYPrfSLEM&ktl;}DDyL|MDg-l!L^ODk4$(ZYPG@0Ehb#_7<U
zf0s|s0cV2LBFoE`l;>hjC&GsiLR}L#aqpZV?g6IpdEpeT(hlQ<Ao##}dM&?2X94jY
zJ$%=CS)lLn3h{1Ylw6Ma@q5z+WpOEG?D-4#W?bzB@_)Z{u^56QaoC)=#}19CS1+~o
z+NJ0Rj%%*O_#lp3qDeW}6Ph4$9?EQkR8%V!t*fo4T)|2K@>LR7fz(k1bl#Sc+>!xG
zY@Gy7Fyvq|L?E=r3o1z4Rbtd^*6hbRt#EH|{DKo~DxF3{4k#4L)=&pP5#kKTMgmvB
z#Lo*Z6Mt`%=+SP8B;%!@WT%2I8sv5j@(Sh;4sr?i3^E+#&3~p-q}m*#1US@nf#b6%
z4ME!+Z~+*ect=g<butwDL==6-K9z7gI>`02qF$Z*sD}U_3yZl*07I{ZNJcJSSMQi(
zLj?zn6@g<8HohKQb|NI4<h&^)>b2**bv=i>M}J!hVYVcqOe7%I`{km4_wGIRM|4J{
zXr3lg@a$-QqC=Q7wpbDP;V_0P`QMmPn6Gf@qBA<<Sko~|E<q01RIx`9k_43%i!IY8
z0JT1vQ5R}Ch2=p7Pp_H%5e9{aJtjHCc)rNqPxDuAULY?|b2}Y4&bdz$<$!IjKEu`<
z_kS1Bq#&fu=5VGmdRj=sNdF4L+oq!XE1p|$iu}%pu2pQpe0)RwKOCGBx1jkASVwVT
zRN*)JMo0ec@Ea|kZYHdb<#N*J`ziRKRBi)1s<AfEKo&d<79<s<!79%`=lg4Gw4k(D
z<@6r0*hqPn`dr$8AE*Gqo@tfz5Hf91a(_<13mWp_z5+3A$uHifQr-2dVU%r4yXlo(
z9K9MMTrI`a`WH(U7{U3gv$G&-ZFhpg7_&-vuxNB79BF=qTZTY71wnD%VLp_cX0U22
z^NwX;Z=hxZ^<KR$_1unn2fKgUd;a&}3U?U_T#O*7ywyVHkj+F53#PAN(MiDGN`K)2
z4|`@J5(d^Yb4*VW8AWFB@l}g%AbN6$GY_jy(#+rZh7{Kh61{p$?Me?IfD>=h7X|0Z
z9)JA&)!QfC*Kc0^<>})C9b)O$^H+~|4@lMT$rc$0q9Y&ZXB<LmEEza<`r#!bAIDq<
z-_8j5p7eY5Ml3-t1g9xnio;QQntyRnuVl1ip`aWgzaF(3JC?y~bui=Th2{=(d1j=+
zaAdjSVUjw=foBY1OI*weK$fGySzu+Eh3)Vz(!U&EA4iYSx*WY~uKuzC^wFy9)m9{E
z?X*oeosMsld<^I=l!x=Xlc55NvqV6EINN2&P}dgb&&lWpQN(-CWq<6Bv46A^Vz-Zn
z2@-mt*>eAFMm|Us0lp^@T|F*cw-bhNRs$X7Gh&tzhC@S<jChKMqnihlX#=ax#D=`y
z=OK5tJGVOpz%yr^t&Oc)n;TnOO^uxbQdi62JdBknqu%bzgYVwFdcF79bFNiAE?l~@
z!&^m6v7b7mq9rvfGg8?(8GnK`o?AwilN5Vy+&79+Z!733n+pnGZYVftbwQlh-F3Lb
z-tz^gJ57!`i$h28!rZWr*fqvZ@4q^q_tl)l-!S%o6qR;(PO=qL?3b-nM28}92!V)t
zTU=*f`L~hf1izC4jvylfM}=5qxyXh__p(M=014iuT_e3G2e`ZxSbqs-7si|!+dPGK
zg>3a|v%Ng>u@t7rbKfopLh^DnQ1u77n+sj|8=u`v+hPjok9V!hwq!69*N^UeBUmRa
zO_ni|Xs2;vp_UCKy~pA?X=!9Mh<cQXWowpxK1V+~=oU3Wb3{9dljqdeSa8e+yxbrz
z!Hm^2JeRUdQkOg*a(|kb$$~)dgiyfKBZR31KtxX<Ddq45^I<j!lQRE$n$Pln9srl{
z<n-nCMDI$ONEJ08j`ye+1S!y&+w*8sfe>hBo+7Xr0Y%4wJSNAe#X}5`zBUkKDgxz*
z4K5e*YyQ@F)Sq-Y8OeUIAStZdkF_1`&jwk(&t1KC;Si06NPlMLsPHdHgqI9$)m-{o
z>RYjsAJjIvio|=GiU-Z{<RcL*@CF|oHve2VyX(?^#~Z{D${aU|w3Sd^C)w0M2c)Eq
zf_|EkVY-5!$T}kx$7dUoW?=SWH754Lgcn>brArEMHJ%U$t<(-<aF_GT5)`@cftdMD
z6UNXD)A@pO+kZg!VS55g#SAi`v*l7D&2(hFg(&{(6IU0WPMp3u`6Yr-N}%BhlZM4%
z0TbLlNeb_4TP$!#ZEQN*k`5YXRw?+2FRN&VmSZhbrYU&`w0)sAof605Iz`Y^dfzzn
zu1{QHRa-2x4u9H`msF=dw@O2ns1yxge&85Tg*TA~Vt*A8FHUoc7^iy#{1yH*Hx$vP
z{-)||J~Psx573biTkC7ph-FD)kzmS|!IchOhFRfYaw_&}d%}U{w4?$iPDYf@P#s!w
zdIZSIl`EP1`c`2TD*2u(SxlffnmFm~EiIdUF@7vHZJ6LMh7kk#JY|fQ>)3tbXrDHV
zfVeF&c7O5SxQ?|eT4e@1&PW=cX{}?E{03sg$`s5Yu$bn<L5*cs=hO6jn?IF52Yg_#
zdlBb)&Q_V)PzGEttK*pdP){%`^<VY{y>5vTzrI9=m+~cxlJ7oEfhb*U@tV$jK^V)q
z-#s~*W_03W``sw5p5O24`)Kc(YtPD)?d<GuIDgjj^d#w@ms0A*st>dszQ=`)S!5t>
zDiR(Wqf#R~vJ)=Pbr!(C5PJp|r@c`GMMfEj7dN`N5f-Cm2K^@GYB|$r|3f<DLxQnM
z4I(Ll!wt~w;~AH;k?l4%C=(iX<1qZxaxQan(!s1~GWaY%N%=V7j*UfeemP0E*yIgb
zlz*8ZvyAiT{Ww1xrUPOv5}zgg!~oyYE?<2BwWnw0nyP}9yq=9tWN~b5a(x=8T=7|Y
zG->%PYWmdhGemSNeVIVwj){Q;z44UZ!pwF{&~}cQmFPmIeHEt`?HX;IcQ%|!Et&6P
zghNf$Xe)1(G>%EXNuc19f_pSYi63o72Y-3N#Pba6W)(X==XC%&T;NHR6&swar2M0l
zO(B`n3<x4F!YF`KT%9D@pk;M`<Hj!F473RehhoE{g&eS{6D?VxV7lg(l!%UWuAp`E
z^a!3Q8x>v03k_J6rpBS-d=O#UD&6UZ2r;D!5KQUcxV`$Jhz`mtjZ05_E;-V98GkI=
z9j`No^0Zy0l46HL1FhPwF4lo;l4}r<r<``ftu@{Z2rDSU$LKtjF<+}clfJr|zARHE
z`{Cd-HbSrixW-sf!PH}-n@RpW5gjUoazQW_GT?@3uqDAt774ec<ESv&@=r<uOFBBx
zi{6#)nb!=9ys@wyB#u+jV3NK`Xn!*<;Y8}7fNk*5w9v1aV~EW2X~QK=4@iU_08T>Q
zE(a{&VNS1XG`{#E3Hu<vruknL53Cf6h6W{*z$K%#%Ge+)0FNulB7@9TC7fyGQsNqm
z{V8@}C1ulT$t^1Y?Q(1sf|kVg?4V(i=*GH0l2Geh2O6bsTBO!I#k>aHIe+w*eXb-x
z+uor662W&Z&*U~{l1s&d20D{uoDLa?YUZ14HI6+LkVuTo(~LztmNBz!h7HW5d<)mm
zvIS?kTAJHfWRBTpZK(Plu$w)Et+oMytikcce69+iFr9E5l3_YaBKx_9zF3)A=L(j-
z9K2y;AXu>c_~R1rs!^lZH-Bg!@S(c!jf`n|g_E@-J$L+@9a@Zec+Oh&8EJuCPa0pl
z{7VG!56Wlo2=Us6)05&zN?`zy$hiOn06@1kSTpk(gl!GaRc2wI2OHp{RS7$80nMAm
zceyOjdAhVU{Z}K3s?@gZ;PsV@J9w9Gtm{<yFIxX*nzCKLpXxjo9e*A}i^eE>1c8d-
zK<Q!5LSNWRpb;0SCaSl>86r_kzKmb}x}PDV>G;9pQwkQl0nCA-QfV^Am#C{b_!8)4
z_N3NGVB6f+9WlD>Sid&fXq8&|7p#SzI$W6uejph4Pc%M^jl`?$pI4ho|LE5p-&r=8
zopxMrJj(p+$uv1xHh)H5RKT4o65{~R{$%q>gZur~2Kqc<U_%*eD}?RrvV7c?Gr_m=
z2Mn^1N4P+R2aG)?)dELS!#L?{_ts~RUCt+&AAxdor2+j@YT<h#(FV+9`z1W(e$6SS
zCdZLj%^+O_wX%l@%L5->TXS*^!yFD^qvA}O^10s-`N=d25`RyQkJ|xq(zCaF;<KE(
zqluvtPqi``P*p|P^rgoguBlA3leB<KdLsIf9qtx1I&P>LSL^H4e*8@jy*|P-jyqOT
zGC1Y9Mz_f>Dq@Ni4->aA05Pc9bnqN7N&RL2)k_PRY_JGq<~{~eNww~@=GS1^AF;M2
z`Xg6};JTq={D09Bqznbg#osVMpcyfcEJxLR!*M1$-U<>nM?Y|3Z9ba<^q#|-1-P>8
z<==I8QTa?Kgc|>L%JSzR`U~w4u@7Cj@ne0rqfsZVx?-Oy-&*9bW<1GfK1q+G2hkz%
zAdR4xs*x)=JXgdC<WD!c&XtY$rexYx-y`{3U$a9-1AoOiwEf*5EE7!UUWn4O56y`5
z?{YnXPxP94H{Gb?Q8HOw?IR}l!9!$h#&Nu)QBDt}Cy^+im7o6q?ETwvBUhF!3O);8
z;Yp=s5KI7!i=<Ri3S}}PD2b)Gut<hfxtTJ+NjOQ*0N_YC5EN62V`ay>`>D;^tWUih
zv%SssQ-6O$_v`6D$sg!n=rzWib6p$&gAu9BU3F@!DkZ{w`MR&U=5<Ve958-A=Sq(H
zuAY0??O9uQjNb_Y)2|Yb9)l~Pkpi>|EJ<N?gKVuL@gToA;^&Wx(P)pFF7ab?jNXZ`
zZzRBlMyh0I1$U!~+3!eNO=;OhHC@rHxvN1&5Pv^xw-`DAHEA#2^#AaEsY`s)`ryab
z2Ol(c;s+nB+lL>xZJ2x^d+>t~&ip*nnpN+FNWD$5cp(JjgAYFN@uflucCwRu9f>in
zdlXJwjU527f1kOn_yHS?YG;$prDYE=!C@cciQ@*oq|h}lX1cpS;JM(o%mu>O2zqn6
z?|)l%UnqIP#)ws&H(UV?(UscJiDsJe?$x@%?G9AjS$8p+RWvl)qOq;c29x6IvD6~|
zTmz}37#>zv1Jz<)q(_3E-d5-mqh6xRjE<ygA2!e2h2mrw-$wg?=w22eut)O=cElmP
zJ7<m!bh|AwA8fkq_onp$Rw&tzJc;sv@qeiJ<1>3+e6=VMf~^dr#-8nock$*OnT<Q`
zq<pW0W&Z2qX9!ljbFiq9<KP!}e3?_%O@tN|!>?(dhr`3_7d>P#+N4D#Z6O~H_Yi6I
zlt#m1wt43aAKvM#sR*CDvAf&ZeZ48;o*96dRw_l{V?3*_H>0^>i(=q=k4E3L8h^{u
zqxl;4s+BVlhz7eL@qyfufcutih2OYMzn7kehrOwr^G%M?G2o7(?4G;xFNbD_T#(`w
zl;_u*(ejh}v|VMc=g}ny3Yp&28EIg03ui_a6S{eXLtx4|0fu*-^yJc}WT&}x|6x>$
zIvsN$MOgTRFujh>s3pd8#dhEeCV!~V6Xx4fUL5JdrW$`Q_yUolLyZ35T4kxSFFn>j
ztxlHqLlg{p{9A!`#)?j8W3LKoU!rv0zO!n92-6`JJlcA}ct)dOzJ=pT49hfhx7^S>
zYMQPVbJLDXiozf_N=5I>FGMTVj?IPBsk;=QE+xWvJ)TeB%W62C_EAlr)qnJ*8V}1o
zVKWjGfUI@em^kA<J3jaiWl{W2(#E5MV8AM~A{rWX?235e#@#$Wcc~ATjwgo()3XrJ
z?GwyO7JL_d4XMM2n`PQcn2SNoS~9aI;fN+X=ABRS=E)=8IPav?mrF`2_*Hgt44)Y4
zl;6$Hf}E@Tj5W2Fapj5Yu79ZqU=~+<Y;k%7XOX$tI_me?(3-%Y@2X8V@-17u5oJEw
zDsg4p0lFmKch3rZ<p>Ql2=Gyel9(>F-3bTAO)e6uQI9<WfIVcr+5FVeEVFM)E|-#t
zK+IU8USl20h2^$|<TF-Oms({ZrqNSpX2D=Ndh$(_0>Vvc&pWe{Fn<-3?bwA>y^8s(
zTMu6u=LKiM1x+-20p2!-#rNmS+$`Lxh#MG)GKsGDs1k=c%zg;fP}kIsrqGq3O^Rq5
z<43S|?;QLN2-lkv#M3E!zR$R_yRT_b%+4>GA*Lgl7mPN8vOtp0I}&pbIf%BlmezJ_
zE7=~pHQX++&9OPSs(<OdE5Cb|hU4O5&~Duq*RZXvunXkqxoU%>Sl9qrK0;U-LnFkU
z-x4cD`^fK!fP(El2t6~`!FKC`4C+!DuiD~Wyw4?+L)Dm2#;@rv%s9*iv|uo`%yn10
zlcHNwvIy!9jDX+8sq~{bHh5T^(Ml@HZ`l)IHn2+)!={cW-hceHSZgo~bL#52J>s)@
zxOa4n=%L%=ly5p2>b!ed)pH9<+uQ4`AS52nCC;Xm5&6k+Gexm|jLa$1Q9h~LY$~BA
z2(@t}T)C9Uie{xWt%X~T1E^$1s}r~ktrYKhBPn&8Eyj@zK7h(ynzAf_l1EU(?>!;t
z=H=4CM=o@x2!F^nlW|U_<Mt{H?u2aexO`RFSv&c8#)i{kcnrWm+6^zawmOo2revs0
zKGxl$(_GH6)kBB2wjMEFZJtYl-mb6ruz>0C7^{SMHd<My*Gjdpbc{yN*;2>yBapfQ
z$)TJxr<zpxl3t2iTL-i9b?F$TB3u~z5;TlnYr5mDEq?{x$P{fu%WQ4o(8N7|vFncC
z{iO5OlDuNr<5v*Q;I)o6RKvhf7PmSB31LjXbrXX82kyS5YhL(l$GxNoqaEZcOjPb4
zWnW7SwY>S(5z`EUmXqdPVVz%_#S7_}n+$Z5i9wJGs0`^(PaS_>iy=(X6d8%Z6P6Gs
z<pi%ocYk3BO}3lBt0Z7W_fLIe!4hDur;gTdZ7m&HI1>V@ppy;Gx7}0EjPUKC-NcCC
zW5722;l<0t{*(Qq$1e__^dG%A?jOJSX79PjY}ndbI;u-eh1i)+mf-WpVKqxV&_EUI
z!g63s6ZPalf~TL}2@PERM~lgJlygM=xmQn+R(~{TtMh;swy*?H`zAl7cg@=`6tNQJ
zc0)*l(zC)5g5gdRoDq?@hfr*kXQGVDJa+$?Y}Rbk2R7oAt2?u|QRt2~__E!nPhWhu
z_oV;$>)q$i_n_vHiPqo!{U;lru~DY~ax;SP@IbMES|X{G)u)I?OF)@aEbZIDo{8YB
z*?$I}?H(LF-Iwsi(AEnbz>YZKWKW*e=KAhO%Z4_&`)%U2?dH&)JY&ngS=+|i9c@!`
zzSsrc<oqDa<8B6c2d$0-012T6+9bY~FbLP0f;$agJv*Dq!w5TY!%a??jcvs6cOEU=
z;BPko&Zqc)eZ<Oc7#P$>6Z3M&ojnoEY=2+uM-Sqt5S427h%>rV0hyir$m8hx1_22X
zMu4t06tQBn-J4hYM=y>PA2WONeFH2@1NPixA_&JD^<+wE-(+G5K&2o{`*q|rWl9Rj
zK?nQpKAE5Otg_?Vu;FI<V7f*7@+e}!8A!oYCqA}@;y?<pz(u~I@a87oGA?h1k$=_3
zcW1(n6VhdtUm4jWL`xKhj=m7d@H3!4A;Xo-yg*((6cyeypVh_YxV~_u+-$nBK@sp{
z9Go{<j7FcO$X(UceJ?0g)s)rq=w$cq?jZH}sM7OKF-yqJKD%`;semH>SJBH*<HLup
zf_8*dT8*fR+#E=qMwxnnRqsQ0Fn@cE^ZLslr9;Et^_E}18P@}j&_*D<$V11QG3ID_
z-Zxg<QX6e-MEA#M@%%JYp|-uN=}vavw&`#uLR4lI0ST@YUS=nI@S6v}`Ar8?`PIw)
zr%#TuU&|l;XM0CSyI<|$f&STl{NnlX-t%Mk<jMZw-s59m##b9W4*;B6xqp9ejLOLZ
z;ZVvT>;!Co#`z&MA%3PvrUs|_rtNouuJ%2wwh2wUkH6unmlqS*1UG{?<t`PutcK<^
zq>@0pvH17e>7Mf~xozbr?UZ{{?zZ&HWY@UG^}BQaS<3^w&RKNhaBug?A2tGzTC&j|
zi=ZfR=h2P=eV2cOhQ6`Aw10F)bbgWs{gSzskM|laJKE_xJJil{)cZ1x;Gaw!jga4l
zJ)EJ+^~n`jo;9sQ>;b&PH290Rv=?uE(E8{)=~7ugc?N_*Cu2jY(=UggMQ!74JKD}z
zB9KLmF!nblwKcdz3%wsVeS8z5ktArTvd_rIJgeI=Sb8+fa+v+XO@C(NVr?(aKZqEU
z3?v=gpLq6TM~Ju)Clwy8qc%s(r3~Ka_aM-YJQu@8&$MK}(KF><R`$&1*H;OnSWkb|
zzw5z0aC39KgP1<vm1B$>n<(O8+MgvI`Gv1+^<=b?mDNt~OUq#hpQWW#f?^r@+qc=%
zxc*IoHWn9qKTJ0VpMU@U7r*=Ek5MPzeBoH_jf;)8`}amzQ$^xTTeDNe=4`#~;b*N?
z$ModGU;gNa^5%PYQvK1yMWB7=F%72yaYl>j8p%EcT^>F8Ch4A+5DtqFqq_FK@TE8W
zC}TL*B_Se?jdykRMCgdSeW=I_>r_HgumN_tv0<$*AzreAXMgntOgrR-B8JRD{0Gs5
zI$`~~j%W3clRr)l_4Gh-Sk~~}b?3;K;d*`z?_Weck`s$04TDGM4Z{5=GD98TkRHu?
zLy#FZI?*d&6CGDF9gkhHJp!SN%fiO?qMmJ^mJ?OSq#t_e98uU{gs-Q0T}MKDQk*2=
z3Cx|dYEh4_kAGg3)2M8KF7$miW?Mkfg|CkI@+cG3o4~)uq!b6*)~81Sl{bio(B5b#
zlccvDOc4+Ly7rX3FP&T-!1HqCIHJwX(?DcSqn5~ix6@DPw3L<y<Y-!m;L{r$5pmKx
zFhwVQ$liuRZ<=I^B+chY6mqfleiOrRfe;=r&rQvx6Mqk#v^dX3)#SoodhO(J{~T;!
zpskC^E074bs+yh6##lPp{kwPXw&T;e8GTNBE9;3@TH$hCO`ZTzrifF;3|1)u9W~j0
zeedqJ-F@3J+1$1%8N{3T$7EgMu3kCjb>ra0(Q$G*%*U>AZY33#?7S{C9MGRcQu{Xa
zD~*b>Y=4(jzx<0J&1D1V(ti0P=lIPaE&L|^d0Gvxm%I^v43eeH>YH}_)titqr*W5J
zihI?o<x}Qw9#7-2^^lOM7=kwPLqYm~<9^B-@u4I}ia190+R5jyZa4)=lZS4Dmq^Je
z&2Te~ipj<N@(u3uS>3iC@Krqm%JyCQeuZ|MD1X3ml-v{VDU$43k-sf9#5n)qX)&?H
z5N&&L@;&Ftj=6R!`~0DP;Lq&|UVr~tD?KSuHR69_w-{`90yb~N;_9-5L%n}xO??qK
zfAnJMebg1tbhB-7Zt>;);zSE0i$Z{K%*-xmY}7zr&-Y<cesR9J@yE%AO_J7x-q>fK
z>wl|kJG<YGDwC%wl&<PkSW5k<-8R89Oi{D66(zknf)nwk%58q_rLoUUed+iO$$ee#
zFqE8fe6~rMyS=rwlYNJqJKp%Br4pf>qDv<V5A(Ti^GOi;r}_1$%7;zi-xSk6EGn``
z#SufnhIFc6CmTZh&9fZP0HgT^k;C|8*njh5xrebtQYyzJ;?>X_TO(<84l~wzq4iFk
zHEoS*<`?&vFcZ>+RQyBR5lWm~$KuEB#j-Ub2_U9|I&zZ8R&9mXSgY;LnR~>HAi;ht
z%B%OXDl)%CZQWMTKQ(i6nEVt9Fw>9`yJlH8ISBG%)AHUk6<kC4w#xoJD=y$uH-8f?
z1Qg^z<A_GS5<;<~F(L;3BItgz({j!@ZpVBw>A2wh+^E)DR_RHC^uY?H-k`HyotLQa
zx{+avM_X_|cKms~B%BwRiY_jL{0uWN0+0(~HNEM#u7nS2n19J2<v^vm0ydjFj0=F2
zSiFiDHa<!W8%qY=hHYc%{TkoXaDQ-iTCJZTp3$}Er|esJG-p4xe(Ksk_LqC+=Hunz
z)2%I6ZmnOy_U~Rlym$9k#pJAliT@#ZjzK0Ldq~Qk*4bIC;0gl6&-R4CXt8~G0p>xe
z!XjIn6DN_k-Jjz4`}Jyq5s(}-Tw0*}SNK4v9|Ew;OPY4Pchn933*>_IqJN;TSxzoe
zl&F~`Q9mp6R!?zVY<Harz;V-u0-m7R|MJm2_?f_wruS|OC^Hy3%sKmmYsaQkl(ujv
zVD)WTu8;27+USXp$3JdVQ)JQYWE+5v|M5pUM!tFT#;+uCV(DipU(|Th`o+nbWg#`z
z8GygH?<eCc?%d)lTemxHU4P=ayDKBy=XtdQ1OFb7bj_~pI<?tYleR{Mk~}gic5o-L
zmMqoaeODbzgjMOt7HLk<=hz2*Yw8O(O)IZjapwt}O0E{^>>&c7#QQ2BO#|#2*a46W
zqDb`bF0VbrblEs8oHJt*e%G=w`Q6Ta#~qIiuUpscd0{=E{e{6m41XG@#d#$TEp+Sg
ztOrWnZ#&XmVq%wi;GJN~@wgb4Zr$8fQcdFRzNu9s*g5$Q066W=a+A40?Wav;R}8N_
zCnD6oV}sqtofVd1cU#WI87k$m)OkmEE4*7`uFQjH4R560aUpD;wEbguQ6p1UDLyAh
z#GQoetb80XKJ*?@sDCN{P}7^)ooh)s;5+K>UZzf~4V^^M?G?yw{|Q`5j)aJL`?Go#
zc=}_!&+oktL#aTS!=Yl2r~*`ZskZq@omRd(i6P3kqi%4dpb8;4K)c>qAb(=SFhn=U
z4^n$=j;ILu95O9}ho*{>li2F=J$pb@SzQ($DMv}Wa%M9#Sbx=oh|*A2*$J_sMGgEU
z3_4fpjn{MqQ0tPM=A|t|x5`0kff^WAmLLq3^Ko9k!az@XmGH6_-<m+`vxCKq@SG9R
z|Ecj`q5cE0Z4E$&?`5BVp4}ZdDdwL0d8o&mHizwCteEE-+;1OyTUV&$x2WXfd-tPi
zY)k1>xt+y|y?-4*Dr{KKLXG$Cqsou&{`Qlo&L_{TI)2<R#zh~0jE^7O|IH_#x@Wt>
zfyTEoCU0{Z{F<<D47p1M81L5BaQSNE?gFPhht>05_G^y&*V5HrYoiZkDYv#-ExXp2
zdMm_dpxsf#X|&pyImV`<U);8dq{96tkp_fN4ot+-#D8}D0lumxcRU{wrc}1??vSL^
zam5B@$s?mUbK#5@lS}#>`btqM0#!8F!qaPY>^;#cZp4B|Uhg63k)<LDfPnKDDSc-}
z;!*>tM~d%iu4wXEPxR1+ILdJ1n=_xt2ipUU%l43+b4FUaZ>mWy@=7O3u3>pND8P&y
zwSdGm^?y<I8fdJI8bG2X5v4kNmAlVV&<Niq7F&ASqFRLV(t%`hf`^OG0f|87^TjAi
z{kZX23o4N`quYj!^<eMt=*9Eh-gvm7>hMP0%{*_bzI5CT^Swa_9UQZsV-o=WQoL4&
z!<BPJe_;0qeX`xgoXitxJUEMBZgmQ}G;o}#1b=Va%6we6uZq)}d{o~aeW*p-CO|I>
zN{H-%kn4X(+yM@rcR>=4fUDJlZ=l3Ad2D33Kk=G^Tt=V#fV{rKAD4$GAed9{T8GGl
zr<Id_Gj%E*dzHfO{`<rrj8IwMz3QWqeqJIH;f59>bW#O{@+t|V0i$(aXCnWFeOODz
zF@JOLhxO=IzWwUki?A93tDihxxHB<Jqm|D14BxePM49n)A9ri%XshDUauJp9P%`K7
zRZFjoIQjO7T|=e~w-704l4FPaeh#<q^<UTMRo54d0$rT^_=nwRPXW3<*9}BKRL5SF
z!$uyjli*MmH<l2|kMH%zXE8_{s}y`&VSii<nyZ*!6~!cb`cyp+JXR_lM0=}U%1``K
zyNQdVY7C6@LEjBNZl0d!j8oqnOr~S|opmoV+k{>B$w0iw12$?cmS9ffNRzLLmL@9X
zj*MhHIMG-1VVf>Sqrv*lp$z-xS~OQeq@A%9^_q|{*uQa+!z8HV`tq*NHlzLC$$w<;
zildu&qGO|CpV~HUwGK6(f(~6aF)5)Y&I<E%&U`4|ExAs2G`9#`==>3si^dVt%hs6_
zU$1>lt<Y9<U5dJps_B7aB%U81Ioe;kp%1cdrVevm3vr2?RwVIL(|-5~=S!avNnO+@
zuhk19YG<q)VDR|q?#m~8+9nvCZhv((u^eg&i=h}G6iBo;&Hkb;WRD5{iH@cL7O(5+
zdW64@o*cch4%dp=>-mEkuj*~>VNauv{L?P3?d}|$I|wi7q%MVR55>=4)k|_ZQQIQy
zGNG5~e?=LAq!61ZAJm*yOkD}!b$8=@qGnm*AwB<DKop|TC1^soUb+#9x_=Tj+)3m~
zEg^`inXz~mUQ%6Jxl<^arBnP-ICgfKgtPXcEf*&x$dBFA>#poWRIPZ7wJMcu8x}Wh
z!VZHiPc&LL>X<xP5m-sWM5OOH_LIop_xcg`x0Xge$=O9dDgT1(*o~;<2v>02(Or5a
zL3G&2k<-82p2jysEqk`7*?+|vD)PmssMp>q_xf7KZORw`6kF9?qH_ToR&*!blS!(i
z3wk7%f%?$h#3c4IB&M+&DAv3dKTO5xkE=4D6~zuI&|m-Uzy9^#{?+||rsvB&`Cqdv
z`|H2`n?9HGmKw7^%*LhYJ<_upSEo{etM32!@BhbtU#if*$k>{F=6{Z8S4s4`BD4Ie
zn@^|f-uj@9)$jdkt$FW5L07+K7T_+y>TfEbVcfg|Zd0zjpr6vM$}T3iEGGHoZd3TI
zzRYLS+msv@lj>IG7H6-9r?)A2ajW_+X8H8;&!gKEMHu~U%8l##b`>%+-E9iWgwN~S
zl$~DQYQ96df!mcvj(=L@MZHyN;?6&~P0`t+o;S+<+p2Q)q`EpE<*$l}5+s*zLPLa!
zSS}hDlcIqmiAwuB_Ex25^WLyGZxAw+PQ#@Rk0qfV*|mr))N<eU#L@|K+qyycqE=|R
zTODDE;bpK~Z&a0Bx$eGx)w|BeSk!-u-^fEr3|Nf|!{?|Km46S+iC3;HBoBpzwu@C3
z4ClsoSiX=gi5HQWed`FBV|<+*EvBL$u=(1EKPP;Fqn)@+DS-vtt$nq1v+7ZP3dJPh
z4hWU(CfeP|l1L?on}uU-{<N69(jaf8)(WEsZcO;HVb1Kvzs<)z_5*5<kFu|ij}L;(
z@9%$0%Gz-vk$;clA$*}^MT0`{I(t@4E~+PwqVYj+__nMUIYjdU0pN)s<v1ue^U)9U
zO%Q1vQP|yCK_#>$(UWVQ2qG!7<UY@)jHKo4k=%7`QLOQo`<xzF(A@<nvMCvDX^>1q
zF9XmOlXnhF#~Nz~2z2Y}|BQT)cfeqif`aF!ZK`f5Rev@>FSxygpDiaeoh$cdX#j;Y
z2u6m}>!vg%5`*KMbqE9Hxj7NT856OPr{OMBH-ku&%X~y~_N1s^&8w+nnrND>&+_y0
z%HS9{Y4B>8PCId0MCf~DreCM)NSA_Y;s_UT-D!_BHJT(G!Ks|l42jrNslzXlC0iwq
z@BSp)+JB1rjMz-FW|9`}Y})V3+x~$x-tTV>LKY=aC|dY*JMO-d&(Y0+N%}k4=bYZY
z<}P(*X4j^+6=7%wF40R+lKrSB&H<DZB-@n09?ML`mQhJ5h@;qR3`}R=jV(z=Ift|G
zBp)f{cSwVyBjAAuCnW23Csh{{Ixr_B^5Wq36n|-hNq~Lprc~HgkshF*Kf8XR6LLZM
z6}Cef1+@83@3_b3$ipOBo+VXQtdeSAiT+%AFH>;Av=tpypOV{=y%8f7d#iPX0$D;!
z=l+vDx1TM2W6jGVl0<?gEirXE$;9#LGwQ`aq{r?GK;^HbeV)e{bUamc;KUZikkn>W
zA%Bca{e*-#>3QZfVo0(;s^eq$9y3ylWa$Q~9gED{LF=cERp;dolDqCotvBx820ajC
zq$oy|tc7)?5S}8{;|7xWa?K}8l_yJ>t}UdY74cLQ%uk<n&u69ERe&*x;h`EkB!!N0
zQ#M_kx~odOurfi0r^H=eP(P!(C(3RlM}H@SwVLYDXk0TJd#cr4S*E>1EH5GKC-yXa
zh$rqr&&k}|(9pS^X{ip9A#}_n4PwhnBualr|1F%iUUmTYOqp6GeukZUUg}Z`Ts)7b
zrNs5qrm{8&hxmv<sV!w;<Mrqixj3MW^Vus&l5mYXL%kaY)Ykx0z)i6uLmdgHy?<dw
zSJ>HtsE^uinCZ8D3;lrPUsO}OSi1CFR<G4~Li|7sl&*AdS^X}svu?8md_h(8<Alr_
zORH%%CG8dU3Y-7S{oaG@*(0QUAvmM%(9^}}mFy8-sI%;F_p5ALP77=Z#au%<uqq*;
z97ArH{>`UBQ`HAfDs(rmie$%JQGW?^E;H1@^$BK70?(zOs<&KCk;bkQXGh-2HULW2
z+*q!Yk}U462S+FZy#Uj6sj|CVcV5-K4NdC6(flTxjusc?#AAUPsOO0l2#ci?@Eh7-
z^g9rSRQ>J#{X@`#CpWfL*_GK6*Q1a&kzUf7I7|x5Go%}Hl+q2Vbe=9b^ndE)DN6uX
z&Be6qE(h}2a`Ok<kT=yvCsJ5T&4j*cnA_ga;XbIhW3vY{n?{=Sl8H27mn8#M&dmx1
z=YNRBo@|4!+z(q&FGN^YB2x%5W9u*V`(8}KGt0a;5IaNUUo2N>U5x+@G0HFGmZ%q}
zrrGkh5U0JGUU#QC)7^#3gMX&FY!`vdOs(Meip)Aw*qGj*3EbD*Ah11=1oAEmba3uS
zMLNsHDeY8#g29ChR`0ykh1ESL!fj|ph-dF-e$(4GC`v1Dh6_|eZ<uAA7N(l9%()PE
z#ZLwEwtBj7eTcsR{3-rk%4*oN)oiUIDgPQt%EL}biYLZ;Q%!HazkjN^lbv{X@U`FG
z@B1>uMpJ~fq#CiPb+hLcU8QrO+t2}7&e&lw9aYS(t<%>L{z!)9fgUg2WloQF!+Q+i
zbRaM}J-I!v9~48v5AsqefYuyrKRjdCZXth&m{z$d)Eb&5FqPUP!Wo<G<f+??yhXZQ
zrs`ozK%56}d-d0W8-G`N9Uv|Zd--bnbKE>#zbCup@C&^89eofU%3J>Zg;Fx#U+JJy
zar7f~Ft<w$LuxvkCon%DYIDOv**pY7*S*{b0d5<M*$DA$KkK+QqWCQJThYu(LKW6!
zPr8k5K5{kCNL++FN`3+m?qcpHGPXIYX?`J|+@*x&TWY{oYkwDNKv-NH&FPB7<SxGz
z{ugfC*w+I4hY04TAvyI3FeCCjnDv%?BjA4eVp=pTIjC#NxV|j=ayDja)Ltu{7(kvA
z*&!Z^j1`Ux{8i1>hW%H<Yf1*+Y;=qw4~e+X-d6(Ns*KVK_?hb{gN)A__VQ}$<79@Z
zYD1`y;wr>>a(}7up_7r#W2*R3(A7dEP3Y)4rWr9Mm|?GnyV$e>rXGW4t@Vi$T7cP2
z4{rU$3M6wCW+m1hs;@<TIS6h@$8O3nKfiLz#mq4B1@^>ofvB7L?D~B?k{q!f!3imN
z=ijQKljL`{`Qmu*X*+NPnBuv;l?>h`-NNyrt4j6i6o1=9^POf?n=sl)T=mT1DJRK8
zKE;Fmx}zy3nIl3Z+m31>af}0R!<en9cX0rECz2xh4pV<!FC5nn{46(QRESsQnbt@Y
za4-pFBvZR;nWrRR3>pR<(emo-f*GdWsdMsZEi#H~;3%KlWpr9x=C4cSqoqhv&SGq@
zT1Vt&#DCk!dny&oVmyDAd+koI6QXjg3WLx%7z9Zj7E@$?pUhQ9rOu9o5RlY)npGZi
z0D*dz<02r-D~dl{`qiS&G;=SxPEM9&R2~Z?s;kQT-nq>@(ZH=E{Am$?{(PUpWKm1=
ztO}rX+D}o~s?;cRivD8%(ffwwd)XfHu%RIf@qej<pR_G$_*&2$nNUVu`vs`WJsD4p
zz|7skpF;m>F=yNe==?t~9F-~OG~X!%`z3>n@_J!G8u98%zGn@lv)(*Dc<GoJMxsU8
zx)<ZAs6m+gT2|r={;|@Dr)~qvGQy=@GSG=nGJ8;+oh@czZmdZ;H$K6E3Y|kYKeVba
zTYs&e9N9slBa=q=({p6YXTWPr$*Q$8>Mz~5%)c}ew8-SB^-}r~PWRE1Z=@4A-HJs*
z%@!T%rB9EgN~m~u+y)FeDb!{{SL(VGU}rngnXj9N-u2P8HApf{ZIX6U6LjVoJYb<a
zyj+}0kJ6zy(S-roo?@ygf%h7GO!c&of`7>N8Wre>#A23^u`F1{*8%&DM*?@#n@$&`
z##48Q9CvVDo*}FT{Sph+)n(;&LCp-^+H=4WU0lqH3o~e`D~r&%h`Nd5RX&1q3|7+#
zmDsc*Tv7WWj;1;c35l;Jr8o@h`EkR(u2EM$6?#qrO<#VDMtbTx$l7s~(8b|!hJQU(
z*7c$=I_gfQ>xj}s+0#CKz1&N@js7Vw7<zdkf210#Kk=E~V{-XOu@!fayRP-<5B<$2
z&5EzTAE+Lq(}moL;}S09o-DqYl@}$w9sSino7c-zz;`1Y*WDU&(Y&&=UYi@bRnw7q
z{0m|gVR&*JS!p3FrxmhKJLc<^?tgC8%NGo(VrFECW%o&Iy@@S!dK&U%%cRFE8B?*2
zvPR`!I3K#7o%ja5-Q=vaBc|&WP1>v&m6pLg+pTTlP0;41Um^vBljbz(Mqen>wkIaC
zamjW0<lGWmYH^p2mA6fys<L54<>95obY*nCM@icY3f$a@f(&>^*sW3oo_|?C;nq97
zHWIj6<Qfd&Uq0*V_1L>M>q{m_RtVh5a;dP1FI+o|(;F0A+wjub2K2$U8TPkDxF$c>
z)t%gxlhBstMJ0<da<!q&>ron{t3Z}X;T=J680W}ylANS%Er88g3$TtVPeeZKW*hfD
z`Q+12cKB}*>;yGEl=$euy?@_`l*d`P5;29bQ!>Z3ql8e&kzHd&-dxiliFPUY(x_WE
zg{72Dv^knL)$fwYG6lZyK*<~Xx;<*!Vf6-kvH?za8?hN1fKV1ON`yOps9VJy6w#Lo
z9=#kO;(T#9j<eSALL+N}1LY%|b;rA(Qensj6*8Aa&G{|cQI)*5Zhz5BRQ<c1rAvsZ
zk~~lP{hoe+fL|%ow>l8^s~McU0IFZT+!qU#|B3L#7y+GT?&ePS=16cOuM6MDL<4CZ
zrfiBTWmgS)g2!P8(>teBGcR^)1_xc&j;7JpHZ-MYU085ueikq%!Z?HhcU;B1ywJ%1
zv0ay*L_wK6kF&n4W`72KzgX!Cf^N<Gt*Fv7Jb9^uk5}s0v98cdM=LegN3v4B<d-A2
z-RLb6l|A<l8>J~W#FgTAKPsuzmKhG9jgA9yWExdJg%aBm?IXsxM!CeM63tI1bx2}r
zGt?E*IV~-dqs7vY2ByxTP=~m9dL7>r$0?zv)_oQ)Vbt5kn15(D9sH>}?U%!W@WT5~
z%$n&Q<L#`f=6(0~(tEsMU^qQ@pc@@ba{>ylDlM-X<*6Tr>&dG2>5`%nfa!(kf9gI|
zbu?r>{m#U`D3^ICcbV5H_jU0D3^l%-Tq?jzkYfh<kU`--`zkH{BSH))BVsytKa)}k
zhvW4fVK^j;+J9V#hS0KZBd!>?yg`{!KDk)9t4fR5&*fpdMb|Qp_gWO#1aWOPYgp)4
zZsWMJ|K!$zZh!Fk(P@H(2SxE;D5d<vyreP$f0{d!7WHL_tc;$B51KXewb}x)>{rx9
z@U=$84ot02+fs3QSyiv_=d1kuRgOPECh_0;&-HQ}7=N+G(kb03aYN8@Ez_eeble()
z^X+0Z-#(j-`z171lDo&+N3|NN&_BI)HNUKdL@DDZsh}ins~^zjV6mOMQ%KWTG?c&o
z>;J25aRNd1)<6qLyAo&NXr$gDI4=@Cffa)1s|tIrrvp(s5ah)u2-OWvT&pins~p0!
zJ0VB(iGSMu+R2XBi09r$TDM_!Azdf-RYt>q(3G5pU_{ed&2&5aqhR(rU;ru~m=N<P
zk7DvI1T><vLgV5~*6|mrWHAZebsq8a5Io)8=L=9t?IE8!vEp~?flJbwEQ>uBC$Cpy
z0>zF^uH2m(w=M1%&M>iTO^2+xgr~UxN<g*0T#`vs%(;Jj1$6@QnV5{j`1!rbYc!Yr
z1m7|5@UaRpC5oIsKHPo0cd&b?q2}K`cr168nLjPjJTrpsWP`hRyFbb$Ru12Ef5aZ)
zUw0KpWq^6?v)2Cp6IAJlUzeykDhrb2Y$CrK5M#W`7jyUW<^Gd)RL#-B?(-G3P)YUH
zO7tLv1rUE!4zZsd&=b3pJ#u@wgUksXH))fqlYQm>7eaqJL?!8Dk3Ym;r%rTyzUVM_
zrbucBUmtJ}^)ihiPi|rUxN--jG0kpO+}0*4k~q*32ukew@X}mfUkj^oOu|UUZ?Rj+
zp}_F*vbSbWJF#3~05*lee_V~niwV@kdlJeko_T*YSY7U=kXFY{T#y1RV;bQn#9ySG
z$atEPf1zE;CHwCzBzzvh=S|Rwgri&f)VzB!EYqFl*@+VDwPvf2`dT819D)xFFg)qe
z92j}tsVCU>1GXvbLep920llt{54TyStA}yBt*4`tc&|)6(u%-w=u8O-%jc$VJ=Xn-
z1?zt_&9Ab=Zdzb7A)Cv1b9K>{{2q%_rPduuu>qzYa~C#-O!=K!+fc`mtIKK>E3N^o
z0w)rXE?W)npNV|0^Q!BGCvRu7ZKc{i3jT0n#8TF>nr9yP++7alkmzxElFjMnCPJwo
zOHZZJ$sW{y(^={Er0&u0H@DqyeAN!{Gh}~8Z4V|Z>0L1zsm7F6V}4K4<GG4_f4}*m
zR{{9-@0OD;j(|8Lc#6#?#A)8I94FuCyIJv9lLk@J;l}htLg)ihk42ZyVsbhY)2rya
z!qT2yI-#`(%j$V?WlC!CoSutjx$vlc@o~_e8F;$ao(mr8D&dghJG~~S(@_?8W_N#h
zM|EW;RKxz}PVodf;(@EJ4?xqtoRNXdG$1>&6VgO+oL&_Uc)yRc*++rY=R%Zcbh?tj
zpyljfQ|7eQ&2IZe=2M+MdJ^*N#8lX5F`RKeg6LT^H<sRv@PZQH#~r`1BugBl0+2C;
z^{>6G{J}JVDBF&tAGqtjLVqU-=LLUOjJa3Kxoiv#OH?BLEGQt={FZ8XO~H{W2ECn}
zmTGtTl!d`aN*ziWR7+%ZnksMH8u4dKI>+(UV22vAyj#HXbvcC1Scsgrz9cffo(s3R
z+-YbvO@EY@u;e(KyhT9T#AmaVd_GrjN5isvNG+~?wE%Z;386C5ndg(rt-F6f7OH;;
zb!&@h$0X%RQAoN+fl*2GXxWUpaX_o}&rhkTaa}xRjBYg}_@WxJPy*f%i@F!<S%(C*
zS<<wI(rdM?$Y8euAkk>|&C1k?I0(%xK*1U_eVdBK{{wWbO^wd1m{y6hHS{)7xZ?44
z^e)o1HdU#=z5Cm{{GsSQ;Z1)ps-defWN3D0+sTK~yXa5MiKY;t8)Br>?OGKW*u$Hv
z*bv?BiUl34?vgC#PMDdCQFWS+(7dDF`Lu{q+}!&ZaQ_APd&w)CzG~?QQah)k3(D1(
zyieXBHq@(8_dN$HdF<m)@v(%=AUo6@)ti3$>8HQF^Summ-yPbSy6t~JVHNGah=9p{
z#{m@DB6?}B!!mWR9YXgzI%3R$EQ)eflM+5jOcaRlmx%3Zr6yReNYStdG&^fZjH5lT
z246lR>Q1-Pw=8N;&)Uxa5KDsnz`CqE3)0r|Igsbu_PnwGvlGAZfvvRqi;eF?diBP3
zUv712tNWSDf~OWXn<;+=g!FcF>iUcV{~n~nJd<UVrl+)wJhX-bnEs@ikEY+JX*epr
zI7OU{y^)<DU!+a<?Nx_txo#c#PJe7iFIIJ7>ASSOaAxq<+u3&%=UW&Zt5@f%C+AtZ
z8uw+#Cj)tn<Qc+E`ouMAZQjZ5_V|A|%byC!d3DkJ_Q~F(mtTLiTG6ujT`lXdqhy2g
zWFPBFWJqLVbJ+5k1lUD+r@x{y>BLKg=AGcjA62{43ONekPqGsy;>dsKTUYMg#Xr$3
z^;g!~=+I7*5+%N-bP1IW7e6z1iAKfzwIu&c!1}<qpij|2(uS;jKQs?jDbiAz3_BLL
zLA=jeVT-v}*yexIJ2NHw&R)!>XQAVv+Z(nCKt(oMt>|>LF!Anq>|ptAr!K9KKN`^)
z^t0F80L@8U(GL)?4S%mBMvlmUHGvG18nOJv(cpuZjawVaY13>Ot0dLgDbh)5rIAu{
zkHbyOsn#-FSza7JJz&obX^ode>TMFM9>^rpXls&(cS(QBNAYEd;1pCI^Q7ML+fy)V
z&1~zPw#>X*PSl}^ytiec&%VgK3D=b+_M|qbY`=AmE-#h)gxb(_G#(KVs)t~U_C`}v
z>RHu-l<Jw)lZZ7QY-^!`|9llV&%ICk#zgmREGasVR@n9y@lWsGy(gkx)SOo-Nix-3
zJypnVN8W!R=1(TcCuo0%8YG@7c&G+7MVJIJ3n`}~QC{YZ(`tP=DyLHuw9O9gg<r%r
z<kyO@1qX~m!~~T)u@%sTVrCv>UNTg?VR$k1;yoKA9B7_pk7Pela|&?MV0;kuv;QAd
zyWVq_HY4Vz=+i+DdfvzQqks|{TWD2zK^AzIFMxlq_AcfB0$AFjue0<XU%q=6ebKM-
z#RaC2rnQwtRS(m@)hDvxJ+&actuI=70so^SsaoEwsokp*SB?0FUWM=MmZGK~@R=90
ze0<xFC1cL5TRmOW*S8-V_s-hx>8G$5=C!D6(prY6y=hgAdg7iJH@iIhR<<0DZduat
zBsYH-ye#t3{L+>0tMA)wi!Uac)8VbX)^7x|JDJz1o0Ed5_|FpY=v`I2;vq3on}cF&
zkxlTdiRgc~w&E+OT)Lv*SY$@LoH^j-Ygc$UtERM4iUu_3NF^=r%<%;9RY#0J@KLi(
zb8eSASZQH<N1VmMAOVzOSe)mJ5h8jQ-f(~D?t-)I;_%?Hfzao0Zm;JlwZBsfRc1kd
zw`^*p%t#<3vH?Ag+Tza(rg57Sa=JK&PcPea6D=mDTQtUkH#YXEPZ$mh>7N(n>wKg@
z`Z~*Mx!e1fgBOR#dxw2g+&?&cas1-(i>D8hKEhQBaJPf>sYH_U;<Q951mClJa9Dp8
zwV0&D`%&g-GqJmYRrHXFX+VT=>H><ZUUJFE>-GxQ*yF;9@Z?jzn&s!N=2q*3&mx_d
zyr9xcaC`AyV>E7Zi8Yg0Y<$sHphG!(wJKmjC!{0VM=?iA8tT}sGj7%VeswJDRqYm7
zoWtPSeGWHhtY_^6exH9rdmB5!=j4C9X2oSe3Xu`l#2jvJ2+EMy@ms`XBp#@453lo5
z#OEB2Y^8skUQ!qP2F2t`&rq0Lp$8u>>3il20_iYa6(Z<pvr=bcRP?lZRR)@tXr09)
zJ}9{JD2ROB#053hTO5OvaryT1#MCQ5AFhIMO3+>C!6f3^jJ=}Ewhb6nw(Wnql#H+=
zU;~H-p(;>dq;7IpO%tcUE1qP`9EiR8oXz-s;~RwP{Z>^+x~9KXV2<VGHR3YmV8@MB
z3s)Zc*hG9ro1~s2H>jo<?0r4ms|WY)-rYuNsW5cS4d3xmv%;$oP)I1(n)>9OR}`+V
zD^|t*9kpwr!{09{p8ocl{p^2!pXd=}@1$Gqs<^XSD{O;TujP62(riKThHc1}wngds
zpJ>5@yEh|C+(E|Yat%ZlD7{P|J}>t>)}7Mpqz|i^*jUvduL~*;w3u7I95K;AAM>@7
zJ-APWn4A2*YWt9=r`2L#`i_ziorF3kx@O4=8DrhAM-{g>H;1@-Oc#Ii{^_-oA?4-0
z-re6k_{~T6KE3}@@$0+4HRT)Q(^$fvua%X)OU0shI=$|f!!_M(dD>TTJ`zF@lY$k*
zph*rA%~d#D8?Bc33(AZ`{m3A{NTc`h82UVSpPXqo^amG}x=wyDE9L^X<i>j0YMEA2
zZIw0v<he7ACp5H(x$1ulcwkU!N*F9VX{j$q3wF^5=(idQT(}18WZSRvnes!v-R-M<
zWT_|J-P$LvWw0?UW}|hQP|ZQR%`f~!!sOF;VxhaV^I6b|3a#niwo~SG9hK*!M0>m=
z(cOG>C5E+?)!GPIdTl8Q-fXpS?q-PJLrIk#bn;g&+7cyGf-8U6t+m(}x<34to#;wq
zM()gD-4}<6{-sH`t~&UMTF#4vAHxmWYRPpi=!+M@r2RLrw8GH@MwWcddNww6;5J;W
zhF$*yx!9-3my(S+CI*Ol&cm>>z1^~$XD7(aa)U5|J7`->d)sZXVTND~xq8gOzr><5
z9@bXHoV4N#h%$eV&~Op(T#vveWTys`BcZ^di)xZhvdpY%L1Ob|8Y_(t7PlNPiX)9?
zQ4Fb7<g~22l91UoTtnxMD^|v0?M38<K(aU%DmY_$DP>PY&kLiKXTJFA)oboOPw4o=
zeIV0F`si1?e=hVkyVsJl+y_ip`GY&s^Re&>u$lv*PfdT{LYgD{Irj8UcK`1EyWP7V
zckg}NiW;5Q!&A9LP63?N*T*55s1#=XJK5`d4|Ht9;)g&Jq(6MvZ}~*^C9-bc|LD>a
zx2S)ie!cRDF991^7}mBV`E9kB3bc;CCil_zn}681n^~#wDk>5foK`Dlc5t8@0ivk{
z@5uWcXY+qnL}rpAxR-AwI>t67Agg4XRvqc6<F`E6k!wd;$<cOKzYihZ#w7qkv<)pp
zRDI)sU`B87>cBsLn`g(J(9t_<y*W~Uj_gi|E5kK?C;PrxDKEU+*C*@{cuUl^Y8QEJ
zj4k}nynmMVi-qv6*fX6abJp6+YsFTwmf!b+&<B6Fydy*qz!B9D4Ab;z_vNm#+dY(X
zwJv6$<zs4{ydh4^MSgOIk=POPr8VT5sCD!8xbgJGF{s5-1Zt{#_`5}-uG0~Cy{W}m
zQeEWVOK@l$rs~6ROwTA?zo<26wWc+h=D|3Q6xH4sMQXEdVWi>r-!qQ%!QH!e2eL+@
zIdy+L^zI6uE&3>G0OE37;B7+>e{o`?lBO^*q!sF-5$5GXPHF2);Q*PwR#aSW?A+sx
zO?XpSE045p1AhB*Kj{lvLQim4_6Y?Mbwh0+?1`rrQD@eli<`O>3Hgmm*tg>wj}*<#
z6!Bn_7Y}ihmV#r5xR~_k$PKx=fZCRBeA$0LT`&Rgjb&&)ytzod7_Tl+!`nqV87)cV
zg`xDZ;f7&AP>&ee=41sTrf}OH{qs|$TSqW;Ox_0vs@5+*WMV(mh)4%(%j9fnG;NDk
z7D*m}D@yG0T)Pt~60QPi#IX}?$(5;fbYeWE5WYv{=v3~zayIPZ_PY*|Moh<ZlskWJ
z(49{S&HH+BdNgIWWp?nNpY{MJhbAmSC%~Ht$d=;T2;|fP!3!a?K{{w+IZ>cG(8L=)
zFJdp-om{K;wgxbI*e~7hu8NL9Yg6Wc`dpHUS+$|Ir*33dC2(rB^W=vZGn9=Na~0)q
z+NgS#<j|FdIX3Ew11VJZt^INIYgT{z%+ZiT%DEXX$IHD6*++4QX~+B?@s}5|+TOBq
ziv(u#PHi)aU3X$`e`}+r9`rr#C9x=J=S*@ZNv6>Pfl086CZODU|7&V3#)bYf(41f6
z2RW<jzy9n0uIa4_IPCYsN!V;@)K%@DlgVKSm*HL-=Fo}m&6~gU;duzLC?|gd1-x^M
z#d-n;o(CHebfsMi{%1LsCjEqn1!sy8ZacT5j{ET1H{ax|YUbDk;qVw*A+i(3GR*;Q
zqnMe()xz#$n*jT`)p{iR=z4jREaNeNzw<uPnujZ{En9okc98v-sk`qH4T=dLPQdgk
zn~l4=Np^r#8Ay-sfqEE5d)a?Z1~0N)&Bd-iJD}8B%<*+~Mbqu2`1-<`&2eZ3#U7<j
zw@i@wC1I}0*<8Z3dP)uZ_dwvYJ3njnciMiQ?qi+;GpdJyu>8pTnz$>>HU5-I0Y{6m
zQki%vdcNWZ3Jx~ugoTz&rAS+=p!hb&H_^@!x3Zu@r63SEcm)EI##Mj#GME-YPPJ*U
zc6I36M`3fYzEOGhD%&8kZn2T}_q4dsUFU&973QlkDqL&I;wVcRtwjtY8j`Q980|L_
z8&`^x2cW1rkY3_LAquRsCHdjTU3gP}2v8|m&7px3{|<NV7+!>I>*r!Rv}jo~>@<5H
zZQA=cZ`yxEZ?MP7qk@0z7{DE(L?e5AOjJ5hJ1hJW*_B4}TTdajFQkU9I-`9kB&wTt
zQH}asJT|fwnbPG}T9vieL%U%DxPQiQZ4Ft6d2L2mL0Zb+hV|cY9TG3`&{A1lQdagq
z=?J+QF5ph~>{|YFBsb%u^5UPNJ8-AQGI+H${2NI;)LTd?iiCd+UxrLj$^+B_rQrk7
zO7n&d$4s1nvJ=0~2go?Hc8zFJsXt7VO>K_>e(oVvc@CwCt}$GsauV0fMlzzAXg>@#
z6gJ`+;6=rvUq{&6MZ|nHIW8rhV5XW3mjvh`phlVsjE@dh)EIvE*ct_z2&<<+@Cz?{
z0o>0}iC<K~xtxDnaCJC{c1)Bj^&d2q+VLIxRpqI7Kt{LtPSrX<9buK#8<ygGRGiN<
zcu$|^vtIU?L|9+_^<V!h@^aZXfBo1025tTvIZxtyOT6h~{t)}9aR+@#5XQw^V{m5U
zK%rsUMOqZFF4<QwonZ0;5EroZMLs2LgwP(`C7rOK0w90te*yqQ9!a39K6W+LS77|T
zFG~OMY6937%6}ej%`l<8*2|!QT3T3F($=8WdJfDalMw3k3iJHmJlvdQF7Lpv1s*#g
z<~`O=`6l7kAGRrWr#moavFC{v_HxqL8BDWvQF*xIx9%Ia6TYs-*a3}w_oYqb=XrKH
zE6yLTM;?FQKveC+jY%aDSQ}rUMqV_ZZ|7fh^#0%4dR|;@Z7G@M#&YdZF4)@Yr5o=#
zb_g0bc#R9cd7NNB&Swgjt@Ut}ZX{u&Vn@4EYKTOQEvqU&CYp0Q!5^Je(PC>69bh-3
zvMLQ;=dozTq$6A;p>Il;Jx8*N5~gWz%JYb2azlUG`(Zl54J$Q;gQ_`q0)|6!U_$pk
zX7^Yd)tSeRo87QFlo~)-l<MYH<W3a^qvCt*lhwNVzjin0omv8p1xw7hU%yKU59_G8
z3W6FY3<HK_a*VW5cv!o20m3c}lB}qsd`d_jV~|k)^-+G|=0ak6k%F_^&3<`L-agFS
z%hrGP)^1%R7*T<=Xe1XhgZDIEsxT@lfrxatn{m<G+HM`~J>7eJY<;F_LJH+N(w@C4
zeaFB1dhc-0I`YeVJ3GgF|8i`JP_+Nz*PPET76Mo=;38=s-FW>l6H9A8y2`I>5<Gf~
z8Ve(z`7xA}=>p*O#b~H&ds<lH8&@&5LD+vxy@<7a5V4sLz-IQYiqom&YX459>KIJj
zkvgzkkv1vxwASr(;?*W^VJO-pe2p7j92Q}tyA?~|&uHVAVHb(cMKm(Qm^aAwMfo7}
z8esQ{b8~$sXlPbxjL2AU0P;dwu`$bW=(sKaTG0%vYy%W><wbp4YWcH}us?X~y^wz|
zC_aSo8t5SgW=Az$j06^WAlLLjwyfbeM_VnZz#_K?F)(?bYo&1N;u#nQR#THQ46^~}
zkVg(t6Qex*APyPRlny$|V9g{5K~jaK1Gr*>E?{Gb#u9hujwc&ZR+Nj0GH5bK9-Gb3
zi%#bI(2*pm?Uphvn|91Q*)Q+=zaD?cU+vH2@E@oI>rcIYOnx<H%~A?ouAtBo(PAzf
z9DrOo(JB5YI>jF~PVpWA#}#iWWim2AXE8QLC_73zw)a{EK`g4ps@d+=9xkQ|MWw1%
z<L&(gkP)L3yocYFtUl=6&QdLjYfLjbOh>sgJ-JX$AYsF`9~L1~j6E$JLHmE-9Uqoo
z2U?Jaexm!azWTAQu~6Rt<ifS>#U-yqyu>(M70tAZYx^JbWGe?kRBAwA$~3#Xsuosd
zH@;S*z)g`Ij~1tpZghiK_qVpH$(I5F>8J)UhTI%oht65+epR(OBZ35$D`VV7x<Our
zeGuzEK9086$MN=hbnO)Y8@qo@-zVE`Lqbv)@o=tmatgKSO21^H#exwnf_8IWxl@=d
zecY{2qHcZC*!9mXi)_8-y1H4DZmFIcW{-~NdW0~knwiY{$Xo6^n$eT!|F}7jq|McR
z;`1^<wpvbVrJ9hwYC^W}_O(pkb^YuWA8&u$ca$uC&;UAO%FxJv-~@k81EyR9;^*2s
z8M+p;dwJ~xw=;Jgx6G_UdYt#Mcv*#gS79F&_EBM9D>O?Rj=O6x_vyhxN7xDAj>R3>
z+1Y{AnLRBo^0Vv2JmzDoMttWkg{v;}D4+pN0>-OqQe1^}SRoJA3Gx>CFOqa(5;!{K
zSQ0cj_VKU)p@C-nbuoXM<Al3jCSAMAN3Sf;uHe`CogouocWFT0LZ*diGAIs8u3x=K
zY-UImXVedh<>$rjg4b;@lxL5wiM=q(2~<D4cGp~a#*Z|AaH1dtkLg=x^;V@<vvKP3
z*Oeov;=hyBAPN%73K9t*-IrlyXN!7Xjp-c1U@hp+Fpv}h8b*Ju@(dc7(Y0X-qj)vD
z$S37rVr3uPYLJyKYGYcB;QT3F@##~-MnZ6z>(<E(pi=24&EsMdK@(Cj*=90%F6%Z2
zSI)1yu9_~rx7r?EaxqoA`y9^UB{SY?5Raf+&3(49u*#h0PIS|R9t-_ZbI!~CI8RNq
z)CLLdZt4*c0l9z10V^0&1R)OzanG<*LpnK;j36wP^%x{E`0ChJyCWNo76X_Gz%6qg
z#ZK;r5o3N?!q^jzt*gO$#W3hFqwcSY%)kGeJ|m&}6?{OWn0)?jd+@BU%DJP?o$P4j
zq!(s=`KqemVDp_%N*Ku9w{H0=zcixh&MjjVPOF_$HxGaQsLIU_4a^lnMdZS=)us4F
z*NMA#ckbTJPP_`+G5XCV7I@!7Z;Oq|s-qI~#i?vJw)4B!4}Uwm_nZFiql1tB<<+m|
z5AW7(Y39LivXe({v=_{wg-l%&a|{vgc-QM4jx__}yR~%xo-}oT=k7<@$rI%<SeF39
zPUi1g<)?oStjdpE@4*a<kT#vZYfbk)`b{l&|G}&voFp@2GA*2wrB<FTYQ92>*pueE
zsO91vcA=*a?l!&OV?G@_yt2rZW(N07MH;H8{WCH0G|Z|A@j({IiA2KTz(&+8Xd7+c
z%5X#o6Z&RAkCqiz_4IQ4D_Xp}C^<?w5Zv#cO}&3Al=>jI?<CpNF-<mg$KbpD=TDyP
zKYcpzf^-Lu4_-ccy8n2f3NK9;epN-I(ctOJ85xE+@jQvo;NWoo+x@3|U+p~^u%MEZ
zHKhUedbt1i7^O*%z2d>Aw`u@zab9*L$=2@E-NXI8BO;mnZ*httMh)wf#yw)Il3;58
z*}i{kwZFa&xOc$$Pgxsu?xMm)QJXKLtRjR9xw09BJ%i&?@w!-P*^9~b3Ns&8*xlfl
z0$?^#8ozvnTktK_#XG?qH(5c;WaYeh&YeCn4WDVIRs9T2FX^*AB)uh#-r7n?qdO?m
z#oSGuzwUU-usb&rBU@)fO)`VPc=D(YdPsk*s8BXrTYEoDnHEX9PFD+8J3I{GjcFI2
zcwYA4iwxmIgB38pD|!c^L|9vW+^4ET9m_uI*<p8=ws4`Q1ERuo1P#j>K>vSD0~`8`
zML^hYY-0=j`PrGk)ZyS1K8D{EK!&dy@_1>oDO-NsT49q!I|$mjd=hd<zP2@v6ik2d
z_Ho4I+Oj;$9tufw#eO-=%0^brcx&C?$)fvfwse05y}6u9$FDdsuM@mlwzgK>f5a$C
zk4dwll$G{ubeLtF$sRXzviH}u2lX{nzZ<@W-o}dEv*Kgyo>Tw0Z*w4iD{lYX$L7Vx
z&ZFL`2EG#gU~_PefV!qt1?K)zJ@<d{?xUxB{pY*S_OdSzUp&k9pMUw{@Y(M1{)^}R
zqsL$GJ=^WE$dM|!rM$e!9%grha^Lw(D{sXqO9dlp?OMp|x14MhJV<hIB6&y}?hbNP
zg3{Dp3wp5X!_}6srokT1WQ1*{e%M=Eo+D*PB&!+^Pcf8XIN@h9kM2{70?2<WAF;D_
zFN=9<B3&D!D{6f@+0wx5bFxnW$ux0Wa8Bpm<chF!J6(vA5|S1DO*`wp?yQe{k>O}-
z%Y6n)C~7CPYqUj=B9dVuFfL3tZi!E#0|KTCi;^s=80>ZN=3z6eIY)~*l+6r+rdnE-
z$iuSGbdx>H1pqsg9?*SRlURRH^*S((bzbY`9?r#|7z=!Q(ZAc1k@Uv-bhDp5{36@@
z(NY}rd*Q%z#63EFn7wJY{aNrN?ZHlFe6m=}&V)}^gR<RnhcJ9e<H>YED!f$gH2FTI
zShD-g_|YI#YisA-skhMv@^fUO*V!<oUdLPl)S1f_X27}_CN^SgMWBCl8@^8JPUMc$
z+gSYJ8gxq~ww;tpb-UT`WH@4p+kB1afPB_=w8v~``Rt;_2wyRn$U)_bZ2r!##r-B(
zN@jy}e#4l+4J8@xL!)}j1aL)5VMI%9tvD^lVMAWv1=;&QBe9C62}Ek<ek%TZV499E
zqg=eIOLnq0yiE*@NC|%gnWW%Hyz+SX<N47}=4DRTQ9YGcP;)UgSdrQ3Q;m8dUMNwb
z>F5|Dn79~r#lI?O;`BU5#PvYZ79|9>b{#*vv|01~m}WT2#_lljz#5><603-aEO@43
zeWtVWbvY_v=VmRNNJG?##i({l!i}uxWjQc0W#H$G>-H_myB2@GK4iUEE>|OJ(WQET
z0PG8@zMFTp>mMJ>h$ou1CK*ac5Fx`z^md^}Z)q&4q^IuOj$Fb72=q=Yp9p3cQBwe0
zGqNLvkFw!eBheUrmT-LkKFaX9eCTWVkEX>IkA^rt6(>NW6MZP5URQQzV+}NnIP!k?
zU_aKcI0`ebx7mN8k7z0I-}faK`SrHCVkFj{-HWegrQ6N*QmgLK6O-`k`C?dBG^PhH
zEGjIarG4NpSkt8L5HP=n`{cDGO&Lo4oz{u8$gTtIyd3uVwVy^gUMG#V<Dtf5jQjxu
z+^Ahjefd`WOGPix9OW6pgKI}4>UqdX%X=6>1snmW9ISuu%=|icw=dSPmCt65GjWGr
z!pdvOe*rEE-S?aCRdMaJJVYh&Q_@}7+m@ZFBaK8u=EZ949aG&=5PP^OC(af#`m-?p
zA-4cWjPVvz945f~{?gOe)O3axh$?^frI3(fw+Gc`;uT2(Fem7<fMaA-kO<xCrys1d
zL!RL#1<rqCXA?nJ70fYDDgZObJ#ges-5I^bjr;(}EFnJ}-o4+-!Rh)r>(=^dJL_h)
zTwiMzZneWno;fWiZe7x>#-h?&M>33%+v`O>Ce!O}aropl>;@^=0f;)daF>(#PKw4W
zu0n3I>J{QinQ<dKhYh%yN|(gQXs}$#o05~B)VP1$@?oa=h{pnb4^At3-*>z(of#<x
zqPQ4zS_7{|9e@lD5HUZXr=1jWmv>kE9H8j<r=u6oCC-O>4wmy3uxJ#V5s9c+?TMmb
z`20D3jcB)!4_Y*^*dc^A7)_v4tQ`q^NR!E+<FN+7Q7v;`%shs&R3q6C#Jt=QGq>+<
zueE=N?|s%u@nQ>!oa|N)?grxHdRf7%h`JVSFmLIgxChAnd&Lh2sxpf2xD=PmW?oLc
z&k}$g{Yi<YPCsC-9Q8D^_!%&Rvlw&)%iQw(n$3DN*HX9Moa*k9WOB*Ps;CYwxE5_A
z9%9Th)vc!N=S;))W6cqsnYWLz5#s_;jcI=rP_lOOu-T(Tr1I1e`eJmh`6e4vA$tFo
zcNG(SgAin0iPd#Rs4%fY%jEFDq=r~m5Nfnx$U8D{-}O|;rofHgB+>)(Op$~+f3S#U
zx*{8nVz4dVRFRI=XpwjcAQD|E<h~$M%c?|VQWAhg?=W(#Ov~uyJf8@v18gdC!@Pg~
zRCqSvNg@729)GCyNHuWM#I8ivAwCgG*s&YUu?zzV>-x5I@(?j5;M*q8ULcuC_<2wg
zyqUvp>9ZrIdLNKC@ev&K#Xay5f+~T>Nq}i^_EuG$wy%J4U_CaQ5H94F=F9+4Mzxqy
z=AV&u9*KSzCrbz~FRLG>q{*`)8fJe4y2|e9iExYZH8@y}ZKJc03GS=-L&-OnGgOdY
z1oCnj*RvwuO?^F?=RX8D$${;LBP@)nev;#6IbHJMP}~FO^$)Edog}c)T(gax>_>u-
zY?Q+dgBr@RH?23~>Gw4a-i7p$jU!c;)S`Ryu#ns}?=}+_6R6$R^fz!?#q@u>j?*`_
z#oGW}T$nCLXWRoLd-7pO(ZxzvOrqZjKied7le;-Pk@=(2qa%Mi2Fd<()9U{CzB!+(
z2H}W2W;$0bzSO8=GG|}$E}K{rs9u*LIch)SFtx_8QQ+X~hiwDrkMDKNbnc9c$RuP$
z#=+JKpf)iv_!&Db6*e~ay}N&%XsLFx-+X*GS}))O-Ho^Y(*i5uV}XRZ(j;Xd3J5^k
z;R8zHa^GC5hkjiG?$+?r#PBOHO!d4ZpE)@KS%xwIca)?+Re8i+AUQHyjLzt*EJB0N
zm=4AW$_G18%Bf9|rA#FPI}b}js-hE=!Z{6<^$N%&<XK~#j|Jw;V+DVe_Fxt?+1=z$
zcGn`%^u}UmMQXZgq*>{FCU&0ZmIZE0fUa^=DtblyZlYKBo8V5}+K|dNAj0{atdQ@L
zq}{kwMg@f<6$DO9<oJH`L%XTloPm_z=N^5^;C0yPABl1Yy%BZh_7l_9lWIvcgH9J*
ztaX2POuiPJ%36Fl<BNaA%W`Pu&~2Z;aOqC3y~)l!w@b|Zd8F6Yrt&RA$nvgq4wR5d
z&D4#va4AOhw1YzCI2836_>8F<BJ8Sm>!%kadG$z|BT>?1kRg^NN|c_)UPn#YqL@_H
zIx(?17dZS>a(w{FwQGB=>u%^`L|>F>pzYSV1@FdDdU{#!p9_C9y6lPCpOV^`4>!Ub
z9CD&s@(y994GH`I2BAIjF}-A@kDH{$={srBYJAvt@;N_@D)L&Lukqp}{`vjM)wt`*
ze=kQ|0z4$iu@m9pDTL7nM+B;cY=ywDGVd5$RtvnzPG3T@@4#b8+zY+6KvDvT+bYw(
z`r7H<NY?ZeYMFl;F5Wd$Uu72s16F3$Yw?Lru&R#XagR1o%G@s<D{hi?B-x5DC7Q*)
zryxNyzuU1Rgbp07Md*mrTqEtZ<iuvPk`~)>C#bm7s@<^{hs<Ugc8b=aBAau+cih;b
zSiSFz8KJ`-JW0!OA~4No3&K+wv_HlsCJqL2yw((>KFWX5$*R-R0>DwE8og#Pn%jxv
zT9~L|IRqdFp-5gqTO8$Th64F)<}ROKDAF6XghbrXD5s$yqm5`xDb6k@utJ1BVSUbX
zS6i9SQbdl>Nm4?I&c<qMBGX~+)`v7!)nL%blyOR<TulAggK)tE6b(1`Q2*Aw8}|3O
z7@wkF461(|FXqgssx$ek?A2me;r4vQc(Ln5L=$y&q}%mbRK0bFO9tnUSNs-}a#~PN
z6QSq%zWhQCzU;kL>#>(1)|^%CW*zUPO=M)3?YKZ@a^0T~uv;^lzUxcVYy^E246Toe
z{@IZb1;<8Ch9g`7yF6~WEX}cGNAd_Zr`N5ED)N7r`aEw$zc!*}m$YwM(YEWr#uxPc
z<O77tGG>;ht=5r*xq3h^Ug70@<QWw^k^8~v+DsjuALcDnowtkxlo63oLbNF{A2W)<
zjxw}`@p@87H=|llsWG_3CK*O=6Se_d%{(m9vwZdnSH0}qi6@^!ji4Ln;N)m94AFC@
zATob_ux%9vdLU{Y+7c-QbBvqDzI&pP5#9`tZKOr9XWdTPaM#TXS}AWLshwzsR{-0&
zuC-!H3Oed3ZhY&Ujj9DxL!UU_=e+whG4<@W4yncZP}KAh_Z}Nve8K@ks^WUNG0<3Y
z0NY`Xn=+aUWUcP!xCNWjAyyIIOsy!y{RDq#fOu-10wM}BDaRe*Wv}CQY(j@d5aRRE
z5YmEXS8`N9<>{FkRBOim5bR&hl}~P+VDC%YYtIV0!jsY#+!AJZ7*+W&autyodCUHa
z?rA29UfNxp)W;Z!O$mpCSrw@NKE8|R^A~;q>>EmAA2y50Zj*B29)8olE5m+^?r?v9
zuQO0lc!x-BdajQ=G*861a9q3AC^ta7MR|hsExTSf4QbP9x?^ztJPzpqb&>+}dAAQ6
z2OuZFak>?ak_UGGR0Af2DsEv3{^aiQ2nK>XC_>IAbXRf{tlukb4pq|5q1#fKtAL*^
zn-lNRzN4MBMMkZGgsiS?gNv_Wc)Nen$y>ESwr-9`Q5#G31QIpj)4z4oWbd_UsHKYe
zR>wZ44{W^ehKD2SNFf|2oYW&adatSO-h)2&OkZ)bQKRD{up1NmG+_cfcSum3dDZek
z(eyk(M9M5LC$^J=CK?o4l@&hHC1A5a-IznI93|M4uyCRU74%L=BA{%#m`Q)qu;_r%
zS^Z1V#3ub|NCifa0{SL^IlI}e#3Go=9!#R3G)xxsa?wGDs_i}&U49Y7k5(oV6T)`j
zFB7-tX}4oL<F)x4mZoQycAg!4l||r!ytlnW^z@=}aVN!bA{4r(37yoGGst~<^j^7R
zk}qx`Aig)UXZ@|?^{6fC5z&7Qp-&phO}+_BivNfpBEeGCBtNU{3Y^Pd9zF>3>*X{A
z{SGzPz{&xhBwX-HmPF2TE0HO2SDzKCM!S)U^eFVZg22@FMY+#gJ_FXpWmnWOT}gE%
z9nrtZT$)9ZS@#lZlQKoU>=A_m`PM7XTFajbkfiD0mPf9+_xuO7MR9)}Co)KYZG?ag
zOftt2c)T9T9yjs)1SJCzmJs6NC^{YBP0V6(55Aexs_(665{uYzY|~XSLsTLKyv0O0
zMc2L0f6?tmC$`)D!Vy<p+o11g?$1^%(}iOCgvP3J^4hV{+u#1?;Mx5@d|e+r3c8i=
zF2P{aOLauW@jIwjuJC_tKl(PQE(Q}_1-_PN>Zrpb;3Q9t_I5KmOEm;p4D=kuFLr$l
zACE%BSQ=##KJgwon7%qe@n%q}da}Yxs=>A3qLvr&&9W(8R`7_>xFz0QLRo>7?O|!D
z(ToChp%@iClA22;;MKc)7^Go@!|K83tWHVBSZfww+%a>#!1#aK&FW<6zAG7@K_1pm
zX9ZjsdSx9w`6i3<H!EPkwIlXUIur|~j)|cf<vhX5%kr~XMMx9@`!G=anqDlbEW$b9
zp#qF~ep=0<NUwzf&eDHuTb#!PZ6D0|!u8elP^?TLrne)0p!h_Du@iAWb49=3{BVZ9
zyY=u@TTyL%sFr_N3;oVn&P-<+ro@31{1yEC3K3Dbvlw@-c2mno=gEyo$5&x7fSHGD
z3x){;LPA!*8awIw9TEz5dCL4D>&h6l>b8e=RK1HoM~-kmR%`)xX(RA93X`;|-Ar}0
za|V$chwu8y!B$~{7Tys}oG-%EhI1e9+;rlAgc>H6b0mMOhr<_|HH)X>JIa8`^fNUR
zT?}_eb=5(>?(#L*oQTbCu$}k&Qz-)$J`tnq#x;4BkggTZSmd<)nf6&AXy-P~kRewS
zo8A<^=c4%aV3M<x#j6(=%+ocDeKo{yr$J5`tV(UW&_np%IKnWgLjnZs3P{AiU$dM1
z5y1q&o<V<)>$6^_W*vjLK|+$bVBh>cUhGZ__!Op2+`QFo)277({NQkbXwmFsTokZ`
zq>;PHEpu8`ue#W_?brmZux6q+RrCutO=^OQ*$KD#PR`%qLJ(bKv<DO`{Xmk7r9GX>
z!`@`H-KP2})@k@JdfQXWOlBkV%<P>NU)*V{c%^>?P1L#(?xa4Cuh4p-1_`hl1`+JZ
zoZ@a$-b-%Oka=p;^p_T5$Qkm#!nLS&*E+Cf*w1ab>DV`QZ*;w*-zTxN0HBK`0d6%_
zH)_0*!2XQD8wVl~#Uodt!<HM$ELQ}xD%N={uXk5g&ou7{<hn2tt1#K@W<0N6wmKd$
zj{kqDZrxcvOLum%J4ku4v;3<2FTH>H7x%y3{NgWn#2PLhYuOV=MWC`WvgcPEORR@8
zP$+lmo*z7u+X)4X;q}1&6dnd>M$&IY{xu$F+QwQ(8Ch$+r3H$Cw{RzD_sy!D>-6X~
zjXmbtm^CNK5_pJS=v!phyJ2Prpc6fHC;5L<J@8X3^Rycv1mg?_O&iu=dC~{bRhxFn
zuH=uiO+<vcR@>rkW&<r{S7d{lBkf{^kldYAe*H)gq_Aov)GjcDLDnF9nElxLKzp&1
zZOSKYM3A}XA7~BZ3WTyZTOiPWx~MNV@$v&i*6n25f9!2a=i0yA?%=tT9^fJ3{`!A_
z<v#d8dhK>)GKxDLd8<CTJDHaLpct3)$F-(B)IuLzR`bIGA8HORK77;i|Nh?n>rMN!
zmiv!_U`g*kYq|Gt+;bg;XwYgm@-Pjb1-F%#K%3Gv+6^(x+^D)65L<O5Ja7+A9urIl
z?m{;okE-Fd8;HPj?PPy=@$#_0_iTT6|7pi#zv|P2-J_%LUK~DwTS~k2K@UxBZu+U;
z-p;<Jp$9?*?r?}`Y|V`a<<9^nvAIb!suf?cs9;sqElv!Fc<87l#MRI-Zl$zG5p;PB
zStn3%wt>MqX^fA~%nz-WlOH9l;@P!(??%I!;c9&D9%%Sbkb)on$d+BJ-yDA(>^|Om
z1JZer&oA}G?!kfU*74VGvh6QEGxwcj4F1zF4*Te>;|N0Mb;$SmZW8BpKYS<^1sQXf
zOui&M0rjNy)ol~C*r`xbyW5XK$^8tm@)y;t^w<%P=~oVceVosMb_dLj%ktu~D=?a@
zU4@DuZh>_L(?<s+!6cTfpW=U1p}<EzHv~X{nG;8Z27^Eq_a#$uTWRLR1>3)%?^uup
zC7f>dN|f`Nh1&?W!{P_i_p#qyaRRK)U2T%gdg3-~!7NFL6BCu8xPezbVa&V&f2v6z
zh1ZI3Wic|Odp`FTQ2O%x^HWI$*l|VY<w#Xb3f<=FzaUmNpoGA+f_Z;Ha@x`flig%!
zmp}xZS3#Z<^rtY3WO#a9wMP~1B8moBFPl)&=(zhWyoP!SU2+mSwJ$34i5|)F5c(tu
zR*|q6@FDJm#S_Fu?TmH3BLo16B|#O$OO|*7%%6H8KGcLD6hR&}TlP`p+X3hu@)Sj}
zA#kjFyubbUNk<;aE^vRs5kw1Ps@<Q{VrI@Eofr**o3EIkVUKW-w#3oA_$(!EZu;j%
zF{=CG>VNG6<=_J$24uL12(T?xa~b>yicv@0(kQ_5kBgjGqR*gH2-$%sAwoW_i_z;s
z5_wj_#4*K|sAG22^@5DYOi}?At+PwGe!<hz?K;K4%ivC=dp&<1ka-`cVWwD7^Kx*f
z0XVschf0xXI^w8Yjf&B=KPm2reXZ^+5c46BDMrL~Hp(Slvqh~1^?S0tM#T^69L#74
zH?WRst6aq;9p~u{3@1XmZOqXmz{)10>y~WB(!iXf=tfbrL|PpLOc~-YNm=~Hk-Zbx
zZ@W#@sJH4K+97`fR4VT>S1onWxM_?4Y{niz;%%XxL0=zq)F<fihn?)799!EVsh}Iw
z0=Vw^*ikv8Om~ywS@~Px90mqog%L|`hX_X_kZkGYeyt(rM4*NUJ?}K9Di3*2GD<ce
zG#$uj=Pb_5XEVK0CZA3~g7zIn8*|;EtQ(iz6`npCP#u3oav8P7t;u*-h@c>;Zj-qq
zH5vz%{DSymr}@lL5~<ED^z1s@bW7OD_Mhx&c4qhZb?Jy2%?}+WODCa-$q8sdTYC*T
zyf)oDQCMjxs*6ck&9>dMb2$8+&#!Ql{86BzLuUBbQ2RRxb67Mo7<W`X>1v?@QBH#<
zSvD-c+*E&$N|)TGb{r!5%&aq!tJU}vmn=8;uA}*g_3DJg%`@CKWBAWP^K#OF%#@!i
z)VQX*g%^fQ(J(vtQ*{c!fkm-erF8#p-<603%MKK5D=7DpN5?09agl6DrHBWLamIx}
zYnTqBLt&BY#wNKnX3<ajDB1TV`-?JZ%h8eYwKabgd(}*HXnn!)^mKyl=;*Q=Kvo_C
zi%&(bw__r`Na#w*eh~Fb{Z_?`B~;-h*(m){U!TJt)Xj1c{IRG#iVJ_*=i9!$wUv?F
z-PN>N_kHOKUupHwo4fn8S@MCDw6|K=tNe({*!V=pX=MWF>Pfw*r{dQraLodKo_zdq
zzaD=T#gu`oN+l+MtasN^1d}9(>nbPmy6{1e5Oh(<xaN_4!*M+NY8`R?4fQ2!0An$W
zp7oOG@!XwEsOBeyDxQ2631e&<8k%MY)+=h5YDoCKMs#_^vfWZwBvW&u?s|T%=lVNp
zR*8qWKbQkOukq??huZwhs(Q8N<bBk)_bGp2@C@1-V|iZ-q~`ICWLKZLYXPhssgYum
z5;mAP2=21NwN94QtNz1n<}FZ;?ABzJni=NZK?guI5m%<OvM!X4+f|P}bP}<Za$P^#
zeY|EYp9n~=nEb<MjR}z(X$@`d!=A)-V=Y=ZtwE5*C~X|QSfa7(02g^?7r1#xl4gH(
z)d)W7vj~%~CZFnle*AQQslf;Rvr)NpshoTThsW#5*|J;Ty}rA(`*_#f^CxnNE7P^|
z3i+tdGX1Db6WAFXEmQ&;E~4(iXW$qhH@Uk3V$qI>ApuWVK~mg@jH4!_lGmD0g@@v_
z8eX?zL=~E}ig_u_QeMB(WLe^pGOB;Xuh-qnJ#*!Spn(8_E64Ua7FY3kDa&;{W_j*}
z#A4W8Okpb&zZP69kQzF;`;00I;`gN};#wSu^!6>BiF_Y&Et*(kvSx#`2A#T=qZY@|
zh&JJbyu;-?d2q%SW1m6UCtFxd2OV`68Ac(P@0D=pF&$0ay#O!b5cijc)#iVxBRm1f
zZ|7Ur7Fk7XjE~%*`F?Zz)cwaF7)fkZD11zHPBUf9)H%LG?Aj7WELIG4xHxGRl*E+o
zZ)~}079C=F-Je(6Q_5=MpDIBEUg_j&gCqdPrkK4OHu;r&+xOqDsIKwAfUH%SfDP=&
z6KhOFJZZWK<JlMy)Dv~cX8wOqn*XrfpU9R$e)glM9doS48xy-8E!@8jAd(z8QDP*5
z7utKiP|l+gMm|$n$6EDlNiPiPxfaopQLavWmj!B&cZk~p?!QQR)wbv$5xU%kK;h!V
zNyNgw`GV>;r}&h0c8{K<2p)Jjfq=7^Fn$74na?6mwXr58l(KM2aI$~+?4q!#gVN2M
z0Q0(Nv~oXbrB3pmNPJv#NtbR^SqDOrqa!?R5kZJEq$Qc?!cKsv;LL!gLW;x$=(L#W
zs!05Q3{#x@C_C9f)$H2c+Jr?5xNiQH@ckiV$zumB8oBPJRlx}8WP`^$e}oRc{^PD=
z?Eh$I1Q-`YE;dV6_&$Gh*Z0O3N^Ld;3<QN{j3>{+0EObp`!Eih{U>bz95JCr#K-#9
zDvfRX5H5%hY$hc>FA|<J&xiN{pj>MGIa&F^8vgJ%{it+ca}uYbnJU@^>dO6fS&^BK
z@Latglql8PI}#W?7z{-JfWt12U`h7X)kWyws@f7b8~Og1uD^df&t5#)d$=LnVIz9}
zWcPUY(eBY+|K;J+hZ|GP+~O9%|0#GH<Kp-CesjNf?|$!Y@7~VGA3eD5SK@bdJpxwQ
z!(myYUvc$E-|QdspY4BjNR-is8!$j^_>syV&noI9R;+;6jUznA@Z<EprVl}Of+O$_
zyXJRpFF%CK&$xf+R<FC*tRF^AcYV`sK?x-)X4cr`x|5cc>fk6_eZaoRdVg%x(F!y0
zT^wR*=7C`3r+0v;T|pT=d@^Z#G;4~eQJ)ET&GVz9X9F@r)kOSLSJ4H^hjdv5lj}&`
zI6JMXx!f?K0P!k#lw^(sdb6He`b!Oo1*_iCGo>3<(j0&I6b}~v7d$ettP*>q7oXBk
z4e+w-O(~_?`Lo6Abqf%FW!*iy{tnpX?9ufBGJkc?vW;>!_Phd^NhjCWm)nci+iElJ
zP3wEvPgz;~uwl#8fW4tV78#u~az4n$h3mJ#4J}>|>g=RCcV`mbJ&kbQB*8?|g+^}N
z?YRE!w$6W#;|bPH&Le=hCJ^_&4<~Cnak`kGaWYA9b0W&<R#R;IrxjtT(Sf+Ar>$Qy
z&XM;L%hXm(RG_-M*V8(Fiu2**nMs3Ac;_I3zD9M7!0s16%;iaX1beQYKc1HEe{Pg|
z?gDzTTpBlD7t3xBt7+B0L!$ra<#XC|A8y<{DG`4~=JE5~X4qxPCW{LE=GWOK)2A10
z?7O{*WtI#<iZJ5{o);Coa&3cwjH+>aBXY(7U+}i0!{kdn8XTe6*5oYRMZF!SQuW26
zl3~~Fzc^x{T-V8$DjBqU$|R87#RD~w9Do+;4Q0eSDTYuK5C~G^UmhHND^fghCkE>m
zyitEr9{Ok5Z+ai~K8`kTd>WJH-*zn1!tZ}Rr&skQ{~&6ElfLNE01skSTht=>h8oi2
z_l`&UK=3mVX;ajH41@UNZ~kaK`A>DU4_<t?cX;&m-qWYygx_M0qLVHTWgo7)NP5rr
zj<etP?!rkex=~J^*@;V%F5l){4y*a3m<xZrmK{esb;@r<nQ4W7_+I#Js^`;7c)W{C
z!g-8TnA5z8x~*OR>-CEvoyxjhd<>VfI?Paf#<(i%&D#!`6ng)IB|Z8FZ04}rG*xAJ
zPVc#5`1jttPhK3mN$MZIcyYX9<H`hVESF!i(WSipXVoT;G$p#ppD$KjR$;~57w><5
zBSGynSqQ0f{1hCY6Mm|9IUkQcRKISuQqI<2IO%o6%`TAY&!vs^YcyG`xhUMQ-nM&D
z<o);VWbvPl5I=tz_GPb!|CdQ<@KkV>SVwB{?&kf75<%-r_@K$P)Ty_v;2I&c{hywE
z)4hK`Bb0jpU$JB{vZNsn_*Q$5y)l3N)ZkC9S%quFpJz8PHF)o6s~IwW^(#I(3y+!`
z)u!aJoBO&1$hYngjI7zi^8)bcy+7r%^*xZWbsv@UTJV<K0qTmvI9s7LIMa5wNBIIq
z;#s{t%dfV_2w<Q2w^{c|fvZNOK70Cq{%zm03Z5l5wMDvZZNb8V?6mp(@)v*68F~ET
z<>Ar(-eL2k*vvHv_Tj?q(KUw!?}Q(jNx3B#ckb4~%)O&VvXc#*m;>OK-f2G9jeAjy
zduQVzQAP*o)gV1yC#YJRgrVEE3Tm}uIqOxki|w{Xc9-@09HyXOy@5wTqv<Kq0i_S!
zm{uMv&gk0d#9Vrnu3C`fO{9OM^;h5H!`<f=_84a6%$=;>tZT6Ym=-5p8gsV|ZTWV)
zmpxg`#CjdBAfM3gkX~B~aVd^WqK?Aiyvxi6MfzdV()#H=G-#W*5v7CtmEwI(Ui&kA
zxVTN#MYiFUOTqxun`fJMrunNooy>`nlh=3J0A)UXcywL&E{eH(vUz{!u>W-b(NX{9
z(cU3mGZy0E9Y5=gvreY{PCGqH%&bGBFtmuKHB@b)<oF9F*3{?B@zjV|ox2AY%sChC
z5;Zg|>;6}@;)7#r!pkLENDH!~va4>S_h@P)RRu|_;<+Tk?wGF<?z$0(m=7iid5>Zv
zum>)hU(SjmxLPvT291AOaFNvg0(TR!l<~ErYnubA(M5GRXuBI*GPTzk9Ld6Yp__-~
z52RVB@x9oJ@crRJvk$`cLmq4V>8W_>oI5ftE<qR8%}`H{XQ)PV(1?3tCP8RT(^Q;T
z9=+9|4S1x|WiU}Xb2>C!A)10#^tVRB51aL_2+8Gi^t{#4jB<b8RH_GlosDe@XIxet
znj#eXp+r#*SKpdDTU&1Ck`=@6*x)hPi5rbl+`&PYaqwcz^K00O{+4~04D_Z|)N{Zu
z1&9D;K$^cyf|<oXNMc|Z4>x<Q#{>w@K@Bg@yi4OdPJnK?_nUyQ_gdjki>ZxFsuAA(
z+FghQgB)^%F5lb;J{5w04~B@+Kby|Y+AX1Fu12&kI{A+QGK|ePyeQg6)oF$X-UNMB
z%@C=Zy~p81N(yEl(#BSzayC4lKJD{dnu|fxHHe6u;!aV&<08s=$4{=`{`2F#!{@tC
zbs^oq&40c*>6$-hfSbcz9N_S}A$FW)c0Rp(_wE3Rc?Y{+?L9w#?jOJSX79PH_Mg5x
zcI)!WO(wHMMDv72us9)Ws5)hg2Qz;J-_%Bb?%1x06KBBu+ZGQej#C>gCTAqgmO;{e
z1hPJr_yoqk@wU)+^ZWu%i^fhPF#|k@n1?c5cRCXYRq;(y#`XlJVad0NO>R(oAifuX
zJhmIg_G!f7;eND#0162JUA{sc-vlI$^eS}Qh2))kn)mYThI?H@9D%%5Gtk!{mzg<q
z21-Bj(Ugq@ueO#PoaLRe`e|DP8$e+)LhJNbJ&dI>e^xsYXIxH7ShyVTxr6-<rX#vX
zu)$N#sXn7FL2I|Yqn|)=?B<A(ZrR3ab8FMqy1}o=Jv`)p%<{J;>3g1!3s;lhqTi{B
zyv4;|Baj)GlTFnxXT=4&l)0L|{^sekoj)G^;plkp*&h|}^090^SK%Ku{;~dJI<Sov
zB&Bcj8R9E{zbP2p(cNX(>50Am=P}oJT5Wf)&Aa=K*E$f)EGKSoIDTAROjEY87iME4
z>we2nI^XYqF7b?>Ek^V5NUjfZp|ax9#d+Hm*H8ZLD=zK)16SM{T({yvCI5~q{*PGj
zz$x5zz2%F)`*O3Hf8c6sd+QdPH;=9L(!KuhZCAE^8C}{B|8zB19t5BDd6D*^qy0NC
zyk_tryc=_J36@?O%@nJ(7@0UgAoAW}|Et3nFAoNP9j~aM7O9qq$F|S3ZhaU?3JiC*
z5u{nYgA_0)<Rh^p(*~U2my`l6@zh%3U9{v99Vt#P>17<mPXPyr_I1##HEyj05L)S4
zHEZnrTw&R!Zhq#49TIJ;S)=P);WqoHpL}%pu0iNOv>tDN;&#T}?Hhi{f@z*`9e%xb
z{PgvI`Q$Ew&?-c1Kvw{d9%VNr4~K}<+TA+gFCOfu?j~U`{{C|(-B0WDfCV8R=(nOm
zibr317Hhem0>@+}kqKx~TZ@w4w$Y;dhPfu~69gqdZrNk#t)M8mGS3~8c0ner+DYDJ
zUw9VmDL(xIj^Kv;;y!$e<Y^l5;z6<0!+oQF$!2(!;4_OsP8MZr>u6q0<7aEhca4Ip
zCKobI-CXZ?s^+chx3%?hI>cP96`Go>)*P1X+M7DzKDw!q|L9B~Yi{^w(mhjO#bo*6
z__|B6YXjPU5O_+mLmZpPTeDXC@!##5;W{=6$t^a^lL8^xH*d%H+#<_W+Xq8=vxfYC
zWV<0gc}GEQ;Irwoj!Y#HT#i&;ipWF~N5VT3YX_AHKKG?{JCdp`tw$$|bB~;$p=|Sc
zHR&EL#8XLks8EGs)(*=3NnMY7XJ-V+x|eu~$JPSW=%)0(xy-T!*K^GCD&070^&dB;
zNcGn=qJ_&jBsSAJHB!<8GCCpKy&+d!2iAdE;hXZcefLBZF!48*qLY~V41)|H`1V<}
zUG39dLyKL*;{X>6VfQ13F$j#vPB!>v?+*{Z-F^CUZ_u{N_qShIr7wbF!(Y$LkxcJ;
zGDf~jKfrtUOfz4|=a)br3KoBkG+?xsRW;`^6~#A?kW6zWm54S=F3{wL+gyLaiP}se
zhQ~z>l%d*HqL((d&l=xxVG9Mq2I@ukky_YSM=o&Fz#gdL$3U`h@N3bjcnAtWK0}}4
zWt@)Lp;oBo#1!w2ZEivHiHZ%cU+1H8h-rIlo`WfS!LPtJ#1ohn*@1t0W-SjwpKwOL
z*;RytB)rwY>!il@*+9%5-cKB98*1TL<`ry(h#{Ger$H9OyFU)#RiJo}Eyk>{i;@92
zM13%XTXu0BAz?T1ij9z>qF`!nRL0ny+T$hKY+NEiEt5^e0j~fAo9n6}o$Ih#%(vZt
z+_qv=cIBNAVP4^0T}*!!1WH8^fhm<j226C8PeERX(db1<=biDnwR+icWn~-9?QoFL
zw2@*)T5<c>5`C?t0!9^;cED30*y*~0uD9l*`F``m2qL4)9(Qrx+u-wg@~|VnQpqY(
z%IYrMjh<v<;QXJ)@aAjPzkg5dx{p(gofBPOBi=ezB}X@<jv0Rwns(ao^IK6M7E`ZB
zT57KckA#qAbv2aJt`;bMy+(a3n9_qFvwvPM&d<vqzUY7MsQMxw_3?`3zZirdNK0aI
z+vrEj`vI24C%`zG7H6%N|5=7mbVCu*Nj(>otPQ4@*yw4R2~b!$kB;TLnB~(;Ksle-
zBS$Z<kvKS$SAl<{C?>9hugYmLEOR;w;MevO{j9H__4yekf48rS9{?ZF4RL@H-9Mor
zu9!j`cA`%!XV8g&^dKZq%{luM4c7pS9Btc@%X?Uyjq;fUMS_friOErFj<@A=3MFC0
zBm)74M-uiHgkkp?n<V@iSPS!x`o{?P`^){7$IkrH1KNK8nGD7QLqYL@oe@}(Pe|js
za8-;LeQnXw8AGf~O@>)n;5qlHkF%a5qH^w6zZ0cncI8^3%~nf#W;kn?4B3?|E0T;C
zaPF<!=Ivl$Y@0L?^e7K#kdi0FZ)KoR%)rW=6%oci^I_2rEE#dQRbkO;oxH@TF-Cy%
zWOaGr2=9Niqdvjp8gNI*(zv=+TI%4Axb&!k9l}9^ZVFJD6%&}_Qc~l<FbfV~BKU+T
zXYIZ<yUqOv+wFEoatru`%$f=XG<z=d0!xj#U0JTa<e-1&K|*cTb`SQqkFIj2uaZM5
z`>s?ZWXls_8(xE11)Z2lqrNKVnBIW0*<wUp?_GZaF;7R;={7>{J(20*k9=D8uJiGz
z-SQdLOeq1q(QGll{7f=(hD={Dg*sjcgjI0Ac}fE!d&}INDyA}!&@u@oK~P_=7+tgt
zjya)Ba;V(2<^buXB+q9*GF;qQ1-ye(_|y=Oi|O5o%PM|)wWe1E=CkB=WV&=;Cy_z7
zw_Sh7-D&ND?{|AsvVHMa>jV9@qh@wMZ@Tino3Y^WLG<HyjSqO?@Qw(WgVe`iyL>=D
zz#SeJ%GJ?Fk`EL+BmM*<w81iMCbEBIlKsQ=ng4ZN$S2pI0Tz_p|NcCJX3r#fn51==
zA$CY){RleDXo`xIitD~$t_;aV5|DD3%w>Nb3NR&<;|8f{@L5fb|MTP2<n?t+9GVkE
zMxV9{`-(G1>ng{r7GGb_%0&*XgjKHLyrBtp1S%DN9GYEIhMCVi+9V(b@E!K9+)4f$
zs>5@<=>p9N^f}K2t*G^ZmXZa1#vdo&M{8QdDegS#A@COUfI#-2sMcF986q5hpc;SM
zzBKT=xB;y`fRsxa#a)B@i>lv)7MRyBS>Uh}T@~~xe_g#YzL1xI0YD0ZPwRszE^>N=
zRkItq<61mZY2aLQ=bYM=NjD1Qoe)JmX%6Ih;l*S$K3iDs#<Q3R4&O-e$Z;zmhwJNW
zf&csfpDVZNI&)e%);*s@^UhPmuuy;5M|DJQ0NOOdRUD$1AvGA2$~v$~cd$7mz4{r#
zSU|dv9~amM7w+a~#!c#<1k7bdhde;`v5Mjc@IML|IV?`ypw9TA!hXFDQZX(^aGW?g
zghwoDKPhBX0VJ;6x!y3*&C>Sge%Bu(Ciq%&2*^#^WT+h@-a>HOZ6Wue>;Qjr-z5xh
z?!U<AG$#=XFge7VxW-;(gZb=wo1ngM=WTg>3QM^R#>--lHPR^V*h#$YD0MUf{vY(?
z5{by6$jB6EQocs#An>M?N!+N&)wbkz>&h;ET>=$QK`T9wcek9_7WRx*1UBFEaP@LH
z09UZBtqSW5kb1?Z*CGN;|6zZ0qzKOKZ!TS%cewOIO(cj}=JwKJQo6mMNlVVlkcu9(
zq2rwfBeofrZc&Tsz*PVru{-jh?tNYkzqo^`gNxTpV#-~yau{8P{3^HZE8EIsP3I8t
zuCrHe0u^jtX1?i(<*JbTlDhAovcvpJSQ7mWebCYavSsq~%W4La9X)^f4zO;GXOBqB
zUrdVR_pW*i|CH@(o)`VOTT(vu1B^DUUa!1sVfvPzziZA(Z5nO4-{-R5NTW-LNE5Np
zV#UXdIl~8i+WY$D`R{h95@)FY{<+oZarg*sx}$W7CPLmg^TP7*zO@NgzK`<t+Qw=p
zCceGXu8`F5BWa<{LiT^gR|6bAabTmm4BUWYnXf1L*!?+K07zEwGR44|E4qQUi#AY$
zYhfRh(`W9s`a!BaPy)8CY<cUpG`!Rdpfd4ce?A|%s^z_}Qeg7{x&_D}3o_6{v@{6d
zR7=sdom4n+oD*h%5hQHGB=YQ#;s%*vP==3BWPS;TG>oo7t+#*A>V!XxCSFhy!yb&m
zq%l{Djq3Q4qI@kP@>wyX6QRt9)FaspCv(qn<Tl(LnHEYnS6K??NWP22lxKup!6<mX
zGzZJDFBL}%fVW{X<EPT&K4z7(5i`XYG|E6G1bXLX-&%<I246yM+qg_~)lihMV>YP1
z8t;}W1om+M3`&2hQS%kJ&T_I~@^pMIdEfeBcu{G;YW7iBHYUw3lRd3uGj4z!Wx^$~
zy0G!lY%RnesJC<Vhz8Zxbp`(=S*lF@PZ--)CZD=S4)I?~B61a_)90?EBc74)<R=Eq
z$?X*%4u0J%EVmh6A^8Gd-ucYm5?%<Bk5|;2R`4fZfR%s5L@KJrUpnc>v-~RhmaJRf
zW75}{2&gVTm+Cr=dHCWpT_XTW`zABb5ZQ%y=X5c-V}HAAsPaFi1Y>#Ne_w=Gr+IxD
z%6Y?)e>7P{Z$+!}=kRuXo&2ifU#H~-%^3bcJ*lqFM^5_lPpVmd=FY-t==I|4RrHfQ
zP*kPpx#xd%=+foX|BZC>{>K@_gYXWE7Zp4Wotj}5{VzA;unlpQpq&3*GT%Z#!-IK#
z@w*j!ATSz@E%>+X0Q4tr9U8E8&3h$=ZyY4xXKLEF6md+A#^i->bB*AeDW_4*R#8r}
z1m=sBQaK<bk48;OX-~^~yn+<_UME~#+V3lS_4a?BukD?0$8(Bl8=?$woGt5Di_>!b
zhH$)-?ZQd!bGh)AnM6EIX%U{R?e?25mU@Ux9V>e1rt;4Exqg@K#Z%S1+iurUW2)1B
zT1v$`QqtX0yZdU=;q@k3C;&_dQyclo4HeyTvym4Ll{|ZVpjIxxpcbd@M?O0fD+avp
zp~!!%ff)*rRS`%cQ5!YHdR$fEG8+N<Edx@qARSL$vh(kKN;#w*vFRPVzcG<-!sX~0
zb8WS`Ym^1=gSnqJ85F_uR@?n5s>7>XYo_KepUgd<hWssKH_a(0rYv;)@Qq%r%$Zi^
zqqo#BhF_6e4gjCOrDn%;IQF9&yNw9j^Y4F_S|v}iP6T-qB}t0p<=3KQWEcql9*BP0
zq~$><I}n{_D%eW!_HRYDC7k}iHuYdf^AkfMC*ZUdK{T0)9bk)+1eE&IS}oDYA7fEg
zBrd0miwlJ$A9x<bRW10`xok@faNUG%V{&bMKhZE4SI%o*s9JfCL=bh!R6Y=MF(ZF*
zH%&+q{jP+)bT6y3%p2~yFr#a~^GM~u5H-DLPp>&0bpLSUI2$e0R%c#BYJ_TKQEtlt
zvQQ4_q*eaFEDQrsffdb6M9a$yBWkL{7+OL1Tb$Br!b-yJ=jvh+Lf=y(%qd(8d#@UG
z-ilB|N*JQQCbKRx^)flK8;Tg}N7R2oi49tG?u#?^$SANWb1w*j$2BXB*EhPVz(5YH
zje&$Ui4g2%;GkAol8}o?U%<mZ8maBL*4`q2r`IUp1k8v%=dTt6VfH`;0-hD!=bYE%
zb`CSk$IZFDf4|S?esX_kTdI+1k!w(uDfmR7MV_cZqC6SInhL*(sX0;21^a*HZ*=Vw
z?c5_tH7@UPJWY|+$xhY!itXvHBA5ybgvTG)4-tBG@u+m{I?}HZsX<SV`Yk^e?&6N*
z1((onRJgB}g9%FdLUCGG?Vh+w-@Nd+U>dLe@I(`wOD$na-0JC+P=jYYgD$rubSfj`
zi722!_a*ZVH@WSCUItbQyJvq`oN*~CQ7xH{8TOGVJFzy$LAA1X+RwhDtM)R6r#H3j
z!AW*voJV}Tm-A~x{D*FNwFV=*C;lF5nuDC_V&);4Xp>Qixs<lgyzZHulvQziozhDE
z%BS1JwGp_BR%_q|SAcB<2}ZFtOr{w4Goz+3M>iUr%AgbMf_ZD4Pp5w%Kc~g~s(`x;
z&9{z5_lln0UOMSgF}W;F$K>^Vv>ft&?X;+db644FVy5`|%bl{7RtWo{+z8W>ol|qx
zwHosb1+PT~RL5Ih=xq^_egG)lU*j^C+NX?@<=Xbfg%aLJ>arr{-l+eZ`3MTUi%VWS
zKC@IP(NRwbnkG65n&W?tB+X2sinkP8mSl*y8XgJPya(uTW66JDM4uEA-d+go+LW30
zG%FJiiiU`nbpYzeF5B8Nh<r;iBg|6WvPkf)Em%<H1LDJ$W5g;HimmT6_K7nF(it$b
z$Ui?-=SSYtEoH&j$7!V)t@I?Rri+nWZKWnm_2`9WcgW(Ly{&&eNu4{U`PqHLxj<G0
z-4IA(9hifuIK7uZwJrfH&fLOqh1cJbQ`p@W@>47|(R&zbo<-&f$HImTus*6PXx_PV
zXT_abERkeT8n=-*9f)VcYI9DL(f=Uj^FO$O&HvyAE?-;)V3DIKOqkWAe@HGm18=GK
zmfOs$84mSidR2eK#1{$wB9{O<K#|Osk+sl}hSem3yeaOxmzKCfXERfCjWI>zLZQ{K
za0Qxs*yKXs@>mZq+(~86dn-oQm^U|2vx1$E@{3F#i%A_p;;#5Kms6Hybe|#f$*!u$
zCv|#1kOGRgmL$Forc`dx%JpEfvimY;IAP=R;&SdG<ja4HiCOd&;3C(=8mFMa>>8aV
zmX|Qz0B(pS3?0brg^9J4AfnAZ%V)D|IV~KTeiXaE=9a$IBJtIdpn2C9W0jqRN~)QC
zpi2IM`R^cdem16Ao^bT0iEgPiVN<H|j^%BQV4*7j?8i)5Xjt|?sB%D;K*SLQ(X~>H
z3O9^GvN(UxF-^()P~eZK(>8Ew8L7DAx$(Lws#~I?M^Wt^vvYXmJzt2jzpdYj0s3TD
z?F8F4S0SU-4e6|U$P1fHg1XLgKePsGlayR-f9`Y0ezDC|YSQ2B&;RMgqyGMrFNg?q
z@Z#tg1Ndt1xMesez3fo`631cgFW%JC{2H+(9e;n1+c{@(A@!TgGdFlFT5U!N?ZnB@
zx8b-nfER~jj>IpRod_r^m9JQgU~ZhGncDh5uMwY2O<1_CEpXqTe6*MW<V=t$h7p6&
z+8q2&Yk2s}AAQ-rmh7WjZwAsKHyge`@Gre2)&=kJ*^1Q=`&cpTgq;W|7)3<l;R2(!
zf_Hxjl7KiVUsZ7XpaW2dl_=ro<?bw@%+djOf^oidKmpc=S_SlHGH-OX7e21t*SjKZ
z!V^R4(8xsan9VWji4sYL**&ft5hLp@19x(2+;A>Fl-T6TLkWM~ik#g?^ghEhsp6y@
zkKuC6+?;ZN%+t-b7u5o_V~m^((6aQCXl#Gr&JcIFe7D`}4KxEK1ZTI>op8}y3FZ+z
zf6XtvC7&q^VpE#OcbFgs`2;a@p^p*Z&G}-+6CoZDrW#DVYK&GMO0qq0=BQ`@I&5u0
z(<UhXYL+%OQ@k`in?P^KTH=fu@XKK7D5drcz-L%-)7TBvCg(&PRk#h*;AdebRIGmu
z5E$n;X|b_0j(Cpj?yjatd58Uj6Rm`MYb$z3aIfn8+#Ny!ixd|gI!MzDW?fz?`NRmW
zG|8258^NpohH)?4Z5KwTL-4t*kj~SlW{_wD2ic!WFusU4!QR9{$Q-ki)2$=!6b17i
zF7pMva62p35B}}v6ehY<$SB}3PnCZt7@=Q^+(1_INYwlU)2U~NB*U+YN7k~kMW@zH
zCU*u-U8}X{_}r=-{eS;EGv$&-TXx$aQ$@}3FL(aTfhbDSWW6HaeA^&}B)untJ=0qD
zL+YiDPehh0w}Lzrl%bd#IRBFyxkW$1Q_PVRD=EGK$Y2yQTQ(JwpYWz!qn3Z{WGAC?
z@=DkQ<UAC)1lv<;V;;l@xM#bTzp%>$i~2daKX?33ma-hmZJj1myx-SieP1liJDMfw
z8RdSnv}UShlz@(r>myrOku?#Fz^=`>evLpXFpyC5okV`xn@H~PtL%xpvD&xS>)z`J
zd1KAQwoWAX$L%Y<-xmY*+6sTas%~G|gZ@Rewj$&`zI|06^<f=fyMF>o($7}q^Tp3p
zRqMn_(zmbc<9_|;(VBFln*m;~lRdkZ{~Trf@1yeKpTTCiqin|gPWFOU{Z95|arWxT
zBlP8P&#`X5%D#d*|6RKENgs*{x<dZ>a$N_p;l4h&eWjoFr<c>URUv-^_U-HXZ696-
zYb$&F;X9nHdwp?QSX&!zig&2*K_6ZZHw^Uj`W<Tfs1LV^wYBYv<HS2uc(<?47HhVh
zyDUx)-=V&b`*h`4U0W~P_3AyJ!^kWVme=t_GRWP&&ENDTUF5np_Z>SAW}RHGWSb_C
zp}%PSbtX!W6UreHL$QCtiy15G#E-sstVw3qd{(E~YFkPCk+&F}@McjbBCXrqO-ot0
z-34NoGW~Vc@Fy&kPpl12=;j3Tl1M%zm?zA$<;-o1ic7G5C#^<8Z6scOh4?4AhHuQ*
zP0dEYrNs}Q$=SOsBX~eBy?k_)U)M-=sxmwx5?MgC?HZhfM0bDDU>W#!UWNerJ5g>%
zi8}0rY~d7#r6nC>3!zo+hM$~C1dUga!wSXh@gk)#=)y-qm_BS+zAlGQ8H>Ij=@)}w
zL;jym<Tslhlsn~qxQ3!CWEuC0EM`BKITKf<+Vmc)6Q8fxqi;!izNE6uk$Tt9470v&
zvS;^9``D45-iLo#enRy7V3==1zuD{cT5m)@3G4&z#MZDlU#cwBG%U~D?sOlz4)J^Y
z`l50SHhLo;|KR%|EoWj}{W1Hps;m=#9N<vyY@Aos#vcdh)20WE{qapl82C2b7}!*n
zX=f3~ZplY^ye3YZo<V;-k{Fb8*-o3kzSp^X_imdUe8_(?S3BXy17@lDoH-l08S0yN
z1M(XmxyuHhqe3_JtRX#ejw_HdeJRstnUq>I<pj^Li)t@@2W2c$09(YG$IQ2nb|gEj
zrn{#i6>}hl3bow`GQbdkl;tT8ibjbf6hKOpZeIyPXh|I)kyFm!K0o3*gcxGKMDyx`
zau--^^#_0OST0hzbS$^-NF^3gq{zP>?4X<_6sBX({rQ*AtuBwRYq9OptpKn4%JE;6
z5>Bp~v$x`yKDgKS#rk<oK_$7mfMzhTBAabB1Hy!eA9IV8k~m#bBE`3<X0V*jHGQ$f
z?}>uIee1R32sXlD6u@b({K_x}fKmAA$gB_M`(1x~QzCO*Glb^5_Z{(7e%6&`@7@yw
z&QetpZ<9U7NnG0DU&aEe&$pm@jFae_8*W^Ub>0bb_v2<D*?Y;}+fh7PU#nSBx1Q7G
z=Qc320BY`JTlW>^13gnKwW142Flj{Ta2Mh|IV88mOUA)mRQX6x5-fR85f(q36~)kK
z90GsYo}w+I9}*4kHl2Ip2rc?C3EnP5SF)VMuux+CbK=R@YUqpM9b_vl&4W<H8rrvH
z0heYM`=?DL!n6X3e?F1y-&4m?$+WCa*qrT&WpGvE=2dlDc)w#_ymI%*;uPIAvFK$~
zOOx`<<Q!hESUpYp%!tYaDUm?sLp47e!=rziTdJ@fcUKDF0W?};a4E<&e^I{H_)(}2
zGf5-STeH^`u^)Icqv}*L2N0`gR@E9H3c?}!&B^O(B=G9MDtuK$Dt^5_p5;G8@d^<`
zsC%!`E44x8Ka}Iec=d-o0zT?~X;@GdCZ?(QTiL_4sF}lLlkT}E?>WJ8^B#vzQ2&3g
zF-bsfi+*>S9ZoJKH}z%ZhbElq{B09b`Z<w~JQgRucwf1dQFO{+f{B#Vy<{7>!XgaG
z1_)4RmVt6iRThBZr@)u=v^E&*%@UFge(B3a8DS`KNY*9S&;>zi?$l~KQmCI_x)=2c
zz{C30dEfo`9%;4z31`PL7MHM16p?=^<%IbkaMV^@Iv@8nbFUNB>NzF0^92qww19~q
z6UGrw%QwY!q>t4}UX5h<epdu*T%8P?x5bSu?oW7+hYagcxlWY*IJrLv=OxwNkh1&T
z^L66@MT}9coRM8(!MIBqD>tXt3D0IeSvf{rO`?340};t^QHY(p``jG#h)aKEKtl>1
zFe*=HIqe4S)34OaM1;+SH$mTlulSu%v$BoC>{P3JhRe!{q(D8%Z8}$uK&)Xh)-qPT
zV>#4r;1fQVbpW^f{F}W$eDUye;@f>O;5Fi=Q6775D&p+vWxTR^a*bAreMLOBdRj@s
z5;=i4RI+pe%D=c1TmCIO-qnB5M-3llUq#|<tMx2iVtC>xq44KluC)lQQLkDb3ZLcY
z=Y|d=vh$svMQ|1g{AbV)0U5|>mzVNSjAwvTlMPC_Q$qG^#PhTP$QxJB*M%IcIBI^v
z5YE6SI?m_kwFZbmI@dGn?kB|JitAbI+8y_IAe>OEwU-meL)MfibE$t6Y9psjbZZOn
zrhv<9?sQ+nriIw+NhXE(QnwEs%D1+lC9_KCpY?8)AdYEXT);u}IWOW)cBCqaN8+~C
zkqDel_JZy*G#u?tuBG)S0k_3E5ka{$`y$^c(LXNdBlg@Zt_rRhdirudcJ>j!WCTB8
zuB57ikmv5knne96Uk88S5&lHpsqu7vO(qM-8}vtteVB!SY<dYfVTP6Tfpc&B_Mz_*
z=fEftA0ZPoI9JIpt@m+fuz&^tDv*L4=9heFy9Xm(rVvXt#+!k)yAArt0F%rcg0|45
zx&$)`e45t5@7=Ebi9k%5LJ!z?kK_D*+5h~9)8po<tN&!-&;Nh<&+<Q<E2To%SI<f@
zD>yOBG4aZ(hQAOdo5LC9KkdE}LY@83xw^$%$z|r}3huB@49v3`)k9B&9!Cth_*!TC
zb#|cGe{dyqWZfq+I<dklIHdbQb|8DC&hjyP!RyC~dF~cyJDxtF>^sb}?7Fcjj)Cp$
zS0CQH|IugJ9vFWS{rgMhpy}7%AzmLY#7?%DmF{1Qa@fhr>FbXi3!aZ%f%?zxUx29Z
zQbN~S4%88U^UxhT*DcJIUig@+=T*2ClJu?tWCV9Z??3InI@B<Y|2bE0pDSS;c?R{*
z5d0v1w%M`c!2sTrZCXI3J7|MQ+8Fr2m{q#>zK@#Wv7>+eFC4lLQBPOu>H3oGwucck
zY(k1ZhCOI-y`itY{}8iHZe2LEF5)7`>Z`3XjGq7H7ansjqBWtE_{!JWCg!NU{9d$p
zE2=-ehTiqx>s(E)^~e7_#W&BDSCKqn%y;pA{+ioE|Ft*khDVX}!$}?6b)hv#oEZ^+
z4QJVaf@goVaJ7DJl>l`kaA%BsQhrvS#-LQ(pJyXDVpDxqAb_^W#r}!-RY9E)Z=y4%
z6mW!V3W^$`H@-$5A?m^4<?5O`dnM*hA2=0(K@xCqBJpp4RetTk=hgO(o=T`Yr`UCh
zA2QDee0tprnQajAhWlqb(hNqzvVjxccZ}+&WD0+Pg1Q7(|JIgU)A?LL)+xq1rsOoA
zWt%ism<zXC3r*Eow|mF}0%2RtrvOp}Qarmm)>)FkXP-tub7C}_l#Cwu%qoWozQ{F1
zFz%1c&ZDq8tyUPz#e&Y>o1@|!!PB#ga?;MM|G9wQs@VersxB@FW*OGHm+fY-0t~CU
z_CSBq6X-B#W01v)zxmEI8#d40-b2fr92j3-p&k}>5fUVbVL;(|0hb2MafE)E9p*_g
zJ8+vgE2I+f2~X-bFDP3=KdJLdHDHew7|bofU;p*rEaD^dTLS03sVY>Sah<6bQbz?z
zrA=V>*U$#B!r<!A7@K&Cy)Kftt!h$4)xdw(#j2Ui#UI{O=sa1fXNl{Ld%-jj9MvKo
zh!yvB2{c}9pH@@-OoGxZ;c9aDWG%i8mXc#`Y5&00Ku>a0gh>`@%7TL8N+Vbr+Y|SV
zaX!6_AjWmJkOWsHx6w%Kd>R(GM3BU>LsU+qxy7}KT?QaGV#GJ&T5N5A_TAGf8xen>
z9N~!{65!?Qq_<(aD6Jcn5^PKrmY?VI89{!{6NCWhOqmi+qtT;W3j@JDNebb%IA+n3
zK+HYS>6v2%D5vke{PbN{tLteshyK$n5<;|6Bi1@fy|hRfK`8VD_Cz~Jb-54pU@S93
z6zK&JBgsopQCKphpqR}>y*?|r$9;dubJUT@Uh+(WWb*6x<p;)b1&#VJiP3{K{vv=-
z$WJS}`UuZn<l}5y2s>H@|Ejt~V{RebaG2XTt~>Uj_*LvL5xG&U_L;D$IB;JS47}F{
z-)};uR!!em^C40uPojiB>drS^ZgHs-KDiT<Kd6FuF@cMx4{wvb`?ajQV0VA6s(XKO
zdz(&3%y0<Ghoh8Bf(EUBBlJ}Gg^i9lr=2`0rlab5g^+i*Kb+;~V&opOQ0k~#_?sXa
zjw;+&jps3kFADP_JNZ*}x=NvQx6hEi*bq!PX{kmU5+pb?YPXyR4}oFDd<6J>LmJ;u
z#zQ=V_-Lu#*gvRYYUBsvR<?iUV>p*34hm<aZ*D7W96>SY`gFz6@4pnYYQreZh9)PZ
zQ;ZqoesQw=#rnP>OG(j3+5Wuhqpb9ExeoPzJ4RZOG9S_GJaTu%L=)GYBG$3FTcTWb
zuge+^K8Q5aDk38x{V|r83apf+VF{_pWBYZ6Sn-+UzC78T61w-B{QQ4a9+F<X!p~mL
zcg#@J-dPH5BktDw5d!_CH6%4gYdW9P<QTH(+I5$YN@7d6p_;$FV|^8)zx<2k!4;2Q
ze<8=+jt#l%&$@=;tD8P|&$D8l0~en=CrC4DuuUzZaf9MqwX6A<TKY#4yLTp8aR~SV
zFaD5)S^WKED@oj1IO%`KL_tG67E{;AMPUAd9f_n6XXMef2PB|$BxoAKeGfH9g}~IW
z0)8O+l22byU%Ph39Zl0Uo}w=Sz1A*S*cS8G^a2NBlX`tAc!XBmai8@qGOus3!Sgsr
zhhyvkep4?_74OJ)fK1P>hd=iBl))yX@XL2JU+!yg7Q2)1p)P;gm1MpW!7=E|LK5wR
zeYKcJsBiwQqeOIkP@vzkKpcaj%LIt#mxoUyGzTSlnFS{}dHGpbFgGA~yUfap3(*{=
zdVcy8J+?HHY969lY{Aj2M|V_%u4X%ifFhxj=!s03Ozd6^LhPpXYe`Zd3F6o%P3Gir
z(0$Oa#zIFJ8a{spnA^ZD`mib_GlW5OPw4q4c6M<Q>Lj^KAjSjvNqX)Ev7w1Qis6O^
zlDjTQ{D|RbXr91cb_8KlPeWc?ZqV?BtlA}*MGx39*NB^vN#4MO8?M#4<Xa0<br2^@
zaBNHbGaOWL)YUg41v#=}DA3~h%7SIcBoc=gE1h~z`s;tcj%%Wahu$La@9-vbcMDc$
zWx!B?7bba~091Wigp>(!x<2;baWwNwy=GZ^9Vjky+zC|GHb9OF-&Y?$Ww&ecsa~x{
zj~&OWfBA_Eel!VdC)k5NJx`LH$49qe44~T{dxfPzO(gBWrg>tvHA52;|8%m;#W<gI
zB@@%g=Ky~)@^GY42mA9C&K%rJbGVI|>#k7~9uj18@<H=VT<Iz>9mHVDY@HzoV^0zj
z$@zBMtSdIThI_KmuaL!Tca>|^{rmmAG|wtvizM+#m>j^Hxoytmp>;ISJN1f87(TfX
zb60w_O#8s`PQ|JmB=<h)&nh!KMtLnGJ4p1j>q>uhC0S`#^)l@c6yX~aR~txTY}V$>
z1E>MJMol=9!_ajX&+2URL=xt#=;@~hY)^kxmWq3+PugwWS&@&CI{YHL9WO>>0^v57
zq;pi}Pb5HP2BC+c2WPa&6oV9DL$g<4OSR3Xy31QF`^!iB>Bk{qrB<=i>Sj^=`_HN#
zj$?o6(ag`Q-$so;PXs(_LI}L;>w$-QcRzlvuyfS^KPv8=jU#FO-!0G_4g9<z!a-69
z$zkdG<>PKiY;fa3jxvv02_GZSj)qj!mf_X#R;pE@IE1-SP#D!QLg6iBc;@3H^2pKt
z6abBrD2Fv~1xKb&a(BEY_4^Sze%rQyn^1r66Lsl(ng9;3mae1kx{Z7G<~l8d(mz~c
z%QjVJ>X;1F@oaD>WluW^3#M_Fs;g<WOlcFi8#-`%jhk(yOL;hpRUjH%9J4YrsqRKj
zM$2%1H`4Dm+8);McA;f|OJvzwL(1$<vJ7gB--t4*S!@|pZ^Ol8h=6>A;zYqMrv`s5
z#p0@zV+573j${R(t9LRVWUFEZh4xu3zC*|<T1^arZE-4GPdHn;HNf2^kx?IN;HytJ
zJkKveFuq>w$gFY!4%I>^k_fgHhw-<X_fD_$X2e8s?lx(eYU$no56g4HU&A_v1a_v<
ze4PuVRe~`<O+>UpA|qETOp2X2cWQqc1#s0ExycMC37@@M1W*&LB!Bh+p>b`um>B7q
zlJGv&7y|0qyDCnnw#A`Lf@+dk{X%2~wG_arsx9MR0xK*aU6vDRsE!LhY%HA4fc)si
zb%GNtqYp|Tf>qTK3{(+W7c(_PptD1>BFF%aC1+5pwHrr{EGMXnP-pW-TRnfmfNBmY
zs-*qSF_FNqFf9dFVJ&DcnriUBMKO-EZpLFxD6YD2L3vhGw=l;Z4fIs()UNuIVY7;N
zJ4u#HGj7Q}5ePdR7N`jx=W6H8zPR`C-Mce)6;GM-H*Fd)*NA@%QGXM$Z;HL6P&jgs
zL4qPmW}gmuPd<GFAnz}IW>SBDHOf5Lfp^4}F?<m8m}YaD&kW?F942#-)g^K85g<CO
z#0P(xBiLNh2iVnMs{w2=U3$k>v|9S)1aaM~*oBY!`NE9~-~x3L7agK+OvQx5<ZE^f
z?(FPb<um5_7Rkfkh%cT${X@(Rod9Rza#l@XEORINvZ`LK3^nW9%ZPtniM}Ot!d1hN
zZ{oVA@q`$-5n+IbUzH<<?*XvG==ceaNRnDp)pc1s7>@*E`W+4OKt?hwx1(yxBx+#&
z%2`$ENrLg^6dO())9VUg9E~GhvZ^HUqbReatd~#~5D_{U>dS;K@ys3zmS15B0LvL}
z<XNqd)NW0iMiI}@0Kb3J)r9*OTb7ZlTU&7yipPiaP3)Kh$2{hf37~;X?0QvJzg|WJ
zWdWX)p^0+kh8gt4Pxa1nKK(!gEes3*5e)-`LpbwpWL={pun)VROhk)&rk9-r`)6$P
z1e>mh@ayv8Qi2zeG{=bSKN$-nd<ZTU43H7XjQ}@fRF$u9V|0J}5Pm3K`=X1NZ4c9M
zk3+b3_iiuq9dHfc6Jo7vCoPkqOrmsS3Z&4Xq@;Z<%i+IA@bS{;$~5><8I~qObSXeF
zx41&J@~EAN7VK|`-TknfsB8wDz`8AlM&6Dc<UPQpb`rSDzbQ)CXQb4<0X3_&9;sAF
z_}!%>vqAh~Lm+>J-ZSJ!A%{iH(PrI#FHx?o+t&`3<+pLmH7kd1?TlE4UQ4nGof=16
ze5{uD??kv>wi%AY3VM4YCT3Xu-^~)OvQ!%PIsQ)(_xT?#UNaaAAxi3Bsj#c+;9?n)
zI}Qd9DOcdq#9LEjK%#>v8h;(j#Ad>~Q7E=TiBxP4O)P)@PWcHnP8<cYPD_x)tqc?6
zHq*FZWMS_ZS0bL2_DiD*{W5xlRO1*#Wqc*s9H2B(`QWv<j^#5Wkw<!K!5U+K!Zyr#
z_L|wi+lEVw7DiVeCzDvg9b8yE4d+al0dbxS4Zt3hl8d`M6MK>PuX)^KCnlg5OZr<A
zR=z$yKFEJ&EJXvYT9dsj21uS!kf@8(8Vb01RHN$KCOoediX5?s<x>$RM(g!(t<4lH
zZ9@|9!1uLBx;8mS6K1Y&8^=ux1<wVTze27}@m=6lVHe-Fb94uUcwO^m@ShV`JXbCJ
z=Kk}ey~E>9_VVD#?(v?JBKDr{9q+a2mlgCB>bQR_^hH8KBv^l5&I(_(4w`Nl>qpGj
z+3Bo$)tqTNtGa-yPFV?|9`z4!OVjeq@E!`C54b`~K$U9I=t$%<5cAIAmX`iFwoiNj
zbP&&XkB`=m0dIfSA=C>A-+13autUu;9R2f=Cr0bXvOCWI;<|#uWSQQ3K#jh$kKN%+
z899I7{m|*%@8UkEHfQ$IL*R==&h^laTEot4?$a@iO3A>pe?C6G#bmf&EGcW-p^t{E
z?o^UZr5mpEz7rK0p4Uv$+b4s)eDB%#>hVE#usGd5TAbcuQogDxh)?2tX`kuLOw|YI
z-DYCCI7MD6#om_reEXQK>GvM?9wIV>N|k>q6!uV=ydY;Ibsp0a`EF|}jiA3h(-Qe`
z2*=w_?2&f#?D!yZbof?~<o-6t)7Ju7*Kj)x-ZPWz+asdXiGb}FQ=ihIW+EQPiPpVw
zx7X&7?4wj9v!uz5T3rKO$2*bPhpZ9$BcBdoROGLH&Zo10j7O$xsguTbojQrz$(w)o
zA9U~C>)yZHeO(i`PyW;Q#l`HiR0}LUwg`cdyxr`Fa}j?VxRSSTqB3xsfP!VVt?tn6
zns8VIY2;+LDJRrPMAe6>9MN?W0&S6BCW!IhZ+_?@<hyvlG9EF9)dsaPv<dd9`M7V6
zii`a0+6jUmdYBxx*2QOC_gU9ILj!+?oTy*Xysk8WL|$PwKh&{y@vtl03CgYjZT!$9
zG<Ng4E0`Udo}Nrb(unb=uDt15WT@2`bK8~R7=vKVHXlFT=a5Ea_be*X^+lGuzI(9W
z?07ycm&-kU`pi4ZacZAEK4^Y88jZVJM&@yR26KWJXIPPUcay7Kw#9c|P5FPJG5qaV
zdgqrXN2C1gRaB&Ft?R@|FKU$H07wN<C+SzbOJdgA?}09kNmm}WwO7h62N?;C3!81N
zOIhP><D$mdrX__9i;B^GH!VXhCn_?@=Z#uomIvG8&yDv98{i6z|2%K>7*}Id;NonW
zzTf=|=-nRCDZiSP!?<vccU^zE(=Xh+M(@QMkoMm_38k{l=WZXI;hyc-t@{MLf&cY5
zA31R^pC#u2x$s6@QLlRJ@<~^JyS>tF?us@Qt>xrAShGzetz%iVr2=vNv--<Oaw<5#
zo(a%#>KjC#2QS!1QX_c*e*p_>BqjG-fgUfl>Y;sO*kD8(s0*mV{1SiHEy_dssDcKP
z_VrptckeLa$UGI;?#5ZB_QHlNQ~T&%N!{D5RBcJflwvu_&3)EhGK>p7^~w$r`2##A
z5QYG)nUAi`U!j3&7s}G4D9VW_Enf;Quj<xFJLR#FJi<AnMuLCtM3Y0gVKcA^fuLej
zB3vtjD4QP3as7t!)WLtP5pH9I3qV+{4HAGZsq}dfZU-~vQ|`Rn&+LLTlV%evP~jq}
zevGk~mu%Y9LBQ)MZv@kh^H*+;E#>2TT*L9MKyNfvEECbPME2buj`qL%!&j?nq4!+M
z>CvVw{1@Uo=z$4)pJQ6-Z8${k$~ZT{WT@^Wlmz%8dG6p`6m5SxxFeSn+!A7agd2n;
zvPn?OPtM=Mw3soc*DwN|tUej<qfw1)u9z@y!Y&eIZB6!`bXO6dVf9p}OfgLGyO;YN
zo#UlJF6RS^5ofRphXuAg5}>{=MhGtW1FCdaHxf1s8PHm1OPPj(<++N~hibR&Kx?fm
zw**Y$g=Sfl9I$^hhiHuAtD;~s+*K(KsL?a!zeHtLnpoa(@5vmw$sMouRs3x~orCyp
zNZ#~Og|PI?Rh#$LGOOtpN7%`k2BUDJyeGjwi70-2t2~fv#WF;@75q^C?z*A`R~%{l
z>$on6Q@kV>u*cGnqF|c=P?CkY6EN}bFu(iZx5x$VC%b<kdgti1*Euf(=!dxhv87<g
z5SqUMQy)<$|8OAuU}OK8?G#w_zmt3LTCDyhsD3$5unYW+NcQbit)JW_2^_CQN!igb
z7XvUHPIPc`%aAvpiBlRHLE6W#=}xw_rRf&wXmK{fqL^@vUkFgVSj-mNZGmzSipTIl
z1J94By#jxE)!qtWUY6(AiO-elb~+4|_6EC-Mt?m%bUZ_xbGY)oPAx^}Ga(Sy9myjj
zd{M6VoiLxwzm{A-8Y*sX7TyM;w}ulro!q%n9&Kxe@+&OHfF;uvN%<eYY=$iCdc$15
zL653H1f$*x!srCqXz3#k0vWl0hKwLE;kR$-1e<?Z>WLjmKPx>tUQGc=a<*{WK|GE;
zmo9niboEZJ8O0Jd%2H}t_ua$^-M!2Cc=X|R;Ptm%EpkR5T_a+H26rq3{UTRcgj`$L
zBN8<;&Feb&=ehHW_4C_@Q73oASm|9Ol}2(GSe=T-B;+sQ7~ZNNSY_LyA^sWi2xX5o
zDfEBAteRJ6Zoh82Z`xs^m~BWiM^Cj(udE!sal3mcGE_UBhh<)^*)>PVU1zZLWWvQn
z>{^vLy9NswzN7KXmMl@StyF3>&7nyqNN>@!6a+y)@@S_G(`iTdGZpEUX*hC>f@~D~
zNhSH3>Jayh5Tt3Md*<ZDs%LlQIqn^9s?vW=pZ@i>>SqaY4TC%bDG$|(;>D*n&Mo{_
z{5im&I)28H9a~blHg8Zyrt|M{2|!9ADqS<qQpjnXR@ow6d7n>b^rLc%aVZYZksX>l
zV^hyh?GKf^mFJaXQE%&5r;oZOR(AQd69U}r_o#4NfxMU`a&~8w&L$LT7qe+q7s`Kb
zc(1qG`=yJ~p`4r1B@$sdHM}#TkU;5&Td0?Hw9FR9PLy;?AxpF+V&>{7iZ|NmJ4*+V
z-%xEQd5y3E5yc4()o&5_xcFe|T#BDoja%XSP0^5R)PQLDOv?%6r9f(kBg9&6rVTKC
z)Uf!LHT{^aVJXAQIrae0tg&A9=-Ph>h5s(?E%R^Hg4LuOUrJdWa(PFFltiS_5O9AJ
zAbO<$hbpEb8Ia|AvFjT0ikIKR#K#t)`X6BuI)P0nHStr?cRqp-hU@h<K^5S$!%Dg}
z+$NlKwhiZvZdrHh@qD`7US%eW0-!O$<{}UiFzJ}4{|i(Lv7}O$jBvf}Y*~Lpyq2Z3
zIF4m^jb@I9FyFVP#_LEXPXL}v#(4Lnk^Wsb7vU?T)OR`+^qdjz?Dcc7toi=OI+eWD
zLh7~fYiy)<gi^~^SwGGtt^I#K|CL(|{olJI%UgGgeDL1Z^u!wT7GIfFXW-w7ugqJg
ziRIsWmTu>S<9_{5Kb-%ZemH;c=YR7vPl<QP`8np~Z}!t!Yh!K9Q8ER~AL&%czV<(d
z)mYG^-3&#gk?Tbwo~7U|W>6^$=FdswC6QZt*^zfw9YH8Mb8}l?c4YPT<coW~yZRK3
z#BZjsERbggdXh*(8Q9ggPP*hve0L(A8l_vU#shV>UX~<B<ts-T*O`B-F|LNmn%t=y
zv`w35$|EI0$J(WY(VTPzxD+D)y3B*Dgpe#EJOPAhQg}67!$O{I9(jX!_Uk4NRlC*N
zjg(hGDib5CX(O@RCyh^I1HoM}5a>Y6_5QdiZyAP;8`P~#*HCKCibT)F&B7J;(BOWV
z1p8jXlLU?k@miXtu(*G6n*;dYKCmxydzEr?$NOsmhh30`X&=*ygB$v8<8&~Ri^eJs
zXk=(!b+Qbyzfb&(t_o=A2hWA2SO|h|)$f5aFCVtE%^6J72AJ*^0QO~CxPa(F>{kl)
z6NwMybwmlDOes+pL@6dXVW~Q~0U0L7C3@6}Ntz;ttw5&1f^L6<jjC!IZ-M)=2k;n1
zrgj5uY*K|~?09gc5QFxrL;$V^W>eE{g0YR;!Wg~QPaH6acQh+TCSeO4QHZaj`lwK#
zHAjNZUNIMyfms<K&lB2-*X8rOcds92yYIwACnOi!XsR#YSSk)Ilq#)bREjRKRfm8A
z34#HSDG&xVypMnKAAX>O*%zqEsf&3Ei!d>0H8le^NJEUACAL-=&Mem70GoWclBz<f
zPV;ot#9O)wh}zyrY^hJ7mK4ts1$;v!6m56kiA-n*jwj9XA!{LV*HE}-%FL=`R83`V
zbFvWYTZe`ichqaO#$8pDJM(2rM=)Ax`a}t81em+`<}`mPj&hauQSy-+F%h^;Q@dLk
zk-um+IQGb<&0$5sn;Qm%m*6#Qs9%Q%0JpUZ$=rT%vbU;o7*nOyzJJlji^zcXET4!1
zCwz+O3Ja<ZuY^WUiV#KuaGo~ojiaJylrex&_K|4q>3j4Lc95ulc-&W5Qt2ia2&D+W
zCF8sl{V{)fr3q%)B|~G>IbyR%X|Ly+I%m7lB%f=GiaS|qX%F@Zh^0e;;0saBT5T1B
zeUDwiCuMz>&#YC0xp9PTR86pcAWFqB)QGW&-FVK(<EV<IS6sT6h%4gcd);7^Hi9Sy
z=(k&NL;*+Ba;I)&nAofrz=Wv<<k4G?blZ1`6L^2^Hyrf~MU3VmHy3a*Ito!Zv{+V&
zpN}HpBpRxb<AMuySa|f0<y|uKFB^MBmn@2u-`Ci<Y7{(4Tu+BI*at4N<Cz8AVVWwG
zWDvjSRh4aGR77TlaG$q32HhFLC&e91@kAoeG)FxZp)76^WCj*nrXr*poq2BycRznm
zAMSr`dS>=xm+srj7?B)yvbELxYHKTKy{NzKjY}ZkRp)c+bc;!Mp{;KRztC;?41sF2
z-$^OBO5PAw#b7*clz6x;Z;*H#6<#|jVwD3JOGx&+Itbl>w_&J}SVW&wQ4wJT#XI^Y
zMTMnt4y-s%gxi?O%4Y<~wA|l13)k|Efy;jsLkb6)MM6S5x3;p)N5rSy4&#>DM_vo5
z289kFp=>)5b~I}1)l;WP^31XbOKtX(C2MzoSsm_AptW<oero+B3G{yQsr15M$)B#q
z0X>%bkdOwh66x$u8T<2-c!w!3PF&nB1eI%@oLI%x*a|1fUU;v~Dm8Sa2FE=g3A=yR
z2`RRCM?y{Wja%|>0k+l2juf-`(Zcm&zdFvoUYwc-Mt3^OCxztC6u%qYqVLr|)l*0f
zj!))nPHd6=jE3#*XBGb;x7rZS->VyxgVp(46wU2qVNPy1dhgeua?`QHxgR!gO5m6X
zE6Iu}f#*qcN*uwH|9It3$T_vX@2h{b749-(7BNZ9AtY_+<cIF4K;9K&&`%+<%T4F5
z#Hm0c{p61RXru?6=Q>jJc(>WDt;UkMv#WW*HV5px9Y}E--ifp<^5oll{kwxU(sYZj
zU?=nQBWeotFn$DCTk3?DaeZl`A7M1i9f0PyS%Pp+2pok+ixB?g<k~4YaFc&>R!#x0
zek2H4l;$;0hTS_$rQN7a<Ygqgr9jk6TVln13Ge+waHv^97&F9er#52O=P?iTiWt95
zFp!*!F@tj?5e2lVap1~;d-d2Y{basB9QY@X={2(a<cOfs196O!p~g*T`%l0az-=+t
zJiL09_@QB^`B4-<KrV%7&q#lDg(nIy6T64c#0;qV5ZT9YS@z4#P&Q^7sZ*JPiB}AA
zQC4GWt08zj<d8JcK<qSYS$`dGR9JG5O*S2EJ>Jnm%G#EN=V?j5j1^aVx<_kQ_Ob2&
z=1C$RPjqsV<#dIi8fa359Z8)-NQNC<+Cj(t?T+=Nx^ma}1%5NF`;LDc^8qDbq3Hqn
z+r~Rd$%Rav&k6=`5!}+~B>M>GCwib(ND<_3`y#zMqR5ZWlFzAjIAV~&_M!B?QBUYk
z)N6WI_uPec0B%5$zpfddz@{uQLuQc|WnA!zDPw=fcez-#zAoyjW*UpocI$se?m5nG
z7tol9r(ycdfTkxK$_|7~v!$+oLA;6R0OCVaD<D#H7t`aOz{8pZN_dgNIH?^y840T)
z&Q@V>hSNs)kIlxu1rf~MiBg=qfxd4KG--OcWR{v;eHm$X6789Ep`=O*DLyRs*VdL>
zVmJOvU`C1b_a~fL!{EqQ(E<Wa63Ge*63O=E%3c?K6=GV2?_v=`186pX34{Uq+HMS?
zZhk$)>{qj)vU_sfEw$lBAW6eX<C&e_;KCmK^<V$DkM9O>N;;y<<&R-`QJRzN<@NNk
zm`GqH)r(Ar#$@ZAED1>JhB%~Z;!&1pdl;D1)&0?{=iYRGRD#(DoqaQKgw9c6aUgR;
z($3L8>5FW4c?zg*65MTnK;*gY5tZmmHeGIbukr08tFG^W`_&#ulCG;N2r+JF;}SU=
z<>ffs-AU_)TFDnm?CBCg%Y`AWZIVL}?nJ^;sb@`ic#_Bl8yZdPthj*sQ>jwihdXuR
zWS8R@4hDnPj}V^w)`vIS`LtA;a<%<qJoGo)>GbpK)}A2#>_mEhM0Yt37TdWy8inH~
ztC0!FgCwFY8zAgr;C7ZHLB(x)gYw&}Dwdx3IS}ngjf7j5@sYrD$6&oG>Qom=dW7w6
zrnNzQEWUN^4M{Uu)gV;Ebj_}KXriqZHLY@k7YE1tFP<N{<vVqUwG01RffbEwOF2ci
z_}m>4cc?zBvD>77fR>3LL|6E$p>UByO{x(?mOHYoTT8abWq$wTPe6h$KNItU+rr`{
zTn0Zhxv&Vzr$C{}))rE<t=Zx>mCurvN+L83%34@4xGXM;ft>~~XXkSb50NX7P|5N&
zT~yC5Ls3avIrx{Z4XUeLo;qlWE2rfXp_fze_^qhym`S>S70;%rMNK{TxRx;SXePTl
zN@&n(0SA0m>fPwQW+Ov+;lIa+6CpJ4)Nhk+(C1h&vIfumZLYF!@6o6_6<%vNz-<u~
zF{!xre|?8&m?KHxG3aGa3v!4cvkm^)4Oq>%UcI9iK)jIVkmo3b=1wrhkry7KgajVH
zDgl#dguQrww91=IkdX$rsg7#E9x34GY2kR`vYM&=LUIfVNTe-ECr+_fiH^{18z=C<
z*;Y$0O9bxn6Wxr>CNfM(j0Y2>1N8TDE$@rH$vWLxf@u^VpP%Dvguq48nXnHNoHpPH
zM0=tmQvjM^dfW6Gc`e(`0t9rps_NRe+*ZQjX`Qiu=21659ZdV~RtUt(kz~ib4pbO2
zUp}wP#Zgv?bkOl0f0_l--NVdOG?XyS({h6J9x)-@l-vz$qc4f>2SR7&u_aLY;6!NO
zmgUZnZxrQCg^{z0Go>Yb{)#_Ur@Co`%QUD;cTt3>s#fs>Tq?x7Kg23SO4`)6caX!V
zo&DH<%Chb4<sPk@I<g4YQw!>mNMo^(x)pZkOX_p<cUowanwM<ksHy;ZJFS@1mU7Oj
z2J2<84u!o3{WYl&p+KcZ^<V6{YAgrvsJhs^v*&$3cJ6dc7t#LA6;tE?kHO1VNPG6?
zvzGD&w3Mjxeyof4_K_HU^&~D~6r<ti|Dd0LxbG&2zLpO}MRZw(RZh4|k?C?>B*uc+
zwO^Dz1HX2rC}OB?wED&5buogZl*7uz1FqR;WW$*A{yI&#Hb5<heY3N6du=Z2#q!Q-
zdk56?i0OGbUwJCgV41d6^9f$a{%F3`rzn84)O^in*=EtZ=)LWVYqJsYyIg8TAG4W%
za=hFOp7DEk^%CZ{nn0s~p{qYSd!mnIkGo2Iuzp;dXF%$J399F?kSHox76-<K^mW{W
z4KQjOa#e3Y(XqiUsjs*z5qp!H3wg}uw?9L4dpU-dCuc%BuLVOz(0}%+|8#ZXM<&Wp
zbIXsEqTJc)8Mo;x@#r>#n00rRC5kG4AN`ZhgKun@gB4=QZRluxs5TwZU}Za`r5O`f
z>|}Sy+TZE$QA~2>N$Gyb?v>xQTIb?t=tiTI?3~{<%DMg0coglN#+$|_TJcu)Q}ac<
zKiudrZ+Ehv@W*JRqts2{zC0`-j(@HdXhmO0sj%?PVMNQAyn54;YpOhVXAd)f-NO`T
zzj*l2X1T3XFX`K$%Vlbi&B5LeQ?YO5iA{{(UsP_%e)(gl@y&oYz?)Wd4X|1kIp)Bn
zG$tWg5qqIO!(`eE-2og9E|TVjbfop%=~$KQOH$^EURS8M9o<HBoM8+WX!uz^g*j35
zS>A6%_(cIiVl*o<QL|vk6)(wupy^^%D-NlTL<~-Dii#X_(UBbH;ZMZbYr-7XF`rj2
z&d<vqyc(-}HSTJU2ifM5T0<3Iu`1-jZ$%YiS0L0&F;9u=X{6xYSkLoo3xLP_kMDNz
zwcb`tmZEZ%_F@>^f6fFATC#``7hiqzVz1CRj=Gw8@@0~lX4M?$X0ok+7BKEONn}n4
zeyHvayw2Mlvq`CTUvN6xL2lLz;Lz%=Rzf0ALn)5x(cR<~z1v%Gco=#KHD$hM!7#vF
z4L#(8a`bV%q8Xh1pBLq8_^Qs;ZIX&YQAd95Wq)K!BnJqRf$l@%SMQNnYcr;8%UyrB
z)7msuHUkAg$PG|hBd#fbCp-R#Y`z3||Ap4}FB6reI2X?w3XWSTH>gA$<&$Be3S<11
z%*B!&QF315G75%6%nbQP^-f-1;7hfvENSl}wLPr^O*=v-otk9j9ZM<v7ENdF0(WbG
zyV!Hpxc>5yDw&sbsz60n6_WVxU>I_6IW1h&Y;dyM{V#d<FL%3tzwLhi<Act}ci#+_
z5{&XVq)saq?9B}Iqtro29iS97y@-@=jbe0i^v?bUKka3QlOpLtYD!qmuiv}d=SO|}
zDDs#!%rF+{S|<c{D)o>W7IU5qrVv+oHbTH;oaOtw?=X5Xao<_0@IOufXRDQVK7sBb
zh~Z)aE0a2x#LhK;xlwr`%lGcyl@4nrnOxF8cuTYTxiy+g5>2?aseL^;6Q`UH`Cs$2
z4&FWhmkYnz0gb}6QTPne%)X|zxDL_Booq$lG$l<)zZzmg;bmtj+Epv<PYRJ!8r6wM
zjP$41*hPIl7X+QPpBbLcQ5bux^(7o|klNuD$j__@#E8d#`~Jt0XAJ@BLjxwL6l67E
zXCUI{EZaYj<eYVZm{fPex(A-VF@i(lBx=(H2D{93%6mwfy#KLe0e$SY?)5p~oT7Q0
zGvGzM`M~Bwv`mk$C4TDBj`7Xnw3tnbd6HK6ybMP>{aUF~HTEtBGp{5GnOQH3(U`mr
zb33`o0S|Y79rnqEo2bPp50W=2xjkBkU#OugHM9k4#Ip27-82+A^@V_D7h}7kqSdkS
z^ycDHJb8ZP`>VPgh71}UuH%`flIv>C(#97gmaR?~$S<{s*e8+)vP*z9_{`mU;0W<Q
z-G(+~JFTO4Jsv517}veM<CyF&Qh`7F7agvi73}YS-siqY;$iT`024J>ethGoO^=vI
zN#fk-WsqU#gud)<KYqUZY|lC*U{2yApnDpJ;C#*Gadg%V>%(TEp69U^%gTx|wtMd}
zDPkvQS)UU6)ZNb6=382WSa)6-e20XFu$%1|;Yd{X$ht1~jeJd{yn5kikmEJPA$VOM
zdydk7s+$V^O{|k>5c@i~B135#0088BpIgt@+e~I{iB7ifecHD|eJd0(2y)Yz!^*;g
zJ8nF7JjMpR!xg}6xt;B$dJWC2QC4Vh;!bt!<6v;GDgPqUH=*J?mPk72#r3Wvj)iDo
z(@(tlV&!*fa&coc$jIitEia<Re1u$Jfr>_dNuU}WhmNoj%1{f?RxKpH@d3@G!5sfN
z<cDoo3cvXE=l*j1wSW3+QA|N9d2l}~CIAl`e)0Ry<Nfi)AO(FW8q8Kic@^(r)qDkQ
zuO#sjf}GZ6c2Ql9XcpF|^^i<vV4>jy%LXh#Ez>J9F%$#$yw`)|_i}%5ht^<#)dymK
z2w;=V3GfAK$ZHIDbPNs-7=nB}A1>K$V}P=iTZoe6u$(Knr|%`Ur@8YXIjB+tk6fc6
zEQsoJl4totbY^W*yiPlGsvP!OE5dW~*Oj0m;hJ__#=H)pUTiUkCgH-2GgA*66_0m9
zs8IDbM-C+vx13(wobKpt)=uy^dBXR9()kLW-Q?aq4Uy0L^Qw>6NWgTg+cl@<caVB7
zbbsW$A%)TW&F^s+%dW%?Nx~=0W+$FE@{Islx6E5HzKd8Jf@&iWVwlF_RKFo^p@EO#
zWCs+p6u){yG=v2i(OmQ@P4p4hp{=bi89TM|v}|p4P?OXja>b?RlzXY;nMKNfG<i1o
z^<anEv-dmuzb+=PA7W*G#jvi2un+wT?kUye;iB$dx!Xv|Ltn{*sOn@mD^Ec(m|)z=
z2EQL<_4W9)8m%8h?nKOaeVb0DTSGb}I9rVc7k>;d^OTKbMs5en@c3EZeO60fkW{M$
zrRj$2&Bji)fevjz>$$;R;SoB2CXb|dc%~iPP^IP{qQ*2wtC;+SY8$iQyNf8Q!7RV(
zvsVLAk-6Wt-)f#;=##|?HFGSHmKCOrPqcKfgoTE@5k+`3Zw4VxC%LX?*WpX4$Qwn(
zV1y7b*ldm~{96^i`16Td(?MG*hKEZ3v>IMZ$LO$vpT_P<&G3!GD*<bN0o<Pya;((E
z(Mqig&!f6Rv8B53N`YT|gK1sjxx&dFh=Zc5BzpMvS-Z`=g$ix*?87jOs0<Y0SkUFY
z7<sm&P3e_Ky<20;d;iOXNVQtK^SKR@G3Zlhhl8WZNw@*jl&aCWj?_PBuht+v__Qx&
zEt1!<jD0V>L||_|d{>HpceQwkZg+AaTrC(C-`Lndu6y8vmp2DLx}P|apl$PN`&Dth
zk-Y)4zniTc0=1`#_{e)QT5*Y37Zuk~bLHJhQsv1B7WcP+6WcOVPGi-~h!fj9Hufg3
z%ULx+i#r>gtocpPkr^6F8lOD@v61lLRbP=7We*=dRB9CLKHJ-W09S`(KEL!P6~8IW
z=CTV1SF!bj_x#(f{1FtN1YD1x7AIl^lnkq;(7L;OCQ<UXo7Zk+nIanWZA!C;YMyG&
z(C;v@*-t+S0T)(h<1=3c=Z_Ix>nmu^@n_m!wX9t!U~G1!xuwZj=$T6V7@F3&n$GHd
z9ab=~g}vWX;&HNn0h+t<{mI?$d&YB!L65x!O<DQ5C&F4fOqdx%-O&2VH|>Pk;HtQF
zxxx9SwcP(;=#0A+J&le)^tjQ9)2f0amzqlB!!S4q5Js{ixIupTW7?57AR)i}F>38i
z+_cz6ac+}_S037M`a)V)X_;g5ClbH(=-qJg0^A<yy&ge-22?jiokot+cT02XcHl+P
zRNtw_$_+`h^}q6ftsCxI5;Z8L_7&oXNTw9$EmV_IDMa~TyK)aij8Dp#8dak3w>2U(
zk|<XSnx?|HRP$h-Etb?%g@#So47-<-Y-;YE2*swSq8s?q9-_xJhrKnZE*c(VP!$Fm
zf>F)_uP@1e9iX8t+`*6>5My^v@)=-Sr@0VP>zwdR>XbXC>+S@yQCqv!RqTTjrnkAz
z0l!lEjPMX_VhF~es(+ct<EKa2nd74+RY$?JA1Zh#d5!{kVc1a5<S5}tE@d>}yip+m
z*?@8m<0`~}NQRWHD7UI<0ATtWU5DHgaaA;KBcmvP53md}vZ`vw=uvreynA@;x}p(S
zaV=#XSqvBe9N!Gc!zFQurnHq>m4U*HA3JeYTxXajMr?JC7Kv5+3AOOq!QL|i(S&Uf
z%C!NeukSk5f4p~i+;=6^_uoJNX73OEgKr)meJU^YR-k8ERG&}59*;`I^YS(Rb}WwA
zEx&|+dLN8Wy}l3qgWcn=Z|sPc;9cdavS=BLwc@Pk#vNCSiO>EXRJ`iEO`XRRDyFm7
z)yVOmRL_gMp6|MkPH}V@efaQGm6v-kSGl!FLmu%3&a&_dPGY@m5#gd9Wz$z@^`{x)
zkzcw0OscclwWFDcCc_L(oy6G%1#mz5EQ&{e8h8LD$hn_A55m-0ns;)F${BOij_|xv
z7wvoZGe=@z&#lZ8Yf@Yxjx|)EsA{E~lp(y4BTyxr8t>mBYGlUVxW=d)nt3a<7E%d2
z?%uiR*SxkIY3VtAwEj{x>GOqn7xL&dM|G`8eM4<pVj_$Z&aW^_YC>&Cyuc!?Bj%ES
ztDGJ?f_h~iEbE-_^)E^%Ot^Om_>=e86rXDK;J5lWBcRz%fM4wh%%%6T{m$G5x3-SG
zwj%h8FrXkLaL3^D>_U4Q*{wROh6lHcAWDV8R55Jz68mHCIv<Y)+>M%YalzalTrzh-
zR1H<1w=`YlhRNfTE~;-_N3m!+rqvsNS51Yh7z#=a=!IKN9i^^{P)KIQ1wqgv!}Qbr
zrImWnKO2?t8f|l~46J#zS46|u`k&Y<;;Xai`};&(oJ|vth<D5Bda|{(3RW`4GZFjv
z1xwL7IbEFAt{A)Veh4OOlE9jSSl#<$u#tJMb3X(GpolenYYV5vom*caiF6u&uU?^?
zsoLad#$SL%Nb_oj;AOW)E0f+PehTk`h7#6%Jt_be(D2jYw$aU2Kmjm6p;4=_RxltZ
zd&S2^3JBi4k3Vu7MqE2K%^3?}rtV^op#a(|VFVDR8ArU^hjb6TG3XsfB3?f*J=X>=
zV6*B2lHG~5^m2^$`@*$LmqIOn_^sP;bPU@Zz%{Ja9oc)$=Y#eR4gYlcD$gy}7^ETD
z7o5wEsQoAiG+H?_xQP`lc_<2NO;kvXEL#Fg5L^rI?Oit;+M~#_+=z%WXh0yaVt0m_
z;zOm)bu3q#=?O>ICig7)$f;?On?X(`OB&&ik|KDxIpIs0fly4>lm;n(-}bmj8Yu$P
z6@a@c@v0&o6+UH{8t^;<C>Rp>dEr1ZQe4nSQ?6#4qFu;6<_XxCCdx$6_@M{8-iU*m
zRhwnX7@fSWtu!Wc8bxhhrxOYT#(c$&=VqrllRJKE%OE*+wE!|2Mk`w8<DS-`B~W0{
zjt+@jQ%C{qyC%`bv3p{FeM_<&53q~zb(3Mq9Yr`uy_!~qu+#HJ<6tbHkYVuzF^fuy
zXrzIN8at1;bdM|zV&(V{2-U%fOFe4?H~@6>+~^Q*o;U(9L}pErNeDNNeHL>~)Up^Z
zT-(iKkvHN5ccK&$!J}JgThnXU>X;<9+Mc%cvQA$$8+uw!Uac*Eux3(ZmOm7()N*S`
zh_2?kN(PNPK{8>{=lv)JNx`NClBh*Q`ViCPnv)@Q<M`37Eq@AdUAV#MkPmpvMssLU
zHVwC1alx0;jaXHyNW7(QTM-c&niZj{FDtqIqmzqa-&`-!9whPmn$}4CdBtS56lLRh
zk&OQ&#_An=y3(<K+wo*?3&tPlKzulUna1|8CoqaHwgC#deV(5#+=;J!Y`%uf+E5hn
z^)~$)U;B=2ud7{qm+VJ>G-ON4^f%Tg28>9Ofp|V{M?1*Mm5WP3Q~=6RuhRDQ5YMg9
zEGH`&vu?oYd>^tIuJvUK3CFL+JWEbUogQ3GnYZTX@2p{e<(d#jZaT)*ieO^M<^q)E
zm7X5xPDw7#b4usZY;|rZ9w#O}7fVM!Ngk|RLL$_lE%gpe`3fqqmd>WceUS_tFE^i@
z$jHZj&6yN=&_Isex(L?;gcoa|uo$W4k$wLI`vm}LoG88HMuSU?{RERk9$>r}%}d$`
zlQm-_5rhkWWp^6}lV>I2<Zz}*D-fV4IsyJ|N4k9zU_dv<5Zc<3_9Y-@YYU<qL+yRX
z$uBnW{g)sBOw?H$=KiRVP$TagDT0ER&tp;6HxlI}r$Dlt)Nobqfd(LH6dAsmYn*!5
zoNL4y)n1CHzeRw0E2D3EupZ4bIFB%(<soB##U{6Z$w2sGxXQ|VXaSuJ6=t~IM#op9
zUu<t@Y5<Gzx@k(vvNw*u!s*#8RvNN=14Iv@a|BvQyA(A5mlG6fMiJf+Os-4+A0wjt
z@4k!Xjfiy%E?=RliQ~#+IxyJD8eAS@ghBS*t7Ed|@=W{MXOQ?y0Z+32O9@rD^fgNR
zKz=fR;I^K-bC_)&e)%|i@ZiC3jd)5_<9~5H2kZcyY_M_v?){ItcisR0=J?+Iod+N7
zeEi9O*^v0~;2`5F|E9R^zRpMN!#p?FmfOT-XPYGW(8D_7Z(pzlLhmCV@2le4ef>gz
z(pcbKWGMaF!0n5Ov1qRd{5IbvK{t%0!c8iF!xfX*zi)durDT0~R*(fF2T|m@c^O2H
ze)=i<@y%yZaWx9TNy3#6B~R|?n=YEU^F6+d-#*s2$9x;tSl0jKNQtW~shUy8hz1oF
zY#Zd}&S%o`Q88CvvS%`#jQDmnD8)G9PM0=dN|zRl^u!cVqQ;||RuV<2Pw7xh&1SQI
zc2v<)SoHpc789YHJ~;iCKf3QU2%6Qk<lp>H;)0RccG<0;#68(b2inoX(frw?WNh{@
zEQ_@4y>iyabzcO9@J&(OZ@jOgdNLwRU@{2K8Ie{c_BB)*8RxrQwPlk_Bi>NBEuzsc
z#dL2Ri07egmyJ$3Gs_?B2B$h#ILugoyLqF$HP+buXHn1~`fX}Ej@38t)%PA?Mu8)J
zr6t*Lot)9$n`FJ8F(!d|6L9M|E*@Z`6IKnBy2ZqR91Rs}+Kh!Bh~=VYwuUkDI726P
zmRpu{m2S{c1A_M*PC9zv#Qa)KwXUPhjKVNZUKQL3<>WOY>MzWm480r>Buy@V55x{;
zMI__KEV_vhv1YZr!c^I^tCmG;3w};gEbEoB`QCiEm>L2ypqj4|GntI)*dtOV5xx}&
zxDy#Lyu+pv3d-riL=QM&fM$CeXi!nFG-<_oy#CV~w7iAGN!+x<a%$eus)b^G|M7=w
z@{Rhm*?fH{$wl*!uQJ9eTeeAm`HWIxl`3AVuRWW=2D>c9<3CEM6yw8m3=-7Gw$P4G
zHyj|J(xeMtq~f$L=bWIXiQO%JF0mT$1-h8!^T<i8oDCJ;-Lh?U%n2amCDu<R+Y`Z4
z8RQYr;Dubl_od7Q20S%Fshw7%Av9-ezMQqyLl@e1giBjB%r?K;JMJ)ld9?fYOZ;p1
z`0>|1181-0E$x0@p^SjHMX(6@^@^1mONq)DcO|u`OPE3z81M$%dys4?)hD^00_v=+
zks@iPi95tlC`pWV5B9-3O12!eX=h(Q+kKqDav_TqK>}3bbD%~nohatHLF$A^ccZRD
zH+6@ZoZw%K?X$JzX9Q+{04Ovi^%3#7^X#9#J61d)QRW6if#tuI11U7wNBJQBSCM?Z
zPeNtjjVa=Z>E^wXm}~`dG%+s5cQ5oL&8f`dG!R+T9vfjO+gud+XA7kIvHtLb=y1o;
zkqJ(^^cXma3#OOZ+Byn3-AC6{D(B_g!z71{O&%~g%7Ui&$BU7F-haDwv$8`?m&P1J
z03IKYiy`b`qwCKaImUfr2>5IOXk;?%`5tCRM|(+qCr5()d4w}5h#WyX=?EcV$!5KA
z^%pnMIg{oVlkUqSA&}n{r`vA3Zfhkt*nK(ZZAhF&KJLNxga|MXjO8PYWbk6LX4%zO
z#QnQW7!zF#GF4rF`G~GQ*>|8BpkEVHF6!1AY`ga8iz>wjfhTZs+=-hG?WiYWYoz^E
zdE)E3&|Y-yZ97hGMt4N*WUMJdn320KkL=y*CO`hP@4t?e3lYJ5Y^rd#Kf|tFbt6HM
z$3V1TcZ{~VdJ{g&CrFGW3U(;IJ4(B+V^R#Zr=#Rn?wr$qQZ621Rs{7Fcd{vb?F@@T
z-4Zw;w-m^oQSn@q_CDF?siaTT4w<6jxC#a{If!HST%mZM=dXpW^f1-SS;Ac(;E7C&
z6EV1@;BzPauz&|_LWwUW^gBBE4VVHdcYIauq&Ye#8p`0=YhX2!VbutlWgx$4J{s;a
zo*2d{%u~957u9sXclXz6b(UHX7snrVpFK5)$0+_#Q`^M>!TwW17o4l*99s(H?;x+|
z5)7t-n0xk;F+9wTFajFgflrvHAQO%!4-0yc&dA@okn~)SXERyQ1HofIuSSRrHyRy0
zZjAVQbEJY~Oc!(GGt`&O&r{r1FWL%UtynEsMr7cBj}(iR)e%BPpes0hC+p;DZjgW>
ziRm8Hi}5(0T`QU+Wj3=t_|%p}=xXLwV`XBKP=PYkRs3*P6vH~Z|MABOM0->@4P%k{
z#v_KwRzKJ9;&J{%IbMt{W;q)blZ*MK+Gi$J)Mi;5LO{fP#jf5eQpuU)Or%KwU7cSw
z77eC<ql!Y6dUY<xFMwPT<;zKZia$(L!#22Ubw@YL4FJE2d{PINCSh4LZc^@2b96;w
zk5NPk>6Rs+)VzuRU|H$J2z^ARNID-~>)tt662V!JFZPan2R|KZzN9OvTE<>tm~PEb
z1A2^jr<XiR4kvKC(cFqJY6~`CW#9+DoE7JPgN*Jo1%PqH@w(%m&<eYl*D<jWIH0X9
zEP>}at=Ha81<7?J`X39$g@7le7-itah~?%7A8r$BWCBLR-J88ZJN1r_Xc>6D!43nS
z2PqAg{WJ-@C_RD%q}Y|N2bu=;Z?XhXoB!AU%m3&9_y7KXxH(xFK7m9aA$;FR&leeg
zp)@oFM2EQqT?<pVNEfte+TFLcg|j=A!$&HEk!h``h3ubF1Df4-AwNv{WNYgR7~nbq
zYEla~)fYgqb{m_ljF_8Gb|vD&kKtXBIb_IP|9!;GG~;koz=}jZ(m%j(tIpixZHxXw
z$9q0vlG%{tGxj4hFNzRlqbJYZD^t;b5DBlQp*D#mqX&KP(cO;*ddhu}%+Q3RfO#Ms
zZxnwsm*^Z2iok=O1KnNB`ym1clJ#7i9H0g;d;|5U7C9TyJYvmKVdPS93&v$F5a%ko
zV-7}DEpb70(`qgVmNJV81edq!OYN4lMP;;@_n@MRm#~~%Y%q;gj`x@CE}t`hkB~DY
zLg-gBYRK=3@BDcY3<|<|`RhVK7jQh{K543h=(duN<rwhli?w<KPg<JFK2`E5poPe?
zsxJ#bLy@mKMy0HB3RCFgSp?I`eZ~y4FD6OQQ;-nMf*AQuYB-i~I9H8nf#-{yH$nEj
zEQ{As9}M-rr|~Au&m&V57`kVF=00%iq4~XL=pMLAxFpTMISU^&Rq4ukWMsUri$_uR
zAt4lR8ifzW+pLngZ8HsQv=o7_xfoTaoMB-&+*C$dTuBG)p`S3U-FV!ZzU8!#Ogc(u
zB^V_1Z!sC+43s>g%$2CFutP#{nBUdb7Oc_Xvt1AN8jj*%+l!(C(lyY3G()xm%~|PS
zDw`dO?wsWcdrsuQk~XI|(7L#XAqA_e$seD5sa8^t@a3a*U!Jb$kMPTT6Gte|jF>O4
zzOGUCsziS3#@UMS{T!#@xW*8@Sg_t=b*<;3VVhmYcTvdY8S5mM&twzJD%%t|s=@Y$
zp%Y!ZDF+q`<c}i6Amnj>re<4B9ubYBig%b<oiJL=mJAjw{|1cQMLrvHAF2ZrQ2b4m
z#l#hwfF?W-=m>@Yq<6(+`ErO49|fBHv>1s%q7&??Z*y9#VVflnp9HK-cj?0S>)i1?
z7sLr8ZJ<gc5R69Z!*D=9ldXSM(i`}!8oB$*L#awgowQ&I@o`CiW0)NN0KYrPr_;V~
za7c4NG4MSma>I05n>om^+8jsEjK~JC!<!z|wadGHzIuzs7oa)mHRPC<39^Y&O#mYT
zyy(>$bvGvbrTSg{^<V$1dMwMO?^qU?n*RE)|IMRTCt%B`m6PaaEE9W4d*=g#q<{&x
zz9~?Dd#eGaU{Lpe1V`E0_L(y%f5YgVK_6vC*zd#ykor1EqlySWzqDw6vA2uxo<0+9
ze;uB>lp$==%|+B%<EBDuFxKhq0F~>VcH*k_V<suZ;F$2nyJui(K3nB20Jf_S$a@dA
z;D*&Jhi3R^W#$B6{s6Zz|9fAcbFuzQUpuron}6L(cYvFJmfrW)<_X;kzv$K>_-K9;
zJc*DCbPM>9HNQF6=+I<~B^)B|BE4o-X-rLDNe-Jz`x2+sYJbqXx2gqhR8OeawAV!T
zTef?N>zGU)m=elws|O}*zhchwzIa=!*`}nX5^5|8rWswE+MYu)_o$tqu0bY@B6xsx
zWLdYlwmzqS5*#-*9VMdH6{TRU?TH>9)E_D!nHz~p`<^4;0eh}l-s1HgP-zpe%+UGW
zG;(erk<2yv9yA7;C=}cpNoEv$D(i8aLd(19Znf_9vac%8!PQF0*8QGW`MJ+i&1369
zFWY?Kv64&?iUNL~TbXEej?4Lo3@CGetH1|Um4|YFtg^vIFw7n7Z)iOI#=YL%-rWsi
zeLCS4h;MDH^+^%Mgml~kbI@?pT@e<I%^@@1q-OJwpJ+q2rE7iELpT%sZzZvr=nG8C
z=IyY$@x;)~)1_mJjN&`kc%psnsP2g?Vs|z)Kl0IcRtLTy^)a2DxU%3PR2K}?)B3n)
zDqB~77u2<)+}?5BhOXOOh@t;>>+(r&Sx;+AXU+?*m_L%(yHs~eM6-s|O@*bg4-hR>
zT}`O`F7fLzO60VAUU$dtmT;T#<>Au-sLEI)<a~PDU?#!Z8UtWQ$}t%9Ksdf!?kE&x
zBf?OHjIgyLg_(sXS_2EG`RjlEzh;BP&^yR~{`!CWf6}IUikzY|Nv?oEH~IagPN^%Q
zh-$1u9Fao>Y)c;E)N3uFJo^4kaV>?_<_)$|F4An13WVYZ>{5M%D?%ImZ~yn~1qB+p
z(Y<O=&!!+ab+RLGFh{@Iip5+h;zNk~7hSkcn=002#%u%HbnObBBUVB}AO~Th22JvR
zwtB{xN!*}u{aVTNGyn;duMf1VXXTHixIv<ZK*K1%oy8?3l&TZyjO*e;08t2nHQ3Qh
zd9Xr#awcdPGUjz8xb{t6`DyD2lKa+H9vQVgflHrxwHSd>%w43pP$bCR?3t2IN21Oy
zskilp1=7R#vZ8Z~RYR88E4pxHIi7oe=p-X}$YlfNK_6AavZ%GLSy8(MsQG&qaE)!}
zM0X1oltw#aO?J~QQE8s*6&y!RRR58;(~5IKszY(-_$Q1UCaCbwPgz9Zv!DH+pISe4
zm;PDt=;!>$waNIF32vh>PV79%V0aBfB-lui6R{MtMJ@629$}|$zvDQUonC%_f|vwj
zl+PHdXeEjJOXPT{`-hC<Md95$6Q>s*i9~KQ#j00Oi(VGh8$^wo8$Ecx?!MhPO}CLs
z*W@E1-h<Cs%NGMGjR`N{4s-RYEHth2KoW$l@U{Uep7vplJB?~9#79chG6=Yu2K4)+
z!dz=}5?hyPj4eYE{p<W5mmE5Ot6YRqGk2m*PSn~Gyv(k$#WhYHAOE&bk|$+i#E_+M
zJLnRn$5ObbyG3s?+oV4^_M<p^h5cgpn6j}ybn|K1MTmgZo{J9`Z#|~F9ZH<3$9!48
zL&HtWW_5=~_icmb*rIzJsvFx_-DY}|x^{mOkLFS^x%^wPNzhwOk~esNuR-C&YUHGJ
zl*-AqUzPK(7pDq=v(#wNe;jkqaQ17}`!1bQNdzjMdJ>8nj;E!I@;sLMj4;J|KAX{{
za^)73?Db|v4=N?c35&a(?c%W0*h*}cK{o60^|oq@CN#2(!xrjZ(d>>d-BSd<b$%y;
zrMKESWW`aV_i4`K!(+;SDtC;GEKjN4WZ7AhMP|(=HAu|5G!`X+Sv9cF*&>bYU+_v+
z>n4aDQkCfZxwX#E3(@^)Dr%2YNaYm_VrRK}@p(-lN$h6XE8J<b#I`a}FPlWFTC(n<
zxi81+QK*hO@Y%--a#49y9m6E*bJ$<aa7GgI@_k9nhkPJQqdv`l9)8VlJ9wts#o+OP
zy@gIdrc+g6a!RvJoWm|dXC2!Kb>E7E>=sMCNsD0jj2(;X=umg-`870rRta0rJk|mu
zlIBM9(t|D_E>Vmf_bOHe#De%J>Lemwo|XfJ-lnlzD;fB+>b2Kku+a$EU#*ToR6nx#
zQOy$^xzIg=rg0j7z&kyE_GESHmCkBlb~SC4lRt^hj8IugxF$Kb7flZBr)<}v_YUlO
z{|9h%@5kBwomsw=_4{s?PpJo%tMw;?r(PNYc8s@6rQzmRs6)&RsXbrOw*^}e1VkLH
zLZ%RH4A6Z`4y+o>6(U_}__%i5l!SLICa)&d)x<c2!~80LjN>PPP!~1lAQ{H7!l`dA
zCO(q2-RN)~m_YFbi!1YSpqr9Ebf7QVehAdX1s`(W-{y0vxqU4$qg>0lhiP|H&Az68
z;p7BOyDFkZGacn`ZhRH>b?MtE>@E~r4!3&z;_%3$mbW5u?gccjkg~9(*G2MG<l_~P
z5=CXDXISiiBMnybbXHvvXlPVweA-Xh*TUfa<TJBKWGPnN^*7UhyI%u=kM1(LV>RmT
zLM79E;qEAe$GP`ggB!|;v{$oWGq^#b8hnt$*L%B9I+@R>xW3M>4I=(02(KY>vy<hq
zG=VBwAwMH5fFnkS1-F=)M<;J64AjsUORpA41VdYY6~c{py`HQ8m99;#JTjLiqzhsI
z99EiySvl;=JJ53rczYhYkY=C{K!PWOt8w4LZQsG;TkfH*wbj)s+98U9SpRTn0WKsY
zu~7-#gasG*M%(HwWBZaj(Yww;L86(`EXucR3=?I~OYYTj5;!D3fy@lWB(2vT;t1#J
z3>HLxY&|Mz%}dj|L1f8b{&l>AA*18GHjX1<rVxX-Cd4Q{qIDxKNi~v3(WeMZFxTAD
zT#$|)^x}e6HOd;>F>!@do!pBQE4%_=SQRfrA?{*H6t+M#&q|$Sjgh2bAhZ=&r2>0-
z9um~WoCC=66ppfpg=(oib!#he1r+{@gstO$*(^!4KFcRHlOy?DxN%An8p+y&2o`{9
z=W_zoEb(yX4Oz>FZxOPCFvc4GXT~6019V4N$*T4IXqp^UL&HhVn>XVWaDAc{s|;<<
zb&%nWqvD5>Ib{gNM;}u;kXu`U+Jik4AO<GOYl#1PiQaI9Wfq*s<VG^3y&EHS4KGH2
z%<5%5xib%zb5Zv`)=aH=<X)*B;1*7*GYG1jy{<DyqBXahM*KErjEK-Py;~ezld^lF
zKLRP#&1q4AVwWw{C80vX!l~fW`@q<qsd`t&hgm5Z&=bx=H)Nm{v}CFw2&Cq#5Q>m=
zk5{;GMiC^ETeYY;ac}d8*0ykQ)Ji;mz$KOWu6mNHz_N;q#~z@dbS9UYI7v1t!eF9q
zagUxZ%F!H<%w{#P9cmks{vQ{PXQ;#eBcTElr<)2ERw0%h@e4?eSCK0GNP(z>dgsI=
zey@pj>iYr`vm`Y{nyIFj1t()|aG<$Eh(p2A-s8i)W8!UpyL-65`{?N&;kL7XhuOwr
zo1RG9SB1NyK=wxE+;?U}p%)};g4?9(fZ)%r8SWiFF>wo{uSLI*`da)u^T_DjkoG=t
z$!NMq+zDCl8AL2z7k5IE6V&(%sWRed*VXn+vx<kJxYV0<$})z9HlGkn#c}6{u74>Y
z9F6zUTgx=@3;*n`oeK?@6EB#5Xx+V~ZUz9C72WhNS9UXcYu)sZQXd)r_*?Sc59O-e
zpUlGto$TJ-b^>Cun8Dlh*cEUeJcB;(d{nuCB1cruiEf)fjJ|jGZu;5r{<FRQcl*zu
zy!fu~PST6#PmbK@A7@+HCwKLH2;9i?{P||uuXcn!(wtm_2?^7s@mP0%wDmWkZuT`l
ztvBN#bQ_b<&c0aH*BiQUs7o2T0407D*8y5Mo%6;9A6s2TolDldtiR=89%lI!!e1p}
zf@fDY{SNA6&7;u?&HF4UztH;D?o69JUvIn(mqp8^<47;1hI`W5J_qllBzsKg_wVdk
zdk5MaCw>;6Ys#1}e8w1m$*6T)DR=NNn)TmhgJ1rLy5IcrNB{KAAlu2z=}QR!Z-sA)
zYd_Cd#4Wfe=HDvC-dsoP+o2l6q&te}39}Ydoa~-xXTKijXPbBG%l!VwpWNw$w%bxj
z;6OIxG3lFOiHxzEcP@(`uqX)@nJ$gA)^lTZlXjG!7khtR<fBc0-KUQh@C)xj3J8nP
z?yPvbG!p58Y=sD~r<yep$O_p<VG3Z%b#qvogXoSMvwWF2-8tc)E<V#-M39Mmlurb`
zxWu`LWg_CDqCAm_@EoU$T!Qt8WvZVY)kEWt{@sJrGkwDQ!_>dR=Lt}Kv%<9y^(+`-
z<XKZMpCY`E;qh&MD2rYZaz(t)-U*97_aI^POg8kwr)51aCJGrggy}m%-DE42^c^V}
zR)q*M$OFHaQl!Ar)7>x~<a^-7|KcRA0%?}gxn!QDJ87vq?P$%s@iAF%z%Nqz_3*BF
zx+I+-8U_SrD{~UC=U1iz?0cjfvekk<A4Tbrqc>Ue(8{WRflcgR8*qNJYBoex636TT
zCt#qlRDO60F;ojY#3R`gg2*hE9N8w+P{0!JaU0a|Gq4vsIN<|Pf~fZos@YwZcZvxq
zs-k7nLf`Np^X848Qb)~(!C}cR@Y9lp{^05E{`2F#e>rxaKChPa0<)+y)IW==;GC&u
zi7EjqB0BPaquryY{kT3@)iCmH<g2?vy7NZ$7U>eVab$iptf`Y7JwDuh);;=qx9e`M
z_~*y>?nj^}+J&R1P{BVvisz6zHH*Je)o+>yDd|--7^&`7!)P=bRr1x*5xfh2%DyRP
zr^T#tBtssxZ!;ZnU*55*^<6?;FLqxZfBk50_i*oj5DqysG~Vysbu9CX{U?vJfy`4s
zO5ZTJWh30GZ|kAJYZM{#Pweia7q8XP@kcb8P;ne>OwAxT;^8>-a6k?u-1fS8HnKwl
z4@-{8PwNg0X782usIS;bee8>PJ=|C(XXVuGGrrOI9HDMXC=52vT!D9t^0eg$Chdg!
zeu9sGE9A&}Rcq#+0weYB5BGMTKI=Vx@r+ge0SJ(+^V;$LG~2tU2l$Vpl=4&*wU&u1
z&0>a5ZN)VRB&mD;D8(k#s?-qSziVyniKEjX>Vd3YQsH39Ly94Fg7un|1linUqoN0n
z#~_YK+Qsgb+s{!FS66DFPR6ytc?e!lW{J*!Rml?&h2VKVgB!LutocabYiTbhSP$6z
z<=#pF_fGbV@PKG7?&+FbaZ8XC;;GU|#IC6|EOR<XeVg2Au9G`EJ6HLPOvv+U(w$X^
z@Rv@YY3*VJ2PnQe;CRgJ5&`1NcVIv!Rv8^GbVDwjR0k0pJ#qiNr}<lxU8k!KGYMsX
zQ<|J|siz08EGsICK6mSzGpqQW$mq=~!hAdtu;S(?ckgzP7SOS)xVzdtODF>Hp1~``
z3^+M&J(i-l>Fua0y}4)A6#*wb-QO{0Ivg45c;Md5BNOP(G&@*dmQyISC(&Ap)oh@|
z0;yAXvb&#r<eD~z2GLLI3d<pelGurVGsptw{?fI#%+eB~BRx?mO!mu;M?sa}&!r%U
zQ#UD|WlP<W2Bq`5<sQSG76y~Zt8&EwplQdPE4cyU<x^t{M+LFT?OtwSL_7pSnDU?v
z_So%QYinyuCY+!lCRcRx>2#1yt6{rCEpj#SoOUb*Cd<3Ljp<;#UCht6U(HT`KklJN
zfugOZtWzK_p+#v9ztbigw_9+Hq5aK>#N*vGIUtxb+{&?4r6&{jVQkO${iI#corBiN
zs5~{p<M*v-ogL$ykH*=<Z0}!opB+5i!{s9HCv_kBmlsoCgfeyW<*VUY^6Eosb1kS+
z#YQ23bl*<6fi92gJhl9|X+`vZq_yK_rJ8^)xX=5>a{DG*C+wXLDjI|<5wL%ylkVR=
zl~j?+!M~+qy{}8Ry4V}nkhpWnY)Er)u@zIe{;hdneAqZq_6gUGXWXD1ae}>xTDmHS
zx*RhU@8a@o)+?)Rzx7A?X&rtQ#g2fJ@|%QgfN=D}*4{~X`p&G1di!;MF&b}2w~_De
zV}tvWykyUEYDvRJ-0=g-r{%X2G_{kxzSn{_e<ys^isP-6oVhx>LIzs)Ce-WL5DZ~?
zf8S=0-)@Vs{&<(&wA0?c+hP>vQVBigRlHN`FjKa87_cK`JFAy&d6KN5Gn>?%sCTQ2
zOReN)ZdEm@-T`ez>2?W!_srr{-iKElcEqDJ48GZhfD{J6T}+R^2(a|Hnl~&PKtNEY
z4=FG8PNss?IHz|i^{8+H^N0j9z-=0%9=Pn`f|1!zo*!k=W>Be7>vWeFB!66I(B~8^
zEmY83Q&ke!KadpCbKG|d$Km&thn#Ho!m)53gqrzbLo@h>J0&!KVCanVID3h2#3SYK
zD?f`z2hSz(vd<t=synB9!~8*H3RGzpZC?>R49J42kL+{lOt+kV;l#5`VnrAP&r$_Y
zzwA$Lx(qgj7Iq>Qsjc{i@l;@GwG|IR<!jw`H*IFh8qdG2oFY1k`lKBxrCM`kzLiwy
z$wpL0fke8xb0l$pW4a6SB=NKn0$pDE5{Kl!Vem_v)8GDCEcS0g(qAo@o9<H(a-8&i
zv8*VO0G@ziEU=yP>)`Xdxj#H;H>CH5?qSf2vSirNArhb0NUT&vNIpLTNr-1q=GwYr
zaV|arjoFH;nIk5{I+FK<e_&vZkNpV;^JiBZ=m4B7WSSO#)k5t*0h$Mt!ijsl8%iX&
z>(}bx(WpV6zP%QX(*vXT7c;07zJ&V)K-G2o<CDe=nr6Wi<?!8}#7A~pE<GUz+rUn)
z&Z^Ni5^9&juBzO(B|0hAM~Hj;PuUS+N$LXb0yuf*Auq!e&w4`is(I6E%w>G4F~KgJ
zh{*60_@r@v9#sj}{UI+-L^+n!>0@)$<gmBnGm+Gzb)V%>nCw0CnvRs?CfOBpqg^0+
zKtl~t>9nd9>PUeWnFGTWY<#2?x?cTpoCrNG-S-Mh=zH`}yH}RKC6!lI9=5mC<b^G&
z1vQKeoVUdD<Y(?Q)TIQiA)0nlzqhc(8b!!IBg~?I2KW<9f0bwIz!BfsP_$=BQXWUf
z%b9ph#?fVjW&_1=EGYasyCY^S(p0LmC_!#SR=XBR644)YTd;)G%(FtiB6r>jN8kVR
zFdJWYMXHv!t@MOzq0i;#7p)a1_hI&P9LJU%!Q`KZBJVG=VQwduA-_c{J~Li#mzSOZ
zq5S55YKq^6SyEhoV;Wqm|Cc0?LTadFJ;*lzOrut~N!?{v@j@>qVgG9IvBV5RBWd_+
z+;+q&8~SBSGABQd(|CH=lu4w@^|}QCt%Xe~Z`#E?9bPgJZ6+q6wvP=8LF5*f*|LP3
z+{Kb|INs38PK{_*bOm~}T>&k8>aOEugLH6zH1<?feNbXN%QS{n6_6f4-LU=|4z>Fs
z*+{KU-g>H}J8p6XSuw5}GCbo?#ba-g<5n*WnU8q*jSQ9mc&v569<K>ClS`c&lxs*!
z6H>e(Ckmo5M0x6d*7JNek1HcPp$0%fT%f;{2c3s&r;pnTQ6^hk=It1T+a;=h>%Aa<
zY-zCnKF~@Wk#~F1H6g9uNgv(`NLu0}X=xae3D$8ye@11nMYuFp06I2;@r?ymMB9*H
zJ26=j&<@J%WX?l~AHBk(q?9}%Qv3dsHeD>AN_G>oZnSsAKOP1BQaGwKTmVK)FmBWJ
z<yZ{VPlrI9tG#^Y=wv<L$$-4z(Rt#39De?oEL9LT{HbG=sLD2=un>(vK7%XfILQHy
zPEY2j$Jn$%Gdy{JZj)L#dIFF9$yu>(>hq<UH_!*5-N-wAfh>kTz9kL~Wue+ih31e>
z0BxKCUbJ4&=T#C(NNRfHZyg7<h!Qd=%$ua})gBNdY_3r3scSA*-rCN^%SHx&WI&E_
zMG=e~p(x{gj+zvx2$Ge$!2*mbZo#4`!qhE6NAITu0(JmyA>{`oB_O`;xFegNA*joB
z=>o~+txL99+-2{3W)ROBU#v05M^C<?>o!74eJp*F6(U+ir6hkF^sso?`DitRh{^_W
z{vseFA!MMGa3AWTr4s|oSxAb1$~@|M@W<Ew`sf5kuVIWFFl}K%%#~E=5i>1I1gD#T
zUiXlK!ZAl5gBs#ob>bzuQ-|Z>j_NBUqcXdjUwcCG$Zn@VTwYv)tW*lJD@hk|(zpG%
z$$$70+#~;mOkzh-y1aPOn%>Hq+AV&lVz50t(VTZ|I4#L@9wDK57ij5!o1vh|V;N=q
z%rND|rEgqcq&e*Jd3CyJfN<<*TYT{n@Hj#Gavyi%Udm_u(P?(dW6a5ePSQJhDZe@^
zW=|`Qp0zT`)~U{P?tcf@j*XtQ%CSVPfQs1<v7p&6qy}uY9LY;?0A<WOj*y(Wn?yX#
zIX5WYV{FK#)YCit<ReLcs3+f?Z0JO7eBW-bOv{&L8<?<-XvX-EGqs_^JJFxtM+N+J
zg+k#`Tu`Pil+xdEk$Co^HshyS{Ef^G1B#;6#>{jYn{sKH9sipyt$(m|9y%?Z=MOEM
zI_9GEO|RE$>7RCM1R9~Z_5Koy!m{~|IJwGqeQ`R|Q@<JarXvG?>V$E0w1svEO+93s
zx;6}81Z5G_yTn)oW7pLQ%%t=?>ps6@fSLX>N$zyd+3S}QEpI9$V=sJmX&J_u;e0#7
z>MtIF`J4fjRYQf9CpffN$JDa<!Y=%VtRZe}5u1u5YkId7Sd>v@A~qxlqo)cdVaPS=
z1*b`UE#6EWD@*}@VYiZ9ptxHCw-Hcr2reS=5I($F19W}1TQ~BrHEoqo=j<^^8?^ie
zM9Kyo_pp=02zD~8pzUilx9m=a7QMEpe~tvgQDB;&B*PLQI9-_Sot2kVV+b8|fAz%Q
z{*po+aUvLHlcPDvuJYijO77<8yx3Mm=4|lrZ>)<77(}6eIV>sEaS$Q{+>qRUTa4{I
zM=rOy=Ejk{$M1fxV#8>rBqH0Y(kw~w+`N7*N3uFV@m}fakDvcW_IK?KXJM&FKGq@L
z8=d9V>@-&LcBja@ehC_)Ya+l1Ao~*I>6+dd=K5}R2rMP#ZjI}w$Ehco-ejda8Tvc;
z*UZWwW~b?Y=d@+{GBFugo03NsWD0vDO^iYgw3>EDaCeo2epHEP%xeo})-jW`h2tq;
zBk&zV>f^#Q+eRz{P1t548$EM%_Sb*?HywWBv|_zffks3tB?OkgP(G8L@A|kc7zSjB
zsW1@lWg=WT@i`rkT~yXiV|d?S$hcD^QWn~#IRNf|+yK#GH#nVGcXsJ~uKA42mgOcF
zdjbtfvPX~8A)VZ;HAaCz>bOar$XAGaM_Yo%84!h@AIBy-`J5rWxzxX@*bjMtBew0#
z78$Xf&t~~`TLsp!B}lM&7qQkXZXJnX$J7dDja;d&mJy^B%9awnehK{{RL?3GpCW`>
zW_|a6`I89wwY`%}HpNSwKzD~)H?U<^ZDv;Z;t+EY*OH{VjIZ6gf={_9zckR9I1Ll;
zo2o6Utm;pfCWrKEB9X>i@TlEr2?_?>PPh&tGmEuVhea9G>tJ+Fbpu3DJX)|!cfP>b
z65*iTFihXL{m_>I_~e0Q@<e-sA2)z>u&5n>!@ZHyV{qfmAk^gEt6;FAU<b_an>Pa|
z;x@TUZ!-|oXUAzmw2pUA1pcer0@z@><c3?4n0wc$5VM#25e$YlqN>NB-+}4c@9>l?
z)CT)?xfth@Zt%TROkB9ax;;G!(zZ6D)Io_^Z!U@6ov<?-I?i47gd0e;VwNL6LZb+O
zMD`Cz8wjZWt~fn{UEfFUlh=9x?2ekxePBug?`MY=BVlq{H$LhqYt3W{|2U<a!?K>*
z?pB>yQ2#fBv({Wv|JkxGyP0|R=lT5o1GL8O>m)ww**_m2-y%HA{W{s&LgB5g5Tu3L
z7@UPax(R@~kJq|wm=<H76@vvw-|MD-k=4+2rh&&0<4Z5?zXu)&Rsp@UPnggs3cl(s
zS(zZ_J@z<itk>i@f(}Twh)IxQPm(eL1VH=0VOA~|r|A+{5e<;KfB$1nm>{>swk>xJ
zL>V0$b}Dg1ce@^d?8Bv?m)IIgZC&hwng>gvhwu6SxA(2fjU30Czs;v;Q@b$)0{~|<
zf0AucN7A8YI1<;Ki%8CyqhL6ICeb9}0nij0AVo`x@H_1O+5NT8<|o<8FE5qV-5@zL
z^4hUpN1US}x~sY>D=RB2FJE%^Ni7Uro`^l??n_$d&sE!o0eb2U$;oQ5F_x>cpV*q!
zDa{ujU%VY458`OU$ta+q>ToM#r{NDQf6juGyLlN_m#Fz&d6=;}mD(o7A^hDkpCD`N
zjG=ZY`6D#xa2sTC?W1)))P##%b68M}Hu?FEl&;OqhXD2rM+}u6tk^9Pe)`*A|GS#u
zodq6Fgpvd52)hW7JFy1Tn6lV-II>3SKBMgNxA{$sI`c~HqEvwHXkyqHpVjYaf0Ho0
z4&&(PTTq>8P>Q_vD9&b5<mq(2QJ3LJXLJJ}0)>ACMUR|-b^sz5``xFJOo1!caQSvc
zcCtIOU17}C#Nk9TkB?;@yMo?%$21D}T5Z&pLV4$SjhK8!UX|k!6u{Av^phMp!auuG
z$8=unf^)4v2%W&KT<jRKO@E@We`J3~`7_}nOk(;20uoMw^1~9FEL<!y0C3d%T@OG1
z!26?Dp7kW!kuN9JR!1vFvDoFEt9X5DYw=f&8lg(g6u*Ns5Dxw#y^-{sak#Y1!|_ii
zc*Oj(@TPF9-J+)De2Y?i2p}{(Cp`x7a0yBjNqP6}I%$r0L?23>PnkOWe~liEpl2gc
z%4F(!=J8lwXsi1WIz6ANT7xkAH0YpoEKxK|%rB5jjfkFFlgC<qq23WI*{0*<RZ!i=
z>^A0c^`$^H+CA1^6_bB+^9f-r1Q}V?s%2~wD0mTWPRFs7WlGRM%^yL|Viqa-X)hdd
zJ;{3Rol@sL*mHY<GXkIBe=|MA3f=S&B^va{kK{dhI-c<=JnlW}J?hvvC3=tUVXb50
z+Q|LUMbRIhOfj;mJX>4`F5MbkQ(-g>+26XZ@CD|9tH<+4KricfQhmCTR5Y7^6rslC
z8Xhfi=jf5&H?~tk$x?>95;e{Cr0Ghs{hdd+;yoQL_HDKUq`&7}fBtyoNJ-7@mjtWV
zqtGhTO8Ng?ecFGxRaUa5;g4QfVOc*K9F?b!KYRG-;ivDwO&|WT&p35|kF<M}Nv7^o
z);^>pY!@R-FrmWEQv}CzF8>9eFnpU}iQ}U$a2mzjKvuZpZB+2?)vaVL4Wbi;dQSj-
z9(BN_A`+X0J)*j6f4N#adF}SZmjHq0<H^c3kabBbLoZP4m6+cNXN#0(v&L_2QB|Wb
z2H2B>0t2JoDYRA(g~A4Aa!Wp?Vit*&nPS;qiFx_+1h*ux_s05x>JRt?+<NO>>q=VC
zID~NaS^|rrX7uplx4b@qixEnf(f4opEJE${v(2%(FWZ|ne{7zgGV@=t1nTOFY-j79
zP2zh=l*&4rvdyi>&JaFM{K~IsR>!aBoJko=t><QvO|8Uizoj^v)ElF&EmE;WGY}J}
znaE=}8JoDay<#J73P}7R&ikQSJDuVK_&bfDYjfJLb#OSR3;hf|e9f>$8kq-sc0&i}
z_pSNm+wlmEe_!P=$Z%MH81)<qJn4O3W)H<OJN%)n@N&x?2RfX*cJ(RV(&NmPz}`?~
zhE&%}UJ}a40t|Rh4`fp199{2O@S)7mB4(=W_0hB5A8fTqodZg8-w}KOfLHXiGZVB|
z_4+XR=}v4EX2ZcCuGNmbWmN`(5_Ac<4ww^|+MK;Xe>y_w*#z=w06Qh{P~(r-Z0J*>
z-?y|6=>VYgkx()e4WXx}J%#g(Z%JE!1s=pz=1vaXL&pM@4IG{xSQv~~)%^pTV418!
z|L!|Rvf_1>Iy`(8d1i%X{h`O?qlce$`t>tlYjblg+mzCTlk7+=ORv0G%J9nH{@4E|
z<S4`xe@02NoK@M^yU$)8>^41!eQCM3Fu_;>YE$i3Sbn*p5FNUJF70NA-yL@JKqH?!
zJE~ByK@exDYve(YK`O6MzHO6`P`Ln99VZ-I3MsZl#|yu^`{RP{8&=(pe`RZ~9pC&T
z8Hfz)tl9!6(4m9raU_A(e`UdFS#MPY$&IL+e=^wNPx*HCsGFT^XCME<6~_4GJp9%f
z>Ps?-<PCM_4rL7gj?N{Ru4l^#0+Za<IX0=?L353Adu0chZA~42cyDXXDFe%(U;aVP
z(x4E$rayPc`NU{vGQyqeP<&Mzr=9GJFSFDB=|w(&5=7O`V&kFsqZ`pnve%9P5zl_%
zf2&Ww>id1EVMZ2C;0IKDsH5=JL~-=LDcHweq!_zt;D{c2!V_INr^XbmjHgzl7fyb5
zDsU+d<#dV)sQUcPI-oDd?~lYJE2j9Qd5{;3V8<~m>}`pfsse5o3=iSI*}t`B>eLy(
zxo+Wkxo8wgB`>^)iRZMvpXuiBi7Hk(f4#^2IMhRxijF5760`H{X!jr+CV_CBVV9MO
z@j^=-ODb?b<#0Xr80<FP=FQi1-3d~-NR*jo6UTDlbrs8r&?g1KY~dYji2H=<#I4b-
z4=e^LxX*v(qkCM8LEVd!8teasoj5OY&-m}|#+jjg;>c-qS^I$<wlO<Y?HvG8e_vJ?
zvH{}lFZ^zINAJTqmW!m4kN+I7AJlsTsnIdKJNhdA*m^Xe|4IV^ihDgn4AwD~YaA_U
z(_IDyz25L4x73h0zBSBh^VDP$%DVy}E>CY(F3dUQJl}PCpsJTvC{UPx@3>OmhjZo&
z<;v63CFPPl;S3(aA-4j(5fCEie{07t!dFk(A@$Kr|J~CWbi!^vL;j4`a^<Q@lY+`A
zYQm4mtI*pwWqCd+LRaVbN7Bz|u7=kY?TsbVYRPrxp$pzIGC*}n^sc}4@$UyH;WH@7
zBjp)jk>J<446HiQ`x$~}V#)v~&r-mH20Bur3vSjl{8=$k$6mcFJ?ko<f2F63?l~HE
z`()wbGbGE)I$Nlz1_9K(VR25-WJn2-(2aA^P(d6m7@IAwNwF&~i4z|6$=ak&)`%^z
zxyf8;LeD};H#iA5b^UdyN^<B(J&8g_vI@@{<?XvkRlx{nzyba|OHNuMDhh!pSB!}7
zOH_nOv2oyy4bzoJXyQ)Rf3|6gJ9+Ae(Abe`$!gN0pA?XO(|8_8@MU<g=gKz7Pc{Bd
zD^1IiFabT0Xvo(&-yvy7Y}iI7^720HP+96%4lnGTw~hDYZp6fNtdLJK?@;Y%f}oic
z0-hGRBUY|NZg8yM{K24}T-iLydW$)_9Ca+YBN8rS%SJG#t;|Abf2a1=z&!xy>3VZr
z5en17RB3?@I+f!B5&3w9);qjG-OJ*JuYLvcG`Us6u|PNAoUv=00~LA6IE@>&pVs7R
zt2Z+$34~U+&AjL(0+y4+DBnkIyd2_#jwLi*$7h8wN(TK;7@goRA|@IIA9$uj<wq$*
zWZ~(sCoqANWni<Of95NGFm)>!GDx=_o*RjWo|b}8fI;RQX*u+26`zv%<+y@Z1G^8$
zWS`u}<e(kir-`1Y@7ana>(DHyT%08a-pMRDx=SkW!9d&TMwDJfRA@<Z9u?J?k1OgY
zEYA+d4gxict3gr?$n2PcZ%HDti?<=B9{pjUZwz$%`2~>`e{VUfG+fwi1p0QBgceEj
z`aVtq9^^y{vl`C{moEX_;Jk<=_(hA4AU7TRq&@^7F7L^-vh(KPNg~;_<8zirdkMwb
znv3I=i){L_Ez0xriKgkXrk%Y$*dvMb%u6di9f2yRd)-4&BG*q~La>>mnA1^<H>Iu=
zti_a->o!r$e|2<J+1XCcSNn+in|bl57E^wbZ6LJaYFv#u?8*{veQB}d>vsA7k^SCt
zzjxBnbo?3pB0>R#!~1bxLzvnFmUQ+wFfH&X3OtKlvm#4~f|dZzN`jy17(L9dl4R_)
zweLL!poDYP`8ln6SJ%lNP!zzCsUk#9e^<1%jd#0ee}tJrRZA&(i4e&F=*S?NkPT2g
z-jUeJc^L)}Kit@!(8N(M=&pN;ls@xU9+i=H^MQEm80#jt&Ag#-Hxzf~^jGr&A#PG3
zt>@_W_%XF6B)xg~9Vx)3>wDhMFE8Wh!XH&X9U}d-<r)n1hAv}=u}D!sn_H6ZYGIU%
z#SQJ<f2w9DPd~-+vRjP)$2Eioe7bMRr#Q+|0t@|bY(u}qhkDETB-{hFq|_~AOM>!5
zg-5uX1CDQSVi)<s%{AH(Ke1g(__|#LRW<yzx!DmwGTYlywQiS|b#oH{leU}rVud3=
z>|}w~2)x(Nb}Y(M_(77frN)>tB0t<#OSh;Zf8A_aUZJY>JST;#i{!!*Nd~2I?}&Zi
zapKC|_`<Wm{9DZX_K_L6>+KWL3wjjPVmf*ngiNhRbov-On6(3EPfJUzkD`A&V#z(P
zoUM1HZm3UO_uHHA%2p>i-ehZN0IX#-GT%|k#;KuPx0_NmT(KYpF_F&MJht89;I|yu
zf9>qxsBeRmvQioP-WId_vYrM<G3Ar|hJkY912m+;SUy$wTT+?x+0B}zQ}O5|Q-Ws}
z$&?H|+ek$pv5YbtGg_x!)=_kwREjVDE@GTN6(r*-{mKNmO6kDoVo1uKk}~Y16Le!%
zW<^qmcKWjJviQEKxJi>=N2c#65fRQ!e>zd>)t?8RzoH8|U0_t|Z5(4p^qZR%S4$vk
zu^T7m8sz*qNT_2IAopmfla{vR(k>Sl9TNEloaaa+aUU%2T{m=D*m4TvI~W7JjmqfZ
zgQEE+a4$iha_X-w<<-|mo&yMbiEcb87T1KAvbl-%qN<o-mZ5i{ZP4?m`5W*qe<58{
zpdBwQfW#X;X>8u1DtEMH@x^ONQ6fhzCz~PUT4Xuq@%)B2LN_~PJsw1za+Oi}3G7nI
zR|o`0c9Z``{54$Q=4Dl}MD=@(WC;O#&^9O-_g&EJBhn8YS0ki8U;qRGxgeFemk=o1
zFs4<K$Vr+<@f3klWDwzE$%y!+e-jKM3VG;sXr)ZiJh7OK)8ne%CONAtp^i=~;QHg^
zsGE`;USEf;1Ws!)<ddOP@1Wj3TseDgin%opM82-<y%wChzUDQKMKKJ!eOyxQYC<VP
zt!ueAY-b;Tl7*Y9c%p=1ejg6c8~#O?qu+W2%fMTvh0By??3pi|qcd==f5N&jWMBQ@
z<^zi0`+yw8mF5<T9z?H5EQofZd0@xhq!Mikv_9`?u2HkkNQ}y@SI)!&B_s(Vw-NaP
zKH=vgLZUMtSS`GwwcL11zFF}zWfT@kTK+n@M%S~Svvs8URQP8g^uYbe-tBeYQJA9t
zfaZF$!r`CjI3t6#J%vdye;Joluw`2zDG1kz*v6e6R{Bi!&ZIe*6D1e6ffAC}F+SPW
zw5}QQF8Ie400{f>m(SPk<wb5=D$}%H3(q<0No2TohKL1fg~e6D(!P#cwH-T=<ovoN
zQA=#1TX9fZABX=v64}<{j@7}|(~f)Gt{0nivJIF6Vjh|~9AEF%f7Z=xGabd{pzMG0
z_!GRO8Umc>xcVT!ag}<Fca9G4Q=N_8b2s<U4Z+rT{t0WbB{O=jQfx^NxQltJaUr(k
z9jU|COePG+3cYwcf@L~j4`7KWP1CNFJaG7xR@3Yl2$p}6*c3f1hBSe&Y(t8!JsbZR
z5iaXFgbAEp0(My~e{rd~9quyQxE@bNrvP^b>W%upJN>nnocUxuA*0#+<7AUoa`l~&
zG9|(Pht>Ii306lKVKpR<a?0JHI6=ueC%`O^eIsR$zgkhK`uI;$&zd0xzDgU9V&3Oh
zi6!9{_#E10_d?I17yk*tbHZ!kQbCN#0fyH_;_O}tEEA=}f4d{_7!UBcV?XbYrBh?8
z_khaLQMe3<|5hvx7eR<m*N*L<bpx&(iuB)}ZJR$AiwbYUnE|CBN<A(v$!8^56d*@W
zAxNlTJpDI<;Zjn(rp~G~?ytRa&B%mQWm4PeABoqylkuD*>Z`8|=Jt5OWgk4%E5M%5
zO6`J`ZfzN8f5>tFduKRIH0PJ!qTrtbaj1rmE9JH++I7bNI<t#m7r~o+=-E)iO$%_<
zf!t!@tPR*sLSUoPsm3H`sF|r0b>E;(N<|l#+vHU2=y_AcOIZ5(NpZHw!ezW%QY2h|
zZF7^EEq)gMO_&M92vCDy&Adk$^-K^SQcgUH>4gipf3iy27~@5Z9oXEY1w0N{HU=OG
zm(!j??Y$ezZ)r2q{N95TR<5%0Y3PqaM8&c$u3$w4M0dL9mVze*b?7OlbRY6(hEOY`
z`E^Vpa5)=?D@c2x=u~0*7mi|m6|~NCAkx0?edJPlNbV#p-L8Zs$&U5yG-*{k{$V1;
zqZ5eSe|Lu?vF1o(%*8FdvG?L|_u#0Ty?*s{=V-T^J>A{kJ=*P%YVV**@QJ`>VMkB%
z3idm=LW1HwkKny+Hz0--(kVWWNcx;4G~)%JCNVY}Zj4f0KuY}4PsLf_sj;4HVQxLT
zvCd9!ln4OcZjk()kyPFgr;l3)_*GoLFoXK1fAs1_jZc>22})4hG2=K-4pYoIwo>h^
zV2rq8CC8)@k@%)Tk->th?w~|y$L+U&i~=vhE)5z~?|hEjygCqfE)Fx?Xa&lFQ!zBn
z5akdm6jxAfjFZyE;wOU7U`?VxkZFktk#3o7G~vKqgp|H={ZcO2Q~n%AsWg(bnpF%O
zf3Hr{phbH-26Er*v;FK<G6}?()8T?FJKW2nVB@VuvW|BGM`q-wZ~Gj<df=IQQZ6bk
zEE^RXZ%mg+3P(fmtR_#=89JWCb2$NFPvFi)e-$QB!o*-;jizoEMZk*BLtpvH7|E7g
zDpmvO>FK1bXyH=GhqmQglyR$4<TxMtf5ya)wPCq;&Yl=iYnwg@gYh(cK({)Lix9j0
zV0{Ll$a$CKXS*~xYiMh>4E|Qp3xO|1Ew-d_&vOva75cy0U|PiC{l}**dbbR84LHXD
zQ<`!Jy@Wca!a5CRb2=y1&lc9zSPnM;Hu~$z(q3zsp}67aVTtEAit7Yh1DRB$e?A4u
z0#n#vZ-*|zB-yf!H#_?Ra)i{x2h#b2VP9dOxbg5hpA7IGVEBge-jIWxSZ};8Emn#H
zxGkzGj-sEzb))aeP&xCK?hY2eW<;|XAljIul5rsiO+|jm`LB<*GcN3W_}zZCA>GDe
zgW7!u;cExWSuNw6TEPN7;|w;cf9G49aU{+58kf=y{6aU@oqfs$JN*9eX!m(`xO<dY
z!*Ch5R-a4xU6N}%z~2^_16djQde;cCf(lj~DsKPPRQWgvONt+rZwwuybM;%e6z?L}
zeu+?Gq75bO^2plzVn!szH&$4oTw7F;&TpvV56Rj~DK4bZM@g^}NVHGZe<Gc$Ukc-+
za1nrB4wXc11DAyJJzI3c$&rsJC^22-2}(GY3dmUKLQ<7Lf<1TZCd;Oa7M^O#qihIV
zBlxRyy)5XP>;ej(l|*0NBw<RAU7Vm5BmNbZI{Oc+YStnbVkqL3t4G-;B7s-S!4W}4
z@s-3Q`QU+J!yU2y;kPf}e?*#n?rJ6`B_z3lRg7ATP1YPL+L}?^3@m%oOG<4n&v;}j
zr?`8|(~MJs?czd?t@8XFRw2uPHB=|Qb@A;@r(e_iNMi^xEUe#kt~v-<{F*}t=`t&p
zu^h!!Y5X|%U5WaYlDJP15E|dFNKcHW8${%zhyRsYKMwz~4@pMFe;wc2+3%*ij((MD
z<e`lQlP|_sq_b!~K)i<7{cb0Qqo?=66$cY*6f3kF(ogM_Yh?e(;o$<{WAeET@fImm
z6~2Kg=QMG)>e9qp7Pk<+o0QGllw2HR=6U$=b8I-xe;m-(pwK&lc;Jkb#?K~zTzWp6
zZh?m6CbzkHO|?v^e_0SoaeClcVk`o%Ci8$MCx(Nm)`+u2=*l}*B2>aetF;LY6Li<8
z+w~U3+-2z7@XbdLyD+8c4shFQ%*ZY=aMdp%aZlB^TInCvXcxr#qlZ)xBmC~@WD|BY
z+K`k;I~naj<oG>GArtX5%VM1NHfJs7X%hRmT`Rp7?LRP0f9q0(6QhLXv&jRjPZ5!c
zRIoUPnWdjKxMDVREn?yh-E++*IA<(O<m8W0f(a>YG&bFgiBxM2hL??Q*r%k#lt}Vt
z@TYV@39CCw46xZe!#5wcu{~j3P07={xjAp%6Ai7I&5J?ntG|O=;8NUnT6hx9A6LPs
z^*-T{SL6<;f5U@m5rnL2vc>^`%l>n=&sF;)<>dxhR&aEK8t=u=oGAjBzirDN<0vHY
zT~|#0Xd$Xt7m{mtgWM`jiL;HdTh=;dZ{tTY#lw?ZMvPn)dtugr646lVE#8b2n`D{Z
z!QU-o0+;KhXgS42D}0ofnkl$*TFW41%$>L{^$n`>e+}0s-GHotHMW^e33rpmCcK|0
zP`$1iliw(x73H#`5^YHk=BZouqjnZH5K3N#mZ3K(*qlHMmEDrpxy>yvw4QQ-LhGWL
zQ1uGYO5kJ31!eP%4>y%_tBPq^U1#MN2}XL9YTm1tj@9=%hZ9H1ZpPsxNOV$)P|Dr2
zItS>Jf2*RlgUF`OR+-qf>Sat8x<xe@mm-T>m;y!SR;)%XJcTh01wBx+30(qs(PG62
ztKbsk=jHPJLdZ*~{zz%B=bY6$SvxAZ920>yT#Zq}T$I-4_byRrU^Yq-vNdcYd&W4j
zIOgcvoTBCCgC%j5>Z6H+b0_VK2J-#AQ%M;cf01%WlhB<;BiaINASP@SL;`<nmFnqc
z(T&$^{*i3JQpldHg;EB(kERA5s}_@LNeV`l9UksS^%HeoixC6F9TZS194vWbj52d?
z1y;jr476#^EXloVK+z`M=vhx8&}`+!>8>gf<Zn#eNqs0KSELZ*aIK&rl~ZBA(>6tB
ze;v`s{OjVBq982{WDuSW_!-A(t!lv`Tf`3*Y{E9__Z>JH`NoPCFyTlK=`v{AGcLF)
z?}l5BnVv~Ji8WlBpDp1I!MCAcAbyFk{~E<MBXKa#X!(Ir+(g3sZ9$wd)Gs+&R<-Fj
zDXMP_<c)##HxN)=N9cNY+nK%1?2Z;qf8yW4G&mXB79e#X%fe@AMyB#B-TzPN7Ce*k
z_2Em!l^}R8lzugDg{Se}%#54MOOAOOo`eHselz5^bp@&P=eSaGGddU6uNz|qBrb1S
z$SMV%2s^JD+7QK=fiaHyEi1Na3)q733j-cv>niaZ+w7O3Veq@OK57Hlr=#Avf2blv
zt!TnhU3s~f*zGh8a9Pgc-&}}CW8BXo*%SLhIH;+nEB%f%XrQE@GIk!LsZa@cxw{uL
zO`4iJlRFt3@(5I>=Cgb<9@R?tSsiVz5kw;Y5bGxC-8Mu;CfCiys|(!Cl#gQ*4Z@6&
zE3&$)x9)uy3b>{XnK`_ikFUZ}e<ci+4wLtM%ltk6T+!nJKW2WprGaeXY;Sh8nyO^3
zy_2vhN_mZhxIbB{A(Jm=hqThMjWh`{ENtyw)aK!-OxNwX(YARz+YBslbvvEMvnHi)
zZR9tkGs-Ete7!t6Z%M*PApri$Th&yt5T`a&cscqHzuRBoZdVUI)}oO)e=Ub!UlnsL
z7dI!DJo~=B-96Z)nei}KO<yH(qoyGRj?j-+vw|*G>oI)$k3k8gI%U<iq<9bUPLQXQ
z92ydb2tf9R3lRm;1>Jnk0OUYX-CIPCg>it@xz`@ERYMRdhyx`FO1fhrM@6#VOL1&e
ztkE6bgad4<e5-Zr3VHg1e*o>L(<QSXq91xLCX>X(9?J3Nv&FX5zb?6YdlMAGs1dV*
zB*G*mMXg{LSt`k-CzfHj|Cqd37)BBPB71N;FN4$#19>p)W`ACy{6fpex3l5Oc2XVO
zi)wfK2Sa2-jzqx5+9EJdjz}0LN534t=?dEw(x@Dddjt;vn{{r1e|I4I-~RePEn-7p
zb;&iJ#n`KZ-B<g2Pj<4sr@JqX_Kv=<M_;wMmYa^{>W4`$Cw9hHIYmEgxE|bzM>}8d
z@Al+FJ^fH8;;L&(R}1|>HR0<aM|0ehR*_6}DP>Z%1_j_ny{JWJyzD{l@E%0DXFNbJ
z?DrmTeJ0cX%Wnc%fA*C=M|&?{^bTIW={?&c+J&DFj}G>p(9ehDo!^^GmJE;|m=U4&
zSYsb-FW^yf|4qb<TALG|zJ;aj%t%iXVX^ci!Qt=*CbQVJI~IVcHLynmG)~mFnsAl2
z+v!e?qw6?>$)TwrF|LSr$J%}6akvI9<+cc`e<f(zF1*-@e@J*1S%0+xoJ>{TlWMS|
zd<ZRfvbkx|%ErLq`ol&2_y%OEfC-9KLSl2%W8KwfEv^QxN5N5}3kvO87!o|4D5-&o
z(S>D`b!`MJ`CG@p1t+-$IjH^h1@`D!4!@8~OqrO%&HXC%HILW!Dt6|1J|{d|DAOAI
zY%xzlD??&yf6BQY&VoBh*=?+xjAnDw;#caD^+8jvQfV7=tk?7@jW_iD)Z2Fx+W_AX
z&+_p^PC_e=4%fBXBoLT*kzZbhi-HEjr%Dz8jiG&g#R4{W&Yb&l8;8(`ElCZWrXTCB
zMI`#RS-IjoHbG8;v}w|E9hET9Os>Q|hKrC7=Z;}Hf26)39PqUwF|SD8Mj-%7E>95M
z>H+Y#o~3OkC_?(4a_~7DP{oo5FuWMH#}SH#VQ6-&B(g6tPFk@%8BFv<i5sRMRv?>w
zyl&kRUiLmGeA{96K4-kMX@8W-Rc3ANiHMzhUsBk$$}e2NF*7f0$%0BY9+AAljisAj
zS^7z7f2w#D;7COdm*0K1^Lqbi*uuGNRhbs~4EZ6Vj4WJu+S@``VWR>ftkf>J;UkPT
z1qagbZJv`A%%wAbpPh)%C1}Y(n`n+hGY3Tg>9xM?I!9ZxtOtEZv2#+K=2lg?@g4T3
z`^|604j<6_5pB}dG+y&Q^ZLU?`&&tMR`{E&f7EShB0<0Ll<ArcT9}Bt7~l`e9hx!l
zyUdwj2hV5uA_7E`ZApAiD5P<^Xh<Jqg7K}bmRZVof)(`Dm1~ZxSe*95;^mW4%?mW4
z+=sKY2xsscG}69|D7`41;Zuy7pA4wmmK2+7bws(>j4Aa~CyD?pvRjEf^|zi?=L>2$
ze^C^3G189Ov|CFnQd*}LlWZf&GW28}^BQ-yIX&~Y$4^%E;gnYS&cGfHROUisy{n4{
zQdeznc6vK=AQOo0IBhmlzo8@4)a@*Td_2-P>ROU&nx<vlcX9ZPmL;Zp#gCHw%9S0Y
zD95|<a>?lhNcdVUXoxDKPE8wsP}L{Xe~)9C0A-o{oD_~F)fx<0rhZ7LC-~SwF14<k
zingEw3|}Aaz4#{Ed+~JlKU>7x8|ufulOa)QAZJyZa^a5|-N@v$m8321;N3+IG+ExP
zaqr%x_@tjSR&6=AFOVJX-*=1tqg?Ya?SY*?;oDby-)m$0R<Xkq*xb}9AS@PVf7o>y
zS(@As<3)6ma4Rp#tGeJfuVX`2-g^Tl)D*@{VT36ck@h4Pe&>P9w)B+y75Aj2mlSoA
zN{xnb=&FI;%GkcP^DM#Ps&Ogy$>Xq3p1t1RUvd7gct#ttoC|ax<#%!c5)KDMt_+Wu
zV*BI<SYE&T#vm?{eF3$=TsZV0f8&<C%G@WhQFM(VD^|>*^{6#XNmW+I^Y@ePi4YYW
zSq4fEX9xi)U-GU5>{K}mhbZj^cBS8ld+ENMeFT#ZP7`ja@K)-Nh*x%YHgclK;+BQ=
znq}i5ghEPfx4f}<EPn=<9w)<Q?s`PwB`3s+mU`r5*kv(CU9j1yfDj<Le{??UawI<S
z-gIhZfMB+0J3skM;#%S&K;r<cqMM<JV>^5jw!@2;N8g71wQ5JKd~BP7R-;kbOn1th
zDj`@*_(J2bIY1DRuWYzCFYvwgj0>4C(}I+Nz;$Hds#QuX&Rktp0L#!bLnO3Rw~Tpe
zZ3?_O%pw1!$hUr>W>jBwe`iWGQ@+jx^0hW&zXwZLd=b7@QwIz)Fh>_0psv>nUK(c$
zG3ysy2H#=7-M0SMoF}Z?$C)#5X*=@<ua&2V1rZQE_0)*4<aB|n<qSCWq~xmgeBkk+
zYOvCF)9a=O2oyaQ2Ud9TNlB_HIjBIGXDde@*My9oh0B<1+mPO>fAjZKMakYGr+DF$
z)T&iBqq+uZD#Oa#?^sa&BT+le*|!h!4y7OAfe1Swp20nh53x4#M>A@&o-Wq#-Ia?(
zNk{`)T6MJ(k!`G4YG-Pk)!9*CThw=So1GLF`PEqJ_}*h{#Fc4V5%K0RD@W%+m7mek
z>-7k^k%YSlD9y*!e=Qq(oZ?zE{e^8CB1vcA=sFxA7HX&Na!d0*4|82k@_Cx#-N@B$
z#Dj+YLGX|ORhbk&jwL7fq_`==>n;Oc`PqWGC@eHTFE~mO6<6u+B$m&AzP*@y3UV3i
znba?Fd1K_N(6e%)vF!+wv~WvPDuh4l<g<kqj8}`A6wtz&f4x_tV=v9MNYWa23aanm
zUhX!cj~6vC{e@I=nV(UC200=$C?rO2dNM#lWkbcK7`SJHu==Ota!Hz|6!+x~drMFW
zhudiIjiEfy&voxMOc-+4j^@tV_L95FZ;ziSM4%tMx4mF;$?)Z=7++Q|!gkg=`|vl}
zhVWH2&1m7Ee_5+(o=g2&2*EsTa+h_ctnMeESrFmomn21}UaodOK!mRK@D9X0b}2Pg
zvgKX@26s-$x{;%uC1&COf_$71URT#Mg1h6mdx`5$cxOBddfq~fEZtQrPZSY?nHtVy
z3@6xm!4b~g<has-%trE&#B&P3R8_U=KnVhsPPsB^f3cw2tH4k!=kdnu+)4h$6E?8Y
z+Ebp^v}6j$0cwP4;?IRr0c7JFU6A?=oYCrOyKRc`qR7}wus;$SZM*0ot~UzHs%%}c
zsWj$t^|m_D$WiOAxX0FVT=bx`qWZE!K1n40${36WAcAl8VPP1qCqq84XoBVe)i@5<
z_U<?-e^{Fl`Zcoq(1*itzFu|4-FBdzxPvlHF%0KLuE6mvxl5JS>sxW0)tktf#=O@!
zv+Q7N4AhP?IaBU&kTv?KpJqP&BOg&gi(%WD;uGW!sh{1(!BS5oX*peP>*<yQq>X;x
zuRa2r3*0;h0B<y&y_IzQ#HvuEW!na>XMf`}f03w<e*gIQpFRBS(I>xq{JTF4KKaY?
z>ipA>FCJf>hZDbf^t8#I+vsgF=XQ$Uqc^3w`rTJ?Y6~B+0n4PQm}nw1%ZUXmkEQ>3
zj$KPPs~j+_^Ry;b@?OK)B^g(;>+c<d){uXV{_igYuk-n|M_JpWlN)i~A06!OJP((V
ze<b$oaR24ep_7K$lZfOj7^tk6CTFyxjv_t^Oj0V;*j$9Alg<pjIz@@IgLTUTDn+Zh
zQ{G|K(I8#~zf!(L6$|r;EjQ01M5}(?3_H<iS1snt(}g6_Nkwnic?1@>Q5mqclt&}s
zXxk@ceQ2FPz4<yc9YqmvIbnPu7Qo<0e<R#U)dd8|VvgTSuAeHVn(w)^sCsHZZNawF
zr2&LjOm?|_t^45+b`@jh&bJD?i>>dNLI!j0k=Ims%=~l-a`mIW=E$|IPy)tvSI$@r
zJCmgnaBD(*k!o!|9$#`%<g{Q!;o8%r04tL?dr>YtGKbQVFv4LBg?SPvr>3}nf35)&
z^r2}{L|7hAESH}k>ByGR41^c1L>I`t-d6r(eOrKk(sH|6ma(Z9cd4EWcStY#K95ua
z1RZ8!N$40BAbN65F4M?$7DkQD%m))2P;GlNkO>Tec?t<ER0XIkscVX8O(@Vn-qA^U
z71jrZ#;Q@|KhWlNK;tM+MycX8e;f|~T$Qsm!tY&ow*u_;K;Lz~^7wiT^iMvg)(KyD
zooNfNDm7q4V19%ZXnj&nMuT~I{nfgbnd<lZT109+JgEOJIKdpj6&5Nw$AXldj3Djm
z!{1iHAlnpIHFBqM=KcofpJqdzA{k<NhGHk?IS!G0<mM<T-1*e3&$5Nme;C>g9>I_&
z&Ami&G&_;>ggg5X!etw5?an8iZL(p<T3UpSN5&O_T~I@CXcCLCC<#ypYEIWvmXSnC
zTt#W?3InpmQYh050t-sR#4zilZ&bf|IVYp1@G5sgvj~rB!^Yv}8jfdI6oKiD$NFKx
zH~}b%EGd8`Wcage7&;gVe>_hWBhASc`k-<RrR$g%%}@%kGYeC&;i+x*U9I^mbkeZM
z>&(LK)LATD3Pata7X=+=SF(>=6h2{=b3u%`JQ$L@tFn-JzF;O<R!x{TB;Ighi9u04
z30m3FZia|TxX`L>1N(72$_{rA_ICEOR|k8~cMiVK{<!-+<BWryfB$3W;K{c;2OEzb
zKI~*KULIvHUhnVo^GVK0+qb<#*Mz+nN7<8acc1(*+n_(c%pP|5A;EVO%MZLTBq{eb
zKNqXlAV}1sz301!M?247W#YETp1eLd*nM#{h)>cl%aXlo<FyXsbaD6}*&;#fZcAZS
zW@|j~qWO9yn7>Kpe~dTGPiw#V&3N=xEU@>R-w-_wJfD70A}2ovGWtesbllFCv$wNw
zfu<KCAwxG$$(|N|j0B25dbw=bVI+%>>INp3c*DAk9>!f;r;8wLh@0;YDcyp`B{I(M
z^yIpL%>J+>BoAbCkQ+Rp(^bN$mPBdFqE=>&2tnTP;3_;qf1pYzJ%E9G*-Q48%P2&|
z52HLbPnzkis|E6D>tWE8%<eSMz_j!<V9(##aw4GBQ;LR;k+ld+T?!T=*G)S$cM!5+
zYFDd5Bd-k)!5*0lf8i}VY_b$v1F4WqMaHDcz6KV>xGgTz`l?^=x-t1EC*-EfNpi4s
zC63jkXc7&cf5_5C;jCM#C{SI@hH7%RVwLC|x|g#=iHN_dKJ`y2Bxr#Dv;vH3SFjLM
zTf?`C0bl%x_{~W)fT6z8T+_MOo9gap>3g`PTOZ>4M1>_zC95UmXVdZd1uoRl3=o~k
z*nbOkcqVYSEr8$gnw=#O0?`4x91}n@p$VLM*!!!nf5%B))Mp%>^@0%~0P!4vqmf){
zx_(iFgKMvj*Jpi>D<x29eN1)6$;ai3RtF_-QJh|M5?c8zF-C5X!1C)lBvJa^cyo^M
zIzfIoyEP4flQA|oFUxYm*yA!k3hm>-gv;}ja!K)7=D5_1DqWpP(O8;TpPVt>2q$bl
zPT@6%e_~P_Mu5ebS`{?$#*id8!ltlBGeDGj%eyF<0Sl}J0K}Q3gm4d%Z0<ZM7)0*Y
zAZmekw!CzpkX@-J+G2^Mpc$rFiqjpT$0DAXVXCd5jf*N{tlBV8-fiaE6Yk6M1<8J^
zuR~-CYclMCOktA5hZb^_`p7&jlAYRZUEU;9e@@FMXpEunORB$E)ur~uj~Ppd+~90C
z?7YkI;w((L+O`U_^bjnZ@SX^%VkYUVNnW2;ozRLTQs0c!D>}#MzoQck5FaXn68*cX
zCIc!TO8=gh<zjG31q^Zc7lX@U8dF2s6Xx8^Jkm641jr_;b1)WZZH=(&V>l#CZ7{Q*
ze^P|&=H{A@Z~<M@MfPY6M65moSCbR9sJ&k;&nO(tLLaC-92|y&k#RZNmtpY%lE%cN
z(rjS?8WZSfTwON&Hwrcj3(_Ofekot<o4^}t&#&bI={qJCy?@`nQ?dr4CZE^}r((Zy
zaISgPppZ?|Siu17oZ&)Q%3d~R(YN)7f9S+%wjrLg_eqi3SXRuK!%shX{PD13uNwd1
zbqgvTiqJ3$wlgO+dU>fCO7Wo}v7XXVOF&>wehLat8g$BLWL*{hwpWgW3{Y9)w!XrP
ziE#fY4D*|^9Myv`*XlV@*xYt@r#E;j^WGC?*}eyt_2TvpuTO6Vx*~XFE6C66e@{H4
zmD-k7p&x8Lw%r=6J#kp|ZNO*V2#M9g&}nsUVdE?tY}~S8`<=mBgI(*Bt21bQf}R;|
zl6AI=6TO|&UI}`~_$(?bQT#LnA%V-Yr=;Z+5AEXl<d}*CBk@bFF#v3>xxOeh^ovDe
zvr7`1NAX;Q`p|MR-l}H`gd%x@f0i+3W#!RnAj9Bj58#{|)L{F0h%9Tt&A<H<T!0+H
z>&ZoN`ZhbZ*{w)AHWp)Nr6LwUyh1RLwv2%SJW?+1?AgAb%D@hpBu#ucKA(}lO|+;%
zl*J||WEPat7Kx%!>bEpUrD2PpyNyolt?<Vh-D(L_KFd~qAp1fUI}aAhe~5aTXG~P%
z@Y&=h!PrSC>s?1TQxA}uPAM=yCX=r0#el+BT&idw4X*8*dT1p@Trnf*TE>rb4zMdD
zp#jenpgMp@tH*Q3jd3{vlIZ3pEHbAK)k(10!o31Mvx<rf5_|R6-cYJ3IrlBzUmVz$
z(T%t^VdK;umBfF$G_vI8f9PE5NAq$?4zi0Ny{P6IljOl1piMz#3{&N@3~`=TPq~~M
z@@<PqFvMc21!-#QybNEPvXM$)VIs^zF;#3Ut|>syU!cA#tmzxBYHS6qpuOr_5y&;J
zPfQQMjguy^9h1S|?CfWPQO;R4K<zF@{2eO~oyS~@<`>BDgrad_e_e6Q2@Pf?2UUb4
zVG8QI4|&nc*K%0ggtqytj&d${7fh4DrBA}XzTg}o)r>VHy@^!Iv${YmAObRTu5~Di
z$I<)-5#mN6hiz6)mJV3u>9~^8WYL+V#Vi~yvqlz;ny=dxDeC4xO>csz;x1b9Ai9ZP
zTdr4xxPYMPNP})HfBz+WMMErS#kEDSjbf;T<iFeozz*X1S*3XSOj|w5Y#LHC+72_x
z3UiCz7La)VxSQHA?;mwDr#fBJqQ|1KQE%y^Z(cv?J>U7yUf|W<;qHs4y9X3|lLb1F
z<DckoNH?t;C4;Ua(*gL&oDo&b5VIr*FsmS`xtUgttaGM1f4Z=>A|PnYTlCjh;_udi
z4n)py;vQX>X}LYEFrzHIK|ocAz+Jbh4cW)*dU|3I;VLTy$3!GtjOVewA#RB(F#2`y
zn6984x9yAiHsS)Rjxlwb52{r>3d~Z}&fLykc+rCrr>XowmGyE!?+oZ2*B#ffqyV^1
zT?(hh8A1P!f5BJ|FS<=cu8_X<!T~iIthnAyNlQL$L#(_Pk4c~6XVoH~j8vr78CR=z
zMjisn77408<;ac`6BSUwTf+J{=fej(vq(=$(Mz7f^3njB?i_sa<Eccus&BdRX-S`R
zWf|T>#4CW%{enm9xZ=kee*CA6kMtJOF}=<O;#2the+;g%diOruMuj|Aapl^{ZBt(*
z$yX7Svnbr#%{a+-5$r92)E_S18)N_Vg?w9>B@yyD$LO{Pk0zN}>eu9hfv!dGoFLU;
z<CSSq(H(eRDiIrbWg<{5PL|7$Xv}d~?!bSn7h45p@o^gHt%x)SXV*2Pj<yZaLYG|C
z?p2(ie`r`X>{)hvdm37M7M$N_?|*KJWJG=LX04-^iYM`?%qOi;#+WauU$yg7h;3Cn
zn=!FoPF5*PDPC;EH8WF6ixgRP`mz98A${&Xc~{Al+WC7+g%&w|8yyYojpPu<CC#{q
zkh&G{Ai1>Fq>J&;q&&x@R$V>Yi*7f)i2uTcf42{R_<)+*)emX8?ZfX5?^9_z$b;}^
ztpI#}9sX~c|0M|WaFyQLd2<MDy!dWeEQ>?7RcujoL$%lnt)CL`H|6GjLoVK}>tYgG
zF;ZTK&<>aHTb_GLKIwB@*G`Ku0Q3E{IOa4+&$FI5cj0lkoR3NM(4g<=WOw1vbo{&;
ze<No(3)3UUrT@I#d-}vKfZ-a#V9(9Wm1BCj9?P!C*(61`h=kM8N8vv`eGkd=$Bob2
z)w~>!PSZY;(kVf^XVht=Kf7VEi4@+jORBcTkl2j>=<}okMFpZkCaM<&1)Ja+r%DYM
z$ZaplI?~u^Av?TJW3g%JVWc{$tZNY8fAg@amU;_Tk+G;9J5ZgLoVn=r!M=<lx|TLK
zzl+cGSdLBnNGw_3jh$)ty<w9}x~KJNnbCo=&n=&u{GdVRlXxdH3rMJGsVm?pX-Kix
zr|o9pUt#wJIncw@dqU-&81lv>1EH72SC(^50F3EeF~~Qr(jpM<B&=Vh8v>&Bf5u=U
z>#w<$ZvrwXpfC<*<J>A~4<Qwp<0f>z$mwK^uvKE&O7bh`9P~?JDkwrw-D@?T%fNTy
zhyT9Iq6?yvimRbdA`PS>wPA;H>{$-;&d4I$2z6k}7{?2TeJ$BLG)WVo8W9-JWtP1$
zPgoQeh1|84KBzF4%WB;4T>S8of5M5;P5>vkcA#p_$|H8<@_CTYs<?_09Viu*Es5o8
z|2+%n8xDst58}2+xM_8+QC%Ix_it?x8X1|1sj|;`j8K*_N@Nzk{aWnwes&h;!4p6B
z&)Ri|PaY5aOFp4Vu{u5Rbog@SRVo6NhAko0oRFZ_j%SGB92HjHP)gekf3fEWVb7c2
zn?zB&$kY?plZJ0?L-~uqW2m1ULp3ou0|&$TOrS|}CnQd8qOd%E?)K&fY_^?Odj|@7
zPk#&!c<i#jSq~AnDLuJduohRy@E7G<MAq?e9Z;f4He~$x_}O1``0pdaWjaw@U@Ff=
zt|X$kSP0P_^50?T?I_&bf2&2<PD7c_v!zsKLZB7nWW|pD0m6{S;ALXUf3?{s6+IjU
ze5uaxGv7ev_F{}p6p*Bs0RoqYyg~S<m@JX|%fEd@3rnIGnhXb;Z#T0>(q@Xuw0_8W
zN)+I<{sI?b{`c48Sw6p6A9h+;4hEdY+53+@wC*REy}YAPWvBw0e|_~fNJq-t`k`9q
zED0yU`3DnY>CaIteU&~)H+}7496TkE6OP%x$zyr#%e43S{#T6#KS_dkmU&L9eUScV
zETWI_<d-jzcE-ol_$+V-R3suu_S-MMV48H~E0nB#jSB#-)EmQHl%yoqhbTweVdryn
z$;V!T5UiY2PumNxf1+ptv+Wmn)W6K<RUyL(%Mp5|@M=_sw@K5zAIk_Pk-v1x$~@bS
zMj4U{cR~y9I8wHs$fvGrA*0?KX`{I4^42dj;m^Y%ew$KYW7U;&<Fir4XZB5z2EUjl
z@k+}Rs4C-h9qLc08Ey*wNqN38d}U{dz4l*zvYlmL`i1i?e}mj|PkCIw@S6Hw*PqCA
z*1Nh2ozJ5h)3CWDSLlCXbIY6Jq$*F}7K`^cx?F1)iRmSDd|2;zl>z41UUrgOrEq^*
z{w1`@VR|oSz1N5Q{m_OKoh@ry4Z@!t@fuY3wYJo5<701U*++>+j>ZTpHY;Lms(d8~
z$P&0+Wl_x@e{e=ISDd{8t03s5NeT;KH!Gxuq#r+-l*`edHnzfL?iBj^GxE#OWR8k_
zno$le$1x_RoF^@XWVOqd&vUZ6USSuh5***>N%lPmR?fb_Q)*CyyQ!qRJWDMhQjwD6
zq!cK@x`z(>Yqg9gEQUuSpb$ZXXe>k1*+PxHTs_1>f1^~Bsdep)GcW_mAaW65Fe1mv
z5(QxPmo{WM=DE@_%P1v|G)4u2C290i#ZL#FX*pQ{3PpZu>#w~P^=)Ze^h(fV)m2h6
zQKiPFXkyUXI~Ioly6D9w4j|sFI37#@FNCu89Uy(n5nyTW<aVN<>2NF(9uGnHKS;|`
zfg!g4e{Wn_cV;6+Q~dQVr^3*uD^o^)6?M-9=_;kKrtaOQCdIz)qb%9mAFeWmLEow|
z(K>Rq=D<FcLAWL84E$QSf)W?e*8^J?29BX|MmiKZ?hU0bP^qq&sfJ`aPZ&<Bo`JMH
zRBnH#{?zDGbtSh-_ha2;2K04dWe-%&5|;Ipe=05ak;M60x(63VbMj0?3Q@2w;n!m5
zhX|7*TW@Q;9$KHDt6Q_)vx*LnlTrT^3lNz&kd#r#BxmpBpUV^RXDku!YilZBkj$f5
zxTVwS{FdVsj<Gs{hcCj;tX6FCfj)Oy6txSxVpcAzPFKUHaAaM`fR2lNj<SoyOxiOv
ze}}C{pAGPEzz-RlM_uWV)0_=m26BW^kJ`!PCTN8hFam~pE-CnlTt{xGsE+Nk$GGq(
zQ;beg{*KlH3LiNEn#^uvad|w%^`t96m(&&JsEfdJfxy@Kd?f0wcD-VCp$<u|3t`t>
z7J{))PVa@{R0DGu*M4|zZ?ue!eB+ExfAvm3L(G%JZ;iTW8H80}5v0tZwB4+v>dfb*
zyG!)7bZ^)oVSA_ncg>0+M>R$5JmcEC41qKot>j@%eAIAI#f0If<o(yMQPLt?vbt;P
z3|$?TCuXX&f#9&dQM-+(94uKXjRj`4R?L;AWEnBoe&ZVY>~<F5Y<=c(0m_<qf0Zkb
zi%GiTEPo54LQ~xBWygy28`l_Ib9JcA^*p~s>FXbs1Xxhh(U?yX6%EPm{+Q7e#Cr@B
zo!gSyUJxG)VYRz*f>vm~&sC07hTy`+_-$ZoBc+YgH??v!SF;RU=Tv7xqLvcQk<(hd
zaSkz7Se46oRz8h2^*dE7+<Nu+e}k%FGpCL@8jYx|CUJMl;}9RQ*!D0HD!8P?=qaUq
zR53tMejdIpZiehKj>4R|MqZTaOvMk&94VaTTu%VXHZP)3ln&W2*(cZwO|f0TnmHkS
zE5twL=LE#C@Ed_LM$1d7&dr_zkw5?w2nr9!E)l3ZU83Mf$9vrf9h+0Ye-{R<0!wJY
z6XO2pG0dOCuKYgyX`Oc9vLY}hjx}HZW!Paj9e0L`rz0`C^Pltlx}kHcvJELY4MKTL
zinekJ`^XfnES$4SKcooD4I+>_=va(AcFLa53r+^Qkq%JZe8l{*^Wy2|X0{=xPG>tA
zDDGE6K8hub4BO6_$l^R8e|Gb|*!{GA<)})5>s=TC96~H(P_KLuMbjld!KDbZ2*QPg
zGgnh`D3o&;uFR7c$H=7EOdN{ECIb(SC%tj7RRy1J5F;W4NP6h-T&Y`=6+4#^nU)#!
zA}AJ%lW?OaTg=oSK;ht9l&9r{3>o6cIDR^=$O4;vlP`+v{KlD3fA|56-eyjz*m}Yt
zVO!_iCTKs0M=zhhLhPO3!0x=-t2&nE16^h^7R?T)BPFYpqd>m5MRD27CzL}G<t=Z&
zJkE{1(!9;az)JCVcHm33i7QlH;8I>uaW(=q(!C`2T6BikAt0&p_&SUN<~YFq_z@oZ
zurgO9i5w1SB)=ale~xtxX_o08&^F+CVyu5D<|UL`vL9a1Iq<i?{twbx#0rINW`Q9<
zgwUB)u2M#vp_UPmQEpTP)l{x18yWVX@@!GeqW+SQDsf<nU$8FlrDYR0d-&5&05<#O
zmm%4pPK%3jGD<6{<|6Nk9|`XV6C!I_cwA1Mf>!YW4gr$}e-TS!#lfoWI8n_C3N#i3
z;h<;kmoWQp8ol$zjYHrek(!xP)|#J&FklOT!ruM1ox^A^TLa$BE8fIv*0!eXc#CML
zD2eotwKMCLs3Dv2`FBT0T~4<zct3`V-Ou9N{yF;(%<bp3pL_g2`)_#1Smfty_~_w~
z-m+MapXo?af1p9q$HH-h7u=eJmo_&j4eF+|8J@{Fp};01t<8`Is6QE;MBbz^D+(3{
zjI5Ttavt|8G)4h;360$tRsziQel+;xQ40;q%Rqrg-E4hCxQEIat;C?u|LlQonZpDt
zL&w(2nMx0cT!zIA%Kl=!fM=F64rX$JXp$)j>~`J+H|_Hz+=hWE^QR4#>(lUH3%^t<
n{|Divjs)~;rLgQepS%?r*B+GGVm1EPbCdiZdhyc{vq&WXW>|)>

delta 673015
zcmV(rK<>ZYq$!k>DX;+;fBlVISH2+nT=*1Wq}wED3^_=)i^|M0bC5(kmC2K&tg2?I
z5dk7Vh7v@;2!Kpl(*2#6+fVnY`#$!4Js+$-$zA_7>>&`~kV;Qw`_xeqG3?mG+H0@z
zzh-RNp;pKA04rT0`iezZQxLZ<SS1#&62_`jpb3d@Wc^<voP;oZf2g?RO$*3`t(k&=
zAen*_x(bOlb{=|8E5`}N#1NV&I1!Uhy;LVZ$lA!q!;DCfMSfESwG(P0(i1ZjPK@o`
zBi?dChhs^6dH8-H@Ac2~WyTDOzw3h{ViJYY6YYamwK_k~7FWB;)>ezC7dD+C?2EgJ
z|3*vbi@8|-e!0kae<<|(`yX2y1}97qIY&d}y;1W>N2e{m#aq1obg~MDG^{R8@X$Rh
z`Dt)NjeE2Wis@SW*EC(uE8!s=l_ycYi!lz}&t&QWUqR=cwMNWgkxw%mw01n{>MY7~
zsmUj7oMm-F!u5$QRwPc$=Ti<0gVsh*?d+&*y)4dimA3ibf2AcuaB$;7QiL6uH%DAm
zvPtsyg@Aep6=OI=ndJ)GRzfdkbRfGpKM9T$pN(!BksHsee0l+Rn?q2krq<9Rw{do@
z(N+7~bOR@?nFB14m^Yf2-h|lKIHnWPF#E*aUYcoIo-d-!;UY(oXj?AKtjb9*F2)nx
zsdqjVi4^=ve+=O70cFA6VTQ|rd<z(aHIIzVQa#5dWu~!v%=XJ{^9OLvABbuGU_A2&
zW0=&{UPy{Pn)AmP<J06Z6Yx_wr$3i*Ij+s&tK*BJDzPOcR**w<#dxRzoZ{zp6y%sN
zW}(bQS+MBxlWf5*dJLI#7nnfG*^n4;Hk}O1Ny^@3e}sY;Y?Z|f&CMt}Q8Ss0-XU>t
zdWQ(C5eJ(QZ{W^!h3`Qwdqy9+D9Xida`9k|QX*OWSN%leXU%%k(umxTX;F#oZk`g^
zSuraumR4e8)s3keR$`^pDeiTfgSWSjfQ50J#d|dhR>aqq@bIY4b9~Dj6;_{iR0gz+
zYSBTkIrf~Uy`K6NB(T);S0at0?tG{vXR7(d3D5KCs)`lnAgm;k`{OJyodY)~rzNLM
zs`1zMQFbT8?naX`8%KXVMrI3K9@k?xsF%nY3J@yD4YO%9O6<Rd*8;3vuq4m`1kflN
zhYc^X>}*~A=^`*bvqwE(10F5fgr)t7iz)rD|M`DEvK%8id9TE+^8BnUEAgiBgRNEw
zo*~Je3QV-reI&>P?sR776i}g@b9R#F(v5jm1nf@UrL~ZQ)Z>3{5ci#e&}2UFH=QtN
zjGDzcm)r?#)=?gDb>lhb*>~kaardO-I2$f=h8$R22>aD(VEhl-T{WBqJ%<_J$FjB1
z6sK7M&1qU-RU@nh!|8M3fS#fluWgpsks89&Uh~UBx0>W)>t2`4`+90om+=zD92dgw
zzfBRfbvT0X(?Nd%m5%{$$fB}fHA(Zr?8+8d_Xn19M`_8!I;udJEcF3EDyN)-P_l>C
z31zo&8Xj6OHO!(9`M;0&zn?IDkO1Sr&2UsB$xC9$S>TnKjuOd)gmxnWX%5}RE2rkK
zl@1u@%r-a0#}p?xL3N4X7S<igmMn@HG{0fA2C|jk=0blg5e{I0KU8oc#|MB76+?ZI
z8rhd@R?P`$wIo|7#l>A%x@em!T#$&SN*aJKQ4B0FZlEObS-}zR+Gudz;U{1d<P{TO
zPDP|0GC!h@-5+W<h76&`mm>jYK~e&pADiC))sXF%8{VcpY%*=vbxM`{S{N8y^$SVB
z&BFOnKZ}3x2eYcjFjj*Bzp$%s3|0eHZ3gF8Ll1OCJBYNb3Ow&;Po5;7JnSUjvjPW)
z?j@grFOdSVoxXfO7lHGWhj4Bzlb?V8yTdoH`xTwGv(sX7rR{WnOc@&M#{jlU?tB(v
zaD8PPOgdj}>OKCb4M2Vlv(2|gxP=u62Q9K7bPjABIlL(*tC_F~MD%RS(DlO%E5k=%
z*z0eK>6m2sG04*qB%NlfIkyV6)tr+Rg8m%~50;L%@CoNEWyqGB<~~b4&&7MQlRC{7
zW^QOK#NJLVf+F1s9>4}5a$>#hb`-GV@8~3f-@sJL13hw+U>+A2uD!~lDgZ96&;DiZ
z0=?^|*s^Tsj2sn{jvgU@u4b&<v|7e}7_QI4A~`y7c=Yn{=;e#y+pk~0-h1}yWg49+
z7I|pkjvOcU{X5$1KMuafvi+DEa)EtJ3>V(x;21z`3r#m|TZhv!MYc&Zg)w!V*R~j+
z0qW)fjF<#p%y_ZIe0X~Tx_KWd;GMABCpdM1gVLwT>#tAh&pyL{zRUZhg0(k|yB*;2
z5g|O$w)-3cb&_un{ttQXKL>+u(rz;oQvM^jdZP2vG92=A+i0eneE(x7VoV2DbR^Dr
zCg$?zy_@)`pesxJE!g689>l<|?DdKNzP`8JULPa(hhHNFIA1K?+u+UGT)<ML+xs)^
zb$1hi<H!+fi)4L&l)Mn2;^X%EYP7#iHRvWdbyt<97#hAPt^6{359(&uw*gTn+v#AC
zvH|CaDCtlw+vz>IW*yC!C;g6o#i&*@O9eWREkwv{WP6ZUg3f{ZY+IFhGn7Cz7Wr>6
znagMN0OjmFnXn2PN}es~!-22?O@R1Pa+M=#nM6$e28oz|qilTYly>bXJQ|v`iil#t
zadb}Y;G%7P-32jJr$!F(SPJJRQJe%$3tN&(zYR-BH<@sfTgfhf8G~Udl6Nt4IZ4F3
zaJx_9nhq7oK8t)pLqEfIS1zIcW@)I;<a757`YzVN&FMnd3mB+GZo8H&CV}rnMX<%4
zA?JbkmDsv}F*gd}D#PPHIImWbTD7ktkP9HNcrisYWrPC>T7?=#jJQ(T`B;g!-4KGr
zOnYLTuSB?H>M(6hIIxZm%PGAMrCOIrQ!E(op|TB*)5?j{)8g)uG~T(#`U3C~8ETtx
z<|k~Adj4v^BYVw**}dBDsvR(uWPM4lL=+QV%uZB)V`?x!2=o_Qc@VMFTEfIis-k8N
z;NWI*K(J6DKqWXRfv&j@k}V!vxKWRBn9v`HMdEZ<^}n%6Jo!cISknWX7rDr*=vm$&
z94KlugayE;)-sLFt-UW`)0xFU6~S+6Q`~<l-X|*F3tRbmR!rbzNU_vuGDuQ-jQ=I6
zIVD0w7@f#!R0>8X1cc+&1jfo6-eIeSqU+zXq)`}yRTNrPmNvo8$i0Jogu*ChYIT-7
zlX#_Z$UqrSAf_XHe7<58DgEw`lkOoFe;;EIPlXR2_j=#a#`_jPp0AkbWqT&yaOAn%
zr4LF6NVCo$jpaRXbUvC`i-_8VXs1^Cu=N8v`j%I{`9k7X#N)H^JI-Z`S&|^BDv!Sd
z?Z&>-@Avs5&&qNM5SMx7>Ll1fBe|RA4wjFnBYPf!A?J*spK<51X^~Z0TY%*Te~!LJ
z<Q*S*LI4o|AZ~$!?wZJlKovZUf9bTsKjyO!|L);UTre3lWuZ|#AlwFToK)CTs!~BJ
zK4SN?%S;&a2cb2QnMspvmc>$VA2bE5YhVv?-`=541N}i$#&!mwcXh+cCSZ%5mp|2t
zj4xD*be5T`i6od&R-Ls%kB(55e=I4j$#;KDw))54_VLD+K4@)X4JQNibD&8_i4FzV
z^kEl71<INX#v?Jch9Br(WYbmN2ZpH0g63rcr&YBmypq_ysYsq+9cOvAv1Wqfm5Jk(
z$^Mevj`ALiWw~pNbd0gaPf0b8nIu@BXY5Y)XGT1G=vVUik1Jv}e(QMAe^vp#8{cX}
z0veaeevkk|H281r=pm_2u<*fe)xWjlY0PHTWxkMaMx`=rWKx*rI7nYt(^iP|shB((
z=Y_L&%@Ag%QP&Bj!BoL_TUA<v0-*}vgD+o-Nm%0Sl!-e4d9YbN@AmdBUj@<$J_756
z#x0B&?2gvwc~#@;DD>a=f4)eHAarS>azn!&PwLd#<(!#hHJ6D0W$w;s8=_AQ9bIwi
zfezsKIWlqIFMsWmLQnJx(n33M5uFx-w(a6b3m2gm3I?*;Qoe(3AE#kMoAOKPB<k_T
zX#W09uXQwH=T)PTk|ys1GKZqj9bx8s`+@Vvi5|AGQI#PTidsvA5b{>*ubv->`F{~e
zZF}?ihm(&a9)B!VC6T8pk1v3D!YGt4-ud{pF}s6Rb*2E0+@<)p0EVoIf^5o^z*iSK
z>zdZAEbVR6$N7omG0xQ?pTnM4?JZ7Mid+4I`yrw1FMJ7^r1^ib_!7!58~-PQf$IrG
z0gj%9slkI^iU@#2dFnVH=J%pP2@m=_kM42M9H#>=lYg`iH6NjSEU0Xrj_5hJJn%R6
zxbzbq^pd3oR5(pJNJes!<b>_jVGATT3oYX65LfZZs-sYHE_#}e*YL%rZqq|%h!DjA
zyzH|06Ju_dsI4@CETUqo9|dphx1?hcA3UV}zT{xHKdj8-ddS{E(Wx(V$F*9Y8|)OC
z5F;ewG=G{phS*3+Lq$tfW92JpR{C;QLLZx!>L2_jA04vPW2ZBK)Y#g%3xNp&9OR)M
zBah2poUS8(&dMHK+^G)ci+m;l0E~ghv97I_yO{QIS>Qory-Xl56OQVRf^16cAHeK>
z*B$G&JJkkz2)aS!WXg#h^{cGeD0!^S+}hJ>7Jn|qE4!NWv83evj(gk%Bf7aE+J^8^
zS<M~$DY4%Ck#K&m@=9iMytwMoH0Td;(e}93jtj$lm7iuOS2m>9!2(*0?%S0rYI?IP
zu#K0QvaT>g7K3uVW<Z`)jjaLCMcDKhpvSVe;mq^7_*DSN=vG(G^qTkV4s`6gBz59s
zs(-9?65jW|c=`J1kQP-V!e8ti(f@n)>ZM%MI&LO>aA)*rHvb+U6wK^I%H&>rSG69m
zemMPM^3;QF|G+^xKN#>Y=>Typk{7hhOR=ecz+pJ{ZwF1q=b(Eg^$c#Bi$j$~UkR(p
zW)T05ne3#M4Upas5H$&Tj4Pec8qj;(k$<7Q7KF5@+$V?`klN(fbqGzaYZYS=Cx`#z
z6?dt?1;HwX&3xu8EMSyc3lGm$Qskr`2?FC_8eZ8k?=RY6zlO}Rt{vDrs<?~uy$Tcr
z-F-N6-`M$j*Yo!FhpnpY^uil4PSB2ITLn8p)ObOA_`5%LYA5aWBU4VoZOV3P{eLq2
z`Y&s}S^G_$dkve6<<1#&0vnmb-v`(*Kis`_*a=+gbFGE=$Eo~g{nR~ynIcl2UM&j}
z$u~U?V{s*q-?1|$Us!ppO!iQ#^^(yOAp;l{)5bc5fdg28e#Y4jE=JMKdZ~LFyTTD(
z@|Z?(qs(^$0p5Z3gzV^>sZ1T1ihmy*KnZosnj*PrON3u18dwmmEMcL%%~rXExY{_H
z+ia_Awi;<KJx23Nea}<>`v=c#x!#`?kHf5N>v_9tU~FqWPkR*_uL^(|rPg>fN4mdV
z672*A5OZxsyI!XcHh@Oy`dL;LC(^au>#3}L`0~}u=SRs-^7-30UupdHtAG8k_K%VW
z_uE2r5Btgg5W-HPbQ5mnhW2~2U|-tDp1=9}_0jfD2ZNGK1^zhl;+B<u6#0NWR{(s?
zlW5d8ebawQgR-_eZ8MPRl`XfW53Mvu7M?MrD7?RN!t|k51`Hm!BvAy3Y|HYboa*C(
zhKF~m+VP{}kvb6I*SFfPTz{&NWF7X7i<NqNPMfcrym*#p7l?zJpYFl`sop>i$yEeP
za1|jyHkt+B+dM<uzuO*bf40s0F?X$~7`9!*9|v$atKOf_U?cMzRbn^1RPyO3j~?|t
z{q+9*j<(9`inSX4cvc9UGm5Q+JO9DMU-$3R|9eo|{vi|S!H!JA$A38Gz6L*@yUg9h
zE(eV-XsOF{2G10EcH9a1uel`PQQQX~-~&P;ePfzU9L;XSx6os5qtX|%o{r%$1cw(p
zgDcH8vhWd?ab}{G8vx2gnCpfVfVl#Y&`akI18;6L#l?lS1Nij$O5D}9L9~#EN~g&-
z<J_e4)1iGoRSQ;GvVShmn~Cet-BK9h4bdPC9U_}5k}N?$ZjpCEFdRGVdK%4dtF_l4
z@gmp(+dJ9v5(<QV^l3MHFnW0MX#7e3>Eu_xjX%Vq&en&%>{#$ti<CZ)?epbg`pf46
zSy0YZJ27Bf2>}h5lyN4nN&Cf4B(#kk*D8~T1`h78O6;DIhJWl;f-bX_Kovwne>!I|
zL|?B%z+A)R_^Wr|asPegl;E_WKW`(a1nkr|zQ$F}Xe=xFL2T8xzLC3b`pO!wUE{7n
z*FP4MJqU_wn6fPds@ub00Mt9Kn1DMwuZr2~{m#xV9F<E~xY_UFp1hy(!{^z_n?rth
zw8$^r)6-%!|9@lJAnS#j%{GbyBDF~U+lXrziWB&rdz!hU)W=&d6#KlSB|#t9e9xUT
z{b02~z|{wAt~>7`Args0P&fPrD}j&mscjC}*O;oj-lu_uUPIc{?UdOasIVqZR!ZIy
z*k~YUOcIrQSqKf?Zse39o2`A>8=dkC%a{8wvr~T2bARtkbHBi*kPAma5C)|1b<}#V
z7uQ`bF2df!k|9sBs~As`0l;!=#(7sgH9y1P%@Jgh<;pPhmB_+k!WOUumlH<n&15y@
ziIzk&4R{S6?j{%6v>3}R*x*^j(ZR5J%F5Jpl<q(r4M9~YZLFAabdh@Mxo8D@Sh>zZ
z=r+$U0Dsfqe~9_ZTj9g;1_!1AWq40|G#3k)ziV^B&OFPZN03~0iQe}UfiF@>05k1N
z{?KXunZTXe*5FSpNNF4Q=-i)2aNof+qG%!_IXIE58_z~15gT^TVjOD>g@$tshE6m3
zm@kR%>s!8x{le!|@)-Y>tLjS7<DPRFirGc^&VLX+v}k&kq&q{7bLRleDd(Dm3%~(^
z;~c4(B0^uDOBhD7-e#EkkA!QNoS91B)lKRa$HMyp+`Ix6>)D5|z_o6c*pDrXq-ma#
zN~MAD16J3yM5D$HNQ@mvcF;O3+4p)+3|Fj3Yk}JrY)IePafe?ASvB61qlCsm1#&7T
zn15%9S$Bh(a;<@~*^Me-O>&HQRCp#49QRU=#D5WclB-Y(`NeshYy$Xbz?(@iS#WtL
ztrB&*LfnDY6NjFGd6gup0}vXfDQzISlqYS0nElE`6u2<KQi-Fwq3+7#s1Jy(`RM*b
z+Rx(3sFKu|4b&NQ)644`qGYew%la-?Cx5$<7)|awPMlKT`-<j#O6$Uf0lz#tIv`5%
z6TMty6P)GoM}q>dYZHGQ#BSU@yZ|K&Y52OKSn|@uwRt93P?m#mgK&OZxAsr?-v-hB
zr%3E~HD%QKoroJ;nJN&(Ht})?`Jo}zbvDyauCYw4(YKiOS73Qc-b@drA;SX43V%<2
zW<}evi34KUs-m^-Z~U}5f$M9{X_l@4k?zpXBz%c4ef{>81%N6xg@ojhys)<~KD-V~
z4`(V#5Y^L>*iRblrgr|^3y=wA*8GtKx#xGQ^SQ5JXB9k=Hswz)UC4=LR8@m~IpqKr
zf3{eWdk9PM`6M_`%;Z}q<60|nbblqk_(c-+>cFqh^{Wu~(y#d^_wV1|&~K+czxC(7
z7Q7S?3`GOhy09wqIA5S=XsB=N&jLsrlE~#n1&KYwgJQ5V^bxI}kdU~$V$2-@>)`nI
z{YbbVUfrK_a6x~`p7H)@HM2iYOa7-iGr5Dq^xoxyDIvv!s6X&nNt#6J1Aob=Wt!fV
zi!tC7pxtCkzPpt=$V7U1m(<c~wYacwH7_us{m+Z{9JeQuk}f-2{QbhyFy6l0d-2sv
z_@=4P9FL&EyD8FAq7iUyVPsnORq%0VL&0e8T@~VJ*5z1`PfH#%$J6L>Af>&k(nZ`c
zGQZVZK!VF`p=qwx`-UpvI)4U<JXjL7z#ai#WzIQgt>Xjxv)SAHt4BlkaCmTYdblq&
z4i&RJ-8JFOUJ)to(h~n{LIF@S7`Ug>NJC*Mdu}iaJQLR1=^~q-**Hx~aM|J&mkr^V
zJU1xGBtS@sHA3CL7k;7#3hHsUd-e>mg^P}hi-^HnYzL=ozvI1Z`hS7#HiTT6hShwq
zJDV)yaGTr{&cd-NJk87U=+V#~kfPVLv&PeSiQF!f#5pd=%1@20ps(fTY>H|&W@Rzw
zceUbu3>l$W5cn7}fF5~cSnxRN;xYdFH2s0t7)Ru@k)2(AVpyf^{#z_AoA>yvPk-A>
zwW#a3nDuY;Gtw-9kAGTjL*28uJ%d<&D$z-%9(xaCKQw_gotAGSLTX;iwG_TS$2IW;
zY<=H;-`-6={c%fjb0U>H*{)HKw%BR@4)FQpeNLIb?t8zM@70}*5>T<Jb*1hBl1NH!
zbBy+8?cGN|Zn<e^Ut>K!Uhro&Zez*$y>|Z|*$F{98$xh7zJFVi{`_Gpt)+cVjX;`>
z$P1?FDi)kCgw2Ue(fP^eNx>zQSMznt%-XgM2X>oHdx)bV*Z~@i71OQ0&uN%77TCYm
zuM_pAQF8KRfC#<zZu{Z=hrjCGe?b4&{!#tHC<7Im1YA94E%L~k>eu^fYjKBrrN?Y2
z;e5vVT}?!=)_-bAhd{;Am8+R6*kvOBJiB7W*xU171{u~dXw3(i_cp`Zv_hG<SO3(e
zJ1*Re0Vo4>HFd!Q9H({cQY1DUIYajVpE#Tc6ed`<j$K)s<`y0f-2>c$RLzN#Gz|)=
zYiV?>Nw*rx0M}4-A=(ZcH0?mqtQ>wDDG9R*p@Nm1&wtn)$XIJhVcpHB_h9yX)x<2T
z_$m3R5X#s-In9ys26ib;7qeEBr4RsjFROey@e)}bHkOfSD+LS{WFXZcPs-^u8<h%{
z#2P;~h~xu=Q2QQvV6N5q;8WgaXoeVXQd34<7B3CC6=0%v0>ti0@WCsGW+T079mn1B
z#c^djFn>~vWVn*hlFiClAtnlYWGDj;v3R-q_$N|*yjI=9Ll$>hJOhf}P%l=5wH74A
zs0M*%AXF~YWZCj%&+p#HwF>EqO~;lSP4rg~ErBAOPl2zWFE8^v1fR_TEh{4xzyryb
zPJ@-I($=<)QXlCj&mcZZapB9Lq+m4Uclniqiht5leN~*Qtz96`q7Dpd-wRV!@15J5
z4jkE_@exGs-;&Bw$(PijLW4V15z1ueIT#R!)?u}CBRI$i7_93unCMW>H4iml3LFCF
zD$01{H}6Gr{dto(`}8bm0X(>Gtj#Rp{x0}P?KU^JzOmz0<5!aH8iVMpK@*2e#}KS^
z-+!}8M}i@U(q*!7{ed}qonVr*-QH?|PZP$qszhHuDH#g1p{S=OQC>4MEvCxrCMRJP
z8YpA*uauPIqJ%)0l4BNJC@4Y&yKL2R%qpx@f^4*k4ZAEJ(`=k8aGop6z%6cO->ndz
z5A?%!49IDkaLY5}DrPlTjAVn=>8xDXR)2=xuD+w^A(>ut0t?I*gHMkG_eZo-ITwQ%
za=~_i=zME6VyH@twp0~T*a1<6ec$yx1fG|(!|3h42M3NZ#%b9%0C|HT)_}Yn2&&<8
zuUBfjBepl`DAWA?I>5IRADW&fCNy+Uni$daAg2TSM-9O?1{aT7`>0^&K`gcY?|)vf
zUTw78_Wqn;qqOm6`xa9^$)?p`Va`8jBJU~a`qC108`zhU_TH;kVFi{XX&`EcU=xpU
z<M`G_=btntXT7ftuRgdY@OeoBab1?P*!(%!oPTboP;0u1<=G{M`M)}fcqo_@d;qK_
zlj6M|ep)=O#RnXVryfH-5Zy$8aDQLlAEzz`h0jTvZxaoq_EfHr$Y7~0Mz0h_!BTDj
zSGkc%I>))M*{2<-7ro<RbFoK+Pa+_!0&P$Vs-(R@mb21@0%NU!#I^^zT8a|&z|X7{
zH61xLI0m!b*?F#=^?L~wZ4@z6qNL=l%QM8k<cw6zL2toqs@Q_HPNm?_MSpLe!QDtA
z;An)Oi+qxN`Eu_?%80eEOL<4WRL*--B=KoU9@D884kM#iRE)6MK>tp6G4EV_fW`;K
zbz((Wqs<P)(7SG{YSoIOTJccBGR7%40@g#5=Ps~C;43s$C+}da;L4gc%4i{tJ+Ice
z-gb>mc3PI%$$;$P2EIlFX@A8%01Ljk1N2n;7GGPFh#CL_gOYk>UD|22_NGzMJvLv2
zfaXD^C}`|%w-~g)f`_;!))RBxFq3c(VH!SUeAhP0g*!fMjcR-$YSzk>@Z7#GWy9Hm
zrcy|cy_{@93n#QL^O~%?KEpvSW?d;_g~n`Qs%)h#|EJxNr&vwr#DB*Vm^lO?S}Q<l
zwjVMsMF4b3n96>x)PtI}U~vN4e{z{EB(aI16Br{n@atq(@#-^ldq4SFb6g#^D3~b#
zpMVe8(mJy7i|U{DZjR4QVe$+|rCN~pkzEr-q}AHlIUsUCL`H*+12C_whIMw~#j72u
zb(MjOb=99~R=n&nK7T5zzQ}Sa?KQNfk8xWK&$7ppPjQ2^UMm40%{4y6t@<aqikV6Q
z;k)h{Kd;q*Fnblwp>5Gt@#OkEHqYL=TGl*+H%%Vex#a}jW$w`It>$mT)ZzW6>C>4z
z3gn?mG3{eZ0A>}}S=yS#N>+!}W-(@PiZwVDtC5Sm6-y;-RDa0-NJ_J_;23wtt*)=A
zA-pE?&$<#;7WHK*n3_oMs#~*bSBpRaXQezT0-x^o2?=}>uLy-$x@+N)>U5r#G&}0I
zE*7o-*!${L;FsW-%bcr7GghEuCGjR_Bgr#ZC(!t=TmRtuo}TbXf1aOX-PSeU=9eR)
z^$nP5$RQqa_kUTmEufe$-U))(I*0EHe2Aa1MKr}=xUE=%S!%88keeEEgM+sczzo>7
z#cbqCle2ker*9fVU<z_;sgKn5rZMuMZ`<KhJQ+J_hub<*#Z{YX*mqrAhqBpl*}+~l
z+?!>~s^PN5zBk-D|KqZ$q3VxK51*dQ*Z9NE&Y{A4*?)Kp?kjjiikZj*>)co73sMj5
zWObYw_JE`*(MMdJ%H1^%yxrhAK${)GkO}dEIfmxIfgvkIGH_$Y00v>KWWf+!!#q|u
z9*l7a_0{fX5e{+_407;}D!JhsRRi-M1}&`J6ZU}hsNY#FEWX#VZD+9^M7^3?*sxlT
zYR@7Hhkw+BimM5#1q@pFn%gT->$Pmb=sM*-i^XEa4|EnYxR9hrtwvkc?j~E-MjOE$
zH2>y$bJrLdvUxG2!>0<&C}u7QXI<{qO;sBWRop}cCU%ZPbmznE5}^F33dh>wO}NNR
zQ1O#Z1kP>@#tt)9XsqQUCv+}4T=7^z4dNmtiGS^G3+gRzjmE8O%~g2U&*!yvFkg}(
zSj6kBirn_COpE-a5YuM6n6ts&eUu3Pz1<)KSfN{v5^djVka+OgF)|^3NtB|dFKagS
z)o`TlOkOJ>Yr>x|O6qhe38FJ9ZK-8VY-kHaU(QOYy|FA=v=Dn2-|Qz`>_vUAtSvQ>
zC4XFOCn6|DHFc|?2BCbvk*|p<jj=kaY?31}_M1rFtU_FN+hyS?0VK*usHrl@d4JN7
zUuNBsr7Is$=hxRW{0v&+vvQF9XR@2@B>$GQlgG)^<cFkh5)FGUK^S-tHj7og1%*}Q
z2Nec79jb3kR9L)fW+uzFfE#S#bX+MXD}N&p?{Rs8)5V)Kw5eT%#TTKxt#FHAw7rXm
z{ReHEwknu`-g=j}8%Eq=pBB)S{8SQs*f)mqjp2i~#^ax7D31mTf#183_z51q#B(Zo
zA}tO2I(Duq&FnqkC{{cb*@~d7RNfdIlmM2JznuPeQ5NIit3plB0LpBBz{*wgS%1Lf
zRAyr=!q*$g88mZAy2JFUx2ggeS_G?S{$${_6cbeb9#G2?<v?20nN-r8u|bwb&0lrQ
zpWFF@>!PUxb9#lg-YiaOw*Qp-Q(|<bWrl)03sAH|^-HphoH6d59P^CkURFpOEUL4h
zJ&97|$~00Ku~IxEmpgqfA~z;bqklTk)*tdkF}Z4zRYnFk%=aWTf-6esx1@w=P{)iH
z=!ixSUVT=U5~qDnjV+Z{a^lo>3q)_!b=V}nv-2D#FgHRT_pCzrvXr5Zig}3b*?gS3
zT)cE7x3O7V$LSRwUKfKr5tv^EdCx|uY{jN7Q<Pxh-q|q$S~KyC*nj|lmw(@(4l{MD
zLi*GDt3P?9&G71gshh#Yc_5B<f|*jJZ3~XRBr)nVw0Z~gBgamCb{br*N#WKonh`UD
zE94kj`YL;eu}foH3um&;t;kGZk1rQNcD^8w$CkIrG&_~)i@e8(Mms^pU<oB)yjFU$
za-NP_u{2&dJ5`y|zGx_=r+*suvEAET0=pygA)i2{pG}3>_(rRujYTU{AruPSk7xM{
z_KdiI0zOXrfW2oIy&1TAzL*HQ&<z2FTawgQ#Td6RzLG@VgC1k%*I-83cU49{42Sp`
zhmRFw@A@#EXUX=FFyeEaSPBWSk4k!PLj+O(Z<_ovcD8B3gTP_pBY&x!*Mvov8E~AI
zi!5H=mQt8A3c|#r#oDfO0D*L($@aHM0D>ib=oct;3?Gtp$xy_cMB}A+`G&`mje>M!
z5CRR5g&`9tpxH`dcjO680EUh_QIHZjr_bu1#Zff%UOM<+0CwZXzo#t!F>->rRz&uE
z?xShb>+H>1{uEKI*MFLvrKc}Kc;64|DhIEAw4OFZ<}hX4$_WMgD2W24#gXl@l)6qY
zl?;YD*h<#iCz7;Zi@Z^r!FntrC<-S8%Cv^Ngc{y9%Hr0;*u&2p52*5~b5aUNRm!ti
z>jnm!L@?#Rn1Gf_$^h**#0!_Fr($HZ(v;T~j!TZY8^S+>T7M5cIvF%w$(L=cEa5iT
z%{|Y79nWT@(_)EhJ!iIZ&CVo}RXs@?+PaRL!=5XH|3V7P`6I#NmOtkbV;>NqEVap`
zffxo_uu((&O9^_v5eQn432uu7%^g^Sf|kpz`1hTmpd~c?S}bVyNC*a<JeF?X8XEc|
zWXP<g$Nc2Xn13~3>7)T#TGHbpZ0VbNnFf<%Xw{1V$CX_$zHt*d6pP=P5QQ7w0A<ZB
zgjm-2!eCiSdh{Sja*T7Yxg+UhAc+c)NYiVUenX>4_`ai2_K^!wGDbBM>JdX4xK>?l
zj;4)r5<y(s0Hx|;Ll1ph$Gx5v`FX5=2ui~^Aic-I4}ZG*_?9GmOZwedp5<mjG#ZSk
zP~&24ccbW@_;&iuD2&h7=FTlLofXxYq^6`dOk~3=4REBgvhi;yw+O=F&R@@W7}v(w
zPV%ZewM+omeK~SHpZ7*rJ^ZUEC)p@RS{BL#vyyvOUb2LVvsv<FN%Gr&Ati)`0Jx}1
zZ(5dfgMVMKa3mV(iC`Fvi;H3`A;VG#`bx_G=F4Vw%(*fV3v5b0`bo_21GwEr-m`&_
zxFFe$SgIcdp6vE1j~@lG?6!H3!tqo46F)Q|QhBn~bP7@<rEmxz2tw8_Q8KaYNW0NX
z`ib{`gC?Cd+rf6Rv^Lf^+CL{rcemf~x6xMn=YRCL{QBINpR8}8WHlhIcTo(qtjcg%
z4y!40!6Z$P|8DO})AlU?R~}=C?Xul%!;3%5r}U^Gkxl6ui~@9lGY^w7?3pk!wSU}7
zoAN$?s3R$`)u&uBfb{HYDWyKujHdVsk`*dxqJ3CY){;T{4pZu9EShGvtt|BlGq|i+
zSbqZ`i@V>SV@jh}+8vjRv_Hcddr&2*@jD?hx4jSfG04e74L>e_MSl#7@l!rgs~o)c
ztf2W?oSbpi0<$aBi&cyqDHh1NLMqluynoOvGGQCqJw09Ir+l#U1A_fCl`mA9|NXmi
z#L_jr>}sM(nL`hEZ!uFm&RXK7)d^^|K7UuKG=z{kc4Y*3vVS#{dYV!4wG}|)Z;V~i
z*k85)LRbd?up4YhGe{#v0uv(z3*Ih)2-~lp)aoag$nh}>C~&P9?&C+UhrpfuSOpPS
zyNLx+UoUV{sM;E&0EefESm&0D)d>Sk97DRby$Ku@M!oU`^U>=XNLa;(DR=s+Z+|4z
z@5J2~Yj{$)?G`$omPWj_mM7m2^}L1;$GTehVHVR}Ubm&-g^C61hT0ES7&zNZEv^!V
zdF2DW^g&CT-OyiC4EYDk9J_K##u}ns{L3hce-2gADT{ujO?8OE>F?jRryE7KSYxv_
z3)M$igi9<)U13c2r2g1>!G&BsHGh9&3E-+`#cWbi(ZD8MRLo=Bd8tdx&uS*#@Tum=
zrfx%i1ovBWz~CoMwi&RY>aaHqm3p^l<*X+cyL5cA4*vGlVTVR5j>%wtEM%%wZxfSp
zziAV3uB}W<P%4mEoh6mUgRWL1R|7`uT@nNiQ=g`pG=+0v9%olR-NzP!7=QVu-4t|;
zwAQO@(MN8zP5ef<)ecah?n>n1Lpr|<cX?81^dzEE&gV-nlr_R4+)G|?HTq2QS!YIT
zoK0Z_DY1(xarrN7oD#6<*F+B?1nIWIhZGL`v$J_hdsi}{>y*gCpR>$*)VQ_05F&=t
zQ!ajd4N0-D-wuFa>HCKLKYw)smiv_J)w+~Kr*<(N3%O~9sVfmMHS(gqgRy<Zjd2`i
zMfmDe&7cLJej1cz4j+$U3otk$f_Zkzn*d0`)MX9;DOutpdT00|iz3Lev5JWeIenfQ
z5J)!)<4^b0;q^>G3psALSaJYfqLtk7_O>q$2q<*Mh5|9Da4O!|w0{r4lsOJ-2-`GT
zNgo}oNdBo(fw1y^?a(XDL(*VYhsxX!I49JuP0N)`2Ge4cIz-K6XNNc@Tv|IjU@W*P
z!_yH744d!>jgB5Wv4K9sImOIo`V!tik|iCdC(E9YSZ@R<kPLo1Rvm~f^KI7v<Cepj
zIX}Cql$1mKFOSiZzkj#S`;f*<Hb=77c8QXp42LyBPJb{tiU)?BDSmy4WpSmPKR^SB
z3Pg%=g{7+ii^LW2a>~Gm$bjoAMXRyt;2de#qjrp(y3${cAhuaJ2SJ?W=UF8~%X~rT
zx`M*xXCp)f25&)$ZdV7vCERSskX`FN>t3fYbg!wd*0D0I*?(z%v-Wc=Wc2O2A?(Jp
zYttcRK#eFiXU9>)QDl!<DLOogin*7bdIR;;B$)GzlNSt;NZY{3xjIG4wWMsAq8<9`
zfcCho=*AaxO?2IpZ776QZLvG9tw4En!=(|P<Z^f!I|(1>rkWm>Z-kHHTTM^0sAmsu
zWGjm1rTVdOhkt;Dcx##A2x=+c%AJoY;@fZw*o~CiRcwRjIGCq`mru0aGg9{fR%{pH
zFEJ#|$(b$&qe)3ti8P+0aph$np>b`=>VuQGewIOK@CD&%X~E^*@{Mn|@5vL8QfVDJ
ziY=LYV+&GM5styEpClTFz&5l=Cu7sm=qgPHP>!uzmVe{gTzxB4Wq57pT9wq4I#oUd
z%-J(CrEY1w6?q=+HL+s>m!B<*FxmZ<79Fj9z=&EQ(mBt}d_KKmf$(OVjB<rQ^8^^G
zvJvLOLe$l58Y52R8~P&J>l3Lb?Q$~JoN!Z{0u~nO{*Vy){MOa*`|wW9C7btipjHIC
z+8MlVGk+6~Q8u@wEbmrEGtWbPTl>1710XUBl)JIT!XnQtsJ%Ne(Ql_6R$Tw^ParOr
zeV*L-ctJ``6*Qg*BiJm`C&D1yp_zIXA+PZKsv@bpLR8S{RU^}2k-=%c93iX%pmLC|
zzw5;|J5$uz=hcSbS?-okRjXJ|ES82Y15^2GsefXMR|TZceZjN?I1)+D8lSycgpv?I
z1(7i+oMlih?_P`%@-DofPqMUT<FFl|+6DTu&^<@eElSlk9m{pWITr54V<KsM0e3MX
z8E2K`#qrW0NV%I#^X$Sx*d(}(dc)9_)QN>gp0c132IO%?3Z0m~KQ9)!DsoE!U(hyr
zJ%4#IC48R*4Ork;bBWUvO!)uss8KcANX9F`L`bFLK?<<fN%5YBq3t6CO2Cf#gUMi0
zmcJY-JmpZjHOt>~NMYJ^w_`b#CrFavuFkV+xmo+^5A0k)bfXrZ;J_?foN!7=*RbAK
zlA=J`4oHq=Geaj6Gms6e!)xQF#e1z$sDB{irRf1{AVTCwds20F%rToZClU$IAzvVD
zwjelKaZ4jLJ4_X#9`wdpjj+1zSRxMNDv7Wii5*`3+Zk|f5`zEw;^E(^$hH|lmUp9C
z{Gz45@_Vv%JqKqn*OPLdYt15YD(QKC1M{B@Ms#28T5@7|L<5|LH@qJ%^18RlZGSO#
z0?iNs!yX#i7`x!eGmM*hz2dlFj%aQ+BheP{+@H@G0Z5nQ3Vfr^l>~2s_%ajr(PC9C
zyPB|c!C~jVa{?rxN#`{=II98<V0(<AF+i9wm;_<Wt_r-s_pjvGk=lW)QMD|Vt7Wc2
znt@PnK8Y9#)r>t3{oUAw*6Pu-iGP*lf$4Y*b2DccR-}R_dj5G#c?8uX!C(qxwky+T
zHB~zrKOBE{_z6}kv8?Y9HXw;z;o+tw^_aN{+M|q~&rtR9t)mu+%R8`g(t(GNQzDEA
zmakajgbr$idkn84n}zsfj5ZR(F_vP?k+d=Xb`Ms>9y^bq7zhpXDbLGinSW~%An%V0
z;^Dj$64=fqbA)$S3=4(>K)n`Lz*+<7oo#@FVq+6>h(+$e*rgxmt0kYS4HOO-oZ{5-
z6TmK}kzZHch5|((Wu4SwV<48^ExU_T;f43op149~L3Y}$;K7BP-e3_*e%O3`Z(=HG
z*m9F4=@yMPc*dh<8*ET_Z-3R!JemI5nux~<QDbiQ*`cP^N+x7%zhWk?CeS9WHKK1$
zK+m-Ckuw*V;YF$tcv-dqd~AbzXzr8%>L3y3L#&;(C~P)%*2A@1Ef<t+c(1jL9K&@D
zN_|D?5>gpJ;|3Z~bIh>8S%xUBlvQEKh^#pYi+yyi7j-U*J_pi&et%X(85>D`jG?K<
z9D?i5*sjxh$>2s{tMt&>qT~cVwTIX%T``nI6Qc^0WDfXbB8Ot=Z5RT*rsI_}CYT>P
z1h$(GWh-B{J~^HsYtfe*=0=Z#UtDvaI4|4ro2Ne-zEt*Q*_wtDWJ|3RhYJ`HW^S|Z
zcPK9a_Annc6K4hDHGiU02WLuT4%XB}vktL7VO|@IlIt3<o+<z(im9_!Lu>=d8#OCD
zSy5d}{6Ytp@@<aMuYY^f+w0$H>}Axsz6OoZ-0dCg$G(c@1#b)?nNICHr)z{|IbK(q
zN?u+&d=?agy%P;Lo>x~lv|$BYuE?5ErfF0kP<*$s4DVmE`hVA7>wni&9lJhY;Llu>
z?637d)kDvqhr(~1Hc`lHu+xU?>~F$b26x&2Z$cp?I)@p5YXeUo``b^0`p1W=mIn#4
zd{(k0s++6^i0vETE>OxQY-@B*q^=wSEZ$2x9HIyKWWoFgZL%7|_<!mO<iKHm1x)eJ
zG9T)TPm{Y4$bUC%MRm*yfn5$JRU53rGI|^3hyLFpeM~tO@h<bBdW{b^bW^ikSI<x+
zhlu12&49Bx*wpz`$Db5`?fI~!x)TH08;_fE&|NzGrdd%qQZ`?U8w>ipsNSLpujhDI
zf0o^`dA}5sNxJFCy_TVxss5zF^=Hyx-#H0mcfZs=mVZE+O_E3duR<TNOY|h)A-(l{
zypb|mG#JiAk$~yubO{mE)S~kjALQNVgNxFsIv8kUcD`V`o~HHr_*!b;UK9vclH?p?
zAORQU(&$`6LAA~8`Jy<_7KQq2t*G`~%E4Ei{@=iSaJ0*v_Y2JSQE7HQ4@GK+G1LN8
z4c8@Bx_{W<pTjm4#XH)j!(lD0U%;FHmm(@(B37#4q)C$iB1dIRB91`h#Wzm-c3Jd3
zVnvZ90<tmt@ZZ{@Ya7OA|2NHtyB$o47sx_<?OOF^Z==v$4<?x4slQbYGR{XU#*gat
zXb2<P$?0uR7`!>qmpIAl?^|%!3E^_x=>`^(K7Z!hPwRD$jY3ex_+Vd3ek*0LIPPQ-
z4%tO@wXr?)H$NdBP^X!N2(V2wCGnQwVn(R@ta(o~L#(&JbkYr`d>yYxpyN0gZp^o5
zT8~~WEdy`$urv-d+W)gnh-DYu#!z%!u8|DlHg=+0n6K8XMK{=k0?XpM0qQo!A_U+3
z(|=g>PutKxO+o*({Csr9HC9Cx)aqspmXo7cZ?&+gWvtV}QD&%sn;7Xo_0)f=rT^4I
z|EYBTQ^)+LO8HL>@}COhhp2}!R<DmJxiNG`9<98-R*RTfM~igz0i~wGxVb`d6iu`i
zL}Z0+;t-gz^tKKPBM7(~LOh5!BR*fUxqo~IqUz9m8CN?Rfg(6z2D;PHG=~EQHsRq5
z0=-2}gR5Aev;4hWWczkA>2c`KqMSw{&5Vn7g&;1bEH1ppVs!*Qesnd@!*4#1S`wIR
zK585!m1}mF(O*+8uBt)iUHQqdK=xw~F?)7H65P>cSMz5X^uV|13Jck*4iu|?0e>TK
z7q!YOK9G&ah32TOe?n*072v`9dd+GK1()cMj(#&@JAb6KG&sJ)uqW{cjNbjrzt6Am
zrq&^F(-1Vkq*>cg<v7>yP>x!02owT1UIjTSl6}K3NGuWPby@%*mNg(HHgl)qLF9V`
zZrRT6tzD-AxNJ;1Xv?`YsWJ07UVr1Qbf7nlen&&M=aWD9i22p&8{fFt@^vpczrJ7d
zgrW(3fL=dPsgngpz)7B!IEyW0QD<i0j-#fD^{LN>yQWL|EUStT05?o2;P|U`TNTTH
zo@*_QpZg`aE~u&1QhQzfrG_spgQBX}*}l-`H!eWWEuh!0uZ^+_Ed!>|pMPKR#cK_2
z*S)tX=QEt%x^69xXyQ)YxqHJ1u*F&pZF+tEwsRRY#u}ff%(1R}i_RpG#_i{$k#&Sw
zEVA>1s=J#aDLOYV>Xh?y@7*~Z;ijhTMW#DuX-JT;xEEs#H%yW|&Wol=O6MFH+oV|D
z&{mYk`>Y;o)3~=I-L8q}@qaGoisuS_etj2QTT(aJHo3oi=S>|o>hoV^pd17nz_3Od
zE)p-hiu4mi;c{u9b$vE%Qd`r~-@Z=YT^H_DL-4T2>}A0AVd(Dz`#y)z|Lagv?1raj
z!_#SmLRijbLPuIG=0y-a!aWKL)!rz{7L`X&o2p&r++yM*M$=^z=6_n`Hs^GFE`@cV
zGpv7#E^=lfbPi{G{-MDh9o(fhQBIZZLUic;AmHht#2pK?jzCB|3EeBVk2jafoAP1K
zbmPy~xRRx0u%-3~UnnyaHD}`hJA-6ZHV|-Qk*L3ZsD<q{N5lKCNZVZA_l?`eGEou`
zRK;KOsD(e6WHYcps()G`OT)hRP+&SKTzslwRxDm!C*^r&C|HAW&KkpI!!-RM*(T@Z
z!f6y%fF<g9ZJBKtmV|PX>Jns?>;oizI#tZa56CDfq6X>>9+inc5GQs7fSR-UxqGH}
zn%L)h)VS5f9y=sL0nR<;iPUOL7Z30EQEj{`yW*XkaXBE8>wizrq`2RVL_e)oJI$_u
z%Eb^-&!^>TJVDvT<Y)!#+b$;^oO9U)&Ozh1Pw0!pKNNJjpCIWt$itJ0(-_>BFZW)&
ze0!MWvkQmxE8}eC?-}b!pLil|p>pD`{&|s2S9#Z8e;D0(C=;PodzO}P9!|Z~^;(@E
za~H<;(G~LhW`D-<*Amgz5KY<CRk;&me{$0&WVV!XgYNKrkT@vKx&(fnGHuR^P<%Z<
zUBIisk20~W^a`I7m%faFb-{oZGcKZ}U+W6a)vbo9AMj}P9_+Ve<#Lehu0CcY2`_sn
zP3NAIY)C9HLoxvzxspuJxCiL>LJna`N}hor)*6yRP=8!2jmrd~y}na6&UjYzRSYA1
zzYE2<_EiQCu<VTg*PxGg7AL_pC|7&DE%Om}2lqQ(GWy@+um9=pAOF+szx}7^)1Mdd
zw<pEjKdx0w@v2rd?c?wD?lkm<zxP8juU4Z@j5hnba`ZuL@;ki8ug8e8bUpP6iu8Tn
zEJ%9lf`5X5Q7ySdV%Fj^_g=)}6giw2oRf)r-6U0{>eQ7Y+<;Hb#z(`SPCedq)rdD8
zVdH+s!{EX=DCI?x1NTc6|IIMB{58CF_vniVi2kF;T5O1UNIpK0Yy-H1<SIvF-QZaz
z2FzOKHaN$;m}~i^@BVlfC!s?x!{qhCvJ*iK3V;6nx!7+<S6T{DbBc}L@O1x<U)Ayz
zy^%!~&{acvPU~Oghq=m}JkbA8gT5Yx=`}OVrT~Gp(Q^|d-Tx_W1Yp?a<21R|SLNZK
z@KFb1SDY8i*fo*PRwxVUX8bk(#39YwmQf=~ew;ZoTJq?AmpIP*<iY*>o&IgUnoXy5
zhksCgtPa&_HR|zqx266K*b9B+nFG3%3Gp@!ewdBbG+W{>GCys$;L-!(Sc`bZ{S3SB
z(zrvcE@hqlThDM&ah^F>CP{BxR~zF8FKttumyq=al(V~$;TkmxzkR4J$Z1l;E~5@#
z*G|AUk_c%lUrvX_lX4uy@|j2anRw={-haY%ACZMk?mzg~@h6}BdenRH;FC!&yZ_)f
zz5AnIKkWT${^=(VCZk{f`sDsYC(3;xDkC?e%2TUF7o8@RjRd^f4V72Dc6>74#ki>E
zq$*r<csAFbk!lZJsZ`T-6(72a9n7<k?7wI{7rD4ZF@Ad6v+))O;ARZKTbxI?I)8LF
zAwb8&y8SYKF6C8pIm9YeT2zt317&_0RK41Nv8yA#)tBIAk{7sy(IGDyE~s+TLX82s
zOneEBvH$vi{_iB)^?-j&qV&IQ_pyiBqe+im>Lkg7{=-V&8L=+{4Jvj@^v<KvCnx&O
zqy8rqmrBH2u1ZmIU&rL%`Q+r&v48u{gQj;LtiAK;_*Z${xB5E|*WUS6{_9En9lUX}
zo9vm4n5@0?>&b8K>pS=Rzo{B`<sz@xiNm{6;({yY_Y;Pc7gs8CG9$Wcg2y~1N=+FP
zq8m4tehB-kv1gEYrCTEVG8t}U57&#zjm4@q*P-G=EviD*EH-nIn4tf`u78Vn&F;q6
zZ@&-mpC|mkb<&sXErSE48GIxJ&f7-cS|k4LfUrB(MgTR2r-<5a*~Ej5O*{;nh)7mn
zu*H)y7fg_@rpV{<QHbU2I{S|2-?HFN(YnQi8;9_A2dIV&N+E>SYRMG<RH^()efi@m
zU&)4Oq=^%G<u0ej?JIg+QyI$cnzO`54`+Icr1qy|{^D;5osb#O@XsHU?^+xSM|4G6
zg$9t=Hu*r47F!>GVPjK+kEE`X@e-k;3=*;P{&;3kfBBPs@`mPwvG8YtNEcG_mT;@J
zX1LIvH4_;-UKNP?`2cIjlwY(40&@p$csGkdsZ|~$D1aK>Rx5vHksVr_S%W${Ap%^n
zFwj{^CgExxSzxWls=%T$0oAk6hL6ycNI;2z@K=c|=C+-G_I>fpZj$z`7yb(7W2n8c
ztL!i7YViOG=dkh<E~-nyjEJwy-p#=JQB5IVEQ?&=_KF!#OTw1l>KYVw%w=-yhPZ~k
z&f)dJ6wtwC(aGHiurzu^qRGP8DHM8fMTvbN)4<0uc}zy0$aN>*1|ayqbn?tCtvr9e
zq>?66k4o8p=R}jlUcflVZ1ZH9JMgtiG(F@al;!JxkTs%L&U%15Q?2#odq6?bwLj$x
z)Ijr4Xo4AQsCqLgu;F&zU5!4B=GL<fkg|~n^?iy-Pys|}KP*2daJv!{F7W$B71hzX
zL2G^;cRSg3e_b*JuW$@SYGX$m{kWp-PYg4y^2J4eal&wIlj2khhS-ECny^ln6}N}>
z2VN`9LQcG(QHlXu%2}NEYryGXkcvU-I9~wW0B}H$zp%DLcbk}iY<F&I4TGFnQGQPA
zY$+MZa|Gv>5Iq`O6BKdc6yM=k6OvWw2y4dStqh$Stsa9&14FvDhQW#zLA}A|FV`u>
zNlWWAMDMTDe-*=nvKBrYqa01mV_YkK2-iJrDM22r-(tp>UGhCk)X<xJ!XS^QkSMij
zHalIh8{QGD((7)Lj#e`q7W1p+Svh;ef1b_p&uNMOj`JD+3zXDUzM7)y4be=hSak@`
z;6i-awBo|8;u9Gsr_*wz)m$QOD|5?%WjsM|b$)hfe<!T+ARwg5mrZrK;%Z2Y*=j}P
z6l2Xnnt`V<qA)<Ag&w5Lr(brVc%r$eF1wfKz9^Pou13k8I?5o71Ow<LIE{CcKN#q0
zgP=g_Ddauc@!0p*xs!1}BDatyZlJz{tXRa-3vd1pscA#Bvc1SV4u2iH$2Nz9-?ur&
zw`BTEe;PY5+uDanWX>?x@(snFD0?DsN2vo!Hp6O`9NRM+5G{Z8$cf1zh~=)UhE+}+
z-s*X_K=tKxFz{bS0-&S?kZ^n^J^(y`vfW(f^(jK;XXP@}+{!&4KPxe*5h}0*3+3Z5
zX51N>KO+`Tnzw8|3&qF0rLxfkn^-wdCI!^_e+yp3(V&7JOZ*ll!soT_<alD~%NHme
zd6D-V(5zMrv=9?!t_zZSQACAfIpl#c?BM16+zNyw+N*E3@A1FA-~q{9(+4`87>;>w
zIzP)=jsUdk6pffJe<oOzZhpZNmf3qjwA9EtEz!-D`!34q1sCW&ROkQk!3U8CNsp&_
ze_Ze>=mdMl5y$1Lm6{iF?&&x_Ox%o%uTjphZ|#_@RFrj3)rxfn`AAM;6B}gZ5h=|m
z8rwwE@BXO5?xEU;qYrUiw2hr**h?!s=z5JmWUZzDZvhj#sDj#Eq{O&3UhI8g!ytkD
z9MzR~6?77Z8uk!7$}!_=lXfyUbdBrbf9VtbZ=;!*?Rhvc`6E13Z^iS1AhyyE$upK9
z@QOSr5Xz+~_|3b@vT4@$HL3S2oP_0Mg3)zZ@!_ZVIQCUBeYJYe5H~Cb7kPK95vx{j
z89G~PvjDL<BZYHJ44IA{!QU2(pi^BFi62DJ-J&e%)D@9$OzNN1yBBSrPhKove>pEn
zH|O)QTu=wPjPK1<rm;VqLzE^tX9$h+ZBmEn{5>V+Vo6tu94Y}VD@5zgsdF}mJncj|
zG?L_(VMn-bpr%q^ApAW)S-AkrTW;xl?){#7A3oULYEHfGp@3=Uj>N_j`dA*~vH*ve
zYLhazY46Z4E5i;84k;-wEW}u&e}>$4smf{Y*JcndP2cChC66(){IQq8G#l7@w%oPP
z<GU5LgYR-yy6l0k-|m|x#YN_q91%7cAmn#Iq;g6!YX>#r=egWVN;PBqatHn74TN{N
zXf4JG4AL)Hzo7uy0ZQ=+69^~?4a`Ycbt$#FHY}R=ui4f7(grUOI9_Lce}BK#&Nggm
z697=V(Vc_aZo_sy3)n(YNd#8NAG8vI_W&=YCiP=BnDBBPxQl#E!iibZup2b<w;*Wu
zIF30!s;u)tfks{6hxZ@;s(1fay+`*`8iFW@Gn!)5H=zZTj)-%yT#Y!Zi`|RF*QPLW
zA4AIkoc%5Ob&lxA0&wJFe?7&PbA9cJ6S7Aexo2(C3Vp-H!)=MW$+DomLaQ>aoZDTu
zi7B05A3aaz^qo?Hj7uU!qDT^)R7r-UbO|r1>F7L2w=~(})a}^a$Drr)r%$3)Le)@E
z7bFm?Vg`RspgzhxD}xogluRY8S=pkJf|E>{g0@^%tUVEnox*OPf05><g&?>Hb-3MJ
zPgg{Ebi7z+kFB@gKH;+pmSfZx8nH&qhE?9rLwPTyou6LjqqDMnmn!<=yu=QyP<k`j
z=7@46cDYU4VOCF6!v#9BfU=WqX;eZ><Ag^}n&s-q)SI+=M6Bd7t`Q@7I(Ymp2NH)9
zm$;uZ53#Ae-<J36e{qw#j0ChfsrzGT+=q|s?YV=!!2vVVm_?p=Rv4|S?Fpi4D~TEs
z^p4Mh8ludm3zcM3o9wi{G%Za<RBMd{g@^@5DGtH;j0ylw#jYEo*Io{Q0P5-$FY0!*
zR9(MP^yj;5@(v|3*=-rxcS1E`q>h7g?XQtb8kVu)`!!<Se_VX#bI$vd$9yoKJDzY3
zHAy2Vw{@N`BuOWP4T-qAxsOa2zqX~IL>{&IOy!x1cos=B{G_X7q>>cJShH({sD{+%
ztKqwOAp!n;EMk@Oo4&~fQtVy+vN9^(`{V5DdV$avU2-LtZu+7$6`mKKVWR_|i`6Ee
zm1rlc!O!p0f1AFiZ4}4>SPq#at0(<|{L%L|HK;S!s(7u|8s~=iw@G*Pr4A}J)5WTe
zBQ{exLrqqESA4>2+M^ce&YZo&*N+Kv3p$-3yNJz3-{hk`5`xZ0(<|ZAs@*L((}eLr
zP_>QaB$&K~f;3N6v{L0RKA%Xq%cvX|no+_t5gHJ{e~H;%5ZMW&JTV^@U9GaF@&#9L
z%PU{Q?dyHb1Y~7Q2JdLBf$ZEai-m4C-x(=j<tc=2n?M)=Fm?2=nE_nEV_zHAOpQqJ
z<+V<naOD;|xU>+l&?!JDj|S54kBF?7tM5yi->Q7-B&YvGBAMo$)S=t9#Lz-2Xtz;S
zA+Z~|e?Vd*kO5gT2CefnIp#IrP!Z+fkncv;0X>r3%K7t94gs93$9g{Lv(2qP`pr-t
z8|q`jVm36hSuL52vuiXFO@cZEjES=saUL#`7ps$ZuSmQQBIb&82rQCAtD79K#g|v>
z@PE8=f+NmTmf(quuY|~PT7Q;&QS!6T!a88te<Jsl$!#CN9C-_x$8l*v+ZVYltDa#E
zhN+EuFx?EwI}-<mru7*AeagRQWv`s)VyJN2`*BGJbuoLY`tmor&oc8$(1wTy5td<!
zO=Qu2ifv@OAW~7KD-@uL6bGrdxV+w8$ALtW@rx8ju&u-L<Xx^}9>&hrDPH|WV0vLD
ze<$DKdCh7a&BsV|7LLKHqlYJxbQQSsXbVA6LMQ5ac-PGYKh24@#qz43yc|n;M3VBa
zJOhUxSw5L;i+o7Ep1~W1kRwt^0HFX5mh0>E&;p)rF@`8>wcIy9j}Eqsp2mUJPuTP^
z&5&gkGUvJE$}^J*kr`R0RsIs|d|j!=f93oIX4UDt(ph2UXgpyE4Z9+7@+`9BUP@6z
zD4q<=WRrTQSvM?nUkJcd&-T?F?GOR=vkrrwUWmR32nY^Dm~l<CP9HtI{~*wnb>E<s
z7d#P2J&sMl5fYZ@#Q>FIM?TysW8;Y`2#YET0G@qW{|-Bj&O`yx<d}Y7Qi(S!f2;lc
zCwJau3p?k*kS*A})T;Hu13~HpuQf^O%iTx!@83@~evYqBS-Nxwe}h>jOoYT)^O@D}
zb9#kb-|{r#<p`oCPqVgNS$p`|aRVchEo>tb5{=EXyytFX8wloP$fx+6THSgTH_1Ix
z)*JJ#t&RpEx+psTQhCBOufDQPe|#AtKxi%wt;C9<L5k|Z{=v&v`>$Wp(Uw{lbSsRR
z*hkG~YB2<IUN388%~SH=!ElZwybAl<&eZ`+(fn3rW)qIh>5`_hs*-f?i<hsD4!K8k
zcs+l$_w@_u9}C+oTEGKCd}C~!R7_)IW>=tW9Hap!W)Ab-$#B(bF#+yKf0R{FEZxjj
zu^pKQ{8?bYik}Om<GxmSMh4>8`{oS6=7W553-_{bsERxt3x756*xA)oToMgXz2d3}
z9`%;1npn3MU+6kzYRZ8)efcP`{x)>x2HfDxp;^h}UBggNVcHukw1=AGS#9i~wEGwb
z%@79Ir^#b^RelAf-}NZre+VS|@snbY*5ZjiFp@|(vKxVfN-{tYLJ=K?a*&X2^Vx3-
zxCw@zYC}4i+}<TL^tee6zaYYp3+#XEo-jBB;Yr`*hF3&_EVao7IIMSAEcWOusPkry
z2kw2r)=$aZtO9pGoA!3il-nBnMWKtqucs~R`f$m?{EwsGPg_Mbe=O<rJfl1I=TjHi
zjLx>c=V*X7f2qBjwDp_qu3Qg3#&^Sy+cVKO`Kh=U_MG*AA93Ajw|>-UOSNcjTi`)w
z7nU$;%W)tDY%o2I^N;b0&Z&JCI!Mq_5(QOaq89hm0ID&7yxlyk7AYd771HCgJ8Y)m
zE73rsp6|tQVDzkwf7o}Y8&p4~S6Fk_D99@n1+5q=E5kya5RnY-4h0F-=^T9yp65ZM
z@;7uWa7b-(zhgC1gmV*JwCbP|ITsEOKNEyyh{E?ljK9)Xt&y1NS9UGnvU2Sf48QKE
zxQX3sSJs)m_3_BTH>k3}Z1*NMZ;^Zv47^Cjx90ptf6|s3e_EQ$b!w6{6HQRLGpuh-
zdudTtA<9}lyC~>EJ{nm02%0x0*GEiP|2zC=PWnXuRJ8Ser4W4^=2Oq6TOC9{DgO12
znO-*?MVn8dXj$bX@===0vf&7c@)jB8C@|)sIo{?=s2TK~!LrnCL9?A+H>>N9`{WAb
z4Ga0sNbufBf5M}(ToPBz=1p`gnaWWUrqS50A|}c4N)`dQi3<F8NKCI*^r^*F@>u^6
zD@w?3qr>J~C7<N6edQJ+&EIh$f@{)F{vPWHgz5EeFGUPZca0{-_y1PcBsKCgk<xzK
zX#6&j6bvU)!leUypT)Iy6W${HZ*j_S==`@t%AQnbf7xOl#>S3UC-251A2Z9^+8;Rw
z<Gbtv{=4-2s*(%mmHr_i>w;rCTj9T?nx0H^X-H#m=Vi4#rGs5wnU|Mz;sAf87O}fn
zjjn<q-L#sOmy>DsE>9bI-1CreNHez7=|s6zH8|swD<2Q_NWYPFY<yL}@yMliM;*W{
zHhex?e^vA11Q0gX0rPPgf8x_Mlml<<q33N|U!V)-W=LZ8wk3#f>MJhUc2k%`C!@!&
z=_L=x@%inyd9M>#P@EytL6Whnjv4=l1nf4P3h-4W24^KUWIh1TV1FI~U=;QW6<mo@
zPjYe0h-p=dJcOMSGp`2!BIvYSKp>i4X|j^De^u$oG`XPe6f@0$zv?GMPwaQ3jJ=sj
zO&)8({AYYS2}8r;{yCIs9>ADktTO}O1R|8xrI0LK#ZYE|tw@Jh7-4nA^)IcyBjLO*
zbHQZE&i;|wzL(z4BY+UvQCU%r+E!dNy5TJSEa$Qz$$Rs;t#TeW<6%kHO9$1-LP!q~
ze_$>m--UDgd6O(sETdbX(C@O=svhy{iKOdKik<HrS6XMmL6*~gOGDopaN08W09+?Q
zIMNi-wnQ#$bJ`96-3gLMn6lxL)Yw=#q$He1k_%5bst}XA3|6meY~*+i!u#88Q;kmP
zk=3YAuMAv#{xlm^{uhHKst<ZFnwBF8f12}6B7P9rx<J5KAQFnUoFww(vy-a;wcIfA
zoRQf*Rcwk={`AwKdwdu^9_Wh_Rt>c|d6l1L^hv{(JXj!3TE*qnOb{^L?C@M++l+B6
zhE$=1vd*7s8V~(B<1AUHBac=~^|x}jU7++&)HFUor`V`H#1fBjD=8J<bcXJ+f9E}5
znsEc0&rwp(Qb0oX+_r>&IN*7fg;d>Qvt9QUcL-Ue_cf|AJMbG06TU9MtLh*VXd2Cj
zo2@I&n=}lG9sh5nXWFQ*Q#2J0sEK|KZDt$vOuwoC5lpX}(fCof<UWermb`uiY!Q^k
zLn?H)2LQa$r#Oa3$z#(3b2NHrf7fnG`2UF(?hi6&Z!|e?)O2VlZqYX91m6~>;Gh4y
zIm<cuZ=zEF)rtX*Q4Ej|W5F1+KLyr|GlM+ZHAfpu`7g1!3pxvD_A&?ftwR~$=pvH$
z?M5%@dk<hD5D8j5Ly&J_UPHXmSl?*>oYdFde!t&FTkW6I<MQkCAck*^f7>Lh!C5|A
z6od1;0<yqxSq`gdcJeOijgzhK+x&NXR~olx`M>fQ`+UoGw+%I5mQU$XIXtIy4Sra<
z06iKp{TV8nW#{c5w^E(V3X@r33YKXMo#rDURt!94*`%UcEG-;hg0v=0$!Z1&>i<J*
z^VZLfk=<h<GESP+7&>?uf9U@Y-F=Brh+fesgtvivP#i&g41HI%9<P2l{bBNS@YpaI
ze>g?Olpi$iVBj!qoI8Xh_YZT1@QbbiXTIljD%C=M0f2C?uxSEz=Cgu1^B2+Yg({|b
zR$aCH!Rr91`}`dyu6YE<G|JBmDJBSc4FhZY9x2$>Y&mYIm%yM!e=sft4hDC(Cx}Vx
zdSbzb1<b%J5qdus8(0GMJcypzMzF~Mfnkh@GvF|7C@NoO7b2UiPgCF}VTtsbiB?Yw
zkw<GiDb+$e*(3Ld!{j+fZoDU<whD8{h#L7_1kDT{3@<7~c=X(Jv3_L>6pK%5amduy
zwH)^NZ6MR<y>c?~e`{@Vd5qbRa}kDRh6+?{yIikV#?Vr{PKDrm6_)W(!u<^KhvN^+
zO662dtPP6cNii>%(qiEc8k@zRRF?zHc7k{nHl^-ID0|inH{5USFJ+X&F^n<`Sj+rK
zyBfI)k(%Sv>3ic+5HygoBV^XovQvzpB+)@4tZ`Zz+r8*Xe`d)HPa%E}!?@?2HsWM<
zSO}1bILm>`l`XFPgpxp=v)_+JYxdY#HZ9S(wZ&$~>K)&g3R|;DVXkS-jdw*<6;k7<
z)Z_QcFA8rQ%@zoN%DKYom13J4pdcVJ6w4;r&K8Rdfz-kcB|;o%L!pUmy*!yIkK;(E
zFJ{G(^!IPVf61Sg<vUH}G&`azcCfK|z|3>->C)_Wo>N#2HHS9RC;kLN%rwly!>Z=0
z^|tiVQMF41HEY>aNFA`rU}vXg6SA8ef7`+~MddO16&3YTREemrSHm?f?G;?t>Rx)K
zUc+lQnPk(-UAH=3c9{<x1OP;Z5@<(6r4QnQ2i_QlfAALx33Z$_C?WxS5qE7P@D$H0
z``FjAg`_$FENyBa<qy(*U13%B7l2eMXJa{jEcco*Il$65P}lPaODb3^qHd(13`QT*
zxLe-D(s4<QGt7?lhQl{DG};h9K${LA?Ah8qLCn(~5cGCDR)iB+K4_PmoP~GU;B%%Y
z)fkCJf9Euz#eBM{J#FH#2BLV2T`_)|O7M{{K*nprz9@$?IlT(@kR6EYj{MtwuvI&i
zHoh#=dfm(PWr6QnTBlt}oKew}pk@i$;TPmobSL}EmlC*%;yJj_NAH6NLpsif_#Gdy
zTyje&j>f%qvNGGQ3YxDgDO?1q7t^qFKxnq;fAp%QS>s_|KBONn8F`~DegB?4?W<pQ
zEQ@TBx1xkPO-L0A?S~cZxQ93nwGKGjTq`{E6%L{bfoH`1TfuS6+wWxQG7%P1^@Di+
zlnceN_s6D&_e_0i5Z@S24I*BE4-=qy#L2WDWqP_IAc#uYV&kas6y1Xe!@9_(8p)!I
ze~ap)aS)MT;l}u#sTCWI4`m#>lIW;m5aQ<z3k$_5-&Uq{dDhIoMuLEVyaI~>YWQw6
z&X{+G3E^vYGaKXw)EbD*Pk$+Ny1xxu(O;(Y!QYyJ=L|N9vwS*FuPJq|u<m%w9ozp+
zXkbIl_w^ZIhGJPkFvh!zXey)s4Hk93e|6P&AQAK`t2=w$4Cq6!^$C7~U@{)sWr(H9
z+EgWAz>V3-;>!8M%h6<2on(K#VXx1?8a!p=44~Fg9i0+!-?H?<xPA3vnjwQrI?tBt
zFaFK!f}j-l#+vuU2l#N_Q0o3Gm+bg1S8%?t5bn0qUg01LD<=+;)XYQsQ2$dAe~3uu
znN|!!D8??$T3VE>848#JL%mAEy5=;0aIF-^R8F}{xz@2yH*vzh^J@1SE921ExGHOv
z-gFjl?ba}Oo^`ECZBN^fD%sjm!N9c?WM=npr~kJ)16rQG#s|{JeEn%!t9Xxu!vlbd
zzH{JH>lQQ?>&N!c-#iV#+R<Arf2OrUI*)Pv>&5hG8qEOb_0b(p&r~B0O$i4}tr&K|
zPb%l{M~nsx(xF3(nb2iPK^z{0!n8(XRe!!vQQHOYih0jjNYYKa0L6HX-o0gdTP!!6
z#vo^6r~miI2QUM%IB?SpNTDHq#m`3n@0Sx|2ApZ^Ry5$A{yP_qt=5xRe;|9#7MM28
zfGcgKli;52|M!^z$m*M=;`$8m(|_;UQEdj;^SN;s)Mr4R{_nL5%mkj^Y6d*;`j<yX
z2MNu`61H>)k<d*JGyuPw{2owT-Q@M&(P1|^{2%n6FP<Net~DAQu14MDtN(Fy^w&8-
z>U_Wz@V?Cq1omHjum5*Xe*>h{q?@H;n*l%aK<TAd`+vu~fKNlIW#7}%C53=x`dQG^
z5Z-gGdhef1)FN`uAo4-n3MqT@a)HE&iI$9)cP+VKT+X(9z3EY|4iX?zJAYUIFEIns
zt#nN<kn5rtpep(cADoQZ2<*R!L|!!j^mlgHn$HTb`YILfD40P(e|sUhVybZru|myi
zZ~rew1^Miv!A_Pwrt43=lz6u}_&uP;If99k26UdmG*$*ZCFXfVLQhG52y<3x3jSgn
zOXi?}wbT`Y3Fg4+z&vFs>3Ixg>#M{py}w>6Bzcz!hYy7L1>4zqi3lKm0=_%iN~5W|
z70m6`=?7#KdC#qvfBodZz7DUN;Wnl_Fvzfa%AtDn#bTOl4YtJelJ3O!9ePiW8SwRQ
zKH?0#esi=w3mb=LUFiSixncf(xyWi%@K>e*WvPtN%*E%?QjHvfX4$KCvQ&83{G^<@
z{&5@hm1@$ov3_tl@|%2X*Fm5t=3cXFO*H;ZzO^+MnsctzU%hT4q@0DGwe_!F<5<)0
zT<ck*k^IxM_7Cew`^WQ}-OWJ|7zWop1Z*NLYjTgoXa!IGjSTo7#~<(yXa4_(v-bbP
z8Taq#+po@U@a_M-?BUzG@&UHn?8^T;V_HAelgW2De@F7zG!OVM?!o!1Gp>Iehm8(c
z(Jj*YF4pU6=CPwGOZ2)XOsg@*G1&lBnTy?5sCHi&E?zQTDO4Y@tQ(No|I8~4hm@bU
zChRv<+6pbrzF3im@{~;IkB$-dmxF}67njsv_nQ<k_l_<UcXBCxoT2Tqx4A+Q<26dQ
zHWoJOe>9IoDh`P!!<CB2@g=SKH5QRwQiE|koB~`h*;BZSWPq1xC;HUwg-b_g{22H3
zp44d-WGe<UwB;NZ)d`m@;x(H|p1xHn#9Nw63sCT~d?)u-^S&FoOhhWBWVAr0K=qHq
zDw0x{cEaQ@uee^D^RZY6D0<guOB1F8{73e`f75fW>Z4h#xSH&uJY8hxoF0U4RI78v
zuMaBGb+x9lFK#2`4Y<wNDQ?h!S#q{I&t^S9cJe4Lv*|kns-O|cGDgd*Yl^d+yXnW1
zPbNe}ZeZ@%r&GD&=PSdbj~a9n$*G=9$GFk+Rn0XMH+He=L<j%7S09XPA$~>XRbOFK
zf1i7>%SgOh)exDlg6hhy+dX;qP;l~qCIM(mkRjK61z5px3X~QZoZ#tk8N>7rdpOv(
zjcrL4JT3Twj4{jAR@@UOLL1I!IM=%SNeJ(a%cUM&XQV@>vvT%=uN>e)+G(|XRhVv+
zwCjrSb>WlO)#jq+VD(%fR2&-&#^4wqe{yifa+01s9S+gL03I{DKyME;_uXBiR^@uK
zt-vPoVme6q1^!nb0{YBkQoN@g5|<JzB(MM(rh`wZI_i(fF3MtD$(XJxK$qm>)4X>A
z1P7$R;{>)!gR+Usaw-fGs1y}#Kq(&7=N|bl&=Hw&<#R@E^mRL;vnQTzL3m(tf3%Ya
zvkZ)rFg;(;uh+mcP)W1Od-`T-$PddTt$&4)A-E<h@}*q5)KtJZbtHqdFH_rhGplLf
zT*6yP=vh_?BjPH6z6ukME=JD4u!4hh0crF+-%YmY-WJZrEdUm8afMN2YYD<qF<o*I
zss`K*G-wiu6TP-iY2Rq>T!*Iee;9WBUeey#X@^B<eXZ7SBlwO4;D~XPEfxm%XVF7@
zVLg!A^E80x3Ic+0kEhNz<fbSF2?3H5bl}M}JEajwh0W556wJ(Vq<89YA_DPI!xLG*
zsDL8=MuaFL{4Y$$TnFnAWh_4-!EJdZO^A3Gw)#0&s0l9Y5hsWq5FTKce_DR|)<*8+
zDwCz|ihH7$zpmD=eZe-u+QmaPCe<$gKEDdO`$dzHf`|5uul~VZ)R%Z>v9tk0X2w~w
zTKJ%#Z`?+2wY~zXM^9rSRQcsHhr&`FZgQaRr#_J~VE4&OR5G=kN3iFX9FdbnkrRPl
zg_S~)B-xA<)^%kCxp;J7e~CkwlMB-5w!kdiqnqHq0-hL{D`<BsD%UPo1X4e<hey-9
z5ky)`XxKHgKX&2>hSJt|+Q~M=4w|8kzCp*ZtlX`hcO#UpCCNHXGDHvEm9o!F3C+VG
zhPpn4U;w+^M2}7$6;NzX>?#yXfGa{B<k#J3b{VBB5{dllOaL^>f53p$#^degF-H7C
zb^<QLDpz8B&OEj2zJ(aQB9FmztWdLiFKAx)1W%p6sNBR|jnaL0V|i~Ai6z?*HAgu$
z)zPM%+snp>)1<u`WYhfp08>8PY3m*525fpXpIzX|79T<}09iwCw2;o;t5?BEPVYi$
zEN6$&&{~b%^k0^fe}v9I>E~K6{gZ%a0pZz@R0azkoY**ch8+v!NoSTs{Ljiw6^w}0
zOLlf}@kxzkz-+gVGRdY&IMzb6K_~sB0K^jDXSiajqrE=2m<E)eMtf1|n_7qFpkCT#
zRPxgCDc_@FyuM4gm-02YQSSV$VAC+8)URl}y312)fy*;ie+J0E#!96^DR2?RZi{Mz
z%OGc+7UWpd)~`Xn=_K3w$>f(2_v6I&j;jNWdH~d7te)d>2DY2wP&hebeH?(_Fa}^9
zxe+acW~Jz+C7rTR-*v=3C7;F|g*7e9c~5Ew$muZmL0<yw?iZ_ypo_|xEz>%W!B->#
zIN~k5c2S$Ae>uA*Qf)Iv4WQ=6`N@=R3h^dZ<t0AnO134uW43}7`UyyuW`PlS1TovY
z<~(ZVyg<nbt!sy)KbSV1NG>J5%TV5-K|Og40)3h?EgScDOVoAs+&4il__DMyegcyQ
z^aiL6G>V6Pn%3vKc7A*4CK3$VMYUAv<C4+##6p1Ke}r4ndXx&D=0%U|(9@ZbjYjxM
z+IjNj%e@!0l#lSyS7GOZ@99igud#(uOnCz;8Y`7{Sk1~N---1MYqn=m-5RnErMV6j
z)m@Kpcb8~vY@KsX&u)@0Px_r!c7lou^@zAI;@xk^u)_Scs2HZD6%wl+kXY;sbC#|k
zDxTg+e+6(xCKQ%FRz2B}Y4xugolTzU%B!u2jyPUly?U-7bbOk0Lq_XMGm2dRHJYWE
z3>{L@!7)f23%2Si69Fx|2CEJO-C!%e7mk0IH=_-rtNoNdHa8mXMuVC~qoj}bqK4rN
z^FpWAM~75bZ+11?*zi3=R@E68gy(@<4_+Rvf9@Gtb=iisK)rGf;lxK^1*l;WvFbtx
z)){8uI~e(tz@CTNtsH49{&S8BAJ7?FreJB5Cm(v_n29CZXT>S)v!#1Yct=OL8?hPU
zh^#8oZeM%0BdqAaIKCHU@pLhXj{|PU@=ZFzP`>euK77?pp6m6d{Wn6jj85wlG<M|A
ze?J{L+G3+XWDDrX41QIdsv({~=lP=U>(IkVi}y^>U8S51C#rOvL~)kEGrGvZ`ouNm
zO|MbA-CDD}y;^u=IC9^123{%1?L{9YQ&K1R1YwI^v>UVOWk#R1h~9qd>sc{jG#_t$
zQB^kPAwtOJ%3tB=Ql%PJS^AimXR(5<f9;52Du>`0a#((ybVt;EUg{|Xgyu2Hv@AAU
zq7dke?OCok4OXY3@8ol<XN{Ur!CAJ@c+kw*%mT^EFT@O1DAe1jS|Z%V!z^GUJTJ9=
znDZ?FfEkuCXF6xODO=3AA3=}-FP1vs%USJI5*Y>?Tn-j97-mh)@*>aK`W+uYe}Y|l
z&a|2Pn#3jt!7Vd$2xhw*O!NAB>t6C-|Ihzh37xvL6_DZ<W@pRK&K8;uj;DLz#@_@1
zF}#YR=5~z*3R{EZBwrN%lXEqgN?jOyD#%W-lcF1wZ8zM}-Byzj+N~e6sKvLg$))||
zuz+JoiG(-dW$w&AEjFZfjkUnoe-p(w@h+pyL%i8VIz$@~J1&r)AfD%wWeZ4~EbMKg
zjQhHN)9EM2-!x0EVh6v4_}b##;cAVE%{`F#V3jiUvyWBkyOPMFe$blHY_M636!ep9
z#c1GpD^d%DfYoJyR!pGTzt&NCJ9nLPYnf_-?Ewdwb9cZ~Cp<B5&#8BAf88~wI+S-i
zY1M_lro*afAIj@WlmGR9{$HU*!kHnR0lQ|}cYfJs!!}QZH}VgDmtACP?>C7dC}Hlc
z;B3=h<WsIh$)$02ldb;X{HixCMq91G)&`6D*3Qmgr@ySWzU4cC{a){oSm19<i3e}=
z!1+q8YvqS6XWLnpbQKu)f5nMjJz0?!c>W9{B@HXt%B#_;n2xvftFZQGQ+#z=j%j_j
zy2%zT;mJ}zOmsx_U>|<{=Eck5%h!LPcD!-WhK89zL;b<LoL<rPnO6PpFaYs5P9r7S
z3AJHG1I0g{lq=X?RjN9^W8gr|=~yjJxZE3?oM=KjvUaGMlq6SqfAw#>sAxIOv)N}Y
zG1>v}F}^y<iYcT+;z-Nd3!Fltrp5RU$UMA4mj(mz3OR?6O@@Bic}3Pc<$NQXZ?T7D
z{dQyL0`JHA4YpdYUxtOV;bF1It&h~)B7TT<OLN><%?HwWlRY7gcf=pkc*}(L#+$#-
zuhz#@cZ94D4o*luf4eM($d6L5&^r>57JRI77mvTi<;W?wcCYcWb4UK0IURpcpW|n2
zidAMrca8huJ?Zo}k!Htwj2(9Bgz@DInc0d>-m_L}^?P9|>w<#27g%#^eUEIy4fmFQ
z>Fc*9j>_tHs>an#k{{(CZ{B*H!BH!(f4j@&U^IC>`GxB`f6da1bzvjfjs=>I7+OjR
zme5z75EHF@%_FjQPX)NO>rQ;5I|tcfS!C14L6@J}bL*1b4KGw17VY|FyME!WUApTQ
zZ}alG1>}EzG!m`_;EHSok)!Jsm2pi=36zvpuuMFX)$HA@yyS0&T4a1D)Fs0^tzi0t
z1^m&~4b&2ae_U5byw4W@AI3$Zd-RD`>l?QBU5N47Rr9+3WiI@gJfD_Qj&SCT^R3pt
z)i|(o^@N@>70P{_Ya?+KiP#Y=I^C5F@_Gn|{w-W>i`869PH%JJA^(Qcv{|f<Wh+=-
zF}9)-TzlBb!?FbN5RMd{-Zjm+KwZs{>H0z{Tt`@Sf8OmUSbLHm<*8pDesy%v@z$fT
zEgyQK*Vy#g_Z5F}8n7pT^MGOY)!-e?3;6ec|M&25wm`Yc2|>I|SksvG;?Wf%O<jFR
zpH~smZK=Y#Rn%ekxx`Gt7oM%5fCPDtnMJzPiYiD!3EB%C)1{#^liuTWDCK)@PT1Zv
zw(_K`f3=a^wsiqV(nUV2Ki`RqDKso-#Z^Cp>l>B=g`F^VM3`27{#+1cWz|!{wydy<
zTc?JJl?p*TrMzNX%o_p49_HD1LuN<wz-tp;NkiFe>Cj%b&%;6#TY`lxr9p$D7MP?L
zD_88B-(>9cstP(c%GJayJZ(%1gq)hQTw=n?f8=<P_cXEQy4n)_i@w$KNjS*gsXAJX
zNTOzRh>@o#0HJXcOp={Y6jZBn(!eRW<abf|B1l^PR;IT-E1i9~3L<v0DH!>cWeORm
z3Tt>EC&DSu{82Se9->U4_c-yYx?*j_7-p(y^K-TvUB{&jj=G}N9l^hg^nPE6g(PJ*
ze;-rBIkniSTfe7QYjz{oxPHAS1sDGlT4IkrAqWD=<M-wJQSZP0=l^=Dw@^H>SB#U#
zNA-)m^V*N`H}AryZ4HlG!NHdiJC{1@{p1@dmcpDx1~qhfX55W5S->u?rGNZ{n+TBn
z(w+BKLYM16Qoje<ApJR15Cr8gDR-ete*+5QGn&mjB#=yKuB206?{8H}`?*YvpD7{{
zUY|CKo-Nt%1sxNau7?(FD+`FJw^M0co>;xP;BqBBhMnhL#%gMh{?BQQI1OY)I?j88
zKyY>#bQ8};?ewyp`etuMG)amj_VRWre+-LpI<UWmq|;95ud6XNUp)~D%?DLae_Zj4
z(m)lIKj&8W#(D(EQvqBR7hphTrY5v1Der_6ogb@JW^S%WZ4D-mb5gmdyCMWVO^#8v
zln7z0SEP15D3z&%e{!M-ovn}c4||z!GPSe&*ImB3@bR6orD7PTJ3}=|<_V8n)8a7K
z{2P-(d&sd>n^H?L>HAb2n<`&Pe_4KSe)WyTrTsa}Du2|v!Y-TAk-%ClSckt-CVYmn
zv|+^P-|Gh{PD(gB_o@FGwPu+xMsGT;*0#$Z0<i^|VgBb`TU)PB{#+_O2D{6hZ9*+=
z759Iu|H8o47T0;?y>w;nGe;)78~0>Go3e)<{-hpRTG$76AvwRY_Z~cae<U4xRO^sm
z?%VgR3nRI!%50wyXId79Iy*$BpU~|jB;~~Ovi9By@vZ&YNxz*a6KnsjJewsi%Dn9h
z%ELK$9g7z4VI!AT54pUV1b*Ec*|feHbLyLz>K$2X$TaTAPGe?zJ60+~8aHpcw^pS!
zzdaFMH*p)c6EtwE)Ru|te<({Dv>{<9D)rg2YK>j4japhcSm==}6u(}o%UGq+2}d&t
zk70#f+o}}}tX88c|Kkd47c|3OBf467!xm7zt|OPI$8;jgtkur>UeBFYk84N19oR=G
zz$wK^FUy48>A_%S6daVPN7sX0$8L4`XMQ`&EJV`-=fv0Ic}uL9f9eif#)V=xQd2)_
z!k@p5tu!6aXdtYE#p+xB-c<#4mYp#M&cUSch{}@63_I%d>mtc#MKzyh@@ZdnR*=?$
zS$nvf?5P6f;u|qD`<yxzDOm1)*JT%?Nc=MDza$k(uQ}XdZ7CYZ3{9TBI?lvXqvde;
zYh(}&xL9iC?dSv7e@sVL6P540Bl?L?pJfC`?hEZOg!*a_rPV;>-7emSh;6g6DfO`n
zB9aI8XEjH;+St_UkhBZLHB^J&4CU^S-W{sFG$`F^s#>vtA#=pRy0tCK?{jtK=mN4X
zB#1J)tkW)cL^P*<FGv>GKWOuY&yRCX%WG(fb`#_IB#-&`f78TOj*p)c9=h>ScM5q9
zZsWU`yh6?B%$ibbUnnk=v;6vL(5K<eXJtC^BW}N-i=+de7PFk4a&72UU&-?6Y@ZeL
z=0W=gvuSaXZyd3IZd8ukp|M9g=8|zUBT~w6IUpsD)Nu#BC#d7h-ft$V2cHc2i6Ooa
zQq%VFOV}>ve~W^4>r0W0zTF<sZy1<6>-nkrAuNN(01j_4nW41p?SO%Q0tRp+@a|8*
z*frtbNYTMkea=o=23FQv{X4-gxQguQT7$kU{dV3*Je1-L^o2~*8i<89sAi0J9Mc*%
zD7O;af>A<R=_aWJxZ*F_z#J|2K0jH>M-1?V<M0ABf1kJca<!PbII~d@rw8M8wWKZD
zzh>xM+&KhOtu-jcpKsCLx>)C#!rT0WIXVn*h_b{qh%~)Mvwn4Dn<m=D<l+5?zv|t8
zK>sI+d>oMDbJB8Dsa&ITlKww&Tlfe^MZA60Dpo%U9Ehrq7dD%`ND#F>Cx=kL$yD4E
zPDU(yf0~VQlE?TTv6<xW=LLy2KpJ=~a2b{3<MOugae;bW<GSJeK95gkiE<Kw<@tW{
zT{+^QFV`eZj?5_yrgik@_b*>R`T2H3$F1KdMG|%R(XZ~`@3i{;ep7$jKj#)zfimNn
zg-d*p0qw%Q>>H}M*;gvKT==WO>e|&*NUK3Xf1BEA<?$zr*`})M@tV6%xf8-HdA_?1
zeTgl4u~OlUdhY4iuy=EB#J(qwOI(we{)sGB`IE=|k2n7H6u6S9GKf2S@;LYrnfnwv
z<jG_GV|TW~$tyQYh;6qp|9#-evUa3=$Z;aPFPJ26&0C(Cs^DgH6G7Z;(Bm=ABSig=
ze~PJp%k%XkqT1W3!8DXc$US^1K;Sy!Iizd#3GIInLXw*5H^JE9%C?zWJF1l8{Bj<+
zXh{{Mh+6Dl1Fr6tDb+Csml#Su_~Kp&sdCpLJE?*9Q;2w_mmJb}@WmrecTx1Eswz*4
zEONwM|8bLiuw6G}so!l{HS)ev&r7ULf7b0j;EqM*IpG*V<T3MeL*aedKEE2;t@cL7
z7|<O8dUN*nwjl?6+C~!E;+??w*!ru@u{M7;ufo}q2mRXm8VZZE6quOcCjD9l9gM{B
zW$t2Pgr3B_xc$`{STJms#)%)eL&$mZZ#aeGGAQve#2#)7Sa5GZ-r6+lU5kOTe~Ko~
zqM%RGT}DCKJT3gu$A}+|kFCbD?6`&^{&#WSxUr><KQdkGoVuCdV0K-G{@RxP3!Pej
z?Yb`?TXp=%=U)xO{w5}=dujum{r<%9k*<4&4QQ}wjY6mY^{eWHV;3N#QS_YnYdHz6
z)|W8y7F8Iz#>qt&jjy{PY=j?*fAFaBb6teXR_aA}L4jQkef6Sa@Gu9_4oRa1qCz=B
z6gn=O9I5P9o8_Y^YLzaE7BY61eFR^u7$IAMI^5>|ws({Eq?k?FVp-;5D<oxf#cn$0
zRqbx8?S|4;;0d}G3<Rx6@EsCY%;G37(38Q~=*jPYq)R%kHU>7G$`^Q4f58X*nCzkr
z$yBFrm{B5uA;{DC5H+d^;|wZQGb);8w;0%C6=c4+><f;N*P|~EQ`}!Nbc_q9Ta@Lp
z#Z;z=8C{NSuEGE<+9zwk1q$><-(4=sDfU#hY#pzqKqI6Izc`2lS9;mJ5L@i=T5@#l
z;p&VZZjH+Tfk^!}bC?6he?^5%k~n?G<0)igMSWl^`0noRvY00%0hK*(^yWOLS`O@`
zg#N6<8q&xYP#Ac6uY)yg39Mm1*_4RnAOf2+k0jy9@{d|IU_h5?9;E}NYFJoHKhiV4
z16hf;pCZ;Z<Ho5J6~frH{t_^DvO>JEIKRWN8m}}K(dAO+`8Xtbe@5lVrtg3%>J7YW
zk(vzXh}=MoI?mFpmgRiT0+PohLBMcT@Qc_WoHk7IQzwx<)e2zZaG%c#dTqix$7R0J
zsgPOBqU#9<_Q9HrEPP43<OQ}eb7r4Lk9_x+>;U9gurf&Q)Xdt|%niMz+gSR&$WOBc
zlH}P{cgc;=Lsyc1e^|^e%6CY}ZBh4UWn$nSoIKQ(L|OMOrrlQhI)n?5CmEAA+45V6
zvpDG>SkeiT&9VIi!5~7JLtl|b#h{)pI}wH-WR(G`NBl%et!G5e@bd4C$71!A3k+bC
zFE<c!4FVA{?410|4_B@2KOAz3M>qN3am4>FM_4;CIEg#Me?p+pOY+K~UJu!$xEo^l
zG1oRM*q*o?caxtBWj|RXbEgj+Dl5tDY}~`9=lIAN@wN2$UO}?IF7i+6N{q@^!_{j~
z7+5HT#9K#<YlJOqfrCHG0i{~f_b(o_YOr2l0(Sw!x(3h7!&PmB@RCPt+AUiJ;4aDO
zR067<r2PY@e=M?;EogTrceI!zWL@Rnq~X7G=QwqfNlfvc{y>l`Nu_O?-FEVyKO}AB
z7_}jlrgSOQ&&4o^yx?gc!mBzo^aBoqn%cL&xp~V6;dYN@-T22B06+|(s12a7&>V4T
zI7*;G>wMvwPw+o4@z5INVRD`?PBqTGoVyQ%ZC~H)e_Ef{un)D-DAf-w<AO65bMq>R
za_fq8xv{vBZ`36TTB9y$=a!AS=NlU3^ul_>j01ef#sxe$_=4_BYuhR`)my~|U2C*n
z?I>(kXwWq)KX2LDn1EeYq&3E%vA1lBpA8y99;LMdoY`A8!;rK=cO*!_bx3~Rwo3|R
z>zi}Ae}OOZIRf_SIltPDhmC`qH+;(T`|zchA-GJ?kTKY`&F#BtD)wmHs%4M{jaquz
z&27e|XrdZ4T6yNb{^$Sd#2@4s?BHvhq;&JA0z{n3FGiHl8Z;`Q4|i!*gC*h_H^io3
z!u8T!ns#|tQRBbQuYz^~(s1*1pKY!Yqm9GYe=(irP{;1s-`p@q`@_%tL$aE|D7&3L
zNIM$wjHkSxy)w9dHknAffVrvODy|C}=L-h(vbpP@BMyq&5xH7fMS^64N=%&Z>=V>Q
zZkhhw+~C_4+`O};`PqX$hS}vje*E6VAN~GA#F8`m(23~{L)xxYN}wk7&)`t=6Y7Nt
ze^IGiwlkx+2i<gtMChaa*wExNtM>xYqzRdXy_Sp@=Gjv{BilHWq-A<B`39y$a+cL$
z`LF-;{~J)ALnV_>))2($V{}E}w;5!7(`UBzkcv`2iX~Ge^o-kKe(SIUQIv;EzeoBz
zn%eF3Lg*g<(m!u5XA-j1V~{b7%HA`5e_B7`(#6rf`@v0#AuW<`1Vdu%lgyLqEaNJt
z0t^}-nL)Z8HST`}t#jMo|A>DYQqwuqFh(wPMTF!NAq*6KgMM0;ZqFn3*S-fWG_K^M
zpnH;n7$je+02pFRK?n?ff4r|mXjL+l;m03~hXkTexF0=@q2AEA1W{Yd^bRSXe+lEG
zWn;AvKL@)p00g$01}X(YR3SR<nlj;Z3A&-|WmlAnR_m=Q5+2MjQ-uQR{Z{2Gmz-oX
zHDnjF3H2%;o4HJI@Dc3O+D>=+)G#+7#e(|yH2-!upHRqQUxMq6zdO3}wm@O+&Kw|C
zKEBAvrD$|?#Vmhto-Z?m`B_w|e?|@iZ?DD1%Hs5F>4l*yLt<O>H-pWSY6v|Po%SYa
zuTBMX>-3RmR-H=KYQ@^gv><lQ$>ba{8`eaaBUkT)MAN0yw))9e3TrtkmuD@QLbbRt
z4gt6j7*h#`f!R1)j1$JMr#F|`dj(Ra5uuWk!DGT&2n$n-{Y+JUiVfA3e`-z+)Kl4t
z+=QD?&j^|hgp$!QZ5XPOLtU$BWk7ogn_R1kjYT%oO%{UyXu6K=#%8gB7@R|NVtMNx
z0~bMxBN8Q^RdJ#TBV#cVs$aTTVZC|%uyO%Re_dA<04G1>ZLCjnzN(foi)w-~@82kI
zq1*~lJtQ1gj;Y{F5wND`e-*om2*_qHkg!g7bwbh=TO={|7_=6V<BJ@oXiJ-97^a}3
zFqIKi6~ay!1arM$l`UZ3P2Qd6EvEQ#;tN=<Ddt@V_boAOzNh_0q8nW)$<?ZgMLkZw
z(MkaLg3nFHFUW}}BBU)jg_?1DgHi?CdYE?O@+3|_@3vxXy6ZLIe{SM*L4~ldfZ}D&
z+y&q!w^caowww;tb*fKy6UsujCZKmDFoFfNowOzO4>VUsM&xYTHZE#PP@`>zcT%mJ
zK>ZA|v|3t4so>x_BY@a&5>SDOVi6IDOx9{a@~dhAc_C23Y`tc32PYiwB>{6#PS<a}
zB<+BtO&G;(t#=!$e^ZAY_C}ezbvUSPeC=0##pI^1iq+=BzRaX02w;U4b-GngdQ6g0
zcT9)5sUs{tTR(P?&Azj4;@L*_{n}N*f?+e;Y6h=Ct41#_z=nvBNH@g!QL&xxX|vN6
ze7ZOY66)qf-r9iDzM4S~oe9|@`TkJCgG?o01a>~85D5dMe~A_!Db=zp$A*ExB}o#&
zJj`x0)fOf2Su3hRtDysBP;FBJmOLn{`l6!6QA63?sKjE{Z|JDD9ez(NX?Ob?v%wp_
z#m_`vVpH4QK6DIDYxxxTdvG7>*--p0K^8@GXIj=7yc&;M4R&|zjxzHPOB>qeoS~Kz
zO~J_ap1-O(e>csf_BHH(vxV?(qlwHthAb>fWFQ!yXR~60yetyn>A`m-?~Bj2i%=!D
z&xl00e7{W9Ag7Xhh}(ET5*#39l}@kc-M&|$xzbI*n!)n6<2G3@Id&)QhGd<gK0rG)
zTtbb`VHtvDuFXrgUQfQ(eP<cHbMJ9_9-Dw*12`4Fe=?NNf-zB}JrU6$45_V;P}AEF
zyVW>sS982JYBA5=dC0MOHpm34Ze9T?a9`_(nso0@IX^LRuoWc^-fjR|u)a?IW<CD!
z$*jSNC)*|&Lht_*sS;iGgHuN?NQCT)!J#E+`3u?Wx7YyI&szUspuTh0uQO2tQhN$b
zo<;=_e<(iZPYjGLsD;5rQ4ojhkYK=y9e9-4Y6av89|-iQ0JUi|6AR0-YwQ6eAv65x
zJUCl=Fbifz4`)H`>5QeXsj~&gwXwnp;^P<<fQCOneZ|)j(o8CbMS_?<1?#h!;{zLf
zKly`5Sn1;@$^DemlTW7E`8*$EuBg?1A_r#Ae;r<~X-;M4;1T;u)JK6g-zH%WM_o&5
zt-=Nl>!O(0MLP+qo}T6B9nEKQN|Gu}_F0;YmQ@p#_;DT9oXBW1O}fV(&z?GZjC~Kc
zB}tAY5>d6GItQcFB9e&2JnBU3oY>Yvms+#7C6_yr@>~(2O~-<QCjJWxra3RF%3%7E
ze}e_*!@)3f!u60a+bt_!1DSl03t|()*54=}@+9=k;o|28PLtbC$y-pUP6fXhI#D>X
zi6h6w%pgS@fC+|(8Hc-;jeruid24aI0zq~BivETT5Z7P<v`$BknmethLfCaB&%CN@
zJEn;g;468y5HAk>5|bTbd|Fy`-U!w>f2xo01>i|P`6j3~1Z_Xh5VOS1$VXfHEo3q%
zR6z7uPLq#7-OSj`N)CrY5pyr+93D?hhuL8h#G9l<vcSgi!h%9=W9ONu(@o3os3=a_
zR=`|ZYqp_v#@1@ZZY^5jce(RzWy@s-0g4Sp9N{RG+*NEaEoZ}9r{%Vvt0iN_e?W*`
z(COf9M>JGlqC9!5SqHBB-i3Cn0la1)L|N}0(Ykj+BOIJ-t>Y%|TFn{bd~F)`VoXnC
z5d8@jG4CS{_oB6jb$UK6uLLX&_Vk>i;HbS+YZ|ae4}GCcZZ^M`!d|)_x>8ThY^!ON
z8d|1x%;t<}c~L5wgp|i^ae3Tgf99eWL%n6qb$HwD`J$-AvLMKllblp^A`F;9!8KiC
zQaE2h#UF;Tf(<sCwFJ|?UZ1L;d`V-x(qQLBd706nwpLbi^G0CBMIP&U7pNntniKPO
z!-i>a8JI*ySCJ#r)$%nYd^-G}TNw2joiAJq8Fh{q*(G#f7Y17B$t{Htf3)}p1DNQS
zfa0H?U$KKUsHsd>pnh9TW&Bo;X;4!ct!V$lX8N^O`s<DKeH(0{o%wRo;F?xi8TFKt
zTh>z+&f2nK%9+(q_GOg;P2`zqeM%kih7RC$uE5pOiNfg0#cLA6!nM43Krj43eZB8y
zQcPH6g(@fJyDUzKuGn8Jf2HKDDx&ipThS3k{*{AcXJ=RVoMNuJj4aMxKs5~{G5`cU
zMa}|*2Otg)GuWiiauOU>6})symY&U1AO&UwTa;v`h1KVq4I#%)C&O|wRD38*0@wE~
z<p@RB7`lbFL&e~X?Mxs)p^LSpW(uc!s8J8!Tnc)vQX<C@vx(YQf4@PHv)1q_o2P~v
z91Eiuv%DeOr<FNZJ1wmh@U~VBnbd#BBov^ltw@W7@x$=I=BJBn%w=rMd9@a$>QJca
zC7YF$yrVy$Bj@5@cbzcc3f4$$GuIcxkdLWDa7AZ92CB|bgAsnEmc<32d=cuy%)M~P
zP(8&tCPS=~nL^8xe=tXkZE+P<{e?Q>MDSD#Sy+`nsdJ%yS#)A$gJieX@gWUHPAU09
zd0Gf^=%>R<ZVlzukZ;ws=;P-u?t$ID{Gkn6`J+ceH|4CE>(fD->^eg{IaKW#T$2Fw
zKw+OClGmqAG{*2s?p{!EBn{(2cD7wG(+)>P`Mf~uTo9zce{Bs3db$temSDHQcUOyk
z-Rx$QK`X4=`#ZmGUOGv1WM0Q_w@<#SBqlkp&N(Fc4Hv0N&P!Omv~Ie6RsdN*roTkX
zwa*@iT~VqHp(LHru#aZu2BgA@M5<`j6~%eyS}XE*@}o3*$c0yQ1SjQO6kwh6a5kc%
zENL7kW$RQYX{XAO3V$=@)F#~lZh>4(O*qic3jv_OP3w+`wOVKgHD09!srAAw;Cxz)
zRZ8t9Cauz~=jHjFnw08Z@Fp*_nFjr&qii<Q@oaA32nr0b(7D5fmKsAkZE&rE{I}EZ
zq$X8Wr9seT%IxK)Z|KY<@^Ih}8C}(mVuY~Vu9Q!IAl$HC$bYA;g?!p;g?!p!A)j^^
zz}Mq^C{$W;T!vOOmSdc#xn7i~JwL^J+54ij_M0mK^#@Y)Cn^NgAB=$>vtGt$?_huU
z_1jmw$yVEEFBJU{2eDSvryUmcabuPBwpPERF}DXh?l>61T%`W8oq?n}$b#4#?f!gr
ziWErLcUFt3rGG=zY8Leeyqf)`tL+q3nCBBNh;~{#;^G7D`yc6vud=xvI3H3(o)3hE
z^6^n7qj<-ywBWd0u`;2+=c=T)qH@pMQ4u#WNI7*rEG8OMOw($Cme@55Dwz>swSG!@
z-;KrXNzLDo1VeY$lVEOBj$O;mf0RP=_av->Z4#W?c7OL`^S5u}wzcNh%O3@G;TsCk
zZ!RrgtyfwPYpv5}jVr-_yH*O`KO&XWzir*FjJto&*Khwes>+@myK?N`Zmh?Cq*Zkq
z>kUfX0L}mt`;wFr;Oy!U9D>UNa@A`TrgUYm)s{KhQ2ZJ~*A5?lI}z~FJ+4?0KgzXt
zKU6GpC4YRQvwfYB5F0iSxJ|^KYMc%91dEMh6H|7IXz-=l@Q$MlJ68j7W7YMbthy!z
zHx*NNSfRBl9||59)k<w1YRKXGYt@yMJ!*47A;_q)FKQL**Nd;S(?|+Tuu^!_mx6+~
z^sA|05^n5mssZo7NnqOBP!C>8L+JOK;@q$Kuz!2Xxj3#VI`0gCoC+UT2p0Y4b5f@(
zm%SPep12#E6t$aiNzgbVn6KSjQ(p34I|d4JZ>>>|#BJL8t=2PyT(OuHl;u3j=3H(Y
zUze-_4jQ$sfbc`HT2?_a-)X*Vt(W8m`R0pdNYFm?RYQhd#m`!?Pb3WZo8YbWCv+BQ
z=zpKDrU>R;vPXu_l})8eZ+QxT7z^^@Xmy>yL3;2+x;ayQ(!$B=Z&^rL(_7B>UVlkL
z4w~MvAd@wXMd}tcyy5)1we*W4Sls+=U5>1(QRxqyrauG9N$O)H>>C2L$cGbGc7a18
zjR;f<gb)9NTW2MO!^xyJF;|ffT1AED)_;i98acnzKuq!kPBO$;o2i{^plYJHn!Mfl
z$F<5=46w4Q#0AIYjs0}9@sQKa6@eg-jl&w|T$`Lx(Zkxv&gjmu{qMEpE)E)F5q&90
z{(Q~8tqB3Xp0ucwvO#kamYDlREFIBE5DLO;e9Cqen!pLm#+5p@%k4E9(gj?q6@O!R
zjz;)NbCP`da_>djmkQ{wct`6Q7<4mCU(<8qqR7y)h5H9jTo&}*^tuC7&9ts0d}G0Q
z_PIH$*EG9=3@OT3y`Ysy`&tmb=ZeR3bTzRpDIf2O$Gg(;9bTcv^JT4|6YKh-bBjC5
z9~3-y;lbd;g=^*F`zQ_X3&UGAE`N4zc&kyr^=UtOwg!=~O-F-t8d_XX%@35Xi6~rS
z+Q&-^77DZKpaeA^GW?b=P|j}rhT?xMDgM_@a=?N}XvXyg%8`<nHq{-5E2||2>pa5B
zuo56@d{V)+xpMcmFWcR^rfhd|yRzM_#<SFUro$wuWM?}_Cfae;;+a4#F@KKsU_bf2
zEAxFCi(VXk3uA4bvwy@p2>EUYKCPfu8yK)K20q5Ylf%UUM>9I7A-3XlD_0!c=SG1u
z`0W(X14IU%?b*_$3q);g7`mcU=m?39GB!fS)5a0L=Bn`?OALf#PFtnake62a$zj9L
zU8qnt#vmdRg*74mB8J29=YQEK98x?N^&uV3vUhop%d+v=KU=O1rAxClU-CFel!RLj
zyizMC_LEn<J6n$VWJFh|^}T1E377>;&5}e$-S`FvFEQq#TvgL61`sx80p5N_$2(i*
zX?}FtT}yC`Wr}zUPh5UJCoUR(iOxE8mI!`G>%abg{~y+lw%kKox_`}BYfRvVkorLq
z_<^bgTDBlWol-y?G{35%fHkRp7+ZGG#sNtmu%HV<u~f45;4;k5h>O&bWfr;OAQwvy
zMd=wwUo_;etZs>mlXLQ_%TyKGlJum=txWtS$lhrQV%Cl%`RqhlKHNlCbZe`8Fqdk0
z%Ar~A6z%&w&t^h7A%CA=6PUar6Us<{+JdsGS~aU88d%gTCli0JkpO-rY;L@`A~wtn
zPm6Nn@2C_vE?8hN{uMs}zp|t`o~)R|F0xCg(0Wj-qEI`oSe438&Sn~FFfXf$qnIGU
zF`N@E{i#?aS`0!Ym{y}4Sqga&lCY!mY3{MDip^O9skJ}T^nbe5G+VICm3t?odKsDf
z)aB|`f5G2^Z?)H>mm1y)%6V84j(VSIW|?(D(ZfgG^qBiMN&7q-19(<Jp38--kbEDf
zoNk0{%1aI5j{36AI<dL#AdgFk1R@vZ$ipGqsTYG(H?RgO=0YR^I$e;L?F-v|2s&MZ
z>;`nY<`0BmbAM405%33$CNBLc*<*U$LCYa-alxSwa;iq43BY5RKp~j1U6~6)oRrfk
zLeR44OhML_mOP9f5Ii+R+;Ef?LTuCv`S8(@I$bge5B(!U`EKaWJY5w4jw(WGOpdv!
z<dZwKb&p@_eL}+cc-*Uv*o&9SP1vn`8JO;^Zmxq&kALJ<(99_?wSxL9SPSO0W}pHS
zU902er4naw^a_}h{==k2skZu<mhmaGRP5LB;{kr_dG{(tpACnxraoXiY4XQa&S5Xh
z=FdkJyTtW>hNu$RH@-2v9@nkmfb_GBBQXJwM#Kbxa}6+!fkL@daAY%DpVhSr&=M8F
zAa?a?w|^&WU<Kl^WS`c@4lMfq#sv{Adkx;+FIZ4F3)>K?b2c}`K?i7HAamS>a~LdT
zHc`vn_qX5T=mFw8qhgjBh_=rAFE&n!hV-1u{ArbBwhkE)a&h6!RL8U9?Xg3=`)zok
z7=Me}z37L+47;6Bo))g8a-3D`N-+?B5x+fxoqxfEMhl`FP9#54X`)8jaScHt^kY$Q
z^D%%W_|IM(71+NK`S@=F()X@#zkhwS-<y$uW4bXw=2;N&8DR9HaMiBcy+WozslbWV
zSqU~^Gb3emRXy~?DzQ+f7gwzYnepSbYS8sA7h{h^z5imp!}7XF6~0gOq{LC7w3mk@
z7JteNVOsLps{c_4Lou&Il=>sfQ-@DRJ03f1rqiHmPj{nt5>sdQFlWB(u=Ab}OX~FR
z(&L-)wKrFX_*>qojhNim?$*EAEvz`+C(u87JuSkNTvG;tFKU^cnBA+-*<htP&a(d(
zUl%uuK%_I4ls=Bx6nm`>gDQ!!<Au1(>3@tJN3ebP*)haxSGH9R!NE~#RpBuQ)w)|R
zWFr0BjHOoSi^t;X(4}kDh?(h?morxdEU@+gV3`{Y&7*&ok+!+cY`eM6=>aikI3Ol#
zO`^YDnwYM$uP&Lr^{*9OT#ev8sh?33LzZ?LwZFP@ic}k)N!sqw2M-^$<*T=2sedjI
zDGWlozMDz#`6T>s($JQS>46HmR--}|=eA>f*lmmC7Z>z&gwg)4Je&1t*Y?}jcigBV
z*|5RFkv&Y-C^xb1ctqaXL0N@jblt15p+bk=gknmBdKL=)EE~9d2d#x_^RUbo05J|m
zi1}m)Y5}duOl(v{FIc)N-9k`bvVX-@h}0K#g=0E`epr<Owt6UJxx&U9@n1XUYh-qP
zu+G<RRR!cuC+ts?OYbZrMibi1Kn{cXuCtGEyv>6xxoN6{$320r>D+hF%3UE>SO`3&
z=w9|M(vL<3-Z=L0RKwc+K4EaiY8fg&{d$G&T9?-p-g>R>cw4!0-9cngjDN$ii6E_9
z_n(&_e*!gr5Gl&2ZY<b+TO!;rX=^m76%@W8PIZ<~=dIS>lH;5t{MqcLS@n)@`$NDM
zHSL|H3J#Ser^N;81Jn71@+VdzTJ3d4Wab$Cg@d7|ZtHLp2DASTI9+m}q%KmHzC%pv
zXU8yppet}epG=D({zkZL|9>(c%{#u}z~xz)ofpmgUhZum%&?HM--Z&jBo-!(E46Ez
z3kBA{=(jyUQQ13ix(Ld~JTGU&`jN(1&U)-SkWX;I3cjUpDo3h!Kqn10_Plp4KJ8Jt
zRP)Go`o4TW>iyUM{9kD&DM#=-NMQdlf}ATf%*7rA=p_t*j_-9?vVR({PV&H^`Qn)x
z$kogF^}ZG+gVA<3+zmchMSLEl6`T(E3#lM$!A*gmL+W~}5tJ^NH^|=gBXdc?zw{VQ
z2z;3gTtfr;|3j%jdd)KFEcf`e<UbMa-lG?_*85|dzo&W&cIsX+P97iCFN)mrm<`#?
zofNKq58`SM@v|g5jDPd<c?pc9U7#5(R<oHi-MM)+A;HWTWv`rnMt^t{M5?_=HDOFw
zMe#yiia(5CQdWU8Ox;VoiCv#l&xEyfIE*4fbz4=E!rsb}`)MFC&@Q3<StY%HPY&K3
z9yu{HB%5O3UX^+JGHHW8%0=-fseF_?%d-XTE}rE7c=Pq!UVm8I6wZTlB(TF{hD?cV
z27Rfz&f=o3RIUP)FJQp$uEA>vNtze16F3vrb|l0oOJWKxS2`-#__gpb{hu>rVD^N1
zEYRQu%*DE`H<8`gJtObRke?&Lyt2)JB^tT~lWVeKS|4YP8znEGC%=AkWXzw*Vr|n5
zY|9K}s|}<|H-8N0>cd@f?2<QiX>L4wxFjacyt?b)3*c0oCyx-6G3krV-MW6Eq((}<
zv~hD?ry+5FxLz<PgT^~n#uAY)?RLt(&3Y`HL$Cu|=Hlk!Lk`hQ=n&om&W{zqYfNo>
z=&B4#W}7}7x`Yg$n!`~8y@06t*s-+@iF5adAqPc6Lx11N(1)cK@#^aQ9PsWZ99yuO
z6@OgiO^O4HiX2*2CBA}^0}qW{0jASyG@eGhst{=rp!R#6;p>KY8H1T?KBBXmdQixX
z_~#73aVkCKbV|=NL+Y1?d3Q4s0V$?XtJVrq(Nn!_=4_B1aTlAAJ!d0=*p0_I06xM}
za~_4pAb;x^(_u}(E2CO+K3IHzrfIzuONDM0WPBX`CUKIXmzaerXa&feYTJq1geTz-
z%Rq2jz(v9#-`6cjoWY|Jd&l_uY*EgNKSj?(ldAbSHSis)hvgFy%o?B1s+9&duP-!5
zNoYIc5cJEI)4S;ChhW{XPK3M_h&V<A4o#4$mwy>LhgVI4NfInL<Z372Oo*miUgivN
z>O-dbT1-{PGgl*%N{<{5vp9#5t6@NX@S3d1=B`C9vKZim-yw$z*v;hv;{C~4iMs3(
zVo=VaQn2G3j#oLXf)09vgdi*7yGU}EPviJ3W~)3f*tl$UBZ<UPaWo2Ipo!d(o>#@s
z=zqCXyQeP(Mc<h^6Y3zHwm@|NODa!MR6g^saa?YK_!mQa0?MHEmnpcKmm=SAH7AZX
z)I(?{dPD6XS`+$e{ZAevuKH=Kc>s3zy1MWO84zD+&H)BY68m@M$o5hu)JR{NvHA{_
z1VvS11|mg7mzzF583;O0HPE()`Et5p7=O*rMl}u<|4$Cd4+$T^E*Q+Ym7%q=)+|UR
zx@4*AygQw-Q>}#p{5vD{ksnpcFcrviFaO>&TXLYK(6M~UteEn>plO8@o~&jkS}O`E
z`O9KTR3%B(8ZqG7_Z5Ev>m18W<*EveEzwBb>xVCXZ%#ulrv`OolUt0YlBZb0u7A#!
z=Tly${lE;&vOCCYxoKAA&_W?SnK*t|_%OGNaDLA0<{Aw1Vjjrv^vk`$4?8{eYk=}J
zt)-h=i}UeQ%Myke4!F;^T1c^BZq*B=B4B9g$F85(0&$sF_gFf$MrCY5p)G|`kbwb7
zo;TxmXIGPIzla)=tl-g5!<(OI?0+JCZD@~dZ><Kf0}R|_Tb)+am@5a(iOKU~2p$|Z
zWe>Qf^da96BCRt^ZO`o3<;YQfg18GwzOGT?dqa76IJ)A*>><Cjy){u>{%W8H<`Adc
zRu`IO_2m1lVm4nbw|0{)2D#e$vAG9P2Y5?h{%J;#tE<V7h|b&GpRgySK7Sy#YMJ|P
zyr(WaxZh2-uIP`4_o*8$7Up0-ER+gGP%?;!)NwC1cL(^@i0`<d=a?^&Fnm_R*x;PN
zl{tTwtHsRF!ks>-<c@tDeIPW9+_a5N1>`yqZiA?Sx3-T2pq^9Uog%C3@FcG>t}IE7
z(o>)VR^s9^7EPOlcI~canSXs1wi$Gym!uI<V~sj#(yQ%<cw^aHj(%%z#prAtQCWYw
zEBE-N!woMrP>;L{V&ONhA<oeir%0{0b4I*w8~+*Jx*<H>+#%gw*L5qqwqFeAbWJ0S
zN?6<Ye$8mFZ3_!<v#(hx93wjsz!;RwBzm9+?NzqXZAb4&Z?`J3-+$Sf$%FAyH9Rde
z=9oDXqwLX`8hr?^s5m61t8;&ilr4lSV&Y7N8Zs{Y+>vBUx6%`LY1<{s4_AxnlP&C6
z+OTZ4I4i5=?r-kjzrWRO2_D3|eD-7ub`3EP>UF2u=sov)tJQ(DgQ`XPVP!2X#{%Vg
z^O<26wmgG7d=y)P1Aq2la2jm!<}~|q5y$u)KI&ni=~c#-B$ZtD{)Y2!eI5@Vz2Qt&
z4C+;xjSZBGpFDijsvZr?(RVZ|dvLpY^kfSpJ6M(j29;aBU(#^cFgNo@03a=f^fn&Z
zmR5M?zTq4pUwnhUfj@`-{n6H!`E=^*Q~zvBgxx-yH*0NnlYj7S{=y+AO{%WJNr*5M
z5Xn9wDoDP5yI<|f--E|=<~~(VZHzy0FI0eKR=e`jWBvJ5--dKaUmruX)mzuk#g=@#
zVG5Zdr1!x&C3Q<iNY2EIDUYC^92Phklu!&*>p}n5pZunOzso)x@m4Dok0#TvuUy(m
z7FogYO-ah=vwts<N0K&Tk_n8Jum1wyP+WYQQ_0oR+;~?a__+dWm+Q|YDFT2}vt!V9
zklbp878R<qsf7u^=wgGZ>^DPsf2gkvi`meXtoG(OSV($Vk3;yyZ2PEJE_(8APv7lH
zK^}U}kYOiI{t$x}M;h{Zx-KQh;ia5EBP{Q$A=|doNPlm4=io$&9$R2@QEDo^DYsge
zCODKsmLc&p%QMcXf+2*1&sF&25}w&4SJYEcp7;rQfpbsv9sf#KO@B=5Ak1aJq10kE
zXR8F-FhSF~@OTS2=G+173{D6;pkfJ64Vc8Bl&^{c7D#O$S4Q)C@mp-OpQsftsEt4;
zj+(?G1%DU*Jo+%5%$QE$^HNNTZT9?O#!PU9G@e~WR2G_10}6FH*N!}~bb`Re2WI8Z
zcGjr>B&!pS)a%!#K${?%sRmxMH;b{6Y)E}5B9F6#XlnArg+ZNw_^N(U>R+;yZGcie
zY0t_@314pe>El86wCQ!MT7O}0$z#_l+YJjAtAE<rcpRzO+%4STX-}Wi*;4jtvglS=
zK|zjaTyGtR*S}S}&Xc75e>~{lSMS%Gg>I%3G#9$w@LQ4&niTi&FATDPc@!&TG)d2c
zWRXQLE$r^v{C`F-9n%UI<?b#t=5Je>xO`@+KqtMYz&;>W@p!w_O`etSACIqQ#Hh!+
zyMLUDxVy_I$<wFF_bgM<;fpjzOC4q!B?bths00NI@lxl3B)7Y(=ka#u-#%+uBX2x%
znFIY%Jm^i$%<{`^hXHn2p6A<bp<xmF+O$GLIViU~oo?;P^D8g@UH@dGq#3`$Z@AIC
zdAE&gKYGietIOjThlcz`2z|ZHhbm|LkAFKYjMiBqc9AwS&WFhQ+uh~UoQ06s>HxGN
zIHJ7;quuFemsznyzw~p+rE`XisazPc>vgR`fX1RxmT>XN5MUCuHV=a#5RvyI&9F@i
zG~^|WW~-Z6tF#96aJwtWQNCq2Z?2rw+Ppbcb{k4Q&DcHKaf{-DBuLEF?(Pe)IDgp~
zoo`zbypp^a39Lo(eZniLQYDEjBsK3Qs|UYIer)l)*vz{(-26D{KbY_hGwtk8Hq%(a
z^_GSt*Im=vVK7{qW7mn6qtlQ^@ZX<pf8WL+0XgSr7XW)0D_#8blSdDKG-?mOu2<$-
zvE+}_cB^4&w2o4=Fi>(sJ(<TH7=N`w3zBHb_HiQzxv5=Xs^}`R*81RBe8A|0#D3JF
z@MJu=-vLu`J`XxEAKX`&zG}tu8}!<BI<S0&o&Iz8Ir#O6eqjiY?pK^vTCT(<2V}8s
zqD=D-`C?Qm<{EA!c4Mys^p6b#vLnRtrgi*XIf@tY8+w4n7x+3<oWlWHpMMrKG^A&?
ze<3T}m45#U{gzJRzv~+V&BD&Gs<=t{({BniCfBTC*F++V1#x+RUgF>9W)NuwoB@3_
zi^E#K17l150|9k&*i)D<TjM{>b<|#RE7l|XMcVz|0$O&H;?YB6Io#N8^q}jons^$y
zjC8_SOx5rrGnn}0uNlE#-#1mJA|KhvOtjBLy`O+_G|bw;q6EjNTtam;ZHKz}bA8G_
zYrnUD{b`rUG+OYlp<o%}JYL^_;gcS>7k@4iF=X%O02LE)AF7Fy=!MLJ+*FCj<$!U#
zM=~HsT~<k0PKCYz^>LWZ3;I))qOR7b6==FbYch&_#tE|ux{0$`MNOO9J*fo9QsGCI
z?`|o+v6EXT1LNihGxg|zQM$G`*pgSpW?)-oRQj``|Kb?J<=tH@8y@#U-Y@W)#D4+F
z0o{#mdBj9_xxGiqQ7%}kw#3?N#u%6qX}3`{%k=-<<on%!`>`!`K|7zt0v(gFpK3p=
zH_ugnHM?A7^X<;x!JIuSM>b=3nyVjUpY&1nQ#J2p73kd_m_5?I*DlApcN_<Nd*^e|
zEHLe!tpW=K%4}C>0}?Tk;}`j?^nZ7_;`WqwE8SFR?Z2M?IvB!-`LLH2FN=aW-@=Q%
zwidBk%|(|mVK6t)jGBX5!eCgp7HAr-hc#8ek0^C2h(izXY0C*|iwF|p<=A96@{2<U
z`zo9M_ToYR(XaXs)@u8OU+kc-SpH3|Dlza(MK7X;H*8<%(tt->`2h#M6Mr$;i@CwM
zO%&cePJPESJiz5yu^2;HTwd9elG4Apl9(73%;Udf-~al)`FrsHV=zBPL(^XxbZ1}5
zM&(7WF>BPSDUzuhlj1*U>Np7jIVY~TZ@WP;G-GP69z^GE1p(C!Lq1}k9URb%d!g;w
zrduu8fUo9Mi5261WEJld34e&=y%1RT`kt$X6-hY|Ts%T|WwD`s3dVG6X8i*PdS^cf
zg#msFydz_fUyj5gEu_{1(v@gLy<#>Yks=?9C0^*f>e-tleT-{gQseKYlAHHc)vAUZ
zYQ~ob4~FdJ7yT@_9u~A%<N~IFXh7RgYDblFkyfF@BGV*aPl!X50Do^I4{EnE?r^{L
zxe<eIWn^Qa`lmaBB9DRer1F4+D+hIRk_p<CMw+Tp8qJaqt(;_)WEpam`-)vt`TP7t
zn%iD#0A;jL9XS~m5}!=lkgLO(P2M=P3&~%UQ^%NNJ7<qL33?jfFh>T@Mkmgvp9b;H
z;p5?A;qX2IRu}6}^?y>is*V|gR{->YPzb<1y<*<Q0pA~kNHPB7%N%OQOH>ofM?EAN
z@S&jK5_Fk3Sf}qN<>2K(@7E6>Y5hT4N2~2f&(HHY9_Yyf))jj|Cc(N;p9M3H8ejN|
z<`|Y!W_G%=;v__*_&XxRz?bZ}nyh&V1Qw#IbE)YKE(E@b^?z-wAS3U;wc;uJGFyOE
zk%xQoaE~8mH(SpNOW4%%JRKht;`NGXTOxOS$zx2EJQvj|?$L9-@HuUgRB-IigDVoH
z-{zc?TQ0CVbGg%-U(E}YZPYvZn)sWn4vNLK<2An1(>t!ts(mf*dFf?t1y&G;cRDRc
zNTn$7Nxi|n2!GyiH+u9&Pu}Q7Z*(NL2k9a+*^#s~#F}t+Mzh98kt{gLHm9r1%7!Y-
z6W`kLi^hHQ3*}k92)LaOzZ&YDunM>UTUpJ_xv$e=yGVMYZzkJ^wvD3GBY<vmrZ>-f
zQRxXm!H)B0NxcrX<KjL}9Go-1&?<`&zlBNNrEfcMMt|#~&>Uc2?U`_L1>elI7jDB)
z)C+h$XBcoP1!l`*3G1#JKHcXz5%TM9>fIu57>$Co$vnkpg+!8BR;D!*rh)vKhqM<q
z2(ygjuTyvD+2u^VYgJXAXsl4SbiL(`>voc+yco-N#t|-lN*5XMTq7hbUqDVql~!H0
zorO_w0Do0fCtY$8P+YeqCuf*b5x&dGAH}k&5y$>gL9wN79zz<_;HG(t;k!H?OV&c@
zX%9)-syKeb=@WRW(7f5z0#W=Ym5AFD%@MGmU&x}nq2RG7%cUeETXaeN@qY4+f>Z{b
zvIWTB<D3=+(jdCdIe8&Dcx!IaSQxmntkv~4l7C|yM_x}lrHNgQICIct)=jff<$euD
z#0CfG*8qr_^nn3W`@%mW{;>sdayw22)#8NSna=^=xTq{T^BXy_HNzzf)?4uXK!|}o
zP9G15-u6os76}gXT0#mtjz~<twIPn>lc7Ef<8_cmCK7<Z*YUKO+>$nr*Cen;9xib_
zGJm>gg8@KumQAk|T-r8uH~hggaV%77gQls!^+^r6sX*yL_qM8G{CO8lgD~RC1wi%P
zvXCap5+_}6p5K2R%55za9}1QbuJdb!X*H;17O+y+1aN}eW{TSB(E(kt6`I<_hLJd`
z2lwxvgDH)B%d(eq*}FYgajlDdU!z6i-hZ;*ZW`+BYmEbOgN%82>~SlbXXgHJyvQa?
zPGgj3gURVybqH4sJ3e(dQEkpNIEj^=%B64l11P-9s_jS;?~h&8z2bueM@2G5M;yMP
zoFGBR$Ba#VC9@kGL^T`6q?ozPvttz2-k`D!saKE|hjXG3o;)d0FhqUEki6zZ6@L~Q
z{%RklA5{>-I??=*PlkMb7+jB*g4a{0^OVb<^(1hJRXiT&cB%?5j1&F&6{7$LR|G9M
zymDI7m3(>9*D~l1qu44W#)3qbzv-&cH+)pfC9XH-UTSF2EmYhVE;qIn?Xsx7zDJRi
z^mk-4Khm;#P@lqCM3lBv9#`n<7=QoBAR~_B1heTh<@I_58?;Y^1h9oBu7&3cLQ&<|
z&MKGLh7GF=XVg1(rXW1T8!FGGpg8x9k0ISfs?7;Lb6^)nX?m8Oi={(2B(4hDW(7V>
z2@R{1hk=O<ZtH-AbR4EY&=^g>H*nHmDnh1On>ssKoGu$q;o419mgqX7sDEr?d}OH<
zSsiB@>nrva2NIoC@2c1cC-Aa7N0^?N19b5M2IU@yNK@l;TmS;|>iC=sj_0*QA}Nw<
zWR1K5TB<rSiGmWra9n_8$XkhLt4I<uEd}%Ub!3BtgC)EF(R6@>tQ?hQ0SMd;GB<{A
zyx3X~zsP(!LZ*Jh#l>510)Nv%hzq@YokifMG4}4qwg>Q=A7T(l011#S@@q^cl><Xp
zV~LeUx%K35@nz0N&&292HK1;`vvdXBR2PL0x;(22gXnEKUvE|L*Ido28)5Ria{y{8
zGdPD54_!p`jo3ROHi$^Us!#|*7#=gntJcK(b=a^z&1fc;qLf<Laeud!TAAdsl(r}R
z$AU`1xGQ}<JQym27R@Y{8hUI#04|#nrA^#R)Qlfah2#&?rzCxlU7g!o&x7UonT7H1
ziO^t}aWX?2z95l^($kjYXsr6U)ek?O_>tE07&VEFJElGkMS0LH5i2V#C#E<Kw9b^W
zr_!6Y!>14#y68!gKYvLD{nOnfZJuGNvy3tbtG)-0jP3>}F)Nnia*g6$C1wrd&?7ur
z^nN^xbezT0R0XH)EGXtDSS8{_(J{$nZ=B|PLaCQUmD{Q5;(j%Z<IFX@CI4<|n|=AY
zv29+aXZdAjI-<#&Qe9IXv?Xy5@S%NC<d?|;`Q1{N(DQv~)qhvNu69kf4to{H67N0r
z%&MH_0W65W&b22%79`FfK*#!GVg$%0$a&UujTa(BaH2u{!Yw3PWstXG@sfJ>HoUSw
zi4+RVELRm<z~9Y1W}S6x_HRKHWshTZf-*d3nc)4kTzs*3mDOTtwkzgTAOvxQAf}l!
zSA^z#6n)rT!GA!Im;>-N(RE@K4J+mx5y;9u4q9*!sfz%eiyk7Gex4y9KA)l3u^{?r
zGQ}Wxzvtf{h@;Ebe&KjLV}@1CrNTk%w(fcP;lZ&$V9;ucWBJ?g?!%`~?)N{rA6|O&
z+tXtC%LXIQ`4vvqLGWas?zSv-E%@a6rHAX69tG^N-+%8jhopa9uomDOmW$X{%ocPQ
zt#ZB<YZD6?E|S2C$T?Bvd8~DC6N0I)MT#8paAFI+<NbU9fX!Jk&~tKL%%avfQicn)
zFS21oNb&NlKM*a_6Rd)p$vJ4NTA#5SC+wh*!=7ZLV%Bubqx-&uqsA$e0Zf^jxrOK?
zb})vWSbs}e+|=LX9zM96)W@k0&hiRWt-&bvuw3ow)$4}5Z}xDKyDGdqV>|i@o0duA
zfF~5p*rF2nc+oew_^ebhQUD=-y-_w|W^NG_^Fl#h!^Q-iQ1#h!*QNpD^jlx5W44Ip
zM907IHn;37>1rGF;Ur<K2C*!9I*ra(GbbPbX@5W`*I<MiJ-1zx<V!F!=o2_But=EZ
z=4StN%Vr<+@5jy3g^kT(iCw!BI+e>l4WNGEPmN#Z*;xNJ?*dG-5p{5U8Xl`2e$p+2
z+C*A}FQ-FGvN|^(gdJK=P)5y14mj~UyW289d{F#Z41tCs)dv$2cb=#Ka?$}0*5OOb
zKz~usPNY;J9gXoy=Bv?^_OL8}WWGl?-Khtwgcin>&LYU!NU2(l&e=vxAFfuMGIq>S
z0>x;x%*}pwUQ{O}5V#wmo%@~|>U-*1^)6wn=SfWITHkq4w@44VD%si5cXoC*yw%mv
zCbijwj&)7KQ<&$*kPGZr)oP41BJWK-q<=)>*i^(7|0GUec{qwz(^kc%%)*t)2@{r#
zo5oU;lLv!=KGC}8K%#Vhk#F|&$)o;*hi$qUjp<2pOqV#=6E6`Ht=e6?A`JQ|c7?w<
zTb<8&r#$2gwtLC9@^yC%SvxVC=fbpO$HUPGM>@^dQCkH6sY39&wS~y-?RJP-8h@ai
z4=^2V$-Np+=&kv<|AH=kj;zvcYpsv)bxYAwm1;ae<oCEZS(;|WX}(H%TGcWN9EA<m
zK=P>zC(COoLTUxoRs$KbToWo<2!7NWfq#__ehwE`*(430MybR_cEy1vfl!HfljM_6
z?gtWNKCk-n*?ze=#qZvIdV*v``+t@f99u2gLGfs+Gg>XuId*mg_u-nshH*|%|C)1M
zt-(IWj%otBM=P7G=yjX_wTZL3xl#NfPH45a&WL3?Ty$ExSeBY!?IyAdnn;f6p)Jq^
ztm5fV@%%5_MjVKv(h)Ey9rf=bn`+Qv01=;V-hrvDXiR3N9EG+jZ;@)XUVk>^k~<R+
zB8UM`$EF5kfTpX9bPKdY{I&-GSMV+tCVTO<lYFt1AR-(taXBoh`zif#T@i27J`9&*
zI-g0^hPj0yMA>=Ba*8XKCE5^Xgk#}kLF7F=-m+s$y>%w1C832{R!A-by2vtpz-Z43
z`WJf%7CcZmKhsMN{$qIb_J8Zcqn9s+U%oj!dJ^5f$B20<&I)depS^HKd}I5sU%dSH
z;q#YokDjPOr-$dN0X*%!ldONTkosOG27LVoJHmyywbEwLcqJO5)-W^)uc*#~h}iS4
z0Hab5Uhf_4|KX){0r^y^9F-|PgcVI_MHQxxE{UEK-dOMgO#^?o+kdWK?{ihW<9&zH
z>0+Pg9Dneep_yhJ*k=T^z~ROP3TTP9^Y|r0^e$jlVFw8UIS2F`b_N&$ezw^n+aD;w
z4O#c4iQC%nEWotxdAz%N*p|Z7C}_F*iUooCt`1|*Z$Q!dy<_)5Q;VWWyM6N;qswT=
zyyL<dR#CzU3ClB;MSu1W67wuZzF=V_cZy33<SF&5i~f=&X;V;Is=`jWxH9z9pnLt~
zz`p0Z;N4grw~M74kqDrIPNy}iaS}@39N9?wSlwK%VGQXQrDp9dUV+~X=Zjn)8ln*1
zB8o4)hZi*7Qlb$uV*oFhJyE~J|7FSetBWLr((CnfORIR(>wjrUkiqhN?n7BP*udZv
z9}OQo7&J|%mpzyn5$Dho*33F5yGeRY!;jCi@5;qf`nQ<Tzm4BW6@XO2R!Xa25-gpa
z>Ve$KX94qj9<|_;0CBmQDA>4(NFgqUq7f3Zz`WksGE9bvLa5c_wh%42TC!ViaV1KU
zIOD{lW~!7P(tpGh7(PXPg?!XF7aKxcP?VVuXgb`w4$vWtg<{#1_!#j@ntl{|b%tsZ
zh#EH;X&8L$Sm3}<;V+0~*%*BKad=6WPdr11ry&hry?MU(YWU*i!Am;XUO(S|dAI?t
zW}7{`J&RWxcT|<3b9WlVu3rdZGKv=aV$F{0C{n8PJAc|@u_gPStCUhB#K4~*l3iZ6
z(&_VF=3t(w=O^pxrZssH(@Tk!JU+jA1Z+b5^FaQ2$n%B29%)>)OLW_ue&MqZesT&%
z*wp%myi4vcl8WI!_ji|$L5t{nABM#*FH5)AtYV2fm3B8J`LQ#3W13&T^$b>FG3F8Z
zY5SGvkAFVzkZpVMG`qn^AyneJ`>DwzRsJ`bH}cQKk><n^kRBKNrE4Sn8GUNBDyH<`
zs~#Q?!|vI7z(F89_j6j91yndJubf_7mE_NqB=Tp>66xV^?-9rDF$eF-oRGxEhrZXZ
zp2_tn0c18mciE81FPtii%TYRp#DLJ{o;}^`g@0H7nTb))#HjPy56;85OZG*`Rbm^^
zN9Q4ZjTd*cW$=Y|XiTD`C4?=kouF8C6_CaaNxZgJ!8FLpXICzLH;$`@Eq1%e9+9?#
z4%;{|G)tCvaR2`Q=5{}V4COFRUK8u<f9I(|Oj~S1pIu2X9C1gNiB`G9<G~<V&D6gp
z<9}h?1eM={i-L?<(DY@C=~cHryIvK+M>+2~UXJd1jHsVU7ah+|aaV}+x-++SsG=eX
z(>)V2zOQ61Y|#wF6IY>}iIR?AaGG#w10-F6SF}ZLoY_G27rchm!WVsPJk&mL=Kq-|
z@n_DHSWA;IyjGXaA_Vc<2mJ@1{JQ@r{eNeA#6Qy`J~WDUlf?9on>F#zw26PFP5d)$
z;v=L@hya!stl4~g#eJJ&eMQpA$6}Ok$jU$;){`>a;rrh$9YZwRP_ttz06xW>GL%GJ
zfbl5zho+m1<4t7PWgEqZuv^iHv9!Vprf@1aPbzIz)M==?K2FI31J9LZ26M;ki+@ft
z=2byt_j!IodUH{oE02Jdz?5150E<nyud?&eIAiSUX}KDEyrNxNFgXD6ahW*V@qVpL
z!OAN<G4|#?z0lWa)}mA^pqGiu5Yd{KLO<vDuvKc3tfARBX3C26qZ=;b&u&*THAzeu
zAJ6foD4Pm%vh923!kBn!CqOQ=Lx0;jI=C*O)}fFf0s8?NYQl*ECYK1XI!>+)!a5O_
ztvMg|DtiQSJ2!zAu-#{FVz{;>M|X6hB&4IuvN;9m&tp`I(uF?0`6yuv@t-@bsBRk5
z(S2~XQN6umwYA-Bq5N~_DLqqW$||{TKgP<+eWa$VGaxu%0!u)@SiARgHh(U8gv`k%
z640oGEYaMz9daM#y$#U9`pJgod<21|lybUZ8b&vExN1*kIWkaa9%!~A*gPpW=vZ7o
zk-Ug2%<q<XIj+Rb&H<=n4d>+59_u=z3-}0XPOz8Hvb2KKB7~6S=Nx5|Bd&C&(eGNa
z0t5JI=^)$-Qz(=!n1w~t;eTdo<LPzR#I$wGQaw2>xm$AD_ne;gqkN;?9|TEhq)D`W
zV%mkEG&kj?g)Tof%Dk=bYMPp5_MVMVs}t0_&DFjuB~33abR#&+h2W~&tcB_E21^%N
zoFw2Ym^a#Z-U2&blyjac8Z4+LpGoLoxnX4DspYON%Tg7Q^Xy8(27lRBQrn&D4gCw?
zF}FR^=;x)!qVdVQv#_GIOh(s<+6VwiZ=M=r@FmxbVJXoUyTOL%hI(j-PBY}jT`D>!
z=_H8bs$>>PHS^XnGnC}xc#a{dNPA{$Ozr)?oV$o$O@*<XXY(pa2a|zDd<|BE)K#U>
z0^YJxE)8%#U2zQ{*MDfx9531!WF#ccCRQCc6IWo|BWXicWrz^-uxFRWBCrys>>8Cj
zCeO0w;kA?I0h-_>i;iop?_2-U#)(NQuy`Zx+V*ZjSO2BW(NOy1U)nSyJM`n2HX;7{
zwkuax?kfKJmM;F-qW@Fc@%&nXZvvM($Xl2$n}9i^i=mix34gmp<!&GFgA$!3VF);m
z(uoybuT~@d%R$9EV}trX>gTxI(uhK)uZxQ^`7-BZm1xs*Eb{cqOU)Sz(M$`q(9&DT
zHLccxi~H0EV-qw>@;5~KB@@!JNRtap4cOfC^=_EKzNss27dNo&+L4dE&H9NC)()3K
zVNu4<-MRh?JAc*f%nH;LXesLQavEvu<r(ECnZ+M((lF$Uep61bf{;ARU)mNtE6rj6
zV!AW?NAs|0g5rqE*9Tv@HLIDlEwa)9#75zj;foquc~4#RX`jBgI7yT3piX&5Y;@OB
zKsPx>0qBnqS;}DLj#lWG^{Ee1<v?>EKOQ6r`6LfN3V#OK5(kb*Iy2sO8hgS*<#xs8
z*B<og|NVxB!3=TxVIQipY446n@M0{=_gA)*j7=34ob%g=bG}v_aQu#>YNwl9@7O%1
z;(_b24oEm69XGAPfbR6??@s$cp5^Wk4IgpI!_%|*@O|*V)^E?R%Ejrf_2Y?YxDD;_
zlfoL=B!3ci&lV80?oBmn7SB(!ldB|sJwLZ1K=wI3rf6z$)j}wV`_B<I$a<eT$cynf
z7Y`Szo3oKkBU+6b-Bf=4_EoYiA0=Ykn?j$}mF&7;x9I86=l4-)vT>}tNqWufzWL_$
z%eTChxI}!C>IJ4fW))u)%P&`>#FFf}So-2Ln|~F565fl8Ad}~kM32!b*mW)u=f+AJ
z*{Sz2N`0?nd$ekPB^Ya;cZG%f;6r^@Co?7E!rBEbAXyBn9n#}t9vMIUG_~MLUO+bw
z@gsgZ=v-T6Q@O#zW-Y`4IbN1)2--FXH)h^tG$au~ZE+kQq&weLoE{T)nXV2;zyIIo
z4}adh`Td{1sa_v^eewR`tNGQ}f7<`uAB%^p?DFBG{EwF|r&KI@wNn#0BJUBh4$XZn
zzo6=-FJ8WW!$JMJMfms8tHa^*z2V`}o3}4hE20%=d>B$R>t@>;P7)%X$AIT3jK%^P
zNKid%3Vyy8&c~Z>$aPTzgZI7Q@1E<9M1Nbca#PGErP%GD;%HP|r~lJ4K6;6pq#Kei
z!r07dd6keDdOH1(XiR!}czQO(%lEJ!QPAYP6vdai&DDFiPZp$a_FRcXZ_?>-HYm@B
zc7&ax<v5feG(llHwa`+`-3w<8t(xBPaYI3)!nPi&vvRmBQQ>49>&Kib5|2Y9IDc2i
zSKJv>ANuA5$z^`R67MnIN6icQ;DaGCHLinHkG+$QI4gY?xQig6i2=B)dEz{YK_a<L
zCm77D9ESbNZ2Hb=6#;xan>Ap>6fZKL^Uz?lSZ5IF>Ap|mI6a2p>2AYJrClAom^5xP
zO5tC{f-@EAM1jyACP=x@Fs4xOEr0pl54yoY3#3G72A2lq2M=o&mM$CO+xDakh=tk1
zI4+e_14mSQG7y8$AUn_g#JgLHQ{g$k9<CpKo-~AYFN)Jsb^$Rv)6YhrtFBt;XhAD=
z#^=#EX<we3zg!y~Z0v(t_kDU>G+<}(k&#t0=7YEE?sn;k*EzG~`TpSf3x6CLI#)-o
z89AeXts(|(06f4T$zMCq;kHoB6{I%=-NEAV{V^KkLJsm%q#mOeB_blp%bW;XNUOf`
z0WfXcuL;86bLUdmx7|YZ1J2;!jY7?}-r*Vn>Y=gCpe~aoHr^ud_&tuN6378Uf9jm|
zyHZw~w$_*C#-W?p=^{H1wtpef#tK=h>REG)Qr8oq#F!#hS0Y|S8UrWWR6q?GdRk}w
zBzh8x$x}w6sd6daaD2$q?qq*FZeNB^0C#(Iw}-nuyVG%wTVcMA0anX=?(|AG0!!u;
zJ0w0)-NXk)^|gJYA(6@Pb9PUW#G_SS4)f`x_hkv_isV{Vs>g0UuYXY!M_(568sd^}
zUa;JJbXJz{L}^@A(S8b@R%VFj<?(J{4al+s6S8Y`V5$P{vymP=_~gMSSiT-+qK8lR
z>}E%6{3@OjQP@gOI674RxXPgvEl!<d%6hJ2fs``=b)iYs$c=Z{!De&u{457xghnGB
zyWlGBk{uh1AlvZPh=0UU6CHFM(x%b7i=|<YF_-hOu5oHhM4(1gvU_(E3$x!ujGD%B
zELuThpF6>z7>k<Ov^fn%NFvO*N;*3>sG(O`&=AKkLqnkvYje;z*a}QnxjrT*^JrZY
zjP3Eydc<4bym+&l?2VCuH_pqX*L&*Lf(?BuXyqp*M-;Fket#;VjbjmPgc~G^%p>WQ
zX89l@3kAZi8Ri}ExV0t&WKBShPK|Ow1OA+I-`w=LHRn05L!!_HJk?#_YTZgiFx+if
z$x<CbYjfa5lYU}b`Gn|S4B6}rVQ82LY$p^oI8#aYgk$A;sDhyb<fF#M@vT=J!+xyw
zcchay4@=o;uYcz@I;TANjSd2fBZR72)}iIUu<t84tcA`;g{bI41ROHt)*zNhbp0$F
zr8;A$!i>f<stbMHMyXHiIP{=Ria#^u3L?PxRMnqiz4lFc>f*K5Ps>!s>6KA4HF-|F
zcftaoyPqJtfbC|0KDU*%!&YNxm*w0u90@l%V!S=RB7Ziw<%Z7oo+jV8ABSq;z*Sp*
z?h-U=2doC!G@uXT)KkQQf=7u0u1mm?fw*lO#@Sb#<qUTMGIf=a#0IZL65|oL*;7d*
z`FbYh2QsZJ#w^c$TeMF@s?XNQ#)8ReCT$O&M{oN1@C3|;1`~f_ppv0n)BkAcb>gx)
zrgl*nu73i;QyuG@UIhaJ@2=hnA6K@Z0w!=sc6OdiUpQt{gz<U4@X;yd2p*iBon%|>
zkR5*O3&i}^pJF%yaZv2+>?Y4^LO$A6xIuN$aEh6|nk%3mw}_*S6W+D}fVBdYB91;L
zq@JFI@x)|R<L-7+S_2{XlRab~s7S-H1;z&JynkHJL+TStNh1k*D3(j9pW((>PA1q^
zao0q<NiWZPs@*t;PO;3-Q{b4WPw&0#29jWEdeRqsR402Pu`-o7J?4a{%@mo+)mIRG
zgdLj70M#hCr_7Ss3|rtGFED<3Yz!4tlufDS@s+YAO~Z}UmS_`P!}>+u=xO7fpq?M5
zUVpNoPTa0*P}5{^m(HT>XLKj^OqfGbM6F}X5kiGpQs1H-sRFxZTVW$ZAP!*l+AVqj
z5UwONiZRJPu&c!_dx_UqcXnDNYwWg;_TGN+@@V+%?cVF>U+!{4trj8%cUuB^HAGPB
z&@hR1TL@zAp)0G=YPMYUBpkm*d*!^SIDge(x23lGYB#}3w9rD&wUAsc3Mg`1B^uJ6
z?;e8NckOT-oItcCIqkO>pSUMvR&=AHT|-N9^*gD5yU7pkX99!Rd?5g%KmY#wL}f@)
zKRH+-`SHi(KZB=#@e6%nk<&>qyUi;<{GhMsn)jaZTQt4>Xm;^l@5|e?*y}AxG=I&L
zHa)A4az1|_z??(b$o+GK%ADfecJ1X+Nz~sa!ZTX|aXH<OO0HW$C!EIj<BwZy*A5eh
zZ}f}(qc6XHHavRs`<JhGc?hJ8F7jp75ARSDOu(97bCk0bEee}JmtH2aH^H`$#Stpa
zUK*rR9X#u5xAma!xUvgD)MKcIhksjVfL(?`;d~YGar-1|NnWCPIi3{opj6ke0KD4M
z$2$GiL+TG}T*XB9HnDM=W|~-KS&p6g4R`#_o43C|JlK2wa`<}htC!ynjt`%|-9I=Q
z9_$@``K=&K=y@=f5}(cj@raINV~+SH=Pz?FYA*x_#Syb-H%lt0jARYi<$v3E!Ex-w
zXIQ(+xfK|OLg01<%m|0?QOU+wo^S9`j_-{@gva@4b=nQ&G4Kl(*rbfJU>@K`8?3mU
z$lUf5voJ{Fh4vS2m26@C?djYrFaOfhGk;_$y(=^{?2=_<JBe8>{R&YgpptWv3ko)<
z=Gl3raM2tzqW(Y3B$E?c%75agBjdD>xHr^GmUJ>^?0~HlFIMhVgb63ki8drC9nco1
z0uJcxe_T6MthucDJ0CQ?g+ZTiLOFJs1cxLKc9TP}l3)XPCCEj@G%Hjshk{lAm<>i<
z9<*Zt$%s$W&is8&CqIY!+PwH=H`k5ksM$|G31Z{deU2U0<1#u=PJd^Tm4Q#h8sV`H
zs`&%I(JU{?zmX?{_IV=<V+pEK1=ehr4uTJ32kvV}ybzCsv($$Nr`K>17XjQu-PltR
zJV>4}<VBCUZS}h_+%v?pT+Zm?Suu|><5G)XR!{P-7aZ&k*mn;`akTY7=YY=rHo(A+
z(Efw1O1~OD`mpKIhkyRjG=PO;2`el-#)(HS-GaGl?&3P2!4Q#^Q|6Xxa=@k*d6tD5
zzrI3Lmk98*9m3XazU*R;JXr0FlnG879q0awfwMyAw;y&8g)Q{!rh6<GD8Dt1I~~}X
zqD}XZHl2}=SH9OA^Tt$9Y7`eZX(D>lNDbS3JgEl;E$EQ`Wq&65pil!mPZ_%oBs*88
z(1K|FaDoH`$C2>bSJ{=>eMP$EI%)ZgeSKJiGtSWHCHoF9Ph?yE4j%z09;nVQWh8Gi
z`gCCDGVm_PoNYzKj_XCdDoRkVo6~9U{p&DvV+OmOC-Awq1bd=c1`x!|FnHx5%_sQE
z6z44l{K7ly=zo<eQg+;O9=zpQ{Er$^<1sfJXp`4#96hHII@5hGcDwfc`e`tK#?~os
z>G!q(`L<1|Q+F*q5nP2XVo=_|&a-SmFZ8xM|JFEUZMSx#%;$A>8FEX>57dmasjKXo
zS2boRr>+SE5}2rk3M?gE&r#qnoUl2A*g%w>ANXM1wtq*0zt}r#4s=zgKGcP-zGww8
ziW-b0i?R+x!6e0?L6XZfElYk7^DKbKCDv&n#t$(pL4*z?$GZvdWeM0K_Te*eF3&LC
z3TlzLUN}(G71t*axzPhyn#T#a$Uec+ExL<3bl`SjAgK@D4@6Ym_=-p4WqKZ*Bf;c3
zE!V721b;H)RT3FxV(Zo-o+E_h!<w|@5LHqv5v|O|2^i%$dR;;Zu4$Wh=EFzB6MJOn
z9~sIcb<h9uY>~$@Q_w0hzNS?|a{Q@_4fuLr{90me>me?49I|2OL@~jxpS(bJb~szT
z<WRViJ3&x<RC7t?REE!+{ct`s!J;e9bGYLCb$?-Lyk~jAMmS59)L5%g$?ofYPLM)p
zsGninM!4)g!Df0THY%UE7zwC>ICESd;RocY2YMv8CUzAmjDn!MvBe<<R+=iikdPv5
zKm^NorCzJE6Y}xKDr-Mn6OtaiL3zSL4xOH0lfm$6k)y{E*rXi$LT~p2S(qD(p$XWH
zjeqMPY(8^j4@149fnAv?EO7lS1G_A*o<kp$c7kWM{b0Gf%vU(7Z6-wm{E^JaE;Jim
zjR%M<_H-@~nP<~b2U(u2LQ-3*S{lMq_z(`yzu^BP_9cA|yy|iQUO=J0Qcp6P$0Az@
zU%%pzhO?68Wx*6M%UUrD;iVaxYgv}GBde7J_?&+hY8MBnMR|JVrdv}&0H;Y)hG-$u
zD{timGr4%TRz#R6Z_PaDI_ktfoew61u8YH9u}FHR<8b(K)8&<m1vzCFDj=}P-tA2b
zhTx&IiZ}i|E25Jh?_Fj<fwzuy6}RI!@+AtH{tC$=o>W6BMIy%>6D^2p6V7wtY_Q6#
zGc$h%pvNBLgCcTtqF=6xL(NI38U8YOWDP@gC>=#Ims#-C6-ze}LF`blYajJD#I@~4
z6zb-(X-~U+t5_uKcojMe3v#_@MfM_Rm(NttCDmQVC=?QVmRGlq!5Rk!V5a+qIJ1Zz
z5|%o`4IKIn4%f|QE|(65WUUNk-U37M#tMJ27bl1fvL-oG&v_T(=ez!=?>I8RHD7-{
z45}8DLaK!@YYA)eiN=l`#4I<;C#=8d-th+u3prN0`b>Q=EW^=E(CAk)&0{f$ID<-r
zou`X2N^*+C@Oe$nm7)k@`F>K!k0;wt`t^`Xe{j-~%sXI>Qi%=J0}+cR=rd<h6%Kzq
zz$_2UyEkx%s8+V6jxrNcT@Xjmx~{{to*y0)6k__hC{ngN07YeAL}IH{;v<EYOVO>X
zpa2=49m#Qw#H2||k~kOcJ%o`+fR#MR2i4%g5dZ4q@?cfU7Gl(cde%BKDlZ_?d2YC|
zi~N+PT@FR1UTKD3@e*`DR9G$|tHXbt6_${ji^38&xK|4)VeS_2`2Y?BEdLhLj0l<K
zbR2*fS!vNVIuavbpl^g&B-<cG7&DHIS~uk95AD9#0y(3yo{@WOgx=i7!=VfQ<~G##
z5w>!XO;?;WplP|$iPmQSTzHI-wv-z}c(Q|-?wxq2YCKQRU;KK%v)d5nbGv^N*28a<
z4Z@#4R^_n0_1VhInR#+1YC677t2$A18gvz(eg{jj1VC};x)Fw!7el7SBtN-2nKDcU
za6J}dpqO7VdG&pWx$*_@nUG>R6>Tiwqp^5?Gih4bVhq+^3PO7Y_H-ufDVJ|oOr0m?
zih%_#k!{6s9)dIfC|I~@fy#eD)Do&{u4cd()c*Gw#L`$}ZEY4gV|^Xd<z;Se4x+$(
zxe0IPS402o(4LKkc$fS|Q$wREPA*6$k5**^mtb=aO~ku`!*68)xr_y;<TLY)8)75f
z&dz~jF9^vfoCv9Qn;Yny>qkks5*2<`67f+is=9PlD1foD&tHCBvV(sfed(o~YhJuZ
zAF|r`K+MbtVG@CxajAh5JrI8I;QosMK#U_<y0P>vuqM4AJJ^4J{{^Bw;wchnVu%^i
zI|<L;*+C}%Jmj3xZQm0JI!K|01BcO6#3UY#%O)h+P!5=ZUffohfkU<|yaCU1&LREL
zk>2ccL=gi{GM>r>dQ*REw?Y&iF-E%FCLMB&^{BW$+?mc!G;kj&>jTj8*{Un^m%pDg
z=#z#=!O9))CAEjaU}Su^9g{VE@IN2prT=`|MivHSz_<t9AX0~j@QRb8IY}#kh&)yT
zPkx~y8-u0rYXE5xz6!)Ye5#X(wPFurVArR3K&WFb4@N7Z89#p#b>_LZ0YuZ<YCR8^
zC18POfMFsM6M_~DO19%EP5$fu{J&@oKj#OvVr@WHteNlZc;kop?sj(c&1hcT)#qUV
z**Jcr)89BEABC=^B@r-tUd+}_9#<M-FcHJ1pf|W7W2EA<d@0x;TIaxvGPOR@3Y@~e
zwjI+++bRKA@REP~LRMMctwe=g)B)pW4cvv}2`tProYnmo2w=k|nR&974@o8@#0(3!
ztuY{u7kD$b$hshxTL&#?1kpRhj{kg0Uosts$d2m|Hk?M1ZnyckQk-y*IWiA8oXp+q
zNX02IhiCi&g^UFcuMnum$^vSdtjRZ>ogI7iK;7lK#B_h-lW3s1EG-cmjAG~c`G}U6
zmr~4REG9|RqHBJuvIiwmM7@UP6s8dIq>3G!k+*u;i5~bQM0R}4Mvae(1^|<k#tg8W
z#d;$b()57QEMb)_-m0zfWW!F7qm3UCWk$CH7yK1}0=UEXgB^`gCq*XDXGB8F(56(|
z{7&C)Z`ywfZQTi7dPE6_>E>x0B@ufkB=>ZakZ`SD8D_H`u7tJJPj&`BG9Nq04EWa%
zBQRp}+2MjzEUHgk3h~Z2cqcYqRc=jU5m<CUk|>xR-i3)-`Hzg@>||R)94pIZc&KfI
zZNtRIW;;O*mxIwNOV>`p?WGH-Sv#}zG)A90pQ(Qwq?zJnO)M}E>K>1f+1#61!yYB(
zjgYoGjT{_G;*NKAr2T7`3nzre_+()?QcV#zh=OTs!eXE(-#8Pj#eCO%2iuw4#%ViS
znwiS0ijj_kt%I;){y56H)L3Nh4+Y_WOsKRzjr@v55d%`t;{uDd#-Y|8qYo3ydOj_v
zNjHC;<NA!Z_S^=)=J<0UTMc9rAC3C14xT}KG9<r~%!$T2fNH9lTm5FM64SHeGi`lV
zl?Y$tLWG}3P9NGjT_Aw-z~vF)%p>}c9yr1c`r3jF|Gd1&D?dy<oiZt7EEp(bA786Y
zL_v9ca53l<545ID32Pa{Z71T~l=Ii8`GkM{CY+{!16z#+Nf-DJW&uv&O7O^PGux##
zlDf-kClIq}`-@U6yb=2yKvc!6Z8QB>o`Y^akJa1EIStH`>c@#005=`@fsNfEY)*x^
z>UIEjpl~}MUuRYE2c^v!sC6vMrV;9q32VrZz+FccYsR;^J8#BHT1q>Z3t_cg)d+vZ
z1GOMB)EJ{^_M{*TXVOT$W|g0`z%ib8OsqZ?s^+fq71|Fnc`u5J*^%D73B3E}DXdC$
z@%l~c(Zx}6_4I6MDu<|WYob=IYq52OE4O@b*Vxn!>T()AOKYNINfBu8ua6hujbYd3
z<F%tsgk4xTz@B9RN{{j{o<?&tN<x3KOt?h=t*yFP-?9k}nZpU#6Ivy0d;`qlKOfWM
zq(91GKhHH>0#m=GA+X-C7g_rvlK>Ay4a$LJ#k{%_OPa_Fs|xDp=n7e;Q1>}Q9)3`^
z>Rq|yQx&gy--z{qSfYZm0n*-J;>6~2l1TvwK*U<go0ZhDd4|o$?yXI|bNqjqRdFf!
za3^^IUcM31umRCk;v`(6yWp;9oPv3kZKT^F3Yfx{sSCo<h}SCUl;OZa-i2!}$4iFu
zP+bAbvRFxlLL}QK$EP<ZLo;EW3iE(Bo_j7m4NPkXW*P|7lx2b=&<eFQu#v-1mSQQ%
z+a|=O;7;Ef*Jl9`*U!rHTxfrCL`(sGu7z%yx(S1}4?o8sgY0y(ARw<kG>Wb={aBUU
zGX24Yy!PW(j9q(x+i?E6<c^+&du-G58fPV0novboMNe+73dPwaU8fhi5}bp8JMK*V
zX4%YU<8>0@&1W#BUhEV%fQLwz>{O$qMNndpJ^qqh&E+04;(Y)F20(w1$iaID`?TG!
zI$nA{&tPe2ZZHcZ&7LpNT8hgl9In_eO|0V{L+EUJo#P`J&xd1*16*xhf7tmJ0zFkG
zb5G20=*$>42|=Tr@1sIoZRYvo>=zS!b>um_a8QhOrXiYZU6VYp>j+jt8FqF!lQEEM
zv;mksW}7CHN4LO6LN|X@^hQtk^!~k@K<PhBui>b?d{H@d)8<U0X92lXF1S=1`<o5?
z-wq5hwwi?p@)zR3yB594Q@UU#BlDxbBhZ1+$Pt_YR?-Vc{9+lfgg`HhDWKvRo#k3R
zTXHgWVg>C)RAlY?BJV*ZTli=}ey@<wWj6n3r&;04VB$i;*<*i9JaYx5Ypc<ak5+aK
z(&6fg^=zV6=8GH%AjXwh&Q#UC?GPcegV8&iW%zk7N{Hq@<{}&OD=#sK3p1bwi{<9m
zn0)qO#9tH~^(tBl2L!TBkLHdudl-OPV>w*jzG-DTL<Tgj@3La~nP$M)Ta31&SyvLo
zAjSkRlkiLoCd7ZB_<PCoa&95HW({VVkBwvO4ef?R%?qsgUD}U8aO))!qhx!pYj{BU
zSkCTgF+<<dpVN-qO#>vbcw9;|%zhXe7$BjQ!@`w>BkmlFll6^?jvVT8vy~Jz=_Q_?
z{qGhOd%gZwXFo}M6OFZ%#Jtrl*g|c!m^q>onu9ng`H+8J>)YFhynvWhi5C!Uq;@rF
zzeTZ+8GW?i+Rj4Q{8{gHSvN{SNfsDFX-2cCUEKV-$^FDI`4YIpc+!`-R@7LRc6nDi
ztt%6V(Y50>a5Z^3ZW~nW*=hXBmK<kwb*rmBcs84;sED}CQzT`LwX~<3b_^VnMH@%k
z;wl=vIz@l@^D64^?0n{IG7{7qKjaMT(wbzmRetnbRY+px@|rc#>{C@Z6>Q#gh>^<f
zHyCau)=T+=T9^f?jPzR<8TZOL+*!njr&>bh!KmKmq-HmHWlVy&PCe`DF{n+r1>43r
zJE0`Sv0v3Xsccp2$?>!f5}nRT89Wr&zD-v*Bbk5My6)smis^}Mu8d4kvp@Cycbj7s
zMd4wW>$+!rq^d|y4Gsx$ooXp?U)-2<32K~ghk3hCd#EYB&DtDIbfyPLCg=OQqG~E{
z#}4RfS<dIa_yvM{b1%zt-^0^kv*%LzfCd3@2~aD~YhY{q09Hx1spJO(k9x6mMqeM&
zedK>$)8|fbGPz`(iGsj8_eM`*{hPmbvpQk#_2|8xdygI5>>I`*g?GAZYkbPlFhQQ%
zi`B`ySK#wp;3||8=UglG9oHUHPSdsW78w`CP_+9XH8_^)&?0~>rwxpj&a#}2P1FPC
z@Epm{SR$0gW`}33-YwBytk*YB6?-(%NGN~VS8#Op#?%M~sCpN}`(sxcUZ=$HxNtTG
z%)EOTo4!Wv(}5?A7+!}Y^oGdhQj6%yKag-tX02#KmK;CJs<S&4|Ndl1`rFxtvfp9J
zV$R>ZN4nu`JSyKOkGTU+)1XMZMUjoO9BCBT_1m-3##Z4Uj&;#1Jvx2t9*Mdq*+PFd
zv}8qd!96iPRR$UTT{+V8@_1H#mlaamhGeA`ahj{4%PfqBApPx%Igz;q!d<kA4^iP_
z#qm*`E!N|#!KE(%R8(<PmCuIYP|zR*NoYlIkBeoib)ZpVG6*N;iT38_F`Pfhk9k<t
zbQ$Lv$jt2Q$c(@d!6qwwKoV)Ol0<({)mc8BN~S&k`NXd4(#@|(;GOM0>OXkctLX5g
zTP#hiEp9vPoGuF{P<pff`f&fn%V3aFx5a-bAG32@mP#}&#(3bC98K}Nw5)?sF&k88
zT64u^<(yX3;0WPZoRMd~FFIa+{-B%u{9%{DXBl_oN&Dvy+ASH~qoj9|v=x74xVox7
z1K{s$xxIx6DYv?~)~D7ljvsv6X(#QUqk*<U)7H9b9)9a-YF+J}q|R+FQ!o=<K<1s#
z8aOWV^Z63`y>BvV?&a&FxBqeQX8-k3n*1_JpMUj&K|X`jB!l7Grfo81RWyCiqowcv
z*Z=%qo%IPaL{0yZ*@a?ieItLi?-#`)m9Rl^Joso!H~Y?c;We4<^qa2)H3Ohq&-M;q
z4yoTS-@e{^HT?SRE9;L4$lr<mjAlqP&eLWSDn1Oe(FvEmx^$vwu=O3|<Fetje=f=?
zO-j1af-m<YtNl5GAUw7etXw^THl`(Ap3fBnH8pbuCgy5GCtA&{5SoAW2!oGyIAXrp
z?0K@>ZF<0w1U9Ne2$3^S97(c=x|$E!^lfd!7y{>tO2NXg1>sU(mY0cwZ&vJg-`P1>
zO{W9Y5z0<Dg7G*#S&-J3Hli4wmgVU*r+<2GMhr%~!ywuyi4l_cWQrPQs87b~0@r7`
zs+NM5heLjW*y1abcxZo=%e-7ID^HtjZc=b+{Y0wA1q&T8YrT2CuVF*NY|t#5egyTM
zl|B)$73rs!jmL;y7tzs9)Kg--yscL=v2Ty{VkM43RUc4#SMw=={n1Z!#x#&r5*;fr
z&l7CVY;pBjc&b&Z<m}MG?MN~+otC^vjN0DeF3if{$j_0E34nhLK4004#?x6?jS~)g
z*x4b00!yfkfi+Z4Rhv{6Y2w;tjz$|-w}%VMMr`oB%2(sE=NAkd09jcm&R`lXJ_D_%
z7_)=Z^r(ck)TENF1!jTB{gg&D=D~4YoK-O<x*8|<-7XVmx|#u=oj!W1rXD~?!%qaF
zV6#{xC@7^ns5pO}ubraWaUCSee-_jM;gX`Xax1m=c+o<qZS8yth?Zs$bJ>mOk;XuZ
zOTm?ue1#Wjm`PC5ht-q%xoZw<r7k1CM#`h)ZDU-hOI2_lS3h}OGTf&u9g&Gx@BnQi
zGND3F#+5CZYP(^{6i`Qx+fVZ9B%5Oi#F@&gjJ^d+%%*>ec$q72U&&>=xt?&3;jXey
zbGx+W66Y&hq({GHfpAu8AK<Zfgu00sH2gVV;+pFyPuNT@b|cRkGgrEAQax+ce6F_m
zO!-iT$A>EMn$*CuwU5w8WV6o$=86!YCgvbZr8`@wi_s_D$laG&olAvGYu~hNfE|$j
zj-GOSP%wW~q>?rm)Tol^vc|InR74{zi5;^k0ajkbd!{e;5BHwEdO3W3_`ALRS5GF{
zw8~SdInENYen6rw4=wvZ9F9XAXG8oB&SbM>S@D%9+1P100FtSUzjn1GUaVJOvNov|
zA%n!y?@Ob!McCiM6~JcDR-7?OY?ErX^2Jlw*;jvjKrxbzLm6`MOEK0ao5#u}%3qe*
zSW|Gym4%~mN-t|?ec>M8Fn$y03Kgs_G;)6ZSd(K4i44&RJVBt(0&e-Mrn4_F&WTTS
z%m^dVX?LW4F{TwEZQnS@C1|9I@loD+Jry-bR-G0nkcqcbCBGr}L2&!zZrXKpk<RkV
ze35@@Dv^w;2>KtK+DK$&i`p_fRk2}L(Ed{Okjuk~9qx;~CleV(-t_I8gH&qRr+Cn8
z^x`7oX4p}QS=ffthB}tb;rT8mxH-v}90-}J%|EqRqs&ARZN=7`Bp>HdGZyn1x<ayo
zMiw|<I=9eI4hpvSa~vVJwVf8{r@tj(_Thi0zuF~nJmu`};{1HIbXk!ie4x0GvSoOe
zb+-Zci`a0(;+$vihqygF9|en3PA0T4k|e5A440Xb;Ft~#5Vf?6qMrHK`ajpyd{q?G
zfx)g6NP|*FS6;WIk>|Yj*YuHRg?rl2$q~&@FGnm4E!;(M;sL>FmypoUNMXD#;WmE}
zSn~`*LpLy7IWlB40Uz*wB9Kpr7>r9wHS|`y=PG@H#A)W{g2{o{;MpHn*;MjUYPJN(
zV%c<FK<GpmZ2H(*c{<SRM0$+p+VhPBuQSrbY+0@(5K=;@YGrZY9gF&Hcewse$~p8R
zmJjCT_#8zCaYHKvj;1I^4nr_18L)q_Z%pHa7%DvRbcP71&NdgCPVfKf{(V}vCjQ~!
z=>zK`4Nni-T1lTGugqHz_y>+e_~U}$v8_r)O60jH927g%VB`d#8_R7-wo)Yo5@c_j
zS}|=<NSeRTPrxwPkWYV1O8_=cL_)I{Iol5cF}^~Z1vZ4sY;n#9KCzGK@=Sl6seSoi
zwip$}Ur~CaM*=iUeXQ?`SV#>?5o3`PQvOXOh*Lm*j6v!64BE%rPJBzWd@sBAW&g4Y
zDRn}zTC;N2V<iJ(8j5yv6!|jj72T;!exHeRxmu0z{30xOqLP6Z`V>xPoLzOyT48ps
zyu!9A#KY;9LZL%H!v;gPpOt@%hkd46j_KEcCmiKH`vYl2=rG7WetC|5n4$d6X4@RE
z5B=*64Qiq`qcbv|nWn4yG6_Ue+>VV18Tpb4khwq)eL|1&ZdmW<`0%Tv123nd$6QN&
z0@D!7s}S07CP;UCW+5G1(&F}ts#l#a=L4=^7j-^FcjBb5IPWt|xa5DVH0&$ci4X4I
zmkw6~Yn>_Z%<~XJZS8Y)>naC_AD@V2^&bDLiOxYLE0+p!zd8|g0Rl7FFe?=gwIx?R
zVLp$SHh8(4H1tj554-^AW16^Pm<GwDW8xuc6yo`_<63k4p!TO<qoN^SXF!Ga#@E^%
zi#u^+Z?!&$7p}|og%W>{V8(0_C)~qNT~#w=086k^sYN=S96Mi)NZLyF4-yHnH*g5L
zAZjRVN=xT;a}IKEpPX~q1pVa0Py5VdpA+d`F=G$rap~Z=tY~(<T&cvM6||ZNw)p*O
zlrKn|!ve+F@m3_H2GWPuD-IGA;6Wj3PI7epJ<F%(kp32I(fNOn8Y5_-CoOa&XU_^^
z1l=@j*%Ocaj<H>q?8#q@eZABduMb^+Rb5xCH9<+!T0B;{ZhdLX0K*i^R>ceCmU=ty
zpZ1euIf#0C{@h{U1DxjrK&1@gHu_iRQ>jcX>)sI<PtxeW`ga|!?iJ8?|FP@QxI}AG
zXfR#BeC?=xh^>E*WTer{AU);yzU&R21H{-m)KCNfn_#kG@_2OC4eLV~5GjKjvdw(a
zFvd>*1180wZ5PnPU_%;<pM@l{>%WG0Di4V#vA0qbC#dqPQE`yC<-C!%yFkXTR;R2^
z2nx!kKK5ITrQ-mZt&^N%LUe6vuCMbMe#nG_57Mgd$?1P4Ep-9`y#1Wih&Fu3%!-@J
zhYr@-75=;StnghnnM<ag)iJS>bp{oXN1S`t*OOh%#5khoBU_}UzGVE0%S38?j}A{L
znkpfgaN*)L<Q=Oj70C{AXvI}GnxzcOMbt%crx3?~Rl?S5FK}f$P17VoehlF80d?x^
z=`SC<1Mz>C?&>c!q&%zgM-LOyLP+EvKmG0FkS2K7^GV(`OA)t~#G}Uf@~J``q^C?c
zZp(m9bUA`q@a4I5!fBUtL`O@LhO()Ie7GbdJ=_vNv@d`*4S<m)qgT&XoJrc%>W6Su
zDM;G5T#Ao;OmmZ0hVb6Orb4_~J&htj<834%#;AWCYlKtKOOR)faa$<|a8Se^cvUjI
zgMDg~;`Fc}E@<3$@L`Ip%N4LL%3>@rv9k$D7Rw-XOw(ZN#g*zn@O;Ap?L5et0}R$I
zrtQWWo7V!I!s4iag6ER&k$&%kM2hi`z3+M6hM2b>e~a^1s1m0lGdmG5yWzaCtjJ)e
zVh4Y<q(Twq*gEE&xSsiPR9{d@%lmnkWr&XoeF2XN8$WlsTCsv4BU*};Qi`=fkUP(p
z!dp1TZ_{o;0xat9aQkBJP=92wPnnjwPC#TmCQH&^rn~Gn|FFIP%Y1h61S|6k#^8Ul
zT&(h6K!Y!5PgYg$l1?CH4?|@S;-r`1H12<bXfPg>DoKBvCe_vXsGM#dL^ega+S_z0
zCXJTDi^FJKTksk-j|qLo$%z7Gc>LNB5f9QAXs)gANn~hKZ`!*G$JE6I?iDVfV{%D)
zhilrwcI!v()PDpYy9{!g;yMYwyQr9uF0#uZ_bL^OEB!Wl6T}Eu4e%frP#^2Fn$3T@
zU~S_(@}dPFTGGp-)zYBeQ$VNCs--N)NkOs2m48zj(uY*IOOYr9<Hk{m{~oTmxDoz*
zL2H_Jq~Rsa=nyd%sY3C*UrGpuig?m85{q$5tYc@(^Qk;U;?s<HrM89ZL0kT@wYG3e
z+VUTa+Y<8-Pj*U5w1oKt7jK@m+suEPZ_p;sUi8BVo<S%a7Id8!X;hkX-ibdIRF|rg
zyz>o5Op0^FZIEnyoU6M-Sz3U9CH1PzOGB*wQD*~E+HZ#P>`<R2k#Xo0mY|q{3vZXl
zd-{0CIbgKDIfLle2pd&sAGsP@+v)f86FU;TZCMW9<yY<GM+o>~PI_$!LFIpSIVXb^
zmtuz;aLT6#%4lp=VGU*3!4l_nbT!Y#%!GPGL|ohTRqG_*^J=3AV>!+H)ADq?{W2)q
z-R>s!clyL;I-jk-_5#d?F`*mZVqTOydGbWL5jXK8IyM+cNgUv9yQ(CPD3m?5_GV+N
z#-bpuuzyQ!&T_G#4#%Tm_)ve078V4|oiO@3;I<RR$1JL*DYWkHNvyJ?=8c3bQxrq{
zJxQe6QGJH~4HJuUOKmUev_ErA@cexR)A!~E>T~>=_IHslR||w)D_oZWibyh50Bky0
z&G@_Yn!Y3SQNho!80xTgwF4pT_mz1Zx50DU-yYxpwr?^AHzB<RPicRA-7#T(I>0vJ
z3p});%1yg|Hh5KNT_o0rjvbEI)?x6Vwp;7{mxBo{husRU23sJwT<gTBB;wCzE!jok
zW=Ic&=9uR(MKFQ<{QI~gKZ1q){QKZ*KZc)9d5>V<Mjvk6w0`%QaH)HcPZqx;@k_Vf
zH9JqY4BT?y_qqiYb2WcfbpWO;+4diTYA&gavB^%YR16FOP52isJid)OE-Wpx*506g
zh-S*_yuKt_DO7ot`-Xf$)cEKbGo1>E)?ln?0A8bPR5Z<Oud|+T-H1y5c3i<J+>*TD
zytq=ZfVERDdLn^ps=7fg?I$m+G5107gCa$(Ja+`<vT}ijVX}YzdG=1?jFX%;hLj~k
zsB5+;rV#suky__OX3~m+L2VR^pX+J#1~tciEa32L(moYnj2B2J24O4)@g@^_^y)A<
zAvsz~S>&zOvmjGIQ>z^?C7c<FSg{g=6l56_&%p6U&(s=B1k7&1MTtL`BCV!Fjstvu
zvj9{pj^t#q8}5Iruqi_il?^O|q^?+bBkdSc6_dlGy|+iy6^&U5TPdnAOau<8IA7Sp
zXU$M6t@?P<<cQQ+Y;uu{(BTp>`x-3vLNGNBUVddU9tik=K`q7f4XIPZ=P%zL4e1Gu
z@^#mL|MEYE2fu%Q_#3&Yrvewa4%%~&_Ti{RJr}1ci8z0K7r4fy>8j0r;OcPKc0`}x
zvx=H(jIve2WjCj7I&ao>Ig&2&M`MC33n~h_?sAfeFQX6lexv#_z&&TkD2^bU@CNpB
z5LVB~7}YeHzdNaZlk}G5{2l!>D^C_z#4~%;E@o&>8fOn2fPM`5QCt!(%Nf8EH+xp+
zK}`uYYI1*pKw4g^dWXZ6gzg6q6Jjw$s7APp9C0e+umNeC6DY^1gkx+;V~ETitfpf`
zhT&tHl6H|zi*e>2QVl!o-bCzc&O**kS4<y5#>6zqf!tw{g>W|qZ5bG^;<q|*xj5<K
zTI^ThJYTq)-_6Wi0@4)@fEMfci<{9f5&(UjGF^Xael(-YxHh-HJR;V$C|B&B`X(P8
zYKqJ6v&p-R4(8=azoSU@lE!`HEEGX0Vv<DJt6}F15=2}@X78WsHVw&x-HV^VRceM=
zVW%JY8G`~wzDkwV!f=`3VOF4(KFO{$9o*sAYk7*UVrz8Gl6PL#jjZAjQ0!riAPcfR
zJ;Z<dB0pVCvqk8D-UPWa;Q4V`cH-A(;<J>!HCMB8R5gm`{$W?U4lI6wwe~YmdyIXH
zW;l0NdmsUb@|s6oi1WpoWvB=Dhy2peURuxP>+u6U>x5MAiCv}+Pu{ylt1#l>{d`JW
zWr_7U6*c^>K@Zx((6_*K-UnagzE$;ALv(+S&U?3>67PXJbuP$!vD5&47vsU8yx(!q
zkTR|Fa>lj0Sl+=wLA>Cc<Sj0xtKS9?NF|y1PR1afIY$&3w!83pHPzCFQ*f;yfZ_iC
z#yxp(pZ@UO!R9Tdxhwl#ttPbgg<?zzFmY9n_pl&bwskL%JjnI*1l~D8h>$=PAq0P^
zib`>w5D!=sCELpvxo??`;L1ETaSexLF<X_ZYI-GQSl%zS&?X5l<+u{JG#8BF+Lwl(
zaI#o&a%)uPN*0h73QW0Ns6^y4?+ru2_Z>3ds;YBuVPWhHSZHBWgB3wI)`efNTH>OJ
zw>n-i(9^3!Pg<t;Wl|w9D24!@w^)CAEJ}GHQ^^05oC{<q;)(eW?sKR9^<NQ1zYK#W
z>~(n@vo)pdq)})FpvX~8T`or@ybH*Kvn%%v=uY>8!i)mwM?Jc)fX?n&apeB%zcxKg
zy<^0s8TC*^hq>@tgLR?Bx+ul~SmNyxtm7zKXzd=ULo4?DPa!ash^uFBkgb2@w!&^S
z&$oDX##~3DIM;2b6sLv17!_*Ic`*R1v$;Jv++`8zIF|T(8iHoi*Jib0O`N}tWjQER
zEI|q4g8tOQDlG6BH-!mOhmFA9&~O+E-$%wW%uL06l!Q0QDQq#V3fz}v7Um&SB%UXh
z36yU9mwU)eOgKab7T617ep!F@uJteBJKGOG?YKt|d3`oN`{{lEERAq+&7;2#n*F>)
zRjAF+{_DSXS|Xv+f4I(s+QqIhy}(q_`j^3A^AHc>5$dDOLp+E_sLwVI@gN?d^`LQx
z2jK|iQL}jXvym&Fa+xcswVix-x%_|wQkvnI*ddx3ax;w|_}w>0;LU#yJ<p3khzwmq
zmB7P@jg>->RsoJtYBCLlMD%)5od<qyQ=Yw^OJ5QUx4@-<gJdDc1jnRX&=kL9ky^p`
z^Rcq?5TuEHkan=E6PUJ>_C-sUu~jns41Yoz<D+NYS`rvY!n!{VTEg+I%I&~5a6F<G
z80*p92De<zia)N{S0{h#gSp}qGgjqA<3uRqHZCGyR)Y4r30LLoy0D;5vRuJF&lTJ>
zaAKO#et2{rVUU_B!E&_7#r&Ww$7NU;n%k8cau5!pdqJ4uiROY;{D}3MKEvT5Ix069
z|MXclg=lqrNOQPB82#0d5yaV|7pz+#lk%rJNiT^}3zOp#X)S-tP3HPrv}_G@fFL7(
znm}7yAk*dOvSe_WSGCGBt!x5n65GLp#2QY1Nk7(C`w3melysC@aD&Z1y7%NTW3-dN
z+ixaz8GVzfhjW>cr%eqGU;g{i@ZjrbulAqA2%>IMiMoWP0XB)3Us*`P_S?gUpZ=<2
zQV{dY#xJ|3fA@dQ?+-coTGHhfQ?upJ4IG1GDX7T8lFDIm4^(y+u~l9?@};HEQR~SE
z8K&=wv6k=dTeSjCE?TglDH9e1&9TRsbF5f?cNt0H=hd|FX>v|7?J~Deqo#Q+G)$O<
zS}BFbzB8W{AeC=m+R$ubPN1sPDCBse)#k;!T9!n%WlDdn8{U^8o2N(-@G8u^8N$Fs
zp3t&+Gfz~~Y>=X$>>%9>d3UPrSdmdjB%mSK0<ZR62j|%pr_AW^EVd|i3G)(&yWV(|
zdh6|{(E(FBM=HWp({XNIeO&m`=4T7qxUc}HoV+f+5mOdeEeqb1DdETURoj5Kf7@-@
zZKPv>m2-bL!Z01}c@&EzIp4enzBYCyDC=iY8ee!QSz?~naUREjZ_!8L3&-FVi;VsL
z;nyp*^Jo~a8udP;H%z|ky`c~6&#bDXZL@ezgd(i^iusy(7+RRRHUR#k3jO$x6be+P
zH>4qHq1(KMA?lx;JE$DN@K0uMR!9XwNVr7{3bcR90FrSZl5GJM<w6B|DVRg16|Ns%
zAFlZOqVaO=D}I)1BsvDjU4SZwz|bV9-;UjxhccZP)4Ivdj;opOR+K~9r7F0?fI@Z;
z&?o5&J|i8U+^V8?B^2E2%H=GahVV&GFiOwVPhNPDDr6!ojN`@`k(WY_Fc1cn9F<xZ
zEa-nRlDVb^8y@s&bQM_3GDH9)C@YiJy+A5@U0O_rNG#o*kO-VFhInC@{_~(q|9Oar
zP_e`?<~d^^*TU=Fs;yNhS3Vy+7oyF<Y9s5@7<S>~1Oya_H=uV@Eu#~~jmgD%7$fII
z3Vue;n%y;JOM(IZ<IUG^hX-%>|FC!T60&~+$tP(K|9kfGi~ZNh+rzy??<RDY?~wk(
z|Gs?vqVYayJ2ef?x=$U451r2Q&=+op$C@)eykJMdlZ11?^^!5};A+UA{w-`FVyy1Y
z@wd3A3$mLW>+{Aj+#lZ_e@jy%Ps{%GEw~#(#<d%PQ=epR*wi2d3UM6r&u#I-)3kp`
zghDnwrNeu9cD|czv23;_*GY2OU0X1Xa(F)nV&DFZUU_h~1+RRk<-RI}@FdADv%>nI
zAGOI3LM!A?n{fBb=2|Z3jL8p~5cxZt=JhN3kW7^8rACOfO%7_4?96>O?U_ScM<8#J
z;ZXBh`J>Z4jW?Pg?U0YJ*WAoZ=?Z@qPgoz~b0p_){{Pwg*WE_4Y+V%l-F%8z%HAz8
z7lYI#vo7k&T&<LpnX1yQMP*fYYn90$8Iq!sWUv{el&Xud|M&m~3>Y{*fMLT14h;Am
z{NHb~Ucj&5`HjoG1cORtR(7vmXLs+tD#f_Wn3plf9M^ALcpp`D1An)^=<t7?4wc}x
zz(NkQh2AGO7c!PeAs1}&DS}doyHVJLl#@0G)a6u^97e5oaTK->ByU3+FQ)yjC=n|C
zZX<4x4G5SQo6A5MHrzz(GS6Gd=a*k>4Zhek|MYsjtz>I!v;X<l`e#qSynNEX-1@TH
zpsJ0TpJoKx-q?D6&<RSiycK`)T8MC6ZLPwV^-22EO7FhD?!D?~C)wBSH$NV19A^iH
z*w3E!cMm>0csu#ix4Y)|Xg2u^erI2Q*-Y;?`kUY0^+qpee`%X*qrcqr?(odFvp;_~
zEDnCiv%ieKy!qqn!K61jn<d}9D-K6z!vWeI4S)R8=F7Le?}qb(A0~h6{qeWM!`-hZ
z{f#eg`mesd`}3d9Zu;55XMY*JEc%;o3Tpe+*|0x8%1(x}fq8b^AAPyee{Fwn^|rpA
z_P1VK|9SJ<%jCO1VjQF1<`)^-{qvv9?;rNJj(#{=KRNHOpX|LwKc8T1N9X;!qaWYg
z9-Z$zIr-Cib3DG@dG&vTVF11P>+8cGzun!Np8sWZcJ}7WAOAS$Tusbr`$exkzd87B
z_|0eMN%HP0|6v?|G5h1&jf1_rx3`_|UJu5Hr&r%iPi9}vU!CrpzT8`H7l(iSrgIu6
zM;m|q;+r?|pW<)Rt-l`qF>X)iPY)*h@r$e7aqsDPy;E$C&OU#O_j|+7(s!qS{^NIF
zzkGT8-5)#sA3huIz1+O~bNlm+>zmDk^pAhNEsED~p8R=lWB$XN;rev6G2Q*~?3-8f
zZ{qCR>6fFy%e&hbo8Nr-G<z|={(3$B)8Y88_~Gv8$(z}H_Uf;PfBp6^R|l_?-e~jn
z_0`Mc<HO6>v&nzu)$yNa)3;m0t>L@fKNr(4e;DmO{ma&HeAxf)`1-}(ckf;d$LZa{
z<nz1P=Udl@v(Imy{_&e{^KX89dG)4q@b<Fv^4oXo=ewT|MsIHRzd64C>*WuZ-yH9B
zwR$$hW=d_OP*rSML{rX5L`$3q;<1`^VCBZKmSE4Ph7*5J$nY(j1)D?;=BCr_2vz}j
zKmZV-^l*~pA<IzifpuwFa31<Nu$p{vge+UVlu!EDHX$*e*-UG3`yM*yy#7GDqdKi&
zX>^U~U+k_8AXT*BY|4%}W)4(uoy<oxY(=ln3R`c*^WxE}XdO**A{W=3raj`ph1!&J
zNh>-erQ?4ndsnz!yiV?`hPaK46uo=U+TBwaX(^wCj|;3T*M>pXi0v9ftOE^Mx<f;l
z5x7Kyy;HQ5S<E6eOT(C|>#12~*3a4PGRr1*Mj2uj+QycRk}+C%(#ypGdo|DC_1xDF
z;Kepx%mc{xGA%xSEUg06pWD3%8+H{b$OuA@3k-kkR>vY3cibZ#nmXUGM(@O1G2j4V
zt$tGHE;plcsrN^C!onBF>SB+{Zy)P<5xWn@bnM3oHLZ`=br+grH6uMjhx!Ci5)8Fj
zDl}<7TGvV=vI^gFsDYZ5`Gie~4%qE&?v<ViYsOQOQ0WOPIOtB=*y>13Lq{I*0uHoC
zWg~xd7^T9+;jv_%gyU6+4-L>954n(IPh7&=sWdlp0%O<|OD|#|Eolz2<jTk>rftSw
zX<^FyHkyT^Ay>;!uX0Xfo3>f(=$x#8I&m^wSTl0*1z&R#B)q!j#e`n;VooTiJxGH`
z)a3>Y7uk#<eM_&{40c<Xx6~xQHbedn$(4VLtZW;JKnyt^?QBQ8n&mf{-TBR|ojDGJ
z(ww&9>{y;HeO5ECUvbm~CuXmiU$5uA2Cg2WFdW7AIHaaAEV(pLj<IQ$nC2v(%!d@-
zH7gbQ5}kdFd=Wz_lcqPS7u(Sh*U>>~Bih~=z)K20V00=_t8)X%>XhPvY?(OcZSsGx
zY?lPuaP8SQ#Y3JY%QS)tL%STs+YIl#K)Rq@k|8tFD0XeNSDJT$3+0F<?{h@bl+1zK
zxLfClx&`+Zn-LtymZX8<v=U#FSw-4P1V@DqPYNms+iVd8l_O)?LiQ;Ju{IlMvl;C!
zq1rWBP+KU+tRoXo-JO|iCTDu_j|hJX$MojwiqOxq8T|oN9DH$rc;xKLe5WFJ-+HXj
zCH&F6lGpKGlm3zeG9E>%vODF{D&3|Y#&i7$e7?L;$Xy&$-to=SP07a|57-v~m>+QM
zU_+rElO{UjI)W8734v{7kJMSxqp6pojQ<+#3<w)<%;&k;8(Vf^5U-_GJyC!Ds^g<Q
z@Bsin(v^Tmw8BT2tZkegIZ=dmEOYS18<$ago0mPfQfklE6PC%@nM@Ew`$iPh3wQZ}
z{d>gA9vkVHBg2Z!P@GgTUvwg;<7+zZB1MEL^(Q#EC`8%oVInXrY<V3-AKqF2^|;*g
zSFiWmkxS{6)~)9=TJt)`J^_C%uxt)R667R%=N$U4*J;v+D?u(SqyRg~1;FAgO$G#@
z&jxJNB-xc9=@nY#DOJ02?jx&IU%Y7p3HfOM`|S(DNdEp0-q$Wp&R+eDC%$i8ob8{U
zbm&R!%`Vkf<*2hXa1SItK$)X*t_xsjEszChTY-V;>Ce(&Nd};&z`%c`LUEq}+w=@Y
zDp`1V*4Y|DnHx(F@)dE~NEUf;yipAMuCu=SyuA$mVtG03uo4qD&73Od<QiU!j8ip`
zvYa6(B7THy8I>jpdxpN)P$p(X>c}ab-Xo6HXXl1g@l+-ebkL2IPWS*E$*XC+?MY;%
zV=NKWM?VMUgAYs1K=yx`7lC+`h>WoEZ=gD<Y{6k#-l=-WD2fCS;!mE27rRh%c|)<(
zohn2c*?cymNeQXhf_3QYgbuk#&)hVQ=v75Y%C5!?L4Y$&#OPP2uaxR}@UFCqMyB)Q
z3&NCn)5?Skz%Wfdy)^nJp{L>3N8wgJ$ZJ=Vt0<0<bP=odJvM)j@R@3kvmH)Xr`Npm
z1sqU{w+9U+QzQGCe<eceD`XpF1Idi%bF`ufw+hdmM=S02Yg#7hZNZhCByXOsIuE@W
z;+E^ApI4z@T9}o4`WutaKkT#w5>yBiD|+;=cvvzP<YGm-zaq|0D+tm6yxbLg$cA}k
zNm1nejLf9=Rg8a&i*QNYpm}I=Jq4zRB&u@hWv*RsNS3<*LNzx!X2>1N1tBu!d!S3N
zO6fP|3kQ3wD^f0O?Z`oR!3aI45E3fkU~OFw>$qQ_GI6#rO|PYB0^d}Feb9_vB7QE#
zDgj@-^7GXA;J)^uXp7`qUKUTG@(2=P+ry!^Nr9SWgv)<ksvA<G!#PY_@t|RLqo5QE
zZ1ldFsSyoJ{nAI#&X1Vrz4Yc}BCG+@PG*ShbefI(*#uT09Fs(sM;WXi`Q;4a(KIm&
z=k(PvGkiZzPx6wYH8OM|Vq}b-FMc5=OB-Qe&h9uYtas<P$3>G^sNpW#lAraar^0p<
z-0XTaA(wx#Di0mNeFpgN=DdLQC}Uho{=wsrEG{mLf(Hl##h*b7wh_#Qke5tyKD|oR
zz!r33nww2Zq5RHsOkqWqzgwo2UoII{LqMm*_UE1P^d%##2{TeTZRam<&h|Td``@0N
zwz-(a8iAJpB*yfsL-X0u>3m-Q!yvtB(nS*FzVd%Z^St$y83YnHpSNIkX?^9s|J=IE
z)YQT@O**=-N)pO>&VkV+4EM6Kg|Z><N>-{DKLQ&GCW`WSyo$UIpKpA}hF#ArI!bKG
z(pMy+8tGXOQa6~>TV;f=R|?Q#3oBY;rLEiZpsW~$@KX-_PtCiE17>mOFr-+$@E?cL
z=Qn>*Zw3l`x5=-!)MQz7EpGl@g@6>CjeZE$Fjb|liwwbdGL7?bOvR;mvRNS7_RDFO
z<VWTukUvk)*oN&&KM7|{WL+5|G%PagSKFo{S0p4NWhWsZHmXxth)74-2~FuRlzjA-
z>I}cXpOkCnYDYlW&Ye`ffC{-#oSKaDW{7{FK74Ut&SaJ+Nh|p7=-}|M^WDkWH|^7%
z-F;U+Q(M+(BwCuVbr}&WF=ofyHT0xbL<9*v5!@-S+#l6JWvM2;$?|#O&L}D+r3AvF
zGu*H^p;R<@f3GuJA${TF){!KwPzY!FeOFz187`q2sf!f0W%F<-UrK7U+0cZ6ro4Z_
zOI$~UBSF2}?@djk*9e<fl@6~~(hFdciQEFhfj2CW52}caX7N(2_!o|PQG@dRMegdJ
zC&y+oPk_2+!^D^?H6gPesO7B@T`+r1%KQv2wWh~S(s3)briPd!N&m3b+*of}evlcK
zM|KSOK0uGLV--cLCl(nIEQ{1m+be%mYp(RNYgNr7+*{WsUP`<-9)WICvP_lVp<3cx
zTF~6YdlNEdn;+1lVrV}oYg6~as6>aIA~A`~x%yC(Y!u2rFGvUz%St6eOXoK2UFZ4R
za`<>mFV%hPpS5O?WxQZR6J(Ej*GNWb%fHdggfrmok-MvCv9n4N$KmG<pMQU3CrckG
z&vu=-&_H)A7s9gV#e&JxDW_1lST4k1zm-kCg6nd?u22D#`Iv%nG+Ioh?TnH-5jvP>
zROFMno5F4LD>;e-k+%!30(|GnPjX(YlJ#W=E7D=>m$yzv03_OV?n12$Zv)#nWT?qe
zJ^2J%FPM`?v?)o`4*Wn}<UN0~2k4O>u-hnLw`4h5V6ls_sg_r`$H7atAILyCRbV+v
zGzpL3Ts4l1TRB1PaesG&UOPU9S86Dn9nrDLm|d2&(l4;o+Y#~57CbuX_-4CyzH|0!
z|Ge|!Z0C6Q^)}nxYZMn*E9SisQgGp%&`r5rLk%RuUbmxp&nQ&$m@9u>)I4c=yQUBi
z+f*y77VQ0P4%4l19M~+Kc)deJ#J2Lw7O8{zeD;T%C-w=R58(>_gvb*Sa#gpZpY6{m
zx`L}WLLy`I+n;`lWKU1i%MPvRFTX_p?mhjx-^mNplnTB-;FX_$mRE$M#V_bBGri4V
zcJW^P`XMdGvC+`XiM)Seo|Q)#=m>%Q9TD>c%H6!XQhJ#X;8u*_)0gbd-kr+aLiDR%
zC+r6J<(JhJ+YS+jYxLE@`Rg|?c&lyG5QJeh{X3=!BHeD8e#weTxKO^DVCh#WSG&?d
zDmC=&_mT4o+T>0@(zyQHMT<^W*a|Z$p3Zv`)T||RiHCX^t_y#nH)J{hjruOVFcO3k
zt5FO}B_HV+p>J%<58j1t14fbMAKS}Wf_=<#rEOWiK<Pjv#X$FOM4WiLjDododtH<L
z!uxq8*w8Cg`%`wG>`O}?%eL)SZOP6iQ%8)#Y;JEyf`8&@4)<e;k=Twl*R{1r(Ra>P
zlzP@Bhe~gLYnXo&C;gLNe(~MW_Y!iidX4}e1#t+@^*6|y|874@2K{8Vs-<KkC1Om-
z)i{y#V4%%}YSgJy28eI~_yFcdc48|UBbl2^OT_slt)~4XWySbnH)QPFRBUz<l{Aj1
zlrG}b`do{?UbSF4Pr^3rJR=sHCbLt%v%pDrPmYcb&O3ic`|bA5tNmvy9uv8jJ$X%-
zF<e|2z7{sM5<UChNB_HjH|z87-$&nnPh|_o-dl!#jT{26m_GzwTCu0CVsTMr^=&qp
zP+|Z%Zai*NxePLiQpVCxH<y(0*-Aw}@R4Wuj}fPyN52&oc=G1_^v${V_+{ouc8&VO
zVHtC>OiX_%Fk8aKJm_K$)DiU;TLz&RLN4W%CB7>6+=^aq^Turk>)PbvB}Ee*kN)ME
zQMb$=tIL;rJQ*?ZneN6{mTSaDSo_09^Rq8Do9o`wL6il2`SG10?>NRsVkeTx1%*<Q
zpVrK1E;zQWr)Y`u(K*UeeQ*+a(jY$qK`cg~a@c<mM6+Lh;d83;pkkv&<w+GvS|5B~
zEr?$a;{7U*5jU^q<V(3YbMQsp{deZs`u%;WN$5=|STD~MJrgh{Cuc9EQkJdAwf*e3
zKgm`++kg4U2v<c59I0si;yrK4=-F@AcsKvnYhoq(If7k$wfI@rO8<y|UUfHHKgT~`
zt=4~QWzJwb{Oq^(Lsd-TpGVn0kFtLrW&dLxWjqjPLe@dJr#{WWCMO#_Ehl6U0TTfB
zCDD>O7?Ag0*l-+11=M<uYSz7~c&EX+5J@2csR*9hH4ML(POn&VqUy$Kb>X1;A~UlI
z_#5YUA=4E(mnel=z^DZC$xsWG5JspqX={JQY&!3|T1#x>vBLl=;X(l<4Ik3nXf^qu
z5`{QcCJ9wMx9%gnD%Ja5QV2}JGk9urHwlU<YFs2ku%H@JY)uT94)FxAP<YFFjHwWl
z1wGQ%Y;X?<%|Yq~aYPxVPQZggx#s#N+m*YI#Z~&){DIm~sECTH9}FsBF4`U-RM>w$
zp+!Hi6buaMDok=j@DPQI*Sak!cupVi+hUAgMmNM?^a6}?4u*{p7W6@zk-SEIo6b?Y
z=+cNm-Fj&n{8B;caTH9_14dJHP@t#NY?M&d34lQeeGmwYdML@z*3eH;EBo)tt?1iG
z_>-FqU?uR4e5MFJAU)To2en1c?DBu`;$INd*7s|V@GF)V>dwBPZF4D?bjolGXxua=
zIPPM(Wb$xvCSerlvN<mnCsg{Ek7YuoaNy&|h6x`ybT6TA#$E-9(*xhBIN-r6(jz;D
z_UVZo&lz8S=q0Z|J;#4Xysypj(gSD8Ht7-l<)Sg^A+=(=9x>mvJh{dJno55u!a(Wi
z6I*d63+{R^^PF6#gSmb}e+{_Kd1+8*KBA_1fiAu&bewOB5R8&;zoJxGx=(*DJm4XA
z#?k%*@jp)ur@o>hKY|2$ymQ`eMD0JC|Ge5gHHT}j)rL#z=#S^;ybr!x2z%yE4f9?(
zKHMv)NIPgu5VV-hx9MGJDbj!7COz*t+-zm|EG?F}2%dV5IRA0aAID2$*jYO8Yt2gz
z#ICqh8s=0n9P5Vuq(U@+SPa~ue*12gz5FNmp?icM3D%;{4L&ByPH-<4*~^Hl_PmF|
zh-g=JMf%W1N#A_Gi&7vXz+G@F@YxgRu=uVP)7|;}Z8(6aVV2bx$&7!_f98+~xMY>+
zt4V^RI_Bq}x4t6%2y)zWK9b(1M%0Pqlbq`2voJg!0-w|bK#wIW<Pi^tDKf5Z%;`6w
zwXlH`0#->$U5M3?hZIX2&k<g?mX$0`W`hf8Q)i$zAzaF>04GY3@7O9fKCCd0+=pz<
z1V)5Q1LB!C2Lx-JC1rnyX6;|f&SwsY6eZ2&RFxJQk$s#&wZrM;jM9X&FU0IMbnMtY
zOxX847`XIic{BPN!rN6YsVZSCR3oD5+EJI&A1a#dDze3p5R1eiABb;>g_c)*D~e}y
z0UR9f;qe|9TjahNjKPNtR#n+9m52xArF3h~5*k+h0%vpih~|Itui)tB4*qd><PVm`
zR8(g70^`3*02Kk9z*r*)v|e94Pptq17dC8JM{9$%mf<9?p(IB|#8zG54i~0LD=^6n
zhc*HPM-Wns;7}$@5t<u}0gn0Ol%B~QG}k+l>WLC6ingJ7Lyo|q=?QAxjG*U%cuy%&
z=Tcpb97K@a8ESuvvP-JRlUSjUawiy{)ASko1{c49WCt$9;83>W8Fjhr#3h%|m=%js
zcA+$i+_wy{$Wprc@#9m#n$ILvJ7^7G#vo93+-vPZ#Ew?#37|?+3q+^_tW(HTf}Z&>
zeg33yVFH^0W~FCRKPu+&j?e~YX)==C!5>#m1X8rQw_1N#s1GbY<EG(8bd{2ZZ>T>X
zl9#a@2C2-I!w4tYBsFBNCDPBl+(%91(2|p0sA1K9DX1{@(0c$;K(4<}XyKd!7QD=?
zZRF{K%>1}I4sWG6Usn)bO3@SEt!_k84$>*rnKY{L^ezStGV!96)r?zB$YD{N8xdoT
z`y|?Fr{h6&?no(rDwCTSN|~3i5rAJWFo`gC)elUNhJrMYbjCc%rB0L*V$=e|Vzf=Z
zDUXJd6cGDb>H;mi<t$Fb$C7*Btd^B*;H?WeMW*Rc3S4}m)RPF+<t<__2^>N{2x0*g
zx9L|e8)h>d>r5f5lqw~V#GLbFxR6&glj!}atE|khl|1%;Mj0#xKF+1|g1I5wZe%D^
zHz>!_77d`05+HgY;l~ygOCjfp81@_zC`I$8fJMy-=F2~9V9*-g`1wDI&h4ZoFvzZF
z?-E^GvY92f-}b_%$Tlt}!-|^Ro)~ULzmh)Tnj~xnZ>~KriG3)hheU($hcEsL3ix*B
zJ8%eR><cD;g^w&VAK1kM1&JWzr>*F*klIyvlBHWs7mz-b3ifKCa8PE@E^V3eFl&5x
z=j6S#`o&3bsx_1bEEru`;ZrGxI&(<X3p_Er#?_ave54BE2AsK8Vh25B!Hbw?UdEY2
z$e^U;49jiP`aS7zIaKd@py$}pA|WR<#WkEQj!yJ{y8zIW@jO`QzC!-ptdyWfT!41m
z!QMV-fn(nqPN;c6Qu<oAly2UQT2Z%TQSK7FIkot0n@p&TreFAV8-|&iiPlEvrohII
z?Q;QIL>yi0Tv6&Rwm%1_<U^}skFuiQ`m!T2iMCb7jZT98tA%%Wn1Ghhw??!(pBDL)
zv}nwK>e23L>@hvg-e~G5Va@3Jg_VrrxbtfN_`Getz*<7_mV@($>NUEO@}S6{z2f?W
z8ua~+mg&ygb~#5@7s4o=D0Z+|6Ty)0t{j!@#nF68SHOgLr&eLSyQeNmk7an4W0V&e
z32T^JXoF#%Ph4FXi*I6|M$DQIXyS7>HNN|QB}TB#Y_(r&-}dsItYgozk{J*p7_gUP
z&%>U~62o}(+*8oh8%@rh5rBhPi6IGB8nms@BQ9K50D8Qlo8-uIHC%EPrOk94rpa{d
zfq2X(VW+koBGK+J`*ny!v|$vQh>$DjZ)F$r2V+XG9uo|x%+{np{lZTF-QrGfddL}n
zf*(U6v)g=K()2k8Zvj;%FQLj*z7$rYu6jr3_;q%5tq?LK-+b_7Uz-*>VG9+_N=2q@
zh@-~o_rSS?MGogAh-yTo+^-kjHd13^F3zMz!Zt<i`<Y%;|1BD3D5L-=Yc_ti|9IFG
z5P<-OStKT$un_$J<G=qe%uqzgB+n~<>|t<xPw)pV7X%)y-hs-6eTvX80`QelcBT39
zQ|XlH`nb3x;)k`yA1)>X>V;?U06L=)7X<ipnzAfuHWXDwW_vUb=<#FfIOPV=&fGcW
zfa^C04L3L|_PIB>?nVmxby0rOO`J9lxw2qDU>eRE%-(;Ur*o+OrL)#bO1LF|Mssrl
z&v7m@l5?${jr(a8G`8UhMsXVFQXPpt)~Fx_BjwKfY|)|O8rXKO*I;9KCn(>=DK1oB
zk3QSdPh!2Nr09~-fpWITSHm=R%NxDk;T^Wv6RF3NL<PO%(F9}GJbrv;ltXKilzMwO
zS`5_|guHv5QMM+*vl@{LJ8Fu55d1q^ozL`;%PtXliQSO$$V$!M>Kbz{7KTTrMyxV(
zWz$hMkkjhX>T1vhy%1f&QZ_L9d4pZ5g;w~nH9N`HvDIXshG|e?IJ^ZYIL8!lVnAYg
zy%XL9!xtAEgH;{VX?^<2<yrJ`nGf-Ja@EZ8R=ok29Bjt46<Mbtq$>q~Mp`XwU$6}D
zh66F{IA_t<5R|{eJhdX@lz`Mn;Tzj(NorpxEn-NxYF^;@Uu%BUelTGj5#E?bSB@Ei
zy7ZS;Cxh+Fo)M1MNbazQB&9jRL~rW-bZ<bbK_Hl?fb$3%+Wm&j08@jcznd()01=!s
zC02YP@m~}wkJbv56C#&?fm~vEwT1pHuxBx%1He!b0HZaFe`BlZaF_R9koe4C8sa0J
z%z+gl`K2#)eu<C=WPh+V@g@t?X0??0*s_srJIP#O4sR}w*w8&4yWFAzyI0JcPALU&
ztx@OMcw4`BZlrxunPd`RbMc43M7LFj{z6@{5x~EvBi~X+d_X6Eo+Ee=Z)LVAv5A2m
z6VjDi+b=zHc$?wF?(}Pv&OSat8A6PzW>B^m)nW?sVaR6T6)9)KI@zZ@x1L(pWw1V8
z2;(fvs(%Nje@!U01-p6U%OT_l8Wf+Ve{`b+E+A~ucj-)JfO^Te;w^ZhYJSfzbJ@GI
zlX>srvoX!@4xti%W`o$3#kwsM=q+>uFzCAC6wI_xTuL)_7uMV=h_7(nU}RqpP!`nb
z%Vukl`4W|GIJ`mGP&06R+u8By2y-p>qny(Ez0GTyB`dhERacX#QB!>fx2mUCtip6;
z8CqXx0m&lJtTn$+{Mvra%Ti~3p~H31NQY*d+eB1}CBs>Na_47?*)s3eyUZ~>VHWG%
zgmBwu@i0w_Sxn!&nkQ6nL2TTQD3jfsYYF`mtx*{fUzn7R)t#DxB?_XBg|-%6EixQa
z$vCBgd<~M>mNCpK9?yE<70J-%h!tt`r5TGy86p-wfW~Q_72wDcgl-xRTy<gv%P9$h
zxAL)~Y}gHd9^hOGoFCKZt28$}XL6mvF@nwCo3o{qx=D?SRPUA$S~{m46W3Df9;<K{
zDhyFnMs-BOmmPkn!w&`JT5*^rS5o?rtaEfiH=N_oj*0@z(2Yx~eL{6`?>!f-IOb1h
z7)}5fTVjSRcI<g961>%VRX~foWwsgWA-G4~^N2-%jqcsOo%5X+JMDc=7_X|5!_FtA
z8xC`_&~z4yj!R1)w<&;e;E~z39CD>EA)Yug&vWjjR6;P_WK^huRv5SPl*pRNqP*y8
z5}^?diS;%~y{RERF31{8%=CjCdLC{-sgDFF%x{&~)9N0~aK#jE%g>SwA*^CixM1gq
zOCBwM790&w5~|-bWImj$h2=wJ?`X}{yB6CTO!*fgk-K*%e4&XQZ$?Au(%gVi0=Rcd
zs&;+Q($077=xnboBJ$2(qE@sspXSrV+<TShP^}o&79%q1Sggn|O4~3UdxNG=L2a`W
zMIiuQJsO%ORSdj0ttFKTdWVWaFTFz*Ebz*I0m?LbCI()vL!<SK3&JQO=IvJz9=dyh
z0rvCG#3+45N6bJzBO$!!+;c5iwgK{z`Z_a#c}pVClfuQ~p&`w|x(W08Ru2zX{k?)?
z`<4vx`Y{{vDxQls*~SV7#}i<s+@rJ*0ikWX?3zd69qlc@r0N4zRMU>`?beb>_N``r
zl1wDP?XSaTf6TOcvr&6%y0UGWrp9U`Gp`sQ@=-XZ+{SqidNs@$?%0UJ?Pv?xI<{d>
zV?oT2X^7M>js_nk?>bKAG_S2}uCF7MzL)1S*s3P{B<$XUp1!3ESjx7HxW15gl`FM7
z6WQx@IHFkHnVw}<BdU-Cq()Qq5;r)10z!=tV5jR6>+3i*lo2Zz_C*(7CP{c|uA;?0
z@?uW*cDFSRfmU|ieS3}eQtz%_yT$-D7~dt(${!X?hjN-@z)(caASs`JGaWu#(UpVM
zQXbd_aGD|f!5^f<X5qJ=KH1u|PpnimD`n}mug})29%5GRJp|L|UU&d)8!0(|L21TG
z?XB4v{n=11_`XaF7Q}luj%|~h4|q!i7VoVm7W2u0IKq9J6)em_NI=v^t@fZ2^m1qx
zrN9|@NGMs_+@JAQkeEXoP)KIOvO{h%DHL+wI#vx&zFBmBXX6D!dy@iS`OYjy*<Q;R
zhcKLI{c0Ol&1!pF;ljBH;1W=OGRE$56urraeG3+R4(4D`a14<QQcE3=8keCVjq+yU
zeDl<OhV>y`Ffxy^XVx>L@~$KhEmE$%+6@PU{`uiG)iZtX5nKkUU9%yLXzX{9eZ=EO
zu<4Ai%zO<qHn$TzlvqWjHn@7<7VE1@(X>JE!R(R{EXe(5OO35flKxwN<o5hfz@#9D
zH~E>Gvv)I5^gRDn{~CoQ8Nx1vjY_80FE`64F<e?&Ke@29IK0tk{3u|SW1Z;Y+aZ``
ziOC~0w{R4{NZsPdT=;ZTtWb%}mtXI~#*bolVbizmdyZ5nLvJanMeX5UDRDAG%C_R7
z_U<cEdRlw|ULdaj5_uti@cD2)%*j8_ZNr&Y`K_UqII)`E1M|W+u&x$PqoGQiVbHZ5
z$R$eHPB`4kZc-2vn-f^{p$aEVCt*8rG&08ltAI1)PR_?ziH-I35efeQk23!>T~R29
zxJ01@<)Tnt_o>^(JvewA5y_(y)`9~VF>39tQh=7#TLt`<UJ^ThaM`@?YskW_0<##!
zQic(=;27d^lrB)@^`LUY3*~s&`5;$8^tt`SLHiW_{2s;wKvUP%j(dclO;_IY_DWqt
zR(O*j@J08)_%fYNHHJx9!CG77`#S0GVG%#I#(W5G3t8HS@~Ve&C~DQnsMiWeXQ9oE
zdT});o0eb8I$B<Tx`DjnpL(UKJMX1F<%VpCc`+v^>RxJijo5?q{6lMAQN*CqO27jW
z!7HU;HG8hus5K=8Z<cxE>Xlp9oeMb66wcXfz+rxsvDEamBeyzyt3$Vf2qhS?y$<U*
zFhu5c1^Ci`3quW=aU2`@z#M><*!UE*8GHy7qQGgzYn2LrlAtjPNX;}Rl>%xobLOj3
z`mw0BT81r7vN3@)(x7X&Cal}L2!WEL`Hil9XSyP7Oz7_#KNjUAOW;^$3H0&fV<Q@F
z6S?tQPE7KYM(?C7D$eK2hn&C7$B$JG!gcr&wAdt7EFW9BwTClPiky>=X`B)YkW?JC
zmUYszxNwtyMjz^jiKgZPqE4QMw1*I}haBhR@8HKj_DsL1IMk~*=hhP~DP$<dugFC2
z#O_}G!-ay21>W#kN0uxk{@jkv8ypo`On{U5qeK?TyN!VJDN9PMIAN$&(9*ho(zf9r
zf7oblJo&u2#j$i*SxUj#NMEHYYm0(PAfSjD_`?l<!2b{u&5q?UFnwAQ6snYEw$o6S
z6Bi^tYLMb2E}Q~dJu~Z_!8Ey?bqueNl3)R9CI`j|d4u8>jMt+Hk)GwzncdSq%T}MY
z-c{sklH;c7kV62S3}JNJC&A&=$;KU5`qtkW%*$iu<uUQ{7|RrEv#~TA<8+7(r;z$%
zy*c84Gzww&JQA;V1|sRakq;1fK~*t5zQRk3NAGNc?$}xYFV5!UWruLbbQTh2XJSZ<
zX8&?NBLwOBIH1o76e_X*A0CkK`%z)Hk|84N0UJCSmJ^%EKm%Rt@&g^@vNR`mfcEyU
z%!=}rtGufoJgJ>1r7<}CbKvsk>7@pJQ|)|zRUf5r>#D}=OBD^;l?vO!<;u2#eHygq
zC0kz+U@t12Y>8ZmW5u7w-knYTDpl?vRt%b?T(pHa!-~8Ih}TrmjUq`s&94wBPyCh2
z1B@0!3#a6ZEO*v#@DOduG#xr%YC6AU9|~RrS5$=XqHGVg8i>pk04AkME<IO}R^jM>
z&w|8G-=D-WL#orrI8>}PV|*iSyZfU!%Ts47U?>&%Q@C)`v|$KdiNY#=`W%N5s|yNl
zcg{P;L=p^Y@wO<%If!>ptR*1}Xo$!uAuyj_8ecPO;FMN6Ez68pb&Zm&Y)(ddOp`dM
zw;8#FNgou>Q6pZxb31uWm63dIh*VO4(m!qDiY3{ERai9bSwA%Z`|zN_;2{14QUu9-
z>_s+l>;4z%#DD;qCWEGLMFW95S-n<krx+c?zX4=yDyV+N)fV^sT_3#mAxBPq;qxpi
zf6%A-75?ngh0n5-e%~iw<!mB&l{Xd{np2Fd448=SXz|@q;lewduTv@J!>WjXSt1f|
zE+t>UGb1wwPOWA{I#wyJa#bhRYQI^T7JayO{yH~`1fv!423~nT_Wo5ag5gT7?kdM&
z??Q$glxFZ%ZtD`}<YhA_dlD1|AQ07nx!VpKo$0jP<^=hmT3hidZ;tYTwFOc5o<tcD
z00FMAv|3{0T-mPKzaxJJqMMC>=F{eeweR~x1Niawbvl&tr0#daX}D8LR|o0a;39W2
z=$0`ZoexEOE*FU;g$pZw$syB}C7i>5K6io&$-um%O;HoknSwgUU5=0FBT;+|;q&N@
ze}=2XW<}oUo_I=UH@{6WUF<gM`DG=$@tFjWiMz1tym%keuc+K!w9#CDZ?4xYs?w=c
z`SA-dvX>eQe3>AU;?it@I@Q?VBQ4PqCgCG&+S9T@ZWV)!EibA5f*Tp+{W)kVVY{Vz
z0EWo7XpXdei~yG#iM2(wL|W$5&5Z(MyU?1=kvp6Wi<WdDc5@UDv)+^=BQOk?PwZD@
z@}{6v0+-bs?(U8qGu5ttH?&h(LeGl62kNLPTuCm&>b|h`<2$yHo|EOL=@r>lsa6do
zsku{cp`0|q$QiP>rPTawkd2p(aSeUP4ls`p-Pc`^lhP)6QuU~urp_aODPSTNpMa}f
z1&Qsf>w0wX3Of)m@L8}IBqV?~;sSd=o-<RpIG!&Hv0LwmX{JMeh<kL|=m7BO`d8fS
zj^}lUUBnE#m<<exggcDSGU)K;ZWZG?ldhe8P|wUMH-!{f*|&Oy9Wdl%&a#7L=?Y=5
z)dfFGcrSkAdB2XX*b@tP7E%+tXFJE7Le9PcCoBrj---vxU37ka7);N!rk^%Dc3QW;
z;PNtZbn31QCc`^_^FWOt5x$D8b!)92{Zs=8-=Ec;7=g%Yzu37BWCg>!Dl#}pBvWi~
zs?y0ae+k26&CbHkWb$5h-ipU4?f2=l%zrAG|5P&n-byBg2~!z4JM$qq5V{Tu+_<5b
zc}D7v(Hpb3+>2s9V)&U$trJZj;;N%)n|!NOCeH;ImRH?>3pQwI&M+#~aayJ{-36EE
zic6@pPfed%;Xn~(FiJweL;$m}LfZr)?I4!`I>|gS7kEi^m;&13a|66EN(Cg=&5M=+
zr(+Ni$5x9rO?_8}&-aK*`4i~5l0EraxKe_(VJ}tumExPxYjem_1QgdNGiTQ2oS;=%
zIIs-g#l}5<Ab(W%)AH|2q<S)lL|E|ipoxTg$T^fTQ%#kr*{&!$bmvn_NRfEXt$E+<
z07R`LZkoJ>+AXTXmW_u}{m*O8Cm1D>Y&;nPohy0)At+9Yf@LYnedPQOZ6O!$3Xg^M
zfYLu2^od{7DBh;T%3dnN(hb;fiey5tPOy@TNT!N^!J><mBWhiy6kasjL#rEAs<>3J
z+Q?lqHXzF@l!3SKipD~}IcU}nnc5alL}0p+ph48WVsz7Dg+jd-_qMp<v{~Wo(QDPD
zd28whUrxsace-R50}=rN!^FTn@l6ax*~Ll%Iy>-Ct;<j1mh{A6D3%S6<t(yp=xu@e
z2`%)0q)w<0k*G#}>?B)-$CN}Pv_IY->wivCBc<ZEMq_CWBl%fGzl+4Yzr@dGw!J<}
z)^~Y2{Hl%DDl0P|9=TQ4df<1hXm;Tei^7bhEfwCV0$MRgLYVp7G7rPXXPs$2l+k&m
zeSFu6ZKJ-tP^R0TjM<0NPQoT!A7NRP3S}C936uDk`voLQ2L&o=vH*P$ASmxiiMq=Q
zXRKVDmB8nMrKj{OV5z$xZs9Z^Q2ntrO_2*^)K8ua2X<}~eJBRT_Q!sr=~h_1lN9e#
zesV=I0I_goG@9~NngeKBpM0@#d~lgu5m#-94DJ5Od^*WFjmHJaEUTlca3dFpROZBg
zQ6EzkVVs<~lP=kcwrDDMpWgC2j^a4_NKALxzo)Ba*3^Qr93$TY$wFK_)o48;=Ulkp
zRchj+`ck(djU~;6HKY7P&fBiu2_Cv58&0yBYYuf4u@~L*7#ZDO*aSq1<?nMrX<T!D
z1t!JvlR}Du7K@^8hX2SfLckSRas0J^tPGkYF{)9qTtyjDMp(I0ln3)5*J>uL5&xkz
zI~BJJ=(b?VFRfL^Zhw_e1v5pe46?h~Qt1_;$ijvvg`X*rUxUq?GGYakNJ#|7wFXT0
zFu8s7#$$^eQE1!lK|_!E(!=S)cC(8~#mH9;r^;EB!6@Lc9s{^gXoun-s=xYwg#<^i
zGnxSdy)SAL9P1NP2kVGdSZVWj!f&jY-z1^Hfk5f41tXJd3Gti`v#Tp4o>>F(48%2`
z7;%|AO1hK@p*bKB9&g$8W=k7~YvY@-B`cnDitcn1)u52=L8=K{d9;ERUeQ2h2!Es8
zM(okYU06dfIs~YvZdxV&iROfV<iYUik6-4hNsrA3EC^A|AE-;f6J;eK{KH0HVHA{l
z$7L!B*LzASqg2_pM}a-s*ex7+_6-_4$@M~5v~wCI?&hEItRG4?0cb)|&1tux+(i)$
z=A7aN-9^4s{GLxF0;UA2$S}Q1`i`PFzn6*QT1tK*Hv(U28o}}tpN<KCV?$(Pp9=@h
zlTkYA30ov%GeJ-yo|@g96h($fc0*LprEt=0Dr{)Yd<70rmGgb{l}1FNIZoGkb5Q?%
z@HXX~aoyyUJk$fu)*o}eZEZ(mMoHopMGRb$xjG;36hPW;pR`U4)c{MER4V+Z?(25*
zLX$#O<l1L)z+2IpZc563xKXwWo=3OYt^s}lH%%k@22nC=;H(V${A-viw?O>$;)GBV
z@{eyXmj>!0?V6$LC5^Qvs?<npf#I^xAkQT@?j7McqN%fq><r9ojieRy-I4L9pyIkO
zXTZ+IycTlu>RH<7Djky5j?K491^}v!0X>lk#7Kj@;UokOyB_#|VhIC3Ybi?6?1#9#
zwQfYcJCgS)eHvoq+)5Mud_I-}j*uoVPB~cL3)?SeBvA$kqXJ<RsM0m0m`9H<F*R9Y
z!fYxb)RBgAIaIh8+B<ZXa9p3vp{!-4yv7TN3LbQ3kkI8zNf5XgfRPI07A$P}Pl%wk
zn*+q;UoP;k?-k>JWwt^cy&gQn?>~xOAnRy89kM`cOVo<xL|jolc}PVzhX_+UxD0FC
zip38bR?Mw1h!n7#a=1%OfgR4=XI>J+kiaz11vLg`V`-&H5a%2%fEF)^u@K1{HWM%y
z>l8`EJZyt`Dfbn?n(0(fH6OWZ33imV8rOtKh87pq8innDIQ>{d3-}3YM{!u!rk5b9
zLds$L6ppFh9Dor5E6)iYlu9SiNrlqvXfnHNENStQeBPexP!U)uC^o-^7lF>_ZnQ@6
zov7TSar7|p)XDfW<Kx8|TYJ;|wqV>THuqv%xE^Q^Z5DC4WpYj#`HavPE`9K6`b0%b
zg!S_d>fu0t;#m{V7*))BgPa=Gkl%u=BSljhhW6c+kjtB7ICrr<;zmy|vv)Qd!Y)_!
zq^^|~$XlE`9e*nUp7c#NyIX+}ILpV3fkeePuG3^F^yxk`VL10x3r7$iB78SH6I6Rg
zsvK~_hk(Ij=kP<cQHJC;1#q^|F&&%{&r_|omuppjU14q{c?eJn>;HV(E20W}(m(Ie
z)oPp-!^4q6Km~u;AAj^GvaL=B&Kv@h72yY54$Y#HS%eIQh&&&dbH)5$%<u5uqj&PN
zRj)S{*osS87XX+ZW+;bdI)C({Ry#`GWuy6s?-*XhWlyAx0zcFgm;jtQ(%zoPiwGb?
ziNjid=|aRM=xm*v3xuszAD5f!9o!6}3ucUB6i;%)D(~tIm#?mBIeYmT<?T8hPFVji
zPZ;hpqm!*+_RkzJT;`PJA}(ZZ=T=;qgMwg|W@*_{1vrcgF<$zEqPjd3TBXCGwA9v@
z9e%hY4<oWsCd*85(1g?mVU&!*EkQEEsY?fc0^;)4M&|rh3~cGFcrQ)Yf<~%m_DM&n
zvxI-3MX4l6vX@@wT>X&kSpBRA@q#fLEyNKb5&ssGj~V&~x${)^hnx)@pTU}vVHvP0
z6Iz9NkFxB)E<MSR9}eHi%uu&A8%><O@GDL$c;5QTe5I2Oo_DLjCCJa_E?AC7c?KkZ
z+g$9sRL1><R7R&DU!^Q~_3m6K8s$h6tWh#_`s#(eOlODJ7UsQo$A&)^ispnWAQ%4N
z+ps0}DOJybD(0bW)ZAF?J=^1{BX8ub%I6-2uJNcyhnF$Vt$IW-C5E-rQTA3qK-H6L
z(<#T;<-k(4I;0dwaaB1P&sHGmkIT=0ca5B)jaY4)z-6g&N0GY}A3t+oPNg74vht)|
zI;%5s;x8JpsP`6XhtDU9o9LdUNEtPw>~3=oJATee<g}K+fdfh?oD)64>6+1jZ2fk1
zf~quXAdA&PiseXR^9j>usuF<!n6U9_&>&u?&j5L+djffixfPId%vqQW(eDa>w;t3`
zHh$9d?}jfukSJU>k-Q%B>vhjlA@)IQzxI3IR7{k`L9t@=0n=n=Rv(<*P2?e70g&U?
zQ`U+&eIv=H@fD0>gJ7f^Uv^wZb0;77@`PN#-jLm!u@?<t*tav4IH)PZ@h>5D_{7p+
z`H`X*nC_tN6@<hq#Oq_g^^*yI%s#zzFmQBCG}mpX$*kCp-bJnGPJ*y@-`ER=)b`)?
z({$j)#hb=V6ErE5IOo$bg&-%8lqjW!5l*;2gDFgTBs#OaY1$F{o0|?lIHdSwvl<%J
zz}FY}1Q}mxcqqKfVwaC1AW|Wjf+!aJl2^d8&!n)-ibRGo-(pS33hzmO5tZ&^RZ^7E
zG)=1$j!m7c?p`eLC;vFOpH)S)%6u1RuY_B$Ptq#O9*;E}D!Ags_*#aIw^wzbtGvl@
zsPUteGPlcVWzm~)Hgg)LcGAqjDNonVkgQz{dE=~8R3az|f`@#D>H6dp7tspb`T2=?
zlDJU=XcpIbakH^m+pOS!m<^CRiRP{)j1lsS#YZX@0xTlC^epBcQV#ByDO7+LnHXA2
zma9x?q{r9h%om#nOGlU$+ME=Ru$BrQmw@D5IJ@N%^VO3MJp%8(FF4j0@UqrMMz9q-
z5)A}}mgi$+STByF{<n}FKhfmw=#)fO^@!Hcm3qbW+WDg@8<OLH;Ll4_wWIB5>oY!2
zqP6{fqs44Ikzc#}IO6R>NF=lxggL=s#(Cl}&L><T%g=9(q1z*F-aX9CfD41qmX5(h
zD(59*F3yO0PiAC2l<2v&2douy+YG_udI&=xS4x$lUq<XAw4In9LOLfZF2wv$EDuQ}
zYi~}fI)KO};Br2H6~xK$RSc%+0rTWe2}>>!vIt#8>anmPLJgp|s<GJ&7&fHEu#-4C
z|1dI-fE({)R#T-mo--+~@=gv4Z+f^oLoh)?Th<#K-mTRx1SK+*(wDfqzv%Gm9eEwO
zM^?G1a6^@rfqirBEnNxo^MX;9hA35W4>wrU&gqTVT;w%>cPJB5&QFTmaJsfbHQ?%t
zd3fY+b&9PHJz0t(BH2d@VqDY7OLoJdkxaY_G1l>1Ce2?nht{H8o<zS~veBvuc8HuZ
z?X89+U%W75kJ|ivgYXwm4)%5<O8@fl7KK70>$JHmaYi}ipv92cM#E_oZ{A`N$^}78
zgW0;h)#A>7xVdk=%4I!%_uvIL3qy%4ygY2}esI%b34dg!rdInodP!33&xS8L;r-{@
z&oTc`|CL|n`4>#3Ka=s1ymA`#<VYCLouyaQ6r`D9dO1_euF4_m+zWXjP1$eF;&jgT
zUmctrQ&W-~1F7R+@8etC+1=f5w>#hL|G9Ip*DxY~2?y2oHz80^upmCx=4#0J*hhb<
zy}x_5e~vFL{mi}svHr|X9>(KWwVTM(%%>u^ipSt=6HOgu<Aa<hhVr3cio^o4GZ#_d
zESr&ulDRS4>dZU5@@_+X3<a3wAX^wMegz$H>#{Q`2p3P|&0WczoWAGX9=2-VK3t-K
zpE>D&qxv(6eXbcDrcmN(?bs3zcL`O8N?iWo&NpqU9YN(N4#){TyQ5E@n*-OhNF=wW
zE|R+c@tJ!9qocIT`=0N+Cou2nKzu?o%KBp3@LxSeX-r$iHUEK=choGdL*}<V)Sk*A
zH6r#Uv~H4V%jmZ)DGDwrany+Xh%<R7rmNk5GQoO1tfXDXZcFrwJE&UqvqamdnvIuC
zpQUPGx#thh>r37;)G%ImgV2IAUe$Sz5F8vy;uDh)(Y7^j*|lzX%g8aC70b9bOf?I`
zHO8dq*MXRk%j=!3@B4stCL^`<(<|I*L%|y!XwvXbX7}J|uiezmFDKvMh51uNrupE1
zlrLDD(o~<$IBpu_r5EAO-#I(hSIuAIgFV<e(s(CCzQJ><FxS)Zc5+*6XUS-Ldt-C!
z$<xn1|KiK_jm>R5-@+kX2g!XJh2&ACxbSHwv+4`}^tOdEloNkLT=D!mU7#6I-KAEK
zxvyEHLwwyf=PfBQvygX+DCK*?f%!jw>d`iMwR;*6q6X=#z4~Uqg0qSyfVXU1K8sAW
zNcgTA7OIBHJ#u*}>|wQOigTB^PNoukMs}2XYk9!ielU^Ej-YTZM0}Bz?`leEJmwt_
z-?==)YY0`ls2pnvVZ3=o^G{sstwR@2$L7;1hq_xyZ-I-|ZFKIpN2`myP(yHk?hTQ3
z^DyBzV0?ZeQE4qCXvv%r;Mg$LCIw-NVK-r>UhTF6m$1gF$^um_osAIer99VONcN|Q
z*4ai)D$I$IACmD~rhVkG1|b7HzEv*C4D!hA0m*FMi1gw;5DYoW&A0_mFnT808Qn)E
zEXR--0&=IlY=*Q|S%AXnL*BlB@%D<Sq3>7d<-F9OK+@&1YUS1F{!2B@tO#<!Kib?R
zRW48m+v?khOudDrJU03`oY>|fag?>=J^U+rt}_;PsZnab)s^Df)^sWaTw!ck^WPiH
zp8eVUFFrbo_x4&E62YB{$Uxj@?A%163q1Y+qCnv17%bpY@}Sgwbe+$Cs4zJ>8*ogx
z#jy#)<k)1AvS*52p{Zw!STh<j+fbk>(1(qXFszq0=sng9$!V=HWGqeml3JE|B;^DB
zA<#-(v=8==9E(cF&D-p4HZkjyH1p|I3%^=zVE{%S=aa##1?@)UpUyhIfdR*ivl&^=
zL1=eHR*1KOheZ27=+8rctOQHQ@sVxQw|C9*1@aF)5ueCDsUR4y=RGf?>V+3UcBfH#
z`rHy5$Yw{77CP7SUJw;v1Mn?!-qdsx{Vs+{aV^;ygelR>k-;Z=DhF)=DxcLK91?oC
znr~DDW(V*_6ud3LQB7DO5kxfC7=OxDaQ;Vs9xU6lU2>wgSTPxYl$xR`e}GFFv4OXe
z1`07s9Lt7b*z(k9Obv;_*C=I)9FBg5myV!_*8HcvhfIU@PfrM#*kqDLtY6h?!N=`&
ziS5*qU(nj!8NNU<l2kb}Uz|CI=fmjdk-kV9gua2zfp5f$c7p7mPd5{4i7>5(2bTvw
zf(RCbq`y^AR|#u>!tlFDF!N(5x>PIf*X|>>fnJm6NOu6$FmolHxS(+|nTTJ5^FWb<
zoKFkKYcq<c6P1?=D-Bwn8`U9pX}+J?vpqU#LOJc4SJtby*Yqm%UF*6hMnA-S_DHFN
zXUiNk(`h~x*ie5U8vd5RBY~o-R5gJE(#(;aYE7R+6h@<em>W^a2}m9Rta%c0!d2}^
z;HOWUrxT-B86kPjHPpTII%<jc_KHUfD-z&`qOzQv#NCn_u|_iG=y|V(jjcuL$JTpB
z>dg)va~%qVEkiF8`|?dbKs)_&$cFs1v8vp#N47kw`R8g3NRKtsmAa-2`GMS`sG_S{
z>gge!eN+^Gd0kSC8X7Y$3_KBDhGbr{INO<#gz1c&FVjH`N$F120nYU$QPy;(u^2rf
z)wLyg0lZeN6+t@cjIrAJ>r_gf0+g=+x*18xEt$0uk=$&Vfru@-eX`;ebK{gUiPyvI
zhyewd9AqG3bwI9W?2|6?M#cGLyH`F=nA}zcu}Y?Yah7{X0ttm*I0vyenV0~qE^z_Y
ziHO!#u^r{ey`S^(9FOP7P5>cblr}#^#bNWAjddX^rF2k{PdpE%@kbK;twpevfULK|
zBOgH|^a>`~OwNx@;bh}1FWf3wrdF2$;b_>nPpE1bY+6DEFfvKh%6<@ggCPoC7*3Nb
z-#oK_X{d&v=bRI%Lqu?wH=*dc6~g@X40~%D@!9nLf>WBEC|o{%TK{JF`ZIp2zUoqQ
z1#bm%%ByUKW13cvA^vqCTl7)h7j#WC5!$;4N3HhG(P1^eGj}=K-#igI=ALwlWHh98
zDf-#SE{n(YXnF<YnzhA{4=$0fpLX;yMOH6=7cQ`!ru}ZdPJNMGulM}DAG*ls=n?<f
zs)m*0h-w*GY?bBMqLjD)v1U4&L844>!?$D|mt<Mr2x7yj-8nEgwQZQuSkp+Y_9yQb
ziK8cH4wOkGQ+h?4AVVmFu^FB=7<gD}dYyyQ-+b$pl)IZ`q=6Z(a`9sB<=*$^<7RPx
zP1nbhQ5b}7F8olCZ3(xJ=U3^h^Z+i|b{(|Z-x@a0eC)_D;c@G0vxpytcDB{|!Msxq
z#HL>yq3zfMy<^esVmFyy<*hSw=zP#OzwAuSE7kaFpNu~L<-*YgHj?W-?<99unZ=uL
zBkBihmlc#GQ7Gj1ZQ6IzcSdYm_9owde1AK~laZK>>_cHg$EQd3j=W>Y7SAgdAXga(
z-=b@S@=h=>Hee}mpddo@WFM9G{0ZalbwU5rei!N%oh&TQ&$*~4ZBQ;7pp^_S^bJS;
z6cp{Y5fF`THr88eF@ySK?zZT)I+<idBjDmAwtzY@IaIk=V|(OA)BL|L3|&%xRgbmJ
z=DWJ9KklqQW|j@xes>qGu|i9brHX;Z2^@Bfqy*}<`h=8q>7X<N(6{zcq$uYEcPo}u
z!cQv~uB#|upm(D{4a5(HvzCOD!e&zdmaJ<9=y#*xdzYl@9hqHcyN274KpvnT{`B?E
zw>zEJCrA6gw3?&MR`_a>N4toBQOh`^i(D5{bj(&Pvi0CcndniPdn5ptoRmjCN{b48
z@ktq2y;RL+7u?r|d5R3g%2HwBu@u7|yv^G=;S>k6%a3+>>`fz|$>g%?>PXve%ZpFS
zGL2jo9(QI@&05aVF|Q;tK8zx2*0E3gI_RgAwMFiU%^y*ogu_hwZ{#O`@+uqIkB&GY
zY%L~2shOmE=qVLxp$S`wj|Iq*S>A>)#a3*#8&DG^0b=ASz8p8J0I|qna{wIn73Q$g
z1>2$}V&*9cSLSurFF%=<{c-MIg;c?rgYN4)T=_yj7bku$AxvmPA1vfW>FJ*TG{PeZ
zyRFo7II@i#$@V#pD^r|*GQz04k%I`eLTBmKodSi(#DJ+F;?yCoAYQ~_?G{@41MRQ4
z_%iRXgl)|ul09T0PJ?~2>p3blrL}8lbewj1yDLbfPN|DR$wn3<?4m#o&-~pIH2N<(
zN!F1^{Jl_&lSu*3LT{cC?xF75ggqt6bjr|c-Jf)F8y5VaVF3Yue(8#}9Ay_>wkboa
z0z$QRQH!FVq7`jqWjk8Ay6#V#S-#SUR<uQ29^J+GiObqNKRxNZd-rZ7`lYehls)P_
znkcv1&&o|Un@!VP?fbCMt8#V=S6NJQE;KKTr<@Dpq7sy)<go!g)|D`1BgS|4PIkZ9
zKkMwC9KSqxC99f$jc;<YH1b-DW2H+Gt-8`&bDbAiDAQKaQoB3l>{3!|;P7Ui9jvZJ
zvMbwE8NkrIp7bSG0PYI0fx$jk5F!!%ML0zC7vw?_1$WJikspbzd59eur$f-T{KZTU
zGH^e5bQxUJ=N)~n!_WCNJIetMa&&%*nBviFQjbP#uJ@0BQ`LPq#a4QRY@YTIhDFC$
zym!YO<Wj;Ia%vR4X`8w@QmrI9Pm|HZ3~N@CiD!7nb=~^L9Iq}-m4J6r0R{4wmA-F#
z7FxM%<w9K*)5z==)+fRFpkcAJQEHLYg56Rtv>8G;2p6fN_ef<}UH0axp_-TTDO}hD
zV{+%BWI0HGc7zm>GNmX@zd86AnsKQiD@SO(qVYEeD+*lnN!$+QsZ*wiiKE3Y^|xx$
z^qp1NXv_OvtL>}Vk>_ve^l1_UwNF9AZz<wyl0k`bt$d>W`iR<(seQ8Fpi+}7lUHYM
zxN~~I9T8x}9=Q~A$yzY_hv9Z+1fNqv1jU_@6;+ad8Wvd^+~*Fb2;j)X2ZB$tof(6t
z!r$^`uE|Ba%$zDlFB`%;qUl}oiH4s(8S<haph3;`*kXnoN^pt-KKrS*$pT|yGjdU}
z1dsGeOjlyvSoH-K5wfgWjZ$Te7TLG;=T|kYz&uY+uc|SOs|?!m2I%Z`uBaE#?&$GP
z=c2=ZED{t3wS!+qxS|q)Mz~4&1SW0{=)s&TV4F)&_~ymZ3UT)v5S7<^BJp(5`)oh|
z@RblI>`KXb>L$%8qu7$;e;bi{ROTXzevSz3H7dpIz2|=jz~dmki2sQ6_rv~24ZKEz
z9zNWjk&g2-uYu$aT=U)gdT@#e7c_9pK8LV>feGKeuYorTs<pHiWJ$iK2Z~R%w1J6x
zqN)K(;NBSwrr7g-8_Yfuxue`s$dPsfH*hcl3R-3k(8D$wc#-EuiALDz8xrNbyK4hY
z`?@qDTUtj0L^Pb|Jyz6a2|XaIHHjfS9P1B^fQcC!;el>=c9(Q~BZ{^8)MT16f@7V3
zBQt=AdXtpU*Kdrv&rHX#LKfa@Xtne5?BwW~3b=n@gcHcveE0Q9`}`TWU-JqR;%=Ot
zoSi>=`o-t`>rH$A?0DyB{~1l&LMx{`?e=#kXM4|*$)uy}#G<)^v6Hc!{Fx*zd6i2U
z=@>++Y`{YFZghY$(80X`dBC(_p+;kWsxT-m)Gb^)AqkZylbnusW<B1i8{WBap#yiv
zX6;bu;3gY&2^k)b^J?<*7|bf;w_PHO6kHMqT$5%Tg+6L%Bf>{{0(K^oRIGE3eF*PL
zDO!wA6tACuyXC`|7^LP8<rj1b>5;{CJn}&rrYS*~N8PISx@@wfK^d(Cm@uz@XbYyn
zMkM>-!pFKU+6Sq9cF$wlZ+ze@+AP$rnfjkrqt#z(wdWBR%YFQKTZ#azPBn-56-&&x
z<{|W7xT>mSAk$hl<m|ZOMDxRK#V=m8l5ugHPFovaJpE#8>))=2&(d*S?I}jO=ms;}
z^(t4J<1zc|JaywE<O-f9n~!{d$vB;bXrlsgL{HvIMS#AO0A#+^W8Y>@G(dc|L|eaP
z(uy%RJSj@=6Izk(?)lka^smuL*ZT0qt~|E){?ujBE}J!jhIqqBJNrey+u--eVcOlk
z{VVI#`T%4K;If>hWa29U8Jj^5<-n)@w#o1<BrpPSiA{0H%X@rbiKp*>`-D{z{YF9U
z>E$J$)7;Kx>i~g^U`_`{_AFmBtSy!ubBy4hYJ_G*CD1td;9Ssw3LOmWk(C*CKNI_+
zz)$4?(yoA87R|`pt=hauEDNnO1|XOA;N=z!6{bcF2@f_C@-!7$h-7Sv&rF$G&20Kb
z9fNJ9@?tu}Ou@q+%c%T+`Z*j2;DOZ#bx1fwf$Nstkfk;V6d?Eya@l)<`@%QP224<Y
z5#Tutn(n3vSW9Dik!P}ON+2t0k%xDkb&)JC-w6m)DIb`kTMGpctJQ#jN0ix50W@%G
zn7HRS&OPly-c&qqjzK~P8XO!zfhO|_+x28VsB_-rsTco;oazjJ`dxMwQH@-B{CE-A
z{dsi6g>kVi&+Q-|KbEk5mqyE&jne5gEwJK+!P#JkVP^K$U4Lj~CyPqt717~OJRIxF
zOXZcDbxyfOfYFGu^Ax>}>6;PSEXF!1OfZp4(E@$?1JJg_=62xEsw-`>v&8hVxe4p8
z?3a>)W7FLlgfKCG6u*+WJVKvy(s5=XmGTM{Id20Ww|;Dd7$A3`kXqB|EH~Me)EKE=
z^PK});4@pM-4N1%<#@7l?;L<(&Kg{S$c>;ODE0$JVH&2w#y6VgL(a}_Ue}L3e(b;#
zU5AOsj9qL`pqg(s{a%M{Nn(zz3%8{0aqi_425SGg|MoP0C9ep<_}DlhC#kcirW;h&
z$Rz?*pVk@6D*DStM01|9hJeC$J6=bf?aP@owP%bHlu*^1m|<eW+DHN=>wi|9S>*5?
zn<+dA5jryuJKD@7TN8dC^?hgJq6<pCFe5|sjoLfyXGK?1KiJMe2f%}!*ZVtr`)6%M
z&@^*dy3>V!egnP6a&p!KsWc#0mM2TeY=*RYi3hwklOZ>F2juhF6_r^sqt~F|HNax+
z95kYxF#_}^SzogH8_|n&FwJ38{nm^leJ2&pP(g;<O$56+iHj6SlZM@HI{~3If@dp#
zich9j+h!%;arslcKfc)}te};sX`K!%ExaL7KygHWO=oA*<PuIoB9Kcq<!~?|O1Djo
zOiI2-^6}%yHNObP3+yd@hk`l4lzPW`<<~9qDxIq`K~2<(v?Uy(u3YZwTz7dsldK!o
zj$lI@geNa&g)&umsYrsrsS2ePPK`bt#Gtz&2aO|<N*ok~PIhjzS);U>rTQH_SkT|n
zIe9IA?zv5oaI<vSnb=F7PXjNy_ts9%_Ydp7d9-izFp`?>GZccwVm1UVHo=VvyxO(o
zbOI=s_GJ{7t!taea?|1)Unl7maJ2ofsUPT?SzDOT_)T~K&r>5lhEL9LiJzd&DX)|U
zCrNf=3*ztkL6BFFD8LR-?5b!8hB+C=@P5{R4_zN$b`XD^7Bsh&DKS>-me&dSKA#OI
z9wH*%<5+|lMaEJrEmzM&jkRI4cFu!oM2FO$BW}yW4rLXg(_qRJG)~4Sv+T3n3^hO+
zEYhJ@k1`>A9LVU~hS6P3Cw;@w)Ns>ao7R)9jn8QT9zVv^x2W0P{1Q*<179@669_VY
z>g@jsn)Uu!=j8m*sCH*3=O?=-htGny5if)7+zqet&X(8_T_g&7nGv3tZ_OFxsUShK
z_8DEBo$f-S5u2{raTl~y4_Ustl#Eu71UsyR9TNzw5Ld0{{{pBRmk+|#7XH(AVk)U&
zJuVe)r6@ydJ#guSY73eJX_AaNOjA~WmViG+5qWc9<Z+@)F3^Is#eoP9MjaWtnkDjP
zL(>rmlT7S9MwV_+n(e$Gp+jP!vJt~|*)%f;wq4%TkAmGCWA5sRW+R9uZ>d~9UPJbi
zOI&n2kZ?Qo73L_(2s#p#@|vYrQw0g&Q=gI@Fik3W2ow%SfnnNia}xguee&^t;~mzS
zV9>XviVeA9g^wAx%#|G5=C})ZkZ0zd66+{6BB89FCMD}1buY~!c#S%)y82D(%F)63
z5g$O(0XCG`I%Uxs$89t?3=i>Y4JwZQ!km?j2$4aJX!lVgI-cWK@2<Y>j%%evIs=in
zV(xg=3KL7Ed;-$M6RsA?)e?YzML@}3uU%PeVil6>r5#2-C-83zRnJ-Fl<&ye8=3_}
zV`<29o`{*DP|<|Eh;}={s*oVVs0E(T;Y%HJNlvX#mNaJ1&wauJM}m_(Gi^w)J2dHh
z5nfJfsFIc1oTxm)nAznQ>+2iPI9l?8lt>1jNvB+di~i)=TlA-QDgzsTnL~C6^OzGp
z93--LkxFo|x6oQ6q&;(jL5XvMJzbZ$uE0{pfe;GNMiSxYQU`&HHv&hKvKhJg4B;1M
zoRj&G_k%_2N0&+QA~-%nj*y3q)=dEIS~I+eIOUjd*GNw0p=f;)?mzQ4O6R?y<U5tO
zs1A?OH4GUUSr&?M(>EJ`S-d#f&|SmafXLUOMhS+x!=LK_D6rwM?K<3Nx?JxvM6T@`
zX9%Z+392zOHVETlT7n@ojM78vrb|G9qn444JJWIw4!Uh!OTuvL{tA=Ay^u{`{-$BB
z`FO#n@1OYysG5S`x}uNW^PS`KgKz)bIokPC=iqp6|4*IsgQNX_&UfbTlkYkmr&w6r
zHmop(4oy)KB&U@7!4=Xi!IEL=;v{pqY1VI?cqnvC=|*wuu~mU50A*VXHjklgG5ebt
zdCSz4&p71Atg4h!va~E*ZUVS<3eqteM+TtecV@a~BuM=z1?q6kp@}<cT%$}uY>GO?
z!S$&La4#~Tjer4vU-3Py+uD=lNr9Q<a>VE+p`GTO^6FK4^`Ivu&edx?Mb(m_U;4{@
zM1rDRfmp#vX2|-SYh#X}Nz=}j$8ROvQ$wg2{DB7t=DZ_+bJ7yo_bf=J<EMmrV|3d7
zb%Vs@SvH$f$ma@`7a(M!6_P4aCzHx>Y-Rc$v6w3xDR3r#yO$XT6ELq4U!j-GNi@A9
z$2WCJSqfWl(K5xJQnCBo`*0~rf&@}xjR8cc2eWROt)W^7T|gmVqWPMCDH3IWIHw#w
zpO*?$ZO-+fJT6F;1Foj*!=l8Ej2B&twqChpLnB*^`vJ5;B1H+n-M@KJCo2r)(os&T
zoyU(LcAvn155`QdeFWfb*oXL3r9QGRaGFwurZHQaO`oav5+uAKh@>nzyF@qm82?M|
zA;y~cReOkurg9H)H90O9f(Zt22Mgl8g<a(zt0KQ$!7KD}yU0K6>FH0unVbotR@)ip
z<2yrug#uwi{id*?;m}4P0_zs>0#jrr>mlBZN=kcwCXq@sX@PP@ZK(Ir@Sq|{9~8SU
zL>ZDXJxvC|X=;?9%pZGiMM4MY%dWE=^X<Y47f^lKRB*58x$Sms@T#aY*5&Q#V!@0-
zt<k`4^@Up`@7UP_w04lW28PD-zvh*<&H>8;xLLMBliR9po|bH97_amtd&PT<1z&xH
ze>L=fs@rupyQgnpkS9q1?~!js-r~yFip^~+klAne=-1B3LCUL{E=wP>PdT<%tLojC
zzU+laYKFX}1TQj@3f(NMB?I8UFCW>djfI1mpy+jl@g{43<|Era6zpA~&Ffl@6!P-I
z_?>-8!2pho&^|J29t;(+&~qvF9T>+Pjxg|l)g8v*V)vU8Jiy$Pd*R_R$mr?hX#mQd
zs&qv2Pls`jlXp6WGrELHu6Pck^2kHuM7Zym&wRu-`v=-M9z<3UMUocp+f~cwO9`uD
z!brOaIMj!*9BXA*X*0x)d3Yu8)fe_U)2NRgKo!l{-x}aae0uczpcdiEUVb|!ygAo@
z-z$R5k@~F!;IC=$CBu24IVU7pAr5fBMbzla&bIaws!aS6|3r3R*p`0bObizpBccq6
zU2e;Hu=`|SV-`WP=ygRPE4OWan=(@K`h*WWsei;04{?Sn1P7N-X*&wAw!*{9Fp|RM
z9oC0ki8B^tXUWLWshBNUc#u?nkG<}HOeVgM7#wPNDd5@zeI7v*m<0YwSylFz-&mV{
zVqV!I^9+@p;*w+=ovUot!EfIlT!HE7XOC8O2HJIZQ5xx11QA~nHVtQ2J$}3+!F<v4
z>bZFQ7y_5|<+gpqkdL#3eFS!<)+J=vOIxPUB4~2QEpw4VdW%KuyOBl5e7)a)MjLg;
z8#XgYNWN&^{GknV@)MDaH`n?`dpN&RBu@NU>W)6@BL(AG2PnJb1qD3<jN;nq{!v|C
z)Z8UN9eR;=c1V6J0_ccXPCvX{;wReGB&|G44dH~o2m*DvvaYt2ydLxH0_k63EcRZ&
z9XkZz33_dR8V-<Ljg5w86tzKrQe4xK>%!^saXc`G2L)1@eSJ-d6&g5aceX3-z?G97
z=_x@6!7%pY?;+z5Ow30&l2UuS6xsjy@!5PF?b&f4o`K@+kgv+Tf>hrj`hT0^zYQ+{
z0D2KsNt1d(G&DD&GpT$?#Ut32!Z~9&>XHd}uh2@4<fAaESvqdrr8pdaTa@d}t`=KK
zoDJP}8lZ#>dL6Fc$Z0X&`sku)PK-Cu8iS?tR*k+RIc+8}4sPp~H!pAB$B*~4P)Xb9
z<YvwcJ@eVD*U9ieTs@ye8&A1@Z9zrbaEDugX~b4vp;k_Y1BMl$Ko+s3;Ml(LV@9HG
zrNOnU5<>VoM`%W`FtY%EeNk(2R*<ED08~J$zv{nD8j&~W<{>s<QH`Jed_*Q{^IR{z
z%jKkUrc<%7@{kS*sGkQ$i!YO7CSjdX{LS#XToSVzO_Do^07bNhMApew#}LMRH11%I
zx^<Xd$kQREiVK{>JSem8Cqq=NGlvo9A)`T>TMJFcwD&yPh`xD2Lm7hge+{IgyS9dC
zbeiWw>Sp_ohwqHElMkt(MwAVPsb6fgK?b4V0-4u2?&Z`FmLXr$NLck10u{yvO70{A
zINQ|)VdTIs*8f{HpJl`BM-lCKHRSG>PyZWs9aUa7fB&lt;hfmSQ9^ib-~w*0eS#YR
z1kLcxVJdqJ7g|*9i&$cVf2%gb7k88N=cpFR_zXFLU;fC3^a8R*fjuq8JJ&2XV-5RT
zW-Q#nHah=D<`F&}DBCcdgVEY6uSh2QaK^|gN{ULC6eUI$H6t!WvuAGy0X{&uPE4Bx
ziMj<!!oqh<q6!HMv&ijVo+0X&ve8(a!UKDoXAG(E9D8r~HGqUie~A{m;h0t1@xGbS
zqALXpqBg`rGLdQ6O^V5(tC;y?qG;0*4Iq$6Yd9L5MUA&XxVOcVE&D<p1Y9gbH-JMh
zJ@>FU%)D)^H`dqJo6&1_29Oh>h^{~vS~8x#WLqL5Ev$3MW=kndia(`XPrjj%x~x&+
zOZX7shv5(UYOQ8?e<_`=hsdSyb*fseP4PbtLj~a}0iqS5so1Oy%EssfEmSsZ&s@mR
z7l=*7Tw5pkAW-Z)4cSFf4$=;%Wq86Z8?Wzt-A39`%w8L>Kplngnn6veUVtrYDZrSO
zDJWv8AmnpbX^m@hB2nnh0*HY!0Zh9PXzD($T~+<XLngbBe*)?}dqV^($XH@|z3zb&
zY;SMRvdQ918(m0c9n)1q0$Zxb(YfEtSrQ}c#k5vieBVd*-aR}Jz<jT=B{0w4t8{qh
zWiD|r9ykO0WNprV!GWpLU$Yk#(Jt&VrqkhL^6=OWvx#a$V<W0DE$Snj+Z{lD<DGab
zj*|h&nlbuaf9J_iOOV;eX)?09-d)Ni+RdS@18;EgSBc@IwE%Nr)zTK}vuJv@j8$UT
zRd3FqW}HMWdfehTvH#6439TV&RfCQ)r<pk`r8veFIr~aTjYfu^<_N^H;hver|L|%o
zy~JNUi|ZY`Mx9IiRo(=oZ?^AW`X(99DL6!#gaeHve~ljTPUF=Xb;JdjUUCc!pg@eQ
zO3~|>-fh+bWNXMqa8{Q=cmt;z+eckAwjpBbuAz}(R>~>u4=D%0>&88sI1@s?Om1>=
zHXQ8jo6)|8@0Id=9E?o_EhOIt80FB$K*_p7D-rR|sv8$1YnUC6PZQYgco1uPL@Zsg
zY``T}e{cceNhwyB0nt&sn<fX(IGDhNVbQ_4FffdW!oJd^@TS$DRRqc+cu7E`!O1+{
zL1;~e0{fDdjj85b4+r33du;imO9_#6(A43I;C*te&x>m@hmRz>z(>aN^B>4VkxjAv
zX6ZyWgAl;j#b;IYj<{*Uos`LK5+01?l5yPvf4<=b2#?+xE+38VY(usFAo$5CgM&e7
z`FLCi1(_8ADwDJPUw|`r@laPu%A;}YNFs5sGq<HN5#)sHi<gkm$p+seB4m`$((mOx
zs!EQ}ai1Bwj5KI9B$m*l!Vx*uJD9`B7LJ4+!AxZLvc;)mNz|P?WPkQJlCK)ch+2b5
ze=NCpf^8D8u$8~f?75%J+52(PEe)t!HE-N0S_29!pAn5&>+B+lG{m_s!C@XYlugxb
zP^yeTco$7CXA#!iu|$l3CxXc)J|86J(7;Bs{9S5u3F44!j)v@Ln!(8g_L;ZYWTJD0
zs5P>5h^2G@(#O%VKqhu}qBuqqu}e6Xe+x1U{b|R{^g##WJ_P|Y47SDzSU)@`NhA&e
zlhU8N&B+}ya+|Y){<+G#0(IsYF4ZJo7cJDmYH}m;G@Y5<reNvZC8J?ii@>tEn9-RE
zS|K=jZ8HLD0YjW5HPIoP*pv$vM69)ug-{YcD|P{p5$J=~%-lD;D$(0AL5wIHe_El<
z6W{<{WV3Z81{Uai!fy>Fq#^n?qG%0gg0W6mBvzOX-lYq`8>kVY@^<kK&lyh^+t3A1
zkizF&%$#I=f#wEmp~Vj8suPryMK!R6M6Kj1F&@Fv$;<?XxC;mYOCTe*I&dg-_%$x{
zl1z)h?^ajwjNGAeo><UdZ|^wKe*$tnEi{=SD6%S%+)68C+Jg-;9Ha#gN4V7B!{w1R
z6%=T{`^@{1<UyJb$01y?kdHeVa4@X-8(e)Jb=}+iMla82KvSDUm#xuVhqzcvV#Woj
zPoO-vpwZDFJ$h9l*VY?0?2XtwzsZSV5)n?<jbKsLnk9oZzo-ExZ9)VYe`GV8{_8^@
zDhdd8h_`WMtH^-WxE(t%-e5jC-iL9fCtlS&>6^fpES)98vX*`5{+CQIAiYSEK$zpa
zc*2C7+0X<r+GevU_%E{M|3*YZJfxCjxC~CuG!Kxp4jv3vnBMf5h9ekCRn;DR+ujAO
zSliMknVpld#0Hc_W3U(;e{V2ZF>%S@iQKqXF#A9bUUMfqNnYQ!qp+)%ISsRpwT84d
zIyVK#Keo^L<s_PZ2DAhUqa$9>JA*()Yc8vFGO0JhBL$qY8aN$>SP`~7<-Q@AIlTT?
z<^YGgd*Kx3`yDD`#0Ro}h0kXH$`xP*D0fbCBIIc0<8Y9Mhh2lde_1-Ug9iDuu4v4@
zRMDWFm9Q;bu52r0Bz}8d?!Xo0D<Zgl%RAHjS?oD6EHrbl1R~OT^f18_09blR=?6HJ
zkW5VkG@)7%ku5JAEB~B^%Y-b%bU95^%0;p4*SfpqSmV${m>IHEGbyRMW<(X1n5?qP
zFe_gn1eVzB#J-^>e^D8S%54geeiRS@dZjA}BjhMm;9yyrkY4<-a2cyv2*V}@BCXMf
z!xULhWRtdS@XvfQ;Hq|uWI+?Bf}oDbm(eH;-IviC3vyp8oC%S0oN<WZz_=3wlJEvO
z8K0cIKgh*~F2gjl_yCatGGd`sTa*MB&MBW17j9B@0HtEae<PuCiSR%qT!&P42HkW;
zGh|ut+7(h@IJU~0>CsXGARr2gpn|(ptcBbIGD~D*&W;%P%>{zCijrf(u4zUuAo|9z
zWfGt@m^+_DwuL-WASaB4XlRMNZ-wc%MhrCvZs(Qa%GeP}Z?`+}m)hG(@$j4KJa_Co
zlmB$#S$I!7e><W&jPgNtnQ2isZv9BF0r7=$W%a2JJ;m*YPoYs@=kSu*dMNK0^$NHe
z?<iE9Y9~q9c-;j?^Athkpwm<lFX5gTi?Kw2M5ug+TfIh!6g?HgB`moB3!60^8(pAq
zzrZeI5vW=y_}l_Xv|N*ZO?ToFR|_j7vEE#t$7-oie;Jnvb6?>&dEOOEl79wcr^1&u
zlZg<@S5Zf!3xcX9PKHs$0>|!ED#)ixgaX1uW^Q45v`wB|y32JHyeM>zU3Ven6uTW=
zh^d*)!k=}_(UX^OIz=KAP!Ku~y->MpYZ9d_^*p+mNM?l^v913@v;!VIo0Xq*d>-7%
z##}>&f1dDc`MLtgPZASpoQ*G2b2JTN*lJ?wcdW?$_2nfGZy7z=R&xyi)@z4qo-9jW
z(^P`ZXpL74g%&FWm9Th}m>C#*iA##{`#M!2l}-XZPnNG9S&5c#y?~=)acsv!!;qhY
z3z#$&i$l{1-Vtd3rg^KYqoq;>By!v-b12yif9M_aif=;jUv@EfDpid*o&mXNRP^tm
zrf?^Y1$G9seW&7{5Gg#k(`0D0`hi=SyU5j{R5%zb!1?R91h4z4=Q8mh4=oTc<}-;#
zW^uzJdR1s;WMwRXec!+SH$zpc5}^t^e1i)f+Sh1e?Z#KB%sJ@6z9GtWm#F^C(xR_)
zf9pQ)N_h!!Y|^{;lcMFU3nzLrC{As|H0cl*^9bh$jD1V4oULTs^0*=?=9w$kOn8bo
z%e>J}EXI%JMKunE2rp99!Q;pK?<7w2GH3>OYn8B^_k(rPTP__N)|_!(CxlC~XWj>g
z$<~tadPK(1d*1TD)tis&`WA|wRDVyRe;=<GuES1xec!iU<rUY(K)d{{v;FpY)mxNe
zUfD;6C$*tG;cQ$ri@y$+jqB(xc)`9ky1VbK7unSxDZQxlR`0L(z11G)x0gc%W0dCb
z^4=b{5#yvmyj~BB``&tG_UUzLWHj^Duh==%5>2H!EH>_W>v&$h%H#R+Rj#!&f3qKx
zsWm~l7zZ0|?fBLG$IQJpXxj1qMa|+C9heMXxKk6ceLGrRt$AWQ{iZ;hZPStwlIM`2
zql@ortSsQ_Z{^QuRi#l_m}9<51+WIw<Z{;9T;E)eH#S>*W7WI~5oKG7E0~`IpGA#F
zuoWBD1pRtD`so*QL5-Yr|F-B*e^ty5w7OwB?En>gAYiis$C*?1=4JjVtl=+75>R_r
zKILK{Ss#H()|$<>yIyK!p)toE_7k|K%n4oiD(hup7C%d-?hpd(#LLj;r}}{+^4Lth
z=+7v4CTE4D(s9%THI~dAEz!qO!}U{`-(2_%44*IbIP`*)DDVZRE&-E8e_eZIy0dSM
z;)p=?!Rac(k29Ng>w-Mt@;3*|&VD%x4bhSf++tP8*5cwREHK$RjUkGMXHTrK*4vl#
zfM0oyP)FFThJ%%5pKo{rAe>LnRw3S%!=#u&tYdvb(_Q^&=CW6WES@kmO%Uu(?)w>I
zsUfkDP?Xu{YUBrqSk1`oe*$p?ULbs0+tbuvmMJD$2>eNBAwaEVq?(Sr=D_?OMTZ$7
zWu`Y-dK;*M$b2x|#r=o`{X;_n5Y8D-Q}Tm*xMhHvDg1Z`By^%@taeW!EKZBSFHZc^
zGd4|=TL|n;a$ONN2SEzRx7cHGmHu9g*s^}~2{OyaGt*K4x**>ne-c{rxM`#0r)zlf
zyW*nxt_2rA#MOfd9z#JDwFwHr;}I0dB%e=M_myLyMOk4rJFl?$e?1>fsLBtb-8Jxn
zoC@|aBZQGONKOd)WGkHw@iM{X4AL2kb(~f`ml9`410X$x91;>C(;t*t>Cm6i?|v7#
zUP;7*fQ#z(=W2zYf6gUfR0EK@-MJUL!vu;I8m`8DvJH1Yteqqa;Ut-kCn#C7M)^Eu
z+JK%zDPfTF3kt~)3%87p0+ZFi3}CrwM*69lOEQiTcLsiypl(Tp_eLaBATZjDKFGCs
z3*eF^1XFx*noUwr*%EE)v#riVpYR7`?atiCJfCdq-qh!Le_!50X+q$Ik{AjiwOaP6
zZV*O9+g2uuSJJk21*uE-lME8Ok6{LZmfZ09ynPQT42G^jbuF+Y1W3?2bu}-|#-*xX
z3R>-KntC7Cge?waBpkRl6jM8U(V97*>YmY7Uxlq!xY+_tG7Vc^v~XX`hGB_uUVD{@
zN<na}YZ4^7e>IS6b7uK>=hGrr2=#{42Ln{;luawP3vUkCn?i{BzmxV;4k4gKlcoF0
z{QurCzk(RH6>n_BMi}F*)#86T_6@dvE;PhBDdtEqylX&3O^79uG>d$Tl&%pJPa>%V
z3lWBX79>U6;(TH#DpU-+Nqv}px-2m=HWqDYv7r$zf16K7%BB58deenV!)MvC>kMHv
zdq+mGGs&W#jBsf`x*eSnCe~NQjAN(x-{-$42~_&B@Q^uy%@e=)IF-`Xo-NnLCaUj_
zI!CCNwbwCo)p>bvxZjN~s;U$$!PWh|<2~H5-L9zmLF`^B%}zRF{stAyW<`x{ei0$V
ziVy}?f3@OLV<}<o4;#%VPuH94aW9=E&CQisjbRVXYjDtA&c}UmS7+n3ciS>|b(-Pi
zHZc;)3!`R}B)hiKY+dF#CAY3LqSc>%G1L`lgb2XOFIE=kYUTUrS>(TI8)h@Mnd)z4
zO4e4)L#T;n{^=#tmHOhNTGe{(Co@u1QG2rae+$1rPXqQQH#27T%$on^mG>q;Tqoj~
z&8Oq&ol?QUWwh9TlJhu}s1aRsuUvP#OTdra5_A1&jv(_><T-5)CO;c+#)jNP?0$8_
zRq0#W>+VO@Ab&&#2x7cO?&MFf9ol{=?xDJ!JQCk}lmi?rTyyr!*hQp~fDP0#1m$wD
ze<?9cBkr+k2n(Qt&7z>wqDd7@?ev*3cD*I-YJ?=^$O&w)rs7oWHmT-LF=^vmja&GR
zis!h?kf$8DI<j0)QZDJ-k)jKf&e<~m940-MirX{d<E_&vz*-OuP6l%|=-Vhs=uq%_
zKqcW2Ib=`3ZJ1w{Vo&sC*7qz=9QAM<e`YhU#>DPHYj;m8_7SYS4KyCiITZ}ylQ!U7
z{7uqldJ+BhOJdr<_V?s8@F~n1vjl3n0Cm$SEiX&ffu~1g1SrE@7l2AXtDUx1*@Pf7
zk%na;3w|^9ugdqZwm4^pq)S_8CgUXvMvc<~7UevnXHaBAI+G)a!Yd`Sm&NrMe>J$w
z>`#W-Y@6AL&Hd%C!M7mbcAWjeLK9>j#lx$1n5nGbea5wDePV<!!Dx1Hv<SYDR^b)=
zZix!xZoz2b01y;+k5o>s13;N?V)#xj5il`GDftTbK#_x7@)azs^@4cII`+GnRTOD~
zG3r7oK))=Q?p@WZ-RemjUZly+e}Vgic%?(lAgDl{D8#kYU*}w{K0O~pFk%2=me4{3
z;yzuY8m&}@qr3BJ|M<M!G_+}`vKy_*Y}TV#eBnJo`m^#J3p6$o8`BAK*t2z%ax2Pi
zsiyZ`e3K;X-NT(Xd;8o6M;Yiw^=eB9&>zD7*QGnd0rL?gpUKv8C3^kbe|G9ilc%m#
zyfx!1TGknMg^WmdHI^JjqnXn+>wY`)Y0Wn&lu5ynXGnnbqBxBtBm|bQ5><#TgK5)q
z3rH0s&BaPM1pdABIV<=LOP~aYLDMEJN^#Q&RVWKNG2ytQ>H$<fE7ux?Pdmjm#qM{Y
zIp?svTxA|xeFQg2oKNH4e|#Jh5HL<u_1u~*5X<{9zaP{4b+f{)OLOoy5sTKE(_cck
z+WjW8O0NFulkW(e6|X;*1vT$K?nYsXf_mdP!l4;7EKP>gNV<hUYx=bKdrGyiM2EyK
zb9E}gnS6$bhw=ibxgS;~+;fdrR?&XMUML}TDueFWO_!&+V<u$De`MW~AyA_ax@b(E
zk+ZyMG2E)i+ftInd-KudJqxjfL;8tWz|?~cs}UTaY?TeEmfMV}P3x?L-;o-!RE(gz
zq8y`l5dhv7A0<xK9sZo@)pXVzkZ%hyiQZ-$q=uPDhMx#!QV^InIRj202j=X&8`<8o
zf{c+F>2&6D(4?Rlf5{%68MKsV3!~u0r^vHyMsQ(MIRDI+{_uc3c=erdrsmtpd<taZ
zLSnh^T%jgN1J+wBsx{Z;!2+x1EwO8MP-|Y%>IMUViLPx|s7|36Br}smLk$`ZkK2Xb
zkW582;>y-$P6MDY#$+*$HW0kgB?l&?1#Si@VP=@oE~eN{e;5V}aSnC<(nUq4@`LTy
z<y6xdN&Uk}vshHBaOMaO<0C1Xg5GWcuhSzvAK-I@6L}XN?gE#s05M(;c|d-@HhbJ3
z989{)Y5SAqkpGvW?b<&UZC_Lqx5Wfk|H^q@or}LfxEJ?R?)PhttWk~%RLrhjl?odZ
z^hwB@AZyHde`oZb7xS@4d~!-#!5e4d5JA56=y%bDdDh)SC`NH@Zs@?ZI6SBtviuk*
znKmhxyr7U4bj|W<ZIJfnS67VLN(B!nT@+gUIGapTR}IkBl7toPGFs!qy@{BdCd^nc
zUj3%kLfKSJbLX%8E($*)B8gakED$3OXb7KPKy)yOe}H~#BrDKB<DDpu$ub`yYlP$8
za6q=Au9+Zyrs@HSMItYu_>2irgk3pJEjPM4kcjU*n%$-eX8;Q<maDwPj&3zGm~q&-
zvPLw9)>`}O{N$Vc<L8a&E7*Wv?6mg*?e)B_IVB?AaxfsvAo4XT<Pq3!?MGbmwcmh#
zU>1b=e{F5`yQ2<$aJ3%&+rLGt<Ge$)u2&o72ho$x!SOk&dmeU7m*fo)o1ryZ7IpiJ
z_4W1DTK)Ij;l=O6a`}+Y2hV-v*ID$UN=J8L0;{tnBfFxyx~(`HE-Xxyrpdpb35ZBN
zQm3(^(VG8HyZU$7)g?4ZksckV%iuv`*lT!mf3}zJeU5ec!_7u>>$B!YS$H>;T*(-4
z7}|0U6a?n+8Hoye59<h@TFOBl&OIh~;2xb0M9@wrdiE?@?R3CDI-OO7$VAbj2eS}7
zjjE>=oCM?WILUU@m7KwN6kRqYLEN%~?t3`FvZa>US+dNv3q8^NRW3rq2zQHPfAW5-
zf39^fECH5|aX*h#$+Y^B|0KDM@@`QjocS1RR}|KhOw(Fd*#XpQ^Y?crXWz6>cXszh
zQ(oW#(Ckptt>TV)ZydJbVr|q$%{w$4#v(!w0^rF8Odq9m1-1d&0OT5i1}F`y+v?g(
z9pTJ0$(K?^RRF>$K6OmSPB&~ajMs<-e>S2tBd51muNXpQEHU_6YBRdHW#LF{*_9^U
zniS6E(}J*YxzU)u)NMvPw)So~>m`t!lJ=Snnza{%QbqyYh?$kSEEEtPRVZ@Xcg=P8
zA&3=C1W;c@wOXhajuyHqi(lBE>K-dR5@siTZs)UozH`3cIo&yb-KC5s$N70Oe|#~5
z9DEchEcG0@8UrpjqRR>|-w+mRqtCyY4x?w0FX_yu!{5_wyxcZ7<*{Zl@39ka?Td!J
zI84V^=F@SsRd13>du_F~YR)dI6T#hj#w|4qU`Ma<-|n?W<X@>bQFm3^u%~w+=d7EN
zRemizqW>$5NkxM94v8$0>2#Ehf0H2zO>d45{sg3p8TfNyH?hQ_4f5I|2YI%P9Ynfa
zpCO&&px8ObE{c4KGY}+eHac;d4%3^2PJv5X5>yiQD7fTS(~61g`1okj0KOxn#lj*f
z!4|85ZWY_WY$6;lGk2JvuI9Ko%3w6jFK1$+kLR4&WSWjScC1BMp&2|te^ew^?<#aq
z%e30rs58z(urd0h0R+8h<>6Dg!Y@=#sJmww(lZ|=W`&oU*p`<t5X`fNOIcjmFbh=U
zMktJs)}$hCWx=Ect>4A1nE$UY5ybm~M*2GyQzXIT(}j>$9P*XN96LpAj1*OjH#1?l
z=rx&B*|iutO9;Bdh;J86e}s;X(5L222Dq_eHXmd;Q4-lzSXOCSS&S@`wFd~TUp6-v
z49>Qd4i>J1&pzTAsk0O@CUG(_7m(k|D^Or=t|(}owOt1Oh!Q@Jt7VRfR9_*brP)J+
zcRR%f0{Dy;fi2c@s0cO<)s?v;|6)>P44lnV4<053<OR2c%YfFJf2P6g%81sK#l{<*
zQ3bIaq<!ehzx1s&AUv-WAMHjgYz^@uE0XlKvK_6gH#eK>D-B!?rlBx5FGybgsm7u8
zD>x7F3RaKapsTP2<Lcx#iN|Iw+#M+>f}2cQ?pFVHfXl!A$!_15Bw+vIz0GpsK85Q-
z+QbWk;M4NR&h(0Ue~aIUN{M3$ZHs%;w{&3#|NZSxnBZSlzPIlaG3fB33ND3DE@e~=
z_o8wuJRdNu@EOas@Lb5a_@Q6?t|6HS4}v!M0fg#*uV#=>xS%iQ<Nu`f?D=0_vYh`L
zTQ?iH+co#Q<}B#SJ6-F6bA>&*{wjxU*s~wU)Ys|k#gvdEe-8Hci&|~pRc~@~f;9wB
z$TRK21pSu{tLLL~?25A2z_x1S17I2|l@U&7J$j!QJt8|=Mrui5Dvyat#{uQVqOo4j
zM#D!N^_p@x)E1@iQD#rIg=I8i;j&e%>C%~J{FSQ(!a?LOmPG>lb-bN;t-2acQ6-DO
zhNGU5EP-SEf59$?iEX3f+E~&w!DO1fUhNkAvcq*xIuzO-I0U^+MG|u-i>*s8vP9i#
z0)(bZnBP$C<yopyHSbACA?MzgGpG@mZxk(xpdn3={pGF=wi-=F=FEdMIm{Z-+j$Rd
z@F{2rYb1LC;0|{h-lsaRW>Fi}1i-5<H;14EsnW)se|W+5{3kSadK?x2FLzVYZw|&T
z7=%w$1f`KJhO~B09<P`@8zXHKr)N2%BixlfEHa<}C9)p^`;~uMS<Y$FJlu4`p($3S
zruCVn5~1(D!5eCTFuEz>m%KbXIf|~X`%{!$tp+jJhDi+=P1EQBPseFWFNiYi&#@~!
zq_NYrf7;ob<0zTT;wy@gqg?Ud{SH?Yt2?@AHk;qqYP&~!hV$!JR=!u|E!r2og3-Ad
z-sW@;lVNH&8zmGNQmTK%z;!6Lm(oM~Q@d!|kK#MJ%t)H?Bx<FzzF|(Y*4y+BdT&9u
z`$j>I;>)6a7&#%g*Tiwkjx%DMSCcFAR?A(De^H2{X)ZTW1LNl?GJi&~VX4W~kaHC0
zi=Xq}#*6gzw11sLRO&?+Ts<f5-93BXo8RBpQ~c~~t~cKq204Htm{T0`is_@7e%C9F
zCkM8EbKrjgSE{H$<};XP^VSdG4!v<vY{gKo@gteN-Ds}I>+-je?XtmDx~Z4?hT(16
ze}@Ot5&doceD}5|fjW8t5ih9sk=iSR1iQxmoSIEG#jk&_QEOK{+uFovi+OB1Lf=e`
zqM>(^f)bo4ABYD9deK3}aL+2Wn)^!#{doiwlx<2>S0g03<+=23_4bO^x*jbfvaGQD
zpt*eW43oRtDP=X$?wQ~G`pq-HArNRgf9i?-2Hkc)^@$~y%`8re|C~9}st7a-5tB;F
zu*sI~^4I+IN!27TWcp%xv3WNFuGWK*WIXVg#fIvX@xb7K_CTYo7%|LKfFI!ti9{7e
z+OS9l>@VRnBKqx5Mp!yH+Ih7vqUm>Pl`6Rlm$gG5-xkqV`mh}}Td=#eW_imae<gk<
zF{1sp6|ME_6+KzR0)p3OiBrzuMR%JdQ&TjP;+o)_vSNf%Q)m#QELnHY_OiQhZtk4D
zvfbqE;CHpghn5~uq441UQo|mj%w6XLks{&+F@nn)`Kjcd2KR6wLuENdT+g}ErV)&&
zmfH9x9dmqj*i9-8&H~?HG3VL>e*;N%Jx)4pm{lpbZY_tDj1hPOu@FdA{=iCuArAq^
z%u8W3uWgDx1AbFM4Kfne4|%UyTkNr4pUa4!DAHx?C|Km~1&-iV?V=L%QhlmFoTDUG
zL8$R}!FMPM-4?`SNjy5TXf4s3gRlnUMj(!N9Ii`eo&_Z%WTs{4^fcwCe+}V=xhv;P
zOLQ=Eo$kT$!Fi{>dv<Vo-nHq}?^#2Fr;)FD@YMF(ys!!hnGAsO!ljNe4FpN4j_^-7
z3$7cIOkP|g=Mc74Tee;iQaDN<_|b`~$Lt-a+EzCi^8MC$V}tVEeo=^t(5o(EMjnt7
zIi$#L#91q%WVqUo9=JBgf0lk@x^MK)ogt?_0PC15nMrz>L=xy1dHTB8+u{r8{3LS&
zOUy4_$}yA~eMKul!Re}kKSbpV=6aqX+pu|?_9k^}(00~qiVh*Kfyap^MhnU<Uar;Y
zH1pKyPk?~DGh1b3_jtqR(_}L~i;X-$JoiS-p_0_fZ7Zgi4`}N3e}n<H*@SMEfV}8t
z&=R~AbUEq2rN-I5VMgG&KNQ&re1Cp}E}G}3Gr&tE?2)}FNiF3R2KYUO2#%QFwCuc7
zt&7$p`X}aDLSa#dXhxO%=wnO^_9KN=XJt;|tO~cGrb17-s*eRp5Cj95W$eOu8o3lb
zV%;1&oN6>%u<2Juf3!eo7X)8BWuCF<r$<-xL>xTvi|6jp-RWU$RlU-U?1U&Xf_#G0
z<P{+6G@t|Kb+%(9#te9ls9dVH7;=1ylH?4_j53DHQ7UG##ulqRnaLQ08AyNB;(-jp
zWQKaTBKNdrqluHv`lu5xE{)DtqvVHt`rQ1Rjm^KUs)=C9e<1LR#oE8E=Eg?z@pja`
z=Nns{jg88NyFojf4`^p|NjsEL+cm_AeJ>=`^`QIWc!r`*GsED9$rXoomUbQ4#==GN
zK%c{=0ng7&<12apd8D6+K4vDo@(;9ny0aOMQ;NCLv}<>1Y}aXW1B)l+=LM*EQe1Na
z(-PqdkLRPwf1Tp>TC6mW|L}2?+~nDS(r!>?Plt<yuxn%`m>#sR69O^GdQ;x9)S@Kt
z^AVqi@)f5Yk^`4hQO$>%{#aZOAnjgc_t=z30HY$jk(`TcHB<20wiagakmx9@h7U{P
z!oisB`v3IEEHH<;#r{<O0#VJf@<d-?dRf9aMkMiNe>M~dTO7zF>>1#sO=U-`MRZZ_
zteH$sn0&eb*(k2apbjmBjG31EAbRKTcF8WyVu#@eqsffJpE=2hGr)N;BoCh6ogT1c
zCD|UTohcTgL^zu%e%PF9TwH1s@E<=uJvg<lWH++MkExKMmB)NJ?n8~lm{8#=8l<J+
zsvp?Ye<PmkSel8o8O6JtrO14d5+Jl{Y|7+gWt4C-v?DQ^WeY5+lT6MK$`1vQB30F%
zDclh9L?1t%rdR1Z<>`+f)48f!n?HjD8MoK@uV>FTnok8}CM;8J1Ch*PbPi8;cMdyy
z`=|TId;7<`2m9@Ab^h}j2?b^nCJAK)kntfbf30pq(+)@m{8g(UEK^?Y=*tW|v7}|d
zPXzvBN%8Z=EIV-&d&O+=zRk=;OrTUUx@r<;0*1Fsj%?zKvJ)fyC}6GRl6?A>a$slE
z><Z-v6W)cT?Zpzfb}4l2JMRw_73VXEBm$)jPjXS1ST9J7U}`O3x1UV_n1=aqmccR=
zf4(m=vcgmcERkd)dCqLb_lZ_buZ&2Qd5`Ap{pT>x@25C~AAO*qQM<LwVpw4<TxKbB
zpmfR1^Uk#mshJ*put%=Y_iPg?`g+1JDL9Fq)qkC*bJ&^;;{w_fsOpwLhgD{#;zcCR
z3sO<R;()wJULEUc8<FM%V+v)0H={R%f6N7c7auK7Ql$cQ1>9m;GL$0)=zc@0EgTd9
zFx{kbwlEr{snlogL1}_$AsB!z0u!LjuKQA61|u+&AXiBipU?7fK0*+ua|hBEUKlcu
z)f`m>MkqQDly*a806!eaX!o6cf--11W`IISQ?7xmGb1V=AujBmz7fpfk=Y&)f0O2V
z%8U`UOfMRxH3zhil!BN~rzwXU+XAPBd2=`6cyO+XxcOOx7033c(E!I_l#dOgSTh~j
zSYIFUHFL8rvS>gE=J$0z&3*)!<d7>Dlk&3d9F;oFBwr)miVhk|a-Gbn$o2>ZOz$y6
zJM%tzO?VyW3UEC}G%+F7OUSthf1pNxoZSKhUz#Wdjo+Yz009l<Q$^Xy3U>`(<OnZR
zyhU6XuPc{ObWq@qn&*~cHU5sxe%HW%lfKZ3OksE%qH3@?c5r1d*PJ)XVr9bRvegn8
zY<o3=g9#M!`0)$y?8inC+EJn-lij>G0vrQb!WgMR#>ADDl<s=-;akAte~E39THH13
zm5t|yu+i+-+~gEfMdU}8jyvhM*Qk*>$h3ftQ#osD?97ZMA5}DDq=Y+*t7Imk2pXG@
z%?Uin#3VJFCU8abEPRuqUa~p<`Z5FiD55TV2p{4a<gSJ?qrYH=&0<oiVIg@OhA|f)
zM=WQbX3>x?-nKMoG>~iLfBp^VQ87~G{r=n>ApJYMa+*$oXf3{V`mS$iEGCqU$1DP4
zTe~T!rZyvAwX2yG>*>t$&AH!WwxRog#fZXIbhW?<0W*utN+K;|DnSgF2@cRg4$rSW
zk`qItqeub9GQ^w^mg6ua<V-_X&a_ID_Uu3YkN<CK*>5cR|NdX2e;p}N?i2cgnV{j-
zTvs~TSjW<!-a4HXm{>NCZ$^BbD(4&-oo_TB*>1o|0PNO{b$om?dKPW2`)3)<AL(tX
zQ(iPYixcnV`J@@qb3UJHa6pF|rm%{#H;<Bc)B)(L6Q){j2lPM*a`b@_P{Uz*B<!aV
z8~+W{{gVzxT>@m_e|3(ig?WA!t(_vpt~}5Fs@9`_UGkLat=BzCr~?o;Edvv^d5s=_
zN<GISG#tHbNfme+#wIPnccrOcdx|e@Q77on&ARFJ##8g#tcqEXr*1*$>>ziFSy)Og
z8n9<&f^LADAn$~T2VX3_nX_ad3-KD@y(BC!)1W2_O;L30e~Dt4eI`TCMQesZzs25y
zdxrp$=)@D`O|u#sO~VFWX7AunN{k?w&4>xKaXzrg*7lfbfvCjoTpm|`c^Tu$+9sL<
zT&BogXlqwXHk;#j+@fiA=U)gj%RUMT$-;p~a6;m*)w=5`ETwt0u^rK25$&HJdi)3r
zf9BW*Exrgne_XMAkYorbPYDR5VYeWLv9+$V-*AP}B@AlQ9GCMc@o47A9t#B3ZA<eY
zl64UD7S%-82F+_b*4oL>ON-{w&l{V;lcnvyt!=gB$!F1%=4SLC|I`0$CfkzT<Hy1Y
zp1SRw=pkxH1M4chiSMY+y_pCj_h4Nhmo-Z>ya^CLf1@PO8E~8Su7N*x?@SZ5rqrf9
zU$nS!r4%ct(%8f4f9hr*R06m}ScEp*)L<69y$^=C-ues^veEqPbGx(6vsJT5&zSXj
zYM%e1xn=ijOn`qI>qYQch+ES<A8ngS-dOi%Ihdra?dUt+V|I%clk6?XbzyprIkl4Z
z>!!zte`J%&o;9b$7v4=;Kb#TKhRg#^8s@@l59DNqwgFCL_t%JL05Y_0<89NnJoiP#
zbLg@yUV<(|hD_XkX0xk#{@E5S(zA{ATFq^6|4F25nLly#uu+XUv^ndk;sQ&@g%nl7
zbL1kVC#^gZnH88wcCO*D|E(#kAwxOoJ8n@-f5E=ROk(~<#MZ0;Cz>1`c~-Jy&dbIv
zBV9m*X09kznAO@7n&dt_aFe4^vP(jinwj;yD!?pv3WRn=*G4dkCps)%@!W$$P)glu
zMu#b|AIw=_dY<%9C>R2CuiV@_2t&`kSzUrP3clS9=5gC>m4!|;A_kO4IiZX>G#jK%
zf0v9%M#q6Kfp-V#WilVm%1ygH<y!QLBBwy9H*cG<F74gcVhg~e=F*XdvXbH5jO6Oz
zK(^hsM8FxJy&>Zj_U_7hL{mUr$3XbdPy|D=B+{7HrvSoMY1jEUNevu8rN3ltk!y~p
zknw1*{gHNrNdMSv@(G}HC3mJPR!=qbe?lMSJw##(h?bR-6T4jqeu)^dSyZDn6*DgM
z>^9We^Ut6Dx4OA?bw!!ZQias9LaP+e_^7d0DG7NTtUw!78OK$QqaQ|gnj!DtFN1?&
zKMwB3$;j|WyCWO+sRh<iB^Lxr<TgsMoF)JtF&bC&bL25DD{cxLrqo@D<iDtyf04OC
z{2bYeE#wy`_S_0Ydw$20Tz+;Owfrc!Yx61B^8jCqDbh#Gn?FZp`n~1I)i<0lWa4x1
z){gy(Z3BJ*+r%NckVsk#8iTy{^k4Nfr?+>F?nQj{=jbyOmRR=$b5`DU&LO7G@Diy?
z{%Rz{E9}1O5r@>vF7<>Zt+7GMe;EnS$5zD)MwiJUV8v^%^NbuuC9XD}8p?P&V#C4K
z`p7BOu<7WCfGwGG_A;=xiK|{ulj539evkAMY)29+nzMOPA)svR@nrJ^F_41MCFQ+g
zHp;{_Bl;_zTTod+0=~9N<S9L%7YzMygIJW&1R@a%5)@_Pv?SUdL3;Z+f7*EU!u)sL
zkksxQzM=8*KS!H%Z$s}K!uD$}Jm>41xV~m%s940Gun~psP17sW&Jg5emMURe0gt;5
zN`RoVYos`vcgGXp&kSej-v(1{r;t5fBhe-0F5<w<!I<4-gE=!{2UP&y4i#UgL)uDU
z%q`nosTANT;0i^<%9tq4e@QFDhI{a=jTmzPSJK@?m`E|#1ORGo5A~#+G}|CO0^~}J
zSYel*yn6AkVX1hkLv@o6=cCkGN-4m>8Y~|_=7k_Hm;Z&M!-xvWA!JW9BQ|J!fv;fu
zavL!S-rTxL{i75*UqbVhzU$)@@tn-7MX)Lj2Dg=Jk__S?01nb1f6Qj&IcVBL2Q5n@
z^MXQyP*F?GnBfwOUkU!!lar%p4LlCYrO*x)o>6^5=>Db%_&22Gfnko9mwY(Pyg~@H
zJ9_iMRq9o0>4Okc<y%4%<SZy?r&s~q=!Ge4>Ifr%KX#ZEBc5E4UU3cI6WPDfz)Lcl
z3~9X<Tc}(T7SE{ce{TZURWEg4`Y|1pEDul2MzbI*_PB#<6O8hUu=CLxc00s-AU|H^
zIVU)ih{hzRq%H$^;<9IK6PsQWy<|wfkkWA+oBbb*Ia+&C_2GrFn>|9jbr(1v$a5QI
zKgtO&%&wQQyD0NmDU%bck)l6fg|DW`7&cZT+0k-3iI6_Nf6>}l*8sd!EcIk3ceIii
zrCzB@s{)e~fu1%^mem*dOrY$5Bm0I7I#^^gUMz^bOMu4_oFGr?k?o88cI7<lE7t{$
zZM|MrA`9fOP2UE|<)jx0y0oTyQ^DqyW2E9ubFQm%VN<~a@AAeM9lc>a$9~_6oGTeJ
z0I_Vy{1$X1f2q{G3FY+jd~s=iPD)2s<U?8c4|U5)6CJM!uVE^JA{HC(3G1+v80^CN
zW+5w2=?GhRkEMegE*u`1;lI<wVF{B(eUi`E?>0o$MwF_B7c7TU?ds}|affX5r-VKb
z)M6jv3X`Mz;wVK8Q^Ru#FTTykEVd#qJcO)ToZKMVe>J`J(co@BGDT4RkAxztNEAE>
z52!`q5*XP@r^t(1(y3I>4>^K{;^Xk=u;IZHfa!6Bv0WTDF$6r3US*UhN_NN7gT3h3
zB9b2HlaC)89;8M)D>V#0brA>|G-Z_xvI6(%loWlnq4Hc2GS502Igi_4?;IRPZPT${
z{*FwYf2P+|1)0uOV2RH#myMuEhc_Q<oF|+N>(J{TKfc%j{Bv|~YUt({9Ri82;5YRB
z?`+_;lzPdyp1P4)NVnnmGqP@ujQH7SNkDTfjA&JRLS6Brmp_;UsV9ekQ%0OB8&D)t
z+gg6*`1A{x!BeaEK`v@}(NO-f4Mpa+Wv7-0f5)=_^_{;Z$;U395=;yG*4+~g#!kAh
zL3cc0iSAxN_5{O3#th7n9MEUFN{OZ6-Vxg6^iG2EFv8S;d5zQu5KM`WENxLYJvf6~
z_@0a!>6&%wn^(wRd`V#qm{QKlxPVBpq#x@YvPXI|5X9pu#tn_$O^THBp3kU47RLyX
zf2yppFEG-=usI(i1z?(y4lc{8Xj)=L!s!f&dp@Qk2|7LpzE})X3JNkO7<KEwLXg>W
z<v5>Z{S?v}oJx*3DByKr_Zu4atHMSv5dS25o{Bvf*5$yIJyL_6qL+F#Dy_)J4mgmX
zM|VC7p9F_mLnNyjHdUpXxHv1OV)dICf9gvPBpERHyi|T74jq)lFk*;=Xbw|&lo3eb
zpJ>Q+GBdIkj@q=%Gg5!gG0QMCTw2ew((DF_MBlGH@(O2%&;v!?g1rP-DKG|CF9fR|
z-%){zV%bCgR;%I8nw~WWd-cjiW#k-$30bD3s}KTelQ#n-&hadVM$UbQaLn#}e@ymS
zFNe?&$maz9H^f8u8AGNh@YhC5o^Ngt+Cq?z!1Zz1T4SSfh!>ej=5WgjUc|Zn-3dbQ
z<})MP3Fq)$C=nLbc5C5c>$j6^&@z|1c5i#HRkNP*+wxRp3#2D&K~<wSF1&m>=<0gj
z(ONEH?cqI6MIyrtVBO8|730Y*e;Qe?k}+J^8arG$eGQ#+GKgsqcclV;--e{vI_xzH
zs9Q$4Mj(?7x#SVvyOKGm!c<%8?Nxo->|Hff*?6odiZpu9{JDR;^Wt#7^X9nydgpAv
zV?O-M?A}zKs<F(o&%Hv9omnyzB0%I0v&xIbL|4{CIxs+WV1V+^k2S4Te{1zNVZ6vy
z7(pL_?Aqsih5EMigUawmOVU`qer-oV=N~_|=K=YH0}3+x>G9*GCjeJnfSqt*cv7j=
zLIG1X8RB0v#>}j9*fAXm_B@!6<r#@$v9HhUs%JAB%|A;gs2Byz2)R3=lEep^^;(gq
z+%OwTgm#VDfp*c?fUfZSe;#rR&2GiiR^%B2thL!}is)d+U@q0@-kZ`_Jd7CJF0WKr
z{P|JzRUEXC73M9Eu6e!VXm96yhtOt#MEBdD{GY$bBS$BD3@&E`6TSjinf<fQtFx0g
zr_W@q1%5VOwhfl`il}Snaz>f1a>quwe9&|*%*Z1nu-wX;5B?s*e_uZMuq!r5*mG`6
z=o+1Ol)XzTz%jV0g+9t1)FIj8`X_CA$!OKXm<~aWqgMTo)qD!n*Ynd=NuC$HpMuPb
zI<<JZz@OsCMjV-~EQvD@U_8{^8>j}B3m4Sfk%)ORDQML+IZh2zASa1rmKqtgKO4%e
zCZYhfXB{XU<D%0af95D3O6bwOEE%`n^h_7#buqq&PP9ji9nal$91J}*EAYZoT|*Y9
zfC>nj!?RvqmoD}}`{Z!v{NUuc^YU=#Rr}dW9Ft09<|LWK(>$N)Z*w4<|6W2w_a|(n
zR>f)=HmF<OSXZX6i2RvhRm{zILo?XQi$jSaqM>)o`={#`fBNxb5t|TKYctwsxy$As
z%Uq!t8QN#fh0Wv0o<@EbBs=;l(rwvuzHC&n1P>IYp>S9;iUeuEGTn#jYhKn$!r6@5
zcJu7FXgeB;22wN}i)*XEn})Bbx^A5t^ykk|Fn$%w2X0U3qI}-FnXO~Jf$>0bs=P|v
zVVbGT>&q>pfBX|#F^#R;jCMJXt%N5)$EBvGx(1Qpx<u!i<&kKNQ_iN<<5NB$`$JQJ
zI9dS~;Lvba-Wrd%GPtUyhzy}fZ&gq|OAcqBEt|0Vr`u)bhxz;p45sJPIf)ZK<*V5z
zcx7#zFDxNPHP&m71cc?#Sxqf1#1c9NG+mor2RSa(e<|qUUo}D+&W_8X+NLbV^5$9l
zsOfzlx3c=E#>7Ngn^unn-c-!b7r6}RvWGguYSnH=Cu7c9#S^6!lKpe3PA%viX{AtI
z6@0IsVAolGd1<pg&$DqxT|qPvsx(T}s6am~+c*>y!v`3B1FdA9+1fMh(h+ijCn{lZ
z-cBh?f2f5AC@&75+)$QAxf}ZZCim8+w`k;!blr>sZV2+1a*+p#+aaENa&i=lKhqJR
z)Rj%&5y*o1-p1DF(b~r57ty~)?Sog}92_3j{TiXksAu>M!IhJr(zN>*)C5hvHX+R0
zE*joDp@{i5^-)Frsa7WCF0&Q0e+?ubXKkyUf6J^2OB<+GVM_zpISvzgsTQle3p%M<
zl}q@+DdtHGsAG-MBQw)1T9fjgY8Oj-Wd8IV9;RD75OU<&IV7NsYK}>rLV{g|7;%1Z
zd_b_>&szMF1rfqqPIi20#sU{eFTGA~G9;^*(RP;zpk2xr77-BBF&}$aF;l|dH)6u$
zf5)E6L(cC>GS2$2YEeAUd}2g5nGY_sY8Hbiz^Lv;Ve$5Ai{0>R-)cXoy7(ov(yZ;H
znQgtd9i6D#o`E?4SdR3S+DkfPq7P;J@Ud|^q}c}l@!$Vn(Jl#@*=1Q+Vt5ta)7#PN
z1Le<EY7@3XCc$kLmy2k%%<@*F1!b5xe@}4aknF5&elzdk`)0mcuhZe^y^SlI+ts3_
zOItrTa-8!AFr$X;Xvuj19SSB993_;86}F1H3*HRX=@Y@Rgrh-hz`{=GnLRchm}AS3
zNCgd>U0S4i;5c!~&=klgzD!7$;Ef>IM}3q{Wua;5t{@I!D9(J8Hi7v_wC0^$e*qSc
zfB{K$7eV(7Y|&aSMxgXnbE7ajy;lC;&r#dzcR!OTQA8j1KZ$;-{9okVik3fi&;K|o
zige4hkY?-D`~UcV{2!t}bDw{9WXZOgP%f=>5!U_odlXJ=_{y+uXQ#UTMUD5~>5*e$
zFD>5A@=3Ht->c|9e0C&}afg62e}(8zb)1z2jHT_1mR?8u|M&m(|M&m-KbwV>@lZI$
zl{1enI2!j}sCD$-A&~YjLnwWMioPt{L|uvFF>l)*$R`|^iCPi(O!S^rSg^QMupT=E
zif;7>4p=cZepzrfMEm-p6>B>e!F+wNSGO5{mV}@^F4#+eBGnFFa+s-ye>ZhFFjjEj
ziV)0feD5#i%#yUht7zNx9hcxzG<50IDm_-SHXGHDVgf(&H7vNYoO>&D5^2h<PUjLF
z81O`zg+D8XOUZR?meKI^>6`){{dzR=4w=ophZh{m(T`NN$Wr#g)Y>mIMsdbod=5i_
zd}-zMUV4{TN3#Tr>Y~G_e=z-k*K3*3ZoO`_7Yrvd^9d7JOqmrNPa+Q#HaH=4hw<%y
ztJN;}uS${rD$lQmX=_~kU=FD|=>?VXHTjU&^%XrYDdS?ilPEnG72)0_GuqdxU=ks!
zUuDrzEQ$3K#O6Tarem9cR%X{6$9F7iXSH=BD$yrSB*<b>ZI^Txe+eGoNGEz__w-Fe
zyg7{^9EqQ)FbcZCP>s$CgO=n0deQUjl`_vl{?qkI$8LQnFv2X7N*qi56irH&_M&hE
zRESL|q<qmLGRW8+!KaM#NTB8g2hKCrlpR&v0pBmRKwk|KkC(ZhJVjyepiQiuTL?uX
z8vd;Gk!@sLc{}&Ae}a~DqXk>0DDw!R3`+<?ZbZBiPHDd~4aq`r0irdJHtPJs>NK^Q
zmt#DA)#0hR@-F2GmRT%iO2}0!5M~sAG@Irc#T&{c9Asgg&$bMXMZ7^=Szyoz?QOJ0
z6{#k;^>KK&P)5`7z&*&+E_?*F1*G!bR#U2;BXA(cWL|hxf34SE%*XY=Q-4r2aiK3S
z47L8fz7K@`g$`g(>uO3ziVx|+Y?`JI=>lP0z%@{^!wS)rw?c!NZ#2m>iXvHHtIRUh
zF(@aYMK2;Vv5bb5)ln}UuvtVL>Xwl)yMq2M#qAkagjj_f&azq7R3H~_L9CeMBZ>z0
zc!q3xu8JPGfA2|?CQZF4B<RQ<PXKzP#0B1Mo?4}Mg?Tt*>HQvj8%QFBKIDXHNeqD>
znh2{a1-*z*=uCKx@bp_7(pGYQ2mT;=_&$G0FYPC=T4pmF@3P>DVS^m8wE1|H6iAoj
zK#i_Dy$Pa&JahI0^mGvs4Vr+ZK_Zb0@W;_v8dOy`fA1t*i}-EW!KRmUyCeuh2&7we
z4t1md`0xLVE*$qHc=Szs|4a;0cu>ybvYnbHk2ty47i44hvY`<bflWvu=oA|%6sz9i
zlKuflFV*p|9?g9Mok8<9#KCWxJ;O+v-8Ky5@bG*3ZDdqM>yD%LpWB_Cy`zI;>ul$d
zQdmTbfA_X;Pa3N`fNllNob9(y-kk03b2H-Lj`DoeDM-Ib20!?LVH&58^A@&7vg1x&
zi~HxNyE~^|6o7VYGVRZXYo})&^N9Js-8X0ZFAmPz9AR&V&&k5TJ~U05i3HCu3JDjW
zMT4k_v`rp-!+pl&R5!}T4r(&o{~U=YZ`gMgf6O+`EKhWok>ze#2fwrh!<hX|awECk
zX-yW2??Av#$(&E50RBkZ$MFhmkRj}BMih8s_z9AH8RQXUxWqGI_dGcq$-!tNF>`8W
z1CRoqg&t2gI7vEDhes9d>$A=VABeKi8X8}(dpq1#JVW*lf+cjsl<#L|WxHypvyrZ_
ze<f>)fkZvz_TpH8HaZ3WTq7P&jwuaqMoP^fMa+x&QRY;Hy&(ibf1Amq${cl)j1wAM
zl$xD3Nu#R_T_}G+uv99i2RlY%RDEh`lv<`mo<e9Vk5Tz7Cvz7nW+Q@B<W0;U=OLQ~
z#H@&bDLUv{Kqb6Sl4t}lVHEusBaPG$e*+l+2-mPYxmt|aML?RlGAtB@%4$DHFAax-
z^?tz`D95q<3d8$h9~`IeHT#8zzOvab_)V=;>6X^&^AhVOMxg)a|4EHZix<$)@q$}d
zA7l%aRU{wK*3rT-z5roBp1){{TKHMjkVdB7WJM-i&b|3MGlJ82@uxQQZAL{zsiA%E
zFn{#A_2E4#Da@5twg=2Ni87A9t~0|2rv2+X@mN-*k8l)nsZ>DOL#ZVp7+OyO5(uYG
z<0P3z5zTDabf6fQ@^z|Zgt{M_gl#cRuO&IoSr#@IvRmYP%UxXT?`7AL?MLvjMKcnm
zjbK;lXr!>TI(4z_{icp{-v(6*)p<a0JAeB2_%Y0bl(RtqXXf=ZpBD)EB8P;tR)n)D
zeWJ`%M!YgJ*N0J20%PuRQtKC)E4|D?er4O%fuy^M(NPqRXsv71c9&_^Wo;)aU5(0F
zbZU|-xRiaD>7?U6+FdYIcs*i<YXR&~m{+pIv^;q!^_t?2)2S$CWy-6@qiuS*M}NL2
zpG-`TA2TT!!dMt;ao?yOKhEi;<?^u-8IJC$jnE@~ujymKWKw10;^3n)6wM5(VcN71
zB<&>ynOCZ9=}$lJgm&dlQc#Uqzwtls933u{izUYMVYAhfA}(sPVK!2B*dw|xu{8lK
zU4&5fUMYEi`VPH~<bb6$Pg;l+rhlR9#2n{FGSKbIALXNhiWJ-?cf>n-ocQm%1Lu<x
z9hM2N$rY2V8G>^Q5u(4w7Ndq&owoI2ZhoVxY$JMQ{tp(EhEZ1wqkrx`YD8a~zBQtq
zu~fD`eSM0%y}LS03=>X2<mndRZN{TaBES(&39`~K<*e{lpd&=TR_`)6g?~CR&0f+R
zTYfkqw+3^RpB~A@*j@a^MLPrvpuekW8L>?zPwc&EV!fou{IbPeX{_t@Mq(3Lad2fE
z{D~!F81YC<Zk-J*WS^4kp(b07rLLk>9p_gi^`VeB$8b<=lQsuO5pWV0l{APLCzwL&
z&RwgHRwbUIk0Rs}OyQ2zs(+2(Y$r`G)J{53t8vjgnv&`fgv@ru7SUy+V(n36n=&#n
zh3>C$`hbQBtypndrrNbJD{8HlYrw1Y>QRsB*)YGlVsvtCj9sd0Vo{^aYzAu3DmCVn
zLguiF3aVW|7XmZko?GHTeEM039}QTjIL0)^jJ?1BrY>eS?WQm!%YV?-Ji$78K5G4J
zt<XFu`)tXXz2;?dseMaw(CQD$Zz0@#DW0;J;&6X_eMK5bMezKxgcs|JxYJI8D+!Ds
z#AXL$;kiWVr0b<FJBUs70u{lG?7@k9Hd;AxSXI`Pa4EXi<<iW)X5d}$w)UDLv1ns;
zH;<(milgO@n)gY+k$<ZLbot(NXbUjlV+&9~<%9ts5kj}&B_H`tAA%NjlR#d$g9jw`
zuyaImA8lriEVqa^GJO(uyzo_?Z-JC>U0}%{VG`k6=HL~OJ?i8RkcZ_$<9()Lw#3}4
zI4oLESU0ek7M{mA^iffF{J16ugHJ9jB5e1H<l16dmU`njg@4?BI*5PZBzdZir%?dD
zi=OhZe{IMFOI3_)aZikdpjNpkiG^T@rx?dMXpwVT1K0Jp=@hVTfu4fC5Xj}7t3EBv
z0{ow=9C>&MW+xXKdsx&yQ_}f$P=nOFw&tn2rE@rlIXo?&3gv{TQ<ArXjQV`~$ujys
z$IN__rV~l}E`Ox#?109)Pw~N;e?xk-3$TL9%JA=03;2sB`TWTzT6Xv_YytR@(V=n<
zd=(H#EiETmch1$Ws*S|@O!J}G%)NH2=XK+=4n0kY{od1lazB{jxmjPF3fFl)bAcRU
zN=M);0c}E>=h<9&UkvIBj<;R7dL-I?A%4{IOo>#M@PARVSxXoyfk(PTiHC%v)*cv)
ziev!g^_Q+MF8m)x=DM~P-@doOXB%jefCexL$rz-zCK3kKJm$8@1zQ&h^!<&lM9-fu
zyzU~L_q6h?*jBf_l~FqnM-M-6rOuaRLA^gsr@V4ebsle2ndSO-khQ!RTlDTANRPmQ
zQ0l0yqkmAI4n<1fNZ_?0qbV4nBCX#)j1TBD-(8k*@_@i@R~dKP0z!lX5zOCFawooI
zuV~;sIXEKsEreV9)K>f|lKKEbn&bltFxtM?xw$|-oKOqstM`Tzso2WmDtOLz#iG%A
z5en#bv`Qi74yK=?L<2|+{VD|^n$Cgw)60H(c7Ii-&a$q`nrPyyg*StCtb99Il7-xK
z3g(R=n=H)!143m>A8y)O35BP=uV~EY5LKOKsc0x6`#Bgp{6q)3QW9xgoxJi{0nnLB
zBtaWfcgB@aTy+Q>m69hZ;aODVu%wtcA()(j`M5NNm^mKx&Ufu-|C=_C`9(gP4bv&u
z-G40FIXVc&TD}RoD55U5a?|KgbP#mhDfeu>8{kH<_s)WJEQt?@0tAGTx?qOG;|pf8
zps8fE2QvzeIZiwQ%Jdbk08jg_bJoJnDETqh$neee%`J#$;YB|~DwqItkHj8K-WU|m
zGG|jzAte1F9D=1!Il$jA6FSZO{9M|AvVXtU*wPennOL!e$MmIo)0T>-C`Hgo;WT1D
zgF&?(u|Wsp5CL(bn8Ag`H`j`a!(=|jq^6_E(8f*E@(~h`U)85uK?hxhsW5F3OvQx_
zdlGSiB?XGgSXo9*E77xP<+G<xw?11@01NXE0CX;tg3J9hr}mucnuK9$T=(|Y{C^)U
zGzE*LZ;KY*DP}Ev_iAo*v=+A)YkP%&&TxD&5~T_?2XTIA@I8tj{8e~i9$J_MtWeM}
ziiG=BxM&YXMZ>4|tWxyduThHJCldmA=hQ%3)<%oVn-8{u&ik4xoZp9+5=VRXpjrU)
zyzsrd->Mzy<B{=V3MjT{t$w&EV}I81T#>9uU-`Vlf@9douFAeKBY|3LDBiYSq4tM(
zh2pZGZ(%CVtO|De2~@Dif|*G;B+=s><-85aE^GHmC&42fDE;NejFc-eKWrZmE5u}&
zVN|-8_^4<T-kXuK`qR4!@9nDZZLN1~O>@DBGi$8xgdLD3-EFGNnxg26gMauG!03-a
z_7uuxKu>ALs>{HNE?={_M8IV#p@y-P#sIm77!1=8`;b!JBc{4K`$kyd+LfF{a@H{1
zs#VjQ)F1)hPBpM!4XCE!xQ~hy{0(&Jg3hPDIk#r!Ti51COh4*eoB`VrpK$_rvlf&Y
zh56%Rq3X87LDAJTbk}cfe1G1#<;%;gEZ|&Lq5GGMwukGjA2BVuMF4BkwW6Y-Rd1kT
z=yR?2NXgMrQSq3wbeQg6Q1MSZ;g+E3L6;hN&NLAbWWQA<wus8}v4EqStq`4>7Orql
z8L^5^qBIvGRwK@ftYy?e{Y=BNGb_*+q06JR^0^;J?Bbg=PM=b}D1QTr{WdH<BE5uo
zzasYr-c%!n9L)H&Ldv0DlYJE6$OEed?3^CZgJVYM&K1W{;lkXZ19WZVcydlo`VM4k
zNOImY-5B1nvNx4F#rhd)8VDq0DG&s(z=|25k`=bV{KF<iMf0jjF%5I7KG#g40(2JG
zxc=}l+um37nioYJWq<JWoB!L26eqPzL3S*M?NcAm1#s2FVOCH?oVXk>j!X;v9FXzR
zJ~?U~FCC<dzT2kX{>2f8BO$o1ngxH}8M#MnGxccgVt1I&2hr~g6E`BKQ5}nvIHT+@
zXeZyV8TCCw;govaABGV$rS4xp9~vsmHBte42g=2iOe6WbyMJh{p9}_fRFV^X%i5lZ
z6}nAYkIEtTJmC$RK|-f-qi_X23BQz>s^zFuz*id6uu?-j!-4oX%L(FeHC|8@yT`S;
z^eTFhz4O*q3PxfAM2)d{7SZ`(+lam9q}IBa@@<WwQMlt>nh(J}YqIppD<O|eV=Il3
z3@jys9MU%1wSV=Qe(-KlF7*(TY~F}o?VdKGogdBNWrk@a@A#@ei4**e$0>ZD=D|0;
zj9N2K%;itI{?csHEH_s#hj$sLfV@s;KT<sCOLJsVfy%w?Dns$HlYW|v8&KWI9!5n%
zZj-x4^sQMy^TNruuNy#PqjQTIi7&a0c)(4>Ihuf#+<&wX7t%m{gZJb7<~puxkvVpv
zjPvTUj14kLEgZ>Bt8@Fa(uj^z0`vA4*TqLX@W34<;{?{13wQE5rRS|XjkCOE_|l8{
zOrTL9WKj(p5+)ja<<3?EFVQR|UX*FJ9>^68p>K~yay`&4p~J&jGK7m37IG}a<&!-#
zoezbO&3}tH5;nY=Lea*J7RKF(H=|cC@Z{OfQL{wWlJ=rgL<MT32!Q>bQMUIFUtnGE
z-<`u3bwQ@$cPzJFJKHm>$L+WOcxWD-PYn}lxP#kF2Cb`^=3q%(h6YV+&ms^mVn-yF
z0uXxhjx51L*N5Jn7Z3#Nj|XzsRR_gI)2KAxUw_#ACj4TaLnpa1k4pUTk5`idk%ztE
zhAF`k!oeHR)_KMpb(Xa8>A*<O^hm4Th%U@VantQyA|BD?d|Z01`0Egl3!|}Z<7ab}
zA>1&(oUyt;j^_n0?*+D=dm8+xIZON3t-727LqFlWspW&0(Gm_Sq=4Bl4PQbeUW_Bc
zvVV_0D!7lmqePajFO0gc2;o&b(HYmGFV+`mEw4Hls6tm!<o%2x&LxtBpgdLOs2mvZ
zoBGNS=y8~4IMfb9U?Z`TAWR2TrumAXbfPXOv5N=}mg=&Z2H(4sACzJx&~66fQQOH!
z7M2St3Xo)mq!rT}5ABsp+2bCVJ!{7$*MF<E=*sv9<}7Yd1T0l5$hqUuMZ0|hUv@SQ
zl$Xs8-R|Vce0IIy9VR-BcJ>;YBknX@GdHiY+3R@^zP@Q{bozwqLvL?y8##ncw!3W#
z8S<PU%CTvOogNfgqtjO^&1+uTS%bBaTU7Hlk|A69FLUJMQ1Pou3}e$`lN=1)?|)t&
zobMkVw9h;H$KSSLpfjKD?Eh(h_YFCJ%+&_2?4BH-?;ITOpLKT6_V@OW&kuGEktYQo
z(YGL&1A1(4|K-k`!*g@vm3f;k@t-SQ#kGDEshnUoqWtAbU!V+1oLY0d60(PZK?V?E
z(|;XO+T|UG&Kp8YC8ctjk06gq%zp=iS`n0)#%3VCm0eJpMSYc0=nBNdm~6q`H$AD6
zh<t}tBK~eZF}z6J`m;Po@LVDqzal4qJxss@IC-=rbBRR3Vv-_|B8?M_PKxFJYI(_H
z=^T+M&>4A=dPl4$v6S7sMae2rk}_#3;2xXiSQ)XaawAe$l=hiV$yVF0w11zN#)h^Y
zTq31)wl!bP%4NO<hx<q8gB%ScE_(+Ke)6HfPkCt;5~#@1SgL3D7DobY*VZnoAc?)R
zIlTM5ImWv5b-eFC*Vl{Rb03rHQ$F*=F$GDl)nq^y)X4W#28@c=`#KZHUNdf^7=*Qe
ztD$pJ@a>@2=rH?YeSN)d6@PuGOlwk^2%04<y*L49bt~=gYg_B<8}$Y4YT=npBTyX7
z#BwA(Dxz~E5@@&bF(0a%Ptn6t=Qf{iK4p{r1=7ZbS}#!Ssz#i_)s9{b<QOZ@UFXBW
z`>ZZJlLZ}b$cww<hlZ4Rr;o*$9m}p*yAJg7CQ2T?mE%Q$?+SK^rhi;o<0$EGM_urZ
zsI@a;I|P|$#R!&6CSB3e^V`Ba%26;(V7Nn$EnJ@ua)}&5$Vm8Djn?ySl9rAHAttR1
z-=9y1)(kpLZkwEd4<AaOOf$3la`7n*zXCx#&MP7=KE=1}mcl3Ok5ADuHX$0tzqQ&R
zurwgjDwcfNS2>9E0)HPf-|{Sm<tz2b94R+>HvIqouXId}Z9@132^y}jS2iuU>?xFF
z{GiIzF+HUUC;9U#6bY#a90rW~M&H|eRMNOYB@NPB7erRl5__2|-9^Oh9O$+jo$W!B
zgdCQ#ss<2X{*w&qt3oPH)9TQ=Tlt*iz=h_55Ln_l8vEeX)_+0IX|ATZbtjh{iNGO@
z!)Pl}i!20lqpFg_RBQ1ZjKy>>)t3Y7lhyL*70nj#TXhYtxig#P$vu6U+~@WcGB*TD
zs}T~7BHL2sHJ$aFb)HRv8kQKppko}zXCs3p=GPG+v5;nPD3V3fHZ@WsxaJ~ajkj5a
zwed%Z`DfgvkAIPVL2nPD?so_0ucH@#KHX`z&koyN0n{LbByU2z_{1dYy2q)#rbbZ}
zK+@&Bnprw&NETX#sC6SNTq%eQ1rkEm5q3v?S_yl);!L;cJ9E_WK0lj}ZKEzdgpxuY
zKlVap(Bk9AeCkqO5{g)}^_mC4bG}C8s-o5^3KW}9^M4!>Iz#iS8Ff3;L9atoA#-TP
z;OK*uRz#S#x)V9tx=dr{IWlU1Mlh>vz3^fgKLLltOvHm;oD{KLt)>ye!8MoNt4;90
zSEpwO-yR(9zuMpH_`Cag6kjfXm6pLBrZmG;u?+*B7cP!7U>K96kh)uzimwxqlQ7u}
zWJ+=7_J1NFo%6h*53kO4j?bg;mFWB=`YPyz?)Q$F<mbOHzeJC|?;Q@_GFrabmyN1T
zOB}NMroHoOzpJK*E<07ahCa>KOc;cQtbdSW49$>cGf$>QdP`FaS70s<g()s!S&tu+
z+j8dYCWgd8rXEwVZ`=|VzPLs>eTdeI*<06WjDI`l`*xA+y!^gfM{(q9!mCNf%++x`
z**+yRf@Vv(+8<olz7@~(kkcO$0W1vo!yp%v<^9iFsaJO<5eve;si1IBMnUEt)jfd(
z<7R)2s`{$3svce1(fxD^{mE`(+a2@3Ag2`(IMXs+wn{W9WFQ>b0{6^ZA~IF4{_7n7
zU4P(vE(*YmXPk*IkjX||b4-E<W36F_qnXDlk8!nAi@8Xp(MpW4ym4sCqLbsOz59Cq
zXh*(;%@7Q(QQBd$9jwU!0aq1P=aP*o6jfv>WeKKHArF)SXT^*ZT<dTcZy+}iM<>^y
z1(vg}uzf~PB-ux;Iv0!gJr|iL2Z4pr8-M0g<m-Ez-dU6I$J9lABn`!;As}z^+WD>f
zB@0Q0vp5CTakR!^Q#anFkz>w=mXU-gjA>PCx!Q+UIRe*)GJo7S#?ox857m7*?-_*b
z#pShYrWJQRZPj^;%?LJhl1sV^e?iMmTVGrf%;2p`_>=k6NYb+Asax`tmmH=+)_>Fz
zsItkhiNfdZr#D5XOd1}MaCz2T`rQYQWf(E~^#?zM#Tm7@S+B1wBg=Tk>7{103o>#e
zY9H>fZNfZ3J@L>$B~P#LdnFUQI9O=IoK;5AcBZd(M@x`nU(%^G`|`XJLB6DgXnB=o
znPtwdE<l}29z;y((gd`6ML9YV|9_WOqkC@-B&%!QbZWGxg9}>*z92(cxE@v&@*&}t
zlxM{bS%QOLgTd=kfT0v;t*%oa8?y9B<37L(FX;Qjqr9z~Z+Xsxh8jIQ_rc5me3`St
zZ)78{CPfevDo){`rn4=wr~@@S<9&spRjb#CUd*F-Wq8#*gC3nB;v}{kLVrROtc=i1
zInoJ2d{>%kg!~!HzVZT$>CJSw;+1*OljURZEFM9YiH!*B^I;Oa#&;#VWP<#1xI+sz
zo)Zu#tc(RZG0fhE<w-1?^-NdfQwt&^MZDSmVm<n)rkFfEl!^Q4w>x`#XZ!8;FZR0h
zr^Eee-4?CKky>qv$u{hn%YUA=4_bm_Gx9cUr+z}ccE2i6ggu0X=O2`>#QYVtgPOr4
zz5FI^ctuvh(`c2P{dnyYnbPVg+eEce@X==E!pv<nnEj}gm#fBShzw_mCl^H$GvjuU
zVB1ktj}N7D0V~RKOFeBU+l#u^hj~*h#Kze0GHOafEh$8zPi(fr9)ISWr9zr504-(+
zmdq{`tA@jue+|j&gkZ}LcNeeuX%*Y>{nl#M?8f6@+ZCV4MfCdo{Ingh5GvWc(9SMq
z!{VWn)?(8;aNk<ywR&WKH=`pJ_aqED1fyz7mk7|hNBRu(8n}PBeC&K?7!Kw0Q`m{x
z7<YD$_6d|L@8`n?!+&hcQtc4MP%<rHb=Xt|4Aijh0ZnR2p=H%o!^muOE%$}O?XVmW
z#^@AuP{A;h=h#7%5hhFS9l`=fA;KVcKbPu`f{e=ic2_x&2#q8p4H&X6>Y7=NY+V@i
zsyQ*ou)PAw%UtNXi4U8_mzvR$&$A__z|v87`^l57uAkA;HGkB@HVkfrq&nbGnSoDj
z{22Ti5_YUIop2bf4(kehQaQ^H2xG9dnx=^nCEu1|pQGq?%GGTWm)Jq^xFr_ihU=el
z(rRg5Akrri&Cs3kBV7yGODZbjPqCluRl5hXnOEf->~0`HwA*}yAwN;=(a9j02!4+_
zf(=~?UQXskkbmjGZKG2gi4j6Eah?xtY@^`;)x<So$j8VXg~YEzY#ZJ{>j$?aC?s2K
z%5oZS4@UZec1+#cs(W^C(;jDx0(5I;zCruT2~yyCguc4E)%<+5R&%me6b*WUze+-g
zLav$>7aL2ZRUhI;U}a~waoN5vJ76(D3iisf@xP{LGk-U`9r1ZBg-6vSy1ns4aB)b_
zLZT>~c(LIxFzRsTB%{hW_}D?OgHLa_jHuokX1&(L1{t)d3IrZw`gAWneX_MlKZM4-
z_Vlc!3&g|2*S77u3vy}{ou0JMUm4k@1Kam^Cue)xLIk6<{KVdi?eJUIX)>H$6HJ3P
zhpedW=zn5$_h>I}zurGQTx~?FlPe>R!i;nm#c%A~t$r`>z^6IANrq;Q*9&bY8>RW&
zH1)KwD`AvN0LDJWMlZ`o{^EpHVa=4x&2tPNyDeZ|6*N{}>HC(nyf`G8Et%j4)R?tZ
zW_d6VS!P@iW~5^=9HZz!Oy&E!lkh*o8~6a)R)58&!)td(kC>A;9eQ7qhMTOPxtwkP
z9t44=?%ZZ+IhqIuv(aF34V3xJ&Xn2IXrj8^DIu#aG~1z@j;9pQ46FHw77!)+3<+av
zPN@N#V_k;yn)*jHE3@&ebkp)MmJ&a>-J(2VX09L8(BEd@#d}8nK}{LK<{pB3@4HQ$
zRDXIxJ*zn80_NeDKL13_W6NHVU_iGEIZfOBHv4iiH?OR2ta{hjtg{_$u0Q$WsOFHo
zq0GE`!I@RXoskOPMXQ^yveox9t6#^Hyvo=2*1moZ!}?VW>JiRv##Q%1zm2vosTG5?
zH@|8`-|X+7cD_D&(b+p-Bx#NqqW4;}(SM{B^r&<$Kk_~xAsGcHJwrBwT|mL$2IY7)
zw%17jrI$HmXM#?8^Qy$JG|}*O)kQaVY-8eCGbDW1=>z3@I~Ycbu2Hr4M-Bo}qJX$E
z4FNuabXHiQTOk8uGdgA;!w*_-CnICG#dI<XJ}YJfcugT6!|dvMcAMhA>_lVF7JtDC
zL`!@a+p>Dlov*I@Q=}7A+X><{-6orqMyjOgr`(mBAF(Ufo0a==V^g-}f6|`gnYH(h
zIV_f5vwZV!wHF^mX=c{RjzCVoX+j|TOmqhvwqVn_%`&gZ(<_k=*d;lP*BapJ!Xh~K
zfx%o6PLA-~IoqGbuQWqK$&9U7&VN3zqL11S&62Ao#<NJf(xq*_yMzWGEhocAAtgSl
zk}n@s(Bq>;l6+LA%9V|k@N)UMcyvE$KB}P3M-L>>N7Xd?sFF-&67{}Mk&h~f^3ft)
zKJrQP(SuHkM}MQk;!)|mc=WeCG9G=*sqyF|4-OckeMb8pE{(?-`r=+Te19Kn{6NK~
ztZG@y`GQ()`le$AYE-MqgZ#t_j`_-R?Zz|fe~5O2p8pEf#=ia#@jm+9@1oOWc6~ZE
zExudp!Zq<=q2GRKLEtxcK1$Eg7Jr?R<68N<O+j(r96Y>{4^(%87ayeSco7I6veEt5
zybZrhzFLnsa)u%s9L$&3N`FJ5FMS;AiXfI>$vrB##b&MMu?n@lMdLZWvW#8oeaBSz
zO3m+pewx3>@M&ImWGVf-A!lPdqz~IhsD~D$rdFdoGHbZy$Yu^k_B{R^ETb=l#lV7q
z{F(&hd$F1e!RP8;OlGS{z5AEwHCg{}`0Vsk0C8O2xd7-MFs)LOynk%m7KN49jOdo8
zh|f3}TSVeUU^>>GE@T3!Sr+B@AQ{4}o3l@s!D)+YU=hJJV}oJ_Ss?*}O_cd1gSzce
zH;xe?(!VBicQ+n%9hg-_*~L^}>b@DW;rSXaW-dt~7p#P)3z9TJ!db2M5{G>S5Vu<^
z7^}TT5UMgCP1F-|VSnLeKc;-*VtT}*!>5u?bHQEwgbi=L2Pd*pnywZkd~Q>=uq<eD
zWj)T9m#ai&4ndr8m1!!A3|N+X<K{@LyU8=aF!j^a!loc;mO{R`V%faM%8Dxp|AwG;
zIYN*AWYD>BdTS_4+#z9x5L{<=-$Q84sk-cZyqq$@Cd;}^`F|PAbJ=!&4~5(O0P$L8
zg$I65mA+^=Hc4F{x8-n)<dRYqy*PiH(R5{40nK~*PEvfy8j(4?W7B>n`DF-1B|pJ*
zZnQuj(@;(cmnAvm;#_2-P^lbKbDc~FR4`AS3(?xvI{b}BqbT4NXJYU&OoTIat0t%$
zC0F2rTBpwCUw<V-c6F$aj`<DB_84unpV}eOS`e3{^EK*{0i<i`L1L;XU@xd`Ry1qJ
zC+GW&J&M4wET0!zvN)j(<(a^{4nl`{!)MqQUrEQ;n`fjWP0U3O(BhI5Msw0mY53_`
z3WgN~A$Vz@D2O1iB!;NL(>MptOqZ9JLf}1&+cPF`e}678EHRaqmV&Deh3a)mHGt%N
zkena(Gut<+fu<YxeAVlo2n|gX3zg8H5*^U76UXwP-j%H~9U<YsZZ(lRcw0$e%aUe;
z6DD$S9t8P8i>6@-325R5G1i7y1K<zk=18_`7S|k}VKzaAC=EPPwCXi%IhT4Y0CPTa
zm6?@zK7TPwzDF^YDTmljIq}PuT)(7aStGm7_ILJ<_P@WNG%sv~Q7SkR{6y`-hFro#
zP#~-EjvxPCo&MBAn<?c70$wI&HnU{P2Re<IBB(`<_`#f+(UeS-h)L7KRU+E{I?wuV
zhj%p>Rz61P{fs^Gekm2Mo#E#!pnufin*EC&x_`9~XmYTBXiBJ5AZNS$x1wdfB(^Lb
zvmgpcTo<Ey@(1-Xm)k4P%b{%h5&gRgzp)LBeCF<Y|8oy=riFW6n1AJ>%R1XdyjWPp
zrWZ}`9j8u0b&JPwZ2qB}E*`qxxyW!w4spR9HY{&x3{$Nlh`5Q=@3f4O;}K!xlkWE%
znt$#E6mxQ+Ic&^sjrR9B>Oj%#d8wL^d1O<&0Ojr4Zv?*Gm-KB|w9>AY!sP%Q4G3^?
zOqOb|UFQ=I<=Id2v7$OSlqQR~MkPE42s?~g<RdsoYtM~@q-St_c~+-@&9=89QjkI<
zzO7EN#fp=kCGCR2Dd>e_ynaB|xR%f<1AoBaL*@e-*d-9Ea}TCMQT-&m&f)6V1g~0c
zw<?ne&2#u*KIUvN&LTqa{_U7*9ZG)5vaF)$<h$ejGraG<#o*h8pJmwaGnv9ntswiu
zW$8J6r3MUbI+7*#g`gEVLi-;h-R=W(>^Ot9yX+wpi>qCb%JwPZPM3YA&Tvs<;D5ZZ
zT(qDomy*}-OVINPU};8P_>iFXvl!>+9cm8eLsADNnoDYiSHJ{v4KpNEQCVbHoJ~Gv
zX1V9&)av15Ke&Wh&cE{t9=lxVGcQh#KU$*@GMl>Qb{yX(;SIT8bWTeKon`I$_+v7>
zB&F+vGQwO2n30=P1#IK~NIF{XQhx_^I1Nsn>Yl#paP!Z;;)kDi1(&5NDT8cdlswlh
zX<=O_-#7LAgzaT$CQV~h3s1(@0Pk*#-5=dBoVAeiYmB2!F>>=M3MJ26h@j#_BKVZL
zs8D>5A9q{HB-6GfBXd3mHW6Sg2+p#>jDHZVJ&jq7iq6ju>mUUrXh~5^u76Igm3r2?
z;;k_g*d3%-C}KV6QgCi}KGu76s-Z2D?(3BWS9|8NwMybH{VEy4sjWc$QG1?o&LZX_
zK&UFD#IzBfv3aPpW6`96Td{{bBSQ}c9<8~&X_OM=`jD6A)VX$px1EN1H}2mFN--Ix
zG77)Xc~;D%6xokZO9mL#D1Ui};rrfDO=+SXq?%ZRky>$do2zRQFxt}H4Ar=<g~Cwj
znhJT)A_!I<k53oIOs!oSwxundc|Nw(%mos{MEdK=4fu~xMkoiY>Hq}ChqAK7pg>H{
zkwJAo=40EFCRI{HRpXSZK%s<^cB#lM9xOHE-?j3X47tOT(3v2a4u6y>m#s`CYuFhT
zRd>;&Vv<u0x2pSC>JHX;=}j!XfD}|eV5p)?5-baQ-S)xZ{_*a9=k@;1;rZ*%;mNDE
zlyO+bb|4!AE=kv2IR%WgzyO`hp>ipTu?I=z$cMIxXWg@RPWeVeV#uphVjd8Tz8!gd
z#0IEtYs93$DD0)f<bSTsmKX$hMldsF`M_S<SZ5}!-75iA2Z5-zd!_JH2~AzuJ=$Ao
zL@N-R@NayH|CSL|DA~sA`pWk;KTvgx0#$90D#xwb2-PjCy}z`0D`E@(7>hoUMa5a~
z3>tS{&Zw?81HV`)T9rz_;$oLLSdhxujapGx1Ax2HnpQW(7k@6ew<kM>7d{BOu1+A^
z<v9SrHbH=NaIHhv2wZ!m{Nzeq#58|=itEHd^B<i}#`&!-Z$p^47XYvC5Cdnt@Tw2B
z7Cyp*S$H-WjoSQSwSpa(63jW4Kq0lXICQXl7w+WwSU~<q-r=R6_3CAUak7-|_0x0{
z0E6wjabH9IHGl8G!sbU8wyr&}pq9WeZgs5Xp1Men`pd!vudSS8KI@sY=DiR*zaFgx
z`AsBS4U#({JqCi4F*2|_=u`(y>l8eLHQF&OF)3!=uDW8+rbUXudf8#qheX4)7x68A
z+?5sJ&y}BCsk?#!5*OtsJb7jqLcinklSP1C!7$598h<Efy8*mzc$t_XkoE+lfamt@
zCo$DJ#Kc}CMqJEbLzWZUYb5P8<!&>dUg39ZbA9v4`jgEk8&95?KU*LAJyOXIf4_IO
z&E`0^A05%2*xd<-<iS)@DIcj`7(NDK#`*c#6I5!*DT|)?Xc0C0(;2y6#|8OlHk;9|
zt}Qbcn16#X)1@yrQ5@$eAE0Vw1r(VVca#-gOQ?}IFQ$CDw5W(r%Z$7{CLE`fuq=hb
zo-`?N^5FR3+~^o*2dC#z5G*7qKkBAn&r)2`uzTD(5Nck*xS^L3Zj*S<-W+${oEq(Z
zzq7m3+1)=oKX`eti=R8DH|INN=OS-ZA_9MW-G3A~#)2F_46U@XJW_%qkQ(ehA2<Aq
z6a0+8W%JD_c`~6=MA$p`4DWR3{B@TKaHr;^94OvK0Zk$+uBm?bfBg6VTM-fAvPf1b
zbM5UPpLEU-+xS5H{N!x^nUwJz<v$wAO{!}J+GKRU;6*8gJC&;2T+q>oHAVD061~j)
zoqwZO+uW_Q{Xf3hZ=X{SUc5QpJKTT9#TJVp<qQ^ODx{6^yQtkhq$%mVG*V^>g@r7g
zAsy0eRF`2c_Z#)=R}0%oh)HkLyBSoWI2%#kVQjPsR0YT3Vpzs>0=}^l#pFW>G9J-c
zz>JW)$=zZIFr=Wi&~+Iptrk7m{NZg8#eeiCsqm{Cn_Ewwe)jnnt5H180q8oJg(iX8
z3kRO;ab31YNBlaO1I&C37%g4*lgJYp9Uuj%Dg>503~{-?-uYID1Zh}aemfuoNKl|B
z&d=Vo&-po`(*Qx**-m~ivmAK?wg!2aPRAkcQ9<@k1k6QZEEO1`C2;+IaK?-fg@3U@
z%gq?&`y~f*7b)3zibW2ihk(F}t(oJkb(IZ_Fb#-MDSc}uj;twnVuK03f*HiLTV!)7
z9qC$5rdN~?Zo3m*+y*Y4lE3V|(GP+9W;RVzHZ;lweX8ylss-5Tn&IpeZwkq@<e$g+
z_{@yPqOf--r1bbT9-;Pq^)E4s`+sS{z&L(hs|hfxD=bt_$*wt=*Q;yqx%ZAScrn(p
zDId~;H#7Qr*eK$8KE6$PyS5Y&_d}Y!FPx=Tg{Av(jXMC*5PkRKS|j98c2s>p13vNA
z0uSv+HsbY&ooD6@cSW##0Op<V+8<vE3y}Yv^sV{7eo@sj3i{QSqAOD<1%K82Tf5kY
zWS{kY^G2J)IG5HJK()VmUF&Td?hfgct)|!N9E7iYmQD%>gyh9S7-A(g50*G)zl=5D
z%$8EJhXb<itt7r2#J&MOd7Cmz_pJjF3{NOAV#D-ib19~0U4({fDuAjvDQ=S~9TE#A
zJPCrvuTV*@d6uXa9$qMUd4CUFPZcs!x9*kjbU{FrU++}DX87Uv7a1)T7A2-D)qT5G
zQY0Oei;S9~l?rlGInk4eEhZX2xH>4NMe!7Z0;9FqlaZE|(hO>6E*m32n?I~*Xt@|@
zogL*N@{lHnWgmh(ROLe_NyK`hGCI^fD;TH|1S8vxzJ0dW4hzJT5r2x7RKIC@h1`Nl
zIHW@J{$+fXd^%!6v~#T?A&<1^k$r|k7U<f`h4(%rj?$fH0;p89cwpc_v0*!LKlpIH
zq!{tTMHMp?FdSz=<T7umRE-O#nB;ql9s$jTiV~1vh9eBXK=?f@g%=|=@bQBKd`~=X
z`f>=T%L}b{vdi@!hkulg;}w-L|3{W-0co!h#@NKe(+KNlQis1i-EAP$(mW#7t}Kie
z^F}K1#o+2PZxYI4CNG(l0xk*Vh9gq2;-|L0ExSrAS-=2m_%LZW2)c8HaLGVq)lQD}
zwezodYGz*5EO>6Fm&$+dZaU&740TKm)mUb&oy(1^&9<6c#eWgn{?q2>J1U%1x9w8d
z*tYpL8a=j0OSvI>{%lZaH+Ic|NJV^uP1eU%n~GVr;A?|k({za{<&g5xYnFSp_u^Dk
zA}Y!)f8W<Cy~d?n&LrG798F0twn4!>3uMfA(CdP*S=EY*Me>TXyDD~GsFFh`ykDLn
z6S*OuanTVr_<v|VfuqcjeLTx!7bz4=^i!P`d#d^9VJX%r0%^qNCrqIi##E{>JGF7f
z9`!cNNG~~#KMdh=#@4F1sE^c+>a24OTojpOvs|?&iM%sV4grFS6{Xnx1XTvSg?XG{
z<1KK$-8Kxbp0xN#LfevfIw)eLvwFbZ{d|j!X7px4o_}I{I4m-GD>~tuVmO8k@uk!f
zVH6}OOzt=YY=`_Uwx&QZgpE&%<5rwzgfXr0U()aidFqNXP7=3P+qncsuSy0<N?!rP
zqY@luu$DpNgGNrIGO|@Oz``s$3kw&Zd4A79N?=S^c|H)lFRA53v6zYhZ>vQG>=`Ch
zs-SfHfPYGNOV4`PWGMiy6b;NnVdT*w_qU6m-KWkDE0g*4tnhNXeHfS~lfn~DEtr!%
zh8bOrQlVUwM+F(bSDV@OwHaF^`u)mG|9>cD#<0t)j1aGS(=5Ftm)cF1-V#lbO2M@V
ztY^na6-*OjTlp+4OBUiQ!=txe6<AJSvY1qUuYZl4kl&_LC0r`2#Vg=~SQd-Q7E;PX
zyJ|b>V8#WBpHvo(WGjE5S+kqVyDGUPSUxuuhG@-a`NT+yw*_Cw1f);88O)00#zx0E
z`gO&VAjtXT9-5_8h1#aZln99ep=g;U^BW^F>_?-$acFXA8t+1VU9EWl>6;_IDH%2v
zr+=yRF=CX+@3>AT>9*0vN(EdERc%HqT$O7wpTY#RvS5hk;*kzagD*G3GP-!it9HxX
zA}-@?WXC;U1~KjD>C{NUhL8SR#FD4{6mY-*ERlVCzB_ES&{}XfzdtUkt5O^37qRV%
zv-S8zMQL*FJhXYvnN!igsCZmrq^4UNTYva3E>L`TVF#9W9i7cw5C=R`9}9f4=ClB$
z15hz2+tQkt<C{sp%XfCKbFRX>d$4yF^(dNK$+Lf*qm*d$T?*>E%01HSZmc)y|Ft$g
z>qeM%)MmRAcgU@hh}6h)V7Q=UDhqLwYQo9Esg0sXAGliwr#GKz^%j*K_)bNgSAVm`
zhN)rwhG6~b+L7V%RE7uBy{X}jn59h$AjU+A##B@65Dx4TS%ox@pynS}tPUbiC<w;1
zQ7R#6ttF-p7#>2jqMg6+heV7fjMu&6wnBemNlOvorBw$)<XesOV5aL+fi+Q(_7j<o
z%qyv)nkb4Zp@~ED5pmIARX|%>NPmV>iukD=$q8{Wve~#txi3gMHx2JVJCizNFV9Yn
zgx>@Mk}n>F(24E#Ys_m<z+1}eP%?`?r)epr594(*SsmRSoVE;EQv62O1$FpTMFk1D
zStBP+H07i>zq&$-upMf`#dNzQumr<O^aJ7m(ugC&?>z><wc#&q<|{=!%zq^GR1H8=
zK6C6G5kE5ml%Y9H@Mc-5=iZW!9CViGO8A}RqKOo=quY-olj$`#!?vzaiR64Vda0tg
zkdI78EhOhnvwoF?P=N$YL{8j+HdO8pn?Fokg%`kwcQ)d-TW!C3LW$(gPa@?}>)jGp
zg&yU~cm<r)+`<LJu*U;rNPjZrb6CX{7Kb<MHh0Wv?LsMpz1=6TughcgbbHGh&9bm$
zK=EBDg<*z{wYw#5%bacFv*t#8wt=soiv|&}ZC{-&vF&K>)D<QBwry0co7Q=X+Gqiq
zYKRz3so_*T{c21i{FqS6M-vo0Kp{`!Q9C}9B?BZ3W%P47k7f}d-hcT^wD-cvuVArZ
z@icaing!qjjQ+#2)}lXMN|r3*7=0fu3Co<)NQtoNyGcr+sI;sSe8&Cs8_y^V@G?uM
zK2IF<lqaU3Qm^)tNa8RzL;GQ=v#+PA*$Dt#=aNyLFZ`P{olxhf#w4<VX)k)gRmAuC
ziIBUJ5`r<<NV*X2_kX>oV-j^?rFwGJWV00eUCpJ@(}7-c+s$b(UXZq@XP6^>%uL#b
z>OuD5g30NkmeQo%g>a(_WWYi*!3K6R8H_{Cl77Yx1C(0hq~I3(#jg<f)!Kc%bJ{ti
zB=_d^Y&5JZ(7qoYSTzWg|M7P~&{NKd_XJpLczU`XM5{|p1b-~9(IKLzKBjf)ITecA
zd4mX61WIf9+q60&HTA>_*USl6o<wKC5Q%rPY@qA9vAGUP_D0AIj8e$lp-1%tO@Crh
z2oVjInT_@}crdorZK9>V%9+c<{E9{WA96_2g_&B*`d!A$UU^peX@s)NRAl)eIOq9L
za<!&C$=yHh>3@Lm>q^s-P<EbhUFHa6KA{336a!+${A7LoRo07In4|Ue=-}kEEds}k
zB|T?v^UCPJK8`#<X!DrLU76V%%i#71Y(r+8B#|*$uHh@63nnytyG_p)A(km$?NohP
zTgfzU4?E<|nVu;#B+S2GAj7UTbbyL_=pENH5}}t%Cx3?0-SxtWThS;^N(ST)xvyBS
z1dl$E)FlgQS1GqAgPW{KJsXm5D4Nf%^QoQSbA?@(uMX2oJAAD#6LkUP+{Fr6U<NNQ
z#qmT-%?jyHg15E6hwl)bAM6~JF5~DxXtlX9sQ%dZYmc&IWR0qEcvoz!63Wi`D|Fyt
zx%G2IZGT5LNhvt$EvPybI<l5)Nof)fi;6Tjqyv6bJ|_;OUZWigS@0ZtFF3^41tt00
zhSzc60UJ4w5@J#2lS1_z!e7Fy$~vOmMft<q(G3o(;|!%MN?DP_UMS;+moVG`iF5ZX
zhL;)UxhO0F-18=Vn#@QkAXLT<&chZ;rT9Agx_=(-MYEKb4Z+Ot;OQNGZkC$^Q_Ay^
z)gp}QOetMT?I3UtM2o(a8XCfmEOnW<dw?e8SFXPw#KqcO;pdyCv=l`~q1J|q-~gfq
z7k7kRJ>OOK__5L#T{hgWpfa2P)Bg+|$1Bl+D-t=3KjkYc_bkjx4Nir}k6%$?JPsin
z6n`DF=cL}Lum=^<NHpXANZO?Ni!&kRJ*Wu!^zY?4{6i-u>Pi<h2o`bD$;@9zGTT>i
z2uL|W*_Dr$aH!n+cSgZ8cbn$ZdoPe_(lr0Dz$J2zp_nbq3zSrJkYR(E(b$<J{%<Ga
zhl2Tl)a_Z>H%DuKwz3_q>_FOFX~^{*5`QOfo!mveZ8@v#0~&*eN0RAy+YD}79{p;X
zUYVDlZ+|87VVn(~Zx1M6dHbtDFN^h%#0`u2Pw+&)1dCx7dg1vll?qp+jWVh22Hrnh
zv8fmbd(j%n38Fh2`8V#`qBgr>0S%j8=4W+F=5E&zkQu5~1e6VIbJ0f&E@0N(R)0s}
zSN`x7rbzS6p1U|h3bM7|G=$VS+kbU%a$KFnwrvx;%w4FXv4E<%7a155CONY{={&wQ
z1Qu_sSh%i7QoIZt4s`1!Lm@K@yZ@W^<HroL&A};%@40{%{nQ8n2lVvp?tT(S#F!8_
z7N7Dq%$y8jR=H+bsuH{(1VjW3dw&%d^@I=o;^3^k^AX>|u}n!ov1v0FJAIr4yC_;C
z-b%^l__BD8BHe3soseCckc4G2bEx4pVm}U3E!-^K$g2RVjv06qJcoiS<dV-3C~l5?
z96Pnz&(Z#LYP$2Y(H@3#BIloLKgaw({TF|lC%dPMJo=IxSY7k}F7p0Ds(&I|4<D{d
zy#xgGE}`ONmcr5aajw598-p}Gn0mT&O#iGoC*rA)tO5_sx+@@9XzLs-G`dR1X;3Tr
z=jdCbBA5dK%WTV*4;JUs<8nU-hMkgpO~?~Pl38bQhIkvXH8hsHW!OPteK3~`Wwq$A
zwVL6CxCxc~8K-48ic`~YGk<WWsA5<$Kw$t>RLD2l>WH9?i1JV&)s-!}@)n~d49S9_
zrEEClP}3OLtZ+F^7}-XUM&szsn9@b5UoVsCl@@xEs~pbfhwO;R>UZ57T6rw$lo+N@
z#_?VXmq#Gsa#*0SQ^Y&5=*3wg%_`G|#LKC+zxM8n&pMwyp@6oXvwx${o&?KlTG%-|
zJ~)209eszOM=MOT(IzO_M|4yUM4|#>BF1N^z&h(+t894E4!#xoR>l>LExgSI;HY4e
zZvphJ8Kv;alQu!lSx2ARp1KG`N(b3|WX(CIyA{houOUJ}%n*wnKwGob(kxbA!iCDt
zz=rkqc{r!MVMfWjY=1N#87;t&9rR77Y1sYo8Fi(I)}A`hd&9`49DyL7MgmmNheM8s
zp|q#EXvu0PgY{qBGw*jG!D8NLI&=0E7!6)v-wSpb%vabU#}a;LGhx|5<d(L$M`2$K
z$y=twm+hToA+$WK<hgRTbahExr>J2&CEr>S!aS6$;9)c(I)8XhVDU^IK-UNzf8s{k
z5=?pVK{V`gmFTBY<^A=TUGTAc{8aKBw#{~Qa0*Ks!XtII&%Mrw1hl{bWA0HrQy15%
zASi9KtE6Sb8LIxs)p#CmbJ2Eiba4?cw6`JbIQNQ~0VI?C9~cAAU?Jda<NTKQ33$K8
z5%8))iY9iCb$>0=;Z3>dADKULmym|VF!RnmXp>e?(JM$BLchu1MY77Wxf&J|Oq3K@
z1Uf+%K;GS|FZnC`@n2+qQSs4DBc~o4cH0j~R>^rgh`0(U9h>H^umD0_^{!x-0wHS~
z9WCduTllsdjEv&NG|N88a)CU80H)fI4d+P<chuoQ`+s~NkXTAMe0DhA$Jua1AVb3Z
zpgN>VQsioE1A%}G5K{d?#Y%J;bwO^Y2pzs<tyGf^;VI(BOZsX(u+GqYY?~n(Ogtdb
zd-)I_4EfB0jBvWIjqBQImZX9S1({L@f?2y)l8KXH&zYh|V!2iqypbdO)@<e&h2<PK
zPo#0-<A0-Mf@&P7oG>H{Y}Gy&+tbA31vZu-h#qJM%zYav?Aqx2`Tij-KYUMna@Y^$
zieH+x1xM;FypqxrpM^ev>+KFRjzZbBPE8vQwR89alpuX;7_QG2>4FQN3lD?KrcfTU
zz}saW?6`GQOv<)gW?#E;#F2>P$bC*;_A~RRSbs0!rUl-6$kBu_43FyizIm?<Mi*H2
z7z$Mx4n}^QzMF-e^v{l^oRD96m2m+})KbmJR82)dH`bR=F87UFujH088c$w&$f!D_
z$*&xk_rdoLaC6xJ%bHh7rzQCzh(Y_TB9IO~ElLOIAUpfuY=5s~KK0U%apus8sz*Z6
zw0|s*;*FEjbEE3+9O@fOMAxcE{TQ};?+4P2E#2-3Ld5+RqHP%F47UzBvFV)H6sv%~
zOo?6EHhX`^C>Yx;{kK@tiPk8bch<jNqOxGOl~j|uFUdlcH=Rmu3q*wZ5db&YbT%i`
zw3s?V$YozF(h>kH!XSuBTwS>7A1*TqKYz9SI>hhs@fZ;B0CGYG$9A-FvwQjmUcBa0
zNajc6q&0&V&nAaZt5eN<{4-w%!Zt)DS;xPDd`-?ycBSMu8ALbao#|&`2ii6V<(TFE
zoUhUWNP+Pio?}lULB>ngmu?Ekd-wh-6Wd=M?ws$p&kda)?(ekspLe4*xai+sDt~P8
zMN&=n>%1m{s69=g;5Y!25V5!fjPm{vNofw54Fu#)U}q)F_VR}JVjMVFij}y5#QE$S
zv7YRYju^J1Kkv6S*k(F&hc<+DLlft_5Z}>j^AC<0@ms3FS2a8^(T&K`Q3OJgdIaLD
zsxYxe-LKmx$DNl)g6`3Xx?W*YL4TnP%0yXPuV?oCYVU<DC;R*l`1SgveSW-iwEvuH
z(b_5fx1tzgOFoli#cl{A3H{hc+FOgAwL2o(kps-|%MWpqxS$GkQ#{_V;q{S;*0(M&
zv$S_rad2T!ih!pvs94msWo{c(*dF+&%aO#C3V;5YA@4W3<Tz4HF>|sOxPNl4sAAox
z^!rR<#kx;}*c>gkt>%&%c@M%fDZ+Ac4x1apWtI*H1>5(8Dq$8KC1YZM=0oA`0u^{G
zDnE5eg(!?B*E!#5f799j)Bf%ooE)9Alf(Va&e?I7p|!~g^Hc3NE0)yv+_|{29bMFZ
z^BZ&fH@{iIn#03V;w>u;x_?W&1-Cz(O-Kv<$$SN%ZJST{H*X7Edb;%)UxEaB#5+&>
zCcX3eho$Bwf8&h`yLN@QtKI`0R9sfg2W`#zt|{}~Q|}gihHm|W|9;OsOqF%4aAL1q
zb-Q|Lw{?r#?~%uZI$_$8FEuJ(^|$`w>z|Yt+}jT@rN!?HnJi2dfqycclA4Q2k*k8+
zkJ>EWRl^wqr<l3LAIF_NqXU``!1;GuAV^61up$A?_Tk^?12IXYc!P3pDk<7~nth0P
zd|t#b&c&Mx&lEGm*GBP#s#oDr)37&Yp0O2XROAG4Ly*Ax6@fuy)}>&GAIQ8`zL&8p
zDk5zuxhBYn=F(HSB7fkBxKfj@n*T!^D+KC)SFzz^undfUC4FZ!N=z{Xm7OWg&{y}c
z9NOtCBB&i1s**J`QXk!swbylDv62qFs<Ub0lgf%ZK6VA19D$!al#3N3g3?3?Pgwy|
zp)XjTvI3?;m!^ga&Agl%=>%yMvMhLW$CFp_%AZKurIlZ?j(>qR`2}9u$vQkZe)A`@
z@W0f4@f@616t8l<R0`&N>mN!mFNwpOA`Wl;7ZQhcR{wLw;SZNGk8`%Z$OXTo)jfjd
zW@K0B*9n?3ZRTfHq3OT90P0&KUYLi}C4%Jz0DE=0xGqf>%lO@jN}Jtf;^ayjm5Cg;
z?0&ZX#IRhm@PGY$%Amq5qkV2<+q<F;W8{hpv6L4%h~$H%TMd-WW)06-`ag(B$t(HE
zL`qbcI=9QntLO`xs5w>=Hn-M4->eokf3<}7k0Pf13Q5!7{)?{*eSU<DDC_=TK}PgR
z^b^a7_e)>y!+%S`YjJN@GgsMR5J%la^BDviG0oc|%YR)dkMom>c-YD%5f5AWKS9I`
zU`#4yJAUGyBHlkmJWs?M|3iv+OsfCICA@!1U=NqT0^anAZF~O|w?3)3C2$x2o0hgJ
z$nnz&UDBx{?N8I$iS63O_YaW97CQD%q3j=7D1-OBN))3Aj(=PM?7yPR*#*TsO!~qL
z+w2?eet)>wgqXm;yZ`k)(ux^Sm3#t(^j7m9NHDoiF8P}Z8D@e$P_%F~^7r%>g19QY
zh5qG#WN+a=_R(&M;O}YxML@d0MUk)mT~BMv4<2$pdtBmgcQF5hImEo6{PF=E1SS6S
zp#GEx^<uo|0}pKP#b0%BZ~nax?*Fk*U2oYw@bq0=@V|faDZE*I3UB`N6#liR@B&f%
zT~FiE*Z&z&^1uVs4|vxs8Kj1%!o_gNh5X26=#5<_(`O!B>`Cti;Q0Vr<CLS~ZAQ8a
z>SGDePBJVv%VC@iiJVsFI3>(V>N@8c0SXAIMjZSp$SEh2)UO%%Dkt0)Jp;=@%<-@%
zi5vOkj#7U@_Kw?4ZbY%nkkd2!P10j5LrHN0DtV9?ct}N9DMIQJB_IP}Kfe?!PT=>J
zV+F1t7`%n>nsRD4LpA3%3zBa$;EflWkNon%oM4E#3W{G=H8V^|YN`qrHpS3#71?x@
zWWyi|x4ERu&yPq3{uPCO@O}pgYe^>?)b54Brf+{q*6_v7H*FWnZO+c=m}?Uh`Q?m(
z62|eo;PzVyO8P`=+`wWfpgM;bn=fAQBYS?C3lH1y<uHAh0mg+hHXhyqhnCU0ls1I)
zT6IZE;A)?@$?$CvtSc&7@LFzbA_Ac}4=nOD!J_*R@Ckv2P>BtKtD<zeeohE%cDDgE
zXPSQiE<~4@zyuc{pJ;93Y_JUXDb^Ob`ilp}!*$_mHI_i7=t9J36V%6Vj~L$Df<|C)
z$Z|ANYoU0glxi^_^%^R#rAAm2obeBZ87H(l5~nHI`ak~r|7A0JMTyX7KwNN8c0}hT
zupp|3!t_zhdqsbm(ZB)Q!B=+=4<14h{b7G5R3Yg1G5w0o^|}J$rvo(m)=+AHHgt`?
zwWJG)iuM%cAGA<V5hNbG4!ZD4>6%~7;+o$goCy7X@LtW&pH@H`MPxQ-grR`zTJmF%
z=oiH?MeTnzy?So`R;fBtgdAHPTN^g>_>Bi*;WcY^sy6!XKzxyg6Dp2Fk3W|i7A${<
zdqUrqSIl7@Gh*YGf9YlvgWN3gX=m?A(YdjY@ZO3i!#Ox0t%=+cAP=);i)*Ss$pd<o
zhAdsNk^v=Za~7o6+Y6(-N@ubEcI8kjhiPk7A~9H!c!8X*xN~l2F9&ja_^xg!1RCKu
z9PA<EshCST{dclqEl>_}C}XqqkOY5_QF)VR15Z7LYJ*}Ugp0U1Cvp&d^vZKjWAn{^
zEWHeFD1T94o;#XKEz4lZemTcy;X<H}837wGO5QLmI9G|!S5fukN^ZV?WJX$?Mz4qt
zho=(a%Xf;mb8fDhtP4iTWXj)s`k7oN$s;VD8QihSH>+PU(yP7ld{rLQ0P%l~&z$Vo
z&VIz{jI)fuQmDetfsc}kB0G!NqjcOE`7ppBEh<1reYnwXX~bOze`hAoP~R6%zYLo5
z3x~5ngls*09VtaQc-n1~x-8hDL1#Y*Ds(AeCzb#P29`J+4yWug9DM@<jqXt*n?lfC
z1W=>Z=icUe$2=9DcLXBDV|ss`0WZTtHpb{)2JpmouU`OJK1QK9Gr^|guXjF)tfO6x
zuT5WKzb_(!b>qcb(O*no&a^9C9?T0yVZ;!2%Fv7?Tg!C%#aY%qH{9;d&0?MGSOu!x
zYMnhSgadR9v74I<>d~!V0F9BhAHoR+y^tA*4)Vb~!Ln|8GXz;fPt||ADA=etDku-W
zRBg}Wc8cgUwFRFE2jg4Q5<{e2C@6v?wyxn8oqAVnN~nKYI&lJTEMGQ@b^>gN+YF*_
z&?gIR@we_nj3NaD!bEuVIvF-I5i@K-+)@1jwU;gpqq{}MC?O1Rt(t_~e8C;D=N6N+
z4}1&r`u4-9N?VB;HU58Boi=EK-=YD=IGgo2F$^uvCb2?K&;hN3H8<Q*Jh=BUN2XTU
zA{-Oabd1hG;#cYPCFEbi;E*C&5mmhoO3RreAe~aJOj5lIMY+G|LP3rPy*Mdi_mEln
zt|OOea@*vzVBG9eA>-M78NyUQWm&^@MoH~{cX0kXdhut3|D1mvwzVRuKsPx=Q`K-S
z9P@&;qU#BC4E;ifHP<VZ3QeVag9N&lEw(1LNSUGl7#hcw{EV;!i6f(Io9%jS_iTUX
zd_RJT%sx!@NPk~_i@Nvw8e@_MF94ae{1|$}*r!GRIvpj-xcK!q?VVTq(aCYt-hI7)
zw4(?m741CudG3F?`>cZLIE9q0AzZFp!SKNv{Q$5!8lZF3$6MZxN~7kb@;?82eNV;p
zZGs$K`kpgws`R?DFtzsKuh9LNx=&Kx^QEg$@ucb(hCWk(LQ1^{S4xg0Kg0f?KZ`b+
zPd1)3*NvXwYRm`7zs!mXp;eMdvXs%<&9jEAVm+&8_=kUCm7+^?lT3EEFkW=M?Ni=3
z<f39nhk_=mWKPefM#mZmNDl$nN+B!{BSQ$?O8$joBd9NE1*%8p)!2mt^J_6#q~au2
z*6g@IWkFn9fiUcVR3lYZPsQp{(}@lVSHoTnY(75{o)vgm{G#1nW2|BE3R``r%awtf
zz*_Axb0B}%RU5=?I6An_9@WD0jO<N8`Ui_#k%t`c82LmfRY}>_o2j`RAji5m>9U&f
z2k*dY>N`y<Vbl4I?=A_S6xE{U1J#<I2&rv@z6zO#12%qamnL6qB5v+2*Dq;I4sEh@
zLuygF`*is-@}`@604{Jph;@V9d0kgJv}s3Ti#&f5#|qYx&p@v48E#6(?+#4i4#JeS
zock0(rmA*AJIE^=T0(;MH;Z4DQE|w;<Br`)ydm~O>@lxkbP1G9Dt=f?ZGf!xVFqC`
z1Sp(Ztb#&4T03NbO)5F*qj<eCi+O7lhy$r!?5Z1oz=vIX@fEk%5>sv5x9!DRw-83_
zR|kK)jp*=mDX%JkY(a@kE=j^5kLQQ&NGkGam1TyhWMPXSx1*|2(TD0r@-qJ@kF{pO
zpaA>6vj>T_N3~Q>wOBOnhz-WPf}`W3Z9MY6PMVp}t6RN=ze8=P;yz=V#r<qBjaI(0
z1R1wBpTy=2q~q|$Jn>v$q{%vO53zCO<hg%p<^C??-NJN)S(Vw+5{AEyYP6NOf_(Tx
zMsvBXd-WKs80fa%x$nF3c6Bl|;~m`DGU9{-E#zd4!p_DC@0^iWCqVEr>qUgP)&)En
z(hLO9i~j7g(yirCxWEyUTonWJ4kH<6z{J7&%x|h*&Cxw8Y)h}0Fq}il*ibcHrFMVJ
z1yDp&eI=oJ-JB$_fDp=`b-TasB^*1zAfG9w%gWYg>+5)LHk5D13<JwQ_(IirDz`a;
zoCjx#+O(y#2{i8Tn_c)b@KwA^>BN(1dV^Xrm845rYk!y%WB4xZwe$YlbQajn)+%6c
z>rrwksGZipvb7%bCpAymP#A?INb!FTE~P74O+{Z;3zgCjPQ@Lol#&o*^HCqy(&kl@
zH0ujoj=AWs$BO-{SQ>MN%AxU1dKZ0*9{;)>_%^+ZZ_rGPPZg$pQr$%qMSpqm>QdKL
zYd2lIfCgtY2QuSre9=+v(NWx8?+_&e&wM(p2Nf?|;VF58kI|CX`#8DDuKa)c)v^Lq
zdc?;PJvhDJtIcXqVFr_qKc!2X+0kwGqaZ%I^}h3KX^4#Q9<N5UW_=d#DUKp!u;9G-
zF!^D@nc$t;m!3LU;a0_1mpd7VsE_p9cHCSS&9G&`dIclv+pl=)SKdR66AIs&(Z<8<
z#xQ;!@y^~utF);74=Nar;PHQZ>b7wE?_Hu#Q^!RmkVWrPPM*b@dc_8rK(_Mp=D3k?
z2(^EzqWF*EiVESYnRyK&eS}ZkOS9vqWbbyH&voCvZre2jvJEVn1s9A8%SUE<7rhc5
z=2{$Punm|s2g8N{==%s!;!7$V9qjENpC6q6xwCtCVE*bH>^=MKn%{pn)S+MAtLnLq
zV{`OPwHF72C^m;naZ}fin*MaqpUy$M{bv7+zli1aKlT8ZtNqXl7W9AyXB1tOXm0XQ
zjcU7Mzg`R61eFWskK8`sIfU<9D%T+2wG8M(S5)8U#aj7oX}VU_=sWNI0Qrs!6>LlR
zm6R9RwkmwtkvJciMInET<w<6EDzS*2J*thd|Bep?Pl~ahp+slHlE5sw)t~&zs?^W7
zzbchGp-Ffys;@?hX$41`AOzcpN1qfMtdWy_jSzy68+y`K9$gEn83-;UwN`fshE#No
zrB@Af<1%orvY#^r0OsForWr6c=A+=9;Amb6)(3e4Dp=PC*#3X*p%-(E0QG|VHSiq0
z!Uv?MIP_7B1Z7pZrb3x@iNV@?K0}lwD!U1oYUvbgK5VcH-6bpIr}3|41!Ud(cU4X_
zYpzD0j+>biZ`{u&$<Q%04Ff<nfkdsH>Qj}WoBMY0<oE?*x$kMI)zr;kZ7QLV;1?_q
zJaqn^cUTIWJ$-+rxy{01WxFB9g^l<zH|dR=hLW2*(?M@k*s=5DTtG+J>7@AUFrxVE
zXAd+AMuQ$^{#j5e?b+fwl&poK@jK_p<SI!9n8XfGM8{5o#b$@k#d`ki_pC>_y??mB
zdmcUJO4`fYTU%Y|-D-oal=4sg_m*3ZqbqV)l**q;366gmg+KW6J3BQJ;M5{+t>@&s
zi@~Dz?fbPy*0qeQF<q@goAKjvr36xiTf&wMbM6!8a{Bkab5*lTV(0J>ej4?uI4kNh
zr$^wQ=q{hrE(@E6VH7S#!>e%Yg=-9NQBA?CRO&s}OD|!;hlKq9XYb#(+qklHVemTn
z6p?iPNz#7>fR<!uWif5%(9vd=WNV9bdgo@jfglhh!vYXU1R#oOd5pgAzU+&Bihij7
zNqT<sunrM{69w5Wl{Bi-1Q4;#Yo6yfrF3Z^iF#XxTkMO#rL(ZY+F4V<v*xglPyf9e
zJlwU1qc{%<o?r@?4{8<L5>7%GXL@sY8ZGc{fscQ*nJpRMd9%L13KUZ<tyL}_a0{Y(
zNt5bdi8C&yOl^scsZ=MlUTR7~UV6oHpeh1~m80fc!#0!+icvoPk*k48LFh>_C{1!0
z&1b2WH9x;9ikHd%{r~*`i1Jae?%|4R%0U?UoE#KC`@8m;yh$EqE~YdnffiRmvqEV1
z|IdGSFCKSKAAfV7C25pD<LZ-solr-V#q!{JCwX(ZG$*(#|E;m?;LRtGA3c6?|Mc;r
z?&-Jx`S_deljEn4(FkMqTUp9!p=(r?x`g%z&E5a*^y_b5Kp6lE1{!h$cV%*2I0s6g
z!SY=~z0M$D^oPZqHbCRKzry!piG0>TT#|p((gVpHuw5xp!ec@AI)QXTQy}6I#*$PF
zx^n4RSX4nTzU{w)=j>hG+Z{G^ij|U7^=#-YmePWY)wcdokI>mk=}{(6njv_*79`M5
z$|sraR5A@MJ5HL@(DL#qxvSsA-L2PQ*uFq;)SAEZ7R~SIt<ZXlM~&v_1?`A>OFMs!
zoTa)V{Ux>T-F0;f`5Hb@R>9VoMo;GMq@M}33Nk`83+3i+KpMrkq`cG>KX8J^J{_x;
zoeoJ>NL`@{ExC1IHw~5OX8fC!>xF?q2@RqILK9ar)nR(gSxXohENd(o)tH3Ri4IEe
z-k(X}=6uqsGc9K3j&T`h4T3)qhm(J$gR(*tWjHJ;E+eWP)VlT6np96ND~1GZ4EE+g
zY<JZr@MGC83?9O)nj~$ru-zts$rA)nfa1FBjI-Hc$8c9WJD-XM9krRWAU!a49hfjZ
zSU-3$^~@0#ffJ##^BJOIy**LVz0BY!4XWM&I{Z3EOedr_K2~=>O|FQ+l`Vgh#$<6b
zPAt>+NEtyeF?G{tn7q)10ggV+D*6!Z;h3~>Xy#1YEy3yJDiteXF&arSZ{FWL$4MIL
zN+VruWKrW%cU-@tJ+pdNXeEoDr3IK>XPJ7-L}Vy6hsctqP>B=KtnBEQnAV{{2j(L&
zfs-)I=8CiDH^gsUK=Gxx6S{wV{Am)ObhU#nF@^q1{`&B4cfv1)-vzQLF2EU*=ui07
zjhepGg<2>-G&kQty)@QH)0vxvGWu-5mEth~=bJp^tQ_k9UKfcszM)pMfL>a|ai<-k
zr8CLx3W?b%muF8d=3@y4P9&NZW!A=fvz9L+Mi*f|a@9Y0{|35qRzZIZ0Z1(L+3xZF
zGm)c1JVTxMAt(|%da(KD?A_<$BG|J>bSH)dL;2b88Nhvb!!!M~%b&Ufc?^<Kb$_h3
znjVt!X55dL!>u1JpJqexp4U$jh)}uYOcU=Z*{p-~7=Fi9P7`V<rP{Q4cb<`OiV>Fd
z&hTdE!aI%F%REeP;9q~_kO*@VwRU>i!9`I>+ZUbB=}n@VY!vM1!NLb1BS>Tx4VnZo
z$b2G_NfA3ymE@q)t(|kV<-_<g6R|{B`v>5v&^l-Pdk=#p`2F62aM$}%#XB9#T;*ac
z=z*)<>D}1b;aSW(98wx~p7@!{IB+^;AXC!Tr(+qI1~}Q_;$43|(Ji)IcpjRpQYq}1
zx3uA@9Soz*_Dgy)>s%fsz2+6h9`#`3?9Dr$<E{Fy9UtUFVn~4tSUX!*H)%d)>#4jR
zZ+a(Q#rz_Pmx-kWelH4Xmoa06eonI33zzvLIjPqi5hdnbSNzgdCbfq5<iC5`W=B3Q
zY@4^~LB_ZoOxb_zg0cZaAG9rT4=`bZ!%?biN=)U9o$pZUT*iCHfkj|wa&;JXVj#S5
z7?s$O_JaeXWI&DuQ3}9UROk*Lo5HL38YlKvgvvrC#|5_O!F(gybCT0A(kZG|7M{s{
zB<G}U4Yjo)DVr`0wWT4Bi0vP+C1QOl=GopNN|tO!$$o!gTK2Q_v3q!N7~ZzSfSz?`
z<*uh`Br}~OZmxl(c?P?qwi)Irw7y&B)Gf7wAV1$3K{%~J3@1GraxZ}k4NNZ^b28b!
zEO%IceBjFOp5ZWTca$H|6(|l8#Z@?1utYDa2am47EPc&Ivgc4ONQ}*<Q<03JuUO?h
z+=(+j<cWU>C*?XE+TxKf=2JdZQ6Y4to1^qb=q9_E&dXwmN|HLh`ZRt=gkZRT@D~Gm
zcp^($@_~j;e#m9(Eb844xRspst~KT)pY>J`|07j-+Su9B<<1V;=Qr(ZF<4MT2Lgk9
zt!aR)1SGRkX4*S&4mu&K62l#@!x0g7Y0nH-J$rw@!{2v+XVVjEHcBUD(xdC6IJbxM
z!(I^NkLfCtaEy=>4%48~pgBIT18lY2TP9LYEzM`a@af{~UGCB#qLE!o%|Old@8Kls
zFPf(z8kqN0HcwDFv~GF;;xn4i4ots|U|V)Ua~y^X2+GF{Lek;C6d#6G$G*j1KM2r@
z0||fe^7k3H)@-)E^QSJm9lEsO-3cO8OHLXHPYS&q$2EaYinxvP^J4^^PLL;QVf<VV
z-gqNF$RkLG`AZB59^;Ec*}}teey)FwZn}|NA}V_2O8YyD$QbH+h|`UN^&rUcttPU{
zl;4RHX(^~rbdc0?LG*M$l#Mf3<z$`D^WlFCR%7C&8dW;V=%NoiqYnWuoKI<q2IHwq
za23~Mt*3=dg*p5X#Z<M>GM%SE2E#zfO3jr0<tDkpLI}~qqfN*`pw-lz4!0zu45o{`
z9AR-vVaLAgGH=+^baXyQ!QI)S>y)b!cl%rxkUE!zGf6|u?hr^63M4D>#K1>y=@)-N
zT7+mlZf)u2J4r>iLc6oeB()tmwsnx%%L0gti7G(??bMVjl}&@lGa8{u53G>K4h32&
zrGBh@P3GlQPYpUZc4ByGkqG0QS9E?+S+v9+1hKg&y>1`07^M$wI1^$4yL9tSy+;Sj
z_MC64tVMWJxe2sDbX$jFuL$y(N^5@)QX=Cb-Ksd{rTl3IRt2}Q69&%_`{DyDNWz(>
z*Sq4zlo(@tD`XG_%W|HdNKi`ecBGQo*U9dE@f`e1xx<5ugz0JWIlGd-+)X||{^sQL
z{x=UFf63*|t`9$F5toBVRFEo>0C+e#{2XM0w3RCdTyZ*0`!5>}DR%9{8wh{6q}yH0
zg-KL144`bZ<3KXzJYLnH=L|y#>xjmnNH|Dp60%2j=GXLRfF5b1p4b7!VVbpPq+VPi
z{nFohHuBI+UV_W>#QxOP*F#ALOlU49ZjM^iOBHD{G9D}>bqo3Ln)X;TZUulxCU#B|
z5v(VeuNVOj%;z^K*cBb!r{RCFryd~5lcKTm9q==YSJ;<oZ3%3JY`0AwpKQL-v@ElQ
z#hsSWaaXLAC&+wC?6^wShiN(Eads+*M=a6tUduiP+nkSwbgSLc(Q01c7O1rg^PW#H
zExSkdRFXjWH5+;<-ahCC@_K$@Ax-hYlJSN{QM$KIquksYT3&U7w?BVMUd+dSE(qi~
zIr+M>7$B`FM@wIAB=mpU1(8``omA2aO_?S=f+&N)64@y}F5-u9JbB8_0~=yX_Jvav
zf1HmdY(ba_P60q>#LPp4su;4!rpe>P_%3m8I?4CboG;@TF>b?<9JVway!R0;7O-=K
z1hUNXWlz;jY!Q!rNb-N7slB+6*k!Ta1d|{FhywGa-#9a=gj1KOQou}2Qg~jE7_@W%
zoi|soD3T9w2x;~VLB@`B!M;GEdn<tlCK0?ov3Al;=ws)H!&HDJY-HLomy~4QdV#b^
z{^`f!+_*8DZ62~v@JCd9zi4Bm)b#QYVGBp5Yj|-H<}CTx<wt)SxDKn$B^J&Kq0r_A
z%cQ`ntbC-?DRAw;>#kWKii|UIKJ+y35wNr3=4|I2)*V2fwVhFo&B)dqpZ77szX~=d
zDWla&_d%qB;2t0eE}X&wP>?@&`60!`im0=tgR7K6hYDt->kR+v?twZ{=%{fzE>F&Z
z8z38vmq9_tX32lcESr=ej}h%mhJ9AjQ|HBNYK=!*(sJX(b>+U$!biLivp>0)FkrD5
z&xJ-wT1BZwCiXZf^wBll;ve=u!dLBCfqdpRzVfl-63J+RoEE*l!*FAqw#)H@)U^V+
zvY{d(UR`yc_L8$|7RDO+93(#-S93R#_Ls>+W@i9vbC`cPDMAeLL70d+B-wdf%38om
zQa$95RB+yCyn1SkitOw>Fh_|eBz8Vw0v$3RnF3RuZK7U~@A>9v&Mx~4G-81~*|mp6
zoMbyhsC{6X<yAg$N8AGsWK47ba7@RGMsn6u6IKcHIPM@=N!#s4TZequ+oZ5N5vokE
z8`f+6;4gnHpo?6z%CQuLN1Ayf40+^+)|`}I`A*abYyLqrVBg`YMVsaJ3Z#rp9gaw`
z`Mv{fnW*A4J;V=P{LtgDq$i9fT#HFcNEk@;e-X_CqKxRBudQx-fm|XBC;|yYyN4lz
z?8uuCGVmszVMFJ>Wfb-9-bIoiKZS#7Px)9vYeIj(Sh_E>8xBQ!{H#p`r+{8&h%oe1
zOK_V8!m@>Obo}VMlli$epvgDP5;YBteqqMS3)p)}LgScWE6ZLo$r(hz){*ybaQCy%
z?)*n`pZ-0(_szdLoldXA854GHdIlf|a^EJJu5WyfMiH~l<AOI~GV9LAzC#X?V!Lrb
zk3D~E0R{v6P&6Z`e^XNFjo4u_kXQ3*iJ0Gv^NB!!>EK*K=ba_bj!&PpLX|~WoZlOc
z7?JJSaoNNXQ6U*_p@icv&l<u^aE(|Xs-094BL5#=!eQf&>CK{+EBWRP^?|RV71PT}
z6P<+dr{2?!hFpKK`-eNbiTn3av!K+XFGzp?VENBkaX3tvRs?ZCv!tEP3);0w2I*%f
z>t7YgZXcz)u?m0C-Y|hb>|g2KI-ujU%bkjxRf^E1@*Lp7=!Wb_zC?cpUAdjg67O1r
zyAZrZ_m~ZEa`<eYBab|DBACf_`|@8VHOZlV+u`#DC51FHT&n{e{7?V2tG1p0+C6_t
z{>ydwU%M^(Bm==Of7ovtA%eeiS{6Uj<d1($xMjxoK@D<zkT~d{HB1{S1Tu(iiN8B;
zL0^DgV~mM)oWna^{I@FxZQ;Ty+rf&&rYOi=V&W<T=WIa4^=R=n>iOUe>sr{6;Bh5;
zKkeEaP)Cbs*6ZD$_k56*idBe^DcOJ9ra84l{0B_ueAJ5VtsYT634Dw7x+9n=y7EAY
zV7BUoP6@B#LrFtt+q6jFL#B*!kmNKR(ton)R3fH=GsWkuWpMVTLDVyfo>)>x#jC6g
zrF-Pf;Er3Agnh4Lg76Q3fpPm^bbVW{Gf@SUNTf5bBy^G|w#iU%v*{jV1HylsBucBu
zugGjAI+Bv~z*L9Y{EJt}y>RaUN;SBu1A`4aF~zd$=#i>ob2>_$Hy8ZBe-NkXMV?K+
z>_r4CQA>fX1QVveK$<UM4IN7$5-_x1BV1GyF(oibV#L&R{OE@6J8>V`cflvov`-Xo
zpatQ44K{tZD&!Q5MS#0_MX7&<xwq0H0haBw!Kp%|9-C$I5fTlMx0(wXa<sEX!!U`9
zR6uk<5DMd)r9frlw$VN0G~;4Yxr=w@GUAt#?&3j}&i{eQE?V2!kug@NE>S@D$X@A)
z?-9`@4&nz|5eEdOd?e^7BGF^U#>l}%(!TPS(JhaKGcJ^%*i|cyB>R7SLQz9g889me
ze?XbPULt7qBrvMsC2CHRh2l+TmqxH5ILI~;cFPSSIB3KU@%i^d^S%|i?RrN76%{8j
zwgJd)U9%y`i}Z+L5>u@?pX`*_Lea$~1y<GLYdVc$1+U-n`r^a37fg!dr|E(7%!Nt@
zLYrWu@wSW+0jO$r&<}sE9;S;`{tKHg?Id7yFEhB{Wne<rdw;mo>HJ~bLue;lr}-s{
zo*>o|4yI%fUAkbYiAWR$&~ilgcRm4GPMG}o2No~&dO{>%*M2sOX)#-<LB2VOgfIIG
z;kLe52nieNQA*Xa97s?{Kznd(xkpQS5q5A5(F;Ugl;^Q~8nAy5`W5HpKnCFBNi;>M
zzYDl6XOK{7D&xVB?f3306?p{?h_=5^^W5*9(B}4Mc<4W~n};gHd~uVNy#o#g<=s=B
z!N-iwZY-!maDz~O-_A??GhHY_D-x-0J|0@EjXSv6YeZ=0aLGxWe}f3EKuLDA#I0gQ
z0j{$YT$$x%Ag6z@kPPzyO;Fkbm`YFFNP+;H(CNo=bdu+)#bS+sa26wmCePWZmaxHu
zSd&nm(Eg?bD>^FY#o$IwDrL<Ohf6Kj(`R@|0D}SdxXVcghLettzd3#U;+y+VIs2%k
z$WMYPs2SYC$~kX<G>Pw@bwBP^GGgXqpSB+e5kS3e>#%>_c<w(xW-@fnZi{OU0)glQ
zr2}@(T(j=m0B_U9Xfzrf)y$Pl6bzt-ZR-*u3=H&e32|sT(!trd{1F8W)cmyC_H-0B
z#DbHCJVQcL)MS%V@KKY7nTF-V3^GM>f&grHFxb_C7iX}p4R3U0C-)A|MPgwq7ruR-
zP21qz6=8o6O!f+NnI3s{hy9{N7utLlq%1?l4#tS}p^4M!aWuXB*E2h^`Nw4kEHf(d
zqKQF~w|I6H!}jU4MA4+jf#!^9VTsPZ5Aq3UGMDA1#R85bmfe;~a=cU7XO-f0slp^O
zHlu0qw(wmC<?6g%1(W}F5}BNjWXe&WbTYGwi8+5VrmQeE=N$VbNuiO|S(W#S)o*`X
zI18i2UL8n$7^{8b22*6~w_>3atyI(>XRz&*8tvh~ncVb_*cB}ZA`aYJ*G*R5AQ{<a
z=H!ima%B}~oJ=G_SC7{6a!!YyxH4{LE0JKsmfG8<^K+t>ldDM!65CM0f~M)U6b+aF
zc6xtmQVm@amIAP~8c5MEMFR|3u{vJF-vVu^&7(vbTY9OEmp~<Ji}RASoAG>dfPwM#
zgZEW6p%!~tu?WLLZNM5-Pb@Z@<`N4dRu7xMrX5!uL#1%2z@q!&@%=~79y`Q9A*gov
zjMoh^#t=YiFOwpHE(`pSe^=Ofg*)5W6RCgTrCs-aLzB;#{Uk2;rtop`bn#h{X(3Ie
zG_EPuZVgDm9%3qg6k9I`&GR0(wa7CCZ2Bq}Kk&|uQ*d2Wg7XiwJUxIYo}AJ3>H2jw
zx)z{tmxu8qV)Jm~5)uhm2#Wi=ZoqEksYoH9xewfE1-@rq2B!kJ%|=2PsMeVT4K#lf
z-%q-OX?ihZFM&K)2~vVl4?xca<0+KMm6Vmx9QTyhFX&XTv;B<r@%ss_FB-G82J1W%
z-y*7J$Sl~$__g>Lm%A91;XVsMT}g@73KCC`bvrHSg#pULkf27F0nZ6T^FxP!k{DVz
zy+yt1@nz9Gh^71PnC^z{*Aus2_pyIpEH=%@`9DboJ2N=n1>T%byRTdaQIsl2UT8>_
z;D=$x7rC*bG#?mLFbf#Y#PAXZ8``SNuqqdJS{`nkrz<|?R_H>K0yn(=ZiT!0enXR$
zFBIjS%Na3BnF1`0O<;vMGsz{kA~=3pO@Yflq*LhRQ8<vNB`!P;H7ICl&ZmDg)+>$d
zqGS8@{9H!Tv9d3SI(?~Jeg;x?*PJd;B-8Uk=ztWJLIoy3qrqiRnVGMv#xwi)V{Pr@
zkFCA4xIrIA$5Y_P<>1_<L!FN4lt^@wJ<?_Hh%lCn-)Y}vB+oVvqfM>0sk8PdBbl>3
z&ktna&O0uSbEby4_wkVA($9agbkq`oTq<cnC*(*z&<vUF1xVSjAd;F3mz=3=&5-;V
z?#ZPRiI&GZZ2Lu{SBQ|y5jBT0QdFzUiqG|9WL`R-am3~3iVI)-O3#gi_62DZN^phg
zv^>XYc@<4Y%y=FOq`e?6_YR_Q%e<WN?nt4NL%i0N*HlP<4C>97Rmy({GCOuBUWIex
zkhu6<(+5U0-bKlaNhG^6q-$!+;zD2(sqZCWusGd7W>lwqd8EZ-{4EPE4+?)gBc0ui
zz&XP%F4R3H@se@(+~ikzRI(zdAyPpskE;$wH*@YhUv^^Lb>==!={Uyclt-+#ewzsh
z3YN}N1<DMBVrB=1$O3=8kd8Ahp2+P!a@)(#&>+yR|F+cP9UKknP+ssT&h{%VG~+fF
zLP~KRL@U{Ow0v#pa^8RW6idxVE6{bg`pWZslEIQxTA)20f;=6f+R&N3xzRzScZT$i
z@<o{w+qL9CVc>1eZT4tdmUIodv3-*P_tTBT;mUiI9yt~Jz`1`s10}6bjj4(s|3};{
zo@$3rao&)P_~3w-3o-!T0IUw_SQeJ(uK@qb=?DCmJHk9ZnPF6|vUZ4fet+g^i*f?t
z6fEqJw8A*vWtG`=CM3Wp-nQfg>0N7NOPp^{^AW0r2DD(%ON9%`$1&mK5}6GxBBh>=
zk$h3RxWN&nt@3}9yccx-{Dm#1XpRtX>1GAYIOT}XM4@nzy#DdWFEY-J`=j3uzLit{
zx^x53gmOH@ce;?N$yG<z`o|w*Rb@-`B{cR>->-wkfE;+cxL+fbjq%@yy<ksR>1bfm
zVwkNJBm8zOTD=Cwnb_9~SWu#ZS0+*{QqdCRr;^||yD@*+w&g?t0Zq7OELIS<VR4=g
zlY8xO0;CQ6WmOQKcL=g`Y0{C=24XOTZ*L7Co)$}N2Q4FR><w{7N1QP?7|C{|%Ry4+
zK5uMPeeys`;)$vB#4dUnCMnuDJ`y3M2ueF}KEi>d&9ODflm`j%y3>Vzh0k%YvjZ7&
zP_!+d#m0Z;9ZZ4VRRkj^0fKa#Jv=^q2oMKx6mn1hp^{Yh@~V3|41_4T2W@@W5V{;m
z;j`-K-KF#ThM5mE$Xb?NjhU4Pa{Lx7o<zF;3L6WLaF$6~yx`3~L#h~2kb~VOk&#&a
zAgkO)l}~a}12ry2c!KDKe>8Pd-#0ck%FF)YzjuH6p{^<^!Pdyr$RwQ=ZHT39y?+PL
zLhmc<9bXZD;$*SX@uO)`%ntkr;oQW?#B>a~obO+mkce=_P8Ir5BchF$A4$o*6M-GT
z>mXIiRAxkXU6Rg(PDDN*F^=$D5=v%V3NPR^qSZ+Xr`9|@&#W~QR)$(%PWuc;>igac
zVvv7@WR76(GC(b<yc2f4S4vClU`Pd4?WOsbxqx*tfbq;7a*kD;zy~16;T39z)~!vw
zednC0{2&)tH@F3ZglFB8w#`=jSXXK3rKa(#BJXE1c^K`>ES<^2MD#Fqjvk(m&NIfi
zR9!M8?=laU%f<*ETo{`gl3Isy3!JzJ5I%qUO+~bL#gct4&@G(3MH(R<b;>IjM7;Bf
zjDp1bM;U7%Iy<OPgMq#=19(D~v8I($%fu`?45=KBJug+@AJAIx^>B=hU&hUB@mewb
zp5}7AEZLs#(mN!`GuR)+%eZitTMkl7vp+<{5Pl_CCtCJ9f&Xi$fgpNc2NKuD(H(ya
zc;&blYlUH?!b%pJUNRuQ-_ZVFI8FPKfyRuIpWleurk8uKOe%cRXi3Ppk%At6J`gZP
zgF9m3%9j=Wh`;mUO)Qaxpzbk2<Lch(dcdd|%jn@S@4vJ=|9v2Xj^{32FGnWVl#z$r
z<2@ORA}_d31Q^Jp9!h}xNJEkb=7)b6Gcc5+HPV=G1iLx2ii*J$IWzK3N2t9bNWufo
zrHjrpzNR8uxqG@|`iK#$3E=p(r$`q*8J`BB-Wi@ytdlFi4m+ZyOoit<Js-)PTW?an
z0*wJT3guZcwYf$Nh%X<LFjwxAQP){2bfyoi)IBk$Ur5fTlyJARZ{=5f6%v1m4;L4y
z0MT5Fe2u0)m1PlYkpxk|y6VfgXg!%>AYZ#OA5I<CF^cV<YlaN?d)x<KK#lIJQ>a<Q
zc=`LCozH*YZYQVTKKhmvZ&00CHbHhc{;Nd>Xgssh$lOJEE1a9M-TqR;r9jCfBI=^q
z?qa3nLGdgAG*|F<WVjRcJHLNnN!f1>=K*w@?%?0xf0pAdt8#gLm1V=qZ8EnT!--y5
zxg$9cOnKwOD+hMLb$F5oX+6#orI~2qp43PJFP*nlRBuAh4glX3qVOC@1iuovL2l5%
zwF^YQ_HZJ<L4IJ<4U;*tbual`$J!NOZdGThK}%Yr^hpzK*Ue$~xt@QC;9|ZIa9h`i
zyB=Y7wrZKhG{5AN9lU>^%Syo%qixq8;sO0w1gfefiHl8JZ#McJLAQmSk@z@HfzO@x
zt;tED69_8Y*<6N}yWmc|i>J^M4w^qwlXlOuK(cm{r2$--;KKYq8D<x=fIFW}OunHf
zmS{||S1Yu#X{Kh?Qp$gEC8ZJcv&+?LRx2!<x1iXdx=xftg<0u=vnVZhnyf1=7j>YC
zm~<)v5I)rBeEb?o*ud!b4#I$J3y2RO_=H!5ww$V&!}2c!?9rWA4^-Rtd;;~ouar12
zJus0+;Pdkrc5e_|tavL`!-b8b;UX*~oPK|tdI(9A10i0;uG4>T$C;oA0r6IKz8)n@
z4tnl#uI37t_>I<sNd+xyg3{UjIr~L8-zHp^+i1rw5JMSnY4vW-GYLR@77k9ss4N(;
z2mdEdy!a?cwG)$?@cA^X5Y564CZXp6frSX9d*Tc;vdG7e)OaM}o)S4K<c<g`x8K$}
z25DIq{alElYczigVnv%?KK$Hv`2oN4<zY{Q7<<)UI0!E|!jeB;hW&boC_6g(tfgyf
zwnIn2WmFI0Y@+XjDRWYhWRn2Ai5aAy72P$dd0FY#FWMVf-b#}X^yc~3Ot^}Wl<R29
z8~=N==64}nvrBKozc*s|yX`+}O^=3JTJHqkNyLo*0ndM{7hMh^?&&M7Zl0GMCZ=$(
zr6;Rw0iDruI&a6U2#qY}YN6|^LI+9_R%*Jjmq8j(*_r#hQ3=-5zd>2KE8dKA?$YLk
zufPm@H7&-9@gOcbG23cY3W<0U5!5FeiI19%+YsQGj4JDNrTqqm)lo6!GDTvkjZ3z2
z?3T0G*!+LY_pJ{>Fd*%2R59S|6l2^lkt%U*`$G-9*MJMT8!Uf4a-G9@3O_u8Oo=u;
zMV%^v{31nCL($J3c?a!x#|xY<ce~nD7fm_ZX`1LWHX{a`9u9V2e*NzFzy~@kbY(=`
z&RAivhJn!7v@mwqM63y!i5@F01<rw4y!}&Wyp(?wZccF#qzR8j#?0$7b_5D4j!Z<x
ze$=RO*IX5M*|IMA5->us*(#;Ua{Rb}Gr*JxeNNIfE-vJFHm!px;XUWS(Ct@;154ie
zTO<rv!Mv#~9#2G7ieoyB@N`^3lduP=ms!b%9Yv{OgyT%{o6BO9IbWa_uwfG`z6W9?
z5@mnfPSxcJL)iBYT9L{{)g+#=C&St6BoD*`BezG?4}O+MYwuf%hJti>yWxegTPH@$
zGMITf5)lhD2A(}^cV3Xw@@EVmn<B1Os1Wz*0Z`!0PI<RE^3PVygKj{xPN!pU{PLye
zSzX~#voJXIJI4DjkraJIBB+@eWJ@qRly-j@E}N*C(lrxtO<PL7W22XYH7cfVb*M=g
zEL*-kIfk<(vl1*bCMGB^!jhMpu^bMgy64%9Ei@32CE^eGbL>sBST#wT@Ggl+9Vvr2
zfXm$b93AqRM9IsWJaWcrzQ_b?#fc3o!y_<QAI0vDtC+)^-K(aCpISN>6Jz3o14Ms`
z)TLxa4i?`zCp*}S93drUD`hfDvlw5dOpsq9aKksDb-a*ew_w8IFc$=Egqp~vx_Cg|
zPBYP1w`Rt1lgvuF&Ky7Op*TiL#btrv4p3xZQD+&zhDG%A%;lI5B&jAqD7A7Hjza>+
ziMlvM-PydfQo-!S@urWF@)@Tpiv54fadW=9mqEl{tRu84+HKB|j4B+M(CBTuUXn40
zLr9r^CA=;wQN*>TL|q5rvX(fCU4-VbM+fD$JsM<mwB1c$%2iAyb<S+hp{ymUQh;<9
z;Q2@>M`2)0fg63<aZc8Va?nL@YJ+L#7Q#7(?11uq(w2!~m)WeWhoe-->ji&HG!)gO
zeleHaq%=93Xhcf$F#mL~YY#-Q9D-*UgpHJIyzd_u0fJj{@iH2AA}%YIdL=z;NgT_5
z>SKWDzNWkapgp5Bf-mmV_ejk(5PvPBK<hD3Z2Mlfdp(k{4`9YZ)E#_@3|31~bQM15
zsQ2r@VC=?JkHB83^Dz=;sic1)hW?R@lNS4lgAlP}aCCV1IsW_Q;pf~MDW2cGI9BVO
zuZ9uA1&LHhhX$qwSEQ!0@+}UeKlxuzTT&Dt(_mM~n-@7Uy;7ukTSzhAayNqlLCUWJ
z<|Ofqe*#8Z*MA$?poBz%V)#SvVl*YMPg00=9eE>>f0IoQR6&-cC0Bn+z46XPVNB;L
z-}7$bS6Z)@|EA1X2!=g~vw{Q}y0G*+X`i;yd^#9X%blv(jl|*&&hZQn)ax~LZ23sC
z`4DUg$d-Bw*nA%zas#hrfBH0IC`NV+_!OS`L{iU>KnnnuKNV+1JWyUU@$0!sh8I-R
zl%%pN{Ch1}Wo2iicn^Okv`QVRP<Y=HIs=X^G7oZ^P98qGo6zA1L+UrX`X813!QHkt
z(JqPR4{zE`pAif&$VY;4TxwXGX5r~Y=<2qxNq&-!A!+dj=DHh-VS=gvD61`}MF=W0
zuGtI;WP@P;-JXaKT^10TWvX6lR9$V!O*C_a4AsM7T<6sHpbmf1u@UN5&T-4!Qkq-E
zPwLFT_NVQfJ%gOdoCN=;qzEe=sj-Hht4?<<`MfY#4<*hFUV4p-un~X!ahMF}PS>R+
z>@H?O9!P{ew^8UrFnM$TbF)$oMpCVE!!&klF7r{{w<V2?i^QcRb`bbR`l=XRSyGWu
zOQ;qao0}A2-l>0HZI4ukpW0BMU!_B~L?~JOi%(-^5sFnay5IfadJAks;Q0_YM=>xQ
zZ#NO;4<fqDvU97mbi^nrj6MI-+#g<V;~Wo>pMriOhq`mHic6yRtrnyeDI?iGxp&Y5
zjFz1bP09|01wBH6bfMVs*`SRjZ|fQDU*(gIhC7+a8|HuCBeC^5$cWR-W1H{5!^>Gm
zv>;FUsB4|g<k<}><`@h2wk|iaeRmO5K&XlW0Y+F*gGXDW108Rkq5H^rkmUf>hF+Cm
z5=3Pfg+5v*p&&$7hnWN0mn8C+SuI}XT3O&vhaanl*E@7We{SOyx0ZJoUi01fn!8Kx
zDA8e3zl(piHx3+8PdqGqEQ62rAas(C4}T79_!=5z*t@o<q#RGK0L$UXD<3mQF4GeE
zNmgJper*$>^dqE1*!OLI{eT8NMfw=jb~>qU+2pu$0v(o2nTcd@sp88d5Kcc1Na`6=
z>2X6xHOV5DJvcu{c<oI#YZ*yntBo?JNdHh?@)v*UG9wP34oN7L$cu&!qs~kbV3nG|
z63PHk(}d*?V3~$Nu)nOk@d{V5S<P^|AC^=^EH+zmPF>VmynT9Qcm;QD<^ou3bKJ#?
zyF5pUWaLpH2Q(0CbrfxkLI)TezK4>bxwBIVZ4kM&fGv*2)&c3nyf|u+bSKcQQR$a?
z5iNhQAuUlD1UNR*7qq-K>moARIHFVFKR_(4l42|AJ^%LPG^rpj2l6$h)0L@oO=0Nz
zsW|9{$ippRe=eFp@UL~%DuDu`u$SqD7Co4e{GDGgd(=8&K-V6j2mnokK|H3j>y%_f
zq2Hm16OcSMk-*2V&JbP?5^=45NvK&M{xg5lH3WCFqC=<w7ElbOFmM>L_n4KAU62j0
zbCjMxNpm;AG}#5$-;Gjl*niJHUEl$WF~<xD0hlS9A%*4njHl$gu_9%8lqI2lX=O^1
zv7aWKf7Oz3XSQy%dF?|7DCeAeXQ!d(xQn9b^F)k*`~ZW_B#WZ5zLNs$QU5N5o}+)k
zfTBX;x6}wk00owXmnw>*Wg9E=d-d?Dt!kKGWc{1IC`Z+~%NBEW5HLzjT#`%d%!F<4
zcTO)$E3m|Qh8XDCb^SpnMQjdR@DWj)Hr|7aI^}}wu3ePao^#M4L?eMQ6=9=_WU2=8
z$%M;XRBUZb>P3BpHbI>k3Zi7Z-)n!5ZhVN5#(akkld6-=*|`ffw0-<>qxs?T<B!$)
zFv<|1Z3>MBLI7>Su_2}lVNFS2W4NM=pkA*#Y8+xJt*~Q>X^Jz+7~;f*)8F+JJP9Lj
z^JWVQn(wL8t*7=Ho<Xnb(e0_+78gbHIBC>|^FFvWcP;OOdAqM`Z6BC@`;mXM6*-qI
zgM?V>!U4O6!l+8Yv+%3#_6y8f*P0`+v7{G4J)=Mz_MM^rW<4p(swZ=Gy0Np4eEjil
z97BplIMNfENT69czaZkVOS;{xxV-e*L|y~j^?^;uOOm^GN_U1{Rryk#M|w$Gm7_*|
zUp8=p=#E(Zn6}6~GPq<vz9@gXY4XfLCDxtA5MY{&tplkB86f%F4pKATTBGr|c6!tJ
z8Vs4yD6i^$91lTA6o=+;ISd<&OkEJMi7?1;0#F7NwI#y10Wkbz!vE8aYWjG<<kUA9
zw9bPU{WAWJjV8n%#y*^3Fz2ehR(gQs<^j7_rVtN#=U{tMuItb%RQZ2#-M1uu-bxWD
zgo;3;UMRAd>$~hE51dW9C6VEP$b(bum56bEoD#goLFPehR?67-!BCy%#jYMV7^&3~
z20~=7!5P?rgpq1;zgDT9gv0E_Tb984nN8XGtwqZ9D`k1XVmL4y;w(7a@?1~7Gc!&e
z6}<cl=XosoX-}CK?OcBcd5vjhRL1>Siq>QEX;%)8zSkY*BwkE!{F&*>yGVEJTxaK#
z1D>0p>-!C0Gd$MXPb<r1LtPL&5OM)jEPH^*f{<Rr(~$^b=MO6wS=*;Q_#P4DK`PB5
zt%v69(3~G{<CI9~f*lGCeKl&Qg*W^$<>Q|R+X<A49*n#lmLq=@Gl#$61B7CY?f41x
z8O}%<ePxv<=!YQRh0g&-ne2bkO70*dC7bm-2SHohc!yEm>g@?Ypfv>48!K$1biK!?
z%US+lXNeA!+WCQc35014SIWne`HT_gz!>s@)tGrv>$`NFyAJu?o|L??Gah&9^nT)%
zcvyT1UHv2;A`O50)tZcYqs_2k3hJV30yV%PO6e8{o_l*;jcoTP6IaNM@oHsoo^u!)
zPbyiQG}ur0ddW+nhfE=JeT&K2|8gZZ78U6DcQjTu*Wysj6p0)y)ivW6(t^O{_o2i#
zo{_vTM)5WCG%216_0qPox~x?XSs1pb6`zhoUl$CI3MhZB-V~w~zk$SvU^@NxoMb*u
zQY(GzU5JMsgydN|wSE?$biqnLY7PrLO6-~VU-fHl><saBs5p}?pRIfBfSN(Ectxsu
zLx)>`35iRGesHhs@1=VOe^FfTZ{@TGtAb@gam&T4P>oY`i{Mvb(WGl@u=B=HsChdO
zPlvxw9rAy$-MtD2(S9LW%Dm4>8ih74@7njU>t!A=#V-fFtK^~9uYO;DDVVRISsybU
zd}EZ*UdNaEwxV7;e$`3Zcc3+l3;!MKz4F|f20071xN_^lR##fB_Y+H8_%5V)3`MBA
zTuOp;^s8XZ_W0ZXq@i)B@vduZm)U;Y_U)KH-t2!|<`)NR6V`Yh9|-IJJi<!*Ob2uM
zRB;y4^O&Tz<U$|0JAR^qvpLu44Uku9AGEb~=U_2$4Q8xVc4HzNPV{I~Vr%hqG}hJB
z%LU){k#(k}K^Rozm6$`JIZlOUSTbCNVqB%JShil$EPR(e6}@6i!;zTR-jPM)A;3Ym
zNbG-n7IPWq=<w<XMDvn<o6fdJE?s+QJFyQ;Bkf}_S=QMESrRt;yqpXHKrIgj$$4k)
zWuN^epF8Pg`*NBO7%=l7QPL;+(xtt!0m;;NBK>GN$*fQ7y`q+<8er=-o1-pr#Fbm1
z@pZxOfbuB$-|h5uu6{O&TT0UDG-cfvUzUGdnu_7G^kZ^W3<nNW$rTp+hcsjkn0Ns8
z&}3N5l6@d<atQ`3AZbyWX!kID1q6luIhyiDNXZ*K1*~1ZGxTLf6g9O^iOa@WTe90U
zVPz+z)ki{}j*^Bi8$Yc}$2R=O!wPruO~QpvcnP`YNMbCDi;l>rGib4`<X$WJ^ap<~
zdo<1e1tS2d=xE5aM#MRsXTu=Oe6IEn-c5H9*e|AVCw#xGuFfMlH)>Z7PErv18&p!?
z-l<9|7GJ5wJSOs-4g;&VAAK+&7iRUhlW)J_O2O<ToMt9)lz15>QSFjA7Wii2=~10y
zQ7+WdqwP-ivU9D+^JuX|vFzWv=XihVA?7hGUk6p>7Oq2lOyf^_n36ln%%xD5f)46l
zi0<=9F2de}bh_6{_MYbBY%ifdPWoJSnE$>%%~JYf?*+JRf+v&x$Bz$Ij3JRmoi@dl
z&?K>T8tPCxj~MKa?O_T-9zGdl7eojYo^z=oG6#I1)ZtF2EiH~&$~0QIk*R+dzuqK)
zYP;TnT7066+69}xHmzHHNVr+ChnZw{_QQ%LKfC)`i~jGkPkzuf_ckqd<EK-lHXkK!
zFL^8Dm2o$46(4c`0)~>T5bzt<Ya{Nkz5=jd6<4n#7BZn_Y$d^8pMBCw{{6EbmanZB
z&)QQgF@1j<InBKs3T(bk5UYRP9+Bn#<yRys#t6g?6&?to3cb%}Pqj|^qH=y1Wd)zu
z7!7kFZ(E*H*TeZ}jBU@yxn{5^b&;{eHupg=>M(1x>O~E1I%k$MGs}j<6GSSr#hv7T
zHrMA6MlB+u!{vk~H#>vuf-`ORNx;KSPBX6QdA4Im@28#cAnvkF7d3yo^1*Ja^3yPT
zO~2f!eC<X<zx}k!Y!vUG(^1%M(SOtaOSs%fNp`<+fmMFsXWv-x=TCkZAk%2ZCbkP5
zXihVC!)bmmz2w&_5B(rTk2YE1=H*SkwkkLh;N6$qze-*GSWGWD5AuvkWCss8dLxfE
zigmMxqF6kBEJv0l4)cG$194xgpju%9_yM%YMer^Wt{NoaK?ReV^%B$oo{rRO#u>9=
zD`yZ_mTF%=rms@DO@}ffB;y`L$|jzbP`T|XoM^MFZGL3eN<WL<>AzX6dX8Dw#2W$5
zNTg!g4k_C7R}3Q^fH4Dxi(1rHOsC^uO1k!E$2d?HjLdM%5q5vxe*juQrN4CfyLe(@
z3Nm9WuTn{yX8gX{@MxC#bO4j;P)*RP<wcV5a@K78xXy!P)ogvv+rVO_a_N2O!JkWT
z_LsdC%9NK4PF)@c7)(bn3o_NJO?kj3^pky8VvE<@Rqe8DQaakuRhC=y@I-mwtdvrT
z!yF|0XIi;U)@o@>jOb{8HcBp~#e?LHlDc+WsP}B=cR%g??swoU%th!=rtU<o|5jWP
z>nw<5<6F?~qvY;qJHI2c9lUcleg{FLm3QuaLhtM-l@CT_vx<hav-3OUhSRL%N@Dv5
zf7$t2UjFS^j@!u@-59y(%iE;Kgp?czN-#TX-Mc-%(*W34ORW-rJRcpz;WkS6+H4v=
zQA;P=L{}P#%`VD!I2=f|rFc9VP>{lpFDW~66(lX`{#S{ob6VkB0&HcOXh%az*i#q^
z_{klD5L+QEUQC&Qc+uIkfPPhQRTh7LtnW&6Y9PL81gR!0Ak+cr4fkExZ|HlUO47~Q
z1IGHJ<vUc=KU^Gt{BX)qTKGZYwcHP~TKGX0M}B~tNTwQM0Ie-cGpErvAxM)d8@0A~
zU=%mxD;4`%&0ybTyI-v;y=$A>N`u@|%UD3=*VV$_jgfA(1@Fu&AHdcWVYE%>pU6sm
zf290ovVt!ilRSfcZlQXba;Je)Zh|@+)D=L2B?J=0xwEx@{dq#t`{Hxvz1qudF2N+N
zet0Mh&ZhY}hXlCmtLT2Cg06?vB~IuHYPqH&R22|EjlgGks7p@AWDE{1RalBe3D|m%
zEmr+4=HWil=kHZ7@e$q}+$7r}Fn3;C+0uTv!VN;2qUqdr9*j2TR++;ROW!(Be#iYS
z9Vs`D7ewoSc`nLzxcI5S&D{E20XEWR;U}Phlk$`HCQ+B@t@D=ic#fFWw3%dX?OXxJ
z$D?U%??46fkmHm*VO1KN^WY|s*S9neudGi6hT=SM;)Wm!x1YyjE@>@BsN2$A{OkSn
zbI<$!(Pp#%BIMGYE$+ud<X-n@W59^k=b^`V^*p41BBkkO?3h-N>+6Il=jGK5QTlkM
zCF$P%8UI1k<0&1y?fv+Enog4YD*tWkexOYYUn<5yq0lW~jF1l&1#pJmnh%EaIJr{9
z=L=~(mVMvNJRWjnuG^8XCA`|5EA{TIr!PC5U)t1AZMzvJ;l7J`tR20wJ*jqCgv%DC
z&M4%6u#s}rtZZVcxXpYl46*SfFN{-MVB%ZSkI{JWmB#rvCNQ-pZZ)5vpGx#lQ$G?*
z^p^dUcHYEB)X-0P`}u(HSI%`j9}DuTJ-Asv<LugM2sQ5y@}<g|!*sjNF3GtD41BWq
zye&9d4ncm+ek^o$;r-Ddco$Zmn)&TA9p|Ng0)4CDLGbuoV2!<selGH17(7_-#~u)b
zAD4L2sD&(<kD5y8xIN@*BDHhia~=4=dDBWUUbn+HYH(vM7J93gK6`;)+mnT@8uP`*
z6RM&yBRdU#(L8-lo{-FJzp%V=WdxX^t2xbpaxcalZAzNe-|JC)k@x+VVGzF<i%=$i
zA*mm+Sm@Yy7+xV#Hy-w`7vdMcqkoC}kDGvS@nFFkn+=>e`}u`~<qU8*t#|I(#7OB1
z-DFi=JR}9CIQTPVer>h;;%&L5jB@$AWjiv;$KU4z()Sh-QF<UB&4Ejary{G$;+C6w
zx~SSp!k$7OIWAD23p-9Tc!rt93LyV~g-zI%;b2$=v@A=|;Z1@=auFeISUn=3^vWRH
za6;VU6LwRI@LN3#q4`+cnQ_8YFogYw%&Yo2&?g?z<Xb4c(1%Y8AhqA2_BN`jOKR5A
z9W9YWwd~{<(}5SKt^c&_3tC~>KUlpCp1iNI%0B2qJJVw-4P=Am2Na&}7bq-$I?bjU
zC>c-3MIL3GnI=z~?|C1!{8|auS!`)Jn}#)f6WWyXF&h!H2FGpu(>fkpb-n5f0w!#Y
z5MeF2s1-2%B}W-GuYnO%-q6m!UgVJcq^nMu&?os>xBTa@*-0715Ln%Xf6f`!4vvBg
zS`Q#vN_e7CD1$6y{ysFoEk9#_LHLspaIT}&J4#N(r>oK36}B6!ON37c;jG{d<ADT~
z!T_wnfG`M2xGa)=u)daCzk?1ZD3;(*wa%kM&i&(vTg;jqbonIB6c-m|w$2>Nm-)nM
zQSv%FY<2O}ah7Kr-lTNezoG{3C-P^))n*1k0j?mW79+rjAKcW2U=;6vCMX6kz%afl
zLNOHpt6r~1hhT?z;2-Wtbu0cGRi`mM{%}vnvvczJ>Enl|$;Zi)7vDZJSh6zt{_Dpt
z9w)PWMw@f|^!Ps?Cwu?bUh?J*-lYGf4^NMu9iLJUM@PrsoF?Bsd2;fYKHlYze-ZDb
z^8v*-<`%9XYasFk#jWmtY4O8IK1QHQO=y1n_?CB8FfL0@XtSyLP?qNK3=M^8Yr)OK
z1BX0<GHtV{PP3ePgZAGmSJdw8L=!%?)u_xl_<n1oDnR_);%d04oFR#&TMNgL#$2l$
ztAIb(NctE7?wK)wlTQQrjo~-TBV-s~6ulPR@;TQs!k-FP){}sLsvcvs^(1SKJH7w>
zc%$Qwmo`ZKh$r^m1=#5H*6{PL>)%}*Z?k2O?S`J(EviC1qFF;|e#Mr#&?dW!bG}=Z
zv}SgZI>|#3<(A(EIs|qdWJJtcZa1PN+1(AIk+`LJNVnOwLBk2S-H5`LZaXf{GbrE&
z0szinb4$AZO($D_f!(d8elZ<q)6K2Uyld1qf(*B?YueJ=>>F!3fY7+*Ioc~nMEm#5
zB8iroPj<%cEq=PkCt3dNG%G7apVNt8q~3nl9(z0`;aB1d3>xpOy++3fhtMEyew|Li
z<|DGS*>E^{z2(m85qVZm93qHViz)k-1b~RKR=W6zorsNpy>m`rQ#75G4X2SH>5%Iw
z7|yx~5*J*d_s4nZiaoRT+d{>X^i@v3?q|%HdEpS12L)BoWP(7(^+WyLj|#?j1`&nc
z;$}>?Xj~onQ6J|vHMGA;LWteFW*By=w+#Xr2Xb)F81f<f4RK(HcbcUg>;9u~S6BiS
zO^1)e&d#%cqS~g<a9~6&hII|!5kqM3h3#f)L7=)ny56Fk0Y8up*(T0-G>bGq@Ye7`
zmhm3>E*b;g#OQvAk#zMj(P+XKO_4c~p@qXfH0dQnZ}kV3^eGc<<KechN+4DSnOql9
zCf6)pI4x1bCT<_3sDiPGmQ`fE1uZGS-c*ExdaHnc(R@9VFICZb=yoSM4-5A8tg@Lm
zNeuF{`fh2MGRG*F>jWvUzbTR6tRwNmh*O7X=Du>6=73pNeY6nY%iI}9X|D0C;hA;0
z_?-R`-VY4Csm*0)SUePdF&3Px#_`)Ju8m((SQ90V?(E3XfMFQBsV{eu`|fXveQkbC
zd?nX^nM<&8C5Gw;_Sy}>9!h#JpTkn$b2wsjFk4}RxdW1N<6-nwSn^0s{5m7Hko@7N
z{_J(f8vFU@o`OpCPN}(G1#cnsEk(DF5!l(;Gt|ONF4#Wa&+w4Qj%iVNcL*4&Rf(9O
zt9kkz8~ON3>arl0#I#P`k6xvto-#xCm>{ozF?aMA-Fd(Q0(u-2O}T~!UNtw$o2}?Q
zYc5JX*npHvzVuv>8SQAv)`X->dtpe&2oIH%9)Z;MCQC8PR!*11e9*d_p6C-2;g6ls
zX#U1NJ$R^i%zNGzr8f1R&=CcK(~>GZpVC!tvM1-+w=8s+>A(VkXbCB>o#@KvO5)>x
zx&qdfD{tmS42SQz{6N*@l8RmRR<m;Nx1%>!&^8ja<+8Z~or-8z`nXH%N9pJjic|Ts
zW!M98%5)g1KlU<5*#XUT9mMWk*=g>pWwl8BjS35qi+h=$)XEzmNhpe8RT?8+Y!7f|
zwmijCYjYw_^~rD8b}o;p9X<H<fv6yV@-rKq&WqRb6Z~KDJ(ts(<o%actZ$&uv?Hl|
z+k5n=^XysYAM~$h!;^db@yGm8a-5_w#ygM;qvb&OR%uVuVln_eF637E`604Fb$s|U
z8i;%ojO3#iFTVQf!2=z}ai7odg7($8+UEc;2JXS1QnHb0$=TC+pR@5y0UGjuXDKW$
zJv;?;h1T=~<zLv1tFqTwq<pCm{%+JR*LX+|+?VdIgyliAs*oQdqT4m$dPQ7FP)T+g
z&Z)F6us7mPcHtgV1a`KsxLhDS#f2;FZKnee^lA$(-EWnf7+a2`OFPmL)m0#_V_R@0
z6N)}uPUXTXIGQ+;5X8)N?)OlC@B`LMjTF?p&WkJ?ijW~ZIpEgj51Ml!npQ&h7aqJb
zfs5z5vycy?B+ox}%^G`^4JUyVjFh=ojNIgksx(h%47?D~7p=g{4o21-KTngZX?F3&
zu5$=XCh>vVMRLLyyW>Kr*Y20@Kyab@&kxftTZw^wheP09X~<_fiaAez8N|Bm>;zvo
zDfNsVgfiV$g@}nWE><jPoHa`r>uMLp)YAP1uGUN-3MENfVcJhMRV-$dW25iErC2QT
zEbPguG~|tOMx7lcfx!*OLY%n;gEoJ!yTrsIlXZy0R^>=)Q?MVN(RW%ZJsa;xSiS`k
zQzmFPos}z6kpf(o0_(GX_?`xi*&}3Efa5bokndZ`345U9?`TcOg?_49ED8&{#oC!{
zjAi2@y|G2<Y*s@`Tb{!zIBG1ka$o)ad`kR%UP@U{`BgC1P%L?x_QT@Z0TN~%o-@=8
zP^-yf_x3Auv+t4K-;+jqOfCh&7w^gz_cS=Rw+O{EJm`{o*sH96&};#e9A~DmyPG-u
zwH^1eVWnAjF^pdqTX%jF52gY9ca2jQ#_h_hDh2|JIzp5N=`pP8w2nbs<HU@^&&>o1
zCi9?l{3?~2rp{UtsU()y<%0|)qa@57D`q}$!D%kDVv-EAi<!Cz<YYfh>Ds90bjW{K
zGDjUZme|mL)nwLx`q;$`aQ4tZxj{!9Lbqm+x*yf9YPa`_?SB<8cS**D@R&UFz}(t^
zR-iD%Zl^T_FXMLGsDKfT0kIG$V>zuuN536({d)^lPwV%HvG}IR|HdK;FyFNMT36Ej
zC?=aLkIDx1L9D33`)hm3eLt~+=7;l-a5y)W;rv5}^9q-Lw%;_Ef81s;H}%0x(`z~I
z1O6*GU-E?thk9_;#DY+3<(H^l-xqXyhkWn3X^U010f)r6lR#VwPYI{D7%&%wRXu7t
z(7)SC&|~?GD{!&x-d3o~-*@?Yoy3WMG7d}+uc9<Zw>3ncmv^jbSF-Xf!0f9G!=IaX
zFc9CkAIh_TV!%ihha>zEY#V=m`(2Y}-fGKEW*H(xITc_242G%Sg#3#neG!Sc(fLf(
zcrFnuwb`xapjDX>cpuH~3*uV!YjLP#6Gz_DX+gYU$nrXqc>N+6SM<zwD}yA~-TO>z
z<H`eAWRFztSNTH$mbd3>Szk)@%%&OZJp=usi!a=NT1&O<g~4Sm^mY(7R{?2B6V#w@
zvwH8=T2X3Io6vb1@M@I!;aZiF%355`hj5kibH-7@5`d%(xsG$ev9;#(rDw{FR%5J%
z5Pg`v29t$o(xouT%G#{YDD}lQuVIy0ev`fu6u!eT{}mi)`65{6i?p8;LFbGC13qx&
zw9j#WHnQnnnSA%+DKx#79DF((M>}^qlJ#rQ&dy06n1pCkMkLx!=D<+U=OlPKonFpI
z&K^WMflH5|t~xt+iSkdRf)kgSnZf-t<Y6$0Vr(t|VBZTLl$+wLAT$D3#N0<1NKsb6
zaTE9Ah+-_Yy1N|GHZ4?s$*Xdn&91X-?2ui54fikX#_^J%2E~xso~u34r7wbwh#p*c
z?5ELF4y3{>2I7LObh`F2iU$Xe`fk+LuAQh;QgHN0k**UTDg7;&gR}mntQnmPQ|3jJ
zEit_sN91Ha8bNC_uS>izDh3!PP-)|l0t$y*4nc<!p|7v2``D&(LqaJa0>&~=pmxcB
z?bR1l`?Bx4!Dy<FYDKm404_Pqq#J6HPLDRv_5WsOE;p(nezd^i6cCi;Vf>hP&*fu@
z=<jIapg<a0Pdp%dSnAy&J6mfNaS=I$;wTAZOX|1?-mksd(#pwPjalfX>D!uNGH{|-
z0G-eBmwXOa5<@;|M%ceiO%82JDsohRx?lU=M8o82995yhCRC~1(Ii>aC-qw>FCr5<
z9$V3Jn^11wR3{Wa`j)%o8ryBL5yE%}H?6qi4AEH3Tv>IsOL5j7)}uD|wb!FEM_Z3X
zENw=EnjyawX5WE{i5ae3Vu$;^wzO%CyY^aT{wMSEQO+fHM|`9BBPtG$LaoMsKeSrp
z3Li$modrHPvpXzmYSoiR)kMvdWsMc^ilQ4ft98{;kK7}x2VEPj#124OgOF&2lGEg*
zaVgH{4N{==Uy!(gx|m#;Lnepd&9_<uA<P&;UdHHks^OX(qb>^_18VJ|1%(n%J-ht<
z8FDKVSyXpY*FIYqN}D@w*N$0#)bxgD*0)=?@D$f$n7wrltSRVM-P#2k#1AjdNwMcr
zuJ7H6LJhdvCwky8G6}>8x_PqxQG@sb)WvjMUUT(avkg0Xq&;o4RyrbDD<_FLUk}Sa
z^r<%Lz#X(`>^xEn_O1`rce3dQqwlsGbhN=}6rm3`Zv0&tHNLvVn7zS&C3`)gjgSCv
z3$<`F;?{35A8sUIiZ3{k5Y3Cno5g(kuFJcjUhqKDuRLC#pw*y|wA(4^SjY|LSCj^c
z|DeU@uVNy(??b7=0gGuN>SV2_4JYd+5zh9ZD9(D|fJ$3CaDDg4EjG{jR=E|6FyYW6
z*XoAzKuZe_;d6TbnuHyH%w?i~*XCnCtTiY1aQzxRkK5UB7S`~BnLHk)`Ot3+lKqFZ
znPmQ<<<l7JqxDGy{cJh|ZnAEjV5>1(C-|@0pu=#d6^pNr)<^wK*v5v#mPQvWyFv}z
z@MX}y>lZ?QSZfZ~(|k6A`+39wEOfU=^ze-^e}wb6*6P!I7<aUP={?c6>oVjpAE-f`
z{|Y5X{^GXVA`NdkP8~!|VgUOs-B4jj@7`{_5*UZkl7PlQc2edlD=j_2HMHT-!$DQY
z&lO3SdEk#t$Lz)_i`^t~NXe5;nE(%_X|3HNSC2a{-#SO#uX8j`Uf<)}oM1G#NZiOr
z0=rEAt&JEzE*i0aV@v>5fZamys_6}pB;2bT$q{}OY-aPV>_*4=kBN;NQ)?W1@Z4ro
z5Kj}#Y&Mr#QyU-c>bz<##?vbu=(Svo5c%58O%W(JnH4EQ6V-$8%}on5ltscpa+9UO
zF>@o>@CwUF{T$^BH@heKFp!cUoYnU2!aZUW;y^`KQ>G+;)QLnVh4=#Fu5Wo`Wy_DE
zM&R$saOM+eM@s7N;j8MXt4}Vx;qrjaLIUaN-Sau=w-QP&?aN~uQUBn*`YmsSR~LnX
zzgR($ESIxE2a?w})fZ$Gwe@ZWd-r&Lx7E}XTX$22>P~aakTlpixTY5WT)(Q7hZjzO
zH5)nUxT1)Er>$iA^^0kS=tp=K%fowJ_du7fZ<pii!w67bgxCW^V)9D?x#HL_iQh92
zj#+j&O})>pKFJN-CGlcZ*N;J`gT)JAp@W4BpIW-@9&nm>zlp;~ZEbi6!qGLKR~SzH
znT0VlBn<8m34Da!J%m3L-&Cq8uxl_YE%3TJcQeL+!P4t1GIFdLtix>3wlr?}A}y69
z!UE<UI`C%u91njzW?KGu-AkOFcb6{=qBVk*;oyzh(r`e?Z+>lbD(lk@dcJXWq-KZN
z)k5STc7y~~kU}@ehBcicn4OLnEd*_=oXrP$q2dL9)s?TpFoV@0261yf3p)5xY{xYB
zws`q}-OqyTHIh1T#Zbe0n`bj%bB9ll9Baa<HO4Q~T`&E#{p%hD(=w>zC0Jj+Ik!bJ
z=_YK+yMWX2$t(rB4e!<d0Pz$39ER}&b;ZW)cfBnQt8k4ATK`AB-JP9~dSku3ACb$l
zm?QjRE|DJ3C1t~scvl}n+=_LNPbKhmmZbxK88%A`Jljo$1s+GG-k~f^U^6v)Y1P8J
zYH9f$XU)BZ-Lppgke9_iz<y+m=X5P<fAOuw3r3z;Xtz*pB=hx+Gi&qfyXpE3?yqBj
z74jhQM>tA+UgJEHkiv%vBl`OE+0%_igg)rEye=A~%r8c1$S3H_b!eUmG$=xX1~9UJ
zQMwV)#%t9f>EsTtW}`4L1z)cml|IBY>sBkpoz@p=`Vt-+St<EDS}yr&<>-P3{Rr!C
zZ?=Fs9Hx==wj7y!{^$wYmIoKX$mz>9P9C08FV*kS&c+7g!A0ZQW4C~$n>bg6e5`sY
zG_hqRWvKupya=&8;@&p%J?N;a6L?yGTtb-nu^>^CE%(FXvTJC=L81XYW<y+O3e-wG
zel{a;Dy8Ai{EfThc?GR+GOuu`fgA4$f|HQkGcV(*!8zTPA3{fD@c24Y(?@xBXmRPx
zg2p#8F9ahEW)>c#XlB6<ch7IS^h1{h(0l^ji?=?DOJ}@jjJG+h!CWMOuBmN*M;;jF
zqy+8+;%_D7T)*k!n<(-;e6$)N#HnpwEAUiA0Ft>()wH;zfw<VjN0#19(&=1MDddYT
zz6h;w;e&C<u0sx<l=#;R7e(h{Vm=bT{6RJEH`uk2n(xBCTyQp!vRGhaI59u6|E>s>
z$*yZ;SK%GF?5;75VKE!BOKHM?e}$}rzgUNR=!0Br-keqV@HdH5#GgNgG(~@0qiK86
z)v(l-J3p2_$sXzM)=4o1M5)13xy+bL2!7&6ctsz&_z(=pJ+Q`*f@gKYzxN$%x>p!X
zd#EtE5$CbG$)Y@HspL?5mG0MBM1C+_Lih60TFl`x`cmt+sjyyAG`^aD7V}ACS~u!>
zPY~gh&#v;Z4}-Pza4E?X=4U$KGm9W+cmOtgOb3=ez~(r%+hwnFfp{ySPzt{Ghzmwt
zD|N|7faZ{=BRPwMc3)&94Oaje6pC$|Fbu9qV2WAm@`vRidDsJ6JkkFLNjj@!r!wrp
zWYQiItsGW!pZQDQy0+zis##Rp(l(NZCnqt48@&S@Z3%fhyBrqhNXf&)M3UuWTW1A?
zf`@T~+#X`sCeyr_=Cd202oN@<_xbrWYXcRV7JL*Xg|dNaBEM<|lmy-zS|02vHw_p9
z&b--sScj<ViKTID4+Oi`b9gr_IBU<0G17QZ{v2ZW9nwg#?Ol0)zDfaXN5GxpyMkG3
zbWRyO)JdM`G?1*y7H{D?NtSc`xj>ZAQpcq8`d&#2axpCV)<Zqw|LOLLf2ZX{EET6|
zKEzp0`a?`8pd2&(rNhV`hx+@082W<YtzHlPugC-}(S+}Vdp))^1eh$3l5@JlmyD6B
zxGwwoxKF3Eyh@3GvA5_5q<uO}2d(5>aOLfHEK4hyrh|N5(yz0d3CSzz<m$$rxG2E0
z^M3&aDy92-1N1P^i58c%z$s>o1BGuJR?ib)q$02+S`IZ4v8hR7Gr1&lMMkg%_NR1o
zj;jce$6$MzKH=5`*cQmfw3yS%4Rm8`6O~}#fi_WvHc-ibIKs58w<f%!ID}f?!_zn$
zL*n-K8Sm{!`a~OBb)d;QS+a{N%~nO6XSU1Z<Fqh4ytk?@u1OnHLG)K34W!*8H>#R$
zA$1Cz5jxpdz^@joD5XMJekE(>=c*BNC{rTYmCP=Pry}^<7zV9jrexA4R6(~I*Utij
zBhu~(1s9foey08V?|C8q0~axj?c+e*tjsT!+Fo*rSnXPuWhC%4)1oYu@r`HsR9w3P
z&1K1;>5$1S&LC%=(1RpT)5#wQ{*IM}loGw;%a-sN{!1Cl@CLnM*wZ;<^c@4oT)=GP
zDvZndR2Rl)B>DkIxlz+>UK)<>C^M9x+S-UNqFD5QNDds5fFqHNXAglv13;3o$o?nU
z@S^>7QQ~$i$LCMJF0P?bwA62?%$BI{Xg<b5={tPwG-Z+Hcui59WYc`)Ku{Sx4z_r@
z<WoAHj6KH<>Ku4+B#DJn0O!+5Q8N11(8KqXnM<H#BeYfrr<1Sc*aENyg_85|n~IuZ
zw_d=1$n4fTURgE>8DTiAFli+<?)8BsbXKq#G@Fh=0r}2*{>m!qV~e!>+Z^dYmR$|j
z`bu$%FWq+c<ZeEh1JRI4@XpTtFmKJ{2+~A$A7$lB#Hn8R=XWvbLt5$GXT>=J3c}w|
z!sUun?6}|Hr&hEA#1~kVpE3+E8$_|tjKS7_!gb_cSr|nhk^1S;7^SYWmMFcHAn{~Q
zS5ww7qs`I9o1{~PzS9hK6r>s#ErsJa2xL&ve77Zjo@;Bq-3`-9kfjxY)398ZPU$qD
zY8<C%5e3Z@4y=ad6!jJ(6Y)@7yS~k^0Gnb!38*WOWpp*=QK6k8+pg+Nfs_QGsj;Ph
zX85M9Ce|#k9`T@(gYdqUk9a6bU0L&=dJ#TI!agH11FQSM@I03b683akpFZ#^a_NhJ
zMWyy!mDuP0>^Zpj#&Q&>v&?X!wOSKV8HwoMqDm6gueq@^mr1*Pw(hY5Y9=2XSzynb
zFzq#T{=e}l!25gY-oanA+Lk+W>(%ssi2t276t!4U@52@Rc)N-ptBQOq`?p>Jkhd)X
zBE@TwVYp%ytx`h6QwysbKZiLs8D&<>A%t@4Y_^J`YSoHGGaNe+apH#Q^ks`wG-jfg
z(<~d~KO{D<DmH;Oe7OmiU^N7^;}$AR*uU4rgvt>KvV(+%NpkG#Vf@sxTG!=&D5(t*
z-ECSZ<Ozc%I`-bU(H0`uFp(ugv=4DLKO3qPALAfai~f*I^Tq<LxPyabXYt()k#Xu}
z0G)-a_(0S@jsv*Gby+yX@5Ux2ym3IUp;1)}$w{{P;wyw9-oJpf5RLE`8Dh%)t{Nc^
z@l+A}Ag~Yz=V;nrVxuK5*6+7}%V}l(Lq~$zLpvvm6YpidqmUV)G4ZE}#8k`8)cn|L
zD-IC-+i`ND4jI*tBSFvL@@8(Kd<|MBoTW})U@+tYirN+ZV4|ZAYEY0Or#}Uo6k<7M
zue1J~D+8jXuL>0}zkBht(iSZhE0%GDIxAle_yxcv>vUtaVqolKe`cJ2E??=nw91kT
z9$%}=M?Ms*NXu#$5taua9ac5TI&ZjIi-nYRi;X3L_;CvXBoI0_tR{9_fr7il)EkN_
zEffw!DIxLv@S-S`oS+T1ZpjG?4_K$E?iK06bOP3|Q524+LLShyCkmQy9%1i@DEd*d
z;><4H|F;%Qw_k{Eo#XR=_HybrYj!uCK5U8{h5NvY>3#l_S2tQ*JoELDWRCs(WpCv%
zIr||fK*lIGK=D<08k7_jGL$>ZNtF&MxDWShPm4nbx~83^3MpEHa;zd8o^GspKpJ*?
zeOj^ZrgAUOG)Cc#R|1!j2dRd_#&#<%t_=j@h5?*m^>kH}Zw*&}xtZ{;T$M%SbFE2g
zAPmn2wS?>tHA5(Oe2<EN9Fa0c($()HU}OV}#EU-`=f{JF!rdBAw5Ug{)Z<qorHlu|
zY`R2-i6xFKd`n6?7h{uSjsmgHL&bR?h@go0j$mIA6P~XX8{$h#vlsJWV0ttt$ZZ)P
z`>wr@VwlMf$dhk>35a-FpoVoc9w{M2UHdZQ>L~Umc>%@l>5%Z4W{E_)BcrQZ8wigV
zKnxAF2%v2cO*CPA0j;x#Vg=h+G?}5Tk)gzEd_r9LKx0d!5MDmY{Ol3D-^)qH>@aW8
z>OA}fuWFB>%cCb0s*J9Crnxb~XFNWwxc(4ExBp2ixzkF2?n)i|pe=5^^D?_>YEOdd
ztRdjHSM1klV^qeG2!4ng#gNlmT^Wo-RmS+)rGmvv@ftWZT+td1mQYM?sicv-s7<1D
zvv4Dq>Qf2nDMLpeE1=!_>{(n2E`)ry_`T((@&&ZxgT?%V#r$1c%&SLlmEru&a;>0I
zRk@Ag@(wkBmu;8hUQ7Mif(ic}>PBy^R~>`SZ*WcosdL3SStj@2OLFN_#Mt;4%TGj|
zQJ$;wYn_wRoFiSH6iRv^dy9awzl(wZ>2$Z1>>}>U{@c#S?oZ+(!PorpV8xnPt5RGU
z!1LFPiaO3mu8IwZzH>d5sVl)WsMg@^-}DiKhPu0dCNmEZWl=B)eDN<51X7M>&c^NU
zPDFhEK07~rcye;+dTY;k{%wcsz8$^mEmW_~w6B;KcW$GAh4h!+RdJ-&Z(PAL>atql
z`k{o9Z%wDM=037$_Fp^*euZRI9msnn6P?zoO)}0Uu<Hg2d2(IA+CM9glK<UKU*l&K
zX64|2wgB%KUqXgftY-a~pyHLUlzgF6_=hxPigY{xdk7g9$-YDov6qwUX1RLW6)}PS
zIZ5G-T;}ynQ16D-<HFV0=mz%fcf)OYSm92-Nq#Jg@e0Cz2Gy*U+-oJD{s5bouVcau
znFcd83}6SQZN4GiO?MC&&A-$*I=-w*n;*%4xsmA7EI3JC50%Szv*lA|bqKFRGzYDv
ztAU6>$M>TT21GhDwB<r-agK_C6lkAjKK4%1u-qkayys0QvTpOh>fwuy)K<@)_%&<}
z&PBVzV6FR`+;OZ2m3tj@zb;T<ZhRCR(S2I>RT9YA-OuQx(*J+<$q(8?+MmsJ@m)uM
z(V?po6R)1FW6gfIt`1K|jy5xVzawd#2js;i6)2bQN|H?S%sVQyezRm=?Q{8x^Z7ZK
zZyZ1-90O7nq9hVE@IS>co!*~jDQ6|%@sgM)Y0C#4TcK|!CgI9iSvjDee%1qH3|=#0
z7RwAQ&!7r#IU_bZ#*IGImpVuZInXkHlbuLha$u=jlb9URt5l!$?f>_Id|e@OHO%3I
zCF*~kC5ra>?+`4OPnMoy@gufFwL~U4Vm0SY^2{RqIroiI3;Goca>ZEHv)=d7=w7<#
zTD<e`2R+9*f|I(`aJ6<w#qG>bHLK9Z0Tr8Z3-0i_uW4Hkr&uflU>!Q0j&Xy3fMNwj
zayv~kw6&2vTQ`0q+yq99idu0xuZ^M;b|@is$;tfklE}Vt7#HkyyZEkP!Wze+k$g$%
zyXi#zKPAbhs`GER>!I`@-F^*61@)OF-zbLd_B*~pAK>wZle^e09*AMhSE5dO7M^B)
z_Jx>P0tbKPAc~tO=Ht%KbEye`+S_91)^OJv)*SHIGq+JfxMi_f{+D`yM=2w*N<Rt9
zFvL!Yzo@rLJapqqcHjl_1}%k91L(L3@k~k1ie?&emMfZa8REoC(zv$cu{pv}U}o0`
z`O2_%y<$aeO32<W|I~TCD=}C4tqU_mJHddoA_q-2lN>Yf-U$jEjh$(K%?BL#{_`2h
zvKKVKJ3d#~NfDedoN^+mtMJ=#QqO{&4eS3_f^IAW^r7#*j9j}sp<OPx_D})vkZFeK
z8%#WyFV|XoVj;`H4<s{*MA|afwM%qE%A(|*^2gicn09tP?Ihn6*YPUul?}OPzO?+h
z)#MwFncCECs69Co{J&j)exeIivSXz^yXE{`e80iXv7>K#dHPDM6Aq_TbKqSWYFA)d
zK*%FVQ?5>z#=AD>vRoMYuHZQACJ;C;i|LIv4Wo$kn{vLKAgZ>4H+wi!GSD7Le#{P=
zAzA;dk1-yrJQ%Jb9c39r#m8UCotD^-GtF`YqQ<9T;<?)pLG8(Z5;lbNt6&pHA+3yS
ztZk1}#wFcE|Ec!%p~Bm$3U8~lugdy;(82y^>tLq}(z{Fpqk~e_zrs*f@dpa0;Mx{5
z4OC8~eFOxw?i_e~T=fJl)~(*GZ9v`FOcyIv6<ukY_BZY+pdn7$KKo&nysdw~sZuK@
zEq3=EJz5fa+Ti<t_RG4VPjqp3!X{4AU^bOxx?piC(+=PQDmibNzyY{bKITX?nx>vm
z?+V5DmZYz51vGbIL~1`iwVQ{g(mmk1z1jM~scf`!k$)1p-H8~nNM&2(z}8^Yy8Cn8
z@~!~*f89x*`H)5vg8^h$x>(0Le1e40EsNRoahGo!xcL@;ahof7tWNj6X0A5Hh<e`-
zHao_~Vt;e0LVql>(i&TV>os(yooAILYtW~UVnTQtse<v{C7H`%7r3hx6?od({fY`#
z@g=MD^WVIR)rxDeU}Epx-Kfs<Hedm_jedMb$y;xOAh6{)#Z64vlFA)fgg01kCp)aM
z-YZPhhpP;K)X|yIa4w=v*=5RjJAC)E!CK>P&Q@ML?lr_usHScxOlnGRMd`y_p^54&
z+1Xqco^Meij*{<A9<`Fk-@RxhUp;u<N*>;)kN3Z$|M}bVf6&Ko=zosCp<f?pPUqUG
z*VORl>kY`SVOH(P#>%0Hz;<hY^??6#{216r?ML)~pNnbx2@UgH{_|tn{u|9^GHahc
z<=-CO=NBH{Uo~#-!^Vw5w5c;`%BnZ`O>Sva-^{LFiEMn6IK{7lW2yhfbJI$thi$Rb
zO0@{^(^^meZA*`wY3-5b`We4YK@za!GG~JXhui27j1Q9(CA|353V#G6_IsdQcliXP
z^sS|TQblE)@0&33M4UV&w8%%nmPf}&_rJ~PatnTjknNE8ELo2q&4#of`)n(9swci=
zfB||CZy%ub`>c>54}Dr(A4SE})A_7GShhGEBz^|#CwHYVw6WoQG*&c4*63R<o-d-(
zYL1QCba~I*B@*LHgECLAA<@$Mke0{y*$r=hAm8{b&(Jn3X`T#6XX&Y^P~Z3-uTD@Q
zUY_sWXLVSf?!kmUA;t5CQ$__-4>AFUW=<Z<;vW+A`*xy>E&HRV23MPt+;q80hG>Nk
zVKU7}sNV82yD3|>1rsRAEWaG<12gQU?Sv*xGFpUU`M!93|MYQkdjG-G$Gzm_e?8@Y
z9UcN@B2<KRtS_)kZKq<}nd0z1Mx7P~dsiCZAK9HZDh7z=WIH!quu<Ac{^9(8{I;8=
z7&>gSQ2vqM$Q6hDL+EQhk%FedY-QJU1<NbY-V}2(Oi0_{-u<Vik6+lNIhI~9brsV_
zRtTAd$^As3>EmO=aG*+Z)DAabv=f(q8#tS$<1$rz(d5yir^&wAaA?{FV5x@ZwExn_
zJgd37=Q62!M>V^2a+M7y>M>f|I^C9+$^-GRS^`&$0LV0TgaxK4Mt83<C_6?*tiwtx
z2xv&U^?u};;KcMGp<s&7i*j~3&1k<C(aBG`I+Ku8e%3AjIc%hzA5El1`u(7Pm7G1h
z*<#b98*B9>*=Dn4TiZPu7uOfV^kufKrb}xOtv|>w|JOX5-fXM!^ZfFkXz!rqih3o+
z{~LUockXm?5G4(rIxVIoJFz4u+`m-UCY=te7}+}t<9uBm%eN_G$pZB`2#Y<<WJlx#
zKLyYmC3FZ7Ai_38+EZXqbgemmzwurfUIG@AbYgts@uyBm8b%3M$bH|AHDb+;h?$5O
zs9Qc^$h59WF_{mU#kz|o{RCcZO&@l`<<1WGk}l}O*;8Lnh6eB@MEeM0DfbM%>v(SP
zgb~=FFD4lkhOdCLp6S&lS(gzs4L%kIZpQs9B63J~ck@>!VM8&Y_|&(5dMhe*@-m+Y
zkiP7>XF;@)Ap!y?=Ia<zhF0hg=L4UtUVA^m&B+-wI!;euMCXBI*z&;LIa}C9kg&k6
zIG}i$IAU^$v0mm@m{l6e6q1zB!C~B8E>`sAbF>5yCui^==jS7mLm{YbGBy9!T9Y}x
z2oFroxMHN24(05FO&3{zIo_LTvPUd1wW?nPo^+yf;z_6FFjE<8w*SM|;<4%i@(?XX
z7y>9S1{wnms^m%*q}kDxKfiGjvwI|vn2T|AXP?ZcXc;P7%K+qgYDAlgQoUh<u^r_B
zsVk0DOOE@mQ<F}UL85A+ZPNbd>-XAXEcE`&WhK>U%T1?d2VOUSf_Qz~ZPjGEVa)Iv
zW>)UvdrpOVI81>cvL>if@_00%O^0D|oOtQ4#V$T5nFHr*1!xUP)SOVJVPn!`pL-O`
z-IF0Zd!r!M#huG9ektjYBo{*g$hwp4BP-cTn8FU_Q%1r9K|d0kmGy7qsPGSma@^Ww
z{x6jDI5?2e;mEsxyR-Hvo$WQyF}Xwl5MQia`azZ6&D*uxJ9Vv#sw=UJ1L@<L6~mUY
z#kZWoGX!h8y4s9LRQmQ{<Q(^PD__uPp7|2l$@gH;4_WWrc!Onuf`Z$MgM`*P3fIP8
zKjFx&7gDg#->?n4JMm6t2?d)<gGO6{968g(G=%ohu~wyjie8pb&Q)FYe)_q`GaKJj
zXb@|nD&I_C?h{;gIk5@w`L%kHivSld`7L(yYX!Pd2_b?3<KIrQbV?-qEm|(6h4XaU
zsTh*CoNfgX%DZF3_LT{&mu@8niJFI%+dICEcNGn8nphR|_93Y6Lt@o$II$`^sp}<H
zZPlZ_FrR9FyB=unXOxe5y0JfT&7>wpoFw6OG#?3-@rt(3XySg-*KgfV`g(OggXS!)
zP5No{$c7#LVyQyY##Etz?AKF;c#%b%*eVmUCM!K~VOak~oezcJ*Nkj0P7%C<TD(L_
zB?fN*N8N}B+!b37ZivHr9wm)$%Aj=2&R=Nl?5@Xus;V>kz^mQ~ulo37Bgr3sti{$g
z<q!^HDJ(_2CQFdHyBWXA#<@Zp_SuDUE!v!>3>D6L!Rc9PnP((OPZ$nhjD#esADH8~
zq$D8@h<jxz`<n9CuH0TsV#GrwbEYRRS@EIMA2X{u2R!Iiul)PZuO3V4+9QEaTU&;A
zT2N?z6p{dDdRg=9hz7YRA?@cGQ>1No#B{C`_VW*-cU$j<iD)Hz`R^O@#Y{{gOL=1>
zxs>UBJI#&8tqa!?!22X|1JoTm88|5v>3I9Q{^4ER_T9h3G~TCA2OV_(^tT){1s?Sa
z3KIjnGWmGsHxw61rHG(iVZ_yE<uZg%<JlX3JG#-ce4wL-YeLG9DC2ayLW(w7=>g-B
zzt`52(`3r-egPNbQkN!+NJF<!n00s?YRuJve-J}HsLa1nmDwHDUlWYvw*^(Qo(3L=
z4y&HLoUzO+C8nB`aHTh!tqy6~+ZaxRu70cGROOc24X06T*>pT?k)LIgaCIyOe|1HF
zojZYrp+qauD4=i<gDy8*9TRsd$%z}_q+mEjEMwhjuR_F_!P^Zd!jRp3AbvO^RGHMZ
zHbhWmI2O$pNN$>tm7HYqbNfOHJ>ZcG<HY$`zRAV;ut>^Nw9q<*tFn<s!V{Z`_-^PT
z%CTxT5TUlh_8k>ywc@P!BT%3tpGEC|>y1oC9F9w`dT}glYGZ-Sk2o+Ag)OdWDr%n3
z2TARN!RWVZFshu{_uOn`xe2JXiy+C{8IP=$iMGP0#(C9^Q6!nD13;l5wtt;vFZEAW
zs~PiGy%o>sYu*jsi*5N}j7mmccZ*}}gq8@cxpsW=ZSv<oeR4;?K1z0P=wJJP*|YXw
zaQgMvN2AeESstC7ocy2NRyf0C_wFZm@3imSX@Byk)4TVM?)}Hny-zxyeDVpN<75G9
z`GjY)e_)EW2yi@m5;eCo`%v2a?=pLpPM%bxlTGGbL;_A|jdP0-P%cO-XBBb9M-SN#
zicsGy#=Mm&aWLpSd)C3)CcLVDYq{LqM1DiQw?76W@)Fh?{FxKKy@@DGXrPT}grH1*
zC6>=fVkkLeW}0PN6VJ5Kt~6Tfg_#<v`mWAJ3}39U{4}|sciO}JW#&t`DJK6|@C_x5
z60c4(rlMTC%D2ks<`M^mZ%y_wJSnUlZZxg!z@hNzL8WKP?4NUt9i5ebKDo;m+znu}
zc6PoLS}+I9$DE`jlpoH+0Cknj&c4_6Mu76^9DM&OB`!GpVL#dyTB;fS%JFyC>8yYC
z*H>RWJN@eaoPK-f{$T#>K!nzC{WcO<^~E+`3~h+W!b2dL);QkTu?!}cPDe|cO;d|6
z;{Y(c;A>VaDwM1lb+np)sQ>Hp>v%IY+!0M_$zTrk!;>2H7ym4;(`3f|tGGG&Zc&5L
zOO>yDP!qp}JOIgd6Uxrx<YE!fA^<*jl@ABgOyg|7!OwO_c6R(Ztz+icQ@SuG^AY0G
zF(OvB<f9QTv>`J%eq@gvKdS%gL6_{QDuz-ZU5vBWa<Ch*;Uds~H&#)nis+}He|7~n
z!h#FRYd4RC(<QDmiQDER#9|zb&2lCJaJzJPjk?j?yd_r(ZE(LiUM<H)parl(MoQ_%
zL!!Qx5(k%sot$7`#}~qUTK<P9%Ti)U{V8ylXW1cWx*V&|v)}K=3nD*9D6f7r6?)+x
zxi#fzdx4<hhw!9-pVdDj!qcJ%&z<{d(vut|{>J!rIAp$)`Y0a|p&dAHif%JWr>a<0
zTCW_3Ap6%>AS}7^kOLN62749n-Zyk4uoGW3ou2Q?EIzqq49qZd6tMYP9Q!jCj5>T(
z=kDIYnQnek)kj0vfUl}y$ULX#$R;i3WjwEmeyd~qs>ob_sJiT(Y=HJA67vOdyiSPs
z;|CLD8CQ3MhoepFYFAJ8AUmI5?(BT$SPy@}Wg>kh$&d5VL@LGKL~=vrV6o65B#M|g
zcMRp4pUf{VG9I?v#jI>ToIE-~0c1?C^BV*w*B_))c1c<|2$tijCA$p$akh;b{FwF?
z53IVGaXnLimMzQ_aodd9o?#fi-fJZ<Nx>KV;VQyIG-d$A?Y}%Q<mM2>3hj`f!b{6Z
zgRBThDv`s((%btg2%2Z4#C_EFZq*PJTggdI+ni4I)A9Hft?aqJ)nc3a1c+%7t<$_?
zb*%xoS+a|qat-p|ES17`f{=b%=VE+bq|<>Wx1dUYvL0&)yG_F0*YoqEowINKYucYz
zl&<FIu>{V<_wFYZI@@m3U)D-nThU3~AH1SdiQBAl=gv;;tAsRBW&pWZfEZWcoX(+<
ze)>Orq@M5IYu~xszWe94T8r9v_E0}`Ik!uS#{M_8Jv!BhOM^|5*IQGIq`~fMR*AIr
z|Gl$+<Ng#>l`9{S0?c@k<L!}+II;D&K@5N!%6n^94yV{?hFsJ9_|^_%XCm0l5P5r_
zu(%YFB^+WFt@0$^4Gbql68kU5MAm%S#&OnJF~^4}JytQ?EbQ^4Px#-TK5=-bcsb||
z-1&;=8_3^?Q{sjqpnKO>^#b2)`vTvD7x*84{sR9)F7PXJlh&^9KW=k<Z#KWa|9Jne
z?>|0V-}n9c7T05_TdGQL?GkIVU2C?XC$_!DUoNiBYR{!`9~;I3V_hh&gjvcf4UXm|
zqu&VNS@PYBrve|5nJ#?xAT6^$eVSxrlxrF24lIBY`EwV&m)&y`;HEcSG+8fyx`c9n
zESl|mM?Y#4T@Fb4W-Zv!Um><^`^DAQ!Y}<b0@t<@_@<Y!X<wDJ(Gh!+$MM^nRoja1
zJMLpdAokz=J=Y|AJTi{!2GkKpH->GE=4!P}n`YYiCC@Nd;az-RZ!=f8?GdVBb5&Bo
zJ#~J~`zqWrEDyklB~#!94btgLR1&>^yqdL=%W0O4@t^c&rHpW{K)}&lxu;)st|d!4
z4g31KY$fHWm5c@n&G)jEydJI%g-b6cwYj3F&aX;`xuTVaWPh_3hVkvH)7hM*GTlY)
zst#BIuXjDyK@_$53(oaC^RAd*XkQ-)km7M)nEeK{Y2jSItHc`TXgff_RqRH8sg3kY
z(JKaExd7OuP4yR<Ysy{zvQv#T6b63Vnqs1@`F2^65O6t;fb^v#d<=x)jWC!U+xrcc
z)ZYMLT1g$k^jrbtCKF^#(Nki;zj01{S=nkGlXp~uBomJ;aP*)X@KiaN>D`nfk#&8K
zbsL-ChAPdHVhSr18?V`HSGT!;rE;>Fin47jg-88Okvs=tm(sd78&o7%DZIE(0iO#Y
z^l(2jMpBZhjpy0yI;(lHEe_&btMze^ot&K0d^XIQN8L=nSB_d6o^iu!h2p<!B}qL|
zlXp6+Psr2dqW{WKFHv^93b0ijz#G&y6XILR7@;n!&3z`!Z&jN2hR5cAwO%HXuXC=^
zLb7$ad=0^R>$makCG2`))2}h=O=aabzs2O*H(^q3W6o2UN?Wt%FXRtNTq+SMvyfnx
z4<An)BvGy`@CFR^eqc234NF5P5_uqFI_nRMaz(BQKXOoQ{2{)LT7Q%9lhS%ab-yx_
zIoGc0S6W#=Oed)5m%2KCem>gB%d;Z&b>vMR>)NmKED$o}5E*^JKs{^33nhMu0aK&l
zc0vihm<*(J_jtZNL0%f|N~5)2I592!Dh@GoDMH!koFj^vS(Y?~DImWe@I^(T5EcF7
z5+S9A4Y}eNBP$FMbco92O}kn_d%oZIA)g3bwo=IXzodpn#Z|z6sNP)o8GE4Mx^5e3
zSci~%-3GHpl3iRNqHSNHv`57t9kv{>GZYp{U^$ScWx1q!xj0*O5MlO(4U!g*gTq<H
zU_vJkmun~rjl1){=?l+fF|(0HqT+8^Ry}5Z?v(@Asb8O8Qt#NFL**CIG~Qm#c-QhS
z;IU08NO91E+Aw^7_Lyw^LK5zhamL2#LFN2yAmzSmnKm*s$K%{cu6@T+Y_s9CGTxdb
z>*P8w)2?CeyuB8=MWg2$rpk9W&J7Hf3yW8WfF>(xUqIb9%4Ai~8X}y95isa9Ya}7C
z0nc$@y8J4hp@q6h>X4SDj>y2!@EIt$W@CLkBA&Wk^neV1O?v2ns0Xf`<iA*s;561p
z>sZG@o10=cag*zZd_8U&?E5CD#FP9r@qT`3L?7<(`7rHgSH*CkwcFQ47LjGMiy9v5
ziEpv91O}%9YrB#=FYYi(x$UfQl&w3%Te5{Z3)ohN3+VfHz-mGUJwxt`tZb9T=Jth9
zHz|WEB?=mU6PLrSuY<yHl+9L2IwDX!MGxCQwfGbnj8btBYR*f7q{F|LQj&cp$r?<=
zeKVWVa6g=okU!yW<`c;wW38GYJwOCmYoBIX9X>68k*L7xET!e!O|*N?FR#zIf_~py
zz7@@Jy~5|~F|XRczz<hzbL$%N?HJ#B>hu=W<ojBGgIks#3kvfu-8V!-t>cYIcJmP`
z@%`7wyUAaYUE1X#P86-*;bd^J8wbL1Q9X#jLPa1SN)d37mvgILHES}Y`?@vGj=3Rs
zsQvTi{n{}&zOb~;mIu9Zb<4H<o?6~U!Z$gkP3b2FdkVIbGy~kO;R(DH+oUJCg#`&j
zxve9ATUqp0t5NHT`3f!XSSrpX&wzg6uGKqQS*;T!D?4I581xthNZL|cCA<g%_ry+#
z9$HL&eL*k!cVeLx7x}P(!ZfTbTi8=w*>c&5ZS+sQ!!uh0=v!;|S1QqOR@a07B?GXP
zNdCGZ(=iN<5KGin(m!ear7BZtf=CY`z&*Zy(me<kJ+7OW*aywR7qOsi(u$Vib{Qy6
z8p6izmj|6Dw^Sg-t?iRCmlUqkL#{X+c$Y#T7w<W8jwYszGP2UAbvWr21RIBPUT#f%
zr6#-9WTgj8J@{gA9!gLTT_0sIIR;-r@r!BkDj!IsRGFOptvGL%8Sj45{joTY%Eab>
zmYsjb0}%<y-bVW*X?A%I@{_zp3k!daCw!jZ?DL>5r|IOXg=BZwT6xGV_;C8!umvG}
zir}yOA~}=4(;*|7R{GVB?GfpkJw}$t@5Fh(h#QHxes2V}F=%HsU}NLXy?0`6G|44$
zuEQUFdtASYRO&%X-x|t~o2KiL97D~2UuOG=SyvS<?ToGwU7fXWnQ=HQChksfr}g-4
z$te65cHs)2&^dc+xy)RD)d?Aawb~FMt70ke5(D0{?<0O+De%y=E$?ov9mNM2!glQy
z)M8+-pifHZ(bGy)GzMn?-xVu#c@1Mm-3ZN%ZECr215*%(733`%?|T<d>ytQtVZF(Q
z1Br#uP(`a>+Y;cbDDZ@Y698Os8F)o!m2i}5WHpcOZr2c8X?*^-&{X3CD;QrA0{d8e
za?;!1PQLx7^8q;by#dbs_+tiZOlQ1&Tr)QHx9b9jQRO=!0I5J$zfSbm-}MEdpy<b%
zi25NZ-9E$}-5(BpUnH_!$cbOO7kYnre@FQ^oYS%Uv}9(~ynky^>#Zc4PK#;SnNjUE
zVp6tTY5Lbm+1)OP@jKKo4b-^VAhSkUTmg%MN)c*2Y;Ca+v!M2o*^F?gLcp+F#c@jv
z&h#=%zDg&_W~j~$<Ck=rAvbtQ4Tj<RGU9BQjX1Dwd*>%|?UlaP@=D*{Pd}T0f9J|#
zm&WBC-D5JLO)E|0@-M<9U{2)Tj&OT5u28myZY3#yAej1gs*XEtxvW+e%f|CjnQUwP
zJZ?0(y}`5DgsG=cB@rn(%#L=P1)G3BF_D61jK)wF%n_LupY2x6TBtWe@S3<7=Yv4%
z(;mv($$niMVFmfMLGy?dpE#Ote{)(H6SxJwgIf?WZrBI6`Vm*+d_+HumS0TPR<!&=
z!inATL<&u~6qSIiB^nOfVgtb?SPJHQl{Kz4d>bO5$5hSt*h$E%(b0UPfZJ}$tY$RC
z>NF)r21WIVMCXvC#@W`aWgZ}{%dK~{^(FoK4{@w@kiMvIkc{)%&~<3;fAWs+ad@*N
z74oX7``f2QE@<wZrAIce-g~OvxuZH84YzhMxh-n*^x0EcZ2Yy-Vyh3aVVp@gzSx9t
zqu=!%@9~)4Yn^>vEU<O|E%vf6BDTv|ASm(Cc0K5u{aemS1%+c_wT0kQ@AIoWMAqo2
zezBXLm&I@nb-9?dKTU?&f5ohQmzi9f$lNU3{qpOKPG<6lpZc@c9q<uIJU@Sacy;H?
zp7P1?Lg1oIvoS*7-h8OwxMl^%X@+H?U06O__gF1;?1lYOEzjs);T*ERY|kS7wr1%j
z+jMLr#;NM8BOPsIppL1jndl!9rN^UB?DRP=qc51yXB$iP0kPu}e}|aXnmz@>64ACg
zu5&=_Z;1B3rt{hB^_U%ft_f1bnB|TycEQ$)>yF}}Pl|H(EGx_Ol6I7DChh9(mnUFL
z`1H93aDRyg{n*FFHT`$iztY?gZUC|q54<)h8PAX9j&@Gc6FYdHlGu`w?6tr1yFG1W
zueI~LefH!YBwu`)fBdxbyWiy(iG0)Hkhm|t_#)Z6lA-eNze|TCM(x{of5BIWhbW&x
z47V&A3Q_=$S$2`FfI*cVdiUp@-~CL3VC8X#TH}eExPXY!ZHWtcU*HF&O)lGjc+&gN
zj~56EwD25p+P^BwY%JzDl>xX)bzgGZet(8`HW483=K2Bze~<FL6(DqW%glyrixnH7
zV^nQ>$>y@bN=hkVQT?F*^~))pj4YZ+h#}plIV#xnxlq&646rpjQRsTZ8?C{IMqSm?
zw>E%8P40dg#TTKOrarU;>$G^8CEw=*q8%G`5~=>z{C?02)`S|4{EWwlI@}s{k;YuB
zOkeQlLVZLce_o>eVNe{r!|tc46p@-;7fCUZ%-{>Xg#3^;aO4^)HTp*~nc)_b=U9js
zL8u#W3+0F_=HNF;U)BcT?YY-dh$52ps_(JsbZRfs7sM$rm$+Df{48`ap8rN960g#4
zxucWGZl$@^(IAx<-aFE%(_2V8-z?Al{Y6n!BZ9kJf64k~F;9i;IJD9?^}NJZa&qrm
zHG8j@;CnbME{jh2%JMVxQoj`-jEwL<=@0}oo-Y4%*wTC7qU*bAWc0Y3fj0S)nrs>F
z0kuQ~WdFy>Ws5Fei>7eUl0HB<?(zHkTswpzk4iesG_?a^b$lM5<g;LSYVV^fRJ;P%
z7-zMve<0`j4*vd{1Yb|^*o||M&njuL=f&$)8K`uO+3?%6y_;d@943KZgWC)d-tvoJ
zxFosnG32zxT%y>@_=f0eS}OSV@6VpYIw{YyDpFh9O{gX^JiBP7>ze6mGZIX<vNsUb
zFP*{+i!8mN{+QrBCWQ-!8pi|O`*T-3IX0ATe?IOSgY`u1BiCG89&fwDbw2OE%x0af
z>b`HS{I)k&UMu`47Dl4FIa`xTtktfxTJMMDl<2$IWKRS^{c>q?8vl9?y(sDNx1dWL
zguLq-+ih_aiPeJQrr8fH4m(7DSht~@g9V4N{(!bO5*woVb}sXagH<xZg1LXF@BKf|
ze~u^BwpNBq(LsqVcqjl(t9|6Om6L21l?S6YV9m2?Ug=)z&cR|^UX$XxVU%g3Ub{AQ
zyL!cFtjCyFsE4sM!(S>*b1pPr2y$UcK`FJsHbA=4tO6QIb5g;@@}z=3zf>Ci39<@c
z3fmTu9dcXNCMJr%f>~Pl!(i?*+c5Nge>xqo9yNtl$ksBLl-Ni&^EGx`qBm;Xgh@y2
zHAa?56*@L~aAOYi7E=(#+8-6Kn2(19TqPGEP1#BnQV%X1T1!2q<&2-V!8mX#=eN&Z
zgX23*bw1AjInT`d9c}y)uP#>e7Eat4^zW_QwvV^5Xfi{Gjiq-*P7H6pM-bCWe|_xt
zNA2j?;M~iJHg@>VY4#6)!K>Qq@C6B<;NeX(qDyp>L>T4k>V53o55}78f6_|sw354$
zz`>l?H?<Mlb#H}c&2~7{&dcnkX>_lmum^f5v7CR+C+RU_R?iqWjWWJnrC6QI`D9W|
zxpE<IB;sl~;E4VdFy^al)Ja~{fBG(6=dMG3x94LcXZ0(s&z?z<b_*-kPr}F*`E9xQ
z5jXom=y*r5(aw*CNLVWX+jHOceC#v(KbyR9#4Q46&yVGf_sw}p;6U6LUZ%m*IZ4Ly
z^G=N56Hz|b94L?oIt^X18&En?F19+=eZw^Oir4)&R72;#&A$do?5*<me}7BWeg510
z<6U6p5#NOnm|#`?oqKTus@vn%@%Nn%M}4ikz(AKA#@h&DuxuB4yB9^Vdz9SiC7n(u
z*adDb6lXqc#)@4Kr`qOF5{A<8kQRA2c-s(?<cfG;Bz=(fX7>qjE?*SayB{{kcHtR`
zj<OTaUq_zQ6;WUA-@Q*hf2m?NjPh|lnvc}&NgYh`*V(W{nGzW80H|WR@h<nh%fJ&E
z3m(|5|8cwUbp}XO-GbZf!redDcHv6e43_`Hzva8|JiW}vsTVBQrAWKa(s6nzT7zi@
zyGhiZY8WGZP*sELg4D9vRWT@!U?+)$@FND~V&EH>Ajb(GmlCwlf2zprQZQJIOCnP+
zq?sXyPuLA^y|~aU4YaUEh-zM!Y&~Eq+De9*D6nF(Dql)eyqlKhQ~4zC)4<HgL)CMP
zX!}>BEwXH%SBsLEqH4Q<-{#|4<6T$-Tjov;MJ5dC=XI!4qF`1?IQ2VP&0_x_a~HC(
z3g70taBs;j2#<yhe{RCA=nb}`o-Feo?}Ft^O0}MHW1J<&Dk?Hk2$QKzr&GFe11;73
zL8Dj&BK50+ZoqBd47V|i40ziB-B8nItzZ4V{!%bs<^UDqv4BH#79^8BEiUb-Zp}eb
zTy|ZPl^)n#;=fo6ZwU}alC%E8!nn79xb*w8U>uuRzk}(me}&@FINkTn^czp|14z+Z
z0q0aOb8!AYpc8EyooLY_8)1BwPPRo5M`%i0#E9vSm4pugSejXpBi=R@m^J$ECbSB#
zt(|!g4ePzD#>10a7CZZ{kV=|EVYd${A^;l2_%fdXn02X%BNAord=@6r+xvD2Gn_*E
zg!5!b9W!}ue}j%b`y}Yd-e1xWcl3XXVzh?QCKk@``HudD_v2<4SnAU0O9@L_ANC@$
z%Fzi!3RPz%$Vox>qY2++vAW^#P551%3dqG|DiJgs|KbRSi^^FRZgi`lqfLU5ZWWTW
z^mOAAPqWMF04wnL`h;LmG0KU9#>A?Tx;reGDmA3mf6R)>)9hk~<C*-CZ$mZz#U1=V
z)-Maa%{jS5X{O`aX_g+&i`lFgy<pp6(94=V$lJ-3UvKCoVqnvkC^NJ@E@th8Z3{n>
zPb-;P@SxAfufM$+hm*G@;JMz`?iy^b`p)~u`=&23!G~dKsrNxdXE*}QYgjj%{v(Oy
zXLypUe=Hqj)BhSLABEqR^K<*be+eKUhScr+*ZAY$VHgDP&G(%BdR-(Mza*rndf<J&
zea9!+SqSD*ZWAr}NrqVIe27aNA1{B&XZm};EIV|v<&Mv8CI!#prac+XFY|G-k1}kJ
zEPzl-v9*%BuZIU85CJ|Q0=x|(K#kaM1reZ5f2}*UgBnD79o0@GUHai9n{IY4+wu~f
z&nRH5;$;C(86jp9nLl&l({v^KifZJzGHS4HjU`KCu2mL8@h6w@Z7BY36<y&G=u14U
zi?#K2s#{hoHcED4kqWt@7OrYsy%v+alH+pQ?=QR6>8)3iruOfaMO%YFzD-5>RW)d~
ze^;vY7HR;Gj!)xhJ{x9B*Y1{uC1t~A+`N|X;J;0<#?PH4YbUoRt{=O_^0Ci}!UCe#
zX_^W;vIfegA6;BEcH^S4%RFILH8vjI8ueoR=;B(jTP+n!4J7r^tx+Y`j}8@LAHI_U
zvEiq%0-cSrRvR{|2rExjYv29Sql;?ee??xs-<at5CKMT)Xk;WPI-(eouSV*X#ITwW
z2vKl-`S9_?K~j|izny44(_orjv(xTPf+tz}lQEt3hef$U(BwyILgqt!8@2u>;U}f_
zhCHq^6e-qE<Fe{7m`#wv6_l%Yd0R3Ph%1;TogjIWhr0HwJPG*pT%j+YAr|4rf0OXW
z@uSgjtHPNgV{cJH>q?7p`+i|B)-Ovi%*QWf9;u15Kx?NLI?1tOZk|cCD}Dhrf~DXT
zk3qzqARlTzvwA~bev(1ScIax$F5rG2%kHOI#>z+mqqpm0Wo@_mQr=jimjvrPEP>8Q
zOWdoWk?5xB7!Z^))Vy?#)>0W(f7Z}-b>^{py)S5xncU}o?dIbPnheRmvK%SPn4E;f
z2lwNTPar$?KmPcL&zXCXM;&J?^_wj!9d713vB{FAu(YWl8(M2`@!OAIrNhSe;)(|V
zPG)Uz-BJfTI~)w;yOaFvXgg+ZpT>a%<nWK>7)w3sO(Brm+*Vt+(EFyMf2MCyRzup|
zz}eMs^*-cdeW+FOp;pCvTB~9Wt^Cbes`xha@J74%FQH?L8;zIZRQ26;l+@)KYDIqz
zb>~V9$1u>5x6w1p%adX<pDfdj(Q`l0f7jA}SNneP<_f)+@f8By_RU&q?P{-cIa;OD
zzA*+E$(Aa+;fit0x>JYLe?-{(cAT8d`~9peHT#^tc#JF6Q*kTArt=R&gka(6Q32X{
zh2+<E@>QV{%6vMcj|P)LS4FP%S&YE~VU=-Qz`@X#g~CuPDG_067=%HtZd>-A8eztd
zcSQm)hDyJPhJc?`;n9Xg5xT{zO)J2w<K};Ig%XbZ6%eox^Y}ilf5R4h5V!R`Y!Iwl
z$tu{`*I>5tg$O5&`rDeNQ|+3qT{l&4IqSQuPw@o}=PBidx!H^PFw|?I7mJf|Yl>~y
zr1p^5XLkPt-z?N_QDV<QNopmRhFW`3TN^3|!9X|A4jKplK|lB(2@<uDrV;~1c}X5(
zQaYY9wAz}A%bO%te-8j8Wi8(M_k*6&rOH{|PDQq4BY5R4A}8DmIN{v^CN!Z6teeih
z`=ls#lfNXp57Ozb!6C~wZ8Q0Y6G4V)Kf5Z1DCDrg2v361MAhqA!>w1AK6hAColQr`
z#xOQ!>Iqvv(JG9AIlf@7APT+OMg`ZW^R{bvAIyNIHZENIe-<O06$LWtZY;@D0{33~
zwvn;o-ShdloMkDix(a7x!QW#P3+jUeFAV%x5x-d{hzssYT%bORr*xQadTN6h!*9}8
z=jn7?GR0V1^X+n0BmW(6r;D_o4|51=rLibpS}YrC51cDhm*ocaPz&Xs^K5$4YY8|T
zuxfYibdrbme;DsjhSm3o=-L!*WImZATv?yvmRu<>fz&3M&*6`M_u^@1=Wd7Pa@|b2
zQnH!!o7hgq*|k8_-3uR-NQ&=u;V=TTh^yGdh;TUdELIxsH`X->cV*Kqty+G`OJs!)
zEmOI;kUA1!H>+bdWJlgROl_QKnYxJA6~6>8RP_LAf0<%mR*(dKy&B?!nG~gBj4J3|
z8IS{f8f0b8?v!Um711fcCj*L#&uf=MNWGl})f3k@`b!>q(2>;Ta2@55BvuU#e^;Wy
z0z23{<o%kw5SpRZs-Lj?O(905U6;UsHmv3VEnzD-I#D=Phr7(jFDsFrA=ijI`$jLX
znhijSe|QMBuXk}VYCnYJX162R=3HMPoay4;d;GK+@HCZ_I_oKWYZ^xjCh{x8D=5>P
zsS@}7znEUKNY8MIUxQYzx$3>gqsi=sJC<ewlNB|^WEX>&OrV!&?;yZTleFqgE9w39
zWp?w0U?}3f-bZ+|*U=Pk7e4VO2$pzb!wS<ce-_6?@Fi-Fh+qJcoGA5pyM0`7o7O{6
zd1UR4*432*Ep{!fIub_h>tW`^hTy#O>OD;30E)NjnB*py0>Zx8`k@3WxdNA`H6;P$
z_#y-YZ9b8+sHg@zdzkD0qgo0wIO7l)vf;&1@-Xl?OX4@(UzUik^2;kW7Y8?A{X0%>
ze^9@vcxFSd5wQa_`cHqD`5@Dn`795!nb<}Kf?Yb#=}TkagZzRW*G_%74<yX7YddPx
zNhQib425$LAi8s4?&~Hv%a5Sv>dyy9p#&vXVSJV=1W6}aP?KV)g$1kVMH3?z?p<0s
z#3Rs1XuxKZ6Aw6GERLlWlPPl5Q4l9ke-W!z9FT}YwxaNYc(cdBd(lw&kxHMxKNBfQ
z#EMOfR3c)?wsIm%*bq`!;-<lmiId;52Nl2T9ci<>2Z3x~wJ1EuZi?}M<?2AYsmbVa
zjrj0!y%;>NvEYHM)A^qxa)iOFYcjvnT0m-@D7%a^CCsuB;%s}s$RkoMYRxV`fBNjR
z&zh=3&5^P~M?S0JfHNluQX4Oe^`)EwS=WV=uIO);XLf<us-K!?>5XJTt&}J+oM-sP
zGu3K|7Vg+Dr!mp6?8;hcIa*?cW<dYlO%9V?+^TGh$fKY}6aVt#BwO?o23G&YYMGqE
zB(uTv-nvwYEXKFf+;p>b7b7Tgf1Jb((9SV-iUTLw-}Mj6w*MXV!%3~#J?Oj%DBf*p
zT@#s$2;8Q|lyz+>;%^q2qAGZwGB5Mub>$wZrzuqI7Z^b#DXqB9rWbROoMPhu+XTj0
ziMB(;ac0g4ib=;W9Rp6!VNkijN9Jn*4_AgMVva}Jr>}mTk0v5az;VUke^Lr|Z;G?8
z7{iT7oBIOXBBIxgaEG&$omR~d4tM_4oszs<c1iN+PO|AJC+(V;M`#|fd5Gvml1hnz
z9CX+k*R*`YqM+%&%1g1x(|E>w_M!;|!)9TlqS}uT9>em;YZ_LLh(g-WbVOqXXM0kZ
zManG<$67jn*9BCWQiMmTe>MqEI>tE6UMJTGz_(PJX?7u~QtT>@9K>cCIn#0r9P%lD
zR>D04hu}Ag8i)A5ty%B5&91gt?IXY^<8PL_1XFvo?g|WB-P9E*jkYDoa&2GWH;tqI
z;0yfV3;gZ*0xM^AsV{I%S$ku|lbTO&GZA}z;kv=|wZH&TldNgpe}I>cU=wB0g7!M`
zoZ^VixLE0$5Fv3BCb9?Ji{L)W$C1l+{j#Vvh~QN{rLW(*r}XtYJ%J_Nrl&i;CvIX%
zH%rh2SEHP)?I^4H%A#UP(OJ@y;@R$V;!-3O4Ytd8C)%oKz14n1>I}bI!G7Jtbp{-_
zy(tT}hBsxx&limTe|=-awRtWNS6(lc<94N87sV*Qn|iGRiW?B~b-|(CiaG5nTES*|
zF0*@(UEq+g<$T@lz8hQKj>2?SjOFLj=FB`qLG0oE3uN$!oqk*0rQBw<x1{daST~r#
zKE$2}HYdn}Hu*SiPj)w?ymnAtGzKbEwq6QRMf7)Yu{ENLf2OF#M^A)w(I2ZZ{rIVi
ze3%I(r4O5u&%s4hC3`j942SjJ5lfz2GlkroIBs}I*S8q2KF-d98Qs!_7)FPK`Dk?0
zp~IjD-yN&km=!&5gL(&dwBAIBo+k$ay}Zh^>&|vjXx<WpX7jM_=uX7+VOY$DTf;$~
zXluS*-Yfole;rz(4_?vHUm2cLZS}pn>h;(a&L0*lB3EI6gLgvjl}E|{Zj(Y%G7=+O
z)?k9;at*Zm_!306lRSnkR6iyV4<w}=FJ0&q{vi!nkbOOPhW(PX?#cd)&U{NeCM{G~
zJm|RN)BuM}|C|`N7S`IkkHy6us!^{ETw?Dg0GEdqf9~g-<j1lYuTZ(qP~)<d+-oJD
z{t&w)xFM?oIkoE4;+LPYio-D^yr=FsOo|*KUz~U@cTvgTBRM@{=*@!j<juBn1#h-|
zwi5MiUuzyLo6zCZekI8$$TykZ1fvfIbe+%o95VB_lW)I4{)*HTnPz6^vnWA#RUCPL
z6J|tifAhfV;j8h?t(`sY!Og+t8Lkk8b${6cp~^j)u<%J;pg_KV6dcigTK0og2leh}
zbW-X6Kl|hd?IG>Y=DPT<qv+5*tPv9@?`#dU@$HGo(H4Oo-->vAtGRk>5soDJ>1W-U
zhgkE!m6q%G!+t0U@P_<Yc8ckx2m*-9EN8^kf5x~vhx$_IYBm}kD3ov{X1qWh;cZD7
zQ)$e#%9gTWK8Ol$H`#djMVvAb4V&_=xXDd*6mEBY4MqC+;8*$JSNRS5RqT*1bEv#S
z2>EqgE$<LremOi}K5nq>uQu*~vch2@q-4Eyh+G-#kKxn1D_j|yjKQ`RIX)YV;m#*@
ze-{y&*mxY_7!anq!5Ho~jDefjbP#Omgm8PJ9-qzE;bbyJK9t41vTUtwl=I6=3GR^4
zU`Owu<k6C$OsqmHhYqI=&g7j9#?V<^Ud%)DZ4UM?POrdnvF=%1SzK!!%WOzo*09Wm
zPO(p_ZZVNH6ujQqW!>|4nx9A5pFSKHf2|7Ol80LZ({-@EU2e423&s_FwNSpAMo(qK
zOcKR3C>(haEL??8Z6siY1C{W$sIAqI_Y0=+UddjSIhuAmi#I6C*~fucv&3o6pW&H%
zpJ3UF@u2L42d@-U?RLQwrrK=R11i*dlH(VBx$pq8ML_aoCqQ>Tvkn%7*xl>8e+M|q
z4mO7<zK&IcIBPHp?z74x65)1+kCz(bZ9RtH(Lo45c4;l#qG`Sw?ngA)&2C7vo*O75
zix&8OQ%mX--2@kFO~mT;QM0xu6W<0|Ya6&*TacwCjf;b$4X}3UzlC_x8(>TCo&%ep
zV&7t6N2MG(tah7L7B)H#a1y9(e@At0Npv;}t#Wi}t<g5r<BdWO&R(U{9A|SuRk^PH
zE<-0WGR>ll+l@k~tg+j`E@13W=JbXXnO}8g7GgnffD5fV^2PyKNgaBXQ4JnTP}zt#
z-1+2_|0@o6mlrw>Q3~&T>`P?pm?Cy=DO%sIp4Nsj5Vt~aa1-1oLA3V=fBJaTW9+JQ
zb`Y4CHIY0(pi-1rmYej#?(E!0egV8DXW8qlKc7j`GcXi}7hDH?em>00D+A+QXw{h%
z!@PfUz^)K~&LOV>gH!SX*z24DeBf;b8A%L`wi`hsG<eAsW$fZi;em-uX95LEVn8M`
zP|Amfgn-4O*uEe(*fpk4f3pm!FCOX_wL#iqEylOH1mdL`XX1pK6_=Mp5q7N~HP4Dr
z$I@Ol*j2Z%JuA4y)ssy7GQ3F+lcg=0fPBG4svR_dM;7CV8iz%877+H;@B^HzGNzOA
zDjhCA4S1py@$dGNX_6Ep@yeeOyxirNS&!PgeW!Z|i$LP03s1_re@Jos-uggsoS`F~
z$$3_W7^pEgph7OTrovE@U2C$^1FJ6ni?xbAdn7+!_F2>d-_S-Xfgj%n>Oj+=-#b+x
zn&jKog}Y6#!dp~{+bH~?p=R77899(AdOz)66vggQ^6A~54YGh8w0f<BgDb08c0QC&
zdyjlSzqyjz>lE9*e<k8+b68wRA?Tn=z3q3vIJ)OIsMg&@;|qJOG86aHt=S5ikfc;Y
z3_JT<alUpv@qAF_OMXnZ<WPPg)V$l&_U=aPt6`bmXGRuI_q`}}N+&Wo9>gdB4P48k
zE!3&SS$rl}9&ArmmhiaW9Ch?ou~jtk?Wkk(mb{yFjtDX5e`3hJ*(wc2yIpIysV_%)
zgKz6Z*W3^EUsgn<uDjw<aH%1hT``}vn6MNROdql99FmEU-lFvMH0){9FeIB(=Q6)o
zk5o3!>q9`&2ch&g7?4yyufIaF_b-&{T{F<%GSNH8Vq2W%{iu@Wy%uiL8fo6X^Ujuy
z$G35g-OkLsf1yFTIZLm0bc1ZY7J?+cK7IDIJ<MNbNqIwr^0ndDU=@i14u`bBLkXrI
zrLm@Rau2LztJ&3M*d%&jZk5a@jGd%xvHI;oT|^#Gh9}TE^zQk*|1z5~+mr6(u}#=r
z_}=;kuEpd2!1n&<vAsSCz|$u<nybo-(sO)-8)}RKe{776+9K0&`L5hN2+ZGnH^$){
zTRYY`60FwBn^gb~vuZ)lgBI9;&K*g9&qU$QQ2Om^9^ha3E2z+S)<rggIl!hP$X!Z_
z+&k26F;>_ngF0g~yxc_^!m0b@PFqUqz_4E167TIj<RAB3naehy>9v8f)<T&BP>S}Z
zn3p7Ge=KegtwfD->bQ*?kYT=;mfUjLL+#NmUsD&~$@HGlTVWsH**j57M831xf`%UP
zZ@vvV6~-r<0#2g5q&4N6P5I{Avg0_v?iZ+<zVN2sj+660=g6`}p)26rpv&c><CzIX
z?#}u6F>1y&odX^)$zJCrtG<bn0Qb9Sl>sNUf4kXP9E{wD=1s>9lz<OPDdUs0(3LR*
zyNsE5_+KA$Esp@s4cYj+OU?|7oZOvLaUlhyJRVE|0f}5jcNUb+j>ev7RSH+wSjXo>
zA(oFlGzV>T-j6TLu^FKLnM*rW06cYQjs)-mm1xIGDBlEk6_Q?fS3?8Mvavs!rk5NR
ze=wL96K^75iV^fqqZ>7>J9@3*v4@Ok>0M>M3_Nq89@(a2|HFU%#D@|QRsZ$#2J7zd
zAzjZKop`tIaZ&hR=FHSWYSvor)xqkw0TtLL!oX6C<9#6_L}o0{TnoE+<m%Z~8OsF5
z4?CNiAQy{69k+xF3)O8Lc>s#ZHBzz-f1?jfSV;}-#3^W7jhpu2(kDTb^cpqiQoG6Z
zoX3+}Rhio~(D>v-X}J$p#^1b^@npTCa_=<tv0ftXou)Z96?}{6{Q73V^=iE_ShN%}
z3*O%}Rc!sbXmu#dWI6EAW@gSByJy=iF-%#Ei+oznZZ|)XDDZlv4$8z@XDQkRe?&`E
z^6l3%h*#FWW(N3t;o85gEq5a<@ioe_Eh$p_>x3N&WO$A9Gl=JQ*?(7>tn|Q&qyK_S
z<IZS;=@8RE>1Dql9Cpv;-)KH;cus4pX0^RWS%|vAUg4{v#1c@GqSNUYsYXt-nZwr(
zqZM?E7YZC0<wg<*J>R{h*ug9Ee?j*6Abb2qWe*wPX?nhLcy#NkgX80H<kE>PNyUmh
zp;Ql-vq1a%=={z>Ebi#-*oHs#?V-Eg(#84~=EGV_*ZQ^c78kx1S}X-Xq=FtSJl^*Q
zSgM0g<cR(IZ5**H<rE%>B7nIebZ(v4vrT@Ep~YTJwRENDTjreHV%&bfe>cI=e)DW|
zmY#3IHR<u&GR<i6A9&^mp80`iMzrYz%X~L16P12`6D*SlvNe{uCdXWdVao9g_+>uG
zQ0@r>-Wtc0HoMYhwGZZ+!8dWCuJg2%a?Nz9Pvc*&!Ss?Ie~YSfJv_gwP3;P!3)<aC
zK@3JLF|aGxT;upZFuMPde~j)I=OaxZRSlfu7U_hyiFcHeHA-J-tjCyF6{LzMTPx%T
z$e>(mCN8wdHB*W;?Q%4nnolnEncA^EuFp@FM!!RQ9AkuTjXY{=zTLHPNEeoRla@C2
z#PM4jNcWX7ejs=sB>Uf>C(cgkdLs6_sR*>8xc!bQ1+9xix(VoGfAYzy+G$EwHishJ
zWEcWQx(tnUlVL0<xwgh?+({}`*Ea0EF`?q`aoxNX!<bhJA2l2CHdqa-F1(>fFer$G
zVH9ym<INVO1_^rWVMH-Oo9;>tp>-p8RJ$o#0BQZDw8ltkQ<<b*9E!1DO2EJL)9KdI
z+e>S;E3MZ1vHkSlf7Qx7g9UjLsxJ{EmjSx?WLjKKrS9+wac4nK@0-|Do980N`L4>K
zZX-+U-PKNgOGbN|&ny^uJsXq0puxHP!AIw6epeLA_*Sd;ca3XVdwBXnRD?q=SA@bB
zC4n=J8j23({rND(MG%47G@6#=JB#kyzd`Mm&Vh!*$YtH2e~4^=&TUtnjeq}FC;4g$
z`pblNQk0~6zRFre`v&sWIJ->oRcGDRqs#MA@{F!x+Ng^+;_a>RZyk)#^{_&>BD^-)
z2o~84w)pRtkcfG1yn%1EZ*p;tl4E2)w6tvHTVXFsQ~n(1bkC-XKrcIs_ig|9Lg)8I
zvdeAm9vGt2e<o*gE&SB=a8wV6#bwbcUpdpXjK*T(FvcUM5A;eQL}E}}k1Zb!zjs#7
z4fbJ2(T<Y&bl6G&4@1<YKr<;@nzKKB+Dd+$WR2frgtf0%Qy=O|{^lXjtSlP`TSp=a
zDrc>(3J}kY&J#^7I#$2@z9mF}heJ<WrM&7U2Qmhxe}_ap*`ig=nhRPsooo^r)~>SQ
zMC@vi42$_JK~`YiX6+5#C^tfq4wFk^aQQ$>j;W;v;-!Ag-h4zNFl6SqXnY)n*+fli
zxu}YX&lHl%WK}!oHDhgh6Q!?9X37M=u+IbTJ)dT;@?u{0SkCQzlf9nxG&_(cMdIQh
zpAxGWf8LmEiZK8}@_yrp10Z;`cU_G4)GVn1w6IGSmZUaD8WFGI^;JI1A_y7cu|&Vd
z9P5~oUNc=o_O5K(`zCa+Fyb$k2G-`}%WV6b*Z~)?O?6aYqs-**|Cx>)jQSh-DvT*Q
z6fZ|@)Rr^UydW?h*4?nH@ZBmPMomrEL6etce-~-eZP;{L&hGa^1>EtU-HG1J-Bz-T
zi(-Cjypu=@c0$J;Fb!UOX6yb3e8k_hFD`Ofl?z$Ua(7i}{whbn*Kt=NxziCmJ77UV
zIkm?eVB@x!lDnjGmrv{C*iCyI3<Q9g4O-ERLgyK$?J@$%)_6TP*_9?MJ@5wjFBUq~
ze>CwUjUFE6<Cij}G$0|zvVrbVSsIajX0o(pZEbl;vw<=?_uJXT-4_pfHpq<cxL>>Z
zSfRCr3#H8CSbX5a^6|%lzx?sXN18gRF9vdk!7l{FB3#c7H}f6#pQ8wuHWiR0&0FEO
zACuhB_}-ZUUF&L&A!pHBYocJ&s(lL_e`(*Hz*2Y%gH8>*wpx~GIu0Lvm+yo@eEhMw
z=sx~f_GM#_VJI;>L++X`LYcdpF_EO4O~VjoOUb~Q@-O4e^)c2G##vhC8L{I@I-^5O
zto@r}W_lZrOG-K*9lSx7VnCz(buzdarz1K)vBL$jvdtNI^BKw}(IJhUmvxWme?bq+
zXDS7j?^!B=!gfwC@@zOzoERMD9EFzuZaN5yC+NqTi28Y%-Pnh?qx-|5?~7Cs?xbA5
z7kYnrNBKCM)A2Y|nikBAn)h!lYP}_@MA#YKgC}y!8%@}6*0QwS-ni{VnzhVfZ(*la
zc@qJSZ`RWIm#g+lAXO$+_QuVNf2D;hYQq7?ag<YNu!D5^vPJyz@@m#fE@4*1f6|*(
zMg+W<RC?m(rKd9gSF}&BNpCGjtz<Mvs5jd3*Tc2V73C<Y_Jrm+?@>8MBp)b`$B`tB
z-}C7N@rXn=d*6;}rMSw5D%kYJV;sSrvLLJHf|?NiVQ?<y*^dg)nk(8KfBNuMp^R}p
z9nwb=IT0Mp*WfI+1Q78&<mg0De6-~pTeAW>1T~C{BnQ5od^<sUKyt=l26&hMa14lk
z8BEjbY>J=cFKhVW5K)%5c(rK-cy-+TPp*n<xwA>}Dx1>q-^+E_0y4*KQ8;QCzoILz
zp&@UKu3`EwUi`5*KOTfGe<XcTVWk)KxG3bWQF>oD6IU<j+Nroo86Y-@#LibcGF~CE
zN1DBu4+G8S6u)jur<qA(Xmw1YJtR!-e1DLUZbu}E#6UV+M@L6vh$WBwx3p^Z3Xh1F
z>KwMg;8n5UsiAh7jpzb;A$ktyLMM4ndtPP&p##C~{^eKGd?4e%e<@EdFX?laKf8Ny
zh9VI#j?>=H2YJEQLBHzCSMqF-pp=hEMF!p*rlWOvc;u^K=~H=*Lmp+W8%8|J>p{RH
z4S=-U<f}Q!buivC>eLiE@HIN-PD+#cVJk*q$FpO|(u28(ke7JZ1~JOZ{^5Ug`8(ZI
zC#sWL<L0|qTRDwaf8u@9Q%-%2B!^NLh+(%CzUruPw-&Fstsa9|eE#kEk2IDqdmDj0
z$Y^m1*m_5MPRe|-BXEhs`DiT4EJ|CA(wU|^_!?JIJd18BmLKsyu3Q`s#uvxM2=z$)
zb`-!iD|{y!;?0)fm5QGQg!5TBI7+@#3e>B%)Qh|?n)H(<e+ZOfEk#xy+<Bbb|0?n1
zs}r2Pl@Kkfe7}qQ^XvNJe~G}DcOP!^c2NLp=a>BwaXRlX`lrm&Y5!``+1j%Z$Gujv
z_u$5rS<#Q439N`0@a?#KFYflAbJS?2t8$SKxwL>$r_OKlY&}v(ze!~)ZsNi!m+MA|
z(ueP_*gg|We;I>#9KX@kIv(dUsH!5DucTYTK5h|<Qekg-)U8i=9BN>HL|?^zrYuP7
zN2<ekmXa9g1>HdQD=U5Mn`mvXbm(Cfu3r7w<m;Tvhsf6-X#@PeM3QOt?GuJYdO;k6
zE|`}m-s#zbP<hRUOoz(^mZh+!mJPM6bnP#Ewsua0e|~t;fp;{tyPNoWo!*q{kuV|z
zhd@At;6>11#Ay%^x`s!guW2vmwACbZxVPL9S^k;{D<RW&K-oS1+~cW<bHjdHR8lzC
zh;3|Hc-lLRW9iJuX>#^}sRcA3r5my0<L&}1&gVdye3j`S*GlQzL~dB>{NIG9E^^3!
ztJI_}fATIJQ-l9~4P!%<LWC)YxXO)V^3{CpiABjDzNJd?VpB_!%DAYd3b(IXL?XVt
zMv&C$7SpmV9b4LrldH8htLfWU1(B$NX;-AS)A(PJmNMk1qfYV|*FvFBQUh~^uY(&`
z_>yVnE)%d-Gj(?3k=~I{mXF<gSH(2{7uqA$e~5kAnsL4OjaQnpqR-#&6Ehgl{1?9g
zjR6-}ALQ4L$FK4-XC-3HrIdR|cE06xT-_iV+pI{m>{tXYzC2)L{2P9ptKrtXmZ{UJ
z)ng@bffw^3dzRpdk&v_rf<QGSjXhUPi1=Gxa!FG?E#Qg|9bw|ZjxDEBGZ|zr%VlR7
ze;u0UNwY3#^?Dk(g~vQzfK5JVr<l5?K*Bhv3n=6`=Y9ylq?z;4157z5UZkac)P;y!
z?yO-NDc@_$NV!ZoeY08(-A-Oc#5-2&bX&@|kYou1cSz*#mO(AF5_h9pN$r-d63Vz)
z2iOr1qY$s7v%U2Cw@9mBnNDAcqpJdYe|(4)`|lAe=FHx|II6+h26UlH!PaCFZp+$q
z)d*IWr$wzob^_q(O??1(d2P&t(`Y;&qJ};o9{lzY4^CaZJa(z92OYK=In4P~HUI-#
zytF&Z5)6Y+UuSd`lkbb^aPa%ELW#frop9PKY8G#pV7I-**2Wsg+s=MlOOe;5f4}ip
zB-!J%QdpVG`MLZ1ycpczza06q*V^l+Ji(R5XMQiLCd0igD!THpnB16ww{e3On%-7h
z-yA4;qgl7_dzQe3Q|bxs--T!8oegCsJ$K$gIhVIB;Zg}Ai47RcJl8Q!Zxl=tGyRUM
za5sc`&T1<ELv>D<#DpLG>sBF6e>{iJvvE&S)QY;!Z7p$z;h>naamlpdSwL{OhkRBM
zev+*g&E#6ru4ZP~ex(lUEsM1H7H=acwI$elGjXXh-VZ|42chY=EHwSfP*J}$DAckN
z(JKupS|obiD$#Xlqe`vlwE<VxEEnxNe2`s$x@gw)x-<N)f~6!`&Yp9he@m+~&fVhx
zX^#`cMM5o0ds`i*7v{JR``Z#ek`qnhz4Y~Boa65Hb+|Vuq`jmPb}+g+91*T^I?d8;
zvSev5Y}<x`Pq$#kKC3)?JpoKSSBAv2(4b@0-1;pTH8;Z0wQF$bcnTl*^9TO?+vLxB
zPPf9HZ-q+rw!HZl<IKjGe}7@VyfIh4Ezh#&-xrRRkFqVRk<?<KMh5L;F#dC$b2(Rm
z#0d^Hl$PEQrsQ7Th$Xq<KzB@beJi`GIaI@7Kk%pz>AJtYblvDCZ>gxqhJ5NRD|oES
zpadz6HiqZBQN50sR~TY22t*Vd>g!T!K}mjMGA&-^4E!ZK&q={8e}s^5pkAroS3ws@
zcKPRgcC*XG3}fJ698M-<{H>#8_v^2ZMx$LVfB7tZ{q|E*^x@ygl-{bc$ufrSPP!P+
z?|yp4+1BZ7qoSzx;~P%%KqE4fPVzmbFaBx=?vT2KMO_d5<cP>o!jtEywJZFQjt(cI
zUyk`V*IVKI_6qZVf0Ni&M(Y(xG`z&6JQxcM#pUG|lMS^s-!4lm{Pzmg)&|~SXqMME
z)m{0m4GhecL4FVnJ}9rhLFLs>>93=@{&H$-fJD(0^SqQ9JeAi}U6K`xjGQaWac{90
zx6+}vS5@nNUq8EBsj17hz2R;x+q;-!#g5t7A*-vg804(Re=OF;INLZwUv*P-Cp{<v
zrse6&HWIDuVgGvyeI_^Xt$PVwzs2M{oo<f>OKaS2!hf=&E+2w*RYw4ad+U#M3T}{x
zPR*-T**x4Q^U;X7s#}{E85)|;1lq@8x~*cdl`*_mJhpk2b53u#NI9SQ?4hMH{ILI#
zOKUh#1AfAGe|q`_7M=rMYWgl(Y5H+$pWE~~L_g>_HqWi@?D*cmy$^jFg#f>;m6rjz
z>~$x3Mw$g}XpoD+DtU=Gef~kS%3~}BQbvGW>vHwVtffy`BT5zO%Qj12>UFukDiC{`
z4`_)@Mo-7DQmKEaP4OAYsn=n4F{`a)kYa#$^wB9We}*<$VHHMYsKHKdB9r27cKuF>
z39H)V?m-X_%eE7lPDesaE6HC=BU$T<AIF^vriV)qq}NzJFyhzy!%zL$>rN@R|7XtR
zAPUL)r0WR-#FS)=fZ-FBim`M)f)J&@9wcW<NAz+cSczutp3{B~Y@_MBXwgrti_O;C
z0(1RRf1@E?<!JYHxhp54bLfslm%doO0n>;wlA=DcyX0r|z%95}&lM1vTKE>=jN!Da
z!`XEHZb%q><2o2C`g?YnCc}KTHHGjMHQ1E~qt>y^?&BKpEWxu^M0t66{C69wh8R>E
zFRrg0HjMRsQxJi-qoDF@NBgd&Kx`Q9yIe=$f7UePd=uHca)4BW`jFVNwr=c*$nx2`
z$71a`c@t8xSn+kQAgkrzFS;k;jcZnR->HLkZU5~%b=<CnmoC!K=6a-|;b;R>I-}W?
zad8<%%VmPSx?~;a!YEr#$9anU^jBFj85YFce$#Qraq@PR4m75gZyaY_ZS_saQnltC
zf3dQB#&yKX?QvIWyUT5Nwe5v{`VZCWW?mwfH%MA}ZJB{IMR_O8gkG2%{Hosd?GuC>
z8(Tk1xR~4=`rP2oY93!-wfB_W+u=l`gY0~Mc?s~)O;2U;CW#OD00T$~jBPdcuz24J
z;^+NSI4;FRjU?{tL=i82R6bFo38Qh5e~f&F7kSD+WWlZIXT(ttKkJT)F_xx_?e3D2
z*A?u+E?x+x&h@%{y)dGMIhZ<aa4Bb+r{s(vNq&)>Pm7lTp~aaSvC4R^Brq#yl6rr3
zI^|gZ@~SB0+_2JcuR9CA=i51qvB=|XAX<8ZBXNs;@ULPc{HO2rCC>F{;DG+Tf1DMg
z_9z`V&~=*1McU5-FS}8AF-)l3!n*SX#B;exK$=6u>UF_bEqL!tM$)iDpLA(sFJx=v
zq40<!WnwZ>w3iped)oH};r2yFCwS_SU$7^ZQ_4@!2K>>m@<lpJ$2Z_s*H;DWwr5-+
zQyy*@*PTCgNwCXG9@r$Cj`FgEe>4`3PGN;ub;AIk)1Kz#Rl@)64{w$YPN08h2+JH|
zSa_yBNJ+TvPf7p#?!{Bo&9Uu@vHZ&Pm9%-rt66Ti&>!(n2WSAN8Pud@fyd_=NTR%<
z;4vR1PqTD7X8IPNRn~$=8EXm~p4F`FU;QXKrRh!cba<5b?~{iwo?)HnfAnUe8jqzg
z5HC}BqLcG^&f#nTJi?z?>zt+F$G$m${S+5Owq*-Zb%A-FKB>KlnIu*}N9h=d7)%W&
zg3AfWPQF20ngPb7=>UJSJ13X}Ju+qE7l)8tOVkO9g--Kqc7w++vJ@0b(SdlcUlBD@
z6w8HkZ2>a&indT75e@ICe-wh#ER-J{xjPI`lm=&Mui5LYKc6uXr0u6EGc3~CLubiD
z%ce;;N+EZe)okr~GR@i;`wRfzb9PS1TyWmbhXv|`@L;lWKb?@!#$fOczg^X%lsIyp
z@%RT>nO}~bWu;?StE#*yVv1i(<;Z7W&(D8wfL~Yh^Z1nV0lo9-f1%i2^%|q58s5hN
z_&iOnrrE_8yVe8_Q`E#RO>p?d?zj*UWB1EP*@zQPUzQW1ub&^LUwWfDohOuXIhjuc
z<Q63N(&}dj_U88jnR{l>_|cd84a1ck2$4}tD;Cpdx)A=bU!p1r9dAT5aV<)m?<YiB
zxpPc8=O-_KszX1`f6J`;@^yM+-g=cXWHxRyjcfWmIHtWU9;N5NxOKBV1N&GoAJB_~
zjz9bYpMKV~QcVAX&!ul^G&opu=MS2$K7zo8Hx?o01p@lX1|r5}>pc@g9<7I422a3@
zcm=Yj-bWYhKx32}{Un1A3Tlb`Sl|8H474#f`NKP(-MM>se}RVDXsB&J9LUwS3N^qY
zhVngSDdv_P-J=bF5Z~0(cN4A0@YcP2dN}8{YQ4BME@#uZ6|)pRo0huZLMxvu1wYzJ
zl6LYmFFEGN==xEj0B-y%7kjWg&D0)Bdd@`OLo0Zai|XQKR7BG60!_E_%du3U?D2o?
z%jeU)Uv1)lf6Yl0%V#&0uTKDdCEhmrMPT82fTL$F6irMRlMOTeHkfO}S}-#k%cIe%
z+$S=8L$V0H|2)qgLerHWPOkEan7K#kB<Vd%Cm7U2W0cXjJo^lru8dEjBlJo4U|XXq
z<f-UA7G;|nwEb<|UaQrFu+Zs@#Tz>%z%&UC7i)w{f46y!7#)Z%f58GUREjcinV!X(
z>q-{dq{xesAT|ehwa|xi6~NjMPq5|j<ylLqJbn?L=m1xSBUDu7)}}=G3zh<1p_Ze~
zJ@Cj2HIvdVD!=C>t<xH_?|Yp86E5@tbwupkJN&dIex6|h+$&O-y5X^bzf|tw;Jc<*
zxTb4&e?A?$7f8CUJSc@<`SA(vp?j1+HMROry_)Vx`=a{rjzEH51N2?sZyesGjNTjE
zm1}2Jkal8&dIBe=L5B=t-x0#Ca0lf|t-2&i+^M7Tl{~{|U}S(l9FW)oVZv+~o6e>z
zlH5&zwm61u(9SC9H*{m5VN?6xATASnPF!3Je_cTZm|aba>#-~KDN0vm!62|?uP0Ii
zjP*)@ne)gliy4zOHV1lqyz{J|8h_Tg1w}>G)8H;PFS{;E4<CAR_<5rs^31uo2c7C^
zIxe~F;*<^wXF$AWxeO8Dz21-Ij`X62$`0E43w~jugO)Doo%xgvW>_s7W6-d;8`%h^
zf5nvqX*2_B>E2BCz$4-TtsM5MOgsfGJSb8cH^EbKS4QVW>PAkQWwp&&)GW7j%@IgM
z*f8MGH_S~|>Z&bTfxmW$f$Z<=4LV4^_%iuv=XZ2%=pOx)Aex!!Lo2-bExD>Ke-D37
zzOYO9m!02fFB`o6mz|#vbT60?J_gNnf4BM@I*Ph-uz=dE%uFEE7qJh{fDW4OZ!$KL
zo$w+)at*p5Zo;#rV7<N_6Im&)vnik)RdYo1PDsv$BB$s15K|CZ!=kGzk;m+HoW%xP
z-k`DmnvN?WAbLwwG@h4XyR)W%H@4TIHL(SUac~jVX#{ucmegp57?#6oh{A+Ze?6rR
zdaMZPtr%muD*#<m7o^VO<Os8sLyC5;r!dq*N(VX7I}e>lq}8xVKB;hN%;3dvD##Z&
zm2^qWyG5rgs2@hh=Px_%+@;qkou2*>2`C*%^!t0pviA-;(&zq9jR(_Cq#n`a=Yvl6
z&;7j|sP6fIj_A*FNZG8NqnxyQe?2rDa99*CiFv=wnDA(MU=grby5Yh~?z1dT0IteH
z4KwvvI@<{(!JUfmr#GhZ0{1kGMLarJ6IvoVtRomSWZ%FU<Rn+coA~~?r~U3RL-RD+
zDOOf9rnRH&$u*J^nY!R&n6m{`RbaIjP*yq|Pi1YhKnSZH<4Vg7On!q7e}!)D{H{XO
ziW!NHO2(*HIt9>Y{_vCj{c|h%!%uxWNb*N9AI~_LhmPs*e)h*G+BqjT2g-n4R2$fp
zUB`H1TaDZ27``I|{IugiA;TCp459vN$1%!&sL!4XL*lALe9xIAG2V|qD_Y<q+_{CF
zC;|B0&;ClwM9=I|zEV<<f25<$b@M?ftc>odaxrCNCU-g(RsOX@mv=y1kDr`$@<H;&
z7hlK?r`Pg}WdHY$BcdU<``ADpm}8L(`CH5s!xOXyOFT;MR1XUWma(wqg^9E*=a#8d
z6^sR7*ktZ9x#J|Je1ya$p;2rb9}Fbc5ZfvB8};6JT4h@dGpoi@e=O;3?B6!s#uG4@
zXs<1LdW@AqJS5I`S+JmLI<J_p{5a|q$&}*wYKKQVaH-n4D+}rxra&9tv8mp(LMEP<
zo_85-@zkz%TPh7Ei;Yn6y<jt2sFSb~UY}ENCv+i*x&g6!f4``l^`A&{9bb~@jKf!i
zm*X$|3=yI;eF7)`e@^n(WRLpTOOBG@>$~`xv}}C62W#Tq5C8UWdK$fWM-5`|M~FqF
zb~^=p#quY;Yk%VPA6oP*=K~OxJlnfN;%qhoKHXjZtHhtr1dN4_r+xVYbr_S%3gdHS
z*IDzn<TB4**^~<V2;UEQ1(eejQdKa1rM_>^=+%V>i`rHHe|G#Bbf>s(2COsm`1B=p
z(u+)=BHw{)>CblW(D;&L1k3Z~l$Li;r?i16tBnfXmSPowUJMIJaGrJ9ionpJ%q%N!
zJC;EaC}4DcNlz@MIQKVW?`WW5=Hq=ep21Id_5%~$i1e$P!XNm^6R(xqW*j%MFPQE6
zPsV!>lE3~ne>wXh6ye5^aDr)lRTM~tpbaY#;#gfNw;=KZK&;2K*jrnl%EC+m(O+g?
zWd#b0?>jle(x1{v{+~gKUaz=iW4ti9FE0=!kT1S_aqOH-)*9VteThENPb_PT1kDt0
zpKfl?EFH85W#^LDi25$sd4TV@WXq)t^YF*A82?pUfB)hSKgDDD`Hv*F)3-A8pL;vM
zW0Jxg*9OojUJBP`^8+&_u0FcolOm)%F7}-|v9q#oN3{K}HG~b#OXz=e2>v2sh0K`W
zx7oVqG5&owDvnl?CX(M1Y25qvKlc`lu6lUXX7Y!hf;Or{aHQx9iHj0-qCETLhYqdh
zD5Im>f3asm&3c&5j@-)~`qZLN<M1mSkeQgubu(Da_VoKXEnH6XC0YdaAAgr#+E7se
zR-jP-j8k_>op_ZO^D;Qnb-JnQMN9=N<?Ep*g_dToEsZMQMmke?&rEk>Mq!3<6)ri7
z@%u;-QGqlf?}3nNmT)igs%*O+?ajr6>*G${e^L!^<opsDc6Rx7=p)SSP2`ck7veZ)
z!npsF@mf|$<{c*dUDyDBP7-_pmMNcm;LDowI43C>9KNERs7ZS9LW+s8!W`?mq#6I5
z9$Ay3Ov_;xuu71Vz&FrI9?WMA+Fno;sA8We{ou@QRJFX@8+{3J4^F*Na*gxg0D?FQ
zf4P%9se}MjK&!tcvwPqEuKW9~7822oQsqQ5U{(X1>oGwlxKyfjvG@0@{8cvgT7WOq
zJF}{{y|m~Z*)aoMlj84~HlHT{ktoqwT6BU+Ivr@doleI;11_3m2x?vZs^_@h>jrb}
zmI4=pLz*C^i2@Rjed$&uwVh)4k?CyJNwiJS4SyGEf%hczM1r_r)<R5fI)+X*%n*tg
z>AZUA0weJv8Gp0k$o}Zn4i@&W!G}o8{ZToFDzvZp%h!QIdq5&Qq#kFs>hV=5xW}H|
z8(b+7K7A2_?1GxUs?^ESWmmxk%A*p7+V;&tZ${6DqO-xX$^qPI=HYablPt;!l6RH`
z+<ycqWW~5mR8r7x+hVvp@S)TiH7a+VQG=PBqyYs{%aC_MJIhvd^y)ibxx`Hp-qNer
zf!(@Kg5IQ4Eo9Y7?s&rNj9^WB85zU^j<%JZk>!zt5t@^ANq9Y#EW_UJYzg5NVB1;j
z?2~o1)aAS%7|6qhq)?LO%Zb#xWIHNPu75iY+p1Ii4)Kk)LoeAhqw|pM@2CC#yv6=p
zzHj)L{2PDnaC?V$KKZ1Td~)z}^6={?M*KkQdg-KRT(GhsozSXW&a#QbdMfL>F4Q`&
z$=44N;Y`9<ucGpa)sP-|L_0sr^km=}64|G2k~=&6yWLu*G2T2313r8zbZM^B>3`tu
zPJGNBj1nEs{N*c~Pt`9(Ym_Sb1ywJI8(DRA-)=c><JV9+bUY}%MUg&qq!jG_1Id=~
zn%qx`YQ1zu*_q)K0H^I-W;2tK_r+7<!z_;nzNx^_9lpzVgQIBN+kRXJ3w$voYpOd&
zbo#vmd?T?;EVcg5M$knXlOGPG)PLUvrmUl&Gyct{%YS3W_(Lbne+Scm{gykH!?e$2
zwW@j7m*>ds*+ZSMPqjJ-U8YduTB7>}>s?&|C;RV(W7%uoH+d#@M2U7P-Mo2|{GPQ(
zG2w;ksi>y>*k3y%Y73rWdcOA%23YtxAUOEI9~L!_A0@kg_$eR!yz8`8-G5H>Lb~aK
zC99o^rbTo13)N$sjh+?I1VT$}$Y12hvo+&g-HRP{kyXQO!UB!=cf(8%Iz9ObmKM^&
zKEBQQ8~V@ZXh_$WKL6Xl9YjXg>Za4fXZa6*QD4H6UD|A$OdyGN2|ejf(N^hMPyX!-
z+bm&8@jmi1PM(MY&9y|srhh@^`r1dy)8e`fi%(Fd0c&}g_HPb2%r+li6v<QmLQS|0
zZ$N?ON5sbrnOln|W|F-)0+~I#m=A~UT@nywRQR@wZ#gCBprtwV*iZzUO5nO2c}KEK
zS=1L96fWxV<W)ADIlw}ZrkwBJB7Z&j2vh+!CowB3HHfTXVkBHLdVhis_+hWgd;-ls
z8%RhGrb}y_4GT7RbC__^x7g@-(iXeCWF=GN_*{}yJZKN5MHIxZ%uN^LJH+%I`}7n=
z$pGRaG0j(b2~$j1X_WCG2AOP<3rptIm!{=x5eG*+)jGQdzsv>pYj2vlEXX1O-d<7q
z1UE_bf}aTC1vAZVsDCGg=?cXQ!&Bi^y-5DVb{0!fgP3)vlboGOLe-LVv5z$8>R{(C
zJ^zq1JApOAf6$5VYNBkEELV1ql6&;HCUDa83gB>%eA)?e3@o+jBX`n7<)L;z>jWtS
ziDm#81SZEgGUACo(AEd|5ZD6;JAa}^utq1d8&X;?>5WqUI)6aAzhAwkT>oe}7)wHz
zjsXw${L6a^t|9AWm_xuxNUpNsL?Xa*4}`<7LA19qJj=%OrV&UQgswji!Qd?>JcEy_
z88xiyV_#$thH9cFzYGW8q(gs51i2Jr)I11TW0eTGi0&}??zodkY9(J@ztOG4!VE?v
z(8Fwqtc)`Mmw$Z6$(3V(pYjucOLY)3odq*!I!`hoVyxoC3j&q)%F3Z%5VZtf!_DkU
z6eWR9WmO}%?wX@P=i_BiT#$wA#s^(_AOA*}*=Du|%$(j246C(rhR&9TgvFqwxISNS
zHk&tDj0FtJ#YSoP5_M9uvxRvll7N&?BqN5;1j`=WIDhLg>?>|uSzarS7IoDd?dsGn
zFLg@nx43kGIufE<I#3@Q9O+}FqUfrvZ<vdH-#Sx!ypah<MPO$t1B<;xmDDkV(qJiq
zE9ko6q_he-a@nTm#SC17zl`sVr_Xj#%<$#6HZ)-3@CM9unnlY{PoeS$D!gf6uW7^i
z2&y>SK7UV$#UX^y3dYNMiKALMhc@GAANBsLm^bTdi(KE?R@EixqrD284yag-sINg%
zD<@|$T??=PbaOO<eS@tDPD;2jr9VT{%ueLYVCKr?j~W9Pz9>*yNPeY9E>QuT&EHr^
zX49ktTk!frK`OG8P6aMXfOC%{Daf%<Ff<F#Lw~$Mk{Y)7Z+J6E%(KL=mX>9oI4}<h
zUKw$UAbLH)*sV`7s7sGJ0T_I>3@ra@GNh6VPbN46maPC4%F@x<*@4nE)INhn?H5z=
zJ^HAdcq541<RtdQvX?afz|%l?yy`u~+g544iR`*F>*SL)&Z<FB1qeTum1egswwAcN
zXMgSuZGjKQ2_5e~0}A_iTFm*eWmCvkv`@#6I{Z9aIxFZ1k~4zI>fj{N(#7fe&{^w4
z@wEDm$@(<QGEOCL=FQ6lGUO+W5pLfy`P33emfTXYkEq`vz*X~^4dI*-Z0_<++_zlB
z(eJ9yG)<n$FxT1OU?IBcVBn>^dUJaR4S!ud42^J`b{PAMo4Ssg-&-L4shmsdt^83h
zDHz;v(!mE#IP~spP&PX5L+EFkfP{=&K#4`8WWFU1;D;wCL?+KpiC#g6_NgN?{ia_^
zFvX&C^({w<W5$-m9Bb`P=1>N`nf6}sr$CE;5eqTDh<JInM81UYXZ5XIE`^@e#D7qd
zn8aJ>k)j#|)3YWLNw4~^J)b_<y2N^xy-J7Zj{keGvA`P3Y5|L`5*oHJ%>qHp71=zk
ze<@~#GgjgQ6_M5VI-p7z^X7~WErmmXXHL@o8)d#GQ7_pK792aal!-M7UK=X1l_vHS
zy-o->QnV};c2LcM{rF@5E(9%b=YJr=PGv_w=;Wb6^#pa`y(cf9b)rUf@zH9awbl|q
z^yv=!p`xZSczvwZwEK8Ky=GkfU{<l4=p?_+(m^&gf$EAs*)VG7>3HT)MCo;;hk~oS
zRJ9I&WrEqfthEyW8=Ysa=)#!)0H6j*VF7J_dh*-{cX88a4~ed14Nx9;KY#7^Q;scj
zr}w}??ed$>1bF|r>HWLiH1A$!q`fl>2=74H%zYXqyXV3$A9F1^26Z_R_fc@M<XSXb
zt+-jOvtaqkQq!SS4(9Wt+<Bm_00D<5&O^E|C1PYKi?Z_PN4fz`vp!xhvQYHUq7!;5
zxTR~6jOs|mgao}I(jr4#oPW<muZVt^4FBUWB%^`qA0;Q%pdBmaSQ8Lh0YwU7^{5{Q
zJaGtYfq-c2Yey}iX$Q?si0#)pR-WN>8bhU8g{{CM?t=|DRya^MeN;19GRQ`z#yvl&
zAvM<F7%R)Y8AnsqJEj4RL&b`nS3>rJlg|fCtOAXXwEXW_4Hv~VAAb+wOC5#f2H?P+
zk39srj&>@HY?=YWPLz+w5jQ_d_;X~MFo`Kh3=rt9Dp)kN>=oR=#=+UZXn&q6%1kAF
z&on?@eGa8O&uHK-X?!3~@f)je6W|Z3R2Lv_{Qj(dD_64Et|`gPVe1X3{GP-Y7uL7%
zb91=e!kgRKaVLk4g?}ENbT&&l8nb?O5GsV96q>1evPqk33jh0C`YJtH7y?+tA%MEh
zedN8cCQ(H?WeYjSKGm*KTYoz6-8g7d7K$#1#W`FdoKVf1k2loXUJWgj&3w{i9%W1!
zJ2PnbtUr4#0{KGNX(QiRISXY@?(V{8L?2m#-Qi)q8|q~T4u95yuIsS4+y^c;+kD{u
zrWXYA3urkqQ8D8%4iv{({a)zBMNtHCR`f}{yg%>wFaGU|<c_p?!PhlB>L9=(B)hoN
zQrrMR)iDr=Q87T;y<}>0twuDMbuNz**HdRQFR%9R92m;hjGJeYx)+Y`%!OOh=T>s(
zhdq9ygBBSU4}TEN;MzaV*~e`|Dru0f)nvt<!>CpF_uh^*<f695>8tz_>$iVd%!-3n
zh^lR8ao<DDve;g786gB^@6(^B>G=VgJs!Iqv~a6{XsM^u*+g(O@~JMRscJi}FbfxD
z*?W*q_jJ=wg;7<S(N>(m%Yp=t>O{ZdC_17lQEVkGg@4aFPnwwK&Q8;}YsUFD8KA3_
zfT+N$tU{W+C{|Syr;f$s(^yjsy1=oD$lCZOgz1!&x_oM>%i8H#d6lyMGAd|2N6|~=
zdg?b35Cm>Eu2{u1LQCenobhjgzoZ@gptcd=m^(Xl#(CDnIoBKc8vHeYcBF3+s=`bV
zd{%H8tAC`^$NrbseR)TkX8=r4mb4UrnAbC=#aMFMX{1LR%Qvg#u~VPjAfOY@>6jpo
zg;gGU3wUjyV0BxxSe0I6?FDi{xSm0Ag13_*1fy|2E38+T@$HOreHLht7lw0EOsp_u
z2qj0d44?VkFdlf!ixpjfsEkBY4Dc=^m5ilU4}avA#jCMgej$y|z1J<qU3pJLnZ<2F
zr1?_PAVPzZ?9d|Fe6Q3=_B1G{=KzMLm7e&*YQ?=GE_>xKfA74P>}#<OR|$4GP!jmL
zmVd=faTdx`%d!{AsdD6YcG!*)sNo)n7s7grkCwC1?fRU3mBgxoP?H|9dpi>kdhX7O
zu79=XJQfRWJ+SP<W+hqDwmqTlS!Nsv;BZ+rt|rz)A3E@>vnWZR!3@bE=N0wRxj2*^
z!!^PRr4LXyyON2naWX;~xX9`lv&_;-xeOgx4!Ew#2D<3bnw5#=3peFT>hof;J5t6B
zA4y;urW_}s$cIiI8x(AJrbWLh3XRDf(tkym!=`AaFv-|?hw92{>{?^ypp!idG~6}$
z5z%1bM}a-mKY0Xfu()Od6W~BV3Dy@-IFG7UvA|76(}_)gWh|+rvk<l;A34`;P`?7^
zo%`NG$6mV%L)|M);s6PpD^_pVFFg^k?lol&SQF25tfdJ|tb3cQ#>6L)EWjK1XMYZb
zV(*9id>~P5KJO>5)F;*a17{lu$L(hpPHa}6m6&g%GHhlV^LA33jk706{WY9&6AjlJ
z?3q~URuXx&A_`#lZ24F;KHdjN$dvvL>#In2n9#RlMHM?cnProScyN}Ep_J#UwSJIK
z|H`-BS+!K0I$^h7nshR<lpksoJAdT@PaA*3r;-C|)ZTsS5oTb`KMN3NPy)+;I*@H}
zLDK37;qoH&bXsqDDlUjIIl)$~y8Z>WBxyA~3G-85a9htuc_5gZkg;(mZg(HFiMJEG
zFxIbOL^37D495)i5s2GN!P3fOabfYRd_dAAR~kUrr^wex4Jlru8__(E;(r6IcweAs
z#C3^^LCJ9pQ+{oNDZkf6A~;e0t8A1CSUHLCp=-cfshJ5Ej^2B%LGu!$OX(?dxQ$_8
z6vw&<eELVap+O`N_Dg;~IC8Gan(`9X#k!rCWIfh>@2iBRkHQNARuv*L<%04z5sc|t
z%8XZ{M<fg8Bs>ruNiSwveSb454xw4N?8B%Ab`23(ah-8|h3j6G&uShnw5vXEdz{rS
z%O?Q^j>Ho=>dBwIPBl|Bzo-x{C#&(rSCm6%^!jN>0aTC)0MFM^viG;*YP^S>6^5<7
z`w7DKHB3KV$G#!x*vw6hbbwr9_&ZvOe)zRz;f~ELr<r#_Z`_F$O@CZlePQV?!qYz+
z6xU-|!$B4EAv5_qce?g%7vGiacAHO%*cqPev$WlWYzGo766q>shHd|W9^=ABoYkc?
zU3m%RBxZ44G<chW>Q&O{z&r!X<Pz~wZQ`<t@#2I2P59W{0up+G776E?@9e~z@G?ds
z4hMe0MtPk&;2d#eGk>0G;ZxNc)CwF$R{NtO6K8?-L5Llzx2yRN`^}=3LdkS)<zSW*
zTJgubqN~4O!B<zQ6Z)W<43;$I;+P^Pe4m&w^Sb0A&v9qx#flT?-iDY2Rkapr;t?8X
zhZ*ydE#dN>RU!=}dE2bUu$9h+7i5`)@gCj|wU9>(<E_YAv41H{JPHs+rxFmvW}i4H
zC`{cq#;<{(>=v^i4wok@hX-rUSE*;YFQ&imE<JRiIgM*-x^OG4wQXP&{EkM;vDJ^Y
z(2EPU=q<LueH0qFa2NH*_N-9D&(h(oxP;>yv1wI|cS{;{S8<uZwzG5gU}KF7p@E3h
zSgj$=&qw*J%YO*9v6iHMxf)|$9;UXQ@R&ph#ttPmK5`rL-%20fFVrquF_4M)($#{y
zTy|b|0CeOq-|F*f+gZ}03AZPLQ9$%rQ2R7Ai+R=|QEKzqvy#F1JYu}h20@vjv(OQA
zo?WHG3&sVJN=KsBO$u6q8;x-DMtNF!cJYY&6CuvobbpWQE_s?(RcG#X-LI_6Flmlm
zH^<IpE7O{!Tu(_%oTX@H;+seYMOLz#i5=H!t5oQQvlsEYtUMFeVOO57>i_#e0pxS=
zo19dFybL1m*~6egSAdI=Rf~PLTH}6q+3xIiEH_P_z5PD#8Zo@!yT}f2gtEp;skd32
zZDR3KQGcD;fa3ss9d1A1RSpk3I(V}ykW+kJZr`I_CPn=UU06g!*NGxhoL(^-n9x9S
z%-7WXt1Jj?^^rP?j9>FsfI|lZsL4VuBF^O5&^cb!U>8Y54KtPCqrm`RV1c`&cYiSO
z&)qmkil9!CVASvx=vN#qz1O`^Qf=sV`EJW{b$_D;;mvMn$($n)h@=iwC18g`EjhDv
zy<khJOIL9gNa1^Z*oc(RI0Ck(JjmH1Nk5w+wlo=-$wFhj?5WU<>H}aHluV69^rrQ6
z$<SKXlrJ7`iS(RC%Hp6Z);{YcvuITrx2Cexr{@CHk*K0kx4zybv~xP2SET9Mfri6l
zCVvUaAAfwJPr~T>#LQX`eUN1fWewCLIMX8JI7qI%MUQu{#}I4CVgC5z$1-r;IyO%i
zmD#k6O46a*mF*Ar#ZkOTQI@$k!|h5wOi-Z$IkngaTVa0Hmdu*lm&EL1JSaN{iiFG+
zu3lwcGV%T6Sg;v5*mUC`x>@Muvt*Qy=YI^}Ne85-v1J;2`$<ovjrP)`!r$cz%sk1a
zc|r1ubJ263p&e_<p=k&(v)C_&R{}I3<LzAlqxr4kyo_P5<6>1S2|}^lxmLkrCegf-
zt|y(Z2nut9=uvw;8#gNSX^5{Fsusn3v9ao5)S*)-ON1U+^)bm>BeKD1<MD`WMt_<e
zaq5FLXPH*!<$%*R*OTC2vc@P?`GxU38dpX^`YOdtdi?czQ|Cu*+SWr*F+qB8#N+(N
zN6s4YvhK73i}e!5gzXVM*b9Q75dF2YV}+`F_}B~l7eSyHtG}*npj6R3xf##W*UsdK
zxA!OM?8;--j<f62^!%?!R^$0Vx_^G-3$LT<Gcc0k`qgiC-UJ1w-$ehhFR7Itdh1Cc
zY*z>URO=AMqwjFh>7ERzm+YHK`XDMmO^OL?M`7(;w3UxN6d>pD7pSbhv-7wT*vLz;
zr+5VjVv{cxCT8ssA)C&#pc+adv30?w$QSXp#No)IF^OrE9*v;HS+?Og0Doag!wAyD
zNAtK^L(~$H;4^BcTt~qx)s2WeO8_~rnSZv<%YFYsH*DyHt|HjhT8)(QaMZy4K8oS-
zO0CmGYL7>a9FJe+!pqibB)7-osocUDO0PYlTUPS;r&+eq%LnyaDaU8u<5#sLUedu?
zZTU*(gPs<7kFTW1Zwt!b$bTCcPOsq&4(s%wZ;}|*eDQRa96)-<u9Kkf(RXzazSxj=
z$33v1OSzg(4+w6j`!2qqp~?_m$I9lo$AbO&6*r_}rfFDbKVVwckZcK$d(p5$m0uRF
z)363M6l7-R(=gTVn_{MXniH3#8jtrnK=WT>X5Tew){4S~nRn@{f`1mKpHHQLxf@^E
z!0+OT?d!(XctZ1IylC0%{^eKGd=M^|eHSm(r4st|vVBQEIya;`?^Ld+j?mhwA1`G!
z9Cxjti1sn)I1h@JM?42%rv+>PQRrb>D{bXH0Hj#uif$s+ngwa+tltE1v%YNvb}5dT
zNy|Lr;t(^`;Ozv2L4RV)LjtHE*y;F2SHmBuoKxgTZyF%BHRXxtuam*eI31DT6IbNY
zbbs!^B|3N9;zrTvF-MPnig&uSz(2S<S@4+oD68cDR|z(B(T-P}Zle2ABt>S9kwVf5
zMu(5_h*%U#k@CRU?7$bh=6O~+$8*0bA*+lqCTtj8BTeIBSAWP^e@OaQuqgaFUKRez
zmZiQJ{PS;jHF$W9%OL}=tcS*AWiV{L%tBQ_z<T-eb0`L%SPc(TwZ&aVYb83B0Rn13
zn>4{!QJC!SB^|p?{F{rqX<4y`Uu$Q0p{imK4Y1er8h!8HGlXS7M}3(m)F49%7^PuM
zdQ4>A`EX<J4}XWYx5S9GM%re(N=>ZT*#AyT94@euge;vt$vI8vp~F|^5Efmi+$>*S
z!*}oes+7QwEM5{}R9D6IX_2A?@d-m?g6W~o60ufXG%MPn491?`*F#miRPRXDcPSB-
zSvH^T_)0V=_-r4=EHxC0?}>a9==WG3fXV)?K(T5rlYhfT=O2r6sX05&%PY4w`s6<S
zdhB<*Lw$|+_pNl-;UO%#2#4g@_MM*(cDB4y+<kA^dC=is>x6i!UIdykrUQ(TzEZD2
z_Ns7`mM_1_uFd1Kvva?EDJWgeEqM#Cq=em^0hZKSc5xlI@+-QHiH93r#iIoB{;#V7
z^NLzb9Dj(#&d#GaZq97D^Xae!zkiwi=~FBFq+NKB0ELo;MWFasJ{+c<VtRR)joaUy
z2oTWs+4<r9=f{VzTo>05xV1z1PnR2oz>N(WWby$v3D`crn+`YZ=DQcihbM@srHw`l
z9G`V|a?e|kYlq~|UHPpGn=6VX=i{!~%mN%%mw(#QmdD%rxZm_}MfaKb9r^9}DJkzc
z-1S7?{j2}x=N2#gH*_5S`i>6^M%Hj!d9NF{x|Qf=Fx2inS8<!0vr$(}oKe$UAv|Oa
zoK_>Nr3W&3&VF@-p-RX>oYzevf<`n{Qb~fRqDTjhw6$mlQL>$PFE3weK$Lea`|xV1
z9e)Wm59kgqRnW5DcyJxKtS;xYA>$cf4y8mijc+Qz>KY|rU^bTLg6tOd9;L4&O3BZV
zqY&7!%^vI!tmsgXia0((L)tuICqA*?X*jF|dvuZ~Qf(YCUoDHD2!h8gnHM0lq~Qr}
z#n%~!8jCZX*PRE2rO;Kdx&(~FSh5djJb&=v5`NL)mH=`xuQ%8jvBa0^cT>kbx(^F7
z2}}U3?R*Rf{~7dMxF)%RC$d?Bck{7gb~EVn+XN?kBx}>Qm)r7k8!xxrw`Cjew)x$*
zzKhFmKxqd3y8$>_UtfuFgR!uR9jsPDhK{D~O6vey9A2(+h=Z4`+O;&f7q%-w0DrNV
zWFnLu=lqefG~<B*2v-^z7UI$6j7$WvE8^ow*7Q8X)=Jm_$99&C%8B}~wJPLpo@E57
zffICHBs7zP6D@krigThCJ?_3owC?4snDi9<oFA&D`?|ynLuyW*N@Ls)h`9t8%)(%Y
zAX>D{a6jNo?Nk64g92qf_;a<H{(nw4LK^HUZlgvanR8LY&Fj$?BQ0BFPk4>m9L`rn
zdN>)u2hao1^OC57)}Q6rw<}!oN}Mf6+rf||Pr4?3D5oGwR|JT_9|>d!y=cyz6P%i+
z=#i7F{DQa-6d>M$%J0G3VL*(^Sjs3$_Tn(m;=>vq-$Z|w^#n5gCC?jp5r5NSGEput
zay{}*>m<>n_$n-)2|uDKcJ>_|&$eK0l8iC-JS<#1j<%+|v0(VYy>VmL&;#7b+jaO<
zudZ91itQ9!7uP#FVKksU=7H<oX@*?`?C(sEQPXP%t{WU8CM#i}bHiHmGa99|!OV}2
zj_6G8JS$#RPQDy<p?9b>IDf8Ap5rnRFLO=WofJR-G=xB?MGIHo!Hl134xW<VHl7OB
zmWMo>-bgOaB(2^{7EsunQqpDQkjBA`5sh7t3=bYiGNg0fxl6AO=OY1=zT!-#78;Nm
zb8t-bxm=9o1=heTqRYdp^G#OPP~%T3NqD+MK%{4;&ruN7#%m$LJ%0&$?p1P<YYn9+
zXrl1;z3Lq}xhkf!K0{c)aUV=;3gzhc{U4<ENGnJxpWp9)qP0Ankv8*h$wQ6hcvwts
z8n|rvzV5%x|L;2g=V{5+XeRl4KmBO_|J(L|KKq}t{XGA@`%^gkpo8yW{>K-jip7b<
z9=0{8@+cS?0iMQ1B!5F4i&UW`_!jLcA=kpV(oE;w&3``Gll?!gAlgPFcihDdDVhUm
z49ue$MEg1~iDgMOM5i)zeyjVBA`ZO&Cw@AN@aD}PekDY=D#YR-aL=q3q7VcED<DC1
zmaL>CEX!(%s^WBpa(<2&1JN^8=N+<TeC&&7TD=5$cAaA>V1IS;e5YytJm$T4{w_Ux
z;Tq`VIqgGAQHb<LUtlq|xCSz>H5Y*wthNTehPthTnA=Y3gVTZuqzr_SF-^tLQ&+^w
zaE0j)C>ivhXI?Loj^I88h?%v1(ge&<#!p$Hbq10Oq-`nBfG=HOYDJBEtoe-wbInTU
za|9UVeTdvsB7b^w-qi33H0jDU2XTeG7g1ndB;G#C&gYkkQP?2ur;f<pLV2m6^gAn4
zb9tssj808KE^LGP)ha(Nhvxstk63cA%eGYmxdkMDXK|J1P2l;LH1kU#_g~bqn3fId
zmiYc}Q;@1H-@N;RR95(ETV<)*mVMx@e+@P7V)#fivVUG!!2wrCcpTQl2}e;T*BK2i
zl_~_zFy&8cj3|U!NQISQIvz{8;P9r!?Q=2_&}+E-8+!>ZQrgEno%)OcbAw@c4l%Q7
z3poM!TdiSJS@%v{$IBJ<*t|Bxiv}$Jit+l_FYd5OeTUmra&Uzl?!S{l4yS7sa(D~^
ztR6830DpI;XPL#Is@Y~a`DwtAQrmWrK&1&xddtiD1+S&b(Cw|6kD`KQm6~!N%9ed7
zTlS%B*}E-U7I@7n7<f!nYDV0^|K>M!c%uQ`0b5N6z$0e^^{kYL=ob6CNyC{Y`<W^c
zlC5Se)iAOS>>P#uFC0uM)zzs=*GlRlmdoGlGk^7K1kOANrWC@f+_;q%BnrQdL8akP
zA5k%<!rR@x<TIh20q%<sP>;~7`TMIS!p=@5yFrK`pBpu=>)=~1D^lp#G`+!{_}V~f
z4HB^o$K80G1g<umaA*R;)1mXvEkO|<`lx})kTfw?@xoL(TWI<k>6)CyI~MH1tU*!4
z5r5={oCd)rgyw_eGMr^Z+$b=;?Q1_J*P3%r7e0m5`M6*@*lBAb5`N`mgX{P#g@@yc
z=+osD2NS;Hfbjc3ejL+XdzGOGAP0=p2Jc4`G_dw*X`$jkC+Vdf4^k&Yu~<wL?=n%;
z2SWXm$IZ$A!Ns#-;YR=fIL)^#Z&N<LUw@WC`FNDdvriADD!CE>#v3ZZ4`7Fo)W!UA
ztnM(Z>yV=glrpo<a6V-N!H5J<+-yWPodq?q5wM0H1rPy)SsE)KKN>v}p($$XK<r0D
zMuBED^dSG;=Y`)7By7yrd9}}dsD<PR4R4N&mtfx0KuYOPi&7Lc3DaO1U?kXEAb-nf
zIF}7!`BDQ0Jq)*B=@x?~jAv6?P)Iz(qVIF@c|c4EO=)Ub`qc2oiW^Sn!hXLOo``z&
zQm4?9&um;GqD7%pttzE?{uL+sY?{qo&en(_zT}Ss8H<M@&e9RlyUDa*g4a^Txa8uz
zpqC0EM>JC^7F}mr=Bg-O(s-t9v40yB(tnb@zDmKlU>VD^DR?-?f1mY-xF@Vu;;*(t
zw|8|{>T-}%A?V6+Rr*lnV;BW7wUDTW^NpwhaG(_2(aeG)4Z-<J62<*qDWI&ZE{(fC
zoR=6jILgCeF&_{^e2nWbndT%*k$iE{{<<g`E$ooK>vI6I2T74gD<yFx7k`ZAW0;2?
zi-j!+7_e$9G|%icpbkdPM9LeEs~137jKg|#3<u#$08HjnfEhr#9U=nllI18Gt>J&U
z>L?s<ap8)3I60k-rrEX11lXA**cpN4Oj&MDE{Ozi;vPiwX+e^=%NNnj4T={C7K@p;
zqSQ4WU$rNx08OGDCz}Z^Pk*P#%=5qu$d5z))n<X%F0!krlsI;+4t5rKb*L?;p(q5B
zuF2Wg5}o}3aS~03)fWp=qXu*M-u0;Md?r2p0xgGs6N{l+&pWr^>$VtAOZ!=}i{elE
zOyigJF~kq+Q`gfJY0Z^ygLfMbgGbRg=KakrTT7TOswQbkRZ}f$cYjW>MZzWKs)!kC
z?)Z{G<xC+rln4lMBMQanVj?S-tR6TULR6fgv~pV|sezDD3{9f&7P8vpa2zmDLy`a^
zD2slcx^T1VNoIphi3n999q23#b1`?1x!mxs*~1->OFqj+Es^yNf1d`%1Lf<^MT-3x
zi>VuuDA0Vqnb{Qst$*hCwZx5DxT+=?oMU|%+a}PZ0_gk1GVo+A8P6sdiL+FBc?x5d
z=t3fk7LVf9io2cU@6flJ7uPK;Ak9gN=k(&5($)%UdP4Q7kr+|qiGRtG#9LO2>+9^?
zqm9xvEqKX}l5bSfl?~;=h6Ch7>VSMJ`>56^2bj%0#>l+E7Jp7@ey<?gW7B2(Tm?xh
zrA9&}HbOS71}OC(T`$!g(gt_sIT0oOdkP<Q$}FB4-pGn8rLVF<t)8-$Rk(B))T$nF
zM7Ewuk)VuKWC#J*q-ecG200YmJPphQytjFtB+S|BSBN~)!eM;rV(a+3WZy&c38Coe
zr=C1;Agp{WynlixASa=pdJG>`b`;(v?f~cChT+9G{w)a8Q<f;lLtf-r?LC(t_7aUq
z8(W<WxGm+8`;g`KI^tOLB|=2>im~jZN}a>_Lz=^F5_@{wb`KfI0KXg#vS~vzf9}G>
zGm$nf_^F0gO3`sn_{f;txa>g6Gk%DQWf#1!2lH8eIe$%Kf14@|Qc<1L@ZDi_z*NiS
zuqAB9A=Yuf*^*uvnoJr{XjOOs)6tM+b#*K==i!szC#m+8%)^P_!oRBWhq+jkVVR&A
z7<pzPvhU&%!rUm+7zk9^Hvw=^OrWo?a2)kjHZ0`jmE_rT1D(+QuT`Sx*FE-R(;t2b
z_srlaiGLAcmijg4HqlAB3)1S-p<CJ`JrB!ry*9JcZzAKi1kX0?M2NX-f`CkG@0IuV
zD`<jVdr2YmOd~9ZBeFBh!cph|2PqKkX3>@iI{;Dd`5<Yd2E5Q^8BV~sjqQ#Lhftm}
zL?Ol-l0Mm2r{au1<yIeLn7NifX2%1+9Q-PuHh;8OY2RUo@>3pA4@Nnra+t}d9nWor
z9nA6)HN^tQnCJ>EH4x#eJ-M&hUR*rF#}Wto(XexxT47I)yfvtD%2j+p2!$!Yws)jE
zDS9%<D1LPVu3q#J#}^=xYYsX=%x5-Njvzo7Tp&Y-D_EBtKAe#b+~+z3(8KyODYT}@
z8h=;37qpoD6mk_El*;JzBp{ngT9&jBK8(XMlb-ADUGN6Z1I}nAkRU;$8_oq1(WsUQ
za=qW@cxXlvM31NpZM#DIL3j}>fK*4)oxr5%y!JDIO2&A@0zp6rc&Fne{^X~fL^C4V
z({zx}Ni_TPlgaDEcZ=$t{00I-+U7k25Pufly(k#o?O!BQeO7-@FffuwDKUB?5aMAU
z*rx#9k8}yFNDsgD^l<B`8WjCGtH;v<X~U<5tE8K%1<)x7uwjtE^4bf?GTdUSQc15P
z9q69;Q`GTm!^86{)aIlSUM3&t&@YC_#lD<E&uv($)vrQks;`wZ|2<M56go8<*?<33
zTI%w9ANeBM4q1hNIKBwn5H9`gst_<`WSyp1GqY}1in;u$OPasRBJ}7eFM*~NBgZI;
zqZfaCr9Clg7=g<r%pw+_IS6D}NIr;)%wcPt=80*UCXpCO_#czl5XuT(gb2(x#+5sY
z&roWrShZm*=_%5!va=OSwMyh-;eRDsrt|EAK@#WFvC}V1Y+%B1LbPQ*iP0y6I&^AX
zJz^P79u4M!1TK1{8=Mjr*LLfV?vl{<t<6q$k1adIVOSE7fUc&E3d*b>1qa$vt}g`Q
zVUsf*)ic4djvKSwNU@k&go`IFoHps11Up*f$OnnJ(iF=Z=HR(5R6f!wNPq58x!o<(
z0m9lY)WQQ&HxNcw3}0n2iX=O*zI*W$)pop2ktPqC(vUmxvPqv}$2_ZyWMy8STfq=0
zKL~}4VooYWW$L~+6}c-zOGc=k%q8M&o|S2yJ!sCXuTz*m%T{;K^D%M9F4_z0M~I#q
zEIKl};<{l=Tsyx+MKPyHvVV%`R@7yL^R-o{3fE2YlFc-(vc%zouB`X{vYd}_l&oqJ
zCcy11So6ju=i1Lt0<5KIfZP&C?qaArZgK1(6e_%5a@xNp%KK#g1Lk(ry06Zej!8o%
z8Dz*cwCPu9O*8xY3&-9&BCtM|=M*4G8aq*Nwku-pPAbs((i75Dhkt+l!jku^@A^|c
zqcu36d)3J-7`!nEBJoYSm%eZ_w07^am@af!rlQTA7bNfRPqTl{rB(Xn3H^0Zygr~e
z-E8q#M`ZnnSNU+TFRi#apZd7Wfbfu{n2(H{q_I0!8t{YXANO5@FPtoH19lQQ#!?%b
z$nKS~{me(_p|L-AHh;X6(49lc9rTOZaD3zpw~{?P(7~e)6brtYix7pH&bgLnzho`#
zZztb=bL20^htvGwH2+pkv#CfVCSMcBac8=@G@P|0YY@WG+@jv70Eul}KL!fvSgVup
z0L5Y&6|ie6RJU<dxGZB>3ojP@8y4diC|zeV>eKXJH>##?Ab*|?>8-B36*b}hjJ?b%
zV}ueHS|Gv(5Rk}@&c?T#-6$5Mf#?Luq~Q|f;lo%IPIfk=6X!p6868EKlK%TMH^Q2Q
z_s-p}o0gxTn0DP;R(0etoU~J~-)E_PY*k@rO$)r3i<cxv_zA)!T3nUa6>+(7lhCni
ztlddA%G*P~#(&2M-U`2JHTA}i1f5AYQvVd<Z921r4pV?e=2we$luc2?a9dr;uFwaq
zBbN=O-sa<3J`84+WrN7f1j{jdFvjfcAHlpK=UZbY&F5lfWm+sB{0GUKfkSBUukt=e
zj(EeR7)tEFLEPD(bP#0{Y^SS}8eoEHqW(uq)94^7>VGKdo$aQ(tz`Fn_lI5!36)kJ
z2v@Z!q7<D5x9wYtG~D2>x#&cDJ-M9cgDfr>zIKGN`e<AbZs?i`;?&w#968C!`*lE?
zKw%`Fow4~ih@_U_KMiP>2ux&}w3Av?Fn!lln9oOKO61vqI9U{awm9|-q#2Jlh2`>D
zUREqVtbZWsvsoL0hodGIm7$D^<^>=;26`;s1y`A`A-(J>O9wu8OcgCLY)7rcqf}qS
zEY&XLF0zr8@n!Q+St}djjXAXYW+L{DimROc|MD?&#(jN_LBJ%TE>b0>hQ-V5rbNhM
ze?Bcaeo>rm((-znEB)$6b-G3GTREZH*<-SHpMP<a_@@AeNuSj)kg^i29Ukc(DWW4%
z&U<1T(NERPO}=FGFo)^uqx^UELE%aCq!`Tf(KGpU3umTF5I`vzfRq;(-27EqUTNd_
zGXx0J5pnGedJ-gFpJZxp_da)70TP+DuVGn-3YNwdGkctSps!c+5Q3iQZ4NN~Yd-km
z&VSu|y@OU0E)m2B=sT|T2z6i?588))T)3{zCZ{iWn_<(Ixzc=Fs_K%&jWlOa)UzjI
zP%1|VD}nV06Xp2+>#>hK4;ezOVrR;wAAD?~JRW~1Xm-P4I`MEaYhd2=e(H2OKf9t~
zF3`l6W2`6N2x54^G^%07Hjswea&?L?e}A{#D?%F@TLX!R&}aD4oyKY4o7ADaN|(_L
zV<Rt$>!Z5-o=PoqKH~JSssTp|i6lCK76Q8PWi07QVeChhnpNQwLMx9#^6fzN<LBG}
zj|I%VHp*PU=Ic@5OE;z4z=5kL)UJ&MUy<ZHXL&Wwg%4N2?rP$IfEqH+(e|zj?0?g$
zVVr{@-!-L_oyNJF_O@Ogk9lF)^7+(FrB)i(KfT~|Z*ry$B_mizn*MUR>3(BY^DVU3
zJg7mhS(jRiem*W6vYP{vVVi4NP?q=P@}os#5L&3@;=AJoX*w=B=Qo#svoifA`H+3{
zA^T>%v$9_D&Gs^HAo371>|4lJQ-9f&pmrP=r>LS5_z=#;v#XW`bkXET$(dC<S=s<S
z#ADN(iFaQ_rm=?1Z@M~6u+4$_L5L=oMbco!&1y(5*^>{|r9V`cURYgPN#?ImQ~GTd
zMno&lT{3Ks!9sGFSxR>8nI<I(z)TMVTO>EZV=|d^n9XLEH6ZFyXgYk3OMltdppOmA
zhkTj)U3st4OcXC7xCNY1)*ht;vn3#Y=pw~>If@$>g|$3s44XkYEUg>Ce;Ue*@Q^e5
zt<5O_=naP{+RxwwF%k*P<<aAvLwwc6S3H}TJUj?u=+6e(WLVtr2|D}}cOu`gZ%n#y
zBv9y-`U;u?Gu8<GVu)FZu73eZKhK7RB<S(&xwvg~x`U2Sxx6?}33W%sZq}a?ztipf
z?#0vEZTYMlY<+MHEc&VPKF<FAWLLh}b)jVfRuq~#xKb{*h~;}a>6!sZd`6J{U_9-U
zh?wl>oveez%OS&5i~ZFm(z3Q=Z<yexl`^`C8(n3G9SlAHXd{!YWPfg^2mwSYvq3u_
zJG6V8Lxd-{<=NZqcNHMpDDpQ2dZgaWcPx4*aebF5A-Z*Cay|~)DhB#8z@qN{p4b*Q
znLI5n$I0<{z1^nK$Zl8ORyy|rYV|N5F}35$WK)rh_`8akMu)qfj*IclsF;@r;u2s9
zg7rEiUr9l1{*zjJ#ea1aa3JXaXbb29htTrrxrP`|JW-OPCeg~ejIyZ8{gf}GLE&Cp
zN1!1bF!?gMKX?T<(g1%_(;XK|@Ji*U<dZ~-7N89HXd<X)R`hWiu8yBZipjNQa`JPF
zWsTH@g5x{YVkQ3^K@K|_qRF{BjWL;XxBPsld~R>$u!|iepMN@_8ec#oDrZ5<*fahx
zx^dirnABl<__-2#R6G6>TE@4~k1;^potBzkc=ULLP0Ac*?ByE2<Q&Rkib~(jdBquJ
znTsFp&ZnZP?8Xi32G{^EGBBK50^&{aas><TnB$PGw|euQH)=kEORfaaKFLJ+>)B1E
zzU1u-1waOaJ%5)EK`RNElFKaPumm8+x9JSEfpjmC?wq8oxyk177!T6vz#N-Cw8Q09
z&?EhqwE$7Dc3BmE8n)$7_ZiD73G6x$igeZf=;BUUN=Kp!U)qAjA4yHQPI0%`F7aTV
z4-I0SM4n7rLE#zFt7mqcY0Pd5U|-5YLzk8Wd9sm=(0{f)zrHHC&Iq~{np3#GwB;A}
zqpk?IEyw89oOA&mY1bbv>Oy*;t1YQlp=>pDsd^kQ%#F8Eh-Y8`1lp~8N%}u|^q<@@
z@u2?UozJ>5fO7EC&FesRgBG5L$=M{~iGCRAt}aj<$0UdnZ~G|m_P2EZ8$!iFA?T{h
zYKYR}mw#-*C93hYSa4KzZWdd1y>I!RR7E)_)#)M^-|M{8+~Ml!lnk*KnLIG94n&iu
z>?&VR^BJO914A%sewPR&xZ7dNGF>Ll&5@{$stFC5&xYowbx_5oJsx=bwz&f?{3XSS
ze_h2Xv{hk5IpknHCZ0Rs_FdXm<u$_uODj3GtbZh@uqc2fmGcYa>{tpj>nw;kIXmYo
z=$4U>x!&$|4mzXqfpu>rq_ZNh>h3$+Qe>4|ObDVxa3x-~V@N-F#1uX#bPF`Y_Y4V1
zjE<={(U&8;q(eGCXNGBfrA@50^q-W8`s^-i?4ToAf<$Ls&al*_q3tLox|z<~)y{Y_
zl7G6(L_FCrMB9JD6{h7SE{HY~fJ#Ull~;i<N)O4a$a#ZdHj1%kz(B*hdu7fdTDH%u
zqb$&Nd*!r$=x9b~R-%xwmh+Or*Sv%75{7WLf9eQG*~4$2J^%Kb$KRZGzq$YHF%DMm
zRX)o)!WOB`o>=W>{i{kNB1l*%jGZJ=FMk5WMyx7M_`i3Qfnd1D$4?#$O=wsb9;vL%
zpF7ES6Bi!aBMEPI*zb4p{37f8DC6<u8rnC!%9Wb#@VByd!Z;szV$d`<mV=Z8`?uBE
zXc;r-B+(w;{p9Yw_MJOz{BN7@Ry#1LsAQxssv&nlvmu5OO5+XY%-(PrHj|S|eSf*@
zUJe=*&{}IW<EX~xkDlQ2KL6$`moN%T2*7Bd*|AidGs&^0n>4Pj{z&^6GVJ8BgSrV*
zg2WAD`RweFk`PPl!U4Ye+$nMSvX^!!w1QpQV*HFvai!`A-+%k!KOev7e)Zzp@17@T
z+4xmXq=|2$0VXs|<?z#g?*@-{9e+eaB?C$Uzj>5r7-lwY(nbHHE5E6oph8S{bvJf7
zj%lEIIVp+J{VSB#oR4<dSrhan%_Y*Dl`1m9!PZX|Ew`E_uL<nqQvvj#yW0t%t7)Gl
zJ%#BBQmRz;Wt5DJW;4Kvsr^`1G)#Te#pr1?UO%1CzDsnh%Sv{MpcYyx<bR3UH*=K7
z<gtAQe{@z1gUK@QL8P$3bSTNGUej01gVcl_|BNKH3(zU`S6(4y(~=o!mUr%c@=5ZV
z?Hrxt{#Z3l(LwnzyLx+bwbM(xTGhri%3*eFMPZr6yYQl}^>EYDPX-t4Fr$^*S1O8;
z>Kc{@TGS^f$t#8iW}^6dW`AO9Jy!OUZk1LXhP8dY(?8j3Y7i7lz7Hc-$AQx=0IDEL
zOJ|u#IBWXN5^M;SfGo%|5Mf)v>XhD!74$|+(#9FLvqMXGG9*zW*)OW31OTZ(8z7P<
zk3`jJa~1#DU{vCF3Ak=0XOBpRFQ$X~V*~lY3099eR&4+5<k{)-hJQv!vk4wOh{{oz
zc*o9BcSO}c=SwS!#EoV5@W-+{G|zB=tM(e2to+@z;k$^NT8kljI+dz@8*!zXy%W5C
z>S|;17r15&I;T}Q1%ZD-EyYZIV;YGrn4=P@rMkLXooCs2USAMa<h5rG)v#KG0tc;;
zh8i9i1e0mJpaXyahJQ;Ih22IGx30qBu}XiEyvc>E&a((|IB$qS!Ef+Hk-${3oZ3M0
z5cXG%I5c>=XT{-*Y*5J1=lD3Kj~dHGoH*^H1^~wx<5%`_pbDJ)DdB^hx77DlC#3D~
zQL-$IKAi=%9rm=MnHmb7!jQ(<$MmHj7LU@``V8pmoj?6~@_#z<b<)O)3Ygw78et}Q
zvqT<J!AwaFft|IwWCB!iZVj6IGizFUa=ip+NVBu}W%*svntY6o2CobY%MEZdC6%{t
zi0t-r*f?!%510YHR?>S4n@o?XLGQkq$9oO6FHe<g@B`AMfK_<uy1bzU810qXt)xn7
zqOH{1Ob!z%!+*JC$htog6<YYZofx5&?X-%WO~Z6~1Mb>IZu_Wmp+uhlD{BDMhdBVg
zB#gs!Kirr@)O)+O1L~)6WwnObYh5b%Ru;Oe#fPQEN$iC45UiXWQv>cse_lZm(5Yq}
zD>6{{vV~oIZA0^b<#OKw0CT;dipuW*>JRU_*t&{4f`8|mhp38HmSpPYll1=Y|M&kl
z`M2ajkCv_X@btw~{vg>guJ09d#2~v83LptG?#0^tv^c=>89EeuH^+q~JZ?GNr{Q#;
z%5)zDLt8OnnMF9|@a5X1C8K%yoV_<#O~G$xLT0b&!-j$uD;m95X*7CFnwDALZr#5N
z*Zn(L_kS0Dbyh4puVc9C!K;R`g&?oq|NZ~^|Mg_0`A-S`awdC^gjk8xodm^*h#s1g
zm}ZDb?i+{5CDCmrW;tY}Gw)Yk>}%GxqWS{WlFo|SHgE;R)n=p(wR~_tAWOV6SlaWj
z46jI$)MO@aQq^r^ruugqx>L{{YLvbUX80nLK!5g>@#?~FV4dYX{QtA}Z|iL&SGp*A
z-F%8P<z<mF0P0ZX1MPB8mZYj;TPmqV$u)a%dI3owNu~uLVI&}mwrhX$YCXW(>t?@R
zKgo{&ABTuYfI3y#-SgmY&Mpy|85tQdVw}f6WU;DrwcfLrllVkmpGeGvE#rBy-CJms
zJAXSq_tSqndin&!#tH$ieImtfb1*y@{;37YL-v&t*e#cB?rzAJOw>Pl@dqe?6>p3>
zusrBoVSPp+7Ul;Qhe_}3;KzsgkB4!0_+bYHzcc^7Od*-e4ha;4<i#Z~axZ&~D}=X3
z2PeFnna;g0sRipZgn#iJoJKe`eC(a8Ab%?`#E?>#vvm-x$S1y_<wKsp@QxQ)sgETN
zzx36jU!I)758ozSTkPi3MLs>UNPh=BM8=Y=gS30SB=tIAv)+!xLCN~j9_>`q0vBCQ
z`Y78;$I!B@7>7zbpoh=xN%EFsT?yH0ru4&<k$(UYYv-+;|2s)<8`M^Ni_`HR;C~-f
zrd^+(gEd&;fI&c?RjaGYyy2%-N-$ZL=c_I6xI5$(@&@5k@lCgQY2SJ5DSXlGDso|E
zoF6@`KHt~p<@Diu$OpEdqIURcxN|7^m9kCAqqZ|Im+XZXgmROqBb&cVd{7QY#0Z6~
zIa>?X(I&*uX1VbHA_d@u^aVr>M1SNj3^)KnAUAYyI)Nvv)-dZPP(GkQ!Pmj?S!qv#
zFedf2&sC4mmDe~gk^uD($zs3Ed>gXt)`O0WYT~D0^qBXINW>!@W~6o$&B#SEbZ4t9
zfMg;kvFBl(0%|u&D$et{P6db;8EiNS?K@KP<bC*<XxO&I-<p#iks>iq4S!4MnpbUJ
zD#TWkK~k>uv!uZ$wJI8a*6Na46T-q8p>C~<U;-3+l{9Xo*4FU_Yl%ZCiW&19J~i3z
zmj1GDmO0ku@0OsMM%e-R#dZ^*N!gQk>=9*=bu&XA-H~Y4nqW4u)>5pj?PTTs%o;CB
z4w0qBT{aA>F)gq7A!&Jb)PJ=A_s*T?lE<z|j??RRO-|AdnK{GQFc0*`B$M<#NlJ9T
z<`zEtF)q&J@u5Ec4`AMw$CGh0Iq#PeCgT8`6y()k5uSnhD{&xh;dVa8d==z^0+lwc
zF|M@>COcw`t?q9RGT<r*5Z)fBq(wccz>zUU9UeHUfXI_|w-WeB1%H=%wOj(uj|H*S
zN^%O4DmBJi$f8odm2B-FTFJ3^8(!ElNb+GDJD%1<_@t*p{Pc#S^pjD-$R|Oa%7@1G
z`Yvr;@9<^Grr6vZFG8H1(-W`3KN~JA=fm}~h2p4avR7<u18CZ%bhY#;ygF9QW+*&A
z)A1|mfk1J(F-MDWZ-0cj@AhR4bSZ}Zgh<$pfo^NPX#Dz4TfhXrSZh3>ezrA@?e=<(
zDCnHnC-CyeZ(_a$l9`0#F~!1H(Y}#8H@)^|N194{@LAkbOU+1GkgVkEs#<unPs~K-
zuo0B@DW&Dy$B!OM%L0VBG0JJ${WbhQ`SZrSc}(AK<sU(9#D9PF0nIlwBVt>cTCu08
zph$B>jO|kUzjW5(9%^FFhq#(dL*eRE8tTw33n!8?xhksCoo(nveeeRyp}kij-{#yx
ze6lpVSS*`WBd8T9nw0i5AQLK$;p${9g^HdaEX`9bGixTLjpjf}dKz=BzODsMf-<H=
z5NU#zK#Ve%#ec&m$5bA|RwLOl0^o!2NHF@nAWgF)>N#F!fT~<~S%-}$IE;_FKPY0G
zBtIQVqa@4vQZBeb+Z*+gbm;`fkF*)PSr35aL$2o^btJ+_L%ly5YnBkDvF5J;O+d20
zr1v>3@1Cq=enRZ%=s=pj?{pOwePb>UhJo$oMq*I;xtu=i`#FD<d`~>7N#*tLiqppm
z5e9DaG1+4Hn!eiV`-<BF0#(izc9q2y#eLl-(8)dBkDe#5v{nmTOY)v7jy>^KpgvgL
zLP&Ix>g|dIrZAi$9BN2X_KQMN*ff~TYqmH$NwX*9zFD;@Sq9Bvv%#!k*Xb2Egyg?i
zPp3C*3$9D$;F^EQmCCWQhuh2dJiH%^s3VIP!U5pjs(Rn?6OO{{iDo@@>s_cT9CJA4
z4)BjB<(YNfxONZfy*#b&G?9CrY+o*4SF6Polp}x!?P@)#8`1_kqO|{v{|hX_FEUbb
zC1PK?417hY7PyxN^0DMZt}aHubM|_O4ybOundnz@s8WBc4<diHoc^3y5|TS{S)Z@;
zZ#1FM`a~_l_wn}Bg+39k7ke-VvZ%BZ_vv}Kk*M%DfM<Vz`}G#?=*u1bdfxYy@LC#Z
z<KHFg0~D*E&z1GGwX`k8h>rU&XG4;cjwHcWyEW_Q{fsP+AyYi1{<iD%8!cq)ZgM*;
zHnW-ZoMwNnvcW0#)Lmx{s0ooTIfL$$jfy(YWmI$a28+OU2Nw-{(d|o?f6~nS%XJvv
zQxy5|e>=tB|Lu>1v-Nxcr{nGbd13P2B-r_=nm2>4S|xB%LHcXnzhujB;^x{cH3THU
zabj{v>XP=G$!vbfY;R%*xA2!E+GpkX!AxUOnB{+<I@H7-t!eTwurw`~HAjTrbZXo9
z>UcZl1tT_0Z0N<e!*!h*jL|{PBHdsMX$7$w{Sm+D(<z%}0iBQJcfq%xe-?i>FOq2q
z{PC3fcl=D%>wY!F??W-_txh^sj5V<J5>G1y^%ChK|01S@=J#VdQ4(*O7AA`K)b{~S
zZa#nMa+3jj=OMi%42aBx{iv+)!>A|cT8Rlo`G8kKW`QyBB9?AvCoR)uphP-NT9Cv<
zAhmsrE412b7L)=NUM$PSW%d#d#n-$#&R@duTyqYSsb|Pd3lB}NEuE*`HXQ|8uw6&)
zUp-MR2xoEA(DUYMLCCGjx5*RaQJBf#x}1Ma1;QPzHD62D<fM^cyJ!Lnt6TKP&?Zqy
z^NgrV1Qs7;Iu@RhB$lo#5Mm|eLhRz{o*?ZHnoNmJoZF^IvJ8)oQJO$<XKTBXiTL0i
zLD8nW5_V2lyo-4-AL=oRo>~EnWC>gjkxIK=$gqAJkB{2+N+icPzM#<8<cV6NV4{D}
zeouRhikCD&h!MYD(o@crA0Ia8=*#+z5%lR*(v%@)_-|(ypMM^8%3*qYX2hLCB%h8%
zD>ByAw~35yP>(ilWRhT-{zUG!bhC65G(}E3HRhKR=X#<a4Tqqt)zH>KjP}lbG}#*z
zRC;Rg88U+GAvGpMA5YAMkF>HKBrSiKc1SHg@^aZ$Ou3S2#G2e`eMvz*&r25B7kki#
z4j#@XKNmgdIRN(m=C^&+|Ne$NDlQ$4!vCoM`&;<@{wMse__W9Vll_mMf9ForshLiu
zVUjy{-nsjNC!>@zErSMl$)=b|z%vo1Vnxjn<`3q@f2Q3}KR+=k-ud<6^Iw0g=baFY
zd?z8CJpaa5<4W3<tWv2L3nn^E<EE9=?)lU1AK*A-Emip@DMyOMa6jbpA9`$FG@4#i
zX*AWQd0oxJ%KVKLS7KzN_~5GkOSzmVs8$-@-~7fX;msdqWdy24y?XIv<GpJs>3R(e
zX9S~|a$uD!6KxsP%tiCMl2(6>!CdhLO3PS0*?E)rCGpc8Ek21ZE&Q!G$^(V+pamUc
zw{0Jx9sK8Hed*^PO(v<k_{Oit=SvGO9OumIpwyTqQv4_8{46t3YUmn=xgxeEK-MPK
zLhS95dgt;LK>D<!6X+pu2GOGRB!qZU?BH}n2_A;S3D{JXjT7J)SYLm1KYTvJwt_LY
z64>GV6MYhSZeY?^>Tk9@|5=oP50KXXV8P5OjXVk_JZ!W@SZe-!WO7M4H9Tm-UzdSS
zxCzq|;Ol7x0|C=^&Dn-vZx(yo9b~H%r{rXNJQ;PT6iK?CsQN$nyKP*Y5;^&(*t$xm
zytv(v_-uGpodsLvb(()c0NK#zL;G&QG&sMP$S#4WDJ{F_>SL*s26I2)ORO(?IrT1e
z?MT1G6YTsReShmqEr3y-q!T*yW?|23c-x~0p`eViMeDXzj>RddKH~EkZQXDB(IU7t
zV~cx%Q`vj>2ZBO?XesOVI$aZ*`8yY`GbQpR=~g^S_WRizSZ05kIvyFP`Y#261x>dq
ztH-#31rI)u-~Z$k5c#m`u4aAL1Cl6*C%RafZB#tW#heBX;i8-hGHgYYbGcTmSM~Ot
zey8*bKVbW5M6E@<Xc#R~is;eG=F@R(;v6I%(9<v1eyA?w%ZDr-4OS-#-8kZqAw~Xt
za8JMpCFYv^o|=E`t@TPno>7`6M6B4_+w>9^N#;)6EJhb|=kF*mv3bKP`NkTR3+TEQ
z3zLxG`gvcFg?Hk{ecQ70x|&YByZB2Mt6P@C!>BrcaDoG)`1(j^gqL}{cbppApxaT%
z!!Mjb9ArxJaW`QQpdC6WdVWVb;6nUJd)X^apI--kV*Y>OgWex5_{5C^e%*ZdU=M~D
z&5Z+nS!#6bgNFKS2snfr2Rr%KCm%l6=fn2T)0>8p{?c=Ta?s&7M^mHmYbJIY4z_t?
z5-Pyw6zzJU^{87&h8{R@-w1gC-tQO`Nl+viS5KHFx10g$ca{1mC!GgQ>6w-L1;gZ~
zw27E>1D}6+&kk0EHjFqUl3uz2TbZY;p=!ULPmvz#%q(f3(ZN@N%Q>B8j<oWN;kw@b
z7A65WvI+xIilZ_X7yH9>*-_b?B%IuoZ6fVfWvMMB7E@FR!Ff>6@S_dkcWDBD=UF%p
zyA%1!lUZ)s5>6v|EGy1SI8^#?4w96fbl%EWZJB>fzSHGL?DXEWx+urjpEg;oc-THy
zWZhz_2{or@XtOtgg)#f;V}W_&C}Q>-#I`Zo4lve9dbr+6Ac=5+MeR@+DH8EV3z{J9
zCJ|L*m<%OviKP=D^Y~60g=ulCyT7$G><@k`9_)a`iVHafS|V_UzdL5r-WPtwgxX{-
z*6M#iy<d9PH9Gek5fY+S`TcF$It9wGGP=D5QI40@B<%Tf3(b4bE~z|>8L}QpbU<7P
zLBWFaT*1W8WWf+!nCz+6!+70LBKebOG?_LgZBv*^28lg+RHqP2v+D)=6qb|l47Peu
zHwV=m>?3T&0p2(nPQnv|%a!UeBAuZN+Qxq*^nSaw)bL&oJU{w5^+sz^lH<$Eie=xK
z^^os%AUQ|t1E{58^20^bt}eopf1Zxw02(|Vg^L${)nTVG4`hx>@`)?hvZMlI6qS@6
zZq;*tOYw#F2>1=UI6iwpa2ITr!j$3edfQWf-T5b^=@}yVZ+89(Quk2NSHhq8qU3+-
z<P3&U@<ZEBQ5ld95Xd%=%_R8=-Rg(qYN<dV)o@YG;^psuv$G>*Vu8Ss?c>cSac1^x
zEf15KqZ{czg)e>8R=$FR!N5AlhyNqG*Nz-h?O7!-U`}p3JL74XYY{hV&#&#HSwT_w
z+VC$~nwq^%i^5lie<cgUzteS*htq#$;V(C?%Fa$u#pUC@e`Z{TINdPGf4a4?23&z7
zIotEJZox^-fFPC^Ye`aRwO50+V*uf6+jKsiVVQggLc6@xFQq2r;o)I0pgTyp4w>z9
zH099`0(_~UYB`k|``vN&%M^0P)L{~POjA0;3y&=~EG_c6lquELm0}|ij%a_wDS~%k
zAU5TZ*Nt3MthP|l6+i#c85+%W$pUg9M6u-SRW{=+1{=+r4W1w-V0gLBXz#Xir1Pfn
z&a1*G57R^95Bi4f?Zzi}wKc)ljXZSG=mTFTZ`yJ{)c6E`ZM<Gii+)@5zbST)*5SQN
z#UVW`zN~^EToyn5?&<L5v)_L|{&u(cZ{dLK{`AYElgGp3Z(lxs@$J!*;j0%<f;Lqj
zTpi#>z;K;BKYI8$0=~m!IY{QgQQ$`T)1Qm}vKSCqN#^#G)33tL0^0s#DVsaAm9S%f
zxpg^>Dh3dKxBR^2h404*yEXQa`hIzzYD83Nt^h+MFj86?6ko5EFhYMoJC4!JlBnw~
zRa$ViCHZv`?f6oiI!GKN5er%A32NmCFijNrwDmX$pKy{VQqR_I$NU6BB2rBTC=(T>
zWfYfggutkAsNa@s8U4l0?p|MyU9=MVVt3w%uDkm?)98rv^4o**cOGCfha{@1mq_J!
zlPP~!n(25Q^|o_zowR=s3i%D$%!#v^lws`t+?o)EdF-m<zd;^bsN;U3-hv#Z+=#7R
z@N~SI(&URRU$XQb8A=U*YR;fpZiBLGy9y5iBnu$LEJ;oD`?WS+7-VE;c%+y?@Y5Nl
zT5=|~YsUF3->(@b_urry@9abcUdu${WH;LoT2gfs48gRPw8einPBt}M7z#T!57Ozf
zr{LjwL$)BLsyX%s5cpv+`f0fP@VEBJP~f&nWy^{g!Wo=4(*9Ns0pZ6spEcVCCSuQ#
z<n(xjZNA;62Ed>=i3C8O=s6I^6wPSk_CVEP)9S3$99$wyZqf+UIeoo3riOiDWF4F_
zyz8?Hj?lWD`B{H*b}Zf*o;9X5{}h_fD9u`u6&wxz;o{!t=_YaSWbh9Y_co)C7xy;T
z4;A-+c*p(!C~+Uf;)jcSMw`mkfl;-n5EC^>rz<ph3icO@u8<w7xe3}vfIU*1CMfU6
zE7`RwEBf>UarFE+A+yahlqR2b8EIr1+gNeJty2$5ZK;2NA5(#t`c3L#I>4=Hp&uP5
zg=iiNw~}D`6^@SC<cqEWi$rL4XE5jjvp~{xCnrBJveV=p+a%rnVK%GWx#(Z+>7$?Y
z*~!xyqDX&AY63MPq5iWZX_b)eg7Ov}YwThn4aSX$^u0o$U0+-vb2bn{FDM&xX+x;l
zwfr}T5gvcHfjb2KGpTC5(=X_Ai*CW)En{etk8jxGF8?HueByA=J~j#Lp&@LH)Nma@
znNOQ}Id1Y~D}P9fNSV?B!0N0=WHrwkLI$aVEcKOpsccDYLXu3QAtJOxDzr)GY(2MH
z#WYDI-68XO*?WCD;n>l?gbrtu<Pblxx{ed+?eTvc1%=~gTI@YJdA_fW7;j6%)^Oc&
z`%FXLw#HH~bmz{yhelbtuU`=OfH7&`Ii;T0s-w$;bP<pNSvb0NeUi12#r8TDT^Xr4
z+L&yM>3wA_!ZchXuMC7S1N^-Y)k~tVGvtf6NtH|YeH6rD=ZVrGz_i$X>A05@K|0-d
z%*=m%R8H&FwW2+^pL^qNu4yKAPHcT<w}%}o&}b3|=uoVlutoBlirC`C`ux0Cd^u$c
zjpx^NRLC8ajX}x;=@KNz__h2RBy9Nq90&03ckX;wot+>)#`X+xs|=oCW9o536E$xG
z6W>HmU<fToPqBxVRWK!~SXOT}EG;SFWJ-S@a*no;%V+qQhuuSb61g9~=%`H&a3_eH
z$L%#<x9w%14fns|>E2c*(#yC=um`I*;D!l5CYiKV`V;L1&Bl~wecGLXbzEA1aTzvw
zij5}wR-Ufq2PtbeM7fN`e|a6#+JxD(8~h?YI`d0VeY?>D04xO__hes_rOiX+jOTwO
zmB78i@n#5qpb!i81$5z0Xsi)G8jUU4lLGVb6G!x_@#WUDpSG$qd#mt@s!x&KZnh1R
zVQv^bS-h4JEH76~jK63O=K+kK8e|rJ5%g55Zf_R?7@;6*JPeEv(8`IHO`tW@{#+s(
zc?u}7;*^jSC#($nR7|>*&wD#%v9f=)8?ZHQmuQz4<ggkOC!CXDIY`jXB$YylB&+XY
zeGf;C0i90VCshm*_RuSm&(tnoFnxl7Gf@jC=y%q!Smvw!KbF-ca$erV(#j0q&X-=A
zQO0f5wa*`dS;}N+`3^ZdGIIlR^ATus(jD#E?j$B}w$@~oE$s?HoWjh3I$(b#O!Q3y
zF#+}Q+KWZ%iW72!#6eL&Nu<N1MT4i>e*Bqe{n;$xCK)sRRi$;?NyJ4i-eM7~GZ(Jt
z{raY+lgmchK*-tB)AFJM^!7ML6o4iyj{89E33`${?z8Z>&-x~Hw|X0veV8Vwsixa`
zUR7OyQS~D)4it|czKYCw3nqVA<_48#qm+>p`c^6oD0xRH94dZZoCvDvY{Gww59|;1
zOo6#j$S+G@oQ7Xxyb~Mzrk)L&<;B6iLO{>ED`ex`v?^hMh)lL?ciS2q%gmz;`%i7%
z{l3D<`tXx53+Jnv3|Gy;Yke|&a%{_uZ;~OY+L^!%3=Wq3YUy1LeC~g8cfQo|B{qej
zyiF2UI?p2g;?#z*`Ro046Z_!;_H?o&+F>>w_lIXFdAVTMzDd&g$Uh5rji*R!XGe0j
z=#Ye-?-ZG2B@O09;?IGA0?l1CCm#N@u(y{0EMU%ue1)OO(!Y7Ze&|#3R4r-<nv(hz
zpHC}zQ|8{xI>lkHTkn6fm8jgm3Fog0iubY-{2gY91(~pJW2duU3@s@QbeSg7SbaW9
z@2gfMmlWPw-wBkIpRx^-1$=G+X`?TH?c=H&ICe%^>7G?@-ip?S+#@~rl6yGPQP{^C
zrKu)@vus8`J7K&sxl_mTJNxlYj{22l;Rq$xEwT}BS#C~0{>p#5pU2${cO`o(SEUCA
zu4p$5{QA&0F<gi{DjXzPyr8-^X&*kqb#zHR0X`9`@7H!ZC1fSJ2~8X}h2Ki>g)}-v
zfcFO3-8?sCdu<)E^tiYwAokAbBjy_BOjhy_IjNvUk#(cV$D&!lR)8WE82=KOi*k^_
z3&8`W2`4<gnh$?D*v3AsYnytE+(YCixhzh#W2f3~tLyhc?<$z3OrX6~a~0*(X46#j
zt$J(PUvQA|HUTqvFK@fJ?C>>t?l#eG(jOCiEmF#R57N$#GGkx4Q{~h8#1@7roL)av
zPP`c2z2Zf$_!j)_PvOh|Wj(C}r+TqI3o6(NEN)qi=gogrwdCKnSOX-6S>eI7J7sWZ
zZ<%T&^{A7*8pimJz+O^c2ik1I7F2KRGc>}GeyJMgYSDB4b)aLbP!KF&`iauD;my*Q
zWkNv3<H&#gJ`}@Cz(a_j>g!Pm6nvVqtamTufj$?8%GsD#51vt34NDVyB3Wn(Gzkz3
zX9Jy%&G>(YHkpqCfm>esFNO++l68qskF@XuerPZDP0U5$c{5&9NI|HWlPH~)E4%+Y
zHT*wGYPkDA0GXU-2!GJP$vAV>aQ+@C$IzKSOpL2EG$wCcn!R~zpb(})K6aofm+Vtr
z7C~iMSK9Vfy0VD>@n+4CO>5fMDRgV0$aWdaq0fJPx{d2}T}YWie@jwX63fsE!Xgq4
z?I__(<WjFt0SfGmz98%7mSw7R8$7dv$grGRC&%y?u}g|Q0Y;|&x*|*;t_G#DuWmxc
zx0TfYvJFDjrzjYSq6sMkt+;u}GCl9je4EVLcP`J$o8yCL;aMaaz|kd5mg9prrAxSA
zQ*3_~GNV2n5J4O-o50J0$mq_JZJMO<sC79Luo>WK6p!Jgz;=t7Dp7siLct1><J3k(
zPa%%jKut<qbzP~DC)_<*d#eY+<o2q;#lX{g3__Y2q@%hSs5pUbH{k0ACRXJUv@6<r
zn{d8?p>(|OJ~^5r0qipqj%681>&z`$4C{XZQtNEXvuT1niTHWMB><#QYAKF4&I2L!
zOqhAST^Qw==mBLRAa7bm^7#E_B;i@Do0lwfr&u^<wi9i5<iz9~735dP%1KHs<Iq1h
zjs_8-ViJF;5P?eU*D-N|NfgE!|NX!Jzrm`b=0PWR;px`ru~sJLifi^M^mT7Bu9$yy
zTe2fG4U7E?!oS&mO}vsRE~pY|5`oMjj*lJgkeHWJV0T6?0Vr>HzYKZ2j7KAW>joHW
zqBwsr;l0~G(4|3vO$vn9C~~=iENkwoC(I~rm3cC-!!a`tonx9x8a$8Lir#6{%QxWQ
zq`p*n1!m5O5;4Hoo(~cI0b1{Ivw44M{TED2W9oetQ>S0GzL*OO@{ROje}nYQd(&eW
zX;5#L4;_$gFKN{!QFhVb!-ROKH(`aMmGR-&LKtWRVf03LQQQr~2<hzko%ikygJC?x
zg{}j`04K-NW*lQ|M^VlZr0)&87}EJf&=z^sud_(6LZ%)aC(+c8^VNyVWsQI6vbO9t
zhLa_v98Cej5JZ~NtlCJ-`;Oi@j79rM+`?^AakO{(hkRKakMl;;M%S^g5A?_Ncmi((
zRagm_a|3U(jCe~wEHe6Y*2%Gw{5F1gf=t0EVFahRfpWDg-4-8?>kR36HUMEZdN(~1
z*|=ead~FOEt(;7j76c`ufOLNkDq%-072gSVI7)*GATY^tPwUr}H(jBF=tJACgvGTw
z?QOZuTZ*{%MRPf2tWnIx8{T+#$a{u%PhL&7Me~I>|0;f!D4bj?hRq6ZN5}|Jg9nvu
zeFyDGH-sDSfC4}_q#j&Nr-5nz_25o%QeMY|;ESeF6i))fE$T%@_vn8=7k3W6XWz;o
z!_&UT+Vw!gQSP={OxIygwp#9biR|UelGtg}8|m1W?@aI9N6X}ro(cG1g63dqZDO9t
zQbpk(CZ<4*6qrFv?Nhi)yqTIUG*>V8wk32zwiEBZ7MN@Bk&3e*3>;Lg$TGHU|NGE7
z&m9Ie!@5Uwkd^KDRBeCY?2foS5h3FG<Ort%x7{p1t;@tMdwgGdYoqE)_m>mmC&L5?
z`n#xZsVb<tV5v8Fh3=wUx8BV>=KTUtU|QJSBIA-m<HsLZek!=|St;?h0^+n_^#%IT
zADjdUxvKW_qU%@3Ev>C}OP|@P8$~_Ml59UBt9^q>cohDFD>Z+%3qeh%KAkofVm{BR
zuutQU>au=IEOvb|tjgoZ+;Q<5B$`oHf14dMjpm><p0)9n8+lER)O<dzgzL*(cJ?An
zwc%m*+n@?`DmP?vF9}+!+1c%y{GV)Z+^|-?M1lQr+obL`>n;!zv=XmlYV_7w25eid
z#~SRJ(e|}3-=Tk&S+)dpjU=p~7|G!cvi{!PS)0slKXtO>YZ2tS|BI*Q`~YMqVgk(a
z4s)J*w*0se$@}?F2N^TRI#?QzAVE<PhL66K{6wD^8ARMl#yQ)jS7f~z%HlMPJ#V4?
zhb1|Bo~RWYB`Jt>l#7}*tG5t-fVL2KlXahPQ$ZjLULb!y;oc1LpV5hC-HP)yyeA3f
z#R%SMRMTVB?7=Yp+5rHVRV9I6p{=CRzw)AlA65f<vqiOHdZ3^P&vDn3vE^hnU^pTX
zYP!0X-G(h!M%T48z(DPOBrMsiZCv5=q2Hy4Fq``3yC1yOw^~0ea`sLqjj~8LOSyls
zXr}e}TCIPGF)&Ki9|Y2*gq&HA#b8}hA+uBgTnIlyIG#0cm{!gJCWnf)^?FW4G2Y!+
zhxVY}K7O3Eq~9MDD18EoeA2l7v53yB44<Gc&+QWe;U=RDa$_rKYvn>pNR(5=Fq>Ci
zaNgxgQO--oG|KsFDb+$iH3`$rISt7i3Y_WN@acclY3}{1SKPmQ|Fho4nL{)9Daz6?
zRPtrE2YYP39L%mO!9wuxkVYxDo7$rA4E3(e&7;5F_PRU`WxBF$YDxH}X^kaV&nKI{
z%8uWa`-)FcQ|k?i)}WH9-<GW!&XDr;MtNbn52g6LgR!u#CD_$W*Z#^F)i{hzU9o`k
z+tGhrw@V1!T`h+_M@kV<FJaiL-)1wD(qmhqs!mZ?e_gzuLxGEF&Zo3ef-Ub8Vf*?Z
z-dw}AN6*XfNp-1K<enO-J&h0c44(c`H>$NQJ|vDR5WFK+Nq)K7Rk~EKj(a2|I-}e<
zDr+q6Rcic6XvkbS&GMq0Ywd}IozvMHzRZ7RQ#0!!=DMQ)*{oz+L5R?+xj<*DlYti2
zA!?;i1O!OZVA~M3i2(JBb!uegL_|LZSFTG%tsfjoB!lmEZK;}xhhN?*L{WO98nMFj
zq!9-bMH!naYCYSBT(nD&PnrsA99!3Zdz_$`B4I*wooQQd04XnZMbk=^Xz!D$xPE`|
z2{}HCD(rA4#iujqcWMY;;s27~#^ch8X-+Fpy4(~e(fcsd)o<6{_#oT$?2xDDo4o-+
zi+-+?YLJzp0jKGW9dlkpr1WNpxe=P75?1ordL?F~$uLMQnrpS>;IwOEKw#_|FKSyY
z>X+|F#|E4X(9TSg@u298mrbkgiEn>3xME)*m71-<;mOH_`P&Ecm|I1X7-rK#GaIOQ
zs$LQl<iMJQcLgn);ahIWTrfSo!Z8ah73zBRqGWb8#L2pI$D1OdY^o|}?VUT?BM5Sw
zr5or?##Bxm%X(I?G_p~N6GYJ8OL`6$$O>TpBahh+Ksu^2E6rhX+iI#b1`>Z60I`Dp
z+rR{d|7XzZf|&r{^6+U;eus{n)^)y%yM;{^gj^O(oCphEPYhy3@IM@J{-RO;X0Sim
z9@t0qP0|Dzbj-a;p!w3edpl<ILg$$SQ_-=K2boW$P3S=uRRLL*Ke!tzT)J~dIMLe#
zs*w&C=?-+~&Y%!AnonePqlkZ+rr=%L54mGv4vHs1&+C~in`UNBE0LP%q)+=nboeHW
z0PPt}j^2&3&BgMRS&wJa@-IAjVfcJ|PhVEZQz)lF#ZrnmSm{su!(O=Is9s_@lk27Y
zBA1^d#0GeqEu2g)@xDjp1vFSb@(ohWtL=|~`Q5sd8}^4NOnKT!6GMNbU<R#B-p#MK
zsatcXKu*&MgGZ7*-X^90RBhqK>J?|@YBjC;Nt&SOggE?`jzxFX%G+bp{Z*bpd@06b
z9`vPaM%sa#)yqjRh^y-gR)<yH_JDpPYR1$t;~pJ--FmpY7wB+lr@0B|y}5uc5lCbL
zQbj0d8V(67pTv(9PM3ew5m}1l88wC6rk1{^IBtoA5HF%Mmy7s4K}Ij?B&NL<P7@}6
zwv-kwl*U2(3|h~^v>X1`Eb2Mf78g`w!C_=mVHB>Xo6KT|A-wa_Oscagkb}If>&K;d
z);75p4VLCS7g3E)R3!DhI<Hq+{EqMM@+ncbq+tWoy=%cu7{7lOby7OZhcS4J8Ly)%
z3;(AK0eK@)r)6<@9o{_=t}QG*yqNd4)Np`16^!DA=C8HQ`HIpzjwFoG3Lg@bKZ!XX
z!~~y%ubYGC-#kA+{>#COFtLM&x1?Om9A(x|$G{)h@CC|!H9faBndtoo*v+uor8LA;
zOlew4L2yDVV5)z1YCY4p7!HBtN?lc*+}zYUUUkT>r?fIR^{qI)_s9L7>j*ubL-FBW
zAE3BI|1H`2*OdFs8{1*&u$tcD3UZ>!`TjGAXn2TzbYf}AseeSjY`KctoN@Pte%r8Y
z=|{}mc~;_%K*be$NVSDBNbq`NUVC-|N~<c8B}wZz{?vb*If_}m%(Cb#R~hY<=yOtX
z)v@*sD69<R$apcrid|;3tfXXzh20O2A8AJ%c+atB3P*MFuTKOB?2;NG1__j0SqTNz
zwK5hYTIqu=5`Zbu&z5Q>PX$+puqo%)+9+o|TbM$L(u;5^SAFDIulfY_@0{D7az9<^
z>MeFgeeZvPli*0bVJZRg3Seag0*oa?<0Z=C_h!ty3p2S~uVDTJ`zu&SFgDo|j8@)0
zmx*~M%SwaJdB-ou*hCLDZ^P^jMJGv+IQm*pk~U-a^YOJcbhRLkj5Y>wjI|GZ(vq{9
zwz72=1dg$Db=g2C**jgrbz5aF_|Jy=BO2uNvZ#Mlm8Na{QqwkKK&o2mBkj5c1s=3P
zzAVzQKOgcZy{-JHFhF=<47Q><k;(1%hgG?pUJu(K3w7vvj^Y|We_NC4el^s<MC#Gj
zpZbu{eLgGwTG>6K1Te@l30d~s+|}Ivn4Tw&4w0KU-ASAH2+iGq@vO44E^Wk0rN1zR
zDj9z_@vF+UK^f%GWyO*iZJ3R}`+C{20yUre;2ioeJ$chsT(GL*^(|7@kBzzZ)6d}h
z#Zy?r4u3YU1VGa|8eOR%3}?wEZev=<EV1eg$3YW2w9~R!6sm`T^{QIzRqy$7O6zTF
zxJFZbB|RD&6DS^g6wGNU`LHrjysf8wyYzn#=at@djnMk(hNpFY7JN9B0Xv;xKPIb!
zc|Nh#n`Y}Uz<72o|5fqK<^YxeLx0s(b!MIKJ}O=avNo+)Htpom?{j6f2haFi%_Uzx
z36e?Hrbrw-NTq^gAit$5unAPRUq$x`B)>(up?tbRU9uEKGTA}g&EXDhh`fRQV{?Bd
z{e;(VAY&0e)65kFhcUM|3;}OIV_7pso=iexfzGMfn>{4&Eumv3i-`KZK(gb@6js?R
z!6>1FUOX$q2W`u?|GJTi=$nWRDzZ45lDsg%AeuLG3Ij<QB*l2nb}Wqm#3a3)e7-EQ
z#+;%*Ni|i_NiW=Y+EEt=?DTu@kB5JmTJ73zxhaYhi0LwUon)Ua-#~xd`>HHY_PcV}
z<();o%H>%dNNahWYQBlet4c6cUR8fp^BoYGj*kY~dQ#5LCMA~X>xa(^Y3XefYbiaI
z0g2a{hflAn0>Y9Ru>vMm+#!9sVKB(iFOHtQlq9k^#SN_r%C$$_cmN_!$eVv(g@r?C
zvWif(^=!5#U-$ZlG^K&|1W@w%TB{DRZrrY3AON$LCdrBa6Cvd38&S+xqSG{K`vuK}
zeN!)q)W+Tm9x!Dqgn9kvb>%mtp;ECiAWA$*O^7qTOVOv4=(MMxv#=EYOUq6pOw_@-
zr6nyZ5u@hHD!yj&xR&5SG8lh$%Q9?X3cexxz6cU#-ekrMVwQ;M8DbxvlL5zCr5bd#
zunrC;Mh__6ZsJWrb7ffoM7JaVs#~{l$k;?9RUN+*IG`^M(!GO<rf#4lnK_ohYy(Ww
z2I-}{1!FRfx&jntqJACZCjg(MVJP2?mYIZ!p>HK<?Twt{#zEQ-{P2IX0XxkOwf<@C
zHO#BDDKHzT>x$@Q@0x?S+A4|VZzJYX+d=r5i0}hkPQ@T-q%*eBj=aaRj!qt!tdeMo
zmp;`RYTOJ*rU6I!sG7S;_`06iy|GRq$^XaAcX_-n0q2H<y>;t8AJ^F(h5%4qOKD*_
zjcqiD4{Q7)EX#62i3)#D#k5Kyc4n|AeP;3&T#7|Lqp1-@ZEM`V-P!qC8$2<5xlCgW
zkhoN~)UB==dtuS$Y;s&C15!FKwRx)f+XAa^q-Gu->&!V}_P+VR=^)j97wa|;?`a~e
z$A{>R((uHcJA4};X;L3|?h-aR?HhFGj(fzI*hcM>!9a1$)C7NE!ocFMQrEQdbPF}H
zLCw-!wOk$QLG{WtS~|zXE;IeVFwZzOLD*MGpeY$TDYGPKo8#a385FOjpwc_n5vhzs
z28p3vDYA+B+cN;5Y&5s50R*>DeK4?iYmO|uY!xGS;Ypp5cE5upi|(e*D$#i_M-7lN
zB<rbo96hzPP2zu(n5@#B^#8*Gi#()PmOTgM{j(c3rsL#(QDKL-Ih>cgvOiQ?BhLjW
z(+J$~Ww`NA)e0_bbRY;!_HtPKtQewp_zYsLmDtF4S;$9%dEw{zujV^D;r~$W41y?`
zG2h+lTl<keLER+CM-nQ-I2wtw+K7J%Pn^UYLDkv1wOD@|EA}{v>yDztp~eQxQEvA0
z(_w5-j)c(Dt&@=IlsKq=3X@UFWVD6z)vobrF=u8V=Ry%WmnBz-69Q7ZKL=lkN{#XK
z?ssN019;C{ZsOE5(pGyal^Rq)u&GAe>AEk0Dl_S0O8lFaUy+ukdoUziu&RLP!7`nM
zvp?I}@qd5byxX0PE%r)FCl`BSTAxv=?Vgjm4I(LyuTEVIs1{~2DDn!HvD{p+O21k!
zaUVptZT_dMA--56IXgQsrsKul^1~nqz613*%qs*WD=6z?2yS6Qg*If+p0ZTBk#>XK
zzMa%ol#+4+l-geOwDr&7e3`&A-5FNB>l8{~H(7u2b{QiRX-=Gdoc*Z0ILv1n2I;#%
zcO4)xCp{4mOW2Ct2;&EhqxB@Q*IHjw`iQc1RY_<*Y(}86CUFXC;S6}^RauMfr@Rpe
zo(i8gNkTqSxouxi$6O#y22seoMNs1Uz;C*yznSC!d1`1dX+%HCvd9e+3OatxhUuH9
z30Z$Z{2=W^bhd0thAI*tre}7P+w-V<Y($gfd_Wq;%9ubfKi>-1Wt9n{QS0j5ZnX~#
zYlmX|N=e+nT5d)=3FM8f7g-Nxaxo`12eax$pMYQyidK5QNABf$S_!0yBmgM_8~fMa
zTq=7d+P0FlQ*oZ6?@6MLM?fM??I5h#7NUP9)splOdj@C8-j2+$OYSm^pJ~`eP@dw$
zwBmvY{|*Nb>T|1L5zHv7#*G#OTVtkkNrR1K<<6Fy=#ds1GbNC7w4F3Rfc}zFJC9t3
z7oFAfO#G4LEO-|^6rP*wsYw@97HZZ7(p#{?fr$Pwb1pl;jb}GyAH?{m=Rj;otki#z
z1bIa>M)x^hv)suWaD?{F|7dXaSk_GH8O^)2vj<a&DJI5oGDdnenNBO}(PkQT;yqtA
zlk(a#oUr`aVwExfNQqyPT7B#GRxmwR9VmsXOLsg+CnTbYGuV8HcSrkSf5#j$Wj&*d
zAFdN2=U}*^@xWdZsO&MwHb)l#F+G30tT0K%Nzr&Dxp`ZTRa}L$YK-CtmiXPd^Dv`(
zqcq@5zM8Y9DM@1%l6O|1)LGL15+<I|bFj<kp-yG}ey`X9`~vUKc?}RHBXZW1v>(tg
zt(U}A-&r2q%e#!Ve}@7OuI1CMf(mPS@<9S*FE;M|UlDTS`8Ur$1<c~d2J3%->-Q7q
z@$l9sKKNq+gzO9F(&|w24+BDVrkT7X)T84*6ZrCWp&-=bD6vrFIt~Z^6UtjzQ137m
zR$8W&0;gX;f7$=6$!du|Zum~ItSH)Ejw?rz+WXe54SePguMfs<KRGTm_xoKX&ApGS
zXx6f=X}9+JW1@rIdc`|;lG=YN1l`~{xU3ggiibdqM%o25%4WTCizH?I$ftR4iA?f9
zIv2^#g@^<8Qzks4NtFiwIN|6v?K5|t$j2LX`BHWJXgz-YBnbUf+-$2wyf^e5lNEyh
zaDN_5!o$<>u;&c0;1RB#K%C_?e(NuXK}5~lp{5HaIRKV(-M44^@+^OI7J`)liN3u+
z_p|%M<c19@$d%I5Su@A#ZXfFNp<W&?%67$azVkI!X&BhRhNya$I0uM3Lr`+&PM;<U
z#a2){|J<OawEmZEbOaqgt)lDOb}aFIr<RqNLobM1qp4VxfOhP`K<|hD^Z9<KC@Hsv
zsyEQ2CiIOfOfiDvS51F$9dx)>wVlAyjw6kb6NH}#GxG3bSzX-rvIa=1W`B@FvCt<)
zN83OV>G92?@YK^A$m1Q1PzXekttWte%y{C*4aT*31j{aE99*6s?`*{kNBoqPP4F#`
zzRW~IsycF@$(iKp(8VPr0?fA59?gx&ZENt$As!gI0ei5q3ORrJ2G;-@f%UvOdG!07
z6W<?d>#l=kxK01iEsEP?@@8WdKStu@U;e`+M1sPVvs*u^{Pc%EDmQfV<ws&=KQe!9
ztMPhCQ_H#4Cls{rcLlCW*`V01J7BRHr^AF$oE8PG_OK0B#Yc)<I96y{xTN>wQFuUi
zcD|928~g=`_tJmDA4@rueCL)g&nsZz7`Teo_BydJ#R!e1AB<pG;s684imjQ}16@fT
z_oT5psI>4zV_ZcQ{%=(IG;jmw6V&GL%&TKmNldLP6`hk>dB<w$atepS7LeUK#TD_y
zBk=+twF0u_&K*dTvl>=6w)EbBIh--?D8{rbHBTH{=Td(rtlxl{-yc}Y{+xlwwmjFi
zSC=9>nUtx$f#X7!XIgmWt}m`mUTAzYzrHH3y(R$3*uV_-rgh^$PApx{3!<dh<h;Os
zv$MGcl#z(g4pBj1<#Q6RonLF`T>9~ejUJoy>?~xBBN%bP#0UQMU(y=2w9A1cGk;QD
zn?1S#UTuFF(pliv-3A#*l~<d*2i{d**1@LIr%^b&iScW*Fh_EP-0Vb<dH3U&Pqe6-
z&Ihf)U_{bNky&izJv5{OnA=5HQi@ramS)~}@G5WXQogN4IZ82}<#-7cK#uoJsAat(
z&`x<p6jR%8CF$<rcKpbDUuybnxWh7O`TOGya07oCYdWEQi~Bw7(brpaWV>a52aRD)
zzckiZ+`1Q@a!%R5w|T?;?1uZC$+I&Aq0+qnR8ZY&(#xDdyqp7F0l__05Z{3veUjM8
z;%K_1rZeAwp8`#7q$lD~7$w%t!A44=(;U+g8Kt4F<eF$yz_bXvm!XRhy;<DKJU2aT
zPA`95lYBhM*>uOAWIf>2B{~^wzbt;xlUXRQsh2UlW%_NqUixFAJh9ZUgR7kq?9PsF
zLk?lxfrmx`P8Ueqnk}M+V8g|~39v1vR1+9cMm<(=#$MKYsa^G}^K&gQm1Y=YhNBW6
z{08igRu{I&en>EUHJ3$Z9+bE#E8|nBY)yZhR>rR$?krP0iBP0LVnHX^((uJbM&=m{
z+j<J2!+!}BKC~Nw*)XMdhd3G4%4>p%+I_p#V&MO!VZiNd5?o_m95DmGcyoVnw|G(q
zBe=a0(%qj83wiqC%xMc!s^qWcW$#Oad~Mff-oRy0Jf*bPKCI?@nODf3LKXq>K30FN
zR{40+t3bw9-NZO)3~4Ly5VIh3h5e#=wW$ieWtEln4SDy_)4sUi+ecDJi%o$Qw<80R
z`zqpc-UKSwre)}Z;!8?lD;V8Gkwj&=WFDSf7s)$&(o-|o%JuwpPdVYZS<@y%j#CrU
zxkXlg3eFs!dtdnu?wK|h7dH(2S+IYm!h#He0o559`foL-iCn^?nKzUBKw!IDd^Aw#
zJg^cORx&e_34b<Z0;az>sPVB|#RsoOko<jlvYPZ+2h|s?qOW&{pG~s$!zt~b1s$qy
zsi}N%cHVxVL+(@p@lu|?>BRVuN~C>ST~Y+kq<KZn3B)4a7%>%+^vzEI1cQH`|HEJh
zwI>V9uFI)5G1p+XoU0%}=an?>apnC3nL)}1q>tzA?hq;Wtz&<&hz_7oMN$@5x6X&j
z#m=h2dUAX5tP~9k@=>hV$X2@550)p-<aHU-lPdUk0OKY`NB7H63(3|J#7pj|y~XZO
za@k82KS|FCRHI!;`a{g;291ARlz*`VNynl<7{Jr<F~)Egd`V}qMT21wD8^lLROM9l
zNhE8ULi3^KnE$xlF55DsNP=4_htEKrAzG7b?};t1;_kBszirYFMWPAxXNApl#J2z4
zQ{g{LPldq%m`ksyAL5`V1yW23Rru_lr8<`x61SxpYHDGo>w21{6Zn67bXDd|NSVT_
zIE_UtWRe>ur9pOULageF#ORhlYvP{#G*2cI<~Bc5v7fBsN`clL6x&i<IxNsz!wUX;
z!VneR0$U)dKIl&1^&Z36IL^SEhQ%yQGEA-)5x?;L^T5n64Ea03RhPs{;Y6Fj<R1h`
zo-p3*;r}?!>*W;WUC@6MYxHehCTTWKLT#tK{MB*$iFmP5b&e8m3QbrHtWy|>+X62S
zhRn^LufV3!>Ny)&tS%W*Ut(CTn&6LXy-16%faCZT=c0svYSbjn1HwlhFx~N^q9R1Z
zl)y?-hBhc}T405;{K44-%!5Wnb42$~LB~yM$l~Lx40JgfGp&ExG9*Pfk*K=L0Q+7H
z=7nZj6D`bcQnwB`rKw43{~HFxgoxZh+dwMspg5XKnTe;y)k(YDzYFk$d1l%|Ahg2w
zo?dmo{^L<K21y4T6dg&eqI#hcPw~gT;i??#+V}5CTgi`j$!;3z_DT#Xvd_vU^!_Ya
zG&W?Q0`?=T1CoE7^7qkQ6jL$5#{zFjv)7rptc~NX4Wv}!NV#EmAw>?FqP%C^<Hl<5
z#GlIY*;T{>XV&t;`wPDT!#Ns_WDR%t#)X+1GsyuY0650m+4(R0PuSUFc0FVs#t^^k
z&Dx7FP!awIM5NW;`R+GWcww*jYq;_~=p%cwtpH`)eKda?a&SK9rSK#s;O`9o-i!CA
z1MR+CA~B(yhu4KK+VRv?mKfT)i>47Bt{-~<k@TpB)Rv{YlJr$sxPSDL>3Z>jvYzWQ
zy>FEQSGG7uv^3c`q||Ef#N{3Z8e*NbBxpPSx#WY3JAw{2@v{?MM7;O>)qDYQFncY)
zKT{xviza{Z|9K0SFdx)~viSF-&xPp~P#iZ-$5Fh<D8yd$0%{;CchwOKoS&V{bjA|Y
zu@&;23#gWYMCrGCuo8d{R-qCjaKsQ0;PB0MM4QWJd(qo)f2RQw+nHW$@25lcy#Bl}
z9~ZP56s!6>($dU5{rY9<>D?z{!sC>^k+r#hD!zaAO<h`@Vy+hkT6|w@?SCV!|0h6N
zw^Q)Hq1Jy4sP(U!9CC@}%Cy&Nc4p@(0)Xp^9gi(QzBLFS>BhF(y>5I`vUB8go}L>R
zXXfDVScN@Hv?xtAQ`+i8qr-R5x)-ZyOm!!Z13~{!<K1Ep6}x{YqjR_S!NNiH!M^E(
ziMD@t3wB)pL7$dFzhutjhS=CxLkf?^fPxattUcHl;InssJ-B~&aR0&nhFA4{ZO7bq
zOvj$wdxMuXZ9Uevxgod9=%e^~!f$_GypY_j;)~)}gS)?OlisQy^w7P*y$9{aKHuNj
z8J>j6SbSxeay0D=tC$GQLIuvfd;ixj9g2VZuAsb-ohu#Gk{*VgF6S3g8uYN7j@JSr
z!)VrWyu!7>LG}U*zZ{g|&%Jto-&{X3)L`?;{IMIKV)2ZH-33KlbKk<G14Uh`LR3yB
zt>nUJSX=HI1l{b2Co-s?az_C?2`PY3+y$-)*Z}a3+h}l(^BGsuasl5ho*n#Sw)%hm
z-~smfC2~mVGY*`-KEFPsV}Jp9(M1vlm>`q}(XHjV+L@)aClHB93m<o`sstV_%QQsB
zhFaOIdQ|zZ2?u`bCYqKT_2S0aiK!2PdBJegNPhPNv<-|VbG#$-h7K-I28_Q8D@`Bl
zZB4rh%Oe^VDtph@Q`Un<fJ4J*IxK$}-6WUnrLPGuMaVAG$KkG${6mC*#edatc<z0)
zGA&3C2mgHeh5T!SGk(dRC8NhB7HXC>YA5(zpAy(h5W_?<OS%x9f)vIMs-UFyF^zxr
z)n(ktPID}yxKSy{Wm{D<L(bwmYVSWO2(EB<XbppaI5mPd=s?O~e!fbEVcmaeGSY?C
z^lTLE4<LAQXj~iPg6eZ*M#ZK|4>H^H){qdgS$c_9`<mU6l3MRaaN27d2}yQ{`Dokn
zZHV8ETra3-N5_)$g#&LrAcC<@)j#cSDK3p5LGeLu=$L}6&{R^doAmTc)A@UaJCeP@
z99}Ort?*zbd{J-JPt4o5atMFo7`aVRNL-q5Wa|h|bW=y0)0<n`Bt<G8*4^emylu>e
z0r3%iV`55?UCnf;_q38R^(pHm(|J}iZ@P(&+P~FYXxtYAN>CFs&A~CW1GDNZp_<>>
zG70-C;U!#)r1wYe4R92Q1ltB3;N)Gcva3^rL5gwUn~IT5TuK<kYs!B!<O2c2K%&ou
zK%odOhQ35IekCC|_l$>s5<*pZ7r{D~iy1uz(uxr61)KA8Z(tq4y9_K$aZ;5ImH7xv
z;mjg%>aCDQC;b?IWI1;NRX`5&_vjtZMNezB)1`lB#r8$RT<7Zs#I-Sd>y?uzGzvd>
zZG{O^twN|1JRrX4Nicu6nMyZVLU9zoM9{J4tk|#`+F+<ecYU|&RkUrQu&ONSePr*z
zX~lLb2I(LT8JVLW=t4<??FB&((qRy<npa~@`}fI#^eRawpHsGT6OTH}EQfq^wZlI(
zrjgi3@nP)WF}uxb%c#hf%vBFCW&vVorZ;5dt5XOEg(Beb%O`&-a}s4Y!yAvfgA5Ra
z@@+x(2m<9#%`(A++u7s>64<&}i$$P-N2%U`-HjS;rW0gekgKeIS`^s_^@<5)@Iawm
zgC0C}4W-$*=5|a9Bm`;fQ|cp@`eY|*Ixm%w;Wv9z?&yWEi-JCv-H{=Sv>Itwc&@n0
zjo_AqdmMX(d{}=FdgiTKa^-Z!dLKgQ8_)_~H<LykNUqM|HwH<oWG@KH@-!XJC);;n
zv{HFhuM9RRn8ebD0w>#Ygn_ac7AeNoewOAIv<VjJ3Wbe0s^<cO<$6>KDU@ncSuTPB
z$-O7vN%pdn<s{GE-c~4}_oH%mvq(U<HmMOvdRFDR!ODL=6XX+@avd6Af*bjdW}m~B
zXiy>+PV||emK;4l_K<JAob(Z1zs|J84vJC6iEGOeQ8*n-d65`Eglj~~qwq^j{m9D(
z{&%Us{~)CTU)AivuoXe(?@%+a^W)SED1wfhG3zaXT}c~kvDH~chv<qx^0S3_q7<-K
zPbe#Ke(ZlTgu}zbdVX%4KjHIC;RxD$wIXV^VXjNlt40zyrMX%d!XcXM<aTVWN%I$Q
z_zkQ<bPOn05t=w|k1nMYI_p&*5-TBfj@JCgkfgWtlTQ!a6mH|e##b9EF4JOwtE9Y?
z`TBjI#s(<m?uisU(i<Vmu}gP7ka^+YpNM><T4sMey0kMM7y~y`mpom)n>JMV_%LIU
z+}JH+gw3^$`GZQYu&$zCC-M-}jGLZG&6PD+I!^+M$8+-qdzi2%X(o2sT7}$A_<y1>
zTQ7jLWkB9Ctt0wl6=c{@ohc=4V6IVG>rpxsU-=WqQ%dmET#0!ny6MTkK1r08ZFl{>
z@^*iJ%#2piu&7@BFOdv9*ztIVH{?p-*-h_OnT!DKsTs(sF|ItHqO>MmgFm4X+>(Fu
zB*I?|HO{gz3CW5}UcO08r{)cSaUK+Pi3JlIN89E2dww~T>v{QvWJN&4VM%OY>cP{(
zyF9j84+t=CEiQ4vH7GjrDS;mBDl%h$1WkVg#kJK&VpFhR_e>n_NK8OFwdf>?&X5`6
zAD?yFW5W_AQG8$(k$OP$3`xamO^q3X<Sy$A(JeaguN{on!22}+rh`uknD0vK3$D-?
zFbq5ID{NoTh^a&LQnot()qJpXB*MWnUcVwrCIWW4;^&A2NzLp)6J3q*ndV?b+(Cas
z`sgl6Y=%^z8PdCZB)z*klPvj5O~UDKv3BSiWxNm3ciP6f8G>WH(nC0ro(W;2(I!Q+
zxf!Y<xc5#t<nAJpc3+B*DCokHDUk@dy=rhVC>DWph`qX4uQW8kRAd+?T&jQn@Bcpn
zV1>(uy8LJhe%Q{=qpDpX(N%jB#o2$zIm(nD)Qx3nLt~<uvmH^iVFhhE?HsqxK-D+1
z#1b~}@X4`eMtehPw#8<jBFiZjrSBm8=Sg`6X5pCrP^&FhN6fj8b5H#c{}X3=s`-8F
zEsPcAU<ZF#R|h(p&ti!y!#C?{*z(H8WQ<||&*%F$bW=St6Y+NvDuqoVte<~z()UMY
zVK~9{IBG!Ny;6NoZvbwR0D`~Ef#BB3rYpfO!I!YLx;w``e_z?Q+i&t^WmNaYAbY?0
z#eie5s4>$DV7c&;x7rtZ`C2&r?vX0^yITzn0gP9oN}19miD{d$9L>~(ua)BC`p^}Q
z+VaK<$4j!r&*p5QBCQ@K>&kzO_XJ``x;Bdz9!~Sm+{^7K%O?D1vBbNrQk|WJI%`?i
zs`aqjYFXQFy&a3JvSEccHCLymzmnaD;=py9s<@?j#VH(TQ??sFPo9gRfY0ch&Vug4
zR+LFp>d8fYY^ckx!EU&*gqKDGlfDK+>!H{l>^yDc_5KslekG#~XDfegvjrd@-}g62
zD0~xCl}VOgscxyTQPgCo?5*PX(`F@Eg{=A<VgOA*vcKzW<a6dd8ztLqqmg6HoCg|@
zSoT9_@X&r)6KrV=A6`FBR{hbc*v_dkGIg47d*3g^zo*mktl5CryQo+F#NZ9Xwc${r
zjrR09Mw!jUs`lckyBRlu<QCF@dNkNh)LM2<QF0&Uk%2dNN$mlssc*OS*_%eyrwf4&
zTU~oG^!tfZF6uL$=_qLdr=F<sDQO%a8)<7X$*Zcb%4<m+m-q~ngv8yG24}RXLEh;`
zoTw>(<y!L<IQk0HA}!6Vs!yBqZWRW#myC(ywhKk|Cb}&|SprV>Bxsv|(!xeKozD;M
zmauwBtmI*eX7=GBlVq_GE$NK%jP0}O$wHrX^Z%P0+>Id@N`H6U={%xg9+Q%Vn<+L$
zr!FB)4Y7Op>o=N}{4<BI(AD%}w7$1u%N`V$$hM0xOBE#$tmh;*$6afucA#FCR$#^6
z8E}_Rf@SmpFU=|i^H<7$rSy$Am3r$N)7?ql_~nO3XL}#29t%B4Dhz-4aO6#(T*@;t
z_u|Al&t&A4fA~#QCSU#}jmx{yxi_sY%JH=Z@3+M6+4+t4NGKc_hr;UE(-2<YYW`yw
z9fJLr?0R<iw(tJ7`KC+quG6XlIVRWqtb;g{li|<enn40TH?u>3+9-HOxX8kem^Q1~
zcAvz;4oVC$^dUCJ%>ESo0zu>nvpq?IS4kJU6v0<NXs~UdWi@M7l{SJ=BukN8+6A$U
zg`O1PehipTD#pqDI%~)s#s?4?6;O2gh@~ES(9AUwc5yxT96{^9ZBFSoDpdGdrX)rt
zI$fj5JcD~dF%X4+cm_iuDMaj9RL;KFKM3lTXd_<vq$xS|+*ZU=Dba<bx<pCBd9W|8
zg5h926HxjL_fIw1{6si>ps6wnPP>GC``Xq&$h4n9o;G`WmcR_Z7sVBI3L9H0kVG__
z?iHsGrNvM2YF@8WqM-SkJWH2jLQ9Vy7kl+N{XK3GYr7zS5rB6GpBL%i7(fozyB-~E
zr{>QP*Jl9Xe6t5|<h;RfLxBWS6JiKQOsCP)XOA9#A;XTywcwl~UCJeX?Fd!kohM7%
zBBMO%L~r?x*d^`q$FPKTG7E(C&C8e1J5OnNi*a^5S*({+`w%1B9cg>mUYZStWnw!2
zS4@p00onq8NvnWn-iKEcraN>mot`A>>KqSrc*(cUj#l?bNwmwd*o?5#&WAtFmxeET
z<%guLS9J8pmuNkizs65Uy7clnn2x}E`AxCSsj5*(R)96`sWM*6&Xdo_>F7fj0(10%
zafE4VzeH^b+^ky!{gX6moF++XobvVM+gf^CW>fWlZ)2A<K8BOe;D21ZMbPKN+U$Jm
z(6;#@_U4}w2a#%WWhxqq2%|iy=j*qkSXx5X(E>?^(*DMB<G35krfvJ!ZgvjhG17j*
zG4`-pNe5b#G9X9;cZ~3-ue3){cxp+{dRrw?@-SO&B04zFudQ9D$pV>7R_>QUH7)tB
zviQ?~dWII;-~h1DPfot+Y2c(27pj)cS~arLjtW>-%q%$_-D=y*ksj(m3dTz#82IPI
zaL3RYO{y*AvKMbC^;294g5+9A@cOb6Xkc%8YR+NNI{wuIVLLltH%5}*>DbUIioFAU
z)xI{(UL!Wd-l`JE4<i)2KQF$8K9)>vmpOrd6YKaEzVRTaY{OKQK-@Vfd`IVC3LHpU
zr6EfPkjK&ldQr`pNt}MS)<|H`EdzdKg&E@b^Nb!xt9?^W*OlPa%BWwX(BM!IoUI2h
zMFXmxajkO#yp*V!C+(1B#d_kS&}QFrl&MT(d*OMbbEl_%&1&h%^}L)Zq>B6K<%N8I
zIqI5TmKSZDVCf#MRe6yl&SV0U%QvM)A7;Wls6eE**&P)PiZ8nDoUQF+;NZ=qa_#nC
zzIz#-4<-egA+!+!TI+O~`M`G}8NAe6r9RRtrZ`QC(#eEnhn6leN3kP|ns7L;a!D#e
zK!cjwHZmOBSYaY{|2t8Z?i_vn_}iC%!<Wx~|M=T4c7H1qE6>6K{@w1*mq#a$hsWQ(
zeEj0uqbI{xFP?-u$Rk~51aT4WV>N!@zTmvbKEfJ6v>bnX{Bn5m@Wt`-m)SJpG{-dF
zRwi;Z>yKrmiuMhjL`0%w52T)246Re{x2X0V7V#?p;Ao%Hp)t%Z$_~>SkfgGIoLQ7%
z<Fkty+Y&TObU;VivpGeu7CQAraQY5;MQJ*BQ5aenVid@boUD#rHEi6dokqjysHJ_}
z6f9ICYa>`B!62Dk_Z^<fUNU%l{g=_ckuWpQEtnTZ<Tv3{G$qu^YP?rjeJ-v{_caAA
z^9@3Rs?sO)IIG`UTVxbA%IRf)P#|Rh(gfS#14#YW1zofNgL{W-J>vm#Smju{F2Un5
zf~R1_myKd2`l#3oJIQPPpE`Ed#%<ZP+B8T1t#IeYq&hEAY>Zd#`+Oa7D=C2wnu*3H
z&67Y0&{YL)i)_swY}wV-Y#GPVLP9^ZLezT)(SrR-?`hX(d{*}fs*jX^e3jU}di9fH
zlWovgN%_~xBiw@7ujef4SwvPXFD}w-PZ{8L%Vn{st*~X;9JbBNt=^XzUo(|WY8C{?
zp>dSA16klzirvAQQd<IrhE-7@J*k;b^12e+Q5t|UDV5UORsu%EB%P@zXsC8cKn9Rk
zxZ3|I{&^by&$r?1{BdM|-4*4wNG<h5Z%>E{q$<i%nH;T5;>fG5$M41rZhV<=JAR=w
zCpb;Nh`jH{n!sCnYd_qozLcXRu?$*lDuFviWdsj#XMR+alK^n8Z~5cY5dfKyGddqt
z6l_I3sNOD!`M0Q1u6o%7)!h!HNPR*dgFZ$F;ilZ-a-fHuSFR3!e(NjuyY7APH{d<?
z4%kd)yoiSA>=@^xT%&AxrQjFp@^xu%Y1KS?SEgZ%5}7*61z*imqS+f!X^_soayb6w
z<k`2ychy<(l9$BcAp*Ybi1tKmQBix@J*C~>NEkcFf#9Lh(q)~tsg0)AL-X>M2p_{5
ziX)4Bi$ttDa3@xOiYm64bg&aIPX~r-P&^}`b*fP3S*ZEZl6ISlf_=k7xwhtCP%h7E
zRY>^>Shiq`DpgL5I*n?4B}C=v=!nWrGZ;2bidh1&aY}wH#FYntXsVTCRW7tPlX%Zk
zcPZy3vb}IFYw3kVKUAstCSAW0*=Nh;4O0;lSaMqy>~%tak&*EMFkTC1@@a;y$%D*Y
zXKTLAUY>UiW)tOGxXHl97SFjUPJHXVyLaz)z9mI@F)p%^Xc%r@UMH<woO319qWdBB
z1lRJWPxS)VLwo!d>TK<g@K5r{*03Czx~pXao>L#6NE0E<+ZeGXV;|Oc#ZaUQ(IE)t
zNhybP(ZL#j$O*8jk??-K-|!8Bkuz;KD;>;3fF(^zlU1GXxx3lQ!}sFk(|)t>2s$Zz
z3#oh(#6T<A;H`-L<~(!$YSVNB?P3@$2?vX=@?5_RE>hY3ot=jQG)s%}RP#H-VCgz=
zqVMQUCrh+n#E!BkdpSDp6-R#oPs{&84?KiL-~v5=n&bQ}>T$1l3Rp<MU_Gj;MG*9_
zd&SpH1L_VB?0sDYCRT?P2{!njdmQlvJSfXv5E5!-;}zlLNEb0Y<ss66wfu|e0qN45
za5ZQ~I$I5oFCFI~6F^*bFvf861cI@gw%R{LUY8F)h=2*Qknazxrzb<if}~8Ucvx0o
zH^~Nn<ujq1O#0Zvj}|H7R)I#P(=D4X&AL?e=Wb>O=-TLmpDvFJcqd;UxVa;(2`Q+W
z4<03z{gS@o^HnsXEt}yxRkqU8p*lZj%f_#0sB&;_hc!1M!0CkU&U((A%f0a>d|i^A
z9a#Gc=cpJhJ422N6n7D)rd%x0w$VHpHq8TnSqbEFg3egok@P;w*HWxbNjnLG1}$$;
zG7#^S_dBSZ<Z(%r2FRzqqDTF&2X~6+)4-rE8>EvS!Z4_U33%DKhrl@G_IXBmzT5rc
z-T1{pmX}<$8^5RLeck+Gznqi{I;EK!>yS3ZZgYOVtIothap&NB)5QFJz>~VfKd1wL
z(BD()8wF~L6eS_sbeA2fO*T7zQBBl=#T1wlyTpe!s+3V3n_%-%U5tUwF`@*@1^+mF
ztcmLlnvbGk5EvGSJ#nPR6ErKY>F?4pTaZLx;3Jsuy<#*AJbyhK37;RK(q8|KC>B7&
zbS*|;enBn4GjH`anESKx?Fip-G%rSfVGl;;(1p6`pA}IrBEJX>E|AbVnAgZfuUp>e
zOSHKU=HzbGTO2+DDUEyfK@X?pdQvGqz4;E3$xOw_4il>A%j9e~U!!k0yY?~s4I%*W
z)gn!brr%a{{~r|S@%*`*a^Z0Lw6DkO3K~bc1h=Kp6cWA=7!3+jqlixtsxn)DQj|0z
z^*gRtn=Dw^gD%TrV?Q1n<E)3`PtDF0*kHA4b0U)g21uga95agOjrM9Tum{C=mkMH~
zh}L?#tuCZqIRY|p#?UNIf=^1QEcS#SQy6(`@5+UQxW-L{7kf$t;YZ!0J>Mj}jN7F9
zjhj;CApE%@?Th<^&-vhk0sEGJ9DR3Ed|3saGJf5Cm*@iF4^tk1@g)jHx{9bQStD_&
z^n`S=f{-6VlY+G?HEC1|NF@ku4K0J_ihd1ZIjvi|TyOEeeW8<by3fU*8-ga;al(A)
zA*25s_7PfLkBO)zz3lMsKK`voiHilJ(u5lbU=@a&SxzuQa#KKvF_(XT_od#r8;r`g
zHtn&)<WTjM*2(rgM4MuXqwV9SNWCgsFJGX?>f&N5CLctn@V;>P4(x#u!8Pl*9^e&D
zk9H@PcJG3w<>{pI3N#q?@bPK+*gCvo(t(s0y_gpqn5}bER2C1CgfXcYPfZc^0mJ#h
z!MIy(a<c)Gud3K=B`wK+Q4o+-xI;VUA{rL8<Y0nu7|_*68vxNU5oSyS9<CbL9s+C@
zk7F4-V~YL!Cim#OX~_&=>6RxUBvc2eHmYr_kLT=etaH3`r|1{o5o%r2&E#>n&Y~BV
z1kWM9iw@;vlviyP%Pt&c-t|gf9`{^vEWk>pqdch;mlOrF((ELE`=Df<!=nmpnQW;<
zGSrc}p4Wd~BP2Yl(hqSJOS(sBB{{XqIUNV6gg}^13XFu8vej4%V_47xVqU~Vt1+QE
zsS>9}zXk^vdmzf&WvrFfTFgxe*UW74myAj!VMg?5u<h(4*y=VAiZ!;7_JvpJpt(C3
zsj|0QbIZub@VK^rdYVy(ypW=8I+R%Ham{7a#?fuNCI~ezk!*Ri=-Dfm7wcI}KF7R?
z`_QB-!^$ZF;LXaUOjfOGnFv>Ddd;*MS&osK7OV9Vrn0<GFdL1-Q-qQcPM8Ck^Qh7%
zErBjNyxNx4niBR@Fel1{kzQ*@RsdL?wG}*lg+QRZhtrgQQ3<)qo}~ZG4)S`@Up0Lq
zk0xh2X_Zo)6%$E`_FRBLGL^2<;O2NVzA2tJtnH{!D1`%9oS6=Z8l{jfn1sI18RT`b
zC+~u5I9}%m8jSP{UFH@hbuy>TM|75)TDYpyJ&_v(<BB<r1=0!Xq?HWcr`A!lp^oAK
z|M&m?|03Rhm?#A~aChCBf83yOza`v6;;h<}qgD!>CDIk<@g-?VRwS^RRj%Qq8ueZz
zQ|gJLKpd|+usisUQQ(P$QSkh7O6;h1eb%=Lu;YzD#`dTcG|R9a<;o*c+8+biv8$@J
z%oAN;-r}muL?ybBVma?lZ^3*H`*F7@+ql$lXc*If6po}NFI+SAVzLt(%FnK%U!W(4
zuxEJn0{qt#9v3cFGXe|KKvKjT`fcGH7CZp#Bqh<BvFFZJbb`rjBQ~1em|HAER(>j`
zKMP*5WEbemk}t>r>H5%&u9~Pqb5!d~=_l||qO`@o|KI;lWYPFzp3@Y+dW1+q_kyM>
zDSVWFNhU)9%ARk3gN&#utfBxJv7*7IMY8^rm>lKGaK6n|^ziw1b;-P@fh<mO)1H`I
z=s6E1==ri)H9;lar*iZ8z2R)U$eTQ=hrG3IbxKci;^x;X*ev)Eq)T`ilfS~5JaeBn
zG}mJ})0m7p!lfvsEuI~%SC_Hil=Zs~7nEd3mhryg)r%*C;u#k4sz$ElbrL)E<-km$
z#U%x7bZ7_d>E57t=nh0Y;XbZ3>ldWY<_^$q5MV`r_hb6+&e2!?Tmzu#0Cszrm*q+W
zA%8Ncjq^<~+`}?=2Z^kb5u8i8%g2e~g`J)I!jZe5<SE2CFLwU8v-3b>P{+<Q5RJ?1
z03c5?(@w?HCe?JlY9}mtv*METz;gCtQPBqyZ*B8qJ5b;muoU<QW+>@v&08tLp?l#L
zHL0N~5PL9Ykb36ew8Ek6dRRN*cnQcCaetlW?uP<ysW_d82Q_9$gZhYO6wngsd8pr#
zi}C_=O|md#Q!A#O6f(g!MnnYlc6}BY#wx;`h7S`CJ=FPTUzRcN&8|$;1^_GDbH_^r
zYYLOsPlGnx78h%X$kY;Ey1w8oyQ@|pBUqG@cyq)NZlQR^v${o4E~VX#{gR4&x_{)0
zJ@T`^iAlG=b0W5uA%^1))@rU6Yq!x<<+otaVK87u7-bZW($^Lt;;`{E_S9Lm4=2)y
zFUxKhi&CKi;14rRE)chAa@ztWSf1z_38MXlwObBEb9(ZiXwJa<3oYW2(8RBX@~f5h
z4C}c!rR%gx$R%VFKo`T0QgDzjtAA+o#U9X3`tryA&Lh%>>FRn*YWOCHUl^~qfOZvK
zlwzeEqY3L6$aK6Vx_1a(h%KepQ9vy(TQp|Xn4T;y$Q~BZe3cv+`y$arg4!3@QJ@j&
zj<Ub=GyxT6lVa8t1~#kr8-KLVB86a#(P5IqoUu5QWjq9`0fBiy=tBgp7k}=gRtlXY
z9T%p^E;B0yFO!*u*RcU&RxWRRC@dm6IHUns&kG@&ljW9`2%3UEroU2y6wxa0vTvUe
zEQ02Py@{r{ZYt%lxD997h=)k71j+3DH3+3$u#VlsVpmwsZV$gHn~Oh(Etv-uP_7cm
z3X9o>8%_`I1jfEBrT*Nk(|@+ObMVJrad1$Wkjow%)|1V#v%9~yeoR=ASMv4p+2o~G
zth|#h&q(eV(H7D>)Gh>7$$Bx0fMqg1U)pnFQllc!XLyJ6F~@*(+Z`M^ePAY0tT4=j
z`~C4{3Dy{%d-dx0k(>x|iD1`FCD}sGIj>f*#_YT@D@~|$gRqn{+kYo>1JHuRx_s&H
zL7U;;?^yZ)zHBq=Qxl%#qVb;tWStxYm3DYl)~lho01nROE*$57_BHw9^Uv>AzxwR%
z-Rl0Y&px|1`K<iqy<dFx*)M+a`RAX7U+><HTdSG^ql~T%aZjmwBV5ZHEYyGukG31P
z8(2S6+;~+hR4>+vD1T6k@_O2oNd3|{1ewvix`J0u({lVCWnb11HR`2^DNClao}7Q$
z#c!ZuYJ9^WO;_bENuCOZRP`g*Q0JO-^JEnz9}B~5oV9Ssl=`>7P0vvBE>C8T-XXer
z3CV?5bdMa*aX66Ph6J9bcU*Q4(?`!Tc{I+qB&d}+tzrRAV1JM767U~4W%u{oxVlKs
z{h^EdzFElWdfybJPV0y5u)b;I_jXO&F<b~jzv4u$>`<oD@HrIv1o2Ak1BoX^#G}}1
z$-^YsNiFB8w<z$)p!JQeW<xpEqcpo;Ua052laVWB=qHbz8>E02+aNA(1?8kKH}~x-
zu`;03NiH4KJ%3T=emw-^9O9P_xJLMblk54oz^iA1B~@G~BC1XF_<V~iT!G98`~uB_
zKUyY|^qNf4Dx1Uuq`+U|n(ZWR{aWF_<YH2Doy6Sgm^B|~sl&lKqntzOkZhgrgzOEH
z2<QA<RHUuUks;E_GG&~rBC(Nq*PX9v7gH$^Wq{-?yng@?pR^-=pW`6Q%0qP`#x<EC
zRscY;lUBchh@k!sQnOJ?*@WjL(&i`wmS>%bAm4)wo<I7^TO3HSpZLIX>rv9w!)VvR
zXzH2P%c?3ZrBT`LfhXSl7g_o^FE=kWpNEAZ<#<fb<Hhv)Kg#AfaT_U_tBOQMxVT>M
z0qA$pEq^PmoZ~l%l2S$-k!2_K=nXUSWQhkHI9q;<pZVRBNO`Ny;*s4w^7l$Jp8cN3
z(EVP%Xn0;vgMsLGZS~yu)GHs+N7<^n409#vB4<&uBa5fUPalglt2jmC4$Mpt_oU<9
zvG24Y@bQFoLd0`Ms7EAZA<xlo6f!@$-O#Fvp?^2UX|6P7^|d3;AwUD5!_@H?%#~_M
z4|th+BxdE?VZCxd%001xdPO`rPs_LUY&}b?Bgln5zEM(&{NY$6XWFe|Cu`g_ZGjwg
z%t0aD^K5{mPKxeKRQE7G(ML2pNyw4YNM@voc#Xw)>AQ`s#E_#a4qKMD_L3<AG_lR%
zUVpHStzV{Cy8{MaSJG~)I3p^>m|;9gZWm_PEEOP{JTm-TqH(td7)bgM676a|eodP&
zT|MGSrhB0r5wcuTENn~mcOF`roD_d=?#gQe=~wpS*|iF|Xoi30D^gHZd{*upioTYh
z1$n?4Fp1zI(`tTUU=IEPaEalKVEmiYUVnzso7vpzgW=DK5r3NWcL#Uj#CfE+Ux;~+
zd){xxCxlz?%dJM7(#h$K0aM3UF}X#OqNFetr&bRr8|le0y*s#vO}sa_D@nkXT(aZ1
zp5bF-+$zDTMZ&$^ZNbtccp_34SgcEFHj-qNcqU3T5y43@+N)#TB<dM;o3yr<>VH{)
zj-6ZTt@n5+1(Y5W&0wGssB}-sZ{`<`X7~8(lM<U~chULx*uo9txHK;tP0Wcuij3rk
z9>THzZTY6YkYIN#R8x4*Je~MHaz2nCBe{{j1C}9aQFeekEm4X9NB4K8G0V8j4(fT8
znx;Bx34Wf<lORasTO^E1Z<BBT%73w9Agvze+vWFKgn?6GFFNu&<|Z)+_Ud?JBUsF7
zekNr`G>($f$5GCM`8=)5rQXc$CE_^3l%AR{mhB}b^vYiq-3oSdtTW4;6i99<CuyCa
z_TaNLm2?5jIe~YPo9FI3eP`=2OT9g*3-D%4ZO|MPV95oU``!~@T+kOBOMl6<F1$W*
z5v`*4W)!_VTk<=W)lAxS$<kZPyN%a+N?7uB7Q~3S0G<4Jf=vh7o!O!00f`{B9dM;U
zs$;=t>n75yyi;asGssb85!A>XELzQG-@b?ZL@*iijO|-0orOZuDT4<;o_mt!v`@!|
zyNjb2M-I6bKu5MSmZUES;eQ2tHUik@2ir)x_g&r*e_+L0rWOhJwtPq>nN%g2-yxYh
z5qi6fOly&-IsxFr@L+KtR<{KKm5xay>lJSN($Vz78^hXe0Yb8*F{4op_aZ<-r9srY
zJUr*AHFMMDh0k6!#p~+2J<J^bl$c($*C}*&Lt9<=remhA@t0Uz8GnlrQ${3tJm!ss
zUNmA*x6%KNL-ax?>ZYnWA-zCHB%BJsQe$6gON)nCEkwc2W@K!T&jPFP!Lx|*2zy8~
zpORK624|SWLI&LR7z46}NQaJ=l`bw-Zf$v2r<wvQG{eceJtbN=*umB~hq!POEEx^l
z$*xJcf@B*?KU|B7D1X`0CN|wjzgF~$aZVCyHIKJ&;$EyL0xd9Jkp)a~9*&Iu<@_R{
z9zt4UJRqUy;-8h_*l9?Z8OOYqv|yJGxkC0awM&V?LnX{Df$gU`P7V+$kxkD-wE{8b
zS>sL26YkJmq5w^*v-QOVt?+51{~-R6r2;Y=NFyaIPZFe?T7NVU?SmFw2n;zVUg~%l
zWA<{MP}T`fi4GF%`L%RgpQJW%YHG#0uNY7X=H*u~3_W4a>{rq5QORJzR{vqutjcNp
z8w-bop7UmTlL@Xt=5Z;l;c@o}e^f(={$ch;5h!w%9l`U<gPlCi#P!)dEdDAU#`NCs
z>%IFAK2zUg_J0}S(&xYUrCv$D2haTK?!9o~dviCw;tm8Ad+e#*Tipe{H1mCXu-AMA
zSvK8%UVm2{h&Axg4YRfzB_04ks*H6a8&x#aM?`!Mg|ym%?(dKbmT4(BL^LI_u}y2u
zy>zv9UgF-=jEI%7#1zaZ%iqOc-1~}=qaP+GA5nDTRe!BaNyz&TRoI-j6p41%{*9kW
z!zFyClAPwF2ZAcxdtNO9hY#myx?6ld@-S{E`OO4al7206!b+UAjzexry+|evGWplc
zCDxOM2<cdutO=J$<`9i&gKBG3-|j=|bWAM))F3~2QyH(T3?nTrs3@xD_#O-ULQhwq
zsR(P4Sbt#g5Z8hr@S5;*Esat2^-~YIIIBD)H&U84C&{<X&6%HMF2-nT?Hvu#7}5PH
zUlmHLOb&2gva9`A)kGuKl%hw*_K99)%9j61@G32-9=eE-UQC;JOY>Vrs--(r-J0qw
z+eySBvDU?~tP<GyCb2^=mgR!gS6&kZY_m2;lz-jGr;XJH0{bN+wrRLehC#DFq+|*p
zBq0V&7AJBk(F4@r?wNcS;*U?EnYuUA&@ok(T01HIvmmPW)^y+`Ur<qO!A6$VCA^+*
zd<5tuN1kOGGl@FzS0+r~rHZ6qsD2lwv7zB>tO_f=0!3B<dSOrs0!gj48RDicBicDN
z7Jr1l6nRrCA4QjwLT6FJB@Ih?W+!TI4U}zNxpR4!TZppQkH=Lat6lHU%GX`RC>)jg
z{95yUyp%!kgs@aJMwdyciI%J_j2+Mc!;D}di5$ovy5&9@%pe`&@6qEtwun<Poj}Ml
zw-wqtcwnh1&w<D!AsF3Hr5Glb+^2Qgoqs;?+6cRcwjtqEp6UZhCpQbrWgzxI)+=iO
z*vnK?Z&|V$z2d@=0e6$%cL64yK<ZjukfPJev?i##Ouz>ydH=X)zyc__v$W9<Dxn_;
zhIn*AGq@pTo0Fuxw3p#~=tsfPo_LE^>|pbg)5ja14Av~q48sDEBX8cM?Z}f~sDFjI
zZT(QZc{g<oFJpJuxp*Myj$+J~iZF6j8R_Gm1Du;a1NRG1d(LeL$(1$tlDGa%+_Y(b
zYXVlsL!i(X1k}j+B59pRH1?=jY45?8#NEv2&$uF|DPRLki>6!bNX$#BC!$~wz{G}y
zVf}SQ2hFscm+37AdfjszeGw67(0?%(bnlF{$?xV06y6LKh)$B7ZBAclWoVvJ3rjFN
zmCP^UdGYJbq1xlx7<LFDnUhl5IA=Q)J+~QKH^DW)s4H(_!%`7k=C51#9J<l2ZH$#)
zXA)H<lRB4)8mv6r+t;*Ko@oF^`8&m8Wjz5}7FiYaojYGufW!knM)Jna!hd;blZfxI
z0Yt3UH{)5uF}J!n%q}a6Lsl`M>dE>SN(0NZoF6m1)?O-fzv=v9<8<$vu5tvkJXv7r
z){BT3#~aS1>d#09Qaw}l7tMk;vbfz<%ft*eTC~SfJ9i$2OP;h>FQrekOjfZ>bWn{`
z&c%~to^eyQ>{L2or8g$(2!A{*QvG*M<kU5J#Eh=t?z%*ZRM`#qF#|>rj^p8+xLDRm
zmkgzQ?2%ECG>#HDH|F9nx|=mX*A;?(Ln>gYx@y@;BPyr(nr=PG`%$rJ#F?LTX@K|I
zT)^y)<2-X*Svg(OpW4bUbrBN=efqQtR9;VFgQ=PPF!)nDXqFcTXnzz|26;N`hA(@u
zI(u1>xCPfDPrFTREo4;8r8T0C*;*;<xLI67oUNqQl4y#nX3=Mi30l-#QWSY3ZSV4`
z(79^~a4)HJvN|X7e@Qnm`}z5?#m)3cOULd^Zq5C+tf9B1t!N-UoP|KBNgqi=jM*#(
zj_YE~HeVP!2AjxzDSr^GH<0A<LXs$s(9>p)((4`u7*|?pxUG;{#Z2s~IZ0B=FdB#T
za^=I~Nua2n!V2}+^T9x!7_3eeH9krfK~|152!4XcN!r8&$jnrE)KwyWk&GW#FE&Kb
zS_`euk!Kwp7tekpiAnKUEv{Kc5MBLDZR>=Gyzq(I8+3ZRoPR8gVwdrLDxne0cC~KP
zh0zNF<48hl6^+ieP`EvaF0%Yo44-bVODp!CK74*daavM~W}Tlln>=^Q(9~!VjBAF}
z8B^K-<<bwESs*&o2oph}M=aG6l_^_;ljMjwY}&++q1d%)4@lLqth+IJA-hCG^h)C3
zxW<@eT#V^e(|=rW$w?4s1{8P)l||c9*E2S@qv+~Uq0iI>CHiKWVv@4+;3{DuGIvqT
zg6x}3e*Oe?XHUy9a~#7@tL0RFQ@r>C!pB?PDwvD3OJlcAHJoD@Jr~*Lm(HM9_@o(Y
zW&ykG43qzTb?q7(TmY$1(8XwF6amj}qdNf}BZ5_<YJUwOdY9A?qVAN^QMhVq^bwgb
zqWVExE>;qLVbn*Wsw)6^l2b!@=&A*Ibu-TdvOc}Qil%yeH}_VccVb@v2Bg}a!qZmP
z@R|Ym@Utco2}Yx8u~%Iv2uxcr$%-Q___W~QTX-qwYv=%m^PXK)>4q@HHPz|Se;I9x
zOEIW4Cx1^R6ni5kEf+>o_B_mhYo*rtye98AEqFtHGve?^wHstHx~Nt|!$7tsCvn`M
zjV*Mq>ZQdCz3y!;`IcV6n5(kt992~cf=cGq)0|ti?PGAhwQrXr<vhdT2HMMDX^+>+
zt`NER<}sB1;f!N}&(;FS%jkdo7whe)ia^K6et##olD<c4@L=^XQ7v%KNet5`G^lnh
z^AiU<4<)4yEiY-1=rJ_4xeY8|Ab&V9{wvYR<kFz5(O>|69=&D1=jgj*;(o34_(tbJ
zY?!K>mz3b2es%n`*!xNfQu<HpNf4d;@wM<N4U%`K;4z#-il}(&T!#s->CZS+-{jrC
zOMgB!r?a)RrLb}~MH#x7HfPG~Zt%YhQXgVW=UEBp2(y?Z<rze9ejYVT_cY}D?c)lC
zoUCUvAj$@vvz|79@pJc-2o^J@whJG_#SS#VadgxtZ16?F=?P6QGewVV&2q5G`X!6Z
z?833NnA3iKb%uFk&<wfb%mPynbBBlk&VLrC<Jh&%{Ak?YO;n$~6Ft0N@$epnu>%ph
zuY7cLEMW}BFC-j?D3zedoQacIQ)z5@r0#UmNKUW*nwCr^eL-hpY)4a5n47m)WAU`$
zKg<MJV6KRO(mI*ho@{VhL%NB$j#b@o#X&-hgYh6&Hj1NFHOHMnbUzJR0cyB=Vt>|o
z9v~9-|Mdw7?`wo1!at4aZ4eE=bcIxX$wV9zw<|-uJ+MKbL@M_U3Mr9vRQTVyLr33p
zF1NQ*Xo1g`ZKXJc#o;G6!^wAec(|$;&@+qh-_~rSILU7AqkEg=yN#m4sL!ugmyH;>
zFT)}!c-7vQ>$!>8{pj5d3UHQv<$r#y7J<L{#hPhfd`0Z)64(6N+HxSZS6e(=@Sv7%
zLZYTzC-9gc#~WynyC4{~y4yXuwf0*ihp3kW%B6a?U|=hSB@Z%T1(h6u5qy<kB=>A;
zlWK;L(xhsnfd^IwAg0=)WrM9y1f9cS<wcIOSuLtqsa?#&ba5V7xTv8Wrhj23ac<dy
zt6*VNK=+^nEaqcx4lIy-$++R0^<}bq&3M(ku2-XhINT%KQI-Xs)0*NI_ywxPNAy7@
z(W{tJj;AzkqUc*>R;hBCP@k0hHS<cCN#~TQaVOt2sbaZD^aznYGHxl_#LmvE1)|T2
z;9XfJnoTGnM%FYEf)K+3XMg6a`t2^V1Gdenn_f^(e11K5FOmqaSe>?P*g$ALar31_
z<VLi=x0ZvjVWCM5p4n$$-ieV$MCuOzzX_N6!)!R|00MAG?&yYnomNw@aeENPcHjp)
z{{lyjij2zBz8umQaqQ|%6|)D-8!XLbJp!yw)ShJjp(<X`ZnVV;41Yc6M5n9)=zRQr
z`Fbf2Ko?|bGa3%}9H*{x_XD}xuF3<VtE>Bb+3`z!c#rpU+Dje1KKz!Dz7oE&O9i%X
z*rdX;CGh1ry%E22y~r}c6CaD=odY+<J-Deb?D~U+w{gKFcA<;ma*r=;*Y!%nRhT`&
zpB5-L_KXa{JYWT{zkkAgNw>wUGc`@v;Y^L+oVsHOQZX6{JwMNNCO3=3An^!#kn{{^
z+iiSB485p|sWz?Jf(*MQqH|nHC0i<ORNX{QMv{F7))2d%gE-A}q*1fQkQKvKmy027
zH(sZWHmpM$#GJlRTJQ&IbUWBHo>mWX1~bx8e#OfJTKEJtSbv8yHk5)<6eq0AoJ&Tj
z>e)Gt7wDP?n8vSc(RL-u{W(I%87!bDlk?@bT}|jjQ3f#uMX7izi84^F+tZ!z>A9YO
z_cD|Be8sjGf5<nb-(cr29;nUl5SiC*e1|;yAx!SwAM%b@m#M(rlv!DyV-r<bQ)Y7f
zDhjO|+aUiaQh$rxk^g=|i`}AckXb)D{puq=oNWjfi(%ll>xC%$TOZc|zpS@M>2@~t
ze|GlR7JNkUl|<ljKAnXFi<otR7(z_8(9xVRq=^;!0QDzK?kkzxu0%_&Jly~Z@Z!w=
zAyGuel=NFZEno<J@r7o-GqRALt{axrxg?)F^+&m__kV`^cc%b;%gJH5piPo`=+G6s
z>_dmNMk<PAr9@rBGbl7wCg}Q-OJsd9_L_TEkBQRQm`__xx;WU|#%Bm~FstDNY|d94
zznb^g?LmnrgFOnA?KjA5&}^LpPhc{%?SJYQUqbSs|DD3>NGm<O;IBkQF%!OzlHBj@
zWB3ZbQh$CJ`GjL1k58QRxjY>wt3UK*tUe4>h~#|%g+5z00GYFwhRt6E8GT`SDtW7s
zZYvT?=3Pt!uYWQvXJy)G#CwlCzpOn{@d;~Y+c3Ck;SzMyjTNJ-u(UgL!Gw?)b?lD`
zd9GV}5OmMJ6IlFQ!9_0~41QUhKmny@wu$J?5`U@)l8*Vj+iAM0#+UOZtoQZ7tq9?6
zOStWO%0=DhHz7@=4L9+Vs3;8yN8(+)9sC``DE9ltX!YQN_fVVHHMo%ccRasr{=97x
z0ETPALl@!t#=*?M<F`GHom)y~d{~0`RMK+h#+|h0uXvI#6<9$875fPWe$4FOx`tPQ
zB!6b*Uz#~5e<pVx;7M<Db0|$XL8a`T{QMZDSOR%*owbRPmSe3QiEw8U$=pFv5iE~q
zQyh;3WfciaQ}2T$-m+rX-@mKsv&aqdcpXCFDKRrP@9cT^P7aBF$A|asefHq9gE#j^
zh3I^El|F9yJDT|Jo^UrwCZg6Wj<q!u(SNT*$4Pe!N!_%!BbhQPpW=H;SFfZ;g2LO!
z#oOb%Mi+}!|Ffol|L*<I`gcF?-+RFBh$A_h{RjPD_FEo1-0}I{`}cl5+NTO4(4!i+
zinafQKd95TA)?3&sDj!h#O6SNk1b--Mo!*aVxy%Ix`!l<tR!OC#jLTu4)yXQ6Mrln
z_ug8-cBs$1KM8s7>{#yxnM}(yXUr2A^koi9${?00>F!)Mcwfy900^-*1gw|ZMb&7W
zz&^GD69H$vbLUC0>H4S>D~^wzN=^gH775i6Smh|3HwjAqzPdi1Xf;9j@uUix?8+~V
zdLl>|#MT9s+o+kdZQ&@E(3MNKd4DUo&}kGVEt{mXEp-ws*vZS2{Q=6z@7%E^I}6gZ
zTH5N`bkns7++!3tE+(gl&8J6X9NscRAMOgA?HmTVZ0+g*E5uj|xjB|<aJiaI_cd8`
z#aylhO1&qnH*U0xIF}b(Xi?Vc>tlT{12R?6xE|o^j%H`<>4%#E>xb_OdVj;4Dt?M-
z`syCQ3<|&*Uk{SDj>S2X>Qgj#JMvi1xYUKThT1!RadK1~6pw#@Qao=a3ckC##!nCL
z$JTp+dWd*(P>jMj!#ks_0lX)}>~j;QZwMfb+M|_4tqrMWw5%=yU5qqzXMgG`Pm4@Y
zBM+P@R0|J$>%2jt)y|Mi9)JBl!mn#7dnG99ZDab5R?kQ|xB=pZEz!s91=gU$nk*-3
zh%vU$6UO%0y}S4C_ut$<ygS<Wqi&B#YSq1`?t8gnt_C(&?GbvdHFNsjY^e8*%o`-`
zrC2tUA_lkGha;I{|EyY-hxWGqy%||=|L(8)cYirjWMc8-Y^!@(&wrWP#xd_b?OXX%
zI&<;OdB%@wShBzaMM@}H6I5T!8|<RvpKbXF>^4-2iDxTmL7x|w*^27#st_F{gM|tC
z-GQ$*n&>tX4JqiF%DC)-QIh^;O=gRc*)2wgl2A^M9n-&8S5-Cdc1?1839yp{e8}g+
z)H)yg&>t8@q+93X$$z+u_1QFhSr~PYKQG@je8cgF_%=MvB}_Wi>QcrvEKb1BA)AKl
z<#gocr{3X^*|JcJdiXkWPQroTj|n4&kX_oxKAbk|Nuk=lhZ{ZNa1`qVQMEiGa~n{>
z(#=$${?wijp74FYtlgf}?OfC?dGnilL1S*<du$K>s{i_)s(+MJYS<75T+8+n&3<JF
zRb5A%g3xcjnfGli{!x>0di441Bs&DzvGlM#{SudroG0r(Wwd9LN_u)Eh1A?w1E7d!
zW@(G>M-geMnlMT<=w<WPHJ8{$a&IIGXdu1)th+3zC7FLlNj)u7v?r67n)VZxTTs(S
zR=kgnMlA9co__`1P>SS;_hW6F4QrjNM0_)ek_mTXIhWMbvdBz{k}1ZP<m-zD2s&{p
zuNPWui$!2uA9W9ee<FlFVkd$lhz7u=#tyQAX<G>twz>g%-PdsjN@Yqsg3PO{MLfsX
z{lQ=$KkFC9;_Ls~e;LHZeAPcDWaJ9)ho9Xy@W=n!r+)>9E9k1Yo7Pxc>rE|&j7!ed
z(-O||e5GoOiT?f-Y?;x~@erVj!*3oRJ$n4&#5-AA--v4occ%&vg~xedWn3$2OeP@H
zTI{_M{R2bw4eX2Z-0`dUUFsMC{gK&6#oikaGiJi)nHD|gDLj-(rX9Q!E~P4+%SZ`X
zOCRturGM<M8XjBO(g&(gU3huFU0qLORd*1Xm!j9!z&9t@b^6($K>}~ZddbstnSN9s
zn4_)HZ8Z3?{9%LmRklqkW82Jab=uwCzmKoX-D27nL02+OSsqK*B}V~(&^^rXw?Eof
zHuzCJWr0$j*91>8qc~PI+R=~{R4U?UZdW72;(sQKS~XjKPyfLnSn7Ab>>sOh8|V}E
ziTxM%@MrkE{%81yesKRuxxA?QLHE5kVmh)qLSS@i=C0~D9;-BegBtC}8FLBioVLzD
z7vh!Wb8K>*4XeXtqWD-W)m9;>L@t=;#3Y6biNG!eGA)r7dt2H<kz{)jdZJp52f_CH
zCV!DYNNg$lj#Vv~(}8td?sPumi@>L!EiVp(00h?Hf9*e>zd2+Z+}&buV6l1w;#J%l
za2=Mfyq-5_nlsWBbGq1WwGrVw?3ma?D2!Rc=3Z4I;2H8)*|svACxq$G>$ie@d3j)>
zP8ZI4f9Up!D3L%sV=Y7+t(Il@g1I-zQGeXqw2yW#HWL?**^DU&b5TXIkC1n;Qyc7I
z`RJJWP|t%xB}qNA9GedP`*aKs1xc%+J9or@Vk*{pF%aQ6m3r}JIZ0a2Af(4Hke*e@
z#||si>(+u=-;OL>)?6*I2Vk;NVGeE^#jjy@_WU~OPa92VH5IUvQ&v|8N>S&Ce}8EH
z0&PVFp8!1qH@tA(Bw{qa&_GS?>7;IkrgS-pP*o$@@ll!!-b(kP_*iaz*IVW+6wBN!
z49gk`=9I<>n^!AlPWV7J(_UVDnvTCf5d-=!x9ne4PWo(PxO*h&hsm6FJ=1_$uk*0V
z&r~f};s}%QX@$kslzbMBz5$vU(|^n+nwt_oKq`zMLekk6#EWqsFvwEd3?^USZ2#n<
zo+;oHa>5Nlrj+ju>mD}YGOXpd!PMbS6@ro1y4Tl2*N)mz)%19`<3<2+Hwp1NgK>^E
z1#z}XVq%&OouCr5VR6rzx1S72;LkJc?0;!^RR6}2Jd>_FS52e~&-3jUr+<2<po~bi
z>*NjQJvm_8`FeFdtOJXX?DPbLT%PN*4;e3t{(AZ*u#=gFUO)fEQ2$K*#(k2?dM+$R
z(j)|llzOQ_L-<>TQ%0CX`r{NRdJsg_b=urc>IlVeTxu)<4=AFJCdXebrEx6bD7!sb
zZ6PjX<A#cxe{grG8Dm2Ruzw_em33;ZiT-d{oT`85Av^khKyXhzY-8#A%P`#A_~1oY
zmi1Yp9WfOdwQ2-#$lsFO+_oz|pu^I8q3S?HLk*KeD|)nuTh6U#q0x^f7JyfRg5qYk
zCaqS@Lgf9b-2wE!5@PtL?EIm;s*m!%su&0k3I%*nne}d9-x6b#%76c#nltXe{kuap
z@W`@HnDKf#Z~s)*(~l!qd8QxfJ*<e{XK7=Y8}aR&TvSH0AyCp?_Egj?PT<!=`C}+`
ziYWpGKG9a;x6ny{SNs;{(C_fUGx&>`L>wtw56?T!j`k`{K|jk$QYpZ>8$Mc4uitp#
z5U^jk$a}3sC|Ge>#ebHHmP8STTdwN!a*TXV)%L#Pu=LztQ;ebW-wyzCx598GJK>xP
zNq=3OS~k$9p2RGEXUAL9h6U1F`z8uEsON8**NTpgii1bLNB7K!Pmug^rrY0BR7mRU
z@O$>v=9Ys(92;&|en<!^Dh<>X_tMb&9A2-Db;~M`bWlNR6@Q1<w3%nsbETz}DzGh6
zkK6Yp9m|1Fph!Cav@$0l2sT>I5XRY1OKIo$k>G1=L2PW6-sy@|qq@1T4zaJ<fn6&1
zYvhWZuUJ~72F;x9(bjVTKsZuzOtj9<<X}M%xlG=;hqU_Ts_kiJC86%M1U)0+oPtH)
z$*?0}xv5hOynjgMb5fpH5oU=~5$1vqTP<trk!<`VDhP(3FWjXUzH<f2*F1D#Ij%MK
z4250$VzT~L`oGS~X+37j;-s7<)v3aXl&vQ<G#eaUQyU%AKjy7db3Y;&k7tZ>c4Fy<
z-8e2zWGvLm1SR~T)EJcBLr~4^J9iQ(c<0Xkz?wPweShqv+*Z=1p-u9MPf_Ob3BvfE
z1gWK!`VFi>`nZ_?%Owy!w?d<%><FX9cxD=8E0?7rXWc(#`FNSjWY}ZM+H^q)I50Iw
zhcB70a9k|avio#9;HyL&g*TK|Yf@^9%~2G@`e9KV=N~8C*--wCq9;s4p98MZf>}E9
zH<KTC(|<d5_wfuccx;Mz2KBG@w>*>Hu`79!30?T5B<U`})$m$XUk04YAEaI-_S5O;
zzr+Y4v?{qx6_&~CQ5+mv`Ft_^lLS73j{iE`b@1-T_t`Za^+@0$rFAT~llXIEi7o^|
zmBwIQD<C}ByYwr0ZJ|-x9bBT%wg0<_b4;dFrGNf^Yr8H$nRKf?d~)>a(c^GTlpnng
zo6+vDF9?zGj?*mAF9;UCocvZ$k$Z}c{JWi<0;#|D9mkV!=XpDzW!s|Rkf|R~Dfa2S
z|7Y9)JqAB@Z|N1g>(zPxSG)Uz@PgT%JaR}NAmSwd25$`C{M}M2Ib|8bS0o<+{;2D7
z5P$9l4ecQ-ENEO<ndc?K8@gD3gphtl!7vDaqWnx6dk?cL*nj@#;;-ND?`w2I21C9H
z#tNT|9T@znspot4g8kp{&hV+T*OPk5@8n(K59o$__H@uo|B70^^%9U;(#@*)K0Z!G
z&zH)c^7-?|@3AN{sk(hZaT_M}lb`sm*ng^-=5bjrC*ww|$+Wr;VKlZDT6q_tfjqTI
z4rw!`GE$QDIcW;(kb1VBIwonhpe3*lgO=tK*I9&V+b1Zs?0%=75OMLe$Wkeuot(s6
z;%a^oNaLS(l~&||Nj)i$IQ*LVIA>L$f^ds1#EF%#NbSzDqJh6P*CX&?&AgehvVSay
z;??w8hDr5vM9MEKfd*6yV($Wp+hJ>`s#;40mDjz@@cDXspuRVQqi<h+^Wxd_<A=kb
za}Iz1_}{{ML>?y@GQY7i=NOJ(6uY~>(I0~tI<Z|pEWCYXa(?7KhPWRxi2X%z_cy)`
zZB>OQao{1)PO6oj_}}gA^Tkx!(SKmkj?}DWIW@ad?#b~`99#Zdfx0ZNSBO6}Y*MpW
zw;IkXcz#|s!so%}A5-1J@`pPQ*6s4(tez{!jSr#G3O^Nz+~LNvYY^~r|2d9ND56II
z=UB2?(aGz2k=&;}<n-pjV6f-M=%0ByTe9BB<h~DN7WjcY@jd<%nL~YE?0<zt8IY5H
z@kQ7iQT29<pZyH0H3(Klyar6)-F;u3bo;^{@OJroSWko}e1F4RJV!nm&bP=%Q-G6!
zjV2@gM7MnqO#eOJz8?oEj3@>{<It<W@oNbo{XBogT3(cZ@dhEdc|!)K9mlma-f45O
zH~Q&c<7>XxZb2iT1lb?{=YJ=nGZW>NKK3AR=^%sm_Ri1`?0UcW;&;VavXsaK+TD-0
z&&oyj-f%~916lv>?ta`M&IwDK?x?Nl23yZ0VD^Nw_rPr)RYZP3wwPExQfs5`=}oDX
z%RZA#iNHgw`u)-_%ytb${dE*#xu}bi)beLN2<^~Ljvc3-@&~EF8h=L8P7hajJG$-4
zy{O4aZ%Y@ax4~^3W(^bijb#M<O`Ev?jkWdRKabRCfadkLoxk<_egFUA<}`^a{Pp7H
z;Ak_eDqM+)CU6j>*_|@V#=6RITlJ_>0(l<pdRnr_B3++Y@K!r3Y8#6{J1e4f09WX>
z3b&4%!J?looJT!TkAH-A_Qf?n7vw`phj1fz5WZk1v)$AmAmK;z3BcALnWCjX_v^`E
zh0MM>maB{EIw+oHohLBKw5gf73Gx~}8C7iDXY|yI^H`B*%0!_y^z~I^Y4GCqEWUwK
zLRY|RoFEjWOJ<5TFL7Yp4|K%BSM(kw9ru|Nlz;5(AVXjY-G2&gI1OQgcpG~{!X~ce
z+=bCN9lHG51M-VjoOoDw8TG*Bwze<*f}6;LI^rEgzaK2)An<p8`d4|)_q%}-<b={!
z3}9>1x_kQb8(`K4Ihg1sz2e#P$KM_un`RQ8LH3SGzu&~uFH`wV(jePXtE{hkU_t_T
z!Bt$yKX3U$-hb*ildYS$G`iUlOcJ(E?iEd-grM4NtmD2kP0^OmJV=4D%by48yc%E#
z(HgB!^%op=fPS8P*z>()fWQy~LvPvvS)iCW+4Z8D2HA7^$8^L2A`kP)-e0|oITEaQ
zdua!A-Isk4V_~(x;c27Ef<dY76*5qiallDcoNjq6Y=4K0zy<EkKD_ZNXa+&=K0kE9
z#gCn=XNx`e=bi5>C*@x1&!_!+f3)2!o-Zrr47H$0I2BK0;P=y=#J4=0)|cD+di#DF
zlG{r=(kq#?biH#D!HSMZJZT8+X1Bepmd6;joPABGlsonlm*HO8l>&R_*@`j7^r#sl
zU0oVtZhwR@?hWCX9-=HJnG(O}D-FzV^PU_^vcJin&Dy8jFS7r!SlY79r4*s0g3St0
zJ({^;My2RA=uXSCy`NcAlAyMP|0@_>2;b*TG$ICCTbyn+$!s0f^`{^`66+c!PYnHu
zETEKpf<a(YgdhWYT&h=IW0WibO7|d;=+%7F(ti_S8>l9jzU?KFh+y`O)DI2hS!;Rd
zi-{_|ZC}@;Eo$fr>T--<B9d>@RaQ<RDXyi1i=d@hZbzo51f|bIcpq<jk_o_#zzl{-
zll0glULz!LQhgD{I}3ghMpQhbJ9h@8aTUcqgC3#}!jX6+6PxHeZ9;3CfibMQ<fRb1
zE`L1q{6*{E*)g-fK7RSlt1pKypZ)&vx8W=0tcwNmo9?aOY`+ci*)nA?lZ#8y3MjY(
zCoTfX%;BhI1XM-g@mvpt=sjR%Z_24Oojputp^CUnxM}7rrCTqXOe*jiP8&pZy1TKX
zyMM%<$~YT$r;EZH(^o_hlYbaLOK`Auj(?E2kKVFVO^;j8g3VN)Cp$G`W*3qHN<BhM
zCYx&|g3?GrKt0O<Z9tO0UII#5vM(cYmr<NQYVJf0rnfu`@(#N09){PV(+70~j=Q9~
zigr&CU@yjj{vhsKCL1DKB)kFzE?^g<pC+i1nAcCs<wbiMR_l+WPC$&00~?aD=t>nj
zV5)y78AVVLdXiO=bs8}?lW3ap&EkpHnEPmdkayQqQHdEd6dn7!=oJZorEN9G)zZxf
zEEvH|@?f(4to`0RlDzNO_3-JLI}tBmR_GO3xd$>P#fd*WJ>&^u4q8AW?>Y&>psi3z
zXtS7TL*%wkOtR5u<0$f9X_}LO>#}>7AklwEv_NaQBZxD^>*;mmnsnM0EI+Lhj9okF
zT}(QLAk#%&uR&|?)6Jqf1uMrcun-jZ6x!TfLPO4GeVk5N7+3q%i(_r&B#I0Rd1BM{
z_D9m+0)KiCc0vC>fcku}Y7U^44#w>pywj5Q+YhTn1sxHGL5H&2G1MR4n~`*Ar{{m*
z0LM{x8a)*%#)VOb!X6w!|5((E3KwL&UpyH44;j8=IbB?q`-g@A<*|FpDWscexI!9W
zR9!%+VE0{I;C+(ynPSyRLt6rr{p3{lGQ##d`k2x$_9oMcv~AS(=Ky4KM1(q<AM}Qv
zOi>d+Jh#HMi3qvrSc5`0BHBJGf_r~|C<1SL^cI8uOHc=udmkjq<&PXE#+x3k$FCoK
z`B4LZK5YLy-8$l}Nf>Q%wx6^RkbTDiji^-aO_FSraPq`dW6RdX6yi(+!B+}tT9r%5
zmrzw)M&)VF6Aw=PB?3df{E(A%%O2|MLuw1i0Z|SHvpwUDtJtXRs$oN<LxX>*+T>4L
zANA%7p5bpPyw_dEm4ZJf+!8wR3nWKLXt0VMcjw{Jr8!A8b6HT=a{aR`Mh~Ao|F<G6
z(_p`N`HWjJ5=l1`9nBJwM|{O7=oL+nPqlfiHs3#H^j(sUWEupnw0@v%<;CI##$zFR
z%fPVih{X#<+K!u$2nd7p@dba40wCWO$<vPArX~N$-BHYL$yVhm-aEPy`58!rp_#pX
zDm%ObTnd0Y#z&$I(NqXz)|Tjh;ifS`hnJGBjpabbjnXjdX=_4}lUGXH4{3%KNQ348
z7dyOOR@?hYXreejaiJD$nUvz;QRK!21&vts{9>0r3EXFTlUCks5$AuJ%AzD4rEY}0
z_xkP0#NQK$BrK3P;q`!f;*`SNos~<4Ek<b<`-T;VV)`v|tXSbo2Vj)S+^sD^+QKu4
zdSpVa%C|*kX~>=u$6P13cYC{RCF)giTc!AIi^x);CB|u6g~?8kNv`+&CfuJ^<|kOx
znt~-|08-x1k<d3u^&x*niD;)~uoPOIC>(Rc_5nRwd$-@IR)qQ9_{_GOY07~1l?%7#
zoKN*oTD`WVBaSuV+DZ*n;0SDhDLa5xchr{e4SxCAuLgI)W6lJidMS{~fET&FF_%%X
zEbCTK*91BhQ3TTadC}HW0hL-W@L_C2KbKlQQfNOWb_Od?ayx%&Y3Z7gtSTY{`gw}c
z$pazBz4pNun=_J=-YzP3_zH8rVHLp=!=9Z!%QNkgW@jIzQnGNN>|^*o*mu8u&~KI<
z{jx7Pk>Nfe|9x##MKFHh@oADBkzpmKV&wxPA^4F3hl5Nx1_}<mijEkQsWg;^mO#rE
zkl17WS5IBH!V`Z4(+^po2(u`wkY^n*&25RID%)%6k!j|{p{srJkgIw_{+XzEavi7C
zWZ^+B3D?@Avh|!);jWsB2a7A3a&y7_Cm;3RH!?|PNgHdOZ;q05-w=Hzd&7B5L97!%
z#>!fc@`Jx}Y)M^5d^XctC7dijDnwuRUWMm-2pxZ}rCWd2a#>DzN7u`mABy4zghnZF
z;O0=?3B26BVa(t*@;$&!!&TyGl$j*bjuU82@^fk`RZQZYT^DHYy@Bq>_Nv%YK%)m%
z1Oyv7$*m3))g#j5=;ZN}#}8k^2YLMM$>SF<wXyc-)$>P3FCQl=O{@92h)A|BVmS*P
znLs5XXf=Q8I6zx*xt26Zl4gt2SoV-@N<|6%7>MN3zvrx+Txd;4dR#!bv0<t$qAVKn
zJjGPfsY*kP<5c&S{^yfrc?I_h(O#oJSfnWD%X~UnnQ(}%{1D0Me`(#jy%X6oHJEV9
zGX0pLQ*UGJTKO8l*sWPMd~Z~L2d+M#A#F+YDhhwu>D1oE)4b7{1XLt-o`%~fcPAY=
z@yS67VIQsIisoTUZ{&8w?t%&DVj`=~V6!_4tyB|<B2yAmbs=FOGf(knW|HCu!_$;s
z#PBI&dy(YM*gOO{Oj-bK3zPH>qYp+^x@LJ%&e^!*j0l3&MYFutZeWl6aC_@6>2;qR
z`}Tih&izK$4YABN%sFJEYcHgkJ@lhlZ2Ypo#-_k(>U@{|{yyF(AEh8VI(K1JGX6~=
zzvO+3W$kr^r%^c!>XqI5QAH$a7_hs{13-;Ul~fY~D$sNZ4h{JpP|EHT;#{T2XjdyG
zf$1<`nLtCOBoLycpE47Mv}T3Z7tF#GmLh-ursIv*!lBYu-(Qt)8tLhwPDMZ0t8#g8
zZddE1t8-lV@RbP}a(v&`Xa~nKr5}lYV7Aj@w)ct@*EP2}x6-&N>7^*tQ8-sA{a(^~
zoAW<?UDD%EU1h7TQ+JJC2I%wsiH==7Ka}V5(KeeomwuHWrls>{TgncPtwE3!%7K5K
z_NB2$YYm+^z_?tnK@Yx~uyY!@udUhy7xJ;KKbhgJL`Yuc=1frwM4XtraNw01F)(;T
z*7`znP&feoF!`|coL%nR@c?w2S<R8+P3m<PvKQ9*h#r5S8;PNIBnz?kP&*yIT1@y~
z$x`bTlEYak{J($6GoLz@n$s7^RRVu0iNkg{lg5leQnV`)?D-nYh&Ee!aUc$apjBEc
zq%B=1RgrEbYYt<I<XTG`skI`v2X%QR04l|z3G{m{dLn}JeFW#LN!sIADt+6uYy66Z
zUc`_0r7kp|oXh;WTC6s7092p}0*XJg^oi_E%IkK2GiBgcLz}_SYK@cQ%(s8{!$^G}
zsn3Cm({73KM-GjRj7?khQ&!EQ$hwWHe!so#R2QY7%p1XyY*A|1Mr;KUzP}hEdqx;o
zO#4m0J3eA{7z)f0#(VIK&kL*p^qkYjz<vs%DJ=hE0d@N0p2O0TIPQJscQXN_na$R7
zNCLfokT4N`0>ZOMg%`o}JkWp3#j;9U)Z6iud`~GgZTbAbkWIyfcWOyu@dX=oYk%Ck
zC3l4h_kFwDelYzzftOxRZS(?=Miu&q>pfX7DH_oumRJTUQD@Ib(ww19;1m&(V(&b9
z3&HV&I)=sTX;>B0e_f#s0Sf^7Kv9negxZ_Hc<n>0pH{qCgok%Jn>v4jr)6oG+ItqH
zAzT=KHl?J0LJriLG9clLl(j=*=8GEk;n_TGnKe%F-g?QL<0`z7W<_XUJT2$cC?l=#
zr!JucPFlhN!&ZHS-U@dWdwkdaA()U*5!UpVTu0oQP;7qx@4-`W?=SA^qElDl>!Q_>
z(IZhR`Dp?HChZ}vD*%6731l>hfyRmVKLLY$Y$W$i+T<#}`-t_@0aVPuAz#neOwErw
zX83)Pas7boGKcx<1}BAvioKHu3Vu_3Ic?5}9hV~io#_38upJ7?AL|NFakWZ6EUf#M
z$$kVM=l-R~I~<<w)VmB_aAj^-tsL7Tm-e7dODYCVN_B+@XFq?OBSq@^my>7T7JJ`5
z!hiRLW+vL6Vp5DShNxKwz;s57gr0!@WA8<K2=uAhIB5QnJTX~)@o(XO{ijd+j~=PA
z_S?Y5hxO!l;UDE&{9`bm5Ot0|TJ&QL8e8D^XsO6^_tH<ggnY)*L!lHr9i~I8z=BT?
zIe_5J=bD=0XZwG$F})s*tqGn?o(W6yl0Bvxg++4^%5s%7ZSfUl(4#C)FN0`IQ`$DD
z;Qsv~?iuPGbTXz|P7)Cd+F;n@spCIsL+zB!5#F$n07Sp|wuuZ=pmNc-p_&{D<4=#F
z))7QhJfo=apmml6k=WTBVDPwZ(&{XZ;60UViD)D78~}eDnAL~yYN>A6!lqM{f5x4*
z2&XU#TZ39?iU(9nCnEcAA7BCNW+LI7kF-RQIUks(<k?GYrT!#K8#B=vMw&<DP|QFQ
z{OEDna&#Om!O*a*&mWraqBBX%9|`+^g>=)LB?r1YIez>!W`$PsU?hbd0B{c5)8ns$
z6Nk@;ems9FSgb-H#^%-giqmdV*l;&Iq<bj%o5HQ}Y9?pZ;-8eV=Y0bZ34EZRvIgNP
zId*`F^)EFWGyW!BN-rBjAXMe07nKFiV|F#BJg>r*h_;gHGyf2+8zK@U;hk*=B4p;@
zR*gsm?jORxK;{gKx<Tm1ewo;@=2P(Y^|%3qcl>`SK465%71UG#*hF^CUeW7x*UICd
zXlaIKhY^!1`hc@nDddLZj;cN){u4En+Ae5z+y*(DvJzjazjeLHzWQY&@Zal2XF+-f
zy^qU!)s-OMeb&`m*^J3-Xq^DzNAtNil~?hL#*`%M_R#$iiMP$QBxHrvyKE+{hmF<?
zmb-r>now#>CMM)*^+Af&hb#SwGb0|4czE^G9A2ygS8{{G@7ocbGJ-F9uIT-r>YC|}
z5=XXQHk~x*)9Nkl#ZChOEj1<P;k;cFcYeHf6VrsZ!yD6=q4^UjT&f{UpNP0UsW0aJ
zu$Ox$C(pE6pmgXDB&0O#ncFPw8mTXkM}L0?kPvh)oq%_HW(RshL<86S58d&~o7TZP
z6m>uU)aQNj%=lL@l*b46rJ>cZA<$vk5(y?i>)m-P&NobUncyF7`BcrBS4WGw*Gpe}
zZIYL)dc=-R`mohY`%>|^*mm4J6*=YMoGt0i*QYnOuMLJ3JX{Eo8}>tZSy+`c`+k2w
z2BPTn%lE8)&%I;>21R~G4*9r!YAVi%EuMGlAPuOBb(;%WO@{JRdpkBXXj$o^zcUl}
zu(+Kbs@v8_5dlMp8L?Roo*J+$*a@Ch(tP{&?SDz1w<X>Ow;HFsxc6Sl*#6Dd%hmFk
zAk^yl#!eXipElyMqk$wDAp`0$PB?$&I#O?EJU%J5fb<21j3t0(r!}M>KftD}?Hw6_
zq79-1o<oe+f%|j6bX_hRg9YT<I^@OhZL`$xR7f8^4$;})!aw98$jyUB8r__@;B7vU
zmA&aBv}nRtO2B)p<2Y5dwfb@;qK_-58$P;^brKTx2TkW#j?gb2gLDqXKudqA$Tkjh
z7|5+iM7e5~!9F=+egXdNniB34a3y4~>l5E%@_Wy$a8_Pp2}zyNA0m%qe!X$~Sbs<A
zL&D0U+y1O#pg1h_VCS<zv3sQ3AX_ObvCEL>CK)sGIhhPErp;M79dh?1{JDAWZRv7!
zdh+z;^W0efXy3tXwb+*=QZ9eFoyoSEyDO4kU=ECMD6OM`=FMn0BB=?d<|e+{Fn>o`
z+u8Z@+MKP%Gpw?LM@AeuSmCt5L1GZhSCYFJOF669n|;+MRxQ*FX{(vC1RDgdCQvzL
zt2A+lOknMjUE5L0M<NmuV}`{yf$g#*`k8-%q?~fWJaKdTM+_2?9Nm9drpXc=b=Gv)
z5Y})WOoLBwaMO~|kBQE8XRC+B!xxW_UOpav_w2>*Po5t=d^~*d_+MWgzj!=6dG-A9
zi=#(RkH0l6`&uJxw-VN?4Qk0sHhlNqZG9v=@w32?u`2Bd(YhWNM%Xb{Vv}L@tVgDF
z3L#aF1b;kd3P?PN!0>;*zJBWa$Wf@4`mFP>y);hds{=zis(4|4v<W*FTEkGl<9dVy
zA$XI(0*=Tki89I)k|x*scgfC9wx4+_JT?V8{}^kyYKD<|awbqFJjL&^R4zTLDp!r(
z^C$~!cBq>3W@FXJOVq)04YOL#%~(-a{aP+@_2J$|I)hFl;^u!D+3cQ3#&QB;yvx8I
z*J<-2)<%+?yUVh9FP6frTy96~bg%3~PJEIlsU3NlU|}(4fnKDdL^Ir4nbwir2lY!y
zQfy^q2BJ|kA|+GW<HyNq&@imi2|iF}H+0}Ne&6=n@r}PD871;g=AzqeIXE(?x%;&T
z?y?DXCb+|?WW0Zc`ywOxP$rXY)!cbswr9u{mJ9iAZMj`O>E)$y(JkboOTViOMO<cr
z(;KO%m5g_t-O7W|LPD#dZ-!0?v}5<k9LU@hoyvAPjdIn?bVq+wF}&LRd<x>f-;wpL
z_|)TiODz1R9}ZD+@bWV4K&W#G-$hkAGK#V_=xrs_xgUR3&DE1S{=p9tJl^eCCmUz9
zJ1D;O*)^Sh0fN)2P?Vm4QYJX(jvMayq^zYNLlBc@u$?1W5@o3~s?69Bs%|xPqgm2K
zn3(K=J^F}Be_xDbd%oBckFszxw>?^uoU>ATcO|(ZVmvTILZ0=_hnK*~g>kJcFc;5<
zuM}$IQ9^&(U$GmHV7P4eWR>*kUnM$VvIfiQqFhd<s`$&)-N^Z!6Prx<Vp$R%yt^5f
z^&%+p^-4<Ip`Y>2#I%AUq8W-k%f?1)Z|P=ac~D8fIDFq<s%6s;dTzT)^uR+W00G}L
z5>D7=!B|6J$=H}v@!g9y_bWx2kn|O~knjclWuJcyzAwZXhm3%+01qRx`eNRFlNgAB
zwc~?zgdUrqjLoSOC7$aNWpT=>e898}F;`IphyhMIOC~Zv)7|wV-49i*ls8ym>FLSC
z<ENPu>fUF=wwz7*?si<y{KW~{1P#6=kSjIu{KsO#T?WugjQGt?Nu<sLw?M_S9_2(d
zO^ttV(Z|C4RD@NF-LHZn$w;Ey_|LnNP%C+KEe%S^RE$Hh8=uZH8Ln{skF8)^okFfO
zYYul6C`r0KXff++bP=n?guYi?2HFpbE#q@zOVJapVlJH|u3aDsnyt-FYA7t~(=%TM
zb09CgNryF?XxDNY6??67@{K)4)n9OQdeVQ0o}nkZFkjDNmRn9ATX<W?nK`oAk90km
zI=2U=0ap$0+)w*owFQZ7)pRVm4(SNBKH-q+@|q(8GF88Uw)=eY?CaxihmW2;Jv#pO
zhHgH3a_}{IW1m&yL+T>6Rv?KK4K}XhHw8X+DF!pqGs=1AdKwCFTgiK7%!|=~8R>sF
zB!vncDNoR$Hr)Ex^pn14-$Z!P(?p$&ECa2D(RBLW-j89pF(sT<w<+xHbrSVduN%Xh
zo}Y|}FE+Ne&aJV92pQL`yp~p>_NAFM0Nm8B8&kFtoa*4@=;@PfE_U)UQVH((K!)a|
zC{qOIlv0^V$E~dU$9H5*u2%@BPMUvUZG85Yl0+bjT?RU%KNjFQF2-fJ4-rnDCnI+S
zt$;}&^Vm1R1DImC$k;^;7w1u;CTTRVu0J`2H`vZT&XD7%h8jnIb)2U3<||`&wX!el
z|9D=aI$$q6COfuS+0Y4B#4^AEF;5WtOwP?>A-(a~*^3A{%!@Sd0pD4v(v*K@nw^3+
z`%)vlSVU0&@aqu24)JR@Y{NGZok@_@0-*p+Y{Dq!iwf}hsALS<C1E;*;hu)C@)vcg
za=P{IzvOFgKvmzH2Bto~)=Il&dC?Dx)<^F%?1HQg9fQme_={0aQb(!&S@KUSK2DfW
z+%GR2Gxb(u&H725VkxVnU`~I*Nl=VurI@}ChR7cZ2Ngew0USgzDwgwwWesO6+LF@d
z`NS-NSI7S56Mr)c&{P>HI}=qaVbY*Cz4;uH685kd*ef^WlZitSY{qp|sy5%sOjl16
zApoE*tfPVG-?~ok*#S=x^cLsggU2Zzj-pTL;%y(qj83aJjQLS>TR?x;(UWtx*1~JA
zdJBhBB>{4RsnE#JtLB1QM5m(c7efZOQ5lEsf{LW}^0MmI#fC|+U|C3}m9DAWKq)*V
zT4+A_1FcjWLfAEP<U)upk0T|pLi^Igi}crBw#aeb1zi^ScHnKAYkloW9l&kQ5-k+W
zeLbCksuFO4Ekz-5$9sQJ%`VwWgcN!$2r{Bq1YN6D8;LO}DNk-Ce>z-*x*r>tkf*_1
zyR4=QY|tbEs!IGFHF;EO>9a9NrAiT);J1mNEWg2bqjg}a+NaI-ghp<6C@mg)K_9X#
zmCWB;c860$7BX$tZK#5WS==s8H;6@$Uxu4PDCHeEImzJ-pG|+%(OQbQH9s1CQ=s}c
zg`jc6KKs#8Q^ZZEh4o?UShdG(PMgV%zD~YyWR9Q5*f(28wE<Ja7hA$Z)_@`WhH|e}
zC+cPcNTnDs3hXYcUrFye4CgKAc!<M%OG4`vCkl@HWz!(7u2&o_mu0X#q^z7=<7j@Z
zg>I4b>@5j3Zl8aW!jZnLS5r>SIF^^Nnji`1I8h>{p9?HC@e>l_3TRfBRHNQGl8~r8
z?P-bfCz2!qfDpL(IlUTG=u_YXc7rbV{B*-+IPdf%k!}|$?-lED5htisx{}T*X+KHz
zr*?!7JJeH2D4_NH%&&Mcwp={ia;!E+On2Luft2Z~%<_M-){U`PRRChNG5Gu;u$+nE
z9RByW$S59WxfTBb{{!H2U;bD4zy9O@$9d`L0;+T^68>rVc2GQAFPF5t{9n>OuNwS=
z)=Lh1@t<m5@0qgjC7Uub*@F>Q7R#U^42nl`vZ8^HSW&eMr@D>atvw#lu{8}kwVR~{
zUc@UEv$B5*H?DH9TCfgD<7S_>^i&=Ky9YHidoWyn@!5Xyvs?G>fA*W=F{FV0`z!6$
zOk22Dz>O>AeCuT${?EDwLeb*QXF&l8)@{%k{yb$zt*TE4xQ_B%A-DHl1kwuA+O}BA
zyu)H4SKN+jo(AO&Msdss|CmiwY?73JWCdxCMaO?heHb9!;FD%TsYXuL4~l#>GrRzi
z)w<N17bGuFh5N=`3cFP7Nv+1lbyemzFPvS&-r~IG*D}Zd1UvUPQ3(ZL$I=KosTaAe
z&xmdcoofcY$zT>uh$a-q1t1E7yDS*3H5sZp4|lDS5RV3$s5x4>X>`tXAv?U}F;ke;
zb7OxddzM`TGihy!U}08KQ#@Bgl=F7T7#63Li<K8idGyD-;t)*LylOUQG+~4bPKt6)
zlitC?f$k5>dKeq;W!0aO%k4fzSVGGx@FVmsB4V;OAQ^iKZKGX)JmppZG*EsIb%pkl
zPvN@?3G0usil=`#5wK;Jq<H`vsNU0hNO6BKgsbS@@J)+>`hH(tuDanMax_iTqzpxa
zR@)Ej2m3QYJGtrcUl8!*riaB2BpsX*p1`5)WM3X=kYhDew44pN?l0jHDvlP5NVL)L
zPO7y|%f;gTJ|@_3Qop^8!rxJ$!XE3u7$V2oaH&aj$YY=%nwOBIItY-2dMLtPsvCa-
zFEraGIrpbIX7~q4ScDfVaeAX1<ZQi4Lbg|pTHG<cHJAo2@i)!ySH}lO&yRZ&tk7DP
znSndRxwaC2VU~$UGxycmg1vFYKCX|rCeNzNa(ZrB_9?Tl4kRu2!xz^>hAh-zTy!FN
z`2r<KWxf^z&zpoKz!Rw9|H$%vZccwJL6o_EHjH2m>CLcCTgm=V_)?!l3LoH3m2j0W
zgim2`Rh=!0+bE}rGX?@R9+Kpc{Mx5{jhfF#;bX#`J&}xR`vcNTPsIhn4C#G^{7g<(
z2B;$;DD#haNOg5RO{?~CVn4&d9cGd_20`UwD~~0s{?J`mA3oMSy{JzPr}cl?vRqy#
z{D)A4>OnY#Qt-i!*ITj#{phMfSqmQP%VYbg$DCdX)RrNcGuY?LYJrg8e3klJldOyi
zY0Z?509SF1?nj!KcbVnL@lU!GlWxRZc{$!v89QE2%Oy|mo4Q#>e}e|4!krU!N!gl8
zDX2!k?+z!+@?2<AE@WL#bA5kAI{v+>eA(J$cuT-33wuH5@t)<#33ht;j<IEt(~*R^
zs;#yX*XbxhIchBx-`{5Yqt10_ia=-T08*)6&#KmLqm?n=a2uZQ+Z*SLvQ-%^TPku+
zI&%wrV#Ng?i!pU}d~MmnQjGv<)8O57KS*Gj?<`qa(=}jTNq5TICy;-NliN|4Nx)iX
zbSj+xV-kWlLm<K>ll>)M#NWA}H4V|VL7$>l{i(4zAD}Z{^2bK@*q_#|Hcl3cgxLYo
z!X*aY9Ndg@c2c2LKs(3>2Al1s6P|W36OuHiLHDzB!$#@TD|^ZURX?+}G>4y+Z~5;y
zW$g{$zOOlaVQ~n&)$)INWfg8(glctFsiSb)9Mb4yTq9zfO=ZQ6Gz@Oo>>}cYPU-)z
z=jY2Z&<=9Qw6e*f1ixR03C$}enm&Gb0s{Ls?BHa8QVKeQ8);<0v^P~xF3b58Y9Qjp
zZz{=4avo?WFpDBbaLGS4XPaA_gMQH^s7qdGX48jv`jN2|E_Hu5dC@KdX)EGt<qq$R
zHUx_^KE^NxZ}8v+aGIx(gMTZYd)EdtWwX9>pWs?d{CdTwdIKM8HGdo*NeG^@n5?|j
z{ae5@U3CrxAJ{EWtae^Pf4ziOHz^w80MySu>-ft*@M-yW>rflVZDS~bFiD*Sx5VRV
z$N6vRpW7M$exiS$_Xlo<Z^)zNHPz8%LueqUyWwhrognoBl;agLFvgeYY%0DR4Q=Sj
z=Wwsu1PIJp3p6;Y6QD`xJ8Wh1kHx{ySD^ToN1Im?@IZ8#bgr;}qt6!%Wb1Hp<s$~f
zaFIoIhfA)cW4_PPbSqy!O+!?ubaULuHAZM}Gv`&p+~$AYDFr{26spZk65FiJlIcGV
zWPs22V||Mtt68ibQq`t-x+*W;Es<`a%qrYPl~z(t`{qOH|9M@lD@}`0Q!6vA%`o+V
ztLwdrpPs8G;lg3YK6+l;s#Mnl)M_h*wv$4#0L8KRm7-ru+NSo15}Z}cDHT%J9mMq{
zY{_{D{!D)mo0mK3qI|LY(|fx+Iw4)IHvD*hcSj}_{{3KgM^G^^sqpt_yE{xV!!~@e
zJG=Hjc6WBF@nsXF%VHrC_NVbdFtDF?UWBFkX*!+aY+U?QUc3v1DlbiM6ptWmb68B~
zYoml9kYF|0c^wvGyqX%5O`0jF1n%og`}rIDeRO~232$h>*qB~_Ui{R*E;e+G>%Oy-
zoHY^qxg<%B-=?#cnG1<{=_`HsE5+bQ3Tv-YL~3=Ul<9fb#jz^&WGYlr1dRg_-%3ni
zzG8_>`lTM%*T3?iqyd3HEX!*Pl=^ZI1Gm=;f}r3OdB#FHWd^O|fJnK#s+uppJbI|r
zY0Q614gWf;8Bmqn_9?-)lkcI+B6<I!nMmV}U_fGyeWri{8#-{oNu0B?wYWo8q!M?E
zeJe@>=Fzje0K$bhBSu=~A5_`FYhU|8-5i9Q`ULd>2Fkc;SEC3-li#Vvgz9ak!SW{^
zx;-$$tX2oNHb&krs6K1oFQ%3npVH?Ft%!foc5yG{R}=`vmpB9wmx$kZUN75K8u?$S
zUHS&8F|(kXhlQI2QrI&n>h*L|Oe?YPb+u;oqz@z%z;0Onq+r~|7X`i+xb`%hnSGW<
z9{Ux#iVA!s-hUTS_~-atjoRsTt~ht@AKklK{2a~C)G>(K*PxfTD}Ra@EpzpzwxfR_
zZIS9rZ{IzD^z3udjK~8;5JDt*T7pJ_zO|<S8hQy@9M7F+RcGmBBSid1f=0eT<;tjA
z=fIEO19mAl3`Zguef2rvwwO6@wv<pP(Md`vi#iK8^(Ay8Y$LE6L76&d;;&P@!>4+C
zx^x!w-_%m)%)UI=E8^X-yXyr?Pp*HK4boG>R+r1Us>{>n;zI5Gi~y;dNlQUCw`-MN
zdzm=|lIY{x`$BsQhjicg+VHN+X5MHBCt-Z|2KVp(JSpNC1%i2`=j9;|qDO%)*hDz0
z__6L~p#0+%zy6zQI%ANA{E=BG?ErCMI7<#84e-ZK<;FIO{w25_=am>tFTj7?j^>ju
zm8~5XtK~XM6?^SsO%IyxI@}W0WheS&3XFAt|D%Hy((v-Eo&-^WFCy(QrR`7JIqlkD
zJfw$RWC1-YFt;IGuF0Gwb@!^2dU<xatW&TC>_J!?R^$ZcG}!UAC>Qk~r0d6Fu{<ls
z1B1vA_hgVNV0~}y?EoYCkY9hXW6(=jJqW(TM0WSZU!Yeg5)X^tx<L0If476ai%iT4
zQ(&1+Sl-iJ_^EdP$mYx%z{am}e7P9T$Qdv2P@+3=;3vC(WHaLBT3n}%!xIznh>ryQ
z#NZST1OHQpPU7Y;Ig-eZ4K|L>&rK$vv^f;m@<f?&Bk~F|t^0|apND^!<==(R310>F
zga68B{!!gvpRi|2bRV*HeHG##u!Zefg7?@(dDn@+#vMs%r@!R43MZ!}pTGMM@(8nj
zQL*=PLVE8aI9ud*EXq#o2W$EazE(J3GmQ#svqWU9^EnY6?2Len;pW@$u(E6yxO$pa
zh!c6C1=!*dG>=l8_I`g1wueox&#!gx&KrF^`oqs$iYB&!Y0($-38%{pW%#$4K)SA6
zfG5`9mvaXAn`Z89dA+gNKX95`9FSV0r9a{ZvNADvs+ztU!5b^ev*t||EuYJJRqQ@w
z$m5%;oUSf+iGeNaK`?WXWVv5WbkylJ-COe9b*5)#^MljtQf_}51|k?{4lsx+xu}sB
zOME!%Y69d3snlItP0;BEgGi)b`^UXo#s~VU+x96um32srOHfU@6XzvhKwVIu$EI>B
z;}5fMg+|u0T<AK{+S$^E%I36b^;2#Z*(tNqfQO*}qOcNSz~(1n9n9FTwpjqQP{Z@-
zT%_wLjpK8v3&VeVZ)Yxw+g2Pev|z>C>QdP1hy39=IiKu5`ycgx+x&h%LU!hVo=nky
zU_R=@CYU00MT+gAn6WJMiMYLXeh#1^zn30g*3wn^szhScP2-V&(zm20V`&Z|>m=|$
z5<T9uj#BF=PKpm$y!WnScf9{ORxry$7JC*SZJm>(AMby5qI~b7dTuiU7CI>3Abz^+
z1%NPM-<MC>u>Wz^@so)1Bi7N5H-Y}%x*f6i$l)Byw?lU}cP8^i^6z|r{r`Y<d^R4h
z7bWuEnY;IYun%U73J%d73_l=UUE`L;-UJzK!6e=9$ZK7O`=9?GT6IiAEvSTW5~;_k
z$=_T8L$ZG@?tLCs>~o1dKe#)SQnoj6#h!=LAK?s`45%{|hhi(OF0Q2i-Nszi%@3rs
z$y$4UZbbUjjf+CF)&T-Mg@fpb*O~1&xM3Z$Rjl5QtIk2Z>7?)RXRc_nj=%gd*HLEE
ze)JkfZoHCmJnEC%7EbYSSC?9orp-CVWw2osA5(wBfoU?qz|VCz>}rDf?AogI<I;WP
zxsD@;FE~)pJcT>BQGll>doMZKMIYhkp`YG^;`9CgH1b;1cEsHHwdN!#K3RwUTajWf
zZbUkOLVxX@qxjlx7{6{6ZbohQ^(yv|3N*b;yj{!x=mMOi8X!$8nqHvA*yU_zC(W?Q
zE=hm;gCtufa+yqE!TK~p(vS)xp>EmhB5Fo#cO|Dpvhcvn9`Dv9Fk8*J*r(ZSI_x6p
zpyYMh<tlrd#b478MCCLCo`8pa%*JI8?zX+8k6AX~8|`}mmpxvI0pFT~+>+@wQ!(~N
z^lgj?IF&@B6xKL=6dd4tmd-Rv4yZ-~k^_G{+P5mmp42#Oq=~U4VijM6SOeZbeB0x5
z<#Dv{1>GGTb4E<u<8d2e%ZIw<qvF|%{QZK+w$cLK$-YoXY-wxK;D)3vNk`cjF;0p=
zID6EUuaKQq$7c<CiH1Bp*VUh;A>i@?1)+jAd?`>}>aQ+~-Kfhz9su^NSy`b9fF*xA
zihD$7RcB*#(WyBhSnp^yGOiM5Nu|zkOB-3!&)zQT*A+2;L6BaUJ#CuTt!0i+%T79r
z$gI5)E=aeD5wjT)^$F`y<I5o1k@+DC+3U&;3=OF4S&B8{$ncwVKcHt@2qBg3zuh<V
z*cXn-HY10rprh^g3qp_Hw@+l?jQD?4!e;y><0*TQJV#-vw-M+52a}zIHaJeW7)ft$
z@}W{PlGMD|-Kq%z<M{LZD^UzV1uXqcPTC0oRZM4VbhS>HNb2TKO46MXjtcRq3v#o(
z@%pyXEqNJ-+!NJv6m(u)J|AHSRyyi=1$EGSC7q?z80_9Czjqkav*KqzD>{F_27PVw
zM`&-qE#jti-kNONyEI$UWp~F08=stf?hl;u?}{52DqEY6p}H*}u#<6uHQc4Sglj1c
zi%ES>f2l$%%BgL)ekEF2Z+zvJAH!D)Cn3iOUrX>MHlu6Tni~M<49%Bg)uTz`HV7K&
zzP4Jj`X`JiNM(RDZg?8PPLO}$Nu$r=frdnjr>{<4Ldpw0VkOTE`Z+T@ItqLtZ6m_j
z8c0TlruC&4oh9`Q_z;JVuIN9lXA9%rmUKy2CMHcvzr`R>_@M2iqE6Z$+jdav?rRhU
zdw?d)0u>7kqo%rx=9_tigk`}^6f^$@hu(+tr9e-=92BC@kWN^iHD-SWBC=;h8f>Lc
zWkeThSQ$AeG{)|RMB2@oHJ9_!03;9<u2)ji!H>Qag@crS(UgRdq-YGA&aF}IpBOiZ
zd6jZO=4|hI4U0-EN{AuVs-O{}8nqtR%=+kUmN9IxfeH8&E}$D@{%$bp%?x;vVtMYh
zN<h_LQE~_bFQ!g!D8GLS8h@ClN9zy>7|FjP#LJgf#|yxm3iY^Qna|`$QjX`0zpt5~
z-xw4W*tl(M#F}c+tc;$ctDUvN2$Y8EMj(iy6sK1F4VXVjAiQ@s%kV1hfBmHZDIVOr
z8~!xlqh^k7amFtt$mgkGWotQRm*ph(Z_}kSqk@_T2hyUJY2be_)PpqdB39|Lk4uI^
z_sbzDwH@jX<oTWJ1#!7hwG}?KkH(bkelJZ=X>)5sxAThWOj?{Ef<d8lX8b@r!ya?7
ziiC|5mA!o`$Q#BO#xZQv$J7?T4%Sohf~@{K3^7+t_Vmu3?o)T}#00cyRW9d)nRQ1Q
zgrzyC=KZz4UFd(be-WNKu<r6=uo>q@xLCSk@8vkN3eAw{*yx`4hLzSd2bEK<nngVZ
z7L)jO>`(3SLTH=hgTM7ONVyU95jQQ000N@ZdW7eVhbL`vt7$+KVxrwUDvYxA(=Ir$
z*7)fv%$f-jKaY%}v+WPt@ka2{mX)u<wLH@+1o1t*$$Ebu-?^j5`p%tV@5{2S$ARzr
zcgyMn<wu6WP0!cuWw_^gI5!aX7Z*wEIH{v1PRvsjkpIn?2Ay|06-kNbe*JCdZxWjN
zn+K`lzp{UZ5s@EIkB5u!{t=unob2BU&gXA}x~D#9Muget?phZ|31b^6oMyD}NyI86
z^kszoV()*%+9f)c#Zzgw-Yd{O^AF-N(&U8V%XOH=ar3hHW_@N^QGM{0N)UkdS(C3M
z`bqPXf9eSP;#VAb5{0j5BzIp`{D;MHq{zpziuVS0KWQ55<JOlStb#M$nA3M0y-$0g
zGPi#GE#{7djiMs_&C8e1w=BtYy168Q;mLmz32lFHAUDt5+5(SX2MT%3_J6MrBrUG^
z_y7L?Y8oIkq;k@qR)BUfz|u3qixd2#4eF+#mi{dqeS%Wpfb(3#nE-xxR>j)JJ9j!;
z7S66LdeHGXcRP>*nRZyj`{kEE+#B8<Ng^swUYZsTlHm-~pO_KEG0}ZfFbG^4FUo6b
zTPT0?wZ>E5NFXH$e69Y-I(o^;wNvsuEXufEl+z&IyybxdfScUexI28c<)(RMX{89u
z&0Nzv{SHUhprV+hy}Q7pK_&gH5OUCkSLi(~2s?5wM5zEI7y~RshgOP_CM=}Ymqc|x
zo{apLhf^q;o4=e8DPbf!uY79yYP6cH1(Sch%+aj<(?Dtd71i4nfG=A*`IwbV<=%_%
zk6t{LG8)xSgpT2N@$H6Q#daKuQWryk&BBy(>$<wI-6&?zX{e~Hj=lwFT|90wP_f5X
zC!|LiZ5aEjhO7AmKxSJ-drqS*dW0(l%qN=Sn4a8hJHyS$66$h=Ln-B?%j8hE7RG<@
zVK~<F<|>Hs3;a#j>Y*HSai|DS4<9~ZzgGX=dCo3m>3}f1LYR(ud_hWMlAPm1NQn9@
zDEiAl+%D~_Ty(@F>-IO<<B!nC^n{?Q2QOsyopIuPl3C-MgWdfiO@%t$P==D;v|Y62
zPZO*<UO&rz+z<OdX6aLoMjKn!*V=zK{Z^s8Ldu~)P<9|>nMGj{s2Y|(WQV48T=1NV
zSxCcbagyJiJEDtJrb!*@$;ea<x)T!GOaSabzIz?IT{7NrVfYgxy}m!%A2|A>HXrJ~
zcDpd@Nfp1&Or{Xj0mPVUtd=yVyK^UOF?=S0Ce(VO9pXKzxA6jYD<fbfyd!@Cw6DEW
zbQe-yh38Tef+M$VT1-3wCK29rDy^P>9ITg#r8!XCZM-9VfxsTdzH~DwSScR-`+xuc
zets981h7FmD@5?Z7N{?3*cF6~xLyEZiG@eBPp8%SO5h?pnC<<DncU315T2-6BhLr^
zs}~P`-~X#J%pv&f_oKk*0vCTCTVENS98qn5R~&6F0fE}*^`F;t-GMxkJBETOM}l|g
zv>~wNd;;OG{Sk%2>Z*xG%$T{J#duoQvnac>w>L?(l`(tlF*QbGZp9uo1kp~gdi#=c
znd$IkksUQOS=MEBfsmeZrF0G`6{yZGk@frP#gia`B!774uW*hHZ4Q6mAC!w)dCJwn
zU(-+j{vcm|Nh5wNII)Kya&r}~iqZO@3`e6nKqSHp<Pml_c1Rgbs#!A%loeP|^&zvt
z{Ri6ymYF1IEASn)lJlP&3H%-uEL6;A6@BDK?5j9MWO-bS(qr)lG^8NU<WQqH3_%OS
z?eP`+I#5T8EJn|szdV0__U%d7zO!&x`&xno%1B1bHN~*`q>e;8RQP<at(<uKUX}s&
zMZcPe7D>UftWs=nHjmaW6eN$!^8V+)01LYOje(va#p5jzx~=u12rO6ymgA6-wy>gu
z^#X{C#h&U}@}`=gzN5MoRZMDUMs^z9&MsFXoP{Zdze@H8s#kxG%j~xjcC#4$*S>vJ
zU$s2saI+JAAxac}ELhYP(bSr`hLwr%VrrVukRHg#UdIav86KoPO8^f$Vm*&D?G0f-
zgR+Ztz<6*jj0Qfueew;dP8MY4k$1cusO>xWa@w4Ut~D7kkQZ-x;hli&U*82GU!6$n
zlF^`e!cso6*^Ynyyu8+FMfZ*sJ0}~d3-D08)CuAgtt>Ylwjj>snBWO;1<dahTTTJb
zi72PHZ@{*7-BJ1t6P?;4Q9TV=Kuba)ZB;3C7Su}|D`B5mO&Z817(B@B*Sj|@f*}0F
zH)E?=OP`Y_a0bAFYGd}Bq->x~jv3C<dO7FA=jV9(bya^Y66;LVhq=HUi|wN{(UT<r
zPw?vXOpIu+6$>ou=c=pg7(+x2PsdC>k4gX{9JtUyDnw=#SaMKaM+U2`l`BRDJj!a3
z29aZB^V-2X$YF*UwDrzeJxAy%WrTZD=Ervo1@3hud?u?~l{o|x+TUfEee#Uqzl$+4
zZmf_l7Vm%GZWWgWL?c?JVIu@V!LuoUN_+b7UDxw*4FADO+S7L*qLgyK`0Gwl92{)U
z=%%Hkir{^&N<mo{lvC-1CgTPEyQos=KHru?4bTtsipglX=B#e8K~UyX&j6g*(&ahG
z3ms8B94+Fw@R<bLX)tXr_HN6EF|2*NXTFI2->`pjjTHV@sSyPo2x~9C|IN<#vEu%f
zf>10FEaHtgwHmQV@rq8<JIFCUdoWCY%d!6~-%BlWS#&E>mHdyTL<GBy9u!|Z898Y~
z737L!cKBAAUx@LJWV5Te^uQ}h_E|O%RHqNCm%7REtuLTc!=5?3k(&0_?Rt}t_Ps|+
zexiT$c${xNgm__{zpLdhxFF=vy{Nz91{|I4W&XxK?}PVAw0*urQg}ArqCfLB^=$Js
z_>Ip8N&7}BAK^g2r;pi3X2qH4PeRgR5HH?JM{|9njkxxD?6e+qhF6)=G1TuK?Lsfx
z70J8{zs4@7B$`JX?tojAW#lMZ*Pm0Ze*b?r67_~tr(945n9~ab!QDBeyEBZ1KML`E
zT33?92TID;c4d1$h*}L;!$eaLgJpgxQ(KT%U?MhIgDqCbhp^4`Q0)aC!NCs6I<0*3
zHZ}R%J^qw(Sox(6e+c!;->pXE(%&$R&Rs$||J=DR&`am1gmOApIz+VPs?bySLP~!h
z;p?z&w~N2wAJeIRr4m7S@<j#f`?orP4)i;@D{g%EGm>r0E`7fvQmH-<XAdhqz!Dcf
z`Qi&(<$Yax2<R)iZXYj~VQWT@-!3GaRc0YDK7Y}KE&J(T<A~pn$nd}4Nw_|T<t;Dy
z;c_>-Fr+(T7xd4#n07%afS&`o(UpHcCpymUo(;*lWcNH$>4b6j6X8QZDsR9xE*FR%
ziu=kwSk*(V5JzI-ojVWZ#-Ioq93&2jWXX!$47|)z=sd5%ASP0!IWfD;StD)d%6ZMy
zokXo`*XQT;TlZS^uV#Inap0^QUJUhfrJj!mzZTDjmpCn~t%azN7~T*?t_6R=BguOG
z{B9pltF%Jvw3V7sI*W-N);6MGp7AZyS{fjA&^sMvi85-lsgkN37NKp{h~)&sW5omu
z_9$@|cQ|JATEo0hY!0HCJe5F(^-$ULIigXLqGBYn$^E(qcMg!g>IP}9Ysc=Zn!y}I
zI1);4_A5*NYyGC2f{#k0M*4pR#ryb;oBHSMFbJl(hSTuS>YbU^kT_|qQ|{=)oHShz
z%}Aj=%GE}PT<S-$yE3<4H22&K(d+2B?T7g?=rf!W>MQYlg;iW>51NgzAv|azjAEP+
zD?>GLIlEzlt=-Rtvp(_CGZ@ef8}#y}$#z~K>Vm!{eLjmlsSA%vG{k>jIaQzXh6`0%
zn5qp1mW$7jgUe;%rWT{qqyGO{_WyFX|LguA|N5Z!`Q7hDZ4@>wPAowr%@S3t(W7)2
zkr$}P%i2nM8ASB8b#7xnGjmzk$k9|dt+FZPkpsbcy*uPRL%S!*;?eQ?yrFOJ+_&bL
zNkazB01^N-wN{f1oriycL_Znhb!-nO<LE!MU#CD>!PS&Bqidzjn&IUsn6R~XW1i#!
ziW}3i3<q2CjdVeQB<g8>nt$Ds{9|A@AiH*>EhT=PPrzIx@kwG(iW^q-Q~4q;WXvUL
zEec8?RPG>gibMlT*P^%K2~3*s5t2++!$Lz7+b4{s4cIK1S`UA;xdzBl`nvOJ^FQ7u
z*urV~gAJWbNt*=#C8`PoRc|b!Tr!&P({x8cc%iJ8G?(bMjbLNo`eM$$h8(w^Ayi!%
zcoG{%5&Gafhc*A1wc)N5gB!RCI5E=6&u{~it>P^L^{WU>V$?$nG)aqFkCDa3c1O>T
zCBZdtEiidab$oxwozNLY%5{8P)HbxXv0eI=o{n;((B`;WB2(DcJ#M4oJ+{R=H_yBI
z;%7;$i(42o$EhD~Y}#f|5}UUk9GOGXVltiDiFYPJce>k>ENLEqNfX{K<v)QFC#}A|
zvN)lk?^D_9NhA-y@7mqFM8b#lA70o@i5j%a<wy0veGGpr0JO$OF#OA=^C>;`9AdlW
z>1<QHH`t;H>WH8|V_A2}`}AyCBRHZ=PSUP5wq7>eUW7p#?0XAG$>4TZV%}ksEF)P~
zLqFD?VxH))?s{SV-e;O^+DdiPXnhd)%CbIa;lDMbZ#bmeVR-M}=%ZPHmAoWS%isdD
zS=g$eBnp2YxQU+pgz%)M=YzcZ{ilPsz2|ILug#mjDK_Z&yB-g|rh7O#O?y7+Xs~gp
z9gK^{f&!Z-V-k<eh|4}I0<#+YPk1=EtXq!8FZ^WWr$NV)s77p)Gn_ZWc3O^K|3@AR
zkyjgMgWviA;sdw6Pk7*-|5(w18Egm+{FrH)A98;{Bt4D~-+W5iBs0bqND59cs)6rq
zD3u>2Nap36`XWKj9T_sxD4s{1hn~h@tjqb5c-4<_YJPJ1FuTD{jsrlqaFuFQkKa2a
zxeYGr^N%@nqjI$Ey#4AIpWRJ_k-&S((JTMKXX^0qa8)mg6CRsJFjWtV=g2bSEjv4>
zH(r0sgP)&siH3S(u$A_u;25YB#O$qCmC-A;_|i`po~b5DmD~2Y%Wc|w)x1-x>PpP)
zI#pY(>$$UyP1`16AM?%2|1+tf+deOHmhfuz7ydw@D?Q>igzl<Y6ldk~e<@*mvnKkv
zDW7uWk7ZL-mB0HBW&rMv2s=j$O|s0_OfrA^MCXJJ#a=l+RQise#W#dAI&W50IEtHB
zu@qlctFjkC!nOJfzWI~bRZcp4oxZcWCW1yFv6+49j75m!yp*g-f)l0)EdD(px@gh2
z$dl`zH|&Dk*KqLZvYHCyda%cvWzx~hdkTCuH1l~}hc&9_!x()^%f+OB9=rgvX5N3F
zHW&4{k8khWEBgA1K0GP?u!wz@ZufQZn0z9)L|=~gs0Jyy2MxZyM?~&qJiC5_oTtV5
zY+8?taQ$_8p>(0cu|1Sk!`axUv2a|U(Ukb*C$E7{r9WTH`jY#%yzckYUu||s68WaN
zLOxJWYl@{#vYrRJd;=#t;Y};a(er=U$rPF8afhvQqtfO}0o>ktYcGQLSi*_~DbG`&
ze+@%U>#EJ1#j^?tC3QPve4!2$RW8i~tObWp%GueZWQhVC)E<j$k&P&OOdJ)Yg^Ryb
zy8Dn1KRMPq{?n?(9g~=Btv>`^W_7tf1CZ{%rkiNDu|PIP<>q$M*CC9Ef}wxH(%rEd
z_ONeff(8aC|Ex>Jv$-Nru&1U5EG>5HXDdu!ill=`M4DONq98mlx)MhpVziPuDpKy+
z+o{kDCLESw@k@tf%I+8yqi@#!Xj6m=x{CQ40&M?r?-u{SzcnK%UJSHnFcYyH+1J6#
zMo0091cP7q0XgrU7CbG_+W3E$(Oh3;&cWHVIXgh=hu?D$hu%Mo;Md^pPO(55?ia>A
z7(_WN(85)3kTA6_&Ebv!{Pc_4ckbMlpr|g?VR8D$PEsmzz@XifXhSEPiM&hux4og$
zw_#b45+(gf3A*z@<DE_s46!6ENeHumkLI(ql9XY^5+Xnx_5Rf2LxF#XPP)%XOX*(?
z<=3J93by3y8<~<1BzO1q?)_Ms9}(a6tHK0OLnQOwXr-%XYzz0u={^yEB+ehBC$Ak+
zZDLCR=AiIg%<I263WyWXs1xBp!n2cI)Ei=h7w38B>;ag0`Hc-pR7kT%msL>Qpgmsi
z>>PQLU-Gj?ytgSU#_@m830)mteEN00`euFhLr&U$rXfwk&5eOVf0|~L4bd4hZK?@%
z=!Q$oDhz^nD&ZJQQAE$%X6+FISsLp--C8L<08CWJN5W?|AvI%GRXK~b@I+D;><K!5
z68g&@jv|Dl8*aX+HnpGo4~Aiznt3hMX}1qq9G~@uWA|+XytscVr>|T8)NYI8#j?2w
zU)*{R+|rW7V~h|5dO_o@W49(eHfuaNxOjyAom!8Rur^DuEhfoziI`;d<`Q#dYv4WR
z=AVXN``$3xn!4U)-`35HVm5*$K2-Y1jqNSbYRZsa`CSV-NUXriQYB=Cq3O!!Np{7Z
zJ7{y+XQ{^I&K-ZP=+2o9J5(}dSj;62;6O;i9K;6%*)V6>BhgZ&Q?fP0P`*2{ke$y_
z8f;RlO7)>I^;u6$H}*Z&(0468(zx^yPad#TSC@_S|ER@w&3Fq&<5!WV$vCEK?1hn$
zXvie)bIe1o%l1nDpD@}w);`vTab*yWUK3hM8Em4>rB;8#+;Bx~e&(|P7Y(Ylw0hOJ
zG5=00h^AFg?YY)LCYpxXDwRuDQ`0j98H_pxp}laGxhdhvwwYB>p<KI@LRVW2!Cs<!
z4>C(<8kc&k3G<rf&3DL3h2dGfo2YaC4jo<2)z=E>krs9)=c}6Gp;mx*yEoc#V<xJw
z9vEEO0ZM<sF_K{iz!6xwBuJ4IrQMnwQUFgtu)i6?Z^L_6w28~f!4>KbV#{xRj*B^;
z)M48}>?C3(2A!dmY(szShY_hpYW<~Twu540nV@tIZ6@$Xc(MZM7OWcoi7k`QD)op;
z15aaZSPXwMPE+P494$zplfZ|O!SH<9B<v6y;Q!8qi@IBX(0usKL8}ih?BP6G<JRO=
zbtdSk=P)KC@kn89TLFz|mDro&sEK$}A}mDtVeT<xLX0BkKgyhBCo!?L=RVi1yBz5U
zYOhm?6h^lL!-?ZmWb#1|*`P?4#(D_S{ASKoGmY}j7b_U1VH!*(3ygZ%Fg;sK!kJ^@
zpIXh|)XQdn&ipYeN&y;e-}9G}Det+6+D}p+SS)>&ZC@PUhG{#c7o{y+Oq8O$;u89A
zL9C4P+4u~=Xt`wK8<APQXGIC7scVYar#N2(Z?bqFwG4k0vpoxk5`te!z?gZ&o+a&~
znWt5rWc79H)u<LFq1P@BdAp?&IVg^b=P!!7QzPepPp2Bj!{dX8j|RoVWX_@_!&NQG
zUy39rBhISjg{B&hvuDl~V8skkr`gm2vx72Q%FLN1hXwUjEL^KmMJ-8Sc;P`R7?A`t
z`%%)p2vWxz@G#*-bvmZH)lB|d2uF#^bxjN9@bIvnpEn6oP4Shel${im@K3=2VMAwl
z?UF}-PJnsy4KZ(0R~)NmqhH<+8U=C6l;j7L;Ht);^njWp<}gJ%i;diAFpMEz7uV4U
zyH0r#WFNV#0JFXJz3LSdVeoAA5?xkYU54paW+k57e_~_89ina}J=5I};nH8|hHif6
zdM*j^+#A+oESi-dO^DOV9!;8rc^HLCOgsXAo2Mr~I94khZ=X*xilrGZl)MzmH1o{1
zK4Hi%77p*+(a3<}DPUUk;cHuU{ZyKiSjkbcltFkj_9arzJ-V9p@n=8mSYO{ek}$y|
zc{|32xaT&u{spnl`gLXi^nWKwzwbJlx@`7taj~QmFoy=t3@}#xW1qjkbl%Ne%r|#`
zEZp)PZwYgiB?5{m7z6d#p9zcMn!-jCZWO;<b$;CB$ot{L<fDKTdgsmwNaze+8hr?Z
zr5vtf1YE;tyMg@SxNHQyuge5^xSxv3UtViAI+GN){FwKPkA_veK96a-H*y*Fsy6c*
zXvwMx1WP%*vYc12jkj2=b&J`wQpeSQvRM!!RUpSVO+86;^~?Y-O&c?BGRB)s5_2s3
z#B<Lb7aLJyWb`>+RhV(cTC4e`$Z+K2_ZhF~OnpW?Jy5}{LOSLT;@p^2x|Huk`0MiU
zuL)+E^!JWwn3Bue7Wey58l<2`u#v8<1kg0(J@L)-!05tv_O#Dqp=M8Z^L`M23&i*5
zy2G*h@X7Ipr{TeHJgvJHb~t-tqbgu1{N#`htT9T3iuu#`AZ*mxt#V^d-)3s0Fg|<E
zMuthG_DqxmaPeiL7s*6eg(OMNc6{}e0dRj+#pzuNIwsX?#HLzy?_-K9`PM*O;oA4K
zWZrQ#PK-<uAodn%vsMw?)H(-$+Q%jt?K+E{9aloc``8AO17h}6J#kkZLDrYIZ52wn
z7*bw)BeyiKdG!7DMDpR`KqY;FJypM@JG#VP5a=uC>)ly)J9Pb9)~K4;p%Ui)GO)^^
zaV@J07^c%}?RFP+Z&--T&JB`D<&rO_I6V2pd0-|qEKkQVLjEc4TBn_V?NqY^q2!g)
z@3i7XKN{c2`*9=;Dlu2=1%5Fw4kTW1ktw`+hO|5|=-H$tMr%|{POo#@7fe{5Y=lkH
zKvaVM6qRLRmTG)aTMAVAY=Q2**VB#<y;T=SyArR8`piVB6r?dXVP74yULUS4_3deH
z3!QHR<PDk6{qb9>XVK?>9{%51FcJ^$-@X5!fA3!Z{@uRp<AMBV=-Ua<)j@dOqPV@`
z!N0wq`kU2(G`^OyrB4pW`#3`zXZz@6IUB#b*ieZI6O;xZTph)D%l#X^QHdSrWd)kS
zVBYB!Z0&l6irxgk*ZRvyLl*P#9X&rTp5R?x^hpW{6cerlE`fP}Xn*Id5JAwOq?b^+
zM3|t}Lz<$kLX>W-0tt3gYCc~!A8z$*4yq0)*mdqpvAi0l!>Nu>H1}Bay|L!K*cKo^
z#KbM0C@=?LD9H6zx-4&3iQ<J?VwCQ-(`KdFN1iMJ5^JsoH&BQIi-nVWF>TIVl4zG5
zGMnXk&P@(P@TQr6O7R1*3SWm=J5+Tm3dPg%ZBk?6)6QC1B(su9DaQ8p2d(kN_5nOi
zYwNRFE1<a8(yqJx)CJbsz&MGd^)~=XR>|MJ?u7N|wN~nZ<`DX6q6Mtpw;;8ziKf*G
zv_eW(VP{lpj8Nk60BObfAR~itvxpEOfTaIvDHSO*ka?7UAnvw|F+qf{xJ;v;`hBD5
zN~9xn%?PsBUk1Zlasg$O(NDvL_7vvhusI)wKmLfCvwy+avCtqvZ%nE&i1i{+CXX5!
z`RBu+SVJ}s7ifin{H60XnBNc-oC@MN^K>D8UtJHjGjD9DCM^AoS+}hNTy{@WEYaH8
zIeq8#?Km}m8w_7&yp7qM8n@X#l4k>Q0AWbak-xY5LhvDXt-U(3@irvEt~ydED9V(C
zd+h19l{TC6Jbg}&Y`Myg09Dn6S0_0-NQZ<evo|KzN%Ix)eAC()MEZ?e1qQdXlV?;r
z6SwSUE}j<XeB?@%?_Dd+>;F5f6yA{H9Oa48$y(um7cAA5kFzm$-?fZew1OX1+FUhV
zSySvj-C&V;&`G-3eGVLnWGVNQBkvD(-zUv24^`?ajZDlQ=_I}PXmyom$+7BZ3%Ps4
z?wsVS_SNQ2y_2@zxoca--p#esm0*gL%kkwWYo;p+{>vC!M&*B##I6`^PpS<WbkE9E
z#|9LCW2tpPmy~P}9eQx1OXMTm*e{z{&QOkp0FxjF!qlhw1!tw0dk;R>uN{V85_yv5
znFK?Tu_g%tf8x^WAVV8u%eY@xE4Jibv4~VEy4jK(Bww0_BNe*ddv?4m+ij~C^&F+~
zclU`H5GhHTvlDLAvZshQ0XM~Tr7f-Cg|SF~V6ZZS)`G}$tBn)%Wnr>h-}`sju_=|*
z=8Ophg9H|B>Fqjl>epKVs^5FM@Kc3<suzlDKu^qatpLwV)x@+W?3+=~EnkP6N21ze
zSJU<$+`TJ_xrl6-9vQfP%|-2Ok*HJ-@E3c1NMAYa6envdxU;AKa`QUexR>FvC-pdg
z7@*Y0Kd_sHq#B3G^r!M{KRny_RtNiBMa4asS66(?ciSuW-&=F<XDY9{-xs6_4E=4&
z!spSVYo+pA5(U!ksA)la><F~Sv=c_$y}sO?NT;ch$T|O7JL3$+ZcG<j9^cRBcG_(|
zM(g3-L*3#%{TZsp$9<s-?xj>Al*#OW&#i$yJ0zuF*liQirwJ|aOEQ!++O6I$;H%tI
zp8rb}CbdkI!NSN@cE_=#%H1PONYG0#7;m}W-AwrY)zBi!LsKe~Z{%n7o4KIj_hpoQ
z-3bkMVZA&mZDUv)jQDanekoH+lTB2+Z{zp3T5$$nK=zb_XQ^G?StG6q%Rsn)C<C2C
zb2SIm89pUKlCwahIhU1nwRlaOwx*C>FwSDE&38$F9VdEvWsM*<ipLvoP=DU^3a@EB
z^ZoSX>C5LIyEpA@wIIR869M6SQ7$KJov1qK4U}LzH6YIVCU>KYFwT(Y?C(odT^dRw
zs$r5RnqkHCjzzFs1M{6asc^f0m<6pi<V`fEz7l<IWrC4$P@Ah5wc+euF)|ex8??1a
zI_6n9xzKDG9f}t%nJkR>;4X<tNhdIuCE4FuIiFigqwNn05e~Mf9CXCat7$8aae{r%
zwL9}^#NGIGVv-ZLLetY?y!F+^UirGzqf<^MNbcNsKD@yNK6w@gl6=R1UPbiN`_TB*
z6Vy0!vW~9A!0Si9&%ROEci)y*7UEpsL9i71?eJiT!oPi6v?<1i&7z|S4s8%s```Hn
z==+%i2Br=Fjhhn~-i*8XL7soSP!_+VJgCjLHWkaPHP$$;#mzEQ#U>Z^J8$kvCd5tN
z`gp!_Qt{4JyS;6Q+xy#ply}Ve)o~(#RK*l|Gw$4+v+y(*>D6%(rPAI|;*$K)4#f-|
z$#P0X8d!f_?{6W-HcSb9<htawuD1~u?l$xP4|Q9g)zf-)je<&@G;1>anWK(;cvDL)
zr-W;kX$?fXhBp9#SJ5JWF$5r%R30XYq3PlGC$x)F^`=?0ANsU^+`UiOtyUn#x^B&}
zesfPJYphdpl<;Df*wxeOqEgIbYbR~FU~USEt0txfY8Lh<+Jqb}5<wj8U2i(J@~M`|
zmknhIE?cXJvN-wICow_XGQTZOWQ^W#2znHsOA<CT2Pt-qt5@n^Egc$oaN``+nQbq$
zh@PLhMX*OuACM(~v6nE(T0$Rs84$%~9^sAc9pQs;s3U%q$oMv$2>Y~yWOEDR?7E0#
z*CuV=)+xwzdDar~H`<k_M0<P5%;I1?Z`srM5mvQyK)hUP9HP3PK3b1oPmv?_;X~*X
z`@J18%PkGIEzi^B=t%mSh2pCPM*>uirZsZm!Y2)sMDsX*!9r?oYf_g|7B*>oL0pAi
zx{g{4;FuM=#!hzC;klI>Hps^kn2;6~*m5jVT-Fzt9%7s<n+2LqOKjsxnm=kYt5vyL
zyCQrOmBv^`vrqwPW6Cj6hz?d_HS0D>g}7-*!AJ(0KZuigeW+jPHnh?+3_aI@*ejiV
zU_7?j!ytHn%4u^EYvzQ?izgN2@R-eD!lItYfyRL?mrDfrMLygx$y6Y1vY<1m{2AU8
z$@<<wihH;BfB4((f9Tup<83eBv8#$UIblxpMN|BwcxdY+Q08hfP8GX5K6v;;K0^zu
z-}4!ImwiJzXKh$>wqALxPU%KChm<GC7f7EAl0Ex>kZM!j>*9Hrv5G*nqbo-x*f)3x
zo}g8;*65^9#cBz9c!i(&s|YMha0;A}S+y!Dc4UIWKE4A1UlI@&O5|m&uKRXe%~|B&
zaDjFxZazz~%M2Wl4_`b!dil6`boBD*%cGOWo{r=X`o~Lq68UuRc7=A%Y;?WqNQhFK
zrVA5)g;&o5iLsHv7Iv9<bHY??TEkZ_o(y)puXNHRre)(4Exe%F32!G7YrEuxiz7=F
zUWR>dW`Xxaw<B611V%qenoq~<Gl{{tJ~`+PzPK1h>_5C|xVW0AE^CxQSs{En?54fW
zNn?<=Rf@?C=hezOsX#7Guf_C`s_UJd8$L9DOy3HARFFx>n7qy{78Hb)yixH$_tz-|
z-UU6^@<DJNpCS5>!AqpAU1#ZKRWZ_rTE(^*`T~p$rP)gwz<1j)uWByFR{}ZgtEL^g
zsySO9SIbV%web1vI>RBQa9z}k3fVcI7;T`+k&JPxc>MB-gfuz2Ag40{SOJH=MD4GC
zD0q`}0{>i`<W;72f#uQDotK@`Ppw9gI`Ym~-J;of&=F6c+bpT^|KdTMcH+K0BrAIK
zWlVE(n=DZ1Y51#JhC^BZrFzFGx8iNuqmGGk*2aix*^|KS#Pql~e1{&UrP^eC&`6iv
zAO<wdQ-=H`jp6=K<9~@u8q-75f}nkW@|dkIwd|k;&gx7G4hq)4fp66_V9*4cC1~g4
zX1bou`$)T;+Bkwr&Z>!4Ge?8{NZ|)f>b&->=0!=|3~$ZCIL7qa6vKWb4{U9{U}g)d
z4h51F5sN^${n&NAIC+5hURBOm2&Q|b<^!t+l^yjwmU|Ws#O16+@~4Ukqm0{stu{^W
zGZN+HTYY7BzyT*`VGIaot675WtfZt3bn2V$eSzBdH3k|;{&Y~xAO+?E+00Y3_gMOV
z^oo~8e7)icdXv~W(p<Dh<c~;t8((AHQE0iiOmIHt;oQCsQ=8P~pjloV;I9LFYFNrs
z!wWpMU+g_P`g$Kati&jo9LflPHUd=8a74=Y3~;N>z<jkJYP}+i6&26G(%CdicmRko
zC5Q87ylx{VN|z2`ARh9yg85`CVXbjMrA9yOYT>j2RRTos0JZ0Yurf?L^(w?2WQDSa
z2Utnc;aS8l>k-67s{P=-49~(k2y?nBmlJ0}+WhgcQ)(Orl@>y@iX`KIb7$$H`jbyT
z9hhR@Dk8-?L(&zgQ;&yPW+>WK5c1{qN)V&Tm#P`?752=kv7<<Yh4l0UN>*@iO?Vbd
z4^7+x9pf`&=7Zoeu`eSsJ2k1t<RN*D7G4ogeobNLHI_XSebaJ&u?E?k;nsFtuafNG
zj77`DzO+`U8t>8NSLAPhfvzV*x^@`w_XQ#MeTIRCi9{ic0qVVUUBmb0aS;%nq>gq7
z4t}s_{*#xk3!<g;@Y!IAmxeGC#|q!uFE8dn5v|9GmZXRU$a!G^NNU>WDYT;=SlbAu
zB`s778waYCVDbma%3`maE-uUcLuQ+gr_eZS)SpuVX_h{Pw{n$#^mJO<Pc0<_QrV4a
zi6125dWI4*lPq{Nuv7ug7-=q-d+gURSyQ&6Lwv0)?N3du;lW9D7PKkPJg?gg2nzYY
zbA`H&62Ucz1YY|;R(~jvOaEa4|3*>o0v=TI)rZJCP=~0i)Ba+;TtK|PsnPi<*fL*h
zLByc=66gEMj5Z>Fj>32j%yg9()1Sh!3HHpiZfBi$KaiJ8eMyDf#ar_4et2NN#}HO0
z{VpHj7sKrtls&Ckkq$TO7DRj?RSc!NFi$nf#28AP)vtzFzM-VMV|Vq=KG=RA)X{hN
zj()T3%d7U2f~jyzU>)C9H5HL%#RhwAtg-%$RTmrQV5y0JL{{oH!P3u}R0MbxtOt!;
z@*s>+^#XGiB^8-!EouF4f=rK9TI{idTsJ+ojb``DdC}rzvd~0zfCkW!ho-Y7po;Jt
zqz~bHB$84VdtNFVm;{H~x3T24b4lP9AO%{kio0PQqSq_3D--;1!Qw3zKPB`i;VldT
zKj>*KooMub=?8@gE&y$~0aiBU{iquoJ5-!^dbUN-&zMg8z@j8hg}$y1|F>*k4~nPw
zZiP=Rr}RCq*v$>54EuNNB&BdN(ZE9I#j__z&r?#U<`-ZtX|9u&>{(g(sqm?&K7w~l
z&Zsz|8Qa`jib4h>FvNbcVVu5d4qa1E-`TTX(C6@f<V2^u(-*Ys3hq=xF_Cy9u{#Xa
z2uT8gTTVQJC?Z4)FHNdRN*-c}9HuOYSq;iBDbQYM7_uxzCy$>ze)zI@`0UlUFZb?*
z4?KDGbWgb6@Lu@y=nr4ppZE8RuU<TRTFkD+t6qHl;@PX`!!Q30*;48_8UEt#-KRs;
z`mvRNZJ>dX-9C!`)Tt<D;p>L?Kl}P@h!xev6EBeL!Pc4Hkx6jKVOjjkv*T~|kF(<0
zi${-N6gnXlej~jT9evq!X83?pTv|Df-f%W5hQIvWE~E;hPrEx=3wua(Lp16$DH#tk
zngy9JpFiw>6X<%$?rW|-ehd^>)Hx4=)?7({m9&e=ePkigi4w-YfA{_`+-C0~t7=K>
z@_D%o|6V0d#w8P@e%<FSBqn0mP^6T_y}NgdufKHWv4>6VqrccWPzAVN%tHA8+>hwZ
zXqUks!h^b(i>jmpxKzVZQXJ7W^Q;nWugpx&lW-PZv;QYqYq>IwGB9hf<D-cxyAYax
z5*xQ(IP>D@yOSaV`mh6ZAz%?mWVrv?%d>>m(y58_GVV(mq*FO7{}ME5>`gVkf8cm`
zgy=lD40ewm`GfsI@ojTeN&*U7)i&^cG2&Tzxzz-?o$N?BDPm6(B*E6GRAv94#toNJ
z#X-zj!+u~H<`ZpHqD@2XOTi4o%AtpUeT2ZxfnDG+I1A)aiJ<{CSG?L<S**DrT4`u4
zQ&NMJ>RYUS&EtY+O+Bra3&0?$_~Zu4hs?@9H6}zMI4n=xyNh!0{uL5s;k$@5BL_9I
zOoN@;6K=dOA#mD6)IZxSck{t8IYNn&j5TaB<6|CF4xkE6e1oci;@PeYnNW&<dY1A9
z9{xgYLRg?TdCM7XMI(4U>NP)KmJX7$V=1{++1AqYS3?bIlq{p7v3aXnjo=3WBkd`Y
z5)D0#3Uq}W(^4dA5o5Sr*vQ9uzJAA**v3{ais=fMNNLO>@lilENzsXj6K1ivq;DPo
zi{Z94AaqrC82xUO7CR)pjyCy!i(z_vOgmk#cFwACDQ@Pbjj-4yQUBEBaLai!-hfHJ
zt`<BQMBLKQsHTF8^3)TeXwEE5dBsC7K)IItV-1axB_an3ud~XPB?~{<&pZfPQ|k~4
z)uOSEha`!<Yq(zP>?%<^#p@tj)Q_<WLc-947wpHy2U)bRKJ~;aW=CLuA3`pwor)zz
zRjzs~b<07vNY`q}_cOF>=qEW5)+ph4F1n=Zg<)JS5fq@l`ZfIPww`@Z%?4Tf%Fr?T
z@sOr5!MclSs!N;zBf#gQOio~%yibPL1Y?e2CRU+gw3|%3J!l_jR(j&2X9}a}ef3He
z_WbR(HXC*Q(c>#w^3Sq=!(Hs1JlJQzHB4*sAp}|d*J1l0hO-!7-TDlIs;v2f^vPO%
zIpVwcT<p9NMcE|~pg0+)ds7KeSxl;^llr^_Ex^qpI%L=0UykLgkvGwUS+)ujAN0re
zf$Zt1r)?7PJNT4CJuuBd(ojpJBUbbWDaIb!rb$}B84j$lU_%9eBn?cfEr@XPse_#p
zwh~e+DjIYNCbR;R8b&?(RQr?-a9VVxQ>#w6_v_&@obI85w+xryl*_zkpnb59fkp*;
zN-7?Xex4>SQP9Xl-P5R3T$D(}6o7Br&(gc5HZg@mw^SqiTpV$01V-!Y6OK!uA^a=H
z+5=l=b}i?qfCL$TyHUFU0s%F8#ZgOJIH~tWUt-|aD8NuD(6ALDE(HksPi-^b`RmR<
z?Y0kg4~ty{ehya60j9HSEoFal8s$<3P!Z0lv5=&cOwPrT`?g}OCOeJk_6e<7_Ca^0
zrj^253SFhEsdZtB;AyMLt+Pw+&920{vFRUrB27@s_yk*jv#z*=o<a}??inJ$On`4^
zB{KF(144!?YU=J=91bt{J^4eCC<f$y(lZ*Oku~4Ci{AjF-yMpKq>DWwl%U7pll^#(
zb{a#Z(XZGJl-qTd9a}0t4ecjqa-Cb9!^ttAMJ*KtR@JRtHkizr=30fZ##4qrruEqp
zj(^jr1LLTFMJI>;<e?n?a`IrX!_XvKGlWm8Co#5H&Qo~KjNb%e))kFu2`3MFx%_M|
z>xG)Pm(_HkXN>@G2}n;j@}sz}<5u+faTAp0nusx9!Pf-`k9YZ89ll5R)KA&;5zF~-
zSY(T7n?a<xmO1=XA)cV<w%H<L)q{ghJbFU+TuxknQ9ty!O5N)8_E|TpqKj)J(De!G
z-KQg`zeCN)JpF0rvwt;+IV{QB>yLV6`=HN<_6d<Fawa1@XUrDT6B&k-R_@xoNwaWz
zS(KS2rVRR~24Id^Fo6ri_Z~w(zYeTx9*j6axUxOik2wz`*}0J)ANPpUvToN)f|r<&
zSJJqDqyaFA0+UaA4uMZxf<Ltq_8(9zw0}l>fa0h4`g_HmF>RLk!v91!3Y=Mf*jN>V
z1xxuDGfyN<CV^(y$-P!s^PxVqCvV*U4PW$ZX^Fn`=;>!}0z*O@n%}m8A>j6Iw+{{v
z4h|;OtYJFJ0KeYWx8y|(+6AaoA5N*Bp!dFiXWYKg*Z6~xL;HKfUH01VgtcXwPbuyx
z(MBR{Yqq3FvV5@f@Y(Z!EB1DZqT{Q)c}aKni<i%ebR{GrKUn<vcCq)>vlmZ~UKY3Y
zAxx68Km4BsNpgo>9(H$k2O<ymv;~CxkHUPoUe;guzj_++=dbaf{@DJG{9pbD2WK#U
zo(8tFC%>!0ck)1V^+16(2EJxrCa0KoJ3B{4+_}ynzWsUA=}aI3CK!Mx4-OUR;s<dL
zEmds|en(k=!t>Dcb<;VoEjdpmqqki*R9Dgbt-xVrXqjnS<e>61*Y}hKIBlV=d2Y0V
zejKhGLH^J|&7{-KDOQP;Lr%pCt8X5Egv@p)z;7P6*S=ZT3qv2%EE9oYd%m7dz3f2v
z^8@w_Ge0>{&bv`1^B@d>iFTre3&~+53?}ssH&Cd(Sxj2&&#(=KVZU^z{5Dcd6G+1r
zPv2}%i%Zi@dp4GK2g_>WvPxKmWIN@;=`iKt{$lgUH!2T^xHn#H3awn=zKdIbD>q54
zhC#wXK9Wsl!zicZIaed_{ijHK=!k?I#t(CweQ$rHtR+#A(*<Z$lD?^=0=@5wK$>nF
zC}MQ-_+>C=hJ(RiRGcwWPP)jScDxJ8A^4H>A#cC2rbT9x?|WkUvZCM^dv-tFU_@E;
zlbYKoH))VLKTUj_dd^bMW-ls#PVL4~$`28bb0e80>qSPcKNSJuVU}F=NDNU`LM<2b
z#?zA#a}R^GP2%h@*{Z4f-NO_(NmtY&7&sNgzDYF!W<?c9d<usH(`xsNqmzQrbZc}?
z+9Hs%PlUYt?wiLi9)}@dh#)Pl_}v%C;(lD*zW3{2f7ZWyFZ@4gvvl--?W6R*-^SZM
z-@MIcRDAjP<#&%Ce_Pxg-2I%_!ashQ-1z5p87Mp0X}>M*f0ii<B6JV*bNq1MtT4b@
zk%xR~8;P(WAx0@fmR@aKCke|Tmqa1S-PX+WQP?&dPtJ))F6QlsGU(phcRFvIrP8ki
zc&y7Prz69pfJQgwXNqHg+9DQ$m?qg&%2Omgamy*`sbvx6i$o=k6xdrQ-J{<c>0|TB
zj^#B=#vPFzAkAQ-G3iG_X{%`Ko9BFnB$$>*c3LA3jFI}<@b$!r-G}%^S_2k97-}+K
zE%k8M0qYAilq!ymR8;mgH%qGAt~-AE)FCdSTeDdY>7tZ0tBEmxb?ZaAo-K4;MKc08
z13!DK^LLP{thanc!aq5rykkc@71H^o|EA>F;f4ujuKsQs=+4fhI%iyIZ(rJ<5qz>O
zzK~LbAs!tHI{I>0E^1X|&zi|~xM%mj&36aL8Qa542mGo%<>g#d8BLxMDMmtp!x{2$
zFV%#1;qEzDmRARV@)XUPT?Bc;%Ld5qp9DQRQ>6d8E4S_*7Sn3Jr*BgSU(l62o%m48
z>mt`bXPh5aX7xt(5KN!F%)%5`mEa+yiEHi0Wv;CZCH4oVuk`}!n5<zZO6XGcJi?9>
z;fr4Ka3VaZ67V#c#p?u<GMsJ8jT_Q)VbclsGZ{gtBfRy03;uIhPw<G;U*b>(_BEX2
z%x}NEp4WkS#*3y**$+Ma7vk>WytapjFOQ!-K6!cc^f~0us@>Uc18@5lXWl^<Ml$)K
zw-maG5)@eVOu9@a>oC!-iGuA7tNP*sDP;orU!b5-^PGbOZ`U&cC%<w1x36k2_+Gv|
zdiYIoyL0`2Ha>ka4F<MWXuW(KmgD8omrouODmt9!qmz6kW&J27VLpfF=OVHv(}C_G
zQ+kj=6Q95vs1|fpT)ZQdpR(Nixz*VZ&#pNJRa_UO;g4SN&Eq2^>jc44*_J%=P7}tp
zV^%D<dD8JHtB4`+wZv^k#^C?`|Nei9WZU_7<n-}>s_ra*5FQ_|rL!OPq#RE1nIS;C
zy*MpdMHnwBsOLG>O9sj9tQYOPT!a}ToxZt}E%6hZHE|XQ(}d=j-$j`hgSaduco!ck
z=lvjE`>Tfkv7UZFj<{;QA{L7LWx4Ps6oCcxtpfqO?^cjWS3zC5Y~bPU7pYGlsX^3>
zi<5_ckM3(lSB2(AGl6tQrowpHs4uTZ)YsByDNHqsM0y7>nKI4qrh{)_7`MVYW$QF&
zKy$R>8Yg9XARa5KP6HF08uVTa^LfyEF<rNw2O%CghRr0~P7D>sRDE~1M^?SQIFG8n
z<0-|`IKC;hFikeu+4(Zho^!{lu(z0>xRDNjxo=+-VF+SIsI0z~mUgqbf?gv4$@Ejh
zo}AI5U}VI5-DTNGferRzoVJ#_CXLu}T!l5UW8O)3Ma^iENHqwnqp7N6MFL4GtTq#m
zZpca(P1&^gu3?lGlt8VoByppg#8EWDr)KP)Ugf0)8qe3PuBD;3ybnK3DK*KOr|Wxv
zCJj!opM&C=WWRaBTl4qNccW*f%rn};F;Q^jaK5G6dfxjmX23Wm-njq*%dj5hY8N%Y
zaF9q*BmEcM2Q2*S$5PEDa})=AMjOJ3pFWKD4vmVNK(mx8rvm$)RjVr$m1<?kRmD6>
ztpBexl`}3F%0X9)G4q1Me=iS$&Rhn6g8zI_wu^la8gOR!?%w_S%s)PS?`L-d@yyro
z9x!k6{;$Jzq)QIG4}9^ZC9M^j;8_qbMLK-$>^xfoS#>!@GT3FHUNCq3*ApWNpBAKv
zWL2`O;jAj#wHPgh$WkP`fuje;hg99q25-4CBdPK!?KVFp(~2eHxHxZ^8pRZUe6|lN
ztj%M>l?KIkm4@g0i6fUe7j}E>)Ru+^?+xDaHO?M8x^!%z98?atf!j+H&QQm+Ws@~$
z$x!mQLI^JiNCrP$tb+sELnB5nNRJ4FNok-;m)hD)NXXUe;bTGj=+$%jE>3=b{JePb
z?BVYpKN?vdZizD@TL4+E;C5ku?I7708u|RSb&5!5SnR!cezGsLHOER%Hz5duK1l~>
z%zaF2or8rxW=*1U<WDSjwqb@o%$Bi>gW{W-QA|cN12c!JXE!;9)Y1{H+V?U=@WGP(
zw`>^cyy3a@o>cQP;ucO7g92MFNFm4|l7bA$ccu7H!8A)s4w%ZO3vC~NWjS|m7X%Cq
zR3YK|ak;Qp(KTT2(>&$a0zS^H<$M1B?EPDFTUnMaiajTO#VV@YBG>?^OJ-IUD>JJp
ziJ4-hZY5HwuFcK>7Kuf2l>jUh79fh1Qbaq#J`axL*x`NlgYDQmjve6$`^n+Q?N|Sl
z`UB_u1kdjqW6a9}KvBwntiJ5-itZ|LVXnF6Wy~?h^&9x#*w;aOEz2!hR@iJ*Ra0?t
zvIwc>^A@KH9j(C`9_@f+Dp`q2<~^ynhVk<Ph#_B&HMJoWkBYYj((a@hqj*$w5z<Jy
zm_+juen#ZnK>uRBoi4<}B9~EsGm|TBEJ+KrPR%8F2f@YB5Ts^*jyQ;-Is=yA6WMi9
z-Ovju(XKUZzqVIMQPf07y*lrFZnrx#P$2(}tI7OalM18)h5G?<W=u{5WxL&WoF0Ws
z&CiNp-H`^cH&~C&?A(bae@1lINJ|M-w9kP#QbL11!?=7fcdU`QhQi{|C?mV=<IX_Z
z!mlLpQ0xQcEE{-#>r>w?;sE@jkh0bqS~-+ber15Wf`ozCa9hP0Fj$M%l(y-S!zJ$2
zgJJ3V8iiVz;F*dE<d$?piF>0HQBX-NEhx#-+|j!l*B8@jV&*=91Vy0lYcZ9Ulci$J
zdA1?&!EOR>P#aEas5FegJx7@HVh*dUmn-op(iP*zn70If7K2VO3xjsnFft#NFSTDl
z@bs-R7y42)I1#X5id?bLAX#dN!P$*1>tzqC3#g7AjV~%C^ncE@Jd;QQ!AW+IX)mby
z$G|zca^d!HSM;Q-z(mMB7!9>xdD2%X(y=N2Jv)k8wYgr1H}<u%5ilJRmswy(@kCTn
zZ);wtjb2iJ7bI+%ks1&It3RXW77mxM>k(>pAzXB}I6=8b-QzG&)U7RM2!jM}oJjN-
z+fG0;Y+@m9!)MOK{_@0^8*0bbk7qD3avF+AspVOxDvF3-N~T{FS~F26AKf+9>3<LR
zRQ93w6w6F?aaE<++akquG&!&~Gy>^6mZ6+3w-5$@_tS2=YX~ATuV(qy)g=I9+<V1)
zU-=P<|7R+p<JHAMQlR8aH2c0Huy5b$EA{l5qQ}SEw`q0K3MA3<IM@8%LL}e^#iT+m
zuXqwZ=recv;yYOV2^I3iHyS3AZOS8nZ+pT=4yirvM8s}O0&9`uvQE)JnY8b}P-KH5
zIw7Wik`I|5=6z+_P>vlS!v*@nopGsV#&fB9gvNur5x6!^-v2XNE-_Ls@%OUdtBwXe
z)59GZ!oCXB2fu&R$sS+wf9{oMc;%8ID9470@6>IxQw}RCwe<pgF=Q+U#vxe~=d7;j
zgGYIQl)Ax)1V$}RtI`BA$MDnwW*=0RN%X{jq>k817Uz~ZW)!d)jPmjEFn^!a&orti
zi7LOS`|_rE^d90US7zc^-hVPZtK`E_S}%pY*mtsq37RltinnY7l@gSXZ%DY<2f@xu
zQF2UGK6^7NNa0TS5$t&HFZFW+&Dx-bfqZEP4+gy}E}VEoeR&*TJcr@lmN!*{m1|{x
z)2-lQY>ahU4eM?DNivrdY*-(~2IzLshmnW@Y<*1<bnNp^Pt)Idzr&Izt9)3Uo#`Rk
zSklNmc%+!2^SL+KDblX~`2m%a#7erP`jwNolVz<^?W9+|2TLjQ){Yzp_`nKQ7o{bj
z<XN(-^ZZO{S}yL=-G)ca7VlM7MY0Hg$3x2wC6)G=?WJd$5I6!C5NRt^cs!a;BoxIp
z@73_AhLqR2WdB+z7!Sz4Y7Y+cvsG)~cQahK{O%PsP(L<9@AA>dr5sNc0gNebwMu;f
zB$k68ukErEidQyG#v;ik!d6XKfRSHatv_5_oup906qaPhR#DK@;Ur&4m_R3gpx7-D
z?7$t@S$-MEB{o=v#%D@6P;03Jc-_0%M##k~hdZa+;{UP(mTz36(Xlq751{Xx?ku(u
zTWPIMHpBtP6NKD-coH;zMIsZk!I$xOzTWu~i}3Y8JW)D99wg)<<<Li+o>GyQQ8-gO
zHc>*H7==4M>=VSvVwPyCc<ZKr7jiXP+dyX`V(|)ZvdBI>On2bLeq@bUCQ=dQtC?vc
zJ|(BNvP(k=;95ST{*sSjtAXb$wrH7|0dO|I96LC@B#=(zTqV?Sds#y4iP*P4`z&m0
z-~Uz?OV^>r*IUk1;=WYGDNpLK>~=>4EvOgA9&ari5HEUrT|Qs}DZplbp4IUp^duG*
zGR=y~&>u+6bj>0md8zgwsQOi;5j$p)e5dY&$W;mA(+I(IiJOa=Z5F+=UN*R4ZVML8
z-O0w6a1f|L+>X5HJeD-V>O|Nss{u^)DJ+|y3+uUX$0|M$7MZG(^hW>_CDqHSvIcu?
z5Ef$)oB{tt))a9zORBYh$J4+FecnXsms?AZSkOeji}wjxe940UbErHLhx4;*Jz|99
zD#dGoBPf#<!RfxC=>EiWN#~UiUY-qN!t0fj0b_67`>zn}g(!vr(}b7(#2Pm3WVrB|
z4T%fCCh?PvdAhKvTSiKN4ZHe~P)gC5HjI6HJJaDaE+=glD5cGR$n-raW4%%kog_)^
z4FR;iz5v>5ecH<aBLWj$6yLs@`GzawX#Jh>!{!ZJx2|v1)mB|6{^-BE?6cilp#!8T
z8}6>sd|vZ0t)@gtY)lR!^HlkyuTM0mF=?ej+p>aqYQoVf?a`+V!B!Xv#Zu6bZg}#!
z6FLZ2-Ls08LEQy^98zz6Um}u)Athd#+QwokkyTEU+5GGAm48CpNjojc{a({-uk}>w
z?a}$~%l9pOR!2;-u$9F&16Em9U#W04trKsBn<Efa-&fu!T5kDt*U=8SeW7k#RIQ9B
z=rk?|n?@bq)w9}XsPBaAk6A})akFPg@#dH@M4^sW>nMJIEFFJ(w?B;^CXx{JXn9vI
z+U1i?U_VEjvVD<t7vX;eOoUzxjLyMu<#8HGl}0r}B?X+5A+qtq!^3CUd{&;FQHr@J
zj?b&=m0`*XsD}K?Vh4#scb1>d6`~PAbRX%@MK4s9t(R3j^NFC9cA_7a3X{?Sfr_ND
z9!oV^!McHeAIqDTpyfTE<d#_=Aaj3*@%w^T7v~#u3(<UBsH>s*jus$IJ6)~{bVn!M
zpI3dfNTmV>66}RbNM=b(pqry$(1{#>QPJsz;3B%E23*xawn-@|is8^03u(hoqYf@&
zm&7e|POmHcgL6d^6&xKVz=)Ah8@GG1O|{ihnRV-blWM9Fs;Q)p6(2TH-mR_y&LQi5
zh;+aqbs8HR_SHC&mL=-&b%O>5j1)LL|31Fd8bC)rw^z_MqT)i=tUM$|n3_~c4=Lh6
zX~ZBI56k>)mXCY&>odo{*0o19CWT^83FM!b((Fj<Y5Vw%^|9=X%|jfG_s*(+O%X?f
zS=mT`+wHN&ujUs*<U^?$nX8)bL==PwZEfwkf$$`|iGT@Kv#l+?#2J-q>c`A~oKSfR
zZ}6HCVqgBE+s&Rm+P%N`@adxmd(U^A>`G)$Q7i=RA0e|A#gi|6G@X)LifVM6JEcBG
zt=KrA3f1fNq`o!&E`}R=WV3GfYe!wn^8s0Z*$4ansg(FyZoQ$F-Y~?PFbJbjc}8e%
z52Pz16qGxOOdQcBMc2lZiAZw^0x(~!xzQM6AeJ>Xh`5FefuRciY?B8NGN{NePIaVn
zP0QHi!hr?QrRS+ljdC;9xWMWy)x{fJbd@((@xwTW|Ioc`B^-pzcs|{NxC^b6WSN+M
z57_>e00|Y?k$gVS5w+kZAf<j7m;k`}=rzXN%kW(fcw04ZYIE?*To#bDiiu}!ia`CS
zILqDbEHAfO&wSybj&;cBxsau(XK+*P4*8f6VeV82lWV3UE2GE7e-6wAx63CndY7Y;
zF1NuQsKQgR!VDpEsFXC0r2*LJh@mroofi2FjC^ZrBc9QQJBy98Zs93PHZoKqywjSM
zjiT4F-bk(ky1PVPoH}})`EpRYly(*M8nx}`{HVdzGof2sno-Paow9i5KaU|zA(~=C
z1Joh-?8Uj0X-87VM?VHXwtf!AdfwOQ_GWEFS1X@1`xPthm_6B>RJ=h0rw3Pmh2iW|
zK&L2%*g#=sAH%%#@EB(j;ZAG%t)09^ygCK35NEk@9A$3hOwK-TZ((H1+rT<X{%K#I
zYOTVh)^XuWW?5LWj4rAPD~{@bvqbAUmQDs^zs@UFa}qL>HnxT$Ub`y`CF?IIC+D+j
zVv(MTK2whgSyNkDdB%d`q42kVTr-}WrbRVX*TB+R_WY$!_~Y4v(H*1wxDwEIzNM-#
zTQEQ=gkK}eu*)E~^tG7Qea_@C^d>RI2A8e|hNv9)H~5!Tr}F|sup?n{QSbf3i_8ZA
zgKBc>SU*sl=aNhvSLK|rrmt<p$x>SpYIrdLuYp+F`N$uUqSnF>5h;;>v-u8Ceqdig
zko@&%iPR0*<(R6h5S#~H%a1b#-$-?0=$m?=4K*3+RxO{6YSh7Mfohae+!!SrQoiNq
zT89xznPb1Daw92=9D0EgkP9$pkQE6#G@wiCn};4zFX$k^JNt1C(}6mfa6DE2l_Jbp
z*%kMM0WlGi;FLY9CXBCtq&_g0Xa#@%U}m*~44iO{92w8Qrdk$AhnEhgIflTT8r>>$
z;?ur=>X}ocwG~p`-S^~RSNKtQwx-x)UiP(W6!S8px^D~}K=gs$uBS<9Q;{p=oKSpi
zD!o%=4yeS8e<{j|`zIj0wQ>=KDpm9qI|Tt5VIt#dh#F_Lk)2(CU@NLFdXZWL061-Y
zkv6^X)pI5$nc97)3(Ey%x}lUV;cepCloqJ)2_*|lciP?eXkqqQ5mqnY+DLIlC<l2)
z*;AWiN(owzuSp+jl1jAS_%P*Ov((VkpsR|&2x%{=n0tJ=qDJS>pp247feD#o>WI=@
zC>qD=z`gCy`*_}e_s{!_vQCYVX6+FRR^R?i8Ud(J-R0t9BQt7f<(rWOFE}bKG?P-O
zSh2{GL=**`XoZhN0T|~JSnUNPL2GL6SF$C+3VC{pgQ|Hu#|4~MicD;jK(f<1GOgCZ
zl6O^ykq?LTCq^%gQB&@$@UDTNnFsOq6xehoZCc!~lR1We%iZWTy75rPvf+N1EP5V}
zg#|dQbg_jL_?`{N6VipPLPr2CDGilT8Mgthcwf=33iVH!FU-%Pzky73(953TlJK80
z#Y`ixBmeh6hdz)#_`!|m1!0ENuKQ{O6yzSN4MYc(`~Ej{Toxqamr48frVJ@KlR8?$
zs`hn9EpViN*$o^JUuVnDg^uV>5N=VPo>J^AX06uu9{<ufj~UGcn9sxw67Ub3H~7D8
zAMJg#<~~GAebhB;8d*L|jjT{@dl>tD9m0vEhv}Z+{a}Kz`nA!`o4~J`FB#!G?j4E5
zs-#o{gXoKsR{{IhCXFS6t6uPI)M*?qM6wQk`om>^afj)&ZkNO7asBf1eT+$WFZ`^2
zqXUE!<x<gOXNjY8gvxzdtz9rAjNu!Nnjc+isgTKvF)?)nRVyZ<-IE_xiZtcKsp#B#
zfiqodsq*Xj$V^L-=Mbv|54^!FgyeJ`MF5aHcRXH*Df2w9^^iz#9gS(ng&)DZP^$)q
z9Ct^5BTOv@UZ({xD^W#g5zu0C#An3cl1tfA1PY84P=1_GM7ec@S+K^c-sd$@u0*yp
z^x#tw6a6p%!HtACejw(=tN^;mSp!tac2)pcATTq?`RG`dpDR(;Vays@F4(IQp|eCE
z&jg_jH&di%@S;*)cBI*Rz=dVwQQ$MK+4dKIeR<r+Uy4byKacM)4J`7vg;kVQ)Eh@e
zPFS5t8zdS}F7X%42j`mqR2OdV=NXI0dY{VP<aOz^P?Cw4-9FB-QiQJhQCDlfvGQ?L
zC_TXZDPFK`X*hhMo509T;nUkVXePUy<YVj#FWTY_MWhf@sG)Hot}q&Y9kDUHh2r0T
zqv5Ki6oVr3qPh?0;x~x#ABZ}qD(v_ACU^f%SSN~KvO|gJH5Ck;Kcq!v#}dbM;EA7x
zPSuq*{#HMpxsPo~<!L_}KlCdHa3bx)uW@)UGfiu9m16bIzRjNCxV&|Ylj*`)<3IR8
zRt!7wuk=4}v)yT#9WcdwTO7vQyYAS3zjf2^uKQ26?zilUm;TlKXWb;YCUF((=1Q(z
zV%#~)S-*?fsQ0glP8?ONc<$EZ<<sZi?LF@cAWh?~;kvW46j~ESh9UwUu~J%P)UeRg
z;G5|p=vDt*YoZb6E7s)k(+7L&-iq$I<uw^IK~~F_u>@%kv?IFl>wL6;w>tEHV5y}Y
zg^6(22mDt5lF8-q-r@88`v?8q2M?Y%-+Izq6#HSbC@7P*wfc%wr5Fxp5N#y(ikW!C
zpL^zL0!Fw6@$+W@Ls!{j+y0h-%>zl(*nnAiBkG`Jf+#VDzPNSk_FsQZV3O~D^Z0Pp
zTc<h9l`DRDDu9MQL)P7<1W?j{IPfS0*!_Gup8qRjE34V8yakEQ33N1xoIB3C<F@IR
z9U<ecK7UbmH3+R_EK<BgOFap!g_BlmY6~-1%MB{fevLxaq1j#b{%UI?*YT<~`43MY
z-`n5o|L*C%K7iGpzBmkT-Mw|i^#jA6SbC6YrDejcND@HL+>B=;uR6JZ{Lj_+xb$pD
zx$>|aO3qxt7<(*4evCe&+)>MC-&BMxnTROJ5NEYxhE+?GySM80Pg|4cz?XY|*bi%S
z;NPOZXjOOnr}Eoe&~C!G1aeg)3bV~}(v1x6UWZyN%At2D@btAiSS~rMXqNVPnwPk&
z{>kX%;L+aRv;Oa2?7i53TYBrWtLP*o!;dA^X;cUhuURg<J{&d`8Yg#D6;hyZGB?u-
z{^hLqS%j>4aQUgC3<51W8tphvMC$#lck+|n!~O5~`YW#HE0`=T{+iAQis>|Cd8YY=
z({8`87}9!i97iXDlxF3L#!iIfC)!uQg8&FGZ*mDYeK=z$%F~^Hs_^)yQ70Q;%Ky~-
zA7;$sAN8cVI2{p8?YKPqlO@0ACywrpnW;Oe;xKZ2t?li%9#o^}7&0+qEhtn~z6}}7
zMl-i_l?t8Y*WHj88==(zXJ>6&0phi+9P77t<vxA~Y5@y;u>btp`}mzDr{hF=+$rUU
zQNg$&OWwVxi_?XF7RN4*7iVW&nt%4oa{Zd@Jpr6#|HYGohr7@B`p@<sG}mO4{LUTG
zA%v${SHXJQu7Sq$<E4q?Zt6a>lJ*)M2UnhtL^fm?=I*Z0o_kKYo-E#w%oTwApg36&
z2m&uX(|-2tBTJt2TATO%INBe$BoFovxF$~yez&{-D1B>x?Y*FlYd6T_>W!4q1T0F=
zTLA`mcc4ZsZC)ajXIR!eGFw|-upDsd2LhSQHI^5Cz9qS80gM>-51u}9tPc|Aqup;0
zIL~gE0Y2UCIG=WBRW-N2r|x3wcIgapKLQj4^(0Q*EBBcV3$y-WBKZx0L>%Wi)2NOW
zln5uGTeQD_CLw$fW!Tsb_n++dpY0w#j47j>lq<V?2BR@90W=WJOp<8a1aD`EF3(2+
zo5-CrTP1&_YGlrc9oTZoo<4nyfaE!i{PoYcKvzxw(f<9tCr-BhZtoA-=H8y_Rqs*2
z9+f9VB>`YDuYR#AQ&4i+y8)nH9o-UxR{hK6r3a6HcJF`JKiL2F$^MgX`v-gXpYI*M
zS3#v(>WDzVPH3aH3StK%V3ETirTfdj-6pc`kZ!6+cbt~J8Vv~U2){ZaOC=+G+eu61
zDKf>o7G2tf{iDkl+J8-f^8VAO-#Ov>!PCdP`%kW`v@>F$qNBpcr&O=Xf&~;sm6&&;
z=RT}|24aC~UlvW2WE>NvteTbXTK=ok$@(>Uu=nI?%09wd+lzX(?YP9YleVhnnoNzA
z(B0>LH$%_A7F*!@v-9i^hY#IF!&TYD7W)voV%WBIq1w*Xk<_faE7nDR@hjs9hW?Zz
zN#<h+sI>6j;U$~E-CMVA39oD>imgZ!liqHBNcUa&E4Y~ztwT!&Q}I*ZjW6~rpiCAi
z=n>kar`}&}!M|NYf(a3xRm%r6UhK1fZ6x@<HF@@Y|9ilAF28l9kv_cWq*^b{TAfID
zi@iqJnOm)K1zf)RU)h>G{rf+xeCxeyf)`h<$iH$rd9ru-{QjD^u3VEzF`u3I!mhf1
z7<o(}v*HYZ%a{MU*5qIN-P6DS^vV4f&!6u-Idr1R%O{VX?miHG=gzIQ*Sp$g#`&9a
zyckCouyWEp9WmT6gyGw*gAg!8%+?lg5?9jp5Ra1ID{(Rmt^B87lht>_`{g!X536*0
zpy^0nlBNay+;+{s`kFj^`grf7*5n+2#@=8%(sK{h=Ueeq-b38Yzt{!3(pX}CZFhp6
z?A?d8;2<&>Z;BM$-oBe{N+)geSLSb`BNOVr)l0~)Q9-+DRgM0otjT%@)WM5qd(U?t
zJl=njD1leg$*v=dSA`-hTvUtE5Ew<G<RCD22GC52cXDTo!7TN{F^t^tk4f}@&%cWU
zmHw&MWWCO#UZ?)c-TlM<^Sy%?j}HA?cdqAHP%K#-A7bAf7l@Vf9x7GwZq62yK7Q{@
zjQUL!9b?h?e{pArj*I@I{m1*wb$JgziJUF&6vZwS#e<fWnH7Ju=<Eo(S;F^e1;AVD
z*Q=Ku=C4qB#_=r_i##c8jipw9XFfYqg<Q(8DF|ILG?-%=u}}?Wj7+_2@)PLByDttO
z_79(aw`aWMJ!eNOjLYxB0G-!DG2VlsV0}`17HeqI*FURlejS6fBadfKVSsz|^xK1L
zI4=-sCbne*R#%7r&uq@n;eF%A_wdQy!GR;@!}|{(JpI-WEsn#mAqixE2&!I8V5eky
z$*?-Rs>YFT-L=-;qG%fiSeMnCoK`-H3P+i`?I%E^6w7J#5r1^>Z1+A^_V+LLpYQbp
z=Qdlv_xN_i^%fXy9cL85l^Jjb)33dJ+<(l15dGa}`~7eBAMHWKw(_uJcvXfdu_slm
zB7-rbdT203l|TYX$+g3OXqer<cel&I0nGE??>^dpuz&amTsKdjILY;Gb~oF~?tJS0
z>+@UkU%H8sdt}Cka`HMKl|!bnm`4j4BxAuk4?LGrEh_N5hJAU{qO<P0Tl%tYXP>P9
z&(*ZE|Ab@5ZU9g~ufIHf^uQ)`aJ5U$XG_;tOs72MrdSh1D{!m$OXQagf0N<&*3aer
z2O*lw?xRP3GJUs0?!+SIVrf#cpO(kAaw2Z<?$EMiz)u<Y2S-P|c+!`eCjI-n{rh{*
z5BI;>zt6cH_8B-4oo;_dcm(h762)BrNgbP&;;t~~F@q@>|Mi}->Q&`Ds{Iluef>zN
zq^P;7hP_HY)ji3((E#ekf0?>+c-vMSxFR$HJyX|M3iVV)qkg*o;J(~L{k^|`w*Q=m
z6DRZ2FQQYawr<_X;?1;#et@iF2z7e+peUd_kr1^Us=edB?0P(}7DzJ;pLhIhFW#Xz
z96>#ifN#4!==hw$KP^i4JL3oylx#6YvN>P}9g!R(zztw$aCqx=f6Cirlf@~dCPOE)
z2pIEdb?6|sx()3F!0?oE2%-vb4Lg;m8kQ&7hCAFqOx9WwaYYfUsV5&kMlp^ziPN1u
z6BN8UbFxQS7YfItpgK{206khyzjZ>oIww@X2y4|*pna484OQKNgFnfTMls?L2)4{b
z(ZS#S7<c$?V1ZC<f6Pn-Ck_q%Za{|*A|~oe;G<56OOCV<={K1ZGqAyS)i!KZ2kJuM
z7U(F9!}jRru%42;=;8hYx%c*-AN0R@`n><dF(+Pl2UikHCp#~PMI4MGP~H+o>m<Og
z=pn>6XngbK{uB2B#}E;A;ZEy(Jl*zok0|mkD9GN`M~GUwe+UcIuZ8PWsEMHh>RG3J
zH%Pi2H1}C#Y&VdnFAv<Q?BBls;yv>{ag@e^Fj+RBoZrq~-+%UkM0qFs_MTBD26=4N
zNTTv~C+Fp87$c}A<9dE@|M~v2!-SE6k3Cl|v}|#=Um{2H^8iz-uxCh_9bKjn0s~u{
zE~sOWJzzA4f71-|v&OJm0wK^$nW$T>RZk^@eswZS8t^2(xlq8zuw=DL1VKN=buFf{
zlTk?&CMk!3tWK1WC{N0HE3RG-xH0&Sp&t8SyXh#O!<5#G(lPd=CMFID<Dnag7;Zl#
zUjOZK2!HxWg*q=jGF*LJ=^APj%+R|o4J1LgR9@!If8gHu)9t-Ge>!<|`SjMU%Qs~;
z8vUx8p8x9eC%?Y`y9a;5EqF+)KruZp#!N{yP}#IsDOvO<>`cgFwzmHeKhsg+a@%|%
zk~obD$A#O-nOrgL4IAd(V}z;5{8Gz;TTgN|?T=9)WJ}(mwSMw14)&fu*?o+Kn=OtD
zO!I~Ef3c71&qw^e&4N38nx<^I-+X*8zfsm9LRb4iY}oz-*YeiwUlq6V;b+~`Pk;UE
z?yv41f8PD<(=Wd0{`yY-`R$X>ZvXo8;m|ev9YVj}v(e~Nk9Ug5%~P$CiKQ3In~Kq?
z=vl;VX5g@O`OTxJFMr}#-KFdJ+hQcZGW?p}e^naJmPc5f`q}4CpC0}k-$vBXH9yI(
zrK`v4^()ryV`g-4|KZ+)7mxNDpHSEaIDXfC&6fa<zF|M%0{}ct2E?b30RBPnsq`C;
ztfelh_U8|t(?cKcQ-6Toc)-EATWVIie|@t6Km9#&rD1N#HW%9nk+}fWs+}P@H37s4
ze*?5xA4alsb5*xb`u3Rv;H7zV3%P}~j(41V3XV;TFU74~`bz)F-pjwrmo^2&s+~~F
z!QtLBA<h%CmN7GCs3rD51Dm7rRgvAyZ+5bq$2Xbwee?9D@8{{g-|gM^m-3>IaR*A+
zUV3n{efw8Oy<YDJqxXaK9CPnO?xoHQf3LE_fXR7Cke5129$N$T<xK9>M9(a`eSGp%
z$d}UFt~y;t%#Y536?c+rkB9rk6N$g$(%t^m?K@w5`q{5P`_&h>?|kn5>+T)*^dY<y
z39IsQY7T3NqhW@5of5?2<h<|zfv{#D2jm1_ucGJgnI{i;D_sA=G2!>Um&B4Ve<T&(
z{rOXPe~Ghts|ZSBP&`>F1+lu#_g>1G=T7T65|hxiF-0QN(aHL6MM>#u{EwaKA{j$z
zkYc4$94Jr96ubmKlKL|ZL@FXpvKAiF^R3J4CFb6UU+((G0+j;A75*;KX#`DNvSr2s
z_AJ5Vg!PDL)9%QnEY+ov<ei;Wf7LK^A{r`|pTpuuI0Hpy*FB14(raZG%c}Qf)%#)9
zeRCxHN}jKNVNIIvK5HqUj@Y@>5sTV&f(oP61hwoOgy54ay5*K~wNg-Gtwx5ks~qD(
z5>S*i0<w&#2CI6NT6*53h_JfT#Y8-6p~9x)tZp(=>B|J8j^?RYJ$G#Gf43EiVDY(|
z&0=b<hnq0q+zdTSNd)e7t((0f-kY%1`H*!C*RM-*4J2r+Ea4#x=Co4FepzcO+fFw4
z^1Ho1eErpz-|s$pv4>hFFX@?(#{)wliUrS=pU2HJuukkP#^S=PPUT-ziYq$ltw$W7
zmqL=LaFmtBd{{lK0Gx=`e?;)PX8#)!z-oF69ELaz$vCe5;*F@ozyrF{1xi&*ric`q
z97<SbSvS%(9$Yav&06)NL)gTMaxgf3YbGbaRk{{ynnaPKVt|MMPyui#V_<Eq7&u}!
zt7hKD^^u4X=%XL{Snl=EyU{%4A#-d(4Nvxwz;6qg&1aX}Ct9Nie<^xVaki%u_Htz>
zAaMdZ`|{Sl!$EdDs!m>o>*l~0ktBG!Q{9J#&t=y<z7-fEtRhiSyHe742$`La$5PQx
z?HOs60AS>buI{srTCImxP!+sP6nxj?U$2;e)N`8Gt?g|Xpx|R#=Bi>p)v9Ch8taPM
zVzyeJe1as(xj+Mdf0gC*Y@4@^9-+<lZ_vzr?zv;Pvq^-%2JM5HaB~8)omC*{Vl;Bi
zXVMnk{-*WGyG)2-lf!6dKT3xWld*BJ<@T*kPJlSL@D*aD{%|!_G(8=*lX7}|dGqG(
zM7ohzom{o!<ZAg^WB7s5OZ#IusUa&XP*)iIkJ4l(Tkc(te>R7OF=C#*o7p?ewe?O)
zUH#(daCVv9$HW19<QBcpRcN4j9OkV5CB<-Yvl0@S`l6E<-KC3qW)00;p;2Ty^J>~1
z0b?&4T#Wnr(jarH*$4o_^BFT3h`obyb7p;sKOrzYz*IXsw+8eASnljBhbcSPWl$*Z
zxmJHi&11Qee`Jw#Av+!#3ZI+PmoEw`KmcY#|8Zy{JH8=KaXxz`;5wRrYWOYB;ogDW
z_rvP%b>ebfMPPC)q2QQq7%8#LhMv3~InQ8U=U4_mW*dBYW5<!k1}<&)uZ_oqyZ%Pz
zveC&lbo%bMFT;L(oxSU1PDjh$p|+!(V5E1W$RfaKf5X|uN#4W}$!v@9&nydlxsSe>
zN=a*aW~G@M<Y%{TZFJc9w5nXI<9vqVY@Q+oo^LuGX-QHo{0j)lGq)il_`y-A9JUL0
zE9Z5jrfdqVH@2wb%>|vHVESSbZ74k1ks<5?GfRK*ksa$12yaBMxorb_1kEX+<xn^k
zbS~*_e|_X14LW?HVXfq#1KCnMMp1Jum}kn!x$A$%vI7w746nTFPRCgh$kM~8;coU^
zgB3Ki<Tzo|==IU)2K|=YfdnMG*`POpquh(1iE+qK#8|~7Enae4bbUqIr2ZCa*bpW_
zmCp-B`HXl~q?ak`-TrB&no}n_vo;pq891w0f9G;yI1PFrViS|-y?7baAvcb}R7#&F
zn9E<>!<%gdXG}$n%&N-9GKVim;x0j!KdIKe#i9sO(%?WTvtC+v)@1U_++e6tHEh=@
zR7Zuu^D_|$KwsHjH0{3r?FJKT*J<a3i&Jx5n1Js4<b9cEp$@d6P_axP7FP1Hrn908
ze+u;`!E{5J2~078GpH^EKRt34B<<;BQP?l<KZ%<dz*j(um%B$VanZN^GKsrP4ipM=
ztL4m|cpy&^b^%YBZW}VL1)i8P@$sS@&ATNkkk5U+Q4b9qrkdRFe%P!a-iv2=v3d~{
zSZr%6ERvNK%D&b;6xoGUDDq>y5HD+@e=nQ7c!~w5JV%RY@&$#;mMv`TzyZt?@+_Vw
z4}rV@sK!YF@9J|Yk`~t<7ATA(4O<m;imw@0fxGHV1gUyka`v<^2vN18+M!!pt*&NS
zZ)=+Hsv#?SqiaiKzSGNen2tN>Hs1iXo|bRguIa8fh`B9H%A<pG#|6^=CcE;8f5=Kc
zE&(Z5ozAmEBB_7Cnl@kk;ML`8D_57O?jN$cD+V8}E|a{}V(6DI9W;?%5#|5$FR|D^
zue-3X%UlBwV0W_EOc(;oX{j)OD_6v5NL~h3lEi>ef;}k+g1`Jd_hQ4&T1}EEnoX&e
z{Jx|emj*=XH~iqSyXF(%uEa9ie^`V)y*rfeELQ@qmlzC8r<w`9j!&&#orY~+(h8AJ
zSb7T;ZU{H5F6t0+E8T^c&(0Q7RcN^!vO1AY&K;wjG_OY7=>TVTsx|J>uA{dx+}nj1
zkRt|+5kK=SBcsyEibbn2ofg7{qH5JEd9iJ}lnOSGNjg)*xL6cm5El?0f9!ayHt!M_
z(D5Mkm^z1d-AxtV`eWiTR4v52P|%zens*Xd))g+)SV+QKWldSmz4+4L_WfW)jZ#QU
zw89H&E$HWSd1n$22&2>nXv+hmV=9)M;{YR_<&*1-(ys4*G)XUBaJHKaMwL<^b0223
zJdH#UXp^K@&;rA2KvJX$e{bHne<fk~mz;WU#sGJ6Hl6-HXb3ku*)M-Ym^tp^ckbVq
z!aFLP$CvI;uGKqR)TI3BFMo_l>fNCAN&7eH=LT>t|MEwno_9X{%q{3Ie+--VZa_1H
zTd2)sam5sp^mmZTPHr7B{Nye6_Q^Zfp<5-$wF=9;R_Mt<_iU{}e<;A>1LLOLs}4R@
zrWrG*zM*m=^*2yBc@CC@E}m3wqev6^3H=`OMXO=P0-~O|&Yd!6Mg`1A9Ukl`vcv_n
zaj{UDweBWM8AHphC8D+%IudOK3yqq0cQpPp-YrJ{x&MV#MipS1Prr!`xM`K!4pJc1
zPqC3GX&c0m6~J3wf5KeyDY1~3tO^wR=qn0@nDhpFP#9`th%Kbx*UdHW-E1#uPws1h
zFF~G2nJ1&8Og~g;f;2A5!ji>FJ2=};hBI(oS}~P$jx)O|gE3oFVJk)fKLF8kbwQW9
zmQOB^S*=q699XIri7&_M7P%Fc686F+IwEp*RtZp!*ayj%e-p><fW54cZTK1<_pf@n
z8;ky0w+5OsB2MRU8dOu-vLSPXz>ZboK)SqA!P_mLqqo;Yaz-5zlNcJ3$=24vt8&`t
zLEPZ3`AC@wuUy4Ul9H>H821*FwXf=%z7}g#oM)BF6wQ#v2+o2I1YZ=+MkH$Jp=yLp
zZJl+s;!>p9e<m$2j$-B@u9v=Y>38|*tK4n>?+^I&fDoG<k6YUTe46{|@$U~0JK4AQ
zpLJxf#RpELcq^=-g({Mj2vQPrjdB}P*ZUTVrY*-?SIXeoqNl;vv9)<cA+sqzO8V?M
zMRfHtNlFNz9ioaHP9>#;t3^3NO(x7k%>S#`oZ^KDe|0!yvrw4GUI|XV6dYWj+*7-Q
zD&={-R<hfXI!>|7Y$6FNB$-fcc8jYnIQAq;XQY3jm+LFj?4zj*en4-j9>(5;t0XNO
zy|7}`HIyYO5>~{gB3aDH{YsOi=uoo4>22W^0gPm&f?$|PtHgGd{5=0T4l!ugQ6JhI
z(DMQae**~*!(g8Hv_cUF42ckp>p6<roLySZMmc$1y)y4mLmLCVuhc`<5&oLfbxp;i
ztGA0u-ib8iy~ROf|0mKOvdvr&5e>|Z+o~0zunz<MBbM@Qg*d3vL-G#3w6<=|hhJ}h
z8Nd4VK&*b9YykIjUw_*kUv|~N4+H%xu<7`>e|hE9)Is~Fs%`IAdV&vwJ;X}f2kLy+
zR>oR{{Snrwr)bTo&BFoIhD(aN(l1!Vvb{bzL}pu8KlI8^ipTmUTn?r{i7{ez^Vr?I
z@|awuh9xijRh2OP621|W=DQAKfA=5k1Qo4=a8K;g&a#G<bb50yKFO&+S@ka6GSRW3
zfAh6cI$%hJX)b*Jo76FvL~5OQ)WXJn=L>O6qhjsij)v>d4VIym#73@(^Wx6`=omMh
z<{>Yc?c;a`TBTPDlW}qArRrbsQZFe~HYc%eu4LEQ%35OCf*z8=V%sqne78-OWR>g`
z<h2upj>LnrIL|uZUwKjTDmlwCLNvt9f7eZxL@x4Hx9BxbYh2aNV&xi+74_+_bgg7*
zo?ohx1<@H`rz3aIMDYQ{=Sb%fMlNw-3)*r~4pmjJqcv0hVe>{H2>#O5U)qG;6|!31
zGp1PrJ~McB&X?xvTSc)AI-gPsfURAs4|R>L^5`_W{9vCBFtk@rs}_T+SoBxQe;LhB
z)2#Jjw?4a|vEwHg_VBKFZuRAc8#nBWiX|)V!}W4UlGkvJYkd6;np~Yuj&CgZ3hUtV
zU865u@0PJ+_1CoarFY45t~@RgluYPJ?2MDpH)TuO@vRbD^Ab{ezdcXOM06~xc$nAc
z$5lQX)*VqpE;CkUvs3u-rnJNJf0d{918q&(gEtBFys_yc%}gjb#?VgIBQ7VWRd%1L
z0Ml7D&CkSMa<Fuwl@a6&`(QFLuBFd!Sq^kB+a){!m(}jEME0V(KSo?5f+vvfP(|+t
zor*>FI99YPSirJpwUe`b%Lr@8Z07q{|8{(R#2Ak0YDbX_X&8ggJKIF`e}2G?Xj>WA
zgMjR_x5m7I4Ypf;-bfN%GdK$nPs6H5BQ3X}(TO|R;M+$}@9jS7?>&G1^m+f`?vn?P
z_MS^B&%R{~hwR5ePlz#SXikC-fwhtL*SyB)Gm_x54^YHV+?j0TCpuc#j|j#~Y9oG=
z6Bn~$JXKbFEe#Ou<5Rpsf3r%Jou#-HAKaSi3M8U6B1Nn)d^@U+ov5_^F)o}HA(zN8
zy$*N(K%Q<={c6#CsoWqu8W%}uP>5~b6LFMQ#XN)`s}`-H12cfi&MbuJ*L}yZ&-+e7
zb}Mn&mmiaOq8l1C3l3Jy<XlJ5*0S23i?0e%{Pgx0X<*{U{>?Ere>I<0bNuA^!O1K9
zuqPCm{GPpw-6x1_L;ky^fFtzv;{wo`M&Fli`qIq}k-;S9Z=@EW<U{*$_66=z6MLOl
zIJRcC;@<2!E7VshVPo<$HRgMv^NtTN<hMHtAmvVMUPtljy%0;ThzM=~7nNB&-Im<$
zxoMCDoB&6Zk0B#Ve+gKCME&s1o$TOlC)@oqWY>Em#9|VauR^I-3D`K07o)G9OXzMn
zLp75T0Hz`<r5uxkyV>yqhVVM>oZdI5A39#U_B-}ouXTr)F)#7s>UCj3^||@`6=n;j
z1Ti#m7g+ME904x^k}zunhniqmTo}+k{}lPD)sPD_GtD#7f1NZeTUSjud<4mC83fXQ
zw4S7f%H6*#3t#fkr7LU`UB3b&R$o42np)(DyjU|hp5wb;^yO(^pZ3d1-wr?&8;Af*
zyM001>pCUv1rHdxx@OL~z4hYH>X5Fx5{9UepG)=QwTyR1(*#Nap~!F+6QZTT+wsyz
zm!6E=mtPlNf0+zgS*(pkmDNMuMogG7hQ1N0g|H$D_m8~8Ca;T0Nw7D^4h1nyOHhax
zkWoOn6fu(Wyj&aCmj#)@Jc7?_Ep08BWw-?axgm&%p=|8Um1k)+`CtSq>4$rYY!D{%
zc>jpSn5)_fNeWwY3|R{4J>tm0eKL}}Mv-=Ca5qw5e}NNOHW-Q~T2@z`((Y^yatyV9
z?1nlBDb3(I(Hv;+8=ReB*ha98)~jcxKqX|On$l|otJ?C*C8xTqbE|dl5-8|u7s?_k
z_QJ703?Fi&A`6Bz?`rcXB~1unB8)r`1mzgvcfnAvLXbvVqYkiTIM_7+;bGx6)J;Jz
zDGinGe?(Mi1~=CzpInLsJCYR;6l|}@iBCB8EbGodc_nxT``$GUA*TyY%U8vvQ%oc-
zp4|A7@B7QnXZM%12jjLB@eFxAtsh&TY}9vg=^GXthO=RU&&wpiQ%XM7vT=lh3zJ3}
z5HVHz3^w7v$lREjU&t@8E_m_AwV4$&#z|PGfBN1`WTV?iUsfxo5djC;mv)*e%h$D6
zmR)e`b43TzvTrT5lXSWjOB6=aO=hVW$}&Ax1}`q$AAa`HhB}7wVn5qtK_(IL$jfBo
z2?M}d!76avKlq;N?KGeLX;J9ocCteD@gFwpyM3;OjMb*GB$}KTBP;?21)4c{@Le4f
ze=#Ul@TojOyOW!bkqk1r>`928d9xf#Tz5qa?Vn35{SjF72OVO((9OH}yp{&J+pT7e
z6Wx^?&9#$l5;U(P9=H$sn%E&e;(M}hdaNbc4gc%K1g8!<em<mOsd0@waAf!3p5%uA
zisJ4{j7blZ6m`IHbln!c8Xlv>Q5SD_fBoBSsrLox$3N>Bv7T0o$<Ubd(bH7OhzRwA
zq!=rV?L@YFtE9QwaeH~Le+SRB217_8dY`$7>#aOljGWY1`jYDi`(M!wgi!Jtf-o+m
zuDjxZ0WQrN_ni959C8yxoXk?py)2US-xxmSo|5`C>Z&zDkHqwYbK7Y_nr9%Se<P(g
zBK4qK>&F8^9Sy$Z2AOYvw)6EM6wgs-f@6l`>d$Ve^IkPO+b$;E7YCv^y)2Hm5&yF7
z##^4${pz&OKOgTu-jkG3ku1qo0a0Zmq?D&-R%%NKBpiov=wj!pUAp!6w@0mu)3wE+
zzQX&Xh5RxmnlTPbr>mJ~lKC!Df4*EL0O>7o>E<Zz7w)>$HVDxVu@I$qTcjE8D&;d6
zsGKY}X!*3=JXooW@MYR^E8Okl{_D#lLCMHxb(+J|!(s{$SQ5yiqYM_M!SUt1s0SLO
z#5gW>zYg3Ogt|9*QIcD`g+crF&Y<mNi%Aypgrf_b_w{9RkLPtDYeGMae~-(v1(NIP
za=y?YludH)a#FP;m$?#xBjiF9IK3I1>R9BkUkoiYrPC@YjQhRPXfL2I$2uGd*;Dp_
zWFgx<$c{)XOo=U=ZaQmJiTY?le*k{@;`t+^bE>7&sfuZx2I_~A{7ki0T`s4Tc09Jb
zrlPQ{=TuzqJ<qn9`~bV6f7#-+8h#@Sjr2IyBb+b{x;d;Jy)V2pMEkO*AdPO3+)e8A
z_g1UM-Ryzh`rw-LY9iUPDm{x?DH2M?kROTSY8}d<>?H%Q&G%@|S9=YV%==5#J+O`I
z9~}62B!<{1;hTgb46;orMX_T?r$gku9VBbQSR_Lpv?H{GZ%?K^e{$vHOigDeJ}w2J
zl!yb&o-K~I4;IH!&z>`Bgc~w^D9&tcCF+pAxwRDto2pdrjICG!ZMrzFT{DgarI{fk
zio9a3=-{Q^OjY!@(65^7g!otjnl~MTFsJTp^!~xS1wu5Qp91t|xxu!!P_lMwD|E=q
z(v8l84^rsd+OmMBf9V2Wir+x+3D|Y_te7ANpKvpp%<DF4)#~_l75)AwhN@X@K?wd_
z+xUkfPP&tqMllxLz)+Z>6_TTf!=U)gM`&eQX4tFq#c@h7)<ka7?c1Myx-GhK+ii`)
zUO5Gbpwy88p-t^ZBIR?UJ);I|tM#>n1UFtJ``{U)HtI+oe{t~<J`<(5c>l!NKh7t(
z(`;3}>8GcOQgVInw7z!VMR1)p{2odPeA$}=!a*rT_Nc7P2JIbc0W5}$06vlwCX~_z
z*Rta@m73DpxYzi~fwVqe^`+YXreDkF^IQtvrypS=fa)Vga?KCzk)tkuL^v%zAjtuo
zmF!71GdF1Re>u(euRPm_d8J^Kg?Pn7TQ6sjuz4!k(#%_VT~{Y1kAsitjXXgoOkK6)
z<+|!|lf=WRxdRfMQlY2vj2~kiZrI~+GrNnLVbj5sp|XL~3??E!hb7vD!_KV`)~C5l
zbmoDnVgw=T6FrwQo{L;cLh0gdZACR4S%bbl$K*>Xe~=z8=+>6Te>5nb#7?1~6u-4~
zpbd7l0YEpS9WC>5Py5goXfS9;heRt;?nXm%C&P{GARf>)*>XI=F6P%wrX_0C7zSqV
zmXq+Pm_mp_#pgGS1@SCNu1M6fCDG23&74akH+k}68lu3goNNa5tCtyPcSM4s15&;m
zhtOxie^4wake_2(H?qJNQ-$w}zASkX?%T~{ktfX%g8MS52bJ))<Xl93MEsWQPrmh{
zPJe2C=utU&wYI^UMUhp$ktK2J+ukLgHzpmWlI9@3_yhY7K(uZaP6lQMfK%M3;<8At
zIhj(|lF;S6`BQ-F!c9h}{EWA3w1%~n=t|~Be?iY$CqMOkNA>xKbcEJR9igjlD!Kim
zlZ$Cz-S5p>&blvK17KUXE@LA2%o~n!WqVE*5$JyL#MAj!);soe@FRr3zIFKy)nXx&
zZC`As?%C}$d~=`^(I}T4<F09#a*a4aCrQq?PxIr2JMp#2dV`K(HOf>}i@VOa#+QCz
zf7|PN*U>HIO++Lq%iq|aweWmij@!`zcD<iJ;m15gG*Vc#`&njXyxlQ*&YJ~->q^0_
zn>~h1fdPID+YHzGGKYk#a52x46H=!KSL34B9Q~a&qFkMxUM$DB(pxwcCafAjFzB;4
zN(N-PIL|4cOAQfjD&*qJ=VIyTr`3H$e@bXXWOvPpn#vV~gjhP8QCi#K^5>Hi$;<W1
zGnr!R9n%g7u=07&f1r3Xm8EGO*^fW4U%Oc`L)6U%ml($hA%`-6$B|3-j2}^_o%fg7
zG%(xPu+pKoJ?&tg&(1_F`-w-|=Su~KZ+copnQ{-v_uV|nW+iPYPBWprXooJ*f96!t
z8b+$lKBngDYTI04NTqL3@;K!gPn{14j8$3xku*f)>s1j8=SA~1+$fZ4H3I<wtCz4T
zIGsIL^}U<gCfeSOW~-#@NAr!3i$RQv$F*xY3PVbdz*-6X9PA1Y1cHw7k+3Tio5O<N
zYX8Q!w3wZZ=emMo)T9Y&qvN~Le>b+beHnT;+{MY9Xa|fV$+Cb+*N%p={DJ8RCOnwX
z@P%|p(FbPv1sf4>E5h#bwHGw7vYCyH#d@KsB2!rW*t(k0YD%F$3K~C(TL_5O-G2OR
zH6o`Q7RwVTjFuIygSl}gDP>Ir!M{GyNXSkYxn2^hEHmn9VhDA7><2qpe?zEaRul7z
zcCtfC;qpw!Dsjm#1pnH`FD=x*(g*6DYx7M0WGS3_?v7oy`TU#v+1<N$e{H;y2GGHO
zKmi*`e%iQm>&~a$TkijUb$I*E&fQOUKKuMXY)FQa(|p~HiPTls`FF)-SKwO5?$#tZ
zc3~}+TR`y3c3gkB95$p*f6fL>IPTw@<nJ&wSEv5o;1{Zy#Etb|6_@Vqr}`%Wu{TZA
zrLt!ew>Kg=f;|~v+KynI>7QgesS=oiK-lkXz@dl*Jl@}(6<okhe^?!N{+V3diypmw
zoBjCiH&Js1dV}d4kd?mW(M|oOi_hHr0dK~?-q&9b`D@%`S^o~Tf6u;3yZ-8{>?YCj
zMB>^8ce(i+88~WVl1U98%X01zP46pX5C^1m`36uQ<O{}WVg`u+Bt5O<fzqF{otSye
zX6>jW2~LE%#z4N!!M;@T5;mzP6EX7cJw~Z(cP;sE{!fBBm>Ie3)(_&5?4%RzXya)8
z>`^i|dl<GwzWf_wf167a*fSC3EEs_^WFcl})toaSz2FHa6vERr*m(fPHVF8Nkr5?M
z@Khd2BfTczts>dvj)(~gmqRprE^X5I8P_2*a&gU*m05ma*RK&8hZSo#FOckTRxMyi
zb~4MHS!UECL(LWUKZ}C-zTdkOe|ovnT7#%U4Ym)eLS&xwf6;(+y1CmVHeJ$dh471o
z#3c#NBG^82k(`1yf%;O-%0CxFVQEoKm?1*G++)e+l1O^uz^Zdffp}G!!9d0MFbo4u
z2Kvlt^-{QZj%zRIyMoLH*vAXOcPuBb9e*#+#F8<j8Lp<IL=@}5>@3v@tLU>kSF0z*
zq_)KPWlfqQf4g3#e)M{!Y<{%ZEuIC0-pS>bBa6LmWQlQBaxFIOycEzGDS+ucZ`zz-
zi!MylK)iMx<7Wkn^h#)IT<G2vU^}n^YC%2G@RiJ9)LM_thrxSfXYE-GgY;K5@+F<l
zy6|$f__1#FQ|#*~{K67AlVmtG1tywZ(0Gx{uaddRfAijPMa*(ZYph1Yk9S|OA3?aa
zepdIs{ETPQV7t|skQ`mqLYST96Xcqf^I|NOKho?%bxdoV_3Ls}04Y_`wgZy)QPlCZ
zYf+@Sij%wZsiDv|S&UYs2XZZkYMwK3oOL`YcA~29hMbgqXa^xx@~M6F^X$6gj`<9b
zdNx*ff3hLi&fnO!=sz^^34?>{o~s?A&YOX{agq~^$p&rO0V1GSg^XvNO|l~l_?nA;
zgTHr6L>9?{w7X);(BMe0PS+;c0JrRCfx3csLW}NUMRl5hH@e$Z`V&AS{RIF<wia48
z!ACimomZ!O5e0nf9C4gij!5j~+Mxt{0!4aqe;I*e+i~!*vuqbatnKU37H7;Sj?Di4
znEfFMEY)w-z5yP2pUN?dgKH#kb36vp{yIIB2s)Dc$?b9}(Wz3a0!5?4heXF?z^H`+
zv#*=mH_dl7%4>?MKJD`eSH^V-ML@~~3m4?tk)TCRj;lSaVE)P_(t#*Qy@>UBhE$zu
zfBZJ#!7O~A*$WUzEVf(7x+7*$gPN_+^Tri#q3w+<=ojoI`i*uZIdhwIM0va}y4>7A
zF#mS63Fp<=4T7lEiAW(`OHAFU5=)ggX6dnTQl)#6PYU-oLnnW6B(ukPxZPD!<#CYb
zI1LA-JAV00-Q3tw?M>tNgz{-*)bbwie+@=7N@`L-$#5^0vJqW%1Me_szDqKcBTg$Q
z0w?viD0DeApht1d?;Vfdw&qfS5HDqkdTTC2zu_zIEr!E;P6vOj-BQgjHJFwXK$@l2
zv+wJ=mXnjwVyJ0lL^{y}h2v^NaBVf(a8fXEK^yB<wp#m6QY`?eDv1oKCsiuFe>070
ztow_iLcGJmP30ZC>WC7oZVo_}Si?Aw=SpMExG<O;G8A-9Ql`sU3E$qYW?I}v4uR(X
znEU$T9G+quUU*L;_8o1<H7n1ScW5D*m9~f9#5P(?3upZZn9W0t`3K(8aW(&8bNkq-
zINK^-b%{aT)e6Y9$g*5S2?fNuf4N`E>4F)EjPr`ZApQ{5ol%@Qb~vz;@6%jXCnH~|
zsz^{@HMI#cRMiNNU5}k?>o+XwQVR%hc<qP_G$;*B;f^u|3p7ry%$09}Wh^BNpDC|x
zJWyV1kmqJLvTAGy`<yj1wB;<zX$Ka+IZ`BVxLFC<!#f@w+~0p}Yvj)6f64akPy3Gh
zj->Y0Njdg+$_@P0&NdGOG7o&~K9rU2u%Zca-#$Vo6;0x8ilDWhmqjoZK8#53R2~5g
zUFJCUJ^17xQMo{lTF-!eft3)mPS!f9Wpe}eI^=EBJTQa8cS5M!T@R0LMGLfcI90?|
zTd|7#ELDHl(Rjdd1*@}ne=MzD_?sq5db_q_fE38zny~6PD@zrc0I9QGT9<UTTU!z0
zMg#hcN<hdA@IMz?{55)UxnMMfhNrKPV;K<EBq3?{WDXn51FOC)>mcC&pepbMCxw)(
z+eexa<Y-%AcXoz_NNO17iwVCqE6x_UR)ZEP8_@~L@47QmRHn%Cf4K&V>(4?_&1yla
zSciH@K6yU5c0wT|?T$l6Zfo7GPEVs9z?h%ndzdSjR6rc;NMHMha*dY6K&w;?(Mwl1
zlvhH1?l^XwgtD4;^x`HELA}ZW>VzbExt31?;_;g6hZSJT>(&;humtP&hm{MGPL<as
zQ;cLCl2dsF145GOf7aHwauk+Np|a4cIN0*RRJNDYjH;W{Zr$xkl*>#dG}}w{aeGmB
zs4;1}T376fgnuVPIm=fCx-V~fv{S85dky2Cs1O+YD#p|lGhyp7C1w&XvRagk<ZOi#
z#V?ptL7{tDK;0Bcw4+jIM}$iSwDpHsP93$9<@>BTR`=)De^$BtDq_m&0AWE~h1b;-
z)g+M3qzh*fl&og+2$*Hqu?2J)AeLg>^hwGxq$i0;%!ad^(-q;A?8}EF*gYm$G@5$G
z%S*J2I#Dl{P8|4cP+a}bTs4V!IWN!7VWndzpp;(HKz_o0M2qvau8sQ#akhHdV}oif
z+=_~owUQ`hf2p93I4l2pa|tZzv+a|@0dv9vkf3&0_hcGfzl-d>C*orgOX6sU;}0We
zp_lCFd1cT5&pz1RbR(sgu2@1|mwDI!Aj@o#0QZVXaasa%NT4f`DL0HcGUx>Jf}@Nu
zmX+7V1M00t(gC6;V%&+NUg84{w(aCHVqmj^qEX;*e+Gvk*r=ix<r*g9S&Nqq1Rb?F
zSzr&)?S0o`mXFxal1N}OonStjg?pLxvQu|la!L0mWNTiRA!K=kpp0y?@TX1LqRD5q
z-KI;kh$6t}^C>}pKf25zF)4iyH?jyuIEwi9MO*mubN-x#0$6oiA!s>p-&cB&(0$+s
zXsK~le-x_Sd6c6Q)l-&nIB~S7HE~!oOtt3J?6of)DOn^ax>Fq2j(OIG(-W0tbz724
z9cM4MsXz-<q}i|w6VRo3eUKlh==vT=Sznc6&mw4P8j*rpi<1ZCE6be2Z$#=NO$y?W
zn8!R+QCv7n7KEdUj1_7}-u!m&u#-J|dVv3ae}VtnJ-q+0lRembw0F4Y&Z7qm^Xm$3
z4M8b{&HMd|Bfpk_Z3r(dy%@^oteQ(>j?PT9Y0#Y;DdeWIhS_%J1Sl__Xo@w;vArt9
z*6z!DJbb)+KLfLq&7wm#w=h~(-jhiG7)=t1w^4u_iBkZc)(t0saX9kX+VU%cSZPFk
ze~K2oKs<V${qE(V8{#W9rpM9LN|EZ<5Kor3mWm-L0aTDhj4J&}6p+`-eI%^_<{NyX
zA6^(qTK<&Hc_jvPE-AUKR)HG)tnl_Mc_BL7QN^qjtXf7a$xi~1d=QGxjmXDdq6(&=
z5(G3WkH#1>x1#E3;$PdXo1OW(lYb->e`!{Z$4*3WOES9rP5c4ECF*?&^Z@Y4$*|`~
zm>nGKCH);85I3uPfHS$rGx~v<c8*-PwG$ldz8rLvmqT$uUtQg2kop4ZGI`1CVOz;-
zzSRe6Ws=s7mFY?w1Tgd@fn2W>5w<LoavRW2v=^}XAUICl-Erh*ujBGO>xwdhe|4cB
zH4I|j=U&8sZQsU}7Idb7abUkmoyjlyzHtiWV%+b(1^+r?3naMedO_%-Ipb6)h-h|4
zgbb0ue0?1`y@eh`&sSlZ?<nu=7*LX7-sDk09?8-hEA&802(cBPe>yED;9bU&71EAj
zK>~UW_pc4eVzmydkRl+b$^;%xf8<I2T0HBz!5-^9nz0*$NWtCg{>Td3ZEZa%E~Eis
zY?<<?$%`X9A<DcHm#oCM`L5itaZF2MGIgB(O%?9GHSQ#%xq3Ys34)%pMbl|8v8bmz
zy<2~qc88fTEXNV$A9f!<@>!ap(x2M7$RwJtCjJ1B6nNRQyvAhm3yVc@f6rbB7LvGV
z&_;XBC8_WPVF_VF&(an7sT;{+EAeV38~O|l&D!l5Zpbk-PVN&h6uuC7w<<I!euZDB
z_*=b*6uw=tTZjdhiQh9&WpqafBr)-F`mFmP0oDSaAOKv0dNBs#n3mdIuJ-_!?&1_V
z#x}D!Z$YB4HKr!?g(B0%f3VK(eD+x|I@U?&Oa+LPRVU_8n4~47ep(u^!kcou7>gUi
z4QEtL&hS}&bW%m%jEh!y61QETYeAw)<jip;k`bWKZyTG2V0kGoqMnurTt(3k!LA&0
zVFs9%ye2|!8=|rsP|izLV%1sO8;%w)pCs}Jm&Ph08#Etk7>^=Oe@GVqQxGM4N{^Z4
z?;KFVk-<lIv^O1(E2nc`s+D65+L8B=naJQj8Hz^Nf|dvwS`&_nIdVSDFN~>Uh@fF@
zwbl}{UQ`+%{Bl;D4#as`NC`WMIkhLuJ6X)@m|3(buWxO!5V{GFHfkT45BttYLg2<a
zba-W?6$|QlonZO%e}fy_KKs4i?)7>D`KbR~#LFPK4R%;JVUY50p{L-+lN?Bt`DN>R
zATF^+?6a41oGkNR9WV)zZZo*~FaNv$@Bi}O{-ax;r&dEn%*5icbTmo9QEm-mLtl%f
z)?4m#iH!zsMkz%;?H=6Pl49|kCOHmfslB=*Oj;@xpJ{Tbf54$oJhrxCC#xnDgj?(D
z>`{?BBBvB1$u>tcq}2`dEcbt=fNbCXqHo5HzDd)Ouq0FN`u8Kr=0>AFrD{%*E_W`l
zu5Q8-Ld+4PUZvR1425P?vW&K!r6h~ia>%j=n!;qK(A_ap378Wx%@G^^k*Fwo=m($P
z`gEWtepYlne?YwV{Vifqws1r{a~j@=aJ`m~6r{~lVCbmd1oS`2X?$|pzodA*rloFv
zQMk?&_f8b(X>Mg7RLf9&yKz|yZolf}Sc6gJfxMbk99W7&RuMeQhuV1qqV%qoMpM3G
zIfQY0ypZJ-FMMc3;>0)VvWtmCFARxwoHe}+c8DUTe~N$tB`6xL*3$^YjOk`_JmN7e
zo7&~&fEJxXh<i5EjD6IY$DSBLL`hW_d@zefo|y<a*&C<>?}5@K06*?E#%(-BT5mur
z2+D!^>Z8o@BGl7zN4K#o$on&lWH>m^QR6O*!Ad!p4Y>Jw6qyg<?(qtz)74Y+v<3om
zf)I67e{PAllNhF1;iSaN;NV)hjwR&=>x)NG=nzK2`l?x2aw2jD;<asKUeBYg2r|wY
z!Gl4%6h7QiMnSDm9%n`5UF&AM@w`Le#;l+$Mm{S}#W23bgeC6<^+xbi1qfg$zEI6N
z-P%GfPIzrsZ-6>Fii2&hg`T-JUmQ#7>BR3qe{)rU$DTC@6x}(?9rm31fh}z=Z{T(D
z2tz2`ASyMOFZJ3$A-%Wm&Epm05!rbUaJnZxretaNV?XWE+45C+JCRpGsIp+c#p+&9
z#dJ2ijPD{Vk+ZcG8ylC;WYb%bZECrZ?HgebUArlP)D%}85tRtRO^p0i`*_6TXuBO+
ze+d)DaL<<Fx7q$3gu1hQHY6RYKgtcDYc?ue0X?lT7@h~jOI;1SD<;dALwxwC+~mis
z>W7lVvcR7EHkZXdY^y}hhsy*YL4sNYUv^F}rSJxtHv+?8<lZXA^cx}li;^KxC)H>~
zZ?9o$*B%$iEZyT$ptX7U|FkGy=OZSYf92C@-+ypOJAX0oBW6(C)FM_b=sutbtCAr%
zJ-BO^cl~@diN+V8r6@NmZkSS=Sjz;VDb%65SYyY=g1^wL)4%-Ve^I;!x%3q&{V)Ic
zUsZpmQ`wZ-JUgzOc0Uu0_6Q@w=VHk?cN8wXc*8LK9LCC!8UtZxb9+kw^n<J+f8v(=
z!tgTN+Lm;q?QJbnQ2~Df)hG-$RBZcc>X#PnkaQs6?blIylqmA)Gm-pZ>vV$r@JoY~
zlK=f$+PG28F0XE)xocN7de@Q(AxSHw5=rtGbc~zrBvJLp44~>xws8{DJD;tFrTNXO
z<SB?<MBbNnGOb=Yv^*$wW;s!oe;#$6Y$%@^c`C_JGFFLRwCv)Q*-=+*y&tWu6NVT5
zVwRh@^E?qes2Goj$d@xE0iXQv@3ysITU%jT`?p|OTWeVRce~oZ+tvQvuJ#k`YD-*p
z9cLA8ndsrnt`T8=m5<6iL{h#IKF<;|k@bGJcYD<r(r}SA-wXMAQ9xl5e>Na^1#(5<
ze9%g^dSYT+ky9X+`uBa62&r?*U_k99>yh%(ZLfz~PX10f$Q@+o2iSp*T%Oy!K~0Az
zIEX~pfTArWW3B6+X~n!%w16DSk|@Hzk--j(Acj64?XMJ)3q@!#_}vtpaiBGoF!n%8
z0}C=<P$LlTR4PMm-ck~vf5FhsZz~+K)t3`OFzqUEuctQ>!X!7Js<ou;uSYcS>)guZ
zydRcxhVEg6TU%;Y0~0eT-3?)|5#k!2?Qe+oI@q|~yVbkp{&GTG<*pbQ7Od9?MT9%n
zaStpj7=<73L_X&xP)urm9#$%b;Mmq7q!M-6wzh<N)GBNI*N3qvf8j}-4o{cPEs7}u
z{;$u@5U#`>F)jt3ATL>kbG|_t&$zkdPqQMQ<Vv8Q)@MDt$^{VKBQbAnK>{+E8c0QM
zUq0_G-`}=%mNAQRdv+v2yA*;1?Oq`pr=mF83o%e_iNEfnMb5C1%kJ38;*J=dL^Q}W
z*Mpu}m<c1{1c$?of5Ox(J5o-KV*uCT`SL(5V!4)}5VS`T9~J~NpL(<h2HEzP|MI`j
z21%UEAp6Vz@Shlxa$Gn%m<d`oz!c?ggR*rk2JO&?fZc=+_$_&eQ?I>*_89wj#icaX
zkRgbjqON3{5>Su&A@&G@xPI`z{*T#HnvFzE^OuI6O#_oYfAH}}7*{(~LXC5u)L<~M
zWmAz$R?G;{mTOl6I<XTH-8cvfHE6Q8)hnjO1O%Gf@0Bc%*iQV=)Or$lSI^oXNOQG6
z#U;!=FK!w3UBan4ku*^kXHsOD5zT`gRec7l5;bDT?{zG=_Mg1)%jUGPiXNRjiV5-z
zE`8>m4@_LPe`verMv)<Rv&YIhedcfwImr*>%ZjmqKG%(r#^z4Il{I%S<g+0oK?f=W
z-g5#OAkEpAgq_#?dsZ}Y)#JOx3Zr__WH%)Vt&g=z;;311Y2+hgB(^KHRJ(Kh7Bh!x
z68`fxix_<Nv;XI9>uq=GKPw*nod0p(B!=1qw^5iUe<)8<-!Gw_LRlAU9JXS%s0EYx
zb?HcIEKyt^HqYgl!M89*K~1seU5(gIq6Z_i3#A_lj%S6(6iH$Rc_b3+n7OaK8&JGo
z=-wd7RSosIkV<{K3MnG=rL59@@}4m7!I$ji>j7PJgs^spxq4L=<flVmMY-PxD}ohS
zNL0qKe<m7HZNd^_D$0vTk`IoeNSKn|P$@#IR11I<!;?LYW3dJ+BP>(nN8+<foQDFC
z%c1g%5+wK8ulwY1@+d}MI9(BSuLG3EJtYpkw2UU-I%%Ugc?I&YYfGipH{E<%b^$}x
z)~sZKAi^cbdTk1J@5?`}C&+NI^0P{i(e>J3e=)YlK11WmZ>;`idU3k%z7^D*l1Cwg
z@rt9DvAwiHgcxfPyxheMY^14EMZYcQ4;ROxf3}xC8jQ+^BoP4}P-oiGp#(p-xMs=q
z2&Yl=af3*uL3ubuC;4o~0Q8j<$8UObO3;~|;48t&Mzn#j_?6h#?Ub>>_;OoK@Do~F
ze<ZvWeXscJj&F_7%+$4=2KG%^U}&|4aK*`DtiDxWgEIkL?ikltUQ)fdvXiDn%$`k2
z5Ex|nm{!T76trSuU-FBzx_r$WSVKm@+gJ!x)(=VFr-e9F6y(5{)u2ZJQ3fZu#yorX
z3pwg$*(=;>)9<!rqFxn={9l^ENQ==}f8(z;5)!yjtmIa!jS%vY_#`DOQlb&aQC?h=
zquk&F*$KtXVPg3L_q|aWz>bXVGg1MeGd{{e5`j~9OL8c)O&mKxEOA05TqY~dt=k(7
zwJ$>KNSt+1M`yTO&oAL6u}=8)%%gP^qGWC?E<M*$1|ULdBxzz3z#E9Luf{<Me}T8m
zLx$qVG5-|LPY_(9_6dHp4!4O$ZUjaAzz|5`qjFRc*@f=GTca)*nz2m!dJxw#60C4Q
zn6r?!3DO<{Euba*QTz@p3z7hSQZ9Sil)v6)y9NmP%r5VL0(tG@<hH-EK$i-3FK79b
zzBIW>-(~~+F<71gD8~EtQ^4X2fAk?P+cYLhoOF&F=!BT~l7W+<W+dsySUIp6-LLR~
zA#aQZ>`Nyr31Zk{@@nGLdlLwr=NDlfZW^=vqA#wZK{5@NZgp)p7ZZ<#+HMTE4kDiT
z0OHO(wCJW(o6-t1@XPBIXlV-xHoUGahFyym>Evp;g>mgNc0s+P!U$w>e}cDC4d3G3
z^Yx&Y-ipS$^lpUY7@933_}zc{{J^}GtyaXnz53<NO_tU8x=7xNZ2Q2s)5KL8r1T7n
zkGUa8vI-)E$Wf_~hi|ioBG2KdN`C@Yid}c(&Gf(BUxQr=s@?knywcr;!KM4uT}eP(
zbiZ#6u4pH^T+N2f%r8m#fASe%5BGK-bh4+<4)>ovIk>9Nhl*W_K4UP@PL{{I0=j4o
ze1C|d7!hzVgci;U1vMKs%mErK5$mRgO(zIV9>I>c>8ZxE>fRVo54Wa6%*5sVZWX92
zpIt-}2(_Zz5E2#~72G`<T#WmM;JQ9PMy{Q%b=}oB+99JX+e9D+e+(qm1XFZ3DGUu3
zY3sky)&N5zLys#$4+*RtBbxs_PHfqj722MbB+YUX<R8CYEI!=<O<($&7&t~JaCm{z
zXmK@XoDGARR3T!<i3(-yOVc+`AM26;#c@r#Wqcy*MvkVM7Z0LWk)&n**K*_w6!+qW
z)-|(nRmzyK0H-1Ff215Au_)q95?(IB7a|3S8CjW;?D6@0JQ@fqJ#|aNVzgycg)bHq
zz=fyqhaxYur6DL=TS?5ch*RWa9WPZ;t)9>FNez+CbJz%9TEJH~+k*&Lnl|K9Ry0@=
z*-jgpRE)MGlw|;t=Gie=xYd$b&(EeQFg47Tl&g6WPEp@Ue{5Wpl_%0N@Ta5V4fFV=
zb`xERa{jiq0&|Bnb{dK^H*|TuGq1R@GK04SIE^l8?@Fv!D=;8l;If|FoQGf|vE5Qv
zx4N3jywuHafTX&DV8Yq!I&&PkE#6ASjBTtKkq~Bjl{hvgZTG|&1kR_#X&KTI%2H?)
zSH-fl?vNiZf6hF#YR~MpD|2P7l}zXXSD|~N^MXOw=~#0b8HiovyAY0$439Uq2trW}
z4YzC2=OiMy_DoneE>8N3C%9z)-qqlH)lXIl?VthbMFw2Pxbj9vm`pS*(kLLc=G}7Q
zT>wU*Mws;L18A%c^hZVonN5ib?owfv9SNmMJyDTefBS$-TSvy5BZJqhKQIx)zbAQ~
z(s8>PrN)(6n>B6WWD<~duy_CY-eLc{y+8E7-+jKnd+*U+-$@M*v#+v^#Wo{3w^63I
z4<0xw=Y1Q(h9Y@mR|(#&0bKqdTi}zEB_?i{^k*?8q_JxM!Xnx_t3%p;u@utQ3@^Ls
z!^?6)e=JDU+Re6)M?;UlkS-%>c3p3eOHn;TQ{3>)K4lxjMq5ms&h+T!o38&+Fx?x!
zN5B5Y#^|5DcW~ju<-{u`+IMehn4uoPiedU6R}M4!)rRRGr7?#7@%NOwzmj`*e=-j*
zbh6vG+6gB9Vuon_L)XB)@EE4M(^2In`T&_5e@<=NY-ii<rCaH1ho~R?a{tMLr!V{N
zBt3od;K059S+<pZeoN1Xpw~aipKPY%YDZx9&BZm;`LJ9Xe|J;A{x0;*vF6A1W;}&%
zV-ecf*Q>^Q#SotBR)!(KJRimK2;3B}Z*Z;ZA{tz>=VkppC-YU7UjP??m-VHWT{b-h
ze|56v(ddNFw>@oYe`_hz7SHz^li{*jxpW*E<=F`DTs!6v-6?!<Y23fHXYCzWa-8Z}
ze0f||qavSt%^Aod!5w*6si^Q(wCcaj2EY6feZTwVkN)YqLAH}w(5x~5-UWc#vvrno
zuxG{md*#@h>v(-TbYm5b4kCVXGP|74e=9C_PYkgS$N9<T&H6mQ^V#P&JK@`HX(Whz
zoAI3VmtlG4X0Unlym*66Nh;as*2vd-bKvlu9ptCQ-k%ovXjAF*-U4|wJ*Wg>6WW~>
zzb?&0h9IO6m4B#a&H6Qk&{0?dBIwP^+5+r%+??gjBxu=b3UwirCJK_zl8g#>e=UhI
z;)IAqs>+wRN)>07vsR<T#|qZZ4ic}yuK%JS;t6_oI?IExEw33(|8XcsWzqm;K$^c-
zKd<}J*ZQw4d*R1c70xGuq`5)q<g}w+97Jjwx(07`Rj@@sC8CBb`poH-K+$SICDIIS
zNnWuh+pOC#rq~!*eF6DDj6C<4RoLAZ`+t%_ITPCgQc{MDN<5jXZ!PXfMatG&N6_$2
zymiE$6M2@F_}V?tD#VIvrSpzV%x|w}P8O@F$FytUB)ac>%ZxYgVU~ohBH-*DJU)EZ
z$(}-21`Ia?)}Zj1NmC--rC+f;Yz}Y@bmh^2j*9OV$Hi<?Fi?#?9`|fh>MB3Zoqr&r
zM(TLe=Zpo*-s+JL0QE?%Nnq-|c;89T>Mi>6ZFUrLL?7)h<tg9opNvX|Rf=zVQ%Zsp
z_l%`9wowLYfI*6i1HYg<cPDhEFm!*_;`XRiUNom9STE!UZZPr@^#uN~c_ZXlnH>?P
zsjh3@b%SghTxc;-hW1ozd`GB->3?}qa*Bu+r{xrqxtMe!+AtEJXNTYM>-J(_Dybv0
zpg{$WjYDySzqE2cltoH20gko9V3NZE1?T2a{9;1WVJp5jLIYxBR44`Jj#Yr4iq40a
zJ3VOAus9jzf|94OFk4#*Re};M9?;GAFaP+T>EMLvN-{S}M00CAb;1}txqn3=)E$pp
zTu0DM9-i6V=vX{MArc_6$)%>hij(0%b%MpXkH{vNyS{(ydJV^>Eq1&W=SW9?p$3&a
z^T*06T)QP%5EqJBXp<8f8smZaLaRNe;B{phlIHkX=Hv-pkEkXsB`T#?sm3#OQVQ~0
z?jgP=+L%QhCE#&E8E%(*|9>lgAO(&XgpbT$x61A!kjfuo8?$_10d7TY4prW@o}vCI
zStG1RjIME{$~qXM<fz<lfcA{cCoIvOC(A!0jtB%7swe0{Rh#Z*J|49sVb}v4z)rLT
zEb7T}bLk8<_$y;IS}i#leLWM>=gauCL?P5pq07&Rhg!}<F%JkqwSN<2C{|0a-jUSc
z_!1wfRr;{5mS^6xlmT%8&CjC)79-Bf5$s*LCaf^Dn2mO_4KHAraG^p9O1^H0vLOrw
zP?}{$gH64Y-TCa-cbp;#$?-;Z_m(5xOO)~YV|CnDt3Au;IiYJO`?a)_|J=xKdopJC
zRMGl%`RAg~h>HIBcz-AR?3VitDFAMq;7=vKiPDMgv6Fs0l*Nt+tS#=zqreEW%>ZHz
znOXN2h4I{+A#-%~5rUL9<bCYD2#x9-2jb=kqpZjCX|jO&2o`zQAO783H*Eo_%1!5s
zUxi1I?A=SY;D5LJ#rdf215eQL@VU*>|A?py$;<QI#NW*8+JDjPP)F9azjc~&5o~7%
z2T#Lw;C`uKb=28O*<Y(bjC8;adDImrVYeJ^=#Rn!mKw-oYlPT_iJqVxU#SisY>=T=
zBCF%V!__v2c4zzb9oB2#2&L{2XVU0F+UooHw5-_&TZR|0fC&C?zU!{Ua_ELRL9Ovd
z7q4$`+iRgC5q~CkvZD=occYVSxJ3oW!aqqt8$am6#}_UZd|r%XG4QXxWV|>=Q_V+H
zU;j%-hrzi<U8G49BYo%7ySINO<3Q0mRDHDEbUP?CLgMJG_{D8V^f)?1s@bVD0A>cg
znh*Q<Yex%SpG_C~FW?M!$HiFR2MTo1*>a~B&6$TaDSvpBPV{%xt?U=;mJ8<QTutlr
zV6gLNPHL(q+mq=SIrD(tEy+cu<+M-btg)Zd%V`-O%x!__#Im_Qlpg!q)n)Xe`!zk#
zo?X9OAtoW9hVUB*$_1?MCESkLQ7lqX(EW8^?-CK`V<16Zv&;dgBSdN(@`#l$-$cr6
zW%=~yuzyWh(P1&E{2x;;;9dXs@nYiteHNOz`{6viQ(XXJycmtdUgvJMJ{q{?aw0~R
z-P9$ai}$9Gq?6EKWUu?;PPNfIrqRZ|$Y=s-dV-umC-fKjY$y8__IW}{@ro%)1BtP4
zba+Ke_iJ~a*RS|sSV$$oq3(hk$LY3f(bs!=+ka<Y$;hHx+j?9+NEt3O?a=XoTlO%2
z6CQqQ<g;4yiqHt!zT~e+qe13(Vo-Rw6M6f6KP#{ew8WB1<?A$~{rS%$ud2@;vcBO3
zL1?E4>vi?_3b76IiHfv4J3A+CKag5L{H^B9eUOv@xllTis9!{1%oYq|om>WyNm4_H
zNq?;bu^jkZ;8~$L9~$oAzo-7dN%3ax7o}7U@A3pXcVntJ-dLnph1FcJk{@C?vz<AZ
z7AFH=AK+mz8cW;_BN5V_aqB81(z9AHH?rR^5OLtTnmI9gFMtyHfye3Gn(S@bru(vB
ztbwpbh}Ff{`MXoMBN6+C4yh*`$rsbh{C{V5TC0yrJWD%JD}+<|&j*O8Dq=(;UMt9(
z-md$+IE|lY3T$xU^BP2#Nt#exj08ph<JD5JHe2S_@}GofCr!z`oGbyJO-Vx7HU8;1
zHUGykUMEk4IRsX@vL|De?j7<V_g`f0@$ULH@c-~jopmSS*KSuV=UuFvm{Gc?34b+c
z*<I$mgEs4g{5l>pDP}VP!#*KKRpOytE~a|iG;k$*esA}FwuuS=6xVU_fWP=YVe^pP
z)H){y%_{)OA^b>c#QNzN-2d)$I<jQ+CfD@vwqoQ_lcXFf4ZeBLSq`zh!CDfn2bu$V
zCOUFX1pQvDsXN*0+bwu<cfuR3IDd<_LDV)F{e`m(Key~HEcj0Lwspmc{J`_L@-(hH
zi|;*&YtG@dPT>mO?Rxs#8XfNXdfc)?_OtS(M7PtQV;yc;k9)5!7wL1!_tp>gTEo==
z>sL8OZ5K6Lts?#`YT{2)6@ONB@dH%G^*6}U{c-Kv<E-*`2!8j1y}wbK_kYPXZ<AL}
zGIc@}oB>Xfa+ksq1B&hkaM;Jy1juA``&lPckVQ^`cIrFDAIUuw47HvGb?uJvl6Gpr
zRmW1p7b0Nrjh3Nz$ElayVGYZqWh^<dv1GZ>Qw^;4rqk5W?N(@3<pM`qO&P$&fX5;q
zt6$UXcn$v<zEaMXi|i;;Xn*>ZdU0&o^@$xl@(V@g^nugXo~Ixv*EFH80`R!q3rdTA
zobUv*TJ;8R(FbaT|8`{Y)PZT$!Bxh7mfoVBSmH&3E<&wCz~gcOZ4hHNLlwu<1;qJH
zll?<g3FPukYfAfW>c<RHPJUHP$hJT%NZB-|i93ofi=iPEI3jDc?tdE|e(Hwvv?`Bz
zA_nc9pUY6YbmPj(x;I}w?mybUzxU)|4`CDUH|n-N#Ln>X{AQh+zk<)~vVLhbak}I=
zAa~$X&^o447M3#BV91lqVu9`?_b$hY;$mfQ@I@cOt|lP#C?hGyggE=<k8aiWAMbv<
z_fEqjs8+evoG3fj1Am6$dK;{pWONSk=eGQFd)4ME*Nq4~7%m>{9`4@TbvyRr`J=CX
z`D6U&JKreX*snO|=s{=*%Xa_S?!m#!r_Ud_cFEt;>~%F-jEl&0(px#^ovS9aGpp3l
z!noOfHSt&0akx`Xkl{d&yHz4WBEe{We%Xq5M!;*X+>{$xuYcED^TqW$yk-nm*u@=&
z1><Fz^D6Y`4z{JqiNlMU@}TFoZlK3o^7h7pJQMM63+&Z{?%rr6d+R85euj|d?QQ>0
z;ZNh@?}o>Iom)2bug=a-X1%fsJ1}w#EBsXyI|#UMHHf3>^XL+=F(nMPNySQkV?Pge
z9KqgFLxx;Gjeir#GBy>XN9JOWSWFEn)d_7dhRlktNDI;%kV;MC!UeGt<N`U>nVxF&
z?KIKZc;ybuc%O0vQbb2GzhW!T{r&Cx52F6PToE1JHPjz3$8?nQ8g@)Ts==mLFvAhH
zwr0|9Ym0zTj4}4eq>XGCe}@6TQSYDtJm7ClTxDBZdVe1Q8c9*+L-DFm!OIHqSz%a@
zl3g@!Ov?aZo-V$k$<sY=kd*X@#L37qfXB#Raw>2LS@EEBqtR*?<*TBY+N}M&#4r5N
z;;~GRaA$8)mn^WSrm)Q<;DJs%BUg)Zu%PnHT^B$yR?M3ayzVvytMrD8-;lJB2f!Sj
zNRUZt_kU=bftQwISNm`&vo^?+JwwyKGJ3&D3Mvz6+JG04P_BwV8k&sfg-^}VNkpYw
zuSs}eE!2TlNvR^V6yXpXm%o3^0tr{hB_ASetaF|=wPN2z!jv|eo=E~vr=CeZTI-qg
zOy7Ut+x^3bFYfi9?!GvD*q4CP4YOS(feb5UPk)a{Lc*UUJ0K~S;C?AL*bG)<Z;YK*
z%s0`TE!$+D{I<eXVD_o#rzS0ed}3|g6H)STiIf_!s__@ZlBUrIAwmDDaeg4}tg<d#
zX;oNZ4!SOpt+r&m$A+=O+~TRlZ>LwMB={-Xk$lNZfI|tdg287r*3pt}cAxF*jx#-w
zMSr-o;)JIc0yHI?i#W!&p~2hc-b>J;|9{uIp#i_m{!k!L?@7f-z-VCh3;)~w^u44S
zm&4*DpVje;geLNgjE$dD86<(dMHu-K%W|LkBAL9thHCAuUs`>kEL#g1p$;Zxm8U#k
zv$@tK^%V_5h}Rs2Ng<1@I30LfPDC{Mu74;ccH$IZ)gzel(p6y7)qDde8XgH!)m@1;
zX&m95Y!IChpf@`9*3YM<CQIQ-eNv7EcY}Y$)Za@8A3qEK?0sp`9$)u-M<gG0@B8{N
z)3d&b2X&7KAJdEBK!dg!r9dcn)x8so$P$3(JkrwF7*X7PEK)!)rbs}!BLT@Tg@1wk
z(Y`=ORdZC_of`DG*RaJPpg|NvwRdRNdo{hp(VfTszFf;iHVpQgtN3m}_gEQI3p>#(
zspBF6p?O^*@5J1%<=M=GxaV$mT@jxGth`j~i^3$uUZscM!{QJUk>WPP7{V7EB^yjD
zN>kR8d`d;RI<+L>6<Z}DaO>N>!+(tR38Jb%N(ZXy#jc$wX}ermhGX^Kb|gALQSc4H
zd4=y&uA@~RP%eBmQ*4Ojc1>l-Xu)3W!%MR|s<z{66jebGC9WmG=ZXMX({Ps)&=Ro3
z>Sl&|LvfzieK^req}dpjqvc5b7)wP%tM6URO$X^#*?J{Jylji{v`&uLS$`T$=%e>N
zMp*5Sn^nrNTL$JUdC9Y)l@W?oV$t#DZ}2a`dt5SVK8AH!3XOle6bL^s>lQ94pJ(Z}
z%Azv`>LKQcq4_q(>i!JTesMUoyt&fYg+5B&Ilrrp<EUvi0Rh&yvWK<xu_8<{^zk@<
zlY*I`oxHgsA~L*Z;2Qb^iGK&xQ&DG~UzeM65QjYCZ6sguv$I#&PObAgPIxR|OhYK6
zS2a2S*<6Jqf<<kyV)9;cq2M(Ik$EfnmJ;aZz<bgBEd=)K|FAg4@N0A{c_*6xBaV4g
zp+WDiWC%-<>~5<KElF{e@KJq#UX0SW<0!l^lPf~-Fuq2N9Ue7;>woYlj;gZ>B(Z4;
zrE932YryJLZvwI79jBbm@-=Vn;kQ*Uu83+|^~orJP7g^G;fEIp$n|zbFrc<x9mE&C
zxtqlOWt;SBIc<HEpS<d1hj4f3`fvtr$yZX_H;(^ysi)UPK7-ptTHC&{hlX^t%pD#s
zjww#6q$Ly{1gPZ~4u9_NKURdcIFJ}(<~J&j_{-L?%Y-XN2_?L|P-bABJ>T1X@OUre
z$&1EHH{lv99^x~)e7U~im9B0>o9fCpO)Xpzn&^4;cPK~>heeX+!I%I+eE^doGXfop
zsEdD{O&2J#_S1QNWZ{p<<Pao9*t%p~l2BJ0^Gn0_5`unUKYv;WiXK2*_m!{5pZC?&
zhRtrI5}6XH20SJozULl9RlA|x>#Gd?mtzt_8w1b3kB1o_iqhcZ8)epM&}7PX1u|x}
zK_Y#dFgTcCavTL3XJzJ$P=RMWOu6h^HM|qT0Q-&}F&`70CvG4w2k^MQxPl0N7{4ui
zOQLw=C3eTF0)MQtCl5bwM<AK~Y5?H+wGf?|ys;ae2ksuT?GUcXKSQ7<{*2IOB*!c%
zbf{@y!T3Q*ZcVb+=Gm3Gd~GeuB}s|Y4VKc=oE&iNbUTYNq+xcsCrw%G_++5#q~S#v
zv4T|F$i-9hL-KSqGE{B}M^rau?C0OtxHDTpTt^m*)_*;Vgx*n!>{app`6;Qy9G7by
zX5-6HyEMDXRl1#ZyTaMOq`O1lf$^DVi=<auIHwIr5;ASVt;SsOB8!w*3^Dgf-WXkK
z{XZ;~`AafjkhB`>=*D#E`t~{&a}hl-wz^&F56Ha4wnPOgeIlki3f->S=ezzXG}urc
zBWhs}(SJayhsMA134RiSPJWX|_%Y2N4#`*XKth$hU_T(dmIv=leIOoR3X8|^?1nlO
zuj~kXH(KD3dW~ZX$4Mbcn;(~R%})Bhlcj#MzscqTh|R)>C}-=Wg_2H0;WgmPEY#;#
z<w$qg4y4xZk>8{9*vXDa2G)*$Y~SwVf3>x>1AitSvz0+G{-C>mZ{O;pbl%Fo7t}c$
zFX1V3%KLmhywQ%pDS7?WN-nBOGtZFr3Pqo~q$~mqqoL#*Hi4~WP=cmmo89oFEG@KC
z+9W$!-&T7CLH)-0><mS{5|}J4kLZ~2bi@K*2wpj4%;$75_r)0DPW3PvR!$h>XHbiv
zEq`ms$An1(Q4JO(qTi8D8OJ0cIW<x3wEIy`%!=Y<A>e2l+Tw&FH@M5tiVH~Jf@$u$
z&#l%kj&_@$?JRxI?IPmhs{UCYKlP?=;cs5!y_;=(;E<R&GA8td(e(9i=_+o4cW?!K
ze~{e=6*&nWZamlrAwUapxI6M_se#d&<A42L5_#<i`*jV%>-u&Hy<WyVBaj2hV{{pj
zpWWNO<i}3-d@-?Cd`%KAsSORKq9*fbXzu@x-6Cz@xpn7m_xA1Xom*WQ-M0Ks-w#q2
zW@(PHI;-gS8`SQKsrNKIU<RyJNifte#vb!^L4Xy?@>552n4<B|tvA>*opJ`Eu7Br+
z<J$;DJ9R^&38S0|MYH%T{Z*_a6TVa}YJIO>oB;_%Y<W^PP5`6@J{pZQF@dBZwJ~3w
z)4LqG`|&(%p*ij^&Kcf~0n_4#{d2RCf;EnE2ENaMdbgRjfsjg=QfK*vRa2+1gN8SC
zlnthNS2<umsxtzN5B%Dd7o@~aNq_vae7=Aw|HTwYDt2lkwEtN?JrAX=xv`s^fiOA3
z0bT-ST$;A!BwI&z+&S^TiDK_+_ZLs5YfvD75X(zCCC$jVa4>lT=rBos(eEHUZ-sP>
zbkR6E3KVw)TRB;cz<l?|60QmJ&77!hrwc-iph+ww{!MmN=dWqlj@LQ8GJiks3l}n`
z(_fS^EGav%b>{^4Nm`@wc$N$A;g5ZNAd^hmV4AygGS)D`Q(jIU)LM=4YPFMvL<>IG
zr(8}%nBZaGn#!U!+Zx9sSt4Vh;tsiih?gg#R~gfV6at)w1pGjM*(Ntl7NMh?*U>Yk
zlaxI2j>Khnl3}kxO@%Mg2Y(bmIqW_-W7vy^>sF_n7v{h@`i2p>)wC&G+!5)5Ke?@v
zLvbVrdPVy?clsCj&A;FXL>)47VH*O2>mhpl7<v|CL)*G6vyR@HfQz|hn4FxqTGlRC
zb|Do5WzrD0H0>Yf1t=h0jE7^F4!XIP6JW|0yTT!zuN>O8ywihQ!GABhopUKs@W%zA
zth6?87{G+$6pILKAet)7?e90No-el##g+1zp^LZ<I+AMUNNU4V(S`sGL%KST;%~+N
z1Y!9o*felkWr!~OVN-6dQNF;$FN)$-_x83<nieK*9gf`#;*lKPA61JX!eu5R6C9u@
z@<S<#92wmU(fnQi?tgD+E6^ywluwJ?P{f79_y7WI{*jfOC*|DgJGOl)3`TxPij-hv
zJ*kMHBbLe&zHEJZk@y`5W$d|G8tv23WVqx;<9)$UD1iblrrG|3I!Xwn=gJGIf<27#
zjf)96h*4rPBybTOupFQ}!a`OyPS}Xlb08NPqz?#Mnw$HNvVV=w+~csLYlI1&Qa^AZ
zQ0Wj@37Q(pH&?Ud(vL*c#DTc(;;$9Rbmnh<3rr6jmlE^Lk(dBI`&Hz4wU^CO#vR^T
z)L}GyCEc=)XcI|oSoVQHh6_YGDX$S7qAk^tjYhOSC^3~SuWPMtu{)h6qFJn0{S*<6
z$V92a6<LvA?0;+DYm~6h-SxSw!l{ztk$Oh(Dcf9ZQ=b<(0kpFN$DYJL4U@-^K6l1%
zh%$}&IU!u)BE%K~=klxogsk!E#l){*RDxA2*i>;@*0A$O{?Rm_6r)5py^HB}twEO!
z8q&W19%ROH9*rc2Vdm+?_-A&U&+J6FUPBLBN-F6Hw|{|sw${K#e}|&MDR2DA$)$eq
znW_FDiX&TOgnKrW?Riy=+(;<pXtOSwwWG0VwcVw0n7tzq5{Nbel7ky_SR7Xi8jC*8
zm?6H((8qGG>EFVHi2tDAYmiT1cN$wkF5~|a7*_!DO&r!zL!8pANGn6}d|EsW+nS1y
zkCE-AiGP+-Jpxzq*eY=O>~D6#GP!Eo5+Ngq*Ai{)Z*~NP6i)Z=u@JQ?F0PZHIZ!gw
zDT`A%pUsG>j3%X4pcVAcj+W>-fy;|wff@^n9u@Wu(ZDs@btTTXS!KnE;EVBMl#8OE
zQA_f5S)rc#{!_F)t@loJR}YL1Eu`jWOd_PPcz^pAJL-rY5!Hvu-9bSfzguV5kFD@G
z#f2;i*b-JF>~(K7MJ!1T&t_FDEkr^@BrzDR2m^k3en}n_Q{RK|9U~>IEI`%H8O;bK
zErmKfsZhy*awzRMP<!z{13OqhG0dOHWVdg1;w3Cz>)nMt7jW*ow=6aQ0m4G9VU#=8
z1Aq654H~}+kw(jYo9(&U+!BJyV{0%u-Y6PD?<cyc<V`#&^(w&bX7x^-jEAhXb}zeU
z!VHV{ocgWI3PdqXn2jw}>$LBlkMcpfj}L4GH<EB>teIe@IZl|L#7Zm1>yKK!0_bZc
zxug=|HSM3GdtA!|+Vf*z2`zv7_;42}!hedt_Z%wIILWRfEjk`Etcp4wy5r5i6>FBk
z+ha&#{@>bCHijw#SzJY-)0lmM=%!p14jQcaePGB%B^0o*(6yb=dWN!C^M;TV6$^vg
z02ygL8CyIa4(2ExjT8sD+fV8|#H%b?*SaBZZIPX#Fa%?uLnkXn8~=Q>R<n|rI)9Tl
z%Q>>&@u3L>slfeq6hOq+J7S4D<!oT79gk-x)XQ@&#t%rX^nQa`14AjFB7$vV35}k^
zk^vfvC60kpx1|sq_QcW82%)De?Et*G5dwYOojr{3@qFclP!40$_z9zfUOUF{U4Hs1
z7xu!x86eS?Au*J1j3SKZ`Lu`$!GGy=3&h75w(Ln+E6y$|E3;CclRW?eEHa9qtXRIq
z7{CEwa<O2pbuh~b3uWs)=YHgy;Wk1B%Yue#xN?0Ny_LI);5yct3w0B0MFgqZh7jF#
z^bnV|)HTq|Pw>Fx^1E3_w1P8(Ve;U>o9GS>YsA1##{eH34J`}pJr60d6@QYiCBwC`
z`Y{49W>QVM@i-Y!VKZAfd&xCr`7PK|QN_d<q!njM<cUql`o~U~zG(NN3UTp~VC6NY
z7k5GQ-Piey_!JsN%=*Q779qpuN?+CKsbgiGVCZuCtPiR6b5-ZL3Ir#)6`UE-jW|hk
zXe+KUsbaPu^=V+ZnDnwek$<W;^R`glij``vs;*ouSnMkIP<-KNH;>yQhBK^~@nHdk
zI$lh$qGCKnr@mT{=1*HSNYRXR<;JYGz8aEJ0%suM`(r^_Q7%ZbX%YLJ*6PCr+c-6Z
zF4t45_aUV#N5Q@9fdCgv(2I$U#?rh9yhipE;c|^^X@#UPv{}y=-+!y4a|YcwltyJ;
z$9bq+tGOVd>Iq3vNJQ(>*E>?d=)9uk0&cTx^LF<$KYtW6qR?TYlNN)b{N&c@PYen;
zUd)_aCMc?p-CeyHht6(wgM`KI?hEFfbx0vhD^i_|Q1qA!Dv_Jo=c5W<MeXtPTYsDM
zw|jOrE6ybA&7JVVK!0K2=|@(8TmlT(cgGQ&foCYa1&3uVC1b3*B{o-+HJ0hJ)zTVe
zwbGwgR3c8X;r^FJUq%~}f)GA9UCa>3>F$YpzQkK6xw?crs_}6-DY!`?YGwZcs=fqO
zdwvey7FokJ#5z$dkmweuF`WO@o->!4rWws1C~q=1z;F~G@_%C^U!ii<vr;%(8VI9i
zJsY1N7(QjC+=<NnOz5u}dB*gO6GRHf<sRRz!{TP-&@X*B!hrF{lC5|Vtrr5WY&!8S
z6fuM}E>uVv-MLdg1up<m5b_D!Oh;N!{)hN8-lXgo|83we(?TmugFa^nfujXN)Y7o>
z62OQEc=?V*fPe5ak7%hLWq%v@|1E>+P#lm2;{_Kj{e;zhw5S(;LIRk&8ggx2`w%#g
zkT;f+R{Vy~tFwZGPQMaQp>^L=fY6eLODXd=2dyUP#CwKPedQY-k!UySY7{#U5Rx5j
z9eAQJ?s5L69E0EZIIV<xlUtFgids$Qe>sWd5GKqz_J2xCf)oj-<k4ixUNTMB098K7
z4)c-M<zd!QCZt%x1?}~42WeEdm|48-$tfL<>Kw<bDKn&MYJ%D)Lh~IT&#t=LXI*&^
z_KfVZ<MoXT$(*GOZsr3s&g6a-c?~ikUQf1GP50NXSQHo!kBlje^XR%RKEGu{aGlwG
z>c$pEZ-3J=*f8bGSVdYOTt}bZ3KMfz5^Wct@?|POA|B01?$UGPb(~%jnU}~!OvHjO
z)G$>AhW5Hyl%SwWF|>SJtEb9t6psWt`+71lT9A@mntqm41q(~L!-`z=2;IJQYsc@8
z=F)S=VZo7Mb{Z5YWl3BY-!2@BbLYKKfwkt*4}YH#t3ImXl_w&Z1*=6vGFny`f(|uT
zWK$8H(Ph(Q7`p9c2V{^eQ|`z)zhv#sR9g{6FDZ_=gV3G5H-?Q3yMn#p75?NxzSHw^
zg(Vo#BTRgu*xrVC9CvxclV(M;$EK#K$A#kzHFV=$jkRz+d8s*o1V#<a5BLN0tZWku
z>wjh~>J3;%H?(AARiJIt+iO$Hox1TDkd&;4x2$zYMVQ(OCCRpW(O7kDRjTBMQlZ)j
zztF4H5W6hWQ<G-m<DACAWpU|;O{-37PjLyggKQr$n3ZyU?knC<%8d+%7ZK>cs5obf
z{47+QkwlVk`#f~A$jw?b52;Tl3G|M7i+`eFX_XjR8u9=OlW+XMkYfA$7=SP*e8{j_
z|HIHd3-c#!0ZBM9r!995WF6_z{TI5>+NSQfh=9~;NgXRK?ek+Wp6{q_cT`NyT(9qZ
zEn@dy61v@T_Ye)HoBBoQ=SS}9|DnC3*eeawW=AcUU#%RRz7sLbyFp?MHbXW$rGFKO
zr%d_`iP}1YJ|1&q?YMZ+j~jl58*apf4!*s1a@kQdJFTPl^$#qi^x^Zn*6e;MoxBy1
z_{Z!m{(hUxOWJVfk}ccx@5;8dS)++_NnYoiWD?UEVqf{5?J$Hk>Bo27X;7QhXg~~#
z)=cokIbq$P{fVy>kE7^bP1|v~e1BvS!?yuh67?a)WOFg$zR!ZI$K6SI5)2$xltN{Y
zsU^n4?j85-qu_N|?P-wcl~ognzgUZ;kJIntq%D*bI=aS_DyQ!-C?T3`+Lhz6qBJc{
zBl6#?b17F3KIMr#{FLx@t6dri8G&tx4Ku$ihQERGZ$7TbBi3|h72YhNhJPDzx0hs*
z1tMNaAcvKHnU+@{ZQ%{BazRLnt+y;{ZQO~((wUJxTUGMI^Krk*dA)L@w4lrb%rZ*c
zgr=X|`jN#(j0CIgN1GNm-`+8mgu+Xui5nuMSa5!#n2@WBN`@=FU!C^dA3qEv&u3~1
zilu$-#BY=Mx4$ImLq-3(`+w!Qf(O$nkY5jEz-G}|vdqR~&dJOgQqu+FAym*&+&X~>
zU-B`=4jh_iAe>k8eAJYa8{ajJz{GL2f4TokdR^10m(JJpx-5fV@rBki$9bJ>H&V<0
z=BY+~IZ;^Rx5UJWU>`fz^1MK(C#`l8B_~2*JaL3DRpn4EaROCT9)HXKE{?nEp>^ET
z3=?WYd<c<OK-Rp}5KGgDGFH$gfvIB^5^E}wIPVOxPG>3ju!(zYVcj$8)L%nxWSa4x
znlpDYZ@g<=A<plpGSOP4QlVhWExBJ_+JIxDBP5zgd6V$S&%A;H#_0#a?1%{*i?7T1
zrH0#63zZnA({fhN;eY9%4H2#HL=Ia}g|z!r6&b%HPFpd|D~<c1Ipidt;x5og6+z=U
zdZtipp52S5?DM{1wDs+W*jpy3Iww4zDCnsvKWmo#_O0u!yXz@gbvu7Mk@72Rzwfll
z*X3}5h_vwebvq$zIC_<pV<L69mHbRx*Z3k(E6(Qz{OQ>0XMeZ4P$|Qr#^R2?ScU;a
z%f4S7f|$jVfxt0(f*&^Q8Pb4T!Yc{WM54pd<KG`1HumAy{qdjX^HqDWX07jDcdZ3V
ze9d~_z13Lo0~xfvCEP;BTTPKnFRSIPVK~IH<P(66Y8-3sj{T+6zIz@O2UeCk*Tdj@
zpK5GMwC+xDOMhd4>W_~6sWsjQ6{y7FTqr;t*vOQz)P`8cfHlTfY@oWv1|DqSD%((m
z4<FOxbg8_hg;3sG0_7X&lf-362=JxQ)x}t0i*=Z(zk8T%IQm%>!xkEEh+@U6Su?Sz
zYv~5w{fN_{k|-gAMKesOwK?#A_ubzEHzX{GxiAVfM1Kvv9qhQk&?Gc0*ClB+I^l~)
z{+W~(?S}x4B*s;J3G0Td-*;PnB+1_Od)CxRy8gI&I|x^-BT*%he+q^Tw}4J0lJtd^
z`jg6;q3TY;>kLLlc$#~2gQdrdTzY4cf&|<&`fkl77Vsow&%<psu3oEEB^_aa?uWks
zX48%Entz)SBB1wZ>asYQJX=gk_ipy$#r^{~lR2ef47HRRBY927kz)Tyxa;fE-QPrs
zYSGHJG95z%e9>trJ{=2ij5~^`(A#(kOVDYlPm>iC6`|ilJ^IjWD-X*mmLZI$=VST+
z_Fu=fOg|INmCx~p1ZI&$dHZuxdGrZ)=h=6Un14QoZ+%!|hl<#mU5771x@M%M={|%Z
z0qV6sbLYsAPZREFt#W#)Y?EeYmE-XOMxsmYppG><Ls1n4iM_Ntnmy@O*Yy>A3Y*~Q
zZ65?OaQt$N3h$0d4*PjM5Z8*y@#xZt#bd1)b5@CXhaOLe>j(GK=#*b(T$$Se#diuM
z1AiJ2g-UeldV$oyI%MUdJNI_T)d!8E6pai9`tjD*lfCcvo;$&}K;AlaL~#nZOK?;$
zXBc6XlhGxCn7g4F+{~AmMDvS_Sr?kJtwy(c{VA*mK!99d=jE8OHj;+nkvv_mo5xI`
zu=vaPP40xOAc+p?lIUz)sDzH}0Z@y^#eaHose{$M4ur(HMK>C#MuWN)PZoaw7?=rR
zh*@BmbO`%K@V(O@q2S~pUMk|+vOZDBIq(AG3{ZFTqB4kBaM?S;oa_oCW0_j@VsHRP
zHRP<jhC_>@?(;fPKtv&p01|8ww0v%MF+<=9JxdCQVEIr`;Hr~XguB9kP+!~<W`CI*
zwQaY67&?68fbN=Wq(qa6IU>NW<6KIj$>;(O@}xYd9=O^fvqT_qJ?Qu>SO7qd_GO>k
zq2h_fa9IQf29wt%;dcYSbOg2F0ZDo;qHb~WE?KhMwL0?ad6_*X$^lOO5^%xieGzBt
z=Dmt4wula8mC>+EOtiAy*%k8zXMZ7v?+vi-4L*^o<1>iP^O*)trdI`OR`NnJJJhP1
z#K)qQ6I2q$34E;t!c2|QGg6SLoSD(3Sj)n>X&xJqL?RBH3j|8^T8DHR^`AEL=_2Xr
zJx$kV8b4;RuU{HHuC<RX`eR*91Ug=;qbA9X(cs7KZX3m8Dd)BnXdVjFN`Hk>FD69^
z4dP)bqogd&$e`)v)E!j0QgLUAd>Ju#EupY<UqmpwcFS4Lkn%Mf;<$pdhJ=?-<}H=0
z3C%alYpT1P1#&)y;;cb6u;AvtNhsF^VNUoFKb96!1V)jAu9JA=Sf?RBEqW`)zXUJ>
z-ZxP8(LcV_8ETe2MB1}+TYtmXNC6$^e-z}ENY03|ZO|Q<1~)5G7kG+krGs@Mx;yBY
zlkoZ|O%a!syAmBSwSwEz0vJ0w8oNI?C4n)5h;9c?FZrwGu}Af5`Pkf9VVRQ53_4dy
zGZhISL`Ii8La9Z#2g5sxW+GDj=lz+xlWGc1(T}lC<DJc;OHZ~(41cnCGl!aN6BE7m
zSN#Z}r|%~nWygkBy8-zn8@znnKYaS#-jji-3@v{a!Fs2T%P?|75v}3}2^@m)s<wd~
zoD0TbOT-70M;ZiL8xmr5F(LfXG9{81wvP0s6QJfL&V8pZKh)cb9wdJ<)3jueR6JP2
zi5p!C)H-Q^H=N8;^ncJZ`nQMC*im$_ipnZZHL;Vp;;#rV&jbNVb)I}cAsQ*?MLWQL
z7WqW3t$e=Z4VWRJ1CbX#qNzpPgHFit@xQ1jJkBqf#Wn%xojZAd7VX6i7*V7pbCg(A
zb<~Omp2*n2{Xs5MX#SA9Na5sx>~${rF*30s#NJlzG1jAQ!GBc*C)IQ&4Xu{xYkf9>
z;tdNRo=3;eA@$I`5Q~q6uk*-6yWJoK^Ki~$jUsu=eO<*_6<Wn<rBmnWZ3S@@0V*br
z231OP3^{H?37feMo1^}5OEmqQk+i=%c>2T;r98HQ90^U+DaO<JCDuBh>(7wb^EyH{
zwU8<u<Fls+hkrf_SJum1Nz6v@yH}*qwq3b}rg<5hPBJu2sZ2f^UJY|whhqXAfyv4_
zqsGk@-u23t6LTiD7no=)qZE}7-8ATihp*Xg3_(=(-E<(og_?Z;nIoj<=bvuF4@MJ*
zWAN2b5>>tz--IsjM3Oe6ec<#|Sds{xi>TJA8|tN+=YM_3u_988Xh#7GQzch}gmuO{
z<hdnd(fn<K$WIfMP%|JbsLr^tpvm1>o=s3}K#!w>;y@Z^nl0e%+&7NPIaB#LPfHf)
zn0Z1nR4ci!KzlO0N(Z$(CMi)8ODbkgR9iR7rp>V6mgf4L=3OOzu^iOC*b`4X9qX$I
z2#$)9`F{_pB0=2K&FW<@3kLaU)mYu5%KEFvaKLyfuG6K{G7ZhjtY*EJgjq)F&a4lC
zH9LALNA|#VU^b4sU-YF-zm}(c;J;a&%jBlM;TOc@9ifHO++7_*Pc>ppBb+6&?j`d5
zwXczd8<(Z8m4BGbTY&^9wjilP?bJWEKG|UFjeniY{ri&*_zm5^H}>%G3I6Ed@ffG*
zEc}w$1ODoy%9B_4jahB-SL>5^=JMa4Xx(QqjrjNwE%KGfCrM0<=J0Di19R#`Yall1
ziE3<Bo#<7;il>0-d#q1V>gV^OwTaH!EHCR|I)V<KZipBd=_%XyDl_^69HrW&HjfwX
z6n|Rns17S%(^!PGkt)cAYODkhTU^{sVP@Xg$FfaChYxlUX#1_GsMXAZL<YEr5sfn&
zNTAW2z017X(wFx8^m+7A_8%qmn17{aM&hL&5SVy1^jsd8Zmhl7(dd8)mWYEwHl!0Z
zU?sH!%Ig;#;o!k{JDSVglMZB2H|3A^Ab;CDJZMKye%h)(Yc`X02et!+l5#HCj3!6Q
zST%!Chst}M!E9y~wh+0pPAtkAQG1ckhN5R=O3kua>eY+Z3^g_K;V|5N5|_4dG49Jt
z8-fH-82p4lklVh*SaTwGSSH1pWSSft?D<KY#vcx~w~wMW=71DQzHfiV$Tl@lKY!4;
zYrnR||C1d(JUo1cpw_u^tzY-yzUkvh!$$y=Goahy(_?>5a8Qg;@+O%y<HEMLIcqo#
zL<-p6*0U;!B)))ntCbT;&q!)Zdw%IONVl%f3n;vs?VW7(ApuJx=YVqPT0Ww6_p9v4
zF|C{b>;L>e{U5XYiYuWVX42z7On+{Iuibp439UQXfgA2O@X(j_N!7{j@BYKY8vU>T
z^Z)q&_+S3pe?*L?L?qQa*)u0CJF;UM@@3TU|Bi--PIkjM7qem~`_-NQ-~Z>EZ1ax$
zpZo35@<08*s3PoSUu5Iyd3NwJ`sx3fJzR`S_pQsF?DNn5H{qB6)BhITe}C`wN4j{&
zfGhN)-Eg!1KV*m1Fu!z6$=zeciPN)p{$WB!e)Dm~9dz?`T8KN{pMT*-XCL74m{eE}
zo!<%P*U5hMS=0=cO!je~5VQ5G5{&#;x1uIb;MzrAO*IlH3tGCb-C>(Bq5u5<c0+X%
z->kaOAqlzQW=DFa>;6~q2!EeR`Ac^ca_{bR1U#%j<l@kGgZV}Fm;duWx|MQowLbab
zH?7tuXtybZGAc!?j|isCoAHu|8$bWX{pBe5U<5(W>Y?1Zb*uZ?ty^OWl$c<5^O3I%
zP1w*+KFOJw1s)09b9dovZfez*cJ|fRh(|gUAa;A)LBHAGW{=%`dVh}mhShkpoo&Gp
z+;0CyuGr<!$(B0QnR6hw;U#fv^?7<&B!W*luC82vW+zL-8}V0v<d2VqLvCDoh&DQ*
z;d_o!-1Hg;s?q$t$0}{V;&3$@EFH1*_p1+D+IH=6^KI4~y12=Ek6zsP$^#fTeBUul
zCvyG67{B+SM^b8M{eRH%fw(-7<s_lO5RV&9rGIooPv))OojNJcJ}vT-(2RK!HCk@E
zmhDyuIBsX%uN!9sfybTfiPQLh*ogyv*PI$(rVrpO)tk#$bW+(X6{}{d1}$Ba=Cgu4
zcU-+L9JBJ#)TdRolYM$;W%Tro6>omf1lP-9OS4Twpq&y>Reu{8*gIbf`FSXBQH{!z
zOM`ewpN8ra^b(tA8fL~~Rbe~SEWQb_K&LN6!L{@i-**zkVgef~es#<p$HmDBzgy~F
z3jVTgq~wNte#_~qmkd5cnSh_vL4-MycJpGwoF&E|q@_Rb8cIZD5=MjU?9pi#B`&V_
zbqiR$d&MZ?E`P5YiI-0$Q$kZFmx`4{8K~*##G16!-d9DkJYXLluvA@o$w+(qi%=#i
zDi~xUuK!k7zSS)!Nb-WMRKKxt-yOdV1SJqL4OvWqJfHC;0H(RV`%&Q*5~#qYt$ITN
zRbk|F2OjZxb#@@<U27(l^siV%^sE>auaUD^o+gDU&3_Y$Vi8UV@m69OlYvz%gkN2l
z4V!^bikfBByXO+I1LKPfgbs7JH%P;Ba&dt?=y^>sgn=TaRw#oq4aC$Wde#{B;<G@?
zc^#|`L+b2kX;CH!Yqybm1TZKWP#LVKNhn64)nkfTZ(RM^y_5H<+1Yk6>ApCSP_dWA
z@wQu$?SBJS<n6-8)0e=_?H5pmv{Y~WgQme_Eetx#9CtQvsi|cX6H>*x+W@goN2p8X
zUfgyIvVF1r4?p^F>3?{~n6>@_KP{%PDE6Ix<(ibke|Q%rmrti@@EZVPU9Y|K`FM0=
zo}WeChu+t8?)rY`C~bdEJ24GcPIaAKGL%rEZht|8e(SN|zxOS~<YNv7ALY!FJVid~
zczB4@d{h^XH(aP<OEOUP)n5Ot<5Drsmhu1?HPqGy>%j$zo=G?v5&tNKp2jM;_2-^m
z6xpi@u_SK>by=Wg>Z0ZLtS@j9(a;HDUd+PKZ(-PS5bA(#4g5)c7hjloJCB?qnnyeu
zCV!2!-rnQsrKQ*3KgSp%<zF7Q9AWhRHeWFo+e$4&OPAwR@<6=R`N(5h{4pXPcct?5
zdDgpq``3MI>AxLW23jz+^u2N9x<k59$LNW~wIQrAHi{wiiKc9_nZmu=np6Z3w{IL@
zMZ)1DP7a<%OUf<v<&+c7Er1hNXRc9oE`Pu`Ma)cGKEYTM`wbM;M3XNm-wiy93uEML
zhY?c8R9=a&XZ(wq4QaIHb+55-FSv_aTac6wqg@pgYA&dTFM)vVSH~_-ia?W2-UIZE
z{u~V8g<MT@AN1$j)ZT^H5f|k}sdttM9wDUK2awvUbo>>vTs}#7j4<s?)+eT*uYY6@
zvrXMn>Y{GLG^*oAN}U^6PFSAh6RLUmz|fs+K0|y#<3CQYHuCHk>EOr~K3*+lPSU9l
z{&d}PXq}Ji)b}IZy6qu3V-{k!+UTt7R({_JcbM!a_fl3M^eM||rpTo8wSA_NfS@(3
z{zBl!uIt-(?sl$NVdVfj9>q1VLVxKj;jGXdKKs0L?atCM$K8&Lao;I@@J#&bi(g+&
z1-@In0Ou`AA1vVFkiLxHZ6MWTsjD@8t>mlOCKDM%Yubp=(&2*X^?L8tP90ojN5Qz0
zP^L{pJK<OD6mkSR&TBzxZGPa&ZtZO=*|XF=VxL!x^@=ga(jk+ATThcH?0<mzAdHcW
zC<?!{I+#)PHL26!#HIGB7fRush4jIYRdP!&S@lcStQVqp_XAm{1Z@lYjT?Z+Y7OWf
zmUFGp6nQO>%jjA<M8x;|x?@~5UO`&86II>c_G%}Ka?a4n{sVhU8jAo=o@^mZxz7&L
zP`UsgDxV2~R?AaH*u%wn<$p5@lJVJ#IkVx+TduEql&=(U0K@U=0q8`5%p097O>|9n
z27|5~Sh_UGl>WFzpL));Baf#Nfk6^;ZZs+lFH;7#V3ZbmP&Vy)c-i37f!4G+-DBE;
zU_v5}H7xAX#8!l#&rK){dCpOP2tK@`zc^0v>i!_>GmTME)fydzfPZxj-Ox@+VRRfu
z;*0bs=jw_+XWngnt)3iL8ZE{Xj#9uYs#Cp)>ZQK5ZR!N$S;(ivB4kVjI>(iG#R~Gq
z47Fxd{`OQqEV$uU(*+{Zj$!cE)_P!=jQPHIc|^2j`d)HGm&P3qt2PgdykZf2pYAX^
zQR#|)rNPSKv1irYb$_e?XNH7|4vWcRteu$9iXK?VvE!3fBp01!B8<=_3F%s-?vIYV
zlY}famtdkNvk~{V#P-7PnFcZ{?y668lFYMQd3$s_UqSrKH}X2_Uvn{EyYJ@JyzV<?
z-PfTP({(hd*NAE^0??`H{&JW!3d8n$`8a8VW>Kqz7rBu@@qe1GKO50?rY+@70+KH6
zAfMV7ufD|?Nb87gUiBFndiCKfHS#tT<mOA#l}VD(t+PzDO~Da2lBsrnQ1kq3X-@8$
z+sC>(DSdKZLtfAVlvjS<ic~g*jZuE=wB|J=w(CQ{q}jT0tRghEYI>;aVCv)TIV;W)
z)%jYY<Yq&$Lw_bRTvL2A5i!P(P*bv5DYdqsFN3r~Z4{L+wsb)693wMo1dkU%08NpE
z8o5e|{41!Ce-#DtudV9+RdlnBXv0jCc#j6*s|?xoPuX5wOdxZ{b%{A7H4=Q{w^st)
zI(&9(DU^*ElCo}!TjcwGQq8}q7P$JZ>fVXpr)ahGx_>(LuYOxgurIy*jF2T)yf|%+
znBy(#9ehu4HWkdIU?7~CpqP<hM!G2YyAnuZM$bx>4RKYNg*QP^9tfcf)Mn;QiYmgh
zYSaoRgB8C~jX24Q(vG=VOa11C{#e9Y=U=idV8wJTcCTPpQ`YJAIEC)ID$m@^6*Oy7
zWuba-0Dtf!YDQqKlBK@<jQyoKf0mQ&OAA{zj|Gg}=CE$xx}`bZY9E9*9l+hzy}V?G
zIq7wZVhcz_(}DnhjNV6?<)zolAmmA?8|U_jShILY!FcR*+K8>ARWv9yXBxU{i5J{0
z=EitG&xl25kSls{SL?K#MO|7L^3?4)tfAv_!hhatt~D_+7zquT9Cx|hoBme~jzj<p
zZmZ)3!p!+059V=;#m@5+3pwYkrlt@R2QRFY)<S$;Sgiub6bl6Y`58sfO{}n+mY32J
zlE+S)I5klJ+EF$!4rR%_@xF3vq6=U-l6EFySVSNmb`-OY0m#Masr#5@XIRERHv9s`
z*?+}`eZn9k&4{ooS%bYL2YNCjHVoDS``tzEt|iG6fCf9EG|!bT$I~2Ag5uHPWd_~*
z(P#ogE=3beB&~Ic1;JR1lS(z4ctMMtN|+}LlMBXhi35GiL|2Wfl|(NKKu5CD1Q8^3
zeR>Bm^9qj_C$Eb6hlE+*unxM?x~r|*QGZdOpX`KQ_YHA4-`(E*^Fm;QY{pWO{crR{
zKC1Z1?fPy%N6S7}i_Yhb>%G0vR!XqyH_%!giv#hD@@Z6-GJrH|w0QmDq3buinQX;`
z|B&VpsE_;LZYPs@+#5Omqw(_Y*~^3M>HdTJ@XdZ(Re<i2QZCv;LhtEM@g)pTOMjNM
z(*kx@jm+11);f#gB36I-*duvpkoUn|Ks+Pd-OC_v8QJash(Vu!`hS3K93w<$@t;}x
z+fV)vzjlvD#ZO0XQTc=OwxV2)eao@x{e-zaFV4b3HNLj*I8kvrmkg$kzuKG@UZQd*
zYI8yqkP4>UtY12^=s(~4cK_)U41emAPd>5l>`J{*;G^w7_*p-<d;k94!9oAKy+8C}
zot;)g&`xo32T}{N!#NTg#{tvOIF6rl5C?nrpYI)F5bqtqo_Qiye*Y<?XIyX^Bs6iG
zgR|x~TeY^CR&jWK2VZ$yPWG#$|6SZEg!J)WP!+`vh~UvfY?SzPMnH(%u7BY(p+6qF
zzyOvG-#_v3`=>a7j#LT7Jdt@eHt0}Mc>OVy#W^s!OI~K4v&Sy+4u<-QR}5BBexx_O
zPU<Wp(^F9YH4}OTWA1SV_eBUVW-`(%W<YC@CGj1PXim3xbv%+P)|}qGq^-!+3pG(!
zv$K2xffOC06j*@su-e8Ip??q59?@%Zh-~$;JBe-#k&=MGa1-E<JiKOl&(dId!=go5
z`#~nFsX7jhmv!ixtXtkgLGd>}));BPBwXWT+WZzCD2_IwhTRjURXp&^v$?zb0650@
zR?qQiB?NzJ*SyBmtS~nQOpzuec;)9BwA!+H%$;xyya5dl)NwsnHGgJBEF{|ONjZf&
zn+%mOZlQzsv&+V~Jt_Ne4-9yf{DL@pVd5kRdb9`tp~-5hYfie+%MAvMUjV<4IB7vj
zB{m#EV!m1TSp%GP_eeK5IHXJt@`a?jq+9?!<-a#pN?2gU-_Qr!D0JbgTQq801leK*
z7hClO6)*JOl$|r?_<x-{P123+sj)FTiSO;!(F(1UVo|_cJvtqn9dIX%b2*y%tp4~?
zm9DeCbSCf%*4YjD{HpJ)P?o`1*#1D;hvZrf8CTn?U^o%MmuF)!QgD2}EH=}8crKM_
z)P8*wcTC_9r)*}MhG=!?)}343+jrU_RuOaR%D@?d$!f^k+JA0aevreevkS;7n&cjT
zP!EmP-P=umG@vbwQ=I~fkm;TXeiws{WPGAxqDHXBwr8m*OhA%)Il(p5F=wpQ;FmJo
zff&kPJbxr+8Xo1^R%`9pVO$cEnOf^1m*_X+JbiV3nUURGTLK(Q2iPD?bpR|IV5or2
z%r0d>t5;>!w|{aXBA6OiqEwGRs&&Y+<wxzZ=O<a^%x6<OiXe9nA7j<AU<gzFv0mB{
zD;CQ1$K@65cp$QfXssBZW9$oD+{GIJwkW8VaXXDMm(yD>la)K(c8r*bYkzc>HqmZn
z_Xbi303oeDzd8(0C|He6lCYm_zEXRmzM}ddq)<eR$$w$X-nv(Ke4?62AuRQZHzHz|
zff8RTJ7R!|AkWvDdFooPKb-AeFjc8fKy!eDcCSa*FttALq#Fbhu8?N;^wt1#$ZR5k
zR4$8o;$Qh>L(d<K)gLkdq$GMPw-7!b1!}dVbzBO4&0NQWPd1|SfVcg{1n`5x@d>E^
z2#2kh_kS2ZV-A2%K6%#(J(nl1uIgQC=CLdgYx`PzK}Ea?$Y4UBT=B6Mzqes$)%|+(
zgLyYz`q-nGfoP;uWEqdxNnGkk?cbga7-W>O0)*A3?7+XOnbi8#OD<teF+xh$SgJvY
zC>a(fqddYrZ6H*Xk`Qi{ECzn#6uUfGZb9wQ<bUaGRE4tX!%EHFVUE$w5m=7kboc_4
z0CPZ$zjH(b&*r=oc9XitwbgtP?mkdQ7TgHJzws~GF8oV1U;I<(68~Zxi=^e}lS>&q
zt;9DyfQzdAIzUKhzCI~p8{DUv{WB>zD63{4_^!a5V1#aYQJXAe<qJfu-GDhPFnez>
z7_FP<i!Oia4I=PFY4w7m=f=jMdy5IM@2$%ebGXb2YDIG?j|-LpjmQb1X~UtRu-a`A
z5hN%PfZ__{me=aO4U+7OeGLgj4uLeI?_bu{JD$B>8&R;9GWJOH7^8<M4e~8b)D}BV
zcUi|OYfA-s<Tt7xB_0<(a8Qj6ibi@io|shey`g^)J27U8TZ`x>aFVFrG|??5UFt-`
zn+b$oa`Q^4qLkLQ_A3EnVoXy(MM8-CP%x>}I-|*TMZMR_S6!!U00Sw!N|#gu137P4
z1^hO|cnWa?<27=WdBs3M7jP&K_p=&*L$@`IhgqM=+g?4utI4diEM^mmtYa~lw(yGX
z>STW|84XMns}6KS9^$GbP+hX66xs_fg*ut2AjpXbKt0Mhid$xG2n7P`Yl!6bt-cB<
zeb%<*<Lx_r1u=`BC3w1TZ4s|9lO^)hH7#kY%wO5HEM#D?gDcH;o(ErP*&8?+EuRmr
z>_@r!)%|F}L0@j?hr!zMh)>b=TDyB)oBMx$9Or)DyzIicay+<p23PlEH`A5<Ku~y3
zKYFcQy*}XE@9D?gghxLNviGgCmUbGvXW!R%CF^rJhhX%6`ssM!uWxwFb`%(FpzEWt
z%7ZKW>F62Vf%@&3Ve$g|=?~sxh89WTeU|E@2bYrrmbdAjR@D!iH-?vvW0ogfsd<0X
zMnCS6{MG#u-1O_gQa@xQ4~j|E$?h#ajF;T*hotn?{G{V#hrNTt59;-Eh!*qy*({&_
z>HJTlD;QP8;y;d2{Ty7%v#6{2&wHA%6UQL3e|QTPF?e4mEBOjLdG85*PZQ5ku4EVQ
zX(FAJXIFB#_i;dW@?M7go+i=mT)}@O-qVDgY!bjgHYlHMw3}^R6Ku%Zukgq^x#;Ps
zJF4z~tJC(!?aog=_wLX?tS(r(#)&=ADbl<?KxWsFU8w;8j+GLPk6{Wpi~+E;2aQm`
z!1G!)j+&>`3#=a?KD_UcexN5#Hc+4|?kPu)k5l0Lzx<_f{=u<t7!iT=v4?+P<3ZNw
z!`S|y@IS94B<bVePu65*AN8L`S5fqrrjlXzz8*w$6ZK&#TK7l$7a8_DTxWtT-Ry?N
z=`KYg7SvM4SNUSfNk66pglwoy1_T)d1x;7i(H3veUDFK!w(VYqP{kk<-*+@Tx{oL%
zRR`qzwA?u|o(E%NJ;`4oGNylaD)Yehnl=R8G=XEDi|0f2dMBpmVm1#u!FOzVWMx{7
z#!h3jRi{=j<Ud^yG@NbEX%sb2VE{kKXEkF?xCz{9bxR;{dd2Bd{IlsOKQY}1?MDLJ
zXSs3n^OoDIYLcH+hBD53;^6m>ENaVrb7yA<ah39MD8^1pA!J0fvIBpsGliiAy-F-Z
zEpJcQiJ@i2m;IDHzM|zR!k2lolQkPLdAHZ=iABo|O@<XSh)5f~Sw|+NC@^0_$Hd0q
zjxlYjA#Q8%ZKRhENRXfR;S%e6g}uKh6I_1xg@r2T-!Nvbq39*b`8Njf{*kJAuVIPM
zjW`;x1i(JJ8Kjjc?`nS$%6{-@@EqaSuAm9GJ*>zFY4AT?rM2t^!Mcx1Ph59jn;WSE
zjaNhVNBn`_sBgsJH-519hOlPa#LdC$16veY90^^0LYD&pVA!{g&VXR{C&ZcZaN7px
z|2HuGNQDYi5?!E@mJwOvw>y_ZouYz!GpJ#-1WeJ$U9e1Pjo*J`l9P)!&C!V7Wl^=n
z8<BXGQitM_i_O1iZnjna6h~V|98FJ^T3;8%>i!Z^QuasOp=h|`@!4%!&|0m>vFU0R
zA!)>Q^Uc_bcY5k;fAH|!%#Io^^B4Qq;u}rtkrTAcP#x+tyEA$2NIAkw{wr8=#EhTI
zhn-j&B~nH>p(%fBG`5$rqjN(s4M4%Vgo-$U2rVmWy3(e%X`C;%Hh!a9rYV3BK&+G4
zlX}fgb{uEW{HG^W2Rgu6qDp_yAV79ui0@=iE!%09?OJ|d6wwgMvj!t@V=PIP)<buw
zIdUJoCjrf2q%Zd4nj!%Z7HcJ4J;S|zUX6xGM!TXXMGk+L>)x`Wm7UiH{jT`DZj(AX
z5wTuN$p5BCuLj_Z=at^tJ1pA%`#9EmDTD!P@eV2Nn}Dx{!C(VT4wXbtDQUwWje0QC
z<x{!TV@wR}J@%p|{;H+Ed}&hagYSFOfePQAr`%5p{r+41PpoeJ+yRgO>i@&lQBDKe
zd0dLK;c<Wdrl)YHh-bBbNg_tk`?o|p!hW-VU!9e!b70|wvN}-ToaC0XvTe`DN?Qe;
zZ0c@yrzmFob@t3jcNa*P-4u_f)t@{{D)rn6#d)Y{YaNtWFyO^;TB1lPN}DD;c_-_-
zC+@?WV*O}me{<vZolk$0?Lmalf18DbW{yq<yhwkEYH)(T`>#a_lz{2$PdnLVK1O!w
zpWJ_WTe$V|O#IK;=5u$L+^`rhXp!TNjH<xU8x`0q%?_tn_-}}Iy!8Jz^2pDx?UDcQ
ze08+M2D2LEpK$;oD@g(gn$@N^LkYU0K@_n$@H)q}%vMpbQf$0xRGrI{z)v596~)&5
z3tfLv%F7}nb+dhz5tSrF(IWI5FaIEkRH}9?wXzBun*@$p{#~s3E4rr_?_bdBOfJoQ
z`|rG}=~Hy7Iz1h&)`0&j_S49&th%`w4rnm*$Q`)#d_MI2qKc}r%vcKW<Fs=GMl#35
zo%-PP_}M+4WjZ^5;3NI{(y@j&VmzJKEwz6O^yw4Y$$k{bjh$@csc4_KQ9gXG*|0kn
z)b-90-cr*$8;ZWzU-5$2Sa-Dw@zN4%^*7YlnC&1Vl{=UDRoZrc_p4J~7QsA@n*i$=
zi3l1AYa5?L1k;;vq-8dpF8kqT&0ZK8EPBznh)@%a3P0a$dz8)yhDw9)#6c$D#lC-T
zq&{_H^%bLR1I>Oz*mTJ<QDUt#TYt*C#YD`f7PL&w+ZR?6m_+Q`MzV48Lu2>QgcZnw
zFN9y^CyL>QM|ihmMhgMfoL;=+LM1&R!=w9;_Lq{D@1mYzEFii)JbG`@n080hYh4p|
zFP^PI=Ds4cbwcEMiw}M6!Nnw7Y-4{4+q{Fj!|djd8_5aS*!j_xCt972Xi2VIk$3NI
zdVKi@;uzIEZMD+Bg(saCBVYme;5YGdCS}pQtgY__e@mvWR|U*aqaq8{Oi@7;QuL7J
zj-(bhcSkIth@ytM^0gD9B|*}ilM0)pe8)CQxs4o+rm>M{sZNj4ZNYew7j%EGSeK3i
z_I3DRk|qX&rByLT(&Bq>EG-`fs6&&3u75~M{uuT83Ng5I8d3bIxXtQp5FFR$mA0Db
ze)-W%fAkCz^-Ml-=WX*%_SIKkWjBxW*-a_FqQwP{e$+F@-|%zCIHNwmv+UguEREvd
zavg*hZ%6NZQ&l&!zs=sb|G$6C81Nn1-HF=WW3TD&chi34!>lLsE);2abGf26L*mxY
zzQXE>^UVDT-x*_zE_aYP)}iJ|=NX_M;RJLGv+?Pjjie04(T^J(7P!c#xEliBA>iMn
z1}KPnP8X9B`2fYnyC0<6H|!I!4r@D=l}$SK>n;8GwMGv=X8u*Kw|{>tUU4_g&C52H
zwfV}O<P}@|W~;l+j&%!IJtX!;ChPge{Ug}`x454mad5u*=CU1aT)>82J{~-OjHuE}
zaJa;9nD-nG{i$A<mSch<+`a4%cA(TjfM{BOLcCQodQZ)+>TGh?T;szcejdgLjh1>n
zwK)yKA#Ojm;y1qn*Svonbo0Vne09%G?Dn=d%{QkQY~MpE3DPL#6;V6Q_ikS%YS9Os
z+Ydbd;0a3njxBt8XDwIwG(NTKNk6cN|1P+V+XYQQkqBtTfo&2cw?#Ju`N?P1>~d*W
z?1#-^0lz7(iKVRwKgr4!lQT!X%sp(ZAktmJB+LsM&&3|egg<|Ymz;$Jl68?MnD{4+
zMGx<Zs5^?@`&OTDr&d(TxjqH|JCpudne>gHK(^S5b+l?*k<e+j5s_(Q5w$2(w3bGy
z$!Z$0ZoKO(zoGP+yr2}j@lK0cHFqGqtyG)5t#rE~tL3kwhmJrSYsAPbt$Ha>Oim3V
zs=mT-sFmVsob`WYs6AeG^m&=(Xf8>{%z#vUs8Mz11`{JY7(dap9<Nl@rd6pM(Fs6N
zL1<X42X6+5Rsu2`$(;#RI8@;=PY-jMEa7!l=*Yy(P{Z%e8<;h^r#?gZYGL=rmAAe7
zP50Amd?C@S)w*|S4%m)|t(Bk&IB5+C9#t8T!X%L)KBj+CP>p1TbQu)rR?BIMQUw?T
z)7Y+3*h(n|9#xzL&@%&AR#trWfoqMN!2pFOU`e8X{JJlH^;z^hbvd9hD|*k7(_9%A
zZ0vg0^ij!dVe~12_)NP1KBrbgQouUb3u+x()fgM{uqtF}#oS^Za7GSjUMW`<R=JK=
z86S!cGSGjt{jhz|Ph4NQX(ogz9cxt<I;X3t$26#;Lg@l?rlnO1H+f9LjdY1X=)}%h
z{)Rqw1xquv+ELkG&s4P&Noz|}Z{gPcgr(%<mPd8Vj92Vi$#(t3?$PhzadK;N=jLzt
z+?`I7+3Y3W{%L`_JgQHJAeoL<`nh0ItC6NxA*+9EkPqTGirkBZOlEYA2OA)pIRjNu
z4`yS)*N&6d1{>qc4avsbfPs2rzz%@_Xr#oFDr|c;2=o-f=m<J9@dENwTAN<WBGjQ`
zfq;-X5;gd}i#!PfN<*)qpdYVeBeYa_odL9n!{^Ike-K?H3?T`E!)ZTatZ05(2t3KO
z8cBbwpD}<B`qXFrdQJYu4Sb>-f1>L@0TW*w{ae<JmB4P~T9!I?tq}gU%&kNY8EPn4
zFBx>a62u;Xg~m>ILVBnrc!KC$Tjp2vn0G5wWeOJKYb2o7y>(d#@QcR>EbBO8`mA_k
z$+oO~t!|PYkfwnG<4A0AJlAsI$H1sFtU7<kuL<oq^Jqb#%o``y3m_)n<)^Q5yB+F}
z!!CJ+KKh}L<z7AKCv=|zFuLI$v0=awU{Ae#N`OM55@g4-3Ri^!?rCtTbWAK{`mD1}
zZ&c##s^03{WAReiJSl*V)@va@tdJsMwOhqW6#J=Paa+l1;5fyTn^GPPz@P|n*SmkK
z*GeZTR>31*3ejzF0Q`)BJ{8!22I;g57^Ty-6uWfVN^1kkLm%sy_>U0j#HyethJBi+
zTOzlkCEg>V3zO3}M<3$MZ1=K<V3B&UnSU9P&p;A78NnyBu{#W5nHzG1L>wA$zJs1O
zx65qwWYs&2|GFn6fWWUu8nh);;bVUY>L36z9DZOw?BJ{o*vo+v9R&1zC)-W&oW%Hk
zGP@MBaR?G+mbJcT(qT*R`Q#Z2maj!NS_^RW?9uN2lf%8gKU61RIvQLnelWf4MXd$R
z2yZI24Fv+1fg!sGkNR<cuK5fz-=13FN27Z~evQ9zAWW&2k#(|z`_FeDcMpFa?so40
zo;&>c+3h>-Or4zPld=Yn;}8xW0c7dXLA-{7qi%4}T9fVsj_XqeGh2cF#mPu_*P2G-
zqfsZ{9vq<d;@j-IV&*RU%5eyJ)V|Jg#AEruuGS9;eLdZMarp4w-tP0g=ZH4|8D@8S
zw-9O$l+uB$Q{Nq1VwySaWN?4YkC0T~H$oK>0}gR9d0jdsRN|f`yx02Z_#+xEs0cuf
zrD1e@I1WALf*Zs~<7@=9wd9z*U3XxxdaraueZ}zVD_o$TZNO=Z4Uodjlu;P`mlc28
zG0xMLBba<A^k;x{?uK3QHAQF|z>oBI&-Zp8J?`Cq`j}n*!LcOi^KyTlAG1D*d-_bn
zN8~9~OynypCUeoA!v(}aZN)uET$Ot+xk+6np1IewD<Tn1=Kj6b)?P_nd=QO5b}#90
zAg0{oA}Y?(+S+0n)b!I}n|u7INE7iK#EYjx>|Qu}#^<)@)wZ-6C~jG;s++h~75Sm8
z4WF81gd8ZezL)_vej<O-HUX%c-^=L`WX0{J(Ml<po$N7T-dF}P8fm)90Yx%~R-9|a
zm@q!K!A@)xnPON>N7bbV-}`RisA5vE7NW$=VUZtHh`-BTqtX!Zn|5|~E^?{Q{iK?7
zXB8u@IS71OhZxGq)GbPRR?IZX0<-rZZ%nK+`ZARu7bSt<Z()BV?tgE$J4@?eyN;Tu
zR1S_W0}M(JxOvvJHqlpYJysfpvq#1?L|(vQM1#*ZKfiUWBLz>oxVzdtGtJe7Q<z@?
z<!uMGj;(r*V|OK>TL{CC5|^Z2T>rTKnlu~hWeI(E!zzJ(G)qM%?jtH>0o|GA0PFK|
z>b|o-iT1KXnP`8Y%;K>l`kn07=bySyTd{CO=#?FoL#*{A5xnUBrF$=i!7e$|j*di)
zeL^px_PqT4L>huQb(7{<wlo~A(7?ef$=yc?1ORUYHf7xbfPBOZ4Nm~^_GwLd&I(9_
z%&*h@zrYAnk+UHU!(p%A+S-x@N6DCh=@Q+1IvoInxZQuz(t2L776nIcqhx!R$(YHO
z+r|83`_=6DvmQniINEB?>OLu7l+WSs^plO-Eg;7;GQya|{oPoak(>eC%I*^p(jOO&
zX23nw-u*afL~-Y!bu=oEb!Y1zTG2kE;MQoIeU<I~{qEyukM?l6$nTT7KdP!%i>YtI
z@-NLFUk!gxlAn+$CWa`(ZT1YX{4?qU#L_^QM|D1PN~U81=Z?o<agLEe;lJZnrJ8^*
zxYzq8a{EuVjyO7<R5S_K;zv)^GD!E|JvDH+)fxL=b4M%_t;fBl**o{4VFl-`tcH9p
zZnk0x*Z*pE@f(d3Wv_7Gc*a$x;1M^n)}hLwF2{dP2inQb&QE5&vfB2fKgy5m@K;gn
zz>-l*k<o;0fN}H!Y44<zzB8+$(LO9j<L&4+^25DvQ7Dq9@;IMz>q9qwLix1(UXcBE
zve&m;sKmAt-fCGjC5%nknd_q~Y@lVognpeEf+;N1_jPFedL+jFV=B9f(%w&PYF0c{
z0}Fo{J=Rr2Z^BC1=3&B)k?pMBy5&W(51rVe?nI+o-CTO5G;^)4$@L&;?qn&sgnMRj
zEWd}JEQ{J?l*7ic-#CyHC<gMygqdajBCt{)8!f%$A)JEuY7i?g^-iXWl$HgOWYNWm
zFU@i>t5#w!4;QrSK6rAFMZ}<5qxPvaWN?3-(ap)$!Ub#N|EdY>Ka&i~Iqo~f#r1UM
zvALV0a3b9I;Ov(csTDrsQG~+>#A02i2weUn-p0qb{3;$id(v>+lvYCF*%L^iqOqur
zEFxb~J>+(ri0LEyQU=p4r(X}up`dp3!BPhUah_ap8EgtK>_j3`TY=%?rNGweS7?8u
zrRs0JZlmIW8EcZX#-%0dh;OA*O(Wq{Yp%@qvI;%f@S7B)QEil?1w;}m$b)PnIh67C
zGHuX|2Jz&Vh|}NxS*-SNLepQZn476n!Fxx=*|MR8`p|^shPb=}em=kSu;1C{{_t75
zp}jY34}%En)gK-DB)mmpr77ZU27iA|oOSKKbrbLauZl@PGbgTXHFL~lSV#Jv$PZ4N
znCS~@Gn8rn>}CU<Ksof5mJ<&yA7R0Jt-wtsQrz`zk;$7q=+pQ2!g=;>Vfu?1ObXus
zj2EcUO8$7Iv4Un<FuOP$;*<EuZp)=7%wXH?{k%G<M%!-nCgrfJ7WQrSn%I9M>J!(*
z{e8glIyC|ssLfe2tW1-wi249SEL;lSKrZuBi-{J!g35q$4&!kibqUe^D_)#V&d*Dl
z@Fz?y2T5+nXCmoG`##BGFxh+TEgh-EO}0y6`_e8DJ)oh7sCC-a3Ueg78!rIwLNPuv
z3SF*#*<B5<@uD;ct^3|!`8I##-r2pf{4Tk?n({#2(vw%VXciRWfMcU|$baT1?ljZ{
z)pknU)NOkG(aIKk6eXW^p@xbXbLtN5`BE*J<4eHw9nXehJu^*l4iFp1#!L8PYxQxf
zlLnHxWi$b1ygOoz8r=U*u$h@VD7MAUimp>d7sOr<{0GAZzr74)`j&t6D+!hlN8kVF
zt89GP6|Gu+ZKWq%8+|E%e%)Gea=*%cj^o&pBbfZ>E7A9t#V|*SQJ7>aJ~Q5KmzSOa
zq5bA+j^73>xFpEOJh+yMe>tKEN-1C*?+4`u1Z~O{IW{W0h&OsM3G}P(Y(kgNB1!u{
zYDIwT7(zbu+s4o%xqyEoH3h{)jdt{N4co$$dk>#d-gJX`KD^{0+Du$RZ687IZPx)@
z_dwB`HBzHIsS|=$acV>_qH911vy9Oz?mD)*8BzTu$)rH!k8x3}XBr@|Y&iB2F+hfD
zXZZwP%sH!Q7AXCa&n|l{0IIu96%zzIwo@g;af=%&QCrv0;pu-!rZjYx<5DjSr!5X>
z@Dp~6Q0sgJ7aA1fI;N01w*(-%R|R83&S#AuVN~*^OAx7?!_O2tqcoxZzh$Tp!Kd*d
z3{qTM_?+P{I8JAfMTzC#Mz8q{B8lyzyhJ{-(y{#N&Gg|-`#43{S%s3G9x>goug(MJ
zGuna;Rim*1S}1=HRu`#)D&NR9%U;n_Y>F9VDP%auYYvPuwX_0`E10L`fJpEA58A|1
zc|`kxcW$(ItU%XA*b2v#h6`jG=BIOA!?3@ci)AzE6o!IzJ#%cbp6{^kYw^Zy8w)u4
z4W5KkveZGK_hTn1(UNU3Ee&uf?wAuK2RJ!BS)-n7P|SY^shN>A1awggf#0cEzH#-^
z=SwTEbg+voHu+6|sMDCc5V62UwY3VLL#z(Iag1!kdck^35?nG}@a9zURw|_WqpTPx
zl1HZ_a4pXqQH=A+LNz8wcEXvt^Y(3C(l()9OMC=zM-j#fZ0C<{n{vYI;o{YZ#whZP
zAw=;Pwzhv9vv#K{EM3CSKo<KcgMb@=B&6a1Ev9_C<Bn{8@@i6DxFMant~})!vADb5
zj|^S=9EKAsByjNHJD+U@f{MpJx3gt4P)>3*ofVGau_x6`VjJ)F<7Y{np%ewSP(Z06
z?uIzf`I+^3z@R4!@N*Kbd~;y+kjX$<xgoDT0=It-F9fh2>XbM?dcK5pD`(IX6$;f(
zhTfh~j@_vOP?y_<Y>%SQXIf-T1ITp5H|ua3B+<|v2=%i0ttMiZ5I5CdR0@U`FexGg
z931RzKW|DK{=iDwMhHf0Q5BCDEd&AL7hT}=p(?%h@aPA5%nzq6d90mK*X&fs7GekS
zSZ042Ka*&}Obk!ixIS}Y7s9}LL{;3(=hgA1)S}jLw%fmHg%E48Bht!=mpkz&<u(4%
zX%5P|)CZkpbn>J8)mgE6+Hv#@6Je5u*ec!s3j|oJ95c0sS(EmM_{;1s)=y!edwdXN
z&O5|hY>R<W)&|XcSch6cJ$lEVe>yCn1j&CpM;p3O8$Yz$tvCQa*jzWTU>nhj@gY}g
zL#KD7fBq0P@XHk%g-3BiUq)VA>ECgac=e)h#!t2RyC}~q+HI^%r$LlU+l;)8WNZC{
zrSs5f={n!YbQfZwNq+&hrT)_{iNGV|3J-UV^#flW-Vvl&d9N=KWqRs2<I!|vLY;pw
zkB)w!9nu4y;}*6LBLrI|0t+}+iNJ(&4f!&i{N}pXZ(4y}e|IETxR>MgP09k^U}VyS
z#~zhwoa8DZImYVm87WNSZW&#p!h<Gi@L<D_`PA<BhGro_Ymrn+pft;qgOSVn<29g4
z!m($`2Hpq*q&(?q%$tNIW*U00hc<sRbA#PVc3<Ld3BrZ{XdVSUN3}_)c?`6Vf#M3@
zOyY^<Cf#ZBa!u81q;v6XH2Ao%)$MJR(Fu{%eg}=NBOC!SYzqqJhh5d36m^bz7#5AC
z4zaj9EAOPnh&veV>UF;UorFG;!lWVuM^k3xw%=dKE<fizhRiv+AK<9Veu00KB%bw+
zwlZMAUR+QM*n<aV6TqfoXwSvqAk1*kmTqMe9eFLrc6_7o*`#3JM_i+z4~4Cqods;;
zq=HQIw$;z~HM)t{NKgOx`7dC9wO&E`OCvIZN@%0AyqlfIPG0ZO__!{b2k;3yMnD*5
zhLY1;8s-s=F!z0g94i`Z^0|M6lX?#6{ZRoz^#s8)voa{rF|X;_mo@V@_6OKENesm8
z0Bs;tp6CH547z5K#Az2*D@U+_)?)A0s)%h7k>leju#N}}Lp|3}-Ntxh;0c5>urpU@
zfBDD%tkX{-Qf!o}u888KjKFYA<u##vH^yy&!KD04bAW^<e^*F6aXNn?UlCEi)0p0O
zm@=*qt{<)MEDYl&hynXjXi)VTNKXBt;~iCQaSJVBDrL(i28gRzos8VTnk=SpPt9R{
zD<pP9VN;2Ofsr4^{x^9&*ZN`Tf74)C8ucebT}s%30Ql5ab#x3*5AGFPcTrl+oz@|c
zG?!Mg{Nx68y^NrgP;-BD*I-=;)~$h~J6Yx!xmdF5yH6g#z8%aR@nTbX)CEK)jSd4O
zvx=D6;nU{^-)g=1)6~3W>q>IEO8rP7(DzYdkA6`#QGdGJ?(vScJ(1dD-0<kT(H0m4
zG4??;VsWMFw5W1=3yZF)5<ni6+?0l8O8GRa!Pq8XezDj2O7efhSWwR<*HR+#y}^$g
zPKcW?P(X1bXE@--yFuv5{jPeziiRD?y6@f%oJQLeCcQ&I@^F~)m{N~{)Vfb8Ss)Wm
zw_IsA_2sTJ5CX|4037Q_)UX(=H}Fe)3QyUBCOPKW`C^<;x*@P`R=h3?!p<U(GzMaj
zk0^IgX4Vr7e0P7DSF@oL)YS^OF=$5^{5C`52sPshEG{49dGxY4KB!p1Sm!CC)h(oW
z*8IU|nZ%|Le`+xm)P2JQX@(TPQnyC*n=(!S4I6o@Nh}!mDRX3QM8grQ6|cFa2<9mv
zBGTA<z+wNI;cLN4-e|^Rs$TrEoEg?XB@%v-48dKsCkuZMT*KwKeXGwleQOh?nrVMs
zHt5<n+ZHz$p|x4z3Z{{0UUHOT^$7WnADLP;(sx5I^1qUzJS&PWocGy0Ka0#yB-Hs_
z>^J02?tU3(L@*0$iEPB#nIo7#yF*WzR0vq967HT}7JW_YQ-J=EV<X%}+1Dk+80OcB
zP1fW0vjKmLW}*?W3v&iFxQ{zxsiR142q!l9`HU_RnplzCX!pIW25xc45UQA|GN4!s
zy<~+#vYnH}U@6yvi0)skzJO|zz~kQ(n;#SJ@{4Vlak~t42U>sIweopQ?%&@VQY!m%
z_xD2neQ2b;Nz0{OHprLS$sQgaKFi!9Gq~8YtoeU0IgA})N}cS<?%_cvd;I&u!%lYa
zd-u<8??3BgR#&5~aP}Ok5r<d;m5tG?$Fwg{rkf2D^3|f5J1!~9<L*x_B1+$eUwI;4
z&oowFK9EpBpgDtW#17l*C$STcZ&T^LoQmA1VfJFF$Og=hlRR2N_mRu%6(BGB>kSrY
z=4pQxfF5vUG<2L)Z`kBFCaPZ)QOVeW9-?h2FJ~^@j(Wz-wu(Jd`cfz_aPUhR(Q?U}
z{A5<uwfduZybLRcS)8xL`BgX_Lc%B#PA!vr?Ks~tGH5TYw={{d<Bbn`wJcqWR<acz
z7#GA(CMXY>;%KCmLhb4TeI%#oG+A)Y0rP)G9Uq)Wu076~5*GGZ{E&LK^4D?T%LKk-
zNsidAiNA3Y3b{WLQpksR+0iA#P2k1_>JgDTwQA67KRgAo*Fqxt5c1a;J9Ug(H}ogl
z;CszB4{RmBk(I<L?}Ss_35U27&Tz*c;g0vmo&!+;eYUmS3O~x5ybh}=C@m=1T)uy?
zMajXHv+@L1HS~6l`%F@MUl#~x$g{yCNrnG=$VwHY3h&gJ$cDhd#NtSSGy%d4f<%E4
zNYjJAeKOEdF;)OBQsD1DwC}M&81M}E%ag!A)EssnW;;m*k!1x?0<VHr>%N)vKpgU^
zd3AO+GN-Yu0ZmYPd#Ivies1mzq@aJEd`EOfC0ycn%$rBY5&LV_5OX)hVmwuJ*bJNl
zN$_rQkoK%&Q7kwdVGU#|NmccE9*U%Ll)XrGW-!F1Ja4sj?QP=_a-j!Obrg+D8B5Mr
z25{}6+Pzi2QK-gm_YSk|d|GZ_Z2#yP#yiF16E^f)cJP(>WNG>E_SVOcF1vrq{%n|9
z@oDvEbzJ7{%vXeU86!UoqAepd+_g}{X^*olE9TXetu43N?v_xcW)!Xf;h50Hu9~i3
z3a*@N2j&Gh6J^%>R_-FQ9eWvjlyHujfp0D~SyqMYmSC~vi9{m$YSG#zU$tly>8*;B
zw42iY>>+XT85se|d^Jx2<#>O-qU5uQhu^Rm2FffgW~Z#mwY4R4)Ngo2w4%m09)n%#
z;_H>fmJ@#|L2H0+BZ$XRSvr@B%94J4noI)nv8`dQ5B(aI-pKBcZbXT0QJzUBp{Sn?
zO0+o}lf7;0JcEC6IE1HM>#Z#uqpbyQ$Ek#u8RO05bRMq1wIe722}^&ft&WnH0DKUo
zMrzCTE;q!Gm)(iYN=IqMm716Q)dU`mFA6RWL9k~|UOQu8j%}Y@^0>adz_5f|(4okg
zT>Y;DS=HgHGGU;dc!(A2%V1|}5q_m0I+j%>IT8IzyEyfRSMN)$QTu)!D-o$E3`DY*
z+o@+N&}(2aM0&fx8ghR*Eo_3`1DOAL9dnd%F+1b>EA6>{ZiWVPuV+#)k%>qX;fOVY
zL`I7-?R$gQclz$fK>$(@Yf_z32{=rIpr-NgxZowdm_Rvj_ub%P+_%pd>oeKXmmy0F
zq0<0&^gAdx@+Otd&-(5x6Q>x`HNg~47l4B3yN@OK@a{#q0qTEtTj^?C<Zdd#luPZ&
zE-$-opSylU0HU`@j4y0?aSoFj!>2}<p)R@1_&kT%LX1u9uan~1$VR$7D@LboFNOj^
z1)pTJHnJ^Y1To(*J&aKw!xP4ZZw|HwZ6AaX^WX8R8<21ruJ;dEQ2dvUPH;5B;5@jO
ztsp=(OkaO|GW~xzWqphnZ-mgH$M>H_{K~HZO%q#NNaGwKy^6BqGmRO|Hr-q8t*wBG
zf}Hx%i8QmwQlyiWh!WBpwcVi+cnbbHckAF*Si|`gAI05S;}JZ~%*znb+(V^5dh}Rv
zRVqZg(U%tLv$hCi{TN!PSMwCXMWEU8*A?6a(#<B{KDvKD%ALX)CUL^QdwIDH=0Uem
z$F*9_=<|yg`Gn8lyl#te*&V?n_jSVbI8H;4Ekk$TzeLiGr4>R=%#Ij7H328K3rB%P
zvK~^iF9aP~+_+m=w=TQh$U3_0V1X<LLnK8B0kW?;9)Wa|AX~zWbez}3fG)(4RMScU
zdo+266lQ<91#T9b=$uT}%^nNkbClzJ0-8Q@?bf^!>@jsG3#Ja3S<F*k5-bQN23|gH
zNs8AB#i!y7#CJkudE1Vpb<{FqF9%%<HHMRrklzl2C_C9=I^<vY7Ls2aMR_Ee>vd{n
z6K2CM{BM_8eOcq84H3;s+!kCVyX^Kw=imjnYu10nk*$#B52gWMS*O;Z0ls$KGCQ<s
z5(puReP`?z?e>#qsR-G9m^Eb%Ug{JBXJ18z#I~u+uW^P)CRGe0I=Sj?(QofRfBK}$
z<+SiXg*;t4K{BwH*TVcus9SLYGw~TLPyRi9#k8(HNgEZJEV5$+8?>ZhK@nEwCX*!J
zQeA(*6byN24Xat5Jz#OXYIdpBaoxE_DBVSVDG`d&qrVE=Gwq`c#VL3#T+#IsGezFP
ziEoHV;M=|I+sXv^qmSuCDV7Qj_Ht{>2EDb_x?|e=)|U3|c8fZ4b(V=bPc|8fi=HqK
zv~|~X4*5NedRKR!#;NlLnpY~_w?1`mB0PUcT{CMqw69G_RvquzZd6VISKpZdWc?vd
z>W5dy4_cyd;cQ<0ZoJOAU0=KDX=KpX+0lMzTd%qSEsAJ6>a=c$)g@Y1K8e4%fh7bo
z1QfIl8>%5`iCGUBW%EjP7W=AGCQ`8ldW@4(wxO9g@)XVG8&Rx1aG4>}@hTv`r2l^c
zPlbn*^U!q+RmJb>%<?z7eLGH;X^erMtxpw$!LdAUri3_!JG)*_Kjz+3Vbxuyt<M6b
z?oM$l7miXTR#=oo4K~wjA;^AlM#_yQGhlL@+5m`TyL`l1PdJyBz3g`}OlU}Mke!mb
zP_m&|p*!~_mJ<0!U$5S)#sa@@gIRweJP`N&QMDLSu3Fwh4C^$d1k*mWWaieE_KLP{
zMa66+`{9k!2=?}8HEh-X19!s{2Dz6#Sj^02C<%u+#uP7aYLJ^d$J4o?)4hM^W9G4>
zP<xrH9T*ETo+Sv)>=zjJ@|YXwA7;hh+VYLM-T}!qS-*=H+h3ylZg{gCeocR!;e+<|
zVtafU`oN=s+ogLbosomoa|uaEGLXc1*~}ykgen|>c4kCqb<a@5*{%MfCWxOcf#;0g
z&ExZUS1@sUkGa@BT2bX^s>c?M!eeITgu|JTp0UerS;=vq<gZKf9kSWhmfkN>Y1p{7
zb&o7H_DF4Qv0K+HP9%~H$dG?V)QJHKx3>J)Ff8sdb<yN8y9InB;FJ13lZ;yDaziMa
z3^P^VekV*@SS&2jE20`dh^l_ePkkl7^50+oR6^4(^W&4-ckY7fz80Ik>{V3HJ0i3q
z;&5_hpCx;ZU>JIm(af8i+%mX}Uy6IVez7VB4%W*Kv1;HuB79D$SiOHLE*&>=$|3@B
z#Q!2XnD~=L!OK+%u#|p3yWp)4ET1i$P8;7tt=40hWub4*s5fWsfY`*ST8m8=yu<<=
zFfob})6wFr>l$|H*NSd;F`dL_0|P5!%+S^royYau&3g>p0aBNxB<7P^!YJ}fL}jsT
zYP8@X3^|H|@t6lWiyeQ8x}34%I30U%d3k*GMBuKadXtJh4~qH~kgV}hQRU&04VR%v
z(EMQsA)sB8n)oP{nlR`?@C~+;%iHlNk%cm?nH^SUgUxoAuGUmHQiCos8Hg7Z)zaE<
z^emtzh(*%sT0URe{pg>%=kCNIVCg3wzYR??!2cW4Omnfgurz;Ct`{(4`7+x)g8%;d
zVkUwa8mrroG~MsQ%=64+qVOz4tyIhlk|?@GX9*+I<==4s-jE=&bu)H{PN)4sZ`kNL
z>VlE0=x(n#C{fukS%A!K0bl5L!x_OEd8DT7OOM&)cC?Sd^kX*pTm|33+IE9T7<Qax
zp-hZol&Ojg{;Gc#H7oS=jP1(;c*YMtV&VO{BJ3kt6{fGI6@AiBv0@e$(%^T@lbzuG
zC)&}0<3X;gzx?C><+Z<vLQ~5es2xl0U%<FFF8VCoJFr>!tyW&etWG~MH&ER|Nd{bK
zdG{UM8h`o6|AJ(6#vh<h<w&!?i($C}T;D>1TW`LUaom6O&iUiY32ye70Zj`J_4$jN
z(u1wkU;gpG!ja7(T@bnnK|tliF#MM%>J8s^TP&?Ph`xTs8RC?9JaDNwD7o6juoxnM
zXfcV6>4G9I5@!UFlFeAKz=`ArL<w7Cy0gy}6EYWy5EZ%*LmtDTXe?=HxE_pwwsjEW
zHA}#;e-nRuj~C@=-YqAIDKqHoYK^C(mHWJ5v%WcW3wqgy-K~$P`kONLP}J7@vVo~0
z5X|WD=A!Nvc|GsmzPTZamp?0~<z%Q4ccCVP=n=$0GND!LIV`3!qL*$xZ`N96j#edg
z0kJj&Zba60a6IF;8wtHcvOkQo?hZ~C0HdYMhOB>kbKfEkeG)~(b<}|r#Y^faI@wS!
zt&SO|fRLK*JS~k9L1HM|W;_xyp$w&N(a7-pVSwI|MG;~~y3G+Jfe6-uUr&hqFe=9f
zaIxlQ9hapib~kggE-ju7RRh9nk?g*~Hxl9fV1!7(0C+AO>SjJFX7jp>$fQXz(nD{#
zRN#Nbb~7^Ku2-WMS|JR+Z~O4pt?hg6|KGfMvv$k9b-TImBz*W+JGvrNuEmy}POYI^
znz}qHG>A(NdlWdj>v0c)bcARLi|+QCQ0R5pHnu4`S*(pAdVMl1UzfuL18iKsnpm|;
z2K7#jRMNVF7g!LJ31c=rc1rY<O|N@mwM2h^P`yCBS$2B878cS9B!EKfIfg&0is$m|
z8`D-Arq<%~4HVym2_}+Fh;4PcM)5iq_jewmj6o78Fyr@+m{{b;-seM1Gxu;-G_L0x
z7Jr)kjmDq0-f~~pLC7yd#}7bj+RMPb<`0$4eJN6rZwYP6dw4B5S$Ze2;aQ=*-@AW&
zMo8VaPC1_k!Ql9kmy7^f;{|cm*gFrM2sYqsXl9FFJ9j@JGhtj#xYq4e@7p(<?<3em
zJ=Fa4az9RBYIcI#Cmul<v~T=Og7bGL!<TtEe@?Eu^r}Vh6P7wJ=RSE&FKxds+|y)N
zgbHnC@q2S!CFY>Hs<K~bzqDI?fsKEJ%UGiq!gJ!7&d^j=IsLw0V;e%UK51K7k48hw
z4^|%cH&JBt$I-R*l`LUkqPC22Gg(A`D@2PIw@MZ;Z7hozH(s%j=_|6B@hg5Q(}wY!
zkdhka<vF{5L85{DYqpfhQUu4MEk)c+mcrV^OA)t9mLhE|OA$9-u@vbmvJ`*uD}E`W
zh9ne*!~9JYG5_H-;wJn%g!af>E$xCuojikP&cG$i&Cx55s<YZ&V~s6=Fk1H#HUPs-
z7T<gaLy4&I4Sx@Om!u^TUz*MQyc=BGVgv*Cl_xRhl_x1D53L%!JZ>yI8aH0Cqv<Qg
zkHaewFZK<^xrWq<zsc0G`w@TpDRbEcI9+2J`E(l3K%1->yl;p#){*!XR**Z>7fbI+
z)(JcX$oxl)n*q2F;%p*(^7jnOO~k0({WR$a+0`Z7E%R)1Z_i&}UgB%u?zZSTf5KV;
zg~eZ695Jt!-)?Qu61FF3?~%>YO(@pL102l^?lrSi^!T>ALQc*V=PiHRu%I3(JiMWm
zTm+5C7Zr+)Jsn1FXLazyHKYH0DM#yCQZFB0a=@Yfo~h(E(l}C03?u2BSAR`15fshv
zbt#n#SJ-`NZ4`UgSyj0&mval;7zS#fSO*LuehuTjYM3%HsT{%xet;Pkels*>!%M`9
z*T|tf_KVo?4(et$Ot^p7G7WnZFTW7O7^l{{+Rw#<(V1bNh1BAdwj!TR=r96_GCZp~
zb&M3DDhQ1G!00vWV=2U|zJ81s`taxO82~m<pk|KBlgl)~EOB;BrD1={hU`RZAvwkd
zMAOBjoJSoDOQ*ohhEyQS$!kZ(+u#4{+2cEZcvwHX*QP`Cj}?CeQ@5}Wq%EkDk$Et*
zf)HSNJ^HqsKU^G#j?bJru{dVGt8wDDg^1!fMK!k|_)%0I20!A2d}OxaRpFF~Y~&R#
ze=rv&C>a8_HY@~-a42!0j_oZhnTm3-#@o5$=oC-XAHo&5YWOVk8l3;kmW4$W+4yx`
zos^*jNq$w}o2Gw1Nf}TY!j82<VWEKz+3o^)Q4k6wZFSe;wk6_CtWIG%h?!2O9)kWP
zZ_1r#Kon48NR#W#J~k`~ggH^zzj{;ww@g4J5s$eEXuN{)^oT5U=e_Mt72(xPm7eGI
zD-FUY3=pi0&G%4466xK+6c|!FWq5#8!;OkzbTp+W+dzL{R}f4#2$!y)bwno9#4IOv
zaqB|(*p)G3lJ4oYdE?m#rkY`fst2>Hy7xU_9gQ~C{vgw_Px@yM!(PBKd%Fv|>S7PY
zEgSuQldjC&HMD33!YKA&R`@H$Tl(2^OLsA!o^!#0Vk5a4oW6u<J2B*ed8j;w0l0*d
zK<~Sw$fSRS6Sskg`L+!g*aeK`#G1@~3azQeS`q0NM-3uI&nKbhA2xk*!muAb=fZ4U
z{q6?W>RZeZ!3E1rWK?3ge4rBgRBAOwiDcCzI@A-tfMk?7Nq8=S?8yn@*A$WArkJ_`
zK}vJGy6puNYa7JR9W3(N-QQf5#&AFuce<iQblrb5P>9e*qoL5p_xLt-4N?gjH;n8Y
z-8GK`Da#WNri=MoQmW@EQMR=O`TK&W;%>LQn)#O=S*jIA8=^biS9Y)tCfwU1-0k`{
zwg$b6;&`gZ0(P#m^QfQIW;Qz!p2&~FbuiD5uUd^xvIrEkYF{nNPc96gniRbh0w>@z
zNV$J#WOxvbr8@O`A`BNwe&8@3Z^s}HG(~)C>w&UFCzDY^)w(Ch%sPTWM5gk2e^yx>
zZ&W-f%Hx2Uq@8VNM<`}^-Iw48tNE6sit)WKG`LkRWwC(9)Z|)=?(@Ei+S?2ZwZn|4
z3As6M$9$kaDuD{=-@73}klm;WN>j17N1A_*ktD4MG>&_n*f@@_Zp#h2ovFPI|9ns&
z<qViWg+vG+P&W&&9LQ02|N2G_v$T3uPN#(up6<}D9SQwg?0ERAWp$Sv9oRmXfYL2^
z5|n;$2tMr^ZVOp}{vt=8p%E-F?Gr~L@V#)9cNb@%zB{+>+)c8};Ys~*1JMId$i{y+
zcCy>I-wixe2}o16tm6}tW&-M9Q6y2~%vKxinc2bgUJ6%fgMqJyYI%F^PDq<!&U~})
zAIZ!c?PLY^1pg*{#AgRX0OOdOG?4PfQ$JCUPM1dQdTZ;p=x|4-!I403^@p?kRD@DZ
zGLIzy0)qSfjK6|u%D4N+mwkI0?{R<JT5Ib@nOgx)Vx$Tvq6%>FAalcsPnVN?4D=Bq
za8wjV*JW-9yO~;ziw&PVwV{3$Nl3zy0Z|DwYek<K-|)x!Drho66ie{aqAxhswE>4S
zd>8htlWpWq<#so$JlXgmj!oerD1^>ZzLfVfM1p>B0DHTdhTFS|s8G<z;aY#0qoqIV
zUhGfoViCpTr66rPO+alDOjRW0amNspLmGn!Z)M%I5a7Zpea{+x;99e0CX?)$HCStr
zY4NQmxii3~MEStYx~&c+4;wCPrtme$dA;yswvYmWBl7{30p~(N%}tzi3vf@sm`=3#
zu=l^B-6&(&L6@DGhYZF{@}z%Uz_EkR)_*U+R*o$gcy*^x&?sg4yzn%$w>B(CrUJt!
zW6nS6U}Cw7u}g2R0)mD~$YJ8Rs+lQuzsq0eTH@Z(JRw66C>KL?b6h&k5G=w1K6W4U
zME!GTNdr{rGvpiQfA``_<z%N4k%+oSucZ`ProJAj(MHije0Q7-orZq_S+1N}JAJ$7
z)7uShlX0&AetF-J8a<_{s=e%G;oZ}I<i}Kmb`1wkYM`5|p+g)V-{c|}dz*kVQWd6L
zVc(M)=x&&&Zf9Z;9*!`qmC0n#BRMLKH_0cpKojXXVk{ZBn_$=E+2HR6ikLyZAY`s9
zp|>_T#4(<CX9d+aiw}Pyt6230n8xGiAk^G^;)<YE(7bJyCL?1}P5Sn)gyxv%IInxz
zeG9emrNV?-=-r$+zHKlYf}|sRMnbpV)fU1XE~Q9XmBs>@8BVga+0l@~l4?%TXN}CF
zfG{TBB;nsa;+Bv`KBySGVdaqRe%ap6Zss>>&WWrPbWOcy2rYl$kpcir9{0H*Uw!pe
zcC#4fr*}X9^z&bRQMmuQli$Qm^$D7Cg1tP`uM%tVxN-t=K54zn+#OJ4YkR#tJiYz-
z@OFMY9NxNf`uXwIy^8v5SDUw>{b}xXrjIq5xi0#liyK64iuw$71fslIso{kjVAnXw
z^>w}Vs@WO;;WK{=sQzuYt)@u?1>}(lm(m{EIM7mJL3m6k1hH^(qZKF!ke^cMq?eAL
zY@N7X-eIYmf5c3ZA2wk@1*)e+@~_ID(G(5#Yu-*EXUP>5`*MzwHepp@7)|!UnrQ6O
zojad#!DvKDAgCO-cAt8tHCr1sVFZoJiBlT8+DMOxD-VA$$SyATnun@9I7U%{IF0j=
z+1d7lpxPDQ3MQpU3>!K2IIh}|?3SdzEsoK_vEQ@iN(&CLHWT*+)?16(5U5g<J*>D*
z6*_f)aC7F8P2zSJtNHutK=tXgGJqCe`aR6Ka|)~nR%qS5(w2AV8GOXIn`PZZm=j+{
zsO+}3teb!O-?p}HZEa=v-`%+c+Tk=ZAL)Oxnio;I3s&r?q<E#+qJ8iVJt}5jd24%Q
zwQ3+^z5+B!mE?wdR}?x-0KPZN(<W^4$PJHl8Cp?h5W!4lb34ptglNZjI^Qm|KF`o*
zbjf=hca*zr0J-7?KiDkl51&Rd1p#JKEkskJJcNI>M-=vTU8HoM&f|{GV-FZ)I>#%f
zQAEueqsC2$(AoEo*Dt0ZR=%#vA-$x-1>iz)Rx!Ge-xM3v@?+2dnU15@j<+@)*`w@1
ziWnJR4CihV<3G`1b3Ce)V*_7aSOzoDyPtRY_)l^^y47h{qYectxZc(TD7!Y~<gzR(
z>>Yot@YE`_)u`GxLG8EKg%(<*Vwz{?rMu*3Ct{ZMeS}hi)wtNktJQ3KUW|!3;C@H)
zC2LPY)SMC-;zTgjqHi~s=1@lTQ&;CRSsnRC7bEEU5!lLPR^~~@Qz<`NU8_gaW!Tch
z=FhgafQ5Deq?-uA!pq*`MonJ13)rjKijIFo&G6c7<ciX9^~8WE@7=Yh$O?q(6+U4n
z+BhCbZ6<;+-f<MYDB4a*51!R@LEUP;;c^y}u%e%J-6hvOEx4226Lj8XH3g;_)$*Ax
z>+)T8DQh~#;D)x-U(1Q?!rkue?(Mc8r&h|O&2!b5crTswhUZ1EJRVCxZFM@oa8!S~
zJ-pZkuBFA-Uex@8(7@}vv)jG%`FPZhm+G^%ONH6|b1hWtqwb=}Qh3i6O1ILfA9$6i
zIe2yLvi+4uxTc+rmghFx9hFXed7Qr~$BXgWkwVt(Re4?3T{vaDR4V`V`m^4x?W)#2
zb$@iLn%jD#e^{N|{q?Qew?6v-YWjcaAN#dhi=YICa2v~FbNr$(vk#RZpWZes#w<iF
z5iRF(!)U%NX)`W$mZsjQz#YshMM?9K6?O4%dP64>cm?z&$beD>BQAI$#Yn4JVh)m<
z*JBxr5}-<Uu5dmCW%kA|WuW(>?@`U8(Cmw2I4$WJ!1|@UgA-tgv429T6~%vRF4dMO
z^&XH)_aL9=Y0(G7WIWSq55MuPogUY7<h{A^+~fy-f<<*UI=(A?1LM$z^UYw6bSn!r
zf3vWv7Ovq#&1bHqY$ee*ulOthmh7|3V~xJ-TUtR3GpA<0dW>+Oj_t@!wh@y_XqS|P
z+mOl<9^_FiTWSvuJMXj7Ke~T3N=ip&Aoc|j(i#m?JpncB(po51M@CY#<l>baEN^EE
zi2wpHzZ1(bS|o%Fe!%N}V6_G!IfwCNR-AHG$rOpB8qDCoo3Mv_VjQrdmo&>RiQLlO
zzdn6c4*Bx4oN(w;G24xLMtL1#-q+bJt&1@DQ&qF^3YCT;n>Ks>8C!qZ?WHz-#C>ea
zP3D+xBHAU5bY*k{`f`N(I;m>LuJ?UiPo1GJPgiFz4!`Ms;dcwtTRCAp(6HeB99*6~
z?Lv|V%QusiEI(9WzrtcC=!d=9)m9<Y{iK|djT4fAK=+Y(K|7-5YD9L#WG{AgKRo2w
z^0{(O;M=x7v;*ePhlPLAp%{!Qe(jpUGPKfnV~w{Tc3C<(h<=Pnp!Nf2ofR4sJgr*s
zmDrSLDE;qODUuy;O3?1dXMtwc2+}|GR=j=d*X>@D<!>X>a7z&vMwTZE$86w28Jqm&
z|N4LXU;f*F6yHYRBycR;+xzC}^S$NzJw1JMfA0BU4M25ouHt|8t41Oa=ZIe<(0SYL
zFBG^^xNt{m1MzJQ&@}_{V1GjJ(+(aG#L5Zib3FmJJz~=!7u&{dB5n8H0Pzfkam1l7
zPt^-(x3xTEW;xX9xswxM^P9*W!|6%cE_LiGV;mxTaqI}Q_CpR?jW*c9kNHk^yOSO7
zWOv>TvcLQf|4Dxv=k8g1V2yMV07pQ$zex)#rZmto{2e>j%9S2_UKW_3a5~53)o$~3
z0}OrU?<;>aZTzm?_R6w;dM=RBU=@^JfA-s6e1@$4o-e$$aI)wZdha%V+^r9|Q<5Gp
zwWxS2!<m3;REgCr)KBx?()a>4D|-pdOa3ZFAQWgz%WtTkPZte;^|R`pd~^S_@iCUM
z9;&reo$<-*wL#a3QC;ei1R+xMgfuQM`6fQOzDCzLGETF3c2+t4=a)Z*qF?U@ZPcsM
zBmEdh@f$m+U6qpRNF?zUPtZf19`pN>Pr3We;okFXkW`3l4?1%3m#lb9TA+ui?xoad
zS5!B9?hbu=B$u0i*}l8x4~j(aSbilUIYdb-3r!d_E^}|DZj*SgQ^W2B2y++y_D*wP
zp`2Ir`QOH6@1km4&2lHH9sS=<wG;Ke0gmJ&Jt}brjs7S>h6kDI%Z>Qr6DOOxi<mAi
z5m*aHLQ)`srY#F#t4n+=pA^-iMqy(Fx`cS4`9+n!nKtKtMyWf@Jctkr;$W7JWRq)T
z?I0TZpp!}bxH1#_24fhBcy|GibdS_a{WDC=ZNx7Wo6FXqthGj(chzW!#!(FI#+n<`
z8G^6(B#Sum;rL*}5J`U`ZXN*%IFks6J_lF~w{P9*JB`^%jeRGX^+Tk(rz#)H&TiU~
zSKP?uNglI*#gBBtP1s4|hFj{l@j&Bw+@%iJ^vF;nC^(>gxAMrKyGJNMi3jdT_s7;q
z9hCy15C{L@rR!lX^s*Ndfzb`_^{LzX=8L!FO$+)IC2-Q1rz%qjgdKGmZ_epWs=0S9
zMuDi!^&m)CC|6Uf4=T7F&2tr1M$?t6PEHnxJiG6ILDoYx9$Re&Tpm4fUsXE0F|mJl
z1HgHg;5{8p{gyai$3_d_9BWAuyV6{5-&WNbLI-Y~@gGS)!<m`Q*Swzq0UEU3GVwq?
zKVts6ZOOQ-Pqyy>`fD-mS8yf9d*8&w@@jN*y|u_lD6D?wR3DP7$235U3{4^md0-yd
zW>+SE3DpGlPxm_}W;$GwJ&S-!`I~I9uh45bNDVh;m=k4Eh?5o%uet^oM=b|6*(-oZ
zY5~;rn4%(o$sD$}ga8A+fx#ec3VJ~5vn7b8>&U~?$uh#6zl=!ViE2qipG=Si86(V9
z)CF=2$HfnXa)3#RRp+H2W&$;OPxKm}HrF_Rp`GCEihv|n9>!%92@f?Ffs$@*y<Ga;
zEy36BhZs6aA2mpO9n7o6eCS9p<O@Ydz+u?*XBf*XN3adhQuDp@R{4Mv6MNq`Pt1TU
zn<IY-c5)lYq4#50&p;T}to*aW61)8-D5xP@eIO(X6W%2iAw>@LxJ>|PUQt2<kxeUq
z$pWEGzEwX4gJTlL@(waYXa)Jior;VYwgRgqd$G}$qZng&Nu)&m;j6JshFY(Z%fz^S
z2{sU5JJ}GQOE@c7>Z2H@QA&2XIJtFlbMDW>tmr13(?S@7)m@_C*s-S4+xSd!a^3vN
z=jIv(1GXfM8jMMfsTEq}AtY6N<7qp8S#`0z8iv+~E~dn&LW3Ec`4t_+OGnHUOZSk<
zvx8VXl8Y{%mbJj^;wbT^>%o5yp>S}WSL{ms$hU+;4!jAQI~Wxr)maE~+yyHJ2xLmT
z!<bNaH8>WnRUpD<`aK#Jbt%^l`T_pF)KV2B5Jr}s!@qN6fVSdeH+EyLl<nJpU-Yd-
zKf=iK8=@P$;?A-1$r0V-+jSD#rLQ+nX%cY~FmX!3;FWzA#wMA7N%WBhVMS=F%^@&^
za^H}A&z1)de&eSdeiv@DpRCxb*VXfl1s*12Q`JT=t3+7NUOe9izxgKSMI8m(b!%ux
zdm3F09zVJ|m9ra|n2p-%lr=7YcSWO1GxTCMmn2T_B=@BMh&lXa^MEasA7`6Xr$SoO
zNfDwmVYFr}<k7`y?tUXegbdHy>1f*VUHhcC2m(t4nZ7z=%x2HqF9E>T026O1P|v!c
z?$%ZZLEv|BCo0Tp5f(H_+|YQsCOxl7-p~==L>R`Q7b&ouvCilBHmGNR-;^_n#U%oJ
zlmu_Qfda$_E_QMox&ed_FC9-x)M)=+RihSRGS*s*M|$Oj?6Do7wPS^GsWQ^C04|jN
zY*sMFum)HH6s0iyyLU57cGY@DL1T|;Kc7y+=ulXymktq+Vti1q!|T{bl5Mx{NJ8Cm
zqnytP2wpcl7wM-2=3rZYg4(yqwfb_IZ|kQd%vB>h<7eX4nDRs2#cbqMInDUEYHUeV
zq>AD%6a0#NnG!o%iL|*#o9d|d%7tjmg_AqoUt3#kMIH2KTT==5u&u0V5mGKxLE@FK
z;Bf`b(!B`rP3b`^w@OgVeIrEqamRcQ9!46a6o)7cmP5W`5iyE?rOfdV>K#fDLYTNw
zH^1<WBmQlnegBaO;wAhiv={b>OWX||SI^QyE*0tshr=5zc=xP$)2i3<&WRRF^|flU
z(U#ri>UwK&bi8XT_$NgngGL&nXf=)EF!roknOv<n>!nU2V1gS2pHQd}s-25fbZ13`
zMP@VG$(|qf{2=Ln=zuE(eH+;Dq8yriS%MQZ9UiqG;ve`T2D77~?f9D`*+KYYOM)e~
zw{>($Ewr#q$<VXSl=XpRjNpXO+RgZRm32}sKL4w*aru<vjO*kp&%ljKmlLxEWe*?>
zN8E|Bu?VxusZnf38`~+1FqKWjO<wtVc>1m_BID^H6Qyx~79NIBU>1ezZ60w(coxkH
zvKw5=bv#ba6>!z8w`KczjTddw`YwVDs`)t)Qbbz4)4LTdkp|ufzmK|svalTqj31!c
z$F?TF9&uE<Xad(_^eLtO++5zguka6%*=u;I6<FKa;(lqh9M`+9t)?r#B<-Re93mZM
zYXusr*^>o-M;@4Pha<}`3jO=~xOmQK2`}e79$(5q=wt^X$8%A~f>^4LNG`R01!>rN
zn&NMSr&iLE95p^`;3e+z;W0qqEkm+7Cdj|xx*9U~gaZ)Vv7zLShXu+uJ<-~d=uMgj
z_7p0#=^(5ygqiCkZQ->RZ=100^e>K5qFBDMgpAXF>#F%qa#zJQ-xVzq9|v?%dU>&2
z2PkcYEgl9>(?Mf9ZyniX)BLWPTV&)TYC8+0aHNVL`>ERrx##$A8Lm6+Wi`|sFJ^+N
z-msJ1`80Eys`?w1V1DH;&r5k?+tFKj1?#|9OpD5t-a{ceLE>c;`*s5NJrv#M#Vr?<
zn?#j=ooTfr1za}|utw)tCzcs`6q{61ti|hDXUwQGR9o;$4KuMX=?XXwyA*muvXI}E
zV`xA`_7$&d-N1e-1Nda8HIE5`;(x)NzX5;uM)o$_U}{y(f4X(;M}JDl!baSYn_~O{
z4XEggd=dX*;|%n)>Q@^4l5uG*EwKbb9!TMT<fy{axSpAqnY>O~?1GMVRu{U~q6A74
zohbS$g4%G$@7-@&*9r|-wN+lQvO)!su_VyfYJw2`5_GK;ZSs`$b+l5r@fVO@S63v)
z88%=T)b<_spWDjHy3(<^#JbjTSKjM}*V@^pR7Ud(iFXmc*l+BcH^sEI=rFv)4C4TQ
zB(&-Mk;AwC>F(Y-b@uKa9$X{m@(ArBZQXSP1i7|C@YUDNtdzX!H00DGRv%HDWBghT
zQ+Bj)`V|_w%Q+DbVd<VjOos7uVjv)Oua(S5Qdrlx@niSBh62zSnDjvXD_%9ppibH-
z-okPQr@Knfu+>TsI&GcQF_aEi06C<8b_;)5Hs>n3xFutvAh7-WXa{HW2aP(i3u1r?
zxNWnn@er-hOx%p`@m|XkAEQzdb!_jl8ab+mySZ-$m=o5+F}HQQ*Lo`HW}zrWSx0Vd
zhG^(=^&-P$x&&IZPwcAvKr!#c_5mY3#dq^1e3G~~x;(sVLP8QX-rYRKji_#aQ*+H_
zg+R*y4C+6sXILV@4XefKfoLCqt^p{{%~}$8C1ys>iKxI3g(b@UTC6sNRFSz3D^?+z
zpL>v|D8}2k<}PY3{lsv2D|aFku%hNxG!N?Iy6?%w#EwiNH^NvK)J}fDuACfoHa|B7
zUex{bA_un9Z+Eii1;8V}v<NhR`QM`-zLs`^WBc3m<p{9!w~4Vp%>l@z55a@kFTVQ9
zi3RRZZCGl>`d~!V0-9@R$DsWiOOJ4qXN0C*-w{j9C5=N<0W5!HT%V<>Bl)~K)<Ic_
ztLt8=fRWxH!VtTj#2ZU9r#IZJEmHKNNc__ApiEXYwxK)K1kEwIN1N||V9XZV+DU0Z
z#vS@$lE+o_zSOth-juAacMy^p*(jncliwBd10ut=j{HBHHd?&{@xNVv!TzzB3#2Ul
z6%+&llVjYUUX3sskZqojZ(J16O=@MOigWAJla2ZITF;`_U?r*zHy9PmqssH1L(i*e
z+^e8>U!2okRnCQ@S)fyYv_Lg}gy09JsM*kzPU6m(@ht8{&e`)vll{Y$<-rm>e1OfV
z!(u;`bs>Vbz3J9ak}dX6d3RV|wX{N<PQe&J`=Gn=SpP?AtMFf^5gIC@aOI8*RilQv
zmCIBkW@Etq;zRB@RWVuOOI|>fjongg;*h%UiLPUpVB4;jI_Oz{>E}nq={$4#cC|pf
zTCW8xH?D*KEM1ti1gM^$s<6E*b{Yc_R4~V@QM|-xKwK6ypbX`s0RZ*3n;oHu&avvB
zAZM_I*@uz*w!H>H?;|K-?JgUgDm0WD&(+(j-<0m`%q^^H38bF~k~V)JpBYe!3>MZB
zEO0R?o!Ze`8IGKP%4h#}!jYfKZEW?^%ZV@J^>Mm~+-H65uU`h285EJ_uX$Z$^Wbh9
zU{H}qFf47AzK7Ei;CHA%Nd4=hgS(*~hDA2Sp(xw+-2gRL`bcMA3zsQ<(`g;0Nu16K
z8O~xt+(#VX*6zG%sn=kN$VM-N?&_f1=rX53T)c5Cs4nGypt76)KYM?--Nu!riK5rZ
zr--7niU1P<Qj+bosh@00qHL!1mm+1QljQ*ffFKzbh(IC$(X{0=`f5Kwk3Gh|IoExC
z?#}%_WAua6lbrQ^bI!F^1OSS1y1IMUsNB8FR3Ku-iuE(s{QbVw=89F;lR4B>h}f|b
zi9OkS?(^q=`Vwb<Wk1Mja3@B=vqX}@fu|y>tbn>Pizt(WOY%-QqOL77FV2;MsTA>2
zXYz^s)fgC`&_al1#0`9uw;s&!X(&tMgjS<G>;UjZU!1S`Rcj8r6>e7`63)(Gt7q=h
zK)D_hbpfxwfb!r3JV7=TT=UAQ?gVb5QMi76!a`hszqZ9(T>ms|$2aR%^D1!$K(Txx
zn9V2e%CQp-vYtQtyr=)H>FPCD+@N;M#i?v>qDa!JZ0`PbeR8&J%<{U-rs(5@Zj}rc
zs2lAh`#(X_J{*&@jm^+;{neu*z2)C?<q1>{PC#e;LN2&Ix^_xEUoGVgmR@I_pBU9|
zL=De>-KvvvFNGo#5;<<weWxvHHv4C{dl~-~dql0=;FO>tbCk|ai>W)DCJF&upl-HX
zPkd~yh{<VrCJ@qc65Q&ADYf<IL|HGoQC$`{X;b)>g+|mM{H@vnFz53up6O_rs{F(F
z-`f4Ect`-~kShfzx)fSCO%H(4viORha(QxpkE>DASSD97#~SZZT*$=~R*r0iaR~*q
z(ms)H8w%=G6%kbbec^s|^DlH9nt%p#)rnbZOLh;BjamMKGH^oE!|F3K3n)~vA~tY`
z|6ANx5seH7ek$#Rv5_pGOZxtCOf05}4uxj*YoFokl0fx}9N6IOkdJc9_Q>{+qCL8Q
zzRtyw?zDJDZVEDXjTIS8=o<Nqgfeu)4FI=?IpShxa#<<)d9prvS7l)bv?RD!0QkJU
zE7QdUDr&v%^V|v=>4x;1=;ZpE8NA3Joy+S=bKsX2qRtt=menYJFNdj*lkIhtLSxf>
zF4uz#6xgw_q;lhiu*{V^dHmo0%(2IRk!y)%Go4#qBD`>;q;E3UoNGP-_U6KwL?;M$
zUruB@fW<-THL-0NlEUm>T=;rQ;S5|Jn&r(&ko$lquG0_l3wF2Tb2DuaRlWAMl%LI!
ztPzV3UOEdW+GZOY_x>qOfzOcVlj_{vNEYC8hEeyDM+d$~vhanpw3w_~?GI{yE8Wt!
zH~$LxaBDY#e8DJh;#fNa!l^qIXL00T`lx$@>3g1n_T{VOlP|yc<EJ?8w5KR=Ngo7q
z-mRF|cLLQhKEgU7PhV3Hw5LfeeR-XFS;X`lXQiE39~gyNPGij<I%E<gQW1G_xJPW9
zSEjPAJ2FB>y)TS#r$$?=^1#Y}juW7cl{v_pEJ=XIlm&*aVJO{gJfHKdx{40zVjjHv
z0xQEJF7IJdB;F9fJPcr?$;q6a50Y_C7jw67aUsoks-#(!@^TwUsnwm*tUeZA5Pc^1
z1%84PO0-q=#tV(Gm#YBOSHdQbe08o#0`)}BxtFcojU!|Kj;IbBAhc?KwX6Tkt+LS7
zSm<WSi6PD3`m*N)=Xp<$i{1>vU{*K&syl5o)ED`n;yBa%0da^3;G!yKIt<#yX@;UG
z%ADXIiB1@D@r3V0RDA4Y(=1}9`6-N#TaIoq%DEn!b2vv?+sQtvvWJJfQl>TyM56on
zZn7_md?&bFJUfV1vZKI%6pk{uM-7p+oNWBO@w?6H4hZN`U$HYU0cf6YMzzO*gE0zp
zZfxxB?LjMo(V`}W>s)jPJJF~a1vk;P=N+;TM0fRuO4MYBCz)u!+%d0q-f;HF*gV$c
z*$GwPrjQqvg`?y24hU&RbpcY%Z_%tC;S;x%=WJCwhVrJ$_^OV73V^*^DUy^hE5~|_
zN#CjX$Uc|Leg(uk<d|g%1SWI)oaK<f0vW0+Gc+ZGEbaN0+!z!>XR2x)KV5XYhBXka
zJS{^}S4T%M%KL87BEuo-cCEuK%;_(7c-zkQ_Re-+zyo<x6{Q26%W>8}+aY%QExoxo
zb$3zE19Bh4Kwo};?^6iiw{r$LvQZj;ED$^-2kBN{30lOjE0wl(7etERH`$#1?YJj3
z7xflbe0NyAgWv01_ch;x&8-mbG_`EsN+O9ET|T?WZAMYYs$A!b{J=72>LQjd(PIS*
z$sfm2MKqJtkZgdFI`;V;c+bl#w>Kt|FXshn&?McIznqnSKT=7%lTPtxJ87A&_1G<|
z#}CbdZ3}C|>a9!m2K^}}66yXh1%<=vhqfY82Fb-J<RtLJaV|KCJo82jg^9Wy28)9X
ztniu7kC!2z2{<}E{!CjM<wH`~=#e4g%GEL{wL#w4iGCL5zDbdf2qkWAN@9ploK|{9
z<NL}TEI%fHt^W45TMm8xpFiRM{G4?Lzx0!Cw;O#ZqCk|;({e1NMxI2Kp}zjlhED!V
z-&9#UHk^Ql_U9|XhTiDOXIqtrHFvU|AEZ2EOi?muHqj}348)C4C2k|XfhCy1ZS2NX
zb`{5!f8I839N-6>?flG(zv!-HKi&DoS#Ue;WUID+ZMQm!UAQe5zVFk8<%^cow$s7K
z)L+fjS+uXE1T$qG2s^>ML<FGNEn?zFs}mvOomVFhr}E4IU}MpEd0uL{-wN+XNEzTA
zwT%t|!a{BWbm55gNzB^F+x$uc?Z_p?Ki#HuW}1l`r-p(cP+%-2LoX0Xh_WpuGF_fM
zPMG9>$<zGIJ+ooa5aXezRbPqwXOLTy09Pli85N*aCs4H32>(vv&B(#)ze!&qU#7Z(
zKV^;J!XJa1T9ake1IW0{D!0&T@75JwoK0A_O3^0`+N7_VaO5WXgD81k&UHGK;3689
zLV?DI9nSzz>HdgjQYVYnZ(|+<)kc`nDw<M%XYQakh>ivUYdrK-S2YHL?cGrg84o+f
z1%JLiRBa+Kj1TGHcNbLO^O`wBH#!GiTlQWYW}G{XdeT&&y<%w=4I9<xX4e=oxUVPo
zsrACgW0!{;mTMZ2J9~DgHd6mw8Hea|YhUSX`0#m3e-5v51Y{ZQ^Vf$->y*5P)afOE
zU99jDmY|CKcPDvt^esYR7w|=Nl9!L4XiUOs6@OpkdRx0TV%8b?;4gZ-r6=G*1et@Q
zkYgs_q@R00LcDYD*mSbS@}ilUC5;L(M(mNMRuSq)l+Qs6oZS=?4vKNgkd&Y!q&zU7
z?W;V&su8ag(*<+*%t3+m?v&UG6co6B2g6xvJqb#V+E*4|akeVr+W`FY#~j1v#+_I}
zl4s+@TP`M?V``z`J=UU?%EK9P@C|fNTBy&$S|iR)1z#Y}+O@4f6LI_VGMh~poqS~t
zNYaR^rS1@=z%ZwIA&ezH6#*=vZslhqKhDf=@}{jWEGPhTNo$HyQnX~118YBjpUi}_
z3wGp9t<`ocYF^RXFK@SAm$Rm;T4Qrr0A)S8^Fpm=Mz*9h472S`#3~rTD;xda-%iD;
zdGz=jpAlo*3NdVW4#F5n<|*Z|`V^S<_xjbLrpJg<DyWOhz;joTJR^7B(;<1VbI*Oy
z18Q|}2K4<8ef3I8xSb3z!GUUjBf8p=idBP10Wu!)i|PEz3js3(mp#BvJ>=B&<8kp6
zZT4IghX@W+b7RVv?bI6R*a;2Kd^JYRpAv;lX@zWD@|Y&XsEWwe)^a;r?IihReec(|
za&hHPoaOeGhLdAGO18pNTe2>W3OFp)s<K$<t?nN`{i3_u5fzWwF`ANp=ww2bR}rwE
ziU2o@LXRs82hxFLgT(6U5O*1=mePo5{`KiVl3wNhB2-bV`9o+f=4EO$IwR~8@AWQ5
z*si6hCKr?wcuvl56|GJYBZGEi<Zji5Y!AwUX4*}XRjU}Qe?t=7SIr?;A#~n)yKB}M
z>)mX>wW>S!`HHsg(^5NsuYrh_pAR?AbTI=SfwOflig`n(_{7l`vP_fyb7%PUlbxiG
zHi_TbZ@Z}sbZdtCnfWb#D7N*H0;w?xCddfEWTmHJgjhq;@9QS{{m;_EFX68~e)U=O
z;{poqSQ4?LRUrnhrR`*7BZn)Npjo!q_~H@0y&Bmec8Kmz5jaSHiy4nK2iylz7)o6q
zSEa{GLpxYX>I^^~0bzyv=vEJcwuk9hy_5TGeiRdwtq<JMV%v!vl!LD-$M14~8VGF~
zIz``$YBK8XDTYpUnQ>QWG2*3G!5N)>z^Fr-y~TsYQ~&v$p1-h6%`Gg+zv9%4Qbzh%
ztw(pBa2w<6q6?CLh}Mrz9j~UJgyp5;X9+9hc2DW$cjlG;8Nl55>SgJuU0D91S6$N=
zaU6ZPA0paAU)q`(U}%8=B{pSK(7DGxPn0;88tLTV^$`i`dzBRF3#X^Wun-xj0HzA#
z>5*mg2{X>HJKQTI+;4?|QPL9L%i1U9#E2(J0G4A|VFm4fMUmQMUd-}Zzhzln<QFBP
zomHrEMAR_KWO7>#e5}j@xj@4DOckO)BF+55;=-LotRM{@2biD&S=Q*RE}-QuN4)Qv
z^{Jk&`jBUaldj;D#ty(_9<Q)Di<Zf8NYk*~5cI*8cswf6Xha|Hx{}Ga`;<F*1-=Tx
zCQ)z;)e)e7?*DFQCwXcrbM%UyPb|jQ1%%X%-$@pC?VkHdc9|i$(Jy!zxR!djxb~6L
ztq+fg^*VFUA<_KU8Ha-YI%~O`R=fb)#@(!sb>+XU_zru{kpG)c^X2YSU(6Z?!Z`b>
z80(V4R@nI6SZ&Zp@-&lu)_tI?jOJ(7dLj=t8tlS<AZ{VeT{YwXoQ?m@W<&L7XXTK3
znc1Bb)t7>>BG*kB+1PL@jdJiheeZX17hHE^J*%#rIV1RYpWI-|2Un80gE>e2L1V&K
zDCo6O;4@RF;mm7uVRN^&n4hL!Y_;1`;PS}_CT2kiKjNXC&-VBX?T{4*p4?OK4VsC5
z+*2%n@LCV$C*qK~nK7RPjcYY>KkN(=7D(|0J<4Y+I}V3Z2mjHuxSH>&V?MAG@9Ywz
zU$nR=UGm1>0XPPZY30`aiq7;=waLPEuy_4>@%IIJeNANv@8p;7`4-5C>2_K@bAOaK
z<j!y3>aX5EE8hp-3PRlVw|Sq!Ny9pMeJE;wC)MPhzusFE4K8k+`06mr>dx7{H6GjL
z#YG=i?KbS{h*9|zuVMJrlP_z{ng*x00F@pLC$_w09l&q88V)5%gngK0mpx6^t@osP
zKRUydZ_#s_84s=}9<8t*UHrsnnWxe9wxT8%bL-$kY4Jc?)c&ah+B?9ldyTud2uhiM
zv3iT7!RPf1vCE9G%O|i68_>sYc0qMF&q;D8GwS_cwsC|6BA-@fJKPX{Ii7uKs1OLz
zr6qtIY5Y)M3bkjp+H0FjZmn&wck7xalUvs{dV77Nx36pT_Ex)ru=lZUOdnhRbq&N8
z9Rv4f(s`Nm?_s*}O~H0s@vdKQng!K=Zl$KS^|dq6L!#+FZQZ3{t=*-kky4BK!dy3)
zI1V8}MDe*7^uh-lzl&9*Xee9tNJ%GY>TT)|uiv($r~XIzm|uNNS(A|KEZJ;}8dHB&
zL-&gxQeCStgoDk-7;Zv8yk-PNF=YOL>1D5|I;~d|Ys>xmA&jYC>NlE3#+-D2NZA`}
zWwj7pjX?<>#dD86V3K??N>+t6gih(?YqNC2-I2FqeQ%c3v!kZB8X>9W!i~&}E~`R9
zJc_x9tV_0E0jDFV14?A1ZrI2_S|yv_MQ#r9%@A_8z(nCGC03``O7deiVB&yg*={Q9
zgyht^Vci4}!;(YZ-FAi=Ed;-R_&$xq3Nn^g3q%gW+v;B7p4kjJ#Q4{$6k^`><|uh_
z`1sK#mZv_0+6`J3hb(KEUu^~y=ZXm+NC}!;)lh>qaUH*T(DA5p0@u#8>=zRhJWx_{
z3l&j?xlwYMYF5R-5KG|-sZ5yEi0>krH|D3dsMx6sRjnKN{<IBugU#cA%6EhVB1lv~
z0U-d8Y)R_d&N)OvcmCsit7Ff(AFW2~))tD+xgEdO+LQ>8L0^0#C%V(><YcxSV~k2#
z-AT(?qed;2liA%TW7ZbfGg@HO4YSd&XrrMIG*5p)7+w=L+Vmg1xz{|1P$IY1?V*E7
z*WR#tw{{RCmk9F}R`^4I%wTr!^LLwT0nbEd&Q0H1BZXXv;L1_aSO9Y@;D+`7^o@;!
z<ENU%m{l;+3nM_4LY#;i*@C?5T31wQl|k76K7VnEa+B6!*@H2&K3izdS`Jl6mr}&!
zU6OKi2rAK761E}_wA&tmELNeyf-pUKTpJ2X``dq{fL|GKFzjQ075R^^+{!A3u}sz!
z#EGSFp-@&%Dfj4N20yp^l!|H2qvqoQrdu;eVcZQoOEuvrqjtR>2?X9Rdh$z;5WQla
zhJ-BFE{5JMGl6gIB1Fg1Z^}G*)Ti7Q%xH;g>8s*w68BS<LY$|!D8}=&kU9af)d5u4
zYuJ0HDx)E<(X^d^bQ3px8*#nmJ1X8{nUBEr6Ggh#95j*g0}Y0InoVjdZ<JB6BAK9y
zvcIB2g>Z*S`smaF{~2DLkNPI`uj&O2_*DuasR{^+1(u~QrWLb-6b-i7Tr>e&L-R~e
z4lkI15G|2Uu{L_O()S3x9=B^T*2$|z4$F;NpdU*fir9*OqNdO_l(Q70U)5-DaMg2<
z_ll7=Kb<myR8I1V73=!i_-3u{YsR6kFH7hIu<eGGxwfpD)w<_=#7!`>Nvtv-HP)Gh
zwzL%9+W%-m0pX3+h-w{}-qRffYja(J>vg5~qPST+${k9Jzy|V<7mcr(mqrzDU>8^_
zBlow7`{4$E?TKfo@Tsp+A!HaSKjF2)u$#}!H5K|433Z$agV8@_>O{SiZj}<u5&+YJ
z)upr}51sl#ft{~P4t1XVi$?3*6#4I{BTwAk#SW^NVuxmWe9$~PH*DH`JWqKA8yZ)m
zMZx?JeCq|vn%#o&C76>@yicMsx-ruYp`^oB!<wsqtutNvMD7K-)rFIxXkGLGGC$BN
zfbfg4ApNflJRp6;b;N0g1Dd*0cRR%{{%m)57l@J2Lo_9tUxn&z_la6DgTYfs@gJRi
zOMD8PspQl_I%ns`CBJem5AsQVY9)YGo?S4xT!su@3@uzcx}yUifpgwb0h|3Sn~nI0
z>#t^ifX+OTP#lQ2fG}ZW+!@W51-iw%X}h{%lnHTu9&yEEJnB+F2ZA$^jl)Pg?a_^4
z$4(?)FztI2Nk`>Kp%+z$IIJ_jYFa8};AU?tox)I(_iD07ootw-V4<B1W0VHJ-&qYP
zI;LoSx--Jgmd|w;Q*<T`Yq70!5s@aUe6MqVpolGulBP+?aUW;Xs1|6AjP7cd^}3^|
zM*a~aYD#+3_V%-K!U9qbVF|4b<QYP-(&}HxuRZ+Q!$Ete-!}cS5=N79;vV?7|N4J2
z2{~5t+*~7rsq*|sd<8yIg@D^Yi^<!7JrVk;Q3Ki7ld}{=$2F<o*8XgG9&CB|{oQhZ
z!P1oy2s#-w>@g*N1zz(u&!_%N-HmT|oUMSAE_2G%Dy;`s3T7=)AB}R@JyP^pOvrK8
zI2PQ9cx3+!;MuF&CD$C1xQ&qI2<|A}1Q=@a!@Lsis_pHzF*g{Yx>DyzIl5Fm)fcUf
zqOGA~rl1e9^DEK+xNhkQm{m@0zADRqxi+jGF4#e5XOJCaC7@!|Z_V6&nmXSPsasjZ
zk0eET^RgUU2CKB7^}>CPf%a(&j3OXWjJ2UKKo6F~@SGy~&Td5xf>O0>C^Xrrl;|ub
ziR8$P7UEAgECwvjLNUnl2|%w%LRNYlH9<zDC3UfwGmtRxRY_PE&uDwfnjO1;We)ni
zhxu45Xk=Eo9y&l0#~nB)1PFV?1&2*#P*{QfOWINb=LwEEf@`}kvGT8(NT?1MZ0@AW
zh^EqG#n!M_Y;Q-K%)N^>1TBp_xQWlIsvH)ATU?%nx>)Q18A$AW7TFI_At%e}wmapz
zE8nI&*xnSvDEuy#qDc`KESsZ$Zw_B3PhULx=HPMPZ4vho^I}-VxI8ErLoTaG8-={L
zj;Muia3U=^fp6giHj@U&ZeMz-mLQ<F-SVpDZLN0uf8l{2;epFXt_28K0;+g2b+)d{
zPxdxSq_F6Kf>uLJU|~}_J;(V)!~|mO(uqoJ%zCYZ;m>s>qq7QS7vrpdnx~j;&+*Ys
zUY3$WN!EL&P^yQ@k|=?N(LmWLtR~(kQB3JiJZJ3RFS9~C4f-M7#3Rev4a|&m-68Y^
zb5L8Ey<LYhF&6j!r*8Z$a}`LguG4+E7j>^#n_BN@v!|}Ojt5=rKYQ`~@c6~6-qROf
z9ra#3@4a~V=YvPby(4#j?SNVHL(k^w>?+UM=L;?8is3TOiVLRzyIFy~Yh$lY^r_}$
zH<5a|yVqF<v9b_U2vHk4$*V;*haSGMK?6!4k5?$sU-krIxyP!=I@CKGrF5+-@ki0j
z@K#ZgFIyO&_asVGYl&MuhpHQ(y~I~jG1pxelDIu<uqoy6Eq$ba3X9|6^{gEhj%F;b
zHB+rE&?j1|A<#b41<`sZnjSCMz4J>*B;)afWRRig0`eJ;1vDPzHW)9!J=+Oyt)g6P
zq|lFx^RkRm?<<g9utG$d_O%gG9?V6|T*nM4{3a1~<j>vW;YvVqncRXE>^p~bc9C64
zsVKMwhO9aT<_qF~FK`Mu)ntPBz=^T|sUcjWz^WnqwPj~x3QnECV?JD%?c@?Jb@pz=
z1W}&#1tKMRR9$wNOP`$nG@79-%#DWvdFyb4fC2h(oX>ulD-;c(T{+Vk!BZ#G3oeRk
z;g#-5J~y&)j2Z55+UHw|i&%lrJe$QOHItGKmW2f9oXG=!>nNIQ4QsEZ_U>s;ckk~D
zrw;M*&h4JYxT9-9=~kbCV8&{_ot18sic`dz&vO><`ej&M7N_%xx?YEb{3HRo#!OJY
zTV;!(q6(t~91@LdhNW_}9G#W5%!mFFuokAkc#%}Yy#M#}HK^ru@^JBSQ*o;oh$XI{
z4ik>_=zUdxe$-p;^v=o;wNAA`qOOAlGsfw+;ifUACiual73j8{7xpi%F_bzAQ6Q~X
zftoPT?y6LajF!gf(PG7qQ>r@ZClfF3@}Z)M?3scA5{w_`(kIDRvhdVUZTQM^QB@*2
zm&Lcx)mN8|{QklRk#)dm)uUd?!oAo%G_UH|BLd%l3v_rpBKioF-M_CVMc<c^3FGBq
z^sbH_3R)WEd&%WKy_y!P^NnC<SCec?AS@QF+F=r&>Ok-?hz$P_cwa;ba4J{pGAD4n
z6rpFy=G3jPY_{nZ{q4}Dj+7H#@zjzcc)d?CT`9RV@Wbk=s4EQqTel5w>;ib1rx^|}
zDK1)nb+cPN!%QH;v$<B6@<DfYRAQidl4C{1oydbsGw=@wM8KG`ka=ec2mls{PN<s1
zaQTm_iFwK87g(quzI}>9WVd_Q_{r1KNCZ3q_0b*Sw)woLW(XYyHO}EvDT=>=mqN`+
z@qPv$GrdCI4-`8CYNZIYXJ_hna%*N>UR?-(C)!MlGJ;0|rjV2M$P5tYxM)@xDMbG1
zB>w)D-xvQwy`s@0%5DKb6rip|Bq5=WW8(1x6pEaDyVY_{q>wbJDde7?mqWo18bgio
zMH>MlA|~^tUr9Z4t8gI@--f>8)Rmv%l<O^K<6pp|wsX1jv+v5`=off``7z*Jp2xL+
zW_2K$Caw(>ejqJ16nCt4P>fhS3}-5QA;76`hTNlWB=@bPrJGOQoou~%)_e2f)i*~k
z_a7Z>eIG^D!TR%(*z3zr9KZPH;Q7|~-D)~6=B=&nR$H>i{`}@xDG{`oTNo_ZVliJR
z<9h`8aroHYCl|lTuh_-@?|%**INAMw{+Dj;!maOr>4!Il*q)XN2M`f!U9RlgJKP(h
z)^78&=k7rKdE<BXz#SP%O)NOlf3|SP?`HWKNtCu0Rhq*Ly|vW=`v3j}5oi2{yKHgp
z;cJ>J<M(TpMh8zu>u)dlIUbtM(wF?=9*}GZ?YWadaykR25wjp)@Un4PzT}~QM*g>Y
zdfxZsOG1LxGPa}S$jlP|2pV!-ajh`<C3TOCN0I`=ca$UiCb@F_?Vscat?Gc5?S4l}
z#*RBLipf^^B*_x7$>;*-q1F6AtUXKQ&??JjKinO^xV;0IqZa)LWZi5>^UbTz$acX$
zyT2FG=qmqHci=uC`O}~D2jwb%h+g_L3h*%>d+rn)qrz6-;T!!09f%9-Ioa6BRUL5(
z%USrg=y<6S<#d&)eHKf8<D!R<;IS<&>k(}f--?Z)UI<_nddKm6wxC$F)!L<g8(}90
z>{qp$;L|xfpI_z#d!V~Y4^hSQhAbw`H-rZPa`;~V%BXQKj3MB>i50Sc%Hft_QXY<&
zxx}51e6&X57e{}2s`OnFyS6lyR%Ae^k<kW-{6$WWQAYuz-P1m!iL?})(|K8ndLgJ{
zJn03%SH|+zZUP?~9eDC`VyIe{Q~=$nWBPbF$R_DYbtgF;XJ?WE&+0_>F8;27su<(t
z7o*{?M8@Znt_7zV9zITg3}Cy3_-9)<&Z3+XT(zT@%2v#`8|UkB^oK@{%G>1-71MJ6
z<sme5HYdq%CkF@K285S6#x9JG{gvIc@L5C=TrG7D7?S?oNz2gL_um|KlCK`UWZ;(#
zz@_8vX|F*0rnUx{nW~tRVUc>!m;^yJ!1?cL_~cboFl3c2@QluX=K8GrB5rp>mm)%!
z=XuJYd;*>fWOU8X!kBJih=CwQKXsvLn%$^bV{kN@BLQ!Pw-4ca0CG_K^}G;egcm9-
z1l0Z11oFkP!n{7o)3aFybO1Zk4VzJr5B%+cZ7G@~c>*DKjWv+Cq!2bT&p%OFma!i{
zKf3yf=9cnu(|weGNQ$rI5%d7dWyed`N>`w@;6^<ZBmu@{F%hE>p5vJ^*N*C=BXTZ0
z28SUiFJ;&z4<h_ZB`w-dM~}a$YM_I!4vvmF&sN8#Ye~N90v@A59)}`)8q{JWYzkUh
z%tdfo=*dzL|A_T}!(v)Q+?#AzkXd{aa(-abjwFhYbQi&YOr}zL76vqG;!qI-qgINE
z6E^scjv4yGm!cxpGj3@MttXOvp=Vg!k~=rL*+uqKIms?7P!x-6F5a-!a*l93F1F#Z
zd%AdzrSOw0HrCcdmD9XXNQ<ai#rv!SHAk$6*A8!><-`kBR+scwBoMtCoM|K}LQ9e6
zlrzp+<Q-0bPxNa+VM&HgflSgWN&lL>eBo|MzfLy6?Oe`^pOn}0VV<E<?DwXmZzh|+
zf4F~i&^vs7eDLb|{?p#;S5Hj`jdg#X2RrQY&a>}&`>!7#9z1_^uo-j~%Zy|o>q@=D
zRr2W<!ap13hT9|<gJ|uEi3UZg^-C(QERwKU)hi}{eLW5Rn(X=tCZW7is@YZjG{^Q*
z^AH0vQoVz}zC3*OUGM1N(NW*2L+^@NIbq(FAyBGi|COI#YY<5|tG9h5OIAq$SsNZ&
zGG08cr68hov-=g@+!K_iLa64RgGhBkIA12WS7motvkdn6;4Ak4kb>Xj155XhEd~6%
zKZDJGlez!vUb|Oh7khiV(f{`FPM{3AUwinQT7J~tu`tZ?i#pooQBEuRxtq~F0UMGF
z&IX8cyoWVo?D)v6v1ElQ#^mr7h2+D?hR_jc6!rh-NZoLxR#jr@KL$>rztbqO7Y0N)
z68LLZ+HY-w+*rz%WR+XdlT&$m#Yh;5c~^aZwQp)UR_vy^FPnlB#3Air%k(aD<gm)1
zwtVTjPSO3%o6pc@$3NYir~5ihaqH1!-QNszrLAcHrGh^Cind1xXT#oq;wfb6YD*9^
zQKkEmu1@_$@|X#y=Z3@@XgP(bYKsnFDx<)v3IpljN=4<XquZZ-F1bU}l13f_!-M;O
zmUj?agrxK2<twExo$HdH<j)QsF#5CQ{=nNg0^I}kRmpPiI~myDb4HbFHC`mvUSUaN
zMLr(c>og~XxV=1hPV+fKB9cvJU#~7vW`>giU2vCwQjkp7AaXkTMOF3p_?_;rg(NNb
z*Q;e|E+4+Wn0U^g;^ZF<PNC)0wTvWx{l3%ewJWCMtA1Z41TnJ(B78$N!>n6-tf*9Z
zo{RR^|2cO%c>K%W-p?AhLirT_$>L=Dhj$SD(wF1R`>8cEPq{low>IsLO?lwxFA>#U
zooG#xsp<~zRW0`K1uBVR^q{}VS#oPohbB;;%ZjY&z?{%*uD9~{uv!5#$2pdNiO<Go
zdY}8t>0R^l3vuIG;YPjLx5Y?r7jNg<d!r3NWybFURiR`L1noT9@i01AU&+Wlf-(l;
zsSnla71qg#j&GtbkM;ax(1rv8-l;SFd$z70P>rP8*aeel`gY<J@*VIs6r;43E7Fg_
zhgow&VD`F`z|h0xH*|qeRDG#`LvX|RXVx>|64stv*s27rp%ocsyda570qH$UoI*E8
za!vd*qCSR@FZ5d6Q+|O%)|^TqMb)^m<85n?*l&PR?pL%TIV-LS^3L-gu^$eA4!%*`
zZ}{Z;g#EMe3=>e~r6{C~sBF08v1PRZ{%xJ|4d5>Sh`Tf1IGzQCtbqA{a3N)BY<M#2
zp+~*7Z-Bclh}Vcug=rOo{5%_<%J7AvPu?%i0)%LobN&v&D7tlEH!+71Qsn}rPUVE_
zsjcDL(i{v{K^gX}eQ(49>JN+ll1kB!Xy0YYfPDd(m^<0U0Lcf7N(1g52(*7%mV<28
z4<i_XtL9gKJ|BEFEM63Ue?EHs)8Vb>#bI@LF`xeJ(c$NZlhJf=@oJvE`LQ~j>~`I~
z)8U<GxVIdA{pxb~Q~B=c?OUIHcl*ov@T(__{OGeE2Df*Mr;q-8K6>+);>EZshId~5
z^z`D%{JXzS-wg`+{jW!t#ozvVetGyq`Q!7S_HRA^;k(Nh$FFaHx#y<e{nb79!@-?r
zk6-V;czpKb^W)d<-Oq1*SGfLMJb62KGhY1V>(H;K7q7;nAIi^1M_-=*?W<eULGk7J
z;LV?>qp!yAMt^;NI=ub-D*Nlh-4{Ph7lT`0UJSna@{araVsQJ*;=8{dqOaq@n<vx3
zqifpdn0!0`?#;M=`s<y)jfWTGi|oy}Zx4T%?hYs4j$IpnAKd=)X@+ku4lkb_pTB)}
zJiL7VX!r8jSI>TYdc1$@yNkp5^T!9DKD)X#et!J7^A}%z`}S{d4nKYN!!z{Z^1Hvj
zD&2S#ANr2N!j0X<kMBmezSL)?ixK+y=+Bek#h15+Uq9o2xPON^8}GWY`}U{5{q@g_
z@7~-Rqy6vR;JZG(`FBr7?}iuipWOWZ@V6t}`?q)QThE8ZpTF!rdHQ1iS#|u!%j3nP
zXV3n4KKk3kuU>z)cs9xIyi4yq`S!1aa`BhX9{u&tpWpg+`p1LIFK%Cc`OWRaC!@h<
zvxD@<^t;D@vn+i!I{xCxop-k$Js-Y%c<bF?KK<dSI(zx_$wlw<@nSdIzkPbxd-(a6
z-%QHe-#na-KFd!3`tA9%*Oy06KK<$HRWV!qZFG2a>-^~#FMr6NSI=G?o?fNH-jm6b
z-oxR!TlashE~n+^z1KhdQ2qJr&S!VVw;z3W`Qq<?ldCUY9DjQH{Hw{QS6A<jpMCc7
z@yo2Jeta=|xH$UD<8OAqI$u1z_0!ScK7FzO)uZ#t=(F^j%X0en@pl&&yU)kZi`TD@
zzso+Gzj!r&emZ#f_{p>MeD;@HU%mL|(KnM@Ura8JzWwYk-~8~?<cs~q7vq;-{Qdbw
z`L~yUe;xhx{Kwg+S1*73;^N0QU!UcF9KPLu__x!CcYge8x;Xvn(>tG^ZES#~d($1}
zz&tir`NdV_4hkn4HT6v=G2Fc;)YeznA@2J3yw9l@?!H@p-2LqH&v(E4>@!|;DurJB
z^ouWU=|!iu;O!JG|0Q<O@9nJ<IAAj%9?af<o=6<&8)fh6wxSz)@A4U$kKLUJ_3#%t
zQSt2VtuIEdho7dqyTe=Q?q`ER`suAN?xgu=pJ!h<yJYai?K{#M4mdoqu9tF`KR7o*
zbw3{Sq8xo;Al(5UhR#ko|0U8;phs}m^|K=er6Z#&8x_?M>Bv!rfN3_K(u`U7KDEq$
zpyB=5;hRWazj~^kwqK*<Nay~1`L_8+k4%=$uW9}V_n`kiL|^z3JiPYb9Mz$ICf?T{
z>^!@ZstulHBGHi~Bbj;BH_H{gHlla+iAPcRj4b#9EQiTGb-4eG=|8}vuy<|T@yu}b
zu*}A%UEgr>dN$r$tuBIENYCQERflnZ1J?-lw`4`_KTFaFG_WiDp?Bcl=%O>sJyZp{
z_!4y?etbN)-k?MP=lTwOs!vn3^SK_$v>X>hf?PQ(2^qG=KZh;`2dDumDLlrkRFo@}
zt$`b|6#nl)UKt6A1xUIZpLGR;3~xT32@*VBsw;;g>|041!`8UHd+T<3Yd5`r^+(w^
zN2tJn*V1pdB>CC9Cfp4NPW2k%*Uf!wfXJ`me%xo-0e*C2vbWaVRe$K^%o!`iG=ngT
zU&SAvxG$!Ug8Msmw|x1>&v*a$<)@#y|LyK!S)?{qJFC{rX4LX8wfDQVC+VT9-hV{M
zqJzIX#lKqdJMUTbx;+v7D};W3=f+KV39Z`cf6@Q0ZKm7pHm?4%vHUmw`@PA+U{;-A
z?+Y7-7*dSJ$;ec`a0vdBjyMe@#Z)Z@wYWm+H6q4ce6xH#Pe-@^b^ys;&3BxDntio!
zv$f-$Q#~%!0>1j}BK7Z1K?Ku1pI?kWsb5Pki_>=4Gzfn5WxAdgZ}Yx??=t$Trap_f
zE()t|@2DYG&YC*-#%5?qr+xJt>3O`pw--DJ4`eHS=>Etl@?dYzUD>|Tb9mGrlX%dd
zYs=0PUy$5jE^n5a|5kO>A9U56T<@A$UBq$ci{5&w@~B_eP}LJy>Mw46yTSCnqUGNH
z%Xoe_wrBt4Y<_pshi&G69L~t!`k!9^|BR3PXME)Uaq$s5F~ARera|9)dY)g9L@8vK
zcA`X3C9{;*SgHtIK7~)i@_Dq768kR?yBc(_jbik#lg&rrADiEAY+x+p?LGHKH?H?<
zckhQZPIotMmhMH*)E_vir+WH__zg1q%?J1sN8R1M+L-t{tIi95C!nXvw+NHVN4{gk
z92pXZbNj=k`$;Yfq8@&9M#_9gjGp9Q-5d>2dD@c@$o-WE-zM+FpFMA9;g&UbuX&}e
zHm4x+T!_k)(|h+0UOW-Cn9CYM3MZ|5OpaseqpABeLpS3Dhwr1iL<xezaJ_x~i#J{6
z5o(I=gcnO$)gZoqX;r87mGe29zqNY-4FF%Uk;vDpnIVI)`m+=HZlSP}YVpWUDUk`w
z)w4qY#qi|L_7;8B8yoakZ?3y*lRDEdn+mK>LCm%jH^%ODn^ZsXdXI&63{$3XD@GtD
zGuwIKh7GMcJ6_Z?H}&T_({JA)V>wALPzrosAFDs(l%Mi{K9hO9fMo*;g#GRQ>!-)P
z{l|}A-QUtg{9CvG*xhyi->tnbZtw1HZPai5^PA)Qzi<7oNTzAmJHkd?SK>9FGRSye
zLqWCyP~<+LA$fo0dT{sL|GodZ_C^?72*~RO_a<l7`MYem;>f!0P^y2m97lHYqPeb~
zyZW0YTSLNs%HhgvE%#aY|9kxWa6WMyR&T9v%wR~OlP8AN-_qQE`2flI%}0C5KUZ7H
zKl{F%Y@rWZ-=Azrm*ms7zK>h-ngA&-yKmnS1m6U^7IzVL^8QwR+_wxUf3;#2gCsIi
z-CDi2ci!FFsjrf)4%6B%ayOmso3^mHsXq;vhmRb8fUW@f7N=KE?{N=yBwYwv)AEo)
z3lbG7t_*RVQ)S5Yw2P2OtKF7Ki$^QyUC3&6dw6u?uUaFSFm&>TQfR^oiLJk;Jj_xa
zeOsy-qBcTQKTYbkK4^cv#%9UXFFiMBsMz{7snyFIpGdS`Zaw)I59Q-*krltwww7#J
zr<cfoloEc({q8BRm3R<alYnKJrujy=hAe;1PUnK+eC1w3dudu;k|=@D0N@8;X({b#
z@SDx##6%w7%*k6Ls8zC@9~lb`2*0$(q!`Xg&AnuMTPntcr3hG#tkIWDYLc%J<;O!u
zMWmaxKsCTz4vwF8<R<skuAfCYQ4F<QOOxDxb-m-FFu*oyd>~11E3Mm3{zT$OVizAj
zef-LuRS|r>Cc12I%aD?Anpi&C;aM&<4vM}c>ZH4SF?>75H^=v0WCSGeu$kSB{qY=L
zZW)4*L0W@LLNcodb|Pq5sM8a&OD#{6YPz0>lIppxNOf@?C|Po;g$dH9Q!{2PxExA<
z&;TDJoRU&}SD7}PA;TTyQ!$f0i8GIdm5llD!dv>bm`EA@ba@F!#Sl{3Dmb7r!r!+(
z!6&EkFF_kA7xT0{P2I9c2j!2=fsde@Zlf(5f3&23w*&Ah{&`;FbHZbH++#-<#vcXN
zNVrU^G%zTn)w%n+Q7V4>a(31B_|cw!Q4Lrx`TP<^!XmjzPoP0_TYQ=hYNNus=YSeJ
zNA;fT(5J3Lje2Tdi)nonfGmzxbtj$OP5}j0rUaHt2jg;(o)Ob7Wl}`|8noPJmfL^k
zUi7da+}VOW3?o**_+hZCY4!K9ylYxkbKq;F)ndwpnND)-{o#2Sk|CJPfNf@f6}WyS
zNn*ZHehN(5kK71jVy7UEfet*5Ry`NT8#nx%HrMITU8kRyxQ)nUwv273xQ<Us^f$Gi
zQZG`S+A}#TM+0~p(|6f;k#k_M&}>|u;f}`-*|syW+$rMjlFlOg<d5#<-<D&b#<&-~
zlfPtrMN6F!AbzhhFrZ03mNE{1DI}K~wY#>4kR>5C3(@WfmadZ`i)j*xrVvwV6dYY6
zv8<{EQ3x$-F#$vnFqs)YvRzWj8^1S0SLmK@vW*S<E2_a+7J(TxPs#=r-*x&P09Zh$
zzX46tQe38YD*`)BRaSL^7a28LSMFr{u^S446epA={BGHUw$gVghVAryYS60@f6KZd
zCF0@{jJ-khu<mV1N^khufopH8C2eI<HdfTja3&}&w9SmTCn6E-YXG%a+Q+vDCMf-|
zM5PnlXo5a^n@>25ukGyi;(r3L&g(e>RZG~CY&4P%)ZrfMr_-_v_`}E5bsr`vWAbs<
z$!1YabgWw7@B}_SU)7Cw{;J*ue;9VVEyW$gl!MYVa6^1<iqS++s|77bv87P#*GW!z
ztZ0tWxzpFM`0>SGF9y~xXTT44ZuNL4X5f4=@cn4Ft^N_`RVQFcIyF*Gti+#KQQ@5A
zi|OVT6_SU%3NYCMCWrj_#Vrez#y!_>zVIe$hn}ShN9=FCk;W30+3|E{e_<)jG?*-I
z_%sue=j=yxNghk_SZdwFt2i0Lk|`J>qQHWFD9Z7(;<Dxda|9uCM2vY|fX^$U*DCNP
z!@$l+$vJU)IX}^JVB!o6U#<z@70Y7{uRNw);@*=y@NudHzu{;?lm;cadpcg8N>-K)
z8U*fS{CXMdwO@_AK<{Z~e}$q_d)Bod2^I;OL}ECUQt>Efk)lejI(JrbrF#fm+_lGQ
z=U2Bo$+Kc|_~OIZz8f1a0G6J;D{@r~4dLux5_j+hbtu*_-HO|%SDgSI9+9dZ5v}g*
zw3F76AcYuErQ%p9MiD^6gZf`3C+ynk7^DB{c4!%f<<S4c)<+1jf0cyGb7wgYr=8jD
z9o=30_VBn<2)jkOL%u#Fs^GsT%Vpfrm;6K~t^$j{Je~7}`6OLbW^GqHMi&kR(>C?0
z@ePgg1G=J%$^d!D>lv^%&dy;18V(6HI>l~kC`Q2?ITs%y&H};p&msE8tjLm;I&@lU
z>TS%L5}mm-!ae6Ue-x3$RfU3t;FCD>QJ7uDmBy~yd1Vz2Co*lzEDTLdX*9QbY`Qz#
z2*PwAjIMH?USw~z{@`MXOKsT_uqDeH!j%L%#9dj3b(<X4;lHapG19jpu-xQfAhWE}
z43CzrioN8e8W3)es0GnUo;wqwOB+H$-u@o1xF;>9#!xD)f8LzN4lpa6IX3P@jKNR<
zgtFXDS-Dk|;p)7Y25HS8RpAZ<f*Uk_0oG#(B;V)m>W^0=VPhkh3m^{vyr(upe9qZo
zUS~lFeu9{eE3647N~1m}rXY6$SD2HXF*eU9BAVsh*kMxEs_EEbx{E~uK(-ZTiJlWR
zu&xO_KJM|3e?*8_){RpI6wV%4T2`lmjky)>x;YL46&vyl-z#j$BG<*Z`<LW#)3kHT
z;F%b3oyayj5({o);~O*T)LfIKyJT8U$%HaIFAJ>;qN9nh;pHT4ET}rZ*y%X`u`tOL
z;F1)Vkd2`j6j+#RB}sCflPs<sHrsQ5?u-|Ao;j;bf8kAEPu<8?=RqS<cbU4!R((h8
zV_UUG&Ba+WFMk`~CS9~WYqRl+P|zP0P>7l@dNPpyuJ?=zSwSEIWtlr8iN+NEkGdGU
z$)od}*?u@{OzaXf%V-43Nz?u0&x`GCe(|yS48elTqHf;}L-DA4vUrSaZ%^`Umj0B_
zO0n`?e*+?Z!Zwhv7&UNf>lHu%6g9zO&}ALMJ9k2ERH`@zO4MmQ0F>7SndSqAnrvtD
z84y|vy^6su;+d|Y{IST1(e)G5Bc&p(A{HH7?cr)qSxKTL6wft89XdzcNXR6oSj+1$
ztO4%PdytOii&0VDobtp5*{x+fxPt72OJM+<e;0%E1ofzQzP~Ff5-Yg{5swCB5ocZW
z904+iv>3Vh)pLp6k0C}CXaMg}L@=eQ?8M$g_Jx4Rt{?fxq>tJH{xH=fsYH!mKas$j
z^|Q$`BY=_%$WCOwD%GPng9)l=667lxyF{Y}8yjDhxUIiTcGpLaZa>-_eO1>Ktj={e
zfBcw`qBi<>R2<1^;>h+$ol`{@>^5UyUC{zGmLm_XUU>oRw7W-QQ~JcZ;8t8E`^1zC
zxpj88sK$u2>Y%9mO1E@ZvoL6h7%&^8MD_Qv51;xkY8l}=MW@aK4fttkV1@LB8Gbu&
zwz^fAjxZF&y;Q~!9>q_&iXvrdM|>y5f8$(d`bP&(4;~#S+sTtxFP_;AZ@xZwb&wRe
z^Y=e9=b;$=((f{U_hQ2Sq6cWw?Sv<MsH!!4`26VL)p2t8{P=}6`tAPH*9S*QYwOSD
zIYO4VZ?(0_RvfXDyFZj#6++Y6y_n?llVmhlG0Iycs_Xd+TN2h?d9SBh_q)q<e=#g0
z>?M`!PEi-o8X@$w0Uiyy9QW4N2L~8Pa{3W%8IN9xG1d;a0q&jp5x&0Nt+oy5MobMV
zKl<@>^W(O5@_T)$Q@snPE6v;3@X7x1@&2Q)g&2=R;gp2txF!2X$!LCeW9eT1%j=^9
z{&(YpU$31|hQwNY4oWJrT<Bv3f9^W1yVLx#<`xH*y%$6sgD_?Qh(ed1uX1+g^njo8
z;K%GXWsltaA<-juEz2Fb4zXhne4ixk`{4--e0gGDe(JLEzHV|V%}rzzt<GQuk3J4r
zAX1^F$H)%P79(@?kdUio&eq<=mArndeHQ?L?yb!o5^mX8mK7IQ(rrE*f5O)GNLPOk
z8AE@ePNe?Gjg12q;Pm^H7u{~R@BT)f`rpU8#ND-aAKmKvRWFx_SZl!gnb;(>BVs1d
zQ_OS-&gp9fQb0FJpHvrY44RKuF2FMowc652X!}Pg1N-2>i}tIuCiucLfM`t+_(k_o
z7R9@tyBqs(5$6}v`BmK9e-SK?S+mhz<u8Y}hp_P`zVg`KC)MvP;I;cnm2j?VNzAUN
znC8mwOI-HwxwyL!(qehN<eDkcUPpYOnIY7<-i%d&fayoQfc@|L^%qVB%(6<TpS6KU
z{&}PaJ6Y#DQuXjp%#38^HjaZJ30<pR@F|yF=+*tTjcPK^zAxHBfB&n!q>t$jPxuG=
zVIg#uZsIiHwti=A13H`iYo3m7S<~$mKh@s7=CSn+FTEQM>wtzOI7?Pu675d+R|n-Q
zR5q$MX&h+~c*iG8r7}=rrl1C+9cv=)B8#9nRDA8fJX~Hg|G+V-nu?b{M<R#oYP&%Y
zMCbhSsiF5$y(0OHe>?bD;>cpdK$9zu@o+l%QWuIHsa=CBlQsTyh0e;Uf8*(T66r{5
zu9DY>0GfE^&ll~TKUIv}>AK^^-8?*Bd&2mhXaXOim{Y)sW5)XaROoAhkvF#aB0-C7
z^*^M3Mdy!5`Rh)ozOQGr{)QK}F&wX>17B96&Yl_IO!p<ce{CZuZe*o3tpeh+<{$(W
zmaW&oTC-LW(b!7nU5kE_dAO5PGBB!OzokPsBvfB7#E}vq&B62oogPd#!sJvzmysT9
zRk8b1Y)@&l@-iKe*`q@6@10qC+F-m`Hb+(K71)>pNROynWcHA}t0iCG(PIg`KF~qh
z0-QcO&4vPbf6j%;ZvYUQGw=cEGaeU5`J_^{t(XwK##&-r3_!ORMRlRvMliAgnhM{@
zAU`dAaFw!(magViNHJI%tSBHBnO#&V0EH?aA7KNzM<lSJJUvU+7wNT@4X^@31R5B8
z5GO^fZ@RPwr4cj3E5jrqACDUp+;yJgfD(9?UCM^=e;mi|!P8lGCYA`1T<yjdJ*I90
z%>gk3%4Modl1ykRCG5KOK-2}>CegRZlJ)FmZcyL}j{6}3z+F%!1zW!I?rnrJ;m#m=
zRaQmwu~(;AUuz|=vs-`vvwf{dgkN;};Octdes%x-B{DXh!upaCFP!)FmV`L6_Vlg2
zy@!Wie>qcDRS-V|P5u(j<B}L_ix0%EYr;wkJa9)O8^XAYTbnSNW1_3Ng)wmBebG@;
zN~DEIm`a4R=I{w|GOYf0Wie8>-VdHen_P!kESz=Q4$l!EQx-0jEwelgI~<fpSg@n=
za-#6WW&syYB94Ga3dgG=2qEpl_AQq#-Q>20e==nwhnWC&J{5cWm8RwRK-;oQZF@W8
zU8D$%vSRpU!s2D;VC_32-uj3&wC+!J>(Ai0HM#=YjJcs_Uj(#Cl5GshI!IV*<-M4W
zO#;>5j4R$jc_6pVnieO&>jU;C?^&`oc@?&1?Yn%}i_>P8fR00lq3au}N0OE<dZ)i}
zf7!ROXQhyXT72vE%g6i22c6`xyYKh__qkJ6=Zjes!WXJONL+VD#fUnRAo=)MryHz1
ztLS|e&nXlt_N_+bR8Os}Rt^?hzR8FYJ7e{*u?^$cZ8(vyUx`^Q@l2hpG1L8T=Z+4p
zXtnZAkji2{b=|MEckJ>V@<Wa2Y@DBEf5WS`M{kHj7j92ww*2*l?r`oyBj_u^jN#LI
z0(x0cQ@0ZY6nuDIA^~MtcipNnsWx@1Ng1-VE(;z;fNug_BKVfHH4X4u#UGK*nsXM?
z){~Yv%4yAa?6AX_bTmP1ht^4ADvQcO-N&;w<DO0-H)hbN)1BqGNYj%Z6%FcPe~P&x
zTc@PN7+RK|<y2Yg9(+F}6rnYDzB5$g9c@XrfnIA>Gp)QJ2r;L4jo(|mY9U}`p{J$R
z+7^zG(8J_PB5|wUODr+f6G?Ro-Zn(82Y^J;yeqktiB~7h7zWq&r=RyM8@Xo%;Bf+>
zC?aEsBsmCB20<;S0uO;R2d5*Se*<NNisi(Xp?xUFE*6#^3SR6T{7oy>`dCAMw;;(U
zfpS=5Zp#uRV2UF)<cEBFyPF_-dy&JesBF&%TY`Z$sc}VaQM4?($)lLKhH1F+RhIu(
z4;y-Ta|9uMT!<m6DDFdJS?TV=%l48!9PS1UUAOmOaLCU%sAYydTS(0!e?E!;^8H8o
zL02GYIXEgd?K*TIC>ndQ|A+fWUbKZ5Z`ID=3*$H5SoZAK3V^&gp~e#D1bG@w@BNrx
zmOd^ysy#;~II_|AWDsw;`B}5=HpFJFlvX;_2sCeWtHa&;w|rKn3@w4$7D@je=?3*?
zq~3*3fFiU4zpamc$=rHbe~kO~$4ZP?BXQ4vEKriJXi2>~E=8}S^kj4fMukT6GOScp
z^)(r%wyVfAqVYx0dZg|^%743PoR8jX3WToW+udd9gpuDDET7soT)tCAuC7a==Z9p^
zx-<=x#2!4Gj0=Hmxqe*FOOi7SrIY*9-B=^0k5H_FXh{MidIKO8e^NxKmZKszqo&%}
zcx3A~QhQ0)?6!P4cb}Al1tJ=1<HZh*K&y#`3`cAd69b8;QYvx!oL%!Af=91jKXxzi
zMAQ`qjGJP|9m^};1;WsQ`W9f3jYM^a#Xd7u)j0P;%%MsX15Jbst^#G3ANcr44)U<;
zE9BwoU~-Z&$T{(He`Di~&oGsx)`YO#f6?PbWwNd1H$cd#fFG1Uc4P(6aEzU<?v>(;
z=_U`A$FBAo&zhqieoV(`6p8(akR+dx%Q3j~nsmrwH>m5-;w3Q}J~J=i&SLJESM^lE
zB3H08|L8g7+2(qcx@S@;`b3&=c7{?#c?X1b=-&RzLpnx0e@zGk2);Mg7^T!PA=w;+
ziLar_&zSkeQ>`{W7LBLQtj2D%V?s^KZ<P?`8;l$OkDChhYfFKQ*-pfuc$#1#8p9%e
zQMD?dv75Vvy!7O0p3NrGwQPW$WZj5Btn^B^qP?@zUY)`6(&_s+EGuX7N>Ffr1@Bof
zV0eQ+Al&#of4f5Gg2o#tMX)b<`a+%RCP((?zeg5I_k+1OjWWa5(Vg~+oE)1?$;h#P
z)$(!lqPMv1-*%Il+s$W{)$uh=rl?xWHhfr0qQ81~&Pegwi<xMFrsWyopXsL-4zQ+i
zbI10H7%b&QL4<Rj*!BWZF}v5K=XhcNpV>LTadys%e?hkBkpA0pb5>1<rRFp^G_kY9
z6j_&(bMs(gF>*stjPBn&FK7HeD=$ZfA*AKlh%xtO9A)J+e_&G1_@k0?@Mho*3ifw7
zLx<d^vyqo&-(TvRneBTay|5=6XR9yDsDuJmE5VT$u3LwHGH;ZZBkm}fmy>#Y$!RG<
zYwwG#e}-NlT&jtcD|xx=9Jn24S0UX)Y&j>)yP&kaBT3zp`L!}ox}lV|{t*>@I#`MX
zDe}(!TjiLB%H<@?Cuh*8XiVBUmb{<~Coa@XTFXH@cxb5(Hh0Bjqz<6-vK)0I^hlxX
zuC=RLrI5R4bn2smK;))YxLHC;k!w`2_Ci+7e=jDc8)|5Lxg<_A<_*MskhApeGPmp!
zD`8dYO;zY5?+#e5lYB9UhTukOlAp;K0`;K46e_74+qfWQB_b!X&ayhWm#zzok4p6@
z)Y&K;uQfi;u9Am{<&whAX{{RqFE$Z+NFijJBu}3{OVk(dY@A81M_8?IdH5_X51r_u
ze+;LDU*dDAdQv{hNYN9QW~K8K*H}v}gOo_PlO{9eiza~kdt9D%YZAwIrv;dllkZXQ
zvn+4q{A~)8N3Ra{j}MaL{fAEvlEWv-^B2d-!Cw!Lj*r4u0>?);MRIif>hSqjyzTkx
zr%wUZlM#by)i3bht-9`qQ-9oOM?E=sfA&(l;|8YZJF$P{9u(0>AuR9!4<2mUcEzXZ
z-<|p$(m~!Je>Q$cH)Ujy;8Fk0ca=Bzf4Q3|eKFv@JacD*p9OqNd_voG-+hzZ@#o!*
zu-|N(dP7(&ff=_QJ=;raT1TQ=_T;7ptu{@<Qg8wSdu77`($(p@&~}(q2UkGke+Y0-
z&b-s<^&uf#izx8@DxZ!S_R)8HmF`;6I~w$?6BNJAhmBPnB~^=YKB8LUrZ^+FQn<{~
zh<@`_rGZiQK#*)Bwo+p;Mfpt_(=%ohE+&j~=OgjJs-C*XBn1O{Q}|XUF;22+bzaUp
zTIT>R3xbZgZI1QgWF2a=lh$dVe~(K}D(gS}4!3&xZ`ZdPnY<zB&~iDsfNP~dATELi
z`20?9T1<0D?P{lS2U}^w)v~ydawLLWONvVk+@Tu`d*;9{CP}qw<Y7@_(aW$qfrs=O
z4RJdohUH7ikq(IxOYQkFa-T7lQ%yp%5h*=PclaA-N&tkaiK^60$+5Uwf3KpLv04bT
zoS=Tf`145mz?8&n^n<ghV45#~tX5Oc&P-}s_49=BA_{DLS4h7(%__P+U(BYi>!_H4
zv>uN0Y_gc{1$>NJU7*;MET~3$OVd6wiC$kB<NOo~mOFfTpN>U5f=)-u3QP-^VkKEE
z5+xa__w-Q>>we=|eRo9Be?6o=aVGtl8Q)t^SY07{+|l$=_G{frjhEGpEY|3OhS9pJ
zDF~2swfxvq<jkt}pd_k6|DgKTSjCn&M3NjTRt=#eO>!anN5lGVjoicSJu>8CMMN`-
z`FopB=av{X$b}|{Gv7@fivVJ9@{b9c;abl|5;`5u07>%t_>pUTf2mu{sj9Uw$_la@
zB)fOc@l+@9!-?YKbgyEFg^|k0785v$%hOZD;N6bIZW60Ma%F1hfvO^o$@*@jWL&d#
zC`|lWW7~ROo}G=kJ4eO4Vq|4oPx)SUc(rsQ_b$s0B!TI|jS|+c+Z@PN>Lep)2r<IQ
zbiAPyqq^RmUro>Re~AW3TK$v#^lw@E({B1@Fa7=x{q|j17&V?Y4tAxq)8}E`=^l(X
z5)J@&W-Z?v>4Fyj^GCzACxZ?+5W{Bgm?4J@rqh*sW#=BQJm`08ed0Ry#SL;s8H_tx
z84daZA<nq_8GG}kI>viK6B2buCz2Kf%AO^}r0t!&TIgZ*e_8LMoWR!WO_4|q43N_W
z4&olVQ>(mY6|yDMp<Oot#I@iTR~C&1SS*?Ch1}{Af;V0fqe9B=Fk9W^z&aU<5D=6@
z)_=9QxPU#GNvu}#(f5qhcGUCx6{*;I+PTYE%{m<X0qa^X^Fpc1Uas_1PHS*N+~aO)
zqt=yQ&Q<}bfBqKm_D5mwmEw3$<9z4EXk>`VRME7hO2;(h^C``SFHb~1p!Clt7<SAb
z=DJ$GvsK@ae50bG=u0%yS3HH4Ka`Tgxj-IO$oe2zo>qj0!$ZJUWiv*|^{4o22{ixq
zZZAN`^Oib35%%9JFM7F%oKQ;LDscuFqSDPnm8{~We_HToCBQgOqDO9|XnmqFFJ!MG
zh!Q>DMvj9sH(UMv<D~WN!K<Ug7tfRX50Xi{-`4sLCyPc=pMt*dVWnx1(@aLGxi4fz
z-q3uFjx~4k5S21+sq-k(tz;Vv{&3`2<G5gZNbG^o=6s?dQ6jJrX~3HT1jN0p%GW3^
z7~|>re^up!SF+NK8$JKgjTLvJJL235o1GOCs(_h5(wG~=3bZrD0RYlf+I*V<QPJBw
zTTHpiG0x?xQz(&?3d=N+k8z_wy^X_;rQy28{uqi7UT+u<Ohtj$Ut+j)zA$klJH<>G
zPzsl{_>X3C)_eU`<01&XUukxJ7&`g9ZY=@^f90#OPiQ7)&F%AXyQd?9+`k2Zk}>3M
zFoo1%QdE+i-QioTUR?kVLJV?G)l`IoG(xOd^m%Y`MCtDX_hJGc=cmPw46`8ZQB_d)
zoW%+)Rn4-zxXDGQ6UwOBTf%8!71%6Y<#P>HWKl)BHfl!h%!71~h<ikzk~qxJ=vK8X
ze|f<P@3vJkaFR9Gpk~mZY@CEgo@kX=^QpdfcwS7ql2h>noo)_b<-Lke#iYLZWPZYl
zAv$E-VCpWX9)Z)Xs-JhZlj9eUU+lrRmOC{FI|zsAayg6B?BfNPaZEbFA8@+r6XJnc
z9+sVTqvA$=d*>HRlpx+8b$8!^ca_t$f6L2LiP=6wt{S>5FkIq4y_Fn4G)0v%Eht(7
z?BL-mL$hTl2}+S0>m9-3<Q2tfl8vtfOEW6b08oIcyt-n6cZ9!vKNUaGs!~F_qEQY5
zj_~M??gQEKZ=lrp?$Hge7NXQp<P#)7DZrs6Hw%ZbnwaMI5mb{)NiR?{)i-Rce_Is}
z6WvSZQcna5&F@$%!eZDM;6wmp<Y7xO7CuXLFUf<4ZB+^hHABi0wtUp+<h3@Seo=2U
z5EHQZFs!~+BOy`ce6%81TpJSJJP*JX;ssXkBDGGjinCd#;Z)$a+%WD?-RbFVt6~q9
z?C?!~mBg?)zgf})C@<J>&l>*qf7m|%aZ@G!6Se3X)FN28aq}A+C$)dq!SWQ{S9m+|
z^G?VBEUJc3W^P+nrCI9nMHN!7hA>Arug^a*pqx?eHvLsc8&svwP4NY)7p#YtkKx90
zA8+?~#3e$iSUa*Cg4py=3SwVcEod=ezI^(cV81Df7-nS&uMn0{<!i1ie~Wz*)RvWy
zX=n;qk0}AWtgq?^85P(jc>rIl6>tE;w$R$Hsb68&EmxSI<?`yO<F_h0_)&2-NuB!a
zhW!I`POL$ldC;jZrfo$9_so$&`mbxm{aQe}3BqffN&}qmL&KVF;P9@*&$VVRMs0`*
zusE7)=A;HfYiX&WSLcgCe_iC-{fcIK`}R&-;MeEHG(^Bp3l<*H$y*s9KHXCoXAZPQ
zejzZuH=cmAYv28+Y&yNKAJaC_cN)KLtGg}9|Ayyh_@_WmN|XeFp;WpLZ*D4JZ^_%b
z<g3Bl31AeW^d31*B3VE?dYjL9N!D*RrV;FwrHY;apOu|a)aCOlf1hU-7O_YDmh1z!
zs1X!K=|^rDOHR8#$7&DaRfH=zaIV<HRZ=Y8VIfnuD<g(cA!#fhhZ_hmm=+tOy93Xm
zrUznjGQ2WWT4W=v*?7@8;bv>>bVfOFq-=)$&J5c(?0H!s#+MLwrS$UyyK&{TV++k^
zSLvx!@po>p{XC*+e>XfYd+%3mIcenIX~RVn!QKyTMrBo(WST`R2cX*``d4`0LN4%o
z^>mU{+%e}kAD!i?ohYNFt>VrlHxIf+;)SC5&hv7m)KwQ5tF@wPCOxu=pUyN$_g3g0
z@ru-J9IckAZ6gnoAVx<v;x-9iQzMO9Rrm)DCBokEy9cIJe-##`sS_VqmP<ozbbYlU
zzro4`-)Z~|*VeCEmDbAt7VFaV{s5mWrp0fj_cy_9q4)noSk3=&mH+=lq5e-4>i=aZ
z)ZLr%@c#QCQ^z%tjbYx{coY*M`5_2i6{D8%KCJkwYxu&eKAxLhSS=;>eqM^ZmVPAW
z-q3LiA`)NjfB8<!(-`;-=PYgHTFK`NF`PkhyO=;r)XbocyB&!-%f2CIBVN$fb1mN5
z{i=A_z>8@~xibR}^ll13G|Wvt*$#*x;@Xy4=b5;i=$?kpl+dNTfw7gj#05o4F$8gY
z*D`h73{+&>SWMjlGkzF96(7ocA{dQ*)Y2DU4@_Rve}KumJGXB2Rva@QhgV+I@yfCI
zLQQ3352+{ClScV~+{VVi@l)~8C@Tvk?1fnKaov)j`V@8eidySh7^zO}Y(Q_1XlbzK
zM&)E{?gM0kk0D4bIh?;yZk+9aJ!@H_fPN`gf#Jrr<Zd_GF+r&ar8V`WPb`C5Nvpae
z11V|df3Fr3?}_&4Fv{C>r=DbrOkKr)nD~_YMs7K&5%sB-yiwlsVx}X=ke%XHG5dhw
zfTi`cs$Ek0ZB=)i_;)APMM-B6iT=d<>5~!#!%QlRg{ZVtD5#sfW>~$`xA+G`*_VH<
zyG!3HFdCXxfjAdS+$G+~)ZS5X%9!lDKAt@Ae>Wbzc==r-yqDUSM=xGKKW=TeuNl#H
za{MBRN5ToT>0;iU{(UQHJ$do!+5T~|r4MZ_L+O2@&<pej?McP-gZsC-w{L&h-QD;^
z(m3wl-|c?cy(I+<o12?man=WlPW+E>G`+>FxbOe!B+?mP4S)K_+A;q#>II;TR90u9
zf0YtPcO(zYtyXITpRTps%JH|7-Y?3rZ)C>TxR^v=Tv$PNkb+qCv+~C)%Bl5d=_l2l
zl=roL=^@M{#U86+e{jzu!Rw6xY*=9w1QO09$xrXt-uLE%fxDZ?800=dMo%dmbvzPJ
z2p{Usk;TC6EKB`fj>CP7j_^r<h>+Vof90GxjGmY}Ou|L?p^s~_H5Q*821!opH%RU5
zAH}c;ITDSO3|8)X1$nKZu}&@WQf*@+YNVzb^I0~@EH$ycg5kCQ@-U7xhakM@4ao@>
zU`+ehprg8};rA&#fU(lE_LKPHYK%$;#GAc%aXqc%)aMy8kIth22%%cL-z^0)e;7uE
zgx6|auaZ`z*x&p^Zr%Cgj?*wdpuvC84*vX$b`;bSO00<5XqgY|H?nqxNGYP6k~j6D
zH{Fz>>p!lYyZrrY38hx>VCksStAsr3PJ;@}7kncjCMGPCLN90{9-hC>%jJ2!lrZ5R
zVbq#i15E}k<Lvrh&!TlwE~QJae|N<^I%=<_DvEjM>KtM)SZn-~^<d%2(XXVAd-ZYD
zahx;_*69+D77bfY(ptm;#KC07l_?M8XNGvg-q=#+L@zW8&4UwYp@J9<VV}mFo|dwq
zPC6EuX|AQ@H7l%B%co|-l5!_^Tgu|Xu>Pu{l+8uMPQKGWCx!QZ5!W*)f2s5Y<2xHj
zY{sn(XWz1B?W%$Mrb)Se+T5;~EHopUdEj=2xW-r?BXgnwqp(bE1Nx&z$FJ@-?epor
z%DbY{Js6Q1Dy83ua%4Df@ESH|q^s($l`XT}rkYn9l1?gCqx=LoIljCD95VScDsXP^
zZTyb-0tqmVk$;XI#%2g3f9|_Mb(Xl#@s0OGqoJ_*Np9f0@vUyly>!!|g^8E*`K((^
zR7n>4de@qLNY^#n+Ek`>y?2L?|4H=r`~N)O)EA<RtllSUu#3b1QpZnQoB#L!=Lw#0
zUyGDbOHqs;<W|J+pjAI^tw#I)Gnv^x%a;cQ@}Th$A1O|k@4eT&e{;`U7HT_e9ybP3
z=rIw4a@)JR$@`tIxuWq0zpn97-fX<O;ggcdosax_buG}uiG&h!)7824gy0+SGyou1
z_N;)NV7U->4MgyB`CV{`-J`Rjgfiz5=0v=Csvb1Db8D9<iiW%<HDHp!=<IZyJ>1Kc
z>c;}2@k#=Zc>_k@e~GvbW)H#v&``*tttv2;Nj6sivJWR=vo%|ADn_h+SPwyExHk+A
z``k`KoL_gV8-A-P7LTC%`%vo)8ANBJJ0eQUKEKF*EG`xo$>C$toR^h^)W6P%eE1yM
zoUET24<*-yYL%+q!vImU+;!6tI6Q{egPK<Ss-SjJLkQDif5v@!*`*3TIEfZh87WKB
zMkTPmrCRZ7R>Empn$4)eVI87;tTphsgXF*ZyA&k7lBHY!RD}O@5Jmz9R4ytgp3%!#
z8XDdN;1l;Y&oM_`P26JqM7Wi~lc8UF;@0)JET@eHdRrDKevybUVYi4(<kmtJgDAR}
zA@>^Fg??Aue-MC-^B*(%x#rQ@=Fx8uUo&}<@Vq)wgh_P^WAlyeEZcYrN;JOO)EbNk
zhafp!OoqPJp2a{Jq{>DwRP^^qQQ_qGk(>&4=xI<tj}K6&x05S5B3lvUpYegYj=u8n
zjm#{ikIh%7Q@io+dg*@acfuLFm=x|biM<P`<Mz0Cf4W!I$zpH>_*+J6Vl4@2ynpUY
zyboy0byobUDZ~RlCH4D*J=LT8NKb7yFqI7q!{vK;$PbbDK;wPjrr<&HlJx{w?i4sP
zL&-alBi{98DIfatp8Qs)D~1zALN$VmKQ0C{_z`&`Kh7uR&cg-3%6j6%@iS=${Qs1x
zl$Z6UfBz4eOdT7Y&HevfW>Zl$v=DZQhZ;D0&1;(2Su;vvwrR0Q>EAw4B;#0|i8K=o
z69qUm2R7V!Q7&K3oF^oUoH^4F?Y+&l+pNoW@4;9L@)|?IB38jJ>ha1&iwyW2y!*^q
zhAfhFvN5w$!=6=bJ-%NL;~27jQBjle3b#|Ne{xCRs={+8Ka@g%etWlvlEGTFI$MJ=
z1T<nK%3kI(0L|ysFq=Y8f~rH&d{VRg-3!DwyhG=6V|YLBf#0G4)E(o`e3cY-oFdj^
zaba<Uow#*v+ij-`f8WR$Bi0Y<w{X;@80b_68o8)k{ORB-<%@7j%2k-kDoov7xCRwm
ze|$KpA)vMWz!pw<;_2f|I2>2DZG(qbs$?QJ%j>@?)Rkw53ZPB`3?(p2?z^$!Upx6A
zVs`7vix-F)T#xwl3G1$U^+3WW{Ovv>319xPyBk?eKgNJi@?wMS?h$-Qgu>=&>DJ?H
zvy*&!rxp+JeO>!VJMg}|3a$%pQr8UTe@ufzATWUVbp!jcO!jeTP~C9nYPuGcw_d#@
zESeaMkqV`?63Kuya7HL^&H_H(68Rcp!s=(hkId_4?FADIIsu||UV2(Fwvx>Tg`2cl
zA(6rz@k7)CRQv#Xko6NZYaB;_uLFsZnflRQ(dyK*_=?wmy2-xC2XE)s(520of47d9
z2ZrDn*w6$ejo%jO108<fpY}BC6Dg_1oK=?jaS281@bq~(KLFgVzp35di;tbiAHlO$
z1g(s(s*O;W-D-EQ&1G=CYSO2trGbn{5$?zQN~Zu>B<CeZU6!8WbwlWjY(3@Vq5Sm(
z)m{59598d*N!dk3+|G|XK4RlEf79-~`crj38XQvO#52*t>*H@f`_NZ^?Ay<3Z<k_Z
zIVN?Yt33C}UBQdwJ>jQOjAA;~w3rR=CL~<yjij+AdS|KKmg0^!-e8M5<XL~~wnGHi
zt$C93GIDGW7KRNVbS_oL!wm>AO@<8*7r?v^P0nKx$`(=Y+hjPqn$ANVe|8Yv?ksP6
z_E%OAiYlQg%wd05#e5<8hq4cWq^tg6EJgd2{thPI|Eu;fU5VVe77+m%FHm?KuVZfD
z`j)PH?}Y>>c;OIz_qMNRRx*Ab?~+sZ@=|~V-fzp7J2-yot<TD;9@n_}rG}6gVt&<x
z`VM>1WABbP+#cD>x>Kbof6wMcMFl(eJTpaZAakMFt-MPTbyaY)z}oGces@PA0J^k>
znYaKw?slU?g$KV3QHf?;MD|XtcYx#uULFr(mGBe8cN0)kl%w&p#N|t<=5VM4NH%~p
zTU@BF=Piw$f?(2OuEjLGb{Bk}(rPGs)9B0815T)*KdBZK$UvGte<)Rood9r?nT^%;
zk8nXX2C`1$_Ro5}3}=9o&Rp8ZJ`rry$4GMV3&XYQA9?H<c(ZK?YKcUov_fjJ0I$kp
zjb{5M#*j&TOb`+q^QeAi=`q~1WlLwPj}$5zU(NfxeM3GL{df+Pr$%nZD3LtXz03#G
zHqzGslpruO9bF#6e^^>ikQ2Nl{Y1Z_ZJA@!1FNsL8_AmE{VIrX7DI7{L~K!9nP1n+
zon}!A6AX{baxoqe7W`t$QrMv^F+m5Ett!bTmFBusSZg_Uf}lA{{L9IB&Y2PxMWqnN
zX9?$-$`z}~Zwi))h$2l$h(pk|{9T4;f5WJ=HQtLF|0H=>f1D*z;;@yM?FDe+*3n|B
z<z~-wXTmy*=lnl(fh7(N|MgM1=^(E(N_$Q5jxUwz=qH#)t0V?drpGK7xZesz<$j$Y
zEfjSR?M|IAQ0z#X3!GnmHstg>P~d#e_xB{mK@F<4VyH4p5DtAzxzAE=>4&?E9l@k_
z|2azdU$<09f4SQUW#ernuByGclPFD$R08_I-3i}Rj}551r>8*LJG(u-q32ZL;agtb
zabo!I<M=|HXiWFIU?hmLYvwH?65@6FsF&UDi9NdReJ8=Q`cduP>IGAIb=!$E^SkXR
z&y2^^bVf-d&ZL4F-Z+IVdy5A%!_B%fV3g{gLA9>*e@aw6RI9RU(yTsla$dH4TqUer
zCD#?fvLvX|Ix~sAmgSh3YzPmFptJ(KYB7-U5S<fHm{|Qo&7t#2*@9dVR%R-utZmIM
z58bGs$G+d`GWW9N+^MklH+{9hblR<rMkUW}Vmsd7oRkuN+DsluUeW$^dT%Ftz+{M{
ze0-XIf9<-lW?(6a&lXS;ci?kMm8qjGz~Hs=A^0HuW_E)NpY08r)uoo|Qq$rhgo^<J
z@6nM}xxYb!Hi$b0tqdPhnHu8qC#S*}nIdYD2KePvExj&-uW3zr@j6dsyn(#s5h-T+
zMv&9j%TG{&%9u#h{X=B@VcMf>!ob;8wIvCCe-S;f6h4RKvrq5bcD?$vn>6HKHq!U_
zVIMZfOEL#Md(_`UuH8pur``H=XX+bJ?Xn@8uW3ysN7Tg5t=nIIx}!2ykdz4IB(AGe
z^^P=pr_-2<>7Lkdge$fbPjlDwt7?pZ6OFe`#mPc=sg~hf_=+_@VkbU_+hi^>)@jAB
zf2d;fi|%6diQb>uwKSU+A6Jm<JMn7^lI_)a?K2iIEMO~v%>~O#f2B5g^0nA%M>u%{
z^Wr;N9b8wwH?>keR2ZH4J(V(6UWv!nf4JLS);BP~dy(MO!jy+S<S|5TiA?*vM$7j{
zq2=@U(K4yEaY$G0@l3+X`{wEJ-E|7+f344uzO|s=QaY?I4Z4AW4TfjoIKK5+DnN_X
zN4_ORYRNpgt&t8?oqUI_=kC1rozNrG+k6?)a(#RIwWA@4vtbPlEP3_x2!eDjcq$Q4
zj1TH#2<`P@9oCwboi(mf-%=_qrS7*dZC26#Nl?Pvx$FN9D{*3%R-U@7G7AZJe{1k0
z>NtDh7>smNjy{XRH6SC^<^j!v|6V#M(cx8xq!qx1-s6<)6_a0iN)D~EDQa=P<F<Q>
zf2V^y^~a@CpFX=49hk^OaGlNUj1*;HB%`)!oO!s(VD0EL)s2tIMl*Uq?1<16ASfqb
zQwgd?0kv{~$|wOGZk{PVA1-?De`D3&E{hS!DAkt7bU0~Koe#=v2967%*mR25ESn6^
zJMgEL;|PD!ubkK?AL;j^I4yU{B5-6!hAk7q1lJ#(eue+XJv+mZv@dn(ifOazYnPcS
zee{^l1t6esB|iyJ${q35U>zl%*J8(=8IvL(@7;q(;<B8L9{iVlivG<}e-NL}+(FP?
zR4MQg)7xDX?}nv{zeWQxtVXU5Avc8obmQlZ-)&-VZSEzTH*IyZ;~s)S<sO1cg?}O}
zhBl<Hykj%~qAe~;FL+V43tZLlkk<6ma6NqIrbPnZ_%N3~5BxfH+xT|4B)Cs}ZH>YI
zMS>Ci?j(KmyC1=i_=8-ye{mZYvJ-^=FfHzK0PCdj(%+29x5j@QxkNlFf_g1Z!npiK
zM)xQ27Trls=qC8B+P=8*&C>1go3&e|*0A?p{8nvO!5!k7H#f;|)%u_~qu^?{J&E<I
z^(4OA+OpE6($hqgozcM75=vh;8!c_NC92lA94)z81ai+QX^$m)e>=c_O|&}EQ(GPo
z26^SrgzhwR0$a)p+kEVf#uh_WOv|u~%&i*<ehnj#PC~0GJu5G9;W4pNc}`xga+G+6
z%TS>EtNg3s@mgCUG?VO)r{~#*|BWUpoWHm%S+8z15Vi%6X=Pyf#Q@p6aCH)SJtB8R
z7LdTDT;fjRDM*Awe?m`A<@R(MafzH;MT{W%J|l)W7uX_UXvMIHCkP~D6v$H&)Xx-x
zk+7QZ)r;3nFA|>ERGf3f5$R`jlZ*a%>X2DE9Rb0J`I%03ZEyd9nPA`yC-2QzoDc2?
z8?>aw(Q1Rw7z0Lt=o&#9F#>XA-V!4k`)Xj}DDzG;?n-vRfBaoJekV1;BL+7m!;%#9
zMEf?RV9-wFdXSFGcPdj)oe@pK%2Y#m1r@gww+R4}9L2Ha0$nY|<Xth(cfS4O%V)R0
z`?`AhuuUELt72X=SkIhlxez!pTYIU~+AIIBwnkR>{ZttQ5LZa3K@EYp6PYXuh%Xci
zT%gT)y^*`7f5Z@%#4DbcPH4fGs=;JIn-HdpIHrTxu}8v%1iBcECAf%KhjOTXM24Ci
zpCf<|GmYld?QHRX&!gG*l){QeL}cJ9Fr7x>H98~fM5L_gmlb<Lp(zOPw|go<qfx;y
zyCtLq2AQXLk|KGyN$^NVDOmJZ4y9Do%c$ZWq3&bqe=vfSajK3JQ*|kkF&7wV(T4hp
z79yXgTS3Efr^8vTu}%84m=#<NC!@i<j>qDr(_K^VFSY8&*_oTAS+r{90<l;2bRJ|w
zNe5!wQ5~4X^}wf>TncE|JgeUNsh54bBKe#-c$&KHY<($Lu9I$#2HkRY22`4$+>GQ_
zk2t&<f9JtdcFNMG`QG-x{090KlcRZ7MO$BdW1ZEe(^y-Qqll*)(-D{v6x8Knx<IuL
zQ08T!FxV*0fZ0eOP6EAdyoweQpYi~_%0{bMqzr{;lXAjnrc)b+Z#|^LA3QX(`!jq>
z?j*?M%7;iKOQc4mM9~rNwbU)h{?1Mk&JQane~$=;-6%W+($?}Gh)^YDyH)G=8zma+
zHc}@6G{d!<Jd`psON0d&8IJvJOXS?H$wa@HRyZVeT_Lx>IpyqfL}f&{-&MRtMyU1=
zu1MKpmmb?ed{|sg6Bb`<(xqP*ZvJHjtK^l0S}FQeEWgEMTn^t>R_^9?2U8K;c#C)Q
zf0^_hl#~c@Q!#6N>-C@S7griOC>5{sJnCiAn&nPGbY0sKVk7ror<&%IQ5#84Q^8aW
zWK~*Xk@=4(A^#VXId{)22iiW1g6ERrg5%%a40yE41KUIRc*llT{+xX4Nf4U63u`{~
zTG|A#O$FL5vFL$c=!QcMNY!vNEf}7%e{#t)a?MKRzV5Jylr-gb*K8pjK6>={woxCf
z>tZz=-A?tMv~p+Z_$sANgHDe?3r9-yw(AzlOr_8IVLUl`VWw%_qbS&(3Ykn+rS7&L
zoQ}%sq?1PknO4?yJq6bFZW!I0>b-3_la~&`h!(_|?<wIfg0?3B7oKrY;1Gt4fBdBi
z`Y=b4;<}y?YMytv)1)tj3m`#pFX&Ac<1zjQJ`?ii1b~_xDYf`~zwKpmjeXordv)%{
zJ(3)wX#0W_%TvX;UOP>7ocUFGB*_4}6O2X~8({s%NCH9X@5AhRk{iFLs2*VrZdICc
zU=U*y)XB|40xa_HkRyR9(eDCKf9M<>Lc*G)IQo~_Y(lVop@A?&V^otHQ)=Z5SR^M^
z>Um~QvrEbGBWV|A9Va5pG!DUwNuH7_(C_4RAI|I_jXgSfR&iU}Lt3nr1%$K{e?N!P
z{|hlh3bMeoV5bLF!>$O(;j9cXcj*#R%j8kD06<YgB_gdO!pN;GU<suWe>EksiJ*dr
zRQ;1XHe$MSI;w<Y6{~*2mtbt=wW%eY-;FCya5P5;H4dG#Jfg+2W6Vo*JCcG*(619F
z_mlH{JQX#huDKHULm{Z=rBsThqnXr{C<<sQBPKNlffhk>WkPD9JMDyLE5~WU(x8s*
zA<;ph4-JKFOfv*#-cL&#e^7W5&3v)qA5<o(-Pbz0W59ErxU4;566hFic3Y4XSn7m|
z^zoHtj;6I7uwg-5lYsy2-r-K7JiB1xxGs>`o$Oib2JTbNFEY0x+6rfbG%=5!8eVe~
zT$@^U7Uk4}$T6mfGcLvz=~sUwa1EWDNJgFrN0<QlWTpwo-DE#Df6Hc!VHFc^w6SN#
zn0V!#qV}`WsaQR|EKyTV(e{=7=GJ4L>-|is)A~sh+cwqoxzFzUH<c5GiKcF8?=?~j
z|Ei6R_sL7?%=_f2Pat~lE~jal=>K*9a++}8{WIE8JISB3cbWd9^>E>a43&Frx&0H|
zZ3;6~<WBMuYU`2Pe?w!1fu{}S?o9ot)jH5mQ#68uu_f!LldQ<nT9KV)saxm^U3<a5
zs3S-xx-QBVUexX=2c(%5etB4@?y7oeE2*+13=Xq`8~O4L3|GW1-L@$|)y+huu^7gS
z&w~Hm<Y+OdoX}pVimZ>`U^;87axAcyQX{SWO!nje3UkAqe_-669WEYHQM&Kn<I)o6
zMmhB^2&ppX0HJ)!8SY9BrEdTeEUnDNjMGdXn7x7ZV&r(5E60g~-}&B4X5U}@v~6rW
zRO@GcS*A23Ki>Wb*3!hg^pr`6UsEUGjue~96x+MX76|w{bJtW<8`ys)(l(4}b(oyF
zReQ!F!1G)_e;qMXsdUyvUxGN-`J&<k%Pjfm5002cTXDq5pLuv|2DYm{s>%9o36wvo
zdp+xfs30}WFG}S}%SP6*FmQUuj<DtS_hPU_pZx3oj>afyuw(B?0?9@LMzHnm{?pe7
zpr3Bt>LgoKpSGMme)#O*=y?Cx%Vg{J?(NUh-COSee<ine_jY%;+F+4x-FA0_ILh68
z&E22r-FH6R_AR!((FPUuyj3`b=&d`3oD8WvDq#H!`v8V@YaupkgS|+uK;xe5uO1B4
zAd5eNdln3f*p+=5qQ2Ot#k>>o*VRl+C0_KVrQ{h%Btcj7>Uo6KwwU%~=SDGKJF7@5
zUOkyNf12{%;HrnA{4jC4tqmD?eiFbP-LI1ku9nfbt8f15)r;3JlZW5&UY(yiQMrN@
zoOpkHT|LIii9i*gqV#2PC;#?;{I@k9!k=X5uDQ!Tx8EgVs5aXd<zo|<{y@<ws?_G5
zGtP82P8n^l8<PmrBz;{j1ow%IGg%naU?v)5f4&rM&6*b?ULVJL;&7dwmu~mNLp$CB
z9pGDUNwKf}Xc@SbYOZW4EeN-ilRi^xY58lalK(N@E)B2aWnso0{W~Ay#qK5#^I?XA
zIc5y6vD|oh7+e)*FGP+a?}mw7A|JF?%uWlgk``6m`LYl5`_?BYSoT*_UQNY!mwJY{
ze>66^4N1l;Bck50mO#H(^jT5kvxM2NBWKf&-<qi-%ww)ke!&NIX<aP$)~;8;SLbvu
z8+I6S=}R`2PBYlb6(wHbD_^1Q*H){su4)ch_s>tlzuG}SMa4HC^u4CZhpi#llEx#H
zYN+U16YDN=WLBA>)Lht4g2F7hiUnfQe{`g}Q`k?>MSd}W=CX9ev@AbL4P)AZC!>$?
z6LkQ)8L#M%^Kvo7A{KhXchDe~A{3y&42?#{uwmgQ43Y|oD$;v2x{h?z+0~p_F|yoK
zymR(elJzSsQTRkJ1+0Lql03`u)LpaD#22fSqERA6Q0{TLNN0;)Ol9@p35{vte?I+F
z-W0b=@1eT^|HZGq!K?J0`_Ficn@0J-30vffePVy&@`rplsc_dwzSY24QfjZ3GmpdG
zoHT0G`>3-SAr&_d>BeFs1;@Er&@_^$(bH{}g!J1eniR}vC2Ce)SZ#YR0n=v`ruAB-
zQ!jFBk2zcrj-GA1x{hvJ4u^@Me|=jB&W)_NQ&JUu;D!k%v-iMy2bjk9f(>3Z<Ge^b
zp@9(k+Hjk3eoPdKBaQg#*FQywYdh|Hpc<aJ6Wg1)o=x3}I6wJ}f)?W|C+TYDg_7a2
z42=!Zb|dvSRKg{7a+Y1%8+FwLhp@Bi%}<O!o6g~n6ehkt7H;8g^uea0f3(a);6K<|
zX$uB5jA9Kww$b8Z8fHy^*feuG7M_Ko2N1s7k37CtwJl<rt8%5zJw6KlN66g1VCl@y
zLI-6=+Ny4O<BcMm-9ltn_-tiWGTf8aCWs}@t7am8)7xCZAVq)c6{9{<TfhwDwz}*n
z;puYc_hQNbxo9Np^r*P#e+`*)zGfv^8uo7+VDW$N>6V)p0=POv8n*fyi9=qgD+3uT
z7KsseTTb40Br~~{9CCc?pVU*Nq&~$_HYpfWaL;68md-ovbR@5!+as*F)8UH!wQ^HY
zUhAQLwN=?>^85j^;zo(;_bln(KYH;b`SXjz=Y4~Tlm3Q*5tsm2e`C@J#z)+UcI$aI
z3h7>asZ-CYgz>`>;5`}vnV@1y0HZRe6ree@c!f#u8r5j54OuSu=HA<BQ7JaT3}3a#
zVUM7T{m5fM3ke{3b75?OtwGCkI-CQFi_d4}JN)f8Y2T^Q)1I9FeN_nz7^)dnpl{-T
z{5LU6)L}&_*_Mcye*)wf+`H>O@z|^L9&iR{^Jtse9zhe|ygbx!B;(ePj=oJ4rJOx>
zGOswja{GP)Y^#R1E^K#o@2N&+)YU290Lu+xcbsRZqO~x#&HO3mx4~O>G|nWM43Ly#
zccQ$~6SCoY^9RH*tKi?SrzeQ{#ZlRl^<%~5;(@BHsL*MKe^tj^!m`E_u~nj_JX@%=
zl1&@ggR*-VXR^$ZOT@!akeOjQ2yaX7!LcOCNPI&~D08+>+E_EVPzo#exgx;FnHEg6
ztm=xLlbKXMNNxWvk8l*~rq0LsA;Q78=7u1T*W6IsNql2dj(o_=5yTNB{(b)GWIY~Z
zScBWzj^kwYf6t0QxBAC=akX{U-3G4kYrm%(-FyT03&=+%lBzJJ%!lAI_jXu&PL?8C
zI4f`vg%#+fAEXW1k{tfbL*lI$iAjq`SP0R3_$IV7S-?2r%B;(4zF=N1*bm=sSKUYi
z#VWftrXBrvG$eK@yI^95{!6xszg^tfy-a@}mYGv!e}{Q%)WvsplC8xANNZpu+!E)Z
zyX<b4HPK_#S)YVIEAN^zAUC7;k~q8Wt|y02j}KlYtv6pEygEqi7eXT4PquhoIO9Ox
zZU3@0Z(g&oPm*$jC*0G6C&xVI@N;d^BqMg@#q;`LxtEP<|K5N8xHdk?1Ki=%%3{>R
zp|MeWe?{1cNshL2KQXT1FiRWqm2ta!dyn^z5Adx&`!)E>R`3AsKYe=F5Y3Wj4Wkhf
z&k!B52&h7wqysp#>KS2_*INI(I>b^7@sU=toYqVZ^V?Qx7j4BR6(b36HN-HT=Gn}o
zU^8}4NV;kx>fMIbm%Oa|4ImiEZ8<BmktH!Uf0V$zFeFml4o3nfOV|l`b{66o8M+U5
z(s(fyKpWyr>8k*`B{-L`#d9&N#w5`zV$Ulv%;a^WG8ZgCmhRR^Tew;P)H#e|MocqR
zZ-J<un(E<k+U4!Dkc0^_qH1~6i+JQkwZs7#u|Z2ds>b!r10ctcSl5S3euSi@K7%-e
ze|f8-Wy*t3lO*J>j-V*wLd~*e^4be+Q8MOj43?9L7!gE3u1f|b<p5Yfr@w|$uM$e>
z`a+G=?RH6bM8gLoVahT6gubxLyGx<Oo=uqM!x}Ih@{#ntn*i4AgWfh0bh{HnK7dSL
z%)}&tu#_I-w4Z_V50iT_D9#pOUx!`3qc(Z!2Y;GFK~J+DEm$zF(R+OJgT7NKpep%$
zWU)k>PaJTATqpw>!gGJp+8QxDzOO03vncdS=ilpBhpMn>t5gO<b*?1y#aMiFen<!V
zQK%3o)%7JUYe!}i6S;>d{eF1Kd%WDD!tav<)xH>=m)N!KhDIE}5!3gMPj^kM=Dz=H
z2Y+C7JM(e}%cHB5S58S@icPjV`h+L-;-l_Xi7cK3mayvM2^Bx_PkWZ6Hu@MD??-o@
zU<Laelg9E^HZS+jtv<in1K+u3evcZ&zW?iVXP##lzKjw-T*?;OSxlYile5Ba4Yc;y
zdx_Bs)G*0%)v=5(FvJ=<?|))f`?}HCrhlqjY#^v#{l>qk!I^3M-g{QD!s?Nfr97ta
zs&DDlM#JLYw%7Q7VG?mgF8C)mo)v1QyG4Z6Se<9nd@o83sPZ!@UtrRlEiVlwdEVme
zBChJy@bpUBN7@+|Q)k!WA!MSJiSY5tC{xlzt{%T+mr1)qqq^3wd%j~jE8LUSn13Ya
zU48J{_cqMHm@Y5={88wBU&10skH4`@Gj|@$F2s;fErYphtd(yqZ-Um(iR+is+1K}L
zEBVE(HSb*a$J$MXqHPIHUW!@%M;7ucFA&$TG#C(GjPsPkCcP#_<DAe<ue?ZK_Rg{v
zm8Ek(&fOW>*wlTAC1?_I2Jb~6^MBJHajD&PCd$|Zv|FYk$f?LA@D$&TB(mjuEhf=P
zhoz0qolOAc*L7P{7~^vU1}6fi77vD<N$JRL9Cbafp5*lqSj6>bF*Ptx!S*suM(g6{
z0#aN`t(rSTPKBE%auZA}XA$}%bf}L{i7CW=EQzS7p_kMTw`cmxEO&jFkbnIbOUy`a
zLDkYr#+q89NhMr0bwM@<RvqHP;86n%UCDAE_j&egNL`UlaT3CD*L@t#U}|jgeU%^a
zL4FRA)ezBIOXiji?pXpq6YZBvT2KQloknC_Q?zW!lZu?-$L+3LQ%)}yRk+ja!cq*-
zFi{aY*1RhqY^n(D_*08stba&sYczw3GZl8p7hRxMx=CpDQKZJnPB`;+>?EiaZ(FVT
zvJoQs*av0H#>Ver@a*ek8tsi`sn!XVEiL)69l*BVm@mO=M%e)MjXL5tItB!+*~A=6
zl<M_t$>FKl6ol4Z-S(>PGuxqFNavHw`YT6pWh>Gt6q?GJT9G``XMf%e&)s&^5-Py_
zlq(F1jSVp~)Ig!FqluApN`{nH+Z1qssQF<mnwFL*M#y8Y>eD{N-4Z^m3N?6U*d7<+
zU^i<Ahag&2r{%bq6CKs)aT{ikxs}{<H@@jBs3Yr-Na%w+3U^jUf?6?A>ZZGSv)vZV
zUYS<$u=bI|-FN4S(|@%l-b!%Wx$9G@fHoUC%q-negc+M%xpSOnn|lXOHfz6erm@-1
zl5*!IY3Q01hzl$>O2(*t*buieQYDQAS&w6iwUV5s2Jx*hA1L{DH%+*`+j2lhEUCeM
zOLcijm3sBIm`=q>zb_7x&|XDoT_2<^qI^&;`EgmkRVH+Q8h_&aZS^;0_2X>d-i%y3
zssJ;xx7ly6u%@ITJKcjt87-8cf=WFH=n~{G&L*h$v9fR$w9Y*TI)d#QB|bJDqWPu!
z5%Fsn_X9~bRn^THaR^APa>!s>d5*_`@xlzPaoiUE@Za3wb<E9V-rn=6R)HM^SztU&
zF?xRBQ^gq#4u7S1r0{8}<aKE}t6Bb&NJ->)$Y@D5q9PmsqdO1e8T=+L@G$LCL4-x9
zu7cQg9#hw@s#sC4GJ^{mY>3pVM<Sb81UJ8u$&mi4)RI*(ou8*ec+p0hseCmQ(!dN|
z%di(uvk8(tpj$yOfe{HWN0bEk!%_ql4iQVW2q_?R<bQ>Py?W}bz!-4X(UgQpoVPmy
z#@p{v4E3;s#BtICM<8@%XI9M?xwmB436p~n%FFSRThK}Kk4SM8pu9YU-@t4ZMR#~)
ze&71UjZw%UN%hyZ&nFa^pE$Y0so|Rbgg{f(C|J?m5ppq_#r8aNt~`TF9+rZYV++Rq
z7;(J4z<=<dFY`I>tfNWkG8f%R0>4g7@vJL-no384t5P<`T&Qr1Yzm%^9j#HR5K#CZ
z|4olf_1@LWsPr3);G3)zY6{0bqi^<ovcj~yRbp&2ONsIUI|-3R%M9?$^B~1e_EF1-
z7%(^NHFL(tHR^{~hsa;%H;-HHP>L&t{*F9eMSmt8m-s!Gy#kKloo*TwUlmE>QLOJ&
zK1XShSSiRWwK7754sdM-DdCo6G5U2Sa>!|u`arAA`%sOc+^y+s|3E%mH+iEeZ5%ef
zU)<cjc0fFtH93(*`3Zf$)ulFy-ex2~Ngf1H(!5GU16#rbmGXyTH5_9x4;J$|R(R<}
zh<~~!VftKv`-&s4X686sOokSR^)Y=5HPnmW;uJ;Ui_@&1fQh1D7*!7DAPrx8(Iaw$
zD^8ca0K~L3h7cEQQi_c%WYUh&bpw)1h**f}%%(@P>~yZ&#UAL>eZFc)*jXdi@A<Di
z**}EJEGe+JZ}+mIr<LArS|aPnqh$Cm(to1RRyh-oa$2E&4LGfK2ig7dOR>MFxsuf5
zZ3&Y$1U%R)8bKoalefdSAYt_ah71l!Omi4jR21IzTzbeBykc3l0WUaHAtN0!2BzwW
z-W5|)NhPcBP4I&ZenCaRyBJ)gg%u^(ics#_8ygSvE0h#iI^eICX?4N4y^S2nk$;sM
zZ*N<GO@-B7B2``)Nn#?TA^9AnTX1o3#0ZB@));0*%7Fowk<fw_BW;Xw?%)3F|4G3m
zhf6vuOIBOXEK(D{3-=O~XnPwe{Lx2oi2m)r{&&}LxOM=kFJMC#te{dq%()z1t*RYy
zAW=LEFdV<5<tF-!`nVi)K*1z+eSZg*9g<vU+-M~;=!y%?nv|{G4Uq~OjSc3;^BV1@
z4ymcglTpPlj6glKP#xHRmfL?G4{fChn=;9)_a_7jnkkt3TaL>!def-S69Zea-pWbj
zR7O=f=|&Eb-#YcI3KQTwxQ93E%WyM6w&8;CKBB3O1|a%?=ya->fN}TJRDYy%AA9V=
zsld$oT(Qdc5-vVj&UQL7x2Um*a7I-2d@oS3GBNbw>NdjDTZ%_U1=^N7(>bdq?HtiH
zpB{?mW#BZC4I$$5VgQfb6W#AYlDhLhxrbLgIO)iL-BSEMIZ27so803>Kj4MY><YPs
z{2R8__r9uWUiP*6v@-bsKYw;5WKosG4}-(CMdH|{K*)}J*I7R5x9?&C@cO>_5B;qA
zuq-fH;~mLow1;qJ7ZVMsJHvJYd%`R}Ou0!Q;!#3P4$68h#xE<GyFmoH6yZV(@v&ZH
zTk#N?3BDGrJtP0c>09lYxhc+{RwSC*8qOz@4YeMFowwE{Lxl!?oPRVRQdi=C{@z;4
zoc@hC^qDSZ#e<Mte*fM`J#`OkBA4z~_fZra_1UiQiceL7)v=%g(vzFxT4PetVd6Q2
zNPXyEkwRcph>O>XL!#O?-+v!D;<;W-B=8^<Fj7#nDv{nTE=@nkGpqsSO)>paR4=p`
zs8(umC}$DU?R+Zi(0`ha7gh~??m7pl8Ed*%sb5$Xo|R<OYK%~jXCPhz2N(ufItVwQ
zwyJm((3K|Y*Eo6Yr$k#^o04tqrvA>hx;AKnGHIWhTFulFWFFEa%1GHEp?QHkkg`kR
zs`*EJzj9w3ffeU+U><zVos!yCvrW{p;~117gY&X{+ezMLr+;s=jyqZYdwpAA?LCkd
zALf<tSw&m5V+x5;ka^Iu0jOhjt6JU1y0WM*jODwQ^w0`gY8EOSt}Ae8$FiWRWe{<p
zhJ=>w?YH?A@MNXf2M6k0+-nFPszV5vg{9|+3+9*s3=V|rKvQ${#I?ajf}etZwXjzD
zO64I@{t&LBe}7zlQ&j^#L4z@n#<nU?KZBmKR|ZS;Q>mb2LCfmIfDt>$Si)EDKwl_^
z?!RvJED(}#R^A-zVW&Z*0rVwJo;Mc~K?mgRp*}vF#~r+!)Poz`88T4)crj`ClZ9N>
zf^=3@ZRE;Tsal3HVS#Y+FS!Hnv<RTtjOI;LC6)j>(|?U+rqzQdx$a2o%EmZ*kQj+T
zo9m)?fo$Hx5I@+|V3G8mJ0v;XIW5b+XA+asm1kI+s1V;ET4ry2Z>OgFE5H?V`gZ(`
zay(aNoB+(h`h;YH8}0&kXH3}%#SL%#Ls%|sS+~A4>_qe&OF}QYYbS5yPsvL9w5Pw+
zb|~9net$MwnMkg-pGeopu`l@gn4QmdIo{H{Z#eW(v$YG_!&^N*vA#hkj4EmG`Tp@y
z++6%`ZSAujZeQQn#oy<1{pe?ZIX;eCi~p^yec8kP>syOcXCj#JsL|#%ZTRz^J-WW}
z>hG2IbpH+TJ!+pG{ZpI#qURo1-`d%5D!u&b(SOV2<zldNv>3z<;&QFQ&vtw6ne`1a
z_`H}(Ob89XKBOBzm1{K%@x4DmvE|&#wyIAUgG}7oI6U>q30~l++(%}>L=!1kNua&H
z%9U!oA#&8kB8iXZ;t8&K9h>og?5$Q)790LZp!c$5I&91Kbt-_iu@MO%{abgVPgZ?+
z<$u*LJwD7^xE1N);z4G7MT37YUhRp#Imu0wHq}|gMKt!HC7G(&Tw9|lP8fo)vq!26
z6@ve|A__4sE($<bEJq=DLVG>YTTfBph8uLUfk#(NKugtep$NZPLDi-u+=y=M(I5pH
zks`M6070(QkFJG~AAgP?>yeNf#X(-)Jbzrl$O@uq-bXoK8${7rYX(r1?ywO%X-9F7
zL)H}15;%D3ls=`f84E+3QlL<eH!vIlaCAm{=_$uZyX{nPLFuAnQRuhbv%|%#Dp6IV
z9Co8waVq{0;*v(RJ!xF8qQ`&416S{<umI{6MW_)>CihWK0IxU6tI8{}r*<U?#($jb
znaAc#&Wz7afeIzN!yU_e(LUI!eB?jy3?Rz|oOu1vc0X}~q8mD5&_kL4akj{2;8V^e
zh93mQo+hiaIvFKovk^!au;L^DY0`@EQrAYjM_ZvCd7ob<3V9|7Jg~b3Uc%#~d8XfC
zNw=@t8bCoOzB;rMRv%?Dif}%_qkoXk+|<lh>uGn1aeV*}-E>xf1W8)@zP022JtVss
zuzIlKN9CE5A%22VyO`#%`o{snGm#g2mv#dWS-E3P?<`bi7oL2hTDb88E%Ke+3uFS_
zKF9yP1^AFR=P+Z0vwlfqWcoH`*yygPH%O#pQE!~yhRo_yw}##^*P<UUx_>ymjjXd1
zJ!-@;2eEreu*{p<fvYlD>dXB0xjz*?u^pi^$9Np-&{j-b1D09>|ILqyV7G?ZOh8qo
zRW1~h3P^@hS9s=^ivk-*p#s0LAlkHSmRT$Z<n(olIbYpwY(wriXZVvPbis54h&s5I
zB|@Wx_akE~4qak`1qFGFBY&bzb4$fdiPunxX3w*@31yJ<TaQWw-90qyeIw!>$r+NE
z7gJRxu$#su%#*Wn?W_F<@LiiuWog{t6qZeV%JY0N$C7KgTXdL_*?`bQjj>*Ou5Kqi
zoCcOwL$~eAy5=LUajt=|uq2whm*hG-zS8X4Z&;p$4zfvbf}NA*Hh-fvv*X{>llO?%
zm#a5v=_}hBj=)-Ov61#t|F+05JihYlp=#g-s!=Wh?Rj~bX^F88;9XC>&A}=sb4Hfb
z%@H$K(@Ee9Z!U<m5njW7$r7*~P*f{60eeV557Cs$OXJ=Xw-QKnDu3GlP!1$tObEN+
z@(gni>sJCOGK(`X%6~awMR+XP-FJ31pSn`qIoZ6Y<3geWGPa6IVcVE7d@Z{`j$S1n
zhb29uV@oxq`V#0y@`v+d;@zF%2b`p2`Ivw|$={bd{cvX9fupA{BqWLWG&Hn5lu0%A
zhKYdsjEA-8W)dYb@mefALQ(ukBSrB|aOqwJ4^QKnc<*;&Ie!SbAMo(Q_qoBosv4vn
z{y6h@X|cNC=SE3CVTTXc1k;xi;os{zgE8a@t<DaL1H@RswR+*8D;u3^oMoAf5nsKc
z?4zzKE+t7m8M(u;B}(x`$V{tboI~?-f{$fLZ|u`Jf|m4-<hp7ezB9s|j-Bg}Nm!il
zH(92z)Ym{(XMblN?z@BBz_y^k`ubUE9p@DG)fO>7E((U3s{jj|&0PzFMU-YUt@6dF
zOz}|C4;sro$bbi$1aIqt#YW+#en|dQC#m?|f~tG+YB5n;xp(1a$en{d1p9=2gH$6u
z3{`A8i^`iyWd4SkP<!#_!m!M8_A;*;dhX@K>$<1~lz*jv>aoNkJL5!+w6%afsvO1J
zgsWbKc$~j6P`ojLE5nu~40*-yC00@g69XNrq7VRiFp&!;g5f~IZ!B{hucBMYZcrVU
zDQue8WV@d-Fl5A|7*K;KPTYbv-iwgQJ0O%$NZN+Wtv}2x!~?9ztRIBB`RC`Jq!UAO
zWX!6M4}XvLA3i<kJ$ZF-^!4+DqodxN{o_YpKYsC5KRL-K?}}MDVL=eHWi5^W(?9m2
z-+K02ouj2p`eIQMHh4ywbS!6NS=Zzc#<5_+p)-Lloq!Zu>gB3T!x*1T;>;e*OJU5J
zWr+y!U@?4~lj{K)j;XJJi82^tjj|I}ze~g`z<&x`;&7C~in`Xfh92YL;woooP6)8{
z0h{vW&C@7@b=iPs!&t0B!>*!_tz{i+pj@>W)J~jHP{r6Xo#fqG?txAePqdI!JZzSR
z7LACvzBM_^koW4C`~fyvAox;s6|Eb+XE!8&h=;D8+Go%ssApP`Pq=}GE{N#~|4}tc
z(SJVFxog4LL!bU!b7zSo>|F&VOiLfKrM$D)$n*86nqaO1urHYWNJLW9jw^Gz(YT3j
z#T)xcOFefrJ10ccz1|_UuK`V^n|xK4k_hM_!)0kPWk{TIlF`&{zIQyvX)qza0GxP8
zI(LJmxV~{0N`wE-k~3CthvgO+*AyDur+*U;@@(cumTJNPSuwS2MF}mTuG}6&-S8xQ
z=5lj<m*h-pWioYeucWV$5n9f+rhB3R8R~`N6JlKakQ@dy&T?USv94XXT>`Lm8KW1O
zNVF4nWFg}ShQ94pF9T1ILxOK*D%N<sC+lZa@;<jvh@4PE3dw-u8pGUo>~@^kynmT9
zESXro^sST<MCKETm$11&SePJOR8?_-L^vx`NKk_)UX}3u6dzH(y3g-hvnot0uY4D~
zF(}PrWElqp6eYpomjtXS1-l699j|KMAdzNTK>3T0oQ{;>WM?Q$Eq!B7E{qojMkPop
zHN=`QwXMY@&cXKs097Yl0jJX_!heu1*J?2u-kg<>**Dc5w2SK>b=}_a-?5`#7T+FC
z_^$%yu?ZruO$|JR>&7FpkK(0qx4FlHTa<%cpR?w6mGo2*AF-IA?84*q35qaR{2UgB
zSXiY+Wmq;z-raV`WmiWP*fq(J05k&e5?2<rwpLH;R`ULRV;FFuS$Ee?@_!A2wp`n$
zpYwICHs{~9TP3fL4xfL;006LF+8=n&wF|_xH?;O5R2q-fZ7$2-Vz0Vpev`fG+PTqQ
z-Pu{|Z2gG6y7IA`?bW46uivY6;k;4Tqjj%xE>@Ir-MywlX;tY~cY_5;$-(nihmXEK
zc-%up)cqu0H?Bc9GB)M4FMq{B;8)PyjST^pbM0SEhRNw-B6%s09xeaWp1SJW$<G_V
zb6?@*!D#Qs(jdzI-}s$;fUddwNn9n1sB*2UvEQ8V->;wXe)5Z3{@T3F>CIo@m&Wg}
zTN|~P1o`!Ww`|>DL&punD!X5s<F3-LnS|KtBwJhUa5a`dk==nNuYWH?#;bnmP$FoR
zamNo{CwyU4dVCyJ9eWQh;#X@If@jcnACme4I;|dD;{vn#B7>1$RUEroqkP5ka~6$@
z4-y17GmRK7LmT*Xz_<oVssKlVNg#!RJe8OboQ$p}PNlaP*Bj|gVY;uH%!;!T(CfJo
zgmU4t^wwwn;GpK=8-JAhE4SHOrUYI$t{S$oqMW|X+lqG~@`kXTM|N%6GnNYJjf(j3
z0KBy3Yd-IL*i*wE=+t7F)wrBvYN&HtFsgn8^dq#_NO!eCqRPxf`v4^^F>|FeqtWQT
z$#p~)X{^Q2<1k}R>P>AU$<#n-fd+3ChZmyds>#!mo#>s@34e{_^vsFMg<BJX9h-yJ
zGnfYgK`bO$(+mKJB55T6a8dk-zO*Wws+q6tlk&5qFHSInU6R@;teGWKfnUIsK97;2
zFQ$nnM(ofH-LM!%b;DE<DkmrCdb7LKE`T#l(K@B(uQ8QA#y!^!n0cyHHB@SZvzjR3
zU#k($%NfFP#D5u`&aYx^@|!%L)@`lk*1+UV)(l2HQsg}}aK_|O7RF;ux~`@0FuB>g
zdSb*<HtEw`I+_|#R03Bqw!Gtc&guu_y0&_{C?B0Gsi>~V?mf#RiWFgVr802Aa7S^G
zD+D<MKI%Jd`z)x^(D*cgoDui3=_wA*gd%W2hZl6sHGg7R=t-PXA@P%tVJ>kMdL=@#
ztoL8XdFtl*2<T?XitPTrhfk}gvU?vzIZ^rT`gvfam(~w>JR#Oetvp3!dZZo!w_oH$
zaJQs(D#Ype+$5bOA6IekP@Qw}aP;-233JRQez5bs8b8M=Fa^tnCK>pYu*pavq-{kY
z5$LfcOn<0bl6YxPPz?D#c_x|vF-+RJ4ApxWzW0J!Kon&+8uu;A2vDpqcl++bm%Ej}
zpZSQ<9d~xCzW?!ps9bd1^T*FF!f)sJ4MK^(+&&M#Fn4f-$ijPOb|4k-r80085<*B(
z=)T9IS<U=K4$dT<mQ}&&bmLP)G4dHDfN>eW6MyG_H1vdpxSE!J)NAs_i?!;KVO`6u
zYj^#okJ$*M2*h&UaxI)5U)|LtdY{F=GPlu^QKVdFWiE;D^{tDKEHP-@2MyC7opx*3
zRc<nU0*e38qEe)G?3EzEWM$S-8X!8HJ`yk;!bwb|WESgL9EZY+-X=Rd#^Y>SDSU(n
zMt|2Fgv@p<(JiAi64^Y=#Bqm?mL~eZA=wOpOXWo6suE+YgFq|_VLZtwBbZ!)NQ&G2
zJQPCZr^Yp$4&lD_LZGZdx%YfA$rH)E^5s>XI=!W&B3^2xj<37WsQViq5A}&~?(gIt
zO3pO>?L|%EorDM~BTQfR<U;RkR=Pu@7Jpb;@(^1bEv};Vh0+B}%UJIhob>uOHjd%@
z>gDTXT9yFGU`1wnk-I^;lDKk*IQMfrlY(x;*_?B!R#O@upOH1s;FfhCHgE%ZaTmwq
zjk3GELLzBdeHpI)wYgas&$H>GmTdJZpU<xRh$9evmE2>d$%EwN-Y6euS5`^(N`FbI
zeK~_Vx7n=)YGBnBts-H28$315TBo2Jj8NH)YBG79Vsv@grjl7aZ@y%#uYJ<Hy})a6
zU-@uVwWdxCn*|bdg49N*jyeJQQ$8y-w<ZRFJFbl_2S!I%Dsv)1xVkb-grPdIqYY{}
zBwC;wXVyp(%)&SnyrYA_PHq|P;D0f%BK?DvSTfgll3S7Va|_~WiQ?Q5j`MN~Ss_Nl
z$)l%-RuYko-XZWh+PTvkj*EDsRg0;>@@L7I?cfv0il&9|LY9V)*G%IO%4{UG138M3
z-sD7Zo6x8JQWrk$@kPC;!%Y}kDe4PV?jDju`)KIcKBvV;?do6+f^R8(p?_xx1SZBO
z8Ym|#g&GJLy=V|g26H$Ck^CR|6iwT%bgREUl=;W9;lYjU4=uZ1U;WFR*QoqgJ`Df+
z#Lcq@h-g#`u!nLhd-Z{u;?O8sRoh(X3Sz>|6*b=Pip&<k(o5XLB`5Nd?~~g9K9P8T
z6V(RQN2x8Ruxr#gIGDM~&VOf1Zz+dW_?E_7D3M+szC3t(`24`F8`meE_GWyAaxP!o
ztTF0J-O9_~)R)fdPL8@iUHJ5sSuQI@+UI%0(klH1fz&9?9tVoUURX2okib`0_1P7<
zp?Ic3`5-mwIQOg+#qBph7NAQ__Q8%HXG!5#jG3;ayiF_(%+TK;oqy^`7_Q$)Y2YSr
z-v#j(5yx_U9I00MM5DiUFcWuI2S&clqL&C+!gbh9`YUF&?_FU@Kbk`z7!xOY|Eq)N
z$49ub(|`1I|Mg?}mDM?L;2D{%RBfW;i7&;BaJ=2fEQZ2iUm0F0^H5hTXW4PKdSu%)
zwjKtzMkwW;>ydtvNq?kI>(8K3Tk-XEj@;4y^0w_$uZXN;E4|;5y8fNGte(gN1ZFv@
zma!1r@#(Lo{wkhK7gOL25eB3q0S>DWoR>AYnHq2h&E_->9)^2VhTMq`nTG|plyYN<
ze~cXm%{KCUyisaN4t8Id8#O1#OiIm*v-r#F<44fri!w?JK7So&w7s$c{D*g)-76l=
zzNuYR?fvYxzI*Aqx<1PV5keWoIL|YwkT@~j``5u7kt{KcpLiQTPw(vZnY`wHbb5Yr
zPe$#*-aSsmgZs5{W&)lS9eA@qqwJorAfC9SHFLUr7SSVnC05Z6-A97UOUBdbaRd=G
zR{`~00soP>iGOxgYv!!C_wV5-(oX7cS#(HAsu1!O3qPgajS_Iq{pwT5KB9;Lr%X6=
z&5PQiGiDkPtH5S-iBb#f3?R5dk_(0yWR2qJiv1DLky=hUYOm3bJcPi-D9+>w{N15D
zM1K$0-zP_K+PeR~&>rrXi}JlQ$YoW(PhKu&Al11J0)IXxcaLZm-rGdKS0@cUB4VDS
zCKpd0vZ6h&^H{85u@KQ_?`eWgyjP#>`^cRX`?KVIIE(y#RJT}QV`>=?#@#vy#h#(B
z-gBnXgO%v@NonBZ_w>>Oz1surHW7O}bui;j9XmbxOm%F$kE%*#KxHghv2O$V1paz)
z4>xc@)_*|(;9KPldr@_DC)7iCtfaYPHOL(;_w8s6aVIL+?MQuXM+##*^>S9RdwjV*
zw+9_Wwc76$zyUTKtBTh!GDlDM6Y+bURR8+^;$PpN|LgnF_crTGB|r9xP@#2jaI-3`
z)dg5BG38*twZl$`T=O!*$q5Sf*)8Q}c(133#D5uFw;5mf*Y}rs{uckeaH_yL{;;Fs
zuGIYZ=Re)Y;6l~P=KPbXzWfV>P{^W_N62&FZg(eApOBxa=412GK3snKF#7c@N^OZ#
zS!+J2)!!Ru#hi#m`aPye>4pVKW_bYmax1XEk#Z)h**+6F%9D|Olr!bW+)$bt+7}8Z
zV}GCI^Y=xrGGKC_jDfJB`sJi2I(1K=%<dz6^{?;69{<<(aEJcudzf7j1p+eX8R+G>
zNMfs{3Q(P{6Uqt-mFIcx_>@!@E?GWZJapX}!EP8wA-lVY`~>rmb|et4OHP9qQP+~@
z-KDVA6jR|ZAqa24h7$9j{s!wRLd^GE!+$+Z`;WR@d#PP!cB1Y{RI;SSgy(72xV^>1
zKJ{__K~V19EaC_iFz54PG|GuYqN_YP`pZ*y-VTS0iv<cN!m?D@#d~hSJxK1Q@u|_}
zf;u6}3m2tj|Gt;QJhiCm$Y3a?v5Kcn%rk(uzfT@XCb836>sXI>SKN(n@k}}Dd4Jq7
z3|{;wg3*|)t8VfvpJ&V|<Z4;@t%1Hx1&;eL9vryz-cz!6BBs{PGCOOh$rR}>+>6j!
z{Ao%=NFhdw@>rSmewPsjk4`|A%~IOz`pvYI55E4(Y6-&cC1B}(;XnTse~bya(bwOt
zj9+wuC{$QqzqKgkhg*$8+j|ljXMg;zE*mAw6Bg445(vVqt%~qPTWQs?CK5sG>)VmW
z<{OJ*f@_0;%i7eMXkesWt>}#Qv=*L&>gdiIdCYgplQQ`k@J{&JCkN-d(6q>Uduh~-
zWIr!e%ISSO<~(0@Hm&hI*WMYshMmyyK4I?!Ruz&>`EIcCceR7I(Gyw<D}QolBw8Jc
z@htBQIWMhZ;*)0-{nVfps{oE~i0#G$rQx|z9WDFy<n4s8Ur}5I4=nV$!k|U@5$dh3
zvvM$U1#Z(?E`b&ag_1I{LmoLX>V(dmbp)ZhabrUmuL21PHqulndrUhE4{I^xUX${(
z6Y23Eti0;rB)nOfhD5pGh<}ZWQa+Bey7LbK{&w`#ZWe2Nn9{woQ~)gK!{eso-Hj8k
zrO`D8Fi!K!WZPMWvg)((HcDkO7T6ZLFg}2105Pt-u!<b&UhH)3kw$ijupUjX#T;r&
z%Izk>AQmbIce+|Hu6Wco)&?T;OPyL9q(6E1kGV*k#UV8%LGH_z|9@a;v>uJ=m}}Gh
zKWF84w200P5%w(J^J0>x0;{vVJtGaa^#Y)^2=Vq$(5Bl8<@XVBauduz&`fXb?(W9%
zV~)iW-Mk-O-@46ZiKoh*oR+h6R*uIUp42II?<$%~GD*ce1(X^eQC=^7om9t34fq8N
z@R543*(!Brv()KTCVwb+OORK6+J<|}_BPVw@-$nxp|nnIZ|^B~tT0=X#Xi(JOVJ02
zUb3MTjR2a#bd&@iR7Ll)zEV-GrN4~vB0W(!cr7&wepJvxShcQ<ux-iMuteX1frBF_
zh7&pAwzWHXE#;+l&1{7}BF@y4?QOGBx3|}uuC)Je03ae=_J6hw@{&msF}x`q)F+-S
zK8+s6=RRi*s%U?E0Ym2u-ez|WDM;-YsM7RgGNa1y$qB<Vh1TV3{dfcty#UML$X*-w
z+3k`k_2{<%bvDdQHgwgo#yyGrZ0bah>o<LYgce!wh|fGNo`;pu1AT=QD+~Yw&d9|8
z88+^_(`@ceBY!Cb^|go@J*9pHP-+`Gg75~^cMzqoC5@5*b1>JndkzVOWlK0|#D;Ko
zS&9=_v4eON&;kl)F=Z#V1hDNOozuZpYA3!w3*<~EF4DPTH%N+R>HG0GJ97(T7K6JF
z%Gu1=x@mf$qh@IVuX-#?^Tf6Bed~NapH_Q2JC~Q2-G8%u?yhy+dv+8<Uz-oNjpRbN
zDBUg7a>}&NpYRnZ)P@t$mnaGry5+&ZH$8_Bgb{=7ZTBL8X&d*GFmQ<?0CSD`5W>Z&
zU6(glwuwGQOP<I@h^f{{!D@4&@KwcJ7MEXC3N2vIT)N>sFPX@#cvpmVpEqH*#a-sR
zZndNx1b@#0Q=&8<RnxXUn&?dtIjz5n;Shj_^9%JlB1ap;suPB@%74E>rdIK&UZ{2J
zht-*&g`kLHZ6WmM!-3Fw1Di|q;WB(-)aWn}gpp{-3<5Zs5CzVcTa%W5lh_wkJ7nnk
zw<*MzRMroTya$0Cr$MvI;v$<S^gv-rG<DB)XMb$_S16k6RK<Tx0kt}56z@8LQ+<f+
z!tUd<KGHWMl*7$}eE(?RiX!54^;rvTo{V_30i7U3y-r6fJ)_C*BmqNI8l3+s$j-pY
z9P%(!;;>ouiujdQOipK+4+ArE77h&a|A6|YJ{_76NJ0#drpn8x9__^`#aUb+!4s9I
zBYy&OgDajI9S@Hh%HnA|Hl{$rp1OOiA00iX6wVE41d6K&%?s^_$ikMUG}XER1I&KW
zAk?dv4}Y@cu<fr~6U`gj$wlD~9F#XwRWx+(K3)u0mRPm)o@-QteqRDaXr;QQ8p`2>
zA)=^L7K}uB)(N=6H=`oj&Xi#uQHY$C$$#l$7TGidrvrZw4-RU<X;UXpPDCZ8BI@<h
z-$YSwT`ud-?RW_}J?NcT_h=a!7KaAmnkeVKuA6(2xooScX0gNpgGE1fDwt%$NYOUx
za)@mZ^Lxxel%Oa2sNB;xBZ!(-P}c*)3h8bXJHx;*+^)JJ{HYLRDr$NV-4docD}S@G
zlm$3NA_p@>p1SRu>fbP<sP@6XReGd1CM=1b1LjZ3>?D3x%O4$`_%IZfs7~w%^^g~B
zEi(|x6O$jEn&7bWjk?(@_-&>5IIV+PZfqRUg}s-=8kVtic1QWU9Sq;j(Cv+$x??II
zUakVdq-%BwD)Sjqhc&<Lq=p{SK!51L$Sf|D8CA-o1UV^!)YJ?}-p+}yVr0#fF?&df
zy+F-k$gHOA7z!t<TAXT0W!xlba#~pYlLHctcD8(0<}pOSsr@&09aRtxlH(I%L25+C
z-lSl|*z4;QRo#efRD%zw<8h~o>;MhO1b}^6#q^&~fWwo~5orvx9nB1MBY#q7aHX`-
z1?I^nrD%wCrZ$w!*}?#&fjdpyn>FlGA(rYQyc6$NCTX<Xlopdr`EDYJb$4O^<sooi
zvg`<yomIyu#lZSI9T)Q$<s9kolB~FK63>69c4B@HmSG9o=kxInU|azU9`QVmamR^%
zG`<bVg!S@%HnN&4U2^jTn}4jf3Y}&B)^m@Pi#fdxZj{EOn4OnyjqK9Nb0#4&J5Rc3
z6XZVhWGT_$;|O;pF1mu3w8>X0#i@M-(9*$>9O!!F?@}|NLLP9p+tnPF`q1_FVko%)
z+~O=F`)Yh}rR;#-dmG7&HI7_S^tjpm78?R#?rLgEn+AxviLO{aVSlcU=va$#k*sXg
zyCiHkImNvnf7IH2@5U+$<{C#*KtQ@6L66Fnn3~-q=Lc5Qm?#seyIM}5yY!{oQza9<
zkFTbA#E7U=@tV}D>6sR2M*)pVSs`GPnbtK&hld_^khw@E+f(Z{lQ{SlW5QUo#LPE(
z;c`L9VwF*+?wbp`F@H4uHw(vZr7?l^c*z?Zw|q=ovsaJ>-3d86K@^geDuk(ZnYQ}-
z$H)7Rz80cq%e4VZZ(l)s3^<-z5F~qz5j<La9>aT-D)?I}W^232s=FiqgiPtdk0P(4
zz$JCOP-`*MA|7vEKtcxGBeD?T>z2d7;O#5GlOhX-_0{j(qJJ!fVvqAXooNLL6MvCo
z+ugVgC%$Cfo#xzTNQQ4ki^X+L7ExOS^{a!UV@hDj{VeBmrv*9f-E@8Tlc(;O3FR-a
z$vbjJSFSr?V3vXu!WO#i*cLoz*-&P~9LFf?s02G-;9Z*7H#Y>>SPb5!<%SVr>*ve}
z@#H@>;oaT1(|>i-IgY$Y?jPrifqIZy`q8?aU<zHLBp&*Jt}C~kt1BlUF7}c>M&;4C
zaI#(T45#D8*%?=y9%L{w=yF&97Z$z-)>3O@N?`?Et~f114uLE~9(8VDwXAle#g)1r
z3{C2;w=^b5*MSJy;hqY~y9-1c=v28p&nz4-N{fnd(|@s0)ZOtXQq08oWC=3s(c?$q
zGgK3wI@`g+Fu}c&B`1v>Gs#Z5i4b=?)hCl#5}78B1@Z@sh$j1|kU_@B;(F(u;qlq4
zG&JOQf$4X8Dr8q~r?c8n(s?{mO2sl4YRO9|?UwiqCuEQG+pU=8yYg4xxy$M{6TZKN
zWCR!z`F{y-6Ys&D9zwGmRbp9!G&=Gcd?L5DS;ZwJ2~xh??44*oQ!eKXpbhtmQF1?7
z>M$1IZd{BYDw{iz_atXkwE7MD-|ssUlOs-_0!2p;8@zJu6sO7TWV0A;exE!@^o8GV
zII+6X9FB|Z$Clmd8$<i;wrNa;^(fyWk|0#0*?;y|l^NiXxku+!>r-$fQ{604B6>iz
ze#yL78u4!JmJ?_7)pB^;`YV`NCY1rBUN-NmIE*g^(0-hX<7^t^*j6mPMDKCfgK5i>
z?=FCiY5Q-KyG`1Wgq};7{KIkSglqLSzf?70Zb2ny7|oop#&`u?tb9v@U0<p!@#<in
zlz+kv@AoAXF6cM0v0N@_3ltGL^>e8WCY2ofI=Dg|V4c8>Go$_!7E{3lR*{QsN8CcB
z5Beq77uG1BiNGlTtQ<JGcz3<cz>*{u>K+r~URI@?>uwuCSL`qvGcz7ZIBCU$Hq2{U
zZdizjHMRSc!7LLie8#!qt}0k=+xz2|#ec~gY(qP9%8BSRQgj+JwbiV<TI(Ry->FK#
z5z^kPuM-${*=Zi~4W)Dks~+A3NrH?eec-)g_<&p4j~llNmr=M)(e<5Fa)YHsPr5n*
ziz=Nlhq^gbfgD0}o7>T75dF5(N^-ZfvMCax6rz@(7omMl01k_P)Va$A7^T!|CV#UC
z@S~VfL+42x@-+q5F#5eyAW|uXiU7=4O=S*TI+YqODm)e*&tl?6Ba!-{+G1hsy0KDh
zAuyfcNdLhYzqZcOB@pp?#_&c0gZr1Rkxm2r!-HlrMJYvv&^w>>#=((9PB%q&b)0H+
zgxz}MantW@c-@Bl3CV5qaE{zfbbr)=u0f+t;`AD|?<#dwwAhi3y`q^9Hln-W*FMfZ
zxC1Mx=MJ|+g9G4=RK?lkuCJ%f4TMOlqS4aEzW2>4D?;o%SEsmQt6&4sgLM^Pd*OhY
zjf6P|2CGwTin%j0r?Zk)zh#e%gHKHMX{)cOe1PFYQXKKTlYqqMS8NM7-+z6&qOhnM
zsjG2f*TR`)V=BUeS#p>7mdnof`}C0C+yh@u8WIMFqmRG!_n#ggyy{2d$>?{{TgEbK
z2?=-I(nUU7^ngY#VD6!<<QSOI;ys)v`;Q+dk6t`|{p>kLsNa^o2pnhWmW<<F*=;hz
zEt9;=yp<|9O0I?+wS(U8e1Dcqm*pH=ds_d9wuq)Tb#5O>B^2r!s!v>@%n(98YZ%4d
z$i*}$N047iMGb|6{`#R?xfdnvG=o-Wv>0fPcY(JdU3>lNX(twW;hQ3LOa;%W1zhD`
zVZrg0a;Gu6!CC1~R_I__joRv;!tvG@B5%0*J!4zRnd(rVFcU6Ta(`j-H|%EZ9FKO*
z98tZ<gU+BrkRk@T3jkOXenWRGp}ne}nqS6x9FHu3^3KWSj+GM8ocQ4USvKt^@>Ky*
zu7^+Q@5M;1O}tZME&Bj+XuU~jWA_Vph^_Kx;Qp;-|0tQB-Q6&>&TT>EoSt<9_~V<e
z4_+N4L7&~*J3f5o?0?$*XD^*1KPfL;?f6of96op3>D&FM$sd!)``;<9rTGVJ<_sz-
zxEGjR;?}2)j#Fk40`Fzhq93~++Iu%(ce@TC(eMx-$$C)3i?ju))iV)cUJLlVE@L2n
z(0&g`d&XaOKWW8CeNLk|64R-j{OM20uEz$1M$VM-lkZ_DeShzMzz%7R>7;YV+Wq9#
z-Q+I+{=*;GOM5a8K!qHzR^Pl6kk}EIUYF;ATk-T)*ckqaM%aDeBcA2I{7a9%m;1MN
zcl&@D{GGGRTL0wU(JkM$d6r*N0v#X(+Un~@$K1_wWc@fv^!uN2yXaWINF&nIflwpZ
zM@pA*FZ$W?Z-3)$-LVr+ZV}wSe?Qr6JCi%l-r@#YF7QR+5RyBE-J#W*wUhe~l3CZ8
zst<G;fN%J_UpCk*pRBhkT~2;hGZi^wyB#xuwTa{xw*%IqExH~lbYqBQ#nFIxp-N0(
zt7Bhrkxi}Ba8Grmu(UY6au?fOLN{*x>tw6F@w*tCl7GwcKI*8>yRe1bFf?1k5VV^Z
zk(I4HX#zj5`21*)Y#=ZIim&lh&f686uqSMiAu$LCY#Nc2#~%4>h1o|9<_ASy^n@yS
zL7c5rZ9aB3+t-RPc-?}>t(zR-{Nmx=@i%N$byr}B^{N+;VNi~zKxI~}#CGz?b?~j9
zC59}-AAeQNuf~?GzuIFUOmFyy>TCY!Y6w~hMfF@a``*1-a}IqHCh(KGkS#7KWHC(s
zA6$wXl1MV1chyzZ)lfwjSVO2fMnqGe2qUwx;Vcjp(t8_lH+{%4wZXfzz57v9EkrDP
zi`n@8=1oN9W}6L}6YG2aOUy-ydB`ie7Jh7P?tj3=SZ#Kskh{A7^CpGt=3a8ElWdBJ
zb^o~i*)RGj)_xa6kdsj>a+JwSR`|!-@_i&_(gP&4rCWQ`w)Q4P+omj*%{^=57inWf
z1h3`W+PrQ{gaslSVzU#T``5{)h%x-q9W5@V6(m&MYuC*u80S`79+aW>Vs5>+FY0&j
z$$zM9+gLXQPO|YFXvae#f2<U7;p-X#?$?U2=5T#TfQ9?LzV_?ISM%jwc-6>B&q^n#
zvkH#X*Oe6MR<1Q#q%`r#tGiUP?hY@w+A6oO&TCcRA;fI?z8X}%yQZLB0~jztM?Q-{
zV>^(az{Zw39=8?{>14@fC#qwr*B_|?aDVidr$H~L?^hrs<5F-lRm8)Ih-OCM1(LgW
zg-1(tc6?^eM7V3;Ctvs$)zXC0kO$i}fWuIa<z#i=xFKY8-}Y;__SqEUF!*o{{c3Jo
zo1Z5vOjRWn5SWaBi-<&rK*+9zqhSa`ZyA&geC-%<`Y^Mi%IP?Mh*JYLkYd~N6n~lJ
zKM0bu0;!?lmdHkAtY4bZbF2HuPe1SON^_>`U*uH<Nk`LD8KnsAECbQ^i}0?}L|ViC
z^8^Dxq3<N&Jk>lcfJS5K2%v7?QW+FBpxS|Fet+o^e4k?0QGnpPN>q~A0WA^4j%MS#
zUo%1F^x(EKI<j^(>p~KV`$u<P@PFT}>dyU5uKP_1|0uLLFKs2i^odp!<&K#z1L)yy
zA|6ZVOcu0fOf{#ZY1~AKV;DG!|0%1k%E>$f`&LV0=1LPhD%){bA#%A`+6A_%d;htG
z^_F~_xui-e^bI?Q(}ldC;&77|E6v<OS=JBqJ`4naN+BKOKnScAOb<}^b$@WDr4bjQ
z_Eg@iA<9%&NX=;*`Mq&A+{KA1B?;*Hg&Tcs_;i-%NWGX!=qFaJx*;QuY)I8VnhtlN
ztz1XsbR>*TC?8-D)6?B$2;ws!;}%PhzuVgv^|rRRi76m%AWMi)@zsCy>R|u)AbGa`
z=+%pU5*N(JRdfK7O2ElBCV$^`15GYkwr*CCXRit5$$k@4K!m6-+7^fcl|xbK{vHF?
zgL1^JX`OuW%4v5mpYA{M{iQx2RNk%1Nw<t8aQ*!wapm>vkWcUl34bw=0BR3wz6T<C
zhtH3W_n$uP@ARL(*nf;GM+e9FkM`pD;Mq%S9+<Pne28R2$$Ita7k>(fz&z#;q9GWW
ztDi^-+6vx&sED-?pX3I~s6pz<Yy8ux6zSKve{{928BGR{dZXf93)K@Hx4y<>ddBu>
zMeiRuee2Qw(LwU&>x1XXz^QG!$ua))Hy%7a0{+R4`|;rUV`osWd(+fOM1%%VZ8*=y
zXxwc|C$?L+c6Xi5<9~Y+-_%KNx36ilqBQGaZ?~%1(1~j{%ZYM5uj^CHb?ng(hMU{T
z)5B+n$H_!BrNhZ;tU6rW{KKYaFLcrdWjMmuxxF3l;VaatNX`_2QkduDmgp(`nvj&a
ztsMmWivTNU;1!mbGlWbQ`MM{eRGIU5t8$IYqK@cpJAPM@?tf*FE78@+DiG~w<u9gp
zb8f_>JV_xIg~Zey$|F0)CkiSdJ>62^55@)0Gg8~y(k66ZiaY>yziIAPCW@wZU}NKX
zsg@wUv@v<%gxU0`#hD;6)VEC3ab%aBq2_3o+peHLmK%cc63>7tsJ~h<E5v+)<Sp2b
zZuknM5AO>tFn_BRY-2JEFV?wa8&V|=x*JlnrTX6{Nq~ii6zP4p?)!<lkwN*O%e=3J
zK>}mqq0;^I5}no3duQdlf~Q&-{v~n72hKG=QQYtT$L>m-Mz@FGcr!q;0wS0^$=pfV
zY`XAfpX^}7kirfYGEXF&iwim4kt9*+3cl-BhXusDW`CDF3sMp}3@Ph3I|*iihlvws
zZ!=P4ySbGu6K@n78H!XNO>rMCLe|%mc*I&bHpB3CqL_4`vDMlXJ_+TdWN6FdKoSaG
zY2$nfy-ax>G?lwZ&~>GBzH#7Y<4Yt^To!6o;Mn6c1z0_ZYNlu}vN)j8A>Da~(l~{|
z4NC`^+JDiyah9F{$`N`El{!epmYh`Fu;+UvU58?UCG9uUOodIym@E8imL8CH$V9v$
zTuDj@HqL)U{7o}&c(;e$5uggypE*o1mTip5BN(KTqCw%^+WNQu`ro(O0>P&lr&SIL
znI}drFl55|DuAKW2sMZ(M=ZBk2^%B@9{>(=!+-6yGkmzA?C1*^h`gwB3Idr*^y|Eo
z7-<j<&@C&0QB_ILDii}xVjvNpY&O@>gk@dq2J%eR4Mfl=2@K1e>+8RmxTmqcm?9JO
z7Qd*aAK`Oo-P_oD>3NlFHm@<a#CjsMe;if(!n0zYBKD%yD^yEt=(vluIE@Yq$?Gwb
z)_=Z{=beP%Yak@A0y3-JDxAh**6Z5Er%M@XJrXPi#j1s2V-9bh?S2X-(Hp4-V`zy=
z6q7Pa2wWp%a>zX{Dn{+mP1Exw7t3;=<OD+30%@bNPIx6yg$lg|h_EBquR|zh6H~}F
z$fVj&RNx&6$WrZ)gAGRp(S_je_X3LfK7V1Y!-hIXhb?7H6&lzNZoKAlM@=uH(-P%V
z11R3gArw?lL_nE|;C29F;MpY-eB=w|yNI<TCb!O`_AmM<S^;`Eqtt$Sl~RgmpEw<i
z4Rw=4O$Z({m=}yGC?IqvRGwW0h9XI{Co6F-!nzWiTm?s!{CII?{Ez>Z{Qv&1=YNU>
zD7edHBo&ScXOgin-j<O&&$2;2jtQ_lC6;I~s7>DFA?04ZDL|jP7oF@mlFC;rE-*l}
zbE1Za;o=IOf=U|*L_Q;#Ai(<#cr<=YvFiH+9sE+mag`>&)Yl95u#em~VYdoEaPx&y
zy&F;p>n{aL@IRd#*GwQ4ij6fCUVmvn^yCM5?M<4%%Oduv;~8{CRwJrD60M%PT{Xw8
z%&cPVSP+c%l}LQFV^UxOC?9K@Yqf0cY4%`*x-R34?m0bli@|BiM~_%U4TIVe^&nCW
z1bwNSJkl~$C)i`LTSwE=7b?1W{1WCGf1ykjOf=R_6x9Y9<x)eV*Rl?y|9=uPL8W!k
zeD<&k>xWBwS>8(zWdIRJdz8%yyU*x!-)ZUu#BP0keEhO)wf6X6227v@dt2O}4STRR
z1YgHg8SFtro15hgJ&vcE_`d9XRG(MKv;xoaY<OP0Q}}SgN7fH1Nz1EZv_xOr?T@Wi
z@J|nMHa2&hS_^K*h}a*C+<zr_-`l%A|6>mi)T_(K<s`2knmoC~*{91CPfDWN#f3Yz
z+#$!$4bHFzf%`w|6>BuN;tfsDQmm12@wu7Z-Zs`WcZ5Ynm>&yQp&3r1eKx=b>#5GJ
z7swHZx=S9Msk6gp?wobX(iQVasNFRwU0NuGJgGeogKhY>Q2}wDr+@y2lsBa4=V*|o
z9v?N0I)@5?!%(OeSEtDr8SYI-s#pZh$o(p%pq9k8O^Bs!E;^rm=Zj?dl+}2}$x#6U
zpo&3GtzxwkU^|c!x$kC6-m@+6)p>+bwwh)#RCB2VO=%LF$m|q2b1F2V==0;<djd7g
zWNS`CqE@7*;itTy{C~y_ww6HOi^#Vqc9`c9y2}dJ6Q7_fAbAB4)0R`YrQo&QT^De?
zN%W9x!SGh|La!LDW}XhIVD)yG2{sysOfYN4&C~_ZE;{1yVg{I4_@i-Gt5_vNEd0K=
z2Td5{wlTSB;2;fCw!Q3(l@4~2ql4p45_?^p$%nwQxVIRmnST&UMG|Q>v$ek+fwWvY
z%|gi%E$?*_#Rf6w>~wu!l#`GY+^I1}V!5=qZkkI$r7~ppWEfx!1)dD=Vfv_u^eP6c
z7zI43LKJpHaELF$)Opv3iEoXWC5CuL{JVkJIfVRR4#`|=ez+F|fx^<)<m8p=msF}>
z=4NeZ)k?M^JAXd<5J4$o#bXiUS@nCD7rh9mPSZan8ApP3VR&0b=pe3s%?eFlw~m0E
zMt6(_O{&h-{9t%*d?g$oR(<Z8q9aCUSz>jXjA=>H_40TrMO46@rA4F>A;aJ&c$0$f
z8CR_7@~Bw;J)Jf!SZD2iosx$?51o;BdYZJbE82Zo3x5DyK%>9?=B7#R*^T}7UCF;C
zi9oCh(JMx)d0DIUJ%qm#z9W86bw^^7{pbVejUdJY<IN1d_7QB<LWr+~qRLZltr0&0
zxw><Y)A}Gek?H<EIq@*t4Yr&*r;RNhUvzNuSNRuMB0d0ifZKg<c&p>YgnRKx4Zi#P
z_=QN>w+C<jPS<~IvJwDX@xKZGP4sX3K+Kc9lOSP6KBsy90t5pu5y4?b&Aw>FbA6X?
z_`gq*0E(XE)eyPy=Lo!7Egek##$0IB&`VMam`A664S4*nk7IDbs;$w=YQB1PCix<C
zzwJyoS0TMX&1@;yqOz^&Ax=@y^V9XwZAFspVPI)+dpUn)k{Fa!N#ee7q9?f=*xO|J
z+TPZbeM5Sb#|6SX5G(tdSna1}!AgfBtwLTLdn=dXRZcuW#m3y5ST~`wRr&ggK|a6C
zbHxJ<kqi(O#WF1ZOnu>F*VeIn%O4oZJa~27@ACU2?0fxm#<cO_&c4fMv6y#F_w`n0
zQYqO?Fjjwb9O$#pPZ_-AFt+twiny;YDkf;3%LK23baaNqLPm^10fe@z+Hu#2*HgkT
zDy=4D?hs!gYuZu_orY#_rb}IrO(lX~oQnS&eLiz1&ZOIJj7uo$k#5Ig0{tdDr?{^S
zm(zzCaAwD#5bmPs+rW0_PKOr<8e!Bdl)>TXcB+5>Oe?3_jIUB#9qGu){0Xgb8`&iZ
zbZ?~ydVn+dVn9qJjoMxL$}w}}z&oG?-@^7si{0zhGRe`R9JygbeyLvuq92fXie7H%
zSx0U#=Ssv@91Kejq!oce6FVy#lryi6p-(LV*lH`<OG%${U0-V{_LdHCbBNp^FBKOF
zuAqOhMyRl3T1+G!_cVAG&^^?4N4V$l<EIUi2rDrtcv-xmF0-l*Z;ygkulK2`#As)P
zMG_KW+?Ty_>-MhqHo#D5!rm8EL<azkMJWWgw^w0(Y;QBTC-O%!EbW}>dsLBDUqnNs
z+I4Jm*RR3P(r+t>*IA)uR+R*il?P)9$w+?~W@dw8PVWdaaitKmX*9XdjlZ=Mp(4}5
z^V^;-8n>hS?ucOx=k_*mTVgu<>_<2RL|v~Nd>#dJh)~ER?3dE2JoN{3NfAGNSFwP$
z-7y4L!-_+w>(-d><&Fs@;g6S4ld88%^GZiS%ZW>&B4=0-V6Ubl8UWdal1p1WbIE^I
z!T!FU6k_XcW8cS}We-;vxB*GD6C1mp0t)Ipb@@>!7Cre0Af6Ztl$={aR>o9>Fp{il
zv!31cAKAETUO$dayT2?=8nS5CSE$zNUE>3?#j}xDZO*QtuG#=@aC7L~XomOHO^^3>
z;wpi1^H(iWRii2Tg)gc*F<3d@v_*d#Z;lm|_wi|8|Dpcc+HY{U@j@yWnwXA-Dk)2g
z*YJau78X;|x@TQDt?iK0x0wP(eGVuSzs4(K)oVT1I?V-tp;ivJ#s{MMP4tXa%gzfY
z3e5WvO60s}Bd`j2=}{P*92}h_AP@sM9?$^yBnwr24c_P2+>~BT_PVyX;){RDX}JUo
zkbx|#s%Y}d>~~ZTmj%clKs}*4R|(56+6`WcRRY=UZU>Q_>VS&O$@3bz;`Vj}j!(1%
zXiy9U;L}{=5?IlYX@^-Eyei5f)0ZYAy>YenNzHRHQD6#1JMj(}zcA@%uQct4X|%HI
zAW>2bvX4`Enscvw%KNt^RbhWS7%tL-ZgP0KY!*a7B5-BQFDaWQp&*!QsHoLMtCa7R
zI$O!jm6`MX0(5||tUDX5?ep99t<3JSAs@g$g3P~2hexJa8a_#9MV!1%NUR|fcp=f*
zc~Yn|v=29Zr<R`~Yx6I!_n#g<`3~RHlWNFTJ9+W#!K<Y8a{txw;qiari|5J1?-J3l
zU%YzkesTW{#iYsOgQG`nR6h2_Kh^*0)r;3J-A#RqE<q!RlxAl@QB4j;RHP=my*(1g
zhu?^V#dBZ7yp;wPt)DOVf?GQ7Ez{ofpu4w?tqU%m^mekg2YaTt3cDw>64u)cfO}x!
zoO#vMaV9S{y6G8kQ0;$lfMvj=F|tHGAU+7EGeYo$UN05YvX~=3jDdc8+{RGoak&Vj
zep~D;#dFIAuERLp`!G`ahT=9X&n8r2-8g2Ic*SE;jGJS549AJowe;6}xPj*y9s#lT
z6~Nwhs`*(jh}rc*KRn^4!at$!^<OPcB1&=ya<muNu8hqpS#y6v_*X2s${WXn|DS6<
zrgIIk56S|Rn@bnHJH7U`ccW9q+>)_~v1WlcLF;QSI$FJLC*#bGLFZwgi`)r?@5+Vx
zNoB3me*-L9HTUk;R<bAuiuFT{o}eGOXjG3BXM_d@80AzKUB{f#=gWGe`-PI_i^uUV
zl}SaQzZm30Mqz(XPZbY5Y6JBLD_g+v>6T};fGGoN^1Dg@`Rk`o`%czKY8>{9G*whR
z9Zfd&@WqR#2m8<Y_k6a<1F8+FCF7k89R;K8RHPR-P~?SKIMy@`7NniXVqv~THr^RH
zC7%$8JVfX{gZTmwxGHRKJKeNPEZgY^SLpCIy`k<krn!IHYs{vXtS@y%S`H6niniD_
zPOv>zNlnTLQ4#d<uG9#T=Z<MNUg6VpuU5aY<&^%n&aGJQUKT#t)AvMya&I=ny$@^L
z_JK`{h)3UXLA*VkOF$k;8=_9|XlLDxHh?IkidNqNILQf{sJ*ZeA||}OvE#9=v#^VR
z^RTgTpgMmnan`GP|6|Qbh|C2ZKxbpLbSR*2)rupb6>WtopLgQ*>=yf}v(ECq;+;k_
z>;%PK{gW{l`N@yx-5OST2CKKxAw+xy1Lm&$ZXNfZs6LZjRd;Y;Nos;%j@fOk;2Kc#
zkI^M+OI)lnEBd|20SO=Mwof(=nY~N*P{!~~v^{?!1sSE=KW7V&?4Vn2wo+97#8XD2
z)?n_bMT4qjLV7c>ocGlYA4CTl%|v;pH;7^&mMz|usaydUuB}bFOEk+I>#g!jd6P-3
z0i;b5-S$5A42@4j>&wj!xO&-yJD^rIWySIEeJ+nl%K$u4jx82mI{^85_)I&amQSxG
zv73K->)$Q9+VINwP>m#RjT6u)GlM9Q)R01WO(#l3=*_G8$T^X@)BKJOA4FcApFidn
zQ72-wICZaZl9&ah7Qd`zxJ4G)QzfoZTbo1URY*DVB@+)jj;sO811qUbeknyOv!ihG
zYCa%kx6aLkBsj52M@j|eL4^ZjIXe}!Xy1Q5Z~)E=rP~2Ifuy_%HK`k>(Wpi=f9>%0
z#onoZKWH|}$(hF&?Ki%;I1S4tDsz>Oi90W*HIgJJAx|fGt|WHA1k!SLnaxHihj9)7
z<-LF_>`RVCWgeC@0{t`3nuP~$#6ds8S1yl-M5bw2VQ4_=Q(kJWz=fn~$|=J<6&!yg
zxuOixfnzq%F+D+7h$7P)c>=90b=`ZHkH2qy68LzSR1*CNW(K2H5F==C<;lmeJWSC@
zgL);japt$M%c(~9{JwHKkp^K#u(ToJ3Dl$ST{^aDxmqs6=^~ZCpa&@tlm3Tf+K221
zO;Wju@o+kv+wC7CAj@vZmMOcIFQb1~Y3BOUnNgQEf_onSb-&2_dKmMX9U$FE%8mV_
z7f+Huzc_r}6u`;IHR{akvKu+7+<`v=Iu2-N;|?Sb@IyEgRcb$C@(2#Oin{5WhEr;9
z+5Pl~NGhyxMWv0?H#)EBc8`U&6qQ%`ECMW)ipExEJ`PRckb^Z}P7#f$m6m@6Wwkgx
zEq+u=Q+bW4^L4ptneQ5(FRE2og(QrKgO6rg`ixTnpR4OEa_ZNjzCOIBALqZmQms?J
z(tVfFfYlKNooIMy1$H&Ir<mADOQY#O(R3aRcr`4ilKo-(ks4Yno*D5pDcy66wd(D@
zx->{Q2Zgt4erOVim(A4_aP)tHWEaAXYRtm9Y-tkFWq8{zNT0euGRl<?(JA-v+-FdA
z%=sv3Q+E0?Di9WiPeJUP-syHrzgAr*j?L}uS9#?O2ax_{lYAU%0F<f*r;yCO)+N{*
zYau?x7<7tG#&CuuSS{_RD9g&)b0>w=lq!jdMF4hWe|qo#ygWM_N8f*_L$y^!qha8Z
zjFGf_TWud<y_}WvJc8bcxO;sHa#n?*cda*xOvLx#R^IjStBTDF-MW@%rV&<I-T)|I
zWWZZ|QYpik0a>`sOPh2gW6kaK?YW<wjXWOJ^H-|H?3Aih(Nu=4(xNse^>qD?X4exU
zzZjwp6i@NrsI#fa-4uW2^?q~=%!<*9xnU;CZuvIw>~W66xo+&owsXXZQ`C}eBaYFC
zu#a*rm#oAq?*y{id`Zs$M3mV<anfSQRgAZvC>RJp)+=n1%+MhX?GdQa!R+hT(?~Uk
zb^kbNeS7fg2%h8n50X!Bw;_taIYm{~5-s)h)+#YtP03?U!;*gk=8W-40+mX7pj(@9
zRy0>X0_PhWM}b&}7${TDiy?p*^A!C5C)Fy#(0`ER6y={2jNHhhpc3mc@cl@+23_;;
zfjF57hY*<K1&vZDKBsgHGOUzM$Q<DmYkY%RFJb^S27J;Mdl{4rYUnf?S0&p{K3PO^
zoY12zYxnh3(>{NEubbma3){;W{nBmpY@6gvo(<|Fwvu<LE3j_Frw%tF83z~!lfKDe
z0>u<7!F^{Z$PCTPsC!$NGTD)~Yo0*uubd;w2v&a;)fVfM<a9FrjRcxXsXWod59L5a
zvc%?4R;BfJ_&O{63MbL__VRF>pxmoj)s0VY_3!bI2g!ebN$y1_<Ac6}XVhcRK49dV
zabtWE$<CF@`t6R-=PRdIR=bDZ2&t<Z6HuerAvzSq`5^3^l95UFm-5w*i|L?rCL1f;
zmcLvNZsMBj+DW5@;Kmf)v`^^y=X!ij>d1agtEelZ404k25-P(cB@vagQ8Du2Q>P?p
zI!Be~f7*ZKwv5;d{Mb@@R+8c&h~BWjb%9TmH^7NPfapoeBHSYGKnF+*-P;rn@S}0R
z_nTqzS$1iL#(zofe46~<|KDh?Z|~mzJl*|cy8CHggs#L41(<|%K<c!~JWRHep_f?2
zPDny3hg$k6xJz^vl`Xgd=MYT5C9hM|%Z9AF^QnIlLOd_$k|OSTf@sbhYPIsnsmy0*
zLf-*#V*&7K5h8XP6%dY`$QdVuvX<RHV`NMNbO9D=P;xw!l@yl53vA0ZGQi-lVtq0A
zh3RYVg6BG|-C?a%^$c?<PPQy=$@T^?B-H%3g==hNU@^2F2<9|NbpcD#6XXebgt+|G
z41#}?NWPdZbVD05@dOvEir|QuUctAPx0akKQR=@@RTYy+W(r+W4O3eDQpzAi)*U&A
zfzA<9+Eu?p-(T5*Qq>NdY9ZKMo*?LLz7-vud+;m$yBy|n4AY+R0YE~uEz7s1QyM$2
zu#)nZerJku%>gpy+MTVwM!2!E;$7c2^J#x&;jf%4=v<^wt13@ILCusDh0ot11027T
zCRs6y56MojNjhGc74wVY&sSU;i|bZpJCG7n;W4~z3rpK6VHJ;nm#aFf7=yL3;MdpA
zsGdC0BVQsV|Hm~3ng2vh6(n(PZ$H#2af4+LYIW-{^JFOQ2$#s)X*8O5^`fua;emhh
z0lrsb7fo7{qml+W9_or~j@hVQ$8X<Rj-{Jq@0`Ao>F$ILp3D2Hwx-nCCwgcAjVnpV
z)kczY-Eeh`bY)S66o@F5-AS+$SbTt#`M#f|1_seFx}I`YAN<t(@OtBp-dE+`=Jf-J
z<avZA5#ke@Icb%XNR=m8qmyQaze9h=Qt1IH4D`V@A5Rl8^`Ntzo|0Q#5adGk+)UEG
zpJoV+DcM6@{KXn3V=@~GY=5L`-DJkVOzVV%6JcUGBl}4;)h1WCu@!m^R_j^`5Qxwf
zvj0^59BPfVSdi_zJ{hlB<|#=i&9Mo=2PY_}YD8f8U(QOP_gBWuX>w>(@O6LWkq&j4
z>RamAT_U=qgkSNIgYSczbe1zROLBPWbLbOcsona0Ro`6s1S#oK+5(Am5|yICwqK>t
zMt%<7)0TK&t4|9S4$pI^rpjNJdHz=Zx^QEB?*4SzFmPcO%1K*I^C1pXQh~!kIy?s`
zd?Z~Ju&bDRo=4y5k-9#ID0F}H`Dy;++y(^LQnYHj?l=%+oqjC9)q6R}qo&17woRRe
zRsnUxr9@X=sL}t>Vx_3|qN64&R7?;prLplvcZqg>=r-oYdevilJ#9!N`RaEGwpvrj
z>w}`g8@fU)Km?N8>Eji=M&_J)^z=}*U6mAJ2*N_5r32rwq}qpL7dwCIp5Q7xNYb>a
zdw-tZ+3jnAxIiq8oZuXnQ;cTa8s^Vw^mDsiV>MD^c4K3oW=5#pjAJ6S6js~66c$^R
zq1vgByj649b1Q<4uH7(dGbj}5g0gcnxo}o3PV?>U7~kXux{F!A+uQPOaD-+9=ARJ1
zn7}Jme(v*F_T&5jOU{2+$HO?vgw!v>i@cR)>V7NprLCh81QVEDs9-xi@``_u4@Sc-
zAy*UqD|`;Y(8ezXCk-tI?@WpDlwz|T{w-OV{?l|0B>A4m!-`WA7=+-ZTvdOQYIS;@
zaj0TF5<BKEHCB;bmad#M`Vu`aKeUx(RrJ()@Aix}z~ftlvhaT@dnZS}VS~iW@;nEX
zmS_<5^${v|iR=O9mRgpLsFTeBq}K+btYY>Im#(>soiMr(j9OX5TGfOR6u+t9fM5+r
zs8pWdO9wvE>A`VPt)3JQavVjr?lP9|Jy%F#Dh3qKp>+#6Db_Ek=HV}DAb?>^70#ej
zL%2)nYx9dnfsTJcFIahm8%dSM*H_#x-Q;W5vKq$5Y&%X9k28m?V9F%My5caV*NP4%
zRbZCKVcvS9d}=qVQmhNnca&pW;y0@X3nHJZOGV5=h{8#=B&45K_2Y&zm2*$mgOfpN
zGJ{7({WzJhPF5B0KV%F$wbg{$$)cKDDZP!zyv(Y39aet?%&_IGm<x0-JJ=D21)`by
z+3`B}fI6bp&876`Kmf<8zb^`Cz|v)@YQiUrGZqRevu#unq!VedI6cLpk<$CZ;}JN$
zHy4a$UGUiHg1ILbw0cP+EI!p%FRK^CzT7&7jb>P9(sL0$X?97caRivgPbgz__C#5*
zl*YRcT5*4!kA6J|C6*QefUO>YHk;I0vR-J&0jD5-WQm<bEy?B)Tznh|9zuulV@v7y
zd1pI0e)0GPBwp?;Cubq=CAKDYANFiKsLG_vQgRXn$2jse+2a!~X1Rduo4BaM$1M-O
z+S$Z{^MLKc5G83!PdiaV4085PK#(k)y}k3x4L^T5o?HFwXXPXtmNr9FrphUhZpB*~
zrdfbNWDKI2j^>7rTi`L+;%qFNj#nZ4H`bOzv>Lbw<ip-*Wjl8fN;?@)Tvl5uE%K2u
z8c2DNqHk3-9c}p(ZBy<%((#O|QpH<InOe>)-?GO3E=SuepeqWVC=zGuGs(1#XzQL>
zVpV^{ec-w#Kc{18nyKE>);!`mIc_-hSol-f3qs2MEFVj|=f$*&HYC$v{l7-FHC<G}
zLJ;c{lfeXAoo6eapKI+ObCp8EbFN6J6_Eo3om&T@CBAe+EedU#zZmB#oGfWAIo=&W
z1AKKpBQG@8M$r85oj?;2?=tKJoHvi42hM+rihiImIW)~1?j6|m)kn>dovi>~TICU-
zXg`A4LBY%0Tzztc?VAS7XYk#DM%Xs%2LN2?t0hEjHbnKBKsBw(Mf7@C*a&taVX3j|
z{UfT~qXfP!zfdJvkO>m!SyX1_K@;j&I7;^*0X|Jjx0ZzH*eh{$*JXbt4o6>+>)?Mp
zk6b9s-AGLbVVbV#1R6s(5j!mAbuQIda$3i@p0sqKF_5)f!g&s>RP<+i0ivCY+!U#7
z>=$+uq*d%1uZ>W{|6~c=WMg9qZ9r>)>I#=~J6~JBEQq`f$bmTNrw%>P00!|G1hmQ&
zhM;QV5cuU%Ln9z8=tUuDeJ7&<(pP_^$KSUMpAK+zAeM5!k~NR;bj-2Zi5MkQ0z_7y
zp!aEUni7yrmR?$(rWaS~(#@&oGCgg8LWfe%RR|3%s`-{I@b8m{`FZvZ`Tol^zJj7q
zD`P(P=vHo)hLSj@o1LVhKDW(;-rd#42s6d(Wb)?VDg)84KUo3pbR-Nn%ng5K&6O$v
zl+%zK%`I*1IBc6q8F#?iO4U8CK1w-VeBXl=1WFi?BoGH8W6a8UKa>>~H4EM|<JKj4
zAhIivgtWDPM3~UAW2^z@$9g1;HLGxW*{R6ZO`kI}O`F)JP~Wzo*wCzknp;7f38KE~
zO6%yD5k<%SkWPXGG{*zJR+E2z11z#&hvjqoW<qATZ*CImR!cjIj&M(kq`}!%CS{gH
zzC~{%g-^Ucs*6a9i9pey^7HxrvxC0EOtRBLWE^w_MeP#Fgu1HNleZHXkeZi97?ub&
z#IQu#AbVXWyVaJlnqar<oPFtZh+*zSxV0@25pDpQCbm*CfgUS~qOE@z;I_c2VJ@#h
zEwa*MiYs!}a{N_=?ud;Gu)Y=WFG0je?`~Z6-XtAUzA+;hlb7vmlU{7A9ny$JZq%G9
zlC2`5L|xOUf0$iliX-6$KaYWPz`&~OBAlXNDAPS^x9Z7PN77RNhYvY;FDpsq6hWH#
z$FlgtaU-i;pBH^Bs)~P(AaLrbgDGbbw9;Hao?VSGYAvm*tHk;Wf+a|tKUB#Z$Y>eU
z9U0Aa%hW&SL#YfF2KHHl9$fsw+7};~w%b#uzEJl0Bxn|d?&#vt6R60|@%JcF_pQ`o
zW8($FV^b#eVV+U{AQP^4MD98+ceu{faB#QEU(R?p3&VhGs8fG=B-lNTGdH-$CDTgW
z&_PcXu6kihkW||S<nmlSD!`+X;*4e@sK*!h%hM+O*=06<TZOv$khN|4+ePLJz3W|5
zTdeU7(24UOrwD~HLJKQSkpW;KXx2kzYJzJoN)K=KrNSWjgIhH}V)tqZ0k}B&K3|iq
z>8+Y~?{0@RYJh)PZ6uk*RxkkCa@5M&s?-`a*c|F4^S-5(sRNmx=L+!Xz>X(CdO2xO
z@>xCoay<R6xE>S%L$KTpG@i$ddT48i=(6}M3f)|32rs%`UifIEz?3uHg)u2x<hmSv
zpQDuC&~*j`^>U9N-?MU9#Xa{1NoXfLE<opxnq9PaH@bhSA<wA8c)dK+(`R}i;Ps(q
z@p7h*aSw>^%OhnEB_~PFa$zl*mgB3lF)H`~841a446!@MM>`L}Jc#q!o!)@R+&?;Q
zcWT5Pt^V(Sb_W_VxIkju{sqBLNu(&M)Ne$t2)uC=3iSfAcBs=+*TkMjrqr*z=k{EW
z2ov|xMDl+b)5WZK&}EhNNoV;Q;2gh~vx`O==a`!qL6@6tVU;<R%A9@AZYEH``fWA?
z0xp42PObHbks;cM!1^Gm;G_C9l4T6O9F3g`|H(YYUXtx7Wdy7pc_+~$HQWZ8>TlU&
zL>|`N+vo(RTXq3c%v3*su*NJE^D9zIPRTVm6oP*Wt*O&oavFNIrM6|G24mi88-@!|
zx7o^*goHt!td`Rsjgkznu{%_&+@O;4$*e%C)`oWl#sU;e=$fZ}b=P(GI61pg-SRgs
z6_7Q+mRE}Qq=CB3)oUfChm*(!69on~Hrzf;-Oh~WA*Ss10*+^>1>1spZYxh#2ocrn
zHYb1GFLFS>RP?mCMj5pm&9YMq(#HP8m_n5yqyX>o*jFz}F;MeNsNuW24*1&<`aRch
zSsVdj7RdOjo<AuiFxV8^+XnSt3&n%94W(eEcqO^H+?JWTmi43w$%vLe*+AqaqPuzt
zxzVl?)7sV(Chk1W&cI!kgb!nuuR3jVxvqZ+>Ow(!styv#TZM<t@+k%B&cje>=9Y!S
zp6GLY$(~Ub($KU53uohN>rz9O>P=}mOK}tHdD3B?zN^wa*X_7b^Xn=G5hZQ?7Z0+s
z;y3d#_SDi7L47~TI)lz|W4+^8Z%iL7i~0If_e2*Ix}N}kt0iuLY}>&<t&fHaY50E&
zp;S`gBd_gnj4G)uzzs|RsXzf*zRVz?G@%XO^z-Z;>VHKN7!<4g48qyCcG$AOL<tjz
zW!wh;y47__KeZFJ(XuyX3W{dhHOEzB5v?YGraS9d$yImypYCv3nKTxG*Q=ar(^p)}
zMxd}(Qy3tHW0_FlQvn|$y0~!~%hP}GPjJJefK0zh9iAsH)Lesl$z&*}6J%a19MMv8
z=4!Iw($~p;jOW|BQP#>%R+MLUBe9t%j7)IoH{GzUxyd45uv@Nom#p)2D+aSUfdB3P
z_-`Vgslb^DfF7k%d`Jzr6Bk%&+O8?~(7m`SG#Cu)hnbwvl2Foc*V4e0su6!tYJoS;
z>7NuWM*OSA%!D^2qw5SR<Lv^NkyE+7`k%tIuo_${er8EvuKuwpW;9{#enJYysf6G=
zZaX7Be{*!hpmRurUiYZ08Og_xJ0OnmNCd<vI@8~nr{xr(%T>Eek{WTkc7z?gnK6(>
z{EMVfkGw{iA(ic|IEz*Y{o{YS^os~YRMV~F>Wll%=!jwBsxQmKa)}NSVRO}&p{6N>
zWG=5_Ftrt0GPQI`<6(&BymarB&Bm|5zE}ol_V08Cn1|Srx^d6w-Kpb$WsTwAi=vwH
zq-|79;hTOuq-(U{6)9bMC%Ec9EQ&(n+V)h=(Cc>XzU0Et*{o?~a)^JwGNz}Ms-Ktb
zL4m_LN$)FTpK?Rry!UR#yzeKQ&oesbgWUIZTzUY&i;1X4)Dm^*5EqTyjP)D4btn{Z
z0~!aYB(33u&Cf3KP}*KkFL?dx5D3wl0TR3K(M>SdRCyh{Q%mC|L7Ra>=6RDr6x)_b
zHOu7&nw71U>Zv@Wu8n^|&TzoO-HAXtl}-MV@|r1;AE{in1*dLQvad$d9e<;d7-^1E
z1S7OW>e12VxSYO3=tDQ>M{AkEG4k8oQ`;;Zs#X(&Bd@4UJrCT?IT-fpaa-mh#EU_V
z7Nhr+`Ip$2pti~t?$x`|g0Mb%cITSdNx9z?rj#S|w|u5D;y!<cNry&@Uci*#`<Y&9
z7z*{hThs&_e1fE?acv(#F-k12EmohZJ^hk(y4K2lP&8{!{~figu%Kf_3n*af9!Z17
zOF7)XMthZG;B=fJU}Vgurr1E4nwClrZ9atP5c1yVeynEny{Z+QU^mjFYq6wnYp2m(
zq6fR2YkKG#i7tN=Fad3$eeI%weW1cl=U1k@NvZ$5emHg4IWq*-CYtK_3za)cdvWi6
zvU@kE65p;k9Za1N<wDM^j+L08bH4V3>qe_%Gg+^DhF0WNO3^5Nsyk12uT#QJ-#p4|
z+Zkd`f)sMVAssNvsSMoGH6AA&r@<952)f2XiUUQ0R7-!I%zvDsdc~vA3O<i?P`fMG
za$F^kj=p6~9dRD|x1UH;K_!#>C?!Ml##mYVYLO)R4!#!}fM0_>e<PW`%>%yN_YXD>
z*YuIhFf~FlTdFg40E;3&b=zK!`~A5P>}_w~j<5wk+x_MtTsWujf7!{;Z-&k_&!zs$
zX4f$N33Gqo=ARBQjk_Dic1PW(b2l|Z;r2~K6Rg(c?;3#2Os!GdWiK*k=w1U^O|;eP
z%8v+M6hr2g*=8ww`a&*f+j{`eqVY|uiw~P$4KPlAO^(GIZAk!AVW|<`%{k~kCrEl6
zdRnfeW>Phlzvv8}KA8Cg$m&xMifvJGS{dZ@$U}e1IL+s0{@sxd|AHE%!il0dL5X$8
ze3yp;KzTAV7EM$M`8s$sh&fF^TJv?15U|W=R^2f3txmwMU#3woAq3sl^w@1NLUhpw
zmz+#Ws<mPN_W%CB)Xr-aqc*)Mck092s@jUWB&ZK!e|REtr>G$<MbPp6BJwG^*^GRu
zG%|m%>OG_nXM{=JwhWje$BajnnL63}1wWL7j#YB=OS^u*SABS32=(fo>Hmyto$wVM
zeczvc=}Y?EiHwvmT+O7Cdbh`mJzhjgLBvTaM<_D{ssN%Xjo6n;QVU1J2rqP~?}|v1
z)aQxLbY0C0;54ja<1nuH$WZ5QLsT%*o+E$G(q#aASwHUh$bU4gQZotNHrFbcP|hbB
zbfxMtLopw#Aa_>m(q`r@oJle-L@zrys4Z0=`a$xA6v*K43UIzP*}`-A243W(_2?jZ
zSGkw9HAniKDF!|}`FfxBYA-g0{|mYF$c-I{Sgyk8ub`!n5k{`wB$c&FD|j@R??rzR
zX@4W62UGPslDc9lP9^w4`@WAs_gG^utGO)sS`mYynTt%V70`YiKGrlpJS3yKf#s&>
z<&dkD^+9>=cPWc!FoFvO<IFYdE)<=xVvNJJYNa;EiqzvP47Q~8X8&b-FUqzJP8+ID
zIizhSbu1pUQ^{lzG|q<d!XLy=;nIJX!G?giiYy9EyVC?vdvbZZ_}pqgdGYQ_{doCI
zF_v}$>Nn1~b$et5mQQ7lt_U&I7a+kXKDf&~;&O6YoGoV3@p2Z2O#`o=<Wh8z%=uyx
zEpV@gCGQirOIpoEiabuYNn0zXqrDbW{fYQJ{FajS_C9%Ot7|V><2t6b<*k1ni)+@}
z`{Y#^=)D_^Gy1hW$nTTqNR0CIS2Ey9s|JWckY1EV8+x#26k=?im&;Fc2n?iA&f~!h
z2wzCT5-0Wh<XCKJc|_pjj5u$_$GX?d;|DBj9IyJbKNvdo)2ZVlgKo53Peeupa0`>M
zK{I4YAk_7GCa$(366JkzNc4YqlmO%PCo3(ZwT?6Q{FB&=9vtY``_HjHgYZ|R94-MK
zLmxP7ki7X)>!KNQ9^^zaD(q9n<cMLOk^xMtj1`0<iW10=p&z-3rCGF|s2YTDa5oL5
z79ozx0wcfzSIqMpb$s=zATGdxW(_afiCTT3)$+4Ej7oPEXFA=$#?*gKzV!-O-S604
zcYuDC&*z%NTvVk{x4NHGeoa1kSIo)@y+Pt{iG%u-yPhqcV)Iw=#eaf-r$Uzu_{fwH
z?plPIkj7cY9`^ytXB3r>^e-<`J}(TW>g;s#LXlaSC^Cj_?%l34XGG;5@<lP|{l_zX
z8r@W9GixaEhUJsZ`vZT-6lA_7($LwrZYkst2n{?Yh*;rp_F)~C<9AY7C9g>}9O(N2
z9Ztu>C+Ap!HY`{t1@pOnu{p>E-D|F6rkPapdj7+eBDPXx^-8~ffcdin4%`SHC3+F6
znxn!=PWG*os`5!W$|LUtYaOsWtVmG9eDxH+i;RTm7!@znqw;?mR9NPcu|r-9aYt)U
zxsF)~icb}e<hL~+ecK(J#k84`XqESj5%D;URFNe&xKbO-J7GJ7kgl%EXs?)&4ROL*
z*8FfWK;9;{)MZ^Vxd}im#GM}@Rx`_^xgc86Tc6DAcDXy4>#$93I5swpm_@diSnbK>
z<z@F$*L>G)X(@j`8M@OMWswN{RX*FWssWL>#zWgtLT0tG@eJ-q|L<B*6SI%Wz_igV
zf`TJmoh@LTl7}n-ehKHxfcRU`SSHy-2>0B_qk6&;;3d$of~+jL2Yi$V$%*AAOCqW<
zPmZ}P$E)hsxTCqa5V)&6_QAw``;a;F5q>O^Zanm92;6@Oz<Bt0N$yjQ+tU~+RnB?E
zS<vdfz9dmA@?2lu;vPGhhxEC6G%TB>fQ6oy{Eyz!z7E^mAj8&1kUy0Auc=_T^(Dj0
zoL(}htCu&_r<|8lV5oJIel2pVDBi41X5`r`D-tXUj(Bz5FsEZn5K2BvZ+*VyJ-^%H
z>cyLS*|dMq-nH5r%Q57~h?z8E$m;o({0t7anDSCdf=@fTLo)aVQW8IL70YSICy2;K
zrO$Ji%SrC!h2->rNFbu_pi+z_*wuK5-U6UYxXgxDA36zWVqpz9RV9@K&nk5<PVI?y
z(t`Xn3JSAbCUt~kTk!&KY^o5LQGK$hA~y_yT*rT%sr9@uYJ@DgDM!Rf3BTw*S+U59
z3p&UNOaqbfc*Q5)6;!Rc)PYt!2RHczoApFx1rQ|9+fffAd_UP_`N$4dE|#oDD|VuZ
zx3o!Alx%KnxKo7idjSGz4=$_r-iEN5$IwD7=Fxl>r_Gu6po?@fEYeLr%wzd}a+=SF
z=emD7q31-f*t|^$aruG0>P`<!t`)witDB{@8GXZMCyXtUpsBY70<RSUPJDzW0(~}^
zq+9aD^@gsTzcCbenw?Eb_-(szhTFVH+LPB<;^orV%DNe-K6(6Udg-M~l|q!ObtRfp
z12SAAX%l)P0ryGGJfNYuqr4C!Q}WVGo|1psH3megN$jBYTMyh(@YO5>(D~j6j+^_N
z?AT_~?RLNKcYW9ZZ(IsVPCc~3T|hx<Mi~_k)M@0(HX=X{pcij~G7<?4w*EKn4`(?U
z|CD$$VbW_%QATSmH<||i++Y9vUHZ=#=|7M7kFb=5jMgB=;v0|u`Rm5L$GczZ?TUXx
z#@oM2-~98pP6<0adXeCIdX;Ch9sJeykH5LSt4|tknSWFK4!y^c{*e~7d5^g^o49SV
zlO-+rU;(I&R9LCOB+2gZ0_CAjYTXDxO;Tz}uqf#30n$wK;J9YV11-3%2I(q235CNx
zeZ{&XlWJ6MPNLuqbl^;top*ma9T$IM3WPcS0Oehn-1$##cn<fU?<e!0WQ4+ZU?g52
zKf=XVvVAq0PUWmnQas%MlUuS~*pPGb63iu7mbqP5?IpXrdv|sd*N{XgX@hEhfOpU+
zm>A6EeW+UG=kQH89GeE+JVv>ixXQI|mMhzRkdw}*czDGZLA%D^&f*hLS8#tQVbWi?
z{WUXxp-?PPm795=KC9UAS-gBIPz(I#i6xf)^LIP{e6izph*h-$L+}3PckX}bvuEk!
z$IBg>-~-<W1WUo&gKwALs->D*auoqoRv|X-y=O%wBml8}NElszZrK=W$W8q2;uMas
za9Phwa(e;nwXzOh!X4@YSHgdGwrU^%<I*i^1s?;4yhnBP_ZNnv4aGwFlo0RqH`<tl
zwPEmtH(VMb2XLS#K^TN>8qps58F@oLiKWLZ?aXNZ7H-QwbIRHUOo!ihv+khl+8mX0
znKEj5a96pha7R&gMgI368J@ayhVGC~9j7P?UsxbLJ@v^nu-!8hrL=!!L3R=gG|t>!
zE5`_K`RJ_s){bU)=u>E`BS_1>`!^Xl$eypY_SB!Ly0}Ja0WF{9(LE858o5vAs?AEN
zrX9h9D_OgmqvURN3gazK_x13wWk^(L1v(nIjx&#ysP$daeIMe`Dhi9HnxCQFRfz6I
z<tdP(s---&4{LBc2)2J)L${!+E&$EljoaPiMM!~Ut*e&;dy#c>TIgBQ5uqsQf+Zxi
z9Udy0#J&}o*OxV;Se-?H^?)%K+EjO3K$W&QQ61%7)_VMedVl4C7NMr(69q^EiD3k%
z8xaIvRY~>j1U0m~ac5~1{2ttkRvC%ThVwW#VZ{b)1-x%T8Ha!9P~E5#5>7)v%+R^p
zScp81yOw;b%hfM(uf*S2{p2_rB=;!ND<dbmshD1gR6dj3TT<Q^EnRW_Ba_SZgfJ3w
zUD+u~^MJ|OC|e7(-G6ziF=+Ep_kSO?B#7}^^jI$icRED4)19Yo*4ll2op`ERG5l!!
zgJ=QJS~Y{8r%iw8Y1DnAVud8eaACn$ij_beVw}xc8R!qaV0-e65EW{T)w8kjy5ai~
zW2k<sMiL|cj}}K46Hmt%eO{GBIWDnTUq#29+0U?I6(9u-Yw_mc{08=zc&)E7#-#oP
zssaGMiaB+N;7+Np`hYm9p&p10DW$V-6m5hjnmQ<|=16~4F_%(0aL0*Y5un1<owDQn
z9eEPV<OHdwRoz*EONbQ-?0%X}u8>yXmMg(y4}BuMTeF?u7ioT=9odLK!#}nHSr)Ht
z_~j+vBQPu}&Xj?q0s=1i`=Xq)jE8d~<jD=+RVy3<e(I{w*S02|yK##>Rsa|$6$N#n
zp$Fq~M?-)AX1=OEX%b3i<B;+4=#ETOHiItCykDHv8N8;T9qu;)HI_UgTgm(P^_TEM
z>>b%^_XWdTJ*0wvJ{pbHp{ap58;MpwepT#o`Eg5dG@0`m%_S6)385`~R99YR$~e-~
ztbJpOSSJao+tww`jo7vtl5zm^p(Z37MVJ1amVSRja|rKnG9Pu7MFe1mm}JdlS7Kxh
zKZZ!HmA*THl6ohg+8^Rzn^!0`@!qwDFGAdFxVqY<_HpjO?gsmi9DIB5{McM;I=kx6
zueg}vSr)98uDkO0MLyrUyRq@R>@q9nv4iXA&J(z|eokCl^e6t}HY0DMm+XK|JgND}
z+IN39ei7f+2M0mS_(bh8*@3s*|J&Tq?{Rx;zy38#Yn91t(Komgjw!uBaY;@W6G;<U
z;V~pH!p|GOi~F?X7(Cwna`Uc70jkB`)XodN-uRt#8pCwocisB~^#is#$<|goT#a{h
z>?OSWQL{lo^Xn!-D%Rk7*uQXJH_UdP=a+xI@5<TR&BSbYv!wr#iTR)PIkB(l_gx7~
z^@`B-qu0-#?Z5i&1HD(W#P|c;i;hLbwR1c3+An3!&&g(Z-CnW@$JJ&B{>9`MJRM8I
z*eM`4e%uI2|J*`s`Bz4x<W#K4g)uUwk&TUqiWOb2p@?ln@AZ{jo2nM@>G+UwAQ691
zaPoTG4OV2F)UHNmt<v2yI^K+Zq(*BL?m!H|_Ta7E%|2CFr*V4YVaZyA30jJO$?5lz
zMc~gC$?#UAie!R_Yvh$TpoP4|`<&q(%ICAITBa|}3#<#8J#j0mqGxfAGohFS?m5|<
zl$V=b341L=AF#GTEMEmBS8!6d71Dp98_c)KiOtj+E$aiUoOPOq8WT;@x}J2V9f!G{
z27E@aJJ~_iuZ(qTGriEv%C;kx0vi4k<#x)F6T3SAJmSUH@ZV9`dbZPMh=wquvK7Pz
z$BLG;jFwkNP65x_rahEbQ{?~PMgH+9SJ6EsNOzs&^-E}to#gSs(}Uv!^6-Bmo2@u4
zj2jk;4iiKwx=f-~X-#)Gp3<FR;GR&u7IZn;CvMT($Bl{O2Knz|?qRXhcAu4iR7OB-
z;?@uO5l&Ct?3o4azAZ&c&185L+5Fv&r6Koax`7->-9aah#^quZEsKchw^-T1KZW^o
zU(kG&r!p!m+1<V91794zQ_6pFGQrff^bszMFk>Zrd@@L4zqr4~;(tM&meYsb+zYVD
z)739~NAO@2A*5%(gix?`0MBzf1>Qdmu4`!mGR_RAnogh!BB9iR21x}TMn<jg3p*wY
zXlS3M+1T(Ht{M}jH^HyBz5Oz3cYAveaSMW4(VJxC7SN13$+`us&~<+UNOjoeeiaD1
zo_}pOd0G1ig6R>@y;RVy@Ew`~1yp+32}}+LU>qHIsOpUt^_ZNNd&vP-vZncGB!rL;
zpzkV+$51n;<}yJ(Rr*Q^;Ve~}c~dBmm_+~&ei7KfM2L2>Biibegpb{w&#1BGj618l
z$Ogq2x#@IL%@m-Kzm9*)3KQpBW8(Fy>2n?NTa_v_U0Qw-M@w6s9Fmfpdtp{ZoBl%G
z<+jz)uk(VbW4^O?20`al#IcS~1ol$ZiJ>8n>&#$(S9Jbb(JNA4>MeKl;WS=B=kp7Y
zMgLZvSs@N@-amUHy{4m(cCRF$L4PNdFj@|EVI4#%)uE89!1;gk6KgRD_{{T}pvBnC
zVy~_ELPO;!NR&PcT@f&-xyQ+S!;JEM5E((TA-Vr)I}vb4IK8*Dakw`qTaNVM{$)1q
z@xDH9)cc$wiu!D(^#W>L&1e$KTdzfb(Oz_uhw$UseFj^SksmCZ(SgL_@Pk&+@*YwE
z&XKF-HiZ)+(m#I-)h4(0lGhw;qR#m!upd-yzRftttA(Lam?);Jp>+E8WF&HGzVyXm
zXq@q%B%0EdBnc5ZlcVpBjt`zCM+e7=e-OrpJ#|-}*??RV3MOR>^%SXmd&dvNno%&+
z&S?9uAC=pCqO|Ed`q4ti^z<c}>O;fzw8Yt^ZjxL>hpT_v(okBd8;|w?_{Q-XRK>r;
z`jpxpMT}-+{JOD}fpj@UPs{SH|JHaa{5m>B_3M^+utJzggAv=?*=R&?uy~dQioDc3
zj&W`i>0~1&GM+b`Hk&l}>*1-vIL}odv$uNU$Hf%UVE5W$UfU$@lkRkrqf7((91XGA
z{^6+xLwtX6N=V`razS<{G~{=@P0q|!A~IqeZ`gHV_y~O((e!@(;!PN{yO!)!RHiBj
zfPm(rjY*06<9s7L0@K0%x8X<J7k?iLQ<hsp2k04kV9MC5_!IrFD-Y3yFc#?<0%vkb
zB4AS#@!?ga*jX6yYB7a-$v(fK_d#QDGAvJoj7ERTa3%W{M4gDuW@>zENjpkY<C+6q
ze=8+%7rBcTFETsa+00OyvgFq8KjY~;?mzxTmVI~qyY`=U>bs7iKUBKX;1lN~Oqh4j
zSu8ssm?7TC+aHMy=*H?%tpo}qw{mu#tUj^OHRz}Ql<U-J<ip{Sg*SSCZsogpjTB<w
z#6N#v$~g<=e9iER$yFLVDx23Sxje>H82lFJSpOpXv4^cuG2UER;$ZW#7eH3Mo&W#Y
z`?vKrvMXH_yf&U9Ou0)03kMxC)0uQ;dNC;~MO!C}RI1!u`hXx2Bw+yv7y*b$XXf{<
zt9`Tks`tL=eu@3{GxVd>ll1)mF~&Ru0u+BG+qG)%u3W1uA`Ua=Vazed@gJ7Y{Ns4K
znnr^|v9gK0hDz{}Z6X)&G<fVny-?Kj+N-@JRwJmqW1ECZiD<JlVd)x?8g;YWV)+){
zo^$`6M9BE$g|Mxl66TeFmvMgMB?R?U0__Esey28fj;-InhX7J{J(?#!;AoDvHHm-E
zpN#%M^r(Txo@Qn;6y1a<x@ScBFm-m^ER|lV^iRx*hNW^RM%jUjeVqnGp28$!s+joU
zMwWh7GM!Hg4Xs!PCph$6o}Uu-LkKoZ>|{KJ*9uqJH`|N}S6lClEE_cJGr~nPB8qZ*
ztwRZ^M>8?tW{U}a{bm!{0~KHjFVKI^&SG6pwBh@F&NW?<S|DeK^#;a*$w*`!60GF^
zH0cvU*>fY|NXVwkixXMZc#U5czyCt#Htvs<me;0b14XaR#wXEpwyy~=plg#O1iq5J
zh8dF6A1p+bCcBB+y*Ay(O+ne7up8DoC2voUh|AJ?6xIXJ_S~r5On6E&>Lz~)lNN(c
zd<*(+=#zzqP$?460X`~AEi<^6k~^mDI3a=h1~vXBS&_N{MFLyfW`0Q2P1ZKy?O1`y
zb(Nd5i93yoa#b;@AKkZQKZ}<AxS52l<GKtDU0<KU^#L@@a<t@iYKxYaQV$T3gJg0i
zdpw4Wz!0!ep>ZJ!6=c$co?CyFm*R;r@{Tp@JO^887UlBBr4#YJPT>lkkJouP<@4yM
z)8VT)=f1{ePj?WYGQ=tqnl`yirUhEm8sQ4m{~A#c^MAu?_)x<VEU@*o$QLtmR8@ab
zVvofKOb}bQVz^ZZHnD)LS4mn5oFitT+_&voZ={6?isAx6iL?Cu7!iMhCbX`9Z!X2?
zMq&3Ow_9%m)-}}az_%6JJdB4+5+wiz69-2dz6duGJQviSY_cWAco%i};?J+W#A?tq
z5IX`x%1YPGbG1aGD4;DD%T7?U<sxjr@)xazc~t?+vd35VG&R>-Oe*BCI!1eR^fZW{
zj+YwNK-Zmf6e?ztj-7uPpsbHN^4JP&hS$~$3-nqa8DTQa78Q1>fK{f=*jc{^+Mtz}
zr@M(n<iA8d7S$o~p@8Q7YrbYfP)0P5Vi(9($5KouJRT+Hu_FU_Z=lJ&1gF~c2JolY
z<s-9Bt4;b-I}RhC0q)T5?TbTIf_y>hm1kM^Nh#k~y7FT`U(tUZ!f#W+IMupV^&rD|
za*nO=l~{gg6!$D)@vZ=67~W+S&1F>^{`!pC6Iy1d8u<1G@|k#|>&@+E{%Ik1zOg>}
zA0Qf@3{4Bb>8?52dR}}Hus5Su=>NVdQ%MK!xOi`oc{YDFZ$&)Ehcj>7L{&x3^r<^g
z7S}^fDb*DmGQNLo7?m*7^%F(M104;)2XvJjO`tx^FccpWX9oKyxNfy6-n0e$g2@8|
z>0;w5$rHQcmtx{NpT+u^4d5w``p8A4pR3IHqg8Rr)pFvsQ#Gn6oZD&^eoGNND+_QQ
zraggJaR>EfF=2TKaGm^pIUZSY8cx2O(rTr;dm;WIvipBva)+^jTWX2pab)H*CO0JC
z@-{QA&$mmAOIA=)L%DTP9YcO|$?6gjEv4h|ibeH?@-<dFX5-eq4M7P!Se<7M=Zo=s
zcT_1srQMW0-!T4|ewh0)klR8pH@u*mI6Ksok;Yktx%Pt-OaDl<VG5-RtRR>~CHW>o
zca8JdG&O(8WcZ-`Tg|p~&v<$$%ha%W+nnXb8A)@<*Jt|1m*Nc>8Rb+;XdNepTicSr
zQ9&uEDz>VbV4+TJitu{$AN}d+26wx8=(!eN2$a$Txt0AhurOxXcwiLqeMyXMIg@TE
zK==lZ8zc=$*io#_NX&AwSgl3(?LQXRtS?vXT9|(-pBbWf4J9NA5g_k%3K3$CLP;)G
zVmMp|iluQt#JSgwH+Bty(Bcmf#4(57Q7)wXc%fJ}jy$xOgGh8o*X{tDhLVj|@>uRZ
zFK6BHbh;Aq^HAOXD+tSG!gfAeVqAZ=nmZ<@>M~m1ufcs8Y@<e)q*Ea!5tOnzF|s-=
z!*qZD$@FqzayquZ$?l#lO2>6wNA3<4-mCHByV-E#dz|I-gjGk{zf?*bN+bd|Rv+QR
z5|J=Wj($CS(-rnAWL)W8k9(_%Jy&C`2jBkp|MCC!5gVEw0@rxv^aOQ2zdCsN^l*PK
zJA8ET{P^(r&#4o-*|ogxSg!s$>E<A3ewBZ&<U1_Y19#%_-gi$Ay85B6eMoBd#V+xt
z`O|`X9Jm(VyyaYlX@XK}#XuVT@O;n|wcw1`Jtz&{Vp47y4?rj@+4?d~PhWiRrsb*4
z&+*}l=iOH?-gF-yV(#4KqvKbH`?!3>Jch|+#kz(>5Paf>$TiMAGbLj*oKZKbgw21L
zwK<{b8%Wxp8R<!4$nD8V!oxxG9z)a7vA}rtfxk82%Zd0_W3Kw{Zn{%L@7j^U<j9L4
zA+AVvN9(ry*r|al)fNTtsF?Z6B}*Sj>qE5RSrqwI+)yg?o`t&hWMgj0o|IRJ>4Z~t
zeBOWvNI5_?ATJ7dMzM)W5WIQgsMUYfuoS@UxZKaKDknHmQUjCZGw3Gk_#SAP(WXA^
zim{b%z(F0WFSJL`a{7hjAP#nUEf;}y1Nbzfsls06&b-JMqX{rNz`g_UnZ!KlT#Z5v
zpgN!H@+|n^RCd-@PJ6Sn<KtKAob~QHU)|a11;=_#p0aquxSjg@oy0aE8lr!c_A1Sd
z5~_BZO(H=fRq{%OEG8sU`ue>v*gSIP+?Lv)U{a>Q3z4L6M);98Gd7PZud34RVJphO
z0dgE+n3{vM@Mr-H6s`c$bKMY@1M!97fUg;-5O33T0$}=mR*ocMAUv}SrFY`hZ#+wz
zPEdyQJt~;mB?eTr<S}SGgzbMxgd!gktR=N$C6RrJaZ+q?9{e}*M5!C504cy`AJnZI
z!plD8gl{^`KIM#$Y}$7WGDHe2gYDc}NzvLde1IjjFBgShGAELaN8ne~SURc7(rX0_
zyiTMFNTeda^yuL6-s`8w!v@L~tBQb>kC!HlETizWcZIFOHVQG6`tpCdR-?eCkU$#I
z=0_w1@6uU(%1&hH5~XBRVOZ;jqBR-=GPS-*ox|2F>p|av?VQHR7i-@Ue|o(6y|E(>
z=)HqYx_ORUvCq7IGm-u_&bkQv>!j3actwML!zt4MX+W00@iu5BB57j4AB4h{tURl|
zTU6tVS?&)siFsC^(|)-?y7L-;_aO?CXl=IK8dM}Y!G`&@m0Ryuu{`SmQ40x@mW^^9
ztHF)Tne;}9w5L5v6{T~2D%8aB9qJ@}Q@c)xOB8QWy~e%T^8;l7R>c|=WMQ$^v*~;R
z*)fW_7+FJ2(rsx+oXvG=G0C>wNwb=oy(ym7v8-{MfpS@fvc((Ph=f*u{m#JOOv@vG
zs0qrb5RqnQHxtL<x#~DgHq&@R2OzbZNyaC{)}<tqG`*B{+r^PHT9+7l#g9CrWd!2h
z8GSr0my1v`Y%`<5tc=<<Y5Z<gA51UwWx|43@N*&@OL#CoHVQ{^{RH+W_;?wz$Qswp
zSeugphOdtfpMRenK7Vw7@NW(5?G14@qGtrYWuRwOlW-9qGq#bLsHJuFB;);~Sq>#x
z*{osjen{|1Kj}%e;oQDt9#{N)wCF#on#W-e{Q2X)t;Nxs$i9*7$N+YBYzPdC<r#KW
z29j1pBJU)Tw_;9S)fvC{I<E1`TW{cGHkB|>Q=wC9f3X&bc3iiAWju5Lz&+{HONzQl
zr8b9AEpU~<ZX|4MCG%X*5E`&3-Ok0&8kKUNJaqfy@$08gH=O?)?qNfg3k5qXC%*Cu
z!vUEqBRxiJpK5^R)yHoPP>JpfiUr<<gAaLX$*U~-q=2^R8Vi<A^B5YBS}!S?$Qsf7
z?YMiwMB7^OfiM$)s8~*P00Ag-tzDHfcZgy)h%5bC-AlKn>|=qlA~rhTROaaY5kX}a
zXQL#FEN@uYSh8HZNv4p_cC@^ix2DKvrc#2z^RQW@9wEGhrPqDxQN+XM#e(VL3ad^q
z^fRKdF%loNH=WYEhGU0ji>C8a&LnamW1yh}rW0FOhi->|&)jx+{^IzF+h3b@#Kzlx
zQ(!e_lJKteCbTvOc8Z&+C?<Sqao7?d$jDbQ+<PzZt@cb5GT}`N7sU+d8B|A>79*sA
zZITZtt}14n+nJ#p`dpq5d1_4pymy$B|KlT3=v>XHzDZ|FBvVo6-1IfRCVmg$u>2x@
ztzI0^-jE-E%t{SVH?=~RCbETi>z5YdyX}6vY5lJxPuR9kWX_<{b{-qNHl7|nh=4eL
zdTMxot`!;FAfA-8O{jz*hpPGAw!Nm;Ne>VTdcqFcwhi`6h^BB*abg~C?0Hxd7(I(9
zW3p*O##Wtwo+v8$?Pmst6!PUZ*^KHEq!$@BYQKhmBo`*Ny*~QpPJTe>XLumP4zyaX
z0iHKae=wsa>lwuwe!Osz2nlIGOQWo2b%#W-w8nh3P#qlt+k(7f+l+-e#z08C-PQ;z
z)3hS$%@a}%&I1%<pIj$$glZ&C7vW6HadpGS9-k*!BkTUcrVWv#vq*Fu4-g+}XYO*J
z=6&IR#<~KoW0K;%maDxM587evF-q&_lj6s*<^-P>*QI+r%78a|4yA?!LrbC*@33Bo
z`<=w{#h*_scA;=_92%ygXH`#-W(kCP&rP5g;lyIw86@e$Exk~o^jV)iztCEs*+)%k
zIn|oISEFO+-n9sBO`QTL($T}6wdmtz0L}A%@P(}I473b8$1Er$L~q8^Kn|4+4V+>S
z-5a>oKLcp)(8L4Xur~yiNVts!-*}V<1BZ*f+caUQt{u#swe6+4$*)f&B)?_~k8Lj;
zT+)5LtHzhji?EwDj^6!-ZHQkr)6BjE(8VF9_0<d^1i+Pzvd)au;{jL}L;~Qx=H+UC
z_5*Om(*$ZI9<P*oQL;g=Ac03t$-0rFnIvZJ|4{G8ZBOVQfe<1cC(=uz_LO$UGbiUQ
z&B)T(wDOn{oiHzk%QU(Z?4pne=T355Sw{$nh>s+mQ^cisQL7G=FdA3$Nq&u789QFQ
zEjxacU^L|-Xv~p2DSq%&46Imt<Y`TROPS%&L5na={J9h=rgT1eXrbB&BBRx#X4@1@
z6TU2!FT-ZL=v7#6bYp6~b;G8zn9I%E>Xk)~`sRvTY^{iju(P~BD%MdV<dcNsZ;ZiM
z14M}5`uoB#qLw`JfsZCwKcLo*!`9&kP70A`bpF<|``AV=9B)^f&bXTnwA1K+piEN?
zfoOQ9R?LRnrAp)Jstw0k{S`gag!b0XEPt@Ab<`hadZygsAX{srewxMUANi<6fu^Q2
zB~Fk#LOTa*2TMJXq~UbAsihkZkf!<j^X4O9eSz1{0m2)NXYVu}Kd~y*=CWx6*R#L*
znJ}sMfBW#aU)}ra{%2o2{Nl@h!DoM4y}$VU!R5pGg*)-rkDeypbJKi#o^$hz-=Z~}
zbMw1zqSOXD8dnJyRTE7hW<9aS%Q*cfrr1`xS@nPsnWr(aQuZ3pF3q^oU4QEsv^D;>
z*8c68;8nhub_siWdacg;<5vfJ&zv%n#GV~JeQ|sgW1;ztkQ<D(2&Tz@86C||p_pR|
zlaw+wF&8b1(Act=0)<%<vTM=*8YSrgm4a1065eUmu^?Uszan2k9Vk}!j2@IwOv%3P
z4LiYT=L<?pS{rITYvFZZ*wsz?8W;R>QP2obp}G@jbS>d%H%`hrv8$|F_;6r9tAYF8
zfMP*hNZJ(L2t3C?1LAsriPV3^G!{)sPioAI$A>k;BwR1iHjOK-KNn>|)iVKV>$97#
z1QEMJZp+O}ivl2KPvE$ME0tyzzno(t0!oXrgi2E0Ef;430`Wyt;u;nt!QT2%idcv;
z)1_hxp8&iZDHK=~ey^z~dN>%OesWioQbn|uDbAjk%NU5m=F*pceWW##u=-w3|DDB0
z;6u}*2q--9WJT!+ntkjOm<i~zPxM7M-CKGT%O=;&xwWe}KOy2!^q-311?ysPCp)tS
zS>HNp^Vl}L6Iqr%=bYUlB2R9)WN{s{hP^B2kl0K8ZWi1Utp|%V_z<uuv&vcvdBF20
z(j|d*Y*4Yp8pnWt>Q|+^2{Lr{hocwIt&Biak3NyJhQlF1uUkL4UT;N80Czj!S4G3w
z%6`taM3ds5ax86i@RrOiov3(0K!N2JSD^7uIT;NW<<;-q^`Cff_j-^Re&J1bqkdg6
zStVf0EmZJ@Ii@-pk-62oziW&^w<$F<c+VtJe_Jcs4rPdcu)E3#)hsMy95UA^8lz@x
z=TmQN)-9BV%x+5$hB9brB}~V9Bbtry!8UZ_vTZ9O(B6f~T7c`50z`tcV0K^kN>q_r
zr=UFJIc%jrIF-~qv30E^7Y&p;GwU&5PDYrpu9+`&QN`b!FJR+TT9rmH3U{m4ZJuS(
zi{sgQ!I=$zwqpCRLYfc*MVFK~659P)HgpXP>-Fu$^m(_6Ueu;T8nhrM(5$RPA$F#w
z(JN@I->4P^d6oI-I`a){lS)vxXhohJspmKjQ&c(;l8a&%bG<QycdPOd@}f^BNmc8p
zY|OKfJQ9yQweN(m<AaO=l=PTY**5p%c$6I-ygJ-}dz!s`bqEOP?2iY3?(i1L`G>t%
z`%m^>ZQs9lubn-AahyGW{q(8apX8FGebY103J#wiXZueM_Wzh|<L9^8y|&y$DH4$U
zAZCW(a^K1QP*5N{K74j?biDWMWu{(=Z2$GER|n6J2jNcoWnHq5eYw>ZST2e7gXxiT
z-3i8jet`RoG=0F<C1%aysG9(djqXSZl}I>qCL89b)~|jw9{qk-K@&ReC+73_hQy8w
zHp$6FH;wU2P4l>$t!D3LPG80YVIo~Kk6=D?7sCXFi!opJ$zb5c$8~#>aJ*riM-RiU
zt<Q@BYN%K516;ZRd`o#;ywelyfQkHWNx%<(w0Gni(xJ0W%&C?$>4im2MT-D|VmpIK
zkE*DY9tVjyz}@VHILEaY%HoHCAA84{ms>Y8<g>=ZV4X8Zr-8+xrKf>7`p#G4z10F9
zA&{1Fs4Im&q%qM<U<Ue7)1(RuwD#}^{+9RHFJnWFSSZ!B01;AVQ6Q+Y?+86HZVJPH
z^ljC(xlYJ6%C%N}Jb@iwWm~yu68xR;Qh^O3W%Cm^RZMUjcwIF4uwa$Q9JZIUM2HAi
zO`iHs$t2Lh|FjGY<tv1VnQ7q(v}?k6|HyF7Nw9Z0ZDuLh=pm#i($UiAsFeFQ)YXa9
zRm~i$<=<yh78*N^wf^8c=Kfone=|XUw{5`p4r+FmAO-|~>uNmG(&gCQmp0`0ZjXas
z)JGhA^9l)|c<>T$V}V;{seWF#gX^#k&*$45S2jWJ?US7yJifCNj7Br}ySFUPF5Agm
z#YtfT)Sz+XS9JuU^t(ZG4rn@#e?(?#bU<=1c6R1vIT5IF9Umh3Bo1MIfvPuuXT`$%
zDJ_A@R%cSIEsbB1kwCZs77Rr$V>FGSTF{08PcdXtIZ1r2OPUJdhtR?Z7?j@dEIMfg
zqtxFYMv_iMbR$XL&LfbK)hWEIj@1(0Y&DNCAmt3)*=aC5B1T5$EQRF`NMiv$%tNSc
zn42hwOrU99M`gEpPo7d=hFU^@)A`aImY62DCc`eL$qf>8=p&3$msmU($xiJwE^m?;
zXVnrcq%dylN{UBQ#@W31Awh|O8j{?`oi`sZ&)tx#U5^inn<U|c_LNB#GtFL2()iTI
z8_I`l4>1)GuW*jx-_fbXgAWZb34d4BWZ))>*B52E9JoO(<?t^C^I{r*GC`X2<D!wp
zz|tZSFnOp>!Ca(P3sChT`jMtKT2;>w(7LnJiUV3WujwMk;0u_np5Ro&XIj*ruU6-X
zKJ$?dc%S|Z4|_oq&(6*ZxA??FlgZ1rxd3YeXj>RvHvAf~Wo|*bnA&gki#^ZqhSu_H
zRUqSrL87;BJ8l%#Kvo%lQCs0u?N<?cYhJC*kRPTe1&>!387_>Z{KKAD>}k6Yd^YRv
zfad)35Tv$Ol@R9e^UoeW7`FYRp8oi_k0Bi@)9^FcOq_V>g_U27ZYuEV8ID@uentFK
zL3h#^Q!yjks>ruv;n?v2<2BLNH#9M2?sr@_zc0&CJ?64iPl4ip=JscIs=@0{M$)qo
z%kC|xtQ)qsdwhC5uodAgzk+hl|KvTa)UK`yF8KA>jn<&GA3@VM;he=rNUj#Uj@7w=
zjI(U8eZz+BwFj*=a;*=pPN4Mx#>D6cStq+N(3>gkrGj;g&x5cM*v}dx1eUybN*Yda
z_g*-kBBBCg1ij>c=JFS7&DCXTkzT?Q*P8^>JPzj~#fOHI@kTjQ5fkAFT7?jmjYp@)
z6edN-c+I&-7HmEbnN+PX`8R(8@YKo__b&?+Z}OwtkYnsgOnj3DP(b!d#sF!V9VJ$z
zD(>RQzMaS*4w)n?d^o<Cp)8Y1QG>vXJ)h7~AcHMTiUp;A-|#vB+(N+IP4gt)iuhQA
zRtpIEEZg{j>>Cs8Vr)<W(6h8+%$h{YCYppmB`w~M&(^@q%mZYmQ^eti+|iA#cwF!e
zN)<Y?MzuXJ9{LI*QSBmaTKmuJ4U($>pAo*47&=5ltA}rfjWM4PICN)+7MZgM#7Uvq
zoL)hnS%vz4${?>^>kTqX;mh~o{pzpw3ET{0Q!-BNQAxOWlr@%Uj*$obcu}t4AiH$j
z%XMC-<nDqPO-^KVLzOBFVVq~?bT1bk=(d3+c!1)noEBbeU6k%?Q!!F03QRy%D5eHw
zB_#yl{3Xb{p_o#Z4Hywx>Rq1-xUFG*LN)+3P7GpyH{^c5*?XEPB)KHf5Tv^p$#>YO
zP=!yeSpNbHPbe#o_-|@C?uA(?F%<4dm~!@`55=rk)N)$fbZ+xm9n@TP7Y-9x(x+};
zUrI`lNyZj|z79+)qq=11ALB1MJTG`0FRrD!tIbdZWmZmB5su2Eaix{Wf-}i#S41$(
z7DzOIT7TTDNI^CyNcuWvDs|CPI?+k|+NxdwV1Y5xVGcT>+L!JXi>RCxS3Y2E6e1%u
z-Q^~{bxvM9suUhy=GKlfKMe2<iI<VXOq0N(MQ@5fynUEWt(&(GvRR-k*R<#gYg{X@
zbm#lm``u@I|JHT1+C4gW{^;NpLTxfPPjLKyV;+v6X<gei*ec3A5H48~po$qoloaq~
z69TooX2px^lxdEx18l8;{~6L0V>K4^-B`Z?)9Fs!<Et{Qu4e^hjD)v=OT~cOEnlP|
zd$8rp1fvs9mDT!U$`UTei%`yxTB0$GUL7l@qoBr3`=Y*$GP070Fm0H3t4%aYh*Ft<
zsqA^odM3sBvc`W9^EN97cxHfSqUHu1C*s}ObuOG5XB6x^#9l@4&`m6I1NW`h38?X4
zgYjPHwD4(rfXZ9Zn6{~YR%yk6iOf0^BI3uW$yy;f#EJSyi5({<DuRGFMDa<AM;zNM
zEIpncOG{YIJs#5sJ74^GropY|TVDHrv}VgiRTw^j#T#DG?P5jiFybc`ZTxooj%gun
zFV{tJ_lS0%(KS|YJ`T4rCST2St<aP=4t*0R-!!3;G!Z?$9v1mAjJ+Xl`tN7&YkmL6
zGx?^dN=)Q43CV4a6-^Sc%&#d21Jt6A&WBnf<BeHR!5w%}+9a-}ktsv<VX;zwZNx&1
z-Euqn6S>&zo#x~87`MvOBJ{eB2j*zn5DoK^o7laH5)AyxcYBtd+?;jRob(p&vrj)a
zl{02zPD{PCQA2@~a8%}##-L)37vfj#{M5<zMLO3*U}HX6r6gtWumQ%*n^GFM$fna*
z7|;gp^Wl?s6Hlp~zc&<Q(bIQ-t)YQ`A~}Sqq<Ja=Ft_0wBuZP2yLcL!louS-Ce>34
zY98omD89c|LqTGFoaF{5{`5rfu~pg88sHjOOO{=GEDf{u<zqb7YmxM#Zlme-`uFe2
z)C}yI5QKb3+w1ayu6?tuif?T0Fpo!!rykeV_O->!Pp+$-HnG;`i9|$yVEanYKsSD)
z&7PgG61IB+|JLrSBBEiW@jVUIomF5qc&3~R&-$yAyOvcH>v64MI#m_$4Xhw{uO%f;
zqjoJ85d7R6t??@Yvu`M*@5eccgI^V=jy&IS?LHgmuQ+lXZo=&3$?@?^C#<fP8gBm8
z0Fynym1K?eaX2k}VPL+0;r_p|!T$Z<4)}ntX`a5HoxCYdkIJ)m#WHE)vwP@Y#Ty%6
z{bPRqE>B;(KX`|W8((?8cYKt-@%dnuFRP6&)VH3z^u=JUR{Pq#9Q~>Gr7s87UmKqn
z<T!Wa{OR~OedVjc^smdt3FxVnj#xUm_*|o?pg=5C2Q>T`BEmU;agLXh>-E4aWAsr3
zk``(WM|q&h!=>nnRRIg6p-p;rf#bt}7NC?1shwA@BeN<I$7vdv67S}FeQ1tlR*VAA
zh3xUJC?Jn0ez}HH>PFM|0?erI_WE9OLQ^q*FLB;Oo`el9Z6CeGNO~3>#8(Wci3uN*
zRe~<>-p_GEwyy?%&*hV={JOH{5YqI{Evki-Nqw|9P|N~pefr7^&RsOMi#YVHOyL#W
z%e_zt^?W=VC7DDK3`}TH<RYKJ8}eHa?5ES?OT^iiFbJLY@q&dD3$dA{(ll})D#~wC
zpvc1iGz<)UKjF;*#@y*qR@u|NbP~e*jpJO1j4Ebv$9V344TP6h11FT6z2oKn{XvKf
zi?2s}ar?W~tpBK(mE4vmFRz!EdfeUiBM%01zSR7IGzc#y#1>@3lgiE_`J(o<a8y+;
z5*`!h<5-Z}ET+F<-1yMPzUdZ_3bhFJ5yBKue~nHw>bLO3a4roQIoBRaiE?ukb+kFU
zz<$b3ceDF{jtTB&53*lE$aB2s6qd&Qk2Lt8lihD4pWNUWd71E%R&78mO77X*N1Wk9
z@+UfUP{%s)qkz+qNCnzzfMR)9TnD_UbVdNho!HAgl}71AiiDC#82@Afr8M#nCrb%z
z4!yRl%`7`DN7uVBSakfQMSeAq7(j~!%zkzYF`0yaN2FkK_KFxsUu(diKK$+P{9~w}
z>JGLKJ@^a%{aI5_@E;h?Zng!<WGghM>}W90mzUPH-~F8<p(M24So0?wy<L{0rl%b(
zRv(^^|Db83NOtRabDej)U*x!k`P1tm<~8}WebS3_Tfb}mTsEyP!jIL$H@SHjl=VJh
z7}t}3GH+O%(?$7?vne-D-bO8!^YPjG8yAi!=7VwbLNB%Shj6BFt2{riie>%!#=$`>
z{rkrzCbGt{RV(tj^>>uIe!qddPToe82*dBH`u+N7M}@Bw`}_4zOp4hB#&OHJaDwx#
zry?SwgdMGlK}1yXmaQr$mJAsGT)#=#(6M5FQD7S$$d~TI=?bNGKDcY`OW~a`#r~me
zt?!xJL~?Dw<2dw!a;L_vCwm3|eV7YCxA;^F>wIX7EDBZ)a!j|J6!|P_=pFV=om~D}
zR_hnvfByU3sN2311Cdb&>fbFF4fLlS8|0I5UNzp=^4`UO4>qiACV4_q!id32?xDSZ
z#Uj7{T3Y)yeiq?911agg9CK;q(UX)O-X<@_<&*~+OE8wbxA8;J58Q)X_l92o^1*e#
zIGg|d%O18(1Jj8{wSE_%hoojFeBHRCe*fVug;@FbfaKHUjrpp&WWL7So#9)zW@%B2
zwDMM$1K8}>dM8;4S=R4+>$g-fubdcv=tN4Uc3N`1fdQDxohVBc5=rExZ7NkgTy5)O
zp;8%-Oju~P3~fjR)M!0jH}smSaP*0tZn7h_5(1HLP=Na9e89adNy3?hf7^EenQ=wi
zGA*6k!`D$&#CVo=v)}v_X6Kh-`*)gid{bIae@B#ac6X;AuNZ8Pqk?fTnp=W@{}Exj
zCH97ER$3gh&=|AGM~}v5%TD$b+41?L<D*nN+3Oj=C|hR}HyPO*S*!!}cH6(#mLbbn
zw22eHuy0#IEOnf0*{X}A_AT%bc~}KRJdKMaV7cRE!rDFU-xIgcx9S`zLYiD-4Ikg%
zAU(Gdskv2?mRqru+%URN9`^x%q|;jsT!iAAMxF}7$qWP`I3frUcyCJ*Djwg|0h4Vc
zF?NxDkmk@^eN5!$n@1Yhek+lY5yKdkHyr-0HMzJ|lZVGMnJ$xq@mst8+{wDP>N$nt
zkLtJ=fYXl0!f#4Oo`wTG`B&fS%M^N}N8M1~wrWyu({3=aHyZjgIY;+@?9^MEfmrlw
zYBQAqt=Xf$-flu6S>KxCQYpGs7Xuo0e<D6NJrT>#4V!yiWNuub`Xs*f+y9x9aew&y
zr5DS#BbL4_m-*zI$N8ixbaFPymrY9@iI+{cQ|Yp4=yl;TdWHmtrsT<*Xjy-7xtdRk
zFmZ1^g*S?pn?Dl^mh}#QN7H#Lx}t9JQ5&_!N@D$?74!yUBGeb`$NSHt?$%e__x<~`
z+Z})qk3XvCHBq?LC<3?YqVI=xLj##}bz2Q`ukSnM-;RpEZ$HS`LW8l`ySDb6w(J`b
zcux3yEbfR>-~|l%8P45~y$~ITaxI)#^4lK+^3!;j{PLtHKW#OCJ1y5iCtoHuSP`jr
zGd`iKeCHn_vS(^LX8Z0Sb(go^?s|E-S#IATT-$$lK1IfkRlE(-{C~t}?|2d4cVbZc
zem-^=f57P_!v6WzW@%r9{gb=+b@%NrTWwid@j2|eujN)WC?q{FBJoG~n}WwMajW>n
zkEMUg{scV8*F5Wg8n7oW7Of<M5TO7yWgY`2hR^d^F){zBIBFCmOcHf9`q^#jWs@U>
zk&B9Xpn(BW;2zIc>uw^}ws-f`#y^PfX<hpbZ(5P^#}fho#hxcPb1cL`d<y*0zdyjg
z>V8tk6C=7tMb5y<@pKGyaEo`ZPi3AFLlCvc;7Tm!GBZMdc|M1Eqo?Y)47jFA(-M7n
zP6*%xI*d+OfeM3n(=yTyXY<u^$R4opEK+yQ>(hXlbp$3uUZ2*+cQB{T?lec7)7yB|
zm^C;7pwK_aqh<|ia(wO>_XEXCI(2{FkKJtkS=LFsLXi+RQI)ymhq=Aj;9ujT>RVIl
zXH&QJt_e_o2vS=RTnYzrG9aOr#OFqu{J)fY&AX(`!nDyLWe?oSLv$<uP~AS*<WjrI
zIQa2>Z*-+KHQnq+yPXs5pFTmU^X#S>T63JmGnKf_Y9IV3IL#VeW;b`f(WSJ}S=Q(W
z*yJeN=q77&l5H4D;voBkk!*C0ZE%d;-YvGlDRz^8ORUKuwqe|{Gwh~e$E4BvfE(-v
zC)fvEV7GUG-OBw{cQbr~>+9y-n>f8bfodAbe1o&A$<@{1=&HH7KEla$vy1D44zAm~
zw?4tS_3^H)8y#D}+_<W-OY0LBb+a?;CRf&tj;xPxW8Kb)bz2wK4GydglV`E4x0=CE
zK}_R+L^h+QvB^f{G|sR`PpggDou%J)yi{@3c)#^u9=rcU9=rc?w*8m0?Z2FD|K)7^
zFK63-Iotlr+4f(~w*PXrZE&{9{8`@FttQb6@Hfrmy5R2LR{_4`<@b&k-<7;;!h5Sh
zY;Q#Zd*k?>O#b$508LMC{AYJE;#aaJ|K)do{J*r{k?KmwL1sDA>~eMbsTs&@V88}K
zdr$E5#OHv!p8;0FJ(@P#W=`*=;C8KMM4NWxK9*V{q1qThzOLhxKNi}#%&k_EW;=K2
z2Xz1J&F7MR{mL+%=p+&M5$fDtC(ytP$!9#JlW}!A9aj|*5iW|QWTU<hRj>Se$3;GW
z<u~vY;2<sp2fkkN&ov;)h4?Idh6E$S#sR$1<XZCj1FF26GM|Z6t=x(dy&83V;9C;6
zCER*$HV6Jb-FaId*$RBo-)0~A5?svL2@zf$3Aj-lNOs=aZIA?D+|=Rp=F+X>BtI=C
zNS=*u2bc{a_WI(95efB};5jPJnC;JhY}Lw^_*|Aaw<TVrOHAY?TQh>?AlVJ1GV&;Q
zi?E93oRk&|DLc@xgo0vl<hJ=-JkF26lotex+@~v8AXmZ|fY4A@n6m4z1uk3<-0&Q|
z_iZP1-5gc^m%H073N6mr?g7g2vGh~CzP)1hen>pUXf#%Z%42RA%BXm@U%z^Piq&l%
zIOmAB+y@JHYQn|YLqV)pt64T2ahP2I`=PqlYMymR!w53(k}O1!cl7JM)@QxAh%D~2
zSLjDlg5$(@!q95hlkLA8*h2$*D8gh=F4V=e;Tv72T(mu^&iY_o$LHlZl(dT1%XLq{
zyam-%z&F!9@7tlRCy!1yjE(Srjd&j9kk(Bb?!A0DaL)|0?V@+l^Ds5t^PI?sc>R6V
z%dB=Ol3iUZ0Ht@_g>Uce?;ji;9e(%pKpL`2A2CU6BZj=v%+i;yzk7PPKWKQjEoF@`
z=qqJ`g5ZK~XbolA1BA$_6qJ9%RIoUQyEj`J2#~}N)M%%7J)NlQeLo+6jjqw*q0br@
zv~9<3x=7zP&<tUmI5p7`pg0_PoE0KK_zLS!i{;%aJD8m<uII}bZCS8Mq^fHI!aNpG
z4wjQyow_M6SWo6nVd%%%i3T>f?qQ;z6q6}Hmlw;A*w5Wd_g0s0RsGXRdD=(hPhT(C
zQ++Mobe&Hp0w^Nj8y3%h5R)lW>_d+;g)nwQ+1=f}${AnL+DjJ1B1!mqh1y0?P!&a^
zaaH9&e4;yhom&bFuOO})#v-7Jvr)-J1)_GZQwFgT%Ei0h8tim4ZH*&Tn~cD%Dm_@)
zR5$S*KQt>6sj#{FPVOUm+|l0E{#7efRH(q4;<kA1Aa;W=5TP`Gq%gYu7cc&JcrbYM
z;@RHe^Xw!pJc(Ks3cb_ofA-r!bZ=nyQhba}L*5pHQ`<|8^;s1L5_P)Wi||wf?&ZmU
z5WU`c`uRNxp<2j-Wv8q0WZ4DRJ9D!8xOh}bjyhjb{ED&LdjJBnl9x+VroG6p`B~`K
z{e7CBy(6`2-Nj{psO!jPbyff^?I^z$<Lr`$dg;ZHsjt*g6Er+@?uo${t=t&|6>M4V
z>ZSh{%d7@=urC~Ce=p%REnkUbePLOGA_wNzdAAy0Fm7lOxP97EAZi7K+kRe-ir!zU
zw$vmN6rL5s@A9R4S*m<eM0oz<(ZS&0-;Q7H4ffstKX`S2d^F6Oh}GD_rG93t(!dl@
zh(hsuYdn)>fSuqW@=r&?7t6JF#<NELFF`{f8>cg@-_QR2fBbK8Gp(rG(1p5L!{EN@
zqmNEM$$Rr++Io-Tdw_t%<GtkGZu)Ccica*#YSo1u)8UyoEPh-r@&k9gcCw+it4Emp
zdWM;Dm#nsbitD<Pc@>S+T}5xKv0W`!EoO#>0hte7EVk+B+~qL7(8^if#bZ7U<jg6g
zyHUn8en01v)9Y?{I3C4K4U!^W()LpCjvA}vW^xtir!Quc>s?T)hNn_;E>4|pK@_mA
zfzXd|O`yb_o@IM|_~_uf*WVAGzWDwdG~uHJV`8p<;qu*r2D9x_q=%t!e_dj0JP-lV
z3Xio>k*u(TrLVw!LABsvpTCE)5w#|^X|*vZ7*$pp{-eI)3(B{6+7QY{Rr-!<xP-sO
z%ou)6)B(pY5wYm2Eqb=IblR!tEYDVx<roUy`YGOO?EwPsVv<T2Ql#Cn9e1K`e7Bdq
zm=%G4yV=<bRpequML3sP*xBLPWl!$xxJ~}Qi@2%Ue~`|V=aE%5%9UL&xHeRTmRj5P
zf?J&nU=A$<wvm@^*h+E<=zGceF8e$_eG|}ganzh*m<-9Smc*o-&!NzFfunDjH4VZO
zCfLgMSZ!URR7Z;tZ396dI*IkDe~g~AK?wqXyx{q2K`A?>;c*oZ5y|tQ69$qXy}h!c
zQ$Xob9ja86)7VIK9O_fu@LZ=>q+8Fpy_biBql5id2gjR_wt7>Ma0}}KHJ?T~Zy3Ln
z&&SF?hyP6F)qSQbpZS3L>WPKNLr*I&<+F571OT|Rw!BhgTG6K>Ia$Q73z3&Z;S;ET
zKacAd@2pW^IKzL7x;|8Afe^yu@dEa=WihW3fT+BBC%g=PRjGQT_Pbb50p}|h7x`@b
zH*B(nJAqK{s|s!G?DVp|EL=$No-WFKB6y!xwfZo?kfAb^d)2kJnojct(PghJ23#9t
z!EuqbxBOSg<13c>&9fs%yR7&5zI3O5%@$9Ky_sv(jDak$gR1xE<;2ZOA5(WxF0RGR
zEvSi;sCJ}%k42bSuhgx9e5G4^QVNn@vJlWvQwP{8#w?fZQK#&q<khg6IbnMMyYf&q
zOy5h1cz3IIkb6rTXA~jyFlOxRc$1ngnrGu6qveXlFh&|lU)S1{)fF%bt}(-Ze+VZt
z1Txremzva~#WKNXAfx7f4V##ZBwXz5{3|%O8yjfd{cLCuR2N(1l!Qpo(Uf+i2>`rl
z8EnY!S~|TExtM_85dmWU*(d<)xRrG3X)tc+S;!Tl)m<#aNdC|rKojwY-rLfInmt)>
zKW(kn^BNR44du(I@+m9AavtS>*w-f9Y-;ifk&>OlhwsPqfeep8BMqVk(_3mCig<+|
zt2~m7_lDPOs4!qh<9sozuL2}3VWqkPZY1U8G+#szil7!W6pa>JVNxt5TS^Pe21+>4
za<&1u8Y|*IfS0{J!<(}q&_M7y3l{@kyS)qC-~6noRprGtR*B3WENQ%d92p?CVo@uT
zi%27Hun%Pi2H$?W94kv7ladHlHp3=aOIzlyL!<$)7J@NaSHXz#Y&9FZ(<nQ9B*h<X
zY?Es#f^6rBR-Fq()>COicB3Z+JTjBYJCl5NvEnjY*Zk&>$|;A%4S85~lE4hPF$N(w
zU10sRzU6Csniyi9Lt9;cV{Apfz+*BXR@ZT|JMAL!WW?`bGUn4xx^m)s#WD#?8d?bX
zH=c3}i(8y0;m(d28t@hlER+^1v-{a4M!sE4os<hpq*X$NF15lc;r`@WG2PdNmGuTk
zt|#^O&Wk0X!AEXrXsZRV=99z|rGp2UvVZsO_8pu6`b<}z>AGisy5SkIq#7_N2wniB
zRi>`gPUHkB6<wbadK&mER&&e#_VSKaW~KxinTqr5WdG@5il9H6PybTU)Hcu0-Z|px
z|F_iUh5<N+NjaRLFKZHOaPbH#HjVt%wWF{p0mzM5-M2eld=0f1nj~WgKlh!C@#OV)
z^aV&A#Mng?OX&}P+>^&I{&?`*J+}wNv{>YB1R^84e!nYbt(H~PgbhE3Y&5(QQ=%II
z0!h?l5?`z?MF_!dn`>NEoN>cig)((4<I`+FOPv%`iwIU;V4mpuVSY3XRg(u}VMktq
zSszt?L;cpPT>L@|Ipood{Ja(Z2&*#>e)Bb=a4c3P_vK1|KWik+j-i~o&*qgkE~)I&
z)DdRqYTD(j#f2*7^%kM)+VCO0jbujXF!VJxt{caVv5r`!Zt2IYR=oQ9(+~L4txNse
zYm~Y+3a+s@B~X|ElT3_J@F0NS%bGzIzPps+`N?tT(wOzt{3JKbj$@q#6=~aoTtZ1b
z{@ZviTSX0jEzxZ27<!T@P2<m*PmJbNOIkFZ)#<%0A!Uyixlr<GQO;F44$s)E#gyCg
zK*p37F=sfWS&ww%l+xIZ+TkDKk>ZBaTee4H0><N;l}&hx%Bw;PNxpYGl66bbTCep(
z{4-Qhj+lFFkTYOeU&z{@A+F`MZb^U!P8ZHkqauud>5`+P(wUAwElKb=ZZJeC{(M<X
zwel*voVfOF6(T7uYEC*Eta!ECPVrrgi}yLp$vFAMofrc5PYxaY;Qp1QL3`&qFz`l$
z#_-_TcL$Fi9X|j5Xz=Rb@vDQQCxgT1#|N)|*n0}K|7hr!GPn(T*&Db?C|oV9qH$zb
za!V|KP8sO`;_Y^`@bHU!_h9oV9WO^>H3W9d&S|KT*2O+>WdGhtOof(11b-_bN-Zw9
zj#Y1M3jAO}9brEF41Q=1aA-yI@bdN3r|yqU^AIXga5A<lh!@{M%~Hp%RuR#mCKVdW
zrP`GjD>pGtivQFoDQjpD8cN!K<u5Cz%+_OnYg!G@OQ6dKLvhaCdAV8?$~79srFDiv
zNe!OwQV0+QWzJwrc@G~IHr2dD5$vK0u<na;!V-&CjaUg~nvWzxh3;zKIxVkNAzv5V
zdx+{90^nZxtK)o5y6yOnL&h%vP{4S^q6(rvNFzTxV`wt4>9KcxF`F?D2Cb|bQ<I8+
zdV5|0<%DXzFe^a#h`|r;Ae~RjYrN$Poa44t_`)DUr5UlB@euRzLnAhj2<IBUR4ycf
zNtNknf(}K2=xBpb0#P~(Le@!GrE~nXW;=OsZ{Qyp@R8W(?7rp5w3xWViEIqvZnkVN
zg;%9Sle@2}?&C{LUoKc}@8o-T@yH2(L+e(X`-6+|asWXo{v>+C5$gzOIF)HdcN{&A
zr0&WCKoP(xggEt)Z^9EW1v59dj()9IS}uaCfU^o>+u6#oAJGRx-3U(xer_s_DWv5=
z$Ec_%DE*|P&1=MGRU}ReDTa+v_#$YYcHa0kdhGt9o9km}#}~Z&I~QAzUoF{x6%iQ8
ze?OGfTjwp5VPkWT)9!p<j?^UQbm4E^jRwxNvjZV?UoC2Y7{MJF)gtJVnM`ZUjUa0t
z(F&pAvXesD5Tj;4>-h+5Sj~LV@6&5UyCJB>$89EMfV?%E_R*^Kx%-O6t?;w0U!S-R
z;^6UxqG0iXRY{rTz;0;8q+@-5RU|j4)}rBlaZdzu=q_%UGS%Nn|6YdvshzbpeB+#v
zLyMB<`uL(Uq?<;GZuoLZHc~P4%nHzQzChsVYpLJe{FzuBK0|fu)AC1}C*(<MRqauH
z!pu=xfpV1PR#6<nM-f|OxF<ri3N$>|`@NTkZoNm0(F@hzI{HoNtkiCQ&ed(9!Axd}
zw(4l(bJWL`QRi|TOg#026Yb{}SO_WD_`^XYbOge7^xRT6_14A%Vk;|W8(0lVm_aTv
zyNURWWab#NG1iQkQHC?}pK<%DoSw3H1Xs=Yai?x;T9l`-9_}CZ_a9~R@w{+qHb%d*
zvoD7>R_BqN1|07j<<uB|E#_xyBR|^`I`S&Bo+%n6$a2!fkBCa60`EtOuAVL&>w?Jc
zG$>#2y2j^J?L{dZDNQqqddaPYIC1E0@5Eh2S<lRHCX%R;L<T&aPsS8qUPUfk475oe
z5}~93I|wf(zF#rU0t0GUSgjxpK^U!&GQ^NWuCtowoOt2|7;!#-H*qaJ=~9d>Ux1tD
zbsZgwb<U;GFGl#ZJbNe1926K$=sX{LK7zo7_u(Ff|Hjr4&%uV3Jh6V@d@*njghMAe
zZ}b~!2Ra(O05B`*uZF%aBPnpjiq$x5DW{KQ*Q!w?`QQL84SU(vcWhGF1LM-GE&ARu
z_nvU|_9)t;n8U4qmnu7+8#%ANnNlR4kwr66BOi^#0giby^Od6x8tHxEvSc!)?8{OM
z#7ZX8NW?&=jgH0CYwCw(EojIG;@Uq={V;W{8n}iA+EBgyG=RR<itfVR3zb~}uE<9J
zaP;DNgas#|;97mU7VYA=5z_|6zIr%|ir<EBAl1k%{A?M2m#-GFc)S>OA=O>$ZmxP+
z+PB<sQIK1HEwU}#zggajik6F+Otj9W`3crr_VJ*3h++pDnmM{Xk0(Un-?V&`|MD#+
zK-88HQ$E#V&Ss7hk-(>`h`(cJ$6r9YoD-q8Umc5db6GBy?W`*S(wf0>^6dKPPfu^i
zx3QHLN^mlN`~Cj(y87#+-D#aXD`ywwqwjA2_JargDc%{KwmaF$i+M5IJG}kdU)=Az
zBV(42-OI)DtmlRz0aTF>U+bTFbT&_@lx-0_<eF-Ew+V};$su{fH>+?7@3&4!yK>J<
zPFnlX`u&%xoOR{Htb6OL(z*W+H8<1>6(SRXZ+6{(KvcW#+$D;iw?jU-ckf@<@>OC_
zsKo8wm@}2mW1B4GL`mNwT;Fcr5lNt%cfG|1&x=RIbr*X1MU-l=po!?3hu(Xb{K)XM
zRFo5>9K#%yi!RP@us$6;DnoVCrD1V5AJ^q=rF7xGD$eqGjroACD~j5<IcQ*5f>gNi
zU7!_zzPTJvLLaKz>_@BGX&lFq@Lq-UpQqmE4+c4ZCF(Oo4ylVLsC|rK8N*gP{+rZs
z#Vfr`8mhVZfu4A_45AZ@sTPnePL3WLgO%!(Uk>Ew0OMd{@ND2CuR|n+KU=!;cvl~9
zXWPT-p`#uB-AB@Fe_8e!zI#@^AF>Wyn6B-Aq5IoCZ_n8s_gtI_<>5v<aaDGifWXGR
zC?uIltRiUQr$}}XutdD!$xk#*?kzryLo^s1*oZeGNIZn3qFb>?F}FHNd3ja1sSO!9
zY)ywKeu(9G-fHbbPhma>)7R0{h)%th9bfC;8^k{cWmpa^uvacRQ0BX|dZin@%@XW?
zU;=LFl=a}^64NWp+zjJ1ALXSSs3)o>e|SI3z=BF&h#bWyS_#&u@0I9WaRGL;)QM_d
zf1PKSjy%8FGA0Bgc_R~YV%MUWe6uwx#p$^9ZP=k-_w#QxO4bL4Y{42}FK_h>wlwt4
z@Jj7BHh=G`IGqbtX?PIZ{twV_CS#|6eosrRWDruC1Pvyu<V28JJ8H&@RxF8ksr8<?
znRn!QIiAZ)Zh_CoKZ?2Pi-8lvl}kl$rbQ8Xq=z%y9p4*{^-kI$hN3anP;`x!UptF8
z@rDx6mG_&Go;lg1@%RWWIU+RN(uP@^SGH^~migc$V1S@SMXJmq5q_0$j;@n`qgp3F
zm`j;+@*pI-a9Z?*q`>2Oob_W#ij^w<ExMB{I<_T!-_4bMLmX(iUr!0t*x5Oh2kp}k
zkr<Zvn_&xq$QrL9DX9|T5;ZDPJ+o>UD(F8(Bg3RD-;ump!{4~}cfWqV_v~Qs;_={z
zy;t8lE#!?P%EbbyV$5pPj6^kmiVkE=w*uccONPel&=-baFAMDSM55jbE07ILTZvlX
zdza#2>{vDOQKsV3v^2>lZ2oa&0T+z?82$#F|La!=M=xH#+CLb)+&g~q?NGvR;GL;_
zfQ)tKuJtc_ij5~TGwi@c#Nc4<f_IH`MizH#_Nz)Ug3*=ioUBiCz~p&<tHh3IAsv9u
zT3{bN_W#YZ!H#q|mmHqrM@A!lWJ1=R@M_oJc8on1ulX?vhUmzTKfL&EaQMi6y?OEK
zk4G=}_78^bXfdMXfAHGBl&5#4R<8S6ROEVnfuL+aoD|Y@@Aa}5t0g?m{)%r$W`9zg
zFWs3cmWNUBy=Tb6P?bA>CYg{bH7^-m3MH+QaF&$#IubMNS6k>t<2rN=m}k8@bw|n)
zo?RyfIjNY$<Mz+6E8G*&f&y)cB@0Q8Cz_!dRd#QRUAgsYvbApXSiGw4(=8IK!Z+tt
zcdW8S<yeX%JjX`jdFf@_n(x)vD;YWx09xbOUnGK!?8?HL(KJSX=H~o&p++>TJYTDC
zR;fio32L)n_1b#OM{HV*#g2taDp?*wM={u0*#+Xi7Vk#xEK?a=TaF$V@mtl3xEYna
z*Wb9?4g%F75^q%#pCg)Le5Ou=3H0X>cdNM9xaY@#vyaRmU#bb)4Xh==2n1G8fNEhV
zW2f5vIYJ(>k(o1pKkA`XpJr%FE6>oE<ouERtm&wAV*6YBsjN%6nFu9Xv$%q6@_QS|
zH*&FWzbQW}%*IBcOmx;(q(%a3+-(j(0@*kjBqIlL4Z))0Efr>`P$+~>cJ%D{rRvf)
zM>zAzXAxc_((Wv~EjUL_(F~y~3|2(IknY(U#)dn^DC~`Y8Gf4xZG2+O6x~3~kP=Cq
zI$g>0b&-($@p551grD(airaL(6$Kqj__rsBHGS1jSWAoo^e#Czm5;S}xJ)A7-_BKB
zp5`3k*et>20udbYJ_YQS;!Sc*+F?;ReYEsP0vf<Y%8QGMxkI-0Dq7mM)NZ<)>|H9^
z`X*XRHZX2~4q(QJ=jiw{){kYOv?fH5ADt{t*Z*b<@CRb^C3K+c-*3m@8~NFyti+-p
zEXWq$dMTl$@%Y@@G0M{Bjka%sTiGJs9%cr~RF{J7L7gg*zbSBzoP=C<lvI-2-Yyg9
zRdWt+zj@36#E`m>eMAQSPK1PWTtJFuCp(N{%(f+euyP@Aa6Bu0dZWP3faQu0Po!M6
zZ}G+0;H6zi#s)3rhhhO>w>7MsS}u;a1c>olm%vo$V8vQ*g@N4g_cnwGUsI&>(xS}I
zuTL820W|I!N!b9<htwxaGD4W<q5<;9zARz85V|4@#tBohFH5A0uT%U0cL%r|+k!$(
z3rjhFw_tkBBSW*0;#Mkxx_0EJ`(`aBV^Lga)B?jyu|aBM;0`^B25}Ry$6=#IRNulP
z7=1QD6L5}SMzi;Xfd3b>$oM%aS0fYpM^Hk;AnG_t%tX!hs(0?lhLrE~`GO5LJ4v@b
z$NN#IlZDNLHWhy4<h#}EA6-d9MTFwV;%t?Fuuchzj=eo1Um&hafr9@W<5y9>2pK82
zTw9YuBCw$TSNFd7st>}sbaLtVZ;}|57>OK1c6*>}E7^_SzGKAT&D@q60hy#cb)<0Z
zlQt}@?jL_lSdbw+^#ONkv?9aygcSCvaKYtje#`CJ%bo}XL_F<IBlAP5k4QrwVs=7*
zK%j;b%$qtxb}3WN-k0N%*ZM?CSium?xaAOwc@o&d&3q#6x$QLtrCJK~g#62WOg9$}
zy%4btf4Z7u;VQ3y)ak9JuAe?&m&v92CEd%sWbks^#@ArBfy~~nJNK&45eQOFp;?GJ
z8=0J&+=`A4wCIv3NQ@#F#oH{zBA{e{6;1eVBF0Ne6S&rciYfS(p&ZMZZpK#~?{9W3
zYc{KEtjAn<bes;}nH4>vD`6y#ztsO!msf^-d#FLqF!mOfP#_a-63~cd*E3@yv^cKM
zeUJQOe%(?iaZAJ%nDHw)N97hGl=$%uR3`Z|sWR63)t&77LR2s(FEGl0%}nxtD(Z$n
z47*E%_`z>NqucG4;y*qvtRPbSs9VREZaMV8x>_z5z40tTvvsZ6Kzgp(ZJL<j%$8^S
zeEs(VpZm@KZMmf%#KE8T$r|jz{?TK??Dp3G_y6-4Z~TftZ9eoZeo=tSmW4t)+qi1&
z`(Yw<1T?iaDG;=3FYy(3zO6lf`*r=v-Bt}za_hJ@k(Ufvf{fxea&L>z7n7#Ozx}kv
zM@7By>XvUxZe20*^y*sR`4+Js8n7j7PY@Xy7(}$sa~~SRZBN6!gk$i&gvz>C7vs`#
zi4$Ww%E)S2hW8}RP#+?rRA@7&io><Zy<BNVl%##Xl2~(v)ySElj$IFb7mk}?Fb7!S
zM_N&=P$5S&z(u@WdiB<f;FOIhR>_a*W7S9llNW8cPCZ1<H~iC?7pKJ(qPRtnLcoJ~
z$^cX_Q;l?*|2UqmrrF^myaU8s%G*y68MVls7gvnH-_IwAiq!~w^N*bsp82nL-I5$Q
zJ?12C32wQ0@uG&t>ay^EDKtK-2zW|!nJI%OViKf$rE2)J8G|HAiN-ODzLhB|CK`o>
zC;kEtkVRIFbU_S=HT00h-((V!tkL*mno1PnGswB5$3H5Jfhh6f92mbtaGQ<v#L@Mn
zEax=>eINviI~Aju;anHrIO17kqJ?_h#~?>bAw&1jSaSR{^q}~EF{kpijA)yOy!n$C
z^5)oz)3pHFBc|f5H@35E<9PvMOJ!wuOuIce=4x80LJ0OEcI4nHtwAXDHlXjo@$Vx!
z73|Q{JdPqhK%pEWJOW4Lw$TzxB+~wgj@kj;hUY>(biUXi<rx1hzzhvL;f&RcVAV#k
zZCrawQSKwUSJkM068mFhwr186_jq_u^#!yg9v$~&7wiE;>H7V_p6bzkq^Gu<n93$b
z5uDsheu@|wknDpVKv-W23fT<d?c-(0r#g`%-lW4=)cs;0_tF>z<PxZgHpZ@+j87MU
zC*X<vsF;;~rxv+S4y0&_Ur9UQ|3j8iK1ML_|1&J6&W)~r=H7pn)sz)93!0q17({Xu
ztNh9=oD<x=rT_X4joBX0BVC%4DydVcDzjw!C;r~Zq%J)GJNzJ203w=hV?2?gUd|1!
z-U)*&d3=8a<e|VE-v8?J&wg8cb?@wpFYk{|?|=Tq7oUIr)!D=Q`RDh(EKcuz_0av#
z=U;vCWgoDAgidn{jftVYUoFo1-X+vqRCk`<|NNfY2WklbSfAGL(6f&8??l;vCyrYt
z@q7acwOQb!y>T^wXJETsgCNIFffKv8EVYu36VyGxIAy!q8(Vl~tNHogwfx@@I9->H
z@KLECOQQHD^FMlLz&>8<kqGd=-d;mW-}=eF`b+<Rr(Xs?>2QD9>a0DBBX=+!*(Z9d
z+0`PS56Z;=BijD?=WJ^Rquo3iNIPj~Z64wwS+!vu)D7d|nuVurar}iIAb|!T^X;wv
zR=WWr-gOmA)I8@K*GUQ$_|K#-{H}4zw|<IVaC7V@_yZ*2-(U5AGJ^W0znsp6`^B%f
z^z#&d`|Cii-rpy2MrsQfS1PU;Cm^D@aTg<V%^r~*O)-nfHJUAiiASxJp~5M7O6o@=
z?k8Jj$neOiMgt-qr2rn`aMiaV_M<=9VEv-Dy?$9ggI~iG6qIAD)GD)nO+%NH*kKxG
z)ILB_GrK*%jQxE}jp$abB-ixbi}8DagaO)rTZ2>F(Z_1U?!aT$1ZgO^CA=Y6RC!r8
zUk~}haZDWj;K2DZUa-^n$nnpsMzn-+P7mBwB?X$z>fyB8g4iT_k?)=Sr9743qI(1P
zXL2}7Yd!CPX0AGt{)*}>pF>%NzDfD`1ffRE+2b@<3Y*wxx#!ySelcJ`K7uuoH!Gii
zs;G#Z!!M0Fk)(3QEjZ!AWS)K%{(ifChhZG<nJ%=6E~c?7)7Z@wwxoM{-DNX)q$_#;
za?p3(Q@9q8FuI0N)ArNm&g>Nh{Ikgl8i7ehQ7SJnsl0H%%wGQ+^F<CRYCv^?h_bu0
zlRYW{!yvRM3EW!D$D{uf@Iw_q?0MpUXLs}!Don6rA3gk-5LOM#vL<AUH+)b`>E1Zs
zYW=F;r$MXsVCz?ExyY|_5Hk(uZiOHpBGpZ#^1F{;ytv!`T~xqN$^b?{xxZYSrH!w(
z?hqSd5GVfZw(juWH{aavJ^1Rky?c?7?MD`j@%2%T8ajtN(j~~0+{G-+B+}*9dFl4l
ze`2eXefH4XpT6JFj1JQeaARw2KgQF%x@@T#&|swzLUi~j<Js>1Xt!RycyX*zP2c=x
z+lkPVtXpN>C)pMN#mmL`Z@CmC`mS(HY?1khsIBb3yN+%B=DWS414+k!zV{UPGW~o$
z?qBtj_^3X%@?Zt8%mDqs)^-PdKZI1Ff7<3>{+e|c8A4y0r_=ZD-?Eo4j*i)ZTlW+X
z?hA!?k6Ag0NkEbfz$5^DZj{~KnqEuww5_`zJxX$wepr~Q|C?xz`>tijlDAr|=B55&
z@9FD<fA&J$u8VFNinGfy+cJyS$nc4O!(MI~zHj!r5=aL%x;F$ZQ4%=O;yAf?e`~OM
zBXmW8J1NKZo~){ySKaVLcUgMur#XWI-H{`jgLhPG9Nj;Y73;Z3L^lxuUg}A+h;xQQ
zzj@*t*kkB;!zAhSM0oDVC+J=jvqI|3ygnqWb?244KJeEEt8pz1`K18l(0~{q`<+;L
zxlHm8O%YDr8jKP*t5TfVXGSxPe-CbQS*M@}k^u$KgD|Mbqs#*e3+O9@1s!gBJ-_b3
z3+diLnp<yN_6w(Sv0hgnUmOike5-f4L;(f(Axt@bY`!DHONiKXw=%dkLw+;>?|)@j
z#L&aM0cye!4Q0k^kwc028=|Gzn23wmK~~M|uan`L7is8jUiiCd=*bmke;lX;K8#<c
zbhmyYa;aYWuQ&xo&fnj)+)4T3l~g2w^O<l~lBCo0)=#Zp!FL)eB>xIWVyMIYD~u?*
zJ35VP9J>ouHG$nRZa~Alqf2D^5wQFKXzczrG*F;zBmSE%ShGmVNo#Yt8}%F-7i0p2
zg4qnBn%3G8e^ZTKt5X*ie`~Esou3=2dB>@-B7%Nqq`=;3T176N7p(#qO^cS0+b}DU
zm?0tTj@rX4gzk!?uRaHyfj!yV2J@Ik0*!s)vXz+DJ*N6B5I!T&H0vPB)^M_3Q_@yn
zzO$ak5e1GW0dd%vX|JSY)+~jLV5kZAq4x>zyJ>ByI;4S@d(0a5f3SZV+ct`sGE%pE
z{4Rhg0(UTl0GG_Dg#g5m-r(C2Ar|3_yTbk->q!%(czTsL_|yacORRfi9}BK0jfbUd
zwZ4m@D&3GAqq2z_k`<$93F2kpZU)1Oyw&W5PoxT(K?I^8f%xO)nzk4Fq9b<W1yAe5
z_FZLmPVR(kUE6j+e^9kv!OmbWL{jQSsn32NwcY$E1=@d_WaO6^Qffcy09(m|d`c-O
zj2B91by+wC;x|vEaHiv`{|%;=w0~Rf@|JZGMIn4Q9n(6Ty)WMtT_CAHV~J}wK5fjm
z+I_tkyV2m)jU&=_Z!xO+g2hXfh3Dk4U!REkKTg^r1vPH>e>+J+yQ3=<=W~0M_1m1{
zcjBX|N(ere`Q)7LOerWzX;5wD?hVIn+&^6_rRXHWSuqiNHIS*UMWZ~uwqoy=NTSCw
zf@PVF5_T}*9}}@hB`-;TmADV{bP^OC?GepH(|jN`BZkd$F5!Jiw?9L-2T4Y1h>Y^F
zZ1SQo6;`a6e}OG*i?6}VD_5+mH?EeUCSgr7)Tv0J^BG=TKz_HSVE47w8T{kL$lQVU
z?2(LYkq%69LHgN^Etwd5PTY3J-6IUt7A~XdCFH-HL<fq^*@J=Q=guw$emYVc5ZzNJ
zfR4KzmEcLjz`3*RlLzNNB`L!E;yo^~o)+Oi#LLvne>IKy(?5E*Ey#2eK&3J1=R8Sz
zW(*dj2bQ<;Ar#^aQ#h=exe>IThqgL~;UT7ApJ_1cK_5oePw(vfVyHO=L2`%Tk*&_t
zzEx?|lsWo5+NEiNc*=_&1UHB<?y0XRz@X278;6nF32E5*Cwnv6=sqs;)2*Jo)*Scg
zi#~;*f8l7XA>S4fjRc9<u2bP<L&^cSwA3@TJqH{EsT!^&`MAm~s}(I2tv_SXO)&m0
z1!QblSh~VQf=^}vP@LaWtN{OvtTu4x<b#$DbEOttr}YC~b2y%jhn7Vz0vXi@1~40h
zhfcn03n4x3uv74Mp9XV`F+3hmYH{c|L8RFMe?~b#$JP@*kn6$NJ>rU%rN>gMgAe@0
zCk8YBtnzV%mNdcrCds%%HFR2a4*`brv!i!oXKF91?t*wu!CdB+@zEs8-jrppv<mQO
zjL1Z*4J7TVeCjqlE@;V8NW@oy2rKx=K0+QiS)a5B&&w;XvNuuXDI@!Zxcx=Rnx#S9
ze^Mu$6z+=_)MChYKd{s{uCgxhUKPTK+(A1w3?bu55;0CsQZ%>Z8rQRB{$qCOw1WvW
z1Wp_Ggd*(|nOA~CeJn5`5hRn>raC1lT^<5#Ung4@X}Dx_yV>w-Ppi=SzU}!zv3<XD
zHa~|tVdh18?X`m_lfTxfP2|gLIyiTXe=l;qPmnA(Uf!Ut1;76)HM_NIxHZuSxxo}q
zL=%$jwZ2#%$W$6QwZ>+^NXMc4bC`A~!mSlko2fhA2*xeGhQJb`ta~_r!bCXwkZA78
z@82k|t9lnDJp>R3$-9*UQSsa)E>Ob=ee7?Dsi=>?Ve~rmJDm6Ktekbny4|n4fB06k
zf)XXpR3K%4jmBAYgK^9_?FaJYP(hv)i%gDrAb4@QPNFtNO27Yb5WOwYCHbOSi)Hs<
z2kP%tKqXbnC*x5bFxg0A8i5oHsT%NY<zsWJV>YyoYr3D+qe;fE)Y%d&S{*=uIQFUL
zaI|T1XC=JEBzUUfg1W*<i!8kAf4@?k*=HqT>VRuV5@@xK##0H$#5GIcq5;-W;=P4H
zdrf-u)1Nqaqa5T2$xFZe$jU)a^I47%LkjoL<cFC!CDQ@GBde%Rc_<~ls9A{u!MF!@
z9mDruv4+26!(jH-$Ur+VkZ&rhw~bT$IG@<S<iUU)!-khKLXX3~|LXOlf2?FwG9mE%
z7PLbVj9xJC<5x|3#2~Q^0T1!6xUQ^xst9eM%7p>#1uM5zS~&XC)39i60bU)vd}@5-
zv~;7JQsAjiO4DrUG<eWA2*-LpxmkyxL-5#7!hLgX4YaL6)Yj&&c+TZ<3MC6!JmrpO
z#|C{CMgWbsIT!BSypT{ke*x(w9RH&6LlJbT@)SuT27r<Rhw=qI?k%@QOPTa&2lIKg
znkmO3Cu!yfIfCpRm2RIn9qK*mm2y;aH54?tn2o84B#2GhC!DNf1^i^&Z@2GYU|rHx
zS3iiO=86zhB5nrVcX7r*`3TEMivPG#Owb)79)~nIP-7rDn~U)jf2U^0Jnll$o$Sf+
zv!@*nvZGa77e!*tfcYcNW$D91Vmh9(O9X^$3z{VN1(2YeCg!6u1zhc6JM>EXUDQgA
zEXJYYjFSU@7XL;3-_O~jC_VpU|NA*RP`%_o^uM3oNV@(%-<R&E|M&O3{dauUjpRhg
z_N<&ZI`)6Brn7dKf96+(SFt2^h+?KZ*1Z}VJML{*rJ;r<{FH6^4{Yt?C(Mky*~w=Q
zI@y<RJJ}Y(6Ws5IUv{$l58h_KWWNmmo>kJZEf6nt$N&Aofw^ZsII8A>xi`^&_y0IF
z9Z}|nc9LO`55JVZIlk<z`+pxlz;s}W^A?X!FSTzuKI*}uf8mNbPErOui|B0_sD6gy
z^-GCC>MFXi{?Z9|zVtWT$bXTMJLdAircdfK`HA1+v{et?L{$&lYb&V}b@VW{QUOK;
z5F8ToHr607)G~MS+tOr|MMuQIkjY*Vbx2Fs5uwVpt3gly7&O1$ZJ1*;v(-a47h4FW
z8Z1ld*jowVe{pi)Cr1e_y2~4<C!r&pHND%h>8K}Y9ewHbdRu?T?!Iwz7zB(PjQ!dE
zz+j#k9?nM%##+aKP<+QpJtgu{C!_y9d#;c-M2&U_<(3kB{QBtDFW!3WSX)H5xPLY*
zA~yEifN+h(iG{M6*CnGS`H+39!s~uG-N*?s+x%=te;#3Ivl|~o+}`rX<<`fubB<^}
zI!El!=)9fXf-3Xu<)g<QAiH<#rF8AP&O#Lb;<J~dbJtUT8(A55Ad}zn+t0rj(X4lS
zB66+QXH&Xyh=yd+Qo4~hl81)3n##Y-3ycT<v~M+@KfFA+&47~ep!JU&kiPOUBjR{2
z#vl#%f4{d}p6?GIfAsRW)<1GI^2R4DPxT(F<No({!<l7AKYaA+xYn^LzjptA>v-_j
zef;sy;KVYdVzEH*#2x<IzSW@ksN;TBb<@C-LGcw?CF44u-Tx9ogEoUJhj*uRnB?<v
ziCfh&KYNE82Y7ooOYUdCeA<j~(4sFvE#x2Ve+^vNmjR%AnpTiXfzXg+>?UC!d0<-O
zZ&}Q1l9;rP5ttc3-89H+!U)g!`V9|Q4_@jNH9h8Kr)fUtfjZwroq6VNnl35X1+ZQT
z_}oXHt8=dABwso)?_S5XGuzGFzke&ssgw3PM0s;swG$A3;zOU`>wTe*J?!0g3h{V3
ze<|FEo;c0kjdYQZ#w+*q=N)J*SnaLrg5b1>R$r9wiZ|oY@{&!<?|psjy9ub|m$$#H
z%S&Rw803=)ml{91?nirVUKC`<3>LRlZj+_9Pno#QaAZ<^4lx&esPhR5)-QDx<Y(HQ
zXy1@pfr|GHqasQMU**@8xUI~JqqdeRf3~YdaJ#+i)+Uphtwjc1#h=J$iJ^_J(<N+{
z2&oU2t7bz)HL>%>=9D#y$TYX2fu<9wt!cX$(}ywi(+Zcj*Ha{wXjs=<hT>-Mc{2@|
z--S5!PJ(%g2h>vFNgF4Jfp3b4N?*NZpv(jrXXTkG>^It{onbFt#D_Y%>N1~Of4w$=
z=%f`C0I=O#>XzFEOQ3iy?eJ!kDZxK37vjg)v~&Ng09{(R5Qu20MLakqieR^PJw)Va
zqDG7=g~=iGrY??F;G&`Hq=qQ5DTkF2$+xR;9fP?B+grX^<k!*U^=g5SLdEHzl&{h_
zw|SyFn`X6hyLFW?m`7qwrGZ-he^l7dwT&zhC@7dNM}}LI#dQRic_J~_ALYb*Fpz+=
zW*6SBVc;}`?LKvc)5#=mH$dHF-EVp41UF6`dnb>7`*ydb5xeh-srwrD)Hm6Q&uRQ=
z>!sYvOsIG{ewUwJu5fh1lu6+Mu{w?haqStyY?h91T`Vtg^Jrcaqpe>$e>XI_4+z4)
z<%?0==wnB;{l^oyq#N7aTT*tpvElDl6DNY^t3}-K_lvx$`Y+2dPLHOR-O3lUs<^r7
zBkU@7zQ!%T$sJq%^d|o>zPOlN&sXQ?aih<{g(v;T`FL^N*!Gi`*6iC>oCFoGsl_KY
zokBhFif|j4Z-k`2wf^*$f06p*QefAy;T$U%!HK3J3I?$1abCnc&C2i{jqxD=^X2WO
z&KK)SkEF)NpOd33{*3Ia6Y15f@+y0=aUb_;Nw|E|zOA47kK0Kn>3Z7=udV3YPV2vR
z-~YetzU+mNVe>8=*nZfs8|`iE$`E>W-Kj}}@%Axqv3HOs*v|-Jf8q8R0_8_>8gEEB
z5#hu#R8HPXg8zioa%7vi9k3;T-{0!!Ul06W54Ya7{EVIGJDtqw<kIq6OH_FR>5btE
zQ>pt0$g~8o8i10S;1k=&L%-OK`u0ng($@SfVIG>gq$>&!_FJDM`|Fc^9Vr-D8CFx@
z9JtHrGB!Mq^$QI(e>BqAK=kq*Q&)88A{9mgyNG;JKTpPHp;R~evTmy*B%*$kIR8n4
zJ38L8#f?m_A5iCHVamn&n;-3XOE#_vp)%333RooHYP3z8o=q3Zom0swL6f@GD%Biw
z|8tiJy<T6UkMjL}Xt_SYop{5ty&`Nx-#5K+&D?`)3#O_{e|_Cd<Nbu?`;gx;+b%<C
z-vG6T$E?snq)7?8OG=c-yubZFpIB_FTu+{+%CI%yLE||!<E2d~faK0}KF13g5PUos
zr7C`1KgxuXKFKqCGYP5CncYul$sCmTg{an_20^V6`aj0Id%ONVXzcHU4gGx}8z4J+
zs1#p46dE_9f7JhJJjLt0B{+kv0Nj@G4F)~?tVE0R%5Ai9^sEgTIa&(=P%N&1&>U5V
zvw_~Nve$=FI7ipVPgEr#!y!SWlkFe<;QrSloL)Y9%-FJdzWD2^(1$czM|$PEBH^ZA
z(!X5|PRFx+aZMq#Up<t-av71VdHrpy_`!RcYZ#ive^kuN(iW7U=3$jZn^W8`iCC@x
z_@qD@S5+uc>BIOXaLQ^&=#(j*BY=Uc6nWCIgYjI#LJbs|5y$7_*%+vp<G&RhpP+9&
zA?IRu3=c%3UE>npKFaca5kkr;260USW&4u%5t|KV3D>a9xgKV^lNO?d!4j|)Kl#m%
zVileifB9l2(r&(#nkfi2(4B|~g4>)oj89mnehWbOdNh779x(i|wc+GMBj`QeYB(=(
zTRDYA5NIzgG~hNpeHM!G)O-7p5eAzDid)ATG)}`aA5qck`_e({(_xS4lpxVVrvr<;
zVJdEnM`#d%|BmQ`#<4wS#6(XjVXlt}w{<*@e--I)=A-l5i9GHV&7VYA!W213G&-Zd
z3`rF?al<$zAfdtU%;<!hmU=Cep>f!*KNz)pxM9%lrj7ae_crF)#VyC|gCOM1`B(z^
zKWg+J42rm6{OjQn%`@=)d(Ob@qG<-6f3Guu7zmvL#3|fv4x+$`PoIQaL{e;?g{GK_
zf5vG*S1}KGp<yC$TW8|?L!<wT@h$1!y`mG~UiqlOe>m=9^Vl0AFgz5|(GRwo)%)8m
zW*leHAWdxusA!yP*AUOb_f0eHZt6rcB0+n}*oIs7GYy?s@9RG$PNH$32NL(u>+_Qh
zgXIG{TnTv4@oKR7#<SwYf);ANH+8<*f878jcdN*X^||_wimqs!zE>JS!qjyc&-xU~
zLtgxtd&y(IY4&ai&}b4p{u2gaaJFib#lVzan&0BCHOv@>WF%*y8J_Gc!eZ0pMTsSr
zdFzyM?^xEPk|sj>XU1+cO^6O|4}mEt0%zZEq#=8BD^5EqEqg4&0{g_Qqb5jce<mF@
ze<RL0Le7xbjT#=cWK64Lh1Ih3AxYG-4Am%yEPh|(RFXP9zAC3yqRSrn(&5qxW{HM+
z;z)d%P%X1;*s=z2W|bJxu;jy{Qu%URBsHmfR6Q5hr{(C{N<4%X^M)#E<0`461B9mq
z>jR(V1aL+2o^;u;hGyv~^BDPOe-R~Ij<l{I8amWBWD=jD{x7jt`o5IYRIXWB(2XzM
zZPz--TGM_xAPlhj!FKcX`7FjxNN?<Tj9~XCPz&1uSILhp9t_CkWuO2Gf8l2`gxaGD
zw1G*kSX@#I<q8Bkj2%*d9!cnigR4L+jz^$6%7nn=*Am~MWycjj-SC5jf2}Ce6AhU#
zi-uM5HIQ`9-AqcAB|zzu2v5h7t_~AJD3Nu*s<jIkUJt}k_IA7Pe#4~LX6Y%~3(m^b
z44^oStRl=vCmZ*Qo<fdXU0T0E_9y}}DK9P*(^nwikrWFyXzp*83VC=h8zE-Qk#o5q
zmViE;uK@4m8gbj~<OMS~e@ntVmil))+pc{dgZED|p)W1F)i6VCEji`JCRSX-63VUO
z1;7lJ0@`=t3$y&;&GC92u`dR8ANY!w#P%Ni<tnKLhZ`UTIaWJim0gPh<H?;X-9b%{
zZ4Vz!G67MSs3mGUteq`aa8DA`plM>e0WX;?=;?G-Mtq8G3U~_if9&L*eW>b4za*B=
zJz_m}>%*$`4FdteMbnydF5Mo^rzVp6#q4EI9lbEb03dRbJZxhC#K=snZmiiCv9`N=
zq{zFHzU+&ADZ`{kQ}Xl|gbEf5Jy>jFfmCFKh~>eFe<@biG1I<TCWXbtq$m)F?*6@4
zl&d-ZP|oE33c2##f549Tgz_WzHyBbl&hA$1l)~&V3wSK0ytyF-wke`y;_QS9$Q@Qp
ztXe!p78jCDTIJ^j_idL_obZow<&LUx^$sNNw&^=j1W<OHYnCE?z?pCrl_*ryi(H@O
zbIG)Id=(CH)wHC>A^b0^gjb=XmjW~~p1p^;Qqy4FbpNGvf3L6{rT=aubwrD1oK`K)
zBC$3dz7ZE!%)O%(=nkC|`L6Q6c`ACmY#@Uam9`a~<AhTY8?5EE>iVr6#XTvd9==e;
z5U5gu+KS5El?U#|Q@)22;WSENj$0Cr8zh00-+`v(IpReCk|!2k5;!K=RRk&!s$Ue-
zQXwyLw~w)5e{gO9HX`mp04xft>#+)Vv;9{Gd&dU>PHyn(;7_j)UmXmNUcWqewfE@R
z;d2y7_uHfwoD5+}7_iAXqa83k!2?$(Xq)nOH{y=m;S|lvaEy)(*(l8MF=;)jb~(bT
zEXMDNrmOD>Sk#bR8cOCf|Nd{l8OvwaP}qi@P+r~af8!@Uz&ErdrDQ|k<88}eity0o
zrf;`>i3Bhykua{U5EX&Cr^Pa-3vzp?=sSbcYlJArlGPxu5RrTm4qS1Rd^X^f0j?w!
zT1Jcfe94o{9kZ9?xpy+WKJ*R;6KhziVJQN8fhxpO=ibTy$(*|0)_XMI+d~{j6y2n5
z%j-kJe@;}{-LQc>^>vrXQop))-L5EOIHa8DaG?T<>`(V09vJ0h<aYZ-es&#BK6OLi
zu#R;9j4O#1meOy22JB>>jEj{4xA>0>J9<>SFXs|Z@8}MH3mXCx#r9{B2JseoA)PF#
zm+gxtrFBAs|BY_uYFU=*o8AHxG6lIXbz43Ce{v`u2mg0I61>z(N{^X`XjSneA`QMD
z3t$vLYa(`l{3QRY9V*YC9BBdSr$$~6zZhsy>N<fje0qN|W<<PWf5k#Wt{?t(aHf}?
zx?0o<9|@WQN|qAEX~9Fq1Ad5}<T{1wcbv5)t0JkeSw-X|U{2*Ef^Ot(w~U2h7M0#J
ze|ZueYBmKjdR<#nce-+h$gA(id00u6AX;Hz6pq9bLKR}aS^wKOjGO#gE1ak=2l9h@
zwNyTdnTY3e@>JW7^;xY;A{0ee(G`Kv2m-Y5QhC0fpK(?&3j+_})liy_g3Xy0e^#JD
z30^(gKYV6P(eZ;bupuWdPB@h6Y&`Yjf4GBR?d;$G$NwIO>45=dTjSaJBKI2WmUho;
z^CJ}i)rKHqPuls51xj7$5~K$#pqxytMP&@gCE#w3eG~AL2t>O(J5I<uJU3zKv;Y%g
z8&h|RkLQ!3P5?3kqtv3%NyHFR<rR+I?dW*?*82Ia)z<9-Lx#Jx3)WFM(i7-4f6`L?
zE?n+>*{LQIN!~&EoM<@Y0qkMd6CT@fqDg#6Td`uy>a<j((R?NwCVI|b+888I$deK+
z6CJ_2Vq`U3ib}hQu^pHCqD}4<MH}Oo7%@LxYb_E^&Cwt-PE;&dKD(_hc>cOur5nJ%
zER_*QTFRJ+q@hT?9^D^#zPFVTe@_@*Evu!&sS``i+PNk;s?m1qsOjM?rw}^&Q+~83
zQtzG|Cnr%w?hqx?meZw^#bRbG34)A8^o??7ygZr8`Kq5AK=hjAb?w9A@ialbvCVF6
zCySt`W3jo`bD}H<X|;n=mrh*j#K=#+$(nfIU=~cj7N%3U?QOWQUI|k@f6KhK1UyyT
z)#|zVsG|oOEpvcYToe1Lf>@o?G1X&(+hIV`c0GIPR=GB@*q5d>)nEUD{*}!yWBE3{
z`&+nWHoxlC>Dz!2;svi~-&6^(-K4}NwJqFY7j9;$MX_|VZigVWIi@~GdWZkBQgkw+
zQwua5atzmK*{WKs8zg&Kf7BQ@1s8Eeh0=-5=ebmY@OzDes7W*41{SM8we1_>o^i`<
zsJoGLC&-7ig9}A^Dl{dSJBZ)aZx|%+DJln_kewH!=*3fog1n9JVp5e2vDFF&KYnB~
zo{ppDn<m)v93C&XUo4B*(g~#qEb~cAp2c~IqV1C>1H%|E447F9e}^uNU)*lwk!@4U
z9N)08tYHTZ=hvhs`H%%_Pr|J;^5x_%Y2a6!HjG1PfQL#M?5S0%(njdvesh1YvdkOP
z!YbDf%$S7soEAh!JZE3bb**8BOoa7jG%4*C6;_~Nh|=UWm~TjLbB5fx_O}r+8-{Yl
z(q&OG1I83tn;}Ngf6E205BqyBop#FwR$RY^q6bw(9-hA2aYdPMG}`GOQc}GAg-=><
zV>+{UDDkG{8Hk%2<m#x_4oI#K<&?0TVG`W1LGLtXp1fMkWNJSjOv@P(R0ng^jVCFt
zAVm)rtGL)JGjxw`!)V$3N3n3c@xw<hINmvyx|JKxnJ=yEe|!DKz1x{S@aXrqR<l&Q
z!b^{Dz018=fY)Hnw%5KIT=AE_9rvpBs<_C#@8smAxNZ_BPFVF@xjUS+F!F5Q35Na$
zPECN0!v7fgQ_7EXy2PB!40kkfREdeBt0s;Y3YDqeD~L9o?0)7uC0%wq;(_l-{~zG0
zk)movzO2mme^t4!iZ>{Bc*I|lm$qXEPU^qO{#BeU?q3^b$DC>n-kY{4{lW1P`B8X~
zN$%II^yu+ke;nf!I4zb}ICaBnCbWRVzux=GP{f^>nR{62$@mP3WmY*_tvPVop=YgD
z{fZoYKI)uf4q%xun2jP?A@@Z$+>XOM7zZ}5D6DUyf1aL{jjliuj0*}$Jlnt__YeE~
zkFxoAUO2*u9l|3T73uFXMBNK-C_-;In`_;#>j7}4VB_QyS$Eg@F+yb;Cj+rb!POe=
zPSglx-Oy~`dtR&#(AsIC=_8`WQf`IBPhT>M0oZbFSr_)C3tM{7s<AVVtl^cxAdIqY
zM@OVme;iqR!B?@fGoFHW%9-ol&JO7>8KG1$(+v!3p;=fcR22(|AuyZ7?(~LfQmF>s
zJ;Y(<Ms+YB=E!3fySFK_vvPJl1?Y$qKeS8>io`Ts_UiKc@o43?6y3#<8^#NNL9RCO
z9E&XCiJ5X%obPutK{1t5Bs`C@*RP%?HAU_Xf3#*CS-X=*CgpWI2}!X&x|WpIW6=&M
z=>|p5EDG2ENpT_Nr%Z5N6WqjBUK3fNO4u8*z!JngFR?<3Fhe!^N7+ej<e}J(-4#E8
ze$&src@r^|AYospz~%ARYaeC3T`IA9jnxq<{o43%Q6U@G2cL?db!-BLcWTu00&93z
ze|(ECYc&m(EHqLm3OgFZ$S6v7PTc3NV;m?RkDZ2B_BFVOIb7R&`%l}6^R5nMtdQn0
zX94FjIGrXVhXgit)En*E5()0&Qv{RqPZLc3K2ri(SbVfV`2G_F!s@p2DUO2;MWa)I
zoOxM^<3o&dzDN<Glei8$J7k=WOK!ioe{$s3-o1qp$D6AliOtv;HqYIqS*DzHx|&VY
zVXWt2<k?MZQRu@Pd}y(=bGwh5LVS1WZ_V7m#K0*G4hkzvtfKC{ZAsTn`P>iWvhnA-
zWEiP&K%Q?!LyZnN@;h&+jyRoJX=-){nx%<5zr3_+C+h`Ao!YbT!m-<ol}4N6e^0^x
z=Kk{xLG<!?cv_)#c^NT*^{}og`}@snA4}l>G|O1l)hgi1Fx_D|nU;>7Mbq64PX4h(
z*2oEfzhq{8oSTZt(E`C{eSthyH`A%b$XBGHI$Jqb51ttc|43w_shtTv18BtCLl|L%
zzI6N<4()n^datb(rFW4~?pB}$e<g#8LQ08kD`jl7a*Sr}r34tuGFc2UuSTFk8<H)p
z@{nzhMg!UyiiJ&wx^a;j>cm7CBWR{kQ@@zNKc44D26?v@ie47>Yq_ZR4h2Yq+2<3E
zi(d97G=$SrM`N*6^1(2fU=Ui=y|NCfIa}o~;TOYI|7-mGw*NJr{+1}4fBr!=pAXOb
zU(28Vu|TGN(d%M8`M8A4?uH;MpY$D73Y3te4;bjR(gT_Lw(GXjt`_5dKF$9Y)nxta
zWJteVo{6nsH@xF<;(W~+<)_|hpN0bmtH0v<C{Z^DM7b`Vv&_T*A!N<n@(H18QRF7K
z0$E5-&9AdlHw*8SF2(Q$f4#)p9vMHm$+8-iNunDlyUHb~Ufo)j3Yt6BmZ{LzETeb9
zoDry=Pigh&^@(G>&<hf_n>?eSWZA)w%SE1smp_ira|<?>{?Y^0iAvK2m>A=#QON_9
z>x%j(l8UUXjr8yT>;Ey##%CoX4;(cOkFd`H18}hZavbT#hz3$7f9ffjkJE>_h@|4p
z!WZI-FQ%G-JfUPQ2R9XA5gC{`Eg!ChLX-W-Y_8qEOOzINJbPBmR{r^c6O~t5#?apl
z^Dmq`CCCJsN-Jv8`GPVkq5g2CN}0?>91PDX8JdDSlo^4JwRw+{j!^9vdtNhveEBid
z@nxxdo^n>D6rteSf0t-E@IHq3#0tWFOvjCB`Q11~EoSYRu!W|+$!j0zn7odzxi;-f
zW_S_e*pu)Vp#xBa5QlbAbWUM8<)<7yy?Bn<*kkjR`YEoWQ9L#e=zFW5wTXveREU!7
zFhD!mGJqDwrEWxEZO2}!FgLGOr&tFo^xC`uj8>VlhMNP+f6{8+5ca$#2E1C$66Lwo
zI$BeJn}aY{u)f5viuuJ{?wB+U->HgaC!AJy(_@Xv2#7-)Ngb+CNeuBb<Oo(})jP(b
z2-W8F3ie&y%i)-$h$G=+ZUAUr$`elT2{nZ+my7Y~N<l5ct12GeHWE=m>~?l=hV1Ng
zI9rL0g7I@Se;X=}=Pu0!e)Rsfm1>IT%uE%9_HNq(;M8*9rkJK$!Sif07RWn9Bo0!&
z4Q|b#lVn<S%;^w0t#>m$=e<iQ8=^6Z(v**?N!*K)Ng24r&005Puo|#aGGMI8Ct5<<
znBf8egBrrlI^pH?bnJ6R*XD6rKo=ZWQ;kvb0m~YFe{QFqw~nNyk@?M?>M=%6E9QX?
zNufd4VEm#MAM#O4Dh;dcuw!mdVNhzXg>Tb#3T(58Cv+mrYGMLOfJy6Sd)ZJu4BgXm
zIW(CM0*J|RQmx9KS`?F{o@Etp2x$<UyleJnZ8G$Yk-1tsOVV;=FNF}=ysFBxF~1V>
z2%x}nf4i^AQ&GNCOn$~l>gKzuNGX8<UE*`KRY+b*=O<LjrWULrfB7i#JcpSvV;<PJ
zCa}aXN&3~ZQXVNL=T@b!B1#Uep9lwxi(#wD(enxsAjMxYDHvMF8g){YDjsPDgcO-p
z3VVJ-xjnSconU$v+0j;g^0u@FGlJ)YpNeUhe|AA(Sr4H2Bb{a77I+kb7F|<L)#^%9
z-SWJx@up6;fFDMx?~V|1xG1YAin-bqw~Ty9U45jU(MqD?BddpZ{W4xJ5@;>83Q5EB
z1wBNyc~QKp#Rb9!XYOV>W1$S6-{yvYep-q}MPv0DMHdX@;rospqz4+HgaAKg@uBY;
ze;H^3?59LdReE^b&a455<4<uA%VvuBkrO~9&{)<7N``v)cXr;ad2Af>|JL20)PqBc
z3V^%tim`|8ZfO}cLeOsS<P!~Zzw+jLcK~$cCr{DR0!oCCq>FOfN>NskZN_cwm-uRK
zOKY=kdLlR0V!Ad|D0ijA?7MIJWcXj7f4opCU`vpSj4UX}iByz4bGKasvBr^ySr8I&
z^8n&p<g@C$Sjc(D+ybApWJKnJI3ZeC>@dhs@2jKA2N1%$SK4u*q|=kEPo+*FeGsPP
zL(656`FYt=Ki8hepcFPvCpMpe2a2IbXkFv>y+ukxdVOd*HG+wh{B$STc*5-if7Urs
zW0qO2s^*CDWJ8`DZ3@O0!OoUM)g)yz^}L~_WZ<0(O&`{yTI(dOYI+p9tW!l%KxYQN
z@Hk@f*C*f8Lg@R1$rq#Hz%Ff^cyC?28>OWm`Cb2Mx#(5&zHhB)Ogi@~ienfcRpP>>
zi+=wV$}1ARQ07Hht3~hmh`rJ^f0)l4H*o?`Jx5*b2SJ{MsWVm@9*d{%1@pE2$<I6#
zF==<=lU0t!G(6uOYDSyDO@kNM@eR7%$1^4fj+X`;l2_N=Wr@5a|EYzSWL<YL<`kVw
zg32OerHB}??s@Yq(>SZ8`T~v=Rc^ttbto%1(qW+{NHp@1;zwABLw$Okf61y=AlVN`
z;_?(JQeZ`R=~Z!7GU4Zm`!!K1X#`h3`+S~{5hf4<27=HHAz>l=HkYtsupsqxS8jf3
zp(`iSKT$j^!v+VRtO7Vj^{#?7G0>eFXi8fgFTIj_-otT?(Dd<?0xWi?ttrZBIyMQK
zQQ!lh5Ib3d8y5`Fi51Eof5%QbJJaN(MF9k3<o04nz<kh@4<JAkvnn@VSEh)-`BW=f
zhoY}^7EHM}<T^!?_m(jj$DU~4$dTO2Ta>DvI!-;vt00cHTD}5nZs5$b>oDb*<c|6w
zOu!5|jSJB>tdg%85Ol*jeP%K#X69g;mrI7sAYZLoVRoGy2t;Hze;PLfVB<j)_mUyD
z1KJ`rh&@|<fC#6{o{WLAcn!B0<K@RzcN#I63u-$-+?IYI{Ka4u&FYTkMW$lrfzPvW
zUo01H^(15@Uy6z&4mqLoOOUpk9rVB;=TY!mL(GN5-M2fCXV1H5$m=Uc(oPZ>B8i{y
zbe(CG%=Qs5S2{vPe^pz)DoH1>c2xMJZW#)OoFk?rYWF*_gJ0AF*=ikfSwQ}|;{?Hs
zOYZ`lK)ryYWTu?MZE*NXMk|tdSj0$j^`{a`T%(uI%k1?b`Zvqpk1u5JSoav^YP4Y%
zXbJN<D-dKoVd%l->a>$4F=2)#IOvd=;NC0>31dZCw&p#>f5bR*TZEZ{6+y!9_guf8
z=xU{g8#i<=CJx<vT595A<pZ}Zj_U!MKtv7f?~c&HBrr%{VWg6Kmu0myF$(M9_^Iov
z2#od~k|P)cDws;J-V}?a%7eNiaE|n%qcI<i7HTG>W+_9{>N@@u^A^X`;CkgFj;S+M
zDbesatLxz{f34Q;?(TSYUOIjCbWCbS)P+->c2ToA@Bj+qPA0MoCiahUWN4VMp%Bcv
zYBUXDg&wa$yrJidoa+B-JP~`A<*||xMf<fxe4=GOzCNrxYK$2Akll|^ah#tpaoYg5
z0kVFi9tWw5(#gIr-QQ1McCzpC>avsV-|5ht%oEIUe*;*ZST3A_k<B6e_*9yjW9NRH
z`~$t|i$NnCPZN%8+k!LIo3B~?f!FJ~8wDGu;m=n-r~(vOL=z-xkf1pOX9DCB4EIb{
z&;f=7jj7E+)a_1eC@Yp{c5ZW<Gir54<}<~iVs)!bMGW2fC|xnZl-QR2dU92qUY6xM
zY3Z|pfBmfG$D|SUj%;odQ14#!#n9y?Nwh(>&T2C0(xMWl-r(v0SDA8?wuB?kO>q~-
zsvxhf1<yVlI2AU1lZU}+3FAlK=`t7nOA)HN6>fCTq+zGAV;S1qzm(Xy9@Vuw7k`Yy
zE5JogE{h-Y3;32Qa%V8sAo@ApOTE*?`wPcIe^#f+!0+pOeR-+7;4TpkJQ<%dO-Ack
ziOl$VHvUogzjP!fD_Uce5nJHaIqh4FqQ>_9F%sV(-A*ESU}>-rYEx;MV!2X2>&m-x
zRg(_<ImKe=k42?uEd3VxT)(5Ecat`h2^jiOH`F4$q4@XDpKzz?VK)+-OGx&pvd80M
ze=>3hS?KTca%rN|C>_b6T~!mfFobio5TM`NzTDo<&Le>!ep3|h+{=zS^+P{rN2}S$
z-TWrI=b7{oCRZ+g@!==vAU%5hJlxzn)~`NuCl6f98n?o83m<kvbDGP-2~vzCK_m;o
zXsU3h6JHh~m?61~oN{S2GzJrr=QAS9e=!-(BxC~gU8#9OT?&tB3-x;)z0pw}6qZhv
z=X9Nx#XS3g^+lpp%0fd35(Z>LCmZhc9}L^^ohTv^(tws+@!Lc#oSHU2{OrzyA=v>+
z3O?~vySCM%6wdR~_F&XJP0eG#47ReYn+<+H*hT1&wv%U03#{-czzAtAgJ}5|e+bf!
zu68<_KIx<eN^k=FfR|gp@*Nh;A-K<a@{OnN8#tpT1)j+6KE3Nv7a|m<QSQTCrz8@g
zUCOWGKVeZEAM#&+Uj2F-n!Ey;ON-+f8**FhFIIxat0;FM&7vM6v?%68Iew!C41U$C
zm}pSi_ubNNB$c9upWk^p3~^dfe@l-S<Fz5keBIIciaJw^t=e)AZ)N4#*=n(ntaE56
zLBht!*)5;X*VH%gb=GA<FCPqRvleEIEy1D`I-u!jO=D2$-Q2UWdqB1mo8vCG-G(-}
ztEGb>)8pBT=iSGz4(~j0^2KU0k}4DYmg6HfMq@H*XS9bLMZ+Aw(K!w?e|-1N-54N7
zCS1IiXOpr5o`9`6eF=)6q@B2th->qH|MNFuVG6_1FUXpOui)1G&qIu*&am20jV4C?
z?77>Ql~~8oLNSwd+xCnZJehpE-Lc?J`cRs?;=6HLoa6W|7qV{WON)dU!HZg3Fm+I|
z&oubh*PBMo2Je679^IC;e^cMVdL!(1C?yg)d;bf(EyMuf{%7IzaWP%h$$thaCzDB~
zAXFAz;Y5P>8ZlIS6FjiW{-gfGkrImnS@@ZycN(wU_U1q3KX%@v7M=MQW<>lsyVw2v
zt5jOq$vSQq_OstNiEIDS|Dp5G#<SJZOA*<h!=L{r==>9>idUfve@W*bJp51Id6h#&
zFibjszx(k1rp`aj-u$N^8}_<s=I?j!KLE@9!`}1mql5kb#4}F~piVZwRS~`m(LL$>
z9XI#2&fmjX^#ye_)ePKk<NSA;PF2iWU3{?v=V!R1ra@uUbF&I{l`Z`M(So8hQU&ym
zk|S2HavghC<TSq5e|c-dBzbpu&y8ZI|IiI^C)*jiy8?*mgo^?;7i=*9oLgD<Q1<&_
z=AT2ykqB8Ld*0oD`K-P6yh<~naU1bXFW&!LzGUx+SfSCdJR)y?`^^onH^?=&Y87+z
z`JIRHER7e9(%^@ic^X>TBo=?55x2uSe|Y`0v-kS@c;)^8f6Mv8NezEkO%%6gZ*@UU
z=Emk8AAE-m+kX%@CO$b8>EK9uT%0aeiXrl-I1@0v8&{%x|8uk%FGe|1(aqov?pMpY
z*jGf$w%$IVNUtCoQ66Nz00lx?T{SJk+jFzML&=qSFv!PdBXehT0t-iU*J3jF=-)oc
zRxBt%)fB_Bf5o0Z8#5&s79WfzQVq>w^_*ZKX4+PO#l!-5rRFTZxue&m;v709sZT$S
z#V{XQT!rlGwU37&n<@KQc-LXdN5ENv-Ylkh1aZK|bibE<U)n1}?`j@q2-+5fhG9<X
zNLF6NQ2ktTeqoI5wH`PX3CYJ6!YFa12##~BADQ@uf31hT>`}R5l<8%0_Aah-Mg4m<
zcRW&~|7J^rW`75Kz6F!utSTR|FW|a36N^jLL)-fdt+BxRBR8!>E$_gzud#-Rt>&ZL
zXTj>IB(}M6onWIXq7((iF0)LG1qj+xxvrF7;$NRUv-K&}D1kVK`@bFNx($})K(0%$
z!`kC_f7{+%3UsgF>)#YaOmfnstCRU+Jf+DqL`dDyYh9nVAoFanbSDbg7QMkM{&}B)
z{j%1$W>!VGE$CI~6ynv=Hxh?X6#DELNace9*px+}^eijWM=PI-J%8;3#D_>4iQ!oE
z&Pg4wO|B2b!PfU*6?6Aeh}}`hU4KGreDPgje^8GYrN_qZ4G5P?pNa(U#oQ_MfwWSe
zP-e5pHH&G}i1YfBmQ(Q}T{|6W3Ki2a&!^8M3IV-0v4J5Np4}gYO5_aZ8fh$^+6`*`
zfc1igDGEk@#9<9ji$H)i`iquO%KG^mQ%yDbB9La+5>7OWAbl9Kbf4&-5zvk&l@K!`
zf1EdAw;RqQrrrSYaIWD#A9Fal;W*xTB(s}`5PZXGd+U=*B|_2>?^{J-Ys(g?VF0zj
z1s@Cgv_yJZ{EPzcX(}0|S1U9aKshv`*1wY*6cMuIRDcmHQEf+MdXn*6V4tE7(|S6(
zM()*_#xWp0z#k&uySexx;}N>SeAe?yfA?;N)DdE6gwO_-Ikn~MvXoF)Z(wdeUwa)u
zL}}Ph+`vNb#chE1%iKv!vqUr0xRT6mUddTjuByp(6glJ%jn%9h;<T0?HMz>iqk4;c
zN5hVZH!4<c2{FPx60_Awh&%o;vq?4&LqV%|Jc}OqZgul6t~Tr+eI6S~PT53ef3Rbg
zV{$8e7x}+{9!BC>`D>DuAG*(HOv2Ib9w-O(!UR40=P;fDjRnT{sQ;tT{fEB$qpq@v
z_5P21_uXOY*o>~f+k9HpG6}T9;Ev#md80(BMcQ<EYf%cyzZM0OTggQ|D`TjZZ;}y%
zM(4Kv3o%DpdCf?m%x6ArWS%b&f0Hulsqa(`rYU#ZQ07M9yJBa!4?L=cCPYwV6weUk
z02DAe%B2~GD#b~RLxlSb)k@B_Wtfh3f?)=XhEitD<28-Dyfx&Qk2F0WPnN9yK*_OG
zTwmj#65Shpvw#0y7fsa<2mg%a#Ys?tO#-4;N5v8WPWXmYp<c~)wRyY8e-GTp2fBJC
z{e(TIxnSY&2}@00PNEQrLyHoCT&BhHvK%G&&m#yrUP3yF-uonQ&fW$gVQ$;pQ*12y
zdvS!3yi_AR2gihT(ZOywn!=Q%4`Wsuv=Eg(Gy#&q>z)<asz!XPwy^8Z<1-8&87IO8
z_SOl``4CEgU(5Wo=ay*If0m?j1mBF$EEhg+45xML!szvhDS>E5<8#N$yA@Y0Y%t_G
zyN70|YizY2eMR7!UMdJ*R~~a+6&!;W!URbNf!RTsB@!PWc29Ay8;g%ROU*A~reYC7
zfOovq8?&8EdA7#ab{xgN*P6q62oT7(SpJ%<TM&&#N%ubMO8Z@De_m6C>rd*|35U^q
zZjq~iks>Gr3aGlVpt`83l!RWm&Q2Ve`AC==K9l>$r2I%M-xf8l4Fg5)MIKM^&*IX<
z;e?qxJ-ZV40`IqkaC3%oE)vS-vjbfN23MHXkVCX!;XNr>s6j@yQ>AhW=4ZUL63&=p
zmCm5MN`SnRV5K&Oe^{XyP+Ub)2|L?~(krS`Li~s<rGaf0s?;;iB|+=8_(Td`l_JA=
zg(w!&5{)Yae}^-)Lx|nnJFe;iRzSNN&tyIoR)ggu6Tzk?A2NN^K04s@1HI|DLOaPh
z*NiMZ)xEIC-6=J^eJRa2CYI4-41@~21TjfT)`2c{pK(!6fAaeBvp(Xdo{f=*QJyce
zV+4#waf%+7t}mgaatuNnc!YE~WKDeVV<UOeeeSCV{TR-{b9i<et=2l?!!oPJWd(-Y
z`m|f|pAS?P^RRa{!Z9iQpG!N)G_?=$C_PY0`a9;P-t&|$*EJ7Enx6;Kw6~k6lW^0b
zL1ooDC%wMUe<$M+M<13zNLI9|aNm<JvKvqd4#9m+&fzhbM+^ZRqPk>Mg3gzygW43K
zVOY?iO4edTw>jioi98}pV%DZRo(fGRI1@vveHO9W$R40f&zdLk*mV5rWkI07<DI*$
zZg%AEvbcw(z-d^3V`G;kI(aRSjy|LXJwqn$KBQSme|uNP2FLDLgkcQ_2&p3)-~?bu
zg<K(sMo02>&mE_{bowxX&<-u%ndSlpV#e7V5=ehqTqAG;5d|ZpUe!)_VVrjuxja^E
z{F;>_kCi7$wQ8C$S!tLQzLPPf>m<?MTv<0y-b}&CWRZ!qnTN9ccGWNb(6=}^N9Ez|
z!=o43f0tj}yB`RlqPwasiQ7<Jrl35i^QyOmMul32%f+e~c5dh}0Li8hw4l{*XodKK
zBrrxqbbO3Eib8;P5WU8tv<xb&Rska1jY=LEI;N3dv|C@SeFafDSHk;$gx*5VBfW~b
zA`Jv{rwJB5k(+%$wuLRV0iSpdhnlbe>ynvoe=(LzBEnvr)0_E?1gAK;{`K+xqx^ci
z{X0C??{ibcdm-Dt=bp9zlP~bM`Yqe;1*c4JN3DK?fXAPI&eBU?w6mWW%A)ecxl=rf
z-?=Nl=r_5a&=v*T+;*SaIhs!|`eU-=+;(dFfsLyt`pP$1ewCwY5nj-X?$K=ww~cRV
ze;<DBU-?~2Ya)N}SWvSi^_q2tsN(Hb%vZO}PD$3CaNMMA@NV6L1Kbs{b@TITcR<d9
z*WIHYr8`e@_yGIITzW;S8Tm-1BFXksw^O=zL_q<`Ws)(>ZK=G2$?<6|@R&)jvjUp7
zV8A*r9a;5!`1T#gXH*0#G;27MgCMqkf0^=#j969x&@DX@p({LTpipv{Yi<MrQpJMk
zKa`)At7R?S&%=twjagw90Ey|2J9LCbbp8_Hc~YMUI~rL`w~(YR@Eqi*`w-iZ;%WLE
zQ^Cl45}8o6cPkb3A0!=qvS>(h^GsA-#A1Jt!bwvkS;)xfes)LX8Kd+<-AE7fe`C|i
zHN=MbZPzVrm)E+?BM+MB+ViwCCRTbWl8eT}bzQbz|I4oT9mxlxwrh_QEC@y~hTL&j
zxO`gvs7c{gv?^-;tFF>YXq=UR(<f=kpsEPe3AJMDKVry>5^)&&H+AxnTINgB*1V08
zr0+M49#&2olAV6wr%Lv^sfpgce|eDVU$KFHS?YCi2nraK+-y78!W(NaCtX$O?p(LR
z$C~SJMR844t?8(Z?|K_kWH%R+p=>39D&t_ueb+ACVOk*I7OJ?TO+_H^Ea=&KiJtSg
z*n(JZ!&zZC+As=rVu(|L*kL4Wj770#t-LKb#kQ8P0#a2uhnF=JO`>(ef3le<(GoC8
z{Kabn0ttTJl~=p^WT5Z$=kK=7T+Iw!oD$^C%2UC%Ebvr9-_=$doU+VJ=5fJ&C56Dy
zUqT$X&3|zLSk+}@fkpU%_)D~0bWW?Rrpu+k>u!Rv9`&@mHOSO^gG*RIN<c9TjDN*;
z8VrS2(FlMD85OXIXo!H1f2t6BcNdbMmwkP}_6Jk%7(Mo<r|$ie9I2@z%O2xb98o$o
zK;e)q2MPlJa@obcar|yIx^9~zK<ny;Nx2DsSoPz_x*r&E&<!5<!}H|0^`d6&!4PX~
z32u2@y0BQ=&iC)dJ2*j730Z*aKDStt*F1JuL`{pYyUqYp2I}1wf8j=u@zkqTj6Uqs
ziVzpK8o#@h5_TdqL{aZvJ_=~>jvuZT&|^B0mnNh%D<C?ZuHTFCdOco2hi9NK7MZfA
zsdVNx>%gHg2_g5I>L{tWPGC`qW$T68#tUY-vlNI{t6Sz5Thx2!0`cP2-;=A_V>cHP
zx#M_a*F6PWtd{!ge_C7Jzpjc^QE5E89}Rpz!_>?XPd-f?Uj!3}+sW?UfcMnW+w@ut
z6%#681@Du=#QlTaN^0P~`*H$gwvqNFggKm#Rh_d^x|%W&Qmiq8tHjDmBnmxxAT6DM
zfl{xXjppSTZd;SlfJL9kXh=%V=i}bxayq%=)}`;>>wkZ6f84+7|KxYzFSuF_R$!j}
zpT?tK+L>FAuYcX`dYnkd^t#`+S}KX`W*_e&YWX;XO>f_fZrzfk)J-qnQ2s3fcPXF<
zWvBV#6Tw~h{($eNt!e0Lghb914gUmaGX%_NZq8U^QT$VcJoVoob#H~cTL233flkVT
zEsKa*fR3$Xf5ZLd0u^HZIL!Vf8~*$M<Nx)J1(2WRXWZX>*xD3-JBbS@3izfVf+Q|X
zRe?PXile3q`C%y5z+z#iux=Dlm1M`+ud;W=b(IX1pN+>V;dRMyc?lzCt&td!sAK8k
z{}PpzyKU|{?{~+ut}S&N1xuEpmQcH14xOrBFf;1{e_WJ;ha&!V@aGEF#V6&o`1DFx
zpHi;s<BMY5uHF`LAl-pA{*mj~lA>$DKtA{PVt*vp&dr@uH8CB?2A_)&VzCk|DLz8v
z!xd0ew<B;K*Y(w8320S(ivQ!9&xYR)d(sx5Xi&lBO#bRhW9=vuVGXt*v~p*dZQJ2|
zvr~ace`ffA4TvHS&uSYX09HV$zjN~M-wU68XqJbE@?CV`VZbgVw#kXqt&ZjZh=c8@
zkG~$q`$Xok(y8n9aqP*v$ySLUa~tN{tl@fXHnskec7sm@+tOpyi3AXajh5MFx&tBr
z@i<2L-~i@x#o3wpaHsJysc9a8o*R;knp8%BE?Y3U!GFmqh~Cj)NU2&G_r@_S0yS#(
zv67dRVgeyr4XbMIz5$Vi?q^5WEX2iPL7nUb<}1;$mt|Ti`pW^~4e&{w?L>~I&iLn)
z-~(t!OzlKvBI`7ZnARyQ4NHYDiw+6qd99mDE4wTL`N6jQt<XkT9Y_H3M8rxl51<aW
zf&a7uCVxw1)p#mdfMcgmjNhYV!3iF?epv%Sz^T`B%IH#_>q`W-|M^$E)0e8)y{G{S
z7!ZPplj$a*iWE13oH`MCa_!Ssw1fa0Gk=wS*3v<Zrz{t?>!e5xthV3kz9X3S?y3)s
zNhbg_Lm?#Fd;Z7_9=kL?i@_JcWW~}f>WIQxxPM(bFK1Tzj*)bP_SX_iPBRpgBRBs~
zNj5}o2o^-niKX0RCpyDfG&`X0>K`=6YW_d+!<B4W2@u1OL~qxNz8;fofswis^3>?)
z5A5OedcZe#0V}~xF!a%@f+#_}CqfKZq7(Gqreq?^CgQ#E=vPU0)bYW;3HpH}O~-0M
zxPR;SOh`VxUcWa|v-n`@6SNMWA4?9Gd1a#SefQ$UQ@JOka|wOC-eyErYxmqiRn;=Q
z{5?6jn(vWWZFtWt^iBOdgLXHGZZ_QW6BEyw-2;9iz&)aSZjuM@pn){>#Vc4g`go1J
zECr3FO74v-G1bwGSnH=#f-Y82%^SYw-hVTH+S>TUhTA-68o&fSP^@jyd(&d-<i7k}
zi~wRZ;gp|j(>g@TnB9A{cYGl8A__*sJ)WZbiKsvv?2vK;p+k6jr?%hZ+yoa+8xYCw
zi-AfY>nD)L(kJK6rji(I2R&%fn{h2w<<}<5ku_j1i-}as7CvJ|t#*2bQTWwPxPO@u
z7N`fCmkLg-INwu4VSnfpdAU}@VZY;kdU*~(X}wr$lUAhnpQg8kZ;Iv?w}=u2vQ4St
zFxu<tR#j6OC_qTGD%AUptE@%eiL)29+@GBPfa;aW`Fs$RzqOd_s3|$`!;nlI3{OCD
zS_d4JF4n5Nuy4h5ywns@#mpwsVt;~{Yl4->4s_axJGkG+wI&~l99Np-$2aD2&<x1V
zAT1-1I2}@`n20axsqEx6b(8pErO47IlF^hLI>ed2T?t&ZvW?>k$cDsN<dg0(%zMv#
zcY%xd<`OuaB978GB(sQ7k7p~!@EcSUh3Na;DKqM67DA55sgJR^#*T$g)qh7!Ds+|=
zM<b@?_ltafNnAu5uVeCKK*}$24K<prn04u>%!|nqTPM}d#2yG>&PjePL8d7C;+iG0
zz5lEr;q2_Vt?PK)YPQ5jAH}ax^B>Q~UA|2mBIXA|s3shm;HhKq0g{aI&oT);{epOb
zn!mAtQ~GjzaXEp<g0TQHmVc^1NXW8K)I^$nd?hvUo65u;$%Cv9eoavYA9-p^RxU2`
znXd%t?gmpGtcJoBN^v&{_^57of%BtU0Y0ncg(t=NQYCuh_i>t3yhW2;&HlJHeBGO9
zcl+`;qLgDn?6CPSmF=Tdw%P$#Q^wR%C&wB3ERIs33#u$F$)oDamVf6g7X=%@Yj>ms
zATtNyTB_V)W3pmc(wx^LLPl?8DP8z_?I0Gb8$xmmK#H!l7<X@bGM<jLOv?Rx_wE^x
zUF6X-1m-JK46ZbUZ|)6$$|Uj`>h>;I^Vm?KhMOAU+F_=5|1YnV#^=heZ5o6c@~+z+
zT!)z2G=o74=}8WyynhxuU3wo@=wje7aSyu1rJxVfn3{tY#hL<Vx?A>0!^XfSYnq%_
z;<6gF4ajm$n3ixqcLyKnWJT}73%gw%YxlQjr{`b&_Ux;#KI=~A%fJ2wjWI2vv9T$U
zP>1sJ(ETMGn5FuL$|Z(qBA)-ygnGHY=hX;*c^d%&b0%Az!hf&s8epE)(yeqX<@>!t
z=bV2+g*ZShpF;-lP##N*nIy+EbXUj$Q-$47HhUL$XZhKRncA+s)m)s3dOD&<XnJ6}
zwja`ST+j~i<I%7Hu>DXIP8<_|$7T{0)Hh@OH{MZ99mjbOk{{xQ-LJW;z8$iLqB~&U
z=aWJLKZd+B6n_;+4kR~hCp|R@o$efRTZ=g-RXJICNZv_!O>6xrJ66+|<1s3I9a+%p
z5iX)A?(OWjZOAbGr02>2ms(P7N}Hd@wqJBNn!rY!Y{u?~#AfsvZy84!O8|G2bFTYX
z<=}le96iURxU<$}8&P)RizJk%e*x#!`4R2l%Yj@S=zrD0c-9claK~WBy7F{apO)Fc
zU<LZwpGxcf$+iy;9MdG#C}+{hbE7+Y$e7LMjxv_ePllc|sxf+kp!KYBt3YAF-lRNL
zL4?aE5fFA44;FE096GVMLX&cK(M2>m*Trcgkp3joNkTYstvMq!>K}-xbWuosAdYob
zX1=7|jDM)Xh=;9$L^vwWSbykT2qt_{3x?BHXmPu-dZp7>a&wy2j=O%rj{+uv>+TO@
ztGd`~?HL$$9y1mLaJ(!h!JH65&e2;@Tj`Tf$m6!|vbgj|$yDL@<^0ypHhH?OWv+uK
zek>6Uv5NoK3AyJ(Ef4VN<v0F1fn}(AIEWg$<9}EtPI?C4{QLj%zdIsswW3QNJo}|o
zEOpm9*|Q`0=bHa~H@=`;(aDZx<<<Ele^*E`l+zN<SAI*Qa#Y@7cxZ44A3gk(-Q2c9
zAJuBgHo)%*TJ0m^Q8*ZV5XYCI?MI$y+h7s^8|_Y+c$=lT+nAo$R!q(v_SHj)XqO;`
z+<(Mg%81nSufRP{VRdJwFOhogWlq-2;Qt-Zy3=BcQq7crL|k$U)ne0XefkE85tvqN
zeka3zb5^}?9UVM9*gtkmp%a_v9>03=Ov}#Eq<^fNQFBIUzf|d7H(}5}F@GIOKXEKH
z<NHS}1{7C=9&TBu`uFaC^~Kqj#TVWC=YONmy7xx+KJShm-aqS}{kF)9uk!m3PVeVE
z*X6At3ZMZ4Uui-RM_?QE2|=jCK8Mun%PbM|dE)0ftgYy%hChG<WGK@$+*Q`wg;P%r
zc$Olb4!7r|J4%(iPKp9~4g9DuRsChjppfxsh~{PXUGu}gROM`#ZL3J?4uqi_-+z#<
zs-f$lBZ4L0Py!q7icpy#jpj*EL_~^i`J||2k@MVdChb=1QE@h5wZ~aD+^!zVnA<}S
z4dK%xRAR==Ps)5$dFiMFwq1@`mpj`gLOODoSOVCah&)EO8+T6z-q*h-@~4fMKQIv*
z#&kMHzJwOJ$^LNk;(3><uO9@D4}XdKTV86R=Sl+UlrN9QIW#>d5X$SSL<<UUFA+ei
z>**9$w=?xnl}0nWL=e%a-#~NQFz>(=qlWl)1cVPr2z6X=&-<xlKJhGKk7x;$TPf+9
zsguy6kEHhi4z)EIanZ!+^0N#|SeQxz3b88K;r{<zTY>+&_b{^G+?Ukh0e|J(m;l^;
z<qkW-5U^IKj1FUA6en_R|K|SgE-$yUy`${MZMVe_pC8Nirxe`&-B17vkHRPa+soU3
z^To@9=NR6$d#RnhIXr%n=|{4=zv+!fclBG(f7pAq|77pg_JhwqZ{rrO-t}L<4qxBB
z?WghC!SUXAPY<@EcRH@|lYgDJceDK$PhUTKe&oCJa?kZG=~L1ryDj~a>C)cW$!F8^
z!49%#KkPkyeXzYi2`2d}+XN$TxGi7B1MC^c_xkzsgQMeZKK-ZH2e1A-*n9PA@6X%O
z_obh%5$&lznYF9G|L{7#?=j13cRYe6ZE1b9%jnMTuAU`H_hjZDKY!gjK0bK9&F^I2
zeCy`%)zQI#B=P&U>)(5Jjr#jAbS7e7Qlii8sd0$@lX4-t;l1wj&}41wL<Z?IqL=JC
z6OKmNmZ^~BcnjUMdL)MUEosLc9CxGY1ai6rK8M3l+ChAFp6xjnjsQf2bh-Cl%5!9A
z3aQ6b*2P%M+fbLqOn)E>EWhrtbuiBLmbJ<KqaUofZ2{_s^gzwp&Bi6~z#xa1CX`Ys
z7EX+5OT*;Z9nZ4y*KDL0XJr^AKkkGSs_P<%|Bk(Usu%@4aTkRf>^sLVM}e)&Fr-|h
z77xU>rAu!%#+sqraYaE5(e3i|Wj^=G$!=Oi0#X;f2=DX!8h-~CEBGNbDydY9FZh$B
zgO587T#c9BU?j)hU4*bw!YVDuzVvaxIcmjZqlIJVc<^*}&f<s=J7{1bao~I@SVBe2
z5S$q|pwFEQ_w2jhS^lYy9MB|R6tMK)QT0$r0V7%_x{mLP)Hb@SwYW=J@ZtW8mw)Eo
z!s31R`sp7X-+wwfcy&As!Z#m=uog+-+3@A-<6)n#yGI|b&fY!xE*qi)1EuBdyVXOd
zKJ<FMyX~Qc!pnnBz>pWD)S`4L5i}TLA~FKIt>-s4lN+oZg&iXdl|xt@pjw?)%kh$_
zr@0f9v=_td^{Ycbc8P?2qFt!@2eI@anssA(LsQJ`=YIpJK~15scSi18qf?(mkj3-V
z=MT3<<qzy0UvMGO)hb^V_*0d%Y7km*E&k~!YB5w_Lq1qJn-M*-WX6ztvSt*{uiXDl
z^S?Ps358qs-W(k<L*-A1HCOkFnTy@qK4SFyl~d*WSH%PswZu-GF+M%6dhF4FoNkyp
z+1uisLVw_p#MNu2Q)MYoPQQwWB_0`8NYhe9k=-Rkm)aaZ5zGNf$uJs8;ni8@h6ni@
z|GYSSwC@89i=7>M(+mb~7Lry@@UT7CnD&P$oR03ef4cUZX!~oQ`Oxd-cyyMwp+KoQ
zK}E`$I{m<Q;%<qtje)mu4i>9ixLL~2R9bd3s()6rqW~)E5$^&>gU-gjW<A6YZKuf<
zZH43zc6M6$#8T6BErZSRb7rn9-zBMNUtWr33$u<T7b<%F>Z$gE3(c2ycK#IZg?(<X
z#62+rjQcKgx0XrZ+qAx6W+kDEBF4U(N*pvRqH1so(avKlL8Qo19iJwFT^6<as63;r
zqJK%t|G?en_<-bubaj@y=D~$ogDDH)k=0_-)(O{jjSBeqRa&}<I|akF4WZE5Vy|6)
zELwSALC6YN`v7|a$$HAIlK07^9C2JD$u-9r7s|E)=!I2VMX4rpUjSXST%fKci=S1u
zT8(Gg@xAcjf9|r_g4m$KYS^7H2b!{_fPVz7)^`Pw=~&%rR0O2*krPp7tk-E_0wIYM
zgY+zPtWJQCVkf*eSYj1{%aRlQn?4AKVGRVWin6H$)?|*lGklM=t99P3GMT550K~xa
z05zrkD%RmXRHpbY{$63zF&qv<W?-xMQIZR*>)DxC@>$n&ds<!Wdf1Df1SMfqvVXvr
z6w(d}7t%)qF}TCB>Vhg6k1h%I%7Nn>?nxcFhlBW9n$M((#L-+?Z#|5May*+d-@gDB
zEndrA4O*2lB%|PLtYkwExy1)=iw_Z<f#U(3r<p_A0UOVR#Ci<%*I+ziJ9~y;9N3DM
zvlsnDf>E^dr`Lfuo;-`T;@`2i_J3X;zA_shehf6<Teq_Y^s?(572{H|AGG_+@|_iL
zBJ>UdC*onN2~(Gd#pC{w-TxGht-}f2fkSzwY$V~lPJ5I|4;*uN<XSs6FY8c;!|)aq
zAEP^4tN;3j{wMH0=|ju{Q~Ilo9yQLpR;e_aff%>iUCt#Eq)Z7LGcXjcFn^#`VkjF#
ztrCl*Xq;^s{}Dm4(N-`RrUYpdToDGuti5Ih+P0)>#1@pYt>+9alfS<k&+^6f7WAn#
zlFJBMQ9o+`=bllw<HIq(+jaxv$-k>eHVCNL&9>YJwmQ5JF>JZu*;slxu%+LpH_}aC
zyBRvaOWd!;=xYngm4ClYTYnGF|9<TS82~GmMU+(gApY|tVz+qbmv0H&Bc~GJe?%f;
zgvqbJ`9|i%0Dp*aM0uZ)ecQtWh7p1E$;$ceupMIo(QIOIrXDlGTV6yNj}VO<*?z-Y
zJ%$izcieIaqLIS=*q}9*dY3Qu^p_3Uh-WvNqYRSUa?iaX4TqWSC4c;>6TP9mJ{;Lg
zVbS%eUoc<*58WgK_`cf8Mg8-=3itdsl^gux1&5a^8hObj5^d0)&ZbigdXw^Ed-&3y
zA^x%7{N#6*|I#n)1aLH>yV9>;WKH8%w=}qYcgyG0wSO0+mMpC>-byuQ#Z{1qjTBtK
z@J=k1eFFx8gl_s&c7JO*GQHF=w??T<{Q(36Z7;<ysKmCCf;$^uWH7FZ!?8tWsda}J
z<>(VFD$>G0TDX%*?EuBd8$}rjuMZ`&6KV;L(MLY8g0~c3A<XAEMw_|zaS&`hmnNjP
z_k`v%3FOg=>a^KN9C(26_3o@3E~XW-XRoBP%{a!v(*gC-eSdw&!ddaIk7&hQpX^V{
z)d&&hiY0mkGs}}TGfM+}B*G-3QsC*d3APl57M*L4qDT~*-ei)Xx1FR7tyMq1|3FbF
z;IG0HX|z8BRuzKh5pXLwDtSXp$0zm6w<r@qJWW{+n@ZV5um@v37-M}^5LZ75)k;<-
zx3%Hd(fO5@3x8Fh97uEHrC%K+F%ydDteD}?DhA$3@d|6vNsK#DR2v_sEB2xYVOq8I
z;TyX&^!Pj-P16>LwwThlGS@*FfZ$yOibtQfd}GW#7|-6hf47+Z4OrZ?0KLGBNPH#J
zs}msJv<OI=iTyY(4X%j2ihIPz|BfW@Pe~<LDB+JQR(~EMs|8OzLtLH#or_or6C8au
zRq5fW5f(7JyNqX$5yeksuHzL!Sh4?s4TJS?{|fj=!wUvobk(qk($gr$<FugTEB8z|
zd5hJDs(OVSKK~Lszg~*I#v#|<6ssc4>(>(23)q$zX-bLOKwkd+fBioc#2iJhFr~N0
zwYg(Yc7L_rL%Rknqv-5gfmy{|cPp(~OT2hVhV^+hA4ir_)#hUflcQ(QpSSItH-P|U
z!$-oThZbA5*89^WB94JuO#MnZjGr}rCM>WaZEbp7!$+-#%AZq8(C-s;Uy}5E&{-&W
zT||YCG>eQj>Q3foNxf@2&%Nx$!XRg+5_rr~Mt{;<TUd93Z3z}-<3baM(w|1LB%z3u
zjc?s;8#kn(4}~R0+(}!{#uOvBSahRYX4g*7R~<EkxhvC*X3V|$ytvx3I=2)pEVIJO
zqJ@wd&&>HE%HG%Bgco(fjTXKZDy#U=)Pf;ncwekE%pZf@-5n2CH58O0dM*m9^kFx;
z&3|O7-IKn?0ABN1JZ?hmo}0ty$p^`!4{Faou;NTdmu|v&y3QGKy@zF4G9u_A2J;jy
z2a1}Pj8n}g(X=t-N0$?vthQeQX0lttSyxWt?ejPlq6~;BAdO2#X-OwU>~Z%e*WEaE
zShpXozLqv<DEkX3{**2)QcV1C!NHkgVt-e75GVvx@)V}(TT~OA*@nL?Nv0r28A}Wc
zwTS^LYZfx#nPmk%7>0`j#e&_EHL3M`E-{}`zxhzD-?%3IKDPK+i5Js)EVWo(GNHP&
zOnFVHutXGpvCcm$78elz#p3OL5N(>sg;G`mdoz)O-i1_QMj_7XVv>Z)XA-I*7Jq8j
z2|-`1d^VZw;W^^6e4IS<hnHG$8vp<?r`2Q&1b{C?J_{?Eyguw@d+rqKAg{o^;lahi
z0Au|iWF=x4j&^x~7?-euRt)#I;z;0}6OnxQl1{2e36#Qrg0iTe#Oh*7i@|EF1^Dz1
zR&)(B;>4z(lk8(8qSjJv;laH@kbi&pPISogyP-r%B_&hb2)nCsS8lGx$~wGM8)nTP
zB^<XuW+Jdl<S=0U|HZT;Nt5-JBl891XYa{XiJvs>7V>KSla(6Yqx@aQk%RyYu~}w&
zO>dLC6O32AbzU3+>&(FD7KO%Rprl$Uu<CF`&5-LzqX7dTh05ko;G>@Cw}0Ol92>t!
zXF893MeHkxm(`&%<a9|8m9X6|AK2O#x3}9;|NU#KT>t&stt=Nk$*~=je{g-8U&p7v
z%06wM{%k!JT`PF>Wn%<Qnu&nQu@#;ff%=IAU8ATkoV55pP*p7rdhAifa#3(&!3IIQ
zQd8`-xXdT0g3xMlx@4!s#edB@Dre^NIpc=CSG&P7&`}rp)}q$>*3ORRLLw`~a`+U{
zQ2e@##!96IE7y>Fm%Z|n22(_I+G)M3iNKB<$YWBhL{OC?nhAv@B}D_Zkrg9NGnoEp
zVN&%zFaXccMTP0O(IQ68k4BTp3j#SYfehQq@hws_M_#KMx1Nr)d4K3}(jis-z!pt>
zVh1HDO5AKn4S;_Z(Jb}e`kHgO)>p-TW+yjwC5~?q0X=N#`osD)pBd}90$-!gBFWb>
z{Du6Cxwj$giG5YL$Q<i;<bj%UX-ue-^0bZBk}E3LVM-CMJEjcaOoel#x*Yph&Yhj%
z)l}6ocW3Axm*m8aQ-5JbpC87HCDQ%n&_}1?J3^v8T}Tl*iqWKIg^@i?lPlPiM&Z!F
z>8Iv>@`=hZqqr8ioD2wVk~}14!oq5L^3s2sS+n_KNrUNR{5LUml5Hf7-!@w)T<tcs
z+(pY>ZMn;q<1jY&$`q!@k%g@FWNP-G9%lV)|FFORNEsBfGJi`cuh)%|6Of}9Rj=b=
zpJey(tPp5s+cUIj%!;c?q-Dq!qH3+V>>{iQT1{H;OQ;zoc0<#Aj&x)nS?Avm2d<0d
z46O`;z&wyK#Q9rGxWPW_5;eUx;;tT#FbpU~LL(@$&wRcj?R3FP{r6>N#rarKTkAN=
z{z)sA;<y2^x_^+|s)&nM`L(0SS3W!sE2eHAdEF`2;3va9I9a}zgqU)n4lyLP&Jw)l
zp<A^DuNrbQVeGTL!^}+y0=1XLTvI;Qb6kC?Ms!QdCNdCM0j=Ha{h>UyY>PO>O^pEl
zyZk`tnCK~zNpuQ?56jYGkg#AZ@NUn1!gx}}l`Eo?M1S>5^Z@DjOb;S87}(({_K-?N
z+EWiGj|L36K^2N<X8drH*$N(<u%HsqFe)a?oYmmUiDLh=NB9{HQ1bbCj?oRMk<y`%
zm^uw}{eTL&Qf@3eIy&&z1D#My4e8PnRp_6zT4f$tSC7It8V^$uiWCv#75V60cm}C+
zdJ5L4pnoUF$1i;gaj$s89S9aimR7GuFg5&xcteT?mbdt3z!8>Uav%2?^5cBxY-1lU
z^6K(*Jo~hLz4UL#Em0s8^@%|%jS^wN6*rZk;}wZSUQ8S;{`{us`#ywBSWlP+ivV<|
zoeK;%j+T7prirLUd`U&13&t@~$8`$kd9l1^Hh-<ern$Z_o!^NM409pNHq18Dt&fv0
zSBkF0e0OrLot-!F86$-QzV%b(gaV-^6)nU(5uK2lrzu-Wzbp21Ng8B-xWtjyjz<uj
zA5r|hb&@jaZQT@(i@I;9WlOdxEzSzy0kfW?#L?~D8L`HbG&@6%9^2WQ&#T*2SPV^p
zlYg;1V}Frf5&Y~Uux>xWUn0ir#mD+(uwW;io8bOOIa{)A@Qe<4+z}84+;;k7e*P}+
zWY71Gk2;n==UD5rKOG-;B)01NefI_t_1ZqRJowz!HtI|%ETWv(hYUJ@c^Fmv@|ixB
z-;hq3;ejH7UaVGDE+p^Lht%pmS;}VDgnvkENIn))l-$_IsQAPO<#1yMHNRhS{9=o+
zC_<MdwvL87XnE{Bz;-A{e#Lzavf)OtYSh5_VwVw|EqRl^!*2I4uC*M3V=u*G8Tb(G
zTvg~ZQbu}FZL~t?0Xr!=dpJ$owg)=8uR1g=7NZzD7*)h<T@tOV%Cy)kZDaUu$A6A*
zGOkd;i6&VFrbOH<vW4i(yfjAXXFE*JBNB+tP0$l$W;D8XXXju#Uxs;ePcO>`_RG28
zL!OgL7Q5I;LLNI0L=C&uKJJ+W4Sb^ULJJrk$BoIIdUbFKmfYESh*D+M&Q32o;A8eu
zE+W3~s&V?$YsM0vy@U29K5wviJ%2$W6bQE^%8?Y>U4{q{DJG4MzdWoR7eMn*!Wkq+
zf9TlWxQ5Wrcltv@_#CKolKqUpN>o-_L+}YuJwLDgA-`NZ!#;v4kq`O(0T5xHQqfN)
za$CH*?3|kih{;nzhz>h21fr0W<NlenX5|Ayi{Aq@GHFtFEcOd|MU*he{eK`0DgFA!
zUcNX&Yp?7)*1Zty1U8}ax-6W3`_aME148+{TwC0bX~zcT^#UXueYWYfI{C)=cyb2+
z90aV_G*3bF{ltVRFt>p<P-`#xK?=5LVMqIyAWW$HBs6TPqLQ!`V@|zH3Kv+Kjo084
zq(ysM1e9#}UEx0Dv?YEO$bWDAxIx8uQvy~I#?c6Ha)aGjcYP-c92d`;JK(8T0W_@u
zw1m6#-f1-#x~29ly@*{2UROgvu!-@Mva_=%wjeKyITl6N97+Iyu84tYrRizH!t4vQ
zfySU9<V-;Rcz~%nYOCI|I9>PS3@CO7?gFtE%bJSIVEs8b5AOFge}5=<U3Wa9m<UVN
zu<L6r;tj28o41iDJ3)#*jf$&rb!l^;6pAh1?xDcv3r(LPu04~+c6I_wWmyu(BvHfD
zj)3RZHR;4zGW$X}+|{z+6yX&UaA)VKpr7%{NW7JnJgJ1?#MDBX(!im!d?g&;)>?u2
zi|E~w7&ugg1kX@?qJO>Y8B#_ot$`%m1R1p`(^FU|m?%YTNIpzdUp2;b!gO9b-n9&R
zbZjJ6zn~XN%qL5GK;~NGv>2V=JUQ_02eVYzRAHVt1B~C+(=!PYzyN`;sECsok+-MQ
zFNrGyyJ97E;-^4}VjzW0l~ZD9r6?_zkKjYhZSm#-0z{k44u9b98I_1|&9?tQ+{YtJ
zr+h5o5XJJW*ESyFs4%B3PfRIlej5TT1i|NTAhIYD35o|L>QZLNH6qS&t{@p<GPU5z
z(y;h)8BHT+l9zm8X*?zgK(N|y3WQl{!VB&w5a3TT(qDFelJ)rIWcMd)mFU{Pyp;%8
zSia?1WC^I?CVw9X*S<hPw-~jD8ZCm+Q?tS!u!-ScztTfVLy)hcNv1*Lk*jFN7MQVZ
zLyMPJlI{VI%%|4v-pIx|M;$BJF&Ui!szA*?t(InlRTNre3LBvYGyPwjzB<rd_MB&a
zK8n7ahitI)d5&=RydO;A{T;kdT8X<JEN+ajO5PY|YJY=e)0m!JH(R^*ja8r8d4GDX
zS=a2~DiMb@d?#%{mdqY@dIckv_>5mXj@XJB?D(OFZ4A3Gh0&otL}-aUTU;gOROHp1
z#!4x{=E2P7R2y_(#yrC$Z7-Kf+w!E@9pr~M^4S+$Gu9(zN20#%>|o<N+OqGBBpg@H
zAG7@qqks9<#=-=;ZavbklH!P5VB|^Hsx-6PykB4y;C{)k2L5lqcia!J^b=;%Ob2X3
z3Nrd#C;P|sOijXhR1;5P9k+)N@VpYwO<0^()Y_A)@1VdZSDZ{;B^RcDU8e8E3H11V
zah85*u6BTMv0a-x_?PR`=cbKr6}Cup?4bg0iho0ibGUM=HuQL$(i@d`44l(|i}72y
zH~%alk+O|3{}+bhLDY=sznty-eMzkpKLnOTXMO<TMxWQxX8cM%hn-kIh?09i*B*pH
zATgaEJ)3Bwf*b1oWYJp=dAuCJSuhM%f^ZOcAOtHo%o9K|wsixHmrbYiX3<xeXB3;i
z`G3GNIQisMhKWHqt^!<|iID8}rGYFtkp~dNRTHyqWM~J7l954Eut=UHW7-p|hVmuV
zS?vkI;u)@U;`FT#^WW`K;MCij-c?58nBX(>zsQt&WBT-z{!%SMI-Ta#ZhFGh4vfyZ
zWm32<H<<6uPa&EYO=sY<8lZ6!KPnc%uYU&Q0x<HYHb?1G(6Cl!x)Gr+;31@JWH({s
z-tH}oN9;}sUU44Ov3F@_gYyBB8|uFB$52GYrqAyBXL>ev70u!%tuq|o&Q3DIot>~l
zyoSb<<!;i=G}1R7VwzUNI684l$KpDVx5&A2^HSX5H>CsWQPy-1B>;GkS+*96f`8)=
zV#DzR!|iPW*5mDLzN#*V{o&l{1jDv>wVixFUOri!W_xl{S!3&|A@>Kyh!S&itj%j^
z&dO{4>iuJ$h9jJ_%Mwu!O!#nXu$slQ3+ayf3SW;T=XQV|pA(s|Mm-%Fp3=wqX^)_P
z8WVJ1QlVLa^$4^S&lV+MbZtUssejrPMm~%L^C>>Tq0^l5>6k6kEWVm6%ua}1k>EpN
zjP6scf#B%*9Hxq%;2HXpd!tMMSMey43lK?+Y2XI*{)9wYV0YIifuGzUMr?ScV=lW=
zF<xOjw8}Vc8illa*ZFk9=Jz5|!(_1kslrD7H<UBHS^RJp>4B(!di*|mvwwZ_3=LJ7
zwKNr{F)da)<w9HbxJoa(rv2zorBi%_2OC=jO@n_)989U0>*m-CLV?oQ1x)6%N@Hx7
zU2ch;oksrTc3SWwZ(C6h#m%9~CBy;+yW#7@HtR9?&A?Acv^BjSOT;3H`AdD>Av)5I
zrW3s*yzjGt`n3~ZQj?v`qkqdMJXsA4zUFgX+0hh?o}!~Hy*&`aa7@X~Yzad#H`O@<
zE3P%b%8#p)P4jmu2~FvW4PoW;)#+q>M)QnEy71Oe;BL?!8S_XQhz^BbqGQ#B4je{K
z!j!<Gp+d`v_I{dImn|njPO|QkY%6(i*FN<1@ryqmJpXnp`|qvH+kbIkD)d!FyN1Nf
z+;*|%f9==!Th`k}J;(mM|8-P!?Aw6nA%JHd`wco5q2#4vL5CQ2(a0DN^4IhoHAnnI
zJNSEk?i-zf&|QWLD}$9<p>eGdkDY}u*120?#_&kbO&1lZeQB{O!6%~O;KMi12K?$U
zOXGEg+4izf8rMwVXMa@7>Xz&P*%s%4xyR27RL(eg|FN!Mq@aGBCs@wwlMv^#9^o}O
zn~V|H(Rb`w{#00&6A2W$;f*;T2ydy5dh*H%l{dV$aJS=6W%7468J{k4*6a|R!ewe>
z;E{}t?FOk<hY?fztg4G5{EU}AkWw=e08tfhWgl{0H>B4>&VQLOf~BQ(Ub&5VEyh5O
zhaJ45(qKokt`oa<RrgvfiudI^qH~Df7qy;F)!pN{k{3r|LsticW6&yFGsZGDOf!N|
zZRFa^pzNK*0_57NJj6oK%7gWbIFrbk6x}r7Ts$9QPgH-?4@tI|QtYRBo*IcCKBx`f
zpk81>>weo~<$tERJ8^T#JX#cR7W=komjuh7Tnk^*=G>#LHRz|2CXsT%eJ>(^JD?m_
zG2%+dYEUqB#LXc*)!%Sy8I1=(Cf743d7eo&fF6rd7n((MBQL(_VAHq^i`7LNp+=>x
zcL*jg&k?}oPfpms75_W*fi<ZGL(;MWSYT{+wz!@zLw|IB6u#=uWDgOIp2B4Mz8oW^
zC4Xmmkrt}{Ky6j7N8!^E-`-8<u{L{g;$j0sHdwIN%}dcru1BA*GN;-~z8ZY?7)6)M
zpzaz;#}Z9L_CY>tLDK7}7i*+agRY%hIZ1{>8EYISC>x=N%C%2K3ywt)9Z|Prs;*_?
zN1D;D5`V<&LpA$VC9`?u-nkZX6Cu8J#HEX96e0<ohm5tg&4FwZ!P2*ii~#{tIPe+{
zqI;;dYMj3wS%sVcEvbT$k!Q4ob@VQrMqsP3y``4q^RnD(>jTxM2RbsNZQ(WUf3V+O
zbN21+yW!!x?ccSk4Y#bF-~EFddhTnOMHTm~xPKK6ejN82W~EF^{{GnXddWGV$qgF!
zbws@$89)mk@-SiWs!*dy_T1RH0qppSyl9bUSJ>aaYm5oLP518Tv5<Ql&Muy4YyF4h
z=x&Y1V6Rh&;xO7KM1E940BF?mvikKTw^M+lH0Pq_h0Zjvny=uw;rwFPho}8@LJI)3
zihqkzM1U4yC<G(bfN<X%0A}!kXmfMl(uQ6;Ey}Yx8XHiVCDUUK&72@>R%Y~rQ_4r<
zJXcxFmZk!Ez(3{i8nSuN#1vbt#>+|MM(}ttj<;|;YFsX&D)&mgQZ2J18KRm`=ua+z
z9MHl`;qcKeTO#wap2uVrZEFXl(<qxRi+^_c+d<Sw5SL?`^zU}V@sP<(+6-LL0AfsA
zLci>TYUr#_G{tD)x2fApq2)r9i={hVs=xNc3L;b=1*{xv&muKjI`CLfQpRUa%ym0(
zBnMd4$hv(kR1NL*@|j9KwUeG!3SU4dj7hP2R>W!|PCQKw9WRWbop&I2YSY{&i+?DI
zeaUPE+UD%bKAhszT&Ci2Y)n2riEM|r%<+LH0+1jcT26O9z1F!C)AeES3i?q*ApxA-
z$+hf3WszpKagC|rCfn0jX*^r?^9g|D<kC<gBGVy`Ew+tM4gu=5noVF|U;AdQ@$<e^
zI7(YzYuKFurPYC4r0#6r1kG5{GJoKhI8`))5inIKHv|^Y%ffM|mf$nW5Y-ZgeTF(Q
zju?hysM6u{Na6`S7%x*i4VoCw3<}H^!5C{5SvQ@^KpGv`=q0?AT`Eu%h1RWBMw0nD
z&m8fcf3s!EM?RmY$_G7*^c!xWG~+j0vr+;qw!YoNE!MsIx}SebO&`Vds(-YQJsXfz
ze<5A3N4RB+oz3YBnsCzbB}!e7mC-P3m_`CAlqpvitC_}gju2ezvz=KB8sCe-KS1db
zlk*y65E;aY@pSx7q6!7;4q|vKq&$Rg_}s9u-$%NO#ADY*Bvk7pJSWae)(5)nCQY>=
zoSdrqNKMB`G_cV~<T0c8^M7f2nzfYFYI9&@i~t5dI^F8id{pREk|!($n4$vM)3TBy
zLbjUUC9>C|Z4$`2_3INXlzjvdPmam>V+!$3y{qDM-j0~D>q13iq}%1NM@gM<FP5i=
z4W2bpv-2x@Z$s#{>0^><p7U`Upo%K&SwAz|NX@NOks1ERpANgBlz&KNkiC<9%!4yN
zOIaRTGDo|Xz=VEl#mMEzO<mvpQ!Ew+ZtSaC!+bjimYTW!a(h)*f_x{fUL8v3ii74M
zpeAq#T1_jSOX6!gU0qz{Qti%r%iuqkIDa>sGYxy$!GA*w61Bi=$6C8I*EnKeZDqG7
z)bcsK9`K#kiE)~@$$vUAaazZ6F57oSWNyc$E5@TjBePOs2?Vs@ZAhtVsTWSUh+?7F
zMk)Y;y})6kOW_Ff%XlU{_%r}0*pE)o*w5Y8qog}tGD!(OgG)`Pqg8AIo-y2l7i3Gy
zp>ExO@bI%Oo+U3VCNO+@XQxJ1l_no4BX_f~fwU4Dg8u}dFn{&N5ZVuw2hPQ7+mq<Z
zGu=#=pb<t+T0OW>{ydNyj7Lj}YmBRg2%v+fZ9A9*(_tdjxFtk{p(psRI5QW<x5aT8
zEnDsvPKP4O410rE<Ij?%I=6_+_KjpQ4jR6GH|(bi0dE~!RwdoAQm>ipOkJX<Mhvlh
z=!>Tz5dp_*8h?};Ozo0u668mlDSBiDU&B{oSt)3E6G}&HM(Uw9`OU>vf%<2)B1LGk
zEIimySpdCC2O=dsP?-l6a_#Pvg$ouPLV}p_>}))Dnj9CNz!>MLnIx(#Bj_JJ6Q=!a
znMM(^E451M6;?|V_13C!X8-=b{6Dj_C8Uk)D{RgZ!GFYslcvw$=9(6xu~ekD04s1Y
zP?(NF3Kwt6Ax41rF}?Rv@<ben8UQq(tQ=j8#dSeBCYz4UlNcqdmduEZF(qX2PmASM
z;Wm|@j_u(in>38^2T)P}kHxk8CGJ-|3}Ikr=W#xsbk8PbWfkFpp}y<7r;uCG#OfCa
zt1(*u=zm3Vcw`o(dJbAw3>Ic5xq*1Jg=##JREu*BR$<<AjT=~OPVQu!{c<svZrjIe
zHDttY=sAWJ{T?G?Cv6}=RKqs@9+%wuKp^Xl%YHjD-~aK4?EM4Zrj!P9o!U?0Q!HnK
zI@U3zKIVUu4v28?MJC#CYc;7UitCrAbcj%x6MqA!AE6*_P_3|8^>Qy8_`{oHx<*-s
zwU%Mb4n?+eAQM+4#y`CI<B_K<h6weYm^7Jmf$ucy|K;jkrG*kHgv-cQmB7BbGiN-?
z6|0_yR(C?ke%F^Oe9eiTD>>Lyz!n<uK4HNIIeO>B*rTJTNEaQSU)Q3O9W$qdbo}%v
zJAZRL0?Z3v=ELd=_C7}GW!PX07B}dZksypu>sAp_+*rCtO9w>Xfdu;kEF;Y8t_Eo!
zkAnr}2^clX*3Qe?X(wypUOuqhYt-I7m6Nxo5(@{2lOT6?p2@YygCgzXq!+82TlI#j
z!$O}BQx{bc@s{nzCXILO?6iY*%{y#aK7R~~u<Nx&5+g<=^ZaGQMrAwcZp9|8y&N_v
zBTstMF>G4p`I4^eV%A+%7Svbu#e0DIrM;|qbINx1J+obD&@q~W<QQ&j*4cJz24B|U
zqmCKr@h3fvQko>U>qgXz>;#G6^r0TIAtz`)c1<o6ZTb#}LwpWAq?Hwx*WGjfP=C7}
z*4mLUK)Kzv8Gi4y@BZ+J|0`LV!!#RZrjj5DjDam-g=r{^_<QA~I0R7$eM%?Jf(<TN
zzn<3hkQKUVcyxVOQofvdB6_fhw=jof!h*ZkX-e-cqhntlkt5mBG|P)*OxP2L%vzY-
z$%p$E2x<bTwnl<NmTTUR)~0{sI)6m~VrG7E%OLTroj5hvD%I*S6EKUqidjVV?G<g7
zvIH~U`@g?_buf5*@aW*x-toaBiHsOLK74vGRDZW&`&p&gXErJ%lr3^cuNsOIj6o9Q
zSE68I=(U(0m24oQDB-K_;Mas#R5J5l(9=u^4cmIjQwD-$a5$`sT{MnnNq?B79-2wk
zfJ*d9!I?%^qy!+|G-uluhv<$JE3KQZi%yTE<G?S@@E8jR;oj|wmtTGay5LobQ<E<2
zy*_^O;??2tp9fD~932nS^UQ#SU>)>ySvvV5&}BJ;k_+k_{w{#vQ-j5?!ktoXGnK26
zoKBvDu1=k(4Fs1=>uY4&dw+jCYTt(bWqkR&s)6qDO&BU8=Ct-ugsg%Uahu?SB-}9l
z!jfisDK*1*teSZ_x?9zuza$uTRxWv965~-lZJ0LeZf4!pfLf%-Fja>Nl7Rw9<XSYF
zXHGhY>udYqkHA~_<3T5`^rt1}h+scb%b8nTzei946;<{+v2!|K8-F^{PTWYe`!`Ns
zPzT0KJAvOEdHb>yhg*1Aefzs&nYVA0nt2YdHxZr1X*m~tudC`@f8+712zjrH3sHFD
zjkxq>0x#$ikiEC6x=01?-XDs5DAsC5JCFzUSssw=EBCi*QlmoVqVechC(wfD(lIn%
z`XKBA0`@{9=l0>=Gk*%#oo4Q%$&HG1M^kLAJ5l|1WxQfX9nYH9t&=hdvu*WtK0G>r
zlo^b_bLQyOog`kYr(9f!u*tpq6ty;vmLj<Q1LOp}v_bYWU>nrsWvTHHN2H~ATdh|f
z3`lJ$2BdDqdcD+0o5|vx6zr{hn-Svtc##@JB_THt!A4BwIe#^9JDL>5)U}Mmg~bs^
zsl{!1!+3g`SC!)tqki;hu@6ZBv{q}+F^>3>plB@W0}Ot2!!?)M(kk+wPx1?`O6*8U
zKk6vn&mwekOBT9xE0ihp4*8jUc)_ZK3L)l=!1%}w0RR-PoSt^=mfER0g2QQW&cq+5
z!H-s4nhcndgMVYn<`<-Rbo7LQHjvH`j?>9r9z09bsgC0E@l82S+qLW_6@&^pyYhvB
zp$U$Iyg0X+k#VVH7(0j^wbRtj$^kkFurC3QSyp=L2Vekcbh#{rCvUq?;9tAP-2)&%
z_ktUQ<m>|;sS;z8*#z0|j-ccUF)E&m28@6{teJKQdVdq({c@p4obM@t!Mt?H>41U8
zB3q!m&BD`*@(RoFZFawzNHo{kld#Y(D3$hJHFyg2)C(yhu8+WpAO!sSP`Qi&Lf&G_
z?(7^!n-&(f7c<$5%TBOi2Vs;89!C<_-6fLCs;&d0>cxfC70HIbf$73MzWX(!nupoK
z%JlWJJ%5Qo_E83rylxH}=~MJEg!pt>i>it`TqR)(BK!K<i3!Y+mShLNNjNFu6^6e-
zM~5nd@Qjd^(2dn0HZ^7W#p&1y6^rXNyu2{rXsC*Y$0$_*Jj4NRbP{346c7KrR+@ze
zs}hXQzSCt;nm~+@@i$8tGaS;G^Cd{qJ3AgrQGc3&no*?&dRA^2=JWBu@eoTAF3w$x
zmjb9U^hg~L;Cwye$j&7}Qk5V%*N6xGuF^d~A?5Hqpv4ILfk-A4Y&xrdz_%6w@+(3@
zlK+`)uV$jDjeMj}Tb&oRnNTlL@;w4+Ur<2v*xCAFuG4VvHD4Y;o^WJN56mb)<|Tcx
z8h-%O{GI5HPRtU_D~ipIG)7~mx36lp5VLkO*~{#sl#w;|TEM-fxP_lr*&%eni)Y)r
zC)By_V-O-2dlIRja;<-^DX_Qxh86xAhG?cCYdt8zd^k+OH@z06@Pj8HC!`@z!J8ee
zbfux?)yjEX`I<Q1Z+=d0Y}{YtLZ?#IR(~VwVwf7&`>lV~AtAJ2YnR9~>l1QgN`p>d
zxEuS%Up4f7At!AhCvuIdSqiRYrZOhFmI}hU2W$_eKz+VPufEdF(cSg6j^mu^n51*9
zA>>X=tyo^L+O!~D5u`A@PzCWU#*&D`B~(re!-(E6SQG`qjEk~$VND%HJjg9<;eVvI
z*AUfag$H(v*-H3^g_7DAAhGT0x$(8VGSHJQIU6-}M6&S7pdj|5)=(U-9y>Fy<q)*4
zTQG*|{f+?cRw*3IQ6P-~N2h+HwZ{!rCk`%QZ5fsaVfhYXuA~XjAqOaiH7E0*7T~Vq
zYU=k@bn@Wb<i5iO8~z5`=r9Hk)qj)Masl-m=6RzJ*UnNjJ$X;?zO&V$(p0SwC$EBF
zzF2@1>HH}uMq1R*HV~s($iq$OgO157_wU`i*Cj%k;MUNZhBn&ud~dxG=@AkoaI(eT
zYxFd?+x@Lhwtn@&)?1BZW6+OOYLM!0VR+#rK!|=6kxBXyoFM_l`XLItk$=eE4Usp<
zA&Ur0lWlZs<`MaYZF3dJ$gA7})N=TC-ouA4A)a)U$E<SrufAJDiXV4fGmPUbtsGo>
z;xLLJtptT2ztcEv%;M;@$6?EGHaN6oGWb^GT!iRp31gwaEj-PK@NWv0XXuF}i0#Ii
z03VF~=ZoK$^3p}AFMJ<;sej@5@AB$$Eo-v6A#w6I#?vKra_cwW?HwHq4xb+%yn4R(
zbnyDsQ%yz0gKu8E`s2~dz5Ro5<`Q8r>IYlNvY)fR{59(?vL3mSPD1I#)}zZ}GSP{^
z?+U+Lzj?xZ&no*S`){b0ns#=}UEZ?(9?ahF`aZXQX&ugxCe{T`hkqh3cC9hrYWMYG
z?1qL{Hx5tRy~PkUnrM|QXS|SEcvzk_)Fo^QtPANiOb09CAet_NJC_=Up}{JY2Wa=Q
zES;u(xJ*<Ylka_=-pj*iJFYYH7(=#x)<>t;tWjWyWD3m}Ea?PgCdZgD=|^KHA{)G6
z1YuZ7%~%BaUi%mqs((cEpLpaqh4E&x*2WTRQCgiqwSF=J{`=_tT5Aaynpn-|PG%+x
z)*AL6Ecq(bT0ul|D8HyS^C};Y>}j9O$Yj@dSZO4|lu=N{I4)dfjR};3rO*1(1}P47
zC?;kVgQLJp0s1D2{(N2+Rw;r%8DkZ$gR*88Fs+~!73|bUeSeyyBOO!}NHD9TG6<LQ
zcwD|NZbr&%tzVb!pG!U-LEqS+_e~3xEJBBKra`h=&Pqq4IE`bGwV>f#x-E&Y)=_~M
zeMZNkUY}?QZ<E&wOe(2Xrzk9-v5)S!gcVFH1~M(lk(^ZS7<ussfe1zqmckQv(xA{+
zPG)eMs9@3Pvwy;3G9e8zJVOHrSS(D}%rY5bAqVRbWq&eUn?{C0G5EuTBGTCZkc6!Z
z$9S?iH}aVtzi>reNm2yDYzm6HGFo<wMHO?m^TxU2&H!D-3~Pv2iPJ;h*FMM`E?J=q
z^OY{IO1m!gj8LCEsp#|6btFfus3G^kV#h6@+3fTXxPPg$3J(F=+EM{#h<`gHq-|f<
zLl-Q5M3#75$p;o$H)OZDyQgl&L}pTtnZKho#>6G?+zHM|`w%q)U6vJ%sKV=&YKRnz
zf&|ogE2rSJYXY0Exn;p+inq-=&<s>lG7DlkjaQZ@bFGXvA9WS8n@->=e^+?aMfM0g
z2JHR^<9|NUv{H#9gCsa_91uTV=$mnx&<ufktEHAiu%eHaB}i*9r~qJ5?w_M4d%f_f
zC=xydyidVlJztdcumq9YM|c}Ys6q`_rknGr57%!-@VmEL2}&%6C;pANcE{F}gS|&v
zVW*=D$8nuXeE`(IaKr<F9-5HYCw<otwCctcf`7h4|0_2MqmDwW#(|GfDPMnRmJ`RX
zJ~jK?UXI$)KP+&PX-JGuhd&F)yT+GFw!{5FxINH2aT-@#$~j*ybD;Hr3{I-FKElVQ
zhry}K^bvJBi!S_l%uKfs^W`)R4#zUZB@cjAso?Xto}Fn(CHtgS;&^}$zZ}R_8{A+#
z8-I9@V69$(!fKC<d(U7lav$piI9jGUvXGos^VTr)vz%<ELyyD6x*%0@E<^-CM0YQ&
zk8ZapYB(;ut`*2>>DMZQQ@4*DQ#h~$u=i0zRC{G*9^CVH=0#mC`}|(^>^oiuDVT?G
zxtfQ58L~WhJd0LVn%$a4My5L7E|Hk`vVW8Cxldn=J0aX!9`EYo?QHw#VMiUN-%ZL>
z6mK}<BvazOc4Ryi?B+ek)s=MgWnU$48~_8a)+>*Qh`+OQq*2)4>dp$yq;;RGVi{s#
z##1;KEPz{qe4=@)P~vkGJwuOr+E2sBuM|)?$Uss$OdgK5O=LC_bBNOy77H3kwSVhG
zjt}0Upv4T8QX*)Z!Fcp-|7*D}R`LGO{O_i>d#Ga_1j*=8apsN)S_JE?h=>uq9fJ+Z
zff<I80whP72^ws2?ap1-hf0%IzScGd(z$Q-v%A^X>~;1vqd{WWpf@=F5q&!RTFw1x
z3DY_Cvgo3hJ;Mp^miNKG|BwIe!GGtUN0|;Cbt5v0Y&P<9o=@hN`OLM0oB;oL$D=|}
z-hrQdn0NmM)UCbl{~iC_>wblQdibA#LJ)T)8Y&)w?`#y~9QEC2R{AJY<(N@2@EgYa
z&8okER4Ui6)AC36$QrncrTGlTRXO3}B**MBqJE6~)I9~5L~+*`vZpYkVSj%)o%b=c
z{&cpKKgzlOap{g^`3nT<$qcE_*gEhZFc#ex3=uy{=y^vbG<mLu^=bIfJx6`35y8*+
zF|uicRP$OyWS`U~gOYt$inTKCn9>_GA{=8mazR*XnZ>3<T{4MD7mMY6&y{=Gqm=~x
z`Nfl97A8Ac6nm8z${;IQgnx&XX_g!>l>{S1fqwP}M+8S|<QMdae&6qo={30l{-@Q-
zvh%9Pka(QDD5tf(#p#ixPX@4Wb!Zysi3!~a{M$ce<vRhF%YJFMf7kjYz+8!GEjGp6
zY5cO2MCo(bZtv1U#Z3gj+Q#p1U2U~t2|1UC@!z?0d;9KBTjjeg>3_{HciW*SBz7g0
zY&#*+s;x3xgf=wPM~4wh`lyX@M;qvd_uIjD3j@0EL$u1f(F$n;4U5H1w0Xt+?N44d
z@1gdr+YBAj*J<s3;y+fx+%`gQ@22Z-;|i3pTu3BGw>G+nR<J$0SA|p$<rA`F*C^*s
zc%R5df_bGM5MqlSlYd6SgCeczclaReZZ<L5BZE1L_NhNrW!HLiV~TM~7V2F7jXzb*
zD}s=LlU}d)c9_w_bSdbYoxpi=N}MoB2~2T#N(#K-DN1Bg#O7x!RTF>f=WJiW;(~y4
z_(*Vvr3-WbS3s!0f4s$$KhQzt4qW2OF&t>fyTi5Td*Y1YYtO|mBkq4Kbu7|?C{6q<
zFwp9E*==SBq03!}&mu$@(F0h$u5_T7y?<L{9qtkW6&FefVc|UPut^(3_vklUtXV%y
z%eW8ovndV*l6mFHo0p|ix^nCaS`cq*tw@-YeRp=glRQR$;A%16kQIGq6=G&mox7qJ
zrhuv0G7$KEEt@hbuV#OYPl;}!gxJ{oa#Imo%C_cW+l|gBGw>p}Ssj^AU%i&e4!bt{
z{=2p*V3G^SvgR}vRO7#i`ta=0=c-hfgka4=a0a_Y(R*j-QBCyFnK%yOO6c7fd3&=_
z*J5|KY49M2Ys-kj`Kz+a#|bRPe*{ELPHL(!kxxE!hjvRVBz=FiCULOZ%g)XoD`nNk
zcX*yilcLB<cAw3XxHPYH5gT;abV;48pf$F_3tFEs7|d{C=^j<KG%c37lupC4bwuaa
z^3I6Jm24}KsfGBMN6tSXP8`V;`Al7}f+qzHcZ1Lrm8g<vLF)j&45>FI)4HZ@bgrVz
zL9#VyReoVb<yn7b)s9om_P5?GwUAx!b~|qSi+f#B$Fk$&ryU9EbUc%IB4Yh>n?jy|
zKspmwuYOH)maXfcjP>O=3#&}6Af1Gw?$8aq<3DG?FAIlZ2Sw?Q7KSk%7sl1ysSy+`
zT+no$JbpsLS-u=3wFDBJ&7{E^6pwL3b5j|FxnqMrUekZ4q-?96gkn(D6c5<{j-M()
z$!5l$=tjXIh7@ohGa)C&s_4FqOL^OH?abX&^xOB?I);1)006Q2%B5(jJo<xsNGy|i
z(5E0i#^uu^@MA+q6XPs(5XMay;|k$_FfP9U)<{$bzNzSueHJ(t0`x?@3t~gqV`Jp#
zJ;}8&+}eNFJi?-uU<<AGG=o6<8g(V!Pf;&m?X>hLkGOpkpVHESLDvjlWEUGg$sk3h
z<%;y+b8{_bCF=U~GFn}23#q`?Ux;(@@*B=!I5{}ycnp^RT*D|>nX$7TeG?h!%*#-3
zeOprMhQ*Ig)Fey{bjf^?KpSZ}o*-?IjG!e72!MaW8PH@Nl?Ai+OkZrZqD>GmV36t%
zodVY5(IUSpJkH3;9$kUt1D`(_sADiX9N|rj^dQ*<l2l(qp$)cXt1H)N>#^DrMzk{;
z5<QZZJ3He*b6w1<fbpUcJ!@tz9LkknRTCr1q5_mI^ZB!DM0_Uo%<6$xB!gT^1ucZO
z-1vW1QBVHC^SOnJaMIbWcv^AH%_rr;JX40F8-e`RI-r^)C-DaW{Ms?Q8=de#M*(<_
zoctVRN3c2sZ79@v?P>=Kl`O`w02&S8=%F-!ir9FWvm@`r@ryK4dQ9swcU5{x8Ju(~
zij|gaAKnzBIk!k#1t9ds%HWc5#8?MG;IMy6LmNe8*oCztmUE`C+LPp%_7b3SE5%XL
zf~Rf;zy5W%n;pM+^kNqomr#L=Vpd(29($v<dLbl)6eDDUKod>!)d1M{G20OrogZAc
z`)%wnk~7E)rcJT{XG$M|Wc^9vb6cI7vu<c93jNm*!5DwR12PJbp6z=YWYqY$t!;m`
zKSnc%PdxRmnoT+SdW<h4AF;~0W`6m5OqAv)N(_#e@t)Jo*Q}5m&51e<>-NNL>CGuh
z&_NvhZZ+!%+g?XIJ1S<S+<)Z$(yMYo3~=nFgqUkuof%K%%R22Z66<Mfd`xVp4S50H
z<{2nE)uWPA{BBiOO5;!(sY0|y`~QC=n;d$kH8-IUTkc6@Q<lhyaa4Lm%bgIg{S&Ns
zl)eqpNe$60Ac??>!0Hv}PLJjxCzh=YQFpF^qxBu9h24TnSKA9yYj!<zFk7XIPxCNe
z`M2Yi>@SgcaJsJpd3u_W!^F$quElIwoL$aJi2GKxbUB{84$e^3WhvnnAnkvM_RY*F
ztx@I{q?*XwO{%jh94*VJw$wn@rgk$JkmaAOPT#5{`z<uzl1E=bEWOHV16qqw$d1q1
z(nIFtXyU};x7+<wH>AGc`8(3W#V*Tgi3+*MP7YAy#XHTTawk<Ecbr^0oe%K*0&6lI
zwWErwe$p8wqCNQ+=|`)@5~6?gEYL^_^MhtK47A;l!Dx#tMgjYUXoW(iOkrWKH8qs;
z0ncQdoiT<6v|KG_Q5vaft)me${VIg5z43|eipqp&U;XC5UqozL+Y?$Q7K!>wf=fJN
zEh;%s5s8IqI11B%fWc1stSp~Z$w78YkH$(O&5dUstITb6$1z(cN1uNX>2QA#qLP~<
zAX*>?hBIzz_=^FTw)yprMCT}<ZGEo^jruO^7FrRWbYWWo8W6<s*RP%$u)4?GjX)hN
zLUG)4D>&@W`>X!fFqaP?wSB99>)^zbYFsmhY4i0Si5G`7>Q*hvPG+|Mm>CNy*=yMw
z>zYD=!{{je!J*v$8oz(tS6i0?lQJ)t9uYsJP$g?g(UAQL5rBfMO;NDkHJbw9QmS`K
z;||p_5#n9D^YLsJ?V@a(>*lCeqg7)_4grv|fT-H5F;W?KRlc}jfp~9-;I6i=YQUuV
zobB@Aqc}$+%zhM*su5qN_7BhB_rKQHza0uGRK>;ALfXjXy<>k_RfTv1`NSI6y(r-Q
zjvQ~To9gGppN6yO1J4g&DjSHOtN!lM(E<DcMLxZ;1*UZIv9tl6ny+UJ=ZWHNBYN}e
z)A6J2o?drt;sK4sC<{q@6(n&a0%F>Q>%=jnR6wE=fO&wv1fkT#z-gMSIl1r^o&Vy2
z$uAI$Xp|~;m?(dsRkP4gAga2AD7VjSp-Q9KM5Kx9lSk$_WHzp5eyASI2y1k?C}-u$
zF?1BIHOA~u1}5S~kI~rHAt<qoO$B(P`*Br2Rm8B3<3w`IG{2elv(?yBwj|Uk>=-0F
z%1N?*40D-WOX{POxLQ(uOOBF8lHPj#`tVVo<J*#RK}LUk6c6}V0{vk)Ce%KJmE<(_
z=n>lAot<bVoaC*8mM|hOrT7Y(Nimd8Eia$;rn6<$G{C!6D?WfNdVjTGtg4lX64pnA
zz=IgI*(2KpyhL56xMP-ExmrdxYxi%9_NySJs(swApr(lVmM`-<E>T<|oXlf05VmH(
zSZ>I`tyzB~d-%=K{;R{6$Ag!9$4_K;OV~_&J&CGGj-|C2u{efX!o3(2HC*)tT=u*_
zybX=LlFl7PMCK$soK;pjS3~GSm5#U=^d@qO@#P45entTv$^73R91p3?IF6yAu9EpK
zWmJ=NOmtDoq`9*Po?t$xm{~KB88^2ki!7?8IxBx!%7Yw`VEVAjeDN6(X?Ed$#fz_B
z9qyM?M||#B**;yC`F1@(A>Yj&{L*f>hZ<tHMlN(H5P?p9M{}9Id~tM)s=k+$ZcJ`=
z|8tfLP3{Z03yff;0s>I^@`rA#^&Mn?JiW3C+L2&EOq0kkM59@KHNfa1<(8J{>|~n%
zc*B2p*K3@9IWYXyfdwW;TCHoXtF3iiYpk)@^{utdI^rQ*Cjf2?ibRctXYY}O8gsbA
z<=rY^?V?OFSSx*Qb)Jre7;7++hE!<2AuBYN<PzSoWxPkj;04Dy!n<5*{5W7*0c6Yq
zF%cXkZp7bkGUuf5=KwTzS)Cr-^98YFIop2(*i2SV7{M3=g_BVXywWsA1>f7GJbRZR
z5`%TrG7-dV1WNTLK-H(Ew-#WO&<USGvETR%G*+z>1tg#}wb<(Nc~7I^?dyvc_n9Iy
zd28IblFDK{AsknDaPQub;moT_2JKY=wjz1c+~;CL4X&~i12B=nlTpVlz1_YePjr86
zy1KaBh8+b0M?gxC=O@4I1i8LL1Q4EN0ao);bFogaP;QMQ<gNMvqJ`0Wm&@toPT!-c
zGPTf&Gi|yyr8c5vuPS;BMyT#<!b=fTO+5}JB3+i=Q@gJzAqoc*EGFd378vXwi3%SL
zBT&FTA!H-8#M5$gZ4ts)9GN22;N^cE&2vxcLrRPytM|(709@XSaj~hox!pdU3vd?U
zTEa&iJ&+m}#YMgtvHnNt(T$^VB(TI6NR$%5bL>QzkrU{ZZ2RAyJ?#i?IdOQnW2fEK
zVxp&w2M6P<zV;=Z-BG*I;sl~l{$)iLnZYhut3$)eOUj`}OuJt66+I_!0Dgan$IIh-
zv<R=p3m%-&P3$VbOo95c7jsGfIlXTAG(WZog&G>P52%Cf8Vx9ekx=Vwt6uSO%XRlD
z%Q#ZXpgGLSBMAb4VNa32A@xKsb5~9cAhc9c;L-4g61UljTfEr{X+KgZQk-62(Fib5
zB*!>Yq|D5)9yv0-<{D~LQKNr6vqDhefDQ}5;Z#LjnHD=uvkJ+zwWq!888F5x7K5_1
z)$y`Lt8g*7{<WTZ+&?Er&yHVy>|t9?m-Du4a0}z_Sf5x#q$Z&&ei6AbOnNN4;DMHZ
zn~mgDrFd+L7mIINB~B`IR`a?D$RFx_@~(FGio!5jZDJEM>E-kZ4FZ1}e2Me<teiM;
zL4>%d;OA*Ry3nfd+7xeE1e9y>;XU?Sz!YdF(-QC<E|XT5kD81JtySZGJ2*qxOE*h{
z+-ab(+f+-;hxfb5`)#JX?n|Li=(f^J*bU{c8d8E;O0%`H&l_&&ma)hXy=YaHeHhp|
z@(V+C0#lmff=QN_y{Uf`bpPCJT^~{UnS~LTh9XUoiRZ2p+9%XMal(r!ORK43OFLeB
zJ;hlnPHzN<X#IB<l!_rpw5mO}o+<n)TUbR}Wk>OGoX(-lgB&7?Q4)A&;uQ`i;Hth3
zktMiN4%2g*fv)PYx5F!>xGzDU`%W1;wU&HROj_coQ+lHgWJZ6}fZncx#MRh<E`)I}
z%J~ABdtPd)V)gl$#pj5FAXBieO&QkptX5LHUMYLnk`mkE`lg7ZKwWDkt3BrJ*T%KJ
z?SH*+<XO~ePY+Yx`e-E_a;=1mh%cApi%a2N%&JictXdImJ@cfmBpdQ#kn+5gpcf?+
ztb?QuTDELx#qob46vR38Ad{^;D(SO*ZY)OOmYi_FcsQZnlNWFHj$Xp}-Mjx*$~K29
z58irzi3fQQ5%UZkLd(OKL=;v^sA6N~9j8tTeen1bxC#aB_%~561x}+YaqD+~`sHqR
z!+-kllWa?6!7jX6yIEbl+e#m9CKMJAkts4%kFB0#t5<*hQ86u>?H{n)pO(u$P%TPC
z|4ooKJ2T9TXyEl?>dByQ{_meXC7(P>-3{@?)$l)Rq!H^M-ya;`o<^K7W)p_@{?o4e
z?^Wvl=4&_P!O`C1g8=|ozW8i#@O=Npqk~5S$mZYbG$pth44{=l@R0-7`*h)}jq0F_
zFx%SbXia}mJEdwxun9wzhrQ<%Df7XiOts4$POS7bdk;|F3pwhpTTm5NhMCTq8SM@s
zHNY}_iq9(qkU_S7dxBW9w<dE#LdU7Z`*X=v#hk8*72i2ENZ9_mzsA(MSYrk=2VI!m
zj6ksxs8o5qs$&J4;im&ea}A(^h*hGkrS^b+Y?FU~UivU=v+ecSyptR(&s{F7?wH&2
z9Ra|X?7^!A01!uN&C>?GT>!lsqS1gq9@UyVE#mL=MNwU{oITBelC^nqzw@B;@NM?Z
zx7klycxG!i(`y>Hpoj4y&ZKiEF%=4$v6E~PpACYxcC)8W%Q<li^45|<P~?&KLTZ?k
z4>5mC>Zn`*I_w#U<?%sv6g5%}0JAom5~STYZA#A3q@7Cjb|c8h%!&pEc<39XXAJ`&
z#7fGqcx|Aziuga)o8hNLqY2WC7L%8F1fKJ=G_6*ar2!7BHmiHHYd4?2TAR#c@8e!W
z;)=4%9M8<J*2wZmASEUOps7q%Bnt>7=jneGRX&9lb_|&%6*W@pxZf*2A$BxEwnAe5
zFeI2rG*KWA@MYiC7&&m;lmN)*u#6x}e{G$X5j%r2e=%bgf54iMhR;K4RJM&8(|}_3
zdH0c@q}tdb{Vpm1wv7usF+vWUW}DHQt2wPL?Ty@vs)ewyp(Ohu+<>MSG&Ahj2+w~t
z*WQ{;{Ru&|a}uo66{jeKGxVJ1@8ook?c0L)+G*fG9^Ws5i$19y8h+qMp%5_MFz@1v
zU4;2`tA|~uKBtfbUD1%;bJEv#b3}#Ame1p{XySi1S^{#PJK51gP{<QE_jjxKBv%HD
zCB0my91X+{6YitjY;OmC;S^Z}vk`w3uO$(I*JQAI18lh!xXSbzg1t0~4c5t~*Z7WJ
zArlvXy`zVMqiy_L6|v}X>57y2uX1`CTmO6z3e)o<V27pOK4Ag_ytFx9yzr=ej%q!S
zN>zE{QqVsEvVmc%#u&+xtmq^xctHKE%8n_TqEBBNeMRh(1_Nz`1y|)jMX7%rjdL5w
z?IBD$&;-04aM&5fC%F1w{q$^>K?%DzE3PzD==bS|zWKNAkz;2akIN?r+RFdld%QWv
zyAPl5KYjh^U;td6gI7nxu*akV30=p&mO;+!7?ItDuUv=x4j<GP=0i=(fAW*Hwk)Oz
z$MYG$_x{1lz^6B_f*6S$Q*(dX%G>Qbk<!wp>B1;xJHVmmEGcB}!GG8?vZLSRozu?Q
zzvSPzW&D@ZZ%*^YzntN3_lK;i`SkMLYzugePB3?Wx!dlqGr1-|BEZANg)NHuY`x=9
z0y!S*py)=0Qoudqhv>zJ=ruj+bCJicrUUWj4A9_El!~QPmw~-zG6sLZvN46^*|ssp
z*=l-PXqkeJP+oc#ts<9t<Q=Oa(vAZppf72mo-SD_h$O9_TEE&#JMHA=2lwuG+;v$h
z_uD=6tF0$c`rMDLH_-dGTEF_m*md1e>CInSArarKeX`z|wxlx<I}eAhGf0gNRo8V5
z;)ftB%~<=;k!NqwTRMNG?D76r_wU~e-a7nyb<ryq7kz9aN0R4fctX5&R!XT?p7*5X
z9$K#2THLv5Ofeu%Gff5eRZT9XdU)zS+VLCd@1Z&U5@SO@NOZ}=Iy|>U%Cm7EGVhyc
zEgp|D8<VHJ_44na!MI-_4IJhDv+Dg;LW@E=zf0-n_7v#aYo&ip1j0*ZS;n_px3&0A
zZCG=E03QWpyMORv>nA?A&i0%xv7HWy{t}fV_`BCnKLCD_ZT(wUW=2tZx0Fd|zx;z3
z3v)cV38SzEzlutn!&)zP-Taqs-o`<*W1`N@=ConEr=crp%*y)4L;9)}g<JPu>n?J-
z9)K)t8K|qAEyaJ2J%yXxL+|9s;Hp-1c|t`ZIvpqhxui}yj8K7Wap-BWNQ`AUmk=Fx
zRbLwV`q`xv{^0!8TF$n``}Uz82-M%b0lDD7Wc}FxmR~@F@hu=&rkhvLex!xAf`&<G
zh_%p`LNrM*Q)lgT?W`|>csi3^5~?3Mg+hwhV8hTM9?yRZ3oxQ2k)&;Qms0S_W+a(e
zE$79g_4phr7s;B}c9RcUT;DtT73_l7bBQ5lu!y`;0AKGO`QX}F{rSBIAG4*jN_q35
zM+qr4e7R_Okox7#bjcEBUg?%3_xKcd-L!HNuVfYro`vU1xs9^1z=}d7VnmoB?ONP$
zdKNbY!1aH$xNfzK1Igt*EYx_mN@LGh!Tfb(8>^7I;{)(5=tIAWpxI(tuw-^6!K(>K
zD+7wRbrh0wUoDF{X8lBlFAZ7f04Jh<|EmFS4&<gLOEQ07jdjJ3bHT~ee)v>5Gr(B-
zvh~;3yyx&w3yJKVIzChcbPPB1T9iKcJaLY(tPX#*ZNX>Im~3#C1yjWt9?k57@UBX7
zx=~z9KwcJvTA+y|SYV1*I&nIeBg}orn6G{Er{FdiB-|*UYgsf+K?Gk`6id7Y)xDz`
zenP55xElr;@C=U$mIR9>N?w}1+t(`Z?~AG*y?;mk?&5Eu{FC9LV8+HLHLdU7(SO^S
zzh{3Vh0vwi)K7xc?<VjUY;EMNW<ULA@6n@I2S-Q0v|7K4I-2#T*EauP1Nwn%CsUp5
zQ#^XV`jsONA3rnq`6f~fH1*-i;`w09SZo#o8Tr@;X;*bhW!72Zsq(b|zJ7D~{L!<+
zr%wmpA3Tq1ZhlL~*7{Yi*K7SsD`*ddM*Dv|j2=WTqSv*!HoITmyLZo+;c)~TL6dKi
zY5)?}Rrt^5w)E@#ah^8{tSC>*oDR1a@AvM7;-kPJ^udJVsRw7BI@%ih!dBc~(#U~t
zB-#eJBdzzwWxwqsF(ei)lVE+;dyn$#O&DTi;K=Z%_-br=AHF&G?#YW6e;f>+9UOn}
zJ=#0o8w`d?)}qg!jKe{qJbrB{&J47hni%NxOu_I#LWC7M=1ds;dW`)t9+{Nv4Qi$=
z`HAo%fl|4-#nSMu(?XBe5hDQ?A&0D}&tVkdYTI4Pu1hjSZnb*GQ7vzc_fyf;chCqy
z$`K~=iY&K4;&P?4@10=F`c~m*7EymfcC<Q`b&z!GKHDB#xW@+k*g!5+(PKL4aXg7X
z4{(SHLX4vFoEpAL()H`YaL$nhq!ZxHbe?7t<yEnDhj-(R7Ljh3pZZs9y}QFkl|PQx
zp%wNiDmY7g3DY|zeKpxAkVH@5so1<-^e|R<3yH{c3#OJSpFF5YJSXma6xV;l{m%xh
z=r+KWB%9M)b(8pF-*PW8aZ4FGAK~}n`O`leYLZ}c2T7@JA`Gd%hv#B7h-(!oxT|U_
zX6FvP)}Z7XwY~U285I>X=Zo`mgpLaj$DlWjG|J}+Dwjl56E|H^&>%s1%4>+eZiU=2
zs+vBKz$A3-ir}r346Gb4<WPSC^NiB1LpEU+lHd<hmGo=^e=d*>?2!(05JCa9$YMhp
zN2^EDszt%|G-)Uf<V~Eu)?yR^FCFV;Cu{Vq1D6M|T0+Ud0lPP#P!W5$@NCyV>-0Gk
z0HinY<jAf{-0znI|5zOLD<O-S+2xoG$3Q^)yvQO|oPy2)Unlv&%;SHPrJF^2IIKY}
zfvnQZvET%7j05|VxxQ87!a!Ozu1ee(3S+~~hVUp+)G0-4b!66;l3{Njlb0TlxHqS!
zbFMsZWob_)bWwv&quF{4injnpC0+si;|`<mPvXD>){+}WM+_x86T8V&3|2^skVXbo
zRrGg}da<4QL$cxTp;~{5UtT>F2-L+#meM1tUdYlQ2U&`q)mEo2M1hVcYtI3^T0OQr
zW>d|iGKqpd$VpP$8bUA8CblP{0G;UEk$C2U@Nn}uZSUlU{o{TD6Z8V$23;NxKI5e=
zm;%u{gxp~tY6@ql+wZnuAsJH7O!iJtbeM|mJ0%YA$Uf2U>pFkStG?WF$_@lT6}AjB
z-pWffS-`_1Pb<;mz8ImlIzS_lzjrq@tAWu1HpNz5n{t0po}atJ%C+~|=U<>DW<A5s
zr{GJq=H&6n%e;ArmMDc!YYvz{3O0<>C+a9_G{<&YmJ=tI?1Jgig%>52`4`;F;LihZ
z#Bnk{-#$vJOWJ?)emILHD9lPM(?o;^hFUF`mJUmhUTfwyD-`s;PS`Jq<nZwn(p02Z
ziMc~&lrjZ^FJ?t%LAZnr3tlV^$VlGf<2iz$XddTAr%n2^tTv~eI8b9f^Gz^`1*0IE
zdYv)(o;ND1z1$3^wT2s3C0}2crYEffYYQe^X^~)k=GuQB0na-SkRNaFfr)7>=b>YZ
z$O_tfc^Jvk%H}IeK@t<6J(xZ0-A|Pa0}-G@R-w^o?PNf>R?n>^nD;^&L^w^g3118x
zUm<SS9&0KuS@uPwzw_~g)mp*D#Ab$S%<5JjR;wv$U>It0;Z=ws^)KUK+H$H}O(lv>
zm7krRKfHfAwlLT<S1V*!p`T5OTaaSCx$R^>vIEP^yxndBJA$}BzyofacdW5)KI>}6
zU^kh32@1kHU1`)kIqI6c(Y8Wuh&S}{D0;Wm+LxqOiO2Kn9|Bh-9?EIA$PW`>)v;Wr
z=@d|;#ZuF3h)QL#X@c9?Qy{_h0w*0*w^N06%S3-rCZda0PL)>z_(eL|Vk|#02WF!<
zu3}4ccmDxxi#oe6CSq6ztTeaw>|G5=s~vojGpX3Zq3YLFeHICje&FB8es)rnr#Hn%
zxBue56){~BibN)Zlj1eci11sqyXN1>GY1U1N_3O4Q**A*CWW2c(FY*uh34(oo>Z2y
zpVEIef4No(h;vh$d-Hi{Qh!Jj_~BY`|J>NXE6v6Wt;AQPDSt(Q=UE5+HjN&Oi>KDG
zT}>P3)%XKk$(z0sm8R7%#8;$se}w?|S}*g)MIyp}v`qfDu8jP~+6WeZb7RbdJJ960
zqY_-tt;LK!BA>`tPp;FPz*+;vXzg7nvyy)*IMN!s#muY5Ka<lOYDlP;AdTNVj^aht
z+o+FhOMcjhxwbE0+hv&PYAzt1h}d9hDTbyIX*myDvE2#oC*if@<{o@(+NJNST6(mZ
zws3X-5qmR4;#$~L<ZY?*4e{~|Mk3_zAXk@3JuWM?71iZ3=+9R^o0YJfl28DFu>XJg
zU|P;laC6{PBq>#QzCy_E0MCRGwoX{3-3IVB!1Ar-tKUhUY*`{jc;j+)n!cfSR&Q1B
z-+%bv^S(*|UAt<N${5zJpy_p)@7~2>XOFd#oU8CvClln$>ar-7K!7i*UU`*Qb4Kn&
zxB9ORj*bUMhSIo?JA)(Kl87D;*VTWG;JV!3da&ww(@L_uLLV+%&)wkR$>9Tiw$J8|
z*eO8ro%Zj2`S8oH?v3t$d6s{6@AT~a?6cF+dH&_S;@)SY(Y^e^gU>!cd-z$A#~qhi
zgMB@!!U(=!joqGe8{z-Q-oJIXab;<u=(F)FBB2~bfC+%2Bs-mS%GI<kwz7XDODRg}
z?#)&MK_Ey*3P2zcfGDP{J$mdh&VD)PX^(o`=P#TeRlnrSZ(i0VA^?)IoL#%ST$MHv
z5$nFzT=V+Pa_AeQ6}`pLZ0`Pt`CQ_5$_R_Ggk8;}>U=UPqtr9>^>FP+)!IFBCqr!t
z(*Yf!``Bwaq2YwWe>s>Hf2V&kDX(QV@4r5hPEeUWB1e0!Y&oQ#U4?yDbY|7+cr{qZ
zA=(HonxQ>gQd~yb<e+Kd=$|sIrD7PcD&L)BZG{~G@|825vY+gF!OV~1*biFusql%D
z!qe`}Bw_Ns$IDE}!z&hdrs=%&SwDn5B@RwQZ6zXEM{R)k_2z{eJW_wpP<+J7qSMOv
zYMNw1t_W`8XqS&sz*`C=tXr$AdH;Chw<^_n-C^HtHHDTqbW`(mO{?$-)j(8Z$|_X{
z%1YKAJ68-5%FNuOgSBW~D+At9#yVUtr^+<?sd2LazOhzM8R|(Pf@v5RKWeJ4xfJSt
zZXw=`X9QGnv&)17WZ8c!3}!VgIj2|kkY*;P$`%jS+75s>tCeNo>t*ePVJObVrs-`)
zv+``T#kpTpL>@(T8|*Aqb)fAy1X}iMrUgGYenr5ZrQ@bYIGj6(TuIDvyjW)H+FUI8
z=D&A$7(Od23FTZY!kA}sDv+OVMUcDZ7{dBH)O%(e4tO9*@|J(vJ4o7&Znk^;I2f`#
zpluR9_}G$}pwV@>z5yyqeslkRSXWmYLDq>2CI^pTd+LlHnF9zrTqxz|dPd!ExO$mo
zPM>UwihwLe3JUs^4jY{*>U45nl6$csR(nQ|sZw1w^~izCxq&ZXjooa?XT&*T)1Y-Q
zM=oN_wB**6Fui{<JIpMnEf<R+W7kj3&FcWY9O#c=YNe}E{v%S5ZQYR7I(1>fRl43z
zjYfdh0}YtNYG8tD3YZ|I%otpugM~|T&B%aRK)y^BMKf3>=p2TL1Ckl-AnCiQFiGOY
z*_k=WRBJX$5sJmtri5PTz}cM<esre7Q~jHB7fdP!GYfw#T*FNB6h{#Ihb@ZElp-hE
zWcvs#B``HQCt1Fb%-()Ohbm+6g$hgJ@PbA!u4YZM5{&0Y-elih8f2Dcl??qU%^YhQ
z31Axyl1H_*l>RUhXQ38oTTnsfks#6w#7sN;G*`W0F?$l#Vo9EoMMeuOK8~p{a_SXW
zYNAUbf{K4w;%(rkxU;+JkTA(h^m@|cl0=)>wOJh#km{sZug(fikRw}2ZQW0xxTMpd
zPlFVJo(Zuu26^RMr#{-WWtj<yao#+~$1*d6stSZ@m4jh(Q_QTu)g*9Va2-)=nx*a)
zhC&Dlr}yzpYhY9g35lw>!-A#^E<G-y#3Qlt)wX}8f*e9ur{F)BkT7o)7j;0VsUvoI
zWrJHFDvP!j$o#i;vC`prq7nJRYG<oz?+Cbgdq=r)x1{bYs3x{pswq>Gf{CV-4eq}=
zu5KQ%X1Ym+Zf%%7tA4qovG<Qf>kJFLV~iE{2KHvZ(*mQiO+?^cqg&N<*db<>%){1-
z1`U6j`U;9ESA4)J7ck4ay9ddu_)=HrsVcmlBV1C2U>B4g7C|46-e#90vEr7MDEuJc
z94F>)>y!hM1^O>FBneLxwL&gD8YKUcUCOGOx__DjTn&nO#TX6`!cH0Zt&2I*Qte8>
z$~WS<4)8pPNTnpPqwji-y+D3J+Cb>A5iEb53mK5q$MF;zge=cTAKK!y4EtBgE}89*
zqpo@p`zw<f?lR&73<Nj5sBzTBN;8#o2~TaONJ>PH0G8VPiSMh(2Q<}FpzHH?qq`A-
zCLwaZrn;EO{y6;c;qET`9pl#N9z-2w=}D(gGTPXNZQhuiXzV4nTUbkk-5UxNWg&ll
z61g_Qwj#-~7i|y7y^qXgz}4ns;h~S5lGMD4r^CP}sk=H(&Eaj+l$UzRo&&r<6ap*G
zz$4~ItqsQo83*SpCL>A&Ks~H`Of>Yl(TYRwEv6gvoEVGM3CZi4<iTG+bn&f<aWRFO
zVvWfzljDaPk^eo(_ZR79pdgVK;y8b7%92uaBci9=JCicR{T#h|{_F(<I;nT{;fp6_
zHwyDt7*o3)sj|G7(DVTayq``vDT|}G4wcHrmdMybu+%^z*NoqFas>{LRei=MXe5qI
zP|WSxaS*O`(hD>FA%GzDpR>qsr)<UN<GuKZ(j^W`q$&C0`#<a~U+d?v0s4Pr@Go%;
zWSrdBzh}#Wd003c!BLa**bvv^JWE{$R&_ylBXh9*55f^jZlWjF%Z?>{#7Tm-r#M|@
zbI-p-Q{{L9&Lbv2ssvw4dhk?-x&Pq<h*<XVW0VS5@~DV0HC1}2px@^IMz4!mz@U}V
zfuj{`y+L9@R?HWG=*nS0suh2@85|4818~h!uOz*!)~>$5t_#v7u$d{;-{CNH12#+$
zo!uXrcNosHD<G$N!<UlpC_b8c;$dhPOs7^$CV~!;s}-}Mhw<5;U%euhI%f?DpGUSK
zKIZwbT*%&V_;X+`bX(--WVC-<k|XPy<IxA_Y65<Yt|R^+SQGkaSF(Qwc6VW{(FFqo
z8}+m@LUiz9j1YojSDWLCCxG+*aB8O#nsn&3G;X;wD%FqS)8^pbe#0CT3z~ubUebnh
zjoTTGlY!=c4)oIzvc2nD<Ic4C5MwdtK_g~=m9N<6fpKnBfT&MX<Z&SGjx3g1ohKyx
zo<YNJ9s)CZvBytJqyK+H`ba$=y|c(gI(@4&PJKV3P`Or<O4_{oBso?byd?|j;uO6R
ztMVDU)jJqP^YQQlizD_B*2C<MPo}jsE>JB-{6XKxm7PiiU2r%jf&ZeaAUXf389pTM
zw4_h{M4Ja!F|;bIPIYpL>vylz$7EhG5~k`0op`sNGqYh?lPrIOZ~#lKut4L*TCyBU
z4lnP<BKvHn`Bb>Ml{uK^>~nb>#37_G`mgA|vzSc8h+u!w8ieoM3UpOLZK@lU@bm~%
z?UuM#C0Y*4f!`A+!l6wCubl;W5TxJLgiZqArZE#CtdZTR15Fwva~gzFID}A18h+=i
z1W&R2tVBqY8MS|X9^w4pt_C401yA#RPKOVi$NufxGj>JN0W1*qc8qG8eJ#7*4n%a!
zWvnk_@l$x$eAyZyQev{E@egUQj^Lh_@zMtBF!3DE4Ok1g5e_|PoZ9%&v$Dm>Nm&?A
z0ewE!R6}r`S_$|$-}P-pnQ!+bUnycc#A&S57;pgrnYVue=XE%RL9?M*WpXGTRh5KI
z$7Liumg8bi1tT=n>XDSMzR$u#Dj@$Ld1_^YkT9)=dV6%YqWBU*s{_x2oC^%t59%-O
zMJ#i8kbUuj<7Sv$a^X0Vn#Dod1aP=ExkWM6gfB(pNsyP}ClcDj(FM*0Ybsfn`Jwlb
zC2^t8-T{AX9wBLq5eXTih0i?g{~lD`G#FKRDbLK{J+yz?5h-bhXoWHuO#uzno1}NL
zWNUCtwjd<Of);Z>X5P3O>?)w&*shQg<&DUQ((_dcr-q1ZvU)93<rqrwH|B(8Hb(Qm
zqTfTdIXc%X`vOeU6El4lv)OtMJlMLgL(f(~a=U-d)Sr`$vPvP-GbN=;f8hNrF_O?4
z1bKOkPIW>t;5dZ&dDFQ?vS5Ez^rc*1iXgtb<frz4C!?E;kpJb;%i*iT?~gPsr^x``
zqud~Y%nbxx@U!R^hWDqgPB1qd6vWow<e%t5ou2l8C|HlN)kUONCCWh5WntHHHlJ{w
zSv7wZ^KiV1AfNX<rF;E^F7jZ%dqtKj6{c=4;%l&H`{tB`lA+zQ;+n0Oqe5j3sd+as
zJzct)3a9MbeKz$;(bS@3bb|Je&sr09KEPU~tsXH9&gGPt&;0@CRmS1+2ia&wm14-4
z5Z08f{N|7?W8d~=ExWM9p5^cKGN0*zxkG==9dU+m>3XsBlDE3nbZ+Tp(_wXG8%c!O
zdTy6IXWKJ{i7iA>9n&b$Vlmj0BTbGlbqB4x)SZVJz7`blrHwQun6ZJMdN|QC6FnGZ
zzYh@SzMinfT6t7FO#DM(PIbCfGg0B5w!GvOsU^V-(@Qe8;VJc)RU1AdR1q%jEJc5W
zp!tsz3E(7Fk#{Wzv#=X)CWwb#;jgx4vsPk3IR4+Af9SivfAQLy;SGC@LOgxS;%QMe
zeyHDvfsM<Iz#Gp0;`s@@Lc+%mc=I@psvlg=re3=g_%b;UE#fi*FD~|Fg0g3?UXPMM
zh_;s=w>#=ZTGqhT92x!o<@47s?*D%g*V3>!9fr*Iw<FE+#XB<c*ybq!UlZq43|k#U
zk;@t$lb_^MTsmrP<YS&*%p<D8(6ItBP=E>}?cG$>KrV{O{Gy8`beJSTuGsV=ioAbW
z6PG+E)`-Z`qX$R5<VWf{J2F1x=}R6MxB)}P69@bxeZT++e82Vr7kA0p?AU*9s6S{5
z=sr^@QH4IB$?4bFZuM|jIuBP#(J@w*QSS1KK$u|(I9!)e2q`~*2keUl7z>b}UZsMD
zm}Ooif&Gv70}imIx5<}P0^RZH&O#F3RbfX{eU^n?94r(vduRyIadUNT4)UchGX%zq
zZ_p1u;hDLyu>Vt3O&kD0BddQLs?T<y#P8%XolRQ~oj}h8C<PG;U{aDmb4HTv+4*>h
z(BS5V`dM~>X6So}6T?M8+voB?lhn{t$q{K7m$JDIk~{iaeNE+cLi0V#SMFB=>6AX+
z+23(bgoqs^_iq2;t7q)0!F%N(S<jKU2T+y>wSbq*{9V2*_^Ou*`w4#n_6^PA{%=2o
zKR@ax&z?VgbYJE|pG0Itr$@bm<TkNU_549#ca~);s6n#vQ#hpLYU<Zz-?F3Qonc2p
zougsu2Ho(yR>%dL;O8zbl23nQ@~9XmOjVz9bQ6b+n#Y<zQLIZgnSyjl=!|nd{>zI8
zrB8R2bYgi;cX_fRVNriH_#A?$jmQDBu%c3canJbLgwq2neDc*=PpQb-7lFdV5}gSe
z^_m2obt!o%-BJ(Cdu65kpA*$8!pgsY>F1S`J?~Ull@lk}9uSR?znE|0zbfJc<Hd+w
zguYQ<=;#wOA3RjsR($WjGFF;KHPj}C6>_`GIHYO>#Fmkm2_}CHm5Ij<L+Y2mO6qCY
z3lzEc?v?!zbns8=$(^AzvZWViS5L(EpEeD5hiAo>hLO(U%BH`gk3OmKdqdQ}ZT5=`
zI<A26xq1QIr@u~DL@Aif$CuQVpZGK#`)9Sdjjx7+=^W|iMExhUhbsk1xN2l78vvpE
zG|Ypp-e8>ld`N#n4zYC73X#7x%aZFA!@|Ys5t#sS<8<lYpl#%)=xmIn=-Q;qu368o
z-Zbm^XFjh{7Z&G>tGCP#FK*O@uZL9YHQL5Sa%JN%+1{x2KMYatHJVT7jL~sr4-VzK
zo2|m_p;mv5j*O8h?CNEBaO-AW*dI#8*XY4t(|75W?f-v?KDt>C?haA$HQJxAuWbFt
z_2;Hnx901v?!%MIYwW|5%bSh<-VhaEWAu~t`0eE6>MNW+d-&ar`taqj{M)p7@X~01
zKkf=6>`_lRm$yP<O^G||6bfUIsy1^gZ^NvM<8XfDFDeX9^iYVs7dbhO5zP#x_F+W@
zz=|AIg|L51Pd~=a_q?5ySM6Uafqmfi+zsP+ONmbQ@MANV!&d7k*C*CP$(DiScpP96
zD#J8wrwH9Y9=>|=mq$YuZv@NaIN+KCT{Rq_e?JV~4eecYFG3UL!jg;)j3gNr9?InF
zhEA();jEyy#LIr&HNYhHSB&&KaP#9xM#(`CPGW!O1a4pW-P7lgwn)fb0mI>MQ{-Nd
z|CIcnvt_zC#~<aqxHz4rZ>ii#e#YTHP^6_}V$e^_?Zz_-+*;Sm17=MYhQBRMw-cwe
ztW1hzYZWi?TysmS*U=z(vWl{libM4zR5drvbR`XUtihSb+nFZt_8|F_INiB~qR{zr
zE?Iw(eYgfGXHt`#vPkY2B+v2iBG)X@ns8b?txRwcp>_`QStu|KDuP7QY4UP}E$7vw
zFuUQE{1t#UfC-l_{&v2BAXV5Bx1p}V(DJ88e}4LzNMqa+-p*Hc;@Rb|)_!@d_K%WZ
zs{?w1uNJK2yI-Xbj(A+zizEB;SLugQuB(5!cKz^I>4j0vD|_*rKm2SwL(mJ0KT5aT
zc2dcnZ6u9uiV8VoOX0ZSI3pxT2c=Tb{KCkd(mADj8|d73>(z>g_K0YcpgabY)nPdr
z-8O=FY!q=59}`U}8_>>jMB`NMg<9h_mMtxtQfIpg>DTUHGRx;{^WcT|(l6@rHG6;a
zn`74xuKa|1$9~w{?2tJ%b~I@Gka1oL*-E<eWaD^1Gk=wb05zUlXshm4kZJ<+f;h#o
zP8ONf?NwXU&RqE`YOAe%Iq?1x$@e_$%7@;6LablIbw0dP$pi^-bd4G@Mj$d%bDtWa
z(p|I(+a5O;4qVWDa7lSNU#0IA>-c|cvF^Cff9L+XqpA6xgB{#)k9T;6{O>zE9xzM0
z<{Xo$=8<Vv|75%in>yJQ2p(PHf~8h3*)kmUn-_pc*npPD=2iQqFYMw;wz>d{$v*dQ
z|2CK~$1bI8k%bG87OEsYk%kv=ah<ShE0d+a2IZ&FomGqH9*K;{5!-l`KpKBzZQAjQ
zH1ygMRZa5Mo+jNEk%oxf`v|hgoiA2;ho<t^Pr}_88p(|Q4=f&jkIhW66Xa074IO-<
zN^t6Scae|>PU(igUUm5C)jJya`w(X>u4Ix~ylULlmelPN70!{(QaZ`>bdVgX=FklJ
zrL)f-SA_xf{rht0UZ}w>ju(Gd64E4@(S>ykW944Oqob_5bo5vfgSD2!>@WhiQFz(S
z{PU@fK;Gw{1sAc&qhbM)XAdbhb%x2#<ZuVRP4}tDevkfj$Ag2%TQzOE&DDD(avBj7
zAai&SlcP6|>9?YAjSvqu8}~6D2gPP^#H9vw)b=)g%m@!$vvM-SlXZWNxQCF!hP}+^
z(|qo6=~%R^bTM}^h@v32oIqE!&q*bNR*6BH7ZtaSGIC<`z|KKTrvG3YXUD#u>HKUh
z;Sd$0T3TPaxw#(mh=bAZc;IIq;bVCgUTJSStUA9qt0pjhcu6z}ZsO?~k2ehg=hCw{
zBP#pUbBNsNx9+o1G<JWD0#U?^@IKBbm0c6%%hUMXOjS1?@;HQ$=F3JmrQ55>HsZX9
z;_KfE&eX5F@}VLhTELUPRa1Ze(;VmloFjyH+V=zZnU4Gg--Gew9YDf}NS`6IEd7Z{
zYM&oDVz3WLWS4rinEnb%>l3a-L*{~MxX90q!*iboYvcXXiur$42RCvBudJQ8dHN~W
z6*K690vNf=EP`HMEsH5r$jrekhuXnlE#`FN(;LSLu@RdwD(J39%wMTMOSD=~({klt
z1ekQXEWp17w#701>qqLrn-P22(fpnkMPFV?Ucoorkzh*Ov~AkDy49mdS^yh!^r<#u
z%er>1ok-SlnM{A=Sg|q@p(H$WJWsN)99=K57I%jF3<)qMfuBFeiNV!?^S{uwYcM{O
zT5WPu6%)ZKp92=aAuINMC`fwdLnCBiPw|&V^j*|TxS-8cea2nX-*Kgmno*FLJ&*aw
zpEM>?b^e*`w+XaN{<d4uiNZl-`c9pr;FzR=!k(Mui!^@`Fom~)^|4^hu%QQFZ#sQ-
z8H5}UfU9R7@yUpLF(QI@dYZqtrPaZM^w!Ykn3G3aLHoQ^6?TS8azKScl|P(j%T*a`
zCYeK^$08tbyp|$+s*}^ZJWU?WNLK14N3?6-vP0vue7r2m;&jC*Ri%g64cye!6U281
z5}sU2G}C|ZUcoLisZR<*-MSOXX8A^6uE_bEhfqofam^CR;sqV@i(!f9u`_yD0?ex7
zY3wkThMSazaY<;bQ|>nmWpz%Q2oaS#!r5hD)O^y;AaX{^`HWT3#D~BOdTkp_mJe1q
zexM`O4#Nj-o=r8`^zVo9L`3$14GUg2Ol;`aFHe7(CQ||;6ZJxESTY}R^I5#pH%k@f
zYChiB6)!dDF&BGJU0z@$sQ=l8g;whY)EDg^vx}z5YIB>MvP`l?tpYcy&}-c5Y&O)i
zQMLrU_(u71LuJ@+M#@$S;-bd_5Pc@-#6bbSuE_fzAqW3XLk|Aq=KGJE?^nP1)LoI*
zpTmDW9cXUrf$Oz=;`v_3)kT3~y4;MKz@6GqGkT|Pj{3^M8A~@eltX_R1;zu->6b`L
zQ$l4Yxy^)#7E4X;lumdNM&%{d&nV;)$&AX`T4QNJwKj8_%QdPYs!v?`c<-HDh9;}s
z-4{<@Xk5Cp@ly$OYnh#8@6k(O(~ImzO!<FXK~1t~yTFCe`1xfW0~(jNuY8!#)nha=
zVF|)!`8Fr1b<I*5_3JItHM%qjfDaLsY+mV591j|YB?y@Wi8(%-lC(I5Uo{d)O4(X>
zzXpb-RyH(p8VEX4Nk6KjD~Malg=pLf-)!A5I+3`aku1h2VQgW9S?)Nf09s7WGE0B+
zxR%jA2>c;HNiho6-qX4bpFV$Z_;mR2(ThhvK791!gC~!UMvV+m(gF9E_RVd5(pBh!
zCT1ysC&fkCYSGR$Bs35jm4cf&t>7|?fKK_!wS;<xn;LO4PHELR0G8K%vTTHsgpMIv
z6YcxehJF$Gn>s+Z4WBqt*uc@y!fAgWn4B`DxX$!(;=LyKp`m;?Tor6T5gKxx8kGPZ
zdOo$)Iu3q`)6$(`z{rNjEEd7j30Tdta{IWO!$btfJ7D68P>>8U0SOP9WhH9$Mh!vM
z!79g$u*Zu~isZsFOe?%t7VqEz47|@mLe0S=odo{c=$;e)R{@s?HA+^-ER=tT^S9Uw
zR&ZSunu@}W-D*FGLZU)AiLqor)~~^>0ZBg%;hk!w7;5lrjXd;*mn3AYm@5<`f@HEe
z$Pj|RT-LBpk5T4SF&hTwMMLMK=T1~$ylP~R+})>oCfP_cmsoK|2h@e$NWo{Jxv3X1
zwtV!;^Yu#bD>zJV86;Mga1(!xZgR@Jd?{de@A8u7u%kqm{(Sp2J30PTX9`32GGCn$
zRit2WX%0E(nxyJ=c?+~iBtGqZ2!DMXdA&C^D%Xvxvx6weKu<O<7TKihb7V5=&m?<S
zEJ|#nSx&+Sm?f7t8$v<OI21uv+~nbRw1%9cG&NYw^j(opcs9W>1lWI`{;VB`KW}^q
z;#_zc#tv$#M|G1>!ib&O${~kV1h)|L(%4X9Yz#@AL$ml&)k$Wo5x|cWIQ6Aux6l-U
zIZVZaXw0!=sUf&zXSoUy#)pTey6n;NmBNomGFRfc<{9v1(&c3|u*zTrITKmZ3}G{<
zo4r~AX|I5M>|Y40iROPl^zqcEF$rQQ6GmSM2`!(4lum4*@$Jdx_!l5q-zTxm&;?~T
zaZ*GVn&sM)ZjaEUS?+9qLkscIvc|ut5V=;X`h+WrDD`$a=;?Tm(~7dOZ3A&6al16o
zOxq`6Jlc}DP4GET+S}6E)bEsh3kV<Wfbn*BY3}mbdghVraO!`BWme~f3Skc?O>($@
zbz8Hd5&zt@khPoPAG4U&Y~z9sKXB@|RXSVf;$C$r|AKWD6fIl<)o5dtPbD5xs*3Mc
zz#8W~M?oRsDB&K}H=&E|zt|kCO;q~Bh**IH5}sBM0p)nFUiG5HkpDq@QqR}FWS5SY
z0sfvM0*3Tk01bcr6Ub~YjW^ju%ZNy)0^T5V#ST?bz%~zqE05RRs#j=j#?!_!IRxNf
z%{z9O{E6s>ZHLpwcw3T6N3dqlyyQk_l{Fg~$3*#?cOudr=40$RZ(gP*4rG3gE{RE+
zh3#P&50C?r8_OVzfsRAWM9gxr67LtuVJr$a;5<u)-E@CS=S&cLx%vlm_hf+|ja9ys
zl;x7bY0MwdTe~MNQmK#m5#SkcT`n`0pA4?9n8J-gkQ!l0EhT58o3K)b=%UAE+-h8v
z>C~m;A$uBRpAZ8-=Sn$wrl2k8tN2E<RS9>C;J_)p`8+J^=VwwG3Ni;-V$@B4Wd1#K
zueIBwGB1DsKJSi)HQVT3@<Xg9ZngYJKQ)9I3754Dy+T=E?N7SSL5Rku9t%osnWy5U
z#H@Eomy&unOnFY14N?_b?38#}gpwrR3GV??%eEJ};m7I1n&PX<+7l2*hcT%5^O6``
zQX*>x8l(Gcv=$I$7Eg%AOp9V6*{gvIti0(wJI#OD4gdsYIhzVSAb9@S(l6N{oY{@j
zFOtcp9#6B@u>z#Nj!)*N1;-^2o!Vx%b6<(xV|zua@%ZyP&jcHRqq#&4_UG46kR<z;
zg>OO6Dq&!B{6_nuP^Z8OYzB~{)k@xF%afvn*GdusCi89c7k-D_4a+{mAp(=H!@w(&
zexZMt7zMDPsUB}q!v*Y$$go~4IP2~N3R=fix6759h!}S;gsCj&>7oS2ibD|0X88*3
z?B9N$00@LgCd0z6I0Z%}uR=c8v=B^ag2^(_iC{qP8dGy`_8x+eX!mKu43fj7?bpes
zryV7`VHr)7S<+*01VjZDENI~2SZ-ASd<=grri#;Y@M{5_sH=>=;=RW4g65)0=SFae
zFpgI1FL`#ML&6mmWGWN6SF)!$-C__=SqAl(W2K9G&wv?<2~EX95jH9&n6HLf!4S{(
z!XI+L!XkQ{801$_^^>EcACi}kUOW{DIj>9&aC;r(aGJoCbJb^unW&0Bv)rzp%!7Z6
znz$}5#&8)3Xf?|cte^(exSJi-;VVE_L_DQZX9dB1POLc_m$1dD<uVs5=OjB>(<uXb
zy$RsV=`qjL(^Mb{$J8hzrTE#_pV(=f6T<bA?_J=6G0DVYHKNVn2tUqaC&3V&EXdTC
zoAa9D{6F9@2WjMi^oAOd=mz_^{gi*F9-t9zs%yHQF)YJjGFhe<2C0Lj#xC(fxMU*4
zp)d*|@s?$2+q5RuN2sReyc@qws^D#PZ%=FnUWl`*)Yk(+%}+1Id9Df3vu8|>3zJ|y
zzF$9HI}sXrf5bgEg%SiZbx&1CyVPCP>O6n2yGyeG>(XdE8A+tlyBs+Gktu%-0kMo&
zk8Qprh7d~g(rd_B)YR`0sJkr6GT2Rh=Pb@dJ{dh&EvLVGz&DRYW<ahWNoDGno4o=6
zSwN=0iv_Zd>o8eW)KA2jS*z!;TC84xb(`GbNFv5YTe&>&;8bSmrOT;E_5bhtUz(_<
zPKZl2=>M66Kvekfc73AQ>vWp`-M!L(brvKh$DP1|4}FtR5`JyZsrsmHg#<gkE(7vR
zi!qz!Ob?pPI;z>Cf|>xL1{y@e?mef429_{G$F9bfeV2zttouv|33c?Yn=qYlMq=N;
zCwYFwk19^L&KwQXaOs|o07fF7pP}|wh<5aiCA|p8r6%!K>xwBuUfI$)W6*kkR}A{s
zG2~kk&8Sm~M0<-n-`CD}dj`zq(v~-PI7AzTSzy^Ad1+~TlQA@;dEn|Gx&t@=X($w?
zvtm6Lj~QrDBpQ8OP$`nh+Cf6gNhajWGRCN;Vqy}lY5QOm0&*EM*XWP<a;TSbU@S`|
z9L9O4o=%CCT8ku|64$NNKSV-*umN3TE67qbYzT3*F?R?-Jg3<!rd}{NIX<|?jUREA
zHA{el)mXBTXi=++mHEZW<*_IJeMwt=xn>k|VRjY;LsK)|CrOHS9+22+y+HS&Ntk4j
zq{8+H*TO7=Pf1?R!c?|CnaKq@kk6o~$s5W<*u?9S&zq_HRstWrDo6x>Jm+YU{Q<i@
zJY=^zb%nP|k(t3ff<3Mn_Gb(n*d=!Gg-nTqn|G-3^GUOX8SY_p*Bt%n@X1pW0OymF
z;yr75f-D|VFP5f^I2CoL?-@3PsES;_Wj-6t$DvD%L;Q9t>tUM9thv{mHNquV|JmW9
z;V++g%_ouwa!G`LS#F7c(W4&^zk5nd_>V_F9KL)sq=i5N^wDWLElB|DfW2;-@1HFV
z--eabNXn;l*}bPbKtdO|!G}+dxJ8+GZcKzdS7mKUkROJbGV2!DRsOasbz1MA96f(}
z`0B~?ABT^h0-zd|_xqerz2Bdui~h1GR`z?5Pw3z5N=`39t`Go!GDe{X>^FkT)Vl5m
zb~?q)^s|Qc=<JW<<Tjvo1*7r8ktdou?RdFy;sX4<jYydPAPK9!H(1<CZs|&ehf-v)
zO@kutO7hY(Sr&1O^E@)EnJR|-_0Db2sGsOxG><t%;E9ktH8zaG@k1Z>n9U5DI3&u*
z!H9{bWp%yoacl^GU$ahui(VOZcl6SdmN;vz)irc=btSz?XwfNE+do@C?1CRR5r;?O
zOvqGVLkbIEx8_-F$q7C^Rz4%-IP$=GBx(>Eg785QyTp8_fjjokPWqf>Vvsy$95)vH
zdp?AY1)4kGe}@}O7m)E%>FBO#n8>^-Uv`mfm=(KavLCg7jlP7n-HU4TrS4RR@EnUb
zJ?)>1!i<$@y%3j%tFvvz+zfiUvBspc{}sL0!W%#94w5ioN1UYNf4}q9GtYJN)FmCd
z6*&P1KcknXSN7aX+z*x)<>m~1=-BJWLfyCx&rb;MgJ^Vs3Yf$>MZAu*WT^v6AD4io
zC&yVpcYI`jI)_HNJ1%nI8Mv)HE+oo2aQGqe8EiYl#w}-XK<Mm$|6P|AaI!Z#clbBw
z-GF*H>3oYds!TD&+4n0*c^HR7I}a7jqS!+{771amnv<va)meB%Az~_7TY?#qEGm*W
z#i!ojlOmJ^21H&W2fsWQ;ag`4&Ggj5pbO1@dp_5H+aa_#2q^1`s+p#7mMboAg}aUS
z2l!zkD&S%Bs?%7YLyQZ>feX|%IKi+4z?t=C=By=IPzAn3Qh=DM+XAynA8K7@u8@C?
zGqdw!G3U6-9p{Ahq#D;%cToL$Xq7mx-Vl#YtL)oHnu9VPr{dbeLb0mG*Mt<RR1cV6
z4bYl@VesbxEP9QGR!F2LrZw6ZQ_P<FQKoum!s6dHmakE|;?roSXumhtd&H+aM6Kg*
z1xx+*;LDis(-D}KMbG6-Kfb~w$y8~XaiUFPuxRtL28E9?P|Pw_=bdNMg{1$6v#5)@
zkUTl8XNT&Io%_O!SqiaSvXu1cS+lsBVOkD<rJBaNIgb2l2v$rWBld%@1QEYTIW|>d
zk|sIAXiwO!fzHL*GBp{@Xy1f!`^OS%GpKh2`BOvKeUIzU2`?qNXrOgGhIaBuBWOM^
z=&A=l{*0i<JrzezQ(Ck<T{=(z1w&s$Ze*tMbUl~gXn4oWEk;0r(qR%T?a;Y9SG-<-
zN^wMB$3iBZAePf9v1;W^N?UH$X|`04(%&5abofAV6*$}?9rxu|e;+Cags9*i8o_O#
z(;YERw`92DR9TK9BZJqb1YUfAneboC)sMnCCn)|q-Tm->XKT`>&{EsLB=whaxj97)
z`_*)a358yt_5G!UDr>00A0mIus4wMzv{)&^!t~MsD-s`WGC?qjnw^~HTD4Mk;i~ll
zr@Zt@aw=SyJAkHYzYOn2T^b#WX{9GwIzfzsWJRbS63ZLt48|@PgT8nrzAMvS@??%&
z3`CsSrc2`DGV>=+X8bT;^5jB$UD-CvY$b~JX#Y$!)oVEggMeZ@EKEr%Z=l+L$<Q5h
zk>M-06R7{?V_^-o1C}!m^N?unHU=lKG_UCtlogXYxk#6%B($xN-`YDuVDEH;jJIIX
zXj@Qo$L?N915{vt#}Dy-i1*P!Ezk2s8QMqIBHkTGKq*$8k`j3s`PBmzOmyNB)31Oh
zSCQJD=3G<jnzOAPvu`W=Ap-D!`c3DSJ?Qt(*EHGmQJ*$OA2dRm53*FEbgc)-NP&Gd
zq?get=`-wDE?E-kMqXh#8+WAY*pACf4&CKhBW|TW+55vYc#zU()kzZPpr=o^mKjfT
z{zHl}q4aLD&T#Xp3TGpXE~lt8bDX8v-Q9H*W|F74vUYdn&T@tf;b<R!9)6#A-KH_G
zpqo4cIZ|BEB6uycR)?LaaY~}6KmvHPT5(ahng4Wn^i0VR>=dP(gwQw9AH?JYbo<<>
zronIU7z9!%wC0&@K|Ce&N}@HS$1;TYj<tJ7)^KE#1EMcka^{63J4FB7C8b~M^&t8p
zf5Wy~DHhGw&CU-G(^cAkSudvt3ck@zKD55zYmn0fCHIpQI&}FMA9lZKeL+-dy`1w0
zgTI!=yh9H^*6OFh%u8(64w7mdV2^O^TKa=9fd`y&V=&F;XUJMf<R6-3eOgY5AM4!i
zC0}-vk4<f`5#zF>9t^cX(Cs>)ORh6IQk<1A%<&-k?FTLRaTE-HYX{+$JKWkAdwYpY
zr`)qF2fD`NTh|dix}IzbF$gz>T#=jfu1%(!Z14low{8NvJcINxcZjJz^~l}DtLTPi
zM}|IQ^V?MhYX%!U^j>UzA+1PFUvkAkyE3WW&PY{TbYgz{K{`0#HTy`nd`4U)oglhZ
ze)~arvBOm~k5Ynv=8>MUI*|S)Y*~x1cb5)SV(#2;d3zxjh`d6#dQ5A3ZlpcwzCV$z
z)_=lxx<!b0l}$UGgj>8T+EJ|+O#FL(Acgn<@x#F(9z5XO@Ey(oD|zC5!k_4P$jbpS
zr@XAeN7a*3?`8Fz0EfG4S%~DQw0YXw^e&srUg#xlJt}Q~IV;BpU%vTRue{-aXx$`0
z(a=uY%}2wXjCMEdNgHRQP0iRU1WiHWt<Li;UNo9OVnfQjWWM_BoLEQvTXDs7qaZJ(
zIV=)UeezJ4?$i8CdZ3$ZnEF$~b+`SCc8^&3*~uh5aGPl`2iY9tWx-q!ttG91^z4%k
zHi|~4I^JV{Hd*mujuzOp{~69P@7(Apw}NN7_NQ%sj`bKH@9>7&c@v-H4}K~u>n_FQ
z7;lkN?x>uiPC2>8Q#COw&?n;J_YChI!$Dor%@6mqsilf78GhvN+0x;{UBER|Y=yCK
zBHRWqC}Odv=)gH^f84FeIANG}{!3P1#J(yc%-Q3AVtJ^XoRhF5se6e?VD<=~B$wF=
z=E9J}d7oSUEN>xA-?2wlAjEW1){_VyIN|+kyT4n_Km~w^-Q8CXFUgNn0IzJ@?CwHL
z_*C)hB!wT7w2UObgXG5|P_UjO{kurGYDyop?uo|A@fo31#=0H$J`|lavVW!QW2w4Z
z`Bu_@GRJ0M!H)N?B2K5wKH!))6kTR>H-WtXO^RI;Dgagj2Qq1WsU6mZKj2~!?O}vi
zp-|AC&StcqIYo9a0+ACKK;X>u7sSMAf<aaD0&%q3`_@<1wC=Qn$|1L-Z@Mmlk8s-H
zcrl9cc)ftfMi8RH6@TNfRHbt=ZtvIuLb%j_kcYDMd+k$wzi;XtRtkQwtlsX3>fGuj
zy43aOP&z8x5ujy(UBb!sqO#&uO;}ixNWpg!f3eK|3cG#lYqsPFN$BzV!)lmIWJ`R6
zN~2PmK~WB=-72CMUfEiDVO3*gOxqx`FHwwXb_x~vsruro2}BeOtA^v~T{7sr3d**B
zB82d{2~G!X`<^WxFPucNMCVH~i|d*oR1Jw2c*=D7gRJPmJ~&zCxPl9D4L0qJCq1Rv
z(*)8EBu#q2?cKRYcguRI0Wd-_se-prXIMMND;N@E=HOgMI0+^y5VSS;k|+OLm2|gW
z&sk`sd(pvexUP{Lpzc4ZTzD`?oi8(g$r);M9Zs-LTrY|IXymquNTr(=$x@XBv{laz
z@l$U_E3HMmcbLmQDDG3RaA9w;YxFd$U=1U`WWrGPM!$3$*v5sfo%5z(4ffm&%RxQG
zF;&I3YgRPoOF@MkFFDwS<7A7O5Ime0cd&3=l&^DSbID8&uid1`qP;BRNit%8&UiG8
z-a!-&F=%JR)`dzocBc>a67$Uaw{KVVXmr7|rObuK&~@Vp9e*PM6}R=3tY#nx&(GqP
zc(Uw>?DLM5Rw`{w!ni@kZ{?DeZZ{ma#@d9FKxIO#%pgwHg#j{RfhgP#bwR^6FlT0S
z%_HY1LlXYx_{eQHC^Hx!SDtu(hUx)a>)>d`8ZeFb3RMHG)-&3^CBs*SjBIeUR?EwT
z$-y9bDG}}BwkP`VD|n=a3qwfi$X1@73~E}3P2yi9;5l((vt;oea1X0qa>@U7@<o$z
z0+c-DUf(CbOD;WfvyD^qFVTb<8Vnzmihg}}*NFs<rh`7Sv5_B;_*Yhcl<ToJz31|l
zDnM*n1IVpUAc_3n5py@DRbmm2l|C2Tb1}$E-+O}nCWh|mR3L((H(j2wYfD+xolJ@~
zo%Ie0d!h>ul{52XH@VZKa7ibVPHH9S{5BO%X}V9iFtHq1T~Tph6-g#?J638Y0qFj>
zUg=a(mq;JG&`~5b54IS8ZvK0^#Go`*#YuA&cdxACD?b8XoCe(Oq%_j2d+?Rt>kM%$
zeuHIA5l7YhBnh;Ujh7nYC_n5BEz#Pn6WTf5n_Ui13+Rsb&a?F0rP{xCdb*%JOr~;X
z2gz5rZ};eDdUlZPoGsQn^n>}M;c7*K`dxW#D2fL(i#?vk@p_4W*yhV28^sTjFDsAV
zX7usSjQ`lFykqz+m_&<<VTm5lv~=#>ftJZeuHzKGrZX=z&XHKBCCR(pX#97YmXijV
zxG~<PK_oInO?teOSd&*$9#JiM`g1EjZ2w7Bz~h3`n%DFz{t$Vh6rQ2FMn+E%)3TF>
zVtjhG&_Vs$9~A9>!k67dDB|`*f^SZ$W$#|2>{n4Ixik+2N8_qyzuI&vbXj<gI--`M
zop8UsX_vQq{E;sGecrzOAU(U^rv0t&-4?%p*L`A}{QkZ^sBQE6U)EpH{=VOqecrCW
zjkY@Vrq}8Q%OxFG--eCKJz}X<FXS&My?%kCsqR^6q&Rbb<al>i<XE^VyTFprf3j<+
zN1}aOojZ}YqHc)9Ew+k?7^UetOvX~X60}hyXu1rp1Ifl=9cQKjjydMf508T}f}IS1
zg>Tu}noqgOZem7N^lypHkq!|R2~~qj8WJ7jKtl-Lb|S(QlnB)EbfHcqiloSriH@9`
zJz>Bx4(Gam!cL+y`Fu&6k+^pH_mhcP8fdD@%~l81yRi)w<&xii(DEO>mSjawS7oF*
z|B&cssGj}eR-9aZVS2nBwT9@8=O!oCjPAJSbUDa9JI^kXhtzJTJ6IJ@j-DTJ&pTZ<
z0n{(QaOmBR@08Ws{pNb?ooMbWq*mXp*ZJfMgFuachHAftg<q3lE{oz;q@w1ot;Gi`
z7Oe%AB36BVXxoSFgT(&qCGAy7zp*@RSs(h<b_>-0cr^vT1<tW_@Ok1E#k69g5N7j<
zox=DyaB=HOMH}uq>viEY86C{>0ROs2i`{iZv|-n@-SeBM)1$r9ygcE)ku5{Q&njPt
zgsd)qrjCNVD+4|qs2TPPco|Gt!vl^eQaE3b3<sPrFu>xtCfQh-+GxDKs(S=7AdN!y
zNho)WJN~jzR_A>2caAcU?r2BRoscv~6t53b(?7}jLTW++$QlrX&ZM3&H3J#r{sz=e
zDcrOu-g08gAB(up=A9wJbU@%Eon~3s=FyFRHs=@fmC2x?V8oMe3n7jowBmEbnuP!S
z><euF=VxEr*3YQ^ARr})er@^ZnjdogkDU4s-8!lXbg~89<!SwYBHChj3C7_G)&4&>
zUl}g;cr9il4{f+%ejeLp!=l^o*w^FXck0m>*8jr$0a3C40!0$8nHl2y>BT77OGZq8
zZt`MqmU3QVgy;NNAbf#Q2G~aue0Ssgzg9dS>DCXyIm_ZRR!04Qb&czp>wk(EdROeZ
z95+y?ES+uHKQ9z;TW5b7)DrjqmC4)j`o>~-z5XAIRY(gOzmh1Q<e@v@GlK<$c-?A!
zmyJ`)xgy#}IdMX70#&T=S51lw<4ksccOx<a8e_oH$|dD<T9UFCE9|+r*sNFumj?yp
z(gTJBl2mKgTv8b^vavmiINd6Z2yY@&tItwr2H+@>@k-UIt=3U`>b>DuUHBdQ%2=Ws
zNL0?|YkzR+5bl(L2>BTU#eE8IOGz%LK(WvyQdPubE@^Hi%*jH>M+~6MCR2TX?~N};
zCYd-*9v}vVs7I~V3-jZXTZ4Ay+kmRik`8n)8kC1DI7Zqu&q!DD0)xwv+mg>@e1VSG
zX^-!_h+iumqvng#{YTY3qq97alchDvkKkEjmHEU~DPO*R{p6um`ciM3X2e~G!lt}>
zddbk@XC89TxRE|l)#~LNaojY2-KVG6A)%L4ko-zhYKapYw^3FbQJm;h5dyfcvwYHb
z=A3Sz|Ho=sa&8S&IS29pQOOysk?P~sXOWfn8nOQT!hv%F>L3eEx9pE3;k>5j4xqJg
zd%hMW>J`+u)p{jvrnHF`=B4NEQDvhRQb)PROQ~^gbcI_K3$%xv*+4FTB<T*<<bnqp
ze44N45k@z_vIAziuGssKfQv&!-$63McO<$H|2%5;&C2G>T&qKjWrG9QU@*X&o_?B9
zqa0EA(K%l|;up~{S4ClR&vCX-W$)1c?!IwMY%u?w<JK2n@YMRgbh$J8-QK2GcQ(Je
z+iiXECKQ#z4m65FD#_@79=L}3so8~TZEI4~7JX>5T*49w7KZ*lZS&G#W!eoMK{6<*
zQr2aXkE^xr?#jZnZDpw5SF|+O5^E0GX#(~T!B;As8$hHVg4YQm+|zl+R$VU5i__!(
z+>!s>bt@a6q>gj43g!sw+VJ>J^W(ev*tz6v*lu{~SNh8SRA)GU>{RvLoh|Pw-D}u$
z=8$8(<va-bx3e5M$`qJs#635Bk`N^W!jpjylrHnDg6@E{pL!FlNKa5_F$ykw5nXuw
zo|ubGQD%hy;F`LYCsbVrbv98UJa^^^5Q!JgC_L4UgbUcQ_-TI6NN{74;Ud4w(yghR
z5w3`?PW+dz&rl(Mg8p^om3d|UBp&$nA$yxOaJQ(*yFSL!nJmOd=F@x8V|QBD_yINY
zF(gzUY@j{Y*2in=ZiGTvkG9b&6Z><&dNq1wi+430k(Iok9Mg8E-F~;1-0LM@_L8r9
z$?to~*S+Kqy=4FP8#}t6v<bYk-sT-3Dv(6RQyZdpC;YU34Z!O7O{?!HgLK9HyrN6~
z!=O9&?=}&W4{aTO`@rvzwswe~>0ci`rW#w)Th1)J!Fv(5Qs=+8yDL`qD9;bWCJI7N
z#f?wBhs2T^nBr@0Pjo+sBT4FzjYrI5yUwxeRknI1<^ntsB;yOtW^#h?9_LMSr5?DX
zVZO`|i%ax>IYU0A&6;2Pj#Kx5tNiT;F2QPEC0lCq54{<#=dcZ%M%8CK>|9rR7rL}h
zig~tkqXVxqy!o`F#o@9(9~Hf8Z6<Ug+TATApjMj>zuu%fem9xTs@p72XzQwmLN{p4
zXIrN7Re)0@0a*^MC`X8{Z1O?!7q8}J+##PMbDpJtz@O!Sku%<iNFicADSJsRqKMY7
z!CAHWBy#pqcIlEcC{8SpbHwS+``p1}pb5P<0_d$oK7q)dHUzC|D3yK84yRQwLGjHp
zU%{#~7kgr4f?CHuOAd2@Ewdppa9t8h9L?X8m9st4V2cwTp2Ep9Uz%sriGb%k#-Gq&
z0b#Fy2Ah*O^`iY705hzyXE+%WY4BfKiJ7>Cm+KRS_jKs>u6v#QRKR3s@Pji(Yoe$%
zx*p4ss7o<A{0UxOQVcGE(LHC-uBE{VK*1~KEnCmYo~$PIAgp%6)t(du(6s}Y9dt>*
z=s7?gdgv-C#Kn*Ppp*17v?GeuCDZ4AhEuqI0fVSMnSM&uqRTy#3xb7bIuiV7|Lfbg
z@yE0DJs&hS6Cvc8UGPH}u6(}XTFDt?ZJaTJp`|mHR>iz2`YrAa)`;7cts@$od@Oxg
zi#IH$lpg;`l)!BP*;fn)?BMKN&lt~+CJczL@?DsNp4D!m<QRclOG^&J;PfyDurV!v
z8CmvYLRU!700}iy@t=;K|Ck(6_h+eXcFf60)svIa-iXzIBNw#VdGv@iV!HPbd}*YF
zN5#>Yse2M`ojv(G*hBQ>m0~vibk0CtJa7h9!p_wESy{!Adh9)a6X3lZ)li)*pJ(VL
z#kIQbqZIO-<)s9~BFNObeKkqCrRDm6Q8~=X6|8_Lp*q?8-DVa*GEgh7C0+mXcae>E
z6sA+x*TNdm-t7Fwb<<8KH{c3C^ja`?Qco_ao@%)zYW?D4qjgt$(8Vx9LoPG2N~eN}
z-nwz2dz=HPS$3;z!uCkDTmrJdNX+rPs?V355MzL=ms{x2^!q#PvV`6p=#<2NM`cGA
zWQP-#82O>c?n0FUJIP1rc|zQ*hAJ|mMF+|8j-r{+lN}GGvhybSh`Ghg5kL3J9d`EN
zg%VU1@H~}`<N)Q|l8NVoW>;73rMpf}?TVpJ5s^4RNlz!*PrrZltlf)Xz}OtET_wWN
z3U_DR=0K|Hej`!?)hzXGD-yJSB%X0$YqF6H4u*3&Z6{ZXEW=nuo@_Dyu9QpEm`D{-
z{(^1fw~el}v=0}yFX$`Us;fLJ<%^9wOLop@*g9WuMK)Y~tb6kfp7X$ihg3n(<jx!0
zde?PvquD@Oct-)ZG4~Y$SK;X+(#E7Kc9}SBhr~@j*v9S0tu(G<)N?O?7@H%Qck|*<
z!SMFF{}}g4k6qL@-6x(M4rSz=!zW#Tj@w3y+iwo45uP?FHInQo^6`!lhn+W=j+)nm
zpY!fNh7jw9x$b=1TnhzeRVwxD{s%V|ZP}=8It^{K-}Zb<k3=R<jq##Fj@uvo^0k9)
zzM(Q4E_!m@*3*S&0sVP@qqTj6L*A`Vqs+I0g=do2esgWwe2Wz;IvGZrE5i!=`>`cQ
ztJdPNRrAJt5pEf6-dG}R<_)`M{-a6r4L4SG8`*N}<_$K6C(+m!t<X5XW%C7F>+^0e
z-C{u(WOlfyEnM)P=PP_!*%WVrUF&oUUXrH+oG#18=%ix~uv^c6%T2gHB7FR4py{f4
zKq*D!peLt>g|BBtB}s+nR(Z;KQg93r=p&3faC30pRwBt)gC;HD1{5mSkTwWPrH2&^
zGU{;7u2?H5v1jQir_wfNL>-sTveire;PrA^vVDWyQLB%|cE6B$OJjFcb=D};(`<Fg
z(YVD4BV50J`LuL@mRD$og6o2o1Hd6!H9I;Z427w@H7j@B00K?mntC^|A-#Zh1CvCv
z>_T&$I>w!;*H3&=nH$|@D9YI}U1G~X*`t79E=tzdA+qtdI&?SGst{#n7VRCSqA~`|
zkU*`4Ga}&0PP5703KFsIJQgt7Jg3hDjG$ASC^5e@hD+3cxIZ5-@by>sZr^4D$#t<R
z8oXJz@KZfR0u5zVhUoLv)((7C@xw$NcpSK4R;ul&C+96LZv2VN4Bb}O+C*V_shUcD
z%1#O^lFhWeqK(^0^|_zAp#m)~PowOq&>a@a-4fesI1Bbwb^5$#Yi(P_cbM@-ysI{%
zCJ>c+nMuZfK*>L+9y2ao9(32xR4C~JLoS$lhWf*g9xDtGa%GrNoe@tN)9=i$@o^=0
z>~?Id(`x|_GHw!3dX}kbc>o2*q2a2EwWL|NAqI`K4p|BrhgCZ)a9mRH7BCzh_s;1a
zxUAtSOJ{r8YC2rx3%-nYx^%o*|N1eq$67p<)+=s*!(p{L!-%Sy?lBKDWblcdo(PF9
z#7F|Af<P*gzO2zQQxv0Sn`=+oy@|n9!(GH@eyHGVSI0;?7mVsGD@=vWa}C8LXtUFf
zX8HXJ7*_0*P`0}r36$A)_L5uM7qkft#YR+VC|J(603O|s;8LOm#iROa+6X+yRbAJB
znQRt+9V>xE(h*wVurC$csWY7tH^+TytAl!AHPys+#6eE801l;}mVE&eR4QQl+1*`s
zyPk6@1ui8C2X=RnYi8*fm?4I>2L=YAQVh^{#*i_Roe9ctmyM5juqgsm!O9TFrgIj+
zhY?{8e9O5#<>lUL;5GZ4Ez}p+xt4m!w~GRQsVbmR_fcNEyN{>oN}nT-56?;%;MMxK
zfBnDz?O*>p{eMCaZEp`&6&K%I;ee>jzt+phbnqhiI&}*-)yFfdpIdbft*27Jea?$Y
zqmn7#KCbKbQKzul#dyrfe&HgxyZ?w$K9db=$bv$k%(k`60A~MAl2n%JQ>i&|C2f0u
ze2F#1!B*D06O6Xo+HxHj-5%_P1BtJJZM@yaUdZbB$!u*xySrvhVfR`=F{S>uq8V6R
zR%YOe%i$U~LIsa&GtnQoK`$=b3{H1{Bc4@U&JU4G29$dPE3{$w@zgIaTbl+^18>td
z1h~yG*bHy&>L$Yh_(pFA#>O5x3dQz+F+Mz;H!^_a1l@e_^hpRU>g0Gm=<Kbm&UVn+
zLC_>}ia<+&QPMjB=aSLb4Rj#JsuYys@muKw<`w8B$QUW*8FW}LCAbdipB{4puFCGt
zZ5?W00js(Zc;fLQqJ!RxSk*4)_E@Y`--axM90=eph@X?^3ysKWjQwD<viuo;8k9fR
zKb5GXEx|?C4oJGuKNb6TWAv0+#JvGL#@r38-k&%Fv|?wYZQ)zyk8rFhm+AYf0LCEX
z6_S8gp-RDDNJjFpgM+sYxR~wH_8B<lyxyYcx;Gqi2Ff$nY&VR66R;V^^_gF8n;`Ch
z1&EKXSc2mh`e7_D-MKxq8n_>SdZM9XljLa~ai=9R>cPXxqL{<GRc4?XkUrYD2fSzB
zD$EM)2F$a4<2_Ibd>?Jv1OJj;a#OtIILybP-=pMFkOkTw)&^AuYqhNdQEdGvo&h-Y
zskcwK^$lF8)|>0i04Uz0<&r9~6u_2&T%Fd1UrzI>23}?San7zhi}cKYvSBxXg!$YU
zV;0%DWLXK>Al`0IUSk~e0||T=t1F$RmwEa2^0|eU>cthfCBUITF8=%Xlbw@vveV_<
zViz0^&Li&ZJej{sr@2H??Sy^`E~XiHxqQ8inxZ{U)9Dmof*l@O)V|eZp9IGfb#ei7
ze)y;p)XBu*A#$mBW%Dn8oyi6fd~bt?gSFW0xNp1P+|+JroR$AzAaJkt9lFJ{Shu6{
z(hQ6G+88Tysw~-kc->Cgfn71>d>6a}P_i8^P}STTtdT5HyCIUKzCbZ!bJ}iPAYGqr
z2HfhXXz$hxq_Qea^C4rAz3%4{W{%9)Vy5S43w&_!w6%uZXc7E>o^_QCd@@fYn}jG<
z>=?>ik6hd4ChUOU*-*eFk$4-X1u(D-^NAr~$%KuPbfvjBEaB>kyXx}fYIa4=nax=6
zmNdKdgZetAW(wiwh`l`#^_oit=`p~r7tr-WHJrZ!#JBFd2j}bgTk)6YD6iu;)p(6^
zFiRI54GQ2mu>0SCCLN9d%Q=N&u!AK8tlQWiFjZfQpSnekhAqaJ-|4#mxw=${@sH-`
z9s_Qm;)(Nt*KcE#4To}FLD}%2xz~f)ATjZA#=%fiQEEq_3f7vusD}i6@x|eCnO+V+
zjc5X;qX+!?15UE~kvcK#B{_E_Pkxt3tXl_P_z)7eGrFCB(QiKh0Os{_`thIf(f!|k
zSO`%?xk_Bgm+)J$VOY!sqotwDPATN9X*>>txHcvpD)k!wWoYzjpbPJ>u7BUNt09PY
zfj(Bd1!%i0bO<`hP63`rYm7Vni|e`zC6W49bPCsS&iepEEMQU`Zj1SY(Ec#H;XzXK
z)WdH3!eRq|Ak<mfi;5Q425>rMC~P;e13c(>NO^x&Vg#+=40SswWApYMV~9!?Xq~b#
zd_LEUCct<bEe6ixr9a#e!4Epyz9~Gg+4}CXVe~ZgZ4s2$K#8ee;Oe(>9q{-@dtRXE
zXmvNmW-dbV`tJ~4-r|GCA(5`DHI6^*?g}XmP;4}R=#%d<j@-(XoWE&^2cfkdE~~UT
zXvhK1GhO}w?TKMuJEB~L-eIz=suuV07ET0&Y-o$oW12M7G!r3c<O{(?;W+9U-O&sk
zzzwhGbx0j~cr~ETXGf^tc1;LYTJs&@;>2i-oh9PwJNw~e@TJhL#gi=<@h;far|l0m
zp?Woc$j#8+5MuUaC7kwJ_k(PWjhBPx0Qr_^>hn<e&v>J|7uO1hyLHv2aZSg>(5TeC
zu@m73+iC~85hHLZyG7tNWK^?#P_KE}Mj{BcqT?PhWDEASl1t;5Pcx2nxjx|_-h3Xc
zLU`WwgEz9p{UP^zJUsY(pIGZ#E|g7~3*4=L;+?80Q{vwQ$Lb(BeEy5w-JowlL0f|1
z$>oL#R7Wglz<VU@xT5Ypdi69hTcz1TNaneU8&}o#W4fmf7kS5=A+E=l+t-c>VWMBW
zt&8%bA6~tBA$;#*Als*!m*rY%dtL(cazbPm|7k{Vkas;_#`yPup+BSnZsLcVfg_NA
z(e^uN0krMSEdJ9%5KJ&w{xV?l`FG6ZqhjIm!;b^FiB~obCc64r6E{mgUh3QXBtBk%
zEv@oj!KBp5ny;Xj=rBFoTUmmxebB)7-nktxzL*X%3~L%Z4&QAG{cuy<?F8NI-Yi12
z!clF`!(&basEKH0W$XX?Jd-;+(U${%7W<ig%PHx6V&0zNGCnB*p2l{LHAdX9!_*E|
zL^-gKDHC$HnR{q}{J?4tPvR5Rz?j)-Qr3(=?7E{=WzFO;Io?da-s<Krs}MI1+RD2_
z=E`X~7-Fo-C(ub7MkY*mo?PX<+HUJb_x`^3T)FzR^ERALhf8<XkC%Ko@?>&<x;g6+
zyO81uzj~v3u<aDU>h0C`Qrzb|zRw$ucuoHmEO~gqJ;rPht{`%zF*i_SU#W3k&tDO<
zRCXi@-j+D{^;~?z@HNlTZ$C(x3gGD?73I&pJ3Xh~yWM;}NSws0;z)e6uk3@5R&i~!
zAxetJ-C)sSWVwCylYuJZkn?$ew7pL+oRj#ccFVh&Z|hk@kC-dKJgaO!kZDZ5O>S4z
z6HYH7U+nZ`c@C1Gbf}Dwo(6LkXv8?j_x*ZQp<AA=PK4c2-)8}j&92o@po){G)mwLl
z-LWF<_v-X)75{EbSlykN{mWbt%mk9?!M&7yi}%=hTMj|Zzqo3FIP~6sua-|;#tVBy
zt+ecM?~;g~Y2tZHxDv%K!%sHMtx}70$Jjnae-$`9UrT{?L(Nss?S#f%<0mUn2HNyB
z?j3)Og6-4LJqt72>G>q}zHZm&W{uOe9Wt+>Mru$VRb9XvI0#5It12C>;%C$-s8NgR
zg)AhrEi|+(XPbWA{<tZByl=QFhGm_IZVdKopq|w}&`2SwZXuxUt=(BP($8!4D2UJ5
z-l=M5HtLdU9S~<%UJ2O}^w+S8A5>jbrv?bWKDPCF1Nz*c2=HRReh9u0wYCqUikzfh
zC(^2tiYWA^g?IeLR`R?dP$8ntS4S(<o%5MO2L)}RmD(O8Oj?hBcS72VAj$xI>GP1*
z8)|t1kN=ygc|J+0Bg!B?bqBVv4a*-;TUD)9N$r;7R#m^cej251H}xWpjynk2{OB3Z
zBS|RE5VG)M<qH=kT28gLo!>-ch+&LEb+Sk=!QgtO#74Erj-7fE1VS>jC()bg=ReDc
z^iy>^h*IHT@RMSHLU#tjAqT?1A(N&y+m$>0Dm4rM^VHUUePzsbGUkM%@6ku^UrLsE
z1Iwc#ca7J<A?QqTs8_3Owt&`d{~Pz?kN1P(?(y$_C+q-LNdw`l`h&`Xbludz52NbC
z!4u`$zaO?~)0Uwe1Afx@=ZaFTn*#}6NJRPy|JuKETVkAl0~jFy`shJsMYAOP`r-@A
z!OZGMnv&beZo)9S3z|y0BCSXLWS_eo*|@lrjOG*lMU*%AB)1Vv@6bYoSYzVWJWwwD
zN*a?zQLZ}e?dOKb05<J?cOrg~VrA0}91WUx`fzDm9Z_W1=LZ%-?ADW|a<zE`McC-!
zM;`g8)Wqk1jSJvMQgv8~YXh#5+woD)TUEz1o~>5wg#X!&L0D~c5;}JhB#j9VK{xuk
zej1!M9Nx=VsV#vln)owcTF{Fm$<uU<3ymW<xs>Q-7qvz;n^$Ezd50*%36Oiv=mtiE
zd$dLQ4|XsW_m`8jJa64fUaU)iB_K7iI#KgEfMc|Oh26+u)wc_LA4Y2gZs9GikG}P_
zAvPfx2!Q!llC?s7$Tb3|>{=_>$VdapbpdFcE{3Rk(?aspM)k%iY|T5oTj{!1x2g9o
zbR6r%Uf*Tl^v%xYVoV%ywSBmV4=&T$RN@RdGJBb6ZVLKRT*z_6tgDO&E=b)Ig{z~>
z&P9KJ$b}ETZ4G?tj4pJA`$A+!f=nAGFg%?HDGcXHHSgRtGZ{jYC#e@P)!tQVOJ2fT
zKJ^9q05~iC(K9dg;Hd;aMjzUv;Pd9xf=yWk>p2A*GXQD=3ce>cXNQ|zS|W*VCtaQq
z0i=I7WnQ~h9Z{0CuY8g<gg+v|8d?bJcKPgoY@Z?maBC_%-MlV?UA6yV?Kex3x4Gu(
zsDhF3c6e#PfetgpEumnw5A$+}X2jB^vAO(Yh(3-Ik5VxRcbCRT$ZpX={4=)715Q7L
z7R5=P(-v6b?2?17=bIyZuMF_jSj_sik_l9GIn7`k5DTrgMdR$m`S#2kN*SzBA+H60
zI;yaA?Dt?W*hw0W90!Sfz9|89xNaEprU`MD-TP7GakiT7xp?CW-m*)R7)(oLV_H#~
z8BReFL<|R0!csBd9)-jN3E)Pj^N}Sj-;mNRO5tYsm$g)Gjp^Gs?@M#iHce0E6Sld`
zX_c&0o91&>UYV9G$aZ1VSM|c#5%a%)D>7bQE>^`LN@@{LC37ws8i1)hYQ#qkaEdo(
zVQ<cEUc)0EB+nEF)}g-E1=|{qFR;@Du(ns%P=o`j>UYEQa&!&s*D%+5I^8&`2!|E7
ztL&rE2iXZKb$V^ECBid>$3db{k;zA719s6}pC2DI#sw8D&}uYPGn{9P;u(W~cXk$A
z@U;Zo<r7giyW3$m8}V6xMm7b`*q#}VCiYwfwd}g!nNIZ`cBJ{#UWKO8s(~Yfqd7>p
zBcBA+_|y3%^TLQzmk!fc|E#EcK2@!&Mz(`T+*7>x7@Sclq-|0bp4ibm0>I@?hw!(1
z4*RxV$<i|JC_Zl;kry=t<%Ir!Djv#4^so@s@%8cy%XXT-Z}*ZQORx7#0%52k)(4y@
z69;v}V?^~TF#eS(8$1OtMR%@Alq99pVC(*A^k7#s`!AZa8dyeyR)gy~Xr*-)+oq1`
z--<7R*g$9t$FpL?VkNi6+Bzhf0HxMY{D}aD`sbb^QuP#7Sg2j&R5X}>Gq12>1|xue
zK`3ZBs)gYC$l5a7m~I-d;>*)?oFzeBL6YcyHoYNVMKhwLmEcl$iE<+8e>RfOpI^9W
z&>*pNTq8d=dJ@!S`#JtvVkPZe5HzWwk`3vp>jP+vj;v*{jz<#ieHYkBUu{WlT^VOk
z!72z)^g|A`;Sz=f!5EBxs~3lzF6>vAg*U1(uYoG?K6a;WNM#q=5#ERUnN^)EJO3vq
zJm2p*G!~XI>E9$Td=4pktFG23`~D^Qy(`Ex!Km65F|^%_5?6bynO~eVS`YOB?gElP
zd!AqFNo02~jIZtmvCh4wu;X4m6u7r7I5!e=4H-g&y4~GCC-RSf6m+ixuLN^TDEw9s
zkWBgw)=m7n8zo*KX0!uwx81GEx`KN28RzBZ((d+IkyBrhe;rm+C;+#6P3hCStxZBN
zGYt3RH0S>iahEt_VZKWeOAu_0bA}4##DR=(dcDEbkbkXKRg!H?mCRn5_!sQmnn5ux
zB@f%;A|gK+rd7#*yrQy#_Ljd)p#8;?>*o28G(a_J7Q?u<FxzZYhe+2GOjzVr=vC01
z;ST$cl6VzU_W-w1Y@cuAfcr=0r@O~k(<=A=8mTcF@?l&@?uGp<`L9TGE6FMvvsQeP
z;LA0Cg4kP6F2R4i`Xr(E@uvyBn>nEB=4`dDM1gEIW6CvuL6QGr?CfR<IfBr(3qGn)
znAH&A*kt7xFIxs1`mnIb`l==`Ki(oQ*Q!}+HCIZ^zNF!9UoA5SaNCj498Sdkl~Qx)
zbd4kO50aiYZbToQD*WnZp}LYKt|>!Ym>e#O+G7^}3aPpxR7ZYYw!Uu4ZZ2BK*sDfx
z6_3__Dyl4h|1@cP<J46;+0!e$!F}y&ueFLeE*KGDRur5=O!&A+8o^=)$>BTtFRRQ?
zBWM>zkTJNK4MW=OH{zTaD&$FEHpHctd9E$!8sco{@ll))g7hsQJ<;ceh|#srgIvk<
z*bcWkq4VU2#X}Gc<{F^FuM~2!TvSqq+D$6`G{_QvOJK%@W##B5Wg9h|6^N-GXAw*q
zu@anD>>x4b{o>+cVD{?4Bzw0vDaPd<Nr)Mv8PP<Rdly#MFs^HJE6vYw%IGM7lGF7?
z><YUjh98U};IlhGx^m2pRK$r{2Z@LeNqL?^@^^(V6~a?3HyT%C?hKqp+6?wRm^^UB
zGR(PuCh6uoGpG#-*ruWu0-Kf1X+xt-kS9I>voFm$#6Zoi&kQ-YVJgrd92)>d=L+=0
zPdqZ+pV#^Ltpt6xTKfZ%r*syo!{6Nn$@OzqW-G9HWwPe1gb2fM)sI?tP?O;_XD-LK
zP8!v<mc+O7d9g}Gk;WM)M=rStkNqH-U7~e=ahG{mT@ko`NZ#<L>I9N<*7C|{3>+wE
zuiDwYa55ktRc2Rof34`V2wrtM2)jAR=b_Wlk16hM)l5a3*Vh1dFly;7(h0zSD|TCw
z8Un|U4YgckCvYZP6vPTtt8xAK;l-xn8^<6~=QaT0wL9V0@L<WhtqN@FhDoVc#b3LB
zIt)v7(|l-@SvVV9k0Hp?II)?QYu=^@t-g+&SD$XhKY~m8cJN2|q0NE+`0YqC#PyO<
zeI-X-s^Il}&Q)kjTuWFSjJgatd`tx&@RsIOAR{e264e@dgG%Y6=Om1;;}*cZ`CRjz
zEN6YAgEV{o(%R!B3o|*ql8?H!-~B;<6CLTx>cU|G)Wsy+8C2;*N#s^0$9hTTb3MZ~
zce1aB@<|9)$eG4V%}F5ug>D^U@X*RBC&|FEYBXZjMlL4yY$=!mG@L3zx8)Ii?V7DG
zXnO<3tZujAU)e@P7v7u}a?%R5%TL&GjB{}Wq*k_s;>){5UKMY}kxjkLYAbwy^)%SN
zwuWg;F$t=S>{<h}O4<3TvDWb1d8lpYTxh#evGwV8STAuA|C~Iv{rYoqbU9y<4E?i2
zp@PMd{RPo_zD}nNPuw1~LjFPPXOHXobM23f53chBlCzQ{Mq|9C)M(g^)&j!wzx{vz
zKlu0m{r{qW6G!fI4bbVI0*?cK=nkS<``P~BJ%~0!uf6Zq^Df$=C9uY#HM&+~`U$#E
z6y3ligDUMJ_@p|&FOsG@&kA^DhLu(Sjs6rD+4AT-qq{en&_y}f-&(ZwW3eKBk=i!A
zcF@jCc-b4HKhV9gtkba3EomoSHxgu5<3X3vB&Wy~BQ~7VHFmAbi7n25mPf+FAmHU<
z1GlNPvkX2+iJ_f?UeEFpbRU%w=R~7e6-^A%zx|*8R}ykZV2+f@LX<<qx-pFq+QXkT
z(RW;Vx`WlB91h5hH`xIbhxe<NP}Ohm?+?Bl+-}X+v&AKT+}WpJ<v4$vulh7G%lUnJ
zNRL}2VJ@b{YMP&Xd;czfm(ja6*w$g=Rdz<3W{LvkOgkK<%Q@9f-{%E~#r(J1gFC+;
z+|g_S?P)>1J?9tq2K)44-`-UGU-=X2^1a^=?zUS%8u@5F#VHB9SmTvyebnjm-8)<V
z{qNHZ;>@1>$<6(KaL;-(E9S+tINQ_z^6NW;ucMya3N~8PE%M-hyr3?*TjC@;Pv7N*
zgvXnZVZLSozswl{>NmSqLu^oD){xQGI|NM2(dK5DlVK=a>^&xLRNzU4IY=}CEPJBc
zh0{7XIFJiGov*|;!zrmw8>WGpX6OJ3k7737*=d%zNSP^NtX%dfvpeZGXha;Rl`l~h
zIc6Q!JRoGRIn9E9pYe?saLZ+w$j|0QeCmDi21W(^=`;1|bEFG=SRlx4W?p_QHjtlo
z6e%DBll>%C&I(-!o%o@1qW}4N$IRZWlsk#&O74C7BX4_n_6LoKpL*p}YR>KQ@72?t
z9o?&4Qi^A<Q~=yScBKjPobMa77$E00!^7gzxBILv?FS8iKLsk2UzFOcP0OUJdiYBo
z(q;M3Ca^V5W3GA6ILARFAN3apInV6V#KA?h=o~$45>*wX9-J3MVq@j|$y1wF#n|u|
z;MKlr6)5z2F=@U=%py>_W5*yCd{X4gRVYRPYIO#vQbf8e=Xy!K%F<c?L~LP|>EA3p
zH%^#|d5`sfWrA2%R2mAb2;pfi2$U>&*;o*}XQOlq(4nZ538bP4YAomGqc&_ow({p*
zrf2(%AkcHO@a&>M`*emTmwt7F@n!EeX(XUGd6!L#1ut(!6X4RAka)GR1Ar)DHffbl
z^Hns?$07|}XN+5PCOE=?pNA%nm=FYA$C{FjLqoWK4E(ar#Aha)lJ!Of3kl9o5@rPu
z8Wv8&)!RgE0O+Ef@K;OrZ7Jy<UoqA>)1<sCYecr6Jb-dHxL-j=Np3o*E51x!fcu$f
zNPenEo3F((*2PuySybZDyac=J2p1<?HOrz2h<b((eQ#hyClQRP4WwIDLsUCAVtvG|
zq?!MJ1`iJ(0ji^3aFxEzfb*WwRn443eku+H^r&R2cuTK4nrWKVnb0s=-w9{ioPwoU
zC1IeOA8w5^SMX>@_(U(v)YsOcN;(DpDPfH8e08aM0J-u7=9-E&@Li@jsp?JW>%++;
zndyG8sprIV)vJj51RXF`lqK<EoRLAY(wVw{%(BQ{r1Oyd`dxgH(!xIGfuF3;B(B`9
zQcae^Alm+#K5*A%6dzZ=f7NA30+P~I_<Mlb<V=9?o1Ye&H1+IiqG?Gv1g}_^#C)e0
z(Ozk59zs~Bv*dV|>k&`R)-*w!WyKzee-6#en)eAOPc!pHF`ZaN!YY~(<C&HIoOTO;
z-zTsU&*DBKmXP>p{yQOQc_Aspq)6tweD$2ff@Y-H=h@;|P!4);{>sl`;Pu5)vXFDd
zTUROB4+GXGB^vv%$d<+QT^10H))U#CoJuFHso5>LTGjlrB*F>LBQ|E|EAL<8U)Sp5
zC^mLJVLzRTi#dTvZ40jY1<5dG7KXil(@Is)<?gNb%$#0%3yzEtDNaw>GOw9(Nrrz0
z0HeBa&X2)+vq>SkOh^*%MOyA&5^L|3F)Jz)R2{rHl@u^qg2-0e7_rKsBKD~gyg~XK
zMS}a5ve9=a7>m<eO2!`sGOyZ1X~yuOEm4CigIB4hWzfaAI}kS4Gs`W|+)#{v1)hsa
zxopRy+j>2nuyoseMy}FVUq|&y{q<-E=Zh9QH-}0(7;ro@bx%BToJ`y?XM(P|Ha6>&
zd2rdv52Swq5@VVK*(BSQ07>JWW`aD^Etb$vvM@K@iAd@;vFkZ26-|vh1&j*KF}qG*
z<YhLnb%!pJJx@ZT$KW5UFu0X}eCc)#n21)uWN-%7I-_BXx9%YGhulDkrID`&%s#hT
zb>UcI`_Twf3Z2Cu7=M!#9Nxmwg$)?)@a0AhwV&+nn$ibO0<11#c1V0?tD>T^kc#hE
z<swlVrbpN#)TR8Gy9<H|4d#&xzHr=HQ2wXQ%2wb0Hr{S`w}}Bq)ti`qv4&N2B>i!i
zg2e7fusC29ITX6ITle}G?x4w`qRht24EBEx%lr)7iBvcYE4-q;L-rKs=bC(K_%2=M
ze4vIYQa;N&Ka^Ygq>H1PhMIDkCav0%_R;RWoXr5?F=qFc^*sOES`S?skT6ZOici2Z
z=^0Shp!jyA_hY7x6X9-u%OJHYzQmb<d}_bL$q^MjErq3(nz3z)NY`3O1E;5Qvtu4P
z!617H+!!5g>{rHXEC~uKmWOBX@X!}!uGnFDpisfdpM|N~S!R{anddQTVV@TUxt~j<
zik}|5X5P|XIg&<lz$#_0m01c!(^^>_s!X)LS+aBV=)ucJuZBl|hfiPaB*%d|GqFv<
zd*t5lhrv6)VL}G8SoTzW!B|B9m#@OcB@^y+C1c5)>kA8r)?2LBtNN<wg-$d1)jg;x
z5lg^KU!j^ew#*qJn`SG1%b;xR%~@_ZkFrC4`7yM5nrp8=<HI9P?HWIAp)p?Vx6&Y<
z;Kb2*G|4Pt+8Bg?o;H;K;Ft+2ui5@r!)0NII-sz@!RC*<CN%Q&6Kz-{?bJ=G@g=&<
z+?T;Hb=_ELAOl{Pc6g4TSfloN9n|LQq4ms7a!h0&#WSR{V>63PbLVtDo}E|nYL=2_
zs$}lz_%+gYUvs!!Vy09j?VFutyvcguRfg!&jKigpcX^qApFq2IDT%O-i__DSB3(k5
zz3wbSfawS2;Ky?OJy9oE3$~&GMO}YjGn1e!-qZZd^S{d;#HAbiN}-hi1o^c95AEME
zWJCtX3vv}w3u_|Kv;6OJ-~-*Wi?BqUFP0>{NwC^Wc=p(J^yOEmQC|(0`YIm7Bizk2
z>t}F<oAVBTS`=VP*-Iqc4QkV%_87$0rYY1Z?v;2WRqrLoP<fY)-$8|3S{J~{uNMN1
z%S+1TLS>~#gv`gPy`*mZl${WpCLOsqypUhvG6!6~yo?u3A0`gSTdp0|^`ixGT>SyQ
zve{A=>-La&uc0~6Ha5qf^v|Un8hyxt{}ta`CwB0EVC<?nlwEP>&M?h~dYjXTH|@N`
zC;hZ!XUM?egz9@P@Bl}2WY|sW=x&$mz5Df0kOPLLydt77H0s<q82P-fpN9)}x6di#
zS2?Uj`d;?9h+Kz@g*!}(1wzGCCP8>YywBZuWS>iU`f92R9uRw+c@Ymdx)drb_<JK~
z$QVU`%Ban+hw=tZ@{YU35`vZGlmE!wk1|EKhg-P9M(P#cu+m9)W%ZK{?x%7{zZ`DR
zki{!5KDk5+Ce5sTXa#3-##?9lrgKX+(NrAa^sz7o`XjhvGM8oVT@LrB6Ao65Y@_vS
zw&GzM+&~TYIvi?~cKz$N1SAJ{KDz*-n+QyQ1dg1Aa8&$zh5xnNN+80ZIskD%j=w_&
zUJg>?5G^m0Pgy%<ml<r{*mRDf4yyfl^00Mi+;<LRAAI$e4fI`m0=62;35j?M=FY@)
zWj*vFpA{2!{;Rb+E~Z2qR1uISW4;UI>E^~oTS}Ltu)h-#^w)WLPHn9&GN8=3I3-uO
zG>+fTe?szPg^{pAj}G_c)Thwq^*+ilkI~kkj$zG9eiQ6!exnQDTnvjJZXs7!rIPCA
zafR8E_}&GR%XRy(xR?V$kp}R;J$VtCc-Y7sS^eQ_4!)Im4QKd2@E#xZ7hsw2Um|N_
z+0X(oI~f<xq4$vRM524Ij)91MaMF&z8+BD#f0VQ1$mx2jSsuo3iL@@(OX$AJ0m9`}
z?_JqUVq+J1`nU<i@a}Lt&0_{nvM_KKP(Mp_!j>X{t}Y74IdgJ}Y{qe3p%8bVVJU~p
z@i~-{zMj@|hz%9zuQKL{J$ow$Hq~0vXdh?LY|)I${uSJ(pkfK0T!=o~77_uNIwu3`
zf7~S4;0NC0xWe%-v$ORyU2>2Z*76x`52wOmEfSyCknojK8ERV3Q)}#`Vf5_xSRXtb
z8VWvJk{xYTT%^eM5d>Or;%c4j+M4lHZ=BVMd>&0Ilt(FyxQw(oD^%4K%R?N0RhGp#
zXB~l?Pu{30Uk&j*uICeyyuF#PZ0c0Vf5@{Z2YOeA`p{m&vE+>CR0>;PmCfDp^s?t+
zF2$}ZaZ0>8aaCIC7MLfmFVUw?`^djVA3)dPjJi1xm5-WyaK+Tvwpgm&!o&skHQue@
z(ux1M;aH-QaZTbwgYBEWmrIe85nG3QA)p5*0p=K6Is-Yl3_f&%9;7$J@pEE2e;!--
zKZ#>=6s?%WW^A!aR~DgDvI@xJ4<U^cfux;{^F|{1u@YCV@=O?kp{7;ayR8mP<?wHa
zyy3?|b6wddX#!_rs;-3RJ2oD*$kw->1humgekp0vQ-{ntNLbj#hf!a}jDNsxszFc=
z6*Yf1XM8;VVSVzZW6N~DK8cr!f9UO<O?6lljn{!TY@Tb#v935Zc6XqNos*!IWAB7|
z{W;zrdP`07+$Wuf*}R|?I2P~P>(_l}D0ZUeda1(ii|bc*cX(E8tmwP6JpW8p9sT*~
z^=tZaSpIFgVcO_6I0oEdS&tat2Hf5K`yrk3x7jkfzV8iaJw-Y-!U-0Me?(G7;84L;
zT9RzyjPIMg%|TC3o$o3iP`sLDDc?Py<fr+vl<-v1+LjJG|1l$ri_V!9r(g}7e|+{X
zGs&4wAzd!n`&=06$4pr`yi)Rv&kI)7N{K=1OBxQin`u!jcpP_R9Qa+bT*z$_Jrhh|
z4i2QdW0qA#bx}P#1Sugof6yXLCQ8?(&p7c~fmqHZ4J9tk>3BWmTVQfYQig&drwoO3
zEX2#@v?7U$pY+`mTAQzEFyC=L10Kp<8H!{$$S|5)@^>Hc%4RszIbWZg3iJSt_M8Kt
zR?GG3{1PnA1oAJUkU)#MgZaGAaop7C?_Hw`*)pA8(K>z6wFXP&e`}`9kb965p@Wz!
zDFm5-;b2nE0^a(XS~bwUJ;lTjipz~F9*l#)2)1LXAM@B5I|E@1)CC}xkyr&TPCXUY
zGhwLo$Rz=&#-6-R%KVHr;Gp#f5WYDCG7O4k6W)5^<tV4CWc8O^ozltR6Nnari|k~P
z?9__ysD$wYc9Klpf6{hbHc`c?KRb4(+6TIk=oscCRU@G1_^-uD6Tfg9@yU_ozaTmS
zSM3FxkmbfuT~u854?}r1WF)ajvzr|8-N?}HyijcZglRcF1z3ohJ9^4lA3LxC+d<da
zRhSV*Qlrg~BlefL&0<|nFGEec&-V)N_ec(98^cNs8??L(e`=E)CVwq*ai>W-?DBx{
zKoA~{zE021h=FJBs;f9GvXzL;EH7;f<5)pg1<rF~iD6~4NuLLbCp~BVw)V#-m~=D2
zRA`zmoP}yttf(`*;)dRu&}<XyA*S2{O4F6~1CSDIH^L~_Gu|#!U%Pk_J&EZ}tM!wa
z$7UHgxxD0pe-*NXlzuG0FT{x-+7DrGWa`<)YrP8II^&vTm^x=RMW*esafP(~g%l>o
z580K5rtffkIfkz7`(?T~CsyF_`>yAMvN^FqZ}SCFu5?f=&-U<Z&&m!{DNCD_%61c)
zFtGVV`sUa*94)SV9I<F-X=E18h^DT4I6^a!mC2Kbe=uY45ctixoxEtOG(H_TZ{X(G
zZsBh%d`l0k_8kM#5O+<sjYX!(=p$&}Ofk@KNbe4v9K&oKGg`q>-8=qEXe+ExhpVj1
z5b<@E{MlL<CQvC@2YFx>L)T$8T_uyk!uB=XJo!`lE_LBc5VpNPhuC67X#{6Wjur!S
z3}dONe?kv8EPWeP!<r7M+<%VS2--5mVQ^u*)0_^)^0Fm7{weVd+>W90l>vtnS);^-
zhba}W<mf=>W4zi^$lO2$w0){%N3;NQ0#KcSc#uh|!w>o7qt@+rq>O;}9oyu@od#P{
z%JI507+Y6M+D-xC6T~$7(iS=T(zb>FvLzwSf8qSjWqD_a<y-cI=i#&92G)~nX$9vc
z+Q+9;;?}s<`J~0L5T&<y3t#9zW-*pFjmm?@Ra$}u$wOw&JmKyU)`bb<{EP&YR*Mgs
z-&JMOsS`7$n2rZ3c|d(|hsqNc%Tlf#&m1*vUT%|i<3*u=Yu*csb2$(vABK1M(-Awq
zf6(qbJ6~O7_;<Z7S>3Pu`(M3JPSbKF(dWw*l7Ru8O*HXB&4NL)MwNrUr|I7>!)d{-
z;5SHD@%`OCpa<YbrQ1t!C54ebnPfA384^)yt<PzwfR!Xi1UmvpCp$fbSx+qm;p~ei
zQ!(F>XnfWJxhNn<um(I$5d4zPU%u{Qf1<!cGd|Z}zShu|4U=`UMC#sUV)i1o-wvQM
z<lvC?9KfrOCb_r>=~AHQp*hH{WT8IatS!YpMW=eKbjSCj*GG?r4<G&beE9hJ%i-gv
z&wm;|`pe<dQPSj-A)PpW1iklSnbYvK8*e&$^m_~&QI8vd+Kht(f<AF)3O;+(e+}(-
zr6+%W{p7*F{ORbLonfE;f)4OlOk0evw{ni^%$GA@T8|kxTyT7|i}4BGS<76Vae}pQ
z*lNX6eO6ldf~8c@Lo}D1tXC_lBUeNmG=fW#+o3{*EoQ3kgy6M8V%w{{1nj3=lbSt{
zy;Fm`8}#C_X;cJ5vL}!*&|_M!e@P19Q+l*wI45q413%t7b-I{btbo!ero}>91Y{0-
zSfm4*emCvR-`-US%b^c<VI2$S8ltcJ?(6OWFH4`Xa3pV9IybpmxvjwU6PKiMD$*CB
zQZjE;^WZOsFP|KK_w>>5$HQlj#DCY`9k-*G?KdL~;h_krHW73~^|exFe*q_<64&`w
zDIiiGNw>yt*_tD>w3x2X0HJG+Wgz~@--cy?_@VL)x0NuoR>1j`J5Fruh%~X%7$`0U
zN=RRI1HUobZhk__N)jR&%BSmAg^d>92|Gc!L0YZD<e2}wIcs)Hs^DmO8icYE>ORLp
z`|<MA`93=?_7#I|1FV$Ve;fsL+!Qv7O=@0WV&xmJS{{1Zu_KVBgbH}`<OS9_Q_o*E
zYcb_;+8y=vz}B5XI6r2cO`kttkDoCWUgpI{{S&P~efm`$b&+b$P+Ur4Uy)IWXv#b#
zN_qYtN1HD?&S%EvB2i5Xhn0qodzVfQcj%mf*P*}G1nZ2>hLQ^YfBI}%oL~nk@5<eF
zWn))KKQ84CRU)KgVKkYiewx#D%tq+am%G0BZ=5Ib=sVbC3jj#KSeTXLbOHL0HDgy#
zU}>@&FHdQy!rq>c9JS=0W@%{*pB*#7g6D0wSNgv{;fOHfL3Q>4V%5hC_hp9rX<rnU
z{gcZ+H;YgD7Xds$f1kd>Go<Om-S;l*n{Kr0W;8F$H7oeX(>1&jT_)AYibW@(nA65!
zUg!0Hu3_YB+}SQBNu0uYGgJW+{?q>8&L4h1xZQRsGAp3yhD+|#ty>B^!O)}0#My#F
z94@Y`(|-K?dApa~yMwfMQSv`2aMoC$>u`2_l!c*&qFAd5f83*Wi{AmHf(H?V)V~k&
z3%j1m8HNp%GbmEqrv)7bKzH7|8|7$qecf2Zr|mmZfH;f7X|=v{s0V8F!!6_}Jt%}Q
zl5mqS$qG&=Y+0xEJt^L0UFd~W&f@F@Z~1ts3=u0b<I9Q)@+r;L)S9qc7D!&m@!M_0
zo(|x;fRGNCe~(A6G&?cqj4D$^NiD~#T<0r?xd?k&&*Ik3R}zRAI1G<;avs{`Fq|w0
zQp*`Oe+}*V5tB!Gp9T?Pqrsj;Uo$$J+!a*+rI1dhvetiR&1T$PhMH4-!JPJxsRNLZ
znI#4@bSj^4{6cOW4tH0-vVU?u<G=<GNe$JXHCnXxe}@ZKh54Vw_qOP6ONT6IbJJ*l
z`ARIgp|M3CNa>*~?R2|cZ*_eD$nKk&TgOsF%5rpw{-I7BY-5z%6O~<Pktnj~d!DUN
zBxAH;B3XP8=TZo8!8FS*Oq+tX+!M13yDv=EV<Uv~Ort&UbUwk36I}n)lqMO}Y5k?8
zc(-fHe`_to!)Xj0Dx4=;lb=vXVH(v-Z!F{P`IE~VEyPNfi(F>IA`YE~6t&6d=&pSd
za4Hs%BxZoV@)Qvp%b|~a)ZO(>A6wPEs?)wWJP6|ufwjAC(%4fLSg1jnEm0>9)I-O@
zSol2UXLI&K<$8$>FU^yJb~YQp)dU>|D$yxXfBy!)+;V1ePn9(e>~X<TiSriA_spp;
z1E>i`Gg9+g;I&k)p${t&=+A7rJD3B%-_6Ov_O03~z*m;GsMWp8-E&4XTGDLE?lC@D
znJ%E2JvJ>`C`JTu@Nw!hA0(pJO>M;jQ9@W)*Kz5e=;AAqpyJf43u5vEb&vR|bHzbr
ze_^wrmJbx!Q&EUG49bb8A~&jxdR7?eY}?0en#cKC=xfdaVnpP5+7ZluG7zZGN783q
z0oI}vm4VRVF3!#vLnvuKsL>N=%UlrGoC|yoCbcbYr*f=ROHp$CmpgaN-0N&PvCU(+
z54!9lf}(uU8Y)z;qUU64;ilCXWL+h+fAQ6AS0#4GXuU@?WSQ@2eZo0-vOSy^Lv|e>
z-T2(ovCE4|aOy7vk$DCK#43}+ziA&u$HLSsm9xQPz50OgXIC5$k$5*BkYE37a1R=_
zB$0pHbq)wyjituTr$k&qeJkjNa3~I%q3Oz`VO;;L%!#)-;{Y@{k0Zmk8u|06fBn$Y
z2(2BTubheL=QuULIerj*U?-<;c$TC%!qc7Qr#Crqqjc1C*uMVi-fef@lFmL+{>!eM
zyYwG?pbicWR{4TiRbnAU%e0rg$meDrYaMTV2VKIKJTXIk%}yX{mQY2zX#RPN{v^=n
zcBoJWN^d(N8+t6CRT7ix-7Ss=f0yAsEMrnsC%6T3G;YZE1v2@nD5hQu2$d{{?l?bf
zk#}-0?+lXfE}N)|SAk~m1D$I;dj{Kix{Nv~;>dVR8=Sos<Ho4_KTz-9vE>IE1Q_4N
z5kMsoYyGclV%~E$*dM4LKrZ7rgWEbBd*<iN+?X9<eA#1bxK}*NIWCsYe;~`-b3J!r
zk?})?I%}wP*Vsi`iV4dPj<}-q1^iCtcs$EUEV&ePH<IM07wKgw-g}cwAuWVcbNm<f
zhFR)a_(28(mtBFm;Rzjl!L2>d#Ew!WF+sTFgCO4md+6R!fT$)gVqv0MXQ`>wYtJ1g
zs%JtW+$F1MlncVX_aPxBe{G9`Boa3C^vi}xo~%kv+=hL2RzM73<sjr}Np3eL8N*f_
zpi)oKmZ=-*Ha}w@3wqOYySFBuh%d%_-l*xaSc7nRm^)eoabkfQu{tU_bH@*+#d^ZH
zr81@$%OVMkICMXq_J1f478MwB*m~bssjBUvX><;r#@F#RqVxv(e>o(}6dAid=RFa<
zSw@d^+Ugo3rZ@9cQ-2p0zP)Oa2?tztro~D*0G?W(;BT;Dhj`1pX)={Ouzr=<8Me`K
zY{&c^42cjwmYKvpd;2%MypNIT#|xf;YB^Aw2AyhBXzmYdTiz=SZ_U#8eQBUyoc4VK
zrZt2<5DoOD0glyre-)%T^jGlB+Yai5>d_@kq$VC%ppBnhnw^_BAptx6;FCVGS2Pn6
z(^v=QFy^G9P1qB`q8*fOD^?<tfHcYii5Ig?Ygn9y47{#qx~l9lVrw>aw1Kk;=7JUY
z2-exzSi#PgnP?zQpLNS$6x9u%v}wC@J~BUDDA;!QNBadXe}|?ln}haMB*i4Qs*m8j
ziDT`t!Yw_C*LlNg9K|#BxUw?iVv<?j!rETlx=IZd?}X|zIV75X>W0@KmmRvY)!LkH
zB(Qmhu56k{TemwEa1vIKMwZd@*!@mjBOJN%ggSN_4!n1S$L3(T<$57lR!>f?VJSO~
z`)q|+4;Uzwf5a(IgJQw~y5>4OTwGY^d|~z602Sb3Gnhn7kFEnPF?#jn*`w#LUyTG`
zz`WP2V?HdA*}ib@j;o`HUDmh53*1tre_zXnm@bdlZ(Mlvn{6caI3HTcYE2Tr=#(U$
zQ%aLLK$~FeHf?#J$uPr=tkN;td|Zfl)2ugzo*Nhde=*cL(QtXIP~9ne5711lGqEjc
z3Fc8=OHd&5sAVy8;p(MuQJi^>I~urir6qfDur1=R09i(3>vcX!Iy&^g%^xv|!F+La
zg2Rl--Y>-2QyXzikp<1eVGs^O)|r*L0`b^RGD*|JDP<=NE#X^|xEw)=D`AkQoi;P{
zhInqjfBbsrUWdU`(ov60(bLm}Ptj~v`W}aal#z!HQ-Ze?gg)5%XprkFDqp|!U^)x8
zVc<qyEe!JcQ+C2@sFds!tgqQuc;;X_;RI;OvA{imfvwHU?crpZp03ymE1y-(C^F%;
zXX^cyK3_<8f=<WfLW(bMh~_Om<&a9buoe>jf4`&kdK*(#Wr-0cfN)sx)K1k!S^aJ`
zC?ar6HR9_%0r|9#bHM@i8eoA?;pVwtgUZl0UOmCi=y7<7FB0EM?zGo^LRE7EA2<t0
zbM{GA_Y2i;8leQc=}^FRu#cMfgy>!7i3;~hopDSz33{8nFts#yC{)4uBK)CbXz+Xq
zf44ACMt-99c<n~~^((Kf4rY?3kH0~$eUGWTZ7%ea^HcLLYdyliojrKvuPf6NCQlr>
zaua2$6HY8-UT2tVj``KATQaprwTahd;LPT3Y35edzU;kHd~_i@&TsOHQfDvysp*uw
zA90F2*Y@LN)HSb7$bF^jb3k9Uv+S5Bf6)Uzu)#d)`pNT!S&<@R!qfC5QxZ+&zg@n~
z7mIAt#u8z^@%JD(lBYqW3*RLv(MgonX!VuEFDsne%!P@9X>OwA!&xzB|GEWHTP9qR
zXk>^2QN)WN96mV>jwx#~*K=b=Vg6pi6WFW!xQi#e-^3qWU4^lz46Mh=7x7>ff5w&Z
zA@a-`PlEF*IWMN}E~rxp6-tV*o9-M&n>H|f`RyrAP2q`Y`#Y;*u6lCnV>@u-)x8vi
zLTQFOLseRUHKLgd*)5g^LR9aYk@KpTB&d3z^p7fjWn%1i>zw@+%#+8XN6pf|Muq6^
zk)Dh90Z~l)P@tt=6~*)<UB2nue_F|3-2;um;a?TCm^$rvsy&WCW}+$Xd4x%S{{!jB
zL7CjLPpQo<6?q5KNAq_c7J|w*`jHw}=G{r%TRr=^b5=9oHs1sX3c0#vcTlBBXvl;i
z*mqp$a4e3^^1a0Kqkx#9EtKK}OU3X+z~3yrxXL%%rTb3H2Tr3WJ|@m{f0AYu=1u52
zp__&JBGvTecWrXzt#CAA8S(wu5Y(p@6iwXtZ8D4sY6km_VcSyC-LLl|^<95aEI2^4
zKVGs%XGI<BtAC7mx{1SoA3oyKZlvTN3bLqdQWu`+Hgn@3bW7_XUj2HT{09gA5rx7S
z3`mrsB{*vuG;y?^K~W6Le;lz^%hh<zcQ+O@@OCWaD;y&Et1GbtFZ9aX`;lZA)B!jN
z+gI|*@eAVBKP@<(!)H*d9x`>(aOkKJuaCAy|Mvg>|A__$sS)8Rjc^ACx%NX29~T}g
zpD@1dJS5u<x%6AUWdB@h?k4(2+%@TlfZIfk+cnO>4Mao#%i*)9f9`Xv04*7wp-{Xc
z`a*{NiZ(hxAJqRJUki1X_13p#j{(G2a@m7PCN6=0Xj}+wov3%%OU{KYWV%eB#!}a@
z0^HtI#;LE~;S;-L(2ZlJVqU!|KID7*zaJX@hl)zPi|LfVy~I@s#49%o>0|=w)W1Uw
zckT`4(U2cWXE;8Ze-X5^O0Rz8I)wv6o#&89Fnh49GXhH3c41c4`MXpPfEe20-~Ixa
zs|CX@TWuBwV~&FMt)_iruxmDayIj0be3Tj*reqNYc!A7T>L|t+o-T3J5ZdgcA;dV-
z?W!xGHitUZ7SAM`_ZEl^%AmKv3<;<L2vL(#{jTbfRzqf~f3pZ<q@3oQ!`xMlpsV87
zsQr*Oe#wmEoTag1sZ{Qw)T58xdE<S{Rl;3%O?=%$d{{PEi|`eP6@biR`Yreh)$#t8
zns3~Epxp={v%G#?vZRYZ8=_Z5G=?Qyy?Mmeu6aD&^cw(ouX6dAfTDMxG|z(|vOK2!
z#-5wQVm_pce|b-ua9ZjxI$ug!Tz*LH0uLBGb<Qs6+hsbNn)#uudH?G+XNL@u&}l7z
z3*|U=zVf)GXov%Qs^JR~WE4CxRL06<Xy$bli~=jeyow2O<;K4uZRQ${^tu8@X+pl8
zCSHQ9Byv$ODYO8yoQl;^ZUE~DJ{3?3M2uYv4WnN2f0{@ZVaZ1xTa)n-_I|I#%foeY
za7s{0@X+X<YAMVhZmgy`zsaS>{MF~V)`G;FrGiZGsz8Wx5ckzkFPJu5qV(M0U7X1z
zfHIR{7U~0s6Eo15@^d5+${#^u1+lv`m)A?q*Rxb|Y>8ioeyzQ?aHA()E>H+Zi<MgC
zD+Hm4f0536!;qX?%<|RB6uPgUNCnPi9z5MB$ed{X2A9a0Ea|^Uzh1iCy;C+oH`XAk
zn4qhgr?{9m0&HA|<@8Vc^i^L(xW1;hSHvn-WAO}8V}P_A@b2Sg9qE;9QYnMd_1H;V
zZe?_qf$EaZv4j9L^z>`R01+*Vq;v_xbmU35e>-sSa++KOu1!8hEYrLM>;#m*6EoIw
zJ$7kAq$6}%z|6oPu~uBG$1E*A2{J#>_INv?A$r>XOgHcb0m$x+p`){Gr;Lj3bZfOG
z&$OZIRy%Y(tJm);vwOz$p{`kbunAvAU&r95J5kXcmGA6Zhry~O2<%xb(*;lmoUuaj
ze~Md=ol6zqKAgj!gTiMlLUvxUSm6qalV2P|R@x+;>g!-Q_6Wn_G*sFziv(@Pc>CH_
zRn4yy2A~Kfbi5?ZmrDg=^w;u@RNWecY`CH$rSBRF$;1VWBWMyki%Nj=JUIqG7Jvi3
zZVEyDYKX6f?yKQCuLgBSos4~KJ)^>!f8>?pW&;;u*3%QY3qy8MKvuBxzH1Z(a6URt
zspCCV^M@;zvKk_)nLk#$3iN68s}J|jzD4WaGNoP^CvC_L;WOr5|3}6{d#zMeW5#R$
z+fkB_S<4&hFZ@=o1%g{s65i-FFw#bV)oOv~5~`$^nUl1F*p3*uA6#uI7h$9rf42CI
z7-HE^Crgdo)EIhS_TnrJwckdd0Ah@kEYK+!g=uRzP?7G(J{;#TA#gmCVIaPY537y}
z>qaaD!z%=-TEdySIX+Dgq>gpbv&emefWbYJD~7ofi)0nygCnk0Dz+e1F5&i8S?R0`
zj`@^`YzMTFvI3pqs5b8Znwo5}e}rGs>QeB#mLUd~I*2p_?3jZlj>SpN!9V4Oy^1<2
z%|zSR-VNoQZe%;xvg_3OJa@?7LMjvjAYHnvJ)Kl|$5^=>f(WxaA-m>kx!_CPh%T)G
ztzX4JGT?lg5`Q6CyNNWh<el+$e)0V16(=@gHD=+X<h+xH>u*r6Y?}wgf8tV3Kmfnz
zVF(6xhsylxai4@5lFxKAgqB4E{fJUMoQ7-ks_>V1gMQZt2wxI>53pfi<QZ_*jijpH
zsBm_hDjfLhX)<B(j}y-FG&QU(M`L`uzvG-y47D*5=;{!!WJ8M)a?|eak5nzzTim$?
z@V(kI*8b3eweJ`$q4wQDfARz=B)~xb$Uc2NrE$IFJGuq3ly>_eFb#W&WJ_R1`*40~
z$`;2JTRRi~Xj8Y;lkF7*92BbyKuRHAKdE|&32=%?1gsuMmZS5+RGJ%W3II+5vkU(O
z+S6>Yk|0Yl*Q&RGf$B&gM8`1(kq5LUOM|MS8#%a%3TWXwh?ZPte|rg43=l@7Ggzgb
zq6CwSx*E$cAM?vHh`0+_VRe43)flZfDxg!uX*?}DA7}~7v$cSQD&<wUh+6I5f+bE#
zfw6Vx^PG21TEW-Y(fB-@rA^}HT~2g3EcpWwGSg)lJ3i4UzsoGl(f~}=4Zz<)^$|J;
zRGSlH3w};;jyP@ef6q=Nap^dO1^JJEczS5A`ub1e|NM`C>i_UuDec9+dX`I=(zEpa
zfbKbQGxmQW&tp2x2LJ2sE4iMM|Cp<5%$15MHdhc~h*3+EB}Xqk)O-<69#ZBvc~T}X
z(y}DsV3Ksi_0}1^-u)8HO}TQx7-f?#F+I_3c0l6EW5m*Rf8Y@G)xB==Pq+5(-1{bZ
zG+)o`@5g*29wh8K&`aP14kn<Nte1I@-FJIQzIb=9$My>n6#qv5LZBQwQ(G-BQXt~Y
zlg>*zcGNA*m9jaQs~-!0EyNP0@S?a-=q4EaFT1ZC7U$0%!Ih`v6NJaX|KxL}$;Gg*
z^iLHwa~PLde_M?tE>ngs=ltU=sU4334ri2nI$qi>)YF%G`tHka*D3Z_4Af{jE%-aH
z4)lE;{6Av0Sw;~KtxqCdHWQtLz)qER{_8K)YmDS#Piy>Fs!vHen4@m}z2^F?zc{&s
ztHQt6xtd?<kN==}+vkdv4zC>^Gb>cY>7A#>;SiWRf2P^syyvDt_~U>d0ONzT$S?}+
z%_IVF6ezhj=x^dGoeD>RMi=QNC-7>}=!isaA4DNri)E%E0E~<_UezRZaqhPvidOQ$
z>z7Z1l;Y#{a+>u2vvk<p1=GbMb{9++`QF8zLyjZ)3kVMjc5GhnHB3qJUxB68|A9m9
zfP>YCe*kt6<~rO1b=%PoC&|tS;HtF`l6!YP?g+Blt7teL-H`KLI6CL2)l<BRl7%Xc
zlqt%ztNtU<5a8v#I|fh7TC`>z8f&Y@^hNXQKug71;K$VuyjIw$D%Byd)jD*RkJ2HE
zv)kpR1K9F#Y|eywtR|+7xl-o1u%Ot}1QQ$6e^|6ihoi|U`Ba0&9?SqRwrCHDoQ$=i
z7lqS_dR<~Pngbsdk*}HojLbuYt^ol6%mZc359^Z+Z+sds%`d>=|54+C*Nn`Y<BpNC
zr84W{3iFwB{~UP45tn_E$OV^3?hf|%L&RkEB>r`B8wLGfux^HaR<Cv6qBjZjKUdBo
zf3E6gS&QxsL8`V?_v8BWRfen8AUQeAV{UjUlB>x0E_F%RmdnT`lD4Vd;Y_3F<}VN(
z9feF|!1*!=4wuACEG*M)vb?P1Qu?LIns|@DAX)58GU`6Nq}K4?qeTArE<gJ-+J(#1
zytp`>rf;*B=6|@sj{FL&?urv){Ox>Ge`k1?(HA#KM0M?oUjV<RJkQwY>N9K>UOc6b
z4sV7iS#Ww*CLM5I_7a&M1-Be4nQJy9hhS%Ja^9n$N;@Me=xLct91>)U+EVt)jBXtJ
z#nyTbDPjhM!;2ZuUcB>`Z$W!Id<Et!m-;6_T<Hc*iG`$py=04u<%7P-c!T_#f1fz&
zAW7trPt6ynI0=n|V#3i2-frC@7^MUq$P31xun`8inZ_>La^1UxZk(aUeFV6jaK8yd
zN01gLzAu0+ot>CFql3Z^kr*wjZOvXAJAl6OBh%X8i$M&UCfR_66CR?P^8SY`Wk;-A
z=ln-EaJR2`#u*A|h*{Pwq)7Ntf7l0vPY8&zi<NQBh%+fl)Ue$4UP-`5UYfH9{?m`X
zskna#Ykg9zV9CNbIY$~Iv^c2kG@bzj97wy&!C3?RqZ>tExZFe*$tlqa$F&~T`(r^X
z5{o<M<HGJ_T!DAPx@EK3J=i$0lFEyh3L7%oRmr)oWwSpQe`<*W<kN7Ee`4Rr)5?t1
z!)3Pb5cU1nkead@U$bdsNwPn{{R6a9anrpw6zo&>(X9qo1xP3Ik;lr)kZ;=@UD<Mk
zPcG5K9crQm7lOvVs-xj3M+Ku|13cBI!AhYIchLu+jiKFpLk1qxwl?AKdVEF?t1BE_
zk|48UHME(7J%&DbT_!N!e-Ntf_w=t4rT)ueauH!GVYSJ>uc+E2K@v#KA-GZOy8f(3
zaHN`T5LtmNw;<iR8OK!z__?f!DAi5cG7mD~;~b!R6Q4DKQy~QYU+gCjX@qZR?XmiO
zovc@pzmH~G64+nKZLB%IIfcww=7Gy+RAdRCehy%FXzMTe)oXf#e}q7^T%Mg`m8<`9
zD76gN{#y~FFyTm4c{I&3iSHr)7k}SuZwEjFD6FTd22pL`4Vp>RW5B&%0Y)w9<eUZu
zY1M!!2rY76!AZ3!F@y=w89-}_y2!~6-f5C!<Svt3+H;;h$Rt79q9j40%x5HoG($`(
zn#ex@N|Igd!#f?<e*)`)*bi@cpjxi6e<W5cWyt*H@E7;7Ww+b>tywdycAsRV;md4w
z;Dbp5_73zqpXZuGlIDU%!V(_z>72`mqK*nZJ$iwt1bKtc%)sRmM7uUEi@I{D95K%k
zQk@5{UOxTZ5euF&V;WjWTsZ^PI48frN5y9NDjrA~yxM15f7zVYCv!QiU&P|HZphzQ
zB!}xN<JbfpZ}yAFnGoe@z|TC<oIf7Gz6!y$1w#0h<se|plQ87Oy9g>@q{bqNB~d5U
z1Ng4io@*4!N)eL1gRx1Js{gE>AjkO!&{`KH8M|vqtK`C?-+s^>Y#+^y%~ZwoN~<1F
z)gMRFpN4)$e^K$vj9sN1pqG%0!lAjuhaH*UM(TqmiJmYUe>$q=VXX5Lfv>6s=~)Sb
zM5)b8;BgwvRy^up%sOPvlf1D{pFCvA@g?hDO1>{C8&$tn59++u)v(OSw#zlDk#ln^
zsqe)->5>NL)t6cV8-pg?rk|Y%BG9%ilr(hsSJ+QJe^3C7IBk}BH9J@^fOrxmfzDsc
z*4CbXV@Y2)qDXc}t98>|YfT;R_mVrk<Zdsy_h!H;F0xK19gllxt()Bc7S8_3@9?Xa
z-0nt=Kbe==a>YT(RTX^hUm5K=T!2gD{l<SaT)(}@@Fe!_Wstg40|86qMk`8&VNrKu
z&UA*le|5#8m_eCqPV0P=7F(?cVKj(2elkC%*S3a<Cv6#Ao9@|4&bPMqt!)91&E@SY
zixjKgqra(LY|ZgPP(<P*zGtcu^D3&MA^vHj^dDsi^LH=j3R}-3<|Y8;!s}^qCSsKL
zrq!95W~ZzEIiKmASqg`n;{!}N_sfkyb9@jgf0wP+mKgqWxM5Ej%3F;_62O{pMG=O$
zlsiEBxea1}FFDS_;Mj6obgaZE9(#DRy^~GS@Sr*^(5GOYqen`DRf+FYDwv@zMvQ?0
zic1$`oTxxF6;Jsp2xl~~?dhN*Fg9+T3uo{LW5_Lp&R}Oroyytl$S*!*J33@lu+SD@
ze_1c;qYrq(H<Jxnd?ZgS2k1bEH>TutDao(d>NieH!K~3K834?t27)8QIm_R%`CNK_
znk=d6!a>>IPi|}ey#8v*rrR&22US=rhsejPSW$><M;}j{RUVRB77)8L&b;eD);H=p
zwjlrx8lY$YeS*a{(2K{Fs74T+_#2=le{igpQXEm0t77411Sis>fZnK*CHbf1&@>f$
z08O7QR@Knas^X+UDIx)*9nHV2Y86$Lv}~W;Ol88xfy3|-(dP7Qna=8$ij^Gd7ZQis
zSQzoB@EeHUF-e+38l9S4;}{`mX-i=VEUT`h1Biqjgcnr3?8Bf^ox}RR(NpVGe^MYi
zCs49V51|uO+i0K<a`3Z>#tpgQFkI+~U|yHS6dDTU329OCMb6<5wq4nGHF^E=X(?$f
z^7(0D8zabg6I?E>)^k3tb_*?1P7v)9Oc?Tqh{yk~Rj4e#|36akB{t<1C&8;+?WVNS
z|F~Tx5V+-<17hj$sWplFBTT4we~PIEq6~e<E78nO3!w0amK}u-n5glEg79ugm00kf
zNJ|bL&CiwF!Nv#7GBx{G&Z@=K;K(YH1MOfR(V}TDC%%}56K~L*cCONuerCTGg@29*
zCCMkJ`CBzwGNke>L*CuIoF#p~-7M*Nl_<***P%B|t3>oi<T-hlr^yeme_p+awB9SW
z)d%rSAP)%#6~~on=HsveOA9V1rR0?<dmdGLt^};~cSn!~*U?3}FA+NEXQ|?q1P<%1
zZ9z#stZ|G;>EUBQ7g@2GW-hPHEb}cVX-jY^UIAn7oD&I)7bp}}7ZRfFptX6*uycuD
z2L4I@cbOZWMBs6^oDE?te;Mq@8n8`kIH%S+yt-LmocfQR9VL=jnWRr-@j1i6meh*r
zM5(WEriIdBP4+OdYi%T~xfr$8FDsrdPR=dfbs7Qha%f-a+2F4(=lLZ&l_xn!F`sL0
z0@F#hX}7lZ5@|C-FSn)K=Q^}-^KZV+`z9UIUEWX-SNZGhHj!V+e<v*Y2h)teB}Ebx
zOGe_@uj<ZFo|b!5wfyPO=<GOG?)+QIR4P=1o)ElDIv~+D-DNjU)Ej=ts+8Q|tKGrl
zr6axp>Qk)hQ?zhE*9??e9ltDH59h$0xc^GNkO}O17ZW#xuyKo<27vZ_W$X$Y8kx+}
z?r28?X$Kl;;bNItf4XF#rln)k)B!clRXOlrIO_n6KLn{ZI_N2-*i{3k62W`6C(hlq
z8`)5+=x?jMJY}cWuzwod0CLK`7iVQ+-}m+cV_=IBBiMvUf?p-QbZ}tW%5X0C+dW>U
zZbJ3ArK7TVSWP^AOHGL_t-twDSk?EVMk<T0S)w(K+i7iEe{$kFxw(2V)61G7mfX|8
zwOa~H(wh~hrE|g1npBD&0?=0S<I24R@f%<y>ywg2?^QJADsNI#a&~^K-LvJMUbOBm
zcD0*}yf8JPuSJDnae~*_AOI!<*?E@xj*Z9SV<y=Q$7^;tmc)db%1mSW)qhu82^x`b
z5CjUZX$6;jf1&Ah34IH$QT~K3j{&f>#F3abI_F)iq{!e{YtNJL#bj{PoM6pog>b2*
z1I{IT53l?!b7K5UunAahKg}+(WiTif)_v)K+X+~9BCnSr2L(cV3S%b3rOtXj1;)D5
z4~P}e>{XIY;bm>jnl+t4IxF|3Txj(gaGe1jRP+DFfBplyBRDD`n|Qhu+1N^`xt7@(
zU<$QdXS4TD?|K3nHbdl+5r|4%^GtMEe*j`$&4eSF2bxl=oK$fxojxH4JVA8A-Lgk|
zfmdPbnI;~hv<x#9oq!fJB(DdSccqv!Zh?Nb=W-IkQ3hBEfg8&yadIy1VX6tXPSz&^
zwYOe)e}!bv=XI$a0+|<KH&cOfB)J;XmK+PV;bz#xZnBgF^^)7cX@yS;m^_&flo^s*
zVQ2GsVfXC%_&i4+9~ULP)u@`%`-LKx<fSSaedb1EGdVSeM3$L5xVo>7xX8%CR9FsJ
zGfP5@&r2{)>%8=kw*I8Er$>DxrRBxiww#T*f6BN3phklNE*aLg+B9()yc${&NDBV5
zJjqu}`15JhA$%Uxxk%kqCpMJW?hvVT2FYu|)}vEsTQ1i5$Od8=>jVPWX{ISfP8r9-
zL0^P(9Izz-2Q#t5x|lYq$u!gAKV37sqG^c-F0XAhAFp%Ai<4*z#o4n1+h!>PGo{Hm
zf3>Pf(Bayw1i?f2(uX~TN%E*vzD$1P2<rgjrN=xJ9!c2KU)VZ_a)&iVpNckanj6T`
zWHPk30d{RzNPz#$Aj%%M*;U(u9jL<vuD6WuT+?A@pQxPC!Po4kuOC;`FFef-FeJbQ
zJ29xWKqne7P>NZ1JQm}jWOf34X1XM?e|wcNx)+D>vWcco=Ve}^v2F-u!^#O|W=2An
zj@#CoAp+#vZ$`04=h*d@J>oPpObc@knBs(C^~6jrSyPPI@!W>fu|@6Nu(DxESy_=B
zQs_?EfeIL)uwyHDs^+(3cS@feSTVLVAC8fJHuS~}f<vrg_*2v4A7anX;>ft_f2j_=
zW;pAdX`Wd#GAURo(u**iy<4JlDP=b}aFBXcgkIguEx!KG3aJxa_~|6or~pPl*Kq9F
z!o`A0I!8-IW>H3tY$YU3Ik_j7P`6#MK_VwJ1KW1tm?9OoTP+2v<|JzlA}9e9+vz4B
z5NIhtdpgqBHxQm^tx;V40;Mi_e}JzKf*Ox^<nNs~J@=K0*w|6!LGs~a4?>t>?z*oK
z!OgF0Z$Gv^iWv1cXKMr2U3Ecoul-53tAA8K;lfz=e!qX`w%5wY0`=`}cW~AG&lj_U
z${PHq|F%Ea|MKg>o&O~k!^_J$MHgaBp$2rE2V7vQ5Z!GaN?X2ZA8_eofBP8>qaBW;
zEd#k#A4i)9!tblE{V>jo)*>Ch1;>#SHD9)DM4i?bvgGYEqS3UYh@MvBpxv*t!kt7~
zAgs8pc4w9@j>W_24I5BT({YCWGPj7`@P+t7)9>WKX6pOR%l`!l68QEv_mervnpFM^
zoxwTOu=J|+#mAOCYi=EdfBY;bwon6Uvxm2p8J?wYvkgP(#+!)B+O*3*Hz-QeLW8h9
zrrZ@c%0iMPg}J3N#f}zju7!}rHi*b=LCAfWhyDfxAAAFRH^i}>+wB}1CI2)iZ7WTa
zQ0B<5mY2d`w*Qht2hes2$377TJHlG0Ryar^676Uf%kYM(DCy|_f0}Q&r4(6SIZ131
zx|++tRAR>(Nr?H0IzRPXicBX)jl#V)svw+%NPeE@w}FNHTYPiw?QxUD-LMvn!P1$j
zCZ1amWYz7^V-ijhh9OW?SyrW;6z}cTNxCG;{sryV(#+lg_13%HnWULJqdh8oi}(0C
zp<~=~rxWL}LXzppe;3q?gJg&Py@R9p1(Feos`3k*?2q64S~ueUp5?H0GYuv#GG3I?
zEg5)1mU3<Uf^ER%x2?aWZ2C1<|JPVzyHDNP9`B6Li+r5z@AMM=^UltjUwe7)?5Rt0
z+2<bB);3yN2yXBJNfrp6X4^o@YlsM5nmOkljjAe8&x7Q!e^m03Zz1Ar8}N?S2K6Wt
zQc50$0AC|W)AlDsZJ7gPNX{b6NUaF6GW1v>tR$B~G8GM8s(`}CMgkaFOQRPLl6Jer
z5+WFzSpheLQh1zxl1~njRM`&qjr_wXl*ux^P<yXE9}70hLGo?C)e3QIwljtg#0s{V
zJ^UuFjrQ`(e{4qYlF3@&S5#F{T2eJpZ9)~3G71we%<1AhJ<0eUpk0nA(s~a|&YbhW
zmA)@1P6IH=9hh#9vQ@`b-t7)hpi}K%jrqF?Hyd-StttXg+joxhMBy|6Wv0^eO1Y2K
z`l|%`Gd0uN^vnNka1RH`$$IXd@(~+4l>#&B{$**%e=i5gX*w;lmfvos4P?$Ueyx^+
zgFu`RW&TjC6bH$^-_fEYq(@)hzU`hO?blG0-Eq~nm_u~-AQ-2p4-cYw2w{BU`D&Wv
zgW6i;!0@U+wqqznzt#Mbw}0(j0Eo;aAl{`iNkq`!L@)TvRJ+k{9D`c`r80*#4mP5+
z0l_(`e-?eM_*Ie-Et>>tuTLXQKlg(n+)83eFFGJ1?Y!?E)Xp&<@AnN`TExe@o40jP
z)%&<!>G)sMcWI^POb*^JmPR;^o6qK(t;YpcsG-<X?V;bQztumTi)w(=Hz<~8dz|`c
z@6PQzxBL5d_T)t?+SqbjD|<(VB%F|o^oY~ee?)rt2&fzG5b)(01JJ&b!-lgn2<A)>
zoJ_NP#w^<L5@rh3$x^3Cc33tis^9;^5Z?~<+oAh56gWCw$g-?6S1VIKO_5@E-ap&1
z7R|~veFLmCR1hJ*xAvS~zGRPQwx@bm)0Py-Ppj-9EVGOx;TYd?L4C=3>V0L_L5Iu1
zfA)w=b-yZ&trE4fG-4d*dM*|b7EEAJ6FbOB=3Q#don}exfn>{rIXrTabt%dPYD1oS
z6Rrn04<SR$Q9$|bR>O5Y7z|i_v01}Z*D8e{2gKDXm5nu|fzsJ<pN99YZ7m|mx00VS
z;UfVXyfQ<w_yoOUsX_goi*=bQywVT*f46UYN*?qlZe&4yf*;C3(!YDV2j_XZ^XLyW
zPg6?0`%rmH|K+@2)UhXEp0OV7k8eIUwbf=G_HE8KD(lUgR?Goloh-o==R4;3V)b-r
zKDsW;ilpl`tju0mCt~**<i}>RNAwK9yZH?0QoV!&^GXbL!KwFbMFiA-FbFH#f9|Xw
z6Om>L(h3xdzc~(wUfn<u>=?0R249=S=Lfh-t4E~9eudTr93^)CayjIf^Dh=Yxp-XI
zxqVz|y;6LnaVB99Vt{!M_((WXmg=|5*PCoh5uVtc#B5EpWoc40;zJB^;efn`%O&ov
z&QZXM4P&$K)`}$8SmP%c+x6NRf3gv8b7OeT0Si-hEnU&IHNEVagJ>}KP|UFaSPgAj
zSVRhMVA(^?6<e3Ar<Q1|)0<p0`BmXAPA%sxJHN8|W&Ig-{p$^Kk+I?OUVhnochF!|
z^Loiv%d)dDnr56tx@wsFWk&N`9A6gtZYg_q0wPYl7>>b~1IpD&Vm|jde~LTJ$k-`@
zvp|6x`q(^`a!=-4Jawh+em<|b*|@SsZVZq;x=_W?%z9$txPn}DvAd8`mEcmhj^``&
zSO&x$&7`3>WOF7k6Y+>?Btl>lih1Z@&#G=f4q2E@&tQoh%B`{qyuVK_8GI!4PF8kR
zw6F9Gfk#eL%#+(V4Gjcbe?IF+pD8JCs=;P?(~g;C0^-cdA=ZXpwRQZakxhj40rM8r
z#Jk1?H6B~G=$oqFH*Uo14`#~-)g_T!)sYL{HR{E*M#=e9$P~rD#u`gL&J#|_q<#*X
zZ`BMTNVbiHqU)7_4hLsU3Tw4nhQZ(U^}EVhi|VkQ@V)jfSUn$Df0hLfsp4uea+5LA
z_zux?=`wGrWxz<k23%xHMJ~`2+$e{UC?QJXvsMd*2>^A%&b-YoBisZIYfIm%B}+PQ
z9wymjgM&%egoJ9%5dsVxsZO$hDNIXu$8EW}FyvuzI&@XbRi@*qy|tT#UF4<zwQt-A
z%jWEG;W#us@H8F2e~o8U#^&gK7@E)!JD_0*E`C6B6;<LWt`0iT$3l2jb$y;q>8|wC
z7COw&C14hadhdcQL0|EZ2Fc-uFZh0yVQU~w<k8~xDf=h>Ra89=Z<7hQ6gI#nl`Nqp
zAZma&x@X)BzJ8+n#RF;sg-DGEA<Wl7E9t9){6TW8$?F(Yf7^y3Z6CS|;7Suki2{53
z`}c0&-P6hI2lLYB_uf#^k@f7#^Dg=mz^;DoF5S6Km$WDFsD)|6#fu+<({~vQ?ekmW
z2v)tigCI;;sy60Ai#G<d$g^TXcW6X?xeo4Eo%A9*xM$e;BUa9as1@HacVR(qwh<&>
zpmEin;o_4~e?1Hbp_hnox;mG`U@o<N>rRK6RC#7_AVa|K-*4}&_dt7Ls{_=0{7qZ9
zTMbPc=9ByFlsY#rb*=P;ex|c`zx`sG0fWF_(s^kISU+tD^tf|Z--WskPHlGoLz`&t
zew*Zf*0mxg1W)b=wtcVlh2CXD7W}M?fZrdt)hLKUe`*wLzv+qP8Lx$lImB!E^SkyN
zs<Z1{S)k|*1q&TXa1?m+*e2<)M8Wf80BSEd(ZO}5S|{|$gg)Oq(>l@g&6P84(~J75
zGp!SSNb~%sl66J6<MzX8#w=r!RmGz7j3h*^h?rhC%rYC<o9CFT{AdU~KXDw&akP;2
zGhU?-e;f}L!X>VnS+2mu%}Grn8@E{Qj>BzNZ#gjGm)B}C%9F?~$BhamiOc#M_^U62
z0Nu#b9b$Y$6WsMAX4?5AmMkn%capQ0H^QuC7nKLsb2a;d_=KifS;CJja5p1F_-7|L
z4Dm_W@gnz*YegRt4c*o$IWoU$kE99Loq$Mue@3;&jmgcG^yVsJ<0cw9(~sSMSRWcF
zp7y{iRG#HXkzJgwl2=&@uZV42>nAdxnq9lBUbkh$d`A3crCZ{?yqWcszJDU?DTQys
zdTL~!CZL!X^L}I3oB_pT7|Gr3!V5S9a9tUqTvOOyJ{QFF6C~8jmN#O38~IBa^9}gR
ze-#Ss?ce>w-7oh-zH(*@)#oq#{lP!GQ3t+D%Y6Jxn*M6<s^<PN3~jvKwlcKbud5hZ
z{^(cXWh0C8cB;dJs!*MT`;V|3q9E2_+bFh@7k&Lb$A<g2H(;c$;H5r^o%%I6D$i2M
ztt9&Kak`ugPo@Qtiu<8YI1J?At92sUe}N$_U9HmbIrA#*&}3M(=;`O`-tbB*4AWA*
zn@<MrPz=zO0f%$Yg0_1bYic)n1x1}c)Jh&ujSUs?x9VAd&s{DqEryPigS=38g3`U{
za~B~+Y^oKC6dD<7-5-3l>8q1sa#@?Y@Snk808<~DOYm{yhi~e&SDdN5VKa2*f2V0g
zH+cy#m+gE){}Cuo_ku*akE4%f!>F7;K5a+Y@*VBH0ocoDvP)hS4}vQ680um9j)s9f
zTxq1o`Bt%J9s<fCSjFMsfD@rUs7cQezTePR4|efKVG{mBcKC<O4oQat%9XJYy@}~s
z*-KZ!4qwsrvCPxyfm6H1`db&Rf98xO7PY3~g!A$ub17vaC-t;qcaG-N66Y)=<wZkK
z9NmyxLg}dYKV*VJmm;|oV-?HrETy3U@rmoJfqkGX-DmrQ<fSDGfR&Z5x{2c-WffW1
zJ!sv5JMY`lX)YNcs2*&=G5$^s3c$fZ>#jmW$qaEv{V?gPV;kzmaBybuf2N2}cj@k=
zuRZ;%WFJ-bh{~{CayriC3b|(lcj@5ZfHof#?Qb<*&}CpJI7C)FiF(L<Dj}ts03)||
zeSO#0cU|YseyVQ8-m~Whe%ivo-21~`*O0~@D*#Lhkk7(!9DS<FSvtvrhLsuCY?8;c
zS=N9Y3$V|sXgyz>%Uhh!fA<xG2XnH;Y^fY?(ngTBq-~bCi1u^1HY%<K5js|etBZ+G
zek5MtS21ceFm}Y)@EAFz^`ySXl*Obe<<0XyPS>kAKr&7SgKO7h%C_b2l;prHavV$d
zqP)Op>`dV<q&F@hUE7pt2Rbf;-eN$7lPPcnlp*S|b%z&%OUf-ae|j08>yyi5_}dSB
z%DC^x;R3(;IK&LI^J)@*6|MT4kAsmB6ZOQ<Kv%YR2S#isCaOnV)R)g-viOb8=k@lR
z%xwhzUk%?kUzivf5x09ie18DfGf7CgDHo|v|GJ#X>0q_|M$etNzbG}l9d`H=D%esy
zxpS=^+=-8<EjrWWe_DFmx+en9dLqu>p+MK{Qxvyv&P09ypUuD_=tD8!1cv26xd5h4
zQc#R9ft_%=Uh+l6&M*f)a$mA+A!MHuE7)UYMd|s#2kL7SN(@HAXDUp)T5CQn8!<x#
z@JR^FRTnC6!|#m2Xsqq333b(ZY=G?*!gBwuP)uz)*^B^le@p)E0~oXyK#Iv@SnA6S
z$f-1`BSB;1l~mYmRqv>*#>_F0AGNxikNPxUt>E^mcu?akNT99EA>(ZW=ov(ylsd$%
zOkj$@S!4{%%(h*-#RG;+_-NWyKY0BT$y}@=egp!1jmzo`-|g++`NRHRSML1d@1<z<
zBH=H+wVPXce`YEGU_hV0y&`!a7s>VS$2(u&b4?z(W4H0{BB3V)@^(D2i?-r!bKiu7
z+k{|y%Dd|kbs1+wBW`>r+=;U=-bxNPafIqL!wwZDtsFn29*oav^CZt`JWI}}<maV6
zPc!>|IMeTi({*lQ0edI>oM0XUCY@&nh(-%#Zyif-qQz-}OMey<i%gy3sQO9VXpGTa
zGP38VKy;TwDOs&4{FT6?q-1}14I^ai#ZWefxMzu97*S7AIC~-7s%XYjsnZ3ThY(jC
z0ltUBsR|)oMGH>lNjf!*7ThrZ_TT?iU4&TjRA#FT8s(^Jc!a@glE)z^rUKo&o;&v_
z!J>k@s+0X(4u2`mp5agxkv&MS1A$oavMuvUySvASPh>Xf9CK#E{ofDMd?;cePT=lt
z(qa0;Nx1qYCl7V4u}}r^TCSIqbw1U^d&JpB>%t=2?yk-})vA7+2kZ#OizXy`PQ0jQ
z??Z}#Y<lVzk?J8aK@$?pCw-Yu<FT2hD4x7I?QzqEMSt$MTF*_lZ|L2AXhM05v$H9H
z%^%3R(`*CV+?Sz6;7m^el6l-12t+c%pThDEb$1!QXXsC<(0bTCoiO49z2wP*>!8EF
zwP|$QRc55G`H1r63IZD(>7or1Hi!hrEJFZFfx)ji(1#~97$GATO0|Na=`dC+$AJjZ
zxupRRtbZvH({+_O^&FU2x~oWvSf&A7k?T`2SD-X(0+xWx;dMvAJIhss1)Ox!GVJWw
zt(3bRkgEAG8O^d;vAi7S#E#Rhr5>GLI^S^3D-+TMwce-@eu}(X)K4SMVQuu7aUH_a
z37s(7MVCE}!^t_+m^#nsN|*-qcckM+V^HWPVSl$+snr*d4Q|7rG=1e|tM!QINVk|{
zQ*flhUhM7;;(`)QBt2qSt|h&bQ{0i*3`Lj?Yf;9t_I#*IFapv<q2x^PquFS-NOi4B
zhlA@dkuN!04A9qvs)^0aW-ZuZQSZ^wlN6RUM%k7?|H*{GNMXKM@!m3GYWpgz<G{(2
zJAb7^r_dNJN5^(bp__npDu9ZPea0))6W9t4LGN+eBRVgjxf4g^ed|nZ*&d}GL4P$5
zisgXUAalFB6w;LsvgJ;&Er>bw)-51sWXr$~mX|)c6)vN6eTL1S5eFcNlH#)p>d43I
z(48dqM8(kDu?RObt?+5O<N};<Nzd3S$bWduFLjN$HkMj>7lg~$^C=@zpa0u|XCua&
zm~;*gVyHP9%p?Qg7*I1U--30TwNIrMvy0O=5Saf&EhKuw>Pm;<`|e`xLGO{Jn!sa0
zvZ$s!18G@8!KqOP55gD`EMg8#uxw9UwDbPy6zG#ZOOqivGBgY*TsU4SWO6GO?tg<I
z1r?r0Xz*)L^(oV_zpb-1)xc>IphzA4sW>syg%tTSe?gB&U94uxX<PaR!6H{sk(Kiu
z5{lTwP~8Iq8>xWs(@tbH9cIR7bHj{roF+1b*#reKAkj&a+1Guq7rs-<o!YLo6R^8G
zFK_`9i8(gP+2B6^<vs8${5DiY_J8Ut%=u6qHPnm5cTP9YAPEt@gJ4$$@nq?AwYuyt
zmN;Kr(Vvc<|L70Cu%ZY-*5sW}PQ&y{Ou1<X02r7xZ9R>zb%`4V^CB(#oNn(GEA>~)
zVk&UJw0|$`&Sq5^@OL~CN-{D=nmOj7XwBK3+Y?$p@k|vOiyS2FKT4mzZGVrLg$?pQ
z=B2YfG|u8Tn!J~l4-Ohh(u%>@a5gWNp1k?VVt(_IzafHxob>@~BrF53B`Y>JbbG#@
zPNl<u%B}V+5si%)-~s`ih_%MP=cNNMm-HP1_A&*5zvR3EtIXwA+j{>nHFN0Nygn}B
zN_t7ebDBx!*MGs7PfG9xHh<A(6g$bF#uUro6xzVf=^FDAZ$j+Ao@KqUHBtt;zWX%P
z*~L^>V{)74RsJi+)4e?wvw}rdtm}N<aPT-%beT!gZ3A@SJ5U@6PS$5IqRI{3lbl;C
zlKT&mhsdBiFD^P=F@b*L{iJRsPY`FSZIo;ytT*i-fH){MnWU>U>3{IQB?rezT4rC}
zqw5!maVIWxm1gqju13;x^i(l5U9x<l1cuMLu-m2O5}(4&MdzW3%fJSkLQ-(#uC(d*
z=|$+>608&*i!7Vdq^+b^hfn(cBk79McVk6_)vn~b7cgqi-Kh6W#DQqOC9v$rF{65Y
zqHAtmz-gt{fJeui8-H5P=kJQKOCKEi?}YOeF(Ii~`li!#QRXm-ITFodaVHO3$_WqL
z7+49C73Py5_ZyyxaG?2qfNu`<AI)m#46`g~U1D#b6<8K!*$rw1j!|R>*CW-*-Y@7U
z_%~At&p1&Uu@1zh3jDkmSs6ki^E6y$dXk&8mM{6tPnB0bWq*d~T{eZDP;AsVFDf}m
z$Pm{66+%_v;!Vsq*0}hhx03JN-%dsAAh~HB^Hp=+H?eZ3r3j*d(RNVHH_C}cP|RA@
zq@!NX3vhkrJyn5g`K>G~B2hU|WN#M+Q756hCp79JS5eN9)#iEzVY4(w&Ub3C!#4JM
zAxyaMEAVAc+<&h)u_H#xIj|hWY@8-g>x3;{b<3xbxm$<jn2P8P<BasKHO_>A+uy-G
z%nyv0gD1^v%rSyU6D~QAyyn~GoD6fPqEy(l^Q+W{qIU6#NnIiVe58wiB#<;%f-`k6
z;B&1Pt<=<ua*k9-6f$$RK$<ZZ_ycI=MS~H*Hrv%Hd4KshYSu=(X?2Kt)5nwU5rxI#
zE~bXP5wG0HLn<KXKV9Y}rc%Ss>E<5^#VH44z=%Tco7}&DKiOf0?#`&EV!Oybnl<9v
z`^lXV11@yE(T3M&OCnks!VoDg0;TpaP{zAG0~5N!>#O4ni3x8ydn8nx?P<bM3+j+Q
zm)#-2)PM9;IU`Kz!$=!4q0>~67#-}ZksP6prnosN-fIT2phE0tzgAk0Sf(ADsTu90
ztZaF27ZPow)*vh%tylADB4#r%C{@c`?^K3_Bt>|FBP1X~pGHWk)GLRsh7QRzn_llM
z2Z@A$WXbD*TCK)W;}NHpHXm}Al}^5`A9w+d;eVfYo5-h{{QPac;5-vl89vWX#hI+o
z1J!G~D@rP~u&aVg<GzgImwgYz1gvgA{zyaZ5KiQ;O8x$ElffA2b$Te;(M{%3)ZQG1
z`#%TK4BF3D<|C!rMDhLhma)Sp4czjbJK&a;ZHI@j=a{QmY-MMB0=s4fEA?2%h<6R1
zSAR%FV7am3Ax94+B6-K*4L^DC{beTB1mw|qc=)}y1!i;VCG9L~Mu5!lYwscZ=wy>&
zI=&p!F&T2<u8IpJ7SRfUx<H#{DGEe+IA{e9wAuVDH+Bj+P?q@#vwr0z(ZHD+GMMoW
z60b6h#S*7?CD}1^b(7?*2Dza62u>Ts{(oFFJqyJtNM{93G$=voD5+TQIsG(yn=jK`
z9W|Mx(I^JW-e&LflGT-GP<L|H`fSB#IL>4+<J?-s>FOd?rg&07n(n)V4V6idV(uY6
zD>+{(Ry377&{mz4fc6+KY2TiZq;eVPGmu+JxI7Uf>G@Q&cloNTjt^%A93<Hl)ql?>
z(qS!|)+e}r%>SvBBr#@zv>DeOz!NS%cyG{lb+ep99>;Lmk`m?fWI5gvR|i>#%N;e`
z>xx2kaw+O*q1Q+r$_(RzWITwLl7_{n=ke*WIm^|=`9`vm!^N=C-#!4Vry=dV<okmD
z{^3Or;Wg(hPo@`8*)G+a3;l*%q<=wF9-Jt3+Ru7Ec20E5T{6;0yszZslDze>;C>xu
zs)rXJi{%$->4C{L>n_q)NuDct!}i}lXp$>=B!!`n<eamI3fIAI52-K=G#E>?sdz4y
z%KVhKDLPIEqBOHhzHC@n&d%dEOuDkVR9Qm*|8_1a(eU8N!VEm|6dV=x34f3u$-BH1
z*N5?RU9LFc+mtUMOAitl{`FQqRKyTd>zEpXHI^sBKBh}{kWi5m8YZNdg%aF0$~nwI
zOZMScqZbr;21tx+V+xIaE{WN3GeNJ=BN6AFx*ba~;xzh;KxxA{=N@>p`U&?Nf6Isu
zc6Y%*95H;Scbb>JbtcR7tbY$KPT)P6{w?X&%}-Z|*BrkUz1G|tXk;#&=J*8Trq;L;
zb<{?>BCsONOv?A?;+lY%A>hjChp-f}DT*zZtk=o*M0>Kk+f#$)RI{^YOMBL~Z`ov`
zJal_^S1tB3Pt@A(?t0G6!)h=VMMFP%SgZjR#G?xUX>@%!igv;WTYo_8LO8*1Y!?~!
z<@fpOhxJMSbeg{7-SEr`aW+Fn(ksTSAxiCTQ8co5X(=lgsI#I4d*J#<Y*CKvh5_uH
z?>66EG8?$c)H_1A6WjkgK^8J(#ynx*ezhwl=~*g3S2FDb)o+>6-p#Zw3m+701o$2-
z&a)Yd*PR7qI$`oy6Mz2-3xPdIi}hf`Vu{^D?JslZM3I!~J5RkmqPFS5W!Rcdkzv~W
zZg3gnxbLgLf)5kDXmh@o6~q=H`lUi)geq>i4_9lD3nWeGMYvcIa%Su{0{kl~!4`1=
zC<nEXK4WYW_gLm<d_l44h^_FNb5ly=Lsi}#At41=+2f-Xt$)^~beYo+-W!(uXvmK=
z{Vg0xmsv&|vJiUUcCn1Ly8n=y6MKXhj(oA6s_R3*BnE`gV@8@*#j@KIX;?D$YtQ3>
zE3p!ka3(ef*zONOZ|F^bvMfMRnR-%3WzRFg;3j$J3a0+<F6y8SBg%ts63{GV+q43W
z@r5_i{8GFOqJNxibm*zfnP!WY6OeRhwm9~sr@{s!QMy!uUEUPvz!VVxXXi!f4NtJR
zSUuuLgY8+4)2WCvSVkrge=iDg_bQ7h%SdFoqZd1X3M<~JpZ#Bm;UaDZQ}p*@u6y)6
zKRahbvYZalP^ZGQyDJzb2eq)%llOG;iN72pit23bk$($OGuna9g{tRx>kRq9C#i)P
z@hk(;%!YZ22oZOCR)!;a3GKe4T6x)t9JA1jrd~h>Oh%7rjus@NP1Z|U4PH!-m<S)F
z`BW}7-kI!S`+miD3O310%zzSaaLMB0H0M3aR%cFEworpySX$-iXR?{FCUB4tGfgth
z&QkF2sDHP=D*D|2nUK#Q-0K_{SYPSzOoF{o=|kK0TJv~X7`LO_k}-BMv*?!2`Iwl|
z$r8~ibb?Ay1<c8lhsp-!bD|BaQiIpPkw;l9S#_14!E&peU^fZvft<Xc3mr$}%u|rq
z&N=)-<!aQCAk!Xbg;pa`u$dSM9R+gPIfdV%Nq-gNgYXzqU#UlW&iSGpcfoV&xQA7-
z=*yr&69HW`nX(;@KZ&^#F`6`RG<JV&VoN*`n}uCA8q=e{CVnkt9q5tGY%aPS&rH0a
z?I0_x91U*`Vyv?1G^cBwmQo5M0<>K15nb<@DN>l4p5DCfX4b<#nPB*GOv1jZH;yOc
znt!I3PY${y4k+*@h$g*9o0p{e(Sy};I@%jOn2GNiNy;=IB#6?XrfvlFext$?tF^9O
zhfe6+`F|vj#kW(#8bhtaxjFB-Ko9i;EtQ~H$O26b$NNCNX%aAQU~%jYUBY<-ZBSyX
z*E}@X96B(J3LZ<zE4-NRe!Ul^GwLr2zJE7~pIpxR%=(X4eF=~(``G7wQBw6;z0?hp
zz7B>}We;bERUP@K=zP4Wm$B;SQC#6G%d=~bVhyr4jjqhQ)U0V2lBY^b7vu4ISys}b
zJ~=hXyXO=7x`rfICmc=97pp;{^=)%uxU$JUIA_1BQtQ-qcjOm)k?ue*al{gw#D4%I
zd-KF6&b|~IFZxDBd_L`2N>}817G>1t#LrHPARZxb$DvsgZ!Hi+$Z#v&rHp;rFlJ~9
zpk0^*T4fQA<L?YRA{UR>5O}Z}WqEt39}oYwChEbD_wEc8j4*iSHHxUQ0t$1jTK9)+
zgyk2TYyQ5tevNmBXT^q^TF+e!W`9pTg!yQS7A>4Dbz;?&z%pSPgdKi%{ScHd?|iuj
zFZ@22$K4+xj%jG-0ek9~f$JelQ*r!c(<uQ(28!*N7}XnhaU$i=$-B}?#A~~b>TCP&
zrcPSx+q;Q4;e38tScHwl3?s$?oSC}5vi4UPH>c)<!7onnW;Bt$dhqg@hJTBz<G6*J
z_|ezM8e0lCQ`v40%s*6E6QWxaVYs1*r>Y}@$Isbm3=%z`PY!fZAqZWA+YxY2+%8kG
zkmN-}4G@w}q7WD6K)1LRov-?(6OrTa_A&b@M`lMi0K}0`an8_koLt)~aer>M6P8Ve
z!h9v6iePnF`VqN@li>8&@_#<pxFPwHv1ZN0<J{G~yOB%uP%|Qqtc#;45F7fA{w!U{
zI!E@hY6(@*1>Pg~VqYg~{6Ia#>OGcg@wm}o<u|GGxEaifzf+gQnvu=>ua9Ige#%bv
zd>wn=leCrXJ@V0tjOP5@tWe!8rm!kBFi(7SVZ5zS)B}p>>#b4QyMMe`mwLf&hWQP$
z;yJNiSK1~&-VY+gK+GJ3mN06tj|}P%Eh1Wggw~&I4HJ?facCmR={klcPG&tC44eXM
z!RSktm)^t{_F#vNh?APA#nHk*_yy`#`#byVhsIrMux?UK-Ar+;f~{=bF3fqSz1abo
z4I%ll#<9wbI74%#8h-`$U?1S~^%>jGS(Q;*Jh+U0i$@2QV5$)&IuDB(F80yi)@ga(
zG{;*;tOuDTXR+)IU{0|(35k7INsM-krEh}y@Yi8gBwY3LGFIK5SF}nz2FL1YhAo+l
zAPpc4Z!5s4i^_=>pXi(@>Bfb407EQ2$yOIxHV<ZY(E2HJk$*=#rF1_cXS+lU9Y0hn
z{KSlCO=s-O;lw`EEL5>`{E0H;^3ErXb*0)-oR$w*Vs(-uwx{mofgk6s!viG7Lvj+V
zH6O{in4R$O3k}zBmbkxrAJycQL0;Qrct#pjl7u!0)lK8QI~2}kHB^;sLjv32z-#|c
zR09;=QMEpdEPpbCyZFSY<6I`i#1PFA>}Je@?OBnGr@mG08ShXAJc{Ald2$*q+GKRx
zegWqOK%hNMk%nlV@!z1r?KdMiWYt#M`_cDiS(JuBJ1`#knf#NKsS^-XI^=JLGOM13
z)Qf|Vs9SLid&Pue$!ZaZQ>IR&bz2y=hjES_=VyzQNPlM<Q8rzbU1w$Y1C0?t#AJ{z
z&efr-STc!I2&08XK9w4G=&KO}K+jzf=%3=VTiU0{O76i$I2@3DziCHTJ#aM``xAIP
zSCY<!MszF9A{HioppI;6XJA+tz&61;?wIiRoGNFU2xg3G>m_8w-SHe&CH#jZlXiAz
z)?;}G0e@tr)X}?&X+xYB#apCpbs^{))RC7y37X`Ru;3A3(IE-ygyV`78NePkQMUb|
zzOCepV}j47s-{wR9So~5W_*7HS+u2KH|ekq&)oj$JWE_fV721;WZmp~9^|lKMUUDh
z%n>Q8cttBgb-WsD7U9<*iJN3!+X`@aIYVVKd4J_G$>!L<GxRb5gK?-YuyVxn!Y^a5
zk}1YJehoxmh%!vsxGiV}M_`_@2@t6O*%_0~=MwwK`zr{Fcd5eIb8?w7UG1@tOg`a!
z=j<!>5XB_?v}t|!hkmw)h!3SByN9NRQbs)*L=z)w0hLb6MLN#<B>Tdz?dZ=>otuTQ
zAAdmLP>VTSG1wmjUko_ai;MWuBvPr{!#r^YRcBihi@E<LM3?m{3#4fhdL)Kmy%ddQ
z;%-zHoR8e*z3JZ8BX7Zb<qc4|RPqFO7ah0KaLqVsVgA;Ek>Ow#vy92zc_CpDr7F<!
zDOBu2Jtyg9u=#Qg%xq0FWGV|&7KR+TZGU%?H~J#!2`x$|@`z0#L7nrWh5Z~?S|Dz5
z!nqG|@1Cif5`x?~Vk}otSHozfaOr}OEC5p=KEjdFc;+qd2eiAJI_j(9qG_?=t+oQX
z50seL?d;bj`L2B~HX2P!A96UO188Fr-24jNvaHUR#rjM*2EIRDKhbjo-OBSHLw}CI
zTxVL0F(#~Kv`4Xw%v;I`B?8J&{32y|g<fBzt1&ZjoPn8jUW)>kriz=Q6u5wriOH1w
zHhq&tSPSQ<F}wnGBa$Teu1wKc1Ui6eTwS^EMq>Sv<|CrG<p@~uz6N4)TA-UWAj$0P
z&|JGY){t{!R#dQyHlVD8&??tKR)6_&e~%YP6_>m+eHH3q0!#b69(}A2+um7|NVj~S
zmJ^6bWgq?<VxaIlLEy?NjD=)k6`y1yK?d0XpNrIASZsKuvHXz2%=Ke-fiS2QtU4C1
z4|)QwF4DAYREC~&Jybn_rf=`>8FV7Ij>c)A7!Vroqj4Hq-xun0<Nb8i=YPgA?!Go2
ze8o!b9}B=kVE7n}`1rsrwO}Ewybhug?VI%pUCp<@-kWo6{o<5+CvW<wt<SaT6K+`U
z3N*T2h{sBDnoq@V<NKn3r1=n`=hx}M1Rw70-~00S*rVJw*VUId-6}qLknU!zup!JQ
zy3^r9fFw`7oETwh5xS|j0)Ng5MqrLlr5x&K#r&*z_#Hdzn4{U8!8Xs<a89zr0(#4r
zPKy<@7nxknL3N@z!(|{oX%jVwr`|S*-Ow}A2*H@9xRv@iQjrDRPj+csvBAkf2LQ(g
zBMf|Dp!^2HN=x`kkCFci7)(L@ZLJp*3rR7AA4a=+z%JLBV5@3uE`KX<c{(R2FCm-)
z(fSL^!Do4kziEAuF7hE=fd0wHZ(6M{1Q6R#=Y0jn9T<1iu|K*4zgQjrXZIVc1d@Pk
z+504-F>*3(wId9z)9ofd|D4=LH~2+qFM<f(y=4FP?c2V-d_omHXQuPXWFV{inE2~g
zv``(_7```2g{yXB8GoG81b03pLnJc)ko@+HW`pYd$e7?7Cu|Ik=@C#wm>hP=sb1~{
zt@brxuI%K^WNGN=eRYSA9)PvxB#`#Sp(C60U61?vaktk3^9_d<=D?l#>lj?mmPQ>j
zXF}%F{4~SHzL|hIb)|d_v^?TbqUVc5G@%(Hfj5P|mN9&7q<;!i5BqF-sU8uUUfRuW
zVFIT4>{$sutu!(0Cqgxa?gsC2ah;@t!#N+|un^Xv_!a|2W`wTX;^x^lR<U`5mlM_R
zL1560l4^3Ou)2u9VjYFX4M3<}BLC&mUjOEJ%Uo{I%i2mXztG-NzHPC^>N6qsdU!SG
z?0RLnREf1!B!9smk!p}%HOQ$N=qg?yS#Z9(yxBHdxKh3b6}DJ4rqAHZ8cx0WP&&z&
z(M$x1HPb+Jt9rw<*=w1$S}9Ccn7^}ay=(Wx9o=)>sx{&(fdQx^kg&if0<yz2CE_fa
z3%KXG_Jrq!yTbyfAKvY1Kw-BncAMvRb?E%JjoQte<$p&hRguG8+h<Yp_HFg@qrd1I
zWA)LAj3X9xI@raJYd>WvK4%|6m%LQusg=QqNvMc5=LU0oaMf13$<}%)9u_y-SxYMv
zmJb!JX~ak`v%YwMR1LfuK@bc?!-Y+9(|T5-4+sKROb?jKzL*v4)y+i68H++6nDwGC
z6ML|m%zsFt4k{{N5DiIX&oo(qkmq~GT0QTUB2pV<ZN<ul!A-pX-&4cjYoU?hdh;^&
z%+ZgvQCB&~dgneML<62(We^l-j6W7G4i<weO(}ZpxUcd&U1Uw_j6V#UGqneN5!Z>`
z@|g9MW?#XY^z>%YrQ^#xP?R&n1`U<Nw%XlAa(`k&^G75kwvH_qXD)_~l4eIugL<!A
zDl!^PT*>(dz|gLsQDT;{SUYX8Q}~Fo-7g-k+Lvx>i4&cd;>gF@k=LdxlU?vmpyrVb
zi-i5T8bFK_%}Hj1217cPkHy7tclSkli4AC)1$Lo6AnxT-J^FQ!jHIIunKat9y5akw
z>VFs=-@DLy&xrTBKtkK4+Darp7TDl)&dAG&L?7G@wvYi-O6UMkq@+1OO=U~naUCE8
zzSW>GzrCP)DNawj(CtswW20!({B1VP&x?Xpic>gYm+91I;rKh2DE%Z@pgG%qR(+g(
z60_Em%dV`y_SL56q*7c+Wz#$vJ0FMmEq^OpMYhG=+gtX<S55oE+%V|QKu!dSQ<trR
zP$gxAKw=JQt+FWt2hTj>j^h_QNK`Oq6uruZ>dBtNG_L_=2VqdfOo5e2IYL2WT*ZmQ
zP`Z@hJ~o3&fNc(^+8(>I0v4V>9EIqaqo|royJ<!PU)>UM1C|VG8~J1UD7q!yN`H(R
z0272N$Q-$Yc9tC)fQA8A1_}Pt%Ry?O_imA>iY2e+B)t?9dUf!1wqvYc4E2i`?KgQ;
z-`Y0zPn^gtHU84stlt^#p1G7PAQ^U+O(<Kw)$cmbmQKOvTVWg<X~`u*TT+Qsc@^hH
zG?M1-ht=&$ga0k*)Vkdrshz^*u799<nb>oY`^jDUGpOo*a)%zcG2c(V)a)i^jp63K
z)t#xAeXjaPKQ#~e;|51B|IJV~X0R82PLkwS^0O4)lnLo)*nD|@lAozWzkfiF4*Hw_
z30`xFg!sarlS38`zOr?yw$XQga)~?iX#Z>Xv1(D2K;GI%i95-E-A(TPw|_fY;x0Y<
z^4_KrcY+dkwZuKN@ztG8Meh0%_q4>9^yuE#Uu`OJ&zGPtjZld(!7*HXo2f&ea9%qW
z@T$h>I?VHCPoW?U`&l8>T9on@0B%0R2)HJi+zs4{jPVmd1z|p=?J~4|cv(}-d?#1o
z*-NaKd1qEkR#C9BdhN6sJ%7^8klGm+=~?Rhk=Kj1(Z0%jHv19TWDSeCxSsEe^wnIx
z-EFSB*<rs{_nl33<9pO?;>FQ4Lsrb22p6Rk(Xyoo+o=E*@)yvFt8BVK;P5%T<iZyM
z$AWxhREtCpNxD-=P=(gFyPLClR6PFx;rpEdW-<Pt<Fa9hEyZnOMt_9mf)TijggQBe
zd@X!|#Z#!Cv@=#R#-dN=b3L=8T1Z4MwsfI&$C|^$Mj+nxsoQ{--jjFo{xHf7=5o>;
zGi%PD+;cZ7=NV9O%c6W(X{&AIY}ZrtHWK2vB8g!qZgsKu-7-txa<HU^vE!-ce=>pI
z3v}#I)P!kbDz-=NSbzD*d~<&kj!}q2gnMRNA)OU#Nfe=k4Wha7E+MPJBtzl0*&BvP
z$9SdA#?D2P8I~TiD?JiL=PN*OT+$!`wa&X(K{<huzzI)jeE{#u(mq%h;4y=LbZY9)
zC38JcNx^vru;isPgBcWz()^5$(t4p0Mc`#nF)TtfC=)>;DSw*jF$LcX1adVMGWBF8
zIf0>lIa3!jM3{5h69LVUIBkTkWh)hu#Q$CUu|ApQ49Ov%fLB~C3lc!UKHa_D7aoyQ
z^09NSOlDGWy$IJA1=pfjDU$$<%{~J}${t`X3JW_34^7QYM#7r3cUd}<{yw-QeuwtL
z8hRH$Z*cQ<$$ujh-b7K%bB@h3*b0H2#wcbB&iRsjX(JFuODC2jsHL|LYkS;}o;p$J
zl+*DS7k?5L&=a`(Fw72`%vS<~%stmkC<qf<D*X6?oD01pCBrBk08D&eCZ3}pwIu5a
z<NaL#9z=QqW3pyY5r;l;)z5JBA)lp_ztYCD^niy3qJP5Lbo61&@EUwW{2(Kmz@r+$
z&PvXY-Az=r>3$_C5SraUm1lSHOS`+WW~^)5-Ie2^#940%J}GAfJJUJ=fF4O`BYgY#
z2;-4UiCA&5<cX#CDjb*_`w3KDW7ZzPN#$HKXz>N-39`5cusDglCam^SmjQK;jqYMD
zJ(QLzQh(0BWRl5{J&{4%rgVdtwwL|tUm}qOWSb_`&>@j7IPebv6V7(B(=`aq5aI9P
z)uWC*60};LpA<+Liqr*Co;fkp(Q{6n43){1Ni2P0xZHI;E<?$He)po7X5JJ^3$fvN
z)k42fu>uBxtNK2OtY9;xA?sL+`dL0FY9^kh5Pz<1C4^lBC0<5T*RUk?!H}^wf<<v`
zkSHnH=jw*s5S1Ldl5tJM8ol5MVpw}b1M6P#Jmvx?Zss73EICaXYQ;NOilN3u6G?`V
zMBPMfpUy;o#PA<;)?T`hgxL&;Qfy38Qy@>g@J5+B(mMadMYhBRA)OR;%6b*J89&nz
zynib(x;c+K#v?VP1Ka8W?2hDd-XCyiIoAWicf{O;Xw9sP(y1u$L*1dB%bdZn+cx4f
znY+8%D^&ct%)<B%&-}0hqCsjKUXX8BMtV3lMHi1imni_f6Chm0pt8gVZaHDC(AhY^
zkRO_>ZG+=97nIBZ0L=FpR`>ui1qU%_nt!V8N*1x8NPXi=g+qQT5<&Pq<N%s5r(RLX
zPkgwYFg8+v8fq+l(U8`O-VgD9$g9B(#%0>wN{};xCVtRF7Q{nN3-w&@E1I}ZbD=N-
zq6Y<<P_V4QtTP~lU3eN^&GdnDE5sXsKYlXPxC##_X6`%7j3a#ncnKRu`(kk^@qh7c
zwQ$%Oi>z^*F#yM!foFI&J!z=VBpu<Qypvh<-(m)B|1pY#oOV@LUNT3w6ozCGU~Q$G
zI-=t!HV68xWNl>SC1Kcaj-N{fNC4V!yJ_{=klsqy!tdJ}2J_75VH9@7-DPJ%Aysn1
z%>iATmqTKxO!W@P=R<ujU5Lw|6MwQ*b(ik#e?8=_=~FXR=0(ug!}PJNlaNpgnP0cP
zESc>C1U84}TE4)?@l%rp(2ILReyL8WQ4pb&@*&;|Dk7I#5jg7rCd+C00x5{7@5yCs
z3Sie`VE`v<hAIh3d1(+j{fLMnUPeuC2&7=9d2HFZs?HN3$j(hKO^?MRmw#qdQ}9cX
zvUQ#~FovCpJlbLe8PyA*zy!PSEH#xr55tQ-F7Tm<<4yqell;hSv%qHc`w(6ZC}LOV
z<kj<s&jnc?L@AX}9rgw<Gc_ZzsVto#K@p@CNlD=<<v5lq$Xd#bEF9{93&9x8!fz|)
z74PX`09?t&K>Y5@2VJ`*HGja=@XpF;o@J0GlZ#KULj;Pjk9Z$R%;D6{Fk1k^$ro&s
zjJSwNvVXuR^MEW9!VP?r{Xu}!6#}GKc9*%qoG@ZM6~_GpFd~u2m&KyeFNn1)S?Occ
z7WCrI0joPhL>#2tjzMu6#*1bZ0<H~+m!PlhDBqH+nmN*N-@5EU4S(!tu=|JZJ9T+&
ztRv~$gvg$6m^*L#kXS_IK}^r;iw^SqNFnc3mTa{mkT<~z64)9h*$x_LzOs{XC8AsB
z`yZaE+EtF+O5Dt=8Ezyk6l6Np7;(#re;451`K_S{I3yd*v!%Dhde=-J!z_|^h=_N<
zNjJ}AqX;Tt(s3X+?0+0E71SW?w{*!{b(XQC>+bGTB>I8Ch>D(C)*qWI)2|SB#)OlO
zieU?KsK~nvCndlhawh|(R)K)B>U^ph&b=4ytzcTV?yaGGH$)OJ-dl$;j9?Oi1tL;x
z{8otOB<x*jp{+0UoUvoO>?J;#vQ>ej23S-9cHDeIXPVY*27l8uv>YVQ)2@0d9KqZu
zlDdy!QVf@5Jr@hPY9&<X0&Y#SaA~KEZ&X>oMq2usOf3dbV#P8ml9!?gfQ%fT91o@$
zBIdgopHvWqgi{YIm*`WA2~w<H)oPXSd4fhy?ghJ7nRii5`b}<C&*N~^TP8Wh^Z_74
ziiJUHSuWIUqJN+O2qspxmp7G$2g}Pye{*c{GxaM7Zyoe8ooqG!(I0!ap~P;kZatk=
zO5o8DkA_?}3L<t6kjg<tSwSQNaJh2nK?J1UNzV0PN9mEqEt(!RBl&{;Iy7iijoTU<
zi@g+~M8Aq5P?>s}YHr3C5%Y740I$$Vh+H!>zqVdJRe#em8D~qu8W6NqRI_5PO%Z&t
zX;Y;en#jksWP%Zh_1RfwS-V_bRg1l|JXW{Doo9*JjDT6Eyv~OM_*{A~%gmSZ^c$W#
zE9YFDBRxVMqk{45E<!4Ptm%hb;^4izx@m@Btk`Z`dTvKPQ@`+4sZprZ{A+e6GmV4q
zHOICZ?th9dXGhT86lFV6lx_L6yCpTtKSd1tKe3~)3$PV+1keRMJm&QxulY>rK$vU?
zHGmd7aa~*>E<*`R6%xk_4LU7<ks9%zl4C;`b!nXAy1p7h(LQu3m4@p)a@$8~TO^5>
z=G`~VPv9kV-AHt#g4H52BT+4wlSA>Y_p@=z6o10`TuT_QIk(BW;0sY4%F}DE4)S`T
z*w8AIHLBKTw<hm?as9%UV2>mmzTjB&)F#A<?^j+9^BX?tJeHihn8==swa&w75Lcw0
z01?Dydh^LNQ=^#J(4C$|C>eG~1B8IX$0)Z&(Mpu15RK}`ckT>XgXzAey`@rzgtNyo
z?tj>~Zipfon-OG!wck!TN=3!e-)h-+mMK(ndZ}@lF25;YY2;|agM=|aG@~k~yT_gH
zTw>Ln!L>AWZO?K@JPE`{BPobo?Ikd=m<lQlI^Z!bllIH3AB^okw~b%ng|nQgE8|^y
ziq~7HUX88!B2nV{JLkO563yG=C$NDZ`+pc(IQwxdqB;Ie(=`Tuk!5fD`+GWQC_ws}
ziJC|$qXtLr@&B~JIbH+{7)6{XbHya;q6(a%g+V#w#$}^-^$gw~(j9RsbV@#p5N}wc
zgY#@_Z&i6ui7U^v4qJA#cuwpzRu>&=r_*e;Y8q3H<%K^e3;*THn?}qa?w|lUKYs^j
ziuSJ6l1Pmm7??2<i>SNl109ik<18%Ax4lrD)AiC__ocd-1yL!>2$kqG)CpTH9fkh!
zrJ$Iw-iVSl;yl6_W~aVK9R<g#E#3JS#!G=!jE0XzQe&ZEmd;s45^%`@t+^SS9MB^0
z$x%JQk06&=37XC^38xzEH`n~*kbikRJ|f%5E#<6`G)$lR6nR$*{#R^X<;SU7deFWF
z4>h4Of%lSDr7`u)QVYyoXMd?xdH|$!feyAAWgO|)2gC*NM(><bGs@%Zs&T4bg(hZt
zXm4YAR>@=T;IM>kG2qNFd_>)DvWc&XLA$j!v6rH{U&83<EfWlNFX4%hHGim2j}o(3
zhwHpZ8x#F#S_e(rQ$`7rc(8p8O#D%K(fdBvDg9!H9J>fIR%|-w1miU;WAMxM*wRH+
ziBFGXR(%m&jwq*B1LkNLqn4@|;*D%m?+)8E6TJYTAWpwG%T`qfL)pLz;GC}fNdKXb
zX8(ce^&hBS|AFeY1=Y*Ea(^r-MY)-vB1OY-dQu=N{}z*;K0fI8Pw?JIvHD2v9jfEw
z-V4qbR>l2rUZipvf>db&db<}TE~Ha-73g@JkuWf+hqbXfQW-FI6^0RKrkXl)ztj~!
zS-XqNZEew{EY?f-k#Xo5!cJ^7;xPM*oMO$YTJa(Y9ZWul`^c3}BY%<U_L?3eVVL#*
zkcj92RBX++fhrrX%{NB+NCu9Ll$NwFqu&6`VYWb0!>L~j^_Ee*)NV-<OFCZpV09p6
zuOv#Hvr8S3sJIG(*-QSd9~crTqnHv=a+7e3SeHx^AI%LViio&A9=gZ1i(&E^fTae>
z>p4QuggFaU!Kxd*hJQksl_8A#&B6_gNr5H=U1dS&bglO~`_fsg@ard{+^Or7tC!s$
zhViO~_gnOaE{$2CTArv{wX^*Y2;Imy8tJnw-5zv{aAI+a&e33*vSas%&i(0W{yyns
zgR?<0nqA_lz1<siEv9fZ9BwV*UZad;2~!fz^LUH^H%Fj}_<x?V-Jvg4byW_PZ0~A1
zd#oFl4~zx`j@g-A_GY*)Cu?|IPt@y%bM(+fV%t*ELRWVts`N-XOgfJ13=wtJJ?uL!
z$+8~`qvf{0UhC##>yeGwJ2)BX6b&xZ*>og9eIm&rZA7+8v7viF_sYkYY6GNGA@YgF
z!k9)NFh$7VOMjW@({R@Od@y2Hki1N?k}<l1WNT!M;;=Xe+t!Y=52q0?=OCZ`=z_`C
zsvIfiOix4DVX<G&HLEXg!2qYlE4MWR;k!Ide#%acK<U*2;y3=gGKnlat=3b98#c;k
z=9X2U)BhAYkaQ%+Ot+`kS8OJ#wo}=eBDyrR+u-RV$$vz2g9#JJfII?W%}yG)kBaeH
z154tb*c@Lld%>;|6Nl=94+aQo`?+#s(1WMpG$NXd?kM*^Dzdx#`pNDteJJK~8RB03
z<o%q)S)$x4rx}*o+-YXcnQP|T@N`M+G>2=ubRr!_qU;IE58y-Tl7})6osm07ICj^E
z-_iM<Vt?=0ah4|a#B*Cm{-BR^Q}2xuAwoSq`*ybJ<Cku?!!|qZS@oJPlc5SLZ5^#H
zr|k4e#s7<491o6;ddVwVY24{OR*~}<wBvoz$Nnxkn-(X;-_hr`Po&bP#h7C}-*L5a
zzIZp$qmk^q^MdWz05Sa;$EJV60Z3X63lKUPtbedAmf@Pdep2?F#}IpaXz+PYlAp>n
zPcqJSNyYxm?w`)5TLPwmQ~BWK>xbT5q|{Kq?=451+<Br25SFih0>&FaE^8n=B1qOJ
zD=@|hLlr%;*yiFb>@Un4U$8aZ%Zq8c!cf$hy6LQ|JmLuNLW}icM9VTs9pPjTICXLJ
z8h=&MzB^irkKFkAD`q7A1O@&%(e0hzB_xXMgg&JKGk{kT3P|Us6mp}9f5Ci>`6-h*
zO9#x{ME&a>ff<`ij6@n7%}#~DvE0p2pfP@bN1R{MX;+6hhpdd@@u+b1CC~Mf>1E)-
z&&uvxsp;`ek>`2zKMKJEkFjRAOQL{0YJYwpV~)NtbvmCis1SMWA-%wYFWPgLNVCRP
zNl)EYc<@yEoT@CkcXvo)Y@924G$PVdp11rt2HqwEU9mt|j?+_6q*C&+{?(-jkc|Vi
z_57+uDJ9mcdT;l9*tZM9iI$G9EL#YPwe}Z~z$OGE7}K8J6XLlSbBr864S%DUDSvE5
zv@03NsE_Pu)9g9_Ml9Wzn7pAqiDFAq0niUJ`(Z6PVV(-A$g6>#DVrKb+e#{tr$FTd
zxNE^7P4XG;9nTdDEUz$Bz~Pf9E;fV|j7fCP=bUQb*F9FujpoJtA=mjLU7eQ)32W(a
z<#0vH9|`Y=;Lj3jo4M~PcfqsS-hYddae*9aL@tnfm1L!+owAYEIeboRxIQ7WzJgsL
zWat$!+kk~=9DSXf1xBK3$hxwy)jIy}69hhU--G(nA0Z7^b(LRVNm!xh$qVV5N!_(B
zewyIDR~r*V@rKH4k0fiU@(bGp2ceoAyXoy<B0oiZJx|Tup*;)d7VI<2YkyU4T!Gm*
zKc>2))i@z%(~HQRGT}Mf4;4#V-6d^^f)ibe21Wc05Zst4B4)ikCzA?QY1y0Bzy0g~
z{cr#J-|7FMUL3M}6%8VUMz|$Fi!42L%onNKSP*9|E(nsRMcrN1SQOrVVNv$Cl!CF`
z6Bb8|7b9Q}7H5O<Z&P0!h=0~@vO12}<OK!@`<%1!QdR$2s|r1_TO#w7Jb5TsQNRZc
zET-rpZry`q6i(nM`M3Y`|B4Fx*CWdVG|BqRG5U=wV};>pyiyQS0Sfn5q%%CZ$|bWn
zdvr55XNwi_-YO&6MDS2n;sO<o#m|nr!lH%@Rg^t;BQc<|vzoRO=6@uBQtf=Vo_FI)
zdNfrBN!t}}yZTOvoj)Hk2KnMLs81{$jkWk9zM7`(!qpVz>TH=|-!xUl#oDqhek_RE
z2Py@?#ATUja>w;$9T?~h3ID`&amHrh1|nQ}R&Mn?4-_?$0w#*F55$tDi)^WzB6*A#
z0%eI_)|Z1{z<P9`BY$mimca6$m3VOrD4{LPjeIDmX#9Y6!89Ypak#JB{=67Gu96@G
zUb7aOPjY-jdf|~-T#iIyb20+mgeqMHwEkswnl0Hl&-lA4G<hjey;_-IZ}Dqom8)|Z
z@qSJ<7uSQPxl~}1A*V11=Tn+%;SxU}j%~rQ^2|I(MP#<>^?w#~mh<2`A5_W?npUOs
z6H_+yUvH`pP}W1q%ofylPCQB2Pr+iA6nbaNJS-*^1K?RAaJ(h{da$ou@2d!l2a8fd
zJnD+Biq8PMsoO4M@r-RNg3c!!)?3ERl_elm;=`ih6I_TlZfWUZ-Te;W2jJtgUpMGz
zDv&d?gHJz3Fn@Hewx6H<+qc8>cEw@yJ4uh)W3<KJLw)-*Q&q-MlBEUt79EqSnEXFb
zPmH9A5m1p5aKdWh=@~c}W{AlYe?4BkmrunG<W>seg+;}%a=IrzF`CVl%i;kFztE(V
z3>+8EKP(%J6$DtkpEq;9buRA)Z0*fCTb|XYUPtxFU4M&iUaND9@g7&Nw;MHo4XZv)
z>EL8NXBGpFrTj;&<%ik4_*I&oP{qE<z`Nk{I2dpnbQMVT-;wNlqss3MAueyJx;)pa
zH8txm&(6x#o)uc{%ST7AZdCDCi2Gd);eGzM^S@2Ev;oh7cUds^j$ye`gI^BIt<4B$
zq-{LA{D0il&n|=Nzst}548H2Kws7*dpoQnlbd0<J3flfz8!9FzK}$#T;^K6gzWuyy
zl&9fp9I;q)#M+_HyDDYS%=d_dxZ$#2e;c2<c3u=0+4AT-n@&IP8DEt9*1``jZdCQx
z!^QbxTg~SSJLl_ib)%~PFkDiREp;#LTp!LEtbgcc#QXLzm15g^KTR)BisJ3ya%M~L
z;MUEW*&mL}^K`jwj>a~QhcGDKY@7amIN?H@tCvb4OlT`Vu0QYQnXk2Cq^rHz<lG(p
zmC9_X8?SA0*5kJizx%9bnE1oD5k-2rKDilX1-KlQ*|tefP<QJEhrSEzAqpp_?=2Ey
zdVdCt<`FOpkc+{RfO%sNC;cF})9?vyPm^H<?nHUMkePF8LHAH>4YhC8VZ$ks*m!M!
zL-`Cv&#23|8R9@ea^+>hDGK1VC147|c{6+%n{CQL^1Z5}G{9BR-C|>dX{-9?We}Jh
zM7}Rsz~?TAaC~ZRyH192Nf%u27)R6dd4D}se$an^c+oX2gC;0H3^grrols`viWemp
zqb5*s9AIm2FKJTb0JKB$ifCRGbxP`Vzo9phs6^e<?#Cap0;SVFdi3<sgICFJ^7!TR
zXBy4<^vSa)uae&)`Q|Z8PH(ujs5o^*+EC{-MN3(dRO+&qJV@hU1`{!AgKJ4grGItn
zrw(`EhTHj|a$IufHYZ8pMoh{5V46D<$|vf#Lz@d!+o4rPlqufN%j{j-OkUm|3de*L
zu4jk}P%Br@OiUW|4Y!u6=~diy&4Hga)8fLOP6KEOOJoH*({>|U=B?cC;6M0xAd@ZF
zxwBMoV#bC#T2p_QjOkaN7aWJ<<$qX1Os3WZ?<rlKvwsh@1r3IYo}-G1Y}9St9k3^a
zTJXG2)BYcN_Se^egVUF-dniyhw4$V`uldZZyf4X^h(Ib<vDyK@o+lW@xY#(f$+G3Z
zyF=TS>Zn>9EQEU-OoXB8KlGCd9xv!f5G5V_wJherW7%=5@_q2^kV?l-<bSJiS%zPI
z|LDh8N3>akXAhnpzJB;9e)jP275(3LPajpj4XhUb2lTe?MQUA_$N%acugXBjj|+5F
zV5HN_J=U-IcP}3uK77XA;Jqtg(ROw?H79#lBU5ZZjen7icD|TdrP8P<xV%AF4Z#`&
ztkAcnc&S))K8KyydT~pg27gNEK%T2Msadzws9oy!SugWP!7loC#D#4%3BT(o$8eC`
zLzb&V%bmk9`;U^6t6GlV`EpaZ5#X6COw@}`T3GrKKjGA0s)2UJM{XC39>so+Ty^uJ
zkFa&_1!vG?+YCptV+~Gl_hd^^S=|addg|cL;FtJA;c~(eHvuCJjDN_WDBi@#p>L%*
z7CD#zF7JHvZ1<yRU43fdYfV;8CO+nJUBZMj(|n%X0_zUFqX+6&`Z8hG44I-b?{_Fj
zQm$d?ya37yEzIYtqeo4S^FXx2EaTW7+{A2l<u5I>99+w3qViKtF2mYKVcWQB5`1U*
z*)jml#mA{d%?i6_UVpI83Ob68{7BuTlzk)8HebbN{UF|c(;4$8#xZ$ZQ7Na#YUhYR
z$y{d+wj)RWMi>B=dAU~DDD?jD39KjVlf@P4EqG#x4CbTajlx`OL@c>x@7rzHQ)Q6h
zEKCFbxOwnBH`0h>Ej`Ox-Htb9T{UYfTNXweIOx#^{-^dK$A70Q2XtM={1eICWyV&l
zJ`|P`qsDB5VU7u>WAtRQyaf6he~Qp;1}(YZpg+WxXp%$wSm;!rcEKM{*7N`RGh`{H
zh$3pm+`VbfHM4T^l-+4<8YF9$g)^<^0xhR6HD>z)t7SRcL+3{~Wmx*sU_G?3<j8{m
zEOL2C)cJa)fPaH*-59uh$`6I-6r0TDd|Zp8NF5prf_zGk^+^qZb7ZIX+BVqVAD-o_
zA>J`djXxB1K-pk5lD=4%=VA0jb#JiC{DMC6>??j*9s*%jiESjly6Rbun^iZIK)td{
zIr!D5NFlSy+~v*lU{xPT7RfSjR1{H_(}^)*7y(RRD1X-pZ@o!guJB)1ks49K$$qDP
z>amNuq<<(`m~DMYlDK5Kk?cGxK@%@s3KMW6igA&2up5x$J^3B|N8RA*Z}`#555taH
z8$8ApQ*DfoOf@__!>N7@^L<u&f+RuMI9X1{JACm3v;62il1kU7PIr7n&M?(KA>yRA
zj65}tFn`<&s%`MgFGBYk!B3>ihvYA0uu{`~&%2*Slv5)8E*A{8=tVx8qgx4}^Qxj&
zEMd_{cLsu0RN+Z)&IMkFL8bO+-X5w5ITatys!w!<ouo4N22D3j47~&k_9p5~ReU)x
z$`PL3#v^OO`9mMv^og>05bA_JL={%3Rsap`<$v{Rc-1FHSixF)aSq^t+`&c7n6Zg=
zuF_<L5NcRTeZ$KBXA6S%)`0dM*61qmR{1GvRYwkR#FU5*u499|L^a}X8FeYJo|hus
zA0+K(m)@Jb-D;s87`~lE4Y!gspSS6mG%05Be$rNFApON&6#l1L$N7OUJX8_&WWVht
znt#XYGVrtfm25Ye_cxo)nZ<BD#*Hij2Wo`a=ClLii|rICK_r7lWhK5o8LhAE_zglv
z@=_x4U3H!o2Aj^;B4dxbq%1l2MZ-{6Q7=1rSxlK<U1<nL#*X7%wZ(gf8v%A~wftG2
zQ?D;e1!UA{PX3ZD=#Tl&8?jY?be&^<$A5Pq?s&dJGKr*GWbcnnMZ@&hT)JLNChyyW
z4du1bd03S)*FRU#!&ku#e{vmnRV=0?@^)w4okrz@=-3Y2{^E3As(Dp31s~vK0b}uO
zStgTfD|(T(3%(UhVGTYx!RhR%R#cIR?<e~tzkk@I{)IUJHi=mAi^DmHw7(y?)_;$q
znvU10cb_Y8oHu;SV5oK?{Lv_cKBz6b)zGwj(E90zM=u{Kz!vrRxBIQ<FCRX7nSA$O
zEPeWrHt)knM-N)s%{$+CRZXP%<6yzDA@90dyT(n^bH%HGx_8XkQY=8jyZ(6$C*5OV
zOvjF$)j<-8#d^0gwvWL3)+J!o6@SK>Ft11RS}?B}yM6oiP&zi0&J1}9F|#}s4<$=u
z7{Jh}#7=d46_pl)ZkA4lUrFNWODDj`;=bHSu~LwE#?eM$eB=a_GbfPK%@xba8WF0p
zv56bOQBrSm@q^8mx)=ryYR;dQ53?q}Bj^C}1}wnH@-bh4G%(X3O#Pulpnv>SZY8K7
zuC9SsISGU;^ImuMh0T#58Uu3t`bikn`PFcp*WD|1f;f0&jA-pLK-o0JUY^%DC?*sW
z(KYH-tHolQ?fsAkJh+AcheNh(5ZQWLqIi3j`LltG^0pIq7Xv%G9#gYzDx-KB7BMAV
zSY`CDp9C72eBL*Wqk))?9e=pCT628Pgfi8%R*UrsT_=A2G++Zy#~RW544Jsy{Q4B`
zPAQkJsSQSkH^dO-V3HA6KMo>quE7Lq;{hWW)*?%H9Q4o${MhMV59MRt_X=mQ3=_{Q
zYEmwvdHwRK8-|1~07pQ$zX)}9j5?xYB^WD+jMji~T&r=&b-D`ou~@Qs@fUyB@9wEN
zd{2;WVyeVVBSbm;2YmJ{pO>0!C&-n8;jqa|0A0~uFvarGP`rBEv&()k#qL1Jog}##
z12it1x{=YHKU(_4Z)GG>`CeG-$SltByh%HsIGYMfuq>t};~Snd#`ajUAZ9V2fx2Da
z^;J)Vc%{Cq>CaQoV;2_yIO=~msJDyr!c$KDsLQSlOIDqk6R}EK3s_D|@g>kmR=y3U
ztlu^_2Zu8q1d|PfJx%Au{Bl;T%jTZ?tkhvcVk`yxPqyT~NmN3xK^;1^OTI-F^m&9T
zQRoVw8*<GmE}IG|tj-7@4d2}vsZTa>h>NNlL&0FZenZ4DtQLZ`C>DR~sq72M=BBv4
z6JakvCiR|^ZTA=P)8M=#92*tvC2xTR8>Su|fgxEAygeTy`5-%+Q#s9bFxPC=qLv*b
zFAV9>xrYeC5CAk32cwE^7c%09FP`W*f3o-Bp~K@Ai$i=xbF66<wc+@TSm`UZpEZmZ
zr#69vTrYY@AvVDZ;){Q<0=u_V7gtsM$lX07mR*H^4`EU<Xfr;Evx9S%z!g+>>;Y7{
zxA_Wr@I=C#tnY|mm(&JMgoX+a7*P(2-@M~hT5=!uiQss_J7kj_M3CP6pU8Qgy5eC~
zl_fPt^=%kHykJ{FfE=KZLWfwSjbX6_04yOc%XSbFz7np$74d(5C6F5@P8yV?U+E?o
zqN~DEHO$e)SL-aPC>5CAuau@dgeZsDL-1CUo4I@J?k0Qw=hwTtVpLSO4<rhCbv-UP
zlqSTPZW+gpOU}rtMb_!y40&0YrogQN`ue~~Em8a$RPGQr6d4X!b-FaVGNBX{E?E7p
zom@jmv%JT;)@*;{&L?M?1L%ucWqciwDD$7f6)wsHv%8p{d<2wBI_g9h=OCpFc_VIH
zA%ugwIM4ue2p)A$Gy-*huD!iPYQaZA@L&*+?<-Qc3((#h`ho2SeqiCi4lyc>E^Qdz
zk$@a-7@w#*@cOUC3CEavAhyPFYIR{;X3y24br{Es@!)@clws1#CzI+hx$6VO77i6Q
zW4KDow=`yspi*0MJZhBxQ*nX;b5(+0N7d8Ob+a5HggS6-ru66~rwbI=kxlM-Tl#C!
zbm$y)l>;G@wq&gum+#u#VVbOmg+le=3=Rf^R-=ka$J5~kqmj}c(18j@GkPxCA{hF0
z8N!U0>kxn5PO^GYnJpu9osgy)`XK%q+70=^1tkFl_7@(NF)(xLKv3w@9&bg(dZE8C
zmELwQ9L^^!f)SVDGQ(-7bzmJPErcoDWF54oQ+N@+jA!1BO~&0zI?|hNa{pUaDdwm4
zXaIN-8RJljiPBNjj>R;iO?=jA%WN=^&iQ)&_Mm^=OE#8=s_|nh*xSKnWatkvE#-Uc
zCi8J~s?K9*3D`G`q_n5<_Zu1<kqrbYW*rE$n1KY39-W@TQ?}y<mu#aoUxL=OBtCfn
zS*=5Du&Cjl@{CR|wMO5C4(A~5%J_Q8@f+y^=2AP{H5Kb0C;7W?wHTd`Kknf-f2|*M
zxG{g#iEG1ur0%2>`-R`jZ|T{$Khos=agYAMk4K0BlwW)F-iq!;W&gN3DJGY`rVpZi
zCK;mBS@WnmEe{Gn?Idrr%ljYJgM9LlTA6%Hf5No!k?Nh;1CBn_CqdIm((Qiq-S7?5
z4;x+ADVynE=PQz_|M;7JpBG+Ov83Psw)KC<AjI%~dsVi-#e@L_(r%L9a`xNKu{bj0
zjZVCO=eNdhvtPI|Iv|5m*!2L9z6m~z_sWN$KfGDK;gg#1zyGLF(=@6Nw`kMor<l9O
z?b7;ikWm%<KG-LJtgQ4k_eiuu;{EaAmP?V&n5+2XV`Ud&2hii%uE4Vm8{@+ss{Mc1
zs%#9mEk5k!r@AW|p(bOAU<-648yw5@G+SLZY0Y~z#IZ<q9eU)k=2_TH=E#vSUcuZp
z`ebnq45Mp3g_|8U*?vZ~%iw0lpaYi8@-q7)=+*HX>^Isi$w#k+@{FlC11jok{TBN8
zO%OTZ?Ay%Udf2kLR3n!(%YST)(Mx}?;&T%*v4Il)Ma{eJ(<DNb28KaBjg?oSL#I4A
zHZcAo0MVNwDVgwOfJP0#qn3ktGXQC*6W)l*6gsUV4Sfi*bdte(d?l!o>d4*vOjGLq
zYP<jY20!;0;^uI%sA8)%LEVI+TU>#|TZ~+B8l2{n_@AI;APCky>yxBb@R@%lAQk*a
z#V6A#?KZjM*Qx-FV$@AfWvZVZ#sX#Fe(3$O8h!nfD{4A?qMo>+L+qwtfNd28Zm+Sw
zYdwIVKACk~scMWt6QIp4r<Y}Q%$72K%SB}vA1Q)H+EjrDNb=6R6Yo=1i+#8eE|PP^
z-VBfwnT+F26d7ybWB-nkFnfPUrRX%~-Acg4?c4iiR^~PH24y<oQ9z0)IU2BhRck(z
za}XY07g1M15@hX!ASjgq0&vY(;jn-;(8n^cZ+B@z3vG~l!(2S58E!f$OglV1-K_?j
zsFqp!)(3uwDjzynXSs0}G-l@FvbABvQ?=O%D_Y}+kz14Z&q|v9Ay$9KIY~N?ma9Cu
zV#lo-p%OQUCKo2pRn(TT6KLJsOSsP>na6dk8r^G|tz^3tS;-sTfMiZW*SfmP-W6_X
zFD>cg^*z*@a9(7eMlNChg|TIiw#3;bomu)G2sO76-9Zwk!oc|L8ddmX5kTBFZS=$&
z-WYS{gjf+|Pt~G71<8ML6z#KNk0)1o-*H{XZlnGpw@dbyyTUz>+iUdE3wHf>?>w&J
zN*6u#FN=4f`VrH%FSEe$=h%OtKs#6Kv^A?P0ueN22|NsfBuo~+5{MuOGihc4oU*nF
zpZumG%gd|cj!dy#5uFB20XI*s47lk$n5JtufIKJ``LtN6GyQ*+fjFYKcYZ^MFP;Qp
z;=B@DJe3BU!gwA=fTK_*x)uWW;wJZ`>o;vkld#W9YDi%LLQ~nRDBm`A8McX~lGIGc
zYe{<(yXW-dfQ7vgo*-mF{u+#Vx)HQ68l2_&G}vW5XDs316S0`!o0u8sxY!FK9keaj
z99CwCID;M?*}Q)%Zg9+`2uh#lT==_q8K?t(58<_U`R`O+5;#;qZNcI|ROtnuVhdU}
zZ(4g0c+dtBFCO|j<qY0)<hP-|svF-Q*FT^AeERL)A91OIfc$*6EY^#kMG&Irkkjz|
zTSX1?8h``DOFMqULZ)fF>piC2cmk1;QTp~IS3riNwpV{F$|2*lj{@oWb?)*bf0ESf
zyvV@3I2W@`{%d1Hp`1^QR=Hfyc?C55B0KR=={;u~2_nvFpwb&j<=~g9fS$k0mhjE6
z;P{G9m$SZEN)E8Gt7XQKl=JjmewM1fgGjUDnFir5ng?TId9G0kf5kRCqq064sJtX1
z^FBGx&(43R^gp&4vGp{@<wtcg^F66Hbl}T2#W=zE3`qMWR~a~u*COowr5Tbp7wYr+
z3D@vKl3SqwBZoWBHCtI9RN@c|#P$(M0_s}FrK5mZh2w+M!vpVNw=5PDq!>UJW|x(9
z#5nOIcrzUR|JnPq?KZA#T^PJJo+1P}lYkP9NZNl+Cu}K`l4zORYM7*C@BDdufFKYg
z!vYaV1VD-@>mUC`jsK=DYK$6ZjCzB*tm~@ldXxPE^$In=*{ro90I*TxW+#01Nf8k%
zR=?(&?KcG`zPEEKnli94qe2n~3GosOwd$bE*uasZ9QqrATIww$K31BTyR_aynr)Mq
zml1zwyjKTX3B(G%u~EhPT_(A?QwRIk_xpz(4RGdoJ8D1@O!3NZFqA&0v!~a441=o<
zlB}1rJ&Dd=zT4#f^g2BYQhkbDj`s`P=tFQ`-JmuB6I2@w86O!lF!yyU;>G72nis(k
z5#KW6l<$S~7MiVQK3NS9+hPP3ppjYyNMe5pUmDD!J1+`LsTtZu4roT-BcZU-wGi)l
zkd#83N^)Gq*DTo)=3<aO>jr#o$N;({<fBUD06e!~_rZMb0iN+->&F4dx*+O>qwd@R
zFGgeJh_&;13e@K@_k6J`XeHY+^E(MowI!Yxrc7RYC)gr+NDE>6;`w6VAVa9eO{sq~
z&3sxPjkm}{7RS3ixWp4YekW^MEEQ*@cIr)czahU4`#3`ipz||HGZy_cv5bTRUnby5
zh7eT7{R+tk#{6^86pC9u2Fa}5r<J6A@-sV0*GgVBBD6i!WF>AoBt#OYp%B?UUx#><
zppF-?Soev!i4U_$kp2)ZZSvipZtj2I_OoX_wu;$FuFHUwA+btHOTdSeYKHk#lK3<t
zO;=P7xVDUU^O=a!T)z=JjHL@|6f+5xlCC&(;v%yYy6G)UhqQma94^<(*}^`1$<&-U
zS``WC{vjD6k+nq;7Scoo4c!Vt0ocl;ERJ}ent8)#$#^x&&glRibH$QSPmO;WlYAQb
zuBokrnCPhh=@ZjBo4SB0xwXSgNq#X}oZFSEU7IB0i%kq-7NJ{N9=emk=L0MS10h-F
z9KB?=Ty-7TGQfKrp9BoM`B5E|)JHFO6qZS@2EIgbH!Rjye9^_{UH5r+mgaN$^O!64
zQw2VSIo^@LWB3`P{*c%$>M4IN3SAZ5hTExl$y}Mk>&kR~$gFeWlk0q#{Y;z9IW~sF
z;mi%JcS`@|XVxI6q%K@a68c8sJ;?$MH#H5p)pVgIISc!BP20dh1<^5B9s}OzJcLNq
zF-`g>BM#jbQ*^OG=}_}D9wgq07CUYv*j5bze!#k!rVw7oY(6ClIpcp#E&>4eL^#9|
zC-#n~P5Q2xCrLBSo9_29gTv%$4po9n%&qAn1zADdbuEDxwRsRsj4eyxmW(A1e|ED`
z*U?ZBg_=IImJ`epdT`DOyhCqP1!aF%C}#1E^@rpOMrmK3k%Y+8H04CtEKqYg4+*wl
zft(dU*V)bUC*22cfaZTI%!d)g7cPBKkznZ=W&IjwdIHD>-@x3nO99lme|6=wX&<E1
zR`e}r4L?snypA(fy2$aj(_g;h8<JZUR$57^&Ft^jada|Cj_y^hb!b!ytydA(f3G^q
zL^n~rZ%g`hJHBrLNHj|-2uao>;@^oc3T}*BqUwH;WkZO8l?Q(k{QuMJbd27oBbgyp
zK@NyBgk$rOk56#pi=hjDg$%=N+IgBCa%u$FbvSvK>yWCFiR@2Orn+fAlN{ZWrkPGE
zaXvgn+p@CMhB2715Ad}HtBa=0WuG}tt}ADEZQ@hxvQ|Jx2Y||{{0TKcizv=mQ8D~!
z5iTLvR?H>KAuoU4S#qi)7X`+WO_OoJAc+P`5C@iEpGYfpNz@MLgr3F4=%n?oJXG3!
znw{|%u>K&fK|Kbo1r_*JxJ##nywSZ!^4N8vXX)z?vndP%YF+5<Yw&vytiKa5;k`&S
z+)}prJfjypA;)&3YcbLBO>At^L{r2*x<5yWzv7i_&rW}n2|MNby7BUqKQTJIHR_)r
zOFP&a>F=o{{QP4!qB&v?pE@R<rM^OH@}c7xAa+s}rQy(&988TJDlElkOo9p$R@ZO>
zXr1Jx*3;EYk1j5=c9?((s(U3^0ixf8`R_)oUc`--Xv{e+AdD=7^6kJJowU-Rg9=~A
z39INaHkN;6toNsB-Y1G|B>f~Aj_33JZOgR~HX^D3%U6Q)aF`IQbAefN7spnCf1WCy
zq_Z?rQDdY2=<izdEq1H&e6(OA`ib#8)KRJ#Zw{P=egW^ZiPdPDtk+~YSfgHdTvl#W
z>5ieQ%W!vy+KzR+CEWnc_vn@E!(f_fP6t;P>dJqi7SQs}MO$3ezuW#x_cpKFWf0Jh
zkgyvHO)0^SVCFf=UmYTKD7~o0`_Jn^=mp(ua*rwTJkBy)47U!j#wA6g8%|C~AYX7t
zV}N>*v$j=JB^^9xpXlOrY;?s_S}l9D{JfDpwN%#Sh^MrmLNhW;3^MP1B?&MI=Xutb
zn}vTja!7q^mO;}$N(Z7k##qaJyljlt^WY{q*pbX8rU@4=PxcMOa`~h*1AUjq)l-p>
z?e3IskYEGIr(z#>!?ye?P#<a^NeG&94`2~*2+@p5EX-a-@ifFP&;gXEu(T?=5FQAj
zx5Y{ve9L!-E|{e{`>+4&|Enk3Sv}x(3+sQp=lU%!XqI*5XZeyw_E@!Fa@Q?E8*7ZW
zrh1k7oV#$}ygnh9m$~Gw<ulnYCZ~l2HCk{{HUd4n7>F*0$%4IH>t{nyG~AMnXc!+N
zo37X}6Or-Cc9O&FwPF>r*sNxJKzh}*CysB4tV>Zd()_#Vn{4feCWi&oi_@XnbH9J{
z!a27oWe>>rolME=+tf#aa16&$+Keah<TM+xtSA#`Vz3J>qj9$)y)Sx?B~7pnRo8*5
z($H<pp_@PY8`x+KXa7Dw$%HwTxGG$KL*y2sRSP4#geqvCi!%nsw!A-6Rk<WNN6Mwc
zq?F3mOB^(CI24x2UBI;w_fH(viRyn$TRx%E0AZK*mW>E=gL2A(VkOFC+bI+Vll217
z=W=wKi|@5hc^3ApwJ~Rt)mP;?cnT0$v4f@@bdwEdhC)@;_X=yryvrd^*@0?%OQN6A
z32Y!O(S!t0kC4Jimq%YD10^3__dtw&g)*@9LB}`F)N|!<cAPT;%0xo*z%75%Ggdnb
zEn_7B3m@Y+pNc+O)EBzboR36t>-c)mu>pP|j%%K*K?4oh<*&TP6Z5kvhFSwPLIXw*
zi0wX_F4jri?efbmZEFo6_E*VmepN>$oZ)l;iS-AKHechA>3Bdq<$>T_yh{V>PuSE*
z?0O*x%VN4|LfL5!LW{?9$y9%1qjxssLug%KZL#EhFgHj7SmKIPh5R;vUcGd41Vc)k
z7urkQEp+fGJvw3&PBOV<n+>Q`of*?UdPsL7&wNAv<{8qy-f{vGCsFI|3V1<}O7fXX
z*oj}C;+t=0hdmomCOMv!FrhdyxnTp*ieo<bu@e>K3WZemOR7#>95#RR!0)fdFRO+)
zFng|UHU8uw0I;a1Q$QaKX8pui_=9gk?d-BVfjs8`tXQPArt?Z8y&oMwb#sZbM=Jkp
zvn_6iBlFdeKtf3bD(UegKY9TrfLi!AmRz%^BFDtM_V&IJ?VHMZk~rZU`UO-kQ-nc)
zS87EsvM8UOBDE}o7{Gs-*9%y&S});x+dpAn+5=?D;Q15^@@VUEdCtD*#*;oQfb23Q
zvsM#Vet3cRFK{zOoP8*-J25B^GWll5>?p{+8z%8&BpXV!rdq0@YI{D8>YY|Hdt8;%
zn9m$<265*U(?m)HQZxae)lFGsCdn%OD9ICThMM|L7XkoglOTVS;^q23kck(_L>^2(
zw=f&wL^X*?g%OD)^$}yG*2eK<5)YH%F#Q*39+E%jFw}8x@??l06Tk%zfoVs~1e-UI
z=%k;dXJ89JQUDV^qmj{&=n^?0MwnR~)~KBkB~m51kwd-M2N6SN95G%j@XJN*%*%14
zHZQoAvt5Gr!D)Z4;0^4RTswD~37Yxp3-QFQ>g>uqB!$RYJ_)K9@Xwib$0f>oJ41?T
z(4dEC<{+6&yg)Bo^UE$j?6O)(naMf>B1;q`)Y+o5MB32pc!K1v{HC<U|I$tHvMVp8
z8cEuq-3JyH!rN3KKOBf*(E{vcJE7k=|Gcd??w-O($QFNndU$X|Lt|grSez0>3zbc<
z`cpNpinrE}wf5mKJ8lo-8SRZGHSnsr-sbP~Y16h-QwkHae0TwQEuI|XSWf_pv_z+E
zpN5KUzMgKZ-R5b#xq6!y{%ZZUbL^5+f458Y89sn?Hk~b_V7v<T*&v9QD70^4V_14;
z=p~7!u48{-0Op_yKf={Lbtt*w2ZY5D1ZOZ?09Hv{ki>y~TI|)Pb|}ybFpFYRR$Ub!
zrh&%V7?p#Y23H*b5H0b#{-Qg{;8G8cE+}2#806^M=ISu6QdENmSfatWVbg+r!+uAL
zTl=!hUXaq7Iw*xL)fl#PqFZaC$FU7PJYb<C`MQ73A!>P6k|K#N_R|qd&~b!lR_ais
z`D+xuBlOod36lZdBBA7beZrS0cYy-NewN$;lm+32EzzoY|Gm=dB?fgF9yL)xJc>Ce
zj-Hw5Ar6atYnYEL1O;J|9AJJ)SlCy3&YIJBBou~)-wSVBRAoerOIC_6S^BPC4{#kV
zIu(CtuthjQ-?$5oCgng2Bm!OZWmkU}786tpzFFD{k+V`djdpP@?$&2rdq0nHNMFC)
zVHo=<ZaMZ6=9{1Y0(~1#QeJN-(lRF|M4G=rmORzez$p&iyNdM1Dk{M3JLfYyMvE(b
zxcB^-BEM=-q<hcM`=fA;bH5b2#`a`xjnRL>K>&(gd4f9=vZx+Jhf-`k7Ahj&xd_ag
zL|HJ)n0F0|mO96kbzLWf^6<l^dx&%RARq$51BGc$Vs<{oVPY-jf${>(+x}R)O;o>$
zZ4Q%p@>)c>K~t~XCN2y*>(Q26Ap(uZhQHh?IURq&tg_*n@CU>SZ839|=4!=5Y#D!(
zadvJzPgo6MayAol=mv-hAaQ>ZZNGRTY`53lD(5c2MENXLmpb}L^h@4uWyVn#x?5hI
z9($VbUSwYf<1@79`}jxS$Lh+-Ab_p5tOAGa2HTpc{uI}f_1|Yau(a7`K4K?Xy^bFz
z(*ow9GfM8dT@vXoiT>yyj`KkK8ybJiuCv$5KHG9UN}E17Cgq)2IxatOCLOsM6rhSW
z+IjGFap(Thl`?uGg|sHkH4t%N!WgqPtORWcP2=SW(mrv4bIo%ua~Myfuor*=I*um;
zW_9f#qnfosF^&-*Wrb%!hZ?>$2gaxo`i`Nt@FJs1g{s!@?V3fV=s@Ob5T$=f3gH9(
zppqjl?4{R7#>4aYf_Sh@4Dr0hjF?hK3YKWEIM-bUb>uKPVugu5VpnCIA0DS|$f+~q
zUxP`~!ir?}Ez+Q95Q?KS#Un>&e<Af^_b$LQvQBB13#t<zIp(=o_JBqwH_J;)%qaYY
zT3`f4F&#5gp^`G(j@&!30I+{&(LVbgcf#E7l3T899uQ$9a8ZtG61_$jtzbUTA3~Sd
z%)nQb@;D5V6SGAb`*e^oMbo$~C-Ru9EITh92roQ3qdra2f^GBirBG4ktm(e1cX(yR
zt`hVmh$xi!1U+eL0O<*rK00fCzqPl6K%nlkt*6^P6?qNH&rJgB(3pQEb@$q0Qm`3Z
zd|*r&<)T2RX!wsVXlJT6*4u-b1G|Pgr6VlEfvEcq5k0VsA>ZsGmdXKogDsCId5K4h
z4OL1OFqZhFOkn?w&g-QGiF{=8R}}bl1VsbkU5g^{xEXkCrh_@VpzT5~86I@znTE4t
zVEATA3K`Nj5$`&dMn!)|AZLK%Yr?yG&0XuYnDhOqTe*^i370aQLNBB_j{>$5D-{WR
z2_Si~D*+q`<M9c*3bJxPpg5sO<@oAwMLk<Abd-4#0bZezI!%GQ-b{i7O|*;64hze0
z!IdV`D^N)y`Zuq9m(c!q?O~>lW3iJ-WV0wpZAA`flKQVMaGHP1$8+PeuDtB>OOJSb
zG)a;sm62E+k#E%d^~Li?&vOy$q<S8+T$opg&~ofmUW?d;H=hZT{&2>6l1U<%vT_B5
zqfz|1*G}S$oJWEB^YPMvkR4%WXxj}!my=F(u(d$Uzm!19`oWdsK=oUt0p67ns-UB4
z30R<5?^Y_T(_w#FxxiO)8|p0ck}7`nXPrZ@@Zxsr-W4ln^<7^DOz5=D5s!FXmvCZQ
zkVseo3X0ZJFkXFRUJ5~G-XB6W=vCTJFLJViNqqwmV9k=cX2XGF3ZDawzH*Yh_d9K;
z{HjZX=2xZy4o}5D+<|j2`G|3F+deP|S&GN2R6Gp@wqbvfA8uu*@lVW!Xquhd91Orp
z+)CxZ{avbdL+a&MoZU_sb`GLJ_5>gXU}N$g_oUi+A*EAEzy$3hbbK1K&MH_#f?_#Z
zOLCMb)cLsxEXF^F{cF>y)*h94Wj0Fdn1UZ3V%u*qwuQsnbEFaENIop;X$QOAM<B>h
z6wq>0v&4U#nI@K4{&9&4sTvk<c)sw5P51*=m2>dW!2?yBm*#s@=G&C&T!m;L5A9<H
zj_(JamO)TvnXu$uI;9I(_K>L1mA*{RGjlFt?o9iIZE|JLZp+_IDogi&aozodOCdPb
z#=Z}Hj3=|C6*L(Shu3bB$}VqG5azvMA{}uCP@;bWkZy8xMPmN7XSpi${e9-<`o~(a
z2c`YCmrRk(oP9~$wb%$4>_P_*oO^``0)kscvp<n)N~8a*tIuT<T&POgoOHG{Oo{EL
zPT~p@!3mjRdCLh`voUn^Orlwe@rsATM7!bK$_8|QnO^ZUex07qPJ=!p_651LgEQ)f
zp`w4S^}nnD60=a-?iN-C6z9;>-oe0MLQ%<?|FX-7t?+y%=x&`6-8JBF7Al1vdA5T_
zv8Sm9ou$c}-08-q>1PbTMzlX9F_5KX)_1qW!NK*n;MD*g?=-ZZiR)=X2Y2etTgm{M
z-#8DHwIu2S;vbQW6cb-}TJqqNd9aVWTF8I7hs=M!R`>F)u#0+TxTZCC$9OsUAV>>z
zJrjc>N2}g6<Y{uaE+G3L<mx~f8=ID)Xj)zu9pow8Z#2IF6rpJlpUr_zVVskN))az4
z-YLw9J!_TeK(iNSpoM|Mb>PTz!7T))Zoy=p4&w>ya#{ZrL<=FRC(TWL7P=gVA!L6C
zTg3pVKVK3k*WwsgsC>_1ygSo0xZW2_W>_|%G;!ec);H9ihZU=Z)vd$cY?&SA^Dg|~
zz@5U)NbDmsY%+El3LAjF4W4j`<1#b~YL+{LF9&a!yY(T|o~imInC5;7tysY2wh#h*
zu&uX;OpzOr;WEr8|GmPX5JEmqVRnBa-mQhCr^bH!eWSVnF?P5dK8tJ)xAjpIpESjU
z*{Xbjj0U`<Hy(S~bv7}Su4&{^K7_916n5l4Q}2JcxotyznE7Tk_>9yA%D}oQ-e3XV
zj#d&%2Fh}yCEk8!f@l9FUy$9B4vHJz;2DO{93#aSNVwUkRS;?Bc-XYOz4d=vo<e%(
zK3fs)KAyr`Pt2n)Tp>xQijO5Ri+OIqPR2eXbkswsSqx_BkY+sLI1LPuNJxRD;MNvJ
z0HNkrkfGhpHZq?NWPE8Ay|}oV*;sO0^pgo<ZJYr+)NpV#zJO7xWXDN+pyYhv>v#<u
zme9oxS)3b|{p02yc6C34jlh4{G^Hv7Ue|?~rPFteTs8N#1ItmBPSu005L>b?%6SAJ
zl6>fDsJDJG<GX2p=omg^7=~}07Zenlaw#Dhu24u3J%MsGNe@}kP4^%!e3i|NMILaV
zexEVc*^DH#hdGE?SYlUOY;~wARS^u)G`<cnpu({HhTk*RD1UBsDcXNn934n9_T}DD
z8{ILNSQ4NKN#3J@Ew5(1>#=>8RAmgarA0zK_=p{my!%<sLZg=y^uZFn>$*eo$-8mR
zVaM(BxZjjTZ?0<qiE~6mQnp2r?C<Q6xGct=T@#lD=o{qm3<{6)c=$>s7)>fv^!XOo
zk7BU(m9f^~RiLVLNhg0L?Ajgd0*cbhora^G61^npSrSW`7jtT0I(%6GG2}B;h<0zn
zQCKGuZXYvBV}25#Z8&_TC=3}d4uR;^Y33o8q5{NHX*$_)LY$NoD|%k^AU<_b&^h~D
z4TBkwE6M|YIKxGwkbui42s{-h?VqEc%d7lz^rV26ARr&^|I>dbckaC0xpT+EDuzHp
zVR+cj(W64VXb_nq(R-29<}ij?ZNW8vBT3o~gUCr6HNNy4V&|oQX}?W5WdP7XEQ~1Z
z!=K7<Inty8>T+BA9!MuZP!of**g72&?a$?4u!dEiO%@>QNLx>kl?sp}+*%n%y_BRJ
zh?B`-Q*<&)`I&!yYrk=`9sxWnK(*X~U#Y5fEZiT<-SBuTSWdB88!U@MSIapl1iH3|
zdoLe(G_qWw9U*#0>m5T_Ql3opgLV|h!+45XLg1<!dbs)dGha6i+}3<i0%7GhD_-%D
z++|ZriMq65U@;JIIgs<^a42_1=1?+Y;g|NHzzgjv5S4%1gtgKkj6SdXcp7ttK4+>0
zImEI%LD*Adtyln(ifKjJr!e?V@<}<kB1o5O;%;G>-+~>CvuW|a0lZN|<Q&o0%tW&%
z7Snj4h<+QqUGsCK*lWh(io*3Y;lS&B7y60wf%CTji<F%5$8qXw#z=4NtdWE^kr0=J
zGuSbka5{e$v#_|9^5);#X@s$tgG^miij75`x?60STDLNOxjAK-U+hx3HH*Y7W{I7@
zh8E|IWh^omo)O$JiiOrHoe9QH3SyR=!<83?=fM3g6C&p_$|@R?hZsIj{{>t|nP!i5
z%8m9<vb3M%s*K|NnZscbC&{l%F&}c!aGy5cVkCe2%4mFQ)m92LF36FPTe>OE)Mx3I
z%Oub;eG(JH<xaAE+WGA6-Mb12$`om%6KyZP@*OlCro@3UQeRFueI|E9p;0^U3C=H&
znGWD{E@$wS;Qa3j&3`-E4idA~CJAS9MsMm@qVp>@zZ?#CRbGk6AK>x-uM%Lrf~VW}
z@q&L82Kz!D=hBSHbd}K8;{^!+%PSZpmjC3Dn*4O!5_QIpy7W^BL#fP~k3n-5LzhbF
zMR8;G^hJ-OZxIvEj;?9mafz5JV#$lvT5UIrYnEgRd*xmfX4272P3+>rd78e*Uxh49
zvypSe$~`u-ds+|cxhmt6q+Y7<C#7^LG@pN4HA`BB|ALH7oDImmz_xo+2^YuuT`T6O
zL-MoNo#?ZT=xyD9{+7rg;7w{ty;O~*%3|X~EokxWqE6{p<URirWQ~#t+Iw%_5N#PS
ze*OC0yML%gZ{G%qp-$HCpClxsgYg&+zHZa+ihrvCqpl)}I(U(dsj`jnYt%(ID<gmW
z-Ft)CdwZXF!)PsD`?@XPhP4&?RH*7M)zz?Wu5Elyzt>PVhvUM9``+5=1^-yPUzn~p
zmL=)0(V9*Q64|Up9dVh8{z@+dfiOtDoh14ey7sjoL6Kxj3jU;7)iAx_T*yg-zMJ=X
z9;8p?Tdmh>Gwnw@xTy-sYV!zC#x#Esq>1~Nr|%SAa&ZpN`K$YitezUc;q+K+1(ez0
zjEHVLw0rA4^)BUrSG`C<gB<PY#XT3|UzQwN^K_*=1|=}%O0A}t(aF=?N7n_I<~C1r
zNr~ERU7P3*D<=3R=C!FB)7_-u6UDDqE=!$6Cs(MA98*19udyw74;W)(D3yOEu5z-S
zp$cMaMrCd9c_dfC!+{WGxNL4w))eb#&B}V5NS`%>h6}AT%2`q&aF5<NLM&B7;A59C
z6R2HaH5KL<V!tGzaG98YaF#m<<tf{R+3Xw%Z#foS41?-PX6ww-cAArHbYXtl8n7jv
zU9IrWDsPVP^0GZyxWLLE*iC;1PtR0bUKP9M6`Z3*<J1W^xF^p&9f}0S!_t?9dFa*e
zHB=Dh<$W6F3-#`Fnhn??bdF%y^9QPc_Uybno9O>>#wx@~0l082%+xKhVYCBch|K#L
zRW-F>w9_OO&{U3$BAM=(@5Qn%B=N3D>{+M2U;&%C*%5?b)+!GM%dmfb11^D~YO~Ws
zB?U+`KBo;)3?f2LIA%*yKSn|2PDLew69s7^fE|Ar0*QeJx%%yF6_pgN=y59GSxm$<
z9H{z~)+ZegFRHqBv`_nqM_ESi7g3jR*@Ik+J;|Qgi9UVv`fc?8{eMIoNGJH_HIbo>
zw>_7-@YaDfTiEHR`cQwi_*@a}?Pt)XhLhw*tyc{vJE0i}^~Kl4^SeTY97NBarmvko
zC=XL&u#`oMFWQ5hg)33OfNlgtrT3?v5|#k8_|6>}$sMNT5<05T&Lnt)H^7?qG^YM|
z(HbMR0rNs5Iz{%MTL-F&u$matgCBM6k*q<f99Cc#(U~&WeX)OP(UQu%Rc^a|ao8GP
zR3uFUZEsl=xsdF4r9y;FZW*y;@KsaqF!uo%uzRj(i+<LG%S(?mEkSheUQ|u<tlDwh
zi|#=x+@cp!Og~G8#Si%sNEUxfy*NUvwdx=GRr@?o=E_pJ8kMixmM+Y4VP7LdmU|-;
zySOmscPkH~7sY?YegQ!1I~lZ;*bG8YTXj8_aD!S;=BQWKzy_>?*d@=iU>nnB2S7x^
zcoyy)beIg)JbzM;2H8x~PpC&wgEwkTc62>REiLV8inK&LIXu9%CC)xIEgLeMa59=$
zFAAhKf)Ukl@?ewETfpgU`NBC&P7FdV?<awiBlfB&Bou$Rerw2a;E4G!Y=J`TfoJyE
zBaSbK(sk(O*(jTu0^oV!;p%(gp$R^cSqeW9=w_D@P4hktlBwl#H#d`%5xzA=8ZE1&
z<fMzuFAfr#pgBCX^{{9dM^usR8!<PN^sHRJZkV{oYg!L(%g;K|19nB628$@9dl=q%
zUXnI0pDlkc0R%pVTiW_Pl`K?xDEd)B|Ch7PS@$+}o44@fnZXKjYeg=flWW<NLp%}Y
zl*HK!cKZr%#u3MZWk<mnf}8UFQ~+CE2e1_i?qAQ#{r78&RRCPi17FXBcdSQ+%dJqC
zu(e2;F#pYi@S6u$e8VK@nNkS)Y{&mDeEHeNjrD&PTh~@xY%SJY1bura6~>x)x?8gI
zxU<%Xu25@iEzoPskNClo5kI*0h#!<je27H#dKa(B6}k2y#(a2<F+aH8n2A7KbD?iC
zA-WAkTG?u-*uuM3W=OLIw}@=i4l3njf|u@?#?s=2=_Zb4%_qZ_|9-45*{Isl`jS=E
z?!SNky3uUkbh}=?s)e-ePA}#)T~&}*VhfW=wW#ZYuC8FFj$mgOm0h9SIIJz79Zu6J
zF?;tPYPRK#dHL<@_Bc?~E$S36sv&xoI>zN0$#DKT{*yRJ;ea{|OMK1MFMP#2mTv8P
zRjHu5v=meQdvAj6_jYO7Z1j+W9Phoso}hnws7Q5d`cKlD0&Qj5;<|ly`r?1>1=G=9
zFdwQ@ymX#L{>c~3utV<)^{vpYU<n8JOclEIcJV5>_t2H@$re{tsh2fnj@RBU7?A06
zuhXvw3;Oloihey<(654+@czA`^So%nqMv_`TqncDP`rog;*LYp4H9w9UR`JPHQ0Y~
z(dsWO+3X_|?c(lzeX@Dqt!pTi5XIPB^2y>xc=Io5Wo~CF<qMVYTY(lnF6rT=iM7QC
zE6~SZHIwf?M=zWhYI4~}o1h0vCg{P(nV?G^1wZST89BD1qvTu=i`W=3%1G8oMBwAt
zpwMg(2U78ziLzD{Hvmo@N*i@cXUBg>>dqZ7y?N9N7>{LQQW&>H!mwbVk5t@cq)f~3
z=ykb2WrvcyBQlAft2j-j0$E=agcuDz&lPwRF~G+hpQ^a)Yys`P?iD`7Ad!ty6q9*q
zwO|O82Q*UAC^t+>%T3~K79__x*`D@uB0~F15hNYlaPH-_o)f!z4xh;UQ;>f#Ac={=
zU=ywgZB($*a-4^9NvHAarW)nGxO;c}`YU}3%UvhB%hIPj8zb^^blizHT(Kjnta%jE
zd|z~;CbGgL&HN&tCZ~<)0V3z0#{GT%{Y{3sT-#5MGpKlp<J!w;jWd#k;!#da$0R+1
z?zD2U?mC7pGzBld6Mb%NGPZwmC%V14xyc{2jQeqNro8{+i!Z{lG^a2_-u-G(-5Z~w
za@18|ffjc}Mn7MenF0MojUm83NVMDWFg+eMIoPuk_1RHKUL42Nul3@T3SJEj`tIFD
zO^G_|O>tGe9KVj%H>{dNPU%e*(^KMp(?N85Fc^gIniHZ?GwRG2g{FUjSxuk0hq^b`
z@48_t`?7qf<q^?~=J^B<@xPa^fD)V1*ic!t{^k1&&cp6&ic8&1vq_Ha!u}<;B;iDS
zW)(~)v{5+}grhB^yRD5p=yK--&a53Gp0$p#A0~-}ZQnln9RIJ-S=+Mxem|_ys?l1q
zaokU*G}CumUlcn}jW&NdzA_mE-?t3PYC$J955L?v`l4{4f=MZL%L>oceC;uBeE!8|
zawyx!z#dB5=XjD1!tL{gZMWctx2ortKlwcQGa6X11Kh6hyJ_L3xP27k|IIggvRNPm
zAc}WoN8Y_;yUdXxz{WLs6X81QM6>ZYne^ja=X}V?Lz?gl<xYRzZGB#v0dZ$|v;3$Q
zDB~P?UVEC2;(kVyckO918sd-BY?QGhsvdQkxaQ#`iC=Xh{s)`N8MG{$o!P-l=Ix2Y
z;824#{W7<#S~gJ=&?Oe{g5ey7Z>@-}<`P`D)V_UGG>6x%vd}*JViH*1lYp`Dal+7n
zbDT!in3Ss3<hXy2FsbCNgO_S;2pqB00O1|6N@dpAy>kawH-PRL6#+lGbUn)l?%i6D
z*-%_@EuBuEAq>qum)#Koph$Dh-foQo=pA(YlClj7XGLdN>d(T7vt8wD#Grl3ka4O$
z{xl)>51A-9)g~IF$(vq;*$$1VnOIWRB`z$RT`L+IaE^bx-?91{8x)8c{hcwLIZ|*~
zmC81Q-kM4Oaz0dCO{nj~0=MXwR&u7>C$C?>uF=WQ>+tn4F4*zB98wXdffuUc>(rpx
zJD~w)Gs$VL^=;vKu~O$PTBy}qj?g)nDNax6tZ*9hsK(fK+32`wnyhJ@zmkT~o&U%V
zYxLR9fE$1C9RzF3Do50*=*|eq@TQH=8S_&;ts@V67r00x1}8d-Cmi$TnRL{J=q3fS
zQWNme5Xm;@6NqyVp22<^l1LV$t1BnYy(Z>dkX=_cRFmbclqhIAa`<+1=Q!7;{e*+~
zVh4FwseFS_o`xWN=7O+kFC(@JEAr;R`PMk6{#JkVIKx2h-0>JIhT=#v&wWe3{ers)
zlQ(<)m%3mnW!SdGc|r7aX)FXgAS3?MK3EcJyxEmt>#lv!wGRp?ct;+eUlWOF5QN!x
z#l2YORqf_M33JKWVz-5<!TkH2E#@T<pBGX-WtQ1k=7c80SlloJka!fZ&+!63f*{^i
za;twZ;#8P}SNc=q0LQ+A{dRGFIY-X9_$%1d%roBxKvN>FEQL~BZ<wPTozi=amskf=
z@N@|Bck}mm?i73+<P1rUm0@<A_Yjf&i0xKtmmAJbM>(rl>8PhfzyIt1_+L@)!Or9T
z?Y*6?Cp{Xd@_nz83yuhr(0`Tt>-HsN2>pL}=h=&%J{IDo&tGi+r+cCP<=xo5+<Cga
z|6=RuZm;2V3O)8>=pnXSX2gxx##-81HlFep>u$_%GAnD*4f2o?I?sL9dW{-!E9Z8H
zFfG&EGFr3K8dk}fe8V+sg&TVR?@t0>#%C^e8-%5-17Y8>f6fx1eW<&RMz<_<l<|Kd
zK!xz1J9l=8y*ZvF)bzYpOt4?zcftEa5lt;kIMWb=x@*Xpa6ExMw|cSNFC%GDK(HJw
zYq3rt|L3sMY&xG9>rQKY+`_B<?I+t0UqpAJZ}y%)ja=Mdd6!4e_a1HUMGyWF`E3?G
z+TMQ{J=uA>^MbhTuR<3T{-o@EBF%rA<4K_i$0Rz#zVaLm;TBR=?syb;`)bZ7OiXB8
zvl-2dN3agm>R<UNm16etCGH!EkfFe}EiZU5sJ;kH5$!@z8<iXcEGAN*s1?4%d`Da+
zRu0oCyMPFz*wf|e1r8N-nuyVHxAByHV}g`<qIUDUl=nQ{^v`)bcz_r)PSt<zkhUk1
zAuWTq#_5H$h{O8yg37~L<M5yU;e+(}@2Jv2S~>>v!?;L$_SA81EOmg0v^>;1SfVdF
zktE8w%2iRXGA>KU)(IGeRA{1A_0g%i=X1SPEO$<j^Gy9`6-b~hpPG{_{uY_yk>=#F
z$Uw`{<0AvZ5_V@7!?+%+7Ycti$t&3-o}PNz#aP3${A4av%e+{c7AvIBndih8ay%F}
zUo!*Az06q-3{hQFm>we3p;lza$WsgN$ew)GVeBl{fA+%ArJnQ*e^%5<uoG41O{>*P
zSdS{iY0HlSCKb$Cte`c~%e^NIBp%eS92P%~s;3uCso2p0&GN*OWiWpzi~d3k``5;v
z-Is(uQe|7~(r~c7Vl0t`UKulfo~)f|BqWB|<Zwv8WHnY~$Kp6u@a>|r^^IXJXk>Py
zfI1b^(d0?hmZgpu;)g>;?rXZ<@g!*;NeUmpeFoEXJMgIG2OzB-jVrDQt}XbQ*J3}G
zw>d-PR-EmZHIYG}oi%?a7a274Udf+lmn+#BEIXZ+a6vp-a15ls2+KLN6+~e{2<0Tq
zm3<ikMj*RG2$EdP9BS=-PfPO$A9g@{rbn8DJ)BRytYkMHwa1)C35Db{#&#)uY$q~$
zW?12Q$ulzM8DPip!U3|Rn?ZDZ(W4Qcs9)fGM4M$)4zX8R@&<p?^`VG-Iw}UXtNpJL
z@s0C1)7zyYxfGN6M1&1aMu~_LhCZaaWSkn=j}Jw5J9xO$e)vefJ4Va|QM|cOR}xw2
zT^H}lIuF_erygE|>V*{U1829E_`_~&bmP?AVX?|ZFeanNB6l;Zt5LHaYvWtN6NZRs
zku&d#vaulY9r%A5kENJpZYkoLRVr?ff<G8T^uBXvE-^aI9I#1=d2G7~9}-z}_p5pz
z0%cQ}TO>!PJJ{jMY7~VaL!2c;PC94d{2F}DG{CvU`V`Esl3a9axWj4h%;?)g+>pTE
z{*rdnRyq-+o?Va+DB!;1L_h+qn?U6j4<RSz>G4RY&z*le0%i$bc#@oe?K+dp%AA=A
zEkQd_qpi)xi9E>t)c_WP;IS!V#h&UyI~K5yveS3J-EBk<=&o)=4{!4c;O_0sa!F%{
z&HV_`C6kB*$YbDzI1*1Cn58@^Lj%p=?h~^jmy^2D^Z8+n0fiy8rR@*1*`QMSyC%C1
z^7v@@2!em#9-<Hwr5=qI7kU|ucEos}a7JbYy}<<#i%7GJvnbl&$LaLj*<l0!K0)4;
z$60nflqjsHX@8RC+0iuG-+ykg{oIfB#@)Mjp&6f^P&Yj;Iy4gK<HPLqbT$Hp;w}*t
z3FuGa9C^uR<Ksy@NF0DsD>?`&F3!Yd18fB+f(w7+TtMCJ!NOkdGsay8Q+$x0K}#zy
zVVH%{_Dk-QPVY9h*m#mcXGGUS+UM9eA>y{2P>KzYnrJjQr{EHf1ns4a-;$1wCb0`Q
zZ%8_v!soguyv`@d@DvdA6WpZNKHg1y)|AhLW_~w2q|=g2CHL!q_iob?)}esJ6Y7qn
z3+I2}2`8-66oK=doF~{_6zZZ-IiWhq1WZPlhtD|CkY<G1(e&s@0uq$j9-XChJM!PP
zok!bszs&9w4}$W}6JLXGpu9M6noO#|-w1RY&ha25+i@CY)rhc^!9>_n^abSPU>HK-
zTr0OELtGd5f&5CaqbNBdt|R5Nbh^(RXpDaiyRs{2^%s_BjMwh3(KAj`NB27sYky(b
zOy^O4nq_=u`Lv0QoA?>efnd`g&X`EX(ZToo3?t?xUN@P;w98+2aTwRTXE}4zu3UKz
zm{804B0{5pHi2{}$@P>6o8Mm>iu{Ia6Xgm)ya$H-Ff7lKZMeA#Kl7cpvgM5nuwH*n
zZYpj66&Zcc6t9D5$FYLx`F_(P5Qj;Ui_LEks2Gfuak2o%Gs<TZhl`~+6`C5u)!F0}
zt1U}H`#uxpd70gGoG|nJ{)k~?t*V3-W-Sz9!aAK!KbCOKt>O42uJ~dxL)p<?N{=Pp
zBMBfaIQE2?N#@dMcBivG@=YKlL$QCa&J$aB5oZJ<%Av~9zr@W;%0c2Qr}1lkbC?k8
zo`Nc}`s&c`4u@tY=|gddlCx~cV32~IePPK#*bd7{5GKhm0jLsRI_I2faG0H0as(2m
zI3G+?lNhD!|8(#urIRxWZn}XyU<#ko$($zb@Bh5}bmJf2=DQC>WRffU26ul#-K7a|
z17p4<FF>-{QZ5N8+w59_kXUutt!x@38xU|I&Cqnt2t}6Tr4*%OX?fU$g^VRdLl?6!
zr|}5b)P<yx%+j%2oLCYy1syeX@Q60XqX#wuBYd2{kIu}i!69Q~|49lyiC^6)Q4?wy
z(l-V>J3VP=ZZwZWO`}UDX*_>S|HZm0wW=8S0RwVEe<NMzVbY5Mc;6{I(y3xg(^&w1
zQ_M{m@{~W6T$@MWGEdVHg0Jah+i)xwmvMVgT_R?>6`V-MwhI?)q39R#$E{YYZmUJY
z0HSIINqUJrjifCBnl8WqCl@Z)5S@bkO-uXIaH@9tGq7i3ub;u1L4SWXg9Izk+4h=E
zIzFu2RjU{86`OnACQybRXhxMF`_N4`_-*-|Ve9nsrVLI6Qbw(yt?*SyHu4jIKe|OZ
zOo;5|;<h0x&*0SK>^zwe8(@~9mUm>J>z$V{rwvkhpq~c~@b0(zMGwUa8_o2k230lV
zYO2Tg-tpf0QOxpJ*nEGqI)kW(aNgcmb3KM0skWtiXn#}r0GoCmLM{kptizrg$`aVj
zFT1jptl!;qv;b4?wyUlw#hY5Z-l{uQHq4Y}wz7V?BswP<`-(v5b4FQU84kdKaS}Nd
zhVR^wtgK$WT{K(SfNOl;)$iO1&B?xDZ*`OETw{SH&|ScmILCk41Fum}i0jUJJvS_O
z6a@c?N6pGucjNauViwA$xmN;?11cluHJ!KwE7{EQ=nMhj>=GY^hGm6I@lYEq!HRW}
z$_agUSzLnbgBOW+u<|2surGGbFb|-_C*UR|&q-iy;QUp&COD#Jyc#c-%!1&{>7<KO
z(%8kxFZ+lC=G}kup(rtMT94i*IqVT<KM};3-cg&i;PtNnRm{0Ld5$oLP)~Di6=hx~
zuVi_8?Y8S}4^)bQDhh6D>>Xv>h*Ly~SO?5{R(cCJ>M+DB6}S6}Yo-08{vXq&COOKO
zjQb978|<~62hcDwaAKi@HHD8AeHvW0y#=;7oJx1i@@{`MBND5@jkpm91#;DvY~nrh
z=CLC~Oh?K(+Md{H4cr7=8avgG;&BeVI)2P~2xp9@>J7h+kQDnIE$%_3WDu@>zxCwh
z_I@RbYU_<?jZNWebU~YILA17UcjJrZ-F5oEX#H;I?%g#GHmq$>Y4#&*M3<EQTuX0W
zUH3ZIU8#RZTl>+pmJ)Y?OjE>T<Yv*Oov~><1D0UAysy18CfRT}8wWds$mX&&3fTEU
z(jUeXT~u{<m@+Hrl9AiaM%JJa{mIUagJaqg0stuekT{6~hf3U?VAS-iVPtajD>z`j
ztiba@|G+TN$H&NTX?__?_ruabUT?E>4==h{gi3#9>&1($hu=nPrE+UntikXrx2t5y
zc$3!d@KTN{yw3*1mbUzO@A=DJI2xd=U)j%E(ev{CAT)t)NPA(aS^a%iC@u(1{|J*}
zi1v7t5SfG_M+rpqU;pR-efb&Xm%3ptD{0ds1Ngkfv1;km-RQ2h5hFtj_KA45{wcx@
zNiu&23H8;MFIiY^+ZTbL3FeS4)VvQZXK_1`poMR=-wvH<L4~g0Y6wU7l&j>+0~Ws-
zv^CR!&0I{0%zp)*35=$mP!B!cx_M%X|CstME0Y>*bhnFN=$*@i^&}f6!h?6@S~0Og
zu9uLyH|(HVibGd~_;~3}ps+dueq}6{Eopy?_nD@?;3?KE!_<b!bNNE3vDeO6)1bLo
zVy8y20OP)|JGqP*AjAg=YvQFcnj$!m!Ve@pP2ir+d2iMCk~YP4B#N?d0)|xZby0z8
z3ZWr5TAq34s`_wqbMQq|_6JKXR%cyie1yajFuH&nZq1oALApy-M=W<I$MDsv5j}rr
zo5y&}-a-2hA8im*m2>v%M&vq>H^MaMThAV~pYKIKW$DO?co?<X0Bb;$znMs&<qQ_$
zo*a;Nmf6OZ|I6ogY{*c|^SNP;kUCS65yq>#4AT4kwO#XAQBZa*s()T-9Z1|av^}wz
z#1Cg{B)sg$7*0Eu$}y}(?d+&_EI?vr@vZ@X1sqd!@lp0_C26CL_?5#fQ^xZ^>-IV<
zbXePFMOM9~>Z&PGP;5q8T<Av3D&YhM1w*vXI?1326^9HlFa~%BsbaovPPb+XL|ZA=
z5f5Ejk{c<IZBN9CNQ?~ceV+<J?4sBUE^(D4?bRG&2cXt`hw3RBST7c(`Kb#UER~0U
zEt2oCI30zGH$P*Ndo38#@~k5h3q0~U-k>7@Ipr&XQyw~mc=Q1&s9fEb=bv&j1U6B#
zJZ>-n$tAJiLr#-%o9zm=dypuZx@C*)FhwJ`z1ZmndvMCQ))9O@IBB4z+6KnC{z<jj
zpV1!!+-6p=VbL^BHJ>5dps;qL^;2hmsfOx}$C6t?k{R!_=WH;+?~=}#Q(oqFRo3`I
zoEY*F`{$;|BUW+OEu#)6K^TZw$;PHhGR|@=rv&T}U!(J@T5T?FA;H9*K)U}L<GbIo
z>1<t`YOssF(VQpj=)~#fbSZ+J94IIBL@UOgW-pOo0-ko%@GLpk6Bo=GyoT6+sj1CI
z_S}4k9L5-n+g1N<RS?rc+4UfIOYSQzxFR_(U7m9&P#UVrm4ydHxZf6~WY5Sll)#sU
z9ST_W!+BU0o;d*jmQ@+h@<Vt=c=x{SA9yYpgHl&)*Au!d8qvw@G#1+r3p9q{rz6|9
zOpPAf-=9==Ih9!7820--ATc|CM-fRs)2S$i6G<qdnFg30#v=CuNB9<ZcQ@upbmjV_
zb-;Ix(tpm72%D&1dXyR_s2=FtuY-L+{Iu6~%%6-ey2Kf4%JBf3vtX@_9cG)>35BDG
zj9j}BPz`g4nMjG_hU96EY9*b^4b?8U^+~-hbMwek0GXomLYi#BVH}Bn(O-~^^=i5t
z&+o>Ne&U-nVHXU&BXNhYfhX86jvWEJ4gp6-@kGxR4Z#N};v3nnavUI#+_}@S%*wSO
zUSd8=^i2~*U!I<`u_RISmARtXV75!7aFW5NG+VyxpAmN*lq&*7Gb<9ac~;CiZ2G0k
zW@>4$#uLy6$2<6}4neAaM{E0wuB3Qcb~SQqAV(sTfD8o*o!y-U`{5ok5T7R3B5}7T
zQW&%OxUlDLyKU8+r7DY9CeG_sZA=Ne&#@mNDlK0}E`5!US%TA)I!2*HZP%`OW;8iM
zS@N>J@(i9`O%h2*SA@Af7n48*P7TUO@fK!TwV|3`sD7Z)7kMauNTdcan7BL(mK8o%
z&xPYOgw`pw0TTpmkeO<@aLQ8lT+hS1QpoT0Vyqeh;7}AY2`s%~i&twGGbz_AJYi3V
zEG?uXC=-YQfU|JZnc2GH18X(7QWeRq;IO>eHW<0rV%%{0vW^zFT07CK4GPo-$?4it
z79{-MwaPfbhy~MsG54zR5{f92SNw+W1|P{ls<eo#TVp>_&*!w^frNvrJ#M9=w92W=
zz!f?xqq{T%K2bCwLvd;RA3Z_4`X4=(0eDLsCbT^gs>_9v2AiS6F#yF`cJpx*AI^r^
zEbso5j(&=}NP|r6B;vo#?R26D)Ck;yd)@kJ13eF-+T7fK*jDs1rYKl>A9v4)n?z4I
zj{%VwV%Bjt7yZR2oK!qaGJ^NV@i2aU(XlxBp+tG*236MN%eI4qC*FN6AsfS`@6S%p
zfzc90f(tAaHKU(SlN_7|Z&LeeyML0=dtSm$w7&7@)?NC4>y;>o^6ZFAR)L@UMEiAm
z(G?Yzbu;dNL>v0&p++ny#$6|>ev2FrRX`?jD6lM<bYOP^<Io^EoE;PK&2u0tGx`Fa
zSmmervDMOu-n=PI^4qsE?YF8yy+5!-OdU>nv%CKC6)kc1kO;Ib-PqGi$BOyT1sPvh
zFBEu`dV&NJuEL+GN|r97w{Hy|jwBQ+7q(*|7ePjU_kV0Xed6>hESBaRo2Mc2nkg@_
zZC|En3e(H-zNT7cBQ7i1f`rPJTaUIZOm>G*2dgBPxk}G{4#@H`V-7~KdGY{bNy8Cy
z%Qz`|MyBlxq&nklDnBIFm-FZtv@M%}F%#gVBbAw~Zi{tvhp@)St;zA}p}xn&S|ozS
z#dY9+&h7ijgfe+)a4!x#ZNN^`)S3vzGYa8JhVi4$kHA7Wv2?l0Euy+}<Pm*H29lKC
zmcm6Yz@BK?<p7Lq5=b<-pw6UylU-ffDVueR)VL|NilR{h?_Ra_hb82R;FnC`vOZOU
zCgh+J!Y2mx356)V72rR5i0#vjCxx!i&seU1N%dW^uM0J65azBdVe}8AKVnRFjX$7g
z%;>lM6c9JB*Ea|4Qf<MC;5^ZWAG0qNud&3<W-zvxDf<8xn62F%4MXK!AS$8IyDUGC
znF&ub(Fk(JY>RPWRDdS4NV)vYo2gCw@3YJjvf|((e9|RhZ0nXQ1TYHWIOHV6l4@3e
zBRR!*-~$~cb1bJBhDY4YnSFmyg`JDcw3BBtM_%!{p5Y;2-Y9|q<HMWX5jeb1@9H?}
zY2i*U;*cuI+^72Fj<Hb19ZF<Y)_39FjI8}mwDwJ$_tTLq^uAy$(|P;>_Tn|(9O8^u
z%I1FH_>-k{V$-ozBAm+d6xD#T7{%j%p6Ev5LtNZjon;47ZWZBVf&rUS*)w<o<yzn@
z#}e=gYp0zBeG=_iRJEJ{E9v+D%h5n{ou6bGEliP9=4dn_%yyyX0jy20*%YdbQPA2B
zMNZSJg@M0qW|G%qGfu{R*z#E|tNx(o-p?wifN{j(bL|3SE_`v|-Yi|fjjk(y!wX16
zcrxcF2UFAp0n3vC1gC+dUt!Zqe?~W(^QSSVoj~nm`G>+;2q?X%OAnntS#lxAHl-Pk
zCjd?tc)w6bv1m@UnK?c{MOU+^G2It$Tc0Cs`SG&3S-9WqrA9ewN#n7Duitg=hIP3D
zynSU$_Uxfx<ydn)pQT~y488DwClbyjhG3eRp_RXH+o!Eab36<(ap5!0C{=v<mpcZL
zkNtIGQKSx;Kp^hoTpbHRVWkrR)nv9uo~oauSO@8+-^rf5fA3C}Z7Jp!K*TXdX6p_U
zYerKo(QEPH$F2$*aFsQTSBdF03E4wOmemX#Qd3bl9|iH_5-L0ODReA<?A!Miq5pE2
z0vx10L6{b(9o8w#v1zlMA+0Qga}s=E_Ic)iy!}q}yk=p6`?qBJ7GpKoQxjaNTFdYv
z{JFTM!NgADAbjo2pZS}>sNoeHF1omXk|qjUY0wm$^NG97*UKm|mXF06z?&dGgy!Z#
zK{1py=OCBtM1yzf8%3IbYqRDoue&7fY)DaW&Omwy(o(RsL-?S=CXhJ{E*406Ds9n;
zJ7~39KURLj@{t^Re<Wx#q=Se*J4JMOpg7Qz&2t3?VyM?GaHIGzAI0gAjyX~3hO*r!
z92jt@nQhgn+Cs(H%_D6QWpLOcoCyKGduzF7&I!(%_^~aVlb%L@MiFz~vVbe6Mp2WI
zvO}Z%Fby}J5+m-Yoe#E0vSiQNG_{EJREOjYbWvzIikfLu(8Z{4*EwfEv(WNDBNRx1
zp^hwN-VH>+Ng<A%(aSB^Z8ueVi8$=+qk0#5B8%@D67bGeVizJNUd%u&jNY4dyUmp~
z8U7Hvsp(4B6)og{Jk1j~-@g03U`GWCwIdGgzZfBGu{e}KHI1N=N@a`73hbj=R0|w<
za5ceOOYk>(#dY=Me4LHx&hlshjOU<^U}XTQxxu)evIDMvJWB-tP=9-7QLi65N^4W0
zKLI6F0kmMxz%<D_t;=ILu(~rcfhd@?tnmGX7P%0!pIC%{6}SkXXR*ZhYM%^6LBA<n
z-@FG9eF6WDt2c1SpDf$OC&{Q_*MqR8X|~ZPlg0ha9?qtr1&{{dVUMQjNQ|RjGzzgD
z(QQiE9{GvFV!N>-u4KVHPm<HjE;Ge3i-+c@P^mm{Mx{onucnsJOR2a68$6Ws$O3Kc
zBMB)8GNU_xrBRR;DQO+I0=>mqBJ`;4S-W8QINy=mV%82{0i_hc*C0pzt~T3Utc{l&
z@`OW{K~fES#j_X<9dr?}!{JE;<W-h{0Ztr(Hr+evXeO({X_{HXA$PpQma-Yu&q+h1
z240KU)I=gPWSW7nbS3oc)@X$&9gkQ^CnRT*B*D6WlrDt12At0Q8s`M@B@1U1FR*W}
zYZv)I3#Vvl3#=ifI1JNa#*0lS%$L}CIAurE%Zw=w8Ym!L8k!;GR_&X@=!zK``b8Nb
z-~UR&!%ncGHnfJ!srW9l;m8D4x7GIM-c}XHxny~`uE}RzY(6*rY~$TN+mz3Y_+BiO
z$pg865R&|m*&n~HAwe)*4lHZen!zhN2@i@Gx!k)YdsvCR<%U_VD|pfelpB;4q(cH>
zjdq+WGL_$XbT_Kog^DE-#1S*n3;Gu^Mkn4J92G2bKh|zDp=m;RbS+=T3B_hDFfN-U
zBfXO0_B<Tm_B{e1P4PldURVIw3av%OE^%IeYv_PE?Fx+u9<O@xxXL-Ru2|F9EYGF~
z<_t9hpN2<4wd2i<p>iNJrKGvpmE$6c71xH4CNmN?q$MHJ+?4eXHLOhyBq^H&_civJ
zB0fMbn<V2>b_i5d<Y*dUDEmRc_?DOPgLA(&6EnR5lz|i#pdhcAqDeS6cIcd*sJ(W7
zp|w_|5LHYW6)lJr!3q30mR(7lKC(2H?83^a9UDarPtUiMEo#a#f@AD-M=V<z8L@N;
zDAw~m>X~;JPoCSNrQNB{O-|;u$x}c|G4Ht|?kiDZa4zk1stzK?T8X|vAP}rP5ysi6
zteO!h-y9z%TXaq+OUzgZIDQ)k+%!XfFq}Ydrnx*z`YO|`#7^uJ;BIqwbxH~L9}{hD
zqo7>(U&?-3ymJ=mEA#xM`zpC8Z<ch>o#e6ddFt#I<e9`z*Q>H0L!gcbRI$_`f{f2C
zqS6M>9-uw~U&J3CVrUI%2v_Sh0)tG@$M?Slc5ZGHZsZVKfZnl4ozJl706I~B1zTZP
zP$`+qQ%1+Pd&S$dAd;kGFw^UG)e^D)p|lM1BNXFzq|bNUw1}bf&K-|Sor)_bwEiO&
zb4mIHUA%LrQIcb%D>x-643(I$Gtgl*n-8`h?>vj1?`}UsA9nY4zTbMW9eua`4}M#D
z`t9+<t-o(?@BIDI55w=;d#^TsPConL@plhj@8ui&=i}iw-@n+u_-8gdfARP4cK&nn
zAMGa_{oy~izI$+d{LhnDKRvJP{{88L2VZ=%y>)kI>%sQq>Dl9rZ{qczetP`pM?Y=<
zeRjV0_~G`W(f5DvuRp$<9=>dUyR-h_r&l`{N1qM;l%G`ovi|tw{JTegXWu?P+>N*Y
z{>=}`iwA%I(|3peIR9yyojy4_{okI7@{PN@{p`{5p~(K*s0;q2Y6FX=+<*yHlf0Z%
zU7nVF%JYwP8pu}e!Mxas*6x0B_wE{N(#z8>msv3P?{S#I$6>=Vyv;f;xst#rS1dhT
zgU!k4g!G;^30p59IM76YRu0(JiE}K#jPYZ|WC1+7=U%$U=<U6qvXfDCn+Y<e3eQ{t
z^mjZ-&%o4Czq{znJspI8bL7xYm{|+ytsM-#GLMk5qgALIl2|tC!e`;$S~FwoWPkcC
z_3^vp;vv#U(CN50%GS6sFbc2e0J2XG*L;QyL~1RjV|JFM&Ph&x7Az_yOAY}t#io}}
z%^E!7$pH|K`s!+cW@<qrLUo}zc4*5^_`~!&k?K+4#{{ZbR-|V~ppL?yfjv{W;Bnl4
z#d+HU?fYYPfr=h_?<eMjoGx;KMu5F1d<UEjE_~SYx{ff=O}zhbPLRurK~!k!awnmk
zUdqP!)A7qWazzn;`)HSII!=-aw6n*vi&jkYdUA==mxFv&4ovt_zC!^}Yx)C4&J%0U
zw%zX`J{WDClkA-1b7N5xGpO4T*?=^5C$J5(<z$-lPe$1=JHEhnV+^`@Bv4KVx+}uD
zTon4V{&_bn0;~xcXbDkMt8+kNr%B99=mPM3lCjh<^9KQc1c>d(v)uk{f~l@NoJ}T-
z4Oa94<Twd)tUx>Vy^Ek^P&%95o*DzEe!@|EFGv*N4dlc|j>VJ^?k3aDOcFQkf$i<F
z$$W#t;e0-uGCxLJT{daqJ!Bi~FIE-1mb5z@BvcS51;R<qA`<!l%Y=plK&0&x*J1Ih
zu?>d4bZS9=7P7>`v!G#oI?d@#Hf=>rAJuJN=hj^2VnO3_7*1I~FGREH-)%74`LrEO
zVwc0`3Qu%4ks9%2dOEzVzniAhYX*gzU{srNQ}KTIRImtDcL0l_V{<?<N@T$u<aGL{
z1-Me#<d}A^#DfN%ZBdcHz;3@3#0W9L>Bt#a62WDE<~||aS$dcb0THQZxS>|;ah5xu
zK&J-tYp&+kp<pCUy~<t>ec-HHWH(cWy7&8gpx(?(2UznJ@a|5dB6BmF40&{a^Hb7c
z|1j_HY+v{(Q8uL2wpZ&)k55lidLD0n7WY3piY3R^gow*YhtV`R^im=@u^s8&M*E>4
z9CT`b!CI9%#{ATEx~Ed9%cbOXg|T)z06C}f-uhBd`-{NB#bvF~<Az$H+0jei5=(yK
zL>M2v7I2sdk`&wOC;-qC{yyf|+QXbSzG(9u25Df=h^;a2{K96}X(s4<Obr;oL^q@J
zXfSDHW|<|^+;cOmK7qArprCxN%R>K3QYLSIR<`^zXUCH_&l+K!tps>27Q6DSQ`nPW
z;w0W`s%mfLf#n4=kMFQ~jptmlLtsI7ky!!Z2$b4N5Wk1v#!Udre4?arZcRk!F;U_e
zY;^QY>^*a4jF|sH$~C11lM5C+0B;%U$rM}GOzPN7j$5({SjXl4KU9`yYj!~^UQo+_
zsXVOP(m4~m1UyGYwltt1JfyC*?qn6?#*432A0)GeSrWFzS#h|u9|~(Hc&ekFN6txm
zI%5R=d<bER9dgyAA~eq?Ry}c~-&UjMxsZdEJAvnvgL>aZS35TosZuS@0J{D+YneqH
zTs`al?Z*7u4gYp?{_W<a;-N2|O}f&5d})6#>C821+PJEwjqBF5c~woD{<K+~ln2z^
z#c5e!dV{xKG32nP-}EE~y+m<shX>0Sm||!kXJ`EH5untNW`KV|3zyBP+ne(HXgGtg
zsbT<^?k5(Nm&;P7d<mW>M8PNE7dp2FhwCj>I)O%MLPh5(3_MU4Zz?|notZ>`^`DoG
zIQp5&G@H#x|CfIC&dz#K8~?a}>5tkvPQ(}VvzOOVUlR|hJBP5PT-5bb``wB7tDi-d
zh;vcdN+F$*uhY@=evhka@}r)-c2g7<(1%(im^G^aPnz~bTM1^;x6@CW!9$eP3I1AB
z8(Ne67}zMH3y$RuWz`}};}|l33uiqoDelw&JoPyr;<ANNz4+d|!4o!+zkS<-+fvNl
zaq3^8+_N^#s(_ebmoN{@cASm_j$HB~YYo_etLQ))yj|d-9q0;%3d_V8vpz~t2q>!*
z9kW^6-VU-$Zf~2{JDs<Qxt2gVEl&dtgQ1HfYjlE>c4!cW=2d7$H*Y?F1FWWp9gnuf
z@)y95t8`@ytb!FyE%%D`TC9LB7F&X4V$oepiVgvql!7mJq5fWJ5*LvE6Z7MDLB(+a
zaYGUN27y^W&AsQ4YE%Pr_RAgVp@RZU6vf$OG=nbS8yZ%wlVmtn%QXHJ-qVM`1OsbT
z%1pjDO_q9CN~Py+_)@Na)}mE5@VIk~HTK+`fyiE#9EzV$0=)!rtt<vvwtJ^lb%T^#
zeSTMlu1U&Yw`5zKhXz`S$8sK5MI&)g2_u+t@&xax?217Viba`RDBLx*7B;5-UCK{r
zjBh?3Dt_O2rs$*J0=<R3=CU#Plo6w^*c|v>=J<Hl*9!3Sl-9_9Fh^xjZ1z#vL(<2Y
zU=Q>v#vKNahdB7yO>9Q;L@c~^@u(;-d9JAhH2(#Y-O&7!J9aOa9~xxwbgPKOB1W*I
zHAxg)?-Z!s!SguAuMjgm&Bjeh8%z{b9S-TyY#jLGsZA}mY{Em$Ai^qj=(P;$#zhk8
zj<)d!0ePmw=c9&yJt^ujAX?)qEV~n(L)=MoLk&Gc>`-}blkXXYhSQcD@_8X9n7Z>%
z&3++j9XERt;>Jdwg0o3U*b-W}$h7W@$tHtTdg18=-BwQI`Vc2Q@=}4Psw!>;PO^^m
zH!z#oNF7InuNNO+StAQ^;$!Iani8GKA)GexJP`4;H~ZXwj<;}_|EDTZSeCEsGSIpa
z^>|tg{bmuM#)v?0DhAq@l5fUKQzL7sQaK_Yb2b5w%##>}yQph=picO-JxI>j<;&@x
zd6TfqW6|0jQc2eQ?XY4>l7udIbECFQ{{+|QCY%y|ZkW&;GUf0Jwcjje!2PnBGB65t
zeC%Gmcp-Ox=805(0xOOoQ})Ug^%{I?da7vbhVO&aaV*UT7=2t=(HlAK3bPT4eB-sm
z;){$f(jXcORdY~L|6<!@*%<x4&?6@yOQ3a&W~}rqmWRQ>+Y3HoBqg4v`M2iMfGuZq
zI#^hbhUm7QD$rSPZOhSAgGsqipwteF(ob>nJ&mV-P@L1|8Sw=;QTw4P7XWRq=D;y?
z8>UW!%|rC}uG0m>S4-NzLfVwHTHuS>nsby+a~}aAIiqM9kZaz~#Y;#3Fgcu+O4aR0
z$KC{p3!m>tDqKzpsFvPoA#$C^9L1*@042Ac?e9EzvfX|7{Mk1<k9(dTqiIJ7Y1RMt
zb}MLqUKgO9O#4ppAHHrlcT9jOLe1|_RdIm>sn(7<B1?j%#rTWRC`~1xXWT;y^@>fi
zOco|6?8B<TWN4oHaZDL55!}YdqfF9ACEjM#<>9i-gwL9Du5IQd$if!8)`$@)TnEkV
z_X`n#py!>!rs3l+NNP|Fx+PK8xV#(WxW?*#XqA`eZq4Taj%q>}F(;g0$1c_JaCXdy
zm@riWrj!2cL4IZ1e_ze<ShW1aJM(HXKA;W_FBIJMLVa^GwXS)@ujdA)?|P#c2_~tk
z_|0Cba_$)*75dp&xzTLga4MuwVs`O^4A_SRZW5;m4$}50gNC}f`}X<MZIDU({p9(7
z!>uRX7u%d4+dbXee){~ywmhzD1{mF($@qjw=7i+O!a)E`mFPp=Ft4~@quN2QsDnih
zOjX(Yv3A=IAwR3v#Zht^^WhhKAPJ#6({N=b(z3JB9ZrxCOoE)$^7WZV0TEwtcXBQu
zA*Y`85M8`LwK1s)t%veB96b|K=@_4X|B|zUS<C~Rj;MB)#!KipuERx_XipP8oj@l6
zhGXpKo~H)Xn@{lYOuW;Cn89~9M+}2=DntfSwkV0oSL>MLD?v4dj25U-!By3hK_z*T
zLM2$fI9HCO6+HpdeC*BEOoN0#X+^_^#mMlubLA9r=bj;Iutz)lTiD0X_WxslYv;*5
zW}xiedZbY%3_IW=Q(58Ws6F!$uv+1-MSQJs5(O$OxnWr*1gLsR7ss&rCjwpPjWJOE
zP1EUYngjv24q7jOPVh_{PYx_EL!YIl%*&}j&8i*M06OiT6>O-@lW%rU6BjB3KhS+p
z^%nxoj{WHB9N~VbE)^uIp(H_nUlSd~HySlyHeF~b*-Up5FVIjHT3m=CLA5S?u5~Wc
zYci3S2Mq-<ksU&<4HM|yOiwEt&dg@P@{4wbuWj8(lY}FC<3l>JR6?#V*>|lL{F#nr
zZ%8`hGd9BJ{djDAS#V$l<Bdfbga``8c=Shx{a_%fC+zh*wb(T)VbRlnP=j#(hI2Zu
zVv*Gl1Y%l!tY5`}q6*HtpiI;C^Kd#L{`yZ*kJYO^21{gDwhQ5Yp^wo7#_F9+TNmUb
zbJ<N1KMgLp!#}Gbd|uUEIx^1iU8UkOha2Xp;*2h+W*Q%Qb*QLj0sO!COezVb*-Aq?
z=T5Oh>4XnPbTk`jiaMKrA|KY_5?FiXEFe6Q_X6vSdrKnJok#F_A~6;|2Kk}utpe~|
z^g5aqdy*U{uW`GudP}0!qu#EVC3=oYWNW;H9%%-=vsBX%@&VP@f3Q5rnKMFW38JG&
zbQ$-jFd#*}|9P<0{NLi{zwS2w^5dUA?GZ`mWt6xTj&9P^!A^RAE>zQjMZr5PIz*f?
z%>og4`u0^ikX8M`@<8Is04@iPozseo7yBT^Av|Pq%2509sS;b&IB|)TmI7B_uHZMA
z#9|uk%TSp`t$)I*I)_Lg!IKE)Rrgtjq>RPP;JO!Er;G<Y;%qc3R^&#@(@EJUOP-J1
zC`4tfb-4tb#%h><LBK>r_Vr{#@_Bg<mj{fjcU|FboO7PcB1Yyd2C}w_yu;nisyvVT
zO_|;1x<Cpqu9e}1Spzp^ekGoEEZh7o0Et0I4)23ok*6L*C29<XqS&m3SY*-ZWv%F8
zsQA@Pk4wjKw>y}`M^pC25dV|V@lcfAl~CDj>+uiqX||Mq8;afy1QGa$iBGXatR?Ye
znDTz|VPYYm`GLz)w|urg>uR9_irH=HOw+%shoSzw*D4_dvlbM^DBy;%(F|}{d`Q@l
zi2C}C@YVi4Fl;B@yC-ygAg@PN)Yuv|FA?pqY2m_YVByab5R1IRdwG}<RgbnDV2CD(
zflC^@Nrc9KJ6=3$VR;zT=iO5pGi^2q9kPOwI}&Nx3n)Mg{)%-}sMJ;|KGfU(7%4v3
zRPF+J_+)31`|4(w=y2GS!}Fk9x5=@j4<%l=`2?E#9f$7@DOJ&05jTT-TQW8{YH<-b
zSF>{t!0Xw0E6rbpsM66lvkB-FbCnvuY<CG#Vmc~+Dn^)6_BZ;!(=_h`HZR{4gLwfb
zFZHppet}?*;ob^?G-wS6Zg(U%d^~{_m<=3UTFU7aK<5C6)5O*NRW)Eb=^TW0O3Waj
zZA?StuFFFK9_0Ik*kNL9*awm`ZWLf-HByHoaVAMTY%(ey&kQar7PHyY!$VDJq8&!Q
zc@NlsDcH|5XV-`P`cObOWsAKxG8segE26Lrxd{2bII96o#3}UVh?tc=Nz&>dmBzKx
z87xcRd{qW#;72b`;CxvQXY|$%?13bF4erK#ZYOuSOg9^KPiBX%p5SmgSA0f&c7l2#
z4=kMf!lWMvm>sbUM2vm_`|hC>B%VX)DD16&#6xBiC+>0DEM~!iQv@jmCj;72u}`W!
z^9OIw4DX7R`Yl<xl#LMJWttcE{}dY|(fc4lGQ%VRIDO>quCPYQ$OXNN#l1;FHl#>U
zBXu0Wb$BaJP$2L|m4=ZG2>mgw9;13lGWXy*f`7Vj+yG-=z;y#9h(SD~V#<bqKnEOu
zxR{yw=sR|wJ`mbi%;~}KLd3eV4T^QO6L^ul+zH|D0ID8o+{87raO`-e44apiI}L`8
z5z9UQb#R^>o<MM3j-KANA_Y7`TCQN0=GQt%YlFNuQ9Ig2Qq=tuT*B?>+3e$FxjCe^
zfUbOvHVYYVq8p^V0d<mGK0);~1J7oEH%x7_N@?@UrL=horg-NUNNH1FC8bea@wJoE
z<R{Bh(NKF2IIF9K!^^=j7Ztuw>_VXJ>W*fcPiBsj*?u;Y4Pl#C)Q?OkZbw{%4KniQ
zJ$*h0$<C70f8MKpx>FT3hC(QFW}28*6X*Otxir9^REam64C#|M>z!r+#P)4}wNjBp
zZp>rc`?S_aAV@Qhnpp&QhV}>{UCr~T`iD25iCpY$HTsl_k-$of^}#{(X;4LU?_RWV
zC;IWn=;xmoz1zgQuUKHhJx@|bRAnvG-V?b(iF)HMzg4XO>uymQ$v&>-TGh&tI$Y5I
zjNNQkcs6S2XLJuhCc&s7Y8U%|71ee|XW6Ty`9pHJhj<S<TFsY}l*bu0pAtRD2GQeW
zT5s+1cMn-TL&L8XDr&M@Om*W<l_qc!Eqb?kr&^ERu$q+v&YOshT{;JE1@Z6F^5yw>
z>!*VSr3wvRbaV$)4aaK8u9%;g%8%R>T%X@)@`Y#44G;MqEoQxxb}~JGVv7Z)jjb*G
zE%pn$WnvQf$)(F3MQ@3aL*4pjapCef=>r?<rB^6a68^>uBFm2_33Q>7#8Eg?XJ=s)
z38z{8)~Dqb7rNe`gh=*6&pr;bRnI(c^k>fo#N8^UE`$3);eYT{N$>UYpBSO8w^j+R
zRtc_F39eQNu2u=IRtc_uiV3cQEFogvl9c3`V07u{u-0S~t~uD+xljO9+GG!(G-utg
zeniZ7GCYzptdx;L2ZeOb?{oG*_6n#K6)U^I;^@Qxgoe5Mx0vn4ED%OSEBoF`A>l%5
z1LmfolF%tr)xH?Ag<Kx69w*SR(Rxb&&a|o3G@EK`u8Rta4M^L6GI>x-KpNnT9Q+8l
zkteu-TO?zT>k>HhfOQ62Fc7de1AOc7tmonToW{4j&KkkORUBq19bLiQQUm2wKz4>M
zg7lXWJ5KXs`eeOY85|9#5I{B-2q3q;{ac{qlzL7FoUFq_FFb5|MOZ^lkraJOZB!i>
zDC&@6Vj9T^Ue=X=`S;>$BZlDr@#%Vl{$~UKv)Mv!Ebgl>Y<>+65g>4r7qAhI*y}{S
z<wNeNWqoeQG+x?y4K|2Jy}42L8jEJbC3$C6X`tgTSONv5OXXxHsMpkH91v-~jy~GM
zZS#~08oh$01^TJ-{`PNfu*-w$uCv$YrNXEAF%fXtqz6BL{`l!LM1Ihd-F<O0c+Qyf
zKYmL8Hlj}-(MrzCN>n@@QJH6l^llSJINITOlIGJ4%BSe*h5Yd@J6uG)=e!@>9(Wq=
zbUz2z+wVN`kd0zq2KS<H-6E_MTp3%Ht@6IN^WD=#3hX{M?X`P|LZE+WK!ARsKj?g%
z#zXo`Jfl&6vN*fFsHQ}O`v@fx-Kssf-r$DC2XHPDjf{W>yOddM{ApEgbUXt@cfrw%
zdY{^d;-N)Lyfe*<X@0JISeGu?@AuF?n;|g?Yc2E|V%=D9Vrhw<&3fKhvFHe77#e<c
z)Fd9HlJWjjm5{T>`jUKQf*n^iC@*$vv5o@?^cvBBV9A*s9a;h|oZ1Nbj!&4-eyWRB
z1F5Yq(4s)VqZ11uHknK-m>;1jx1%ivo9BZ8L7$%%lrB*;%DOInllsv)6le7FS=!HN
zi$xEJ$2g2%rB!)N@&rPRFqF?W<Pi=?H#_PcrjzN(UptW<n1*EyL#_#=8=`OCROQdS
z%Kn9a{o#ygX!WfW9d<aZ=4<KBeJXxX%_cNQRXombRex+KVgSs#)Dr(8&je|w`wF>k
zVAi9zIIL6$d{G;!M}q$7MWWd=ZWoLyBbmHbe$s}+Vq2Lf#v`hH@`+3`Ee6aC_b~W+
zMYFGAHf*teVC%KSf1bzeVlwP=!d1m96-4BJ+NYT2dNrt_%Bk)^Eot5_sP$H>8gXl%
z(iBFY4#U=_nvIEPEtwi-$Gt#N7D3bHjNs8xTko*EErq#IQNa~OYtJ&P>muP$^||k&
zTWj*^SH<za2vIue!~fBn`}BYGI#5sY-#Yf&(NTg9aJ=d3z`x!NjeU0RMV}_4v(^uP
zPrEPoxA&fHJ>9N&ZQwW^C!mA+O&<NM@_G*Ey!+Amt3%)y;35>8uMpy&ZQ_S{hh{n*
z1y!<Nq^N`(kTDcSz6332Ohs@>G&m5k5$*r|NeX=8?brQ8^FFfE1Flph(TCaVme#QY
z&LD|%-VcWpYr!BsgK=Rr0!hyaQAUb?O$oy+zBpvCVpfL0JhrvF({YnGnsrHLOGY`4
zv{QfDwvWeYD*#bqJ4IX1f&EL<gio}Vil&d^d*h7+J(KLz(G87h<~V2s7vyw#V(~iB
zr=qX%ouNnm$6K2aPAJS#bt&R{;|c3MF@=A<#(6E7K;_(;uW-QOOc3Xkvmi=;&-l79
zs5AlNV*MK8kfsnZ96Az*0@8BKUON|f7Q|qTg?pbqoO5&db5~1rwM6KGq7>U{7@QA}
zij16xV#IL-w+di6X<@Q>6h7HRY(9+#+0jwTD9KAu+pas2_1~2@vqy`FN5_e1&ZJ+Q
z>@Hz!1b%6(7~hLQ;|14Wb=DGp*Iv864H&kEeeaXOcoi(?LSeP3B==)LX9PgRE|_9q
znNV6@0xmFsY9X8B0pC^~FTfvNhizPLgNd&3HTaU~t>NgeoW)np;ss~%TL)X}Q{gq4
zp^nKd)&e!t%At7WQ2a|d6yHMKk+ACO5P|JUU(RjJU*7kadA)Rj?=ic7vxqQU7X5`4
zlSM3_3eE7KrgcsC7ikXOShD-6h^_I+4b>qSnu5MV`h-G0L=jayw^A^@iz2N#8=Jk9
zZ$MGax*UpHx6ueL>OE78A5w2b;)O*S<VMS!GEaSxdRvcXxfxBh-$rPnM_K=s2V?;>
z8+2Dp-9YaGQ{O~jxScM4fe}H8yuXeVJgg8@nlYp?JK^B^F&znK26cFDX6X)KHK%gm
zSP<saGA?{j%=8n+4I)xMi-$oPcZca{3JP-*fba02G)8Bhgm}r*t)KbL*t;F&v<4)f
zL|?OY{ytWDlucuoF<s%7`S1qdCqHF}Vg-&y`A?FRhU;n2A|-TxR7sYjt7nwi%;)%r
zan9vIGaWVU71i12JcPm?`BlrrJ^U1u6p-%>F<;q&Kc1s<%&)qL)R=~Z81k=O5-awg
z3Q|PMNL;p3uA6bz#Fy;QA1a3eH;8%w9TnKMUYL}YkB?nV=4kI`S8%wYLJDKr^$djA
z%XA8WF2f`<s$C9$jYfy{=qNDj*H<3<E06t^$NtJ=f90|N@jUh)-u^h=`F$L%F${C1
z7T(Jj|KQ<mfACnN);dk0-^z#^hRQD)HD@_>aym+^5A7+{)Xa{W`V(6ie0{y_KY+TO
z_ka`@2flsR{=?gF;afTW|GPW>cXY$}%pk<+a$<2wQ42_aRERWjbmz`^c1V)^ojaOC
zGI|OI|5W^)mF*->d<X`kR?bZ;kHLo%Q5z<-*wa<eK|@W{*A6-Wp7OGwgFy5sN_~R8
znd1~*o=fJ7u7F$?_P-*CDxxlgBSpd-riYVwqA7-$IdQuvbjE<$KG$(-_0en$b)ID9
z3~n~QFA80MH`))rcc@#rfCB`-1Oa^=$LCO8gyFvc^uc9rp2XUV-HY8FpKVExpCxx_
zNGgUP-Ji+`rm4xwR(DOIYABv1(Lz7VZRZqv|2y>>Z%g{!!p*XB4PUv2uUx}duHh@!
z@Re)$$~FAsxrQ$l?Fwb|4i0>0AKt#c&+N4vW&3%5<@O}1j%J)8=3Cs7B)SlR-)OCW
z)>^MtDxz1|zaaMH^sB<J){}JfPkZD({i;$CDM4nqBA!nobePETh`RIw0HKgQYUY$H
zDGYyrXG_D3D(B+WR_%)~AKZyfXu~~YBkGHjNs<G9kV<@hx6Tcjqg4deWlq;$i~TeK
zJ5v*X7qW)<klm`*)xl~>;eRm1CBlhE;%*~m;o)qe;vE*YQ>ev_WR#p^99!(edM_AQ
ziy9)Sx<&;KVDabiy{)%iWL&lu)&}hxn5WtqGC_mo39GHUa(>8*NAhWv%H*wG>v^sI
z7QMC)-uf2N(1f-)ov?fC;JC*>YC&nNfE0OuW<Hhjv-ONdSzB*J>vz{LpV?2VQmvZ8
zJJFl4!nX@%RN^)zeznl}{e`>XuTk||daU)|sz#lt`ox*uZ&m$hT)lsyJr>pCK3pdQ
z<>1uS>0%!0!RPa1vkHS5i`s2>I+&B>oTa0}q}xLpAI`--{n>(0@iZNgG?Lf;a<~3}
z)ul7~LMx!jw7Oc>sIGTqQGdKQf?NcHys*;FZ+3lS^YRWnv$d2@XhZXUU(mMOho$y(
zsX<L<$lFRQ0yyHNx}@uzL(lS&^^?MU^1FME&a_@m`*ex6wg!VoB<0nbn^#OHKBTdr
zn({Q-XX>MeBJwZ{P4=z=#=lqs7176kl&q>gKg(g!+opm9RTqp_%(v}C(3Hh|Byu>X
zs5lW6W=@)z1S*yu2yBmqq!)7$18l>^ZK8Lpz=E!~BH^>-;)7T1`)gbLeN8QFSPOKO
zBMHjj{rCh(2Jn#JT=Zd1W971$!3<RBw5b?N8NS=z0vk*TO{3#BRH%dRiCq4FoInSj
z1)SfNiZHq>^hnUH0BRUP>u@)Soo?uY>jtIb1dlM{F!-|PKAhga5?PaQ(Tu?ji-E8P
z^C7BMpF8hA0wdcku!*~-3{jEI!!VnO^lbJxp^fw(Pz+j%$bymGB}-JD$ut|ga4=S@
zEDElWOt9DFCxW+Iw6;%aHSqd>i`IJUZq+3Vg=_aH@axG8ah%<dt#=HjhAz6JL+s5+
z9ejzD&tO^5<iWoi-^!K$-oKOoo(KZodoPp)mVHrOdG)Ql`hEqkKDIZSH($6>-OK84
z%dM{jDSDWWSm%qLUJpw2bOj~4a!gt|CaoNkR*p&k_Kr#FLi<silf<8Y7|uxxT6uQ|
zr3un%VtHe_wYcJ9V45_`eoA%k%p7_@k2v!d5`mbROOUu5EI#k+rhA+<qTO$I8{+y*
zv$+5FC#_$_>)ZQI3^^r0=(PRlGN<hWjZ|pSPJz$!;tgrjprTVC%5%;JwdbmTHuUui
zoW3m+jRr${AMU7j6Cdt>y3gG=b*|&r@){?$Oq$N)BNqcnotn&YNoq6@S_mrQ2y20=
zKOAPWL6}3DoyHCpdjBut?f%@AomX~HVYLF#C!Iey^Pak!*DtLq&bvyCgAkLIW84Z6
zcjcURGelfDPag~wS8jj47?jk+^OTr}b|a8nBdhUnOf__bSEA>CAj{P`s#^^dy+$*=
zbhPtqpAL9HMj6kk;aj1(Lhd>tq+<0x%mx=ylVgGTTcWvbk~7;HadqzQqsehj71Apr
z8(11vlS!^c08jycs@0;o75pp&C9`k^w5)mTD<VG;rvlA#q{rlZ+CN7ph>&TnYtGq>
z6$~uNxdbzAcl&{V>2=iL(oDh!??}R1tht2&LIQ^-9Q5S3lUo4sJLBD>J1{~jw*G})
zhD`u2xSk2W8?Xzf(CgCs;#H|PR>}qiW#;Tkqmw=x=dAl{Mc&2Dq0>NsU2s*)fL73}
zEC0Hcf8ENzZslLM@~?CLbt?zE-v{>UB5{5R9Ba|h?vb*8Ex$Mn>x!|xg0byUK}MAN
ziM<#!nY>6CW=7zf!y7FI4)oAF!047O<dsx7S5xD#SUef1R%?`K6bc=NB6g3Yt96*T
ztUtR})PF;R-}7n7I?MBa=Z>gz=!z5YtW#ET`K6=lOjfQFEb%1Erbis2HJ-8WhcO_2
zVf!a2BupNE@qyR@;WGDhodIJxqO+AwO@AvoCFT-Gtd4613OAqEdC^wreYy_p$WJ%u
zfB)<M_<v%33d*mBX1f>d`<x;SHh!@EJQ{l2Qz3=MqYeNFj#ARR$_c!36Z!86^R(zX
zTaNq`x`yn-?XZwZ_xI#paof4O{P%Kk`L_gvTC|COSNKrBS$wFKW68>~WaU`0ax7Un
zmV6|~lE>M{aVj~^;80Sk{k_m`9%rj8vn!jrg3Zvzx)N-rAQG-j@i#TaA7>vjIV~;N
zf@HKrB@{%3%8cNIrob?@$|qHTR)G#xE5wgu9eG7-$dD>bZ9S?X2}DCugd)r7C&Ukp
z`FGTR5k&mf<7A3Y>WJRU6VBZ5c>9G*AF9;XsZ(F>J*j+>9&r`7?nR??h-yF4c)KGK
z2NJ2Ds*~g??q=m)G@`Jm(|_^1$|r9tpA2vzf&m`49%O@y*25vKN{zecH3T@L!%Wo<
zD4PM}pOt7FXePc&s_c*k^Gf9t*QZDl!O9+gNWof6&lCD?<L+JV(#Bu@($FkD$BE=X
z$a&b@FQ0NYx_^(q`Qsnw-h6!zwS<$ynK&?G80RIOK^)oT9U5eb6yu&%O0$m^R(V)g
z&HyWCfR!`A${Aqg46p**S@{C|c6|XPA4>qZbDS+V{6EfaVDx{SUCZQuDUW@0I<3-w
zKa;%QO0)JqXW2BVGV6BE4OWBvQKklH4&%ez|2oc^v|;HQV>X?>bP0D@C{xz0<`mm+
z-WtCiGWD-5NnJFOv`0eq!CrooWv0aLL2Bw$kFu=VtGul*tQDWos9L+o{xuvGVRwkt
zDZG@%TGT}81<yq5`FL8Z*Lgn98c`R2G6l~Igo^J~w_B^uB|<|hI_}qHcJ)eZjvnTt
z_e-F2oEFeIc*#}}9si9XI-1eWh@++433Z$7s-qg_Bz4fOBM-)k8Xc7qa$p%pQ`zCB
zh*TYcU}O-tQ1M2U_b{Xot5W$O_L534MTJl>WuDWCM`OjBnV<Tgn8{Xm0ySHIa4X@X
zj%k2-C1gvmg3zfDoyOGQz6lae(#A<-7Yq~nUt+{(BgxY$O962&(X11G^((x@xDat8
zX!me2I?i7%4Ca$egm)>=8ni<$h~k_}%k*7^FD2P>B-o!PD*B`bwq_=YkCZx=oo|xB
zovNHe_F8vc;nrc73#Uu68z|I&CW+pGE{1*1CV8aSN%V&txm{ys2m=DY^8Z=+|NQs!
z|JijctatY*a<MBwm=z$*FYVcL!h~3SHK<L$N#V{@+@8N-RG1mmE!gmnv+JS49Ia4c
zR?a&s=be@F&dPb`-`;uWKWLYI9QU1{sAf3u%(d`-39C?D5d{Vf2?k7mS#c_5Tilf{
zGNY8!Pocmn0oBSU$b5o$uf9VHs?$X&s5mbbL&^WQ_Z<3t<_}`B;67csG^|`2RxS-I
zmxh%~!^)*$<<jtxT^g2f=A{zz`GfHE17{FoIi=lJfF?E>bm%t;6s_YdJ02!2?6%f1
z{08`cHd<e{{$eG>xnY8TV|O?q>euPhIgBql>&ORiy+ReuEhJfom}^8voMOfydAZBX
zu_nwR0&#{7u`iwtxVOG4yg&jJBEgz|q}}FBA$)ISlQ5}~)LIMbY1p^*AUO|ayu~Jl
zdqHFF4P=~q(w<}!(ab!>aXdf#3HmLzomsbbCn@m|bgxw`ZA;vL;6I6|(PlhsSV8$%
zGOj=>fLaT@CO`Ow3lHRnHlwe?ky%|&*kRefJ@_#?vUktuyiDSh88N7U;`|oBs>@_N
z#u{KNXp$lPc8QPZ^T!D+;i{OcxD+|WZexaiV9tr8radhJ_YY{nxIo_Kf4X-qRg0#o
zB8i|iHh+{CDAI|4s?ndM)}ZZ&CavmL$#^38tv(R}OS`U1ABi3F-o2<=tt0)=7A;wV
zyhE}ZYP`7g$!s{p`^~%b3fsdsyq`dJHZxqIb<iJ3CgEEABz?dvwx-#CpcB%uONQ;5
z7;tqm0YAw%){U3Y+Vbftt}S3bbj<ebO|^McZA8_<BtFi6M)Vi=>FrlxH`O?NkB$!N
zY|;O(p(^dAT6d+?R~5;j;~aHZnsgaSB$Z86IP9RN#q&|}-Dy?!)T|Cy63}VoL!o6K
zMLpT)JuoG`vn(Bun6)*!00oc}6@j|>kLN;d=|(zBCTb<N+K5=Ma`mhnf!;G$&%r~Y
zZh0DFHWSf*YxeaioCWJ2HI>hji=Ab$ok53~<n)L*@DBa0hS3jo?SlY>qS3+A_$(Ru
zc{s(-Ry>9ct(8rV+puak)4VA!PNt_r<(YTRF8pV7`ofRWvx|1!hi6G9XCO`N>iy5H
z!mWT!dvq05o)d%5t{p@mh)`~e2oNA4H=La5bPbMwov`YBd%}wzh`&ldi5BQboIZ2?
z%WkUWoX#Z>f_*RRQS*MZ=YHaswA^#@!E1>h+f@$L!7lgth^r}M(MP;<0?;4UGb`p4
zUKyv%l=}p_tX}JMqg||HK)b0g=grwMZLh1;EX;ABt|87Fd#n+irVuEVk@lf=2pY?k
zst{X$Fyx%%r4-{TMoVAV(mPD(tgGf_!9d0Sa+;kbaLw3OzqwLDoijNy^rZ5&y}wWN
z;cM;qeZKDW*L`LDzD@`CPcNFfKbjcL*KK-cuOV-Mf4DD}hbDf1-F8o{7(B6%Ne^|2
zjkGz<UL~Wi+wP6D-uBJg-_l89`Y~SXrTz?myQzIFbT8b=_Z=_mA79)L@={(gRvGVP
zc)xhWRX$<sgu;R4Gy_!5x7VI;FnH$rMzi6E<$lQciHgx(zgwJz!b3j+#m8J%`SY*a
zehd8Ge9~5KW&ciYWu``$rCqiHUXpgq^a(3Jvz4FOuaJ1mb}Br}{8kNK{w`9FfoXAn
zTnRhHFsHQ2MYi%fTX~(Wyv|l$XDhF>Yk8gRe!Kf|oX*B4WB8nv>whnoGpch18?|x~
zQx`GX4J+KJo8v|$H^GgfIbIGN6<GC)whY10&T)ji-fYpi`J$^qr{(-@bZtYip0F!`
zk5WCH#H@)-)kVN>fza?wv&gDMjMRdET4!U3{PCF)?I5(X*monGU>b+I5lia7sfa}R
zI6j9o6Y}9dWrvFGE)Hedi`|ReooH-|dObWi^P)dbMkMn~&tl7}becHfttj^58XST*
zi(svvIj6PqXSwa2LhqG)UK{EQGrR!ntMc_<nZUQ(s@Dv>2kDtv2b?tk(hXaGs$f`x
z!pKd=G&75ZUa5UyHz%l@t7oG@M}Lw8n2}W3)_?!D+4_R5`-})iq;Q<H<)0?^&j&@b
znH$0XyIDRxCcgQf!{}4CZqu`PGKnvuPY?B{8cRRzH!7dN2>$6Hx)-f)Y|>8!FZdMp
z<7xrBze;b#O#bN+z1(blj@p2KX%>BYOb-}Qs}hEyemeNdVog^dRV$Cql}G2wqjTla
zx$@{-d33HkI^PSV>SP=sR6%AgdvwyXd52DB^{<Ur1@7uPKAkAH;uSwAuebu9TKSv(
zCjHHdXHq@NXa{mfbi3#g?dd6J`CEO?+%Y$QvsRHzyR#2ZThkIOrZS#?3@oJqzfS`2
zyYm8ZTTk{AGrQ8S!vwS{XMYI1wDZIyBxt<gZ=qI8@u#pEl}pROt{nOCQd2fso4V{Z
z=3|x&S^Uz?0wM4M2EvxxP{r+V$y(NBRaPKOD{q-=ddnz_<`I}2m$tP0%425bG4m^V
z%;;`~!;IUf{?%{HU1sHfF0yhLS-Fd>+(lOIA|J(Fgn{`!lE(<w%}yipt-P1th}8Fc
zbRFU472in#wPBX-fOY2Oz?1@T;(XN4=iRVyH>Jy*3$GkiKDMKZZs(P+%18E9x%il_
zD%UwbH*sAlY>H*xE7NS;9D*=>3_liJo9>&?iAD8nv22i{4vr;%=|GjTu$RAYADK$!
z0Qbalmd!4&_8&Gj=>KSIY~H0?u9+unu^UaBw5f&{L>-!FwK*D2Up1v{{ra9ax<M8=
z-;6IRw{>4}1`ESQM>`chZ1}6?x?`Jg-yVSW(F#s4w$RUiC6fw&01GpO_*(UhM6F48
zn7mGDsUhHzpe|~Euqnw^9Vkzs2Kyl+3HI5O7vBl%CMlzl`I%VmTh)3ejLcu&c&*+V
zXG1z2(+eUnbii|NrM}7vw{o~yIozxqZdMLAD~FqZSBD!p(xTpHA*`HE=GMw1=XaPk
zP97{z9VhQ^;*KM_lWTe8NKxepv%FGZB`dex9O-lDc0=BOyj8i)st+dQ=%9p?j*hac
zbU;p)S}aJRZMzuw%DosT0}tQD_iiSZJ%&*tX+CC`ltJ2`R&I~Iss5fk@?0x3qNA*<
z1eqCF!5_OlIP66JQ+bG6^Ir8CF~37<;Q_UO7{5xZ@{*?D-e()~cXs$whufki-&9Ei
z8dW<{6%X=%>RTx??1=bvFFL4Z6QEq-XMU^tqav%(igi0QIEZTZ<loxedZR+@vth`M
zrnRGLaOg$ci_T-Vq7D1l0SS9cF$+#p@&-eATdfB*RPhmHotTD&R$49U4Kuzpj7Bu1
z|4T+S?oYigZQlm>PGT$F(#|;1@JrH=Y*nFl^E}9Z8pc&jCl?(Du^~2%$TII8CsSwi
z09Qb$zgV1l4<9A3K}Hr-Qhk=$j|=+$bdu+)h;CI2lL!)KEwb)l?u%Y0dLw^f`g9h6
zBd4Z(5G5um-moMxCN6#2qE5tAn$IXJvJ+r}lM2EK;3qX1>L@vPCEjpq#7^|t##^{O
z1Yc9j&!BBie~^^iKQGpBz@PsZ{pnt`&Tpi}+_mURx=|h_@Bm>Ln%7gm;QW@2xA%x#
zw35+TIw9gkeXmu2c-norzrFWt>*;ni+%u5)n22&jdI)Xi;ODf|n<}y9%yd@;<F3WO
zYjh1)(I`C?Cbi0)MIr0>${%j!5BD2L#OSVMk21D<e=(q40uaFmah^OS?rhle`XpS2
zt+5v2>rt7?-rpcgGa%u7apo9+Hn!OoZQ@1Sl_p{?P-XfHvkw(1iRX|zVdqtyWE?z)
z#L9Q9D%)JIVPzb$9^D!U7!OwK3eU%?W7&nCQ4>5x_Jk0_cc_UJNl%4-^8{%{&m>PQ
zw@YpHf1az@-=n_)589Jm(0h~uVv)xq`e2!HM%7}xH5&oLV_4^{nD<kdvA%JBjUunD
z57%PBbegJnQqtO&)TOM=4W@+^AY#Z1r)JsA$jXRol)9|RVuqX?&%A9X<J#Pq<TZW8
ziWqrm)7xO|)k;PBwlx^g&7RlXr>elCo+XL!e@y(lpH46QuYaXuHm-MEtq1h#N4hI;
zM_Ju4xy)4zYVRu|PNV~)sr-<>BzcFsc%XelwFf^2j2*6q4%c4PHX6J11_c-@_bu}}
z`hfm=Tb0}6kv~Hs8o3MnJih46&2w<%Y&PAaO2zLP9rr_4a!J=th|BcD#iu-88q$|{
zf4{uT4+qKN?6@O-p!cG0NWM*i!HUMLqm`BitiB*>JAWgETWIuc$9|zv8~BwuU=K=3
zU>8|MHoEdISL?0*gl^$?nlpBlw)H*JwvI3Sj&&!TH>=7a-}+pCt?2m)?4fJoyZYws
zU!%t$Hejx9Ra=4~%C*$NAnOd__sS9ae;0CuUbLE!y{L6qcvhazE6?ZmO+P!Y4TB#i
zog1cE*qeRUZ$2OKrOZl9_VpPAm}NBlW8%=%S5wWtTq31~gwdH%4-^%aspGZ0NyKP#
z!e>!sOY=^lVQ!7YIfs?pvD|j9d$Dy&DiPzC+^yUlpN2eCh&e0H$c;jr-Lx(Nf4zlQ
z@+j0wsurI9@6{+fAF)@<d3g?(UySQrSGXJJO#KTg{+G6I|7PWS)N86FR<$*EC7X~i
zfOEhn#~mT&-TyX?^H)8lzVwHCNrK5XCXOG9voi|{>f*uP0%}oY6B&C*%M_)jiRiW=
zvNO9elulX~>4@Z*SU5{g&yz%&e<rC;5MaeLnJd~{ln=A1B(8(2kxkh`uc~WI-g(?_
z%06nYi#c|2t!$cwTYfT)(;<xv0Kh9p|COWvZz=`zJc<4dx%}_bX(ke{g1aHe`yPt6
zN%m&oFQnyhpPloP4bxYNT@XiX6W2j3!nY4}SRInSH`nhr_@8z8XM?TkfB0*&AVl7l
zx0MQ;Fuut$;-w%GdM=BYs!xuxtfMch^iS1A0n!WOd~cTqtl`phy7JQMU_5N3u~}d6
zN#Gv^AB(=8-FO-XViP;l_Xnp4=U*CQC%S)cvxR|%0}BLJ6$5yG=s-~ZPb!_3YrDs_
zweDQ2J~3IjI<3b`s^*Tae>c9S|NZQS-Cf7*(7&5rrp}W^v&%fk?)Gl<*=KjXW^bH~
z3z|Lp-MmXB+I9GLPvh5;mPAdHyo7Wr`YC5tp-V3tvWI<nBZLbB5~~MNe9nS>>sf}t
zc%<Pi=jOm@;vW0oafrj1z9yCrVGg`$beMhX#!<rTa?WlgNQI&te@U9>GjV|I6T1tB
z%DnKvNWoWt`0VtI=&;Xyki)JM9S^fZ;<0UfhZoLy$j;@?v;7xa&mL}fcmMI?+vm@^
z-*4~j?>v7N9jLW}-QY}#u-wVv&)uNBS2~nDN!Zh0?pu`O>niXloX~xOev8)=R=)Z~
zq8Ro$#-hreMi?P6e<5eYQZ4CxFG^0wG|2|6n~sRn#9dRY&002ni|~@{{}4obKpGh(
z=fevhO5yyGF%Tn?1N7h0L%11tz`i-8A=waofjIX}wn$PTxpllrOwIH0fK4g<Sv++o
z!%ds^&~ex(BzGaayn;@%F#xkR%I3})-&?**;W4!Vu*$}Jf95nGsgEE`%hg^QHf&cc
zt`8($Wsn{n(J&DGGJ<^kNH-u>gRk#w5`<0U4Xs#hNTMkUC%&jF&WSl<#e;Z2VK!x#
zor*UNW_T1VRB7D{LyU8EQylqo!`qIgZLS84^C+8*)a`BQ>WjXM-qMojf?b}&B&uz1
z*Htd(oEr!Gf13g>eLYZVV%H~h@Q2>VgQ#RYVkdqHsS_cAm$XO(7h-1@0kidkYe8lo
ztst{kF_5bm$W;vFDhBf3J_d5{<Ags>;QzMw;es9y_WXfErzTAjBmh;zq6Vh)P5Vx?
zJ0w~9gq^lKumIDLPl>alHZq=uJx9Y>BJc<7PWvq?f2dUWuT|XOM~EBTE3oJnVbI{5
zLz9cF$mLb^b<@41{<Z48Uo4;yq$U4v5KlPyaN&g4Cjz&_51UdQ=#P&rthm@huv;!*
z&a44@<-p~hdJEO+lAKhv1NezP=Z(tZ*uz3-@wLMaC1)Oe;pAant%rMC&l;8AFwXVf
zqCmSzf5qmG2<fEmeqrwpQ}&#kJ8QEETsNwY)uDe6Q&I2G`d1rt!tz`)G>1ARYxq`G
z5<SyA(v;IOP~DHWU!d9s-2>qC@3BL1&DW!UiPJ8>Q@<TL8#(J2@dvYiHLJHS-p7a8
z02ONLLHCx`)zm@W5QC}~4tl;vn+QA!)Ir09e}&o^yK{iiynxSbJ%B6x{RQw@{N8*(
z-d^NsXsbPGI!m^|;<&fJuaLX<ieaPG{sp4gsFhzYj_remB+@88Qcz+gDuyLq9<=rw
z3Ct65{yjqTe*NG(7QEjr{B9LFw~CxwMb6Dd&h16pwyo)cRS`|ES9vp!UcGmNV7a|(
zf5pjp=C41AFS3zm{|4jXMZgXIE6c9O8WOR44Ni)^vpk9@$CU|RwZSm3e7h@`x88_0
z8qp?mU`N9k*sw45UT#-}OT5i~Ic}JUl7L?qzd4I1XuTX`b$WrH99o4)o!rWpT2#x}
zPl@Uo9HH1WJwzqief-nVelz#=n*Mk#e{P!W5K3RrcYnD5hX{(bX;M2@*G?)2FNH*1
zL5U|;4^QXfS(|2vEvQLN4VE#wv(aJpTE}0nFGR!k+KTs+l|OcTkZZ293KUurDD)_V
z*e!+$u_C}tmW6|a;S@pqP%GLO<X$~(xyc&}=quWVMr7`h<znLg=!)S`w$C{0fBan0
z@V@5I82c!h_Cq~;(NXoCK)A2%rOvuIPwoEQozo}tRN1I8PoPTQ;;FuXNHwDBE$^Z(
zckCX?>~$sUMwN)O*kXAYTdZgUbM~i7#gi-c)!`33HUBVy5quH9zg<j~_pC2zrX#&-
zycg%YD@^Prd(5sLHlB)$^IdR<f6d1U2Q}C@;N^)uYXDen0cyue4Gy~^3NO0+T;&!O
zZq>_z&d0~fE(jb)DjF_JmG58V2$ZFl<yhHBA_K<IB+nQ8;rZTo`@35YHL5mH>R9lz
z{2_`N8V}-p5ch5)`xFlvVdyT4$Px+c8ouZM4plb)wqX?&HSq^|O0FGSf5CxL^Pv@$
zAhhCA8ni-@U&T@^i=}v6R<*2u)}71_FG5M*Eg6a0A}tlxcLg86@+$vDy~=+>4&skO
zQ<k@>fdMO6xp<xm=Bxo-$$dxJLQ@)>2FtdzxtJWs%sIQ58tfL>$F9plEm1=pAJf^I
zZY*N4pit<R3{y%@Tm9^me{lp_{rs#NY8B8t-+JG^c(Kb@7~RkL0@IY$u58jShrF}=
zV<mG_YM@gzT$b&Z*_^;!RqI+AI>O`Ro^Tzse(887=%htu1K$4O{vQlhhxS43R+_g)
zagBw@dfmMh^?aHqwNsLlx`I>!Ls~qtvK3diaYaRM&B8wEu)o_Re^=+JtM`d>ug>GM
z@Q$T=_GG6l*dS4j_x@&c5MM+uUOZu^Lv{(wCeH6QuTvd6nkgyFoCZ@xJaMjy5=NFy
zF5s>vPr{>sD&c9EOuR3zL>+veOb#=SD1helLEuX}A?}qV(kVz;DyRz_#6O4zV)nJY
z9|Fv_q8FK%t$4^>f3?=ZOOA+m@NNyg(0jMFR4;I4H+FQIu{kd|f_A9vtIB&wDE~mU
ztaAoe5-`gpH`6^g&=6GjI&P+?D>u`Xo9W8U^xx6V^uMi_X})qZeK$8#tVTO}Jc-9A
ze}D3kd`_v2?lD^UCqqA8(&l^mqEf~FV4_(f74bN2jgo1*e;)lYI?y(KA?=p)R{h=O
z?pS5h_`qJVtCSctn(Rg{taQ+pd$Gcflt3+YeJ@GShXsz3Bo`*H1ud58V=;9mr!i%v
z9vhtRMe%t|JSoFX*4FI2gBp;?5YrhEsq}2Ut>Io0uDaGhJ)fK;NKTM<_{S$(Gn$f#
z7U@L22MJBee<b=E+(p-_>rS&*$>@HsfiKn`is0D<6yaJYTBH3r1QDPL+E~&xD)qMV
z$=mu@F6^4R-NLI{{i}fOU*YtxaQas`{VSaQ6;A)Zy|-a&<xKd|oC(Wl`c6`CaQY@H
z;5J=*7%UTt{{6{XT{M^AUgrD;nM1m^>)>@92Z<SKf42q7g8m3?oK)BA3nN}Cr?%Vj
z6l_q9SlM=)aY6;Jw%v}TB6lLe@*U1b^GFFUNG2QEH=?V{L$Ml6;&7NS=Z@Ohq$#-H
z9B)Gh8n-GmbOr?~q8)Z?3}FcBk6huE4O}Lu#ocTyhfDyfbBJ*$Oy(W7Sn<U2ma3ZA
z+7#f>e`@72Mp9R&%e$jvu37h@P0`TOc&eLKyWk5s+OYu(U$a(JCk3M91oywNM10PH
z;^FiNFL$W+WejZ37+5ffV;@f00_HC2VrF)l4YIub>6=0)-u4>Y@hI|4ZBz~UQ=}6p
z^QYB_QwxAUb?`Jr230szX4b=f14}#rd=4Jae+EMB`<`K47Zs(D#)TAJhKu9KBC73T
zm>DofBcKHhJz3y0uMd4&yt8<_9OTmh?F}#QC!^MR`YJty&V+@2{Axe!?h5W56mM<$
zrgc(}{v$q%_e}|<dro$sgbOi~Lh@FBIAc+J?w#aG8=ra`iKxwna&~n0(?wA5J>X_$
ze{jx{O}w?cb2%*TH209Wuj^(OVH}V~^b?#^XROE;y0PSxthL%sy)(_%JbrJ_5s02{
zA%XEdH*er*Nt~iW@;h9-HK~Ov=V@3Y60_#^4n(MdU3oC+BtQqTBna9rkpf5RBy5jI
z2Ra+Be~tE@T+M@|4@$3=n*_-z#PD&>e-5;Q4?L9XCsnCaySav<Boy;S!}~GX+unbn
z&IBUKUZAJM+5l27df+IgsW5s*qHW@!-INXPt=5O)B;g@h;7&3d#*=VFf%ZlWbk5bc
z+(canD`X`#+IjU;cvvfkbnPCc#(%|zVV@iwrG4zBNLip34mpz?Y4Gb33A*2le_rlA
z@k(>rt(a)`UUqh}{z;bhMH^l8`caw`iQgQSBby9VVa#93nF`US&><{@+c`3jfRFre
zqC!6=;T|wlsn8l2Mm!Y1^8MHv-m6-Lg0esO5@&0;T6^CNI9eAa*G2_%wjqVgSNc7C
zo<CS>gb$b);oUuyUHC2gofvK_e|zK$OL)XSt{=cN6|&I>ag_~a+PQrye79OV%5F54
z2*z>uLFmh+xT_nRU5$w8DlZ&#h^~eE(T=oWYPtB3xE0u4WQn}DYl;Bq{*W#FyuEzF
z0>dgRCMpQjE^+=!Y+laK>e8v;ZO0ok#G(!6q2_W!vC>;qa;$@66U&iNe|#ZCsa(Bq
zGuih~!3Ht|rUM0L98l)iiQV7!JcJ`!j#l(=u3&B)-gGkK1QVX6>pj|j_PqOWd+$XL
zuDd=dPz~qy;88NlXx>0?WB9!FnS#WEZ&gUlL2P5j9G=qTHl4LuJe;?_5TiEkvRX25
z6}}z(-E<qYt^$inI%Szfe;<E%v4!KyYo9_HwcgRViAKb~H#*Sq>yOP&bRchkWZf<>
zLmYFC0$uuCs%b=p=NtNbqx5`JpED=_$tT6S8s#S&b5AxapS(5AEY7J!%8SIzOjk;?
z67$i-J>d;pR1Cx_vvf_OIkorB%sEo>hQ<a^8K-OR^f>R{$U_d8e>uyY&r7liTM?yf
z>+2h4`>H!dte(vv;fgHUPkBWIi0V|O1-Y#?S6TH_DU27Pn9`KT%x1H9W_#oA#@!~h
ztmXA{8ybCo;PP)(S*1Rk3?;Re<}s_P>n+{J)s9Lv#nR!^LYE~HN85C71%4FoXOp!2
z(n9Cx?ffgJ%H-GXf9=~w&?%-#Vi&k+$KJPXA!uD?ua>u7SjnYLlwKEC;ce+{xSl`y
z&Q;`p_58qC`@VNF7z{SZ%OKds$(vX773>TRU|ATioP{BFVBvH%vpSxbhoVIk?s5YO
z#Tf|uqfTulrwcZ9Dnu%mnog4Vlw~8iO)X;^-HpY=Zm#Wfe_W%GlmZswFUBv5&@%df
z?DKykcC%gxM))o8W*>_Br@1T$FTVlA0{|DX1CZ>nAR&7N*KcCCIr4^A@`GDvm}{Q~
z=OgM3vtvnlw~9Xbcgo~ZP#^}`JOX8Wkj`Tjc(MvS`8CrS1V$s|Ggz=me?##qE63`U
zWA)0hdWGM+f5PwmD2~-LTC9)bPE9ql8+Eyb_jI17>PlF?^rQ(dLgyX5@-+Sk_`6uf
zA_Om{%X}S)!BT*sl4jjnGGkz=fULLA?ZyerQYg$*STk2By*ESYJ^VFbdTD3e6secq
z1}MFLYk8nvDuFG~v(s9$WIIC@0S{;F5lFMotfS-zf2x020N*fM_hac$3*Gr;(R-g}
zk}U@A$+&_9kAp7ifrh#QgXS=%Yc}Dz)|04di4fcPdJ5UNkfp}#R&XbvW5eEaKCQWT
zKDaq}FjjLBelYF>)wxD%cBSa@tyL<z;3V3DbrL(C^M}XB*fSvUYxJJ}mY1{vFWduh
zSf_ajf0JTQhMj955O<aV5Qj0|_t-9nCIL?qz!1Y#$yH>?z;A;ry>9{#;*P7Zh4b#Q
zhdZnlZt=c#k>D-7DPj(Ht^+yzmgnKWCFn3VSOIq!3_uBbI4rY5A6}skuh55A=))`Y
z;T8Ju3Vrxy=)<^20{~*aX|bDe-3M3gG9+Sre{d5pV(^I9!Xrk(+tC9sozPdNqck#>
zG7=x-1-vGTtzE{0-sY@7JWXII3qk`EWzqT=t12?b`*5y}XzhQ$AKh(jtQVPBdA`y5
zLfP5dZqd~%8VXtz7tl>=<1yN(+~#0z=W!+wDx;(9Dt(UA*oQ;zrlYQCaU3@t05(5M
zfBV^x$kqcI@L~Ka4Un5Z+rZ!1;ZOAUo2ZJklGW(mePYAooTM@J*#`pCL6vq*BdU_{
zLgLY_>W>xNLo7U30|FtU8ObATaT@lqSAsOHbXab`LBHNs-Pia6qEt-1yr7-kYEc>L
z-dp;IdWL_7R9umtiMAz>sZ3$t@W`ZPf3Qzt`cAR|P@E2v<8)N{<dfUcj%Bmt<!~F3
zx25jJ0$%0S7@jP3^Z~?lKT3)pSD$6};{qU`(`c@OTbKuI9GeYLJ?GU2g~8k>y$;QY
z{Atr7PK9$2pB0Cqx&7?>gS7z3bL~erpAdQ^*d)!(!Ct&6Amfw;qbjjq%vkX@e_<Yz
zpQtw#n&USfwzI0TknF2Kbi-M=H7@{pTVaSYJFmSeyF*_O`&x2|78P6UgUSqlBh+h!
zR@_4$skFk+{x`(W203gq>H9U|vtKx2T<;b!#cISGK5(}+-}OS!EYq%M(*zM1qHc*)
zO8$65fUbNnDCf!tF_Es|!`~G?e;llV;|xm3;iX$#ujhHVaHG~bCkz|z==KVF`J+NF
z&#m7Ib$R9Yc1_gf6~gk$(QSpWd{czw87o6eAj?w1;<4hg=~MO>$oNcxm9Jq26*ZUX
zC8Qco0wgiu0uDDirgz7~><|h^@%s4KhPnmn4!Vv~pjoZmzZZShy6c`3e@#nicPEIm
z#p^$}?gnqi$7>C{&N}?l-V8G2jR@Z!(UvGM6}O|^NqPp(8eg~sB({S%lWb7H+2d2E
z3>c(GBsD-@koi_Y63!EM?mXweqxDX-n@pO%2^Oy;7>`x`zmQQ>hk}mKtms1fO1Odm
z|9Z{OlpD%MCla?H-AXd(e-A!_1qJ4MC-uw^t;suT!SjtZRfV`=;U*_h^8{2<)<RB_
zt+{T9hOU<cn`y@^f*cZf5SKFtb^Z-oB0w9)K-OmcD2Ge7>35&$I$wDL<g9_E)+5}Y
z)DBTECK!eNmyQH58lVG?>x!PmXX!D^s#$dB&W;su9M}D5FF9u9f8>OJpxQlDd*_a*
z)&>JP`xOU3N6R?stZ!`ot-J(nnMKtN+ezY1MsqDYr7>!0TF)05Yp<vX48<jw;{jJ6
ztP~UbU|l>hpPy|m>+CKZ+{4zP@>a<aIz^J~@S-KO<XJLhYeXS%OH8>hp6s{x_n)ve
ztk7GjdQbw9VRoOUe;^3jWiznG>uT6zenG!Z#Z(Ni9MsN#gjsjOG)r?h{?@tzkvoqN
zQw_l-3g;+9CKoe;T9=?<IR?qRJ_>yCF1iHq-MC2aal<W#-ZufJd*L#LI1E-O8}h1#
zNr-L)>t2R1FPH)@oR7;2#C+vzzw)(T`P#2Q%vZkl*Yvfgf7SR%zV-m~ThPM$`r3y;
z<>G6fPm8|x1vEnWz(EnBw6J&{9tuUk%&id2S8)ZlWqe!#F*ZT6;%PKYz_gTu3RckP
zH;oI(KU`eE{JHs}tH#0tK%)BnN6zoxSr?IHNcna3|94v;^b88!_stslPM-Ti-H8RS
zdN?w&<})A1f9ISRHDK|7$`1LKHMd^v#qP!Kj)zFp(_`WjJbr(<n1GM$eSKi=*Vl6m
zw6j)kt+3!%Snw+>_!SoX3JZSa`@O<~|1G<AUq@^!m09H9eIvwpmQ%0i-%SPE?OW`R
zT~_ik|B{(n6FdP#$cORdIBO9PIOMFTM~T$HwNQ<Hf4t@&MShka#iI)l)q7EOy>++s
z<rh_cI>GePv%9T7w>IR_ZAGG{r~i|RR^jdXL(%U%+JE#N&j<j9**qM})nGkwz4G1z
zv=w+)i&vs2yq+cO(WS)b$w!I!3vms$UBtm-k|>K!?24+K*@r72F8VbXNH7I5?oLPk
z{feJqf7G2$p8T`Z*{4&U?9uP+RNiqv>3IU7oy5hj=yV@Q&uZ>rBYK29rS%^xaxF%C
z$yEJ(PxE63rO6M(8>JJaUp4^Mex%s;=O<YgClbzL9(z+=S31%6N&oBg%lq}HdEX6T
zkDb%Lrnc^DV??q?)8Xh=&7%$OvZTwHZc_D|f46i>olnfvJO}7S=dW)AIKi+(t|R=G
zf#;*>`Ky{ArW>ljHr}dLz1!QHx3{W|LVb1Lj7`U#um$_CC4H;?@sucltP(LB#6xx`
zqvKk=UM!rw>SmLg%no%xyo=SX<51mw=ElwBtXi-CRl4-HZZL=oJ*dq=@V#88-`VZC
zf3@;<UgGWi!N3fo=mWwTR-$)zQQkF~TiJiLOgg6-Cho21KcGl3gL>iCaI{dbk4r8M
zo{OSkQ=7w=r>58_-BTazhQV>0^Hbq&!jVvI_?61@(G~s$4JV^GIn{YMl&cdi=3uAn
zSg=Uhv;Jk*%=ld^7l=>3Ql`#<+X4M5f4AF$;hNbRVIw)!hge6XXixgi3)Evskm$eu
zkN*{{4s_SKis!u+uRy!-jjlHoIxfk#8NQv-xAnVnHC}nx{yQN{PLwzIn3A47U;f3)
z|90hn`)dGArX#mufh_5_YVfl9+rpPDIs1q|Ep|JbC9dV<bM(7%^7$rarvPW;f24*I
z^ICH^EA-Z&Hn~hgSUhl>a$iRMi~cal)!L(_nY2QoE7z#W4V{W=R!K-?pA4~}=HkdE
zH>-Un8+yh7POdmypi^^8lPI)Q^e*f*H$n~$?Vv`Z4frM^f<KsXMDNIkM=#P5Tcbo1
zD){O0iQ^YoDaz4rK@Kr-d5PI=e+4Mi#ZTaVOl@J*_=8yH(KPHg50FG1TtUpgVt-gl
zqy7bVW-o#DGm$ZShXV9Q41@v6b3Pu3*WzKy>^K%(+7<?Q5>|}W<k_G*dCXh+6lY7d
zl&t%V!!SQdVj>2$L)wIbDogC0Y`t)!$eu86t7KyecSb|6UbiSgN6=wEf1+R>@|DZl
z2XI+?Y2=DGx7T1@p2!VkypYO`18GIoRmA?H*@Yg=d*TKO{PLC0+{$Neg-^TknY+Yi
z?(eRL(QcMck0;6g-=8$1rx)_ie#HMiNRR&x9KJ@hKg!OJh9vEMK<~QzpF=p;-K_ma
zw3iI>lk|wT$8(~KxN{!OfBLT;J$O&AJZg|b)43P~1aq3xyCDu>98ICanVtXxN%AmV
zhWkkHl1$Dl)uH&oAOQ=|456&iMTchu=hu+k<SO2G*<o&Zs`JN1Gh{Qv?YPN-d_c3x
zZXUl=UqGK-(M;|Ke)vVF$+0}A0gKlpT{=8F#ZspiD1ZPPE|9{xe<M4Z@?!1NV&U)>
z%3BHkhQ4j)Tnb;?totwe!)!Ka9cS6GM)4e`#|&Mm=HOsy!bWm?EFEhh%M0#aa6T-d
zXyljTR){ji&%E&;G+$doL`@-Ys5qodau;m3;Ph~(<aD{E_J};(V|Vv8{YB*bhj>W?
zl2h{uIvUaL1$Bj(f8)m)?N5+*U~15`vFgXp45S1^(1%*qWIl?Ei8ba{)N|vwpIkaH
zCI&+~caI)~V^q_<`XBfSv;nE8DrdnaVv$81T-dRt^<_SRc_kmP2)eKQDHDL)a}&Uw
zpj-9>q`YcHdw#J#T=pxH(Q#2&-QqbBb=_|)ayP0iJcw84e;WF%?GNgLGkSFe>uo;6
z{4Fo*4L;u7XrJa?`nr4BDZa9ryI=Z)-B@_4udd?HZFlPH^$M?&Xx?&VSeTP>K8`Nw
zrsY6JJ#1{@YlNvbU+U^foBK!X`Ve~A7DHrxr^{*jK!7`)&NLl+RTA}Z5IB2UDsIbL
zIlS=6ru_~Qf4HA)RJkVeT$(NI$9!kTDlS?xeE;rSl10`F4pjBrYc~Bo>#7$|J;~9Q
z6=O?Z6!WhY{a#J|<eIi<)f07^&0JV(IyJRmk!@AYt7^(@glvv-=ZdpLLNTQ}slFFX
z<Lh69o<XS{?9awL1p&<oX<0kh_Yi<+XFp4_Q47lSe`V!ID8OZvx(n2?*{o$pQ)l<W
zi4seL?|v^T&=%pvXhyzG;(_r<A0k6w=)Oyvu?nvj`=n~CG$qbOWGkv2zK}x2hlwJ4
z7y6ARm_6H<0{&fbNFnc&=c0cIW^oL@V!i3QALa;Rg|^w`MMrN_2*^QrKB(I>Z{MH?
zZrL${f9eYXvgQqhM2^s;Vwn;#i|j&^$B`q}@9)|B={h~%Xxf%*PNres?Yu&gGxg+n
zHh~@?_m)#TOu4|FFPcN=-$XL7s9JG+*cY>qe@~bRF+I~Hh4_0&7~3@>lM~wu<|^+6
z2QNH%9d?O|BRemSb}aO-qb2!QJmI~X#CbZre^86rjgFfqPsWP*?pU-!!2XSr^Khzc
z?=+&Hpkk_)y8q}wHS|*-;$*3xdQgg4cy_(5I8#1Uoj5SOyNI5|BO0qDop^yRWkCi^
zE*QIkG$eJOq!P5j0q2UCxPgj9tX5>8b6x=`%9tB9jdB(UR9m}F;@$^C%$jtn`#^qq
ze=3;s?^c@C8>T8XPT19ob1rx3WYA<R2hXbwQ{s*HW7;-!!1^rz(|xr+&ZgEpq(e>^
zU?~#gsZwv|XD%n)my0Ft+}?zka+SX?I;veRlTdy<M?Kr}Wmo3u-N~cW{-G#i8~b~{
zPd~%qf^Fx~&$1E`{So-Mv+vl?4lnWNe`rr3!|2Z+SW8E%^$j?!5BA^B)T^fc7ulbY
ze^!1KzMC)hf&SxOoe&Yz2~m8<pFJ>zzWmvbLx5)F&wpS^QG_oRA;-W1v^2cqc$5rr
zdL3{GbNy68_CZk&V#gPoEB5e|RuoP$=#{?wIojO3`^7KWD`px?bA?bscC2tSf8_s~
zPG<VCO0{g6l4fd2>$ug3&eAv<pNyYgYypb|-ICWokf42-jQS_6hIbb*@zfXL_|Pjy
z+k;*`vS-@0U%prFqAAVQS{}aoWqTzz1WT<~ToLcCn0lxCqaYRkzV4Ay*Kc^A<nMW(
zh+^pjUnu$V3+1vKCD_cr<khn9e~!8AlKGWxn<dxIW%o{W1yOwuQZE~439S!j)ZIjv
zT}2B!`eE**Yj@OLPM6(IS9LTbz0z_(dp#|To;tw4Xn#5z5UYPF=`D10aA-Zc<id(>
zaG!pxj=Fp5vODazFry~aCIdL!pHQoZ8SN_WEQ^QPdCqVLQV2L*A=;Pqf7k!JJ+gbz
zv;*Q>MFamXna~-?@)9x}(Nwyfh%V1`$F=<}Pd$udx`2?co+=j=IsNe*{g5>F(bl7@
zH|L(2VdTR+f%{ireh()^ows>61*`Xreh>V8aan87nvA%3uu9%=qN~_@x=*k7xA(r^
z-s{!5apFWK7h~a2c^x7@f1@v+?Av?2HvFzGw7#D(FCtIaW^*KY@Zw>?{Rj<C#Z!eY
zsGz|Y6L#d1ZiirNOB&oc;^*Q}z2Gw!<Dx)q$ajI8HDw(TA{$`cH+N7gh3%M4;Jbm2
z_G9j4@#H_;DztO;fhv~wUgV2A-Xd<!5`;MR!JWmRVD1^bVG>V9e<c<#88v4)7`^r|
z9nD?`EMJo!GzVFqPDm3Z9S|lHdfT62=zoQ?-@Twb{r~kZZtFH^dQK&8PP67*y{^K%
zt}N{B@&UGN9TgpwZdPZsMFiCx#-D!FsZ`cm(VaVXQ?z&W+$!WAM=tbmsuf+s&UH^*
zd-GOh1K)4`3y$Y>e~fF}bf?92d~SYMJ$L-|BjM`!7`G~$`21=rRWr)NRqJ``l}KOD
zG+9^Hrw%TG-P0rKnVM^h;aQ_c-r+G>(yWn6M;(iktuCYTwc-{yit3yc`u%J+Dnf3$
zpr*?xYzru+N*uZSojZ3lY)l#n;btNZeDWQgBFJ?bUP`@Jf9WWl_5^R>RdPWWbA4%b
zE+2wb+-oP(e*4wr@bea!mR{(`HNiZxf8l8fNm8mW&xCI$fKo6Y{b@WorjC2f@SQu4
z_z1SYo6*ol34&($j=*%RLt%(IZAijIsW_$Maz_nY`k{*`T0A7aj%6$snSibQ+-F;X
zpSMk>U`j~sf6jH8W*D2M_ubxu&%58fKz5nlLV!z_RzsxLz`>AjfAv^Kpk$M8i;3jU
zRP0rl-?scGJN(7HJu3a23ioUp%m))XdC<$Ke5geYuJFJaN5q7?6}yKEMm7Dibb#tn
zsMxk3w!BZ$Rn#-;Yb(k&Njk$VTFQ32rT*xyv)-5~f9yaRG1dfQ_A=ys(9LivZ^!6b
zlmD)_yxq?X(U)rmZsc_GE~)@);P<5k@Vzc80Gw~sG97?T*D{HFfuMU08GMO|9LVF9
zO9kEQ$j?_v)gtL)pLI><>%RW{?q8S*>dq#^kPYHJY{jDgY*D!apYw9>Nvkjt&k}*N
zVmIYdf9=tnIQURppRcTaaU&X8*(CznO$X(oUW$KYF;*6eNgw!V<?_wAcq9oCm*ISW
zTqE23zKmxyoxem{SBxaOq><h0^#79S${^^>O;xFp$4ohBY2aU_-_RVkmTqA$1%vko
zS4FFxMwd1sByyv5SH-QDdpoU5&&i@SSu~IZf4hs;-%XZpcYfMRjqo{HJdnjBQQ1Pw
zq02^8YGf*eBf6pyrZ2jQ7qZQ*<&6-9)_4nqSu{D9WHJ`lSMV<9rUqnR9(4+a6|<$B
z`2IXUs9^dXpvOl|+A{72DC{0$S@LWc_(ApML2K@gs<))3eNV$f1R&dn&Vd^j0OH~F
zf3uwc0B0ny?3f#<u^O6Br@FKCH2P!2s`_elKdP37l~=W{Lf~cfPtn7@?X4Hv5k%^p
zhuhKC!-vmbK6_Ess7n3F1QQKv#dTyLWFfqvOC(e#3SrY#QPEI;RFcUd$wrLh<>!3s
z2%%Qa17Ja=>{78NQZh~8=~x4#Nlu_uf8^>U!F|i7y=s?ZRbLxuqkCcVN5k;XpewUv
zq=4s?xIN}a*(0qqI$}FXkfh6;wd0Sn5&h|Xju+03$Yc(soampQ2wnU6^+Yg`1Z45f
zMxjx1j%*&P0xPrk%3Q#iZP8v3sdbP|^Fj=I$a_>pYlaTyRShy_4(7Y$!tE~&f4n>q
zI?faTQw)#1s=Bt8w!vpD!JP*O0!Q&j;$>iSfXEVF>$A|sUmFnN4ya@Z{-x*a`NzVB
zWv!YrmWR6TS-L6<_!i(pbFq_HJDS7Gts3B8gP?$=4D2;MpaWP17qzNjbfR=S5Gst*
z6}r0@0(&;P0n;5s9}DA+9W6nof9Xg(YP?(Yo_DC;IV!x7X8kNc^)x1KHPO>2eKu!$
z_~<yUlNviA)>+*HKLF?4C<Nm3uG_l--;D2iZr){<0A}eyq98LKu(K)O9p(A`OP3$#
z-jS8VxWET>p&}3<!Z7TcU9p-}sL3nC0d1`6lBhtzp3#T|anzyNL|hH?e^%vH2t27|
zp)mgg#<8If@)J{uaA_}L+<c})!f?%th+ztmP}G>;L1kIP@AIpKjdzzZ-dXl|cah`T
zqKFXQZh&?fFg-zBf)Qw6&LNUPhZ^<1&L+pWdG9yBwo3VDuT^GH7qHsz&S6K_V~WSK
zL)vWx?mldj-@b2?<u=dbe@SwZ&GKX+L+R(%mlLp6*9DDAYDL%Q%V+b}y+yXa0+|M!
zLVCRsE*z)xHd)vv>?;m1$~Ea-E5qBUb?r9Q8-EG2u3q&Ti@CVv)^)~Nm|IZK<pRQ9
zHnasK8FU6K5u-NytLd71=tBw)TXV<OI2I^Z7aVFLr0P*GNP~HBf5tnP9`Zswg7>ix
zws~^s-Rq5Ye3BhUl0jB*FUtf+IkqLe<y_WB2zot4CubuEbcNJLIK)$TmCS8H4~h{p
zBah2!DBY=*Xq(FpH6E83Bb|?SI2-LA;v=Zvp0|n~Wqk%0a@HnWnH@J8&wn96v(!#9
zYU5}(dFdrfRa4t+fBFfjtGr_8JX~x?84T~(^^M&GFnSM~TwoEyh)7vyE@-Mt$6QGO
zh28q2HC5D;bWsu%mh6c}kaxA}ggk1uD4A9<I+87%B)UlEEJzPUF%ntZO?E8wAIu?-
zK@rZ~jDhh8EGsMt1y=^Y_P3Us^nySo7f`vZI^7rMGeoL8e|6arr?BF(8}##WGTPsN
zVsnb045>AtJpsfAR*~!YVQ$m%g{tEv{h?u|6A86RUIWyiFEBE|y1Ibv;i4p6f=d$d
zSMqady9G?Eg$+|<L{I4RQJxQ@NghW{dINT|$;cOuMQDv_7MghB?{GZp6$CHYYASH$
zAqd>~qJXlde`{&e%faIsI5bYgHX%k#=Xg^vOI>}iNzRORX%@@I%0K!ydx}tagA-4q
zYGQ4gEGnry`hzhJ4ZRN=fu}#i0MMNj&;WM!pU{q;8Wxzvoh=~1q0tF-2`m-^{23T`
z=?iCWN%H_C-u7wFu{pgCZ?Mrq#=tW}d@vXgv%n%~e{C}0ORG{IA*_e$wF+#eF0I0`
zDVKK!^Q`qSlTd1M5kJYZQn)iE*MfyFe9-H&+zyYHanIaz=eCD(zln0ci*gU)Ww)k?
z>juwhL4NP7tk^n@{{{3ZMGs(=MQCUnl}i+CX>%4tHZAAGfDHtUNc9K7*ZEvd*#Nv{
zK_HKYe-B&AmON7vp5PdSp^ZKgDE$7Hh)sK(Op7WcLCp4d<<<}Tk*a_-HtXS&m-{ca
z_x7Xvnw7*Rs6T|m&O|W!=ri}?p}YVZLXwQG=<P(mYR2bz)0EEwfAEd%M((6~R;>|z
zVTjx{Fp-J}$GQ)`{Gj~Ml$~n*1uoGmPHoWof9%hnfBBcqjnD4>`OCkwW_c4ybeiie
z*9CE+K^Dta%zKIY1X|nq{Iku!v<Jx<*K4qnLArwhK&=w*Zr2bmPwa<5=%vV@NGQ;W
zK3wmpO0?FA&`bIu&XQ>1OhD-`-05ZoBD8b5>;(+JBY|qnJq&w+v2lv=!J%>maO0Ri
zf42;poVfhVh!#_jDc&g|++S%IUU#S1&TgW|L?2|g@J$~!r#<9Un&`0O0`eJLP$X@1
z%n&ifjqQEIAz3Xr>9>R;34F<A#{W@tAcfpEC@N7ie#zIl6);t5+3-Ko=0fa<-=<+-
z`Z;gb*Zwb4wCP;PVqVjKewl*oTJciNf0A<I(pZ>+a^YHj(`5zIbv%O$-@LbQZ=-<o
zTbYF^ZOdi+i$tI*>XH+n`M8v8DEgbr<qvvJL=J=HZ(Ly(Pyqx92(8w<R9cis*(@y0
zsVeFN2$|*nFBUUZmQ*{HNsaF&5e8n8FHXX^+668N+B>W8-B>2WRg!-lyw8L&e@C0A
z$tggeNpfmtM@?$9d6>N}0IF#6;mWh*HC<@}kLz)V3~<QM?9K1HXu)%qnP@>~u1ddX
z$rU6TXSfyJpodg$XkH<><hj&z0r}xQHWuiz03@bSL|(Y<;TD?f0ielk4hz*sic@m?
zG;g|x-jVCJc_7J)z@T;832F37f2dyx-_d6nyW+k>j1<jfS6%D^F0OzQ%Tsb1Mm86L
zF&Yl!)}bNmZoXcEFfS`hbHqU&#<<=yS$l!32V~9YB9i0<^QahGE)9Vl*h4u09(rCN
z>{OG;931e)h)RFD&Xj9Cy64h=#FJxwv%zmRDm%~ixA$H|JI`J`j{qAGe|^98<mL8$
zRQq(j(|NJ|pD!9zw$q{a^=NPV#ml{CJI@|RcLY$r%C%P;5&yA4yDu?wy%U4j+rh>l
zd#)OErYevs-km_+Fk3^j@u&=AViZ-y>k#+u<&NZ{)I+W+>M&1xEbu3n;G+c8g6-P^
znr5eC%vi3-GnXi+To48Se?AM<k!7k)iCom@SBqb7KzBN=FJCdKq@ktjt0j^px<yoq
zrrAFO=fni7>x%^>A`Dx7pEdp4uARQxSv&#c`+}AI+pZqOs}`4PYoPRMSub7I{L*Fh
zUdQjXu)3<ki!NGJzoN-8Ob7OC(>^-*vAEPdto7iqg@1Z}&GkS_e|`Gz=8_$te{5c7
zD_nOQNDPW}x!2G@3>TYXL+Ocd1Ci)=La_tyo%h)Yf4%yA|MhyO`>&1YukU`cZ?>G;
z*<SQVUeMpy>fH+L1BH|C{c@I`{y8=1ehO8^jn$T(trJ78Pq14^+ZjvljDUgmsLVx1
zx)nWj$wYvr7O><?e>5wBCS#Aria6<WA1o4cu!DZ+!ICa~76_SUi6Qc!ve+JQC<?Hc
zLUWVoC;}$12l(D;{MyAN8X6v}aM2u0TTV9ixtMHMnjn;MCKJg?16|}tWMbuzJt;e4
z9dNf4(h>@3Xb4J1Bq$9<eaLDjQ>wKE-?=?FZuh%hCp#K=f21%#9Gpx~hxJxb{q;V?
z#~rAnHg-xI$LXf5r2XE!A#3?n<>l@p7<{?V{`LzxIKvHUOl$k$+wHyW!n2L9-v8FR
zAp^5OjE`?R-@z`td|E%f7McH4r}5K(L;v`koI{XAN`Y9sV~Gy#Z!#_MiSD>1=nL~r
zi5d@4)biP3e?Cp8vuPq(L`q?XYxyP}6OxBpYXV0XPYr>#RiyBOGs&Ko+!K!~E+FKS
z0SDG~`#GR7V@{Gs-%RBPU^`u2s5~mH5LZ{T&etpZ+fTM1zKHHb-|Rhq8ijS$xUA9w
z&IHZwwxgJh)S%RZG#)avY^{Jmy}t;EI>6$sYnGfof7HfN&v&L5t{)Ob9GZm&JyCE9
zNj8WzVmD@IQ1-~EtT7XPdOQelcD1`y558;)4!%pDRqH+9-F}8QVB#=^he#EP<a(1q
zo=ou+Z@VwH9z5BmU$l&MfxSL>=I7+U{?GqKn`U{gpLNEjp^EcOx`e5Rr^QT26Y&Uc
z=9@4-e-K%W^QJeN*9FlTN;|YTyztj7tEE7ed9s{?x`RjdJcw*2-iwhXD^zs-@g(Jp
z=>98Bp5yk=CHqCUH+FV=ngO{cY3aK)-9~65ry0c-zPNeaU%PL+`tAKoo8yydLzG>|
zBa=OGJj@Pp4l$ki4F-66!86>xGv8cNnpXOQe>J$`^5nup4~VSnPO{ey0=>9N<T%(6
zyXnZmRNkg-F~*1WLN@uL#*Rh=WjzsYIk9tGB^_9QECbGqfw6IH>x^`73Ri>jmB<8_
z`a-V@fH96F4BCTjo@Cj;)19psFSZ_j8?Ajx9q7y$c(V;2A)%>tEZ$nQwGZ20?ZrQK
zf43uhPPb@rK}h}+Kb+RlBuz$xT<^^H=gA8x*gld}6-l~W-1<XNlKLt%u;JXuSeOoO
zl1yjBi}{$`3D?v0_4IT+phF!PxE{J!5!*qMW5kUVT|J-Arbvi(Lm;PX_;z0laA}Ba
zXKsGF@o?Ckz~i%~`?`)8)X9XnW4d#de-2;T!%~H;2}hMhkN187Bj+X+S`WK<KOV*t
zsnGRM9==--eT{G)w#u*3Lv+d2m-{&khwOS7Uon{rDqJ{+H(Hb>JzPA8@fDMKSr5ZG
zyxF28$8rAx+m22x<Nw#^oT48j0P=>_QL^!*K*_S?Sjv17bHk8++lnw;kVNJVf9$<0
z#$j}C-BG{|_t)lE$kd|5q!S$wx4hAaHh&aScv+)Mc65OoKfUM*Z)6<#TD;bX)(-JM
z{WYS<mls|~xeff!=Gq+jw&GtE`i~z`^d_oOPuHuRs2YRShiHT!hx%g^Kl;_^ZDX$d
zdRTrVEKfqyTNMA1{>KvhA}SRkf69#RG?xs_6Jp$Z2mJ*_mgn2~b2o5T^a;iSzRuUz
zbg%2q*zF=MULYY<Aa|Wl;_+AnuihX2&?`G31q{pDAO7&e)9w$?_rBZT-FmqFhd->j
z;qJxf)`F_`;v+RkkFz10Q61yW?k18Qf+hc>Ve&dXOozDfiNn@AX#RR5e~#TJF@%Od
zSRT5^bN6|MV5}T%tA~Q`f}n;JCWD)M#pcEXSOgRHeq)zP&6HiVG2T3p_-(CLQyesX
zwRM&1Vu?XeVC<R8b{6`vav~*3tRN-NHG%Go;~1dx@$Nef7f>swCWC+PaCSNpIhGT>
z5J{C3it$;N4irxECk14Jf8#3v&l~EmS#qdl*C?!~lPoRM5a(iMX5t7q1?dqRRE2bb
zvzf7zrRb<cWyij=P4y)(DT}lFjj~ZQIUNHbn-{XB#eB+MO@=zOAWhEfdzf&#gs8T)
z|8QrAF~sVPNb~(RI9_5TOk|G5B$2G!gWfNR*~N2|A?xHc5y1qKf5gS<VK$6xo#2<C
zs6Dd123evyH+GR!u1+8mQFQ0Xl9C65118e!l#}c**v}z5cNmSgT)2FOU9M&~f9%st
zjgzpSj2N<A5<^a1=sG6-6~tP=CXJHUaQf!+{gZ_%L+~9YBL*(;m565<dp6KWCrFKG
zsStC^hHN34oO6orf1slMbU+J#(dE>Pv(qlEM8@aLsk#2}2i}w%MDm9}P=9ABousqm
zIGGAL>nA`LA{wDI2L&6EtB5IlsS?$4S&{qE;!X&yvIJeBF4ZYsdcNKsR?3zl78fQ-
zCKn`-)ScI>$~dYJ;H!QxRfd!5Rdq~wZ6}2l2*sq#j>mUge>zg@OwB3Jr591x1{sER
zy=6OXLB&(c`z2MxLCPSmy|LizDi3lRzY;}u5PhtEMUNiXXlA+XKXzHnrh<%wv@8(Y
zSYCj5gMe9)JFxxT{^lJ`B429h3KcC)T<mio!??SO6N1mcg6V271_Gd;rcQgL$7DPn
zUcArV{AfGyf4d}M0LRl*lM%>Do)QVl!))C?-6`)3Q`YGs9>=gm2>pAVN_u;-8xY;J
z2eJ(vVX*)wxuIW<^5Pw>(H(KLx4r+uc}{J~B~43lrW8Y{N6t<-FqMeHlY_1@>I^+Z
zCM(Yn7*z}tbv+`ogTo;SyA*3Bh_K5%>LlOji!O6ZfBrr#IR<L>$$;n@a<Yu66ZMK5
z<EL-<lefKA^sQWdGS#2}u$4@*8Illlx;;<&@z&(~BBR6WO0N<6qreDAtPCSm@uu~L
zjbzk1PhX|PhozDS3BTG@y6Z~QHHBCwp3FYqeYW?ZSulV~&m*?x5{&R^0RPo)1FV@d
z5QPbae+(tU=`$+)WY;NBqI=PsN~G@JG7Sy-Exy}w>ESmvaroZcx&4zoA0qu|p%V2a
z44+N1OdviLv8g*wPVIf=Esq0tF+;LBEvt9uv%MJWq2bLPjK-trMSQ+6wkV=XA1;mz
z<k#_eoLV~FmXgI92_g3Fwl+GoTu%G~l#FeFe>8=K8n{SJpwoOM4~K@{;R)}2>%>=v
zE$@j2$2F|78NXKT4n1i>82gGIzNK9>r5mP}OeWc+uA{g31%6mtb2=}n5qAUeY$SQf
zM_&bPpG?#Q%ddo?;Dqbc;cPa|+2?m6@u$-ecxNb6Bo*+-+&x-grkCF%Yq(Ov>*vC?
ze{7#Y=C}5r*YAGb)=kljCx_{D5>GCg;syyrq0CZK<}GgqN#k1X>|A{$zA7DwuS!Sa
ztGOfb)%=n8YQd5Cs`B=$3h{Fsn8A5k-KNJ8s0|J~LC+epW}RrCds!_hIg``utE#Lz
zG3vEjir)7oSc`4m169G_VNO*g4Q9++f7QCIlkM&|5$lECx-C9F7H}-;SY0;yb5=XM
z?e6y_?@2n*IyyJ5po$I{Tj}5s5SWJ>I`<LmB!j~S|A~dr;E}@?2eR;EJHq@}CSP7m
zhj~Y9!G8)?+K~`-De|_V!_>~gW!m*>qyFLd>H5ZBK6Cr@`nz+?cWFg*&=+IAf1^%$
zI&t$39+AjE7cc+s*65<5@5cE>KN}x!AP;VEDJ+N?S#Uq}hp=V(p441R^^RK(-oE@x
zP6b_-{L7sQSs{NS_;+|7<m2!(2vJ*hJyZ}mC1*m<06lC_6J2rf?*v`0N6q^@D+gSL
zX68rf`t9;H5KKwoMgWPXt!NYJe=Y^LsW1umT;m5-{I34kaPKiK;d}fJ-(#Y}_xN4-
zUT3CIhdv9-$rOjB<VjdYr#&pBk4mL5`I!5#<e~+!&*~MMRdc^5<}s%WK}=CHlf<Ll
z<N0jK%bNRY$+bG0wDh1TQL*yhB)Hqa9y3w$k@PW9D*YtTE$Mzb$Nh{-e~<7veeF9C
zT*=aJF;x|AXMEX5Ir_|YhI`;Q)fwQxne$@wi7d!%IY_y-*hDsFaG@sv4-QKq1LI2F
z(CMJR2f%(ixceh>nD`qEA-WP^!u_aR0Go#J3AI!ES30g~H4XHoUKc!FBK@h*<R2>~
z?g9M7hrgA-Sb8fLiQK}(f1o@y8lqsC_o%DFi_;Va$My!<K>tb%%DuVPm8G_PYvyl;
zke+^Y3|-KXCFp4_;kLzF_9~uRO3D33hpod9_aq@U-i7^kci(bu`(3%|;%F*M7--3d
zGe<NvBFX3_v3}9L`|dIZS3-~K!R<Ure$s-<dHT(1zu#8$k43Dwf6pwz8XYGf>L)>;
z0=B%N9CAbVe_juJxs+X3$Q9qV%%72pQhOmQ9}GS#3_qNJES!S3Q361nVo74-&yt$;
zIVfy1rO)JF{O^ZhWZ0!2r~1pKr&^LJFFzqya2>zS3Ay};=uq?W@hEKk0B}H$zl!XZ
zF!nCkFk|4KcsDG!SBvxE*ne#<eov#+cs6$FN$pL*ckw*C@HNj3%lM0L@vO`%7fU$c
zjS@RnEM?Cd0moM=LC+dSDJ)w;Jorg87{GBU!sIK%(ZT-+KD~Sm8RMI5^3bP}=twq?
z5`lS=o~G1^^}F(dmS>jeGk)||4qib60F;4(*3&T%JngvqlS>5s1Ao3ey&y#2lqCJ|
zTD?>tr_KNma-?E))(891Pzf!as$x_`ZO%i&WQbT7C2LX;TTR5d-Zw16hq^lDkw1OI
zO}y<1LBQ?GT3pwUt>Jlmkw<+;?PM+-ol~S7(FMYVo8+`mX~NT>luiWv4@+?Vd@X`=
z4Kc}NBg>G=y8tX-E`N`@?oml<T0pu~M&j@0#3M(zmI_Np!z^AXE`=m(fqdj8Anmcw
zSfJ-o^#fm_I154a?-I$UNX8b?sG$1N>7zqXnzJPW(p*311tk`Q7L;2m5G^RXP%zSw
zEh=yC<^(npV{41*XW^}0kd?ZFG-tiSJt$BXd_-k#C@0~`y?+81bzOmpN?j^5!4z50
z9IDKqpR!~`Wo|4P;p4J!WPLA+NP!}AUWG}!RGAtQdFmgQfc)iZ0<r}cfh<y#?Q)d$
zk{IhcPs!pS>$=9P)9sg?rvFMpO9eG&xP5Dgj?P9&h$(yUC>am4i=_?<ce{fLQD^o{
z7;w=5Dx=y^3xA`ymB$j5Zh_a%JJ;J})X!8*8!B&^KgGc}aAF8La)jUQ^)CL^m~0Kj
zJ|Mv=EI1p2Gz=KWw*ciK^j4hFhZ*qhD&Hi@kZ$5cP)Zif*cuFJ(-?;~svW?Ea=H7)
z7XlV6jvGGJPT;(O@8Lec7QjH7rqgY%4>h>)(C&s`^nV43@x)f-OQX_*qFpX(bE2tu
z7)9q=G3~eIiza{3oW{r0rGtLlKS`F3cjL1z3WV+{Xqu=u>uLs?4`{gy(#GdqSGcQ%
zg9Xz~?y<pN?kt}OTf6Qo<&Qa}%%1^1Q>~zwCMS*73T4(fqAdDBGP;kF*VDg3D$kq~
zjTo2N4u1>WKt<ItErB>fFb)!flpH1MkpyUiykP04jSqhaK$vs-BY+;U2afnhuonx^
zF`@(KdZn-qMCYfM%&GU};(e&)gJ}h4nmMov_>=^f^TFi3A#+gU!HY?Hd~5*@(vns9
zWp^qs3x^Z-YxtRfA(TE5#}rIEy}t=fpeIcb0e_f<3Lr|L33nOdTX#;8KpcR4Ec|jg
zT><hbN&eHc4@UxO+}XHtPC-e;+3x&iu1P78Z!d+n6*eB$^;97E3y?58YP804YGm^u
zKZz#=8kLtp&DXnJrkjnrbVvEq8HV?mOZ@e(w|a}ABOxBo4vE&7d&PyzYRD-BQ;`~=
z;eTZ)o7{Xq4ijpXeJsvMVo)~}stxw>3uY1+LP=fQtxt52_k*LCQoq$6FP<-xMEtu>
z;#{Eg74-+VlLbG;8vUhPJ_;)wv3WkD|A8w!aB&&Gj{#E@=H3Cj99~EaRGJqHh#nZh
zg4!@m0rw|XFc^HL;VRrcgCU9G*Pn8pyMN5nIVT#z8&JFl(~$zWxOdtmB-x0Gk5TkW
zr7n)n(Fe1Mc(a99AGUgOdYCZM7vp(OaC5)h$pc>e0HF1ZU=N^O*<OF<-QWG^j93Qt
zP%9jKI70!^FLdj9xzmW)w21DBk@4U>IXua-SC=@acCAQw(6C&=EX}XAa6YBuSAP+7
zx*+1WKpi5X1J|VyHSxSIL%>+v$^6+bR{I%OTTn-I?HYD?XI=SL8id$OD<+|~*P$6f
zU|ZByNvmy{I@<x>W!q;JGtWmC=qvZ<C4&)gp2C>4pTvk9g3)ac4s9T~Xse~ls&&zK
zmmUY>EjY4vhyp%J^YJh)V$<^JW`BYJ8i{l+OI~yEk-67kU2U89li`qNjU8V&*4iH8
zV4@(tW(o}KH&L=pfEG+0N}!Oy4UXTHEk=74z#$Imh1;^l%MpQ?92Xra*dVjN$!P&C
zf96rbr<o>aACc3<5ehP|L<cU2ubF09bPE4mW>JL$PhR(t!G=e&emA;%_kXTfhNN+3
z6z9lnWR8q|hQf6a%ONH!)16HT8kn*Z6^+e1K-;*4W^!;FeEyp}5#CuV^3(&P1Sipn
zLI}WuOoa&T_OTq1E`O8^OwbDH5VIjF<ScE?#>mgq#g@V27!Os(%K=dslA=;M!Nk|u
z@_yqSD0lE+7620;&PJ{L1b?7~2hWJe`~+Bl5&xkaEqv925On(08q$k)oqepKyL1<1
zFb)+E#C;dOadc-)5aQOy<&|5?5f4U|vOj9|TiVK5^aI$->cY{mMh`B#ZcxC@-FdX#
z2-3k>2rsU6oGR82vcodN8<PZ*3cnK6TYHlAUvcp6IGOmS!<$U>Vt=^?rHZ$*i4TB7
z6IXgo)$Eu-PT)KY<<xj^2G_m;5hH%t4YE5It`NAm@qMU?doh-SYYb*lTkD^7!w(Sj
z=yzf9VhlMBjFKo`+Ly}}?H*F6Ulp)NHLODK^8?`1#Tra7m<^M`<=k}PvTwl0o!ySX
zWbokqKDjniE#ZeufPW2?FUGp&2u){B1Gs>kDOfWE<jg_j*JK@RhS)_{Y}XsiR_81W
z9X!mCyyrHq?RtkV|6r#%gyA$ycMBvoAjVQh3kDXJQ1<oKh3Z8Aq<S45+#kKzFF+C=
za?gcBkYvuBUBe^q1u{Jye~$K+#2W7v^ijubq$~xEXH)htE`J=NY3}(z%q8cSMJTRB
z;lS=Nfa;4Rs#G#C3*@a%u!aC|@f<-i>_ZoEh8m3TeruX5G?4yQM*1Q?9U`Li00ik8
zda-;M_g}TwH@^I=og;>Ys98>j90|JtA~H&bO)gRwmR>2CdDin?Zk#xsoH7|J0K0UG
z{&oAPmW_L#aDVE?f(KmXlfZ679htUZr++G)Q$pbxZ>j2s<WLheGO!DH+en8~`9!P}
zL`7TW+G^B+PjsxENdIWiGXz?7d<}v1^wK*EVA>1eCy4<}rg>mRfggtAj;COh7eG&{
zCa|ZNlf4ioVhWB?V~WJ3-XI$#WU&C~*oh9F>gl<j@_)(Bn(8j?Y=Q@U<}|TERj3Wo
z>iu?lid(|!Hh9ZiSWf>fxXrDcx4U_DJM72nVLo!=#zrW<LBtEFL<zApoob$QnQ=9%
zxd0H+Xe-`7HZt8LEF(6NyHd!>ojb&qD)@&Ti4)j5qmvo&{!Me=G4kWE_?1c7nL5eb
zQ*L%tn17~INYMRBmggZ0cob!UU=QK60At$Y5b{D8f0I#Mrzg}`OOj%G)7dB`uCS0P
z=R^{CgTUv09qfbbe3VSyL%mw};V`aFMv7${JJ((cv=Mk(3F8uFX;eEn%0h{Et{-1^
zxuEnz%7!XleNwN>+ywB<GDYVFlym`a4bi2H8GqxcfnK1wL;+gt)fZiq?YgqvSz6!-
zgoB^tmWKi&|4fzb!G2Kz5V=bxuaJIGM)5??6%C;f3M6lp{vt#SK)zcFPU5!-SYg!&
z&T|@fh1F0t#uRv4aOXaYhx6r?HHo!=eZa<OHCxZO@@M5|P^hbgSR=+jUUV}~vOdw?
zY=8N(f412j2jvPHPYt~68_LU6<RfBz83#5<32PjzyG;(zuaXYp3-0W4R_TR=_l#zu
zdjJ_StqX|*j)j3{Z%>4V>rr8qFff~s3w!Ri+g8n4szQve=k=)PZDUf=ec<mGK#rL^
zk+19#=O==PzZ$cs1hF+HpQx3XBOgg_hkvnLKc5O(ip#a5T%}L|RNCaQfi$mhV1ax@
z{8KVKk}|A=ltKrz-e+l|`Mloe?1Aig;fnsJ;*$G#w!$cu<K&{IT>MVEn&zp-?pa`-
z5z&erVFw8%U6-bzg3~Dz4pNf~2)R69y=9<IruCLkscBQIX*N-YF)>-=D#{@MV1K>X
zhgk)_|J|uvx@-D;P4qiZEJ5Zu&orz{JQ_`yEwXUT>60uS)l|Ni7ob`GbfDgKaPlHf
z--aA5w>*jR<CH^+d!aN+71w*3vcU&z1~K5y`G8|qgHI1L5@IJ~sCX@Ib?P&WDy!-B
z55!GQ-N;V?_73(HJ<l!ON}O{ZRev~OwA-WXaHaw%{SaIx`eS^`?=Wsu`2jT~x4AFu
zeWs2nZ>VEGFfPVh*^*UpZUbu$=Z5@m>(xrYk@^%FM$rraKqRlI2Z^h<$nEnmDcsN%
z;tnPk0+Jp14I{=g=^bmJPMD@mIWuY!$Yjz`%c8zn(DQI`sLJJr)I$f~yMHKJZ$(0Y
z<wU?4@cm^pe~_t#4QqiW6xzta`w<XEc}x<~Q5q{BNTnK6>{R?nyoX6)Z^x0LI|Wlx
z%9{pm5Ab+G6;6`j7*xan24MCP>9ZC6Z~~nUd!C>*lPD9>BcBij9bPcb%IPVTBLh#C
zoL!<4S(CI}0+%i}(i$wNsDC;@m6R32_Pr%wV#vo*%<#*_WGg!te8xgjt1IISaDQ;8
z(cWoc7l#3)2catGeY8EsgQgSM!*Vz0nzGs>5~>s-v#qh9V$B+5a-28^*65;eyJMDG
ztT~_84dPp(a^{FZzt->G{lgsiDTr$8Ckdm)F+vl32NPM4KnrxbRet~%0X0%(T^OZW
z)K^I`gsuZ$%l1hKC03DW!-i(V$(5FiK_^In2e7?7uN+*BWpcIAoA|uShp=q}W9*z$
zXdGu1O@v2-&`a@wCIP@*TF|@lcYFYlDLNuCV>aS5Sl+XFBiQ&ACT3IJ?7C}ak{?Cn
z8o7&@3!Hc#ryk=CG=Bin3OJU;7O}$jo}4ziLeG;q_Zu||#KM+dQ!99F2OJJ3*K2|?
zE1|ejlL5o|6|d3CCpxA#5{>=VsYDPlAvYMuBNLT!7pR1++s}Y!1UDzeu>NhC<zaT*
z_RsN8Q}45S$Pt0U1QumJYGNma=0B3JCvz46zL@o;2??~|#D8T#tHhZ`W~^dj&F(ni
z^tTf6YOej#Rx#Y1<#Z3)BJes{q%MJqz?rB~*jXtx$D6>UpzBHwOZi^Iuy#|Sg&c}4
z!0ku?Bo}h!jvm<wXD65;SnKnIjr^eUPS)huf9<h&xd@n#%BX=0NIYNDDO6~hZAJ(a
zLvR|maQ0;jS${<(4D*9chYVc+6vOQA4Zfj~cS^KXUx1!WyT_Aw{Lhnr4i`&wUVH7X
zsuC(8HkqgP4*#HMJ?SYksXz>%@BgvCcx5=5k`!?Ff<PUCC)7<U&=HR7V5m-07BChB
zCd^ebND4Pe=@JnbRzcLzq(?rHSEe8jij2L0T~~`(2!9Nuk3<8BTc!azR@kk~GxPG?
zQW1h3irio!v`DFLVG=}wS@ea7Gdwq}4p!KmydRI@EDt|d++T{*Ju>7F_34wjs*8VE
z%10sx`p-o0sTjNhL&HJ~E<`E--xDzs<9TsUm>NKj4cn?;BmE$R2iVLW4zt-HBAI0*
zM{1u$+<)e`8HYp!_U1%53!;ehyAKi1HqrPLK<c!A;z@|viYueX+yG?6;jqVlAnO_(
zm);@gQPLOG4gI@dSTjnPn-g5TcrF<ysE9uf)gv_#t~GVj<EEy18GhKQ!17!sSmOOJ
zCRsk5PKND=PaplM#a29cXco<uh?Y>U>jakJmVbsrjWRJ-S82*RRn7^OzUDO&9)!g{
zEbIcyG!fZZJp9|)dTaBG)+Qev%zW2Es3v(m5GL<nMbCNQDoav}CbBk#`}^B^>+_Az
zTX(D6J59qV0S>H=HI?(9_6lKJQ^~dz^RFi3&3F)Db~|ukO_0LppcT~TeI?1RB-xcD
z`+u8}WI48UW`SOaN&ul><R`=V8B|TZ5>QtH>Tg#--4PYK)5QNVQXP7w@+3IwL^rI2
znm*V9(cxqaL<nc&f#D9EGH2w-NW~cnTG1ZdgSdgH)&qyoi~bb#n78SPvpGDoFT~Ya
z_;3!$X@yYUys9UPxkUXs1b#4)9V9KqOMj!%yy!vW--O3P(~Po?+a;{9G|95=?o#tc
zX5O#{&SyC!fY}%4J|i;G56D<^%fLa2A^H)(iKr7*4d#NqNfLGXB&JLUK!G}vW;3*R
zRh<b<j8Eaaz;D8w6x1<bK{eC(5Dkk9tB)=!*r(kEuac7ZgD>y}clM!Tta#x6jeq+l
zly3uC%R$5w`fw@<a7v4Y6Q}^NYUuY-F=I_S-0SF~PLku~HE#;o@G#xfjoz;0B<MMe
z5l(s}HY(g1!U1cpcN`X$VOcI@oK;0s4d7TiQSW~qY&HM4xcRTU&A<Hkr%!uEPUskM
zT5jkF#7x1;fxac}Wp^ep+S7y%41dXQL(D?TK{>C|fn;ab%g~!ki!NowXrXCd%sB<B
z`HD#nc4(iilh5fkIgc4KSbRtaNamX!GA;}a|9BFg=7rdPE<w`X6j+(Lio%TKd~{u>
zJn^VFiBqp8F(*HcEfhJFEzq%OgkASy>y%U?o+-IOcjm$6A2JKh#bOl1tA8WHLF)>y
z-h$4`<g-_!?0m$|f#>BpTz>1VcU|FboHOw*UV4*wEX`#T;%qs2KpG^Jk=@p_N@{g+
zXH#Yp2#@)zAp4Az#zQLEincj51&R>sp(cLwlT(;ecKBfr7GSsN<Pno1wrR)(tdv)L
zSnCHJk{nZu5Si(D0^f6Lg@0JbNdm`3@f^xEjt&}wsrco?XVWHa&P}x~?h!Ie&MLe7
z6KFOTd9Kr)a;sALA+bQwTahQE#;kJUhtLpR@K7IQE#R7YL;rilmud#&3T@zF7Kd&=
z%$36vE>|C7NqEh?Hsk=%H*>rq?uMAV3A-WK-VL2|50ukQmdiMspMQ0=P!XA1I@9#;
z>LLHh2d5Ick7+?xgs`g=PK`NBv8qF&n&7O5=~Vto$A#;$AqVk<c!er0S5?FlO$CR^
zU`=cU?xMjmIieckyuv31`?M8d<#T65G7M~FWN|*|mMfWBSk9P!-aVx;6I~*CGM5!R
zn&DpRqS|m7*>MHysDB<AyraRuoG?EsagcMHnrbOg;X?ixg*fI2##uoqaTn;rCp(LT
zq0KJcV`2ZC&pTws)0mFSLlU=umnQ;)b8v<ay1J)G7;L4oea4u|tn$aEhu)4uD&V$_
z2So8-h5mEVHxiyD2^xfV^07q01tN+bO|LT-@3)E6OkAYk4S$z<MMW5MCv2el!3%L|
z$aM;eb0n-$JeiUdz#<QqmU69y@v$CRn4J`tgvYL;V}BFTu`Cf?-!Xp`czSu@>1Y*s
zx{5rVhJkK+e&02=ZR)-c>vAW>;SkWEgnQPR*Y89t2QmkcaUmEan=}W>DQ{e@QG#l=
z%KpVNF^h=M?SG;#a&wmE?0xr5DPaD#i=c0E=sL&l_)UR@cEn&o9IgwnMXZne46QZs
zS(83%+Gl8>DW5g<tB|_#hE++*98jBh*yM*?_J?^H<hBzvkjIeYjiQ>(I_Ll3@F5Mv
zLimvWDMMY%E7XYl;2{muW<My>bVcU7zO}nk?sz;-=YPvRdGb^Nyme}yKHM#TI2@j;
z;YH{1v=1K2_Lo$Iw0IM!3y3g{Ebi(DcVcea$pB|D>JMiu&hwWC92652X<F+#ancJ3
z?m?~Fr;s)1gM|MGc1iT@ix<1mBm?%H+XGD;p{6{nYp?dR{;Oo_HncRJ^TVcdH%3`A
z0EI<e27li|$?xK$S8-VE6&@7JJllG)9~L1RSgK|J?}Y;SKTGeQ{{6*^u)yg*r==c0
zez+SJIPQ;&@3;O1<;pfzDSA9f2VvnD@0z@V&0~63>b-cE7W+?6e5t7RjP^kvCeudr
zILnUd#(OlOBJS72c$gp<v~Ugv(Ks9Oin<WRCVxL^>Te_nE$@mtW1!LvllhC0XcTiY
zq3l#S*bn%PyWIuOt?PjaV~LvutA!Ghvp5elBI=597cj06jXO1kK#sd=%)I%jfkpN`
zCLIY+MV@OZ!!_5iQ`LmZAhvWdI+M8%aLx(_6&((fVJmu&!R-TvDY0GCO9!h&R9@j^
zqknl~uW8cfh<$La=*UwJtaW!?ZlbgjsXVIDXM*ZGe-R;!f1t8{ItkJ|!SX=TERmLr
ze-*UI9+useWvN9%+L*iYMos5cViIW(Ua5(l1JB2)q)ivq`6O}96EAl-?ZpIkCN|HR
z!k-5j_k$eBVg07pVmaDh#)wb^=b0ON9e*rB-i1lDiY|dOv0QeiSq9s(6NjQnFryjj
z(gMcIhdMCd7Y9MzGO-Z41X(zGmzy`-73fXiJ)~&|fB47#&JX{1yr>qAA}XdJV@6K3
zbLS%oDuc5YNwN$>KbT}=5Bs3Hv&`V!JiG-v3e9agNqmEgL6q8nX8_~DT5V^#oqq@R
zDf21j#!}8qd$9OqEY5;^mH9gk!rL)t0cK{XES0q@a#q5_qtk4Eon%869ppQ(x-!j6
z0F0K~ym&445^Q{`fB!5QP6eZlxeK=Tv!(;bTN2vAVlN^$(=X^-vQZG<B0ydZNIvH9
zb%fK67sRKX0dg(K&?joqS4qOinSTLHi*tf(L_xS8Fa0n(KIR;5P=<yB<}?&M=)ZJ}
zV-7Ec!kaEWQ6=eIRRRd+81aCor1cQKaiY=unxN{P$oxS-=S$bgrralolNbUSqN#4n
z-%TnF$w#_DHJ#?k5caw`d4M}DZE>Yu8PBk;xJX9s9j0{0|Ay|3UvoDktbaCmUDf$n
zU=Q)r11dW;FTnRPk+h;;!J^?!&XQYdIS;bY6)4yx{0G*#1Ss*YtjtoQ%A8GQ&R(#X
za4od3oX33=uhy~hy4J?>74C_U;2Q_%4uE<^GBeSX9N3oQN}wVn8k&jPI7UQ#bmvYk
zzK5)L>rb)(U<JRX@nP$DHh-D5>v!(3UXkgTr2kY;;?TG)A@bHSwrLAXaUnf3tWVk2
z4K}+t)2!@}IC{88{6O-0Om*j~XRuxuowkoALIy4n0-n!&nm;Di!do(;N8xHwj{v%9
zQ<36ndd}z$((8aEND?C#ikAwd)MKB!9+xbxNRhX3%VrtTa@Bw_p?{D*g5VO%(po_N
zNG@IMTZ}YsP}@=gWv4Ic1UEC+6FYToRz$TE!s``*p%1)=xGBl}MuFp4LE(Y~Y9vFq
zPNt{B+ilOv!@MBJ^1%h7+3S+55h^ZW4waY|6mlN^1HK~0*Lrt_z_P!?rhXzYoR%J9
zo037^1qD-u-3kR(;D1VaKU5HzTRm&i5GOIT<iXMIB%5Y^+OIYGrtT*SI@6)1`yFeU
zR+_cLl+pEY9_IP5a@WMP<h;E_RZ6W!FZZ6zv3LGEyb3h1fj(`ajzVuA)jE_MI!zfN
zMy;Zv(^Po--gWI8KKb5J!7u`#IXoef1AQ82aP>d^k>`j??|&W$OGP1ETqZ9b<t$B#
z9Z$8=+D+O;7i`$Hblva(he;<dgrX>ka!FkMAp0QYzFN_vfDq+O!py!S=2~!`#I?XJ
z-x(utGhU)+EY3gGa+da$ltK*R?40W1vHN`gg|%(!*f0#97URSjI&J*e7&SdUxjR#I
z?=oV`;(Ke6x_{P`P)!pWn_NN8ut*OQ+6>HdY2M4pF^A@`z&e|-RYiCTcK;2;E*w?%
zSmlN3C+S%zpgJI)5C=s1K}+>A4;DICXL`2MvWziDT>_3x*TIr6+E(w(9Yy|z^>E^g
zV#YFXqHdGW&<-5xR4m00v(mlrW37FN$SB205Vf7DEq^(LzX*ROh&Y#02ihdG6@Z44
zv-g=bEM){Yh8{aDi#67Y9$YwJZ~Ly;Tae$0_)6H;mr_=TT;C8pNa74-49_h!{Eb3e
zo5aA=T$7~AfF$?8Yj<Ho4sp`CpLnI#qTCG3N6S_9m=}~b<R9cf9VvjGn+z!t4+da7
z8sSI|_J5zg*!5%_1_svL9nnphu(K@3Cc#gED`|3uRg${e@Z4yoc{4wqj@xtsb_>MH
zn_<-#a+0gvt3bk}V}`Zp=+;_pnh+V`V)EtH6QRm?DN`xjyy{QFFPN5xMoB;4*QUqI
zh^7OEllZE<VQGH?bro7;+gy;=T&IF<luX1gnSX<MRdz53%)EL7v@Z+t%f5A9%@+vf
zH5XDQrVb%o4xviSh)lu;i<Z8)%1*8BK4)!AVY%a6x61Ny&Z*&-4>R^k`{L&I`Lj5u
zZQZAkxaK^hoOEnV=T~AT?Q<S+tg7JJ&a?gPy%&w><?f@c7u${K(e{(=7u$8HIb6~p
z&3}d5h$NIE=cpCQMLkU?bIFm5riJB0mvV=b>{WSnoe4@sZ&_1EH)77`CTkjWw2w%}
zv~Mzhq7%bT6&#zUOV56sN6J+Nf`IfV>1X*xK21)q-YxRM;+=8@L&ITbp?PKbG;y&-
zXW(6DDW7p<&^yl)cjyMw#O2?4mO>NLC4a|g6m6Zx|Ds`{Jf|so=gBI~i`bV26LxM0
zrp8am)(<zD5A^Vzr=ws|yL3Ldq?|6GHXfq7LnZ~K^U`?Ni3(8PmQ2#slfk`w=h+CY
zhs!6!jCmXzxjQ>-@6QfD@RW>a%<p}eInge@`?M@InwI9MFa`4;=~T$Rc0UIh?0;Eu
zx`NWrh#_F}oEE&s3@T;8{E<vf(=@^1+c%+}lRwdtjA!{tLsoBFzF2SF)u(7Ad^4Ug
z>=dymfSDC(C<42B<)m|G-hqf0t<055>4Ez0&&!gGWw6x#jB%B0(9E6Epl#Y5Qy!=h
z8rCjL80AT4j=+fgSsHs;iHe+a$bXH(bebZrWb%$``_950{mH3nyoq}&P+xheOiZYz
zk7U>5(x)Xuzyh4Smh<2!q$iQUt<km3(@<_sl7haAw+yelDy4$Ol5kw{Rpam{1bD0a
zH>__d9gJMV*j=p6gkfnECO{(F)rHMfY!ly#wn}FN{A$XkDCwPvCh#mPEPsaV@&h-o
zi<JiJUGI}n4*xpfNVg>)Ug6w%TfVJFHTG$fSYzH{uq3k;3&@u^QX=4w7}!9rCYJV@
zLCq!ug=hu<fdWPch#;AHC!ev47aNpD1800@al_Uj(qOp^{@&TRv==sHGvEyjOLayT
z@z7-)ys7IcdRGowFsIA>Rew4jCj<2^WYxRL$u@KxArLjE1{8-2#ysVWx*~A%MhjpB
z6!<rn*o;ZcVMYxfAg0(WkJu<&h`cN<^m^CNc~_mMIn6>>K2sAY`wSRDUhJJJnt4AP
zBZXv`td0*Zpw|^`h9yD<52q4lb5IZb0<NB{1y7+G087NeX`NEDs()Ha0xW|}Qtq8t
zRXxfoHb-eq;Ps$>j_9WPl(V1<&aQ-?Bm(QMxY15ZkyB?eDq2X~Gf3i3M>B=96TPEq
zFLRrdnHb&7=^J`AHo{4)-<<Vh4irLiPan?M&?_S`xsD|*?W1H$Ho_tpIHroXG9r<&
zEx|#-%nfUr9Up6WPJdPBg=2f%!K<nthxu7J5~TrT9a!477gY`$s<hg5FS-o3;*Dxg
zk;{WGDEBF*%P*(~iAt7^ut*^kPr9EZr7~3wp5Z<|A19;Id-M>tk)VHg+?B7io4i0M
zmAjl8`HAS1(JNka?UDt2>Kt*i`^8>!1!%X_q~!9D7B$u~)qm0sgapYz_L6)C#Iw;L
zrDHoIDk9ZpVII{}$r{o}<^p+bA@n0e5sk2Z65Q=;#8|{!jG*6s5>zqwikI#sLUeiZ
zowhK{Hd|4&CdS3N2&ZK&FBXkzhAdx*x3z7Le9_1$Ya5O=4oL`mD_0m&?@4ayQ=4o_
z7y=L(XQ#5j;(tO9c%k+Zu$asV%<qzkds*5mx@4VB=Ug<7I_^o74ZY6@^>n~?de3(@
z9OHnSOoNx04B|J^o76BWFo+y771tXsPliLs5ce-S|3^oxe=|=sqMi!$95x9u11l~&
zZnN8*Id5;J6W(gqb>0S7a%@J#*nR9Pih>fA%7HyDs(-cYL)O?T(l>L!v^qng^_lJu
z;KVR*&R%7c<9L+*%dVkQBOrPW6|q+x-!g|&ZaoUz3!Mp5!%?jW?N^v~kHU0Ht-`e7
zGRS75DU&Tk<e78bkP~l=!m7TGqmxN;bg$~Hwc#v?#l9_;n<|)vd(}}Ua9!2=k0iSX
zE$qqc@PF%ed|x^x*xEjyC3^cRxu~j+me>H?URfc=<7XH}Il?*mSs+Ft`XhktmZYnA
zB*E<dzn_U@=uG__{lINA>N7QV*?&J%n@#;MvOgpLZ0_CSXNz7h`;Xg<$LV*;1@~Ly
z<bU=Hr&C3b=zssS@E<*6)G!&c|3a2Jy3gO<cYk5>{1XlRT-+LZG!R6pt{48DaA3@0
znJ$-~Gs>MNAS$>IbOb2hC6C&9bmxv)Esm&L=7!2fMU_pE<3K>pr=0bIw|_Mrk7a*o
z9Ih$uIl3*XwyUiuX&tv<zU*K8d3-eZ*YSVsoJ=!;K7Ya8L_oU-z~}IGZ4+)PFku-I
zf`4FtsoPamzFw~ux8bGx@bdrOaYq)m<fVJ^s%`d8yHmC&)^TSL75C@Mxf}wFB;!?6
zZVT}?pqcYKbr)(Ptp7FUjoRmGps)$sf2M26c3#J6=%y9NFlH&Z^{CkX&L|+R&x)Hu
zV#AzF@iP<5iBI$$8sHApx)SGsiHQZCn}12CYEf^xQiyNyH3I6{qBX`6WR@sEzBhFu
zSF?sj->h-|60L(PlV}i`zh<nhHV-eF%${(J&v}3q)}&H+2FnfXz-LL*5`ENd6%InB
zNfC%XjED`86>gM0^wOMw@o2H%?NX;(I`8+R?J%v){%kBe!R>&<M4dGRW$8Rq=6?p-
z1Hrsh^F!$W9o%cg)=bkeLdQo6JBN5?h@?hHJ=B3aL>8xid7A6L(s1tCZC#&Bqb$C5
z&fnWr?qjHY;3v;hIRftP-R=oAU0Iig-?gTT^H=2B#$)yXeK)Snee5eLb8Y&#;915`
z;3QQyFv!sWX9$9$xk`(LifI;ds(&$`mL0<189PGcQEMvktrwJ+Az)^1J}DlzG#Mre
z5C^W&MJV6=h}IPsW#Id<7gnYzAB%H07{Gg;XCesA4==OeI=lIOHg~-_ChT2ry5-ki
zcxT=C=DXHK`0llGPiaFjxM1Omq`zj9p@XWmeQ7)II&*4!y2$78eY91qj(@oJEALbE
zlmsp4|DtkFcOK1mG%R~nPlG>0j?}7p6z3<083gtF(*0en`@RQjx{pryp1xv+IGXFJ
zvBU4y-S_FKa?g2rPLZOdt717ZOIbEdi01sv0vg^$`mRsMP9miQ3sg6P<Tn+in#+t>
zFZT2(9_D&ZYYtAeq@u_)w|^ac`W>Tf<EpP1nH3}R(HNOanG8p$J|2^Cp1&J^an7Oq
z@P{aI6+i3;48?igirHCXkrL>1JYx-`QvhX{K|HZQ|Dp-iebF$;7+zbKBzlhXpw5+?
zDh)}_WvTNy)652a=MKKJg(d-5<2)D^6XY}3%xZ%20@uStKYG6N=zn4GrNwPhy)$G5
z+Sz&<ak4kI$U<RFR9k^qoaeKu3So(g&n&audon;S92pSN2(vZyEl{w4dc{sIJSg?x
z&#h#b6Bwmvm<k8)@TQ}}j`Vn}T_*0R<g)!o(`F1=nZ<G>{3eP6&rL06roOouGj%0<
z^-k)Ag*@5&vS;(Ev48V?i+3&EyrP3BD9LE%<u&WIXe&CGQ`L6{_h|9Lr!U#EBQU<S
zgLB%|U_xkv-`6<g`_Td4nfUc1^D5$_8$F~2f!>3zW$WcW0~WcymU}6$!_M+v)lU90
zy__V+<xN-W<(`yqljxPxCGM%fk}U1zi)<Y2as1N5Y=X$d8h;daji~yp6@8yhj?+;Z
zSL=m+SvXWoix!@&cUQz+|9}CSojsf1_dl9@zpH<q`{PFc{k-6>cdY7K&0*WnVs1@F
z#m%z!%yedUBe2DpZwV!{ym||H@0;xLJ-%#gkK-5iINHCO#JLTBvu%Ef)bO7BewH`S
zlYH9TDD3*Vo_`bT_Fw;(|Ih#L|NVc9wnvQCTAb&}3`tspcx;|&^^%wf*f$(-W-g{J
zjM6p>u;WX>PlykXnw0{`q?erZSR@AwH=9IrOoB=h0!p*{YYGw`hJf*pM3R^bT>Nh?
zS}3gc74pF^ARh1@x{<OI8|(&p&hxxWx9ZhuPOA2!3V$C_zWJ{5M-!jkcFy3NWkJNA
zFBM1f&7wqNLWQ1g4${>CUeE>SK&6ggUI>Akp<7;FR-xk5Cr=)AyB1?NGzeReJq+Z9
z7X!~{qhWeV^54Mw5uGb||G^*;e_l;j0NX!fXx?V+CC!aH|D2OSqOcGA7#Ol*(Q*E=
zE5kF-GJhmem|x4=-knT}H??@Z;rdv}SHsQwyfi^RngV33^W+E?6NfBFG)udkCf2eT
zkQ^5Ol(BotSu#pFQ3G;<v#+6gMY-Tm<QA8;WU*Re+%}z~)k%D&?wgV&MHo))eBX0~
zm{12p4)mNOLA%h+5_J7NCfKT*pI`JQ$nay+mw$<uhzVdm_n7(L4CBc$y#L}Mq`qTu
zu8{ke<>&ym!a+$~Fh;AOk}Qgj*L3JkK;<+bmrx%or`N=18|}JFqrq+%&IF)|b8zoq
zjU*uHw<*kmlrf5YaNuc+7y&X5lWb_9CM4URCORZZ6m@}bgOrx^!JIn75xQT^lCsdA
ze}9!6u~1-e@7_T$|2gufkLnhH@88*fi+vNW(g9pn@SW5LA5!P=YyBsF7Bi0JEEzoL
ztmq4NUs*1hIGM_CvBd()<@+-9hwyE?q&mNoed%=_1>+HGMV;_h9O6fqOBFQ5`>og-
z(&=Q3H`a<C8l;)?k>boQiT50K7Dib4tbglLQw#1aLN6z$Q7@T^h`HJOU~@^V$Nv5k
z8Id<{y`*a!kB@|LVH^Ok@}(IJB<8E;k}A@$^Zm_c@gBiB*niS~@nl~jq?H1rZGWZw
z9`+?I<gS>COJ_W^A%B1~e)(K(hueu=kk4Yk<6qe6z?#bE_`p;PvQynAwe$n%0)I(2
z?C`4`qe~4&LQktCvIy48ur27=?c)gvF^v0Dw;E+9(^I#Z^?TGrRrFe-b)8qX>V$Yh
z$5nF~?4YG{S=-rqT3>#T`?gg7tUX}OE(xH^<_!v+TuzPA+a(>41f$ib7YlW})fRnY
zd3{`xjT6hy%6h1AHcUAOCF1*(>VFg+1LEn){`6v)%$;$(A;ulA6zGB{Iy~7QY+o9a
zmBPF<na<*2QxH|P1GHW9-~Jhw+y#sFrM&rN_N7`Jf}`+z+nXzwg_X;~ujqS8m+}p?
zk@@D8ib&P~d}uwSLVPY#>H%%4&+V_BCE6RPj;JFIjh}xo%nn&)TmT)|SAV6ToAyGs
zq%hxfV1y93@`BDwr*Xcqhx-jhLx$hIfb+Rju1+V(v9ZwixTsZjp*Tt{smx(I0^6c-
zHMb6yO$2esN3a2mPtyK^Q@S`9HQ(%}{xeC|RbAFXRe>It>Q`@|O4MxE91x)?-=`W|
z{VOR7UDC`2TkIv%|6nN5_J3Tq?uJK^EKSQ&eIJkKM1Us+=-uhCq5O*#qF9kRo!+vf
z@%plBFS-_+7m_H}ADdn}*tf`<WLe}~a+RgKOA}KpR3uycx2PH|mu~L2_Is!@ZyoG!
zw&i4@I>EqgKep84f7G*sY+?&G{l;Am4#YO+!~~M0N_P3R>&3P=Lx0GF^q2##-^mnm
z=sxC({?1rlMO%nH4$x*ntXjuRxmdEWT0)CRQz8yIM*BRTB((SQ&|zzdPT1jMvr1Ah
zK77wYcP)T2`>kW?0$ouoWl<lyz+2lo-W4=6!MwKgR&h8ZdW;G#VSvKkMOs2lx$fu-
zqT?USzK`@`F|Ka$rGK*s^!W2`{?Fmk>^`>ooJ|mO`);oO{or%0>|6XQ?E(KH+y(Y&
z;GZ|*aOkG-jdbo#N6ifQ#?!=m+l5C?;gCxD>YyjTvg?1)lWRHu2h+0H|Nn+AG#}k3
z?LFc#e+}=nWlCJO(Ue@PV3d*A!%4KW3*I(ZO?3lb;vKUqB!9`HHKKl|U*_%syqr*U
z3#t|mQD&H;T2FqpUY`zo^@4J5GAhN^y|ibb|Hb-L&9~Gi=9?v55w4`zA%3R)K|+@+
zhboGSJSVz52>ZKh&wg|LT?w!&0rpoDV1w;^13}hb99IgoAr<>*4mJ-RY;H8!ct_^K
zYG|T{LX~Cy!hgNk+qe|HcP!}Zd3&-^bigSIIO>NZ@jb+La9X($OMx`mL(Q9%ul#gY
zemW~Zoj|ztC-L1qPZqnhl=yph;D1H_KIotN9$muN=bIrz|E*@bJ&=7YXgfs{oFTI0
zWg14LD;}qCA;drR$Xlv4Ubm1nL$lC#KBNcD2a+E?qJJ~Z2lR3IK+?xY6k<N87YZ%&
zMi5T>?rZze98x}{pUBVA0S$MV75v&q@Mk2vu%@Ag^gzFuPLNJkPEG}V(4}Ya?jXO2
zC&vdH?J}p10weZo`&xXk(ayVF944X9192HWtM@>bvzZQlY)v*=dLv64rIvah!W$x3
z+h^I-n154Trth{MWyc6wVML}ER{7nQ_Cxq9eE89RztmrWa~utk@7u|JHyQW`@F@83
zqn&py_(1EsQkkq&CM%o&%I3ea`LAsLE1Ums-R2LJ&p~$lPFmT4ee0?zDP#3%Q4OnK
zo%}NdV>!)6X@L9A>FlRS>QR8@6?XucdphNl*ndIZn_@In#}?E?*1=!d25jB9mH}92
z>i28?{T*6>FGcjV)iVS$j_=cSo3ihg%AfXWh)x!Go#cW}mM;M*yXHL80r>y3_pj@1
zBUjom{5w1fM4iNvhNO1hDzPW>rrk=si)E)Lucj{&Bq0fHl3)N*veN1InuB=$yeIG-
z*nb?!x9+v6DuAFw$#Of-jPuNs$OKR*RIOV3b*~HN{Kn1M`6N_)EU+}LFlT@At}=IB
z=f@228qAr02<v3Rg}>N33hyl0`_Zc61n+ta9qo!s?5GPpM|?Le4}(iX^>jvGQP{qk
zH(%7eG5WrOjiVHPsi9*-f4)F4dOc+M;D36`hCS<ssVW=tYv9+DA3`<bG)wzQGlE{1
zY0EVrk;90Yjg5f?d4**aLSOqYQTMzQAlVm?`HNs*7mMvLAmw?M+7hb+h}S^&z#g=n
z4!dVBlIwcwf#iTavOhvl)UwF5F4Oeq6FGtU3-~vzF!%3&mKydJ)~9z6QqmQX4u7^b
zZ`--(^s;HE1VAbn2=+zjAl;7k(49=UADy6MZY|h5kH9kypO)ln@SG(y7^lQR1JK~!
z{;eW<{^lK<ugP%Y(sH>gw6(_mFwV|~$$+dZJlxXhwrJe7XgY(H5PPoaL;a4qxL;7D
zgtp<#+;nyUYBVnC$)BEc_u)eJh=1E=hs{A?P5dcK$HBoq<Rpq=I{r}4aMJN9neQ8a
zz4zwj_TRoM-aK~9@T>OlReShi+Jl~gt7s4M$mQCD9k9=*J<R$a2EFSk5BjJK^7L_4
zb>JU^gUq*U8|=Acboj+u))5d1`mbN?y}2MG-8X*(*EvGRM)PmPLv4BvSAP_@cngae
z3TsSS5PKZrZF6o~nR!#1erhu}><&#Loy<_59dw#J*ojvA#c31Vg<d;tMn4wB_30dV
zPp^5A(T{4B_VcXBj;1a4HMNL4_t46)>B<?J)_I(kLG-DY=kzCigj?rm{&QS&I!)_G
zVv1F&vcEmEe$m#TO%{o+Ab&I%bRspc=vhvrs!??A%h-h*wWHs;y4H>U`@jAVFTV-1
z?!mJc&z`))47SkyaJU_P`}XzA=vJ{q1h4^bbz2|5B~QniPJ<n%E2x6y0B}0yf{ha`
z-ALFYDj&ujuesME`l$})X4TYRXjAxKc!m6ejlr~~yTj3Jtf!dO0DqI3bF0T01<Xk-
z6vFGZu*5|-X{iDiJri8l@)jKi?P+C7bM-8)EpSLyHg`uL#x6oak(PY%!1|+_FP!N5
zij>-pxb0%_Q0n`_Iap)w{&&9N>*nFn+0YNOSc}hg(-jaBrf>PXt1gny(@vey8#|p(
z4*tr47j!t)?1Hwo3V-A&%bL3vl*{q)8e%}CoqcR-Ls>Qen41L)QdFZx60-;vNz)tL
zDoJSJO*%<P{n41tD5eb{b*Pued72dd{42={0?IM4Si|(p!-<Vjv*dSoI_`3?!n=;}
zrpZJaD<9IzBv1>}e<YU;<Zord7Qrq&n}j=tei462mX0^!Sbq%Z0U1X+pUQd{CvmR*
zO{I~hs(P+-H>l5(-eF}4FaHjZyu22mn8GOJz?_%QrWmp$f31Y9DbO@gHk;0unH^Ni
z%tW46#dl4eS@HMbH^L@bTVZ9{vyc5`crCe|$dlhhFYSQKU}gF3$Z3!z1v;QgXiUWf
z`|suiXJtTXrGHAcmy7yLva=*dvs6y|phLl>g#4^bK?0i7lRTRppGbkpY~tIrhW*z~
zj7clW((|kBkHdmaDE?>75}MB-z|qlmLZfg)@ZIPT%EjH=bc&#84%A>JGWkX>wDdwt
zFNiT$jL;4(*Ox)Xcj7e&gcUoL2v{o!?6zo}76*^=7Jm=3=Hp;_7}g~Mp&x>{ACW-#
zsZ|yaz*+Qpd(W$ec$tcIw0j$0Svg-FCdYCA+!pbWcO)H8X6)aYWMlYY{4lq9n3DbL
zqm6jB!_Ugt=rL4E$mcI+!{SzS2z{n?tS$Nm(fj?{!`s1a9d}!2mX<9AECobbG6?A>
z8940!!+(Wg>eYjtwNH>)^6od#X$IEsQng3__DMG3ChLwtNm!q3R?=+>uRF`X+mmyS
z?~4k(dMM$@<x5t#I}?7QzG_vBRUDjhXmLCl{a8qGN8JAa_KbV*ez?jG_%+MVVM}aV
zF){1sp(|%w1+wj-tv#)pF@_}!Q9e(j*^tb*p?@Yy$iRP1ix~^GfgFiB;xo!XPjou7
z2<p?n>x9>X4({oYH8&Z?=N)%%c!J;)`Q&paB2auNC)^8Ceh-eL#>p{};Alpxd&kf7
zbP&ChhP>~RkE8=7(|%i&$;Y+)Pa32fn=5hFKSW!bFCVX!Q(qRc(fK92-{FBelCRPM
zJ%5LX#ueGH0>)j{i>YJTyr=XolKcGSfjDS1y4|jjcY_{-CNGDE9X|v6EzKH@L2|^B
zV3h^oZqz%ULcJjEA(?iN#=VOVh#p3-XbsnP8}Lc4tgP_=zJ&(uf>`{B=m&n0M4U<6
zAy^4`Y%fQ<ZS!^Ndtt={kHv+|#N8H7=zsM@)A;3;oNR8fw?YaNa#|?9y4KLCPG|Wz
zc&$HC@>Z;U>En1_o!$(N68ii!Yd^+>_Fv0N>A2t2E&_~jKLx&Va72Sl25q*zc!bsP
z4dIGE^nYTcP4_Bu^Z1?K6`gA~8X@1QfS<HLQUgC=KR=9qa-Y4D)0tk`jfTm1b$@WQ
z*7O(Do^;pR`osJ^JTu(rZ)#67(m2WB3~t7Xb|%vJTy6$%!RprL8r@B7qCZ`gV*7`;
zpbO-K;#T<hcs3&T(eLP2$Ou+sw(7@Ni_#-pDv}}O(11DWYC7%@XM^P7EgGhm<hRz^
zq%2R8!!0xh*o+cHb3xJkzMo}*bAP50TQ(daK1ZHK%WWGQ5eu?_T={o8*0kf0pgp+O
zA4dQ2;^04czgMvo&FClgr0+(z;yjPfZ$&?^{oalEJeiiLIUpZ=AF^hZ#*)EW@VY5<
zr0D_Q_fYPaCaC{(Gie{#uf^f!55KR>wa`b)cNd4jz(4qDK0$t2&RJ(L8GnPZ;7&kz
z&%S#$O@~EWD4Dj3y$$Yt_TjqXKb228siHM=_oN{^oecQeZny;g9+3I2n^c=f`gnTc
zFJnW3%f&G5C##!HV&}xnvB5&NdWyF;c|1P>p^)8R;`q-ro5sU~#a}Qt3;ZWOjZ?O)
zE_l#A@UxKX?;Af0b-qMrCV#EDf@A9>JF~9e^+Kp##P{m}8^41kVPbVIt@7&9%&a|0
zO`Wq5qSY|dv#S2Di4dMQ0C-;Eoy}_c>0+JsM#>`BmKC-fg=k2lb2d=)_k*3+{F<sL
z=EdA~mzNaDD%L_#YK~c}4p}IKD{qXr3`J8xrzdm#ZV9P;sqAHk6o0!il<9`w@=f$2
zgNrWs2>zW-C)y`?Nx-?-x`%<+DR%f9f(0y#Y5f9><+Y0%$sE36DamZh?z9MJTk$a{
zi(r;SBG35GS|NOiY-OROGLirG@-VoqV10q75J=!V%L!m^216FiX*`_SyV7Dj8xBeO
z(td?9xK3`9GE!VDwSQI7xJ+`JB66wZE-(5`3UJ)>#OUENIW7Vz(Ea`=h-wy!LgeD=
z<rUA90y=lSFjp7HQC1a{OG)|iDJm|I^-lJ7YNfuHo@M!Oy6GZ4z}>7`uY5^maHh$B
zkA!2k(KK<@?w}o9i*}>KADWjb4#{XTJ+DrlR*z)eD*YNge1Bvwkh6#%*V+kf@A)eI
zg6sT04<AOiZh@ZUUlGpg+FGsJA?u|l>#AR6ckM=-*HKO8W&iS8$?LfXox|@FT~vX7
zVqWEM<JmaAW<2=Fp4DNh5n=Zu;zN=$g7|CGrIgknk+Bnp)VX|oVIn#Y{iV~;WfDsz
zq4QGRObYtv1b=P5;Y_zr$Xfrbd22VDDz~u3o_0O34&9E%S7&qvl3CN*)ULG`<;B?v
z3UkMw+AuCT?!sc(@|0}Apj@^t{r>Y2*wUZrP_!Q@+O|*We-ynUyOpbezb1lxO$7UL
ziC`iCu8;<%67$kDFd6vsC4qfA8-F-EiHFw%DLwK}2Y*9VvccT%eofqS?RYjwvs#GK
z(G1Rh;#WyLvN|^8092rA%gTV8!k1PE+(edB3fy}9;)=nIO8Q?&%-^Wo7Kk6>9PjgC
zebtnS?U2B=koN{e-X2L@(tiIT@4`8lMjNsF@q(3}W*?GqwP&>zFyj&<0!@XihuQIQ
zG9W=94Sy$AGjm`;>JyLgazByWrlgn_YYRa_-BLUXQ}ctmH51NZDce^e{Z&YRNg?fs
z_9}wf9=cpqyWu~dxPIP`ub26C%nyF!5H4t%$f2!>>dMssQe1xtvE|nyvFE4hC}~y7
z_5npWm~ljfq*-Xdw*?~Nf_Y%nK{ifY%ExQ4NPo%t`f*lFy(mwQ#~=r$58ehH)wS~(
z%g;S{o6y(?Z`K-J1DkTm)4-Bs?O<Rb03S=a3B}+wPOtSWWpWo8QY_PxwCNX!RUugu
zHiY;?G#M2wPp7kqUd2Wn9K7c7M`_XD*hWUyY|_cV?aQ<K%9p?L<(uTo#H(Hj6b@-7
zq<?wj1=E<%8yc6d*6it>?T*~kv75rLhHg_jy7|oeRgsdyZdJhqG$xarikhE09H3@2
zn+)U+z!8%rz<9rvsRNfM!4LG%umye>O=iUj5*3gKqxw#f3Adq%j3sF+`Iz))Q)VAU
zM$Cx*SErEm`?LIt;;YIsuOP(0{V$bY)qn9nrxcr9Q;1DM8OA70Zw%0+BFUb-xu7iy
z4Wt#!#SEnabO;2i8tHR0=?)?=)dEt}o2A2n8KHw@GR)5TUl;hLX#!u`2(4eIr3_M9
zpwJY(!S39&E;rJhyIj0IZ)<&;!ThDrU8?oo3oYMkTDxBg0!FOtsRAR{uedK6$A4`&
zk{*7`Vra`**MXs0Is?|BQE^s&$HnD*$RC9*8hs_XVbz;L2`~90sUKp8Ig&LPdo#~C
z=#~yH{IL21sSg7Z^wU4=JIIhnI2#v@xjd+7o}SV|bm(j6J}zuGBDaMtUpb4nvV8wi
zJLW#@q8$rAY`L%c(jO)|YbP1S>3{Ho4|~Sf6%LkUPLcIfcK!GoxcSfgSNO2HBNl$x
z6TWSED*W<024k!<%hOA^;$As2_x|nv5?}a5Ka8D_3%)F5_w1`&?tA`)cFcMjbw1wN
ze9-BWCQ^kyVE|M>tG^@MwLbcfHr*HDz7iBy^_~9;XRQ213(we+U-ad7?5lU<t9O6n
z^LU+?v8T)0-e<I`2c)cAFOGYxk2>4>X<k7w_Re9x6kvPcpP_BdKWvQ7Tl@!`*<ssJ
zSGFI7aJ@fx?!8}~!C#%hU)kkXXYh?VgI(qRQ8pZKN6Qo1KTfU<dC<SM4_MgbRUE*=
zjF)r)%kZC3Ql)5%G06&0@AcYaAE$rQPB?@NS`k?3)UOLYK!<x2qF094;?~9ubuf80
zoP(NTfOtlm;7oL!^JAfTu9e1h{I00r>eA6oBTk_}0Lc-N3IOZR+Z9|rnhhOh$-eMl
zgzv5fM!0jQvMy_KXt_Zi)~7fh_bU=+tAj^yp~RdZQR%m!^PiJ{IBc|iqilbg1iL6L
z0a^Z(k0OKLj7I5nYDf$-Mr$dzVsxDtL2d~Oz7NIEUc(DEJA*tvnlf*fo659?Z2VmX
z_F-t!s5rqZG%Ft`i^O7FAw%<DmtlG69y(sgVv&B7D6AqbDZXrE)zJS8Q|Ji*v*CoA
zxSE0!q}J#umO-zvEn(?B&c1)2-bHWH+WJ`f1uCSOQMxp~bn5^l3YGZsAwfG|4-CVr
z&e48b30mTO+QL%sH(^$^oub$bhoZ~zk_4(Fo$5AyCg>W+G8v0(vmRb8xz^$z!^C8|
zgs&rU?eD1GK>9>@xfM<XL=vnVmc|NGqnUJaaGzS+oq|IwegwKwVorajj5E=(kj{oo
zgC%x2jWELU4P<08Wl$W|-}qV8j{Rh{H-v|uD({TTOyeCk7+$3Y2h`2wY9(IM#RFMy
z3YZ*y+x*rQ6_5rLbh*x9p3_YE!>9TARr*kT<DSCm?rX}OP9@8a<FO)4;YCGsxc^4z
zIYPN$aUoHKPZt{>k_3Oyb}fwG3NMk!C4o$)3sPBdN1=)5Et@Sv_sl)#AK(cg$!^k8
z&uX&Z89mC(F3p0WgGg(T7J?y#?^EwA@tf{~9g`(Ur_$+!llJQNO(c~qCJy&WJUnuV
zjdRq~h9_o<+(E^c`(yZKybLve+#+R`vl{59+jikX;lSg0s-}M_kYM2GY2uo#*d$s8
z9_ER@9SJ=!+l$q5n!gRmOTm@k^viPB9h2aURB#YW1n3uLe=L%&Pa1L)b)6T}X_-u$
z!6w&F=vEQ#d@2&BE$Y)A8=f^1Ii?@RW$2!H^{FgFiSw&<L~@IZU+HXo!vh6kMoB3Y
zHL-{q2d`5)TvC6ao{m2VaO5<re5IQ*agx_k(9Q!w1L^@mQC}zrA`r&&Qxclb=skI`
z64I>|_nugYoxdr<_X=g6#rc>HD;pqu{+Jjc?s}3pZnAa$99>;vx2-+ZH_<*<z(ZJW
zkiBJpPqPg^oBAPDa-dBQ7aj{>)2%F39R+4gvEL;s4_tqgC-UoPU*|V;ZVp8$bs_mE
z2-8?uA2s^Z_wRIx)F^Q+v-F(#*3v8T@hd=xo5CQ1N*EVYS#%7f<&Oj4M~~GD6o@s2
z5~yxbd3WFGSTd<#rbd&CbQJD-G$vJu8<Nx9K%0z4njW7_i;&T((xdv{Jh_mx#LcJl
zw|!eV4TOIfPyGS&POQ>?N-c7$d<5tRzp<$ThsN{U7?9#YJ^!rHa4%uZ{#c^wtpHqw
zw<W#K!c#x5@=`{Dr31^9uZn6PM<Ms*95mEYAo$hi-#t563m7sB833sZox;)KbldDy
zp=9~+gxGYtmZR)6DU{k=b1Ax7CvTgu-Bq3<g)D#hD6Rt!wC8|e7YG}?vsS98v0}O%
zx>sM=N=yZ)^u7)8SA%0Qwl?!n-yt+-#OYO1%)^=7?bJ$yKtJ=(uSu?xv!fP>V<NV#
zHkUp!VZ=oCXBDcbTa0McYj2<hxra90-Lcl#W;yI(PhDR&t3|ky=Bau@;#OQ$hT{z9
zYkhxx&-$`Gsv%4IlJ#{l?xpkG%7W7stwMV6hoJS=teAS0j4rROG<Mq2w?Z$DX064z
zFGg8S+Q)6L$@{hHmKO`nb(;L%{ipK32gBKM)5pgJRn-z4P(!);=Gn`&#_hJWxhr!e
zwJ_&-(t=&ou8W>Fn;ILeUz^a!d}Se9En0uo^<(n{>1fKp>-0*bpJ`yC#J>fPfb;Uk
zg|^~z2fyfN6CW6$gT%0?l?7<Riw8%aNO?%1VG;vGF=C|I!pqmtnk-XRRCs#cI6lGo
zBpcFx4DH9jwMO)CU6&d^`i=jTiZ`v~XbfyD^{3HPbS+C==Blo>xpolkl978u!5@DW
zreA|U*9iVZBj`GUG>z;|-bVGF9agt9G%Yvq$BVdE{*VXirRyA@bdHB#LrwpSLrqtT
zbvSp$(oqg(NtZ`CWZ=&l-yrUGT_((rexoO8o(c2uavk@2*=*XDhw51|J<$rB+#&=8
zemQ!wzwzWL9lD7$l1*6@DJ!nL`_q3|F$Vj}im%LyHH}}^Z@IjEp@cv&_{w0vGT6lo
zmWbtw43?f)hQVUs&&Xhry?j0XDo^SVRql%4{2Jh2VP+HlZ48z_U6QOV2T?OUIb0@z
zbmOMgSA9)t`kK`Al@b0gLLLwfa1}<22QKHc!hb#=n-yjwrIDJrc|ESn1GRs&-@FY}
zspLGEM=A~=3Bp@0sO;3inM=!~w~F!y7{6|E@Cj}n%RbAZgB>5e^zKDizYJ{ax&`_4
zH4b*g3)5t3Kd?9Je@Fx;0kNiZD#>9?mGt8V^5_Ls)dI9017Eu|SqHn}dDAs*gNwbF
zrNbnL`vt=10A-dJd`1nM*}i|*5xCHrPEiWU=%Fr+Udn~9b)Wn%(c{+@g<e(_T3h|;
zu3e)D^q&za@~HyuJXM^~|I7YUs!Xk|BVD@S^i%3izc^^*O%=l`7YHkBs^u^hhQUbO
zi=m|4FAGX)Y_vzwV;-+qK&p(>Oq_?k|4$BriQXtJDI4AsO&0No=%0UHI@8};`xEIM
z0`qvC58vN=8U2n<Ao2hnRfjF+zW=SYofH<{J!bLI4d&)Q!;4CRdA^=>v}c__6s+rd
zNhsIK*&d+)<jdk1^0<0q@bajb0N-1XwHHG2%)k4qx$@Oq`D(8GZ!%X(oZu>Ei*TQ1
z>kRY-pV5GE9OHV7Ie35E@#gOx6RKs;?sCAPT}pWgJuS3Q=3r=o@F*={Hq_R~T|cEj
zATh3n>$Iu7#<I{wj?3gk20rEEi)aAY6)W|c!OGZ>MKd}kK0hgdiFAx4rKz=GH6&&i
zfi6jo+LieqDm>nC%8(cdvf!K*zzG5%K%b%E<#RkqrJEvidrp6)X%B2K+Pvo7>pY1~
zyY_=^+th1~Km-E%=zf)^U#02)_KL<!__MX{o)uw;;6`d6&(I^48M$O67S(D-Uc?H%
zoAz=KvImVrgIiW+6>!ghw@Xf!`%L5_3ap-}5q?RPH?DT2S{zmgG8ntfsOykLYk!nd
z$u2s9r$g@L%Nc*KsKjI(@VN@i>uEY(a$QB)aci=yzT;o>`BWa7crnSQ*V1=R>{%Y>
zfc~uLIQnbZ_|&I@^aIH89(S@C#rcN>AJima>{_`?@?(<w(Afe!cbml*2GX->EER&c
z<@iJ-_s@$!cP*gy&kG*69Hcq(a|Q3>4A}*+GPY$Uc=CV!V6OyYMge0KO(q;yUiTF{
z=Bw)P1r2ed;wwlcWj~jSBpdqkNutteqv7q5Yl)`tADztiG=r?FzUX^*t#k#c+c@sQ
z9hw?`t~Gkrmx(kL-U~!)eitPl<<B*>flJvQIh)wFbF>8SIZEfHRa%{bonWcR@&d|Q
z4F)=6aUFl56+J`syoo9W7kC>Y3Ph`K-?6sH<x6W(i~o@**}ptL_{)oC^fDVCXHOqD
zql01G{~(Ry=}xYFB*Pb>LCLZwzB7vD_mVaU5nX7#mWX6v9?&TqLeo2!0=<y*-72kS
zd1W2eMAPKD$x^j83J{2(FF6=xoP@P#b$fI3-{yZ`aX2gO9WQ>0Bxm6!t0Q35&L-f;
zz>K!U_BByz^!rI~mEZ~HnNQRHP>}?_L;mzhnh(I*;X`4B2`=9mb4OfXU7yj~aue*6
zbV6?#53;<~%VTa9thZ-*(T?`U=Z-oJv7+Uun6@sC4<O~5(cfpuED>Uqn=J-z)w#4x
z{BM8pKRM947M42)9s}D4zNmtI9D4y&#gw5ct}K3pEs?CT+gi9|twdrB=caVF3eQ0^
zgobTK(#oV*Qv|wrs%z1X-lY8x5u8sN&Z^n>C3$OwgcL3ub95}V%`4(YKgouJ!c|%#
zoWzsB?D$h8a339>#(64GG3sK=lWA>azT<!H<dxJrLwT2Sm`5sTf)&EV4wTKOQi^w|
zb=?X2NsGj;XZjtL4;|7#`ycq{@QntFQ#$#~aj;GUuNR5lZ$(8)t8(7XXiWgBqUeKk
z%8AzVbFA=_7yEqPCq$5>oJm&09%(ygTz}1GDXk&K#Yov~%5=HD{;EXQ#rk@*TF`%T
z)4~(Ikd-@SH|G(lPiOQjkq$UB8>i}k%#-8UFaSaK<&a4~lj*~4J4Ns7e84VRx?wju
z+#45ZZ+L~(+#>Boo>{QQt7?lQ^CQ$Hgb3eoFK%5ll+zb8V*j)SulC;Ty?EIKs>CS$
zkl|h;f_O4awSra@7&4J`2$|dR6W@RCNFVU}X}8IKVL=(9I1dHgjb5ttZ>6)?=B;~2
z(lLfHNSg-XHO`_13($_<&c>QP6Em%--gWpmE>5oeJ-0i=HBT070xCw?34+{tvB8KI
zv`4%vUuV7vnE*tglqN#*&8l_z-n8luz2EV-bnKSWi*vtP`u=nzoy{RpF4BJ<`2KLg
zc45%IP5SY~DFpJ|yDKRhIYy|v0-HBlS@?n##yN>ZLkcCnC~B<wf*)`J^SBg57$tN@
z9M+7zT7cxGde^{{NOc6)nR2N!M;VTw215u`q7vHj``@J|T1`Oo+IGoZhpIHk(Pt8K
zZCVWZfED-|%uC>E<Dnwb?=gRIs$}RQ8RbJ0*=%8hrAOz|_d1VL_&^MkRi0lJw%jB;
zg%SHxwpd7C$nx{1JugeFu?^Py*8DrzgNZ)Uq3+iM;{WmS&{g>F6)dw?R5G`<7*zWO
z^s^C7Ys&hYLz_lzaLKcHhKS9KCQa5hmmWv#5+c)0K{sd|Ts}lkKu&+6%h;&#;ef3U
zUxKwj;@oY9)wsEkQSm{P@gw|z<d<e>QADe*$dl}<@gV385vAT{6N61mgacJoobIAO
zs1j1r#W9<|CV5I5H1JnSnhDo2LOhwVPbA^PTC5YpRCPM>{3wj4g%zGJNk=Jdi298p
zd~k__6R}mUL-rf=s!o4NVZsK0IVjN4ULhrgeAxbkAmAbEm=NHCz~OiCZpWDSNiv+2
zd<JL9E!n~oQV_W71QtU;w^%6?6NHuXfmYrdc0*<LLT)7L`iq(?GJ6-BDsD9D<%hkY
zn3vC>dSmMR1>G*L*;VqAeib*AxyP@mb|;HgxvdSCM$;cS+SY&j<4PULDqmB=xutgq
zaw5M)q8Iv}e@dR&0$AHi7tM-I+ES9@W<S3--!4;XviLQnREt&1(BK!#-~8%-Mz1f-
z5xewjv^u<Pb>XbM)O^kN*DMluuaWX%EtFj1HCHQul-ImS$0QW?ft0Z^<iFE#%?`0&
z|0rRojCg3awDo@p>JtY|U?rX=!)(HY=&6HW!>$#)qre{vz6Gxld<&A+^e#!%m|ve-
z%H!9(OaVBM9ZjQmNjzdKfhqo|zVM%Xy)vx4$Uw3dz388cV3&<UKK47Wo?e9=-3Vj)
z+?{y-^|F&?v-eU_t+30n{=Ja71bl1}HL;u)zz?H4mo0z9)dZiq#)o^8$yuIGWybpV
zB{P0D9>5C+Ut5n(PNII<B<JZef5$wt9`OGeRrDsQ;&AW#1D@<zap64c*4WyMx%JHu
zJHRjS?qsvVHy#_N9}@pW(}@`FLFPQwOV2nu*wIP1ik*eLraI$F(abM)@(v%T$A6h6
zj3K$vOOJp5j=wLQby*%WX`T@WKFP#tTuLy1(u|*wto-mDy^bllkALCi$pxbQb<ppe
z&fjb_ZUKRHJWc!-M}Z=vezTjKF)i595SsqmZJD(F(8{-KR@<mTyKz;C!zzqg&}+v9
zC!T~Ip+9}bPigc)c8s|W<j+e^;6D+_U|d^eUbKIh!}Dp{FUl-VOVj$&-TNqy$%LNu
z8I4PkiLd?{GGo%xvwXlamOn3@@n17`#WQrV#1^K>$LS&|jM*QP)tVPKL={hG{SQwc
z^MvWILGMx?SE6GWH7%`Iiw^$sB6|H|@6G2UW}fl4@oXH+l#lS|rE~tLqRF9zt_hdX
z3^RYKIeSv^M!L%Q#wb~4Y`vm+&i0QBW?kkLBjRa&WJr*{W`qrA$LC>mrg;Zo*{XpD
zP~&sl0%<FZ5q>-mvwb=8dT|3YuI<0Fir$}MGfpb&O;mAH-9WE5W0zjlwp6T3>3IKo
ziB>m76=WzS=o8Ln68*IVudvpH0VhE8L;`=(WTc$2uPZQ`*j9;daK<07d1l(-?@P4J
zgTTSl%d!txYiCD(eog2lS^oW#bTq+~NA`~kdBxsvh};}Fy&YkcC5Ch@=s`DPnCj0n
z<LD((VJ@+BKlRQ?e+^tVPZPw3^7E1|G0o#~Aqg>LUb72Cb8AS&Cw7t)*B8#!8Pk73
z8DwLbr~G{hRg`4jAn6mS=J7E72b@7bV|D(3&qWo)K|jiT@z;`4+J`Ke4~Nrk2CYrX
zy2cI7*tsG0{sFz}@i1dg&d7dm#rVC|qu<ph<sP|O5&w<Jyjtvmb}gKN$iIJH3v}QH
zslu)Cvyc6Rk6nU47FkZ^CBC}v?*@NnEO|yu2>5de-R)Hdz48LB?KAV^1L(Cp;iCBa
z@NyRbaktNE%UwR>bDQw_QWLIdn|UIrsKn9+pZ`O6#;+3L#pC1>K3u2KM{h`09|N@Y
z^HW4H<BwB5@-l7x$AwZl&^9@nR$W+53DPtkD~cLu{F|FvLLDh7rq`HpCa8bXG+q8{
zIo*wHLSkGf0>q5y$)q)vX!7E)%1x~?h;nZqGtTI*I9+1KdpQ?}KpZ2eI~=CRT-skv
z<NQoip_Hh{Z=!Vh_u-O0A@Q@cexU=%GkzPN_elZ5baVOh5?|pz0aWZZeMt6q|3ve>
zCLy_0b$iWI8^!(C2cI_Mgv@_Qo-h7bio5NPTO%?~N!?^Wq4)JbTx)i}H05%+lzrqt
zid7|1m;{BWAFfI{Hsj(XJ(}vI`R|KY`Jd6ZGgP!HhBX;^{aB*?B}b>HYuC68Ys^i_
z)VZY}>|M#`5F_I9FhlL?j1So3ofpe{yuT-QaKvRg$a&P>Q(Rv>ue5(7&qb;{W|IN8
zVnJ1#>G;>83eu`zzS9e^N(e`Bpl#=ZC|l@1Uf|&j`@spVNZJ)?;0c%65nCKdweryw
z!Xq-{WITADrz}7U`umvvzAO&HQDM}vh%2IELw#<UckuGv8=mcGI$2UmbD|d+MrAuB
z8Pa0s85tZAe-Rsg+Jk@KW@kLk&W?uh2Ug<?`^N=m?~6wj4*ou)_wjW3uVtikeD2a7
zj?!^FX7T4Vh0iDQbjEZTCNg9G>k2ataLzvK%2sErMLs-d{d;-qKl(P!6PC%LVfVRb
zoWocbyQz?WTxdBN9jhBlO{iZ)J=PhYinpRTO+Q{5ee@#aB+Gw3Xes9}7=q*(zay@6
zoW~={myo}giKK`9B<6B9P7&LYzBK!9Zt#<2#>m3t>Ee&2G$Eu)f!+35g?BpIFSW++
zC$vb#3FbVLKd%tEk#1wzSqpH7Xxzh^U@H*&PT9GUNRHUje|h(gP3gZ+r%TGb7wD#N
zmT*r6PYuNDrdfaA9N+AYMdPVV^&?GQ&;o{Qud%Df6HooMYVU^ns0~sn3bz=5ji`|T
z^yE~q<jJ*M{?%e|efbxz1=m?DRSK>v!CCP&&#qjvH2ezt|5=O3FFPw&E-=4Np4I0l
zMZYx5DxRbaSXio42mXhZlw01t?l}G2zHFzWsOA8<ZdHHuM!PYna{pSN{<S{+OV+0=
zd0(MCU1<B#>U16W^A)FC82GvZQ6KgL%?m{hGuQOXD#)_!<+G&!A<5lfDl3Z%g3UD&
zQQrOKWunYuS*a*d_fJGfxgqg(O-Xel5@<2z3CR)HKwe9}t!4$+YH@J?={MpL3d`~k
z`{a2-Cm(-A<A-JxV&Wa|^WmHz>sh}+En0E~Ls7H{a^+1>l)wks&BlTiq37YN<oYVP
zK9}UW1oxz<;+_OKK{q5?P%v_B(IOAqK>Onw(IUku;kd3$CFlY+xn6aO!duq8{u9tV
z-Ed#QpufUbe&v+^H|h9tZm*{0Gc#I7&zHeJpQeBBk`b@Pk4OILV5ka54l*>u-eHob
z8NwpQSI)}}`q2n(f@VR22?{o+Te{yxOtowyRIhO;h$FD1oaqn}!E$qN3Nn?k*P0~G
zuq^(9giihp?N1XfRBg8y|CTRo!}y6TWyJXX{bVcVmvP?RutV-<9dPDU>wJ(lAkGx=
zyJCNywPn|?)<p5cJ#uYDz-*^^8~{QV9uaa+x{heO61H3_h7yMu`rJF7DW6%Je~&3U
z+_t?*XKrhIZPDz$<xKum)gt>~eR2hluHfp**7i=^>$muawXc@cSN-6N>Ia_Iub?0}
z_Ias>;D`SORD{R`*{A6W9Y0JsxRav`w1<D7TB2T!NX8pSv^q1|=Z#WrL@Nn<lMZgC
zmZBZtXNHPG@EvSqW@kwbY6UDH2=Y*s4-P0-^^e*OyI%`z4o!vSY@h?Zd-3!w8>d8%
z1xE^JsO`iTeIz}KtTyXYk7T%#a$zcw!@wz>`sJY7gfj_)sK*JD<Gk=o?=r_&gr<LI
zMm4g(STl@sIl@xo<yAlT4Gc1NrfCv2ob`6cE|$sv6$<k>G0zP(rgf9t6<FE=4_HKp
zi6&$P==9zizSrT)^|<u<F-Q_?%Xy=t=2AM+5U2I<`zwAz_&9?j#au^7(;rGoUUG!2
zU*>no^duYT8JHtX`c?H}N&6dnKuv$ao^MCb<SYrF)cZ?7_o?tbr^n-1l>8Quot!lY
z_r9Pt(e-2X$POa=z-DxIlJ-wbfFJR$D_32Swt*`|6vqzFQYOXHh&J^}HtI3{qadiM
zm)B+*tQe!I()qCW+6#@j+YmGDIH{R>NbsH}{gZJv%#Ksk7%Gk!#B!KzsqcU9<ykz4
za&#oXgeyp;MF^)`z=hHu&ISuO4JQeL)LOcSG{xj&(w`Y()31$$0KhuQ0Dg8cE$JT}
zce~<KJrexf%60?c@2vWQcJw$Q+RJsJNAQ2qDte78p>^O?=m;Jk;#2=%#=2|I{cbq@
z{kzwHe)j5j$J5_OCrLa=at42O6a-Bkm4Oeu?&bv&9yTu(p64GJ+7kczcYgX|=?ww;
z-o>2J(FMx~VLOe+o`QF3^G_qpKtQKZVCXO^FBYOZWGGzY(~Cr#C57i@!M1TcLr){b
z!CSLQOF5y4yOz%u+z4BrLp<=Nov99N!FWSBt|AEg7O59&E~50^-r9d~3dDCX#bO16
zl+LUGl4CoSE^oEXj)+a#+^DdDdW}h4L)4UDG+)La0J0}AdJGs1-|b{JE#*6hSg$IX
zNC=aCT12ZMfOKpI5||&|v|`#&M>y&VmT$Wq9Uj0(JYy2P)PsU)%#cvDYP-rF0ahAW
z{*x#>O7nt&&v)9<^UQxaGF&f;WIO{Ox>(<mUq}t&*Xpwv^mZFfT%leOXQ$<Zmt)pz
z$-mlUy!jRA+5u|oRT`>GL)?)e_|*Id)-%fmBAd0{r>_otgp6|q<6+7`)68G_EZU4|
zu)Flm@F!q51MZlQXr4_5(4J9<WDC)K2jDxr#lnJJ#hC<-CNh7pqwZVqkD{xn6X*}4
zS9kzS{#9}o@m>0Cw~bDl(n5w72PlKggy7DnJuyfARDJss2p2xStHoN#e0T}UT(=#)
z878o6#!g!ixg~006c2K#T^?i%m(7UcG$d@5<YOu*e|Wb_KvF2(-qQl!(*^WW@z@bf
zSDW;99o5v%Z~uRYUmTCmn~}o`WzMVE)3K8ptKIkS_n&U;0dTQPL|Jf+EgIfL&R||r
z`}qcAkajiBX2lvv^FGaF><Hmj5v`!^2;cJl?TeMDmwjwPDhVaI8L8UBDvN9U1;Q^e
zy>=TlD#f&u9d+n-o6d#`7#1#|?FU2$j{X*t8k=}03Eh8}qT*B|Qmm1l89=C{LQa3(
zXuOQidu$7mZNW){#E|H$JG4rHEKU2~A*hNGQy8rZ!^HzgiI!RT*7*=hi9_sVBSO-P
znQ75cFw9l(I8Cnju>d|Y;D>$F?!s}uxDakB=nzM<oTWaC1NyKidIM%zxOdZdf1>el
zZU!*bMOJ@wyWJm2$o`B!fCW!qxbkr&ddT?pOeVsSyX<n{zuOhY+HDI88~d~Ru+_1*
z61QXS;ao9%LI-+|0KcpBjo<Of`D`ey>{wsLmc<jUk1`X4OL{7pq<k3p^ZH3X1&gF>
z=_KWSVF_XCN|Os^bSyFBGVX5tM^+-o=U|v?O=y3N1_~^=x5MNVbTIc}$`)k66u8`Z
zjC5PN?Tj>6CIpTbVy{FzCj*8G4?K0+mtZ2h#Z<)WLuBguowwNMSCM|QPD)2(`ez;!
zKOjmJZQf}Y%!dj=V^x9`(wh)}V}xt~pkkAMCz~A@zL+PSV`ja`JficikdUHGH*5Be
zTL^y;Rr3Z-Q*AjBfvAUuD5?9_W{5%h{-*ZBK*sctm?%`FQG&K&X))4`KSuicm<{cC
z93WE?(bIi{A@?7n9mH(3RxYrw4Cky5oHr8PjOZSIUSh>!+EGD<ZVjO!`hmSMJQpSw
zqSWAlaR}06Xn8d0+f8NyaPlKoRe9Yw2n~Nv8ZY9A`>NSQ1(40rv@M+~0-WHC>^3Jm
ztuB+4T97M!kGjnap<VqnM&4Fd$eT2h1!+b~!UESU#=&GVJl8_tsdk>56%sRnAvaS<
z>43C#reqY03v?*eyDTudtA(y+&(XF!*x<E*<)u@Ju+@jLL|~>Ig<uDee^00j*;#+z
zWp-XU>kLuzN3R_5Y<|p=@F&(B7;n0lxCc!%{n5)P|Af*4>KTE;!4;_TH6;1Hw*Wr&
zBU*eqfCJA{N}$S5-o8|q#XIOg=a${zGz_O`sV(G06uoIh^R*-?5OQI~#1hb;+dL;0
z4{WzSPo{1dZ*MIOK6xjjxL)K9VHAJrQPg=YqP>?*8DyU;4@j>V!@P7~TzaV!n!1Yk
zLNQ_&iMGxq!bS;qIWZI383rC!l{J1q9{);0#y?9NR3mAidB6vjFx`L{QuUOw)Tddg
zEV^6}(Gg9LQ}1MDH!4vZvDPaI8z@ZD3dTAd7~>YFXmpU3`t}G+`4~nxyd!_`Au`OZ
z*S~Ro&rY&nG5mX*EG>lH@`FmT{$tD)dw|MZHeN;}0B?fy6{o%&q*Z+>3Xa1H6O&Nx
z3ZCk!3~l!hH-Bi4isLq*?#TY=YYf9-sPjq*>Fq+PDn&pF?lENd(74BmY>wZRfE;D{
zs@j({vuH?f4EnxCgCqm^@OXbUnDyE&y&HpeCh-*hEYi?&?&v&8hskPw3ns;G)c&{V
z53B8eTYGeCjqX?Ru;`Hkxx5?U34Q=p-=e#p(zW2$X}0LbciC<@3E->IDOq&)e~$li
zyxLx0`_J($@QC))*YEaTyjW}4=Sl|weyB*|ynnJ9u0k^k*T}wL{+WO9!{(l`WtxAi
zvVe0>(jv@1<X2|yep`$AhbpU7d6FK@6H<i7(N7Ht;NHS2+}aJ+NE$h>ZmmJe1WT77
z&ijhaVACGOV$h?0sY;IqD>(nCE(kqcTC~yt<>j0oW17+9wsNH>-Ez)9r0YXZme$Zc
z-sYO$RUW3i%5E$g>gRukm^q&y{q#KFfc#S(VG*aeF@Z?4IhixTI50LZDfdX1jM3-{
z+;tS6i+7$m-E<~nN*9{YHm(&>ZgBxzh#B~|F=jx$N!X5FCZzI@kJ(6~z1;J6vMy#)
zgKZk#X}sCFhUo!&uKIPd7>_S_^l_keiN<wCDq}VjXTSJW)%Abna+kzG%y;sakTRfZ
zc%IM<NE^T<*nkr5;ftlXxM~X44>{JJVzjPe)QH{2ZKv3tJdxgk5l6$O8k7;C)gPjG
z1@b%f9<WK4<-uqtGqT>%gJv3k@V!2SR83!prVJ4~&DwC7R=icv^AFJ$4qdIntb`p&
zOR!6vlqF>ZqSb%M*+^(<Q+6&KxqMm;Bn7_ArtE;r6JTwOQNl!7P{YUEF6x*QObp_a
zP+Lyp;Vc0yq`KRP(yn}aHdtxuHKt~m%CVm$sT}eFvVenRLMzdpm;9w^$t$@aB9$5O
zeBNbrdi}ePxy={9y50%%D`WER84}Uz)c*PR4dPxLDLa2c^6_i2*nevLYVO`$6z~u!
zjDK%#o$u6WLd!EO2dj5ypmouV;P07Ni6k&ov{g^&Myplr$ZQH;4DC}X(|sr_y$dB&
zni67<oBC2*!hE3nakR0in^Z_^OOS6Ym*e?^Y<8~p3bOr@xExN&Ysi3E&h}{PqKpDc
z%0P*wMlF9qo5T#RSY@vN-Y5n9!yry1ky%mxa2#+tcjeohX9B?|gp`gFYr3ffpr?#K
z+4VV(C3K|pBr$NMqjAWi9Bl!>kGnT;KQ8pKYX;qkjx%vqj$rbSGU<Lqv;F8<5p&o#
z!&pr1$WHC@N84HQZhLj+I9Ea5PclejJxAOu@5p~l1_<f$2{uQUtYF{zFv0mcRqtz7
zak>a_5BjjZeJMF>oCs8u+J#@-vbGr=9>6g`gof<Piytc7op{c7J-GNO>xclidCN85
zGM|TTFMXRXzJ?7o&g{YfF6MT@u5iOR$IbAz@32P>!|dXD3clGI@z>EP&grbw?v-uT
z{uqC-5?0xviH*#F%;L6$VhiFyi(x1Vc3<(2$c8{VNg{&Xyh*}YN)FaQ)u^?EIghB0
zICv_to1U-zSKN5UU4c`!4B5UnBvU{5oLk(P3g5wlh?h+rV}?T(<C$eYh#8q>Oq;{d
z>k7_Wh($+GmPHR<Pzw8n=f3>;J~R{;A4GqTTL6jB6oDT*XCU9q3?_mTcAN~^2MCA1
zo3fXJbSTMe8Ofi>1{`X<HZ6)-#Z4+jFVk#-uL<}Qb7$fL17@j(#2#$%knHk-9%zTj
za{`xp&6GKN*bg+99%s<JK1izoy@Iprvg@;D5qaBlN$C3KFP?+0^H?$kU6<jrWuSk5
zg_HPY;3O6m;Rf}$!Qs$CT+0ieI~B@~;M-YQTU04LSFGz^FjuUb<uz}|)TGd(re@CX
zS#53e*sA<og)>A6AERML9Bt4_If{{AGsj=&`iMR<VdV!?dW3$ouGH~S#3}Q8ArjCd
z&TR<6EQ6})(u}`m+<(ou|DqZ9O5uN3O1PJ2mdLl)!9QoZJpk*ksV~T*HprZ=AfWi3
zCo(jCmLHdtgzJFd&+82Q{x7aE@GO?p7kDu~ySDI)YYCr8Irznuf@O4p*tT2~F6OlW
z-sJ1*06cWP2B61nDf$1oME^pO&y#x;;+-6j(Vhc$`gio5>1o_QmzqDk{2hP4{1H*-
zDbmSGzs>>ZeU<cICH<F^^i0@SlJj_C2`Mj3<nzgR*NB9hx<qK|ay^M((;bH8e@!=;
zsy0yDaK>f2;<vUNp3}V*u)f$(-0uy%tzgyRnyqMp6h4=MWNi|oNjgc8GFC`Odhiw?
zClKZMQVfT30$w=|Kh}Y`Yl(lcPfZ0!Qfj3iHxPFM0{qlDFaw-rsamjl{o#2t%=n6W
zSvpK|R5m3@{UBmGyx=ox*w6O84({o=d&2W6n5=o?^DFBR0_rweoAG=(^(#=FyzX?F
z@>HuCd9>rJD@gxDJ%NSGG-W;dzwAGyKFhT_*V4+_r|4*3vUBszVv~OgJ9tIfLrMDr
zvG4&h-~+oOs@D%aiSbi!vV2NJ_Q)MQV>=6aG+}V{UD*?R7d-JP)T4pdB$qD=zc`$R
zyNwiF>EAdt{Dx0jfJZ2Rk&%n}4h>vPSa|}BUUF}V7o^ZN+}w(G^yDPV3dz<(Hso-2
zZ1v13$7Q{6D6InBaBzR{B6zh1pXo2exp0je3TZYTbPWHob)QZAh?845)TA|!kc3hd
z`rW&CZw{b@;t#xI%y=&vo-q>wEE)PnD6pEAj95f!IAkW*kSfeU2N@loMQ?t?Z?<Vw
z$+;vC+&t?|g-DGlcN-E_FbWCvl1!!LT=YG;{~&uSt%A0L$g_WsTo@b1yNAgUvP&k@
zb330j@ShFJWWfiiO(M4~_?BhK(~nj7hy3_TToTbeK_Nola3T>XDnb<Tm(rr`dYYU)
ztHV5fT-DdC6<j!|HH8ac?Jn#8#`tw~C)bWfaXOMrniHuoGJpUVl=CMdK&x}L>CWO6
z{mT_G+b8TzhjD)q^a<jkIaR~xkr7HOQNx>tSWf<9<@p~D^)p*B|C5szz_P-g4U7se
z{eN83-0Y~K1EF%kee?SISvJ0fOb)tneO>c<y`}CSci+K5+hLJ4$QY${Wg3pBykM5B
zESW&#$|rM)&}`E7I_y!(`1N^GjtcjnR4Sk~%05dg&^UjD_ETAh76an_U~1v74+8)y
zI$6^*RB(kKP_kj_{9v0cNv3gLu;|tkMOTe0TWS$nHpFb;TWfp_w5r#%MAU03OIDvr
z3HVA=K%h^1QxTSDsRG_twGs6+fTLkvJt7aBChs5kp)GR7ZjhQ?+I9B?YozPz3MkOf
z-pZP@brOF|2s@n;(MZh%%6!U5vvF`pEusD_xkV?!RBS1np&Q*a+!u6p8=*%}yZ#2&
zletVcFoa8FgDRUsAQH6PJUf#9Z61|^UhhU^)tm%Kqg=#&NY-(<Uanp{b~PS;ttJ|1
z$FIIjWHPaeS{j|<`)#}xyBWdrFu7Fs(-+K^mjQosWzX$_+)`SWg(SP>za#YB()aY^
znQ+c`z8J?|*_8u*;Z7ikA037_T;N@>NvJV&_s&N6;F^eSFb5JFkScinGZnMJYnFe*
z_O`vj2G`t#a*AfO8W#*g!RBa>*w(OUs&~}7V57*3>+6a&Np74531x-wex+{PzV-F;
z$`OAP<$TXnu}PV)6N^vcB9)SZ;OvwbNnq3_V?Jok1uCM(%MP(s9o{mU(y^YF5_$8h
z<D7)^(AZ=vo}@o$nNwljo%MAE4#SM;()zk7JM;q$<g5O_hos^vTp+p{v9BBumtSEr
zeZ!-sJ{=+YD{>}_g`~ROl6mFRkW#;Ks1tv6`xk%=WuBQEcnrI}bR)bAZp!E7I)tPu
z8E3cj&Xrr6Dd1fN-uY?;y!ua<DH_`UVLP2=90A@9Apcq-NOC<xzhqip)y6JgTq*=|
zJsX;*N!vTWOkOi~4RpuOXq}G<%mp~g0{v-Rob)n8{mOQsQ)I$i`rtH&t2v!t_NsrO
z_3p*NoS`*mVU@xce>0<E;_?+-uOmTkz>^Yf>CZTav^4bmrYrj^Pm}ACwJB;YP+b~C
zl4gg+wO3P&+;A*t+sK1cyEf`V@f4ZVg$VERH1T7!N`~Mxu|`Varc0+Mmks~PoBkcW
zZX9fURl!+wggBSBI!$JLG`oMY<rRO8XQSSH)aswn_Px!md$lpEh0`?VV0ZBAiTQVV
ztnOkrh!b<c`*l08>E5_wAn!mmzt(C#v2^+_;&oWpZj&~b<ic5&5AZi>A@tv_dc5oW
z6nuBEqO~X8-S=sm{<l!X@}Rehnz83MT|eZqX}bG9!!+l|o|`7|%`#<HJPLp1O%EIX
zU2B@}LVoGMmE!VSYNqLkz|Z!AY5KdF4Lo_f_p){H-Ck>JS-xpUC|)!!j?+po@Cq1G
zVA+Z6ZZy!<yBQ4=j{2Cx;2@|uVP()N?#IcQ%l7p)N;_h+gVReJ635F%q{E$!NP(M>
zNlyO|8-$frH8}+I?cd~GD~f-fLP{GesT_d@3<UHIosO0xSpYV4HaMe(_2{R`IJ3Kh
z=W`@wj}lW?Swgb+RxWo(=N;3CWp(IqqmY8*O`52F-i%iM!hmIXQUj^xq2Mz^O5;kY
zY}tSF3Km;5PkpB}KZjoiCL@Qc7V4fm7Ol32LKW0$vSl@oqrx<b7=(WkKb9&W553iB
zaK^VfzTN`Y<{_$mOsn2iGX8zzR|;V4fBE_M4K52Rrp{Yc(9;q;Z`(OqwLjL{eVUpG
z_ErDq+V5RKQhXMt!B}mW%&P(evF3`5_QzZYBd(iVDMd8tLe_jB8)0UI{My2=KZGtJ
zKK{*y*2ZfcSXb_5t0;da9Uizdo+Z#+hK3%<cjR&lI~v$#iW`Dx$9%(Q+xy{I#S<TK
zoFC6hus%u`XRKQcv+P5IF*!=RT12bs>$CujKEhSJ#rpahSJ|wugCUR|)C#S1@4iSv
zutc>HPZ_KPq(_FpYIq9RE?nbbIm9WW@aWwqLo#)ee6#B=V|jn%TFnCTU4F;qzPTG@
zqvhgH(F)dSWtWZ(NeEiOrwQ^_`)N|FL_ZT5>>V*AHEoD(zZ9;b@bVm|eQdw$s**j#
z2ayZ)0pPR($2QDlW;NX>(|p*C{w?Z0L!LrcntrIBS0oIt$GIp7Tm;)Gr0dsIigFvF
z--OTn+u1mn&BA|ke%sFZlwJ{@aj6YKQ3Sn<X$&9I6IRsiq=Rn6g~(b{%dcme9%m#V
ztWP<PS2`Hqnl|jnjn9$Cax8dew_pMGWA*Pc(omLbv-olJnw72nr-tJx4ZT3(@le=E
z>P%cd5poo0j(8@-pb!g$v|k}n*?Fy&WJh$v-lgs|qT+wa5NQJJ1YpMIym6l4nL`>Z
zTU~xOg~tBVe@)hx9!0CSX!~w)I~n11n8mN;??b-!1C0&nIb9WFih2>l{CqVg3OKR_
z=OjLcMdLBZASfNDYQo|25orVlJK3;fYgC~}hGaNSF-;JM_)gN>8Qi^lzqhkBNbU^o
z+`oTxd;5REP7h}}JZTM_H22yH*BsO`13Q3=T(0b?*Kbp)j5@JltPn~j4(gq(%nhA`
z_4Qat5HYjRt3)zf980zctT%CzhQvvjY+bU8d@;?i0aW6d6_6gdd@8>E@LSFq6X&?(
zkD(M0SzhuRCwvK>YC}?fhcqXe>mPpIYH{z8B5HrN9yJ=Ki+PW+k8I5$;<=j|B^7S*
z6OD>D+TVGJ>#7l~@C6S^;+IC(s-c42NJ4St440bx7JYIOPfr#-lnwQPNs^CJZY))N
zg9jSn9@xXx9I`4LX(QOAMbF@3>5+1rtQ>y~Lxp^O!`MrsHm<bzX?iB@yNIPeWDvHE
z!25r?cnJO+nFZa*Gr<!ZjT)tEsZoLlHiCfc->1{-MPvCv8sIPQ-c{qU+~V406r<6#
zWYDj^)T%_%@n_(Q?>MIleDWPitl_E9813-lp4SfVX{qMd*@P?;uH(b)NCNHAU1#ZF
zdeV$e=pEJpoNFUzV`5$@%Qvm}gBRBab_9Q1PGO7GsN+?zBJid->Nz`Z)^l#$LgDjF
zW#wmjdG-Ol%h;J7lx@07TUR)$L-m-cPSSo;Yv-{L%xXQjsFj{_Xf<}#>E0ePObIQu
zAIw#DKH^|7B9RjKcCh#otc9`?esUQO*t?pM4v1OGKy+~iWW}i=R)vMp9*#Vc?oWRf
zXET-BUUjx`r4)H0%m{2o6M=xO^d`dGO@doLqG}c&2-hLguZ0z>Me+A*c6g8{X^4Xe
zIS7?=!#`Hi7fSi1^mI%7q`{vpAoT(nw6OjSW=#df!BXYiu8TCs(GkKEAR69b36k0r
zZ7@)^z>%}&qB*L#BY?uUuuI?;z=?m$<Fg=#VL=#PUbj>f-d34q39l*lNDo8tw!Z3_
ztqa1>IgNnxUj!@Uni#k=tGM<N{ziSH_?*>Re6Mc8jW_CuTVLOe4y<;_-(DG)pVeHu
zr_t&&6c?@GQEvR#l5+COR4@g8#8NcezVT@ICY)khdAgze`56AsN#09{+Ae>111IT6
zPq}O$BetE4Pt!abv+63RPYxaf$e~wZ7>5io`Y)YOIm%aUE{3&xuBjj@>n#wwJVN@N
z4pB}mzWFyJlJS2ZmJa>-wGaKd9s2W{Gk-pR<Z*wg?ORZoE{e6p@owmxpZ}uA{Cw$C
z&g;<e`8K8VeSY!repAQwKQn*Pgw*mXxh9~&I1w-d4A4fij0(ND-#yKY?WbCLky-;s
zDz3>0dn+7mprYm6WrqR%`#4WZbRlaDWyzW!q(hWPamos*4f=1O@q*NJh*FxDG!wF_
zux9X$;$bKhdF*&LjB`JNQ~FAPTw%`<WgzTCIgbv5>6eo9Z(x77+7W-c4z#4}06ySW
z5&a>KPH0jOT@fAp7G&$R{mwv1>!f2C)5C`=<4ityC3^IPw}))bKWxO0xF+iWd3Fdj
z`W@CnQd(U<;&g)+poM?8dMN*K$$1-h0Kzx59to<ixpXv6>lp||)X@-=q!7Y}K2umv
z1Zb1d;S-<lDBhZd!)Sk;d4qjKTo%@vKyMLG`I@uRqpZhKUcrtk5AJdGg7;bm1F7&_
zmLeK5w!=r8cFji{D<)Et{(=eW0hTX|+)E17{FF?6X8#nVn_3n$j5K<vAgy7&+2i0T
zetuA?Dlw}6`!Jy0WiwT_wr+1s+yGj?_Dpnq<IER~rl%noVq<@6`@!uEwGvvgjWlRW
zTtY2H8fyjb44gzT1Jv`i;A`CxcbPfb>6lF=0oq|oE}`ULrMsY`$lgmIGl<7&GTi-x
zg*+eqF=2Pi6j|7<oET4gR<uYcOk3OS_^b#{68_>)vjpVSxn^i?#C3ma{AvYf3x2j`
zM_p;sLy)iZ(4BwVJKOjtqOur6=E`>rdgg_fS@4fVF&t$B{#DmQM$=Ej@BTYi9OS>G
z{=kfq=L1Kf8;41P&&kYigAIKx;F_3sGwNdA-D+VTf@~~Pt|{K!)4@=4GERRF8H@fD
z=5ZIZbjryXT1~1MBn}mdvuN1lRUjydWF5gZU<vt_JzIY*&-Zit!WH^{B1;wN`-S?f
zb^144qyHHy@Nc;KzMOhesjYXvb5OExrI8|&JdMv~2`#9r|C@*kd(c(=_%zhZvrZ~A
zbidR80?Nv@Xp<<V*70AIGILWiT!c@+ayS4is#&-yR)MGWrQix&dt5<Xm87s<oV%*l
z`n~#E!vBA@g#U(1_#sBM##`NsKBUH|yyNoKnmxU<-I1H>duLYBHS^hczGWqQQXviH
zw`|Cmtw?b?W=!1$hoW7byzA`dp>HO$;)Da^M-CpV&>$TmqHwMk=6#lGb5!^g+A}lC
z`u$mcMXUoq(JR0mI2Lj#;(;Ij^MM|`%0vUYj$(hMkJ=zrl`0c2M>wK9(k?R7rxd*)
zJvF-?ebZV~>CuVio#p1fWqnEBda<%ZDiPzh_<6XtjfG7I`khP1+mKx#KE%&CjuPAZ
zZbrqDv6j=XGRqB%R%)JIS>tsn_i}53RP;vQBJS|zdALc%qRkndx5C@jIMpv`7l*Wk
zuvmYLjaHNL0wC_?{3HpZ<c-GDOtG68-hpPe^2C|HD?#TeRw0NhltIxElfuu1Kru*U
z-r3Ur=}eQqtZt=UCsMia@vB_@Dp!9QXdFF{SCJL`#N~oQ2L60f;x%JCUrS14`lt-D
zw_lMGRcvXwy%dVr%UPzQNC58rVS3DI(^Y@xZU9@ex3BRex<;=Wq5GO;+uh2wX>_6h
zV6}H^!$+SyggNqQBr;RdjMI+x!v@<7m#rkG^t1mZU|%XVUpEJ{`!4{qS5rCm8DMw+
z1#tKTl0mW;=PS?t8EG*k%SR=?&$_3zmao3p7h*iJGFu?sX~_cg2+WiwdYaPT+yQ?V
zAMrtPAMmB5C&XiIL*7YCZid&u`Nla?XE>Y*1@{X>&7&rdS|B|fM^bjo{SNyF5rN=_
zC{rAfc<j8D3y}QkzEqtP0k+@k(%Z}bj`p8^HTl1)CSOuDQ6j#AYNG8PE>lf(;LoR;
z_~_NO)RRf@_%~rdqO7L)3uT+hKR$nl*lW>nDQ9fmcoIcj#QZa7QUtGDDxHEOuNUH%
zlotG7HM3%W?`3Uf()S0^+ouQ8?_-u{dF(Y%t~Z(FX^|+f&k-GqnIc|DF2gV>ord6%
z=$Rxl{;;}1|3;IPHEwBPq_2IC!8c|KhzPHn^SB3%bxZI_v~)ISOrNJ*pLl;E!ye+p
z9kG^IAn>Qqnc_fXJc|FJ-jqH5lU}reEZ1VXfwZ*e!1>u=SOxS7r>kvx!PCb`!fKyP
zN5i#t8AK8c?%2@mixVRH){xUvE1SU{kD}~;<fiE3EXYE!a0EAQ(hhlA3Zo8s<GcpO
zB<;7E9FgQ<8Kag=hqVj}m^FVhkMr;j_un4uUA#oehr$*IY72uPZKUz2#VPA8BCwWP
zI4zBJ6tYOsDz@b<?qV`LP&-JKjsoRfhtK|eKs!5#_IY;G^J~myk_}p^JPw|~@8+SO
zY;)&rKC5I}us8SO@oB>Igpdw8lARAmU(hP|Px#wgNq@Uz%z*R|d4YevpOHBZkmkpU
zG3)Ek1fQhlh?+MU<nH{)>+8|JY&P$nB+WF{MK*W4K|hJQnD|#MI24iqv%dbs9A%~I
z=m2Yo&S;1By35HSyX)&5_=gO7^7h%@yJyk+gJ*A}(K$c${r<b}q8G29@4xze<N4dY
zSMMTyI(qk7@A<ui<9C1X?&n-ugGmMz52bPyV#Tx!2!Qcjq)YeH2@!BSoyO4Z+|8B4
z7_Fi;5h%M^qAku~uTsRCoiqL1)}XhmDH&buD&BSq5YHnUrv39$3PcpG{8doDkbkhf
zxwYNe+H7szTS05jl>=gWEIaAqA@};U2B#~}xM?^Z+T)xjYXyJ0vd1sxEQivR{2k7#
zO83P1c$X-7SMU8po*dKDk9Pl{2a=A*quoIdJFxqQK`(WBH7;z>FD+bZA-wr$g<tS9
z{r3-+J#o84Dm58oLNG?!N`C`v9#X7;VE{7d;9{3M6T|)z#0u0<Mh?WHDS!uENki&N
z21u71#|Q8SQfq$*36&m?nJ;p*#=V~|*c2+eWSJ_XbJT!H9ce4>^|!WnT(Zhmo0d_T
z0@wrMro4}(j1~H~rK|{P%RN441+S3bYExF^dABTd5o^M~%kJTJHzk+I!V4ic1j~?3
zRAJM`j9uaxowv`P@4tT44bzaL(>Ryn4OCb9<S;#KjAMVvi^sj+s-3pL!?DHzLQ0@}
zyp7NMG}mkCwz)m)hN)<^`fFLG)u&1>xUfyxFrJ}hoFIpl;x{e}#zHJ&m5<{7>jV0v
z!(ZctPb$+`F5})N#X*poQC8L#e?&r~q!|!z+?XUtY(-oqLL42k;JeyD5w{;I)v0*C
z`RwDA6cc|9QXwAd8?<?Y8Wx;RCfs*2GK=f&x;&{vRCgS|`7h*q+iB)Dn(XXRGD4a?
zgUm{*A@o+(l*AZ~!-9_{shLC#!da|9Mk|bHk$DPXsx8-m2Dy2nHDOGTrP;PBHgqLy
zRuHcSA*@o9p^HpP8-`j46f*~>R)hZGTay^z+v0y{oR!jtxlU-2daK}GdA*_40oi;d
z0tOX|-#oV|A=ZJFt$sRc*shxugZ}Zn6zBkumb?bz=>3F*b`fTVE`SNUGD_H`{@rWB
zfY-u<T^SwhQm5=SU9}5f!9wIE2g1XaX63fcI{%_=l6NrT*L{9mO%l81vgG1=IIt_D
zfn9%!XmdRjumvz+S4IIV`JwAq?>gvT3*f)5jQ+L6^s1;|cGpFyUkhNrmPY-$yK?}L
zKySbA!IHFRhg^7>!}`Jq-HTDr=it7sjP|v}>Uoqeui7rfSmyDwt_+{G#Ps;U*d?LC
zWpJ}X&7e3*kEYjE4)oz~B5~5V@yeQlUOcp`K@*aHvTbi8T1HQ)tcQd*vG(5iG-;t=
zN1^MXBhqOL3Ut%~BgsyapvRL=<NKs%evTqqB{h7l-PmWUb5+^CP5ls!L&EntEPH4I
z+RIunM1rOwt~ChFe0W}@#Z`Q<CI4_ca4K_O<)EO6(^Y_HQb^^=XhQ1^;moF9Wk(oq
zh5eF$sw9Ym!ta-IgUq}AqaVrm3PD*}-;#zYvFbi`F2D8{^0L<TQ*ne|TvGuqMEyND
zs4Bk)2Z8Ea6k%dNa?OqsgVfQ2dx<A<c2n4OlUsmsUXe73=3i)lBAw1>^<x@eIG-O=
zSSr&DYjUL={!a|(FOh@)iIH^4q0fhNLGo{Zu>;8cUd+D3UULk(Ma#$};;^@P$G?Vd
zzlLtVWat)Td4;$w-F|7%7DIl%i0#47wb**G1Fn9sgFKRw1q~^&BV1gXPe?YG>GkE7
zXC;L}oEo5jJOKzB_lh`=;t^+W(B48kwk6=kl9sbZTzj+18`$&ZwwbqA#5T>&oi8JQ
zd0pP7<i$5l$P@t%8}AO+kd24wh&ata8)hIh#lUX`o$kaCT3Cllr8U40tKWd1)9KuC
z90U8XC)jL<{u_pH)zz_t`yKhbj(%Pz9oKB`H*Tbs#<}(OwWgb6@)0g!Z7;{K_o2=(
z#AzKqT)!Rx0Q8;`+7KU-0O`}hPW2^!F`cU)#b`ZE#wnYj!}wfO8I9bCIEO0^(No^b
z91NVdipH`oawqYrBF~j`hz%RYTuE&yIQ6(QP-YIDT2^&(UT=Y2By4Vd8L!j_jeUcZ
zBi335r+92&k>`SxRiZ1BL!o{=%#On>1gr_!baWPajL|blCJD`C+&^bGA20=f>$T$9
zI3<nRt1DOZT;1N@SW~CeIp>K5_<tun7@XzUqk=@(D3*d2=r(b9y2R<l2T|g=s*$K}
z$^BS@+jWu`C`8510)1#nk668aboK6W3$!5Aw$1t<lIffyV#h92A*1Vc9U4fYA2kE%
z1%(E5FI+f~Z|b#7Kd-2^qgT0qi&kYqzF}6h)R+10RVDo9?+@%`hk29>JNB}FV0v;e
zJs&1>Uxq7mGI2?rKcZ#Y<K-_S1B&EL-Gt=Ik`v+*bq-l@mr6+LGgG`7C6N!j(mt-n
z41PRzfE*5~DyR^_EDm;H#FCv4`e!8xe2rlvj)pi~Z?|zn-~G_ax8**6uFPnE)rY_8
z!(UDxCJu20b-38MR2ycgbJNN&iLdV$D3Spr>8Zz}i!qUA&~J~^E}m!EF)h15x>y@M
zx9q_p`jjyE-CTBEVM&5>y}#;S_T-=m=N0xcovMfhPz-bg-&~jh520f?_dFwBOVuaH
ztCx;rjWDv0V$niG`{N^jRAfv@Bd$56TU!A2EJ$4;GBPcS%!E$rA1fqcyv!T8j!vWY
zwf9~@l}$t|Y)9gx93>iyLEo}3qo^W{(fJE2<o2GnFAqPZCIPV-xEssMvQXdT?>XT|
zXrI`bZ#Gnb-o#*$SV<dSSd@;ov31|&f^{s;8?r05U(7BFXqYp9F(40Y+4voc=z#2{
zg@%mfIf$xTWW$*-8%O4!ph`m>-H=m;;oh9nzK%DZXA)G8ey8V%hOTW?z1jIO>%lVa
zaA)uiKP42u^td2<XPMIskMs0;I4gyFSO$7de^(r^_OoZo_E0I?gcSUA$Yua9VuGYk
z;umVcR~@YGU0>LL%j)K_l&jT!_!a%Fbzat^Pbr(azC-r&R8>ik8X3JcWli>b$xpl0
zF2PurNXoGct(PjI?Y5=dja{YGPCI&%P0mH+<A<*<-LER_msDYmm0U%URkFWaowdO~
zqlb4G_di@uh{%&VL{)s?w?KB_pC!Q|nnH-)Eg|0_DI1x8Dh6i!wyg&#dy8m0&*F0_
z3z((DL3vZG{zWDgmcHzAS|5{H7=`VfgNFES=*M_M$`iS}f?NReDQ5wCIO~1&<+62e
zZ9cg(GJ27mfTZ&bqFhxw$!ji6L3Bk~PN=oVSv-ua>FTu9LN^_sW@vNcAGW$6H%1em
zB>kJZF8Q&4Yaa)aLragc*kxrGZJkZ$is`BG`a0(wk6m7pRxE|>GvDt=>TNoF@?yWN
z5bkt{2?eybE1yUAq34x=q}$N4(55XPXW~!v@9E{la_HR*a?GCi=)eE#|6repRhX-a
z5rGr%X5MDT7%rO8lYLPN;d7;No2u7h-55Zf6F#_q3CsRe(`1t%1@h@*uG&egs}+4R
zzkk&&ms58oA(>v;Jr<hpM#uCG6Z(Pw*&&kXDwYm#;QRSG&!Ky?;jVAc|L?H$?D}kF
z34HkIfbOAh8YbjEnLtNBBnjH~M^2ckm%G(#YtgDwJTo3w*_(~&RiN+nby@Y_MQ?na
z0y>U=0J&0|?$CN>=#}i~GWj@RgL1X2lvg0Py?+u<ciBQJ|EoQj^@eF*e<YF^7P~(Z
z5#R^5M*Tw&Bv1%3iCtJ-_%R*r(jf%swEl}PtZBn^=@PQO&SsTBjyUrI{mZk6@l8(9
z+Wawn%X?30@30Yc&uaH$_OaLc@BjM$b%kwzlT4OO^Jx-~xc?6)pz*&rXP-MB#nK<C
zi!9bQs%pAYHbDaGq|ryTyH!N3|A^kaK6n?+b4#>zaF0g+*@&XnchL$amgQQJyc<1E
zh%e?5&+l)q-@k3Wd;RBUuU1^Tyg$Fw&}I%Ma^^}$<n-(PEuM(Hwncj^Fgx<1cDt>A
z7x2X`l2PwAx3+g~?>&AJ{?0z_6;{yR(Z9Jfs-KzTxR43pI4#u9@j?<a9ZfR03;3MF
zajCs>7PQ8Z$kI4#WfM8zrTgPR1;E5;Kqe?T(LEws_LQ*90fyB(=nRFe8w#TG3)aiu
zDobV`NK@($X?F@c{$*N`->kqRi^%+chaX{-sSSi<B};C6zy)JAgokV>cOk<onI;OR
znnT&k<cq|U!@_|N_b@|nrZ^w>l?&NYMP2zQz65-(u8%>kuRDhV+wgq!kx+%w5o{al
z+#~q;ar^Nw>(NX6>{neYN8-6$OF^GXwi9ulBBi&+`S5&hb=@m}5n{Ar(8q#*TogLs
zbYXsS+ugLO{al`#(zNgmQNO|c_z&LnjmZ8b!GkV+|1{O6T;hZQ?*$pom$eaT91%C^
zVG$6+C>%~P$s@yMvQCa<86^`YP!?-XOf<q5h{~{%7stQj{r=TFI<%w2<k*7-CO3C)
z`#c^EySIq^GjOp2r8sEk5+2WgZe_cT_SE(2ntQ7df#Rg9lDS?b1x#IPqSqJ%Gm0jl
zw)uV`A}HM#mlS{Le(7YYF(=7Y%$=qsqL=nV8+S^3Nmm`FCdD*sXp&<|xm=Nui<{v%
zK249~aDv(@ORTEsIXswrbamXA<Ae=HyEGP}V|R3>kbALI;acZRLC1`LR?3R5-oGMP
z+xU3J`Qm=?OJG6s>o>M;Z{FEZkj++h)bjiXhH)&XqopsEf2|Q09znlP=GwxM;(&?A
z!lY(nEk23U@v00=h7Ac$YX(OmKKbaH#c}U8X$<!<dZ^9V*nloQ+~gK-QqZy+-GcPJ
z)udl~+2DLP`qRPdS8W-8FFiV6{Yl@@ef#?Pv$xT2e!@S0?nXbaHGcIon!m~W96YMM
z7M)Pr$@sKQi@JL2`<ES*ioV)=`RtZG1QhsTcD%|ZfArjMezHM+?)qkN(rPiF4bG*V
z46}1&?HU0^%o&7;8jU&7`MEx0^UCYLPvhQ0-kmBC{iDXO%IBtk0X+J~lanmd-n1*$
zNmdH+BtbwBzUL1TtKWjY&XiqlY%3$NuTHs|v<u-EFLcxijqSAh_DJZhqj7NKOkf>~
zUo*ASx#A357qy9M4@Wyfv%WweaFg8{%gQy5Q&Yxi2V7hs-HH4rlE9}^nNAxpcUVR7
zL(=MHq9UC89+)_PnY_hHhPa2=18EH>8hIdnk~Cm+vI>dCDuh|aaDo(XjNvhM!(-8H
z291{3%j2YA*(d8=UrmVc$&lMjT8!f)8NpVPhM;o*gCK7?^bJ+@NjNq@_^b-aU-XME
zYeUx#KfyBy^`HLalkw}r_c}FacIZ==(8--LPYP+pi=01ynw2rPX!J0bVu?ud@jBb)
za!Iy1Z)k;VNXwS-UWkmvK5}YwQLq&-VmO>9Qp}3>+J0(GW|7qXON}b_be=fL$iNHF
z-CnZtYzI<Bi?g6TEqf|1)z`xx>WA^v&}N`{e%8&=sj>>t-2J2b>XU>B3hx-2t;RRn
zgJ}gQf_eOZglknTOaxX;Vw9COar>#q*T}y7i7d9$sX@{f!U4MBJZPcZa&owi4nc4<
zOSeil0IU&xcy&+4yNy=#hRs^rQ?iD+PTM||17W9WApP}5pf|k9(^K&EOP|HfPfG+6
z96Gv{E?Z|kAt@RvPbNYupg5}q#m-iDO(U&l#CQFFW;+$85S^iGk9L{+`+*Dxc=fa>
zktP?Ll}-}$7Gp7`-J7yG2Kt+&biX<Im;%l+6nzV{7;F{?+2YBvenQHGn1uX)Ha7ff
z;R>&0NR>u}0r#>8pU5wo+hfam1_Wbz*f?A8CJ_}Z{r8_T8d{O46{Sxb8w?*(ELQuV
zmD1;b6%9s7_V1x5-b>0KUr_2kN|U@XEf>CppPr7;{B<;G2+4HpR=VdM|Ke|nR%!hi
zc319Qb0!rKf`fA*_2wKRB#MU}!rxCi^fLi=-g~oeNwtW>7iA(C;jF4|X|anP<YCdj
zi+1!aH*Xx%&N^2C<V~#2#iSOVCi!F5Qw;=v`MSO;L|tf5J5Ta#oXv{id63=eJi%>e
znxMeTS=!8Z1AYr)|6@1uGK3i;e+wrX^KiZ=q=MS8D7H##aaj}^j~17l(7dS=q&3r2
z*4Odv;n6A|D|Bx&L0Ojf!D(LQ!Wz=(KA_fOO{(O_+L^}9%#=)?e%rm;AAS3x@SXC1
zttbqGBRynI>L5Tn7gTFH_EqMF?fTBqGVDXf65(;m{h=?gBk(|AGyrp=*0iAC{UI;?
zDl2P0HP(0%Vh7kr@4!7CMqTc%9OHSj9B6V8c-E?&?S~H^Mz?GYZ>=dh3LUj?!-Kuc
z!n?GXe4o6w(A5yzgN<q!9v0#L13&kFX!TaDrx_NB9|{Fl((syI^MpMXtKyRsoNc*R
zUzGIPaN{z(nsSd-LwC`|+YMIH&|75v!?hCB6(0QOC_(CEX&Jl-HnNuW2sbX6SG~<A
z@2=W?^6Q1RUujdx@C)W@X4+R0{Ys+$`XoBx{GtXc(6Y+KfRxn{6QWzohW@~Rdu0DW
zjy_5J!v4*mLXAOkBoyn&wK-3z%_@;LOZ2(6%d>TlO@%IxRy<(}U9L3vMj}j4mw_U*
z+b~t;o8{;d|1qj`^ytztR#$2%ab?Xtt6tuR0TuEs;zl`Kk^6tBKEUMI3CXb$>S4N8
z59dkJ6XwIxV!6xmCXi-zEtV#KPT2|BYCbaM$(87}bOlMG4?z^|!E7`sR)1Q-)K+%O
z`}*@*`6)r1EFS&@A2#AWEu>R1rk5||-N3LbKL?-5^!!bjn%m;oL=XurwTNvr9-kXL
zaMPQ$g)@j<@y?=Qq`I_h+H>?H<*wCm)_#|r(ZhK#zT8nr8^ei}ANetV@#<8QJ=`0$
zej^Q=F-Y2^<u+;uVV@(J7TM5s>Sf3bKLzgPmLhwk^p*<P4i9)>d6@iPT*}6p+}>%1
zER>U&6TE_pQH%!EMX;be4j@k?hjJPuT4JQ{>sCf?nOloeO3Aw{Shd){u;n_YyHDG#
zWC!b(N?-<=89A+CG-L;V0PsV~;R+7(pJf`#m#VcK&7oQ_{Mc+M$I75^Z_LNf#Jt3i
z4Phc21L?SU5K%Z{RCn&)yZ>Ob?f+b<yIlfCI264;QSqj`UE^1<2|3+_H0RTJIMeiP
zZnOi~><O8e)89)pQXF)vLCjE#QgSxsZJ6%LN_VX^N)Vc?uB}^tRYtT!j6HBiFFafA
znw5-)oZXW!b(w*$d$HOb^F8bcnGr{suCYfa*d970z4S*(b>qnKRKv{a6mFKk?Y(@V
z^{0$30kqO_JSk2xc$~eb-F*+cStKglbiCrpi+!ZyXXBR3Jvw!PN++6py=UB`@tT$>
z^Bxb^(C^9tXNJ>%lhtV6s@TM_#{HA9>aw~MLNJ==#RhoYS@3Lty*LtfpQulWJD|-1
zzngXbU6iKcGVffV*K;4W-i00udoA%XB)hX@65QCKxIx@%$gO+`6g9S4qNON2)B#GF
zd8IHFHPt!ZMq2AM%%tKpe9vdFiDH^Ehj(el*T@#ttVWA}+1I9ncidGTL5_E640US8
zu1)I5wx+9@MTZ>xuNnP*hp))c+PEvoCzXq9+R!wvI$13qLc-3=IX)O1jS%F#+CWE;
z(?;@&2F(E<1bqLqHWat-1bmN9op*dW|AN+BW9i)5NPmvwRGE%PNi`T)hXGowNb{kU
zzuL1aYw*2)%$gdXrMYzvNPck&(Q~YTL|7)cs4FU2{wJ}dY6}7SHC`M|*xHnEf-HL&
zOn5y`BtDYDUmBkW&^ICEtEBlcVAX<^kea|l+03hNx&E@|YOp6js!_<QPo<;z)pKcU
z$awctzF-BnTJ{WbSLK;-A#G$$T0zFvG8?nqk_Rw<=-lQ&d;Cr|!*!l8-MG>CKG7^r
z_G}&&vt9wE808{49hD)9h<d~9ctaUnIif_%qEM5n+swTo`dxG~qrWUedzfVtMgQ^X
zIy@%)WQy`Ft*Vn!7WR&$VcR7EVvNOk%}tUe;Cg6WS6&j1po!degXIZheO_i`<RP$Y
zI*-SHPMRVx=b920Nm9C@E;vfuM3Xv~j!@?$;cFt%Z|P^QUX>tpnd!ibI^*1Ikpljd
zF<y|*Ck+xbC0$9#1C&NDU_`S^i0dxg%q`p)5|yn9=W>m7^_bDPnIHhgTdY28A97`x
zmP<M`pG-j9(LT;-es(@;&gt!YodDw2i<aPjtoni6LBq)nk`lTq4^qnlIY~s5G&bR5
z73G%Okxx$1T#n-Z!W<5cYbayf{p=|nXJUuD+atT(Ztgby%O$Q^-U3|EBYIHMspNDw
z8i#vVI_?~siA_WmvjWx|OB}lO!kQ1#!>8%c>unrlS}kNmjk6A#4$;Ete$a;dP~?Vx
znw7yhNMXLgD3F%^F`wuzWdUAEIh5MDathnFT2RG?c)s+X4EDxs(f8I^^x(Ac57GDP
z&tfM@F(;zJNNsSG&c+hEP^8wu8wqZoERU@n?Jc;2%@o<)k&EBb5!C`Gxi8^zg*^FD
z@?^?Y3gx7FUxG@?Q)r&K6@0(1Yw9z9Jx*plm%tEIR&i{b7jzfEgYv2S!B=RwOuuFM
zRI;txn>!o2cA<5p;?)+XwJO`Wrs-rf9lwz`Kc($urld2`=5=s3ky$NTTRytv0Dgme
z)-1kPI?PSYy~#&TstwX&f<k214x>yZTqrrp2JuiT9&I!pqmarRFWO{MQ&QJ|-HbY-
z&T{QdAln{;;zb%1iKB{`!KUXjTGTaKIT^d56Iwj3y0V>MW%d0w9dSU)Zw`$HIj|2`
zHf9^f4mU>Uo$@`}D!{u@AFhbg$#gZjpttGjJzP<AMLl0q-J_G#TlG@@aK--G+TPJ?
z>SOH0`Ek*K+w$R0D<6{cEqFA4S)OjKG$Z`7O~2gU{#l<or%y=xB*$kX_t;UEp<%*G
z|0GNM@|^s+z48P7-HUU+EPlm3T$Vo{ulzv6uKBQ3(Fj8>`YplHVDd3C(a;Dlk(pO-
zXt8PjS6J<R__r=!ZMtds<rbfC{d(`wa{s9SJNgM_p<Cf<W3jQ;QF*a{pJA=-8CvVb
zOHC`iXrVDC6bN2xDf2xnZRTYMUvDm2eD_+Zd=+Uga#_-!R4tR27dVP|NY1q{gkZ52
zlHsLOkb7IWcc}?jn?3b3(mcvjXfqRZCXW~1q7z72bQ$JCFl9rQ;Y68B)^Kdm!V{7g
zWOW^`a46(4r9hSsR%yh4Ny^{n2Ig8!PNqcjb=-J0R)zoE3eHOTpxp8SkX!C8`r}&T
zvU$mw`mB?ZSGXAkY(!Uc9U|t;*DkJ@_|&T7l?y}L5<I?nj&vzIa*K@)FB~EL0+W!%
z)fuQc@NETIm%TkD{oRT^(%gY|G_~<9R6D_gDnBvE`g|Has@-LO=6+C{DhfrZ)KxS?
zNw+dX0r1E*rMBLq3eT2W-KH;ShLB}(hJC=xc~&Srl-{1&DGi2ZwKi62KPuI*B=7oK
z!l>g}hpAq25)Y5)YhR!M)#c9XyO;1ucz<KXG2uLs?3;jVLVBWem`zGV7zD53O1S77
zS9~XA?>gY@IwpsIxQEU4BdfMo+S%w3tMS7j3bY+Q!4FnI^Xo&cOOa*BFT=YKQGL$?
z9fbPdf#mFmK4_bpU|_hk+!b-l1O9U*8m5I{te_wgD}i(rSFyBQ!H%|Z@~!I!fwNv~
zgWJ&)U1#1Abv1hoM8({xb6vM1E+&F`bqgnFoGhAF!we^Xk6$9$o+ixLWDnlqRtPJ=
z5uS7!1ZNtr0l<(9k6Lj5vPLiQjiOSD)xk|2+*CqkaJ$D9^pRV4nYzl_=#cxc=~bS{
z!D}9Wloow5b-7YnB91j!0bDT`gjfKR6c3VLmntJlB@V7?zFaI{@*9y|lb=hak@AM+
zO|tF#w;7Lrrlo2m>Wq}hy80r`UyQx+oFVMDWJ=+$YSOiSbzwfyuYP5j`}8L#Ww2-I
zXDd~B2LWCLo`!|T?}5R3&?zJxYTjpkn)p;nE}Sk-xR5;r3lmP)XuNl(nMX*miWdn>
znwNk{ogErwZW*o47<Ed@NQk`G1lQ-}3iI%>(=sD}a&uAEc6cE?0<d!VdW-(g=^TuR
zqPwnu_d$dC@8wL7X+!?Ku{SKTCQ8$XV6V($wXms#@#`Rd%WXfGf%f2O_!QyjS)OMu
zg&FY25^)spq@$y>&nmBqQ`7@yoSV%ZLlZo!p&vJid^QHl$%ZBPv)uPhjA}q%$0fim
z1ZWd~Kd(?w(!#y0C?bc?O1IXbyKQ!OxQ^Wu#xWrT)l>PTT>Wc{Q875wXBZt;iiPU}
zvG+Q5Q%7zp^(!a?bu8}fYP5GDsv3PmW&Ui<SkqHLKM$1sdG8r?rBpJ|(2w&^S?>aD
zuwd$J0wcblkyqkdIZC5xj2C2-A`_d8TF=3M?{y}_cwBUJ+XBbGhXoqSgDrZn<pj<e
z3A+TT42V3AlQX=*r|2Xh@m_7?1CTbprKO|LwqS<zo>$V{hUnZ?>T4rej<|6=hEquj
z2_d7TRh-Nc%1H`31cTB*hgio5Oj@h?Nu!_DMNA%a<Xsxz45rObkXRwM-)~u!I;aJI
zyi!XX_{F{*26vthC+9)QQ6s^;Qp4sIl6IN&yWAqxmuVj!ynOfODz(_(6r<^6%_w=U
zvKzflt&=mead(F+e6T|>_w1FXVIL?<XEM21L&MVpUZC?p3iM0$GP)*O@5qHk<7p+L
zrt7F(PI>oy0*zl(;~~OLtr>``pBmqP2<a(HQTA0Xo^#OcHcP#JC0bPS3$#VUg(TrO
zNam;s{D?Do0Cl6`cfqH0H5Z4B+Q2qw-Fd#NeSQ(}4-ynYI&;q}zFBgbO^WM{CC{#L
zXI;$&s!5BIk8A3e7-EqGUKo6WIP_^cOpYaMOT(B>vlmhPhhMi^(TjBap@>?4tw)W<
zA&GC%8Gi7fR~LwMeL%Fg3!W(JsdsNb*nsuJ&1KaO+NfA+yOCgPl~=DO!6?A&qO*QI
z$S!`61|aTI1?*ymV`C*_8tOwjA+slLXZi64{<U#{OqQhck{EdBT~6}mh^Y2Wo=vlU
zhGy4tJ;L?Ku1EfQ>J*WDoJ@Uxb8c2gU|HtbnD(0yC8u~?NrveERW{Y&7f*fu$SE>u
zB{>Wl|BOrnDU?(S;xtFNNIy}(AcmHRWd)9OJ%%lcbS&Wb__9xdx4agr=B~rU#Os&C
z!=#yC4GXgbkbVQOm`h+^-ZTuRZz)*8y5x1^3#DFy3)>TkYXA>fn-h?KKNCGh;Sy%K
zJ@<VAWf&D(<?et%+sINsz)yK6CnMB-r^`vGg}MK<@3gLZ)pyqQ@Vk+Be#H&_iW~an
za6>_*SHTQbad9zTD3ku@!wMZ|XGg>MLvlUk!#^DiRaHam_i}4*_pCJc9$PEGu!&Tu
zUnL)P4<G7WA_Ae0P^PqhgDirX=)&z*K&!7XC*Ik47=MM$JTzn}qK<0X`lZg;Z`|vc
zKZMf#I9627P`-yPSvi0zp68nc(RK^BoYvr$YeAcy`3}|>Hn6^4FYD_fY}aTL%jy!J
z*cS0Zg+#+59gpcy5}$5|EPN8&cUebV|L_yZQ;Z%(dpeB&3r!h+!hZ(yfJ_$%lTOei
zr*?XJU$vRe^{01$9@gks@F;qFuot0!&zm^St4)L%oF$yyg6Ro}OWo`~=k$E<-HWH^
z@2hr@y3+K%w_%Fqj>fz$SU){?A7g@*8%JMZdhcC>*I@PJ$J*(+2J4qh&)qk_cvqR;
zQ`b0nxz&^AXqC5r)l5(CtC`$2r}rp2WWCpZ`2qCEFDZiQ!6h^IwwmejeY~*}Tt%Ka
z{dU#q)o$)vxP@x_YkyVT|5qvQSJJB;bzMcdcDmJ^%KP^jvBm4@yZWdNQq^?%$BIhH
zzlq;6Xm~w|&t0FIqjVgP`>3lctjW5Wv~%57<hB0-y;hEYm+!U0bN<)rwDM*D^Dofn
z<;(u(T3u$Ib9tzptpU8jAR;|svxx)0kG8di1AN9usF*|UPhXHtpLlo#G@em7>}fW!
znkWRf-Q91vbAaSIg150))P4eDhgs7v%$Y78(81|tAH%!tr|{PHSCRMCSM}L^RTuh`
zM1p)qj}kC{8?Gr{^-&w7Dqi`=paTv6yH2Xo0qtuS*s$SDNs`JNzO*EjSu7_<<#SDr
zO73Z8fR$fRy8dEP?CR1&SLJD3oNyzUs72<I35){&(%xhI_knNw`;{wy<;q_&f*^Ez
z6*GsQxIBs=1Aj)Yuj_U_zV9CP166sy{v2?B{iW1@f{f1hxTPESEgcpfDIOv{fujUm
zB@pLhLvnCkbQD_Jy`3ZocPK5_GaOh->9;PWbdM;C+4;WCmpQC!S!Uyfr4)-(g?p{d
zmVl>uHh;^KyyE%Um4Xwu)`G$VPGg!HUJJc!HcAxuO4@6nBH`R>ovldX*1{qQc>Feo
z*>O65zE!P~u=jI)giGp|QuB+qZOuM}^mQ$;1*A`tlby5z#;yH)?Mn*3l<Qi;ce@p;
z++9mFAjCB%`B0XD+`phj^gAtcd6N~><6O*gPJHnhY{|!@KckcO_gRvsg6ZPs5Mop0
z$?<F$=kr6gIZf~&Js!7a6HeXJ$8Qz&wJW86PblQMYUN7wNLo@8aq_M}b{rr-^gDX}
z1*@^a9q-UgR&z-ix`B%u$fi1U{ZIhXStZ6LhE*=pQZ54~LMGU^;Sp;(=J)nf(3$`f
z<WYj8O2@JEm3H)oi%KTC8Gj$HFv045?#rG&UeSa=&ZHlrhzC^4RR{k284w&=6bi$C
zLLHKUh=d2{$MIOZduao{Fdd$6jGf=Qi5^cwIo-~e?Q$lhY>YGDd1nGbb#nq3Cg*2A
z*YZx&cew8XjUrhlT<aD1?~_5P4wDO$+?>v(oeX~*e-vH<rO7oddiw%GR65R$2a^ol
zqa@ScC;~096o~{w1|35hN=D7O3a;*d8|8KfnsL?jRaiPem!{J7rApZSc0=3W@Zq-U
z;hAkw{IFr7httwr-ixHy+M@sGU<Ctj)?T3nv|hn3;&X*IQ=?xI^~A%_)y8<NaauW&
zdfA64N0NNnNj5|&f%H`5d@}uzuC|&Ao<HaA4Z!G=cZ?kJMx%(2lA&)B(N!ORqhxaG
zK&27Wu#;xekMU$Wm96I%n293VYbI*Lv{F|Rpj^Vvn`BG-X~@g0(pb49*zbIp-K?+?
z&8pGO6FKwUcJzIsg~!ZRF)&cytt^Ji)1c28o`#3u>d|{rCep@PJf2qTD5PRTGYKk)
zY4)8>GAg;gy_oez=~Vb3W~YjO2e?u9DrF`P0D<|~8e_1(`uuf_>+3*9DqXvX{<n$#
zYikJC*Pr-eNXKN?*CRi=9@H$q_yyaoK^~u#VZwl58t45J_NH}>lXS!5U#f({8kW9n
z$#?J2;l_K)@8<fEkb{=EU5UAcWuYhvT)ECHZo4I(Z(x&@J~S*YWpku|FW0%~ZGkPr
zsqog!tmNA`i_aa>6L6D!`%E<SLY1345~Y<cnz&u6mKEdHo*-Vq&{)d#+*ttN5+0hw
z{SVB?r-4&<oVCfM9Bh1acw-x*Y|y4zNim;&64&zua8ti;{E9YbX()Ecyj?dMqf-I!
z+wSQLY;j?gerChjinC0A;X)BDd{k)GJV6nqpJkoBwN%NOP0VVyOp`Aun2Z>Fs0fS<
zE?@y*YrgSqi9Q2gmjT_GbZ;@lQ=xTt`T!geHaDR09QxMn&lnUhVf&c2F+<f`;tlkB
zVxYU50L@e$V4p0K1R3RhlvC_6XzBDMwEm*4JJHK@Ov-g(vlXj<ww2=9)>NK_Ph#s%
zYb1AG@hz?B4L}pOqbIJ-7Q27w&I{iOM6uR3zYNFHt6k+(h)~6&#fOb>9=&~Wz{<Z?
zL<<xo=gWU&Gj*tb3wgcUi*lAl3tji}Asj?HQcFe(t0>pzZ1kKyW;p0w(@1wuyP=*w
zo-@<+_s|;9=R!w+tt9zrdGxF7;4d$nqB-ZNb+7u;zFIet<=nOIyB8$KT{$Q222$-y
z`EOTFd%FRTF3$j&FH(&dICEdQA5D&gM5Z+$^O+~^o|3cI4R&cJQ80t2rL>_7X0gl+
zE=nGfWT9-5%q8LQj|R?I|M^R=!GUz|zA)KqE)D2?nAvrI(JV>{`wM2UAeGA}>&3pb
z!p-1~*}1>O4A8B6ehtKqy=)IIC|dB3omuNV^~jbgn!ZLGzD66qNDSDK=VuHEoTeYI
zr)ThkGC)<kpr0z)RrHJM6`3?v6VC~ed@mg$=MWvZ<01v-n7U9Dz1d@oYLB$K!*#o3
z7t5cD50n*uLZM)#TPeHivpgtKFnG_wKn`>)UuVs5VH7$Oh!(_umK&@PJ;aR|Jh{l6
zq%l08h8qal$eJKS2@Jg((!SLD(V#G+E-fBvtGn2L9rQSQY12QZAE~PyK+e0S!EhTt
zGsmE}-{){91q`o^2o5YyHADlp?C!MUX?C`a)%s?CH`fy%+4<ffS8MMD1+3>*3+X=~
zDkjMPnUy*e!v^+#FnJKh7d8$HGvS4~c=@fDd|*iF`v3ay*=RC7*Y{sMN`gCEa;HB2
zdK}E&Wh(`!)3ia{>sS0)4xg*3%MPcNwFcCLB=&RD|7q(6+CpF^VgDw%=2CQ@D>8<A
z)>U+WYuAWJQTG*X@;mvLI7BjsRwJ=`aq;;2_3nRkT@ysw2Bd89KJXyXQ@;D+1rh>l
z$%okb%Hw?GE`FLHYw?Zxu=EV!QsjIjlaHrBLC()1b&j!2#3yogSNroL=uFzz7bZDK
zMbvY2IOP-JT72jNnxDMwIp@119u?POol|*#@*A?7(ZVM?n#y1mHd?vrc@IC|9@*uR
z!A6!<+{@HUYDqQPd%$cpjbguMZ$Pwj_l`gh=i;k{FylTjpvhS}9Fzm#7Ba2QJ&c_0
z0^A{DaU0s!;4yR08A?5!1oeG4s<*(US4LO%&@!Arh~t3J6}a3j=I!hN2WBq2mSaYL
z=da-Gl|hc&J9S$DxK{<d3tE_@<I@Z=nQF|rGMIco6JO5CQ=<l-A2|VFpk-Sb?~2yf
zE8VQt*EK2?b|>e2%j<NVpL0Na_!*1gkeW|2SVG2SNA8N?h-}CwuE0YAC^uZo6Knmk
z60rBmq6GMR(SZkHla;^VU|=tp<5}2$mh1WW)&J^XZXQa(;wF~Y;P6^Km-21WG_t_`
zzGXRxvhl%m8n6)a&j@HsAG*<8SBOLFg7L$uA{5yV@JTUiSu@oY?O(?F&K3O6N;~Y*
z?)qtDW8;R5<;PzqUuH2#KQ#`@%8>Z)xl&CfF^<_w-{~4zsnGNbI$m(Qr+yfJ1Xl@Z
z5Qsv+E&yhpc0X>&nXDC5Te}%)Ake~}9xYKuQClT?4iKDk-=HCqN}>k0VvoA~ijKab
zqX<o1ZXZJDI)@{lF6HOax?NV^GfTaHWsT#9x2$hOCYXLpfcf$38DIUuhWf@^*-<NZ
zO_iYw#VsdegfNU$j7+Aa@*s+Tuv>-nyAiNjfW*R{B=g|n2CMi9<9D#Y;g6VR<xyF8
z2Z0@r&$T`4#)kNmdpHyv3(k(ye%QA)dKj%t<KlzsUp7E%1;mYEN}m6kJ7m%@tJZCB
zO}zcm=o-7Do2bxB0x_zCX$0oStXILt<!25g7~BSWiozbg%ZRrkcEenMQE-N>g{dY7
zJmz*BKlu)r!2`T3!SZ?xV*RFFc3t_OwTZ`fX*2rGPj0n;4!Vi{<|qC0XKqImu8r3s
zz3W#H7V#MU^>bHWB#kEV-wvYJw}#UrmU3V2VRjBh*`*-_Z55VjaWgLt|D8mbKn~Tk
zzLBkSpkCbn=80G5S7d5`D{2!-NrBl@l~Wr^QUP{M&H_tJMhZ=wWN>-ngPl)(AarKa
zD7bB=%|3q3EQ6TSk7(-d04bwd4%03Hjgo@aSkz@GRp3e)ro`_{_@wrA`>gb*7R?Vy
zF))zW4^%=b_XOmfV@>Jwbq*eHtu~O15JPjA%%%Yf*M$B0%!-A7Ympj`-}j%I(P}d>
zEHPUbe|8$dWE=XtEraXq=4`o!YuY4tvfEbQ#lBtiZ}P~@VVfs+%<7B<{5MUzp-j$(
z&uF9+;i*Y{KFs2QcN3`YfY2C?U1Ed=lxo52?<);!FC{zCWGl^>>Kp%gjqd-Z#((^w
z{{oHws>drUxfM%)jsE1;f0;&qvV!GCf1+qz+)qwOOvv?rX_vpbrMp6xKUuz;ZSf~#
zUc0}aPs*J_KdKlAbK1CQNFTkqL4V+UGGh}WHz?$Gbjbd(CHn-DrhQg?O1D5R9Q<;f
z0>yJz^5@2bc%nuLFU|jgW`fF^uii{h$T;8=RnFo{O-<2%h&0$|Cb`o`SqF6Ddc{8i
zz-TlO)_ay0{+xrW1#)B<<pMM$TBvz*4Jz7+cxM1t`@5`^#C<S7L1X_hK8@9M18}yF
zeU%<Fm7)QYVkI4*uhQ1Nod<VrKe)4V=l=FR?zzFsuwr(H-nRW<ck9k}D<1rP>(18p
zySL8=e;Iv$eE0Xk@%ZT7p0?^(;icO}69F<w8PfR;g8_5L4jx*&+OPZ}p1OL5@3?2p
z<7`S~G=0>L9MMKepB9%c4>R;W9}a#k^P6guds__tahQ=L=AV;s>-~ZJh(w-gN^)*D
zIxHDjOH5>?>F#y!8-wor1^poztb|sYt=RqD&7>E9Ke&BwyLEqOu+_S~{UB-e;_ZHG
ztH1r=!Omb1-@iRr@fMm}zqtvml#Q!q<y&-qVv_?_$WO6uS@;5%kL2gL68>x+XZ-#$
z?gxvIj*@@SxAOju657>x<5hCj`5W>56=(DPz{{Q!c~96sP^F?Pt;xmfp#(+KDyBs4
zJpAT=_MO(|c5CbQyREysTiZmk?fZA`-Q9Wc{|G&3PWJnJh}&J})TkG?r+Ex_x(JcH
zJx-<@^!9w?&gT82&D(=Jt={G!Y2ChicZ>eop?^Nu?Dg(G*xKqR_cmnocsh;yC!7v7
zPjH&*$TT;3^am1^Xl9y>uz3&vljnk|Fq%w%yZCUf1-CDS#Qt-IZ{}ncx?BI54(RXA
z|6Hk~V7%bs!}N!Z$)oDdscQpCHGc2FLjnpn#_?eH_Q8kr;P%@;O}CC;|NZZ0Z{H_>
z8~piCr;j)PBl|G?>$m@LyZ7QjYjpDFMX%WUBe0+2L7SH7bbBSFV;X-P2ejheu*}kb
zmq)TbY0FLaKdv`fVyKYJ`!_PMP;qFSR?p0*yy5rCB8gCl&)>Uq_s;#>_io?6&u?!0
zEcP?&7a9ZlU)2e<Vvx`EM7?HvQ}oElkdRjC-&mAdoBA)93&pYe6a@3wRQ6>SF}G>k
zYDeqq`!&5!*VlKWy|P+;)!wISqh6tZ_bJNO*4H1C3fr$tq!3{1VLJX0bV)}2Xt`Y{
zml~<ZCK%YcrL<Ae6?&}JHZs+K<noP7)zQB5VCT+8*ub>vS$C~W#kC&3UzX()-h6lC
zvbTMS#;IizyRdQURN~(kH%^tP_~+=E8U!{j?pnv6ROwoWX}#jOgwsRHt?BfCqU3D+
zkM7Y~UP_6p^y7TcAtPOTKUEZFub?l`k3t=(tSP<IL1;;anvK74N@i7%Hi0}HwwGz^
z0zJB-Z<U8HO>j>ienKNv2H^XCBl=jVEZY0<@}iw)s<IXCLW`$`HnepkYOxLr_V(Sn
zJJ5r@v^?Q|+U+(XRCq;%8|Q9+`k_4H&;FlcJN#gpQbpqsWuuD_P$|ara~A~AXj~(r
zCF@=eWmQ91*1djZj~z%HEI5ggq>_wHfk-5sF!kMO*lnYylx)I~21%<~``S?UU#+3+
zO-Ghp#CKt<S8(lU@6tA<moR(|(d^wAyO+kL%gp@ojm-S<4bS{vw&kjSs3Mh?t1xT6
z&(kn+zg$z+`FyxfY0BzS;69}(Yvh}<%6N56S#N#zuB_FDtkIWg$SO;4X+u^~l}n}6
zl}@aqLbOiHK3~|B)d!tiM^@=PqYrja;Iaz;yUdNh!0Y%!VBu5}K9g~4R(Qo;w0(2G
zZCJK97a;oV^o^73tToMlxbQ6<OB|)8_agnFcsR(W<7B$VGBP-yhQnhiQ~JzW+iw+T
zcF!u+&tWNZlRo}~G6waWA7!)gpj6dxan-HaHlsqVn>+Wnr5kA+_9L};p=(Tfn#T5-
zEqzu)bt_<`MY&b!%Y#a$4n1yPyfP<|8qAFoZCA#+#n|eNMbk2W*~oQN=~x?{zGOF0
z@x5jki}oAPL%B%W=OIn$R@V&`H?t14s`G~`O8PbwC*qqpKvOhARc%|R)!}K$8(02l
z+U!d|f;c4q$V#v{x}CFAJd9{e#o;@SoAB+Lum<6wDe8!C6)uyFZ-Pf9d6Eq?SSy>G
z_wGNHpuseq4wLzRNBL(NU79r%RmZ5MV!YD<9Ou(@bt<ymcrfeP%eFVScUqfwTHAM`
zt$Vw7=>P7_-M&A9bn`xTTL*up2FWOE$NwN9Mf*{ZyeQcFo8rM@<K@AVt?kb1f>yk<
zxw+l`adPb5p}K4Jo3Y|e?=&Qp`)4tr>YAF)Wy=1Gv^U*<u>3Fji*!F2rRSxdr}N&k
zU$Fb>ToU@%KB!;&p#HDzgIYNaU$i6YeCGcz*&DSi_P_Q<{n{J#^Y%tX<cyXV323CO
zfNDixt-!QIN>M6|G0Y|lU0^gv(q{7&VUr3cDJ(PV_h-2hm$xYy{1Cx4iL3=mZ(Je%
zo*LSZ>Gj`#B3T4;*N9J{IzAisILxCF(0Bkr=3+}vbQ~b8t9Fpj=sOYC**~f|ZSdPo
zv{fLHGPs|dkJbMCP{|l#6G>E4U8xZ%I#?=%s37|k+Are?vg;topR^H;Rj@@S1t_fR
zwW6nK!Gd}I-EtlFYbk($IjGfaux3IUmDw~j)<w5}W4g?>04Hb16UGVFs1!?d;niq_
zr0rf(|D19x*c%L*W*hC(<NliD#_KQ|{eLnoi*Srv1sUg)3EA_iatr#S%y|E4L<eRR
zPx~k9>o8bdz17+-AC%e(tR`(&G0Qa%bq}g?wD**&bKfS%v{<^S>NCVk@CMKluXVX1
z43E)&Ef(05;V?OMDf?%-v?u$6ZY4FHS1}%^M+r8AljC%Glzu>fgJejI8rj<oC06XO
zEte?NzQhS<#nu??PST!B<Cy=7)5f$zCMu<KS^&kGbgtO&dRjPu4NaRV+%x+};de<I
z1Rh{%;eDxcd((M*yYHUuy*%g~JbU}s{U^_VI`oz<ZP00&XJbZXw_H(OeS7V0)Lkm$
zr5mm4hpfo}&t5*;TjF6d4C9TizVprAlV#pVtkfQPe-J$fqm^%1eg5RhT6KhUe3ZxS
z<9@$gS3%od(5hO3kC(NomYUuxwyM5~Dy$o5YW*%5!h#!JvzXZ)_5)Q4neFGWf?0ll
zVLw7mLrGyBcBrH#a}b?o+*cOTbl>%vt>RF*IecLlDmRa%P^jF3l-mZ(4YIOi)93%$
zjd}j({Aa0l+W)hg4E--?mjvy^H^HbjOnPm}OzyNpMX?ACab4}EZN7D44-T}`qwFNT
zcA2ZT(O)URWaTt)n#s4^vvx(yi?J$yBz#vd&f93VbO10RaAe81QX9=Z+Kz6wCH@!|
zzO8JGlQSA~r4%PX@ikYg-+>{;v8mEn0LLa?pU-@X+p#O0W|d1)=J5vWX4#JJqWWD6
z&Dr8A)tXu{m1=Fx@*5=~NgbG?DhFTax9Mx^r?0SIU$n`H;|5n~Gh!Uz(nceHZt%~C
zEcPxv&eLlG<mjU|NL8QYAIk`1@(A!EON~YjcAza!=t&s!S&sqg3nCSGJ<QHx*G#1#
zlObcIv3V?JQ!+SC7$!**EyUJN5jGd}_+-$I{+}ezq6Ezf;ON&P!&tWgHHxcuqUVp-
zxc*rknz$o~x0I&{-<c;dCM`*SUOd<dg35Z_3Tu19r${iQK;%IU5>JGg>3EoqQdEjN
zM5!|^T|5+s{GRz1Qo|ho2AV2yh8@SP@FCio@6dk(qv+SMqx&8CypDceCmq*NQsB3j
z+gp13TGP!j`Pd)QLY%rxg&=YgL`<BVOp74tGmKc#K@X6j06M(mYB*zmI@3R9xp>^h
zDMNQ7g_SEL#RH{29`^0Vl4y3uIU@o&zEhJ0EiOW9GAJ_CH#@|FYFRu8vB{#_d%uIJ
zf5HOWaP#Yn*#t2tj}6YCedca=SvfAFei-M+#K=%A1mFxUrgW`S2XOMFy&30<C!Ccx
z?#n5oRe=e|$M=?CJ&9d^R(RAK?Zgb@Y<!MY4bC(&V+<z`JbS0y&mb@ig_V3kvoM$&
zC*@y^OT1IUaBx`JN;wR1KLwf(H*!|~2Y%}L;`}vI3jd6z8el6>C(@7f?M(LFX*%e1
zqg6k=h|un|Ncy-?xbAECm|B43%Mg-rSv*|z=IOUrHc$T<`NKkggG=c6rtPx8=(@!G
zs=e`(Ot#Nv@9`J*X8jMer=hU|jNTo)uzX*3mC4pu{6ZR>8}U_86svD$L=dLLPuoNB
zeOAA4@B0J0;?RrTNB=YGLKo;(zVOw?-nAzZy;QHgjNCR}lxG0LpX=o_PSA>aDjG*w
zFR6uxJ~((GujyrfwAArf@S!98d?ey)tl2Zwohu<Df6^Dy%QoJ<IEXaqlaDrDu3!2o
zdq~pa4MUMusnj(us+rG)RJx$+SdAXZy6GA}j3w<(ciJi}LCRf58tWbn&)u({&KWK9
zTe_5Hmwlm-`k&F*vO=W+xBvX-aL>PN|7o*cKwNVVNm`$O98AxL$sCp93MnACL}Je%
zOiQ$Rb5!ciArI&eA_AAuX_`-G@leB8I;Zz<UldDyp~%O&J@k_E7uZ8>lIrPZeji1k
zUv&?^`a-_?LcUzX)txIfTiv<5(dy1;@O+?PV1Xg;kuib1=0Mjlk*0;Phgpy1$@45b
zre&AbkO%622nZ9Z=lie0HSGF}B8{JmRYN;hmvR1OPY#+WTi|RpYthC1fVgtX{16c3
zY~$&76_U$+lv+=vUOEO^B@0eQKwsq10KNoGYI2hH>(X<!kd#x9xkzMWR_sQx(@Fhf
zoQWT;EP4Y%WQe9O^r>9IeUON8(T?`nAuvibtAf#gdB2ErfN0Elj;bW~p3^@s&LM63
zY`e;`EVS|YdrtTf+8dM?IKLGP{#X(G)lKGn6<0~nTN9s=`J&2bzeNHWFb&En7E;#_
ztBajS+WJcqmr0P$guyt{{si|0Z2Jv4Ss3okIqmCs<9Q~2#OQZ=c4+A0g6vx&bIv30
z@KZv6<x7tXvUjf6?D%+iJ<qE=sY6u#uJ|no;^Uto_&8EcBksM$sJ+?I^eoQj1N1!d
zmyXW!B$f-!^JmsKhguMSzq#o967k`iiw-Z0U;5Z(G#9;m&LDw~Cb0W$PZ@OHAR`cp
zWI4Zrp&0Ui<*QElRj2$SZFS`Af4;!i`w2aNTAW;q|IX}LH%x^G>#v>*>k}a#MqDe&
zhtMIgOW0VTbVFplrHw4YkQhg}AR-g3CLk4p%W(}f0ZNBWWzI40T}z}Jk!<4gdiXLM
zA7|(-*xnf7&p}V{4n_D{6lM^%acf3!9+_g$)K6gezI?><kZ@L@3`wb7sokPu?=R(l
zwHNXAj!iA#?B5Zk-C{|`>YJ3Z*n9;!7;td>=9=vZLQJ*>RfqqQy@fZnw{7XxcFW#&
zZ|X1Qb-%jL{dzw2lEeIpj`OR#&95iuq@`eQeu;PwiQIzTf_%J}@z(H(;@o2zz=~#K
zRRi{U6m@OOosR6oEbYE;lOaNQZpo{EZZjO08t3i;*Y4kp_f32g;=pAjnd^A)h;z96
zP&nt@#`7L8d~;EnWSr;mxeyWmMW3!m+3dz^uH-XPc*{dsMGlHoV-f>h`0WI6xC`Wm
zE>Ds%e^<u|=cq?>p$-{P9gm;9-QUs6LWEDbxvnK)#XAb1ipnHCO`^4z)dtOfQN`Vz
zdk^Ne`@%^YKaiXF)%3qz4Ai~obbHq8->y4>?Jl>}4H);eR`Q8#D$Q%6eI~n0`kA#W
zrCZH#yWQz_w|&xf^Qn?MgfedxH6zbCQcX|TA5Zh_3R(hg{)RZWBqx~8^6x?aI+p%N
zF?tEDug_sO9Fx*GllHz2ErqOq_rm>a<q>ezS|W%5*s#9tVRe%6F++pF9EPpVF#3i!
z00+q}PPmDO+#Puu_*UR4VqlrK$&`3l6MA2gGu{qK`tf}d?R#mCmo!Pv5r0Cvu0Nv!
zDCXC_OMv+j(}QHVr^jQl6W7<JITdu7JUKxny1Kl$IWyi=phm@lM96}F(QlzY-|rV|
z?A6hJ=>U};XvL<-?Q5#V-6SiA{{HSw6JTs7&FIND^c8=3(Tv{Cu-I>BJ%P4)%RV(E
zDLl=%mo-;`lj<@gVO}8NkY+MVd3Bt=&ELUY48-L^)8Lljd!(5rABh=j@zfahHI%AF
zn!a#vcF7FsrJ>&E@NfKofH8^+KrmVlcr;9sX<Of$<;Z_RVGg%0TnxO(N*HNaqn;^B
zbi6!dA$@M<tI;cSlC2P>NxT2VbIXDS{oCHl7d*3y#lbUMWN)|uSWI%`aM%uj^%`)E
z%-aNrEOhaJ$axyp^Gw5*g3>R6OEMWLUMCWoOWO1Y)49-QS{){T$8rB$R?YR9gGSKm
z)AHnibhfs*>iHhz@iBvV3`hfHV$a43%jBl$XqY>mz2Da&3Y<_aF$I7{iZ&QYZ~y5t
zXBAY)50FX;IuDQz|K!C!e~$U@c7RkFev5Qq5x>l#+GNjDR2xmQ0v~=}dVXuGL;R-$
zFs71i8V~72bE&I;>jUBJaAP#=hvRS@eYGSf>y6ouqBRX-Z83wNYgpeLY)uudCVC|9
z_PxnO8Q<!dEl1iz0r7x;N?ijPBbSt3Buv_Ut?MyH1G|zq`brsF+_+EW<CtFqnDX0<
zh!o~1?+WLjkpP90Vpl%b)zy|;6g9;nW<!n+?6~lfcba*Bh6u+CatL5tVF}rr=0FkA
z%Iq&M#Gl^|>qT|ELQgiIXJavu6edX)rGhqr?K;1<pq$Sbp(s8*CrNNL6^H2nVL+b0
z<BZ;vbMq+qUO45EkvNvXND<5-hWO}n74eY<C??5Nm?#&e($7r9AR}Vz&FIhpO$g8h
zC~<k@h$ep^p4Rnce^&>)gr%fU9l$9={QFJ6+YxZGqBNGqR%H2N_T>~(v`_3ciAVIJ
zWFQprgspIOyEhu^>w6)RhYA4Hh6)qcl{-{MZr&lD)SMHeqg&k}6OiOCehyDFA0AqL
zl2=2nusX4bg_U9n(X=tGgAtBk;0TxdCbMbaILAE8xhsZKe-T0Q`^b?zh=oz#ju3l>
zc8**(swfs36heBcd$HyxUcL_!t>8u>TrGbnZw;_Tssysr0S047QV*qCJkE<UrSNJz
z6;M4c%UH-<u^Q@!3Y>O}B{}bh3&n64iUUMAUD7CmmbT@QKZxw-zu|5NcXixdompC@
zP0^s7dvLLof0yZ0gb}lrqZnO%ZJ??<@B-<~LsmpEYfqx&&HE#l6s^X46rJcaQO%C`
z%7?~U2+5seTYNiX34rBU4_P9I9vq;aKrRImfKyd-Km4(nAL#PFL``WpDU1lLgH+iZ
zwaDxx1>BGStm8bUC3AW?K6*d!d`V8Y9!vT+7Jzpmf9$TkOml5ahSWrqE|FyMj;%RK
zi(BGJ+CG_%hHILWjx%tQ3}yo9QeD`NUaWFu->?;`Oab0WLU4F4LP?QCj`CQ_iDo(L
z-5Nq-U?N8megR0XOeBDrCc@lapyNTPd0>h3pCx(8hb7_$2}5n~Dw8;hPcshlf*W{<
zi@zQae}kvJaj;qZ>BF?cLv*lKTb<JaB;RuP%z4}|)62BOHiKTu#zHA8r;T5xmGNp>
z>NnggMCfYxna<~JDHB~IVvh-6QxWbFn8G82jVR=7MUyn?iz&!?{BA=507RA`x^$9;
z+k>5%vPl-2c7~gT3=#e^@RlgBST%009p&5be{u3O`Z70G>nrB0rZJd>$seh<C|J?^
zeaFD%MzdhO>OGYPs58+BnJ|4!ycyX6(P|7v$P{FVcExTVho92)KnkpAl^Z#e_!S%v
zL`jFqNBv?9%nZ}f90^sy`*OV0g}s}Sqrib$JxSrQ00xcMve5OiV35c-7c9WAK^zvB
zf3pN+*GVfM%v^@Zp)8pkbJ>T^G~3AeSL2f7`{U{jH1oXRAR1l7J-RI%Q~=)8PNzpI
zzzMCzhk~EPWC3v)%Z+6|tbT>Lx5&?SmpC1&H+|q=gEMI4a`{}QdS_W@FbB{c8QH`q
zm{%?92jcg|r3b461&Ki6jTT-Njb@tue?#<aMiOFl%<yK8oXGzbNR#bv4APiuON-Ov
zAk*Nn`|c}!KreW#JcwHx@YZ<L8^qTfcq2Y5IyS;LoQU~?{}r7UB@EXTYoJdB<a|=j
zb^)}PA0v==!~x?`{EuwRjx~AV##$NvRiqC)UbrEsHZ|yJ``4KyBC{L;rxt$4f30R)
zu-W?Dx>F-dJ3C~Iew+5_{(e6-zp#iO0ICA@hh^OG7*gm2I>7h9v5{7#sDQ!1y@cU<
zb^+GIzPl%H-nV)T$C*o=EMto8Z@iXY!z8gdI?l3zpcR5q#Ao^$r6p?v=;oc|lj)rJ
zvprg?D8$4u;Q|02*0{1B&Jt+@e}aamsY{oPr2|;z$Bfc}IG|-2#TjCZ)4FpoT&`3B
zjfffJSa4WTwjBt0PXMgO#!jS;DmZ+;kBRwu-x&<CHs7pfN&j3}CV)Gz&S)znH_#ff
z*<om3#J@SusI3hOocVl~<R!Q+`qFe5=coab-4$PCwA0?&!oi(Nk2IbNf3Gt~WIbg#
z!ZDWu+D=;ETu$mjNX1K*%ussZLQYL=rUi#p=|pntbA?5&Kp>+hx;8jVK0>4Csl*<-
z=1@d~Kb?_gQ+QSxaLDL;gJQI=diG>H8r^P5wo@8bPPz~BYWx`a{U6++P?TW$f#cqE
z4BF?TVVF2@i}e#SvxzoHe_Q%))?+VLwCV*Zf6o9Nb4TpQOxv{RTjn|ix>=K(&O|Ui
zj;-KcGRtWv;5mWLgm~4M!Kywa0Y;A$QhpyKhSsDv=+TgKKF0v)MxhVEr=9TMjaQv-
z_aDEG9un8!*unnGr!V(kywK5iqwdUeOe8CA9MQPyD(E%_$x(zKe^$r4;7e-)gPI;i
z<LD0$qb-k$s#voOjTI%sBAL4+!w@^$T8sY8|7)8>3Em>8?7NNX6Ec5A<d-7WvxMDP
zv`7w<o==<Zwt6`k7uV5Iw@8!Yq#N*gXdl(q#Ejf{*`Tt#J>+QcpiwKov$+|y`dd-!
zG-`bptvsQ-Qj%7je=zm%H{ZYPynFrUXRlTwYtn_EzI%P}j%=lL<17?eoCQc{x&!>k
zjx@;Lm~6~`yZx=d3;RSr1Ut3j`!IPC#q^}Ogt3V}!xao!Nlj~RWwJ^oAwenpK3pS>
zGIjlO#3C}bqiCM1-0P_sDORx~BCH)vtwct_JA7A<TTpOje+6u_Tf5Qr=BDp?aSJ^%
z=tq2RdoUYKid7kSP5Yinrw9@&mb9qryuEq*{>#S@38RDz_VXsodOELJKJd*mId7By
zkh`LBf-qz9vCqEd=+5TL$3VKkt~R4nlF-~)HqWpJA|Q1jeZI)#c#IK}nT?p~95aZ<
zAn7x-7mXpDe@2>2fz$XSAh`4(AvlYl6DI<CFx$HD%fYq<BR2lq49;RY4Y)0H%lb2S
z`SJPKqGJJs*xl$iG?flbrSs=!e_Qd;%lz|;y_b)l?#Ve)xG`Z~LLKf%Ajgxg72I&#
zP3|;-<3!fJDw_DS&;qr4WK4E-Yjdp|VWPqnR=cehe@TeqA^p_FIQFsDHA8D>{Qx^V
zG{BY(pvs8Ql1l#43FMrg_4QR0^>c%PVr_jr!cX5oG!^=fK&eH2uH9o2;}tZqVeO@-
z$p9J&<fe!)cN4vMx12V!8)n<=)~DX=UY3!wyL`&dE>9w&+4A9~wWoOn5qj*yKdW)|
zoxANje|P79_W!war@eFG4gNpdciZ>3%9Eh|D^FspZW0f6+7Iqr@Q$s`2kp%zC$Y78
zyL|`g0^hUP11gRL*oj3TU4LMC2#CXz;D82zolTWs0ul;;Ui(E!$8G)Y(m!9}hIx{i
zBbriXM|5weF5yF#n<U|)>b#JOZZFC_iROu=e>BL0+nbADzWHG5@|P1u+^Nqf`D=<G
z8+1@&T_^Ji^jtVo?5d}3%(X8N;6Us&l^~8zQsVv|gLp{)oSr54Z*c$-+beU#wWf(1
zbgr0|Tzbe(9ym%7JvneHR9xV9I__SD9WKQRMj9dHuR^#KpswMo#zL-kUjf9`+-zJ3
ze<yAx9g~vaj61f;VFBUW+PoA<(s1iB|H<Itp&PpLUa>~XU+iWS4@a;Bk$`zh#@~4A
zCdY_gWL>sMPvZg#2{hMy)i^n(J>jg~(51=t&CJ7@h_fzqcmP?q;O!*KxR)TNT=H#*
zu>$|V2V{fV7}BqUA93r*FysQ^3}|=(e*p85S=B2!ZmNN8@goE|+UDVT;*G!Sx_J8G
z5TPH5w8fX4kDSp|&MhxI;tm6<C<^t*KGl`f8Z1$voo2k=GV&ueBhF1=XD4Yxhv+WP
zsJ_-|ei+Z_vDR6Vd}wWLD6O{4>)aBrv&$IYS9l%&u3|bH$T4<XT%;eFzx$LNe*r*d
z|MhO*7<Dcw`JoMT)RRQO;6fK@xW?uHO*6j7dp12%r~G1fn2Xe|t8-MZe#f}I!8?MS
zvlF@2!fxu{8V?Hc?=i{|5+SrpM5*9R;@kz4Wb}O^jW*8HO!}QhaXMlT2mBc5Wrk2I
zOl{cg?4n|~SJ{Q5YB><x2T1}!e=5t`;%YQ*j&z!$QHH_X_{fwC%=c-#cxW`Z#Alh?
zsOgZM;EI^0!}K4Pr0)H3ne&`gEqbkXQd5lI;M%Yzagp-5<U{BTI6%NBQJA_#Yx6u6
zw*)<Ek&P1``6$iNe{qPWG@3ya6qzv%vhl2EniIW<>+MuuzztO`y^Oe4fB!`4M2`Z8
z1!gz@f!HqY3o?#rlDlPxvh$o2yk63obfDh|9t-!T29qqP<4D3l$X`@t*!ucz<5vgi
z2#ztd*rhA2BgWt09V<>~6<UC7E~QTi)R$&Jy6gxbjt??PS!pY*_lpd*MxhAdH$Dv#
z7mFDO&CPc=S5v94@${t)e*&1sW<gn`_nI0+_e(f0T1s+mF?a@Gb{6wO$C|Nl612dD
z*bm-@IXusdB+MG3AzIOGQhMjq0$hMLJe>RV#;<<$j?-S)zzK^e^(Z@Mi^}{aHz-PZ
z1k`AeX-SIf2x)_~-o1E8i$vEnid<j?*z@ZgwOstj3k7mXrDo=xfAefg0!W`Da|mxC
z9asZ(7;&6&aF)}h!Ym(u7NoNw-rNt|+Mcq@ePh*U@{4#z*xYT2$tmV4P8Uy_3tX$a
z*3_I1Z%~w3BhJ<TyR|uDFLqbe+Krw2I&i^V&}{Izoo}MtMP2bzi5nQ(KADXN5Nn}P
z($+W(H|c{;=2F25e+9(RH@WQ@roBAQd2f7GQ7l!&@M)iO&_7LvlEefW=Or*^#7avg
zzQfLdIw31`^+NNjctAV60d9IjIIZSBE7vr}N_^4hILjrsKkA2=<SE)@Rf8m!)+O;}
z&@?gtou(uGDM~EaUW#vZCrl?Sw48jL#9ZDF?L_=hoN@f8fA}<(%;#uTc%BZG4A7C9
zxPl9EBeKj+H#!8lr1QE?jhq36M&IDgq}q~Zt0z>HuIE`x`#0DM^Q>47o9tHit}(NI
zn0hZl{^MlGS#+AKXTsWQ<ikV|2~ltp9K`G6e31S_H1A;lnqm%wOIZ$?cwcackWdp^
z;I}oMB|)1gfA;q1cDo$GAl9rU@4lgyvbkj7Gy~515eJ`@)1Gmb#e8-g*tf9OFz`j|
z@g^X3U1BZT%hP_r-Y7>?d~{sL4_N{)zQl1T(KQyIa^}=~h@?7KbI2D|oIxvyiDTq6
zPe3>{8i2~t_eWWe3n&Imh0jWiXjfF5RJ@sz3~FJef6`v@+$1lOpMV(17&Ec(J%L4N
z$d|;H4WH#m>GtBJ`r0CRZLF%8U_jK5rmvm)*IHah@s_#66TR~t(reSpKh@Q+md$$M
z)2uhhtN`#yETSMK6){UWIxIV#@P%-KLLnhuwsBcH!;4PLIuz2(Z%@)5P(mZ^hs`NT
zoH9u}fB2er&0@7g7$g#6Z8b*kKVW65Bo}r|gvdY~6PI$2Ch?hN0Qb%-yx7#Pav+*6
zXI!<xc6XLbALXh7May2+^uqL|Ry41)?M5#F?x9IFyv{-YrwNFJD=2^$6^5*v3leDs
zxdK~ML6%VV=5-l4uFpPB6#z%y&waD_nCd@tf7j%`#G2PQC%%MY)x|$a=fxYh|I4w=
zuFjp7CO@C6&aHb=gbsT&^s=dz^8`wqZZttIm#&_hGSf)+t*b}mRbHKv>arVX^z5tQ
z9%gj29-~e?rF(ce$$l5&;Uk5vgPK@4a1Ut;bofwkY-Iy@@C<^te5X52jkjb$YQ})n
ze>^z<k$gI-YOTN)|05bfZWMWc0}JU)as-mr_)fE<D>te+?eB9|d*wzm-2I*2cCXy(
zOn85<H@GYJI-iTb*V*)yTh)fwI~$UMp!t#3NKrT2QIzE%N#EB)WrwaBEyxcD%Se_k
zU<(G2EP_EQ@%Dk%hKaY#;3nW#1HUMXe|@j`N&ln-s=6^|re@1zS3@kwO}Cn=;n1B3
z5mmWBIWx?axZ;A~e-Y+{sg3Tw<OY0WMt+<JRUN;O<PPc4+Gs52P7+TGmJ*)Ug7sT`
zw71KZ6S8qx&&UOjC(Ck6n}PbQxJRsAgf@%l6je5@6?~Gn%{-P}xPfIjNXQnje>wwS
zOQA|*C`)FfOr?@-iK89Z1}#^3Q%QQYwG{0#h_~AX%c0$F-)rxL=m1rvF&+&sTyUu_
z;(xa+zmW&ss2OQ3az);Q!0-r?Tn-liU@rM)NlHa8>1kG(fO_qb?CsG{%D1$5jv4}e
zy7%1CQW*X8*7N?mXKy1ilO=lce@*1^P)KCm-fSSU-+9GJ2=mvsHX9A5Lwe6D8`FdM
zxRVYZt}y*~e)@T(E#*?Hc+Z-I{!NBFe3gw8{Ru*(Lo6(Li2njBSVjBbX0%2Br_c4l
z5oeQ!-=Y#*ewxO|#lyoDciL8dXg1bh@zFfQx@U_D+eEtHaU#?3cK;tif9I?CFU<OA
zh5z~~{dr~0-2(Rl|2)bt>DA!rs^>t~%0J2ha~5<D%R@BWEyVlM=uxy;9+adH*;=zg
z9)9%5kJPBY<zaA#xGI$2sdTwney5@d{BCaiD!-d^S({uVPD6}N`2Zq1iNt*Byd9p`
z1qHh}Tn>T7r!q$05zC~1e>A~$V4@x$Ya73k#T#-z=gJG;#4W&?u?<|h5*ccfRMRlI
zGEyDWPWRU=O3w)eLxK&>mK5nB2}vB|aJxVf!}BT`mg5R9mxjZzFxsWvoa2ag!8qb(
z`|fso^CFfw8hX4p$G8^oEf7RI+_$jivcjQ^^LQ=QadpwDT@z@He{XrpA-?n~n`)$!
z(Q<12t?bM|r_F)LG5N^u+u8W>Z1~|-_C0M}R|Y92L--SrqQ%5TdP+KgP2r-BYNN#g
z44$7a7qv;HU(|iG_jd2ai)Sw$0=_`Um$2t>emwLiRR^oI3&b3Uer%z$3E({V9u>EN
zN(IFzOx*SAj9Iywf8G)(H(Jzxqi0<-W*qhE=+%>cLFmf&X(ZciFpxHUK;N3cjTQO{
z|NFoG4@!q)6)=U@80z=}PLT$qISd+1oLNb5#<B7^NLXd|?r@E$;xX~VK?y{=rpiG=
zX}-{*Z8k!w5`uV!bP(oH#{##fx10-jFA&QQY988kWes8Qe~<3a!&tfjplT(gt$Hji
zPbYI+M1MCXa=O{x-o99|3b;s`dp`2Co{xBnP|OYPvC22iaS@z_Q9Mwc-sc9h{+dob
zn5QLjYo2s9bT8>=p?Pf#ijUz%{K%z51d7x5=E#?%JoXL=?(_KJ&Q7-(byJj-Kit|B
zsGQOb_M_f&e|xjrjy%UZOI!=l(C^EAWH7-k#z$pG{7^WC^xDG23wFG~cTI-|M!?vD
zKJDn+S&lW3!p5;0jghE-r8o>Ns5y#!``dxIK*ix<vX{vkZc4?N&{!-lChbV~O`f4t
ztShs`p_QP1e43@2AR++;h4D~~AqA6gX(RrP0h7}ce|WQ8PLDF!+}!w8J~tQW4}<(D
zRr5N{Wh@0sNmfit*^#VYr&eXLkn2sc_1=GomgoJ1nPt6sR%SsK(Ia)`zyIt111c>M
z5M#g^NS#SS=9#LmkXXtlaFG2&<3$y(pZ-EKcf!v_ncJn!n`1q8!JBkjx7)Xw3!LRR
zB8IS~e*yb}5e~Bph*zAmMEqdr56ozwaVeC5LxDVgdDX2-p8|fDOB=wv-_X{e)zsgI
zk}F_7J4W)5WSuIWb0#2hY~f0sp5WFcwg#k}!#->1ckV{FcG~xEH5yi?0y|)$@6|vi
zAZ~X3k6X7b0~^O^7oDc)r~!r-70Z0>G#k=)e-&m^w4y-|wpF~laT@0v!?d?Cai7M{
zCW(l$Khr;S=l0IFT<}30yZYw!!Mo>gpB;4G>>V6@|N8CIUGC%!&ujILr;m3dJ6^az
zTJUgs!rhu}G=#}^qr+QIUOsIdeE00di(Ad;)`Senf~&}*)_eE)w|>xPxH|qc9`2G6
ze_Gf$q@>gN+l}tnFL}Z(+36RUTsn=Gph=aNS1z6W-A?oFHUsGtGHLC?=ocsaBK%v1
z^#8=(@V^)-!9RC<dvkLa|0UKkbKjzah_;$_rM;I|k0pm{*J_yzb)tT+fAiCu@1Oqc
zK4T-#vgt;<I$ynu`S-5;&%(Wa`|R6ie^1_VrufsncYBZb4xV+MyngkHe%yck3JtD3
zdH#L)Z!yZ9C&yrn_Ay2qe{{cqxHig@viH1r{rvg<tLNN6``O#hi)Vj*MlaZZ_3i7L
z3GvId@PiAzVU_R#qx_>0td5<5XgnJZ#YpyQ00-eD1IBAR-h{Cnos{d!yz_*0e;@sd
zNNYDF2+fxGr#n}EnW_)=g1C3F7oo0N$lM!^KjIr#fyB4S(X+;*IkCow7dGU@9+_YU
zjRt*ar-S!&I?=<2(MqR-N~TU{MeZ+;-{v!T$+Sw&5m&qL=?X+{LzU7bNlyxlPIXy_
zDVjc4_{OGyHYRS=FyYJpUd+9Hf6qJCxif5_kF2kkw3vED#{1|I<aGH@n$mNYAl5n!
z4ZZdCCX@tHT4r2?X`UJfRTbK9rfGy~@ti$JR%0sq4^+`~fFl$SNFXDT0$zYpu{PuV
zk$kR{#|8<A47UU&l({XbD9*92AOQ#;bC8ss>__P|K=^Hz9Nb01Vd&Gqf46{ivXU`b
zYfrAP2M#h*%UqK2rMhD1GjW-iWSE|D+UxO{3A9!*l$<y&q#ZE&0u-7VLUr@I<9C8H
zZW+)*F%rvWZM|g+N}xMK>$cXw)%zTV0N*ASW#umH9Nk&6h3m~>THg}omXvpkGGI7U
zPpeo^+NGiFJ|rcJ<GcW%e;OZ8PYRXunyfNC@tU<(M+eC_?Pw3k!~$s54C+E?uB78-
zgAy1<2v4CyS*$Gds#so&m2HbR$~<eF08?_cK|9BGe#<Cq!<wYarY3F9$LL*>K~b5#
z_W=cU2Bd3G;g93a)$C){CAKtKpEK3e)X657v%+5FJYlkCNwc8Me_QMycKHIefim^k
z!vEYtj7n`AU$D;&EcjTo$S$5g%eEHY>pLrg1l=U)B&&#XZ1o{g8K-QJ#GdV~uUB(s
zYmb^7hG20osRy}sRfwD=JI3@PTI>ASXVppB#nF*yEgt`*9e}<N+f7c{$ubG^m}tt+
zvjsk0_Q-u;UynHBf9KM?o#Q`X+0Lr<tuMG}Tv!&n3BwTvvqYRp1rAF~Q+zV5>Br|Y
zCaO`b$y&j@;$#NPEGojWyosz0Oe7L(7O~4?=NCW@DC?6$g=6ZnZaA^tk#y5|H=W_>
zFd35tRm{aT0tJ3PoS`R-`xBEek;QQIvP^sf5Kh8^i5BSKf5ogbt4Dg24qDuWS$7$n
z3JzUNTcG{=RnAl|wwV8v+`HwYi@Htruk!7x2J8c&Q?nFVqh}BA1Q?TjaU-*vH^3iq
zXt;P0L-hE)<9j_cuI>?gS%YGm_q6gOmdTa#h=fCzcI6HVtbY0eQ&PZjTsoow0DDbr
zK)b~#RRvqfe{>HPQxKd~zGTb+jpb?9Xgr7~Or>r$NMAVPJh@C0c9Aw3Xg8Wv>QpF8
z`kXMk8nd<%@PIRRhj6cMO<Ws58!72?a=OdZ$S74|amO@FL)QjEe!D_2TbF(so);nl
zM}As<rEpq9$({}4Zl1Sbx6d?RYMij*20M=IH`%l~e_9(D1Yw}*kOKYfj8#ee%C4*l
z?WAVq0MV99kGSB-&WATBB`Hi(`M8wgAZYcZX~QTiAS>sY=98k90LWT%S+shd3ggMX
z#?a0+D{_U;(9tCELbGGpjeL>}Cuqq4sJ*df?+#;RlbUi7vK`CoQL2?dWloX|e27+-
zPG|ZLe|U9=Mod=1@y<(te!}e^3jNTRod0Fk_bC3Dj%Fhbs7+WcfiI-=UgSFoP=WDI
zNp&^cUrw>Z+$DdlKnk^%^)hI+@6H~o(rn1b8oe#&^a(>f@8#(ra-G!r5=a^r(Q48@
zZa1T+kIBR)R$CykoL^n6SrG{to#{~enaQe+f9Y^$VxNhl$JS$CZ4?$EbhI?M;_9D%
zOvMTi@xsk@hu|G<o6Cf3??Kj;R_KH~R>t;=7&MVl2ujDAG@GNDATH@Dz+pc)PFj5i
z_;sq|ZG7u9*(IYYJLHAch3JRA<ysMD4A|SCG_Z^o5}*p%^i-Jjq0I5|2sGe;P;M1v
zf2mXG+H-X146WQ8x=~~&Txx5^bed_x$)w;CIGVx)+9wLUX2fOyx+e=pC&JakDI*4>
zSzi~xOQc?j))oNRd21!u2;stdJqUa}&u-F7aLj1;>H*p1!QTa?eRT}R1U6J~gy2Oc
zdCP6-#F26-<mHc<)mT%{c<HmYI%^KYe=DF61Rt`aus+mPxYZY9@%!tmv6^C9K{c7P
zuC_Mo3oTfkA~EU96UHD!0FTh(_L2d~xH1n4vM0k`3Di&6YiH)Ppyx~Zfa~ilC_UJ5
z(*+e-K{0V_1p}5)N_v2$t=IAvof5r286IhXwHkR1Dt;`TdXRFg#;SNQF0F<uf5{nJ
z8UWa;MW+D<#enM)J7mOg9K0C*jiF*``D_b7e*?LPlhEJlhP{*G^Q}$Ux;2kpQrf!G
zW-Tto@)qpCRnQ>SW!JRE-DqdCeQ)ay-E3sP8*Sfj?`-W9B_uog^<Mk#?fW2%y&!vE
zqz<VuP_BchT&1SWr}ry(*={iMe}kR&{q5g|GkCDozQ6Tbo`9R^{rl~^4}PolV#VzE
zSQ@9F$m(i&sO_RiUTm40lUMCH5ZzDg+~mHTqg^cq(aa#tbv+7H>}Yknef#cj*Gi2l
z@Z;Uh->#{7<C3DR1RwSe4&F4n-F|TAx9w^jh`x@!VVrd)MFRsJ&%HZ7e@5S%A)Os&
z9Ln2w+V^&T%MozicY&%a;mt7F7?|jS81DRHIwP9CfE^a7p<0mIYfQK_UHARoi)FeL
zA4Rqm{iMag=~pH!@}%Pua6UaPV2E~HzOAo$td{Wh5E=!#yk__sV4<uN%);=D+-cvx
zT|Of_589hscdKV)>p}b8f95vM2pWnt=W`RRNV9_Ku*wCOz@N`53p+{>p+cpU9ibA^
zVl5u6I2Aad`h>O6p{B9>6^4>5jLwlRt($%@018R!TYmH)JEP<34@P)&x9+#^?39k~
z?XC9q?aI-;d%u1EUWwYnG49@LZ`~`6afeRPc4dt1yX|{)VuYUAe{T>_2rUWhcPo~3
zi$YfPkYV>Bez@Qq&b_b|irALM%>~GBK6TO#a=9r@8oHEG8zdOrO2fQf9#4e5eSvpS
zbZ@o|(BEpBbFaxF*eGM!sJG$@+7N!YPlq2`FL=OQM%kPzOHtg5Q1~>BiL!{T^+TG>
z<>GW_7^@?My?|mpf6=K73()19k_b~HZ`bK1WsDV)By+r`l65P(Fx#tDA)`#j3pPfb
z<Ti!70WEE9wYTnU7tN4pNxD3EP?YIw>mJe94r|wTB9L@cMNg@5_pLs--M$Y=5GHte
zG4Wu#z4gF}1b<%D^E4+LPLI7uELy$OzJ2dL(JtA8cZlO`f1|vmTqel|s7?#+kFgMj
zw;I%MV=KJMw1Ft@7IPd=1S}O?jkLLlT|fYXBNt~_t`=;UafbmgKIPU&CzkCzOxePh
zumH|q;22%qY;SJgF4mmWG&t3L()-*AffFF{N2uiUEa{u-D2(S;)~zbovq@%gTh4o6
zSMTn$H}9x;f7bzgx^>g)4)F<jhW<hbdx)E+CSjU8iUgw8xm>+=!Ur`>y8D`DynLE*
zmEY9ERhTNhxW0T5VuE7{u3|-EL`~;z*W5>^iC~Vbl-+J`-`g}SzjlZW4OWG4#WcFt
z-rl}#_n5oLk*Hq-@cZ}}F^*nxl8y()*URz(!hPpnfBXLCgUF*S>`fK+<#;H*6R%57
zCd4rcta;o+xI4&N_OgzHw1$;4%(4&S%Q;(6Y0Sr!&4gjByER3BidJ@XRLoZsNSQf2
z3Rb)P-k-&go9~d)z4hA)Gbg>E87OP*t-HTPSvN6KoP_8d7g+lzXh(J`22Xp7O&~7}
z9<;aaf8QgDd8*vRHUq9+oZm%J2(kwOgUmTJ0b`ct3;|y+Rd4u;ULP(jahRZ58z)10
zC5Ku$)Y_r+1t9`v)nXuF2gCR%gUC4i9h^k4;GNB4O*VPzaa-`NVIl(z%#bf{T;O>9
z%Db+|yGku6eDgUDhHFBEL{r?Hg0Nf9)P2rHe-8>vcT1K5a`Hl{E8nRwZL7i<G%dr5
zsA+*9n(sKez?p{-lYD6@&-T#v%oP1Nt6S~6cXyzym={~gN0=uU1_z*lP08x;!|^gB
z7d^Iag6{L15)@Ee1lpWguf?~!1a0@6WpDclh8wMOGc0;j7)rKmncC|!_zf#2<d)~5
ze`TQSA6OlN37C#Z&rKz7hL?M5^M2V-aH>g7$yeZi{nJe*if#N@l>Dzg%|XC$F7{S^
zU*5-g2ZI7D8m8hhxiHnp{`$J5XoS9Cbttl#6i8*>cl3*Kr#D3r+Jl`tUMMe<4CDni
zM;C3&9^AcK72NLNdAw9UJWe0gQ$){if3-L7-3#V%NeWTL<Sgp~G~9Ok!PWym9Wh2B
z$ERm$pJDk6P8%{SbK=ac+>nVqkxot!p_+5t2}p^;7aCjVymRLh3@Z!ET`fWdh-fmy
z-S^4ZzsGK?luKxwkHW#aNP<C04N{F<KF+z3!qg79(1K$W*Cyd$(eB=bqHmige>;G7
z6DM#CqTSg<4*Xr(?EAkJKT*IUG+B>vOM?0am!s$HnZjo!2qQ7CgE248aV*93Y@M~b
z{@mcQ@`T$g_Y-Tq-~d>>{54*!u3!h%fu08rog^NF!B=!VJ<g@+2YW_be-DFt2|Npe
zQZvbuKDtAPz9^W17BBXj;Cu|he=3oAd+)v)S%KlVN=n@w7+>NO<>tn9crPjU8Va*9
z%ifD~6d9FCqU>L2TGs~dl*JjGfypnu8oku?X<73}9N%1a9kY_<9lqP_25`u#>Y0*c
z3C-fn*=<c4vRJ;Nd)##HRLS0HM(0}BRh$z?9cl5714MBdfnMzaM*Wa+e{7Z8DlUye
zrPVoS%fg{JkzSynjrk~+>VqE44v8i5Vpn^`v44&{a}pd$pAb@xpJ3P#$&Dzq{$qe9
zhOQ?iX~%OsY+)@VU~os0c;FS@rsJaw62#Czu2rafOm;M7X{f0Fm77b-(<tl;<^>0;
z67)$g^@K;dK$&p<t?fI3e;_KknsQ#>l9;%+<E4%}Amwd0S-I2Ryt`ACaT@VLE?|l?
z^MH7$vvO$zJi11R6#^CseU1ByB4L1(5Lzx|D~-8ln6yTyCSCQpvgyRI@~a{W=Zr&d
zF<1<O!m+P!Ev?mV)pdrx40K6l7TfC&+V{49Tk;||qdTN7lz;PEf7FcbbF2ziy#fe^
zc4rGGo-fF9xyZe5<WLF8RHGCwVRbIoQd70P6(1T8o_++Zje}v;>>;0kR|4Er8!!O0
z)-FHB9?ef+tj%*hH*Flj`?n!h%h9N2t&5ac=k5FL%}tW6W^UtPHtW8pjz5*PJMMBj
zJa>#%?G9%=Rr2W7e_I;FVy5Mg9JE`qgMPafm}+(kLVvzy5SE!@GpK`{YTSZPuz!bJ
zwADLz5C>T^hbKU0=i=KTJeGulT%Hd)z^m(q56y{AOcS8uNjhi|r6oZ&4`cE1LFSvh
zY~=VNgFF^94%O{!BKYbc(b92M*V(#H9O$>Ku()qSEHQIce-o^Zw4kxIJoZ}|nc4aB
z)iiTaUX4|8Ov_^ixg;_!ZlEtCMwbpMn9Np<S2z%580a68WCG8EI|M<kXbANjG<G^m
z3?+gkRGPK5XnZo9fr&v3x22%C?W&B!j%qZaGX>lqCuhF0xE<|{#gdexm6Y5CI&Y_!
znrdv8de!nae-EXRnpi0T1HZfsy|Aip5X(@@P9?dI?}fwYeo^6(^xN%XA&(^6wkWa4
zup6Qz)Ze5Dt3`038EY@O+=ShOr*nj;iJ;0htHD#n?gj^1Ah84kDrPsA75qpPrh=xo
zL;({vw1>cD9?H_Dq3hnc-M)MGzTaMFrqVN)*^_L7e?kSnTQsA~Yku_h+xH)6R_;=E
zv-r1f-^15lT1r#RqFU?|@U3%HE1I`S1s=WR8|U=Ud+mD<G`;11dxvILs&3@=u|e}S
ztUrJZK2se719Kovk+?3)0cU=cocl8E%`NckvJykG)(S*p*S#{$96o|blfZ=>o7Y(U
z$P?jJe?l=jNsL)C{7Y(-GgcjjZ;+yT<nsuk)dzRm+glK6K0)RI+V%Wa^W}ml=}!Cp
z&Tj*Mp_38E3S*yK&@poyTcV@+mc&k19c8ZcMg@yHyDc*6jQLB-a(L=2K}-OZO0{~k
z0)~1`kyh0)$Ywy<vEdU4vQWl`viSC9d*_a1e@BqAdN0tibbp!^dX^;>!#Qz1Qk;ZT
zP1z8pEn&uQX@KC+OO7%<cVT|KW~&Qau0|%R+MEMeU==QK&D7LhgfhyZXR91$m6ld8
z9hylK;^mb2YuIUd9H_J-X~%7<*<1|1V#%-GZr|U8I|5=HpBeUNStYe?=eOlZdMs8h
ze-|;%Bf$o_aao{kAb>IkJTKIoW~d%lR8l&fqM;92MU(;x0W6h5J`MK>_91rFc|wsh
zOph~9OCUd4m1i<#Z{+RYHfx#$ATy?%{$bi>n43~YgGC`~#%(6lTRIfv)skrnq>F0f
zoUj;{ri!9zdb}<JhpxJkQ32X1(NGz8e|lF6F@p7OhWWPDjd6ai<^^?n<1FQN-j_Q*
zq#hvo*dNY_WQ;X9m@|XS<4I2y!~>fYWXp}vi6jipE>hmOZ67+RSV?EiO}palt@>Y_
z@KlTtcAP@<fRD=HaKOAcAQR@H1v#Nj_k9(sBJ{sF{bg&5WW@HCDKK-&)$Pree^aT1
zsY~9wsX?ORGy|KErgoPo`L=Ub80QH??sTH>ZI@y;UX=~<f>_M?FDUbBt97pAA<?1V
zZa=ttkKTW~y>ov@m8C8E%<ZbGVXvvLKn+%SKBl4W8FpIm*!4Q#1q_f~L7NYP2TQrE
z;wid&FUTU;A1_2FlseN2K9c19e>gwgsAw({sg{o^J$s>gpvZ;JFAA%?!c%tGsMn_$
z@h*u+rR;Ga79k7deKCH=$z;9%+fZTA_9D>;-*N{EN!g&8TS6hopv$wf*FuPF7d3(4
zI8(9T&$uIK5a4f?ti^@i!DgjFnCTHE&7s21R_|=K@7%7Ws8yqv^MP74e*twLFJ7dg
zggijYtGyApI2C7q1(kd)jd`x9v@lb*U`7#Z^t&0*OFCxOSV$mSbrDO(f;-$H_ReP&
zhfJ|fPB_z`#O}D2oI~W4Fbg}13kgR1U3dC_ZId_eNv^oo=g=AG7E7Pj081sALeBv2
zq!YMv`F@B=F`r}#ook8ne<Qlp;`04F&{|j-Oh&z-F%A)f!z`Q749`(gsYrjNL<FA-
zJeQ(gHMF85fpPP_R;t-O0p4{rhus4QFc*dHqNhfE#)0l5m|;Y7eD3eH@7!aDlXdp+
zW#MGi$tAa8?LcYx|B71wTM({Uy|dHax>I(=aaA5yvW&G8jizQ7e<R-|3_^gbRHstH
zrd@x71mXbaA`UZ;s~OE8d78)V_Jb`y4_4#p?W$#pWyFQuu2{@+MFQDuUgz2(0Nak%
zz&mS7+|W~n>iy-g@m%ULH{S@i-(-VZH+6Dba<TJqhsE)h#hLPajiFS5Qp#-bgzn>X
zA<i7;oMptSin3F(e}XyQ_5d36fWc3qT+ac|Rcg%G{$S8FNs2>x2>g<PGAS-s1KVJb
z+&MGG8b)y<xjqdPl^_MrUdFnBFB0bSu1S0R<`R6lp}ZI_L><D5cfB1*1?)}w-U=Ji
zjUM<?#9o$~WT#aLU}J!8S(mOZjjdf5CjgUcfLR?F(#2h>f2X;snCMcy`>s#keEqTO
z@uRvj(OLgPv>G51MTa0?_VoB)122vMf&%dq1!KfbNI^`r#+v8sf%h)=_ATRvYcAo}
zThckF31rEw)5IWk++Lw8X-2z%-2KxuXD}68HM+nbdJf<9zyX8G+Bh93omzP}eZ+Kn
z?lwg6TX=~ie~nhA;5Ngx>#l$)BFlsZKp6lRZ*Z^E?&x;=Bez%Ty8cRJeR0e4X0&zp
zdC#|F*HnYdzKFd@$N<xRtaAinQ*%w=y06~9?0o<F?Vq2$J?Mrg0#f+f3lo4yTZJDm
z%#0LpM$QpL10<*~L2Fnn_<(D=P<2a0l@HFC?`EDje`U|0QVzL8pXg9QS-PGLZjm@v
z*N*jVw?a@<J+q~P*7Cm1RCBJ2Jn|Z%W5{T3(e@FT5?qtw>nKHQk_N;B$@ut?SVztt
z(Z8%4O%I;Yv7!rfakWdtwb{iqJ)-3<c9|9(o=RB@)`wzq^!Sc}_;6(o0$9$rBfr75
z#|<m(f6ug^91HPa({17W<_Gh{%#NpuwK-JwiH}ETR_zym7B=iGhDkEPv~h#`2aZ2|
z?5GH2xh<^k>uq<&{BY1lEFM>Zf<4rqqWf{z8(`bPwFX4HUvaGi&tP@4y`>0q-=<@0
z7!A74*`tM5)I?jq_gZd<qYKrAy@RBo(g_$if7NKEHyeIvNkZicFD>(AbsENF^Dj&1
zXqM=c+0Zo8k@tsi2D9`Ua!f)IOY&p_g_faFPm^Xyc3Ob1F7U9ypZhkI71}e9TeA6G
z=gF>uBsYW1t0Gx*AFsh>KAov>1TC4d-d#-gVyM8xf}+|1G*dq9_yvKMi#Au|q|_Ho
zf68|l55YyF1rmj5MY6qB{4sZ^e50O=O2wyXZ6Q)Ldb+==GCJ+`9$;XsVy+u#@gDWe
zQM|SJXZ{3j`d-_TJzDU4Yr)+#&URGWTpfA%527XigK_RI80XG|_Wi4jv$a`2&VvW-
zyH^=!dvnouEj=9`XJ^4U+gBXt_JVPCf2v*RFB#{~f^lv?xO=5>?rtvHudB`H-hy%N
zKG?a^IQJKfbMOAuzU#q)aqi#07hR1GH|y!}{#Dke;TlbvXWsizL_b?bQ(lcx4Fcb<
zXoi@ZUK16V^#<6t5-$pPV^EG-_>2N}O#{^mB{;{vS+%lBO)zDlsl4Ct?VHgne>bgw
zqdWc@7I4t4NG(6k(A@nL>f8DjR1Ut+L-!Pwcx38yR-SHPF*$qqMp52PH;2_U|As2g
z`z6iV%i+jM5y^a8bxCU^RkIc+YaW8pcVFM1y4<q)OwJH)!C>yHSa0n02s@-ld(kn}
z2M1a@P2y3(YMYqS4tJ|5X*&UJe^tB=K>(Bec^A}P#%idv%R4*=1@EqSEcl(<*Jx(*
zJe__w>s{9A&h|9TY8u%XIr@U3n<PiO8{|0uhAKG*pf_u^D2xtC4twsA=1LkZyr?C2
z4$>kd*O&t~HI*c_9XENPT1PDpIbz=ym&uW`IEf3h>nhsRrEO2d#=f}oe@V5Rv{^%Z
z@Oq(sYXogrVHumD&&%OHs;9RKp~s(9K{<B8q--Lvhc(CE`a)~vHFW6niFHHp0-|~b
z+!Z?mTkYHTciLN@=@8Vnd;FYDSU77S=%s?YYR-W3&aDX5uJAgpT#_PmrTm~3i!o)s
zHMooY@dSeUIZFbxhQqP8f8-Ri^jwo?Y>Ry3dJ*&p2t!%$R;9qgf4~3o>C62WFLbco
zs5|pKgG|AEgHh4tYPVrs={`R&yfbw98F^K+Q3DM>7Q0tJ?#K8vmdWxj8yi>q!p^ji
zq0D=0?}&bCxUPAt@}d5>%BM!r&-}Ub*JZF)@U^XN>)H2nL;jnMe|UAejeVCO3CQq<
zYso4*BREQ|=WqbN7Q?7+z2N9i*qNtX$*J93CA|5kgV(Q0X1BH3u^@B+y|L^2h!i3p
zb^}`TXlC4$bdbn<xW@Zi3}yVC?5|b$>Dy$nSQU^T2KDVbcEi@@S_9B<Og+-YP+Ly4
zqI9qu#kzj(9&N}$f4puN{275To{e28jbTkGFjBA72(dDr_Q;5*C%e&XBc@Y14hg5)
zL80cB&Xg0G>#iJUmG{W(148!yNyl`|I~?y|=*{XBaabDjR)UU*?d{iGmaoOK&$ohb
zZ|1VwEDwiIK2Gx8XfMy>bA~;dZ!}SzLgj?Ys*2FuMFTTBe>asuP|~fT536_dO{Ux+
z#fNm#If~Qa3{5`xp$2k+Mlt4l>o@ZEEw449yKzf?m42vsd^FwI-rU}7ZEbJJ1@7FE
zk#L=IE0>>eNUbJjH#$T|82PHK_aoYg@Zsh3QjwN*Gj5vm6Q-0Gs$E-!F0aQ3z?FcD
zlDd&{*|VKae>&+L=jC)tYYpaYqjvOO;dPSeB+CXt#RZpGbHaL9VO@^Pz($*|xo(%5
zNJ#Ah-E=%l2g#LG)4n~e!K9ke_869s)}J;?Iy+BDRRY;JLky^4;0hlgqZ>QMjdNyW
z#E|$S#wSpYM1^4J073q1M}I@x32aSMl$d@tQ19Luf3U+)`ayGU`fln915<Fn3Y(DT
zSMbCU?j8zE9WCm4He=KII05TE&4#Cpsq<Z_bMzUSW!ar>Wdx8Rcnfz{Utd4q+Et!7
zT)6A&M2qhytmB>IM=9r~Ie#l4@q3er8o+NA4_<UZ)?KzbTngLC#vM}1oO-fWLOCK$
zu8m;?f2No%Gav<Fb%}atKP8mLSbKf8*DYS@w_yf58`FP+IKJC%g`JI_$qtEz>2a{=
zUO4!#qCCR)%Ci!12)Lm6)N-lG>YKO48mL9|({}WDcFam@u7q)vNV2heB4*In;S8~#
z|NgK4GZ}JV;YhHw>FgDfP@@g)B~+$H5RQv{f3YpXv+;3!%w&jf{!<1F0@|^|r*tH;
zeBhTW=z%Ji_=|~v(5n5f_ujnR{@ZuOo5#FOjBf4nQ)xY$oG^k6C9a!h>~IV-D+-|y
zKz*tya6pVB$JEerfc}T}_?Y-lqp`cY+m9tLMUACAl^%bH#5Z2g*tt^oEW1}?R$L@Q
ze~;r>r)aQ_mx~ml#fyjM1(IeG(ntr{FgrfCT(TE0UJBxdWD}nyL!{0`r?VmYvup9O
z+qJ2i$R9&yBayTbl5R;+q1(^md?5Q-%oxut0FY1Ov0z8hXS0D23q}^GNZT~>^O|x$
zMOXsvkv@B=&Q3Ccv7T`;hk$b(om&-}f6SDNfy0(BwtC@brHNp(KH~_1@2~MzW)Ixr
z?-Si|`y!GD;<NkBcJt2WrZ`r>3_&@J15=&^-CrOrD)Cb|8pdZ<Ld7BWNj7!LBXK-|
z^pGr%V?5E6Jd=Uk#6KXgbxIQ0_6OO~OeE4^uC0L!%sGljpcu|aGvIGdXJqXZe{-|%
z)_1GOD-i&%(_8mdT9kzqdY9?fk~AwlLKeCl-y-2mKzcb%n3L3<uG-XOHL2ZBB-sl3
zvD6NvsLjdhDXz_@0zNH~u#9@mQWd-%(chv-3Txgc6GSmSSrx=#(t+gXaC}v=x$!}u
z-J|rQ(#3N~7?v(d3JgMkeZwoTe^izL(?b*xk!X;CIAyCVNW8H(O#4G_pvV?;nh(TF
zn7Fu}gtRdO&1!=$7liH{#<%YiOPERCKs*@a_KD0JIbao!Kk)n*y_?Pn7cLf3WD)ox
zXi3#c_w3^&mcBJXF1Zk&q~Y#b^cb~vulHs^>=7(u<evagTIEUbyoG&Fe;sl80XeL0
zC$K5ifWmb8p`=nk+QFdiy{ZIow@O3?dpU{ZWUTwmQFK0favlP(N5~PRPhtC*TwKqj
zQ0s{MQ!M~eb$~v}ry1Ed!KUS0?VO?BnP|QP@LuL+F8n61-2C6@{6SC$EH~-$8%WK!
zA_GaoAE;_E|J4<QHTAn3e*$ZQ&e%pqBILvp1KLo!uOP}ddc&-@0YAXT;_=o*7Q4`f
z?{y#z*u-YVosE@0a7(xBsAG+BI#7f<bYmx=g-0v9X1uTP>t^|oep>m1{o~O}Q!h_5
znw7im{^f5V4osRBUHt<mJ*JX2JV=h>*${4NTxEWuB}=_?yZFe4f8e&c9kvPzKQq4c
zhY!j5BYrjU5BE|sQ+{qbV}y=yHyonN7X3IPju%f@j3L1!<8DB*ij@s!l81}F!Mdt+
z@jXhD;lKhn>SvX5V5I=86<RR}S-gMyf++ECs^N+?A$x}0P_d~bYENube0iFD4cH1z
zwBcFv+ojtnV};Q)e|Dp;5=2Lcu?v3IC50j#`(KV&>6MRr!aoXSH2CNp#r@JXU1r<y
zUC!qjAIl26eJ=luqX*y?T>1C%CD~~A<KYiY?R@I@g)YA3jM6{ogL?0y`CB`vvA~JA
z<QZDmPA?mrckmf>Z!gP+4fQe2Eg4!96q<SO`bG)IuPi0*e>gaJt;n$PgxR^ab(U-u
zV!_(ElB0%X)Va!#=#Z9(l^3?7#UisdD0tLm&jD(*pA0s(;70Y$qUoe|<YlGy;+pCm
zWMIWZHmituW=w5>`9OaxO{l@lV7YL}z_X8FUTw$`g&KF+B3uZSbGHAXjx>rVpT^W^
zSBoTw%e3T&f7ax@rHisr<b8UEm%5FJtUF7lc5=SCplt((!wbh`%$;a;+I$-=CTmP@
zX$xN@NCM-+zF3eS<Egn9laDd}7b0Y<9etZ}o1Bd7Al^+~$o2J_Y$aNSMk!k<irVeA
zP~QGjv?F+H6#FI5fv@UH7!?nodknBZE$Qz`H?yJif638n;>-(fk=L_@y}rKPj@~dX
zEvEP$ozZ;y`5~>ObRS^r<62brjgHX@Z*0*Dw?g6;6OBkShi@RbQon4`HxUiH3;Wb+
z+83<j`ua|rB{O!IQ)Q2dvKV${f-im*pQgvLco7bjc8Xt`P&KGEaHM!{0-}5H-RrmS
zI{Po*f6)INbYAYg>GF!?vtrsH#nkM?x!X|ePh2N@7)?%&I`pnzE3?MRuvnx|TZtY%
zidNhrl4$(-_qJ@e+tF*<Frt4f6LjbaaIOH=2S|wgyrlDmj*wsD@dF7wOOiN7I3Tg8
z&Dg@G_PW*9*j_2qVOg@h(`|Pb96?8`853@Fe;EIRv}1JJMmAv!dlNK*KcA%R#iZj2
zPvpk@&4}IFah{_)zP+utw{g3X;ru`vqVWDIpkXq5ge{mm{_1izdkEz*%o-!ISgV>Y
z58ZWeJ}FnDWT<pSX%IgozB_CQEk~2-$ljE@=2l;fw%d)zjHZ(+YzL+%vB~bY?_azq
zf0K3%Wmj*yoUrHjN$7ljmjZ$}f9*5qIg>nPdg6?btCj{NZiG%a!os1yR}%^h$XPqV
zz0U-w=7&|H+Z15)Yb8IbYfc0F0zs5Aup&|I4dTDY)s!%w*suc8D7&#Y^=aud#X<a5
zFGF1;1qWn265yp+@?7Dn1u(-bFC~|9e*kt@IwC3Xto1`@gz6_&1}ClE0oqB@t$!kx
zQ@?Umbe^uQwB$=W+Dj5qvjiuWTfB>i4^s4#F{h&k>#4p=`^ZCSR6`S!^m@s^XQ4DN
z?mB3o(?JvSK*0GGY$dW+Yoavw;^GARE*vGA&j@H}d;8;)evYiA`eR7nxvS0Ye<gbv
zv;Om}m*nGQnp|U+{u5i!ELx-;jn={sM_dtZJ@NiwiJ`QkHaoa!O$!F$o&p~(E3lky
z1gg;u2*@lQ%VvK^uhn924y_e!#7u+esec9{T?QIx*os#|TA}olF^x(_9@|bxHgUgT
za_ltXkJz~r4OrQQw58dS20|oGf76fQvyBUB&k(Eo7Z`2k?qX|@V{IG@VU9jiXA#$E
zgzwbc64xEgDi3H`#XsgsBahh{(QphF6<JL$5gQ(7<CecU7=kMhXiWq$7kDiDR_>ud
z&ou;bzheV*?4~e7ha+f7>HtgW(~ygw7RVa3TH|TPKFRr|8K$EYVRDcqf9z5>*QOJG
z?4>zQ#$wRM;TM-y&LzkkK2cT_y+N<P;Sa0d7;|cI_dmu?3LW#mliG0ZIu{~d6w$%!
zC((BF4rcBCzPoGcHxj*FB=?8jEO)El@hbC?c1jmfPJ<nvhwmWaqCOLMki3XrOCm+I
zLYa^Mwn%#EVN&xlf<0>De-a3yDSB;&YCS7MopR8KWA%j|a9v1t`H5}FuW~MD2mnh!
zw7-Z%`W(9UXeePL#()^$Kaz#MdQ)%B=Q)DV8cn8{E2yS`X#z>Xt4F&LmJ~HD>B`Fn
zcfWCxC;J;uo{}myVW+S5LV%k>+J9iSjm8so!O?D#UCxJOyThWg!~U}1M1O1?9_+n*
zA(6k^9XjB{4t+wW=%=F~_J?I-N1`;Saxidl>BV7tA_=F4tbs!V5)=~mXy8|Wo@K}A
zocS^ZL&=V4DPDh=#!ZdN@&CSvd*Xc%a*QzVz}HIB6+gJbasb;-qT+nqKcVGyrR9NF
zm)+APPA*?3Uphe)LgSc-IDc}<pasjyUn1`ke>_URcGuVaO1#Olh-=YDsRoW>SAoP8
z7NU2E;cH$LY$?$)ap~hCIO0wL!Xe3%6NN)MjNQ$~5X*^Yw6lCm2e(uc7RACrj648}
zL~&|MfPD&X<kbHl%M$lBqIi@Jk&*!aByqYXUxhcdskg9qt!e%R-+$U@93Eygs)bL<
z&7Z?;d7@B3JeAql*3NZEieA{QP;n({XBB1o#sD=+voRu7hkg4z1e&DAm;`5O_x8#Y
zV(*cJvZQx?xVyrg_sdO7f9F5CkPUrZngsv$4TtNC30#d?<?`VZt!z8Dd<40V=;vUk
zewTOdcVv`~jshRWJb#wjH*T<&+-`OPX*qka8=}Xs_YUMo4&%x3jGk~~RlN{soI=1H
z6;re<q)JFkyl_rk30)vzQG<k<8W3UxluqLmR9A3KpQb=+_P5BXJu(8O3kd$sb|>b`
zC1MwCxUFmNl!@xn2i((VcOLB64WG97rZQC5UZ@fkYAvm1&VP=p+&1XK<UI@LzPY<^
z*lopOimO?Iv2pn-+=E-o@`8L}WJ{2yDj=t&m*8;8I~-AhQD#~B@H|~SO~D)&IZG>Q
zj@b*3);H19S^vWectie;|9twG7wg%(7j#VU!;r2mV0>F0hnebjW@DhwXks^4d0Ir4
z844|Y!JJjX(tjLLXELPu(X_RVGdvE{Qr&~3Z|NMFc`;HQk@~@3Ubt?e9(zSPtm?;v
z?KJsioDcylE8(Icaqx9t3d3+Q^fp@zr;c)h&;frEKQiPR8~F<Hv^tzGqK4UM9OoJ(
zqv!s@pUBU-up_I9^l<p4bnD|;O0*=iQq`pJDDTcVH-9PjmlyQRz6RKmIgBuedRxX7
zu|5OC<Rh;aYI=k~zE>ld6S*87fxl9YNuq>79;hdp2b!DR5wTwCOd)A??2JP`T+EIE
z1qp?fbR@||8Z8Nlqa8g93Yhy2@+Z+;jqSSvYfc~Pij_vB2c94sfOGEfLSUh5kyN|H
zsdQYK@_&`TOHvVtP544zo`h@pq&w$zYP(POb@e%l@43FmO3RaJzrEHbvt`QoK9*!G
zO~M(nlHOuJ^4^MGx2QkyOK<?L_zk&_IDihtYEWsj&~oE-xz}N>qa(Q<!7_ZqW3j*9
z+F8J?DAr73keZ!2@(R{I_P^J!{O#>da8GsNOMgO7N*fl`<T*XmScNPv*Tl?5+Db-L
zOIJ1@<~8V1^A43}^z6w2i+El9c|1j=fcm*NT}Q-;VO(h)_Q2KWVBr`^m#8rwqq+>r
zax3WA##m#|g^h1*Y;8^*Dy2}o^h0nShnOhd-fOu`e9-uA6%uc9(&89}=a}V>GN8}{
zuYcQUcaA5rWN*&j>~q_Canc1FtBc}?obxx_?U*mPqE%1yCE@#Jx9Tt?3fojwq-Km7
z@244j6phUjc7-%)VlDCZ(!6ynp7r1*g}BkeUz|=RAU$wzvMR=TE^1^Tz${L&z->`*
z1MGG)+HT2CvB!zFcTIPn_8Y*Ya5k|@{eSEudlwF;3F=v<sQUTF{mn;>9WX7{_2BSj
z^aFe^=mrE&6t+sHgjr~K>yTc@g6NYSLVhl5(WB^{{e%8qd1|f_p5TfKZO!@;{09cO
z<Z=nlI9c`XTK|bZ!8-c6^%L%9_48*=Qt7VwBrQqz;S6`nv6^xAuC-LimUa}eKYzr%
zDjJdoT&mzokIof9e27esLi@{c7u?Y#u~Q7_zavEj_Xzad#V1STp;3~kZ4$;do8r2l
z51EO1olBY%JH{9fO5H>I(kH{xHu`DapN*U|jZL_*q6>3&F?&rFj<P>39B_%G+s4ce
zkYRW<WUQ&c(IyG=#7PHe8yAZveSi2w-GA?i!DAsy{2pEc#FV(@4vOW}&#Q+9z!q+U
z+tF)%DIX6GZ>R<BGdrCv$Xz!WY&EsS^Aa?PwG*%p5F|WtTKabaP#>qt?TyqrOS>V<
zCiG5iF^1dtXxkh5<YPGu@Q6=X4p~C**-66DcBI<-Ph;nvcgXV2@b-H*xqmU@(3S{l
zNJB@ZG=NlxyELT;D;8CaOH^k%ESJ_@Ra+}+)HTsxS%{P&alG;dOy@qsAUX6YVdjPN
z1Yu0oNI98QB(~76cUCy<wAA&{Yu@aWJfRJB^{&vp#I5i&a39-t%QF8}>oNIEWSThf
z9D3IIxKAps{W;GOw>rlu8Gl1`tyJIY%%F<9!Mo5Bs|dl^zL1kY;IuLwBsN;v!I6|5
zD3DozJsIR*2zW5jET4N#wohF8eW6twwE;W{w&77#2OagB1Lk`}%Hy&1qEj)o<|YW3
zsR(yLi69n4Ce>CuT3?4}b;J2i7r9r-9BxHV5T523wx(m2-KMIynSZI@*yiCExrRQI
z?}sN!h8=x(-~<X2Vx5CRJu-0aG<JBd3tTCm$5X;HeR_#2q+&0ZohgmmJnJi-5Pom<
z)bZI}K<AA+ZX>U4naRgiYK(<Ey)EWic5@X^<1W8;@7hKQzjM#55@%>BxSz8@1|)9A
z9O{l9r$aG{(BNIu{C^KMgdYU+87U490hDATEVa+Md2YnA(NmJq#k`P)>NG3V#aww*
z!ce4c$NVJZzCM8}anCaR_%!#bR&Xs_F<O1{el2<!ZR@(Vo<DAxnF3dgVwdWouEGj3
zsJe$_<ve*$cfH_K=73lpm2cXno1)dew*Ljo8y>YzxN+DTJ%79viIU}Bao>I*gV+FE
z>|KrZ^_OZqh8hEZ99(%jbQ8^B+k>uFEI4*d{9E;<YuAi~ly)S@4_2di-mE88jK%qB
z8ZRBZly1Ixra4zax=IpEFdzl|A((B<uu;$BqMJslzSeKg87zEvUz~=q2sjL7(B$+j
zhoTH-3)GpdyMG<xD@nmoxF7}<ke&@dw1#>0V+n>jf6^j;v=&V4Bp#wT9CMSv<RQ#G
z#%ul4_wVL8;@ys2=iK2A7P0f=S-F=>NvbumcH@-fI7XC(Vc=7VvBSN!YB8e?Xs*Mi
zWJNb!Se?|;*<`3C@0#2N2N>|NIJ=?ceFQv$X6>G3p?{-_Gp*Ujfqg4o3*z^FX>g0p
zxKItW=0iX@f_oCIWwdGz3n^5UebUfx5^IV9`%%pD8>JuJorS{K`km0&%2A#`XJq4>
z4x8Q2CvWa{KHQj%z-BOQ@OzDZHPI<;lY*_m#}mcRAVGPoi=CB-ymtKo&z@U(tR(qc
z+^ikF)qf-5BY?UHh1SvuAp}v2AbW(%^`L;QaqWxaA^u|u$wF`hfDie7-P(mOn=s6-
zyhV?^H~OVohC^HGjo@%)z+Xdx@r`ZGB=!Xpun>*!u(s4LHH>hEoE(VZ(D%_j^p>Bc
zLD*sBjJvG|o!X?kfITQjQ)hsGmqTu(mv)hHSbvmqFuHTWS<R+s24ncdYB9LUX5>sI
z-Xu^nXJtz#317>;@=`&2+(0WtFvrId@VQAR4yhDJPR#2ZWA7C!yDAR*p*`$xYlW_|
zwF}%B(m85W{Wz|_mkh3^5Nx>&2@yFOnqxC&Hf2YeTcDpwmmIb&1Dd{ni<k-5T}a)E
zP=D&G|3!HibO7_w$}J9OKz{Y;ut3a3-)K=S=sD&d`jph`$e2xkfZaQa8GZtGh4Nm_
zdLae0RmysD-vOGN6$*$@yJ|*G&G{AMyefBAcIh23zHJdSvevA$|8h$rnPx~{)l{@F
z&8&!4UTF^6%FPg@rL?uYBoiMF;LlyAnSbS(l~U0Htw)@xfOJb7XZq}J&ja@^K{)E4
zB>fKzTp+MhM6gqBAzjkeu9iTydg}$`h~%E#(f~`C-xykJ@I}hkOKaV_q(ufeW+)Bf
z$N(ffI+p@iDN$jEw&g@}RVpi#L3=B_lO{PSf^<oS^8cH0lj#WwVRfdd7vKqE8-Mhs
z^r%e7>DY>lV9f6Y+ADtttmgL<va1I*S#)Zfl-CfhC<Z-0loc#-?jY@d{v!AnbDEdg
z7~UFPNvuoR{%O&a;Hxf8rl{AJF`T4I0l|WEta+hhc9B>K4c+CO=wYrQ{jN)LAlg99
zT%Itjm5YI}n|Bc&1NT1ytI*U=<$p7+=y?w3t1OB}I9O3ZJ@zPJ94xjRZkc108Ch{l
zw}7)<%GInPRYIqed!9Y>?kKO=ou<i|7TWVnUAqyQ0`Gb`W?O#Km3^J%2z~uIyogNb
z2>!b4s+gP5Mju~Wo`Ti@wkO0=Z(Z>Ctu?_ZE-&XK9-~DsahF1&OpFfLn12>p1uzCD
zJ0EgKV)R>J5<Vpzb3Vp<ZL?kCS}V7s4YowzudMNeO5fzB;v=Zh1)B(A@;4+Ux|E9b
zb>@2pe2?+op-^bbSQvpPG?ylM-tVZfORd0$1S`KviHj>{M%h65Uw+Z_goi=P<M;AR
z=jP8{-Ui?tU}aB8J^jFlGk<j2U`LUC&v{==>{8dD6WQ^1zbzdAc|-tN;E8*3lA#!Z
zv*^K^CzIhhV@hGU_73*mV3nTe*<nPP2}1pBdKDSBO)P`<@%fGgoTjjW4zzzRulXCy
zD*!bI-`jAlE*Z1MpVgqpAvENEVqh|+r<7kTYf<>v7&ji;J3_LgOn(Y3K>ES=_%;Yx
zSqWtBLBHJMoRWUR8A&4D%ykU*#m{ix2yWPITCH&5X!T&oT?7<Sh7Donb5*I!B2*K%
zhv9FYam<wh@%1&?6_>;%Io35sQ#*Qm9+(9|luo#2d<+RYwP+Vw7C^f^l71}#@H#jC
z1o|N`gka-x{b(TeNq->21`A_w;fgboWcZ$ogJWr6Q^@h-zHhmgL3whlSTNy-$<T_P
z%K6ZeyN_&jOVxf>6Vi}^BPXwd*6cb8zGaM7H`spOU(7~#xE(pr5tlE#eS71cds>4y
zhdZqkMu&Q_XBZ)}ypjyQ-O>9cAAC61a76PtrM-`K(R7yeK7Z=>5MhS4%K>IhZ9hk&
zArp}%83Wl|YDHiDH2ZMts~QVLzF?1-Irqo1ZUj;%6{zmw+Tx6DzZZ7!Z1u3@fwL)&
zZr_)6EUjTXaM~~Win`oloE^NM<(D2%D=q^u^2*i|Blo)So1g;KPeb2|PyL&44AHF?
zO;6;p=wWeL6Mriu;#SlQjK7Qt@F?16rH)_o3=4`U>$ZvSc+6$65hC%pZ#Kys`N(%>
z{n^OyDscztmN}Xj%<@XMJjxe&ow=y6P!-KOmLXOMI6f|p=M-n3a#qZQPD}ZUw9{<T
zog_s%)#_?#(&D<Dxov8a_L>ZO%#UdTRaMr~T{$?;b$_rZ0m+!|pr&vNlYrpWunj&|
zj3lVxbvFX{P6UOLCO(QM%rPaQf<MdV1plZ7KsldZDw>;SL?IZer(SaT1$S;P2}JSq
z9Qv3SQVThm0FtQ&E1lt#hXwe8-_BUZq8ljh?UhPZ;S1{E;f_5#KVW3JmjaPoD!pKY
ztwK}JLVt`MFzAe3O|812R?WYeAJa-=(55x(Xrhi+c&TCliRYBFW9T3zjKO5Q5h3%^
zo13LxKha1GT8F914IO<aOJd!L!`=#-(oE2LEWp}=SBD#t+J|WSHe~cqrEwt2x0=!6
zJ0PT;*26e+;}qJ*7Jd50RBl}3O;qS1bXb(>mwzT^Q5XdAMNuesgkl$EsB@vC@I3mo
zL*(ErTPaB;o#8~@Eja?=+kL&2FKRfd5Jyw0)JHB072SuV6%v`XXb7r4kWKEE&}P8A
zvpC0QDAJkUMfMI5)p~-ljW>Rbnee%^R7>Ik6{_At=^H~cm9h#;9tL!fPiSFy{rFTm
z2Y+kHm1#vva88}KR_g{St{``)MI8+rz=3`jEDlph5l}d1(#Q#MYXg?_%vV@Mj`TV@
zjKV@o5%6z*`u=5S|K;BEX99B!NXE`2qvbi@RhSmVmWF0*0JFA$yU`X+QP*y(vSo{=
zsQ5Qr?y!rRB05w^DS*RQ@pM2w_O4cRe}8jxOD=eCu)m5L{fF)r{PJ|~-QMH9gJ+%h
zZ(lt8%}?P!e|9&$eEsy<LtPR3LSz(mGKbPT=y^b0w5mu2FIf*r=Ol@T)01<)<rFFV
z9=f<yS@hkF>1g5+4s;#3nmF8F_E&Lnvfz<v&oH`Zh%t^Ql1_4#aJq~#2UJ0DVt?yn
z#nNFLHZ7WsGexwu4qU`zL|@b=o$4$wb46GWPb>|EL~0Lfmw+=53y13WcEgg0&a}@O
zfHDwWrt>KZJ7l3SktgwBa4r<ie<F9K@zZbI{sb6WJ%HN$^qak>Pv1T}IQTh$?1rm8
z>7Xgvd9-m>Y^<}`A-*>(Cc8VH6n`QHEUw($p`CCK=mCw-=~&Q%+lyWjPf|ckocJf_
zPSySJy_Lu3pOU4+Lz}^5r=*E)px(9M|87r`k^P%YGyKyqqTcEzO2<0gKv<pt1B3{1
zQ|3mE5b&6wMnwf#q%bx#&$rj++5d?voG-MmO_B6nv9SOu0^%4zqo^e_Ab(=b;9e+V
z_T7)-8xM|z#j(s4;$zRw?S7z7g`NJyauFCesqr^P&yy6uYB5<wuY$wPrg7l?_!~N3
z=eCD$Z4F(#^ri?A^NSh)xoPm9-aodmgV#kZy~^Fac#Qo}7HQUGZ#IC@y880*TF_={
zb2EDR7=J<Pb3=Q*os|<W%ztLw50riJ2C^&(sUOhZgY#oG7n*Z^rGU-zDBl#O%@cgW
zFs;Zf(N1Osau@6Ra&2<+H=7__1_QMt3T+#RV&cded>f8*I`uh>xWHM3!{jv9Y)(nB
zhJ!+iBy^%k6p;)%(Z0_Fui9j@ww1;37M<tL@VRe>=#xfmOaZmE_J40@(zGHlC{=@y
zNO@}0x2QO`m`A&0UbnZ&5e=lwUu$&e?5@rC58K=<<gZYW@XM{ThXYqf$yA$F3aE#d
zBvK&C1@db3i+6!mh*M#u02}WI5^v$e(1xqYt@@i-s>pgZJzl0Q3@vZDt>jTI?GR)p
z0=c*&<nxl~M!snvHGfx7B0xbQbu;-eb>pu;$!*9AA+tw&le1W}9hs8GE2fXZs5+wf
zXTXvoSFQ+7_3p$_!I6}5rok(R2b-3kpyS6v`ZP;n(YoV-)CyVnsTO;y9;7J(VdfWF
zz^8@RlH<ARY3qHxH;Vs}p^(rg;Hi>2U&-5Zb)P)sfE7MuJb!4cBDb1IWxWIKn5Zle
zPaPiYY)E1%r{)@%AWBMIvgZXA@XIEhO42B;Rtsabe7py~B1u<dx+0M!nC7lz)Gq)x
z<PhDAmV6p>1EP@1LyJSUpvHz_SzTx<QLPaJen=~`N(<4gQ}wzE9P-}hx|giy7xcel
z9<O@M_Cb1$Fn<KsKx^#4E|{7Ytn(eUuRFasFU4KB&R%*tDGJ<SX!R}_?rz5v-!gQ;
zH}ubz47%n$1Z7Xz6}$uL@9oHg3f)9Rzfl>|<2=n65FrF4{&#b$F(9HXp|ucIq{1@r
zwqR3oLpE?n96sr3tGUg;M*r4aAYx;*{b9!`D-}Ohp?~6+1&G(S2GXQm9N@9k!6j(P
zr#*gs^99esPU6W#U<KhuV~0JXVFFzWLmF1cQIZTfV~v3h0j!6#NA~tz1(8i+zH96$
z3qA1kQZ)a82Rj5MzRJ*GKU~(iM`yVX@yk2#hzn_Y%e2-xsnA*@Vd=n|;xbt-r4g5(
z9}7U5=zqUh8h~4qX>bbPgu*ILn_ft^Ju-CYMWbvj1Ucp=^ntfbO0r|aZrFSJ=ZIL@
zSo#HxqrH8a%XrYsK3?shu+MZO9(?HVXgDlacvAr8b`}pmXw|(slg)EQi(o_XFkubM
zpXtb~(i_%-?dE&iy6b6%$+dXKYdVjx+p)H8=6{YRq8bYamOH_mV1HtQAX-27A68`*
z%KRx#J9?ey^#9M^zb?0tUF)LY@4{20As-W<0Z^h;7qd#`MNupjZCz-RaxHJ}3Lr@&
z$+Q3@j0D7@%e7-g|L6zkUJ)H9Vt2&;b$<6VoPLw_Bt5@xj4|iT1VB-$%l1CK_QfS4
zGk@oG%rVFH8$d62U(cbVaPt|7kjZ^;Di^})W>k^a!oy;Tz&OuGPWVA7ZD4&46y;EY
z_<V5?-0nQlt`8|TFFi2$m;c)r|81K`#vN-&DE5{yJ_WAZ(#Lx2Kv}O3a8BHwQsDxW
zQddOV3sj}?y3HAgfbwX@;usR-%Gl44#D9;?#X6T3`p<fx%!^_0<FgE5VPR`iC)X^7
zdC}87#*uDo6^CIq>ZX?yCw=GVK1Ggtrj}r0s*4(v$<zYy5De0%&mCiY{`|#V2uTLL
z#ZJpDhIh%!UHQopFRA6aD?gh}sQq0}#E%eg|7l#oNEHsbbvn?NTxWw@06fE6TYv4g
zm$(4+CDmQf(!a<{Th*p;nkUooUrR2Z<~eUg@4EJw!mOnLH7ylRXKpIO;jgn)ast)8
zG}rS2&6kd*r`d&IKG@j`TtIeU671%V!2&U)n;g|n+ob%f<FrPaK9<d}w)(y_;yrn@
zt7nh7CHilp1nFBLGHB!C$C1#fp??t=$f1bP;ov$p#mqM5C>;L@q!Mb&2h5>6AM26<
z4_bjuxC}ItaTeXfahVvW3tr&Xzrg5D2-=Y*1A!77h$${n!b$T%a%xG7tH<F}8tKYq
zl2Dt`6IMXZY0l;cLt(lytRPAX0DskcH-$(JXBj;{C3Gk3|87)E*Q_Mm_<z&uwRvo-
zhPqxzU!S@bTWVTXj!Tjfbpx=90rO*3zm=dSy;lc9WrIl7Y^g<nyYF*i{L~d+Qvf~L
z>#n~Q50Yc@vSj!0fYFBk@o)c5M?bCp^W=0DvrDJBd-ZmPDDP-*5mDH#vpkP^gtT+v
zSF0$9p~Rs>aKefxP$`s9ZhviWZ*N&E?hIb#Q(t;3E*AB<)~RG_zjjn;hB>2|C4A6n
zvEnFX!ZBh@2X1zK_t!wfDCXHTd9Y*QfuVL`qv1W(Fcm0ehgRi)4Wqo}7>!5tYsR)K
zo{2@96jM>Zuhf!alj{1|Avjq}ZYFi>Ir9%$?-Aa$k-NIV3wtrh@_#)q5ZzM}MfH+5
zT@e?0?w@Y5u}5{MaWC-yh6iazf?{6SpGDaqYXi{XC_gjU<wN(UJOGLUln(hFSI6*a
zj-Vz!Rf=*Q^yIp;7b%1-y#ry57=H575&v9zOZjQpEB`iftfH@fn^I?AAM@$4JUmuA
zZQPa{LYmv#lI7SqAAh;qC^6z|`T1y3P$e8zSl|!f-M&VHxSgzw8h;_Ix;v14z3f^@
z`R1c`(*4rO^yljTX*QcjQoxf`r9p{yMS{Rmt#5uVRf+J??(8zE%_vPXAQC=gT67(?
z6YG01?O8YCB0{$9<H$wPbR?Iv@<$Veiu>p8pASCkBu(!w!hgf&vD=cH<`13l-Mn~n
zQ&hj(-d_5SF|E}PCk*bJy{YxN{Oyq=cmJt4Pk_zrhR-Y*x4K-_-UvR$R=aJrV)>Fg
zFE1T4Tq+CueN!TO(E%$1G+n=AR6@GU+;11nmxW(_NlkWJ@ICtZq1XJOv8E*r=0IC`
z)%|o%r~2k527mKIqcJOrxhOeq_&fw!eAaE&<EC~fFKD3^3WJZEmy}|=+r5vw7mh}+
z^l4;@f85;lf|L{xqGPR$0(#Q3VliJuU_EUP*X&Hv(;v6ORv}!S=20i-<k@71c#694
z)=Qe<gFPq^=qDn5N@yC9d8K%mEWs_KvXR8i93Tab#DA=yZW`f%AW5rbBkBG-jwLzz
z?Ib54#|{e*{lyViPg-kRNtI$$K0b{G^=+rocCzT<VgKdsi+#5zP4Cx&Itqoj*?4`t
zf7CyCT6v1$Hyg(%yC?horw2#w8F*r=2@ch4H;(s@j}KnG?0<Fe9Ib};wj7ZNOX}vs
z-u%0Hvw!jQ$!)Kdz2RB2(I8)DUF5#wk}Z+iRxuLaMsNIPn9o|07F|9*nJu!8c=-Fp
z8~)jDXoY4GM!S~Mt9-O|w7>hj3&uE<^0^2oE<1Yvq<JCy*Xb$lF4`!yEy5JLE9|LC
zwp9j9K;b_<-yNa!=}lL%v?+SJ4p5_ATbU~G=6}}s#`W?!u78!7)nCK99t_tKiPy<i
z`sn~X-U;Sfm<d5L3&|kRU>3J#1L21Co8$4yOQYpJXz3=kb<N83Z8q%ZLwpi#bq`>b
zj0kGAdjJ!dwixMId53#Yx(B?_!JXp4xEB3S?n~<^FtG4mdYuAopgIZgL%R}Nl`6dH
zbbs0>pD}V5d{x)@W2NwpZ_NE>J^MCv>Ur7MMStwaqQ^5HIR5sp-hK2U(tYRzqOsb)
zDoanljO>s0(94H9FA+Z6z(ni_U6UI>4xBsOVao%m&(r4hxc0Zas6D%zu&-B->z<NG
z55{7DJ8*c#$lVZRI~|b^AD_yrj`PiXAb)z982;z6@Q3!daW_7e)bTN4i^5bCuUBkq
zvI>yI`g|G&a4W6&#q7khc^v&)MiK}C0EFnYcP=ya)?)ulkF%^6nx>xy;G&4(e%H&|
z4W9I{DywQ%N6Yft$KlmR<%SP8lBZ~QwflcZLQPnc=1vl=N+f4-XWUcyNA$!7;(wmm
zKTYNd)p<k?*zqE2CyA~C>?}+z8=`F6#S0)~+>XC**6xaXTE*9E>l!+oP2K`UPBak4
zM8T(;eTPt~9I%u2b(ST~!<2BL5e9GBbZpj1WAa*2_B7h*wE67St7p&m`%Yo(|8f5>
z&2Qa+WkRP-6|I}!8Uv9B6z`fQRDZh(Ja%)G$@h^qn0?nz^JduD6}>&%f4O_mcVyfD
z^ZwDv{=e=Xu;V7`AT(F?W<q_l{f>5D9K1Z}Tfk3cHol2(V?t8p3a6_TUE}Ujk!op!
z0Z+6jpIcjAqjUdUr_!nVvI*16g$4_5Oq|TPb5U+oo<fC-pX2Whr||$f41aRkH%cv!
zsqB8GcC`~HGPQ63z~^?7jYxLd0Ch$JsC)V>o8O|pP)g@lzWR8%ll;9Wrk9o+GtpxH
z-jf=0?i!UI&a&1<MYZW|P^kNX|Enk!JIc{o-^+VHIMpKY8W)K4hc-&tXiuCug!`oe
zci$(XknAY_%jY3#t_*E`8GmU|RG)UD51~B8A8k-|+DN<#M8zro0%}v`3sIV)Pc}?v
z+NktY|Beci|LliovXS0&%H5b3&!IK#IdW~a{n2av3NN-j|I_S8*ECh74WxIIsqZ9%
zReI8|RZ$uwRZS_hql%JiNfe}Bug9_BeK+nO+D4eTc6U`@!t9@q#($zVMKoDan@C?&
znn<lxt!V|x{s^Ustwk!6aEpz*X-gZ)Z{_tLqbvDFegaL2v!RBxlbi;A@NK*sk)pJ*
zq$q9ZOF>=QsHjW!JXV@Ez{UK7s?r1o)q_jA<-h1S%Bg5i8*TkIC{ee525kyyqY8GY
z0+9I-c*D9?uuJynq<{C!?pbiHaMR-azw5GXw8<SD^9IxYYe^*gGSO>8@4%!5DE#=M
z(g$t1eB=9B8>?N?os~EAUG8ReWZ+`!)kbAESx>L!`r9i8yy_e968+I*zC3m}_(uH(
z-)Ji*UE521e}iyvdv7#^y+z&F#d~Xem3upk+rDM1?td;y(SM<jAqPjq^gW`R7BeLN
zNHwM82a4E2iDgyc6}Gin8*U9mh2GiP`t|op!9NV*wxEL@K+AMv5xr3c6P*-Mb$*XG
zKww|xqipFNcK{aii|%I|?Vh9EaZA2I$oh~zwjsJ4W%Ecq)2_Agin4YbG)<jP>-$(I
zdP%mttP_C=9DfXVj6p0ZOL(T;+Or>4j#MwR^2qeiU;Rp(P-3t@jSALioyQfWvp$!#
zGg&zg9jV&|Dw%7xA=WyT%JiNy?Gx0Z8mLwWUOfz6c01vI?8Fm24qB#=CiXVc|2A-P
zD3ozIS~3Pv0*i}C3EZU)_<dvTwBxO-sXJ~aFHB636@Py1S}?^{MPC`B?GuKigRzQ@
z6)o@gqUI&P|9x`$ZQBc9*mAGBwby8LCJS-VE1F#}Q+S%HOb+IkrP;;mTdc1AU~%o{
zS=!#gekQ0@Yq{$u?mFJwv|LYVNs<f(w_hm(%if*^ryIl#4GKq*Oq9<Se-Rpt>XKuw
z75(+X-G2rga#d?>e*EC<vj?Aj_F4DiPd?4Mk1ig4(*50o-`(#HFD@Qr56&ND*~O6d
z;-JgkK5D)jX}8Uj6|d1U2oc$q1>!C6fe@YvB)`v`;D%i8GTF;UWxgnTO<U@h#Wj<^
zP*naB#z}FtHg^eyERv2}JPoLjD^)IIiSKwzcz;4+5l(RN&U{h2I%;H$z~f`LdI(h&
zyS_<~6$DCF`AR@@x9te-lAmZps#9Oy0sKy+FzOgYUflja|37<SO*O49*O(UxCmwh&
z;~?2e20=wd75Etdt}$7}H~S!o9~puX2U0;Gl8m7nL_YW~P&gvJo+yqyqCQ^i9coGs
zBY)wpGKkntv{j)hV}@=Ny#d(So03)F0Z$}=WD;W+f;u*sCo%*4IdWe~y&hDVYqMHO
zx20P1w9$B>FoAK@wGZ`82E8q5WtNS^K(ArHu5Ybt!kk7X(G&m=|4K?EX>z6HEtU&+
zBOuUGGDjIL!nMS+8|()QsQ$Qcigx9Mv43D5eBe^DN%LKF6%gMsz`VAq0{wtH#M30W
zf{6JEXVV8|O%Pa&Gk@#Z?A3dL{4ZTBhu}zDHdBu1&`1WWrM5w*68*q9=UR+U&!^Ng
z_!F8Sav-W~!>Op5MiJ<4>n&GODM0>88sSRnJJ5LzWn<j{CALliC(4ZQ?+A?6_<uop
zsk}>!nys4sW6SOE;9&BC2{*M)lMw?9g|ao&0k~g9RA~ka@8-p%6s1HT(E*a|t(}tH
z3c6{K+cn55T0c0*CHynWc#tpuo&hMfQctZX`B|V)DJwWEs904BlbY8FQR)E-KwuCg
z+|FI(I;~`|%6&9IfRBa6+$Dfv0Dr_m+@|Ro#~ck63>YgT#~f^Y1Gwx&NVqJrP}^+a
zy>$bh65nAxKDS0JH7%W~UoQD=aPQF{(H%QQ^C}$)So7jihp?Dkq~}s+L|sA{!=3zZ
zWEAErT)XKxBgHg5qv8@|z@~~liXO?t0;>h(M&9Elg=j|IsPz;UVms3$Xn$s3z@YHu
zfFy?)&lmZdS@G)V1@iO=y`RQl;Ydx*h8Dn$oXjq*H~ue2lVAzVgeeuBHl|^ugGJ$O
zGtvD;YKRTNzYd{mHJdQ6Z>ayL!yCsf-1<hWqr5e$@Sc9rmA||EqFt?z18ajj(@vj1
z&%g%*T>c7cgB!?_hrxoRqJKg)%JXmdd~?%nsN1Y+x{p|F1fgklwVQ|^r~pCFv`Tsi
zp|&VFFW^<{q!v-^S82&G!KP9_^{qI{wyoU^sxFSf3L<P(Vrs*O6${J&TR&K3XF=53
zF7T`ZlhW{D(de9Tr1=)1C}NOKK~T&?EJmfGyYL=mP9e5|-ayR^8h^Yxtn}PT1}D3J
zK6w6@=ofYw3taQ!O*T>9Y9VvTZgLF+nbJy$NWk7k>C0*+12Yi`0~?q*X5e^0HW~_=
z+aSbOExUo-n<LzL*mWn({Fx7E42~1O25ap~k0F3N-lQK+hzn`2?>&F@`f300=+z(g
z_fB+(l}FEC?d_g8ReygVM`RL-j=a#X8A56-IUS0@9`)wqBf^-=Xzsv$jYxm6+K4sq
z)pSdr@^F@2<qYbT)NO1Olp`QKus*hB^cse5FL|N4#IBK1hO`()mdolVP90<5**#Qb
zM-?X%fGlT&Sz%R~g?4x!>0gbn?<G&rx?H^m-SU$L&?hZ9tAFi8i~Koef`D5-cJeWR
zd4Yu=PA7qR%j;B-Jed75y1_gx%-`Kx0cS*Dxh)%HcY>{*I(EA^N|E3T&6fRlh%%8X
zu=GG8x}3a}PgFnG5YBp_qfDbm8DTUUTc{$JXf*!tU@~o>)l6;3Tjv~d_hI+rZiyPP
z^X~Tj?MDypZ+~w$HFm1k>owXQ=wYHnnGAMco_u}u>hNGMaIThK7e0O2*EB{<aacN}
zrll)brr|B8Be2FB%h2+Y;=qslgQC<sguj`RyG!Oybp9$E;=S&^!yS6hmz?fyam-m9
zJBpXqhCX877@gjK^gi#qIf<>v1mF!lD2p5g75lA9_J64e96}(X-j?rkuEN*IdV=3c
z!84E%fvZ9+vQWkKHPI-g=A)%yBfW=s?m&93tS*c>bJ{$Gc7<&9*JfvZ<YOgFk!#<n
z210T>8gB2I%emA=c<`fp=~zsm`{Ud8yN+bE67L_~c~r3M6s5^3(1|-~Of+Qpcsg==
zkHvGkt$&fxAnH*TmewqtKBFH!c8i*z8PV><$s5<#M8JrK+-?vTQZq-YZM%DHZgp|!
zuY{oH%LWdI6biUJLYT}fb7~Lu1Sh4Oz91i_LD(tthqGc{oEH(KEEnfo9#8ctD79^(
z2E_4!>jgmy?#>+q$e2h7G&4^b*^IIXQnySmP=5x&F+exlNRX)slw%rPZspgUYj1o$
z?K2t4{y{-fSa%p}Cpn%E^WvCY9r|#HMnfbsb5w*6B*IIE)-sp=L~u*`jHf6cuWYh~
zM0~dtkDHU}caC5I8us|K`7f(hcT3vu27?$vnR`t~+Da&gX+AR$0xC*nhR)|+e=%Jl
zEPv!GBNgMb=PF@EW-qESy&y~k!PQc_5~)`9)NxQ5hv(j4HXy6p6BZL_yoy2&Q*l0z
z)A{@zGo1nWm-Ylo#RQ$u)$*y4W;(LoqRLj~mg%d18@U_j+?@OpL5P1&sL`4<tSFB~
za!TmLl`WQdqBb^NZAlM}GpiH~1qV&nRDTUEEb2!i3uU+ycYL8XT{(`$sua*u2KT&q
zHzcl5)fUU_QgLn7sbf@NCMtyj76x}B4fIq*ygkiHU{J@!TO|NL6w#*stm<qrH_~wv
z(2)qVyst93DoIQVWcchZN_oj?z6^g~vsW)+-=h?Y)jV~3syejQ%>k5}9R{l%z<->3
z%Vu=!MCNlRiwP7*6DPgBrERM(#*ek84HNvuFk(o3SHx_2AG=R4Id+FdkeJpOyLdL<
z$J&*&$Y3YAlg8&-b<!lip%}4p1$T%nrYJMNY}wWIG(F$ePvy@cFAS-bxd0nV*2G@$
z_o_OM<&X6Qvr_-zSRkm@DDhisbbt5`sdriOMJ-=Zx@hs5x$VqHlJH|W_`8>vv)tXd
zIDQ|LX3y{Y`aRlv=G&7r`i6%=OIa-U9LzP;Ei5L67vhMnaT<SLO%P5myXZ<Ytmnn0
z)Bvp^ogP36rwza1W;z%6lSz@hnH1NfY>2u740@7&2q~{!zIqE1%B~IOLx27st`Miu
z<l{@3u}!$pw*h_CyUxz0?U0)6rW#K}<e|#U1T1pmPG!^^3SezL>LU!if^i<IW5kOs
zD90^a1&$Q8aUK_VXxg&g<rp`G>ZXnp0D>V&8y8M#NTD@5t?_J@vT6>S(Lvs_@LXXJ
z+DxAWk|ok)R0sx$@;49D%6|_~bGDRpWTI|JdT@jg+nT2Nux+(wdaTmtD_t_gh{il~
z<I{YIhN9v$en)q9cAOp)wQk-M0s5n%&Ud`j05Vcg?6y&<y(2sHNk2wmiO{AMp7Nfj
z|F>mwQr&3$^fcsWBSn@dssWnaBPl(s6G^$laJv$IgRoa8az@^Ret!btbQ*rE@nu9;
zepZTrQycSp^=A@IUsHl*spL4E{D^Z99e}*7;MNhgjwCmil=KNJBi*p%Bkyf`HiiwV
z=N&Dmr78%Ryb_n*@rv7j<=C;5ZDhtRdnczEl|^IeFi2>m0<NUzCiKh^{s|3B@GCg9
zb6>VpRG@43UBl-g4}YChIs`(4d|izJz{|{7Y&3rIJyPVt>`YUtYEDf`6I4oM5v(e&
zBH{ryQt~gXZi6LdP+qad<fJlA_XHI;A+Kb!il<Y6i{;WN1&~OJ1B8a1kTkLVVUDV|
z#%tiaDQ2`9ix)KN&I7E#!{NSaoDO4@?)pkT#7eRTGH9U7;(s7gttd3vZd?Sk9TCFF
z(u_mw$(U*G$OU0vnTF^u@F0ruwu4P(7&H}(`gc;S!0fKt24tKDLw2vE+Kja!p*@Cm
zD!Jh|8cl-IS%B{L-c{+#BM3Hz0`Mzf>XrH%MvY=JaOZ$m>e3tu8+nI&wJSY$!<SvR
z8H@Oqwc1nCf`3+@n%_PXt6zK*zv5VJ!>b;><aq{#2be$Zh<fOFOq}3LDKX;6XAlZC
zx>1pZegqn|la_??wgGcXkyw6~_X1(srvAg}-F0$Xcklky4OB?Ai*Na0OV=t)Y3rUx
ziPwcJyBq@w#mFH+@LxPo_cAlPmktw%#0P(gI;)U@NPoVPneo$~cN#L9ZWufZyHS({
z*u|OSLRmU#cg=enO$4fry{OpXG<W^H14fr!>(>UGv|KCyfB`NLhlfw+3(>fLq48mC
zPP)qfUR}v#%~FO}f8Oz3=fn9`*Z0Oz7S~Ums=aQE+*BZnD%jx=@BU)z=?3?|ZQn<q
zm&6W~v46G=8PoC4K854HTnV9(ju@QW|08O90A#&zS_ST-hOyB@|ILpcxLi)MI0BWJ
zz`{!xynoAzJc#$69QM3|SA4$W3R4r_SgcSGEusRXBZRqujc#swp@uMmL)d(nnNq#<
z8zMZJGT~&Ci;GT#MC9%a@d3{Ky+mk2v;^5)>VGAl#27Dl?x9W#U289E0sQk)^dr08
zEfRCmFx#l$A$mkRw+vW=554iu5$<r&)yCs1?(0m7R`8y)+JLl*Vd0imUkp^X99)Am
z`NQ$6mk=Bq6nxZfh6v5HEUiwRW~yMrpHRmVrICQ?APF_2lxhLP;$d+)G~fa$BwJ4_
ze}5h7NNX6=j3aQL>WviP;GC{l^*f7P;amR{rBJV|D)#ADGm4$V<PYv_h^6JujbG@u
zU5($U;22uXPZet|23K>3WSUR2i{x=~>R6A)qT|BcNj7k0ZiqW2+-dH27W&{r$yuv^
z=frOP%<dKqxn_{~x1U>1m9D*zV_+PbTYnh7MQlRj2ltu!3H_*h<8<0;og=#S@t4Sb
z?DcwU8fBs#4#5xY_UB^I_Xh#<_iL_<sPEc&z&d<wr5H~Mh~jhlmMA)U0Io$F76{YS
z1l&EZP^%t1NH351^<Fj_?b9qT0bx$OI~BvJa^6gnK9ci{<Y?OUdvaB?|8>z!SAQG<
z?n;m;#6PwhjKT+-@5NOAixZ~q@oD3u?;9U|R3pWYK3YeJA2~X#d?7^m(MRWgrRf+d
zcS6!zOPoi@rugWik9?}8u!5cB^g&0`b;}-=5>~{0aR2_diKE4j*kRN<yR2_6M}P$m
zgp6OD6z~<5t$8+6^8SbigLIh+I)5-ZZIUl7_jW(9_<kUaxSp8$MwggxEjX9ua2Ua1
z)!g)YQVO^0uj91}b1;T(8}wV1$zYOQYgIuBjT%TJ+3={i9;oe-=G$Op;-`02w!}YH
zv0z4LQmqaxsooU&X#Y>8Wx>>XGM|7Vju0q0bK;+)w#X9Sa^&|z<0I@)g?}D-66FV`
zcH$qO+wa*kCsRE3==z$*wJ(9Xtqoa?jdtbzUJfVs*C#KK_qTDlC{aG(R~!DFGdE0R
z>14yN>FP%8!0HD*RP|`lIZ^E)9S--AwDg?*w`|thILC(@oiz>Nb2oQ)J-e@4GVhsT
zfoY@i3c__~#Z4<(8}=x^vVRZg^oK@mTYB^a!}YUrB?8mn5G2)(Bnc#K8CLik*Xg%1
z^6+DC>ejr)IXc1HaTHdultZ&a8AwzA^NX8SwEg5hZP%C^d2|bcLsqZqggmfv4JXDH
zD}0kxsm&-SnCotko?Y6K?9@s37voa2<yb5xGOQ;=ymfp={V!e?wtoYkvG#+WFy9|*
z%DcPOUC&cZWtUX_$i5-|a~7oIRt3idZgs1tAyx%F{EfglWAi3Vu-6$)E>YcaKUDQP
zgvAh77@ek&JEJ+!cnDhz{-DRWfr*QYw{U{8TEwMZS5OwEoevcjqHSu&Znx=FYNiWv
zcR8L<Kgjzwo%Yd8pMTBtr5O)*Jz+NzT#ph?aZ$+Q7bl0o0Q)?<OwVsB;Md+NKH@XC
z($`%E^SC~>+-@)VibWl-@f%B<he8d>DN9}17iC1ttaFD4eNuHqy&Tz5MlzTs$8WRI
zT+PId#y6=H>d1kOJj@Dn92%-~9MX5{=3PHL_h|%|fmcopmVaj<VAiKtl_bOf`WC8z
z6K<91A7PCHW{~O1o<@pdOfm0$j9aHqc-_30C0}kRY2Y`>=?P*>Xh?oP-wFy4@-wy+
z6Ya5-vKIY0lpS<r_RVqfBAva-<_t{zAWB97s<?^w>F%`lON2&yUG`Fz0pSside~}v
zZ8xOBRDBs`Jb!?)xR_t3TA#(To^&+52wJ$TRJN&))iMHUoV4a?B1XMfT#yzAZ9X4?
zS7@;MisM?Nkyho6MYTz?|HotZ`2wY7Sb$KHdR^a;ii(jFvM1@={8Ed5qJ4Z}bLXI9
za9VAuSMTQN>9Ge-zGFZ5WNkmzma=xK%L01^gLLCNiGPr}n&K&?!YezLPtL@*Eu|<?
zxE)s2j~_kUjyyt(vkCJpFZ>GFM3b);Gu%c})9}W|QX594V5N78g>umrq?KrpTr$`@
z+TT6d_m%hj*PlatN8+~CjnHsL-uzZ%*gD_@xYE&(K`?P4%~)b)=OQt?2Cf=!7H3G(
zVyO8P>3>e$E+eBJ`vG^mvvJbRlkVL8GvP-KdGjjyVm2(hwo_dvkD`p(mr3_^m~VIJ
zXBOg$m0tbXa0J6j8!S3a#O_q=KC8#Cbw+GO>hq7L=MH(2y(yE$6jjo@oGqD~n+shO
zU+6dd>q|^FyTr}@h5YwR8S`s?F4<F5S9>?<cz?uvQ@NS6Kx~<74fDW0JHAjmt)-RS
zi}IJmD{2W668he`eFgH`B1Y3@;W>Nm$<kL4@xRC-NbFklqtJACCX28~aVWnCm0OkL
zIQ6!)^1|*0{}A$n$#7aYIix$Ok;?&#$LJXvN@AC`9ztt<nc2vw`}*KR1_IvD)eNGf
ze1Cf$im(```t1H^_jm9=%VU*IW6>BA#F-OSORazwGrxh=UMw6@pw2wo8!SOA)aDcH
z32;|Rg_*Dh7LX_viHwtR%|2iq*hVzLq&tGJ_SpY@Pn`t;O1x07ADQo!#z%0JvN|tn
ze(xCYs_Hnt2;J(1$O<uLFF6f$6<LnxJ%5Vlbn$6dN;0;W>&>v<i&YXoE7YL>O?GyS
zpwYPnXp|o!#%N)qzH7EBh~KftTdU7RqHf$6w?a9kkKwl$o;hlS=L4~dQAOgVzB@tS
zcNBmkwsgLaP}l~R>e>9vu?t@hoHgEZ76`Mw)#&k#R%t*C@=%Jw32aLlU6iMq)PE#c
zY{yUk7?p-{OWN~EE!^d7vK6P2Xm%0*>XySdW;R07z=Cll`vK-YE|=p^nT1=rU6F8b
z5Fm9%A6YGd^H}|mvZ*O59TfouyaBAra{XDf#U}~9N2QC_1bOvZR>xOj+da_oXcn3%
z9xawBn`g{AhrG$KFvKA|KyAX!&3~o6m7?{YJd`vX6&P`}2G=D|mi*nb@?4jfgLY$E
zLc}*W0~N?gcFl%>@jw8MlOw&HDUy=bX9X7{I`T9Ts$sYf!pJOzpxt;Vle$u?QE7Rv
zKKBB?tzyiQ25*@*L_CHC++cH-a@X=@g@$_xScRq4MFn6ax#Urd5i)da4}V@W@z@JZ
zKr8{3RHCtTJ~8o^5@Lc?nA5#T@`%so(f;uXvWV|qucTFGql+#s6H89t-|wtoBp%kS
zqKgm#GWlwjWm_kxsOB`1N!eys6@G%0Tc?7m&>MyR*jrle%5BFX97?0rh24hs7VQ+q
zQpz@aj58d4BDK41WLr>D27k$o|Kb@zH_ew0{vgp(K}oAJ&&hP$UR8^u!Zvwao)vc1
zPJf!Y;j|bo6R;3>!^6$Zj+CX#nKGM>m0EO}^EpU83}|!n3G>#S6v<S;u5b4!L%h=o
zb_sdy3=Ny!DA&T)5tSxoPaUh1MD7N0BcHR@sx<kU*$SJRhqL^x6Mu8T!;B{!2zUra
zt+mTHHx+;@QPeGcXLA#WCLZ~#U3dJpD}%S5<PqTyp24z=>^1bE?h&T6y4@KFltJ}d
zw;-s4<nCLB=!egC+(X)5b%1<?g-ZQT$=8CVB2WJ8m}vql@gy6$mvwz@6)$CAZZR-S
z76^m1mlG$tBJ)u|e}AiWV)gLI8<MP4!R=Bi3=k!D6L^0LLjU})zOxX)U@0h$*Kckv
z9a$t50J5l)3@*0ZuU;78(?PqA6~&(c-}IMPuaEjq503X<9X;(od3Dl1dG*Krmma%m
zb93paE_D@hXgf)zPEVX(yEFn#ShXQ6C%D$p&mLCl>QwK9T7P|=CyU8eRC`SGx>hfc
zHZ*8!#G}4!>51U>b$Lqfns;9)65W#84S@@LmYrvg5vW8Sfiwe=;|N}vTy)+v2;S#H
ztVzoQ9N?5|T9c2kP>MDf)7|IKUwyOxw7>WD?#q|^@KMP^>)-u@r_ImVDa(So6#-04
z;8;K}le*|C=YKQO3Xo<6-}e20W}>nd>;u2;9v(hF5Ez5d*DIaCj@WLJr!PuNf%CIv
zM=esnExh(!pW4$G?Ado~WURx{KBe}XUEp=e555T8%>eOYv=sHskaDP9;%iBVbiFCa
z<M7Rk^Qrt8VF)+f;&j<rGls$SRYMF0zX_0D#R2XEGk>FLppeZv_VrLKa8f(NzxKTc
zb5^Ko4cZ7*eAIiIoPN*a=*9*EFEWh*VQ*-nS*zWf7YE0$juj_6`Qh6dXr?CayTwE@
zt`A0%C8cMF1*QO*_O}HpIEP5@j;gKDgANbeeKJ4qSz{-65yLHRgJqcQ%i~A@XF?@Q
zp7|VGs(%Ajpe1hdHI+BF@JGs~T483T$=!*_<AipbrPs#x2-OzZb1)Vn8h;KHNL0R*
zl^5vC$KrpSrn53@jmt~-mRn6XH#joBkCXH#i_z%wDuQP*b>9nGWie&*JUYpP`#Z_k
znL9Xo{;6gOyE)*nE~F%2B>yUkDO!B|*fr3O5P!>y5&fvGfwXCysTV}`K71duw>YoA
z{$2(&{C#iv@ekv2z!};ML>77MWHaU-FRy!Z#VyrrgAm<6K9AR@=EpViE~Y!lwvp*@
zC#tN#CITXCF0#x{^6=A#pMKiGQa*cq@cij<@>}^w|Hc0C@$R#I{Gk8r@4b3?vj6hL
z{eSZG;AnsE#J}U44H1(7P%qs7Hb?nnfwX895OzY1ALjeRwiN%Sh~@^X{zKbSf$sJL
z?6xUQyL*4+uIHB%SXo*@opP6oTvkJibXHBEUEBNz?JCXro*Y>@PCF%S%H3A|vO+a(
zb3Jv=KW})T_c>o}9_{Zw{Yx_ds#XYXPk$6e!JmmJ3jAIE7d-R_qot)YqU%%X&~F*7
z?X{jA@AQKm>R>tR16fAMPo|DW2(ZH*&QRgT<X%`_HElzJ8F+_j5;$*Zuikp_n$b;V
zNO}461(1fFjt!$uKOcS`^^K?Ph@7!SV2g@0;s97cr@wDZT5E8LW_mxie4aD1lEqe7
z*k^wfV_uZ)xM)f=&3u^r$}MK?Vr?(4KbRPc4OIqsF!AEYjxcd!PO3cGKy8h%UX+dg
z1q|A;=WJLTnZDVtjZCGNl_RtD^-Ut8r>B3FzwaTXq177iz_`l0a*TO{h$0!L{dr{|
zzw(W(UW`U%XLZmA(sP)?=he4VgW@~#Z{L4sPw{<P1aHnR_rIIA24DQkuYUjQ@1sHf
z@TC*Ao0rYD``>2RQ$^&i_GYJw-PwNIkDoVI9n;f$zy97&<%e(GN%cn)7lDqM$26P<
z<Qp%hYc%@+zHt2XkCowh4dEyYSQTsU3;%Z0&oYK(Us57sj2zciPn3>$*hlJsS!aI|
zk{4^B*UhH&zJz?u240kxuyIosiUcx)`WZwE>Xh}HGG5jHI{B}YBRxGZ9OfnRjodjh
zVYr;%AY}>Y2b9DjO~YW4dV_HPiOx{QH>9s>(G-NHW+!?CjKY&bmSfMow$Fkn5^veu
zT9mV`vwWiFnCgdKI|mvI1mT-$T9$v2(q4I;Ea53)wPwYl9Niqh$*0k~0m9gi*@SH=
zjv{h(B$r1OA%6(+Ys^Y<plyG8R8V<?_);3pc4d+DwnHezW52IGW$#NTmk017A32Gr
z)jA7I<}B)o;&;3H2}7={?*n?g`Vxy!G@B7~(mSw<QvR5u4KMvrXH#TpzE*#-u#2_#
zn?$u`NIQn`T(?|0_0VaH^JG*^F8!s~t{m>4LJSPNbuoDZ7QtTCveT-~rIT#mzkk0S
zpUzhFIm5-+PQ23!o9|lk42U{KTrzI3$`I(d$=2Hk_qXis+ltxdmMzI3CgSfa`-&91
z!U?a<!&k>AmD6Dv0=081B{6@6^185az<v^G?OU*~)EY{XU2^^W?}9j+3}8$9_4i!k
z9|qNzf2jU>Rt#^JLMguwnx(Aj5AFD?A42K8+Fgnz?iFvAPno}YJdXqEp)g}M1aIVr
zQt{^p_owU;f0P1=k;KSRJN^94EvKN;<&h)s9HqIX8xqqfn_SMXexQE`vTWN3_^2GA
z+Qxkbu7`f>)d1uuxnF#kYlUh>|F#lQ<Mg}d*~AJ&we7*_w_GPX<~pe4i^uwbKewlN
z{O#wB>Pd;3k>FXo#o)V>qBF)UuCEa0(DIM0t1pA(k5Mc=kA~ufZuTvax&D2>Inl<*
zrm#>5R%RDGHtHZP=LdfXiF<X?YW~+r(-uiv!f5QXFZ5Bem29`8#^hI3N>`04Y^8qG
zZkys6mZ<)=y-I#_j1;Jr>TQ1SrL)h?eCgzkgfSoG4k2Zz$0sf7-0jWH9YoYdmpfxM
zA&`htPSvFo<+N)rL^tqC|1`ZB73r|9{F`Cg=W<8>DDx{b0>OX#kj@nJtSP+TlHmXm
zG@3VwAj)5cJwKNRm`kLka!#UN4ZX89(pKkiW35+OH_D{$YxHq8lVTpNgbbmo{-N&(
zEmp2$MTs!AY>i3+sL5cCoK$qHw!&<!wf0(gN>TG4i}C7%yo#)IRobu>{8!!FoF+eo
z0n999#IReoO%8v8zF7CX_sj%WGrq0ze<NIqv1hbGNc_j7h-SVLO1Y!Ctp)-oD8I9_
zd`{>YCw#)Op?H6{n)Q}VdZo;Gg;8(NS#Qp(nDDxhV~a;y@V|EadAuU5Cxi;dl%(fa
zfe`@R2(Rs3zhxnEP|f{I0VxGK-8C>;69y`#Gt09T$Hsr7ieqERp<DB9EInV7I1>)e
zPNVS;sAmjK{zvj>#J45?X#AsV|HuC2esk;b`sn%Qrh9K~T)@`v-#&hD|2Ns>ynu`U
zF=UQGA|HEb>VK^Bv)GF(7z{t#7Y3uR9Uz4v4Mr8dve}wAjlAvtDZz$cuVxqle98b`
zSi)yT41|BiAs|CGr)$SYci$4fKq*Ks3I=7Rlp@85>OObcAKdnGt5@;ejJnRH&_O+h
z0%<JCe|z)*aV7|)>Al|u$_j=7bItzZ`mrSyqb&jo*nC^I>(K+-8$A*7^Y_hS>ZHsE
zour8pGT(pCtd1Xk_`&Za@#2{zBVUww()iWsnr(j}H`WzEvYH<!vqLxT@RjY`Mq9Ud
z?(WK{{=>Z3frEb^i2CMNc7tlw_N1*y7G#fL5;q~7#Co!l!`rSoz7ck%BP3E^pf5lN
zee3E=w@fRqS_$U~L?u^?4E6|^01|x_Do&v21%St(7ew$m-(21JQWJUYuyD;xNcerj
z=H!2=opeWv2f-`pI+_>J1J++S48);vmR%GQ(891DFM8mu?Y3jxITm(l1U?8RACI$P
z?)J@HCB-Br_m(z|kjKh*0K#i`mb*-)<W9A#<eEX17et0c^s)Q6v%*vCZp*m@Lsexg
z4c-yi3eT2=D~sS+BO7UST)_GvZ~xd`)Qo@hmY9=c;!iUWSP(0M;KS$<AK_`dU6dZX
zb1iZdxi9YSWeHV<N}gDi8wIpIc#4pcV_{<6|Ey63p8uHa^DjPzK||8h;ZX6?)Bvio
zRNG>t&I&)AiX+OTqizVKpa~)5Z@JMK`cTD*VaTpXhQK;lA`O5lhAfZdAu6K?THAkJ
zKIaICF0b3dBjq@0SI%r=4y%$-k)<S=3nj#k7IpBGG3Z)pG+sRvK)p+HnwLn1VU>fb
z2WnuLnF5NK&&O%`1`|EwRl>_!Vrv4cPYxF|!gNPW{~xvg3ils~Z)*TP{2=+_i{$>m
zX)zDnpGSJU>2uf$&Wd@efJFAO_jP}TMt+AzK7OzrHDe^DOXVnw4SPR;G+6VVg%%%d
zqsd42fA>k$=F=C}96zo(<D!p0#>Wr0KmFu0_uH;Wpz*DY#cNGNTodTV5Ij|Z@nLPX
zkgqoGE=byQcs(B^zvaAtD?|OQcKTSha&xoMuxov3w8DG_IvlM$fnIAXXRv=HLber6
zh4d$hk}RbVgoveu?f3(HT}(E-91@mP$ai;0R_df;gS6(6QM}o3MzhHkV-9_zcq;-|
zHu&PR8x8C|)h2GO3FEE_#1EvtBv}9kp2rnac2*QHw_-Kpn=S$@w1uA7p)EL{FetZI
zK$8!)28t)+p}XgViE!T(lT?57l}@F|meu2;0yA>l0vgxULjfsFigs#1$x=+5=ImAB
zKF`4;e4p5C8EJ!N5$a2aQqd6+F1{8tU|5ia5lTQeKX1S!QmyRTw7DMcA05AXx!W5L
zn`#cPwOz0Gy6Q_O-LUQ}Y|tSv>m`T)FxV2cIvlQCGsXkEe=sK75$1nnUeU%wun5*x
zm!L}r$Ej-YtI6s*J1Z$n^)2@Gp1$8UEqYm7LT)lNUH^9^BH;A-I3y7ZxMd9l2ue1R
zFO+~7DBe|2&KQ^<%CM{m%H;_P<xFUNEkk<3b0mr+8d*B_c7@%84@pE|)=A$z>Z6f<
znj;<ImL4Lga)q<>b_suD1fz9dC!z!fVl1Wns73k1g><I?e+}?OZZNB?obD~$!I)K3
zuFv@!zH9G@MdSGaF4){LSWBG3CaUnEyv~EI=iVZ5`sZT~4Q037MpWS*olM;KYq<5G
z|F*=ay8hKDTh}R(f7yNU92HpRN<c(McQQsktQGY<4N+xrXBB^v{`f(Ed>*6AvPl8E
z7wN@7MYH*JmQ9l9&o%tO1E(`ew6{90{M2u?Tevti*pSH|_TA*;?llbz2J*pV8gkCM
zmp+B3>pmGsD0u)%FU1|qWgKZGRx#B?FS#Ql<&RGF5d+z#i_vJXesFk)V{<)PJRxe(
z*^YX1NSN%8+~j|-2pYY<O!Y}CqW4ZBv@6kW5{?c+1)Un1HX28ou%%NMA|^Z3Dw<)P
zE?6AR$0nCmiYAF5j?N#!DBbJa>99AxrAFv0x--RQNc;4_NfR$mj@<>2yQvS7ZlY0h
zUCVQcyVkNIXJ!KN3(kkWJfg;_Pu^-MM%2$(31G1IeD{C#(|zp|(oVOyo>)OuMfOts
ze`+N<n)-Or7D~y5AVtU10O#BFd_5}0f{`4*u>qF~;O~Wm5|7F)9br#Xko>P*+}+(d
z#CI@W@=4taBM&X6vuczSccQ*U<7IVEF#?N40tuomydP|x_L{~MAoT9m^+e0E#Y2Yw
zOSU4dqA-6bXm!_Kl@OVU9SH6;3a1tv1vSrD(hD!CE?wPK9K5Ad{3skdyG+7ayJy?Q
zMF~n|_w1%Cbcm)ENV-(ZvXNnS8xeMh7;&nIBhkR*mlfy`WK1mk5d&DT49J6iR0u@h
zMsexcWje|Ko((&7T$KnBdE8Mdy_QTm5ONgxFSmcE$qiA@20yOAdt0A*sb^`>B`oKQ
zQC6<KXCCzR9oJ%vWe(!CNa<8+5hU|yrK^<`FBzzu2Y$pT6jS8$P`A$Rq}U*veK(a@
zK<?9gmSsESN&oTh|NTGy{omaGOZ3FKU;b}NlKjWN|GWM!C$Q?{zL$)1F^5!7Z`_<J
z3$A~;|MP$RpZ{a2LH{6OZ}yoxv|VM|>t30q*WGkFUH8=IdaQo#cWcdapCP*XG0tz+
zWi6ZAUQl!zUJ7@4FTZ5?(w*L2Oz!xal%KuJ%je})I-B0*&0#hv?)2W`{LS#}E^l7m
zslCftI=%Ya=q|4U9q2Cajmz?G4YF|UU0#2b1)rC9d3Snsr}Ylii0<|_O4y@p`kmfp
zS(=A;d3ClZ=e76#ebsyAq`1BqrEju`6I8C_3J(#nV)@nhHF-72DAC*g*1gl)vw3gW
zo7Wf_-mYd*9i1crs3BqtrQE<hae%@Lw{8;tReNc9SRE0P5qz-RZq$@q!tMrtLxg{f
zMzrdDoj*$5;9{H^=2)p9!w^@z&1E5FswCrGoV5@^o8MsjLNP^NMB)uDBeb#cO>(@L
zirK){s~LYzR3^tealKL}Q!r7=@8SYy)1&kZ_DZ5Su|R}dXm>|TowXFv7f#su>tgao
zbH9~a!yZ4E3Z5dV4N>`Ep8PHy_c(tJSVJBqU!R;D1}lJ<2&`s%M}bS&G|`x)Xe#W4
zH_3})a#=im63q{)#GmtWkwRI|kQZK2t(;8dRzCW}LKZ}SM{;&|meDqCHFo8iCoWo5
zd~%;BQzqDQ^~mlzwkg*6>jN$i9P91^6m6BFw{%FMp_c%>lfXQ~+zHD%0D^y4xb{D%
zWaQ&A*rh=Gx@DVcv`Uc-Fba~FNVxfg9(9%HtV*y*2Eq4mc2n1{M2B#)v`%55QaBf4
zIAfhQ$~2@hjXsE!yTm6dCr`8T&Aga8p@|;b@;tqOrY0y2Tr>nbOsAc=YBDT9veIv>
z`^ZRxV&WJVO4QIzY1TEVM}~h>Iiq(HDXG$i-z2NW&XNQNlVo!<8Z%NhDVj;u*z;+>
zFHif2(s{qXIS54-#m;D1)$MrrPGiR~2d4Y)BwuiO`&!!Ey)(NpYp$qAGf0VEr;_4`
zJ&75h?jXe|rG$g5MC>q?io-aHz1qZd_1)YmwW<wZNXwUmDtS5s9*BQ%LV%D{bg`fV
zi%p_*4rxyTI5MOH``*pWu%${qFwB2)i$f=riu5~dhcwD_^Pg_GpD$3RQS3fT#;w>$
zRf9(VsVre;@`A@JI;x^J<cLj2_3+#cakbS@kWA<RJ$SnB=-H|}m%J<@O(fXXDjra$
znK(IpMoSr(^w?biX#9VT^w0Ac7f`7hKX78RY)Ec1Dv({K;X}fl^gMGJF(ug`wfZru
z4^=@`*K`xrfkj^LU<cHAtBd?QDQ$bLP91k|gCB^GQcNYv*1|qgEw3Wg;Rcelb1gSd
zBPic6>szQ&FAA%eoS(nwUd(bwRX{h1Q7>y0QbojcOEz7cxvPIlg0m7q`=Jh=U(#Zu
z)+p+3WJjliwYKZgXk7N@-^~YAJMYSO+B?K26~=yQzlIO-i~FJHv~U3YfievwsWOF*
zd8)x|d5J{TaT(Ty^VUla5w$5xtITh%m;ObrTPdY)cswtZ3;AVJT^o!;LPuccmUk;a
zfvLo$0iI9_KHY!d&d{KT0WCOy8gNVO*ic8ZY;Rf76@HSS>Z7$=R{CAv!agA7nbiX?
z4lq5J#anf!5EB^_WrW>3cE1Zq(7TX;e^E{UI3csz)@l`QsftOvLhHY6_Z}uMo}hRg
z0jHHh&laOMLL<CTXUWm-vt*i2GZ2I#$>KeTDxuyiGjV@d9oAP#RnrGfDy%tgvI@lz
zHByKWxzH)ypCidfmlxIG<ywktcpdhw!t+kj1lDSuu-qV}mh3wZj&KA92Ue@83w62S
zyeWH4El|bTe40#0i_3iC@yHCQ{M23uo23izDZMiK9T-E^AnyM6yI>cu+}PG+S5`|R
zk^<}*gQtHJiK7&eXUOR0sNyS(>pWd@=r#6Jwg3^Fi)q(g4wSRy<`3Q?@4<~uq==Sc
zL~pE`<~r;#n2Iot$hMxd&Nke&6u|Pi`K6E(0JYe&ZOD}efdutJgs&xXjyTG&zcd_t
zF$up}Vcvmw9-^>gxkAfg1jL9@dMUR=xi~Y+mcM_6xa`IBraMhp4L4jKblxSq$Zuwq
zC{HW0>gPEB9)WHV;TG1;D7;Z*fxOECADlZ@QC;QijGimMz>q=)t0`~w%Nn&4!8tS{
zAhZv2$m#7H45fv4%mpr?H_S483(Mw}izy^pdR!!Y1?#qYxo~|*7y-g8elGJhJlyKY
zR+WF0{~Ad}<W8uWD?WTPR<}Of)Z9r<eU$jxZ@2sY9YUrl@LHuA@v(K2m&IJ63BfyI
z1G19x!)!V#Zt#~bUq|F4nU=?|zH*m21KkbAI$+j;!K4iE_OgC342e9*OC>`Eir@|6
z8M|>C`CTNm%1xpE(Q18jX+2_`u_I4@b;N(jTcq1%*+C-R;yeUEMGt>GomQ^{q^p6J
zueZLy&C~TX+0BPv;>qtBmGD@e^52S%8pbOFR4$HjRO8O=Qp1$$G3XWapODPiv<x?o
zjL>xtn<4M5xtNWR=Ju1$s~M$jX*i2kffTN=t`g*3y!BD=fhOo83sQ<MfpKSZw~&9a
z7gC+|i@8;qk|Yc%a@=U_!VCzHi{m+6(U{!jw<03L%^P$rXn;s;uDh12F#_gRo(D(Y
zQnUo3Qi<GK@#LVbC3pL>?#tCMT++4LiQ(osl^yD#=vd*nAdJ<5Zv=5#7_S)_e7Dgt
ziee_>G5hEV1hF!CE5K^5;|vk{Z|r|!Z+u)?VVc^IL8NdCUi{c7#p1)TBU{I+;YYFL
zGu1R<qwAPu#Ef88PbS>OW)(2=7%XdzPn^<%IwTD2)=%t(%36h0iLHkkeNkQwLSWK~
zTQaQAZvYsJDtGb)XyPP8GR}N<^C2-xj#-ZomK1{a@6^$0<?p2R>SX_UJ4k;7SmL=o
z?d636y-&FIT{Wr~XCM<Thn~=E!XzY#;Ij~@lq?UWp$`wrjuy*i;VaQ>J8Ff*F%Gf~
zQ@N%-=mDUfDDdb9O#5}Ya8f&9wcM1^ARguC+9E5PKuE|Vo!T|a;%fnV(4grEqE{xD
zDTVG5`e-RSidx{PpW9`0mR*0PZ}Y;+8RxSY@~hMtxfStVb3=hgbfmAoB`^Nj9bczK
zrPvlGr*Sq&o;u1LX_sPP&q5F+p#`K4FrtzW7Vj1T8ucv2O+cAfEPuH5i$&?N_91q1
zwGuj;#{!k=n)2azj+!T$&~=P|S|*@B;Aikzl+rz$0$81nQ!KWsHp+jZ67@O<j;y`k
zOZHJz79CmYPZ{E;ZBN73g7Qdjy<vaT{^fodPmROO-OiuE0BX5tqy!B9PYcIp@;Uu?
zT36<Z$wz6qu;h(+dpR*nva`|b9lmx_3^UZm*%+aiND*F)r(y>Id)A#eN8GFo;<=+h
z*+zuAOF3PMRptna^YeejEUb-nDF??_ZBngs=+=jB6(T|V#ZfeL8p)*7gX%%D?K40&
zR+rb-nGIMaT*AeV1VyrP)_PS25{~!r(?7}}aJ&_xgr+S9+RK>sq)FI#cN_tRLR;!I
zVTg6v32?NX=+Kw-Q}4!TWDTASUz^m>*1F_rg2-4H53d$yGNOO#RGjX@MD0)xLwpIm
z*bsJV0Oo}DCV7oA3`BA?b0}Gs#1esycM@OW#4T@ixfGoH%!vmV`8m>UFfMUXU0)TB
z3UJ#LHgdoeU0%+zOY>-Hbc-;$h`ovBRX#$z40h9Ll^|Ntu4w*{*i)T`q{<hQTmp&p
z{J3e~lxQoR3PXP<hh~gFW+NkY17zzsN*JP4F;IMUWu)$8x`8ND6q=@7<}X0rMt?{%
zW@MhqKdKh1zw$S|$K>*n*H+v??z+~KKlC@B^r|K8ZJv6H&K7bfj&nqod#?CumS5(K
zfAm)aeO|B6fa;AbU3Y89Mf1jvdTG(=)=Wp1@$X1sgyVn7No2WYvYZw3`N-|QW1Xr5
zid{ZqrWF`bPg2}rAUaPKl9?{HFle{<LlJd7rhPQQh>3MnG|K<Z^-ywl>Kp8Klk?n8
zm~L0JXtQjT>y7U2iqaO|6m8P{5+@+aG?z)~e4zl`o|g#SQtGl3qlvqkjp-zLqY1T?
z4GY>1uOxrdD`7xB-ZWBBIOk53dcYgP?vyNu%=!r_@9f4H;A)L)Fhs!ltgDw}@5Y=j
zi5ysAZ>P&|y$81b7J{_40En<<e*G=cttrlRm5{q~5ZcncSY$CrZnjpxa2gjQ1(HNw
z-Vs~}6eih8DhFvxUjS{E0=J{K6HyPlN%O%cpL~Dz$qxTl^g6*(4{tnr_~27f^0*4u
zqNOmSO4hhUF$pUi!-l-Krp6HMO7L%^?Vj0Asqj{8Ia&bT6Uk(m{a$+X<mQ1=M`;9B
zHaU<c<lHSJY&3zZEJ~E9cKlE&#mbAsb&8~9gH#l`ywsdSV`>5p<<p&&-rb+lU{sG{
z7T15e(e6COcGMuRy<19?Rl(35#7ar!O8tIcKR_0+ywmpuQl^tj37q!Yr+)PMK-^RQ
zPoylysOa=@*Xi8*A|Z*q&HNB6=Evo#9VCT8PcS;{So+A6V&-*jt?HoL8dVXBYLi>R
z4_)QFHZ7IDokTI$IwDuu*se;?pI}L@6taI?EeQH?vC$RW+`9LasH!spduf1=H|oTR
ztuRVQ8#ULTWTX6>UyU5KF;paa_rm{Jdz&gl+$jF;M{f$NWzhpzqT}=&Sw*!?;f*cH
z{Sil8?Y)XWC0d?NH5iGdTG3W0Pr0;9juA^onyWg8F&(Pn*-d;$oK(3qE$*{;2cv({
z*5*W?>EN%$Sw9~RL<~N7YMxB@GoH?hV%~TEUV4rP%oS(U4(y_XX-bUYRd36q+WWK(
zBkW{V{|rY_;oodRj6HQ9swo<3o_=Q<U&!r?-n&Xmy!UnX9h@}&J-JZ;p&+LWsv+~l
zeIa>z`A0+@P$9(Z?S3Vt5l+Y3I>LW+$P%@?kQ<@zIyzi2Z+U`uM(N~o;qEDY#r|BL
zrrUIV$H`rb3`7vOW~+vce&Yzoz555Z4-EN3ypJvuygPUm|Aj%y|Cr`9MBtwm%A~LQ
zcL=tOkx2ZRb@R3Q0kQ4Zv_tT*Cdv-Xq))$6c6L=1Z}87I>BXBA{{WZ7f6ITrmCJo#
z#+q5DY$wP4K(DndkA}~YGzJ%2*=W9XJ{$LQSgWKQq4keuHF2STcH>%pT?&U%p--w?
zN;tfqP;0Q*O5G`>TP&K&fBf73(YCCCpmuB81r%M$x^OH~uMnIU$)&&!A?j82JU7yT
z*c*uZVjP5)2B)c&S7${Ez1e@AkYmO}ZGG+3#v7z~Z=p=>u(*_=6Amk((?1wV&O&OU
z*{fzs&i*KvuMV()Dg;(|`O_yc_Z9{kv0349(G}~23pKBp?(W8pjC!b??&k9^&_3-!
zpgOV5cj}=`sx85K0L2b_la{Mdg5sDa_ufW{yB0SL7nta_W<I7zcvgQ*Q@J85UBL|M
z7Sm}~sBmKH4KwQZCvVYR@(+ZK`B;xt7%EXN{mIep-u~h4ktUyi^KegYEc1LSMxRuS
z+errZ?{~kKD=Z)W(ET1H!hhXYWR(HdvCmff2T#$Y<9%J?=%^Y<j?+THT42a{YcJOB
z_3MMD?WmdK!`+uFTA_b=>Ya_~IS3mdI340TJ7f@cCwbyXxr15?9k*zcqLVyx|3Bmb
zb%;~aN%rpHUuRBhe7Web6u2m9hhHC(hNS43+qcRk%s*Izt-8#p4z`#}K}W{U5*kWe
z`Uucm-e1eHaWcY4=5L8yl{10q<6&<NO*@TTfB{+}-0v0R@nU}h3-P|>^-54)2|1Uv
z6bkLQh4UJKm4GE4g+z*2eagDdpXo?a&e39V=@>_}o4^%`IJfkv#r0xVW;9KcQ)Sm{
z9afL}`bH&Z2+=P9^<*q_5aM~Go`UKJ>{En=dYH~b##@~nZSkG1p2e-U9*#~WZe`-3
zR|KC!S4tRIIyZkq>xq&p_N!BOyvh!{Wr4SZGA<L)H8@)eek{(ES9hf51|)i{U7!nD
z@{Lma(2$Yqt6~&etbw$G@DXq>+YKL?iR$(9qU#kW?_o2lQZpZQeuOV#D@)nUbB~1X
zt_BN5^uRn7+C+WW09!$Mp5~;}ec1h`v)qxSlIXXsE%$#nzG??N8j7MugO#21K^V2#
zW6G+rzNgjGxr%##+q&nqf4~3TeA2}ckT3+#u-S!#%ln<<;v0K6|NUytAl5nDm!3xm
zdq6F+=<Zoe&Sv6t6-!sx+Vd-?u=e0ny~wW3IxR8Nb1^Ar9>y;|4mvVJQ}<?b0Z3h?
z8FGGSH<W*KIx67K>;~_smCO`sc;4J8p1?RfaIN)$aN3tMGLV%9hDUNrmM9_9YY+Lu
z-}P}q`*^Jyb0Nkv23<*F&~nkRY3^uts3dPxBde-GA3aHecA6@Dw3yU59YOod>g1)@
zBch-L4|2zomlTg<Rsaf#u>G|+mOq}R6eU}c284fb-8UHTq#}Jm9AicKd@kgnX^9#U
z6zq@ceXAOH&B9T&3wk#>9o6mv$}<C(ls1$-sFlc=H4WalIpWWjOpfEJff3cTdAEQ0
z+k6O@v2Z%?d#PyodN>?~xg*i2d;Z{G=Z@om@+x5=PKIpeQsw6w(P-Fp546RtFBXsx
zuAqNcMi%pQQn+mwAVUogp>1t3?U=GW$ucPdDc~yA>RPs9ZXPge{pmSvHI69Hn6z8W
z2+62!EWCkWh(+0p?W{vW-7HyJ!`o}Et*C3a0yfbY`0d8jiNpuZEkD6JGlQEIG5zIj
zt#z9YYNu9=tzonkgDZaCik?Nb*19S6clUpPcb|VKrcZd%i(2Sv3K_cH*>Wmk^ep-(
z)<g@7Xqj4X)9qRlnAqdnn`nw{cg2PdRu4%wb0@6K<)}DIN9f)$@N}9*g>N2wj3NLT
zWPCasYmXZGfwa!$=z?+er5coXhYj_9RJ!Lx0q&Nc$DiV3$(TXSs0}roe)idCzuSNK
zR;wkuLp#%`9oVcQ`imHt&^r#GR??<n+MBV=-fM@@{T&^#<SX-rUaO&$pi1JRK+3-)
zY!@p{!E#TEg*{;0Sx4d;?Rh)+@)6N!x|N}2QGa^YcK)Y$66_D`%eu25eJ!5@`F+cN
zuhD;U>Iol+ORK+VDk+%pHzN1tUYCDJ-LG5{0<}PFW*ZRJ+tH=#GYR}#unr4MmRXvq
z((3fk7Y?}k(_%iFep@ZhQSiYT(q!z3P=b6>?YeJ|I+V?obmTkzV=H>FY6wf;Rr?EP
z22Z`0eMiy1Mb5Eyb-j9Wo@J=<Say7gkhdtQAtI$OXQRI6o#cLx{}*TZGl73TFD~of
zKHY!v`dOn9ZHuRB*@qov8(b&*Sa%{pc^g~9hOaNcA<8rTD|)B8@Y0~gCiwYB&F(Zp
z<pM;L?8N0c((n2<ln3|mf1*|DuWYq8pq)ygl=zy`EmT=t!pz(y8olPPCHX%Sh(3rc
z=u<zCVj?S_4=q4dUTLUe28w^hZ4lF0BaoPT1TvS=nJ3u~_Hs5o4+9UwZW<AQi!>XJ
z=yWu&@a}l*VEc_ymv+b>jpz*e)vFUgeGylT0}QO`@0E(5BXVI)pvY9+SpMRu$-&F+
zt)@!a^jpSONey+1%#zw@uuJZ9wiS1(b&NQcS0~R8IdDT>;~h~AHHm-C50nw<vo*cL
z$0Mbq_%1|h3L1|^Qt$ZfDMGcDyY&%U=3dPw8qGw}yHq!B@@3*(xb9s7Qfh}P_1oYW
z?^3u=Xb`Q=#=|7S{19Bx-f3!fJ!@LvQ@yNu8cD{3Eq!U=KVJpb^Wd|-$<Te9OBJn0
z8*F=r_-FU;KM+MP>dt?gm88OIs&Oimwxd`O3nr6_6m-AC6cR5L;!}gEA}oS9hE&jz
z94`ySX*9kX<<qGt+vW%NsxLAd(i=tGLi|N0T7qhwAO#E|n_2jnR}2+|7$Ho(h-8C)
z1KYEZNb(QbP61dNybof4_WvKoT^}|}rx9yb^ckE7OYa{3k->kA4GLQIzQ78+&liAO
zd!P6J4yf9!uZ#2nU%vkk{j1N?#U+-IzO|LFswt*_r%z<Rd+I`Z*I4xJ1%i*VO4IUW
zP3zv8xN63?j4FI*cNA^?fYiL4rQ^GPELC*w-0Rt*yt(__NIPqXr=P-Qn3iIzskSma
z>rIPd)RWM>xZ8i_)wg%^;pmQUI*H`=7q4IwxpMFKHSq1OuP-KA=i!~B)^7yHyRxoR
zw<Z~p@?TVxqxZG$GD2dcUI)e1qKx3>60rbpZpIf-zH~t$tjN50Da*pk*Y4%vteDbE
zDK^kxC6!9OGba!rP96FEKub+p7T7K~u(HDTj>L&WIs$(n#W1@_7b9fzF1+W^-2~^!
z<<a4u;nJrFY%k|kUcXTaPv(pMW@%}b%t+uOk^$q5+7ikOiE)bya<;fYI4}Ej>nuK|
zJ9NeuZ|&?eUqc)&(!VY8x9Lc+^>vlib+`Yohp&!K_K*5#xPN%`>g3hltLKj^V?>}7
z5O4?8UnPHwl-H)!P9YSZ-Gaj+E5#=zk&m)Qt%~Cfa-s)NtR_R4m@W{x8X{MjdD&i$
ziap7k`c5I`*(|+q4L2I6{4KI~$pad^m<uw;b4|~<EgIH*VzKu{dx8Dr{LQLd30;ql
zSRTb4DTS%yh|aiIi}=;Ka8#w+UkMFEQ1=A_ps|0QrBn8OMG75l9R8kC?3!g)8Tms(
zNE3^<xg{S%(#G$Qju8i+ItpGFpop(I8zH1$&LpXOeTz+UWl$*dOVU}8?YyaHz957S
z>sKLnjy@|5Ge$$ti#K`TXcdFAgu(~gb{eIRuUoia!FoqXaAjV;|Fq)j6^IYlKsY2A
zE=+%5l51_wUNK`E{Y8y!xgk|%*b$fkq=C>1C;(Eo#i~{-sURGlOw3}3z2%(Uc)IZ&
z!s>pfrXw@ckJXi9Re6o3OcmIPV#UI}4^wPKb4H)!og+7?x(4h6J>8>+5ANUJ!rRhd
z7@C{D6QX9Bw;tdnVO(q4lV{#WxW28}3ip3A8rH&qzg@C9{rHys>V8`>AqeeMN$xt^
zSZxrt$!o;&yz<c8KrzAA^hzU92K`qI;33kRDJAY8<8!$MBIlFdB~YE0#~qtZ8FbQz
z!%V!Z>X6qBmFQWlEgz0pd7zK=+DRU6(-!6yzpsWqRPJdsIF`QSB*Z15xru>UvO|9+
zRrkwLLGmVXNT|njG4G$<I0aH3KIq;5^x>zE9(=a_DEsaG-<jQwiD`VppRbjTzE8tq
zayq-|=fgF_Y<S*Ra6KxFAZ7(Cm_eN#RE$>Pa5WnZi58R<hvkvkeUUNm<1tKm?mju!
zVdx*+RGK;Y!7Q5#(2|?$Rij}BNp*iy+5}Me&WxQf&LY{WFR+2Zo+$~i9HiC494$CR
zpPJvO*=`XUu#;@PO=l_&`F^*q(~;Gpba!i?h?c><u$Yb389}uu?H0fA3kh#e-|2+z
z(oSc=94fq~f7d}-$aVBSf2tUccO<WyKV6GYZDq4IL%zNCEy>z!G;r=_NZfzJo2ohJ
z;;-DaB~GRcS5R9^aV>Ox;w=Z!mClUanXkGpp%VQoQ*B*yh!XWhFd}gb7igm)x3$17
zUIu6Oj}T}@pb26u#hUd(Y#6{@WLV9&{sm>&=cu2Oj5#MJhI+xnV6(l)GM^`>sMK<c
zDuF9#OPqRJZSh`)L=3rkEV_R`$DT6})^^2WwBq}R3XiaG(eB)cASEPchL0mDz+s5$
zjIC6iS=ECi<;yY_ninkbI9?A&S<NgP(xAv?S$89$(rdVdE}T%Ta>d$v$W4J<aV$)5
z#&T0CorsAS?kX>P@zI;Nq&?5)_=o#ImXYky?{@z}*lqHlAxF6ne6WA~J9nbzV-XeL
zF9$TAI=zK6N1k)g^iHyUfBSy-{>R-1A2*^-=jHHB?vOJeX7%;wP+U}AX8SwI+XoMI
zZo}-mz!GFU{ITEgh3j)v;og39<#}5)zR<qjcm$S!_bW_mON#zB8Y~T3Mqg9-=zHQH
z_U&R;CcJ`)1o5WPh(&)Loab6%XjOZ6%zcidc_$t-sUo-M@8mfqG*!S=DKxD*(b2%~
zc&?+Ej=YeQ?Jj<wI=Y1`0DNc*7Ko_%+WEkO-V)A%|MTNQIyS;UH`a!6R0BDZjgV4?
zOL`;uw%#bOySuk1!Vn}&w6%hWyd}o={U;`$C33OM-4!I$S@M5lt-ZQdP?Gihq1S`{
zaK{@$v;Z7X&Au=zj}BjMD!bdmd#=^R44iySi<9@jiJ!<X&M?wBLiMzoQWN!VF&?)b
zz9{!JTgp7G+8utj4Agb@0dFz2<Vu=~{BubPjnh+o0*;v&W$2fsCaacoBGWAx=Z~V<
z+p<S(%`JU2{QZA(=8rzSfB*hKF;oN}rLnsrP>X?yns~UJ4|vy<!(W}+q@*h>3;Be`
zW%yOO$MtM{C9)q2*@|t;&7AaIBf#5|S$Uk52KepkgUV3Q69$4?vQO}bFbZ{ia3G#l
zL}OWhByJl~q}<mU;m}TQJxz2mQ?-L1ULwOyOA4_d5><cFpQA|R>KD|ZbnC<Z*@BgT
zZ+(Y8!`oje7vt40ln8K<K}I_g1zsp?tVLcJ^wSe2v^gb#5Gf?u<3BxDmURpV$K*qh
zpGy7m9xMEzMPxWwU#4G6r`5jbTaj`BxShlo&%Ha9SHdkIoj5_FEk!f6jZTc96q5F6
z6rIXdm(PEOU0i%OA;E|xd5%*j2D;NJ33*>H&W@)nyUYRp>3I(Ta_GV`a{{25z-lRw
zjetxokhBnL8B`}t^d@RjhgxdG7f9?SyOSFY*w(Z~5A>z<?waTrm^PISn9Zf2m^B+(
zd+ug-odcOx2Tw_eX#~l5F;^W9r;R3OsS;gia$|q3tvG=~ZQeQ_$Gv8yFCh&DB%hnR
za=bjMP=*xumk!L+h`+dq&i0O-TU3BGH%ePkP~E9T`mIl-=zF9~qEFJhS*eyJB}X$P
zB*7P2f#KGxU(0JT8}v`WZ+?qEC{*42$G`pWTIZS&!=4^a1F==JtxEqp<r}7M8PcVJ
z44r=}ZQlN+&&oqmMLroQ#GTtLwi8hAJi3s;DeY3@KTokW)lUdhaIUD}M!6l0)kmPd
zg(F`VGbbX5aK~&4QJOH9X$m+SMadL_7XBV10?=`z@kHq8W|>HqK^P#~`7mg$#TB=f
ztUYQwC<DwI-VX@>#1apukatzW#!X#kJHUUY46MhGK!XY+TDFtHi!4<qu^Z10IJLg!
zWV*7T!}dzTdlA6qq%#9wk7}q}HAwxExK{aWF6mi4<%azSVDQPtPul!O+pp6$)+q?0
zdKd`Aj{>ljAceW6ow6|CXfakU6E8*2H~di1z$Trr(Ne7x^=lOd-`4mx-Z>&E3k-i$
z75V`OFGC8_xCmbcmm=7yb`80%3}br~h=c8o^7A)IlUTZ0vpU|h>{6-DLxU==S8Z0f
z)>On%c{JLK7&tVPTUjyNKT1wqE}<O&pXxwyi4TQXuFjWqhg+%ew($^>Qp%gd^dwOo
z?%Xk>2xZqV#ARq%vgXjKk3J&W?c0Be_Lmq9Xq+-C*p4CEAv-kk!^cde19P(?E>T>m
z6~Ofz!fN_;H3IFPu&8d@MKcOsy=QDIa-qwuw5oEi$8y60kbcGpXAPByd2L4cK>C)y
z4a*;K9TFh%$ck58QBC%LGWxL<F5ph`;zs^+EH~qm{PIsQ8@N+rHM`oH^^JeB9U3E~
z97WQFuR`r7l>tft(D1ouxkbQ+V<w?L$*JGxL)4gAyGQh-l=muTrnX1@zVINbJcrUn
z*90zdImu^cCkZi3bQ}g03g7SyfTH5bFC(<=EE2xz5|=Vh2vc=|OLFp%LnB=U!AB=6
z77R~4wnu>{!rLjJ`y$I;0_cA;G~zc^fGy{iR2>eY9TSyG{Reexc6`S^D?IlOSm>6~
zsTK#ABCN5pX=T1g*~L6T#PnG@>m_?+!usex{_Ve`5|@4RAOH6Mh8cg3Dkt&1B{6id
zd<Z(K-9cXwb#XD*w42#DaA>%6Q3wU1OY#gp6D(c;-vXMx=%+-B5Z-@-yQC8~R1ib`
zpTND4pCq+ae|9aE*AV=D3`&1*H3RGm=f8+aGc0JY@j4ivmNwSCX?xIUyaZB`X$WQY
z3iI;cJlvcVE;kU*f=Hc^>mJ*te3uC24`d4JbO**f^*qrcUQTM1!NOXXg$Fo(C*3$o
z__`Q_0%~;kl`Z5KX>xxx%Pt<T#~N<}OyF^IQb^KO^GmeIi{^{1^vjOk|4Mqz-zEZ;
z(NvP_RcY=ehyyPgpvI-A8>iEc)0tvpt4V|tbdv})3SxE#)F6mz)T)*~R+V!^;7?7}
z#$wwLon5z>vLQ7wXHTqQG7#>Mur_7MUKm-$1gkY~@{34Xa#MfW|86?M<ti<OGpYr4
z0&GL&tc2lx%;B*$F8qlTWNp!HH=rj<bMqpKpbC>w&As%MX<hqYyGwJUl=NZ&4>Q5n
z6DXlz9V1sAP?Lh;wUDxnks%5{mTq5wrVA$|8|tWt5-P<Q2GoCll3u#CkPKeb+w69e
zUq6tij}!N>v9*7>Tb4*YROBrB#f8J*IUSa&hl({I;u`K!T=X`#8pr$3_xDb0%=Aad
zOR3JZXOD6}@Nd4}Kiao}{QAMp&dL72o><ir9lyjer?bn2pwkPUNOg>EzJ8h&?`k@_
zPH#%`I>v{Z^dg`6IpmY+0!a1QXsCO8mRXe>*D%N+5L16Il4>7D66Qlln7!-lY$`V6
zZ&aa<k<%TQgR~VHlEO$!C8twwF?ok9(I(HUUFH&_2*=!=qyc|MYsU;!B<2<|#tdVz
zAUP1bgRE=7*e9~h%|<ZJtTGl+rr-qRf%IZ?mgCTIB>z^?3yY))=D6~X7TLw0SGQHh
zDl6OdlW>2qzj%kea4(oVMC2Oi83sy6F?AA-#AwR}JrIgD$mWRBg7GVgbP%tSkFiz;
zr$L=TRA4hD8N)Cca0z+hkR&lm!ym*QV@c9MM@6fd<Qzy@u<8V^S&R!f7-Fl$t-0g5
zhP*3g#flkdGDpptRv1Mm@nh&nLDY6b#g&$w@=ky9>uvw9hw`uX=W_NBRd@A=UOx`I
zZ8u|uLFX$Nv?Q=t)CMOYH%@ejA4P}wQSA`#6I)ynma5`K0<0{i!U$u>n@-@pQ56uI
zYME(9+&aR=RI#Vj$ZAr(=l=;IIU#j;s$}!Q+IC*GkGRgXdc$;-s<@L1;{@n6Liynd
zGLwJU^UNKP|J_Mo=}lk-X&5JlA6u&TbdQDk2GADnZ7+WFS`<sn!!=PavAA~pu{5@F
zB1E7D<fSaLyQ)f&RCeQAHA>SIt?_tq2E9fJ#D>4QSxmkX$j8l1q6)b+x(S1`-u<p>
zcg6#WB$vlHjSPIe4s;M(K0c1f>*JWbp4@+U)xWvRQhh>hO-Vpq#M8Of#mUr>E8~)d
z7T-m*2|CPq;Z9*?>*Ha45)JE<8r8qFim~OI+v;{3x|MaRIXpUE=n=-G24;%sBk!*7
zX!TA4{o~?5K{nU+sV~6*t!lY|mD)i1Y6IE2-`98gZs_N4`197seaFe-A8MdREDwJg
z1r3}cQozh=K=@pHCBw>M9xrcqAUTujNHVhmrEosP*JTa%U4wlz*hhnXZP0vdIPR{)
z)RzJa1K}WmG!_qJXJ-fcX7W6{OwVsBjxnE0HR3aODO`71G65ZE!7pA_lk7T_z6v$3
zPEn)Ce^DtNCV8Sm&ZUAM$1xsdU^IWQiNDQ8bDVHD%F58L)6pBNsVj(eo-$+s>@E#h
zTPUg!Ed~`qsq3p3iLDH|;*6F-@%g;kUGTaM4)Wy54S^PBDM9InH}0Ct&-szo3a*$2
zA!7QT*}OIB4QyPx^ljl7s>JM6S`gC+RRxLtm*LB_lJiA5FUE`rVR9BMXPAFT74RAE
zto$6dm(h)32jlf(c9~A{zsF`i#L}PwUDU_47$M$MhT<!w1VTbGnH$#W3<y%yPwL0T
z7J|;BY_i3|@!ZxePA;F{bX_xDMr^e`oaADv9``xI!E;u()wCUfvYPwKVqurL&YkF{
z2_qK%qmG={2caZK8E>^gK)ZjNdPEFB?s32d#u7otL-E^lP--Y0CyEhtrMw)2C58YU
zBee}7H2MnQAb_yUbrcV|pGFMuWyN7nIk&DR=VilSy^Mx$XKuUCbf<oSNY5zgo`1JJ
zIM%a#?ig|>IUYHEg*9EC6$K(`zVS5&1Bd&w+p)s$hM2WeD@cU{YDa(5P2HbPxy)g1
zxkf&S+)=inRJa%?asU3#{rkzOw^zS(9HzFbg5Z1P9j`Gbb&O%YI1>tEKfizb_;<4h
zpZ0g396tKjH@}%bzF)Sbn}?q!r%&8$FIgfBg}5db1tJ3RuD3LtXo11^>uLLebhW*6
z|50-KRK*ImCE%}<`TKu1`PoBj@{t=o<X=(CrqlOr>A|B<OS$e3XBjagS@@Dw-!?ao
zR~{#txk3fl)B3)so8orD^IX8)ncF=U$gv|T`&wwNZ{K=khKjm87bi~5ZCYV5sOvb9
z3^yFhh-U?BqLHf1KvXT^Vg}%7b#B!TFL%6Rz`N^^vy?MH68C??=yj$%2Gx2e6*7)F
zuh}#P-yFPr`r_dE^MTivJNWtV^^@lZdjqv<X#w!-BASh+L|@G)7R06G$zleFM+bjC
zc)tH^|LK4)D&tu5Hb7jD4)#v)Ho301F8F#?HB2q8%Z^md+I_xzbg+L+bdvvPTr-Hd
zz`CUIh}f%Cj5>dKao~FGuWtk48wl)E0S1G+EN~r^7N;n?2o*vuX69DU5SWy`%~pEu
zVy3*pjfWj}_w<!ul1-G8FJIIeo+swuo#1YptYBZVbKd>t4xG4t&$V`{eul1>?A0D<
z-pW94ZdSOVJ1En|+%28I)OgB3oz039t<zMO%OHrCJgR?#9*QL@Jk93j{&!Q>Ig+6>
zl)|-+_(4Qk+O;N8l|4imL&eZ61g!6h(LwbP0akzR)1aY&V~=`v*xl7EvSuf;@=Qmt
zqnrcE|F?9YVa(VBq~pduv>=6_p9}IF4o>DX^Ucg-xVfP)msXFm?N`zYL=sUDOmOKW
zRE2zNdmMk6kz(?3%;d)EHVX}fGPvTO942|KPG(G6+dD~gWzCkZtY93MQ|Y7<r_6Oi
z)XL`OiYt$}L)BwaZ>TCTdto`OGR|a=#9X2Mb^XCc4f}4>x6o^@pq>>UgL=;V&wX11
ziA!<xvkl?}VW-jP)XZLp6|g=z$3R`zYUpzRQe%Ji$?lWq`~8=@FZPqKj$XY;4qkrs
z>gdJp$-%3a{o}o__h0Px_{y<bvgLhwk~~f}gmZ6vu8lY1BBX-*w01A#@jFhosuyHA
zIFURgwQvSGD#8C_j|CN2jo#`oSkqyTXEMU8(irQ_O)qzHAW|lchbJ4#G@ObvnMe02
z1%7{2ijRcWvX{h?GZCy!oE6(WgJ|hM_Epv=fLWS25}Y%5w{k_;xt%T~2nhv<eiUVG
zD`kD$i@Zado9;7kLNP9(U*j!$6kW^AcniyoTjG=GfI!Z|rc^dn9P+w(^FR!1&e38H
zlQNT=X?&I~@?b0U&m=EW0k#fr4;Y@Tr73@CU>%rUIxY2b59i{q%<(<D?BDOnOnT#V
z+Uh5dzf4-+Tjhd&FC3VTgg;k*Onzv${aNrV?cq*hqOrKd&P6m<hq2vqNAPY*=auDx
z?sugEY32JW#}eu{4@Zqrt!<rmr`|?QRNY9#deb!1UB_Jh8m#4BW+J+IY$L~O;B<dY
z-zF_2a>wayEb(qNzNJdqPL)e_yUFimI^u3?y+!PQI%_-LV-B)(cG+O&E{Cuw2bDY0
z`n}(a?K)ektOogf(}cjLvWySmQN3jbxT2>pqoux9oEDR?p)c@)?EPPnSw+hPCN*<^
zDz1AFnodYhwk~2ZcIq{vNep6083ccYq!1^(@_6{;`DiEcYNi{gp2}+&vsmvdOYHQi
z-8_>hlc;obbPSOtoDI7YKNak4dLAR@dML$+Dh#%C13$mARrB(g)-6iL?lAGd8c@xW
zsEA}MM4n=QrnCHQKFZ+CW-Bce7wW`nRJ+Q;jjiZqIWRS4;Ma`%_Gi5Bdia0(i0xv#
zT#IN$x9TA>t1oHbuHV^ieEeBvJke@2m8o<D<uS}eZx`C_mgZ8`^fX-Cu}e7m0LY2$
z6U7WOsw-e?W_GNgP&Pg5B$}hI`;G5E#N<7f4}A*;h=mBAkj)9I(qulLd8b!^orBnR
z3-^aS-#t8taVp)ZotIlQNI!p~jop9Wmx|ptTN=Yq@ssRcKAYu^LdvCH-A_+VYcA)D
zVP4P;9U_-#>Vtjrp}(}u2Dw9A`4S<AH&S3^DD8I|r_v*b4ovWT*yq>Yx*{ZdTI)NW
zYCOj%hAzNz8l&&aw-S>ny7toAYT1IKBr&jXE3dX373(<za1Q#dA<2KZ3k_D}Mmn3h
z%if(MNx?3qNQApM#JJ&|4{x#?J8kl&(Yuy}kY^1e(&LPIe~#t(C{9OL;zBk}|9mlH
z1jutF3#66_c!zZjv-Ux<KDHWJoKj*(0Z$EBk8S_dn<2-*QK9-9ym>~z*aW8)$c4<M
z5mi>B+k<CwNU5XF*V2DDPU9YdNClzGJBxtHMk+XV=kA;_)^?}?`&BvAoZf@q$<gWh
z1?-mkX*=mA$C_?u#i~=$xLJ}-Uz30+=~a_A8RsH}I4DBN)=SI|A_b>6TM{XG;r_Rm
zd|gc8^ALZ$@K4(L(D4~56xSdvORm+?5FyCrP1H_D@9@y0cZGj4Tq2!|o60zzT!1Yp
z=}z9)rmGqpd&J{nF<v1QMDN$&WaSXEoVJ637z+lS#=u)H2QbnPkbgd~3;@UQ`JTHq
zyAnnK3&UT_Vj>ANVqoBlz8Su2`i7FTDu<wmi2_UbiZtOM$dPK$d12=iHdr)|VX<YD
zzX8*xRE%FWtBilPkPATw;P<`{x{dwtdJTT$t2RndSSW>L_h&D8QVIM*#OPIlNF7=>
z*i+ijF1X*6w7rpqQ!{-)hbwQ34|1MQLl6+45qW+pOQr9#&WuLxSSAX@u33!RfemYT
z$;ehYt_>f#Q#E>|QUxV7C!NNNz*lNCcm&aNrbf)FoHu{dBNCfv@S6qC*nK_DkRDh~
zr_oiM2MUkBa)+jOS)aF<(;Gg{N)Q3WhemS@J(e>9Yl#O}7J|p3>cn&}!Z<Yy1v&=q
zyPm49RAccsIrhM!I;679Uo6j;0lXH1>D_X-v?E;bK=7GmnIl#xC9$Gsyb;|}H;gCF
z(}_SGz#D%dSIXPZMA`wu5;7y?=X=_YG=msM&=^Ya@E2is9lO39CmTq@)1PyvNf3Ae
zv0w7rD^&Ife;($<GUnVG`r9$fp0fZ@K(D`amrrdVV+g5ps=CHCaj|vY=cs%C44MBn
z-nqC^aP>B{dIX3m47;O}54`#A-6=Kb83oaiSW9tw1kaIwm(+Jt!7dP|D!*)SWhOTs
zoYdVL4WoUxTVEqeK-0k(Wn;Q<Y#|5^-!f#bF~^SIg<znoxV06vVal7yJpIlG84f@z
zjvS7$Yid!c922X4k`9LwTQ@JiYkcnn>}GvKn>)$(MD1wi!=^#=B*_nrA0$jpyv3P}
zP{C$h14%xA)XV!QlNv7{vKE$3r$d*91l`4roPnJU@_UGKVYM7vaX%Q7ldnQGD~xW%
z63U8HmoWb^YsdrOmh4oPkEVo<{M!jg_D{E}?jPUUa(=DLxoQfIp<|&<W{?(bMj9t8
zky#V#0?q3_RF2_KI8ALa&<SE={j_c3{Nr1lGXo=k<5y%65+ccfvKrnt7c+{VaM03V
zjkX`$??hX*lYIK|{b;{{r*l81{O1{V!e`Kk2&L7$z#Nda)$s-Aso$1UAKhN&v&_Sd
zbyQcGQ!7($4ec7Z8B!`#J3;cY)5gvj;45l_FDnj-2fDl+C6&J>sN<!ofDg)F)}iED
z6q!hWx@$x*9+*bOgc9Gpz8xLGEEtBnEAL`=F9LjSEbdDbaVthzzs;8|=W!PHVoA?J
z`UX#?Qj{uVHBgQ7$iAmOsHU{rq(Y|#4T*%VRJ#Ts(<q~+q*}qL=^x*=?ipBco2wGb
z;(E-e(v@(9KN0&0Mk5x(t*2%VXRS&m1?UQYB2?K<vMSpG@K{PHWB|dA)H-x>lmQrn
zyLoowonr36Gric{KkX`OJqZ~ULumKzixgNJlaeJ5XVDd^4Yfmj-br}R*R8Wn9U^n7
zbbF~?F>)tT?Km%0mqSiQRAIcDz8rOBn_?<j<J6StRAA(*YV1R(v0bCTuDiCg5yL%y
zqFJ^Z7nc7TC%Wn7eQ+U|;zARpKRKmJDQ<$8bS2I(7=BELm-M1ZriDmWYxBWCMPn|j
zBZ|x6JuFodKx!5jefxB|v0Vxjf-{1>9jCDN{|!M>JSjpDP9@K2r`k^7!oDm}2S-CX
z_KKkj`);ieYK~BtE62pUlET8)H7vt_=hB@)tc4AmY)n!C1!Pk;LZc2nBm;8q2t^}m
zuBoQN1TF8+-X;X?<g#nUN`3yXX~--c9}w&%<YMui9d(YoD>6iJ;aU^y=!p|MGeQ%=
ze7m5%S`@{?<Fw2RD1QpFsP)=IP8Vhdbma>Vox$_}r{@B_*GW(de55jr#!b6__Ai;D
zia5SWnK8QoSg`r|tmsyzc7<?!rhMgGZ4JE)s|b@zDP;nl6t2e^fY2DaWD5!_Ejm97
zkDb=aRK3>+l3=JPzH%oR?w`jdu!bbA76?+Euz8a1po6iYcO+6AK#s2ck%-%L^GjWY
z{M@IpaUa;Sp?w181`+3g2a1e;OSqZ$4z~85cH~E)0;f?T-3UQS!v(%|>X$nvEI`(Y
zV>C#6+58+N!a3RwN6X@|LEO^xFS2Y@_Qfo4<IUH;W+xR>$tfcrNDz;jjXH9x5uc9#
zxRjE;FQ_?qOdi7TGV$4IAa65TmNqvh1!I@tUY+^a=Z;=@H&%|V0e+HyNkG0+?cLo0
zsnHRj#-b-+M@shb<g}Kt<hV4d5UCzLuj(aAS+r_=2A`Fd@&*`kEs)Idm<D+a;^IcM
zo!Y@FVFkNJ+;S&z6TGIm%z`~`l2NLT7nsSCse6-4*SHvE->Eu6V~Z?`t%Dk;sDMCz
zVV$TsQ88Hk+zmkpIM?KV%SPm=z$_s|1?c-SWayFo#ZOSn1mF|hdd%lL>kYI6SW~pR
zh9^sL1lcOaG+J?KdaGfNlJ$pQA6hYc)T#$#N$H9&=WWS~^2IGWff4eZ*9WC~e3|75
z^T)hXpI#bZMKGwN3=E}%;LHnJzFj+$&n7*oF%6KhYY;=3jq~n*JUhRdz{#gxO%RND
zF(X5-@lq&YPILwUe#S^7M-%SEjK-2jBJu~Ws57Sr<=ULvlG#nta*N$b4xa9JJUVk!
z%A5IgWCIbiD0$Y~I&6)y(qd>5aGp(^7{2BB`33I(i}^KVc2BnQ5^g-76eUiFsdoYa
zj2Q;mY@P_YDo(L~#m1+;FPe%2!Qng&<)%%=R|d-y<iQ#4im`=7EhfsNCT_x~fj&$G
zx>M@O0|C0=gVh-*;H#%Xaqrdgc7Mu`ZfW&d@m?)H>|YkQw1z|QUhO^VI~nzAeclaW
zRGsR4>JHU=HGE4x4<L7$ehkynMb`?|pcptye06a7<EBG@pspl_-9-0Y$1zhL4am+N
z9pu;vS>u#OB9%atbf)R7tQ4(vyv0(@tx3zEu&hQD`}4v$DKkMuK{r^w=8J>_O`H;p
zGA*c0;2<TjUkTiBYVX+M`NDgj^hI!v6K(o&e50yz!V07eOIDS0oZfXlR}V2N1`4=r
zM%_*8(8CFT6;BhuT5nn3)CL%aZ9}Yr!aR7`hnJ$Su+G4R!J1a<&i9j+<hX-jp3g-{
zOp`wxzj~>`(e#Zim03>(;9WNlqE;m=0^EeYpOB;x6kN;296@UX?^-AxK73X3IGf6q
z{FPf&(gRsDa%^zVo`GKqBay7<W4&mE=oTnlz-!Zgn_R`9m`EO+=#ii?pMu4N3Kea9
z>2_h5($AS@gAJ8+p?NfTiV>FU4%jDsURY~RsaZEl(=sqXk$_`yn`;hjRDUb4Sc<10
z=k$#C>&4l6w;_;qNuEwUatCi*;EsZv;jWTlAu!6PD#O}bIP$FrkNWyMJ+@rni~Kv)
z7*KbAWFld^%*ih<E~G8Vr8N1t+T>?_KJD96V=eA8!96Xe^+9ZN9s7L5aZvnZ*s0cv
zl=xpKYhmN2w5t+z+%<aUbhPuUrD3?^!A9k=&d=>M0|gdmYzU|y6UMb@X(Ey+LUa~q
zT{gomoWglpE=r!(VXYU(PDfcb4XXz{J@H6?AO;+u@I#Xyn0~Psi=qA|iejEi;R?2-
zE?xI=cZkZDW5ze9QV1N9F(4>m%}H~Mxj&-?7LnA3sG3eHB{SgpzJk;B`U+g?#?;?r
zn%<0xbSTq2O{WmC>6pou_UM5ur@bR29%c0jJM_zBxuJekxH<~ftcAS8;VouPk9aeG
zVLey~zA8#d7mj%K6rcKI?D&wL<aH<VQ>I9+K9JE#*Rmw;j0a^@QZiF_sIV@ROcMz`
zoQ+{xRvewQiACbCYj~vq>=kP!ypyCO{2A#<j<6~}-pOi<P{|IhFT>glQCyht(hA%0
zx-#y~Nj-5iPVgy$sBKjg%uZE$P$aW|RdyvqJo9xERlGFS!RN~mVjw8FRIP;`YPvEV
zUDDA-fr*xq&<WP=xZ=^1-Mv^@UUNZyBH6xjHHNqAvYBNuMa*nX9+ucqFPwCKrQSA{
zVYqN7nLk8X4m4_<>bYApz(;+1zPw{NSU3Js#X3l&26Yf4p={`n_(&pDQkGVKCUCHF
zhAb^}R1}2ZKBNy)@kMwWNn}s8Oo&mO*(GLcmbb4jR3#3L#a9}S=-c)8mDsuVP>ptC
zsNcdYwfaNHjQUXlI7xk!LW<s?2I1GW+f6D37NgrjgbQIT3Oo=@J?41!%Cm{S^j}S6
zIN4CbB#T8ky0Jysdw#GaF+S{npO5nD5-_CfnVSnRVwOH|%+#rceLRbaOA>P;F-tM#
zX#7|>CZas2Lt-$~<5ZG)Q@zbl<*!6=GypqZd4K`6gO!<wMs=){I<#cqoT9JAB%jA{
ze0d4TVHyf@r?k$qtv`Qy_+tAnUzdkZBy5hs99oanjQ))|fI2WF!0!rwWVq#I{k4D<
z@kZSb2s&lBQlnvB3yk&JqFv5Ja+_D-Wi69g?Y&B3pgSh76Dd-K^6GMu^j{w^@m}sj
zZ+;LlQVE_akJ=@7Ejj*e7AzF5FUtW|g5kJ{V?IkqL~Y=CMHq4>fn_TjQd>_Ig}N2v
zKRCJ1t?#^Jsl~@vSvD_!+f`F^S;483EX;KD#s`Z~7G$(@K2sB>VN>ZXD0&i?HK~dL
z=Ae>FxDW(Q-jW4Es9qQLcSJ)Z`zOy!v3Akp!k}43kPv*g7?pnEbcs62)AX{Ot8A{8
zn_lwDoxw?=VKaJ2C0-m<6fRsJ(11*_H=Oy?Y*O@+7X^J(sJO#_LFrh|GLNAboGe2R
zqbCT=j)a`JhJ|eT{DT-I^C%lSet$8SBjA&@aq?zBQx+$kM6!X8c*hy5$JhE0U}qW%
z7qc=1$=PlQv_?ccvMX#6p<0-n?8KqzP#$PB$S(2e@RSpA)b52=QxzFUt(0l9q(POr
zJA&yfnA^|_EubQQO(3ATOtuV*0wz3d?3~HDGH8x)2&Og8>E<xWM5$9;J)==oxh(xf
zSZXbx(M<$1MLL_J@UNJ0jiU%{m($$9S;Z;bIK5q`5_>G^?evKo*0(LxM7wM&@A`&t
z@)V+#gJ5aLj+*im_FNd05qjme=HyDS>|i8M(#shP;EO4LvY6AGU@y}-_UMdNlA?(x
zXyIbUQ=uS7gVYART7kT?ZbEatlXZyy#4^@U#bqI{)0;pDFv7U2e?e484j0v-V<!aV
z<k2WSD-3rdUBEPI#Vgc<A^aA?8?BZ{=I7E~D@4bt86VY_tnqE<?!0z=nKXD@MmYoP
z6469OiqR^6I+}*a&}fSz-rOwTFn<FsPOOS}dKtaJd^~@BaHgeFq8pZLY^;~*m~Dpa
zcbmZ(yr-~;4&BZ+6b?kZSCT^lV=o+9PM61Yc9K3FL;+?+FCr9vOEvVx%}HP;8x;1=
zis4Nq1qE8&G@IvQ-cHLmdP@ninNAy1?JG%sT}*U;ZN^etu|$YNY%@1+Ii(`E{Nqdt
zSuZqHY;#k*>gw^cHz5%@(bF6-b4&dVJ{UD_S>T3Ll>xVv7~;qckw{otgS-%<?<L1{
zVUtNv>Lr89q%f`@q{e)NU4)sWq@`e#P8nuKfuL`<aG#^->pj!=;p{d0Pe%+{(FnPv
zH#i}G5VrB~Dofwyl*fjOSkn<l+N4<GkRe0fgfzBe7j1xDp_^?=bDJU!78bxL0jHdy
zCqX>{bWDo13N8{%Sop9^Fc4g%$4c`A`sX4?bEUu3J5fNlC$6o(X7hf>EuG`iV<0E7
z8@G^7p_^p=r1c;F_CMtA>mS1bAk`cDvLtkWR?HN9XI@5BQ3`Fr4Tf%Kyx}XP0p<qF
zGtha(o606xr660f+{xO~gO^C0fN)26V#WO?PH5RDQ;U{^TkGKB;P_H@5mqSX7Bbpd
zQJ;Avi<w>OjbNiYkIHCAF9!8V9{1<P)|CE5O8rwoWwXeYU7%>WV|yAvY1Rf-K+_O^
zPndiE16_TptU%w3mws7i>En4H&#S7A6g~vpkNJQ^VKKkqIki2z$;D5qe$f!w2yf%L
zdQ9y^^^$KgaWqz{dr*q6SZ(~y6s6D|B_t4@+U#-Pt>CF4^dblm@jBdn4Lk{GNVb)+
z^3a!y>7YYWx-7z^H#a{3_IPhpEQZj3CIEZPi;a;$7MydK&gK)?&fX_1XX-z?7p4+^
z^grz(Jp2OCrq&HlU?>2SXF<THR5C&t2PsUWLPu~V0tZTEIzSZ~bE*Jr`AF+fnrmT7
zBeNOjMc4hO<`b79st|(|#GcOVGDsm#!2rmlh&h@iAWYTgx43PSPy&M#E(>XY4ZA2l
zW1=!jRshkfpmHd>uBZSx;`6@AeB{FEbe0!D>@u~56!u`dZ|Q)rRF$K&W)z?Zy6>%P
zP7rnfg}B~U!yaQ57(Ha_kO%u>+@LL@2q4it4GbeU*%B3KIWoecoh>eDoR&(pdVN$g
zE66DQP5`diA|<XfyU5N{RGYDXkkjQsNW@y$PU=4t&6tZB-DP3(-T6RWsVmfjyOwM~
z1M?`LC5nxi^1>B&e6BlsDS^K}Hp`QXS|mCu^I+h9>qUet3o;E@vDL~ZH51LQ&@&(-
zOvjN!$u+CS+>!cSZxN$ln1Dn#{B4oXvWT4hq8RCp4dfvE?kaU#PKj`TrU7j3He|Vt
zijCylA5}ZY#80txJf*OV7*Y90TR?_s@v&Raz<;fQPU358oZ`{~9qJ=3nDMm;E-Edj
z%Y$e%P(`Z}fRht`nICuv*vS06QTqO`@~Oq*_Sg{pi|!2C@$w-`poR(?@!Y3cmP!PY
z6-#yI<oJtRlb#sv2HDhqrx}QRJ6l*9TsVah9}<U1nw-swbZA_JbV1QW63eV}E7}YR
zW@&G<beRqATrnH5P6~cZBhQ7ZH1d^(UFmzB@VQm*1M~*+SN5tSAVXK5(j>cviJ3zA
zCs4lTSD4}xSsh-nHp}&QL@?Jm#g=cgHnNY+K3%?5V#?B5GJ0o!=24ACnP<;8TN2yA
zw!&Ko%&im>i8ByTH`z_j(%~fm0LfvWin&t-n)fn;db~5J|BG=1u#wJvP<^xm^qj}U
zBFgNf5R<Q7OOrs+amhWbytPFcX-vNgU@T-d5|l;;?{j$LP1Yg1-AzYPjN65wv1!pb
znB6<F`*XTCjB-$au&L)aYa?FskW3IKm`9gavM+|j_!85Q2#`}aJqv~{JFT}y{i&oh
zi<Cjux&WYr>~=I1MqmZTxRA5O>rO5;A1ZB^pmcPJ`*ser^bl$9L~BWX%ev&sb~7pG
z_hZvwmhvjxM}RjDd_7=aYD|AV3q!8m86mXdRAj!}7cpLcJeZak^%3M0RXU|hcwDVp
zw`Yi33A$1$I=c`5iOlYCQ7!?5&?D}vf>yBrdm;8-7sX!<`eg?OJ4s&<?-lW}SxnDX
z^<QG4_1hMn&x@UvPX%J&n0%ow5!TqS<{l}cKw3(%rXY-nX<r|68F|!{z@<(F*~W_7
zgP}lT)7I#J<8cAMLK$z8D#Px?kJ1@4JK_3foTKvYp*16Svj8Pdh8>?*71xYQeIWeb
zV*v~Fw2-`3Pv*R`s)9&3&D^OFSD>sKEOHX18HAvF*>*edS~WsYo&0WxCGvo~mYo=G
zD1)obN{N$T*)RqPF@{^StR<k=CKqYmxV7MR8ZJ10Ss{OaRrq5cYS)%;+~ubMmQw=H
zm>?-@Yu4jX5?GxnVrEnhFG8C1DJeR0sg-VcB58230GjZ^-v*qwF7)XWAAS^K<-=zX
z1;}!`?v1X!(bYG)c%yA*={<3I%u!R%ofU}dC>wI2fi3=8mDN6v-gZ};7)FKYY(`@n
zj3zvP#(V~3!DK(HWjB;WTVIO8$`?jO(3HY;2Ti%6?TSe`u~Km&U_lg*{k6oq{vve)
z$kSO+rUelSHQLoPBtMuAuTiA(V;lh>Azrn&HReS^UKG1q-`@3T-rhWbkc<0-q*&2B
zJ;7hCg!Wz=wb3&OLe)t!@Y7Vl_;CL&P5xYe%DakZzRG221vD&c$Y7_t3wIlZ0?e-u
z)`TZ~(udKc@89e%@_3MF>glRvhvYY!dQ{#iwi4|Ke(i6P!=E6g1MR&KKLIG^XtA!X
zkNfIQ=mW5VEsE3x6uWwh$Lbp{-zyjbUw-rcF(6zL9~~yrnwm%%5xu&pcU1{QtABQX
zcTEW5Q3uZI=C=E9?Pak`$jfnq<T&r(U3!Y;26X5AoQ~CE5^H$xd8p(}UA*U+BCj_d
zr)rA<<Z=q}sI@es$0)_sVazNr!^&W{`vD0zfFYGtUURk#L|ScSZBAhL(mySgy=ZjT
zX*s`%!!h3tl_L-JGhL;MWsjI3R+MXhCHD!LZ|Vj)U9&v54&=dV1gWsw?8_U3s#~v;
zay^<&c5o?rZ4IGp_w`K=VOe9yU*(LliWF(Z1Va=>Iu)p$i;&)R`cuTGaS{~H1?R?W
ztBB*gG9WW6+@oSQ@=Z<`WvI`2M*<V%o34G;6?lm*9DrT_YuSbLNDR5Mt4M%<ZKf^>
z|98^{DBpSIOtRn4`tpR!ZHxL2{vjc_)Uni=cAa^1SuAc>_rPO9Ti7Gr08*0GYBA79
z&`B&hShQaTAZz|#l>MjP%$iKU1YETvZ2O&2)_85t5dnkmP$+~+*wrsSA(`kKeZJv&
z_@2xPo)#Ea>GX25sW$MtzD&M<udi9hhh~Ac&uSfS-|w4|+CF)nUl7?Q*-D<W7+R7N
zdV5i3wQnD|k;=P%p6QCv>_>f;EB6!HXOWE(k!oAX6SsM9YVGzjywS%S*06jd)qHA;
z{X2bK9)=rSLX(}8v1<WNTc{#6p3d(Q>&zw)pk2y3Xg>T!oFA|p6V9)HknS)p1hUX|
znNI>NW%QZ*%Dvdv7bWGIUVTx@;jwW?6ue~%QnO&_a~sWmqSyp-w^zb!6B;u?;jj_a
zoGdWt`K!>J)BaLn)>>?bUJ~ja_4!UedM9RKQMy}4ZGmDkJiT;-G9TPhtH0|@R7wBx
zs((4E<W=ZB%si7zgT0A=BTOQQD!Bz}E41v`d)U`k`ua+R`TxZV%0>1Yt3xF=*M$}>
zl9C`Cko)KJ^h{lgh;ldBMKYG`C%Pci!QpK)mf^zLcM+dI>i8Q}ZG-W;uNYq_|8jb~
z`{H>gIo>;XA)cy7{W2YoL>xTN$2AN^ap0X+6PKOJ?v`k{Zi*j&_w9AFPS(S%NwQUn
z)tlpm-4|&T%^ycH%bsAWZd_4JIc~>LiA!_ZkmsCxRDkzyGIlKZMuYY$x5rI@_6f?`
z={IZ+3XuFu@G#aa+3)(&dtZ95%9l@bBnzJ{Ag&$LOBGdM$tJz){7pVZh+5Ar=obFk
ziazN}wifJ(9nlkiF$wbT+uMj<U2|Lvd_;0nofJDmnQ#RA>fE<hEUFi#SY_Kshm9<L
z_$fJr#Fu$HO>Mu_az0C1&-M;G$?iAD?tlL7p7eUXcJTWPv#FR+@6zU}hUJQd_E2LU
z!g8JC_ueI6vhpgYyW{llP=K<t<X8;+Q9+jLvX}C?fBgl2kQI>TE8~vd<uu0jSSv(1
z;jG>EWDdT+82J_3KRS%-XbI=^v1yIk*3EO`JA^M{66a2$J@JN?mA2fAc(ep=p>Ao2
zN>7pO#1wa?3#xNAZm@N{>vrswQ@{`k6qezs)G3iX=^pOb{fN+PSe3YF0v(I9XjgrB
zA?r^=Ln17H4oRBP=wa8E+i)p~h6euVc;zS?3T}aW8tPkFK`tMV;`AhpNtpmsSbJ-R
zE8)U7P8xNWr5SO>&lqEn;Pcn37R@7=__0cKGGiI2!=7hl_1x5}b_Hr5y32odV@0Z#
z9&|#9)#!+Oi)LJGoDP)b&<%1yM1E?EQK2k%h$f|f#bdo+7z@7a`!B7j-<V%|F=gaw
z<Qed|v}q#vWpH<kM<rovA=8y7*|6y)K1gzSHS$#=LCZ|PlQe`fznqBTjDjkToQ6z1
zaU18lT^RU))9c2mIwm#RBFd%W9bUcvI^tZCI6ohlAHwWrp<Hh^xe_gf`VlBUw_<Kn
zN0D%UR$9!+S$0!stxS0MoPvR*fnEBleQ+H8QHQof8U>&}C<y`(R>)NlIG<pp4^NWT
zp5>c#k`p)YPUPNd3u!T)Mz71r_Z4u0Pb@xlm?K#9yk_ASGYh_+EX-@5>m7cO8_$+C
zL^ngVkRVz}(s?oL_;n%;z^^fJf+!<X)s`lIXFtL*e&4mb7b?er@U&&OYfOAYHctpP
z<T6(ac~xTr-OX`bZEZ>Hb;_Q9rO#I?qU9_uX=4ateA!~U(|nk;uzj!q#2biBcC^EO
zlVOpSQA7|U2d*bbvK6a5%B<4VJ#q45F77Y3ptl(83Zf)SP!-+ZFf_MjMKNzz>N{zF
zpsN%y_5lrJWYSvln_#*Y^YGn9sl7193$C|WdL6-jAyj#aTnFLn3*v}f6WvJLvKACy
z`ix~SPb#FR8ye{*w4~hx;9>%|PN$MA`!Um;WraN&OB--={!mmW(M!H^r?!hz8*h|r
zol7rqY8-^%lOY@XO~n#xH1!@-a*uz1cZ*5ahnMn{i|DSjZ?J!XZ7O$&J+x#w8WTN9
zED{?4XW_d}?KDTbY^Q!P(P&{={)le~K?#gQC|JRRZ1p`YBEX_1a9`E@UC;|=h%cXq
z&^1NF2#_)reqgts<9SY`HvY0k9eUI!3+m&Qs$?HH!*7DNrx5R&Jh{d#@L6AfUhC^?
z{e055-KzHSo(YQ`(_Bnuk9<I{58hXMF~t1CSs{B>DV;|*<f>ahUAU*&cTTiKF2X3P
z==E)Dn$E8P;^$bT@!EUt*6*SR23Lm5IK&aVn>JH};YD_Bb;usv2Zj(53stuI_4dd2
z-y}5Wyv-&Hsb@Ory5<=j^&3ZjjD(!xom-756W9DDd~(Y)3XJSe?*DHRjklO+5UHdC
zAmqR#6u|UZAVVNtoD2A=+15L59g7y?RZBrrIV<vnEDTbP?>ARK;vo1}EaOFom@)}$
z)0G!%a)$xfDn1+2k}J?dS=F=e!^nx~<;1C|Tpf(JLkr9B=wOLD4?^>QQu$<_$I-{|
z#urgAS>)mFR+2lJaA4VQ$`_&xd|-xJMm2A>xSBGq%<K#`LRJ6CG=pAeZ)1*JVQ~zj
zz{`ztj_R5*uj9x>5!S$cN7p-ywj#9G0VB0IcWrMfkWVt=sY*g+mhHqbohm!~C<suO
zCh_u#Mlw(q(C8$0obi``$a~B)Qe#!kKGkE6T%`+ECBes;G}Q?q1-32`3cb+q2gK4>
zB~t{{dwPSOCAD=5%|C$XNI1~AK9x)!RhNAB_*6|)-NdJvFql#z)G}Y1DKPYTde+g3
z(3bsqZe3dsl~uu#Hqk>=SQdA}Y@sr+CZNz*&x=eOQQfek@i9JsN<7p*Cn&|-No8=b
zP_fYj6{azoEE<IDN`iGd{Of}Edj)*ACVg*7(i1XhjNdNi6}w)AqL!oH6tkSdN{w_B
zcGKe2in{KwZ{(y=XETYMl|Zb8l%_0^eO(DF>-gBvy9R}Jq&9<u48YVq&a!#Mj<%%6
zo)yKLE-G8MW4v#F+DEYXuP`A}2X4i46psn9#KuRW>MC0J-1ZP9xoA2-+Nu8731NH0
z0`M{soDG79vnu*ecU3G~SpQvSAVsT;ZSJg#2~?plGr_*Xq?oDuwh#t*Wytthr1to*
zMPl2IzHQwLf~P*}%A<DeNG+yRzIiQ5*ECp>WNUN^A-gnxwiE|NuArqT)TR=?N!PhK
z2^Q0x#z$}k9lzRwP5s><Bdkdk$x~`vt60i=(&octODu!QlTmSI!eDIX`%!}7y}+*J
z^{&1iywfX6?TW*cE@3g?OHGZO)u1u#gP%c$y=O$aG*VwzBO-0LaJE+7&(IaCJxYbu
z7JnF7)+3C6*Yi}d5HP0?0Q}&n!m0%WU}h&7jRsJURSv(Nazw9Ti69;8*DH7--~L)`
zEEiI#f;iiD?i|-z!9)TF)2pDy#kL+@UO&28eEi@qXBYqF{>$zA_y5{9w7}#+mpKG#
zUP2N3N*RRz1z53|N+;EdYGp>hoP_CeL#y|Y*5IRmhyWekvyPS5TSu^kB?&!>p})L3
zpY`%$O&(`Ad!MY&t?3)5U#fzY&Ei&^PB0es!AJ*5y<|p&`&@lB{=>2sUuf7e77rX%
z?+F(PnrE!UQ|3tCEz9zrBviI{(BY~4(beqA-px45lAWd3Jy`(oP_5K;+gd=T-db)^
z!_0br+2rkyZ5(Y78R7KnY&5>(gd-DhurhZ+kX=B}x|Q&d|7ex@9~Dk<w7>iG#r}Ix
z1>5bi9cFY<SWqr<#z+`{r@MPD%gIkqouo<}@Hg3wyN&4w?YdEQ_4ls(z3Xi_Z677B
znrFBNEEsHgc|PmgQ3?@bVV$CW+G6xU$pnsnlHKaPFIh}ORC1dq+ez9RCwu!R(DDe5
zq1s-BXF87f*6EzXq$S~kFvhiE)kFvWAvnUrkI}N`5hHWXFG&T=$_YU;r&Nb1B%4>+
zOa1^cq;m3^`t10TyWTC(!M~63Zm6+gxbf31=0uz9+DmPp_o~?{L0mThPGKe7&?lmQ
z3v2Osm>HcMg|LE*aN>+nUQ9Hh0PAMmRVPM`Ws?7G;c+Fj@~o_08cCy3sZ_}vQJirt
zngmo;(N`%?5w=1Gptu&S6z{n9dNHt57a&y`#MG@$a!fQ#S98ntK_Y9f0=0}o@5mGJ
zeb*VI{7&Z?l4$2MIchLC6Y{iN0UkDgp8=p;f`=6%DYJ23Ad#Zbg4>*?)lHdIX46ad
zfk4AMu4cV;D{NzNdsY_bd8*3oP5lTkh+oTrM5&#UH5}DvDSfe+Y={ej<g-)PACuOD
z08h@_eLL|gWt*Xq^jrw8S&O$WO6bb@QM4V&1)iz@PLqr|>$dHxw>-sFPafWX=Rxm~
z#%HFZ^6aG_Xxo((&Qp&8_J?mymQU>`eS6M$nLe(8{$H=FsL-{70jV7#*WwcW!@1Bh
zlg1X$PDe7`I!QSDPCXeZ?^>}6u#^?SLm~%IB&O>k%K2ckr2^d7p812^k)a6#aIe^)
zOH`J`0j|v@y!~KnTihZo4kImp6$OzL;g<JE?W_TC#q=v{gXFS;x3nm6f<d*JtrbOw
z5DkW37m^aEi-2}NPvXrq<`r>20@!LVL~P<=++o7w<>f59G)RHq^-4v}H<2?)V7=rU
zFO`icwnYo?)ChNg#Jk*j@C?$hLBc1kZT^i_5e=>NWrClgl;YDpL2pifUQhD*YFoPE
zJ9pvAMLar~rPCL{PUH`o7Lva$3U|WYJhnB=r+axO$^hgH1<hFEyee->e6cVrOU9-}
zp7oNl*|_v+{q_6X`(#GJo~;l^7jgM3<^RiV_;c<WXhA2DgiK@Uhwo(R?O>)sGOJpC
z=e+2NQ$kzaY$o-e@=}$5rH5un+(DIZpj8BRD*-KTkuh?qj=q>FdT}(T5L*Kv3Mr;Q
z9t)3^8o<Q*0)2~d4yen@e7jrXEoO_eY|?#rf1FQHI2`($iTksxYlYy<WE%U=#GP08
z&PRwf6$IdrDb2Q0b-GJ|U~G+)=)Gdynez;>V=8mGU4a;;*fD8;eDNrCqZo>+oJC|l
zOK2T}I_FUYE2^eeu%mYt@FW<VS~ReZJrpJ1T}L(_LMg=SJkL16lBim8TO-i_j9GNq
zTr9|p=hP%n*};r3o1Nvm_gcUpQYq>R38Bl(@1%tS(sS|6pM@faUQBMQ%VLDWah1Z&
zVQc&rXq6(_hG^@5xC_2q4y7xf%NF*v^fq>+UAtACTd{gy0nQ!rsQSkWE1byt2qCxI
zUGYZGN;8kV_6F{Ffm%T~p(H3Sn)+*<iW1MVezuPTRhU%{7(}}CAn4MJA(DD=v$qiv
zJvsPS*62^G4Ru7*TAE7p1VLf$pUnU$XHBu-J8)SmY90E2ANKX9zWWJP-II;ldmEB}
z{c1wYNrs){CJCG6Q{BZ$1u|Uqv}Q>SRWIvU0!8TQa^Xlvf|P&P4~_Q2D>cI#?j=PH
zxA=s)qO!%eUL2*s%(cqHq_y{2Wbd&%VjlU9lDALUQ)9CT7^KSm{rD~qN?@b0EBRCC
zU~$Jg7h`CDL%;^y{6wQ?A~h`?MM(4Tzn+_*o?6JQ*P$>ay=W!pg!**+OX5N4Rbhsu
zQs6qLsUdiolMnKF(8JJpW%b;AtE)*F$*Ta6<Yey|FS=`^B^z?WOm$q3ll#4olfBnV
zZ*DKY`C!$1kCxxtcJGyRzO2%J02mNAFxD#56LuMYbgUq$Zr7>Da>Oe$`^0^{_M5g0
zCkmyj2gOvopgkK(<b+8vI#L;!?;cavAv~^k*hxN%pFUb1&TcXZu*Ox%Jc)^!p&Cf7
zO+K?P+@0xVJaI{07VfFLk3Q=qFXL8)IPBk1GDEd*MwRHz#eZvhf7d59kn#y@KwVHj
z$35YHgtAMwCw~LTuM>$UmkW1pOWuP>@!%^gw8W?*Ur0~mW8E<udq}&b>5&uW6GUMV
z)m&`sZfSx69Hx%yPEM)|;6{62FuhNAzd26!_m1yqNldTH?&bNk%XsnbBr7Jsk2ZV=
zRm`hoqeh);lgcCqG}uA}wV`rcPE#wOsj3Not3yPFSp@3#YVqw73h$<}g(L4q?KOKc
z^ew=i_6e25YaSJDQU>#ty{q|nbkDSzzVCJE?XvCRQLmE~{6=*$je(AYxJKhi?8XlA
zxAE|xD3-+Kcn@Y4u~m!LQ3_UFFTzKN`T>%ODTqU<&!<+a%TaNbjw<I(lrF?EER8FF
zTmz7c;klRF$w&?G)m1Gr+z}AaOP#{JK;iCnya#q4x=n_Jo+(rSOj*?N`l=Wiv3II)
zD-(E8Mzz+Y8d|J)M}u9zVgi~bP}&U75G-o1K1+?nMczq9<+LM~Sp<jOU{pvi2q_|p
z79iVSovB>$UN(GBsh^1%f;S>reWgWzb>*|VF!Cfrz=yCQMJQpn>ZgGSbE|jc-L9cC
zM@j2_BJkj@8=VQ-Po%mo2h)0pJJbn=d!Y{Wj<*7o$^ZBN#oJhpz;E5ZtNfhYbj5Yy
zZX!0!a@jZOc+{}KDO5XhGAOs%2UE3%XC0NiJ8mzB!yC;Vfy;AaUWw@~rQIZdu@$k1
zMNO!sG{*WhVm#c@y5NqJBJiuk?A!>}Owoi2`$h#bYa~&VPxw1gKH-|Z|LC(9Y}#GO
zBE-;=B>k)!u`Ju|gMEM&-(%S+JALTrr7BTK2(=fx$v3Z#{<weCe|Gfh_2Fab*FSr?
zdvfsS{r-zrPxl|sXN$}iT)&rpyb!!KrM1si(b~hGfYv@+PiwU`zkRVEVzD2tql||?
zjxu7xs89p#e|H++BaH7+Ma+sNZIiLfA5F^-?r%TBh#zpoD!H$qV6Ca}Kk>X(R`qV=
ztAqak&lCBawq!k!J}q+MK6>zp9#7Q#-ckSGb;qteB;yFqT`XDQrjvw!>ESyN9bGpo
zWBSz4>q8QJc5}Egdw0E_9>otHhLiAK%tY4VPTZt#^6md37Y-c>@5N%O>*zZ9;L(2a
z;L#(F_7jd)TD^U^cj7J&cp7zEZE1hxsawyhe>OhRaw6;o-31bqGi?8JvyM1jsH<er
z{-ATZ{h{Y{`#;a=nsqdPiRi~3Q^GI%l(+5wJhK0!SG(NU$EHqEXNF1@L`>DKf)Z^y
zG|f;{@o6M>s@H0rYgv(WzsXe%`+m(9#x+COn|Kn$#U6q=YV{cKVyE7OuYl$agJ&o(
zG|Vq<%-1j=nt$2D@gIolt5(NQm)D2hX(gZ-;A|<TRvbhefIxhI3=pWV4lH#L4YKd%
zvvhy*7CmMocqhJ=`cX^xEVUU~k-f^WcLD>8JC>rr)Mb;Vw9{<Vh}CMyax{T@^rMJS
znw|vNvwH~2Y1Y3ue!jnd*#Fb({nsnL*uH<iDR+T)RL4un+CGEocn6LoC4Wnu5i4xL
z;xiTrvP`PBU7B=%(QGtlw3(?BWsN1)FHzE(-%K^Q-~lY*Ve591{c!LS52WZbORGC4
zn=y!1)HSeMiRLP&>Gf*Mx#2_3XSqTL+c<0H?cYi+o8g*CpV6LR>a0LKH1aj1C02h=
zriJAG<S0qz{^=;Um<$;uL*Fsj&i%G8h7dB4%(q<GP@oilT*x4+86HtEYedH%7{(e|
zv-AgV=ZYG?_x!=9+Yy3pY%Nt#6GgWX>a>s(%Z9?P-tL?R2vr*6>8!*8-R?*4R1$4{
z>*{9|W)RA{MLv>3>JuAaaz4RiE@$ZkK~TsLOcawF(HRf!S6M2qILzk3)`R==E3>IG
zP={!=5>6n0oZCX4Qm<oOr3l>s%N=<l^wqFXBhVs#cEd@axQDhk^j-;$2{~jHf1)00
zDdwm_J7T%lTHcj9+2YuRv*bnUzMi`~={&0egL{AjOO>s?z80Ei9NyU~v(X49U1a`_
zvft;!$M(y2qrZJJ$%ogIhohp+Tve@EC4ksKvM&&SW>f}96^pnwC+##nf5XzaQJ#%=
z_bMOJ@>7-`Ne6fSRx`pXp*6^PhueEOXl17o7ZLU+$l>r?`@uvBU6xVfGah`|0aNJp
zvj7M$**KG%7?EGYf-FR5RZxzkB73}os+qmfSW_j3f&7QFVrAtV3+joNqU?xCzY{M>
zCFIqA;w40`@nv_U>f$Yq03#-`{?{NoM1+t>nn1RgU8LuFy$NbyIF#j_arlnjYeD!?
zxV@HnKroZ}?odw_32lz>1s7i4V9j&_Mg8j3M%%M-GTcLc-B4V@-Ac~rRCi!kK}h41
zWzvrn0)_kQEAO)SsUu!gK5Ond&e}v~ZSo&~|Mu^-OhB%zL_x_I)~%joy;?eymY6^m
z6a&0hY~efhw<F;$wq_DA%jjBv+A6`<yDWz~kuIem<3!4w%rz*VO(<}Jyeo~Wa2sXw
zYEZsDXBN|qMaxGp|5BICjv!w~@mMQ`Q5~L?;2Eb{58cVn*?0akMgM1+2&HJ$B-HqS
zMqURI3`h0wRZpEk9PAz*^pKH>%WTdv1L=5dp|WxnolAPNo0mGMY=$akR42yRQ^71K
znDduQ<X$Rsaw|eGLljkj`H_V(9D&FwCm6q?E_AK9LOW?W@#e|`R8i0(S`oI|j<ap)
z&(yIg^Y94-t4K)Rxt+}9oi-1$V#ShwfIL^qR~$KQsgF1Pag$?zw>H2QzD(}+u1Z?R
z@upjl9+E7inop|YSIq<Zmrx*irlmvhW>NRa`tD_BpPP4hrdJiyj5Rz26&s)cN}!Ua
zSzqL{u@{z9))?o*?)eSz=&X=~)ZI}4QfXYJ5IfWnMpuZ$0$Yk|*9)N1jRfg`#HXP{
z@aGT%>m)WQ#6)1ek}|04l1$2dy1n&a+fHjbnJgF+P*%p01vvRqvR|C?yEtFBkR5+$
zPFLN?z9P%2hi!8Sdu7I7H$))Q#8MPBlKlwVtMQiU9Y0J2Zlk!kAbtu;|K($*8E$Sa
zb?z9N-U_Iba?x4N;yDMsj(q)pxF{4=K$+(n<*Jppmxfd6fn}3z2*d0wpZg?w1mdG6
zFii`nS;Y#L!%j$pXAM|wT+=jaD{z*&!zL(!lH;Mc-0|9X4IzPh%pf9CQH|K5Y$uI_
zO)DR3wg-|e<Tk0M9NCeiLLe~_7Ol<02QVukvZ!Q=EF?GQ!qMebFL_yi=uuJ=3L#Y-
z)nY{@gycFNLpTH$66Vx!TR>Zc6J#4#=js#zVydJ|Sp#SX?}yb;{w@rCj-todwHZ<O
z-}_L2P=&xGu!uv8sMc>>RTHU?zQR6j2`Z=wOR5Y*!6L<_Eu7jr*7PP~V4Gk$q6wy%
zg8^UzSihX4XUKM@B6q!itm(9ph32DhjR?AGsb+Nsqy7j5YGWB+<J{VLS&UF6nsQ86
z68Ch{EjuQi6)d5%f_cn~OQ)M!*axH740OapLO5EVUTKK3RQ##1<8Y-|!C%NvK3d;`
zvLa$%y2Mlly2^n+K*TWVGhy*XEPL(sN<K_doS!eIj(%<|dq+cm6?>?k(hXn&+Ng<7
zR?kt3f@$1aT83=87@MUfkyA@~OgZa**3kjU=tM`+N_Zhv(c_Xk`tv__?MG=zxXn<m
zBMY=LfDpKJM?4uF1;%L}XNC;ejN+euyfWd(=LET-*4#pFX-c#lZ9I=u*b)g7>B!0e
zl7mGgqQrHwv=)ee<nnNvr)D8ro8H-BPMjnAE>jpm#3iL%IfQm_nHf|8ACTBY<0uj4
zko5#Em>Ihtc4{AjJ4Y17_Ia`SpJ0-8r1{t4Oylx|C^h{uO0(0bTsP>l*6JA`|A)o(
z#Ea>tvh_m1ek~wy%THdeI2@&>^H{83pxE-xvs_HBQkGGFt0WOKUcPVy0&E=_Q6Orp
z!bss=Kn<3R?<VenT~{BnN+Mz<tGTvwEhnli1WgR?T5?~bnB|lC;TZC*I4`l96Po;1
z%OCzW$_gzrW_qv4ijB&2y6t2+;DF6Z*fG5am=S6<i**%who}TpCfkpaD^vv5ViS^q
zkCb>uq3XGRdLHSCL3DJD-{|02PEPXlE5@y=ZV+F-lFTHv#x!|Zp?sLFs!0!*lf_hs
zg@6EMhEU@<RA*$4MO|rycC=8%Qmt3^l{yQ4^LIjuIa<U7BOKKjg0v#Mh)Ymw3j)bB
z`)&%{JI|k^ypuQnajAx<>a&)wkw~q`hS7Han@#0^Mr9T?F68_o{@Tsq#s}$F@LS0m
zm}47>x40_RhOyT6WjlTFlu&7^Vn_MqxZj!F>8a8y4D)$5p3c>L7R(8L{>-S%c)rey
zQ2|%rO-5ifox%gncP8X0KM-y|l;mGoL}jwcfvEA4c~~v8U6~^+Oft9A+Ixb7g=Sp0
z<rNcunBG|_{9erzL2k)Ly1o&CmU?$7@o<pT(@5_d6{)H*q*Og86-$u#9BNPu{;;7^
zqI|{1)!wqg_|bCr!Eoz(2CPE;9YoeaVE7u7QCk$T=T4f<hE|1xY*9z3?FbAmbuN8L
zV#yS>Orzs#pmxIm+UJ*2`rGG3#hP!mb?xqdu%+>Li5B}7;FS2AQqdWq*W`hE1aHEO
zCA)_QI{8N9FtVpr%FyE_vI=n%my2<xN~@Zo@q*US4l}HqBHYIp*_@ymWI<XAyt3f3
ztEtIqwAk>WK*Dh@dNxrfa}oeIz-*;LQ!)8mcr~z}$0(ib<^X}bn;d0ti#L)Lj#i|9
zJaTq%0RwFGs_>J^O{J!R`22H1icL$aJOQthtxn3bmJUUkXg%9M3Dr^YlN#b_qr^w_
zR1)JJ=AwnKxw^(kheVg#O>}spt;amZZODcp4uA$tvFR$nlwqS(M9bq>d&#z@@vL=#
z1ZRgGQI*f?Mvnwy*a($!BTUk`i=Zoi*6z@r#@vUJ!^X`F^Y+8cM@W4?Jz=f&b6U^C
z%CZ7`uc}&OO=Y}M{ROFMzZwgY8!r3pA?f`yW_*TB7?zwvMy9wgE9D+?yPDr-8cU+3
zax3N4#Um-Yrik|MKzs=T=g$Q2a#Bfca>DSm$i=8KfF55~)_1V;u3FyJ$XzXed?8*(
z2-?wfa?e%sYRbCzZP-{sB0jX^iyH%LkEM(y3m%>Hy;$=SAoR0Lp&ZTDra@>EMQL4}
zo8Q$j*L-YgeJ#lM%lc)~4Ly9guG#ixX6lqOzBHe8FC{iEt{>7thOl86+%e(#UTCWu
z1%xSTkRmqFF-D~VoI!DfPoq(PtlIb=*?piE?znD|L~ySnzfRzc^LS&icTNhEOh#5F
z*UB4zIDYj~tgFI;ex?mfTFs}%IK?WV6?mrjDToj6l^DjOiFt@{I6_#G=M{PqL{}LJ
zNQ96#1bugplMCT+1c8??>T0=pX;n{kdWeEWka0+|RF~}pgthh<)=r0i7T*=I5iLQV
z+8iPcyB?#`kXdXY8{J??K~7=v`slg)O)ff=tku)q3cn~c5F)J90;aE6j=BD7?RJv4
zdxx*xNf921?`Vh6uf(M%ZFT}8knh9YMD8cZR&{fLdl;*2!LLPw=WUA?4Esw9MqS70
z9V2cBmJYTQTLiW3bu`s~a_FO{bh!Tsq4l2-TK@^5_0J2T6(?kW2s&1B`f>>)@h1Rv
z)F8ANk8vKsyKDKgD$=9ODrSK3WsbvgS~GsR>n)1Tah#=YcgxF~*dbU!QYx^53F(m{
z$0?lJbldzVZrFd~hW#gQ*ni@N{j9iQ$$oWN8NnK|14_lJqESzO*jrGhqu2+}Zk7~P
zFbnt)CF-j-0joV{tbj^1Baf2nbT(1pNdhaAa|C!(DM)E`xuzymOtLP*VlbMih9RL|
z5gqaKVl4}cu$1X6m+g1g1;Pv2Q&i?AI&6%nVm*o>qSYrF=P{%4EcJV@yG^*@xnNJ3
zDq?Zw>bnqvWA|l$ptGoA<Wa_O;o+P2sul??bKd7yQAn}0b^P>?Vyj>NJ+2v9E?}a@
zRux55K1%BdvAC3&C98#pM&9n*lGQF*=LRx?R3Ej!P-jT~?F-w9w2iYool=2zy>M(=
zdCrXvl@Cg@C~QD;EX0-?DxRtcGlJ1xW`?dDkDK@sHGaT<XX*JHP#w+(U2`lBl$^p!
z(WONUL-DoD-LHN8it6bVFC(t=EEPu&>b<GYqZWfdlF0K@DL3^TF2jno;j=z#81?B)
ztffhaag8eeXru*gcZb88%4G<}x>AxK_1Cho;TbF`qw6SRV<*{w(!8_$sQa(IfBjeY
z|9kVxzi&u?-qOy_&ODzcW(e@rbc~ijJZdGZWF5Rbd?9BIFOXNBW#I_%3=hzaWT5rf
zkyP4@^J$n=5ob1FtLM_*u@l+mSp?s17q7<2>I)=Z*Tt;9Mm|IabNaJe{@d1dfC>yf
zaUJ#kS`PdI%PQ?oyq_WF6yB_?lIUQ0$p;a*eXopvhjg8tA;BQ|IBC6fdV}j#D?8gf
zbD@c3P;#POT4iPftpKxjCI}>3H50g2<_t5FEl3_G-#0$eQS88<j$hl!<1g|1N7}-;
zKnaT8Y=Igm(?xmJ!o!c?qTWfi{%fx#gKPhKtApR25VVt=;$I)}y^lVUQ9GKf%wnS>
zPfhNBOZ4rJGN<_LmF@>5<LOHuT@~}A3?ItR^6L)`|G(e5|M{W)dBgo@mJxwoM*n%k
zJ^#V|uCowp8*)^`GJI~i++yHXzg0!0_OyVwYt1L^(b9v(P>;crV(2uv??oHlN&fQc
z^-+KS#qPm#0km||{ZM~B+&w=2=GD>D#Eq?g-T0`7u39a>@LOBS*UbDwMK|2ysPf3(
z+-&gvIRdg<t!y@PYVPt^8c~m@WrNGY2_9t<j~50;LaL6)`*A3wm+n#^N6@S@T^q-A
zHTqZ==DSAYVj-1mlNUGcxtk0ZhFkH4`{7XD4}lerzh}qD={-K&-P`{G{P-}PU+IH?
z-NQpSs*|sONVdNGyz#?|DfmyrH0+~yPQ&it<A*GTlfBm!Tt4jUN6NOB>j72j?(k*a
z4~IAND;Q{woYc`to)wLTmZB`*x9p@gN~1xk^&>SVON;#ED>Uv;`uUg#pb|&J03>Mr
zk@1tI>m8Rmw-OX`<x@JhO1Puq{0)tNvsS#zsuEf|7iLZfm518CSS@vVR#=!W7y~*f
zX2$Wr{;u;-wTlK8S&AM2@iJy@Yqw|l<t4>P6mf$v;sYQ#WDTvz-(;iwst`$Ct;WzY
zoHCFuCH*mshG8`!HrV1ybmgxg+<`f`$>}R?DGeZl6aDE%v=+F{>7ap#3mz?hfNk?^
z!k9zJH!F+LLIj3&r2yN4Ln)byOr(l;+ubKK9i2q0P=IInAp~dlCqryale%&W^9*vn
zTMv&(HxZdvY$hi+)9hH+@H$gHn<+B}9SIA^bWEZs7Z+~pQS{LYOk1f&yrGG7Vhod-
z73oafCo~RB3U70QX7C*&ccZ<3K9!?m6n!b?qP{}mZr$&zNZMyU7=PZ{?oatq{97<D
zX$h>h$oGQlCop^E++2_p^RM#kZDi*wuk(vJOV;POWt?0piHQ<o?nuEgfpl@MdV>KR
zl4dBA(#d-K@Ero>yBwD4yG0EnQ@VcH+GOTwd$M@HO?l9VZ$uv4zA?ssCYc8Ltaz_p
z9`-MbceO5-!wHo0vjs0snu~aR5Wkj}Zz5AcM2qh5`K5kUW&2V7zj{sF_DSnyNa8!o
z_(1^ajL;lv_ehJ$#m5iZ9ThsocDQ`KL}qLQ=td^h@xv`CvKOwOt!IUP^BcAQu6JE*
z-|xewfGdwMta9-&!K!(G=cbziu>DMqg1lKTMwf}Q5pmu$euW;oD!1l7<Z~avAREVc
zL<C($$=79;&KL+STfT6Ia4z}Uu!Y&BMU;lekM-^vXyPJ+$R1EF^?h}`U``KK7$prU
z)0=7Dk(|dN{PE=^ot931Wf6FPy@jtjV1;O$`7utu#=jloaiU3oiv~INLuS&PIyz5h
zO?UXV!;qW+T|lD0V(V^oSbP^cBzw<7i<t$%O7)4zPhluDo7=FhD)ktJgfG(4Tb@_F
zj6}&)%DlN{bfdKo-ECGz%9zIiMnn7%qY59ZiDlx|om7J{GlH+4WyB)s&^az~Ug<1M
zs&erN7PCZMg$t#J48P4ye}KVkZtjTB?RMtc+TU--xb7w;qH9OOBSkEjU8WO86-u;<
z#L|+zD~&5H`6|i+fxz{uT-<4NZ!<2&oo&ZzhReQ2Pp#D+=%|au+H|bt+|Tpz`^mQM
zONr9tm#(SZ7th^kKHfWc;TrOVLFIRbEx9LFpkB@WacG!2!6dp(e_ZNX^VziM*{xTh
zpjF?#VZEwNLAb?yUF^jB`k}BASQg=8n78mMoyEaZMjiRO3XR6@-f{AJMr+343*Yi$
zHu};@bUBxJD?Kj<4KAIUuZr2)_g(*k#%@%g+t+lK8npb7F`Waj{N-Q~RJC84A((hu
zVQaEv)kjew2JZHYe{7!88T0z+dD1EbkJzn3+nkbSI~vzt{8#t2z1%aCQylru>=Iw`
zTvm1Av-Ah(zQ6nW>B0WXz5PM#!1EwAddNcEIw;NR^}0?c^SCG_<+vp><UO`r<BoXq
zTF{OT;b6+Tm%Ms2Pf-rQppEc%Tz%7QGk#TD8u&&we174Me<2UycQ=2JD#S~?aeD{5
z$rj^`=feGfz3ahn)Bay$!*v>Qdp4ErcrL`o%^}GY7jyVMW@*x*kP!whGKV;kIso2x
z8{3T7Lv&C|xdAoGIAwG%Y{w9o5wg>Slll@D^6aL`VM^ms6W_K3em;s7i%sFWrnh`3
zoyQ;PH?J&ue;|59`B7rMJtjo-cta!2b<)RzSc6!rZZT<^FgeQH+PSl_Q1CLV$xg`t
z``Uy@c+PAT8@N<=mJx$Lb<48Qaf01egw)iEz#8=bzCW_=$Ed)J2S9NA&~Y<9y^SB<
zHXbh_*H(P}i~VhV^<Ev64P$!gSb!Vw`6$g5j7=`Ie~Q@;BZl~59&0N^LBi~;!Dp3p
zm3$1ng1ro-__cVt^0B(6-Cpd@RfaF!1-pl5j$jQ~&0PE(RvlB!38Z`Rwyx@jdNlSf
zpF>(a*3Ak$NsM6xNJCP<%fJ-bh}<oZnD*mvGJ9QQ3S_Cs9Pr`*7gNt)L~?%Pm99=C
zI$N`}e~SwZFa=zrH9Hpyb{mV0IZt$^mRC(wGlllbC$@(^=?X^8ud-pLZ&z5KkN;q^
zdp<Opd3fi#Cox6(Vd)h66szn<o!ub>Y!U6zNgbkZ6@%`50K31Cpl^f-!Aw<H>6Hr4
z4pGLCBtrtZU!I7eYa%}epZnZ0V*W+WGVTP?f3Z-fDQc0aZF7(N;)G=~C`rkZ+a7hE
z2Fjz%xqMc*zs9Op>5IczdhH06?~@C<{%>U>+yxB4)0fJ%zr<DUWCrzpQ+gZ(*)D{P
z+o8Yq4l&#7iMZqo3mGm$bS}KLvq>gk85}i=6+@9!tFcJnULUKs-4k&}?`SN@w=LYv
ze_af2yDDm|dgZ~-CXJk56)0hoCNsCx#W>Nz?l65w?PD2>o7x-NH#Me4Lk>J``azql
zE!EH2kt5J%)z_1}fOEL}W%BjO$zk$!24_{Xw{G%xmR|N$2$@vwd(T<cOE9>}HI6@K
zg=90Nvs#zmw(gDX7iFzH0tnat@iNCDe}rYIoNf$vlQ^D*ie;+=4=$&kQMaC5C!?(p
zmiB}a<l3}!lBS66IvOTC_^9!TH|C#+k==1QOm8X~rjibIPTpsS&U0R^b?49ibe3J@
z-^C}k_W|sF?=CmZD%Sc_T?DtCG!x~b<5Uyz)wE5ap?=g5eGls3ibQ#s0(t=Uf84}m
zqTH-iqd*Ics<If^%F<$aw)V7geNY{_)fIx{ZLk*(y51vk<Fa$Ac}^ILSX45{unNYM
z!+fMKr9>zG-b~IzHh~~=VgCfF7S*LCnPaYi3=vf`#4{aPzP-SA;47fW%yoTLc|8xL
z&(Jpn*f6)8>HF?-H6>`x!CgL)f3Itu+OhPJ-gcamvvdZgp;N36Hc>D~2`wZkz_NWa
zIbW)nz4o|A1MbJCxvC`PrC}0BqDefbV|cWx5(9$cFq58cw?vQ>*Bs#0tbplmc}i|P
zv*NpaEP0yZ`h0X>@kq@9eh_F`hp2F%ENP`{!(6W`B7W*oQVlc~8DECKf9p3(S1F=$
z!H~>gJdBn~6F64e));!{FUrH+lfAEfh9eo=K++|4l8bayW&?#K#kxchh#ua+$iNoa
z%O@<Fmc$@(!_0}=$~~OY^VIUzxa7>t-V>oyGpf;VY&RsL-2~Oz=2yiK*}1G9#hO?{
zxj3EnewLx;R+mB4Bbw1le_y0jU^+m^2w7t~uag;?9KU6@G}}zu<@QKUU;HIQC9iU=
zY?aTmu>eHiH(4p<b);wc$gR2VL+UdwsM^S+F&XYa%da=$SO(&T0^pwqpadpzA=ym3
zH5M4BIo7Zl+<pv@5F9jW`%1QSi7<R(H*@qD8!Li^l@_@d1vdyOf9eD|4+(;r0&l6}
z@lxs!;5N$?X^f(p78;$(Y9OE6vdzuBI+D#zhMtuIOKaX}?HltVeeEtK#Y;dlP4sI9
z*P0X>tM9YDDSKx_5Xv!FevM~T$t3PhNZgbv^U!$<qbD?<4O-7QJCspH)n>bL&a`9B
zhE`BCfLweXdX+uYf3^`kE`!TyQj>f1G4%;RSXAOVkj0frTA#xE4b9l<Z@LJmh1vMU
zXc!@VD}o@s|MY6kG(E?zKJk(u^JPNaS^}sQW>jakJadAfLCG>{h57GsW<947UGHI-
zj_RDOHTG;>UERve06??6di6=WKLdS6pKfkCrW11VBnPFKf5zz~RjSsQ*<SLE;HAR#
zP3UY1*j6vUyjmq|3*?p)U3g=7)hnaX{I#JPGKB)LtvMDotc8wFAImMXiV!Z`f;98V
z#mtGZv&A_)I!zrl>=0o^qA!xB<=k}z9YViw8*_xX48vLj%So9dRb2q!#7MDS<GmjK
zq5$yyxOi)Ke@0kC<H=eSl0R;gVN<Y>RF0(ZO#B+95!`R?=f(?7?Ma9sHYchjajr(!
zh!|&h%M@EQBo+f<JuVoA?U%yMYh273oXrVXwvh5uKYs~nA7*0_5^=A>bV-Vjx?rrP
z#ycO$Slkgj45#x$L6`1TiKolgyKW(Uj+RO-hDslhf4i8AAyk8NyZ&6&7&ddb)eakR
z%isy+Hid?bk4%ee$Hf*S?^UcEhJXxHg-l7jtt9m44zl48-6Vf4a^mCGj&4Ltu2l}E
zIzqJ4B3`SLtD+=U?tj|{`-T?n*jrs0j)l#?kaN7`sq%MY^&45PkQ&JKs+dMgHhV%`
z29jSff6FiPiE9Wj>3In$ZjqN)zOaIkr=GHKA<kKHSboKl<aGgpTZ2v2EaE8eMU{`!
zFz~v=wpMoFQQyD1!fo4D&oQ-~<b}U5npIS7F{U3=cGUQR+MrE{PuJ6m#hS<-Z98EX
z#e79)<8oJl_>9xo7HbE}#gS<BXN1aPL6v7`f8WV2)K5{lBy)Pcw@jn?Ivt@Sq%BE%
zm04b<RX$C)e!pY&BdL<CU5q4qx3(~g0w1^|$0#JlDhI9eWhDfPnIbfFL<L+iz;Gcj
z9}j$9LRSUn2iK=?kTBMc1Y%${5fIOk+8)?C5-e0)<C1BphghV<T{ISOF~t%k5Rw+U
ze_51EXR;#TVJMO?lTL;eVZ`oBW!+{-KvJKGQmaqGXBr+%zO8Sr;@N>U`#2F6Ei0gR
zy<e0FzU%9E*32u|Q6(hg_*H}tquGXKqW;Qb_$yzDf$sEKQMli}ZQZ-%Kf3e^IIZZ^
zTQy^QCLX{F>wbftj6Ver3k|TqivILGf7PFyc7&h)uozDnW$S+ZtNj}f{+Qjkf2VKU
z?{D;<_}NUt_}#S9@L-gu_PhHhn{nhZ9HSBb13&#2rx*@VNc`U4<zM&_c^)>7iTxW7
z4pFpte(==&KIK32p#*t~1Ho6y5dvIZ+tcHbW8WwPfd8&onC^oWOCvu%$>$Ojf9HNb
zvw!n#?n!cdm1XlX>`}?TqZgje9N!AhhxoI5$^Y;zcm(m7z=Pqly>yfzBRzb1uD^6I
z-M^wY-GLiN1Aw4db}#v#xIJB1YYcz7mTZajEiaOUH$8LcUiyD>VbU@?cLFcgMgNJP
z1+ML2!aQ;OQz-UN2seFF6mKw6f5x67!<Ym7b6$=?GH>x;{BS%et}jMTGQ^JAzcqo^
z(C>Mk+;a&;>+-Zo)@*Vbmp8d3!M>08`gpHWmPbx%)jcYJ-QMVYn*YeKDNSo5EBMu^
za0vGY!ajt1gb0Ign2K7A$AXS45w1?%g)p5=(zp4gdgIeG-nQmJ6l0p&e~+V*G(Nq6
zu16^Qig0VTY;iq`brdr91mEE_%bl*WtI~@k-ZVBh)q|ry%Nhb7U~|*m2#8y)MFd#X
zN#%pRQBI^8CvrWb)z-MJ0Y(SF)t*o%tM;VRyxejv^6E}4Y14Ypd^exupAQ)l%P{|9
zLZAr=7ij7n_Cia|PHaPOf5xLs4xToR9)|9s?E+<u_B6CehgH=#Dh0vfNHwGo>?Gf0
zXYsFm>m_TVc{3_M3^<KPnU*biee}HCNd~q`Uog$*;N|hj?#sRXFX`Ic;tus85Fo&Q
zOO|cmCoOa4BA5%tZKlo8Nx4`{|I0D`9PZcPnv2(@2{#i_?0$S;e<2Zlc&d{PcQk}T
zHrztsFZ}m}h{;J)D5$A%rgQ8SQ<i~dG`lnlKXE@e`d-Z!iNq<to(J!_oc{71G@j$h
zojxA~hbNDzEa7(VzLAzAt8m3@G}jXNApHcS|9fX6cZF{GFZ#Q?Py0vNC8Re;%ezS0
zjoqft-Ge9i1Z>F1f7?|2yezX5JYTbDg&3*yWcPT#52w@Zi_$TU0tpa$`ULp+MI(HV
z9o~``2C976Gf3>d&Q&B?r_hX|_j-+80rQ=^S)42U3>DFvifjra9cO_Ame#I&TK7jI
zNJ|`|-Np-Okn&gCWYLn1gs)QT4N;Izn14fHtA9N!zH2w*e>wvqonS2*3Tqvw#?}g3
zayPWxLtnvFn|6$T-lMgAxcpYW_xX~Dkx&$BS8O@Ny^?akE9R}`c$qRU%IBbRQjpOe
z884B&n<PmphMp#4{ZPq}PLZZMJsgWVc)I82^lIujx!YoOe<EzbeSD@L$4-C5KZeh1
z3>x2Ud#xB+f0P;@LllgaGJp{OjD?LDQR&`m>IsLRLxOt5M<WOsI805MQ(*Wqq`hL8
z$?r!BNPhxHwET1cRLt{yp0uuR&Sp+H))t6&>}JeYMGejE)k{CF_+>5i^^Omqg=5hw
zL+SVhJ1XX)bfOV)$BM7e&Cjjgqh9h_tPjs$Jv(^We++CUx+`T+&12otm;t%d5SVNw
zYG<Rg&;>|!6NSC1no*(>k*ircbf>LB+&`Gt&ocn)hIfa1n9p;~l5kxh6awyLd+9(Q
ztAyqT@^dW2;1}jFSnl^`E~38usGD09zxTYhf6<kZ5q`+pI4$<au8q@w-*auG-;E_p
zM(k{2e@4<&F+H8?5zwHX(pZ!Y6$ne9czr&Nw5=F+A}(R^mb|7OdO`*B#nj11^urYA
zi?Ni}l&BX=r<jGRnB11$UrQ}eR94v0FTL|_{oi}%y&b2~KnGo4x(yd#qft{T8lqz1
zO(*N^{3wF)R-^Y7gJl-A7(>yEDk?|vBrWsve})eVPhN<byptRoaNjZE6y0}#V3x4#
z0BIub_}~QhIvuoN31U)1GmMMmrCte=T0fQ16j4#C(*2TY{L?b-h>%#*FHrNBrlrvH
zGC3_%k{DT<>-VL}K*tq((}X1>vLyBbQPjgg&8*0jxy4kL8})z)Dr!&taQzQZi+=v4
ze?zxngfZgG^6uK&v7Cx~!>pwGU<Z}xP`SBpDE~2f${Q9&S^+0Txy!#*;d;R<A%oB)
zYBEg`n7t{cVytjW=NsJI)U*a+03x0H-n?lmDvOYaO@g*2&U14!)+g0UAP36#kLa!F
zt<6ns=U^#{HY&WkLK4(^^P8J7e_}$#fBSGKZ>JuF1`nNV)O{|>=?63(wIo75&PR!l
zmqqu^DzSZ+qOs#Zrv6ldAbkXBe6MNH$sJ5IqNQwZE(eoFDrb!pqA(C~z58#(UAV#!
zqnm2n#xJv`SHlbzZDAlYr?*#^dH40n*ZVI|4*uBx`ql9XlAruqY!zF+Wb0P6f9la1
z>?EgBmCm~+mR_@kS^a8Pq9g?|uUgX7yc+L5t|LU{{e-90wYT=Lj$#k;?PrzxuQct?
zYOGZYv(is*O@;cY4x$_U&vFh$2Ecbv_EA?z<bb8)Ry|%?Xa1l3Sh+>J<y3(lRv)V8
z2fHwnNj_nb56}H+5+lmH4-{N_e|I}i_U0|eNxXr#9wvF^r#ec~n%|QH^)zcI0bu@o
zwN3WiH&iPY^otx9ahd+ahh@dpBeRT-g@w)i6Q2rMo7HDRcX#PT{Bif?!P6IV9v1F6
z;3#b0egxEg{mugry>|=wtLOVx`qy`Usso_S`SpM9t8{UI)>}w<Te?HUe=Ss#`7AVl
z={`{p>Mwb#XcWOueomOb;1j@XrFcMeL;jf$h_1@&6JnEDIwJq&;AHpd{&P7aJRn<d
zw}S+B`(d%bj(47x_{Cd}i;oGp^}zVIeyStm8(bxSh2FdXCf#zI06v9U3aizo@J6io
zpsw8i{r>?0M$1q6AL{o|f9dt8Jyo}0;*e(&lel~ow`0ZP7dntWekURq7@*kDHy#C{
zMHu88R-Bbe3arc4{+VtmwptHR>-ajaAp*%3u3|R~E?5M6_52j+gq6I=t%nb`NCkZf
z1Kp~`k@WQ?xpjJ1^D&X$|0i$;KlatUA*_QR)>C>SxqUbU(d@-Xf9dwp@+@qX+P89w
z5bgC&UQvDZ7H(mIVvR-=GiJjPdpb8uqR6`WF#JoQ4h2SwzAPU@ME%L*F(nl~l+UXf
z6f5~k5Fu?;tJsP?i@1vVOefjM4*j}&_O@jFpXy9o?A_p2ed>P!!O<qNn)v-b=*@U?
z6{=eKeCXxPk{EzNe~8jh!s=;S2ncVW6~IVQmatYPtwD6Xb~Kloni_qm)t|64DD*IB
zYn(7532PD9z351Z3qW|U<F{HapuLmqB7A*1N|pPX8$_WeG#CB06YP)JI}dQ>&0EfI
z9NZVum{~eRsv*d8Y_ML3Ark2qG7Sf@FPPCCQEu=Wt`BcRf8zXfKHmsDM`i&7a(*pX
zKycZrh6!db#&^0;n>e+cu{8jueV<dtz-PjWRuGay0(+Wlkjysf@$K0p^Pqi98otVB
z!!A%&V|cm~4LSr!qi_VP{XG$vn!mL}Ciam}cw;8@S{y2Ls*w{CY96(hwDMlo!{|?i
zvj<KOHeU(OfBwA_fF5fM^oCEjvyea-owaf>w?sg>qPXo4mnl9%55SW!u(%e^#orjJ
zg1plJSDg14eykyj)AIL<=J5EzpwT#FfFZ+W1O)@p_W1?S0W=2jFS{?E%fQ&acIk97
zjt;-|1DqB?NH^+lZU}__tkS+YzEDv@QV*r{kbt*fe<KIH91^=6zz4q^fI&YJ#LRLD
zz(trP(m6}w=14FCGDGMGLFFZ6q^)XL7#+0^om4S)Lmdv>DWq3;l$I>Pg&)hiHp1d4
zrM2-d5a}4`Gb23qt<A6j`;zIOT0@W7@J?zj1tMlJ7$BCSp-i<e#ds8yDj|=pgmexw
zUzTMjf2kH5LXT&KU<nDyM^1G2DQ;u9GTp&uar2#I<KDxw&$cf<*>F!s#pJSIX}wbQ
zgoG*SUYd`gi>WmLStkeA8n|4XXndW?f8~NFs0hmUNSyGz)<ti*(`lN|m~2m~tfgS3
zkw#}vh`4Gb6wqPG@#7M)cKtJkYDF^*&2pn4f8<8ezbf2b@Y2G+`t$Uxues=2K>?3+
za^+nfqwsVeXctQ_x^3*^#+L4kHkODX(S%4el20=KIjP-_fC_S5+pwKv>pE^C0g&8I
z@*amuKdTapoC#T4!L`@Wcb}kB%|PS95Jsq@z{2$1_RM#*PSST;ugm+h(lWwml3w&<
zf8j=bH==ZEzzYoyy)U{H7Qv#ifRpD}WyQR)f)W<ckb!wY537h&cvhtMKT)2HUqHZW
z8NKAT^VSB!Pd(vz%Z(vP(*KGI0cE`n<86Laj%1Z%l{+9c|0EypI9`o_*7zsB5)1$2
ze*H?VcbSEPUG(ovH^N74DfG{sRU`Gkf9XN#<zx3#;Gg;YM!w6-6{qV?11pv0iW&GF
zYAA)4gl^pSQ}XNs{%H9j#h(7G5cR(PoJBS4x_zOyWw>nZ{*13$dkYus32~Nu{OgYv
zPum?(iyFLc2~LS*gs<HDVZiu09xR?>pu2K{VTRGrD({YGskTyp8wJ$FN`6&Ke}{O9
ziqcxO+&z^G<?&6fc+&&oiQpb`y+1hhIyBLa?~fCLn2UUKmT7?sfX;^^cT!A=f>~I&
zU4sq@tLM=~;wAL&VI5x<*P6c>dh`N(fKrk#4N`zBz7vUc@?s>@$qyBQPJTk4TAvC~
zt+8mb_xvEPz^S#W_%Y-PLug-(e^b-qUQZyrKn=J;j_9QHY2FG$&lMLy0*U-6ljdG+
zmd$nr)*lc>EczJ@)pcO?5iw{hD>%!#<D6AY2j3Onopt}?-~NvQhfV_8Ne0(d1VCM-
zF4rvScHOI8i9hc3dhYLemX4h+9{)wUbbk+eKm-^4H{`l;DSSWS(yMl)f1jKAP*yk&
zcpMhzM$^&HrR=RJophpf-T(8|vA{H>gLbI80u%#;#rJ@6#MFI(9F~aQZdyv+HmWJ5
z!kdHHXTu8MNrcZF0T3wMh1Xn|7LpFNo??`LuP;`tnw@BQ1fasu!vg4QK4Vdwpc-+b
z!*YAQHcI0%tOBde7kbIde`2Iv8?t=D|B=GL62u1PATaXtD08_-KZ0=j`gVumNu|}V
zyw^ZDSygMIdYGOSZ>t)5Si^0C*)GdV9ZTEuuC=f%>Qh62eMli&u}rt{f5*_n$wy*&
zbiO(iE}W)55ayzC6+iFiLqR28^-Q7z2bH=79MVSV-Zvu-^dD&he|m(T9U{R2anqfY
zCxzQ}GJmH=K!52v4Q%R};XvP|X8@(n=92C+nD8gbke`&yzts}kG9SDL{aEW#1T0&<
zmS9VmL339lOsxz_MHvy`IbX*q?2Y2Lnqi_26$72;c1{p`5^m)QHM$gD05rI6<=_c-
zsN~uglO>|AWwHYPe~X-4bMcq*;gS=_9ZR2r$>|74+~K<t(b~(FoTl6IM2o^T1Gc!f
z=pNpd*Cs86#I_#4av!yuJ&&3fb%0w_FeV|KYBG`BoJ;R+0J7>?ZiYyz+g44zdBs|B
zO{7I?o{z%pD#)y%i%Wi3vjXkbd=ZteViRV^Wcggprz?GBf1)@^*UITM>YisYot@Sb
z){r71iGH)1hiZ8-fv-}_5j@y^v9-%<_^Bnvy~rjD<_2#4x2<XlVOs-oE6V}%88NGL
zq%!h4?y08F3eHFqf$7cN!-E(ROMd)q0xN17J&@nSw4cq=>6Nw+1&}Vav?tnD@5mik
zh9~!SN9qS}e}cYi531CJu~qSaBC2wVM=XQZsjK!asq9V*QUT8XjfP|Ub$RK-^z@0Y
z!Eo4IoxAHZbyK2rY*>L%DW3y{eld-V(7_}+iI6Fg6^0t!=b`y{)mt*6cI@AI8Zs;`
zc~YKMhd~&UyALGZ9ho3D1!7zYYp1)q>ibYx2JXVKe_&vHo<=sucfXps+nrGMbq+Vo
z-uBo_&nH59^X&>|=N1Qx_LYdHlF3OTbAo_31~w~!GYb#g8!aqS%e`NN#UzVG$+!hH
zZyCE!0Q^j(VQsMEmJ($^<$6NSyc9z{KgUwgQdnvOO~Kg}vsg2v?z!cVQ=<4lSROZ;
z&ijuuf8H`_C2Sea(Rn%*XvjQUIz;k5ckTIId8S&)6^Z$&<;}*`U==N73DP(OK4I@B
zf-R=?x0_m<vk9!U<{@l4rDH%Et?lKZ3I<LDQ=3{XP)H_(!<`ml|5oQi^;0v<o~kFw
z#11R`R0h&?m&t5WBg<^kU6djHnv1<9vTv6pe`^(_#UNi^X_5Ha-LGy{ib8}*K<)#L
z-5wu1D(ih7p*R}RpDGNORFU>B5H!2;JWUJam}b?%E|+_#Aq_=7ho?0ESW!h8tooqV
zZIhrD!@!XWPNJ_p;aCA~w6x4RHbK6(U_;xF5~tqdBvFy-{sfjC@bcgibAR9(6n@y`
ze{zM~oe%{B$78E{8j~$OI%`fP;8s?o`)JNP+6(Oa;Ay*dD~hK{POvBkF^G2M5)@Zc
zoT+Kzq$2MmPYub#Tbot}YWT$p$RF(pvE!wWf^c0n?+m=L0$$_mVw@54<n__>^<fc%
z#)`~r4Uf3}OSPgdrJwq#n6On#HUCgte~vi4MwNr!&rYlLjMXZ!zAIt15)7kYOwj&W
zMYmi<C8JcsdE})yXJm;?>dU&8P*xDf9Wx`Bx0qS9jCk<LiBhxy3~D-KHn%t^#Pd3E
z(j}rj=ud(z(fyIl&!ed@bmA5gsWJplC;vPIQb}yR8-aKTu858J-!@8WL3@Tre>`PT
zSKA_w*wu5ae@pQ?0#|`bZRN+yt@bh&5Sl*J7j7pTN31Xy{seU6$E>8IKod(O^S>B#
z@Y8y4{tyGL5gL6Zc$97~Z2OmmR)zd!@uT*|s_0ZeX+kXxWmET&g;txD>ELB~tREB0
z(f#<|s8kVr(81I4pB<X2&ME~pfA8mprTW>~8>exnL~C)$NX={_9^g#guq>Gn0?m3P
zrPk&qK>{~7J4iJpav=VVi=hpRA1_QLD+NHR>DB>YyrNde$BQt9N$VN^+r}}A%->iL
zz;6arn+g$g`W?b5XgOhVC=P8hZrE`zZdz`$ltN)KQBxhckfrQ%ZGHmMf8u%#(DG~5
zVbxX@`x@$YkDr-NIHvdJg92&rQ*R9G*Zrb9!Wwx0TpNNRec-)hK%MUFxPSg^C&zd5
zi*A+s*FV`#xe<NfMiD2~?Gpdn7FjZSfTbL#1gWa<M7o+n0#Q=uWID2VqkoQ_AfD?#
z*<Nr=A9`$<UgFLS5omw5e^bL=aE<<gXNGA{|7548iU9LoI~B?lw4V8YfB23`rFY8G
zezyc1@c8K;e_8J4U8VnIyXD9A-kP!kF~^Fs{^a!JU~{YcIeb1-@8PE`W8)M;YDN_R
zpjbcl<|@XM|MJEagPb1xFQx?Ru-|uM4OKhZSo<k#Yh)Y)JiWnhe{&~;<}1#tm8On&
zT2Ox;?av1KzI*xeZ<meieYY#1oktrMehgbyaW%?MJ$D!vx%V@M2U~wTE2PZ8Wj60>
z)zB3inNB`<FXIio`~C$u_kX?}3}buWJtQoBw0->h79JWlkU;hl5VO2H|8s279MV7E
z?r>P|yD`2zfI%3>e+2_Vy4AGjYX?NZNyRj?Qj@%8A)dH)_fZSp0@tcpw0~Owx;6^&
zn|O)e2X9IGPx-e|WAA8x_hdhLb(9?KA3opR+fR=7_uN*U{3SVfd9wfPX!qpc)yw1y
zCY@p+aq8t#yI(d={&KjVJa$iBpM2fm|MvHuAMC$8aX;?8e?C5W^`i1?U*F%@d-d|G
zgQo!0+I_yEuN>_^JviFmJLv<(+r8syN3miTv(b9z_!3F^)fH!;b@KXnzwf5}>gChj
zqrdczUOnGGc6}YZIDCGvcW~0!f4TeQ`TkS))5+26{l?y_7cXQo8-7WmY!pA7QgIO~
zi?hKH{iAF?f6Fs<O>b`cU`9{Xl@P{Q0;uirj_qOB9lTd3`#ZjV`4>wY!+rZQM7nbu
zD`}na%R~ZKsge<+y~Z~OCtpi$SD)1@caM{nJKx9q&)o(khr35^8UJwn>SgQrFUKeQ
zFMfUe^{a3Cm7R8re6)XZ+}c<-x{Y=l%}OVLHEpyTf6_ivEW+<Qm39xF?(Aq0ard=f
z&d#kL$zWD|sMgM}jvS$e1~BE%CBedPpSb-zRe5{9RAjoyE0-nk7pliQn=muFd%18Q
zNT@+qo9Kon?p@@Jnd!QX>c-IkT}LbaeJmg9sJI{Px2P~-oCdx;TvVL%Ngwv3ca-~B
zK*q$+e`3;Io-d1YEGAlIIxlNvs<h&`%MrHV)zP!vmk0la{H6bL_r-pzo&4h;$wqer
z|FO4r_x4`BcK_8EKp(TqzV_XhASFkpx;Z~D_pfn~>OElRHo-~mgg^Z;mczZgY6KNH
zk+=@#w5Idql*>obunDkK)9?EHt&Er%!pU%~f9ZaeypuT3gsJ=t#bp3Ei_<X_M-29r
zT32U_d^A*XEU*fHSuHaP0~}-^g(i*1K5==lyZe+a&Z5B2^5>8ItVFuSefNOlDn3f#
zgVm}LL-znT%e<(IE6FzpFQ2|Rc>bKF9FhocD4+#0?vg(aEVQQr)6ZzHZ?dyyR7cxq
ze=#klA$HSeZW|IUKt-U}S0gWl1U2?@1xliodgqD+SxS*`{|pQriFUNQ+>uP9pK2T=
zR%w*t%2R8Hzj9^#KE|y@s*!I2I8oC7sI`fq07$BtM(iyG*5dN9D6S}aH})r2O4Dkh
zmw8oVnAWSb3QHi_+&ifMvo9bQ$&2ITe?I{=!-<X-Q@9k<i(;XS0)Oh>Kpw=f8NV*I
z(Es#2dFpNnD9jS;%JZ0ywG0Pk=V;5BC0(0)ZSz-!?pBClEr^-VR9ljYs(jHi#U+jy
zV@t4PoiyU6O>bpXQmC3(r@^YtHDR}O^U4Y|U%iE;43Ub&R6srMTJy&mIlQuqf0%;h
z23w+9FT*%~=bp{1`4fpBt3-pY9FE_vgQrWIlMkyK;#jEU?`WM2DL)yLBhC@Bi)J@E
z4Os5oj}e51M{X_?x52a2-8l@MXeQ+Xt(Acz4VBmk98p{Y-f6zI)zj!wsS|$s;+TYa
zOc*C_`K4@dU)Av~5nanZ^-lh{f93A#d*ia}{?m?_l#x<>9Xt|14K%w7jUoj!PWOH7
z>ttV&wZ3g_xxWG1&<+)7Ql3Cdia}BGs4-t2TR4g!f)Iv)wa%Hx&*JVl?QUwg&}1<U
zOGYw!9Cz2`I8D?ZKo%M(hLHWD2_WowPxHAcYlOnu(X-@x$&JUtFcnzje@l@?C3|=2
zXT!(Aliyb#$>#eXPrsF)Ih#K6$i{ehl(_>k{6as}cfVYI)dM5F;~TfG{j*|t)5kR2
zyJtl)YWyGq*3yzW?#@Ws3zlY9xk<t_YfH(j`{P%vd3T-#Hvcvq<wG7*3Jto|*uhS6
zjo?;IO{KjTiG&*1a?S^;e;*$nNix%^+XsQ%FJ>FD1oa5xkSA`YUP4+<Ns0?<UIDPk
zo!l!#guYKjO?=odCVhSwHRSm*V@yxuKfgV_9(REX6Xk@B7Zd1^?o^d-JwS{BEh4Ua
zn?OrwP!wQKT*zZN*`4GoglKmlf{D0r6emAxwO6Tk6ID1OQVx=4f0#SCIP>@IWj43q
zY7eyIze6}S`?w?mgBt0FjktW2MP#!AIl4ubEepPaA7*Kp0}ra9!?$p4Kn~0^CPd&a
zmZzQMS<y)jZyZ06?1U#NV#J*|i-tRm(yG<kr4i$MbfSiA&3)xUH@8tbxm*AU02Mk_
z7IynYqD=E~C5duAe_IfFO^bzaZoZ&!Nns{OLMCrg=6aUXTqR+?QjFdbHQfm+W372O
z%!jBC4#<M!jg!H{;Dz$fQR4YmfE<y*&m_W~irUzT#T>+l#eTE%s|i4o!kDl>7pZG4
zPiIv?xG+d5cwV5Ql7-Uevt;NF$qj8$BFJG)r1&$qH8TdqfBZxZ;Hf(fj?s{~hx%`&
z-9X<~IvKFm$#^keq`nqv@|)z%Vp!l*KFQ#_^H(K@DB2K@sHiahko#O!ZW$8Y-tb#2
z%2|d>1GrFT0`X({l^lGby+&hiF+-VcH{msB)t79IXsPuyn-oHh3)B)-`g{m##T5f0
z)nsQkufIfhf8L%O2GU~oXEXPnB=yaBatYkSHVy7X8*oRk;ll?pl`m39#iPf~Ng?K<
zW^&~y<8gB>)|58ngu!9+OIUkl8eeRsUotqAH)`W}F&<-M4H1PnDfxWltw?qv4<fUU
z;tE_@N{m{a8pZ<hh)F0TYULLJw!v`*Eu;E0vav;Ie+3QqZ?}sz3tWT*(?uVClU}5=
zH;64X6~x%*P!-m3dYPX~$|(>|)MO$pna$Ia3PBK{E3k4YU!rU@9QFZ}CBJy7NYsk(
zDrnYGQnRhs;jJvS6RmK-S~DyM46PA!Qt(mFapPM@ATl8s9s@4&Yr;j|vCwR&Ov?;u
ztL@<Ce?TFTcwi}R%4jX7Ie;i|3)Yu|LZaMEPB`@S^iBbTk6&$2xZZ&x5D$a~1D*Fc
zbtH#rV;hNudDHM}F6@y(!bh`-)9~jSdNEB)!NZi|IE_=#zVyBJtgzBIwzw??XR+9l
z!X|l&%5dIIU(r2{HkYZ3i%RE*EeWTCRn5M`e+u*ot`M!~ulxiwro6WWI;_7Y)F$uc
z<-6!E5A+t@;r?EC|14B?2r23A1j<id>5K#y(I~7_5<pC%JVE-DLoaJ211Y9LF}Qvl
z-<&#*1Deo95{gD4(fj?mlV8u$8SP=Hoqg`#?!qwKCJxs`L;~gp3uSl;GTW&pW>s&3
zfAzE?%F{kKi}o)z<{IE<I>OQ^E#l#J#}1}E9jt9KS`92@bz@C#{xM`Ud3M)6DAvsl
zeoy;YYA3KLF%14#qDel8Xx!FU<yI#?SAY0GU`dvi7RGVPMLj;h%EsxM<{mtxGr_Sl
zyd(fW>8y-Z3fHFS{$4sf5xZX_*p=P7e<8%*>1O%FC|OE=A-$9~c>$g9)-69*@Dp69
zy%_SOBO)W=nv?l81V8}sE@soB%qj<r8Gv8qK-@?w<Ed!{#*hN2=IaAVupWt|#Y;Vf
zkchtoJsO(2Ogc1e_pu;>WI_FKx+WJUR8s|<XWXCX-A?R`_vS}zP0ucEr!qcEe<Dm$
z-rM$fe|lNFxGS&YM4S|ArSR*fyIegGls-L<sN6A?FK%HVel$X}{?_qMnTD_7Cj4o3
zNyHAyP1sVRlFoc8v=c4U^TMvcx%`VTr~t^q`g%RB$4Yc!T3I>4(~1<lQY4Y{+^Fc3
zxU0{3>As7LpwjaNUc5v&p1n#se{Xo;q06hT!Vw9anhZq$oqIE=*t%v_Zc`PCddU+i
z1@f&MlL`gPpN_NCtj_r=VGP#07=g(f6izBS2zQJ&Bx2FhSWR1&hpVxoeUK-p8Hlpv
z7S8E(66a@X7GDnzoCFMBhe-3x#bVTPV$*dtgZ+dG-og-7-0;5mRks^Ef4#b2I_9c-
z8|)o*`fS8HU3g7@p(iJwymeyq)}KE;e6jtPugk+H+E=V%nVwHR%-V<}&@HYjnSvSs
zXdciYiz~<71Zjse#<HD_3P5@}E~^}fHXTt)zY{rw`O<D^+02ULrIA36V``>l9h*<*
zo-7?|0&!9Vj6g>0?u?slfA+k{ReDo{*`=c>O`o|f1`yKJa46Q`O2<y$Q#htb>9eK-
zYD3}&$E+(~s9O;M>~3!;ZZ=tp5woFHsx4Z~Kl505VdFJ>R<E(I0TH5<HC1J7s(N;Y
zF<jeyrVR}XcR+}jFR<n-)x>%2qeZEXFWJLb`=d^Bv6vAHAzF@Jf5QVM7`g)C$LyN(
z3#bbk=?S6kCRRg%2pUpOGuGy+YY`+eVkC<^rV>|IJ`&utRrd25AXZs5g$Z4F$;vLt
z#@z+e<Ybxt>mXkZkEQx!4uJv|H^O1~6(x2(VptQ1<jdOOf6~$_T8fsfLP|9yscIu~
zS5M7mL|&`^zP>_&f47Q?G$j^9G)oxfbD;p=Zc#yzqlU@?3_Z){iy0w6IC@y@OD9Sb
zn9*ra2nC_-=!X4?U<VP=kT<B_H3W8q1G>tF3jiil513__3vau19BIL3=h@_3e@O+n
z5nT(cYcBy-S|f}Ft;!%p$ViPGJ<GQnd>&y4$G9yRVuK<Je<CQ+DiKL0MVN8Nzv%gA
z`6i!Efh}d6zuN7OxB(h+10>5gK)s81-2{#LO_03jO;GKyvHC{%DY@XhM#Mi8H>@qB
zamB{!b^c)P*jVmMxMS_C8i&+ZSDbe+yiSt62fwV%A@I${65mXg_-5_n_58E3mVYL<
z^Uozx)(h!fe|$7CK3Z$w7OGsc*h-+)HIFP&A|iV?p}H!#&7<`FJcaTtwN-u_n)^+1
z{Cu|&^e2xi>gb)pKf&E31jf80#l%f7XIUo7V9PaAwk1<rppo-2eClag=2o{y_HPDf
z5nz?`vRq^;ej~*&rN@4_2nq@z(~Ul+jxS?(#Y}VJf4xmQJjVvz7jR)Y=6;z`OR|vz
zork)h*Ppf@ZG9>s5E!2Ndl1;;#uXe{`GmfIxSHp)!tH<N2)~%qneAwVVBB=B;d@Mh
zCX?iwjF&<H;RN+?UC9<@VI<bX=o(u1XyH9|x`rtd`Ns6FW#75GA<rgO8K7#kI>1u8
zKJsFgf6p~`Qy^V0E;2(D7Eh0sYtc6|-39s^vE7$US`j2Vo{3@Znt*%CKDv?3FIoM^
zRM>n52Ocg<!lcbEaf2#Ut>m*oMO3x5I43l%R|VZ5fpbL<n4~KPaP4yplY1f5Vs(`A
z@z@b4Eno21%85UacT&c`q~~u4sV5++Zt!nef0;^NVX;zK`m@EQzCA<HGmU^zKqjXo
zQngMF?<cK8TY&p*#5T|lCNT-r3k_$Bv!7SUTf@?#QHKqOz3cEn)cOP0`q%m8Ro5?g
z+!PYg7?;Q8(nWWQ_PIoz;B_}3M=a!oir;p)9ksvh+JE7Ou^6xJL2YgThnHer(udpV
ze@ZuO_hHoTL)Y%};`)|GQRQ!py<FX*n2`kk?nVe(!9tSf<Tty<Z^&-ia^&5=fOh9}
zb@8s_q)?Wy6UGxKwnit;UDfD#M|PJRDz9r1jfVzkhV5B?901R-yvxrYeHJ}`xcvOn
zZF?Sbcj2pHsH2q0ZJV3kG=uU{f}UvHf33pULQH@P3&Ey?#(H5KvMS(OZ`~c<iTMKU
zKT`e~HdsfC?tYph_8M()N}HRE!uU;cI4dxu*KwcWk$m7!t)~^6FZggT!8TqNJmeyE
zGYqf3lGQ>};a;IIM$@DgYI38<CYO#NvYC!GM1*0i5;PW#HwqZTc-_~3EyP;Lf4P^o
zFYYGNMOT&M)_ECh`@=4VUnNK3JWg4;aPk2s5boQ%PfbpU<bXtXcshh@n@f58YA@Lq
zo9e-V7^-qIg=Dw%u?Y-_;$_9NH5bEvD1^l{lW+mcUEwxpaXvQ%$}yZtX7xK!_zIxv
z$u4er3qf}p*J1?i%<wIhPm7Aef3;f7$3+=kG_Aw??O1FO)b{ao4yle`Am_O|bToXC
ze+RZs^D6!6H1f^x0gSijaxF*qo&aWQ{){ey9309ya{?Loi<@_Gdf~Xs<ZV7HCR`{L
zCG*PmAh;4+L)KJT{aLnrTo;ZctgMFwQwCa$f)+JiO*S1ZI{}{f!W5;0f8N0ep^6kJ
z>n8&V+wcDQRz>jJqa}&XDbbFBk?3n8l?VBN;`KD0UkR`Ei%Zyf3D0J?-WHD{OFqh6
z5F$X)2yh1PU`;Hf%{bl55!;xp3UmP(j4;Qq{Ew&p*GjmjBUZi9PS>^U-iIBcKlP9L
zsXppMc5KTXRxIWtf6dTve-S?LbmoKQW%6UEX9G=EriQpdyoNHACblZ}sEG*1)ft+D
zVY@Tr1<eq=I^+F-09CclS7cq2daC(czSs_~lzo7^>`2AC^ZCETGy|TgAyqq(BU*n7
zgb-yO-DZwwy602R-UJ2y+txk7Z`W~mb#QG4j#xlf>z=l}{F?qFe<4S#uy1r%!*1R2
z#XTzev)8Gd>e)iM+tWJctF7wUEFU7;;hslmWx0&fk4s)?I}YR)yR+^X<1}$Oj@1kW
zIV;OR5N@TPFfYe`sHUw~G&^MOc8A%xXvYOknd(5aUO_PSd_@i*Gz7}IAO&|6$}0-N
zODQsyo<xLeC#`6We+k&D#lzalkLsFMMfagR@0B_yVdKnH)ff>!u0?TTU{=I>X&nfc
zB8~t<*weXs^MMuS11SDlz!YclBP$Nr=#*v}jdyWbJz~0i(cN4rHREYeE8^BORw^ZT
zGXFMsp}V$*$-ui9zre_mdH1E{^Kc?uOVq_GS*)VkwVW~(f5(&?TcVofFelkqV~i0Z
z|FwA1S*;AvXDr2gP*2^ksY~3`=vJz5OqBuAkV>UPU0}^Wi}GnUH#uz7;7-qaDE`3^
z_SqQ6JlJL8VXK-W;dfr$lj-(Q0>nyuYwEbHi!Scw=F(dGY5}%nGz06hk&Cil1^tcp
zZ^?W>BVethf9#_k(B-n}JgQkz-J~e<F`t|j-}R)5fg}!KV8+w+bqlwE=hgK*X4qnA
zBRGj8Kl;*`y_CpwUD$Hf3Xp5@4&ZSsTT3X%ges=)p1pRQLF(e*LRQBAVaG^wI+xFq
z-=o^G@!c_>WZl`xzMC%{o3Mt+M$OA$m#09YzHc%fe}BUMIZlbrIX)*<Dz`;>C!OEE
z5IjJVC?NPm{-xTguyp`^C<n6A1h?#z>N~>SnN%|LoXN~D;nvo(W79m!EG9<>74VLT
zYvh*2QZj`1yAzR>S2hET^nH(kj{ZFk!tK(*itc9%w{#S>mB;YtX|S<%f9xpgopQej
zgI=sue`!%{uVk2jGzU||c7e*xm!>Sq&CGTy1dUj|pc^YqHIaPP`aEsdy#FH(7w~2X
zDFoDu)N6NPbEVlzXT_%23pzAe7^@*F?yfTwM`Dsdjq$EOwqN@~+A(l{ECHU@MZj>9
z$LZ`%HYdWt$~pp0D1qX;Ri<gVb)9bCzkmP1e*^bFZAmw=IN-2^FG7Rfg^`ClyT(*`
z_P_GgyMGkt5!SMbRNdi<%Wa(NA$(>>kOv?79Qe#$G1Oa=NmS&e4?c!5Z{c%;S@@^R
zK%a-6Z&ry%@-eJL&UIRb;<X4HDuoq((jDfPxhj(k8MAV_r1H(pf9YD$&m}n?8Sw%b
zfBr8^BL0KzhmSt~WFUOaw;`-iQiiQ|))~`?DRzjaXQeu&<UOA{HQG`MQeWUN8#diJ
zawi&mO}7vS6V>b!L{CDMv)L$bv&Ff~<S<y}NaiVB%kN<4lR<ilv`3)RES*)jtL&81
z8gYQ-WPQWRv|u?xw!;E>Lhi2yYxj(9f5JJf?yMVSG?9#mBeN`wyq6q~5I1U5M{(G>
z-X73r9VZI=0|rt0+r!R`+}qtm>lyjf9*P_DIb=GPkfq$bf*7{&bkNZV+Jc1~Q`q{u
zw9To#OJnY*x?QO|JH>Sgvx&Q+Neuc1Pm7!O+T($7QERe_AcflHX&PEJz^iODe;p((
z*A!#L2VdudWXt_0bGrPXU8f#;tuS)3LV@RYD|U{1g4d)QG$<3c@sXPKt~GE^ltb)o
z*ddGzyD66<Jh!yo=+$1UJJoSbD+nuWA{||Nx0S4wjgaf_ke-bCdb04kZY7;)(V@_r
zOeihTfD)F{C9eveH&i%jyt*@^f6ITQFvnCdRafM=+xmAZOf(D-%=0TRLO5D3re$ye
zsk1Av9LXN4>?_utmCLhP)U9}+Q9YW}>gIr0#)x<1TF?=RhWx1GBdopP<XL<*P324~
z^aa*nW09<OB?(4u%(5;Uv4ab_Ok+iyWKz7f_?@olc}M|}jGVOwilLb$f7U7&Vxtw)
zn9w6RVNfeB-raadDhg?kij>^ahzab-OiIzhu&a%fp_Q@+v!N<zutP7VLuzQqVGRDq
zim)Q;CYTY$z(mW+GmrtelEJbNiD|a*;tVQpyzz#i1>*6ItT??bKRtvHSblt5=FqL_
zv9AbRerQ!;wa8DH2NsL`f0e8i69PRToa^b+KD|MG&4G>pWV|87&SY24V0*b{YGlv!
z6OM|m`wBn&euv&4!GtuIE(r*3AlAHuro^R;G$;mfjg~&@SVVbcYkl;T7=>*M*l`2`
zDOI-0;3|`ZXdwsnZlG{iS)Av=A(AdNAW?3!lvRMk!msF@243)Oe{Ww89bp*zwZ3_5
z#o7{oR4RH8L(!DJ;p7&oSEl?L?3*md(g5ys3Il$0seu1G6ySGtUh$*|SoCgF<(<r#
z6tbTemtb^~7;>XdHe2n=#)#D^hCz{;Ait&(_KduXN}z$%M~i>1t&0W3l^*{@99VND
z_1V}LCp*hV0TIm8f2_M+HRdr<ygDE5e-ndhg~A>3mQ|c$Lo16+`7=36&r1JSSVAY{
z{uw3Q0yVgcKBwo;M_EJ*Bp3PESKtW5`Z0u6A-rsfX0>JrnB$glM&r1*6DG3a1bs(X
z>&vKBNpR%TzSQ-N`xO593H+B~p{W-#8-NA7SuM6+@SPE@e@5~6CYxPC;3ZfH8}f<G
z>E)%g)|_P{$KJD@L}6W;jZe)&sGw4O?yfxeH&NhZF^|Ap&g{6V>1V#KFYhU^2H!e1
zBtTUbWA@DzZ7HbPGop0$9x-Ou__iN?TWJof<HJi=M4N%%p3O9;AJY6#b(VQPs{$(E
zM1{K8#n`Pqe~lnrAG$*+FUrHUi%!yNA28vwFOTFt(}=)R_q&t}M>o}PHOUisjq)JA
z4_m-%I=^YVF{nz&R6p61*9Q_uC6)HBCl#<B6jvA6jasY}wm0&C*aB>n9{D>M{Rv1^
zO0~X<=Uz(qq8_IEPW<rmim|wW>z2?pr$8AGDXSqEf9}GnfN~`seB5V9biW+F3Fsyr
zn=c`UP$D`;T}+`ZKslPR;+{njAW_Dr-5|k+`AO&QMsUYkKb4?>QhD?ddfqyIn~mlo
zS~9O0N6rnt$KvcT+vVp7Na#>*;wKdsFd{4Ie!Mfs>yolPVRyLzU2R7_!y2DTtakoz
zEeIOie+tH~N0dq##qWXp%PrQ#@j-a9CvYAT<lT`V*lQ-Cs3hknNJGL81mJ+KeiK3o
zgv-d$fpLZ49FQA(jlHW3q9u_soM0X~7Hx`dJG;sc6&2RqD<Nev=%;ReXA)QkA<4<}
zF*g87hQ*4BwmN(_pJ;kit+`P=ccE7WnbNCEf7hK+!r2&9grqX5#Cv+Ew`-J;Tuad1
z?&}SVWakRtKs|cuy27<crCNVf59O6NFXA|3B#xY;3Y+Q3;sV6&@c(P?TbJ87vNV4i
zPf<-dEP?}oy7@A+B{wC}GHqShBxOej)BzNM0$CP-f>8h|w(W>{h<$*4mwl6clFjcs
zf9GUo;X+Ze+%dCl$4rZ;s=Q~OJlF3SLe4-Ca#BOcnO0+A%ef=drLlhbSjD9uE4$CM
zRiK!pg03+~O)~fu8TH4$gwEoxYxc8Dq+4?H$`F<SdKumeW{z_Q4~94=+?N&ifJV(7
z&0wOxo(}+J{W4g++rP`oZQwGBF9xV$f4%FYm`k_s+Jkqv2E=(NT7KE(ZgaUl%(7}v
zC-Sg09&Xo((Gdeb_!6yc{cah+EV;R&1oDIW%UBTCsIGTZ`rR&LDckX7S5&v~z|v0W
zCI{kk&@Ng;4|r4_g+<^GJR7CGGrGqtL#I71;9iR@@Z-@_ZwSB}fvsr(#HQh7e?><S
zj?Oap13bDRYL(}6$5v)NKyAr+5)+PZRbC1oW6z%JCpt3H%L*DvvRb#G%(*DAGo-(9
z+o^pbTzSQ*NQ@@LSar1aHnAZ92lR5ByZdH7rq4E}5^Z~uCN4}p{T6ql+h~qOw5fxQ
z+QRx%5dpY1N6Dn3R_;_<f#_wZK4!UDTz^ty5j<Zm>p%$y9iiJ4U|5>!!EoUIIh|%e
z^E2c>E<)G|Vv|+Kagn-_POake0CN{t1sjS29iTv&b}i)x6y6PC6|k5IFx<U_<zLBF
z89>M`QnA__9Qi`4jU;QGwi-$I(atLh*{^no*_&5(M!K%schHx|j&4(N>&u7k`hVW|
zkI+!?)X1`y`?yObX9&J?e7Z*^=r8u4yrnYT<w7RTx64~r5S})7Z6;6X037=wg1sW^
z=m&6=%@*_}?Ue;qUzqnk??hjB{MQw}*O0(9JfoML6}aKc$e8R|^>aXImUVV6NxI!G
zBgIP`c6oGzCJU_&;)yl6s<vK5uYbkzAG`kUJbUqY@BW5thmGj@<K5$3!0C2g9zMOl
zF_CR9S_1tO>bBEtl>PPg=XYAS@3d~UZtr}0@9rJH5?`0)5I*tu-9?9f#nm5uzkkqq
zwy!w$_cvzKxxELVA^&)WQ1O*3Aihs>aJ(i<Ib&XUNgGGt9d^yvZZF>lgMT>6n#Fk&
zoApN2bkjGDU3Cw;>TnKryRyl3CoL`2!BMjMfIUcBuNLa4g&FuU0>1MA-a)b>N2A{U
zmc7x__-NLIn0Cva0BJryI(pWn%W^Rm#EDgOfqVi%C>+mlSpv7yaTl8CTe7SBs7!px
z%<IIb7+9#9966$Yu2NhDpMQNr^b6iPSXOaoGVgJrp9<M#*PBwxeYI21&(|$L_?0yG
z?D{)kmy?H=NX(lwd&vg8tbF1Jpuh}U<=OW9d|U0Vtx0)1`8CP2HygH06&&`Shz%N8
z$08z@jWXBoKGQ$V&%2JxDj2}ySW(A;5FA96EEQn-N*5F$*7CJ%$A9$`(};PS=4&U%
zy@C!iO10(t&|cGtlld5plSzu36L3!5YAv}To=S)kIuL*AY3nycF66z$Zz5ZE1W&)7
z*0Ctghm(BA3v|MBvh$g{?4vqhxtk$=l258fu;uD`b&|XPccavECv}EP<Lc|evWSK2
zVl}P$Z%FhXzI@&}*nd6#_Ws7zlM+#69zV}*hFw<KWYGto|3|V}l0m3bcOJ5}dDuZn
zq$NcXu+gSua|~ou&B<jnzvK(vc65lMzuFPSPo;t@3I-9oZvWzlh3}fhxT%tXJ7U5l
zkle)sB}sHVUOu=qENLUwmCvBt1%V(n{`lbN2hk=TWAxqi3xB@wr9AY{lFwWBTAxOn
zH$IJ(=HGTKs~^Ar`J7yoXZ+&^6v)uhPP20=vQ&Ml$i$(B>hXKWBYiL}PN(Sz*jZWm
zDh%S)=dY|M|5iu);Kh%7hezM;J$)KZ_%-GzI_Y8ty|L~hX+7UNPX4oX3#zT?Mu`Fe
z;vA0GIhXxn27i!ru+#oH+No21<2AxOV*25G;kT)tPcPx|F3y?9eW=2mC76_L?fPG?
zUkvF~(rltIbU$U7q4<n(RoI)i9WeRm{STJ(=wGmz!)}u;3pY}@DrEgXdh<ShaqK3k
zbNJ%L@rsQr6R@%T{hEy~-|IiCHhH8e(M|q*zUs0HD}Uxny!(v=wbOVmq|WhE(9%`-
zsn*$SG`yio$fhvY)Abil^|}#g65>NVmp0a~(RjY*qHx1{+wR3D@4t7)^M5-+{QPCu
zm#r55PbOi3r}{2EPuG!Jyt{fo;){?BYF<k88|&2DR+8ny>Fc}4-#72v5eLoyr%oNX
zXwgqDBY%*DYwbPu#`II&pIoyNR=_`dS1>hr?`W&`G5O>ZKIw%=iyPIZ<PqYUnVm^@
z2;JEhdN{~tPONPGlup<8K*rX5n9s`NX*w<k?f^AKVVtbc8uYZ??O{3}ySrstZco#T
z?Ge1drv7cxe9TB*k^1cE|Nq;*WfeTD+|*`_-GADG(Q#{wv95oK&d8$|FAtCQ_YN0N
zip|_2!9JY3J-X(w;GOUzQ~7Qwdkc4Kck13zBiTs0PRs$6d+Q{f>Bc?HMy=kc--W2&
zMX$Qm<JCsh+GHF@j9TqjPFuzFbi1z6&UyJhhbib+ui#P8X!R87fT|DOm{uMv&gk0d
z#D83Rm2N7@5#&vzr1e+dqr=_jW|<GO(sL)PHEp_m@Ke^Caax>oY0MpyF9Yc5u>?ED
zS5U(+O%6jGnSm;bItq*PE;Abx>4%k;)=%%Dfz`i_C>^A)HG{|a+@ImY`E{z!k`1q1
z5(c2$>}}qhq_1x_5+_QI&u`Y@qknS$=zp?oon|xlWb@`>=jr~#Bjm_D#A|rMmiK)g
zPC-tsO#97x^(ditf>lteQ#`bWs!fy-aShuL00mEcO8E4_sbc0HoD!8M+$CygSl0co
zYQ_6+FxtDSg*0n0m0e5zg9{o-RY4M)Vvy!TS6#z$u;Q*8f{6JPCosmJPN5@S5r6$8
z9{pJqqCa9N2ha}S1}ggnzJg*Y<7-FPHoH`#i|VplcQ-Z<l`HvEaT57h{yfj-8OuxR
zr-kxjD?<6hxkQlp)b;8G;7(ZLGaQM><f(Nt)RW>Fs?j(L_4pNw>7r?h{zKAT_E!B9
zVKgQrL`CV$>EIVPl4uHQ(ceDx(0@X`VHSLCoQ{^aI+{@~4w}OE>uhXv9%I#^sTPvR
z9a@0O%3E`1Ys<}CWySD2Hh6S*;zrGTp3xOkan-t^P&+mO(ciM~Dg(W074;mjqySEp
z^ndyG`1rtkQ#YizRQqy2R>R9PHw`+S?=}It<=$@s!rrTeKh5_eGO60aUVpU<;p@#I
zYg8Q0+~P*?xz%LKJczPnxl)Q|?IM7!EQYi%I{A+=d~_eP3=p)90uN-G4r$<JlA2;D
z;fHF5fQKvGz|_x?$*g$u$$+h~1<7xfeeli~9iB^bF^KJgE0SHk%Oc8o$4{;w5=0+9
z-+ihJsd;9rf!Z?Zn`-{W&41x84h9DY7bkwR^Tn-Ox4LyyzWaokp<jHz_uN(c-H*qT
zI*q-L=gA_51u#Y$Do*Iw#cY-#GJByvH*MGG*5-&|{;f+&BaTxW&Bi^FW;CLOK-MRk
zo!g=f?A<IqEu$a?fL}FFr-D~qU3WSY2vzY-QpWZKX2Ftg6I;1K?SFv}pY=D4?bC?E
z!~JMpisF^Fe1$r`3C^C?tI%y1l6UTD-pkV~?sW~OM0`|9r^A!XaYlI|`GpyBV_~9h
zfIx`2y<<KGww4^+OLbYd`e|DP8=zqt-gVkv^)Qyk{8{Nl9AKL<_iHg_>Q68o(LI6<
zUgez19(4&?yX_q<0)NG^o1+6KVcbtPR-0QFZLJ$DMegA~XO_Po=cSW^E}y5P%+=(#
z=#Oe5uW|9$2xJ~>Sf}daX?BV(C9bA#zkm8{=auB)ex(_#9?8~o6~0p7w(?bVU>h|^
zN<XBI$lOo<x=Ai>Bf7gbBst(l#a{nm%=HZ<`p#y}eaCAZNPiX#CvI>!eq2pVQ?jua
zW@961O7c(N?<Rxxp3R4|{79}3a-p)~(ZzY)71ttv_=-zA|H2iw2G^~)P{}`V#s3ux
z9yo>TuD6u<!<U=Q{0moG+grETym@S`m+tlZZ@aRsWOQlY|LJ0;JP3+)B=IS9w14oz
z@9gZ%@=1*eTYtuvF<i?UwU)%B|M=qY`@O@?lfxG;54sJns1U?7_j}fB)r~dmS|6OS
zIi02m9A?@@^$wyhVGA9JueUopKHSeQDFs?)NU1%lMA6xMfm@`;p?Vny@l#UKM*BKw
z))sE93Z#?LwPL!k^V2fUvTcV%+ghyA^(}Lo{fp1;-G923NEVjzzV&$fGq*EtZC~+A
z7L4q*4<anrj-S3hpWQ;la53&v0vD7ug=x>H1Sx<>t=%mv{KefJ)!kIsi$8wur2EzS
zYNiv@zTMkNeh?K>Jo?<TSj+vCr~&)ZwK1EQ)}oWmqC~FRqASCIFpm*koKkMtBQA+}
z`@3(RhkpzZJC%3I1J8mzMbQUIl;7JGd<u9pP5I;FDAa|1W0B49D#2&qz0J7g7iDYf
zXjV+(XKTqf!nRjVE@YZ=alPNEnzyds*49gntXn5EEw0+)uw>U>)d^SVsz&~&GkvUi
z!9SDknffXw%lAi@O^RI`(EfwKQ<ClD*hJo%rGMIw|FCO@>$pfruCZAjXUJrJ^>%#E
zEwWs-73j;GHRLCW@+%<p87C1wn;!RaGR+3eDe&awep4XDN#aO&r(*4(GQl#3`ff*3
zwL0!c_?WbAprK^*c`<Gt&Bas6@T8xKS-KvS`{S}4wR$~9bKI_YiO1Fg)aa)4j=9XT
z1%KCb%=0SUIBNBU7p6${*EFJq%UKn>p-!qrqnJS_WV<)y>cBeS23wM^t=wZ#z{F+x
z!Y)ec1p>Q7$rQ9$v|X*}uH}DQ!{Z<(7THUN3}cWi3_D5p`@O&4|6%v(%e`*hD&OCJ
zVU@lJij5HC@2(B;t|w#UyYvR$yFEq7mw)16((DR16@WT5AFZO!YnN%|$%?H@$JHDF
zyhZE?$ut*IiD<Lr0<GL|o9iz)QJZDV$!vHit`fbpv3=I~jtg5Tk;qUl0^8L9^jE1~
zxM^SyRPm!Lc%3XQIu%CWBMcN+qR^*!8K+@(s1>R?F~z%MOaDijA7d4p2gt#+J%2LK
z!76*fQeYe639Npy1NF>W9)v#O#J;kt2nR`ctFG5cjmlnE%pTrPd`e_Uax63AnInc|
zHkt%k4DVib;Z>k<i8aQou#40KMo}L~iLSf2jB;BpW*{^|ii(1%d7(1K?vy^b&t?PB
z;F3N%0_h+I$xK&mYpa~~i}`HZ{eR=O6;pv0-U$)r74FsfL^hp?AQFBmA9>j3bOQ3)
zk47&_I`53nt;HNS`t3q<I~*i5ZKRlyR@@2;hRzx)U{q0Q2RsFWovumDqxPDM<{z6k
z((tCq9yf8`>xK+e$BulWl2xRX)m^w7JxNADV>*cwmabL*{*l^sQLJbEihpyW>+ADs
zcC{7y=Lij{+G)#(TWeOKE@CaU*Mmnw$g;W`%4tQA@*4G#fK7FS%>Gq59}Mz04?15t
zsy<JL9lYZA54uqhWL$YPjCuZU@sO;h!)iLAnhvU|Hd4l|yxgzVDnW!!LLL_*hOvuH
z*C+UxkC_Nn4dF;OCg@BdoPQZkBQ+l*8M2>Ll6q3G59!P_8xmqqBo;A>ZB3^=gsS#%
z+9WvtRwsTI;`3WJ3LB!v7RgBa6|``_A71Wz9KR*x_rPYUZmY5f<PZzVV)9pkQo^<X
zc9L>&#<B@wUpwG8>6Tw}Fh1@0FIOCnhJt#nzAMGf*v{QhwvkQ8F@N^GC@E7lKm8XS
z$C)bU)}gr~kE7pipcc#7RQKrZZGobftQVgot3ysLVmpc`je<F462s{&CCo6MVmA_9
zNex)<o%t1MN8wDE^40VBpPl$fROkzXPT?lZ>>rJ!4e0IDv89Gc73@(b?md^uAUAYW
zn9L8e5{+P(M=I&sUw_)V^`CHBxgTYNUT<P5lw+R9DbX0v=eXQJt>C?fsP601CU7cD
z{#OfSlcP!26I?s~Bt)O^G(M+=Tmb_?`Pg9E*^QQ_xd+*>bb7T@0Q3PHrR_89rM*jF
z@+9&q$UoWGb?|jQ0XQ99oA7J<u@>uSu?~w-Pk92oAK(NuLx0q=z_E|%HjquAyc^HT
zTIvDXCG=U1&&ZR@;4(MI{nDdrxsmmT=~P0v!E}m2oauPMbz7da$loOwogOBssR|)V
zl}wifXp+p|x2y{>+94rV3Oeue8tW`NLV?^bFm?7)A<sSxy#?4=47DKx2H|&IxX6aR
zf*_1Fsfx)x41ZLvaN|19hEBM~t@?7`vaTckd*)Z4Cqs#<`>qz+tktAvO1lAOt^Te~
z9=YggF0N}QBxD%BWF-`Y&m;>73htNR%E<7psV$-$<4iqBuN8nErULK*`+KeZa>6Vq
z7sO0sx~c>rlM=x|8Rrd&OOLXy>2@06XwQH{SY8McaDSiZ@4$Nk5RQH(;34^xmS(t-
z2-vmYMroc-wEMP^Z{NAQU9UGJw|Rub&HV4+FcnD?c4c!CRo~F+L1$7K%@8BAwtKL@
zeRPpB<DVQ-*?0LcO5W<Kv<<JJ_X7ICEUgO7ML#&iv|iR2|J!<(u<?^&ak33CAWvjk
z_#>U<t$)jOG_14d7n(8MEg*DIlJ_;iRdx<YPoJPvhgBJlpb|3cEdq@-YnSm7hF})b
zoaTY?ZB@w|f!a)F#Dq_se4P|0KM_K|)Z|_S%MuUbQY;dLO_98y_%l$@`^hi0kG8jk
zZmMYp;I7b30C1T}EBUMTk^cI6M}2|5tg)ys7k_I<K8k)U79dwlMi!!rqpxvp*N^C|
zyu(vM<zG}NA4AZ>hKP$0XH3UUIKrPwxGT9sG)i5k`LF9jI==j}_S=`DZQGw2;!x>R
zbYhS;;zl)dW`oJXQIQgFrJ^_jwIg{UDfkKq8HiL19}vOXiLBIy5^a7mpLrqGkCV_g
zu7BcMfC#S4j=$kJb94dWnAI)C*RyiHLo0s4-I@J)PSWBUaCgUiC?MyOWmJYKsTny>
zz(GMdY-YKNd>L}3Dc&@PMM2cDlvrB5v)V`cl`QBp{%HRrT2s;Di2EBo5@Av!yp@K8
zLP0rJ)12HbC{g=J%}O0<;On>nt=@I0r++#E?i0I+>CMwuz%()6c?ehGVf0A!<?3L9
zzd2DP2XwM0l||_IS(ct((mBm-G*?_1q8<3B4zqL|Hr%dXKY|pmnSISi;7^oU`s9NE
zmsLCQNm<RoUGi1>5|FCKmj<XEb`Txt#;=p^Y<juv$aD`nEk{ZX!DS+GR3lvW7Jr>z
zig;eV_q5M}cafwnsW3}5=Jp{FE_7LWIftiRYB=J=Fl*+^S$ZR!pO!}ol0{`MSZ!5U
zD=?S}4WysktcSxOkKD|M3)<%K9SCKpi6^I)Bs@D>kun%yYA_|3@z-uBblS`$ztNJ1
zpQ}Pi+`huhCBG(z>4n}Xza~&L`hOqa6jPij_Wsx8ArI9H*PQ*m>n80>>sGXLl#Y?8
z!4YDabhAil_6;GVGg&XPp!tA_>vCJO5hD;$phN3#Cm*=#egR_j)K|+)+wM&V-#Px+
zpM>N$-{dfJwbOHudP-0@cl%$C(~<jgJO?~Evj>W08EvA(*EATruO(&&Fn?mdGTcd4
z%RjYN<|Qy9!`R&Ub!?BY5pKiIM;ggSG)-Y`kzft3ilGl`JynkaQB%0<niI<UIRl1@
z-;vM1-Vsbc@Vr{UKMB(i8j<9ZG_KD8>Zm@!*k9T(XpO)H8cSKBnyx|?{Ti7w-M=6@
zvU|g}!sbon>gmjEu1XXD+kg0#EMMb#Q~cmdS5=Qte6z5j5>GF7k`1@Biw#$LV?x}H
zyBl~9^<=aIeJ`U8|G~S7HdizmA1i5d%{`SMr@VM7Iw8z;%U6$g-0kMy@O72!OGDwr
zN;9ewUT#M2OLSltUMyezLX+$Axy94Uk>iuKz5ngOQfELiK453!Ie&;|;QGB<TukYk
z(n#al<kJ<ate;n>Bpd)9sb6HjLMJf8iDl=INnzxKV}CYvI6`(RPk;MTS|BK8o(|tu
z#|ZXmq?DLmukzo52{^iM&V`$!Q!xJql2$hC+jZUz-*$z0tX@YF%J-SvNX%o{HDJ^3
zj%4dVCK2M1vJj;#(0`h&RAf>zs-@Z`TCho|&pkKK$^7(`80)U)X?h_G<Ej>5%~bG4
zgRrzM7(UxiitUF^e%(fV!I5Q@FEx3ct612S(3a^bg&P)6=H^-9)sbx9H=ai7465L?
z2}kQOCR+41^KoxDSA~WdhE-B`9SC~pE&wpQw7chTn2fMH5P!;nJH@pIU3TDnElY-w
zj7-xRf#p{k;uxZo`a<wriASSu3TG#tS7M})+bP4kryjxJC%^r<-!odWTvf0bb*&A}
z+k!i8805*o`ON&w(sq&*rClT;tgNcPO6@HNE;PYy6CE}cTI8NHr5D8FRz9c^Ql2Bj
zhAKD_wRd1YM1TLLLnQaubTnQAWr7nK>esyYGteaDXOOri*9%m*ud>1zU;2+?R8;Mr
zcyL`kJ+8jl!fQV~VZT$UB}|EvS9D6q02=L7TwuwflzVZh1uOUTGU^ktG(ljNW&+sO
za;p1Tj|Ze6x%FH=#G?qvS1aWR$rN0F3;15ITz--!UVnc{xRo8h?D-3gp$#{A*9!=S
z?Au+u)qPSK2(`6QI+<XfpJcNOAa|40mF}pvvX)XJ?W$Bvy=s<I67`HE#ck5cMvV-n
zBTKwAjuuZ%O9|^zr)+*MQU)LOg)mHVc8>aTEV4+zhHq0NtXacbPpFv;Rx4zk^(0xw
zQu-8}a(|vxuyKM`4!feNcST1M^?x%R0xtCQjARbC9ak!R(NL`+#k7Wo!@FHQ%tyIq
z7*#ki+(pw&t>ppZ&NOY@ql01g2EGkYLX9(zmQVP0CL$WEViwy=gTHcB)|!oFYm0Es
z#L7jd-smM=)-1*gsi?|A3K01%AHfSz3KSvbfPW}1Pm2B}rWdz|xHXVm*Q8eI<D^jZ
zHELap$$Tg@G@r?#^teQN2!tef%=JCNnH^DQ<H~R@B&`TH1YnfI9WfDiHsp_jf;XEI
z;ucPB`dgrFo!BHlMQV-S-!%J(3W#DS(TpVCUz(B{1uyR0X$G_AQ1ftgD`HtUQsq%I
zxPMx-t&|bHP?d}NXq_;JS6=?{tc=&KL5o0@fG{1Ec3NlxJc1HCw~<$#Pt*9n&SG-q
zh+3>eqoII=F^_a)h99V+?G)QLF@Az>N0>=|OKP8L{s9F{y}%7(W|Z-%fZ(tm-dE$o
zp0`$vZehmUKrJA4FicNLw=)e-M&y_KdViA20ZRa$&HG0q8!c~DLDVbI3o&X4^m5St
zaCa61F+nc(UZxC(Ym}d!%{(q_emX8x&8ShUZXOse&%_Dr8kLI}qbzne>1^80s&~L@
zxhuCh&Q8VtWFoF4rplmF@)^Lrw99*rLiMId;ogC(uAZWb<qr#nPuIc>PNJ0<2Y*!-
zCJp}T5Yj3Ep^lx*1TvX+6{Wa+!5X0WY)FuDgNijtb0T2Eh)s@<wUf+y06*FAq6dTP
zu&$+DUk<CoiBsp+x*l6{0S12iV*4w2)gB$}KH7V*jo`y=X>$9k?_NCY>_2|M82W=3
zN5|;HlfC1bMFt}kh-O@(s|^>AH-F$Hy@WSr!{3i~h9uhtN$4ghVXgZ}#CZDE?!@^P
zwxLDuLc{485%Hv9Cqi6u;VV8D{dGZ$Ojld)DtUJ7Njk!A5QbuF3yk4s_vTZ;f=Dc9
zKf1VUo87OqhWj7?;=k?ammPHLx2|-^&4%v};olh@%KLG;Vl^~nPrniN6n}!J6+?hG
zgA);ID|mvynu%M_MFC$gYNLa9VLp~ju0r*s1C9V36K0+R3iftNUg*zww$Rm9C|tVI
zyCN<?Gb?qdFMrDHDb+FR*$^h0t_c^8LXZ)ZfjdDXZdg5Lpe9q^M7h1lJ#0u*2&PGe
z%Qz>SoB=bt*!EJ#2e-x3X@AXCE;?w}Shv-Z9WLdzTdl78%|P;TE8Pf0{6bIyV0|`E
zs+ttjtKFtFjqeAEvG<VbPWERyoe&~Em``~k$gtJa!dTU^Tb?GU4)Tm#E-LE6bJW^`
zQbBNUy_r&^R?_fr{YoY$iOgY$48w~wt2?OG6i^{paZ^upRfm^!O@Fu0RRy6rW>SOD
zg)6z^P$dqBkvFao_fDjz!2X#?YD-D`7ri4KMll#5>mNdKvr`{zKb4UuO{m4(wHT62
zph-)W<CPr!xEJm!38T{?FfCI`@8P(5N`G(8(s?<vGr3^zXyWPxyWOO0tYCk&J;#z2
z`SAbz?~tuTcuO2m=6}3o!ij;``$uVeBzeZUBUhy+N105noi9N0xwyg|Dcq65TI==?
z^USAQ;ftM}oqRkf1hc@r3E_>3jDLNRKvov@sju*Hc3uq6DHXc)5kMuMdZ%RG#LAOk
zWB0Q{tJc7b5p=k~nyOyKvZ|1P$ozo6W^WpCD#a*~F%z38Hh*=%<%S_Fk-+v=O+xM}
z^ZvW$S)TgYW&)Ia1cUh7C)$_b7z2<t`MC>9(AY0qTkY!X((eh6I(Q`A2(DQla_*7N
zz;se&FCD<pNLBZ+=+U%Je;9ZKG&B-nGAu6DL!dI#vT(m|s!OfIYI~>2j`#70o$bYu
zs?b1j?YaXN34f?#g_dgB4?S+^J0VpS=Tcn1qx2`YqTV-ib7r2XG$s@19B!!eq2bU}
z^6nUr_h-zjQg+-m*Ly9In6ckqThl7yKE+&yv`DOt({mTI)U;FBoTNyLEyXE#xK(K{
zoz+$Ie5a$Ib^K?Q%s=C#x>n+RB`iUkTF_E`?uM?9D}RUkMMs5}xMp~B?%En?eel(X
zI0MCIJ94(!eC(LJ<P*S%*H^Z1tD`F6cuH?~g5bMms%vdgO<%v#I~_4>t*!7$asA5f
zc20}66+u;g{i^P{Wh~EDSLRl%);{{%)9csvX{Y>oxVkd1I%N%vFgZ%04TRMR$-C?<
zh_K!!kAE-DGVH=aGS$0e?K|RTBPmtWX(>S6)@rTdU*;9XZEj1oNNU|~V=rZ&b9+tm
z2%zMXBAjn1QUoh*T!ZI&GXyQP9R+?3k2E=T=4ty`N5;J151h^nzE1u&LDMT*>1CoD
zIvrl5mu1cJfQpMKKOnz2FeJ~6^d1o$<6cgnn13P}<g++?Q;=xs2HH^FK|d4OP+HO<
z*5K>r&hxk@zD-^W3j+yIkuHU0XV{8&moddlKX*4A^pX;~f$Tkj%cs(nUK>JW*5!{<
z29FEqPG>(zi2*{)T{4<aLbm43(j<AhrY|hh%l#Fb>az~M>iDlZ^E_U!CB0Z$UXFWy
zW`CF<aFac|ZCbI0^z;tw{$qlt+MDFJI#g(_R?F;p2%Y10tM#+NQe~m0evZU@uAu7>
z%UkKw!m-TgjTC<4`yeeRVk-J2`KBnW6R)~BMLQdVqS$!VMV~f3-q<g{HN<hCPV*(3
zN)qktHzEC+h#F%jTTY=Q9a4)!k7T!<Hh=%)cH`EqTXpi@AxTN;Bms}Npr$%9tlSLc
z)w{tp-99=?IRI4Xrk*uaPn@Gh@=Zs+>F}HC@m}N#{Pir%cJ*DZng7g}&_k|Tp&cJr
zBbmI?l5-&1a5WG}U|An{M)?U3in>shF$It>9E&#-fT^6SEe75W-abF#S_r3Zzkfut
z!cp)urkC0si#5WB0!!u6vDCU_YPo^e$+06!Li1^b!Zhr;KmStP>hkbx78)hp3g~RF
z$4uW@O4LGS_EsFzySF?3vrbx)Evei!2!`w0C!2M(HqFxVHGWVHJfOt@j?<(>8XjFt
zVbq#gj!bHCMOt=cy&e|ccsPuLSAXa=LCjf*SVlh`ftgp8XzA@$sIc@w6z?_Si?r92
zWpCaVE5TA#;^3A%!bx1(;orpUsE6xSp}rlJx#Egc=ktime&qU0^nxC|$wv9?y*Tad
zUZ|#{)vTyn&*}1WFA-PsOWL}x_<kv!qz0#pn{Pzva2Mh|SsEmtrsLdck$(>LB*9z+
zeOdOVmt}pUad7f}infe?NO*$VbncBKwCKk;*zOseZz=6y2E+QNgd?@2t(CAPZl$Gp
z5Q<nr6;)ZlrP<ZI_DdB=*hnSx3e$2hE#jc7C>ATu`B#jI61QBb1zI?+#j7}vEIXIG
zALcE|AWxDrl>>OTV%aoVpnt^=280~~T=vztX`GJgFR924k%3UYjliA^i&=7-pJ$>K
zWrU%?54YBAGDUht9P+R@5yV->crz(4k3A@cX!*v}${1|y>nu`q>%H+TeG|J922M~n
z-9oRVQ={}vKAMkK7v$a#NlzDt1vOj6*b<kO&0C7HHB2@Mo_q416MrmM?s4b@wczTx
z3B-@+cVn@`mD@;y3~gw_lFr^XA-SIu>Bu9|s>J)st&E}?1w%xnqHR^Sf%{m*7TEwH
zcGEH!jVPZ2P;>%ZB2Q$4IoRw0N%v#_U4$e~Nkh>3T|=jg@wi#41w})|KXxz5Hb5sj
z#h~MU`~&G2zr)$FOn-MdH1t_yP-qi37)NczZS!eIGrl>Is+>`_8q7gWA?#NKm@tlb
zTE5RNBNghSE5b(K^KM{`tCJ}5nz*vX{V^}_keM_3t`Vu9Di;S~Af(zWQa!$Vo<|&@
zh$AYMC9>Nq*eNMor4|G|=GjcgE60dCshHYDUJ>5xFi0+OH-85$;u%<gy2f)zzW7{B
zL{HR*L8Q#NH>uu4xYEr~v+|3=<rJ%XhFi+XqKH3BuL>ttn~*vCMH)6NhZ^jCqQJZi
zpeSE`zxVeC_rD@8%7ZSi5jTzU*!$`bpG9xsmCch~v`VZLaXiXNAwbu10<WlK=>+8e
z%-$ike$|e5HGgPW{gX(Jt<|2zOU&?fAr$`n%e5Av{ODC1@~NkTfyL>G(0ucQNX#O7
ze*jGmVl<6*dGWq&JOf;2Y*5OUGI(+$o~I3%8eBc!W^%CN_!LL6CE!OHM91=cSQVd`
zWm7$~?tVhVf;cwC{-be!yTS?8YI`X|t7J{7Ij@SJHh*$j2Di2Viv^gK#hvbJ*tB34
zJ;|gH-{|(C*Xq_5)TmYoy?@@V5;(tWNW*hp#PGovUBpB232KO|cq4g1mm}(jcgL5~
z`r{BvXPt<m>lXVWWt8Y2=QCy+_I5`FWePogxgTSsh~p^Sq%l`g)j`OQa%D}TsFc#A
z&!IBpD}NYGW|w5Lfb-%Osp@1Z1Z2~T#ua8*Ngr7Dx^EwfE^$4J61XrpNf6mg>qi@Q
z+!-vO0Y?cG4Tt#+U)t`$NS7(ZQjPIuVC`;$KFl;$&3poA@>r_Nr*XA9Sl;d0U+MMD
ztP{Tm6pKf3-k9Xi|2REvuA2H^68`-2zvcfpSAR-{u&<uwqQ-Y(mSf_TRSkcM;WTUg
z`|c|t)XAT7b&a`_%goOeJT9FWm?l%|g&qq%ju>+B<W2U=<Ummv;85qtx(C2-+s7+7
zq&q=&AbX^)*fD#->&J<C?iQ#!p1wlacbK2gbz@W9<Lb#LH*Vj#_hqsNMnwPqMmcDD
zO@B9toPZ0lk<6#L`=5E<ZzTET{GMaM(~<k2{Mr2vpiP^U(6yEWb@SdlbjQwh3v;Cx
zKIZCq5w3+wS}>mhi+4lo-*#UeY7oGmbM^MQ62_5dQ2z|B_2O-s96KHid0moCi`sGr
zts6-jT_1L_O6lJ5F&R8|H2g*2NT{bN^?x+|m-V_wb}+aIia!PiVK8r@udV+PvrTSY
zIJ9O0SYGv5RvAXm|MCkBff1o+=_`phD3eXhQGNNnXz^B5e{u=E>wnj|8ei&<KTq-1
zbLCYej~N}By`NjwcHfuw_T2C&@_J~Ou|XGFgNn}*9O~ej81N>n7OvKZRtZoy@_%sd
zZp+}b^g$h!f>LpRmJH#JO!ZlY2*)fH!zZvO5GY|lg*`&iI>I#pMUC+N&VfHqJs6zX
zTvNT*V(0XsIUyQ{ibHyTAX2o)a1RA7Riit4D)F?OV%I4aBtA3~wWf)>-nfa6eY)Vx
z6=?<|VcB3n?l?wum=iiSqb|YKzkjub<hC;b=cE|xn39upnrzZoVUEo6v88xIQsuiM
zY^&XrnUhQH?nr0JfE5*fR<V>9niT&_6tl`<d(To0K#Th$v-2>lPOTQkaykcdm23{P
z0is){r}?;^SpQSOBT};m22`A$65=JSbt~CTU<K$GGwp%E+UhW9W01v)%YXc6nhhUH
zZ1x^n=H$Tm?=>iVUS<JUR}2G+m;_iZpuZuy$m}qWE3*TCiC!j^^abxTuHW3BYzh6O
z&I;9lAxI@3&ynZw|NhtivbcxPZ^8EPrm9eR!gZ!zNIeuJ1tTH$&Y=xrg~7*RVQkE`
zSDa^+IHY2nMb*H`#j0U0?te6>(0Q^{&l1-g_k!@k9MwD?h<)zsastA9IxekfG0|cY
zW@U-GDu++j;)h@<Ip&uBAtW76=rC%EFv&hB4#ya|7{RI$E^*%&?b1qqkW}$=NsN$l
z8x6(Ir;%q%1W7zPMCCM`S%{X{Wq`{n*87mYI9MB?efRXrM#Lvacz@!D1fajN(%Z0I
zl-3P%31y`U%g^&*N*E|}0U;C}p|-<mG<uZk$H3C7fC;-Tj#)JD;F%{nE%T@V<@CLm
zpT6q`WLwOj|1^t)5Ur{aYaOLtS|r$0hjs#6qMf6<+=p8-QkEfibOVSn{Uo#|EE%AS
zr&Cd{Pc!auA5a^0B!9A(Jd;q7^zwcAfl*w+LVcLT=)oFC5rnm;Ck1_cglEsvQ8LPe
z9W8=mRhgqPw-9bP^md5rj-4kyxrW1p_9dE%16LwrShqI#eiJgWYC67}klEM3+cnsE
zxy7YU_@n@Y;Zz0jd<@@CALJ!__gh)_Y%F?^<+}IB*SF~eh=0sOP(B=`RG>1o{*BO6
z;TJX<;+58Z%=m{DLf)-Tf0_=&$Spw<3xK`;CWwZk3inmxdBow1!aPgbKNTmd6gsy$
z3~Y-H!IYDhYNR1SLKLHR^I7l^=mVEtif>5c8_IZyOAsF|)f+noEtncvK>W$p6oyw>
z#X+G*`sTL6#(xnMgRV~(j4u9XHZ3-c!fa?#8#=|9G43zz<r3@r2E5p;gKs;tqJwXx
zpUZWq<J&O+Uh{NFv-8m16=O|!a)OAz#oZF+I62QtIQSqqOsj~DgaYfiv{YcF3=lV@
zw5-Im3=z>MIg{GE6L3$-_vzqu8sJA?<7X@7JIM~e9Dl(=gr4^!1o}&BsMHv(>1;-m
zW5~W{*IhcyiCi!XzVMFq<;@GgKFgmbuDt$2j=LQja@U`AiL)*hqk_BVSvE@%Fvgt|
zq!~5XRxP4&gW_DZt2q8O{i711(+hD{C-B}6+55!NPqvZ-qlA-wOuQu2W1%wvgvMge
zS-v4L4}ao?j6|~pdQs^}uo{H>?kjAlfH$s!79c#1V=A>Albbg*y~AjNz68uSyJTTo
zOwZ~54M-jJ`cilTt+?Te`EZ-g0=%qDgJbLgty0cU1d4KIJ3yvqm!a;JdrBeo(kh_d
zP0h1*4$fkC917~9T}Z|R5gdcQtdb#HEan7OS${}Z>?jc(9~2%h&(0;gEEMM2u4@X3
zj+yseLg$6#B^H(7<mG2!!Q6l{;G!2?h{a*5%cloRwxt;tvk-S;3yx+*IVf%!7P+7T
zibP1ECo*L+v3oIepPSZi1-erbi?B}$tIeQViSyQgS&ayeU>bb<EVqGM^nQ^^9ukok
zWPc2}q{xfXMW|7MlZ6<c_YFtX4PryFR<r(whEuyPNZ?4KvAvpKrj;B)*woXImX=d0
zl#o?B1G9*ZaO5+Mw8@zqgy8v#HKgbmVX6)QF3Q{y1!k)9GaOX$(A76STex8-ipwiM
z)O%}CjR-cH^`7+CmyT<qhlk!GXH4;|CVz8x3l_aRAPK+=le|uVcRa}gIBA^bh5dIN
z&FoCCS=L?#ic5rk0YcgagihxB8h~8&cC8fEtJUbS<9PKiKXJj2ro!4m2j2*Y$rZe0
zYm#FC-L~x6@-?W50F(wq5#g?h#oS2F=A(4n6twK2hh;YMaHQb|`?D3!9NbGYxPOh9
z>#k7~9+F~&=t2!RXTl=|_Ezu;WO)j?ds>1OE$7>9v!>YO7TlACeg!=F-BqqtckXo3
z+&rs*uu%y_!sGxx%WZQeohqY&y1AZ@b4R2T0q`5-2D8G`TLu`fwqG2_J7v>V-dUe@
zriB?EqkKq_9VB|%bYC?k$yHPJGJo|D4dELTR~txTY}V$>!*c<KMNK%8vcq*3&&p)8
zEs)A9disUtl@NbbeiipppVaHRvmzfOb@<IojrcGo@Kj)GLK+}t{zL*)W)ON9dT>UY
z%%^a7oA5Q*Qf>38?($mA{_<gdS~w&+(kgap%_ItH{h;b$C{vwWiZIzant%DQ`fb$s
zVZvHb6XIH3Uk`k4IrroF{KG`LqW%vR=$dRENInHuVIz5VDgPWL{P$sg`Zs{wG?Jrn
zaWNRCuQN7|WT$RCPk>VWF8%ln7RnjXt$#jS*CRCWxKL!VYgYWZ6S7cZO^ses=v5LQ
z`+Gx(4Q^b>QRY!Aabtp1D1Ukw%ekBy>PWFF28Yq?3XP&VMku_63{QQ0L>f8Tp8)=E
z9OXXbt>DOXJ9WovT)rQnW7)bz+Jt%^t4p69>hcQdIx5#(xM#1f)3D0_<q})6sWMZ;
zWT1v;gBw-$v{7NfG{91IHMN>4Z31^g2X3!%v#oR{52vvTM5BshR)1zH)m_QS=r^3-
zjcU1#x(Cg>UQF5V2`PJPEScR&Cxu%#CcylzIDvXze_K!)RB!$HxR20zgyKZOEhh%B
z#LrbJ#|SE69mxtnSMOv#$X3}D3hiDgzC+0FQj86UY<?nKPdHn;HNf3fBBO3BW|Etw
zuJg9l^kSDZS1^HV2!BN-bZy09ydsAdy+{Xcljc<|z5Bm@J|L7YtYexBjzd3B1=y*A
z20%?jv_c{y7b{GPjW~-<H45NjVdN$=v@3k}Y7sz9v;v3{r_=JaU1MUTXG+35RAUHa
zq-E0L7Kbtks!2@BX^5<#mI8=PSSWcHL%j;-zM<Ur)p5axjemvH8Nda-xK31pWgtBX
zM6jwFg0Lwf>wKz)2z0h@Rs_ust2p|#-8gbY!SaJAMHyk5rVDMg2s9~rVoE4s=a@*K
zAdD(WTkx4{L3^>N2LC;Zah&yqtbD2q7vx>VHVbp?@g`3)&4{=zvEMsnqton)QA_TL
z0J-6?Kuz!{Rew8g^5FKTw{A@VTEy&2)usVGjQGb8^*0v#rr0|&%?klCNN7NT`EQW-
z<kN>hTK>i-i}6>Z%!3_xM_d`h2SJaCSSIOIHeEl<`<1ysE<L7m$u6NIrw{%ly%-zN
zxLpml8U$aGrFU#at)@@f2<TqLF5K&+b2loW3RLs&g@5Q9Q!(K%`I-fl=pvmm<62Eo
zk@QA<@%-uEV{WJofQhqdF@~|so#?Zoc)c>ztYa@Db|orH%!G>tL%xaYp2ibf;7Vu#
z9)4Ah7_bK*|DxmP^SB18pz69L9*l<oG5wAPc_1+cmfKM^WfC=_e&wvH^dwREa*7Q|
ziy4mu<A06D5ieO4Opm7U=?c1K5~{)iLI*>Anb0Mk+2b?K$FBKJ@+ofQX{mt6M4GA^
zMLa_T6iZhV?q6(KMy_sc#Zf38CDAvrV-6g%m`^5h1}-rGC@$qbX(hYdWrSapp^0+k
ziW&68Pxa200Z|7UXklOgi0c=y8^W1)BWoHRfq#A2{lo@p;+|<G?O^|05hRX7_-%fA
zCc%rya$`jHJ7Zyl55dKP0Wt!4A;2wZTj}c<-EP1SrD-Lacv<)O47WLi+qZ7D65j#W
z0E!UFTRSOHJT{5ajS28F`;x5bT$aO^NAU4dab+6(s0>jOA-WWxnEy=yOL^4Vq6PaM
zv46Wa^0CThfCDS*Vrb;;*Z?p+F12>xE`L{)up!FZ-hi6bT8~sJB>e7DlGz{>ui<b)
z?->B^$YD`)v{}~QOO&g(l9=%NOc-vtrg^`gjg44_UQ0Frof=16e5{uD??kv>vKfxU
z3VPcX6Em#-?`DZsS*jZMIr_JV`}`jluYVbgg%Bn6ud1-C>fme{T{;d14>>X5(!^U+
zWI)1#DAs!!%fx2FyHY5&k1A5JJv6cSN98BfIB^unIxRsGx6-c|x0z=HBMW=SxDxTC
zv|k!k=$Fw0AsWXZD&q^u6#%7?$_MA-I+jk2L>}p_1#67`3EME|*=uG4ZyPQ#T7MW_
zeVj}p<~DF)@iYvWjsfC47aB-C_{!(Crm;i(*F5^K6BE#jCH<`lE8iX;A0$(LMFXu`
zlf5hkES_PIsI!w23b<KRqw3qnJg)^lIpQY@tfuakT5kYa-K=WV>V_nsFwlZGEO^f*
z=V(IM^=;$0=|{nH0p>5uCHwPGe18`>RoKPX?Ht_!Azqif8GLb~Yp1G(-`szGw0C&i
zNM0U1-aX!PQpDcVz2m(){j!3dLLHZdzLY*Ow&Zd2RqLSXhOvIce4U(3i`R=YZD&;%
zP}M0bfyAT!0cUBF_YChL)A@iaqy$u{7LATXKCv9{9Bygpk7N792S5k$e1G@&X#E)Q
z_Ja<goJ;t|`woH~S{%dC-;O*nT0fTEQTk8U6?{yV>AeTE(0BH+*`F#S=er*|z58R_
z=c>(_z4SovVv%z_w4=6QXEyigm_}8}z_Y&{A75iK+%JA9YuliYhO6#G5&%^<T;qKw
zDl$B;nWVQ*27CGEY<!T}*ndNyX3(@!vl3@958^ixgE1G5ABpCf2x{G)ev$V3@W*Y$
zj%r8Gjt?ULhaUu4?)Uklo(qKCf;Vb#su?Fg91*on<Zi#z`jmb)V{t^TDB~Bd{L=iC
zeejB;rZaI;t6Kow@xEnNkTpWB<Z}fKv-I328tMh4Jn~{ooiuLj#3%{kP7J+sw|V<^
h^Ukg2c}W~U`KRMQ7i-W`EjR16{|6>>QTm3JB>?5IR!RT>

diff --git a/backend/windmill-api/docs_snapshot/llms.txt.gz b/backend/windmill-api/docs_snapshot/llms.txt.gz
index 111dc1537fb49226cb20a784ce8f49674af9bbea..07db118b4c2ac77a0f2639fe974e1bbe9c957f0f 100644
GIT binary patch
literal 9116
zcmV;NBV*hjiwFP!000021Fb!4bKAC--}5UllbO58tYq!9yZfPY=Vlz+P2JjwYq`zr
z?Ch`*2}_76lHtRS`s??+0D=!GqLU9z6OjPU0S?al9KKW^ZI*0pn!b4PFaLLCE2T4)
z7bcrmc~iy){+X!Cr1$epUe$V)8ugTy5BF*Qq)fK98NZR3N0Y*^QWdGL@AGo2>RhcF
zn<g`rm+{6_b*XDJqqnztX6w9EHmgmU=~Pwuef^|Mn5$M*tW$HM-r`ulRyAv1uJb&F
zf1h3|y*620(UiKW^R2FJo>eF6=LS%@Pt6y*vZ<|iD!*58o&e~!-l!k`<KI=PvvmW*
zVV<H{r8cHXiqbv;kSevSQkOerw?$so6$7nRngeJK)h#To%ojk}nhf?SFKWBBf15-B
z_6Xdovs5>*<{2zJQ)f+C<t6<8>Qenf{kf!{VSH_}3V?onqAn0WfS@w-b*bSYA`E{c
zoEY*OID&PFKrgfW=|0sDF!OKv{z1>wc@saJza>cj3lOYK`DkNPjm%q_xG8a0XwK#G
z159^%eFcA>U0%y(CbkB2*A<^b4X~)&rmAN>H2JJvy!dEVm95QBYE#!m_0wYU^z?M{
zBt&%rJNDu{j~m=FLTCSbizJV$7w>HSOS5X<S_7cX>Lkv$3-|Io)vL<?>&01`H%U7{
z7e#mZ&U83e=jjKa_tTrp{o@ySBXnU;HuV-R%*CSt>OfFc0Ys!$2CoC&okwj`x+J<%
zrG8RdT|OlFQ>Ios1(TXAvDsSvb+S$V!V6-7djGh+I#G8UAcm~Aa0QZZr)bi&%DXdb
zRlzjy_j?O}yvhL_^@F;8JEKEcHR%H!SOVk^YXJdm;Bmcyd!4}iaji<D5scS(+x8wr
znr^H4JzS)d`b!N*{PLyhoS}jX-NbcM8hrLry)$)<>j9G}Ym>Z~tN-o&^nb4op88_V
zuSfFwVv|2bbsja9iTumk<n>SL7uf71SC<M#xXGEA9Upt6mhh-4)DD;!F_Eg!F<h1y
zaEA*{Ki}K3LUvQy0tlNp8tfjN(o9%dk><byi1@cQYihVnh}M!uRO)kM;|E%PDrUT9
z6}2<;5PO3A$&9sZG6AtdI9ddM_hZ$%v5BeZ?C*AkSqersyLyvnGxaWqzyESGQ*U*(
zfm{ANTy?(8XD?^!SD-BX_i6`!(von@52hqke@52(4Tuu!-j6292cTvzQ92kdYg5cu
zyLkowXB_d$@CnWooJJj<lUCa%tu4QelMw=^Me!~012KFZ{H!aQm=fXAsno1>yaPV^
zG$-i;vni8^<O>izW1>uSt>+1dAd}&%EY}h^vsJFkL_|PR>h&BRz>9eSLJcHThC&d8
z9!#5=CmK3aaBCFaUcWNaE=flJ)3=-~Ocdcn(NTNUg=KJA51cfNy)_!R7NEBT$y*0A
ztTa$6Uy=-YBjb2i+V$F$)z?s}<-H!n^0U8ncnU<v-9!5WHn;-4CTUU>$WLaq$@2&J
zo7n=VhX4O^cXy-89N7jvuJBr+G9d!H73S|x@0NHk;g9Rz@9yBnp22NB{Tq0z0#O5c
z#=FucqB)g@ki4;lNm2WH{t*^3#n%pRyAxLF26Q*#R8^zLCklz%Mi4+Xh(ow2R;Qpq
z(DN(MU=(SUxJMwJT15^ti*!d~v#NlX<GLVfPgvM6i)*zwV#~i@eLEjsRG<4o201Xy
z4I7QBUXKdS@+?D<3i!%-5_`Sg(f{7s_3toh7wBtriaCj7yzeVr3Dus09*E-odrFms
z=1E5|a?63bzFQ&Tj<O^K)_ehd5&rH*xC8CnVL}1ri(0@&JehL2F~DgS>V5NlF@g=-
zj0#H@Zo%5XFJSRe*%@F*@|E7-kJs7D?~6lRZFE_TVgXAXfOshNg7*pT_YEjr_z>74
zm?b;7aT#0?)Y=FYmhImcorLv;A&tpmaSkdYT;H;X(}fV0&UWrqyG3=HG+b|z@`~!w
zYC2<8H3eE_gwDJC`=YYWM^6QonRF__`*bRvrvd*)dC@-=)WN<lBA;N!QB-KDNyv0Y
z5IWZyRh0ci2Fm95#irPd-xgeG5-#BYLgfq<s0x|!er!mM{>})|oZ~q0a?{Y_F@zBa
z=>y2zeqTJwQ50^cL4VsjlH1ewU{=Qu$O;Z%g0n0@Gt$L|r1SSg3+9g2IP*Xo*rE)-
zy;$B625$AzfOb&r5i_SZmt71|t*Ynnsti+Ln<t>)tQj#d#lAB-Fyr_^;ZoDiDjY$`
zz>yp}C9pHUH!@Yd2N`e8AB{{ff@x2e>-+#Zt$F=@k*Z-{{&^I&VA)9s2IC05w@n7t
z1{h%{pDNUk&P|r1q^|82wNO&6&%nY!ksTXYh7?l}Uh}m9`K{5<^2g;@4XYTYh};wl
z6n>E(A2qgPaDhVYCB1tI*XY^-Z`99azICdAv&eu;lzMBxq#)}75RBnO^R4}x9A)T*
zu1IhAb@|~v8Eab&gR{IAM={CX&a(vPMCaNx96wcg7V#tzOcKc?jOa(Sd~BuqD{TfF
zfJVC|V<Iv4XlMz-HY*ym90y2~25ZDqPek;Fw7f9_{u)L)dDMVTvJkKLfbnG=hK!~V
zE-!B@9hZ4kwI*4ILP?GS#1>4%41IQaNs1mhIK&E?w&R7LEt1)S&BjOqI$+#7=(I*B
zde^=5<Kp&*#kI{YKd5~539UGJKeWx+ik%UdVyP0?4`w%i)M>+uhz<9lGmUz+{PFcP
ztQZc5QDn1yp3hk9PER^OGs_>H)8K8IuQ2QaifE2*V)BlwrGSNgLhlmgGt7VuQ4php
z0Mim8?kxX_hlHCJ`LQDwg1Nu9KuJIn7k5{l98^)}v8nI|b&u@)^xYh3B?;f)D8`TI
zk2ZP>zqE&j6M`W=2L`tMk>yeD4iE@vYb%VsOhl^0DfpJRQ;c7h;Dv$PpoV$i(jXRi
zc*58Dj^oXC4nTLkEA-a;gTg268KxMLIuT~Q!8k%p9BwkB4#o}%?%uAExVo=}cme;y
z1EGi#s!*kkQDP*(#{qC6NZ6Q06Qe5w)<lGMQI_z6Q-!91Zg6bm)u=A$^s`a)&WIDw
zwCfU2ElrJno|y;}c@6@yBDTh766X{G;-Kc*%KiT}Uri*YPcWj#xbUaGtKT#xnUR|l
zHyA-c&u?mQduv@ii29P+dlT>Cj)6JDsAdjogk#teeD&&POJDGiWXQz(;3l9uK@;>a
zYDu_*7Rf{AIN}~8R_b^g-5L~yPC(31lNK;HwoK+A3F}=O=|pV))TM2ibY)^V&58It
zx+w@BnWBf$<JdA?>~2j{ks9J|4qq2KyV4|hgLGOk$_dA0O}cYpbl`j@>^{Pchl{f=
z^QM@H)e{YkcxVrsr*PVya~HVRI%AqdE>)P=0?U>ma3sR%aGj<sN#*D$C7`|K!cfSS
zrsK`z+a2?uK1YII%|IoDg`2b{VD)2e5t5|I5)C2-uS_GV-#|M#y>#m5biQe$c4!Ys
z)aYR9&Yr$=YA$(KG1A^;{v3iw{!f>hg435k{8_yz^TNh6b#0OHq#)>wDVD}O%wSRw
zeYP7T@EH=5@!?^k(SSDXqDv@A!oO2AfcBq}AsjIJ16Lids^*l8lhAekd=x*r{19{+
zVt8r#t>74?t|*!{YJNTS7a0nXz|sO?5&C0*NaKehw^=Q!OPdWt{D2Z}bV>ol+CEa~
z1a;R(TcM=nL>mek@|mvJ7z-jz^lP|+?h!9IIK0p_E~0TGG>R*puHX5o+sGo~8hB%Y
zF8RJ#Rl!ND@-LH#OU8`_B~Z_x3<)8zUJecX`DI4bf`5J8(LHFhWojoRTO)xpB|^RS
zv?ze<;tj-jovOBVF=;=GBEsPj4Ucg6p2%mobt2|qTqSWr(V2h-me&|B6u!wIV&rS;
z<)tw_2G2iswyQNj@$7dB=rMjkHQEW}uI^cydxPBFpt0ci6$AN%M&EXo=%co81(R$r
zD+WM?YsVw^IRuah$(GC2>BptIqL;~jiF4Rn@|{#ckP0spoH-i)s3jA8Z%eqiAl=#o
zv7-&)6%UQtp(8ZA8q6;mS!y2)#(i<Obm1+PGvIJr+iV9C=&jI;*lefgzX?Od3rKh4
z$P3pY)8v7f`3U4AOXVS7`v_o5`b%ehCv#s3o9m>VycREXVC);RfIx!=uDv@6P^C%F
z0ouGw)G8Mz)km{hQmEWT;;ShLCp=vQ)3qqOR75~IT&}=iAyD*cr-aYY^@P2tBpC}7
zvY~x51W=+pMUjeCG$)HpZ440T%IG@48g_!zST<XKzj8*C`P|rS3Z@l}7~$nS6(Wrx
z>m4N-Qg%vr-9G)D=?p9b&TvHU;g%1tK0?*>Hzsy-MC}|A&(Q<4;`}VQ$EjZBfpQ!y
zK1eeFA|=xwT{A>e_v97aXgtN%97f#(|G}yPWd*elVfZ$0^-)Vs(+L>bhz5+Kb9Two
zbwU3~S_C;~JJ}H3R0q70PheS-EXJ47EbuDDy<`~j_LzjB2PsIV5n;M&(1e{RFJd<Z
zSvxXC4>|EBr@CBsG@ZCzzH+M%$tpbIsjvk@2mT26OtN}wqqoRoR(K!V09xx%aZ2?N
zz-?h_RIsY45-e_qc3r)Agj)mLG0D?>z2me@H;#CSm&0rHjnwMYmI&xf-JqzA!EC=X
z=vhS-7(xGyR7L?f1IDvzFprFQ!BJqxZq$e+<sNzE(}Ndgg2T;0)qr6@hXV2notkp0
zjuOk@hzIZWG{xOTXcxf}h2M3xL4N?STa%&Bys8=_XDr4nu-+7?VsO~()A4>Z=UkYG
z0L>D)St2*f2s74d-;y24f~b+F^{#a*pcj);hLFDVrfwNIan#m3%Wmm!^`Eo1mgnko
zH}cCMOe|4AFw&hwS%CnETy)3;h;+jdl0L=J@1t367;-?D_-OE4{1Bp&B)t`T$t2@o
zwL!RNgSI!0C*TFlb1#UznQt2whZv%B&>|CFZ`3-S0v`;D)|+UZj!P_10zt*QaYC_8
z#ibw=XV$Vys;v<bN|s%u%$?&QIzCy5g!|y+)Gh7Iu6<LohD1Acso==Q{(9+k)_>AV
z|N1M4|6x!EbkYpSl-+CRrM?g2rxSx6IGUs=j~-zLNpArz0bpm)A(2(-`<^PwTQ3aa
z+i$*1Gy<|`Lg@V?Ho$5C-g{?Mg4Nja2H5xQekJoFd$eVqk$UHys1tqt?G%xpVkG$2
zR!o?&Ma7I{S<_)(=%wP2vU75hlQ-ZT7hh1*hkN66(WA-V$jHcz9J!Ua8df%-sB^FJ
zWx#Fix?>nB0ZOC;259&MK0VbFAmia^?QS9*9>MS)ctPyPP!LD#2``y`{dfnI@?glr
z3Ph$8tiAH!`pg%ch@k%2;#sV0hV@oRRMUt7-8xmo!$}N}$A0KFR+8J5#zI%U5b9X`
zl;T(@!2kO{-}sdJ8g>8<PnYrLC~b_==W$TPgL+__j58Q8X+D@5nFP7wIqE=h4=U3V
z@H?s-RREdtO<0MuG3k+BF3DNJ0V72>_;WW=mhvpbxSlC4;G&%(Hx~oJ@da|#=V@|;
zVc$J#j!zJWmGL9|YCTv4IoC)$mh!O6wazdX9hmU8>Ulc7$w<KeVnOl>OCbmL(HCn2
zBcpKSxFFv27hoLV-&Ed3)po876J%T`mMr=*o4QEapcdDh)F`%ew}5a-DQn(aLBj7c
zy9c$})pR}2oo+jGbbadAd;|k6q8A@aObh~sJmINSDE`ms^%dV>;Kb^;1}wbHfPpNS
zU+aPh4T=Bk>Qa!A$t$Mg;~BKq>D|b^*2xePH$+PG8Xz|fuVimpkWgfpM{Ay@ZY&Ls
zWN;5A`IRH1ftO*ZNN@olY%GbB4!htO!y5@>!#S+-29(punNayEYR8UT&`+Jo@p58>
zF6IZ1dD?8j;Mt(J9?&8l2XDbZ;Dri|ATYUEU&i|~$8b@z-V_bu3{11MIZNo@%ua>r
zIp3@zJ(yiY6GoEnGsNtDj`wOTIf#A1*Lk+iF)ig5_F7Kmj{*+1+Vl#d5Q8hdGU-IP
zQyS9)%`>^N6q8x&<Da#<(JZWNBC6^*I(eCaZg=GsL%yxwyyv88l2ngq!cnV~)zNVQ
z-wO5HA26htU4A$&MQVWBpz@nG;`DNg!<Nd&;c`5(cBSojtk^}sD%=i@tedDOh=d{7
zTu)A7fy>hUMGl}O*stySInFmP{-V%Q1%%e4{y6^KFk`{WXUuH|Zo|R{Zh7m0-DmkS
zw9*=&(2~k}-;g{)r~EVoB+n(nnOJF{nIfF25B#1*ktI<y;E-l;QyOB=sNN#&S#!L!
zDg4;TjUDp#{_J6t#@Q%B>XNb)R?|?Tug%&l0|&IE(B)Irup%5fLc*Qr<WMYiR#8g`
zn*sZ#NEla3&KzT5F2fa*E|q>|?(u$$3)~0z1blAPuxVCPfv15HwgA}U4{>vY0!v2k
zh9am1;PmJ{@*|@4u$Sc4g7ywvAIt3kMIirjvS=+~j!5Q+{2YB(3jMw}Ee13bS8mDF
zfpx0b`(djK!G?<yaWTrE*7fj`F4-Dc>2ewdY{f({ZchqA<tN6i&-9~R<53h0>Db<P
za?AGK(WPs7VXHiy76f+PG9o{8#MdAM-%igKTAPjFGLT!R#Bfhrb8hOc(#VMVb#(XD
ztA(<$;v9G8qbb>XJfId*Y5Tq3N4gAv-Vqm%L?7LrD9^?&9L+VZlnnFQJ4_F*rU!@E
zUcLnuj=0$P_=Dxa5f6@N@F<Ak?7)@kCu7?BEatoH5Pvj28-8%QZT+t+UZ)&bN+zBZ
z^>q_r-90N3I8j6s9i4%~dB?D;EnK89u`?%2<^<da%qC_K8Hvx7XI=%l))Oi9bBY~3
zsvjdi!9b_O-+jIHF3jf>HzRg0!M}^jR|N$TOuv#xg>#Hm%Md2jrj;niQ%tpq{HW1{
ziWL>8O3)U600k%q2DV)OqR?>f`m`l$PW|-~W>)`n1P>ZZz4_N)aw{bztTfb0AV_q<
z3`g~;*%m58Bb(5w^%}_$*ika^WOyXHC6n>!FS|$xey!y7Zp<CWHk7wJ=8pQ~l6U@@
zlru&zrfLb1K<W1nAzC6OPN)c-RLkW>*sdXH(?I0q^BZMH#hLLP3sn~0Ly|;o4}hUS
zbVVrb%4`WNn}P#~SmADf5^KY<x^2lrWe)=<Cmq1u)Xc#{DT8-M<qF=Fnr!`lAP-&p
zOeoCbyE7@62z9xe0ukJ(J<+Vrl$6uvQUPIQ${FCqa@wu#wqQ(oWhWX*wTv1lVN@Rg
zSBF#dy?e2nG)jpcG6Uan3ADzs#RPFm3vqMoEf8USt-Xn~7!mIu$i&$jKMgICC_J$5
z{%SiXh))%(TfN7BEX!FQa<M3w0u5N~fK84<9lN{?OJQ7+dD$sV&~aO|_a|PeJe$l$
z9{so;A88*jBjM&|M`n=xNnWd|Wd=NG<YLK_PIv;@D>D)&_t@NU7AnDkZ&S)O+k{75
zsV5#2$(ZqLB@(qaKap%R46gfp1u;YMsx7bHxODBI6X1I|CdT9Kk{Z_WIG}I5q^kvr
z5MIGv9o67?Tc9bc>}YkN1(e2(-=wGR<V1L=&;Y0EIh=eF`hNJh5Cs&txZD-r;_~5%
zqIRNv8M^XDfQA&q%)$&~pz9(bUO;W`+@$Cy9bj;rzkWa9q1V1s;nH283tsEhr=TVU
zuvE3n;#pf0I>u|ota}r7WSXiU>?x0A<=sCWZ#&fOG7>gQnjsa{mcW|<o1g+bz7<K^
zda3Ql#8&Goo5g8E{>SCn`44Ji5&hk3SO1ER8Jq@~k2J}2Rb_+Tm`)+BDSO;8a(5v~
zwav@jchIG9g{Un;;}s&mLXQ&o{hsRpFCBTQs1%h@bv3*aa(7!VIcA$3P3FVit%g=m
zraV9(Njr}%wNw+*b{?a4Sl=V4Em-il)d3+g0pKY-kV=NSc&HO}`tBs0)D1JtXav1I
zlMbjk87%QeXXrcRdd+kvQ8oB!I$QBHys&P99!mUscRSJZkcZl&o5ttUZs-6?><wo*
zCCC+@3q|ULs_8jKgbf0P{CiYSxLuP#eJ)~jBdSsF0V?9`IuMcF>x<Sonj7pzTWx}q
z>)$mx=*5D6XFA68Va_<^-`GaOrb^*Tf@KHu=cC)*z`pF=+vKgI)A;$`NN_medMj*i
z8!(@l!uAw%IB4K4GuJ>N)&&|mA!Bk{DV9xbok@J-xZq@6u|>BC<``T?c{EO`=M>F0
zgaPV7An*dd+$O5|->?CmPf#O-oT=5WL<%*LJTZLq7KpK`x2fbR+3oRO4H(6xt}tqE
zv>Q7Fb3Hva2}Xw5NY%@pVsLS4)}TJ-_|^o6D~yR~%wA~NGezJmKOob3w3O-*nsq(c
zSkc&EP60nZPCef2dMy}mik=Si1qc;8&Z6EXjESlQUCYDPHHD8>IVkWYw#f!Q1*{4C
zFVxb%q}O}f_tGAkBi<U3wk@vdB{!(0;4Mn=SHKaniA^XfKfKS-Bq%)2yU?ONyZ!Kf
zPEHC?o@)KY$t5Xf^v+}{VQ0&)&>4o45yujp?c~y>!gx9|@zhMz2xZiWdF38;p}*VP
z^^*$=K^NpLr@whGobM7)=p70i-;6x$q(IquRApFCY)!i0>cYvLN{QHfv`s1v$@zsv
zhJ%>v+0DezYFzB;M{;#_O?KhX(QyqoBBjO`n9p`o=5-#!;lF~#Uvrf3ATk{Oc74>T
zQ8P$57_8#dI(5_g@{VBkev9$7NCu7DXrYVnNTMN_y*}e&nlp~NkP-?CL6EdS%D#{i
zdQ`w%rJ7-X2c&!K(OCJ0v(F@+w#dzQz8Ez0asJ84R9(o(XTs(ezI?yDxV@XHKW@%X
z?=Dz_J-@iRxVup1krEHs5l#9RorBML<18WU#5*1Q2ORcH*m=pldy1`qrvsGf`nh{a
z3+@GH`TH}VsXjj!7%cL|B|l@sll@R(ljP}OZ9mt~y$rPAs?5=wwHK;)z>6jWwT_Et
z!qmxI0=r?cY*zb$<D{p_;AtH8+{5hmua+x0AbDwf@C>4danB`t;LR~@U7G@Sj;+@h
zXF3JutIJVvN!7ZbOv$SK6oBMTehqR4C6Z<iV~r;E>Q!~y=|mdHvsS{baG%ln|3JV0
zBe9{)q(8?oVv)9|aXR7?bhePTm?anh8*1Q{<~gPTm`+QmnPlN$0UY%hVJ8lCYjVy0
zj|3hSXKLYa0Q9y4%amUJ=X?6|dqweVxg@~3sr}>z{`}dPqmZQT{0FFQypstc>%Kf=
z5`HN>rPIqfrzV;t=$JF3VrFSd<xE!}n1>0aeS}ymzkmdHk-0WWoh?Smai3r>ruPw!
z7{o4Qrl6WN!)EsQIhJmwx~K_lyy6#=ZkefzANXi!*0zptKpz;i8oIqoU~2!Fl9ioH
zw4aJ9>Fr+UXv{*v&&6<cBh}@>=AB(G&d$Rx1)T)7f)bOTS}j=T2hsq#asF<+opF)e
zfCafAgVL+Yqb-eaf=d5xJ39`S5Vc=j9$%TC+C5Qfzwa;|fJtusU=Lla=<6N$NOaJ*
zV`{7<fulMZ%?>^qW}g!5z2^N*rzgV@TPx0JigXvGT;M0B@VR_sibItB4^DlRd89V-
z&@CP-<O6d*`fD3KST1P6f&M9^@4cw7<_Uj2!isCT0KY%*Sb#L|R$2G!29WH?at|wM
zBu}p3FO609Z^x|gKDwnu<V+z@`mj_N#MDa8anV#8Cc2UA8KhhnP&l%Jq_ZykI{$j{
zND2zje550pB;;w9O(P^XfHSP~^znSkOqc|Az&_?~nmH#p>~jqkrVP4$bW;f0;?G{9
z5N2H@_MU`P?UDg1EL|Kgk8n!o%oUkQji?JQ7TqWzetD~U@EX>nEuc>s9U>XNI|t6<
zX998BqBLYYrtZq>4y@>NKS28HV~RREi@P?^b2oZWfY_Ve1t1^Tp>n`kdJt%kuEdw7
zmW&b1Jb1pRYD~6nE!sq{=IsDbmz?`QEoB)2vcbSXw2kWtMi=}wUrk!)Q@$FZPW)OU
z-d9)bzG~Q`dkEDlJ3(;b(!hl4!P=rsfRSJ+<G?S|RuLWoLi$IrPjLz~sNl$F9U}2a
zenm!hmZDAo=p9F+fb^s;=L$Xp_a^MxI%&h)ln2>KyY7K)!X6AF1)i_#EC8uUW*Nz*
z9q2qx>`=7cga!nV7pk0Z{1*qFd4Bk9fg?{ZSY~*3oi|T!B=dDzYY{xK(N-ee<Lc(2
zj~>=?iv2>%j@vJwGf^F(69Ckwz~bj5i@c(i!kp2kM@nNm+9@YoR?j`9x;pZV!d6v$
zQtm4V?&Ak<T$<#h{lUoRID_Yw2nWu>^(UURo>M&b5rQn<YBvV}2yNlhkIU&+HnnXu
z5Aa{Sr%zaK34!L~x8+P-oGq#7lDw8bQ+1IK&4#1Ub@&|6$X!YKeUVL$fR0?0?AG{=
z-7=ifCF-rgkLQ+JU7o8~AH_~km(;tt-o2Jwy{ZCD4_lvAVR`*n@R^p~VUXUp)0{*H
zPxRqioM7%J=y&=QxgLD+fJU9*C~QhC!w7amJ<Pkh2xcfW6*oof6A(&ummZdwdyOge
zGwk7y4MY7$Q%e(*=LlwMyH>komdPKZAiUiK^WbwVqxY{(nmTAifzDV@zJ-Y!)mxhD
zRDydLek$USsv%h-lYnrkB}0|2pr&!9w2dN5&Y5;e=MxSiB8vPXSERR98*D=7rg7gQ
zZb#322SVyfhz=1>{o@L4@sRsZPOE#P(ZeQRl5wAvp88<|7#Ebcwbbq>+}GRoQX1Rh
zr^%)B_lgJ{OHO0)T=Hipq~~sH;7|X|&A1by^XUZl4hhQS6KWCSY>4v)Hd=Z_XWlO{
z(yy>>wVqn^2~O>*=*LGqekAET9xM_xs0v&*zRkM%5*tID0mIiNe?=X~5zHSh&(G8X
zlXWJ355*?&h?IBx@o$x)nOy=9ffKeU^6fUMfv|j7wN2#Z2oSbK73WG~nRgwTLEmct
z=7#S{rl$^I{Uz9Mz*({QeFw>_H@JD3CNF)r(=qnK2gc3)Vgf%_VD&N~uU*#oWJIX`
zsf$E=<-%#ZH?5<zleNdyZ}=Hkv$04swlq&5qNFBW0l}lnZMuG9j`3nI8?1DOV?vMA
z<omd7Cm1=0;3*fO_)eqLcP8|KDf&<we%u+8_y)a3C9ezvD%2O_7|tQ7WiTf4WBMJS
zVDhBjouvwEP_V5L2Q$PW&#*nUpg5C=l5VnN`%?|L1?O9jwW*S-Vj?}~<ipRtP=0;q
zLl)kV82Hon*3)2ekko0F*n?zp6ZFDQ5V;8k4YmMi&`8!;r<IY3Qsmf~jVp~?-<?Z@
z?xyJu0rc5yLC>X`Uxo#7<x;G1a1cguUtYtSzN!Y9M&k19=Tn95A6qxI`AO}?KZap*
z8McV;_1wBaFv%%0Lr`Gh5P{0psQMi{m8PL{8w`aBZ*)ei^GdI(V`nOO%p8ak5j*{2
zb$0Y%O>etz(_ue&Te<#SZ7W{a$d~vi6-yn(^>{#3=L;Gz)<v-WGD9b^&3{FU!q}Z}
zI?TG?gYWbYY_DVs>#f1prT|;gh$Fh@^VIT@i7>M?{NMyNC&t(ee{U-UoqH6Ccno2d
zF2$2}n1>tzwM^ax%-287f*NS~cA?1h@cSYIh`E9C6o4OS#1ZiF)CVad_$mPd>-1u7
z{qN~`Vh8H6Rut_@!TsoFM#sUvuqM>~D2d6|WGPTRwEytJn-_cwZw;2vVf|bJ>I|uO
z*(%p%a)jhF-ZEI^e$YsRLHSl@ug73uS6~tjf=b!q!VK^e_2`7NuImaW|7S-qf&i*Q
zhV*u}HI+<RgPa4<+~i&figm`{(rCLQTFi$)S<rd`Zc<=pASG(d$(;fij*Dd69_aoJ
z>yIqeJk#s=*-T@wmAKv#n860t)+Nld7R>Rhw!vT^$GEsaa*gP{R8N3hvXr>SAl3U}
zcj-*NSxVUDl1el68t@S%5ol3;5O2*3fbcEYfd_=j3Lc|WC3$}M)!4m*@{afOz}vFp
a@a|=shH*%|1=$+ai~k2cMJG9kivR!|N4ER`

literal 9144
zcmV;pBS+jHiwFP!000021Fb#VZrjL`@A--b0-Q~-lC_xG-G{-!2^`y#cw#4x<(Xiy
zSa4coOX`>+Ic(C7=IggE-R$N?3hDSEjxDjPtNK#+D!vq7be8ONn!b4PujY55jgXnh
z3zf}HUYD_gKNDe8x}I-yQ^{4T#A9CGuhaZdsBEJ%ej-s1DurRCC{kIi^KvJuT&!xH
zCNq(j@m86tl$Dy%)4M#=RbC36RjSNnDonnv9%TuzDq&)osuS@R$2N1BnSZ#-^A!F*
zy%chzvdR!hSy%Z^RyxnjiTJe!Qr4;ZrdK-E)n4Rl5$6e@uB)y1=|BEmq%zyoFdX0%
z^(xgd0VzuT07!~duS!|&h29l;Ss6xJiZln*9H~2)TBvV8vQ`<aQ(jbhr~g)o0O}FB
zS7)iLVa_v{cqY#3(&Q!le|0JTA^up>$1uK9nE|9<pNI>j4=^xlz9}Vqi3G!ML=$6v
z16!~u5$R=?Kdw`G50F2|^}U>l^E$pie@mGD7Z7Mv`JiKE2H+YM*CnnB!CWps0l3ra
zEBJYKd2JUn(G`%pF}x2I;395oQ_VVL@?O1o@kOnSuGBALTUCYmWwCgCd^~xyhw21Y
z?8SK=*SKUv&f(`4NgkUQ?{xLPUiqgsfM~rsiSymUJv>k4$~1qyI7{<7@dIR0w5M-@
zLs+eEKf!rFy}3L*et|ba7W!mc?cl;(JSaFFh^i>y5Q&w->wtIXLF$w)i8P{=k76gw
z`y_wN#A+`9sLB$ZZN#4^yW~&2AR12Z@3&Vc;%*CvA*(c8fh1fh0-Bn<4Ot2UVBq()
zh99qTKu7!}uHVjRQ&x3)4;z-i@rSwK0BzyxY76%|0r+txN+l7E*Ld3wZbX{y%zO<O
z>7@Er!4|)KDO!6d;6m4NRhJ6Cdnw+js>1nzNtBgJUd+Y+c0T&QS4Ve!vEj!f`}ks;
zKSos^)ka0l!@K15FXBBcc9M%r0V5o6KFp4fy%9_JsxHJHm>4k;Q^*)DOANHb1*ebK
zx-`gcN?pLgCXNQH2fH-0EUid$-~n{_cRH&pxJ^jbl13QuSFPiFntm!}Jg12~gbrbk
za6g%`mUU)PG>C^M@N+X(Y-*h-LwkR>FVxafbhEFvc{UU8a`^rI%}l(NW(&9cGhB7P
z%x5oW;x{;1`1fiLKWR$X=6h8VslOuY{Q*LWbsr{^<O7`MMxwMRTvn=>ul92T|1*tv
zWq1c?0(PSc_eqLfomQHkMqot1X;J(L{%{z+kABt`O?(pJ(uq`UWV{DH`Zy=)1JHy@
ztmF#_J>x@}$V$!=5J4)#M_H~VuxG1WmWdSsNhvpT_yQix3lM4`p)wSLAoKuirXFeN
zOu(%Xczc_f`RtNpY(DytodrM<0*XehQ5%=uWj(UfF!okS;95Z55+rXGKv+pQseDN?
z<c&<@U8y%4Rhp?JRd!s50{d}u3vpNIT(>vzcUW)(dQMWOD4-wJYMbZx@SEBJ=Z62^
z-`(AaGDkK-UmLt;s9ab9?uGlu)4L_!Q}}WH`R)#G@EP3R)4ze&3J^V@cf2cgVl}B!
z5z#lgP$_C-Pv6qQg81HM?)H{-x&iHlI2C4aJFSA^mJtL}1>zAdj+QAX6!iTSXf%Sf
zOk5+7R$j3KO(Wft7&QiXJI)KD_k@KHvplcW5u5&e_2YbbVgBk09puOW8x|T>zs@N*
z%d-qcEYNHBli2O`p8k8QH=kkDKG5H27jqKPc>h<@*i(E8dLfGY=ae!F$v_7va?^qO
zzF*<N9b{36tojD}BmC}0xD9RHX(9pTjaa}!JgRcJRls=`;$!{16v2XR2ZbjKyI^kM
zA29i#EDfk5c}ve9rt9qG^U@HTtt^W{DqyN3826=M@I2xDu?8g!zXUc3X38FJTm}~e
zwKyV$W&QJ#ld%5KKVx>XI0qFHu5a0)>B1f?neE-9dWY&YX}pbz$}@@wEoqO1sSC8y
zh@5x%^OCa32X_UgnY1gx^Rz1sPXqpq@}j#dsFOV}AzuOFASpD}Bw|`4h@5MQD$C(R
z2FmC2Qd4Y)ZwpQ|iI#8xk#dF#l|g2Fm>N>6pP3+nIZP8zH;pVFLll9KK0?gx^U_fc
zl5jf>``gZz+@5{}GdsRVR&az8gt7q5NETa?&d*5}z>YQuxu*^6P=?=LEboW{H+!i-
zJ1_^t%<0W#n?h8psyRGrhY7IN6HstAOc<DE&rA+L9Ns9LYT90fBZwH-l4H9BcIR^w
zW2ythG}irSVuBHT_GG!qkC5Zd?dK(`0=WF~AZfw0lL!pP5qWRx46F?>%1*u-)Q`?p
zmZPMu^bWO9QmxOx!a$K7E0~59(=y%y66E^%9;rKR;)M(bgyewk>`?wUknq7%<Pbm~
zPWhn98T|#?!c2V4SEzQ^K$=sQiM%bq^QJJH<7hHA-ekfXgzkK!K<|*~FZ%uRy9Qzm
zq(_eQ1q$t`86VZ!93V!xhj5Oz{qjcqTIM^a!Z=G3xLYZAsv;U`V`4ao`A+{$4nOp!
z8`5`vTYmaTM&?e!;4H7K!<%%5)^`cQL?_`i8o!!6ix@}*Kq3o-3H^c=n>M05)3&z&
z=zP#*1SM*X2BIZcXGM(`Z;xowyp@eO(BXeW+Ud~6`yNFyd5}O(vasI!9>dOBf&@)C
zoZdbyWL)OPcvG@<vq=5}#u`l941JGzNeU`CYOM7(ZN-ZQT4bRGi;WQxbR@ZX(D{zR
zfVP|L=f&+$i))=-eiHfWD_WoS`Ov4p);Hf9Yhe@G_i8_XkZH}6Sljbc3ygTR{Q31X
zsu&MPQKYj&9^Ba4%gxb&Gqe2JIXm8_`3l2Fpg`y7?j|q4SX#8u-`Ti!c@HySpA?K~
z5x{2&33ncgiJOFr7ByoBEE~06YdA@8Brfi*n&TjfGLMzP8`R#i^V4^8JS$1~1V>|j
zM!&j}JNU$J8UkE?zM2CATmH;)G<O>a2MD+<#*iiwRU!z!<sQWFWeFbWxjQO=1D6J=
zz|FJri0?SwZ0E>y*V`ahZZ-<P@q3tJXw5O}EyhD);&780HH}@{(fuR0)*C!tvNcIa
z8E`P%5{iwX@>l8@Wkv#=98jkt2}@H;Vs&M}oam@slqEdil(=cgD;yg&3Sb*``dA5i
zX2AWZ{Jg|fOI4wVYG%cW{T@WSA;!kL66X}m;_&Q7TMqDBzM6QPKsK8W>%xz^K?@Mx
z$&4JfxWI@43hq?l@>bH^Tg5BYYZdR~mT5f0_-qaekYm|4jNB;7{)EAoBt<6P2nT>}
z1p(+#<PUL+ERu-KbF5>Nn5pA#bZ<}?IuS8L8^EHu)nzgVSy=6T%oeHnLzddJX`^D;
z&586pI1ogS1<|4CVQ88*b+@WEq=>ki!`FrOu2c!$AekB_IpOHCO7~8X_T1(~-4{~n
z#HP&aVj@+n4Mse)L(O9dw&Rut{<X>YOd_8uRE!+LE0>nn;XHL&lG4#qOF)0iEkhwE
zpagw&>g|qsP?saYr>dtE!o+o25wh|j*N90{XNd$MgIA`u%3n`EIlXiW=ycAhBR{l*
zB<geky0xb7oT5v9Vayq5vwuz|KnXyXn!@ataQL%oTjqt1XX08T<4Hl(DOD_$x}O11
z5PrHH-Dq+>Cey>i2ICk$fuwy<l7v5}I0mgh6GJp$91E^GURBA-B`2ZN|LG)tahWdY
z?!-XZ^jpEvR%s|MH)uFMb|>izk-$a-VG(+g;E=}mMGn@LRbG5v5Ag#^9g-=9LM#11
zK_Ap!AGAS9$tgn={^UK~Y%q#Ny67l7lEd5!N#i0KH*iLA#?#Ha2DCQ}k=DSE4Cj*X
zixviUVwHcJe7Nkmp>PW78I<c`k60%g2!4K>(P_b7U$=A*T5Jp22}y4zaLz}l*`5{!
za9zBC7-<w{R~3`ivnV1Q9?|d!haZUHhD&F~9E>wI!fACTI0MUTjC5MQ$tYsXZtCTw
zF&zfaAGVguo1nP&djaP$zDGsc3FNl+S*o={?yk^WaQupqd_=Qvw@T!w<y!%eE#~(C
zs&MUi<RO;;9zwF_a&h`)DX!>YvS8vI)|R|JCJ3+Lg@Qdt(;xL@!tZSf7Z;?PPjwq@
z3a@x*<cAKN*;Nm|)yPtPuP|bbt0jxZRyhL>x6}2mCxPDD^J1;G)AJ9Oq2dLkyD{>@
zwT@|W&&+%P^MR@Ikgt6Kv~40!YkntlUs*QSN}zdd{pW$XugC@h4H~%i{v;rkfSv=k
zd6|e+Zry8N)M`mVewRaFrVyMkxCp>`l3h|IkQ`1|V3-q5^lC3GpP}msYh!F$87O3Z
z`=*bejZYOtYOSI<*<@m?;DD}_tOBZGB}k2B!}ar(Gn&+2wa%tcYG}j&FK19lGzQ!E
zlrBkmHtl)4=kH8rU>R_(Ci*>hym{3KRkOJ<v4atL7!kwhAZj?%4DN9%S9zcu2b1>_
zB;b&e@sG|KI#X-%3vMOuqBn?9_rO0`RiOMP|0N9H<z64v<nEn7p^j+4Fga(J46cp(
z7t$igt=!7vXeVjlm3#!tnq)CPjAlWjQmk#RBrlIj7<-U{WEv5rs~Sz%iSi<LAjsOW
zAUecZKX@w3O-s{>{q)Ao-al614o}4`7~1nkxbJL!a;4-BdCUs$qYwRgmx@!W`v~p|
zRiT1qrb@8b4{bYpaSL|}xMPy1`DV`vrfwYZkVXz~&^J<vQ(YpWGjW5WHU_i(PN8oV
zRbWK@1F4J_;S3nhs>X~s;svA7j@_sMOUixKD4z{_VNN^T98?V$2XrVPuaK!Kr|KxN
z9USrCgPx|iJqfKM1~WjOnl1VRfZeJLz2?T$%I>i>W`Xsla4LG6%|4yRljfWY6A2(F
zk%JOBC<Dw`ibGSjBny&8zScYMRzN={B|G8y&g;rEa^k4oKg*8kAN8QKzm{Qjxf}Uq
z5GR%>AQ<URqO3p!tXy=&1cbB$5;pOR<MyLjZWwexr}$vl-})h}N|JPD?4-dAqvgYg
zPe$!v1k$1xFwcW1@?yTNSsY?;(P4{Bc(WCobP9ejDB5hJO*$;GKnVmD@5Tv5pHxg?
zD9#aPmz1w|u_xKCBIO*7$7p<-6AAa;&WT%EnZ19~<~v#K)Frhe8~gKRqqF{#9{Sgx
zK?D%PI-rwga7@{~c3#SL82OzT?!eI`MS1i9Ge|lUa4`crgN}(TBi9{Ol$YKzh#$ZC
z7SI674HH7|AF%;e1MuEEqY|t}&l_OfcZZcsUseMIQ-<~kZy?Dp)r^e%$g!0TK{=1O
zNHkYsAQNT92{p3<W8d1H>Wl0_mw85NXyfdi7?bcIq6Wl3n9|p%sG&)%xyv%K#byl!
z`b`k&CuelP;V!<RMWU-lXC8e`l^q$mkptWVXTudok?bDhON(pYb{jEP7AY&mFp$LC
z^!2ftfEf=*t9%>b@Cb%?&<kQzih@nn?r9|GZ(r`<MBgj&1jA*J30Au`=r*}U2#B!$
zRpVZ)bcPjfc=)Fs26R7}h=-H9FdU<z$M{V8nTA4aonY@!q?h7tsA&B6f4*so7%Er+
z*gQ-d8FlNZU;zh3Jg9@V$~e~o%M=38$jm5Yz|j$k&ro5UMZcwDQq7er--NYKTa}LV
z#@VbO95BEP@Z%0Az>E;<1eggfnWL2=cN`<ZaS#eA<Y_X(0ny%Tj-!wyu;T~#>ZUgd
za@c{$F=e`!8<}CYKM0GR>3C!t)0U8buR%kwEQK8Hqc7GLMn>VtVTEDaoq%b8zp0>(
z>Kk3*E3n~K)Z6OyY?9;Aj)|)WHh;Thb4f{ojaP+)^kudN_1{&|J<aW}TQJ(b|7+fY
zp0?A8<0UEvK}a6^)YgRl&*}9Q-(cXx;zJFVXr{oBx0GMYf({xU{<Et~ON<3>_#BUC
z(2eckMjo`H`jogKwkWcO<0j#e?2ShWMTUCN>T&AA(%{Gr?%-rU<p^%z4e2X9TyhBu
zOX8%(E;ttQ#)jKrA69t{O7!HMt$Y>vu>%+MYYRADPK+eR{KZ3_);loFwis0avWUmQ
zQ!o&Cp#Wno&UdWW<9(T9SgYP_iyCPLrdjHoCG-ci7hxjN536$bY9A56$Yv(>Df^h?
zy&6hmVxRSOo^5hWpt*&$w!89s0UK+!of0&p;7YDkIuY-b#&l3?nA}h@%*@9kW?na%
zg|%aJs#*?No~EaRUNs6V-_{>qbJB=Osz(HH(0XRId04=Ep?>=lhCZ{)PvergdZhJg
z?P(!SFQ+(`sbC*2#{+9uQV++pU8K(7a!6#|bb5k_9iq(@{3I5*5kPa111t&mYrT1j
zldutgQD{*EL7PFpA%Cuzv0$w^W{(56Vc`R}+<S@-S?G+dZN^YYn=HJpNgiSFU>X57
zA16XctTYg$2qATmKQJk>B#K%b(+oc5Xl1S`&-eTJpmZR>QU+^l9r2L1i!(?<e$ecU
zC(&P!RD^@E!c&bV0VsYt<^^BnaQ;hdcELE^fUTB|jqnuq;f@W}kb9;|OkV?~!-4f_
z&NAaLr&kCy=1(<s`HW4eNPwXMfVWet@$$H6#zt;zU;1^Shw(ON#aU)xlh4A6E=o4n
zna>w-NZWMCe5#^aghK}|dFy*}4VN-A)TTsdAmAvb$rZaZ$9kC$bJeaZ=UAyVazGo*
zXhO9XeQqAItyfc#r-2c+r8wZ(a<D<gC-=pcV&MhQ^w7js29%HE{w^-7Hp%^{Gh5=*
z5j@>BoOY`~IkrlT34;`vz+`K<t>Zl~p7`_S`3FWxgUJP=8mmxY)q!V~ll7qzU_=&1
z)WGQa>FD!=Iai=gx+-Kouvos0EmC%}unWvJyEqvo=*z0lS(iU^YS*asH9tr6a6kM4
zU=qwBqPRv9R-<s@SStq~?^L1SF%C)k)B-*V_G&VEY~ikCIc<U2GLB%}f%F^G0LH_b
z$p^i`!&~q|4xQFkUgbf)zjTdjw8_(H2@tO5P1Fn>@LyRL;lZ=j?=x{+{=Ii}^|m~4
z5lmfG8W~a7o%XsmriNWu8yIpf301O3;)tn16)|hSj_5DU(IYhOXyWq`J%7+P`-B<W
zoT$G1ge&==$rXU2)Q1RL3D=AZu`*cd5p0u@!2wa84Y5mtHLP^^D@<A<3m9vI4hgM%
z2Pz5+{PBm32S+?OqQQeGhR{K#RF6ve3Qy*Z9GH4gO<hXwr1=g4t{n#DqElM`r0fd^
z2s?SOqKtqd0yH`kj4J?ORXtv05U{f{OXh?epAv%1MEpe+A10`Jn0RacO0h=}FwX`+
z&t}2Tn~n|pFt66S`>`Jq{%%bg6O<<LU9$O%2xF+;jwmr(uMdnrF=iVzqXrY3R#f6{
zlPB;4Q1DUxT`u1XbWF8lOE!B|{P_|fi+{QU4;p#3{nwwCL)g^JQc*LKAmNMz_1Ah=
zhzy-bL{=p?cpTwEClhyuN21$38P39B7a-v;g?+r8`+{R@%AX%{xBh;~EC0lkGjv{*
z@duGm>2@TdvqVOUJw@n*T`n)ehA%;*7dl=|p0Qm~>#TdmlCeeO0Zby_MWipBT{)Pa
znJwLAU2q^Ddt@j$iIrlt#y9z*0;HZ3pEsah;Q?LImic^(j4~asCCI7@bg_6^lJBF5
zc7AC0PLG_?qDTE9SX`##ayxBL39g$+<pDbl3`YB)*9^ii0cFlfSa7z<37fmA>CVUU
zobN^@INz0$9Dn~nfwO7SH!=D6PNC&kmHR0e0sA=+f^UJOL|m7@3^P-r6Ia8uv;v2t
z*{<|Nk4a@m^^|)mY63pPbwy3Ap`GbY*=ZI6Genym62}^=S}2#z!8lmg#&&>bTQnKn
z^xsk9acFKDStNdWU{~MrjcROw1)B*p;lH8M4ErV5=7ZH+rxNX+95o<pvemEPbCoe=
ztDZ{6zSj5;<Un~gndd$<<2p>&f5BXrdrOW?d;5c2*i&nxc+kMbvfs2~l_-mt>pCTY
z%_--uB0TVEsuN)wYt)r`<S~&QGkmSA`q6<;N4D-~1T{%k*5iU#ZF%*kTXhu_)`?n=
zLpG?qiu~}X*26hM?P{#PRbmDBmq9<}bNEh&(Xv^#EvG1k?@GGxz~d3gPEl&_(0QaO
zL3gyq=MklG!}t5K4V<n6>ZHIwJ3jHIp64)rT+;_ScwFv_AMr{vpvVI{RP11%2*|K?
zg|o0&18!T95Qn1Prw%BFa(Wbu3n?B(JPa(hiUr#fw9)g%E#+NMj9r+07SDWv{g4E(
zy1<*TE#FiX??A0N+h5JM!@cL)t){|mc{4mk6(tQ(Hw~&~=39~Y{(HVDA3H%_=`2ob
z3Xv?&&VLeHjpXlNyJiCD8AUL_5^d*XSD@Q#nCxtdiVAU@cySk!tdqRlKZ81qGeo|g
zmuHBY89FC{pYM30@Y0c+nCkk8RM!x}W(B#Wx9PguJppSnbG(vWP|*=!VDldz{An>0
zG9Vu!KdkGLm%0SqF9|{01Ax15Pl_U%Q=z8PYQC0meGEXD(Fl5aX4_)tWOK$_nW6KZ
zOW)JI4gAAL)7eUMh8NlaK$0jRMZ)!|;OHEhLAMK9Fzj=&;=9w5vb7*L*cRMugZ1j3
za9ZBQf<NcegY^%bGS8o}af|)z!kJE(%GND=I=L+{ZVhkTJ)f+jdC)}wgWys>AlF@$
zJ0Vld8acx&pf{V?CB!ttyW3@B;ln$Fy8GGfr;l^8U4bE2@|!#Bw$`-qciIjEtm76k
z!zeml>=OOK<mscn1tf2*0Y6d7*ii$Dr2DFk{oTQKvRwBG@`Y7h`mJ%!G))`|xlePM
zG+pllhbobAK}Dcr3(kBpA{Bp5Zh=b&ya}P%LQwLFU=3(5)O>a`F`^t72O7p)U0s{d
z`u8T?bq+Qgbtb_yzMC?ya<DwbE13K>hyIQd!%=_Nu%9}D!~KQ9B2KjvVU3Gt^7X=J
zBRg_f`3v1gBTo(?-pCynt(<XmfTSCSt$o4<X%Y53p#cecFx7Q87s2)>o_rN}+!K$H
zuSRTIl=ONpIS1C*^WEWXcK8z!Y-YdwxV*T%n~C3V&QI?ySV*2<TwUB<2=zee7woPi
zVM9C8Wd3ok6n1=mA`SOA_K5`Wya!ho`%XU*D=<-?x~eqmL7bMKpNf+C>!}!_7ZK;B
zR&$3@!`|Fa#BKLi_0(HJv#!b<E$f4*y#sdjG|V<}@kGR0X<eW_Etd7_Fov8H_B0$N
zj(zIhcDtzC3){O3wuQx0ZvzZ|>U{u49@8TFT)A_6E5PDRrogFXIfyeUXBV7(;onkW
z^D(}MKBE%Z?i@p%Lk?<Um2X{R-)+EpjCG7pe<{V0S5b_lh8B~44pYSP??4ZKq$g-q
zVmq{g9Y~#f&^F33o~&9uzGgNV2P+z>X$+f^)PBpohhil1=;EZF97j<1Ep?{6X5#$7
zt0NlK@@%;z#5pHt^1CJYjYgx0q!&jVIc>wOX^>d=QY4k|L*Xu+Ud}m(QzbzQq#0GG
z+b&}+siTST0zlgj#P&OV4?^BWEqpdVr%l*mfC*VA={mv@J-@Dn)Cykh_5$A&)K2NQ
znuPb|zE|n)P2hxg*3D?7tgk(?<A!~t4{hMb9rBFgJ6-kVkoB02MsB042nTc*3~ixy
zgB$?eyya)5=QgxWmAv$Hr_nm5T;SW5xTKbfK>_`<%f;Dw_@b?opg`3Ipr@9oR{4>b
zcRQ%v4lXk-HW0obXH8H?XBx6?_obk{M7xV3JC^B2UR{oF2a)OnQAVGZdUXkCk^?kY
zL+4fhe&a_HZ}jS=3d@3Et4;<}y+`BR<aamz#qOfhH~kQa7r6u?-3R#v_=Yz8-oB%a
z?^^eLZQo^Zsg4@#77qq_)w~(~y@l>g7xaC>05hKNgQT$948M-BO+BaL=X-t_&^X$q
z{oNuEJa*)d2+N{u;HTgh^%?!QW2kr^-BeaAPC20TUbZ%hskRB^MQyerJL;WWx)7;;
z8b6{9J;a!X5*9g`28N^Ymm3sPokQ06f=AXTwH5+CoqxYHDFv-@KG2uXro%}V=mU44
zw{T$<aT6e>Q1>LX1AaDlVCEb#Ka^Nls50nz(~e2|(&A2<4u<g)y(Y<CIbmk7W?;DZ
z#%by^SHfs3kX>A;Xa{)kO?u|OQA;N+0lk{+*cs-_d}J?vB^0MkN<)T4y(`*0GGmiW
z04kFlQ!?C|+_giWyV1S!)(&(RJGy6=RbTh$svg5ggSaO~Ikg~>aOT1D12u_u={8oq
z=~Pr6LF$t0CZ;7XBSJbD*g?kCVhm3BTfUk!&)0l4a60krt9V~s%ZF9Xj`L%rUg-&v
z9H$1UQ1#}v+6`D%nu5j6G`>dl7!tON3cGHnV1pW$eJx959lzfZ+O4UmABKAk0V!^6
z&K11Y@lDvfc+!G7kVn~xpZCZzVJ8wR1)i>aEr6)VLK(<q?I~eS>`<Upg;p0FFVunG
zG;a)f;{M^gK}POgFin5&T2G$d*u2we4R&zD1{><Mx2v56KDb%SDGCftJFK^W5=T|4
zP5@9Bj8I|GoFXO%3a|T`%$<4aE>&ja9)%6tc&FT3Ox(*$-nhKGN$Z2@9m5Qs8*Uug
z3)iK4(tJ+wICK!44c=%sM-b>_zfN~eP^zuEhkx;bZh74VTgK+%!*V7r&X!ctOHSWk
zsSL`+I9j9r9`UZ2A=JpxOQ~6rPDWry&RzBeePCY}C*xT4R$=#?Qi{uS@#>2;T*M`H
zFt7HnZJL!apy^=)Kod4^7${x&LeuW$F7-`iC!K>wdXY5(m^T2r{cf#X58nJiqfT%X
zwr01(2zN!D{M)+7y&}S?HE8z$p;UL7J&9UNOlY6syDYG6Zu1i4QpMzM14zDiyUU1}
z{8AR8+X0vduTwghLCE<o$L;`jX{#pR!o-d0OwCmy!95ILnQ~0ku!$3skZ{=+eU+}D
z)`_KUo<^3OGwqVrt4sz&6gg_HNN+P+Y{lrnxOa>D(X*xxC-vq;4-IE+as9syEBKyM
zYbDVwNg;-tRN9nx_%0sX{;I%Hpf^;QD{wfo-hveLIKDSYDeNREcQj#uQKem-8Anan
zaPxgzf|e}y)gtcY_ETRg0^@@6Jby<UfQR~0U)rYBd0~Ch2CpLumzmA0p1GIC*nZjG
zPcr=_Rl~lV)@x7PGbG-Vuc-T2pG}<Ca6D{(_pEX64D=fHuSrNXx>l!lL~X`LJbobe
zIqppoG?xoJU(G8L)VEkE;%AuFKt?5xBb+~7o}Y;Y7AQ`9n~_f90o^1xtOVH=JrX)$
z+peZnE;awQuXFa9qkL?!r7^2_XxLC8<=N%+xM~%U1zf5U>)pX^Z^5PeQrm9d2VR0>
z9aM>C{y#FUz0*q24L^|KPQ3)XQ}7k$q)>cQj7@e|xRsft@KC#FI=)o{gdcZw3Y?RH
z=YX%(#wATpk2&MeHW8iygkanEzGe83#mx14_$q6))p&w+sUAVh+nxvlt{<8$s_p#e
zgahn0g=OuqZRpjT%pG<fz`#BP-*RP0)3ca5Lxp}sK`*Ps7vAgLK-XeckMMPV+_@$l
zD;pkhOw^2dN~-}IMYB;B#_iFg;>=3Q56i}Okn8a-PB$KEBxh^1>F7B}DHiWjdU@-W
zIE^zl@JSvla=|<{TRc@_m!QenSw#aNasYf%=NT6NnF<6MN%pf}PX&6abX8aC7jbZ!
z7>3R5utmI<bL|EJkW=I<plicg!DenyOC1YJ($KjMh62DFnGwIdk}ES7Qo&>9u=hyV
z={F79#Ar0=Y4;jTe1U^DuE@{#&UT%*iCs~l&?x4@1EMNl(14+Kn*LQPtyIV6#dnmZ
z(0U2Wj2#yk1g$vu;u~rDlkai8RruHxWJ?+`;x!ix+P)PgY`z`7A%?n%V_b`0kr$%Q
z&AO~i3~{z?#V4&W4;g{A1>Q!isj`^`#nSdQsaBAOF9hmg%pK3CAbd|FM&Qe!kDiF&
zH6o0xQ{nkt9nCqO*fM^oe}<naxF78n5OJ_Btp2p$BBZhn88uWm-MlG<(woF5Ys<d?
z#NUFxedHdm;A>=LRIzaU(bzqMEQXDaBTrki1fIS0Sp&y7N|0P&Ui?308AJAVjQ{{q
Cpmy;9


From 11fda89b520cc8d1ce30cdba36bd10355cf025cc Mon Sep 17 00:00:00 2001
From: hugocasa <hugo@casademont.ch>
Date: Mon, 20 Jul 2026 20:56:57 +0200
Subject: [PATCH 073/171] feat(telemetry): generic feature-usage telemetry with
 AI session metrics (#10200)

* feat(telemetry): add generic feature_usage table and batched logging endpoint

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat(telemetry): log AI session usage events and document them in telemetry settings

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(telemetry): use escape sequence instead of literal NUL bytes in buffer key

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(telemetry): validate dimensions, decouple retention, keepalive flush

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(telemetry): allowlist feature-usage dimensions and index retention scans

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(telemetry): pin tool-name allowlist and deploy session attribution

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* refactor(telemetry): route AI chat usage through feature_usage and drop ai_chat_usage

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* refactor(telemetry): slim dimension validation to registered kinds plus key shape

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(telemetry): backfill ai_chat_usage into feature_usage before dropping it

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(telemetry): disclose provider and model identifiers in telemetry settings text

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(telemetry): issue all flush chunks before awaiting so pagehide keeps them

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* chore: update ee-repo-ref to 6306c072a50937ea9af44a5bcf42345543207486

This commit updates the EE repository reference after PR #672 was merged in windmill-ee-private.

Previous ee-repo-ref: 964f242a0eb44db7f7d26636cc8d76aeabea2b73

New ee-repo-ref: 6306c072a50937ea9af44a5bcf42345543207486

Automated by sync-ee-ref workflow.

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
---
 ...b5014e1c889ba9181ee3331f128c56c9d22de.json |  12 ++
 ...42bcbf66f0cc5900c7777141df47776e32fa3.json |  18 +++
 ...83030e7a7ce32971a5621aceb738a3673f943.json |  44 ------
 ...86122e4ceb34cc8993937dff24cdd7ba3fe5f.json |  12 --
 ...d523ec2219920a64783cd5d2972f1826114cc.json |  17 ---
 ...3f75fb05a27ee759972b76e812b70843eb5e4.json |  62 ++++++++
 backend/ee-repo-ref.txt                       |   2 +-
 .../20260720081307_add_feature_usage.down.sql |   1 +
 .../20260720081307_add_feature_usage.up.sql   |  17 +++
 ...20260720094300_drop_ai_chat_usage.down.sql |  11 ++
 .../20260720094300_drop_ai_chat_usage.up.sql  |  22 +++
 backend/src/monitor.rs                        |  10 ++
 .../windmill-api-workspaces/src/workspaces.rs |  99 +++++++++++--
 backend/windmill-api/openapi.yaml             |  37 +++--
 .../lib/components/InstanceSettings.svelte    |   6 +-
 .../copilot/chat/AIChatManager.svelte.ts      |  42 ++++--
 .../copilot/chat/AIChatManager.test.ts        |   5 +-
 .../src/lib/components/copilot/chat/shared.ts |   6 +
 .../sessions/sessionDeployModel.svelte.ts     |  10 ++
 .../sessions/sessionPreviewTabs.svelte.ts     |   4 +
 .../sessions/sessionRuntime.svelte.ts         |  19 ++-
 .../sessions/sessionState.svelte.ts           |  15 +-
 frontend/src/lib/utils/featureUsage.test.ts   |  80 ++++++++++
 frontend/src/lib/utils/featureUsage.ts        | 137 ++++++++++++++++++
 24 files changed, 566 insertions(+), 122 deletions(-)
 create mode 100644 backend/.sqlx/query-0390d9e4fae597aabdeef940aa5b5014e1c889ba9181ee3331f128c56c9d22de.json
 create mode 100644 backend/.sqlx/query-2cdb9076747b61c01b6d389157e42bcbf66f0cc5900c7777141df47776e32fa3.json
 delete mode 100644 backend/.sqlx/query-3ec92c1682f3ce701028f66f7ce83030e7a7ce32971a5621aceb738a3673f943.json
 delete mode 100644 backend/.sqlx/query-98746829ab854dff922a04822bc86122e4ceb34cc8993937dff24cdd7ba3fe5f.json
 delete mode 100644 backend/.sqlx/query-b64f0f337aed44840cd68f4c81bd523ec2219920a64783cd5d2972f1826114cc.json
 create mode 100644 backend/.sqlx/query-c3a973b0eea69be747140426cd03f75fb05a27ee759972b76e812b70843eb5e4.json
 create mode 100644 backend/migrations/20260720081307_add_feature_usage.down.sql
 create mode 100644 backend/migrations/20260720081307_add_feature_usage.up.sql
 create mode 100644 backend/migrations/20260720094300_drop_ai_chat_usage.down.sql
 create mode 100644 backend/migrations/20260720094300_drop_ai_chat_usage.up.sql
 create mode 100644 frontend/src/lib/utils/featureUsage.test.ts
 create mode 100644 frontend/src/lib/utils/featureUsage.ts

diff --git a/backend/.sqlx/query-0390d9e4fae597aabdeef940aa5b5014e1c889ba9181ee3331f128c56c9d22de.json b/backend/.sqlx/query-0390d9e4fae597aabdeef940aa5b5014e1c889ba9181ee3331f128c56c9d22de.json
new file mode 100644
index 0000000000..bacf0f76c2
--- /dev/null
+++ b/backend/.sqlx/query-0390d9e4fae597aabdeef940aa5b5014e1c889ba9181ee3331f128c56c9d22de.json
@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM feature_usage WHERE day < CURRENT_DATE - 60",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "0390d9e4fae597aabdeef940aa5b5014e1c889ba9181ee3331f128c56c9d22de"
+}
diff --git a/backend/.sqlx/query-2cdb9076747b61c01b6d389157e42bcbf66f0cc5900c7777141df47776e32fa3.json b/backend/.sqlx/query-2cdb9076747b61c01b6d389157e42bcbf66f0cc5900c7777141df47776e32fa3.json
new file mode 100644
index 0000000000..2a67e64615
--- /dev/null
+++ b/backend/.sqlx/query-2cdb9076747b61c01b6d389157e42bcbf66f0cc5900c7777141df47776e32fa3.json
@@ -0,0 +1,18 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO feature_usage (feature, kind, key, entity_id, value)\n         SELECT * FROM UNNEST($1::text[], $2::text[], $3::text[], $4::text[], $5::bigint[])\n         ON CONFLICT (feature, kind, key, entity_id, day)\n         DO UPDATE SET value = feature_usage.value + EXCLUDED.value, updated_at = now()",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "TextArray",
+        "TextArray",
+        "TextArray",
+        "TextArray",
+        "Int8Array"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "2cdb9076747b61c01b6d389157e42bcbf66f0cc5900c7777141df47776e32fa3"
+}
diff --git a/backend/.sqlx/query-3ec92c1682f3ce701028f66f7ce83030e7a7ce32971a5621aceb738a3673f943.json b/backend/.sqlx/query-3ec92c1682f3ce701028f66f7ce83030e7a7ce32971a5621aceb738a3673f943.json
deleted file mode 100644
index 3d91feace1..0000000000
--- a/backend/.sqlx/query-3ec92c1682f3ce701028f66f7ce83030e7a7ce32971a5621aceb738a3673f943.json
+++ /dev/null
@@ -1,44 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        SELECT provider, model, mode,\n               COUNT(*)::BIGINT as \"session_count!\",\n               COALESCE(SUM(message_count), 0)::BIGINT as \"message_count!\"\n        FROM ai_chat_usage\n        WHERE created_at > NOW() - INTERVAL '30 days'\n        GROUP BY provider, model, mode\n        ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "provider",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 1,
-        "name": "model",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 2,
-        "name": "mode",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 3,
-        "name": "session_count!",
-        "type_info": "Int8"
-      },
-      {
-        "ordinal": 4,
-        "name": "message_count!",
-        "type_info": "Int8"
-      }
-    ],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": [
-      false,
-      false,
-      false,
-      null,
-      null
-    ]
-  },
-  "hash": "3ec92c1682f3ce701028f66f7ce83030e7a7ce32971a5621aceb738a3673f943"
-}
diff --git a/backend/.sqlx/query-98746829ab854dff922a04822bc86122e4ceb34cc8993937dff24cdd7ba3fe5f.json b/backend/.sqlx/query-98746829ab854dff922a04822bc86122e4ceb34cc8993937dff24cdd7ba3fe5f.json
deleted file mode 100644
index 58f8729225..0000000000
--- a/backend/.sqlx/query-98746829ab854dff922a04822bc86122e4ceb34cc8993937dff24cdd7ba3fe5f.json
+++ /dev/null
@@ -1,12 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "DELETE FROM ai_chat_usage WHERE created_at < NOW() - INTERVAL '60 days'",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": []
-  },
-  "hash": "98746829ab854dff922a04822bc86122e4ceb34cc8993937dff24cdd7ba3fe5f"
-}
diff --git a/backend/.sqlx/query-b64f0f337aed44840cd68f4c81bd523ec2219920a64783cd5d2972f1826114cc.json b/backend/.sqlx/query-b64f0f337aed44840cd68f4c81bd523ec2219920a64783cd5d2972f1826114cc.json
deleted file mode 100644
index ed4288ea5c..0000000000
--- a/backend/.sqlx/query-b64f0f337aed44840cd68f4c81bd523ec2219920a64783cd5d2972f1826114cc.json
+++ /dev/null
@@ -1,17 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO ai_chat_usage (session_id, provider, model, mode) VALUES ($1, $2, $3, $4)\n         ON CONFLICT (session_id) DO UPDATE SET message_count = ai_chat_usage.message_count + 1",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Varchar",
-        "Varchar",
-        "Varchar"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "b64f0f337aed44840cd68f4c81bd523ec2219920a64783cd5d2972f1826114cc"
-}
diff --git a/backend/.sqlx/query-c3a973b0eea69be747140426cd03f75fb05a27ee759972b76e812b70843eb5e4.json b/backend/.sqlx/query-c3a973b0eea69be747140426cd03f75fb05a27ee759972b76e812b70843eb5e4.json
new file mode 100644
index 0000000000..fa96843cc9
--- /dev/null
+++ b/backend/.sqlx/query-c3a973b0eea69be747140426cd03f75fb05a27ee759972b76e812b70843eb5e4.json
@@ -0,0 +1,62 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        WITH per_entity AS (\n            SELECT feature, kind, key, entity_id,\n                   SUM(value)::BIGINT AS value,\n                   MAX(day) AS last_day\n            FROM feature_usage\n            WHERE day > CURRENT_DATE - 30\n            GROUP BY feature, kind, key, entity_id\n        )\n        SELECT feature, kind, key,\n               COUNT(*)::BIGINT AS \"entity_count!\",\n               COALESCE(SUM(value), 0)::BIGINT AS \"total_value!\",\n               COALESCE(PERCENTILE_CONT(0.5) WITHIN GROUP (ORDER BY value), 0)::DOUBLE PRECISION AS \"median_value!\",\n               COALESCE(PERCENTILE_CONT(0.9) WITHIN GROUP (ORDER BY value), 0)::DOUBLE PRECISION AS \"p90_value!\",\n               (COUNT(*) FILTER (WHERE last_day < CURRENT_DATE - 3))::BIGINT AS \"inactive_3d_entity_count!\"\n        FROM per_entity\n        GROUP BY feature, kind, key\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "feature",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "kind",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "key",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 3,
+        "name": "entity_count!",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 4,
+        "name": "total_value!",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 5,
+        "name": "median_value!",
+        "type_info": "Float8"
+      },
+      {
+        "ordinal": 6,
+        "name": "p90_value!",
+        "type_info": "Float8"
+      },
+      {
+        "ordinal": 7,
+        "name": "inactive_3d_entity_count!",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      false,
+      false,
+      false,
+      null,
+      null,
+      null,
+      null,
+      null
+    ]
+  },
+  "hash": "c3a973b0eea69be747140426cd03f75fb05a27ee759972b76e812b70843eb5e4"
+}
diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index dcb517e0eb..1a8edeed9c 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-a3adea1ffb406e709cc480871df58fab6c51aca1
+6306c072a50937ea9af44a5bcf42345543207486
diff --git a/backend/migrations/20260720081307_add_feature_usage.down.sql b/backend/migrations/20260720081307_add_feature_usage.down.sql
new file mode 100644
index 0000000000..1b12797d72
--- /dev/null
+++ b/backend/migrations/20260720081307_add_feature_usage.down.sql
@@ -0,0 +1 @@
+DROP TABLE feature_usage;
diff --git a/backend/migrations/20260720081307_add_feature_usage.up.sql b/backend/migrations/20260720081307_add_feature_usage.up.sql
new file mode 100644
index 0000000000..6d17777b97
--- /dev/null
+++ b/backend/migrations/20260720081307_add_feature_usage.up.sql
@@ -0,0 +1,17 @@
+-- Generic product-telemetry accumulator: day-bucketed counters (entity_id = '')
+-- and per-entity accumulators (e.g. messages per AI session). Aggregated into
+-- the anonymous usage stats payload and pruned after 60 days.
+CREATE TABLE feature_usage (
+    feature VARCHAR(50) NOT NULL,
+    kind VARCHAR(50) NOT NULL,
+    key VARCHAR(100) NOT NULL DEFAULT '',
+    entity_id VARCHAR(50) NOT NULL DEFAULT '',
+    day DATE NOT NULL DEFAULT CURRENT_DATE,
+    value BIGINT NOT NULL DEFAULT 0,
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    PRIMARY KEY (feature, kind, key, entity_id, day)
+);
+
+-- The periodic retention delete filters on day alone; without this it would
+-- full-scan the table (the PK only reaches day through four other columns).
+CREATE INDEX idx_feature_usage_day ON feature_usage (day);
diff --git a/backend/migrations/20260720094300_drop_ai_chat_usage.down.sql b/backend/migrations/20260720094300_drop_ai_chat_usage.down.sql
new file mode 100644
index 0000000000..f4b3030011
--- /dev/null
+++ b/backend/migrations/20260720094300_drop_ai_chat_usage.down.sql
@@ -0,0 +1,11 @@
+CREATE TABLE IF NOT EXISTS ai_chat_usage (
+    id BIGSERIAL PRIMARY KEY,
+    session_id VARCHAR(36) NOT NULL UNIQUE,
+    provider VARCHAR(50) NOT NULL,
+    model VARCHAR(255) NOT NULL,
+    mode VARCHAR(50) NOT NULL,
+    message_count INT NOT NULL DEFAULT 1,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_ai_chat_usage_created_at ON ai_chat_usage (created_at);
diff --git a/backend/migrations/20260720094300_drop_ai_chat_usage.up.sql b/backend/migrations/20260720094300_drop_ai_chat_usage.up.sql
new file mode 100644
index 0000000000..7c72379b4f
--- /dev/null
+++ b/backend/migrations/20260720094300_drop_ai_chat_usage.up.sql
@@ -0,0 +1,22 @@
+-- AI chat usage telemetry now flows through the generic feature_usage table
+-- (ai_chat/message and ai_chat/model events). Backfill the accumulated rows so
+-- no reporting window is lost, then drop the old table. Day-bucketing uses the
+-- chat's first-message date; values are filtered to the identifier shape the
+-- logging endpoint enforces.
+INSERT INTO feature_usage (feature, kind, key, entity_id, day, value, updated_at)
+SELECT 'ai_chat', 'message', mode, session_id, created_at::date, message_count, created_at
+FROM ai_chat_usage
+WHERE mode ~ '^[A-Za-z0-9_:./-]{1,100}$'
+  AND session_id ~ '^[A-Za-z0-9_:./-]{1,50}$'
+ON CONFLICT (feature, kind, key, entity_id, day)
+DO UPDATE SET value = feature_usage.value + EXCLUDED.value;
+
+INSERT INTO feature_usage (feature, kind, key, entity_id, day, value, updated_at)
+SELECT 'ai_chat', 'model', provider || ':' || model, session_id, created_at::date, message_count, created_at
+FROM ai_chat_usage
+WHERE (provider || ':' || model) ~ '^[A-Za-z0-9_:./-]{1,100}$'
+  AND session_id ~ '^[A-Za-z0-9_:./-]{1,50}$'
+ON CONFLICT (feature, kind, key, entity_id, day)
+DO UPDATE SET value = feature_usage.value + EXCLUDED.value;
+
+DROP TABLE ai_chat_usage;
diff --git a/backend/src/monitor.rs b/backend/src/monitor.rs
index 58af60c525..86f26aeb33 100644
--- a/backend/src/monitor.rs
+++ b/backend/src/monitor.rs
@@ -1362,6 +1362,16 @@ pub async fn delete_expired_items(db: &DB) -> () {
         tracing::error!("Error reaping stale join_pending_inputs slots: {:?}", e);
     }
 
+    // 60-day retention for anonymous feature-usage counters. Runs here (not only
+    // in the telemetry sender) so rows are pruned even when telemetry is disabled
+    // or the build has no stats scheduler.
+    if let Err(e) = sqlx::query!("DELETE FROM feature_usage WHERE day < CURRENT_DATE - 60")
+        .execute(db)
+        .await
+    {
+        tracing::error!("Error deleting old feature_usage rows: {e}");
+    }
+
     match sqlx::query_scalar!(
         "DELETE FROM agent_token_blacklist WHERE expires_at <= now() RETURNING token",
     )
diff --git a/backend/windmill-api-workspaces/src/workspaces.rs b/backend/windmill-api-workspaces/src/workspaces.rs
index 74b31c1410..7b5ff16bb1 100644
--- a/backend/windmill-api-workspaces/src/workspaces.rs
+++ b/backend/windmill-api-workspaces/src/workspaces.rs
@@ -199,7 +199,7 @@ pub fn workspaced_service() -> Router {
             "/protection_rules/{rule_name}",
             post(update_protection_rule).delete(delete_protection_rule),
         )
-        .route("/log_chat", post(log_ai_chat))
+        .route("/log_feature_usage", post(log_feature_usage))
         .route("/cloud_quotas", get(get_cloud_quotas))
         .route("/prune_versions", post(prune_versions))
         .route("/list_ws_specific", get(list_ws_specific))
@@ -9559,25 +9559,96 @@ const TRIGGER_OR_SCHEDULE_TABLES: &[&str] = &[
     "email_trigger",
 ];
 
+const MAX_FEATURE_USAGE_EVENTS: usize = 50;
+
 #[derive(Deserialize)]
-struct LogAiChatPayload {
-    session_id: String,
-    provider: String,
-    model: String,
-    mode: String,
+struct FeatureUsageEvent {
+    feature: String,
+    kind: String,
+    #[serde(default)]
+    key: String,
+    #[serde(default)]
+    entity_id: String,
+    value: Option<i64>,
 }
 
-async fn log_ai_chat(
+#[derive(Deserialize)]
+struct LogFeatureUsagePayload {
+    events: Vec<FeatureUsageEvent>,
+}
+
+// Only registered (feature, kind) actions are accepted, so telemetry stays
+// limited to predefined feature actions. Keys are shape-checked (identifier-like,
+// no spaces) rather than pinned to value sets: they come from our own frontend
+// (modes, tab/draft kinds, tool names, provider:model) and pinning every value
+// server-side was not worth the maintenance.
+const FEATURE_USAGE_KINDS: &[(&str, &str)] = &[
+    ("ai_session", "created"),
+    ("ai_session", "message"),
+    ("ai_session", "autonomy"),
+    ("ai_session", "tab"),
+    ("ai_session", "tokens"),
+    ("ai_session", "deployed"),
+    ("ai_session", "archived"),
+    ("ai_session", "deleted"),
+    ("ai_chat", "message"),
+    ("ai_chat", "model"),
+    ("ai_chat", "tool"),
+];
+
+fn is_identifier_shaped(s: &str, max_len: usize) -> bool {
+    !s.is_empty()
+        && s.len() <= max_len
+        && s.chars()
+            .all(|c| c.is_ascii_alphanumeric() || matches!(c, '_' | '-' | ':' | '.' | '/'))
+}
+
+fn valid_feature_usage_event(e: &FeatureUsageEvent) -> bool {
+    FEATURE_USAGE_KINDS.contains(&(e.feature.as_str(), e.kind.as_str()))
+        && (e.key.is_empty() || is_identifier_shaped(&e.key, 100))
+        && (e.entity_id.is_empty() || is_identifier_shaped(&e.entity_id, 50))
+}
+
+async fn log_feature_usage(
     Extension(db): Extension<DB>,
-    Json(payload): Json<LogAiChatPayload>,
+    Json(payload): Json<LogFeatureUsagePayload>,
 ) -> Result<StatusCode> {
+    // Pre-sum duplicate keys: two rows hitting the same conflict target in a
+    // single INSERT error out ("cannot affect row a second time").
+    let mut agg: HashMap<(String, String, String, String), i64> = HashMap::new();
+    for e in payload.events.into_iter().take(MAX_FEATURE_USAGE_EVENTS) {
+        if !valid_feature_usage_event(&e) {
+            continue;
+        }
+        let value = e.value.unwrap_or(1).clamp(1, 1_000_000);
+        *agg.entry((e.feature, e.kind, e.key, e.entity_id))
+            .or_insert(0) += value;
+    }
+    if agg.is_empty() {
+        return Ok(StatusCode::NO_CONTENT);
+    }
+    let mut features = Vec::with_capacity(agg.len());
+    let mut kinds = Vec::with_capacity(agg.len());
+    let mut keys = Vec::with_capacity(agg.len());
+    let mut entity_ids = Vec::with_capacity(agg.len());
+    let mut values = Vec::with_capacity(agg.len());
+    for ((feature, kind, key, entity_id), value) in agg {
+        features.push(feature);
+        kinds.push(kind);
+        keys.push(key);
+        entity_ids.push(entity_id);
+        values.push(value);
+    }
     sqlx::query!(
-        "INSERT INTO ai_chat_usage (session_id, provider, model, mode) VALUES ($1, $2, $3, $4)
-         ON CONFLICT (session_id) DO UPDATE SET message_count = ai_chat_usage.message_count + 1",
-        &payload.session_id,
-        &payload.provider,
-        &payload.model,
-        &payload.mode
+        "INSERT INTO feature_usage (feature, kind, key, entity_id, value)
+         SELECT * FROM UNNEST($1::text[], $2::text[], $3::text[], $4::text[], $5::bigint[])
+         ON CONFLICT (feature, kind, key, entity_id, day)
+         DO UPDATE SET value = feature_usage.value + EXCLUDED.value, updated_at = now()",
+        &features,
+        &kinds,
+        &keys,
+        &entity_ids,
+        &values
     )
     .execute(&db)
     .await?;
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index e5bc24d360..883ab5ec74 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -6505,10 +6505,10 @@ paths:
         "400":
           description: invalid input or request closed
 
-  /w/{workspace}/workspaces/log_chat:
+  /w/{workspace}/workspaces/log_feature_usage:
     post:
-      summary: log AI chat message
-      operationId: logAiChat
+      summary: log anonymous feature usage telemetry events
+      operationId: logFeatureUsage
       tags:
         - workspace
       parameters:
@@ -6520,19 +6520,26 @@ paths:
             schema:
               type: object
               required:
-                - session_id
-                - provider
-                - model
-                - mode
+                - events
               properties:
-                session_id:
-                  type: string
-                provider:
-                  type: string
-                model:
-                  type: string
-                mode:
-                  type: string
+                events:
+                  type: array
+                  items:
+                    type: object
+                    required:
+                      - feature
+                      - kind
+                    properties:
+                      feature:
+                        type: string
+                      kind:
+                        type: string
+                      key:
+                        type: string
+                      entity_id:
+                        type: string
+                      value:
+                        type: integer
       responses:
         "204":
           description: logged
diff --git a/frontend/src/lib/components/InstanceSettings.svelte b/frontend/src/lib/components/InstanceSettings.svelte
index b3d0ee1446..13a7a41ccd 100644
--- a/frontend/src/lib/components/InstanceSettings.svelte
+++ b/frontend/src/lib/components/InstanceSettings.svelte
@@ -1061,7 +1061,8 @@
 						<li>job usage (language, total duration, count)</li>
 						<li>git sync repo count (sync vs promotion mode)</li>
 						<li
-							>AI chat usage (provider, model, mode, session count, message count — last 30 days)</li
+							>feature usage telemetry: aggregated AI chat and AI session usage counts, including AI
+							provider and model identifiers (last 30 days)</li
 						>
 						<li
 							>resource counts (workspaces, scripts per language, flows, workflows as code, low-code
@@ -1107,7 +1108,8 @@
 						<li>user usage (author count, operator count)</li>
 						<li>development instance status</li>
 						<li
-							>AI chat usage (provider, model, mode, session count, message count — last 30 days)</li
+							>feature usage telemetry: aggregated AI chat and AI session usage counts, including AI
+							provider and model identifiers (last 30 days)</li
 						>
 						<li
 							>resource counts (workspaces, scripts per language, flows, workflows as code, low-code
diff --git a/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts b/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
index b9649200ab..6e07271a60 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
+++ b/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
@@ -1,5 +1,5 @@
 import type { ScriptLang } from '$lib/gen/types.gen'
-import { WorkspaceService, JobService, type CompletedJob } from '$lib/gen'
+import { JobService, type CompletedJob } from '$lib/gen'
 import type { FlowOptions, ScriptOptions } from './ContextManager.svelte'
 import {
 	flowTools,
@@ -45,6 +45,7 @@ import { prepareScriptUserMessage } from './script/core'
 import { prepareNavigatorUserMessage } from './navigator/core'
 import { sendUserToast } from '$lib/toast'
 import { workspaceAIClients, getNonStreamingCompletion } from '../lib'
+import { logFeatureUsage } from '$lib/utils/featureUsage'
 import { modelSupportsVision } from '../modelConfig'
 import { getKnownModelContextWindow } from '../modelConfig'
 import {
@@ -2078,6 +2079,13 @@ export class AIChatManager {
 					}
 				}
 			})
+			if (this.isSessionChat && this.sessionId && result.tokenUsage.total > 0) {
+				logFeatureUsage('ai_session', 'tokens', {
+					entityId: this.sessionId,
+					value: result.tokenUsage.total,
+					workspace: this.operatingWorkspace
+				})
+			}
 			return result
 		} catch (err) {
 			console.log('chatRequest error', err)
@@ -2435,15 +2443,29 @@ export class AIChatManager {
 
 			const model = tryGetCurrentModel()
 			if (model) {
-				WorkspaceService.logAiChat({
-					workspace: this.operatingWorkspace ?? '',
-					requestBody: {
-						session_id: this.historyManager.getCurrentChatId(),
-						provider: model.provider,
-						model: model.model,
-						mode: this.mode
-					}
-				}).catch(() => {})
+				const chatId = this.historyManager.getCurrentChatId()
+				logFeatureUsage('ai_chat', 'message', {
+					key: this.mode,
+					entityId: chatId,
+					workspace: this.operatingWorkspace
+				})
+				logFeatureUsage('ai_chat', 'model', {
+					key: `${model.provider}:${model.model}`,
+					entityId: chatId,
+					workspace: this.operatingWorkspace
+				})
+			}
+			if (this.isSessionChat && this.sessionId) {
+				logFeatureUsage('ai_session', 'message', {
+					key: this.mode,
+					entityId: this.sessionId,
+					workspace: this.operatingWorkspace
+				})
+				logFeatureUsage('ai_session', 'autonomy', {
+					key: this.autonomyMode,
+					entityId: this.sessionId,
+					workspace: this.operatingWorkspace
+				})
 			}
 
 			if (this.mode === AIMode.FLOW && !this.flowAiChatHelpers) {
diff --git a/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts b/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts
index 55bea0d7e6..ba6508e87c 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts
+++ b/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts
@@ -23,7 +23,6 @@ const mocks = vi.hoisted(() => ({
 	getCurrentModel: vi.fn(),
 	tryGetCurrentModel: vi.fn(),
 	isWebSearchEnabledForProvider: vi.fn(),
-	logAiChat: vi.fn(),
 	sendUserToast: vi.fn(),
 	getOpenaiClient: vi.fn(),
 	getAnthropicClient: vi.fn(),
@@ -38,9 +37,10 @@ vi.mock('monaco-editor', () => ({
 	Selection: class Selection {}
 }))
 
+vi.mock('$lib/utils/featureUsage', () => ({ logFeatureUsage: vi.fn() }))
+
 vi.mock('$lib/gen', () => ({
 	WorkspaceService: {
-		logAiChat: mocks.logAiChat,
 		listAiSkills: mocks.listAiSkills
 	},
 	ScriptService: {},
@@ -129,7 +129,6 @@ beforeEach(() => {
 	mocks.getCurrentModel.mockReturnValue(undefined)
 	mocks.tryGetCurrentModel.mockReturnValue(undefined)
 	mocks.isWebSearchEnabledForProvider.mockReturnValue(true)
-	mocks.logAiChat.mockResolvedValue(undefined)
 	mocks.getOpenaiClient.mockReturnValue({})
 	mocks.getAnthropicClient.mockReturnValue({})
 	mocks.listAiSkills.mockResolvedValue([])
diff --git a/frontend/src/lib/components/copilot/chat/shared.ts b/frontend/src/lib/components/copilot/chat/shared.ts
index e37ae1da7f..a1f79f181e 100644
--- a/frontend/src/lib/components/copilot/chat/shared.ts
+++ b/frontend/src/lib/components/copilot/chat/shared.ts
@@ -39,6 +39,7 @@ import {
 } from '$lib/gen'
 import uFuzzy from '@leeoniya/ufuzzy'
 import { emptyString } from '$lib/utils'
+import { logFeatureUsage } from '$lib/utils/featureUsage'
 import { forLater } from '$lib/forLater'
 import { scriptLangToEditorLang } from '$lib/scripts'
 import { getCurrentModel } from '$lib/aiStore'
@@ -763,6 +764,11 @@ export async function processToolCall<T>({
 		}
 
 		let result = ''
+		// Key by the resolved tool's declared name, not the model-provided string,
+		// so hallucinated tool names never enter telemetry.
+		if (tool) {
+			logFeatureUsage('ai_chat', 'tool', { key: tool.def.function.name, workspace: workspaceId })
+		}
 		try {
 			result = await callTool({
 				tools,
diff --git a/frontend/src/lib/components/sessions/sessionDeployModel.svelte.ts b/frontend/src/lib/components/sessions/sessionDeployModel.svelte.ts
index 28f0075880..8332782cdf 100644
--- a/frontend/src/lib/components/sessions/sessionDeployModel.svelte.ts
+++ b/frontend/src/lib/components/sessions/sessionDeployModel.svelte.ts
@@ -23,6 +23,8 @@ import {
 	type DeployPlanEntry
 } from './sessionDeployModel'
 import { maskKey } from './modifiedItemsMask'
+import { sessionState } from './sessionState.svelte'
+import { logFeatureUsage } from '$lib/utils/featureUsage'
 
 export type DeploymentStatus = { status: 'loading' | 'failed'; error?: string }
 
@@ -261,6 +263,9 @@ export function useSessionDeployModel(getArgs: () => SessionDeployModelArgs) {
 	async function deployOne(item: DeployItem, discard = false): Promise<boolean> {
 		const plan = discard ? discardPlanFor(item) : deployPlanFor(item)
 		if (!plan) return false
+		// Snapshot before the await: the user may switch sessions while the
+		// deploy runs, and the event belongs to the initiating session.
+		const initiatingSessionId = sessionState.currentSessionId
 		// Don't attempt a deploy we know the user can't make (no write permission
 		// on the path, or blocked by the operator / deployer rule) — the UI
 		// disables it too; this is the guard behind that.
@@ -280,6 +285,11 @@ export function useSessionDeployModel(getArgs: () => SessionDeployModelArgs) {
 						.add(item.key)
 						.add(maskKey(item.draftKind, item.displayPath))
 					getArgs().onItemDeployed?.(item)
+					logFeatureUsage('ai_session', 'deployed', {
+						key: item.draftKind,
+						entityId: initiatingSessionId,
+						workspace: getArgs().workspaceId
+					})
 				}
 			}
 			return res.success
diff --git a/frontend/src/lib/components/sessions/sessionPreviewTabs.svelte.ts b/frontend/src/lib/components/sessions/sessionPreviewTabs.svelte.ts
index c88387d1b4..27b0dc2454 100644
--- a/frontend/src/lib/components/sessions/sessionPreviewTabs.svelte.ts
+++ b/frontend/src/lib/components/sessions/sessionPreviewTabs.svelte.ts
@@ -35,6 +35,9 @@ export type PreviewTabsAdapter = {
 	// Fired synchronously on every tab-set change, so the runtime can drop editor
 	// cells no open tab references anymore (a closed / navigated-away item).
 	onTabsChanged?: () => void
+	// Fired when open() creates a brand-new tab (not focus/retarget of an
+	// existing one), with the tab's initial URL.
+	onTabOpened?: (url: string) => void
 }
 
 // True when a tab's URL is the live editor for a specific editable item. Every
@@ -268,6 +271,7 @@ export class SessionPreviewTabs {
 		this.#tabs.push(tab)
 		this.#activeId = tab.id
 		this.#flush()
+		this.#adapter.onTabOpened?.(url)
 		return { status: 'opened' }
 	}
 
diff --git a/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts b/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts
index fa0dc52946..7b864e28e4 100644
--- a/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts
+++ b/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts
@@ -49,7 +49,13 @@ import {
 	previewTargetForSessionTarget,
 	selectPreviewTabsToClose
 } from './sessionPreviewTabs.svelte'
-import { matchPreviewPage, parsePreviewItemRoute, previewLocationLabel } from './previewRouter'
+import {
+	matchPreviewPage,
+	parsePreviewItemRoute,
+	previewLocationLabel,
+	resolvePreviewTab
+} from './previewRouter'
+import { logFeatureUsage } from '$lib/utils/featureUsage'
 import { UserDraft } from '$lib/userDraft.svelte'
 import { UserDraftDbSyncer } from '$lib/userDraftDbSyncer.svelte'
 import { armRestartOnFirstInteraction } from '$lib/userDraftToast'
@@ -432,7 +438,16 @@ function createRuntime(session: Session): SessionRuntime {
 			// Only persist a real width; undefined means "never resized" (defaults to 50).
 			if (snap.previewSize != null) setSessionPreviewSize(session.id, snap.previewSize)
 		},
-		onTabsChanged: pruneEditorCells
+		onTabsChanged: pruneEditorCells,
+		onTabOpened: (url) => {
+			const slot = resolvePreviewTab(url)
+			logFeatureUsage('ai_session', 'tab', {
+				key:
+					slot.kind === 'editor' ? slot.editorKind : slot.kind === 'artifact' ? 'artifact' : 'page',
+				entityId: session.id,
+				workspace: getEffectiveWorkspaceId(session)
+			})
+		}
 	})
 
 	// Let the jobs tray open a run in this session's preview panel (as an iframe
diff --git a/frontend/src/lib/components/sessions/sessionState.svelte.ts b/frontend/src/lib/components/sessions/sessionState.svelte.ts
index 1c38838787..26b90abd11 100644
--- a/frontend/src/lib/components/sessions/sessionState.svelte.ts
+++ b/frontend/src/lib/components/sessions/sessionState.svelte.ts
@@ -18,6 +18,7 @@ import {
 	protectionRulesState
 } from '$lib/workspaceProtectionRules.svelte'
 import { getLocalSetting, storeLocalSetting } from '$lib/utils'
+import { logFeatureUsage } from '$lib/utils/featureUsage'
 import { workspaceRootId } from './sessionScope.svelte'
 import { type DBSchema, type IDBPDatabase } from 'idb'
 import { userScopedDb } from '$lib/userScopedDb'
@@ -795,6 +796,7 @@ export async function commitSessionWorkspace(
 		// The draft prompt has been consumed as the first message.
 		delete s.draftPrompt
 		await putSession(s)
+		logFeatureUsage('ai_session', 'created', { key: 'fork', entityId: s.id, workspace: newId })
 		// The global workspaceStore is intentionally left untouched: the session
 		// chat targets its own workspace via AIChatManager.operatingWorkspace, so
 		// committing must not yank the user's active (navigation-mode) workspace.
@@ -809,6 +811,12 @@ export async function commitSessionWorkspace(
 	// The draft prompt has been consumed as the first message.
 	delete s.draftPrompt
 	await putSession(s)
+	// A picked workspace can itself be an existing fork — classify by root.
+	logFeatureUsage('ai_session', 'created', {
+		key: ws === s.workspace_root_id ? 'root' : 'fork',
+		entityId: s.id,
+		workspace: ws
+	})
 	// The global workspaceStore is intentionally left untouched (see the fork
 	// branch above): the session chat reads its committed workspace through the
 	// manager's workspace resolver, not the active workspaceStore.
@@ -958,8 +966,10 @@ export function setSessionArchived(id: string, archived: boolean) {
 	if (!s) return
 	const next = archived ? true : undefined
 	if (s.archived === next && (archived || !s.archivedByWorkspace)) return
-	if (archived) s.archived = true
-	else {
+	if (archived) {
+		s.archived = true
+		logFeatureUsage('ai_session', 'archived', { entityId: s.id, workspace: s.workspace_id })
+	} else {
 		delete s.archived
 		delete s.archivedByWorkspace
 	}
@@ -982,6 +992,7 @@ export function deleteSession(id: string) {
 	// GC any linked files and artifacts persisted for this session.
 	void deleteItemsForSession(id)
 	void deleteArtifactsForSession(id)
+	logFeatureUsage('ai_session', 'deleted', { entityId: id, workspace: s.workspace_id })
 }
 
 export function setSessionChatId(sessionId: string, chatId: string) {
diff --git a/frontend/src/lib/utils/featureUsage.test.ts b/frontend/src/lib/utils/featureUsage.test.ts
new file mode 100644
index 0000000000..3e13ff17d7
--- /dev/null
+++ b/frontend/src/lib/utils/featureUsage.test.ts
@@ -0,0 +1,80 @@
+import { describe, expect, it, vi } from 'vitest'
+
+vi.mock('$lib/gen', () => ({ OpenAPI: { BASE: '/api' } }))
+vi.mock('$lib/stores', () => ({ workspaceStore: { subscribe: () => () => {} } }))
+
+import { createFeatureUsageBuffer, type FeatureUsageEventPayload } from './featureUsage'
+
+describe('createFeatureUsageBuffer', () => {
+	it('sums repeated events per (feature, kind, key, entity) and flushes one batch', async () => {
+		const send = vi.fn().mockResolvedValue(undefined)
+		const buffer = createFeatureUsageBuffer(send, () => 'ws1')
+
+		buffer.log('ai_session', 'message', { key: 'global', entityId: 's1' })
+		buffer.log('ai_session', 'message', { key: 'global', entityId: 's1' })
+		buffer.log('ai_session', 'tokens', { entityId: 's1', value: 120 })
+		buffer.log('ai_session', 'message', { key: 'global', entityId: 's2' })
+		await buffer.flush()
+
+		expect(send).toHaveBeenCalledTimes(1)
+		const [workspace, events] = send.mock.calls[0]
+		expect(workspace).toBe('ws1')
+		expect(events).toEqual(
+			expect.arrayContaining([
+				{ feature: 'ai_session', kind: 'message', key: 'global', entity_id: 's1', value: 2 },
+				{ feature: 'ai_session', kind: 'tokens', key: '', entity_id: 's1', value: 120 },
+				{ feature: 'ai_session', kind: 'message', key: 'global', entity_id: 's2', value: 1 }
+			])
+		)
+		expect(events).toHaveLength(3)
+
+		// Flushed events must not be re-sent.
+		await buffer.flush()
+		expect(send).toHaveBeenCalledTimes(1)
+	})
+
+	it('splits batches per workspace and drops events without any workspace', async () => {
+		const send = vi.fn().mockResolvedValue(undefined)
+		const buffer = createFeatureUsageBuffer(send, () => undefined)
+
+		buffer.log('ai_session', 'created', { key: 'fork' }) // no workspace -> dropped
+		buffer.log('ai_session', 'created', { key: 'fork', workspace: 'ws1' })
+		buffer.log('ai_session', 'created', { key: 'root', workspace: 'ws2' })
+		await buffer.flush()
+
+		expect(send).toHaveBeenCalledTimes(2)
+		const workspaces = send.mock.calls.map((c) => c[0]).sort()
+		expect(workspaces).toEqual(['ws1', 'ws2'])
+	})
+
+	it('starts every chunk request before any send resolves (pagehide flush)', async () => {
+		const send = vi.fn().mockReturnValue(new Promise<void>(() => {}))
+		const buffer = createFeatureUsageBuffer(send, () => 'ws1')
+
+		for (let i = 0; i < 60; i++) {
+			buffer.log('ai_session', 'tool', { key: `tool_${i}` })
+		}
+		buffer.log('ai_session', 'message', { workspace: 'ws2' })
+		void buffer.flush()
+		await Promise.resolve()
+
+		// keepalive only protects requests that were issued; a sequential flush
+		// would have started just the first chunk here.
+		expect(send).toHaveBeenCalledTimes(3)
+	})
+
+	it('chunks flushes above the per-request cap and survives send failures', async () => {
+		const send = vi.fn().mockRejectedValueOnce(new Error('network')).mockResolvedValue(undefined)
+		const buffer = createFeatureUsageBuffer(send, () => 'ws1')
+
+		for (let i = 0; i < 60; i++) {
+			buffer.log('ai_session', 'tool', { key: `tool_${i}` })
+		}
+		await expect(buffer.flush()).resolves.toBeUndefined()
+
+		expect(send).toHaveBeenCalledTimes(2)
+		const sent = send.mock.calls.flatMap((c) => c[1] as FeatureUsageEventPayload[])
+		expect(send.mock.calls[0][1]).toHaveLength(50)
+		expect(sent).toHaveLength(60)
+	})
+})
diff --git a/frontend/src/lib/utils/featureUsage.ts b/frontend/src/lib/utils/featureUsage.ts
new file mode 100644
index 0000000000..6e02e4ce0e
--- /dev/null
+++ b/frontend/src/lib/utils/featureUsage.ts
@@ -0,0 +1,137 @@
+import { get } from 'svelte/store'
+import { OpenAPI } from '$lib/gen'
+import { workspaceStore } from '$lib/stores'
+
+// Anonymous product-usage counters (e.g. AI session activity), batched into the
+// backend `feature_usage` accumulator. Only aggregated counts ever leave the
+// instance, and only when telemetry is enabled and not in minimal mode — never
+// log paths, prompts, code, or user identifiers here (entity ids must be
+// opaque random ids).
+
+export interface FeatureUsageOpts {
+	key?: string
+	entityId?: string
+	value?: number
+	/** Workspace whose API route carries the batch; defaults to the active workspace. */
+	workspace?: string
+}
+
+type SendFn = (workspace: string, events: FeatureUsageEventPayload[]) => Promise<void>
+
+export interface FeatureUsageEventPayload {
+	feature: string
+	kind: string
+	key?: string
+	entity_id?: string
+	value?: number
+}
+
+const FLUSH_INTERVAL_MS = 30_000
+// Backend caps a batch at 50 events; chunk larger flushes.
+const MAX_EVENTS_PER_REQUEST = 50
+
+export function createFeatureUsageBuffer(
+	send: SendFn,
+	getDefaultWorkspace: () => string | undefined,
+	flushIntervalMs = FLUSH_INTERVAL_MS
+) {
+	// One accumulator per (workspace, feature, kind, key, entityId): repeated
+	// events sum locally so a chatty UI still produces one upsert per flush.
+	const pending = new Map<string, { workspace: string; event: FeatureUsageEventPayload }>()
+	let timer: ReturnType<typeof setTimeout> | undefined
+
+	function log(feature: string, kind: string, opts: FeatureUsageOpts = {}): void {
+		const workspace = opts.workspace ?? getDefaultWorkspace()
+		if (!workspace) return
+		const key = opts.key ?? ''
+		const entityId = opts.entityId ?? ''
+		const value = Math.max(1, Math.round(opts.value ?? 1))
+		const mapKey = `${workspace}\u0000${feature}\u0000${kind}\u0000${key}\u0000${entityId}`
+		const existing = pending.get(mapKey)
+		if (existing) {
+			existing.event.value = (existing.event.value ?? 1) + value
+		} else {
+			pending.set(mapKey, {
+				workspace,
+				event: { feature, kind, key, entity_id: entityId, value }
+			})
+		}
+		if (timer === undefined) {
+			timer = setTimeout(() => {
+				timer = undefined
+				void flush()
+			}, flushIntervalMs)
+		}
+	}
+
+	async function flush(): Promise<void> {
+		if (timer !== undefined) {
+			clearTimeout(timer)
+			timer = undefined
+		}
+		if (pending.size === 0) return
+		const byWorkspace = new Map<string, FeatureUsageEventPayload[]>()
+		for (const { workspace, event } of pending.values()) {
+			let events = byWorkspace.get(workspace)
+			if (!events) {
+				events = []
+				byWorkspace.set(workspace, events)
+			}
+			events.push(event)
+		}
+		pending.clear()
+		// Start every chunk request synchronously before awaiting: the pagehide
+		// flush only protects requests that were already issued (keepalive can't
+		// help a fetch that never started).
+		const inflight: Promise<void>[] = []
+		for (const [workspace, events] of byWorkspace) {
+			for (let i = 0; i < events.length; i += MAX_EVENTS_PER_REQUEST) {
+				inflight.push(
+					send(workspace, events.slice(i, i + MAX_EVENTS_PER_REQUEST)).catch(() => {
+						// Telemetry is best-effort: drop the batch rather than retry.
+					})
+				)
+			}
+		}
+		await Promise.all(inflight)
+	}
+
+	return { log, flush }
+}
+
+const buffer = createFeatureUsageBuffer(
+	async (workspace, events) => {
+		// Raw fetch instead of the generated client: `keepalive` lets the request
+		// finish after tab close/navigation, which is when the final flush runs.
+		// Auth rides on the token cookie (WITH_CREDENTIALS app setup).
+		await fetch(`${OpenAPI.BASE}/w/${encodeURIComponent(workspace)}/workspaces/log_feature_usage`, {
+			method: 'POST',
+			credentials: 'include',
+			keepalive: true,
+			headers: { 'Content-Type': 'application/json' },
+			body: JSON.stringify({ events })
+		})
+	},
+	() => get(workspaceStore) ?? undefined
+)
+
+if (typeof document !== 'undefined') {
+	// Flush what's buffered before the tab goes away. pagehide covers
+	// close/navigation paths where visibilitychange is not delivered.
+	document.addEventListener('visibilitychange', () => {
+		if (document.visibilityState === 'hidden') {
+			void buffer.flush()
+		}
+	})
+	window.addEventListener('pagehide', () => {
+		void buffer.flush()
+	})
+}
+
+/**
+ * Record an anonymous feature-usage event. Fire-and-forget: events are summed
+ * locally per (feature, kind, key, entityId) and flushed in batches.
+ */
+export function logFeatureUsage(feature: string, kind: string, opts: FeatureUsageOpts = {}): void {
+	buffer.log(feature, kind, opts)
+}

From b070f56c5e6109c219a53cbb9628e28be4397fb7 Mon Sep 17 00:00:00 2001
From: hugocasa <hugo@casademont.ch>
Date: Mon, 20 Jul 2026 21:44:24 +0200
Subject: [PATCH 074/171] feat: detect server-handled git-sync so CLI picks git
 push vs wmill sync push (#10201)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* feat: detect server-handled git-sync so CLI picks git push vs wmill sync push

Add a non-admin GET /w/{w}/workspaces/git_sync_deploy_mode endpoint returning
{configured, deploy_on_push}, so any workspace member (not just admins, who
alone can read get_settings) can tell whether pushing to the git remote deploys
via server-side auto-pull. Surface it through `wmill gitsync-settings status`
and align the deploy guidance/skills to prefer git push when the repo deploys on
push, falling back to `wmill sync push` otherwise.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix: address review — clean JSON output, warn on git_sync parse failure

- gitsync-settings status --json-output now uses console.log so the JSON pipes
  cleanly to jq (log.info wraps it in ANSI color codes)
- get_git_sync_deploy_mode logs a warning on git_sync deserialize failure instead
  of silently reporting configured=false, and documents why it is not EE-gated

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix: address codex review — license-gate and branch-match deploy-on-push

- get_git_sync_deploy_mode now reports deploy_on_push only on Enterprise-licensed
  instances (auto-pull can't run on CE/downgrade) and returns auto_pull_branches
  so the client knows which tracked branches actually deploy on push
- gitsync-settings status matches the local git branch against auto_pull_branches
  before recommending git push, so an untracked branch falls back to wmill sync push
- add an integration assertion for the endpoint's default (no git-sync) shape

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* docs: point per-topic skills at the canonical Deploying section

The git-push-vs-wmill-sync-push decision lives in core.ts (AGENTS.wmill.md),
which is already in context. Have the per-topic skills reference the Deploying
section instead of re-encoding the detection, so there is one source of truth
and no drift (the compressed version also wrongly implied `gitsync-settings
status` detects the CI-workflow path, which only core.ts's filesystem check does).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix: match remote+branch server-side for deploy-on-push detection

Codex flagged that a workspace-level auto-pull signal recommends `git push` even
when the local checkout is a different repo/branch than the one that auto-deploys.
Match precisely instead, without exposing anything sensitive:

- git_sync_deploy_mode takes optional remote+branch query params. The backend
  normalizes each auto-pull repo's URL to host/path (dropping embedded
  user:token credentials by rebuilding from parsed components, never scrubbing
  the string) and compares to the caller's remote; deploy_on_push is true only on
  a licensed instance where an auto-pull repo matches that remote and tracked
  branch. The response is two booleans — no repo URLs or branches leave the server.
- Branchless (default-branch) and fork/sync_forks repos stay a safe fallback to
  `wmill sync push` rather than a wrong git-push recommendation.
- CLI status sends `git remote get-url` + current branch (new getGitRemoteUrl
  helper, --remote flag) and reports the matched result.
- Unit-test the URL normalization/credential-stripping directly, since a
  regression there would be a token-handling bug.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix: address codex security findings in deploy-mode detection

- Strip credentials from the local remote client-side before sending, so a
  token embedded in the URL never reaches the server's request-URI logs
- Fetch the remote via spawnSync arg array (not an interpolated shell string),
  removing a command-injection path from a caller-supplied --remote value
- Use the remote's push URL (`git remote get-url --push`) and recommend the
  qualified `git push <remote> <branch>`, so the pushed target matches the one
  the server checked
- Keep the port in remote normalization so different services on the same host
  don't collide into a false match
- Unit-test credential stripping (CLI) and port distinctness (backend)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat: resolve $var repos and fork sync_forks in deploy-mode detection

- Interpolate $var:/$res: references in the repo url/branch the same way the
  auto-pull poller does (system context, cached, only when a field is a
  reference), so variable-backed git URLs match instead of falling through
- For a fork workspace, evaluate the root ancestor's git-sync settings and treat
  its wm-fork/<base>/<id> branch as deploying when the root repo has
  auto_pull.enabled && sync_forks and its base matches the tracked branch
- Read settings/resources on the plain pool (a fork member may not belong to the
  root workspace); only booleans are returned
- Unit-test the fork/branch matching (base + sync_forks + workspace-id suffix)

A blank tracked branch (repo default) still needs a network ls-remote to resolve,
so it stays a safe fallback to `wmill sync push` rather than a wrong git push.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* refactor: share one git-repo resolver between poller and deploy-mode

The auto-pull poller and the deploy-mode endpoint both resolved a git-sync repo
resource (system context, $var:/$res: interpolation) with duplicated boilerplate.
Extract windmill_store::resources::resolve_git_repository_resource and have both
call it, so the interpolation lives in one place. Drops the endpoint's local
resolve_repo_url_branch helper and its raw SQL query (and cache entry).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix: address codex review — fork false-positives, shell-safety, auth contract

- Fork deploy detection now mirrors reconcile_fork_branch_pull: the wm-fork branch
  must route to this workspace (first existing of the id candidates) and the repo
  must be in the fork's own inherited settings, so a multi-repo root or an
  ambiguous id can't produce a false deploy_on_push
- Recommended deploy command is shell-quoted (branch/remote names may contain
  metacharacters and the output is agent-executed)
- Remote normalization folds only the host; repo paths stay case-sensitive
- Document the system/RLS-bypassing contract on the shared resolve helper and
  restore the head-fetch doc; fix the overclaiming integration-test comment
- Dev-workspace label and default-branch cases remain documented safe fallbacks

Also restores 5 sqlx cache entries an earlier cleanup dropped.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix: require a runnable auto-pull delivery path for deploy_on_push

enabled auto-pull alone doesn't mean a push deploys: a webhook-only repo with no
active hook (failed registration), or a repo that only polling could serve on an
SSH URL (the poller rejects SSH), delivers nothing. Gate deploy_on_push on an
actual delivery path — active webhook, or a pollable non-app HTTPS repo — per the
repo's auto-pull mode. Unit-tested across modes/webhook/URL-scheme/app.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix: read fresh repo config for on-demand deploy-mode detection

resolve_git_repository_resource took an implicit allow_cache=true (right for the
poller loop). An on-demand status could then match against a stale url/branch
cached by an earlier poll. Make allow_cache a parameter: poller keeps true, the
deploy-mode endpoint passes false so it reflects the current git-sync config.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix: defer the deploy fallback instead of assuming wmill sync push

When backend auto-pull doesn't match the checkout, `status` no longer flatly
recommends `wmill sync push` — a CI workflow may still deploy on push. It now
reports the backend signal and points at the Deploying guidance (check CI → git
push, else wmill sync push; record the choice as a `Deploy mode:` line in
AGENTS.md). deploy_command is null in JSON when undetermined. This resolves the
CI-backed false recommendation without the CLI re-implementing CI detection.

Also fix two review nits: restore the deploys_on_push_branch doc comment (it had
drifted onto has_runnable_delivery) and correct the app-repo comment (their
exclusion from the poll path is a conservative safe under-report, not "can't be
polled").

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* refactor: drop the ambiguous-fork-id disambiguation from deploy-mode

The existence-query resolution guarded a very narrow case (a suffix owned by both
a coexisting wm-fork-<suffix> and <suffix> workspace, queried from the wrong one).
Not worth the per-fork query; keep the cheap candidate-family check plus the
inherited-repo membership test, which already close the real fork false-positive.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* refactor: drop remote-URL matching; disambiguate deploy-mode by repo count

Matching the caller's git remote URL against each repo dragged in the whole
remote-URL surface (sending the URL, credential stripping, shell-safe remote
handling, fetch/push URL, port/case normalization) — and the risk that came with
it. Replace it with a simpler rule that fits the actual question:

- deploy_on_push is true only when exactly ONE licensed, deliverable auto-pull
  repo tracks the pushed branch. With a single synced repo the local checkout is
  unambiguously it; with several we can't tell which is the caller's, so we
  return false and the CLI asks the user.
- The endpoint takes only `branch` (no `remote`); status no longer reads or
  sends the git remote.
- On the fallback, status now tells the agent to ASK the user how the repo
  deploys (CI git-push vs wmill sync push) and record it in AGENTS.md, instead of
  assuming wmill sync push. Guidance updated to match.

Removes normalize_git_remote (+url dep), getGitRemoteUrl, stripGitRemoteCredentials,
shellQuote, the --remote flag, and their tests.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* refactor: share fork-branch routing between reconciler and deploy-mode

Deploy-mode detection was re-deriving fork/dev routing (root walk, wm-fork/dev
branch parsing, descendant resolution, inherited-repo check) that the auto-pull
reconciler already owns — the source of repeated edge-case bugs. Extract it into
windmill_common::workspaces::resolve_fork_branch_target and have both the endpoint
and reconcile_fork_branch_pull (EE) call it, so they can't drift and dev
workspaces are handled by construction.

Endpoint now resolves the root via the canonical cached fork_ancestor_chain
(dropping a duplicate CTE) and routes forks/dev workspaces through the shared
resolver. The .sqlx cache is unchanged (the moved queries already existed).

Bumps ee-repo-ref for windmill-labs/windmill-ee-private companion.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix: exclude archived roots and frame deploy_on_push:false as unconfirmed

- deploy_on_push now requires the root workspace to be live; polling and webhook
  delivery both exclude deleted roots, so an archived root (or anything beneath
  one) with retained git-sync no longer reports deployable
- status and the OpenAPI now describe false as "not confirmed" (it also covers
  ambiguity and conservative false-negatives), not a definite no — the CLI asks
  the user rather than asserting the push won't deploy

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore: bump ee-repo-ref for EE branch merge of main

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 backend/ee-repo-ref.txt                       |   2 +-
 .../tests/workspaces.rs                       |  14 +
 .../windmill-api-workspaces/src/workspaces.rs | 255 ++++++++++++++++++
 backend/windmill-api/openapi.yaml             |  39 +++
 backend/windmill-common/src/workspaces.rs     |  87 ++++++
 backend/windmill-store/src/resources.rs       |  59 ++--
 .../gitsync-settings/gitsync-settings.ts      |  11 +-
 cli/src/commands/gitsync-settings/status.ts   |  57 ++++
 cli/src/guidance/core.ts                      |  19 +-
 cli/src/guidance/skills.gen.ts                |  97 +++----
 .../auto-generated/cli/cli-commands.md        |   2 +
 system_prompts/auto-generated/prompts.ts      |   7 +-
 .../skills/cli-commands/SKILL.md              |   2 +
 .../auto-generated/skills/resources/SKILL.md  |   5 +-
 .../auto-generated/skills/schedules/SKILL.md  |   2 +-
 .../auto-generated/skills/triggers/SKILL.md   |   2 +-
 .../auto-generated/skills/write-flow/SKILL.md |   2 +-
 .../skills/write-script-ansible/SKILL.md      |   4 +-
 .../skills/write-script-bash/SKILL.md         |   4 +-
 .../skills/write-script-bigquery/SKILL.md     |   4 +-
 .../skills/write-script-bun/SKILL.md          |   4 +-
 .../skills/write-script-bunnative/SKILL.md    |   4 +-
 .../skills/write-script-csharp/SKILL.md       |   4 +-
 .../skills/write-script-deno/SKILL.md         |   4 +-
 .../skills/write-script-duckdb/SKILL.md       |   4 +-
 .../skills/write-script-go/SKILL.md           |   4 +-
 .../skills/write-script-graphql/SKILL.md      |   4 +-
 .../skills/write-script-java/SKILL.md         |   4 +-
 .../skills/write-script-mssql/SKILL.md        |   4 +-
 .../skills/write-script-mysql/SKILL.md        |   4 +-
 .../skills/write-script-php/SKILL.md          |   4 +-
 .../skills/write-script-postgresql/SKILL.md   |   4 +-
 .../skills/write-script-powershell/SKILL.md   |   4 +-
 .../skills/write-script-python3/SKILL.md      |   4 +-
 .../skills/write-script-rlang/SKILL.md        |   4 +-
 .../skills/write-script-rust/SKILL.md         |   4 +-
 .../skills/write-script-snowflake/SKILL.md    |   4 +-
 .../skills/write-workflow-as-code/SKILL.md    |   4 +-
 system_prompts/base/flow-cli.md               |   2 +-
 system_prompts/base/resources.md              |   5 +-
 system_prompts/base/schedules.md              |   2 +-
 system_prompts/base/triggers.md               |   2 +-
 system_prompts/generate.py                    |   4 +-
 43 files changed, 624 insertions(+), 137 deletions(-)
 create mode 100644 cli/src/commands/gitsync-settings/status.ts

diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index 1a8edeed9c..89e8173421 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-6306c072a50937ea9af44a5bcf42345543207486
+4c08634af953db5c1125b1fb03f5af211fe21db3
diff --git a/backend/windmill-api-integration-tests/tests/workspaces.rs b/backend/windmill-api-integration-tests/tests/workspaces.rs
index 92f179c39b..c319a1b9ec 100644
--- a/backend/windmill-api-integration-tests/tests/workspaces.rs
+++ b/backend/windmill-api-integration-tests/tests/workspaces.rs
@@ -457,6 +457,20 @@ async fn test_workspace_endpoints(db: Pool<Postgres>) -> anyhow::Result<()> {
         resp.status()
     );
 
+    // --- git_sync_deploy_mode (response shape + default when no git-sync configured) ---
+    let resp = authed(client().get(format!("{base}/git_sync_deploy_mode")))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(
+        resp.status(),
+        200,
+        "git_sync_deploy_mode: unexpected status"
+    );
+    let mode = resp.json::<serde_json::Value>().await?;
+    assert_eq!(mode["configured"], json!(false));
+    assert_eq!(mode["deploy_on_push"], json!(false));
+
     // --- update_operator_settings ---
     let resp = authed(client().post(format!("{base}/operator_settings")))
         .json(&json!({}))
diff --git a/backend/windmill-api-workspaces/src/workspaces.rs b/backend/windmill-api-workspaces/src/workspaces.rs
index 7b5ff16bb1..3e862bd13a 100644
--- a/backend/windmill-api-workspaces/src/workspaces.rs
+++ b/backend/windmill-api-workspaces/src/workspaces.rs
@@ -135,6 +135,7 @@ pub fn workspaced_service() -> Router {
         .route("/edit_datatable_config", post(edit_datatable_config))
         .merge(crate::datatable_migrations::routes())
         .route("/git_sync_enabled", get(get_git_sync_enabled))
+        .route("/git_sync_deploy_mode", get(get_git_sync_deploy_mode))
         .route("/edit_git_sync_config", post(edit_git_sync_config))
         .route("/edit_git_sync_repository", post(edit_git_sync_repository))
         .route(
@@ -1025,6 +1026,260 @@ async fn get_public_settings(
     Ok(Json(settings))
 }
 
+#[derive(Deserialize)]
+pub struct GitSyncDeployModeQuery {
+    /// The branch the caller would push.
+    pub branch: Option<String>,
+}
+
+#[derive(Serialize, Debug)]
+pub struct GitSyncDeployMode {
+    /// At least one git-sync repository is configured for this workspace.
+    pub configured: bool,
+    /// Pushing `branch` deploys via server-side auto-pull: exactly one licensed,
+    /// deliverable auto-pull repository tracks it. False (deploy via `git push`
+    /// through CI, or `wmill sync push`) when unlicensed, no repo tracks the
+    /// branch, or several do — with multiple synced repos we can't tell which the
+    /// local checkout is, so the caller asks the user instead.
+    pub deploy_on_push: bool,
+}
+
+/// Whether an enabled auto-pull repo actually has a delivery path that fires, so
+/// a push really deploys — mirroring the poller/webhook. Polling needs an HTTP(S)
+/// URL (SSH is rejected in the background); webhook-only mode needs an active
+/// hook; `auto` needs either. With neither, `enabled` alone never deploys (e.g. a
+/// webhook that failed to register).
+fn has_runnable_delivery(
+    auto_pull: &windmill_common::workspaces::AutoPullSettings,
+    resource: &serde_json::Value,
+) -> bool {
+    let webhook_active = auto_pull.webhook_id.is_some();
+    let is_app = resource
+        .get("is_github_app")
+        .and_then(|v| v.as_bool())
+        .unwrap_or(false);
+    let is_http_url = resource
+        .get("url")
+        .and_then(|v| v.as_str())
+        .map(|u| {
+            let u = u.trim_start();
+            u.starts_with("https://") || u.starts_with("http://")
+        })
+        .unwrap_or(false);
+    // App repos also have a GitHub-API poll fallback, but require an active
+    // webhook here — conservative (errs toward `wmill sync push`) rather than
+    // asserting the app installation can mint a token.
+    let can_poll = !is_app && is_http_url;
+    match auto_pull.mode {
+        windmill_common::workspaces::AutoPullMode::Webhook => webhook_active,
+        windmill_common::workspaces::AutoPullMode::Polling => can_poll,
+        windmill_common::workspaces::AutoPullMode::Auto => webhook_active || can_poll,
+    }
+}
+
+/// Whether pushing `pushed_branch` matches a repo directly tracking
+/// `tracked_branch` (the non-fork case). A blank tracked branch (repo default) is
+/// unresolvable without a network call, so it never matches and the caller falls
+/// back to `wmill sync push`. Fork/dev routing goes through
+/// `windmill_common::workspaces::resolve_fork_branch_target` instead.
+fn deploys_on_push_branch(pushed_branch: &str, tracked_branch: &str) -> bool {
+    !tracked_branch.is_empty() && pushed_branch == tracked_branch
+}
+
+/// Non-admin endpoint so the CLI/agent can pick the deploy path (git push vs
+/// `wmill sync push`) without reading the admin-only workspace settings. Takes
+/// only the branch and returns booleans — no repository URLs, credentials, or
+/// webhook config ever leave the backend.
+async fn get_git_sync_deploy_mode(
+    _authed: ApiAuthed,
+    Path(w_id): Path<String>,
+    Query(q): Query<GitSyncDeployModeQuery>,
+    Extension(db): Extension<DB>,
+) -> JsonResult<GitSyncDeployMode> {
+    // A fork clears its own auto-pull; its pushes deploy through the root
+    // ancestor's repo (which owns `sync_forks`), so evaluate the root's settings.
+    let ancestors = windmill_common::workspaces::fork_ancestor_chain(&db, &w_id).await?;
+    let is_fork = !ancestors.is_empty();
+    let root_id = ancestors.last().cloned().unwrap_or_else(|| w_id.clone());
+
+    // Polling and webhook delivery both exclude deleted roots, so an archived
+    // root (or anything beneath one) can't deploy on push — treat a missing row
+    // as archived too.
+    let root_deleted = sqlx::query_scalar!("SELECT deleted FROM workspace WHERE id = $1", &root_id)
+        .fetch_optional(&db)
+        .await?
+        .unwrap_or(true);
+
+    // Read on the plain pool: a fork member may not be a member of the root
+    // workspace, and only derived booleans are returned (never the settings).
+    let git_sync = sqlx::query_scalar!(
+        "SELECT git_sync FROM workspace_settings WHERE workspace_id = $1",
+        &root_id
+    )
+    .fetch_optional(&db)
+    .await
+    .map_err(|e| Error::internal_err(format!("getting git_sync settings: {e:#}")))?;
+
+    let settings = git_sync.flatten().and_then(|v| {
+        serde_json::from_value::<WorkspaceGitSyncSettings>(v)
+            .map_err(|e| {
+                tracing::warn!(
+                    "git_sync deploy mode: settings deserialize failed for {root_id}: {e}"
+                )
+            })
+            .ok()
+    });
+
+    // Missing settings row / null git_sync means nothing is configured, not a 404.
+    let Some(settings) = settings else {
+        return Ok(Json(GitSyncDeployMode {
+            configured: false,
+            deploy_on_push: false,
+        }));
+    };
+
+    let configured = !settings.repositories.is_empty();
+
+    // Auto-pull runs only on Enterprise-licensed instances (see poll_git_auto_pull);
+    // without a caller branch there is nothing to match. Either way deploy_on_push
+    // stays false and the caller falls back (git push via CI, or wmill sync push).
+    let Some(branch) = q.branch.as_deref() else {
+        return Ok(Json(GitSyncDeployMode {
+            configured,
+            deploy_on_push: false,
+        }));
+    };
+    let licensed = matches!(
+        windmill_common::ee_oss::get_license_plan().await,
+        windmill_common::ee_oss::LicensePlan::Enterprise
+    );
+
+    // Count the auto-pull repos that would deploy this branch. We deliberately do
+    // not check the caller's remote URL: with exactly one such repo the local
+    // checkout is unambiguously it, and with several we can't tell which is the
+    // caller's, so we report false and let the CLI ask the user.
+    let mut matches = 0u32;
+    if licensed && !root_deleted {
+        for repo in &settings.repositories {
+            let Some(auto_pull) = repo.auto_pull.as_ref() else {
+                continue;
+            };
+            if !auto_pull.enabled {
+                continue;
+            }
+            // A fork deploys only through the root's sync_forks repos.
+            if is_fork && !auto_pull.sync_forks {
+                continue;
+            }
+            // Interpolates `$var:`/`$res:` as the auto-pull poller does.
+            // allow_cache=false: an on-demand status must reflect the current
+            // repo config, not a value cached by an earlier poll.
+            let Some(value) = windmill_store::resources::resolve_git_repository_resource(
+                &db,
+                &root_id,
+                &repo.git_repo_resource_path,
+                false,
+            )
+            .await?
+            else {
+                continue;
+            };
+            // `enabled` isn't enough: without a runnable delivery path (active
+            // webhook, or pollable non-app HTTPS repo) the push never deploys.
+            if !has_runnable_delivery(auto_pull, &value) {
+                continue;
+            }
+            let tracked_branch = value.get("branch").and_then(|v| v.as_str()).unwrap_or("");
+            let deploys = if is_fork {
+                // Fork/dev routing (wm-fork/* or an env-label branch) resolved by
+                // the same logic the auto-pull reconciler uses; this repo counts
+                // only if the branch routes to *this* workspace.
+                windmill_common::workspaces::resolve_fork_branch_target(
+                    &db,
+                    &root_id,
+                    &repo.git_repo_resource_path,
+                    branch,
+                    tracked_branch,
+                )
+                .await?
+                .is_some_and(|(fork_id, _)| fork_id == w_id)
+            } else {
+                deploys_on_push_branch(branch, tracked_branch)
+            };
+            if deploys {
+                matches += 1;
+            }
+        }
+    }
+
+    Ok(Json(GitSyncDeployMode {
+        configured,
+        deploy_on_push: matches == 1,
+    }))
+}
+
+#[cfg(test)]
+mod git_sync_deploy_mode_tests {
+    use super::{deploys_on_push_branch, has_runnable_delivery};
+    use serde_json::json;
+    use windmill_common::workspaces::{AutoPullMode, AutoPullSettings};
+
+    fn auto_pull(mode: AutoPullMode, webhook_id: Option<i64>) -> AutoPullSettings {
+        AutoPullSettings { enabled: true, mode, webhook_id, ..Default::default() }
+    }
+
+    #[test]
+    fn runnable_delivery_requires_a_firing_path() {
+        let https = json!({ "url": "https://github.com/o/r.git" });
+        let ssh = json!({ "url": "git@github.com:o/r.git" });
+        let app = json!({ "url": "https://github.com/o/r.git", "is_github_app": true });
+        // Polling serves only non-app HTTPS repos (SSH is rejected in background).
+        assert!(has_runnable_delivery(
+            &auto_pull(AutoPullMode::Auto, None),
+            &https
+        ));
+        assert!(has_runnable_delivery(
+            &auto_pull(AutoPullMode::Polling, None),
+            &https
+        ));
+        assert!(!has_runnable_delivery(
+            &auto_pull(AutoPullMode::Polling, None),
+            &ssh
+        ));
+        assert!(!has_runnable_delivery(
+            &auto_pull(AutoPullMode::Auto, None),
+            &ssh
+        ));
+        // Webhook-only mode needs an active hook.
+        assert!(!has_runnable_delivery(
+            &auto_pull(AutoPullMode::Webhook, None),
+            &https
+        ));
+        assert!(has_runnable_delivery(
+            &auto_pull(AutoPullMode::Webhook, Some(1)),
+            &https
+        ));
+        // App repos are gated on an active webhook here (conservative): their
+        // API poll-fallback may still deploy, so this is a safe under-report.
+        assert!(!has_runnable_delivery(
+            &auto_pull(AutoPullMode::Auto, None),
+            &app
+        ));
+        assert!(has_runnable_delivery(
+            &auto_pull(AutoPullMode::Auto, Some(1)),
+            &app
+        ));
+    }
+
+    #[test]
+    fn non_fork_matches_tracked_branch_only() {
+        assert!(deploys_on_push_branch("main", "main"));
+        assert!(!deploys_on_push_branch("dev", "main"));
+        // An unresolved default (blank) tracked branch never matches.
+        assert!(!deploys_on_push_branch("main", ""));
+    }
+}
+
 async fn get_copilot_settings_state(
     _authed: ApiAuthed,
     Path(w_id): Path<String>,
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 883ab5ec74..3444e873a5 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -5183,6 +5183,45 @@ paths:
                     type: integer
                     nullable: true
 
+  /w/{workspace}/workspaces/git_sync_deploy_mode:
+    get:
+      summary: Get how local changes deploy to this workspace via git sync
+      operationId: getGitSyncDeployMode
+      tags:
+        - workspace
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - name: branch
+          in: query
+          required: false
+          description: The branch the caller would push.
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Git sync deploy mode
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - configured
+                  - deploy_on_push
+                properties:
+                  configured:
+                    type: boolean
+                    description: At least one git-sync repository is configured.
+                  deploy_on_push:
+                    type: boolean
+                    description: >-
+                      True means a `git push` is confirmed to deploy via
+                      auto-pull: exactly one licensed, deliverable repository
+                      tracks the branch. False is *not confirmed* rather than a
+                      definite no — it also covers unlicensed, ambiguous
+                      (several repos track it), and conservative false-negatives;
+                      determine the deploy path another way (CI `git push`, or
+                      `wmill sync push`).
+
   /w/{workspace}/workspaces/edit_git_sync_config:
     post:
       summary: edit workspace git sync settings
diff --git a/backend/windmill-common/src/workspaces.rs b/backend/windmill-common/src/workspaces.rs
index 284ebeb896..f1679677fb 100644
--- a/backend/windmill-common/src/workspaces.rs
+++ b/backend/windmill-common/src/workspaces.rs
@@ -1438,6 +1438,93 @@ pub async fn workspace_with_fork_ancestors(db: &crate::DB, w_id: &str) -> Result
     Ok(chain)
 }
 
+/// Resolve which live descendant workspace (and its inherited repo entry) a git
+/// branch pushed to `parent_repo_path` — a git-sync repo on `parent_w_id`
+/// tracking `expected_base` — deploys to via parent-managed fork sync, or `None`
+/// if it routes to no fork. Shared by the auto-pull reconciler and deploy-mode
+/// detection so both agree on fork/dev routing.
+///
+/// Reads lineage/settings for arbitrary ids with no authz check (like
+/// [`fork_ancestor_chain`]); the caller must already be authorized for the
+/// workspace whose deploy path it is resolving.
+pub async fn resolve_fork_branch_target(
+    db: &DB,
+    parent_w_id: &str,
+    parent_repo_path: &str,
+    branch: &str,
+    expected_base: &str,
+) -> Result<Option<(String, GitRepositorySettings)>> {
+    // Only a live descendant of parent_w_id may receive the pull — a crafted
+    // branch name must not route into an unrelated workspace. Descendants (not
+    // just direct children) because a fork of a dev workspace also syncs through
+    // the root's webhook/poller: only the root can hold auto-pull config.
+    let fork_id: Option<String> = if let Some((base, suffix)) = parse_fork_branch(branch) {
+        // Throwaway-fork form derives from the tracked branch
+        // (`wm-fork/<tracked>/<id>`); a different base is not this repo's.
+        if base != expected_base {
+            return Ok(None);
+        }
+        let [generated_id, dev_id] = fork_branch_workspace_id_candidates(suffix);
+        sqlx::query_scalar!(
+            r#"WITH RECURSIVE descendants AS (
+                   SELECT id, 0 AS depth FROM workspace
+                   WHERE parent_workspace_id = $1 AND NOT deleted
+                   UNION ALL
+                   SELECT w.id, d.depth + 1 FROM workspace w
+                   JOIN descendants d ON w.parent_workspace_id = d.id
+                   WHERE NOT w.deleted AND d.depth < 10
+               )
+               SELECT id as "id!" FROM descendants WHERE (id = $2 OR id = $3)
+               ORDER BY (id = $2) DESC LIMIT 1"#,
+            parent_w_id,
+            generated_id,
+            dev_id,
+        )
+        .fetch_optional(db)
+        .await?
+    } else if branch != expected_base {
+        // Environment-label branch (`dev`/`staging`) of a dev-workspace child.
+        // Dev workspaces only exist directly under a root, so no recursion here.
+        // The tracked-branch guard keeps a label that collides with the tracked
+        // branch from double-routing (the parent's own pull already covers it).
+        sqlx::query_scalar!(
+            "SELECT id FROM workspace \
+             WHERE parent_workspace_id = $1 AND NOT deleted AND is_dev_workspace \
+               AND COALESCE(dev_workspace_label, 'dev') = $2",
+            parent_w_id,
+            branch,
+        )
+        .fetch_optional(db)
+        .await?
+    } else {
+        return Ok(None);
+    };
+    let Some(fork_id) = fork_id else {
+        return Ok(None);
+    };
+
+    // The fork inherited the repo entry at fork time; use its own copy.
+    let fork_repo = sqlx::query_scalar!(
+        "SELECT git_sync FROM workspace_settings WHERE workspace_id = $1",
+        &fork_id
+    )
+    .fetch_optional(db)
+    .await?
+    .flatten()
+    .and_then(|v| serde_json::from_value::<WorkspaceGitSyncSettings>(v).ok())
+    .and_then(|s| {
+        s.repositories
+            .into_iter()
+            .find(|r| r.git_repo_resource_path == parent_repo_path)
+    });
+    if fork_repo.is_none() {
+        tracing::warn!(
+            "git fork sync: fork {fork_id} has no git-sync repo {parent_repo_path}, not routing {branch}"
+        );
+    }
+    Ok(fork_repo.map(|r| (fork_id, r)))
+}
+
 pub async fn get_ducklake_from_db_unchecked(
     name: &str,
     w_id: &str,
diff --git a/backend/windmill-store/src/resources.rs b/backend/windmill-store/src/resources.rs
index c77b0874ec..5ea1638baf 100644
--- a/backend/windmill-store/src/resources.rs
+++ b/backend/windmill-store/src/resources.rs
@@ -2867,20 +2867,24 @@ async fn get_repo_latest_commit_hash(
     Ok(commit_hash)
 }
 
-/// Resolve a workspace git-sync repository and return its current head commit
-/// for the tracked branch, for background auto-pull polling (no authed user).
+/// Load a git-sync repository resource's value with `$var:`/`$res:` references
+/// resolved. Shared by the auto-pull poller (`get_git_repo_head_for_autopull`)
+/// and deploy-mode detection so the interpolation lives in exactly one place.
 ///
-/// Returns `Ok(Some((ref_spec, sha)))` for a pollable repo, or `Ok(None)` for
-/// repos that cannot be polled in-process — currently GitHub-App-backed repos,
-/// which authenticate via an installation token at clone time and sync via
-/// webhooks instead. Credentials embedded in the resource URL (including
-/// `$var:` references) are resolved with the system identity, bypassing
-/// per-user ACLs, since the poller runs without an authenticated request.
-pub async fn get_git_repo_head_for_autopull(
+/// SECURITY: reads under the system identity (`SUPERADMIN_SYNC_EMAIL`), so it
+/// **bypasses resource RLS** and returns fully-interpolated JSON that **may
+/// contain credentials** (an embedded `$var:` token in the URL). Callers must
+/// have already authorized access to `w_id`, must use it only for git-sync
+/// `git_repository` resources, and must **not** return the resolved value to a
+/// client — derive and return only non-sensitive facts. Pass `allow_cache=true`
+/// for the poller (avoids re-decrypting/re-auditing a `$var:` secret every tick);
+/// pass `false` for on-demand reads that must reflect the current resource.
+pub async fn resolve_git_repository_resource(
     db: &DB,
     w_id: &str,
     git_repo_resource_path: &str,
-) -> Result<Option<(String, String)>> {
+    allow_cache: bool,
+) -> Result<Option<serde_json::Value>> {
     use windmill_common::db::DbWithOptAuthed;
 
     let resource_path = git_repo_resource_path
@@ -2897,18 +2901,29 @@ pub async fn get_git_repo_head_for_autopull(
         },
     };
 
-    // allow_cache=true so repeated polls reuse the interpolated value instead of
-    // re-decrypting any `$var:` secret in the URL (and writing an audit row) on
-    // every tick.
-    let value =
-        get_resource_value_interpolated_internal(&dba, w_id, resource_path, None, None, true)
-            .await?
-            .ok_or_else(|| {
-                Error::BadRequest(format!(
-                    "Git repository resource '{}' not found",
-                    resource_path
-                ))
-            })?;
+    get_resource_value_interpolated_internal(&dba, w_id, resource_path, None, None, allow_cache)
+        .await
+}
+
+/// Resolve a workspace git-sync repository and return its current head commit
+/// `(ref_spec, sha)` for the tracked branch, for background auto-pull polling.
+/// Returns `Ok(None)` for repos that cannot be polled in-process (GitHub-App
+/// repos, which sync via webhooks instead).
+pub async fn get_git_repo_head_for_autopull(
+    db: &DB,
+    w_id: &str,
+    git_repo_resource_path: &str,
+) -> Result<Option<(String, String)>> {
+    let value = resolve_git_repository_resource(db, w_id, git_repo_resource_path, true)
+        .await?
+        .ok_or_else(|| {
+            Error::BadRequest(format!(
+                "Git repository resource '{}' not found",
+                git_repo_resource_path
+                    .strip_prefix("$res:")
+                    .unwrap_or(git_repo_resource_path)
+            ))
+        })?;
 
     if value
         .get("is_github_app")
diff --git a/cli/src/commands/gitsync-settings/gitsync-settings.ts b/cli/src/commands/gitsync-settings/gitsync-settings.ts
index 5c27e032b5..efaf00dcb5 100644
--- a/cli/src/commands/gitsync-settings/gitsync-settings.ts
+++ b/cli/src/commands/gitsync-settings/gitsync-settings.ts
@@ -1,6 +1,7 @@
 import { Command } from "@cliffy/command";
 import { pullGitSyncSettings } from "./pull.ts";
 import { pushGitSyncSettings } from "./push.ts";
+import { gitSyncStatus } from "./status.ts";
 
 const command = new Command()
   .description(
@@ -54,7 +55,13 @@ const command = new Command()
     "--promotion <branch:string>",
     "Use promotionOverrides from the specified branch instead of regular overrides"
   )
-  .action(pushGitSyncSettings as any);
+  .action(pushGitSyncSettings as any)
+  .command("status")
+  .description(
+    "Report how local changes deploy to the workspace (git push vs wmill sync push)",
+  )
+  .option("--json-output", "Output in JSON format")
+  .action(gitSyncStatus as any);
 
-export { pullGitSyncSettings, pushGitSyncSettings };
+export { pullGitSyncSettings, pushGitSyncSettings, gitSyncStatus };
 export default command;
diff --git a/cli/src/commands/gitsync-settings/status.ts b/cli/src/commands/gitsync-settings/status.ts
new file mode 100644
index 0000000000..23ff2a9f0a
--- /dev/null
+++ b/cli/src/commands/gitsync-settings/status.ts
@@ -0,0 +1,57 @@
+import { colors } from "@cliffy/ansi/colors";
+import * as log from "../../core/log.ts";
+import { GlobalOptions } from "../../types.ts";
+import { requireLogin } from "../../core/auth.ts";
+import { resolveWorkspace } from "../../core/context.ts";
+import * as wmill from "../../../gen/services.gen.ts";
+import { getCurrentGitBranch, isGitRepository } from "../../utils/git.ts";
+
+export async function gitSyncStatus(opts: GlobalOptions & { jsonOutput?: boolean }) {
+  const workspace = await resolveWorkspace(opts);
+  await requireLogin(opts);
+
+  const branch = isGitRepository() ? getCurrentGitBranch() : null;
+
+  // The backend reports whether exactly one licensed, deliverable auto-pull repo
+  // tracks this branch — in which case a `git push` deploys. It does not check
+  // the remote URL: with a single synced repo the checkout is unambiguously it,
+  // and with several the backend returns false so we defer to the user here.
+  const mode = await wmill.getGitSyncDeployMode({
+    workspace: workspace.workspaceId,
+    branch: branch ?? undefined,
+  });
+
+  const deployCommand = mode.deploy_on_push ? "git push" : null;
+
+  if (opts.jsonOutput) {
+    // console.log (not log.info, which wraps in ANSI color) so the output pipes cleanly to jq.
+    console.log(
+      JSON.stringify(
+        { ...mode, current_branch: branch, deploy_command: deployCommand },
+        null,
+        2,
+      ),
+    );
+    return;
+  }
+
+  if (mode.deploy_on_push) {
+    log.info(
+      colors.green(
+        `Git-sync auto-pull deploys this branch: pushing '${branch}' deploys to the workspace.`,
+      ),
+    );
+    log.info(`Recommended deploy command: ${colors.bold("git push")}`);
+  } else {
+    log.info(
+      colors.yellow(
+        mode.configured
+          ? "Couldn't confirm a backend auto-pull deploy for this checkout (no single repo unambiguously tracks this branch)."
+          : "No git-sync repository is configured for this workspace on the backend.",
+      ),
+    );
+    log.info(
+      "This is not confirmed deploy-on-push, not a definite no. Ask the user how this repo deploys: `git push` (a CI workflow, or a git-sync repo that couldn't be disambiguated) or `wmill sync push`. Record the answer as a `Deploy mode:` line in AGENTS.md so later sessions skip the question (see the Deploying section).",
+    );
+  }
+}
diff --git a/cli/src/guidance/core.ts b/cli/src/guidance/core.ts
index 1d060a58cb..ae8a3f20ee 100644
--- a/cli/src/guidance/core.ts
+++ b/cli/src/guidance/core.ts
@@ -137,23 +137,24 @@ There are two ways local changes reach the workspace. Pick based on how the repo
 
 ### Detecting the setup
 
-Before deploying, check whether this repo has a **GitHub Actions (or other CI) workflow that runs \`wmill sync push\` on push**. That workflow is the signal that pushing a branch will deploy:
+A \`git push\` deploys when either mechanism is in place: **server-handled git sync** (the workspace auto-pulls the remote, so Windmill deploys what you push) or a **CI workflow that runs \`wmill sync push\` on push**. Check for either:
 
-- Look for \`.github/workflows/*.yml\` (or other CI configs) that invoke \`wmill sync push\`, \`wmill\` deployment commands, or similar.
+- Run \`wmill gitsync-settings status\`. If it reports \`deploy_on_push\`, pushing the current branch deploys via backend auto-pull — no CI needed.
+- Otherwise look for a \`.github/workflows/*.yml\` (or other CI config) that invokes \`wmill sync push\` or similar \`wmill\` deployment commands.
 
-If such a workflow exists → **use \`git push\`** (Option A). Otherwise → **use \`wmill sync push\`** directly (Option B).
+If either is present → **use \`git push\`** (Option A). If \`status\` reports no auto-pull and there is no CI wiring, **ask the user** how this repo deploys (a CI pipeline you didn't recognize → \`git push\`, or manual → \`wmill sync push\`) rather than assuming — then record the answer (below). Only use \`wmill sync push\` directly (Option B) once you've confirmed there is no deploy-on-push path.
 
-**Save the preference so you don't re-detect it every session.** Once you've determined which option this repo uses (or the user tells you), record it in the **project-specific instructions** section of \`AGENTS.md\` (user-owned — never overwritten by \`wmill refresh prompts\`), e.g. a line like \`Deploy mode: git push (CI runs wmill sync push)\` or \`Deploy mode: wmill sync push (no CI wiring)\`. On later sessions, read that line first and skip the scan. Re-detect only if the CI wiring visibly changed.
+**Save the preference so you don't re-detect it every session.** Once you've determined which option this repo uses (or the user tells you), record it in the **project-specific instructions** section of \`AGENTS.md\` (user-owned — never overwritten by \`wmill refresh prompts\`), e.g. a line like \`Deploy mode: git push (backend auto-pull)\`, \`Deploy mode: git push (CI runs wmill sync push)\`, or \`Deploy mode: wmill sync push (no git-push deploy)\`. On later sessions, read that line first and skip the scan. Re-detect only if the wiring visibly changed.
 
-### Option A — \`git push\` (CI is wired to sync)
+### Option A — \`git push\` (backend auto-pull or CI deploys on push)
 
-The CI workflow will pick up the commit and run \`wmill sync push\` on the backend, which is how deployments are intended to happen in this repo. Don't bypass it.
+Pushing the commit deploys it: the backend auto-pulls the remote, or a CI workflow runs \`wmill sync push\`. This is how deployments are intended to happen in this repo. Don't bypass it.
 
 1. \`git add\` + \`git commit\` the local changes.
-2. \`git push\` to the branch the CI runs on.
-3. The workflow deploys to the workspace.
+2. \`git push\` to the tracked branch (the one the backend pulls or CI runs on).
+3. The deploy happens on the backend.
 
-Only fall back to Option B if the user explicitly asks to bypass CI for this change (e.g. CI is broken, urgent hotfix), or if the workflow doesn't cover the current branch.
+Only fall back to Option B if the user explicitly asks to bypass this for this change (e.g. the pipeline is broken, urgent hotfix), or if the tracked branch doesn't cover the current branch.
 
 ### Option B — \`wmill sync push\` (no CI wiring)
 
diff --git a/cli/src/guidance/skills.gen.ts b/cli/src/guidance/skills.gen.ts
index c4e6b19afd..bdeeda6bf3 100644
--- a/cli/src/guidance/skills.gen.ts
+++ b/cli/src/guidance/skills.gen.ts
@@ -53,7 +53,7 @@ After writing, tell the user which command fits what they want to do:
 - \`wmill script preview <script_path>\` — **default when iterating on a local script.** Runs the local file without deploying.
 - \`wmill script run <path>\` — runs the script **already deployed** in the workspace. Use only when the user explicitly wants to test the deployed version, not local edits.
 - \`wmill generate-metadata\` — regenerate the local \`.script.yaml\` (input schema) and \`.lock\` (resolved dependencies) for scripts you changed, and refresh their content hashes in \`wmill-lock.yaml\`. Local files only — **not** a deploy. See "Keep metadata in sync" below.
-- \`wmill sync push\` — deploy local changes to the workspace. Only suggest/run this when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
+- Deploy local changes to the workspace — via \`git push\` or \`wmill sync push\` depending on how the repo is wired (see the **Deploying** section in \`AGENTS.wmill.md\`). Only suggest/run a deploy when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
 
 ### Preview vs run — choose by intent, not habit
 
@@ -83,7 +83,7 @@ If the user hasn't already told you to run/test/preview the script, offer it as
 
 If the user already asked to test/run/try the script in their original request, skip the offer and just execute \`wmill script preview <path> -d '<args>'\` directly — pick plausible args from the script's declared parameters. The shape varies by language: \`main(...)\` for code languages, the SQL dialect's own placeholder syntax (\`$1\` for PostgreSQL, \`?\` for MySQL/Snowflake, \`@P1\` for MSSQL, \`@name\` for BigQuery, etc.), positional \`$1\`, \`$2\`, … for Bash, \`param(...)\` for PowerShell.
 
-\`wmill script preview\` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). \`wmill generate-metadata\` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's \`AGENTS.md\` opts in), per "Keep metadata in sync" above. Only \`wmill sync push\` deploys to the workspace — run it only when the user explicitly asks to deploy/publish/push.
+\`wmill script preview\` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). \`wmill generate-metadata\` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's \`AGENTS.md\` opts in), per "Keep metadata in sync" above. Deploying to the workspace (\`git push\` or \`wmill sync push\` depending on how the repo is wired — see the **Deploying** section) is the only step that mutates remote state — do it only when the user explicitly asks to deploy/publish/push.
 
 For a **visual** open-the-script-in-the-dev-page preview (rather than \`script preview\`'s run-and-print-result), use the \`preview\` skill.
 
@@ -193,7 +193,7 @@ After writing, tell the user which command fits what they want to do:
 - \`wmill script preview <script_path>\` — **default when iterating on a local script.** Runs the local file without deploying.
 - \`wmill script run <path>\` — runs the script **already deployed** in the workspace. Use only when the user explicitly wants to test the deployed version, not local edits.
 - \`wmill generate-metadata\` — regenerate the local \`.script.yaml\` (input schema) and \`.lock\` (resolved dependencies) for scripts you changed, and refresh their content hashes in \`wmill-lock.yaml\`. Local files only — **not** a deploy. See "Keep metadata in sync" below.
-- \`wmill sync push\` — deploy local changes to the workspace. Only suggest/run this when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
+- Deploy local changes to the workspace — via \`git push\` or \`wmill sync push\` depending on how the repo is wired (see the **Deploying** section in \`AGENTS.wmill.md\`). Only suggest/run a deploy when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
 
 ### Preview vs run — choose by intent, not habit
 
@@ -223,7 +223,7 @@ If the user hasn't already told you to run/test/preview the script, offer it as
 
 If the user already asked to test/run/try the script in their original request, skip the offer and just execute \`wmill script preview <path> -d '<args>'\` directly — pick plausible args from the script's declared parameters. The shape varies by language: \`main(...)\` for code languages, the SQL dialect's own placeholder syntax (\`$1\` for PostgreSQL, \`?\` for MySQL/Snowflake, \`@P1\` for MSSQL, \`@name\` for BigQuery, etc.), positional \`$1\`, \`$2\`, … for Bash, \`param(...)\` for PowerShell.
 
-\`wmill script preview\` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). \`wmill generate-metadata\` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's \`AGENTS.md\` opts in), per "Keep metadata in sync" above. Only \`wmill sync push\` deploys to the workspace — run it only when the user explicitly asks to deploy/publish/push.
+\`wmill script preview\` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). \`wmill generate-metadata\` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's \`AGENTS.md\` opts in), per "Keep metadata in sync" above. Deploying to the workspace (\`git push\` or \`wmill sync push\` depending on how the repo is wired — see the **Deploying** section) is the only step that mutates remote state — do it only when the user explicitly asks to deploy/publish/push.
 
 For a **visual** open-the-script-in-the-dev-page preview (rather than \`script preview\`'s run-and-print-result), use the \`preview\` skill.
 
@@ -293,7 +293,7 @@ After writing, tell the user which command fits what they want to do:
 - \`wmill script preview <script_path>\` — **default when iterating on a local script.** Runs the local file without deploying.
 - \`wmill script run <path>\` — runs the script **already deployed** in the workspace. Use only when the user explicitly wants to test the deployed version, not local edits.
 - \`wmill generate-metadata\` — regenerate the local \`.script.yaml\` (input schema) and \`.lock\` (resolved dependencies) for scripts you changed, and refresh their content hashes in \`wmill-lock.yaml\`. Local files only — **not** a deploy. See "Keep metadata in sync" below.
-- \`wmill sync push\` — deploy local changes to the workspace. Only suggest/run this when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
+- Deploy local changes to the workspace — via \`git push\` or \`wmill sync push\` depending on how the repo is wired (see the **Deploying** section in \`AGENTS.wmill.md\`). Only suggest/run a deploy when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
 
 ### Preview vs run — choose by intent, not habit
 
@@ -323,7 +323,7 @@ If the user hasn't already told you to run/test/preview the script, offer it as
 
 If the user already asked to test/run/try the script in their original request, skip the offer and just execute \`wmill script preview <path> -d '<args>'\` directly — pick plausible args from the script's declared parameters. The shape varies by language: \`main(...)\` for code languages, the SQL dialect's own placeholder syntax (\`$1\` for PostgreSQL, \`?\` for MySQL/Snowflake, \`@P1\` for MSSQL, \`@name\` for BigQuery, etc.), positional \`$1\`, \`$2\`, … for Bash, \`param(...)\` for PowerShell.
 
-\`wmill script preview\` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). \`wmill generate-metadata\` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's \`AGENTS.md\` opts in), per "Keep metadata in sync" above. Only \`wmill sync push\` deploys to the workspace — run it only when the user explicitly asks to deploy/publish/push.
+\`wmill script preview\` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). \`wmill generate-metadata\` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's \`AGENTS.md\` opts in), per "Keep metadata in sync" above. Deploying to the workspace (\`git push\` or \`wmill sync push\` depending on how the repo is wired — see the **Deploying** section) is the only step that mutates remote state — do it only when the user explicitly asks to deploy/publish/push.
 
 For a **visual** open-the-script-in-the-dev-page preview (rather than \`script preview\`'s run-and-print-result), use the \`preview\` skill.
 
@@ -386,7 +386,7 @@ After writing, tell the user which command fits what they want to do:
 - \`wmill script preview <script_path>\` — **default when iterating on a local script.** Runs the local file without deploying.
 - \`wmill script run <path>\` — runs the script **already deployed** in the workspace. Use only when the user explicitly wants to test the deployed version, not local edits.
 - \`wmill generate-metadata\` — regenerate the local \`.script.yaml\` (input schema) and \`.lock\` (resolved dependencies) for scripts you changed, and refresh their content hashes in \`wmill-lock.yaml\`. Local files only — **not** a deploy. See "Keep metadata in sync" below.
-- \`wmill sync push\` — deploy local changes to the workspace. Only suggest/run this when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
+- Deploy local changes to the workspace — via \`git push\` or \`wmill sync push\` depending on how the repo is wired (see the **Deploying** section in \`AGENTS.wmill.md\`). Only suggest/run a deploy when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
 
 ### Preview vs run — choose by intent, not habit
 
@@ -416,7 +416,7 @@ If the user hasn't already told you to run/test/preview the script, offer it as
 
 If the user already asked to test/run/try the script in their original request, skip the offer and just execute \`wmill script preview <path> -d '<args>'\` directly — pick plausible args from the script's declared parameters. The shape varies by language: \`main(...)\` for code languages, the SQL dialect's own placeholder syntax (\`$1\` for PostgreSQL, \`?\` for MySQL/Snowflake, \`@P1\` for MSSQL, \`@name\` for BigQuery, etc.), positional \`$1\`, \`$2\`, … for Bash, \`param(...)\` for PowerShell.
 
-\`wmill script preview\` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). \`wmill generate-metadata\` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's \`AGENTS.md\` opts in), per "Keep metadata in sync" above. Only \`wmill sync push\` deploys to the workspace — run it only when the user explicitly asks to deploy/publish/push.
+\`wmill script preview\` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). \`wmill generate-metadata\` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's \`AGENTS.md\` opts in), per "Keep metadata in sync" above. Deploying to the workspace (\`git push\` or \`wmill sync push\` depending on how the repo is wired — see the **Deploying** section) is the only step that mutates remote state — do it only when the user explicitly asks to deploy/publish/push.
 
 For a **visual** open-the-script-in-the-dev-page preview (rather than \`script preview\`'s run-and-print-result), use the \`preview\` skill.
 
@@ -1150,7 +1150,7 @@ After writing, tell the user which command fits what they want to do:
 - \`wmill script preview <script_path>\` — **default when iterating on a local script.** Runs the local file without deploying.
 - \`wmill script run <path>\` — runs the script **already deployed** in the workspace. Use only when the user explicitly wants to test the deployed version, not local edits.
 - \`wmill generate-metadata\` — regenerate the local \`.script.yaml\` (input schema) and \`.lock\` (resolved dependencies) for scripts you changed, and refresh their content hashes in \`wmill-lock.yaml\`. Local files only — **not** a deploy. See "Keep metadata in sync" below.
-- \`wmill sync push\` — deploy local changes to the workspace. Only suggest/run this when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
+- Deploy local changes to the workspace — via \`git push\` or \`wmill sync push\` depending on how the repo is wired (see the **Deploying** section in \`AGENTS.wmill.md\`). Only suggest/run a deploy when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
 
 ### Preview vs run — choose by intent, not habit
 
@@ -1180,7 +1180,7 @@ If the user hasn't already told you to run/test/preview the script, offer it as
 
 If the user already asked to test/run/try the script in their original request, skip the offer and just execute \`wmill script preview <path> -d '<args>'\` directly — pick plausible args from the script's declared parameters. The shape varies by language: \`main(...)\` for code languages, the SQL dialect's own placeholder syntax (\`$1\` for PostgreSQL, \`?\` for MySQL/Snowflake, \`@P1\` for MSSQL, \`@name\` for BigQuery, etc.), positional \`$1\`, \`$2\`, … for Bash, \`param(...)\` for PowerShell.
 
-\`wmill script preview\` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). \`wmill generate-metadata\` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's \`AGENTS.md\` opts in), per "Keep metadata in sync" above. Only \`wmill sync push\` deploys to the workspace — run it only when the user explicitly asks to deploy/publish/push.
+\`wmill script preview\` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). \`wmill generate-metadata\` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's \`AGENTS.md\` opts in), per "Keep metadata in sync" above. Deploying to the workspace (\`git push\` or \`wmill sync push\` depending on how the repo is wired — see the **Deploying** section) is the only step that mutates remote state — do it only when the user explicitly asks to deploy/publish/push.
 
 For a **visual** open-the-script-in-the-dev-page preview (rather than \`script preview\`'s run-and-print-result), use the \`preview\` skill.
 
@@ -1914,7 +1914,7 @@ After writing, tell the user which command fits what they want to do:
 - \`wmill script preview <script_path>\` — **default when iterating on a local script.** Runs the local file without deploying.
 - \`wmill script run <path>\` — runs the script **already deployed** in the workspace. Use only when the user explicitly wants to test the deployed version, not local edits.
 - \`wmill generate-metadata\` — regenerate the local \`.script.yaml\` (input schema) and \`.lock\` (resolved dependencies) for scripts you changed, and refresh their content hashes in \`wmill-lock.yaml\`. Local files only — **not** a deploy. See "Keep metadata in sync" below.
-- \`wmill sync push\` — deploy local changes to the workspace. Only suggest/run this when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
+- Deploy local changes to the workspace — via \`git push\` or \`wmill sync push\` depending on how the repo is wired (see the **Deploying** section in \`AGENTS.wmill.md\`). Only suggest/run a deploy when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
 
 ### Preview vs run — choose by intent, not habit
 
@@ -1944,7 +1944,7 @@ If the user hasn't already told you to run/test/preview the script, offer it as
 
 If the user already asked to test/run/try the script in their original request, skip the offer and just execute \`wmill script preview <path> -d '<args>'\` directly — pick plausible args from the script's declared parameters. The shape varies by language: \`main(...)\` for code languages, the SQL dialect's own placeholder syntax (\`$1\` for PostgreSQL, \`?\` for MySQL/Snowflake, \`@P1\` for MSSQL, \`@name\` for BigQuery, etc.), positional \`$1\`, \`$2\`, … for Bash, \`param(...)\` for PowerShell.
 
-\`wmill script preview\` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). \`wmill generate-metadata\` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's \`AGENTS.md\` opts in), per "Keep metadata in sync" above. Only \`wmill sync push\` deploys to the workspace — run it only when the user explicitly asks to deploy/publish/push.
+\`wmill script preview\` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). \`wmill generate-metadata\` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's \`AGENTS.md\` opts in), per "Keep metadata in sync" above. Deploying to the workspace (\`git push\` or \`wmill sync push\` depending on how the repo is wired — see the **Deploying** section) is the only step that mutates remote state — do it only when the user explicitly asks to deploy/publish/push.
 
 For a **visual** open-the-script-in-the-dev-page preview (rather than \`script preview\`'s run-and-print-result), use the \`preview\` skill.
 
@@ -2006,7 +2006,7 @@ After writing, tell the user which command fits what they want to do:
 - \`wmill script preview <script_path>\` — **default when iterating on a local script.** Runs the local file without deploying.
 - \`wmill script run <path>\` — runs the script **already deployed** in the workspace. Use only when the user explicitly wants to test the deployed version, not local edits.
 - \`wmill generate-metadata\` — regenerate the local \`.script.yaml\` (input schema) and \`.lock\` (resolved dependencies) for scripts you changed, and refresh their content hashes in \`wmill-lock.yaml\`. Local files only — **not** a deploy. See "Keep metadata in sync" below.
-- \`wmill sync push\` — deploy local changes to the workspace. Only suggest/run this when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
+- Deploy local changes to the workspace — via \`git push\` or \`wmill sync push\` depending on how the repo is wired (see the **Deploying** section in \`AGENTS.wmill.md\`). Only suggest/run a deploy when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
 
 ### Preview vs run — choose by intent, not habit
 
@@ -2036,7 +2036,7 @@ If the user hasn't already told you to run/test/preview the script, offer it as
 
 If the user already asked to test/run/try the script in their original request, skip the offer and just execute \`wmill script preview <path> -d '<args>'\` directly — pick plausible args from the script's declared parameters. The shape varies by language: \`main(...)\` for code languages, the SQL dialect's own placeholder syntax (\`$1\` for PostgreSQL, \`?\` for MySQL/Snowflake, \`@P1\` for MSSQL, \`@name\` for BigQuery, etc.), positional \`$1\`, \`$2\`, … for Bash, \`param(...)\` for PowerShell.
 
-\`wmill script preview\` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). \`wmill generate-metadata\` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's \`AGENTS.md\` opts in), per "Keep metadata in sync" above. Only \`wmill sync push\` deploys to the workspace — run it only when the user explicitly asks to deploy/publish/push.
+\`wmill script preview\` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). \`wmill generate-metadata\` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's \`AGENTS.md\` opts in), per "Keep metadata in sync" above. Deploying to the workspace (\`git push\` or \`wmill sync push\` depending on how the repo is wired — see the **Deploying** section) is the only step that mutates remote state — do it only when the user explicitly asks to deploy/publish/push.
 
 For a **visual** open-the-script-in-the-dev-page preview (rather than \`script preview\`'s run-and-print-result), use the \`preview\` skill.
 
@@ -2770,7 +2770,7 @@ After writing, tell the user which command fits what they want to do:
 - \`wmill script preview <script_path>\` — **default when iterating on a local script.** Runs the local file without deploying.
 - \`wmill script run <path>\` — runs the script **already deployed** in the workspace. Use only when the user explicitly wants to test the deployed version, not local edits.
 - \`wmill generate-metadata\` — regenerate the local \`.script.yaml\` (input schema) and \`.lock\` (resolved dependencies) for scripts you changed, and refresh their content hashes in \`wmill-lock.yaml\`. Local files only — **not** a deploy. See "Keep metadata in sync" below.
-- \`wmill sync push\` — deploy local changes to the workspace. Only suggest/run this when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
+- Deploy local changes to the workspace — via \`git push\` or \`wmill sync push\` depending on how the repo is wired (see the **Deploying** section in \`AGENTS.wmill.md\`). Only suggest/run a deploy when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
 
 ### Preview vs run — choose by intent, not habit
 
@@ -2800,7 +2800,7 @@ If the user hasn't already told you to run/test/preview the script, offer it as
 
 If the user already asked to test/run/try the script in their original request, skip the offer and just execute \`wmill script preview <path> -d '<args>'\` directly — pick plausible args from the script's declared parameters. The shape varies by language: \`main(...)\` for code languages, the SQL dialect's own placeholder syntax (\`$1\` for PostgreSQL, \`?\` for MySQL/Snowflake, \`@P1\` for MSSQL, \`@name\` for BigQuery, etc.), positional \`$1\`, \`$2\`, … for Bash, \`param(...)\` for PowerShell.
 
-\`wmill script preview\` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). \`wmill generate-metadata\` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's \`AGENTS.md\` opts in), per "Keep metadata in sync" above. Only \`wmill sync push\` deploys to the workspace — run it only when the user explicitly asks to deploy/publish/push.
+\`wmill script preview\` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). \`wmill generate-metadata\` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's \`AGENTS.md\` opts in), per "Keep metadata in sync" above. Deploying to the workspace (\`git push\` or \`wmill sync push\` depending on how the repo is wired — see the **Deploying** section) is the only step that mutates remote state — do it only when the user explicitly asks to deploy/publish/push.
 
 For a **visual** open-the-script-in-the-dev-page preview (rather than \`script preview\`'s run-and-print-result), use the \`preview\` skill.
 
@@ -2896,7 +2896,7 @@ After writing, tell the user which command fits what they want to do:
 - \`wmill script preview <script_path>\` — **default when iterating on a local script.** Runs the local file without deploying.
 - \`wmill script run <path>\` — runs the script **already deployed** in the workspace. Use only when the user explicitly wants to test the deployed version, not local edits.
 - \`wmill generate-metadata\` — regenerate the local \`.script.yaml\` (input schema) and \`.lock\` (resolved dependencies) for scripts you changed, and refresh their content hashes in \`wmill-lock.yaml\`. Local files only — **not** a deploy. See "Keep metadata in sync" below.
-- \`wmill sync push\` — deploy local changes to the workspace. Only suggest/run this when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
+- Deploy local changes to the workspace — via \`git push\` or \`wmill sync push\` depending on how the repo is wired (see the **Deploying** section in \`AGENTS.wmill.md\`). Only suggest/run a deploy when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
 
 ### Preview vs run — choose by intent, not habit
 
@@ -2926,7 +2926,7 @@ If the user hasn't already told you to run/test/preview the script, offer it as
 
 If the user already asked to test/run/try the script in their original request, skip the offer and just execute \`wmill script preview <path> -d '<args>'\` directly — pick plausible args from the script's declared parameters. The shape varies by language: \`main(...)\` for code languages, the SQL dialect's own placeholder syntax (\`$1\` for PostgreSQL, \`?\` for MySQL/Snowflake, \`@P1\` for MSSQL, \`@name\` for BigQuery, etc.), positional \`$1\`, \`$2\`, … for Bash, \`param(...)\` for PowerShell.
 
-\`wmill script preview\` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). \`wmill generate-metadata\` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's \`AGENTS.md\` opts in), per "Keep metadata in sync" above. Only \`wmill sync push\` deploys to the workspace — run it only when the user explicitly asks to deploy/publish/push.
+\`wmill script preview\` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). \`wmill generate-metadata\` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's \`AGENTS.md\` opts in), per "Keep metadata in sync" above. Deploying to the workspace (\`git push\` or \`wmill sync push\` depending on how the repo is wired — see the **Deploying** section) is the only step that mutates remote state — do it only when the user explicitly asks to deploy/publish/push.
 
 For a **visual** open-the-script-in-the-dev-page preview (rather than \`script preview\`'s run-and-print-result), use the \`preview\` skill.
 
@@ -3005,7 +3005,7 @@ After writing, tell the user which command fits what they want to do:
 - \`wmill script preview <script_path>\` — **default when iterating on a local script.** Runs the local file without deploying.
 - \`wmill script run <path>\` — runs the script **already deployed** in the workspace. Use only when the user explicitly wants to test the deployed version, not local edits.
 - \`wmill generate-metadata\` — regenerate the local \`.script.yaml\` (input schema) and \`.lock\` (resolved dependencies) for scripts you changed, and refresh their content hashes in \`wmill-lock.yaml\`. Local files only — **not** a deploy. See "Keep metadata in sync" below.
-- \`wmill sync push\` — deploy local changes to the workspace. Only suggest/run this when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
+- Deploy local changes to the workspace — via \`git push\` or \`wmill sync push\` depending on how the repo is wired (see the **Deploying** section in \`AGENTS.wmill.md\`). Only suggest/run a deploy when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
 
 ### Preview vs run — choose by intent, not habit
 
@@ -3035,7 +3035,7 @@ If the user hasn't already told you to run/test/preview the script, offer it as
 
 If the user already asked to test/run/try the script in their original request, skip the offer and just execute \`wmill script preview <path> -d '<args>'\` directly — pick plausible args from the script's declared parameters. The shape varies by language: \`main(...)\` for code languages, the SQL dialect's own placeholder syntax (\`$1\` for PostgreSQL, \`?\` for MySQL/Snowflake, \`@P1\` for MSSQL, \`@name\` for BigQuery, etc.), positional \`$1\`, \`$2\`, … for Bash, \`param(...)\` for PowerShell.
 
-\`wmill script preview\` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). \`wmill generate-metadata\` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's \`AGENTS.md\` opts in), per "Keep metadata in sync" above. Only \`wmill sync push\` deploys to the workspace — run it only when the user explicitly asks to deploy/publish/push.
+\`wmill script preview\` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). \`wmill generate-metadata\` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's \`AGENTS.md\` opts in), per "Keep metadata in sync" above. Deploying to the workspace (\`git push\` or \`wmill sync push\` depending on how the repo is wired — see the **Deploying** section) is the only step that mutates remote state — do it only when the user explicitly asks to deploy/publish/push.
 
 For a **visual** open-the-script-in-the-dev-page preview (rather than \`script preview\`'s run-and-print-result), use the \`preview\` skill.
 
@@ -3101,7 +3101,7 @@ After writing, tell the user which command fits what they want to do:
 - \`wmill script preview <script_path>\` — **default when iterating on a local script.** Runs the local file without deploying.
 - \`wmill script run <path>\` — runs the script **already deployed** in the workspace. Use only when the user explicitly wants to test the deployed version, not local edits.
 - \`wmill generate-metadata\` — regenerate the local \`.script.yaml\` (input schema) and \`.lock\` (resolved dependencies) for scripts you changed, and refresh their content hashes in \`wmill-lock.yaml\`. Local files only — **not** a deploy. See "Keep metadata in sync" below.
-- \`wmill sync push\` — deploy local changes to the workspace. Only suggest/run this when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
+- Deploy local changes to the workspace — via \`git push\` or \`wmill sync push\` depending on how the repo is wired (see the **Deploying** section in \`AGENTS.wmill.md\`). Only suggest/run a deploy when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
 
 ### Preview vs run — choose by intent, not habit
 
@@ -3131,7 +3131,7 @@ If the user hasn't already told you to run/test/preview the script, offer it as
 
 If the user already asked to test/run/try the script in their original request, skip the offer and just execute \`wmill script preview <path> -d '<args>'\` directly — pick plausible args from the script's declared parameters. The shape varies by language: \`main(...)\` for code languages, the SQL dialect's own placeholder syntax (\`$1\` for PostgreSQL, \`?\` for MySQL/Snowflake, \`@P1\` for MSSQL, \`@name\` for BigQuery, etc.), positional \`$1\`, \`$2\`, … for Bash, \`param(...)\` for PowerShell.
 
-\`wmill script preview\` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). \`wmill generate-metadata\` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's \`AGENTS.md\` opts in), per "Keep metadata in sync" above. Only \`wmill sync push\` deploys to the workspace — run it only when the user explicitly asks to deploy/publish/push.
+\`wmill script preview\` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). \`wmill generate-metadata\` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's \`AGENTS.md\` opts in), per "Keep metadata in sync" above. Deploying to the workspace (\`git push\` or \`wmill sync push\` depending on how the repo is wired — see the **Deploying** section) is the only step that mutates remote state — do it only when the user explicitly asks to deploy/publish/push.
 
 For a **visual** open-the-script-in-the-dev-page preview (rather than \`script preview\`'s run-and-print-result), use the \`preview\` skill.
 
@@ -3190,7 +3190,7 @@ After writing, tell the user which command fits what they want to do:
 - \`wmill script preview <script_path>\` — **default when iterating on a local script.** Runs the local file without deploying.
 - \`wmill script run <path>\` — runs the script **already deployed** in the workspace. Use only when the user explicitly wants to test the deployed version, not local edits.
 - \`wmill generate-metadata\` — regenerate the local \`.script.yaml\` (input schema) and \`.lock\` (resolved dependencies) for scripts you changed, and refresh their content hashes in \`wmill-lock.yaml\`. Local files only — **not** a deploy. See "Keep metadata in sync" below.
-- \`wmill sync push\` — deploy local changes to the workspace. Only suggest/run this when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
+- Deploy local changes to the workspace — via \`git push\` or \`wmill sync push\` depending on how the repo is wired (see the **Deploying** section in \`AGENTS.wmill.md\`). Only suggest/run a deploy when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
 
 ### Preview vs run — choose by intent, not habit
 
@@ -3220,7 +3220,7 @@ If the user hasn't already told you to run/test/preview the script, offer it as
 
 If the user already asked to test/run/try the script in their original request, skip the offer and just execute \`wmill script preview <path> -d '<args>'\` directly — pick plausible args from the script's declared parameters. The shape varies by language: \`main(...)\` for code languages, the SQL dialect's own placeholder syntax (\`$1\` for PostgreSQL, \`?\` for MySQL/Snowflake, \`@P1\` for MSSQL, \`@name\` for BigQuery, etc.), positional \`$1\`, \`$2\`, … for Bash, \`param(...)\` for PowerShell.
 
-\`wmill script preview\` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). \`wmill generate-metadata\` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's \`AGENTS.md\` opts in), per "Keep metadata in sync" above. Only \`wmill sync push\` deploys to the workspace — run it only when the user explicitly asks to deploy/publish/push.
+\`wmill script preview\` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). \`wmill generate-metadata\` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's \`AGENTS.md\` opts in), per "Keep metadata in sync" above. Deploying to the workspace (\`git push\` or \`wmill sync push\` depending on how the repo is wired — see the **Deploying** section) is the only step that mutates remote state — do it only when the user explicitly asks to deploy/publish/push.
 
 For a **visual** open-the-script-in-the-dev-page preview (rather than \`script preview\`'s run-and-print-result), use the \`preview\` skill.
 
@@ -3282,7 +3282,7 @@ After writing, tell the user which command fits what they want to do:
 - \`wmill script preview <script_path>\` — **default when iterating on a local script.** Runs the local file without deploying.
 - \`wmill script run <path>\` — runs the script **already deployed** in the workspace. Use only when the user explicitly wants to test the deployed version, not local edits.
 - \`wmill generate-metadata\` — regenerate the local \`.script.yaml\` (input schema) and \`.lock\` (resolved dependencies) for scripts you changed, and refresh their content hashes in \`wmill-lock.yaml\`. Local files only — **not** a deploy. See "Keep metadata in sync" below.
-- \`wmill sync push\` — deploy local changes to the workspace. Only suggest/run this when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
+- Deploy local changes to the workspace — via \`git push\` or \`wmill sync push\` depending on how the repo is wired (see the **Deploying** section in \`AGENTS.wmill.md\`). Only suggest/run a deploy when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
 
 ### Preview vs run — choose by intent, not habit
 
@@ -3312,7 +3312,7 @@ If the user hasn't already told you to run/test/preview the script, offer it as
 
 If the user already asked to test/run/try the script in their original request, skip the offer and just execute \`wmill script preview <path> -d '<args>'\` directly — pick plausible args from the script's declared parameters. The shape varies by language: \`main(...)\` for code languages, the SQL dialect's own placeholder syntax (\`$1\` for PostgreSQL, \`?\` for MySQL/Snowflake, \`@P1\` for MSSQL, \`@name\` for BigQuery, etc.), positional \`$1\`, \`$2\`, … for Bash, \`param(...)\` for PowerShell.
 
-\`wmill script preview\` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). \`wmill generate-metadata\` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's \`AGENTS.md\` opts in), per "Keep metadata in sync" above. Only \`wmill sync push\` deploys to the workspace — run it only when the user explicitly asks to deploy/publish/push.
+\`wmill script preview\` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). \`wmill generate-metadata\` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's \`AGENTS.md\` opts in), per "Keep metadata in sync" above. Deploying to the workspace (\`git push\` or \`wmill sync push\` depending on how the repo is wired — see the **Deploying** section) is the only step that mutates remote state — do it only when the user explicitly asks to deploy/publish/push.
 
 For a **visual** open-the-script-in-the-dev-page preview (rather than \`script preview\`'s run-and-print-result), use the \`preview\` skill.
 
@@ -3375,7 +3375,7 @@ After writing, tell the user which command fits what they want to do:
 - \`wmill script preview <script_path>\` — **default when iterating on a local script.** Runs the local file without deploying.
 - \`wmill script run <path>\` — runs the script **already deployed** in the workspace. Use only when the user explicitly wants to test the deployed version, not local edits.
 - \`wmill generate-metadata\` — regenerate the local \`.script.yaml\` (input schema) and \`.lock\` (resolved dependencies) for scripts you changed, and refresh their content hashes in \`wmill-lock.yaml\`. Local files only — **not** a deploy. See "Keep metadata in sync" below.
-- \`wmill sync push\` — deploy local changes to the workspace. Only suggest/run this when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
+- Deploy local changes to the workspace — via \`git push\` or \`wmill sync push\` depending on how the repo is wired (see the **Deploying** section in \`AGENTS.wmill.md\`). Only suggest/run a deploy when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
 
 ### Preview vs run — choose by intent, not habit
 
@@ -3405,7 +3405,7 @@ If the user hasn't already told you to run/test/preview the script, offer it as
 
 If the user already asked to test/run/try the script in their original request, skip the offer and just execute \`wmill script preview <path> -d '<args>'\` directly — pick plausible args from the script's declared parameters. The shape varies by language: \`main(...)\` for code languages, the SQL dialect's own placeholder syntax (\`$1\` for PostgreSQL, \`?\` for MySQL/Snowflake, \`@P1\` for MSSQL, \`@name\` for BigQuery, etc.), positional \`$1\`, \`$2\`, … for Bash, \`param(...)\` for PowerShell.
 
-\`wmill script preview\` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). \`wmill generate-metadata\` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's \`AGENTS.md\` opts in), per "Keep metadata in sync" above. Only \`wmill sync push\` deploys to the workspace — run it only when the user explicitly asks to deploy/publish/push.
+\`wmill script preview\` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). \`wmill generate-metadata\` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's \`AGENTS.md\` opts in), per "Keep metadata in sync" above. Deploying to the workspace (\`git push\` or \`wmill sync push\` depending on how the repo is wired — see the **Deploying** section) is the only step that mutates remote state — do it only when the user explicitly asks to deploy/publish/push.
 
 For a **visual** open-the-script-in-the-dev-page preview (rather than \`script preview\`'s run-and-print-result), use the \`preview\` skill.
 
@@ -3483,7 +3483,7 @@ After writing, tell the user which command fits what they want to do:
 - \`wmill script preview <script_path>\` — **default when iterating on a local script.** Runs the local file without deploying.
 - \`wmill script run <path>\` — runs the script **already deployed** in the workspace. Use only when the user explicitly wants to test the deployed version, not local edits.
 - \`wmill generate-metadata\` — regenerate the local \`.script.yaml\` (input schema) and \`.lock\` (resolved dependencies) for scripts you changed, and refresh their content hashes in \`wmill-lock.yaml\`. Local files only — **not** a deploy. See "Keep metadata in sync" below.
-- \`wmill sync push\` — deploy local changes to the workspace. Only suggest/run this when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
+- Deploy local changes to the workspace — via \`git push\` or \`wmill sync push\` depending on how the repo is wired (see the **Deploying** section in \`AGENTS.wmill.md\`). Only suggest/run a deploy when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
 
 ### Preview vs run — choose by intent, not habit
 
@@ -3513,7 +3513,7 @@ If the user hasn't already told you to run/test/preview the script, offer it as
 
 If the user already asked to test/run/try the script in their original request, skip the offer and just execute \`wmill script preview <path> -d '<args>'\` directly — pick plausible args from the script's declared parameters. The shape varies by language: \`main(...)\` for code languages, the SQL dialect's own placeholder syntax (\`$1\` for PostgreSQL, \`?\` for MySQL/Snowflake, \`@P1\` for MSSQL, \`@name\` for BigQuery, etc.), positional \`$1\`, \`$2\`, … for Bash, \`param(...)\` for PowerShell.
 
-\`wmill script preview\` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). \`wmill generate-metadata\` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's \`AGENTS.md\` opts in), per "Keep metadata in sync" above. Only \`wmill sync push\` deploys to the workspace — run it only when the user explicitly asks to deploy/publish/push.
+\`wmill script preview\` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). \`wmill generate-metadata\` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's \`AGENTS.md\` opts in), per "Keep metadata in sync" above. Deploying to the workspace (\`git push\` or \`wmill sync push\` depending on how the repo is wired — see the **Deploying** section) is the only step that mutates remote state — do it only when the user explicitly asks to deploy/publish/push.
 
 For a **visual** open-the-script-in-the-dev-page preview (rather than \`script preview\`'s run-and-print-result), use the \`preview\` skill.
 
@@ -3574,7 +3574,7 @@ After writing, tell the user which command fits what they want to do:
 - \`wmill script preview <script_path>\` — **default when iterating on a local script.** Runs the local file without deploying.
 - \`wmill script run <path>\` — runs the script **already deployed** in the workspace. Use only when the user explicitly wants to test the deployed version, not local edits.
 - \`wmill generate-metadata\` — regenerate the local \`.script.yaml\` (input schema) and \`.lock\` (resolved dependencies) for scripts you changed, and refresh their content hashes in \`wmill-lock.yaml\`. Local files only — **not** a deploy. See "Keep metadata in sync" below.
-- \`wmill sync push\` — deploy local changes to the workspace. Only suggest/run this when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
+- Deploy local changes to the workspace — via \`git push\` or \`wmill sync push\` depending on how the repo is wired (see the **Deploying** section in \`AGENTS.wmill.md\`). Only suggest/run a deploy when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
 
 ### Preview vs run — choose by intent, not habit
 
@@ -3604,7 +3604,7 @@ If the user hasn't already told you to run/test/preview the script, offer it as
 
 If the user already asked to test/run/try the script in their original request, skip the offer and just execute \`wmill script preview <path> -d '<args>'\` directly — pick plausible args from the script's declared parameters. The shape varies by language: \`main(...)\` for code languages, the SQL dialect's own placeholder syntax (\`$1\` for PostgreSQL, \`?\` for MySQL/Snowflake, \`@P1\` for MSSQL, \`@name\` for BigQuery, etc.), positional \`$1\`, \`$2\`, … for Bash, \`param(...)\` for PowerShell.
 
-\`wmill script preview\` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). \`wmill generate-metadata\` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's \`AGENTS.md\` opts in), per "Keep metadata in sync" above. Only \`wmill sync push\` deploys to the workspace — run it only when the user explicitly asks to deploy/publish/push.
+\`wmill script preview\` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). \`wmill generate-metadata\` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's \`AGENTS.md\` opts in), per "Keep metadata in sync" above. Deploying to the workspace (\`git push\` or \`wmill sync push\` depending on how the repo is wired — see the **Deploying** section) is the only step that mutates remote state — do it only when the user explicitly asks to deploy/publish/push.
 
 For a **visual** open-the-script-in-the-dev-page preview (rather than \`script preview\`'s run-and-print-result), use the \`preview\` skill.
 
@@ -3680,7 +3680,7 @@ After writing, tell the user which command fits what they want to do:
 - \`wmill script preview <script_path>\` — **default when iterating on a local script.** Runs the local file without deploying.
 - \`wmill script run <path>\` — runs the script **already deployed** in the workspace. Use only when the user explicitly wants to test the deployed version, not local edits.
 - \`wmill generate-metadata\` — regenerate the local \`.script.yaml\` (input schema) and \`.lock\` (resolved dependencies) for scripts you changed, and refresh their content hashes in \`wmill-lock.yaml\`. Local files only — **not** a deploy. See "Keep metadata in sync" below.
-- \`wmill sync push\` — deploy local changes to the workspace. Only suggest/run this when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
+- Deploy local changes to the workspace — via \`git push\` or \`wmill sync push\` depending on how the repo is wired (see the **Deploying** section in \`AGENTS.wmill.md\`). Only suggest/run a deploy when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
 
 ### Preview vs run — choose by intent, not habit
 
@@ -3710,7 +3710,7 @@ If the user hasn't already told you to run/test/preview the script, offer it as
 
 If the user already asked to test/run/try the script in their original request, skip the offer and just execute \`wmill script preview <path> -d '<args>'\` directly — pick plausible args from the script's declared parameters. The shape varies by language: \`main(...)\` for code languages, the SQL dialect's own placeholder syntax (\`$1\` for PostgreSQL, \`?\` for MySQL/Snowflake, \`@P1\` for MSSQL, \`@name\` for BigQuery, etc.), positional \`$1\`, \`$2\`, … for Bash, \`param(...)\` for PowerShell.
 
-\`wmill script preview\` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). \`wmill generate-metadata\` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's \`AGENTS.md\` opts in), per "Keep metadata in sync" above. Only \`wmill sync push\` deploys to the workspace — run it only when the user explicitly asks to deploy/publish/push.
+\`wmill script preview\` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). \`wmill generate-metadata\` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's \`AGENTS.md\` opts in), per "Keep metadata in sync" above. Deploying to the workspace (\`git push\` or \`wmill sync push\` depending on how the repo is wired — see the **Deploying** section) is the only step that mutates remote state — do it only when the user explicitly asks to deploy/publish/push.
 
 For a **visual** open-the-script-in-the-dev-page preview (rather than \`script preview\`'s run-and-print-result), use the \`preview\` skill.
 
@@ -4583,7 +4583,7 @@ After writing, tell the user which command fits what they want to do:
 - \`wmill script preview <script_path>\` — **default when iterating on a local script.** Runs the local file without deploying.
 - \`wmill script run <path>\` — runs the script **already deployed** in the workspace. Use only when the user explicitly wants to test the deployed version, not local edits.
 - \`wmill generate-metadata\` — regenerate the local \`.script.yaml\` (input schema) and \`.lock\` (resolved dependencies) for scripts you changed, and refresh their content hashes in \`wmill-lock.yaml\`. Local files only — **not** a deploy. See "Keep metadata in sync" below.
-- \`wmill sync push\` — deploy local changes to the workspace. Only suggest/run this when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
+- Deploy local changes to the workspace — via \`git push\` or \`wmill sync push\` depending on how the repo is wired (see the **Deploying** section in \`AGENTS.wmill.md\`). Only suggest/run a deploy when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
 
 ### Preview vs run — choose by intent, not habit
 
@@ -4613,7 +4613,7 @@ If the user hasn't already told you to run/test/preview the script, offer it as
 
 If the user already asked to test/run/try the script in their original request, skip the offer and just execute \`wmill script preview <path> -d '<args>'\` directly — pick plausible args from the script's declared parameters. The shape varies by language: \`main(...)\` for code languages, the SQL dialect's own placeholder syntax (\`$1\` for PostgreSQL, \`?\` for MySQL/Snowflake, \`@P1\` for MSSQL, \`@name\` for BigQuery, etc.), positional \`$1\`, \`$2\`, … for Bash, \`param(...)\` for PowerShell.
 
-\`wmill script preview\` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). \`wmill generate-metadata\` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's \`AGENTS.md\` opts in), per "Keep metadata in sync" above. Only \`wmill sync push\` deploys to the workspace — run it only when the user explicitly asks to deploy/publish/push.
+\`wmill script preview\` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). \`wmill generate-metadata\` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's \`AGENTS.md\` opts in), per "Keep metadata in sync" above. Deploying to the workspace (\`git push\` or \`wmill sync push\` depending on how the repo is wired — see the **Deploying** section) is the only step that mutates remote state — do it only when the user explicitly asks to deploy/publish/push.
 
 For a **visual** open-the-script-in-the-dev-page preview (rather than \`script preview\`'s run-and-print-result), use the \`preview\` skill.
 
@@ -4719,7 +4719,7 @@ After writing, tell the user which command fits what they want to do:
 - \`wmill script preview <script_path>\` — **default when iterating on a local script.** Runs the local file without deploying.
 - \`wmill script run <path>\` — runs the script **already deployed** in the workspace. Use only when the user explicitly wants to test the deployed version, not local edits.
 - \`wmill generate-metadata\` — regenerate the local \`.script.yaml\` (input schema) and \`.lock\` (resolved dependencies) for scripts you changed, and refresh their content hashes in \`wmill-lock.yaml\`. Local files only — **not** a deploy. See "Keep metadata in sync" below.
-- \`wmill sync push\` — deploy local changes to the workspace. Only suggest/run this when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
+- Deploy local changes to the workspace — via \`git push\` or \`wmill sync push\` depending on how the repo is wired (see the **Deploying** section in \`AGENTS.wmill.md\`). Only suggest/run a deploy when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
 
 ### Preview vs run — choose by intent, not habit
 
@@ -4749,7 +4749,7 @@ If the user hasn't already told you to run/test/preview the script, offer it as
 
 If the user already asked to test/run/try the script in their original request, skip the offer and just execute \`wmill script preview <path> -d '<args>'\` directly — pick plausible args from the script's declared parameters. The shape varies by language: \`main(...)\` for code languages, the SQL dialect's own placeholder syntax (\`$1\` for PostgreSQL, \`?\` for MySQL/Snowflake, \`@P1\` for MSSQL, \`@name\` for BigQuery, etc.), positional \`$1\`, \`$2\`, … for Bash, \`param(...)\` for PowerShell.
 
-\`wmill script preview\` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). \`wmill generate-metadata\` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's \`AGENTS.md\` opts in), per "Keep metadata in sync" above. Only \`wmill sync push\` deploys to the workspace — run it only when the user explicitly asks to deploy/publish/push.
+\`wmill script preview\` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). \`wmill generate-metadata\` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's \`AGENTS.md\` opts in), per "Keep metadata in sync" above. Deploying to the workspace (\`git push\` or \`wmill sync push\` depending on how the repo is wired — see the **Deploying** section) is the only step that mutates remote state — do it only when the user explicitly asks to deploy/publish/push.
 
 For a **visual** open-the-script-in-the-dev-page preview (rather than \`script preview\`'s run-and-print-result), use the \`preview\` skill.
 
@@ -4845,7 +4845,7 @@ After writing, tell the user which command fits what they want to do:
 - \`wmill script preview <script_path>\` — **default when iterating on a local script.** Runs the local file without deploying.
 - \`wmill script run <path>\` — runs the script **already deployed** in the workspace. Use only when the user explicitly wants to test the deployed version, not local edits.
 - \`wmill generate-metadata\` — regenerate the local \`.script.yaml\` (input schema) and \`.lock\` (resolved dependencies) for scripts you changed, and refresh their content hashes in \`wmill-lock.yaml\`. Local files only — **not** a deploy. See "Keep metadata in sync" below.
-- \`wmill sync push\` — deploy local changes to the workspace. Only suggest/run this when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
+- Deploy local changes to the workspace — via \`git push\` or \`wmill sync push\` depending on how the repo is wired (see the **Deploying** section in \`AGENTS.wmill.md\`). Only suggest/run a deploy when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
 
 ### Preview vs run — choose by intent, not habit
 
@@ -4875,7 +4875,7 @@ If the user hasn't already told you to run/test/preview the script, offer it as
 
 If the user already asked to test/run/try the script in their original request, skip the offer and just execute \`wmill script preview <path> -d '<args>'\` directly — pick plausible args from the script's declared parameters. The shape varies by language: \`main(...)\` for code languages, the SQL dialect's own placeholder syntax (\`$1\` for PostgreSQL, \`?\` for MySQL/Snowflake, \`@P1\` for MSSQL, \`@name\` for BigQuery, etc.), positional \`$1\`, \`$2\`, … for Bash, \`param(...)\` for PowerShell.
 
-\`wmill script preview\` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). \`wmill generate-metadata\` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's \`AGENTS.md\` opts in), per "Keep metadata in sync" above. Only \`wmill sync push\` deploys to the workspace — run it only when the user explicitly asks to deploy/publish/push.
+\`wmill script preview\` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). \`wmill generate-metadata\` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's \`AGENTS.md\` opts in), per "Keep metadata in sync" above. Deploying to the workspace (\`git push\` or \`wmill sync push\` depending on how the repo is wired — see the **Deploying** section) is the only step that mutates remote state — do it only when the user explicitly asks to deploy/publish/push.
 
 For a **visual** open-the-script-in-the-dev-page preview (rather than \`script preview\`'s run-and-print-result), use the \`preview\` skill.
 
@@ -4975,7 +4975,7 @@ After writing, act on the user's intent instead of just listing commands. Run \`
 - \`wmill flow preview <flow_path>\` — **default when iterating on a local flow.** Runs the local \`flow.yaml\` against local inline scripts without deploying. Add \`--remote\` to use deployed workspace scripts for PathScript steps instead of local files. Add \`--step <step_id>\` to run only one module in isolation (see "Single-step vs whole-flow preview" below).
 - \`wmill flow run <path>\` — runs the flow **already deployed** in the workspace. Use only when the user explicitly wants to test the deployed version, not local edits.
 - \`wmill generate-metadata\` — regenerate stale local \`.lock\` files for the flow and its inline scripts and refresh their content hashes in \`wmill-lock.yaml\`. Writes local files only (not a deploy). Run it after editing inline scripts whose imports or arguments changed, so \`wmill-lock.yaml\` doesn't drift and add noise to git-sync/CI. By default it scans **scripts, flows, and apps** across the workspace but only regenerates stale ones; pass the flow's folder as an argument (or run from that subdirectory) to limit the scope to the flow you edited. Note a flow (or script) that imports a changed shared script is pulled in too — run \`wmill generate-metadata --dry-run\` to see exactly what is stale and why (\`content changed\` vs \`depends on <path>\`) before applying.
-- \`wmill sync push\` — deploy local changes to the workspace. Only suggest/run this when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
+- Deploy local changes to the workspace — via \`git push\` or \`wmill sync push\` depending on how the repo is wired (see the **Deploying** section in \`AGENTS.wmill.md\`). Only suggest/run a deploy when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
 
 ### Preview vs run — choose by intent, not habit
 
@@ -5786,7 +5786,7 @@ Text/HTML/inline parts are placed inline in \`body\` as strings.
 
 ## CLI Commands
 
-\`wmill sync push\` deploys local changes to the workspace and can be destructive to remote state — only suggest/run it when the user explicitly asks to deploy/publish/push, not when they say "run", "try", or "test". \`sync pull\` is safe to run yourself — it never mutates remote state, though it does overwrite local files to match the remote (use \`sync pull --dry-run\` to only preview).
+Deploying local changes to the workspace can be destructive to remote state — only suggest/run a deploy when the user explicitly asks to deploy/publish/push, not when they say "run", "try", or "test". Deploy via \`git push\` or \`wmill sync push\` depending on how the repo is wired (see the **Deploying** section in \`AGENTS.wmill.md\`). \`sync pull\` is safe to run yourself — it never mutates remote state, though it does overwrite local files to match the remote (use \`sync pull --dry-run\` to only preview).
 
 \`\`\`bash
 # Push trigger configuration — only when the user explicitly asks to deploy
@@ -5837,7 +5837,7 @@ Windmill uses 6-field cron expressions (includes seconds):
 
 ## CLI Commands
 
-\`wmill sync push\` deploys local changes to the workspace and can be destructive to remote state — only suggest/run it when the user explicitly asks to deploy/publish/push, not when they say "run", "try", or "test". The commands below never mutate remote state, so they're safe to run yourself — note that \`sync pull\` does overwrite local files to match the remote (use \`sync pull --dry-run\` to only preview), while \`schedule\` just lists.
+Deploying local changes to the workspace can be destructive to remote state — only suggest/run a deploy when the user explicitly asks to deploy/publish/push, not when they say "run", "try", or "test". Deploy via \`git push\` or \`wmill sync push\` depending on how the repo is wired (see the **Deploying** section in \`AGENTS.wmill.md\`). The commands below never mutate remote state, so they're safe to run yourself — note that \`sync pull\` does overwrite local files to match the remote (use \`sync pull --dry-run\` to only preview), while \`schedule\` just lists.
 
 \`\`\`bash
 # Push schedules to Windmill — only when the user explicitly asks to deploy
@@ -6094,8 +6094,9 @@ wmill resource-type list --schema
 # Get specific resource type schema
 wmill resource-type get postgresql
 
-# Push resources to Windmill — deploys to the workspace and can be destructive to
-# remote state, so only run it when the user explicitly asks to deploy/publish/push
+# Deploy resources to the workspace — destructive to remote state, so only run when
+# the user explicitly asks to deploy/publish/push. Depending on how the repo is wired,
+# deploy via \`git push\` or \`wmill sync push\` (see the Deploying section in AGENTS.wmill.md).
 wmill sync push
 \`\`\`
 `,
@@ -6113,7 +6114,7 @@ After writing, tell the user which command fits what they want to do:
 - \`wmill script preview <script_path>\` — **default when iterating on a local script.** Runs the local file without deploying.
 - \`wmill script run <path>\` — runs the script **already deployed** in the workspace. Use only when the user explicitly wants to test the deployed version, not local edits.
 - \`wmill generate-metadata\` — regenerate the local \`.script.yaml\` (input schema) and \`.lock\` (resolved dependencies) for scripts you changed, and refresh their content hashes in \`wmill-lock.yaml\`. Local files only — **not** a deploy. See "Keep metadata in sync" below.
-- \`wmill sync push\` — deploy local changes to the workspace. Only suggest/run this when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
+- Deploy local changes to the workspace — via \`git push\` or \`wmill sync push\` depending on how the repo is wired (see the **Deploying** section in \`AGENTS.wmill.md\`). Only suggest/run a deploy when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
 
 ### Preview vs run — choose by intent, not habit
 
@@ -6143,7 +6144,7 @@ If the user hasn't already told you to run/test/preview the script, offer it as
 
 If the user already asked to test/run/try the script in their original request, skip the offer and just execute \`wmill script preview <path> -d '<args>'\` directly — pick plausible args from the script's declared parameters. The shape varies by language: \`main(...)\` for code languages, the SQL dialect's own placeholder syntax (\`$1\` for PostgreSQL, \`?\` for MySQL/Snowflake, \`@P1\` for MSSQL, \`@name\` for BigQuery, etc.), positional \`$1\`, \`$2\`, … for Bash, \`param(...)\` for PowerShell.
 
-\`wmill script preview\` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). \`wmill generate-metadata\` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's \`AGENTS.md\` opts in), per "Keep metadata in sync" above. Only \`wmill sync push\` deploys to the workspace — run it only when the user explicitly asks to deploy/publish/push.
+\`wmill script preview\` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). \`wmill generate-metadata\` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's \`AGENTS.md\` opts in), per "Keep metadata in sync" above. Deploying to the workspace (\`git push\` or \`wmill sync push\` depending on how the repo is wired — see the **Deploying** section) is the only step that mutates remote state — do it only when the user explicitly asks to deploy/publish/push.
 
 For a **visual** open-the-script-in-the-dev-page preview (rather than \`script preview\`'s run-and-print-result), use the \`preview\` skill.
 
@@ -6807,6 +6808,8 @@ Manage git-sync settings between local wmill.yaml and Windmill backend
   - \`--with-backend-settings <json:string>\` - Use provided JSON settings instead of querying backend (for testing)
   - \`--yes\` - Skip interactive prompts and use default behavior
   - \`--promotion <branch:string>\` - Use promotionOverrides from the specified branch instead of regular overrides
+- \`gitsync-settings status\` - Report how local changes deploy to the workspace (git push vs wmill sync push)
+  - \`--json-output\` - Output in JSON format
 
 ### group
 
diff --git a/system_prompts/auto-generated/cli/cli-commands.md b/system_prompts/auto-generated/cli/cli-commands.md
index 67b5ec70df..40909bbf3c 100644
--- a/system_prompts/auto-generated/cli/cli-commands.md
+++ b/system_prompts/auto-generated/cli/cli-commands.md
@@ -251,6 +251,8 @@ Manage git-sync settings between local wmill.yaml and Windmill backend
   - `--with-backend-settings <json:string>` - Use provided JSON settings instead of querying backend (for testing)
   - `--yes` - Skip interactive prompts and use default behavior
   - `--promotion <branch:string>` - Use promotionOverrides from the specified branch instead of regular overrides
+- `gitsync-settings status` - Report how local changes deploy to the workspace (git push vs wmill sync push)
+  - `--json-output` - Output in JSON format
 
 ### group
 
diff --git a/system_prompts/auto-generated/prompts.ts b/system_prompts/auto-generated/prompts.ts
index c3a606291a..8e82c36b74 100644
--- a/system_prompts/auto-generated/prompts.ts
+++ b/system_prompts/auto-generated/prompts.ts
@@ -589,8 +589,9 @@ wmill resource-type list --schema
 # Get specific resource type schema
 wmill resource-type get postgresql
 
-# Push resources to Windmill — deploys to the workspace and can be destructive to
-# remote state, so only run it when the user explicitly asks to deploy/publish/push
+# Deploy resources to the workspace — destructive to remote state, so only run when
+# the user explicitly asks to deploy/publish/push. Depending on how the repo is wired,
+# deploy via \`git push\` or \`wmill sync push\` (see the Deploying section in AGENTS.wmill.md).
 wmill sync push
 \`\`\`
 `;
@@ -2969,6 +2970,8 @@ Manage git-sync settings between local wmill.yaml and Windmill backend
   - \`--with-backend-settings <json:string>\` - Use provided JSON settings instead of querying backend (for testing)
   - \`--yes\` - Skip interactive prompts and use default behavior
   - \`--promotion <branch:string>\` - Use promotionOverrides from the specified branch instead of regular overrides
+- \`gitsync-settings status\` - Report how local changes deploy to the workspace (git push vs wmill sync push)
+  - \`--json-output\` - Output in JSON format
 
 ### group
 
diff --git a/system_prompts/auto-generated/skills/cli-commands/SKILL.md b/system_prompts/auto-generated/skills/cli-commands/SKILL.md
index 8dc4a3d0f3..c2d7fe27ef 100644
--- a/system_prompts/auto-generated/skills/cli-commands/SKILL.md
+++ b/system_prompts/auto-generated/skills/cli-commands/SKILL.md
@@ -256,6 +256,8 @@ Manage git-sync settings between local wmill.yaml and Windmill backend
   - `--with-backend-settings <json:string>` - Use provided JSON settings instead of querying backend (for testing)
   - `--yes` - Skip interactive prompts and use default behavior
   - `--promotion <branch:string>` - Use promotionOverrides from the specified branch instead of regular overrides
+- `gitsync-settings status` - Report how local changes deploy to the workspace (git push vs wmill sync push)
+  - `--json-output` - Output in JSON format
 
 ### group
 
diff --git a/system_prompts/auto-generated/skills/resources/SKILL.md b/system_prompts/auto-generated/skills/resources/SKILL.md
index 113826ad63..19b8c9f420 100644
--- a/system_prompts/auto-generated/skills/resources/SKILL.md
+++ b/system_prompts/auto-generated/skills/resources/SKILL.md
@@ -242,7 +242,8 @@ wmill resource-type list --schema
 # Get specific resource type schema
 wmill resource-type get postgresql
 
-# Push resources to Windmill — deploys to the workspace and can be destructive to
-# remote state, so only run it when the user explicitly asks to deploy/publish/push
+# Deploy resources to the workspace — destructive to remote state, so only run when
+# the user explicitly asks to deploy/publish/push. Depending on how the repo is wired,
+# deploy via `git push` or `wmill sync push` (see the Deploying section in AGENTS.wmill.md).
 wmill sync push
 ```
diff --git a/system_prompts/auto-generated/skills/schedules/SKILL.md b/system_prompts/auto-generated/skills/schedules/SKILL.md
index 526740e04c..434a61e6f2 100644
--- a/system_prompts/auto-generated/skills/schedules/SKILL.md
+++ b/system_prompts/auto-generated/skills/schedules/SKILL.md
@@ -39,7 +39,7 @@ Windmill uses 6-field cron expressions (includes seconds):
 
 ## CLI Commands
 
-`wmill sync push` deploys local changes to the workspace and can be destructive to remote state — only suggest/run it when the user explicitly asks to deploy/publish/push, not when they say "run", "try", or "test". The commands below never mutate remote state, so they're safe to run yourself — note that `sync pull` does overwrite local files to match the remote (use `sync pull --dry-run` to only preview), while `schedule` just lists.
+Deploying local changes to the workspace can be destructive to remote state — only suggest/run a deploy when the user explicitly asks to deploy/publish/push, not when they say "run", "try", or "test". Deploy via `git push` or `wmill sync push` depending on how the repo is wired (see the **Deploying** section in `AGENTS.wmill.md`). The commands below never mutate remote state, so they're safe to run yourself — note that `sync pull` does overwrite local files to match the remote (use `sync pull --dry-run` to only preview), while `schedule` just lists.
 
 ```bash
 # Push schedules to Windmill — only when the user explicitly asks to deploy
diff --git a/system_prompts/auto-generated/skills/triggers/SKILL.md b/system_prompts/auto-generated/skills/triggers/SKILL.md
index 494d5d9798..f0d400670c 100644
--- a/system_prompts/auto-generated/skills/triggers/SKILL.md
+++ b/system_prompts/auto-generated/skills/triggers/SKILL.md
@@ -61,7 +61,7 @@ Text/HTML/inline parts are placed inline in `body` as strings.
 
 ## CLI Commands
 
-`wmill sync push` deploys local changes to the workspace and can be destructive to remote state — only suggest/run it when the user explicitly asks to deploy/publish/push, not when they say "run", "try", or "test". `sync pull` is safe to run yourself — it never mutates remote state, though it does overwrite local files to match the remote (use `sync pull --dry-run` to only preview).
+Deploying local changes to the workspace can be destructive to remote state — only suggest/run a deploy when the user explicitly asks to deploy/publish/push, not when they say "run", "try", or "test". Deploy via `git push` or `wmill sync push` depending on how the repo is wired (see the **Deploying** section in `AGENTS.wmill.md`). `sync pull` is safe to run yourself — it never mutates remote state, though it does overwrite local files to match the remote (use `sync pull --dry-run` to only preview).
 
 ```bash
 # Push trigger configuration — only when the user explicitly asks to deploy
diff --git a/system_prompts/auto-generated/skills/write-flow/SKILL.md b/system_prompts/auto-generated/skills/write-flow/SKILL.md
index 47ff8f47b7..976b424b59 100644
--- a/system_prompts/auto-generated/skills/write-flow/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-flow/SKILL.md
@@ -49,7 +49,7 @@ After writing, act on the user's intent instead of just listing commands. Run `w
 - `wmill flow preview <flow_path>` — **default when iterating on a local flow.** Runs the local `flow.yaml` against local inline scripts without deploying. Add `--remote` to use deployed workspace scripts for PathScript steps instead of local files. Add `--step <step_id>` to run only one module in isolation (see "Single-step vs whole-flow preview" below).
 - `wmill flow run <path>` — runs the flow **already deployed** in the workspace. Use only when the user explicitly wants to test the deployed version, not local edits.
 - `wmill generate-metadata` — regenerate stale local `.lock` files for the flow and its inline scripts and refresh their content hashes in `wmill-lock.yaml`. Writes local files only (not a deploy). Run it after editing inline scripts whose imports or arguments changed, so `wmill-lock.yaml` doesn't drift and add noise to git-sync/CI. By default it scans **scripts, flows, and apps** across the workspace but only regenerates stale ones; pass the flow's folder as an argument (or run from that subdirectory) to limit the scope to the flow you edited. Note a flow (or script) that imports a changed shared script is pulled in too — run `wmill generate-metadata --dry-run` to see exactly what is stale and why (`content changed` vs `depends on <path>`) before applying.
-- `wmill sync push` — deploy local changes to the workspace. Only suggest/run this when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
+- Deploy local changes to the workspace — via `git push` or `wmill sync push` depending on how the repo is wired (see the **Deploying** section in `AGENTS.wmill.md`). Only suggest/run a deploy when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
 
 ### Preview vs run — choose by intent, not habit
 
diff --git a/system_prompts/auto-generated/skills/write-script-ansible/SKILL.md b/system_prompts/auto-generated/skills/write-script-ansible/SKILL.md
index 4a980ada3e..2c8519a301 100644
--- a/system_prompts/auto-generated/skills/write-script-ansible/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-ansible/SKILL.md
@@ -12,7 +12,7 @@ After writing, tell the user which command fits what they want to do:
 - `wmill script preview <script_path>` — **default when iterating on a local script.** Runs the local file without deploying.
 - `wmill script run <path>` — runs the script **already deployed** in the workspace. Use only when the user explicitly wants to test the deployed version, not local edits.
 - `wmill generate-metadata` — regenerate the local `.script.yaml` (input schema) and `.lock` (resolved dependencies) for scripts you changed, and refresh their content hashes in `wmill-lock.yaml`. Local files only — **not** a deploy. See "Keep metadata in sync" below.
-- `wmill sync push` — deploy local changes to the workspace. Only suggest/run this when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
+- Deploy local changes to the workspace — via `git push` or `wmill sync push` depending on how the repo is wired (see the **Deploying** section in `AGENTS.wmill.md`). Only suggest/run a deploy when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
 
 ### Preview vs run — choose by intent, not habit
 
@@ -42,7 +42,7 @@ If the user hasn't already told you to run/test/preview the script, offer it as
 
 If the user already asked to test/run/try the script in their original request, skip the offer and just execute `wmill script preview <path> -d '<args>'` directly — pick plausible args from the script's declared parameters. The shape varies by language: `main(...)` for code languages, the SQL dialect's own placeholder syntax (`$1` for PostgreSQL, `?` for MySQL/Snowflake, `@P1` for MSSQL, `@name` for BigQuery, etc.), positional `$1`, `$2`, … for Bash, `param(...)` for PowerShell.
 
-`wmill script preview` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). `wmill generate-metadata` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's `AGENTS.md` opts in), per "Keep metadata in sync" above. Only `wmill sync push` deploys to the workspace — run it only when the user explicitly asks to deploy/publish/push.
+`wmill script preview` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). `wmill generate-metadata` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's `AGENTS.md` opts in), per "Keep metadata in sync" above. Deploying to the workspace (`git push` or `wmill sync push` depending on how the repo is wired — see the **Deploying** section) is the only step that mutates remote state — do it only when the user explicitly asks to deploy/publish/push.
 
 For a **visual** open-the-script-in-the-dev-page preview (rather than `script preview`'s run-and-print-result), use the `preview` skill.
 
diff --git a/system_prompts/auto-generated/skills/write-script-bash/SKILL.md b/system_prompts/auto-generated/skills/write-script-bash/SKILL.md
index 70dec59ab4..6931a0ed58 100644
--- a/system_prompts/auto-generated/skills/write-script-bash/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-bash/SKILL.md
@@ -12,7 +12,7 @@ After writing, tell the user which command fits what they want to do:
 - `wmill script preview <script_path>` — **default when iterating on a local script.** Runs the local file without deploying.
 - `wmill script run <path>` — runs the script **already deployed** in the workspace. Use only when the user explicitly wants to test the deployed version, not local edits.
 - `wmill generate-metadata` — regenerate the local `.script.yaml` (input schema) and `.lock` (resolved dependencies) for scripts you changed, and refresh their content hashes in `wmill-lock.yaml`. Local files only — **not** a deploy. See "Keep metadata in sync" below.
-- `wmill sync push` — deploy local changes to the workspace. Only suggest/run this when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
+- Deploy local changes to the workspace — via `git push` or `wmill sync push` depending on how the repo is wired (see the **Deploying** section in `AGENTS.wmill.md`). Only suggest/run a deploy when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
 
 ### Preview vs run — choose by intent, not habit
 
@@ -42,7 +42,7 @@ If the user hasn't already told you to run/test/preview the script, offer it as
 
 If the user already asked to test/run/try the script in their original request, skip the offer and just execute `wmill script preview <path> -d '<args>'` directly — pick plausible args from the script's declared parameters. The shape varies by language: `main(...)` for code languages, the SQL dialect's own placeholder syntax (`$1` for PostgreSQL, `?` for MySQL/Snowflake, `@P1` for MSSQL, `@name` for BigQuery, etc.), positional `$1`, `$2`, … for Bash, `param(...)` for PowerShell.
 
-`wmill script preview` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). `wmill generate-metadata` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's `AGENTS.md` opts in), per "Keep metadata in sync" above. Only `wmill sync push` deploys to the workspace — run it only when the user explicitly asks to deploy/publish/push.
+`wmill script preview` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). `wmill generate-metadata` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's `AGENTS.md` opts in), per "Keep metadata in sync" above. Deploying to the workspace (`git push` or `wmill sync push` depending on how the repo is wired — see the **Deploying** section) is the only step that mutates remote state — do it only when the user explicitly asks to deploy/publish/push.
 
 For a **visual** open-the-script-in-the-dev-page preview (rather than `script preview`'s run-and-print-result), use the `preview` skill.
 
diff --git a/system_prompts/auto-generated/skills/write-script-bigquery/SKILL.md b/system_prompts/auto-generated/skills/write-script-bigquery/SKILL.md
index 6ce38eaf3e..1127373c3f 100644
--- a/system_prompts/auto-generated/skills/write-script-bigquery/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-bigquery/SKILL.md
@@ -12,7 +12,7 @@ After writing, tell the user which command fits what they want to do:
 - `wmill script preview <script_path>` — **default when iterating on a local script.** Runs the local file without deploying.
 - `wmill script run <path>` — runs the script **already deployed** in the workspace. Use only when the user explicitly wants to test the deployed version, not local edits.
 - `wmill generate-metadata` — regenerate the local `.script.yaml` (input schema) and `.lock` (resolved dependencies) for scripts you changed, and refresh their content hashes in `wmill-lock.yaml`. Local files only — **not** a deploy. See "Keep metadata in sync" below.
-- `wmill sync push` — deploy local changes to the workspace. Only suggest/run this when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
+- Deploy local changes to the workspace — via `git push` or `wmill sync push` depending on how the repo is wired (see the **Deploying** section in `AGENTS.wmill.md`). Only suggest/run a deploy when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
 
 ### Preview vs run — choose by intent, not habit
 
@@ -42,7 +42,7 @@ If the user hasn't already told you to run/test/preview the script, offer it as
 
 If the user already asked to test/run/try the script in their original request, skip the offer and just execute `wmill script preview <path> -d '<args>'` directly — pick plausible args from the script's declared parameters. The shape varies by language: `main(...)` for code languages, the SQL dialect's own placeholder syntax (`$1` for PostgreSQL, `?` for MySQL/Snowflake, `@P1` for MSSQL, `@name` for BigQuery, etc.), positional `$1`, `$2`, … for Bash, `param(...)` for PowerShell.
 
-`wmill script preview` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). `wmill generate-metadata` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's `AGENTS.md` opts in), per "Keep metadata in sync" above. Only `wmill sync push` deploys to the workspace — run it only when the user explicitly asks to deploy/publish/push.
+`wmill script preview` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). `wmill generate-metadata` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's `AGENTS.md` opts in), per "Keep metadata in sync" above. Deploying to the workspace (`git push` or `wmill sync push` depending on how the repo is wired — see the **Deploying** section) is the only step that mutates remote state — do it only when the user explicitly asks to deploy/publish/push.
 
 For a **visual** open-the-script-in-the-dev-page preview (rather than `script preview`'s run-and-print-result), use the `preview` skill.
 
diff --git a/system_prompts/auto-generated/skills/write-script-bun/SKILL.md b/system_prompts/auto-generated/skills/write-script-bun/SKILL.md
index 7dcaec30bc..44cccc7ba8 100644
--- a/system_prompts/auto-generated/skills/write-script-bun/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-bun/SKILL.md
@@ -12,7 +12,7 @@ After writing, tell the user which command fits what they want to do:
 - `wmill script preview <script_path>` — **default when iterating on a local script.** Runs the local file without deploying.
 - `wmill script run <path>` — runs the script **already deployed** in the workspace. Use only when the user explicitly wants to test the deployed version, not local edits.
 - `wmill generate-metadata` — regenerate the local `.script.yaml` (input schema) and `.lock` (resolved dependencies) for scripts you changed, and refresh their content hashes in `wmill-lock.yaml`. Local files only — **not** a deploy. See "Keep metadata in sync" below.
-- `wmill sync push` — deploy local changes to the workspace. Only suggest/run this when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
+- Deploy local changes to the workspace — via `git push` or `wmill sync push` depending on how the repo is wired (see the **Deploying** section in `AGENTS.wmill.md`). Only suggest/run a deploy when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
 
 ### Preview vs run — choose by intent, not habit
 
@@ -42,7 +42,7 @@ If the user hasn't already told you to run/test/preview the script, offer it as
 
 If the user already asked to test/run/try the script in their original request, skip the offer and just execute `wmill script preview <path> -d '<args>'` directly — pick plausible args from the script's declared parameters. The shape varies by language: `main(...)` for code languages, the SQL dialect's own placeholder syntax (`$1` for PostgreSQL, `?` for MySQL/Snowflake, `@P1` for MSSQL, `@name` for BigQuery, etc.), positional `$1`, `$2`, … for Bash, `param(...)` for PowerShell.
 
-`wmill script preview` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). `wmill generate-metadata` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's `AGENTS.md` opts in), per "Keep metadata in sync" above. Only `wmill sync push` deploys to the workspace — run it only when the user explicitly asks to deploy/publish/push.
+`wmill script preview` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). `wmill generate-metadata` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's `AGENTS.md` opts in), per "Keep metadata in sync" above. Deploying to the workspace (`git push` or `wmill sync push` depending on how the repo is wired — see the **Deploying** section) is the only step that mutates remote state — do it only when the user explicitly asks to deploy/publish/push.
 
 For a **visual** open-the-script-in-the-dev-page preview (rather than `script preview`'s run-and-print-result), use the `preview` skill.
 
diff --git a/system_prompts/auto-generated/skills/write-script-bunnative/SKILL.md b/system_prompts/auto-generated/skills/write-script-bunnative/SKILL.md
index 86c3bfd010..ba1253b66f 100644
--- a/system_prompts/auto-generated/skills/write-script-bunnative/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-bunnative/SKILL.md
@@ -12,7 +12,7 @@ After writing, tell the user which command fits what they want to do:
 - `wmill script preview <script_path>` — **default when iterating on a local script.** Runs the local file without deploying.
 - `wmill script run <path>` — runs the script **already deployed** in the workspace. Use only when the user explicitly wants to test the deployed version, not local edits.
 - `wmill generate-metadata` — regenerate the local `.script.yaml` (input schema) and `.lock` (resolved dependencies) for scripts you changed, and refresh their content hashes in `wmill-lock.yaml`. Local files only — **not** a deploy. See "Keep metadata in sync" below.
-- `wmill sync push` — deploy local changes to the workspace. Only suggest/run this when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
+- Deploy local changes to the workspace — via `git push` or `wmill sync push` depending on how the repo is wired (see the **Deploying** section in `AGENTS.wmill.md`). Only suggest/run a deploy when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
 
 ### Preview vs run — choose by intent, not habit
 
@@ -42,7 +42,7 @@ If the user hasn't already told you to run/test/preview the script, offer it as
 
 If the user already asked to test/run/try the script in their original request, skip the offer and just execute `wmill script preview <path> -d '<args>'` directly — pick plausible args from the script's declared parameters. The shape varies by language: `main(...)` for code languages, the SQL dialect's own placeholder syntax (`$1` for PostgreSQL, `?` for MySQL/Snowflake, `@P1` for MSSQL, `@name` for BigQuery, etc.), positional `$1`, `$2`, … for Bash, `param(...)` for PowerShell.
 
-`wmill script preview` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). `wmill generate-metadata` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's `AGENTS.md` opts in), per "Keep metadata in sync" above. Only `wmill sync push` deploys to the workspace — run it only when the user explicitly asks to deploy/publish/push.
+`wmill script preview` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). `wmill generate-metadata` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's `AGENTS.md` opts in), per "Keep metadata in sync" above. Deploying to the workspace (`git push` or `wmill sync push` depending on how the repo is wired — see the **Deploying** section) is the only step that mutates remote state — do it only when the user explicitly asks to deploy/publish/push.
 
 For a **visual** open-the-script-in-the-dev-page preview (rather than `script preview`'s run-and-print-result), use the `preview` skill.
 
diff --git a/system_prompts/auto-generated/skills/write-script-csharp/SKILL.md b/system_prompts/auto-generated/skills/write-script-csharp/SKILL.md
index 2eecb618db..95adb7c71e 100644
--- a/system_prompts/auto-generated/skills/write-script-csharp/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-csharp/SKILL.md
@@ -12,7 +12,7 @@ After writing, tell the user which command fits what they want to do:
 - `wmill script preview <script_path>` — **default when iterating on a local script.** Runs the local file without deploying.
 - `wmill script run <path>` — runs the script **already deployed** in the workspace. Use only when the user explicitly wants to test the deployed version, not local edits.
 - `wmill generate-metadata` — regenerate the local `.script.yaml` (input schema) and `.lock` (resolved dependencies) for scripts you changed, and refresh their content hashes in `wmill-lock.yaml`. Local files only — **not** a deploy. See "Keep metadata in sync" below.
-- `wmill sync push` — deploy local changes to the workspace. Only suggest/run this when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
+- Deploy local changes to the workspace — via `git push` or `wmill sync push` depending on how the repo is wired (see the **Deploying** section in `AGENTS.wmill.md`). Only suggest/run a deploy when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
 
 ### Preview vs run — choose by intent, not habit
 
@@ -42,7 +42,7 @@ If the user hasn't already told you to run/test/preview the script, offer it as
 
 If the user already asked to test/run/try the script in their original request, skip the offer and just execute `wmill script preview <path> -d '<args>'` directly — pick plausible args from the script's declared parameters. The shape varies by language: `main(...)` for code languages, the SQL dialect's own placeholder syntax (`$1` for PostgreSQL, `?` for MySQL/Snowflake, `@P1` for MSSQL, `@name` for BigQuery, etc.), positional `$1`, `$2`, … for Bash, `param(...)` for PowerShell.
 
-`wmill script preview` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). `wmill generate-metadata` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's `AGENTS.md` opts in), per "Keep metadata in sync" above. Only `wmill sync push` deploys to the workspace — run it only when the user explicitly asks to deploy/publish/push.
+`wmill script preview` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). `wmill generate-metadata` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's `AGENTS.md` opts in), per "Keep metadata in sync" above. Deploying to the workspace (`git push` or `wmill sync push` depending on how the repo is wired — see the **Deploying** section) is the only step that mutates remote state — do it only when the user explicitly asks to deploy/publish/push.
 
 For a **visual** open-the-script-in-the-dev-page preview (rather than `script preview`'s run-and-print-result), use the `preview` skill.
 
diff --git a/system_prompts/auto-generated/skills/write-script-deno/SKILL.md b/system_prompts/auto-generated/skills/write-script-deno/SKILL.md
index f7f3a517db..ea2bfd4421 100644
--- a/system_prompts/auto-generated/skills/write-script-deno/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-deno/SKILL.md
@@ -12,7 +12,7 @@ After writing, tell the user which command fits what they want to do:
 - `wmill script preview <script_path>` — **default when iterating on a local script.** Runs the local file without deploying.
 - `wmill script run <path>` — runs the script **already deployed** in the workspace. Use only when the user explicitly wants to test the deployed version, not local edits.
 - `wmill generate-metadata` — regenerate the local `.script.yaml` (input schema) and `.lock` (resolved dependencies) for scripts you changed, and refresh their content hashes in `wmill-lock.yaml`. Local files only — **not** a deploy. See "Keep metadata in sync" below.
-- `wmill sync push` — deploy local changes to the workspace. Only suggest/run this when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
+- Deploy local changes to the workspace — via `git push` or `wmill sync push` depending on how the repo is wired (see the **Deploying** section in `AGENTS.wmill.md`). Only suggest/run a deploy when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
 
 ### Preview vs run — choose by intent, not habit
 
@@ -42,7 +42,7 @@ If the user hasn't already told you to run/test/preview the script, offer it as
 
 If the user already asked to test/run/try the script in their original request, skip the offer and just execute `wmill script preview <path> -d '<args>'` directly — pick plausible args from the script's declared parameters. The shape varies by language: `main(...)` for code languages, the SQL dialect's own placeholder syntax (`$1` for PostgreSQL, `?` for MySQL/Snowflake, `@P1` for MSSQL, `@name` for BigQuery, etc.), positional `$1`, `$2`, … for Bash, `param(...)` for PowerShell.
 
-`wmill script preview` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). `wmill generate-metadata` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's `AGENTS.md` opts in), per "Keep metadata in sync" above. Only `wmill sync push` deploys to the workspace — run it only when the user explicitly asks to deploy/publish/push.
+`wmill script preview` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). `wmill generate-metadata` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's `AGENTS.md` opts in), per "Keep metadata in sync" above. Deploying to the workspace (`git push` or `wmill sync push` depending on how the repo is wired — see the **Deploying** section) is the only step that mutates remote state — do it only when the user explicitly asks to deploy/publish/push.
 
 For a **visual** open-the-script-in-the-dev-page preview (rather than `script preview`'s run-and-print-result), use the `preview` skill.
 
diff --git a/system_prompts/auto-generated/skills/write-script-duckdb/SKILL.md b/system_prompts/auto-generated/skills/write-script-duckdb/SKILL.md
index 76384c1161..e732183c22 100644
--- a/system_prompts/auto-generated/skills/write-script-duckdb/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-duckdb/SKILL.md
@@ -12,7 +12,7 @@ After writing, tell the user which command fits what they want to do:
 - `wmill script preview <script_path>` — **default when iterating on a local script.** Runs the local file without deploying.
 - `wmill script run <path>` — runs the script **already deployed** in the workspace. Use only when the user explicitly wants to test the deployed version, not local edits.
 - `wmill generate-metadata` — regenerate the local `.script.yaml` (input schema) and `.lock` (resolved dependencies) for scripts you changed, and refresh their content hashes in `wmill-lock.yaml`. Local files only — **not** a deploy. See "Keep metadata in sync" below.
-- `wmill sync push` — deploy local changes to the workspace. Only suggest/run this when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
+- Deploy local changes to the workspace — via `git push` or `wmill sync push` depending on how the repo is wired (see the **Deploying** section in `AGENTS.wmill.md`). Only suggest/run a deploy when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
 
 ### Preview vs run — choose by intent, not habit
 
@@ -42,7 +42,7 @@ If the user hasn't already told you to run/test/preview the script, offer it as
 
 If the user already asked to test/run/try the script in their original request, skip the offer and just execute `wmill script preview <path> -d '<args>'` directly — pick plausible args from the script's declared parameters. The shape varies by language: `main(...)` for code languages, the SQL dialect's own placeholder syntax (`$1` for PostgreSQL, `?` for MySQL/Snowflake, `@P1` for MSSQL, `@name` for BigQuery, etc.), positional `$1`, `$2`, … for Bash, `param(...)` for PowerShell.
 
-`wmill script preview` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). `wmill generate-metadata` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's `AGENTS.md` opts in), per "Keep metadata in sync" above. Only `wmill sync push` deploys to the workspace — run it only when the user explicitly asks to deploy/publish/push.
+`wmill script preview` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). `wmill generate-metadata` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's `AGENTS.md` opts in), per "Keep metadata in sync" above. Deploying to the workspace (`git push` or `wmill sync push` depending on how the repo is wired — see the **Deploying** section) is the only step that mutates remote state — do it only when the user explicitly asks to deploy/publish/push.
 
 For a **visual** open-the-script-in-the-dev-page preview (rather than `script preview`'s run-and-print-result), use the `preview` skill.
 
diff --git a/system_prompts/auto-generated/skills/write-script-go/SKILL.md b/system_prompts/auto-generated/skills/write-script-go/SKILL.md
index d968736b08..b089418a3c 100644
--- a/system_prompts/auto-generated/skills/write-script-go/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-go/SKILL.md
@@ -12,7 +12,7 @@ After writing, tell the user which command fits what they want to do:
 - `wmill script preview <script_path>` — **default when iterating on a local script.** Runs the local file without deploying.
 - `wmill script run <path>` — runs the script **already deployed** in the workspace. Use only when the user explicitly wants to test the deployed version, not local edits.
 - `wmill generate-metadata` — regenerate the local `.script.yaml` (input schema) and `.lock` (resolved dependencies) for scripts you changed, and refresh their content hashes in `wmill-lock.yaml`. Local files only — **not** a deploy. See "Keep metadata in sync" below.
-- `wmill sync push` — deploy local changes to the workspace. Only suggest/run this when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
+- Deploy local changes to the workspace — via `git push` or `wmill sync push` depending on how the repo is wired (see the **Deploying** section in `AGENTS.wmill.md`). Only suggest/run a deploy when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
 
 ### Preview vs run — choose by intent, not habit
 
@@ -42,7 +42,7 @@ If the user hasn't already told you to run/test/preview the script, offer it as
 
 If the user already asked to test/run/try the script in their original request, skip the offer and just execute `wmill script preview <path> -d '<args>'` directly — pick plausible args from the script's declared parameters. The shape varies by language: `main(...)` for code languages, the SQL dialect's own placeholder syntax (`$1` for PostgreSQL, `?` for MySQL/Snowflake, `@P1` for MSSQL, `@name` for BigQuery, etc.), positional `$1`, `$2`, … for Bash, `param(...)` for PowerShell.
 
-`wmill script preview` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). `wmill generate-metadata` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's `AGENTS.md` opts in), per "Keep metadata in sync" above. Only `wmill sync push` deploys to the workspace — run it only when the user explicitly asks to deploy/publish/push.
+`wmill script preview` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). `wmill generate-metadata` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's `AGENTS.md` opts in), per "Keep metadata in sync" above. Deploying to the workspace (`git push` or `wmill sync push` depending on how the repo is wired — see the **Deploying** section) is the only step that mutates remote state — do it only when the user explicitly asks to deploy/publish/push.
 
 For a **visual** open-the-script-in-the-dev-page preview (rather than `script preview`'s run-and-print-result), use the `preview` skill.
 
diff --git a/system_prompts/auto-generated/skills/write-script-graphql/SKILL.md b/system_prompts/auto-generated/skills/write-script-graphql/SKILL.md
index e3f71c5563..377932b1f0 100644
--- a/system_prompts/auto-generated/skills/write-script-graphql/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-graphql/SKILL.md
@@ -12,7 +12,7 @@ After writing, tell the user which command fits what they want to do:
 - `wmill script preview <script_path>` — **default when iterating on a local script.** Runs the local file without deploying.
 - `wmill script run <path>` — runs the script **already deployed** in the workspace. Use only when the user explicitly wants to test the deployed version, not local edits.
 - `wmill generate-metadata` — regenerate the local `.script.yaml` (input schema) and `.lock` (resolved dependencies) for scripts you changed, and refresh their content hashes in `wmill-lock.yaml`. Local files only — **not** a deploy. See "Keep metadata in sync" below.
-- `wmill sync push` — deploy local changes to the workspace. Only suggest/run this when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
+- Deploy local changes to the workspace — via `git push` or `wmill sync push` depending on how the repo is wired (see the **Deploying** section in `AGENTS.wmill.md`). Only suggest/run a deploy when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
 
 ### Preview vs run — choose by intent, not habit
 
@@ -42,7 +42,7 @@ If the user hasn't already told you to run/test/preview the script, offer it as
 
 If the user already asked to test/run/try the script in their original request, skip the offer and just execute `wmill script preview <path> -d '<args>'` directly — pick plausible args from the script's declared parameters. The shape varies by language: `main(...)` for code languages, the SQL dialect's own placeholder syntax (`$1` for PostgreSQL, `?` for MySQL/Snowflake, `@P1` for MSSQL, `@name` for BigQuery, etc.), positional `$1`, `$2`, … for Bash, `param(...)` for PowerShell.
 
-`wmill script preview` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). `wmill generate-metadata` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's `AGENTS.md` opts in), per "Keep metadata in sync" above. Only `wmill sync push` deploys to the workspace — run it only when the user explicitly asks to deploy/publish/push.
+`wmill script preview` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). `wmill generate-metadata` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's `AGENTS.md` opts in), per "Keep metadata in sync" above. Deploying to the workspace (`git push` or `wmill sync push` depending on how the repo is wired — see the **Deploying** section) is the only step that mutates remote state — do it only when the user explicitly asks to deploy/publish/push.
 
 For a **visual** open-the-script-in-the-dev-page preview (rather than `script preview`'s run-and-print-result), use the `preview` skill.
 
diff --git a/system_prompts/auto-generated/skills/write-script-java/SKILL.md b/system_prompts/auto-generated/skills/write-script-java/SKILL.md
index 77b3797763..fdccdba79f 100644
--- a/system_prompts/auto-generated/skills/write-script-java/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-java/SKILL.md
@@ -12,7 +12,7 @@ After writing, tell the user which command fits what they want to do:
 - `wmill script preview <script_path>` — **default when iterating on a local script.** Runs the local file without deploying.
 - `wmill script run <path>` — runs the script **already deployed** in the workspace. Use only when the user explicitly wants to test the deployed version, not local edits.
 - `wmill generate-metadata` — regenerate the local `.script.yaml` (input schema) and `.lock` (resolved dependencies) for scripts you changed, and refresh their content hashes in `wmill-lock.yaml`. Local files only — **not** a deploy. See "Keep metadata in sync" below.
-- `wmill sync push` — deploy local changes to the workspace. Only suggest/run this when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
+- Deploy local changes to the workspace — via `git push` or `wmill sync push` depending on how the repo is wired (see the **Deploying** section in `AGENTS.wmill.md`). Only suggest/run a deploy when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
 
 ### Preview vs run — choose by intent, not habit
 
@@ -42,7 +42,7 @@ If the user hasn't already told you to run/test/preview the script, offer it as
 
 If the user already asked to test/run/try the script in their original request, skip the offer and just execute `wmill script preview <path> -d '<args>'` directly — pick plausible args from the script's declared parameters. The shape varies by language: `main(...)` for code languages, the SQL dialect's own placeholder syntax (`$1` for PostgreSQL, `?` for MySQL/Snowflake, `@P1` for MSSQL, `@name` for BigQuery, etc.), positional `$1`, `$2`, … for Bash, `param(...)` for PowerShell.
 
-`wmill script preview` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). `wmill generate-metadata` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's `AGENTS.md` opts in), per "Keep metadata in sync" above. Only `wmill sync push` deploys to the workspace — run it only when the user explicitly asks to deploy/publish/push.
+`wmill script preview` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). `wmill generate-metadata` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's `AGENTS.md` opts in), per "Keep metadata in sync" above. Deploying to the workspace (`git push` or `wmill sync push` depending on how the repo is wired — see the **Deploying** section) is the only step that mutates remote state — do it only when the user explicitly asks to deploy/publish/push.
 
 For a **visual** open-the-script-in-the-dev-page preview (rather than `script preview`'s run-and-print-result), use the `preview` skill.
 
diff --git a/system_prompts/auto-generated/skills/write-script-mssql/SKILL.md b/system_prompts/auto-generated/skills/write-script-mssql/SKILL.md
index 8945418446..f8536ce963 100644
--- a/system_prompts/auto-generated/skills/write-script-mssql/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-mssql/SKILL.md
@@ -12,7 +12,7 @@ After writing, tell the user which command fits what they want to do:
 - `wmill script preview <script_path>` — **default when iterating on a local script.** Runs the local file without deploying.
 - `wmill script run <path>` — runs the script **already deployed** in the workspace. Use only when the user explicitly wants to test the deployed version, not local edits.
 - `wmill generate-metadata` — regenerate the local `.script.yaml` (input schema) and `.lock` (resolved dependencies) for scripts you changed, and refresh their content hashes in `wmill-lock.yaml`. Local files only — **not** a deploy. See "Keep metadata in sync" below.
-- `wmill sync push` — deploy local changes to the workspace. Only suggest/run this when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
+- Deploy local changes to the workspace — via `git push` or `wmill sync push` depending on how the repo is wired (see the **Deploying** section in `AGENTS.wmill.md`). Only suggest/run a deploy when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
 
 ### Preview vs run — choose by intent, not habit
 
@@ -42,7 +42,7 @@ If the user hasn't already told you to run/test/preview the script, offer it as
 
 If the user already asked to test/run/try the script in their original request, skip the offer and just execute `wmill script preview <path> -d '<args>'` directly — pick plausible args from the script's declared parameters. The shape varies by language: `main(...)` for code languages, the SQL dialect's own placeholder syntax (`$1` for PostgreSQL, `?` for MySQL/Snowflake, `@P1` for MSSQL, `@name` for BigQuery, etc.), positional `$1`, `$2`, … for Bash, `param(...)` for PowerShell.
 
-`wmill script preview` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). `wmill generate-metadata` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's `AGENTS.md` opts in), per "Keep metadata in sync" above. Only `wmill sync push` deploys to the workspace — run it only when the user explicitly asks to deploy/publish/push.
+`wmill script preview` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). `wmill generate-metadata` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's `AGENTS.md` opts in), per "Keep metadata in sync" above. Deploying to the workspace (`git push` or `wmill sync push` depending on how the repo is wired — see the **Deploying** section) is the only step that mutates remote state — do it only when the user explicitly asks to deploy/publish/push.
 
 For a **visual** open-the-script-in-the-dev-page preview (rather than `script preview`'s run-and-print-result), use the `preview` skill.
 
diff --git a/system_prompts/auto-generated/skills/write-script-mysql/SKILL.md b/system_prompts/auto-generated/skills/write-script-mysql/SKILL.md
index 9088d88f11..4e09271274 100644
--- a/system_prompts/auto-generated/skills/write-script-mysql/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-mysql/SKILL.md
@@ -12,7 +12,7 @@ After writing, tell the user which command fits what they want to do:
 - `wmill script preview <script_path>` — **default when iterating on a local script.** Runs the local file without deploying.
 - `wmill script run <path>` — runs the script **already deployed** in the workspace. Use only when the user explicitly wants to test the deployed version, not local edits.
 - `wmill generate-metadata` — regenerate the local `.script.yaml` (input schema) and `.lock` (resolved dependencies) for scripts you changed, and refresh their content hashes in `wmill-lock.yaml`. Local files only — **not** a deploy. See "Keep metadata in sync" below.
-- `wmill sync push` — deploy local changes to the workspace. Only suggest/run this when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
+- Deploy local changes to the workspace — via `git push` or `wmill sync push` depending on how the repo is wired (see the **Deploying** section in `AGENTS.wmill.md`). Only suggest/run a deploy when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
 
 ### Preview vs run — choose by intent, not habit
 
@@ -42,7 +42,7 @@ If the user hasn't already told you to run/test/preview the script, offer it as
 
 If the user already asked to test/run/try the script in their original request, skip the offer and just execute `wmill script preview <path> -d '<args>'` directly — pick plausible args from the script's declared parameters. The shape varies by language: `main(...)` for code languages, the SQL dialect's own placeholder syntax (`$1` for PostgreSQL, `?` for MySQL/Snowflake, `@P1` for MSSQL, `@name` for BigQuery, etc.), positional `$1`, `$2`, … for Bash, `param(...)` for PowerShell.
 
-`wmill script preview` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). `wmill generate-metadata` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's `AGENTS.md` opts in), per "Keep metadata in sync" above. Only `wmill sync push` deploys to the workspace — run it only when the user explicitly asks to deploy/publish/push.
+`wmill script preview` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). `wmill generate-metadata` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's `AGENTS.md` opts in), per "Keep metadata in sync" above. Deploying to the workspace (`git push` or `wmill sync push` depending on how the repo is wired — see the **Deploying** section) is the only step that mutates remote state — do it only when the user explicitly asks to deploy/publish/push.
 
 For a **visual** open-the-script-in-the-dev-page preview (rather than `script preview`'s run-and-print-result), use the `preview` skill.
 
diff --git a/system_prompts/auto-generated/skills/write-script-php/SKILL.md b/system_prompts/auto-generated/skills/write-script-php/SKILL.md
index 728c9cff3a..efa7ded59a 100644
--- a/system_prompts/auto-generated/skills/write-script-php/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-php/SKILL.md
@@ -12,7 +12,7 @@ After writing, tell the user which command fits what they want to do:
 - `wmill script preview <script_path>` — **default when iterating on a local script.** Runs the local file without deploying.
 - `wmill script run <path>` — runs the script **already deployed** in the workspace. Use only when the user explicitly wants to test the deployed version, not local edits.
 - `wmill generate-metadata` — regenerate the local `.script.yaml` (input schema) and `.lock` (resolved dependencies) for scripts you changed, and refresh their content hashes in `wmill-lock.yaml`. Local files only — **not** a deploy. See "Keep metadata in sync" below.
-- `wmill sync push` — deploy local changes to the workspace. Only suggest/run this when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
+- Deploy local changes to the workspace — via `git push` or `wmill sync push` depending on how the repo is wired (see the **Deploying** section in `AGENTS.wmill.md`). Only suggest/run a deploy when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
 
 ### Preview vs run — choose by intent, not habit
 
@@ -42,7 +42,7 @@ If the user hasn't already told you to run/test/preview the script, offer it as
 
 If the user already asked to test/run/try the script in their original request, skip the offer and just execute `wmill script preview <path> -d '<args>'` directly — pick plausible args from the script's declared parameters. The shape varies by language: `main(...)` for code languages, the SQL dialect's own placeholder syntax (`$1` for PostgreSQL, `?` for MySQL/Snowflake, `@P1` for MSSQL, `@name` for BigQuery, etc.), positional `$1`, `$2`, … for Bash, `param(...)` for PowerShell.
 
-`wmill script preview` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). `wmill generate-metadata` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's `AGENTS.md` opts in), per "Keep metadata in sync" above. Only `wmill sync push` deploys to the workspace — run it only when the user explicitly asks to deploy/publish/push.
+`wmill script preview` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). `wmill generate-metadata` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's `AGENTS.md` opts in), per "Keep metadata in sync" above. Deploying to the workspace (`git push` or `wmill sync push` depending on how the repo is wired — see the **Deploying** section) is the only step that mutates remote state — do it only when the user explicitly asks to deploy/publish/push.
 
 For a **visual** open-the-script-in-the-dev-page preview (rather than `script preview`'s run-and-print-result), use the `preview` skill.
 
diff --git a/system_prompts/auto-generated/skills/write-script-postgresql/SKILL.md b/system_prompts/auto-generated/skills/write-script-postgresql/SKILL.md
index bc90d19c4a..2f1e495277 100644
--- a/system_prompts/auto-generated/skills/write-script-postgresql/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-postgresql/SKILL.md
@@ -12,7 +12,7 @@ After writing, tell the user which command fits what they want to do:
 - `wmill script preview <script_path>` — **default when iterating on a local script.** Runs the local file without deploying.
 - `wmill script run <path>` — runs the script **already deployed** in the workspace. Use only when the user explicitly wants to test the deployed version, not local edits.
 - `wmill generate-metadata` — regenerate the local `.script.yaml` (input schema) and `.lock` (resolved dependencies) for scripts you changed, and refresh their content hashes in `wmill-lock.yaml`. Local files only — **not** a deploy. See "Keep metadata in sync" below.
-- `wmill sync push` — deploy local changes to the workspace. Only suggest/run this when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
+- Deploy local changes to the workspace — via `git push` or `wmill sync push` depending on how the repo is wired (see the **Deploying** section in `AGENTS.wmill.md`). Only suggest/run a deploy when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
 
 ### Preview vs run — choose by intent, not habit
 
@@ -42,7 +42,7 @@ If the user hasn't already told you to run/test/preview the script, offer it as
 
 If the user already asked to test/run/try the script in their original request, skip the offer and just execute `wmill script preview <path> -d '<args>'` directly — pick plausible args from the script's declared parameters. The shape varies by language: `main(...)` for code languages, the SQL dialect's own placeholder syntax (`$1` for PostgreSQL, `?` for MySQL/Snowflake, `@P1` for MSSQL, `@name` for BigQuery, etc.), positional `$1`, `$2`, … for Bash, `param(...)` for PowerShell.
 
-`wmill script preview` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). `wmill generate-metadata` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's `AGENTS.md` opts in), per "Keep metadata in sync" above. Only `wmill sync push` deploys to the workspace — run it only when the user explicitly asks to deploy/publish/push.
+`wmill script preview` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). `wmill generate-metadata` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's `AGENTS.md` opts in), per "Keep metadata in sync" above. Deploying to the workspace (`git push` or `wmill sync push` depending on how the repo is wired — see the **Deploying** section) is the only step that mutates remote state — do it only when the user explicitly asks to deploy/publish/push.
 
 For a **visual** open-the-script-in-the-dev-page preview (rather than `script preview`'s run-and-print-result), use the `preview` skill.
 
diff --git a/system_prompts/auto-generated/skills/write-script-powershell/SKILL.md b/system_prompts/auto-generated/skills/write-script-powershell/SKILL.md
index e296d8de82..9b729ce87a 100644
--- a/system_prompts/auto-generated/skills/write-script-powershell/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-powershell/SKILL.md
@@ -12,7 +12,7 @@ After writing, tell the user which command fits what they want to do:
 - `wmill script preview <script_path>` — **default when iterating on a local script.** Runs the local file without deploying.
 - `wmill script run <path>` — runs the script **already deployed** in the workspace. Use only when the user explicitly wants to test the deployed version, not local edits.
 - `wmill generate-metadata` — regenerate the local `.script.yaml` (input schema) and `.lock` (resolved dependencies) for scripts you changed, and refresh their content hashes in `wmill-lock.yaml`. Local files only — **not** a deploy. See "Keep metadata in sync" below.
-- `wmill sync push` — deploy local changes to the workspace. Only suggest/run this when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
+- Deploy local changes to the workspace — via `git push` or `wmill sync push` depending on how the repo is wired (see the **Deploying** section in `AGENTS.wmill.md`). Only suggest/run a deploy when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
 
 ### Preview vs run — choose by intent, not habit
 
@@ -42,7 +42,7 @@ If the user hasn't already told you to run/test/preview the script, offer it as
 
 If the user already asked to test/run/try the script in their original request, skip the offer and just execute `wmill script preview <path> -d '<args>'` directly — pick plausible args from the script's declared parameters. The shape varies by language: `main(...)` for code languages, the SQL dialect's own placeholder syntax (`$1` for PostgreSQL, `?` for MySQL/Snowflake, `@P1` for MSSQL, `@name` for BigQuery, etc.), positional `$1`, `$2`, … for Bash, `param(...)` for PowerShell.
 
-`wmill script preview` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). `wmill generate-metadata` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's `AGENTS.md` opts in), per "Keep metadata in sync" above. Only `wmill sync push` deploys to the workspace — run it only when the user explicitly asks to deploy/publish/push.
+`wmill script preview` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). `wmill generate-metadata` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's `AGENTS.md` opts in), per "Keep metadata in sync" above. Deploying to the workspace (`git push` or `wmill sync push` depending on how the repo is wired — see the **Deploying** section) is the only step that mutates remote state — do it only when the user explicitly asks to deploy/publish/push.
 
 For a **visual** open-the-script-in-the-dev-page preview (rather than `script preview`'s run-and-print-result), use the `preview` skill.
 
diff --git a/system_prompts/auto-generated/skills/write-script-python3/SKILL.md b/system_prompts/auto-generated/skills/write-script-python3/SKILL.md
index 49c0ab057f..3db3b90942 100644
--- a/system_prompts/auto-generated/skills/write-script-python3/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-python3/SKILL.md
@@ -12,7 +12,7 @@ After writing, tell the user which command fits what they want to do:
 - `wmill script preview <script_path>` — **default when iterating on a local script.** Runs the local file without deploying.
 - `wmill script run <path>` — runs the script **already deployed** in the workspace. Use only when the user explicitly wants to test the deployed version, not local edits.
 - `wmill generate-metadata` — regenerate the local `.script.yaml` (input schema) and `.lock` (resolved dependencies) for scripts you changed, and refresh their content hashes in `wmill-lock.yaml`. Local files only — **not** a deploy. See "Keep metadata in sync" below.
-- `wmill sync push` — deploy local changes to the workspace. Only suggest/run this when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
+- Deploy local changes to the workspace — via `git push` or `wmill sync push` depending on how the repo is wired (see the **Deploying** section in `AGENTS.wmill.md`). Only suggest/run a deploy when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
 
 ### Preview vs run — choose by intent, not habit
 
@@ -42,7 +42,7 @@ If the user hasn't already told you to run/test/preview the script, offer it as
 
 If the user already asked to test/run/try the script in their original request, skip the offer and just execute `wmill script preview <path> -d '<args>'` directly — pick plausible args from the script's declared parameters. The shape varies by language: `main(...)` for code languages, the SQL dialect's own placeholder syntax (`$1` for PostgreSQL, `?` for MySQL/Snowflake, `@P1` for MSSQL, `@name` for BigQuery, etc.), positional `$1`, `$2`, … for Bash, `param(...)` for PowerShell.
 
-`wmill script preview` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). `wmill generate-metadata` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's `AGENTS.md` opts in), per "Keep metadata in sync" above. Only `wmill sync push` deploys to the workspace — run it only when the user explicitly asks to deploy/publish/push.
+`wmill script preview` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). `wmill generate-metadata` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's `AGENTS.md` opts in), per "Keep metadata in sync" above. Deploying to the workspace (`git push` or `wmill sync push` depending on how the repo is wired — see the **Deploying** section) is the only step that mutates remote state — do it only when the user explicitly asks to deploy/publish/push.
 
 For a **visual** open-the-script-in-the-dev-page preview (rather than `script preview`'s run-and-print-result), use the `preview` skill.
 
diff --git a/system_prompts/auto-generated/skills/write-script-rlang/SKILL.md b/system_prompts/auto-generated/skills/write-script-rlang/SKILL.md
index 2d3370b5a4..b90ccb3bf8 100644
--- a/system_prompts/auto-generated/skills/write-script-rlang/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-rlang/SKILL.md
@@ -12,7 +12,7 @@ After writing, tell the user which command fits what they want to do:
 - `wmill script preview <script_path>` — **default when iterating on a local script.** Runs the local file without deploying.
 - `wmill script run <path>` — runs the script **already deployed** in the workspace. Use only when the user explicitly wants to test the deployed version, not local edits.
 - `wmill generate-metadata` — regenerate the local `.script.yaml` (input schema) and `.lock` (resolved dependencies) for scripts you changed, and refresh their content hashes in `wmill-lock.yaml`. Local files only — **not** a deploy. See "Keep metadata in sync" below.
-- `wmill sync push` — deploy local changes to the workspace. Only suggest/run this when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
+- Deploy local changes to the workspace — via `git push` or `wmill sync push` depending on how the repo is wired (see the **Deploying** section in `AGENTS.wmill.md`). Only suggest/run a deploy when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
 
 ### Preview vs run — choose by intent, not habit
 
@@ -42,7 +42,7 @@ If the user hasn't already told you to run/test/preview the script, offer it as
 
 If the user already asked to test/run/try the script in their original request, skip the offer and just execute `wmill script preview <path> -d '<args>'` directly — pick plausible args from the script's declared parameters. The shape varies by language: `main(...)` for code languages, the SQL dialect's own placeholder syntax (`$1` for PostgreSQL, `?` for MySQL/Snowflake, `@P1` for MSSQL, `@name` for BigQuery, etc.), positional `$1`, `$2`, … for Bash, `param(...)` for PowerShell.
 
-`wmill script preview` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). `wmill generate-metadata` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's `AGENTS.md` opts in), per "Keep metadata in sync" above. Only `wmill sync push` deploys to the workspace — run it only when the user explicitly asks to deploy/publish/push.
+`wmill script preview` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). `wmill generate-metadata` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's `AGENTS.md` opts in), per "Keep metadata in sync" above. Deploying to the workspace (`git push` or `wmill sync push` depending on how the repo is wired — see the **Deploying** section) is the only step that mutates remote state — do it only when the user explicitly asks to deploy/publish/push.
 
 For a **visual** open-the-script-in-the-dev-page preview (rather than `script preview`'s run-and-print-result), use the `preview` skill.
 
diff --git a/system_prompts/auto-generated/skills/write-script-rust/SKILL.md b/system_prompts/auto-generated/skills/write-script-rust/SKILL.md
index 26740e153d..b28951e7bc 100644
--- a/system_prompts/auto-generated/skills/write-script-rust/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-rust/SKILL.md
@@ -12,7 +12,7 @@ After writing, tell the user which command fits what they want to do:
 - `wmill script preview <script_path>` — **default when iterating on a local script.** Runs the local file without deploying.
 - `wmill script run <path>` — runs the script **already deployed** in the workspace. Use only when the user explicitly wants to test the deployed version, not local edits.
 - `wmill generate-metadata` — regenerate the local `.script.yaml` (input schema) and `.lock` (resolved dependencies) for scripts you changed, and refresh their content hashes in `wmill-lock.yaml`. Local files only — **not** a deploy. See "Keep metadata in sync" below.
-- `wmill sync push` — deploy local changes to the workspace. Only suggest/run this when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
+- Deploy local changes to the workspace — via `git push` or `wmill sync push` depending on how the repo is wired (see the **Deploying** section in `AGENTS.wmill.md`). Only suggest/run a deploy when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
 
 ### Preview vs run — choose by intent, not habit
 
@@ -42,7 +42,7 @@ If the user hasn't already told you to run/test/preview the script, offer it as
 
 If the user already asked to test/run/try the script in their original request, skip the offer and just execute `wmill script preview <path> -d '<args>'` directly — pick plausible args from the script's declared parameters. The shape varies by language: `main(...)` for code languages, the SQL dialect's own placeholder syntax (`$1` for PostgreSQL, `?` for MySQL/Snowflake, `@P1` for MSSQL, `@name` for BigQuery, etc.), positional `$1`, `$2`, … for Bash, `param(...)` for PowerShell.
 
-`wmill script preview` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). `wmill generate-metadata` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's `AGENTS.md` opts in), per "Keep metadata in sync" above. Only `wmill sync push` deploys to the workspace — run it only when the user explicitly asks to deploy/publish/push.
+`wmill script preview` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). `wmill generate-metadata` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's `AGENTS.md` opts in), per "Keep metadata in sync" above. Deploying to the workspace (`git push` or `wmill sync push` depending on how the repo is wired — see the **Deploying** section) is the only step that mutates remote state — do it only when the user explicitly asks to deploy/publish/push.
 
 For a **visual** open-the-script-in-the-dev-page preview (rather than `script preview`'s run-and-print-result), use the `preview` skill.
 
diff --git a/system_prompts/auto-generated/skills/write-script-snowflake/SKILL.md b/system_prompts/auto-generated/skills/write-script-snowflake/SKILL.md
index 77135c178e..bf428e2d8f 100644
--- a/system_prompts/auto-generated/skills/write-script-snowflake/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-snowflake/SKILL.md
@@ -12,7 +12,7 @@ After writing, tell the user which command fits what they want to do:
 - `wmill script preview <script_path>` — **default when iterating on a local script.** Runs the local file without deploying.
 - `wmill script run <path>` — runs the script **already deployed** in the workspace. Use only when the user explicitly wants to test the deployed version, not local edits.
 - `wmill generate-metadata` — regenerate the local `.script.yaml` (input schema) and `.lock` (resolved dependencies) for scripts you changed, and refresh their content hashes in `wmill-lock.yaml`. Local files only — **not** a deploy. See "Keep metadata in sync" below.
-- `wmill sync push` — deploy local changes to the workspace. Only suggest/run this when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
+- Deploy local changes to the workspace — via `git push` or `wmill sync push` depending on how the repo is wired (see the **Deploying** section in `AGENTS.wmill.md`). Only suggest/run a deploy when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
 
 ### Preview vs run — choose by intent, not habit
 
@@ -42,7 +42,7 @@ If the user hasn't already told you to run/test/preview the script, offer it as
 
 If the user already asked to test/run/try the script in their original request, skip the offer and just execute `wmill script preview <path> -d '<args>'` directly — pick plausible args from the script's declared parameters. The shape varies by language: `main(...)` for code languages, the SQL dialect's own placeholder syntax (`$1` for PostgreSQL, `?` for MySQL/Snowflake, `@P1` for MSSQL, `@name` for BigQuery, etc.), positional `$1`, `$2`, … for Bash, `param(...)` for PowerShell.
 
-`wmill script preview` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). `wmill generate-metadata` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's `AGENTS.md` opts in), per "Keep metadata in sync" above. Only `wmill sync push` deploys to the workspace — run it only when the user explicitly asks to deploy/publish/push.
+`wmill script preview` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). `wmill generate-metadata` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's `AGENTS.md` opts in), per "Keep metadata in sync" above. Deploying to the workspace (`git push` or `wmill sync push` depending on how the repo is wired — see the **Deploying** section) is the only step that mutates remote state — do it only when the user explicitly asks to deploy/publish/push.
 
 For a **visual** open-the-script-in-the-dev-page preview (rather than `script preview`'s run-and-print-result), use the `preview` skill.
 
diff --git a/system_prompts/auto-generated/skills/write-workflow-as-code/SKILL.md b/system_prompts/auto-generated/skills/write-workflow-as-code/SKILL.md
index 715de71b1f..9ec901e003 100644
--- a/system_prompts/auto-generated/skills/write-workflow-as-code/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-workflow-as-code/SKILL.md
@@ -12,7 +12,7 @@ After writing, tell the user which command fits what they want to do:
 - `wmill script preview <script_path>` — **default when iterating on a local script.** Runs the local file without deploying.
 - `wmill script run <path>` — runs the script **already deployed** in the workspace. Use only when the user explicitly wants to test the deployed version, not local edits.
 - `wmill generate-metadata` — regenerate the local `.script.yaml` (input schema) and `.lock` (resolved dependencies) for scripts you changed, and refresh their content hashes in `wmill-lock.yaml`. Local files only — **not** a deploy. See "Keep metadata in sync" below.
-- `wmill sync push` — deploy local changes to the workspace. Only suggest/run this when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
+- Deploy local changes to the workspace — via `git push` or `wmill sync push` depending on how the repo is wired (see the **Deploying** section in `AGENTS.wmill.md`). Only suggest/run a deploy when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
 
 ### Preview vs run — choose by intent, not habit
 
@@ -42,7 +42,7 @@ If the user hasn't already told you to run/test/preview the script, offer it as
 
 If the user already asked to test/run/try the script in their original request, skip the offer and just execute `wmill script preview <path> -d '<args>'` directly — pick plausible args from the script's declared parameters. The shape varies by language: `main(...)` for code languages, the SQL dialect's own placeholder syntax (`$1` for PostgreSQL, `?` for MySQL/Snowflake, `@P1` for MSSQL, `@name` for BigQuery, etc.), positional `$1`, `$2`, … for Bash, `param(...)` for PowerShell.
 
-`wmill script preview` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). `wmill generate-metadata` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's `AGENTS.md` opts in), per "Keep metadata in sync" above. Only `wmill sync push` deploys to the workspace — run it only when the user explicitly asks to deploy/publish/push.
+`wmill script preview` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). `wmill generate-metadata` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's `AGENTS.md` opts in), per "Keep metadata in sync" above. Deploying to the workspace (`git push` or `wmill sync push` depending on how the repo is wired — see the **Deploying** section) is the only step that mutates remote state — do it only when the user explicitly asks to deploy/publish/push.
 
 For a **visual** open-the-script-in-the-dev-page preview (rather than `script preview`'s run-and-print-result), use the `preview` skill.
 
diff --git a/system_prompts/base/flow-cli.md b/system_prompts/base/flow-cli.md
index 59040ce006..d8a2b41b13 100644
--- a/system_prompts/base/flow-cli.md
+++ b/system_prompts/base/flow-cli.md
@@ -44,7 +44,7 @@ After writing, act on the user's intent instead of just listing commands. Run `w
 - `wmill flow preview <flow_path>` — **default when iterating on a local flow.** Runs the local `flow.yaml` against local inline scripts without deploying. Add `--remote` to use deployed workspace scripts for PathScript steps instead of local files. Add `--step <step_id>` to run only one module in isolation (see "Single-step vs whole-flow preview" below).
 - `wmill flow run <path>` — runs the flow **already deployed** in the workspace. Use only when the user explicitly wants to test the deployed version, not local edits.
 - `wmill generate-metadata` — regenerate stale local `.lock` files for the flow and its inline scripts and refresh their content hashes in `wmill-lock.yaml`. Writes local files only (not a deploy). Run it after editing inline scripts whose imports or arguments changed, so `wmill-lock.yaml` doesn't drift and add noise to git-sync/CI. By default it scans **scripts, flows, and apps** across the workspace but only regenerates stale ones; pass the flow's folder as an argument (or run from that subdirectory) to limit the scope to the flow you edited. Note a flow (or script) that imports a changed shared script is pulled in too — run `wmill generate-metadata --dry-run` to see exactly what is stale and why (`content changed` vs `depends on <path>`) before applying.
-- `wmill sync push` — deploy local changes to the workspace. Only suggest/run this when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
+- Deploy local changes to the workspace — via `git push` or `wmill sync push` depending on how the repo is wired (see the **Deploying** section in `AGENTS.wmill.md`). Only suggest/run a deploy when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
 
 ### Preview vs run — choose by intent, not habit
 
diff --git a/system_prompts/base/resources.md b/system_prompts/base/resources.md
index 763c0741f8..1c548a2484 100644
--- a/system_prompts/base/resources.md
+++ b/system_prompts/base/resources.md
@@ -237,7 +237,8 @@ wmill resource-type list --schema
 # Get specific resource type schema
 wmill resource-type get postgresql
 
-# Push resources to Windmill — deploys to the workspace and can be destructive to
-# remote state, so only run it when the user explicitly asks to deploy/publish/push
+# Deploy resources to the workspace — destructive to remote state, so only run when
+# the user explicitly asks to deploy/publish/push. Depending on how the repo is wired,
+# deploy via `git push` or `wmill sync push` (see the Deploying section in AGENTS.wmill.md).
 wmill sync push
 ```
diff --git a/system_prompts/base/schedules.md b/system_prompts/base/schedules.md
index f3d9d9ee9a..1a6a0f1929 100644
--- a/system_prompts/base/schedules.md
+++ b/system_prompts/base/schedules.md
@@ -34,7 +34,7 @@ Windmill uses 6-field cron expressions (includes seconds):
 
 ## CLI Commands
 
-`wmill sync push` deploys local changes to the workspace and can be destructive to remote state — only suggest/run it when the user explicitly asks to deploy/publish/push, not when they say "run", "try", or "test". The commands below never mutate remote state, so they're safe to run yourself — note that `sync pull` does overwrite local files to match the remote (use `sync pull --dry-run` to only preview), while `schedule` just lists.
+Deploying local changes to the workspace can be destructive to remote state — only suggest/run a deploy when the user explicitly asks to deploy/publish/push, not when they say "run", "try", or "test". Deploy via `git push` or `wmill sync push` depending on how the repo is wired (see the **Deploying** section in `AGENTS.wmill.md`). The commands below never mutate remote state, so they're safe to run yourself — note that `sync pull` does overwrite local files to match the remote (use `sync pull --dry-run` to only preview), while `schedule` just lists.
 
 ```bash
 # Push schedules to Windmill — only when the user explicitly asks to deploy
diff --git a/system_prompts/base/triggers.md b/system_prompts/base/triggers.md
index 37ce6fc0e6..8861cc2c39 100644
--- a/system_prompts/base/triggers.md
+++ b/system_prompts/base/triggers.md
@@ -56,7 +56,7 @@ Text/HTML/inline parts are placed inline in `body` as strings.
 
 ## CLI Commands
 
-`wmill sync push` deploys local changes to the workspace and can be destructive to remote state — only suggest/run it when the user explicitly asks to deploy/publish/push, not when they say "run", "try", or "test". `sync pull` is safe to run yourself — it never mutates remote state, though it does overwrite local files to match the remote (use `sync pull --dry-run` to only preview).
+Deploying local changes to the workspace can be destructive to remote state — only suggest/run a deploy when the user explicitly asks to deploy/publish/push, not when they say "run", "try", or "test". Deploy via `git push` or `wmill sync push` depending on how the repo is wired (see the **Deploying** section in `AGENTS.wmill.md`). `sync pull` is safe to run yourself — it never mutates remote state, though it does overwrite local files to match the remote (use `sync pull --dry-run` to only preview).
 
 ```bash
 # Push trigger configuration — only when the user explicitly asks to deploy
diff --git a/system_prompts/generate.py b/system_prompts/generate.py
index dac36ad97a..beac340499 100644
--- a/system_prompts/generate.py
+++ b/system_prompts/generate.py
@@ -1668,7 +1668,7 @@ After writing, tell the user which command fits what they want to do:
 - `wmill script preview <script_path>` — **default when iterating on a local script.** Runs the local file without deploying.
 - `wmill script run <path>` — runs the script **already deployed** in the workspace. Use only when the user explicitly wants to test the deployed version, not local edits.
 - `wmill generate-metadata` — regenerate the local `.script.yaml` (input schema) and `.lock` (resolved dependencies) for scripts you changed, and refresh their content hashes in `wmill-lock.yaml`. Local files only — **not** a deploy. See "Keep metadata in sync" below.
-- `wmill sync push` — deploy local changes to the workspace. Only suggest/run this when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
+- Deploy local changes to the workspace — via `git push` or `wmill sync push` depending on how the repo is wired (see the **Deploying** section in `AGENTS.wmill.md`). Only suggest/run a deploy when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
 
 ### Preview vs run — choose by intent, not habit
 
@@ -1698,7 +1698,7 @@ If the user hasn't already told you to run/test/preview the script, offer it as
 
 If the user already asked to test/run/try the script in their original request, skip the offer and just execute `wmill script preview <path> -d '<args>'` directly — pick plausible args from the script's declared parameters. The shape varies by language: `main(...)` for code languages, the SQL dialect's own placeholder syntax (`$1` for PostgreSQL, `?` for MySQL/Snowflake, `@P1` for MSSQL, `@name` for BigQuery, etc.), positional `$1`, `$2`, … for Bash, `param(...)` for PowerShell.
 
-`wmill script preview` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). `wmill generate-metadata` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's `AGENTS.md` opts in), per "Keep metadata in sync" above. Only `wmill sync push` deploys to the workspace — run it only when the user explicitly asks to deploy/publish/push.
+`wmill script preview` does not deploy, but it still executes script code and may cause side effects; run it yourself when the user asked to test/preview (or after confirming that execution is intended). `wmill generate-metadata` does not deploy either — it only writes local files (locks, schemas, hashes) — but offer it before running (or run automatically if the project's `AGENTS.md` opts in), per "Keep metadata in sync" above. Deploying to the workspace (`git push` or `wmill sync push` depending on how the repo is wired — see the **Deploying** section) is the only step that mutates remote state — do it only when the user explicitly asks to deploy/publish/push.
 
 For a **visual** open-the-script-in-the-dev-page preview (rather than `script preview`'s run-and-print-result), use the `preview` skill.
 

From ddec2abbb3f56fc44d4c75fde60f00fb1c6373bb Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Mon, 20 Jul 2026 22:09:59 +0200
Subject: [PATCH 075/171] feat(jobs): cap total queued jobs per workspace on
 cloud (#10218)

* feat(jobs): cap total queued jobs per workspace on cloud

A workspace could flood the queue with an unbounded number of jobs across
many concurrency keys and scripts (or keyless jobs), which the per-key
cap from #10197 does not bound. Add a companion instance-wide ceiling on
a workspace's total queued jobs.

check_workspace_queue_cap rejects a push once the workspace has
WORKSPACE_MAX_QUEUED_JOBS (default 20000, superadmin-configurable, 0 to
disable) jobs queued, cloud-only and runtime-gated on CLOUD_HOSTED like
the per-key cap. It runs on every push, so it applies even to premium
workspaces and catches parallel for-loop floods. Jobs already queued
still drain; only new pushes past the ceiling are rejected, so an
in-flight flow only fails to push further work while at the ceiling.

The setting loader self-gates on CLOUD_HOSTED so it is never loaded off
cloud, from initial load or a settings-change reload. The depth count is
bounded by the cap via LIMIT so a runaway backlog never costs an
unbounded scan on the push path.

* docs(jobs): note the workspace cap is a soft ceiling and the depth helper is count-only

Records the two review points as constraints: the cap does not serialize
admission (a soft ceiling by design, like the per-key cap), and
workspace_queue_depth is pub only for the test, returns a count not job
data, and leaves authorization to the caller.
---
 ...857a2601b10b057877c3b2795b8ea9c928c1b.json | 17 +++++
 ...193ea4129874c36e2c334e9e73f4b4c54ad07.json | 15 ++++
 ...d75eda5fc20669d598f0dbbb301030e58d702.json | 23 ++++++
 backend/src/main.rs                           | 27 ++++---
 backend/src/monitor.rs                        | 40 ++++++++++-
 .../windmill-common/src/global_settings.rs    |  5 ++
 backend/windmill-common/src/worker.rs         | 10 +++
 backend/windmill-queue/src/jobs.rs            | 69 ++++++++++++++++++
 .../tests/workspace_queue_depth_test.rs       | 71 +++++++++++++++++++
 .../src/lib/components/instanceSettings.ts    | 12 ++++
 10 files changed, 277 insertions(+), 12 deletions(-)
 create mode 100644 backend/.sqlx/query-1ce0728a6b0942fecf8ce5f4a06857a2601b10b057877c3b2795b8ea9c928c1b.json
 create mode 100644 backend/.sqlx/query-750eb7365e2590a42d9f3c4cbbf193ea4129874c36e2c334e9e73f4b4c54ad07.json
 create mode 100644 backend/.sqlx/query-d977778801cc5efdfc4051d5b77d75eda5fc20669d598f0dbbb301030e58d702.json
 create mode 100644 backend/windmill-queue/tests/workspace_queue_depth_test.rs

diff --git a/backend/.sqlx/query-1ce0728a6b0942fecf8ce5f4a06857a2601b10b057877c3b2795b8ea9c928c1b.json b/backend/.sqlx/query-1ce0728a6b0942fecf8ce5f4a06857a2601b10b057877c3b2795b8ea9c928c1b.json
new file mode 100644
index 0000000000..7a74d18f48
--- /dev/null
+++ b/backend/.sqlx/query-1ce0728a6b0942fecf8ce5f4a06857a2601b10b057877c3b2795b8ea9c928c1b.json
@@ -0,0 +1,17 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO v2_job_queue (id, workspace_id, scheduled_for, tag, running)\n             VALUES ($1, $2, now() + ($3::bigint::text || ' s')::interval, 'other', $4)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Varchar",
+        "Int8",
+        "Bool"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "1ce0728a6b0942fecf8ce5f4a06857a2601b10b057877c3b2795b8ea9c928c1b"
+}
diff --git a/backend/.sqlx/query-750eb7365e2590a42d9f3c4cbbf193ea4129874c36e2c334e9e73f4b4c54ad07.json b/backend/.sqlx/query-750eb7365e2590a42d9f3c4cbbf193ea4129874c36e2c334e9e73f4b4c54ad07.json
new file mode 100644
index 0000000000..17f12041c4
--- /dev/null
+++ b/backend/.sqlx/query-750eb7365e2590a42d9f3c4cbbf193ea4129874c36e2c334e9e73f4b4c54ad07.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO v2_job (id, workspace_id, tag) VALUES ($1, $2, 'other')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Varchar"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "750eb7365e2590a42d9f3c4cbbf193ea4129874c36e2c334e9e73f4b4c54ad07"
+}
diff --git a/backend/.sqlx/query-d977778801cc5efdfc4051d5b77d75eda5fc20669d598f0dbbb301030e58d702.json b/backend/.sqlx/query-d977778801cc5efdfc4051d5b77d75eda5fc20669d598f0dbbb301030e58d702.json
new file mode 100644
index 0000000000..420092f7e8
--- /dev/null
+++ b/backend/.sqlx/query-d977778801cc5efdfc4051d5b77d75eda5fc20669d598f0dbbb301030e58d702.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT count(*) FROM (\n            SELECT 1 FROM v2_job_queue\n            WHERE workspace_id = $1 AND running = false\n            LIMIT $2\n        ) s",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "count",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Int8"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "d977778801cc5efdfc4051d5b77d75eda5fc20669d598f0dbbb301030e58d702"
+}
diff --git a/backend/src/main.rs b/backend/src/main.rs
index 6a12250e53..aa895df3e7 100644
--- a/backend/src/main.rs
+++ b/backend/src/main.rs
@@ -64,7 +64,7 @@ use windmill_common::{
         UV_EXCLUDE_NEWER_SETTING, UV_INDEX_STRATEGY_SETTING, UV_PYTHON_INSTALL_MIRROR_SETTING,
         WORKSPACE_FAIRNESS_DURATION_SECS_SETTING, WORKSPACE_FAIRNESS_ENABLED_SETTING,
         WORKSPACE_FAIRNESS_MAX_PERCENT_SETTING, WORKSPACE_FAIRNESS_MIN_TOTAL_SETTING,
-        WORKSPACE_REGISTRIES_SETTING,
+        WORKSPACE_MAX_QUEUED_JOBS_SETTING, WORKSPACE_REGISTRIES_SETTING,
     },
     scripts::ScriptLang,
     stats_oss::schedule_stats,
@@ -127,16 +127,16 @@ use crate::monitor::{
     load_preview_tags_override, load_require_preexisting_user, load_retention_period_overrides,
     load_tag_per_workspace_enabled, load_tag_per_workspace_workspaces,
     load_workspace_fairness_duration_secs, load_workspace_fairness_enabled,
-    load_workspace_fairness_max_percent, load_workspace_fairness_min_total, monitor_db,
-    reload_app_workspaced_route_setting, reload_audit_log_retention_days_setting,
-    reload_base_url_setting, reload_bun_install_min_release_age_setting,
-    reload_bunfig_install_scopes_setting, reload_critical_alert_mute_ui_setting,
-    reload_critical_alerts_on_token_expiry_setting, reload_critical_error_channels_setting,
-    reload_extra_pip_index_url_setting, reload_http_route_workspaced_route_setting,
-    reload_hub_api_secret_setting, reload_hub_base_url_setting,
-    reload_instance_events_webhook_setting, reload_job_default_timeout_setting,
-    reload_job_isolation_setting, reload_jwt_secret_setting, reload_license_key,
-    reload_npm_config_registry_setting, reload_nsjail_tmp_backing_setting,
+    load_workspace_fairness_max_percent, load_workspace_fairness_min_total,
+    load_workspace_max_queued_jobs, monitor_db, reload_app_workspaced_route_setting,
+    reload_audit_log_retention_days_setting, reload_base_url_setting,
+    reload_bun_install_min_release_age_setting, reload_bunfig_install_scopes_setting,
+    reload_critical_alert_mute_ui_setting, reload_critical_alerts_on_token_expiry_setting,
+    reload_critical_error_channels_setting, reload_extra_pip_index_url_setting,
+    reload_http_route_workspaced_route_setting, reload_hub_api_secret_setting,
+    reload_hub_base_url_setting, reload_instance_events_webhook_setting,
+    reload_job_default_timeout_setting, reload_job_isolation_setting, reload_jwt_secret_setting,
+    reload_license_key, reload_npm_config_registry_setting, reload_nsjail_tmp_backing_setting,
     reload_nsjail_tmpfs_size_setting, reload_otel_tracing_proxy_setting,
     reload_pip_index_url_setting, reload_retention_period_setting,
     reload_sandbox_image_cache_max_setting, reload_sandbox_image_default_registry_setting,
@@ -1892,6 +1892,11 @@ async fn process_notify_event(
                         tracing::error!("Error loading concurrency key max queued: {e:#}");
                     }
                 }
+                WORKSPACE_MAX_QUEUED_JOBS_SETTING => {
+                    if let Err(e) = load_workspace_max_queued_jobs(db).await {
+                        tracing::error!("Error loading workspace max queued jobs: {e:#}");
+                    }
+                }
                 SMTP_SETTING => {
                     reload_smtp_config(db).await;
                 }
diff --git a/backend/src/monitor.rs b/backend/src/monitor.rs
index 86f26aeb33..0a3333e58c 100644
--- a/backend/src/monitor.rs
+++ b/backend/src/monitor.rs
@@ -74,6 +74,7 @@ use windmill_common::{
         UV_INDEX_STRATEGY_SETTING, UV_PYTHON_INSTALL_MIRROR_SETTING,
         WORKSPACE_FAIRNESS_DURATION_SECS_SETTING, WORKSPACE_FAIRNESS_ENABLED_SETTING,
         WORKSPACE_FAIRNESS_MAX_PERCENT_SETTING, WORKSPACE_FAIRNESS_MIN_TOTAL_SETTING,
+        WORKSPACE_MAX_QUEUED_JOBS_SETTING,
     },
     indexer::load_indexer_config,
     jobs::delete_jobs,
@@ -92,7 +93,8 @@ use windmill_common::{
         DEFAULT_TAGS_WORKSPACES, FORK_WORKSPACE_TAG_APPEND_FORK_SUFFIX, INDEXER_CONFIG,
         PREVIEW_TAGS_OVERRIDE, SCRIPT_TOKEN_EXPIRY, SMTP_CONFIG, WINDMILL_DIR, WORKER_CONFIG,
         WORKER_GROUP, WORKSPACE_FAIRNESS_DURATION_SECS, WORKSPACE_FAIRNESS_ENABLED,
-        WORKSPACE_FAIRNESS_MAX_PERCENT, WORKSPACE_FAIRNESS_MIN_TOTAL,
+        WORKSPACE_FAIRNESS_MAX_PERCENT, WORKSPACE_FAIRNESS_MIN_TOTAL, WORKSPACE_MAX_QUEUED_JOBS,
+        WORKSPACE_MAX_QUEUED_JOBS_DEFAULT,
     },
     KillpillSender, AUDIT_LOG_RETENTION_DAYS, BASE_URL, CRITICAL_ALERTS_ON_DB_OVERSIZE,
     CRITICAL_ALERTS_ON_TOKEN_EXPIRY, CRITICAL_ALERT_MUTE_UI_ENABLED, CRITICAL_ERROR_CHANNELS, DB,
@@ -299,6 +301,9 @@ pub async fn initial_load(
             if let Err(e) = load_concurrency_key_max_queued(db).await {
                 tracing::error!("Error loading concurrency key max queued: {e:#}");
             }
+            if let Err(e) = load_workspace_max_queued_jobs(db).await {
+                tracing::error!("Error loading workspace max queued jobs: {e:#}");
+            }
         }
     }
 
@@ -743,6 +748,39 @@ pub async fn load_concurrency_key_max_queued(db: &DB) -> error::Result<()> {
     Ok(())
 }
 
+pub async fn load_workspace_max_queued_jobs(db: &DB) -> error::Result<()> {
+    // Only the cloud enforces this cap, so never spend the query off-cloud, from any call site.
+    if !*CLOUD_HOSTED {
+        return Ok(());
+    }
+    // Same Err / None / invalid policy as load_concurrency_key_max_queued: 0 disables.
+    match load_value_from_global_settings(db, WORKSPACE_MAX_QUEUED_JOBS_SETTING).await? {
+        Some(serde_json::Value::Number(n)) => {
+            let v = n
+                .as_u64()
+                .map(|u| u.min(CONCURRENCY_KEY_MAX_QUEUED_MAX) as u32)
+                .unwrap_or_else(|| {
+                    tracing::warn!(
+                        "{WORKSPACE_MAX_QUEUED_JOBS_SETTING}={n} is not a non-negative integer, \
+                         falling back to {WORKSPACE_MAX_QUEUED_JOBS_DEFAULT}. Set 0 to disable."
+                    );
+                    WORKSPACE_MAX_QUEUED_JOBS_DEFAULT
+                });
+            WORKSPACE_MAX_QUEUED_JOBS.store(v, Ordering::Relaxed);
+        }
+        other => {
+            if let Some(v) = other {
+                tracing::warn!(
+                    "{WORKSPACE_MAX_QUEUED_JOBS_SETTING}={v} is not a number, falling back to \
+                     {WORKSPACE_MAX_QUEUED_JOBS_DEFAULT}. Set 0 to disable."
+                );
+            }
+            WORKSPACE_MAX_QUEUED_JOBS.store(WORKSPACE_MAX_QUEUED_JOBS_DEFAULT, Ordering::Relaxed);
+        }
+    }
+    Ok(())
+}
+
 pub async fn load_fork_workspace_tag_append_fork_suffix(db: &DB) -> error::Result<()> {
     let value =
         load_value_from_global_settings(db, FORK_WORKSPACE_TAG_APPEND_FORK_SUFFIX_SETTING).await;
diff --git a/backend/windmill-common/src/global_settings.rs b/backend/windmill-common/src/global_settings.rs
index bbe7dbb9b5..2714d31276 100644
--- a/backend/windmill-common/src/global_settings.rs
+++ b/backend/windmill-common/src/global_settings.rs
@@ -121,6 +121,11 @@ pub const WORKSPACE_FAIRNESS_MIN_TOTAL_SETTING: &str = "workspace_fairness_min_t
 // `check_concurrency_key_queue_cap`.
 pub const CONCURRENCY_KEY_MAX_QUEUED_SETTING: &str = "concurrency_key_max_queued_jobs";
 
+// Cloud-only ceiling on how many jobs a single workspace may have queued in
+// total, across every key and script. Applies even to premium workspaces. `0`
+// disables the cap. See `windmill-queue/src/jobs.rs`, `check_workspace_queue_cap`.
+pub const WORKSPACE_MAX_QUEUED_JOBS_SETTING: &str = "workspace_max_queued_jobs";
+
 /// Global settings an agent worker (a remote worker connected over HTTP instead
 /// of to the database) must NEVER read through
 /// `GET /api/agent_workers/get_global_setting/{key}`. Every other key is served.
diff --git a/backend/windmill-common/src/worker.rs b/backend/windmill-common/src/worker.rs
index 2c936ff0aa..b9dd29c00a 100644
--- a/backend/windmill-common/src/worker.rs
+++ b/backend/windmill-common/src/worker.rs
@@ -213,6 +213,10 @@ pub const MIN_PERIODIC_SCRIPT_INTERVAL_SECONDS: u64 = 60;
 /// Default for [`CONCURRENCY_KEY_MAX_QUEUED`]; also the value the setting loader restores when
 /// the setting is cleared or malformed.
 pub const CONCURRENCY_KEY_MAX_QUEUED_DEFAULT: u32 = 10_000;
+/// Default for [`WORKSPACE_MAX_QUEUED_JOBS`]; also the value the setting loader restores when
+/// the setting is cleared or malformed. A workspace spans many keys, so this sits well above
+/// the per-key cap.
+pub const WORKSPACE_MAX_QUEUED_JOBS_DEFAULT: u32 = 20_000;
 lazy_static::lazy_static! {
     pub static ref WORKER_GROUP: String = std::env::var("WORKER_GROUP").unwrap_or_else(|_| {
         #[cfg(not(feature = "enterprise"))]
@@ -347,6 +351,12 @@ lazy_static::lazy_static! {
     pub static ref CONCURRENCY_KEY_MAX_QUEUED: AtomicU32 =
         AtomicU32::new(CONCURRENCY_KEY_MAX_QUEUED_DEFAULT);
 
+    /// Cloud-only ceiling on the total number of jobs a workspace may have queued at once,
+    /// across every concurrency key and script. Guards against a workspace flooding the queue
+    /// generally (not just behind one key), including from parallel for-loops. `0` disables it.
+    pub static ref WORKSPACE_MAX_QUEUED_JOBS: AtomicU32 =
+        AtomicU32::new(WORKSPACE_MAX_QUEUED_JOBS_DEFAULT);
+
 
     pub static ref SMTP_CONFIG: arc_swap::ArcSwap<Option<Smtp>> = arc_swap::ArcSwap::from_pointee(None);
     pub static ref INDEXER_CONFIG: arc_swap::ArcSwap<TantivyIndexerSettings> = arc_swap::ArcSwap::from_pointee(TantivyIndexerSettings::default());
diff --git a/backend/windmill-queue/src/jobs.rs b/backend/windmill-queue/src/jobs.rs
index 934b9b50b4..bea3bc1008 100644
--- a/backend/windmill-queue/src/jobs.rs
+++ b/backend/windmill-queue/src/jobs.rs
@@ -6280,6 +6280,11 @@ async fn push_inner<'c, 'd>(
         )
         .unzip();
 
+    #[cfg(feature = "cloud")]
+    if *CLOUD_HOSTED {
+        check_workspace_queue_cap(&mut *tx, workspace_id).await?;
+    }
+
     if concurrency_settings.concurrent_limit.is_some() {
         let concurrency_key = resolve_concurrency_key(
             workspace_id,
@@ -6791,6 +6796,70 @@ async fn check_concurrency_key_queue_cap<'c>(
     Ok(())
 }
 
+/// Bounded count of a workspace's non-running queued jobs, capped at `limit` so the scan
+/// stops once the ceiling is reached rather than counting an entire runaway backlog.
+///
+/// Internal helper for `check_workspace_queue_cap`, `pub` only so the integration test can call
+/// it (like `concurrency_key_queue_depth`). Returns a count, not job contents; the caller is
+/// responsible for any authorization — it takes the workspace id as given.
+pub async fn workspace_queue_depth<'c>(
+    db: impl PgExecutor<'c>,
+    workspace_id: &str,
+    limit: i64,
+) -> Result<i64, Error> {
+    sqlx::query_scalar!(
+        "SELECT count(*) FROM (
+            SELECT 1 FROM v2_job_queue
+            WHERE workspace_id = $1 AND running = false
+            LIMIT $2
+        ) s",
+        workspace_id,
+        limit,
+    )
+    .fetch_one(db)
+    .warn_after_seconds(3)
+    .await
+    .map_err(|e| {
+        Error::internal_err(format!(
+            "Could not count queued jobs for workspace={workspace_id}: {e:#}"
+        ))
+    })
+    .map(|c| c.unwrap_or(0))
+}
+
+/// Rejects the push when the workspace already has `WORKSPACE_MAX_QUEUED_JOBS` jobs queued.
+///
+/// Caller must runtime-gate this on `*CLOUD_HOSTED`. It runs on every push (not only
+/// concurrency-limited ones) because a workspace can flood the queue across many keys or with
+/// keyless jobs. It caps *new* pushes past the ceiling; jobs already queued still drain, so an
+/// in-flight flow only ever fails to push further work while the workspace is at the ceiling.
+///
+/// This is a soft ceiling, like the per-key cap: the count and the insert are not serialized, so
+/// a burst of concurrent pushes can land a handful over the limit. That is fine and intentional
+/// — the cap exists to stop an unbounded runaway, not to enforce an exact quota, and a
+/// per-workspace lock on every push would add hot-path contention for no practical gain.
+#[cfg(feature = "cloud")]
+async fn check_workspace_queue_cap<'c>(
+    db: impl PgExecutor<'c>,
+    workspace_id: &str,
+) -> Result<(), Error> {
+    let cap = windmill_common::worker::WORKSPACE_MAX_QUEUED_JOBS
+        .load(std::sync::atomic::Ordering::Relaxed);
+    if cap == 0 {
+        return Ok(());
+    }
+    let cap = cap as i64;
+    let depth = workspace_queue_depth(db, workspace_id, cap).await?;
+    if depth >= cap {
+        return Err(Error::QuotaExceeded(format!(
+            "Too many jobs queued in workspace '{workspace_id}': at least {depth} jobs are \
+             already waiting and the instance limit is {cap}. Cancel the backlog or slow down \
+             whatever is creating jobs before pushing more."
+        )));
+    }
+    Ok(())
+}
+
 // pub async fn insert_debounce_key<'d, 'c>(
 //     workspace_id: &str,
 //     args: &PushArgs<'d>,
diff --git a/backend/windmill-queue/tests/workspace_queue_depth_test.rs b/backend/windmill-queue/tests/workspace_queue_depth_test.rs
new file mode 100644
index 0000000000..f6969afc4c
--- /dev/null
+++ b/backend/windmill-queue/tests/workspace_queue_depth_test.rs
@@ -0,0 +1,71 @@
+//! Regression guard for `workspace_queue_depth`, which backs the cloud-only cap on how many
+//! jobs a single workspace may have queued in total.
+//!
+//! Run with:
+//!   cargo test -p windmill-queue --test workspace_queue_depth_test
+
+use sqlx::{Pool, Postgres};
+use uuid::Uuid;
+use windmill_queue::jobs::workspace_queue_depth;
+
+/// Queues `count` jobs in `workspace`, scheduled `offset_secs` from now, with `running` state.
+async fn seed(db: &Pool<Postgres>, workspace: &str, count: usize, offset_secs: i64, running: bool) {
+    for _ in 0..count {
+        let id = Uuid::new_v4();
+        sqlx::query!(
+            "INSERT INTO v2_job (id, workspace_id, tag) VALUES ($1, $2, 'other')",
+            id,
+            workspace,
+        )
+        .execute(db)
+        .await
+        .expect("seed v2_job");
+        sqlx::query!(
+            "INSERT INTO v2_job_queue (id, workspace_id, scheduled_for, tag, running)
+             VALUES ($1, $2, now() + ($3::bigint::text || ' s')::interval, 'other', $4)",
+            id,
+            workspace,
+            offset_secs,
+            running,
+        )
+        .execute(db)
+        .await
+        .expect("seed v2_job_queue");
+    }
+}
+
+/// The count is per workspace and ignores running jobs: a runaway in one workspace must not
+/// charge another, and jobs already executing are not backlog. Future-scheduled jobs count,
+/// since a concurrency-parked backlog is almost entirely future-dated.
+#[sqlx::test(migrations = "../migrations")]
+async fn scoped_to_workspace_and_ignores_running(db: Pool<Postgres>) {
+    seed(&db, "ws-a", 4, 3600, false).await; // waiting (parked in the future)
+    seed(&db, "ws-a", 3, -10, false).await; // waiting (due now)
+    seed(&db, "ws-a", 5, -10, true).await; // running — not backlog
+    seed(&db, "ws-b", 9, 3600, false).await; // a different workspace
+
+    let depth = workspace_queue_depth(&db, "ws-a", 1000)
+        .await
+        .expect("count depth");
+
+    assert_eq!(
+        depth, 7,
+        "only ws-a's 7 waiting jobs count; running jobs and ws-b must not"
+    );
+}
+
+/// The scan stops at `limit`, so a runaway backlog does not cost an unbounded count on every
+/// push. The cap only needs to know the depth has reached the ceiling.
+#[sqlx::test(migrations = "../migrations")]
+async fn bounded_by_limit(db: Pool<Postgres>) {
+    seed(&db, "ws-a", 50, -10, false).await;
+
+    let depth = workspace_queue_depth(&db, "ws-a", 10)
+        .await
+        .expect("count depth");
+
+    assert_eq!(
+        depth, 10,
+        "the count must stop at the limit, not scan all 50"
+    );
+}
diff --git a/frontend/src/lib/components/instanceSettings.ts b/frontend/src/lib/components/instanceSettings.ts
index b58eb329f7..3b892049c6 100644
--- a/frontend/src/lib/components/instanceSettings.ts
+++ b/frontend/src/lib/components/instanceSettings.ts
@@ -438,6 +438,18 @@ export const settings: Record<string, Setting[]> = {
 			cloudonly: true,
 			ee_only: '',
 			hideInQuickSetup: true
+		},
+		{
+			label: 'Max jobs queued per workspace',
+			description:
+				'Rejects new jobs once a workspace has this many queued in total, across every concurrency key and script. Guards against a single workspace flooding the queue generally, including from parallel for-loops. Applies even to premium workspaces. Jobs already queued still drain; only new pushes past the ceiling are rejected. Set 0 to disable. Default 20000.',
+			key: 'workspace_max_queued_jobs',
+			fieldType: 'number',
+			placeholder: '20000',
+			storage: 'setting',
+			cloudonly: true,
+			ee_only: '',
+			hideInQuickSetup: true
 		}
 	],
 	'Object Storage': [

From 858d9a55274616f8e0a1844c7029371e7054f63a Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Mon, 20 Jul 2026 22:56:04 +0200
Subject: [PATCH 076/171] chore(main): release 1.764.0 (#10196)

* chore(main): release 1.764.0

* Apply automatic changes

---------

Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>
---
 CHANGELOG.md                                  |  28 ++
 backend/Cargo.lock                            | 283 +++++++++---------
 backend/Cargo.toml                            |   4 +-
 .../parsers/windmill-parser-wasm/Cargo.lock   |  48 +--
 .../parsers/windmill-parser-wasm/Cargo.toml   |   2 +-
 backend/windmill-api/openapi.yaml             |   2 +-
 benchmarks/lib.ts                             |   2 +-
 cli/src/core/constants.ts                     |   2 +-
 frontend/package-lock.json                    |   4 +-
 frontend/package.json                         |   2 +-
 lsp/Pipfile                                   |   2 +-
 openflow.openapi.yaml                         |   2 +-
 .../WindmillClient/WindmillClient.psd1        |   2 +-
 python-client/wmill/pyproject.toml            |   2 +-
 typescript-client/jsr.json                    |   2 +-
 typescript-client/package.json                |   2 +-
 version.txt                                   |   2 +-
 17 files changed, 209 insertions(+), 182 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 995c31a083..382a04c843 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,33 @@
 # Changelog
 
+## [1.764.0](https://github.com/windmill-labs/windmill/compare/v1.763.0...v1.764.0) (2026-07-20)
+
+
+### Features
+
+* **ai:** add npm package search tool to global chat ([#10204](https://github.com/windmill-labs/windmill/issues/10204)) ([0593ff7](https://github.com/windmill-labs/windmill/commit/0593ff7d7d598af0b9f52d08bb22147e3a83e6e9))
+* **ai:** expose get_db_schema tool in global chat ([#10207](https://github.com/windmill-labs/windmill/issues/10207)) ([f4308cf](https://github.com/windmill-labs/windmill/commit/f4308cf033b75e9a69c1e21041ff97f3bfa1787c))
+* **ai:** extract prompt cache token usage from OpenAI and Azure providers ([#10214](https://github.com/windmill-labs/windmill/issues/10214)) ([2b58df5](https://github.com/windmill-labs/windmill/commit/2b58df57fc5bae08155ffd7198643ed739e6a463))
+* **ai:** live web-search source list on chat tool cards ([#10210](https://github.com/windmill-labs/windmill/issues/10210)) ([542a484](https://github.com/windmill-labs/windmill/commit/542a4842a317a6607de973b4567bdb27dc088664))
+* cap queued jobs per concurrency key on cloud ([#10197](https://github.com/windmill-labs/windmill/issues/10197)) ([71f2d47](https://github.com/windmill-labs/windmill/commit/71f2d47cb4ff331cbcc7843bf0704ddb63cb77db))
+* detect server-handled git-sync so CLI picks git push vs wmill sync push ([#10201](https://github.com/windmill-labs/windmill/issues/10201)) ([b070f56](https://github.com/windmill-labs/windmill/commit/b070f56c5e6109c219a53cbb9628e28be4397fb7))
+* expose windmill api endpoint catalog to global ai chat ([#10199](https://github.com/windmill-labs/windmill/issues/10199)) ([83a354f](https://github.com/windmill-labs/windmill/commit/83a354f831cbc1821f2316e6d4e1c7f7a2cd7cdb))
+* **jobs:** cap total queued jobs per workspace on cloud ([#10218](https://github.com/windmill-labs/windmill/issues/10218)) ([ddec2ab](https://github.com/windmill-labs/windmill/commit/ddec2abbb3f56fc44d4c75fde60f00fb1c6373bb))
+* **sessions:** live DOM access for the raw-app preview in AI sessions ([#10129](https://github.com/windmill-labs/windmill/issues/10129)) ([b448af1](https://github.com/windmill-labs/windmill/commit/b448af1da7f6a351973724721e52682259212292))
+* **telemetry:** generic feature-usage telemetry with AI session metrics ([#10200](https://github.com/windmill-labs/windmill/issues/10200)) ([11fda89](https://github.com/windmill-labs/windmill/commit/11fda89b520cc8d1ce30cdba36bd10355cf025cc))
+
+
+### Bug Fixes
+
+* **db:** grant schema usage and re-run windmill role grants ([#10212](https://github.com/windmill-labs/windmill/issues/10212)) ([38ceae1](https://github.com/windmill-labs/windmill/commit/38ceae1a098ae165c75f43aa9049b5afafdd3bac))
+* **forks:** show workspace settings link in sidebar for fork creators ([#10216](https://github.com/windmill-labs/windmill/issues/10216)) ([11bb37d](https://github.com/windmill-labs/windmill/commit/11bb37d7ca7fbd50cc66905f41851226a48e57fb))
+* **git-sync:** avoid percent-encoded colon in git-sync hub script path ([#10213](https://github.com/windmill-labs/windmill/issues/10213)) ([87be041](https://github.com/windmill-labs/windmill/commit/87be041c091dd7fdd8c6be907a9b2894779f9ac0))
+* **inputs:** add ownership check to saved-input args read endpoint ([#10194](https://github.com/windmill-labs/windmill/issues/10194)) ([f32d770](https://github.com/windmill-labs/windmill/commit/f32d7702bcb592a70f5cf7e01f9e830047645240))
+* **schedules:** apply scope-path filtering to schedule list endpoints ([#10192](https://github.com/windmill-labs/windmill/issues/10192)) ([70359e3](https://github.com/windmill-labs/windmill/commit/70359e3a76d2e1fa5994acce4909753410c80664))
+* **security:** enforce token scope filtering on folder list endpoints ([#10193](https://github.com/windmill-labs/windmill/issues/10193)) ([b5e69ff](https://github.com/windmill-labs/windmill/commit/b5e69ffba6afd49d147e9b5e88e2d7020c09142f))
+* **sessions:** session bar badge readouts, job persistence, refresh bounce ([#10217](https://github.com/windmill-labs/windmill/issues/10217)) ([c8870d3](https://github.com/windmill-labs/windmill/commit/c8870d36aed2283bfa14419cd0bb346083f27b9c))
+* steer ai chat away from draft-blind api catalog reads and runs ([#10202](https://github.com/windmill-labs/windmill/issues/10202)) ([0e04bc6](https://github.com/windmill-labs/windmill/commit/0e04bc6991486b2b2b05b13feed5b083e403ac80))
+
 ## [1.763.0](https://github.com/windmill-labs/windmill/compare/v1.762.2...v1.763.0) (2026-07-19)
 
 
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index d8da1f0400..d909f7da22 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -687,7 +687,7 @@ checksum = "ae36dc4177970ef04fde5178d3e2429882def40e57a451f919c098f72baa6cec"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.0",
+ "syn 3.0.2",
 ]
 
 [[package]]
@@ -1152,7 +1152,7 @@ dependencies = [
  "http 1.4.2",
  "http-body 0.4.6",
  "hyper 0.14.32",
- "hyper 1.10.1",
+ "hyper 1.11.0",
  "hyper-rustls 0.24.2",
  "hyper-rustls 0.27.9",
  "hyper-util",
@@ -1346,7 +1346,7 @@ dependencies = [
  "http 1.4.2",
  "http-body 1.1.0",
  "http-body-util",
- "hyper 1.10.1",
+ "hyper 1.11.0",
  "hyper-util",
  "itoa",
  "matchit 0.8.4",
@@ -1704,7 +1704,7 @@ dependencies = [
  "hex",
  "http 1.4.2",
  "http-body-util",
- "hyper 1.10.1",
+ "hyper 1.11.0",
  "hyper-named-pipe",
  "hyper-util",
  "hyperlocal",
@@ -1909,9 +1909,9 @@ dependencies = [
 
 [[package]]
 name = "bytemuck"
-version = "1.25.1"
+version = "1.25.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6aedf8ae72766347502cf3cb4f41cf5e9cc37d28bee90f1fdaaae15f9cf9424"
+checksum = "95832e849adfb21180ccb6826a99da14e5d266ae5c2e668e1602cf234f153797"
 dependencies = [
  "bytemuck_derive",
 ]
@@ -2205,9 +2205,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.6.2"
+version = "4.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd059f9da4f5c36b3787f65d38ccaab1cc315f07b01f89abc8359ee6a8205011"
+checksum = "0fb99565819980999fb7b4a1796046a5c949e6d4ff132cf5fadf5a641e20d776"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -2227,9 +2227,9 @@ dependencies = [
 
 [[package]]
 name = "clap_derive"
-version = "4.6.1"
+version = "4.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2ce8604710f6733aa641a2b3731eaa1e8b3d9973d5e3565da11800813f997a9"
+checksum = "32f2392eae7f16557a3d727ef3a12e57b2b2ca6f98566a5f4fb41ffe305df077"
 dependencies = [
  "heck",
  "proc-macro2",
@@ -3668,7 +3668,7 @@ dependencies = [
  "hickory-resolver",
  "http 1.4.2",
  "http-body-util",
- "hyper 1.10.1",
+ "hyper 1.11.0",
  "hyper-rustls 0.27.9",
  "hyper-util",
  "ipnet",
@@ -3871,7 +3871,7 @@ dependencies = [
  "deno_error 0.6.1",
  "deno_tls",
  "http-body-util",
- "hyper 1.10.1",
+ "hyper 1.11.0",
  "hyper-rustls 0.27.9",
  "hyper-util",
  "log",
@@ -4620,9 +4620,9 @@ checksum = "9afc2bd4d5a73106dd53d10d73d3401c2f32730ba2c0b93ddb888a8983680471"
 
 [[package]]
 name = "fastrand"
-version = "2.4.1"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f1f227452a390804cdb637b74a86990f2a7d7ba4b7d5693aac9b4dd6defd8d6"
+checksum = "da7c62ceae207dd37ea5b845da6a0696c799f85e97da1ab5b7910be3c1c80223"
 
 [[package]]
 name = "ff"
@@ -5732,7 +5732,7 @@ dependencies = [
  "futures",
  "http 1.4.2",
  "http-body-util",
- "hyper 1.10.1",
+ "hyper 1.11.0",
  "hyper-rustls 0.26.0",
  "hyper-tls",
  "hyper-tungstenite",
@@ -5782,9 +5782,9 @@ dependencies = [
 
 [[package]]
 name = "hyper"
-version = "1.10.1"
+version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "55281c53a1894c864990125767da440a4e630446785086f52523b20033b74498"
+checksum = "d22053281f852e11534f5198498373cbb59295120a20771d90f7ed1897490a72"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -5812,7 +5812,7 @@ dependencies = [
  "futures-util",
  "headers",
  "http 1.4.2",
- "hyper 1.10.1",
+ "hyper 1.11.0",
  "hyper-rustls 0.27.9",
  "hyper-util",
  "pin-project-lite",
@@ -5823,17 +5823,16 @@ dependencies = [
 
 [[package]]
 name = "hyper-named-pipe"
-version = "0.1.0"
+version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "73b7d8abf35697b81a825e386fc151e0d503e8cb5fcb93cc8669c376dfd6f278"
+checksum = "fab3637d6b04a8037af8a266fdf6cf92ea957e8c53981a2bf6136572531025bf"
 dependencies = [
  "hex",
- "hyper 1.10.1",
+ "hyper 1.11.0",
  "hyper-util",
  "pin-project-lite",
  "tokio",
  "tower-service",
- "winapi",
 ]
 
 [[package]]
@@ -5860,7 +5859,7 @@ checksum = "a0bea761b46ae2b24eb4aef630d8d1c398157b6fc29e6350ecf090a0b70c952c"
 dependencies = [
  "futures-util",
  "http 1.4.2",
- "hyper 1.10.1",
+ "hyper 1.11.0",
  "hyper-util",
  "log",
  "rustls 0.22.4",
@@ -5878,7 +5877,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f"
 dependencies = [
  "http 1.4.2",
- "hyper 1.10.1",
+ "hyper 1.11.0",
  "hyper-util",
  "log",
  "rustls 0.23.35",
@@ -5895,7 +5894,7 @@ version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2b90d566bffbce6a75bd8b09a05aa8c2cb1fabb6cb348f8840c9e4c90a0d83b0"
 dependencies = [
- "hyper 1.10.1",
+ "hyper 1.11.0",
  "hyper-util",
  "pin-project-lite",
  "tokio",
@@ -5910,7 +5909,7 @@ checksum = "70206fc6890eaca9fde8a0bf71caa2ddfc9fe045ac9e5c70df101a7dbde866e0"
 dependencies = [
  "bytes",
  "http-body-util",
- "hyper 1.10.1",
+ "hyper 1.11.0",
  "hyper-util",
  "native-tls",
  "tokio",
@@ -5925,7 +5924,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7a343d17fe7885302ed7252767dc7bb83609a874b6ff581142241ec4b73957ad"
 dependencies = [
  "http-body-util",
- "hyper 1.10.1",
+ "hyper 1.11.0",
  "hyper-util",
  "pin-project-lite",
  "tokio",
@@ -5945,7 +5944,7 @@ dependencies = [
  "futures-util",
  "http 1.4.2",
  "http-body 1.1.0",
- "hyper 1.10.1",
+ "hyper 1.11.0",
  "ipnet",
  "libc",
  "percent-encoding",
@@ -5966,7 +5965,7 @@ checksum = "986c5ce3b994526b3cd75578e62554abd09f0899d6206de48b3e96ab34ccc8c7"
 dependencies = [
  "hex",
  "http-body-util",
- "hyper 1.10.1",
+ "hyper 1.11.0",
  "hyper-util",
  "pin-project-lite",
  "tokio",
@@ -6490,7 +6489,7 @@ dependencies = [
  "http 1.4.2",
  "http-body 1.1.0",
  "http-body-util",
- "hyper 1.10.1",
+ "hyper 1.11.0",
  "hyper-http-proxy",
  "hyper-rustls 0.27.9",
  "hyper-timeout",
@@ -7826,7 +7825,7 @@ dependencies = [
  "http-body-util",
  "httparse",
  "humantime",
- "hyper 1.10.1",
+ "hyper 1.11.0",
  "itertools 0.14.0",
  "md-5 0.10.6",
  "parking_lot",
@@ -9466,7 +9465,7 @@ checksum = "2c9283685feec7d69af75fb0e858d5e7378f33fe4fc699383b2916ab9273e03c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.0",
+ "syn 3.0.2",
 ]
 
 [[package]]
@@ -9544,7 +9543,7 @@ dependencies = [
  "http 1.4.2",
  "http-body 1.1.0",
  "http-body-util",
- "hyper 1.10.1",
+ "hyper 1.11.0",
  "hyper-rustls 0.27.9",
  "hyper-tls",
  "hyper-util",
@@ -9592,7 +9591,7 @@ dependencies = [
  "http 1.4.2",
  "http-body 1.1.0",
  "http-body-util",
- "hyper 1.10.1",
+ "hyper 1.11.0",
  "hyper-rustls 0.27.9",
  "hyper-util",
  "js-sys",
@@ -9648,7 +9647,7 @@ dependencies = [
  "futures",
  "getrandom 0.2.17",
  "http 1.4.2",
- "hyper 1.10.1",
+ "hyper 1.11.0",
  "reqwest 0.13.1",
  "reqwest-middleware",
  "retry-policies",
@@ -10585,7 +10584,7 @@ checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.0",
+ "syn 3.0.2",
 ]
 
 [[package]]
@@ -10601,9 +10600,9 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.150"
+version = "1.0.151"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8014e44b4736ed0538adeecded0fce2a272f22dc9578a7eb6b2d9993c74cfb9"
+checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
 dependencies = [
  "indexmap 2.14.0",
  "itoa",
@@ -10650,7 +10649,7 @@ checksum = "8d3b1629de253c70a0508c3899572da79ca359fdab27c7920ff00406df418906"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.0",
+ "syn 3.0.2",
 ]
 
 [[package]]
@@ -11852,9 +11851,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "3.0.0"
+version = "3.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2fac314a64dc9a36e61a9eb4261a5e9bbfbc922b27e518af97bc32b926cf967"
+checksum = "a207d6d6a2b7fc470b80443726053f18a2481b7e1eee970597051596567987a3"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -12235,7 +12234,7 @@ checksum = "43cbfe0cf76104d42a574802844187e84a305e531ed54455f11fbde0f10541cd"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.0",
+ "syn 3.0.2",
 ]
 
 [[package]]
@@ -12332,9 +12331,9 @@ dependencies = [
 
 [[package]]
 name = "time"
-version = "0.3.53"
+version = "0.3.54"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "18dfaaeddcb932337b5e7866ee7d0ce9b76d2fd092997146f187ec09b4558a50"
+checksum = "3e1d5e639ff6bab73cb6885cc7e7b1de96c3f32c68ec55f3952614bec1092244"
 dependencies = [
  "deranged",
  "num-conv",
@@ -12352,9 +12351,9 @@ checksum = "9e1c906769ad99c88eaa54e728060edef082f8e358ff32030cb7c7d315e81109"
 
 [[package]]
 name = "time-macros"
-version = "0.2.31"
+version = "0.2.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c431b87111666e491a90baa837f914fb45cd5dc3c268591b0220ff5057f2085f"
+checksum = "7e689342a48d2ea927c87ea50cabf8594854bf940e9310208848d680d668ed85"
 dependencies = [
  "num-conv",
  "time-core",
@@ -12748,7 +12747,7 @@ dependencies = [
  "http 1.4.2",
  "http-body 1.1.0",
  "http-body-util",
- "hyper 1.10.1",
+ "hyper 1.11.0",
  "hyper-timeout",
  "hyper-util",
  "percent-encoding",
@@ -12780,7 +12779,7 @@ dependencies = [
  "http 1.4.2",
  "http-body 1.1.0",
  "http-body-util",
- "hyper 1.10.1",
+ "hyper 1.11.0",
  "hyper-timeout",
  "hyper-util",
  "percent-encoding",
@@ -13176,7 +13175,7 @@ checksum = "f153acc4e99a5f2a5aefa09fb078be54e26271b2813f6041200b224c098d8328"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.0",
+ "syn 3.0.2",
 ]
 
 [[package]]
@@ -13878,7 +13877,7 @@ dependencies = [
 
 [[package]]
 name = "windmill"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -13963,7 +13962,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-ai"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "async-stream",
  "async-trait",
@@ -13996,7 +13995,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-alerting"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14009,7 +14008,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "argon2",
@@ -14039,7 +14038,7 @@ dependencies = [
  "hex",
  "hmac",
  "http 1.4.2",
- "hyper 1.10.1",
+ "hyper 1.11.0",
  "indexmap 2.14.0",
  "itertools 0.14.0",
  "jsonwebtoken 8.3.0",
@@ -14147,12 +14146,12 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-agent-workers"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
  "http 1.4.2",
- "hyper 1.10.1",
+ "hyper 1.11.0",
  "lazy_static",
  "quick_cache",
  "serde",
@@ -14170,7 +14169,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-assets"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14185,7 +14184,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-auth"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14211,7 +14210,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "reqwest 0.12.28",
  "serde",
@@ -14221,7 +14220,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-configs"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14238,7 +14237,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-debug"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "axum 0.8.9",
  "base64 0.22.1",
@@ -14260,7 +14259,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-embeddings"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14283,7 +14282,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flow-conversations"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14299,11 +14298,11 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flows"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
- "hyper 1.10.1",
+ "hyper 1.11.0",
  "serde",
  "serde_json",
  "sql-builder",
@@ -14320,7 +14319,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-groups"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14341,7 +14340,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-inputs"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14355,7 +14354,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-integration-tests"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -14390,14 +14389,14 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-jobs"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
  "base64 0.22.1",
  "chrono",
  "http 1.4.2",
- "hyper 1.10.1",
+ "hyper 1.11.0",
  "lazy_static",
  "serde",
  "serde_json",
@@ -14415,7 +14414,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-npm-proxy"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "axum 0.8.9",
  "flate2",
@@ -14433,7 +14432,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-openapi"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14455,7 +14454,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-schedule"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14475,13 +14474,13 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-scripts"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
  "futures",
  "http 1.4.2",
- "hyper 1.10.1",
+ "hyper 1.11.0",
  "itertools 0.14.0",
  "lazy_static",
  "prometheus",
@@ -14512,7 +14511,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-settings"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14540,7 +14539,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-sse"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "lazy_static",
  "serde",
@@ -14552,14 +14551,14 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-users"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "argon2",
  "axum 0.8.9",
  "chrono",
  "dashmap",
  "http 1.4.2",
- "hyper 1.10.1",
+ "hyper 1.11.0",
  "lazy_static",
  "serde",
  "serde_json",
@@ -14577,7 +14576,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workers"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14591,14 +14590,14 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workspaces"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
  "futures",
  "hex",
  "http 1.4.2",
- "hyper 1.10.1",
+ "hyper 1.11.0",
  "lazy_static",
  "magic-crypt",
  "regex",
@@ -14626,7 +14625,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -14640,7 +14639,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14659,7 +14658,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "aes-gcm",
  "aho-corasick",
@@ -14696,7 +14695,7 @@ dependencies = [
  "globset",
  "hex",
  "hmac",
- "hyper 1.10.1",
+ "hyper 1.11.0",
  "indexmap 2.14.0",
  "itertools 0.14.0",
  "jsonwebtoken 8.3.0",
@@ -14761,7 +14760,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-dep-map"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "chrono",
  "itertools 0.14.0",
@@ -14780,7 +14779,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "regex",
  "serde",
@@ -14795,7 +14794,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "astral-tokio-tar",
@@ -14819,7 +14818,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-jseval"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -14836,7 +14835,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -14852,7 +14851,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-mcp"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -14873,7 +14872,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-native-triggers"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -14904,7 +14903,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-oauth"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "arc-swap",
@@ -14929,7 +14928,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-object-store"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "async-stream",
@@ -14963,7 +14962,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-operator"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -14981,7 +14980,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -14990,7 +14989,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15002,7 +15001,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15014,7 +15013,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -15026,7 +15025,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15038,7 +15037,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15050,7 +15049,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -15061,7 +15060,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15072,7 +15071,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15084,7 +15083,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -15095,7 +15094,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15117,7 +15116,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15129,7 +15128,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15143,7 +15142,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -15160,7 +15159,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15173,7 +15172,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -15185,7 +15184,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15203,7 +15202,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -15219,7 +15218,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -15235,7 +15234,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -15246,7 +15245,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15285,7 +15284,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-runtime-nativets"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "const_format",
@@ -15325,7 +15324,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "getrandom 0.3.4",
  "wasm-bindgen",
@@ -15336,7 +15335,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-store"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15346,7 +15345,7 @@ dependencies = [
  "futures",
  "hex",
  "http 1.4.2",
- "hyper 1.10.1",
+ "hyper 1.11.0",
  "lazy_static",
  "magic-crypt",
  "quick_cache",
@@ -15370,7 +15369,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-test-utils"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15394,14 +15393,14 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "async-trait",
  "axum 0.8.9",
  "chrono",
  "http 1.4.2",
- "hyper 1.10.1",
+ "hyper 1.11.0",
  "itertools 0.14.0",
  "lazy_static",
  "rand 0.9.0",
@@ -15427,7 +15426,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-azure"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15460,7 +15459,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-email"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15480,7 +15479,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-gcp"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15514,7 +15513,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-http"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15526,7 +15525,7 @@ dependencies = [
  "hex",
  "hmac",
  "http 1.4.2",
- "hyper 1.10.1",
+ "hyper 1.11.0",
  "itertools 0.14.0",
  "lazy_static",
  "matchit 0.7.3",
@@ -15550,7 +15549,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-kafka"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15573,7 +15572,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-mqtt"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15597,7 +15596,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-nats"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -15621,7 +15620,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-postgres"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15656,7 +15655,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-sqs"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15684,7 +15683,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-websocket"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15709,7 +15708,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "bitflags 2.13.1",
@@ -15728,7 +15727,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "async-once-cell",
@@ -15842,7 +15841,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker-volumes"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "bytes",
  "futures",
@@ -16580,18 +16579,18 @@ dependencies = [
 
 [[package]]
 name = "zerocopy"
-version = "0.8.54"
+version = "0.8.55"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7cbbc0a705a0fd05cc3676525980d2bf5a9bc4adac6d6475209a7887cf59d19"
+checksum = "b5a105cd7b140f6eeec8acff2ea38135d3cab283ada58540f629fe51e46696eb"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.54"
+version = "0.8.55"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2e817b7b52d0c7358d3246da9d69935ebb18116b2b102b4230dac079b4862f5"
+checksum = "0fe976fb70c78cd64cccfe3a6fc142244e8a77b70959b30faf9d0ac37ee228eb"
 dependencies = [
  "proc-macro2",
  "quote",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index ec1cf6201a..5bb6069461 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.763.0"
+version = "1.764.0"
 authors.workspace = true
 edition.workspace = true
 
@@ -87,7 +87,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal", "./parsers/windmill-parser-wasm"]
 
 [workspace.package]
-version = "1.763.0"
+version = "1.764.0"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.lock b/backend/parsers/windmill-parser-wasm/Cargo.lock
index 7cdad91ae3..a8ad779bb3 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.lock
+++ b/backend/parsers/windmill-parser-wasm/Cargo.lock
@@ -6191,7 +6191,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill-common"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "aho-corasick",
  "anyhow",
@@ -6272,7 +6272,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -6284,7 +6284,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "convert_case",
  "serde",
@@ -6293,7 +6293,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6305,7 +6305,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6317,7 +6317,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -6329,7 +6329,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6341,7 +6341,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6353,7 +6353,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -6364,7 +6364,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6375,7 +6375,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6387,7 +6387,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6398,7 +6398,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -6420,7 +6420,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6432,7 +6432,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6446,7 +6446,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "convert_case",
@@ -6463,7 +6463,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6476,7 +6476,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -6488,7 +6488,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6506,7 +6506,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -6522,7 +6522,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6538,7 +6538,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wasm"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "getrandom 0.2.17",
@@ -6570,7 +6570,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -6581,7 +6581,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.763.0"
+version = "1.764.0"
 dependencies = [
  "anyhow",
  "bitflags",
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.toml b/backend/parsers/windmill-parser-wasm/Cargo.toml
index 9fd7646dec..d752b7d676 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.toml
+++ b/backend/parsers/windmill-parser-wasm/Cargo.toml
@@ -12,7 +12,7 @@ resolver = "2"
 members = ["."]
 
 [workspace.package]
-version = "1.763.0"
+version = "1.764.0"
 edition = "2021"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 3444e873a5..cd5b6a8699 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.763.0
+  version: 1.764.0
   title: Windmill API
 
   contact:
diff --git a/benchmarks/lib.ts b/benchmarks/lib.ts
index 793d2837f1..225d80dccd 100644
--- a/benchmarks/lib.ts
+++ b/benchmarks/lib.ts
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.763.0";
+export const VERSION = "v1.764.0";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({
diff --git a/cli/src/core/constants.ts b/cli/src/core/constants.ts
index 0811c18360..a78e01a31e 100644
--- a/cli/src/core/constants.ts
+++ b/cli/src/core/constants.ts
@@ -10,4 +10,4 @@ export const WM_FORK_PREFIX = "wm-fork";
 // (e.g. utils.ts) can read it without importing main.ts and creating a circular
 // dependency (main → workspace → utils → main) that triggers a TDZ.
 // Re-exported from main.ts for backwards compatibility.
-export const VERSION = "1.763.0";
+export const VERSION = "1.764.0";
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 42ebc783f7..deb7eaf526 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.763.0",
+	"version": "1.764.0",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "@windmill-labs/components",
-			"version": "1.763.0",
+			"version": "1.764.0",
 			"hasInstallScript": true,
 			"license": "AGPL-3.0",
 			"dependencies": {
diff --git a/frontend/package.json b/frontend/package.json
index b940c9eeb9..7f458ca339 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.763.0",
+	"version": "1.764.0",
 	"scripts": {
 		"dev": "vite dev",
 		"dev:ui-builder": "mv static/ui_builder static/ui_builder.dev-disabled 2>/dev/null || true ; trap 'mv static/ui_builder.dev-disabled static/ui_builder 2>/dev/null || true' EXIT ; vite dev",
diff --git a/lsp/Pipfile b/lsp/Pipfile
index 7a075c57a7..7ed5878119 100644
--- a/lsp/Pipfile
+++ b/lsp/Pipfile
@@ -4,7 +4,7 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-wmill = ">=1.763.0"
+wmill = ">=1.764.0"
 sendgrid = "*"
 mysql-connector-python = "*"
 pymongo = "*"
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index 6f42e214ca..b28b7184a1 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1,7 +1,7 @@
 openapi: '3.0.3'
 
 info:
-  version: 1.763.0
+  version: 1.764.0
   title: OpenFlow Spec
   contact:
     name: Ruben Fiszel
diff --git a/powershell-client/WindmillClient/WindmillClient.psd1 b/powershell-client/WindmillClient/WindmillClient.psd1
index c97ebc9576..4f21d2832d 100644
--- a/powershell-client/WindmillClient/WindmillClient.psd1
+++ b/powershell-client/WindmillClient/WindmillClient.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'WindmillClient.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '1.763.0'
+    ModuleVersion     = '1.764.0'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()
diff --git a/python-client/wmill/pyproject.toml b/python-client/wmill/pyproject.toml
index 7c42484438..acede5f804 100644
--- a/python-client/wmill/pyproject.toml
+++ b/python-client/wmill/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill"
-version = "1.763.0"
+version = "1.764.0"
 description = "A client library for accessing Windmill server wrapping the Windmill client API"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/typescript-client/jsr.json b/typescript-client/jsr.json
index 8850db5c63..cceec4de9b 100644
--- a/typescript-client/jsr.json
+++ b/typescript-client/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@windmill/windmill",
-  "version": "1.763.0",
+  "version": "1.764.0",
   "exports": "./src/index.ts",
   "publish": {
     "exclude": ["!src", "./s3Types.ts", "./sqlUtils.ts", "./client.ts"]
diff --git a/typescript-client/package.json b/typescript-client/package.json
index 1ca391ffc6..bafac5a181 100644
--- a/typescript-client/package.json
+++ b/typescript-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.763.0",
+  "version": "1.764.0",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "homepage": "https://github.com/windmill-labs/windmill/tree/main/typescript-client#readme",
diff --git a/version.txt b/version.txt
index 1de8885f2d..35944d0771 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.763.0
+1.764.0

From 7ec56ef61946a685f19a6bac476970696d728a83 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Tue, 21 Jul 2026 07:08:16 +0200
Subject: [PATCH 077/171] fix: require auth on GET
 /concurrency_groups/{job_id}/key (#10221)

The /concurrency_groups global service is registered after the router's
.route_layer(from_extractor::<ApiAuthed>()), and Axum's route_layer only
wraps routes present at the call site, so this handler was left with no
router-level auth. Unlike its siblings list_concurrency_groups and
prune_concurrency_group, get_concurrency_key declared no ApiAuthed
parameter, so GET /api/concurrency_groups/{job_id}/key was reachable
unauthenticated and would return concurrency keys (which can embed
workspace ids, script/flow paths, and $args-templated argument values)
for arbitrary jobs instance-wide.

Add _authed: ApiAuthed so the extractor independently enforces
authentication regardless of layer placement, matching the
defense-in-depth pattern of the sibling handlers.

Fixes WIN-2212

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 backend/windmill-api-jobs/src/concurrency_groups.rs | 1 +
 1 file changed, 1 insertion(+)

diff --git a/backend/windmill-api-jobs/src/concurrency_groups.rs b/backend/windmill-api-jobs/src/concurrency_groups.rs
index 8303788b8a..3f559b4c25 100644
--- a/backend/windmill-api-jobs/src/concurrency_groups.rs
+++ b/backend/windmill-api-jobs/src/concurrency_groups.rs
@@ -357,6 +357,7 @@ async fn get_concurrent_intervals(
 }
 
 async fn get_concurrency_key(
+    _authed: ApiAuthed,
     Extension(db): Extension<DB>,
     Path(job_id): Path<Uuid>,
 ) -> JsonResult<Option<String>> {

From adc555d1722cb59aa5b88503b3105357d76f5b71 Mon Sep 17 00:00:00 2001
From: hugocasa <hugo@casademont.ch>
Date: Tue, 21 Jul 2026 07:09:31 +0200
Subject: [PATCH 078/171] fix(triggers): apply scope-path filtering to list and
 fix update scope check (#10220)

The shared `list_triggers<T>` handler returned every trigger row of its
type in the workspace regardless of the token's declared scope. A token
limited to e.g. `http_triggers:read:<prefix>/*` could enumerate all
trigger paths (and their configs) through the `/list` endpoint, while
`get_trigger`, `create_trigger`, `delete_trigger` and `exists_trigger`
correctly rejected them. This affected all 10 TriggerCrud kinds (HTTP,
WebSocket, Kafka, NATS, MQTT, SQS, GCP, Azure, Postgres, Email).

Apply `build_scope_path_predicate(&authed, T::scope_domain_name(),
"read")` to the returned rows after the draft-only append, mirroring
scripts, flows, apps, resources, variables and schedules. A `HasPath`
supertrait on `Self::Trigger` exposes the row path to the shared handler
without each impl restating it (`Trigger<T>` returns `&base.path`, the
`()` OSS stub returns "").

Also fix `update_trigger`: it only checked scope against the new path in
the request body, letting a scoped token move a trigger it can't touch
into its scope. Now check both the existing path (URL) and the new path.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 backend/windmill-trigger/src/handler.rs | 15 +++++++++++++--
 backend/windmill-trigger/src/types.rs   | 22 ++++++++++++++++++++++
 2 files changed, 35 insertions(+), 2 deletions(-)

diff --git a/backend/windmill-trigger/src/handler.rs b/backend/windmill-trigger/src/handler.rs
index ed3b89fc65..0c46ff25fd 100644
--- a/backend/windmill-trigger/src/handler.rs
+++ b/backend/windmill-trigger/src/handler.rs
@@ -6,13 +6,13 @@
  * LICENSE-AGPL for a copy of the license.
  */
 
-use crate::types::{StandardTriggerQuery, TriggerData, TriggerMode};
+use crate::types::{HasPath, StandardTriggerQuery, TriggerData, TriggerMode};
 use async_trait::async_trait;
 use serde::{de::DeserializeOwned, Deserialize, Serialize};
 use sql_builder::{bind::Bind, SqlBuilder};
 use sqlx::{FromRow, PgConnection};
 use std::fmt::Debug;
-use windmill_api_auth::{check_scopes, ApiAuthed};
+use windmill_api_auth::{build_scope_path_predicate, check_scopes, ApiAuthed};
 use windmill_common::{
     db::UserDB,
     error::{Error, JsonResult, Result},
@@ -65,6 +65,8 @@ pub trait TriggerCrud: Send + Sync + 'static {
         + Send
         + Sync
         + Unpin
+        // Path accessor so `list_triggers` can apply scoped-token filtering.
+        + HasPath
         // `'static` so the deployed trigger can be boxed into
         // `WithDraftOverlay`'s erased-serde inner (it's an owned row).
         + 'static;
@@ -662,6 +664,9 @@ async fn list_triggers<T: TriggerCrud>(
         }
     }
 
+    let allowed = build_scope_path_predicate(&authed, T::scope_domain_name(), "read");
+    triggers.retain(|t| allowed(t.trigger_path()));
+
     Ok(Json(triggers))
 }
 
@@ -715,6 +720,12 @@ async fn update_trigger<T: TriggerCrud>(
     Json(mut edit_trigger): Json<TriggerData<T::TriggerConfigRequest>>,
 ) -> Result<String> {
     let path = path.to_path();
+    // A scoped token must be allowed on both the existing path (URL) and the
+    // new path (body); checking only the latter would let it move a trigger it
+    // can't touch into its scope.
+    check_scopes(&authed, || {
+        format!("{}:write:{}", T::scope_domain_name(), &path)
+    })?;
     check_scopes(&authed, || {
         format!(
             "{}:write:{}",
diff --git a/backend/windmill-trigger/src/types.rs b/backend/windmill-trigger/src/types.rs
index 77d90bea20..dcf9a136be 100644
--- a/backend/windmill-trigger/src/types.rs
+++ b/backend/windmill-trigger/src/types.rs
@@ -102,6 +102,28 @@ where
     pub error_handling: TriggerErrorHandling,
 }
 
+/// Path accessor for the associated `Trigger` row type, so the shared list
+/// handler can apply scoped-token path filtering without knowing the concrete
+/// row shape. The `()` OSS stub returns "" (its endpoints 404 anyway).
+pub trait HasPath {
+    fn trigger_path(&self) -> &str;
+}
+
+impl<T> HasPath for Trigger<T>
+where
+    T: for<'r> FromRow<'r, sqlx::postgres::PgRow>,
+{
+    fn trigger_path(&self) -> &str {
+        &self.base.path
+    }
+}
+
+impl HasPath for () {
+    fn trigger_path(&self) -> &str {
+        ""
+    }
+}
+
 impl<T> FromRow<'_, sqlx::postgres::PgRow> for Trigger<T>
 where
     T: for<'r> FromRow<'r, sqlx::postgres::PgRow>,

From fd51d40f1254a206de1f38e59cc3dadce8e13aa5 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Tue, 21 Jul 2026 07:34:44 +0200
Subject: [PATCH 079/171] feat(pipelines): catalog declared measures and
 dimensions (#10190)

---
 ...d07f0f0519a31300e597776ad8b77130501d2.json |  63 +++
 ...e6dc47b9e448df2463b7980d689f5dedc39a2.json |  15 +
 ...b2fb39d4ab8278cd605219541d06837e974d2.json |  16 +
 ...378985f6e7a593361d1a185ed606db13d84d4.json |  20 +
 backend/Cargo.lock                            |   1 +
 ...0260720050649_data_metric_catalog.down.sql |   1 +
 .../20260720050649_data_metric_catalog.up.sql |  36 ++
 .../src/asset_parser.rs                       | 116 ++++++
 .../windmill-parser-sql-asset/src/lib.rs      |   5 +-
 .../windmill-parser/src/asset_parser.rs       | 287 +++++++++++++
 backend/windmill-api-auth/src/lib.rs          | 125 ++++++
 backend/windmill-api-auth/src/scopes.rs       |  26 ++
 backend/windmill-api-scripts/src/scripts.rs   |  27 ++
 .../src/data_metrics.rs                       | 204 ++++++++++
 backend/windmill-api-workspaces/src/lib.rs    |   1 +
 .../windmill-api-workspaces/src/workspaces.rs |  21 +
 backend/windmill-api/openapi.yaml             | 118 ++++++
 backend/windmill-api/src/lib.rs               |   4 +
 .../src/mcp/auto_generated_endpoints.rs       |  42 ++
 backend/windmill-api/src/token.rs             |  43 +-
 backend/windmill-common/Cargo.toml            |   1 +
 backend/windmill-common/src/data_metrics.rs   | 268 +++++++++++++
 backend/windmill-common/src/lib.rs            |   1 +
 .../windmill-common/src/schema_contracts.rs   | 214 +++++++++-
 docs/pipeline-metrics-layer.md                | 135 +++++++
 frontend/src/lib/components/EditorBar.svelte  |  46 +++
 frontend/src/lib/components/SqlRepl.svelte    |  26 +-
 .../assets/AssetGraph/schemaContracts.ts      |   5 +
 .../components/copilot/chat/pipeline/core.ts  |   3 +-
 frontend/src/lib/components/custom_ui.ts      |   1 +
 .../components/metrics/MetricsDrawer.svelte   | 378 ++++++++++++++++++
 .../lib/components/metrics/metricSql.test.ts  | 181 +++++++++
 .../src/lib/components/metrics/metricSql.ts   | 182 +++++++++
 frontend/src/lib/components/sqlDdl.test.ts    |  69 ++++
 frontend/src/lib/components/sqlDdl.ts         | 164 ++++++--
 frontend/src/lib/mcpEndpointTools.ts          |  42 ++
 36 files changed, 2853 insertions(+), 34 deletions(-)
 create mode 100644 backend/.sqlx/query-58a79f32f880c5ea0ee8821ca4ad07f0f0519a31300e597776ad8b77130501d2.json
 create mode 100644 backend/.sqlx/query-add9dcf335bf5d6a53fd6c77db1e6dc47b9e448df2463b7980d689f5dedc39a2.json
 create mode 100644 backend/.sqlx/query-cb792a399cc1a7eb67222380cc0b2fb39d4ab8278cd605219541d06837e974d2.json
 create mode 100644 backend/.sqlx/query-dcfbbe009dccc40249bbab1e6ae378985f6e7a593361d1a185ed606db13d84d4.json
 create mode 100644 backend/migrations/20260720050649_data_metric_catalog.down.sql
 create mode 100644 backend/migrations/20260720050649_data_metric_catalog.up.sql
 create mode 100644 backend/windmill-api-workspaces/src/data_metrics.rs
 create mode 100644 backend/windmill-common/src/data_metrics.rs
 create mode 100644 docs/pipeline-metrics-layer.md
 create mode 100644 frontend/src/lib/components/metrics/MetricsDrawer.svelte
 create mode 100644 frontend/src/lib/components/metrics/metricSql.test.ts
 create mode 100644 frontend/src/lib/components/metrics/metricSql.ts
 create mode 100644 frontend/src/lib/components/sqlDdl.test.ts

diff --git a/backend/.sqlx/query-58a79f32f880c5ea0ee8821ca4ad07f0f0519a31300e597776ad8b77130501d2.json b/backend/.sqlx/query-58a79f32f880c5ea0ee8821ca4ad07f0f0519a31300e597776ad8b77130501d2.json
new file mode 100644
index 0000000000..27596043f8
--- /dev/null
+++ b/backend/.sqlx/query-58a79f32f880c5ea0ee8821ca4ad07f0f0519a31300e597776ad8b77130501d2.json
@@ -0,0 +1,63 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT script_path, table_path, kind, name, expr, filter FROM data_metric dm WHERE dm.workspace_id = $1 AND ($2::text IS NULL OR dm.table_path = $2) AND ($3::text IS NULL OR dm.script_path = $3 OR dm.script_path LIKE $4) AND ($6::text IS NULL OR (dm.table_path, dm.kind, dm.name, dm.script_path) > ($6, $7, $8, $9)) AND ( $10 OR dm.script_path = ANY($11) OR EXISTS ( SELECT 1 FROM unnest($12::text[]) AS pfx WHERE dm.script_path = pfx OR left(dm.script_path, length(pfx) + 1) = pfx || '/' ) ) AND EXISTS ( SELECT 1 FROM script s WHERE s.workspace_id = dm.workspace_id AND s.path = dm.script_path AND s.archived = false AND s.deleted = false ) ORDER BY dm.table_path, dm.kind, dm.name, dm.script_path LIMIT $5",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "script_path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "table_path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "kind",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 3,
+        "name": "name",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 4,
+        "name": "expr",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 5,
+        "name": "filter",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text",
+        "Text",
+        "Int8",
+        "Text",
+        "Text",
+        "Text",
+        "Text",
+        "Bool",
+        "TextArray",
+        "TextArray"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      false,
+      false,
+      false,
+      true
+    ]
+  },
+  "hash": "58a79f32f880c5ea0ee8821ca4ad07f0f0519a31300e597776ad8b77130501d2"
+}
diff --git a/backend/.sqlx/query-add9dcf335bf5d6a53fd6c77db1e6dc47b9e448df2463b7980d689f5dedc39a2.json b/backend/.sqlx/query-add9dcf335bf5d6a53fd6c77db1e6dc47b9e448df2463b7980d689f5dedc39a2.json
new file mode 100644
index 0000000000..d005f170f2
--- /dev/null
+++ b/backend/.sqlx/query-add9dcf335bf5d6a53fd6c77db1e6dc47b9e448df2463b7980d689f5dedc39a2.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO data_metric (workspace_id, script_path, table_path, kind, name, expr, filter)\n         SELECT $2, script_path, table_path, kind, name, expr, filter\n         FROM data_metric WHERE workspace_id = $1",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Varchar"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "add9dcf335bf5d6a53fd6c77db1e6dc47b9e448df2463b7980d689f5dedc39a2"
+}
diff --git a/backend/.sqlx/query-cb792a399cc1a7eb67222380cc0b2fb39d4ab8278cd605219541d06837e974d2.json b/backend/.sqlx/query-cb792a399cc1a7eb67222380cc0b2fb39d4ab8278cd605219541d06837e974d2.json
new file mode 100644
index 0000000000..756e94cb41
--- /dev/null
+++ b/backend/.sqlx/query-cb792a399cc1a7eb67222380cc0b2fb39d4ab8278cd605219541d06837e974d2.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM data_metric WHERE workspace_id = $1 AND (script_path = $2 OR script_path = $3)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "cb792a399cc1a7eb67222380cc0b2fb39d4ab8278cd605219541d06837e974d2"
+}
diff --git a/backend/.sqlx/query-dcfbbe009dccc40249bbab1e6ae378985f6e7a593361d1a185ed606db13d84d4.json b/backend/.sqlx/query-dcfbbe009dccc40249bbab1e6ae378985f6e7a593361d1a185ed606db13d84d4.json
new file mode 100644
index 0000000000..23ab7ae78a
--- /dev/null
+++ b/backend/.sqlx/query-dcfbbe009dccc40249bbab1e6ae378985f6e7a593361d1a185ed606db13d84d4.json
@@ -0,0 +1,20 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO data_metric (workspace_id, script_path, table_path, kind, name, expr, filter) SELECT $1, $2, $3, k, n, e, f FROM UNNEST($4::text[], $5::text[], $6::text[], $7::text[]) AS t(k, n, e, f)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "TextArray",
+        "TextArray",
+        "TextArray",
+        "TextArray"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "dcfbbe009dccc40249bbab1e6ae378985f6e7a593361d1a185ed606db13d84d4"
+}
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index d909f7da22..0bed7274d7 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -14754,6 +14754,7 @@ dependencies = [
  "windmill-parser",
  "windmill-parser-py",
  "windmill-parser-sql",
+ "windmill-parser-sql-asset",
  "windmill-parser-ts",
  "windmill-types",
 ]
diff --git a/backend/migrations/20260720050649_data_metric_catalog.down.sql b/backend/migrations/20260720050649_data_metric_catalog.down.sql
new file mode 100644
index 0000000000..91227d6a13
--- /dev/null
+++ b/backend/migrations/20260720050649_data_metric_catalog.down.sql
@@ -0,0 +1 @@
+DROP TABLE IF EXISTS data_metric;
diff --git a/backend/migrations/20260720050649_data_metric_catalog.up.sql b/backend/migrations/20260720050649_data_metric_catalog.up.sql
new file mode 100644
index 0000000000..3f701eafca
--- /dev/null
+++ b/backend/migrations/20260720050649_data_metric_catalog.up.sql
@@ -0,0 +1,36 @@
+-- Catalog of `// measure` / `// dimension` declarations, one row per declaration,
+-- synced from the producing script's annotations on deploy. Persisted (rather than
+-- parsed from script content on demand) so folder-scoped listing is an index range
+-- scan instead of a scan over every script body in the folder.
+CREATE TABLE data_metric (
+    workspace_id VARCHAR(50) NOT NULL REFERENCES workspace (id) ON UPDATE CASCADE ON DELETE CASCADE,
+    -- The producing script. Also the permission anchor: ducklake table paths have
+    -- no folder to authorize against, so reads are filtered on this.
+    script_path VARCHAR(510) NOT NULL,
+    table_path VARCHAR(510) NOT NULL,
+    kind VARCHAR(16) NOT NULL CHECK (kind IN ('measure', 'dimension')),
+    name VARCHAR(255) NOT NULL,
+    expr TEXT NOT NULL,
+    filter TEXT,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    PRIMARY KEY (workspace_id, script_path, kind, name)
+);
+
+-- "what does this table declare?" for the script editor drawer.
+CREATE INDEX idx_data_metric_table ON data_metric (workspace_id, table_path);
+
+-- Sort order for the listing endpoint's `ORDER BY table_path, kind, name,
+-- script_path`, so each keyset page is an ordered index range scan resuming from
+-- the previous page's last row rather than re-sorting the catalog every request.
+CREATE INDEX idx_data_metric_page ON data_metric (workspace_id, table_path, kind, name, script_path);
+
+-- "what is declared under this folder?" for the agent tool. text_pattern_ops so a
+-- `LIKE 'f/folder/%'` prefix is a range scan: this database's collation is not C,
+-- and under a locale collation the planner will not use a default-opclass index
+-- for prefix matching.
+CREATE INDEX idx_data_metric_folder ON data_metric (workspace_id, script_path text_pattern_ops);
+
+-- Written on user_db transactions (SET LOCAL ROLE); the one-time GRANT ALL
+-- migration predates this table, so explicit grants are required.
+GRANT ALL ON data_metric TO windmill_user;
+GRANT ALL ON data_metric TO windmill_admin;
diff --git a/backend/parsers/windmill-parser-sql-asset/src/asset_parser.rs b/backend/parsers/windmill-parser-sql-asset/src/asset_parser.rs
index d2ab5b51a7..4b523d5792 100644
--- a/backend/parsers/windmill-parser-sql-asset/src/asset_parser.rs
+++ b/backend/parsers/windmill-parser-sql-asset/src/asset_parser.rs
@@ -730,6 +730,122 @@ impl Visitor for ColumnIdentCollector {
     }
 }
 
+/// Extract the column names a bare SQL expression reads, for validating a
+/// metric measure/dimension body against a captured schema. Parses `expr_sql` as
+/// a standalone expression (so its identifiers sit at query depth 0, unlike a
+/// wrapped `SELECT`) and returns the final segment of each identifier ref:
+/// `sum(amount)` → `["amount"]`, `date_trunc('month', ordered_at)` →
+/// `["ordered_at"]`, `t.amount` → `["amount"]`, `count(*)` → `[]`. A parse
+/// failure yields an empty vec (fail-safe: nothing to check, not a spurious
+/// error), matching the fail-soft stance of the rest of the contract machinery.
+pub fn extract_expr_column_idents(expr_sql: &str) -> Vec<String> {
+    let Ok(mut parser) = Parser::new(&DuckDbDialect).try_with_sql(expr_sql) else {
+        return Vec::new();
+    };
+    let Ok(expr) = parser.parse_expr() else {
+        return Vec::new();
+    };
+    let mut collector = ColumnIdentCollector { refs: Vec::new(), query_depth: 0 };
+    let _ = expr.visit(&mut collector);
+    collector
+        .refs
+        .into_iter()
+        .filter_map(|parts| parts.last().cloned())
+        .collect()
+}
+
+/// Whether `expr_sql` is exactly one SQL expression, consuming all of its input.
+///
+/// Metric declarations are author text interpolated verbatim into executable SQL
+/// that a *reader* then runs. Without this, `count(*) FROM t; DELETE FROM x; SELECT 1`
+/// would be stored as a "measure" and execute as whoever opened the drawer, so a
+/// declaration that does not parse as a single trailing-token-free expression is
+/// rejected at deploy rather than filtered at render time.
+pub fn is_single_sql_expression(expr_sql: &str) -> bool {
+    use sqlparser::tokenizer::{Token, Tokenizer};
+    // Reject comment tokens outright: the parser skips them, so `sum(x) --rest`
+    // would pass the EOF check below, and a comment interpolated into the composed
+    // SQL can blank the rest of its line (defense in depth — it cannot inject a
+    // second statement, but a declaration has no business carrying a comment).
+    match Tokenizer::new(&DuckDbDialect, expr_sql).tokenize() {
+        Ok(tokens) => {
+            if tokens.iter().any(|t| {
+                matches!(t, Token::Whitespace(w)
+                if matches!(w, sqlparser::tokenizer::Whitespace::SingleLineComment { .. }
+                    | sqlparser::tokenizer::Whitespace::MultiLineComment(_)))
+            }) {
+                return false;
+            }
+        }
+        Err(_) => return false,
+    }
+    let Ok(mut parser) = Parser::new(&DuckDbDialect).try_with_sql(expr_sql) else {
+        return false;
+    };
+    if parser.parse_expr().is_err() {
+        return false;
+    }
+    // Anything left over means the expression ended early and the rest would ride
+    // along into the generated statement.
+    matches!(parser.peek_token().token, Token::EOF)
+}
+
+struct FunctionCallFinder {
+    found: bool,
+}
+
+impl Visitor for FunctionCallFinder {
+    type Break = ();
+    fn pre_visit_expr(&mut self, expr: &Expr) -> std::ops::ControlFlow<()> {
+        if matches!(expr, Expr::Function(_)) {
+            self.found = true;
+            return std::ops::ControlFlow::Break(());
+        }
+        std::ops::ControlFlow::Continue(())
+    }
+}
+
+/// Whether `expr_sql` could be an aggregation. Every SQL aggregate is a function
+/// call (`sum(x)`, `count(*)`, a scalar subquery wrapping one, a user-defined
+/// aggregate), so an expression with *no* function call anywhere provably cannot
+/// aggregate: `revenue = amount` or `amount * 2` is a row-level value, not a
+/// measure. Deliberately lenient — any function call earns the benefit of the
+/// doubt — to avoid maintaining a reserved aggregate-name list, which drifts with
+/// DuckDB versions. A parse failure returns `true` (not our error to raise here;
+/// `is_single_sql_expression` already rejects unparseable declarations).
+pub fn measure_expr_may_aggregate(expr_sql: &str) -> bool {
+    let Ok(mut parser) = Parser::new(&DuckDbDialect).try_with_sql(expr_sql) else {
+        return true;
+    };
+    let Ok(expr) = parser.parse_expr() else {
+        return true;
+    };
+    let mut finder = FunctionCallFinder { found: false };
+    let _ = expr.visit(&mut finder);
+    finder.found
+}
+
+/// Whether `expr_sql` is exactly one top-level function call, e.g. `sum(amount)`
+/// or `count(*)` — but not `sum(a) / count(b)` or `sum(a) + 1`.
+///
+/// A `// measure … where <pred>` compiles to `<expr> FILTER (WHERE <pred>)`, and
+/// SQL binds `FILTER` to the single immediately-preceding aggregate call. If the
+/// expression is a composite of several aggregates, the filter silently applies to
+/// only the last one and the canonical number is wrong. Requiring one call makes
+/// the target of `FILTER` unambiguous. (A single *non-aggregate* call still errors
+/// loudly at run time, which is acceptable — the danger is the silent case.)
+pub fn is_single_function_call(expr_sql: &str) -> bool {
+    let Ok(mut parser) = Parser::new(&DuckDbDialect).try_with_sql(expr_sql) else {
+        return false;
+    };
+    match parser.parse_expr() {
+        Ok(Expr::Function(_)) => {
+            matches!(parser.peek_token().token, sqlparser::tokenizer::Token::EOF)
+        }
+        _ => false,
+    }
+}
+
 impl Visitor for AssetCollector {
     type Break = ();
 
diff --git a/backend/parsers/windmill-parser-sql-asset/src/lib.rs b/backend/parsers/windmill-parser-sql-asset/src/lib.rs
index 65d8242a80..667cb16b38 100644
--- a/backend/parsers/windmill-parser-sql-asset/src/lib.rs
+++ b/backend/parsers/windmill-parser-sql-asset/src/lib.rs
@@ -1,4 +1,7 @@
 mod asset_parser;
 mod asset_parser_utils;
-pub use asset_parser::parse_assets;
+pub use asset_parser::{
+    extract_expr_column_idents, is_single_function_call, is_single_sql_expression,
+    measure_expr_may_aggregate, parse_assets,
+};
 pub use asset_parser_utils::parse_wmill_sdk_sql_assets;
diff --git a/backend/parsers/windmill-parser/src/asset_parser.rs b/backend/parsers/windmill-parser/src/asset_parser.rs
index bdce9ec764..4cf0c22a41 100644
--- a/backend/parsers/windmill-parser/src/asset_parser.rs
+++ b/backend/parsers/windmill-parser/src/asset_parser.rs
@@ -124,6 +124,15 @@ pub struct ParseAssetsOutput {
     // column-lineage graph view, executes nothing.
     #[serde(skip_serializing_if = "Vec::is_empty", default)]
     pub column_lineage: Vec<ColumnLineage>,
+    // `// measure <name> = <agg> [where <pred>]` — table-scoped aggregations of
+    // the produced asset. Accumulating, deduped by name. Catalogued at deploy;
+    // executes nothing.
+    #[serde(skip_serializing_if = "Vec::is_empty", default)]
+    pub measures: Vec<Measure>,
+    // `// dimension <name> = <expr>` — table-scoped slicers any measure can be
+    // grouped by. Accumulating, deduped by name.
+    #[serde(skip_serializing_if = "Vec::is_empty", default)]
+    pub dimensions: Vec<Dimension>,
     // Bare `// macros` (must be alone on the line, like `// pipeline`) —
     // marks this DuckDB script as a workspace *macro library*: its body is
     // CREATE [OR REPLACE] MACRO statements (plus plain setup) registered at
@@ -493,6 +502,34 @@ pub struct ColumnRef {
     pub from_column: String,
 }
 
+// The two table-scoped metric primitives, declared on the script that
+// materializes the table (`docs/pipeline-metrics-layer.md`). A *measure* is an
+// aggregation; a *dimension* is a slicer. Table-scoped, not per-measure: a
+// dimension belongs to the table, so every measure can be sliced by every
+// dimension. Metadata only: these are catalogued at deploy and read back by
+// editors and agents, which write their own SQL. Names are validated at deploy
+// against the producer's captured schema, the same machinery as `// column`.
+#[derive(Serialize, Debug, PartialEq, Clone)]
+pub struct Measure {
+    pub name: String,
+    // Aggregate SQL over the table's columns (`sum(amount)`). Trusted author text.
+    pub expr: String,
+    // Optional row predicate from a trailing `where`. Kept separate from `expr`
+    // so a reader can render it as an aggregate `FILTER (WHERE …)`, letting two
+    // measures with different filters share one GROUP BY (a shared `WHERE`
+    // cannot express that).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub filter: Option<String>,
+}
+
+#[derive(Serialize, Debug, PartialEq, Clone)]
+pub struct Dimension {
+    pub name: String,
+    // Slicing expression over the table's columns (`region`,
+    // `date_trunc('month', ordered_at)`). Trusted author text.
+    pub expr: String,
+}
+
 // `// trigger any` (default) vs `// trigger all`. `Any` = OR: any trigger
 // firing runs the script (current behaviour). `All` = AND: the script
 // runs only once every partition-bearing input has materialized at the
@@ -526,6 +563,8 @@ pub struct PipelineAnnotations {
     pub materialize: Option<MaterializeSpec>,
     pub data_tests: Vec<DataTest>,
     pub column_lineage: Vec<ColumnLineage>,
+    pub measures: Vec<Measure>,
+    pub dimensions: Vec<Dimension>,
     pub macros: bool,
     pub use_libs: Vec<String>,
     // `// mute <asset>` — suppress the auto-derived cascade edge for a read
@@ -564,6 +603,8 @@ impl ParseAssetsOutput {
             materialize: pipeline.materialize,
             data_tests: pipeline.data_tests,
             column_lineage: pipeline.column_lineage,
+            measures: pipeline.measures,
+            dimensions: pipeline.dimensions,
             macros: pipeline.macros,
             use_libs: pipeline.use_libs,
         }
@@ -1006,6 +1047,28 @@ pub fn parse_pipeline_annotations(code: &str) -> PipelineAnnotations {
             continue;
         }
 
+        // `// measure <name> = <agg> [where <pred>]` / `// dimension <name> =
+        // <expr>` — metrics primitives. Complete words (checked before the
+        // `on`/asset shorthands), accumulating, deduped by name (first wins).
+        // Malformed lines drop fail-safe like the rest of the annotation family.
+        if let Some(after_kw) = consume_keyword(rest, "measure") {
+            if let Some(spec) = parse_measure_spec(after_kw.trim()) {
+                if !out.measures.iter().any(|m| m.name == spec.name) {
+                    out.measures.push(spec);
+                }
+            }
+            continue;
+        }
+
+        if let Some(after_kw) = consume_keyword(rest, "dimension") {
+            if let Some(spec) = parse_dimension_spec(after_kw.trim()) {
+                if !out.dimensions.iter().any(|d| d.name == spec.name) {
+                    out.dimensions.push(spec);
+                }
+            }
+            continue;
+        }
+
         if let Some(after_kw) = consume_keyword(rest, "on") {
             let spec_text = after_kw.trim();
             if spec_text.is_empty() {
@@ -1066,6 +1129,42 @@ pub fn count_malformed_data_tests(code: &str) -> usize {
     malformed
 }
 
+// Count `// measure` / `// dimension` header lines whose right-hand side fails
+// to parse, returning `(malformed_measures, malformed_dimensions)`. Same
+// fail-safe drop as the rest of the family (a typo silently omits the metric),
+// so the deploy path warns off this count. Same leading-block boundary and
+// grammar as `parse_pipeline_annotations`, so "malformed" means exactly what the
+// parser rejects.
+pub fn count_malformed_metric_annotations(code: &str) -> (usize, usize) {
+    let (mut measures, mut dimensions) = (0, 0);
+    for raw_line in code.lines() {
+        let line = raw_line.trim_start();
+        if line.is_empty() {
+            continue;
+        }
+        let rest = if let Some(r) = line.strip_prefix("//") {
+            r
+        } else if let Some(r) = line.strip_prefix("--") {
+            r
+        } else if let Some(r) = line.strip_prefix('#') {
+            r
+        } else {
+            break;
+        };
+        let rest = rest.trim_start();
+        if let Some(after_kw) = consume_keyword(rest, "measure") {
+            if parse_measure_spec(after_kw.trim()).is_none() {
+                measures += 1;
+            }
+        } else if let Some(after_kw) = consume_keyword(rest, "dimension") {
+            if parse_dimension_spec(after_kw.trim()).is_none() {
+                dimensions += 1;
+            }
+        }
+    }
+    (measures, dimensions)
+}
+
 // Parse a `// retry <count> [<delay>]` right-hand side. `<count>` is a
 // non-negative decimal; `<delay>` is an optional raw duration string left
 // for `parse_duration_secs` to validate at deploy. A bare zero count (or
@@ -1268,6 +1367,104 @@ fn parse_column_lineage_spec(s: &str) -> Option<ColumnLineage> {
     Some(ColumnLineage { column, inputs })
 }
 
+// `// measure <name> = <agg> [where <pred>]`. The name is a single identifier;
+// the first `=` separates it from the body (SQL comparison operators live after
+// it, so splitting on the first `=` is unambiguous). A whitespace-bounded
+// ` where ` splits the aggregate from its row filter — a `where` buried in a
+// string literal or subquery would mis-split, at which point the compiled SQL
+// fails at DuckDB parse (fail-loud, not silently wrong). An empty aggregate is
+// rejected. Modifier metadata (format/label/additivity) is deferred: `|` and
+// `||` are valid SQL operators, so a modifier delimiter must not collide with a
+// measure body — that grammar is chosen when the explorer needs the fields.
+fn parse_measure_spec(s: &str) -> Option<Measure> {
+    let (name_part, body) = s.split_once('=')?;
+    let name = single_ident(name_part)?;
+    let (expr, filter) = split_measure_filter(body.trim());
+    let expr = expr.trim();
+    // A bare trailing `where` with no predicate is a typo, not an unfiltered
+    // measure: reject the whole line (counted malformed) rather than emit
+    // `sum(amount) where` as the expression.
+    if expr.is_empty() || matches!(&filter, Some(f) if f.is_empty()) {
+        return None;
+    }
+    Some(Measure { name, expr: expr.to_string(), filter })
+}
+
+// `// dimension <name> = <expr>`. Name is a single identifier; the expression is
+// trusted SQL emitted verbatim into SELECT and GROUP BY. No filter clause.
+fn parse_dimension_spec(s: &str) -> Option<Dimension> {
+    let (name_part, expr) = s.split_once('=')?;
+    let name = single_ident(name_part)?;
+    let expr = expr.trim();
+    if expr.is_empty() {
+        return None;
+    }
+    Some(Dimension { name, expr: expr.to_string() })
+}
+
+// Split a measure body on the first top-level whitespace-bounded ` where` into
+// (aggregate, filter). "Top-level" = outside string/quoted-identifier literals and
+// outside parentheses, so `count_if(note = 'some where value')` is not split on the
+// `where` buried in its string. `to_ascii_lowercase` is byte-length-preserving, so
+// an offset in the lowercased copy indexes the original; the predicate keeps its
+// source casing. A trailing ` where` yields an empty predicate, which the caller
+// rejects, so `sum(amount) where` is not read as a filterless aggregate.
+fn split_measure_filter(body: &str) -> (&str, Option<String>) {
+    // Byte scan, comparing on the ASCII-lowercased bytes: `to_ascii_lowercase` is
+    // byte-length-preserving, and byte-slice matching never panics on a non-UTF-8
+    // boundary the way `lower[i..]` would for a non-ASCII body (`sum(x) + π`).
+    let lower = body.to_ascii_lowercase();
+    let lb = lower.as_bytes();
+    let b = body.as_bytes();
+    let (mut in_single, mut in_double) = (false, false);
+    let mut depth: i32 = 0;
+    let mut i = 0usize;
+    while i < b.len() {
+        let c = b[i];
+        if in_single {
+            if c == b'\'' {
+                // A doubled quote is an escaped one, not the end.
+                if b.get(i + 1) == Some(&b'\'') {
+                    i += 2;
+                    continue;
+                }
+                in_single = false;
+            }
+            i += 1;
+            continue;
+        }
+        if in_double {
+            if c == b'"' {
+                if b.get(i + 1) == Some(&b'"') {
+                    i += 2;
+                    continue;
+                }
+                in_double = false;
+            }
+            i += 1;
+            continue;
+        }
+        match c {
+            b'\'' => in_single = true,
+            b'"' => in_double = true,
+            b'(' => depth += 1,
+            b')' => depth -= 1,
+            _ if depth == 0 && lb[i..].starts_with(b" where") => {
+                let after = i + b" where".len();
+                // Whitespace-bounded: end of input, or a space follows (so a token
+                // like ` wherever` is not matched). `i` is the space before `where`
+                // and `after` is just past it — both ASCII, so the slices are valid.
+                if after == b.len() || b[after].is_ascii_whitespace() {
+                    return (&body[..i], Some(body[after..].trim().to_string()));
+                }
+            }
+            _ => {}
+        }
+        i += 1;
+    }
+    (body, None)
+}
+
 // `<asset-uri>.<col>` — the referenced column is the segment after the final
 // `.`; everything before it is the asset URI (default-syntax shorthands
 // enabled, like `// materialize`). Same shape as `parse_relationships`' target.
@@ -1472,6 +1669,96 @@ mod pipeline_annotation_tests {
         assert!(!parse_pipeline_annotations("// macros_v2\n").macros);
     }
 
+    #[test]
+    fn measures_and_dimensions_parse() {
+        let out = parse_pipeline_annotations(
+            "-- materialize ducklake://f/finance/orders\n\
+             -- measure revenue = sum(amount) where not is_refund\n\
+             -- measure orders  = count(*)\n\
+             -- dimension region = region\n\
+             -- dimension month  = date_trunc('month', ordered_at)\n\
+             SELECT 1;",
+        );
+        assert_eq!(
+            out.measures,
+            vec![
+                Measure {
+                    name: "revenue".to_string(),
+                    expr: "sum(amount)".to_string(),
+                    filter: Some("not is_refund".to_string()),
+                },
+                Measure { name: "orders".to_string(), expr: "count(*)".to_string(), filter: None },
+            ]
+        );
+        assert_eq!(
+            out.dimensions,
+            vec![
+                Dimension { name: "region".to_string(), expr: "region".to_string() },
+                Dimension {
+                    name: "month".to_string(),
+                    expr: "date_trunc('month', ordered_at)".to_string(),
+                },
+            ]
+        );
+    }
+
+    #[test]
+    fn a_where_inside_a_string_or_parens_is_not_a_filter_delimiter() {
+        // The `where` is inside the aggregate's string argument, so the whole
+        // expression is the measure and there is no filter.
+        assert_eq!(
+            split_measure_filter("count_if(note = 'some where value')"),
+            ("count_if(note = 'some where value')", None)
+        );
+        // A real top-level filter still splits.
+        assert_eq!(
+            split_measure_filter("sum(amount) where not is_refund"),
+            ("sum(amount)", Some("not is_refund".to_string()))
+        );
+        // A `where` inside parens is not the delimiter either.
+        assert_eq!(
+            split_measure_filter("sum(case when x then 1 end)"),
+            ("sum(case when x then 1 end)", None)
+        );
+        // A non-ASCII body must not panic on a byte offset that is not a char
+        // boundary.
+        assert_eq!(split_measure_filter("sum(amount) + π"), ("sum(amount) + π", None));
+        assert_eq!(
+            split_measure_filter("sum(π) where region = 'π'"),
+            ("sum(π)", Some("region = 'π'".to_string()))
+        );
+    }
+
+    #[test]
+    fn measures_dimensions_fail_safe_and_dedup() {
+        let out = parse_pipeline_annotations(
+            // Malformed (no `=`, empty body, bare trailing `where`) drop; a
+            // duplicate name keeps the first; the body comment after real code
+            // is never scanned.
+            "-- measure broken\n\
+             -- measure empty =   \n\
+             -- measure dangling = sum(amount) where\n\
+             -- measure revenue = sum(amount)\n\
+             -- measure revenue = sum(other)\n\
+             -- dimension region = region\n\
+             SELECT 1;\n\
+             -- measure sneaky = count(*)\n\
+             -- dimension sneaky = x",
+        );
+        assert_eq!(
+            out.measures,
+            vec![Measure {
+                name: "revenue".to_string(),
+                expr: "sum(amount)".to_string(),
+                filter: None,
+            }]
+        );
+        assert_eq!(
+            out.dimensions,
+            vec![Dimension { name: "region".to_string(), expr: "region".to_string() }]
+        );
+    }
+
     #[test]
     fn use_accumulates_dedups_and_rejects_prose() {
         let out = parse_pipeline_annotations(
diff --git a/backend/windmill-api-auth/src/lib.rs b/backend/windmill-api-auth/src/lib.rs
index 25f572d8ae..961f88d547 100644
--- a/backend/windmill-api-auth/src/lib.rs
+++ b/backend/windmill-api-auth/src/lib.rs
@@ -502,6 +502,89 @@ pub fn build_scope_path_predicate(
     }
 }
 
+/// The same `domain:action` path grant as [`build_scope_path_predicate`], decomposed
+/// into what a SQL `WHERE` clause needs so the filtering happens IN the query.
+///
+/// Filtering in SQL rather than dropping rows after the fetch is mandatory wherever
+/// the result is paginated: a post-fetch filter makes a page's size — and any
+/// continuation cursor derived from it — reveal the count of rows the caller cannot
+/// see. `ScopePathFilter::allows` mirrors the emitted SQL, and a cross-check test
+/// pins both to the predicate.
+pub enum ScopePathFilter {
+    /// Unscoped token, or a grant that covers every path: no restriction.
+    AllowAll,
+    /// A path is granted iff it equals an `exact` entry or sits at or under a
+    /// `prefix` (from a `prefix/*` grant, matched on the `/` boundary). Both empty
+    /// grants nothing.
+    Restricted { exact: Vec<String>, prefix: Vec<String> },
+}
+
+impl ScopePathFilter {
+    /// Whether `path` is granted. Mirrors the SQL a caller builds from this filter,
+    /// and the matching rule in `resource_matches_pattern`.
+    pub fn allows(&self, path: &str) -> bool {
+        match self {
+            ScopePathFilter::AllowAll => true,
+            ScopePathFilter::Restricted { exact, prefix } => {
+                exact.iter().any(|e| e == path)
+                    || prefix.iter().any(|p| {
+                        path == p || path.strip_prefix(p).is_some_and(|r| r.starts_with('/'))
+                    })
+            }
+        }
+    }
+}
+
+/// Restrictions equivalent to `build_scope_path_predicate(authed, domain, action)`,
+/// but pushable into SQL. See [`ScopePathFilter`]. Not for `jobs:run` scopes (whose
+/// `kind` dimension this ignores), matching the predicate's path-domain use.
+pub fn build_scope_path_filter(authed: &ApiAuthed, domain: &str, action: &str) -> ScopePathFilter {
+    let (is_scoped_token, parsed): (bool, Vec<ScopeDefinition>) = match authed.scopes.as_ref() {
+        Some(scopes) => {
+            let mut is_scoped = false;
+            let parsed = scopes
+                .iter()
+                .filter(|s| !s.starts_with("if_jobs:filter_tags:"))
+                .inspect(|_| is_scoped = true)
+                .filter_map(|s| ScopeDefinition::from_scope_string(s).ok())
+                .collect();
+            (is_scoped, parsed)
+        }
+        None => (false, Vec::new()),
+    };
+    if !is_scoped_token {
+        return ScopePathFilter::AllowAll;
+    }
+    let mut exact = Vec::new();
+    let mut prefix = Vec::new();
+    for s in &parsed {
+        if s.domain != domain {
+            continue;
+        }
+        // `write` covers `read`, mirroring ScopeDefinition::includes' action rule.
+        if !(s.action == action || (s.action == "write" && action == "read")) {
+            continue;
+        }
+        match &s.resource {
+            // A domain:action scope with no path part grants every path.
+            None => return ScopePathFilter::AllowAll,
+            Some(resources) => {
+                for r in resources {
+                    // `*` grants every path (resources_match's wildcard short-circuit).
+                    if r == "*" {
+                        return ScopePathFilter::AllowAll;
+                    }
+                    match r.strip_suffix("/*") {
+                        Some(p) => prefix.push(p.to_string()),
+                        None => exact.push(r.clone()),
+                    }
+                }
+            }
+        }
+    }
+    ScopePathFilter::Restricted { exact, prefix }
+}
+
 pub async fn require_devops_role(db: &DB, email: &str) -> error::Result<()> {
     let is_devops = is_devops_email(db, email).await?;
 
@@ -1211,6 +1294,48 @@ mod tests {
         assert!(!allowed("u/alice/bar"));
     }
 
+    // The SQL-pushable filter must grant exactly what the post-fetch predicate does:
+    // any divergence either leaks/over-grants (filter looser) or hides authorized
+    // rows (filter tighter). Cross-check both over a matrix of scope sets and paths.
+    #[test]
+    fn scope_path_filter_agrees_with_predicate() {
+        let scope_sets: Vec<Option<Vec<&str>>> = vec![
+            None,
+            Some(vec![]),
+            Some(vec!["if_jobs:filter_tags:default"]),
+            Some(vec!["resources:read"]),
+            Some(vec!["resources:read:*"]),
+            Some(vec!["resources:read:u/alice/foo"]),
+            Some(vec!["resources:read:f/team/*"]),
+            Some(vec!["resources:write:f/team/*"]),
+            Some(vec!["resources:read:u/alice/foo,f/team/*"]),
+            Some(vec!["variables:read:f/team/*"]),
+            Some(vec!["resources:read:f/team", "resources:read:f/team2/*"]),
+        ];
+        let paths = [
+            "u/alice/foo",
+            "u/alice/foobar",
+            "u/bob/foo",
+            "f/team",
+            "f/team/db",
+            "f/team/sub/nested",
+            "f/team2",
+            "f/other/db",
+        ];
+        for scopes in &scope_sets {
+            let authed = authed_with_scopes(scopes.clone());
+            let predicate = build_scope_path_predicate(&authed, "resources", "read");
+            let filter = build_scope_path_filter(&authed, "resources", "read");
+            for path in paths {
+                assert_eq!(
+                    filter.allows(path),
+                    predicate(path),
+                    "mismatch for scopes {scopes:?} path {path}"
+                );
+            }
+        }
+    }
+
     fn opt_scopes(scopes: Option<Vec<&str>>) -> Option<Vec<String>> {
         scopes.map(|v| v.into_iter().map(String::from).collect())
     }
diff --git a/backend/windmill-api-auth/src/scopes.rs b/backend/windmill-api-auth/src/scopes.rs
index 3c09185650..3b594fe79c 100644
--- a/backend/windmill-api-auth/src/scopes.rs
+++ b/backend/windmill-api-auth/src/scopes.rs
@@ -240,6 +240,10 @@ pub enum ScopeDomain {
     // Core resource domains
     Jobs,
     Scripts,
+    /// The `/data_metrics` catalog. Its own domain, NOT an alias of `Scripts`: a
+    /// `data_metrics:read` token must reach only this route, never the broader
+    /// `/scripts` routes (some of which do no further scope check).
+    DataMetrics,
     Flows,
     FlowConversations,
     Apps,
@@ -303,6 +307,7 @@ impl ScopeDomain {
         match self {
             Self::Jobs => "jobs",
             Self::Scripts => "scripts",
+            Self::DataMetrics => "data_metrics",
             Self::Flows => "flows",
             Self::FlowConversations => "flow_conversations",
             Self::Apps => "apps",
@@ -355,6 +360,9 @@ impl ScopeDomain {
         match s {
             "jobs" | "jobs_u" => Some(Self::Jobs),
             "scripts" => Some(Self::Scripts),
+            // A distinct domain, not an alias of `scripts` (see the enum variant):
+            // a `data_metrics:read` token must not reach the broader /scripts routes.
+            "data_metrics" => Some(Self::DataMetrics),
             "flows" => Some(Self::Flows),
             "flow_conversations" => Some(Self::FlowConversations),
             "apps" | "apps_u" => Some(Self::Apps),
@@ -987,6 +995,24 @@ mod tests {
         assert!(check_route_access(&scopes, "/api/w/test_workspace/jobs/123", "DELETE").is_err());
     }
 
+    #[test]
+    fn data_metrics_is_its_own_domain_not_a_scripts_alias() {
+        // `data_metrics` must be a distinct domain: a token scoped to it must reach
+        // only the data_metrics route, never the broader /scripts routes (some of
+        // which do no further scope check). Regression for a privilege escalation.
+        assert_eq!(
+            ScopeDomain::from_str("data_metrics"),
+            Some(ScopeDomain::DataMetrics)
+        );
+        let dm = vec!["data_metrics:read".to_string()];
+        assert!(check_route_access(&dm, "/api/w/test/data_metrics/list", "GET").is_ok());
+        assert!(check_route_access(&dm, "/api/w/test/scripts/list", "GET").is_err());
+        assert!(check_route_access(&dm, "/api/w/test/scripts/raw/h/abc.ts", "GET").is_err());
+        // Conversely a scripts token does not reach the data_metrics route.
+        let sc = vec!["scripts:read".to_string()];
+        assert!(check_route_access(&sc, "/api/w/test/data_metrics/list", "GET").is_err());
+    }
+
     #[test]
     fn test_new_domain_parsing() {
         // Test that new domains are properly parsed
diff --git a/backend/windmill-api-scripts/src/scripts.rs b/backend/windmill-api-scripts/src/scripts.rs
index 16ca652b07..64f997ff06 100644
--- a/backend/windmill-api-scripts/src/scripts.rs
+++ b/backend/windmill-api-scripts/src/scripts.rs
@@ -1347,6 +1347,18 @@ async fn create_script_internal<'c>(
             malformed_data_tests
         );
     }
+    let (malformed_measures, malformed_dimensions) =
+        windmill_parser::asset_parser::count_malformed_metric_annotations(&ns.content);
+    if malformed_measures > 0 || malformed_dimensions > 0 {
+        tracing::warn!(
+            "script {}: {} `// measure` and {} `// dimension` line(s) are malformed and were \
+             dropped. Fix the syntax (`measure <name> = <agg> [where <pred>]`, \
+             `dimension <name> = <expr>`).",
+            ns.path,
+            malformed_measures,
+            malformed_dimensions
+        );
+    }
     // `// macros` — this script is a workspace macro library: its body is
     // CREATE [OR REPLACE] MACRO statements plus plain setup, registered into
     // `macro_definition` and injected as TEMP macros into consumer jobs.
@@ -1677,6 +1689,19 @@ async fn create_script_internal<'c>(
         }
     }
 
+    // Metric catalog: replace this path's declared measures/dimensions wholesale,
+    // so the catalog always describes the deployed state. Runs for every language,
+    // not just DuckDB: a script that drops its declarations (or changes language,
+    // or is replaced at the same path) must clear its old rows.
+    windmill_common::data_metrics::sync_metric_catalog(
+        &mut *tx,
+        &w_id,
+        &ns.path,
+        old_path,
+        &ns.content,
+    )
+    .await?;
+
     if ns.language == ScriptLang::DuckDb {
         // Record this script's macro-call edges for the asset graph (the
         // worker re-detects calls live at job time, so these are display
@@ -4111,6 +4136,8 @@ async fn check_schema_contracts(
         &ann.column_lineage,
         &ann.data_tests,
         ann.materialize.as_ref(),
+        &ann.measures,
+        &ann.dimensions,
     )
     .await?;
     tx.commit().await?;
diff --git a/backend/windmill-api-workspaces/src/data_metrics.rs b/backend/windmill-api-workspaces/src/data_metrics.rs
new file mode 100644
index 0000000000..c19df4a808
--- /dev/null
+++ b/backend/windmill-api-workspaces/src/data_metrics.rs
@@ -0,0 +1,204 @@
+/*
+ * Author: Ruben Fiszel
+ * Copyright: Windmill Labs, Inc 2022
+ * This file and its contents are licensed under the AGPLv3 License.
+ * Please see the included NOTICE for copyright information and
+ * LICENSE-AGPL for a copy of the license.
+ */
+
+//! Read side of the metric catalog: what a DuckLake table declares (for the
+//! script editor drawer) and what is declared under a path prefix (for agents).
+
+use axum::{
+    extract::{Path, Query},
+    routing::get,
+    Extension, Json, Router,
+};
+use serde::{Deserialize, Serialize};
+use windmill_api_auth::{build_scope_path_filter, ApiAuthed, ScopePathFilter};
+use windmill_common::{
+    data_metrics::{canonical_table_path, MetricEntry},
+    db::UserDB,
+    error::{Error, JsonResult},
+};
+
+pub fn workspaced_service() -> Router {
+    Router::new().route("/list", get(list_metrics))
+}
+
+#[derive(Deserialize)]
+struct ListQuery {
+    /// `<lake>/<table>`, with or without the `ducklake://` scheme.
+    table: Option<String>,
+    /// Path prefix to scope to, e.g. `f/analytics`.
+    path_prefix: Option<String>,
+    /// Results per page, clamped to `MAX_PER_PAGE`. Defaults to `MAX_PER_PAGE`.
+    per_page: Option<i64>,
+    /// Keyset cursor: echo the previous response's `next_cursor` fields. All four
+    /// move together (they are the sort key); omit them for the first page.
+    cursor_table: Option<String>,
+    cursor_kind: Option<String>,
+    cursor_name: Option<String>,
+    cursor_script: Option<String>,
+}
+
+/// Position on the (table_path, kind, name, script_path) sort key. Only ever built
+/// from a row the caller received, so it never reveals a hidden row.
+#[derive(Serialize)]
+struct MetricCursor {
+    table_path: String,
+    kind: String,
+    name: String,
+    script_path: String,
+}
+
+/// One page. `next_cursor` present means more rows may follow (pass it back);
+/// absent means the catalog is exhausted.
+#[derive(Serialize)]
+struct MetricPage {
+    metrics: Vec<MetricEntry>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    next_cursor: Option<MetricCursor>,
+}
+
+/// Builds the descendant pattern for a path prefix, anchored to the `/` boundary
+/// so `f/analytics` does not also match `f/analytics2`. LIKE wildcards in the
+/// caller's own text are escaped, since an unescaped `%` or `_` would silently
+/// widen the scope past the path they asked for.
+fn descendants_of(prefix: &str) -> String {
+    let escaped = prefix
+        .replace('\\', "\\\\")
+        .replace('%', "\\%")
+        .replace('_', "\\_");
+    format!("{escaped}/%")
+}
+
+/// Largest page a caller may request; the caller pages with the keyset cursor.
+const MAX_PER_PAGE: i64 = 1000;
+
+/// Lists declared measures and dimensions, optionally narrowed to one table or to
+/// a producing script path prefix.
+async fn list_metrics(
+    authed: ApiAuthed,
+    Extension(user_db): Extension<UserDB>,
+    Path(w_id): Path<String>,
+    Query(q): Query<ListQuery>,
+) -> JsonResult<MetricPage> {
+    let table = q
+        .table
+        .as_deref()
+        .filter(|t| !t.is_empty())
+        .map(canonical_table_path);
+    // A prefix matches the path itself and everything beneath it, but not a
+    // sibling folder that merely starts with the same characters.
+    let prefix = q
+        .path_prefix
+        .as_deref()
+        .map(|p| p.trim_end_matches('/'))
+        .filter(|p| !p.is_empty())
+        .map(str::to_string);
+    let prefix_descendants = prefix.as_deref().map(descendants_of);
+
+    // The four cursor components are one value; a partial cursor would compare
+    // against a tuple with a NULL (matching nothing) or silently restart. Reject it.
+    let cursor_present = [
+        &q.cursor_table,
+        &q.cursor_kind,
+        &q.cursor_name,
+        &q.cursor_script,
+    ]
+    .iter()
+    .filter(|c| c.is_some())
+    .count();
+    if cursor_present != 0 && cursor_present != 4 {
+        return Err(Error::BadRequest(
+            "cursor_table, cursor_kind, cursor_name and cursor_script must be supplied together"
+                .to_string(),
+        ));
+    }
+
+    // RLS reflects the user's own permissions but says nothing about a token's path
+    // scopes, so a scoped token must be filtered separately. This route has its own
+    // `data_metrics` scope domain (not an alias of `scripts`, which would let a
+    // metrics token reach every /scripts route). The grant is anchored on the
+    // producing script's path, as with `list_macros`. It is pushed INTO the query,
+    // not applied after the fetch: with scope filtering in SQL every returned row is
+    // authorized, so the keyset cursor (the last returned row) can never name a row
+    // the caller cannot see, and a post-fetch filter would instead let the page size
+    // reveal the count of out-of-scope declarations under a table/prefix.
+    let (scope_all, scope_exact, scope_prefix) =
+        match build_scope_path_filter(&authed, "data_metrics", "read") {
+            ScopePathFilter::AllowAll => (true, Vec::new(), Vec::new()),
+            ScopePathFilter::Restricted { exact, prefix } => (false, exact, prefix),
+        };
+
+    let per_page = q.per_page.unwrap_or(MAX_PER_PAGE).clamp(1, MAX_PER_PAGE);
+
+    let mut tx = user_db.begin(&authed).await?;
+    // Keyset paging: continue strictly after the previous page's last row on the
+    // (table_path, kind, name, script_path) sort key, so total work over the whole
+    // catalog is linear (offset paging re-reads every prior page). One extra row is
+    // fetched to learn whether more remain without a second query.
+    //
+    // The EXISTS runs under `script`'s RLS on this authed connection, so a caller
+    // only sees declarations from producers they can read. `data_metric` itself has
+    // no RLS, so removing this predicate would expose every workspace metric.
+    // Archived/deleted versions are excluded, else a renamed producer keeps serving
+    // its old path's declarations. The token scope filter ($10 allow-all, else the
+    // path is a $11 exact grant or sits at/under a $12 `prefix/*` grant on the `/`
+    // boundary) mirrors `ScopePathFilter::allows`. The ORDER BY is a total order
+    // (script_path breaks ties on table/kind/name), so keyset windows can't skip or
+    // duplicate a row.
+    let mut rows = sqlx::query_as!(
+        MetricEntry,
+        "SELECT script_path, table_path, kind, name, expr, filter \
+         FROM data_metric dm \
+         WHERE dm.workspace_id = $1 \
+           AND ($2::text IS NULL OR dm.table_path = $2) \
+           AND ($3::text IS NULL OR dm.script_path = $3 OR dm.script_path LIKE $4) \
+           AND ($6::text IS NULL OR \
+                (dm.table_path, dm.kind, dm.name, dm.script_path) > ($6, $7, $8, $9)) \
+           AND ( $10 \
+                 OR dm.script_path = ANY($11) \
+                 OR EXISTS ( SELECT 1 FROM unnest($12::text[]) AS pfx \
+                             WHERE dm.script_path = pfx \
+                                OR left(dm.script_path, length(pfx) + 1) = pfx || '/' ) ) \
+           AND EXISTS ( \
+             SELECT 1 FROM script s \
+             WHERE s.workspace_id = dm.workspace_id AND s.path = dm.script_path \
+               AND s.archived = false AND s.deleted = false \
+           ) \
+         ORDER BY dm.table_path, dm.kind, dm.name, dm.script_path \
+         LIMIT $5",
+        &w_id,
+        table.as_deref(),
+        prefix.as_deref(),
+        prefix_descendants.as_deref(),
+        per_page + 1,
+        q.cursor_table.as_deref(),
+        q.cursor_kind.as_deref(),
+        q.cursor_name.as_deref(),
+        q.cursor_script.as_deref(),
+        scope_all,
+        &scope_exact[..],
+        &scope_prefix[..],
+    )
+    .fetch_all(&mut *tx)
+    .await?;
+    tx.commit().await?;
+
+    // The probe row proves more remain; drop it and hand back its predecessor as the
+    // cursor. Without it the page fit entirely, so there is no next page.
+    let next_cursor = if rows.len() as i64 > per_page {
+        rows.truncate(per_page as usize);
+        rows.last().map(|last| MetricCursor {
+            table_path: last.table_path.clone(),
+            kind: last.kind.clone(),
+            name: last.name.clone(),
+            script_path: last.script_path.clone(),
+        })
+    } else {
+        None
+    };
+    Ok(Json(MetricPage { metrics: rows, next_cursor }))
+}
diff --git a/backend/windmill-api-workspaces/src/lib.rs b/backend/windmill-api-workspaces/src/lib.rs
index c2b62d450b..017c9702a5 100644
--- a/backend/windmill-api-workspaces/src/lib.rs
+++ b/backend/windmill-api-workspaces/src/lib.rs
@@ -1,5 +1,6 @@
 pub mod datatable_migrations;
 pub mod deployment_requests;
+pub mod data_metrics;
 pub mod workspaces;
 pub mod workspaces_extra;
 pub mod workspaces_oss;
diff --git a/backend/windmill-api-workspaces/src/workspaces.rs b/backend/windmill-api-workspaces/src/workspaces.rs
index 3e862bd13a..83fdc51e38 100644
--- a/backend/windmill-api-workspaces/src/workspaces.rs
+++ b/backend/windmill-api-workspaces/src/workspaces.rs
@@ -4942,6 +4942,7 @@ async fn clone_workspace_data(
     // Clone CI test references
     clone_ci_test_references(tx, source_workspace_id, target_workspace_id).await?;
     clone_macro_registry(tx, source_workspace_id, target_workspace_id).await?;
+    clone_metric_catalog(tx, source_workspace_id, target_workspace_id).await?;
     clone_asset_usages_and_triggers(tx, source_workspace_id, target_workspace_id).await?;
 
     // Clone flows with new versions
@@ -5597,6 +5598,26 @@ async fn clone_macro_registry(
     Ok(())
 }
 
+// Declared measures/dimensions are deploy-derived like the macro registry:
+// without cloning them the fork's editor and agent tools report no metrics until
+// every producer is manually redeployed there.
+async fn clone_metric_catalog(
+    tx: &mut Transaction<'_, Postgres>,
+    source_workspace_id: &str,
+    target_workspace_id: &str,
+) -> Result<()> {
+    sqlx::query!(
+        "INSERT INTO data_metric (workspace_id, script_path, table_path, kind, name, expr, filter)
+         SELECT $2, script_path, table_path, kind, name, expr, filter
+         FROM data_metric WHERE workspace_id = $1",
+        source_workspace_id,
+        target_workspace_id,
+    )
+    .execute(&mut **tx)
+    .await?;
+    Ok(())
+}
+
 // Asset usage rows and `// on` subscriber triggers are deploy-derived like
 // ci_test_reference / the macro registry: without cloning them the fork's
 // pipeline graph has no asset nodes or lineage edges, and — worse — the asset
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index cd5b6a8699..6b50450af9 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -4465,6 +4465,94 @@ paths:
                 items:
                   type: string
 
+  /w/{workspace}/data_metrics/list:
+    get:
+      summary: list declared measures and dimensions on DuckLake tables
+      description: >
+        Call this before writing any aggregate query over a DuckLake table. A
+        declared measure is the canonical definition of that number, and
+        reproducing it yourself will silently disagree with it (a `revenue`
+        measure typically excludes refunds or test rows). Filter by `table` for
+        one table's declarations, or by `path_prefix` (e.g. `f/analytics`) for
+        everything declared under a folder; omit both to browse the whole
+        catalog. Results are keyset-paged: a full page may mean more remain, so
+        continue with the `cursor_*` params rather than assuming a measure does not exist. Use each returned `expr` verbatim, and when a measure has a
+        `filter` write it as
+        `expr FILTER (WHERE filter)` so measures with different predicates can
+        share one GROUP BY. If a number you need has no declared measure, write
+        your own aggregate as usual. Results are limited to declarations whose
+        producing script the caller can read.
+      operationId: listDataMetrics
+      x-mcp-tool: true
+      tags:
+        - data_metric
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - name: table
+          in: query
+          description: DuckLake table path, with or without the `ducklake://` scheme
+          schema:
+            type: string
+        - name: path_prefix
+          in: query
+          description: Producing script path prefix, e.g. `f/analytics`
+          schema:
+            type: string
+        - name: per_page
+          in: query
+          description: Results per page, capped at 1000 (default 1000)
+          schema:
+            type: integer
+        - name: cursor_table
+          in: query
+          description: >
+            Keyset cursor. To page, pass the previous response's `next_cursor` fields
+            back as `cursor_*`; all four move together, and are omitted for the first
+            page. Continue whenever `next_cursor` is present. Every returned row is one
+            the caller may read, so the cursor never names a hidden row.
+          schema:
+            type: string
+        - name: cursor_kind
+          in: query
+          schema:
+            type: string
+        - name: cursor_name
+          in: query
+          schema:
+            type: string
+        - name: cursor_script
+          in: query
+          schema:
+            type: string
+      responses:
+        "200":
+          description: declared measures and dimensions
+          content:
+            application/json:
+              schema:
+                type: object
+                required: [metrics]
+                properties:
+                  metrics:
+                    type: array
+                    items:
+                      $ref: "#/components/schemas/DataMetric"
+                  next_cursor:
+                    description: >
+                      Present when more rows may follow: pass its fields back as the
+                      `cursor_*` params. Absent means the catalog is exhausted.
+                    type: object
+                    required: [table_path, kind, name, script_path]
+                    properties:
+                      table_path:
+                        type: string
+                      kind:
+                        type: string
+                      name:
+                        type: string
+                      script_path:
+                        type: string
+
   /w/{workspace}/workspaces/list_datatables:
     get:
       summary: list Datatables
@@ -30819,6 +30907,33 @@ components:
         kind:
           $ref: "#/components/schemas/AssetKind"
       required: [path, kind]
+    DataMetric:
+      description: |
+        One `// measure` or `// dimension` declaration, as catalogued from the
+        script that materializes the table. `expr` and `filter` are the author's
+        own SQL: a reader renders a measure as `expr` plus, when `filter` is set,
+        a trailing `FILTER (WHERE filter)`.
+      type: object
+      required: [script_path, table_path, kind, name, expr]
+      properties:
+        script_path:
+          type: string
+          description: The declaring script, and the path reads are authorized against
+        table_path:
+          type: string
+          description: Canonical scheme-less DuckLake path, `<lake>/<schema>.<table>` (schema defaults to `main`)
+        kind:
+          type: string
+          enum:
+            - measure
+            - dimension
+        name:
+          type: string
+        expr:
+          type: string
+        filter:
+          type: string
+          description: Row predicate from a measure's trailing `where`
     ContractWarning:
       description: |
         One save-time schema-contract warning: a consumer reference that does
@@ -30835,6 +30950,9 @@ components:
             - missing_lineage_source
             - missing_relationship_column
             - relationship_type_mismatch
+            - missing_measure_column
+            - missing_dimension_column
+            - non_aggregate_measure
             - suppressed
         asset_path:
           type: string
diff --git a/backend/windmill-api/src/lib.rs b/backend/windmill-api/src/lib.rs
index 5f436473e5..d56928a712 100644
--- a/backend/windmill-api/src/lib.rs
+++ b/backend/windmill-api/src/lib.rs
@@ -656,6 +656,10 @@ pub async fn run_server(
                         .nest("/volumes", volumes_oss::workspaced_service())
                         .nest("/workers", windmill_api_workers::workspaced_service())
                         .nest("/workspaces", workspaces::workspaced_service())
+                        .nest(
+                            "/data_metrics",
+                            windmill_api_workspaces::data_metrics::workspaced_service(),
+                        )
                         .nest(
                             "/deployment_request",
                             windmill_api_workspaces::deployment_requests::workspaced_service(),
diff --git a/backend/windmill-api/src/mcp/auto_generated_endpoints.rs b/backend/windmill-api/src/mcp/auto_generated_endpoints.rs
index fda5966e30..71becbf9c3 100644
--- a/backend/windmill-api/src/mcp/auto_generated_endpoints.rs
+++ b/backend/windmill-api/src/mcp/auto_generated_endpoints.rs
@@ -51,6 +51,48 @@ pub fn all_tools() -> Vec<EndpointTool> {
         "required": [
                 "url"
         ]
+})),
+        body_schema: None,
+        query_field_renames: None,
+        body_field_renames: None,
+    },
+    EndpointTool {
+        name: Cow::Borrowed("listDataMetrics"),
+        description: Cow::Borrowed("list declared measures and dimensions on DuckLake tables: Call this before writing any aggregate query over a DuckLake table. A declared measure is the canonical definition of that number, and reproducing it yourself will silently disagree with it (a `revenue` measure typically excludes refunds or test rows). Filter by `table` for one table's declarations, or by `path_prefix` (e.g. `f/analytics`) for everything declared under a folder; omit both to browse the whole catalog. Results are keyset-paged: a full page may mean more remain, so continue with the `cursor_*` params rather than assuming a measure does not exist. Use each returned `expr` verbatim, and when a measure has a `filter` write it as `expr FILTER (WHERE filter)` so measures with different predicates can share one GROUP BY. If a number you need has no declared measure, write your own aggregate as usual. Results are limited to declarations whose producing script the caller can read"),
+        instructions: Cow::Borrowed(""),
+        path: Cow::Borrowed("/w/{workspace}/data_metrics/list"),
+        method: Cow::Borrowed("GET"),
+        path_params_schema: None,
+        query_params_schema: Some(serde_json::json!({
+        "type": "object",
+        "properties": {
+                "table": {
+                        "type": "string",
+                        "description": "DuckLake table path, with or without the `ducklake://` scheme"
+                },
+                "path_prefix": {
+                        "type": "string",
+                        "description": "Producing script path prefix, e.g. `f/analytics`"
+                },
+                "per_page": {
+                        "type": "integer",
+                        "description": "Results per page, capped at 1000 (default 1000)"
+                },
+                "cursor_table": {
+                        "type": "string",
+                        "description": "Keyset cursor. To page, pass the previous response's `next_cursor` fields back as `cursor_*`; all four move together, and are omitted for the first page. Continue whenever `next_cursor` is present. Every returned row is one the caller may read, so the cursor never names a hidden row.\n"
+                },
+                "cursor_kind": {
+                        "type": "string"
+                },
+                "cursor_name": {
+                        "type": "string"
+                },
+                "cursor_script": {
+                        "type": "string"
+                }
+        },
+        "required": []
 })),
         body_schema: None,
         query_field_renames: None,
diff --git a/backend/windmill-api/src/token.rs b/backend/windmill-api/src/token.rs
index 7a4a4887f8..8bcd02d2fc 100644
--- a/backend/windmill-api/src/token.rs
+++ b/backend/windmill-api/src/token.rs
@@ -207,6 +207,21 @@ lazy_static! {
             }],
         });
 
+        // Read-only: the `data_metrics/list` route is the only surface and the
+        // catalog is written at deploy, never through a token. Path-selectable
+        // because the route filters rows by the caller's `data_metrics:read` path
+        // grants. Its own domain, not a `scripts` alias, so a metrics token can't
+        // reach `/scripts` routes.
+        groups.push(ScopeDomain {
+            name: "Data Metrics".to_string(),
+            description: Some("Read-only access to declared measures and dimensions".to_string()),
+            scopes: vec![ScopeOption {
+                value: "data_metrics:read".to_string(),
+                label: "Read".to_string(),
+                requires_resource_path: true,
+            }],
+        });
+
         groups.extend(build_standard_scope_domains());
         groups.extend(build_trigger_scope_domains());
 
@@ -235,7 +250,33 @@ mod tests {
             .flat_map(|d| d.scopes.iter())
             .map(|s| s.value.as_str())
             .collect();
-        assert!(values.contains(&"docs:read"), "docs:read must be selectable");
+        assert!(
+            values.contains(&"docs:read"),
+            "docs:read must be selectable"
+        );
         assert!(!values.contains(&"docs:write"), "docs has no write surface");
     }
+
+    /// The `data_metrics` route enforces its own scope domain, so `data_metrics:read`
+    /// must be grantable here or no token can ever reach it. It is read-only (the
+    /// catalog is written at deploy) and path-selectable.
+    #[test]
+    fn data_metrics_read_scope_is_exposed_read_only_and_path_selectable() {
+        let opt = ALL_SCOPES
+            .iter()
+            .flat_map(|d| d.scopes.iter())
+            .find(|s| s.value == "data_metrics:read")
+            .expect("data_metrics:read must be selectable");
+        assert!(
+            opt.requires_resource_path,
+            "data_metrics:read is path-scoped"
+        );
+        assert!(
+            !ALL_SCOPES
+                .iter()
+                .flat_map(|d| d.scopes.iter())
+                .any(|s| s.value == "data_metrics:write"),
+            "data_metrics has no write surface"
+        );
+    }
 }
diff --git a/backend/windmill-common/Cargo.toml b/backend/windmill-common/Cargo.toml
index 7e30547d9b..d91fb209db 100644
--- a/backend/windmill-common/Cargo.toml
+++ b/backend/windmill-common/Cargo.toml
@@ -90,6 +90,7 @@ const-str.workspace = true
 crc.workspace = true
 windmill-macros.workspace = true
 windmill-parser-sql.workspace = true
+windmill-parser-sql-asset.workspace = true
 windmill-parser-ts.workspace = true
 windmill-parser-py = { workspace = true, optional = true }
 windmill-parser.workspace = true
diff --git a/backend/windmill-common/src/data_metrics.rs b/backend/windmill-common/src/data_metrics.rs
new file mode 100644
index 0000000000..41eaeae9c3
--- /dev/null
+++ b/backend/windmill-common/src/data_metrics.rs
@@ -0,0 +1,268 @@
+//! Catalog of table-scoped metric declarations (`// measure`, `// dimension`).
+//!
+//! Declarations live in the producing script's annotation header and are mirrored
+//! into the `data_metric` table on deploy, so a reader can ask "what does this
+//! table declare?" or "what is declared under this folder?" without fetching and
+//! parsing script bodies. Nothing here rewrites or executes SQL: the catalog is
+//! read by the script editor and by agents, which compose their own queries.
+
+use crate::error::{Error, Result};
+use serde::Serialize;
+use windmill_parser::asset_parser::{parse_pipeline_annotations, AssetKind};
+
+pub const KIND_MEASURE: &str = "measure";
+pub const KIND_DIMENSION: &str = "dimension";
+
+// Mirror the `data_metric` column widths so oversized annotations fail at deploy
+// with a clear message instead of a Postgres error.
+const MAX_NAME_LEN: usize = 255;
+const MAX_TABLE_PATH_LEN: usize = 510;
+
+/// Canonical `<lake>/<schema>.<table>`, defaulting the schema to DuckLake's `main`.
+///
+/// A producer's `// materialize ducklake://lake/orders` target omits the schema
+/// while a consumer reading `lake.main.orders` records its asset as
+/// `lake/main.orders`. Both sides must land on the same catalog key or a consumer
+/// can never resolve the table's declarations.
+pub fn canonical_table_path(path: &str) -> String {
+    let p = path.strip_prefix("ducklake://").unwrap_or(path);
+    match p.split_once('/') {
+        Some((lake, rest)) if !rest.contains('.') => format!("{lake}/main.{rest}"),
+        _ => p.to_string(),
+    }
+}
+
+/// Whether a canonical table path is safe to interpolate into an `ATTACH` string.
+/// A real DuckLake path is dotted/slashed identifiers; anything else could break
+/// out of the string literal or the statement.
+pub fn is_safe_table_path(path: &str) -> bool {
+    !path.is_empty()
+        && path
+            .chars()
+            .all(|c| c.is_ascii_alphanumeric() || matches!(c, '_' | '-' | '.' | '/'))
+}
+
+/// One declared measure or dimension.
+#[derive(Serialize, Debug, Clone, PartialEq)]
+pub struct MetricEntry {
+    /// The declaring script, and the path reads are authorized against.
+    pub script_path: String,
+    /// Canonical scheme-less ducklake path, `<lake>/<schema>.<table>`.
+    pub table_path: String,
+    pub kind: String,
+    pub name: String,
+    pub expr: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub filter: Option<String>,
+}
+
+/// Replace `script_path`'s catalog rows with the declarations currently in its
+/// source, so the catalog always describes the deployed state.
+///
+/// Declarations describe the table the script materializes, so a script without a
+/// ducklake `// materialize` target contributes nothing: there would be no table
+/// to attach them to.
+///
+/// **Authorization is the caller's responsibility.** This writes workspace-scoped
+/// rows for whatever `w_id`/`script_path` it is handed and performs no permission
+/// check of its own. Call it only where the caller has already established write
+/// access to that script path, as script deployment does.
+pub async fn sync_metric_catalog(
+    db: &mut sqlx::PgConnection,
+    w_id: &str,
+    script_path: &str,
+    old_path: Option<&str>,
+    content: &str,
+) -> Result<()> {
+    // Clear the old path too, so a rename does not orphan its declarations at a
+    // path this script no longer occupies.
+    sqlx::query!(
+        "DELETE FROM data_metric WHERE workspace_id = $1 AND (script_path = $2 OR script_path = $3)",
+        w_id,
+        script_path,
+        old_path.unwrap_or(script_path)
+    )
+    .execute(&mut *db)
+    .await?;
+
+    let ann = parse_pipeline_annotations(content);
+    let Some(spec) = ann
+        .materialize
+        .filter(|m| m.target_kind == AssetKind::Ducklake)
+    else {
+        return Ok(());
+    };
+    if ann.measures.is_empty() && ann.dimensions.is_empty() {
+        return Ok(());
+    }
+
+    // The lake/table name is interpolated into an `ATTACH 'ducklake://<lake>' …`
+    // string that a *reader* executes, so a quote or semicolon in it is stored SQL
+    // injection.
+    let canonical = canonical_table_path(&spec.target_path);
+    if !is_safe_table_path(&canonical) {
+        return Err(Error::BadRequest(format!(
+            "`// materialize` target `{}` has an unsafe table path `{canonical}`: a metric's \
+             lake/table name may contain only letters, digits, `_ - . /`",
+            spec.target_path
+        )));
+    }
+
+    // Reject caller-authored values longer than their columns (VARCHAR counts
+    // characters) with a clear error at deploy, not a Postgres "value too long"
+    // failure. script_path is the script's own already-validated path.
+    if canonical.chars().count() > MAX_TABLE_PATH_LEN {
+        return Err(Error::BadRequest(format!(
+            "`// materialize` target table path `{canonical}` is too long (max {MAX_TABLE_PATH_LEN} characters)"
+        )));
+    }
+    for name in ann
+        .measures
+        .iter()
+        .map(|m| &m.name)
+        .chain(ann.dimensions.iter().map(|d| &d.name))
+    {
+        if name.chars().count() > MAX_NAME_LEN {
+            return Err(Error::BadRequest(format!(
+                "metric name `{name}` is too long (max {MAX_NAME_LEN} characters)"
+            )));
+        }
+    }
+
+    // Declarations are interpolated verbatim into SQL that a *reader* executes, so
+    // each one must be a single expression. Otherwise `count(*) FROM t; DELETE …`
+    // stored as a measure would run as whoever opens the drawer.
+    for (kind, name, body) in ann
+        .measures
+        .iter()
+        .flat_map(|m| {
+            std::iter::once((KIND_MEASURE, &m.name, m.expr.as_str()))
+                .chain(m.filter.as_deref().map(|f| (KIND_MEASURE, &m.name, f)))
+        })
+        .chain(
+            ann.dimensions
+                .iter()
+                .map(|d| (KIND_DIMENSION, &d.name, d.expr.as_str())),
+        )
+    {
+        if !windmill_parser_sql_asset::is_single_sql_expression(body) {
+            return Err(Error::BadRequest(format!(
+                "{kind} `{name}` must be a single SQL expression; `{body}` is not \
+                 (it would be executed by anyone reading this table's metrics)"
+            )));
+        }
+    }
+
+    // A measure's trailing `where` compiles to `<expr> FILTER (WHERE <pred>)`, and
+    // SQL binds FILTER to one aggregate call. A composite like `sum(a)/count(b)`
+    // would filter only `count(b)`, silently corrupting the canonical number, so a
+    // filtered measure must be a single aggregate call.
+    for m in ann.measures.iter().filter(|m| m.filter.is_some()) {
+        if !windmill_parser_sql_asset::is_single_function_call(&m.expr) {
+            return Err(Error::BadRequest(format!(
+                "measure `{}` has a `where` filter, so `{}` must be a single aggregate call \
+                 (e.g. `sum(amount)`): a `where` on a composite like `sum(a)/count(b)` would \
+                 filter only part of it and silently produce the wrong number",
+                m.name, m.expr
+            )));
+        }
+    }
+
+    let mut kinds: Vec<String> = Vec::new();
+    let mut names: Vec<String> = Vec::new();
+    let mut exprs: Vec<String> = Vec::new();
+    let mut filters: Vec<Option<String>> = Vec::new();
+    for m in &ann.measures {
+        kinds.push(KIND_MEASURE.to_string());
+        names.push(m.name.clone());
+        exprs.push(m.expr.clone());
+        filters.push(m.filter.clone());
+    }
+    for d in &ann.dimensions {
+        kinds.push(KIND_DIMENSION.to_string());
+        names.push(d.name.clone());
+        exprs.push(d.expr.clone());
+        filters.push(None);
+    }
+
+    sqlx::query!(
+        "INSERT INTO data_metric (workspace_id, script_path, table_path, kind, name, expr, filter) \
+         SELECT $1, $2, $3, k, n, e, f \
+         FROM UNNEST($4::text[], $5::text[], $6::text[], $7::text[]) AS t(k, n, e, f)",
+        w_id,
+        script_path,
+        &canonical,
+        &kinds[..],
+        &names[..],
+        &exprs[..],
+        &filters[..] as &[Option<String>]
+    )
+    .execute(&mut *db)
+    .await?;
+
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn a_declaration_smuggling_extra_statements_is_rejected() {
+        use windmill_parser_sql_asset::is_single_sql_expression;
+        // The shape that would otherwise execute as whoever opens the drawer.
+        assert!(!is_single_sql_expression(
+            "count(*) FROM t; DELETE FROM secrets; SELECT count(*)"
+        ));
+        assert!(!is_single_sql_expression("1; DROP TABLE t"));
+        assert!(!is_single_sql_expression("sum(amount) garbage"));
+        // A trailing comment is skipped by the parser, so it is rejected explicitly.
+        assert!(!is_single_sql_expression("sum(amount) --rest"));
+        assert!(!is_single_sql_expression("sum(amount) /* c */"));
+        // Ordinary declarations still pass.
+        assert!(is_single_sql_expression("sum(amount)"));
+        assert!(is_single_sql_expression("count(*)"));
+        assert!(is_single_sql_expression("not is_refund"));
+        assert!(is_single_sql_expression("date_trunc('month', ordered_at)"));
+    }
+
+    #[test]
+    fn a_filtered_measure_must_be_a_single_aggregate_call() {
+        use windmill_parser_sql_asset::is_single_function_call;
+        // A filtered composite would mis-apply FILTER to only one of its aggregates.
+        assert!(!is_single_function_call("sum(amount) / count(*)"));
+        assert!(!is_single_function_call("sum(a) + sum(b)"));
+        assert!(!is_single_function_call("sum(amount) * 2"));
+        // A single aggregate call is fine (FILTER attaches unambiguously).
+        assert!(is_single_function_call("sum(amount)"));
+        assert!(is_single_function_call("count(*)"));
+        assert!(is_single_function_call("count(distinct user_id)"));
+    }
+
+    #[test]
+    fn an_unsafe_lake_path_is_rejected() {
+        // The injection shape: a quote/semicolon in the lake name would break out of
+        // the ATTACH string literal.
+        assert!(!is_safe_table_path("dl';SELECT(1);--/main.orders"));
+        assert!(!is_safe_table_path("lake\"/main.t"));
+        assert!(!is_safe_table_path(""));
+        // Ordinary canonical paths are fine.
+        assert!(is_safe_table_path("sales/main.orders"));
+        assert!(is_safe_table_path("my-lake/analytics.daily_v2"));
+    }
+
+    #[test]
+    fn a_producers_target_and_a_consumers_read_canonicalize_alike() {
+        // What a producer declares, and what a consumer's read records.
+        assert_eq!(
+            canonical_table_path("ducklake://sales/orders"),
+            canonical_table_path("sales/main.orders")
+        );
+        assert_eq!(canonical_table_path("sales/orders"), "sales/main.orders");
+        // An explicit schema is preserved rather than forced to `main`.
+        assert_eq!(
+            canonical_table_path("sales/analytics.orders"),
+            "sales/analytics.orders"
+        );
+    }
+}
diff --git a/backend/windmill-common/src/lib.rs b/backend/windmill-common/src/lib.rs
index 8f3dae3203..08a4ea93ed 100644
--- a/backend/windmill-common/src/lib.rs
+++ b/backend/windmill-common/src/lib.rs
@@ -62,6 +62,7 @@ pub mod instance_config;
 pub mod job_metrics;
 pub mod log_context;
 pub mod materialization;
+pub mod data_metrics;
 pub mod min_version;
 pub mod notify_events;
 pub mod runtime_assets;
diff --git a/backend/windmill-common/src/schema_contracts.rs b/backend/windmill-common/src/schema_contracts.rs
index b605aae33b..7d941040bc 100644
--- a/backend/windmill-common/src/schema_contracts.rs
+++ b/backend/windmill-common/src/schema_contracts.rs
@@ -22,7 +22,7 @@ use serde::{Deserialize, Serialize};
 use sqlx::types::Json;
 use sqlx::{Postgres, Transaction};
 use windmill_parser::asset_parser::{
-    ColumnLineage, DataTest, MaterializeSpec, OnSchemaChange, PARTITION_TOKEN,
+    ColumnLineage, DataTest, Dimension, MaterializeSpec, Measure, OnSchemaChange, PARTITION_TOKEN,
 };
 use windmill_types::assets::{AssetKind, AssetWithAltAccessType};
 
@@ -46,6 +46,15 @@ pub enum ContractWarningKind {
     /// Relationship join columns have different captured types (may still
     /// coerce at run time — phrased as "differs", not "will fail").
     RelationshipTypeMismatch,
+    /// A `// measure` body reads a column absent from the producer's own
+    /// captured (target) schema.
+    MissingMeasureColumn,
+    /// A `// dimension` body reads a column absent from the producer's own
+    /// captured (target) schema.
+    MissingDimensionColumn,
+    /// A `// measure` body contains no aggregate (it is a row-level expression),
+    /// so grouping it by a dimension produces an invalid query.
+    NonAggregateMeasure,
     /// Warnings for this asset were suppressed by the producer's
     /// `on_schema_change=ignore` (one informational entry per asset).
     Suppressed,
@@ -299,6 +308,109 @@ pub fn diff_contract(
     warnings
 }
 
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum MetricRefKind {
+    Measure,
+    Dimension,
+}
+
+/// Warn about measures that contain no aggregate. A measure is meant to reduce
+/// the table's rows, so grouping a row-level expression like `amount` by a
+/// dimension yields an invalid query. Pure and schema-independent. A warning, not
+/// an error: detection is deliberately lenient (any function call is accepted, to
+/// avoid a reserved aggregate-name list), so a hard block would risk rejecting an
+/// unusual-but-valid aggregate.
+pub fn check_measures_aggregate(
+    measures: &[Measure],
+    materialize: Option<&MaterializeSpec>,
+) -> Vec<ContractWarning> {
+    let mut warnings = vec![];
+    let target = materialize
+        .filter(|m| m.target_kind == windmill_parser::asset_parser::AssetKind::Ducklake)
+        .map(|m| normalize_asset_path(&m.target_path))
+        .unwrap_or_default();
+    for m in measures {
+        if windmill_parser_sql_asset::measure_expr_may_aggregate(&m.expr) {
+            continue;
+        }
+        warnings.push(ContractWarning {
+            kind: ContractWarningKind::NonAggregateMeasure,
+            asset_path: target.clone(),
+            column: None,
+            expected_type: None,
+            found_type: None,
+            schema_version: None,
+            captured_at: None,
+            message: format!(
+                "`// measure {} = {}` contains no aggregate, so grouping it by a \
+                 dimension produces an invalid query",
+                m.name, m.expr
+            ),
+        });
+    }
+    warnings
+}
+
+/// A metric measure/dimension plus the column names its body reads, extracted by
+/// the async wrapper (the pure diff never parses SQL). One per declared metric.
+#[derive(Debug, Clone)]
+pub struct MetricColumnRef {
+    pub kind: MetricRefKind,
+    pub name: String,
+    pub columns: Vec<String>,
+}
+
+/// Validate metric measure/dimension bodies against the producer's own captured
+/// (target) schema. Separate from `diff_contract` because these are the
+/// producer's *own* declarations, not consumer reads of an upstream: a measure
+/// citing a column the producer itself dropped is the producer's bug, and is
+/// deliberately not muted by `on_schema_change=ignore` (which only governs
+/// downstream drift). Pure — column refs are pre-extracted by the caller.
+pub fn diff_metric_contract(
+    metric_refs: &[MetricColumnRef],
+    materialize: Option<&MaterializeSpec>,
+    schemas: &HashMap<String, CapturedSchema>,
+) -> Vec<ContractWarning> {
+    let mut warnings: Vec<ContractWarning> = vec![];
+    let Some(m) =
+        materialize.filter(|m| m.target_kind == windmill_parser::asset_parser::AssetKind::Ducklake)
+    else {
+        return warnings;
+    };
+    let own_path = normalize_asset_path(&m.target_path);
+    let Some(schema) = schemas.get(&own_path) else {
+        return warnings;
+    };
+    for mr in metric_refs {
+        for col in &mr.columns {
+            if is_reserved(col) || schema.find(col).is_some() {
+                continue;
+            }
+            let (kind, label) = match mr.kind {
+                MetricRefKind::Measure => (ContractWarningKind::MissingMeasureColumn, "measure"),
+                MetricRefKind::Dimension => {
+                    (ContractWarningKind::MissingDimensionColumn, "dimension")
+                }
+            };
+            warnings.push(ContractWarning {
+                kind,
+                asset_path: own_path.clone(),
+                column: Some(col.clone()),
+                expected_type: None,
+                found_type: None,
+                schema_version: Some(schema.version),
+                captured_at: Some(schema.captured_at),
+                message: format!(
+                    "`// {label} {}` reads `{col}`, which is not in ducklake://{own_path}'s \
+                     captured schema (v{})",
+                    mr.name, schema.version
+                ),
+            });
+        }
+    }
+    warnings
+}
+
 /// Load captured schemas + producer modes and run the contract check for one
 /// consumer script's parsed refs.
 ///
@@ -313,7 +425,13 @@ pub async fn check_schema_contracts(
     column_lineage: &[ColumnLineage],
     data_tests: &[DataTest],
     materialize: Option<&MaterializeSpec>,
+    measures: &[Measure],
+    dimensions: &[Dimension],
 ) -> Result<Vec<ContractWarning>> {
+    // Whether a measure aggregates is a pure property of its expression, so this
+    // check runs regardless of whether a schema has been captured.
+    let mut warnings = check_measures_aggregate(measures, materialize);
+
     // Referenced ducklake paths (normalized) across every ref family the diff
     // inspects — plus the consumer's own materialize target (for W3 types).
     let mut paths: HashSet<String> = HashSet::new();
@@ -342,7 +460,9 @@ pub async fn check_schema_contracts(
         }
     }
     if paths.is_empty() {
-        return Ok(vec![]);
+        // No captured schemas to diff against, but the schema-independent measure
+        // checks above still stand.
+        return Ok(warnings);
     }
 
     // A managed scd2 producer (re)creates a `<dim>_current` view with the base
@@ -462,14 +582,41 @@ pub async fn check_schema_contracts(
         }
     }
 
-    Ok(diff_contract(
+    // Extract the columns each measure/dimension body reads (measure filters
+    // too), then validate them against the producer's own captured schema.
+    let mut metric_refs: Vec<MetricColumnRef> =
+        Vec::with_capacity(measures.len() + dimensions.len());
+    for mm in measures {
+        let mut columns = windmill_parser_sql_asset::extract_expr_column_idents(&mm.expr);
+        if let Some(filter) = &mm.filter {
+            columns.extend(windmill_parser_sql_asset::extract_expr_column_idents(
+                filter,
+            ));
+        }
+        metric_refs.push(MetricColumnRef {
+            kind: MetricRefKind::Measure,
+            name: mm.name.clone(),
+            columns,
+        });
+    }
+    for dd in dimensions {
+        metric_refs.push(MetricColumnRef {
+            kind: MetricRefKind::Dimension,
+            name: dd.name.clone(),
+            columns: windmill_parser_sql_asset::extract_expr_column_idents(&dd.expr),
+        });
+    }
+
+    warnings.extend(diff_contract(
         assets,
         column_lineage,
         data_tests,
         materialize,
         &schemas,
         &ignored,
-    ))
+    ));
+    warnings.extend(diff_metric_contract(&metric_refs, materialize, &schemas));
+    Ok(warnings)
 }
 
 #[cfg(test)]
@@ -531,6 +678,65 @@ mod tests {
         assert!(diff_contract(&[a], &[], &[], None, &schemas, &HashSet::new()).is_empty());
     }
 
+    #[test]
+    fn metric_column_missing_from_own_schema_warns() {
+        let ann = parse_pipeline_annotations("-- materialize ducklake://lake/orders\nSELECT 1;");
+        let schemas = HashMap::from([(
+            "lake/orders".to_string(),
+            schema(&[("amount", "DOUBLE"), ("region", "VARCHAR")]),
+        )]);
+        let refs = vec![
+            MetricColumnRef {
+                kind: MetricRefKind::Measure,
+                name: "revenue".to_string(),
+                columns: vec!["amount".to_string()],
+            },
+            MetricColumnRef {
+                kind: MetricRefKind::Measure,
+                name: "refunds".to_string(),
+                columns: vec!["refund_amt".to_string()],
+            },
+            MetricColumnRef {
+                kind: MetricRefKind::Dimension,
+                name: "zone".to_string(),
+                columns: vec!["zone_id".to_string()],
+            },
+        ];
+        let w = diff_metric_contract(&refs, ann.materialize.as_ref(), &schemas);
+        // `amount` exists; the refund measure and zone dimension cite unknown
+        // columns of the producer's own captured schema.
+        assert_eq!(w.len(), 2);
+        assert_eq!(w[0].kind, ContractWarningKind::MissingMeasureColumn);
+        assert_eq!(w[0].column.as_deref(), Some("refund_amt"));
+        assert_eq!(w[1].kind, ContractWarningKind::MissingDimensionColumn);
+        assert_eq!(w[1].column.as_deref(), Some("zone_id"));
+        // No captured schema → silent (first deploy).
+        assert!(diff_metric_contract(&refs, ann.materialize.as_ref(), &HashMap::new()).is_empty());
+    }
+
+    #[test]
+    fn a_measure_with_no_aggregate_warns_schema_independently() {
+        let ann = parse_pipeline_annotations(
+            "-- materialize ducklake://sales/orders\n\
+             -- measure revenue = amount\n\
+             -- measure scaled = amount * 2\n\
+             -- measure total = sum(amount)\n\
+             -- measure n = count(*)\n\
+             -- measure custom = my_udaf(x)\n\
+             SELECT 1;",
+        );
+        // Runs without any captured schema. Bare column and pure arithmetic warn;
+        // sum/count and an unknown function (benefit of the doubt, no aggregate-name
+        // list) do not.
+        let w = check_measures_aggregate(&ann.measures, ann.materialize.as_ref());
+        assert_eq!(w.len(), 2);
+        assert!(w
+            .iter()
+            .all(|w| w.kind == ContractWarningKind::NonAggregateMeasure));
+        assert!(w[0].message.contains("revenue"));
+        assert!(w[1].message.contains("scaled"));
+    }
+
     #[test]
     fn asset_without_captured_schema_is_silent() {
         let assets = vec![read_asset("lake/unknown", &["whatever"])];
diff --git a/docs/pipeline-metrics-layer.md b/docs/pipeline-metrics-layer.md
new file mode 100644
index 0000000000..202a174a57
--- /dev/null
+++ b/docs/pipeline-metrics-layer.md
@@ -0,0 +1,135 @@
+# Data metrics: declared measures and dimensions
+
+## What this is
+
+A way to declare, on the DuckDB script that materializes a DuckLake table, what the
+table's canonical aggregations are:
+
+```sql
+-- materialize ducklake://sales/orders
+-- measure revenue = sum(amount) where not is_refund
+-- measure order_count = count(*)
+-- dimension region = region
+-- dimension month = date_trunc('month', ordered_at)
+SELECT ...
+```
+
+Those declarations are catalogued at deploy and read back by two consumers: the
+script editor (a drawer that composes a `SELECT` you can insert) and agents (a tool
+that lists what is declared, so they stop guessing).
+
+That is the whole feature. It records definitions and hands them to whoever is
+writing the query. It does not rewrite, compile, or execute anything.
+
+## What it deliberately does not do
+
+**It does not enforce anything.** An agent or a person can ignore a declared
+measure and write `sum(amount)` without the refund filter, and nothing stops them.
+The bet is that most wrong numbers come from not knowing the rule, not from
+defying it, and that an informed writer is most of the value.
+
+**It is not a semantic layer.** Declarations are single-table. There is no join
+planner and no fan-out-safe aggregation across grains. To combine tables, a
+developer materializes a mart with a pipeline step and declares measures on that.
+
+**There is no query-time indirection.** What you deploy is what runs. Compiling a
+`{{ metric(...) }}` token into frozen SQL at deploy and substituting it on the
+worker would break that: the script in the editor would stop being the script that
+executes, and job logs would show SQL appearing nowhere in the source.
+
+## Why no compiler
+
+A compiler buys two things over handing definitions to the caller: byte-identical
+SQL with no LLM in the loop, and enforcement. Both matter only once several
+independent consumers depend on the same number being reproducible, which is a
+situation this codebase has no evidence of yet. Until then the machinery costs a
+token grammar, a deploy-time freeze keyed to script hashes, a worker substitution
+path, and a second way for the editor and the runtime to disagree.
+
+If that evidence shows up, the catalog is the right foundation to build it on: the
+declarations are already structured and already validated.
+
+## Authoring
+
+Both annotations live in the leading comment header, next to `// materialize`:
+
+- `// measure <name> = <aggregate> [where <predicate>]`
+- `// dimension <name> = <expression>`
+
+`expr` and `filter` are the author's own SQL, stored verbatim. The predicate is
+kept separate from the aggregate rather than folded into it, because a reader
+renders it as `expr FILTER (WHERE filter)`. That is what lets two measures with
+different predicates sit under one `GROUP BY`; a shared `WHERE` cannot express it.
+
+Declarations attach to the table the script materializes, so a script with no
+ducklake `// materialize` target contributes nothing: there is no table to hang
+them on.
+
+## The catalog
+
+`data_metric` holds one row per declaration, replaced wholesale for a script path
+on every deploy, so it always describes deployed state. It mirrors how the `asset`
+table is maintained.
+
+Persisting rather than parsing on demand is what makes folder-scoped listing cheap.
+Reading a table's declarations is a point lookup either way, but "everything
+declared under `f/analytics`" would otherwise mean fetching and parsing every
+script body in the folder on each agent call. Both access patterns are single index
+scans:
+
+- `idx_data_metric_table` for the editor drawer
+- `idx_data_metric_folder` for the agent tool, using `text_pattern_ops` so a
+  `LIKE 'f/analytics/%'` prefix becomes a range scan. This database's collation is
+  not `C`, and under a locale collation the planner will not use a default-opclass
+  index for prefix matching (measured at 50k rows: seq scan with the default
+  opclass, index range scan with `text_pattern_ops`).
+
+### Canonical table paths
+
+A producer's `// materialize ducklake://sales/orders` omits the schema, while a
+consumer reading `sales.main.orders` records its asset as `sales/main.orders`.
+Both are canonicalized to `<lake>/<schema>.<table>` with `main` as the default, or
+a consumer could never resolve the table it reads.
+
+### Authorization
+
+`data_metric` has no RLS. Reads are filtered by an `EXISTS` against `script` on the
+authed connection, so `script`'s existing folder, group and user policies decide
+what a caller sees. The producing script path is therefore part of the key: a
+DuckLake path has no folder to authorize against.
+
+## Consumers
+
+**Script editor drawer.** A Metrics trigger sits in the editor bar of every DuckDB
+script, and in the compact Helpers menu below the width threshold. It lists the
+tables that declare metrics so they can be browsed, composes a plain `SELECT`
+client-side from a measure/dimension selection, and offers three things to do with
+it: copy it (a complete query attaching the lake under `dl`), run it in an embedded
+REPL against the lake, or append it to the script (reusing whatever alias the
+script already attaches, since a repeated `ATTACH` would not run). The output is
+ordinary editable SQL with no link back to the catalog.
+
+**Agent tool.** The same endpoint is exposed with `x-mcp-tool`, so an agent can ask
+what a table or a folder declares and use the declared `expr`/`filter` instead of
+inventing an aggregate.
+
+## Limitations and follow-ups
+
+- Declarations only exist for materialized DuckLake tables. There is no way to
+  declare a measure over a Postgres table or an API result.
+- The drawer's REPL runs a preview job per execution, so it is a place to check a
+  metric rather than a dashboard. There is no charting or filter builder.
+- The drawer composes SQL in TypeScript while an agent composes its own. They agree
+  semantically because both read the same declaration, but not byte for byte. That
+  only becomes a problem if identical SQL is ever required, which is the compiler
+  above.
+- Deploy hard-rejects three things, all because a reader executes the stored text:
+  an unsafe lake/table path and a measure/dimension body that is not a single SQL
+  expression (both are stored SQL injection), and a filtered measure whose body is
+  not a single aggregate call (`sum(a)/count(b) where …` would apply `FILTER` to
+  only part of the expression and silently produce the wrong number). Everything
+  else is advisory:
+  missing-column and non-aggregate-measure warnings come from the separate
+  `check_schema_contracts` endpoint, which the editor calls fire-and-forget on save.
+  A CLI or direct-API deploy skips those warnings, and a declaration whose SQL is
+  otherwise wrong is only discovered when someone runs it.
diff --git a/frontend/src/lib/components/EditorBar.svelte b/frontend/src/lib/components/EditorBar.svelte
index 1e6a29388f..ce242a891a 100644
--- a/frontend/src/lib/components/EditorBar.svelte
+++ b/frontend/src/lib/components/EditorBar.svelte
@@ -53,6 +53,7 @@
 		Package,
 		Plus,
 		RotateCw,
+		Sigma,
 		Save,
 		Settings,
 		Users
@@ -69,6 +70,8 @@
 	import { quicktype, InputData, JSONSchemaInput, FetchingJSONSchemaStore } from 'quicktype-core'
 	import S3FilePicker from './S3FilePicker.svelte'
 	import DucklakeIcon from './icons/DucklakeIcon.svelte'
+	import MetricsDrawer from './metrics/MetricsDrawer.svelte'
+	import { endsWithUnterminatedStatement } from './sqlDdl'
 	import FlowInlineScriptAiButton from './copilot/FlowInlineScriptAIButton.svelte'
 	import GitRepoPopoverPicker from './GitRepoPopoverPicker.svelte'
 	import { insertDelegateToGitRepoInCode } from '$lib/ansibleUtils'
@@ -161,6 +164,7 @@
 	let ducklakePicker: ItemPicker | undefined = $state()
 	let dataTablePicker: ItemPicker | undefined = $state()
 	let databasePicker: ItemPicker | undefined = $state()
+	let metricsDrawer: MetricsDrawer | undefined = $state()
 	let gitRepoPickerOpen = $state(false)
 
 	let showContextVarPicker = $derived(
@@ -238,6 +242,9 @@
 		['duckdb', 'python3'].includes(lang ?? '') ||
 			['typescript', 'javascript'].includes(scriptLangToEditorLang(lang))
 	)
+	// Declared metrics compile to a SELECT, so only a DuckDB script can take the
+	// insertion; the other DuckLake-capable languages call it through the SDK.
+	let showMetricsDrawer = $derived(lang === 'duckdb')
 	let showDucklakePicker = $derived(
 		['duckdb', 'python3'].includes(lang ?? '') ||
 			['typescript', 'javascript'].includes(scriptLangToEditorLang(lang))
@@ -317,6 +324,13 @@
 				action: () => ducklakePicker?.openDrawer()
 			})
 		}
+		if (showMetricsDrawer && customUi?.metrics != false) {
+			items.push({
+				displayName: 'Metrics',
+				icon: Sigma,
+				action: () => metricsDrawer?.open()
+			})
+		}
 		if (showDataTablePicker && customUi?.dataTable != false) {
 			items.push({
 				displayName: 'Data table',
@@ -936,6 +950,24 @@ JsonNode ${windmillPathToCamelCaseName(path)} = JsonNode.Parse(await client.GetS
 	></ItemPicker>
 {/if}
 
+{#if showMetricsDrawer && customUi?.metrics != false}
+	<!-- Appended rather than inserted at the cursor: the snippet is a whole statement
+	     block, and when it relies on an ATTACH already in the script it must follow it. -->
+	<MetricsDrawer
+		bind:this={metricsDrawer}
+		workspace={ws}
+		getCode={() => editor?.getCode() ?? ''}
+		onInsert={(sql) => {
+			// Terminate whatever the script ends with: appending a fresh statement
+			// after an unterminated one produces invalid SQL. The separator starts on
+			// its own line so the `;` cannot land inside a trailing line comment.
+			const existing = editor?.getCode() ?? ''
+			const sep = existing.trim() === '' ? '' : endsWithUnterminatedStatement(existing) ? '\n;\n\n' : '\n\n'
+			editor?.append(sep + sql + '\n')
+		}}
+	/>
+{/if}
+
 <S3FilePicker
 	bind:this={s3FilePicker}
 	readOnlyMode={false}
@@ -1119,6 +1151,20 @@ JsonNode ${windmillPathToCamelCaseName(path)} = JsonNode.Parse(await client.GetS
 					</Button>
 				{/if}
 
+				{#if showMetricsDrawer && customUi?.metrics != false}
+					<Button
+						aiId="editor-bar-metrics"
+						aiDescription="Open the measures and dimensions declared on DuckLake tables"
+						title="Metrics"
+						variant="subtle"
+						on:click={() => metricsDrawer?.open()}
+						unifiedSize="sm"
+						startIcon={{ icon: Sigma }}
+						{iconOnly}
+						>Metrics
+					</Button>
+				{/if}
+
 				{#if showDataTablePicker && customUi?.dataTable != false}
 					<Button
 						aiId="editor-bar-use-datatable"
diff --git a/frontend/src/lib/components/SqlRepl.svelte b/frontend/src/lib/components/SqlRepl.svelte
index 5ca069b5be..3763f7aeed 100644
--- a/frontend/src/lib/components/SqlRepl.svelte
+++ b/frontend/src/lib/components/SqlRepl.svelte
@@ -16,7 +16,10 @@
 
 	type Props = {
 		input: DbInput
-		onData: (data: Record<string, any>[]) => void
+		/** `ranCode` is the editor content that produced `data`, captured when the
+		 * run started, so a caller can discard a late response whose query it has
+		 * moved past. */
+		onData: (data: Record<string, any>[], ranCode: string) => void
 		placeholderTableName?: string
 		/** Called after a migration is run via the DDL guard, so the schema view
 		 * can be refreshed to reflect the applied change. */
@@ -46,6 +49,12 @@
 
 	const DEFAULT_SQL = 'SELECT * FROM _'
 	let code = $state(DEFAULT_SQL)
+
+	/** Seed the editor from outside, e.g. a query composed in a drawer. */
+	export function setCode(newCode: string) {
+		code = newCode
+		editor?.setCode?.(newCode)
+	}
 	$effect(() => {
 		const _code = untrack(() => code)
 		if (placeholderTableName && _code === DEFAULT_SQL) {
@@ -71,6 +80,12 @@
 			if (pruneComments(code).trim() === '') return
 		}
 
+		// Snapshot the code that will actually run: after the DDL guard has stripped
+		// any migrated statements, and before the execution await during which
+		// `code` can be re-seeded (setCode). The caller identifies which query a late
+		// response belongs to by this value, and history restores exactly it.
+		const ranCode = code
+
 		isRunning = true
 		try {
 			const statements = splitSqlStatements(pruneComments(code))
@@ -130,10 +145,13 @@
 					created_by: '',
 					id: job.id,
 					success: true,
-					code,
+					// The snapshot, not the live `code`: a mid-run setCode() must not
+					// rebind this entry's result to a different query. Selecting it later
+					// reseeds the editor with this exact SQL and re-fires onData with it.
+					code: ranCode,
 					result
 				})
-				onData(result)
+				onData(result, ranCode)
 			}
 			if (doPostgresRowToJsonFix)
 				sendUserToast('Query failed but recovered with the row_to_json fix')
@@ -185,7 +203,7 @@
 			on:select={(e) => {
 				const data = e.detail as (typeof runHistory)[number]
 				editor?.setCode(data.code)
-				onData(data.result)
+				onData(data.result, data.code)
 			}}
 		/>
 	</Pane>
diff --git a/frontend/src/lib/components/assets/AssetGraph/schemaContracts.ts b/frontend/src/lib/components/assets/AssetGraph/schemaContracts.ts
index 4a1de04e13..56a82715fc 100644
--- a/frontend/src/lib/components/assets/AssetGraph/schemaContracts.ts
+++ b/frontend/src/lib/components/assets/AssetGraph/schemaContracts.ts
@@ -408,6 +408,11 @@ export function mapWarningsToMarkers(code: string, warnings: ContractWarning[]):
 						(l) => /^\s*(\/\/|--|#)\s*column\s/.test(l) && !!w.column && l.includes(w.column)
 					)
 					break
+				// The measure/dimension warning kinds (`missing_measure_column`,
+				// `missing_dimension_column`, `non_aggregate_measure`) are not handled
+				// here: this live mirror does not parse metric annotations, so it never
+				// produces them. They are surfaced by the authoritative post-deploy
+				// `check_schema_contracts` endpoint, not by Monaco markers.
 				case 'missing_relationship_column':
 				case 'relationship_type_mismatch':
 					lineNumber = lineMatching(
diff --git a/frontend/src/lib/components/copilot/chat/pipeline/core.ts b/frontend/src/lib/components/copilot/chat/pipeline/core.ts
index 86fe9eb634..31d74880a5 100644
--- a/frontend/src/lib/components/copilot/chat/pipeline/core.ts
+++ b/frontend/src/lib/components/copilot/chat/pipeline/core.ts
@@ -319,8 +319,9 @@ export function getPipelinePromptSection(ctx: PipelineContext): string {
 Data Pipeline editor (ACTIVE):
 - The user has the /pipeline/${ctx.folder} editor open. A pipeline is a DAG of scripts (nodes) connected by storage assets (DuckLake tables, data tables, S3 objects, volumes, resources) and execution triggers.
 - Annotations are top-of-file comments in the NODE'S OWN comment syntax: \`--\` for SQL (duckdb/postgresql), \`#\` for python3/bash, \`//\` for bun/TS. The \`//\` shown below is the TS form — translate it (a \`// pipeline\` line in a SQL node is a syntax error that won't deploy).
-- A script becomes a pipeline node when its source starts with the \`// pipeline\` annotation. Declare execution-DAG inputs with \`// on <asset-uri | schedule | webhook | email | kafka | mqtt | nats | postgres | sqs | gcp | data_upload>\` (e.g. \`// on ducklake://main/orders\`). Outputs are inferred from what the body writes (wmill SDK calls / SQL CREATE TABLE / writeS3File); declare a managed output with \`// materialize <asset-uri>\`. Optional badges: \`// partitioned <daily|hourly|weekly|monthly|dynamic>\`, \`// freshness <duration>\`, \`// tag <name>\`, \`// retry <count> [delay]\`, \`// data_test <kind> ...\`.
+- A script becomes a pipeline node when its source starts with the \`// pipeline\` annotation. Declare execution-DAG inputs with \`// on <asset-uri | schedule | webhook | email | kafka | mqtt | nats | postgres | sqs | gcp | data_upload>\` (e.g. \`// on ducklake://main/orders\`). Outputs are inferred from what the body writes (wmill SDK calls / SQL CREATE TABLE / writeS3File); declare a managed output with \`// materialize <asset-uri>\`. Optional badges: \`// partitioned <daily|hourly|weekly|monthly|dynamic>\`, \`// freshness <duration>\`, \`// tag <name>\`, \`// retry <count> [delay]\`, \`// data_test <kind> ...\`, \`// measure <name> = <agg> [where <pred>]\`, \`// dimension <name> = <expr>\`.
 - \`materialize\` (the managed output): \`// materialize <asset-uri>\` means the runtime writes the node's output table FOR you — write the body as a single SELECT and the runtime wraps it in the create/replace, so do NOT also write your own CREATE TABLE / INSERT. IMPORTANT: \`// materialize\` is **DuckDB-only** and its target MUST be a DuckLake table (\`ducklake://<name>/<table>\`) — deploy rejects it on any other language or target. For a \`python3\`/\`bun\`/\`postgresql\` node, do NOT use \`// materialize\`; write the output via the SDK instead (e.g. \`wmill.writeS3File(...)\`, a \`CREATE TABLE\` in postgresql, or \`wmill.databaseUrlFromResource\`/ducklake helpers) and let the output be inferred. Reach for \`duckdb\` when a node should materialize a DuckLake table. Write strategy: with no option it REPLACES the whole table each run (full refresh; the only mode whose output columns may change); \`// materialize <uri> append\` INSERT-appends rows (incremental); \`// materialize <uri> key=<col>\` merges/upserts on \`<col>\`. \`// materialize manual <uri>\` opts OUT of managed writes — the script writes its own DDL and the annotation only records the output asset for lineage. \`materialize\` is paired with partitioning for incremental pipelines: a \`// partitioned <daily|hourly|weekly|monthly|dynamic>\` node runs once per partition (append/merge into a fixed-schema table), and the \`{partition}\` token — usable in any asset URI AND in the body SQL — is substituted with the current partition's IDENTITY string at run time. To filter the source to the active slice on a time grain, use the runtime-injected macro: \`WHERE wm_partition(<ts_col>) = {partition}\`. \`wm_partition(ts)\` buckets a timestamp with the exact identity format the runtime used (daily/hourly/weekly/monthly), so it always matches and you never hand-write a \`strftime\` format. Do NOT write \`= TIMESTAMP {partition}\`: the identity string is not a valid timestamp literal for hourly/weekly/monthly and errors at runtime. For \`dynamic\` partitioning the identity is your caller-supplied key (not a timestamp, no macro), so filter on it directly: \`WHERE <your_key_col> = {partition}\`. \`materialize\` is an output DECLARATION on the node — it is not a command; there is no "materialize run".
+- \`measure\` / \`dimension\` (declared metrics): on a node that materializes a DuckLake table, \`// measure <name> = <aggregate> [where <predicate>]\` names the canonical way to aggregate that table (e.g. \`// measure revenue = sum(amount) where not is_refund\`), and \`// dimension <name> = <expr>\` names a way to slice it (e.g. \`// dimension region = region\`, \`// dimension month = date_trunc('month', ordered_at)\`). They execute nothing: they are catalogued at deploy so the editor and other agents can reuse the definition instead of re-deriving it and silently disagreeing. Keep the predicate in the \`where\` clause rather than folding it into the aggregate: it is rendered as \`<agg> FILTER (WHERE <pred>)\`, which is what lets two measures with different predicates sit under one GROUP BY. DuckLake-only, and only meaningful next to \`// materialize\`. Declare one when a number carries a judgement call someone else would get wrong (refunds excluded, test rows dropped, which column is the amount); do NOT blanket every table with measures, an obvious \`count(*)\` earns nothing. To USE a metric another node declares, read that node with read_pipeline_node and reuse its exact expression rather than guessing it.
 - Use get_pipeline_graph to see the current nodes/assets/triggers, and read_pipeline_node before editing one.
 - Build new nodes with build_pipeline_node and edit existing ones with edit_pipeline_node. These apply directly as unsaved drafts on the canvas (like the flow/script editor applies AI edits) — they DO NOT deploy. There is no separate Accept/Reject step. Prefer these over the generic write_script/edit_script draft tools while a pipeline is open.
 - Reuse existing asset paths from the graph when wiring a downstream node to an upstream one (read the upstream's write asset, then \`// on\` that same URI).
diff --git a/frontend/src/lib/components/custom_ui.ts b/frontend/src/lib/components/custom_ui.ts
index 917cd8714d..041c2dd23a 100644
--- a/frontend/src/lib/components/custom_ui.ts
+++ b/frontend/src/lib/components/custom_ui.ts
@@ -122,6 +122,7 @@ export type EditorBarUi = {
 	s3object?: boolean
 	database?: boolean
 	ducklake?: boolean
+	metrics?: boolean
 	dataTable?: boolean
 	debug?: boolean
 	history?: boolean
diff --git a/frontend/src/lib/components/metrics/MetricsDrawer.svelte b/frontend/src/lib/components/metrics/MetricsDrawer.svelte
new file mode 100644
index 0000000000..cdc640fba8
--- /dev/null
+++ b/frontend/src/lib/components/metrics/MetricsDrawer.svelte
@@ -0,0 +1,378 @@
+<script lang="ts">
+	import { Drawer, DrawerContent, Button, ClearableInput } from '$lib/components/common'
+	import Toggle from '$lib/components/Toggle.svelte'
+	import { DataMetricService, type DataMetric } from '$lib/gen'
+	import { workspaceStore } from '$lib/stores'
+	import { SvelteSet } from 'svelte/reactivity'
+	import {
+		attachAliasFor,
+		codeMentionsTable,
+		composeMetricSql,
+		DEFAULT_LAKE_ALIAS,
+		pickAttachAlias,
+		splitTablePath
+	} from './metricSql'
+	import { copyToClipboard } from '$lib/utils'
+	import { Copy, Play } from 'lucide-svelte'
+	import SqlRepl from '$lib/components/SqlRepl.svelte'
+	import SimpleAgTable from '$lib/components/SimpleAgTable.svelte'
+
+	let {
+		getCode,
+		onInsert,
+		workspace
+	}: {
+		getCode: () => string
+		onInsert: (sql: string) => void
+		workspace?: string
+	} = $props()
+
+	let ws = $derived(workspace ?? $workspaceStore)
+
+	let drawer: Drawer | undefined = $state()
+	let entries = $state<DataMetric[]>([])
+	let loading = $state(false)
+	let loaded = $state(false)
+	let selectedTable = $state<string | undefined>(undefined)
+	// Snapshotted on open so the composed snippet is stable while the drawer is up.
+	let codeAtOpen = $state('')
+	// Selections are held per declaration, not per name: two live producers may
+	// declare the same name on one table, and keying by name alone would make
+	// toggling either one select both. Selections survive a table switch, which is
+	// harmless because `sql` only ever reads the current table's declarations.
+	const selectedMeasures = new SvelteSet<string>()
+	const selectedDims = new SvelteSet<string>()
+
+	function idOf(m: DataMetric): string {
+		return `${m.script_path}|${m.name}`
+	}
+
+	// Name filters, shown only past a threshold so a small catalog stays a plain,
+	// scannable list. The table filter is cleared implicitly by narrowing; the metric
+	// filter is reset on table switch (a name from one table rarely fits another).
+	let tableFilter = $state('')
+	let metricFilter = $state('')
+	const TABLE_FILTER_MIN = 12
+	const METRIC_FILTER_MIN = 8
+
+	function nameMatches(name: string, filter: string): boolean {
+		return name.toLowerCase().includes(filter.trim().toLowerCase())
+	}
+
+	let tables = $derived([...new Set(entries.map((e) => e.table_path))])
+	let shownTables = $derived(
+		tableFilter.trim() ? tables.filter((t) => nameMatches(t, tableFilter)) : tables
+	)
+	let current = $derived(entries.filter((e) => e.table_path === selectedTable))
+	// Full table sets drive selection and SQL composition; the `shown*` derivations
+	// only narrow what renders, so filtering never drops an already-checked metric.
+	let measures = $derived(current.filter((m) => m.kind === 'measure'))
+	let dimensions = $derived(current.filter((m) => m.kind === 'dimension'))
+	let shownMeasures = $derived(
+		metricFilter.trim() ? measures.filter((m) => nameMatches(m.name, metricFilter)) : measures
+	)
+	let shownDimensions = $derived(
+		metricFilter.trim() ? dimensions.filter((d) => nameMatches(d.name, metricFilter)) : dimensions
+	)
+
+	function build(existingAlias: string | undefined, attachAs: string): string {
+		if (!selectedTable) return ''
+		const ms = measures.filter((m) => selectedMeasures.has(idOf(m)))
+		const ds = dimensions.filter((d) => selectedDims.has(idOf(d)))
+		if (ms.length === 0 && ds.length === 0) return ''
+		return composeMetricSql({
+			tablePath: selectedTable,
+			measures: ms,
+			dimensions: ds,
+			existingAlias,
+			attachAs
+		})
+	}
+
+	// Only consulted when inserting an ATTACH of our own, which happens only if the
+	// script has no alias for this lake. Every candidate is checked, since a blind
+	// fallback can land on a name the script has already attached something under.
+	let insertAttachAs = $derived.by(() => {
+		const parts = selectedTable ? splitTablePath(selectedTable) : undefined
+		if (!parts) return DEFAULT_LAKE_ALIAS
+		return pickAttachAlias(codeAtOpen, parts.lake)
+	})
+
+	// The alias this script already attaches the lake under, if any.
+	let existingAlias = $derived.by(() => {
+		const parts = selectedTable ? splitTablePath(selectedTable) : undefined
+		return parts ? attachAliasFor(codeAtOpen, parts.lake) : undefined
+	})
+
+	// Shown and copied: a complete standalone query, attaching the lake under `dl`.
+	// Inserting adapts it instead, because repeating an ATTACH the script already
+	// has would not run.
+	let sql = $derived(build(undefined, DEFAULT_LAKE_ALIAS))
+	let insertSql = $derived(build(existingAlias, insertAttachAs))
+	let insertAdapts = $derived(!!existingAlias && insertSql !== sql)
+
+	// The REPL wraps whatever it runs in `ATTACH 'ducklake://<lake>' AS dl; USE dl;`,
+	// so it wants the query qualified with `dl` and carrying no ATTACH of its own.
+	let replSql = $derived(build(DEFAULT_LAKE_ALIAS, DEFAULT_LAKE_ALIAS))
+	let lake = $derived(selectedTable ? splitTablePath(selectedTable)?.lake : undefined)
+	let repl: SqlRepl | undefined = $state()
+	// Results tagged with the query that produced them (the REPL reports which code
+	// it ran). Staleness is then a render check (`preview.sql === replSql`): when the
+	// selection changes the shown results no longer match and vanish, and a late
+	// response for a superseded query is discarded rather than shown under the new
+	// selection — no effect needed to clear it.
+	let preview = $state<{ sql: string; data: Record<string, any>[] } | undefined>(undefined)
+
+	function runPreview() {
+		preview = undefined
+		repl?.setCode(replSql)
+	}
+
+	// One page's worth; the endpoint caps `per_page` at 1000. Larger catalogs are
+	// walked page by page via the keyset cursor below.
+	const PER_PAGE = 1000
+	// Hard stop against a runaway loop; each page advances the cursor, so a real
+	// catalog exhausts (the server drops `next_cursor`) long before this.
+	const MAX_PAGES = 1000
+
+	// The trigger lives in the editor bar, which places it either among the buttons
+	// or inside the compact Helpers menu.
+	export async function open() {
+		codeAtOpen = getCode()
+		drawer?.openDrawer()
+		loading = true
+		try {
+			const all: DataMetric[] = []
+			// Resume each page from the cursor the server hands back; every row it
+			// returns is authorized, so stop once no cursor comes back.
+			let cursor:
+				| { table_path: string; kind: string; name: string; script_path: string }
+				| undefined
+			for (let i = 0; i < MAX_PAGES; i++) {
+				const res = await DataMetricService.listDataMetrics({
+					workspace: ws!,
+					perPage: PER_PAGE,
+					cursorTable: cursor?.table_path,
+					cursorKind: cursor?.kind,
+					cursorName: cursor?.name,
+					cursorScript: cursor?.script_path
+				})
+				all.push(...res.metrics)
+				if (!res.next_cursor) break
+				cursor = res.next_cursor
+			}
+			entries = all
+		} catch (err) {
+			console.error("Couldn't load declared metrics", err)
+			entries = []
+		} finally {
+			loading = false
+			loaded = true
+		}
+		if (!selectedTable || !tables.includes(selectedTable)) {
+			// Prefer a table the open script already references.
+			selectedTable = tables.find((t) => codeMentionsTable(codeAtOpen, t)) ?? tables[0]
+		}
+	}
+
+	function toggle(set: SvelteSet<string>, id: string) {
+		if (set.has(id)) {
+			set.delete(id)
+		} else {
+			set.add(id)
+		}
+	}
+
+	function definition(m: DataMetric): string {
+		return m.filter ? `${m.expr} where ${m.filter}` : m.expr
+	}
+
+	// Counts per table in one pass, so rendering T tables over N declarations is
+	// O(N) rather than O(T*N) filters.
+	let countByTable = $derived.by(() => {
+		const counts = new Map<string, { m: number; d: number }>()
+		for (const e of entries) {
+			const c = counts.get(e.table_path) ?? { m: 0, d: 0 }
+			if (e.kind === 'measure') c.m++
+			else c.d++
+			counts.set(e.table_path, c)
+		}
+		return counts
+	})
+</script>
+
+<Drawer bind:this={drawer} size="700px">
+	<DrawerContent title="Metrics" on:close={() => drawer?.closeDrawer()}>
+		<div class="flex flex-col gap-4">
+			<p class="text-xs text-tertiary">
+				Declared with <code>// measure</code> and <code>// dimension</code> on the script that materializes
+				the table. Inserting writes plain SQL you can edit.
+			</p>
+
+			{#if loading}
+				<span class="text-xs text-tertiary">Loading…</span>
+			{:else if loaded && tables.length === 0}
+				<div class="flex flex-col gap-1 rounded-md border p-3">
+					<span class="text-sm">No metrics declared yet</span>
+					<span class="text-xs text-tertiary">
+						Add <code>// measure revenue = sum(amount) where not is_refund</code> next to a script's
+						<code>// materialize</code> annotation, then deploy it.
+					</span>
+				</div>
+			{/if}
+
+			{#if tables.length > 0}
+				<div>
+					<div class="mb-1 text-xs font-medium text-secondary">
+						{tables.length === 1 ? 'Table' : `Tables with metrics (${tables.length})`}
+					</div>
+					{#if tables.length > TABLE_FILTER_MIN}
+						<div class="mb-1">
+							<ClearableInput
+								bind:value={tableFilter}
+								placeholder="Filter tables…"
+								inputClass="text-xs"
+							/>
+						</div>
+					{/if}
+					<!-- Laid out as visible choices rather than a dropdown: browsing what
+					     else is declared is the point, and a filter appears once there are
+					     enough tables to warrant one. -->
+					<div class="flex flex-wrap gap-1">
+						{#each shownTables as t (t)}
+							<Button
+								size="xs"
+								variant={t === selectedTable ? 'accent' : 'subtle'}
+								onclick={() => {
+									selectedTable = t
+									metricFilter = ''
+								}}
+							>
+								<span class="font-mono text-xs">{t}</span>
+								<span class="ml-1 text-xs opacity-60">
+									{countByTable.get(t)?.m ?? 0}m / {countByTable.get(t)?.d ?? 0}d
+								</span>
+							</Button>
+						{/each}
+					</div>
+					{#if shownTables.length === 0}
+						<span class="text-xs text-tertiary">No table matches “{tableFilter}”</span>
+					{/if}
+				</div>
+			{/if}
+
+			{#if measures.length + dimensions.length > METRIC_FILTER_MIN}
+				<ClearableInput
+					bind:value={metricFilter}
+					placeholder="Filter measures and dimensions by name…"
+					inputClass="text-xs"
+				/>
+			{/if}
+
+			{#if shownMeasures.length > 0}
+				<div>
+					<div class="mb-1 text-xs font-medium text-secondary">Measures</div>
+					<div class="flex flex-col gap-1">
+						{#each shownMeasures as m (idOf(m))}
+							<div class="flex items-center gap-2">
+								<Toggle
+									size="xs"
+									options={{ right: m.name }}
+									checked={selectedMeasures.has(idOf(m))}
+									on:change={() => toggle(selectedMeasures, idOf(m))}
+								/>
+								<span class="truncate font-mono text-xs text-tertiary" title={definition(m)}>
+									= {definition(m)}
+								</span>
+							</div>
+						{/each}
+					</div>
+				</div>
+			{/if}
+
+			{#if shownDimensions.length > 0}
+				<div>
+					<div class="mb-1 text-xs font-medium text-secondary">Group by</div>
+					<div class="flex flex-col gap-1">
+						{#each shownDimensions as d (idOf(d))}
+							<div class="flex items-center gap-2">
+								<Toggle
+									size="xs"
+									options={{ right: d.name }}
+									checked={selectedDims.has(idOf(d))}
+									on:change={() => toggle(selectedDims, idOf(d))}
+								/>
+								<span class="truncate font-mono text-xs text-tertiary" title={d.expr}>
+									= {d.expr}
+								</span>
+							</div>
+						{/each}
+					</div>
+				</div>
+			{/if}
+
+			{#if metricFilter.trim() && shownMeasures.length === 0 && shownDimensions.length === 0 && measures.length + dimensions.length > 0}
+				<span class="text-xs text-tertiary">No metric matches “{metricFilter}”</span>
+			{/if}
+
+			{#if sql}
+				<div>
+					<div class="mb-1 flex items-center justify-between">
+						<span class="text-xs font-medium text-secondary">SQL</span>
+						<div class="flex items-center gap-1">
+							<Button
+								size="xs"
+								variant="subtle"
+								startIcon={{ icon: Play }}
+								disabled={!lake || !replSql}
+								onclick={runPreview}>Try it</Button
+							>
+							<Button
+								size="xs"
+								variant="subtle"
+								startIcon={{ icon: Copy }}
+								onclick={() => copyToClipboard(sql)}>Copy</Button
+							>
+						</div>
+					</div>
+					<pre class="overflow-x-auto rounded-md bg-surface-secondary p-2 text-xs whitespace-pre"
+						>{sql}</pre
+					>
+					{#if insertAdapts}
+						<div class="mt-1 text-xs text-tertiary">
+							Inserting reuses this script's existing <span class="font-mono">{existingAlias}</span>
+							attachment and leaves out the ATTACH.
+						</div>
+					{/if}
+				</div>
+			{/if}
+
+			{#if lake}
+				<div>
+					<div class="mb-1 text-xs font-medium text-secondary">Try it</div>
+					<div class="h-64 rounded-md border">
+						<SqlRepl
+							bind:this={repl}
+							input={{ type: 'ducklake', ducklake: lake }}
+							workspace={ws}
+							onData={(d, ranCode) => (preview = { sql: ranCode, data: d })}
+						/>
+					</div>
+					{#if preview && preview.sql === replSql}
+						<!-- ag-grid measures itself against its container, so the height
+						     has to be explicit or the table renders collapsed. -->
+						<div class="mt-2 h-64">
+							<SimpleAgTable data={preview.data} />
+						</div>
+					{/if}
+				</div>
+			{/if}
+		</div>
+
+		{#snippet actions()}
+			<Button disabled={!insertSql} onclick={() => (onInsert(insertSql), drawer?.closeDrawer())}>
+				Insert
+			</Button>
+		{/snippet}
+	</DrawerContent>
+</Drawer>
diff --git a/frontend/src/lib/components/metrics/metricSql.test.ts b/frontend/src/lib/components/metrics/metricSql.test.ts
new file mode 100644
index 0000000000..0d19344b21
--- /dev/null
+++ b/frontend/src/lib/components/metrics/metricSql.test.ts
@@ -0,0 +1,181 @@
+import { describe, expect, it } from 'vitest'
+import { attachAliasFor, attachAliasTaken, composeMetricSql, pickAttachAlias } from './metricSql'
+import type { DataMetric } from '$lib/gen'
+
+const revenue: DataMetric = {
+	script_path: 'f/metrics/orders',
+	table_path: 'sales/main.orders',
+	kind: 'measure',
+	name: 'revenue',
+	expr: 'sum(amount)',
+	filter: 'not is_refund'
+}
+const region: DataMetric = {
+	script_path: 'f/metrics/orders',
+	table_path: 'sales/main.orders',
+	kind: 'dimension',
+	name: 'region',
+	expr: 'region'
+}
+
+describe('attachAliasFor', () => {
+	it('ignores ATTACH-like text inside a string or dollar-quoted literal', () => {
+		// The `$$…$$` body is data, not a statement.
+		expect(
+			attachAliasFor("SELECT $$ATTACH 'ducklake://sales' AS ghost;$$;", 'sales')
+		).toBeUndefined()
+		expect(attachAliasTaken("SELECT $$ATTACH 'x.db' AS dl;$$;", 'dl')).toBe(false)
+		// A real ATTACH alongside literal noise is still found.
+		const code = "SELECT '--not an attach';\nATTACH 'ducklake://sales' AS dl;"
+		expect(attachAliasFor(code, 'sales')).toBe('dl')
+	})
+
+	it('ignores an ATTACH that is commented out, in any of the comment styles', () => {
+		for (const comment of ['--', '//']) {
+			const code = `${comment} ATTACH 'ducklake://sales' AS old;\nATTACH 'ducklake://sales' AS dl;`
+			expect(attachAliasFor(code, 'sales')).toBe('dl')
+		}
+		expect(attachAliasFor("/* ATTACH 'ducklake://sales' AS old; */", 'sales')).toBeUndefined()
+	})
+
+	it('resolves the default-lake shorthand, which refers to the lake named main', () => {
+		expect(attachAliasFor("ATTACH 'ducklake' AS dl;", 'main')).toBe('dl')
+		expect(attachAliasFor("ATTACH 'ducklake://main' AS dl;", 'main')).toBe('dl')
+		// The shorthand must not be read as an attachment of some other lake.
+		expect(attachAliasFor("ATTACH 'ducklake' AS dl;", 'sales')).toBeUndefined()
+	})
+
+	it('matches the lake name case-sensitively, unlike the SQL keywords', () => {
+		// `sales` and `Sales` are distinct DuckLake configs.
+		expect(attachAliasFor("attach 'ducklake://sales' as dl;", 'sales')).toBe('dl')
+		expect(attachAliasFor("ATTACH 'ducklake://sales' AS dl;", 'Sales')).toBeUndefined()
+		expect(attachAliasFor("ATTACH 'ducklake://Sales' AS dl;", 'sales')).toBeUndefined()
+	})
+
+	it('does not treat mid-line // (integer division) as a comment', () => {
+		// `5 // 2` is division; the following ATTACH must still be found.
+		const code = "SELECT 5 // 2;\nATTACH 'ducklake://sales' AS dl;"
+		expect(attachAliasFor(code, 'sales')).toBe('dl')
+		// A leading `// materialize` annotation is still a comment.
+		expect(attachAliasFor("// materialize x\nATTACH 'ducklake://sales' AS dl;", 'sales')).toBe('dl')
+	})
+
+	it('reads a doubled-quote alias as one identifier', () => {
+		expect(attachAliasFor(`ATTACH 'ducklake://sales' AS "a""b";`, 'sales')).toBe('a"b')
+	})
+
+	it('does not let a backslash-ending literal hide a following ATTACH', () => {
+		// `'C:\'` is a complete SQL literal (quotes escape by doubling, not `\`); the
+		// ATTACH after it must still be found, and its alias seen as taken.
+		const code = "SELECT 'C:\\';\nATTACH 'ducklake://sales' AS dl;"
+		expect(attachAliasFor(code, 'sales')).toBe('dl')
+		expect(attachAliasTaken(code, 'dl')).toBe(true)
+		// A doubled quote embeds a literal quote without ending the string.
+		expect(attachAliasFor("SELECT 'a''b';\nATTACH 'ducklake://sales' AS dl;", 'sales')).toBe('dl')
+	})
+
+	it('recognizes the optional ATTACH DATABASE keyword', () => {
+		expect(attachAliasFor("ATTACH DATABASE 'ducklake://sales' AS dl;", 'sales')).toBe('dl')
+		expect(attachAliasTaken("ATTACH DATABASE 'x.db' AS dl;", 'dl')).toBe(true)
+	})
+
+	it('reads a quoted alias whole, including one containing a space', () => {
+		expect(attachAliasFor(`ATTACH 'ducklake://sales' AS "my dl";`, 'sales')).toBe('my dl')
+		expect(attachAliasFor(`ATTACH 'ducklake://sales' AS dl;`, 'sales')).toBe('dl')
+	})
+})
+
+describe('pickAttachAlias', () => {
+	it('skips aliases already attached, whatever they are attached to', () => {
+		expect(pickAttachAlias('SELECT 1;', 'sales')).toBe('dl')
+		// `dl` taken by another lake: fall back to the lake's own name.
+		expect(pickAttachAlias("ATTACH 'ducklake://other' AS dl;", 'sales')).toBe('sales')
+		// Both taken, and the second by a non-DuckLake attachment, which occupies
+		// the alias just as effectively.
+		expect(
+			pickAttachAlias("ATTACH 'ducklake://other' AS dl;\nATTACH 'foo.db' AS sales;", 'sales')
+		).toBe('dl2')
+	})
+
+	it('does not treat a longer alias as a match for a shorter one', () => {
+		expect(attachAliasTaken("ATTACH 'x.db' AS dl2;", 'dl')).toBe(false)
+	})
+})
+
+describe('attachAliasFor with tricky sources', () => {
+	it('still finds a real attachment when a literal contains comment markers', () => {
+		const code = "SELECT '--not a comment';\nATTACH 'ducklake://sales' AS dl;"
+		expect(attachAliasFor(code, 'sales')).toBe('dl')
+	})
+})
+
+describe('composeMetricSql', () => {
+	it('qualifies the table with the alias the script already attached the lake under', () => {
+		// DuckDB names the catalog after the ATTACH alias, so qualifying with the
+		// lake name would not resolve against a script that attached it as `dl`.
+		const code = "ATTACH 'ducklake://sales' AS dl;\nSELECT 1;"
+		const sql = composeMetricSql({
+			tablePath: 'sales/main.orders',
+			measures: [revenue],
+			dimensions: [],
+			existingAlias: attachAliasFor(code, 'sales')
+		})
+		expect(sql).toContain('FROM "dl"."main"."orders"')
+		expect(sql).not.toContain('ATTACH')
+	})
+
+	it('attaches the lake under the conventional dl alias when the script has none', () => {
+		const sql = composeMetricSql({
+			tablePath: 'sales/main.orders',
+			measures: [revenue],
+			dimensions: [],
+			existingAlias: attachAliasFor('SELECT 1;', 'sales')
+		})
+		expect(sql).toContain(`ATTACH 'ducklake://sales' AS "dl";`)
+		expect(sql).toContain('FROM "dl"."main"."orders"')
+	})
+
+	it('falls back to the lake name when the script already binds dl elsewhere', () => {
+		const code = "ATTACH 'ducklake://other' AS dl;"
+		const sql = composeMetricSql({
+			tablePath: 'sales/main.orders',
+			measures: [revenue],
+			dimensions: [],
+			existingAlias: attachAliasFor(code, 'sales'),
+			attachAs: attachAliasTaken(code, 'dl') ? 'sales' : 'dl'
+		})
+		expect(sql).toContain(`ATTACH 'ducklake://sales' AS "sales";`)
+		expect(sql).toContain('FROM "sales"."main"."orders"')
+	})
+
+	it('quotes every generated identifier, so reserved words are safe', () => {
+		const reservedMeasure: DataMetric = {
+			...revenue,
+			name: 'select',
+			expr: 'count(*)',
+			filter: undefined
+		}
+		const reservedDim: DataMetric = { ...region, name: 'group', expr: 'region' }
+		const sql = composeMetricSql({
+			// `order` is a reserved word, and so is the `select`/`group` naming below.
+			tablePath: 'sales/main.order',
+			measures: [reservedMeasure],
+			dimensions: [reservedDim],
+			existingAlias: 'dl'
+		})
+		expect(sql).toContain('AS "select"')
+		expect(sql).toContain('AS "group"')
+		expect(sql).toContain('FROM "dl"."main"."order"')
+	})
+
+	it('renders a measure predicate as FILTER so measures can share one GROUP BY', () => {
+		const sql = composeMetricSql({
+			tablePath: 'sales/main.orders',
+			measures: [revenue],
+			dimensions: [region],
+			existingAlias: 'dl'
+		})
+		expect(sql).toContain('sum(amount) FILTER (WHERE not is_refund) AS "revenue"')
+		expect(sql).toContain('GROUP BY 1')
+	})
+})
diff --git a/frontend/src/lib/components/metrics/metricSql.ts b/frontend/src/lib/components/metrics/metricSql.ts
new file mode 100644
index 0000000000..7cce1c2075
--- /dev/null
+++ b/frontend/src/lib/components/metrics/metricSql.ts
@@ -0,0 +1,182 @@
+import type { DataMetric } from '$lib/gen'
+import { splitSqlStatements, stripSqlComments } from '../sqlDdl'
+
+function quoteIdent(name: string): string {
+	return `"${name.replaceAll('"', '""')}"`
+}
+
+/**
+ * All generated identifiers are quoted. Quoting conditionally would mean tracking
+ * DuckDB's reserved-word set, which shifts between versions: a name like `select`,
+ * `order` or `lambda` is rejected bare, and a list that misses one silently emits
+ * invalid SQL. Quoting always is version-proof and needs no maintenance.
+ */
+function ident(name: string): string {
+	return quoteIdent(name)
+}
+
+/**
+ * Alias used when the snippet attaches the lake itself. `dl` is the convention
+ * across the codebase's DuckLake scripts; the lake's own name is only a fallback
+ * for when the script already binds `dl` to a different lake.
+ */
+export const DEFAULT_LAKE_ALIAS = 'dl'
+
+function escapeRegex(s: string): string {
+	return s.replaceAll(/[.*+?^${}()|[\]\\]/g, '\\$&')
+}
+
+type TableParts = { lake: string; schema: string; table: string }
+
+/** Splits `<lake>/<table>` or `<lake>/<schema>.<table>`, defaulting the schema. */
+export function splitTablePath(tablePath: string): TableParts | undefined {
+	const path = tablePath.startsWith('ducklake://')
+		? tablePath.slice('ducklake://'.length)
+		: tablePath
+	const slash = path.indexOf('/')
+	if (slash < 0) return undefined
+	const lake = path.slice(0, slash)
+	const rest = path.slice(slash + 1)
+	const dot = rest.indexOf('.')
+	const schema = dot < 0 ? 'main' : rest.slice(0, dot)
+	const table = dot < 0 ? rest : rest.slice(dot + 1)
+	if (!lake || !table) return undefined
+	return { lake, schema, table }
+}
+
+/**
+ * The alias `code` attaches `lake` under, if it attaches it at all.
+ *
+ * DuckDB names the catalog after the ATTACH alias, not after the lake, and the
+ * prevailing convention is an arbitrary short alias (`AS dl`). Qualifying a table
+ * with the lake name would therefore fail against most real scripts.
+ *
+ * `ATTACH 'ducklake'` with no `://` part refers to the lake named `main`, so that
+ * shorthand has to resolve here too or a `main` table gets a redundant second
+ * attachment under a different alias.
+ */
+// SQL statements, comments stripped, split on real (non-literal) `;`. Matching
+// ATTACH per statement (anchored at its start) ignores attachment-like text
+// buried in a string or dollar-quoted literal, e.g. `SELECT $$ATTACH … AS x$$`.
+// `false` selects standard-SQL string quoting: this is DuckDB, where `\` is data
+// (so a `'C:\'` literal does not swallow the following ATTACH) and quotes double.
+function statements(code: string): string[] {
+	return splitSqlStatements(stripSqlComments(code, true, false), false).map((s) => s.trim())
+}
+
+export function attachAliasFor(code: string, lake: string): string | undefined {
+	// SQL keywords match case-insensitively; the lake name must not. DuckLake
+	// config keys are case-sensitive, so `sales` and `Sales` are different lakes,
+	// and folding them would reuse an alias bound to the wrong one. So the URI is
+	// captured and compared exactly. A `ducklake` with no `://` refers to `main`.
+	// A quoted alias may contain doubled quotes (`"a""b"` = the identifier `a"b`);
+	// capture the whole quoted run and unescape, and require an unquoted alias to
+	// end on a token boundary.
+	const re =
+		/^ATTACH\s+(?:DATABASE\s+)?(?:IF\s+NOT\s+EXISTS\s+)?'ducklake(:\/\/[^']*)?'\s+AS\s+(?:"((?:[^"]|"")*)"|([A-Za-z_][\w$]*))(?![\w$])/i
+	for (const stmt of statements(code)) {
+		const m = re.exec(stmt)
+		if (m) {
+			const attachedLake = m[1] ? m[1].slice('://'.length) : 'main'
+			if (attachedLake === lake) {
+				return m[2] !== undefined ? m[2].replaceAll('""', '"') : m[3]
+			}
+		}
+	}
+	return undefined
+}
+
+/**
+ * Whether `code` already attaches anything under `alias`. Deliberately not
+ * limited to DuckLake: a SQLite or Postgres attachment occupies the alias just
+ * as effectively, and re-using it would fail on the duplicate name.
+ */
+export function attachAliasTaken(code: string, alias: string): boolean {
+	const re = new RegExp(
+		`^ATTACH\\s+(?:DATABASE\\s+)?(?:IF\\s+NOT\\s+EXISTS\\s+)?'[^']*'\\s+AS\\s+"?${escapeRegex(alias)}"?(?![\\w$])`,
+		'i'
+	)
+	return statements(code).some((stmt) => re.test(stmt))
+}
+
+/**
+ * First alias not already attached in `code`: the conventional `dl`, then the
+ * lake's own name, then numbered variants. Checking each matters because falling
+ * back blindly can land on a name that is itself taken.
+ */
+export function pickAttachAlias(code: string, lake: string): string {
+	if (!attachAliasTaken(code, DEFAULT_LAKE_ALIAS)) return DEFAULT_LAKE_ALIAS
+	if (!attachAliasTaken(code, lake)) return lake
+	// Unbounded on purpose, and it terminates: a finite script can only occupy
+	// finitely many aliases, so some `dlN` is always free. Returning a taken one
+	// instead would emit an ATTACH that fails on the duplicate name.
+	let n = 2
+	while (attachAliasTaken(code, `${DEFAULT_LAKE_ALIAS}${n}`)) n += 1
+	return `${DEFAULT_LAKE_ALIAS}${n}`
+}
+
+/**
+ * Whether `code` looks like it references this table. Used only to preselect a
+ * table in the picker, so a false positive costs nothing.
+ */
+export function codeMentionsTable(code: string, tablePath: string): boolean {
+	const parts = splitTablePath(tablePath)
+	if (!parts) return false
+	return new RegExp(`\\b${escapeRegex(parts.table)}\\b`, 'i').test(code)
+}
+
+/**
+ * A measure renders as its declared aggregate plus, when it carries a predicate,
+ * a trailing `FILTER (WHERE …)`. FILTER rather than a shared `WHERE` is what lets
+ * measures with different predicates sit under one GROUP BY.
+ */
+function measureExpr(m: DataMetric): string {
+	return m.filter ? `${m.expr} FILTER (WHERE ${m.filter})` : m.expr
+}
+
+/**
+ * Composes a plain SELECT from a metric selection. The result is ordinary
+ * editable SQL: nothing re-reads or rewrites it later, so a user is free to
+ * change it after inserting.
+ */
+export function composeMetricSql(opts: {
+	tablePath: string
+	measures: DataMetric[]
+	dimensions: DataMetric[]
+	/**
+	 * The alias the script already attaches this lake under. When absent the
+	 * snippet attaches the lake itself under `attachAs`.
+	 */
+	existingAlias?: string
+	/** Alias to attach under when the script has none. Defaults to `dl`. */
+	attachAs?: string
+}): string {
+	const { tablePath, measures, dimensions, existingAlias, attachAs } = opts
+	const parts = splitTablePath(tablePath)
+	if (!parts) return ''
+	// Qualify with the alias in force, so the snippet resolves against the
+	// catalog the script actually has attached.
+	const catalog = existingAlias ?? attachAs ?? DEFAULT_LAKE_ALIAS
+	const tableRef = `${ident(catalog)}.${ident(parts.schema)}.${ident(parts.table)}`
+
+	const selected = [
+		...dimensions.map((d) => `  ${d.expr} AS ${ident(d.name)}`),
+		...measures.map((m) => `  ${measureExpr(m)} AS ${ident(m.name)}`)
+	]
+
+	const lines: string[] = []
+	if (!existingAlias) {
+		// Escape the lake as a SQL string literal. The deploy path already rejects
+		// unsafe names, but the composed query is copied and run standalone, so it
+		// must not trust the catalog value blindly.
+		const lakeLiteral = parts.lake.replaceAll("'", "''")
+		lines.push(`ATTACH 'ducklake://${lakeLiteral}' AS ${ident(catalog)};`, '')
+	}
+	lines.push('SELECT', selected.join(',\n'), `FROM ${tableRef}`)
+	if (dimensions.length > 0) {
+		// Group by ordinal so a dimension expression is written once.
+		const ordinals = dimensions.map((_, i) => i + 1).join(', ')
+		lines.push(`GROUP BY ${ordinals}`, `ORDER BY ${ordinals}`)
+	}
+	return lines.join('\n')
+}
diff --git a/frontend/src/lib/components/sqlDdl.test.ts b/frontend/src/lib/components/sqlDdl.test.ts
new file mode 100644
index 0000000000..806435a809
--- /dev/null
+++ b/frontend/src/lib/components/sqlDdl.test.ts
@@ -0,0 +1,69 @@
+import { describe, expect, it } from 'vitest'
+import { endsWithUnterminatedStatement, splitSqlStatements, stripSqlComments } from './sqlDdl'
+
+describe('endsWithUnterminatedStatement', () => {
+	it('reports a missing terminator on the final statement', () => {
+		expect(endsWithUnterminatedStatement('SELECT 1;')).toBe(false)
+		expect(endsWithUnterminatedStatement('SELECT 1')).toBe(true)
+		expect(endsWithUnterminatedStatement('')).toBe(false)
+	})
+
+	it('is not fooled by a trailing comment after the terminator', () => {
+		expect(endsWithUnterminatedStatement('SELECT 1;\n-- note')).toBe(false)
+		expect(endsWithUnterminatedStatement('SELECT 1\n-- note')).toBe(true)
+	})
+
+	it('treats terminators and comment markers inside quoted runs as data', () => {
+		expect(endsWithUnterminatedStatement("SELECT ';--literal'")).toBe(true)
+		expect(endsWithUnterminatedStatement("SELECT ';--literal';")).toBe(false)
+		// Dollar-quoted bodies protect their contents just as strings do.
+		expect(endsWithUnterminatedStatement('SELECT $$;--literal$$')).toBe(true)
+		expect(endsWithUnterminatedStatement('SELECT $$;--literal$$;')).toBe(false)
+		expect(endsWithUnterminatedStatement('SELECT $tag$;--x$tag$')).toBe(true)
+	})
+})
+
+describe('stripSqlComments', () => {
+	it('removes comments without touching quoted runs', () => {
+		expect(stripSqlComments('SELECT 1 -- note').trim()).toBe('SELECT 1')
+		expect(stripSqlComments("SELECT '--not a comment'").trim()).toBe("SELECT '--not a comment'")
+		expect(stripSqlComments('SELECT $$--not a comment$$').trim()).toBe('SELECT $$--not a comment$$')
+	})
+
+	it('only treats // as a comment when asked, and only at a line start', () => {
+		// `//` is division mid-line: never stripped, and not even when asked.
+		expect(stripSqlComments('SELECT 1 // note').trim()).toBe('SELECT 1 // note')
+		expect(stripSqlComments('SELECT 5 // 2', true).trim()).toBe('SELECT 5 // 2')
+		// A `//` that opens a line is a Windmill annotation header.
+		expect(stripSqlComments('// materialize x\nSELECT 1', true).trim()).toBe('SELECT 1')
+	})
+})
+
+describe('splitSqlStatements', () => {
+	it('keeps splitting behaviour intact through the shared scan', () => {
+		expect(splitSqlStatements('SELECT 1; SELECT 2;')).toEqual(['SELECT 1', 'SELECT 2'])
+		expect(splitSqlStatements("SELECT ';'; SELECT 2")).toEqual(["SELECT ';'", 'SELECT 2'])
+		expect(splitSqlStatements('SELECT $$;$$;')).toEqual(['SELECT $$;$$'])
+	})
+
+	it('escapes quotes per dialect (backslashEscapes)', () => {
+		// Standard SQL (false): `\` is data, quotes escape by doubling. A `\`-ending
+		// literal is complete and a doubled quote embeds one, so neither splits.
+		expect(splitSqlStatements("SELECT 'C:\\'; SELECT 2", false)).toEqual([
+			"SELECT 'C:\\'",
+			'SELECT 2'
+		])
+		expect(splitSqlStatements("SELECT 'a''; b'", false)).toEqual(["SELECT 'a''; b'"])
+		// Even in standard mode a Postgres E-string backslash-escapes, so its `;` is data.
+		expect(splitSqlStatements("SELECT E'x: \\'; still data' AS v; SELECT 2", false)).toEqual([
+			"SELECT E'x: \\'; still data' AS v",
+			'SELECT 2'
+		])
+		// Backslash dialects (default, e.g. MySQL): an ordinary `\'` is an escaped
+		// quote, so the embedded `;` is data and the literal does not split.
+		expect(splitSqlStatements("SELECT 'it\\'s; still data' AS v; SELECT 2")).toEqual([
+			"SELECT 'it\\'s; still data' AS v",
+			'SELECT 2'
+		])
+	})
+})
diff --git a/frontend/src/lib/components/sqlDdl.ts b/frontend/src/lib/components/sqlDdl.ts
index 5897c08859..21e566390f 100644
--- a/frontend/src/lib/components/sqlDdl.ts
+++ b/frontend/src/lib/components/sqlDdl.ts
@@ -11,76 +11,158 @@ const DOLLAR_QUOTE_START = /^\$([A-Za-z_][A-Za-z0-9_]*)?\$/
 // this splits them while taking into account that ';' may appear inside a
 // string, quoted identifier, dollar-quoted body ($$ ... $$), or a comment
 // (-- ... or /* ... */) and is then not the end of a statement.
-export function splitSqlStatements(code: string): string[] {
+type SqlScan = {
+	statements: string[]
+	/** Source with comment bodies blanked out, quoted runs left intact. */
+	withoutComments: string
+	/** The final statement has real content but no closing `;`. */
+	unterminatedTail: boolean
+}
+
+// Single pass over a SQL script, aware of the regions where `;` and comment
+// markers are data rather than syntax: strings, quoted identifiers, backticks,
+// dollar-quoted bodies and comments. Everything that needs to reason about SQL
+// text shares this scan, so an edge case is fixed once.
+// Whether everything on `code`'s line before `i` is whitespace.
+function isLineStart(code: string, i: number): boolean {
+	for (let j = i - 1; j >= 0 && code[j] !== '\n'; j--) {
+		if (code[j] !== ' ' && code[j] !== '\t' && code[j] !== '\r') return false
+	}
+	return true
+}
+
+// `backslashEscapes` selects the string-literal dialect. MySQL (and the other
+// databases the datatable REPL talks to that keep it on) escape a quote inside an
+// ordinary `'…'` with a backslash, so it defaults to true to preserve that. Standard
+// SQL (Postgres/DuckDB) instead escapes by doubling and treats `\` as data — pass
+// false there — with backslash escapes still honored inside a Postgres `E'…'` literal.
+function scanSql(code: string, slashSlashComments = false, backslashEscapes = true): SqlScan {
 	const statements: string[] = []
 	let currentStatement = ''
+	let withoutComments = ''
+	let tailHasContent = false
 	let inSingleQuote = false
+	// The current single-quoted literal honors C-style backslash escapes: either the
+	// dialect backslash-escapes every literal, or this is a Postgres `E'…'` literal.
+	let inEscapeString = false
 	let inDoubleQuote = false
 	let inBacktick = false
 	let inLineComment = false
 	let inBlockComment = false
 	let dollarTag: string | null = null
 
+	// Real content: counts toward an unterminated tail and survives comment removal.
+	const keep = (text: string) => {
+		currentStatement += text
+		withoutComments += text
+		if (text.trim() !== '') tailHasContent = true
+	}
+	// Comment content: kept in the statement, dropped from `withoutComments`, and
+	// never marks the tail as real content.
+	const comment = (text: string) => {
+		currentStatement += text
+		withoutComments += ' '
+	}
+
 	for (let i = 0; i < code.length; i++) {
 		const char = code[i]
-		const prevChar = i > 0 ? code[i - 1] : null
 		const nextChar = i + 1 < code.length ? code[i + 1] : null
 
 		// Inside a protected region: append verbatim (';' is not a separator)
 		// and only watch for the region's end.
 		if (inLineComment) {
-			currentStatement += char
-			if (char === '\n') inLineComment = false
+			comment(char)
+			if (char === '\n') {
+				inLineComment = false
+				withoutComments += '\n'
+			}
 			continue
 		}
 		if (inBlockComment) {
 			// Look ahead for the close so the '*' of the opening '/*' can't be
 			// reused (e.g. `/*/` stays open).
 			if (char === '*' && nextChar === '/') {
-				currentStatement += '*/'
+				comment('*/')
 				i += 1
 				inBlockComment = false
 			} else {
-				currentStatement += char
+				comment(char)
 			}
 			continue
 		}
 		if (dollarTag !== null) {
 			if (char === '$' && code.startsWith(dollarTag, i)) {
-				currentStatement += dollarTag
+				keep(dollarTag)
 				i += dollarTag.length - 1
 				dollarTag = null
 			} else {
-				currentStatement += char
+				keep(char)
 			}
 			continue
 		}
 		if (inSingleQuote) {
-			currentStatement += char
-			if (char === "'" && prevChar !== '\\') inSingleQuote = false
+			keep(char)
+			// Ordinary literals escape a quote only by doubling it (`''`), so a
+			// `\`-ending literal like `'C:\'` is complete and `'a''b'` embeds one quote.
+			// Postgres `E'…'` literals ALSO take C-style backslash escapes, so there a
+			// `\` escapes the next char (e.g. `\'` stays inside the string). Getting
+			// this wrong splits one literal into a spurious extra statement — a
+			// DDL-guard false positive and an ATTACH-detection hazard.
+			if (inEscapeString && char === '\\' && nextChar != null) {
+				keep(nextChar)
+				i += 1
+			} else if (char === "'") {
+				if (nextChar === "'") {
+					keep(nextChar)
+					i += 1
+				} else {
+					inSingleQuote = false
+				}
+			}
 			continue
 		}
 		if (inDoubleQuote) {
-			currentStatement += char
-			if (char === '"' && prevChar !== '\\') inDoubleQuote = false
+			keep(char)
+			if (char === '"') {
+				if (nextChar === '"') {
+					keep(nextChar)
+					i += 1
+				} else {
+					inDoubleQuote = false
+				}
+			}
 			continue
 		}
 		if (inBacktick) {
-			currentStatement += char
-			if (char === '`' && prevChar !== '\\') inBacktick = false
+			keep(char)
+			if (char === '`') {
+				if (nextChar === '`') {
+					keep(nextChar)
+					i += 1
+				} else {
+					inBacktick = false
+				}
+			}
 			continue
 		}
 
 		// Not in any protected region: detect the start of one.
-		if (char === '-' && nextChar === '-') {
+		if (
+			(char === '-' && nextChar === '-') ||
+			// `//` is not SQL comment syntax (DuckDB uses it for integer division),
+			// so treat it as a comment only at a line's start, where Windmill's
+			// annotation headers (`// materialize`, `// measure`) live. `5 // 2` and a
+			// `ducklake://` scheme are mid-line and stay code.
+			(slashSlashComments && char === '/' && nextChar === '/' && isLineStart(code, i))
+		) {
 			inLineComment = true
-			currentStatement += char
+			comment(char)
 			continue
 		}
 		if (char === '/' && nextChar === '*') {
 			// Consume both chars so the '*' of '/*' can't double as a '*/' close.
 			inBlockComment = true
-			currentStatement += '/*'
+			comment('/*')
 			i += 1
 			continue
 		}
@@ -88,32 +170,37 @@ export function splitSqlStatements(code: string): string[] {
 			const m = DOLLAR_QUOTE_START.exec(code.slice(i))
 			if (m) {
 				dollarTag = m[0]
-				currentStatement += dollarTag
+				keep(dollarTag)
 				i += dollarTag.length - 1
 				continue
 			}
 		}
 		if (char === "'") {
 			inSingleQuote = true
-			currentStatement += char
+			// Backslash-escape this literal when the dialect does so for every string,
+			// or when it is a Postgres `E'…'`/`e'…'` escape literal.
+			inEscapeString = backslashEscapes || (i > 0 && (code[i - 1] === 'E' || code[i - 1] === 'e'))
+			keep(char)
 			continue
 		}
 		if (char === '"') {
 			inDoubleQuote = true
-			currentStatement += char
+			keep(char)
 			continue
 		}
 		if (char === '`') {
 			inBacktick = true
-			currentStatement += char
+			keep(char)
 			continue
 		}
 
 		if (char === ';') {
 			statements.push(currentStatement.trim())
 			currentStatement = ''
+			withoutComments += ';'
+			tailHasContent = false
 		} else {
-			currentStatement += char
+			keep(char)
 		}
 	}
 
@@ -121,7 +208,38 @@ export function splitSqlStatements(code: string): string[] {
 		statements.push(currentStatement.trim())
 	}
 
-	return statements.filter((s) => s.length > 0)
+	return {
+		statements: statements.filter((s) => s.length > 0),
+		withoutComments,
+		unterminatedTail: tailHasContent
+	}
+}
+
+export function splitSqlStatements(code: string, backslashEscapes = true): string[] {
+	return scanSql(code, false, backslashEscapes).statements
+}
+
+/**
+ * Whether the script's final statement is missing its `;`. Callers appending a
+ * new statement need this: a `--` or `;` inside a string or dollar-quoted body
+ * must not be mistaken for a comment or a terminator.
+ */
+export function endsWithUnterminatedStatement(code: string, backslashEscapes = true): boolean {
+	return scanSql(code, false, backslashEscapes).unterminatedTail
+}
+
+/**
+ * Source with comment bodies removed, quoted runs left intact. Set
+ * `slashSlashComments` for sources that may carry Windmill's `//` annotation
+ * headers, which are not SQL comments. Set `backslashEscapes` to false for
+ * standard-SQL (Postgres/DuckDB) sources where `\` is data, not an escape.
+ */
+export function stripSqlComments(
+	code: string,
+	slashSlashComments = false,
+	backslashEscapes = true
+): string {
+	return scanSql(code, slashSlashComments, backslashEscapes).withoutComments
 }
 
 export function pruneComments(code: string): string {
diff --git a/frontend/src/lib/mcpEndpointTools.ts b/frontend/src/lib/mcpEndpointTools.ts
index 336c24cefc..70dabb01f6 100644
--- a/frontend/src/lib/mcpEndpointTools.ts
+++ b/frontend/src/lib/mcpEndpointTools.ts
@@ -60,6 +60,48 @@ export const mcpEndpointTools: EndpointTool[] = [
         "required": [
                 "url"
         ]
+},
+        bodySchema: undefined,
+        queryFieldRenames: undefined,
+        bodyFieldRenames: undefined
+    },
+    {
+        name: "listDataMetrics",
+        description: "list declared measures and dimensions on DuckLake tables: Call this before writing any aggregate query over a DuckLake table. A declared measure is the canonical definition of that number, and reproducing it yourself will silently disagree with it (a `revenue` measure typically excludes refunds or test rows). Filter by `table` for one table's declarations, or by `path_prefix` (e.g. `f/analytics`) for everything declared under a folder; omit both to browse the whole catalog. Results are keyset-paged: a full page may mean more remain, so continue with the `cursor_*` params rather than assuming a measure does not exist. Use each returned `expr` verbatim, and when a measure has a `filter` write it as `expr FILTER (WHERE filter)` so measures with different predicates can share one GROUP BY. If a number you need has no declared measure, write your own aggregate as usual. Results are limited to declarations whose producing script the caller can read",
+        instructions: "",
+        path: "/w/{workspace}/data_metrics/list",
+        method: "GET",
+        pathParamsSchema: undefined,
+        queryParamsSchema: {
+        "type": "object",
+        "properties": {
+                "table": {
+                        "type": "string",
+                        "description": "DuckLake table path, with or without the `ducklake://` scheme"
+                },
+                "path_prefix": {
+                        "type": "string",
+                        "description": "Producing script path prefix, e.g. `f/analytics`"
+                },
+                "per_page": {
+                        "type": "integer",
+                        "description": "Results per page, capped at 1000 (default 1000)"
+                },
+                "cursor_table": {
+                        "type": "string",
+                        "description": "Keyset cursor. To page, pass the previous response's `next_cursor` fields back as `cursor_*`; all four move together, and are omitted for the first page. Continue whenever `next_cursor` is present. Every returned row is one the caller may read, so the cursor never names a hidden row.\n"
+                },
+                "cursor_kind": {
+                        "type": "string"
+                },
+                "cursor_name": {
+                        "type": "string"
+                },
+                "cursor_script": {
+                        "type": "string"
+                }
+        },
+        "required": []
 },
         bodySchema: undefined,
         queryFieldRenames: undefined,

From 39058c0a01c35cf553daae3af37c6d326a7c8763 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Tue, 21 Jul 2026 11:21:07 +0200
Subject: [PATCH 080/171] fix(postgres-triggers): enforce resource-path scopes
 on ancillary routes (#10222)

* fix(postgres-triggers): enforce resource-path scopes on slot/publication routes

The Postgres trigger ancillary routes (slot management, publication
management, version/logical-level checks, template script creation) relied
only on the route-level middleware, which validates the scope domain+action
but delegates resource-path enforcement to each handler. These handlers made
no check_scopes call, so a token scoped to one postgres resource path (e.g.
postgres_triggers:write:u/alice/*) could drive these endpoints against any
postgres resource in the workspace, including the destructive drop_slot_name
(pg_terminate_backend + pg_drop_replication_slot).

Add a check_scopes call at the top of each affected handler, before any
connection is opened, mirroring the generic trigger CRUD handlers. Read
endpoints require postgres_triggers:read:{path}; write endpoints require
postgres_triggers:write:{path}.

Fixes WIN-2213

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* docs: condense postgres_trigger_scope test module comment

Address Codex nit: state the durable constraint (mismatched scope must fail
before DB access) instead of narrating pre-fix behavior and change history.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 backend/tests/postgres_trigger_scope.rs       | 69 +++++++++++++++++++
 .../windmill-trigger-postgres/src/handler.rs  | 49 ++++++++++++-
 2 files changed, 116 insertions(+), 2 deletions(-)
 create mode 100644 backend/tests/postgres_trigger_scope.rs

diff --git a/backend/tests/postgres_trigger_scope.rs b/backend/tests/postgres_trigger_scope.rs
new file mode 100644
index 0000000000..1172e03ab6
--- /dev/null
+++ b/backend/tests/postgres_trigger_scope.rs
@@ -0,0 +1,69 @@
+//! Postgres-trigger ancillary handlers (slot / publication / version management)
+//! must reject a path-mismatched scoped token before opening any connection —
+//! the route-level middleware only checks the scope domain, so per-path
+//! enforcement lives in the handlers. Rejecting pre-connection is why these tests
+//! need no real Postgres resource.
+
+use axum::{extract::Path, Extension, Json};
+use sqlx::{Pool, Postgres};
+use windmill_api_auth::ApiAuthed;
+use windmill_common::{db::UserDB, error::Error};
+use windmill_trigger_postgres::{handler, Slot};
+
+fn scoped_authed(scopes: Vec<&str>) -> ApiAuthed {
+    ApiAuthed {
+        email: "alice@windmill.dev".to_string(),
+        username: "alice".to_string(),
+        is_admin: false,
+        is_operator: false,
+        groups: vec![],
+        folders: vec![],
+        scopes: Some(scopes.into_iter().map(str::to_string).collect()),
+        username_override: None,
+        token_prefix: None,
+        read_only: false,
+    }
+}
+
+// A token scoped to `u/alice/db` must not reach a read handler for `u/bob/db`.
+#[sqlx::test]
+async fn read_handler_rejects_path_mismatched_scope(db: Pool<Postgres>) -> anyhow::Result<()> {
+    let authed = scoped_authed(vec!["postgres_triggers:read:u/alice/db"]);
+    let user_db = UserDB::new(db.clone());
+
+    let res = handler::get_postgres_version(
+        authed,
+        Extension(db),
+        Extension(user_db),
+        Path(("test-workspace".to_string(), "u/bob/db".to_string())),
+    )
+    .await;
+
+    assert!(
+        matches!(res, Err(Error::PermissionDenied(_))),
+        "expected PermissionDenied, got {res:?}"
+    );
+    Ok(())
+}
+
+// The destructive slot-drop handler must reject a write token scoped to another path.
+#[sqlx::test]
+async fn drop_slot_rejects_path_mismatched_scope(db: Pool<Postgres>) -> anyhow::Result<()> {
+    let authed = scoped_authed(vec!["postgres_triggers:write:u/alice/db"]);
+    let user_db = UserDB::new(db.clone());
+
+    let res = handler::drop_slot_name(
+        authed,
+        Extension(user_db),
+        Extension(db),
+        Path(("test-workspace".to_string(), "u/bob/db".to_string())),
+        Json(Slot { name: "some_slot".to_string() }),
+    )
+    .await;
+
+    assert!(
+        matches!(res, Err(Error::PermissionDenied(_))),
+        "expected PermissionDenied, got {res:?}"
+    );
+    Ok(())
+}
diff --git a/backend/windmill-trigger-postgres/src/handler.rs b/backend/windmill-trigger-postgres/src/handler.rs
index 10a26e0066..0592c48bf7 100644
--- a/backend/windmill-trigger-postgres/src/handler.rs
+++ b/backend/windmill-trigger-postgres/src/handler.rs
@@ -20,7 +20,7 @@ use windmill_common::{
 };
 use windmill_git_sync::DeployedObject;
 
-use windmill_api_auth::ApiAuthed;
+use windmill_api_auth::{check_scopes, ApiAuthed};
 use windmill_trigger::{Trigger, TriggerCrud, TriggerData};
 
 use super::{
@@ -46,7 +46,8 @@ impl TriggerCrud for PostgresTrigger {
 
     const TABLE_NAME: &'static str = "postgres_trigger";
     const TRIGGER_TYPE: &'static str = "postgres";
-    const DRAFT_KIND: windmill_common::user_drafts::UserDraftItemKind = windmill_common::user_drafts::UserDraftItemKind::TriggerPostgres;
+    const DRAFT_KIND: windmill_common::user_drafts::UserDraftItemKind =
+        windmill_common::user_drafts::UserDraftItemKind::TriggerPostgres;
     const SUPPORTS_SERVER_STATE: bool = true;
     const SUPPORTS_TEST_CONNECTION: bool = true;
     const ROUTE_PREFIX: &'static str = "/postgres_triggers";
@@ -395,6 +396,10 @@ pub async fn get_postgres_version(
     Extension(user_db): Extension<UserDB>,
     Path((w_id, postgres_resource_path)): Path<(String, String)>,
 ) -> Result<String> {
+    check_scopes(&authed, || {
+        format!("postgres_triggers:read:{}", postgres_resource_path)
+    })?;
+
     let pg_connection = get_default_pg_connection(
         authed.clone(),
         Some(user_db),
@@ -416,6 +421,10 @@ pub async fn list_slot_name(
     Extension(db): Extension<DB>,
     Path((w_id, postgres_resource_path)): Path<(String, String)>,
 ) -> Result<Json<Vec<SlotList>>> {
+    check_scopes(&authed, || {
+        format!("postgres_triggers:read:{}", postgres_resource_path)
+    })?;
+
     let pg_connection: Client = get_default_pg_connection(
         authed.clone(),
         Some(user_db.clone()),
@@ -458,6 +467,10 @@ pub async fn create_slot(
     Path((w_id, postgres_resource_path)): Path<(String, String)>,
     Json(Slot { name }): Json<Slot>,
 ) -> Result<String> {
+    check_scopes(&authed, || {
+        format!("postgres_triggers:write:{}", postgres_resource_path)
+    })?;
+
     let pg_connection = get_default_pg_connection(
         authed.clone(),
         Some(user_db.clone()),
@@ -513,6 +526,10 @@ pub async fn drop_slot_name(
     Path((w_id, postgres_resource_path)): Path<(String, String)>,
     Json(Slot { name }): Json<Slot>,
 ) -> Result<String> {
+    check_scopes(&authed, || {
+        format!("postgres_triggers:write:{}", postgres_resource_path)
+    })?;
+
     let pg_connection =
         get_default_pg_connection(authed, Some(user_db), &db, &postgres_resource_path, &w_id)
             .await
@@ -531,6 +548,10 @@ pub async fn list_database_publication(
     Extension(db): Extension<DB>,
     Path((w_id, postgres_resource_path)): Path<(String, String)>,
 ) -> Result<Json<Vec<String>>> {
+    check_scopes(&authed, || {
+        format!("postgres_triggers:read:{}", postgres_resource_path)
+    })?;
+
     let pg_connection = get_default_pg_connection(
         authed.clone(),
         Some(user_db.clone()),
@@ -563,6 +584,10 @@ pub async fn get_publication_info(
     Extension(db): Extension<DB>,
     Path((w_id, publication_name, postgres_resource_path)): Path<(String, String, String)>,
 ) -> Result<Json<PublicationData>> {
+    check_scopes(&authed, || {
+        format!("postgres_triggers:read:{}", postgres_resource_path)
+    })?;
+
     let mut pg_connection = get_default_pg_connection(
         authed.clone(),
         Some(user_db.clone()),
@@ -604,6 +629,10 @@ pub async fn create_publication(
     Path((w_id, publication_name, postgres_resource_path)): Path<(String, String, String)>,
     Json(publication_data): Json<PublicationData>,
 ) -> Result<String> {
+    check_scopes(&authed, || {
+        format!("postgres_triggers:write:{}", postgres_resource_path)
+    })?;
+
     let mut pg_connection = get_default_pg_connection(
         authed.clone(),
         Some(user_db.clone()),
@@ -640,6 +669,10 @@ pub async fn delete_publication(
     Extension(db): Extension<DB>,
     Path((w_id, publication_name, postgres_resource_path)): Path<(String, String, String)>,
 ) -> Result<String> {
+    check_scopes(&authed, || {
+        format!("postgres_triggers:write:{}", postgres_resource_path)
+    })?;
+
     let mut pg_connection = get_default_pg_connection(
         authed.clone(),
         Some(user_db.clone()),
@@ -773,6 +806,10 @@ pub async fn alter_publication(
     Path((w_id, publication_name, postgres_resource_path)): Path<(String, String, String)>,
     Json(publication_data): Json<PublicationData>,
 ) -> Result<String> {
+    check_scopes(&authed, || {
+        format!("postgres_triggers:write:{}", postgres_resource_path)
+    })?;
+
     let mut pg_connection = get_default_pg_connection(
         authed.clone(),
         Some(user_db.clone()),
@@ -948,6 +985,10 @@ pub async fn create_template_script(
 ) -> Result<String> {
     let TemplateScript { postgres_resource_path, relations, language } = template_script;
 
+    check_scopes(&authed, || {
+        format!("postgres_triggers:write:{}", postgres_resource_path)
+    })?;
+
     let relations = match relations {
         Some(r) => r,
         None => {
@@ -1090,6 +1131,10 @@ pub async fn is_database_in_logical_level(
     Extension(db): Extension<DB>,
     Path((w_id, postgres_resource_path)): Path<(String, String)>,
 ) -> error::JsonResult<bool> {
+    check_scopes(&authed, || {
+        format!("postgres_triggers:read:{}", postgres_resource_path)
+    })?;
+
     let pg_connection = get_default_pg_connection(
         authed.clone(),
         Some(user_db.clone()),

From 6e4263364325e4d4616697c6da601bbc887ff43c Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Tue, 21 Jul 2026 12:21:34 +0200
Subject: [PATCH 081/171] fix(pg): actionable error when s3object input exceeds
 jsonb 256MB cap (#10228)

Native SQL PostgreSQL scripts with an `(s3object)` input materialize the
whole referenced file into a single jsonb parameter. PostgreSQL hard-caps a
jsonb value's element payload at 256MB, so a large file fails with an opaque
`total size of jsonb array elements exceeds the maximum of 268435455 bytes`.

`materialize_s3object_args` now reports the largest materialized payload, and
that specific server error is rewritten into guidance explaining the input is
materialized (not streamed) and pointing large-file users at DuckDB, which
reads S3 natively and streams.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 backend/windmill-worker/src/pg_executor.rs | 92 ++++++++++++++++++++--
 1 file changed, 85 insertions(+), 7 deletions(-)

diff --git a/backend/windmill-worker/src/pg_executor.rs b/backend/windmill-worker/src/pg_executor.rs
index 0b84af81b9..71e78f92fe 100644
--- a/backend/windmill-worker/src/pg_executor.rs
+++ b/backend/windmill-worker/src/pg_executor.rs
@@ -768,7 +768,7 @@ pub async fn do_postgresql(
     // Materialize any `(s3object)` args into JSON text and rebind them as `jsonb` so
     // `otyp_to_pg_type` picks the right binding. Must run before the param map is
     // built below.
-    materialize_s3object_args(
+    let had_s3object_input = materialize_s3object_args(
         &mut sig.args,
         &mut pg_args,
         client,
@@ -875,7 +875,7 @@ pub async fn do_postgresql(
     };
 
     let result = if run_inline {
-        result_f.await?
+        result_f.await
     } else {
         run_future_with_polling_update_job_poller(
             job.id,
@@ -889,8 +889,9 @@ pub async fn do_postgresql(
             &mut Some(occupancy_metrics),
             Box::pin(futures::stream::once(async { 0 })),
         )
-        .await?
-    };
+        .await
+    }
+    .map_err(|e| map_s3object_jsonb_overflow(e, had_s3object_input))?;
 
     // Release the cache lock now that we have the result — allows the
     // post-query caching code below to re-acquire it if needed.
@@ -985,7 +986,8 @@ async fn increment_connection_counter(database_string: &str) {
 
 /// For each `(s3object)` arg in `sig_args`: download the referenced file, decode it
 /// to JSON text, then rewrite the arg to bind as `jsonb`. Mutates `args_map` in place
-/// so the existing bind path picks up the materialized payload.
+/// so the existing bind path picks up the materialized payload. Returns whether any
+/// `(s3object)` arg was materialized, so the jsonb-cap error can be rewritten.
 async fn materialize_s3object_args(
     sig_args: &mut [Arg],
     args_map: &mut HashMap<String, Value>,
@@ -993,7 +995,8 @@ async fn materialize_s3object_args(
     conn: &Connection,
     job_id: Uuid,
     workspace_id: &str,
-) -> error::Result<()> {
+) -> error::Result<bool> {
+    let mut materialized_any = false;
     for arg in sig_args.iter_mut() {
         if arg.otyp.as_deref() != Some("s3object") {
             continue;
@@ -1016,6 +1019,7 @@ async fn materialize_s3object_args(
                     arg.name
                 ))
             })?;
+        materialized_any = true;
         // Parse to a Value so `convert_val`'s Array/Object → JSONB branches bind it
         // correctly. A bare String would mismatch the JSONB param type.
         let parsed: Value = serde_json::from_str(&json_text).map_err(|e| {
@@ -1028,7 +1032,38 @@ async fn materialize_s3object_args(
         arg.otyp = Some("jsonb".to_string());
         arg.typ = Typ::Object(windmill_parser::ObjectType::new(None, Some(vec![])));
     }
-    Ok(())
+    Ok(materialized_any)
+}
+
+/// A `(s3object)` input materializes the whole file into a single jsonb parameter, which
+/// PostgreSQL caps at ~256MB (`total size of jsonb {array,object} elements exceeds the
+/// maximum of 268435455 bytes`). A large input trips this with an opaque server error;
+/// rewrite it into guidance pointing at DuckDB, which reads S3 natively and streams.
+///
+/// The attribution is hedged: the same error can also come from SQL constructing an
+/// oversized jsonb at execution time, and with several inputs we can't tell which one
+/// overflowed, so we point at `(s3object)` inputs as the likely cause rather than naming
+/// a specific file. The DuckDB remediation is the same either way.
+fn map_s3object_jsonb_overflow(e: Error, had_s3object_input: bool) -> Error {
+    if !had_s3object_input {
+        return e;
+    }
+    let msg = e.to_string();
+    // Match only the jsonb byte-size cap ("total size of jsonb ... elements exceeds the
+    // maximum of 268435455 bytes"), so the ~256 MB wording stays accurate. Excludes the
+    // element-count cap and unrelated caps like "array size exceeds the maximum allowed".
+    if !msg.contains("total size of jsonb") {
+        return e;
+    }
+    Error::ExecutionErr(format!(
+        "This query hit PostgreSQL's ~256 MB size limit for a single jsonb value. This is a \
+         server-side database limit, not a worker-memory limit, so a larger worker will not raise \
+         it. If a large `(s3object)` input is the cause: native SQL `(s3object)` inputs load the \
+         whole file into one jsonb parameter and do not stream, so they only fit small files. For \
+         large Parquet/CSV files, use a DuckDB script instead: it reads the file directly from S3 \
+         and streams (e.g. `read_parquet(...)` / `read_csv_auto(...)`) rather than materializing \
+         it.\n\nUnderlying error: {msg}",
+    ))
 }
 
 /// Parse a date string in formats produced by chrono's Display or JS frontends.
@@ -2023,6 +2058,49 @@ impl FromSql<'_> for StringCollector {
 mod tests {
     use super::*;
 
+    #[test]
+    fn test_map_s3object_jsonb_overflow() {
+        let pg_err = Error::ExecutionErr(
+            "db error: ERROR: total size of jsonb array elements exceeds the maximum of 268435455 bytes".to_string(),
+        );
+        let mapped = map_s3object_jsonb_overflow(pg_err, true).to_string();
+        assert!(mapped.contains("256 MB"));
+        assert!(mapped.contains("larger worker will not"));
+        assert!(mapped.contains("read_csv_auto"));
+        assert!(mapped.contains("Underlying error"));
+
+        // The element-count cap is not the byte-size cap, so the "256 MB" message would
+        // mislabel it — it must pass through unchanged.
+        let count_err = Error::ExecutionErr(
+            "number of jsonb array elements exceeds the maximum of 268435455".to_string(),
+        );
+        assert_eq!(
+            map_s3object_jsonb_overflow(count_err, true).to_string(),
+            "number of jsonb array elements exceeds the maximum of 268435455",
+        );
+
+        // A different "exceeds the maximum" error must NOT be reclassified as jsonb overflow.
+        let array_err =
+            Error::ExecutionErr("array size exceeds the maximum allowed (134217727)".to_string());
+        assert_eq!(
+            map_s3object_jsonb_overflow(array_err, true).to_string(),
+            "array size exceeds the maximum allowed (134217727)",
+        );
+
+        let other = Error::ExecutionErr("syntax error at or near \"SELCT\"".to_string());
+        assert_eq!(
+            map_s3object_jsonb_overflow(other, true).to_string(),
+            "syntax error at or near \"SELCT\"",
+        );
+
+        // No `(s3object)` input → even a matching error is left alone.
+        let pg_err2 = Error::ExecutionErr("jsonb array elements exceeds the maximum".to_string());
+        assert_eq!(
+            map_s3object_jsonb_overflow(pg_err2, false).to_string(),
+            "jsonb array elements exceeds the maximum",
+        );
+    }
+
     #[test]
     fn test_parse_naive_date() {
         // chrono's NaiveDate::to_string() format

From 28966bdbf190ac461aa5259e04d6c15cf699fd94 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Tue, 21 Jul 2026 12:53:52 +0200
Subject: [PATCH 082/171] fix(frontend): curl fallback for +Variable/+Resource
 in bash sandbox mode (#10235)

* fix(frontend): use curl fallback for +Variable/+Resource in bash sandbox mode

When a bash script uses `# sandbox <image>` or `# docker`, the body runs
inside a custom container image that does not have the `wmill` CLI
installed, so the `wmill variable get` / `wmill resource get` snippets
inserted by the +Variable and +Resource pickers fail.

Detect `# sandbox`/`# docker` in the editor code and insert a curl-based
snippet using the BASE_INTERNAL_URL, WM_TOKEN and WM_WORKSPACE env vars
(available in sandbox) instead.

Fixes WIN-2215

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(frontend): mirror worker grammar and use curl/wget fallback in sandbox mode

Address review of the bash sandbox picker fallback:

- Extract detection into `bashRunsInCustomImage`, mirroring the worker's
  BashAnnotations grammar (leading comment lines only; `# sandbox <image>`
  or bare `# docker`). A bare `# sandbox` is the nsjail-bash modifier that
  still runs on the worker rootfs where `wmill` is available, so it now
  correctly keeps the `wmill` snippet. This also fixes the substring
  false positives (`# sandboxed`, `# docker` in prose/body) and false
  negatives (`#sandbox <image>`).
- The default `# sandbox alpine:latest` image ships busybox `wget`, not
  `curl`, so the snippet now tries `curl` then falls back to `wget`.
- `variables/get_value` returns a JSON-quoted string; strip the outer
  quotes with `sed` so the sandbox snippet matches the `jq -r .value`
  output of the non-sandbox branch. Resources return JSON either way.
- Add focused unit tests for the detection grammar.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 frontend/src/lib/components/EditorBar.svelte | 27 ++++++++++--
 frontend/src/lib/script_helpers.test.ts      | 43 ++++++++++++++++++++
 frontend/src/lib/script_helpers.ts           | 24 +++++++++++
 3 files changed, 91 insertions(+), 3 deletions(-)
 create mode 100644 frontend/src/lib/script_helpers.test.ts

diff --git a/frontend/src/lib/components/EditorBar.svelte b/frontend/src/lib/components/EditorBar.svelte
index ce242a891a..04f181f4fc 100644
--- a/frontend/src/lib/components/EditorBar.svelte
+++ b/frontend/src/lib/components/EditorBar.svelte
@@ -39,6 +39,7 @@
 	import { createEventDispatcher, untrack } from 'svelte'
 	import { sendUserToast } from '$lib/toast'
 	import { getScriptByPath, scriptLangToEditorLang } from '$lib/scripts'
+	import { bashRunsInCustomImage } from '$lib/script_helpers'
 	import Toggle from './Toggle.svelte'
 
 	import {
@@ -673,7 +674,17 @@
 			}
 			editor.insertAtCursor(`v, _ := wmill.GetVariable("${path}")`)
 		} else if (lang == 'bash') {
-			editor.insertAtCursor(`wmill variable get ${path} --json | jq -r .value`)
+			if (bashRunsInCustomImage(editor.getCode())) {
+				// Custom image: no wmill CLI. Fall back to curl, then busybox wget
+				// (the default `# sandbox alpine:latest` image ships wget, not curl).
+				// get_value returns a JSON-quoted string, so strip the outer quotes
+				// to match the `jq -r .value` output of the non-sandbox branch.
+				editor.insertAtCursor(
+					`{ curl -sf -H "Authorization: Bearer $WM_TOKEN" "$BASE_INTERNAL_URL/api/w/$WM_WORKSPACE/variables/get_value/${path}" 2>/dev/null || wget -qO- --header="Authorization: Bearer $WM_TOKEN" "$BASE_INTERNAL_URL/api/w/$WM_WORKSPACE/variables/get_value/${path}"; } | sed 's/^"//;s/"$//'`
+				)
+			} else {
+				editor.insertAtCursor(`wmill variable get ${path} --json | jq -r .value`)
+			}
 		} else if (lang == 'powershell') {
 			editor.insertAtCursor(`$Headers = @{\n"Authorization" = "Bearer $Env:WM_TOKEN"`)
 			editor.arrowDown()
@@ -751,7 +762,16 @@ string ${windmillPathToCamelCaseName(path)} = await client.GetStringAsync(uri);
 			}
 			editor.insertAtCursor(`r, _ := wmill.GetResource("${path}")`)
 		} else if (lang == 'bash') {
-			editor.insertAtCursor(`wmill resource get ${path} --json | jq .value`)
+			if (bashRunsInCustomImage(editor.getCode())) {
+				// Custom image: no wmill CLI. Fall back to curl, then busybox wget
+				// (the default `# sandbox alpine:latest` image ships wget, not curl).
+				// get_value_interpolated returns JSON, matching the `jq .value` branch.
+				editor.insertAtCursor(
+					`curl -sf -H "Authorization: Bearer $WM_TOKEN" "$BASE_INTERNAL_URL/api/w/$WM_WORKSPACE/resources/get_value_interpolated/${path}" 2>/dev/null || wget -qO- --header="Authorization: Bearer $WM_TOKEN" "$BASE_INTERNAL_URL/api/w/$WM_WORKSPACE/resources/get_value_interpolated/${path}"`
+				)
+			} else {
+				editor.insertAtCursor(`wmill resource get ${path} --json | jq .value`)
+			}
 		} else if (lang == 'powershell') {
 			editor.insertAtCursor(`$Headers = @{\n"Authorization" = "Bearer $Env:WM_TOKEN"`)
 			editor.arrowDown()
@@ -962,7 +982,8 @@ JsonNode ${windmillPathToCamelCaseName(path)} = JsonNode.Parse(await client.GetS
 			// after an unterminated one produces invalid SQL. The separator starts on
 			// its own line so the `;` cannot land inside a trailing line comment.
 			const existing = editor?.getCode() ?? ''
-			const sep = existing.trim() === '' ? '' : endsWithUnterminatedStatement(existing) ? '\n;\n\n' : '\n\n'
+			const sep =
+				existing.trim() === '' ? '' : endsWithUnterminatedStatement(existing) ? '\n;\n\n' : '\n\n'
 			editor?.append(sep + sql + '\n')
 		}}
 	/>
diff --git a/frontend/src/lib/script_helpers.test.ts b/frontend/src/lib/script_helpers.test.ts
new file mode 100644
index 0000000000..1badf03e11
--- /dev/null
+++ b/frontend/src/lib/script_helpers.test.ts
@@ -0,0 +1,43 @@
+import { describe, it, expect } from 'vitest'
+import { bashRunsInCustomImage } from './script_helpers'
+
+// bashRunsInCustomImage decides whether the +Variable/+Resource pickers insert a
+// curl/wget snippet (custom image, no wmill CLI) or the wmill CLI snippet. It must
+// stay in sync with the worker's BashAnnotations grammar
+// (backend/windmill-common/src/worker.rs): leading comment lines only, `# sandbox
+// <image>` or bare `# docker` select a container; a bare `# sandbox` does not.
+
+describe('bashRunsInCustomImage', () => {
+	it('true for `# sandbox <image>` (spaced and compact)', () => {
+		expect(bashRunsInCustomImage('# sandbox alpine:latest\necho hi')).toBe(true)
+		expect(bashRunsInCustomImage('#sandbox   python:3.12-slim\n')).toBe(true)
+	})
+
+	it('true for a bare `# docker` annotation', () => {
+		expect(bashRunsInCustomImage('# docker\necho hi')).toBe(true)
+	})
+
+	it('true when the sandbox line follows other leading comments (default template)', () => {
+		expect(bashRunsInCustomImage('# shellcheck shell=bash\n# sandbox alpine:latest\necho hi')).toBe(
+			true
+		)
+	})
+
+	it('false for a bare `# sandbox` (nsjail-bash on the worker, wmill available)', () => {
+		expect(bashRunsInCustomImage('# sandbox\necho hi')).toBe(false)
+	})
+
+	it('false for prose comments that merely contain the words', () => {
+		expect(bashRunsInCustomImage('# sandboxed run below\necho hi')).toBe(false)
+		expect(bashRunsInCustomImage('# runs in a docker container\necho hi')).toBe(false)
+	})
+
+	it('false when the annotation is not on a leading comment line', () => {
+		expect(bashRunsInCustomImage('echo hi\n# sandbox alpine')).toBe(false)
+		expect(bashRunsInCustomImage('msg="$1" # docker')).toBe(false)
+	})
+
+	it('false for a plain script with no annotations', () => {
+		expect(bashRunsInCustomImage('# shellcheck shell=bash\necho hi')).toBe(false)
+	})
+})
diff --git a/frontend/src/lib/script_helpers.ts b/frontend/src/lib/script_helpers.ts
index d936d60f25..4a85107b70 100644
--- a/frontend/src/lib/script_helpers.ts
+++ b/frontend/src/lib/script_helpers.ts
@@ -1435,6 +1435,30 @@ export const INITIAL_CODE = {
 	// for related places search: ADD_NEW_LANG
 }
 
+/**
+ * Whether a bash script body runs inside a custom container image that does not
+ * ship the `wmill` CLI (nor `jq`), namely `# sandbox <image>` or `# docker`. In
+ * that case editor snippets must fall back to a plain HTTP client instead of `wmill`.
+ *
+ * Mirrors the worker's annotation grammar (backend/windmill-common/src/worker.rs,
+ * `BashAnnotations`): only leading comment lines are scanned, stopping at the first
+ * non-comment line. A bare `# sandbox` (no image) is the nsjail-bash modifier that
+ * still runs on the worker rootfs where `wmill` is available, so it is excluded.
+ */
+export function bashRunsInCustomImage(code: string): boolean {
+	for (const line of code.split('\n')) {
+		const trimmed = line.trim()
+		if (trimmed === '') continue
+		if (!trimmed.startsWith('#')) break
+		const tokens = trimmed.slice(1).trim().split(/\s+/)
+		// `# sandbox <image>` selects a container; bare `# sandbox` does not.
+		if (tokens[0] === 'sandbox' && tokens[1]) return true
+		// `# docker` (v1 daemon runtime) runs in the referenced image, no wmill.
+		if (tokens[0] === 'docker' && tokens.length === 1) return true
+	}
+	return false
+}
+
 export function isInitialCode(content: string): boolean {
 	for (const lang of Object.values(INITIAL_CODE)) {
 		for (const code of Object.values(lang)) {

From 572d69e5ae8ae12207dca175fdb5ea378d852a45 Mon Sep 17 00:00:00 2001
From: Guilhem <guilhemlemouel@gmail.com>
Date: Tue, 21 Jul 2026 14:58:18 +0200
Subject: [PATCH 083/171] feat(ai): open the Compare & Deploy page from chat
 with item preselection (#10232)

* feat(ai): open the Compare & Deploy page from chat with item preselection

* fix(ai): label the compare link card outside sessions

* fix(ai): scope untracked-chat compare links to explicit items

* style: drop narration comment on compare mask precedence

* fix(ai): match compare items mask against parked live-draft paths

* fix(ai): land maskless-mode compare on the view holding the masked drafts

* fix(ai): honor explicit fork mode over the draft-mask heuristic

* docs(ai): describe mask-aware compare mode auto-pick

* fix(ai): match legacy app fork diffs under their identity mask key
---
 ai_evals/cases/global.yaml                    |  32 +++++
 ai_evals/core/validators.test.ts              |  34 +++++
 ai_evals/core/validators.ts                   |  12 +-
 .../src/lib/components/CompareDrafts.svelte   |  15 ++-
 .../copilot/chat/AIChatManager.svelte.ts      |   1 +
 .../copilot/chat/ToolMessageActions.svelte    |   4 +-
 .../copilot/chat/global/core.test.ts          |  34 +++++
 .../components/copilot/chat/global/core.ts    | 118 ++++++++++++++----
 .../chat/global/pageNavigation.test.ts        |  19 ++-
 .../copilot/chat/global/pageNavigation.ts     |  40 +++++-
 .../sessions/modifiedItemsMask.test.ts        |  35 +++++-
 .../components/sessions/modifiedItemsMask.ts  |  39 +++++-
 .../components/sessions/previewRouter.test.ts |  15 +++
 .../lib/components/sessions/previewRouter.ts  |  22 +++-
 .../sessions/sessionRuntime.svelte.ts         |   6 +-
 .../(logged)/forks/compare/+page.svelte       |  63 ++++++++--
 16 files changed, 442 insertions(+), 47 deletions(-)

diff --git a/ai_evals/cases/global.yaml b/ai_evals/cases/global.yaml
index f2ff64248f..bf376b66e8 100644
--- a/ai_evals/cases/global.yaml
+++ b/ai_evals/cases/global.yaml
@@ -1050,6 +1050,38 @@
     - opens the Kafka triggers page
     - does not write, deploy, or delete anything
 
+- id: global-openpage7-compare-review
+  prompt: |-
+    Create a TypeScript script draft at f/evals/global/compare_review_demo that returns the string "ok" (no need to test it), then open the review page so I can look over the pending change and deploy it myself.
+  runtime:
+    maxTurns: 8
+  validate:
+    draftCountExactly: 1
+  toolExpect:
+    requiredToolsUsed:
+      - write_script
+      - open_page
+    forbiddenToolsUsed:
+      - deploy_workspace_item
+      - delete_workspace_item
+    toolCallArgs:
+      - tool: open_page
+        field: page
+        stringIncludesAnyOf:
+          - compare
+      # The eval chat is untracked (no modified-items mask), so the model must scope
+      # the review by passing the item it changed explicitly — an omitted mask would
+      # preselect every pending change in the workspace.
+      - tool: open_page
+        field: items
+        stringIncludesAnyOf:
+          - f/evals/global/compare_review_demo
+  skipJudge: true
+  judgeChecklist:
+    - creates the script draft, then opens the Compare & Deploy review page instead of deploying itself
+    - preselects only the created script on the review page
+    - does not deploy or delete anything
+
 - id: global-closepage1-close-runs-tab
   prompt: |-
     You just opened the runs page for me in the side panel. Close that tab, I'm done looking at it.
diff --git a/ai_evals/core/validators.test.ts b/ai_evals/core/validators.test.ts
index 5183a20226..d603dae626 100644
--- a/ai_evals/core/validators.test.ts
+++ b/ai_evals/core/validators.test.ts
@@ -174,6 +174,40 @@ describe("validateToolExpectations", () => {
     expect(checks.every((check) => check.passed)).toBe(true);
   });
 
+  it("accepts a stringIncludesAnyOf substring inside an array-valued field", () => {
+    const checks = validateToolExpectations({
+      run: {
+        success: true,
+        actual: {},
+        assistantMessageCount: 1,
+        toolCallCount: 1,
+        toolsUsed: ["open_page"],
+        toolCallDetails: [
+          {
+            name: "open_page",
+            arguments: {
+              page: "compare",
+              items: ["script:f/evals/global/compare_review_demo"],
+            },
+          },
+        ],
+        skillsInvoked: [],
+      },
+      toolExpect: {
+        requiredToolsUsed: ["open_page"],
+        toolCallArgs: [
+          {
+            tool: "open_page",
+            field: "items",
+            stringIncludesAnyOf: ["f/evals/global/compare_review_demo"],
+          },
+        ],
+      },
+    });
+
+    expect(checks.every((check) => check.passed)).toBe(true);
+  });
+
   it("accepts stringIncludesAnyOf when only one of several calls matches", () => {
     // Existential: a mutation mixed with verification SELECTs still passes.
     const checks = validateToolExpectations({
diff --git a/ai_evals/core/validators.ts b/ai_evals/core/validators.ts
index 7570ccd12d..32ff225fc1 100644
--- a/ai_evals/core/validators.ts
+++ b/ai_evals/core/validators.ts
@@ -239,9 +239,15 @@ export function validateToolExpectations(input: {
       // model mixes the requested statement (e.g. an UPDATE) with verification
       // SELECTs that would otherwise fail an "all calls" check.
       const needles = rule.stringIncludesAnyOf.map((needle) => needle.toLowerCase());
-      const hasMatch = values.some(
-        (value) =>
-          typeof value === "string" && needles.some((needle) => value.toLowerCase().includes(needle))
+      // Array-valued fields (e.g. open_page.items) match on any element.
+      const haystacks = (value: unknown): string[] =>
+        typeof value === "string"
+          ? [value]
+          : Array.isArray(value)
+            ? value.filter((v): v is string => typeof v === "string")
+            : [];
+      const hasMatch = values.some((value) =>
+        haystacks(value).some((hay) => needles.some((needle) => hay.toLowerCase().includes(needle)))
       );
       checks.push(
         check(
diff --git a/frontend/src/lib/components/CompareDrafts.svelte b/frontend/src/lib/components/CompareDrafts.svelte
index b37ba4fcac..b7970c90e1 100644
--- a/frontend/src/lib/components/CompareDrafts.svelte
+++ b/frontend/src/lib/components/CompareDrafts.svelte
@@ -1,5 +1,6 @@
 <script lang="ts">
 	import WorkspaceDeployLayout from './WorkspaceDeployLayout.svelte'
+	import { maskHasDraftRow } from './sessions/modifiedItemsMask'
 	import DiffDrawer from './DiffDrawer.svelte'
 	import WorkspaceDeployItemSummary from './WorkspaceDeployItemSummary.svelte'
 	import DraftBadge from './DraftBadge.svelte'
@@ -315,9 +316,17 @@
 			// Default intent is deploy-all; when reached from a session's Review
 			// (chatMask set), preselect only that chat's items instead.
 			const selectable = visibleItems.filter(isSelectable)
-			selectedItems = (chatMask ? selectable.filter((i) => chatMask.has(i.key)) : selectable).map(
-				(i) => i.key
-			)
+			selectedItems = (
+				chatMask
+					? selectable.filter((i) =>
+							maskHasDraftRow(chatMask, {
+								kind: i.draftKind,
+								path: i.path,
+								draft_path: i.draft_path
+							})
+						)
+					: selectable
+			).map((i) => i.key)
 			hasAutoSelected = true
 		}
 	})
diff --git a/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts b/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
index 6e07271a60..e498323b85 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
+++ b/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
@@ -1722,6 +1722,7 @@ export class AIChatManager {
 					}
 				: {}),
 			testActiveFlow: async (args?: Record<string, any>) => this.flowAiChatHelpers?.testFlow(args),
+			getModifiedItems: () => (this.modifiedItems ? [...this.modifiedItems] : undefined),
 			attachedFiles: this.attachedFiles,
 			getUserInstructions: () => getUserCustomPrompts()[AIMode.GLOBAL] ?? '',
 			setUserInstructions: (instructions: string) => {
diff --git a/frontend/src/lib/components/copilot/chat/ToolMessageActions.svelte b/frontend/src/lib/components/copilot/chat/ToolMessageActions.svelte
index afee03bcf2..a40f244019 100644
--- a/frontend/src/lib/components/copilot/chat/ToolMessageActions.svelte
+++ b/frontend/src/lib/components/copilot/chat/ToolMessageActions.svelte
@@ -7,6 +7,7 @@
 		Database,
 		DollarSign,
 		FolderOpen,
+		GitCompareArrows,
 		KeyRound,
 		Mail,
 		Package,
@@ -69,7 +70,8 @@
 		folders: { title: 'Folders', icon: FolderOpen },
 		groups: { title: 'Groups', icon: Users },
 		triggers: { title: 'Triggers', icon: Zap },
-		workspace_settings: { title: 'Workspace settings', icon: Settings }
+		workspace_settings: { title: 'Workspace settings', icon: Settings },
+		compare: { title: 'Compare & Deploy', icon: GitCompareArrows }
 	}
 
 	function getActionCard(action: ToolDisplayAction): ActionCard {
diff --git a/frontend/src/lib/components/copilot/chat/global/core.test.ts b/frontend/src/lib/components/copilot/chat/global/core.test.ts
index 595eaaa15b..f1b932ab1c 100644
--- a/frontend/src/lib/components/copilot/chat/global/core.test.ts
+++ b/frontend/src/lib/components/copilot/chat/global/core.test.ts
@@ -253,6 +253,7 @@ vi.mock('$lib/infer', async () => ({
 }))
 
 import {
+	buildOpenPageUrl,
 	globalTools,
 	globalToolsFor,
 	prepareGlobalSystemMessage,
@@ -4171,3 +4172,36 @@ describe('prepareGlobalUserMessage', () => {
 		expect(message.content).toBe('## INSTRUCTIONS:\nCreate a draft')
 	})
 })
+
+describe('buildOpenPageUrl compare selection', () => {
+	const itemsOf = (url: string) => new URL(url, 'http://x').searchParams.get('items')
+
+	it('explicit items win over the chat mask', () => {
+		const url = buildOpenPageUrl(
+			'compare',
+			{ page: 'compare', items: ['script:f/a/b'] },
+			{ workspaceId: 'ws', chatItems: ['flow:f/c/d'] }
+		)
+		expect(itemsOf(url)).toBe('script:f/a/b')
+	})
+
+	it('omitted items fall back to the chat-modified mask', () => {
+		const url = buildOpenPageUrl(
+			'compare',
+			{ page: 'compare' },
+			{ workspaceId: 'ws', chatItems: ['flow:f/c/d', 'script:f/a/b'] }
+		)
+		expect(itemsOf(url)).toBe('flow:f/c/d,script:f/a/b')
+	})
+
+	it('an empty or absent mask yields no items param (page select-all default)', () => {
+		expect(
+			itemsOf(
+				buildOpenPageUrl('compare', { page: 'compare' }, { workspaceId: 'ws', chatItems: [] })
+			)
+		).toBeNull()
+		expect(
+			itemsOf(buildOpenPageUrl('compare', { page: 'compare' }, { workspaceId: 'ws' }))
+		).toBeNull()
+	})
+})
diff --git a/frontend/src/lib/components/copilot/chat/global/core.ts b/frontend/src/lib/components/copilot/chat/global/core.ts
index fa3e93f56f..e1517d1334 100644
--- a/frontend/src/lib/components/copilot/chat/global/core.ts
+++ b/frontend/src/lib/components/copilot/chat/global/core.ts
@@ -134,8 +134,13 @@ import {
 	buildFoldersUrl,
 	buildGroupsUrl,
 	buildTriggersUrl,
+	buildCompareUrl,
 	WORKSPACE_SETTINGS_TABS
 } from './pageNavigation'
+import {
+	COMPARE_ITEMS_PARAM,
+	parseItemsMaskParam
+} from '$lib/components/sessions/modifiedItemsMask'
 import {
 	pageHref,
 	TRIGGER_PAGES,
@@ -994,6 +999,11 @@ ${pipelineBullet}
 - After creating or editing a script or flow draft, run test_run_script, test_run_flow, or test_run_step with representative args before reporting that it works. These tools prefer drafts, so testing does not require deployment.
 - Use list_runs to find recent runs (optionally filtered by path, creator, label, or status), then get_job_logs with a returned id to inspect a specific run's logs — without starting a new test run.
 - Use open_page to show a workspace page with filters applied — Runs, Schedules, Variables, Resources, Assets, Audit logs, or Workspace settings on a specific tab (e.g. "open the failed runs of f/foo/bar", "open the schedule for X", "open the git sync settings"). Only the pages listed for this user in the tool are available; don't offer pages that aren't listed. Don't use it as a substitute for list_runs when you just need the data yourself.
+- When the user is happy with the changes and wants to review or deploy them, use open_page with page "compare" — it opens the Compare & Deploy review page.${
+		previewTools
+			? ' By default it preselects the items this chat modified; pass items ("<kind>:<path>" entries) to control the selection'
+			: ' Pass items ("<kind>:<path>" entries naming the items you changed) so the review is scoped to them — omitting items preselects every pending change in the workspace'
+	}, or mode ("draft" or "fork") to force which comparison is shown. Prefer offering this review page over calling deploy_workspace_item directly when several items changed.
 - For a Windmill operation no other tool covers (workers, queue state, a run's result or args, ...), use search_api_endpoints to find a REST endpoint, then call_api_get for reads or call_api_endpoint for mutations (the user is asked to confirm those). Always prefer a dedicated tool when one exists; endpoints for authoring or deleting scripts, flows, apps, schedules, resources, or variables are not available through the API catalog tools — use the draft tools and delete_workspace_item instead.
 - runScriptByPath / runFlowByPath from the API catalog run the DEPLOYED version of an item. Use them only when the user explicitly asks to run the deployed version, and read the item with read_workspace_item version: "deployed" first so the arguments match the deployed input schema (a draft may have different inputs). To test something you are editing or just wrote, always use test_run_script, test_run_flow, or test_run_step — they run the draft.
 - When a required decision is ambiguous, use askUserQuestion with two to ten clear proposed answer strings instead of guessing. The user can also type a custom answer when none of the proposed answers fit. Set multiSelect: true only when the answers can genuinely co-apply and the user may pick several (not mutually exclusive).
@@ -1903,7 +1913,8 @@ const OPEN_PAGE_NAMES = [
 	'folders',
 	'groups',
 	'triggers',
-	'workspace_settings'
+	'workspace_settings',
+	'compare'
 ] as const
 type OpenPageName = (typeof OPEN_PAGE_NAMES)[number]
 
@@ -1917,7 +1928,8 @@ const OPEN_PAGE_LABELS: Record<OpenPageName, string> = {
 	folders: 'Folders',
 	groups: 'Groups',
 	triggers: 'Triggers',
-	workspace_settings: 'Workspace settings'
+	workspace_settings: 'Workspace settings',
+	compare: 'Compare & Deploy'
 }
 
 // Trigger kinds available given the workspace's license — the EE-gated kinds
@@ -1954,12 +1966,24 @@ function allowedOpenPages(workspaceId: string | undefined = get(workspaceStore))
 		'audit_logs',
 		'folders',
 		'groups',
-		'triggers'
+		'triggers',
+		'compare'
 	])
 	if (isAdmin) allowed.add('workspace_settings')
 	return OPEN_PAGE_NAMES.filter((p) => allowed.has(p))
 }
 
+// The advertised `items` description must match this chat's surface: only chats that
+// track their modified items (AI sessions) can honor "omitted = this chat's edits" —
+// on an untracked chat (the global side panel) an omitted mask falls through to the
+// page's select-all default, so the model is told to pass the items explicitly there.
+const COMPARE_ITEMS_DESCRIPTIONS = {
+	tracked:
+		"Compare: preselect exactly these changed items, each as '<kind>:<path>' where kind is script, flow, raw_app, app, resource, variable, or a trigger kind like trigger_schedule / trigger_http (e.g. 'script:f/foo/bar'). Omit to preselect the items modified in this chat (everything when this chat modified nothing).",
+	untracked:
+		"Compare: preselect exactly these changed items, each as '<kind>:<path>' where kind is script, flow, raw_app, app, resource, variable, or a trigger kind like trigger_schedule / trigger_http (e.g. 'script:f/foo/bar'). If omitted, the page preselects EVERY pending change in the workspace, not just this chat's — when you changed specific items, pass them so the review is scoped to them."
+} as const
+
 // One flat object (not a discriminated union): `page` selects the target and the
 // per-page fields are optional. Top-level `type: object` is what Anthropic's
 // input_schema requires; a top-level oneOf would be rejected. Each per-page URL builder
@@ -1967,20 +1991,7 @@ function allowedOpenPages(workspaceId: string | undefined = get(workspaceStore))
 // apply to the chosen page is harmless. This full schema is used to PARSE tool args; the
 // advertised schema (what the model sees) is narrowed per-user in `setSchema`.
 const openPageFullSchema = z.object({
-	page: z
-		.enum([
-			'runs',
-			'schedules',
-			'variables',
-			'resources',
-			'assets',
-			'audit_logs',
-			'folders',
-			'groups',
-			'triggers',
-			'workspace_settings'
-		])
-		.describe('Which page to open'),
+	page: z.enum(OPEN_PAGE_NAMES).describe('Which page to open'),
 	path: z
 		.string()
 		.optional()
@@ -2031,6 +2042,13 @@ const openPageFullSchema = z.object({
 		.enum([...WORKSPACE_SETTINGS_TABS] as [string, ...string[]])
 		.optional()
 		.describe('Workspace settings: which settings tab to open'),
+	mode: z
+		.enum(['draft', 'fork'])
+		.optional()
+		.describe(
+			"Compare: which comparison to show — 'draft' (deployed items vs their pending drafts) or 'fork' (this forked workspace vs its parent). Omit to auto-pick: the view containing the preselected items (draft whenever any of them is a pending draft); with nothing preselected, fork on a forked workspace and draft otherwise."
+		),
+	items: z.array(z.string()).min(1).optional().describe(COMPARE_ITEMS_DESCRIPTIONS.tracked),
 	new_tab: z
 		.boolean()
 		.optional()
@@ -2057,7 +2075,9 @@ const OPEN_PAGE_FIELD_PAGES: Record<string, OpenPageName[]> = {
 	username: ['audit_logs'],
 	operation: ['audit_logs'],
 	resource: ['audit_logs'],
-	tab: ['workspace_settings']
+	tab: ['workspace_settings'],
+	mode: ['compare'],
+	items: ['compare']
 }
 
 // The model-facing schema for the given allowed pages: the `page` enum plus only the
@@ -2065,7 +2085,8 @@ const OPEN_PAGE_FIELD_PAGES: Record<string, OpenPageName[]> = {
 // `trigger_kind` enum is narrowed to the license-available kinds.
 function buildOpenPageDefSchema(
 	pages: readonly OpenPageName[],
-	triggerKinds: readonly PageTriggerKind[]
+	triggerKinds: readonly PageTriggerKind[],
+	chatEditsTracked: boolean
 ): z.ZodTypeAny {
 	const full = openPageFullSchema.shape as Record<string, z.ZodTypeAny>
 	// z.enum() rejects an empty list, and a user with no reachable pages (e.g. an operator
@@ -2084,16 +2105,27 @@ function buildOpenPageDefSchema(
 						.enum([...triggerKinds] as [string, ...string[]])
 						.optional()
 						.describe('Triggers: which trigger kind page to open')
-				: full[field]
+				: field === 'items'
+					? z
+							.array(z.string())
+							.min(1)
+							.optional()
+							.describe(COMPARE_ITEMS_DESCRIPTIONS[chatEditsTracked ? 'tracked' : 'untracked'])
+					: full[field]
 	}
 	shape.new_tab = full.new_tab
 	return z.object(shape)
 }
 
 const OPEN_PAGE_DESCRIPTION =
-	'Open a Windmill page with filters applied — Runs, Schedules, Variables, Resources, Assets, Audit logs, Folders, Groups, Triggers (by kind), or Workspace settings (on a specific tab). Inside an AI session it opens as a tab in the side-panel preview next to the chat; elsewhere it offers a clickable link. Use after surfacing something the user likely wants to inspect (e.g. "show me the failed runs of X", "open the schedule for Y", "open the git sync settings", "open the kafka triggers"). This is the only way to show one of these pages in the session preview — open_preview only handles editable items (scripts, flows, raw apps, pipelines). Only pages listed for this user are available; do not offer others.'
+	'Open a Windmill page with filters applied — Runs, Schedules, Variables, Resources, Assets, Audit logs, Folders, Groups, Triggers (by kind), Workspace settings (on a specific tab), or the Compare & Deploy review page. Inside an AI session it opens as a tab in the side-panel preview next to the chat; elsewhere it offers a clickable link. Use after surfacing something the user likely wants to inspect (e.g. "show me the failed runs of X", "open the schedule for Y", "open the git sync settings", "open the kafka triggers"), and use page "compare" when the user wants to review and deploy pending changes (the items field controls which changes are preselected). This is the only way to show one of these pages in the session preview — open_preview only handles editable items (scripts, flows, raw apps, pipelines). Only pages listed for this user are available; do not offer others.'
 
-function buildOpenPageUrl(page: OpenPageName, a: OpenPageArgs): string {
+// Non-arg inputs the URL builder needs: the chat's operating workspace (the compare
+// page cannot fall back to its own store default inside a session preview) and the
+// live modified-items mask backing the compare page's default preselection.
+type OpenPageUrlCtx = { workspaceId: string; chatItems?: readonly string[] }
+
+export function buildOpenPageUrl(page: OpenPageName, a: OpenPageArgs, ctx: OpenPageUrlCtx): string {
 	switch (page) {
 		case 'runs':
 			return buildRunsUrl({
@@ -2132,6 +2164,15 @@ function buildOpenPageUrl(page: OpenPageName, a: OpenPageArgs): string {
 			})
 		case 'workspace_settings':
 			return buildWorkspaceSettingsUrl({ tab: a.tab })
+		case 'compare':
+			// Explicit `items` wins; otherwise preselect this chat's modified items. An
+			// empty mask (chat modified nothing) passes no items so the page keeps its
+			// select-all default instead of preselecting nothing.
+			return buildCompareUrl({
+				workspace_id: ctx.workspaceId,
+				mode: a.mode,
+				items: a.items ?? (ctx.chatItems?.length ? ctx.chatItems : undefined)
+			})
 	}
 }
 
@@ -2139,6 +2180,19 @@ function buildOpenPageUrl(page: OpenPageName, a: OpenPageArgs): string {
 // hash target), or "all <page>" when unfiltered.
 function summarizeOpenPage(url: string, page: OpenPageName): string {
 	const u = new URL(url, 'http://x')
+	if (page === 'compare') {
+		// The raw params (workspace_id + a possibly long items list) are noise here —
+		// summarize the selection instead.
+		const parts: string[] = []
+		const mode = u.searchParams.get('mode')
+		if (mode) parts.push(`mode=${mode}`)
+		const items = u.searchParams.get(COMPARE_ITEMS_PARAM)
+		if (items) {
+			const n = parseItemsMaskParam(items).size
+			parts.push(`${n} item${n === 1 ? '' : 's'} preselected`)
+		}
+		return parts.length ? parts.join(', ') : 'all pending changes'
+	}
 	const parts: string[] = []
 	u.searchParams.forEach((v, k) => parts.push(`${k}=${v}`))
 	if (u.hash) parts.push(u.hash.slice(1))
@@ -2146,8 +2200,10 @@ function summarizeOpenPage(url: string, page: OpenPageName): string {
 }
 
 export const openPageTool: Tool<{}> = {
+	// The initial def assumes an untracked chat; setSchema below rebuilds it with the
+	// caller's real surface before each iteration.
 	def: createToolDef(
-		buildOpenPageDefSchema(allowedOpenPages(), allowedTriggerKinds()),
+		buildOpenPageDefSchema(allowedOpenPages(), allowedTriggerKinds(), false),
 		'open_page',
 		OPEN_PAGE_DESCRIPTION
 	),
@@ -2162,7 +2218,8 @@ export const openPageTool: Tool<{}> = {
 		this.def = createToolDef(
 			buildOpenPageDefSchema(
 				allowedOpenPages(operatingWorkspaceFromHelpers(helpers)),
-				allowedTriggerKinds()
+				allowedTriggerKinds(),
+				(helpers as GlobalToolHelpers | undefined)?.getModifiedItems?.() !== undefined
 			),
 			'open_page',
 			OPEN_PAGE_DESCRIPTION
@@ -2185,7 +2242,14 @@ export const openPageTool: Tool<{}> = {
 		if (page === 'triggers' && triggerKind && !allowedTriggerKinds().includes(triggerKind)) {
 			return `${TRIGGER_PAGES[triggerKind].label} aren't available on this instance.`
 		}
-		const url = buildOpenPageUrl(page, parsed)
+		const urlWorkspace = workspaceId ?? get(workspaceStore)
+		if (!urlWorkspace) {
+			return 'Error: no workspace is selected, so no page can be opened.'
+		}
+		const url = buildOpenPageUrl(page, parsed, {
+			workspaceId: urlWorkspace,
+			chatItems: (ctx.helpers as GlobalToolHelpers | undefined)?.getModifiedItems?.()
+		})
 		const pageLabel = OPEN_PAGE_LABELS[page]
 		const summary = summarizeOpenPage(url, page)
 
@@ -3241,6 +3305,10 @@ export type GlobalToolHelpers = SessionToolHelpers & {
 	// Wired only for session chats (see AIChatManager): the artifact tools are session-gated.
 	artifacts?: SessionArtifactsStore
 	getChatId?: () => string | undefined
+	// Live snapshot of the items this chat modified (`kind:path` mask keys, see
+	// modifiedItemsMask.ts); undefined when the chat doesn't track them (the global
+	// side-panel chat). Backs open_page's compare-page default preselection.
+	getModifiedItems?: () => string[] | undefined
 	openArtifact?: (artifactId: string, name: string) => void
 	// Explicit "this chat is an AI session" marker for session-scoped gating
 	// (the pipeline gate). Do NOT infer it from `sessionId`: the eval harness
diff --git a/frontend/src/lib/components/copilot/chat/global/pageNavigation.test.ts b/frontend/src/lib/components/copilot/chat/global/pageNavigation.test.ts
index 5f7a84ee1c..f3e4f48b46 100644
--- a/frontend/src/lib/components/copilot/chat/global/pageNavigation.test.ts
+++ b/frontend/src/lib/components/copilot/chat/global/pageNavigation.test.ts
@@ -5,8 +5,10 @@ import {
 	buildResourcesUrl,
 	buildVariablesUrl,
 	buildTriggersUrl,
-	buildFoldersUrl
+	buildFoldersUrl,
+	buildCompareUrl
 } from './pageNavigation'
+import { parseItemsMaskParam } from '$lib/components/sessions/modifiedItemsMask'
 
 function parse(appPath: string): URL {
 	return new URL(appPath, 'http://x')
@@ -63,4 +65,19 @@ describe('pageNavigation builders', () => {
 		expect(u.pathname).toBe('/folders')
 		expect(u.search).toBe('')
 	})
+
+	it('compare carries workspace, mode, and an items mask that round-trips through the page parser', () => {
+		const items = ['script:f/foo/bar', 'trigger_schedule:u/alice/daily']
+		const u = parse(buildCompareUrl({ workspace_id: 'wm-fork-x', mode: 'fork', items }))
+		expect(u.pathname).toBe('/forks/compare')
+		expect(u.searchParams.get('workspace_id')).toBe('wm-fork-x')
+		expect(u.searchParams.get('mode')).toBe('fork')
+		expect(parseItemsMaskParam(u.searchParams.get('items')!)).toEqual(new Set(items))
+	})
+
+	it('compare omits mode and items when not provided', () => {
+		const u = parse(buildCompareUrl({ workspace_id: 'ws' }))
+		expect(u.searchParams.get('mode')).toBeNull()
+		expect(u.searchParams.get('items')).toBeNull()
+	})
 })
diff --git a/frontend/src/lib/components/copilot/chat/global/pageNavigation.ts b/frontend/src/lib/components/copilot/chat/global/pageNavigation.ts
index ea783e19e7..da249b1ed0 100644
--- a/frontend/src/lib/components/copilot/chat/global/pageNavigation.ts
+++ b/frontend/src/lib/components/copilot/chat/global/pageNavigation.ts
@@ -1,7 +1,15 @@
 import { buildFilterUrl } from '$lib/navigation'
 import { buildRunsFilterSearchbarSchema } from '$lib/components/runs/runsFilter'
 import { buildSchedulesFilterSchema } from '$lib/components/schedules/schedulesFilter'
-import { TRIGGER_PAGES, type TriggerKind } from '$lib/components/sessions/previewRouter'
+import {
+	COMPARE_PAGE,
+	TRIGGER_PAGES,
+	type TriggerKind
+} from '$lib/components/sessions/previewRouter'
+import {
+	COMPARE_ITEMS_PARAM,
+	serializeItemsMaskParam
+} from '$lib/components/sessions/modifiedItemsMask'
 
 // In-app paths for the deep-linkable preview pages the AI chat can open.
 export const RUNS_PATH = '/runs'
@@ -118,6 +126,36 @@ export function buildGroupsUrl(): string {
 	return GROUPS_PATH
 }
 
+/**
+ * Deep-link to the Compare & Deploy page (`/forks/compare`). `workspace_id` is required:
+ * inside a session preview the page loads with the *navigation* workspace as its store
+ * default, which is not necessarily the session's (possibly forked) workspace. `items`
+ * preselects exactly those `kind:path` entries (see modifiedItemsMask.ts); omitted, the
+ * page falls back to its select-all default. `mode` forces the draft or fork comparison;
+ * omitted, the page auto-picks: on a fork it lands on the view containing the masked
+ * items (draft when any of them is a pending draft, else the fork comparison); a
+ * non-fork always gets the draft view.
+ */
+export function buildCompareUrl({
+	workspace_id,
+	mode,
+	items
+}: {
+	workspace_id: string
+	mode?: 'draft' | 'fork'
+	items?: readonly string[]
+}): string {
+	return buildFilterUrl(
+		COMPARE_PAGE.path,
+		{
+			workspace_id,
+			mode,
+			[COMPARE_ITEMS_PARAM]: items ? serializeItemsMaskParam(items) : undefined
+		},
+		{ validKeys: ['workspace_id', 'mode', COMPARE_ITEMS_PARAM] }
+	)
+}
+
 /**
  * Deep-link to a trigger list page (by kind). When `open` is set, the trigger at that
  * exact path is opened in the edit drawer via the `#<path>` hash the page handles.
diff --git a/frontend/src/lib/components/sessions/modifiedItemsMask.test.ts b/frontend/src/lib/components/sessions/modifiedItemsMask.test.ts
index b66b83b2f1..6cad6121cd 100644
--- a/frontend/src/lib/components/sessions/modifiedItemsMask.test.ts
+++ b/frontend/src/lib/components/sessions/modifiedItemsMask.test.ts
@@ -1,5 +1,10 @@
 import { describe, it, expect } from 'vitest'
-import { maskKey, forkDiffKindToUserDraftKind, diffInMask } from './modifiedItemsMask'
+import {
+	maskKey,
+	forkDiffKindToUserDraftKind,
+	diffInMask,
+	maskHasDraftRow
+} from './modifiedItemsMask'
 import type { WorkspaceItemDiff } from '$lib/gen'
 
 // The fork-diff → user-draft kind bridge must stay the inverse of
@@ -57,6 +62,12 @@ describe('diffInMask', () => {
 		expect(diffInMask(diff('script', 'u/me/s'), mask)).toBe(true)
 	})
 
+	it('matches a legacy app diff under both its identity and bridged mask keys', () => {
+		expect(diffInMask(diff('app', 'u/me/legacy'), new Set(['app:u/me/legacy']))).toBe(true)
+		expect(diffInMask(diff('app', 'u/me/legacy'), new Set(['raw_app:u/me/legacy']))).toBe(true)
+		expect(diffInMask(diff('app', 'u/me/legacy'), new Set(['app:u/me/other']))).toBe(false)
+	})
+
 	it('does not match when path or kind differ, or kind has no equivalent', () => {
 		const mask = new Set(['trigger_http:f/foo/route'])
 		expect(diffInMask(diff('http_trigger', 'f/other/route'), mask)).toBe(false)
@@ -64,3 +75,25 @@ describe('diffInMask', () => {
 		expect(diffInMask(diff('folder', 'f/foo/route'), mask)).toBe(false)
 	})
 })
+
+describe('maskHasDraftRow', () => {
+	it('matches by storage path or, for a parked live draft, by its visible draft_path', () => {
+		const mask = new Set(['script:u/me/my_script'])
+		expect(maskHasDraftRow(mask, { kind: 'script', path: 'u/me/my_script' })).toBe(true)
+		expect(
+			maskHasDraftRow(mask, {
+				kind: 'script',
+				path: 'u/me/draft_123',
+				draft_path: 'u/me/my_script'
+			})
+		).toBe(true)
+	})
+
+	it('does not match a different path or kind', () => {
+		const mask = new Set(['script:u/me/my_script'])
+		expect(maskHasDraftRow(mask, { kind: 'script', path: 'u/me/other' })).toBe(false)
+		expect(
+			maskHasDraftRow(mask, { kind: 'flow', path: 'u/me/draft_123', draft_path: 'u/me/my_script' })
+		).toBe(false)
+	})
+})
diff --git a/frontend/src/lib/components/sessions/modifiedItemsMask.ts b/frontend/src/lib/components/sessions/modifiedItemsMask.ts
index 14ab16a653..7d0d3abbae 100644
--- a/frontend/src/lib/components/sessions/modifiedItemsMask.ts
+++ b/frontend/src/lib/components/sessions/modifiedItemsMask.ts
@@ -48,5 +48,42 @@ export function forkDiffKindToUserDraftKind(kind: ForkDiffKind): UserDraftItemKi
 // True when a fork-comparison diff names an item present in the chat-modified mask.
 export function diffInMask(diff: WorkspaceItemDiff, mask: Set<string>): boolean {
 	const kind = forkDiffKindToUserDraftKind(diff.kind)
-	return kind !== undefined && mask.has(maskKey(kind, diff.path))
+	if (kind !== undefined && mask.has(maskKey(kind, diff.path))) return true
+	// Legacy drag-and-drop apps tally fork diffs under `app`, and an explicit
+	// `?items=` mask names them `app:<path>` (the same kind the drafts list uses).
+	// The bridged lookup above reads them as `raw_app` (kept for chat masks, which
+	// only ever record raw apps), so accept the identity key too.
+	return diff.kind === 'app' && mask.has(maskKey('app', diff.path))
+}
+
+// `?items=` on the compare page: an explicit preselection mask passed in the URL
+// (the chat's open_page tool builds it; the page parses it). Comma-separated
+// `kind:path` keys — safe because Windmill paths cannot contain commas. An empty
+// value parses to an empty set, i.e. "preselect nothing", distinct from the param
+// being absent (no mask → the page's select-all default).
+export const COMPARE_ITEMS_PARAM = 'items'
+
+export function serializeItemsMaskParam(keys: readonly string[]): string {
+	return keys.join(',')
+}
+
+export function parseItemsMaskParam(value: string): Set<string> {
+	return new Set(
+		value
+			.split(',')
+			.map((k) => k.trim())
+			.filter(Boolean)
+	)
+}
+
+// Whether a mask names a draft row. Mask entries key items by storage path
+// (`maskKey`), but a never-deployed live-editor draft parks at an opaque
+// `draft_<uuid>` storage path while callers building an explicit `?items=` mask
+// know it by its visible `draft_path` — so a row matches under either name.
+export function maskHasDraftRow(
+	mask: Set<string>,
+	row: { kind: UserDraftItemKind; path: string; draft_path?: string }
+): boolean {
+	if (mask.has(maskKey(row.kind, row.path))) return true
+	return !!row.draft_path && mask.has(maskKey(row.kind, row.draft_path))
 }
diff --git a/frontend/src/lib/components/sessions/previewRouter.test.ts b/frontend/src/lib/components/sessions/previewRouter.test.ts
index 67c2fa8192..cd1a78fd8e 100644
--- a/frontend/src/lib/components/sessions/previewRouter.test.ts
+++ b/frontend/src/lib/components/sessions/previewRouter.test.ts
@@ -2,12 +2,27 @@ import { describe, it, expect } from 'vitest'
 import {
 	artifactUrl,
 	draftFriendlyLeaf,
+	matchReusablePage,
 	parseArtifactRoute,
 	parsePreviewItemRoute,
 	previewLocationLabel,
 	resolvePreviewTab
 } from './previewRouter'
 
+describe('matchReusablePage', () => {
+	it('matches curated pages and the compare page, ignoring query params', () => {
+		expect(matchReusablePage('/runs?path=f/a/b')?.path).toBe('/runs')
+		expect(matchReusablePage('/forks/compare?workspace_id=ws&items=script:f/a/b')?.path).toBe(
+			'/forks/compare'
+		)
+		expect(previewLocationLabel('/forks/compare?workspace_id=ws')).toBe('Compare & Deploy')
+	})
+
+	it('does not match trigger pages (they dedupe on exact URL)', () => {
+		expect(matchReusablePage('/kafka_triggers')).toBeUndefined()
+	})
+})
+
 describe('parsePreviewItemRoute', () => {
 	it('maps edit/get routes to item kinds', () => {
 		expect(parsePreviewItemRoute('/scripts/edit/f/foo/bar')).toEqual({
diff --git a/frontend/src/lib/components/sessions/previewRouter.ts b/frontend/src/lib/components/sessions/previewRouter.ts
index 7c388f9e7f..f6a3cc8be4 100644
--- a/frontend/src/lib/components/sessions/previewRouter.ts
+++ b/frontend/src/lib/components/sessions/previewRouter.ts
@@ -7,6 +7,7 @@ import {
 	Calendar,
 	Database,
 	FolderOpen,
+	GitCompareArrows,
 	Users,
 	Settings,
 	ScrollText
@@ -77,6 +78,16 @@ export function triggerLabelForPath(path: string): string | undefined {
 	return Object.values(TRIGGER_PAGES).find((t) => t.path === clean)?.label
 }
 
+// The Compare & Deploy review page. Kept out of PREVIEW_PAGES (it's not a picker
+// destination — it's reached through the chat's open_page tool or a session's
+// Review button) but known here so preview tabs label it and reuse it on
+// param changes like the curated pages.
+export const COMPARE_PAGE: PreviewPage = {
+	label: 'Compare & Deploy',
+	path: '/forks/compare',
+	icon: GitCompareArrows
+}
+
 export const pageKey = (path: string) => `page:${path}`
 export const pageHref = (path: string) => `${base}${path}`
 
@@ -95,13 +106,22 @@ export function matchPreviewPage(path: string): PreviewPage | undefined {
 	return PREVIEW_PAGES.find((p) => p.path === clean)
 }
 
+/** Match a preview href to a page whose tab should be re-pointed in place when
+ * only its query params change (the open_page filter-change behavior): the
+ * curated pages plus the compare page. Trigger pages are deliberately not
+ * matched — their tabs dedupe on the exact URL instead. */
+export function matchReusablePage(href: string): PreviewPage | undefined {
+	if (stripBase(href) === COMPARE_PAGE.path) return COMPARE_PAGE
+	return matchPreviewPage(href)
+}
+
 /** Human label for a preview tab's location — the workspace page name, trigger
  * page, run detail, or item path. Shared by the sessions tab strip and the
  * close_page matcher so both name a tab the same way. */
 export function previewLocationLabel(url: string): string {
 	const artifact = parseArtifactRoute(url)
 	if (artifact) return artifact.name || 'Artifact'
-	const page = matchPreviewPage(url)
+	const page = matchReusablePage(url)
 	if (page) return page.label
 	const trigger = triggerLabelForPath(url)
 	if (trigger) return trigger
diff --git a/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts b/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts
index 7b864e28e4..1eac3ad5c7 100644
--- a/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts
+++ b/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts
@@ -50,7 +50,7 @@ import {
 	selectPreviewTabsToClose
 } from './sessionPreviewTabs.svelte'
 import {
-	matchPreviewPage,
+	matchReusablePage,
 	parsePreviewItemRoute,
 	previewLocationLabel,
 	resolvePreviewTab
@@ -1000,10 +1000,10 @@ setOpenPagePreviewHandler(({ sessionId: callerSessionId, href, label, newTab })
 	// filter change updates it in place instead of spawning a duplicate — unless the
 	// user asked for a separate tab. open() dedupes on the exact URL, so differing
 	// filters would otherwise always open a new tab.
-	const targetPage = matchPreviewPage(href)
+	const targetPage = matchReusablePage(href)
 	if (!newTab && targetPage) {
 		const existing = owner.tabs.find(
-			(t) => matchPreviewPage(t.loc || t.url)?.path === targetPage.path
+			(t) => matchReusablePage(t.loc || t.url)?.path === targetPage.path
 		)
 		if (existing) {
 			owner.select(existing.id)
diff --git a/frontend/src/routes/(root)/(logged)/forks/compare/+page.svelte b/frontend/src/routes/(root)/(logged)/forks/compare/+page.svelte
index da67c50fad..13021ed4d1 100644
--- a/frontend/src/routes/(root)/(logged)/forks/compare/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/forks/compare/+page.svelte
@@ -20,6 +20,11 @@
 	import { switchWorkspace } from '$lib/storeUtils'
 	import { goto } from '$lib/navigation'
 	import { readChatModifiedItems } from '$lib/components/copilot/chat/HistoryManager.svelte'
+	import {
+		COMPARE_ITEMS_PARAM,
+		maskHasDraftRow,
+		parseItemsMaskParam
+	} from '$lib/components/sessions/modifiedItemsMask'
 
 	type CompareMode = 'fork' | 'draft'
 
@@ -49,6 +54,15 @@
 	// selection here; the page only swaps which comparison component is shown.
 	let forkDirection = $state<'deploy_to' | 'update'>('deploy_to')
 
+	// Explicit preselection via `?items=<kind:path,...>` (built by the chat's
+	// open_page tool). Parsed synchronously from the live URL so it can never race
+	// the children's select-all default. Present-but-empty means "preselect
+	// nothing", distinct from absent (undefined → no mask).
+	const urlItemsMask = $derived.by(() => {
+		const v = page.url.searchParams.get(COMPARE_ITEMS_PARAM)
+		return v === null ? undefined : parseItemsMaskParam(v)
+	})
+
 	// When reached via a session's Review button (`from_session=<chatId>`), preselect
 	// only the items that chat modified. The mask is the chat's stored
 	// `${UserDraftItemKind}:${storagePath}` set; undefined for a legacy chat (no
@@ -56,30 +70,33 @@
 	// Derived from the live URL: an in-app navigation to this route with a
 	// different from_session must reload the mask, not keep the first one.
 	const fromChatId = $derived(page.url.searchParams.get('from_session'))
-	let chatMask = $state<Set<string> | undefined>(undefined)
+	let sessionMask = $state<Set<string> | undefined>(undefined)
 	// The mask loads asynchronously, while the resolved value can legitimately be
 	// undefined (legacy chat). The children must not run their select-all default
 	// until the mask is known, else they'd race it and select everything. Ready
 	// immediately when there's no session to read from.
-	let chatMaskReady = $state(!page.url.searchParams.get('from_session'))
+	let sessionMaskReady = $state(!page.url.searchParams.get('from_session'))
 	$effect(() => {
 		const id = fromChatId
-		chatMask = undefined
-		chatMaskReady = !id
+		sessionMask = undefined
+		sessionMaskReady = !id
 		if (!id) return
 		untrack(() => {
 			void readChatModifiedItems(id)
 				.then((arr) => {
 					// A slower read for a superseded chat id must not win.
 					if (id !== untrack(() => fromChatId)) return
-					chatMask = arr ? new Set(arr) : undefined
+					sessionMask = arr ? new Set(arr) : undefined
 				})
 				.finally(() => {
-					if (id === untrack(() => fromChatId)) chatMaskReady = true
+					if (id === untrack(() => fromChatId)) sessionMaskReady = true
 				})
 		})
 	})
 
+	const chatMask = $derived(urlItemsMask ?? sessionMask)
+	const chatMaskReady = $derived(urlItemsMask !== undefined || sessionMaskReady)
+
 	function selectMode(v: 'deploy_to' | 'update' | 'draft') {
 		if (v === 'draft') {
 			mode = 'draft'
@@ -133,8 +150,40 @@
 
 	$effect(() => {
 		if (modeResolved || !currentWorkspaceData) return
+		if (!isFork) {
+			untrack(() => {
+				mode = 'draft'
+				modeResolved = true
+			})
+			return
+		}
+		// An explicit ?mode=fork is only deferred (not latched at init) so the
+		// non-fork fallback above can veto it — on a real fork, honor it as is.
+		if (urlMode === 'fork') {
+			untrack(() => {
+				mode = 'fork'
+				modeResolved = true
+			})
+			return
+		}
+		// A fork reached with a preselection mask but no ?mode= must land on the
+		// view where the masked items actually are: a chat's pending drafts have no
+		// fork-diff row, so fork mode would open with none of them selected. Defer
+		// until the mask and the draft list are known, then prefer the draft view
+		// when any masked item is a pending draft; else keep the fork comparison.
+		if (!chatMaskReady) return
+		const mask = chatMask
+		if (mask?.size) {
+			if (drafts.loading) return
+			const masksDraft = drafts.items.some((d) => maskHasDraftRow(mask, d))
+			untrack(() => {
+				mode = masksDraft ? 'draft' : 'fork'
+				modeResolved = true
+			})
+			return
+		}
 		untrack(() => {
-			mode = isFork ? 'fork' : 'draft'
+			mode = 'fork'
 			modeResolved = true
 		})
 	})

From 39b9a9d3d59bf2dd089ddb403a4a8e39a8b96490 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Tue, 21 Jul 2026 15:38:21 +0200
Subject: [PATCH 084/171] bump slim image Python to 3.12.13 to ship current pip
 (#10236)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix(docker): upgrade bundled pip in uv-managed Python runtimes

uv-managed Python runtimes ship a pip that lags behind, and it gets baked
into the full, slim, and EE slim images at build time. Add a pinned
PIP_VERSION build arg and upgrade pip in every real managed runtime after
`uv python install`, failing the build if any upgrade fails.

Fixes part of #10219

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(docker): simplify pip upgrade to native uv per-version install

Replace the runtime-discovery loop with a single
`uv pip install --python <ver> --system --break-system-packages --upgrade`
per known Python version. uv resolves the managed interpreter by version,
so no directory scan or symlink handling is needed; a plain RUN still fails
the build if the pinned pip can't be installed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(docker): bump slim image Python patch to 3.12.13 for current pip

The full image floats LATEST_STABLE_PY to 3.12 (→ 3.12.13), whose
uv/python-build-standalone runtime already ships pip 26.1.2. The slim and
EE-slim images pinned 3.12.12, which ships pip 26.0.1 — the only runtime
actually behind. Align them to 3.12.13 so they inherit the current pip
natively, instead of adding an explicit pip-upgrade build step.

This supersedes the earlier pip-upgrade approach on this branch: the full
image needed no change, and the slim gap was purely the stale patch pin.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 docker/DockerfileSlim   | 2 +-
 docker/DockerfileSlimEe | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/docker/DockerfileSlim b/docker/DockerfileSlim
index 92138e8181..915815f935 100644
--- a/docker/DockerfileSlim
+++ b/docker/DockerfileSlim
@@ -26,7 +26,7 @@ RUN make
 FROM ${DEBIAN_IMAGE}
 
 ARG APP=/usr/src/app
-ARG LATEST_STABLE_PY=3.12.12
+ARG LATEST_STABLE_PY=3.12.13
 
 # UV configuration
 ENV UV_CACHE_DIR=/tmp/windmill/cache/uv
diff --git a/docker/DockerfileSlimEe b/docker/DockerfileSlimEe
index 63f121abb3..d4ac4bd21c 100644
--- a/docker/DockerfileSlimEe
+++ b/docker/DockerfileSlimEe
@@ -26,7 +26,7 @@ RUN make
 FROM ${DEBIAN_IMAGE}
 
 ARG APP=/usr/src/app
-ARG LATEST_STABLE_PY=3.12.12
+ARG LATEST_STABLE_PY=3.12.13
 
 # UV configuration
 ENV UV_CACHE_DIR=/tmp/windmill/cache/uv

From 9bc1f6212837155c964a7db7103aabbcf14cbce2 Mon Sep 17 00:00:00 2001
From: Guilhem <guilhemlemouel@gmail.com>
Date: Tue, 21 Jul 2026 16:01:44 +0200
Subject: [PATCH 085/171] =?UTF-8?q?feat(ai):=20session=20chat=20nits=20?=
 =?UTF-8?q?=E2=80=94=20empty=20sends,=20command=20picker=20polish,=20sessi?=
 =?UTF-8?q?on-state=20prompt=20(#10233)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* feat(ai): session chat nits: empty sends, picker polish, session state

* fix(ai): scope empty-send turns to global chat and pin new behavior

* fix(ai): align grouped search nav with display order, enable empty-send button

* fix(ai): fork fallback for unlisted workspaces, section headers across branches

* style(ai): hint-colored 3xs picker section headers, drop inline row descriptions

* style(ai): more spacing between picker sections

* fix(ai): require context elements for empty global-chat sends

* style(ai): no empty bubble for text-free messages

* fix(ai): review round 2 — keyboard tooltip access, requestedMode guard, no display names in prompt

* fix(ai): queue context-only drafts pressed while a response streams

* fix(ai): shared context identity for queued badges and full queue-context union
---
 .../src/lib/components/DrillPicker.svelte     | 141 ++++++++++++++++--
 .../copilot/chat/AIChatInput.svelte           |  50 ++++---
 .../copilot/chat/AIChatManager.svelte.ts      | 121 +++++++++------
 .../copilot/chat/AIChatManager.test.ts        |  57 ++++++-
 .../copilot/chat/AIChatMessage.svelte         |   4 +-
 .../copilot/chat/ChatCommandPicker.svelte     |  32 ++--
 .../copilot/chat/QueuedMessageChip.svelte     |  17 ++-
 .../lib/components/copilot/chat/context.ts    |  16 ++
 .../copilot/chat/global/core.test.ts          |  41 +++++
 .../components/copilot/chat/global/core.ts    |  65 ++++++++
 frontend/src/lib/components/drillPicker.ts    |   4 +
 .../sessions/sessionRuntime.svelte.ts         |  20 ++-
 12 files changed, 474 insertions(+), 94 deletions(-)

diff --git a/frontend/src/lib/components/DrillPicker.svelte b/frontend/src/lib/components/DrillPicker.svelte
index 49a6fe0b8e..524a33e249 100644
--- a/frontend/src/lib/components/DrillPicker.svelte
+++ b/frontend/src/lib/components/DrillPicker.svelte
@@ -16,6 +16,10 @@ leaves and ignores the current scope.
 	import { ChevronLeft, ChevronRight, Loader2 } from 'lucide-svelte'
 	import TextInput from '$lib/components/text_input/TextInput.svelte'
 	import SearchItems from '$lib/components/SearchItems.svelte'
+	import Portal from '$lib/components/Portal.svelte'
+	import { zIndexes } from '$lib/zIndexes'
+	import { createFloatingActions } from 'svelte-floating-ui'
+	import { flip, offset, shift } from 'svelte-floating-ui/dom'
 	import { generateRandomString } from '$lib/utils'
 	import { onMount, untrack, type Snippet } from 'svelte'
 	import {
@@ -65,6 +69,9 @@ leaves and ignores the current scope.
 		 * branch to carry a `loading` flag. Needed by flat workspace layouts
 		 * whose root entries only exist once items are fetched. */
 		rootLoading?: boolean
+		/** Full-text hover tooltip for a leaf row (rows truncate their text).
+		 * Return `undefined` to show none for that leaf. */
+		rowTooltip?: (leaf: DrillLeaf<L>) => string | undefined
 	}
 
 	let {
@@ -80,7 +87,8 @@ leaves and ignores the current scope.
 		leafSecondary,
 		onScopeChange,
 		onFilterChange,
-		rootLoading = false
+		rootLoading = false,
+		rowTooltip
 	}: Props = $props()
 
 	let searchInput: TextInput | undefined = $state()
@@ -116,6 +124,9 @@ leaves and ignores the current scope.
 	$effect(() => {
 		void filter
 		onFilterChange?.(filter)
+		// Rows re-render under a stationary pointer without firing mouseleave,
+		// which would strand the tooltip on a removed row.
+		tooltipLeave()
 	})
 
 	/** Tracks whether the last user action was mouse movement (true) or
@@ -141,18 +152,24 @@ leaves and ignores the current scope.
 	)
 	let searchedItems: (SearchEntry & { marked: string })[] | undefined = $state(undefined)
 
-	// Group filtered results by their nearest-branch ancestor for display.
+	// Group filtered results for display: nearest `searchGroup` branch ancestor
+	// first, the leaf's own `section` otherwise.
 	const searchResultsByGroup = $derived.by(() => {
 		const groups = new Map<
 			string,
-			{ group: DrillBranch<L> | null; items: (SearchEntry & { marked: string })[] }
+			{ key: string; label: string | null; items: (SearchEntry & { marked: string })[] }
 		>()
-		if (!searchedItems) return [] as { group: DrillBranch<L> | null; items: SearchEntry[] }[]
+		if (!searchedItems) return [] as { key: string; label: string | null; items: SearchEntry[] }[]
 		for (const r of searchedItems) {
-			const gkey = r.group?.key ?? '__none'
+			const gkey = r.group?.key ?? (r.leaf.section ? `__section:${r.leaf.section}` : '__none')
 			const existing = groups.get(gkey)
 			if (existing) existing.items.push(r)
-			else groups.set(gkey, { group: r.group, items: [r] })
+			else
+				groups.set(gkey, {
+					key: gkey,
+					label: r.group?.label ?? r.leaf.section ?? null,
+					items: [r]
+				})
 		}
 		return Array.from(groups.values())
 	})
@@ -169,9 +186,26 @@ leaves and ignores the current scope.
 		)
 	)
 
+	// Browse rows annotated with the section header rendered above them. A
+	// header is emitted when a leaf's section differs from the previous LEAF's
+	// section — comparing against the previous entry of any type would insert a
+	// duplicate header after every branch interleaved between same-section leaves.
+	const entryRows = $derived.by(() => {
+		let lastLeafSection: string | undefined
+		return entryList.map((entry) => {
+			const section = entry.type === 'leaf' ? entry.node.section : undefined
+			const header = entry.type === 'leaf' && section !== lastLeafSection ? section : undefined
+			if (entry.type === 'leaf') lastLeafSection = section
+			return { entry, header }
+		})
+	})
+
+	// Search nav must follow DISPLAY order (the grouped blocks), not the raw
+	// fuzzy ranking — grouping reorders interleaved results, and rank-ordered
+	// keys would make ArrowUp/Down jump between non-adjacent visible rows.
 	const navKeys = $derived(
 		isSearching
-			? (searchedItems ?? ([] as typeof searchItems)).map((r) => r.leaf.key)
+			? searchResultsByGroup.flatMap((g) => g.items.map((r) => r.leaf.key))
 			: entryList.map((e) => e.key)
 	)
 
@@ -210,13 +244,30 @@ leaves and ignores the current scope.
 		el?.scrollIntoView({ block: 'nearest', behavior: 'smooth' })
 	}
 
+	function leafForKey(key: string): DrillLeaf<L> | undefined {
+		if (isSearching) return (searchedItems ?? []).find((r) => r.leaf.key === key)?.leaf
+		const entry = entryList.find((e) => e.key === key)
+		return entry?.type === 'leaf' ? entry.node : undefined
+	}
+
 	function moveHighlight(delta: 1 | -1) {
 		if (navKeys.length === 0) return
 		const cur = navKeys.indexOf(highlightedKey ?? '')
 		const next = cur < 0 ? 0 : (cur + delta + navKeys.length) % navKeys.length
 		highlightedKey = navKeys[next]
 		mouseActive = false
-		requestAnimationFrame(scrollHighlightIntoView)
+		requestAnimationFrame(() => {
+			scrollHighlightIntoView()
+			// Keyboard parity for the tooltip: anchor it to the row the highlight
+			// landed on — otherwise the full descriptions are pointer-only.
+			if (!rowTooltip || !highlightedKey) return
+			const leaf = leafForKey(highlightedKey)
+			const el = pickerRoot?.querySelector<HTMLElement>(
+				`[data-nav-key="${CSS.escape(highlightedKey)}"]`
+			)
+			if (leaf && el) tooltipEnter(el, leaf)
+			else tooltipLeave()
+		})
 	}
 
 	function setHoverHighlight(key: string) {
@@ -231,6 +282,40 @@ leaves and ignores the current scope.
 		onPick(leaf)
 	}
 
+	// Single shared hover tooltip (opt-in via `rowTooltip`): one floating node
+	// re-anchored to the hovered row, instead of a popover per row — rows can
+	// number in the hundreds. Portaled to body because the picker often lives
+	// inside an overflow-clipped floating container that would cut it off.
+	let tooltipText = $state<string | undefined>(undefined)
+	let tooltipTimer: ReturnType<typeof setTimeout> | undefined
+	const [tooltipRef, tooltipContent] = createFloatingActions({
+		strategy: 'fixed',
+		placement: 'right-start',
+		middleware: [offset(8), flip(), shift({ padding: 8 })],
+		autoUpdate: true
+	})
+
+	function tooltipEnter(el: HTMLElement, leaf: DrillLeaf<L>) {
+		if (!rowTooltip) return
+		clearTimeout(tooltipTimer)
+		const text = rowTooltip(leaf)
+		if (!text) {
+			tooltipText = undefined
+			return
+		}
+		tooltipTimer = setTimeout(() => {
+			tooltipRef(el)
+			tooltipText = text
+		}, 250)
+	}
+
+	function tooltipLeave() {
+		clearTimeout(tooltipTimer)
+		tooltipText = undefined
+	}
+
+	$effect(() => () => clearTimeout(tooltipTimer))
+
 	function activate(key: string | undefined) {
 		if (!key) return
 		if (isSearching) {
@@ -390,6 +475,7 @@ leaves and ignores the current scope.
 	{@const key = leaf.key}
 	{@const isHl = key === highlightedKey}
 	{@const isCur = !!leaf.current}
+	{@const tip = rowTooltip?.(leaf)}
 	<button
 		type="button"
 		id={idFor(key)}
@@ -397,6 +483,7 @@ leaves and ignores the current scope.
 		aria-selected={isHl}
 		data-nav-key={key}
 		aria-current={isCur ? 'true' : undefined}
+		aria-label={tip ? `${leaf.label} — ${tip}` : undefined}
 		class="w-full text-left flex items-center gap-2 px-3 transition-colors {baseClass} {isHl
 			? 'bg-surface-hover'
 			: ''} {isCur ? 'cursor-default text-emphasis font-medium' : ''} {leaf.disabled
@@ -405,7 +492,11 @@ leaves and ignores the current scope.
 		disabled={leaf.disabled}
 		onmousedown={(e) => e.preventDefault()}
 		onclick={() => pick(leaf)}
-		onmouseenter={() => setHoverHighlight(key)}
+		onmouseenter={(e) => {
+			setHoverHighlight(key)
+			tooltipEnter(e.currentTarget as HTMLElement, leaf)
+		}}
+		onmouseleave={tooltipLeave}
 	>
 		{@render defaultLeafIcon(leaf)}
 		<div class="min-w-0 flex-1">
@@ -479,10 +570,12 @@ leaves and ignores the current scope.
 			{:else if total === 0}
 				<div role="status" class="px-3 py-2 text-xs text-tertiary">No matches</div>
 			{:else}
-				{#each searchResultsByGroup as { group, items } (group?.key ?? '__none')}
-					{#if group}
-						<div class="px-3 pt-3 pb-1 text-2xs uppercase tracking-wide text-tertiary font-medium">
-							{group.label}
+				{#each searchResultsByGroup as { key, label, items } (key)}
+					{#if label}
+						<div
+							class="px-3 pt-3 pb-1 mt-2 first:mt-0 text-3xs uppercase tracking-wide text-hint font-medium"
+						>
+							{label}
 						</div>
 					{/if}
 					<ul class="pb-1">
@@ -500,8 +593,15 @@ leaves and ignores the current scope.
 			<div role="status" class="px-3 py-2 text-xs text-tertiary">Empty</div>
 		{:else}
 			<div class="flex flex-col py-1">
-				{#each entryList as entry (entry.key)}
+				{#each entryRows as { entry, header } (entry.key)}
 					{@const isHl = entry.key === highlightedKey}
+					{#if header}
+						<div
+							class="px-3 pt-2 pb-1 mt-2 first:mt-0 text-3xs uppercase tracking-wide text-hint font-medium"
+						>
+							{header}
+						</div>
+					{/if}
 					{#if entry.type === 'leaf'}
 						{@render leafRow(
 							entry.node,
@@ -544,6 +644,19 @@ leaves and ignores the current scope.
 	</div>
 </div>
 
+{#if tooltipText}
+	<Portal target="body">
+		<div
+			use:tooltipContent
+			class="max-w-72 rounded-md border bg-surface px-2.5 py-1.5 text-xs text-primary shadow-md whitespace-pre-wrap break-words"
+			style="z-index: {zIndexes.tooltip};"
+			role="tooltip"
+		>
+			{tooltipText}
+		</div>
+	</Portal>
+{/if}
+
 <style>
 	/* Path truncates from the start (left ellipsis) so the deepest
 	 * (rightmost) folder stays visible. `unicode-bidi: plaintext` keeps
diff --git a/frontend/src/lib/components/copilot/chat/AIChatInput.svelte b/frontend/src/lib/components/copilot/chat/AIChatInput.svelte
index ce7b27c593..427856d291 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatInput.svelte
+++ b/frontend/src/lib/components/copilot/chat/AIChatInput.svelte
@@ -4,7 +4,12 @@
 	import ContextTextarea from './ContextTextarea.svelte'
 	import AttachedFilesBar from './files/AttachedFilesBar.svelte'
 	import autosize from '$lib/autosize'
-	import type { AppDomSelectorElement, ContextElement } from './context'
+	import {
+		contextElementKey,
+		isSameContextElement,
+		type AppDomSelectorElement,
+		type ContextElement
+	} from './context'
 	import { AIMode } from './AIChatManager.svelte'
 	import { CHAT_INPUT_PADDING, getAiChatManager } from './aiChatManagerContext'
 	import { formatMention } from './mention'
@@ -235,20 +240,7 @@
 		(selectedContext ?? []).filter((c): c is AppDomSelectorElement => c.type === 'app_dom_selector')
 	)
 
-	// DOM selector chips can share a display title (two `button.btn` from repeated
-	// elements), so identify them by (appPath, selector) — keying or removing by
-	// title would collide, giving repeated chips one Svelte key and deleting them
-	// together. Other context types stay identified by (type, title).
-	function contextKey(c: ContextElement): string {
-		return c.type === 'app_dom_selector' ? `dom:${c.appPath}:${c.selector}` : `${c.type}:${c.title}`
-	}
-	function isSameContextElement(a: ContextElement, b: ContextElement): boolean {
-		if (a.type !== b.type) return false
-		if (a.type === 'app_dom_selector' && b.type === 'app_dom_selector') {
-			return a.selector === b.selector && a.appPath === b.appPath
-		}
-		return a.title === b.title
-	}
+	const contextKey = contextElementKey
 
 	/** Append `@title` to the textarea so the button-picker path stays in
 	 * sync with the inline `@<word>` mention path — both leave a visible
@@ -446,9 +438,19 @@
 			// auto-sent when the streaming turn completes successfully.
 			// Editing-while-loading keeps the old discard behavior. Paste
 			// tokens are expanded into the queued text (the queue is plain
-			// strings), so the full content survives the auto-send.
-			if (editingMessageIndex === null && (instructions.trim() || images.length > 0)) {
-				aiChatManager.queueMessage(expanded(chatDraft(instructions, pastes)), images)
+			// strings), so the full content survives the auto-send. A GLOBAL
+			// context-only draft counts too (mirrors the idle send guard), and
+			// the selection is pinned to the queued entry so the flush sends the
+			// chips picked at press time.
+			if (
+				editingMessageIndex === null &&
+				(instructions.trim() ||
+					images.length > 0 ||
+					(aiChatManager.mode === AIMode.GLOBAL && selectedContext.length > 0))
+			) {
+				aiChatManager.queueMessage(expanded(chatDraft(instructions, pastes)), images, [
+					...selectedContext
+				])
 				contextTextareaComponent?.clearForSend()
 				instructions = ''
 				pastes = []
@@ -694,8 +696,18 @@
 
 {#snippet sendStopButton()}
 	{@const isLoading = loading ?? aiChatManager.loading}
+	{@const emptyDraft = instructions.trim().length === 0 && images.length === 0}
+	<!-- A text-free GLOBAL draft with context chips is a valid turn (Enter
+	     already sends it), so the button stays enabled there for pointer/touch
+	     parity — mirrors the sendRequest guard. Custom onSendRequest consumers
+	     (inline ⌘K) and editor copilots need content. -->
 	{@const sendDisabled =
-		disabled || (instructions.trim().length === 0 && images.length === 0) || pendingImages > 0}
+		disabled ||
+		pendingImages > 0 ||
+		(emptyDraft &&
+			(onSendRequest !== undefined ||
+				aiChatManager.mode !== AIMode.GLOBAL ||
+				selectedContext.length === 0))}
 	<Button
 		variant="subtle"
 		unifiedSize="md"
diff --git a/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts b/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
index e498323b85..4c4304f27b 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
+++ b/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
@@ -81,6 +81,7 @@ import {
 	createAppBackendRunnableContextElement,
 	createAppFrontendFileContextElement,
 	flattenDatatablesToAppContextElements,
+	isSameContextElement,
 	type ContextElement,
 	type AppDatatableElement
 } from './context'
@@ -107,6 +108,9 @@ import {
 	prepareGlobalSystemMessage,
 	prepareGlobalUserMessage,
 	type AiSkillListItem,
+	type ChatCommandItem,
+	type SessionPromptContext,
+	getSessionContextPromptSection,
 	type GlobalToolHelpers
 } from './global/core'
 import { formatChatJobCompletion } from './datatableTools'
@@ -512,6 +516,11 @@ export class AIChatManager {
 	// tool `helpers` in GLOBAL mode so the preview/deploy tools dispatch to THIS
 	// session rather than the UI-active one — keeps backgrounded sessions isolated.
 	sessionId: string | undefined = undefined
+	// Live session facts (fork vs live workspace) for the GLOBAL system prompt.
+	// A resolver set by the session runtime — copilot must not import the
+	// sessions modules — and re-read on every system-message rebuild; the send
+	// path rebuilds after beforeSend, so a fork committed there is picked up.
+	sessionContextResolver: (() => SessionPromptContext | undefined) | undefined = undefined
 	// Resolves the workspace this chat operates on. Session chats set it to their
 	// own (possibly forked) workspace so the chat targets it WITHOUT switching the
 	// global workspaceStore. Undefined for the global side-panel chat, which
@@ -944,18 +953,28 @@ export class AIChatManager {
 	// alongside workspace skills. Unlike a skill, these run locally and never
 	// reach the model; the submit path intercepts them first, so they shadow any
 	// workspace skill of the same name.
-	readonly sessionBuiltinCommands: AiSkillListItem[] = [
-		{ name: COMPACT_COMMAND_NAME, description: 'Summarize the conversation to free up context' },
-		{ name: CLEAR_COMMAND_NAME, description: 'Clear the conversation and start a new chat' }
+	readonly sessionBuiltinCommands: ChatCommandItem[] = [
+		{
+			name: COMPACT_COMMAND_NAME,
+			description: 'Summarize the conversation to free up context',
+			kind: 'action'
+		},
+		{
+			name: CLEAR_COMMAND_NAME,
+			description: 'Clear the conversation and start a new chat',
+			kind: 'action'
+		}
 	]
 
 	// Built-ins followed by workspace skills, with any skill whose name collides
 	// with a built-in dropped: the picker keys leaves by name, so a duplicate
 	// would break its keyed list and ambiguous-resolve nav. Built-ins win — they
 	// already shadow same-named skills at execution (the submit interception).
-	sessionCommands: AiSkillListItem[] = $derived([
+	sessionCommands: ChatCommandItem[] = $derived([
 		...this.sessionBuiltinCommands,
-		...this.globalSkills.filter((s) => !this.sessionBuiltinCommands.some((b) => b.name === s.name))
+		...this.globalSkills
+			.filter((s) => !this.sessionBuiltinCommands.some((b) => b.name === s.name))
+			.map((s) => ({ ...s, kind: 'skill' as const }))
 	])
 
 	allowedModes: Record<AIMode, boolean> = $derived({
@@ -1445,8 +1464,9 @@ export class AIChatManager {
 	 * alongside it. */
 	queueMessage(text: string, images: AttachedImage[] = [], context?: ContextElement[]) {
 		const trimmed = text.trim()
-		// An image with no text is still a message; only a fully empty send is ignored.
-		if (!trimmed && images.length === 0) {
+		// An image-only or context-only draft is still a message; only a fully
+		// empty send is ignored (mirrors the idle empty-send guard).
+		if (!trimmed && images.length === 0 && (context?.length ?? 0) === 0) {
 			return
 		}
 		if (trimmed) {
@@ -1459,36 +1479,29 @@ export class AIChatManager {
 			}
 			this.queuedImages = merged.slice(0, MAX_ATTACHED_IMAGES)
 		}
-		// Pin the context snapshot to the queued message. The queued text accumulates
-		// (several inline prompts can queue during one stream), so union the DOM
-		// selector chips too — replacing would drop an earlier prompt's element and
-		// misapply its instruction. Non-DOM context comes from the latest snapshot.
+		// Pin the context snapshot to the queued message. Several prompts can
+		// queue during one stream and each pinned the selection at its press —
+		// union by identity so a later press doesn't drop an earlier prompt's
+		// chips (all pinned entries ride the single flushed turn together).
 		if (context && context.length > 0) {
-			if (!this.queuedContext) {
-				this.queuedContext = context
-			} else {
-				const merged = [...context]
-				for (const c of this.queuedContext) {
-					if (
-						c.type === 'app_dom_selector' &&
-						!merged.some(
-							(m) =>
-								m.type === 'app_dom_selector' &&
-								m.selector === c.selector &&
-								m.appPath === c.appPath
-						)
-					) {
-						merged.push(c)
-					}
+			const merged = [...(this.queuedContext ?? [])]
+			for (const c of context) {
+				if (!merged.some((m) => isSameContextElement(m, c))) {
+					merged.push(c)
 				}
-				this.queuedContext = merged
 			}
+			this.queuedContext = merged
 		}
 	}
 
-	/** Whether anything is waiting in the queue — an image-only message has empty text. */
+	/** Whether anything is waiting in the queue — an image-only or context-only
+	 * message has empty text. */
 	#hasQueuedMessage(): boolean {
-		return this.queuedMessage !== '' || this.queuedImages.length > 0
+		return (
+			this.queuedMessage !== '' ||
+			this.queuedImages.length > 0 ||
+			(this.queuedContext?.length ?? 0) > 0
+		)
 	}
 
 	/** Detach the queue for sending. Text, images and context always leave together. */
@@ -1707,6 +1720,10 @@ export class AIChatManager {
 			previewTools: this.isSessionChat,
 			skills: this.globalSkills
 		})
+		const sessionCtx = this.sessionContextResolver?.()
+		if (sessionCtx) {
+			systemMessage.content += getSessionContextPromptSection(sessionCtx)
+		}
 		const baseHelpers: GlobalToolHelpers = {
 			// A session targets its own fixed (possibly forked) workspace, so capture it for
 			// permission gating. The global side-panel chat follows the live navigation
@@ -1772,9 +1789,13 @@ export class AIChatManager {
 			previewTools: this.isSessionChat,
 			skills: this.globalSkills
 		})
-		// Preserve the active pipeline-editor augmentation that configureGlobalMode
-		// adds — otherwise update_user_instructions (which calls this) would drop the
-		// /pipeline/<folder> context + direct-draft/materialize guidance mid-session.
+		// Preserve the session-state and active pipeline-editor augmentations that
+		// configureGlobalMode adds — otherwise update_user_instructions (which calls
+		// this) would drop them mid-session.
+		const sessionCtx = this.sessionContextResolver?.()
+		if (sessionCtx) {
+			systemMessage.content += getSessionContextPromptSection(sessionCtx)
+		}
 		const pipeline = this.pipelineAiChatHelpers
 		if (pipeline) {
 			systemMessage.content += getPipelinePromptSection(pipeline.getPipelineContext())
@@ -2220,9 +2241,9 @@ export class AIChatManager {
 	) => {
 		// Returns whether the input was consumed: true when it was sent as a chat
 		// turn OR handled as a local built-in command, false when it was dropped
-		// without being acted on (mode hidden, empty, beforeSend failed). The
-		// queue flush restores the queued message only on false, so a consumed
-		// command isn't re-queued and re-fired into the next conversation.
+		// without being acted on (mode hidden, empty non-GLOBAL draft, beforeSend
+		// failed). The queue flush restores the queued message only on false, so a
+		// consumed command isn't re-queued and re-fired into the next conversation.
 		const requestedMode = options.mode ?? this.mode
 		if (!isAIModeVisible(requestedMode)) {
 			return false
@@ -2237,12 +2258,20 @@ export class AIChatManager {
 		if (options.instructions !== undefined) {
 			this.instructions = options.instructions
 		}
-		// Only a truly empty draft is dropped here. An image with no text is a
-		// valid GLOBAL-mode message; outside GLOBAL an image-bearing draft must
-		// still get past this guard to reach the refusal below, which puts it
-		// back in the composer instead of silently losing it.
+		// A text-free GLOBAL draft is a real turn — rendered as its context chips
+		// (no bubble), with the empty-message marker substituted further down —
+		// but only when it carries something for the model: images or selected
+		// context elements. A bare accidental Enter is dropped in every mode (in
+		// editor copilots it would burn a turn for nothing). Gate on requestedMode,
+		// not this.mode: changeMode can decline a switch (e.g. SCRIPT with no
+		// model), and a declined non-GLOBAL request must not slip through as a
+		// GLOBAL empty turn. Image-bearing non-GLOBAL drafts still pass through
+		// to the switch-back refusal below so attachments aren't silently lost.
 		if (!this.instructions.trim() && (options.images?.length ?? 0) === 0) {
-			return false
+			const contextEls = options.contextOverride ?? this.contextManager?.getSelectedContext() ?? []
+			if (requestedMode !== AIMode.GLOBAL || contextEls.length === 0) {
+				return false
+			}
 		}
 		// Built-in session commands run locally instead of becoming a chat turn.
 		// Intercepted here — before the beforeSend workspace commit, file regrants,
@@ -2507,7 +2536,15 @@ export class AIChatManager {
 			const sentImages = images
 			// The LLM gets the full pasted content; the display message above keeps
 			// the compact tokens + registry so the bubble can render/expand chips.
-			const oldInstructions = expanded(chatDraft(this.instructions, pastes))
+			// A text-free send (and image-only sends carry their images as the
+			// content) gets an explicit model-facing marker: every mode's template
+			// interpolates the text under an INSTRUCTIONS header, and a dangling
+			// header confuses models into echoing it back verbatim.
+			const expandedInstructions = expanded(chatDraft(this.instructions, pastes))
+			const oldInstructions =
+				expandedInstructions.trim() || sentImages.length > 0
+					? expandedInstructions
+					: '(the user sent an empty message)'
 			// Deliver background-job completions to the model as a preamble on this
 			// turn (notify-only wake). Folded into the model-facing text only — the
 			// display bubble keeps this.instructions, and no extra message is added, so
diff --git a/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts b/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts
index ba6508e87c..1962768140 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts
+++ b/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts
@@ -914,11 +914,66 @@ describe('AIChatManager queued messages', () => {
 		expect(hasImage).toBe(true)
 	})
 
-	it('still ignores a send with no text and no images', async () => {
+	// A text-free GLOBAL send carrying context chips is a real turn — the
+	// transcript renders just the chips (no bubble), and the model-facing text
+	// carries an explicit marker instead of a dangling INSTRUCTIONS header the
+	// model would echo back.
+	it('sends a context-only GLOBAL draft as a turn with an empty-message marker', async () => {
 		replyWith('done')
 		const manager = createManager(createInputMock())
 		manager.mode = AIMode.GLOBAL
 
+		await manager.sendRequest({
+			instructions: '',
+			contextOverride: [{ type: 'code', content: 'x', title: 'snippet', lang: 'bun' }]
+		})
+
+		expect(mocks.runChatLoop).toHaveBeenCalled()
+		const sent = mocks.runChatLoop.mock.calls[0][0].messages.at(-1)
+		expect(sent.content).toContain('(the user sent an empty message)')
+		// The stored message keeps what the user typed — nothing — so the
+		// transcript renders chips only, and edit/retry restores an empty draft.
+		expect(manager.displayMessages.find((m) => m.role === 'user')?.content).toBe('')
+	})
+
+	// With nothing riding the draft at all — no text, images, or context — the
+	// send is dropped in every mode; a bare accidental Enter must not burn a turn.
+	it('ignores an empty send with no context in GLOBAL mode', async () => {
+		replyWith('done')
+		const manager = createManager(createInputMock())
+		manager.mode = AIMode.GLOBAL
+
+		await manager.sendRequest({ instructions: '' })
+
+		expect(mocks.runChatLoop).not.toHaveBeenCalled()
+	})
+
+	// A context-only draft queued mid-stream must be retained — the queue guard
+	// previously dropped anything with no text and no images, silently eating
+	// the draft the idle path would have sent.
+	it('queues a context-only draft while streaming', () => {
+		const manager = createManager(createInputMock())
+		manager.mode = AIMode.GLOBAL
+		const a = { type: 'code' as const, content: 'x', title: 'snippet', lang: 'bun' as const }
+		const b = { type: 'code' as const, content: 'y', title: 'other', lang: 'bun' as const }
+
+		manager.queueMessage('', [], [a])
+		// A second queued prompt pins its own selection; the union must keep the
+		// earlier prompt's chip and not duplicate re-selected ones.
+		manager.queueMessage('', [], [b, a])
+
+		expect(manager.queuedContext).toEqual([a, b])
+		// A fully empty queue attempt still leaves nothing behind.
+		manager.dequeueMessage()
+		manager.queueMessage('', [], [])
+		expect(manager.queuedContext).toBeUndefined()
+	})
+
+	it('still ignores an empty send outside GLOBAL mode', async () => {
+		replyWith('done')
+		const manager = createManager(createInputMock())
+		manager.mode = AIMode.NAVIGATOR
+
 		await manager.sendRequest({ instructions: '' })
 
 		expect(mocks.runChatLoop).not.toHaveBeenCalled()
diff --git a/frontend/src/lib/components/copilot/chat/AIChatMessage.svelte b/frontend/src/lib/components/copilot/chat/AIChatMessage.svelte
index b1bf92de1b..b6c6d20c64 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatMessage.svelte
+++ b/frontend/src/lib/components/copilot/chat/AIChatMessage.svelte
@@ -119,7 +119,9 @@
 							{/each}
 						</div>
 					{/if}
-					{#if message.content.trim() !== '' || !(message.images && message.images.length > 0)}
+					<!-- Text-free messages show only their context chips / images — no
+					     empty bubble (empty sends require chips or images to go out). -->
+					{#if message.content.trim() !== ''}
 						<div
 							class="text-xs px-3 py-2 w-fit max-w-[min(32rem,100%)] bg-surface-accent-selected text-accent rounded-lg relative group break-words"
 						>
diff --git a/frontend/src/lib/components/copilot/chat/ChatCommandPicker.svelte b/frontend/src/lib/components/copilot/chat/ChatCommandPicker.svelte
index 6cd72e50db..995a84708c 100644
--- a/frontend/src/lib/components/copilot/chat/ChatCommandPicker.svelte
+++ b/frontend/src/lib/components/copilot/chat/ChatCommandPicker.svelte
@@ -1,12 +1,11 @@
 <script lang="ts">
-	import { Sparkles } from 'lucide-svelte'
 	import DrillPicker from '$lib/components/DrillPicker.svelte'
 	import type { DrillLeaf, DrillNode } from '$lib/components/drillPicker'
-	import type { AiSkillListItem } from './global/core'
+	import type { ChatCommandItem } from './global/core'
 
 	interface Props {
-		skills: AiSkillListItem[]
-		onSelect: (skill: AiSkillListItem) => void
+		skills: ChatCommandItem[]
+		onSelect: (skill: ChatCommandItem) => void
 		setShowing?: (showing: boolean) => void
 		externalFilter?: string
 		autoFocus?: boolean
@@ -20,13 +19,21 @@
 
 	let inner = $state<DrillPickerHandle | undefined>(undefined)
 
-	const tree = $derived<DrillNode<AiSkillListItem>[]>(
+	const SECTION_LABELS: Record<NonNullable<ChatCommandItem['kind']>, string> = {
+		action: 'Actions',
+		skill: 'Skills'
+	}
+
+	// No `secondary`: rows show just the command; the full description lives in
+	// the hover tooltip (rowTooltip below). It stays in `searchableText` so
+	// filtering by description keeps working.
+	const tree = $derived<DrillNode<ChatCommandItem>[]>(
 		skills.map((skill) => ({
 			type: 'leaf' as const,
 			key: `skill:${skill.name}`,
 			label: `/${skill.name}`,
-			secondary: skill.description,
 			searchableText: `${skill.name} ${skill.description}`,
+			section: skill.kind ? SECTION_LABELS[skill.kind] : undefined,
 			data: skill
 		}))
 	)
@@ -35,7 +42,7 @@
 		inner?.handleKeydown(e)
 	}
 
-	function handlePick(leaf: DrillLeaf<AiSkillListItem>) {
+	function handlePick(leaf: DrillLeaf<ChatCommandItem>) {
 		onSelect(leaf.data)
 	}
 
@@ -51,18 +58,17 @@
 	})
 </script>
 
-{#snippet skillIcon(_leaf: DrillLeaf<AiSkillListItem>)}
-	<Sparkles size={12} class="shrink-0 text-tertiary" />
-{/snippet}
-
-<div class="w-[min(340px,calc(100vw-20px))] max-h-64 overflow-hidden">
+<!-- This wrapper is the scroll container: the flush DrillPicker sizes to its
+     content (h-full can't resolve against a max-h-only parent), so overflow
+     must scroll here or the list is just clipped at 16rem. -->
+<div class="w-[min(340px,calc(100vw-20px))] max-h-64 overflow-y-auto">
 	<DrillPicker
 		bind:this={inner}
 		{tree}
 		onPick={handlePick}
 		{externalFilter}
 		{autoFocus}
-		leafIcon={skillIcon}
+		rowTooltip={(leaf) => leaf.data.description}
 		flush
 	/>
 </div>
diff --git a/frontend/src/lib/components/copilot/chat/QueuedMessageChip.svelte b/frontend/src/lib/components/copilot/chat/QueuedMessageChip.svelte
index a6e6c248e6..54c55864c1 100644
--- a/frontend/src/lib/components/copilot/chat/QueuedMessageChip.svelte
+++ b/frontend/src/lib/components/copilot/chat/QueuedMessageChip.svelte
@@ -1,6 +1,8 @@
 <script lang="ts">
 	import { Button } from '$lib/components/common'
 	import { X } from 'lucide-svelte'
+	import ContextElementBadge from './ContextElementBadge.svelte'
+	import { contextElementKey } from './context'
 	import { getAiChatManager } from './aiChatManagerContext'
 
 	// The single message typed while a turn was streaming, waiting to be
@@ -11,9 +13,12 @@
 	const aiChatManager = getAiChatManager()
 </script>
 
-<!-- Image-only queues have empty text; without the image row the queued draft
-     would be invisible — undismissable, then auto-sent as a surprise turn. -->
-{#if aiChatManager.queuedMessage || aiChatManager.queuedImages.length > 0}
+<!-- Image-only and context-only queues have empty text; without their image /
+     badge row the queued draft would be invisible — undismissable, then
+     auto-sent as a surprise turn. Badges render here only for context-ONLY
+     queues: text queues pin the same chips, but those stay visible in the
+     composer, and repeating them would read as two selections. -->
+{#if aiChatManager.queuedMessage || aiChatManager.queuedImages.length > 0 || (aiChatManager.queuedContext?.length ?? 0) > 0}
 	<div
 		class="mb-1 flex flex-row items-start gap-1 rounded-md bg-surface-input px-3 py-2 opacity-60"
 		title={aiChatManager.queuedMessage}
@@ -34,6 +39,12 @@
 				<p class="text-xs text-secondary whitespace-pre-wrap line-clamp-2">
 					{aiChatManager.queuedMessage}
 				</p>
+			{:else if aiChatManager.queuedImages.length === 0 && aiChatManager.queuedContext?.length}
+				<div class="flex flex-row flex-wrap gap-1">
+					{#each aiChatManager.queuedContext as element (contextElementKey(element))}
+						<ContextElementBadge contextElement={element} compact />
+					{/each}
+				</div>
 			{/if}
 		</div>
 		<Button
diff --git a/frontend/src/lib/components/copilot/chat/context.ts b/frontend/src/lib/components/copilot/chat/context.ts
index ce0c83cae6..3537b757f5 100644
--- a/frontend/src/lib/components/copilot/chat/context.ts
+++ b/frontend/src/lib/components/copilot/chat/context.ts
@@ -302,3 +302,19 @@ export type ContextElement = (
 ) & {
 	deletable?: boolean
 }
+
+// DOM selector chips can share a display title (two `button.btn` from repeated
+// elements), so identify them by (appPath, selector) — keying or removing by
+// title would collide, giving repeated chips one Svelte key and deleting them
+// together. Other context types stay identified by (type, title).
+export function contextElementKey(c: ContextElement): string {
+	return c.type === 'app_dom_selector' ? `dom:${c.appPath}:${c.selector}` : `${c.type}:${c.title}`
+}
+
+export function isSameContextElement(a: ContextElement, b: ContextElement): boolean {
+	if (a.type !== b.type) return false
+	if (a.type === 'app_dom_selector' && b.type === 'app_dom_selector') {
+		return a.selector === b.selector && a.appPath === b.appPath
+	}
+	return a.title === b.title
+}
diff --git a/frontend/src/lib/components/copilot/chat/global/core.test.ts b/frontend/src/lib/components/copilot/chat/global/core.test.ts
index f1b932ab1c..75f7317fa6 100644
--- a/frontend/src/lib/components/copilot/chat/global/core.test.ts
+++ b/frontend/src/lib/components/copilot/chat/global/core.test.ts
@@ -257,6 +257,7 @@ import {
 	globalTools,
 	globalToolsFor,
 	prepareGlobalSystemMessage,
+	getSessionContextPromptSection,
 	prepareGlobalUserMessage,
 	setDeployedInSessionHandler,
 	setGetPreviewStatusHandler,
@@ -3572,6 +3573,46 @@ describe('session pipeline gate', () => {
 	})
 })
 
+describe('getSessionContextPromptSection', () => {
+	it('describes an ephemeral staged fork with its parent and deploy semantics', () => {
+		const s = getSessionContextPromptSection({
+			workspaceId: 'wm-fork-foo',
+			parentWorkspaceId: 'prod'
+		})
+		expect(s).toContain('STAGED FORK of workspace "prod"')
+		expect(s).toContain('Never present a change as live in "prod"')
+	})
+
+	it('distinguishes a persistent dev workspace from a staged fork', () => {
+		const s = getSessionContextPromptSection({
+			workspaceId: 'guilhem',
+			parentWorkspaceId: 'prod',
+			isDevWorkspace: true
+		})
+		expect(s).toContain('persistent DEV WORKSPACE')
+		expect(s).not.toContain('STAGED FORK')
+	})
+
+	it('marks a parentless workspace as the live workspace', () => {
+		const s = getSessionContextPromptSection({ workspaceId: 'prod' })
+		expect(s).toContain('the live workspace itself')
+	})
+
+	it('announces a pending fork before the first send commits it', () => {
+		const s = getSessionContextPromptSection({ workspaceId: 'prod', pendingForkOf: 'prod' })
+		expect(s).toContain('staged fork of workspace "prod" is created automatically')
+	})
+
+	it('never calls a committed-but-unlisted workspace the live workspace', () => {
+		const s = getSessionContextPromptSection({
+			workspaceId: 'wm-fork-gone',
+			forkParentUnknown: true
+		})
+		expect(s).toContain('parent workspace is not currently visible')
+		expect(s).not.toContain('the live workspace itself')
+	})
+})
+
 describe('prepareGlobalSystemMessage', () => {
 	it('keeps global chat draft instructions concise and user-facing', () => {
 		const message = prepareGlobalSystemMessage()
diff --git a/frontend/src/lib/components/copilot/chat/global/core.ts b/frontend/src/lib/components/copilot/chat/global/core.ts
index e1517d1334..86b95bfa89 100644
--- a/frontend/src/lib/components/copilot/chat/global/core.ts
+++ b/frontend/src/lib/components/copilot/chat/global/core.ts
@@ -1862,6 +1862,71 @@ function getInstructions(subject: InstructionSubject, language?: ScriptLang): st
 
 export type AiSkillListItem = { name: string; description: string }
 
+/** Live session facts appended to the GLOBAL system prompt for session chats.
+ * Provided by the session runtime as a resolver (copilot must not import the
+ * sessions modules) and re-read on every system-message rebuild — the fork
+ * commits at first send, and the user can re-point the session's workspace. */
+export type SessionPromptContext = {
+	/** Operating workspace (undefined while the session is an unsent draft with
+	 * no pick). Only slug-validated workspace IDs belong here — free-form
+	 * metadata like display names is user-controlled text that must not be
+	 * interpolated into the system prompt. */
+	workspaceId?: string
+	/** Set when the operating workspace is a fork of this workspace (staged
+	 * session fork or persistent dev workspace — `isDevWorkspace` splits them). */
+	parentWorkspaceId?: string
+	/** The operating workspace is a persistent dev workspace, not an ephemeral
+	 * staged fork. Same promote-to-parent deploy flow; different lifecycle. */
+	isDevWorkspace?: boolean
+	/** Committed workspace missing from the user's workspace list (access lost /
+	 * stale store): still a fork per `isForkSession`, but the parent is unknown —
+	 * must not be presented as the live workspace. */
+	forkParentUnknown?: boolean
+	/** Pre-send intent: a staged fork of this workspace is created at first send. */
+	pendingForkOf?: string
+}
+
+/** Session-state guidance appended to the global system prompt so the model
+ * knows where its work lands (staged fork vs the live workspace). */
+export function getSessionContextPromptSection(ctx: SessionPromptContext): string {
+	const lines = [
+		'',
+		'',
+		'Session state:',
+		'- This chat is a Windmill AI session with its own operating workspace: every tool call (reads, drafts, test runs, deploys) targets that workspace.'
+	]
+	if (ctx.pendingForkOf) {
+		lines.push(
+			`- No workspace is committed yet: a staged fork of workspace "${ctx.pendingForkOf}" is created automatically when the first message is sent, and all work lands in that fork.`
+		)
+	} else if (ctx.parentWorkspaceId && ctx.isDevWorkspace) {
+		lines.push(
+			`- Operating workspace: "${ctx.workspaceId}" — the user's persistent DEV WORKSPACE, forked from workspace "${ctx.parentWorkspaceId}". deploy_workspace_item publishes into the dev workspace only; the user reviews & promotes changes into "${ctx.parentWorkspaceId}" from the session's deploy panel. Never present a change as live in "${ctx.parentWorkspaceId}".`
+		)
+	} else if (ctx.parentWorkspaceId) {
+		lines.push(
+			`- Operating workspace: "${ctx.workspaceId}" — an ephemeral STAGED FORK of workspace "${ctx.parentWorkspaceId}", created for session work. deploy_workspace_item publishes into the fork only, and the user reviews & promotes fork changes into "${ctx.parentWorkspaceId}" from the session's deploy panel. Never present a change as live in "${ctx.parentWorkspaceId}".`
+		)
+	} else if (ctx.forkParentUnknown) {
+		lines.push(
+			`- Operating workspace: "${ctx.workspaceId}" — a fork whose parent workspace is not currently visible to this user. deploy_workspace_item publishes into the fork only; the user promotes changes from the session's deploy panel. Never present a change as live in any other workspace.`
+		)
+	} else if (ctx.workspaceId) {
+		lines.push(
+			`- Operating workspace: "${ctx.workspaceId}" — the live workspace itself, not a fork. deploy_workspace_item publishes directly to everyone in it.`
+		)
+	} else {
+		lines.push(
+			'- No operating workspace is set yet; the user picks one (or a new staged fork) before the first message is sent.'
+		)
+	}
+	return lines.join('\n')
+}
+
+/** `/` picker entry: a workspace skill or a built-in session action. The kind
+ * drives the picker's category grouping; entries without one are ungrouped. */
+export type ChatCommandItem = AiSkillListItem & { kind?: 'action' | 'skill' }
+
 /** Fetch the workspace's AI skills (name + description) for the global system prompt. */
 export async function loadWorkspaceSkills(workspace: string): Promise<AiSkillListItem[]> {
 	if (!workspace) return []
diff --git a/frontend/src/lib/components/drillPicker.ts b/frontend/src/lib/components/drillPicker.ts
index 5f3b5d6a25..71e13742e0 100644
--- a/frontend/src/lib/components/drillPicker.ts
+++ b/frontend/src/lib/components/drillPicker.ts
@@ -21,6 +21,10 @@ export type DrillLeaf<L> = {
 	/** Optional override for the fuzzy-search haystack. Defaults to
 	 * `label` (or `secondary` when label is empty). */
 	searchableText?: string
+	/** Category header this leaf renders under, in both the browse list and
+	 * search results (a `searchGroup` branch ancestor wins in search).
+	 * Consecutive leaves sharing a section share one header. */
+	section?: string
 	/** Marks this leaf as the user's current location — gets `aria-current`
 	 * and a styled, no-op click. */
 	current?: boolean
diff --git a/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts b/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts
index 1eac3ad5c7..9ef0b7f05f 100644
--- a/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts
+++ b/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts
@@ -25,7 +25,7 @@ type SavedScript = Omit<Script & UserDraftOverlay, 'draft'> & { draft?: NewScrip
 type SavedFlow = Omit<Flow & UserDraftOverlay, 'draft'> & { draft?: Flow }
 import type { HiddenRunnable } from '$lib/components/apps/types'
 import { type RawAppData, DEFAULT_DATA } from '$lib/components/raw_apps/dataTableRefUtils'
-import { workspaceStore } from '$lib/stores'
+import { userWorkspaces, workspaceStore } from '$lib/stores'
 import { loadCopilot, copilotWorkspace } from '$lib/aiStore'
 import { emptySchema, type StateStore } from '$lib/utils'
 import {
@@ -341,6 +341,24 @@ function createRuntime(session: Session): SessionRuntime {
 		const s = sessionState.sessions.find((x) => x.id === session.id)
 		return s ? getEffectiveWorkspaceId(s) : undefined
 	}
+	// Session facts (fork vs live workspace) for the system prompt. A resolver so
+	// each rebuild reads the current record — the fork commits at first send, and
+	// the user can re-point the session's workspace between sends.
+	manager.sessionContextResolver = () => {
+		const s = sessionState.sessions.find((x) => x.id === session.id)
+		if (!s) return undefined
+		const wsId = getEffectiveWorkspaceId(s)
+		const ws = get(userWorkspaces).find((w) => w.id === wsId)
+		return {
+			workspaceId: wsId,
+			parentWorkspaceId: ws?.parent_workspace_id ?? undefined,
+			isDevWorkspace: ws?.is_dev_workspace,
+			// Committed workspace missing from the list: still a fork (mirrors
+			// isForkSession) — the prompt must not call it the live workspace.
+			forkParentUnknown: !ws && !!s.workspace_id,
+			pendingForkOf: s.pending_fork?.parent_workspace_id
+		}
+	}
 	// Pre-flight: materialise the (still-transient) session, then commit
 	// the workspace (creating a staged fork if needed) before any send.
 	// AIChatManager awaits this so the first message hits a persisted

From 32994df427e6df6747caf1ba6371512d5a5be5c2 Mon Sep 17 00:00:00 2001
From: Diego Imbert <70353967+diegoimbert@users.noreply.github.com>
Date: Tue, 21 Jul 2026 16:35:59 +0200
Subject: [PATCH 086/171] fix: return to parent workspace when a fork is
 deleted remotely (#9898)

* fix: return to parent workspace when a fork is deleted remotely

When a workspace fork was deleted remotely while a user had it open,
reloading stranded them: a regular member got logged out (whoami fails on
the vanished workspace) and a superadmin silently landed on a dead
workspace whose requests 404. Detect the deleted fork on load and redirect
to its parent (or the workspace picker) with a toast instead.

- forkParentMemory.ts: persist a bounded fork->parent map in localStorage
  while a fork is reachable (the parent is unrecoverable post-deletion).
- (logged) layout: record the current fork's parent via an effect.
- root layout: tryRecoverFromDeletedFork detects the vanished fork in
  loadUser and redirects to the remembered parent or the workspace picker,
  reusing the workspace list already fetched on mount.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix: verify fork existence for superadmins before deleted-fork redirect

* fix: only recover deleted fork on actual 404 from superadmin check

* fix: recover prefixless dev-workspace forks via remembered parent

* fix: use workspace exists check to detect deleted forks

* fix: restore wm-fork- detection for non-member superadmin forks

* fix: record fork parent for non-member superadmin dev workspaces

* Update frontend/src/routes/(root)/+layout.svelte

Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>

* fix: store fork parent map with null-prototype to handle __proto__ ids

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
---
 frontend/src/lib/forkParentMemory.test.ts     | 117 ++++++++++++++++++
 frontend/src/lib/forkParentMemory.ts          |  82 ++++++++++++
 .../src/routes/(root)/(logged)/+layout.svelte |  36 ++++++
 frontend/src/routes/(root)/+layout.svelte     |  79 +++++++++++-
 4 files changed, 311 insertions(+), 3 deletions(-)
 create mode 100644 frontend/src/lib/forkParentMemory.test.ts
 create mode 100644 frontend/src/lib/forkParentMemory.ts

diff --git a/frontend/src/lib/forkParentMemory.test.ts b/frontend/src/lib/forkParentMemory.test.ts
new file mode 100644
index 0000000000..48d0d553fb
--- /dev/null
+++ b/frontend/src/lib/forkParentMemory.test.ts
@@ -0,0 +1,117 @@
+import { describe, it, expect, beforeEach } from 'vitest'
+import type { UserWorkspace } from './stores'
+import { recordForkParent, getRememberedForkParent, forgetForkParent } from './forkParentMemory'
+
+const MAX_ENTRIES = 50
+
+function ws(id: string, parent_workspace_id?: string): UserWorkspace {
+	return {
+		id,
+		name: id,
+		username: 'admin',
+		color: undefined,
+		operator_settings: undefined,
+		disabled: false,
+		parent_workspace_id
+	}
+}
+
+beforeEach(() => {
+	localStorage.clear()
+})
+
+describe('recordForkParent / getRememberedForkParent', () => {
+	it('remembers the parent of a fork present in the list', () => {
+		recordForkParent('wm-fork-a', [ws('wm-fork-a', 'parent'), ws('parent')])
+		expect(getRememberedForkParent('wm-fork-a')).toBe('parent')
+	})
+
+	it('is a no-op when the workspace is absent from the list', () => {
+		recordForkParent('wm-fork-a', [ws('parent')])
+		expect(getRememberedForkParent('wm-fork-a')).toBeUndefined()
+	})
+
+	it('is a no-op when the workspace has no parent', () => {
+		recordForkParent('parent', [ws('parent')])
+		expect(getRememberedForkParent('parent')).toBeUndefined()
+	})
+
+	it('is a no-op for an undefined workspace id', () => {
+		recordForkParent(undefined, [ws('wm-fork-a', 'parent')])
+		expect(getRememberedForkParent('wm-fork-a')).toBeUndefined()
+	})
+
+	it('never clobbers a prior mapping once the fork disappears from the list', () => {
+		// Recorded while reachable...
+		recordForkParent('wm-fork-a', [ws('wm-fork-a', 'parent'), ws('parent')])
+		// ...then the fork is gone from a later list — the mapping must survive so
+		// recovery can still find the parent.
+		recordForkParent('wm-fork-a', [ws('parent')])
+		expect(getRememberedForkParent('wm-fork-a')).toBe('parent')
+	})
+
+	it('handles workspace ids that collide with Object prototype members', () => {
+		for (const id of ['__proto__', 'constructor', 'toString']) {
+			recordForkParent(id, [ws(id, `parent-${id}`), ws(`parent-${id}`)])
+			expect(getRememberedForkParent(id)).toBe(`parent-${id}`)
+			forgetForkParent(id)
+			expect(getRememberedForkParent(id)).toBeUndefined()
+		}
+	})
+})
+
+describe('forgetForkParent', () => {
+	it('removes a remembered mapping', () => {
+		recordForkParent('wm-fork-a', [ws('wm-fork-a', 'parent')])
+		forgetForkParent('wm-fork-a')
+		expect(getRememberedForkParent('wm-fork-a')).toBeUndefined()
+	})
+
+	it('is a no-op for an unknown fork', () => {
+		expect(() => forgetForkParent('wm-fork-missing')).not.toThrow()
+	})
+})
+
+describe('bounded storage', () => {
+	it('evicts the oldest entry once past MAX_ENTRIES', () => {
+		for (let i = 0; i < MAX_ENTRIES; i++) {
+			recordForkParent(`wm-fork-${i}`, [ws(`wm-fork-${i}`, `parent-${i}`)])
+		}
+		// One more tips it over the cap and trims the oldest (index 0).
+		recordForkParent(`wm-fork-${MAX_ENTRIES}`, [
+			ws(`wm-fork-${MAX_ENTRIES}`, `parent-${MAX_ENTRIES}`)
+		])
+		expect(getRememberedForkParent('wm-fork-0')).toBeUndefined()
+		expect(getRememberedForkParent(`wm-fork-${MAX_ENTRIES}`)).toBe(`parent-${MAX_ENTRIES}`)
+		expect(getRememberedForkParent('wm-fork-1')).toBe('parent-1')
+	})
+
+	it('updating a fork to a new parent moves it to the end so it survives the next eviction', () => {
+		for (let i = 0; i < MAX_ENTRIES; i++) {
+			recordForkParent(`wm-fork-${i}`, [ws(`wm-fork-${i}`, `parent-${i}`)])
+		}
+		// A changed value re-inserts the key at the end of the insertion order.
+		recordForkParent('wm-fork-0', [ws('wm-fork-0', 'reparented')])
+		// Push past the cap: the now-oldest (index 1) is evicted, not index 0.
+		recordForkParent(`wm-fork-${MAX_ENTRIES}`, [
+			ws(`wm-fork-${MAX_ENTRIES}`, `parent-${MAX_ENTRIES}`)
+		])
+		expect(getRememberedForkParent('wm-fork-0')).toBe('reparented')
+		expect(getRememberedForkParent('wm-fork-1')).toBeUndefined()
+	})
+})
+
+describe('corrupted storage', () => {
+	it('tolerates non-JSON content', () => {
+		localStorage.setItem('fork_parents', 'not json{')
+		expect(getRememberedForkParent('wm-fork-a')).toBeUndefined()
+		// A subsequent write recovers cleanly.
+		recordForkParent('wm-fork-a', [ws('wm-fork-a', 'parent')])
+		expect(getRememberedForkParent('wm-fork-a')).toBe('parent')
+	})
+
+	it('tolerates a non-object JSON value', () => {
+		localStorage.setItem('fork_parents', '42')
+		expect(getRememberedForkParent('wm-fork-a')).toBeUndefined()
+	})
+})
diff --git a/frontend/src/lib/forkParentMemory.ts b/frontend/src/lib/forkParentMemory.ts
new file mode 100644
index 0000000000..8cb2a3c4e0
--- /dev/null
+++ b/frontend/src/lib/forkParentMemory.ts
@@ -0,0 +1,82 @@
+import type { UserWorkspace } from './stores'
+
+// A fork's parent linkage lives only in its own `workspace` row. Once the fork
+// is deleted remotely, `listUserWorkspaces` stops returning it and the parent is
+// unrecoverable from the server. We therefore mirror `fork id -> parent id` into
+// localStorage while the fork is still reachable, so that after a reload landing
+// on a now-deleted fork we can send the user back to its parent instead of a
+// dead workspace / forced logout.
+
+const FORK_PARENTS_KEY = 'fork_parents'
+const MAX_ENTRIES = 50
+
+// A null-prototype map so workspace ids that collide with Object prototype members
+// (`__proto__`, `constructor`, …) are stored as plain own properties rather than
+// triggering prototype semantics on read/write.
+function emptyMap(): Record<string, string> {
+	return Object.create(null)
+}
+
+function readMap(): Record<string, string> {
+	const map = emptyMap()
+	try {
+		const raw = localStorage.getItem(FORK_PARENTS_KEY)
+		if (!raw) return map
+		const parsed = JSON.parse(raw)
+		if (!parsed || typeof parsed !== 'object') return map
+		for (const key of Object.keys(parsed)) {
+			const value = (parsed as Record<string, unknown>)[key]
+			if (typeof value === 'string') map[key] = value
+		}
+	} catch (e) {
+		console.error('Could not read fork parent mapping', e)
+	}
+	return map
+}
+
+function writeMap(map: Record<string, string>): void {
+	try {
+		localStorage.setItem(FORK_PARENTS_KEY, JSON.stringify(map))
+	} catch (e) {
+		console.error('Could not persist fork parent mapping', e)
+	}
+}
+
+export function rememberForkParent(forkId: string, parentId: string): void {
+	const map = readMap()
+	if (map[forkId] === parentId) return
+	// Re-insert at the end so the oldest entries are the ones trimmed below.
+	delete map[forkId]
+	map[forkId] = parentId
+	const keys = Object.keys(map)
+	if (keys.length > MAX_ENTRIES) {
+		for (const k of keys.slice(0, keys.length - MAX_ENTRIES)) delete map[k]
+	}
+	writeMap(map)
+}
+
+export function getRememberedForkParent(forkId: string): string | undefined {
+	return readMap()[forkId]
+}
+
+export function forgetForkParent(forkId: string): void {
+	const map = readMap()
+	if (forkId in map) {
+		delete map[forkId]
+		writeMap(map)
+	}
+}
+
+// Records the parent of the current workspace when it is a fork still present in
+// the user's workspace list. No-op otherwise, so it never clobbers a previously
+// remembered parent when the fork has already disappeared.
+export function recordForkParent(
+	workspaceId: string | undefined,
+	workspaces: UserWorkspace[]
+): void {
+	if (!workspaceId) return
+	const ws = workspaces.find((w) => w.id === workspaceId)
+	if (ws?.parent_workspace_id) {
+		rememberForkParent(workspaceId, ws.parent_workspace_id)
+	}
+}
diff --git a/frontend/src/routes/(root)/(logged)/+layout.svelte b/frontend/src/routes/(root)/(logged)/+layout.svelte
index 8bd5119945..9d6accc4e2 100644
--- a/frontend/src/routes/(root)/(logged)/+layout.svelte
+++ b/frontend/src/routes/(root)/(logged)/+layout.svelte
@@ -28,6 +28,7 @@
 		workspaceUsageStore,
 		userStore,
 		workspaceStore,
+		userWorkspaces,
 		type UserExt,
 		defaultScripts,
 		hubBaseUrlStore,
@@ -86,6 +87,7 @@
 	import { useDbManagerUriState } from '$lib/components/dbManagerDrawerModel.svelte'
 	import Modal2 from '$lib/components/common/modal/Modal2.svelte'
 	import CreateWorkspaceInner from '$lib/components/workspaceSettings/CreateWorkspaceInner.svelte'
+	import { recordForkParent, rememberForkParent } from '$lib/forkParentMemory'
 	interface Props {
 		children?: import('svelte').Snippet
 	}
@@ -672,6 +674,40 @@
 		$workspaceStore
 		untrack(() => updateUserStore($workspaceStore))
 	})
+	// While a fork is reachable, mirror its parent linkage to localStorage so a
+	// later reload landing on a now-deleted fork can return to the parent (see
+	// forkParentMemory + the deleted-fork recovery in the root layout).
+	$effect(() => {
+		const ws = $workspaceStore
+		const list = $userWorkspaces
+		const isSuperadmin = $superadmin
+		untrack(() => void recordCurrentForkParent(ws, list, isSuperadmin))
+	})
+
+	// A superadmin can open a fork they aren't a member of, including a prefixless
+	// dev workspace. The membership-gated list omits it, so `recordForkParent` can't
+	// see its parent — fetch it directly so the deleted-fork recovery still works.
+	async function recordCurrentForkParent(
+		ws: string | undefined,
+		list: typeof $userWorkspaces,
+		isSuperadmin: string | false | undefined
+	): Promise<void> {
+		if (!ws) return
+		if (list.some((w) => w.id === ws)) {
+			recordForkParent(ws, list)
+			return
+		}
+		if (!isSuperadmin) return
+		try {
+			const workspace = await WorkspaceService.getWorkspaceAsSuperAdmin({ workspace: ws })
+			if (workspace.parent_workspace_id) {
+				rememberForkParent(ws, workspace.parent_workspace_id)
+			}
+		} catch {
+			// Best-effort: if we can't resolve the parent, recovery falls back to the
+			// workspace picker rather than the parent redirect.
+		}
+	}
 	$effect(() => {
 		$workspaceStore && untrack(() => onLoad())
 	})
diff --git a/frontend/src/routes/(root)/+layout.svelte b/frontend/src/routes/(root)/+layout.svelte
index 0ad1865342..8b7736965d 100644
--- a/frontend/src/routes/(root)/+layout.svelte
+++ b/frontend/src/routes/(root)/+layout.svelte
@@ -3,9 +3,16 @@
 	import { page } from '$app/state'
 	import { UserService, WorkspaceService } from '$lib/gen'
 	import { logoutWithRedirect } from '$lib/logoutKit'
-	import { userStore, usersWorkspaceStore, workspaceStore } from '$lib/stores'
+	import {
+		clearWorkspaceFromStorage,
+		userStore,
+		usersWorkspaceStore,
+		workspaceStore
+	} from '$lib/stores'
 	import { getUserExt } from '$lib/user'
 	import { sendUserToast } from '$lib/toast'
+	import { switchWorkspace } from '$lib/storeUtils'
+	import { forgetForkParent, getRememberedForkParent } from '$lib/forkParentMemory'
 	import { onDestroy, onMount } from 'svelte'
 
 	import { refreshSuperadmin } from '$lib/refreshUser'
@@ -33,7 +40,70 @@
 	]
 
 	async function setUserWorkspaceStore() {
-		$usersWorkspaceStore = await WorkspaceService.listUserWorkspaces()
+		const list = await WorkspaceService.listUserWorkspaces()
+		$usersWorkspaceStore = list
+		return list
+	}
+
+	// A fork deleted remotely while the tab was open leaves the client pointing at a
+	// dead workspace id: every request 404s and members get logged out. The fork's
+	// parent linkage lived only in its own (now deleted) row, so we mirror it to
+	// localStorage while the fork is reachable (see forkParentMemory) and use it here
+	// to send the user back to the parent. Returns true when it handled the situation
+	// so the caller skips normal loading.
+	async function tryRecoverFromDeletedWorkspace(workspaceId: string): Promise<boolean> {
+		// Only forks are recoverable, identified two ways: the `wm-fork-` id prefix, or
+		// a remembered parent. Neither alone is sufficient — dev-workspace forks carry
+		// no prefix (only a remembered parent), while a non-member superadmin's fork has
+		// the prefix but no remembered parent (the recorder only sees the user's own
+		// membership-gated list). A workspace that is neither is left to normal loading.
+		const parentId = getRememberedForkParent(workspaceId)
+		if (parentId == undefined && !workspaceId.startsWith('wm-fork-')) return false
+
+		// `exists` is not membership-gated, so it settles "is this workspace gone?"
+		// identically for members, non-members and superadmins, and it requires a valid
+		// session. Only a conclusive `false` means deleted: any rejection (expired
+		// session, transient failure) is inconclusive and must leave the normal loading
+		// path — including its genuine auth handling — untouched.
+		let exists: boolean
+		try {
+			exists = await WorkspaceService.existsWorkspace({ requestBody: { id: workspaceId } })
+		} catch {
+			return false
+		}
+		if (exists) return false
+
+		forgetForkParent(workspaceId)
+
+		// Send the user to the remembered parent when we have one; otherwise (unknown or
+		// inaccessible parent) fall back to the picker rather than the forced-logout path
+		// this recovery exists to avoid.
+		if (parentId != undefined) {
+			switchWorkspace(parentId)
+			const parentUser = await getUserExt(parentId)
+			if (parentUser) {
+				$userStore = parentUser
+				sendUserToast(
+					`Workspace ${workspaceId} not found, switched to parent workspace ${parentId}.`,
+					'warning'
+				)
+				await goto('/')
+				return true
+			}
+		}
+
+		try {
+			clearWorkspaceFromStorage()
+		} catch (e) {
+			console.error('Could not clear workspace storage during deleted-workspace recovery', e)
+		}
+		workspaceStore.set(undefined)
+		sendUserToast(
+			`Workspace ${workspaceId} is no longer available, please pick a workspace.`,
+			'warning'
+		)
+		await goto('/user/workspaces')
+		return true
 	}
 
 	async function loadUser() {
@@ -41,6 +111,9 @@
 			await refreshSuperadmin()
 
 			if ($workspaceStore) {
+				if (await tryRecoverFromDeletedWorkspace($workspaceStore)) {
+					return
+				}
 				if ($userStore) {
 					console.log(`Welcome back ${$userStore.username} to ${$workspaceStore}`)
 				} else {
@@ -131,7 +204,7 @@
 		computeDrift()
 
 		if (page.url.pathname != '/user/login') {
-			setUserWorkspaceStore()
+			setUserWorkspaceStore().catch((e) => console.error('could not load workspace list', e))
 			loadUser()
 			UserService.refreshUserToken({ ifExpiringInLessThanS: 30 * 60 })
 		}

From b0bf25683ba3aac3e94bbe9d6bbd6e22545e734e Mon Sep 17 00:00:00 2001
From: Diego Imbert <70353967+diegoimbert@users.noreply.github.com>
Date: Tue, 21 Jul 2026 16:36:33 +0200
Subject: [PATCH 087/171] fix(frontend): prevent browser back-swipe navigation
 over monaco editors (#10229)

* fix(frontend): prevent browser back-swipe navigation over monaco editors

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EEP1T4UogYABBifdNJUUuQ

* fix: toggle root overscroll-behavior-x on editor hover instead of cancelling wheel events

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EEP1T4UogYABBifdNJUUuQ

* refactor: replace per-editor swipe guard action with single global handler in root layout

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EEP1T4UogYABBifdNJUUuQ

* style: compress swipe-guard comment to four lines

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Q97WNWUT9mntEEVhg6kpzv

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
---
 frontend/src/routes/+layout.svelte | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/frontend/src/routes/+layout.svelte b/frontend/src/routes/+layout.svelte
index 51d093c77e..d95b78ccf3 100644
--- a/frontend/src/routes/+layout.svelte
+++ b/frontend/src/routes/+layout.svelte
@@ -29,10 +29,24 @@
 		if (target.tagName === 'INPUT' && (target as HTMLInputElement).type === 'number') {
 			target.blur()
 		}
+		updateEditorSwipeGuard(e)
+	}
+
+	// macOS Chromium turns horizontal wheel overscroll into history navigation. Cancelling
+	// wheel events can't block it (only a gesture's first event is cancelable; Monaco swallows
+	// the rest), but Chromium honors root `overscroll-behavior-x`, so toggle it while over a
+	// Monaco editor. Wheel also feeds this: editors mounting under a still cursor fire no pointerover.
+	function updateEditorSwipeGuard(e: Event) {
+		const overEditor = e.target instanceof Element && e.target.closest('.monaco-editor') != null
+		const value = overEditor ? 'none' : ''
+		if (document.documentElement.style.overscrollBehaviorX !== value) {
+			document.documentElement.style.overscrollBehaviorX = value
+			document.body.style.overscrollBehaviorX = value
+		}
 	}
 </script>
 
-<svelte:document onwheel={handleWheel} />
+<svelte:document onwheel={handleWheel} onpointerover={updateEditorSwipeGuard} />
 
 <svelte:head>
 	<!-- {#if !import.meta.env.PROD}

From d24e1768163c10fbbc144bd1126457e42d282e37 Mon Sep 17 00:00:00 2001
From: Diego Imbert <70353967+diegoimbert@users.noreply.github.com>
Date: Tue, 21 Jul 2026 16:36:44 +0200
Subject: [PATCH 088/171] fix(parser): spurious pg arg inferred from
 placeholders in comments (#10226)

* fix(parser): ignore pg placeholders in comments, strings and dollar quotes

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NXWRDKzswMeDBP5THXpb9Q

* package json + lock

* chore: remove stray root npm lockfiles

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013kuUhCPD9ph4ZuFd13SCWJ

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
---
 .../parsers/windmill-parser-sql/src/lib.rs    | 43 +++++++++++---
 cli/package-lock.json                         |  9 +--
 cli/package.json                              |  2 +-
 frontend/package-lock.json                    | 58 ++-----------------
 frontend/package.json                         |  2 +-
 5 files changed, 48 insertions(+), 66 deletions(-)

diff --git a/backend/parsers/windmill-parser-sql/src/lib.rs b/backend/parsers/windmill-parser-sql/src/lib.rs
index dc094a0a7b..38f4b7a33e 100644
--- a/backend/parsers/windmill-parser-sql/src/lib.rs
+++ b/backend/parsers/windmill-parser-sql/src/lib.rs
@@ -613,19 +613,21 @@ fn parse_pg_file(code: &str) -> anyhow::Result<Option<(Vec<Arg>, bool)>> {
     // the parser's "text" fallback, so the executor can later distinguish
     // "user committed to text" from "no info, use a placeholder".
     let mut hm: HashMap<i32, (String, bool)> = HashMap::new();
-    for cap in RE_CODE_PGSQL.captures_iter(code) {
-        let idx = cap
-            .get(1)
-            .and_then(|x| x.as_str().parse::<i32>().ok())
-            .ok_or_else(|| anyhow!("Impossible to parse arg digit"))?;
-
+    // Walk placeholders with the same tokenizer the executor uses so `$N`
+    // inside comments, string literals, or dollar-quoted blocks (e.g. the
+    // commented-out examples in the default postgres template) doesn't
+    // produce a spurious arg. `range` covers the digits of a real `$N`, so
+    // anchoring the regex at the preceding `$` only extracts the `::TYPE` cast.
+    for (idx, range) in parse_pg_statement_arg_positions(code) {
         // Skip if this arg was explicitly typed in declaration
         if explicitly_typed_args.contains(&idx) {
             continue;
         }
 
-        let cast = cap
-            .get(2)
+        let cast = RE_CODE_PGSQL
+            .captures_at(code, range.start - 1)
+            .filter(|c| c.get(0).is_some_and(|m| m.start() == range.start - 1))
+            .and_then(|c| c.get(2))
             .map(|cap| transform_types_with_spaces(&cap, &code));
         let inferred_default = cast.is_none();
         let typ: std::borrow::Cow<str> = cast.unwrap_or(std::borrow::Cow::Borrowed("text"));
@@ -1109,6 +1111,31 @@ SELECT * FROM table WHERE token=$1::TEXT AND image=$2::BIGINT
         Ok(())
     }
 
+    #[test]
+    fn test_parse_pgsql_sig_ignores_placeholders_in_comments_and_strings() -> anyhow::Result<()> {
+        // Mirrors the default postgres template: the commented-out s3object
+        // example mentions `$5`, which must not surface as an argument.
+        let code = r#"-- result_collection=last_statement_all_rows
+-- to feed an S3Object (json/jsonl/parquet/csv) as a parameter, declare it as (s3object):
+--   -- $5 input_file (s3object)
+--   INSERT INTO demo SELECT * FROM jsonb_to_recordset($5::jsonb) AS x(id INT, name TEXT);
+-- $1 name1 = default arg
+-- $2 name2
+INSERT INTO demo VALUES ($1::TEXT, $2::INT) RETURNING *;
+/* also not an arg: $6::int */
+SELECT 'literal $7', "col $8" FROM demo;
+"#;
+        let sig = parse_pgsql_sig(code)?;
+        assert_eq!(
+            sig.args
+                .iter()
+                .map(|a| (a.oidx, a.name.as_str()))
+                .collect::<Vec<_>>(),
+            vec![(Some(1), "name1"), (Some(2), "name2")]
+        );
+        Ok(())
+    }
+
     #[test]
     fn test_parse_pgsql_mutli_sig() -> anyhow::Result<()> {
         let code = r#"
diff --git a/cli/package-lock.json b/cli/package-lock.json
index 328cfa2d64..96dd0681e0 100644
--- a/cli/package-lock.json
+++ b/cli/package-lock.json
@@ -29,7 +29,7 @@
         "windmill-parser-wasm-py": "1.693.1",
         "windmill-parser-wasm-py-imports": "1.693.1",
         "windmill-parser-wasm-r": "1.668.1",
-        "windmill-parser-wasm-regex": "1.692.0",
+        "windmill-parser-wasm-regex": "1.764.0",
         "windmill-parser-wasm-ruby": "1.526.1",
         "windmill-parser-wasm-rust": "1.647.1",
         "windmill-parser-wasm-ts": "1.695.0",
@@ -793,6 +793,7 @@
       "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.16.0.tgz",
       "integrity": "sha512-UVJyE9MttOsBQIDKw1skb9nAwQuR5wuGD3+82K6JgJlm/Y+KI92oNsMNGZCYdDsVtRHSak0pcV5Dno5+4jh9sw==",
       "license": "MIT",
+      "peer": true,
       "bin": {
         "acorn": "bin/acorn"
       },
@@ -1457,9 +1458,9 @@
       "integrity": "sha512-5YNeUibxpNBvYrxCgQcz1PxGhTFx2CyEpg2udtIhq7bx0d4gF/KDZVupMeQmAObmrEtTSFGUWNRJ4zXSWNrSpQ=="
     },
     "node_modules/windmill-parser-wasm-regex": {
-      "version": "1.692.0",
-      "resolved": "https://registry.npmjs.org/windmill-parser-wasm-regex/-/windmill-parser-wasm-regex-1.692.0.tgz",
-      "integrity": "sha512-BHGTxrinZJ9ef6hFxbKiBqBEr5uqgG/QySOgMA5r1LswO9n/8fyGswr8JcPT2kGaoeoweV6/RQ+RHVaOhosnKw=="
+      "version": "1.764.0",
+      "resolved": "https://registry.npmjs.org/windmill-parser-wasm-regex/-/windmill-parser-wasm-regex-1.764.0.tgz",
+      "integrity": "sha512-V2eFdKD90gqWikOvjl2fwMpFqiFt/21+4iQMbiNJYl7Lm2UiEcEZ4r9bpgJLG4TLOLqvD6+u4Ju3WaytxN2O2w=="
     },
     "node_modules/windmill-parser-wasm-ruby": {
       "version": "1.526.1",
diff --git a/cli/package.json b/cli/package.json
index ba8a702526..c13802c0b0 100644
--- a/cli/package.json
+++ b/cli/package.json
@@ -37,7 +37,7 @@
     "windmill-parser-wasm-py": "1.693.1",
     "windmill-parser-wasm-py-imports": "1.693.1",
     "windmill-parser-wasm-r": "1.668.1",
-    "windmill-parser-wasm-regex": "1.692.0",
+    "windmill-parser-wasm-regex": "1.764.0",
     "windmill-parser-wasm-ruby": "1.526.1",
     "windmill-parser-wasm-rust": "1.647.1",
     "windmill-parser-wasm-ts": "1.695.0",
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index deb7eaf526..61d94a137a 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -89,7 +89,7 @@
 				"windmill-parser-wasm-php": "1.647.1",
 				"windmill-parser-wasm-py": "1.693.1",
 				"windmill-parser-wasm-r": "1.668.1",
-				"windmill-parser-wasm-regex": "1.692.0",
+				"windmill-parser-wasm-regex": "1.764.0",
 				"windmill-parser-wasm-ruby": "1.526.1",
 				"windmill-parser-wasm-rust": "1.647.1",
 				"windmill-parser-wasm-ts": "1.695.0",
@@ -880,7 +880,6 @@
 			"version": "1.11.2",
 			"resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.11.2.tgz",
 			"integrity": "sha512-TC8MkTuZUtcTSiFeuC0ksCh9QIJ5+F21MvZ4Wn4ORfYaFJ/0dsiudv5tVkejgwZlwQ39jL9WWDe2lz8x0WglOA==",
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"dependencies": {
@@ -892,7 +891,6 @@
 			"version": "1.11.2",
 			"resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.11.2.tgz",
 			"integrity": "sha512-kyOl3X0DuTiT1h2ft8r2fYO8JYtU9a9Xis/zBSiGArNaagCOWx90N1k2wxp18czFDH+OgcWGb5ZP/XMt3dcyPA==",
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"dependencies": {
@@ -903,7 +901,6 @@
 			"version": "1.2.2",
 			"resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-1.2.2.tgz",
 			"integrity": "sha512-c95qOXkHdydNKhscBTebqEC1CVAZpyqOfVfBzQ1qgzyl3gfeldUjIggDbIZgDKsHLgnsM+igH7TJ/eAasaVuMA==",
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"dependencies": {
@@ -1419,7 +1416,6 @@
 			"version": "1.1.4",
 			"resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.4.tgz",
 			"integrity": "sha512-3NQNNgA1YSlJb/kMH1ildASP9HW7/7kYnRI2szWJaofaS1hWmbGI4H+d3+22aGzXXN9IJ+n+GiFVcGipJP18ow==",
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"dependencies": {
@@ -1568,7 +1564,6 @@
 			"cpu": [
 				"arm64"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1585,7 +1580,6 @@
 			"cpu": [
 				"arm64"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1602,7 +1596,6 @@
 			"cpu": [
 				"x64"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1619,7 +1612,6 @@
 			"cpu": [
 				"x64"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1636,7 +1628,6 @@
 			"cpu": [
 				"arm"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1653,7 +1644,6 @@
 			"cpu": [
 				"arm64"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1670,7 +1660,6 @@
 			"cpu": [
 				"arm64"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1687,7 +1676,6 @@
 			"cpu": [
 				"ppc64"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1704,7 +1692,6 @@
 			"cpu": [
 				"s390x"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1721,7 +1708,6 @@
 			"cpu": [
 				"x64"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1738,7 +1724,6 @@
 			"cpu": [
 				"x64"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1755,7 +1740,6 @@
 			"cpu": [
 				"arm64"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1772,7 +1756,6 @@
 			"cpu": [
 				"wasm32"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"dependencies": {
@@ -1791,7 +1774,6 @@
 			"cpu": [
 				"arm64"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1808,7 +1790,6 @@
 			"cpu": [
 				"x64"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -2114,7 +2095,6 @@
 			"version": "0.10.2",
 			"resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.2.tgz",
 			"integrity": "sha512-RoBvJ2X0wuKlWFIjrwffGw1IqZHKQqzIchKaadZZfnNpsAYp2mM0h36JtPCjNDAHGgYez/15uMBpfGwchhiMgg==",
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"dependencies": {
@@ -7350,7 +7330,7 @@
 			"version": "1.21.7",
 			"resolved": "https://registry.npmjs.org/jiti/-/jiti-1.21.7.tgz",
 			"integrity": "sha512-/imKNG4EbWNrVjoNC/1H5/9GFy+tqjGBHCaSsN+P2RnPqjsLmv6UD3Ej+Kj8nBWaRAwyk7kK5ZUc+OEatnTR3A==",
-			"dev": true,
+			"devOptional": true,
 			"license": "MIT",
 			"bin": {
 				"jiti": "bin/jiti.js"
@@ -7885,7 +7865,6 @@
 			"cpu": [
 				"arm64"
 			],
-			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -7906,7 +7885,6 @@
 			"cpu": [
 				"arm64"
 			],
-			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -7927,7 +7905,6 @@
 			"cpu": [
 				"x64"
 			],
-			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -7948,7 +7925,6 @@
 			"cpu": [
 				"x64"
 			],
-			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -7969,7 +7945,6 @@
 			"cpu": [
 				"arm"
 			],
-			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -7990,7 +7965,6 @@
 			"cpu": [
 				"arm64"
 			],
-			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -8011,7 +7985,6 @@
 			"cpu": [
 				"arm64"
 			],
-			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -8032,7 +8005,6 @@
 			"cpu": [
 				"x64"
 			],
-			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -8053,7 +8025,6 @@
 			"cpu": [
 				"x64"
 			],
-			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -8074,7 +8045,6 @@
 			"cpu": [
 				"arm64"
 			],
-			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -8095,7 +8065,6 @@
 			"cpu": [
 				"x64"
 			],
-			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -12789,21 +12758,6 @@
 				}
 			}
 		},
-		"node_modules/svelte-check/node_modules/picomatch": {
-			"version": "4.0.5",
-			"resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.5.tgz",
-			"integrity": "sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==",
-			"dev": true,
-			"license": "MIT",
-			"optional": true,
-			"peer": true,
-			"engines": {
-				"node": ">=12"
-			},
-			"funding": {
-				"url": "https://github.com/sponsors/jonschlinkert"
-			}
-		},
 		"node_modules/svelte-eslint-parser": {
 			"version": "0.43.0",
 			"resolved": "https://registry.npmjs.org/svelte-eslint-parser/-/svelte-eslint-parser-0.43.0.tgz",
@@ -13543,7 +13497,7 @@
 			"version": "5.9.3",
 			"resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
 			"integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
-			"dev": true,
+			"devOptional": true,
 			"license": "Apache-2.0",
 			"bin": {
 				"tsc": "bin/tsc",
@@ -14369,9 +14323,9 @@
 			"integrity": "sha512-5YNeUibxpNBvYrxCgQcz1PxGhTFx2CyEpg2udtIhq7bx0d4gF/KDZVupMeQmAObmrEtTSFGUWNRJ4zXSWNrSpQ=="
 		},
 		"node_modules/windmill-parser-wasm-regex": {
-			"version": "1.692.0",
-			"resolved": "https://registry.npmjs.org/windmill-parser-wasm-regex/-/windmill-parser-wasm-regex-1.692.0.tgz",
-			"integrity": "sha512-BHGTxrinZJ9ef6hFxbKiBqBEr5uqgG/QySOgMA5r1LswO9n/8fyGswr8JcPT2kGaoeoweV6/RQ+RHVaOhosnKw=="
+			"version": "1.764.0",
+			"resolved": "https://registry.npmjs.org/windmill-parser-wasm-regex/-/windmill-parser-wasm-regex-1.764.0.tgz",
+			"integrity": "sha512-V2eFdKD90gqWikOvjl2fwMpFqiFt/21+4iQMbiNJYl7Lm2UiEcEZ4r9bpgJLG4TLOLqvD6+u4Ju3WaytxN2O2w=="
 		},
 		"node_modules/windmill-parser-wasm-ruby": {
 			"version": "1.526.1",
diff --git a/frontend/package.json b/frontend/package.json
index 7f458ca339..0486cb503f 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -164,7 +164,7 @@
 		"windmill-parser-wasm-php": "1.647.1",
 		"windmill-parser-wasm-py": "1.693.1",
 		"windmill-parser-wasm-r": "1.668.1",
-		"windmill-parser-wasm-regex": "1.692.0",
+		"windmill-parser-wasm-regex": "1.764.0",
 		"windmill-parser-wasm-ruby": "1.526.1",
 		"windmill-parser-wasm-rust": "1.647.1",
 		"windmill-parser-wasm-ts": "1.695.0",

From c6fd6da9711dda7b02b74d40a9b24d472f81cdf1 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Tue, 21 Jul 2026 16:37:10 +0200
Subject: [PATCH 089/171] repoint slack hubPaths to form-data 4.0.6 versions
 (#10239)

The image prebundles the hub scripts listed in hubPaths.json by their
pinned (immutable) version. windmill-integrations republished the four
image-cached slack scripts with form-data bumped 4.0.5 -> 4.0.6; point
hubPaths.json at the new versions so freshly built images cache the fixed
lock instead of the stale one.

Fixes part of #10219

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 frontend/src/lib/hubPaths.json | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/frontend/src/lib/hubPaths.json b/frontend/src/lib/hubPaths.json
index b898ebe658..0f0322676c 100644
--- a/frontend/src/lib/hubPaths.json
+++ b/frontend/src/lib/hubPaths.json
@@ -1,14 +1,14 @@
 {
 	"gitSyncTest": "hub/28184/git-repo-test-read-write-windmill",
 	"gitInitRepo": "hub/28789/git-sync-init-repository-windmill",
-	"slackErrorHandler": "hub/28241/workspace-or-schedule-error-handler-slack",
+	"slackErrorHandler": "hub/28794/workspace-or-schedule-error-handler-slack",
 	"emailErrorHandler": "hub/19795/workspace-or-error-handler-email",
-	"slackRecoveryHandler": "hub/28239/slack/schedule-recovery-handler-slack",
-	"slackSuccessHandler": "hub/28240/slack/schedule-success-handler-slack",
+	"slackRecoveryHandler": "hub/28791/slack/schedule-recovery-handler-slack",
+	"slackSuccessHandler": "hub/28793/slack/schedule-success-handler-slack",
 	"teamsErrorHandler": "hub/19742/workspace-or-schedule-error-handler-teams",
 	"teamsRecoveryHandler": "hub/11593/schedule-recovery-handler-teams",
 	"teamsSuccessHandler": "hub/11596/schedule-success-handler-teams",
-	"slackReport": "hub/9084/slack",
+	"slackReport": "hub/28792/slack",
 	"discordReport": "hub/9085/discord",
 	"smtpReport": "hub/28242/smtp",
 	"appReport": "hub/28243/app-report",

From c7ee192680be0572b5c3d1602908daf81cf5e283 Mon Sep 17 00:00:00 2001
From: hugocasa <hugo@casademont.ch>
Date: Tue, 21 Jul 2026 16:37:38 +0200
Subject: [PATCH 090/171] update ee ref to git sync cli prompt fix (#10224)

---
 backend/ee-repo-ref.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index 89e8173421..8bc1d06cad 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-4c08634af953db5c1125b1fb03f5af211fe21db3
+eb3690a34b41134c91b9cb6f90b11daa541ad171
\ No newline at end of file

From 68debab877c6dc8ee3732e0c23d467db85fd4584 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Tue, 21 Jul 2026 17:10:29 +0200
Subject: [PATCH 091/171] feat(triggers): add AMQP (RabbitMQ) trigger via lapin
 (#10230)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* feat(triggers): add AMQP (RabbitMQ) trigger using the lapin library

Fixes WIN-2214

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore(triggers): defer AMQP cross-workspace deploy pending utils-internal publish

Revert the amqp_trigger additions to the shared windmill-utils-internal
TriggerDeployKind and the frontend cross-workspace deploy adapter: the
frontend installs the published npm package, which lacks the new kind
until a release is cut. AMQP create/edit/delete/list/sync/capture are
unaffected (they use local types); only cross-workspace deploy/merge of
AMQP triggers waits on the package bump. Also document the at-most-once
ack in the consumer loop.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(triggers): address AMQP review — at-least-once ack, workspace cascade, contracts

- ack AMQP deliveries only after successful dispatch; nack+requeue on failure
- add ON DELETE CASCADE workspace FK so amqp_trigger rows are cleaned on
  workspace deletion (and the listener stops)
- fix the /amqp_triggers/test OpenAPI body and add amqp_trigger to
  WorkspaceDiffRow.kind
- register AMQP in the generated workspace trigger tool (create_trigger)
- drop banned $bindable defaults on optional props in the config section
- add build_uri unit tests (encoding, ports, vhost)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(triggers): stop AMQP poison-message loop and reconnect on transient drops

Chaos testing against a live RabbitMQ broker showed the previous
nack(requeue) + immediate re-poll spun a tight redelivery loop (~1000
critical-error reports/sec) on a poison message, and any connection blip
permanently disabled the trigger (lapin has no built-in reconnect).

- on dispatch failure: nack+requeue then stop consuming; the listener
  framework re-lists the trigger after its ping goes stale (~15s), backing
  redelivery off to that cadence instead of a tight loop (verified: rate
  dropped from ~1000/s to ~1 per ~26s, message preserved)
- on connection/stream error: stop and let the framework reconnect instead
  of disabling; persistent failures are still disabled via get_consumer
  (verified: a forced connection close now auto-reconnects and resumes)
- finish the AI create-trigger action wiring for AMQP: add amqp to
  CreatedResourceTriggerKind, the action-card registry, and the drawer
  registry so the result card renders and its "Open" action works

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(triggers): complete AMQP frontend registries and defer merge rows

- add amqp to capturableTriggerTypes (so AmqpCapture mounts), the Runs
  jobTriggerKinds filter, and CLOUD_DISABLED_TRIGGER_TYPES
- wire AMQP into global AI chat mode: TRIGGER_KINDS, the request union,
  writeTriggerSchema, triggerServices, and the draft adapter
- stop emitting actionable AMQP fork-comparison rows (revert amqp_trigger
  from TRIGGER_OR_SCHEDULE_TABLES) since cross-workspace deploy is deferred
  until windmill-utils-internal is published — avoids a deploy that fails
  with "Unknown kind: amqp_trigger"
- use design-system TextInput instead of raw <input> in the config section

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(triggers): complete AMQP session/draft registries and constrain prefetch

- add amqp to the session-deploy, draft-compare, preview-router, and
  copilot workspace-item registries so AMQP drafts/deploys/nav/path
  resolution work
- include amqp_count in the MoveDrawer attached-trigger rename warning
- replace the raw prefetch <input> with a design-system TextInput bounded
  to an integer 1-65535 (backend u16) and block save on invalid values

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(triggers): make AMQP disconnect/reconnect consistent with the Kafka trigger

lapin, like rdkafka, has no transparent reconnect, so the AMQP listener now
mirrors the Kafka trigger's explicit reconnect loop instead of relying on the
framework re-list (which disabled the trigger once get_consumer failed on a
sustained outage):

- get_consumer returns cheaply; consume owns a (re)connect loop that retries
  with a 30s backoff, reports a critical error every 10 failed attempts, and
  reports a recovered critical error once it reconnects — never disabling the
  trigger on a connectivity failure
- a consumer/stream error breaks out to reconnect rather than disabling
- dispatch failure still nacks+requeues (at-least-once) with a short backoff
  to avoid a tight poison-message loop, keeping the connection alive

Verified against a live RabbitMQ broker: killing the broker keeps the trigger
enabled and retrying (attempt N), and restarting it auto-reconnects (logs
"reconnected after N attempts") and resumes dispatch.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(triggers): complete AMQP capture registries and constrain prefetch contract

- add the 'amqp' case to triggerKindToTriggerType so opening the AMQP editor
  from a capture button no longer throws "Unknown TriggerKind: amqp"
- register AmqpIcon in CaptureTable's icon map and add an AMQP entry to the
  script/flow CaptureButton menu
- bound the OpenAPI prefetch_count to an integer 1-65535 (matches the Rust
  u16) and regenerate clients/prompts
- require a non-empty exchange name when the exchange binding is enabled
- build_uri: fall back to "/" on a blank vhost and bracket IPv6 hosts (+ tests)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(triggers): wire AMQP into pipeline graph, git-sync, and preprocessor types

- asset_graph: discover attached amqp_trigger rows and emit an AMQP TriggerEdge
  so AMQP triggers render (and can be opened/deleted) on the data-pipeline canvas
- frontend pipeline graph: add amqp to NativeTriggerKind, the add-trigger menu,
  node presentation, event-trigger set, annotation keywords, and the
  editor/service registrations
- git-sync: add the amqp_trigger include pattern (+ test) so an AMQP git-sync
  deployment stages only its .amqp_trigger.* file, not an unrelated same-path object
- preprocessor starters: add the AMQP event to the generated TS/Python/PHP
  trigger event types (kind/payload/exchange/routing_key/queue_name/redelivered/
  delivery_tag)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(triggers): finish AMQP pipeline/parser wiring, prefetch validation, source lists

- fix a stray edit that corrupted the pre-existing MqttTriggerEditor import
  ($lib/... path) in PipelineTriggerEditors.svelte
- reject prefetch_count = 0 server-side in validate_config (RabbitMQ treats 0
  as unlimited) and defensively skip basic_qos(0) in build_consumer (covers
  the capture path that bypasses CRUD validation)
- recognize `// on amqp` in the canonical parser (TriggerSpec::Amqp) and add
  amqp to the CLI non-autorun/event-trigger sets so a pipeline cascade never
  runs an AMQP-only node as a manual root without an event
- add amqp to the preprocessor intro lists and both pipeline AI instructions

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(triggers): reject zero AMQP prefetch in all paths and finish guidance lists

- extract a shared validate_amqp_options used by both CRUD validate_config
  and build_consumer, so capture configs (which bypass CRUD validation) also
  reject prefetch 0 instead of silently connecting with an unlimited buffer
  (+ unit tests for 0/1/65535/None)
- add AMQP to the main script-writing preprocessor-sources prompt and the CLI
  triggers-skill guidance list

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* docs(triggers): de-duplicate AMQP prefetch comment and fix GET response text

- keep the zero-prefetch rationale only on the shared validate_amqp_options
  doc; drop the redundant call-site comments
- correct the getAmqpTrigger OpenAPI 200 description ("deleted" -> "retrieved")

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore: update ee-repo-ref to aaa6cb89b05b76139252c64f057e53b94d12ac60

This commit updates the EE repository reference after PR #680 was merged in windmill-ee-private.

Previous ee-repo-ref: 5da5fd65aca9594b2611837a52e4677b544b0380

New ee-repo-ref: aaa6cb89b05b76139252c64f057e53b94d12ac60

Automated by sync-ee-ref workflow.

* chore(migrations): consolidate the four AMQP migrations into one

The table and the three enum ADD VALUE statements (trigger_kind, job_trigger_kind,
draft_kind) are one atomic feature. ALTER TYPE ... ADD VALUE runs inside the
migration transaction on PG >= 14 (Windmill's minimum) since the amqp_trigger
table doesn't reference those enum types, so they can share a single migration
instead of four. Verified applying cleanly in a single transaction on a fresh DB.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
---
 ...281a22467010d2c4a0611c8ae02742336f433.json |  38 +
 ...d3be7a970d602d3809396d9253d7e5dc88152.json |  41 +
 ...bc7e9ee85289ff5c52af43166928337c257e7.json |   3 +-
 ...7b23d6dcf2e5364852a5e85b3c41c417bace2.json |   3 +-
 ...66f38ffe2f3a0958adea53e67757c6ac463ec.json |   3 +-
 ...69c3592218d34e58d617253e8b563bc661a7a.json |  17 +
 ...adbb2860ce52d37a56b2861de1215260ecff8.json |   6 +-
 ...fbe7db4887c4ac5295052c796bd78a7edc50b.json |   3 +-
 ...f518b42f4cdb33e034441015494bd26c172d2.json |   3 +-
 ...fa25bfb67dd641153d1ca23f7d0d2ae73624e.json |   3 +-
 ...cb3adcf0175d0a71013f2497397c1c8ccc619.json |   3 +-
 ...cad6d8995242dc20a4e14c1a8fae4fc6a9fd2.json |   3 +-
 ...2f7175cc6f2e02d9c565bb5159cae3e0b6835.json |   3 +-
 ...70f68bc0421f1aa228f80157adda63191d33b.json |   3 +-
 ...c23caf312ec377dd91e5307f00d3fb8ec325d.json |   3 +-
 ...08532a1020cabaf5e22325a1e05f0491d785c.json |   3 +-
 ...ac91ee793ad6f5ceed5b3eda9b48617c5434d.json |   3 +-
 ...e35adf640d44d607e62a1fb296e38ac3fdd36.json |   6 +-
 ...e6ecfcdec3d505d28cc65b5920dcf87c0014f.json |   3 +-
 ...2d82c350857166fc27fe9eecc88bcc4b229bc.json |   3 +-
 ...6e490d5dfcdd7a94dcbe5d05c9e5af37ac4a4.json |   3 +-
 ...9393023e79f948976e6ffc0e9bfc94623393c.json |  27 +
 ...1a803e1bced2f8e1a12f8933b7598ee85a147.json |   3 +-
 ...04af5a7eb488c76f783e690af0c2153b1d6a8.json |   3 +-
 ...a55a9f8fa854b29edcea83710a9170124edf0.json |   3 +-
 ...4f412c57af931f80621aee5012e9cb3535626.json |   3 +-
 ...8d92a983470adcd3cc850734960c905e61e83.json |   3 +-
 ...a22e4276c1da653475628889ce17dc904fbaa.json |   3 +-
 ...6eb9016207975af1e37042d81df8cb6ae2c53.json |   3 +-
 ...506bf08c28efe82b68b3d44bafbd3d0e91c29.json |   3 +-
 ...c749524f1db10a51f3de6cadd4826e6c1d422.json |   3 +-
 ...68644853987e62cbcedc8d3a46626a60c9fb0.json |  15 +
 ...d2393e297043e4e58555d872b5c4dd89c196a.json |   3 +-
 ...3a960b89e02ec40b292f3b5198baf2a1d3dbf.json |   3 +-
 ...fbafe5dc3cdecc17a3d5a7476b160c1b6e7e1.json |   3 +-
 ...c408eda4323ec12ade20ec0da565051128f26.json | 100 +++
 ...e33244fe8ab9a803248fc23f334034d24aad4.json |   3 +-
 ...bb6a8f961c119516e4c33dc928cd3b4f4edbc.json |   3 +-
 ...9e637e9e156cd85b69126c87dfff89a47711d.json |   3 +-
 ...4267d67f58f9cbff0d164b4df45de885b0e9d.json |   3 +-
 ...77429c51e6166c414bcc5ce2e97fac25bcd77.json |   3 +-
 ...9746147aa9b8d0a81642a7b7cb4738a0cad66.json |   3 +-
 ...d434f860922fbc021185beffb9827647feb8e.json |   3 +-
 ...d288eb60f6c6644a73cdf949de0159215a7f7.json |   3 +-
 ...13f1f882b695f896f94e5cf91d205633355a1.json |   3 +-
 ...e1ea2fe96a1b94f5a92953fb1c1642d15c016.json |   3 +-
 ...120e5b0f629f9f04e08a2982df33ff23ac7a9.json |   3 +-
 ...1a8a9cc35f362197c0766a5787436af141106.json |   3 +-
 ...5e59e5edda1faea72f39603814afb6a3cd596.json |   3 +-
 ...acd0068c51ca21018d6751cc1044e38c06730.json |  15 +
 ...9352d4d1e3cb3a8a08f1c9c03055a1cab1235.json |   3 +-
 ...f03f72ef81db302d727e18e63a307ac902022.json |   3 +-
 ...c35c7342ac9a814c73f6290e1d6ebd3a55423.json |   3 +-
 ...50d6a6935420fbedc83aa3ad1e9be7465c8dd.json |   3 +-
 backend/Cargo.lock                            | 718 +++++++++++++++++-
 backend/Cargo.toml                            |  10 +-
 backend/ee-repo-ref.txt                       |   2 +-
 .../20260721082249_add_amqp_trigger.down.sql  |   2 +
 .../20260721082249_add_amqp_trigger.up.sql    |  83 ++
 .../windmill-parser/src/asset_parser.rs       |   7 +-
 .../tests/pipeline_annotations_parity.rs      |   1 +
 backend/windmill-api-assets/src/lib.rs        |   9 +
 backend/windmill-api-auth/src/scopes.rs       |   3 +
 .../windmill-api-groups/src/granular_acls.rs  |   7 +-
 backend/windmill-api-users/src/users.rs       |   1 +
 .../windmill-api-workspaces/src/workspaces.rs |  19 +
 .../src/workspaces_extra.rs                   |   9 +
 backend/windmill-api/Cargo.toml               |   6 +-
 backend/windmill-api/openapi.yaml             | 394 ++++++++++
 backend/windmill-api/src/capture.rs           |  12 +
 backend/windmill-api/src/offboarding.rs       |   5 +-
 backend/windmill-api/src/token.rs             |   1 +
 backend/windmill-api/src/trash.rs             |   1 +
 backend/windmill-api/src/triggers/amqp/mod.rs |   1 +
 backend/windmill-api/src/triggers/handler.rs  |  23 +
 backend/windmill-api/src/triggers/listener.rs |   8 +
 backend/windmill-api/src/triggers/mod.rs      |   2 +
 backend/windmill-api/src/workspaces_export.rs |  33 +
 backend/windmill-common/src/assets.rs         |   1 +
 backend/windmill-common/src/triggers.rs       |   3 +-
 backend/windmill-common/src/user_drafts.rs    |   6 +-
 backend/windmill-git-sync/src/lib.rs          |  11 +
 backend/windmill-store/Cargo.toml             |   1 +
 backend/windmill-store/src/resources.rs       |   1 +
 backend/windmill-trigger-amqp/Cargo.toml      |  37 +
 backend/windmill-trigger-amqp/src/handler.rs  | 203 +++++
 backend/windmill-trigger-amqp/src/lib.rs      | 341 +++++++++
 backend/windmill-trigger-amqp/src/listener.rs | 255 +++++++
 .../windmill-trigger/src/trigger_helpers.rs   |   2 +-
 backend/windmill-types/src/jobs.rs            |   2 +
 backend/windmill-types/src/triggers.rs        |   3 +
 cli/src/commands/pipeline/boundedCascade.ts   |   1 +
 cli/src/commands/pipeline/localGraph.ts       |   1 +
 cli/src/commands/sync/sync.ts                 |  10 +-
 cli/src/commands/trigger/trigger.ts           |  21 +-
 cli/src/guidance/core.ts                      |   2 +-
 cli/src/guidance/skills.gen.ts                | 121 ++-
 cli/src/types.ts                              |   5 +
 cli/src/utils/git.ts                          |   2 +
 cli/test/git_unit.test.ts                     |   3 +
 .../src/lib/components/CompareDrafts.svelte   |   2 +
 .../lib/components/CompareWorkspaces.svelte   |   1 +
 frontend/src/lib/components/MoveDrawer.svelte |   1 +
 frontend/src/lib/components/Path.svelte       |   7 +
 .../assets/AssetGraph/AddNode.svelte          |   6 +
 .../AssetGraph/PipelineTriggerEditors.svelte  |  11 +
 .../assets/AssetGraph/TriggerNode.svelte      |   1 +
 .../assets/AssetGraph/boundedCascade.ts       |   1 +
 .../AssetGraph/parsePipelineAnnotations.ts    |   1 +
 .../assets/AssetGraph/pipelineTemplates.ts    |   1 +
 .../lib/components/assets/AssetGraph/types.ts |   1 +
 .../lib/components/common/table/Row.svelte    |   1 +
 .../components/common/table/RowIcon.svelte    |   6 +
 .../chat/CreatedResourceActionDrawers.svelte  |   4 +
 .../copilot/chat/ToolMessageActions.svelte    |   2 +
 .../components/copilot/chat/global/core.ts    |  11 +
 .../copilot/chat/global/userDraftAdapter.ts   |   2 +
 .../copilot/chat/global/workspaceItems.ts     |   3 +
 .../components/copilot/chat/pipeline/core.ts  |   2 +-
 .../src/lib/components/copilot/chat/shared.ts |   1 +
 .../copilot/chat/workspaceItems.svelte.ts     |   3 +
 .../components/copilot/chat/workspaceTools.ts |  13 +-
 .../copilot/chat/workspaceToolsZod.gen.ts     |  40 +
 .../renderers/triggers/TriggersBadge.svelte   |  11 +-
 .../src/lib/components/icons/AmqpIcon.svelte  |  22 +
 frontend/src/lib/components/icons/index.ts    |   3 +
 .../src/lib/components/offboarding-utils.ts   |   2 +
 .../search/GlobalSearchModal.svelte           |  17 +-
 .../lib/components/sessions/previewRouter.ts  |   2 +
 .../components/sessions/sessionDeployModel.ts |   1 +
 .../components/sidebar/OperatorMenu.svelte    |   1 +
 .../components/sidebar/SidebarContent.svelte  |  10 +
 frontend/src/lib/components/triggers.ts       |   3 +
 .../triggers/AddTriggersButton.svelte         |   6 +
 .../components/triggers/CaptureButton.svelte  |   6 +
 .../components/triggers/CaptureTable.svelte   |   3 +-
 .../components/triggers/CaptureWrapper.svelte |  29 +-
 .../triggers/TestTriggerConnection.svelte     |  22 +-
 .../components/triggers/TriggersEditor.svelte |  10 +
 .../triggers/TriggersWrapper.svelte           |  10 +
 .../triggers/amqp/AmqpCapture.svelte          |  58 ++
 .../amqp/AmqpEditorConfigSection.svelte       | 175 +++++
 .../triggers/amqp/AmqpTriggerEditor.svelte    |  29 +
 .../amqp/AmqpTriggerEditorInner.svelte        | 615 +++++++++++++++
 .../triggers/amqp/AmqpTriggersPanel.svelte    |  61 ++
 .../src/lib/components/triggers/amqp/utils.ts |  56 ++
 .../components/triggers/triggers.svelte.ts    |  28 +
 frontend/src/lib/components/triggers/utils.ts |  19 +
 frontend/src/lib/script_helpers.ts            |  38 +-
 frontend/src/lib/userDraft.svelte.ts          |   1 +
 frontend/src/lib/userDraftDbMigration.ts      |   1 +
 frontend/src/lib/utils_deployable.ts          |  31 +
 frontend/src/lib/utils_draft_deploy.ts        |   6 +
 .../src/routes/(root)/(logged)/+layout.svelte |   4 +
 .../(root)/(logged)/amqp_triggers/+page.js    |   5 +
 .../(logged)/amqp_triggers/+page.svelte       | 550 ++++++++++++++
 .../auto-generated/cli/cli-commands.md        |   6 +-
 system_prompts/auto-generated/prompts.ts      |  10 +-
 .../schemas/amqp_trigger.schema.yaml          | 113 +++
 system_prompts/auto-generated/script.md       |   2 +-
 .../skills/cli-commands/SKILL.md              |   6 +-
 system_prompts/base/pipeline-base.md          |   2 +-
 system_prompts/base/script-base.md            |   2 +-
 system_prompts/generate.py                    |   4 +
 system_prompts/utils.py                       |   1 +
 165 files changed, 4753 insertions(+), 138 deletions(-)
 create mode 100644 backend/.sqlx/query-02e39bb9957d3ccfe3d573994cd281a22467010d2c4a0611c8ae02742336f433.json
 create mode 100644 backend/.sqlx/query-05843e117361d6b7cd9da652596d3be7a970d602d3809396d9253d7e5dc88152.json
 create mode 100644 backend/.sqlx/query-1cd16f93bdc90b24ceb1e86495069c3592218d34e58d617253e8b563bc661a7a.json
 create mode 100644 backend/.sqlx/query-5f2e66e53166840c68efbc521fe9393023e79f948976e6ffc0e9bfc94623393c.json
 create mode 100644 backend/.sqlx/query-90da952a912de746abee641cc4268644853987e62cbcedc8d3a46626a60c9fb0.json
 create mode 100644 backend/.sqlx/query-a47f7d625a96ad47277609ae173c408eda4323ec12ade20ec0da565051128f26.json
 create mode 100644 backend/.sqlx/query-d9d997591a163f25a9be5134bffacd0068c51ca21018d6751cc1044e38c06730.json
 create mode 100644 backend/migrations/20260721082249_add_amqp_trigger.down.sql
 create mode 100644 backend/migrations/20260721082249_add_amqp_trigger.up.sql
 create mode 100644 backend/windmill-api/src/triggers/amqp/mod.rs
 create mode 100644 backend/windmill-trigger-amqp/Cargo.toml
 create mode 100644 backend/windmill-trigger-amqp/src/handler.rs
 create mode 100644 backend/windmill-trigger-amqp/src/lib.rs
 create mode 100644 backend/windmill-trigger-amqp/src/listener.rs
 create mode 100644 frontend/src/lib/components/icons/AmqpIcon.svelte
 create mode 100644 frontend/src/lib/components/triggers/amqp/AmqpCapture.svelte
 create mode 100644 frontend/src/lib/components/triggers/amqp/AmqpEditorConfigSection.svelte
 create mode 100644 frontend/src/lib/components/triggers/amqp/AmqpTriggerEditor.svelte
 create mode 100644 frontend/src/lib/components/triggers/amqp/AmqpTriggerEditorInner.svelte
 create mode 100644 frontend/src/lib/components/triggers/amqp/AmqpTriggersPanel.svelte
 create mode 100644 frontend/src/lib/components/triggers/amqp/utils.ts
 create mode 100644 frontend/src/routes/(root)/(logged)/amqp_triggers/+page.js
 create mode 100644 frontend/src/routes/(root)/(logged)/amqp_triggers/+page.svelte
 create mode 100644 system_prompts/auto-generated/schemas/amqp_trigger.schema.yaml

diff --git a/backend/.sqlx/query-02e39bb9957d3ccfe3d573994cd281a22467010d2c4a0611c8ae02742336f433.json b/backend/.sqlx/query-02e39bb9957d3ccfe3d573994cd281a22467010d2c4a0611c8ae02742336f433.json
new file mode 100644
index 0000000000..9219641ce9
--- /dev/null
+++ b/backend/.sqlx/query-02e39bb9957d3ccfe3d573994cd281a22467010d2c4a0611c8ae02742336f433.json
@@ -0,0 +1,38 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n            INSERT INTO amqp_trigger (\n                amqp_resource_path,\n                queue_name,\n                exchange,\n                options,\n                workspace_id,\n                path,\n                script_path,\n                is_flow,\n                permissioned_as,\n                mode,\n                edited_by,\n                error_handler_path,\n                error_handler_args,\n                retry\n            )\n            VALUES (\n                $1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14\n            )",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar",
+        "Jsonb",
+        "Jsonb",
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Bool",
+        "Varchar",
+        {
+          "Custom": {
+            "name": "trigger_mode",
+            "kind": {
+              "Enum": [
+                "enabled",
+                "disabled",
+                "suspended"
+              ]
+            }
+          }
+        },
+        "Varchar",
+        "Varchar",
+        "Jsonb",
+        "Jsonb"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "02e39bb9957d3ccfe3d573994cd281a22467010d2c4a0611c8ae02742336f433"
+}
diff --git a/backend/.sqlx/query-05843e117361d6b7cd9da652596d3be7a970d602d3809396d9253d7e5dc88152.json b/backend/.sqlx/query-05843e117361d6b7cd9da652596d3be7a970d602d3809396d9253d7e5dc88152.json
new file mode 100644
index 0000000000..950fe7bcdf
--- /dev/null
+++ b/backend/.sqlx/query-05843e117361d6b7cd9da652596d3be7a970d602d3809396d9253d7e5dc88152.json
@@ -0,0 +1,41 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        SELECT kind, path, script_path, is_flow FROM (\n            SELECT 'schedule' AS kind, path, script_path, is_flow FROM schedule\n                WHERE workspace_id = $1\n                  AND script_path IS NOT NULL\n            UNION ALL\n            SELECT 'email', path, script_path, is_flow FROM email_trigger\n                WHERE workspace_id = $1\n            UNION ALL\n            SELECT 'kafka', path, script_path, is_flow FROM kafka_trigger\n                WHERE workspace_id = $1\n            UNION ALL\n            SELECT 'mqtt', path, script_path, is_flow FROM mqtt_trigger\n                WHERE workspace_id = $1\n            UNION ALL\n            SELECT 'amqp', path, script_path, is_flow FROM amqp_trigger\n                WHERE workspace_id = $1\n            UNION ALL\n            SELECT 'nats', path, script_path, is_flow FROM nats_trigger\n                WHERE workspace_id = $1\n            UNION ALL\n            SELECT 'postgres', path, script_path, is_flow FROM postgres_trigger\n                WHERE workspace_id = $1\n            UNION ALL\n            SELECT 'sqs', path, script_path, is_flow FROM sqs_trigger\n                WHERE workspace_id = $1\n            UNION ALL\n            SELECT 'gcp', path, script_path, is_flow FROM gcp_trigger\n                WHERE workspace_id = $1\n        ) t\n        WHERE ($2::text IS NULL OR script_path LIKE $2)\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "kind",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 1,
+        "name": "path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "script_path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 3,
+        "name": "is_flow",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null,
+      null,
+      null,
+      null
+    ]
+  },
+  "hash": "05843e117361d6b7cd9da652596d3be7a970d602d3809396d9253d7e5dc88152"
+}
diff --git a/backend/.sqlx/query-089d7bc7acdbb97cf477159e111bc7e9ee85289ff5c52af43166928337c257e7.json b/backend/.sqlx/query-089d7bc7acdbb97cf477159e111bc7e9ee85289ff5c52af43166928337c257e7.json
index 6efb66005d..a762af65c9 100644
--- a/backend/.sqlx/query-089d7bc7acdbb97cf477159e111bc7e9ee85289ff5c52af43166928337c257e7.json
+++ b/backend/.sqlx/query-089d7bc7acdbb97cf477159e111bc7e9ee85289ff5c52af43166928337c257e7.json
@@ -36,7 +36,8 @@
                 "github",
                 "azure",
                 "asset",
-                "freshness"
+                "freshness",
+                "amqp"
               ]
             }
           }
diff --git a/backend/.sqlx/query-0f7e01b613a94b29784aae6d7b17b23d6dcf2e5364852a5e85b3c41c417bace2.json b/backend/.sqlx/query-0f7e01b613a94b29784aae6d7b17b23d6dcf2e5364852a5e85b3c41c417bace2.json
index 0e0fbca58e..9333553d8e 100644
--- a/backend/.sqlx/query-0f7e01b613a94b29784aae6d7b17b23d6dcf2e5364852a5e85b3c41c417bace2.json
+++ b/backend/.sqlx/query-0f7e01b613a94b29784aae6d7b17b23d6dcf2e5364852a5e85b3c41c417bace2.json
@@ -27,7 +27,8 @@
                 "nextcloud",
                 "google",
                 "github",
-                "azure"
+                "azure",
+                "amqp"
               ]
             }
           }
diff --git a/backend/.sqlx/query-16d438374b03a9c515f4c2d638366f38ffe2f3a0958adea53e67757c6ac463ec.json b/backend/.sqlx/query-16d438374b03a9c515f4c2d638366f38ffe2f3a0958adea53e67757c6ac463ec.json
index 0e966467a9..9efcf8fc44 100644
--- a/backend/.sqlx/query-16d438374b03a9c515f4c2d638366f38ffe2f3a0958adea53e67757c6ac463ec.json
+++ b/backend/.sqlx/query-16d438374b03a9c515f4c2d638366f38ffe2f3a0958adea53e67757c6ac463ec.json
@@ -27,7 +27,8 @@
                 "nextcloud",
                 "google",
                 "github",
-                "azure"
+                "azure",
+                "amqp"
               ]
             }
           }
diff --git a/backend/.sqlx/query-1cd16f93bdc90b24ceb1e86495069c3592218d34e58d617253e8b563bc661a7a.json b/backend/.sqlx/query-1cd16f93bdc90b24ceb1e86495069c3592218d34e58d617253e8b563bc661a7a.json
new file mode 100644
index 0000000000..f2327d1700
--- /dev/null
+++ b/backend/.sqlx/query-1cd16f93bdc90b24ceb1e86495069c3592218d34e58d617253e8b563bc661a7a.json
@@ -0,0 +1,17 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "WITH t1 AS (UPDATE websocket_trigger SET script_path = $1, server_id = NULL WHERE script_path = $2 AND workspace_id = $3 AND is_flow = $4), t2 AS (UPDATE kafka_trigger SET script_path = $1, server_id = NULL WHERE script_path = $2 AND workspace_id = $3 AND is_flow = $4), t3 AS (UPDATE postgres_trigger SET script_path = $1, server_id = NULL WHERE script_path = $2 AND workspace_id = $3 AND is_flow = $4), t4 AS (UPDATE mqtt_trigger SET script_path = $1, server_id = NULL WHERE script_path = $2 AND workspace_id = $3 AND is_flow = $4), t5 AS (UPDATE nats_trigger SET script_path = $1, server_id = NULL WHERE script_path = $2 AND workspace_id = $3 AND is_flow = $4), t6 AS (UPDATE sqs_trigger SET script_path = $1, server_id = NULL WHERE script_path = $2 AND workspace_id = $3 AND is_flow = $4), t7 AS (UPDATE amqp_trigger SET script_path = $1, server_id = NULL WHERE script_path = $2 AND workspace_id = $3 AND is_flow = $4) UPDATE gcp_trigger SET script_path = $1, server_id = NULL WHERE script_path = $2 AND workspace_id = $3 AND is_flow = $4",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text",
+        "Text",
+        "Bool"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "1cd16f93bdc90b24ceb1e86495069c3592218d34e58d617253e8b563bc661a7a"
+}
diff --git a/backend/.sqlx/query-212553c83e4dcdc6d045eb2fe2dadbb2860ce52d37a56b2861de1215260ecff8.json b/backend/.sqlx/query-212553c83e4dcdc6d045eb2fe2dadbb2860ce52d37a56b2861de1215260ecff8.json
index 704883d4f1..831dce83d7 100644
--- a/backend/.sqlx/query-212553c83e4dcdc6d045eb2fe2dadbb2860ce52d37a56b2861de1215260ecff8.json
+++ b/backend/.sqlx/query-212553c83e4dcdc6d045eb2fe2dadbb2860ce52d37a56b2861de1215260ecff8.json
@@ -40,7 +40,8 @@
                 "github",
                 "azure",
                 "asset",
-                "freshness"
+                "freshness",
+                "amqp"
               ]
             }
           }
@@ -79,7 +80,8 @@
                 "github",
                 "azure",
                 "asset",
-                "freshness"
+                "freshness",
+                "amqp"
               ]
             }
           }
diff --git a/backend/.sqlx/query-22e0e8a1aa48f8b21763452bd36fbe7db4887c4ac5295052c796bd78a7edc50b.json b/backend/.sqlx/query-22e0e8a1aa48f8b21763452bd36fbe7db4887c4ac5295052c796bd78a7edc50b.json
index 49a2977cf8..54f9e57c2f 100644
--- a/backend/.sqlx/query-22e0e8a1aa48f8b21763452bd36fbe7db4887c4ac5295052c796bd78a7edc50b.json
+++ b/backend/.sqlx/query-22e0e8a1aa48f8b21763452bd36fbe7db4887c4ac5295052c796bd78a7edc50b.json
@@ -27,7 +27,8 @@
                 "nextcloud",
                 "google",
                 "github",
-                "azure"
+                "azure",
+                "amqp"
               ]
             }
           }
diff --git a/backend/.sqlx/query-23419adcd74c326d716527293eff518b42f4cdb33e034441015494bd26c172d2.json b/backend/.sqlx/query-23419adcd74c326d716527293eff518b42f4cdb33e034441015494bd26c172d2.json
index 5c84181bdb..6aa714182f 100644
--- a/backend/.sqlx/query-23419adcd74c326d716527293eff518b42f4cdb33e034441015494bd26c172d2.json
+++ b/backend/.sqlx/query-23419adcd74c326d716527293eff518b42f4cdb33e034441015494bd26c172d2.json
@@ -43,7 +43,8 @@
                 "nextcloud",
                 "google",
                 "github",
-                "azure"
+                "azure",
+                "amqp"
               ]
             }
           }
diff --git a/backend/.sqlx/query-2bed492ef32edf36e60e8a03268fa25bfb67dd641153d1ca23f7d0d2ae73624e.json b/backend/.sqlx/query-2bed492ef32edf36e60e8a03268fa25bfb67dd641153d1ca23f7d0d2ae73624e.json
index 241778d359..920a463d01 100644
--- a/backend/.sqlx/query-2bed492ef32edf36e60e8a03268fa25bfb67dd641153d1ca23f7d0d2ae73624e.json
+++ b/backend/.sqlx/query-2bed492ef32edf36e60e8a03268fa25bfb67dd641153d1ca23f7d0d2ae73624e.json
@@ -43,7 +43,8 @@
                 "trigger_nextcloud",
                 "trigger_google",
                 "trigger_github",
-                "data_pipeline"
+                "data_pipeline",
+                "trigger_amqp"
               ]
             }
           }
diff --git a/backend/.sqlx/query-3c84781704b84b8a927ecce5a3fcb3adcf0175d0a71013f2497397c1c8ccc619.json b/backend/.sqlx/query-3c84781704b84b8a927ecce5a3fcb3adcf0175d0a71013f2497397c1c8ccc619.json
index f5ee767768..257e1e528f 100644
--- a/backend/.sqlx/query-3c84781704b84b8a927ecce5a3fcb3adcf0175d0a71013f2497397c1c8ccc619.json
+++ b/backend/.sqlx/query-3c84781704b84b8a927ecce5a3fcb3adcf0175d0a71013f2497397c1c8ccc619.json
@@ -129,7 +129,8 @@
                 "github",
                 "azure",
                 "asset",
-                "freshness"
+                "freshness",
+                "amqp"
               ]
             }
           }
diff --git a/backend/.sqlx/query-42b4b73e9d60348e2d90fcade9dcad6d8995242dc20a4e14c1a8fae4fc6a9fd2.json b/backend/.sqlx/query-42b4b73e9d60348e2d90fcade9dcad6d8995242dc20a4e14c1a8fae4fc6a9fd2.json
index ad5613b8fd..a2174020cd 100644
--- a/backend/.sqlx/query-42b4b73e9d60348e2d90fcade9dcad6d8995242dc20a4e14c1a8fae4fc6a9fd2.json
+++ b/backend/.sqlx/query-42b4b73e9d60348e2d90fcade9dcad6d8995242dc20a4e14c1a8fae4fc6a9fd2.json
@@ -27,7 +27,8 @@
                 "nextcloud",
                 "google",
                 "github",
-                "azure"
+                "azure",
+                "amqp"
               ]
             }
           }
diff --git a/backend/.sqlx/query-45024b932383199974616bba1fc2f7175cc6f2e02d9c565bb5159cae3e0b6835.json b/backend/.sqlx/query-45024b932383199974616bba1fc2f7175cc6f2e02d9c565bb5159cae3e0b6835.json
index e61104d62d..a5db66e7c6 100644
--- a/backend/.sqlx/query-45024b932383199974616bba1fc2f7175cc6f2e02d9c565bb5159cae3e0b6835.json
+++ b/backend/.sqlx/query-45024b932383199974616bba1fc2f7175cc6f2e02d9c565bb5159cae3e0b6835.json
@@ -33,7 +33,8 @@
                 "nextcloud",
                 "google",
                 "github",
-                "azure"
+                "azure",
+                "amqp"
               ]
             }
           }
diff --git a/backend/.sqlx/query-46f00a75b2e7e4ac70758a9687070f68bc0421f1aa228f80157adda63191d33b.json b/backend/.sqlx/query-46f00a75b2e7e4ac70758a9687070f68bc0421f1aa228f80157adda63191d33b.json
index c269f7f340..dcd3573e92 100644
--- a/backend/.sqlx/query-46f00a75b2e7e4ac70758a9687070f68bc0421f1aa228f80157adda63191d33b.json
+++ b/backend/.sqlx/query-46f00a75b2e7e4ac70758a9687070f68bc0421f1aa228f80157adda63191d33b.json
@@ -42,7 +42,8 @@
                 "trigger_nextcloud",
                 "trigger_google",
                 "trigger_github",
-                "data_pipeline"
+                "data_pipeline",
+                "trigger_amqp"
               ]
             }
           }
diff --git a/backend/.sqlx/query-4a43d4df6c5b2e8dda4308dcb88c23caf312ec377dd91e5307f00d3fb8ec325d.json b/backend/.sqlx/query-4a43d4df6c5b2e8dda4308dcb88c23caf312ec377dd91e5307f00d3fb8ec325d.json
index 7474818bf3..8849c7f0fa 100644
--- a/backend/.sqlx/query-4a43d4df6c5b2e8dda4308dcb88c23caf312ec377dd91e5307f00d3fb8ec325d.json
+++ b/backend/.sqlx/query-4a43d4df6c5b2e8dda4308dcb88c23caf312ec377dd91e5307f00d3fb8ec325d.json
@@ -81,7 +81,8 @@
                 "github",
                 "azure",
                 "asset",
-                "freshness"
+                "freshness",
+                "amqp"
               ]
             }
           }
diff --git a/backend/.sqlx/query-4d272cf4a77aab7007a5b35589e08532a1020cabaf5e22325a1e05f0491d785c.json b/backend/.sqlx/query-4d272cf4a77aab7007a5b35589e08532a1020cabaf5e22325a1e05f0491d785c.json
index 99d6e818ea..6425204e0e 100644
--- a/backend/.sqlx/query-4d272cf4a77aab7007a5b35589e08532a1020cabaf5e22325a1e05f0491d785c.json
+++ b/backend/.sqlx/query-4d272cf4a77aab7007a5b35589e08532a1020cabaf5e22325a1e05f0491d785c.json
@@ -40,7 +40,8 @@
                 "nextcloud",
                 "google",
                 "github",
-                "azure"
+                "azure",
+                "amqp"
               ]
             }
           }
diff --git a/backend/.sqlx/query-4efaa4c3c14987fe95a508cc0cbac91ee793ad6f5ceed5b3eda9b48617c5434d.json b/backend/.sqlx/query-4efaa4c3c14987fe95a508cc0cbac91ee793ad6f5ceed5b3eda9b48617c5434d.json
index bdb39d134f..3a9c2ffae7 100644
--- a/backend/.sqlx/query-4efaa4c3c14987fe95a508cc0cbac91ee793ad6f5ceed5b3eda9b48617c5434d.json
+++ b/backend/.sqlx/query-4efaa4c3c14987fe95a508cc0cbac91ee793ad6f5ceed5b3eda9b48617c5434d.json
@@ -47,7 +47,8 @@
                 "trigger_nextcloud",
                 "trigger_google",
                 "trigger_github",
-                "data_pipeline"
+                "data_pipeline",
+                "trigger_amqp"
               ]
             }
           }
diff --git a/backend/.sqlx/query-4f547c0fd54f3bc57212ce87810e35adf640d44d607e62a1fb296e38ac3fdd36.json b/backend/.sqlx/query-4f547c0fd54f3bc57212ce87810e35adf640d44d607e62a1fb296e38ac3fdd36.json
index dea8f68e4f..ee1034e845 100644
--- a/backend/.sqlx/query-4f547c0fd54f3bc57212ce87810e35adf640d44d607e62a1fb296e38ac3fdd36.json
+++ b/backend/.sqlx/query-4f547c0fd54f3bc57212ce87810e35adf640d44d607e62a1fb296e38ac3fdd36.json
@@ -35,7 +35,8 @@
                 "nextcloud",
                 "google",
                 "github",
-                "azure"
+                "azure",
+                "amqp"
               ]
             }
           }
@@ -76,7 +77,8 @@
                 "nextcloud",
                 "google",
                 "github",
-                "azure"
+                "azure",
+                "amqp"
               ]
             }
           }
diff --git a/backend/.sqlx/query-54ad5cc89563fdbbacdd6bfde9be6ecfcdec3d505d28cc65b5920dcf87c0014f.json b/backend/.sqlx/query-54ad5cc89563fdbbacdd6bfde9be6ecfcdec3d505d28cc65b5920dcf87c0014f.json
index d81d6ebd94..6513bbbf21 100644
--- a/backend/.sqlx/query-54ad5cc89563fdbbacdd6bfde9be6ecfcdec3d505d28cc65b5920dcf87c0014f.json
+++ b/backend/.sqlx/query-54ad5cc89563fdbbacdd6bfde9be6ecfcdec3d505d28cc65b5920dcf87c0014f.json
@@ -36,7 +36,8 @@
                 "trigger_nextcloud",
                 "trigger_google",
                 "trigger_github",
-                "data_pipeline"
+                "data_pipeline",
+                "trigger_amqp"
               ]
             }
           }
diff --git a/backend/.sqlx/query-560539adbad0ecfa57fa477c3b82d82c350857166fc27fe9eecc88bcc4b229bc.json b/backend/.sqlx/query-560539adbad0ecfa57fa477c3b82d82c350857166fc27fe9eecc88bcc4b229bc.json
index 91c941593f..81ca75de73 100644
--- a/backend/.sqlx/query-560539adbad0ecfa57fa477c3b82d82c350857166fc27fe9eecc88bcc4b229bc.json
+++ b/backend/.sqlx/query-560539adbad0ecfa57fa477c3b82d82c350857166fc27fe9eecc88bcc4b229bc.json
@@ -43,7 +43,8 @@
                 "trigger_nextcloud",
                 "trigger_google",
                 "trigger_github",
-                "data_pipeline"
+                "data_pipeline",
+                "trigger_amqp"
               ]
             }
           }
diff --git a/backend/.sqlx/query-5884ce1906015f6b96231f311226e490d5dfcdd7a94dcbe5d05c9e5af37ac4a4.json b/backend/.sqlx/query-5884ce1906015f6b96231f311226e490d5dfcdd7a94dcbe5d05c9e5af37ac4a4.json
index 0c445c1ae5..9a18371f1f 100644
--- a/backend/.sqlx/query-5884ce1906015f6b96231f311226e490d5dfcdd7a94dcbe5d05c9e5af37ac4a4.json
+++ b/backend/.sqlx/query-5884ce1906015f6b96231f311226e490d5dfcdd7a94dcbe5d05c9e5af37ac4a4.json
@@ -36,7 +36,8 @@
                 "trigger_nextcloud",
                 "trigger_google",
                 "trigger_github",
-                "data_pipeline"
+                "data_pipeline",
+                "trigger_amqp"
               ]
             }
           }
diff --git a/backend/.sqlx/query-5f2e66e53166840c68efbc521fe9393023e79f948976e6ffc0e9bfc94623393c.json b/backend/.sqlx/query-5f2e66e53166840c68efbc521fe9393023e79f948976e6ffc0e9bfc94623393c.json
new file mode 100644
index 0000000000..2a9c1c119e
--- /dev/null
+++ b/backend/.sqlx/query-5f2e66e53166840c68efbc521fe9393023e79f948976e6ffc0e9bfc94623393c.json
@@ -0,0 +1,27 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n            UPDATE\n                amqp_trigger\n            SET\n                amqp_resource_path = $1,\n                queue_name = $2,\n                exchange = $3,\n                options = $4,\n                is_flow = $5,\n                edited_by = $6,\n                permissioned_as = $7,\n                script_path = $8,\n                path = $9,\n                edited_at = now(),\n                error = NULL,\n                server_id = NULL,\n                error_handler_path = $12,\n                error_handler_args = $13,\n                retry = $14\n            WHERE\n                workspace_id = $10 AND\n                path = $11\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar",
+        "Jsonb",
+        "Jsonb",
+        "Bool",
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Text",
+        "Text",
+        "Varchar",
+        "Jsonb",
+        "Jsonb"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "5f2e66e53166840c68efbc521fe9393023e79f948976e6ffc0e9bfc94623393c"
+}
diff --git a/backend/.sqlx/query-66a0e51cf149ba532463e29dd361a803e1bced2f8e1a12f8933b7598ee85a147.json b/backend/.sqlx/query-66a0e51cf149ba532463e29dd361a803e1bced2f8e1a12f8933b7598ee85a147.json
index 68d9a1fc3b..8870f18d44 100644
--- a/backend/.sqlx/query-66a0e51cf149ba532463e29dd361a803e1bced2f8e1a12f8933b7598ee85a147.json
+++ b/backend/.sqlx/query-66a0e51cf149ba532463e29dd361a803e1bced2f8e1a12f8933b7598ee85a147.json
@@ -38,7 +38,8 @@
                 "nextcloud",
                 "google",
                 "github",
-                "azure"
+                "azure",
+                "amqp"
               ]
             }
           }
diff --git a/backend/.sqlx/query-67e25a7c19ea0ffaf7ea5303fcd04af5a7eb488c76f783e690af0c2153b1d6a8.json b/backend/.sqlx/query-67e25a7c19ea0ffaf7ea5303fcd04af5a7eb488c76f783e690af0c2153b1d6a8.json
index fcc16e9a7c..0eb26d5dc0 100644
--- a/backend/.sqlx/query-67e25a7c19ea0ffaf7ea5303fcd04af5a7eb488c76f783e690af0c2153b1d6a8.json
+++ b/backend/.sqlx/query-67e25a7c19ea0ffaf7ea5303fcd04af5a7eb488c76f783e690af0c2153b1d6a8.json
@@ -162,7 +162,8 @@
                 "github",
                 "azure",
                 "asset",
-                "freshness"
+                "freshness",
+                "amqp"
               ]
             }
           }
diff --git a/backend/.sqlx/query-6b9348e60cc1ce158314a93fc7aa55a9f8fa854b29edcea83710a9170124edf0.json b/backend/.sqlx/query-6b9348e60cc1ce158314a93fc7aa55a9f8fa854b29edcea83710a9170124edf0.json
index 43d3b6d7f6..9dbeab4c76 100644
--- a/backend/.sqlx/query-6b9348e60cc1ce158314a93fc7aa55a9f8fa854b29edcea83710a9170124edf0.json
+++ b/backend/.sqlx/query-6b9348e60cc1ce158314a93fc7aa55a9f8fa854b29edcea83710a9170124edf0.json
@@ -47,7 +47,8 @@
                 "trigger_nextcloud",
                 "trigger_google",
                 "trigger_github",
-                "data_pipeline"
+                "data_pipeline",
+                "trigger_amqp"
               ]
             }
           }
diff --git a/backend/.sqlx/query-7065f23d04e26831664048f2cfc4f412c57af931f80621aee5012e9cb3535626.json b/backend/.sqlx/query-7065f23d04e26831664048f2cfc4f412c57af931f80621aee5012e9cb3535626.json
index 046d8ad6bd..e4eea7fc8f 100644
--- a/backend/.sqlx/query-7065f23d04e26831664048f2cfc4f412c57af931f80621aee5012e9cb3535626.json
+++ b/backend/.sqlx/query-7065f23d04e26831664048f2cfc4f412c57af931f80621aee5012e9cb3535626.json
@@ -32,7 +32,8 @@
                 "nextcloud",
                 "google",
                 "github",
-                "azure"
+                "azure",
+                "amqp"
               ]
             }
           }
diff --git a/backend/.sqlx/query-73fdd01bad58b8be1a52f89faef8d92a983470adcd3cc850734960c905e61e83.json b/backend/.sqlx/query-73fdd01bad58b8be1a52f89faef8d92a983470adcd3cc850734960c905e61e83.json
index 7b7e68ad45..23dd32b094 100644
--- a/backend/.sqlx/query-73fdd01bad58b8be1a52f89faef8d92a983470adcd3cc850734960c905e61e83.json
+++ b/backend/.sqlx/query-73fdd01bad58b8be1a52f89faef8d92a983470adcd3cc850734960c905e61e83.json
@@ -27,7 +27,8 @@
                 "nextcloud",
                 "google",
                 "github",
-                "azure"
+                "azure",
+                "amqp"
               ]
             }
           }
diff --git a/backend/.sqlx/query-7fbf72d9059fcd77e4c1112fa4fa22e4276c1da653475628889ce17dc904fbaa.json b/backend/.sqlx/query-7fbf72d9059fcd77e4c1112fa4fa22e4276c1da653475628889ce17dc904fbaa.json
index cd5e361f15..19264cfdfe 100644
--- a/backend/.sqlx/query-7fbf72d9059fcd77e4c1112fa4fa22e4276c1da653475628889ce17dc904fbaa.json
+++ b/backend/.sqlx/query-7fbf72d9059fcd77e4c1112fa4fa22e4276c1da653475628889ce17dc904fbaa.json
@@ -30,7 +30,8 @@
                 "nextcloud",
                 "google",
                 "github",
-                "azure"
+                "azure",
+                "amqp"
               ]
             }
           }
diff --git a/backend/.sqlx/query-836bac47d89113d90bd03a471446eb9016207975af1e37042d81df8cb6ae2c53.json b/backend/.sqlx/query-836bac47d89113d90bd03a471446eb9016207975af1e37042d81df8cb6ae2c53.json
index 1c0e5a0f1b..c2d9b482b5 100644
--- a/backend/.sqlx/query-836bac47d89113d90bd03a471446eb9016207975af1e37042d81df8cb6ae2c53.json
+++ b/backend/.sqlx/query-836bac47d89113d90bd03a471446eb9016207975af1e37042d81df8cb6ae2c53.json
@@ -27,7 +27,8 @@
                 "nextcloud",
                 "google",
                 "github",
-                "azure"
+                "azure",
+                "amqp"
               ]
             }
           }
diff --git a/backend/.sqlx/query-87564a196a1662f524407d853db506bf08c28efe82b68b3d44bafbd3d0e91c29.json b/backend/.sqlx/query-87564a196a1662f524407d853db506bf08c28efe82b68b3d44bafbd3d0e91c29.json
index 9b3fd8f205..71d71e7843 100644
--- a/backend/.sqlx/query-87564a196a1662f524407d853db506bf08c28efe82b68b3d44bafbd3d0e91c29.json
+++ b/backend/.sqlx/query-87564a196a1662f524407d853db506bf08c28efe82b68b3d44bafbd3d0e91c29.json
@@ -38,7 +38,8 @@
                 "nextcloud",
                 "google",
                 "github",
-                "azure"
+                "azure",
+                "amqp"
               ]
             }
           }
diff --git a/backend/.sqlx/query-8f163ee5adf4caaaa12a5698e68c749524f1db10a51f3de6cadd4826e6c1d422.json b/backend/.sqlx/query-8f163ee5adf4caaaa12a5698e68c749524f1db10a51f3de6cadd4826e6c1d422.json
index 90031c14d6..4e63ce0324 100644
--- a/backend/.sqlx/query-8f163ee5adf4caaaa12a5698e68c749524f1db10a51f3de6cadd4826e6c1d422.json
+++ b/backend/.sqlx/query-8f163ee5adf4caaaa12a5698e68c749524f1db10a51f3de6cadd4826e6c1d422.json
@@ -36,7 +36,8 @@
                 "trigger_nextcloud",
                 "trigger_google",
                 "trigger_github",
-                "data_pipeline"
+                "data_pipeline",
+                "trigger_amqp"
               ]
             }
           }
diff --git a/backend/.sqlx/query-90da952a912de746abee641cc4268644853987e62cbcedc8d3a46626a60c9fb0.json b/backend/.sqlx/query-90da952a912de746abee641cc4268644853987e62cbcedc8d3a46626a60c9fb0.json
new file mode 100644
index 0000000000..a67728cc90
--- /dev/null
+++ b/backend/.sqlx/query-90da952a912de746abee641cc4268644853987e62cbcedc8d3a46626a60c9fb0.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE amqp_trigger SET workspace_id = $1 WHERE workspace_id = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "90da952a912de746abee641cc4268644853987e62cbcedc8d3a46626a60c9fb0"
+}
diff --git a/backend/.sqlx/query-940b6d78bab940a37a42492f030d2393e297043e4e58555d872b5c4dd89c196a.json b/backend/.sqlx/query-940b6d78bab940a37a42492f030d2393e297043e4e58555d872b5c4dd89c196a.json
index c76a069f49..ea5a2946f7 100644
--- a/backend/.sqlx/query-940b6d78bab940a37a42492f030d2393e297043e4e58555d872b5c4dd89c196a.json
+++ b/backend/.sqlx/query-940b6d78bab940a37a42492f030d2393e297043e4e58555d872b5c4dd89c196a.json
@@ -27,7 +27,8 @@
                 "nextcloud",
                 "google",
                 "github",
-                "azure"
+                "azure",
+                "amqp"
               ]
             }
           }
diff --git a/backend/.sqlx/query-9c50e3a136a8ee3ec56e083f26d3a960b89e02ec40b292f3b5198baf2a1d3dbf.json b/backend/.sqlx/query-9c50e3a136a8ee3ec56e083f26d3a960b89e02ec40b292f3b5198baf2a1d3dbf.json
index 87655ad8c1..52590474a3 100644
--- a/backend/.sqlx/query-9c50e3a136a8ee3ec56e083f26d3a960b89e02ec40b292f3b5198baf2a1d3dbf.json
+++ b/backend/.sqlx/query-9c50e3a136a8ee3ec56e083f26d3a960b89e02ec40b292f3b5198baf2a1d3dbf.json
@@ -35,7 +35,8 @@
                 "nextcloud",
                 "google",
                 "github",
-                "azure"
+                "azure",
+                "amqp"
               ]
             }
           }
diff --git a/backend/.sqlx/query-9ecb404e46a4eac55f977f05a3afbafe5dc3cdecc17a3d5a7476b160c1b6e7e1.json b/backend/.sqlx/query-9ecb404e46a4eac55f977f05a3afbafe5dc3cdecc17a3d5a7476b160c1b6e7e1.json
index ab01730c02..fc1e28642b 100644
--- a/backend/.sqlx/query-9ecb404e46a4eac55f977f05a3afbafe5dc3cdecc17a3d5a7476b160c1b6e7e1.json
+++ b/backend/.sqlx/query-9ecb404e46a4eac55f977f05a3afbafe5dc3cdecc17a3d5a7476b160c1b6e7e1.json
@@ -36,7 +36,8 @@
                 "github",
                 "azure",
                 "asset",
-                "freshness"
+                "freshness",
+                "amqp"
               ]
             }
           }
diff --git a/backend/.sqlx/query-a47f7d625a96ad47277609ae173c408eda4323ec12ade20ec0da565051128f26.json b/backend/.sqlx/query-a47f7d625a96ad47277609ae173c408eda4323ec12ade20ec0da565051128f26.json
new file mode 100644
index 0000000000..9361eb51aa
--- /dev/null
+++ b/backend/.sqlx/query-a47f7d625a96ad47277609ae173c408eda4323ec12ade20ec0da565051128f26.json
@@ -0,0 +1,100 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        SELECT\n            EXISTS(SELECT 1 FROM websocket_trigger WHERE workspace_id = $1) AS \"websocket_used!\",\n            EXISTS(SELECT 1 FROM http_trigger WHERE workspace_id = $1) AS \"http_routes_used!\",\n            EXISTS(SELECT 1 FROM kafka_trigger WHERE workspace_id = $1) as \"kafka_used!\",\n            EXISTS(SELECT 1 FROM nats_trigger WHERE workspace_id = $1) as \"nats_used!\",\n            EXISTS(SELECT 1 FROM postgres_trigger WHERE workspace_id = $1) AS \"postgres_used!\",\n            EXISTS(SELECT 1 FROM mqtt_trigger WHERE workspace_id = $1) AS \"mqtt_used!\",\n            EXISTS(SELECT 1 FROM amqp_trigger WHERE workspace_id = $1) AS \"amqp_used!\",\n            EXISTS(SELECT 1 FROM sqs_trigger WHERE workspace_id = $1) AS \"sqs_used!\",\n            EXISTS(SELECT 1 FROM gcp_trigger WHERE workspace_id = $1) AS \"gcp_used!\",\n            EXISTS(SELECT 1 FROM azure_trigger WHERE workspace_id = $1) AS \"azure_used!\",\n            EXISTS(SELECT 1 FROM email_trigger WHERE workspace_id = $1) AS \"email_used!\",\n            EXISTS(SELECT 1 FROM native_trigger WHERE workspace_id = $1 AND service_name = 'nextcloud'::native_trigger_service) AS \"nextcloud_used!\",\n            EXISTS(SELECT 1 FROM native_trigger WHERE workspace_id = $1 AND service_name = 'google'::native_trigger_service) AS \"google_used!\",\n            EXISTS(SELECT 1 FROM native_trigger WHERE workspace_id = $1 AND service_name = 'github'::native_trigger_service) AS \"github_used!\"\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "websocket_used!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 1,
+        "name": "http_routes_used!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 2,
+        "name": "kafka_used!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 3,
+        "name": "nats_used!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 4,
+        "name": "postgres_used!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 5,
+        "name": "mqtt_used!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 6,
+        "name": "amqp_used!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 7,
+        "name": "sqs_used!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 8,
+        "name": "gcp_used!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 9,
+        "name": "azure_used!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 10,
+        "name": "email_used!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 11,
+        "name": "nextcloud_used!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 12,
+        "name": "google_used!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 13,
+        "name": "github_used!",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      null,
+      null,
+      null,
+      null,
+      null,
+      null,
+      null,
+      null,
+      null,
+      null,
+      null,
+      null,
+      null,
+      null
+    ]
+  },
+  "hash": "a47f7d625a96ad47277609ae173c408eda4323ec12ade20ec0da565051128f26"
+}
diff --git a/backend/.sqlx/query-a4b6371d33206010b2f3ffd2b09e33244fe8ab9a803248fc23f334034d24aad4.json b/backend/.sqlx/query-a4b6371d33206010b2f3ffd2b09e33244fe8ab9a803248fc23f334034d24aad4.json
index 405904604a..4824bba526 100644
--- a/backend/.sqlx/query-a4b6371d33206010b2f3ffd2b09e33244fe8ab9a803248fc23f334034d24aad4.json
+++ b/backend/.sqlx/query-a4b6371d33206010b2f3ffd2b09e33244fe8ab9a803248fc23f334034d24aad4.json
@@ -192,7 +192,8 @@
                 "github",
                 "azure",
                 "asset",
-                "freshness"
+                "freshness",
+                "amqp"
               ]
             }
           }
diff --git a/backend/.sqlx/query-b3771b690c5966272b1f42c9965bb6a8f961c119516e4c33dc928cd3b4f4edbc.json b/backend/.sqlx/query-b3771b690c5966272b1f42c9965bb6a8f961c119516e4c33dc928cd3b4f4edbc.json
index 092d15e592..3bbd0f043e 100644
--- a/backend/.sqlx/query-b3771b690c5966272b1f42c9965bb6a8f961c119516e4c33dc928cd3b4f4edbc.json
+++ b/backend/.sqlx/query-b3771b690c5966272b1f42c9965bb6a8f961c119516e4c33dc928cd3b4f4edbc.json
@@ -167,7 +167,8 @@
                 "github",
                 "azure",
                 "asset",
-                "freshness"
+                "freshness",
+                "amqp"
               ]
             }
           }
diff --git a/backend/.sqlx/query-b3f0595cacba194e08b9a3e244d9e637e9e156cd85b69126c87dfff89a47711d.json b/backend/.sqlx/query-b3f0595cacba194e08b9a3e244d9e637e9e156cd85b69126c87dfff89a47711d.json
index 7325a2a313..6efaff7069 100644
--- a/backend/.sqlx/query-b3f0595cacba194e08b9a3e244d9e637e9e156cd85b69126c87dfff89a47711d.json
+++ b/backend/.sqlx/query-b3f0595cacba194e08b9a3e244d9e637e9e156cd85b69126c87dfff89a47711d.json
@@ -27,7 +27,8 @@
                 "nextcloud",
                 "google",
                 "github",
-                "azure"
+                "azure",
+                "amqp"
               ]
             }
           }
diff --git a/backend/.sqlx/query-b6cfb752675a3f36975e6cc6c454267d67f58f9cbff0d164b4df45de885b0e9d.json b/backend/.sqlx/query-b6cfb752675a3f36975e6cc6c454267d67f58f9cbff0d164b4df45de885b0e9d.json
index da7e3d5787..98bcf5a2c2 100644
--- a/backend/.sqlx/query-b6cfb752675a3f36975e6cc6c454267d67f58f9cbff0d164b4df45de885b0e9d.json
+++ b/backend/.sqlx/query-b6cfb752675a3f36975e6cc6c454267d67f58f9cbff0d164b4df45de885b0e9d.json
@@ -47,7 +47,8 @@
                 "trigger_nextcloud",
                 "trigger_google",
                 "trigger_github",
-                "data_pipeline"
+                "data_pipeline",
+                "trigger_amqp"
               ]
             }
           }
diff --git a/backend/.sqlx/query-bcfa34cf80abea05f0c24883b9e77429c51e6166c414bcc5ce2e97fac25bcd77.json b/backend/.sqlx/query-bcfa34cf80abea05f0c24883b9e77429c51e6166c414bcc5ce2e97fac25bcd77.json
index 419ab26383..fb35992691 100644
--- a/backend/.sqlx/query-bcfa34cf80abea05f0c24883b9e77429c51e6166c414bcc5ce2e97fac25bcd77.json
+++ b/backend/.sqlx/query-bcfa34cf80abea05f0c24883b9e77429c51e6166c414bcc5ce2e97fac25bcd77.json
@@ -81,7 +81,8 @@
                 "github",
                 "azure",
                 "asset",
-                "freshness"
+                "freshness",
+                "amqp"
               ]
             }
           }
diff --git a/backend/.sqlx/query-be6d2c92a62b7b284651c45af809746147aa9b8d0a81642a7b7cb4738a0cad66.json b/backend/.sqlx/query-be6d2c92a62b7b284651c45af809746147aa9b8d0a81642a7b7cb4738a0cad66.json
index b9d33a6b5f..809deb1a55 100644
--- a/backend/.sqlx/query-be6d2c92a62b7b284651c45af809746147aa9b8d0a81642a7b7cb4738a0cad66.json
+++ b/backend/.sqlx/query-be6d2c92a62b7b284651c45af809746147aa9b8d0a81642a7b7cb4738a0cad66.json
@@ -112,7 +112,8 @@
                 "github",
                 "azure",
                 "asset",
-                "freshness"
+                "freshness",
+                "amqp"
               ]
             }
           }
diff --git a/backend/.sqlx/query-c3b1152b554812d65eb27f95b1fd434f860922fbc021185beffb9827647feb8e.json b/backend/.sqlx/query-c3b1152b554812d65eb27f95b1fd434f860922fbc021185beffb9827647feb8e.json
index 8a6ab29126..2bc2bdf950 100644
--- a/backend/.sqlx/query-c3b1152b554812d65eb27f95b1fd434f860922fbc021185beffb9827647feb8e.json
+++ b/backend/.sqlx/query-c3b1152b554812d65eb27f95b1fd434f860922fbc021185beffb9827647feb8e.json
@@ -34,7 +34,8 @@
                 "nextcloud",
                 "google",
                 "github",
-                "azure"
+                "azure",
+                "amqp"
               ]
             }
           }
diff --git a/backend/.sqlx/query-c8fb2a1491f90951a6d2e4e9c56d288eb60f6c6644a73cdf949de0159215a7f7.json b/backend/.sqlx/query-c8fb2a1491f90951a6d2e4e9c56d288eb60f6c6644a73cdf949de0159215a7f7.json
index 161b9d36f9..52830d5c73 100644
--- a/backend/.sqlx/query-c8fb2a1491f90951a6d2e4e9c56d288eb60f6c6644a73cdf949de0159215a7f7.json
+++ b/backend/.sqlx/query-c8fb2a1491f90951a6d2e4e9c56d288eb60f6c6644a73cdf949de0159215a7f7.json
@@ -43,7 +43,8 @@
                 "trigger_nextcloud",
                 "trigger_google",
                 "trigger_github",
-                "data_pipeline"
+                "data_pipeline",
+                "trigger_amqp"
               ]
             }
           }
diff --git a/backend/.sqlx/query-ccef7a1bde5cac6c362c5fedb6c13f1f882b695f896f94e5cf91d205633355a1.json b/backend/.sqlx/query-ccef7a1bde5cac6c362c5fedb6c13f1f882b695f896f94e5cf91d205633355a1.json
index f567c462f8..0cf9c77f62 100644
--- a/backend/.sqlx/query-ccef7a1bde5cac6c362c5fedb6c13f1f882b695f896f94e5cf91d205633355a1.json
+++ b/backend/.sqlx/query-ccef7a1bde5cac6c362c5fedb6c13f1f882b695f896f94e5cf91d205633355a1.json
@@ -27,7 +27,8 @@
                 "nextcloud",
                 "google",
                 "github",
-                "azure"
+                "azure",
+                "amqp"
               ]
             }
           }
diff --git a/backend/.sqlx/query-d41ea93fd58381b89e151c965eae1ea2fe96a1b94f5a92953fb1c1642d15c016.json b/backend/.sqlx/query-d41ea93fd58381b89e151c965eae1ea2fe96a1b94f5a92953fb1c1642d15c016.json
index d97c02d26b..2660ca05ef 100644
--- a/backend/.sqlx/query-d41ea93fd58381b89e151c965eae1ea2fe96a1b94f5a92953fb1c1642d15c016.json
+++ b/backend/.sqlx/query-d41ea93fd58381b89e151c965eae1ea2fe96a1b94f5a92953fb1c1642d15c016.json
@@ -112,7 +112,8 @@
                 "github",
                 "azure",
                 "asset",
-                "freshness"
+                "freshness",
+                "amqp"
               ]
             }
           }
diff --git a/backend/.sqlx/query-d4211392e174a0e8f89c7fcebdf120e5b0f629f9f04e08a2982df33ff23ac7a9.json b/backend/.sqlx/query-d4211392e174a0e8f89c7fcebdf120e5b0f629f9f04e08a2982df33ff23ac7a9.json
index 052d83fcd9..0bd066afd1 100644
--- a/backend/.sqlx/query-d4211392e174a0e8f89c7fcebdf120e5b0f629f9f04e08a2982df33ff23ac7a9.json
+++ b/backend/.sqlx/query-d4211392e174a0e8f89c7fcebdf120e5b0f629f9f04e08a2982df33ff23ac7a9.json
@@ -252,7 +252,8 @@
                 "github",
                 "azure",
                 "asset",
-                "freshness"
+                "freshness",
+                "amqp"
               ]
             }
           }
diff --git a/backend/.sqlx/query-d495c94b580fd34d5ae90615ef21a8a9cc35f362197c0766a5787436af141106.json b/backend/.sqlx/query-d495c94b580fd34d5ae90615ef21a8a9cc35f362197c0766a5787436af141106.json
index eb340e6cc7..049856cbde 100644
--- a/backend/.sqlx/query-d495c94b580fd34d5ae90615ef21a8a9cc35f362197c0766a5787436af141106.json
+++ b/backend/.sqlx/query-d495c94b580fd34d5ae90615ef21a8a9cc35f362197c0766a5787436af141106.json
@@ -28,7 +28,8 @@
                 "nextcloud",
                 "google",
                 "github",
-                "azure"
+                "azure",
+                "amqp"
               ]
             }
           }
diff --git a/backend/.sqlx/query-d4e0da9f9653d532770066310f85e59e5edda1faea72f39603814afb6a3cd596.json b/backend/.sqlx/query-d4e0da9f9653d532770066310f85e59e5edda1faea72f39603814afb6a3cd596.json
index e60f5cc187..317f33de07 100644
--- a/backend/.sqlx/query-d4e0da9f9653d532770066310f85e59e5edda1faea72f39603814afb6a3cd596.json
+++ b/backend/.sqlx/query-d4e0da9f9653d532770066310f85e59e5edda1faea72f39603814afb6a3cd596.json
@@ -48,7 +48,8 @@
                 "trigger_nextcloud",
                 "trigger_google",
                 "trigger_github",
-                "data_pipeline"
+                "data_pipeline",
+                "trigger_amqp"
               ]
             }
           }
diff --git a/backend/.sqlx/query-d9d997591a163f25a9be5134bffacd0068c51ca21018d6751cc1044e38c06730.json b/backend/.sqlx/query-d9d997591a163f25a9be5134bffacd0068c51ca21018d6751cc1044e38c06730.json
new file mode 100644
index 0000000000..d5e5970903
--- /dev/null
+++ b/backend/.sqlx/query-d9d997591a163f25a9be5134bffacd0068c51ca21018d6751cc1044e38c06730.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO amqp_trigger (\n            amqp_resource_path, queue_name, exchange, options, path, script_path, is_flow,\n            workspace_id, edited_by, edited_at, extra_perms, server_id, last_server_ping,\n            error, error_handler_path, error_handler_args, retry, mode, permissioned_as, labels\n        )\n        SELECT\n            amqp_resource_path, queue_name, exchange, options, path, script_path, is_flow,\n            $1, edited_by, edited_at, extra_perms, NULL, NULL,\n            NULL, error_handler_path, error_handler_args, retry, 'disabled'::TRIGGER_MODE, permissioned_as, labels\n        FROM amqp_trigger WHERE workspace_id = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "d9d997591a163f25a9be5134bffacd0068c51ca21018d6751cc1044e38c06730"
+}
diff --git a/backend/.sqlx/query-e4d71278fb80126a7a9da73f1889352d4d1e3cb3a8a08f1c9c03055a1cab1235.json b/backend/.sqlx/query-e4d71278fb80126a7a9da73f1889352d4d1e3cb3a8a08f1c9c03055a1cab1235.json
index a35373a959..ad34773e36 100644
--- a/backend/.sqlx/query-e4d71278fb80126a7a9da73f1889352d4d1e3cb3a8a08f1c9c03055a1cab1235.json
+++ b/backend/.sqlx/query-e4d71278fb80126a7a9da73f1889352d4d1e3cb3a8a08f1c9c03055a1cab1235.json
@@ -192,7 +192,8 @@
                 "github",
                 "azure",
                 "asset",
-                "freshness"
+                "freshness",
+                "amqp"
               ]
             }
           }
diff --git a/backend/.sqlx/query-e80177f3ffd4c1f52cdb4757483f03f72ef81db302d727e18e63a307ac902022.json b/backend/.sqlx/query-e80177f3ffd4c1f52cdb4757483f03f72ef81db302d727e18e63a307ac902022.json
index 3f403a8f95..cb0b92a822 100644
--- a/backend/.sqlx/query-e80177f3ffd4c1f52cdb4757483f03f72ef81db302d727e18e63a307ac902022.json
+++ b/backend/.sqlx/query-e80177f3ffd4c1f52cdb4757483f03f72ef81db302d727e18e63a307ac902022.json
@@ -34,7 +34,8 @@
                 "nextcloud",
                 "google",
                 "github",
-                "azure"
+                "azure",
+                "amqp"
               ]
             }
           }
diff --git a/backend/.sqlx/query-eac595e19e5c8e70f1514ef29dec35c7342ac9a814c73f6290e1d6ebd3a55423.json b/backend/.sqlx/query-eac595e19e5c8e70f1514ef29dec35c7342ac9a814c73f6290e1d6ebd3a55423.json
index b48f144f8e..461b7fc037 100644
--- a/backend/.sqlx/query-eac595e19e5c8e70f1514ef29dec35c7342ac9a814c73f6290e1d6ebd3a55423.json
+++ b/backend/.sqlx/query-eac595e19e5c8e70f1514ef29dec35c7342ac9a814c73f6290e1d6ebd3a55423.json
@@ -27,7 +27,8 @@
                 "nextcloud",
                 "google",
                 "github",
-                "azure"
+                "azure",
+                "amqp"
               ]
             }
           }
diff --git a/backend/.sqlx/query-ed8facbf29ebb670d05fe8aa34b50d6a6935420fbedc83aa3ad1e9be7465c8dd.json b/backend/.sqlx/query-ed8facbf29ebb670d05fe8aa34b50d6a6935420fbedc83aa3ad1e9be7465c8dd.json
index c28997d702..902a07854d 100644
--- a/backend/.sqlx/query-ed8facbf29ebb670d05fe8aa34b50d6a6935420fbedc83aa3ad1e9be7465c8dd.json
+++ b/backend/.sqlx/query-ed8facbf29ebb670d05fe8aa34b50d6a6935420fbedc83aa3ad1e9be7465c8dd.json
@@ -27,7 +27,8 @@
                 "nextcloud",
                 "google",
                 "github",
-                "azure"
+                "azure",
+                "amqp"
               ]
             }
           }
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index 0bed7274d7..84014f30e9 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -128,6 +128,54 @@ version = "0.2.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
 
+[[package]]
+name = "amq-protocol"
+version = "7.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "587d313f3a8b4a40f866cc84b6059fe83133bf172165ac3b583129dd211d8e1c"
+dependencies = [
+ "amq-protocol-tcp",
+ "amq-protocol-types",
+ "amq-protocol-uri",
+ "cookie-factory",
+ "nom",
+ "serde",
+]
+
+[[package]]
+name = "amq-protocol-tcp"
+version = "7.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc707ab9aa964a85d9fc25908a3fdc486d2e619406883b3105b48bf304a8d606"
+dependencies = [
+ "amq-protocol-uri",
+ "tcp-stream",
+ "tracing",
+]
+
+[[package]]
+name = "amq-protocol-types"
+version = "7.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf99351d92a161c61ec6ecb213bc7057f5b837dd4e64ba6cb6491358efd770c4"
+dependencies = [
+ "cookie-factory",
+ "nom",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "amq-protocol-uri"
+version = "7.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f89f8273826a676282208e5af38461a07fe939def57396af6ad5997fcf56577d"
+dependencies = [
+ "amq-protocol-types",
+ "percent-encoding",
+ "url",
+]
+
 [[package]]
 name = "android_system_properties"
 version = "0.1.5"
@@ -472,7 +520,7 @@ version = "0.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5493c3bedbacf7fd7382c6346bbd66687d12bbaad3a89a2d2c303ee6cf20b048"
 dependencies = [
- "asn1-rs-derive",
+ "asn1-rs-derive 0.5.1",
  "asn1-rs-impl",
  "displaydoc",
  "nom",
@@ -482,6 +530,22 @@ dependencies = [
  "time",
 ]
 
+[[package]]
+name = "asn1-rs"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7f43a50ac4fdca5df8e885c21b835997f0a1cdee65494a6847694a98652d9d8"
+dependencies = [
+ "asn1-rs-derive 0.6.0",
+ "asn1-rs-impl",
+ "displaydoc",
+ "nom",
+ "num-traits",
+ "rusticata-macros",
+ "thiserror 2.0.19",
+ "time",
+]
+
 [[package]]
 name = "asn1-rs-derive"
 version = "0.5.1"
@@ -494,6 +558,18 @@ dependencies = [
  "synstructure",
 ]
 
+[[package]]
+name = "asn1-rs-derive"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3109e49b1e4909e9db6515a30c633684d68cdeaa252f215214cb4fa1a5bfee2c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "synstructure",
+]
+
 [[package]]
 name = "asn1-rs-impl"
 version = "0.2.0"
@@ -555,6 +631,18 @@ dependencies = [
  "futures-core",
 ]
 
+[[package]]
+name = "async-channel"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "924ed96dd52d1b75e9c1a3e6275715fd320f5f9439fb5a4a11fa51f4221158d2"
+dependencies = [
+ "concurrent-queue",
+ "event-listener-strategy",
+ "futures-core",
+ "pin-project-lite",
+]
+
 [[package]]
 name = "async-compression"
 version = "0.4.19"
@@ -574,6 +662,92 @@ dependencies = [
  "zstd-safe",
 ]
 
+[[package]]
+name = "async-executor"
+version = "1.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c96bf972d85afc50bf5ab8fe2d54d1586b4e0b46c97c50a0c9e71e2f7bcd812a"
+dependencies = [
+ "async-task",
+ "concurrent-queue",
+ "fastrand 2.5.0",
+ "futures-lite 2.6.1",
+ "pin-project-lite",
+ "slab",
+]
+
+[[package]]
+name = "async-global-executor"
+version = "3.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13f937e26114b93193065fd44f507aa2e9169ad0cdabbb996920b1fe1ddea7ba"
+dependencies = [
+ "async-channel 2.5.0",
+ "async-executor",
+ "async-io 2.6.0",
+ "async-lock 3.4.2",
+ "blocking",
+ "futures-lite 2.6.1",
+]
+
+[[package]]
+name = "async-global-executor-trait"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9af57045d58eeb1f7060e7025a1631cbc6399e0a1d10ad6735b3d0ea7f8346ce"
+dependencies = [
+ "async-global-executor",
+ "async-trait",
+ "executor-trait",
+]
+
+[[package]]
+name = "async-io"
+version = "1.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fc5b45d93ef0529756f812ca52e44c221b35341892d3dcc34132ac02f3dd2af"
+dependencies = [
+ "async-lock 2.8.0",
+ "autocfg",
+ "cfg-if",
+ "concurrent-queue",
+ "futures-lite 1.13.0",
+ "log",
+ "parking",
+ "polling 2.8.0",
+ "rustix 0.37.28",
+ "slab",
+ "socket2 0.4.10",
+ "waker-fn",
+]
+
+[[package]]
+name = "async-io"
+version = "2.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "456b8a8feb6f42d237746d4b3e9a178494627745c3c56c6ea55d92ba50d026fc"
+dependencies = [
+ "autocfg",
+ "cfg-if",
+ "concurrent-queue",
+ "futures-io",
+ "futures-lite 2.6.1",
+ "parking",
+ "polling 3.11.0",
+ "rustix 1.1.4",
+ "slab",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "async-lock"
+version = "2.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "287272293e9d8c41773cec55e365490fe034813a2f172f502d6ddcf75b2f582b"
+dependencies = [
+ "event-listener 2.5.3",
+]
+
 [[package]]
 name = "async-lock"
 version = "3.4.2"
@@ -646,6 +820,18 @@ version = "0.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4288f83726785267c6f2ef073a3d83dc3f9b81464e9f99898240cced85fce35a"
 
+[[package]]
+name = "async-reactor-trait"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a6012d170ad00de56c9ee354aef2e358359deb1ec504254e0e5a3774771de0e"
+dependencies = [
+ "async-io 1.13.0",
+ "async-trait",
+ "futures-core",
+ "reactor-trait",
+]
+
 [[package]]
 name = "async-recursion"
 version = "1.1.1"
@@ -679,6 +865,12 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "async-task"
+version = "4.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b75356056920673b02621b35afd0f7dda9306d03c79a30f5c56c44cf256e3de"
+
 [[package]]
 name = "async-trait"
 version = "0.1.91"
@@ -699,7 +891,7 @@ dependencies = [
  "async-compression",
  "chrono",
  "crc32fast",
- "futures-lite",
+ "futures-lite 2.6.1",
  "pin-project",
  "thiserror 1.0.69",
  "tokio",
@@ -759,7 +951,7 @@ dependencies = [
  "aws-smithy-types",
  "aws-types",
  "bytes",
- "fastrand",
+ "fastrand 2.5.0",
  "hex",
  "http 1.4.2",
  "ring 0.17.14",
@@ -823,7 +1015,7 @@ dependencies = [
  "aws-types",
  "bytes",
  "bytes-utils",
- "fastrand",
+ "fastrand 2.5.0",
  "http 1.4.2",
  "http-body 1.1.0",
  "percent-encoding",
@@ -849,7 +1041,7 @@ dependencies = [
  "aws-smithy-types",
  "aws-types",
  "bytes",
- "fastrand",
+ "fastrand 2.5.0",
  "http 0.2.12",
  "http 1.4.2",
  "regex-lite",
@@ -875,7 +1067,7 @@ dependencies = [
  "aws-smithy-types",
  "aws-types",
  "bytes",
- "fastrand",
+ "fastrand 2.5.0",
  "http 0.2.12",
  "hyper 0.14.32",
  "regex-lite",
@@ -898,7 +1090,7 @@ dependencies = [
  "aws-smithy-types",
  "aws-types",
  "bytes",
- "fastrand",
+ "fastrand 2.5.0",
  "http 0.2.12",
  "once_cell",
  "regex-lite",
@@ -924,7 +1116,7 @@ dependencies = [
  "aws-smithy-types",
  "aws-smithy-xml",
  "aws-types",
- "fastrand",
+ "fastrand 2.5.0",
  "http 0.2.12",
  "http 1.4.2",
  "regex-lite",
@@ -949,7 +1141,7 @@ dependencies = [
  "aws-smithy-types",
  "aws-types",
  "bytes",
- "fastrand",
+ "fastrand 2.5.0",
  "http 0.2.12",
  "http 1.4.2",
  "regex-lite",
@@ -972,7 +1164,7 @@ dependencies = [
  "aws-smithy-types",
  "aws-types",
  "bytes",
- "fastrand",
+ "fastrand 2.5.0",
  "http 0.2.12",
  "regex-lite",
  "tracing",
@@ -995,7 +1187,7 @@ dependencies = [
  "aws-smithy-types",
  "aws-types",
  "bytes",
- "fastrand",
+ "fastrand 2.5.0",
  "http 0.2.12",
  "http 1.4.2",
  "regex-lite",
@@ -1019,7 +1211,7 @@ dependencies = [
  "aws-smithy-types",
  "aws-types",
  "bytes",
- "fastrand",
+ "fastrand 2.5.0",
  "http 0.2.12",
  "http 1.4.2",
  "regex-lite",
@@ -1043,7 +1235,7 @@ dependencies = [
  "aws-smithy-types",
  "aws-smithy-xml",
  "aws-types",
- "fastrand",
+ "fastrand 2.5.0",
  "http 0.2.12",
  "regex-lite",
  "tracing",
@@ -1217,7 +1409,7 @@ dependencies = [
  "aws-smithy-runtime-api",
  "aws-smithy-types",
  "bytes",
- "fastrand",
+ "fastrand 2.5.0",
  "http 0.2.12",
  "http 1.4.2",
  "http-body 0.4.6",
@@ -1429,7 +1621,7 @@ version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cffb0e931875b666fc4fcb20fee52e9bbd1ef836fd9e9e04ec21555f9f85f7ef"
 dependencies = [
- "fastrand",
+ "fastrand 2.5.0",
  "gloo-timers",
  "tokio",
 ]
@@ -1690,6 +1882,19 @@ dependencies = [
  "generic-array",
 ]
 
+[[package]]
+name = "blocking"
+version = "1.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e83f8d02be6967315521be875afa792a316e28d57b5a2d401897e2a7921b7f21"
+dependencies = [
+ "async-channel 2.5.0",
+ "async-task",
+ "futures-io",
+ "futures-lite 2.6.1",
+ "piper",
+]
+
 [[package]]
 name = "bollard"
 version = "0.18.1"
@@ -2252,6 +2457,18 @@ dependencies = [
  "cc",
 ]
 
+[[package]]
+name = "cms"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b77c319abfd5219629c45c34c89ba945ed3c5e49fcde9d16b6c3885f118a730"
+dependencies = [
+ "const-oid",
+ "der",
+ "spki",
+ "x509-cert",
+]
+
 [[package]]
 name = "colorchoice"
 version = "1.0.5"
@@ -2419,6 +2636,12 @@ dependencies = [
  "version_check",
 ]
 
+[[package]]
+name = "cookie-factory"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9885fa71e26b8ab7855e2ec7cae6e9b380edff76cd052e07c683a0319d51b3a2"
+
 [[package]]
 name = "core-foundation"
 version = "0.9.4"
@@ -3854,7 +4077,7 @@ version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7bc6b10059f0ccb14c6e0319c5275f0407fb2f9ffe405cd555700561999ea4bf"
 dependencies = [
- "fastrand",
+ "fastrand 2.5.0",
  "futures-channel",
  "libc",
  "windows-sys 0.59.0",
@@ -3975,6 +4198,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
 dependencies = [
  "const-oid",
+ "der_derive",
+ "flagset",
  "pem-rfc7468",
  "zeroize",
 ]
@@ -3985,7 +4210,7 @@ version = "9.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5cd0a5c643689626bec213c4d8bd4d96acc8ffdb4ad4bb6bc16abf27d5f4b553"
 dependencies = [
- "asn1-rs",
+ "asn1-rs 0.6.2",
  "displaydoc",
  "nom",
  "num-bigint",
@@ -3993,6 +4218,31 @@ dependencies = [
  "rusticata-macros",
 ]
 
+[[package]]
+name = "der-parser"
+version = "10.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07da5016415d5a3c4dd39b11ed26f915f52fc4e0dc197d87908bc916e51bc1a6"
+dependencies = [
+ "asn1-rs 0.7.2",
+ "displaydoc",
+ "nom",
+ "num-bigint",
+ "num-traits",
+ "rusticata-macros",
+]
+
+[[package]]
+name = "der_derive"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8034092389675178f570469e6c3b0465d3d30b4505c294a6550db47f3c17ad18"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "deranged"
 version = "0.5.8"
@@ -4117,6 +4367,15 @@ dependencies = [
  "opaque-debug",
 ]
 
+[[package]]
+name = "des"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ffdd80ce8ce993de27e9f063a444a4d53ce8e8db4c1f00cc03af5ad5a9867a1e"
+dependencies = [
+ "cipher 0.4.4",
+]
+
 [[package]]
 name = "digest"
 version = "0.9.0"
@@ -4255,6 +4514,12 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "doc-comment"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "780955b8b195a21ab8e4ac6b60dd1dbdcec1dc6c51c0617964b08c81785e12c9"
+
 [[package]]
 name = "dotenv"
 version = "0.15.0"
@@ -4584,6 +4849,15 @@ dependencies = [
  "pin-project-lite",
 ]
 
+[[package]]
+name = "executor-trait"
+version = "2.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c39dff9342e4e0e16ce96be751eb21a94e94a87bb2f6e63ad1961c2ce109bf"
+dependencies = [
+ "async-trait",
+]
+
 [[package]]
 name = "fallible-iterator"
 version = "0.2.0"
@@ -4618,6 +4892,15 @@ version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9afc2bd4d5a73106dd53d10d73d3401c2f32730ba2c0b93ddb888a8983680471"
 
+[[package]]
+name = "fastrand"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e51093e27b0797c359783294ca4f0a911c270184cb10f85783b118614a1501be"
+dependencies = [
+ "instant",
+]
+
 [[package]]
 name = "fastrand"
 version = "2.5.0"
@@ -4668,6 +4951,12 @@ version = "0.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1d674e81391d1e1ab681a28d99df07927c6d4aa5b027d7da16ba32d1d21ecd99"
 
+[[package]]
+name = "flagset"
+version = "0.4.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7ac824320a75a52197e8f2d787f6a38b6718bb6897a35142d749af3c0e8f4fe"
+
 [[package]]
 name = "flatbuffers"
 version = "25.12.19"
@@ -4874,13 +5163,28 @@ version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4577ecaa3c4f96589d473f679a71b596316f6641bc350038b962a5daf0085d7a"
 
+[[package]]
+name = "futures-lite"
+version = "1.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49a9d51ce47660b1e808d3c990b4709f2f415d928835a17dfd16991515c46bce"
+dependencies = [
+ "fastrand 1.9.0",
+ "futures-core",
+ "futures-io",
+ "memchr",
+ "parking",
+ "pin-project-lite",
+ "waker-fn",
+]
+
 [[package]]
 name = "futures-lite"
 version = "2.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f78e10609fe0e0b3f4157ffab1876319b5b0db102a2c60dc4626306dc46b44ad"
 dependencies = [
- "fastrand",
+ "fastrand 2.5.0",
  "futures-core",
  "futures-io",
  "parking",
@@ -5301,7 +5605,7 @@ version = "0.30.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bebc6e7327e49a66ffb40508c673b7643191bd6b509530193bda97f09272cdcf"
 dependencies = [
- "async-channel",
+ "async-channel 1.9.0",
  "async-stream",
  "google-cloud-auth",
  "google-cloud-gax",
@@ -5513,6 +5817,12 @@ version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
 
+[[package]]
+name = "hermit-abi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d231dfb89cfffdbc30e7fc41579ed6066ad03abda9e567ccafae602b97ec5024"
+
 [[package]]
 name = "hermit-abi"
 version = "0.5.2"
@@ -6157,6 +6467,15 @@ dependencies = [
  "generic-array",
 ]
 
+[[package]]
+name = "instant"
+version = "0.1.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e0242819d153cba4b4b05a5a8f2a7e9bbf97b6055b2a002b395c96b5ff3c0222"
+dependencies = [
+ "cfg-if",
+]
+
 [[package]]
 name = "integer-encoding"
 version = "3.0.4"
@@ -6172,6 +6491,17 @@ dependencies = [
  "rustversion",
 ]
 
+[[package]]
+name = "io-lifetimes"
+version = "1.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eae7b9aee968036d54dce06cebaefd919e4472e753296daccd6d344e3e2df0c2"
+dependencies = [
+ "hermit-abi 0.3.9",
+ "libc",
+ "windows-sys 0.48.0",
+]
+
 [[package]]
 name = "io-uring"
 version = "0.7.13"
@@ -6577,6 +6907,28 @@ version = "0.20.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "507460a910eb7b32ee961886ff48539633b788a36b65692b95f225b844c82553"
 
+[[package]]
+name = "lapin"
+version = "2.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02d2aa4725b9607915fa1a73e940710a3be6af508ce700e56897cbe8847fbb07"
+dependencies = [
+ "amq-protocol",
+ "async-global-executor-trait",
+ "async-reactor-trait",
+ "async-trait",
+ "executor-trait",
+ "flume",
+ "futures-core",
+ "futures-io",
+ "parking_lot",
+ "pinky-swear",
+ "reactor-trait",
+ "serde",
+ "tracing",
+ "waker-fn",
+]
+
 [[package]]
 name = "lazy_static"
 version = "1.5.0"
@@ -6774,6 +7126,12 @@ version = "0.5.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0717cef1bc8b636c6e1c1bbdefc09e6322da8a9321966e8928ef80d20f7f770f"
 
+[[package]]
+name = "linux-raw-sys"
+version = "0.3.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef53942eb7bf7ff43a617b3e2c1c4a5ecf5944a7c1bc12d7ee39bbb15e5c1519"
+
 [[package]]
 name = "linux-raw-sys"
 version = "0.4.15"
@@ -6932,7 +7290,7 @@ dependencies = [
  "base64 0.21.7",
  "block-modes",
  "crc-any",
- "des",
+ "des 0.7.0",
  "digest 0.9.0",
  "md-5 0.9.1",
  "sha2 0.9.9",
@@ -7238,7 +7596,7 @@ version = "0.12.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "957228ad12042ee839f93c8f257b62b4c0ab5eaae1d4fa60de53b27c9d7c5046"
 dependencies = [
- "async-lock",
+ "async-lock 3.4.2",
  "crossbeam-channel",
  "crossbeam-epoch",
  "crossbeam-utils",
@@ -7749,7 +8107,7 @@ version = "1.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "91df4bbde75afed763b708b7eee1e8e7651e02d97f6d5dd763e89367e957b23b"
 dependencies = [
- "hermit-abi",
+ "hermit-abi 0.5.2",
  "libc",
 ]
 
@@ -7862,7 +8220,16 @@ version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a8d8034d9489cdaf79228eb9f6a3b8d7bb32ba00d6645ebd48eef4077ceb5bd9"
 dependencies = [
- "asn1-rs",
+ "asn1-rs 0.6.2",
+]
+
+[[package]]
+name = "oid-registry"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12f40cff3dde1b6087cc5d5f5d4d65712f34016a03ed60e9c08dcc392736b5b7"
+dependencies = [
+ "asn1-rs 0.7.2",
 ]
 
 [[package]]
@@ -8273,6 +8640,28 @@ version = "4.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d211803b9b6b570f68772237e415a029d5a50c65d382910b879fb19d3271f94d"
 
+[[package]]
+name = "p12-keystore"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3cae83056e7cb770211494a0ecf66d9fa7eba7d00977e5bb91f0e925b40b937f"
+dependencies = [
+ "cbc",
+ "cms",
+ "der",
+ "des 0.8.1",
+ "hex",
+ "hmac",
+ "pkcs12",
+ "pkcs5",
+ "rand 0.9.0",
+ "rc2",
+ "sha1",
+ "sha2 0.10.9",
+ "thiserror 2.0.19",
+ "x509-parser 0.17.0",
+]
+
 [[package]]
 name = "p256"
 version = "0.13.2"
@@ -8414,6 +8803,16 @@ version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "df94ce210e5bc13cb6651479fa48d14f601d9858cfe0467f43ae157023b938d3"
 
+[[package]]
+name = "pbkdf2"
+version = "0.12.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8ed6a7761f76e3b9f92dfb0a60a6a6477c61024b775147ff0973a02653abaf2"
+dependencies = [
+ "digest 0.10.7",
+ "hmac",
+]
+
 [[package]]
 name = "pem"
 version = "1.1.1"
@@ -8654,6 +9053,29 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
 
+[[package]]
+name = "pinky-swear"
+version = "6.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1ea6e230dd3a64d61bcb8b79e597d3ab6b4c94ec7a234ce687dd718b4f2e657"
+dependencies = [
+ "doc-comment",
+ "flume",
+ "parking_lot",
+ "tracing",
+]
+
+[[package]]
+name = "piper"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c835479a4443ded371d6c535cbfd8d31ad92c5d23ae9770a61bc155e4992a3c1"
+dependencies = [
+ "atomic-waker",
+ "fastrand 2.5.0",
+ "futures-io",
+]
+
 [[package]]
 name = "pkcs1"
 version = "0.7.5"
@@ -8665,6 +9087,36 @@ dependencies = [
  "spki",
 ]
 
+[[package]]
+name = "pkcs12"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "695b3df3d3cc1015f12d70235e35b6b79befc5fa7a9b95b951eab1dd07c9efc2"
+dependencies = [
+ "cms",
+ "const-oid",
+ "der",
+ "digest 0.10.7",
+ "spki",
+ "x509-cert",
+ "zeroize",
+]
+
+[[package]]
+name = "pkcs5"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e847e2c91a18bfa887dd028ec33f2fe6f25db77db3619024764914affe8b69a6"
+dependencies = [
+ "aes 0.8.3",
+ "cbc",
+ "der",
+ "pbkdf2",
+ "scrypt",
+ "sha2 0.10.9",
+ "spki",
+]
+
 [[package]]
 name = "pkcs8"
 version = "0.10.2"
@@ -8687,6 +9139,36 @@ version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
 
+[[package]]
+name = "polling"
+version = "2.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4b2d323e8ca7996b3e23126511a523f7e62924d93ecd5ae73b333815b0eb3dce"
+dependencies = [
+ "autocfg",
+ "bitflags 1.3.2",
+ "cfg-if",
+ "concurrent-queue",
+ "libc",
+ "log",
+ "pin-project-lite",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "polling"
+version = "3.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d0e4f59085d47d8241c88ead0f274e8a0cb551f3625263c05eb8dd897c34218"
+dependencies = [
+ "cfg-if",
+ "concurrent-queue",
+ "hermit-abi 0.5.2",
+ "pin-project-lite",
+ "rustix 1.1.4",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "polyval"
 version = "0.6.2"
@@ -9334,6 +9816,15 @@ dependencies = [
  "crossbeam-utils",
 ]
 
+[[package]]
+name = "rc2"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62c64daa8e9438b84aaae55010a93f396f8e60e3911590fcba770d04643fc1dd"
+dependencies = [
+ "cipher 0.4.4",
+]
+
 [[package]]
 name = "rcgen"
 version = "0.13.2"
@@ -9344,7 +9835,7 @@ dependencies = [
  "ring 0.17.14",
  "rustls-pki-types",
  "time",
- "x509-parser",
+ "x509-parser 0.16.0",
  "yasna",
 ]
 
@@ -9382,6 +9873,17 @@ dependencies = [
  "sasl2-sys",
 ]
 
+[[package]]
+name = "reactor-trait"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "438a4293e4d097556730f4711998189416232f009c137389e0f961d2bc0ddc58"
+dependencies = [
+ "async-trait",
+ "futures-core",
+ "futures-io",
+]
+
 [[package]]
 name = "reborrow"
 version = "0.5.5"
@@ -9804,7 +10306,7 @@ version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b8bf7840285c321c3ab20e752a9afb95548c75cd7f4632a0627cea3507e310c1"
 dependencies = [
- "async-lock",
+ "async-lock 3.4.2",
  "hashbrown 0.16.1",
  "relative-path",
  "rquickjs-sys",
@@ -9984,6 +10486,20 @@ dependencies = [
  "nom",
 ]
 
+[[package]]
+name = "rustix"
+version = "0.37.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "519165d378b97752ca44bbe15047d5d3409e875f39327546b42ac81d7e18c1b6"
+dependencies = [
+ "bitflags 1.3.2",
+ "errno",
+ "io-lifetimes",
+ "libc",
+ "linux-raw-sys 0.3.8",
+ "windows-sys 0.48.0",
+]
+
 [[package]]
 name = "rustix"
 version = "0.38.44"
@@ -10052,6 +10568,19 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "rustls-connector"
+version = "0.20.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70cc376c6ba1823ae229bacf8ad93c136d93524eab0e4e5e0e4f96b9c4e5b212"
+dependencies = [
+ "log",
+ "rustls 0.23.35",
+ "rustls-native-certs 0.7.3",
+ "rustls-pki-types",
+ "rustls-webpki 0.103.13",
+]
+
 [[package]]
 name = "rustls-native-certs"
 version = "0.6.3"
@@ -10275,6 +10804,15 @@ dependencies = [
  "serde_json",
 ]
 
+[[package]]
+name = "salsa20"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97a22f5af31f73a954c10289c93e8a50cc23d971e80ee446f1f6f7137a088213"
+dependencies = [
+ "cipher 0.4.4",
+]
+
 [[package]]
 name = "samael"
 version = "0.0.20"
@@ -10411,6 +10949,17 @@ version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
+[[package]]
+name = "scrypt"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0516a385866c09368f0b5bcd1caff3366aace790fcd46e2bb032697bb172fd1f"
+dependencies = [
+ "pbkdf2",
+ "salsa20",
+ "sha2 0.10.9",
+]
+
 [[package]]
 name = "sct"
 version = "0.7.1"
@@ -10978,6 +11527,16 @@ version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "199905e6153d6405f9728fe44daace35f8f837bbf830bb6e85fbd5828709a886"
 
+[[package]]
+name = "socket2"
+version = "0.4.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7916fc008ca5542385b89a3d3ce689953c143e9304a9bf8beec1de48994c0d"
+dependencies = [
+ "libc",
+ "winapi",
+]
+
 [[package]]
 name = "socket2"
 version = "0.5.10"
@@ -12137,6 +12696,18 @@ dependencies = [
  "xattr",
 ]
 
+[[package]]
+name = "tcp-stream"
+version = "0.28.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "495b0abdce3dc1f8fd27240651c9e68890c14e9d9c61527b1ce44d8a5a7bd3d5"
+dependencies = [
+ "cfg-if",
+ "p12-keystore",
+ "rustls-connector",
+ "rustls-pemfile 2.2.0",
+]
+
 [[package]]
 name = "temp_deno_which"
 version = "0.1.0"
@@ -12152,7 +12723,7 @@ version = "3.27.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
- "fastrand",
+ "fastrand 2.5.0",
  "getrandom 0.4.3",
  "once_cell",
  "rustix 1.1.4",
@@ -12462,6 +13033,17 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
+[[package]]
+name = "tokio-executor-trait"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6278565f9fd60c2d205dfbc827e8bb1236c2b1a57148708e95861eff7a6b3bad"
+dependencies = [
+ "async-trait",
+ "executor-trait",
+ "tokio",
+]
+
 [[package]]
 name = "tokio-graceful"
 version = "0.1.6"
@@ -12521,6 +13103,20 @@ dependencies = [
  "whoami",
 ]
 
+[[package]]
+name = "tokio-reactor-trait"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e9481a72f36bd9cbb8d6dd349227c4783e234e4332cfe806225bc929c4b92486"
+dependencies = [
+ "async-trait",
+ "futures-core",
+ "futures-io",
+ "reactor-trait",
+ "tokio",
+ "tokio-stream",
+]
+
 [[package]]
 name = "tokio-retry2"
 version = "0.5.8"
@@ -13551,6 +14147,12 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "waker-fn"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "317211a0dc0ceedd78fb2ca9a44aed3d7b9b26f81870d485c07122b4350673b7"
+
 [[package]]
 name = "walkdir"
 version = "2.5.0"
@@ -14129,6 +14731,7 @@ dependencies = [
  "windmill-queue",
  "windmill-store",
  "windmill-trigger",
+ "windmill-trigger-amqp",
  "windmill-trigger-azure",
  "windmill-trigger-email",
  "windmill-trigger-gcp",
@@ -15425,6 +16028,33 @@ dependencies = [
  "windmill-queue",
 ]
 
+[[package]]
+name = "windmill-trigger-amqp"
+version = "1.764.0"
+dependencies = [
+ "anyhow",
+ "async-trait",
+ "axum 0.8.9",
+ "base64 0.22.1",
+ "futures",
+ "itertools 0.14.0",
+ "lapin",
+ "serde",
+ "serde_json",
+ "sqlx",
+ "thiserror 2.0.19",
+ "tokio",
+ "tokio-executor-trait",
+ "tokio-reactor-trait",
+ "tracing",
+ "urlencoding",
+ "windmill-api-auth",
+ "windmill-common",
+ "windmill-git-sync",
+ "windmill-store",
+ "windmill-trigger",
+]
+
 [[package]]
 name = "windmill-trigger-azure"
 version = "1.764.0"
@@ -15836,7 +16466,7 @@ dependencies = [
  "windmill-types",
  "windmill-worker-volumes",
  "windows 0.61.3",
- "x509-parser",
+ "x509-parser 0.16.0",
  "yaml-rust",
 ]
 
@@ -16488,24 +17118,52 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "x509-cert"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1301e935010a701ae5f8655edc0ad17c44bad3ac5ce8c39185f75453b720ae94"
+dependencies = [
+ "const-oid",
+ "der",
+ "spki",
+]
+
 [[package]]
 name = "x509-parser"
 version = "0.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fcbc162f30700d6f3f82a24bf7cc62ffe7caea42c0b2cba8bf7f3ae50cf51f69"
 dependencies = [
- "asn1-rs",
+ "asn1-rs 0.6.2",
  "data-encoding",
- "der-parser",
+ "der-parser 9.0.0",
  "lazy_static",
  "nom",
- "oid-registry",
+ "oid-registry 0.7.1",
  "ring 0.17.14",
  "rusticata-macros",
  "thiserror 1.0.69",
  "time",
 ]
 
+[[package]]
+name = "x509-parser"
+version = "0.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4569f339c0c402346d4a75a9e39cf8dad310e287eef1ff56d4c68e5067f53460"
+dependencies = [
+ "asn1-rs 0.7.2",
+ "data-encoding",
+ "der-parser 10.0.0",
+ "lazy_static",
+ "nom",
+ "oid-registry 0.8.1",
+ "rusticata-macros",
+ "thiserror 2.0.19",
+ "time",
+]
+
 [[package]]
 name = "xattr"
 version = "1.6.1"
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 5bb6069461..638e267c04 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -22,6 +22,7 @@ members = [
     "./windmill-trigger-kafka",
     "./windmill-trigger-postgres",
     "./windmill-trigger-mqtt",
+    "./windmill-trigger-amqp",
     "./windmill-trigger-websocket",
     "./windmill-trigger-email",
     "./windmill-trigger-nats",
@@ -141,6 +142,7 @@ postgres_trigger = ["windmill-api/postgres_trigger"]
 mcp = ["windmill-ai/mcp", "windmill-api/mcp", "windmill-worker/mcp"]
 bedrock = ["windmill-ai/bedrock", "windmill-api/bedrock", "windmill-worker/bedrock"]
 mqtt_trigger = ["windmill-api/mqtt_trigger"]
+amqp_trigger = ["windmill-api/amqp_trigger"]
 native_trigger = ["windmill-api/native_trigger"]
 sqs_trigger = ["windmill-api/sqs_trigger", "windmill-common/aws_auth", "windmill-api/openidconnect"]
 gcp_trigger = ["windmill-api/gcp_trigger"]
@@ -180,7 +182,7 @@ run_inline = ["windmill-api/run_inline"]
 oss_core = [
     "embedding", "parquet", "openidconnect", "license",
     "http_trigger", "zip", "oauth2", "postgres_trigger",
-    "mqtt_trigger", "websocket", "smtp", "native_trigger",
+    "mqtt_trigger", "amqp_trigger", "websocket", "smtp", "native_trigger",
     "static_frontend", "mcp", "bedrock", "run_inline",
     "quickjs"
 ]
@@ -201,7 +203,7 @@ ee_rhel = ["ce_core", "ee_core", "kafka-gssapi", "all_languages"]
 ee_windows = ["ce_core", "ee_core", "all_languages_windows"]
 all_sqlx_features = ["all_languages", "enterprise", "enterprise_saml", "embedding", "parquet", "prometheus", "flow_testing",
  "openidconnect", "cloud", "jemalloc", "tantivy", "sqlx", "kafka", "kafka-gssapi", "nats", "otel", "dind", "websocket", "http_trigger",
-  "postgres_trigger", "mcp", "mqtt_trigger", "sqs_trigger", "gcp_trigger", "azure_trigger", "smtp", "stripe",
+  "postgres_trigger", "mcp", "mqtt_trigger", "amqp_trigger", "sqs_trigger", "gcp_trigger", "azure_trigger", "smtp", "stripe",
    "license", "oauth2", "zip", "static_frontend", "scoped_cache", "agent_worker_server", "bedrock", "native_trigger", "quickjs",
    "windmill-git-sync/all_sqlx_features"]
 
@@ -361,6 +363,7 @@ windmill-trigger = { path = "./windmill-trigger" }
 windmill-trigger-kafka = { path = "./windmill-trigger-kafka" }
 windmill-trigger-postgres = { path = "./windmill-trigger-postgres" }
 windmill-trigger-mqtt = { path = "./windmill-trigger-mqtt" }
+windmill-trigger-amqp = { path = "./windmill-trigger-amqp" }
 windmill-trigger-websocket = { path = "./windmill-trigger-websocket" }
 windmill-trigger-email = { path = "./windmill-trigger-email" }
 windmill-trigger-nats = { path = "./windmill-trigger-nats" }
@@ -678,6 +681,9 @@ tree-sitter-ruby = "=0.23.1"
 tree-sitter-r = "=1.2.0"
 oracle = { version = "0.6.3", features = ["chrono"] }
 rumqttc = { version = "0.24.0", features = ["use-native-tls"]}
+lapin = "2.5"
+tokio-executor-trait = "2.1"
+tokio-reactor-trait = "1.1"
 strum = { version = "0.27", features = ["derive"] }
 strum_macros = "0.27"
 hudsucker = { version = "0.22", features = ["rcgen-ca", "native-tls-client"] }
diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index 8bc1d06cad..d0497c1e02 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-eb3690a34b41134c91b9cb6f90b11daa541ad171
\ No newline at end of file
+aaa6cb89b05b76139252c64f057e53b94d12ac60
diff --git a/backend/migrations/20260721082249_add_amqp_trigger.down.sql b/backend/migrations/20260721082249_add_amqp_trigger.down.sql
new file mode 100644
index 0000000000..1ab9baecb8
--- /dev/null
+++ b/backend/migrations/20260721082249_add_amqp_trigger.down.sql
@@ -0,0 +1,2 @@
+-- Add down migration script here
+DROP TABLE amqp_trigger;
diff --git a/backend/migrations/20260721082249_add_amqp_trigger.up.sql b/backend/migrations/20260721082249_add_amqp_trigger.up.sql
new file mode 100644
index 0000000000..2f2da55c00
--- /dev/null
+++ b/backend/migrations/20260721082249_add_amqp_trigger.up.sql
@@ -0,0 +1,83 @@
+-- Add up migration script here
+CREATE TABLE amqp_trigger (
+    amqp_resource_path VARCHAR(255) NOT NULL,
+    queue_name VARCHAR(255) NOT NULL,
+    exchange JSONB NULL,
+    options JSONB NULL,
+    path VARCHAR(255) NOT NULL,
+    script_path VARCHAR(255) NOT NULL,
+    is_flow BOOLEAN NOT NULL,
+    workspace_id VARCHAR(50) NOT NULL,
+    edited_by VARCHAR(50) NOT NULL,
+    edited_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    extra_perms JSONB NOT NULL DEFAULT '{}',
+    server_id VARCHAR(50) NULL,
+    last_server_ping TIMESTAMPTZ NULL,
+    error TEXT NULL,
+    error_handler_path VARCHAR(255) NULL,
+    error_handler_args JSONB NULL,
+    retry JSONB NULL,
+    mode TRIGGER_MODE NOT NULL DEFAULT 'enabled'::TRIGGER_MODE,
+    permissioned_as VARCHAR(255) NOT NULL,
+    labels TEXT[] NULL,
+    PRIMARY KEY (path, workspace_id),
+    FOREIGN KEY (workspace_id) REFERENCES workspace(id) ON DELETE CASCADE
+);
+
+CREATE INDEX idx_amqp_trigger_labels ON amqp_trigger USING gin (labels) WHERE labels IS NOT NULL;
+
+GRANT ALL ON amqp_trigger TO windmill_user;
+GRANT ALL ON amqp_trigger TO windmill_admin;
+
+ALTER TABLE amqp_trigger ENABLE ROW LEVEL SECURITY;
+
+CREATE POLICY admin_policy ON amqp_trigger FOR ALL TO windmill_admin USING (true);
+
+CREATE POLICY see_folder_extra_perms_user_select ON amqp_trigger FOR SELECT TO windmill_user
+USING (SPLIT_PART(amqp_trigger.path, '/', 1) = 'f' AND SPLIT_PART(amqp_trigger.path, '/', 2) = any((select regexp_split_to_array(current_setting('session.folders_read'), ','))::text[]));
+CREATE POLICY see_folder_extra_perms_user_insert ON amqp_trigger FOR INSERT TO windmill_user
+WITH CHECK (SPLIT_PART(amqp_trigger.path, '/', 1) = 'f' AND SPLIT_PART(amqp_trigger.path, '/', 2) = any((select regexp_split_to_array(current_setting('session.folders_write'), ','))::text[]));
+CREATE POLICY see_folder_extra_perms_user_update ON amqp_trigger FOR UPDATE TO windmill_user
+USING (SPLIT_PART(amqp_trigger.path, '/', 1) = 'f' AND SPLIT_PART(amqp_trigger.path, '/', 2) = any((select regexp_split_to_array(current_setting('session.folders_write'), ','))::text[]));
+CREATE POLICY see_folder_extra_perms_user_delete ON amqp_trigger FOR DELETE TO windmill_user
+USING (SPLIT_PART(amqp_trigger.path, '/', 1) = 'f' AND SPLIT_PART(amqp_trigger.path, '/', 2) = any((select regexp_split_to_array(current_setting('session.folders_write'), ','))::text[]));
+
+CREATE POLICY see_own ON amqp_trigger FOR ALL TO windmill_user
+USING (SPLIT_PART(amqp_trigger.path, '/', 1) = 'u' AND SPLIT_PART(amqp_trigger.path, '/', 2) = (select current_setting('session.user')));
+CREATE POLICY see_member ON amqp_trigger FOR ALL TO windmill_user
+USING (SPLIT_PART(amqp_trigger.path, '/', 1) = 'g' AND SPLIT_PART(amqp_trigger.path, '/', 2) = any((select regexp_split_to_array(current_setting('session.groups'), ','))::text[]));
+
+CREATE POLICY see_extra_perms_user_select ON amqp_trigger FOR SELECT TO windmill_user
+USING (extra_perms ? (select concat('u/', current_setting('session.user'))));
+CREATE POLICY see_extra_perms_user_insert ON amqp_trigger FOR INSERT TO windmill_user
+WITH CHECK ((extra_perms ->> (select concat('u/', current_setting('session.user'))))::boolean);
+CREATE POLICY see_extra_perms_user_update ON amqp_trigger FOR UPDATE TO windmill_user
+USING ((extra_perms ->> (select concat('u/', current_setting('session.user'))))::boolean);
+CREATE POLICY see_extra_perms_user_delete ON amqp_trigger FOR DELETE TO windmill_user
+USING ((extra_perms ->> (select concat('u/', current_setting('session.user'))))::boolean);
+
+CREATE POLICY see_extra_perms_groups_select ON amqp_trigger FOR SELECT TO windmill_user
+USING (extra_perms ?| (select regexp_split_to_array(current_setting('session.pgroups'), ','))::text[]);
+CREATE POLICY see_extra_perms_groups_insert ON amqp_trigger FOR INSERT TO windmill_user
+WITH CHECK (exists(
+    SELECT key, value FROM jsonb_each_text(extra_perms)
+    WHERE SPLIT_PART(key, '/', 1) = 'g' AND key = ANY((select regexp_split_to_array(current_setting('session.pgroups'), ','))::text[])
+    AND value::boolean));
+CREATE POLICY see_extra_perms_groups_update ON amqp_trigger FOR UPDATE TO windmill_user
+USING (exists(
+    SELECT key, value FROM jsonb_each_text(extra_perms)
+    WHERE SPLIT_PART(key, '/', 1) = 'g' AND key = ANY((select regexp_split_to_array(current_setting('session.pgroups'), ','))::text[])
+    AND value::boolean));
+CREATE POLICY see_extra_perms_groups_delete ON amqp_trigger FOR DELETE  TO windmill_user
+USING (exists(
+    SELECT key, value FROM jsonb_each_text(extra_perms)
+    WHERE SPLIT_PART(key, '/', 1) = 'g' AND key = ANY((select regexp_split_to_array(current_setting('session.pgroups'), ','))::text[])
+    AND value::boolean));
+
+-- Enum values for the new trigger kind. ALTER TYPE ... ADD VALUE runs inside the
+-- migration transaction on PG >= 14 (Windmill's minimum) as long as the value
+-- isn't used in the same transaction — the amqp_trigger table above does not
+-- reference these enum types.
+ALTER TYPE TRIGGER_KIND ADD VALUE IF NOT EXISTS 'amqp';
+ALTER TYPE job_trigger_kind ADD VALUE IF NOT EXISTS 'amqp';
+ALTER TYPE draft_kind ADD VALUE IF NOT EXISTS 'trigger_amqp';
diff --git a/backend/parsers/windmill-parser/src/asset_parser.rs b/backend/parsers/windmill-parser/src/asset_parser.rs
index 4cf0c22a41..211c205579 100644
--- a/backend/parsers/windmill-parser/src/asset_parser.rs
+++ b/backend/parsers/windmill-parser/src/asset_parser.rs
@@ -172,6 +172,7 @@ pub enum TriggerSpec {
     Email,
     Kafka,
     Mqtt,
+    Amqp,
     Nats,
     Postgres,
     Sqs,
@@ -1527,6 +1528,7 @@ fn parse_trigger_spec(s: &str) -> Option<TriggerSpec> {
         ("email", TriggerSpec::Email),
         ("kafka", TriggerSpec::Kafka),
         ("mqtt", TriggerSpec::Mqtt),
+        ("amqp", TriggerSpec::Amqp),
         ("nats", TriggerSpec::Nats),
         ("postgres", TriggerSpec::Postgres),
         ("sqs", TriggerSpec::Sqs),
@@ -1722,7 +1724,10 @@ mod pipeline_annotation_tests {
         );
         // A non-ASCII body must not panic on a byte offset that is not a char
         // boundary.
-        assert_eq!(split_measure_filter("sum(amount) + π"), ("sum(amount) + π", None));
+        assert_eq!(
+            split_measure_filter("sum(amount) + π"),
+            ("sum(amount) + π", None)
+        );
         assert_eq!(
             split_measure_filter("sum(π) where region = 'π'"),
             ("sum(π)", Some("region = 'π'".to_string()))
diff --git a/backend/parsers/windmill-parser/tests/pipeline_annotations_parity.rs b/backend/parsers/windmill-parser/tests/pipeline_annotations_parity.rs
index fff818edb2..1936f7ff70 100644
--- a/backend/parsers/windmill-parser/tests/pipeline_annotations_parity.rs
+++ b/backend/parsers/windmill-parser/tests/pipeline_annotations_parity.rs
@@ -121,6 +121,7 @@ fn native_str(t: &TriggerSpec) -> Option<&'static str> {
         TriggerSpec::Email => "email",
         TriggerSpec::Kafka => "kafka",
         TriggerSpec::Mqtt => "mqtt",
+        TriggerSpec::Amqp => "amqp",
         TriggerSpec::Nats => "nats",
         TriggerSpec::Postgres => "postgres",
         TriggerSpec::Sqs => "sqs",
diff --git a/backend/windmill-api-assets/src/lib.rs b/backend/windmill-api-assets/src/lib.rs
index 997879e155..3a2bf83097 100644
--- a/backend/windmill-api-assets/src/lib.rs
+++ b/backend/windmill-api-assets/src/lib.rs
@@ -784,6 +784,11 @@ enum TriggerEdge {
         runnable_kind: AssetUsageKind,
         runnable_path: String,
     },
+    Amqp {
+        path: String,
+        runnable_kind: AssetUsageKind,
+        runnable_path: String,
+    },
     Nats {
         path: String,
         runnable_kind: AssetUsageKind,
@@ -928,6 +933,9 @@ async fn asset_graph(
             SELECT 'mqtt', path, script_path, is_flow FROM mqtt_trigger
                 WHERE workspace_id = $1
             UNION ALL
+            SELECT 'amqp', path, script_path, is_flow FROM amqp_trigger
+                WHERE workspace_id = $1
+            UNION ALL
             SELECT 'nats', path, script_path, is_flow FROM nats_trigger
                 WHERE workspace_id = $1
             UNION ALL
@@ -1210,6 +1218,7 @@ async fn asset_graph(
             "email" => TriggerEdge::Email { path, runnable_kind, runnable_path: script_path },
             "kafka" => TriggerEdge::Kafka { path, runnable_kind, runnable_path: script_path },
             "mqtt" => TriggerEdge::Mqtt { path, runnable_kind, runnable_path: script_path },
+            "amqp" => TriggerEdge::Amqp { path, runnable_kind, runnable_path: script_path },
             "nats" => TriggerEdge::Nats { path, runnable_kind, runnable_path: script_path },
             "postgres" => TriggerEdge::Postgres { path, runnable_kind, runnable_path: script_path },
             "sqs" => TriggerEdge::Sqs { path, runnable_kind, runnable_path: script_path },
diff --git a/backend/windmill-api-auth/src/scopes.rs b/backend/windmill-api-auth/src/scopes.rs
index 3b594fe79c..75cbc104ac 100644
--- a/backend/windmill-api-auth/src/scopes.rs
+++ b/backend/windmill-api-auth/src/scopes.rs
@@ -261,6 +261,7 @@ pub enum ScopeDomain {
     KafkaTriggers,
     NatsTriggers,
     MqttTriggers,
+    AmqpTriggers,
     SqsTriggers,
     GcpTriggers,
     AzureTriggers,
@@ -323,6 +324,7 @@ impl ScopeDomain {
             Self::KafkaTriggers => "kafka_triggers",
             Self::NatsTriggers => "nats_triggers",
             Self::MqttTriggers => "mqtt_triggers",
+            Self::AmqpTriggers => "amqp_triggers",
             Self::SqsTriggers => "sqs_triggers",
             Self::GcpTriggers => "gcp_triggers",
             Self::AzureTriggers => "azure_triggers",
@@ -378,6 +380,7 @@ impl ScopeDomain {
             "kafka_triggers" => Some(Self::KafkaTriggers),
             "nats_triggers" => Some(Self::NatsTriggers),
             "mqtt_triggers" => Some(Self::MqttTriggers),
+            "amqp_triggers" => Some(Self::AmqpTriggers),
             "sqs_triggers" => Some(Self::SqsTriggers),
             "gcp_triggers" => Some(Self::GcpTriggers),
             "azure_triggers" => Some(Self::AzureTriggers),
diff --git a/backend/windmill-api-groups/src/granular_acls.rs b/backend/windmill-api-groups/src/granular_acls.rs
index 663644e8e0..e413165825 100644
--- a/backend/windmill-api-groups/src/granular_acls.rs
+++ b/backend/windmill-api-groups/src/granular_acls.rs
@@ -46,13 +46,13 @@ fn audit_action_prefix_for_acl_kind(kind: &str) -> Option<&'static str> {
         "variable" => Some("variables"),
         "schedule" => Some("schedules"),
         "http_trigger" | "websocket_trigger" | "kafka_trigger" | "nats_trigger"
-        | "postgres_trigger" | "mqtt_trigger" | "gcp_trigger" | "azure_trigger" | "sqs_trigger"
-        | "email_trigger" => Some("triggers"),
+        | "postgres_trigger" | "mqtt_trigger" | "amqp_trigger" | "gcp_trigger"
+        | "azure_trigger" | "sqs_trigger" | "email_trigger" => Some("triggers"),
         _ => None,
     }
 }
 
-const KINDS: [&str; 20] = [
+const KINDS: [&str; 21] = [
     "script",
     "group_",
     "resource",
@@ -68,6 +68,7 @@ const KINDS: [&str; 20] = [
     "nats_trigger",
     "postgres_trigger",
     "mqtt_trigger",
+    "amqp_trigger",
     "gcp_trigger",
     "azure_trigger",
     "sqs_trigger",
diff --git a/backend/windmill-api-users/src/users.rs b/backend/windmill-api-users/src/users.rs
index b98bc6f414..0e22f4a09d 100644
--- a/backend/windmill-api-users/src/users.rs
+++ b/backend/windmill-api-users/src/users.rs
@@ -1751,6 +1751,7 @@ pub async fn delete_workspace_user_internal(
         "kafka_trigger",
         "postgres_trigger",
         "mqtt_trigger",
+        "amqp_trigger",
         "nats_trigger",
         "sqs_trigger",
         "gcp_trigger",
diff --git a/backend/windmill-api-workspaces/src/workspaces.rs b/backend/windmill-api-workspaces/src/workspaces.rs
index 83fdc51e38..99fb33e417 100644
--- a/backend/windmill-api-workspaces/src/workspaces.rs
+++ b/backend/windmill-api-workspaces/src/workspaces.rs
@@ -4444,6 +4444,7 @@ struct UsedTriggers {
     pub nats_used: bool,
     pub postgres_used: bool,
     pub mqtt_used: bool,
+    pub amqp_used: bool,
     pub sqs_used: bool,
     pub gcp_used: bool,
     pub azure_used: bool,
@@ -4469,6 +4470,7 @@ async fn get_used_triggers(
             EXISTS(SELECT 1 FROM nats_trigger WHERE workspace_id = $1) as "nats_used!",
             EXISTS(SELECT 1 FROM postgres_trigger WHERE workspace_id = $1) AS "postgres_used!",
             EXISTS(SELECT 1 FROM mqtt_trigger WHERE workspace_id = $1) AS "mqtt_used!",
+            EXISTS(SELECT 1 FROM amqp_trigger WHERE workspace_id = $1) AS "amqp_used!",
             EXISTS(SELECT 1 FROM sqs_trigger WHERE workspace_id = $1) AS "sqs_used!",
             EXISTS(SELECT 1 FROM gcp_trigger WHERE workspace_id = $1) AS "gcp_used!",
             EXISTS(SELECT 1 FROM azure_trigger WHERE workspace_id = $1) AS "azure_used!",
@@ -5146,6 +5148,23 @@ async fn clone_triggers_and_schedules(
     .execute(&mut **tx)
     .await?;
 
+    sqlx::query!(
+        r#"INSERT INTO amqp_trigger (
+            amqp_resource_path, queue_name, exchange, options, path, script_path, is_flow,
+            workspace_id, edited_by, edited_at, extra_perms, server_id, last_server_ping,
+            error, error_handler_path, error_handler_args, retry, mode, permissioned_as, labels
+        )
+        SELECT
+            amqp_resource_path, queue_name, exchange, options, path, script_path, is_flow,
+            $1, edited_by, edited_at, extra_perms, NULL, NULL,
+            NULL, error_handler_path, error_handler_args, retry, 'disabled'::TRIGGER_MODE, permissioned_as, labels
+        FROM amqp_trigger WHERE workspace_id = $2"#,
+        target_workspace_id,
+        source_workspace_id,
+    )
+    .execute(&mut **tx)
+    .await?;
+
     sqlx::query!(
         r#"INSERT INTO sqs_trigger (
             path, queue_url, aws_resource_path, message_attributes, script_path,
diff --git a/backend/windmill-api-workspaces/src/workspaces_extra.rs b/backend/windmill-api-workspaces/src/workspaces_extra.rs
index 7ef55be497..1166d04fe3 100644
--- a/backend/windmill-api-workspaces/src/workspaces_extra.rs
+++ b/backend/windmill-api-workspaces/src/workspaces_extra.rs
@@ -279,6 +279,15 @@ pub(crate) async fn change_workspace_id(
     .execute(&mut *tx)
     .await?;
 
+    info!("Updating amqp_trigger table");
+    sqlx::query!(
+        "UPDATE amqp_trigger SET workspace_id = $1 WHERE workspace_id = $2",
+        &rw.new_id,
+        &old_id
+    )
+    .execute(&mut *tx)
+    .await?;
+
     info!("Updating gcp_trigger table");
     sqlx::query!(
         "UPDATE gcp_trigger SET workspace_id = $1 WHERE workspace_id = $2",
diff --git a/backend/windmill-api/Cargo.toml b/backend/windmill-api/Cargo.toml
index fa9ed3f2e5..b764e6ff83 100644
--- a/backend/windmill-api/Cargo.toml
+++ b/backend/windmill-api/Cargo.toml
@@ -10,8 +10,8 @@ path = "src/lib.rs"
 
 [features]
 default = []
-private = ["windmill-audit/private", "windmill-common/private", "windmill-api-auth/private", "windmill-store/private", "windmill-api-users/private", "windmill-api-workspaces/private", "windmill-api-groups/private", "windmill-api-configs/private", "windmill-api-settings/private", "windmill-api-assets/private", "windmill-api-agent-workers?/private", "windmill-trigger-kafka?/private", "windmill-trigger-postgres?/private", "windmill-trigger-mqtt?/private", "windmill-trigger-websocket?/private", "windmill-trigger-nats?/private", "windmill-trigger-sqs?/private", "windmill-trigger-gcp?/private", "windmill-trigger-azure?/private", "windmill-trigger-email?/private", "windmill-git-sync/private", "windmill-autoscaling?/private", "windmill-object-store/private"]
-enterprise = ["windmill-queue/enterprise", "windmill-audit/enterprise", "windmill-git-sync/enterprise", "windmill-common/enterprise", "windmill-worker?/enterprise", "windmill-api-auth/enterprise", "windmill-store/enterprise", "windmill-api-jobs/enterprise", "windmill-api-scripts/enterprise", "windmill-api-flows/enterprise", "windmill-api-users/enterprise", "windmill-api-workspaces/enterprise", "windmill-api-groups/enterprise", "windmill-api-configs/enterprise", "windmill-api-settings/enterprise", "windmill-api-schedule/enterprise", "windmill-api-agent-workers?/enterprise", "windmill-trigger/enterprise", "windmill-trigger-kafka?/enterprise", "windmill-trigger-postgres?/enterprise", "windmill-trigger-mqtt?/enterprise", "windmill-trigger-websocket?/enterprise", "windmill-trigger-email?/enterprise", "windmill-trigger-nats?/enterprise", "windmill-trigger-sqs?/enterprise", "windmill-trigger-gcp?/enterprise", "windmill-trigger-azure?/enterprise", "windmill-trigger-http?/enterprise", "windmill-native-triggers?/enterprise", "dep:windmill-autoscaling", "windmill-autoscaling/enterprise", "license"]
+private = ["windmill-audit/private", "windmill-common/private", "windmill-api-auth/private", "windmill-store/private", "windmill-api-users/private", "windmill-api-workspaces/private", "windmill-api-groups/private", "windmill-api-configs/private", "windmill-api-settings/private", "windmill-api-assets/private", "windmill-api-agent-workers?/private", "windmill-trigger-kafka?/private", "windmill-trigger-postgres?/private", "windmill-trigger-mqtt?/private", "windmill-trigger-amqp?/private", "windmill-trigger-websocket?/private", "windmill-trigger-nats?/private", "windmill-trigger-sqs?/private", "windmill-trigger-gcp?/private", "windmill-trigger-azure?/private", "windmill-trigger-email?/private", "windmill-git-sync/private", "windmill-autoscaling?/private", "windmill-object-store/private"]
+enterprise = ["windmill-queue/enterprise", "windmill-audit/enterprise", "windmill-git-sync/enterprise", "windmill-common/enterprise", "windmill-worker?/enterprise", "windmill-api-auth/enterprise", "windmill-store/enterprise", "windmill-api-jobs/enterprise", "windmill-api-scripts/enterprise", "windmill-api-flows/enterprise", "windmill-api-users/enterprise", "windmill-api-workspaces/enterprise", "windmill-api-groups/enterprise", "windmill-api-configs/enterprise", "windmill-api-settings/enterprise", "windmill-api-schedule/enterprise", "windmill-api-agent-workers?/enterprise", "windmill-trigger/enterprise", "windmill-trigger-kafka?/enterprise", "windmill-trigger-postgres?/enterprise", "windmill-trigger-mqtt?/enterprise", "windmill-trigger-amqp?/enterprise", "windmill-trigger-websocket?/enterprise", "windmill-trigger-email?/enterprise", "windmill-trigger-nats?/enterprise", "windmill-trigger-sqs?/enterprise", "windmill-trigger-gcp?/enterprise", "windmill-trigger-azure?/enterprise", "windmill-trigger-http?/enterprise", "windmill-native-triggers?/enterprise", "dep:windmill-autoscaling", "windmill-autoscaling/enterprise", "license"]
 stripe = []
 run_inline = ["dep:windmill-worker", "windmill-api-configs/run_inline"]
 agent_worker_server = ["dep:windmill-worker", "dep:windmill-api-agent-workers"]
@@ -34,6 +34,7 @@ http_trigger = ["dep:matchit", "dep:windmill-trigger-http", "windmill-store/http
 static_frontend = ["dep:rust-embed"]
 postgres_trigger = ["dep:windmill-trigger-postgres", "windmill-store/postgres_trigger"]
 mqtt_trigger = ["dep:windmill-trigger-mqtt", "windmill-store/mqtt_trigger"]
+amqp_trigger = ["dep:windmill-trigger-amqp", "windmill-store/amqp_trigger"]
 native_trigger = ["dep:windmill-native-triggers", "windmill-native-triggers/native_trigger", "dep:strum", "oauth2"]
 sqs_trigger = ["dep:windmill-trigger-sqs", "windmill-store/sqs_trigger"]
 gcp_trigger = ["dep:windmill-trigger-gcp", "windmill-store/gcp_trigger"]
@@ -141,6 +142,7 @@ matchit = { workspace = true, optional = true }
 windmill-trigger-kafka = { workspace = true, optional = true }
 windmill-trigger-postgres = { workspace = true, optional = true }
 windmill-trigger-mqtt = { workspace = true, optional = true }
+windmill-trigger-amqp = { workspace = true, optional = true }
 windmill-trigger-websocket = { workspace = true, optional = true }
 windmill-trigger-email = { workspace = true, optional = true }
 windmill-trigger-nats = { workspace = true, optional = true }
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 6b50450af9..81ebb3c72f 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -5629,6 +5629,8 @@ paths:
                     type: boolean
                   mqtt_used:
                     type: boolean
+                  amqp_used:
+                    type: boolean
                   gcp_used:
                     type: boolean
                   azure_used:
@@ -5650,6 +5652,7 @@ paths:
                   - nats_used
                   - postgres_used
                   - mqtt_used
+                  - amqp_used
                   - gcp_used
                   - azure_used
                   - sqs_used
@@ -17457,6 +17460,211 @@ paths:
               schema:
                 type: string
 
+  /w/{workspace}/amqp_triggers/create:
+    post:
+      summary: create amqp trigger
+      operationId: createAmqpTrigger
+      tags:
+        - amqp_trigger
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+      requestBody:
+        description: new amqp trigger
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/NewAmqpTrigger"
+      responses:
+        "201":
+          description: amqp trigger created
+          content:
+            text/plain:
+              schema:
+                type: string
+
+  /w/{workspace}/amqp_triggers/update/{path}:
+    post:
+      summary: update amqp trigger
+      operationId: updateAmqpTrigger
+      tags:
+        - amqp_trigger
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - $ref: "#/components/parameters/Path"
+      requestBody:
+        description: updated trigger
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/EditAmqpTrigger"
+      responses:
+        "200":
+          description: amqp trigger updated
+          content:
+            text/plain:
+              schema:
+                type: string
+
+  /w/{workspace}/amqp_triggers/delete/{path}:
+    delete:
+      summary: delete amqp trigger
+      operationId: deleteAmqpTrigger
+      tags:
+        - amqp_trigger
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - $ref: "#/components/parameters/Path"
+      responses:
+        "200":
+          description: amqp trigger deleted
+          content:
+            text/plain:
+              schema:
+                type: string
+
+  /w/{workspace}/amqp_triggers/get/{path}:
+    get:
+      summary: get amqp trigger
+      operationId: getAmqpTrigger
+      tags:
+        - amqp_trigger
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - $ref: "#/components/parameters/Path"
+        - $ref: "#/components/parameters/GetDraft"
+      responses:
+        "200":
+          description: amqp trigger retrieved
+          content:
+            application/json:
+              schema:
+                allOf:
+                  - $ref: "#/components/schemas/AmqpTrigger"
+                  - $ref: "#/components/schemas/UserDraftOverlay"
+
+  /w/{workspace}/amqp_triggers/list:
+    get:
+      summary: list amqp triggers
+      operationId: listAmqpTriggers
+      tags:
+        - amqp_trigger
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+          required: true
+        - $ref: "#/components/parameters/Page"
+        - $ref: "#/components/parameters/PerPage"
+        - name: path
+          description: filter by path
+          in: query
+          schema:
+            type: string
+        - name: is_flow
+          in: query
+          schema:
+            type: boolean
+        - name: path_start
+          in: query
+          schema:
+            type: string
+        - name: label
+          in: query
+          required: false
+          schema:
+            type: string
+          description: Filter by label
+        - $ref: "#/components/parameters/IncludeDraftOnly"
+      responses:
+        "200":
+          description: amqp trigger list
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/AmqpTrigger"
+
+  /w/{workspace}/amqp_triggers/exists/{path}:
+    get:
+      summary: does amqp trigger exists
+      operationId: existsAmqpTrigger
+      tags:
+        - amqp_trigger
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - $ref: "#/components/parameters/Path"
+      responses:
+        "200":
+          description: amqp trigger exists
+          content:
+            application/json:
+              schema:
+                type: boolean
+
+  /w/{workspace}/amqp_triggers/setmode/{path}:
+    post:
+      summary: set enabled amqp trigger
+      operationId: setAmqpTriggerMode
+      tags:
+        - amqp_trigger
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - $ref: "#/components/parameters/Path"
+      requestBody:
+        description: updated amqp trigger enable
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                mode:
+                  $ref: "#/components/schemas/TriggerMode"
+                force:
+                  type: boolean
+                  description: >
+                    Bypass the parent-state conflict warning when enabling a
+                    trigger in a fork whose parent has the same path enabled.
+              required:
+                - mode
+      responses:
+        "200":
+          description: amqp trigger enabled set
+          content:
+            text/plain:
+              schema:
+                type: string
+
+  /w/{workspace}/amqp_triggers/test:
+    post:
+      summary: test amqp connection
+      operationId: testAmqpConnection
+      tags:
+        - amqp_trigger
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+      requestBody:
+        description: test amqp connection
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                amqp_resource_path:
+                  type: string
+                  description: Path to the AMQP resource containing broker connection configuration
+              required:
+                - amqp_resource_path
+      responses:
+        "200":
+          description: successfully connected to amqp
+          content:
+            text/plain:
+              schema:
+                type: string
+
   /w/{workspace}/gcp_triggers/create:
     post:
       summary: create gcp trigger
@@ -19966,6 +20174,7 @@ paths:
                 nats_trigger,
                 postgres_trigger,
                 mqtt_trigger,
+                amqp_trigger,
                 gcp_trigger,
                 azure_trigger,
                 sqs_trigger,
@@ -20013,6 +20222,7 @@ paths:
                 nats_trigger,
                 postgres_trigger,
                 mqtt_trigger,
+                amqp_trigger,
                 gcp_trigger,
                 azure_trigger,
                 sqs_trigger,
@@ -20071,6 +20281,7 @@ paths:
                 nats_trigger,
                 postgres_trigger,
                 mqtt_trigger,
+                amqp_trigger,
                 gcp_trigger,
                 azure_trigger,
                 sqs_trigger,
@@ -23229,6 +23440,7 @@ components:
         - trigger_kafka
         - trigger_nats
         - trigger_mqtt
+        - trigger_amqp
         - trigger_sqs
         - trigger_gcp
         - trigger_azure
@@ -26415,6 +26627,7 @@ components:
         - kafka
         - nats
         - mqtt
+        - amqp
         - sqs
         - gcp
         - azure
@@ -26919,6 +27132,8 @@ components:
           type: number
         mqtt_count:
           type: number
+        amqp_count:
+          type: number
         gcp_count:
           type: number
         azure_count:
@@ -27435,6 +27650,183 @@ components:
         - subscribe_topics
         - mqtt_resource_path
 
+    AmqpExchange:
+      type: object
+      properties:
+        exchange_name:
+          type: string
+          description: Name of the exchange to bind the consumed queue to
+        routing_keys:
+          type: array
+          items:
+            type: string
+          description: Routing keys used to bind the queue to the exchange
+      required:
+        - exchange_name
+
+    AmqpOptions:
+      type: object
+      properties:
+        declare_queue:
+          type: boolean
+          description: Declare the queue (durable) before consuming; when false the queue is declared passively and must already exist
+        prefetch_count:
+          type: integer
+          format: int32
+          minimum: 1
+          maximum: 65535
+          description: Maximum number of unacknowledged messages the broker delivers at once (1-65535)
+
+    AmqpTrigger:
+      allOf:
+        - $ref: "#/components/schemas/TriggerExtraProperty"
+      type: object
+      properties:
+        amqp_resource_path:
+          type: string
+          description: Path to the AMQP resource containing broker connection configuration
+        queue_name:
+          type: string
+          description: Name of the queue to consume messages from
+        exchange:
+          $ref: "#/components/schemas/AmqpExchange"
+          nullable: true
+          description: Optional exchange binding for the consumed queue
+        options:
+          $ref: "#/components/schemas/AmqpOptions"
+          nullable: true
+          description: Optional consumer options (queue declaration, prefetch)
+        server_id:
+          type: string
+          description: ID of the server currently handling this trigger (internal)
+        last_server_ping:
+          type: string
+          format: date-time
+          description: Timestamp of last server heartbeat (internal)
+        error:
+          type: string
+          description: Last error message if the trigger failed
+        error_handler_path:
+          type: string
+          description: Path to a script or flow to run when the triggered job fails
+        error_handler_args:
+          $ref: "#/components/schemas/ScriptArgs"
+          description: Arguments to pass to the error handler
+        retry:
+          $ref: "../../openflow.openapi.yaml#/components/schemas/Retry"
+          description: Retry configuration for failed executions
+      required:
+        - amqp_resource_path
+        - queue_name
+
+    NewAmqpTrigger:
+      type: object
+      properties:
+        amqp_resource_path:
+          type: string
+          description: Path to the AMQP resource containing broker connection configuration
+        queue_name:
+          type: string
+          description: Name of the queue to consume messages from
+        exchange:
+          nullable: true
+          $ref: "#/components/schemas/AmqpExchange"
+          description: Optional exchange binding for the consumed queue
+        options:
+          nullable: true
+          $ref: "#/components/schemas/AmqpOptions"
+          description: Optional consumer options (queue declaration, prefetch)
+        path:
+          type: string
+          description: The unique Windmill path for this trigger. Must be of the form `u/<user>/<path>` or `f/<folder>/<path>`.
+        script_path:
+          type: string
+          description: Path to the script or flow to execute when a message is received
+        is_flow:
+          type: boolean
+          description: True if script_path points to a flow, false if it points to a script
+        mode:
+          $ref: "#/components/schemas/TriggerMode"
+        error_handler_path:
+          type: string
+          description: Path to a script or flow to run when the triggered job fails
+        error_handler_args:
+          $ref: "#/components/schemas/ScriptArgs"
+          description: Arguments to pass to the error handler
+        retry:
+          $ref: "../../openflow.openapi.yaml#/components/schemas/Retry"
+          description: Retry configuration for failed executions
+        permissioned_as:
+          type: string
+          description: The user or group this trigger runs as. Used during deployment to preserve the original trigger owner.
+        preserve_permissioned_as:
+          type: boolean
+          description: "When true and the caller is a member of the 'wm_deployers' group, preserves the original permissioned_as value instead of overwriting it."
+        labels:
+          type: array
+          items:
+            type: string
+      required:
+        - path
+        - script_path
+        - is_flow
+        - amqp_resource_path
+        - queue_name
+
+    EditAmqpTrigger:
+      type: object
+      properties:
+        amqp_resource_path:
+          type: string
+          description: Path to the AMQP resource containing broker connection configuration
+        queue_name:
+          type: string
+          description: Name of the queue to consume messages from
+        exchange:
+          nullable: true
+          $ref: "#/components/schemas/AmqpExchange"
+          description: Optional exchange binding for the consumed queue
+        options:
+          nullable: true
+          $ref: "#/components/schemas/AmqpOptions"
+          description: Optional consumer options (queue declaration, prefetch)
+        path:
+          type: string
+          description: The unique Windmill path for this trigger. Must be of the form `u/<user>/<path>` or `f/<folder>/<path>`.
+        script_path:
+          type: string
+          description: Path to the script or flow to execute when a message is received
+        is_flow:
+          type: boolean
+          description: True if script_path points to a flow, false if it points to a script
+        mode:
+          $ref: "#/components/schemas/TriggerMode"
+        error_handler_path:
+          type: string
+          description: Path to a script or flow to run when the triggered job fails
+        error_handler_args:
+          $ref: "#/components/schemas/ScriptArgs"
+          description: Arguments to pass to the error handler
+        retry:
+          $ref: "../../openflow.openapi.yaml#/components/schemas/Retry"
+          description: Retry configuration for failed executions
+        permissioned_as:
+          type: string
+          description: The user or group this trigger runs as. Used during deployment to preserve the original trigger owner.
+        preserve_permissioned_as:
+          type: boolean
+          description: "When true and the caller is a member of the 'wm_deployers' group, preserves the original permissioned_as value instead of overwriting it."
+        labels:
+          type: array
+          items:
+            type: string
+      required:
+        - path
+        - script_path
+        - is_flow
+        - amqp_resource_path
+        - queue_name
+
     DeliveryType:
       type: string
       enum:
@@ -30393,6 +30785,7 @@ components:
           postgres,
           sqs,
           mqtt,
+          amqp,
           gcp,
           azure,
           email,
@@ -30575,6 +30968,7 @@ components:
               "nats_trigger",
               "postgres_trigger",
               "mqtt_trigger",
+              "amqp_trigger",
               "sqs_trigger",
               "gcp_trigger",
               "azure_trigger",
diff --git a/backend/windmill-api/src/capture.rs b/backend/windmill-api/src/capture.rs
index bf98ae460d..1eed038c25 100644
--- a/backend/windmill-api/src/capture.rs
+++ b/backend/windmill-api/src/capture.rs
@@ -48,6 +48,8 @@ use windmill_common::error::Error;
 #[cfg(all(feature = "enterprise", feature = "kafka", feature = "private"))]
 use crate::triggers::kafka::KafkaTriggerConfigConnection;
 
+#[cfg(feature = "amqp_trigger")]
+use crate::triggers::amqp::{AmqpOptions, ExchangeConfig};
 #[cfg(feature = "mqtt_trigger")]
 use crate::triggers::mqtt::{MqttClientVersion, MqttV3Config, MqttV5Config, SubscribeTopic};
 
@@ -234,6 +236,14 @@ pub struct MqttTriggerConfig {
     pub client_version: Option<MqttClientVersion>,
     pub client_id: Option<String>,
 }
+#[cfg(feature = "amqp_trigger")]
+#[derive(Debug, Serialize, Deserialize)]
+pub struct AmqpTriggerConfig {
+    pub amqp_resource_path: String,
+    pub queue_name: String,
+    pub exchange: Option<ExchangeConfig>,
+    pub options: Option<AmqpOptions>,
+}
 #[cfg(feature = "postgres_trigger")]
 #[derive(Serialize, Deserialize, Debug)]
 pub struct PostgresTriggerConfig {
@@ -271,6 +281,8 @@ enum TriggerConfig {
     Nats(NatsTriggerConfig),
     #[cfg(feature = "mqtt_trigger")]
     Mqtt(MqttTriggerConfig),
+    #[cfg(feature = "amqp_trigger")]
+    Amqp(AmqpTriggerConfig),
     #[cfg(all(feature = "enterprise", feature = "gcp_trigger", feature = "private"))]
     Gcp(GcpTriggerConfig),
     #[cfg(all(feature = "enterprise", feature = "azure_trigger", feature = "private"))]
diff --git a/backend/windmill-api/src/offboarding.rs b/backend/windmill-api/src/offboarding.rs
index 24b6d3f10d..f9bf0e1449 100644
--- a/backend/windmill-api/src/offboarding.rs
+++ b/backend/windmill-api/src/offboarding.rs
@@ -186,6 +186,7 @@ async fn get_offboard_preview(
         "kafka_trigger",
         "postgres_trigger",
         "mqtt_trigger",
+        "amqp_trigger",
         "nats_trigger",
         "sqs_trigger",
         "gcp_trigger",
@@ -750,6 +751,7 @@ async fn check_path_conflicts(
         "kafka_trigger",
         "postgres_trigger",
         "mqtt_trigger",
+        "amqp_trigger",
         "nats_trigger",
         "sqs_trigger",
         "gcp_trigger",
@@ -1017,13 +1019,14 @@ async fn offboard_user_from_workspace<'c>(
         &new_permissioned_as, username, w_id
     ).execute(&mut **tx).await?;
 
-    // ---- triggers (all 9 types with path/permissioned_as) ----
+    // ---- triggers (all 10 types with path/permissioned_as) ----
     let trigger_tables = [
         "http_trigger",
         "websocket_trigger",
         "kafka_trigger",
         "postgres_trigger",
         "mqtt_trigger",
+        "amqp_trigger",
         "nats_trigger",
         "sqs_trigger",
         "gcp_trigger",
diff --git a/backend/windmill-api/src/token.rs b/backend/windmill-api/src/token.rs
index 8bcd02d2fc..c7229fe056 100644
--- a/backend/windmill-api/src/token.rs
+++ b/backend/windmill-api/src/token.rs
@@ -24,6 +24,7 @@ fn build_trigger_scope_domains() -> Vec<ScopeDomain> {
         ("kafka_triggers", "Kafka"),
         ("nats_triggers", "NATS"),
         ("mqtt_triggers", "MQTT"),
+        ("amqp_triggers", "AMQP"),
         ("sqs_triggers", "AWS SQS"),
         ("gcp_triggers", "GCP Pub/Sub"),
         ("azure_triggers", "Azure Event Grid"),
diff --git a/backend/windmill-api/src/trash.rs b/backend/windmill-api/src/trash.rs
index d0d7ddc6c2..416546b850 100644
--- a/backend/windmill-api/src/trash.rs
+++ b/backend/windmill-api/src/trash.rs
@@ -467,6 +467,7 @@ async fn restore_trigger(tx: &mut sqlx::PgConnection, item: &TrashItemWithData)
         "nats_trigger",
         "postgres_trigger",
         "mqtt_trigger",
+        "amqp_trigger",
         "sqs_trigger",
         "gcp_trigger",
         "azure_trigger",
diff --git a/backend/windmill-api/src/triggers/amqp/mod.rs b/backend/windmill-api/src/triggers/amqp/mod.rs
new file mode 100644
index 0000000000..81aaca3aa8
--- /dev/null
+++ b/backend/windmill-api/src/triggers/amqp/mod.rs
@@ -0,0 +1 @@
+pub use windmill_trigger_amqp::*;
diff --git a/backend/windmill-api/src/triggers/handler.rs b/backend/windmill-api/src/triggers/handler.rs
index 35b025965d..d86912d8d0 100644
--- a/backend/windmill-api/src/triggers/handler.rs
+++ b/backend/windmill-api/src/triggers/handler.rs
@@ -61,6 +61,16 @@ pub fn generate_trigger_routers() -> Router {
         );
     }
 
+    #[cfg(feature = "amqp_trigger")]
+    {
+        use crate::triggers::amqp::AmqpTrigger;
+
+        router = router.nest(
+            AmqpTrigger::ROUTE_PREFIX,
+            complete_trigger_routes(AmqpTrigger),
+        );
+    }
+
     #[cfg(all(feature = "enterprise", feature = "sqs_trigger", feature = "private"))]
     {
         use crate::triggers::sqs::SqsTrigger;
@@ -143,6 +153,7 @@ pub struct TriggersCount {
     nats_count: i64,
     postgres_count: i64,
     mqtt_count: i64,
+    amqp_count: i64,
     sqs_count: i64,
     gcp_count: i64,
     azure_count: i64,
@@ -245,6 +256,17 @@ pub async fn get_triggers_count_internal(
     #[cfg(not(feature = "mqtt_trigger"))]
     let mqtt_count = 0;
 
+    #[cfg(feature = "amqp_trigger")]
+    let amqp_count = {
+        use crate::triggers::amqp::AmqpTrigger;
+        let count = AmqpTrigger
+            .trigger_count(&mut tx, w_id, is_flow, path)
+            .await;
+        count
+    };
+    #[cfg(not(feature = "amqp_trigger"))]
+    let amqp_count = 0;
+
     #[cfg(all(feature = "sqs_trigger", feature = "enterprise", feature = "private"))]
     let sqs_count = {
         use crate::triggers::sqs::SqsTrigger;
@@ -362,6 +384,7 @@ pub async fn get_triggers_count_internal(
         nats_count,
         postgres_count,
         mqtt_count,
+        amqp_count,
         gcp_count,
         azure_count,
         sqs_count,
diff --git a/backend/windmill-api/src/triggers/listener.rs b/backend/windmill-api/src/triggers/listener.rs
index 43cabf13e3..d12ff7a1e2 100644
--- a/backend/windmill-api/src/triggers/listener.rs
+++ b/backend/windmill-api/src/triggers/listener.rs
@@ -51,6 +51,14 @@ pub fn start_all_listeners(db: DB, killpill_rx: &tokio::sync::broadcast::Receive
         listen_to(MqttTrigger, db.clone(), mqtt_killpill_rx)
     }
 
+    #[cfg(feature = "amqp_trigger")]
+    {
+        let amqp_killpill_rx = killpill_rx.resubscribe();
+        use crate::triggers::amqp::AmqpTrigger;
+
+        listen_to(AmqpTrigger, db.clone(), amqp_killpill_rx)
+    }
+
     #[cfg(feature = "websocket")]
     {
         let mqtt_killpill_rx = killpill_rx.resubscribe();
diff --git a/backend/windmill-api/src/triggers/mod.rs b/backend/windmill-api/src/triggers/mod.rs
index bc69c66b2b..10f45cbd7f 100644
--- a/backend/windmill-api/src/triggers/mod.rs
+++ b/backend/windmill-api/src/triggers/mod.rs
@@ -1,4 +1,6 @@
 // Concrete trigger submodules (feature-gated)
+#[cfg(feature = "amqp_trigger")]
+pub mod amqp;
 #[cfg(all(feature = "azure_trigger", feature = "enterprise", feature = "private"))]
 pub mod azure;
 #[cfg(all(feature = "smtp", feature = "private"))]
diff --git a/backend/windmill-api/src/workspaces_export.rs b/backend/windmill-api/src/workspaces_export.rs
index 5cf198c08b..c869d87780 100644
--- a/backend/windmill-api/src/workspaces_export.rs
+++ b/backend/windmill-api/src/workspaces_export.rs
@@ -19,6 +19,7 @@ use windmill_api_auth::check_scopes;
     feature = "websocket",
     feature = "postgres_trigger",
     feature = "mqtt_trigger",
+    feature = "amqp_trigger",
     all(
         feature = "enterprise",
         any(
@@ -144,6 +145,7 @@ pub fn is_none_or_false(val: &Option<bool>) -> bool {
     feature = "websocket",
     feature = "postgres_trigger",
     feature = "mqtt_trigger",
+    feature = "amqp_trigger",
     feature = "native_trigger",
     all(
         feature = "enterprise",
@@ -189,6 +191,7 @@ async fn fork_parent_trigger_modes(
     feature = "websocket",
     feature = "postgres_trigger",
     feature = "mqtt_trigger",
+    feature = "amqp_trigger",
     feature = "native_trigger",
     all(
         feature = "enterprise",
@@ -1226,6 +1229,36 @@ pub(crate) async fn tarball_workspace(
             }
         }
 
+        #[cfg(feature = "amqp_trigger")]
+        {
+            use crate::triggers::amqp::AmqpTrigger;
+            let handler = AmqpTrigger;
+            let amqp_triggers = handler.list_triggers(&mut *tx, &w_id, None, None).await?;
+            let parent_modes = fork_parent_trigger_modes(
+                &db,
+                <AmqpTrigger as TriggerCrud>::TABLE_NAME,
+                parent_workspace_id.as_deref(),
+            )
+            .await?;
+
+            for trigger in amqp_triggers {
+                let mode_override = trigger_mode_override(&parent_modes, &trigger.base.path);
+                let trigger_str = &to_string_without_metadata_inner(
+                    &trigger,
+                    ExtraPermsBehavior::Drop,
+                    None,
+                    mode_override.as_ref(),
+                )
+                .unwrap();
+                archive
+                    .write_to_archive(
+                        &trigger_str,
+                        &format!("{}.amqp_trigger.json", trigger.base.path),
+                    )
+                    .await?;
+            }
+        }
+
         #[cfg(all(feature = "enterprise", feature = "smtp", feature = "private"))]
         {
             use crate::triggers::email::EmailTrigger;
diff --git a/backend/windmill-common/src/assets.rs b/backend/windmill-common/src/assets.rs
index 62f6d32070..d1bbed1a18 100644
--- a/backend/windmill-common/src/assets.rs
+++ b/backend/windmill-common/src/assets.rs
@@ -632,6 +632,7 @@ pub fn trigger_spec_to_row(spec: &TriggerSpec) -> Option<(ScriptTriggerKind, Str
         | TriggerSpec::Email
         | TriggerSpec::Kafka
         | TriggerSpec::Mqtt
+        | TriggerSpec::Amqp
         | TriggerSpec::Nats
         | TriggerSpec::Postgres
         | TriggerSpec::Sqs
diff --git a/backend/windmill-common/src/triggers.rs b/backend/windmill-common/src/triggers.rs
index b4f8f472cc..d667363ebb 100644
--- a/backend/windmill-common/src/triggers.rs
+++ b/backend/windmill-common/src/triggers.rs
@@ -39,7 +39,8 @@ pub async fn update_triggers_script_path(
          t3 AS (UPDATE postgres_trigger SET script_path = $1, server_id = NULL WHERE script_path = $2 AND workspace_id = $3 AND is_flow = $4), \
          t4 AS (UPDATE mqtt_trigger SET script_path = $1, server_id = NULL WHERE script_path = $2 AND workspace_id = $3 AND is_flow = $4), \
          t5 AS (UPDATE nats_trigger SET script_path = $1, server_id = NULL WHERE script_path = $2 AND workspace_id = $3 AND is_flow = $4), \
-         t6 AS (UPDATE sqs_trigger SET script_path = $1, server_id = NULL WHERE script_path = $2 AND workspace_id = $3 AND is_flow = $4) \
+         t6 AS (UPDATE sqs_trigger SET script_path = $1, server_id = NULL WHERE script_path = $2 AND workspace_id = $3 AND is_flow = $4), \
+         t7 AS (UPDATE amqp_trigger SET script_path = $1, server_id = NULL WHERE script_path = $2 AND workspace_id = $3 AND is_flow = $4) \
          UPDATE gcp_trigger SET script_path = $1, server_id = NULL WHERE script_path = $2 AND workspace_id = $3 AND is_flow = $4",
         new_path,
         old_path,
diff --git a/backend/windmill-common/src/user_drafts.rs b/backend/windmill-common/src/user_drafts.rs
index 7e0c1f3f55..84a0e8c3ea 100644
--- a/backend/windmill-common/src/user_drafts.rs
+++ b/backend/windmill-common/src/user_drafts.rs
@@ -45,6 +45,7 @@ pub enum UserDraftItemKind {
     TriggerKafka,
     TriggerNats,
     TriggerMqtt,
+    TriggerAmqp,
     TriggerSqs,
     TriggerGcp,
     TriggerAzure,
@@ -80,6 +81,7 @@ impl UserDraftItemKind {
             UserDraftItemKind::TriggerKafka => "trigger_kafka",
             UserDraftItemKind::TriggerNats => "trigger_nats",
             UserDraftItemKind::TriggerMqtt => "trigger_mqtt",
+            UserDraftItemKind::TriggerAmqp => "trigger_amqp",
             UserDraftItemKind::TriggerSqs => "trigger_sqs",
             UserDraftItemKind::TriggerGcp => "trigger_gcp",
             UserDraftItemKind::TriggerAzure => "trigger_azure",
@@ -94,7 +96,7 @@ impl UserDraftItemKind {
 
     /// Every variant, for code that must enumerate kinds (e.g. generating
     /// the `draft_only` existence SQL).
-    pub const ALL: [UserDraftItemKind; 25] = [
+    pub const ALL: [UserDraftItemKind; 26] = [
         UserDraftItemKind::Script,
         UserDraftItemKind::Flow,
         UserDraftItemKind::App,
@@ -111,6 +113,7 @@ impl UserDraftItemKind {
         UserDraftItemKind::TriggerKafka,
         UserDraftItemKind::TriggerNats,
         UserDraftItemKind::TriggerMqtt,
+        UserDraftItemKind::TriggerAmqp,
         UserDraftItemKind::TriggerSqs,
         UserDraftItemKind::TriggerGcp,
         UserDraftItemKind::TriggerAzure,
@@ -144,6 +147,7 @@ impl UserDraftItemKind {
             TriggerKafka => Some("kafka_trigger"),
             TriggerNats => Some("nats_trigger"),
             TriggerMqtt => Some("mqtt_trigger"),
+            TriggerAmqp => Some("amqp_trigger"),
             TriggerSqs => Some("sqs_trigger"),
             TriggerGcp => Some("gcp_trigger"),
             TriggerAzure => Some("azure_trigger"),
diff --git a/backend/windmill-git-sync/src/lib.rs b/backend/windmill-git-sync/src/lib.rs
index b7c714e5c8..cf000244e5 100644
--- a/backend/windmill-git-sync/src/lib.rs
+++ b/backend/windmill-git-sync/src/lib.rs
@@ -93,6 +93,10 @@ pub enum DeployedObject {
         path: String,
         parent_path: Option<String>,
     },
+    AmqpTrigger {
+        path: String,
+        parent_path: Option<String>,
+    },
     SqsTrigger {
         path: String,
         parent_path: Option<String>,
@@ -144,6 +148,7 @@ impl DeployedObject {
             DeployedObject::NatsTrigger { path, .. } => path.to_owned(),
             DeployedObject::PostgresTrigger { path, .. } => path.to_owned(),
             DeployedObject::MqttTrigger { path, .. } => path.to_owned(),
+            DeployedObject::AmqpTrigger { path, .. } => path.to_owned(),
             DeployedObject::SqsTrigger { path, .. } => path.to_owned(),
             DeployedObject::GcpTrigger { path, .. } => path.to_owned(),
             DeployedObject::AzureTrigger { path, .. } => path.to_owned(),
@@ -186,6 +191,7 @@ impl DeployedObject {
             DeployedObject::NatsTrigger { parent_path, .. } => parent_path.to_owned(),
             DeployedObject::PostgresTrigger { parent_path, .. } => parent_path.to_owned(),
             DeployedObject::MqttTrigger { parent_path, .. } => parent_path.to_owned(),
+            DeployedObject::AmqpTrigger { parent_path, .. } => parent_path.to_owned(),
             DeployedObject::SqsTrigger { parent_path, .. } => parent_path.to_owned(),
             DeployedObject::GcpTrigger { parent_path, .. } => parent_path.to_owned(),
             DeployedObject::AzureTrigger { parent_path, .. } => parent_path.to_owned(),
@@ -216,6 +222,7 @@ impl DeployedObject {
             DeployedObject::NatsTrigger { .. } => "nats_trigger",
             DeployedObject::PostgresTrigger { .. } => "postgres_trigger",
             DeployedObject::MqttTrigger { .. } => "mqtt_trigger",
+            DeployedObject::AmqpTrigger { .. } => "amqp_trigger",
             DeployedObject::SqsTrigger { .. } => "sqs_trigger",
             DeployedObject::GcpTrigger { .. } => "gcp_trigger",
             DeployedObject::AzureTrigger { .. } => "azure_trigger",
@@ -446,6 +453,10 @@ mod tests {
             DeployedObject::MqttTrigger { path: "t".to_string(), parent_path: None }.get_kind(),
             "mqtt_trigger"
         );
+        assert_eq!(
+            DeployedObject::AmqpTrigger { path: "t".to_string(), parent_path: None }.get_kind(),
+            "amqp_trigger"
+        );
         assert_eq!(
             DeployedObject::SqsTrigger { path: "t".to_string(), parent_path: None }.get_kind(),
             "sqs_trigger"
diff --git a/backend/windmill-store/Cargo.toml b/backend/windmill-store/Cargo.toml
index fdd82a7e5d..1409e30ebf 100644
--- a/backend/windmill-store/Cargo.toml
+++ b/backend/windmill-store/Cargo.toml
@@ -19,6 +19,7 @@ mcp = ["dep:windmill-mcp", "windmill-mcp/server", "windmill-mcp/auth"]
 http_trigger = []
 postgres_trigger = []
 mqtt_trigger = []
+amqp_trigger = []
 sqs_trigger = []
 gcp_trigger = []
 azure_trigger = []
diff --git a/backend/windmill-store/src/resources.rs b/backend/windmill-store/src/resources.rs
index 5ea1638baf..7a3ca50e73 100644
--- a/backend/windmill-store/src/resources.rs
+++ b/backend/windmill-store/src/resources.rs
@@ -2386,6 +2386,7 @@ async fn update_resource_type(
     feature = "http_trigger",
     feature = "postgres_trigger",
     feature = "mqtt_trigger",
+    feature = "amqp_trigger",
     all(
         feature = "enterprise",
         any(
diff --git a/backend/windmill-trigger-amqp/Cargo.toml b/backend/windmill-trigger-amqp/Cargo.toml
new file mode 100644
index 0000000000..4c5ce41941
--- /dev/null
+++ b/backend/windmill-trigger-amqp/Cargo.toml
@@ -0,0 +1,37 @@
+[package]
+name = "windmill-trigger-amqp"
+version.workspace = true
+authors.workspace = true
+edition.workspace = true
+
+[lib]
+name = "windmill_trigger_amqp"
+path = "src/lib.rs"
+
+[features]
+default = []
+enterprise = ["windmill-common/enterprise", "windmill-store/enterprise", "windmill-trigger/enterprise"]
+private = ["windmill-common/private", "windmill-store/private"]
+
+[dependencies]
+windmill-common = { workspace = true, default-features = false }
+windmill-api-auth.workspace = true
+windmill-store = { workspace = true, features = ["amqp_trigger"] }
+windmill-trigger.workspace = true
+windmill-git-sync.workspace = true
+lapin.workspace = true
+tokio-executor-trait.workspace = true
+tokio-reactor-trait.workspace = true
+futures.workspace = true
+urlencoding.workspace = true
+axum.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+sqlx.workspace = true
+tokio.workspace = true
+tracing.workspace = true
+async-trait.workspace = true
+itertools.workspace = true
+base64.workspace = true
+anyhow.workspace = true
+thiserror.workspace = true
diff --git a/backend/windmill-trigger-amqp/src/handler.rs b/backend/windmill-trigger-amqp/src/handler.rs
new file mode 100644
index 0000000000..48710224df
--- /dev/null
+++ b/backend/windmill-trigger-amqp/src/handler.rs
@@ -0,0 +1,203 @@
+use async_trait::async_trait;
+use sqlx::{types::Json as SqlxJson, PgConnection};
+use windmill_api_auth::ApiAuthed;
+use windmill_common::DB;
+use windmill_common::{
+    db::UserDB,
+    error::{Error, Result},
+};
+use windmill_git_sync::DeployedObject;
+use windmill_store::resources::try_get_resource_from_db_as;
+use windmill_trigger::{Trigger, TriggerCrud, TriggerData};
+
+use super::{
+    AmqpClientBuilder, AmqpConfig, AmqpConfigRequest, AmqpOptions, AmqpResource, AmqpTrigger,
+    ExchangeConfig, TestAmqpConfig,
+};
+
+#[async_trait]
+impl TriggerCrud for AmqpTrigger {
+    type TriggerConfig = AmqpConfig;
+    type Trigger = Trigger<Self::TriggerConfig>;
+    type TriggerConfigRequest = AmqpConfigRequest;
+    type TestConnectionConfig = TestAmqpConfig;
+
+    const TABLE_NAME: &'static str = "amqp_trigger";
+    const TRIGGER_TYPE: &'static str = "amqp";
+    const DRAFT_KIND: windmill_common::user_drafts::UserDraftItemKind =
+        windmill_common::user_drafts::UserDraftItemKind::TriggerAmqp;
+    const SUPPORTS_SERVER_STATE: bool = true;
+    const SUPPORTS_TEST_CONNECTION: bool = true;
+    const ROUTE_PREFIX: &'static str = "/amqp_triggers";
+    const DEPLOYMENT_NAME: &'static str = "AMQP trigger";
+    const ADDITIONAL_SELECT_FIELDS: &[&'static str] =
+        &["amqp_resource_path", "queue_name", "exchange", "options"];
+    const IS_ALLOWED_ON_CLOUD: bool = false;
+
+    fn get_deployed_object(path: String, parent_path: Option<String>) -> DeployedObject {
+        DeployedObject::AmqpTrigger { path, parent_path }
+    }
+
+    async fn validate_config(
+        &self,
+        _db: &DB,
+        config: &Self::TriggerConfigRequest,
+        _workspace_id: &str,
+    ) -> Result<()> {
+        if config.amqp_resource_path.trim().is_empty() {
+            return Err(Error::BadRequest(
+                "AMQP resource path cannot be empty".to_string(),
+            ));
+        }
+
+        if config.queue_name.trim().is_empty() {
+            return Err(Error::BadRequest("Queue name cannot be empty".to_string()));
+        }
+
+        super::validate_amqp_options(config.options.as_ref()).map_err(Error::BadRequest)?;
+
+        Ok(())
+    }
+
+    async fn create_trigger(
+        &self,
+        _db: &DB,
+        tx: &mut PgConnection,
+        authed: &ApiAuthed,
+        w_id: &str,
+        trigger: TriggerData<Self::TriggerConfigRequest>,
+    ) -> Result<()> {
+        let resolved_edited_by = trigger.base.resolve_edited_by(authed);
+        let resolved_permissioned_as = trigger.base.resolve_permissioned_as(authed);
+        let exchange = trigger.config.exchange.map(SqlxJson);
+        let options = trigger.config.options.map(SqlxJson);
+
+        sqlx::query!(
+            r#"
+            INSERT INTO amqp_trigger (
+                amqp_resource_path,
+                queue_name,
+                exchange,
+                options,
+                workspace_id,
+                path,
+                script_path,
+                is_flow,
+                permissioned_as,
+                mode,
+                edited_by,
+                error_handler_path,
+                error_handler_args,
+                retry
+            )
+            VALUES (
+                $1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14
+            )"#,
+            trigger.config.amqp_resource_path,
+            trigger.config.queue_name,
+            exchange as Option<SqlxJson<ExchangeConfig>>,
+            options as Option<SqlxJson<AmqpOptions>>,
+            w_id,
+            trigger.base.path,
+            trigger.base.script_path,
+            trigger.base.is_flow,
+            resolved_permissioned_as,
+            trigger.base.mode() as _,
+            &resolved_edited_by,
+            trigger.error_handling.error_handler_path,
+            trigger.error_handling.error_handler_args as _,
+            trigger.error_handling.retry as _
+        )
+        .execute(tx)
+        .await?;
+
+        Ok(())
+    }
+
+    async fn update_trigger(
+        &self,
+        _db: &DB,
+        tx: &mut PgConnection,
+        authed: &ApiAuthed,
+        workspace_id: &str,
+        path: &str,
+        trigger: TriggerData<Self::TriggerConfigRequest>,
+    ) -> Result<()> {
+        let resolved_edited_by = trigger.base.resolve_edited_by(authed);
+        let resolved_permissioned_as = trigger.base.resolve_permissioned_as(authed);
+        let exchange = trigger.config.exchange.map(SqlxJson);
+        let options = trigger.config.options.map(SqlxJson);
+
+        // Important to set server_id to NULL to stop the current amqp listener
+        sqlx::query!(
+            r#"
+            UPDATE
+                amqp_trigger
+            SET
+                amqp_resource_path = $1,
+                queue_name = $2,
+                exchange = $3,
+                options = $4,
+                is_flow = $5,
+                edited_by = $6,
+                permissioned_as = $7,
+                script_path = $8,
+                path = $9,
+                edited_at = now(),
+                error = NULL,
+                server_id = NULL,
+                error_handler_path = $12,
+                error_handler_args = $13,
+                retry = $14
+            WHERE
+                workspace_id = $10 AND
+                path = $11
+            "#,
+            trigger.config.amqp_resource_path,
+            trigger.config.queue_name,
+            exchange as Option<SqlxJson<ExchangeConfig>>,
+            options as Option<SqlxJson<AmqpOptions>>,
+            trigger.base.is_flow,
+            &resolved_edited_by,
+            resolved_permissioned_as,
+            trigger.base.script_path,
+            trigger.base.path,
+            workspace_id,
+            path,
+            trigger.error_handling.error_handler_path,
+            trigger.error_handling.error_handler_args as _,
+            trigger.error_handling.retry as _
+        )
+        .execute(tx)
+        .await?;
+
+        Ok(())
+    }
+
+    async fn test_connection(
+        &self,
+        db: &DB,
+        authed: &ApiAuthed,
+        user_db: &UserDB,
+        workspace_id: &str,
+        config: Self::TestConnectionConfig,
+    ) -> Result<()> {
+        let amqp_resource = try_get_resource_from_db_as::<AmqpResource>(
+            authed,
+            Some(user_db.clone()),
+            db,
+            &config.amqp_resource_path,
+            workspace_id,
+        )
+        .await?;
+
+        let client_builder = AmqpClientBuilder::new(amqp_resource, "", None, None);
+
+        client_builder
+            .test_connection()
+            .await
+            .map_err(|err| Error::BadConfig(format!("Error connecting to AMQP broker: {}", err)))?;
+
+        Ok(())
+    }
+}
diff --git a/backend/windmill-trigger-amqp/src/lib.rs b/backend/windmill-trigger-amqp/src/lib.rs
new file mode 100644
index 0000000000..24ca19036d
--- /dev/null
+++ b/backend/windmill-trigger-amqp/src/lib.rs
@@ -0,0 +1,341 @@
+use base64::engine;
+use base64::prelude::*;
+use lapin::{
+    options::{BasicConsumeOptions, BasicQosOptions, QueueBindOptions, QueueDeclareOptions},
+    types::FieldTable,
+    Channel, Connection, ConnectionProperties, Consumer,
+};
+use serde::{Deserialize, Serialize};
+use serde_json::value::RawValue;
+use sqlx::{types::Json as SqlxJson, FromRow};
+use std::collections::HashMap;
+use windmill_common::{error::Error, triggers::TriggerKind, worker::to_raw_value};
+
+use windmill_trigger::trigger_helpers::TriggerJobArgs;
+
+pub mod handler;
+pub mod listener;
+
+#[derive(Clone, Copy)]
+pub struct AmqpTrigger;
+
+impl TriggerJobArgs for AmqpTrigger {
+    type Payload = Vec<u8>;
+    const TRIGGER_KIND: TriggerKind = TriggerKind::Amqp;
+
+    fn v1_payload_fn(payload: &Self::Payload) -> HashMap<String, Box<RawValue>> {
+        HashMap::from([("payload".to_string(), to_raw_value(&payload))])
+    }
+
+    fn v2_payload_fn(payload: &Self::Payload) -> HashMap<String, Box<RawValue>> {
+        let base64_payload = engine::general_purpose::STANDARD.encode(payload);
+        HashMap::from([("payload".to_string(), to_raw_value(&base64_payload))])
+    }
+}
+
+#[derive(Debug, Deserialize)]
+pub struct AmqpResource {
+    pub host: String,
+    pub port: Option<u16>,
+    pub username: Option<String>,
+    pub password: Option<String>,
+    pub vhost: Option<String>,
+    pub tls: Option<bool>,
+}
+
+/// Binding of the consumed queue to an exchange. When present, the queue is bound
+/// to `exchange_name` for each routing key so messages published to the exchange
+/// are routed to it.
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct ExchangeConfig {
+    pub exchange_name: String,
+    #[serde(default)]
+    pub routing_keys: Vec<String>,
+}
+
+#[derive(Clone, Debug, Default, Serialize, Deserialize)]
+pub struct AmqpOptions {
+    /// Declare the queue (durable) before consuming. When false the queue is
+    /// declared passively, i.e. it must already exist on the broker.
+    pub declare_queue: Option<bool>,
+    /// Maximum number of unacknowledged messages the broker delivers at once.
+    pub prefetch_count: Option<u16>,
+}
+
+/// Shared validation for AMQP options used by both the CRUD handler and the
+/// consumer builder (which also covers capture configs, that bypass CRUD
+/// validation). RabbitMQ treats prefetch 0 as unlimited (unbounded consumer
+/// buffer), so a set prefetch must be at least 1.
+pub fn validate_amqp_options(options: Option<&AmqpOptions>) -> Result<(), String> {
+    if options.and_then(|o| o.prefetch_count) == Some(0) {
+        return Err("Prefetch count must be at least 1".to_string());
+    }
+    Ok(())
+}
+
+#[derive(Debug, Clone, FromRow, Serialize, Deserialize)]
+pub struct AmqpConfig {
+    pub amqp_resource_path: String,
+    pub queue_name: String,
+    pub exchange: Option<SqlxJson<ExchangeConfig>>,
+    pub options: Option<SqlxJson<AmqpOptions>>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct AmqpConfigRequest {
+    pub amqp_resource_path: String,
+    pub queue_name: String,
+    pub exchange: Option<ExchangeConfig>,
+    pub options: Option<AmqpOptions>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct TestAmqpConfig {
+    pub amqp_resource_path: String,
+}
+
+#[derive(Debug, thiserror::Error)]
+pub enum AmqpError {
+    #[error("{0}")]
+    Common(#[from] Error),
+    #[error("{0}")]
+    Lapin(#[from] lapin::Error),
+}
+
+/// Consumer bundle. The connection and channel are kept alive for as long as the
+/// consumer stream is polled: dropping them would tear down the AMQP consumer.
+pub struct AmqpConsumer {
+    pub connection: Connection,
+    pub channel: Channel,
+    pub consumer: Consumer,
+    pub queue_name: String,
+}
+
+pub const CONSUMER_TAG: &str = "windmill";
+
+fn build_uri(resource: &AmqpResource) -> String {
+    let tls = resource.tls.unwrap_or(false);
+    let scheme = if tls { "amqps" } else { "amqp" };
+    let port = resource.port.unwrap_or(if tls { 5671 } else { 5672 });
+
+    let credentials = match (resource.username.as_deref(), resource.password.as_deref()) {
+        (Some(user), password) if !user.is_empty() => format!(
+            "{}:{}@",
+            urlencoding::encode(user),
+            urlencoding::encode(password.unwrap_or("")),
+        ),
+        _ => String::new(),
+    };
+
+    // The URI path is the virtual host and must be percent-encoded; the default
+    // vhost "/" therefore becomes "%2F". An empty vhost also falls back to "/".
+    let vhost = match resource.vhost.as_deref() {
+        Some(v) if !v.is_empty() => v,
+        _ => "/",
+    };
+    let vhost_encoded = urlencoding::encode(vhost);
+
+    // Bracket an IPv6 literal host so `host:port` parses correctly.
+    let host = if resource.host.contains(':') && !resource.host.starts_with('[') {
+        format!("[{}]", resource.host)
+    } else {
+        resource.host.clone()
+    };
+
+    format!(
+        "{}://{}{}:{}/{}",
+        scheme, credentials, host, port, vhost_encoded
+    )
+}
+
+fn connection_properties() -> ConnectionProperties {
+    ConnectionProperties::default()
+        .with_executor(tokio_executor_trait::Tokio::current())
+        .with_reactor(tokio_reactor_trait::Tokio)
+}
+
+pub struct AmqpClientBuilder<'client> {
+    resource: AmqpResource,
+    queue_name: &'client str,
+    exchange: Option<&'client ExchangeConfig>,
+    options: Option<&'client AmqpOptions>,
+}
+
+impl<'client> AmqpClientBuilder<'client> {
+    pub fn new(
+        resource: AmqpResource,
+        queue_name: &'client str,
+        exchange: Option<&'client ExchangeConfig>,
+        options: Option<&'client AmqpOptions>,
+    ) -> Self {
+        Self { resource, queue_name, exchange, options }
+    }
+
+    async fn connect(&self) -> Result<Connection, AmqpError> {
+        let uri = build_uri(&self.resource);
+        let connection = Connection::connect(&uri, connection_properties()).await?;
+        Ok(connection)
+    }
+
+    /// Establish a connection and open a channel to verify the broker is reachable
+    /// with the provided credentials.
+    pub async fn test_connection(&self) -> Result<(), AmqpError> {
+        let connection = self.connect().await?;
+        connection.create_channel().await?;
+        Ok(())
+    }
+
+    pub async fn build_consumer(&self) -> Result<AmqpConsumer, AmqpError> {
+        let connection = self.connect().await?;
+        let channel = connection.create_channel().await?;
+
+        validate_amqp_options(self.options).map_err(|e| AmqpError::Common(Error::BadConfig(e)))?;
+        if let Some(prefetch_count) = self.options.and_then(|o| o.prefetch_count) {
+            channel
+                .basic_qos(prefetch_count, BasicQosOptions::default())
+                .await?;
+        }
+
+        let declare_queue = self.options.and_then(|o| o.declare_queue).unwrap_or(true);
+
+        let queue_declare_options = QueueDeclareOptions {
+            passive: !declare_queue,
+            durable: declare_queue,
+            exclusive: false,
+            auto_delete: false,
+            nowait: false,
+        };
+
+        channel
+            .queue_declare(
+                self.queue_name,
+                queue_declare_options,
+                FieldTable::default(),
+            )
+            .await?;
+
+        if let Some(exchange) = self.exchange {
+            if !exchange.exchange_name.trim().is_empty() {
+                // Bind the queue for every routing key; an empty list binds once
+                // with an empty routing key (fanout exchanges ignore it anyway).
+                let routing_keys = if exchange.routing_keys.is_empty() {
+                    vec![String::new()]
+                } else {
+                    exchange.routing_keys.clone()
+                };
+                for routing_key in routing_keys {
+                    channel
+                        .queue_bind(
+                            self.queue_name,
+                            &exchange.exchange_name,
+                            &routing_key,
+                            QueueBindOptions::default(),
+                            FieldTable::default(),
+                        )
+                        .await?;
+                }
+            }
+        }
+
+        let consumer = channel
+            .basic_consume(
+                self.queue_name,
+                CONSUMER_TAG,
+                BasicConsumeOptions::default(),
+                FieldTable::default(),
+            )
+            .await?;
+
+        Ok(AmqpConsumer { connection, channel, consumer, queue_name: self.queue_name.to_string() })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn resource(
+        host: &str,
+        port: Option<u16>,
+        username: Option<&str>,
+        password: Option<&str>,
+        vhost: Option<&str>,
+        tls: Option<bool>,
+    ) -> AmqpResource {
+        AmqpResource {
+            host: host.to_string(),
+            port,
+            username: username.map(str::to_string),
+            password: password.map(str::to_string),
+            vhost: vhost.map(str::to_string),
+            tls,
+        }
+    }
+
+    #[test]
+    fn build_uri_defaults_encode_root_vhost_and_pick_plaintext_port() {
+        let uri = build_uri(&resource("broker", None, None, None, None, None));
+        assert_eq!(uri, "amqp://broker:5672/%2F");
+    }
+
+    #[test]
+    fn build_uri_tls_picks_amqps_and_5671() {
+        let uri = build_uri(&resource("broker", None, None, None, None, Some(true)));
+        assert_eq!(uri, "amqps://broker:5671/%2F");
+    }
+
+    #[test]
+    fn build_uri_encodes_credentials_and_custom_vhost() {
+        let uri = build_uri(&resource(
+            "broker",
+            Some(5673),
+            Some("us er"),
+            Some("p@ss/word"),
+            Some("my/vhost"),
+            None,
+        ));
+        assert_eq!(uri, "amqp://us%20er:p%40ss%2Fword@broker:5673/my%2Fvhost");
+    }
+
+    #[test]
+    fn build_uri_omits_credentials_when_username_empty() {
+        let uri = build_uri(&resource(
+            "broker",
+            None,
+            Some(""),
+            Some("secret"),
+            None,
+            None,
+        ));
+        assert_eq!(uri, "amqp://broker:5672/%2F");
+    }
+
+    #[test]
+    fn build_uri_blank_vhost_falls_back_to_root() {
+        let uri = build_uri(&resource("broker", None, None, None, Some(""), None));
+        assert_eq!(uri, "amqp://broker:5672/%2F");
+    }
+
+    #[test]
+    fn build_uri_brackets_ipv6_host() {
+        let uri = build_uri(&resource("::1", Some(5672), None, None, None, None));
+        assert_eq!(uri, "amqp://[::1]:5672/%2F");
+    }
+
+    fn options(prefetch: Option<u16>) -> AmqpOptions {
+        AmqpOptions { declare_queue: None, prefetch_count: prefetch }
+    }
+
+    #[test]
+    fn validate_amqp_options_rejects_zero_prefetch() {
+        assert!(validate_amqp_options(Some(&options(Some(0)))).is_err());
+    }
+
+    #[test]
+    fn validate_amqp_options_accepts_valid_prefetch_and_none() {
+        assert!(validate_amqp_options(Some(&options(Some(1)))).is_ok());
+        assert!(validate_amqp_options(Some(&options(Some(65535)))).is_ok());
+        assert!(validate_amqp_options(Some(&options(None))).is_ok());
+        assert!(validate_amqp_options(None).is_ok());
+    }
+}
diff --git a/backend/windmill-trigger-amqp/src/listener.rs b/backend/windmill-trigger-amqp/src/listener.rs
new file mode 100644
index 0000000000..347eb94b28
--- /dev/null
+++ b/backend/windmill-trigger-amqp/src/listener.rs
@@ -0,0 +1,255 @@
+use std::{collections::HashMap, sync::Arc, time::Duration};
+
+use async_trait::async_trait;
+use futures::StreamExt;
+use lapin::options::{BasicAckOptions, BasicNackOptions};
+use tokio::sync::RwLock;
+use windmill_common::{
+    db::UserDB,
+    error::{Error, Result},
+    jobs::JobTriggerKind,
+    utils::{report_critical_error, report_recovered_critical_error},
+    worker::to_raw_value,
+    DB,
+};
+
+use windmill_store::resources::try_get_resource_from_db_as;
+use windmill_trigger::listener::ListeningTrigger;
+use windmill_trigger::trigger_helpers::TriggerJobArgs;
+use windmill_trigger::Listener;
+
+use super::{AmqpClientBuilder, AmqpConfig, AmqpConsumer, AmqpResource, AmqpTrigger};
+
+// lapin (like rdkafka) has no transparent reconnect, so — mirroring the Kafka
+// trigger — the connection is (re)established in `consume` with a backoff retry
+// loop rather than disabling the trigger on a transient broker outage.
+const RECONNECT_BACKOFF_SECS: u64 = 30;
+// Back off after a failed dispatch so a poison message that always fails can't
+// spin a tight redelivery loop; the connection stays up for other messages.
+const DISPATCH_FAILURE_BACKOFF_SECS: u64 = 5;
+
+impl AmqpTrigger {
+    async fn build_amqp_consumer(
+        &self,
+        db: &DB,
+        listening_trigger: &ListeningTrigger<AmqpConfig>,
+    ) -> Result<AmqpConsumer> {
+        let AmqpConfig { amqp_resource_path, queue_name, exchange, options } =
+            &listening_trigger.trigger_config;
+
+        let authed = listening_trigger
+            .authed(db, &Self::TRIGGER_KIND.to_string())
+            .await?;
+
+        let amqp_resource = try_get_resource_from_db_as::<AmqpResource>(
+            &authed,
+            Some(UserDB::new(db.clone())),
+            db,
+            amqp_resource_path,
+            &listening_trigger.workspace_id,
+        )
+        .await?;
+
+        let client_builder = AmqpClientBuilder::new(
+            amqp_resource,
+            queue_name,
+            exchange.as_ref().map(|e| &e.0),
+            options.as_ref().map(|o| &o.0),
+        );
+
+        client_builder
+            .build_consumer()
+            .await
+            .map_err(|e| Error::BadConfig(format!("Failed to build AMQP consumer: {}", e)))
+    }
+}
+
+#[async_trait]
+impl Listener for AmqpTrigger {
+    type Consumer = ();
+    type Extra = ();
+    type ExtraState = ();
+    const JOB_TRIGGER_KIND: JobTriggerKind = JobTriggerKind::Amqp;
+
+    async fn get_consumer(
+        &self,
+        _db: &DB,
+        _listening_trigger: &ListeningTrigger<Self::TriggerConfig>,
+        _err_message: Arc<RwLock<Option<String>>>,
+        _killpill_rx: tokio::sync::broadcast::Receiver<()>,
+    ) -> Result<Option<Self::Consumer>> {
+        // The connection is established (and re-established) in `consume` so that
+        // a transient broker outage retries with backoff instead of disabling the
+        // trigger — mirroring the Kafka trigger, whose client also lacks a
+        // transparent reconnect.
+        Ok(Some(()))
+    }
+
+    async fn consume(
+        &self,
+        db: &DB,
+        _consumer: Self::Consumer,
+        listening_trigger: &ListeningTrigger<Self::TriggerConfig>,
+        err_message: Arc<RwLock<Option<String>>>,
+        _killpill_rx: tokio::sync::broadcast::Receiver<()>,
+        _extra_state: Option<&Self::ExtraState>,
+    ) {
+        let path = &listening_trigger.path;
+        let workspace_id = &listening_trigger.workspace_id;
+        let alert_id = format!("amqp_trigger:{}", path);
+        let mut tries = 0_usize;
+
+        // (Re)connect loop: retries forever with backoff; the framework's
+        // `select!` around `consume` cancels it on killpill, and
+        // `update_ping_and_loop_ping_status` returning None (trigger removed /
+        // disabled / capture stopped) breaks us out.
+        loop {
+            let mut consumer = match self.build_amqp_consumer(db, listening_trigger).await {
+                Ok(consumer) => consumer,
+                Err(e) => {
+                    let status = format!(
+                        "Failed to connect (attempt {}), retrying in {}s: {}",
+                        tries + 1,
+                        RECONNECT_BACKOFF_SECS,
+                        e
+                    );
+                    if self
+                        .update_ping_and_loop_ping_status(
+                            db,
+                            listening_trigger,
+                            err_message.clone(),
+                            Some(status),
+                        )
+                        .await
+                        .is_none()
+                    {
+                        return;
+                    }
+                    tracing::error!(
+                        "AMQP trigger {} failed to connect (attempt {}): {}",
+                        path,
+                        tries + 1,
+                        e
+                    );
+                    if tries % 10 == 0 && listening_trigger.trigger_mode {
+                        report_critical_error(
+                            format!(
+                                "Failed to connect AMQP trigger {} (attempt {}), retrying every {}s. This alert repeats every 10 failed attempts. Error: {}",
+                                path, tries + 1, RECONNECT_BACKOFF_SECS, e
+                            ),
+                            db.clone(),
+                            Some(workspace_id),
+                            Some(&alert_id),
+                        )
+                        .await;
+                    }
+                    tries += 1;
+                    tokio::time::sleep(Duration::from_secs(RECONNECT_BACKOFF_SECS)).await;
+                    continue;
+                }
+            };
+
+            // Connected: clear any "reconnecting" status.
+            if self
+                .update_ping_and_loop_ping_status(db, listening_trigger, err_message.clone(), None)
+                .await
+                .is_none()
+            {
+                return;
+            }
+            if tries > 0 {
+                tracing::info!("AMQP trigger {} reconnected after {} attempts", path, tries);
+                if listening_trigger.trigger_mode {
+                    report_recovered_critical_error(
+                        format!("AMQP trigger {} reconnected", path),
+                        db.clone(),
+                        Some(workspace_id),
+                        Some(&alert_id),
+                    )
+                    .await;
+                }
+                tries = 0;
+            }
+
+            // Consume until the stream errors, then break out to reconnect.
+            loop {
+                match consumer.consumer.next().await {
+                    Some(Ok(delivery)) => {
+                        let trigger_info = HashMap::from([
+                            (
+                                "exchange".to_string(),
+                                to_raw_value(&delivery.exchange.as_str()),
+                            ),
+                            (
+                                "routing_key".to_string(),
+                                to_raw_value(&delivery.routing_key.as_str()),
+                            ),
+                            ("queue_name".to_string(), to_raw_value(&consumer.queue_name)),
+                            (
+                                "redelivered".to_string(),
+                                to_raw_value(&delivery.redelivered),
+                            ),
+                            (
+                                "delivery_tag".to_string(),
+                                to_raw_value(&delivery.delivery_tag),
+                            ),
+                        ]);
+
+                        let dispatched = self
+                            .handle_event(
+                                db,
+                                listening_trigger,
+                                delivery.data.clone(),
+                                trigger_info,
+                                None,
+                            )
+                            .await;
+
+                        // Only ack once the job/capture was dispatched. On failure
+                        // nack with requeue so the broker redelivers rather than
+                        // dropping the message (at-least-once).
+                        let dispatch_failed = dispatched.is_err();
+                        let ack_result = if dispatch_failed {
+                            delivery
+                                .acker
+                                .nack(BasicNackOptions { requeue: true, multiple: false })
+                                .await
+                        } else {
+                            delivery.acker.ack(BasicAckOptions::default()).await
+                        };
+
+                        if let Err(err) = ack_result {
+                            // Channel is gone; break out to reconnect.
+                            tracing::warn!(
+                                "AMQP trigger {} ack/nack failed, reconnecting: {}",
+                                path,
+                                err
+                            );
+                            break;
+                        }
+
+                        if dispatch_failed {
+                            // The message was requeued: back off before consuming
+                            // again so a poison message can't spin a tight
+                            // redelivery loop, while keeping the connection alive.
+                            tokio::time::sleep(Duration::from_secs(DISPATCH_FAILURE_BACKOFF_SECS))
+                                .await;
+                        }
+                    }
+                    Some(Err(err)) => {
+                        tracing::warn!(
+                            "AMQP trigger {} consumer error, reconnecting: {}",
+                            path,
+                            err
+                        );
+                        break;
+                    }
+                    None => {
+                        tracing::warn!("AMQP trigger {} consumer stream ended, reconnecting", path);
+                        break;
+                    }
+                }
+            }
+        }
+    }
+}
diff --git a/backend/windmill-trigger/src/trigger_helpers.rs b/backend/windmill-trigger/src/trigger_helpers.rs
index 1427f7f102..e0bfaf3d34 100644
--- a/backend/windmill-trigger/src/trigger_helpers.rs
+++ b/backend/windmill-trigger/src/trigger_helpers.rs
@@ -140,7 +140,7 @@ fn runnable_format_from_schema_without_preprocessor(
     schema: Option<sqlx::types::Json<PartialSchema>>,
 ) -> RunnableFormat {
     match trigger_kind {
-        TriggerKind::Mqtt
+        TriggerKind::Mqtt | TriggerKind::Amqp
             if schema.as_ref().is_some_and(|schema| {
                 schema.properties.as_ref().is_some_and(|properties| {
                     properties.iter().any(|(key, def)| {
diff --git a/backend/windmill-types/src/jobs.rs b/backend/windmill-types/src/jobs.rs
index 95ac69bc2c..79b33f86ac 100644
--- a/backend/windmill-types/src/jobs.rs
+++ b/backend/windmill-types/src/jobs.rs
@@ -32,6 +32,7 @@ pub enum JobTriggerKind {
     Email,
     Nats,
     Mqtt,
+    Amqp,
     Sqs,
     Postgres,
     Schedule,
@@ -66,6 +67,7 @@ impl std::fmt::Display for JobTriggerKind {
             JobTriggerKind::Email => "email",
             JobTriggerKind::Nats => "nats",
             JobTriggerKind::Mqtt => "mqtt",
+            JobTriggerKind::Amqp => "amqp",
             JobTriggerKind::Sqs => "sqs",
             JobTriggerKind::Postgres => "postgres",
             JobTriggerKind::Schedule => "schedule",
diff --git a/backend/windmill-types/src/triggers.rs b/backend/windmill-types/src/triggers.rs
index 8ad1d5e8a7..e7c398b1f2 100644
--- a/backend/windmill-types/src/triggers.rs
+++ b/backend/windmill-types/src/triggers.rs
@@ -16,6 +16,7 @@ pub enum TriggerKind {
     Email,
     Nats,
     Mqtt,
+    Amqp,
     Sqs,
     Postgres,
     Gcp,
@@ -36,6 +37,7 @@ impl TriggerKind {
             TriggerKind::DefaultEmail => "email".to_string(),
             TriggerKind::Nats => "nats".to_string(),
             TriggerKind::Mqtt => "mqtt".to_string(),
+            TriggerKind::Amqp => "amqp".to_string(),
             TriggerKind::Sqs => "sqs".to_string(),
             TriggerKind::Postgres => "postgres".to_string(),
             TriggerKind::Gcp => "gcp".to_string(),
@@ -58,6 +60,7 @@ impl fmt::Display for TriggerKind {
             TriggerKind::DefaultEmail => "default_email",
             TriggerKind::Nats => "nats",
             TriggerKind::Mqtt => "mqtt",
+            TriggerKind::Amqp => "amqp",
             TriggerKind::Sqs => "sqs",
             TriggerKind::Postgres => "postgres",
             TriggerKind::Gcp => "gcp",
diff --git a/cli/src/commands/pipeline/boundedCascade.ts b/cli/src/commands/pipeline/boundedCascade.ts
index 69166726c5..57130ba129 100644
--- a/cli/src/commands/pipeline/boundedCascade.ts
+++ b/cli/src/commands/pipeline/boundedCascade.ts
@@ -71,6 +71,7 @@ const assetNodeId = (kind: string, path: string): string => `${kind}:${path}`;
 const NON_AUTORUN_TRIGGER_KINDS = new Set([
   "kafka",
   "mqtt",
+  "amqp",
   "nats",
   "postgres",
   "sqs",
diff --git a/cli/src/commands/pipeline/localGraph.ts b/cli/src/commands/pipeline/localGraph.ts
index eb3350c818..be5c8f1567 100644
--- a/cli/src/commands/pipeline/localGraph.ts
+++ b/cli/src/commands/pipeline/localGraph.ts
@@ -259,6 +259,7 @@ const NATIVE_KINDS = new Set([
   "email",
   "kafka",
   "mqtt",
+  "amqp",
   "nats",
   "postgres",
   "sqs",
diff --git a/cli/src/commands/sync/sync.ts b/cli/src/commands/sync/sync.ts
index 7a78623870..29d83862e4 100644
--- a/cli/src/commands/sync/sync.ts
+++ b/cli/src/commands/sync/sync.ts
@@ -1717,6 +1717,7 @@ export async function elementsToMap(
         path.endsWith(".nats_trigger" + ext) ||
         path.endsWith(".postgres_trigger" + ext) ||
         path.endsWith(".mqtt_trigger" + ext) ||
+        path.endsWith(".amqp_trigger" + ext) ||
         path.endsWith(".sqs_trigger" + ext) ||
         path.endsWith(".gcp_trigger" + ext) ||
         path.endsWith(".azure_trigger" + ext) ||
@@ -2470,6 +2471,7 @@ function getOrderFromPath(p: string) {
     typ == "nats_trigger" ||
     typ == "postgres_trigger" ||
     typ == "mqtt_trigger" ||
+    typ == "amqp_trigger" ||
     typ == "sqs_trigger" ||
     typ == "gcp_trigger" ||
     typ == "azure_trigger" ||
@@ -4237,7 +4239,7 @@ export async function push(
           }
         }
         const rules = folderRulesCache.get(folderName)!;
-        const remotePath = change.path.replace(/\.(script|schedule|http_trigger|websocket_trigger|kafka_trigger|nats_trigger|postgres_trigger|mqtt_trigger|sqs_trigger|gcp_trigger|azure_trigger|email_trigger)\.(yaml|json)$/, "").replace(/(\.flow|__flow)\/flow\.(yaml|json)$/, "").replace(/\.(app|raw_app)(\/app\.(yaml|json))?$/, "");
+        const remotePath = change.path.replace(/\.(script|schedule|http_trigger|websocket_trigger|kafka_trigger|nats_trigger|postgres_trigger|mqtt_trigger|amqp_trigger|sqs_trigger|gcp_trigger|azure_trigger|email_trigger)\.(yaml|json)$/, "").replace(/(\.flow|__flow)\/flow\.(yaml|json)$/, "").replace(/\.(app|raw_app)(\/app\.(yaml|json))?$/, "");
         const relative = remotePath.slice(`f/${folderName}/`.length);
         if (!relative) continue;
         for (const rule of rules) {
@@ -4931,6 +4933,12 @@ export async function push(
                     path: removeSuffix(target, ".mqtt_trigger.json"),
                   });
                   break;
+                case "amqp_trigger":
+                  await wmill.deleteAmqpTrigger({
+                    workspace: workspaceId,
+                    path: removeSuffix(target, ".amqp_trigger.json"),
+                  });
+                  break;
                 case "sqs_trigger":
                   await wmill.deleteSqsTrigger({
                     workspace: workspaceId,
diff --git a/cli/src/commands/trigger/trigger.ts b/cli/src/commands/trigger/trigger.ts
index 1cadc8d9d2..83b62f9eb4 100644
--- a/cli/src/commands/trigger/trigger.ts
+++ b/cli/src/commands/trigger/trigger.ts
@@ -9,6 +9,7 @@ import {
   HttpTrigger,
   KafkaTrigger,
   MqttTrigger,
+  AmqpTrigger,
   NatsTrigger,
   PostgresTrigger,
   SqsTrigger,
@@ -48,6 +49,7 @@ type Trigger = {
   nats: NatsTrigger;
   postgres: PostgresTrigger;
   mqtt: MqttTrigger;
+  amqp: AmqpTrigger;
   sqs: SqsTrigger;
   gcp: GcpTrigger;
   azure: AzureTrigger;
@@ -84,6 +86,7 @@ async function getTrigger<K extends TriggerType>(
     nats: wmill.getNatsTrigger,
     postgres: wmill.getPostgresTrigger,
     mqtt: wmill.getMqttTrigger,
+    amqp: wmill.getAmqpTrigger,
     sqs: wmill.getSqsTrigger,
     gcp: wmill.getGcpTrigger,
     azure: wmill.getAzureTrigger,
@@ -114,6 +117,7 @@ async function updateTrigger<K extends TriggerType>(
     nats: wmill.updateNatsTrigger,
     postgres: wmill.updatePostgresTrigger,
     mqtt: wmill.updateMqttTrigger,
+    amqp: wmill.updateAmqpTrigger,
     sqs: wmill.updateSqsTrigger,
     gcp: wmill.updateGcpTrigger,
     azure: wmill.updateAzureTrigger,
@@ -142,6 +146,7 @@ async function createTrigger<K extends TriggerType>(
     nats: wmill.createNatsTrigger,
     postgres: wmill.createPostgresTrigger,
     mqtt: wmill.createMqttTrigger,
+    amqp: wmill.createAmqpTrigger,
     sqs: wmill.createSqsTrigger,
     gcp: wmill.createGcpTrigger,
     azure: wmill.createAzureTrigger,
@@ -381,6 +386,13 @@ const triggerTemplates: Record<TriggerType, Record<string, any>> = {
     subscribe_topics: [],
     enabled: false,
   },
+  amqp: {
+    script_path: "",
+    is_flow: false,
+    amqp_resource_path: "",
+    queue_name: "",
+    enabled: false,
+  },
   sqs: {
     script_path: "",
     is_flow: false,
@@ -536,6 +548,7 @@ async function list(opts: GlobalOptions & { json?: boolean }) {
     natsTriggers,
     postgresTriggers,
     mqttTriggers,
+    amqpTriggers,
     sqsTriggers,
     gcpTriggers,
     azureTriggers,
@@ -547,6 +560,7 @@ async function list(opts: GlobalOptions & { json?: boolean }) {
     listOrEmpty(() => wmill.listNatsTriggers({ workspace: ws })),
     listOrEmpty(() => wmill.listPostgresTriggers({ workspace: ws })),
     listOrEmpty(() => wmill.listMqttTriggers({ workspace: ws })),
+    listOrEmpty(() => wmill.listAmqpTriggers({ workspace: ws })),
     listOrEmpty(() => wmill.listSqsTriggers({ workspace: ws })),
     listOrEmpty(() => wmill.listGcpTriggers({ workspace: ws })),
     listOrEmpty(() => wmill.listAzureTriggers({ workspace: ws })),
@@ -559,6 +573,7 @@ async function list(opts: GlobalOptions & { json?: boolean }) {
     ...natsTriggers.map((x) => ({ path: x.path, kind: "nats" })),
     ...postgresTriggers.map((x) => ({ path: x.path, kind: "postgres" })),
     ...mqttTriggers.map((x) => ({ path: x.path, kind: "mqtt" })),
+    ...amqpTriggers.map((x) => ({ path: x.path, kind: "amqp" })),
     ...sqsTriggers.map((x) => ({ path: x.path, kind: "sqs" })),
     ...gcpTriggers.map((x) => ({ path: x.path, kind: "gcp" })),
     ...azureTriggers.map((x) => ({ path: x.path, kind: "azure" })),
@@ -643,11 +658,11 @@ const command = new Command()
   .command("get", "get a trigger's details")
   .arguments("<path:string>")
   .option("--json", "Output as JSON (for piping to jq)")
-  .option("--kind <kind:string>", "Trigger kind (http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, azure, email). Recommended for faster lookup")
+  .option("--kind <kind:string>", "Trigger kind (http, websocket, kafka, nats, postgres, mqtt, amqp, sqs, gcp, azure, email). Recommended for faster lookup")
   .action(get as any)
   .command("new", "create a new trigger locally")
   .arguments("<path:string>")
-  .option("--kind <kind:string>", "Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, azure, email)")
+  .option("--kind <kind:string>", "Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, amqp, sqs, gcp, azure, email)")
   .action(newTrigger as any)
   .command(
     "push",
@@ -662,7 +677,7 @@ const command = new Command()
   .arguments("<path:string> <email:string>")
   .option(
     "--kind <kind:string>",
-    "Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, azure, email)"
+    "Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, amqp, sqs, gcp, azure, email)"
   )
   .action((async (opts: any, triggerPath: string, email: string) => {
     const workspace = await resolveWorkspace(opts);
diff --git a/cli/src/guidance/core.ts b/cli/src/guidance/core.ts
index ae8a3f20ee..c43ff8c6c0 100644
--- a/cli/src/guidance/core.ts
+++ b/cli/src/guidance/core.ts
@@ -89,7 +89,7 @@ When a new app needs to be created, YOU run \`wmill app new\` yourself with \`--
 
 ## Triggers
 
-You MUST use the \`triggers\` skill to configure HTTP routes, WebSocket, Kafka, NATS, SQS, MQTT, GCP, Azure, Email, or Postgres CDC triggers.
+You MUST use the \`triggers\` skill to configure HTTP routes, WebSocket, Kafka, NATS, SQS, MQTT, AMQP, GCP, Azure, Email, or Postgres CDC triggers.
 
 ## Schedules
 
diff --git a/cli/src/guidance/skills.gen.ts b/cli/src/guidance/skills.gen.ts
index bdeeda6bf3..69e4338d22 100644
--- a/cli/src/guidance/skills.gen.ts
+++ b/cli/src/guidance/skills.gen.ts
@@ -7232,12 +7232,12 @@ trigger related commands
   - \`--json\` - Output as JSON (for piping to jq)
 - \`trigger get <path:string>\` - get a trigger's details
   - \`--json\` - Output as JSON (for piping to jq)
-  - \`--kind <kind:string>\` - Trigger kind (http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, azure, email). Recommended for faster lookup
+  - \`--kind <kind:string>\` - Trigger kind (http, websocket, kafka, nats, postgres, mqtt, amqp, sqs, gcp, azure, email). Recommended for faster lookup
 - \`trigger new <path:string>\` - create a new trigger locally
-  - \`--kind <kind:string>\` - Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, azure, email)
+  - \`--kind <kind:string>\` - Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, amqp, sqs, gcp, azure, email)
 - \`trigger push <file_path:string> <remote_path:string>\` - push a local trigger spec. This overrides any remote versions.
 - \`trigger set-permissioned-as <path:string> <email:string>\` - Set the email (run-as user) for a trigger (requires admin or wm_deployers group)
-  - \`--kind <kind:string>\` - Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, azure, email)
+  - \`--kind <kind:string>\` - Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, amqp, sqs, gcp, azure, email)
 
 ### user
 
@@ -7509,6 +7509,120 @@ Both print the job result, are safe to run yourself, and don't deploy.
 
 // YAML schema content for triggers and schedules
 export const SCHEMAS: Record<string, string> = {
+  "amqp_trigger": `type: object
+properties:
+  script_path:
+    type: string
+    description: Path to the script or flow to execute when triggered
+  permissioned_as:
+    type: string
+    description: The user or group this trigger runs as (permissioned_as)
+  is_flow:
+    type: boolean
+    description: True if script_path points to a flow, false if it points to a script
+  labels:
+    type: array
+    items:
+      type: string
+  draft_only:
+    type: boolean
+    description: 'True when this row is a per-user draft with no deployed
+
+      trigger at the same path. Set by list endpoints when
+
+      \`include_draft_only=true\` synthesizes the row from the
+
+      draft. Frontend renders a "Draft" badge.
+
+      '
+  is_draft:
+    type: boolean
+    description: 'True when the authed user has a per-user draft at this path
+
+      (over a deployed row or a synthesized draft-only row).
+
+      Frontend appends a \`*\` to the displayed name.
+
+      '
+  amqp_resource_path:
+    type: string
+    description: Path to the AMQP resource containing broker connection configuration
+  queue_name:
+    type: string
+    description: Name of the queue to consume messages from
+  exchange:
+    type: object
+    properties:
+      exchange_name:
+        type: string
+        description: Name of the exchange to bind the consumed queue to
+      routing_keys:
+        type: array
+        items:
+          type: string
+        description: Routing keys used to bind the queue to the exchange
+  options:
+    type: object
+    properties:
+      declare_queue:
+        type: boolean
+        description: Declare the queue (durable) before consuming; when false the
+          queue is declared passively and must already exist
+      prefetch_count:
+        type: integer
+        format: int32
+        minimum: 1
+        maximum: 65535
+        description: Maximum number of unacknowledged messages the broker delivers
+          at once (1-65535)
+  error_handler_path:
+    type: string
+    description: Path to a script or flow to run when the triggered job fails
+  error_handler_args:
+    type: object
+    description: The arguments to pass to the script or flow
+  retry:
+    type: object
+    properties:
+      constant:
+        type: object
+        description: Retry with constant delay between attempts
+        properties:
+          attempts:
+            type: integer
+            description: Number of retry attempts
+          seconds:
+            type: integer
+            description: Seconds to wait between retries
+      exponential:
+        type: object
+        description: Retry with exponential backoff (delay doubles each time)
+        properties:
+          attempts:
+            type: integer
+            description: Number of retry attempts
+          multiplier:
+            type: integer
+            description: Multiplier for exponential backoff
+          seconds:
+            type: integer
+            minimum: 1
+            description: Initial delay in seconds
+          random_factor:
+            type: integer
+            minimum: 0
+            maximum: 100
+            description: Random jitter percentage (0-100) to avoid thundering herd
+      retry_if:
+        $ref: '#/components/schemas/RetryIf'
+    description: Retry configuration for failed module executions
+required:
+- script_path
+- permissioned_as
+- is_flow
+- amqp_resource_path
+- queue_name
+`,
   "azure_trigger": `type: object
 properties:
   script_path:
@@ -8815,6 +8929,7 @@ export const SCHEMA_MAPPINGS: Record<string, SchemaMapping[]> = {
     { name: "NatsTrigger", schemaKey: "nats_trigger", filePattern: "*.nats_trigger.yaml" },
     { name: "PostgresTrigger", schemaKey: "postgres_trigger", filePattern: "*.postgres_trigger.yaml" },
     { name: "MqttTrigger", schemaKey: "mqtt_trigger", filePattern: "*.mqtt_trigger.yaml" },
+    { name: "AmqpTrigger", schemaKey: "amqp_trigger", filePattern: "*.amqp_trigger.yaml" },
     { name: "SqsTrigger", schemaKey: "sqs_trigger", filePattern: "*.sqs_trigger.yaml" },
     { name: "GcpTrigger", schemaKey: "gcp_trigger", filePattern: "*.gcp_trigger.yaml" },
     { name: "AzureTrigger", schemaKey: "azure_trigger", filePattern: "*.azure_trigger.yaml" },
diff --git a/cli/src/types.ts b/cli/src/types.ts
index c125ae2c2e..f0cd58abbb 100644
--- a/cli/src/types.ts
+++ b/cli/src/types.ts
@@ -63,6 +63,7 @@ export const TRIGGER_TYPES = [
   "nats",
   "postgres",
   "mqtt",
+  "amqp",
   "sqs",
   "gcp",
   "azure",
@@ -243,6 +244,8 @@ export async function pushObj(
     await pushTrigger("postgres", workspace, p, befObj, newObj, permissionedAsContext);
   } else if (typeEnding === "mqtt_trigger") {
     await pushTrigger("mqtt", workspace, p, befObj, newObj, permissionedAsContext);
+  } else if (typeEnding === "amqp_trigger") {
+    await pushTrigger("amqp", workspace, p, befObj, newObj, permissionedAsContext);
   } else if (typeEnding === "sqs_trigger") {
     await pushTrigger("sqs", workspace, p, befObj, newObj, permissionedAsContext);
   } else if (typeEnding === "gcp_trigger") {
@@ -335,6 +338,7 @@ export function getTypeStrFromPath(
   | "nats_trigger"
   | "postgres_trigger"
   | "mqtt_trigger"
+  | "amqp_trigger"
   | "sqs_trigger"
   | "gcp_trigger"
   | "azure_trigger"
@@ -419,6 +423,7 @@ export function getTypeStrFromPath(
     typeEnding === "nats_trigger" ||
     typeEnding === "postgres_trigger" ||
     typeEnding === "mqtt_trigger" ||
+    typeEnding === "amqp_trigger" ||
     typeEnding === "sqs_trigger" ||
     typeEnding === "gcp_trigger" ||
     typeEnding === "azure_trigger" ||
diff --git a/cli/src/utils/git.ts b/cli/src/utils/git.ts
index 342222ed1b..441133afe4 100644
--- a/cli/src/utils/git.ts
+++ b/cli/src/utils/git.ts
@@ -285,6 +285,8 @@ export function gitSyncIncludePattern(
       return `${path}.postgres_trigger.*`;
     case "mqtttrigger":
       return `${path}.mqtt_trigger.*`;
+    case "amqptrigger":
+      return `${path}.amqp_trigger.*`;
     case "sqstrigger":
       return `${path}.sqs_trigger.*`;
     case "gcptrigger":
diff --git a/cli/test/git_unit.test.ts b/cli/test/git_unit.test.ts
index 4b6cf464e2..140da33866 100644
--- a/cli/test/git_unit.test.ts
+++ b/cli/test/git_unit.test.ts
@@ -274,6 +274,9 @@ describe("gitSyncIncludePattern", () => {
     expect(gitSyncIncludePattern("gcptrigger", "f/t")).toBe(
       "f/t.gcp_trigger.*"
     );
+    expect(gitSyncIncludePattern("amqptrigger", "f/t")).toBe(
+      "f/t.amqp_trigger.*"
+    );
   });
 });
 
diff --git a/frontend/src/lib/components/CompareDrafts.svelte b/frontend/src/lib/components/CompareDrafts.svelte
index b7970c90e1..32be6caf35 100644
--- a/frontend/src/lib/components/CompareDrafts.svelte
+++ b/frontend/src/lib/components/CompareDrafts.svelte
@@ -118,6 +118,7 @@
 				'nats_trigger',
 				'postgres_trigger',
 				'mqtt_trigger',
+				'amqp_trigger',
 				'sqs_trigger',
 				'gcp_trigger',
 				'azure_trigger',
@@ -483,6 +484,7 @@
 		trigger_kafka: '/kafka_triggers',
 		trigger_nats: '/nats_triggers',
 		trigger_mqtt: '/mqtt_triggers',
+		trigger_amqp: '/amqp_triggers',
 		trigger_sqs: '/sqs_triggers',
 		trigger_gcp: '/gcp_triggers',
 		trigger_azure: '/azure_triggers',
diff --git a/frontend/src/lib/components/CompareWorkspaces.svelte b/frontend/src/lib/components/CompareWorkspaces.svelte
index a2453add27..ac4fcfad99 100644
--- a/frontend/src/lib/components/CompareWorkspaces.svelte
+++ b/frontend/src/lib/components/CompareWorkspaces.svelte
@@ -1001,6 +1001,7 @@
 		nats_trigger: 'NATS trigger',
 		postgres_trigger: 'Postgres trigger',
 		mqtt_trigger: 'MQTT trigger',
+		amqp_trigger: 'AMQP trigger',
 		sqs_trigger: 'SQS trigger',
 		gcp_trigger: 'GCP trigger',
 		azure_trigger: 'Azure trigger',
diff --git a/frontend/src/lib/components/MoveDrawer.svelte b/frontend/src/lib/components/MoveDrawer.svelte
index 212e45d58d..21b155fce3 100644
--- a/frontend/src/lib/components/MoveDrawer.svelte
+++ b/frontend/src/lib/components/MoveDrawer.svelte
@@ -48,6 +48,7 @@
 		push('schedule', c.schedule_count)
 		push('kafka', c.kafka_count)
 		push('mqtt', c.mqtt_count)
+		push('amqp', c.amqp_count)
 		push('nats', c.nats_count)
 		push('postgres', c.postgres_count)
 		push('sqs', c.sqs_count)
diff --git a/frontend/src/lib/components/Path.svelte b/frontend/src/lib/components/Path.svelte
index 27d6b45e6c..284677ce7c 100644
--- a/frontend/src/lib/components/Path.svelte
+++ b/frontend/src/lib/components/Path.svelte
@@ -20,6 +20,7 @@
 		PostgresTriggerService,
 		NatsTriggerService,
 		MqttTriggerService,
+		AmqpTriggerService,
 		SqsTriggerService,
 		GcpTriggerService,
 		AzureTriggerService,
@@ -58,6 +59,7 @@
 		| 'postgres_trigger'
 		| 'nats_trigger'
 		| 'mqtt_trigger'
+		| 'amqp_trigger'
 		| 'sqs_trigger'
 		| 'gcp_trigger'
 		| 'azure_trigger'
@@ -302,6 +304,11 @@
 				workspace: ws!,
 				path: path
 			})
+		} else if (kind === 'amqp_trigger') {
+			return await AmqpTriggerService.existsAmqpTrigger({
+				workspace: ws!,
+				path: path
+			})
 		} else if (kind == 'sqs_trigger') {
 			return await SqsTriggerService.existsSqsTrigger({
 				workspace: ws!,
diff --git a/frontend/src/lib/components/assets/AssetGraph/AddNode.svelte b/frontend/src/lib/components/assets/AssetGraph/AddNode.svelte
index 4745742e20..880abb685a 100644
--- a/frontend/src/lib/components/assets/AssetGraph/AddNode.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/AddNode.svelte
@@ -94,6 +94,12 @@
 			description: 'Triggered by an MQTT message',
 			icon: Radio
 		},
+		{
+			id: 'amqp',
+			label: 'On AMQP',
+			description: 'Triggered by an AMQP (RabbitMQ) message',
+			icon: Radio
+		},
 		{
 			id: 'nats',
 			label: 'On NATS',
diff --git a/frontend/src/lib/components/assets/AssetGraph/PipelineTriggerEditors.svelte b/frontend/src/lib/components/assets/AssetGraph/PipelineTriggerEditors.svelte
index 0a32929720..e364b29883 100644
--- a/frontend/src/lib/components/assets/AssetGraph/PipelineTriggerEditors.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/PipelineTriggerEditors.svelte
@@ -8,6 +8,7 @@
 		GcpTriggerService,
 		KafkaTriggerService,
 		MqttTriggerService,
+		AmqpTriggerService,
 		NatsTriggerService,
 		PostgresTriggerService,
 		ScheduleService,
@@ -15,6 +16,7 @@
 	} from '$lib/gen'
 	import KafkaTriggerEditor from '$lib/components/triggers/kafka/KafkaTriggerEditor.svelte'
 	import MqttTriggerEditor from '$lib/components/triggers/mqtt/MqttTriggerEditor.svelte'
+	import AmqpTriggerEditor from '$lib/components/triggers/amqp/AmqpTriggerEditor.svelte'
 	import NatsTriggerEditor from '$lib/components/triggers/nats/NatsTriggerEditor.svelte'
 	import PostgresTriggerEditor from '$lib/components/triggers/postgres/PostgresTriggerEditor.svelte'
 	import SqsTriggerEditor from '$lib/components/triggers/sqs/SqsTriggerEditor.svelte'
@@ -44,6 +46,7 @@
 
 	let kafkaEditor: KafkaTriggerEditor | undefined = $state()
 	let mqttEditor: MqttTriggerEditor | undefined = $state()
+	let amqpEditor: AmqpTriggerEditor | undefined = $state()
 	let natsEditor: NatsTriggerEditor | undefined = $state()
 	let postgresEditor: PostgresTriggerEditor | undefined = $state()
 	let sqsEditor: SqsTriggerEditor | undefined = $state()
@@ -63,6 +66,8 @@
 				return kafkaEditor?.openNew(false, scriptPath)
 			case 'mqtt':
 				return mqttEditor?.openNew(false, scriptPath)
+			case 'amqp':
+				return amqpEditor?.openNew(false, scriptPath)
 			case 'nats':
 				return natsEditor?.openNew(false, scriptPath)
 			case 'postgres':
@@ -87,6 +92,8 @@
 				return kafkaEditor?.openEdit(triggerPath, false, scriptPath)
 			case 'mqtt':
 				return mqttEditor?.openEdit(triggerPath, false, scriptPath)
+			case 'amqp':
+				return amqpEditor?.openEdit(triggerPath, false, scriptPath)
 			case 'nats':
 				return natsEditor?.openEdit(triggerPath, false, scriptPath)
 			case 'postgres':
@@ -135,6 +142,9 @@
 				case 'mqtt':
 					await MqttTriggerService.deleteMqttTrigger({ workspace, path: triggerPath })
 					break
+				case 'amqp':
+					await AmqpTriggerService.deleteAmqpTrigger({ workspace, path: triggerPath })
+					break
 				case 'nats':
 					await NatsTriggerService.deleteNatsTrigger({ workspace, path: triggerPath })
 					break
@@ -195,6 +205,7 @@
 	     gated off the canvas outside edit mode. -->
 	<KafkaTriggerEditor bind:this={kafkaEditor} {onUpdate} />
 	<MqttTriggerEditor bind:this={mqttEditor} {onUpdate} />
+	<AmqpTriggerEditor bind:this={amqpEditor} {onUpdate} />
 	<NatsTriggerEditor bind:this={natsEditor} {onUpdate} />
 	<PostgresTriggerEditor bind:this={postgresEditor} {onUpdate} />
 	<SqsTriggerEditor bind:this={sqsEditor} {onUpdate} />
diff --git a/frontend/src/lib/components/assets/AssetGraph/TriggerNode.svelte b/frontend/src/lib/components/assets/AssetGraph/TriggerNode.svelte
index 98307013c4..0e279112cd 100644
--- a/frontend/src/lib/components/assets/AssetGraph/TriggerNode.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/TriggerNode.svelte
@@ -48,6 +48,7 @@
 		email: { icon: Mail, label: 'email', ...MUTED },
 		kafka: { icon: Zap, label: 'kafka', ...MUTED },
 		mqtt: { icon: Radio, label: 'mqtt', ...MUTED },
+		amqp: { icon: Radio, label: 'amqp', ...MUTED },
 		nats: { icon: MessageSquare, label: 'nats', ...MUTED },
 		postgres: { icon: Database, label: 'postgres', ...MUTED },
 		sqs: { icon: Send, label: 'sqs', ...MUTED },
diff --git a/frontend/src/lib/components/assets/AssetGraph/boundedCascade.ts b/frontend/src/lib/components/assets/AssetGraph/boundedCascade.ts
index 6fcabbe71f..810ab36cc1 100644
--- a/frontend/src/lib/components/assets/AssetGraph/boundedCascade.ts
+++ b/frontend/src/lib/components/assets/AssetGraph/boundedCascade.ts
@@ -51,6 +51,7 @@ export function assetUriToNodeId(uri: string): string | undefined {
 const EVENT_TRIGGER_KINDS: ReadonlySet<string> = new Set<NativeTriggerKind>([
 	'kafka',
 	'mqtt',
+	'amqp',
 	'nats',
 	'postgres',
 	'sqs',
diff --git a/frontend/src/lib/components/assets/AssetGraph/parsePipelineAnnotations.ts b/frontend/src/lib/components/assets/AssetGraph/parsePipelineAnnotations.ts
index f9e53494ff..34b9ac2eab 100644
--- a/frontend/src/lib/components/assets/AssetGraph/parsePipelineAnnotations.ts
+++ b/frontend/src/lib/components/assets/AssetGraph/parsePipelineAnnotations.ts
@@ -31,6 +31,7 @@ const NATIVE_TRIGGER_KEYWORDS: NativeTriggerKind[] = [
 	'email',
 	'kafka',
 	'mqtt',
+	'amqp',
 	'nats',
 	'postgres',
 	'sqs',
diff --git a/frontend/src/lib/components/assets/AssetGraph/pipelineTemplates.ts b/frontend/src/lib/components/assets/AssetGraph/pipelineTemplates.ts
index 02607d5f35..bf0c14d16e 100644
--- a/frontend/src/lib/components/assets/AssetGraph/pipelineTemplates.ts
+++ b/frontend/src/lib/components/assets/AssetGraph/pipelineTemplates.ts
@@ -309,6 +309,7 @@ export type DraftTriggerSource =
 				| 'email'
 				| 'kafka'
 				| 'mqtt'
+				| 'amqp'
 				| 'nats'
 				| 'postgres'
 				| 'sqs'
diff --git a/frontend/src/lib/components/assets/AssetGraph/types.ts b/frontend/src/lib/components/assets/AssetGraph/types.ts
index 0e055abca2..d9ef2dafbf 100644
--- a/frontend/src/lib/components/assets/AssetGraph/types.ts
+++ b/frontend/src/lib/components/assets/AssetGraph/types.ts
@@ -110,6 +110,7 @@ export type NativeTriggerKind =
 	| 'email'
 	| 'kafka'
 	| 'mqtt'
+	| 'amqp'
 	| 'nats'
 	| 'postgres'
 	| 'sqs'
diff --git a/frontend/src/lib/components/common/table/Row.svelte b/frontend/src/lib/components/common/table/Row.svelte
index d2d15ecfd5..df0e4ce023 100644
--- a/frontend/src/lib/components/common/table/Row.svelte
+++ b/frontend/src/lib/components/common/table/Row.svelte
@@ -45,6 +45,7 @@
 			| 'nats_trigger'
 			| 'postgres_trigger'
 			| 'mqtt_trigger'
+			| 'amqp_trigger'
 			| 'sqs_trigger'
 			| 'gcp_trigger'
 			| 'azure_trigger'
diff --git a/frontend/src/lib/components/common/table/RowIcon.svelte b/frontend/src/lib/components/common/table/RowIcon.svelte
index b2deb47443..7ef3543073 100644
--- a/frontend/src/lib/components/common/table/RowIcon.svelte
+++ b/frontend/src/lib/components/common/table/RowIcon.svelte
@@ -3,6 +3,7 @@
 	import KafkaIcon from '$lib/components/icons/KafkaIcon.svelte'
 	import NatsIcon from '$lib/components/icons/NatsIcon.svelte'
 	import MqttIcon from '$lib/components/icons/MqttIcon.svelte'
+	import AmqpIcon from '$lib/components/icons/AmqpIcon.svelte'
 	import AwsIcon from '$lib/components/icons/AwsIcon.svelte'
 	import AzureIcon from '$lib/components/icons/AzureIcon.svelte'
 	import GoogleCloudIcon from '$lib/components/icons/GoogleCloudIcon.svelte'
@@ -41,6 +42,7 @@
 			| 'kafka'
 			| 'nats'
 			| 'mqtt'
+			| 'amqp'
 			| 'sqs'
 			| 'gcp'
 			| 'emails'
@@ -50,6 +52,7 @@
 			| 'nats_trigger'
 			| 'postgres_trigger'
 			| 'mqtt_trigger'
+			| 'amqp_trigger'
 			| 'sqs_trigger'
 			| 'gcp_trigger'
 			| 'azure_trigger'
@@ -75,6 +78,7 @@
 		nats_trigger: 'nats',
 		postgres_trigger: 'postgres',
 		mqtt_trigger: 'mqtt',
+		amqp_trigger: 'amqp',
 		sqs_trigger: 'sqs',
 		gcp_trigger: 'gcp',
 		azure_trigger: 'azure',
@@ -117,6 +121,8 @@
 		<NatsIcon {size} class="text-gray-400" />
 	{:else if effectiveKind === 'mqtt'}
 		<MqttIcon {size} class="text-gray-400" />
+	{:else if effectiveKind === 'amqp'}
+		<AmqpIcon {size} class="text-gray-400" />
 	{:else if effectiveKind === 'sqs'}
 		<AwsIcon {size} class="text-gray-400" />
 	{:else if effectiveKind === 'gcp'}
diff --git a/frontend/src/lib/components/copilot/chat/CreatedResourceActionDrawers.svelte b/frontend/src/lib/components/copilot/chat/CreatedResourceActionDrawers.svelte
index b73c8dc6bc..e25df2cc40 100644
--- a/frontend/src/lib/components/copilot/chat/CreatedResourceActionDrawers.svelte
+++ b/frontend/src/lib/components/copilot/chat/CreatedResourceActionDrawers.svelte
@@ -70,6 +70,10 @@
 			label: 'MQTT trigger',
 			load: () => import('$lib/components/triggers/mqtt/MqttTriggerEditorInner.svelte')
 		},
+		amqp: {
+			label: 'AMQP trigger',
+			load: () => import('$lib/components/triggers/amqp/AmqpTriggerEditorInner.svelte')
+		},
 		sqs: {
 			label: 'SQS trigger',
 			load: () => import('$lib/components/triggers/sqs/SqsTriggerEditorInner.svelte')
diff --git a/frontend/src/lib/components/copilot/chat/ToolMessageActions.svelte b/frontend/src/lib/components/copilot/chat/ToolMessageActions.svelte
index a40f244019..58ebfe2bb8 100644
--- a/frontend/src/lib/components/copilot/chat/ToolMessageActions.svelte
+++ b/frontend/src/lib/components/copilot/chat/ToolMessageActions.svelte
@@ -26,6 +26,7 @@
 	import GoogleCloudIcon from '$lib/components/icons/GoogleCloudIcon.svelte'
 	import KafkaIcon from '$lib/components/icons/KafkaIcon.svelte'
 	import MqttIcon from '$lib/components/icons/MqttIcon.svelte'
+	import AmqpIcon from '$lib/components/icons/AmqpIcon.svelte'
 	import NatsIcon from '$lib/components/icons/NatsIcon.svelte'
 	import { runToolDisplayAction } from './createdResourceActions.svelte'
 	import type { CreatedResourceTriggerKind, ToolDisplayAction } from './shared'
@@ -54,6 +55,7 @@
 		kafka: { title: 'Kafka trigger', icon: KafkaIcon },
 		nats: { title: 'NATS trigger', icon: NatsIcon },
 		mqtt: { title: 'MQTT trigger', icon: MqttIcon },
+		amqp: { title: 'AMQP trigger', icon: AmqpIcon },
 		sqs: { title: 'SQS trigger', icon: AwsIcon },
 		gcp: { title: 'GCP Pub/Sub trigger', icon: GoogleCloudIcon },
 		azure: { title: 'Azure Event Grid trigger', icon: AzureIcon },
diff --git a/frontend/src/lib/components/copilot/chat/global/core.ts b/frontend/src/lib/components/copilot/chat/global/core.ts
index 86b95bfa89..c45f5b129b 100644
--- a/frontend/src/lib/components/copilot/chat/global/core.ts
+++ b/frontend/src/lib/components/copilot/chat/global/core.ts
@@ -8,6 +8,7 @@ import {
 	JobService,
 	KafkaTriggerService,
 	MqttTriggerService,
+	AmqpTriggerService,
 	NatsTriggerService,
 	PostgresTriggerService,
 	ResourceService,
@@ -462,6 +463,7 @@ const writeTriggerSchema = z.object({
 			triggerRequestSchemas.nats,
 			triggerRequestSchemas.postgres,
 			triggerRequestSchemas.mqtt,
+			triggerRequestSchemas.amqp,
 			triggerRequestSchemas.sqs,
 			triggerRequestSchemas.gcp,
 			triggerRequestSchemas.azure
@@ -1553,6 +1555,14 @@ const triggerServices: Record<TriggerKind, TriggerService> = {
 		update: (a) => MqttTriggerService.updateMqttTrigger(a),
 		delete: (a) => MqttTriggerService.deleteMqttTrigger(a)
 	},
+	amqp: {
+		exists: (a) => AmqpTriggerService.existsAmqpTrigger(a),
+		get: (a) => AmqpTriggerService.getAmqpTrigger(a),
+		list: (a) => AmqpTriggerService.listAmqpTriggers(a),
+		create: (a) => AmqpTriggerService.createAmqpTrigger(a),
+		update: (a) => AmqpTriggerService.updateAmqpTrigger(a),
+		delete: (a) => AmqpTriggerService.deleteAmqpTrigger(a)
+	},
 	sqs: {
 		exists: (a) => SqsTriggerService.existsSqsTrigger(a),
 		get: (a) => SqsTriggerService.getSqsTrigger(a),
@@ -4858,6 +4868,7 @@ const triggerLabels: Record<TriggerKind, string> = {
 	nats: 'NATS trigger',
 	postgres: 'Postgres trigger',
 	mqtt: 'MQTT trigger',
+	amqp: 'AMQP trigger',
 	sqs: 'SQS trigger',
 	gcp: 'GCP Pub/Sub trigger',
 	azure: 'Azure Event Grid trigger'
diff --git a/frontend/src/lib/components/copilot/chat/global/userDraftAdapter.ts b/frontend/src/lib/components/copilot/chat/global/userDraftAdapter.ts
index 32cf08d229..eae27fb5b4 100644
--- a/frontend/src/lib/components/copilot/chat/global/userDraftAdapter.ts
+++ b/frontend/src/lib/components/copilot/chat/global/userDraftAdapter.ts
@@ -21,6 +21,7 @@ const TRIGGER_DRAFT_KIND_BY_TRIGGER_KIND = {
 	nats: 'trigger_nats',
 	postgres: 'trigger_postgres',
 	mqtt: 'trigger_mqtt',
+	amqp: 'trigger_amqp',
 	sqs: 'trigger_sqs',
 	gcp: 'trigger_gcp',
 	azure: 'trigger_azure'
@@ -44,6 +45,7 @@ const GLOBAL_DRAFT_KINDS = [
 	'trigger_nats',
 	'trigger_postgres',
 	'trigger_mqtt',
+	'trigger_amqp',
 	'trigger_sqs',
 	'trigger_gcp',
 	'trigger_azure',
diff --git a/frontend/src/lib/components/copilot/chat/global/workspaceItems.ts b/frontend/src/lib/components/copilot/chat/global/workspaceItems.ts
index c17e84cc8f..31f9261227 100644
--- a/frontend/src/lib/components/copilot/chat/global/workspaceItems.ts
+++ b/frontend/src/lib/components/copilot/chat/global/workspaceItems.ts
@@ -7,6 +7,7 @@ import type {
 	NewHttpTrigger,
 	NewKafkaTrigger,
 	NewMqttTrigger,
+	NewAmqpTrigger,
 	NewNatsTrigger,
 	NewPostgresTrigger,
 	NewSchedule,
@@ -38,6 +39,7 @@ export const TRIGGER_KINDS = [
 	'nats',
 	'postgres',
 	'mqtt',
+	'amqp',
 	'sqs',
 	'gcp',
 	'azure'
@@ -52,6 +54,7 @@ export type TriggerRequestBody =
 	| NewNatsTrigger
 	| NewPostgresTrigger
 	| NewMqttTrigger
+	| NewAmqpTrigger
 	| NewSqsTrigger
 	| GcpTriggerData
 	| AzureTriggerData
diff --git a/frontend/src/lib/components/copilot/chat/pipeline/core.ts b/frontend/src/lib/components/copilot/chat/pipeline/core.ts
index 31d74880a5..795b2983fe 100644
--- a/frontend/src/lib/components/copilot/chat/pipeline/core.ts
+++ b/frontend/src/lib/components/copilot/chat/pipeline/core.ts
@@ -319,7 +319,7 @@ export function getPipelinePromptSection(ctx: PipelineContext): string {
 Data Pipeline editor (ACTIVE):
 - The user has the /pipeline/${ctx.folder} editor open. A pipeline is a DAG of scripts (nodes) connected by storage assets (DuckLake tables, data tables, S3 objects, volumes, resources) and execution triggers.
 - Annotations are top-of-file comments in the NODE'S OWN comment syntax: \`--\` for SQL (duckdb/postgresql), \`#\` for python3/bash, \`//\` for bun/TS. The \`//\` shown below is the TS form — translate it (a \`// pipeline\` line in a SQL node is a syntax error that won't deploy).
-- A script becomes a pipeline node when its source starts with the \`// pipeline\` annotation. Declare execution-DAG inputs with \`// on <asset-uri | schedule | webhook | email | kafka | mqtt | nats | postgres | sqs | gcp | data_upload>\` (e.g. \`// on ducklake://main/orders\`). Outputs are inferred from what the body writes (wmill SDK calls / SQL CREATE TABLE / writeS3File); declare a managed output with \`// materialize <asset-uri>\`. Optional badges: \`// partitioned <daily|hourly|weekly|monthly|dynamic>\`, \`// freshness <duration>\`, \`// tag <name>\`, \`// retry <count> [delay]\`, \`// data_test <kind> ...\`, \`// measure <name> = <agg> [where <pred>]\`, \`// dimension <name> = <expr>\`.
+- A script becomes a pipeline node when its source starts with the \`// pipeline\` annotation. Declare execution-DAG inputs with \`// on <asset-uri | schedule | webhook | email | kafka | mqtt | amqp | nats | postgres | sqs | gcp | data_upload>\` (e.g. \`// on ducklake://main/orders\`). Outputs are inferred from what the body writes (wmill SDK calls / SQL CREATE TABLE / writeS3File); declare a managed output with \`// materialize <asset-uri>\`. Optional badges: \`// partitioned <daily|hourly|weekly|monthly|dynamic>\`, \`// freshness <duration>\`, \`// tag <name>\`, \`// retry <count> [delay]\`, \`// data_test <kind> ...\`, \`// measure <name> = <agg> [where <pred>]\`, \`// dimension <name> = <expr>\`.
 - \`materialize\` (the managed output): \`// materialize <asset-uri>\` means the runtime writes the node's output table FOR you — write the body as a single SELECT and the runtime wraps it in the create/replace, so do NOT also write your own CREATE TABLE / INSERT. IMPORTANT: \`// materialize\` is **DuckDB-only** and its target MUST be a DuckLake table (\`ducklake://<name>/<table>\`) — deploy rejects it on any other language or target. For a \`python3\`/\`bun\`/\`postgresql\` node, do NOT use \`// materialize\`; write the output via the SDK instead (e.g. \`wmill.writeS3File(...)\`, a \`CREATE TABLE\` in postgresql, or \`wmill.databaseUrlFromResource\`/ducklake helpers) and let the output be inferred. Reach for \`duckdb\` when a node should materialize a DuckLake table. Write strategy: with no option it REPLACES the whole table each run (full refresh; the only mode whose output columns may change); \`// materialize <uri> append\` INSERT-appends rows (incremental); \`// materialize <uri> key=<col>\` merges/upserts on \`<col>\`. \`// materialize manual <uri>\` opts OUT of managed writes — the script writes its own DDL and the annotation only records the output asset for lineage. \`materialize\` is paired with partitioning for incremental pipelines: a \`// partitioned <daily|hourly|weekly|monthly|dynamic>\` node runs once per partition (append/merge into a fixed-schema table), and the \`{partition}\` token — usable in any asset URI AND in the body SQL — is substituted with the current partition's IDENTITY string at run time. To filter the source to the active slice on a time grain, use the runtime-injected macro: \`WHERE wm_partition(<ts_col>) = {partition}\`. \`wm_partition(ts)\` buckets a timestamp with the exact identity format the runtime used (daily/hourly/weekly/monthly), so it always matches and you never hand-write a \`strftime\` format. Do NOT write \`= TIMESTAMP {partition}\`: the identity string is not a valid timestamp literal for hourly/weekly/monthly and errors at runtime. For \`dynamic\` partitioning the identity is your caller-supplied key (not a timestamp, no macro), so filter on it directly: \`WHERE <your_key_col> = {partition}\`. \`materialize\` is an output DECLARATION on the node — it is not a command; there is no "materialize run".
 - \`measure\` / \`dimension\` (declared metrics): on a node that materializes a DuckLake table, \`// measure <name> = <aggregate> [where <predicate>]\` names the canonical way to aggregate that table (e.g. \`// measure revenue = sum(amount) where not is_refund\`), and \`// dimension <name> = <expr>\` names a way to slice it (e.g. \`// dimension region = region\`, \`// dimension month = date_trunc('month', ordered_at)\`). They execute nothing: they are catalogued at deploy so the editor and other agents can reuse the definition instead of re-deriving it and silently disagreeing. Keep the predicate in the \`where\` clause rather than folding it into the aggregate: it is rendered as \`<agg> FILTER (WHERE <pred>)\`, which is what lets two measures with different predicates sit under one GROUP BY. DuckLake-only, and only meaningful next to \`// materialize\`. Declare one when a number carries a judgement call someone else would get wrong (refunds excluded, test rows dropped, which column is the amount); do NOT blanket every table with measures, an obvious \`count(*)\` earns nothing. To USE a metric another node declares, read that node with read_pipeline_node and reuse its exact expression rather than guessing it.
 - Use get_pipeline_graph to see the current nodes/assets/triggers, and read_pipeline_node before editing one.
diff --git a/frontend/src/lib/components/copilot/chat/shared.ts b/frontend/src/lib/components/copilot/chat/shared.ts
index a1f79f181e..2e3f49de5f 100644
--- a/frontend/src/lib/components/copilot/chat/shared.ts
+++ b/frontend/src/lib/components/copilot/chat/shared.ts
@@ -482,6 +482,7 @@ export type CreatedResourceTriggerKind =
 	| 'nats'
 	| 'postgres'
 	| 'mqtt'
+	| 'amqp'
 	| 'sqs'
 	| 'gcp'
 	| 'azure'
diff --git a/frontend/src/lib/components/copilot/chat/workspaceItems.svelte.ts b/frontend/src/lib/components/copilot/chat/workspaceItems.svelte.ts
index 8a7932b8d9..b1a6f695d3 100644
--- a/frontend/src/lib/components/copilot/chat/workspaceItems.svelte.ts
+++ b/frontend/src/lib/components/copilot/chat/workspaceItems.svelte.ts
@@ -7,6 +7,7 @@ import {
 	HttpTriggerService,
 	KafkaTriggerService,
 	MqttTriggerService,
+	AmqpTriggerService,
 	NatsTriggerService,
 	PostgresTriggerService,
 	ResourceService,
@@ -35,6 +36,7 @@ export type WindmillItemKind =
 	| 'nats_trigger'
 	| 'postgres_trigger'
 	| 'mqtt_trigger'
+	| 'amqp_trigger'
 	| 'sqs_trigger'
 	| 'gcp_trigger'
 	| 'azure_trigger'
@@ -123,6 +125,7 @@ const workspaceItemLoaders: Array<{
 		list: (workspace) => PostgresTriggerService.listPostgresTriggers({ workspace })
 	},
 	{ kind: 'mqtt_trigger', list: (workspace) => MqttTriggerService.listMqttTriggers({ workspace }) },
+	{ kind: 'amqp_trigger', list: (workspace) => AmqpTriggerService.listAmqpTriggers({ workspace }) },
 	{ kind: 'sqs_trigger', list: (workspace) => SqsTriggerService.listSqsTriggers({ workspace }) },
 	{ kind: 'gcp_trigger', list: (workspace) => GcpTriggerService.listGcpTriggers({ workspace }) },
 	{
diff --git a/frontend/src/lib/components/copilot/chat/workspaceTools.ts b/frontend/src/lib/components/copilot/chat/workspaceTools.ts
index 5609ab1321..a976b7dab6 100644
--- a/frontend/src/lib/components/copilot/chat/workspaceTools.ts
+++ b/frontend/src/lib/components/copilot/chat/workspaceTools.ts
@@ -4,6 +4,7 @@ import {
 	HttpTriggerService,
 	KafkaTriggerService,
 	MqttTriggerService,
+	AmqpTriggerService,
 	NatsTriggerService,
 	PostgresTriggerService,
 	ScheduleService,
@@ -14,6 +15,7 @@ import {
 	type NewHttpTrigger,
 	type NewKafkaTrigger,
 	type NewMqttTrigger,
+	type NewAmqpTrigger,
 	type NewNatsTrigger,
 	type NewPostgresTrigger,
 	type NewSchedule,
@@ -45,6 +47,7 @@ type TriggerRequestByKind = {
 	nats: NewNatsTrigger
 	postgres: NewPostgresTrigger
 	mqtt: NewMqttTrigger
+	amqp: NewAmqpTrigger
 	sqs: NewSqsTrigger
 	gcp: GcpTriggerData
 	azure: AzureTriggerData
@@ -155,6 +158,12 @@ const triggerConfigs = {
 		create: (data: { workspace: string; requestBody: NewMqttTrigger }) =>
 			MqttTriggerService.createMqttTrigger(data)
 	},
+	amqp: {
+		label: 'AMQP trigger',
+		requestSchema: triggerRequestSchemas.amqp as z.ZodType<NewAmqpTrigger>,
+		create: (data: { workspace: string; requestBody: NewAmqpTrigger }) =>
+			AmqpTriggerService.createAmqpTrigger(data)
+	},
 	sqs: {
 		label: 'SQS trigger',
 		requestSchema: triggerRequestSchemas.sqs as z.ZodType<NewSqsTrigger>,
@@ -302,7 +311,9 @@ const createScheduleTool: Tool<any> = {
 				})
 				return JSON.stringify(toolResult)
 			} catch (error) {
-				throw new Error(`Failed to create schedule "${requestBody.path}": ${formatToolError(error)}`)
+				throw new Error(
+					`Failed to create schedule "${requestBody.path}": ${formatToolError(error)}`
+				)
 			}
 		} catch (error) {
 			return setToolError(toolCallbacks, toolId, error)
diff --git a/frontend/src/lib/components/copilot/chat/workspaceToolsZod.gen.ts b/frontend/src/lib/components/copilot/chat/workspaceToolsZod.gen.ts
index d989412bb1..79883d2dd9 100644
--- a/frontend/src/lib/components/copilot/chat/workspaceToolsZod.gen.ts
+++ b/frontend/src/lib/components/copilot/chat/workspaceToolsZod.gen.ts
@@ -293,6 +293,43 @@ export const mqttTriggerRequestSchema = z.object({
 	"labels": z.array(z.string()).optional()
 })
 
+export const amqpTriggerRequestSchema = z.object({
+	"amqp_resource_path": z.string().describe("Path to the AMQP resource containing broker connection configuration"),
+	"queue_name": z.string().describe("Name of the queue to consume messages from"),
+	"exchange": z.object({
+		"exchange_name": z.string().describe("Name of the exchange to bind the consumed queue to"),
+		"routing_keys": z.array(z.string()).describe("Routing keys used to bind the queue to the exchange").optional()
+	}).describe("Optional exchange binding for the consumed queue").nullable().optional(),
+	"options": z.object({
+		"declare_queue": z.boolean().describe("Declare the queue (durable) before consuming; when false the queue is declared passively and must already exist").optional(),
+		"prefetch_count": z.number().int().gte(1).lte(65535).describe("Maximum number of unacknowledged messages the broker delivers at once (1-65535)").optional()
+	}).describe("Optional consumer options (queue declaration, prefetch)").nullable().optional(),
+	"path": z.string().describe("The unique Windmill path for this trigger. Must be of the form `u/<user>/<path>` or `f/<folder>/<path>`."),
+	"script_path": z.string().describe("Path to the script or flow to execute when a message is received"),
+	"is_flow": z.boolean().describe("True if script_path points to a flow, false if it points to a script"),
+	"mode": z.enum(["enabled", "disabled", "suspended"]).describe("job trigger mode").optional(),
+	"error_handler_path": z.string().describe("Path to a script or flow to run when the triggered job fails").optional(),
+	"error_handler_args": z.record(z.string(), z.any()).describe("Arguments to pass to the error handler").optional(),
+	"retry": z.object({
+		"constant": z.object({
+			"attempts": z.number().int().describe("Number of retry attempts").optional(),
+			"seconds": z.number().int().describe("Seconds to wait between retries").optional()
+		}).describe("Retry with constant delay between attempts").optional(),
+		"exponential": z.object({
+			"attempts": z.number().int().describe("Number of retry attempts").optional(),
+			"multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(),
+			"seconds": z.number().int().gte(1).describe("Initial delay in seconds").optional(),
+			"random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional()
+		}).describe("Retry with exponential backoff (delay doubles each time)").optional(),
+		"retry_if": z.object({
+			"expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables")
+		}).describe("Conditional retry based on error or result").optional()
+	}).describe("Retry configuration for failed executions").optional(),
+	"permissioned_as": z.string().describe("The user or group this trigger runs as. Used during deployment to preserve the original trigger owner.").optional(),
+	"preserve_permissioned_as": z.boolean().describe("When true and the caller is a member of the 'wm_deployers' group, preserves the original permissioned_as value instead of overwriting it.").optional(),
+	"labels": z.array(z.string()).optional()
+})
+
 export const sqsTriggerRequestSchema = z.object({
 	"queue_url": z.string().describe("The full URL of the AWS SQS queue to poll for messages"),
 	"aws_auth_resource_type": z.enum(["oidc", "credentials"]).describe("Authentication type - 'credentials' for access key/secret, 'oidc' for OpenID Connect"),
@@ -425,6 +462,7 @@ export const triggerRequestSchemas = {
 	nats: natsTriggerRequestSchema,
 	postgres: postgresTriggerRequestSchema,
 	mqtt: mqttTriggerRequestSchema,
+	amqp: amqpTriggerRequestSchema,
 	sqs: sqsTriggerRequestSchema,
 	gcp: gcpTriggerRequestSchema,
 	azure: azureTriggerRequestSchema,
@@ -440,6 +478,7 @@ export const createTriggerToolSchema = z.object({
 		"nats",
 		"postgres",
 		"mqtt",
+		"amqp",
 		"sqs",
 		"gcp",
 		"azure",
@@ -452,6 +491,7 @@ export const createTriggerToolSchema = z.object({
 		natsTriggerRequestSchema.omit({ path: true, script_path: true, is_flow: true }),
 		postgresTriggerRequestSchema.omit({ path: true, script_path: true, is_flow: true }),
 		mqttTriggerRequestSchema.omit({ path: true, script_path: true, is_flow: true }),
+		amqpTriggerRequestSchema.omit({ path: true, script_path: true, is_flow: true }),
 		sqsTriggerRequestSchema.omit({ path: true, script_path: true, is_flow: true }),
 		gcpTriggerRequestSchema.omit({ path: true, script_path: true, is_flow: true }),
 		azureTriggerRequestSchema.omit({ path: true, script_path: true, is_flow: true }),
diff --git a/frontend/src/lib/components/graph/renderers/triggers/TriggersBadge.svelte b/frontend/src/lib/components/graph/renderers/triggers/TriggersBadge.svelte
index d7340e053a..ac41827d6c 100644
--- a/frontend/src/lib/components/graph/renderers/triggers/TriggersBadge.svelte
+++ b/frontend/src/lib/components/graph/renderers/triggers/TriggersBadge.svelte
@@ -5,7 +5,14 @@
 	import { getContext } from 'svelte'
 	import { type TriggerContext } from '$lib/components/triggers'
 	import { enterpriseLicense } from '$lib/stores'
-	import { MqttIcon, NatsIcon, KafkaIcon, AwsIcon, GoogleCloudIcon } from '$lib/components/icons'
+	import {
+		MqttIcon,
+		AmqpIcon,
+		NatsIcon,
+		KafkaIcon,
+		AwsIcon,
+		GoogleCloudIcon
+	} from '$lib/components/icons'
 	import AzureIcon from '$lib/components/icons/AzureIcon.svelte'
 	import { type Trigger, type TriggerType } from '$lib/components/triggers/utils'
 	import { Menu, Menubar, MeltButton, MenuItem, Tooltip } from '$lib/components/meltComponents'
@@ -69,6 +76,7 @@
 			email: { icon: Mail, countKey: 'email_count' },
 			nats: { icon: NatsIcon, countKey: 'nats_count', disabled: !$enterpriseLicense },
 			mqtt: { icon: MqttIcon, countKey: 'mqtt_count', disabled: !$enterpriseLicense },
+			amqp: { icon: AmqpIcon, countKey: 'amqp_count' },
 			sqs: { icon: AwsIcon, countKey: 'sqs_count', disabled: !$enterpriseLicense },
 			gcp: { icon: GoogleCloudIcon, countKey: 'gcp_count', disabled: !$enterpriseLicense },
 			azure: { icon: AzureIcon, countKey: 'azure_count', disabled: !$enterpriseLicense },
@@ -103,6 +111,7 @@
 		'default_email',
 		'nats',
 		'mqtt',
+		'amqp',
 		'sqs',
 		'gcp',
 		'azure',
diff --git a/frontend/src/lib/components/icons/AmqpIcon.svelte b/frontend/src/lib/components/icons/AmqpIcon.svelte
new file mode 100644
index 0000000000..41987f704f
--- /dev/null
+++ b/frontend/src/lib/components/icons/AmqpIcon.svelte
@@ -0,0 +1,22 @@
+<script lang="ts">
+	interface Props {
+		size?: number
+		color?: string | undefined
+		class?: string
+	}
+
+	let { size = 16, color = undefined, class: clazz = '' }: Props = $props()
+</script>
+
+<svg
+	xmlns="http://www.w3.org/2000/svg"
+	width={`${size}px`}
+	height={`${size}px`}
+	viewBox="0 0 24 24"
+	fill={color ?? 'currentColor'}
+	class={clazz}
+>
+	<path
+		d="M21 3H3a1 1 0 0 0-1 1v6a1 1 0 0 0 1 1h6v2H7v3a1 1 0 0 0 1 1h1v2H7v2h10v-2h-2v-2h1a1 1 0 0 0 1-1v-3h-2v-2h6a1 1 0 0 0 1-1V4a1 1 0 0 0-1-1Zm-1 6H4V5h16v4Zm-9 9v-2h2v2h-2Zm-4-5h10v2H7v-2Z"
+	/>
+</svg>
diff --git a/frontend/src/lib/components/icons/index.ts b/frontend/src/lib/components/icons/index.ts
index b39df4310e..7774bb50f0 100644
--- a/frontend/src/lib/components/icons/index.ts
+++ b/frontend/src/lib/components/icons/index.ts
@@ -104,6 +104,7 @@ import XeroIcon from './XeroIcon.svelte'
 import KafkaIcon from './KafkaIcon.svelte'
 import NatsIcon from './NatsIcon.svelte'
 import MqttIcon from './MqttIcon.svelte'
+import AmqpIcon from './AmqpIcon.svelte'
 import ApifyIcon from './ApifyIcon.svelte'
 import McpIcon from './McpIcon.svelte'
 import SageIcon from './SageIcon.svelte'
@@ -333,6 +334,7 @@ export const APP_TO_ICON_COMPONENT = {
 	kafka: KafkaIcon,
 	nats: NatsIcon,
 	mqtt: MqttIcon,
+	amqp: AmqpIcon,
 	apify: ApifyIcon,
 	mcp: McpIcon,
 	zoho: ZohoIcon,
@@ -550,6 +552,7 @@ export {
 	KafkaIcon,
 	NatsIcon,
 	MqttIcon,
+	AmqpIcon,
 	ApifyIcon,
 	McpIcon,
 	ZohoIcon,
diff --git a/frontend/src/lib/components/offboarding-utils.ts b/frontend/src/lib/components/offboarding-utils.ts
index f6f41bcc68..11f266e101 100644
--- a/frontend/src/lib/components/offboarding-utils.ts
+++ b/frontend/src/lib/components/offboarding-utils.ts
@@ -28,6 +28,7 @@ const TRIGGER_TABLE_TO_ROUTE: Record<string, string> = {
 	kafka_trigger: 'kafka_triggers',
 	postgres_trigger: 'postgres_triggers',
 	mqtt_trigger: 'mqtt_triggers',
+	amqp_trigger: 'amqp_triggers',
 	nats_trigger: 'nats_triggers',
 	sqs_trigger: 'sqs_triggers',
 	gcp_trigger: 'gcp_triggers',
@@ -41,6 +42,7 @@ const TRIGGER_TABLE_TO_LABEL: Record<string, string> = {
 	kafka_trigger: 'kafka trigger',
 	postgres_trigger: 'postgres trigger',
 	mqtt_trigger: 'mqtt trigger',
+	amqp_trigger: 'amqp trigger',
 	nats_trigger: 'nats trigger',
 	sqs_trigger: 'sqs trigger',
 	gcp_trigger: 'gcp trigger',
diff --git a/frontend/src/lib/components/search/GlobalSearchModal.svelte b/frontend/src/lib/components/search/GlobalSearchModal.svelte
index 3e631a55e9..d2b27635da 100644
--- a/frontend/src/lib/components/search/GlobalSearchModal.svelte
+++ b/frontend/src/lib/components/search/GlobalSearchModal.svelte
@@ -40,7 +40,15 @@
 	import { Alert } from '../common'
 	import Popover from '../Popover.svelte'
 	import Logs from 'lucide-svelte/icons/logs'
-	import { AwsIcon, AzureIcon, GoogleCloudIcon, KafkaIcon, MqttIcon, NatsIcon } from '../icons'
+	import {
+		AwsIcon,
+		AzureIcon,
+		GoogleCloudIcon,
+		KafkaIcon,
+		MqttIcon,
+		AmqpIcon,
+		NatsIcon
+	} from '../icons'
 	import RunsSearch from './RunsSearch.svelte'
 	import AskAiButton from '../copilot/AskAiButton.svelte'
 
@@ -152,6 +160,13 @@
 			icon: MqttIcon,
 			disabled: $userStore?.operator
 		},
+		{
+			search_id: 'nav:amqp_triggers',
+			label: 'Go to AMQP triggers',
+			action: (newtab: boolean = false) => gotoPage('/amqp_triggers', newtab),
+			icon: AmqpIcon,
+			disabled: $userStore?.operator
+		},
 		{
 			search_id: 'nav:email_triggers',
 			label: 'Go to Email triggers',
diff --git a/frontend/src/lib/components/sessions/previewRouter.ts b/frontend/src/lib/components/sessions/previewRouter.ts
index f6a3cc8be4..1a876491db 100644
--- a/frontend/src/lib/components/sessions/previewRouter.ts
+++ b/frontend/src/lib/components/sessions/previewRouter.ts
@@ -57,6 +57,7 @@ export type TriggerKind =
 	| 'gcp'
 	| 'azure'
 	| 'mqtt'
+	| 'amqp'
 	| 'email'
 
 export const TRIGGER_PAGES: Record<TriggerKind, { path: string; label: string; ee?: boolean }> = {
@@ -69,6 +70,7 @@ export const TRIGGER_PAGES: Record<TriggerKind, { path: string; label: string; e
 	gcp: { path: '/gcp_triggers', label: 'GCP Pub/Sub triggers', ee: true },
 	azure: { path: '/azure_triggers', label: 'Azure Event Grid triggers', ee: true },
 	mqtt: { path: '/mqtt_triggers', label: 'MQTT triggers' },
+	amqp: { path: '/amqp_triggers', label: 'AMQP triggers' },
 	email: { path: '/email_triggers', label: 'Email triggers' }
 }
 
diff --git a/frontend/src/lib/components/sessions/sessionDeployModel.ts b/frontend/src/lib/components/sessions/sessionDeployModel.ts
index 173f732132..d38de06c86 100644
--- a/frontend/src/lib/components/sessions/sessionDeployModel.ts
+++ b/frontend/src/lib/components/sessions/sessionDeployModel.ts
@@ -26,6 +26,7 @@ const DEPLOY_KIND_BY_DRAFT_KIND: Partial<Record<UserDraftItemKind, Kind>> = {
 	trigger_nats: 'nats_trigger',
 	trigger_postgres: 'postgres_trigger',
 	trigger_mqtt: 'mqtt_trigger',
+	trigger_amqp: 'amqp_trigger',
 	trigger_sqs: 'sqs_trigger',
 	trigger_gcp: 'gcp_trigger',
 	trigger_azure: 'azure_trigger',
diff --git a/frontend/src/lib/components/sidebar/OperatorMenu.svelte b/frontend/src/lib/components/sidebar/OperatorMenu.svelte
index b3b30aa710..e6519ffafc 100644
--- a/frontend/src/lib/components/sidebar/OperatorMenu.svelte
+++ b/frontend/src/lib/components/sidebar/OperatorMenu.svelte
@@ -158,6 +158,7 @@
 					kind: 'azure'
 				},
 				{ label: 'MQTT triggers', id: 'triggers', href: `${base}/mqtt_triggers`, kind: 'mqtt' },
+				{ label: 'AMQP triggers', id: 'triggers', href: `${base}/amqp_triggers`, kind: 'amqp' },
 				{ label: 'Email triggers', id: 'triggers', href: `${base}/email_triggers`, kind: 'email' }
 			] as TriggerMenuLink[]
 		).filter(filterLink)
diff --git a/frontend/src/lib/components/sidebar/SidebarContent.svelte b/frontend/src/lib/components/sidebar/SidebarContent.svelte
index 524c11072a..2fffd7b22c 100644
--- a/frontend/src/lib/components/sidebar/SidebarContent.svelte
+++ b/frontend/src/lib/components/sidebar/SidebarContent.svelte
@@ -58,6 +58,7 @@
 	import KafkaIcon from '../icons/KafkaIcon.svelte'
 	import NatsIcon from '../icons/NatsIcon.svelte'
 	import MqttIcon from '../icons/MqttIcon.svelte'
+	import AmqpIcon from '../icons/AmqpIcon.svelte'
 	import AwsIcon from '../icons/AwsIcon.svelte'
 	import {
 		getAvailableNativeTriggerServices,
@@ -359,6 +360,15 @@
 			aiId: 'sidebar-menu-link-mqtt',
 			aiDescription: 'Button to navigate to MQTT triggers'
 		},
+		{
+			label: 'AMQP',
+			href: '/amqp_triggers',
+			icon: AmqpIcon,
+			disabled: $userStore?.operator,
+			kind: 'amqp',
+			aiId: 'sidebar-menu-link-amqp',
+			aiDescription: 'Button to navigate to AMQP triggers'
+		},
 		{
 			label: 'Email',
 			href: '/email_triggers',
diff --git a/frontend/src/lib/components/triggers.ts b/frontend/src/lib/components/triggers.ts
index a870b9a622..9f41d7ced5 100644
--- a/frontend/src/lib/components/triggers.ts
+++ b/frontend/src/lib/components/triggers.ts
@@ -54,6 +54,7 @@ export type TriggerKind =
 	| 'nats'
 	| 'postgres'
 	| 'mqtt'
+	| 'amqp'
 	| 'sqs'
 	| 'gcp'
 	| 'azure'
@@ -78,6 +79,8 @@ export function captureTriggerKindToTriggerKind(kind: CaptureTriggerKind): Trigg
 			return 'nats'
 		case 'mqtt':
 			return 'mqtt'
+		case 'amqp':
+			return 'amqp'
 		case 'sqs':
 			return 'sqs'
 		case 'postgres':
diff --git a/frontend/src/lib/components/triggers/AddTriggersButton.svelte b/frontend/src/lib/components/triggers/AddTriggersButton.svelte
index 19daa64489..901eb37244 100644
--- a/frontend/src/lib/components/triggers/AddTriggersButton.svelte
+++ b/frontend/src/lib/components/triggers/AddTriggersButton.svelte
@@ -92,6 +92,12 @@
 				icon: triggerIconMap.mqtt,
 				extra: cloudHosted ? extra : undefined
 			},
+			{
+				displayName: 'AMQP',
+				action: () => onAddDraftTrigger?.('amqp'),
+				icon: triggerIconMap.amqp,
+				extra: cloudHosted ? extra : undefined
+			},
 			{
 				displayName: 'SQS',
 				action: () => onAddDraftTrigger?.('sqs'),
diff --git a/frontend/src/lib/components/triggers/CaptureButton.svelte b/frontend/src/lib/components/triggers/CaptureButton.svelte
index 995be6e1f5..cf148d19f4 100644
--- a/frontend/src/lib/components/triggers/CaptureButton.svelte
+++ b/frontend/src/lib/components/triggers/CaptureButton.svelte
@@ -11,6 +11,7 @@
 	import AwsIcon from '../icons/AwsIcon.svelte'
 	import DropdownV2 from '$lib/components/DropdownV2.svelte'
 	import MqttIcon from '../icons/MqttIcon.svelte'
+	import AmqpIcon from '../icons/AmqpIcon.svelte'
 	import GoogleCloudIcon from '../icons/GoogleCloudIcon.svelte'
 
 	interface Props {
@@ -61,6 +62,11 @@
 			displayName: 'MQTT',
 			action: () => handleClick('mqtt')
 		},
+		{
+			icon: AmqpIcon,
+			displayName: 'AMQP',
+			action: () => handleClick('amqp')
+		},
 		{
 			icon: Database,
 			displayName: 'Postgres',
diff --git a/frontend/src/lib/components/triggers/CaptureTable.svelte b/frontend/src/lib/components/triggers/CaptureTable.svelte
index 18ab7d7e91..2d20ac02e1 100644
--- a/frontend/src/lib/components/triggers/CaptureTable.svelte
+++ b/frontend/src/lib/components/triggers/CaptureTable.svelte
@@ -17,7 +17,7 @@
 	import { isObject, sendUserToast } from '$lib/utils'
 	import SchemaPickerRow from '$lib/components/schema/SchemaPickerRow.svelte'
 	import type { Capture } from '$lib/gen'
-	import { AwsIcon, MqttIcon } from '../icons'
+	import { AwsIcon, MqttIcon, AmqpIcon } from '../icons'
 	import GoogleCloudIcon from '../icons/GoogleCloudIcon.svelte'
 
 	interface Props {
@@ -218,6 +218,7 @@
 		websocket: Unplug,
 		kafka: KafkaIcon,
 		mqtt: MqttIcon,
+		amqp: AmqpIcon,
 		sqs: AwsIcon,
 		postgres: DatabaseIcon,
 		gcp: GoogleCloudIcon
diff --git a/frontend/src/lib/components/triggers/CaptureWrapper.svelte b/frontend/src/lib/components/triggers/CaptureWrapper.svelte
index 2c56681230..bfffbfc56b 100644
--- a/frontend/src/lib/components/triggers/CaptureWrapper.svelte
+++ b/frontend/src/lib/components/triggers/CaptureWrapper.svelte
@@ -13,6 +13,7 @@
 	import KafkaCapture from './kafka/KafkaCapture.svelte'
 	import NatsCapture from './nats/NatsCapture.svelte'
 	import MqttCapture from './mqtt/MqttCapture.svelte'
+	import AmqpCapture from './amqp/AmqpCapture.svelte'
 	import SqsCapture from './sqs/SqsCapture.svelte'
 	import GcpCapture from './gcp/GcpCapture.svelte'
 	import AzureCapture from './azure/AzureCapture.svelte'
@@ -78,9 +79,17 @@
 		if (captureType === 'azure' && args.azure_mode !== 'namespace_pull') {
 			return false
 		}
-		return ['mqtt', 'sqs', 'websocket', 'postgres', 'kafka', 'nats', 'gcp', 'azure'].includes(
-			captureType
-		)
+		return [
+			'mqtt',
+			'amqp',
+			'sqs',
+			'websocket',
+			'postgres',
+			'kafka',
+			'nats',
+			'gcp',
+			'azure'
+		].includes(captureType)
 	}
 
 	async function getCaptureConfigs() {
@@ -301,6 +310,20 @@
 				on:captureToggle={handleCapture}
 				on:testWithArgs
 			/>
+		{:else if captureType === 'amqp'}
+			<AmqpCapture
+				{isValid}
+				{captureInfo}
+				{hasPreprocessor}
+				{isFlow}
+				{captureLoading}
+				{triggerDeployed}
+				on:applyArgs
+				on:updateSchema
+				on:addPreprocessor
+				on:captureToggle={handleCapture}
+				on:testWithArgs
+			/>
 		{:else if captureType === 'sqs'}
 			<SqsCapture
 				{isValid}
diff --git a/frontend/src/lib/components/triggers/TestTriggerConnection.svelte b/frontend/src/lib/components/triggers/TestTriggerConnection.svelte
index ec2ec5eb4b..77a81ba432 100644
--- a/frontend/src/lib/components/triggers/TestTriggerConnection.svelte
+++ b/frontend/src/lib/components/triggers/TestTriggerConnection.svelte
@@ -3,6 +3,7 @@
 		CancelablePromise,
 		KafkaTriggerService,
 		MqttTriggerService,
+		AmqpTriggerService,
 		NatsTriggerService,
 		SqsTriggerService,
 		PostgresTriggerService,
@@ -15,18 +16,13 @@
 	import Button from '../common/button/Button.svelte'
 
 	interface Props {
-		kind: 'websocket' | 'nats' | 'kafka' | 'postgres' | 'sqs' | 'mqtt' | 'gcp';
-		args: Record<string, any>;
-		noButton?: boolean;
-		testLoading?: boolean;
+		kind: 'websocket' | 'nats' | 'kafka' | 'postgres' | 'sqs' | 'mqtt' | 'amqp' | 'gcp'
+		args: Record<string, any>
+		noButton?: boolean
+		testLoading?: boolean
 	}
 
-	let {
-		kind,
-		args,
-		noButton = false,
-		testLoading = $bindable(false)
-	}: Props = $props();
+	let { kind, args, noButton = false, testLoading = $bindable(false) }: Props = $props()
 	const triggerWs = getTriggerWorkspace()
 	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
 
@@ -37,6 +33,7 @@
 		sqs: 'SQS',
 		postgres: 'Postgres',
 		mqtt: 'MQTT broker',
+		amqp: 'AMQP broker',
 		gcp: 'Google Cloud Pub/Sub'
 	}
 
@@ -69,6 +66,11 @@
 					workspace: wsId!,
 					requestBody: args as any
 				})
+			} else if (kind === 'amqp') {
+				promise = AmqpTriggerService.testAmqpConnection({
+					workspace: wsId!,
+					requestBody: args as any
+				})
 			} else if (kind === 'sqs') {
 				promise = SqsTriggerService.testSqsConnection({
 					workspace: wsId!,
diff --git a/frontend/src/lib/components/triggers/TriggersEditor.svelte b/frontend/src/lib/components/triggers/TriggersEditor.svelte
index 3f886be4ee..44f565d086 100644
--- a/frontend/src/lib/components/triggers/TriggersEditor.svelte
+++ b/frontend/src/lib/components/triggers/TriggersEditor.svelte
@@ -26,6 +26,7 @@
 		KafkaTriggerService,
 		NatsTriggerService,
 		MqttTriggerService,
+		AmqpTriggerService,
 		HttpTriggerService,
 		GcpTriggerService,
 		AzureTriggerService,
@@ -116,6 +117,7 @@
 			azure: () => AzureTriggerService.deleteAzureTrigger,
 			sqs: () => SqsTriggerService.deleteSqsTrigger,
 			mqtt: () => MqttTriggerService.deleteMqttTrigger,
+			amqp: () => AmqpTriggerService.deleteAmqpTrigger,
 			http: () => HttpTriggerService.deleteHttpTrigger,
 			email: () => EmailTriggerService.deleteEmailTrigger
 		}
@@ -255,6 +257,14 @@
 				isFlow,
 				$userStore
 			)
+		} else if (triggerType === 'amqp') {
+			await triggersState.fetchAmqpTriggers(
+				triggersCount,
+				$workspaceStore,
+				currentPath,
+				isFlow,
+				$userStore
+			)
 		} else if (triggerType === 'http') {
 			await triggersState.fetchHttpTriggers(
 				triggersCount,
diff --git a/frontend/src/lib/components/triggers/TriggersWrapper.svelte b/frontend/src/lib/components/triggers/TriggersWrapper.svelte
index 6b9399c6a2..72e96c9150 100644
--- a/frontend/src/lib/components/triggers/TriggersWrapper.svelte
+++ b/frontend/src/lib/components/triggers/TriggersWrapper.svelte
@@ -8,6 +8,7 @@
 	import KafkaTriggerPanel from './kafka/KafkaTriggersPanel.svelte'
 	import NatsTriggersPanel from './nats/NatsTriggersPanel.svelte'
 	import MqttTriggerPanel from './mqtt/MqttTriggersPanel.svelte'
+	import AmqpTriggerPanel from './amqp/AmqpTriggersPanel.svelte'
 	import SqsTriggerPanel from './sqs/SqsTriggerPanel.svelte'
 	import GcpTriggerPanel from './gcp/GcpTriggerPanel.svelte'
 	import AzureTriggerPanel from './azure/AzureTriggerPanel.svelte'
@@ -143,6 +144,15 @@
 		{customLabel}
 		{...props}
 	/>
+{:else if selectedTrigger.type === 'amqp'}
+	<AmqpTriggerPanel
+		{isFlow}
+		path={initialPath || fakeInitialPath}
+		{selectedTrigger}
+		defaultValues={selectedTrigger.draftConfig ?? selectedTrigger.captureConfig ?? undefined}
+		{customLabel}
+		{...props}
+	/>
 {:else if selectedTrigger.type === 'sqs'}
 	<SqsTriggerPanel
 		{isFlow}
diff --git a/frontend/src/lib/components/triggers/amqp/AmqpCapture.svelte b/frontend/src/lib/components/triggers/amqp/AmqpCapture.svelte
new file mode 100644
index 0000000000..4a484ac422
--- /dev/null
+++ b/frontend/src/lib/components/triggers/amqp/AmqpCapture.svelte
@@ -0,0 +1,58 @@
+<script lang="ts">
+	import { fade } from 'svelte/transition'
+	import type { CaptureInfo } from '../CaptureSection.svelte'
+	import CaptureSection from '../CaptureSection.svelte'
+
+	interface Props {
+		captureInfo?: CaptureInfo | undefined
+		isValid?: boolean | undefined
+		hasPreprocessor?: boolean
+		isFlow?: boolean
+		captureLoading?: boolean
+		triggerDeployed?: boolean
+	}
+
+	let {
+		captureInfo = undefined,
+		isValid = undefined,
+		hasPreprocessor = false,
+		isFlow = false,
+		captureLoading = false,
+		triggerDeployed = false
+	}: Props = $props()
+</script>
+
+{#if captureInfo}
+	<CaptureSection
+		captureType="amqp"
+		disabled={isValid === false}
+		{captureInfo}
+		on:captureToggle
+		on:applyArgs
+		on:updateSchema
+		on:addPreprocessor
+		on:testWithArgs
+		{hasPreprocessor}
+		{isFlow}
+		{captureLoading}
+		displayAlert={triggerDeployed}
+	>
+		{#snippet description()}
+			{#if captureInfo.active}
+				{#if captureInfo.connectionInfo?.connected}
+					<p in:fade={{ duration: 100, delay: 50 }} out:fade={{ duration: 50 }}>
+						Listening to AMQP messages...
+					</p>
+				{:else}
+					<p in:fade={{ duration: 100, delay: 50 }} out:fade={{ duration: 50 }}>
+						Connecting to amqp...
+					</p>
+				{/if}
+			{:else}
+				<p in:fade={{ duration: 100, delay: 50 }} out:fade={{ duration: 50 }}>
+					Start capturing to listen to AMQP messages.
+				</p>
+			{/if}
+		{/snippet}
+	</CaptureSection>
+{/if}
diff --git a/frontend/src/lib/components/triggers/amqp/AmqpEditorConfigSection.svelte b/frontend/src/lib/components/triggers/amqp/AmqpEditorConfigSection.svelte
new file mode 100644
index 0000000000..72b6f6360a
--- /dev/null
+++ b/frontend/src/lib/components/triggers/amqp/AmqpEditorConfigSection.svelte
@@ -0,0 +1,175 @@
+<script lang="ts">
+	import Section from '$lib/components/Section.svelte'
+	import Required from '$lib/components/Required.svelte'
+	import { Plus, X } from 'lucide-svelte'
+	import Subsection from '$lib/components/Subsection.svelte'
+	import ResourcePicker from '$lib/components/ResourcePicker.svelte'
+	import type { AmqpExchange, AmqpOptions } from '$lib/gen'
+	import Button from '$lib/components/common/button/Button.svelte'
+	import TextInput from '$lib/components/text_input/TextInput.svelte'
+	import Toggle from '$lib/components/Toggle.svelte'
+	import { fade } from 'svelte/transition'
+	import { emptyStringTrimmed } from '$lib/utils'
+	import TestTriggerConnection from '../TestTriggerConnection.svelte'
+	import Tooltip from '$lib/components/Tooltip.svelte'
+	import TestingBadge from '../testingBadge.svelte'
+	import { workspaceStore } from '$lib/stores'
+	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
+
+	interface Props {
+		can_write?: boolean
+		amqp_resource_path: string
+		queue_name: string
+		exchange?: AmqpExchange | undefined
+		options?: AmqpOptions | undefined
+		isValid: boolean
+		showTestingBadge?: boolean
+	}
+
+	let {
+		can_write = false,
+		amqp_resource_path = $bindable(),
+		queue_name = $bindable(),
+		exchange = $bindable(),
+		options = $bindable(),
+		isValid = $bindable(),
+		showTestingBadge = false
+	}: Props = $props()
+
+	const triggerWs = getTriggerWorkspace()
+	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+
+	// Toggling the exchange binding on/off. Off means the queue is consumed
+	// directly with no exchange binding.
+	let bindExchange = $state(false)
+	$effect(() => {
+		bindExchange = !!exchange
+	})
+
+	$effect(() => {
+		isValid =
+			!emptyStringTrimmed(amqp_resource_path) &&
+			!emptyStringTrimmed(queue_name) &&
+			// when the exchange binding is enabled, its name must be set
+			(!exchange || !emptyStringTrimmed(exchange.exchange_name))
+	})
+</script>
+
+<div class="flex flex-col gap-12">
+	<Section label="AMQP">
+		{#snippet header()}
+			{#if showTestingBadge}
+				<TestingBadge />
+			{/if}
+		{/snippet}
+		<div class="flex flex-col w-full gap-12">
+			<Subsection label="Connection setup">
+				<ResourcePicker
+					workspace={wsId}
+					resourceType="amqp"
+					disabled={!can_write}
+					bind:value={amqp_resource_path}
+				/>
+				{#if !emptyStringTrimmed(amqp_resource_path)}
+					<TestTriggerConnection kind="amqp" args={{ amqp_resource_path }} />
+				{/if}
+			</Subsection>
+
+			<Subsection label="Queue">
+				<p class="text-xs text-primary mb-2">
+					Name of the queue to consume messages from<Required required={true} />
+				</p>
+				<TextInput
+					bind:value={queue_name}
+					inputProps={{ placeholder: 'queue name', disabled: !can_write, autocomplete: 'off' }}
+				/>
+			</Subsection>
+
+			<Subsection label="Exchange binding">
+				<Toggle
+					textClass="font-normal text-sm"
+					color="nord"
+					size="xs"
+					checked={bindExchange}
+					disabled={!can_write}
+					on:change={(ev) => {
+						if (ev.detail) {
+							exchange = { exchange_name: '', routing_keys: [] }
+						} else {
+							exchange = undefined
+						}
+					}}
+					options={{
+						right: 'Bind the queue to an exchange',
+						rightTooltip:
+							'Declare the queue and bind it to an exchange for each routing key, so messages published to the exchange are routed to it.'
+					}}
+					class="py-1"
+				/>
+
+				{#if exchange}
+					<div class="flex flex-col gap-2 mt-2">
+						<label class="flex flex-col w-full gap-1">
+							<span class="text-secondary text-sm">Exchange name</span>
+							<TextInput
+								bind:value={exchange.exchange_name}
+								inputProps={{
+									placeholder: 'exchange name',
+									disabled: !can_write,
+									autocomplete: 'off'
+								}}
+							/>
+						</label>
+
+						<span class="text-secondary text-sm mt-2">
+							Routing keys
+							<Tooltip>The routing keys used to bind the queue to the exchange.</Tooltip>
+						</span>
+						{#each exchange.routing_keys ?? [] as _, i}
+							<div class="flex w-full gap-2 items-center">
+								<TextInput
+									bind:value={exchange.routing_keys![i]}
+									inputProps={{
+										placeholder: 'routing key',
+										disabled: !can_write,
+										autocomplete: 'off'
+									}}
+								/>
+								<button
+									transition:fade|local={{ duration: 100 }}
+									class="rounded-full p-1 bg-surface-secondary duration-200 hover:bg-surface-hover"
+									aria-label="Clear"
+									onclick={() => {
+										if (exchange) {
+											exchange.routing_keys = (exchange.routing_keys ?? []).filter(
+												(_, index) => index !== i
+											)
+										}
+									}}
+								>
+									<X size={14} />
+								</button>
+							</div>
+						{/each}
+						<div class="flex items-baseline">
+							<Button
+								variant="default"
+								size="xs"
+								btnClasses="mt-1"
+								disabled={!can_write}
+								on:click={() => {
+									if (exchange) {
+										exchange.routing_keys = [...(exchange.routing_keys ?? []), '']
+									}
+								}}
+								startIcon={{ icon: Plus }}
+							>
+								Add routing key
+							</Button>
+						</div>
+					</div>
+				{/if}
+			</Subsection>
+		</div>
+	</Section>
+</div>
diff --git a/frontend/src/lib/components/triggers/amqp/AmqpTriggerEditor.svelte b/frontend/src/lib/components/triggers/amqp/AmqpTriggerEditor.svelte
new file mode 100644
index 0000000000..cc181951bf
--- /dev/null
+++ b/frontend/src/lib/components/triggers/amqp/AmqpTriggerEditor.svelte
@@ -0,0 +1,29 @@
+<script lang="ts">
+	import { tick } from 'svelte'
+	import AmqpTriggerEditorInner from './AmqpTriggerEditorInner.svelte'
+
+	let { onUpdate }: { onUpdate?: (path?: string) => void } = $props()
+
+	let open = $state(false)
+	export async function openEdit(ePath: string, isFlow: boolean, fixedScriptPath?: string) {
+		open = true
+		await tick()
+		drawer?.openEdit(ePath, isFlow, undefined, fixedScriptPath)
+	}
+
+	export async function openNew(
+		is_flow: boolean,
+		initial_script_path?: string,
+		defaultValues?: Record<string, any>
+	) {
+		open = true
+		await tick()
+		drawer?.openNew(is_flow, initial_script_path, defaultValues)
+	}
+
+	let drawer: AmqpTriggerEditorInner | undefined = $state()
+</script>
+
+{#if open}
+	<AmqpTriggerEditorInner {onUpdate} bind:this={drawer} />
+{/if}
diff --git a/frontend/src/lib/components/triggers/amqp/AmqpTriggerEditorInner.svelte b/frontend/src/lib/components/triggers/amqp/AmqpTriggerEditorInner.svelte
new file mode 100644
index 0000000000..6383db2a39
--- /dev/null
+++ b/frontend/src/lib/components/triggers/amqp/AmqpTriggerEditorInner.svelte
@@ -0,0 +1,615 @@
+<script lang="ts">
+	import { untrack } from 'svelte'
+	import { Alert } from '$lib/components/common'
+	import Drawer from '$lib/components/common/drawer/Drawer.svelte'
+	import DrawerContent from '$lib/components/common/drawer/DrawerContent.svelte'
+	import Path from '$lib/components/Path.svelte'
+	import TriggerRunnablePicker from '$lib/components/triggers/TriggerRunnablePicker.svelte'
+	import { usedTriggerKinds, userStore, workspaceStore } from '$lib/stores'
+	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
+	import { canWrite, capitalize, emptyString, sendUserToast } from '$lib/utils'
+	import { withForkConflictRetry } from '$lib/utils/forkConflict'
+	import Section from '$lib/components/Section.svelte'
+	import { Loader2 } from 'lucide-svelte'
+	import Label from '$lib/components/Label.svelte'
+	import {
+		AmqpTriggerService,
+		type AmqpExchange,
+		type AmqpOptions,
+		type Retry,
+		type ErrorHandler,
+		type TriggerMode
+	} from '$lib/gen'
+	import AmqpEditorConfigSection from './AmqpEditorConfigSection.svelte'
+	import type { Snippet } from 'svelte'
+	import TriggerEditorToolbar from '../TriggerEditorToolbar.svelte'
+	import PermissionedAsLine from '../PermissionedAsLine.svelte'
+	import { saveAmqpTriggerFromCfg } from './utils'
+	import { getHandlerType, handleConfigChange, type Trigger } from '../utils'
+	import Tabs from '$lib/components/common/tabs/Tabs.svelte'
+	import Tab from '$lib/components/common/tabs/Tab.svelte'
+	import TriggerRetriesAndErrorHandler from '../TriggerRetriesAndErrorHandler.svelte'
+	import TriggerAdvancedBadges from '../TriggerAdvancedBadges.svelte'
+	import Toggle from '$lib/components/Toggle.svelte'
+	import TextInput from '$lib/components/text_input/TextInput.svelte'
+	import TriggerSuspendedJobsAlert from '../TriggerSuspendedJobsAlert.svelte'
+	import TriggerSuspendedJobsModal from '../TriggerSuspendedJobsModal.svelte'
+	import { deepEqual } from 'fast-equals'
+	import { useTriggerDraftSync } from '../useTriggerDraftSync.svelte'
+	import LocalDraftBanner from '$lib/components/LocalDraftBanner.svelte'
+
+	interface Props {
+		useDrawer?: boolean
+		description?: Snippet | undefined
+		hideTarget?: boolean
+		hideTooltips?: boolean
+		isEditor?: boolean
+		allowDraft?: boolean
+		trigger?: Trigger
+		customLabel?: Snippet
+		isDeployed?: boolean
+		cloudDisabled?: boolean
+		onConfigChange?: (cfg: Record<string, any>, saveDisabled: boolean, updated: boolean) => void
+		onCaptureConfigChange?: (cfg: Record<string, any>, isValid: boolean) => void
+		onUpdate?: (path?: string) => void
+		onDelete?: () => void
+		onReset?: () => void
+	}
+
+	let {
+		useDrawer = true,
+		description = undefined,
+		hideTarget = false,
+		hideTooltips = false,
+		isEditor = false,
+		allowDraft = false,
+		trigger = undefined,
+		customLabel = undefined,
+		isDeployed = false,
+		onConfigChange = undefined,
+		onCaptureConfigChange = undefined,
+		onUpdate = undefined,
+		onDelete = undefined,
+		onReset = undefined,
+		cloudDisabled = false
+	}: Props = $props()
+	const triggerWs = getTriggerWorkspace()
+	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+
+	let amqp_resource_path: string = $state('')
+	let drawer: Drawer | undefined = $state(undefined)
+	let is_flow: boolean = $state(false)
+	let initialPath = $state('')
+	let edit = $state(true)
+	let itemKind: 'flow' | 'script' = $state('script')
+	let script_path = $state('')
+	let initialScriptPath = $state('')
+	let fixedScriptPath = $state('')
+	let path: string = $state('')
+	let pathError = $state('')
+	let mode = $state<TriggerMode>('enabled')
+	let dirtyPath = $state(false)
+	let can_write = $state(true)
+	let drawerLoading = $state(true)
+	let showLoading = $state(false)
+	let queue_name: string = $state('')
+	let exchange: AmqpExchange | undefined = $state(undefined)
+	let options: AmqpOptions | undefined = $state(undefined)
+	let isValid: boolean = $state(false)
+	let initialConfig: Record<string, any> | undefined = {}
+	let deploymentLoading = $state(false)
+	let permissionedAs = $state<string | undefined>(undefined)
+	let selectedPermissionedAs = $state<string | undefined>(undefined)
+	let preservePermissionedAs = $state(false)
+	let errorHandlerSelected: ErrorHandler = $state('slack')
+	let error_handler_path: string | undefined = $state()
+	let error_handler_args: Record<string, any> = $state({})
+	let retry: Retry | undefined = $state()
+	let suspendedJobsModal = $state<TriggerSuspendedJobsModal | null>(null)
+	let originalConfig = $state<Record<string, any> | undefined>(undefined)
+
+	let optionTabSelected: 'connection_options' | 'error_handler' | 'retries' =
+		$state('connection_options')
+
+	// prefetch is surfaced as a plain toggle-backed number in the Advanced tab.
+	let enablePrefetch = $state(false)
+
+	// Backend prefetch_count is a u16; block save on out-of-range/non-integer input.
+	const prefetchInvalid = $derived.by(() => {
+		if (!enablePrefetch) return false
+		const p = options?.prefetch_count
+		return p == undefined || !Number.isInteger(p) || p < 1 || p > 65535
+	})
+
+	let hasChanged = $derived(!deepEqual(getSaveCfg(), originalConfig ?? {}))
+	const amqpConfig = $derived.by(getSaveCfg)
+
+	const draftSync = useTriggerDraftSync({
+		itemKind: 'trigger_amqp',
+		path: () => initialPath,
+		workspace: () => wsId,
+		drawerLoading: () => drawerLoading,
+		getCfg: () => amqpConfig,
+		applyCfg: loadTriggerConfig,
+		deployed: () => originalConfig
+	})
+	const captureConfig = $derived.by(untrack(() => isEditor) ? getCaptureConfig : () => ({}))
+	const saveDisabled = $derived(
+		pathError != '' ||
+			emptyString(script_path) ||
+			!can_write ||
+			!isValid ||
+			prefetchInvalid ||
+			!hasChanged
+	)
+
+	$effect(() => {
+		is_flow = itemKind === 'flow'
+	})
+
+	export async function openEdit(
+		ePath: string,
+		isFlow: boolean,
+		defaultConfig?: Record<string, any>,
+		fixedScriptPath_?: string
+	) {
+		let loadingTimeout = setTimeout(() => {
+			showLoading = true
+		}, 100) // Do not show loading spinner for the first 100ms
+		drawerLoading = true
+		try {
+			drawer?.openDrawer()
+			initialPath = ePath
+			itemKind = isFlow ? 'flow' : 'script'
+			edit = true
+			dirtyPath = false
+			fixedScriptPath = fixedScriptPath_ ?? ''
+			const { overlay: draftOverlay, noDeployed } = await loadTrigger(defaultConfig)
+			edit = !noDeployed
+			originalConfig = structuredClone($state.snapshot(getSaveCfg()))
+			if (draftOverlay) loadTriggerConfig(draftOverlay)
+			if (!defaultConfig) {
+				initialConfig = structuredClone($state.snapshot(getSaveCfg()))
+			}
+			await draftSync.maybeRestore()
+		} catch (err) {
+			sendUserToast(`Could not load amqp trigger: ${err.body}`, true)
+		} finally {
+			clearTimeout(loadingTimeout)
+			drawerLoading = false
+			showLoading = false
+		}
+	}
+
+	export async function openNew(
+		nis_flow: boolean,
+		fixedScriptPath_?: string,
+		defaultValues?: Record<string, any>
+	) {
+		let loadingTimeout = setTimeout(() => {
+			showLoading = true
+		}, 100)
+		drawerLoading = true
+		try {
+			amqp_resource_path = defaultValues?.amqp_resource_path ?? ''
+			drawer?.openDrawer()
+			is_flow = nis_flow
+			itemKind = nis_flow ? 'flow' : 'script'
+			initialScriptPath = ''
+			fixedScriptPath = fixedScriptPath_ ?? ''
+			script_path = fixedScriptPath
+			queue_name = defaultValues?.queue_name ?? ''
+			exchange = defaultValues?.exchange ?? undefined
+			options = defaultValues?.options ?? undefined
+			enablePrefetch = options?.prefetch_count != undefined
+			path = defaultValues?.path ?? ''
+			initialPath = ''
+			edit = false
+			dirtyPath = false
+			mode = defaultValues?.mode ?? 'enabled'
+			error_handler_path = defaultValues?.error_handler_path ?? undefined
+			error_handler_args = defaultValues?.error_handler_args ?? {}
+			retry = defaultValues?.retry ?? undefined
+			errorHandlerSelected = getHandlerType(error_handler_path ?? '')
+			permissionedAs = undefined
+			selectedPermissionedAs = undefined
+			preservePermissionedAs = false
+			originalConfig = undefined
+		} finally {
+			clearTimeout(loadingTimeout)
+			drawerLoading = false
+			showLoading = false
+		}
+	}
+
+	async function loadTriggerConfig(cfg?: Record<string, any>): Promise<void> {
+		try {
+			amqp_resource_path = cfg?.amqp_resource_path
+			queue_name = cfg?.queue_name ?? ''
+			exchange = cfg?.exchange ?? undefined
+			options = cfg?.options ?? undefined
+			enablePrefetch = options?.prefetch_count != undefined
+			script_path = cfg?.script_path
+			initialScriptPath = cfg?.script_path
+			is_flow = cfg?.is_flow
+			path = cfg?.path
+			mode = cfg?.mode ?? 'enabled'
+			can_write = canWrite(cfg?.path, cfg?.extra_perms, $userStore)
+			error_handler_path = cfg?.error_handler_path
+			error_handler_args = cfg?.error_handler_args ?? {}
+			retry = cfg?.retry
+			errorHandlerSelected = getHandlerType(error_handler_path ?? '')
+			permissionedAs = cfg?.permissioned_as
+			selectedPermissionedAs = cfg?.permissioned_as
+			preservePermissionedAs = !!cfg?.permissioned_as
+		} catch (error) {
+			sendUserToast(`Could not load amqp trigger config: ${error.body}`, true)
+		}
+	}
+
+	/** See `NatsTriggerEditorInner.loadTrigger` for the rationale. */
+	async function loadTrigger(
+		defaultConfig?: Record<string, any>
+	): Promise<{ overlay: Record<string, any> | undefined; noDeployed: boolean }> {
+		try {
+			if (defaultConfig) {
+				loadTriggerConfig(defaultConfig)
+				return { overlay: undefined, noDeployed: false }
+			}
+			const s = await AmqpTriggerService.getAmqpTrigger({
+				workspace: wsId!,
+				path: initialPath,
+				getDraft: true
+			})
+			const { draft: draftFromBackend, ...deployedTrigger } = (s ?? {}) as any
+			loadTriggerConfig(deployedTrigger)
+			return {
+				noDeployed: !!(s as any)?.no_deployed,
+				overlay: draftFromBackend
+					? ({ ...deployedTrigger, ...draftFromBackend } as Record<string, any>)
+					: undefined
+			}
+		} catch (error) {
+			sendUserToast(`Could not load amqp trigger: ${error.body}`, true)
+			return { overlay: undefined, noDeployed: false }
+		}
+	}
+
+	function getSaveCfg(): Record<string, any> {
+		return {
+			amqp_resource_path,
+			queue_name,
+			exchange,
+			options,
+			path,
+			script_path,
+			mode,
+			is_flow,
+			error_handler_path,
+			error_handler_args,
+			retry,
+			permissioned_as: selectedPermissionedAs,
+			preserve_permissioned_as: preservePermissionedAs || undefined
+		}
+	}
+
+	function getCaptureConfig(): Record<string, any> {
+		return {
+			amqp_resource_path,
+			queue_name,
+			exchange,
+			options,
+			path
+		}
+	}
+
+	async function updateTrigger(): Promise<void> {
+		deploymentLoading = true
+		const previousPath = initialPath
+		const cfg = getSaveCfg()
+		const isSaved = await saveAmqpTriggerFromCfg(initialPath, cfg, edit, wsId!, usedTriggerKinds)
+		if (isSaved) {
+			draftSync.discard(previousPath, getSaveCfg())
+			onUpdate?.(cfg.path)
+			originalConfig = structuredClone($state.snapshot(getSaveCfg()))
+			initialPath = cfg.path
+			initialScriptPath = cfg.script_path
+			if (mode !== 'suspended') {
+				drawer?.closeDrawer()
+			}
+		}
+		deploymentLoading = false
+	}
+
+	async function handleToggleMode(newMode: TriggerMode) {
+		const previousMode = mode
+		mode = newMode
+		if (!trigger?.draftConfig) {
+			const ok = await withForkConflictRetry(
+				(force) =>
+					AmqpTriggerService.setAmqpTriggerMode({
+						path: initialPath,
+						workspace: wsId ?? '',
+						requestBody: { mode: newMode, force }
+					}),
+				'AMQP trigger'
+			)
+			if (!ok) {
+				mode = previousMode
+				return
+			}
+			sendUserToast(`${capitalize(newMode)} AMQP trigger ${initialPath}`)
+			onUpdate?.(initialPath)
+		}
+		if (originalConfig) {
+			originalConfig['mode'] = newMode
+		}
+	}
+
+	// Keep `options.prefetch_count` in sync with the enable toggle without
+	// leaving a stale value behind when it is switched off.
+	function setPrefetchEnabled(enabled: boolean) {
+		enablePrefetch = enabled
+		if (enabled) {
+			options = { ...(options ?? {}), prefetch_count: options?.prefetch_count ?? 10 }
+		} else if (options) {
+			const { prefetch_count: _drop, ...rest } = options
+			options = Object.keys(rest).length ? rest : undefined
+		}
+	}
+
+	function setDeclareQueue(declare: boolean) {
+		options = { ...(options ?? {}), declare_queue: declare }
+	}
+
+	$effect(() => {
+		let args = [captureConfig, isValid] as const
+		onCaptureConfigChange?.(...args)
+	})
+
+	$effect(() => {
+		if (!drawerLoading) {
+			handleConfigChange(amqpConfig, initialConfig, saveDisabled, edit, onConfigChange)
+		}
+	})
+</script>
+
+{#if mode === 'suspended'}
+	<TriggerSuspendedJobsModal
+		bind:this={suspendedJobsModal}
+		triggerPath={path}
+		triggerKind="amqp"
+		{hasChanged}
+		onToggleMode={handleToggleMode}
+		runnableConfig={{
+			path: script_path,
+			kind: itemKind,
+			retry,
+			errorHandlerPath: error_handler_path,
+			errorHandlerArgs: error_handler_args
+		}}
+	/>
+{/if}
+
+{#if useDrawer}
+	<Drawer size="800px" bind:this={drawer}>
+		<DrawerContent
+			bannerReserved={draftSync.hasBaseline}
+			title={edit
+				? can_write
+					? `Edit AMQP trigger ${initialPath}`
+					: `AMQP trigger ${initialPath}`
+				: 'New AMQP trigger'}
+			on:close={drawer.closeDrawer}
+		>
+			{#snippet actions()}
+				{@render actionsSnippet()}
+			{/snippet}
+			{#snippet banner()}
+				<LocalDraftBanner
+					show={draftSync.hasDraft}
+					getDeployed={() => draftSync.deployed}
+					reserveSpace={draftSync.hasBaseline}
+					getCurrent={() => draftSync.current}
+					onDiscard={() => draftSync.resetToDeployed(initialPath)}
+					disabled={!can_write}
+				/>
+			{/snippet}
+			{@render config()}
+		</DrawerContent>
+	</Drawer>
+{:else}
+	<Section label={!customLabel ? 'AMQP trigger' : ''} headerClass="grow min-w-0 h-[30px]">
+		{#snippet header()}
+			{#if customLabel}
+				{@render customLabel()}
+			{/if}
+		{/snippet}
+		{#snippet action()}
+			{@render actionsSnippet()}
+		{/snippet}
+		{@render config()}
+	</Section>
+{/if}
+
+{#snippet actionsSnippet()}
+	{#if !drawerLoading}
+		<TriggerEditorToolbar
+			{trigger}
+			permissions={drawerLoading || !can_write ? 'none' : 'create'}
+			{saveDisabled}
+			{mode}
+			{allowDraft}
+			{edit}
+			isLoading={deploymentLoading}
+			{isDeployed}
+			onUpdate={updateTrigger}
+			{onReset}
+			{onDelete}
+			onToggleMode={handleToggleMode}
+			{cloudDisabled}
+			{suspendedJobsModal}
+		/>
+	{/if}
+{/snippet}
+
+{#snippet config()}
+	{#if drawerLoading}
+		{#if showLoading}
+			<Loader2 class="animate-spin" />
+		{/if}
+	{:else}
+		<PermissionedAsLine
+			{permissionedAs}
+			{path}
+			onPermissionedAsChange={(pa, preserve) => {
+				selectedPermissionedAs = pa
+				preservePermissionedAs = preserve
+			}}
+		/>
+		<div class="flex flex-col gap-4">
+			{#if description}
+				{@render description()}
+			{/if}
+			{#if !hideTooltips}
+				<Alert title="Info" type="info" size="xs">
+					{#if edit}
+						Changes can take up to 30 seconds to take effect.
+					{:else}
+						New AMQP triggers can take up to 30 seconds to start listening.
+					{/if}
+				</Alert>
+			{/if}
+		</div>
+		<div class="flex flex-col gap-12 mt-6">
+			{#if mode === 'suspended'}
+				<TriggerSuspendedJobsAlert {suspendedJobsModal} />
+			{/if}
+			<div class="flex flex-col gap-4">
+				<Label label="Path">
+					<Path
+						workspaceOverride={wsId}
+						bind:dirty={dirtyPath}
+						bind:error={pathError}
+						bind:path
+						{initialPath}
+						checkInitialPathExistence={!edit}
+						namePlaceholder="amqp_trigger"
+						kind="amqp_trigger"
+						disabled={!can_write}
+						disableEditing={!can_write}
+					/>
+				</Label>
+			</div>
+
+			{#if !hideTarget}
+				<Section label="Runnable">
+					<TriggerRunnablePicker
+						workspace={wsId}
+						{fixedScriptPath}
+						bind:itemKind
+						bind:scriptPath={script_path}
+						{initialScriptPath}
+						canWrite={can_write}
+						isOperator={!!$userStore?.operator}
+					/>
+				</Section>
+			{/if}
+
+			<AmqpEditorConfigSection
+				bind:amqp_resource_path
+				bind:queue_name
+				bind:exchange
+				bind:options
+				{can_write}
+				bind:isValid
+				showTestingBadge={isEditor}
+			/>
+
+			<Section label="Advanced" collapsable>
+				{#snippet header()}
+					<TriggerAdvancedBadges
+						{error_handler_path}
+						{retry}
+						extraBadges={[
+							{ name: 'Exchange bound', active: !!exchange },
+							{ name: 'Prefetch', active: enablePrefetch }
+						]}
+					/>
+				{/snippet}
+				<div class="flex flex-col gap-6">
+					<div class="min-h-96">
+						<Tabs bind:selected={optionTabSelected}>
+							<Tab value="connection_options" label="Consumer Options" />
+							<Tab value="error_handler" label="Error Handler" />
+							<Tab value="retries" label="Retries" />
+						</Tabs>
+						<div class="mt-4">
+							{#if optionTabSelected === 'connection_options'}
+								<div class="flex p-2 flex-col gap-4 mt-3">
+									<Toggle
+										textClass="font-normal text-sm"
+										color="nord"
+										size="xs"
+										checked={options?.declare_queue ?? true}
+										disabled={!can_write}
+										on:change={(ev) => setDeclareQueue(ev.detail)}
+										options={{
+											right: 'Declare queue',
+											rightTooltip:
+												'Declare the queue as durable before consuming. When disabled, the queue is declared passively and must already exist on the broker.'
+										}}
+										class="py-1"
+									/>
+
+									<div class="flex flex-col gap-2">
+										<Toggle
+											textClass="font-normal text-sm"
+											color="nord"
+											size="xs"
+											checked={enablePrefetch}
+											disabled={!can_write}
+											on:change={(ev) => setPrefetchEnabled(ev.detail)}
+											options={{
+												right: 'Prefetch count',
+												rightTooltip:
+													'Maximum number of unacknowledged messages the broker delivers at once (QoS).'
+											}}
+											class="py-1"
+										/>
+										{#if enablePrefetch && options}
+											<TextInput
+												bind:value={options.prefetch_count}
+												inputProps={{
+													type: 'number',
+													min: 1,
+													max: 65535,
+													step: 1,
+													placeholder: 'Prefetch count (1-65535)',
+													disabled: !can_write,
+													autocomplete: 'off'
+												}}
+											/>
+										{/if}
+									</div>
+								</div>
+							{:else}
+								<TriggerRetriesAndErrorHandler
+									workspace={wsId}
+									{optionTabSelected}
+									{itemKind}
+									{can_write}
+									bind:errorHandlerSelected
+									bind:error_handler_path
+									bind:error_handler_args
+									bind:retry
+								/>
+							{/if}
+						</div>
+					</div>
+				</div>
+			</Section>
+			<div class="pb-8"></div>
+		</div>
+	{/if}
+{/snippet}
diff --git a/frontend/src/lib/components/triggers/amqp/AmqpTriggersPanel.svelte b/frontend/src/lib/components/triggers/amqp/AmqpTriggersPanel.svelte
new file mode 100644
index 0000000000..40a68566de
--- /dev/null
+++ b/frontend/src/lib/components/triggers/amqp/AmqpTriggersPanel.svelte
@@ -0,0 +1,61 @@
+<script lang="ts">
+	import AmqpTriggerEditorInner from './AmqpTriggerEditorInner.svelte'
+	import { isCloudHosted } from '$lib/cloud'
+	import { Alert } from '$lib/components/common'
+	import Description from '$lib/components/Description.svelte'
+	import { onMount } from 'svelte'
+
+	let {
+		selectedTrigger,
+		isFlow,
+		path,
+		isDeployed = false,
+		defaultValues = undefined,
+		newDraft = false,
+		customLabel = undefined,
+		...props
+	} = $props()
+	let amqpTriggerEditor: AmqpTriggerEditorInner | undefined = $state(undefined)
+
+	async function openAmqpTriggerEditor(isFlow: boolean, isDraft: boolean) {
+		if (isDraft) {
+			amqpTriggerEditor?.openNew(isFlow, path, defaultValues)
+		} else {
+			amqpTriggerEditor?.openEdit(selectedTrigger.path, isFlow, selectedTrigger.draftConfig)
+		}
+	}
+
+	onMount(() => {
+		amqpTriggerEditor && openAmqpTriggerEditor(isFlow, selectedTrigger.isDraft ?? false)
+	})
+
+	const cloudDisabled = $derived(isCloudHosted())
+</script>
+
+<div class="flex flex-col gap-4">
+	<AmqpTriggerEditorInner
+		bind:this={amqpTriggerEditor}
+		useDrawer={false}
+		hideTarget
+		hideTooltips={!isDeployed || cloudDisabled}
+		allowDraft={true}
+		trigger={selectedTrigger}
+		{customLabel}
+		{isDeployed}
+		{cloudDisabled}
+		{...props}
+	>
+		{#snippet description()}
+			{#if cloudDisabled}
+				<Alert title="Not compatible with multi-tenant cloud" type="warning" size="xs">
+					AMQP triggers are disabled in the multi-tenant cloud.
+				</Alert>
+			{:else}
+				<Description link="https://www.windmill.dev/docs/core_concepts/amqp_triggers">
+					AMQP triggers allow you to execute scripts and flows in response to messages consumed from
+					an AMQP (RabbitMQ) queue.
+				</Description>
+			{/if}
+		{/snippet}
+	</AmqpTriggerEditorInner>
+</div>
diff --git a/frontend/src/lib/components/triggers/amqp/utils.ts b/frontend/src/lib/components/triggers/amqp/utils.ts
new file mode 100644
index 0000000000..f82fe2ebf7
--- /dev/null
+++ b/frontend/src/lib/components/triggers/amqp/utils.ts
@@ -0,0 +1,56 @@
+import { AmqpTriggerService, type EditAmqpTrigger } from '$lib/gen'
+import { sendUserToast } from '$lib/toast'
+import { get, type Writable } from 'svelte/store'
+
+export async function saveAmqpTriggerFromCfg(
+	initialPath: string,
+	cfg: Record<string, any>,
+	edit: boolean,
+	workspace: string,
+	usedTriggerKinds: Writable<string[]>
+): Promise<boolean> {
+	const errorHandlerAndRetries = !cfg.is_flow
+		? {
+				error_handler_path: cfg.error_handler_path,
+				error_handler_args: cfg.error_handler_path ? cfg.error_handler_args : undefined,
+				retry: cfg.retry
+			}
+		: {}
+	const requestBody: EditAmqpTrigger = {
+		amqp_resource_path: cfg.amqp_resource_path,
+		queue_name: cfg.queue_name,
+		exchange: cfg.exchange,
+		options: cfg.options,
+		path: cfg.path,
+		script_path: cfg.script_path,
+		is_flow: cfg.is_flow,
+		mode: cfg.mode,
+		permissioned_as: cfg.permissioned_as,
+		preserve_permissioned_as: cfg.preserve_permissioned_as,
+		...errorHandlerAndRetries
+	}
+	try {
+		if (edit) {
+			await AmqpTriggerService.updateAmqpTrigger({
+				workspace,
+				path: initialPath,
+				requestBody
+			})
+			sendUserToast(`AMQP trigger ${cfg.path} updated`)
+		} else {
+			await AmqpTriggerService.createAmqpTrigger({
+				workspace,
+				requestBody: { ...requestBody, mode: 'enabled' }
+			})
+			sendUserToast(`AMQP trigger ${cfg.path} created`)
+		}
+
+		if (!get(usedTriggerKinds).includes('amqp')) {
+			usedTriggerKinds.update((t) => [...t, 'amqp'])
+		}
+		return true
+	} catch (error) {
+		sendUserToast(error.body || error.message, true)
+		return false
+	}
+}
diff --git a/frontend/src/lib/components/triggers/triggers.svelte.ts b/frontend/src/lib/components/triggers/triggers.svelte.ts
index c849b24c79..cd25328ff6 100644
--- a/frontend/src/lib/components/triggers/triggers.svelte.ts
+++ b/frontend/src/lib/components/triggers/triggers.svelte.ts
@@ -1,6 +1,7 @@
 import {
 	KafkaTriggerService,
 	MqttTriggerService,
+	AmqpTriggerService,
 	NatsTriggerService,
 	PostgresTriggerService,
 	ScheduleService,
@@ -349,6 +350,32 @@ export class Triggers {
 		}
 	}
 
+	async fetchAmqpTriggers(
+		triggersCountStore: Writable<TriggersCount | undefined>,
+		workspaceId: string | undefined,
+		path: string,
+		isFlow: boolean,
+		user: UserExt | undefined = undefined
+	): Promise<void> {
+		if (!workspaceId) return
+		try {
+			const amqpTriggers = await AmqpTriggerService.listAmqpTriggers({
+				workspace: workspaceId,
+				path,
+				isFlow
+			})
+			const amqpCount = this.updateTriggers(amqpTriggers, 'amqp', user)
+			triggersCountStore.update((triggersCount) => {
+				return {
+					...(triggersCount ?? {}),
+					amqp_count: amqpCount
+				}
+			})
+		} catch (error) {
+			console.error('Failed to fetch AMQP triggers:', error)
+		}
+	}
+
 	async fetchSqsTriggers(
 		triggersCountStore: Writable<TriggersCount | undefined>,
 		workspaceId: string | undefined,
@@ -533,6 +560,7 @@ export class Triggers {
 			this.fetchWebsocketTriggers(triggersCountStore, workspaceId, path, isFlow, user),
 			this.fetchPostgresTriggers(triggersCountStore, workspaceId, path, isFlow, user),
 			this.fetchMqttTriggers(triggersCountStore, workspaceId, path, isFlow, user),
+			this.fetchAmqpTriggers(triggersCountStore, workspaceId, path, isFlow, user),
 			this.fetchNativeTriggers(triggersCountStore, 'nextcloud', workspaceId, path, isFlow, user),
 			this.fetchNativeTriggers(triggersCountStore, 'google', workspaceId, path, isFlow, user),
 			this.fetchNativeTriggers(triggersCountStore, 'github', workspaceId, path, isFlow, user),
diff --git a/frontend/src/lib/components/triggers/utils.ts b/frontend/src/lib/components/triggers/utils.ts
index d8066eb18a..6ff2ea3ea0 100644
--- a/frontend/src/lib/components/triggers/utils.ts
+++ b/frontend/src/lib/components/triggers/utils.ts
@@ -13,6 +13,7 @@ import {
 import KafkaIcon from '$lib/components/icons/KafkaIcon.svelte'
 import NatsIcon from '$lib/components/icons/NatsIcon.svelte'
 import MqttIcon from '$lib/components/icons/MqttIcon.svelte'
+import AmqpIcon from '$lib/components/icons/AmqpIcon.svelte'
 import AwsIcon from '$lib/components/icons/AwsIcon.svelte'
 import GoogleCloudIcon from '$lib/components/icons/GoogleCloudIcon.svelte'
 import AzureIcon from '$lib/components/icons/AzureIcon.svelte'
@@ -35,6 +36,7 @@ import { saveKafkaTriggerFromCfg } from './kafka/utils'
 import { saveSqsTriggerFromCfg } from './sqs/utils'
 import { saveNatsTriggerFromCfg } from './nats/utils'
 import { saveMqttTriggerFromCfg } from './mqtt/utils'
+import { saveAmqpTriggerFromCfg } from './amqp/utils'
 import { saveGcpTriggerFromCfg } from './gcp/utils'
 import { saveAzureTriggerFromCfg } from './azure/utils'
 import type { Triggers } from './triggers.svelte'
@@ -50,6 +52,7 @@ export const CLOUD_DISABLED_TRIGGER_TYPES = [
 	'kafka',
 	'sqs',
 	'mqtt',
+	'amqp',
 	'gcp',
 	'azure',
 	'websocket',
@@ -67,6 +70,7 @@ export type TriggerType =
 	| 'kafka'
 	| 'nats'
 	| 'mqtt'
+	| 'amqp'
 	| 'sqs'
 	| 'gcp'
 	| 'azure'
@@ -86,6 +90,7 @@ export const jobTriggerKinds: JobTriggerKind[] = [
 	'email',
 	'nats',
 	'mqtt',
+	'amqp',
 	'sqs',
 	'postgres',
 	'schedule',
@@ -123,6 +128,7 @@ export const triggerIconMap = {
 	kafka: KafkaIcon,
 	nats: NatsIcon,
 	mqtt: MqttIcon,
+	amqp: AmqpIcon,
 	sqs: AwsIcon,
 	gcp: GoogleCloudIcon,
 	azure: AzureIcon,
@@ -149,6 +155,7 @@ export const triggerDisplayNamesMap = {
 	kafka: 'Kafka',
 	nats: 'NATS',
 	mqtt: 'MQTT',
+	amqp: 'AMQP',
 	sqs: 'SQS',
 	gcp: 'GCP Pub/Sub',
 	azure: 'Azure Event Grid',
@@ -184,6 +191,7 @@ export function triggerTypeToCaptureKind(triggerType: TriggerType): CaptureTrigg
 		'kafka',
 		'nats',
 		'mqtt',
+		'amqp',
 		'sqs',
 		'gcp',
 		'azure',
@@ -215,6 +223,7 @@ export function updateTriggersCount(
 		kafka: 'kafka_count',
 		nats: 'nats_count',
 		mqtt: 'mqtt_count',
+		amqp: 'amqp_count',
 		sqs: 'sqs_count',
 		gcp: 'gcp_count',
 		azure: 'azure_count',
@@ -286,6 +295,8 @@ export function triggerKindToTriggerType(kind: TriggerKind): TriggerType | undef
 			return 'nats'
 		case 'mqtt':
 			return 'mqtt'
+		case 'amqp':
+			return 'amqp'
 		case 'sqs':
 			return 'sqs'
 		case 'gcp':
@@ -381,6 +392,14 @@ export async function deployTriggers(
 				workspaceId,
 				usedTriggerKinds
 			),
+		amqp: (trigger: Trigger) =>
+			saveAmqpTriggerFromCfg(
+				trigger.path ?? trigger.draftConfig?.path ?? '',
+				trigger.draftConfig ?? {},
+				!trigger.isDraft,
+				workspaceId,
+				usedTriggerKinds
+			),
 		sqs: (trigger: Trigger) =>
 			saveSqsTriggerFromCfg(
 				trigger.path ?? trigger.draftConfig?.path ?? '',
diff --git a/frontend/src/lib/script_helpers.ts b/frontend/src/lib/script_helpers.ts
index 4a85107b70..91e310f5c9 100644
--- a/frontend/src/lib/script_helpers.ts
+++ b/frontend/src/lib/script_helpers.ts
@@ -703,7 +703,7 @@ export const TS_PREPROCESSOR_SCRIPT_INTRO = `/**
  *
  * ⚠️ This function runs BEFORE the main function.
  *
- * It processes raw trigger data from various sources (webhook, custom HTTP route, SQS, WebSocket, Kafka, NATS, MQTT, Postgres, or email)
+ * It processes raw trigger data from various sources (webhook, custom HTTP route, SQS, WebSocket, Kafka, NATS, MQTT, AMQP, Postgres, or email)
  * before passing it to \`main\`. This separates the trigger logic from the main logic and keeps the auto-generated runnable UI clean.
  *
  * The returned object defines the parameter values passed to \`main()\`.
@@ -716,7 +716,7 @@ export const TS_PREPROCESSOR_SCRIPT_INTRO = `/**
 export const TS_PREPROCESSOR_FLOW_INTRO = `/**
  * Trigger preprocessor
  *
- * It processes raw trigger data from various sources (webhook, custom HTTP route, SQS, WebSocket, Kafka, NATS, MQTT, Postgres, or email) 
+ * It processes raw trigger data from various sources (webhook, custom HTTP route, SQS, WebSocket, Kafka, NATS, MQTT, AMQP, Postgres, or email) 
  * before passing it to the flow. This separates the trigger logic from the flow logic and keeps the auto-generated UI clean.
  * 
  * The returned object determines the parameter values passed to the flow.
@@ -812,6 +812,16 @@ type TriggerEvent =
         content_type?: string;
       };
     }
+  | {
+      kind: "amqp";
+      trigger_path: string;
+      payload: string;
+      exchange: string;
+      routing_key: string;
+      queue_name: string;
+      redelivered: boolean;
+      delivery_tag: number;
+    }
   | {
       kind: "gcp";
       trigger_path: string;
@@ -867,7 +877,7 @@ export const PYTHON_PREPROCESSOR_SCRIPT_INTRO = `# Trigger preprocessor
 #
 # ⚠️ This function runs BEFORE the main function.
 #
-# It processes raw trigger data from various sources (webhook, custom HTTP route, SQS, WebSocket, Kafka, NATS, MQTT, Postgres, or email) 
+# It processes raw trigger data from various sources (webhook, custom HTTP route, SQS, WebSocket, Kafka, NATS, MQTT, AMQP, Postgres, or email) 
 # before passing it to \`main\`. This separates the trigger logic from the main logic and keeps the auto-generated UI clean.
 #
 # The returned object defines the parameter values passed to \`main()\`.
@@ -878,7 +888,7 @@ export const PYTHON_PREPROCESSOR_SCRIPT_INTRO = `# Trigger preprocessor
 
 export const PYTHON_PREPROCESSOR_FLOW_INTRO = `# Trigger preprocessor
 #
-# It processes raw trigger data from various sources (webhook, custom HTTP route, SQS, WebSocket, Kafka, NATS, MQTT, Postgres, or email) 
+# It processes raw trigger data from various sources (webhook, custom HTTP route, SQS, WebSocket, Kafka, NATS, MQTT, AMQP, Postgres, or email) 
 # before passing it to the flow. This separates the trigger logic from the flow logic and keeps the auto-generated UI clean.
 # 
 # The returned object determines the parameter values passed to the flow.
@@ -986,6 +996,17 @@ class MqttEvent(TypedDict):
     v5: Optional[MqttV5Properties]
 
 
+class AmqpEvent(TypedDict):
+    kind: Literal["amqp"]
+    trigger_path: str
+    payload: str
+    exchange: str
+    routing_key: str
+    queue_name: str
+    redelivered: bool
+    delivery_tag: int
+
+
 class GcpEvent(TypedDict):
     kind: Literal["gcp"]
     trigger_path: str
@@ -1019,6 +1040,7 @@ Event = Union[
     NatsEvent,
     SqsEvent,
     MqttEvent,
+    AmqpEvent,
     GcpEvent,
     PostgresEvent,
 ]
@@ -1036,7 +1058,7 @@ export const PHP_PREPROCESSOR_SCRIPT_INTRO = `<?php
  *
  * ⚠️ This function runs BEFORE the main function.
  *
- * It processes raw trigger data from various sources (webhook, custom HTTP route, SQS, WebSocket, Kafka, NATS, MQTT, Postgres, or email)
+ * It processes raw trigger data from various sources (webhook, custom HTTP route, SQS, WebSocket, Kafka, NATS, MQTT, AMQP, Postgres, or email)
  * before passing it to \`main\`. This separates the trigger logic from the main logic and keeps the auto-generated runnable UI clean.
  *
  * The returned object defines the parameter values passed to \`main()\`.
@@ -1052,7 +1074,7 @@ export const PHP_PREPROCESSOR_FLOW_INTRO = `<?php
 /**
  * Trigger preprocessor
  *
- * It processes raw trigger data from various sources (webhook, custom HTTP route, SQS, WebSocket, Kafka, NATS, MQTT, Postgres, or email) 
+ * It processes raw trigger data from various sources (webhook, custom HTTP route, SQS, WebSocket, Kafka, NATS, MQTT, AMQP, Postgres, or email) 
  * before passing it to the flow. This separates the trigger logic from the flow logic and keeps the auto-generated UI clean.
  * 
  * The returned object determines the parameter values passed to the flow.
@@ -1098,6 +1120,10 @@ export const PHP_PREPROCESSOR_MODULE_CODE = `function preprocessor(object $event
     // ['kind' => 'mqtt', 'trigger_path' => '...', 'payload' => '...', 'topic' => '...', 'retain' => true, 'pkid' => 1,
     //  'qos' => 1, 'v5' => [...]]
     //
+    // AMQP event:
+    // ['kind' => 'amqp', 'trigger_path' => '...', 'payload' => '...', 'exchange' => '...', 'routing_key' => '...',
+    //  'queue_name' => '...', 'redelivered' => false, 'delivery_tag' => 1]
+    //
     // GCP event:
     // ['kind' => 'gcp', 'trigger_path' => '...', 'payload' => '...', 'message_id' => '...', 'subscription' => '...',
     //  'ordering_key' => '...', 'attributes' => [...], 'delivery_type' => 'push',
diff --git a/frontend/src/lib/userDraft.svelte.ts b/frontend/src/lib/userDraft.svelte.ts
index 6ecacbce22..24572ee1ab 100644
--- a/frontend/src/lib/userDraft.svelte.ts
+++ b/frontend/src/lib/userDraft.svelte.ts
@@ -27,6 +27,7 @@ export const USER_DRAFT_ITEM_KINDS = [
 	'trigger_kafka',
 	'trigger_nats',
 	'trigger_mqtt',
+	'trigger_amqp',
 	'trigger_sqs',
 	'trigger_gcp',
 	'trigger_azure',
diff --git a/frontend/src/lib/userDraftDbMigration.ts b/frontend/src/lib/userDraftDbMigration.ts
index 4c3079ea94..1496e595cb 100644
--- a/frontend/src/lib/userDraftDbMigration.ts
+++ b/frontend/src/lib/userDraftDbMigration.ts
@@ -46,6 +46,7 @@ const ITEM_KINDS = [
 	'trigger_kafka',
 	'trigger_nats',
 	'trigger_mqtt',
+	'trigger_amqp',
 	'trigger_sqs',
 	'trigger_gcp',
 	'trigger_azure',
diff --git a/frontend/src/lib/utils_deployable.ts b/frontend/src/lib/utils_deployable.ts
index 556ac0a3c7..7d517c3bb4 100644
--- a/frontend/src/lib/utils_deployable.ts
+++ b/frontend/src/lib/utils_deployable.ts
@@ -6,6 +6,7 @@ import {
 	HttpTriggerService,
 	KafkaTriggerService,
 	MqttTriggerService,
+	AmqpTriggerService,
 	NatsTriggerService,
 	PostgresTriggerService,
 	ScheduleService,
@@ -36,6 +37,7 @@ export type Kind =
 	| 'nats_trigger'
 	| 'postgres_trigger'
 	| 'mqtt_trigger'
+	| 'amqp_trigger'
 	| 'sqs_trigger'
 	| 'gcp_trigger'
 	| 'azure_trigger'
@@ -94,6 +96,8 @@ export async function existsTrigger(
 		return await KafkaTriggerService.existsKafkaTrigger(data)
 	} else if (triggerKind === 'mqtt') {
 		return await MqttTriggerService.existsMqttTrigger(data)
+	} else if (triggerKind === 'amqp') {
+		return await AmqpTriggerService.existsAmqpTrigger(data)
 	} else if (triggerKind === 'postgres') {
 		return await PostgresTriggerService.existsPostgresTrigger(data)
 	} else if (triggerKind === 'sqs') {
@@ -196,6 +200,21 @@ export async function getTriggersDeployData(
 			createFn: MqttTriggerService.createMqttTrigger,
 			updateFn: MqttTriggerService.updateMqttTrigger
 		}
+	} else if (kind === 'amqp') {
+		const amqpTrigger = await AmqpTriggerService.getAmqpTrigger({
+			workspace: workspace!,
+			path: path
+		})
+
+		return {
+			data: {
+				...amqpTrigger,
+				permissioned_as: onBehalfOf,
+				preserve_permissioned_as: preservePermissionedAs
+			},
+			createFn: AmqpTriggerService.createAmqpTrigger,
+			updateFn: AmqpTriggerService.updateAmqpTrigger
+		}
 	} else if (kind === 'nats') {
 		const natsTrigger = await NatsTriggerService.getNatsTrigger({
 			workspace: workspace!,
@@ -372,6 +391,8 @@ export async function getTriggerValue(kind: TriggerKind, path: string, workspace
 		trigger = await KafkaTriggerService.getKafkaTrigger({ workspace, path })
 	} else if (kind === 'mqtt') {
 		trigger = await MqttTriggerService.getMqttTrigger({ workspace, path })
+	} else if (kind === 'amqp') {
+		trigger = await AmqpTriggerService.getAmqpTrigger({ workspace, path })
 	} else if (kind === 'nats') {
 		trigger = await NatsTriggerService.getNatsTrigger({ workspace, path })
 	} else if (kind === 'postgres') {
@@ -412,6 +433,9 @@ export async function getTriggerPermissionedAs(
 		} else if (kind === 'mqtt') {
 			const trigger = await MqttTriggerService.getMqttTrigger({ workspace, path })
 			return trigger.permissioned_as
+		} else if (kind === 'amqp') {
+			const trigger = await AmqpTriggerService.getAmqpTrigger({ workspace, path })
+			return trigger.permissioned_as
 		} else if (kind === 'nats') {
 			const trigger = await NatsTriggerService.getNatsTrigger({ workspace, path })
 			return trigger.permissioned_as
@@ -493,6 +517,13 @@ export async function getTriggerDependency(kind: TriggerKind, path: string, work
 		})
 
 		result = retrieveKindsValues({ resource_path: mqtt_resource_path, script_path, is_flow })
+	} else if (kind === 'amqp') {
+		const { amqp_resource_path, script_path, is_flow } = await AmqpTriggerService.getAmqpTrigger({
+			workspace: workspace!,
+			path: path
+		})
+
+		result = retrieveKindsValues({ resource_path: amqp_resource_path, script_path, is_flow })
 	} else if (kind === 'nats') {
 		const { nats_resource_path, script_path, is_flow } = await NatsTriggerService.getNatsTrigger({
 			workspace: workspace!,
diff --git a/frontend/src/lib/utils_draft_deploy.ts b/frontend/src/lib/utils_draft_deploy.ts
index ee8538e4db..6068753c4c 100644
--- a/frontend/src/lib/utils_draft_deploy.ts
+++ b/frontend/src/lib/utils_draft_deploy.ts
@@ -27,6 +27,7 @@ import {
 	KafkaTriggerService,
 	NatsTriggerService,
 	MqttTriggerService,
+	AmqpTriggerService,
 	SqsTriggerService,
 	GcpTriggerService,
 	AzureTriggerService,
@@ -49,6 +50,7 @@ import { savePostgresTriggerFromCfg } from '$lib/components/triggers/postgres/ut
 import { saveKafkaTriggerFromCfg } from '$lib/components/triggers/kafka/utils'
 import { saveNatsTriggerFromCfg } from '$lib/components/triggers/nats/utils'
 import { saveMqttTriggerFromCfg } from '$lib/components/triggers/mqtt/utils'
+import { saveAmqpTriggerFromCfg } from '$lib/components/triggers/amqp/utils'
 import { saveSqsTriggerFromCfg } from '$lib/components/triggers/sqs/utils'
 import { saveGcpTriggerFromCfg } from '$lib/components/triggers/gcp/utils'
 import { saveAzureTriggerFromCfg } from '$lib/components/triggers/azure/utils'
@@ -79,6 +81,8 @@ const OVERLAY_GETTERS: Partial<
 		NatsTriggerService.getNatsTrigger({ workspace, path, getDraft: true }),
 	trigger_mqtt: (workspace, path) =>
 		MqttTriggerService.getMqttTrigger({ workspace, path, getDraft: true }),
+	trigger_amqp: (workspace, path) =>
+		AmqpTriggerService.getAmqpTrigger({ workspace, path, getDraft: true }),
 	trigger_sqs: (workspace, path) =>
 		SqsTriggerService.getSqsTrigger({ workspace, path, getDraft: true }),
 	trigger_gcp: (workspace, path) =>
@@ -589,6 +593,8 @@ const TRIGGER_SAVERS: Partial<
 		saveNatsTriggerFromCfg(p, cfg, edit, ws, writable<string[]>([])),
 	trigger_mqtt: (p, cfg, edit, ws) =>
 		saveMqttTriggerFromCfg(p, cfg, edit, ws, writable<string[]>([])),
+	trigger_amqp: (p, cfg, edit, ws) =>
+		saveAmqpTriggerFromCfg(p, cfg, edit, ws, writable<string[]>([])),
 	trigger_sqs: (p, cfg, edit, ws) =>
 		saveSqsTriggerFromCfg(p, cfg, edit, ws, writable<string[]>([])),
 	trigger_gcp: (p, cfg, edit, ws) =>
diff --git a/frontend/src/routes/(root)/(logged)/+layout.svelte b/frontend/src/routes/(root)/(logged)/+layout.svelte
index 9d6accc4e2..d36569ae95 100644
--- a/frontend/src/routes/(root)/(logged)/+layout.svelte
+++ b/frontend/src/routes/(root)/(logged)/+layout.svelte
@@ -520,6 +520,7 @@
 			nats_used,
 			sqs_used,
 			mqtt_used,
+			amqp_used,
 			gcp_used,
 			azure_used,
 			email_used,
@@ -547,6 +548,9 @@
 		if (mqtt_used) {
 			usedKinds.push('mqtt')
 		}
+		if (amqp_used) {
+			usedKinds.push('amqp')
+		}
 		if (sqs_used) {
 			usedKinds.push('sqs')
 		}
diff --git a/frontend/src/routes/(root)/(logged)/amqp_triggers/+page.js b/frontend/src/routes/(root)/(logged)/amqp_triggers/+page.js
new file mode 100644
index 0000000000..42bd37a2fd
--- /dev/null
+++ b/frontend/src/routes/(root)/(logged)/amqp_triggers/+page.js
@@ -0,0 +1,5 @@
+export function load() {
+	return {
+		stuff: { title: 'AMQP triggers' }
+	}
+}
diff --git a/frontend/src/routes/(root)/(logged)/amqp_triggers/+page.svelte b/frontend/src/routes/(root)/(logged)/amqp_triggers/+page.svelte
new file mode 100644
index 0000000000..8d7316d6ed
--- /dev/null
+++ b/frontend/src/routes/(root)/(logged)/amqp_triggers/+page.svelte
@@ -0,0 +1,550 @@
+<script lang="ts">
+	import { getLocalDraftHint } from '$lib/localDraftHints.svelte'
+	import { run } from 'svelte/legacy'
+
+	import {
+		AmqpTriggerService,
+		WorkspaceService,
+		type AmqpTrigger,
+		type TriggerMode,
+		type WorkspaceDeployUISettings
+	} from '$lib/gen'
+	import {
+		canWrite,
+		capitalize,
+		displayDate,
+		getLocalSetting,
+		sendUserToast,
+		storeLocalSetting,
+		removeTriggerKindIfUnused
+	} from '$lib/utils'
+	import { withForkConflictRetry } from '$lib/utils/forkConflict'
+	import { base } from '$app/paths'
+	import { page } from '$app/stores'
+	import CenteredPage from '$lib/components/CenteredPage.svelte'
+	import { Alert, Badge, Button, Skeleton } from '$lib/components/common'
+	import Dropdown from '$lib/components/DropdownV2.svelte'
+	import PageHeader from '$lib/components/PageHeader.svelte'
+	import SharedBadge from '$lib/components/SharedBadge.svelte'
+	import DraftBadge from '$lib/components/DraftBadge.svelte'
+	import ShareModal from '$lib/components/ShareModal.svelte'
+	import Toggle from '$lib/components/Toggle.svelte'
+	import { enterpriseLicense, usedTriggerKinds, userStore, workspaceStore } from '$lib/stores'
+	import { Code, Eye, Pen, Plus, Shield, Trash, Circle, FileUp, Pause } from 'lucide-svelte'
+	import { goto } from '$lib/navigation'
+	import SearchItems from '$lib/components/SearchItems.svelte'
+	import NoItemFound from '$lib/components/home/NoItemFound.svelte'
+	import RowIcon from '$lib/components/common/table/RowIcon.svelte'
+	import ListFilters from '$lib/components/home/ListFilters.svelte'
+	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
+	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
+	import { setQuery } from '$lib/navigation'
+	import { onDestroy, onMount } from 'svelte'
+	import Popover from '$lib/components/Popover.svelte'
+	import { isCloudHosted } from '$lib/cloud'
+	import AmqpTriggerEditor from '$lib/components/triggers/amqp/AmqpTriggerEditor.svelte'
+	import { AmqpIcon } from '$lib/components/icons'
+	import { ALL_DEPLOYABLE, isDeployable } from '$lib/utils_deployable'
+	import DeployWorkspaceDrawer from '$lib/components/DeployWorkspaceDrawer.svelte'
+	import TriggerModeToggle from '$lib/components/triggers/TriggerModeToggle.svelte'
+
+	type TriggerM = AmqpTrigger & { canWrite: boolean }
+
+	let triggers: TriggerM[] = $state([])
+	let shareModal: ShareModal | undefined = $state()
+	let loading = $state(true)
+	let deploymentDrawer: DeployWorkspaceDrawer | undefined = $state()
+	let deployUiSettings: WorkspaceDeployUISettings | undefined = $state(undefined)
+
+	async function getDeployUiSettings() {
+		if (!$enterpriseLicense) {
+			deployUiSettings = ALL_DEPLOYABLE
+			return
+		}
+		let settings = await WorkspaceService.getPublicSettings({ workspace: $workspaceStore! })
+		deployUiSettings = settings.deploy_ui ?? ALL_DEPLOYABLE
+	}
+	getDeployUiSettings()
+
+	async function loadTriggers(): Promise<void> {
+		triggers = (await AmqpTriggerService.listAmqpTriggers({ workspace: $workspaceStore!, includeDraftOnly: true })).map(
+			(x) => {
+				return { canWrite: canWrite(x.path, x.extra_perms!, $userStore), ...x }
+			}
+		)
+		$usedTriggerKinds = removeTriggerKindIfUnused(triggers.length, 'amqp', $usedTriggerKinds)
+		loading = false
+	}
+
+	let interval = setInterval(async () => {
+		try {
+			const newTriggers = await AmqpTriggerService.listAmqpTriggers({
+				workspace: $workspaceStore!
+			})
+			for (let i = 0; i < triggers.length; i++) {
+				const newTrigger = newTriggers.find((x) => x.path === triggers[i].path)
+				if (newTrigger) {
+					triggers[i] = {
+						...triggers[i],
+						error: newTrigger.error,
+						last_server_ping: newTrigger.last_server_ping,
+						mode: newTrigger.mode,
+						server_id: newTrigger.server_id
+					}
+				}
+			}
+		} catch (err) {
+			console.error(err)
+		}
+	}, 5000)
+
+	onDestroy(() => {
+		clearInterval(interval)
+	})
+
+	async function onToggleMode(path: string, mode: TriggerMode): Promise<boolean> {
+		let committed = false
+		try {
+			const ok = await withForkConflictRetry(
+				(force) =>
+					AmqpTriggerService.setAmqpTriggerMode({
+						path,
+						workspace: $workspaceStore!,
+						requestBody: { mode, force }
+					}),
+				'AMQP trigger'
+			)
+			if (ok) {
+				sendUserToast(`${capitalize(mode)} AMQP trigger ${path}`)
+				loadTriggers()
+			}
+			committed = ok
+		} catch (err) {
+			sendUserToast(
+				`Cannot ${mode === 'enabled' ? 'enable' : mode === 'disabled' ? 'disable' : 'suspend'} amqp trigger: ${err.body}`,
+				true
+			)
+			loadTriggers()
+		}
+		return committed
+	}
+
+	run(() => {
+		if ($workspaceStore && $userStore) {
+			loadTriggers()
+		}
+	})
+	let amqpTriggerEditor: AmqpTriggerEditor | undefined = $state()
+
+	let hashHandled = false
+	$effect(() => {
+		if (!hashHandled && triggers.length > 0 && amqpTriggerEditor) {
+			let hash = $page.url.hash
+			if (hash.length > 1) {
+				let path = hash.slice(1)
+				let trigger = triggers.find((t) => t.path === path)
+				if (trigger) {
+					hashHandled = true
+					amqpTriggerEditor?.openEdit(path, trigger.is_flow)
+				}
+			}
+		}
+	})
+
+	let filteredItems: (TriggerM & { marked?: any })[] | undefined = $state([])
+	let items: typeof filteredItems | undefined = $state([])
+	let preFilteredItems: typeof filteredItems | undefined = $state([])
+	let filter = $state('')
+	let ownerFilter: string | undefined = $state(undefined)
+	let nbDisplayed = $state(15)
+
+	const TRIGGER_PATH_KIND_FILTER_SETTING = 'filter_path_of'
+	const FILTER_USER_FOLDER_SETTING_NAME = 'user_and_folders_only'
+	let selectedFilterKind = $state(
+		(getLocalSetting(TRIGGER_PATH_KIND_FILTER_SETTING) as 'trigger' | 'script_flow') ?? 'trigger'
+	)
+	let filterUserFolders = $state(getLocalSetting(FILTER_USER_FOLDER_SETTING_NAME) == 'true')
+
+	run(() => {
+		storeLocalSetting(TRIGGER_PATH_KIND_FILTER_SETTING, selectedFilterKind)
+	})
+	run(() => {
+		storeLocalSetting(FILTER_USER_FOLDER_SETTING_NAME, filterUserFolders ? 'true' : undefined)
+	})
+
+	function filterItemsPathsBaseOnUserFilters(
+		item: TriggerM,
+		selectedFilterKind: 'trigger' | 'script_flow',
+		filterUserFolders: boolean
+	) {
+		if ($workspaceStore == 'admins') return true
+		if (filterUserFolders) {
+			if (selectedFilterKind === 'trigger') {
+				return (
+					!item.path.startsWith('u/') || item.path.startsWith('u/' + $userStore?.username + '/')
+				)
+			} else {
+				return (
+					!item.script_path.startsWith('u/') ||
+					item.script_path.startsWith('u/' + $userStore?.username + '/')
+				)
+			}
+		} else {
+			return true
+		}
+	}
+
+	run(() => {
+		preFilteredItems =
+			ownerFilter != undefined
+				? selectedFilterKind === 'trigger'
+					? triggers?.filter(
+							(x) =>
+								x.path.startsWith(ownerFilter + '/') &&
+								filterItemsPathsBaseOnUserFilters(x, selectedFilterKind, filterUserFolders)
+						)
+					: triggers?.filter(
+							(x) =>
+								x.script_path.startsWith(ownerFilter + '/') &&
+								filterItemsPathsBaseOnUserFilters(x, selectedFilterKind, filterUserFolders)
+						)
+				: triggers?.filter((x) =>
+						filterItemsPathsBaseOnUserFilters(x, selectedFilterKind, filterUserFolders)
+					)
+	})
+
+	run(() => {
+		if ($workspaceStore) {
+			ownerFilter = undefined
+		}
+	})
+
+	let owners = $derived(
+		selectedFilterKind === 'trigger'
+			? Array.from(
+					new Set(filteredItems?.map((x) => x.path.split('/').slice(0, 2).join('/')) ?? [])
+				).sort()
+			: Array.from(
+					new Set(filteredItems?.map((x) => x.script_path.split('/').slice(0, 2).join('/')) ?? [])
+				).sort()
+	)
+
+	run(() => {
+		items = filter !== '' ? filteredItems : preFilteredItems
+	})
+
+	function updateQueryFilters(selectedFilterKind, filterUserFolders) {
+		setQuery(
+			new URL(window.location.href),
+			TRIGGER_PATH_KIND_FILTER_SETTING,
+			selectedFilterKind,
+			window.location.hash || undefined
+		).then(() => {
+			setQuery(
+				new URL(window.location.href),
+				FILTER_USER_FOLDER_SETTING_NAME,
+				String(filterUserFolders),
+				window.location.hash || undefined
+			)
+		})
+	}
+
+	function loadQueryFilters() {
+		let url = new URL(window.location.href)
+		let queryFilterKind = url.searchParams.get(TRIGGER_PATH_KIND_FILTER_SETTING)
+		let queryFilterUserFolders = url.searchParams.get(FILTER_USER_FOLDER_SETTING_NAME)
+		if (queryFilterKind) {
+			selectedFilterKind = queryFilterKind as 'trigger' | 'script_flow'
+		}
+		if (queryFilterUserFolders) {
+			filterUserFolders = queryFilterUserFolders == 'true'
+		}
+	}
+
+	onMount(() => {
+		loadQueryFilters()
+	})
+
+	run(() => {
+		updateQueryFilters(selectedFilterKind, filterUserFolders)
+	})
+</script>
+
+<DeployWorkspaceDrawer bind:this={deploymentDrawer} />
+<AmqpTriggerEditor onUpdate={loadTriggers} bind:this={amqpTriggerEditor} />
+
+<SearchItems
+	{filter}
+	items={preFilteredItems}
+	bind:filteredItems
+	f={(x) => (x.summary ?? '') + ' ' + x.path + ' (' + x.script_path + ')'}
+/>
+
+<CenteredPage>
+	<PageHeader
+		title="AMQP triggers"
+		tooltip="Windmill can connect to an AMQP broker, subscribe to specific topics, and trigger scripts or flows based on those topics."
+	>
+		<Button
+			unifiedSize="md"
+			variant="accent"
+			startIcon={{ icon: Plus }}
+			on:click={() => amqpTriggerEditor?.openNew(false)}
+		>
+			New&nbsp;AMQP trigger
+		</Button>
+	</PageHeader>
+
+	{#if isCloudHosted()}
+		<Alert title="Not compatible with multi-tenant cloud" type="warning">
+			AMQP triggers are disabled in the multi-tenant cloud.
+		</Alert>
+		<div class="py-4"></div>
+	{/if}
+	<div class="w-full h-full flex flex-col">
+		<div class="w-full pb-4 pt-6">
+			<input
+				type="text"
+				placeholder="Search AMQP triggers"
+				bind:value={filter}
+				class="search-item"
+			/>
+			<div class="flex flex-row items-center gap-2 mt-6">
+				<div class="text-sm shrink-0"> Filter by path of </div>
+				<ToggleButtonGroup bind:selected={selectedFilterKind}>
+					{#snippet children({ item })}
+						<ToggleButton value="trigger" label="AMQP trigger" icon={AmqpIcon} {item} />
+						<ToggleButton value="script_flow" label="Script/Flow" icon={Code} {item} />
+					{/snippet}
+				</ToggleButtonGroup>
+			</div>
+			<ListFilters syncQuery bind:selectedFilter={ownerFilter} filters={owners} />
+
+			<div class="flex flex-row items-center justify-end gap-4">
+				{#if $userStore?.is_super_admin && $userStore.username.includes('@')}
+					<Toggle size="xs" bind:checked={filterUserFolders} options={{ right: 'Only f/*' }} />
+				{:else if $userStore?.is_admin || $userStore?.is_super_admin}
+					<Toggle
+						size="xs"
+						bind:checked={filterUserFolders}
+						options={{ right: `Only u/${$userStore.username} and f/*` }}
+					/>
+				{/if}
+			</div>
+		</div>
+		{#if loading}
+			{#each new Array(6) as _}
+				<Skeleton layout={[[6], 0.4]} />
+			{/each}
+		{:else if !triggers?.length}
+			<div class="text-center text-sm text-primary mt-2"> No AMQP triggers </div>
+		{:else if items?.length}
+			<div class="border rounded-md divide-y">
+				{#each items.slice(0, nbDisplayed) as { path, edited_by, edited_at, script_path, is_flow, extra_perms, canWrite, error, last_server_ping, server_id, mode, retry, error_handler_path, error_handler_args, labels, draft_only, is_draft } (path)}
+					{@const href = `${is_flow ? '/flows/get' : '/scripts/get'}/${script_path}`}
+					{@const ping = last_server_ping ? new Date(last_server_ping) : undefined}
+					{@const pinging = ping && ping.getTime() > new Date().getTime() - 15 * 1000}
+					{@const enabled = mode === 'enabled' || mode === 'suspended'}
+
+					<div
+						class="hover:bg-surface-hover w-full items-center px-4 py-2 gap-4 first-of-type:!border-t-0
+				first-of-type:rounded-t-md last-of-type:rounded-b-md flex flex-col"
+					>
+						<div class="w-full flex gap-5 items-center">
+							<RowIcon kind={is_flow ? 'flow' : 'script'} />
+
+							<a
+								href="#{path}"
+								onclick={() => amqpTriggerEditor?.openEdit(path, is_flow)}
+								class="min-w-0 grow hover:underline decoration-gray-400"
+							>
+								<div class="text-emphasis font-semibold text-xs truncate text-left">
+									{path}{(getLocalDraftHint($workspaceStore, 'trigger_amqp', path) ?? is_draft) ? '*' : ''}
+								</div>
+								<div class="text-secondary text-xs truncate text-left font-light">
+									runnable: {script_path}
+								</div>
+							</a>
+
+							<div class="hidden lg:flex flex-row gap-1 items-center">
+								<SharedBadge {canWrite} extraPerms={extra_perms} />
+									{#if draft_only}
+										<DraftBadge draft_only is_draft={false} />
+									{/if}
+								{#if labels?.length}
+									{#each labels as label}
+										<Badge color="blue" small class="px-1" title="Label: {label}">{label}</Badge>
+									{/each}
+								{/if}
+							</div>
+
+							<div class="w-10">
+								{#if (enabled && (!pinging || error)) || (!enabled && error) || (enabled && !server_id)}
+									<Popover notClickable>
+										<span class="flex h-4 w-4">
+											<Circle
+												class="text-red-600 animate-ping absolute inline-flex fill-current"
+												size={12}
+											/>
+											<Circle class="text-red-600 relative inline-flex fill-current" size={12} />
+										</span>
+										{#snippet text()}
+											<div>
+												{#if enabled}
+													{#if !server_id}
+														AMQP trigger is starting...
+													{:else}
+														AMQP trigger is not connected{error ? ': ' + error : ''}
+													{/if}
+												{:else}
+													AMQP trigger was disabled because of an error: {error}
+												{/if}
+											</div>
+										{/snippet}
+									</Popover>
+								{:else if enabled}
+									<Popover notClickable>
+										<span class="flex h-4 w-4">
+											<Circle class="text-green-600 relative inline-flex fill-current" size={12} />
+										</span>
+										{#snippet text()}
+											<div>
+												AMQP trigger is connected{!server_id ? ' (shutting down...)' : ''}
+											</div>
+										{/snippet}
+									</Popover>
+								{/if}
+							</div>
+
+							<TriggerModeToggle
+								onToggleMode={(newMode) => onToggleMode(path, newMode)}
+								triggerMode={mode}
+								includeModalConfig={{
+									triggerPath: path,
+									triggerKind: 'amqp',
+									runnableConfig: {
+										path: script_path,
+										kind: is_flow ? 'flow' : 'script',
+										retry,
+										errorHandlerPath: error_handler_path,
+										errorHandlerArgs: error_handler_args
+									}
+								}}
+								{canWrite}
+								hideToggleLabels
+								hideDropdown
+							/>
+
+							<div class="flex gap-2 items-center justify-end">
+								<Button
+									on:click={() => amqpTriggerEditor?.openEdit(path, is_flow)}
+									unifiedSize="md"
+									startIcon={canWrite
+										? { icon: Pen }
+										: {
+												icon: Eye
+											}}
+									variant="subtle"
+								>
+									{canWrite ? 'Edit' : 'View'}
+								</Button>
+								<Dropdown
+									items={[
+										{
+											displayName: `View ${is_flow ? 'Flow' : 'Script'}`,
+											icon: Eye,
+											action: () => {
+												goto(href)
+											}
+										},
+										...(canWrite && mode !== 'suspended'
+											? [
+													{
+														displayName: 'Suspend job execution',
+														icon: Pause,
+														action: () => {
+															onToggleMode(path, 'suspended')
+														}
+													}
+												]
+											: []),
+										{
+											displayName: canWrite ? 'Edit' : 'View',
+											icon: canWrite ? Pen : Eye,
+											action: () => {
+												amqpTriggerEditor?.openEdit(path, is_flow)
+											}
+										},
+										...(isDeployable('trigger', path, deployUiSettings)
+											? [
+													{
+														displayName: 'Deploy to prod/staging',
+														icon: FileUp,
+														action: () => {
+															deploymentDrawer?.openDrawer(path, 'trigger', {
+																triggers: {
+																	kind: 'amqp'
+																}
+															})
+														}
+													}
+												]
+											: []),
+										{
+											displayName: 'Audit logs',
+											icon: Eye,
+											href: `${base}/audit_logs?resource=${path}`
+										},
+										{
+											displayName: 'Permissions',
+											icon: Shield,
+											action: () => {
+												shareModal?.openDrawer(path, 'amqp_trigger')
+											}
+										},
+										{
+											displayName: 'Delete',
+											type: 'delete',
+											icon: Trash,
+											disabled: !canWrite,
+											action: async () => {
+												await AmqpTriggerService.deleteAmqpTrigger({
+													workspace: $workspaceStore ?? '',
+													path
+												})
+												loadTriggers()
+											}
+										}
+									]}
+								/>
+							</div>
+						</div>
+						<div class="w-full flex justify-between items-baseline">
+							<div
+								class="flex flex-wrap text-[0.7em] text-primary gap-1 items-center justify-end truncate pr-2"
+								><div class="truncate">edited by {edited_by}</div><div class="truncate"
+									>the {displayDate(edited_at)}</div
+								></div
+							></div
+						>
+					</div>
+				{/each}
+			</div>
+		{:else}
+			<NoItemFound />
+		{/if}
+	</div>
+	{#if items && items?.length > 15 && nbDisplayed < items.length}
+		<span class="text-xs"
+			>{nbDisplayed} items out of {items.length}
+			<button class="ml-4" onclick={() => (nbDisplayed += 30)}>load 30 more</button></span
+		>
+	{/if}
+</CenteredPage>
+
+<ShareModal
+	bind:this={shareModal}
+	on:change={() => {
+		loadTriggers()
+	}}
+/>
diff --git a/system_prompts/auto-generated/cli/cli-commands.md b/system_prompts/auto-generated/cli/cli-commands.md
index 40909bbf3c..8d04a720db 100644
--- a/system_prompts/auto-generated/cli/cli-commands.md
+++ b/system_prompts/auto-generated/cli/cli-commands.md
@@ -675,12 +675,12 @@ trigger related commands
   - `--json` - Output as JSON (for piping to jq)
 - `trigger get <path:string>` - get a trigger's details
   - `--json` - Output as JSON (for piping to jq)
-  - `--kind <kind:string>` - Trigger kind (http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, azure, email). Recommended for faster lookup
+  - `--kind <kind:string>` - Trigger kind (http, websocket, kafka, nats, postgres, mqtt, amqp, sqs, gcp, azure, email). Recommended for faster lookup
 - `trigger new <path:string>` - create a new trigger locally
-  - `--kind <kind:string>` - Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, azure, email)
+  - `--kind <kind:string>` - Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, amqp, sqs, gcp, azure, email)
 - `trigger push <file_path:string> <remote_path:string>` - push a local trigger spec. This overrides any remote versions.
 - `trigger set-permissioned-as <path:string> <email:string>` - Set the email (run-as user) for a trigger (requires admin or wm_deployers group)
-  - `--kind <kind:string>` - Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, azure, email)
+  - `--kind <kind:string>` - Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, amqp, sqs, gcp, azure, email)
 
 ### user
 
diff --git a/system_prompts/auto-generated/prompts.ts b/system_prompts/auto-generated/prompts.ts
index 8e82c36b74..fb2e40e6ec 100644
--- a/system_prompts/auto-generated/prompts.ts
+++ b/system_prompts/auto-generated/prompts.ts
@@ -21,7 +21,7 @@ export const SCRIPT_BASE = `# Windmill Script Writing Guide
 
 ## Preprocessor Scripts
 
-Preprocessor scripts process raw trigger data from various sources (webhook, custom HTTP route, SQS, WebSocket, Kafka, NATS, MQTT, Postgres, or email) before passing it to the flow. This separates the trigger logic from the flow logic and keeps the auto-generated UI clean.
+Preprocessor scripts process raw trigger data from various sources (webhook, custom HTTP route, SQS, WebSocket, Kafka, NATS, MQTT, AMQP, Postgres, or email) before passing it to the flow. This separates the trigger logic from the flow logic and keeps the auto-generated UI clean.
 
 The returned object determines the parameter values passed to the flow.
 e.g., \`{ b: 1, a: 2 }\` calls the flow with \`a = 2\` and \`b = 1\`, assuming the flow has two inputs called \`a\` and \`b\`.
@@ -761,7 +761,7 @@ A script joins the pipeline when its source begins with the \`pipeline\` annotat
 
 - \`// on <ref>\` — declares an execution-DAG **input** (what triggers/feeds this node). \`<ref>\` is either:
   - an **asset URI** (the node runs when that asset is produced upstream): \`ducklake://main/orders\`, \`datatable://main/users\`, \`s3://<key>\`, \`$res:f/folder/my_resource\`, \`volume://name/path\`.
-  - a **native trigger kind**: \`schedule\`, \`webhook\`, \`email\`, \`kafka\`, \`mqtt\`, \`nats\`, \`postgres\`, \`sqs\`, \`gcp\`, or \`data_upload\` (a user-uploaded S3 file). For these the actual trigger row (cron, topic, …) is created separately; the annotation only declares the binding.
+  - a **native trigger kind**: \`schedule\`, \`webhook\`, \`email\`, \`kafka\`, \`mqtt\`, \`amqp\`, \`nats\`, \`postgres\`, \`sqs\`, \`gcp\`, or \`data_upload\` (a user-uploaded S3 file). For these the actual trigger row (cron, topic, …) is created separately; the annotation only declares the binding.
 - **Outputs** are inferred from what the body writes — a \`CREATE TABLE\`, a \`wmill.writeS3File(...)\`, a DuckLake/datatable write. To declare a managed output explicitly, use \`// materialize <asset-uri>\`.
 - Optional badges: \`// partitioned <daily|hourly|weekly|monthly|dynamic>\`, \`// freshness <duration>\` (e.g. \`1h\`), \`// tag <worker-tag>\`, \`// retry <count> [delay]\`, \`// data_test <kind> ...\`.
 
@@ -3394,12 +3394,12 @@ trigger related commands
   - \`--json\` - Output as JSON (for piping to jq)
 - \`trigger get <path:string>\` - get a trigger's details
   - \`--json\` - Output as JSON (for piping to jq)
-  - \`--kind <kind:string>\` - Trigger kind (http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, azure, email). Recommended for faster lookup
+  - \`--kind <kind:string>\` - Trigger kind (http, websocket, kafka, nats, postgres, mqtt, amqp, sqs, gcp, azure, email). Recommended for faster lookup
 - \`trigger new <path:string>\` - create a new trigger locally
-  - \`--kind <kind:string>\` - Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, azure, email)
+  - \`--kind <kind:string>\` - Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, amqp, sqs, gcp, azure, email)
 - \`trigger push <file_path:string> <remote_path:string>\` - push a local trigger spec. This overrides any remote versions.
 - \`trigger set-permissioned-as <path:string> <email:string>\` - Set the email (run-as user) for a trigger (requires admin or wm_deployers group)
-  - \`--kind <kind:string>\` - Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, azure, email)
+  - \`--kind <kind:string>\` - Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, amqp, sqs, gcp, azure, email)
 
 ### user
 
diff --git a/system_prompts/auto-generated/schemas/amqp_trigger.schema.yaml b/system_prompts/auto-generated/schemas/amqp_trigger.schema.yaml
new file mode 100644
index 0000000000..6d8f661652
--- /dev/null
+++ b/system_prompts/auto-generated/schemas/amqp_trigger.schema.yaml
@@ -0,0 +1,113 @@
+type: object
+properties:
+  script_path:
+    type: string
+    description: Path to the script or flow to execute when triggered
+  permissioned_as:
+    type: string
+    description: The user or group this trigger runs as (permissioned_as)
+  is_flow:
+    type: boolean
+    description: True if script_path points to a flow, false if it points to a script
+  labels:
+    type: array
+    items:
+      type: string
+  draft_only:
+    type: boolean
+    description: 'True when this row is a per-user draft with no deployed
+
+      trigger at the same path. Set by list endpoints when
+
+      `include_draft_only=true` synthesizes the row from the
+
+      draft. Frontend renders a "Draft" badge.
+
+      '
+  is_draft:
+    type: boolean
+    description: 'True when the authed user has a per-user draft at this path
+
+      (over a deployed row or a synthesized draft-only row).
+
+      Frontend appends a `*` to the displayed name.
+
+      '
+  amqp_resource_path:
+    type: string
+    description: Path to the AMQP resource containing broker connection configuration
+  queue_name:
+    type: string
+    description: Name of the queue to consume messages from
+  exchange:
+    type: object
+    properties:
+      exchange_name:
+        type: string
+        description: Name of the exchange to bind the consumed queue to
+      routing_keys:
+        type: array
+        items:
+          type: string
+        description: Routing keys used to bind the queue to the exchange
+  options:
+    type: object
+    properties:
+      declare_queue:
+        type: boolean
+        description: Declare the queue (durable) before consuming; when false the
+          queue is declared passively and must already exist
+      prefetch_count:
+        type: integer
+        format: int32
+        minimum: 1
+        maximum: 65535
+        description: Maximum number of unacknowledged messages the broker delivers
+          at once (1-65535)
+  error_handler_path:
+    type: string
+    description: Path to a script or flow to run when the triggered job fails
+  error_handler_args:
+    type: object
+    description: The arguments to pass to the script or flow
+  retry:
+    type: object
+    properties:
+      constant:
+        type: object
+        description: Retry with constant delay between attempts
+        properties:
+          attempts:
+            type: integer
+            description: Number of retry attempts
+          seconds:
+            type: integer
+            description: Seconds to wait between retries
+      exponential:
+        type: object
+        description: Retry with exponential backoff (delay doubles each time)
+        properties:
+          attempts:
+            type: integer
+            description: Number of retry attempts
+          multiplier:
+            type: integer
+            description: Multiplier for exponential backoff
+          seconds:
+            type: integer
+            minimum: 1
+            description: Initial delay in seconds
+          random_factor:
+            type: integer
+            minimum: 0
+            maximum: 100
+            description: Random jitter percentage (0-100) to avoid thundering herd
+      retry_if:
+        $ref: '#/components/schemas/RetryIf'
+    description: Retry configuration for failed module executions
+required:
+- script_path
+- permissioned_as
+- is_flow
+- amqp_resource_path
+- queue_name
diff --git a/system_prompts/auto-generated/script.md b/system_prompts/auto-generated/script.md
index 408f1354b7..9d393d2c7f 100644
--- a/system_prompts/auto-generated/script.md
+++ b/system_prompts/auto-generated/script.md
@@ -19,7 +19,7 @@
 
 ## Preprocessor Scripts
 
-Preprocessor scripts process raw trigger data from various sources (webhook, custom HTTP route, SQS, WebSocket, Kafka, NATS, MQTT, Postgres, or email) before passing it to the flow. This separates the trigger logic from the flow logic and keeps the auto-generated UI clean.
+Preprocessor scripts process raw trigger data from various sources (webhook, custom HTTP route, SQS, WebSocket, Kafka, NATS, MQTT, AMQP, Postgres, or email) before passing it to the flow. This separates the trigger logic from the flow logic and keeps the auto-generated UI clean.
 
 The returned object determines the parameter values passed to the flow.
 e.g., `{ b: 1, a: 2 }` calls the flow with `a = 2` and `b = 1`, assuming the flow has two inputs called `a` and `b`.
diff --git a/system_prompts/auto-generated/skills/cli-commands/SKILL.md b/system_prompts/auto-generated/skills/cli-commands/SKILL.md
index c2d7fe27ef..cba3a1da40 100644
--- a/system_prompts/auto-generated/skills/cli-commands/SKILL.md
+++ b/system_prompts/auto-generated/skills/cli-commands/SKILL.md
@@ -680,12 +680,12 @@ trigger related commands
   - `--json` - Output as JSON (for piping to jq)
 - `trigger get <path:string>` - get a trigger's details
   - `--json` - Output as JSON (for piping to jq)
-  - `--kind <kind:string>` - Trigger kind (http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, azure, email). Recommended for faster lookup
+  - `--kind <kind:string>` - Trigger kind (http, websocket, kafka, nats, postgres, mqtt, amqp, sqs, gcp, azure, email). Recommended for faster lookup
 - `trigger new <path:string>` - create a new trigger locally
-  - `--kind <kind:string>` - Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, azure, email)
+  - `--kind <kind:string>` - Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, amqp, sqs, gcp, azure, email)
 - `trigger push <file_path:string> <remote_path:string>` - push a local trigger spec. This overrides any remote versions.
 - `trigger set-permissioned-as <path:string> <email:string>` - Set the email (run-as user) for a trigger (requires admin or wm_deployers group)
-  - `--kind <kind:string>` - Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, azure, email)
+  - `--kind <kind:string>` - Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, amqp, sqs, gcp, azure, email)
 
 ### user
 
diff --git a/system_prompts/base/pipeline-base.md b/system_prompts/base/pipeline-base.md
index a0f2e2492a..55c1c53169 100644
--- a/system_prompts/base/pipeline-base.md
+++ b/system_prompts/base/pipeline-base.md
@@ -8,7 +8,7 @@ A script joins the pipeline when its source begins with the `pipeline` annotatio
 
 - `// on <ref>` — declares an execution-DAG **input** (what triggers/feeds this node). `<ref>` is either:
   - an **asset URI** (the node runs when that asset is produced upstream): `ducklake://main/orders`, `datatable://main/users`, `s3://<key>`, `$res:f/folder/my_resource`, `volume://name/path`.
-  - a **native trigger kind**: `schedule`, `webhook`, `email`, `kafka`, `mqtt`, `nats`, `postgres`, `sqs`, `gcp`, or `data_upload` (a user-uploaded S3 file). For these the actual trigger row (cron, topic, …) is created separately; the annotation only declares the binding.
+  - a **native trigger kind**: `schedule`, `webhook`, `email`, `kafka`, `mqtt`, `amqp`, `nats`, `postgres`, `sqs`, `gcp`, or `data_upload` (a user-uploaded S3 file). For these the actual trigger row (cron, topic, …) is created separately; the annotation only declares the binding.
 - **Outputs** are inferred from what the body writes — a `CREATE TABLE`, a `wmill.writeS3File(...)`, a DuckLake/datatable write. To declare a managed output explicitly, use `// materialize <asset-uri>`.
 - Optional badges: `// partitioned <daily|hourly|weekly|monthly|dynamic>`, `// freshness <duration>` (e.g. `1h`), `// tag <worker-tag>`, `// retry <count> [delay]`, `// data_test <kind> ...`.
 
diff --git a/system_prompts/base/script-base.md b/system_prompts/base/script-base.md
index 842667928a..71ffada86e 100644
--- a/system_prompts/base/script-base.md
+++ b/system_prompts/base/script-base.md
@@ -19,7 +19,7 @@
 
 ## Preprocessor Scripts
 
-Preprocessor scripts process raw trigger data from various sources (webhook, custom HTTP route, SQS, WebSocket, Kafka, NATS, MQTT, Postgres, or email) before passing it to the flow. This separates the trigger logic from the flow logic and keeps the auto-generated UI clean.
+Preprocessor scripts process raw trigger data from various sources (webhook, custom HTTP route, SQS, WebSocket, Kafka, NATS, MQTT, AMQP, Postgres, or email) before passing it to the flow. This separates the trigger logic from the flow logic and keeps the auto-generated UI clean.
 
 The returned object determines the parameter values passed to the flow.
 e.g., `{ b: 1, a: 2 }` calls the flow with `a = 2` and `b = 1`, assuming the flow has two inputs called `a` and `b`.
diff --git a/system_prompts/generate.py b/system_prompts/generate.py
index beac340499..d315e3a97b 100644
--- a/system_prompts/generate.py
+++ b/system_prompts/generate.py
@@ -828,6 +828,7 @@ WORKSPACE_TOOL_ZOD_SCHEMAS = [
     ('NewNatsTrigger', 'natsTriggerRequestSchema'),
     ('NewPostgresTrigger', 'postgresTriggerRequestSchema'),
     ('NewMqttTrigger', 'mqttTriggerRequestSchema'),
+    ('NewAmqpTrigger', 'amqpTriggerRequestSchema'),
     ('NewSqsTrigger', 'sqsTriggerRequestSchema'),
     ('GcpTriggerData', 'gcpTriggerRequestSchema'),
     ('AzureTriggerData', 'azureTriggerRequestSchema'),
@@ -842,6 +843,7 @@ WORKSPACE_TOOL_TRIGGER_SCHEMAS = [
     ('nats', 'natsTriggerRequestSchema'),
     ('postgres', 'postgresTriggerRequestSchema'),
     ('mqtt', 'mqttTriggerRequestSchema'),
+    ('amqp', 'amqpTriggerRequestSchema'),
     ('sqs', 'sqsTriggerRequestSchema'),
     ('gcp', 'gcpTriggerRequestSchema'),
     ('azure', 'azureTriggerRequestSchema'),
@@ -1582,6 +1584,7 @@ SKILL_DEFINITIONS = [
             ('NatsTrigger', 'nats_trigger'),
             ('PostgresTrigger', 'postgres_trigger'),
             ('MqttTrigger', 'mqtt_trigger'),
+            ('AmqpTrigger', 'amqp_trigger'),
             ('SqsTrigger', 'sqs_trigger'),
             ('GcpTrigger', 'gcp_trigger'),
             ('AzureTrigger', 'azure_trigger'),
@@ -2478,6 +2481,7 @@ def main():
             'NatsTrigger', 'NewNatsTrigger',
             'PostgresTrigger', 'NewPostgresTrigger',
             'MqttTrigger', 'NewMqttTrigger',
+            'AmqpTrigger', 'NewAmqpTrigger',
             'SqsTrigger', 'NewSqsTrigger',
             'GcpTrigger',
             'AzureTrigger',
diff --git a/system_prompts/utils.py b/system_prompts/utils.py
index 8ae4df291c..9666b6cf0c 100644
--- a/system_prompts/utils.py
+++ b/system_prompts/utils.py
@@ -46,6 +46,7 @@ SCHEMA_MAPPINGS = {
         ('NatsTrigger', 'nats_trigger'),
         ('PostgresTrigger', 'postgres_trigger'),
         ('MqttTrigger', 'mqtt_trigger'),
+        ('AmqpTrigger', 'amqp_trigger'),
         ('SqsTrigger', 'sqs_trigger'),
         ('GcpTrigger', 'gcp_trigger'),
         ('AzureTrigger', 'azure_trigger'),

From 2caee41fdfe1e69010a1f4544d45aaa5db49f590 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Tue, 21 Jul 2026 17:49:29 +0200
Subject: [PATCH 092/171] fix(worker): mount /dev/shm as tmpfs in the Docker v2
 nsjail sandbox (#10240)

The Docker v2 nsjail profile provided /dev/null, /dev/zero, /dev/random,
and /dev/urandom but omitted /dev/shm, since generate_rootfs_mounts()
skips the image's own /dev in favor of the profile's device nodes. Any
program needing POSIX shared memory (Ansible/Python multiprocessing,
Chromium) failed with "No such file or directory: /dev/shm".

Add a /dev/shm tmpfs mount, matching run.ansible.config.proto and
run.python3.config.proto.

Fixes WIN-2216

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 backend/windmill-worker/nsjail/run.docker.config.proto | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/backend/windmill-worker/nsjail/run.docker.config.proto b/backend/windmill-worker/nsjail/run.docker.config.proto
index a2da459fbe..5cc1e4ca03 100644
--- a/backend/windmill-worker/nsjail/run.docker.config.proto
+++ b/backend/windmill-worker/nsjail/run.docker.config.proto
@@ -77,6 +77,13 @@ mount {
     is_bind: true
 }
 
+mount {
+    dst: "/dev/shm"
+    fstype: "tmpfs"
+    rw: true
+    is_bind: false
+}
+
 # Host DNS config layered over the image's /etc so name resolution works on the
 # job's network (mandatory:false: some minimal images have no /etc files to shadow).
 mount {

From dc5b006e7f02baeb262d3f9e1dcc17ab99688442 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Tue, 21 Jul 2026 15:59:26 +0000
Subject: [PATCH 093/171] fix npm checks

---
 frontend/src/lib/components/ShareModal.svelte | 1 +
 1 file changed, 1 insertion(+)

diff --git a/frontend/src/lib/components/ShareModal.svelte b/frontend/src/lib/components/ShareModal.svelte
index 0996e6ca7b..65ba6215fb 100644
--- a/frontend/src/lib/components/ShareModal.svelte
+++ b/frontend/src/lib/components/ShareModal.svelte
@@ -42,6 +42,7 @@
 		| 'postgres_trigger'
 		| 'gcp_trigger'
 		| 'azure_trigger'
+		| 'amqp_trigger'
 		| 'email_trigger'
 		| 'volume'
 	let kind: Kind

From 7fb8a2e390cef3cd01a33c89ee55d3f53cb1e20f Mon Sep 17 00:00:00 2001
From: Diego Imbert <70353967+diegoimbert@users.noreply.github.com>
Date: Tue, 21 Jul 2026 18:25:06 +0200
Subject: [PATCH 094/171] fix(parsers): keep s3 asset path suffix verbatim to
 preserve storage distinction (#10241)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix(parsers): keep s3 asset path suffix verbatim to preserve storage distinction

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01An2pTqSmqJd2XwnagvX4kM

* package json

* fix(pipelines): preserve named storage in generated TS/Python S3 URIs

The TS/Python templates emitted `s3:///${s3Key(path)}`, stripping the
leading slash and pinning the URI to default storage. For a named-storage
asset path (`secondary/key`) that produced `s3:///secondary/key`, which
resolves to the default storage with key `secondary/key`, dropping the
named-storage dependency and reading/writing the wrong object.

Emit the path verbatim after `s3://` (matching the DuckDB template) so a
named-storage input/output keeps its storage; identical to the previous
output for default-storage paths. Removes the now-unused `s3Key` helper.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore(cli): align bun.lock parser versions with frontend

The PR bumped windmill-parser-wasm-asset (1.749.0→1.753.0) and
windmill-parser-wasm-regex (1.692.0→1.764.0) in package.json and the npm
package-lock.json for both cli and frontend, but cli/bun.lock was left
pinned to the old versions. Sync it so the CLI's wasm asset parser (used
by localGraph inference) matches the frontend and deploy-time parser.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
---
 .../windmill-parser-py-asset/src/lib.rs       |  33 +++---
 .../src/asset_parser.rs                       |  76 +++++++------
 .../windmill-parser-ts-asset/src/lib.rs       |  25 +++--
 .../windmill-parser/src/asset_parser.rs       | 104 ++++++------------
 .../tests/fixtures/pipeline_annotations.json  |  10 +-
 backend/windmill-common/src/assets.rs         |  15 +--
 cli/bun.lock                                  |   8 +-
 cli/package-lock.json                         |   8 +-
 cli/package.json                              |   4 +-
 cli/src/commands/pipeline/boundedCascade.ts   |  10 +-
 cli/src/commands/pipeline/localGraph.ts       |  23 ++--
 .../pipeline_bounded_cascade_unit.test.ts     |  16 ++-
 cli/test/pipeline_local_graph_unit.test.ts    |  23 ++--
 docs/pipeline-local-dev.md                    |  35 +++---
 frontend/package-lock.json                    |   8 +-
 frontend/package.json                         |   4 +-
 .../assets/AssetGraph/boundedCascade.test.ts  |  16 ++-
 .../assets/AssetGraph/boundedCascade.ts       |   9 +-
 .../AssetGraph/parsePipelineAnnotations.ts    |  17 +--
 .../AssetGraph/pipelineTemplates.test.ts      |  21 ++--
 .../assets/AssetGraph/pipelineTemplates.ts    |  55 +++++----
 21 files changed, 227 insertions(+), 293 deletions(-)

diff --git a/backend/parsers/windmill-parser-py-asset/src/lib.rs b/backend/parsers/windmill-parser-py-asset/src/lib.rs
index 8d2e87a53e..b8a12fb476 100644
--- a/backend/parsers/windmill-parser-py-asset/src/lib.rs
+++ b/backend/parsers/windmill-parser-py-asset/src/lib.rs
@@ -383,7 +383,7 @@ def main():
             s.map_err(|e| e.to_string()),
             Ok(vec![ParseAssetsResult {
                 kind: AssetKind::S3Object,
-                path: "test.csv".to_string(),
+                path: "/test.csv".to_string(),
                 access_type: Some(R),
                 columns: None,
             },])
@@ -441,7 +441,7 @@ def main():
             s.map_err(|e| e.to_string()),
             Ok(vec![ParseAssetsResult {
                 kind: AssetKind::S3Object,
-                path: "analytics/x.csv".to_string(),
+                path: "/analytics/x.csv".to_string(),
                 access_type: Some(W),
                 columns: None,
             },])
@@ -450,10 +450,11 @@ def main():
 
     #[test]
     fn test_py_write_key_matches_duckdb_read_key() {
-        // Cross-language lineage: this write records `exports/x`, the same path a
-        // DuckDB `read_csv('s3://exports/x')` resolves to (see
-        // windmill-parser-sql-asset `test_duckdb_read_key_matches_sdk_write_key`),
-        // so the producer and consumer connect in the pipeline graph.
+        // Cross-language lineage: this default-storage write records
+        // `/exports/x`, the same path a DuckDB `read_csv('s3:///exports/x')`
+        // resolves to (see windmill-parser-sql-asset
+        // `test_duckdb_read_key_matches_sdk_write_key`), so the producer and
+        // consumer connect in the pipeline graph.
         let input = r#"
 import wmill
 from wmill import S3Object
@@ -465,7 +466,7 @@ def main():
             s.map_err(|e| e.to_string()),
             Ok(vec![ParseAssetsResult {
                 kind: AssetKind::S3Object,
-                path: "exports/x".to_string(),
+                path: "/exports/x".to_string(),
                 access_type: Some(W),
                 columns: None,
             },])
@@ -508,7 +509,7 @@ def main():
             s.map_err(|e| e.to_string()),
             Ok(vec![ParseAssetsResult {
                 kind: AssetKind::S3Object,
-                path: "dir/in.csv".to_string(),
+                path: "/dir/in.csv".to_string(),
                 access_type: Some(R),
                 columns: None,
             },])
@@ -531,14 +532,14 @@ def main():
             Ok(vec![
                 ParseAssetsResult {
                     kind: AssetKind::S3Object,
-                    path: "mybucket/dir/in.csv".to_string(),
-                    access_type: Some(R),
+                    path: "/out.json".to_string(),
+                    access_type: Some(W),
                     columns: None,
                 },
                 ParseAssetsResult {
                     kind: AssetKind::S3Object,
-                    path: "out.json".to_string(),
-                    access_type: Some(W),
+                    path: "mybucket/dir/in.csv".to_string(),
+                    access_type: Some(R),
                     columns: None,
                 },
             ])
@@ -564,25 +565,25 @@ def main():
             Ok(vec![
                 ParseAssetsResult {
                     kind: AssetKind::S3Object,
-                    path: "pipelines/km_real/enriched.json".to_string(),
+                    path: "/pipelines/km_real/enriched.json".to_string(),
                     access_type: Some(W),
                     columns: None,
                 },
                 ParseAssetsResult {
                     kind: AssetKind::S3Object,
-                    path: "pipelines/km_real/raw_events.json".to_string(),
+                    path: "/pipelines/km_real/raw_events.json".to_string(),
                     access_type: Some(W),
                     columns: None,
                 },
                 ParseAssetsResult {
                     kind: AssetKind::S3Object,
-                    path: "pipelines/km_real/report.json".to_string(),
+                    path: "/pipelines/km_real/report.json".to_string(),
                     access_type: Some(W),
                     columns: None,
                 },
                 ParseAssetsResult {
                     kind: AssetKind::S3Object,
-                    path: "pipelines/km_real/summary.json".to_string(),
+                    path: "/pipelines/km_real/summary.json".to_string(),
                     access_type: Some(W),
                     columns: None,
                 },
diff --git a/backend/parsers/windmill-parser-sql-asset/src/asset_parser.rs b/backend/parsers/windmill-parser-sql-asset/src/asset_parser.rs
index 4b523d5792..12d7932a16 100644
--- a/backend/parsers/windmill-parser-sql-asset/src/asset_parser.rs
+++ b/backend/parsers/windmill-parser-sql-asset/src/asset_parser.rs
@@ -1261,13 +1261,13 @@ mod tests {
             Ok(vec![
                 ParseAssetsResult {
                     kind: AssetKind::S3Object,
-                    path: "a.parquet".to_string(),
+                    path: "/a.parquet".to_string(),
                     access_type: Some(R),
                     columns: None
                 },
                 ParseAssetsResult {
                     kind: AssetKind::S3Object,
-                    path: "c.parquet".to_string(),
+                    path: "/c.parquet".to_string(),
                     access_type: Some(W),
                     columns: None
                 },
@@ -1284,25 +1284,35 @@ mod tests {
     #[test]
     fn test_duckdb_read_key_matches_sdk_write_key() {
         // Cross-language lineage: a TS `writeS3File({ s3: "exports/x" })` or
-        // Python `write_s3_file(S3Object(s3="exports/x"))` records the asset path
-        // `exports/x` (default storage). A DuckDB reader of the same object must
-        // resolve to the identical path so the graph connects the producer and
-        // consumer — both the bare `s3://exports/x` and the triple-slash
-        // `s3:///exports/x` default-storage form must yield `exports/x`.
-        for uri in ["s3://exports/x", "s3:///exports/x"] {
-            let input = format!("SELECT * FROM read_csv('{uri}');");
-            let assets = parse_assets(&input).expect("parse").assets;
-            assert_eq!(
-                assets,
-                vec![ParseAssetsResult {
-                    kind: AssetKind::S3Object,
-                    path: "exports/x".to_string(),
-                    access_type: Some(R),
-                    columns: None
-                }],
-                "DuckDB read of {uri} must resolve to the SDK write key"
-            );
-        }
+        // Python `write_s3_file(S3Object(s3="exports/x"))` records the asset
+        // path `/exports/x` (default storage, leading slash). A DuckDB reader
+        // of the same object uses the triple-slash default-storage URI and
+        // must resolve to the identical path so the graph connects producer
+        // and consumer. The bare `s3://exports/x` form names storage
+        // `exports` instead — a different object, a different path.
+        let input = "SELECT * FROM read_csv('s3:///exports/x');";
+        let assets = parse_assets(input).expect("parse").assets;
+        assert_eq!(
+            assets,
+            vec![ParseAssetsResult {
+                kind: AssetKind::S3Object,
+                path: "/exports/x".to_string(),
+                access_type: Some(R),
+                columns: None
+            }],
+        );
+
+        let input = "SELECT * FROM read_csv('s3://exports/x');";
+        let assets = parse_assets(input).expect("parse").assets;
+        assert_eq!(
+            assets,
+            vec![ParseAssetsResult {
+                kind: AssetKind::S3Object,
+                path: "exports/x".to_string(),
+                access_type: Some(R),
+                columns: None
+            }],
+        );
     }
 
     #[test]
@@ -1318,7 +1328,7 @@ mod tests {
             s.map_err(|e| e.to_string()),
             Ok(vec![ParseAssetsResult {
                 kind: AssetKind::S3Object,
-                path: "out.csv".to_string(),
+                path: "/out.csv".to_string(),
                 access_type: Some(W),
                 columns: None
             }])
@@ -1335,7 +1345,7 @@ mod tests {
             s.map_err(|e| e.to_string()),
             Ok(vec![ParseAssetsResult {
                 kind: AssetKind::S3Object,
-                path: "referenced.csv".to_string(),
+                path: "/referenced.csv".to_string(),
                 access_type: Some(R),
                 columns: None
             }])
@@ -1355,7 +1365,7 @@ mod tests {
             s.map_err(|e| e.to_string()),
             Ok(vec![ParseAssetsResult {
                 kind: AssetKind::S3Object,
-                path: "data.csv".to_string(),
+                path: "/data.csv".to_string(),
                 access_type: Some(RW),
                 columns: None
             }])
@@ -1375,7 +1385,7 @@ mod tests {
             s.map_err(|e| e.to_string()),
             Ok(vec![ParseAssetsResult {
                 kind: AssetKind::S3Object,
-                path: "data.parquet".to_string(),
+                path: "/data.parquet".to_string(),
                 access_type: Some(RW),
                 columns: None
             }])
@@ -1393,13 +1403,13 @@ mod tests {
             Ok(vec![
                 ParseAssetsResult {
                     kind: AssetKind::S3Object,
-                    path: "a.parquet".to_string(),
+                    path: "/a.parquet".to_string(),
                     access_type: Some(R),
                     columns: None
                 },
                 ParseAssetsResult {
                     kind: AssetKind::S3Object,
-                    path: "b.parquet".to_string(),
+                    path: "/b.parquet".to_string(),
                     access_type: Some(R),
                     columns: None
                 }
@@ -1419,7 +1429,7 @@ mod tests {
             s.map_err(|e| e.to_string()),
             Ok(vec![ParseAssetsResult {
                 kind: AssetKind::S3Object,
-                path: "data.parquet".to_string(),
+                path: "/data.parquet".to_string(),
                 access_type: Some(RW),
                 columns: None
             }])
@@ -2101,7 +2111,7 @@ mod tests {
 
         assert_eq!(result.len(), 1);
         assert_eq!(result[0].kind, AssetKind::S3Object);
-        assert_eq!(result[0].path, "example_file.parquet");
+        assert_eq!(result[0].path, "/example_file.parquet");
         assert_eq!(result[0].access_type, Some(R));
 
         let columns = result[0].columns.as_ref().expect("Should have columns");
@@ -2132,7 +2142,7 @@ mod tests {
 
         assert_eq!(result.len(), 1);
         assert_eq!(result[0].kind, AssetKind::S3Object);
-        assert_eq!(result[0].path, "example_file.parquet");
+        assert_eq!(result[0].path, "/example_file.parquet");
         assert!(result[0].columns.is_none());
     }
 
@@ -2145,7 +2155,7 @@ mod tests {
 
         assert_eq!(result.len(), 1);
         assert_eq!(result[0].kind, AssetKind::S3Object);
-        assert_eq!(result[0].path, "example_file.parquet");
+        assert_eq!(result[0].path, "/example_file.parquet");
 
         let columns = result[0].columns.as_ref().expect("Should have columns");
         assert_eq!(columns.get("col1"), Some(&R));
@@ -2164,7 +2174,7 @@ mod tests {
         assert_eq!(result.len(), 2);
 
         assert!(result.iter().any(|a| {
-            a.path == "file1.parquet"
+            a.path == "/file1.parquet"
                 && a.columns.as_ref().map_or(false, |c| c.contains_key("col1"))
         }));
         assert!(result.iter().any(|a| {
@@ -2197,7 +2207,7 @@ mod tests {
 
         assert_eq!(result.len(), 1);
         assert_eq!(result[0].kind, AssetKind::S3Object);
-        assert_eq!(result[0].path, "test.parquet");
+        assert_eq!(result[0].path, "/test.parquet");
         assert_eq!(result[0].access_type, Some(R));
 
         let columns = result[0].columns.as_ref().expect("Should have columns");
diff --git a/backend/parsers/windmill-parser-ts-asset/src/lib.rs b/backend/parsers/windmill-parser-ts-asset/src/lib.rs
index f273db5cbe..68b1287aa0 100644
--- a/backend/parsers/windmill-parser-ts-asset/src/lib.rs
+++ b/backend/parsers/windmill-parser-ts-asset/src/lib.rs
@@ -433,7 +433,7 @@ mod tests {
             s.map(|r| r.assets).map_err(|e| e.to_string()),
             Ok(vec![ParseAssetsResult {
                 kind: AssetKind::S3Object,
-                path: "test.csv".to_string(),
+                path: "/test.csv".to_string(),
                 access_type: Some(R),
                 columns: None,
             },])
@@ -461,7 +461,7 @@ mod tests {
             s.map(|r| r.assets).map_err(|e| e.to_string()),
             Ok(vec![ParseAssetsResult {
                 kind: AssetKind::S3Object,
-                path: "pipelines/km_real/raw_events.json".to_string(),
+                path: "/pipelines/km_real/raw_events.json".to_string(),
                 access_type: Some(W),
                 columns: None,
             },])
@@ -470,10 +470,11 @@ mod tests {
 
     #[test]
     fn test_ts_write_key_matches_duckdb_read_key() {
-        // Cross-language lineage: this write records `exports/x`, the same path a
-        // DuckDB `read_csv('s3://exports/x')` resolves to (see
-        // windmill-parser-sql-asset `test_duckdb_read_key_matches_sdk_write_key`),
-        // so the producer and consumer connect in the pipeline graph.
+        // Cross-language lineage: this default-storage write records
+        // `/exports/x`, the same path a DuckDB `read_csv('s3:///exports/x')`
+        // resolves to (see windmill-parser-sql-asset
+        // `test_duckdb_read_key_matches_sdk_write_key`), so the producer and
+        // consumer connect in the pipeline graph.
         let input = r#"
             import * as wmill from "windmill-client"
             export async function main() {
@@ -485,7 +486,7 @@ mod tests {
             s.map(|r| r.assets).map_err(|e| e.to_string()),
             Ok(vec![ParseAssetsResult {
                 kind: AssetKind::S3Object,
-                path: "exports/x".to_string(),
+                path: "/exports/x".to_string(),
                 access_type: Some(W),
                 columns: None,
             },])
@@ -570,25 +571,25 @@ mod tests {
             Ok(vec![
                 ParseAssetsResult {
                     kind: AssetKind::S3Object,
-                    path: "pipelines/km_real/enriched.json".to_string(),
+                    path: "/pipelines/km_real/enriched.json".to_string(),
                     access_type: Some(W),
                     columns: None,
                 },
                 ParseAssetsResult {
                     kind: AssetKind::S3Object,
-                    path: "pipelines/km_real/raw_events.json".to_string(),
+                    path: "/pipelines/km_real/raw_events.json".to_string(),
                     access_type: Some(W),
                     columns: None,
                 },
                 ParseAssetsResult {
                     kind: AssetKind::S3Object,
-                    path: "pipelines/km_real/report.json".to_string(),
+                    path: "/pipelines/km_real/report.json".to_string(),
                     access_type: Some(W),
                     columns: None,
                 },
                 ParseAssetsResult {
                     kind: AssetKind::S3Object,
-                    path: "pipelines/km_real/summary.json".to_string(),
+                    path: "/pipelines/km_real/summary.json".to_string(),
                     access_type: Some(W),
                     columns: None,
                 },
@@ -609,7 +610,7 @@ mod tests {
             s.map(|r| r.assets).map_err(|e| e.to_string()),
             Ok(vec![ParseAssetsResult {
                 kind: AssetKind::S3Object,
-                path: "out.json".to_string(),
+                path: "/out.json".to_string(),
                 access_type: Some(W),
                 columns: None,
             },])
diff --git a/backend/parsers/windmill-parser/src/asset_parser.rs b/backend/parsers/windmill-parser/src/asset_parser.rs
index 211c205579..de35ccdd6e 100644
--- a/backend/parsers/windmill-parser/src/asset_parser.rs
+++ b/backend/parsers/windmill-parser/src/asset_parser.rs
@@ -722,26 +722,13 @@ pub fn parse_asset_syntax(s: &str, enable_default_syntax: bool) -> Option<(Asset
     }
     for (prefix, kind) in ASSET_KINDS.iter() {
         if s.starts_with(prefix) {
-            let path = &s[prefix.len()..];
-            // Canonicalize S3 keys to a single asset identity. The SDK object
-            // form (`{ s3: "key" }` / `S3Object(s3="key")`, default storage)
-            // resolves to `s3:///key`, whose path is `/key`, while DuckDB
-            // `s3://key` and `// on s3://key` yield the bare `key`. Strip every
-            // leading slash so the triple-slash default-storage form and the
-            // `s3://storage/key` form share one path — otherwise a TS/Python
-            // writer and a DuckDB reader of the same object become disconnected
-            // nodes in the pipeline graph. Stripping ALL leading slashes (not
-            // just one) keeps the identity stable through URI reconstruction:
-            // `trigger_spec_to_row` rebuilds `s3://<path>`, so a canonical path
-            // must never itself start with `/` or the rebuilt ref would parse
-            // back to a different key. Only leading slashes are touched, so
-            // Hive-partition keys (`s3://b/y=2024/f.parquet`) are untouched.
-            let path = if matches!(kind, AssetKind::S3Object) {
-                path.trim_start_matches('/')
-            } else {
-                path
-            };
-            return Some((*kind, path));
+            // The suffix is kept verbatim. For S3 the path encodes the storage:
+            // `s3://<storage>/<key>`, with an EMPTY storage segment for the
+            // workspace default — so `s3:///key` yields `/key` (leading slash
+            // significant, default storage) while `s3://secondary/key` yields
+            // `secondary/key`. Stripping leading slashes here would conflate a
+            // default-storage object with a named-storage one.
+            return Some((*kind, &s[prefix.len()..]));
         }
     }
     None
@@ -1560,52 +1547,43 @@ mod pipeline_annotation_tests {
     use super::*;
 
     #[test]
-    fn s3_key_normalization_unifies_uri_forms() {
-        // A TS/Python SDK write of `{ s3: "exports/x" }` (default storage)
-        // resolves to the URI `s3:///exports/x`, while a DuckDB read of
-        // `s3://exports/x` and the `// on s3://exports/x` trigger form yield the
-        // bare `exports/x`. All three must canonicalize to one asset key so
-        // the writer and reader connect in the pipeline graph.
-        let sdk_write = parse_asset_syntax("s3:///exports/x", false);
-        let duckdb_read = parse_asset_syntax("s3://exports/x", false);
-        assert_eq!(sdk_write, Some((AssetKind::S3Object, "exports/x")));
-        assert_eq!(duckdb_read, Some((AssetKind::S3Object, "exports/x")));
-        assert_eq!(sdk_write, duckdb_read);
+    fn s3_path_keeps_storage_distinction() {
+        // An S3 asset path is `<storage>/<key>` with an empty storage segment
+        // for the workspace default. The default-storage form `s3:///key`
+        // yields `/key` (leading slash significant); the named-storage form
+        // `s3://secondary/key` yields `secondary/key`. The two name DIFFERENT
+        // objects and must never collapse to one identity.
+        assert_eq!(
+            parse_asset_syntax("s3:///exports/x", false),
+            Some((AssetKind::S3Object, "/exports/x"))
+        );
+        assert_eq!(
+            parse_asset_syntax("s3://exports/x", false),
+            Some((AssetKind::S3Object, "exports/x"))
+        );
+        assert_ne!(
+            parse_asset_syntax("s3:///exports/x", false),
+            parse_asset_syntax("s3://exports/x", false)
+        );
 
         // The `// on` trigger annotation goes through the same function.
         assert_eq!(
             parse_asset_syntax("s3:///exports/x", true),
-            parse_asset_syntax("s3://exports/x", true)
+            Some((AssetKind::S3Object, "/exports/x"))
         );
 
-        // Explicit-storage form is unaffected (no leading slash to strip).
         assert_eq!(
-            parse_asset_syntax("s3://mybucket/exports/x", false),
-            Some((AssetKind::S3Object, "mybucket/exports/x"))
+            parse_asset_syntax("s3://secondary_storage/path/to/file.csv", false),
+            Some((AssetKind::S3Object, "secondary_storage/path/to/file.csv"))
         );
 
-        // Hive-partition keys and nested paths under default storage are
-        // preserved verbatim (only leading slashes are stripped).
+        // Hive-partition keys are preserved verbatim.
         assert_eq!(
             parse_asset_syntax("s3:///t/year=2024/month=01/f.parquet", false),
-            Some((AssetKind::S3Object, "t/year=2024/month=01/f.parquet"))
+            Some((AssetKind::S3Object, "/t/year=2024/month=01/f.parquet"))
         );
 
-        // Every leading slash is stripped so a canonical S3 path never starts
-        // with `/`. `S3Object(s3="/x")` resolves to the quad-slash URI
-        // `s3:////x`; the identity must be the bare `x` (not `/x`) so the ref
-        // that `trigger_spec_to_row` rebuilds round-trips back to it.
-        assert_eq!(
-            parse_asset_syntax("s3:////x", false),
-            Some((AssetKind::S3Object, "x"))
-        );
-        assert_eq!(
-            parse_asset_syntax("s3://///deep///", false),
-            Some((AssetKind::S3Object, "deep///"))
-        );
-
-        // Non-S3 kinds keep their leading slash (their paths are workspace-
-        // relative and the slash is significant).
+        // Non-S3 kinds also keep their suffix verbatim.
         assert_eq!(
             parse_asset_syntax("res://f/foo", false),
             Some((AssetKind::Resource, "f/foo"))
@@ -1616,26 +1594,6 @@ mod pipeline_annotation_tests {
         );
     }
 
-    #[test]
-    fn s3_explicit_storage_aliases_default_storage_nested_key() {
-        // Accepted tradeoff of one canonical key: the explicit-storage form
-        // `s3://storage/key` and the default-storage nested-key form
-        // `s3:///storage/key` collapse to the same node `storage/key`, even
-        // though they name different objects. This is a best-effort lineage
-        // graph that does not split the first segment as a storage name; the
-        // collision only happens when a storage config is named to match a
-        // default-storage prefix. Pinned so the aliasing is intentional, not a
-        // latent surprise.
-        assert_eq!(
-            parse_asset_syntax("s3://mybucket/x", false),
-            parse_asset_syntax("s3:///mybucket/x", false)
-        );
-        assert_eq!(
-            parse_asset_syntax("s3://mybucket/x", false),
-            Some((AssetKind::S3Object, "mybucket/x"))
-        );
-    }
-
     #[test]
     fn bare_pipeline_marker() {
         let out = parse_pipeline_annotations("// pipeline\nconsole.log('hi')");
diff --git a/backend/parsers/windmill-parser/tests/fixtures/pipeline_annotations.json b/backend/parsers/windmill-parser/tests/fixtures/pipeline_annotations.json
index 226f32914c..a09349647d 100644
--- a/backend/parsers/windmill-parser/tests/fixtures/pipeline_annotations.json
+++ b/backend/parsers/windmill-parser/tests/fixtures/pipeline_annotations.json
@@ -741,12 +741,12 @@
 		}
 	},
 	{
-		"name": "s3 triple-slash default-storage trigger canonicalizes to bare key",
+		"name": "s3 triple-slash default-storage trigger keeps its leading slash",
 		"code": "// pipeline\n// on s3:///exports/x\nexport function main() {}",
 		"expected": {
 			"in_pipeline": true,
 			"asset_triggers": [
-				"s3object:exports/x"
+				"s3object:/exports/x"
 			],
 			"native_triggers": [],
 			"partition": null,
@@ -756,12 +756,12 @@
 		}
 	},
 	{
-		"name": "s3 quad-slash trigger strips all leading slashes to the bare key",
-		"code": "// pipeline\n// on s3:////x\nexport function main() {}",
+		"name": "s3 named-storage trigger keeps the storage segment",
+		"code": "// pipeline\n// on s3://secondary_storage/exports/x\nexport function main() {}",
 		"expected": {
 			"in_pipeline": true,
 			"asset_triggers": [
-				"s3object:x"
+				"s3object:secondary_storage/exports/x"
 			],
 			"native_triggers": [],
 			"partition": null,
diff --git a/backend/windmill-common/src/assets.rs b/backend/windmill-common/src/assets.rs
index d1bbed1a18..d6a4156f38 100644
--- a/backend/windmill-common/src/assets.rs
+++ b/backend/windmill-common/src/assets.rs
@@ -567,11 +567,9 @@ mod trigger_ref_roundtrip_tests {
     // `trigger_spec_to_row` rebuilds a stored ref as `s3://<path>`, and
     // `parse_asset_trigger_ref` parses it back. The two must be inverse for
     // every S3 URI form, or a consumer's `// on` trigger lands on a different
-    // graph node than the producer's inferred write. Because `parse_asset_syntax`
-    // strips ALL leading slashes, a canonical path never starts with `/`, so the
-    // naive `prefix + path` rebuild round-trips — including the `S3Object(s3="/x")`
-    // quad-slash case that previously desynced (path `/x` rebuilt to `s3:///x`,
-    // which re-parsed to `x`).
+    // graph node than the producer's inferred write. `parse_asset_syntax`
+    // keeps the URI suffix verbatim (a default-storage path starts with `/`),
+    // so the naive `prefix + path` rebuild round-trips for every form.
     fn roundtrip(uri: &str) -> String {
         let (pkind, path) = parse_asset_syntax(uri, false).expect("parse uri");
         assert_eq!(pkind, PAssetKind::S3Object);
@@ -590,11 +588,10 @@ mod trigger_ref_roundtrip_tests {
 
     #[test]
     fn s3_trigger_ref_roundtrips_for_every_uri_form() {
-        assert_eq!(roundtrip("s3:///exports/x"), "exports/x"); // SDK default storage
-        assert_eq!(roundtrip("s3://exports/x"), "exports/x"); // DuckDB / bare
+        assert_eq!(roundtrip("s3:///exports/x"), "/exports/x"); // SDK default storage
+        assert_eq!(roundtrip("s3://exports/x"), "exports/x"); // named storage `exports`
         assert_eq!(roundtrip("s3://mybucket/exports/x"), "mybucket/exports/x"); // explicit
-        assert_eq!(roundtrip("s3:////x"), "x"); // S3Object(s3="/x") quad-slash
-        assert_eq!(roundtrip("s3:///y=2024/f.parquet"), "y=2024/f.parquet"); // Hive
+        assert_eq!(roundtrip("s3:///y=2024/f.parquet"), "/y=2024/f.parquet"); // Hive
     }
 }
 
diff --git a/cli/bun.lock b/cli/bun.lock
index 7c76732a90..c783e411c7 100644
--- a/cli/bun.lock
+++ b/cli/bun.lock
@@ -19,7 +19,7 @@
         "pg-gateway": "0.3.0-beta.4",
         "svelte": "^5.45.2",
         "tar-stream": "^3.1.7",
-        "windmill-parser-wasm-asset": "1.749.0",
+        "windmill-parser-wasm-asset": "1.753.0",
         "windmill-parser-wasm-csharp": "1.510.1",
         "windmill-parser-wasm-go": "1.761.0",
         "windmill-parser-wasm-java": "1.510.1",
@@ -28,7 +28,7 @@
         "windmill-parser-wasm-py": "1.693.1",
         "windmill-parser-wasm-py-imports": "1.693.1",
         "windmill-parser-wasm-r": "1.668.1",
-        "windmill-parser-wasm-regex": "1.692.0",
+        "windmill-parser-wasm-regex": "1.764.0",
         "windmill-parser-wasm-ruby": "1.526.1",
         "windmill-parser-wasm-rust": "1.647.1",
         "windmill-parser-wasm-ts": "1.695.0",
@@ -290,7 +290,7 @@
 
     "utility-types": ["utility-types@3.11.0", "", {}, "sha512-6Z7Ma2aVEWisaL6TvBCy7P8rm2LQoPv6dJ7ecIaIixHcwfbJ0x7mWdbcwlIM5IGQxPZSFYeqRCqlOOeKoJYMkw=="],
 
-    "windmill-parser-wasm-asset": ["windmill-parser-wasm-asset@1.749.0", "", {}, "sha512-gj8g9sWQ0tXKfXso7xJxR56sS8Loe/RsnFy+0af5R8siZeCag9ikquGbQ8d8kOqIK2U8eCNA0LqsU/xAFDJIOg=="],
+    "windmill-parser-wasm-asset": ["windmill-parser-wasm-asset@1.753.0", "", {}, "sha512-zpJhjvcU8EWRoOJzas/nRGKjGdQnvzeB9GOxP+Mdmnk8BFk3uehsmHS2Krxyjo36fUrCHqobbnffEqf0g3LIGg=="],
 
     "windmill-parser-wasm-csharp": ["windmill-parser-wasm-csharp@1.510.1", "", {}, "sha512-qm09YmnbeYHLwYn1jUnObVzPhYO9NZKMlIO7nlo7zPJBXqksgG5fK/KCtwGw9rChrnz+DsvM9wP5FhrwRLMtwQ=="],
 
@@ -308,7 +308,7 @@
 
     "windmill-parser-wasm-r": ["windmill-parser-wasm-r@1.668.1", "", {}, "sha512-5YNeUibxpNBvYrxCgQcz1PxGhTFx2CyEpg2udtIhq7bx0d4gF/KDZVupMeQmAObmrEtTSFGUWNRJ4zXSWNrSpQ=="],
 
-    "windmill-parser-wasm-regex": ["windmill-parser-wasm-regex@1.692.0", "", {}, "sha512-BHGTxrinZJ9ef6hFxbKiBqBEr5uqgG/QySOgMA5r1LswO9n/8fyGswr8JcPT2kGaoeoweV6/RQ+RHVaOhosnKw=="],
+    "windmill-parser-wasm-regex": ["windmill-parser-wasm-regex@1.764.0", "", {}, "sha512-V2eFdKD90gqWikOvjl2fwMpFqiFt/21+4iQMbiNJYl7Lm2UiEcEZ4r9bpgJLG4TLOLqvD6+u4Ju3WaytxN2O2w=="],
 
     "windmill-parser-wasm-ruby": ["windmill-parser-wasm-ruby@1.526.1", "", {}, "sha512-rMBQA8s21wmL2kA5ztRs/ZgVA3ckxe9/NLjxl3iQPL0CX6DlvfaUH0O+AnhpXXDMyBs1Y1SZIhcnbnvsHZ3R8g=="],
 
diff --git a/cli/package-lock.json b/cli/package-lock.json
index 96dd0681e0..b0b610a045 100644
--- a/cli/package-lock.json
+++ b/cli/package-lock.json
@@ -20,7 +20,7 @@
         "pg-gateway": "0.3.0-beta.4",
         "svelte": "^5.45.2",
         "tar-stream": "^3.1.7",
-        "windmill-parser-wasm-asset": "1.749.0",
+        "windmill-parser-wasm-asset": "1.753.0",
         "windmill-parser-wasm-csharp": "1.510.1",
         "windmill-parser-wasm-go": "1.761.0",
         "windmill-parser-wasm-java": "1.510.1",
@@ -1413,9 +1413,9 @@
       }
     },
     "node_modules/windmill-parser-wasm-asset": {
-      "version": "1.749.0",
-      "resolved": "https://registry.npmjs.org/windmill-parser-wasm-asset/-/windmill-parser-wasm-asset-1.749.0.tgz",
-      "integrity": "sha512-gj8g9sWQ0tXKfXso7xJxR56sS8Loe/RsnFy+0af5R8siZeCag9ikquGbQ8d8kOqIK2U8eCNA0LqsU/xAFDJIOg=="
+      "version": "1.753.0",
+      "resolved": "https://registry.npmjs.org/windmill-parser-wasm-asset/-/windmill-parser-wasm-asset-1.753.0.tgz",
+      "integrity": "sha512-zpJhjvcU8EWRoOJzas/nRGKjGdQnvzeB9GOxP+Mdmnk8BFk3uehsmHS2Krxyjo36fUrCHqobbnffEqf0g3LIGg=="
     },
     "node_modules/windmill-parser-wasm-csharp": {
       "version": "1.510.1",
diff --git a/cli/package.json b/cli/package.json
index c13802c0b0..548588a402 100644
--- a/cli/package.json
+++ b/cli/package.json
@@ -28,7 +28,7 @@
     "pg-gateway": "0.3.0-beta.4",
     "svelte": "^5.45.2",
     "tar-stream": "^3.1.7",
-    "windmill-parser-wasm-asset": "1.749.0",
+    "windmill-parser-wasm-asset": "1.753.0",
     "windmill-parser-wasm-csharp": "1.510.1",
     "windmill-parser-wasm-go": "1.761.0",
     "windmill-parser-wasm-java": "1.510.1",
@@ -54,4 +54,4 @@
     "@types/ws": "^8.5.0",
     "typescript": "^5.7.0"
   }
-}
+}
\ No newline at end of file
diff --git a/cli/src/commands/pipeline/boundedCascade.ts b/cli/src/commands/pipeline/boundedCascade.ts
index 57130ba129..31c780a272 100644
--- a/cli/src/commands/pipeline/boundedCascade.ts
+++ b/cli/src/commands/pipeline/boundedCascade.ts
@@ -87,12 +87,10 @@ export function assetUriToNodeId(uri: string): string | undefined {
   if (!m) return undefined;
   const prefix = m[1].toLowerCase();
   const kind = prefix === "s3" ? "s3object" : prefix;
-  // Mirror Rust `parse_asset_syntax`: strip all leading slashes from S3 keys so a
-  // `--to s3:///exports/x` token resolves to the canonical graph node
-  // `s3object:exports/x` (default storage), same as `s3://exports/x`, and a
-  // canonical key never starts with `/`.
-  const path = kind === "s3object" ? m[2].replace(/^\/+/, "") : m[2];
-  return `${kind}:${path}`;
+  // The suffix is kept verbatim (mirrors Rust `parse_asset_syntax`): an S3
+  // path encodes the storage, with a leading `/` for the workspace default
+  // (`s3:///key` → `/key`) vs `s3://secondary/key` → `secondary/key`.
+  return `${kind}:${m[2]}`;
 }
 
 export type LineageDag = {
diff --git a/cli/src/commands/pipeline/localGraph.ts b/cli/src/commands/pipeline/localGraph.ts
index be5c8f1567..bb51cd98eb 100644
--- a/cli/src/commands/pipeline/localGraph.ts
+++ b/cli/src/commands/pipeline/localGraph.ts
@@ -300,13 +300,10 @@ function fallbackParse(content: string, language: string): ParseAssetsRaw {
     if (uri) {
       const prefix = uri[1].toLowerCase();
       const kind = prefix === "s3" ? "s3object" : prefix;
-      // Mirror Rust `parse_asset_syntax`: strip all leading slashes from S3 keys
-      // so `s3:///key` (default storage) and `s3://key` / DuckDB canonicalize
-      // to the same node id (and a canonical key never starts with `/`) —
-      // otherwise a go/bash fallback consumer's `// on s3:///x` would not
-      // connect to a wasm-inferred `x` producer.
-      const path = kind === "s3object" ? uri[2].replace(/^\/+/, "") : uri[2];
-      out.triggers!.push({ kind: "asset", asset_kind: kind, path });
+      // The suffix is kept verbatim (mirrors Rust `parse_asset_syntax`): an S3
+      // path encodes the storage, with a leading `/` for the workspace default
+      // (`s3:///key` → `/key`) vs `s3://secondary/key` → `secondary/key`.
+      out.triggers!.push({ kind: "asset", asset_kind: kind, path: uri[2] });
     } else if (NATIVE_KINDS.has(firstTok) && rest === firstTok) {
       // A native marker (`// on data_upload`) must stand alone: the canonical
       // parser rejects a marker line with trailing content (`// on data_upload
@@ -393,14 +390,10 @@ export function parseMuteAnnotations(content: string): {
     }
     for (const [prefix, kind] of MUTE_ASSET_PREFIXES) {
       if (arg.startsWith(prefix)) {
-        // S3 canonicalization as in `parse_asset_syntax`: strip every leading
-        // slash so `s3:///key` (default storage) mutes the same node as the
-        // inferred bare `key`.
-        const p =
-          kind === "s3object"
-            ? arg.slice(prefix.length).replace(/^\/+/, "")
-            : arg.slice(prefix.length);
-        muted.add(`${kind}:${p}`);
+        // The suffix is kept verbatim, as in `parse_asset_syntax` — a muted
+        // `s3:///key` (default storage, path `/key`) only matches an inferred
+        // default-storage read of the same object.
+        muted.add(`${kind}:${arg.slice(prefix.length)}`);
         break;
       }
     }
diff --git a/cli/test/pipeline_bounded_cascade_unit.test.ts b/cli/test/pipeline_bounded_cascade_unit.test.ts
index 06781e0c6a..6946ba13eb 100644
--- a/cli/test/pipeline_bounded_cascade_unit.test.ts
+++ b/cli/test/pipeline_bounded_cascade_unit.test.ts
@@ -256,16 +256,14 @@ test("assetUriToNodeId maps s3 → s3object, others verbatim", () => {
   expect(assetUriToNodeId("nope")).toBe(undefined);
 });
 
-test("assetUriToNodeId strips leading slashes from S3 keys (canonical node)", () => {
-  // Mirror of Rust `parse_asset_syntax`: `--to s3:///exports/x` must resolve to
-  // the same canonical node as the graph's `s3object:exports/x`.
-  expect(assetUriToNodeId("s3:///exports/x")).toBe("s3object:exports/x");
-  expect(assetUriToNodeId("s3:///exports/x")).toBe(assetUriToNodeId("s3://exports/x"));
-  // All leading slashes stripped so a canonical key never starts with `/`
-  // (the quad-slash `S3Object(s3="/x")` form collapses to `x`).
-  expect(assetUriToNodeId("s3:////x")).toBe("s3object:x");
+test("assetUriToNodeId keeps the S3 storage distinction (verbatim suffix)", () => {
+  // Mirror of Rust `parse_asset_syntax`: the suffix is kept verbatim, so a
+  // default-storage `--to s3:///exports/x` resolves to `s3object:/exports/x`
+  // while `s3://exports/x` names storage `exports` — a different node.
+  expect(assetUriToNodeId("s3:///exports/x")).toBe("s3object:/exports/x");
+  expect(assetUriToNodeId("s3://exports/x")).toBe("s3object:exports/x");
   // Hive-partition keys and non-S3 kinds are untouched.
-  expect(assetUriToNodeId("s3:///t/y=2024/f.parquet")).toBe("s3object:t/y=2024/f.parquet");
+  expect(assetUriToNodeId("s3:///t/y=2024/f.parquet")).toBe("s3object:/t/y=2024/f.parquet");
 });
 
 test("resolveToken: short name, full path, and asset URI", () => {
diff --git a/cli/test/pipeline_local_graph_unit.test.ts b/cli/test/pipeline_local_graph_unit.test.ts
index 59058bbcf4..7b8b8b0dc5 100644
--- a/cli/test/pipeline_local_graph_unit.test.ts
+++ b/cli/test/pipeline_local_graph_unit.test.ts
@@ -381,18 +381,19 @@ test("derived triggers dedup against explicit `// on` and never self-trigger a m
 
 test("parseMuteAnnotations mirrors the canonical annotation grammar", () => {
   // Any comment prefix regardless of language, header-only scan, complete-word
-  // keyword, s3 leading-slash canonicalization — in lockstep with the Rust
+  // keyword, verbatim s3 paths — in lockstep with the Rust
   // `parse_pipeline_annotations` / frontend parsePipelineAnnotations.ts.
   const all3 = parseMuteAnnotations(
     `// mute ducklake://main/a\n-- mute datatable://main/b\n# mute s3:///lead/slash\nSELECT 1;\n// mute ducklake://main/body\n`,
   );
   expect(all3.muteAll).toBe(false);
-  // all three prefixes accepted; s3 triple-slash canonicalizes to the bare key;
-  // the line PAST the first non-comment line is ignored (header-only)
+  // all three prefixes accepted; the s3 triple-slash default-storage path keeps
+  // its leading slash; the line PAST the first non-comment line is ignored
+  // (header-only)
   expect([...all3.muted].sort()).toEqual([
     "datatable:main/b",
     "ducklake:main/a",
-    "s3object:lead/slash",
+    "s3object:/lead/slash",
   ]);
 
   // `mute` must be a complete word, and prose args are not asset URIs
@@ -478,11 +479,11 @@ test("go/bash fallback: leading-header `// on` only, options stripped, no body p
   );
 });
 
-test("go/bash fallback: `// on s3:///key` canonicalizes to the slashless key", async () => {
-  // Mirror of the Rust/wasm `parse_asset_syntax` S3 strip: a fallback consumer's
-  // triple-slash default-storage trigger must resolve to the bare key `exports/x`
-  // — the same identity a wasm-inferred SDK/DuckDB producer uses — or the local
-  // graph shows a disconnected `/exports/x` node. Explicit storage is untouched.
+test("go/bash fallback: `// on s3:///key` keeps its default-storage leading slash", async () => {
+  // Mirror of the Rust/wasm `parse_asset_syntax`: the suffix is kept verbatim.
+  // A triple-slash default-storage trigger resolves to `/exports/x` — the same
+  // identity a wasm-inferred SDK write of `{ s3: "exports/x" }` uses — while the
+  // bare `s3://exports/x` names storage `exports` (a different object/node).
   await withFolder(
     {
       "triple.go": `// pipeline\n// on s3:///exports/x\npackage inner\nfunc main() {}\n`,
@@ -495,10 +496,8 @@ test("go/bash fallback: `// on s3:///key` canonicalizes to the slashless key", a
         graph.triggers.find(
           (t) => t.trigger_kind === "asset" && t.runnable_path === p
         ) as Extract<(typeof graph.triggers)[number], { trigger_kind: "asset" }> | undefined;
-      // triple-slash and bare both canonicalize to `exports/x` → same node
-      expect(pathFor("f/mypipe/triple")?.asset_path).toBe("exports/x");
+      expect(pathFor("f/mypipe/triple")?.asset_path).toBe("/exports/x");
       expect(pathFor("f/mypipe/bare")?.asset_path).toBe("exports/x");
-      // explicit storage keeps its `storage/key` path (no leading slash to strip)
       expect(pathFor("f/mypipe/storage")?.asset_path).toBe("mybucket/exports/x");
     },
   );
diff --git a/docs/pipeline-local-dev.md b/docs/pipeline-local-dev.md
index 6ee6a59a14..e05acec9f0 100644
--- a/docs/pipeline-local-dev.md
+++ b/docs/pipeline-local-dev.md
@@ -85,21 +85,16 @@ makes the client own the whole cascade so the backend dispatcher never double-fi
 python3, and SQL dialects all get wasm inference (SQL dialects route to `parse_assets_sql`; its
 comment-header annotation scan is dialect-independent). `go`/`bash` have no wasm asset parser, so
 they fall back to a minimal `// pipeline` + `// on` scan (annotation-only). Inferred asset paths
-must match to connect nodes, and all S3 URI forms canonicalize to one key: `parse_asset_syntax`
-(shared by the native and wasm parsers) strips leading slashes from S3 paths, so the SDK
-object forms — TS `writeS3File({s3:"x"})` and python `write_s3_file(S3Object(s3="x"))`, which
-resolve to `s3:///x` (empty default storage) — the triple-slash annotation `// on s3:///x`, DuckDB
-`read_csv('s3://x')` / `COPY ... TO 's3://x'`, and `// on s3://x` all yield path `x`. A TS/Python
-writer and a DuckDB reader of the same object therefore connect regardless of which URI form each
-side uses. (Only leading slashes are stripped — so a canonical key never starts with `/`, which
-keeps the identity stable through `// on` trigger-ref reconstruction — while Hive-partition keys
-like `s3://bucket/y=2024/f.parquet` and the explicit-storage form `s3://storage/key` keep their
-`bucket/…` / `storage/key` paths.) Tradeoff of collapsing to one canonical key: the explicit-storage
-form `s3://storage/key` and the default-storage nested-key form `s3:///storage/key` now alias to
-the same node `storage/key`, even though they name different objects (a bucket `storage` vs. an
-object under the `storage/` prefix in default storage). This only collides when a storage config is
-named to match a default-storage prefix — unlikely, and acceptable for a best-effort lineage graph
-that already doesn't split the first segment as a storage name.
+must match **exactly** to connect nodes. An S3 asset path is `<storage>/<key>` with an empty
+storage segment for the workspace default: `parse_asset_syntax` (shared by the native and wasm
+parsers) keeps the URI suffix verbatim, so the SDK object forms — TS `writeS3File({s3:"x"})` and
+python `write_s3_file(S3Object(s3="x"))`, which resolve to `s3:///x` — the triple-slash annotation
+`// on s3:///x`, and DuckDB `read_csv('s3:///x')` / `COPY ... TO 's3:///x'` all yield path `/x`
+(leading slash significant). The named-storage form `s3://secondary/key` yields `secondary/key` —
+a **different** object and a different node, so the storage distinction is never collapsed. In
+practice: use the triple-slash form everywhere for default-storage objects and the producer and
+consumer connect regardless of language; mixing in the no-slash form (`s3://x`) names a storage
+called `x` and will not connect to a default-storage write.
 
 ## How to test
 
@@ -159,12 +154,12 @@ http://localhost:3000/pipeline_dev?workspace=<WS>&wm_token=<TOK>&folder=demo_pip
    `startProxyServer` for embedders that need a localhost origin (e.g. Claude Code preview).
 5. **`pipeline dev` editing**: the dev page is view+run only (editing stays in the user's editor).
    If in-browser editing with file round-trip is wanted, mirror flow-dev's `handleFlowRoundTrip`.
-6. **Asset-path normalization**: done — the python parser resolves the
+6. **Asset-path normalization**: the python parser resolves the
    `S3Object(s3=…, storage=…?)` constructor / dict-literal forms to the same canonical path as the
-   TS `{s3, storage}` object form, and `parse_asset_syntax` now strips leading slashes from
-   S3 keys so the SDK-form `s3:///x` (`/x`) and the bare-URI no-slash form (`x`, DuckDB and
-   `// on s3://x`) canonicalize to one key (see Language coverage). SDK writes and DuckDB reads of
-   the same object connect regardless of URI convention.
+   TS `{s3, storage}` object form, so SDK writes and reads connect across ts/python. The
+   SDK-form path keeps its default-storage leading slash (`/x`), matching the triple-slash URI
+   forms (`s3:///x` in DuckDB and `// on s3:///x`); the no-slash `s3://x` form names a storage
+   called `x` and is intentionally a distinct node (see Language coverage).
 
 ## Plan reference
 
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 61d94a137a..daf5e8f6b8 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -81,7 +81,7 @@
 				"vscode-languageclient": "~9.0.1",
 				"vscode-uri": "~3.1.0",
 				"vscode-ws-jsonrpc": "~3.5.0",
-				"windmill-parser-wasm-asset": "1.749.0",
+				"windmill-parser-wasm-asset": "1.753.0",
 				"windmill-parser-wasm-csharp": "1.510.1",
 				"windmill-parser-wasm-go": "1.761.0",
 				"windmill-parser-wasm-java": "1.510.1",
@@ -14283,9 +14283,9 @@
 			}
 		},
 		"node_modules/windmill-parser-wasm-asset": {
-			"version": "1.749.0",
-			"resolved": "https://registry.npmjs.org/windmill-parser-wasm-asset/-/windmill-parser-wasm-asset-1.749.0.tgz",
-			"integrity": "sha512-gj8g9sWQ0tXKfXso7xJxR56sS8Loe/RsnFy+0af5R8siZeCag9ikquGbQ8d8kOqIK2U8eCNA0LqsU/xAFDJIOg=="
+			"version": "1.753.0",
+			"resolved": "https://registry.npmjs.org/windmill-parser-wasm-asset/-/windmill-parser-wasm-asset-1.753.0.tgz",
+			"integrity": "sha512-zpJhjvcU8EWRoOJzas/nRGKjGdQnvzeB9GOxP+Mdmnk8BFk3uehsmHS2Krxyjo36fUrCHqobbnffEqf0g3LIGg=="
 		},
 		"node_modules/windmill-parser-wasm-csharp": {
 			"version": "1.510.1",
diff --git a/frontend/package.json b/frontend/package.json
index 0486cb503f..dec46b6f2d 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -156,7 +156,7 @@
 		"vscode-languageclient": "~9.0.1",
 		"vscode-uri": "~3.1.0",
 		"vscode-ws-jsonrpc": "~3.5.0",
-		"windmill-parser-wasm-asset": "1.749.0",
+		"windmill-parser-wasm-asset": "1.753.0",
 		"windmill-parser-wasm-csharp": "1.510.1",
 		"windmill-parser-wasm-go": "1.761.0",
 		"windmill-parser-wasm-java": "1.510.1",
@@ -628,4 +628,4 @@
 		"@rollup/rollup-linux-x64-gnu": "^4.35.0",
 		"fsevents": "^2.3.3"
 	}
-}
+}
\ No newline at end of file
diff --git a/frontend/src/lib/components/assets/AssetGraph/boundedCascade.test.ts b/frontend/src/lib/components/assets/AssetGraph/boundedCascade.test.ts
index e4692de6b8..89c9f24708 100644
--- a/frontend/src/lib/components/assets/AssetGraph/boundedCascade.test.ts
+++ b/frontend/src/lib/components/assets/AssetGraph/boundedCascade.test.ts
@@ -509,15 +509,13 @@ describe('assetUriToNodeId', () => {
 		expect(assetUriToNodeId('ducklake://lake/t')).toBe('ducklake:lake/t')
 		expect(assetUriToNodeId('not-a-uri')).toBeUndefined()
 	})
-	it('strips leading slashes from S3 keys so s3:/// and s3:// share a node', () => {
-		// Mirror of Rust `parse_asset_syntax`: `--to s3:///exports/x` must resolve
-		// to the same canonical node as the graph's `s3object:exports/x`.
-		expect(assetUriToNodeId('s3:///exports/x')).toBe('s3object:exports/x')
-		expect(assetUriToNodeId('s3:///exports/x')).toBe(assetUriToNodeId('s3://exports/x'))
-		// All leading slashes are stripped so a canonical key never starts with
-		// `/` (the quad-slash `S3Object(s3="/x")` form collapses to `x`).
-		expect(assetUriToNodeId('s3:////x')).toBe('s3object:x')
+	it('keeps the S3 storage distinction (verbatim suffix)', () => {
+		// Mirror of Rust `parse_asset_syntax`: the suffix is kept verbatim, so a
+		// default-storage `s3:///exports/x` resolves to `s3object:/exports/x`
+		// while `s3://exports/x` names storage `exports` — a different node.
+		expect(assetUriToNodeId('s3:///exports/x')).toBe('s3object:/exports/x')
+		expect(assetUriToNodeId('s3://exports/x')).toBe('s3object:exports/x')
 		// Hive-partition keys and non-S3 kinds are untouched.
-		expect(assetUriToNodeId('s3:///t/y=2024/f.parquet')).toBe('s3object:t/y=2024/f.parquet')
+		expect(assetUriToNodeId('s3:///t/y=2024/f.parquet')).toBe('s3object:/t/y=2024/f.parquet')
 	})
 })
diff --git a/frontend/src/lib/components/assets/AssetGraph/boundedCascade.ts b/frontend/src/lib/components/assets/AssetGraph/boundedCascade.ts
index 810ab36cc1..f3ed9a4f66 100644
--- a/frontend/src/lib/components/assets/AssetGraph/boundedCascade.ts
+++ b/frontend/src/lib/components/assets/AssetGraph/boundedCascade.ts
@@ -38,11 +38,10 @@ export function assetUriToNodeId(uri: string): string | undefined {
 	// `s3` is the URI prefix for the `s3object` asset kind (mirrors the CLI
 	// `assetUri` and the canvas). All other kinds use their name verbatim.
 	const kind = prefix === 's3' ? 's3object' : prefix
-	// Mirror Rust `parse_asset_syntax`: strip all leading slashes from S3 keys so
-	// `s3:///key` (default storage) and `s3://key` resolve to the same node id
-	// and a canonical key never starts with `/`.
-	const path = kind === 's3object' ? m[2].replace(/^\/+/, '') : m[2]
-	return `${kind}:${path}`
+	// The suffix is kept verbatim (mirrors Rust `parse_asset_syntax`): an S3
+	// path encodes the storage, with a leading `/` for the workspace default
+	// (`s3:///key` → `/key`) vs `s3://secondary/key` → `secondary/key`.
+	return `${kind}:${m[2]}`
 }
 
 // Native trigger kinds that fan out *per event*: a single event always flows
diff --git a/frontend/src/lib/components/assets/AssetGraph/parsePipelineAnnotations.ts b/frontend/src/lib/components/assets/AssetGraph/parsePipelineAnnotations.ts
index 34b9ac2eab..5fdbc4c748 100644
--- a/frontend/src/lib/components/assets/AssetGraph/parsePipelineAnnotations.ts
+++ b/frontend/src/lib/components/assets/AssetGraph/parsePipelineAnnotations.ts
@@ -277,18 +277,11 @@ function stripTrailingKvOpts(s: string): string {
 function parseAssetSyntax(s: string): PipelineTriggerAsset | undefined {
 	for (const [prefix, kind] of ASSET_PREFIXES) {
 		if (s.startsWith(prefix)) {
-			let path = s.slice(prefix.length)
-			// Mirror the Rust `parse_asset_syntax` S3 canonicalization: strip all
-			// leading slashes so the SDK object form (`s3:///key`, default
-			// storage) and DuckDB / `// on s3://key` share one asset path, and a
-			// canonical key never starts with `/` (so ref reconstruction
-			// round-trips). Without this the live graph preview would show
-			// disconnected `/key` and `key` nodes. S3-only; leading slashes only,
-			// so Hive-partition keys are untouched.
-			if (kind === 's3object') {
-				path = path.replace(/^\/+/, '')
-			}
-			return { kind, path }
+			// The suffix is kept verbatim, mirroring the Rust `parse_asset_syntax`.
+			// For S3 the path encodes the storage: `s3:///key` yields `/key`
+			// (default storage, leading slash significant) while
+			// `s3://secondary/key` yields `secondary/key` — two different objects.
+			return { kind, path: s.slice(prefix.length) }
 		}
 	}
 	return undefined
diff --git a/frontend/src/lib/components/assets/AssetGraph/pipelineTemplates.test.ts b/frontend/src/lib/components/assets/AssetGraph/pipelineTemplates.test.ts
index 00fdd085ed..08ec089491 100644
--- a/frontend/src/lib/components/assets/AssetGraph/pipelineTemplates.test.ts
+++ b/frontend/src/lib/components/assets/AssetGraph/pipelineTemplates.test.ts
@@ -9,16 +9,15 @@ import {
 // The seeded draft asset (`autoOutputAsset`, stored as `outputAssets` and used
 // by resolveGraph for inactive-draft node identity) must match the asset
 // identity the deploy-time / wasm parser infers from the generated body. The
-// parser canonicalizes any S3 URI by stripping the `s3://` prefix and all
-// leading slashes (see backend `parse_asset_syntax`); if the seed carried a
-// leading slash while the body wrote `s3:///key`, the preview would render a
-// duplicate `/key` node and a phantom post-deploy drift. This pins the two in
-// lockstep so that class of drift can't regress.
+// parser keeps the suffix after `s3://` verbatim (see backend
+// `parse_asset_syntax`), so a default-storage object's path carries a leading
+// slash (`s3:///key` → `/key`). If the seed and the body's write URI disagree,
+// the preview renders a duplicate node and a phantom post-deploy drift. This
+// pins the two in lockstep so that class of drift can't regress.
 
-// Mirror of the parser's S3 canonicalization for a raw `s3://…` URI.
+// Mirror of the parser's S3 path extraction for a raw `s3://…` URI.
 function canonicalS3Key(uri: string): string {
-	const rest = uri.replace(/^s3:\/\//, '')
-	return rest.replace(/^\/+/, '')
+	return uri.replace(/^s3:\/\//, '')
 }
 
 const S3_KINDS: PipelineOutputKind[] = ['s3_parquet', 's3_object']
@@ -32,10 +31,10 @@ describe('pipelineTemplates S3 seed/body parity', () => {
 				expect(output).toBeDefined()
 				const asset = output!
 
-				// The seed must be a canonical slashless key so it matches the
-				// identity the parser infers from the generated body.
+				// The seed must carry the default-storage leading slash so it
+				// matches the identity the parser infers from the generated body.
 				expect(asset.kind).toBe('s3object')
-				expect(asset.path.startsWith('/')).toBe(false)
+				expect(asset.path.startsWith('/')).toBe(true)
 
 				const body = generatePipelineDraft({
 					language,
diff --git a/frontend/src/lib/components/assets/AssetGraph/pipelineTemplates.ts b/frontend/src/lib/components/assets/AssetGraph/pipelineTemplates.ts
index bf0c14d16e..1e26f2bb31 100644
--- a/frontend/src/lib/components/assets/AssetGraph/pipelineTemplates.ts
+++ b/frontend/src/lib/components/assets/AssetGraph/pipelineTemplates.ts
@@ -175,16 +175,16 @@ export function autoOutputAsset(
 		case 'ducklake':
 		case 'materialize':
 			return { kind: 'ducklake', path: `main/${adj}_${pick(TABLE_NOUNS)}_${slug}` }
-		// s3 outputs use the canonical slashless key. `parse_asset_syntax`
-		// normalizes `s3:///<key>` (default storage) and `s3://<key>` to the
-		// bare `<key>`, so the seeded draft asset must be slashless to match the
-		// deploy-time inferred identity — otherwise the post-deploy drift check
-		// would flag the output as a phantom `/`-prefixed node. The generated
-		// bodies still emit the `s3:///<key>` default-storage URI for runtime I/O.
+		// s3 paths carry the canonical leading slash of a default-storage
+		// object (`s3:///<key>` parses to path `/<key>`). The deploy-time
+		// parser stores writes in that form — a slashless seeded path would
+		// never match it, and the post-deploy drift check would report the
+		// output as lost (it isn't; the key differs by one '/'). Bodies emit
+		// the path verbatim after `s3://`, so the slash round-trips.
 		case 's3_parquet':
 			return {
 				kind: 's3object',
-				path: `pipelines/${folder}/${adj}_${pick(DATASET_NOUNS)}_${slug}.parquet`
+				path: `/pipelines/${folder}/${adj}_${pick(DATASET_NOUNS)}_${slug}.parquet`
 			}
 		case 's3_object': {
 			// duckdb's natural output for a generic blob is CSV (one COPY TO
@@ -194,7 +194,7 @@ export function autoOutputAsset(
 			const ext = language === 'duckdb' ? 'csv' : 'json'
 			return {
 				kind: 's3object',
-				path: `pipelines/${folder}/${adj}_${pick(FILE_NOUNS)}_${slug}.${ext}`
+				path: `/pipelines/${folder}/${adj}_${pick(FILE_NOUNS)}_${slug}.${ext}`
 			}
 		}
 		// A macro library produces no asset — its "output" is the registry
@@ -222,13 +222,6 @@ export function assetUri(asset: { kind: AssetKind; path: string }): string {
 	return `${ASSET_URI_PREFIX[asset.kind]}${asset.path}`
 }
 
-// Bare object key for the SDK's `{ s3: <key> }` / `s3:///<key>` forms. Asset
-// paths are already canonical slashless keys; strip stray leading slashes
-// defensively so the emitted key never starts with '/'.
-function s3Key(path: string): string {
-	return path.replace(/^\/+/, '')
-}
-
 // Splits a datatable asset path (`<db>/<table>` or `<db>/<schema>.<table>`)
 // into its constituent parts. The `<schema>.<table>` grammar is owned by
 // `parseDbInputFromAssetSyntax` in $lib/utils.ts (which consumes a full
@@ -438,11 +431,12 @@ function bodyTs(ctx: TemplateContext): string {
 		if (!input) return ''
 		switch (input.kind) {
 			case 's3object':
-				// `s3:///<key>` URI — one spelling shared with the `// on
-				// s3:///…` annotation form (the object literal `{ s3: <key> }`
-				// is equivalent).
+				// `input.path` encodes storage as `<storage>/<key>` (an empty
+				// storage segment — leading slash — is the workspace default).
+				// Emit it verbatim after `s3://` so a named-storage input keeps
+				// its storage; stripping the slash reads the default-storage key.
 				return [
-					`  const buf = await wmill.loadS3File(${JSON.stringify(`s3:///${s3Key(input.path)}`)})`,
+					`  const buf = await wmill.loadS3File(${JSON.stringify(`s3://${input.path}`)})`,
 					`  const rows = JSON.parse(new TextDecoder().decode(buf))`,
 					``
 				].join('\n')
@@ -468,10 +462,10 @@ function bodyTs(ctx: TemplateContext): string {
 		switch (outputKind) {
 			case 's3_parquet':
 			case 's3_object':
-				// `s3:///<key>` URI — see the loadS3File note above.
+				// `s3://<storage>/<key>` URI — see the loadS3File note above.
 				return [
 					`  const payload = new TextEncoder().encode(JSON.stringify(rows))`,
-					`  await wmill.writeS3File(${JSON.stringify(`s3:///${s3Key(output.path)}`)}, payload)`
+					`  await wmill.writeS3File(${JSON.stringify(`s3://${output.path}`)}, payload)`
 				].join('\n')
 			case 'datatable': {
 				const dbName = output.path.split('/')[0] ?? 'main'
@@ -525,11 +519,12 @@ function bodyPython(ctx: TemplateContext): string {
 		if (!input) return ''
 		switch (input.kind) {
 			case 's3object':
-				// `s3:///<key>` URI — SDK string params must be s3:// URIs
-				// (bare keys are rejected), and this form matches the
-				// `# on s3:///…` annotation spelling.
+				// SDK string params must be s3:// URIs (bare keys are rejected).
+				// `input.path` encodes storage as `<storage>/<key>` (empty storage
+				// segment — leading slash — is the workspace default), so emit it
+				// verbatim after `s3://` to preserve a named-storage input.
 				return [
-					`    buf = wmill.load_s3_file(${JSON.stringify(`s3:///${s3Key(input.path)}`)})`,
+					`    buf = wmill.load_s3_file(${JSON.stringify(`s3://${input.path}`)})`,
 					`    import json; rows = json.loads(buf.decode("utf-8"))`
 				].join('\n')
 			case 'datatable':
@@ -552,10 +547,10 @@ function bodyPython(ctx: TemplateContext): string {
 		switch (outputKind) {
 			case 's3_parquet':
 			case 's3_object':
-				// `s3:///<key>` URI — see the load_s3_file note above.
+				// `s3://<storage>/<key>` URI — see the load_s3_file note above.
 				return [
 					`    import json`,
-					`    wmill.write_s3_file(${JSON.stringify(`s3:///${s3Key(output.path)}`)}, json.dumps(rows).encode("utf-8"))`
+					`    wmill.write_s3_file(${JSON.stringify(`s3://${output.path}`)}, json.dumps(rows).encode("utf-8"))`
 				].join('\n')
 			case 'datatable': {
 				const dbName = output.path.split('/')[0] ?? 'main'
@@ -647,7 +642,7 @@ function bodyDuckdb(ctx: TemplateContext): string {
 		if (!input) return null
 		switch (input.kind) {
 			case 's3object':
-				return `read_parquet('s3:///${input.path}')`
+				return `read_parquet('s3://${input.path}')`
 			case 'datatable':
 				// `pg` is the attached Postgres catalog (see ATTACH above).
 				// Use a 2-part `pg.<table>` ref so the asset parser maps it
@@ -670,7 +665,7 @@ function bodyDuckdb(ctx: TemplateContext): string {
 					`COPY (`,
 					`  SELECT *`,
 					`  FROM ${fromExpr}`,
-					`) TO 's3:///${output.path}' (FORMAT 'parquet');`
+					`) TO 's3://${output.path}' (FORMAT 'parquet');`
 				)
 			}
 			break
@@ -681,7 +676,7 @@ function bodyDuckdb(ctx: TemplateContext): string {
 					`COPY (`,
 					`  SELECT *`,
 					`  FROM ${fromExpr}`,
-					`) TO 's3:///${output.path}' (FORMAT 'csv', HEADER);`
+					`) TO 's3://${output.path}' (FORMAT 'csv', HEADER);`
 				)
 			}
 			break

From 555c751016fea4087be09fa2520af331cc872bfc Mon Sep 17 00:00:00 2001
From: Diego Imbert <70353967+diegoimbert@users.noreply.github.com>
Date: Tue, 21 Jul 2026 19:03:42 +0200
Subject: [PATCH 095/171] fix(db): repair s3 asset paths missing
 default-storage leading slash (#10243)

* fix(db): repair s3 asset paths missing default-storage leading slash

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01An2pTqSmqJd2XwnagvX4kM

* fix(db): also repair script_trigger refs + exclude _default_ storage alias

Extend the s3 leading-slash repair beyond the asset table:

- script_trigger.trigger_ref (pipeline cascade edges, stored as s3://<path>)
  suffered the identical corruption: a window-era default-storage edge was
  recorded as s3://exports/x instead of s3:///exports/x, so it no longer
  matches the producer's post-fix write ref at dispatch (asset_dispatch does
  an exact trigger_ref = match with no DISTINCT), silently breaking the edge.
  Repaired with the same storage-name heuristic, with a dedup DELETE to avoid
  double-dispatch.

- Exclude the reserved _default_ alias from the storage-name set. The runtime
  treats s3://_default_/key as the primary storage (fork_storage_ref), so
  _default_/key is a valid explicit-default ref; prepending a slash would
  corrupt it. Applies to both asset and script_trigger via the shared cache.

join_pending_inputs (transient AND-join state) and materialized_asset_schema
(ducklake-only) are intentionally left alone; documented inline.

Verified end-to-end on a fresh DB: seed prior-state rows as the pre-fix parser
would have persisted them for data pipelines and scripts, run the full
migration suite, assert every row matches the fixed-parser identity (default
repair, hive/root/nested keys, named-storage + _default_ untouched, pre-cutoff
untouched, non-s3 untouched, duplicate collapse) across both tables.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
---
 ...asset_paths_missing_leading_slash.down.sql |   3 +
 ...3_asset_paths_missing_leading_slash.up.sql | 144 ++++++++++++++++++
 2 files changed, 147 insertions(+)
 create mode 100644 backend/migrations/20260721154835_fix_s3_asset_paths_missing_leading_slash.down.sql
 create mode 100644 backend/migrations/20260721154835_fix_s3_asset_paths_missing_leading_slash.up.sql

diff --git a/backend/migrations/20260721154835_fix_s3_asset_paths_missing_leading_slash.down.sql b/backend/migrations/20260721154835_fix_s3_asset_paths_missing_leading_slash.down.sql
new file mode 100644
index 0000000000..9cf6c8c064
--- /dev/null
+++ b/backend/migrations/20260721154835_fix_s3_asset_paths_missing_leading_slash.down.sql
@@ -0,0 +1,3 @@
+-- Irreversible data repair: once the leading slash is restored, the rows are
+-- indistinguishable from paths that always had it. Intentionally a no-op.
+SELECT 1;
diff --git a/backend/migrations/20260721154835_fix_s3_asset_paths_missing_leading_slash.up.sql b/backend/migrations/20260721154835_fix_s3_asset_paths_missing_leading_slash.up.sql
new file mode 100644
index 0000000000..cbf0382fcc
--- /dev/null
+++ b/backend/migrations/20260721154835_fix_s3_asset_paths_missing_leading_slash.up.sql
@@ -0,0 +1,144 @@
+-- Repair s3object asset paths recorded without their default-storage leading
+-- slash. An S3 asset path is `<storage>/<key>` with an empty storage segment
+-- (leading slash) for the workspace default: `s3:///exports/x` -> `/exports/x`.
+-- Between 2026-07-06 (#9939) and the parser fix, the asset parser stripped
+-- leading slashes, so default-storage assets were recorded as `exports/x` —
+-- indistinguishable from a secondary storage named `exports`. For rows created
+-- in that window (cutoff one day early for safety), a slashless path whose
+-- first segment is NOT a storage name — neither a configured secondary storage
+-- nor the reserved `_default_` alias — can only be a default-storage key, so it
+-- gets its slash back. Rows already starting with `/` are always correct.
+--
+-- Best-effort by nature: the corruption itself conflated a stripped default key
+-- with a named ref, so identity is inferred from the storage config AS IT IS NOW.
+-- A named ref to a storage that was since removed/renamed (or never configured)
+-- is the one residual false-positive — it would be repaired as if default. The
+-- `created_at` window bounds this for `asset`; `script_trigger` has no timestamp
+-- and relies on the storage-name heuristic alone. Both are acceptable given how
+-- rare mid-window storage churn is versus the common default-key case this fixes.
+--
+-- Same corruption hit `script_trigger.trigger_ref` (the pipeline cascade edges,
+-- stored as `s3://<path>`): a default-storage edge recorded as `s3://exports/x`
+-- instead of `s3:///exports/x` no longer matches the producer's post-fix write
+-- ref at dispatch (asset_dispatch rebuilds `s3://` + the repaired asset path and
+-- does an exact `trigger_ref =` match), silently breaking the edge. Repaired with
+-- the same storage-name heuristic — script_trigger has no created_at, but a
+-- correct default ref is always `s3:///…` and a correct named ref always leads
+-- with a real storage name, so a `s3://<seg>/…` ref whose seg isn't a storage is
+-- unambiguously a slash-stripped default-storage ref.
+--
+-- `join_pending_inputs.trigger_ref` (the AND-join barrier) is deliberately NOT
+-- repaired: it is transient slot state cleared on fire, so a window-era `s3://…`
+-- slot is superseded once inputs re-arrive under the corrected ref (and deleting
+-- live slots could drop an in-flight accumulation). materialized_asset_schema is
+-- unaffected — it only ever holds ducklake asset_kind, never s3object.
+--
+-- Data-repair only: wrapped so a failure NOTICEs and never blocks the release.
+DO $migration$
+BEGIN
+    CREATE TEMP TABLE __asset_slash_fix_cache (
+        workspace_id TEXT PRIMARY KEY,
+        names TEXT[] NOT NULL
+    ) ON COMMIT DROP;
+
+    -- Reserved first-path-segments that denote a real storage (so a slashless
+    -- path leading with one is a genuine named ref, NOT a slash-stripped default
+    -- key): the workspace's secondary_storage names PLUS `_default_`, the alias
+    -- the runtime treats as the primary storage (workspaces.rs fork_storage_ref).
+    -- `s3://_default_/key` is a valid explicit-default ref recorded verbatim as
+    -- `_default_/key`; prepending a slash would corrupt it to key `_default_/key`.
+    -- The JSON is parsed at most once per workspace (candidate assets can repeat
+    -- a workspace millions of times via job usages), and only workspaces that
+    -- actually have candidate rows are ever fetched.
+    CREATE FUNCTION pg_temp.__asset_slash_fix_storages(ws TEXT) RETURNS TEXT[] AS $fn$
+    DECLARE
+        result TEXT[];
+    BEGIN
+        SELECT c.names INTO result FROM __asset_slash_fix_cache c WHERE c.workspace_id = ws;
+        IF FOUND THEN
+            RETURN result;
+        END IF;
+        SELECT ARRAY['_default_'] || COALESCE(array_agg(k), '{}') INTO result
+        FROM workspace_settings s
+        CROSS JOIN LATERAL jsonb_object_keys(
+            CASE WHEN jsonb_typeof(s.large_file_storage -> 'secondary_storage') = 'object'
+                 THEN s.large_file_storage -> 'secondary_storage'
+                 ELSE '{}'::JSONB END
+        ) k
+        WHERE s.workspace_id = ws;
+        result := COALESCE(result, ARRAY['_default_']);
+        INSERT INTO __asset_slash_fix_cache VALUES (ws, result);
+        RETURN result;
+    END
+    $fn$ LANGUAGE plpgsql;
+
+    -- Duplicates first: when the corrected `/path` row already exists for the
+    -- same usage (recorded before the regression, or re-recorded after the
+    -- parser fix), prepending the slash would violate the primary key
+    -- (workspace_id, path, kind, usage_path, usage_kind) — drop the slashless
+    -- duplicate instead.
+    DELETE FROM asset a
+    WHERE a.kind = 's3object'
+      AND a.created_at > '2026-07-05 00:00:00+00'::TIMESTAMPTZ
+      AND a.path NOT LIKE '/%'
+      AND a.path <> ''
+      AND length(a.path) < 255
+      AND split_part(a.path, '/', 1) <> ALL (pg_temp.__asset_slash_fix_storages(a.workspace_id))
+      AND EXISTS (
+          SELECT 1 FROM asset b
+          WHERE b.workspace_id = a.workspace_id
+            AND b.path = '/' || a.path
+            AND b.kind = a.kind
+            AND b.usage_path = a.usage_path
+            AND b.usage_kind = a.usage_kind
+      );
+
+    -- length < 255 keeps the prepend within the VARCHAR(255) column; a 255-char
+    -- slashless path cannot be repaired and is left as-is rather than erroring.
+    UPDATE asset a
+    SET path = '/' || a.path
+    WHERE a.kind = 's3object'
+      AND a.created_at > '2026-07-05 00:00:00+00'::TIMESTAMPTZ
+      AND a.path NOT LIKE '/%'
+      AND a.path <> ''
+      AND length(a.path) < 255
+      AND split_part(a.path, '/', 1) <> ALL (pg_temp.__asset_slash_fix_storages(a.workspace_id));
+
+    -- script_trigger.trigger_ref for asset edges is `s3://<path>`. A corrupted
+    -- default-storage edge reads `s3://<seg>/…` (exactly two slashes); a correct
+    -- default ref is `s3:///…` and is excluded by the NOT LIKE. `substring(from 6)`
+    -- is the `<path>` after the `s3://` prefix. Delete a slashless edge whose
+    -- corrected twin already exists for the same runnable (fetch_subscribers has
+    -- no DISTINCT, so a duplicate would double-dispatch the subscriber).
+    DELETE FROM script_trigger a
+    WHERE a.trigger_kind = 'asset'
+      AND a.trigger_ref LIKE 's3://%'
+      AND a.trigger_ref NOT LIKE 's3:///%'
+      AND substring(a.trigger_ref FROM 6) <> ''
+      AND split_part(substring(a.trigger_ref FROM 6), '/', 1)
+          <> ALL (pg_temp.__asset_slash_fix_storages(a.workspace_id))
+      AND EXISTS (
+          SELECT 1 FROM script_trigger b
+          WHERE b.workspace_id = a.workspace_id
+            AND b.runnable_kind = a.runnable_kind
+            AND b.runnable_path = a.runnable_path
+            AND b.trigger_kind = a.trigger_kind
+            AND b.trigger_ref = 's3:///' || substring(a.trigger_ref FROM 6)
+      );
+
+    UPDATE script_trigger a
+    SET trigger_ref = 's3:///' || substring(a.trigger_ref FROM 6)
+    WHERE a.trigger_kind = 'asset'
+      AND a.trigger_ref LIKE 's3://%'
+      AND a.trigger_ref NOT LIKE 's3:///%'
+      AND substring(a.trigger_ref FROM 6) <> ''
+      AND split_part(substring(a.trigger_ref FROM 6), '/', 1)
+          <> ALL (pg_temp.__asset_slash_fix_storages(a.workspace_id));
+
+    -- The temp table is ON COMMIT DROP; drop the function too so nothing
+    -- lingers on a pooled connection.
+    DROP FUNCTION pg_temp.__asset_slash_fix_storages(TEXT);
+EXCEPTION WHEN OTHERS THEN
+    RAISE NOTICE 'skipping s3 asset leading-slash repair: %', SQLERRM;
+END
+$migration$;

From 4a898247a21ae918fa952a993fbe407ebc49e404 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Tue, 21 Jul 2026 19:04:01 +0200
Subject: [PATCH 096/171] fix(apps): let entitled viewers read pre-existing S3
 files from deployed apps (#10245)

* fix(apps): let entitled viewers read pre-existing S3 files from deployed apps

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(apps): confine S3 viewer fallback to full unscoped sessions

A scope-restricted token (e.g. apps:read:<app>, or an app-embed token) is
allowed on apps_u/* but rejected by the route-scope middleware on job_helpers/*,
so granting it the viewer fallback would be a new capability it cannot obtain
directly. Gate the fallback on scopes.is_none() so only full sessions (which can
already read via job_helpers) delegate; scoped and anonymous callers stay gated.
Add a scoped-token isolation assertion.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(apps): treat filter-tags-only tokens as unscoped for S3 viewer fallback

The scopes.is_none() guard wrongly denied the viewer fallback to tokens that are
effectively unscoped (empty scope arrays and if_jobs:filter_tags:-only tokens),
which the route-scope middleware treats as unrestricted and which can therefore
read the same file via job_helpers directly. Reuse that semantics via a shared
is_effectively_unscoped helper so the relaxation covers exactly the tokens that
gain no new capability, while genuinely scoped tokens stay gated.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 backend/tests/app_s3_onbehalf.rs     | 310 +++++++++++++++++----------
 backend/windmill-api-auth/src/lib.rs |   9 +
 backend/windmill-api/src/apps.rs     | 125 +++++++----
 3 files changed, 287 insertions(+), 157 deletions(-)

diff --git a/backend/tests/app_s3_onbehalf.rs b/backend/tests/app_s3_onbehalf.rs
index 9dd96e30f1..7b233b505d 100644
--- a/backend/tests/app_s3_onbehalf.rs
+++ b/backend/tests/app_s3_onbehalf.rs
@@ -1,7 +1,9 @@
-//! Deployed-app S3 reads authorize on-behalf of the app author and are confined
-//! to app provenance (declared keys or recent job outputs): a viewer cannot read
-//! an arbitrary `file_key` as the author. Requires the `parquet` feature — the
-//! real `apps_u/*` S3 handlers are gated on it.
+//! Deployed-app S3 reads authorize on-behalf of the app author and are confined to
+//! app provenance (declared keys or recent job outputs): an anonymous viewer cannot
+//! read an arbitrary `file_key` as the author. A viewer on a full (unscoped) session
+//! instead falls back to reading as THEMSELVES (bounded by their own S3 perms), so the
+//! gate is exercised here through the anonymous identity it still fully protects.
+//! Requires the `parquet` feature — the real `apps_u/*` S3 handlers are gated on it.
 //!
 //! `base` fixture: test-user (admin, SECRET_TOKEN); test-user-2 (non-admin,
 //! SECRET_TOKEN_2, no S3 folder permission).
@@ -21,6 +23,19 @@ fn client() -> reqwest::Client {
     reqwest::Client::new()
 }
 
+/// Mint an API token for test-user (admin) restricted to `scopes`.
+async fn mint_scoped_token(port: u16, scopes: Vec<&str>) -> anyhow::Result<String> {
+    let resp = authed(
+        client().post(format!("http://localhost:{port}/api/users/tokens/create")),
+        ADMIN_TOKEN,
+    )
+    .json(&json!({ "label": "scoped", "scopes": scopes, "workspace_id": "test-workspace" }))
+    .send()
+    .await?;
+    assert_eq!(resp.status(), 201, "mint scoped token");
+    Ok(resp.text().await?)
+}
+
 fn authed(builder: reqwest::RequestBuilder, token: &str) -> reqwest::RequestBuilder {
     builder.header("Authorization", format!("Bearer {}", token))
 }
@@ -50,62 +65,54 @@ async fn test_deployed_app_s3_onbehalf_provenance(db: Pool<Postgres>) -> anyhow:
         .await?;
     assert_eq!(resp.status(), 201, "app create: {}", resp.text().await?);
 
-    // GET an app-scoped S3 route as `token`. No workspace storage is configured,
-    // so a request that clears the provenance gate fails later at the storage
-    // lookup (or the CE OSS stub), never with "File restricted" — which is what
-    // lets these assertions distinguish "gate passed" from "gate denied".
-    let get = |route: &str, token: &'static str| {
+    // GET an app-scoped S3 route ANONYMOUSLY. Anonymous callers have no viewer
+    // identity to fall back to, so the provenance gate still fully applies to them
+    // (unlike logged-in viewers, who now read as themselves — see the union test).
+    // No workspace storage is configured, so a request that clears the gate fails
+    // later at the storage lookup (or the CE OSS stub), never with the denial
+    // message — which is what lets these assertions distinguish pass from deny.
+    let get = |route: &str| {
         let url = format!("{ws}/apps_u/{route}");
-        authed(client().get(url), token).send()
+        client().get(url).send()
     };
-    let denied = |body: &str| body.contains("File restricted");
+    let denied = |body: &str| body.contains("is not accessible from this app");
 
-    // download_s3_file: author-on-behalf allowed for the declared key, denied for
-    // a key the app never declared (the confused-deputy guard).
-    let body = get(&format!("download_s3_file/{APP}?s3={DECLARED}"), USER_TOKEN)
+    // download_s3_file: allowed for the declared key, denied for a key the app never
+    // declared (the confused-deputy guard).
+    let body = get(&format!("download_s3_file/{APP}?s3={DECLARED}"))
         .await?
         .text()
         .await?;
     assert!(!denied(&body), "declared key must clear the gate: {body}");
-    let body = get(
-        &format!("download_s3_file/{APP}?s3={NON_PROVENANCE}"),
-        USER_TOKEN,
-    )
-    .await?
-    .text()
-    .await?;
+    let body = get(&format!("download_s3_file/{APP}?s3={NON_PROVENANCE}"))
+        .await?
+        .text()
+        .await?;
     assert!(denied(&body), "non-provenance key must be denied: {body}");
 
     // load_table_count and load_csv_preview enforce the same gate. The preview's
     // numeric `limit`/`offset` must deserialize (regression: a flattened query
     // struct 400s on them under serde_urlencoded).
-    let body = get(
-        &format!("load_table_count/{APP}?file_key={DECLARED}"),
-        USER_TOKEN,
-    )
-    .await?
-    .text()
-    .await?;
+    let body = get(&format!("load_table_count/{APP}?file_key={DECLARED}"))
+        .await?
+        .text()
+        .await?;
     assert!(
         !denied(&body),
         "table_count declared key must clear the gate: {body}"
     );
-    let body = get(
-        &format!("load_table_count/{APP}?file_key={NON_PROVENANCE}"),
-        USER_TOKEN,
-    )
-    .await?
-    .text()
-    .await?;
+    let body = get(&format!("load_table_count/{APP}?file_key={NON_PROVENANCE}"))
+        .await?
+        .text()
+        .await?;
     assert!(
         denied(&body),
         "table_count non-provenance key must be denied: {body}"
     );
 
-    let resp = get(
-        &format!("load_csv_preview/{APP}?file_key={DECLARED}&limit=5&offset=0"),
-        USER_TOKEN,
-    )
+    let resp = get(&format!(
+        "load_csv_preview/{APP}?file_key={DECLARED}&limit=5&offset=0"
+    ))
     .await?;
     let status = resp.status();
     let body = resp.text().await?;
@@ -116,23 +123,16 @@ async fn test_deployed_app_s3_onbehalf_provenance(db: Pool<Postgres>) -> anyhow:
     );
 
     // load_file_preview: `read_bytes_from` / `read_bytes_length` are required.
-    let resp = get(
-        &format!("load_file_preview/{APP}?file_key={DECLARED}"),
-        USER_TOKEN,
-    )
-    .await?;
+    let resp = get(&format!("load_file_preview/{APP}?file_key={DECLARED}")).await?;
     assert_eq!(
         resp.status(),
         400,
         "file_preview without byte range must 400: {}",
         resp.text().await?
     );
-    let body = get(
-        &format!(
-            "load_file_preview/{APP}?file_key={DECLARED}&read_bytes_from=0&read_bytes_length=4096"
-        ),
-        USER_TOKEN,
-    )
+    let body = get(&format!(
+        "load_file_preview/{APP}?file_key={DECLARED}&read_bytes_from=0&read_bytes_length=4096"
+    ))
     .await?
     .text()
     .await?;
@@ -144,6 +144,94 @@ async fn test_deployed_app_s3_onbehalf_provenance(db: Pool<Postgres>) -> anyhow:
     Ok(())
 }
 
+/// The viewer-perm union: a viewer on a full (unscoped) session is no longer hard-denied
+/// by the provenance gate for a pre-existing file. It falls back to reading as ITSELF
+/// (bounded by its own S3 perms downstream), while an anonymous caller (no identity) and
+/// a scope-restricted token (can hit `apps_u/*` but not `job_helpers/*`, so the fallback
+/// would be a new capability) both stay fully gated with the actionable denial.
+#[sqlx::test(fixtures("base"))]
+async fn test_deployed_app_s3_viewer_union(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let ws = format!("http://localhost:{port}/api/w/test-workspace");
+
+    let resp = authed(client().post(format!("{ws}/apps/create")), ADMIN_TOKEN)
+        .json(&json!({
+            "path": APP,
+            "summary": "s3 viewer union test",
+            "value": {},
+            "policy": {
+                "execution_mode": "anonymous",
+                "triggerables": {},
+                "allowed_s3_keys": [{ "s3_path": DECLARED }]
+            }
+        }))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 201, "app create: {}", resp.text().await?);
+
+    let url = format!("{ws}/apps_u/download_s3_file/{APP}?s3={NON_PROVENANCE}");
+
+    // Anonymous: still gated. The denial is the actionable message and echoes the key.
+    let body = client().get(&url).send().await?.text().await?;
+    assert!(
+        body.contains("is not accessible from this app"),
+        "anonymous viewer must stay gated with the actionable denial: {body}"
+    );
+    assert!(
+        body.contains(NON_PROVENANCE),
+        "denial must echo the requested key: {body}"
+    );
+
+    // Logged-in viewer: no longer hard-denied — the gate delegates to reading as the
+    // viewer, so the request falls through to the storage read (no gate denial in
+    // EITHER the old or new form). No workspace storage is configured here, so it
+    // surfaces a downstream storage/OSS error, not a gate denial.
+    let body = authed(client().get(&url), USER_TOKEN)
+        .send()
+        .await?
+        .text()
+        .await?;
+    assert!(
+        !body.contains("is not accessible from this app") && !body.contains("File restricted"),
+        "logged-in viewer must delegate to its own read, not be gate-denied: {body}"
+    );
+
+    // Scope-restricted token: an `apps:read:<app>` token reaches this route but is
+    // REJECTED by the route-scope middleware on `job_helpers/*`, so it must NOT get the
+    // viewer fallback (that would be a capability it cannot obtain directly). It stays
+    // gated with the denial, unlike the unscoped session above.
+    let apps_read_scope = format!("apps:read:{APP}");
+    let scoped = mint_scoped_token(port, vec![apps_read_scope.as_str()]).await?;
+    let body = authed(client().get(&url), &scoped)
+        .send()
+        .await?
+        .text()
+        .await?;
+    assert!(
+        body.contains("is not accessible from this app"),
+        "scope-restricted token must stay gated, not get the viewer fallback: {body}"
+    );
+
+    // A filter-tags-only token carries no real scope restriction (the route-scope
+    // middleware treats it as unscoped), so it can read via job_helpers directly and
+    // MUST get the viewer fallback here — not be gated like a genuinely scoped token.
+    let tag_only = mint_scoped_token(port, vec!["if_jobs:filter_tags:default"]).await?;
+    let body = authed(client().get(&url), &tag_only)
+        .send()
+        .await?
+        .text()
+        .await?;
+    assert!(
+        !body.contains("is not accessible from this app") && !body.contains("File restricted"),
+        "filter-tags-only token is effectively unscoped and must delegate, not be gated: {body}"
+    );
+
+    Ok(())
+}
+
 /// Mint a presigned bearer (`exp=..&sig=..`) exactly as `sign_s3_objects` does:
 /// `HMAC-SHA256(workspace_key, "file_key={s3}&exp={exp}")` (no storage param, since
 /// these routes send none). `validate_s3_signature` is `private`-gated, so this test
@@ -198,16 +286,19 @@ async fn test_deployed_app_s3_presigned_bypasses_gate(db: Pool<Postgres>) -> any
         let url = format!("{ws}/apps_u/{route}");
         authed(client().get(url), token).send()
     };
-    let denied = |body: &str| body.contains("File restricted");
+    let denied = |body: &str| body.contains("is not accessible from this app");
 
-    // Control: NON_PROVENANCE without a signature is denied by the gate.
-    let body = get(
-        format!("download_s3_file/{APP}?s3={NON_PROVENANCE}"),
-        USER_TOKEN,
-    )
-    .await?
-    .text()
-    .await?;
+    // Control: NON_PROVENANCE without a signature is denied by the gate. Sent
+    // anonymously — a logged-in viewer would instead fall back to reading as
+    // themselves, so anonymous is the identity that isolates the presigned bypass.
+    let body = client()
+        .get(format!(
+            "{ws}/apps_u/download_s3_file/{APP}?s3={NON_PROVENANCE}"
+        ))
+        .send()
+        .await?
+        .text()
+        .await?;
     assert!(
         denied(&body),
         "unsigned non-provenance key must be denied: {body}"
@@ -304,12 +395,14 @@ async fn seed_completed_job(
 }
 
 /// A deployed app that renders S3 files it produced (e.g. a SQL query persisted to
-/// S3 by a component) must clear the provenance gate for the viewer whose own app
-/// run produced them, while (a) a viewer cannot forge provenance by running a
-/// runnable directly (no app marker), (b) another app's outputs stay denied, and
-/// (c) another viewer's outputs stay denied (cross-viewer isolation). Provenance is
-/// keyed on the app-origination marker (`trigger_kind='app'` + `trigger=<app path>`)
-/// that `execute_component` stamps, plus `created_by = <this caller>` for isolation.
+/// S3 by a component) must clear the provenance gate for the caller whose own app run
+/// produced them, while (a) provenance cannot be forged by running a runnable directly
+/// (no app marker), (b) another app's outputs stay denied, and (c) another caller's
+/// outputs stay denied (per-caller isolation). Provenance is keyed on the
+/// app-origination marker (`trigger_kind='app'` + `trigger=<app path>`) that
+/// `execute_component` stamps, plus `created_by = <this caller>` for isolation.
+/// Exercised anonymously: the gate still fully governs anonymous callers, whereas a
+/// logged-in viewer would instead fall back to reading as themselves.
 #[sqlx::test(fixtures("base"))]
 async fn test_deployed_app_s3_onbehalf_flow_script_provenance(
     db: Pool<Postgres>,
@@ -322,10 +415,10 @@ async fn test_deployed_app_s3_onbehalf_flow_script_provenance(
 
     const FS_APP: &str = "u/test-user/s3flowscript";
     const OTHER_APP: &str = "u/test-user/other_app";
-    // Produced by test-user-2's own app run of THIS app.
-    const USER_KEY: &str = "results/user2_output.parquet";
-    // Produced by test-user's own app run of THIS app.
-    const ADMIN_KEY: &str = "results/admin_output.parquet";
+    // Produced by the anonymous caller's own app run of THIS app.
+    const OWN_KEY: &str = "results/own_output.parquet";
+    // Produced by a DIFFERENT caller's app run of THIS app → isolation, must stay denied.
+    const OTHER_CALLER_KEY: &str = "results/user2_output.parquet";
     // Produced by an app run of a DIFFERENT app → must stay denied.
     const OTHER_APP_KEY: &str = "results/other_app_output.parquet";
     // Produced by a DIRECT run (no app marker) → the forgery attempt, must stay denied.
@@ -342,64 +435,49 @@ async fn test_deployed_app_s3_onbehalf_flow_script_provenance(
         .await?;
     assert_eq!(resp.status(), 201, "app create: {}", resp.text().await?);
 
-    // Seed the produced-file jobs (all within the 3h window).
-    seed_completed_job(&db, "test-user-2", Some(FS_APP), USER_KEY).await?;
-    seed_completed_job(&db, "test-user", Some(FS_APP), ADMIN_KEY).await?;
-    seed_completed_job(&db, "test-user-2", Some(OTHER_APP), OTHER_APP_KEY).await?;
-    seed_completed_job(&db, "test-user-2", None, FORGED_KEY).await?;
+    // Seed the produced-file jobs (all within the 3h window). The gate's `created_by`
+    // filter uses "anonymous" for an unauthenticated caller.
+    seed_completed_job(&db, "anonymous", Some(FS_APP), OWN_KEY).await?;
+    seed_completed_job(&db, "test-user-2", Some(FS_APP), OTHER_CALLER_KEY).await?;
+    seed_completed_job(&db, "anonymous", Some(OTHER_APP), OTHER_APP_KEY).await?;
+    seed_completed_job(&db, "anonymous", None, FORGED_KEY).await?;
 
-    let get = |route: &str, token: &'static str| {
+    let denied = |body: &str| body.contains("is not accessible from this app");
+    // Anonymous GET (borrows `ws`, reusable across calls: the URL is built before the
+    // `async move` so only the owned `url` is moved into the future, not `ws`).
+    let anon_body = |route: String| {
         let url = format!("{ws}/apps_u/{route}");
-        authed(client().get(url), token).send()
-    };
-    let denied = |body: &str| body.contains("File restricted");
-    let body_of = |route: String, token: &'static str| async move {
-        get(&route, token).await.unwrap().text().await.unwrap()
+        async move {
+            client()
+                .get(url)
+                .send()
+                .await
+                .unwrap()
+                .text()
+                .await
+                .unwrap()
+        }
     };
 
-    // The viewer's own app run's output clears the gate (the case that regressed to
-    // "File restricted").
-    let body = body_of(
-        format!("download_s3_file/{FS_APP}?s3={USER_KEY}"),
-        USER_TOKEN,
-    )
-    .await;
+    // The caller's own app run's output clears the gate (the case that regressed to
+    // a hard denial).
+    let body = anon_body(format!("download_s3_file/{FS_APP}?s3={OWN_KEY}")).await;
     assert!(
         !denied(&body),
-        "viewer's own app-produced key must clear the gate: {body}"
+        "caller's own app-produced key must clear the gate: {body}"
     );
 
-    // The admin viewer's own app run's output clears — the gate has no admin bypass,
-    // it just matches the caller's own runs.
-    let body = body_of(
-        format!("download_s3_file/{FS_APP}?s3={ADMIN_KEY}"),
-        ADMIN_TOKEN,
-    )
-    .await;
-    assert!(
-        !denied(&body),
-        "admin's own app-produced key must clear the gate: {body}"
-    );
-
-    // Cross-viewer isolation: the admin cannot pull test-user-2's result even though
-    // it is a genuine app-marked job of the same app (no admin bypass either).
-    let body = body_of(
-        format!("download_s3_file/{FS_APP}?s3={USER_KEY}"),
-        ADMIN_TOKEN,
-    )
-    .await;
+    // Per-caller isolation: another caller's result stays denied even though it is a
+    // genuine app-marked job of the same app.
+    let body = anon_body(format!("download_s3_file/{FS_APP}?s3={OTHER_CALLER_KEY}")).await;
     assert!(
         denied(&body),
-        "another viewer's app-produced key must stay denied (isolation): {body}"
+        "another caller's app-produced key must stay denied (isolation): {body}"
     );
 
     // A key produced by a direct run (no app marker) stays denied — the forgery the
     // app-origination marker closes.
-    let body = body_of(
-        format!("download_s3_file/{FS_APP}?s3={FORGED_KEY}"),
-        USER_TOKEN,
-    )
-    .await;
+    let body = anon_body(format!("download_s3_file/{FS_APP}?s3={FORGED_KEY}")).await;
     assert!(
         denied(&body),
         "key from a direct run (no app marker) must stay denied: {body}"
@@ -407,11 +485,7 @@ async fn test_deployed_app_s3_onbehalf_flow_script_provenance(
 
     // A key produced by a DIFFERENT app stays denied — provenance is scoped to THIS
     // app's path.
-    let body = body_of(
-        format!("download_s3_file/{FS_APP}?s3={OTHER_APP_KEY}"),
-        USER_TOKEN,
-    )
-    .await;
+    let body = anon_body(format!("download_s3_file/{FS_APP}?s3={OTHER_APP_KEY}")).await;
     assert!(
         denied(&body),
         "key produced by a different app must stay denied: {body}"
diff --git a/backend/windmill-api-auth/src/lib.rs b/backend/windmill-api-auth/src/lib.rs
index 961f88d547..8120c16605 100644
--- a/backend/windmill-api-auth/src/lib.rs
+++ b/backend/windmill-api-auth/src/lib.rs
@@ -275,6 +275,15 @@ fn scope_restrictions(scopes: Option<&[String]>) -> Option<Vec<&String>> {
     (!restrictions.is_empty()).then_some(restrictions)
 }
 
+/// True when the token carries no real scope restriction — unscoped, an empty scope
+/// list, or only `if_jobs:filter_tags:` filters — so it holds the full privileges of
+/// its user and can reach any non-job route they are authorized for (mirrors
+/// `check_scopes` / `check_route_access`). A `false` result means the token is
+/// genuinely scope-restricted.
+pub fn is_effectively_unscoped(scopes: Option<&[String]>) -> bool {
+    scope_restrictions(scopes).is_none()
+}
+
 /// Enforce monotonic privilege when a token lifecycle endpoint mints or rescopes
 /// a credential on behalf of `authed`: the resulting credential must never be
 /// more privileged than the caller's own token.
diff --git a/backend/windmill-api/src/apps.rs b/backend/windmill-api/src/apps.rs
index fe10229af3..4e7942b16d 100644
--- a/backend/windmill-api/src/apps.rs
+++ b/backend/windmill-api/src/apps.rs
@@ -3883,6 +3883,18 @@ async fn get_on_behalf_authed_from_app(
     Ok((on_behalf_authed, policy))
 }
 
+/// Which identity a deployed `apps_u/*` S3 read runs as.
+#[cfg(feature = "parquet")]
+enum AppS3ReadIdentity {
+    /// The gate passed: read with the policy's on-behalf identity (the app author in
+    /// author-mode, the viewer in viewer-mode).
+    OnBehalf,
+    /// The gate did not pass but a logged-in, non-embed viewer is present: read with
+    /// the viewer's OWN identity so the downstream S3 permission check self-enforces
+    /// their entitlement (never the author's).
+    AsViewer(ApiAuthed),
+}
+
 #[cfg(feature = "parquet")]
 async fn check_if_allowed_to_access_s3_file_from_app(
     db: &DB,
@@ -3891,7 +3903,7 @@ async fn check_if_allowed_to_access_s3_file_from_app(
     w_id: &str,
     path: &str,
     policy: &Policy,
-) -> Result<()> {
+) -> Result<AppS3ReadIdentity> {
     let is_app_embed = opt_authed.as_ref().is_some_and(|authed| {
         windmill_api_auth::scopes::has_app_embed_sentinel(authed.scopes.as_deref())
     });
@@ -3912,7 +3924,7 @@ async fn check_if_allowed_to_access_s3_file_from_app(
                 &db,
             )
             .await?;
-            return Ok(());
+            return Ok(AppS3ReadIdentity::OnBehalf);
         }
     }
 
@@ -3921,24 +3933,25 @@ async fn check_if_allowed_to_access_s3_file_from_app(
         // get_workspace_s3_resource_and_check_paths already bounds the read by
         // their own perms — no provenance gate (it would over-restrict). Embed
         // tokens are excluded (untrusted app JS stays confined below).
-        Ok(())
-    } else {
-        // Author-mode/embed: confine reads to the app's declared keys or files THIS
-        // app produced, else a viewer could launder the author's S3 perms via an
-        // arbitrary file_key (confused deputy). Provenance is the un-forgeable
-        // app-origination marker (`trigger_kind='app'` + `trigger=<this app>`);
-        // `created_by=<caller>` is ANDed only as a per-viewer isolation filter (it
-        // can narrow — one viewer can't read another's result — never forge).
-        let creator = opt_authed
-            .as_ref()
-            .map(|authed| authed.username.clone())
-            .unwrap_or_else(|| "anonymous".to_string());
-        let allowed = policy.allowed_s3_keys.as_ref().is_some_and(|keys| {
-            keys.iter()
-                .any(|key| key.s3_path == file_query.s3 && key.storage == file_query.storage)
-        }) || {
-            sqlx::query_scalar!(
-                r#"SELECT EXISTS (
+        return Ok(AppS3ReadIdentity::OnBehalf);
+    }
+
+    // Author-mode/embed: confine reads to the app's declared keys or files THIS
+    // app produced, else a viewer could launder the author's S3 perms via an
+    // arbitrary file_key (confused deputy). Provenance is the un-forgeable
+    // app-origination marker (`trigger_kind='app'` + `trigger=<this app>`);
+    // `created_by=<caller>` is ANDed only as a per-viewer isolation filter (it
+    // can narrow — one viewer can't read another's result — never forge).
+    let creator = opt_authed
+        .as_ref()
+        .map(|authed| authed.username.clone())
+        .unwrap_or_else(|| "anonymous".to_string());
+    let allowed = policy.allowed_s3_keys.as_ref().is_some_and(|keys| {
+        keys.iter()
+            .any(|key| key.s3_path == file_query.s3 && key.storage == file_query.storage)
+    }) || {
+        sqlx::query_scalar!(
+            r#"SELECT EXISTS (
                 SELECT 1 FROM v2_job_completed c JOIN v2_job j USING (id)
                 WHERE j.workspace_id = $2
                     AND c.started_at > now() - interval '3 hours'
@@ -3947,21 +3960,45 @@ async fn check_if_allowed_to_access_s3_file_from_app(
                     AND j.trigger = $3
                     AND j.created_by = $4
             )"#,
-                file_query.s3,
-                w_id,
-                path,
-                creator,
-            )
-            .fetch_one(db)
-            .await?
-            .unwrap_or(false)
-        };
+            file_query.s3,
+            w_id,
+            path,
+            creator,
+        )
+        .fetch_one(db)
+        .await?
+        .unwrap_or(false)
+    };
 
-        if !allowed {
-            Err(Error::BadRequest("File restricted".to_string()))
-        } else {
-            Ok(())
+    if allowed {
+        return Ok(AppS3ReadIdentity::OnBehalf);
+    }
+
+    // Gate denied. A viewer whose token is effectively unscoped falls back to reading
+    // as THEMSELVES: the file is still bounded by their own S3 perms downstream, and
+    // such a token can already fetch it via `job_helpers/download_s3_file`, so the
+    // fallback adds zero capability. `is_effectively_unscoped` (the same predicate the
+    // route-scope middleware uses) is what makes that true: a genuinely scope-restricted
+    // token (e.g. `apps:read:<path>`) is allowed on `apps_u/*` but REJECTED on
+    // `job_helpers/*`, so serving it the file here WOULD be a new capability — it stays
+    // gated. `!is_app_embed` keeps that confinement explicit (embed tokens carry the
+    // `app_embed` scope, so they are already scope-restricted). Anonymous callers (no
+    // identity) also have no viewer to fall back to. Only the confused-deputy denial
+    // reaches the message below.
+    match opt_authed.as_ref() {
+        Some(viewer)
+            if !is_app_embed
+                && windmill_api_auth::is_effectively_unscoped(viewer.scopes.as_deref()) =>
+        {
+            Ok(AppS3ReadIdentity::AsViewer(viewer.clone()))
         }
+        _ => Err(Error::BadRequest(format!(
+            "S3 file \"{}\" is not accessible from this app. A deployed app running on \
+             behalf of its author only serves files it generated, files in its declared \
+             allowlist, or presigned files. To expose a pre-existing file, sign it \
+             (signS3Object / sign_s3_object) or set the app's execution mode to \"viewer\".",
+            file_query.s3
+        ))),
     }
 }
 
@@ -4029,7 +4066,7 @@ async fn download_s3_file_from_app(
         get_on_behalf_authed_from_app(&db, &path, &w_id, &opt_authed, force_viewer_allowed_s3_keys)
             .await?;
 
-    check_if_allowed_to_access_s3_file_from_app(
+    let read_authed = match check_if_allowed_to_access_s3_file_from_app(
         &db,
         &opt_authed,
         &query.file_query,
@@ -4037,10 +4074,14 @@ async fn download_s3_file_from_app(
         &path,
         &policy,
     )
-    .await?;
+    .await?
+    {
+        AppS3ReadIdentity::OnBehalf => on_behalf_authed,
+        AppS3ReadIdentity::AsViewer(viewer) => viewer,
+    };
 
     download_s3_file_internal(
-        OptJobAuthed { authed: on_behalf_authed, job_id: None },
+        OptJobAuthed { authed: read_authed, job_id: None },
         &db,
         None,
         &w_id,
@@ -4092,9 +4133,15 @@ async fn app_s3_on_behalf_and_provenance(
     }
     let (on_behalf_authed, policy) =
         get_on_behalf_authed_from_app(db, path, w_id, opt_authed, None).await?;
-    check_if_allowed_to_access_s3_file_from_app(db, opt_authed, file_query, w_id, path, &policy)
-        .await?;
-    Ok(crate::db::OptJobAuthed { authed: on_behalf_authed, job_id: None })
+    let read_authed = match check_if_allowed_to_access_s3_file_from_app(
+        db, opt_authed, file_query, w_id, path, &policy,
+    )
+    .await?
+    {
+        AppS3ReadIdentity::OnBehalf => on_behalf_authed,
+        AppS3ReadIdentity::AsViewer(viewer) => viewer,
+    };
+    Ok(crate::db::OptJobAuthed { authed: read_authed, job_id: None })
 }
 
 // The app-scoped display ops carry the app path in the URL and everything else

From 7ac27c1ef240729fc38d5fa506b96bf60be74e25 Mon Sep 17 00:00:00 2001
From: Guilhem <guilhemlemouel@gmail.com>
Date: Tue, 21 Jul 2026 19:04:15 +0200
Subject: [PATCH 097/171] fix(frontend): limit compare & deploy rows to the
 active direction (#10234)

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
---
 .../lib/components/CompareWorkspaces.svelte   | 37 +++++++------------
 1 file changed, 14 insertions(+), 23 deletions(-)

diff --git a/frontend/src/lib/components/CompareWorkspaces.svelte b/frontend/src/lib/components/CompareWorkspaces.svelte
index ac4fcfad99..fbebaf573a 100644
--- a/frontend/src/lib/components/CompareWorkspaces.svelte
+++ b/frontend/src/lib/components/CompareWorkspaces.svelte
@@ -910,22 +910,18 @@
 	// Trigger and schedule rows now flow through `comparison.diffs` like every
 	// other deployable kind — the backend's `compareWorkspaces` populates them
 	// from `workspace_diff`, with runtime fields ignored by `compare_two_*`.
-	let deployableItems = $derived.by(() => {
-		return (comparison?.diffs ?? [])
-			.filter((diff) => {
-				const key = getItemKey(diff)
-				const isSelectable = selectableDiffs.includes(diff)
-				const isDeployedAndIrrelevant =
-					deploymentStatus[key]?.status === 'deployed' && !isSelectable
-				return !isDeployedAndIrrelevant
-			})
-			.map((diff) => ({
-				key: getItemKey(diff),
-				path: diff.path,
-				kind: diff.kind as Kind,
-				diff
-			}))
-	})
+	// Rows are limited to the active direction (conflicts are ahead AND behind,
+	// so they show in both): an opposite-direction-only row would render as an
+	// unexplained disabled line. The other direction stays visible through the
+	// toggle badge counts and the behind/hidden alerts.
+	let deployableItems = $derived(
+		selectableDiffs.map((diff) => ({
+			key: getItemKey(diff),
+			path: diff.path,
+			kind: diff.kind as Kind,
+			diff
+		}))
+	)
 
 	let ciTestResults = $state<Record<string, CiTestResult[]>>({})
 
@@ -1050,10 +1046,9 @@
 	<div class="flex flex-col gap-4">
 		<div class="bg-surface-tertiary p-4 rounded-md border">
 			<WorkspaceDeployLayout
-				items={nothingToAct ? [] : deployableItems}
+				items={deployableItems}
 				{selectedItems}
 				{deploymentStatus}
-				selectablePredicate={(item) => selectableDiffs.some((d) => getItemKey(d) === item.key)}
 				{allSelected}
 				onToggleItem={(item) => toggleKey(item.key)}
 				onSelectAll={selectAll}
@@ -1110,9 +1105,6 @@
 									</div>
 								{/if}
 								<div class="flex items-center gap-2 text-sm">
-									<Badge color="transparent">
-										{comparison.summary.total_diffs} total items
-									</Badge>
 									<Badge color="transparent">
 										{selectableDiffs.length}
 										{mergeIntoParent ? 'deployable' : 'updateable'}
@@ -1278,7 +1270,6 @@
 						<span class="text-tertiary mx-1">&rarr;</span>
 						<span class="text-secondary">{diff.path}</span>
 					{:else}
-						{@const isSelectable = selectableDiffs.includes(diff)}
 						{@const oldSummary = mergeIntoParent
 							? summaryCache[key]?.parent
 							: summaryCache[key]?.current}
@@ -1294,7 +1285,7 @@
 							{editUrl}
 							{oldSummary}
 							{newSummary}
-							renamed={oldSummary != newSummary && isSelectable && existsInBothWorkspaces}
+							renamed={oldSummary != newSummary && existsInBothWorkspaces}
 						/>
 					{/if}
 				{/snippet}

From dae7c49f21eda2249217641b3503eb6bd6b3ebdc Mon Sep 17 00:00:00 2001
From: hugocasa <hugo@casademont.ch>
Date: Tue, 21 Jul 2026 19:04:39 +0200
Subject: [PATCH 098/171] test(git-sync): cover fork-of-dev-workspace branch
 naming and routing (#10231)

* test(git-sync): cover fork-of-dev-workspace branch naming and routing

A throwaway fork of a dev workspace pushes to `wm-fork/<tracked>/<id>` (the
tracked branch, not the dev's label), and the root's `sync_forks` poller
enumerates `wm-fork/<tracked>/*` and routes commits on that branch into the
nested fork through the root. This was twice assumed to instead live on
`wm-fork/<dev-label>/<id>` and therefore never be collected/reconciled; these
tests pin the real behavior.

- CLI unit: `computeGitSyncDeployBranch` for a fork whose parent is a dev
  workspace resolves to `wm-fork/main/<id>`, explicitly not `wm-fork/dev/<id>`.
- git-sync E2E: fork a dev workspace, assert the created branch is
  `wm-fork/main/<id>` (not `wm-fork/dev/*`), then assert a commit on it deploys
  into the fork via the root's sync_forks poller while the root is untouched.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* test(git-sync): reconcile single-dev-per-root in fork-of-dev e2e

The root workspace allows only one dev workspace, and a sibling test leaves one
attached, so attach_dev_workspace failed with "already has a dev workspace".
Detach any pre-existing dev before attaching, and detach ours via addCleanup so
the test doesn't leak its own.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore: update ee-repo-ref to aaa6cb89b05b76139252c64f057e53b94d12ac60

This commit updates the EE repository reference after PR #680 was merged in windmill-ee-private.

Previous ee-repo-ref: 4c08634af953db5c1125b1fb03f5af211fe21db3

New ee-repo-ref: aaa6cb89b05b76139252c64f057e53b94d12ac60

Automated by sync-ee-ref workflow.

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
---
 cli/test/git_unit.test.ts               |  20 +++++
 integration_tests/test/git_sync_test.py | 111 ++++++++++++++++++++++++
 2 files changed, 131 insertions(+)

diff --git a/cli/test/git_unit.test.ts b/cli/test/git_unit.test.ts
index 140da33866..2db2834bd2 100644
--- a/cli/test/git_unit.test.ts
+++ b/cli/test/git_unit.test.ts
@@ -199,6 +199,26 @@ describe("computeGitSyncDeployBranch", () => {
       })
     ).toBe("wm-fork/main/mydev");
   });
+
+  // A throwaway fork OF a dev workspace is named after the tracked (cloned)
+  // branch, NOT the parent dev's label: the child is not itself a dev
+  // workspace, so it carries no devWorkspaceLabel. The dev label reaches this
+  // deploy only as the checkout base + PR target (handled in sync.ts), never as
+  // the branch name — otherwise the branch would be `wm-fork/<label>/<id>` and
+  // the poller's `wm-fork/<tracked>/*` enumeration would miss it.
+  test("throwaway fork of a dev workspace -> wm-fork/<tracked>/<id>, not the dev label", () => {
+    const branch = computeGitSyncDeployBranch({
+      workspaceId: "wm-fork-child",
+      parentWorkspaceId: "prodstaging", // the dev workspace (prefix-less id)
+      devWorkspaceLabel: undefined, // child is not a dev workspace
+      clonedBranchName: "main",
+      groupByFolder: false,
+      useIndividualBranch: false,
+      items: [{ path_type: "script", path: "f/foo/bar" }],
+    });
+    expect(branch).toBe("wm-fork/main/child");
+    expect(branch).not.toBe("wm-fork/dev/child");
+  });
 });
 
 describe("forkBranchName", () => {
diff --git a/integration_tests/test/git_sync_test.py b/integration_tests/test/git_sync_test.py
index c0c9fb47e9..3cc54f2796 100644
--- a/integration_tests/test/git_sync_test.py
+++ b/integration_tests/test/git_sync_test.py
@@ -943,6 +943,117 @@ class TestGitSyncAutoPull(GitSyncTestBase):
             "Parent workspace received a commit from a fork branch",
         )
 
+    def test_fork_of_dev_workspace_branch_deploys_into_fork(self):
+        """A throwaway fork OF a dev workspace pushes to wm-fork/<tracked>/<id>
+        (the tracked branch, NOT the dev's label), and the root's sync_forks
+        poller enumerates wm-fork/<tracked>/* and routes a commit on that branch
+        into the nested fork — through the root, since only the root holds
+        auto-pull config. Regression for the assumption that such a fork lives on
+        wm-fork/<dev-label>/<id> and is therefore never collected/reconciled."""
+        repo_name, _ = self._create_test_repo()
+        resource_path = self._setup_git_sync_resource(repo_name)
+        self._configure_single_repo_sync(resource_path, include_type=["script"])
+
+        script_path = self._deploy_seed_script("forkofdev")
+        script_file = self._repo_script_file(repo_name, script_path)
+        # Seed before the fork branch is created so the branch inherits it.
+        self._seed_wmill_yaml(repo_name)
+
+        self._configure_auto_pull(resource_path, sync_forks=True)
+
+        # Attach an existing workspace as a dev workspace of the root (label
+        # "dev"). It carries the same inherited sync repo so a fork beneath it
+        # resolves against it.
+        dev_id = f"it-dev-{uuid.uuid4().hex[:8]}"
+        self._fork_workspaces_to_cleanup.append(dev_id)
+        dev_client = WindmillClient(workspace=dev_id)
+        dev_client.create_resource(
+            path=resource_path,
+            resource_type="git_repository",
+            value={
+                "url": self._gitea.get_docker_clone_url(repo_name),
+                "branch": "main",
+                "is_github_app": False,
+            },
+            update_if_exists=True,
+        )
+        dev_client.configure_git_sync({
+            "repositories": [{
+                "git_repo_resource_path": f"$res:{resource_path}",
+                "use_individual_branch": False,
+                "group_by_folder": False,
+                "settings": {"include_type": ["script"], "include_path": ["**"]},
+            }],
+        })
+        root = self._client._workspace
+        # Only one dev workspace per root, so clear any left attached by a prior
+        # test before attaching ours, and detach ours afterward so we don't leak.
+        existing = self._client._client.get(
+            f"/api/w/{root}/workspaces/get_dev_workspace"
+        )
+        if existing.status_code == 200 and existing.json():
+            self._client._client.post(
+                f"/api/w/{root}/workspaces/detach_dev_workspace",
+                json={"dev_workspace_id": existing.json()["id"]},
+            )
+        self.addCleanup(
+            lambda: self._client._client.post(
+                f"/api/w/{root}/workspaces/detach_dev_workspace",
+                json={"dev_workspace_id": dev_id},
+            )
+        )
+        attach = self._client._client.post(
+            f"/api/w/{root}/workspaces/attach_dev_workspace",
+            json={"dev_workspace_id": dev_id, "dev_workspace_label": "dev"},
+        )
+        self.assertEqual(
+            attach.status_code // 100,
+            2,
+            f"attach_dev_workspace failed: {attach.content.decode()}",
+        )
+
+        # Fork the dev workspace (branch first, then workspace) — its parent is
+        # the dev, so this is a fork OF a dev workspace.
+        fork_id = f"wm-fork-{uuid.uuid4().hex[:8]}"
+        self._fork_workspaces_to_cleanup.append(fork_id)
+        job_ids = dev_client.create_workspace_fork_branch(fork_id, f"Fork {fork_id}")
+        if job_ids:
+            dev_client.wait_for_jobs_by_ids(job_ids, timeout=90)
+            time.sleep(3)
+        dev_client.create_workspace_fork(fork_id, f"Fork {fork_id}")
+
+        # The fork branch is named after the tracked branch, not the dev label.
+        fork_suffix = fork_id[len("wm-fork-"):]
+        fork_branch = f"wm-fork/main/{fork_suffix}"
+        branches = self._get_branches(self._clone_repo_all_branches(repo_name))
+        self.assertTrue(
+            any(fork_branch in b for b in branches),
+            f"expected {fork_branch} in the repo after forking the dev, got: {branches}",
+        )
+        self.assertFalse(
+            any(f"wm-fork/dev/{fork_suffix}" in b for b in branches),
+            f"fork-of-dev must not live on a wm-fork/<dev-label>/* branch: {branches}",
+        )
+
+        self._gitea.create_file(
+            repo_name, script_file, ts_script("return 'fork only'"),
+            branch=fork_branch,
+        )
+
+        fork_client = WindmillClient(workspace=fork_id)
+        self._wait_until(
+            lambda: "fork only" in fork_client.get_script_content(script_path),
+            timeout=self.PULL_TIMEOUT,
+            message=f"fork-of-dev workspace {fork_id} did not receive the fork-branch commit",
+        )
+
+        # The root (the fork's grandparent, holder of the poller) must not see it.
+        self.assertNotIn(
+            "fork only",
+            self._client.get_script_content(script_path),
+            "Root workspace received a commit from a fork-of-dev branch",
+        )
+
     def test_settings_normalization_and_redaction(self):
         """Webhook mode on a token repo is persisted as polling; server-owned
         webhook fields are never exposed; legacy repos gain no auto_pull key."""

From d6cf1ef9872cd0db0f51e4881237bac383e45f61 Mon Sep 17 00:00:00 2001
From: Guilhem <guilhemlemouel@gmail.com>
Date: Tue, 21 Jul 2026 19:06:21 +0200
Subject: [PATCH 099/171] feat: attach text files to chat messages, read on
 demand via file tools (#10215)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* feat: attach text files to chat messages, read on demand via file tools

* fix: resolve name collisions and sync message files with the transcript

* refactor: render message file chips with the shared context badge

* fix: suffix same-name attachments, sync registry on compaction, bound file bytes

* feat: carry message files across compaction, drop them from the roster

* refactor: merge context, dom and file badges into one wrapping row

* fix: dedupe identical attachments and make badge list keys collision-proof

* fix: name carried files inside the collapsed summary instead of badges

* fix: serialize registry reconciliation and correct the attachment budget

* fix: reserve pending bytes so overlapping reads honor the attachment budget

* fix: share attachment byte budget across concurrent composers

The bottom composer and the edit box are both mounted while editing an
earlier message, but each enforced MAX_CONVERSATION_FILE_BYTES against
only its own staged files plus the transcript. Two attaches near the cap
could each pass independently and overflow the persisted transcript.

Each composer now publishes its staged bytes (committed attachments +
in-flight reads) to the manager, keyed per instance, and the attach-time
budget subtracts every other live composer's stage. A message an open
composer is editing is skipped from the transcript sum since that
composer's stage stands in for it.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix: charge an edited message at its persisted size until the edit commits

An edit is not committed until send, so the edited message's persisted
attachments return if the edit is cancelled. Substituting only the edit
box's (possibly emptied) stage let the always-mounted bottom composer
claim headroom that vanishes on cancel: remove the near-limit files in
the editor, fill the bottom draft, cancel, and the persisted transcript
overflows MAX_CONVERSATION_FILE_BYTES.

attachmentBytesExcluding now charges a message another composer is
editing at max(persisted size, editor stage), so freed space only
becomes available once the edit actually commits.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix: preserve a message file's exact name when a session row clashes on rebuild

syncMessageScoped rebuilds message-scoped rows from the transcript through
collision-suffixing addFiles. Session rows load first (on restore), so one
holding a wanted name pushed the rebuilt message row to a "(2)" suffix while
the persisted prompt still referenced the bare name — get() then resolved the
reference to the session asset and the model read the wrong content.

Free the name from the conflicting session row before the rebuild so the
message row reclaims its exact reference. The rename is in-memory only: it is
deterministic and re-applied on every load, and the session roster is
regenerated live each send, so the session asset stays addressable under the
suffix without a persisted-record update.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix: reserve resent files across the edit-resend gap

The edit box unmounts (dropping its staged-byte entry) the instant the user
submits an edit, but restartGeneration then awaits registry sync and beforeSend
before the optimistic bubble lands in the transcript. During that gap the
resent files were reserved nowhere, so the always-mounted bottom composer could
attach into the temporary headroom and the resend would then push the persisted
transcript past MAX_CONVERSATION_FILE_BYTES.

restartGeneration now reserves the resent files' bytes in shared manager state
before the transcript slice; sendRequest releases the reservation once it
installs the bubble (or restores the files to the composer on a pre-install
bail). The reservation bridges the gap so the budget stays honored throughout.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix: re-target an in-flight index when a session row is renamed on rebuild

#freeNameForMessageRow renames a restored session row so a same-named message
attachment can reclaim its exact name. But the row's #indexFile, started under
the old name during restore, stamps via #patchFile(oldName, file) — after the
rename that no longer matches, leaving the row stuck 'indexing' so read_file
rejects it and search_files excludes it.

Re-kick #indexFile under the new name when the renamed row is still indexing;
the stale completion then no-ops (its name is gone).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix: release resend reservation on local-command sends; surface compaction-orphaned files

Two follow-ups to the message-attachment work:

- A resend edited to /clear or /compact runs the local-command path and returns
  before installing a bubble, so the #RESEND_KEY reservation set by
  restartGeneration was never released and its bytes stayed charged, blocking
  later attachments. Release it on every sendRequest path that exits before
  install (via #releaseResendReservation).

- Drop-oldest compaction (summary fallback) removes API messages without a
  summary, so a folded message's `## ATTACHED FILES` reference no longer reaches
  the model even though the file stays readable. The roster omits message-scoped
  files, so the model loses awareness of them. orphanedMessageFileNames() finds
  message files whose only referencing message went negative-index, and the
  roster now advertises them (summary compaction already carries its own).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix: key the resend reservation per send so unrelated sends can't release it

The resend reservation used a single shared key, so a normal or concurrent
sendRequest released it at its own install/early-return even though it didn't
own it — dropping an in-flight resend's reservation and letting attachments
staged before the resend bubble lands under-count against the byte cap.

restartGeneration now mints a per-resend token, reserves under it, and threads
it through sendRequest as resendReservationKey; releases act only on that key.
A send with no token (every normal send) releases nothing.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix: reserve the whole wanted-name set when freeing session rows on rebuild

Freeing a session row for a message-scoped rebuild suffixed it against current
rows only. With the transcript referencing both notes (2).md and notes.md and a
session row named notes.md, freeing notes.md renamed it onto notes (2).md — also
a wanted reference — so that message row cascaded to notes (3).md while its
persisted reference stayed notes (2).md, and read_file returned the session file.

#uniqueName now accepts a reserved set; the rebuild frees each session clash
clear of the entire wanted-name set, so every message row reclaims its exact
reference regardless of collision order.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix: orphan summary-carried files when drop-oldest removes the summary

orphanedMessageFileNames classified summary rows as always-live, but a summary
carries its folded files' reference on its own API message. When summary
compaction succeeds and a later summarization fails, drop-oldest can remove that
API message, yet the files stayed off the roster — so the model lost their
reference even though they remained readable.

The summary display row now tracks its API index (slot 0 at creation, re-based by
drop-oldest); a negative index reads as "counterpart gone" and its files move to
the roster, mirroring user-message orphans. The index is used only for orphan
detection, never as a restart target.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix: reserve outgoing file bytes for normal and queued sends too

The resend reservation covered edit/retry, but a normal or queued send has the
same gap: the composer (or queue) clears its files the instant sendRequest is
called, dropping the staged-byte entry, while sendRequest then awaits
regrantLocked()/refreshFolders() before the bubble lands. With a locked or slow
linked folder the composer stays enabled, so a fresh drop can spend the same
headroom and overflow the 5 MB cap once the first bubble installs.

Generalize the reservation: sendRequest mints a per-send token and reserves the
outgoing files' bytes just before attachment upkeep (reusing restartGeneration's
token when present), and releases it on install or any pre-install exit.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* refactor: join attachment layers on a stable content-hash id

Sixteen review rounds kept finding the same bug family: a message file's
identity was its display name, joined by hand across the registry, the
transcript, the prompt reference, and the render keys — every same-name
collision or interleaved rebuild made two of those copies disagree.

Give each message attachment a deterministic id, attachedTextFileId(name,
content) — a synchronous pure-JS hash (works on plain-HTTP deployments) whose
exact value is pinned by test, since persisted transcripts reference it. The
prompt and roster list the id, the file tools resolve id-first (bare names
remain a fallback for legacy chats and session links), and pre-id transcripts
hydrate on load by recomputing the same hash — no migration state.

Names become display-only and may collide freely, which deletes the machinery
that defended them: the suffix-readback registration loop, session-row renaming
on rebuild (#freeNameForMessageRow, reserved-set #uniqueName), and the
reconciler's serialization guards (#syncSeq/#syncChain) — syncMessageScoped now
compares ids instead of awaiting blob text, so it is synchronous and cannot
interleave. A same-name clash within one draft gets a composer-local courtesy
rename before the id is minted.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix: resolve bare names to session rows and scope id searches to one row

A bare name is the roster's namespace: session links are advertised by
filename and have no other handle, so a same-named message attachment (which
is addressed by id) must not shadow them. get() now resolves session rows
first, keeping the message-row name lookup only as the fallback for
transcripts persisted before ids existed.

search_files restricted an id reference by mapping it back to the display
name and letting the worker filter on it — same-named files were then
searched together under one label. The tool now passes the resolved row
itself, so an id-scoped search can only ever hit its own file.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix: label search hits with resolvable ids, normalize attach batches at commit

An unscoped search_files reported hits by display name only. Names may
collide, so a hit could not be mapped back to the row that produced it —
a follow-up read_file on the bare name could return a different same-named
file. Rows carrying an id are now labeled `name (file id: …)` in hit lines,
so every hit names the reference that resolves to exactly that row.

addTextFiles normalized (deduped, courtesy-renamed) each file against a
snapshot taken during its read loop. Attach batches overlap, so a file
committed by another batch between reads escaped both checks — duplicate or
same-named unsuffixed entries in one message. Normalization now runs in the
single synchronous commit step against the live list (foldIntoDraft), where
nothing can interleave.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix: dedupe renamed re-drops in foldIntoDraft, truncate queued file chips

"Same file dropped twice" means same original (name, content), but a
courtesy rename erases the original name — an identical re-drop then missed
the duplicate check and landed as a further-suffixed copy. The dedupe now
also matches entries whose suffix-stripped base name equals the read's name.

Queued file chip labels get min-w-0 so long filenames truncate inside
max-w-36 instead of overflowing.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix: address cubic review — line counts, chip clicks, reference robustness

Five fixes from the cubic pass:

- The prompt advertised split('\n').length lines, one more than read_file
  reports for newline-terminated files — textLineCount now matches the tool's
  numbering (0 for empty, no phantom trailing line).
- Clicking a sent message's badge opened edit mode (the wrapper's
  click-to-edit), unmounting the preview popover as it opened; the badge row
  now keeps clicks to itself.
- resolve() accepts the composite label rosters and search hits print
  (`name (file id: x)`) — models echo references verbatim, so the printed
  form must resolve.
- fileToAttachedTextFile enforces MAX_TEXT_FILE_BYTES itself (raw size +
  decoded byte length), so no ingestion path can persist an oversized
  attachment past the composer's pre-check.
- Duplicate detection after a courtesy rename now uses an explicit sourceName
  instead of inferring provenance from the display name — a user's real
  `report (2).md` is not a rename of `report.md`.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix: exact names win over label parsing, commit recheck uses decoded bytes

resolve() parsed any `name (file id: x)`-shaped reference as a printed label,
so a session file literally named that way became unreachable by its exact
name (the dead-id fallback resolved the base name instead). Exact id and
exact-name lookups now run before label interpretation.

Attachment admission and the pending reservation use raw File.size, but the
committed charge is the decoded UTF-8 length — malformed input decodes each
invalid byte to a 3-byte replacement character, so a file passing the 8KB
text sniff could inflate past the conversation cap. The synchronous commit
step now re-checks the live budget against decoded sizes
(admitWithinByteBudget) and drops what no longer fits, with the budget toast.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix: normalize files folded into the queued message

Repeated submissions during a stream aggregate into one queued message, but
their files were concatenated raw: an identical re-attach duplicated its chip
and ate a slot (possibly displacing a distinct file at the eight-file cap),
and a same-name clash skipped the courtesy rename. The queue now folds new
files through the same commit normalization as the composer — the queued
entry is a message draft like any other.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* style: compaction boundary label uses text-normal text-2xs

* fix: fold provenance survives pass-through, dequeued files fold into the draft

foldIntoDraft recorded sourceName only for renames it performed itself, so a
file already courtesy-renamed by the composer lost its provenance when folded
into the queue — a later re-attach of the original escaped dedupe. Folds now
compose: the original source name rides through every fold, and dedupe
matches on it.

dequeueMessage restored queued files into a possibly-populated composer by
raw concatenation; prependText now folds them like every other draft
aggregation (dedupe, courtesy rename) before applying the cap.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* refactor: one MessageDraft owns the lanes that ship with a send

Review rounds kept finding the same P2 shape: an aggregation point where
files join a draft (composer commit, queue append, dequeue restore) that
forgot one of the draft rules — fold dedupe, courtesy rename, slot caps,
byte admission, lanes moving together. The rules existed only as convention
re-implemented per site.

MessageDraft owns them once: text, pastes, images, and text files live on
one object with addFiles (fold + optional decoded-byte admission + cap),
addImages (cap), prepend (restore-merge), replaceIfEmpty (occupied-guard
restore), and take (all lanes leave together). The composer holds a draft
instead of four state vars, and the queue is a draft behind the existing
queuedMessage/queuedImages/queuedFiles accessors — an aggregation point can
no longer skip a rule, because there is no raw array to concatenate into.

Deliberately not moved: @context and DOM picks (ContextManager owns their
lifecycle), the conversation byte budget's cross-composer ledger (store-side
follow-up), and sendRequest's options shape (it decomposes immediately and
is pinned by the manager test suite).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* docs: correct the drop-routing comment, condense the budget doc

* fix: address cubic review — name sanitization, drop hold, merge restores

Four fixes from the cubic pass:

- Attachment display names render into model-facing prompt blocks, and OS
  filenames may legally contain control characters — sanitizeAttachmentName
  strips them at attach and again at every prompt-render site (legacy names
  predate the attach-time pass), so a crafted name cannot inject prompt lines.
- Drop routing awaits handle/entry resolution before it can call
  addTextFiles; a send during that window landed the dropped files on the
  next message. The drop handler now holds sending (holdSendForIngestion,
  taken before the first await) until routing completes.
- Restoring a taken queue after a failed auto-send replaced the queued draft
  wholesale, silently losing a follow-up queued during the preflight. Both
  #restoreQueue and the unmounted-input requeue now merge via draft.prepend —
  the taken entry's text lands above the newer follow-up.
- restartGeneration validated the API restart index only after reserving the
  resend bytes and truncating the transcript, so a stale index threw with the
  reservation leaked and the display transcript half-mutated. The index is
  resolved and validated before anything is touched.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix: restored drafts keep chronological priority, store names stay resolvable

A failed auto-send's restore folded the taken (older) draft's attachments
AFTER a follow-up queued during preflight, so at the slot caps the older
attachments silently dropped despite the text landing first — and only one
entry's pinned context survived. prepend() now puts the restored lanes ahead
(the cap drops the newest additions) and #restoreQueue unions both pinned
contexts by identity.

Session filenames were sanitized only at prompt render, so an id-less file
whose stored name carries control characters was advertised under a name
that resolve() could not match. Names are now sanitized at every store
row-creation site (attach, folder expansion, refresh, and persisted-row
restore for pre-sanitization records), making the advertised name the stored
name everywhere — render-site sanitization remains as defense in depth.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* chore: update ee-repo-ref to aaa6cb89b05b76139252c64f057e53b94d12ac60

This commit updates the EE repository reference after PR #680 was merged in windmill-ee-private.

Previous ee-repo-ref: 4c08634af953db5c1125b1fb03f5af211fe21db3

New ee-repo-ref: aaa6cb89b05b76139252c64f057e53b94d12ac60

Automated by sync-ee-ref workflow.

* chore: repin ee-repo-ref to main's eb3690a34b (aaa6cb89 needs the unmerged AmqpTrigger OSS companion)

* Revert "chore: repin ee-repo-ref to main's eb3690a34b (aaa6cb89 needs the unmerged AmqpTrigger OSS companion)"

This reverts commit a782e6f1c5a4c054fc660ce1f432020e1019aeb7.

* refactor: one name seam per scope — claim on the store, sanitize in the fold

Name rules (sanitize, uniquify, dedupe, resolve) lived as convention at every
creation site: four sites carried verbatim copies, two skipped uniquify
(restore, file placeholders — legacy names could collapse to one display
name), and the dedupe check compared the raw name against sanitized stored
names, so re-linking a control-char file added a spurious copy.

Store side: #claimName(raw) = sanitize + uniquify is now the only way a
session row gets its display name; addFiles derives the sanitized name once
at the top of the loop, so dedupe, uniqueness, and the stored row all see the
same string, while relPath and folder keep the raw on-disk keys they must
match. Draft side: foldIntoDraft sanitizes its reads itself instead of
assuming the reader did, making the fold self-contained. Folder names — raw
grouping keys by design — are sanitized at their model-facing render sites
(roster folder lines, not-found listing), mirroring rosterLine.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix: a display-name collision is not a duplicate

Sanitizing names before the dedupe compare made two DISTINCT files whose raw
names sanitize identically look like re-links — the second was silently
discarded instead of claiming a suffixed name like the restore path does.

Dedupe now means "the same file re-linked": matching stats (size + mtime)
plus a matching name, pre-suffix sourceName, or raw path. #claimName records
the pre-suffix name when uniquifying renamed a row, so re-linking a suffixed
file's original still dedupes. A same-named file with different stats links
as its own row rather than being silently swallowed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix: the re-link identity is the raw name, persisted with the row

Dedupe still compared sanitized display names, so two distinct raw names
that sanitize identically collapsed whenever their stats also matched — and
the provenance recorded for suffixed rows lived only in memory, so after a
reload re-linking the original behind a suffixed row stacked another copy.

sourceName now records the RAW pre-sanitization name on every session row
(display names lose information twice — sanitize, then suffix), rides the
persisted record, and is re-derived on restore. Dedupe matches stats plus
raw identity (sourceName, or relPath for folder children) and never compares
display names. #claimName returns to a pure name function; restore claims
the display name from the persisted raw identity.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
---
 .../copilot/chat/AIChatDisplay.svelte         |  79 ++-
 .../copilot/chat/AIChatInput.svelte           | 376 +++++++++----
 .../copilot/chat/AIChatManager.svelte.ts      | 510 ++++++++++++++----
 .../copilot/chat/AIChatManager.test.ts        | 293 +++++++++-
 .../copilot/chat/AIChatMessage.svelte         |  32 +-
 .../copilot/chat/CompactionBoundary.svelte    |  12 +-
 .../copilot/chat/ContextElementBadge.svelte   |  16 +-
 .../copilot/chat/ContextTextarea.svelte       |  16 +-
 .../copilot/chat/HistoryManager.svelte.ts     |  12 +-
 .../copilot/chat/QueuedMessageChip.svelte     |  30 +-
 .../lib/components/copilot/chat/context.ts    |  22 +-
 .../chat/files/AttachedFilesBar.svelte        |   2 +-
 .../chat/files/attachedFiles.svelte.ts        | 248 +++++++--
 .../copilot/chat/files/attachedFiles.test.ts  | 231 ++++++++
 .../copilot/chat/files/attachedFilesDB.ts     |   3 +
 .../copilot/chat/files/fileTools.test.ts      |  66 ++-
 .../copilot/chat/files/fileTools.ts           |  85 ++-
 .../copilot/chat/global/core.test.ts          |  31 ++
 .../components/copilot/chat/global/core.ts    |  23 +
 .../copilot/chat/messageDraft.svelte.ts       | 152 ++++++
 .../copilot/chat/messageDraft.test.ts         |  91 ++++
 .../src/lib/components/copilot/chat/shared.ts |  18 +-
 .../copilot/chat/textFileUtils.test.ts        | Bin 0 -> 6684 bytes
 .../components/copilot/chat/textFileUtils.ts  | 208 +++++++
 24 files changed, 2212 insertions(+), 344 deletions(-)
 create mode 100644 frontend/src/lib/components/copilot/chat/messageDraft.svelte.ts
 create mode 100644 frontend/src/lib/components/copilot/chat/messageDraft.test.ts
 create mode 100644 frontend/src/lib/components/copilot/chat/textFileUtils.test.ts
 create mode 100644 frontend/src/lib/components/copilot/chat/textFileUtils.ts

diff --git a/frontend/src/lib/components/copilot/chat/AIChatDisplay.svelte b/frontend/src/lib/components/copilot/chat/AIChatDisplay.svelte
index aefa123713..a267e71e8c 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatDisplay.svelte
+++ b/frontend/src/lib/components/copilot/chat/AIChatDisplay.svelte
@@ -39,6 +39,7 @@
 	import { getAiChatManager } from './aiChatManagerContext'
 	import ChatTypingIndicator from './ChatTypingIndicator.svelte'
 	import AIChatInput from './AIChatInput.svelte'
+	import AttachedFilesBar from './files/AttachedFilesBar.svelte'
 	import QueuedMessageChip from './QueuedMessageChip.svelte'
 	import JobsSegment from './JobsSegment.svelte'
 	import { getModifierKey } from '$lib/utils'
@@ -272,8 +273,8 @@
 
 	// File attachment is GLOBAL-mode only.
 	const canAttachFiles = $derived(aiChatManager.mode === AIMode.GLOBAL && !disabled)
-	// Steers the OS file picker toward text + image formats (soft hint; images attach to
-	// the message, other files link as text context after a content sniff).
+	// Steers the OS file picker toward text + image formats (soft hint; both attach
+	// to the message — text files after a content sniff).
 	const TEXT_FILE_ACCEPT =
 		'image/*,text/*,.txt,.csv,.tsv,.json,.jsonl,.ndjson,.md,.markdown,.log,.yaml,.yml,.toml,.ini,.cfg,.conf,.env,.xml,.html,.htm,.css,.js,.mjs,.cjs,.ts,.tsx,.jsx,.py,.rb,.rs,.go,.java,.kt,.c,.h,.cpp,.cc,.cs,.php,.sh,.bash,.zsh,.sql,.svelte,.vue,.dockerfile'
 	let fileInputEl = $state<HTMLInputElement | null>(null)
@@ -361,16 +362,30 @@
 		e.preventDefault()
 		const dt = e.dataTransfer
 		if (!dt) return
-		// Images attach to the message; other files link as text context. Images are
-		// reserved from dt.files BEFORE any await (a send mid-ingestion would land
-		// them on the next message), and dt.files is the only place a disk-less drag
-		// exists — a cross-tab image resolves every getAsFileSystemHandle() to null.
+		// Images and loose text files attach to the message; folders link as session
+		// assets. Images are reserved from dt.files BEFORE any await (a send
+		// mid-ingestion would land them on the next message), and dt.files is the
+		// only place a disk-less drag exists — a cross-tab image resolves every
+		// getAsFileSystemHandle() to null.
 		const flatFiles = Array.from(dt.files ?? [])
 		const topLevelImages = flatFiles.filter(isImageFile)
 		const imageWork: Promise<unknown>[] = []
 		if (topLevelImages.length > 0) {
 			imageWork.push(aiChatInput?.addImages(topLevelImages) ?? Promise.resolve())
 		}
+		// Text-file routing must await handle/entry resolution before it can call
+		// addTextFiles — hold sending across that window (taken BEFORE the first
+		// await) or a send mid-resolution would land the drop on the next message.
+		const releaseSendHold = aiChatInput?.holdSendForIngestion()
+		try {
+			await routeDroppedTextAndFolders(dt, flatFiles)
+		} finally {
+			releaseSendHold?.()
+		}
+		await Promise.all(imageWork)
+	}
+
+	async function routeDroppedTextAndFolders(dt: DataTransfer, flatFiles: File[]) {
 		if (canUseFsAccess) {
 			// getAsFileSystemHandle calls are kicked off synchronously inside this call.
 			const handles = await handlesFromDataTransfer(dt)
@@ -381,9 +396,9 @@
 				handles.length === 0
 					? flatFiles
 					: await Promise.all(handles.filter(isFileHandle).map((h) => h.getFile()))
-			// Files are always snapshotted (handle discarded).
+			// Loose text files attach to the message, like images.
 			const textFiles = looseFiles.filter((f) => !isImageFile(f))
-			if (textFiles.length > 0) await handleAddFiles(textFiles)
+			if (textFiles.length > 0) await aiChatInput?.addTextFiles(textFiles)
 			// Folders link as a live handle.
 			for (const h of handles.filter(isDirectoryHandle)) {
 				await addDirHandle(h)
@@ -395,19 +410,25 @@
 			// (no entry API), fall back to the flat dt.files.
 			const entries = await readDroppedEntries(Array.from(dt.items ?? []))
 			const source: FileToAttach[] = entries.length > 0 ? entries : flatFiles
-			// Only top-level images attach to the message, and those were already
-			// reserved from dt.files before the walk — drop them here so they aren't
-			// re-reported as skipped non-text. Folder-nested images are deliberately
-			// NOT attached (the FSA path never extracts folder contents either); they
-			// ride the text ingestion and are summarized as skipped.
-			const textEntries = source.filter((entry) => {
+			// Top-level files attach to the message (images were already reserved
+			// from dt.files before the walk). Folder children keep riding the
+			// session store as a snapshot — including nested images, which are
+			// deliberately NOT attached (the FSA path never extracts folder
+			// contents either); they are summarized as skipped there.
+			const topLevelText: File[] = []
+			const folderEntries: FileToAttach[] = []
+			for (const entry of source) {
 				const file = entry instanceof File ? entry : entry.file
-				const nested = !(entry instanceof File) && entry.path?.includes('/')
-				return !isImageFile(file) || !!nested
-			})
-			if (textEntries.length > 0) await handleAddFiles(textEntries)
+				const nested = !(entry instanceof File) && !!entry.path?.includes('/')
+				if (nested) {
+					folderEntries.push(entry)
+				} else if (!isImageFile(file)) {
+					topLevelText.push(file)
+				}
+			}
+			if (folderEntries.length > 0) await handleAddFiles(folderEntries)
+			if (topLevelText.length > 0) await aiChatInput?.addTextFiles(topLevelText)
 		}
-		await Promise.all(imageWork)
 	}
 
 	async function onFileInputChange(e: Event) {
@@ -418,7 +439,7 @@
 			const textFiles = picked.filter((f) => !isImageFile(f))
 			// Reserved before the text work is awaited — see onPanelDrop.
 			const imageWork = imageFiles.length > 0 ? aiChatInput?.addImages(imageFiles) : undefined
-			if (textFiles.length > 0) await handleAddFiles(textFiles)
+			if (textFiles.length > 0) await aiChatInput?.addTextFiles(textFiles)
 			await imageWork
 		}
 		input.value = '' // allow re-selecting the same file
@@ -754,10 +775,11 @@ the panel, or the Escape-to-stop focus check would wrongly reject them. -->
 					<JobsSegment standalone />
 				</div>
 			{/if}
-			<!-- Context chips (attached files + selected-context / DOM-selector) render
+			<!-- Message-scoped chips (selected-context / DOM-selector / images) render
 			     inside the input box via AIChatInput → ContextTextarea's `leading` snippet;
 			     selected context also appears as @mentions in the input (deleting the
-			     mention deselects). Hence showContext={false} below. -->
+			     mention deselects). Hence showContext={false} below. Session-scoped
+			     assets (attached files/folders) render in the footer row instead. -->
 			{#if inputPreface}
 				{@render inputPreface()}
 			{/if}
@@ -863,12 +885,12 @@ the panel, or the Escape-to-stop focus check would wrongly reject them. -->
 											<div class="max-w-64 text-xs">
 												<p class="font-semibold">Attach files or link a folder</p>
 												<p class="mt-1">
-													Text files stay in your browser, and a folder is linked live from disk.
-													The assistant lists, searches, and reads them on demand, so their contents
-													are sent only when it reads one.
+													Files and images attach to your next message. Images are seen directly;
+													file contents stay in your browser and are read on demand.
 												</p>
 												<p class="mt-1">
-													Images are sent with your next message, so the assistant can see them.
+													A linked folder is a session-wide resource: the assistant lists, searches,
+													and reads its files whenever it needs them.
 												</p>
 											</div>
 										{/snippet}
@@ -876,7 +898,7 @@ the panel, or the Escape-to-stop focus check would wrongly reject them. -->
 								{/snippet}
 							</DropdownV2>
 							<!-- Fallback file picker (used when the File System Access API is unavailable).
-							     `accept` only steers toward text; the content sniff in addFiles() is authoritative. -->
+							     `accept` only steers the picker; the content sniff at attach is authoritative. -->
 							<input
 								bind:this={fileInputEl}
 								type="file"
@@ -968,6 +990,9 @@ the panel, or the Escape-to-stop focus check would wrongly reject them. -->
 					</div>
 				{:else}
 					<div class="flex flex-row gap-x-1.5 min-w-0 flex-wrap items-center">
+						{#if aiChatManager.mode === AIMode.GLOBAL}
+							<AttachedFilesBar />
+						{/if}
 						{#if !hideModeSelector}
 							<ChatMode />
 						{/if}
diff --git a/frontend/src/lib/components/copilot/chat/AIChatInput.svelte b/frontend/src/lib/components/copilot/chat/AIChatInput.svelte
index 427856d291..336246b368 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatInput.svelte
+++ b/frontend/src/lib/components/copilot/chat/AIChatInput.svelte
@@ -2,10 +2,10 @@
 	import AppAvailableContextList from './AppAvailableContextList.svelte'
 	import ContextElementBadge from './ContextElementBadge.svelte'
 	import ContextTextarea from './ContextTextarea.svelte'
-	import AttachedFilesBar from './files/AttachedFilesBar.svelte'
 	import autosize from '$lib/autosize'
 	import {
 		contextElementKey,
+		createAttachedFileContextElement,
 		isSameContextElement,
 		type AppDomSelectorElement,
 		type ContextElement
@@ -31,6 +31,16 @@
 	} from './imageUtils'
 	import { modelSupportsVision } from '../modelConfig'
 	import { tryGetCurrentModel } from '$lib/aiStore'
+	import { createLongHash } from '$lib/editorLangUtils'
+	import {
+		fileToAttachedTextFile,
+		MAX_ATTACHED_FILES,
+		MAX_CONVERSATION_FILE_BYTES,
+		MAX_TEXT_FILE_BYTES,
+		textByteLength,
+		type AttachedTextFile
+	} from './textFileUtils'
+	import { MessageDraft } from './messageDraft.svelte'
 	import ExpandableImage, {
 		isImageViewerOpen
 	} from '$lib/components/common/image/ExpandableImage.svelte'
@@ -46,6 +56,7 @@
 		initialInstructions?: string
 		initialPastes?: PasteAttachment[]
 		initialImages?: AttachedImage[]
+		initialFiles?: AttachedTextFile[]
 		editingMessageIndex?: number | null
 		onEditEnd?: () => void
 		className?: string
@@ -76,6 +87,7 @@
 		initialInstructions = '',
 		initialPastes = undefined,
 		initialImages = undefined,
+		initialFiles = undefined,
 		editingMessageIndex = null,
 		onEditEnd = () => {},
 		className = '',
@@ -142,16 +154,22 @@
 
 	let contextTextareaComponent: ContextTextarea | undefined = $state()
 	let instructionsTextareaComponent: HTMLTextAreaElement | undefined = $state()
-	let instructions = $state(untrack(() => initialInstructions))
+	// The four lanes that ship with the next send — text, collapsed big-paste
+	// blobs, per-message images, per-message text files — owned by one draft so
+	// every aggregation applies the draft rules. The composer keeps only the
+	// async in-flight accounting (pending counters, byte reservations).
+	const draft = new MessageDraft(
+		untrack(() => ({
+			text: initialInstructions,
+			pastes: initialPastes ?? [],
+			images: initialImages ?? [],
+			files: initialFiles ?? []
+		}))
+	)
 	$effect(() => {
-		const text = instructions
+		const text = draft.text
 		untrack(() => onDraftChange?.(text))
 	})
-	// Collapsed big-paste blobs referenced by tokens in `instructions`.
-	let pastes = $state<PasteAttachment[]>(untrack(() => initialPastes ?? []))
-	// Per-message image attachments (drag/drop/paste), GLOBAL mode only. One-shot:
-	// they attach to the next send and clear, unlike the persistent attached-files store.
-	let images = $state<AttachedImage[]>(untrack(() => initialImages ?? []))
 	// Images being decoded right now. Holds off sending so a message can never go
 	// out without an attachment the user already dropped, and reserves cap slots
 	// against a concurrent drop.
@@ -171,10 +189,10 @@
 			sendUserToast(`${model.model} can't read images. Switch to a vision model first.`, true)
 			return
 		}
-		// Count decodes already in flight: two drops that both read `images.length`
+		// Count decodes already in flight: two drops that both read the image count
 		// before either resolves would each claim the same free slots and overshoot
 		// the cap.
-		const remaining = MAX_ATTACHED_IMAGES - images.length - pendingImages
+		const remaining = MAX_ATTACHED_IMAGES - draft.images.length - pendingImages
 		if (remaining <= 0) {
 			sendUserToast(`You can attach up to ${MAX_ATTACHED_IMAGES} images.`, true)
 			return
@@ -210,7 +228,7 @@
 					failed++
 				}
 			}
-			if (added.length > 0) images = [...images, ...added]
+			if (added.length > 0) draft.addImages(added)
 			if (failed > 0) sendUserToast(`Could not attach ${failed} image(s).`, true)
 		} finally {
 			pendingImages -= batch.length
@@ -218,7 +236,140 @@
 	}
 
 	function removeImage(index: number) {
-		images = images.filter((_, i) => i !== index)
+		draft.images = draft.images.filter((_, i) => i !== index)
+	}
+
+	// Files being read right now — same send-hold/slot-reservation role as pendingImages.
+	let pendingFiles = $state(0)
+	// Drop routing resolves file-system handles/entries asynchronously before it
+	// can call addTextFiles/addImages; a send during that window would land the
+	// dropped files on the NEXT message. Holds block sending (no slot or chip
+	// impact) until the drop handler finishes routing.
+	let ingestionHolds = $state(0)
+	export function holdSendForIngestion(): () => void {
+		ingestionHolds += 1
+		let released = false
+		return () => {
+			if (!released) {
+				released = true
+				ingestionHolds -= 1
+			}
+		}
+	}
+	// Bytes those in-flight reads have claimed against the conversation budget:
+	// two overlapping drops that both read the budget before either lands would
+	// otherwise each spend the same remaining allowance.
+	let pendingFileBytes = $state(0)
+
+	// Publish this composer's staged bytes (committed attachments + in-flight
+	// reads) to the manager so a concurrently-mounted composer — the edit box
+	// while editing an earlier message — sees them in its own budget check and
+	// the two can't each spend the whole conversation allowance.
+	const composerKey = untrack(() => createLongHash())
+	let stagedBytes = $derived(
+		draft.files.reduce((sum, f) => sum + textByteLength(f.content), 0) + pendingFileBytes
+	)
+	$effect(() => {
+		aiChatManager.setComposerStaged(composerKey, editingMessageIndex, stagedBytes)
+	})
+	$effect(() => () => aiChatManager.clearComposerStaged(composerKey))
+
+	/** Attach dropped/picked text files (sniffed + bounded). GLOBAL mode only. */
+	export async function addTextFiles(candidates: File[]) {
+		if (aiChatManager.mode !== AIMode.GLOBAL) return
+		if (candidates.length === 0) return
+		const remaining = MAX_ATTACHED_FILES - draft.files.length - pendingFiles
+		if (remaining <= 0) {
+			sendUserToast(`You can attach up to ${MAX_ATTACHED_FILES} files.`, true)
+			return
+		}
+		const oversized = candidates.filter((f) => f.size > MAX_TEXT_FILE_BYTES)
+		if (oversized.length > 0) {
+			const mb = Math.round(MAX_TEXT_FILE_BYTES / 1_000_000)
+			sendUserToast(
+				`${oversized.length} file(s) over ${mb}MB were skipped — link their folder to read them on demand.`,
+				true
+			)
+		}
+		const usable = candidates.filter((f) => f.size <= MAX_TEXT_FILE_BYTES)
+		if (usable.length === 0) return
+		let batch = usable.slice(0, remaining)
+		if (batch.length < usable.length) {
+			sendUserToast(
+				`You can attach up to ${MAX_ATTACHED_FILES} files; ${usable.length - batch.length} were skipped.`,
+				true
+			)
+		}
+		// Conversation-level byte budget: transcript + queue + every live
+		// composer's stage (this one and, mid-edit, the other) + this composer's
+		// own pending reads. File content is persisted with every history save, so
+		// an unbounded total would grow the chat record without limit. The
+		// transcript sum skips any message a composer is editing — that composer's
+		// stage stands in for it, so counting both would charge those bytes twice.
+		let budget =
+			MAX_CONVERSATION_FILE_BYTES -
+			aiChatManager.attachmentBytesExcluding(composerKey) -
+			draft.files.reduce((sum, f) => sum + textByteLength(f.content), 0) -
+			pendingFileBytes
+		const withinBudget: File[] = []
+		for (const f of batch) {
+			if (f.size <= budget) {
+				withinBudget.push(f)
+				budget -= f.size
+			}
+		}
+		if (withinBudget.length < batch.length) {
+			const mb = Math.round(MAX_CONVERSATION_FILE_BYTES / 1_000_000)
+			sendUserToast(
+				`${batch.length - withinBudget.length} file(s) skipped — this conversation reached its ${mb}MB attachment budget. Link a folder to read larger sets on demand.`,
+				true
+			)
+		}
+		batch = withinBudget
+		if (batch.length === 0) return
+		pendingFiles += batch.length
+		const reservedBytes = batch.reduce((sum, f) => sum + f.size, 0)
+		pendingFileBytes += reservedBytes
+		try {
+			const reads: { name: string; content: string }[] = []
+			let skipped = 0
+			for (const file of batch) {
+				try {
+					const attached = await fileToAttachedTextFile(file)
+					if (attached) reads.push(attached)
+					else skipped++
+				} catch {
+					skipped++
+				}
+			}
+			// Commit through the draft in one synchronous step — fold (dedupe,
+			// courtesy rename) and decoded-byte admission both run against the live
+			// list, so another batch landing between this one's file reads can't be
+			// missed, and malformed input that inflates on decode can't slip past the
+			// raw-size admission above. This batch's own raw reservation is excluded
+			// from the budget — the decoded sizes replace it.
+			const liveBudget =
+				MAX_CONVERSATION_FILE_BYTES -
+				aiChatManager.attachmentBytesExcluding(composerKey) -
+				draft.files.reduce((sum, f) => sum + textByteLength(f.content), 0) -
+				(pendingFileBytes - reservedBytes)
+			const { droppedAtBudget } = draft.addFiles(reads, liveBudget)
+			if (droppedAtBudget > 0) {
+				const mb = Math.round(MAX_CONVERSATION_FILE_BYTES / 1_000_000)
+				sendUserToast(
+					`${droppedAtBudget} file(s) skipped — this conversation reached its ${mb}MB attachment budget. Link a folder to read larger sets on demand.`,
+					true
+				)
+			}
+			if (skipped > 0) sendUserToast(`Skipped ${skipped} file(s) (non-text).`, true)
+		} finally {
+			pendingFiles -= batch.length
+			pendingFileBytes -= reservedBytes
+		}
+	}
+
+	function removeFile(index: number) {
+		draft.files = draft.files.filter((_, i) => i !== index)
 	}
 
 	// App mode @ mention state
@@ -250,9 +401,9 @@
 	 * leave duplicate tokens. */
 	export function insertMention(title: string) {
 		const target = `@${title}`
-		if (instructions.split(/\s+/).includes(target)) return
-		const sep = instructions.length === 0 || /\s$/.test(instructions) ? '' : ' '
-		instructions = `${instructions}${sep}${target} `
+		if (draft.text.split(/\s+/).includes(target)) return
+		const sep = draft.text.length === 0 || /\s$/.test(draft.text) ? '' : ' '
+		draft.text = `${draft.text}${sep}${target} `
 	}
 
 	/** Strip every `@title` token from the textarea — used when the user
@@ -268,7 +419,7 @@
 		contextTextareaComponent?.unsyncMention(title)
 		const escaped = title.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
 		const re = new RegExp(`(^|\\s)@${escaped}(\\s|$)`, 'g')
-		instructions = instructions.replace(re, (_m, lead, trail) => {
+		draft.text = draft.text.replace(re, (_m, lead, trail) => {
 			// Boundary on at least one side → drop the mention entirely.
 			if (!lead || !trail) return ''
 			// Middle of text: keep ONE of the bracketing whitespace chars so
@@ -296,12 +447,23 @@
 	export function restoreInstructions(
 		value: string,
 		restoredPastes: PasteAttachment[] = [],
-		restoredImages: AttachedImage[] = []
+		restoredImages: AttachedImage[] = [],
+		restoredFiles: AttachedTextFile[] = []
 	): boolean {
-		if (instructions.trim() || images.length > 0 || pendingImages > 0) return false
-		instructions = value
-		pastes = restoredPastes
-		images = restoredImages
+		// Attachments still decoding/reading (or mid-drop-routing) count as
+		// occupancy too — they belong to a draft the user started even though
+		// their lane is still empty.
+		if (pendingImages > 0 || pendingFiles > 0 || ingestionHolds > 0) return false
+		if (
+			!draft.replaceIfEmpty({
+				text: value,
+				pastes: restoredPastes,
+				images: restoredImages,
+				files: restoredFiles
+			})
+		) {
+			return false
+		}
 		focusInput()
 		return true
 	}
@@ -311,24 +473,30 @@
 	 * the user typed is lost. Restored images join whatever is already
 	 * attached, up to the cap — dropping them would lose the attachment
 	 * silently, which is the whole reason the queue carries them. */
-	export function prependText(text: string, restoredImages: AttachedImage[] = []): boolean {
-		// Whether the restored text landed on top of a draft the user was already
-		// writing: both instructions now share one composer, so the caller must keep
-		// both their contexts rather than replacing one with the other.
-		const mergedIntoDraft = !!text && !!instructions.trim()
-		// An image-only restore has empty text; prepending it would only add blank lines.
-		if (text) {
-			instructions = instructions.trim() ? `${text}\n\n${instructions}` : text
+	export function prependText(
+		text: string,
+		restoredImages: AttachedImage[] = [],
+		restoredFiles: AttachedTextFile[] = []
+	): boolean {
+		// mergedIntoDraft: the restored text landed on top of a draft the user was
+		// already writing — both instructions now share one composer, so the caller
+		// must keep both their contexts rather than replacing one with the other.
+		const { mergedIntoDraft, droppedImages, droppedFiles } = draft.prepend({
+			text,
+			images: restoredImages,
+			files: restoredFiles
+		})
+		if (droppedImages > 0) {
+			sendUserToast(
+				`You can attach up to ${MAX_ATTACHED_IMAGES} images; ${droppedImages} restored image(s) were dropped.`,
+				true
+			)
 		}
-		if (restoredImages.length > 0) {
-			const merged = [...images, ...restoredImages]
-			if (merged.length > MAX_ATTACHED_IMAGES) {
-				sendUserToast(
-					`You can attach up to ${MAX_ATTACHED_IMAGES} images; ${merged.length - MAX_ATTACHED_IMAGES} restored image(s) were dropped.`,
-					true
-				)
-			}
-			images = merged.slice(0, MAX_ATTACHED_IMAGES)
+		if (droppedFiles > 0) {
+			sendUserToast(
+				`You can attach up to ${MAX_ATTACHED_FILES} files; ${droppedFiles} restored file(s) were dropped.`,
+				true
+			)
 		}
 		focusInput()
 		return mergedIntoDraft
@@ -336,8 +504,8 @@
 
 	/** Insert a plain @filename mention for an attached file (used by the @ menu Files category). */
 	export function insertFileMention(name: string) {
-		const sep = instructions.length === 0 || instructions.endsWith(' ') ? '' : ' '
-		instructions = `${instructions}${sep}${formatMention(name)} `
+		const sep = draft.text.length === 0 || draft.text.endsWith(' ') ? '' : ' '
+		draft.text = `${draft.text}${sep}${formatMention(name)} `
 		focusInput()
 	}
 
@@ -429,8 +597,8 @@
 
 	function sendRequest() {
 		// The send button is disabled while decoding, but Enter reaches here directly.
-		// Sending now would drop the in-flight images onto the following message.
-		if (pendingImages > 0) {
+		// Sending now would drop the in-flight attachments onto the following message.
+		if (pendingImages > 0 || pendingFiles > 0 || ingestionHolds > 0) {
 			return
 		}
 		if (aiChatManager.loading) {
@@ -444,17 +612,16 @@
 			// chips picked at press time.
 			if (
 				editingMessageIndex === null &&
-				(instructions.trim() ||
-					images.length > 0 ||
-					(aiChatManager.mode === AIMode.GLOBAL && selectedContext.length > 0))
+				(!draft.isEmpty || (aiChatManager.mode === AIMode.GLOBAL && selectedContext.length > 0))
 			) {
-				aiChatManager.queueMessage(expanded(chatDraft(instructions, pastes)), images, [
-					...selectedContext
-				])
+				const sent = draft.take()
+				aiChatManager.queueMessage(
+					expanded(chatDraft(sent.text, sent.pastes)),
+					sent.images,
+					[...selectedContext],
+					sent.files
+				)
 				contextTextareaComponent?.clearForSend()
-				instructions = ''
-				pastes = []
-				images = []
 			}
 			return
 		}
@@ -462,25 +629,30 @@
 			// In edit mode selectedContext is the edit box's own copy (seeded from the
 			// message's original chips), so send exactly what's shown — the user may
 			// have added or removed chips.
+			const sent = draft.take()
 			aiChatManager.restartGeneration(
 				editingMessageIndex,
-				instructions,
-				pastes,
-				images,
-				selectedContext
+				sent.text,
+				sent.pastes,
+				sent.images,
+				selectedContext,
+				sent.files
 			)
 			onEditEnd()
 		} else {
-			aiChatManager.sendRequest({ instructions, pastes, images })
+			const sent = draft.take()
+			aiChatManager.sendRequest({
+				instructions: sent.text,
+				pastes: sent.pastes,
+				images: sent.images,
+				files: sent.files
+			})
 			// clearForSend() pre-zaps the textarea's mention-sync so the wipe
 			// doesn't drop `selectedContext` before `AIChatManager.beforeSend`
 			// snapshots it. Only mounted in SCRIPT/FLOW/GLOBAL — APP and the
-			// fallback textarea still rely on the plain `instructions = ''`
-			// reset (no `@`-mention state to coordinate).
+			// fallback textarea still rely on the draft reset alone (no
+			// `@`-mention state to coordinate).
 			contextTextareaComponent?.clearForSend()
-			instructions = ''
-			pastes = []
-			images = []
 		}
 	}
 
@@ -489,7 +661,7 @@
 	// for the conversation bubble and expands them for the LLM inside the manager.
 	function submitRequest() {
 		if (onSendRequest) {
-			onSendRequest(expanded(chatDraft(instructions, pastes)))
+			onSendRequest(expanded(chatDraft(draft.text, draft.pastes)))
 		} else {
 			sendRequest()
 		}
@@ -661,7 +833,7 @@
 	}
 
 	function handleAppInput(_e: Event) {
-		const words = instructions.split(/\s+/)
+		const words = draft.text.split(/\s+/)
 		const lastWord = words[words.length - 1]
 
 		if (
@@ -680,9 +852,9 @@
 	function handleAppContextSelection(contextElement: ContextElement) {
 		void addContextToSelection(contextElement)
 		// Update instructions with the selected context title
-		const index = instructions.lastIndexOf('@')
+		const index = draft.text.lastIndexOf('@')
 		if (index !== -1) {
-			instructions = instructions.substring(0, index) + `@${contextElement.title}`
+			draft.text = draft.text.substring(0, index) + `@${contextElement.title}`
 		}
 		showAppContextTooltip = false
 	}
@@ -696,7 +868,7 @@
 
 {#snippet sendStopButton()}
 	{@const isLoading = loading ?? aiChatManager.loading}
-	{@const emptyDraft = instructions.trim().length === 0 && images.length === 0}
+	{@const emptyDraft = draft.isEmpty}
 	<!-- A text-free GLOBAL draft with context chips is a valid turn (Enter
 	     already sends it), so the button stays enabled there for pointer/touch
 	     parity — mirrors the sendRequest guard. Custom onSendRequest consumers
@@ -704,6 +876,8 @@
 	{@const sendDisabled =
 		disabled ||
 		pendingImages > 0 ||
+		pendingFiles > 0 ||
+		ingestionHolds > 0 ||
 		(emptyDraft &&
 			(onSendRequest !== undefined ||
 				aiChatManager.mode !== AIMode.GLOBAL ||
@@ -725,45 +899,47 @@
 	/>
 {/snippet}
 
-{#snippet contextPickerRow()}
-	{#if selectedContext.length > 0}
+<!-- One wrapping row for every badge-shaped chip: selected context (or, when the
+     picker row is hidden — showContext=false in GLOBAL/session mode — the raw-app
+     inspector's DOM picks, which always show), then message files. Only image
+     thumbnails get their own row (different height). -->
+{#snippet badgeRow()}
+	{@const contextChips = showContext ? selectedContext : domSelectorChips}
+	{#if contextChips.length > 0 || draft.files.length > 0 || pendingFiles > 0}
 		<div class="flex flex-row flex-wrap items-center gap-1 px-2.5 pt-2">
-			{#each selectedContext as element (contextKey(element))}
+			{#each contextChips as element (contextKey(element))}
 				<ContextElementBadge
 					contextElement={element}
 					deletable
 					onDelete={() => {
 						selectedContext = selectedContext?.filter((c) => !isSameContextElement(c, element))
-						removeMention(element.title)
+						if (showContext) removeMention(element.title)
 					}}
 				/>
 			{/each}
-		</div>
-	{/if}
-{/snippet}
-
-<!-- DOM selector chips (raw-app inspector picks) always show — even in GLOBAL/
-     session mode where the general context picker row is hidden (showContext=false). -->
-{#snippet domSelectorChipRow()}
-	{#if domSelectorChips.length > 0}
-		<div class="flex flex-row flex-wrap items-center gap-1 px-2.5 pt-2">
-			{#each domSelectorChips as element (contextKey(element))}
+			{#each draft.files as file, i (i)}
 				<ContextElementBadge
-					contextElement={element}
+					contextElement={createAttachedFileContextElement(file.name, file.content)}
 					deletable
-					onDelete={() => {
-						selectedContext = selectedContext?.filter((c) => !isSameContextElement(c, element))
-					}}
+					onDelete={() => removeFile(i)}
 				/>
 			{/each}
+			{#each { length: pendingFiles } as _, i (i)}
+				<div
+					class="h-6 w-24 rounded-md border bg-surface flex items-center justify-center"
+					title="Reading file..."
+				>
+					<Loader2 size={14} class="animate-spin text-tertiary" />
+				</div>
+			{/each}
 		</div>
 	{/if}
 {/snippet}
 
 {#snippet imageChipsRow()}
-	{#if images.length > 0 || pendingImages > 0}
-		<div class="flex flex-row flex-wrap items-center gap-1.5 mb-1">
-			{#each images as image, i (i)}
+	{#if draft.images.length > 0 || pendingImages > 0}
+		<div class="flex flex-row flex-wrap items-center gap-1.5 px-2.5 pt-2">
+			{#each draft.images as image, i (i)}
 				<div class="relative group">
 					<!-- The chip is a 48px object-cover crop, so the expanded view is the only
 					     way to check what was actually attached before sending it. -->
@@ -811,10 +987,13 @@
 		<div class="relative">
 			<ContextTextarea
 				bind:this={contextTextareaComponent}
-				bind:value={instructions}
-				bind:pastes
+				bind:value={draft.text}
+				bind:pastes={draft.pastes}
 				onImageFiles={aiChatManager.mode === AIMode.GLOBAL
-					? (files) => void addImages(files)
+					? (pasted) => void addImages(pasted)
+					: undefined}
+				onTextFiles={aiChatManager.mode === AIMode.GLOBAL
+					? (pasted) => void addTextFiles(pasted)
 					: undefined}
 				{availableContext}
 				{selectedContext}
@@ -833,16 +1012,7 @@
 				{onKeyDown}
 			>
 				{#snippet leading()}
-					{#if aiChatManager.mode === AIMode.GLOBAL}
-						<div class="px-2.5 empty:hidden">
-							<AttachedFilesBar />
-						</div>
-					{/if}
-					{#if showContext}
-						{@render contextPickerRow()}
-					{:else}
-						{@render domSelectorChipRow()}
-					{/if}
+					{@render badgeRow()}
 					{@render imageChipsRow()}
 				{/snippet}
 			</ContextTextarea>
@@ -854,12 +1024,12 @@
 		</div>
 	{:else if aiChatManager.mode === AIMode.APP}
 		{#if showContext}
-			{@render contextPickerRow()}
+			{@render badgeRow()}
 		{/if}
 		<div class={twMerge('relative w-full scroll-pb-2', className)}>
 			<textarea
 				bind:this={instructionsTextareaComponent}
-				bind:value={instructions}
+				bind:value={draft.text}
 				use:autosize={{ maxHeight: '40vh' }}
 				oninput={handleAppInput}
 				onblur={() => {
@@ -923,7 +1093,7 @@
 		<div class={twMerge('relative w-full scroll-pb-2 pt-2', className)}>
 			<textarea
 				bind:this={instructionsTextareaComponent}
-				bind:value={instructions}
+				bind:value={draft.text}
 				use:autosize={{ maxHeight: '40vh' }}
 				onkeydown={(e) => {
 					if (onKeyDown) {
diff --git a/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts b/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
index 4c4304f27b..d33a0ded8e 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
+++ b/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
@@ -54,7 +54,8 @@ import {
 	buildSummaryMessageContent
 } from './compactionPrompt'
 import { dfs } from '$lib/components/flows/previousResults'
-import { SvelteSet } from 'svelte/reactivity'
+import { SvelteMap, SvelteSet } from 'svelte/reactivity'
+import { createLongHash } from '$lib/editorLangUtils'
 import type { UserDraftItemKind } from '$lib/gen'
 import { maskKey } from '$lib/components/sessions/modifiedItemsMask'
 import { getStringError } from './utils'
@@ -67,6 +68,14 @@ import {
 	stripImagePartsFromMessages
 } from './imageUtils'
 import { chatDraft, expanded } from './chatDraft'
+import { MessageDraft, type DraftSnapshot } from './messageDraft.svelte'
+import {
+	MAX_ATTACHED_FILES,
+	sanitizeAttachmentName,
+	textByteLength,
+	withAttachedTextFileIds,
+	type AttachedTextFile
+} from './textFileUtils'
 import type { FlowModuleState, FlowState } from '$lib/components/flows/flowState'
 import type { CurrentEditor, ExtendedOpenFlow } from '$lib/components/flows/types'
 import { untrack } from 'svelte'
@@ -325,9 +334,12 @@ function getSendRequestErrorMessage(err: unknown, webSearchUnavailable: boolean)
 	return appendWebSearchErrorHint(message, webSearchUnavailable)
 }
 
-/** A message queued while a turn streams: text, images and the pinned context
- * snapshot always move together so a flush can't drop one. */
-type QueuedEntry = { text: string; images: AttachedImage[]; context: ContextElement[] | undefined }
+/** A message queued while a turn streams: the draft lanes and the pinned
+ * context snapshot always move together so a flush can't drop one. */
+type QueuedEntry = {
+	draft: DraftSnapshot
+	context: ContextElement[] | undefined
+}
 
 export class AIChatManager {
 	contextManager = new ContextManager()
@@ -347,20 +359,29 @@ export class AIChatManager {
 	savedSize = $state<number>(0)
 	instructions = $state<string>('')
 	pendingPrompt = $state<string>('')
-	// Message typed while a turn is streaming. There is only ever one queued
-	// message; pressing Enter again appends another line to it. Auto-sent when
+	// Message queued while a turn is streaming. There is only ever one queued
+	// draft; pressing Enter again appends another line to it. Auto-sent when
 	// the turn finishes (clean completion or user cancel). Ephemeral — never
-	// saved to displayMessages or history.
-	queuedMessage = $state<string>('')
+	// saved to displayMessages or history. Owning it as a MessageDraft means
+	// every aggregation applies the draft rules (fold, caps, lanes move
+	// together) instead of re-implementing them here.
+	#queuedDraft = new MessageDraft()
 	// Context snapshot to send WITH the queued message, when it must stay scoped to
 	// what was selected at queue time (e.g. an inline element prompt submitted mid-
 	// stream) rather than the live selection, which may change before the flush.
 	queuedContext = $state<ContextElement[] | undefined>(undefined)
-	// Images attached to that message. Kept beside the text rather than inside it
-	// because the queued chip renders `queuedMessage` as a plain string. Always
-	// move the two together — #takeQueue/#clearQueue/#restoreQueue exist so no
-	// call site can drop one and auto-send a message the user never wrote.
-	queuedImages = $state<AttachedImage[]>([])
+	get queuedMessage(): string {
+		return this.#queuedDraft.text
+	}
+	set queuedMessage(text: string) {
+		this.#queuedDraft.text = text
+	}
+	get queuedImages(): AttachedImage[] {
+		return this.#queuedDraft.images
+	}
+	get queuedFiles(): AttachedTextFile[] {
+		return this.#queuedDraft.files
+	}
 	// Jobs the chat started that detached into the background (global/sessions
 	// chat only). Rendered in the jobs tray, persisted with the chat, and advanced
 	// by a single background poller. See registerJob / #pollBackgroundJobs.
@@ -1084,8 +1105,12 @@ export class AIChatManager {
 		// "counterpart gone": storedImages finds nothing there, and restart maps
 		// it to an empty history (everything before it was dropped too, since
 		// compaction only removes prefixes).
+		// A summary row also carries its API index (for orphan detection) — re-base it
+		// too so it reads "counterpart gone" once drop-oldest removes the summary.
 		this.displayMessages = this.displayMessages.map((m) =>
-			m.role === 'user' ? { ...m, index: m.index - drop } : m
+			m.role === 'user' || (m.role === 'summary' && m.index !== undefined)
+				? { ...m, index: m.index! - drop }
+				: m
 		)
 		return freed
 	}
@@ -1131,13 +1156,43 @@ export class AIChatManager {
 				return 'empty'
 			}
 
-			this.messages = [{ role: 'user', content: buildSummaryMessageContent(formatted) }, ...tail]
+			// Files attached to folded-away messages ride the summary: the transcript
+			// is their durable home, so dropping the referencing message without
+			// carrying them would lose the attachment entirely. Deduped by stable id:
+			// several folded turns can carry the identical file, and the summary must
+			// list/keep it once.
+			const carriedById = new Map<string, AttachedTextFile>()
+			for (const m of this.displayMessages.slice(0, displayKeepFrom)) {
+				if ((m.role === 'user' || m.role === 'summary') && m.files) {
+					for (const f of withAttachedTextFileIds(m.files)) carriedById.set(f.id!, f)
+				}
+			}
+			const carriedFiles = [...carriedById.values()]
+			const filesNote =
+				carriedFiles.length > 0
+					? '\n\nThe user attached these files earlier in this conversation; they are still readable via `read_file` / `search_files` (pass the file id):\n' +
+						carriedFiles
+							.map((f) => `- ${sanitizeAttachmentName(f.name)} (file id: ${f.id})`)
+							.join('\n')
+					: ''
+
+			this.messages = [
+				{ role: 'user', content: buildSummaryMessageContent(formatted) + filesNote },
+				...tail
+			]
 
 			// Replace the summarized display prefix with the boundary marker and
 			// re-base the surviving tail's restart indices (the summary occupies
 			// slot 0, so the tail now starts at slot 1).
 			this.displayMessages = [
-				{ role: 'summary', content: formatted },
+				{
+					role: 'summary',
+					content: formatted,
+					// The summary API message sits at slot 0 of the rewritten history; track
+					// it so a later drop-oldest that removes it can orphan the carried files.
+					index: 0,
+					files: carriedFiles.length > 0 ? carriedFiles : undefined
+				},
 				...this.displayMessages
 					.slice(displayKeepFrom)
 					.map((m) => (m.role === 'user' ? { ...m, index: m.index - keepFrom + 1 } : m))
@@ -1293,6 +1348,9 @@ export class AIChatManager {
 			)
 			switch (result) {
 				case 'ok':
+					// Reconcile file registrations with the compacted transcript — the
+					// summary message carries the folded-away turns' files forward.
+					this.#syncMessageFiles()
 					await this.historyManager.saveChat(
 						this.displayMessages,
 						this.messages,
@@ -1320,8 +1378,9 @@ export class AIChatManager {
 		if ((result === 'ok' || this.wasCancelledByUser()) && this.#hasQueuedMessage()) {
 			const next = this.#takeQueue()
 			const accepted = await this.sendRequest({
-				instructions: next.text,
-				images: next.images,
+				instructions: next.draft.text,
+				images: next.draft.images,
+				files: next.draft.files,
 				contextOverride: next.context,
 				queued: true
 			})
@@ -1462,22 +1521,31 @@ export class AIChatManager {
 	 * one queued message; pressing Enter again appends the new text as another
 	 * line so it all goes out as a single message, and its images accumulate
 	 * alongside it. */
-	queueMessage(text: string, images: AttachedImage[] = [], context?: ContextElement[]) {
+	queueMessage(
+		text: string,
+		images: AttachedImage[] = [],
+		context?: ContextElement[],
+		files: AttachedTextFile[] = []
+	) {
 		const trimmed = text.trim()
-		// An image-only or context-only draft is still a message; only a fully
+		// An attachment-only or context-only draft is still a message; only a fully
 		// empty send is ignored (mirrors the idle empty-send guard).
-		if (!trimmed && images.length === 0 && (context?.length ?? 0) === 0) {
+		if (!trimmed && images.length === 0 && files.length === 0 && (context?.length ?? 0) === 0) {
 			return
 		}
 		if (trimmed) {
 			this.queuedMessage = this.queuedMessage ? `${this.queuedMessage}\n${trimmed}` : trimmed
 		}
-		if (images.length > 0) {
-			const merged = [...this.queuedImages, ...images]
-			if (merged.length > MAX_ATTACHED_IMAGES) {
-				sendUserToast(`Only the first ${MAX_ATTACHED_IMAGES} images are kept.`, true)
-			}
-			this.queuedImages = merged.slice(0, MAX_ATTACHED_IMAGES)
+		// The queue is a message draft like any other: attachments join under the
+		// draft rules (fold, caps) — repeated submissions during one stream
+		// aggregate into a single queued message.
+		const droppedImages = images.length > 0 ? this.#queuedDraft.addImages(images) : 0
+		if (droppedImages > 0) {
+			sendUserToast(`Only the first ${MAX_ATTACHED_IMAGES} images are kept.`, true)
+		}
+		const droppedFiles = files.length > 0 ? this.#queuedDraft.addFiles(files).droppedAtCap : 0
+		if (droppedFiles > 0) {
+			sendUserToast(`Only the first ${MAX_ATTACHED_FILES} files are kept.`, true)
 		}
 		// Pin the context snapshot to the queued message. Several prompts can
 		// queue during one stream and each pinned the selection at its press —
@@ -1494,38 +1562,47 @@ export class AIChatManager {
 		}
 	}
 
-	/** Whether anything is waiting in the queue — an image-only or context-only
-	 * message has empty text. */
+	/** Whether anything is waiting in the queue — an attachment-only or
+	 * context-only message has empty text. */
 	#hasQueuedMessage(): boolean {
-		return (
-			this.queuedMessage !== '' ||
-			this.queuedImages.length > 0 ||
-			(this.queuedContext?.length ?? 0) > 0
-		)
+		return !this.#queuedDraft.isEmpty || (this.queuedContext?.length ?? 0) > 0
 	}
 
-	/** Detach the queue for sending. Text, images and context always leave together. */
+	/** Detach the queue for sending. The draft lanes and context always leave together. */
 	#takeQueue(): QueuedEntry {
 		const taken = {
-			text: this.queuedMessage,
-			images: this.queuedImages,
+			draft: this.#queuedDraft.take(),
 			context: this.queuedContext
 		}
-		this.#clearQueue()
+		this.queuedContext = undefined
 		return taken
 	}
 
 	#clearQueue() {
-		this.queuedMessage = ''
-		this.queuedImages = []
+		this.#queuedDraft.clear()
 		this.queuedContext = undefined
 	}
 
-	/** Put a taken queue back after an auto-send bailed before becoming a turn. */
+	/** Put a taken queue back after an auto-send bailed before becoming a turn.
+	 * Merged, not replaced: the user may have queued a follow-up while the
+	 * auto-send was in preflight, and clobbering it would silently lose it — the
+	 * taken entry's lanes land ahead of the follow-up's (they were written
+	 * first) and both entries' pinned contexts are unioned. */
 	#restoreQueue(queued: QueuedEntry) {
-		this.queuedMessage = queued.text
-		this.queuedImages = queued.images
-		this.queuedContext = queued.context
+		this.#queuedDraft.prepend({
+			text: queued.draft.text,
+			images: queued.draft.images,
+			files: queued.draft.files
+		})
+		if (queued.context?.length) {
+			const merged = [...queued.context]
+			for (const c of this.queuedContext ?? []) {
+				if (!merged.some((m) => isSameContextElement(m, c))) {
+					merged.push(c)
+				}
+			}
+			this.queuedContext = merged
+		}
 	}
 
 	/** Put a draft's pinned DOM selector chips back as the live selection, so the
@@ -1559,7 +1636,11 @@ export class AIChatManager {
 			return
 		}
 		const queued = this.#takeQueue()
-		const mergedIntoDraft = this.restoreToInput(queued.text, queued.images)
+		const mergedIntoDraft = this.restoreToInput(
+			queued.draft.text,
+			queued.draft.images,
+			queued.draft.files
+		)
 		// The queued draft pinned its own DOM context; restore it so sending from
 		// the composer targets the element the draft was written for, not whatever
 		// is selected now. If its text was prepended onto an existing draft, that
@@ -1570,12 +1651,17 @@ export class AIChatManager {
 	/** Put what the user typed back where they can see it: into the input
 	 * when it's mounted, otherwise back into the queue so it reappears with
 	 * the chat panel instead of being silently dropped. */
-	private restoreToInput(text: string, images: AttachedImage[] = []): boolean {
+	private restoreToInput(
+		text: string,
+		images: AttachedImage[] = [],
+		files: AttachedTextFile[] = []
+	): boolean {
 		if (this.aiChatInput) {
-			return this.aiChatInput.prependText(text, images) === true
+			return this.aiChatInput.prependText(text, images, files) === true
 		}
-		this.queuedMessage = text
-		this.queuedImages = images
+		// Merge onto anything already queued (see #restoreQueue) — replacing would
+		// silently drop a message queued while this one was in flight.
+		this.#queuedDraft.prepend({ text, images, files })
 		return false
 	}
 
@@ -1967,19 +2053,130 @@ export class AIChatManager {
 	// is false when a queued message is about to take over (a user cancel with
 	// something queued) — then the rolled-back prompt is dropped rather than
 	// shoved back into the input, so the handoff to the queued message is clean.
-	private restoreUnsentTurn = (
+	private restoreUnsentTurn = async (
 		displayLenAfterUser: number,
 		modelLenAfterUser: number,
 		instructions: string,
 		pastes: PasteAttachment[],
 		restoreToInput: boolean = true,
-		images: AttachedImage[] = []
-	): boolean => {
+		images: AttachedImage[] = [],
+		files: AttachedTextFile[] = []
+	): Promise<boolean> => {
 		this.displayMessages = this.displayMessages.slice(0, displayLenAfterUser - 1)
 		this.messages = this.messages.slice(0, modelLenAfterUser - 1)
+		// The rolled-back turn's files must not stay registered: the message
+		// referencing them is gone, so leaving them would keep stale content
+		// readable by the tools on later turns.
+		this.#syncMessageFiles()
 		if (!restoreToInput) return false
 		// An occupied composer declines the restore and keeps its own draft.
-		return this.aiChatInput?.restoreInstructions(instructions, pastes, images) === true
+		return this.aiChatInput?.restoreInstructions(instructions, pastes, images, files) === true
+	}
+
+	// Bytes each live composer has staged toward its next send (committed
+	// attachments + in-flight reads), keyed per composer instance. While a
+	// message is being edited the bottom composer and the edit box are both
+	// mounted; each must see the other's stage or two attaches could each spend
+	// the full conversation budget and overflow the persisted transcript.
+	#composerStaged = new SvelteMap<string, { editingIndex: number | null; bytes: number }>()
+
+	setComposerStaged(key: string, editingIndex: number | null, bytes: number) {
+		this.#composerStaged.set(key, { editingIndex, bytes })
+	}
+
+	clearComposerStaged(key: string) {
+		this.#composerStaged.delete(key)
+	}
+
+	/** Release the outgoing-files reservation identified by `key` (a per-send token).
+	 * Called once when sendRequest installs the bubble (the transcript then accounts
+	 * the files) and on every sendRequest path that exits before install — abandoning
+	 * the send leaves the files in the composer/queue, which reserves them, so a
+	 * stranded reservation would double-charge. Keyed per send so one send never
+	 * releases a reservation another owns. */
+	#releaseOutgoingReservation(key: string | undefined) {
+		if (key) this.clearComposerStaged(key)
+	}
+
+	/** Attached-file bytes counted against MAX_CONVERSATION_FILE_BYTES by
+	 * everything except composer `selfKey` (whose stage replaces its own edited
+	 * message). A message ANOTHER composer is editing charges max(persisted,
+	 * editor stage): a cancelled edit returns the persisted attachments. */
+	attachmentBytesExcluding(selfKey: string): number {
+		const selfEditing = this.#composerStaged.get(selfKey)?.editingIndex ?? null
+		const otherEdits = new Map<number, number>()
+		for (const [k, v] of this.#composerStaged) {
+			if (k !== selfKey && v.editingIndex !== null) otherEdits.set(v.editingIndex, v.bytes)
+		}
+		let total = 0
+		for (const [i, m] of this.displayMessages.entries()) {
+			if (i === selfEditing) continue
+			let persisted = 0
+			if ((m.role === 'user' || m.role === 'summary') && m.files) {
+				for (const f of m.files) persisted += textByteLength(f.content)
+			}
+			const editorStage = otherEdits.get(i)
+			total += editorStage !== undefined ? Math.max(persisted, editorStage) : persisted
+		}
+		for (const f of this.queuedFiles) total += textByteLength(f.content)
+		// Composers not tied to an edited message stage genuinely new bytes;
+		// editing composers were already accounted via the per-message max above.
+		for (const [k, v] of this.#composerStaged) {
+			if (k !== selfKey && v.editingIndex === null) total += v.bytes
+		}
+		return total
+	}
+
+	/** Reconcile the store's message-scoped file rows with what the transcript
+	 * references, joined on the stable file id. Runs on chat load/clear, after
+	 * rollbacks/truncations, and after compaction, so a chip the user can see is
+	 * always readable and a dropped message's file never lingers in the tool
+	 * surface. Also the single hydration point for transcripts persisted before
+	 * ids existed: the id is a deterministic content hash, so legacy rows gain
+	 * their permanent id here with no migration state. */
+	#syncMessageFiles = (): void => {
+		let hydrated = false
+		const withIds = this.displayMessages.map((m) => {
+			if ((m.role === 'user' || m.role === 'summary') && m.files?.some((f) => !f.id)) {
+				hydrated = true
+				return { ...m, files: withAttachedTextFileIds(m.files) }
+			}
+			return m
+		})
+		if (hydrated) this.displayMessages = withIds
+		const wanted = new Map<string, AttachedTextFile & { id: string }>()
+		for (const m of this.displayMessages) {
+			// Summary messages carry the files of the turns they folded away.
+			if ((m.role === 'user' || m.role === 'summary') && m.files) {
+				for (const f of m.files) wanted.set(f.id!, f as AttachedTextFile & { id: string })
+			}
+		}
+		try {
+			this.attachedFiles.syncMessageScoped([...wanted.values()])
+		} catch (e) {
+			console.error('Failed to sync message-attached files', e)
+		}
+	}
+
+	/** Ids of message-scoped files whose only referencing user messages were
+	 * dropped from the API history by drop-oldest compaction (a negative `index`
+	 * marks a message whose API counterpart is gone). Their `## ATTACHED FILES`
+	 * reference no longer reaches the model — unlike summary compaction, which
+	 * carries the reference on the summary — so the roster must advertise them.
+	 * A file still referenced by a surviving message is not orphaned. */
+	orphanedMessageFileIds(): Set<string> {
+		const live = new Set<string>()
+		const dropped = new Set<string>()
+		for (const m of this.displayMessages) {
+			if ((m.role === 'user' || m.role === 'summary') && m.files) {
+				// A summary carries its files' reference in its own API message; that too
+				// can be dropped by a later drop-oldest (negative index), orphaning them.
+				const gone = m.index !== undefined && m.index < 0
+				for (const f of m.files) (gone ? dropped : live).add(f.id ?? f.name)
+			}
+		}
+		for (const n of live) dropped.delete(n)
+		return dropped
 	}
 
 	private notifyReasoningSummaryUnavailable = () => {
@@ -2031,7 +2228,11 @@ export class AIChatManager {
 					// Inject the attached-files roster at request time (re-read each iteration)
 					// so it always reflects the live file list without reactive bookkeeping.
 					if (self.mode === AIMode.GLOBAL && self.attachedFiles.count > 0) {
-						return appendAttachedFilesRoster(base, self.attachedFiles)
+						return appendAttachedFilesRoster(
+							base,
+							self.attachedFiles,
+							self.orphanedMessageFileIds()
+						)
 					}
 					return base
 				},
@@ -2220,6 +2421,7 @@ export class AIChatManager {
 			instructions?: string
 			pastes?: PasteAttachment[]
 			images?: AttachedImage[]
+			files?: AttachedTextFile[]
 			mode?: AIMode
 			lang?: ScriptLang | 'bunnative'
 			isPreprocessor?: boolean
@@ -2237,6 +2439,10 @@ export class AIChatManager {
 			 * it, so the composer restore must not also fire (the draft would exist
 			 * twice — queue chip and composer). */
 			queued?: boolean
+			/** Per-resend reservation token (see restartGeneration): the bytes staged
+			 * under it are released once this send installs its bubble or exits before
+			 * install. Absent on normal sends, so they never touch a resend's reservation. */
+			resendReservationKey?: string
 		} = {}
 	) => {
 		// Returns whether the input was consumed: true when it was sent as a chat
@@ -2244,8 +2450,17 @@ export class AIChatManager {
 		// without being acted on (mode hidden, empty non-GLOBAL draft, beforeSend
 		// failed). The queue flush restores the queued message only on false, so a
 		// consumed command isn't re-queued and re-fired into the next conversation.
+		//
+		// Reservation token for this send's outgoing files. A resend arrives with one
+		// already set by restartGeneration (it must reserve earlier, before its own
+		// pre-send slice); a normal/queued send mints one below, just before the
+		// attachment-upkeep awaits open a gap. Released once the bubble installs or the
+		// send exits before install. Kept in a mutable local so every exit path
+		// releases the right key.
+		let reservationKey = options.resendReservationKey
 		const requestedMode = options.mode ?? this.mode
 		if (!isAIModeVisible(requestedMode)) {
+			this.#releaseOutgoingReservation(reservationKey)
 			return false
 		}
 		this.changeMode(requestedMode, undefined, {
@@ -2260,16 +2475,22 @@ export class AIChatManager {
 		}
 		// A text-free GLOBAL draft is a real turn — rendered as its context chips
 		// (no bubble), with the empty-message marker substituted further down —
-		// but only when it carries something for the model: images or selected
-		// context elements. A bare accidental Enter is dropped in every mode (in
-		// editor copilots it would burn a turn for nothing). Gate on requestedMode,
-		// not this.mode: changeMode can decline a switch (e.g. SCRIPT with no
-		// model), and a declined non-GLOBAL request must not slip through as a
-		// GLOBAL empty turn. Image-bearing non-GLOBAL drafts still pass through
-		// to the switch-back refusal below so attachments aren't silently lost.
-		if (!this.instructions.trim() && (options.images?.length ?? 0) === 0) {
+		// but only when it carries something for the model: images, files, or
+		// selected context elements. A bare accidental Enter is dropped in every
+		// mode (in editor copilots it would burn a turn for nothing). Gate on
+		// requestedMode, not this.mode: changeMode can decline a switch (e.g.
+		// SCRIPT with no model), and a declined non-GLOBAL request must not slip
+		// through as a GLOBAL empty turn. Attachment-bearing non-GLOBAL drafts
+		// still pass through to the switch-back refusal below so attachments
+		// aren't silently lost.
+		if (
+			!this.instructions.trim() &&
+			(options.images?.length ?? 0) === 0 &&
+			(options.files?.length ?? 0) === 0
+		) {
 			const contextEls = options.contextOverride ?? this.contextManager?.getSelectedContext() ?? []
 			if (requestedMode !== AIMode.GLOBAL || contextEls.length === 0) {
+				this.#releaseOutgoingReservation(reservationKey)
 				return false
 			}
 		}
@@ -2281,6 +2502,11 @@ export class AIChatManager {
 		// conversation.
 		if (this.isSessionChat && this.mode === AIMode.GLOBAL) {
 			const trimmed = this.instructions.trim()
+			// A local command consumes the send without installing a bubble; an edit
+			// resolved to `/clear` or `/compact` must not strand its resend reservation.
+			if (COMPACT_COMMAND_RE.test(trimmed) || CLEAR_COMMAND_RE.test(trimmed)) {
+				this.#releaseOutgoingReservation(reservationKey)
+			}
 			// `/compact`: summarize the conversation locally to free up context.
 			if (COMPACT_COMMAND_RE.test(trimmed)) {
 				this.instructions = ''
@@ -2294,6 +2520,19 @@ export class AIChatManager {
 				return true
 			}
 		}
+		// Reserve the outgoing files' bytes now, before the upkeep awaits below: the
+		// composer (or queue) already cleared them, so without this reservation they
+		// are unaccounted during the gap and a fresh drop could spend the same
+		// headroom, overflowing the cap once this bubble lands. A resend already holds
+		// its own reservation (reused via reservationKey), so only mint for others.
+		if (!reservationKey && (options.files?.length ?? 0) > 0) {
+			reservationKey = `send:${createLongHash()}`
+			this.setComposerStaged(
+				reservationKey,
+				null,
+				options.files!.reduce((sum, f) => sum + textByteLength(f.content), 0)
+			)
+		}
 		// Re-grant any locked File System Access handles within this send gesture, so the
 		// file tools can read the live files. requestPermission() needs a user gesture, and
 		// this runs before the first await/network call while the Send click is still active.
@@ -2313,17 +2552,31 @@ export class AIChatManager {
 		// Context elements and the snapshot are attached after beforeSend (see below).
 		const isFirstUserTurn = !this.displayMessages.some((message) => message.role === 'user')
 		const pastes = options.pastes ?? []
-		// Images ride only on GLOBAL turns, but the composer stays mounted across
-		// a mode switch, so chips attached in GLOBAL can arrive with a send in any
-		// mode. Refuse and restore rather than silently dropping attachments the
-		// user can see. This sits past the awaits above on purpose: the composer
-		// clears itself synchronously right after calling sendRequest, so an
-		// earlier restore would be wiped. Queued drafts are the caller's to
-		// restore (it re-queues on false).
-		if ((options.images?.length ?? 0) > 0 && this.mode !== AIMode.GLOBAL) {
-			sendUserToast('Switch back to the chat mode to send images. Your message was kept.', true)
+		// Attachments (images, text files) ride only on GLOBAL turns, but the
+		// composer stays mounted across a mode switch, so chips attached in GLOBAL
+		// can arrive with a send in any mode. Refuse and restore rather than
+		// silently dropping attachments the user can see. This sits past the
+		// awaits above on purpose: the composer clears itself synchronously right
+		// after calling sendRequest, so an earlier restore would be wiped. Queued
+		// drafts are the caller's to restore (it re-queues on false).
+		if (
+			((options.images?.length ?? 0) > 0 || (options.files?.length ?? 0) > 0) &&
+			this.mode !== AIMode.GLOBAL
+		) {
+			sendUserToast(
+				'Switch back to the chat mode to send attachments. Your message was kept.',
+				true
+			)
+			// Abandoned before install; the files go back to the composer, which
+			// re-reserves them, so release this send's outgoing-files reservation.
+			this.#releaseOutgoingReservation(reservationKey)
 			if (!options.queued) {
-				this.aiChatInput?.restoreInstructions(this.instructions, pastes, options.images ?? [])
+				this.aiChatInput?.restoreInstructions(
+					this.instructions,
+					pastes,
+					options.images ?? [],
+					options.files ?? []
+				)
 			}
 			return false
 		}
@@ -2331,6 +2584,12 @@ export class AIChatManager {
 		// repeated here, not just at attach time: the model can be switched to a
 		// text-only one after attaching, and sending the image then fails the turn.
 		const requestedImages = options.images ?? []
+		// Text files pass regardless of vision support — the prompt carries only
+		// references; content is read via the file tools. Hydrated so every copy of
+		// this turn (bubble, prompt, registration, restore) carries the stable id —
+		// only edit/retry of a pre-id transcript can arrive without one, and the
+		// hash is deterministic, so hydration reproduces the original id.
+		const files = withAttachedTextFileIds(options.files ?? [])
 		const sendModel = tryGetCurrentModel()
 		const modelIsBlind = !!sendModel && !modelSupportsVision(sendModel.provider, sendModel.model)
 		if (requestedImages.length > 0 && modelIsBlind) {
@@ -2338,7 +2597,7 @@ export class AIChatManager {
 			// put them back in the composer instead of silently discarding them
 			// (the input already cleared itself optimistically on send). Queued
 			// drafts are the caller's to restore (it re-queues on false).
-			if (!this.instructions.trim()) {
+			if (!this.instructions.trim() && files.length === 0) {
 				sendUserToast(`${sendModel.model} can't read images. Switch to a vision model first.`, true)
 				if (!options.queued) this.restoreToInput('', requestedImages)
 				return false
@@ -2366,9 +2625,14 @@ export class AIChatManager {
 				// Same objects as the API message's parts: sharing the exact data URL
 				// lets the history's blob store persist one copy for both.
 				images: images.length > 0 ? images : undefined,
+				files: files.length > 0 ? files : undefined,
 				index: this.messages.length // matching with actual messages index. not -1 because it's not yet added to the messages array
 			}
 		]
+		// The bubble now carries the outgoing files, so the transcript accounts them;
+		// release the reservation that bridged the preflight gap. A beforeSend
+		// rollback below restores them to the composer, which re-reserves.
+		this.#releaseOutgoingReservation(reservationKey)
 		// Undo the optimistic bubble + loading/label. Shared by the beforeSend-failure and
 		// pre-flight-cancel paths below; callers put the message back in the composer.
 		const rollbackOptimisticSend = () => {
@@ -2388,7 +2652,7 @@ export class AIChatManager {
 				console.error('AIChatManager beforeSend hook failed', e)
 				rollbackOptimisticSend()
 				if (!options.queued) {
-					this.aiChatInput?.restoreInstructions(this.instructions, pastes, images)
+					this.aiChatInput?.restoreInstructions(this.instructions, pastes, images, files)
 				}
 				sendUserToast(
 					`Could not prepare the session before sending: ${
@@ -2414,14 +2678,15 @@ export class AIChatManager {
 			if (this.wasCancelledByUser() && this.#hasQueuedMessage()) {
 				const next = this.#takeQueue()
 				const accepted = await this.sendRequest({
-					instructions: next.text,
-					images: next.images,
+					instructions: next.draft.text,
+					images: next.draft.images,
+					files: next.draft.files,
 					contextOverride: next.context,
 					queued: true
 				})
 				if (accepted === false) this.#restoreQueue(next)
 			} else {
-				this.aiChatInput?.restoreInstructions(this.instructions, pastes, images)
+				this.aiChatInput?.restoreInstructions(this.instructions, pastes, images, files)
 			}
 			return true
 		}
@@ -2564,6 +2829,19 @@ export class AIChatManager {
 				throw new Error('No script options passed')
 			}
 
+			// Message-attached files travel as references: the prompt lists them by id
+			// and the model reads their content via the file tools. Register them in
+			// the store before the request goes out so this turn's reads can already
+			// see them. Registration failure must not block the send — the reference
+			// just reads as missing and the model reports it.
+			if (this.mode === AIMode.GLOBAL && files.length > 0) {
+				try {
+					this.attachedFiles.registerMessageFiles(files as (AttachedTextFile & { id: string })[])
+				} catch (e) {
+					console.error('Failed to register message-attached files', e)
+				}
+			}
+
 			let userMessage: ChatCompletionMessageParam = {
 				role: 'user',
 				content: ''
@@ -2592,7 +2870,8 @@ export class AIChatManager {
 				case AIMode.GLOBAL:
 					userMessage = prepareGlobalUserMessage(modelInstructions, oldSelectedContext, {
 						workspace: this.operatingWorkspace,
-						images: sentImages
+						images: sentImages,
+						files: files
 					})
 					break
 				case AIMode.APP:
@@ -2655,6 +2934,9 @@ export class AIChatManager {
 							this.contextUsage = Math.max(0, this.contextUsage - freed)
 						}
 					}
+					// Reconcile file registrations with the compacted transcript — the
+					// summary message carries the folded-away turns' files forward.
+					this.#syncMessageFiles()
 					await this.historyManager.saveChat(
 						this.displayMessages,
 						this.messages,
@@ -2813,13 +3095,14 @@ export class AIChatManager {
 				// about to auto-send (see the flush below) — drop the rolled-back
 				// prompt instead of restoring it to the input so the handoff is clean.
 				const willAutoSendQueued = this.wasCancelledByUser() && this.#hasQueuedMessage()
-				const textRestored = this.restoreUnsentTurn(
+				const textRestored = await this.restoreUnsentTurn(
 					displayLenAfterUser,
 					modelLenAfterUser,
 					sentInstructions,
 					sentPastes,
 					!willAutoSendQueued,
-					sentImages
+					sentImages,
+					files
 				)
 				// restoreUnsentTurn hands the text/pastes/images back for a resend, but
 				// the DOM selector chips were already consumed from the live selection
@@ -2953,8 +3236,9 @@ export class AIChatManager {
 		if ((turnCommittedCleanly || this.wasCancelledByUser()) && this.#hasQueuedMessage()) {
 			const next = this.#takeQueue()
 			const accepted = await this.sendRequest({
-				instructions: next.text,
-				images: next.images,
+				instructions: next.draft.text,
+				images: next.draft.images,
+				files: next.draft.files,
 				contextOverride: next.context,
 				queued: true
 			})
@@ -3025,12 +3309,13 @@ export class AIChatManager {
 		)
 	}
 
-	restartGeneration = (
+	restartGeneration = async (
 		displayMessageIndex: number,
 		newContent?: string,
 		pastes?: PasteAttachment[],
 		images?: AttachedImage[],
-		editedContext?: ContextElement[]
+		editedContext?: ContextElement[],
+		files?: AttachedTextFile[]
 	) => {
 		const userMessage = this.displayMessages[displayMessageIndex]
 
@@ -3038,24 +3323,37 @@ export class AIChatManager {
 			throw new Error('No user message found at the specified index')
 		}
 
-		// Read while both arrays are intact: storedImages pairs the API message with
-		// its transcript entry, and the truncations below drop them.
-		const sentImages = this.storedImages(displayMessageIndex)
-
-		// Remove all messages including and after the specified user message
-		this.displayMessages = this.displayMessages.slice(0, displayMessageIndex)
-
-		// Find corresponding message in actual messages and remove it and everything
-		// after it. A negative index marks a message whose API counterpart was
-		// removed by drop-oldest compaction — everything before it went too, so
-		// restarting from it restarts from an empty history.
-		let actualMessageIndex =
-			userMessage.index < 0 ? 0 : this.messages.findIndex((_, i) => i === userMessage.index)
-
+		// Resolve the API restart point BEFORE reserving bytes or truncating: a
+		// stale index must fail while nothing has been mutated, or the transcript
+		// would be left truncated with the reservation leaked. A negative index
+		// marks a message whose API counterpart was removed by drop-oldest
+		// compaction — everything before it went too, so restarting from it
+		// restarts from an empty history.
+		const actualMessageIndex =
+			userMessage.index < 0 ? 0 : userMessage.index < this.messages.length ? userMessage.index : -1
 		if (actualMessageIndex === -1) {
 			throw new Error('No actual user message found to restart from')
 		}
 
+		// Read while both arrays are intact: storedImages pairs the API message with
+		// its transcript entry, and the truncations below drop them.
+		const sentImages = this.storedImages(displayMessageIndex)
+
+		// Reserve the resent files' bytes across the gap between the edit box
+		// unmounting and the optimistic message landing. A per-resend token owns the
+		// reservation (sendRequest releases only this key) so an unrelated or
+		// concurrent send never clears it. Set before the slice below removes the
+		// message from the transcript, so those bytes are always accounted.
+		const resendReservationKey = `resend:${createLongHash()}`
+		const resentFiles = files ?? userMessage.files ?? []
+		this.setComposerStaged(
+			resendReservationKey,
+			null,
+			resentFiles.reduce((sum, f) => sum + textByteLength(f.content), 0)
+		)
+
+		// Remove all messages including and after the specified user message
+		this.displayMessages = this.displayMessages.slice(0, displayMessageIndex)
 		this.messages = this.messages.slice(0, actualMessageIndex)
 
 		// The last report described the pre-rewind history; clear it. Readers
@@ -3073,11 +3371,19 @@ export class AIChatManager {
 		// contextElements. `undefined` for modes that don't attach context leaves the
 		// live-selection behavior. An empty array is a deliberate "no context".
 		this.instructions = newContent ?? userMessage.content
+		// Prune the truncated messages' file registrations BEFORE the resend
+		// re-registers its own — the other way around would delete the fresh rows.
+		this.#syncMessageFiles()
 		this.sendRequest({
 			pastes: pastes ?? userMessage.pastes,
 			contextOverride: editedContext ?? userMessage.contextElements,
 			contextOverrideOrigin: 'replay',
-			images: images ?? sentImages
+			images: images ?? sentImages,
+			// The bubble copy is authoritative for files: the API message carries
+			// only a reference (content lives in the store), so nothing ever strips
+			// it the way providers strip image parts from history.
+			files: files ?? userMessage.files,
+			resendReservationKey
 		})
 	}
 
@@ -3133,6 +3439,8 @@ export class AIChatManager {
 		// session, so "New chat" must clear them — otherwise the next, unrelated conversation
 		// would still get the previous file roster and could read/search it.
 		if (!this.isSessionChat) this.attachedFiles.clear()
+		// Message-attached rows belong to the conversation just left in every case.
+		this.#syncMessageFiles()
 		this.syncArtifactsSession()
 		this.onChatRotated?.(this.historyManager.getCurrentChatId())
 	}
@@ -3170,6 +3478,10 @@ export class AIChatManager {
 			}
 			if (this.backgroundJobs.length > 0) this.backgroundJobs = [...this.backgroundJobs]
 			this.#ensureJobPoller()
+			// Message-attached files live in the transcript, not in the store's
+			// persistence — rebuild their rows so the loaded chat's references are
+			// readable (and the previous chat's are pruned).
+			this.#syncMessageFiles()
 			this.#automaticScroll = true
 			this.syncArtifactsSession()
 			this.onChatRotated?.(id)
diff --git a/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts b/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts
index 1962768140..01bb4da732 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts
+++ b/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts
@@ -495,7 +495,7 @@ describe('AIChatManager queued messages', () => {
 		manager.dequeueMessage()
 
 		expect(manager.queuedMessage).toBe('')
-		expect(input.prependText).toHaveBeenCalledWith('line one\nline two', [])
+		expect(input.prependText).toHaveBeenCalledWith('line one\nline two', [], [])
 	})
 
 	const img = (n: string): AttachedImage => ({
@@ -994,7 +994,7 @@ describe('AIChatManager queued messages', () => {
 		await manager.sendRequest({ instructions: '', images: [img('a')] })
 
 		expect(mocks.runChatLoop).not.toHaveBeenCalled()
-		expect(input.prependText).toHaveBeenCalledWith('', [img('a')])
+		expect(input.prependText).toHaveBeenCalledWith('', [img('a')], [])
 		mocks.tryGetCurrentModel.mockReturnValue(model)
 	})
 
@@ -1086,7 +1086,7 @@ describe('AIChatManager queued messages', () => {
 
 		expect(accepted).toBe(false)
 		expect(mocks.runChatLoop).not.toHaveBeenCalled()
-		expect(input.restoreInstructions).toHaveBeenCalledWith('find it', [], [img('a')])
+		expect(input.restoreInstructions).toHaveBeenCalledWith('find it', [], [img('a')], [])
 	})
 
 	// A refused queued draft is the caller's to restore (it re-queues on false) —
@@ -1194,7 +1194,235 @@ describe('AIChatManager queued messages', () => {
 		manager.dequeueMessage()
 
 		expect(manager.queuedImages).toEqual([])
-		expect(input.prependText).toHaveBeenCalledWith('', [img('a')])
+		expect(input.prependText).toHaveBeenCalledWith('', [img('a')], [])
+	})
+
+	it('queues a file-only message and restores it on dequeue', () => {
+		const input = createInputMock()
+		const manager = createManager(input)
+		const file = { name: 'notes.md', content: 'hello' }
+		manager.queueMessage('', [], undefined, [file])
+
+		expect(manager.queuedMessage).toBe('')
+		expect(manager.queuedFiles).toMatchObject([file])
+		const queued = manager.queuedFiles
+
+		manager.dequeueMessage()
+
+		expect(manager.queuedFiles).toEqual([])
+		expect(input.prependText).toHaveBeenCalledWith('', [], queued)
+	})
+
+	it('normalizes files aggregated into one queued message', () => {
+		// Repeated submissions during a stream fold into one queued message, so the
+		// queue applies the same commit normalization as the composer: identical
+		// re-attaches dedupe (no wasted slot), same-name clashes get the courtesy
+		// rename, distinct files survive.
+		const input = createInputMock()
+		const manager = createManager(input)
+		manager.queueMessage('', [], undefined, [{ name: 'notes.md', content: 'alpha' }])
+		manager.queueMessage('', [], undefined, [
+			{ name: 'notes.md', content: 'alpha' },
+			{ name: 'notes.md', content: 'bravo' }
+		])
+
+		expect(manager.queuedFiles.map((f) => f.name)).toEqual(['notes.md', 'notes (2).md'])
+		expect(manager.queuedFiles.map((f) => f.content)).toEqual(['alpha', 'bravo'])
+	})
+
+	// While editing an earlier message the bottom composer and the edit box are
+	// both mounted. Each enforces MAX_CONVERSATION_FILE_BYTES at attach time, so
+	// each must see the other's stage or two attaches could each spend the full
+	// budget and overflow the persisted transcript.
+	it('counts every other live composer stage in the attachment budget', () => {
+		const manager = new AIChatManager()
+		manager.displayMessages = [
+			{ role: 'user', content: 'edited', files: [{ name: 'a.md', content: 'X'.repeat(300) }] },
+			{ role: 'user', content: 'kept', files: [{ name: 'b.md', content: 'Y'.repeat(500) }] }
+		] as any
+
+		// Bottom composer staged 4MB; edit box (editing message 0) staged 900KB.
+		manager.setComposerStaged('main', null, 4_000_000)
+		manager.setComposerStaged('edit', 0, 900_000)
+
+		// From the bottom composer: message 0 is skipped (its editor's stage stands
+		// in for it), message 1 counts, and the edit box's 900KB is visible.
+		expect(manager.attachmentBytesExcluding('main')).toBe(500 + 900_000)
+		// From the edit box: message 0 skipped, message 1 counts, bottom's 4MB visible.
+		expect(manager.attachmentBytesExcluding('edit')).toBe(500 + 4_000_000)
+
+		manager.clearComposerStaged('edit')
+		expect(manager.attachmentBytesExcluding('main')).toBe(300 + 500)
+	})
+
+	// The edit box unmounts (dropping its stage) the instant the user submits, but
+	// restartGeneration then awaits registry sync + upkeep before the resent bubble
+	// lands in the transcript. During that gap the resent files must stay reserved,
+	// or the bottom composer could attach into the temporary headroom and overflow.
+	it('reserves resent files across the restartGeneration gap', async () => {
+		replyWith('done')
+		const manager = createManager(createInputMock())
+		manager.mode = AIMode.GLOBAL
+		const fileRow = { name: 'a.md', content: 'X'.repeat(3000) }
+		manager.displayMessages = [{ role: 'user', content: 'orig', files: [fileRow], index: 0 }] as any
+		manager.messages = [{ role: 'user', content: 'orig' }] as any
+
+		// refreshFolders runs inside sendRequest AFTER the edited message was sliced
+		// out but BEFORE the resent bubble is installed — the one moment the gap is
+		// open. The reservation must cover the resent bytes there.
+		let observed: number | undefined
+		vi.spyOn(manager.attachedFiles, 'refreshFolders').mockImplementation(async () => {
+			observed = manager.attachmentBytesExcluding('probe')
+		})
+
+		await manager.restartGeneration(0)
+		// Drain the resend turn fully (its runChatLoop resolves immediately) so no
+		// async work bleeds into a later test's shared-mock call counts.
+		for (let i = 0; i < 50; i++) await new Promise((r) => setTimeout(r, 0))
+
+		expect(observed).toBe(3000)
+		// Once the turn installs the bubble, the reservation is released — the
+		// transcript now accounts those bytes on its own.
+		expect(manager.attachmentBytesExcluding('probe')).toBe(3000)
+	})
+
+	// A normal send clears the composer's files immediately, but sendRequest awaits
+	// attachment upkeep (regrant/refresh) before installing the bubble. The outgoing
+	// bytes must stay reserved across that gap or a fresh drop could overflow the cap.
+	it('reserves a normal send outgoing files across the preflight gap', async () => {
+		replyWith('done')
+		const manager = createManager(createInputMock())
+		manager.mode = AIMode.GLOBAL
+
+		let observed: number | undefined
+		vi.spyOn(manager.attachedFiles, 'refreshFolders').mockImplementation(async () => {
+			observed = manager.attachmentBytesExcluding('probe')
+		})
+
+		await manager.sendRequest({
+			instructions: 'hi',
+			files: [{ name: 'a.md', content: 'X'.repeat(2500) }]
+		})
+		for (let i = 0; i < 50; i++) await new Promise((r) => setTimeout(r, 0))
+
+		// Reserved during upkeep (before the bubble lands), then accounted by the
+		// installed transcript once the reservation is released.
+		expect(observed).toBe(2500)
+		expect(manager.attachmentBytesExcluding('probe')).toBe(2500)
+	})
+
+	// A local command (/clear, /compact) consumes the send and returns before a
+	// bubble installs, so an edit resolved to one must not strand its reservation.
+	it('releases the resend reservation when an edit resolves to a local command', async () => {
+		const manager = createManager(createInputMock())
+		manager.mode = AIMode.GLOBAL
+		manager.isSessionChat = true
+		vi.spyOn(manager, 'compactManually').mockResolvedValue()
+		const fileRow = { name: 'a.md', content: 'X'.repeat(2000) }
+		manager.displayMessages = [{ role: 'user', content: 'orig', files: [fileRow], index: 0 }] as any
+		manager.messages = [{ role: 'user', content: 'orig' }] as any
+
+		await manager.restartGeneration(0, '/compact')
+		for (let i = 0; i < 20; i++) await new Promise((r) => setTimeout(r, 0))
+
+		// No stranded reservation: the abandoned resend charges nothing.
+		expect(manager.attachmentBytesExcluding('probe')).toBe(0)
+	})
+
+	// The reservation is keyed per resend, so a normal (or concurrent) send that
+	// carries no token must never release a resend reservation it doesn't own.
+	it('a normal send does not release another send resend reservation', async () => {
+		const manager = createManager(createInputMock())
+		manager.mode = AIMode.GLOBAL
+		// An in-flight resend owns this reservation.
+		manager.setComposerStaged('resend:other', null, 4000)
+
+		// A normal send that bails early (empty draft) carries no reservation key.
+		await manager.sendRequest({ instructions: '   ' })
+
+		expect(manager.attachmentBytesExcluding('probe')).toBe(4000)
+	})
+
+	// Drop-oldest compaction (summary fallback) removes API messages without a
+	// summary, so a folded message's `## ATTACHED FILES` reference no longer reaches
+	// the model. Its file (index < 0) must be advertised through the roster instead.
+	it('flags message files whose referencing message was dropped by compaction', () => {
+		const manager = new AIChatManager()
+		manager.displayMessages = [
+			{ role: 'user', content: 'a', index: -1, files: [{ name: 'dropped.md', content: 'x' }] },
+			{ role: 'user', content: 'b', index: 0, files: [{ name: 'live.md', content: 'y' }] },
+			// Referenced by BOTH a dropped and a surviving message → still visible, not orphaned.
+			{ role: 'user', content: 'c', index: -1, files: [{ name: 'shared.md', content: 'z' }] },
+			{ role: 'user', content: 'd', index: 1, files: [{ name: 'shared.md', content: 'z' }] }
+		] as any
+
+		expect([...manager.orphanedMessageFileIds()]).toEqual(['dropped.md'])
+	})
+
+	// A summary carries its folded files' reference on its own API message; if a
+	// later drop-oldest (summary fallback) removes that message, the reference is
+	// gone and the files must move to the roster like any other orphan.
+	it('orphans summary-carried files when drop-oldest removes the summary', () => {
+		const manager = new AIChatManager()
+		manager.messages = [
+			{ role: 'user', content: 'summary api message' },
+			{ role: 'user', content: 'tail' }
+		] as any
+		manager.displayMessages = [
+			{ role: 'summary', content: 's', index: 0, files: [{ name: 'folded.md', content: 'x' }] },
+			{ role: 'user', content: 'tail', index: 1 }
+		] as any
+
+		// Summary API message present → its files are still referenced.
+		expect([...manager.orphanedMessageFileIds()]).toEqual([])
+
+		// Drop-oldest removes the summary's API message and re-bases indices.
+		manager.compactOldestMessages(1)
+
+		expect([...manager.orphanedMessageFileIds()]).toEqual(['folded.md'])
+	})
+
+	it('a stale restart index fails before touching the transcript or the budget', async () => {
+		const manager = new AIChatManager()
+		manager.displayMessages = [
+			{
+				role: 'user',
+				content: 'old',
+				index: 5,
+				files: [{ name: 'a.md', content: 'X'.repeat(100) }]
+			},
+			{ role: 'assistant', content: 'reply' }
+		] as any
+		manager.messages = [{ role: 'user', content: 'old' }] as any // index 5 is stale
+
+		await expect(manager.restartGeneration(0)).rejects.toThrow(
+			'No actual user message found to restart from'
+		)
+		// Nothing was mutated and no resend reservation lingers: the budget still
+		// counts only the transcript's 100 bytes.
+		expect(manager.displayMessages).toHaveLength(2)
+		expect(manager.messages).toHaveLength(1)
+		expect(manager.attachmentBytesExcluding('probe')).toBe(100)
+	})
+
+	// An edit is not committed until send, so cancelling it returns the message's
+	// persisted attachments. Charging only the (possibly emptied) edit stage would
+	// hand the bottom composer headroom that vanishes on cancel — remove the files
+	// in the editor, fill the bottom draft, cancel, and the transcript overflows.
+	it('charges an edited message at its persisted size until the edit commits', () => {
+		const manager = new AIChatManager()
+		manager.displayMessages = [
+			{ role: 'user', content: 'big', files: [{ name: 'a.md', content: 'X'.repeat(4000) }] }
+		] as any
+
+		// Edit box mounted on message 0 with its attachment removed (stage 0):
+		// the bottom composer must still see the 4000 persisted bytes.
+		manager.setComposerStaged('edit', 0, 0)
+		expect(manager.attachmentBytesExcluding('main')).toBe(4000)
+
+		// Once the editor stages more than the original, the larger figure wins.
+		manager.setComposerStaged('edit', 0, 9000)
+		expect(manager.attachmentBytesExcluding('main')).toBe(9000)
 	})
 
 	it('drops queued images when the conversation is switched away', async () => {
@@ -1391,6 +1619,29 @@ describe('AIChatManager queued messages', () => {
 		expect(chips.map((c) => c.selector).sort()).toEqual(['div.a', 'div.b'])
 	})
 
+	it('merges a follow-up queued during a failed auto-send instead of clobbering it', async () => {
+		replyWith('done')
+		const manager = createManager(createInputMock())
+		const chipA = { type: 'app_dom_selector', selector: '#a', appPath: 'p' } as any
+		const chipB = { type: 'app_dom_selector', selector: '#b', appPath: 'p' } as any
+		manager.beforeSend = vi
+			.fn()
+			.mockResolvedValueOnce(undefined)
+			.mockImplementationOnce(async () => {
+				// A follow-up arrives while the queued auto-send is in preflight; the
+				// failed send's restore must merge on top of it, not replace it.
+				manager.queueMessage('typed during preflight', [], [chipB])
+				throw new Error('workspace commit failed')
+			})
+
+		manager.queueMessage('first queued', [], [chipA])
+		await manager.sendRequest({ instructions: 'first' })
+
+		expect(manager.queuedMessage).toBe('first queued\n\ntyped during preflight')
+		// Both entries' pinned contexts survive the restore, older first.
+		expect(manager.queuedContext?.map((c: any) => c.selector)).toEqual(['#a', '#b'])
+	})
+
 	it('re-queues the message when its auto-send is rejected by beforeSend', async () => {
 		replyWith('done')
 		const input = createInputMock()
@@ -1422,7 +1673,7 @@ describe('AIChatManager queued messages', () => {
 
 		expect(accepted).toBe(false)
 		expect(mocks.runChatLoop).not.toHaveBeenCalled()
-		expect(input.restoreInstructions).toHaveBeenCalledWith('look', [], [img('a')])
+		expect(input.restoreInstructions).toHaveBeenCalledWith('look', [], [img('a')], [])
 		// the optimistic bubble is rolled back
 		expect(manager.displayMessages).toHaveLength(0)
 	})
@@ -1851,6 +2102,32 @@ describe('AIChatManager context compaction', () => {
 		expect(manager.contextUsage).toBeUndefined()
 	})
 
+	it('carries folded-away message files on the summary', async () => {
+		mocks.getCurrentModel.mockReturnValue(gpt4oModel)
+		mocks.tryGetCurrentModel.mockReturnValue(gpt4oModel)
+		mocks.getNonStreamingCompletion.mockResolvedValue(
+			'<analysis>s</analysis><summary>SUM</summary>'
+		)
+		const manager = new AIChatManager()
+		seedForSummary(manager)
+		const file = { name: 'notes.md', content: 'hello' }
+		// The identical file on TWO folded turns (identical content registers under
+		// one name) must carry as ONE summary entry.
+		manager.displayMessages = manager.displayMessages.map((m, i) =>
+			(i === 0 || i === 2) && m.role === 'user' ? { ...m, files: [file] } : m
+		)
+
+		await manager.sendRequest()
+
+		// The summary display message carries the folded-away file once, the API
+		// summary references it as still-readable, and the registry keeps its row.
+		expect(manager.displayMessages[0]).toMatchObject({ role: 'summary', files: [file] })
+		const sent = mocks.runChatLoop.mock.calls[mocks.runChatLoop.mock.calls.length - 1][0].messages
+		expect(sent[0].content).toContain('notes.md')
+		expect(sent[0].content).toContain('read_file')
+		expect(manager.attachedFiles.messageAttached.map((f) => f.name)).toEqual(['notes.md'])
+	})
+
 	// A take_screenshot follow-up is a `user` message with no display counterpart
 	// (appendPendingToolImages injects it). It must never become the tail
 	// boundary: `messages` and `displayMessages` would then be sliced at
@@ -2255,7 +2532,7 @@ describe('AIChatManager sendRequest lifecycle', () => {
 		expect(manager.displayMessages.some((m) => m.role === 'user')).toBe(false)
 		expect(manager.messages.some((m) => m.role === 'user')).toBe(false)
 		// ...and its text is handed back to the composer.
-		expect(restoreInstructions).toHaveBeenCalledWith('do a thing', [], [])
+		expect(restoreInstructions).toHaveBeenCalledWith('do a thing', [], [], [])
 		expect(manager.loading).toBe(false)
 	})
 
@@ -2284,7 +2561,7 @@ describe('AIChatManager sendRequest lifecycle', () => {
 
 		expect(manager.displayMessages).toHaveLength(0)
 		expect(manager.messages.some((m) => m.role === 'user')).toBe(false)
-		expect(restoreInstructions).toHaveBeenCalledWith('do a thing', [], [])
+		expect(restoreInstructions).toHaveBeenCalledWith('do a thing', [], [], [])
 		expect(manager.loading).toBe(false)
 	})
 
@@ -2386,7 +2663,7 @@ describe('AIChatManager sendRequest lifecycle', () => {
 		expect(manager.messages.some((m) => m.role === 'assistant')).toBe(false)
 		expect(manager.displayMessages.some((m) => m.role === 'assistant')).toBe(false)
 		expect(manager.displayMessages.some((m) => m.role === 'user')).toBe(false)
-		expect(restoreInstructions).toHaveBeenCalledWith('think hard', [], [])
+		expect(restoreInstructions).toHaveBeenCalledWith('think hard', [], [], [])
 		expect(manager.loading).toBe(false)
 	})
 
diff --git a/frontend/src/lib/components/copilot/chat/AIChatMessage.svelte b/frontend/src/lib/components/copilot/chat/AIChatMessage.svelte
index b6c6d20c64..61d9a47966 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatMessage.svelte
+++ b/frontend/src/lib/components/copilot/chat/AIChatMessage.svelte
@@ -7,7 +7,7 @@
 	import { Button } from '$lib/components/common'
 	import { RefreshCwIcon, Undo2Icon } from 'lucide-svelte'
 	import AIChatInput from './AIChatInput.svelte'
-	import type { ContextElement } from './context'
+	import { createAttachedFileContextElement, type ContextElement } from './context'
 	import ToolExecutionDisplay from './ToolExecutionDisplay.svelte'
 	import CompactionBoundary from './CompactionBoundary.svelte'
 	import { messageDraft, segments } from './chatDraft'
@@ -59,7 +59,7 @@
 </script>
 
 {#if message.role === 'summary'}
-	<CompactionBoundary content={message.content} />
+	<CompactionBoundary content={message.content} files={message.files} />
 {:else}
 	<div
 		class={twMerge(
@@ -74,11 +74,27 @@
 		onclick={() => editMessage()}
 		onkeydown={() => {}}
 	>
-		{#if message.role === 'user' && message.contextElements && editingMessageIndex !== messageIndex}
-			<div class="flex flex-row gap-1 mb-1 overflow-scroll no-scrollbar px-2">
-				{#each message.contextElements as element}
+		<!-- One wrapping row for every badge on the message: selected context / DOM
+		     picks and attached files, side by side. Clicks stay inside the row: the
+		     wrapper's click opens edit mode, which would unmount a badge's preview
+		     popover the instant it opens. -->
+		{#if message.role === 'user' && editingMessageIndex !== messageIndex && ((message.contextElements?.length ?? 0) > 0 || (message.files?.length ?? 0) > 0)}
+			<!-- svelte-ignore a11y_no_static_element_interactions -->
+			<div
+				class="flex flex-row flex-wrap gap-1 mb-1 px-2"
+				onclick={(e) => e.stopPropagation()}
+				onkeydown={(e) => e.stopPropagation()}
+			>
+				{#each message.contextElements ?? [] as element}
 					<ContextElementBadge contextElement={element} compact />
 				{/each}
+				<!-- Index in the key: same-named entries can survive in older transcripts. -->
+				{#each message.files ?? [] as file, i (`${file.id ?? file.name}:${i}`)}
+					<ContextElementBadge
+						contextElement={createAttachedFileContextElement(file.name, file.content)}
+						compact
+					/>
+				{/each}
 			</div>
 		{/if}
 		{#if message.role === 'user' && editingMessageIndex === messageIndex}
@@ -89,6 +105,7 @@
 					initialInstructions={message.content}
 					initialPastes={message.pastes}
 					initialImages={aiChatManager.storedImages(messageIndex)}
+					initialFiles={message.files}
 					{editingMessageIndex}
 					onClickOutside={() => (editingMessageIndex = null)}
 					onKeyDown={(e) => {
@@ -119,8 +136,9 @@
 							{/each}
 						</div>
 					{/if}
-					<!-- Text-free messages show only their context chips / images — no
-					     empty bubble (empty sends require chips or images to go out). -->
+					<!-- Text-free messages show only their context chips / images / file
+					     chips — no empty bubble (empty sends require chips, images, or
+					     files to go out). -->
 					{#if message.content.trim() !== ''}
 						<div
 							class="text-xs px-3 py-2 w-fit max-w-[min(32rem,100%)] bg-surface-accent-selected text-accent rounded-lg relative group break-words"
diff --git a/frontend/src/lib/components/copilot/chat/CompactionBoundary.svelte b/frontend/src/lib/components/copilot/chat/CompactionBoundary.svelte
index af9888bc93..3a04ebccf2 100644
--- a/frontend/src/lib/components/copilot/chat/CompactionBoundary.svelte
+++ b/frontend/src/lib/components/copilot/chat/CompactionBoundary.svelte
@@ -1,8 +1,9 @@
 <script lang="ts">
 	import { Button } from '$lib/components/common'
 	import { ChevronDown, ChevronRight, History } from 'lucide-svelte'
+	import type { AttachedTextFile } from './textFileUtils'
 
-	let { content }: { content: string } = $props()
+	let { content, files }: { content: string; files?: AttachedTextFile[] } = $props()
 
 	let expanded = $state(false)
 </script>
@@ -16,7 +17,7 @@
 			startIcon={{ icon: expanded ? ChevronDown : ChevronRight }}
 			onclick={() => (expanded = !expanded)}
 		>
-			<span class="inline-flex items-center gap-1 text-2xs text-tertiary">
+			<span class="inline-flex items-center gap-1 text-normal text-2xs">
 				<History size={12} />
 				Summarized earlier conversation
 			</span>
@@ -28,6 +29,13 @@
 			class="mt-2 max-h-80 overflow-y-auto whitespace-pre-wrap rounded-md bg-surface-secondary p-3 text-xs text-secondary"
 		>
 			{content}
+			{#if files && files.length > 0}
+				<!-- Attachments from the summarized turns, carried across the boundary
+				     (still tool-readable) — named here, not rendered as interactive chips. -->
+				<div class="mt-2 pt-2 border-t text-2xs text-tertiary">
+					Files added by the user: {files.map((f) => f.name).join(', ')}
+				</div>
+			{/if}
 		</div>
 	{/if}
 </div>
diff --git a/frontend/src/lib/components/copilot/chat/ContextElementBadge.svelte b/frontend/src/lib/components/copilot/chat/ContextElementBadge.svelte
index 326dcabd7b..412fdf641f 100644
--- a/frontend/src/lib/components/copilot/chat/ContextElementBadge.svelte
+++ b/frontend/src/lib/components/copilot/chat/ContextElementBadge.svelte
@@ -14,6 +14,7 @@
 	import HighlightCode from '$lib/components/HighlightCode.svelte'
 	import FlowModuleIcon from '$lib/components/flows/FlowModuleIcon.svelte'
 	import type { FlowModule } from '$lib/gen'
+	import { getFileIcon } from '$lib/components/icons/fileIcon'
 
 	interface Props {
 		contextElement: ContextElement
@@ -33,7 +34,8 @@
 		'app_dom_selector',
 		'workspace_app',
 		'workspace_script',
-		'workspace_flow'
+		'workspace_flow',
+		'attached_file'
 	])
 	const icon = ContextIconMap[untrack(() => contextElement).type]
 	let showDelete = $state(false)
@@ -65,6 +67,10 @@
 					<X size={iconSize} />
 				{:else if contextElement.type === 'flow_module' || contextElement.type === 'flow_module_code_piece'}
 					<FlowModuleIcon module={contextElement as FlowModule} size={iconSize} />
+				{:else if contextElement.type === 'attached_file'}
+					{@const fileIcon = getFileIcon(contextElement.title)}
+					{@const FileIconComponent = fileIcon.icon}
+					<FileIconComponent size={iconSize} class={fileIcon.className ?? ''} />
 				{:else}
 					{@const SvelteComponent = icon}
 					<SvelteComponent size={iconSize} />
@@ -161,6 +167,14 @@
 				<div class="text-tertiary mb-1">Selected preview element</div>
 				<div class="font-mono break-all">{contextElement.selector}</div>
 			</div>
+		{:else if contextElement.type === 'attached_file'}
+			<div class="p-2 max-w-96 max-h-[300px] text-xs overflow-auto">
+				<pre class="whitespace-pre-wrap break-words font-mono text-2xs"
+					>{contextElement.content.length > 5000
+						? contextElement.content.slice(0, 5000) + '\n…'
+						: contextElement.content}</pre
+				>
+			</div>
 		{/if}
 	{/snippet}
 </Popover>
diff --git a/frontend/src/lib/components/copilot/chat/ContextTextarea.svelte b/frontend/src/lib/components/copilot/chat/ContextTextarea.svelte
index f3967fe402..f9d5dbf777 100644
--- a/frontend/src/lib/components/copilot/chat/ContextTextarea.svelte
+++ b/frontend/src/lib/components/copilot/chat/ContextTextarea.svelte
@@ -37,6 +37,8 @@
 		onRemoveContext?: (contextElement: ContextElement) => void
 		/** Called with image files found in a paste, so the host can attach them. */
 		onImageFiles?: (files: File[]) => void
+		/** Called with non-image files found in a paste, so the host can attach them. */
+		onTextFiles?: (files: File[]) => void
 		className?: string
 		onKeyDown?: (e: KeyboardEvent) => void
 		/** Rendered inside the input box, above the textarea (e.g. context chips). */
@@ -54,6 +56,7 @@
 		onAddContext,
 		onRemoveContext,
 		onImageFiles,
+		onTextFiles,
 		className = '',
 		onKeyDown = undefined,
 		leading
@@ -312,13 +315,14 @@
 		// a picture of them. An OS screenshot carries the image alone, so it still lands
 		// here. `onImageFiles` is unset outside GLOBAL, where attaching is unsupported —
 		// the paste must then fall through to text rather than be swallowed.
-		if (!text.trim() && onImageFiles) {
-			const imageFiles = Array.from(e.clipboardData?.files ?? []).filter((f) =>
-				f.type.startsWith('image/')
-			)
-			if (imageFiles.length > 0) {
+		if (!text.trim() && (onImageFiles || onTextFiles)) {
+			const pastedFiles = Array.from(e.clipboardData?.files ?? [])
+			const imageFiles = pastedFiles.filter((f) => f.type.startsWith('image/'))
+			const otherFiles = pastedFiles.filter((f) => !f.type.startsWith('image/'))
+			if ((imageFiles.length > 0 && onImageFiles) || (otherFiles.length > 0 && onTextFiles)) {
 				e.preventDefault()
-				onImageFiles(imageFiles)
+				if (imageFiles.length > 0) onImageFiles?.(imageFiles)
+				if (otherFiles.length > 0) onTextFiles?.(otherFiles)
 				return
 			}
 		}
diff --git a/frontend/src/lib/components/copilot/chat/HistoryManager.svelte.ts b/frontend/src/lib/components/copilot/chat/HistoryManager.svelte.ts
index beb3424998..24d7284b95 100644
--- a/frontend/src/lib/components/copilot/chat/HistoryManager.svelte.ts
+++ b/frontend/src/lib/components/copilot/chat/HistoryManager.svelte.ts
@@ -487,11 +487,15 @@ export default class HistoryManager {
 			const existingTitle = this.savedChats[this.currentChatId]?.title
 			const titleSource = displayMessages.find((m) => m.role !== 'summary') ?? displayMessages[0]
 			const derivedTitle = expanded(messageDraft(titleSource)).slice(0, 50)
-			// An image-only first turn has no text to derive from — fall back to the
-			// attachment's filename so the History menu entry isn't blank.
+			// An attachment-only first turn has no text to derive from — fall back to
+			// the attachment's filename so the History menu entry isn't blank.
 			const imageFallback =
-				titleSource.role === 'user' && titleSource.images?.length
-					? (titleSource.images[0].name ?? 'Image attachment')
+				titleSource.role === 'user'
+					? titleSource.images?.length
+						? (titleSource.images[0].name ?? 'Image attachment')
+						: titleSource.files?.length
+							? titleSource.files[0].name
+							: ''
 					: ''
 			// A hydrated omission marker is not user text — deriving from it would
 			// overwrite the filename title an evicted image-only chat was given.
diff --git a/frontend/src/lib/components/copilot/chat/QueuedMessageChip.svelte b/frontend/src/lib/components/copilot/chat/QueuedMessageChip.svelte
index 54c55864c1..0e1ec12e74 100644
--- a/frontend/src/lib/components/copilot/chat/QueuedMessageChip.svelte
+++ b/frontend/src/lib/components/copilot/chat/QueuedMessageChip.svelte
@@ -1,6 +1,6 @@
 <script lang="ts">
 	import { Button } from '$lib/components/common'
-	import { X } from 'lucide-svelte'
+	import { FileText, X } from 'lucide-svelte'
 	import ContextElementBadge from './ContextElementBadge.svelte'
 	import { contextElementKey } from './context'
 	import { getAiChatManager } from './aiChatManagerContext'
@@ -13,12 +13,13 @@
 	const aiChatManager = getAiChatManager()
 </script>
 
-<!-- Image-only and context-only queues have empty text; without their image /
-     badge row the queued draft would be invisible — undismissable, then
-     auto-sent as a surprise turn. Badges render here only for context-ONLY
-     queues: text queues pin the same chips, but those stay visible in the
-     composer, and repeating them would read as two selections. -->
-{#if aiChatManager.queuedMessage || aiChatManager.queuedImages.length > 0 || (aiChatManager.queuedContext?.length ?? 0) > 0}
+<!-- Attachment-only and context-only queues have empty text; without their
+     image / file / badge row the queued draft would be invisible —
+     undismissable, then auto-sent as a surprise turn. Context badges render
+     here only for context-ONLY queues: text queues pin the same chips, but
+     those stay visible in the composer, and repeating them would read as two
+     selections. -->
+{#if aiChatManager.queuedMessage || aiChatManager.queuedImages.length > 0 || aiChatManager.queuedFiles.length > 0 || (aiChatManager.queuedContext?.length ?? 0) > 0}
 	<div
 		class="mb-1 flex flex-row items-start gap-1 rounded-md bg-surface-input px-3 py-2 opacity-60"
 		title={aiChatManager.queuedMessage}
@@ -35,11 +36,24 @@
 					{/each}
 				</div>
 			{/if}
+			{#if aiChatManager.queuedFiles.length > 0}
+				<div class="flex flex-row flex-wrap gap-1 {aiChatManager.queuedMessage ? 'mb-1' : ''}">
+					{#each aiChatManager.queuedFiles as file, i (i)}
+						<span
+							class="flex flex-row items-center gap-1 px-1.5 rounded border border-border-light text-2xs text-secondary max-w-36"
+							title={file.name}
+						>
+							<FileText size={10} class="shrink-0" />
+							<span class="truncate min-w-0">{file.name}</span>
+						</span>
+					{/each}
+				</div>
+			{/if}
 			{#if aiChatManager.queuedMessage}
 				<p class="text-xs text-secondary whitespace-pre-wrap line-clamp-2">
 					{aiChatManager.queuedMessage}
 				</p>
-			{:else if aiChatManager.queuedImages.length === 0 && aiChatManager.queuedContext?.length}
+			{:else if aiChatManager.queuedImages.length === 0 && aiChatManager.queuedFiles.length === 0 && aiChatManager.queuedContext?.length}
 				<div class="flex flex-row flex-wrap gap-1">
 					{#each aiChatManager.queuedContext as element (contextElementKey(element))}
 						<ContextElementBadge contextElement={element} compact />
diff --git a/frontend/src/lib/components/copilot/chat/context.ts b/frontend/src/lib/components/copilot/chat/context.ts
index 3537b757f5..bf915515db 100644
--- a/frontend/src/lib/components/copilot/chat/context.ts
+++ b/frontend/src/lib/components/copilot/chat/context.ts
@@ -4,6 +4,7 @@ import {
 	TriangleAlert,
 	Diff,
 	FileCode,
+	FileText,
 	Code2,
 	TextSelect,
 	Table2,
@@ -29,7 +30,9 @@ export const ContextIconMap = {
 	app_dom_selector: MousePointer2,
 	workspace_script: Code2,
 	workspace_flow: BarsStaggered,
-	workspace_app: LayoutDashboard
+	workspace_app: LayoutDashboard,
+	// Fallback — the badge renders attached_file with the per-extension file icon.
+	attached_file: FileText
 	// flow_module type is handled with FlowModuleIcon
 }
 
@@ -283,6 +286,22 @@ export interface WorkspaceAppElement {
 	summary?: string
 }
 
+/** Message-attached text file, rendered with the shared context badge. Never part
+ * of `selectedContext` — constructed at render time from the composer's / a sent
+ * message's `files` state (see createAttachedFileContextElement). */
+export interface AttachedFileElement {
+	type: 'attached_file'
+	title: string
+	content: string
+}
+
+export function createAttachedFileContextElement(
+	name: string,
+	content: string
+): AttachedFileElement {
+	return { type: 'attached_file', title: name, content }
+}
+
 export type ContextElement = (
 	| CodeElement
 	| ErrorElement
@@ -299,6 +318,7 @@ export type ContextElement = (
 	| WorkspaceScriptElement
 	| WorkspaceFlowElement
 	| WorkspaceAppElement
+	| AttachedFileElement
 ) & {
 	deletable?: boolean
 }
diff --git a/frontend/src/lib/components/copilot/chat/files/AttachedFilesBar.svelte b/frontend/src/lib/components/copilot/chat/files/AttachedFilesBar.svelte
index 50b961c090..ec52c90ab9 100644
--- a/frontend/src/lib/components/copilot/chat/files/AttachedFilesBar.svelte
+++ b/frontend/src/lib/components/copilot/chat/files/AttachedFilesBar.svelte
@@ -43,7 +43,7 @@
 {/snippet}
 
 {#if cards.length > 0}
-	<div class="flex flex-row flex-nowrap items-center gap-1 mt-1 mb-1 min-w-0" role="list">
+	<div class="flex flex-row flex-nowrap items-center gap-1 min-w-0" role="list">
 		{#each visible as card (card.key)}
 			{@render chip(card)}
 		{/each}
diff --git a/frontend/src/lib/components/copilot/chat/files/attachedFiles.svelte.ts b/frontend/src/lib/components/copilot/chat/files/attachedFiles.svelte.ts
index 124b390ec2..6a4b93ee94 100644
--- a/frontend/src/lib/components/copilot/chat/files/attachedFiles.svelte.ts
+++ b/frontend/src/lib/components/copilot/chat/files/attachedFiles.svelte.ts
@@ -24,6 +24,7 @@ import {
 	ensurePersistentStorage,
 	type PersistedAttachedItem
 } from './attachedFilesDB'
+import { sanitizeAttachmentName } from '../textFileUtils'
 import { enumerateDir, isIgnoredPath, queryReadPermission, requestReadPermission } from './fsAccess'
 
 export type AttachedFileStatus = 'indexing' | 'ready' | 'error' | 'locked' | 'unavailable'
@@ -45,6 +46,19 @@ export interface AttachedFile extends FileEntry {
 	 * (locked/unavailable). Consumers should read `store.folders` instead of testing this.
 	 */
 	isFolderRoot?: boolean
+	/** Attached to a chat message: readable via the file tools like any other row,
+	 * but hidden from the session footer bar (its chip lives on the message). */
+	messageScoped?: boolean
+	/** Stable content-hash id (message-scoped rows only) — the reference the
+	 * transcript and prompt carry. Names are display-only and may collide;
+	 * lookups join on this. See attachedTextFileId. */
+	id?: string
+	/** Raw pre-sanitization source name (session rows) — the re-link identity.
+	 * Display names lose information (sanitize + suffix), so a re-link must
+	 * match on the raw name it arrives under: two distinct raw names that
+	 * sanitize identically are different files even with equal stats. Falls back
+	 * to `name` for rows persisted before provenance existed. */
+	sourceName?: string
 }
 
 /** A linked folder as a first-class object — consumers read this instead of re-grouping rows. */
@@ -87,8 +101,31 @@ export class AttachedFilesStore {
 		return this.files
 	}
 	get(name: string): AttachedFile | undefined {
-		// Resolve to a real file — a folder-root placeholder may share the folder's name.
-		return this.files.find((f) => f.name === name && !f.isFolderRoot)
+		// Name lookup. A bare name is the roster's namespace: session links are
+		// advertised by filename and have no other handle, so they resolve first —
+		// a same-named message attachment must not shadow them (it is addressed by
+		// id). Message rows resolve by name only as the fallback, for transcripts
+		// persisted before ids existed.
+		// Folder-root placeholders may share a name with a real file — never resolve to one.
+		return (
+			this.files.find((f) => f.name === name && !f.isFolderRoot && !f.messageScoped) ??
+			this.files.find((f) => f.name === name && f.messageScoped)
+		)
+	}
+	/** Resolve a tool-supplied file reference: stable id first (how message
+	 * attachments are addressed), then name (session links + legacy prompts).
+	 * The composite label the roster and search hits print — `name (file id: x)`
+	 * — resolves too: models echo references verbatim, so the printed form must
+	 * be a valid one. Exact matches win over label interpretation: a row whose
+	 * literal filename happens to look like a label stays addressable by it. */
+	resolve(ref: string): AttachedFile | undefined {
+		const exact = this.files.find((f) => f.id === ref) ?? this.get(ref)
+		if (exact) return exact
+		const label = ref.match(/^(.*) \(file id: ([^)]+)\)$/)
+		if (label) {
+			return this.files.find((f) => f.id === label[2]) ?? this.get(label[1])
+		}
+		return undefined
 	}
 	readyFiles(): AttachedFile[] {
 		// Folder-root placeholders aren't real files — never expose them to the read/search tools.
@@ -114,8 +151,15 @@ export class AttachedFilesStore {
 		}))
 	})
 
-	/** Files linked on their own (not as part of a folder). */
-	standalone: AttachedFile[] = $derived.by(() => this.files.filter((f) => !f.folder))
+	/** Files linked on their own (not as part of a folder or a message). */
+	standalone: AttachedFile[] = $derived.by(() =>
+		this.files.filter((f) => !f.folder && !f.messageScoped)
+	)
+
+	/** Files attached to chat messages — tool-readable, not shown in the footer bar. */
+	messageAttached: AttachedFile[] = $derived.by(() =>
+		this.files.filter((f) => !f.folder && f.messageScoped)
+	)
 
 	/** Number of locked folders needing a re-grant. */
 	get lockedCount(): number {
@@ -128,15 +172,57 @@ export class AttachedFilesStore {
 	}
 
 	removeFile(name: string): void {
+		// Session rows only: message-scoped rows are managed by syncMessageScoped, and
+		// a footer chip removal must never take a same-named message attachment with it.
 		// Target the real file only — never a folder-root placeholder that happens to share
 		// the name (those are managed via removeFolder), else removing a same-named standalone
 		// file would also drop the folder's placeholder.
-		const f = this.files.find((x) => x.name === name && !x.isFolderRoot)
+		const f = this.files.find((x) => x.name === name && !x.isFolderRoot && !x.messageScoped)
 		if (!f) return
-		this.files = this.files.filter((x) => !(x.name === name && !x.isFolderRoot))
+		this.files = this.files.filter((x) => x !== f)
 		void this.#deleteRecord(f.sourceId)
 	}
 
+	/**
+	 * Reconcile message-scoped rows to exactly `wanted` — the union of files the
+	 * current transcript references, joined on the stable id. The transcript is
+	 * their durable home: rows are rebuilt from it on chat load and pruned when a
+	 * rollback or an edit/retry truncation drops the message that carried them.
+	 * Synchronous — decisions compare ids, never content — so rapid chat
+	 * switching cannot interleave two reconciliations.
+	 */
+	syncMessageScoped(wanted: { name: string; content: string; id: string }[]): void {
+		const wantedIds = new Set(wanted.map((f) => f.id))
+		for (const f of this.files.filter((x) => x.messageScoped)) {
+			if (!f.id || !wantedIds.has(f.id)) {
+				this.files = this.files.filter((x) => x !== f)
+				void this.#deleteRecord(f.sourceId)
+			}
+		}
+		this.registerMessageFiles(wanted)
+	}
+
+	/**
+	 * Register a message's attachments as tool-readable rows. Identity is the
+	 * content-hash id: a row already holding the id is reused (retry, sync
+	 * rebuild), and distinct files register independently even under one display
+	 * name. Rows are NOT persisted here — their durable home is the chat
+	 * transcript (DisplayMessage.files), from which syncMessageScoped rebuilds
+	 * them on load; a second copy in IndexedDB would only drift.
+	 */
+	registerMessageFiles(files: { name: string; content: string; id: string }[]): void {
+		for (const f of files) {
+			if (this.files.some((x) => x.messageScoped && x.id === f.id)) continue
+			this.#pushIndexing({
+				name: f.name,
+				file: new File([f.content], f.name, { type: 'text/plain' }),
+				sourceId: f.id,
+				messageScoped: true,
+				id: f.id
+			})
+		}
+	}
+
 	/** Remove every file linked as part of the given folder (and its persisted record). */
 	removeFolder(folder: string): void {
 		const ids = new Set(this.files.filter((f) => f.folder === folder).map((f) => f.sourceId))
@@ -157,34 +243,40 @@ export class AttachedFilesStore {
 
 		for (const item of Array.from(input as ArrayLike<FileToAttach>)) {
 			const file = item instanceof File ? item : item.file
-			const desired =
+			// rawPath keys everything that must match the disk (folder split, junk
+			// filter, relPath); the sanitized form is what names may be compared and
+			// stored as — mixing the two is how dedupe once compared raw against
+			// sanitized and missed.
+			const rawPath =
 				(item instanceof File ? '' : (item.path ?? '')) ||
 				(file as File & { webkitRelativePath?: string }).webkitRelativePath ||
 				file.name ||
 				'file'
+			const folder = rawPath.includes('/') ? rawPath.split('/')[0] : undefined
+			if (folder && isIgnoredPath(rawPath)) continue // skip junk inside folders
 
-			const folder = desired.includes('/') ? desired.split('/')[0] : undefined
-			if (folder && isIgnoredPath(desired)) continue // skip junk inside folders
-
-			if (this.#isDuplicate(desired, file)) continue // silent no-op on re-link
+			if (this.#isDuplicate(rawPath, file)) {
+				continue // silent no-op on re-link
+			}
 
 			const reason = await this.#preflight(file)
 			if (reason) {
-				result.rejected.push({ name: desired, reason })
+				result.rejected.push({ name: sanitizeAttachmentName(rawPath), reason })
 				continue
 			}
 
-			const name = this.#uniqueName(desired)
-			const relPath = folder ? desired : undefined
+			const name = this.#claimName(rawPath)
+			const relPath = folder ? rawPath : undefined
 			const sourceId = createLongHash()
 
-			this.#pushIndexing({ name, file, folder, sourceId, relPath })
+			this.#pushIndexing({ name, sourceName: rawPath, file, folder, sourceId, relPath })
 			result.added.push(name)
 			void this.#persist({
 				id: sourceId,
 				sessionId: this.sessionId ?? '',
 				kind: 'snapshot',
 				name,
+				sourceName: rawPath,
 				folder,
 				relPath,
 				blob: file,
@@ -227,8 +319,16 @@ export class AttachedFilesStore {
 				result.rejected.push({ name: path, reason: 'Not a text file' })
 				continue
 			}
-			const name = this.#uniqueName(path)
-			this.#pushIndexing({ name, file, folder, sourceId, handle: dirHandle, relPath: path })
+			const name = this.#claimName(path)
+			this.#pushIndexing({
+				name,
+				sourceName: path,
+				file,
+				folder,
+				sourceId,
+				handle: dirHandle,
+				relPath: path
+			})
 			result.added.push(name)
 		}
 		// Keep the folder represented even when it links empty (or all-binary): a placeholder
@@ -264,8 +364,12 @@ export class AttachedFilesStore {
 						this.#pushPlaceholder(item, 'unavailable')
 						continue
 					}
+					// Claimed on read from the persisted RAW identity: legacy names can
+					// sanitize to one display name (both must stay resolvable), and the
+					// raw sourceName is what a later re-link dedupes against.
 					this.#pushIndexing({
-						name: item.name,
+						name: this.#claimName(item.sourceName ?? item.name),
+						sourceName: item.sourceName ?? item.name,
 						file: item.blob,
 						folder: item.folder,
 						relPath: item.relPath,
@@ -367,22 +471,28 @@ export class AttachedFilesStore {
 
 	// ------------------------------------------------------------- internals
 
-	/** Identical re-link (same name, or same File identity) → silent no-op. */
-	#isDuplicate(desired: string, file: File): boolean {
+	/** Identical session-file re-link (same name, or same File identity) → silent no-op.
+	 * Session rows only — message rows dedupe by their content-hash id in
+	 * registerMessageFiles, and a same-named row of the other scope is a
+	 * different file, not a duplicate. */
+	#isDuplicate(rawPath: string, file: File): boolean {
+		// "Duplicate" means the SAME source file re-linked: identical stats plus a
+		// matching RAW identity — the row's sourceName (raw name at link time,
+		// `name` fallback for pre-provenance rows) or, for folder children, the
+		// raw on-disk relPath. Never a display-name compare: sanitize and suffix
+		// both lose information, so two distinct raw names can share a display
+		// name even with equal stats and must both survive (#claimName suffixes
+		// the second).
 		return this.files.some(
 			(f) =>
 				// Folder-root placeholders aren't real files — they must not block attaching a
 				// standalone file that happens to share the folder's name.
 				!f.isFolderRoot &&
-				(f.name === desired ||
-					// Identical re-drop at the SAME relative path (its row name may have been
-					// auto-suffixed). Keyed on the path, NOT the basename — otherwise two distinct
-					// files sharing a basename under different folder subdirs (proj/a/index.ts vs
-					// proj/b/index.ts) would be wrongly deduped and silently dropped.
-					((f.relPath ?? f.name) === desired &&
-						f.size === file.size &&
-						f.file instanceof File &&
-						f.file.lastModified === file.lastModified))
+				!f.messageScoped &&
+				f.size === file.size &&
+				f.file instanceof File &&
+				f.file.lastModified === file.lastModified &&
+				((f.sourceName ?? f.name) === rawPath || f.relPath === rawPath)
 		)
 	}
 
@@ -402,16 +512,20 @@ export class AttachedFilesStore {
 
 	#pushIndexing(p: {
 		name: string
+		sourceName?: string
 		file: File | Blob
 		folder?: string
 		sourceId: string
 		handle?: FileSystemDirectoryHandle
 		relPath?: string
+		messageScoped?: boolean
+		id?: string
 	}): void {
 		this.files = [
 			...this.files,
 			{
 				name: p.name,
+				sourceName: p.sourceName,
 				file: p.file,
 				size: p.file.size,
 				lineIndex: [],
@@ -420,7 +534,9 @@ export class AttachedFilesStore {
 				folder: p.folder,
 				sourceId: p.sourceId,
 				handle: p.handle,
-				relPath: p.relPath
+				relPath: p.relPath,
+				messageScoped: p.messageScoped,
+				id: p.id
 			}
 		]
 		void this.#indexFile(p.name, p.file)
@@ -431,10 +547,18 @@ export class AttachedFilesStore {
 		status: AttachedFileStatus,
 		isFolderRoot = false
 	): void {
+		// File placeholders claim like any row (a legacy name may collide once
+		// sanitized); folder-root placeholders keep the folder key's name and stay
+		// outside name uniqueness — they may legitimately share a name with a file.
+		const name = isFolderRoot
+			? sanitizeAttachmentName(item.name)
+			: this.#claimName(item.sourceName ?? item.name)
+		const sourceName = isFolderRoot ? undefined : (item.sourceName ?? item.name)
 		this.files = [
 			...this.files,
 			{
-				name: item.name,
+				name,
+				sourceName,
 				file: EMPTY,
 				size: item.size ?? 0,
 				lineIndex: [],
@@ -453,8 +577,16 @@ export class AttachedFilesStore {
 		const children = await enumerateDir(dirHandle)
 		for (const { file, path } of children) {
 			if (!(await this.#sniffText(file))) continue
-			const name = this.#uniqueName(path)
-			this.#pushIndexing({ name, file, folder, sourceId, handle: dirHandle, relPath: path })
+			const name = this.#claimName(path)
+			this.#pushIndexing({
+				name,
+				sourceName: path,
+				file,
+				folder,
+				sourceId,
+				handle: dirHandle,
+				relPath: path
+			})
 		}
 		this.#ensureFolderRow(sourceId, folder, dirHandle)
 	}
@@ -501,22 +633,33 @@ export class AttachedFilesStore {
 			if (!cur) {
 				// newly added on disk
 				if (!(await this.#sniffText(file))) continue
-				const name = this.#uniqueName(path)
-				this.#pushIndexing({ name, file, folder, sourceId, handle, relPath: path })
+				const name = this.#claimName(path)
+				this.#pushIndexing({
+					name,
+					sourceName: path,
+					file,
+					folder,
+					sourceId,
+					handle,
+					relPath: path
+				})
 			} else {
 				const curMod = cur.file instanceof File ? cur.file.lastModified : undefined
 				if (file.size !== cur.size || file.lastModified !== curMod) {
-					// content changed → re-read + re-index
-					this.#patch(cur.name, { file, size: file.size, status: 'indexing' })
+					// content changed → re-read + re-index. Patch by row identity — a
+					// message attachment may share the display name.
+					this.files = this.files.map((f) =>
+						f === cur ? { ...f, file, size: file.size, status: 'indexing' } : f
+					)
 					void this.#indexFile(cur.name, file)
 				}
 			}
 		}
-		// removed/renamed-away on disk → drop from memory
-		const removed = [...existing.values()].filter((f) => f.relPath && !seen.has(f.relPath))
-		if (removed.length > 0) {
-			const names = new Set(removed.map((f) => f.name))
-			this.files = this.files.filter((f) => !names.has(f.name))
+		// removed/renamed-away on disk → drop from memory (by row identity — a
+		// message attachment may share the display name and must survive)
+		const removed = new Set([...existing.values()].filter((f) => f.relPath && !seen.has(f.relPath)))
+		if (removed.size > 0) {
+			this.files = this.files.filter((f) => !removed.has(f))
 		}
 		this.#ensureFolderRow(sourceId, folder, handle)
 	}
@@ -563,9 +706,6 @@ export class AttachedFilesStore {
 		}
 	}
 
-	#patch(name: string, changes: Partial<AttachedFile>): void {
-		this.files = this.files.map((f) => (f.name === name ? { ...f, ...changes } : f))
-	}
 	/**
 	 * Patch the row for `name` ONLY while it still holds the exact `file` we indexed.
 	 * `buildLineIndex` is async and unawaited; between its start and finish the row's
@@ -583,10 +723,22 @@ export class AttachedFilesStore {
 		this.files = this.files.map((f) => (f.sourceId === sourceId ? { ...f, ...changes } : f))
 	}
 
+	/** The only way a session row gets its display name: sanitize (control
+	 * characters must never reach model-facing text) then uniquify among session
+	 * rows. Every creation path — attach, folder expansion, refresh, persisted
+	 * restore — goes through here so none can skip a rule. Message rows stay out
+	 * by design (id-addressed, names may collide); `relPath`, `folder`, and the
+	 * row's `sourceName` (re-link identity) stay raw by design. */
+	#claimName(raw: string): string {
+		return this.#uniqueName(sanitizeAttachmentName(raw))
+	}
+
 	#uniqueName(original: string): string {
-		// Uniqueness is only among real files — folder-root placeholders may share a name
-		// with a standalone file and must not push it to a "(2)" suffix.
-		const taken = (n: string) => this.files.some((f) => f.name === n && !f.isFolderRoot)
+		// Uniqueness is only among session rows: folder-root placeholders aren't real
+		// files, and message rows are addressed by id — their display names neither
+		// block a session link nor need protecting from one.
+		const taken = (n: string) =>
+			this.files.some((f) => f.name === n && !f.isFolderRoot && !f.messageScoped)
 		if (!taken(original)) return original
 		const dot = original.lastIndexOf('.')
 		const base = dot > 0 ? original.slice(0, dot) : original
diff --git a/frontend/src/lib/components/copilot/chat/files/attachedFiles.test.ts b/frontend/src/lib/components/copilot/chat/files/attachedFiles.test.ts
index c81bc1f9c4..4376314c5f 100644
--- a/frontend/src/lib/components/copilot/chat/files/attachedFiles.test.ts
+++ b/frontend/src/lib/components/copilot/chat/files/attachedFiles.test.ts
@@ -34,11 +34,17 @@ vi.mock('./fileEngine', async (importOriginal) => {
 })
 
 import { AttachedFilesStore } from './attachedFiles.svelte'
+import { attachedTextFileId } from '../textFileUtils'
 
 function file(name: string, content: string, lastModified = 1): File {
 	return new File([content], name, { type: 'text/plain', lastModified })
 }
 
+/** A message attachment as the transcript carries it: name + content + stable id. */
+function mf(name: string, content: string): { name: string; content: string; id: string } {
+	return { name, content, id: attachedTextFileId(name, content) }
+}
+
 const dir = { kind: 'directory', name: 'proj' } as unknown as FileSystemDirectoryHandle
 
 async function settle(store: AttachedFilesStore) {
@@ -401,6 +407,31 @@ describe('AttachedFilesStore', () => {
 		}
 	})
 
+	it('keeps a session row indexable when a same-named message file registers mid-index', async () => {
+		buildMode = 'manual'
+		try {
+			const S = file('notes.md', 'session\n')
+			await store.addFiles([S]) // session row 'notes.md' (file S) → index pending
+
+			// A same-named message attachment rebuilds while S is still indexing —
+			// neither row is renamed, and neither index is stranded.
+			store.syncMessageScoped([mf('notes.md', 'message\n')])
+
+			for (const d of [...buildDeferreds]) d.resolve({ lineIndex: [0], lineCount: 1 })
+			await settle(store)
+
+			// Both rows ready: the message row via its id, the session row via name.
+			const messageRow = store.resolve(attachedTextFileId('notes.md', 'message\n'))
+			expect(messageRow?.messageScoped).toBe(true)
+			expect(messageRow?.status).toBe('ready')
+			const sessionRow = store.files.find((f) => f.name === 'notes.md' && !f.messageScoped)
+			expect(sessionRow?.status).toBe('ready')
+		} finally {
+			buildMode = 'real'
+			buildDeferreds.length = 0
+		}
+	})
+
 	it('removeFolder deletes the live folder record from storage (persisted session)', async () => {
 		const { deleteItem } = await import('./attachedFilesDB')
 		const s = new AttachedFilesStore()
@@ -473,4 +504,204 @@ describe('AttachedFilesStore', () => {
 		await settle(s)
 		expect(s.folders[0].files.map((f) => f.relPath)).toEqual(['proj/app.ts'])
 	})
+
+	it('a session link and a message attachment share a name independently', async () => {
+		await store.addFiles([file('notes.md', 'session content\n')])
+		await settle(store)
+
+		store.registerMessageFiles([mf('notes.md', 'message content\n')])
+		await settle(store)
+
+		// Two rows, one display name, independently addressable: the message row by
+		// its id, the session row by name (its roster handle — a bare-name resolve
+		// must return it, never the same-named message attachment shadowing it).
+		const messageRow = store.resolve(attachedTextFileId('notes.md', 'message content\n'))
+		expect(messageRow?.messageScoped).toBe(true)
+		expect(await (messageRow!.file as Blob).text()).toBe('message content\n')
+		const sessionRow = store.resolve('notes.md')
+		expect(sessionRow?.messageScoped).toBeFalsy()
+		expect(await (sessionRow!.file as Blob).text()).toBe('session content\n')
+
+		// A footer removal of the session file must not take the message row along.
+		store.removeFile('notes.md')
+		expect(store.resolve(messageRow!.id!)?.messageScoped).toBe(true)
+		expect(store.standalone).toEqual([])
+	})
+
+	it('resolve falls back to a name lookup for legacy references', async () => {
+		// Chats persisted before ids existed reference message files by bare name.
+		store.registerMessageFiles([mf('notes.md', 'message content\n')])
+		await settle(store)
+		expect(store.resolve('notes.md')?.messageScoped).toBe(true)
+		expect(await (store.resolve('notes.md')!.file as Blob).text()).toBe('message content\n')
+	})
+
+	it('resolve accepts the printed composite label verbatim', async () => {
+		// Rosters and search hits print `name (file id: x)`; models echo references
+		// verbatim, so the printed form must resolve.
+		const f = mf('notes.md', 'message content\n')
+		store.registerMessageFiles([f])
+		await settle(store)
+		expect(store.resolve(`notes.md (file id: ${f.id})`)?.id).toBe(f.id)
+	})
+
+	it('stores control-char filenames sanitized so the advertised name resolves', async () => {
+		// The roster prints sanitized names; the stored name must BE that name or
+		// the reference shown to the model would not resolve.
+		await store.addFiles([file('a\nb.md', 'controlled\n')])
+		await settle(store)
+		expect(store.get('a b.md')?.status).toBe('ready')
+		expect(store.resolve('a b.md')).toBeDefined()
+		expect(store.list().some((f) => f.name.includes('\n'))).toBe(false)
+	})
+
+	it('re-linking a control-char filename dedupes against the sanitized stored name', async () => {
+		await store.addFiles([file('a\nb.md', 'controlled\n')])
+		await settle(store)
+		// The duplicate check must compare what is STORED (sanitized), not the raw
+		// re-link name — else every control-char file re-links as a "(2)" copy.
+		await store.addFiles([file('a\nb.md', 'controlled\n')])
+		await settle(store)
+		expect(store.standalone.map((f) => f.name)).toEqual(['a b.md'])
+	})
+
+	it('links two distinct files whose raw names sanitize identically — equal stats included', async () => {
+		// A display-name collision is NOT a duplicate: the re-link identity is the
+		// RAW name, so even identical size and mtime cannot collapse two distinct
+		// raw names into one row. The second claims a suffixed name.
+		await store.addFiles([file('a\nb.md', 'first\n', 1)])
+		await settle(store)
+		await store.addFiles([file('a\tb.md', 'other\n', 1)]) // same size, same mtime
+		await settle(store)
+		expect(store.standalone.map((f) => f.name).sort()).toEqual(['a b (2).md', 'a b.md'])
+
+		// Re-link of the suffixed file matches via its raw sourceName.
+		await store.addFiles([file('a\tb.md', 'other\n', 1)])
+		await settle(store)
+		expect(store.standalone).toHaveLength(2)
+	})
+
+	it('re-link dedupe survives a reload — raw provenance is persisted', async () => {
+		const { getItemsForSession } = await import('./attachedFilesDB')
+		const record = (id: string, name: string, sourceName: string, blob: File) => ({
+			id,
+			sessionId: 's1',
+			kind: 'snapshot' as const,
+			name,
+			sourceName,
+			blob,
+			size: blob.size,
+			lastModified: blob.lastModified,
+			addedAt: 1
+		})
+		;(getItemsForSession as ReturnType<typeof vi.fn>).mockResolvedValueOnce([
+			record('r1', 'a b.md', 'a\nb.md', file('a b.md', 'first\n', 1)),
+			record('r2', 'a b (2).md', 'a\tb.md', file('a b (2).md', 'other\n', 2))
+		])
+		const s = new AttachedFilesStore()
+		await s.restore('s1', false)
+		await settle(s)
+		expect(s.standalone.map((f) => f.name).sort()).toEqual(['a b (2).md', 'a b.md'])
+
+		// Re-linking the original file behind the suffixed row must dedupe, not
+		// create `a b (3).md` — the raw identity rode the persisted record.
+		await s.addFiles([file('a\tb.md', 'other\n', 2)])
+		await settle(s)
+		expect(s.standalone).toHaveLength(2)
+	})
+
+	it('restore claims names, keeping legacy rows that sanitize identically distinct', async () => {
+		const { getItemsForSession } = await import('./attachedFilesDB')
+		const record = (id: string, name: string) => ({
+			id,
+			sessionId: 's1',
+			kind: 'snapshot' as const,
+			name,
+			blob: new Blob([`content ${id}\n`]),
+			size: 10,
+			lastModified: 1,
+			addedAt: 1
+		})
+		;(getItemsForSession as ReturnType<typeof vi.fn>).mockResolvedValueOnce([
+			record('r1', 'a\nb.md'),
+			record('r2', 'a\tb.md')
+		])
+		const s = new AttachedFilesStore()
+		await s.restore('s1', false)
+		await settle(s)
+		// Both legacy rows sanitize to `a b.md`; the claim must uniquify so each
+		// stays independently visible and resolvable.
+		expect(s.standalone.map((f) => f.name).sort()).toEqual(['a b (2).md', 'a b.md'])
+		expect(s.resolve('a b.md')).toBeDefined()
+		expect(s.resolve('a b (2).md')).toBeDefined()
+	})
+
+	it('resolve prefers a literal filename over label interpretation', async () => {
+		// A file literally named like a printed label must stay addressable by its
+		// exact name — label parsing must not strip it down to the base name.
+		await store.addFiles([file('notes (file id: missing)', 'literal\n'), file('notes', 'base\n')])
+		await settle(store)
+		expect(await (store.resolve('notes (file id: missing)')!.file as Blob).text()).toBe('literal\n')
+	})
+
+	it('syncMessageScoped reconciles rows to the transcript references', async () => {
+		store.syncMessageScoped([mf('a.md', 'aaa\n'), mf('b.md', 'bbb\n')])
+		await settle(store)
+		expect(store.messageAttached.map((f) => f.name).sort()).toEqual(['a.md', 'b.md'])
+
+		// A message dropped from the transcript prunes its row; the survivor stays.
+		store.syncMessageScoped([mf('a.md', 'aaa\n')])
+		await settle(store)
+		expect(store.messageAttached.map((f) => f.name)).toEqual(['a.md'])
+
+		store.syncMessageScoped([])
+		expect(store.messageAttached).toEqual([])
+	})
+
+	it('back-to-back reconciliations commit only the latest set', async () => {
+		// Rapid chat switching fires syncs in quick succession; reconciliation is
+		// synchronous, so the last call's set simply wins.
+		store.syncMessageScoped([mf('old.md', 'OLD sentinel\n')])
+		store.syncMessageScoped([mf('new.md', 'NEW sentinel\n')])
+		await settle(store)
+		expect(store.messageAttached.map((f) => f.name)).toEqual(['new.md'])
+	})
+
+	it('syncMessageScoped replaces a stale row under the same name', async () => {
+		store.syncMessageScoped([mf('a.md', 'old\n')])
+		await settle(store)
+
+		// The transcript's copy changed (edited message): different content means a
+		// different id, so the stale row is pruned and the new one registered.
+		store.syncMessageScoped([mf('a.md', 'new\n')])
+		await settle(store)
+		expect(store.messageAttached.map((f) => f.name)).toEqual(['a.md'])
+		expect(await (store.get('a.md')!.file as Blob).text()).toBe('new\n')
+	})
+
+	it('keeps message-scoped files tool-readable but out of the footer roster', async () => {
+		store.registerMessageFiles([mf('notes.md', 'hello\n')])
+		await settle(store)
+
+		// Hidden from the session bar, listed for the tools, readable by id.
+		expect(store.standalone).toEqual([])
+		expect(store.messageAttached.map((f) => f.name)).toEqual(['notes.md'])
+		expect(store.resolve(attachedTextFileId('notes.md', 'hello\n'))?.status).toBe('ready')
+
+		// Identical re-registration (retry / sync rebuild) reuses the row — same id.
+		store.registerMessageFiles([mf('notes.md', 'hello\n')])
+		expect(store.messageAttached.map((f) => f.name)).toEqual(['notes.md'])
+
+		// A same-named file with DIFFERENT content is another message's attachment:
+		// distinct id, its own row, both independently readable under one label.
+		store.registerMessageFiles([mf('notes.md', 'other\n')])
+		await settle(store)
+		expect(store.messageAttached.map((f) => f.name)).toEqual(['notes.md', 'notes.md'])
+		expect(
+			await (store.resolve(attachedTextFileId('notes.md', 'other\n'))!.file as Blob).text()
+		).toBe('other\n')
+		expect(
+			await (store.resolve(attachedTextFileId('notes.md', 'hello\n'))!.file as Blob).text()
+		).toBe('hello\n')
+	})
 })
diff --git a/frontend/src/lib/components/copilot/chat/files/attachedFilesDB.ts b/frontend/src/lib/components/copilot/chat/files/attachedFilesDB.ts
index 36f9ac4fbe..fe051ef8cc 100644
--- a/frontend/src/lib/components/copilot/chat/files/attachedFilesDB.ts
+++ b/frontend/src/lib/components/copilot/chat/files/attachedFilesDB.ts
@@ -21,6 +21,9 @@ export interface PersistedAttachedItem {
 	kind: AttachedItemKind
 	/** Display name: relative path for files, folder name for dir-handle records. */
 	name: string
+	/** Raw pre-sanitization source name — the re-link identity. Absent on records
+	 * persisted before provenance existed (dedupe then falls back to `name`). */
+	sourceName?: string
 	/** Top-level folder (for grouping); equals `name` for dir-handle records. */
 	folder?: string
 	/** Folder-relative path (snapshot folder children) — restores the folder grouping/tree. */
diff --git a/frontend/src/lib/components/copilot/chat/files/fileTools.test.ts b/frontend/src/lib/components/copilot/chat/files/fileTools.test.ts
index 0bd45153af..bb61f95c8c 100644
--- a/frontend/src/lib/components/copilot/chat/files/fileTools.test.ts
+++ b/frontend/src/lib/components/copilot/chat/files/fileTools.test.ts
@@ -9,7 +9,9 @@ vi.mock('../shared', () => ({
 import { searchFilesTool } from './fileTools'
 import type { AttachedFile, AttachedFilesStore } from './attachedFiles.svelte'
 
-/** Minimal store stub: searchFilesTool's empty-ready path only reads count/readyFiles/list. */
+/** Minimal store stub mirroring the real lookup contract (id first, then
+ * session-name, then message-name — the real ordering is pinned in
+ * attachedFiles.test.ts). */
 function fakeStore(rows: Array<Partial<AttachedFile>>): AttachedFilesStore {
 	const files = rows as AttachedFile[]
 	return {
@@ -17,13 +19,20 @@ function fakeStore(rows: Array<Partial<AttachedFile>>): AttachedFilesStore {
 			return files.length
 		},
 		readyFiles: () => files.filter((f) => f.status === 'ready' && !f.isFolderRoot),
-		list: () => files
+		list: () => files,
+		resolve: (ref: string) =>
+			files.find((f) => f.id === ref) ??
+			files.find((f) => f.name === ref && !f.isFolderRoot && !f.messageScoped) ??
+			files.find((f) => f.name === ref && f.messageScoped)
 	} as unknown as AttachedFilesStore
 }
 
-async function runSearch(store: AttachedFilesStore): Promise<string> {
+async function runSearch(
+	store: AttachedFilesStore,
+	args: Record<string, unknown> = { pattern: 'x' }
+): Promise<string> {
 	const res = await searchFilesTool.fn({
-		args: { pattern: 'x' },
+		args,
 		helpers: { attachedFiles: store },
 		toolId: 't',
 		toolCallbacks: { setToolStatus: () => {} }
@@ -64,3 +73,52 @@ describe('search_files — attachments present but nothing readable', () => {
 		expect(msg).toMatch(/still being indexed/i)
 	})
 })
+
+describe('roster — folder names are raw disk keys, sanitized at render', () => {
+	it('strips control characters from locked/unavailable folder lines', async () => {
+		const { buildAttachedFilesRoster } = await import('./fileTools')
+		const store = {
+			folders: [{ name: 'bad\nfolder', status: 'locked', files: [] }],
+			standalone: [],
+			messageAttached: []
+		} as any
+		const roster = buildAttachedFilesRoster(store)
+		expect(roster).toContain('- bad folder (locked')
+		expect(roster).not.toContain('bad\nfolder')
+	})
+})
+
+// Display names may collide (same-named attachments on different messages). In
+// this environment `new Worker` throws, so searchFilesInWorker takes its
+// main-thread fallback — the search logic exercised is the same.
+describe('search_files — colliding display names', () => {
+	const colliding = () =>
+		fakeStore([
+			{
+				name: 'notes.md',
+				status: 'ready',
+				messageScoped: true,
+				id: 'fAAA',
+				file: new Blob(['alpha target\n'])
+			},
+			{
+				name: 'notes.md',
+				status: 'ready',
+				messageScoped: true,
+				id: 'fBBB',
+				file: new Blob(['bravo target\n'])
+			}
+		])
+
+	it('labels unscoped hits with the id that resolves back to the matching row', async () => {
+		const out = await runSearch(colliding(), { pattern: 'target' })
+		expect(out).toContain('notes.md (file id: fAAA):1: alpha target')
+		expect(out).toContain('notes.md (file id: fBBB):1: bravo target')
+	})
+
+	it('an id-scoped search hits only its own row', async () => {
+		const out = await runSearch(colliding(), { pattern: 'target', file: 'fBBB' })
+		expect(out).toContain('bravo target')
+		expect(out).not.toContain('alpha target')
+	})
+})
diff --git a/frontend/src/lib/components/copilot/chat/files/fileTools.ts b/frontend/src/lib/components/copilot/chat/files/fileTools.ts
index 982b858154..ebdc983778 100644
--- a/frontend/src/lib/components/copilot/chat/files/fileTools.ts
+++ b/frontend/src/lib/components/copilot/chat/files/fileTools.ts
@@ -17,6 +17,7 @@ import {
 	type SearchHit
 } from './fileEngine'
 import type { AttachedFile, AttachedFilesStore } from './attachedFiles.svelte'
+import { sanitizeAttachmentName } from '../textFileUtils'
 
 /** Slice of the GLOBAL tool helpers that exposes the attached-files store. */
 export interface AttachedFilesHelper {
@@ -34,7 +35,7 @@ function storeFrom(helpers: unknown): AttachedFilesStore | undefined {
  * same accurate status instead of search_files claiming a non-ready file isn't attached.
  */
 function notReadyMessage(store: AttachedFilesStore, file: string): string | undefined {
-	const entry = store.get(file)
+	const entry = store.resolve(file)
 	if (entry?.status === 'ready') return undefined
 	if (entry?.status === 'indexing')
 		return `File "${file}" is still being indexed. Try again shortly.`
@@ -44,11 +45,14 @@ function notReadyMessage(store: AttachedFilesStore, file: string): string | unde
 		return `File "${file}" is no longer available (moved, deleted, or its local copy was evicted). Ask the user to re-link it.`
 	if (entry?.status === 'error')
 		return `File "${file}" failed to load: ${entry.error ?? 'unknown error'}.`
+	// Re-sanitized: folder-root placeholder rows carry the raw folder key.
 	const names = store
 		.list()
-		.map((f) => f.name)
+		.map((f) =>
+			f.id ? `${sanitizeAttachmentName(f.name)} (file id: ${f.id})` : sanitizeAttachmentName(f.name)
+		)
 		.join(', ')
-	return `No attached file named "${file}". Attached files: ${names || '(none)'}.`
+	return `No attached file matching "${file}". Attached files: ${names || '(none)'}.`
 }
 
 /**
@@ -80,7 +84,7 @@ const searchFilesSchema = z.object({
 		.string()
 		.optional()
 		.describe(
-			'Optional exact filename (as listed under "Attached files") to restrict the search to. Omit to search across all attached files.'
+			'Optional file to restrict the search to: its file id when one is listed, otherwise its exact filename. Omit to search across all attached files.'
 		),
 	ignore_case: z.boolean().optional().describe('Case-insensitive matching. Defaults to false.')
 })
@@ -105,7 +109,11 @@ export const searchFilesTool: Tool<{}> = {
 			const notReady = notReadyMessage(store, parsed.file)
 			if (notReady) return notReady
 		}
-		const ready = store.readyFiles()
+		// Restrict to the resolved row itself, not a name filter: display names may
+		// collide (same-named attachments on different messages), and a name filter
+		// would silently search all of them under one label.
+		const target = parsed.file ? store.resolve(parsed.file) : undefined
+		const ready = target ? [target] : store.readyFiles()
 		if (ready.length === 0) {
 			return noReadyFilesMessage(store)
 		}
@@ -113,15 +121,18 @@ export const searchFilesTool: Tool<{}> = {
 			content: `Searching attached files for /${parsed.pattern}/...`
 		})
 
+		// Hit lines are the model's only handle on which row matched, and display
+		// names may collide — label id-bearing rows with the reference that
+		// resolves back to exactly that row.
+		const rows = ready.map((f) => (f.id ? { ...f, name: `${f.name} (file id: ${f.id})` } : f))
 		// Run in a Worker so a pathological model-supplied regex can't freeze the tab.
-		const result = await searchFilesInWorker(ready, parsed.pattern, {
-			flags: parsed.ignore_case ? 'i' : '',
-			pathFilter: parsed.file
+		const result = await searchFilesInWorker(rows, parsed.pattern, {
+			flags: parsed.ignore_case ? 'i' : ''
 		})
 		if (result.error) {
 			return `Error: ${result.error}`
 		}
-		const scope = parsed.file ? `"${parsed.file}"` : `${ready.length} file(s)`
+		const scope = target ? `"${target.name}"` : `${ready.length} file(s)`
 		if (result.hits.length === 0) {
 			return `No matches for /${parsed.pattern}/ in ${scope}.`
 		}
@@ -135,7 +146,9 @@ export const searchFilesTool: Tool<{}> = {
 }
 
 const readFileSchema = z.object({
-	file: z.string().describe('Exact filename to read, as listed under "Attached files".'),
+	file: z
+		.string()
+		.describe('File to read: its file id when one is listed, otherwise its exact filename.'),
 	start_line: z.number().int().optional().describe('1-based first line to read. Defaults to 1.'),
 	end_line: z
 		.number()
@@ -160,8 +173,8 @@ export const readFileTool: Tool<{}> = {
 		const parsed = readFileSchema.parse(args)
 		const notReady = notReadyMessage(store, parsed.file)
 		if (notReady) return notReady
-		const entry = store.get(parsed.file)!
-		toolCallbacks.setToolStatus(toolId, { content: `Reading "${parsed.file}"...` })
+		const entry = store.resolve(parsed.file)!
+		toolCallbacks.setToolStatus(toolId, { content: `Reading "${entry.name}"...` })
 
 		try {
 			const res = await readFile(entry, {
@@ -181,32 +194,59 @@ export const readFileTool: Tool<{}> = {
 export const fileTools: Tool<{}>[] = [searchFilesTool, readFileTool]
 
 function rosterLine(f: AttachedFile): string {
-	if (f.status === 'indexing') return `- ${f.name} (indexing…)`
-	if (f.status === 'locked') return `- ${f.name} (locked — needs the user to restore access)`
-	if (f.status === 'unavailable') return `- ${f.name} (unavailable)`
-	if (f.status === 'error') return `- ${f.name} (failed to load)`
-	return `- ${f.name} — ${f.lineCount} lines, ${humanSize(f.size)}`
+	// Message rows are addressed by their stable id (names may collide); session
+	// rows by name. Names are sanitized at render: this block is model-facing
+	// prompt text and stored names (legacy, folder children) may carry controls.
+	const ref = f.id
+		? `${sanitizeAttachmentName(f.name)} (file id: ${f.id})`
+		: sanitizeAttachmentName(f.name)
+	if (f.status === 'indexing') return `- ${ref} (indexing…)`
+	if (f.status === 'locked') return `- ${ref} (locked — needs the user to restore access)`
+	if (f.status === 'unavailable') return `- ${ref} (unavailable)`
+	if (f.status === 'error') return `- ${ref} (failed to load)`
+	return `- ${ref} — ${f.lineCount} lines, ${humanSize(f.size)}`
 }
 
 /** Build the `## Attached files` system-prompt section (metadata only, never content). */
-export function buildAttachedFilesRoster(store: AttachedFilesStore): string {
+export function buildAttachedFilesRoster(
+	store: AttachedFilesStore,
+	orphanedMessageFileIds?: Set<string>
+): string {
 	const lines: string[] = []
 	for (const folder of store.folders) {
+		// Folder names are RAW disk keys (never sanitized in the store — they must
+		// match the handle, children, and persistence record), so this model-facing
+		// render is where control characters get stripped.
+		const folderName = sanitizeAttachmentName(folder.name)
 		// A locked/unavailable folder has no readable children — one line for the whole folder.
 		if (folder.status === 'locked') {
-			lines.push(`- ${folder.name} (locked — needs the user to restore access)`)
+			lines.push(`- ${folderName} (locked — needs the user to restore access)`)
 		} else if (folder.status === 'unavailable') {
-			lines.push(`- ${folder.name} (unavailable)`)
+			lines.push(`- ${folderName} (unavailable)`)
 		} else {
 			lines.push(...folder.files.map(rosterLine))
 		}
 	}
+	// Message-attached files are deliberately NOT listed here: their reference
+	// lives inside the message that carried them (or the compaction summary),
+	// exactly like DOM picks — the roster only advertises session-wide links.
 	lines.push(...store.standalone.map(rosterLine))
+	// Exception: a message whose API counterpart was dropped by drop-oldest
+	// compaction takes its in-message reference with it, so those attachments must
+	// be advertised here or the model can no longer see they exist.
+	if (orphanedMessageFileIds?.size) {
+		lines.push(
+			...store.messageAttached
+				.filter((f) => f.id && orphanedMessageFileIds.has(f.id))
+				.map(rosterLine)
+		)
+	}
 	if (lines.length === 0) return ''
 	return [
 		'## Attached files',
 		'The user has attached the following files to this conversation. Their contents are NOT included here.',
 		'Use the `search_files` tool to find content with a regex, and `read_file` to read a bounded window of lines.',
+		'Reference a file by its file id when one is shown, otherwise by its filename.',
 		'',
 		lines.join('\n')
 	].join('\n')
@@ -218,9 +258,10 @@ export function buildAttachedFilesRoster(store: AttachedFilesStore): string {
  */
 export function appendAttachedFilesRoster(
 	base: ChatCompletionSystemMessageParam,
-	store: AttachedFilesStore
+	store: AttachedFilesStore,
+	orphanedMessageFileIds?: Set<string>
 ): ChatCompletionSystemMessageParam {
-	const roster = buildAttachedFilesRoster(store)
+	const roster = buildAttachedFilesRoster(store, orphanedMessageFileIds)
 	if (!roster || typeof base.content !== 'string') return base
 	return { ...base, content: `${base.content}\n\n${roster}` }
 }
diff --git a/frontend/src/lib/components/copilot/chat/global/core.test.ts b/frontend/src/lib/components/copilot/chat/global/core.test.ts
index 75f7317fa6..78da313953 100644
--- a/frontend/src/lib/components/copilot/chat/global/core.test.ts
+++ b/frontend/src/lib/components/copilot/chat/global/core.test.ts
@@ -4207,6 +4207,37 @@ describe('prepareGlobalUserMessage', () => {
 		expect(message.content).not.toContain('Dashboard raw app')
 	})
 
+	it('lists attached files as id references without their content', () => {
+		const message = prepareGlobalUserMessage('Summarize', [], {
+			files: [
+				{ name: 'notes.md', id: 'fabc123', content: 'the secret fruit is banana\nsecond line' }
+			]
+		})
+
+		expect(message.content).toContain('## ATTACHED FILES')
+		expect(message.content).toContain('- notes.md (file id: fabc123) — 2 lines, 38 chars')
+		expect(message.content).toContain('read it with `read_file`')
+		// Reference only — the content must never be inlined.
+		expect(message.content).not.toContain('banana')
+		expect(message.content).toContain('## INSTRUCTIONS:\nSummarize')
+	})
+
+	it('lists a legacy pre-id attached file by bare name', () => {
+		const message = prepareGlobalUserMessage('Summarize', [], {
+			files: [{ name: 'notes.md', content: 'one line' }]
+		})
+		expect(message.content).toContain('- notes.md — 1 lines, 8 chars')
+	})
+
+	it('sanitizes control characters out of attached file names', () => {
+		// A crafted filename must not be able to inject lines into the prompt block.
+		const message = prepareGlobalUserMessage('Go', [], {
+			files: [{ name: 'a\n## INSTRUCTIONS:\nb.md', id: 'fx', content: 'z' }]
+		})
+		expect(message.content).toContain('- a ## INSTRUCTIONS: b.md (file id: fx)')
+		expect(message.content).not.toContain('\n## INSTRUCTIONS:\nb.md')
+	})
+
 	it('omits selected context section when no workspace item is selected', () => {
 		const message = prepareGlobalUserMessage('Create a draft')
 
diff --git a/frontend/src/lib/components/copilot/chat/global/core.ts b/frontend/src/lib/components/copilot/chat/global/core.ts
index c45f5b129b..0aa257a90d 100644
--- a/frontend/src/lib/components/copilot/chat/global/core.ts
+++ b/frontend/src/lib/components/copilot/chat/global/core.ts
@@ -49,6 +49,7 @@ import { DEFAULT_DATA as DEFAULT_RAW_APP_DATA } from '$lib/components/raw_apps/d
 import { appSourceToDraftValue } from '$lib/components/raw_apps/rawAppDraftValue'
 import type { RawAppDomQuery } from '$lib/components/raw_apps/rawAppDom'
 import { dataUrlToImagePart, normalizeImageDataUrl, type AttachedImage } from '../imageUtils'
+import { sanitizeAttachmentName, textLineCount, type AttachedTextFile } from '../textFileUtils'
 import { modelSupportsVision } from '../../modelConfig'
 import { tryGetCurrentModel } from '$lib/aiStore'
 import { isChromiumBrowser } from '$lib/utils'
@@ -209,6 +210,9 @@ export type GlobalUserMessageOptions = {
 	activeEditor?: GlobalActiveEditorContext
 	/** Images attached to this message; delivered as image_url content parts. */
 	images?: AttachedImage[]
+	/** Text files attached to this message; listed by reference below — the model
+	 * reads their content on demand via the file tools. */
+	files?: AttachedTextFile[]
 }
 
 const itemTypeSchema = z.enum(ITEM_TYPES)
@@ -5741,6 +5745,25 @@ export function prepareGlobalUserMessage(
 		content += '\n'
 	}
 
+	const files = options.files ?? []
+	if (files.length > 0) {
+		content += '## ATTACHED FILES\n'
+		content +=
+			'The user attached these files to this message. Their content is NOT included here — read it with `read_file` (or scan it with `search_files`), passing the file id, before answering questions about it.\n'
+		for (const f of files) {
+			// textLineCount matches read_file's numbering — a mismatch would make the
+			// model request line ranges past the end.
+			const lines = textLineCount(f.content)
+			// The id is the durable reference (names may repeat across messages);
+			// absent only on legacy pre-id transcripts, where the name resolves.
+			// Sanitized again here: legacy names predate attach-time sanitization.
+			const name = sanitizeAttachmentName(f.name)
+			const ref = f.id ? `${name} (file id: ${f.id})` : name
+			content += `- ${ref} — ${lines} lines, ${f.content.length} chars\n`
+		}
+		content += '\n'
+	}
+
 	content += `## INSTRUCTIONS:\n${instructions}`
 
 	const images = options.images ?? []
diff --git a/frontend/src/lib/components/copilot/chat/messageDraft.svelte.ts b/frontend/src/lib/components/copilot/chat/messageDraft.svelte.ts
new file mode 100644
index 0000000000..588fe4f4ff
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/messageDraft.svelte.ts
@@ -0,0 +1,152 @@
+/**
+ * A message draft: the four lanes that ship together with one send — text,
+ * pastes, images, text files. Every place a draft accumulates or moves
+ * (composer attach, queue append, dequeue restore, failure restore) goes
+ * through this type, so the draft rules — file dedupe by source identity,
+ * courtesy rename, attachment slot caps, all-lanes-move-together — live here
+ * once instead of being re-implemented at each aggregation point.
+ *
+ * Deliberately NOT owned here: the conversation byte budget (needs
+ * manager-wide state — enforced at the composer until it moves into the
+ * store) and @context/DOM picks (ContextManager owns their lifecycle).
+ */
+import { MAX_ATTACHED_IMAGES, type AttachedImage } from './imageUtils'
+import type { PasteAttachment } from './pasteTokens'
+import {
+	admitWithinByteBudget,
+	foldIntoDraft,
+	MAX_ATTACHED_FILES,
+	type AttachedTextFile
+} from './textFileUtils'
+
+/** A draft's four lanes as plain data — what moves between owners. */
+export interface DraftSnapshot {
+	text: string
+	pastes: PasteAttachment[]
+	images: AttachedImage[]
+	files: AttachedTextFile[]
+}
+
+export class MessageDraft {
+	text = $state('')
+	pastes = $state<PasteAttachment[]>([])
+	images = $state<AttachedImage[]>([])
+	files = $state<AttachedTextFile[]>([])
+
+	constructor(seed?: Partial<DraftSnapshot>) {
+		if (seed?.text) this.text = seed.text
+		if (seed?.pastes) this.pastes = [...seed.pastes]
+		if (seed?.images) this.images = [...seed.images]
+		if (seed?.files) this.files = [...seed.files]
+	}
+
+	get isEmpty(): boolean {
+		return (
+			this.text.trim() === '' &&
+			this.pastes.length === 0 &&
+			this.images.length === 0 &&
+			this.files.length === 0
+		)
+	}
+
+	/** Files joining a draft always fold (dedupe by source identity, courtesy
+	 * rename) and respect the slot cap. `byteBudget`, when given, admits the
+	 * folded entries by their decoded size — the fold must run first because
+	 * dedupe changes what gets charged. Returns dropped counts so the caller can
+	 * toast — the draft has no UI. */
+	addFiles(
+		reads: { name: string; content: string; sourceName?: string }[],
+		byteBudget?: number
+	): { droppedAtCap: number; droppedAtBudget: number } {
+		let folded = foldIntoDraft(this.files, reads)
+		let droppedAtBudget = 0
+		if (byteBudget !== undefined) {
+			const res = admitWithinByteBudget(folded, byteBudget)
+			folded = res.admitted
+			droppedAtBudget = res.dropped
+		}
+		const merged = [...this.files, ...folded]
+		const droppedAtCap = Math.max(0, merged.length - MAX_ATTACHED_FILES)
+		this.files = merged.slice(0, MAX_ATTACHED_FILES)
+		return { droppedAtCap, droppedAtBudget }
+	}
+
+	/** Images join up to the slot cap. Returns the dropped count (caller toasts). */
+	addImages(images: AttachedImage[]): number {
+		const merged = [...this.images, ...images]
+		const dropped = Math.max(0, merged.length - MAX_ATTACHED_IMAGES)
+		this.images = merged.slice(0, MAX_ATTACHED_IMAGES)
+		return dropped
+	}
+
+	/**
+	 * Merge a restored draft on top of this one (queued-message delete, restore
+	 * after a cancelled/errored turn): the restored draft was written FIRST, so
+	 * its text lands above and its attachments ahead of the newer ones — at the
+	 * caps it is the newest additions that drop, never the restored draft.
+	 * Returns whether text merged onto a non-empty draft (the caller must then
+	 * keep both drafts' context), plus dropped counts for toasts.
+	 */
+	prepend(restored: { text: string; images?: AttachedImage[]; files?: AttachedTextFile[] }): {
+		mergedIntoDraft: boolean
+		droppedImages: number
+		droppedFiles: number
+	} {
+		const mergedIntoDraft = !!restored.text && !!this.text.trim()
+		// An attachment-only restore has empty text; prepending would only add blank lines.
+		if (restored.text) {
+			this.text = this.text.trim() ? `${restored.text}\n\n${this.text}` : restored.text
+		}
+		let droppedImages = 0
+		if (restored.images?.length) {
+			const merged = [...restored.images, ...this.images]
+			droppedImages = Math.max(0, merged.length - MAX_ATTACHED_IMAGES)
+			this.images = merged.slice(0, MAX_ATTACHED_IMAGES)
+		}
+		let droppedFiles = 0
+		if (restored.files?.length) {
+			// The restored entries were already a normalized draft; the current
+			// (newer) files fold against them so dedupe/rename still apply.
+			const merged = [...restored.files, ...foldIntoDraft(restored.files, this.files)]
+			droppedFiles = Math.max(0, merged.length - MAX_ATTACHED_FILES)
+			this.files = merged.slice(0, MAX_ATTACHED_FILES)
+		}
+		return { mergedIntoDraft, droppedImages, droppedFiles }
+	}
+
+	/** Replace the draft with a snapshot, but only when it is empty — an occupied
+	 * draft keeps what the user is writing. Returns whether the restore was taken. */
+	replaceIfEmpty(snapshot: Partial<DraftSnapshot>): boolean {
+		if (!this.isEmpty) return false
+		this.replace(snapshot)
+		return true
+	}
+
+	/** Unconditionally replace all lanes (put a taken queue back, etc.). */
+	replace(snapshot: Partial<DraftSnapshot>): void {
+		this.text = snapshot.text ?? ''
+		this.pastes = [...(snapshot.pastes ?? [])]
+		this.images = [...(snapshot.images ?? [])]
+		this.files = [...(snapshot.files ?? [])]
+	}
+
+	/** Snapshot and clear atomically — the four lanes always move together, so no
+	 * call site can take one and forget another. */
+	take(): DraftSnapshot {
+		const snapshot: DraftSnapshot = {
+			text: this.text,
+			pastes: this.pastes,
+			images: this.images,
+			files: this.files
+		}
+		this.clear()
+		return snapshot
+	}
+
+	clear(): void {
+		this.text = ''
+		this.pastes = []
+		this.images = []
+		this.files = []
+	}
+}
diff --git a/frontend/src/lib/components/copilot/chat/messageDraft.test.ts b/frontend/src/lib/components/copilot/chat/messageDraft.test.ts
new file mode 100644
index 0000000000..a6a9bb6169
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/messageDraft.test.ts
@@ -0,0 +1,91 @@
+import { describe, it, expect } from 'vitest'
+import { MessageDraft } from './messageDraft.svelte'
+
+// Fold/rename/dedupe semantics are pinned in textFileUtils.test.ts; these pin
+// the draft-level guarantees: lanes move together, restores respect occupancy,
+// aggregation always applies the rules.
+
+describe('MessageDraft', () => {
+	it('take() snapshots and clears all four lanes atomically', () => {
+		const d = new MessageDraft({
+			text: 'hello',
+			pastes: [{ id: 'p1', content: 'x' } as any],
+			images: [{ dataUrl: 'i1' } as any],
+			files: [{ name: 'a.md', content: 'a' }]
+		})
+		const snap = d.take()
+		expect(snap.text).toBe('hello')
+		expect(snap.pastes).toHaveLength(1)
+		expect(snap.images).toHaveLength(1)
+		expect(snap.files).toHaveLength(1)
+		expect(d.isEmpty).toBe(true)
+	})
+
+	it('replaceIfEmpty declines when any lane is occupied', () => {
+		const d = new MessageDraft({ files: [{ name: 'a.md', content: 'a' }] })
+		expect(d.replaceIfEmpty({ text: 'restored' })).toBe(false)
+		expect(d.files).toHaveLength(1)
+		d.clear()
+		expect(d.replaceIfEmpty({ text: 'restored' })).toBe(true)
+		expect(d.text).toBe('restored')
+	})
+
+	it('prepend puts the restored draft first and folds the newer files against it', () => {
+		const d = new MessageDraft({ text: 'typing', files: [{ name: 'a.md', content: 'a' }] })
+		const res = d.prepend({
+			text: 'restored',
+			files: [
+				{ name: 'a.md', content: 'a' }, // identical to the newer draft's copy → it dedupes
+				{ name: 'a (2).md', content: 'b', sourceName: 'a.md' }
+			]
+		})
+		expect(res.mergedIntoDraft).toBe(true)
+		expect(d.text).toBe('restored\n\ntyping')
+		expect(d.files.map((f) => f.name)).toEqual(['a.md', 'a (2).md'])
+	})
+
+	it('prepend gives the restored draft chronological priority at the caps', () => {
+		// The restored draft was written first — the cap must drop the NEWEST
+		// additions, never the restored attachments.
+		const d = new MessageDraft({
+			files: Array.from({ length: 6 }, (_, i) => ({ name: `new${i}.md`, content: `${i}` }))
+		})
+		const res = d.prepend({
+			text: '',
+			files: Array.from({ length: 3 }, (_, i) => ({ name: `old${i}.md`, content: `o${i}` }))
+		})
+		expect(res.droppedFiles).toBe(1)
+		expect(d.files.map((f) => f.name)).toEqual([
+			'old0.md',
+			'old1.md',
+			'old2.md',
+			'new0.md',
+			'new1.md',
+			'new2.md',
+			'new3.md',
+			'new4.md'
+		])
+	})
+
+	it('addFiles reports drops at the slot cap and the byte budget', () => {
+		const d = new MessageDraft()
+		const many = Array.from({ length: 10 }, (_, i) => ({ name: `${i}.md`, content: `${i}` }))
+		expect(d.addFiles(many).droppedAtCap).toBe(2)
+		expect(d.files).toHaveLength(8)
+
+		const e = new MessageDraft()
+		// Budget admits by decoded size AFTER the fold — the identical duplicate is
+		// deduped, not charged.
+		const res = e.addFiles(
+			[
+				{ name: 'a.md', content: 'aaaa' },
+				{ name: 'a.md', content: 'aaaa' },
+				{ name: 'b.md', content: 'bbbb' },
+				{ name: 'c.md', content: 'cccc' }
+			],
+			8
+		)
+		expect(e.files.map((f) => f.name)).toEqual(['a.md', 'b.md'])
+		expect(res.droppedAtBudget).toBe(1)
+	})
+})
diff --git a/frontend/src/lib/components/copilot/chat/shared.ts b/frontend/src/lib/components/copilot/chat/shared.ts
index 2e3f49de5f..55febeb014 100644
--- a/frontend/src/lib/components/copilot/chat/shared.ts
+++ b/frontend/src/lib/components/copilot/chat/shared.ts
@@ -19,6 +19,7 @@ export const SPECIAL_MODULE_IDS = {
 import { get } from 'svelte/store'
 import type { PasteAttachment } from './pasteTokens'
 import { dataUrlToImagePart, type AttachedImage } from './imageUtils'
+import type { AttachedTextFile } from './textFileUtils'
 import type { CodePieceElement, ContextElement, FlowModuleCodePieceElement } from './context'
 import { workspaceStore } from '$lib/stores'
 import type { ExtendedOpenFlow } from '$lib/components/flows/types'
@@ -473,6 +474,10 @@ export type UserDisplayMessage = BaseDisplayMessage & {
 	// Images the user attached to this message (drag/drop/paste), rendered as
 	// thumbnails in the bubble. The LLM message carries them as image_url parts.
 	images?: AttachedImage[]
+	// Text files the user attached to this message, rendered as chips in the
+	// bubble. The prompt lists them by reference; the content here is the durable
+	// copy, re-registered into the session file store on load for tool reads.
+	files?: AttachedTextFile[]
 }
 
 export type CreatedResourceTriggerKind =
@@ -571,13 +576,20 @@ export type AssistantDisplayMessage = BaseDisplayMessage & {
 
 /**
  * Compaction boundary: replaces the summarized prefix in BOTH displayMessages
- * and the API messages (where it is a plain user message). It carries no index
- * because it is never a restart target — only the surviving tail's user
- * messages are rewound to.
+ * and the API messages (where it is a plain user message). It is never a restart
+ * target — only the surviving tail's user messages are rewound to.
  */
 export type SummaryDisplayMessage = {
 	role: 'summary'
 	content: string
+	// Index of the summary's API message, tracked ONLY so orphan detection can tell
+	// when a later drop-oldest compaction drops it (index goes negative) and its
+	// carried files must move to the roster. Not a restart target. Absent on
+	// summaries loaded from pre-existing history.
+	index?: number
+	// Files attached to messages the summary folded away — carried forward so
+	// they stay tool-readable (and reload-safe) after compaction.
+	files?: AttachedTextFile[]
 }
 
 export type DisplayMessage =
diff --git a/frontend/src/lib/components/copilot/chat/textFileUtils.test.ts b/frontend/src/lib/components/copilot/chat/textFileUtils.test.ts
new file mode 100644
index 0000000000000000000000000000000000000000..aca305d2b9494bae4868ece2693678cced58eeb7
GIT binary patch
literal 6684
zcmbVQ+iu**5ltSYuPE#WASaN<BP$o#fda_hH6UcyM%FU&APK7;vZ<lXY0}N6G$TR4
zVjuDWK|Uj2<uA#pYF=kXmo?zka>(lHx|}*y-RZo@t)p9tbs5=os&^=LJERwdjvU=l
zV)Ho#SE<vb3%1i*dV5R7^VIz-b+gpGS~~rziZ8X>!F%UaG}G~kUbr`DrjKL1Oz?1$
zAFX`i4|x_J8<&4)Rl=)FWm1>kXfHa~#=TW@jSmj$en^deomYkhE0cb%v@GLYSZcd5
zcKnQ``Sk~vW@WIw-S`#;>*fVJ6prZd?{vGpmAWuUON7E{J5Nnox-=qXVk%N&bWC4<
z`7agPmiT~Q&MLz(D;zH=G~{wah)9X>DMar|WtHyh-+K0pjuVJznyGR|2xq3*OXX55
zjb_SR>Jrhv(soH{Oe(Wl#mnBNsffAlE!KstTn<V6ElQdz7a<*&Vle_s-dWaP(o{$J
zTvKIOp_*oTOebt9JS)92wkpa^WZ^yKl`AUXz~qiTR;8m-XUQ%;i|-~{j<LvtBwUYa
z7+{?)$MYE82Q!^z`I!kuqp{0h=@2V7z~r7a5FUNyRzGq)j!g#Gyf>;SXStKTFTP0@
z?m9ZS(aH4BdmpnG<-un&`D^^mh2QLMwC$k~r%8fr)AdYqUNsrOjB+c_h=oIBsTLZf
znd9VWs!C0Vbr$*+alflijA#yHtdA%H?W4-OJrXHdww{z#74V-!&=t*wV(YuhRZ~_;
zk}fpkEXl2w2%!iy@B(1tpQ0!O<aen2lokNpB{}s8VQm)n6*j=yu<syrr{@i%I=uBl
z@aXbx)ruktpN}|BU#AR^7x*_?)|Br*N%@b64-+RMa~iZiI%Ul(-i9q*OWS~4`|$;H
zc!C8)Q6k7%4#LS)L7@hDle$(ZD1-lF1BfZ393gc%_`uFpmfm>6vK5mD)Tv7a9&wWP
z45UPgmxGr;o+T;(#4<;}5CR2uQ5S%KNVAb3m$@?F+7hh7Xo@ZKSsJ6h(nw_#S4D;g
zP|C_qSDO5G;NEL#Mxs>Q>U+H9D>ACA<(fUD(_1O#mlP;p5Oq1@#R3b{_~pjBt%V^o
zqPug@MXlF+cSwVfhxK;IA0)RP+L7+i(|RJ)Ril={lSH88ya!qz_3>O4VVFphOUBG$
zQa0azu2dGD2C^5g;-Z)EBSsKHtf|ERcZKz&dh0ZD^P4WwW`s~Yh@|PDX96?Kl;~YD
zIq-9m8sw0*d~HgAktZaDrG8sl?oWx)*NFIfEV+f%fs=&spDlKck<=8t<dUJm4FVrn
znSXaLuG*zudgR5+yt0uDHw{pEzq>liZN3VNin3S8n9m#)76omTi8QIm=4Hu=EAkR~
zV}zCz*1s)%`S*ValT@YU$?9F-%}0Y&p~6pOIuIqc-lpW~K)SrF?Q>pRrV8Yr#oD%_
zJU6sO!zS5x6&K{Na@ftTM4N43Qy0{SG0|HRG`NtMKBBeGJND-?g5Uo{Y`9zbxG|i4
zj1ftuMgTqs^hwVPxAcL0312CxEM%KVc~vu2U`WJxH-*Qnsh6g?%vhDZN<nGzO_k-Y
zo7ud&oOLmiOvP*AIz8ve_~am*JqGX#PABIKTp5VoO+R9?4_oN>(}n;KAlF8bfHeun
zPYpn%gTsg1rk7IRJ{(LMEn8FWXWiQBC@=bB<1pi122?pTY?TL_y6n{<7in7x%>jZ-
zLB&Ek(#SBqHqA#;Nf>=O%rPH4s6?y5A9IO}Mzj1AQj;UIgBoZ-%YAGWubhC+^2M21
zt{Q&xBsyuD(t<W9xW6s6;=v6wAW}65$|tSSP8EkFs|PM2^%}!&h6aszAlo7&e2>&|
z|Cbqdjk-}67go!`(N9Vj1hAtTd{8S?b$|^chYllk!W#Tx0&^fp4YaYW3(4aO+tnHo
zxC=>D*Z%9GCn*xPGRiYdE0`iUh3-1<3Z&QJp}6b018WC7!YvLj?qlZFg@MS|LB<vj
z!lD}hT2y;|tLPA=oBGWoy}Q#kNO-JKgWSMPZ-@f7^IXM;ON`?Qj=1%NXECpFZPGQS
zwkA8fHO&ob0C_(Wi27l^&Y(|vlD2xnhBwyw0)|L!6;~Rku1<Z!Ac8wSVsA9tGb9f5
z8MZ}f!`2?vAb~PZdX*f`-dKW9iZYCkwi$Hg0FoR1IB*(Q2AKKHy$5D>)1r^mDur}d
zfp7=hjr)5Rlz!F%>j6RDz1I_D|3`o&+M1yRi=o0Jy~I5NhV51BPsihN>j9o+j{zw@
zU|-)juYaB1?*=E*hUWb-rnx8TV^t2N4wo|wY2$33@%4%YC-I3MCm9eCb3aBR!Cj;b
zECh<UJ91}6L&w>|=(4Z1Ihk(WzdoFvnQy<P<G1fme){nG<oMm&_h)9o1>YQ2IluJ@
zaYc|s4&Qs(x^F9Wh8uu0C)0bQ86&9w4HflO!hOqs_xskKKu(!Y*s{oQ%IkX)bZ<7C
zKL>Yq{U~y7=Jm;wYx!rH9ZWT!Y71(3NfY#F>t`zN8dTt7%;6pqH*P6%aw&=FYizt7
zY#9cvi<6#rD>AAT+Iv8#cYXD+*tAvm{6Tfoo<^1gzK0Osc){BDnWHE|=+aAEKt?%e
zACI`bD{+O&gqT|%z4-#uH;QKF$uWq=O!X@>4*31MS`Vx69owpFKkM=<oI}3+`oDlX
z{hkz*472<6;pENkfo#ra_?jzpWpgk^XfP5>a^(oxj-D5PxHWfUw{REzxt`UJVXjs#
zH0ZM&MNd7qB<`YQcQChkAMT)kW2EG!@02aTgo3Wa5Btr--soJ&bD#c5`vk8Oo^`M@
z{!#ds5jQ6z^N@chuU}xbyq915Y*#PCjcJeY>T~uNSq%2%;k>7zc8RGEm!yocHB4}w
ztly)rg2HO%Fm8`hSJyL~vRZsF8S)i~UPM~sB*+sKuC#YWG*ShWsd8ze?oymjK}UR-
zjWhkx``5?EU`Jd`EvUc|1w#gFIQYja;<}>J;Lh}K@(%YzsNy+*=1{e@0rg$8Tr;J{
zD;3D{F^cwg<r&$}R3sPU9cd%@U~{Q{PL@C%!veAZ`xvA0rZS9pHVM7}COtGu@5ji~
z;j{MRkkC)*1m=HlxQJ{x8f$q%fwfqCF_}z8oGuSW@yW0JfTO~}k+o_W{%JD#ndQ*`
zvMih|lB8Q95%w$IAdlgx-yVJ;JZP0cY7!n&YJ}X9TNYez9M@+;v^YZa@WT4W?6gPB
m54tQ*z?0z~TOd}z*yci+Z}bEX>+lI#QQbk_RxrCo-v0s3-+?Fq

literal 0
HcmV?d00001

diff --git a/frontend/src/lib/components/copilot/chat/textFileUtils.ts b/frontend/src/lib/components/copilot/chat/textFileUtils.ts
new file mode 100644
index 0000000000..a34d4999d6
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/textFileUtils.ts
@@ -0,0 +1,208 @@
+/**
+ * Message-scoped text-file attachments for the GLOBAL chat composer.
+ *
+ * Text files attach like images: chips in the composer, riding the next
+ * message, cleared on send. Unlike images, only a *reference* (name + size)
+ * enters the prompt — the content is registered into the session file store at
+ * send and the model reads it on demand via the file tools, same as a DOM pick
+ * is inspected via the DOM tools. The full content stays on the message for
+ * the bubble preview and for re-registration on edit/retry.
+ */
+import { isTextFile } from './files/fileEngine'
+
+export type AttachedTextFile = {
+	name: string
+	/** Stable reference the transcript, prompt, and file tools join on — a content
+	 * hash of (name, content), see attachedTextFileId. The name is display-only
+	 * and may collide freely. Absent only on transcripts persisted before ids
+	 * existed; hydrated (deterministically, from the same hash) on chat load. */
+	id?: string
+	/** Original filename before a courtesy rename (set only when one happened).
+	 * Lets duplicate detection recognize a re-drop of the same source file without
+	 * inferring provenance from the display name — a user's real `report (2).md`
+	 * must never be mistaken for a rename of `report.md`. */
+	sourceName?: string
+	content: string
+}
+
+/**
+ * Files one message may carry. Enforced wherever a message is assembled, not
+ * just at the composer: queuing clears the composer, so its own count would
+ * reset and let repeated sends stack an unbounded batch into a single message.
+ */
+export const MAX_ATTACHED_FILES = 8
+
+/**
+ * Per-file byte cap. The model reads content on demand (never inlined), so
+ * this only bounds what rides the message state and the chat history's
+ * persisted snapshot — a sanity ceiling, not a context-window one. Larger
+ * files can be linked via their folder instead.
+ */
+export const MAX_TEXT_FILE_BYTES = 1_000_000
+
+/**
+ * Cumulative cap across a conversation. Message-file content lives inside the
+ * transcript (DisplayMessage.files) and is rewritten with every history save,
+ * so without a conversation-level bound repeated attachments would grow the
+ * in-memory record and its IndexedDB copy without limit. Enforced at attach
+ * time against transcript + queue + composer bytes.
+ */
+export const MAX_CONVERSATION_FILE_BYTES = 5_000_000
+
+/** Display names are rendered into model-facing prompt blocks, and OS
+ * filenames may legally contain control characters (even newlines on POSIX) —
+ * a crafted name must not be able to inject prompt structure. Applied at
+ * attach and again wherever a (possibly legacy) name is printed for the model. */
+export function sanitizeAttachmentName(name: string): string {
+	return name.replace(/[\u0000-\u001f\u007f]+/g, ' ').trim() || 'file'
+}
+
+/** Read a file for message attachment. Returns null when the sniff says binary
+ * or the content exceeds MAX_TEXT_FILE_BYTES — the cap is enforced here at the
+ * reader, not only at callers' pre-checks, so no ingestion path can persist an
+ * oversized attachment (decoding can also grow past the raw size when malformed
+ * UTF-8 expands to replacement characters).
+ * The id is minted by the composer after name finalization (a same-name clash in
+ * one draft gets a courtesy rename first, and the id hashes the final name). */
+export async function fileToAttachedTextFile(file: File): Promise<AttachedTextFile | null> {
+	if (file.size > MAX_TEXT_FILE_BYTES) return null
+	if (!(await isTextFile(file))) return null
+	const content = await file.text()
+	if (textByteLength(content) > MAX_TEXT_FILE_BYTES) return null
+	return { name: sanitizeAttachmentName(file.name), content }
+}
+
+/** Line count as the file tools report it (fileEngine.buildLineIndex): an empty
+ * file has 0 lines and a trailing newline is not an extra line. The prompt must
+ * advertise the same number or the model requests invalid read_file ranges. */
+export function textLineCount(content: string): number {
+	if (content === '') return 0
+	return content.split('\n').length - (content.endsWith('\n') ? 1 : 0)
+}
+
+/** Admit files in order while their DECODED byte size fits `budget`. Admission
+ * pre-checks use raw File.size, but the committed charge is the decoded UTF-8
+ * length, which malformed input inflates (an invalid byte decodes to a 3-byte
+ * replacement character) — so the commit step must re-check against what will
+ * actually be charged. */
+export function admitWithinByteBudget(
+	files: AttachedTextFile[],
+	budget: number
+): { admitted: AttachedTextFile[]; dropped: number } {
+	const admitted: AttachedTextFile[] = []
+	let dropped = 0
+	for (const f of files) {
+		const bytes = textByteLength(f.content)
+		if (bytes <= budget) {
+			admitted.push(f)
+			budget -= bytes
+		} else {
+			dropped++
+		}
+	}
+	return { admitted, dropped }
+}
+
+// cyrb53 (public-domain hash by bryc) — chosen over crypto.subtle because it is
+// synchronous and works on plain-HTTP deployments where SubtleCrypto is absent.
+function cyrb53(str: string, seed: number): number {
+	let h1 = 0xdeadbeef ^ seed
+	let h2 = 0x41c6ce57 ^ seed
+	for (let i = 0; i < str.length; i++) {
+		const ch = str.charCodeAt(i)
+		h1 = Math.imul(h1 ^ ch, 2654435761)
+		h2 = Math.imul(h2 ^ ch, 1597334677)
+	}
+	h1 = Math.imul(h1 ^ (h1 >>> 16), 2246822507)
+	h1 ^= Math.imul(h2 ^ (h2 >>> 13), 3266489909)
+	h2 = Math.imul(h2 ^ (h2 >>> 16), 2246822507)
+	h2 ^= Math.imul(h1 ^ (h1 >>> 13), 3266489909)
+	return 4294967296 * (2097151 & h2) + (h1 >>> 0)
+}
+
+/**
+ * Deterministic content-hash id for a message attachment. Identity derived from
+ * the file itself: re-registration after reload/rollback lands on the same id by
+ * construction, identical attaches dedupe, and legacy transcripts hydrate their
+ * ids without migration state. Two seeded cyrb53 passes (~106 bits) — collision
+ * odds are negligible at conversation scale, and the context is not adversarial
+ * (a user's own attachments).
+ */
+export function attachedTextFileId(name: string, content: string): string {
+	// NUL separator: unambiguous split (filenames cannot contain it), so
+	// two (name, content) pairs never hash alike across the boundary.
+	const input = `${name}\u0000${content}`
+	return `f${cyrb53(input, 1).toString(36)}${cyrb53(input, 2).toString(36)}`
+}
+
+/** Return `files` with every entry carrying its id (legacy rows hydrated). */
+export function withAttachedTextFileIds(files: AttachedTextFile[]): AttachedTextFile[] {
+	return files.map((f) => (f.id ? f : { ...f, id: attachedTextFileId(f.name, f.content) }))
+}
+
+/**
+ * Fold freshly-read files into a draft's attachment list: identical
+ * (name, content) duplicates are dropped, same-name-different-content clashes
+ * get the courtesy rename, and ids are minted from the final name. Must run
+ * against the LIVE list in the synchronous commit step — attach batches overlap
+ * (each awaits its file reads), so dedupe/rename decisions made mid-read would
+ * be stale by commit time.
+ */
+export function foldIntoDraft(
+	current: AttachedTextFile[],
+	reads: { name: string; content: string; sourceName?: string }[]
+): AttachedTextFile[] {
+	const commit: AttachedTextFile[] = []
+	for (const f of reads) {
+		const draft = [...current, ...commit]
+		// Sanitized here, not assumed: the fold is the draft side's single choke
+		// point, so every rule a name needs is applied by this one call — a future
+		// entry point cannot skip one.
+		const readName = sanitizeAttachmentName(f.name)
+		// "Same file dropped twice" means same original (name, content) — a
+		// courtesy-renamed copy carries its original name in sourceName rather than
+		// inferring provenance from the display name (a user's real `report (2).md`
+		// is not a rename of `report.md`). Folds compose: a file renamed by an
+		// earlier fold (composer → queue → dequeue) keeps its original source.
+		const src = f.sourceName ? sanitizeAttachmentName(f.sourceName) : readName
+		if (
+			draft.some(
+				(x) => x.content === f.content && (x.name === readName || (x.sourceName ?? x.name) === src)
+			)
+		) {
+			continue
+		}
+		const name = uniqueDraftFileName(
+			readName,
+			draft.map((x) => x.name)
+		)
+		commit.push({
+			name,
+			content: f.content,
+			id: attachedTextFileId(name, f.content),
+			...(name !== src ? { sourceName: src } : {})
+		})
+	}
+	return commit
+}
+
+/** Courtesy rename for a same-name clash within one message draft: `notes.md` →
+ * `notes (2).md`. Display-only — identity is the id, and names may collide
+ * across messages — but two identical labels inside one draft would be
+ * indistinguishable to the user and the model alike. */
+export function uniqueDraftFileName(original: string, taken: Iterable<string>): string {
+	const names = new Set(taken)
+	if (!names.has(original)) return original
+	const dot = original.lastIndexOf('.')
+	const base = dot > 0 ? original.slice(0, dot) : original
+	const ext = dot > 0 ? original.slice(dot) : ''
+	let n = 2
+	while (names.has(`${base} (${n})${ext}`)) n++
+	return `${base} (${n})${ext}`
+}
+
+/** UTF-8 byte length of attachment content — budget math must match the byte
+ * caps, and string length undercounts multibyte text. */
+export function textByteLength(content: string): number {
+	return new TextEncoder().encode(content).length
+}

From 9739d5a2c2a21beded8848ea9049b2816196a898 Mon Sep 17 00:00:00 2001
From: Guilhem <guilhemlemouel@gmail.com>
Date: Tue, 21 Jul 2026 19:06:32 +0200
Subject: [PATCH 100/171] feat: unified read-only `diff` chat tool (drafts,
 fork vs parent, search) (#10211)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* feat(frontend): unified `diff` chat tool with cached snapshot, fork mode, and search

One read-only global-chat tool for every comparison: drafts vs deployed
(workspace index + per-item unified patches over stable YAML), deployed
fork vs parent workspace (against="parent_workspace", sharing the fork
banner's compareWorkspaces fetch through a single-flight store), and a
literal grep over changed diff lines. Multi-file raw apps split into
per-file text patches with folder-style index children and per-file
reads. Patches are materialized once into a per-workspace cache keyed on
draft created_at / comparison ahead-behind markers and the workspace
drafts version, so repeated queries never refetch unchanged content.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ai_evals): teach the mock draft backend what the diff tool reads

The diff tool reads drafts through the get_draft overlay, the drafts
listing's draft_only flag, and per-row created_at change markers — none
of which the benchmark mock modelled (fixed timestamp, always
draft_only, overlay ignored), so in evals every draft looked absent and
the model looped to max turns. Mirror production: monotonic
deterministic created_at bumped per upsert, draft_only computed against
the deployed stores, and draft/no_deployed overlays on script/flow/app
reads (404-shaped not-found). Also drop the diff case's judge items
about conversation content the judge never sees — tool usage is already
enforced deterministically.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ai): diff tool reads unsaved editor state instead of going stale

The pre-diff flush honors the auto-save toggle (a read-only tool must
not persist parked edits), which left a gap: with auto-save off — or
after a failed save — the persisted draft the diff reads is stale, and
a brand-new editor-only draft looks absent. Item reads now detect
unflushed parked edits (hasUnsavedDisabledChanges / failed save state)
and diff the in-memory editor value directly, bypassing the snapshot
cache (it must only hold persisted state) with an explicit unsaved-
changes note; index and search modes warn which items' unsaved edits
they exclude. Local values are canonicalized onto the persisted draft
shape so they never diff noisily against the deployed side.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat(ai): invalidate diff cache the moment any draft write lands

The snapshot cache leaned on time windows (5s listing throttle, 15s
read reuse) to notice writes it didn't trigger itself — an editor
autosave landing between two diff reads could serve the pre-edit patch.
The syncer now exposes onAnySaved (fires for landed upserts AND
deletes, all keys), and the snapshot subscribes once: a landed write
marks exactly that item's patch stale and expires the listing throttle,
so the next read refetches regardless of any reuse window.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ai): reject the diff file arg on single-document items

Passing file for a script/flow/classic-app diff was silently ignored
and returned the whole patch — an explicit error steers the model to
call again without it. Also declares the file arg on the item handlers'
signatures it was already flowing through.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ai): surface empty-file additions/deletions in app diffs

An empty file appearing or disappearing produces no text patch, so the
per-file split dropped it — a draft whose only change was such a file
read "unchanged". Presence changes now keep their added/deleted entry
(patch '', 0 lines), render as "(empty file)" in summaries, and a file
read states the presence change instead of an empty window.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ai): include classic-app drafts in the diff index and fix ++/-- search

itemTypeForKind now maps classic `app` draft rows to the chat app type
(mirroring the read path, which already pairs app/raw_app), so their
diffs materialize in the index and search instead of reporting "not
addressable". Changed-line search is hunk-aware: `---`/`+++` file
labels only occur before the first @@ marker, so a changed source line
like `++counter` (rendered `+++counter`) now matches instead of being
mistaken for a label.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ai): mask every variable value in chat diffs; compare classic apps value-to-value

Variable VALUES never reach a tool result — the chat-wide invariant
read_workspace_item enforces, not just for secrets. Draft-mode diffs
mask both sides with a placeholder pair that still marks WHETHER the
value changed; fork-mode masks at fetch (and still never decrypts);
item reads carry an explicit note. The former secret-only flag is now
valueMasked.

Classic-app drafts hold the bare grid value while the deployed row
nests it beside summary/policy — diffed raw, a one-field edit read as
a whole-document rewrite. Both sides now reduce to { value } via
classicAppDraftValue (pure, unwraps legacy wrapped drafts), which also
cleans the CompareDrafts drawer for classic apps.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ai): honest secret-draft reporting, classic-app metadata split, glob-safe file subjects

A secret variable's sides are both masked upstream, so an empty patch
cannot prove the value is unchanged — such drafts now report
"cannot be compared; may differ" (valueUncomparable) instead of
"matches deployed", in the index and item reads.

Classic-app drafts mirror summary/draft_path into the bare grid while
the deployed row keeps summary as a column: sides now reduce to
{summary, value} via classicAppDraftParts, applied to both sides, so a
summary edit diffs as one and draft-only markers never pollute the
grid diff.

Raw-app search subjects strip the file key's leading slash so
slash-anchored globs like f/x/*.tsx match.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ai): classic-app local edits, comparison-relevant fork fields, conflicts as unflushed

The chat app type spans two draft kinds: item mode now flushes and
probes both raw_app and classic app keys, and the flush sweep includes
classic-app editor cells (kept out of GLOBAL_DRAFT_KINDS so
clearGlobalDrafts never clears an open classic editor).

Fork projections gain the fields the backend comparison counts that
getItemValue drops: flow schema (with a taxonomy-agnostic inline-hash
strip) and resource-type description/format_extension/is_fileset.
Folder display_name is not exposed by the API's Folder type, so it
cannot be projected.

A conflicted save leaves its payload parked with state 'none', so
index/search now count conflicts among unflushed paths and say so in
their warnings.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ai): staged app renames diff as path; flush classic-app cells at their real keys

A staged rename (draft_path) changes where deploy lands an app, so both
app kinds now compare `path` on both sides — a rename-only draft diffs
instead of reading "matches deployed". classicAppDraftParts returns the
staged path separately from the grid.

Item mode resolves each draft kind's own storage path and additionally
asks the listing which row owns a friendly/renamed path — a renamed
classic app's cell lives at its ORIGINAL storage path, which only the
listing knows — so pending/failed/auto-save-off edits are flushed and
probed at the real keys. The appDiffSides rationale comment is
compressed to the repo's four-line limit.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ai): never claim folder parity the API cannot prove

folder.display_name exists only as a DB column — no folder endpoint
returns it — so an identical projection cannot prove a fork folder
matches its parent. Fork index and item reads for folders now say the
display name is not exposed and may be what differs, instead of
"content matches parent". Exposing the field on getFolder is a backend
follow-up.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ai): gap-free patch pagination; forced-fresh comparisons never join older fetches

When the char backstop cut inside a patch window, the continuation
offset still pointed past the requested window — silently skipping the
undelivered lines forever. windowPatch now cuts at the last complete
line and continues exactly there (a single over-budget line is
delivered truncated and stepped past so pagination always advances).

fetchWorkspaceComparison treats an in-flight request as being as old
as its start: maxAgeMs now gates joining it, so a freshness-forced
post-mutation read (maxAgeMs 0) always issues its own fetch instead of
adopting a tally that began before the mutation, and a superseded
request can no longer clobber a newer cached result.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ai): generation-ordered comparison writes; path-only fork reads for enum-less kinds

Concurrent comparison requests can share a Date.now() value, letting a
superseded request's late result overwrite a newer one and be reused
for 30s — cache writes are now ordered by a monotonic request
generation. Test pins the same-millisecond race with the newer request
resolving first.

Fork comparison kinds outside the chat type enum (folder,
resource_type, …) were listed and even advertised as readable but no
call could reach them: a fork item read without `type` is now a
path-only wildcard (ambiguous paths list their kinds and ask for
type), messages label entries by their comparison kind, and pending
index lines for enum-less kinds advertise the path-only read.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ai): grid-based wrapper detection, comparison invalidation on mutations, multi-kind wildcard reads, honest hidden-diff summaries

The classic-app wrapper heuristic keyed on metadata keys the editor
mirrors into every bare grid — a grid with a component named `value`
was reduced to that component. `grid` presence is the discriminator: a
bare App always has it, a legacy wrapper never does.

invalidateWorkspaceDrafts now also drops cached fork comparisons for
the workspace, so the FIRST post-deploy fork read cannot reuse a
banner-prewarmed pre-deploy tally (the snapshot-baseline check only
covered subsequent reads).

Wildcard fork reads return a section per matching kind instead of an
unactionable "pass type" for kinds the chat type enum cannot name, and
the fork index never summarizes ACL-hidden differences as parity —
hidden counts stay directional (a conflicted item counts in both).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ai): address cubic review batch — invalidation scope, races, edge output

Comparison cache: invalidation matches either side of the pair (a
parent deploy moves its forks' tallies), fences in-flight requests
(no new joins, late results rejected via a per-key generation floor),
and the map is LRU-capped. Eviction moves from every drafts-version
bump to deploy success only — draft saves never move the deployed
tally. Fork snapshots also baseline the PARENT's drafts version.

Draft materialization carries a stale-generation token so a save
landing mid-fetch discards that run's pre-save result instead of
repopulating the invalidated entry; a save/delete also expires the
fork cache's hasLocalDraft join. onAnySaved listeners are
error-isolated (a throwing listener must not mark a committed save
failed) and the pagehide keepalive flush notifies them on dispatch.

Output edges: folder fork lines drop the empty parenthetical, and a
patch-window offset past the end reports itself instead of an
impossible range. The eval case pins the diff call's path argument.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* refactor(ai): one fencing primitive per cache instead of per-surface races

Review rounds kept finding pairwise races between async producers and
invalidation — each patched with its own fence. Replace the class:

- diffSnapshot: a per-workspace mutation epoch, bumped by every
  invalidation. Both reconcilers run a bounded retry loop — joiners
  re-validate after awaiting, producers refuse to store results whose
  inputs predate a mutation. Covers in-flight listing adoption and
  pre-deploy fork tallies in one mechanism.
- workspaceComparison: per-WORKSPACE generation floors (either side of
  a pair). Any request started before an invalidation is fenced from
  joining and from landing in the cache — including superseded
  requests the inflight map no longer tracks.

Also: delete_workspace_item invalidates comparisons like deploy does
(deployed state moved), and empty FILTERED indexes say the filter
matched nothing instead of claiming workspace/fork parity.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ai): invalidate comparisons on every direct deploy; keep secret caveat with metadata changes

Direct chat deploys (schedule/trigger/resource/variable/app) bypass
deployDraftToWorkspace and never evicted cached fork comparisons — the
shared deploy tail now invalidates before the fallible draft cleanup.

A secret variable whose metadata also changed produced a non-empty patch
that silently dropped the value-uncomparable caveat; item reads, the
index, and fork sections now keep the caveat alongside the patch.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ai): scope diff caches to the authenticated identity; derive fork freshness from the comparison store

An SPA logout/login left workspace-keyed diff caches (per-user drafts,
permission-filtered fork patches) readable by the next account — both
cache modules now wipe on identity change, with a global generation
floor fencing requests started under the previous account.

The fork snapshot stamped its own fetchedAt over a comparison that
could already be near expiry, compounding the two 30s windows, and
survived comparison-store invalidation when draft cleanup failed after
a deploy. It now carries the comparison's own fetchedAt/generation and
stops reuse the moment the store fences it. Delete-item invalidation
moved before the fallible draft cleanup for the same reason.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ai): fence fork-reconciliation joins across account switches

ForkCache lacked the epoch stamp WorkspaceCache carries, so a joiner
arriving after an identity change (or any epoch bump landing before it)
compared its own post-bump epoch against itself and adopted the old
producer's in-flight tally. The cache now records its producer's epoch
for the joiner and reuse gates, and an identity change also discards
the in-flight reconciliation maps so no cross-identity join exists.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ai): surface swallowed fork-side fetch failures; include conflicted editor edits in item diffs

The shared getItemValue reads {} for any failed fetch, so a transient
API failure on a fork side rendered as a fabricated one-sided diff (or
parity when both sides failed). A fork side is only fetched when the
comparison lists it as existing, so an empty read now raises and shows
as a fetch-error entry.

Item reads promised conflicted local edits (the index says so) but the
local-override branch only covered autosave-off and failed saves — a
conflict silently fell back to the persisted draft. Conflicts now read
the in-memory editor value too, with a caveat naming which side is
shown either way.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ai): report failed diff materializations as unsearched instead of silently omitting them

A side-fetch failure left an index entry with status 'error' and no
patch; diff search skipped it and still presented definitive no-match
or complete-count results. Failed entries are now listed in a warning
naming what was not searched.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
---
 ai_evals/adapters/frontend/mockBackend.ts     |   45 +-
 .../adapters/frontend/vitestAdapter.test.ts   |   78 +-
 ai_evals/cases/global.yaml                    |   32 +
 frontend/src/lib/appDiffSides.test.ts         |   41 +
 frontend/src/lib/appDiffSides.ts              |   36 +
 .../lib/components/ForkWorkspaceBanner.svelte |   11 +-
 .../components/copilot/chat/global/core.ts    |  899 ++++++++++++-
 .../copilot/chat/global/diffSnapshot.test.ts  |  680 ++++++++++
 .../copilot/chat/global/diffSnapshot.ts       | 1141 +++++++++++++++++
 .../copilot/chat/global/draftDiff.test.ts     |   81 ++
 .../copilot/chat/global/draftDiff.ts          |  132 ++
 .../copilot/chat/global/userDraftAdapter.ts   |  104 +-
 frontend/src/lib/userDraftDbSyncer.svelte.ts  |   40 +-
 frontend/src/lib/userDraftFlushToggle.test.ts |   81 ++
 frontend/src/lib/utils_draft_deploy.ts        |  140 +-
 frontend/src/lib/workspaceComparison.test.ts  |  163 +++
 frontend/src/lib/workspaceComparison.ts       |  181 +++
 frontend/src/lib/workspaceDrafts.svelte.ts    |   11 +
 .../(logged)/forks/compare/+page.svelte       |    6 +-
 19 files changed, 3842 insertions(+), 60 deletions(-)
 create mode 100644 frontend/src/lib/appDiffSides.test.ts
 create mode 100644 frontend/src/lib/appDiffSides.ts
 create mode 100644 frontend/src/lib/components/copilot/chat/global/diffSnapshot.test.ts
 create mode 100644 frontend/src/lib/components/copilot/chat/global/diffSnapshot.ts
 create mode 100644 frontend/src/lib/components/copilot/chat/global/draftDiff.test.ts
 create mode 100644 frontend/src/lib/components/copilot/chat/global/draftDiff.ts
 create mode 100644 frontend/src/lib/userDraftFlushToggle.test.ts
 create mode 100644 frontend/src/lib/workspaceComparison.test.ts
 create mode 100644 frontend/src/lib/workspaceComparison.ts

diff --git a/ai_evals/adapters/frontend/mockBackend.ts b/ai_evals/adapters/frontend/mockBackend.ts
index 2ab8f47f37..64cacabd58 100644
--- a/ai_evals/adapters/frontend/mockBackend.ts
+++ b/ai_evals/adapters/frontend/mockBackend.ts
@@ -304,13 +304,20 @@ export function getBenchmarkJobLogs(workspace: string, jobId: string): string {
  */
 const benchmarkDrafts = new Map<
 	string,
-	{ workspace: string; kind: UserDraftItemKind; path: string; value: unknown }
+	{ workspace: string; kind: UserDraftItemKind; path: string; value: unknown; createdAt: string }
 >()
 
-// Fixed timestamp so artifacts stay deterministic. No eval simulates a
-// concurrent writer, so every save is accepted and the conflict branch is
-// never taken — the syncer just records this as its `last_sync` baseline.
-const BENCHMARK_DRAFT_TIMESTAMP = '1970-01-01T00:00:00.000Z'
+// Counter-based timestamps: deterministic run-to-run (same event order → same
+// values) but MONOTONIC per update, because production bumps a draft row's
+// created_at on every upsert and the diff snapshot cache keys patch reuse on
+// it — a fixed timestamp would serve stale patches after an edit. No eval
+// simulates a concurrent writer, so every save is accepted and the conflict
+// branch is never taken.
+let benchmarkDraftClock = 0
+function nextBenchmarkDraftTimestamp(): string {
+	benchmarkDraftClock += 1
+	return new Date(benchmarkDraftClock * 1000).toISOString()
+}
 
 function benchmarkDraftKey(workspace: string, kind: string, path: string): string {
 	return `${workspace}::${kind}::${path}`
@@ -341,7 +348,8 @@ export function seedBenchmarkDraft(
 		workspace,
 		kind,
 		path,
-		value
+		value,
+		createdAt: nextBenchmarkDraftTimestamp()
 	})
 }
 
@@ -354,6 +362,7 @@ export function updateBenchmarkDraft(input: {
 }): UpdateDraftResponse {
 	const key = benchmarkDraftKey(input.workspace, input.kind, input.path)
 	const value = input.requestBody?.value
+	const createdAt = nextBenchmarkDraftTimestamp()
 	if (value == null) {
 		benchmarkDrafts.delete(key)
 	} else {
@@ -361,10 +370,11 @@ export function updateBenchmarkDraft(input: {
 			workspace: input.workspace,
 			kind: input.kind,
 			path: input.path,
-			value
+			value,
+			createdAt
 		})
 	}
-	return { status: 'saved', current_timestamp: BENCHMARK_DRAFT_TIMESTAMP }
+	return { status: 'saved', current_timestamp: createdAt }
 }
 
 /** Mirror `DraftService.getDraftForUser`: 404-shaped throw when absent so the
@@ -378,7 +388,7 @@ export function getBenchmarkDraftForUser(input: {
 	if (!entry) {
 		throw Object.assign(new Error(`no draft for "${input.path}"`), { status: 404 })
 	}
-	return { value: entry.value, created_at: BENCHMARK_DRAFT_TIMESTAMP }
+	return { value: entry.value, created_at: entry.createdAt }
 }
 
 /** Mirror `DraftService.getOwnDraft`: `null` (200) when absent — unlike
@@ -392,7 +402,18 @@ export function getBenchmarkOwnDraft(input: {
 	if (!entry) {
 		return null
 	}
-	return { value: entry.value, created_at: BENCHMARK_DRAFT_TIMESTAMP }
+	return { value: entry.value, created_at: entry.createdAt }
+}
+
+/** Whether a deployed benchmark item exists for a draft row's kind+path —
+ * drives `draft_only`, which production computes against the deployed tables. */
+function benchmarkDeployedExists(workspace: string, kind: UserDraftItemKind, path: string): boolean {
+	if (kind === 'script') return Boolean(getBenchmarkScriptByPath(workspace, path))
+	if (kind === 'flow') return Boolean(getBenchmarkFlowByPath(workspace, path))
+	if (kind === 'app' || kind === 'raw_app') return Boolean(getBenchmarkAppByPath(workspace, path))
+	// Drawer kinds (variables/resources/schedules/triggers) have no deployed
+	// benchmark stores today.
+	return false
 }
 
 /** Mirror `DraftService.listDrafts`: metadata rows (no value) for a workspace. */
@@ -403,9 +424,9 @@ export function listBenchmarkDrafts(workspace: string): ListDraftsResponse {
 			kind: entry.kind,
 			path: entry.path,
 			summary: (entry.value as { summary?: string } | null)?.summary,
-			draft_only: true,
+			draft_only: !benchmarkDeployedExists(workspace, entry.kind, entry.path),
 			legacy_draft: false,
-			created_at: BENCHMARK_DRAFT_TIMESTAMP
+			created_at: entry.createdAt
 		}))
 }
 
diff --git a/ai_evals/adapters/frontend/vitestAdapter.test.ts b/ai_evals/adapters/frontend/vitestAdapter.test.ts
index 1532928bff..c07d104f47 100644
--- a/ai_evals/adapters/frontend/vitestAdapter.test.ts
+++ b/ai_evals/adapters/frontend/vitestAdapter.test.ts
@@ -126,13 +126,32 @@ vi.mock('$lib/gen', async () => {
 				hasBenchmarkWorkspace(data.workspace)
 					? Boolean(getBenchmarkScriptByPath(data.workspace, data.path))
 					: actual.ScriptService.existsScriptByPath(data),
-			getScriptByPath: async (data: { workspace: string; path: string }) => {
+			getScriptByPath: async (data: { workspace: string; path: string; getDraft?: boolean }) => {
 				if (hasBenchmarkWorkspace(data.workspace)) {
 					const script = getBenchmarkScriptByPath(data.workspace, data.path)
+					// `getDraft` mirrors production's overlay: the row plus the caller's
+					// draft and a `no_deployed` marker (draft-only item). The diff tool
+					// reads through this shape — without it every draft looks absent.
+					const draft = data.getDraft
+						? getBenchmarkOwnDraft({ workspace: data.workspace, kind: 'script', path: data.path })
+						: null
 					if (!script) {
-						throw new Error(`Script "${data.path}" not found in benchmark workspace`)
+						if (data.getDraft && draft) {
+							return {
+								...(draft.value as Record<string, unknown>),
+								path: data.path,
+								draft: draft.value,
+								no_deployed: true
+							}
+						}
+						throw Object.assign(
+							new Error(`Script "${data.path}" not found in benchmark workspace`),
+							{ status: 404 }
+						)
 					}
-					return script
+					return data.getDraft
+						? { ...script, draft: draft?.value ?? undefined, no_deployed: false }
+						: script
 				}
 				return actual.ScriptService.getScriptByPath(data)
 			},
@@ -166,13 +185,30 @@ vi.mock('$lib/gen', async () => {
 				hasBenchmarkWorkspace(data.workspace)
 					? Boolean(getBenchmarkFlowByPath(data.workspace, data.path))
 					: actual.FlowService.existsFlowByPath(data),
-			getFlowByPath: async (data: { workspace: string; path: string }) => {
+			getFlowByPath: async (data: { workspace: string; path: string; getDraft?: boolean }) => {
 				if (hasBenchmarkWorkspace(data.workspace)) {
 					const flow = getBenchmarkFlowByPath(data.workspace, data.path)
+					// Mirror production's `getDraft` overlay (see getScriptByPath above).
+					const draft = data.getDraft
+						? getBenchmarkOwnDraft({ workspace: data.workspace, kind: 'flow', path: data.path })
+						: null
 					if (!flow) {
-						throw new Error(`Flow "${data.path}" not found in benchmark workspace`)
+						if (data.getDraft && draft) {
+							return {
+								...(draft.value as Record<string, unknown>),
+								path: data.path,
+								draft: draft.value,
+								no_deployed: true
+							}
+						}
+						throw Object.assign(
+							new Error(`Flow "${data.path}" not found in benchmark workspace`),
+							{ status: 404 }
+						)
 					}
-					return flow
+					return data.getDraft
+						? { ...flow, draft: draft?.value ?? undefined, no_deployed: false }
+						: flow
 				}
 				return actual.FlowService.getFlowByPath(data)
 			},
@@ -341,13 +377,37 @@ vi.mock('$lib/gen', async () => {
 				hasBenchmarkWorkspace(data.workspace)
 					? (listBenchmarkApps(data.workspace) ?? [])
 					: actual.AppService.listApps(data),
-			getAppByPath: async (data: { workspace: string; path: string }) => {
+			getAppByPath: async (data: {
+				workspace: string
+				path: string
+				getDraft?: boolean
+				rawApp?: boolean
+			}) => {
 				if (hasBenchmarkWorkspace(data.workspace)) {
 					const app = getBenchmarkAppByPath(data.workspace, data.path)
+					// Mirror production's `getDraft` overlay (see getScriptByPath above).
+					// Benchmark app drafts live under the raw_app kind.
+					const draft = data.getDraft
+						? getBenchmarkOwnDraft({ workspace: data.workspace, kind: 'raw_app', path: data.path })
+						: null
 					if (!app) {
-						throw new Error(`App "${data.path}" not found in benchmark workspace`)
+						if (data.getDraft && draft) {
+							return {
+								...(draft.value as Record<string, unknown>),
+								path: data.path,
+								raw_app: true,
+								draft: draft.value,
+								no_deployed: true
+							}
+						}
+						throw Object.assign(
+							new Error(`App "${data.path}" not found in benchmark workspace`),
+							{ status: 404 }
+						)
 					}
-					return app
+					return data.getDraft
+						? { ...app, draft: draft?.value ?? undefined, no_deployed: false }
+						: app
 				}
 				return actual.AppService.getAppByPath(data)
 			}
diff --git a/ai_evals/cases/global.yaml b/ai_evals/cases/global.yaml
index bf376b66e8..e2676c0b2a 100644
--- a/ai_evals/cases/global.yaml
+++ b/ai_evals/cases/global.yaml
@@ -1707,3 +1707,35 @@
   skipJudge: true
   judgeChecklist:
     - deletes the deployed script via delete_workspace_item rather than a raw API endpoint
+
+- id: global-draft-diff-report
+  prompt: |-
+    Update the existing workspace script at `f/evals/global/format_greeting` so the returned message ends with an exclamation mark, keeping everything else the same.
+    Then show me exactly what your draft changes compared to the deployed version.
+    Leave the result as an AI draft only; do not deploy or save it.
+  initial: ai_evals/fixtures/frontend/global/initial/format_greeting_script.json
+  runtime:
+    maxTurns: 8
+  validate:
+    draftCountExactly: 1
+    requiredDrafts:
+      - type: script
+        path: f/evals/global/format_greeting
+        language: bun
+        valueIncludes:
+          - "!"
+  toolExpect:
+    requiredToolsUsed:
+      - diff
+    forbiddenToolsUsed:
+      - deploy_workspace_item
+      - delete_workspace_item
+    toolCallArgs:
+      - tool: diff
+        field: path
+        stringIncludesAnyOf:
+          - f/evals/global/format_greeting
+  judgeChecklist:
+    - creates an AI draft for the existing f/evals/global/format_greeting script with the exclamation-mark change
+    - the draft changes only the returned message's punctuation — summary, language, path, and the rest of the code are untouched
+    - does not deploy or save the draft to the workspace
diff --git a/frontend/src/lib/appDiffSides.test.ts b/frontend/src/lib/appDiffSides.test.ts
new file mode 100644
index 0000000000..72abbbffb9
--- /dev/null
+++ b/frontend/src/lib/appDiffSides.test.ts
@@ -0,0 +1,41 @@
+import { describe, expect, it } from 'vitest'
+import { classicAppDraftParts } from './appDiffSides'
+
+describe('classicAppDraftParts', () => {
+	it('extracts the mirrored summary and staged rename, stripping them from the grid', () => {
+		const draft = {
+			grid: [{ id: 'a' }],
+			fullscreen: false,
+			summary: 'My app',
+			draft_path: 'f/nice/name',
+			parent_version: 7
+		}
+		expect(classicAppDraftParts(draft)).toEqual({
+			value: { grid: [{ id: 'a' }], fullscreen: false },
+			summary: 'My app',
+			draftPath: 'f/nice/name'
+		})
+	})
+
+	it('unwraps a legacy wrapped draft so it compares against the deployed value', () => {
+		const wrapped = {
+			summary: 'My app',
+			policy: {},
+			value: { grid: [{ id: 'a' }] }
+		}
+		expect(classicAppDraftParts(wrapped)).toEqual({
+			value: { grid: [{ id: 'a' }] },
+			summary: 'My app'
+		})
+	})
+
+	it('does not mistake a grid whose component is named value for a wrapper', () => {
+		// Production shape: the editor ALWAYS mirrors summary onto the bare app.
+		const grid = { grid: [{ id: 'a' }], value: { some: 'component-state' }, summary: 'My app' }
+		expect(classicAppDraftParts(grid)).toEqual({
+			value: { grid: [{ id: 'a' }], value: { some: 'component-state' } },
+			summary: 'My app',
+			draftPath: undefined
+		})
+	})
+})
diff --git a/frontend/src/lib/appDiffSides.ts b/frontend/src/lib/appDiffSides.ts
new file mode 100644
index 0000000000..68ff75c11b
--- /dev/null
+++ b/frontend/src/lib/appDiffSides.ts
@@ -0,0 +1,36 @@
+/** Split a CLASSIC app draft into comparable parts. The editor mirrors
+ * summary/draft_path INTO the bare grid it autosaves, while a deployed row
+ * keeps them outside `value` — compared raw, metadata diffs as grid noise.
+ * Also unwraps legacy wrapped drafts ({summary/policy/custom_path, value}). */
+export function classicAppDraftParts(json: unknown): {
+	value: unknown
+	summary?: string
+	draftPath?: string
+} {
+	if (json === null || typeof json !== 'object' || Array.isArray(json)) {
+		return { value: json }
+	}
+	const obj = json as Record<string, unknown>
+	// A bare App always carries `grid` at top level (and the editor mirrors
+	// summary into it), while a legacy wrapper never does — `grid` is the only
+	// reliable discriminator; metadata keys appear on both shapes.
+	const wrapped =
+		!('grid' in obj) &&
+		typeof obj.value === 'object' &&
+		obj.value !== null &&
+		'grid' in (obj.value as Record<string, unknown>)
+	if (wrapped) {
+		const inner = classicAppDraftParts(obj.value)
+		return {
+			value: inner.value,
+			summary: (obj.summary as string | undefined) ?? inner.summary,
+			draftPath: (obj.draft_path as string | undefined) ?? inner.draftPath
+		}
+	}
+	const { parent_version: _pv, draft_path, summary, ...value } = obj
+	return {
+		value,
+		summary: summary as string | undefined,
+		draftPath: draft_path as string | undefined
+	}
+}
diff --git a/frontend/src/lib/components/ForkWorkspaceBanner.svelte b/frontend/src/lib/components/ForkWorkspaceBanner.svelte
index e2bfae895e..b97740b135 100644
--- a/frontend/src/lib/components/ForkWorkspaceBanner.svelte
+++ b/frontend/src/lib/components/ForkWorkspaceBanner.svelte
@@ -1,7 +1,8 @@
 <script lang="ts">
 	import { workspaceStore, userWorkspaces } from '$lib/stores'
-	import { WorkspaceService, ScriptService } from '$lib/gen'
+	import { ScriptService } from '$lib/gen'
 	import type { WorkspaceComparison } from '$lib/gen'
+	import { fetchWorkspaceComparison } from '$lib/workspaceComparison'
 	import { Button } from './common'
 	import { AlertTriangle, GitFork, CircleCheck, CircleX, Loader2 } from 'lucide-svelte'
 	import { goto } from '$app/navigation'
@@ -67,11 +68,9 @@
 		error = undefined
 
 		try {
-			// Compare with parent workspace
-			const result = await WorkspaceService.compareWorkspaces({
-				workspace: parentWorkspaceId,
-				targetWorkspaceId: $workspaceStore
-			})
+			// Compare with parent workspace (shared single-flight fetch — the chat
+			// diff tool reuses this result instead of recomputing the comparison)
+			const result = await fetchWorkspaceComparison(parentWorkspaceId, $workspaceStore)
 
 			comparison = result
 		} catch (e) {
diff --git a/frontend/src/lib/components/copilot/chat/global/core.ts b/frontend/src/lib/components/copilot/chat/global/core.ts
index 0aa257a90d..3e8375bf39 100644
--- a/frontend/src/lib/components/copilot/chat/global/core.ts
+++ b/frontend/src/lib/components/copilot/chat/global/core.ts
@@ -122,8 +122,15 @@ import {
 	workspaceStore
 } from '$lib/stores'
 import { get } from 'svelte/store'
-import { deployDraft as deployDraftToWorkspace } from '$lib/utils_draft_deploy'
+import {
+	canonicalDraftSideValue,
+	deployDraft as deployDraftToWorkspace,
+	getDraftDiffValues
+} from '$lib/utils_draft_deploy'
+import { changedLineIndices, draftDeployedPatch, windowPatch } from './draftDiff'
 import { UserDraftDbSyncer } from '$lib/userDraftDbSyncer.svelte'
+import { invalidateWorkspaceComparison } from '$lib/workspaceComparison'
+import type { UserDraftItemKind } from '$lib/gen'
 import { bundleRawAppDraft } from './rawAppBundlerBridge'
 import {
 	buildRunsUrl,
@@ -151,6 +158,7 @@ import {
 import {
 	clearEphemeralSecretVariableDraftValue,
 	deleteGlobalDraft,
+	flushGlobalDraftSaves,
 	getEphemeralSecretVariableDraftValue,
 	getGlobalDraft,
 	getGlobalDraftStoragePath,
@@ -158,10 +166,32 @@ import {
 	listGlobalDrafts,
 	persistGlobalDraft,
 	readGlobalDraftValue,
+	readLocalDraftCellByKind,
+	resolveGlobalDraftStoragePathByKind,
 	saveGlobalAppDraft,
 	setEphemeralSecretVariableDraftValue,
 	type DraftPersistResult
 } from './userDraftAdapter'
+import {
+	computeDiffParts,
+	expireWorkspaceDiffList,
+	getForkComparisonStatus,
+	getForkDiffIndex,
+	getForkParentWorkspaceId,
+	getWorkspaceDiffIndex,
+	maskVariableDiffSides,
+	readForkDiffEntries,
+	readWorkspaceDiffEntry,
+	resolveWorkspaceDiffTarget,
+	type DiffFileView,
+	type ForkDiffEntryView,
+	type WorkspaceDiffEntryView
+} from './diffSnapshot'
+
+const VARIABLE_MASKED_NOTE =
+	'Note: variable values are never shown in chat — the diff marks whether the value changed without revealing it.\n\n'
+const SECRET_UNCOMPARABLE_NOTE =
+	'Note: this is a SECRET variable — its value is never shown and cannot be compared, so it may ALSO have changed beyond what this diff shows.\n\n'
 import { apiCatalogTools } from './apiCatalogTools'
 import { isSessionPipelinesEnabled, SESSION_PIPELINES_GATED_MESSAGE } from './pipelineGate'
 
@@ -560,6 +590,73 @@ const rebaseDraftSchema = z.object({
 		.describe('Workspace path of the draft to rebase onto the latest deployed version.')
 })
 
+const diffSchema = z.object({
+	against: z
+		.enum(['deployed', 'parent_workspace'])
+		.optional()
+		.describe(
+			"What to compare against. 'deployed' (default): the current draft vs the deployed version. 'parent_workspace': the deployed fork vs its parent workspace (only in a fork; local drafts are flagged but not part of that comparison)."
+		),
+	type: itemTypeSchema
+		.optional()
+		.describe('With path: the item to diff. Omit both type and path for the workspace index.'),
+	path: z
+		.string()
+		.optional()
+		.describe(
+			'Workspace path of the item to diff (draft vs deployed). Omit for the index of every draft in the workspace.'
+		),
+	trigger_kind: triggerKindSchema
+		.optional()
+		.describe('Required when type is trigger. Must match the draft trigger kind.'),
+	file: z
+		.string()
+		.optional()
+		.describe(
+			'Item mode, multi-file apps only: read one file\'s diff inside the app (e.g. "src/App.tsx"). Omit for the per-file summary plus config changes.'
+		),
+	search: z
+		.string()
+		.optional()
+		.describe(
+			'Search mode: literal substring (case-insensitive, not a regex) matched against added/removed diff lines across every diff in the comparison. Ignores type/path.'
+		),
+	file_glob: z
+		.string()
+		.optional()
+		.describe(
+			'Search mode: optional glob filter on item paths and app file paths (e.g. "*.ts" matches file names, "f/dash/**" matches full paths).'
+		),
+	max_matches: z
+		.number()
+		.int()
+		.min(1)
+		.optional()
+		.describe('Search mode: maximum matching diff lines returned (default 50, hard cap 200).'),
+	types: z
+		.array(itemTypeSchema)
+		.optional()
+		.describe('Index mode: only list drafts of these item types.'),
+	path_prefix: z
+		.string()
+		.optional()
+		.describe('Index mode: only list drafts under this path prefix, such as f/billing/.'),
+	offset: z
+		.number()
+		.int()
+		.min(0)
+		.optional()
+		.describe('Item mode: skip this many patch lines (paginate a large diff).'),
+	limit: z
+		.number()
+		.int()
+		.min(1)
+		.optional()
+		.describe(
+			'Index mode: max items to list (default 50, capped at 100). Item mode: max patch lines to return (default 500).'
+		)
+})
+
 const editScriptSchema = z.object({
 	path: z.string().describe('Workspace path of the script to edit.'),
 	old_string: z.string().min(1).describe('Exact text to find in the script source.'),
@@ -996,6 +1093,7 @@ Rules:
 - If the user message includes an ACTIVE EDITOR section, treat it as the currently open item and use it for references like "this", "current", or "open editor".
 - Use deploy_workspace_item only after the user explicitly asks to deploy. It persists a draft to the workspace.
 - Use discard_local_draft to remove a draft, including the matching open editor draft. Use delete_workspace_item only to delete a deployed workspace item.
+- Use diff to review changes — before deploying, or when the user asks what changed. It is read-only: without arguments it lists every draft in the workspace with its change status; with type+path it returns that item's unified diff (for multi-file apps, pass file to read one file's diff). In a fork, pass against="parent_workspace" to compare the deployed fork with its parent workspace instead. Pass search to grep changed lines across all diffs.
 - Variable values are never readable. For secrets, create a secret variable and reference it from resources as "$var:path/to/variable".
 - Use search_resource_types before write_resource.
 - When script or raw app code needs an external npm package you are not fully familiar with, use search_npm_packages to find it and get its documentation and type definitions. Link the package documentation in your answer when you rely on it.
@@ -2912,6 +3010,26 @@ export const globalTools: Tool<{}>[] = [
 			return rebaseDraft(parsed, ctx)
 		}
 	},
+	{
+		def: createToolDef(
+			diffSchema,
+			'diff',
+			"Diff workspace changes. Read-only. Default: drafts vs deployed versions (index without type/path, one item's unified diff with them; file=<name> for one file inside an app). against='parent_workspace': deployed fork vs its parent workspace. search=<text> greps changed lines across all diffs."
+		),
+		showDetails: true,
+		fn: async (ctx) => {
+			const parsed = diffSchema.parse(ctx.args)
+			if (parsed.search !== undefined) {
+				return diffSearch(parsed, ctx)
+			}
+			if (parsed.against === 'parent_workspace') {
+				return parsed.path !== undefined ? diffForkItem(parsed, ctx) : diffForkIndex(parsed, ctx)
+			}
+			return parsed.path !== undefined
+				? diffWorkspaceItem(parsed, ctx)
+				: diffWorkspaceIndex(parsed, ctx)
+		}
+	},
 	{
 		def: createToolDef(
 			deleteWorkspaceItemSchema,
@@ -5233,6 +5351,776 @@ async function rebaseAppDraft(path: string, ctx: WriteDraftCtx): Promise<string>
 	)
 }
 
+const MAX_DIFF_PATCH_CHARS = 50_000
+
+function windowPatchBody(patch: string, offset: number, limit: number): string {
+	return windowPatch(patch, offset, limit, MAX_DIFF_PATCH_CHARS)
+}
+
+const DIFF_READ_DEFAULT_LINES = 500
+const DIFF_INDEX_DEFAULT_ITEMS = 50
+const DIFF_INDEX_MAX_ITEMS = 100
+
+// Read-only draft-vs-deployed diff for one draftable item, served from the
+// workspace diff snapshot (fetched once, shared with the index), with a direct
+// computation fallback when no draft row is listed.
+async function diffWorkspaceItem(
+	args: {
+		type?: WorkspaceItemType
+		path?: string
+		trigger_kind?: TriggerKind
+		file?: string
+		offset?: number
+		limit?: number
+	},
+	ctx: WriteDraftCtx
+): Promise<string> {
+	const { workspace, toolId, toolCallbacks } = ctx
+	const { type, path, trigger_kind: triggerKind } = args
+	if (!type || !path) {
+		throw new Error('type is required when path is provided.')
+	}
+	const itemKind = itemKindFor(type, triggerKind)
+	if (!itemKind) {
+		throw new Error('trigger_kind is required when type is trigger.')
+	}
+	toolCallbacks.setToolStatus(toolId, {
+		content: `Comparing draft vs deployed for "${path}"...`
+	})
+
+	// Address the draft by its storage path (a draft_only item lives at a
+	// synthetic `u/{user}/draft_{uuid}` key) and flush any parked editor autosave
+	// first so the server overlay reflects the latest edit — the same resolution
+	// the deploy path uses. Unlike deploy: a flush conflict/failure doesn't abort
+	// a read-only diff (surfaced as a caveat), and the auto-save toggle is
+	// honored — with auto-save off, a read-only tool must not persist edits the
+	// user chose to keep local. The just-flushed row must not be served from the
+	// throttled listing cache, so expire it.
+	// The chat `app` type spans two draft kinds: raw apps AND classic apps —
+	// the classic editor parks its cell under `app`, so both keys must be
+	// flushed and probed or classic edits silently go stale. Each kind resolves
+	// its own storage path (live-editor mapping), and the listing resolves a
+	// friendly/renamed path to the row that owns it — a renamed classic app's
+	// cell lives at its ORIGINAL storage path, which only the listing knows.
+	const draftKinds: UserDraftItemKind[] = type === 'app' ? ['raw_app', 'app'] : [itemKind]
+	const flushQueries = draftKinds.map((kind) => ({
+		workspace,
+		itemKind: kind,
+		path: resolveGlobalDraftStoragePathByKind(workspace, kind, path)
+	}))
+	const listedTarget = await resolveWorkspaceDiffTarget(workspace, draftKinds, path)
+	if (
+		listedTarget &&
+		!flushQueries.some(
+			(q) => q.itemKind === listedTarget.kind && q.path === listedTarget.storagePath
+		)
+	) {
+		flushQueries.push({ workspace, itemKind: listedTarget.kind, path: listedTarget.storagePath })
+	}
+	const storagePath = listedTarget?.storagePath ?? flushQueries[0].path
+	for (const query of flushQueries) {
+		await UserDraftDbSyncer.flush(query, { honorAutosaveToggle: true })
+	}
+	expireWorkspaceDiffList(workspace)
+	const hasConflict = flushQueries.some((query) => UserDraftDbSyncer.getConflict(query).conflict)
+
+	// When the latest edits never reached the server (auto-save off, the save
+	// failed, or it conflicted with a newer server version), the persisted
+	// state is stale: diff against the in-memory editor value instead —
+	// read-only, nothing gets persisted — and bypass the snapshot cache,
+	// which must only ever hold persisted state.
+	let flushSkipped = false
+	let localValue: unknown
+	let localKind: UserDraftItemKind = itemKind
+	let localPath = storagePath
+	for (const query of flushQueries) {
+		const skipped =
+			UserDraftDbSyncer.hasUnsavedDisabledChanges(query) ||
+			UserDraftDbSyncer.getState(query).state === 'failed' ||
+			UserDraftDbSyncer.getConflict(query).conflict
+		if (!skipped) continue
+		flushSkipped = true
+		const cell = readLocalDraftCellByKind(workspace, query.itemKind, query.path)
+		if (cell !== undefined) {
+			localValue = cell
+			localKind = query.itemKind
+			localPath = query.path
+			break
+		}
+	}
+
+	let flushCaveat = hasConflict
+		? localValue !== undefined
+			? "Warning: the draft conflicts with a newer server version; this diff shows YOUR local editor value, not the server's. Resolve the conflict in the editor before deploying.\n\n"
+			: 'Warning: the draft has a conflicting newer version on the server; this diff shows the persisted draft, which may not include the latest editor edits.\n\n'
+		: ''
+	let patch: string
+	let noDeployed: boolean
+	let files: Record<string, DiffFileView> | undefined
+	let valueUncomparable = false
+	if (localValue !== undefined) {
+		let deployedSide: unknown
+		try {
+			const values = await getDraftDiffValues(localKind, localPath, workspace)
+			noDeployed = values.noDeployed
+			deployedSide = noDeployed ? undefined : values.deployed
+		} catch (e) {
+			if ((e as { status?: number } | null | undefined)?.status !== 404) throw e
+			// Editor-only draft that was never persisted at all.
+			noDeployed = true
+		}
+		let beforeSide = deployedSide
+		let afterSide = canonicalDraftSideValue(localKind, localValue)
+		// App sides carry `path` (staged renames diff); mirror it onto the local
+		// canonical value, which only knows a draft_path.
+		if (localKind === 'app' || localKind === 'raw_app') {
+			const deployedPath = (deployedSide as { path?: string } | undefined)?.path ?? localPath
+			const stagedPath = (localValue as { draft_path?: string } | null)?.draft_path
+			afterSide = { ...(afterSide as Record<string, unknown>), path: stagedPath ?? deployedPath }
+			if (deployedSide !== undefined) {
+				beforeSide = { ...(deployedSide as Record<string, unknown>), path: deployedPath }
+			}
+		}
+		if (itemKind === 'variable') {
+			;({
+				before: beforeSide,
+				after: afterSide,
+				valueUncomparable
+			} = maskVariableDiffSides(beforeSide, afterSide))
+			flushCaveat += valueUncomparable ? SECRET_UNCOMPARABLE_NOTE : VARIABLE_MASKED_NOTE
+		}
+		const parts = computeDiffParts(beforeSide, afterSide, 'deployed', 'draft')
+		patch = parts.patch
+		files = parts.files
+		flushCaveat +=
+			'Note: this diff includes unsaved editor changes that are NOT saved to the server draft yet (auto-save is off or the last save failed).\n\n'
+	} else if (flushSkipped) {
+		throw new Error(
+			`The latest editor changes for ${type} "${path}" could not be saved and are not readable; retry once the editor saves.`
+		)
+	} else {
+		const entry = await readWorkspaceDiffEntry(workspace, itemKind, storagePath)
+		if (entry) {
+			if (entry.status === 'error') {
+				throw new Error(`Could not diff ${type} "${path}": ${entry.errorMessage}`)
+			}
+			patch = entry.patch ?? ''
+			noDeployed = entry.noDeployed === true
+			files = entry.files
+			valueUncomparable = entry.valueUncomparable === true
+			if (entry.valueMasked) {
+				flushCaveat += valueUncomparable ? SECRET_UNCOMPARABLE_NOTE : VARIABLE_MASKED_NOTE
+			}
+		} else {
+			// Not in the draft listing — either no draft at all (deployed is current),
+			// nothing at the path, or a listing/overlay disagreement; ask the overlay.
+			let values: Awaited<ReturnType<typeof getDraftDiffValues>>
+			try {
+				values = await getDraftDiffValues(itemKind, storagePath, workspace)
+			} catch (e) {
+				if ((e as { status?: number } | null | undefined)?.status === 404) {
+					throw new Error(
+						`No ${type} found at "${path}" — it has neither a deployed version nor a draft.`
+					)
+				}
+				throw e
+			}
+			const { deployed, draft, hasDraft, noDeployed: fetchedNoDeployed } = values
+			if (!fetchedNoDeployed && !hasDraft) {
+				const message = `No draft exists for ${type} "${path}" — the deployed version is current.`
+				toolCallbacks.setToolStatus(toolId, { content: message })
+				return message
+			}
+			// A never-deployed item diffs against nothing: the whole draft reads as added.
+			noDeployed = fetchedNoDeployed
+			let beforeSide: unknown = noDeployed ? undefined : deployed
+			let afterSide: unknown = draft
+			if (itemKind === 'variable') {
+				;({
+					before: beforeSide,
+					after: afterSide,
+					valueUncomparable
+				} = maskVariableDiffSides(beforeSide, afterSide))
+				flushCaveat += valueUncomparable ? SECRET_UNCOMPARABLE_NOTE : VARIABLE_MASKED_NOTE
+			}
+			patch = draftDeployedPatch(beforeSide, afterSide)
+		}
+	}
+
+	const changedFileCount = files ? Object.keys(files).length : 0
+	if (!patch && changedFileCount === 0) {
+		// A secret's sides are masked on both ends — an empty patch cannot prove
+		// the value is unchanged.
+		const message = valueUncomparable
+			? `No visible changes for ${type} "${path}" — but a secret's value cannot be compared and may have been updated in the draft.`
+			: `Draft matches the deployed version of ${type} "${path}" — no changes.`
+		toolCallbacks.setToolStatus(toolId, { content: message, result: message })
+		return flushCaveat + message
+	}
+
+	const header = noDeployed
+		? `${type} "${path}" has no deployed version yet — the entire draft is new.\n\n`
+		: `Draft changes vs deployed for ${type} "${path}":\n\n`
+	if (args.file !== undefined && !files) {
+		throw new Error(
+			`file only applies to multi-file apps; ${type} "${path}" diffs as a single document — call again without file.`
+		)
+	}
+	const body = files
+		? renderEntryFiles(files, patch, args)
+		: windowPatchBody(patch, args.offset ?? 0, args.limit ?? DIFF_READ_DEFAULT_LINES)
+	const result = flushCaveat + header + body
+	toolCallbacks.setToolStatus(toolId, {
+		content: `Draft vs deployed diff for "${path}"`,
+		result
+	})
+	return result
+}
+
+// Body of an item read for a multi-file app: one file's patch when `file` is
+// given, otherwise the per-file summary plus config changes.
+function renderEntryFiles(
+	files: Record<string, DiffFileView>,
+	configPatch: string,
+	args: { file?: string; offset?: number; limit?: number }
+): string {
+	if (args.file !== undefined) {
+		// App files are keyed with a leading slash ("/App.tsx") — accept the
+		// slash-less spelling and a unique basename too.
+		const names = Object.keys(files)
+		const requested = args.file
+		const resolved =
+			names.find((n) => n === requested) ??
+			names.find((n) => n === `/${requested}`) ??
+			(names.filter((n) => n.endsWith(`/${requested.replace(/^\//, '')}`)).length === 1
+				? names.find((n) => n.endsWith(`/${requested.replace(/^\//, '')}`))
+				: undefined)
+		if (resolved === undefined) {
+			const changed = names.join(', ') || '(none)'
+			throw new Error(`No changes in file "${requested}". Changed files: ${changed}.`)
+		}
+		const fileDiff = files[resolved]
+		if (fileDiff.patch === '') {
+			// Empty file added/deleted: the presence change IS the whole diff.
+			return `File "${resolved}" was ${fileDiff.status} with empty content.`
+		}
+		return windowPatchBody(fileDiff.patch, args.offset ?? 0, args.limit ?? DIFF_READ_DEFAULT_LINES)
+	}
+	const sections: string[] = []
+	const fileLines = Object.entries(files).map(
+		([name, fileDiff]) =>
+			`- ${name} — ${fileDiff.status}${fileDiff.status === 'deleted' ? '' : fileDiff.lineCount === 0 ? ' (empty file)' : ` (${fileDiff.lineCount} diff lines)`}`
+	)
+	sections.push(
+		fileLines.length > 0
+			? `${fileLines.length} file(s) changed:\n${fileLines.join('\n')}\nRead one with file="<name>".`
+			: 'No file contents changed.'
+	)
+	if (configPatch) {
+		sections.push(
+			'Config changes:\n' +
+				windowPatchBody(configPatch, args.offset ?? 0, args.limit ?? DIFF_READ_DEFAULT_LINES)
+		)
+	}
+	return sections.join('\n\n')
+}
+
+// Indented per-file child rows under a multi-file app's index line.
+const DIFF_INDEX_MAX_FILE_CHILDREN = 20
+function fileChildrenLines(e: { files?: Record<string, DiffFileView>; patch?: string }): string[] {
+	if (!e.files) return []
+	const names = Object.keys(e.files)
+	if (names.length === 0 && !e.patch) return []
+	const lines = names.slice(0, DIFF_INDEX_MAX_FILE_CHILDREN).map((name) => {
+		const fileDiff = e.files![name]
+		return `    · ${name} — ${fileDiff.status}${
+			fileDiff.status === 'deleted'
+				? ''
+				: fileDiff.lineCount === 0
+					? ' (empty file)'
+					: ` (${fileDiff.lineCount} lines)`
+		}`
+	})
+	if (names.length > DIFF_INDEX_MAX_FILE_CHILDREN) {
+		lines.push(`    · … ${names.length - DIFF_INDEX_MAX_FILE_CHILDREN} more files`)
+	}
+	if (e.patch) {
+		lines.push(`    · (config) — modified (${e.patch.split('\n').length} lines)`)
+	}
+	return lines
+}
+
+function formatDiffIndexEntry(e: WorkspaceDiffEntryView): string {
+	const label = e.type === 'trigger' ? `${e.triggerKind} trigger` : (e.type ?? e.kind)
+	const name = `${label} "${e.path}"`
+	switch (e.status) {
+		case 'new':
+			return `- ${name} — new, never deployed (${e.patchLineCount} lines)`
+		case 'modified':
+			return e.valueUncomparable
+				? `- ${name} — modified (${e.patchLineCount} diff lines; secret value may also differ)`
+				: `- ${name} — modified (${e.patchLineCount} diff lines)`
+		case 'unchanged':
+			return e.valueUncomparable
+				? `- ${name} — no visible changes (secret value cannot be compared; may differ)`
+				: `- ${name} — draft matches deployed`
+		case 'pending':
+			return `- ${name} — draft present (diff not computed yet; read it with type+path)`
+		case 'error':
+			return `- ${name} — diff failed: ${e.errorMessage}`
+		case 'not_diffable':
+			return `- ${e.kind} draft "${e.path}" — not addressable in this chat`
+	}
+}
+
+// Workspace index: every draft the current user has, with its change status
+// from the materialized snapshot.
+async function diffWorkspaceIndex(
+	args: { types?: WorkspaceItemType[]; path_prefix?: string; limit?: number },
+	ctx: WriteDraftCtx
+): Promise<string> {
+	const { workspace, toolId, toolCallbacks } = ctx
+	toolCallbacks.setToolStatus(toolId, { content: 'Computing workspace draft diff...' })
+	// Parked editor autosaves may not have a server row yet (a brand-new draft
+	// only appears in the listing after its first flush).
+	const { unflushedPaths } = await flushGlobalDraftSaves(workspace)
+	expireWorkspaceDiffList(workspace)
+	const index = await getWorkspaceDiffIndex(workspace)
+	let entries = index.entries
+	if (args.types?.length) {
+		entries = entries.filter((e) => e.type !== undefined && args.types!.includes(e.type))
+	}
+	if (args.path_prefix) {
+		entries = entries.filter(
+			(e) => e.path.startsWith(args.path_prefix!) || e.storagePath.startsWith(args.path_prefix!)
+		)
+	}
+	const total = entries.length
+	const shown = entries.slice(
+		0,
+		Math.min(args.limit ?? DIFF_INDEX_DEFAULT_ITEMS, DIFF_INDEX_MAX_ITEMS)
+	)
+	const lines = shown.flatMap((e) => [formatDiffIndexEntry(e), ...fileChildrenLines(e)])
+	const notes: string[] = []
+	if (total > shown.length) {
+		notes.push(
+			`Showing ${shown.length} of ${total} drafts — narrow with types/path_prefix or raise limit.`
+		)
+	}
+	if (index.otherUsersDraftCount > 0) {
+		notes.push(
+			`${index.otherUsersDraftCount} draft(s) by other users exist in this workspace (not shown — drafts are per-user).`
+		)
+	}
+	if (unflushedPaths.length > 0) {
+		notes.push(
+			`Warning: unsaved editor changes on ${unflushedPaths.join(', ')} are NOT reflected here (auto-save off, a save failed, or a conflict is unresolved). Read the item with type+path to include them.`
+		)
+	}
+	const filtersActive = (args.types?.length ?? 0) > 0 || !!args.path_prefix
+	const summaryLine =
+		total === 0
+			? filtersActive && index.entries.length > 0
+				? `No drafts match your filters (${index.entries.length} draft(s) exist in the workspace).`
+				: 'No drafts in this workspace — nothing differs from the deployed state.'
+			: `${total} draft(s) vs deployed:`
+	const result = [summaryLine, ...lines, ...notes].join('\n')
+	toolCallbacks.setToolStatus(toolId, {
+		content: `Workspace diff: ${total} draft(s)`,
+		result
+	})
+	return result
+}
+
+function forkComparisonUnavailableMessage(parent: string): string {
+	return `The comparison with parent workspace "${parent}" is unavailable for this fork (created before comparison tracking existed).`
+}
+
+function forkParentOrThrow(workspace: string): string {
+	const parent = getForkParentWorkspaceId(workspace)
+	if (!parent) {
+		throw new Error(
+			`Workspace "${workspace}" is not a fork — it has no parent workspace to compare against. Use diff without 'against' to compare drafts vs deployed versions.`
+		)
+	}
+	return parent
+}
+
+function forkEntryLabel(e: ForkDiffEntryView): string {
+	const label = e.type === 'trigger' ? `${e.triggerKind} trigger` : (e.type ?? e.kind)
+	return `${label} "${e.path}"`
+}
+
+function formatForkIndexEntry(e: ForkDiffEntryView): string {
+	const name = forkEntryLabel(e)
+	const draftFlag = e.hasLocalDraft ? ' [+ local draft]' : ''
+	const aheadBehind = [
+		e.ahead > 0 ? `ahead ${e.ahead}` : undefined,
+		e.behind > 0 ? `behind ${e.behind}` : undefined
+	]
+		.filter(Boolean)
+		.join(', ')
+	switch (e.status) {
+		case 'only_in_fork':
+			return `- ${name} — only in fork (${e.patchLineCount} lines)${draftFlag}`
+		case 'deleted_in_fork':
+			return `- ${name} — deleted in fork, still in parent${draftFlag}`
+		case 'modified':
+			return `- ${name} — differs (${aheadBehind}; ${e.patchLineCount} diff lines)${draftFlag}`
+		case 'unchanged':
+			// Folder display_name lives only in the DB (no API surface exposes
+			// it), so an identical projection cannot prove folder parity.
+			if (e.kind === 'folder') {
+				const suffix = aheadBehind ? ` (${aheadBehind})` : ''
+				return `- ${name} — no comparable differences; the folder display name is not exposed by the API and may differ${suffix}${draftFlag}`
+			}
+			return e.valueMasked
+				? `- ${name} — value never shown in chat; may differ (${aheadBehind})${draftFlag}`
+				: `- ${name} — content matches parent (version history differs: ${aheadBehind})${draftFlag}`
+		case 'pending':
+			return e.type !== undefined
+				? `- ${name} — differs (${aheadBehind}; diff not computed yet, read it with type+path)${draftFlag}`
+				: `- ${name} — differs (${aheadBehind}; diff not computed yet, read it by path alone)${draftFlag}`
+		case 'error':
+			return `- ${name} — diff failed: ${e.errorMessage}${draftFlag}`
+	}
+}
+
+// Comparison kinds a chat (type, trigger_kind) pair addresses.
+function forkKindsFor(type: WorkspaceItemType, triggerKind?: TriggerKind): string[] {
+	switch (type) {
+		case 'app':
+			return ['app', 'raw_app']
+		case 'trigger':
+			return triggerKind ? [`${triggerKind}_trigger`] : []
+		default:
+			return [type]
+	}
+}
+
+// Fork index: deployed fork vs deployed parent, same tally as the fork banner.
+async function diffForkIndex(
+	args: { types?: WorkspaceItemType[]; path_prefix?: string; limit?: number },
+	ctx: WriteDraftCtx
+): Promise<string> {
+	const { workspace, toolId, toolCallbacks } = ctx
+	const parent = forkParentOrThrow(workspace)
+	toolCallbacks.setToolStatus(toolId, {
+		content: `Comparing fork with parent workspace "${parent}"...`
+	})
+	const index = await getForkDiffIndex(workspace, parent)
+	if (index.skippedComparison) {
+		const message = forkComparisonUnavailableMessage(parent)
+		toolCallbacks.setToolStatus(toolId, { content: message })
+		return message
+	}
+	let entries = index.entries
+	if (args.types?.length) {
+		entries = entries.filter((e) => e.type !== undefined && args.types!.includes(e.type))
+	}
+	if (args.path_prefix) {
+		entries = entries.filter((e) => e.path.startsWith(args.path_prefix!))
+	}
+	const total = entries.length
+	const shown = entries.slice(
+		0,
+		Math.min(args.limit ?? DIFF_INDEX_DEFAULT_ITEMS, DIFF_INDEX_MAX_ITEMS)
+	)
+	const lines = shown.flatMap((e) => [formatForkIndexEntry(e), ...fileChildrenLines(e)])
+	const notes: string[] = []
+	if (total > shown.length) {
+		notes.push(
+			`Showing ${shown.length} of ${total} items — narrow with types/path_prefix or raise limit.`
+		)
+	}
+	if (shown.some((e) => e.hasLocalDraft)) {
+		notes.push(
+			'[+ local draft]: you also have an undeployed draft there — not part of this deployed-vs-deployed comparison; use diff without against to see it.'
+		)
+	}
+	const hasHidden = index.hiddenAheadCount > 0 || index.hiddenBehindCount > 0
+	if (hasHidden) {
+		notes.push(
+			`Hidden items you lack permission to view also differ: ${index.hiddenAheadCount} ahead, ${index.hiddenBehindCount} behind (a conflicted item counts in both).`
+		)
+	}
+	const forkFiltersActive = (args.types?.length ?? 0) > 0 || !!args.path_prefix
+	const summaryLine =
+		total === 0
+			? forkFiltersActive && index.entries.length > 0
+				? `No differing items match your filters (${index.entries.length} differing item(s) exist).`
+				: hasHidden
+					? `No differences visible to you between this fork and its parent "${parent}" — but hidden items differ (see below).`
+					: `This fork matches its parent workspace "${parent}" — no differences.`
+			: `${total} item(s) differ between this fork and its parent "${parent}":`
+	const result = [summaryLine, ...lines, ...notes].join('\n')
+	toolCallbacks.setToolStatus(toolId, {
+		content: `Fork vs parent: ${total} differing item(s)`,
+		result
+	})
+	return result
+}
+
+// One item's fork-vs-parent unified diff (deployed sides only).
+async function diffForkItem(
+	args: {
+		type?: WorkspaceItemType
+		path?: string
+		trigger_kind?: TriggerKind
+		file?: string
+		offset?: number
+		limit?: number
+	},
+	ctx: WriteDraftCtx
+): Promise<string> {
+	const { workspace, toolId, toolCallbacks } = ctx
+	const { type, path, trigger_kind: triggerKind } = args
+	if (!path) {
+		throw new Error('path is required.')
+	}
+	const parent = forkParentOrThrow(workspace)
+	// No type = path-only wildcard: comparison kinds outside the chat type enum
+	// (folder, resource_type, …) are only reachable this way.
+	const kinds = type ? forkKindsFor(type, triggerKind) : []
+	if (type === 'trigger' && kinds.length === 0) {
+		throw new Error('trigger_kind is required when type is trigger.')
+	}
+	toolCallbacks.setToolStatus(toolId, {
+		content: `Comparing fork vs parent for "${path}"...`
+	})
+	if ((await getForkComparisonStatus(workspace, parent)).skippedComparison) {
+		const message = forkComparisonUnavailableMessage(parent)
+		toolCallbacks.setToolStatus(toolId, { content: message })
+		return message
+	}
+	const entries = await readForkDiffEntries(workspace, parent, kinds, path)
+	if (entries.length === 0) {
+		const message = `${type ?? 'item'} "${path}" does not differ between this fork and its parent "${parent}" (or does not exist in either).`
+		toolCallbacks.setToolStatus(toolId, { content: message })
+		return message
+	}
+	// A wildcard can match several kinds at one path (nothing in the chat
+	// schema could pick between them) — render each kind's section.
+	const sections = entries.map((entry) => renderForkEntrySection(entry, path, parent, args))
+	const result = sections.join('\n\n====\n\n')
+	toolCallbacks.setToolStatus(toolId, {
+		content: `Fork vs parent diff for "${path}"`,
+		result
+	})
+	return result
+}
+
+function renderForkEntrySection(
+	entry: ForkDiffEntryView,
+	path: string,
+	parent: string,
+	args: { file?: string; offset?: number; limit?: number }
+): string {
+	if (entry.status === 'error') {
+		throw new Error(
+			`Could not diff ${entry.kind} "${path}" against the parent: ${entry.errorMessage}`
+		)
+	}
+	let draftCaveat = entry.hasLocalDraft
+		? 'Note: you also have an undeployed local draft on this item — it is NOT part of this deployed-vs-deployed comparison; use diff without against to see it.\n\n'
+		: ''
+	if (entry.valueMasked && entry.status === 'modified') {
+		draftCaveat +=
+			'Note: variable values are never compared in chat — the value may also differ beyond the changes shown.\n\n'
+	}
+	const changedFileCount = entry.files ? Object.keys(entry.files).length : 0
+	if (entry.status === 'unchanged' || (!entry.patch && changedFileCount === 0)) {
+		// A masked value can differ in content without producing a patch —
+		// never report that as "same content".
+		const message = entry.valueMasked
+			? `${entry.kind} "${path}": no visible config differences vs parent "${parent}", but variable values are never shown in chat, so a value change cannot be displayed. The workspace comparison reports it as ${entry.ahead > 0 || entry.behind > 0 ? `differing (ahead ${entry.ahead}, behind ${entry.behind})` : 'in sync'}.`
+			: entry.kind === 'folder'
+				? `folder "${path}": no comparable differences vs parent "${parent}" — the folder display name is not exposed by the API and may be what differs (comparison reports ahead ${entry.ahead}, behind ${entry.behind}).`
+				: `${entry.kind} "${path}" has the same content in the fork and its parent "${parent}" (only version history differs).`
+		return draftCaveat + message
+	}
+	const header =
+		entry.status === 'only_in_fork'
+			? `${entry.kind} "${path}" exists only in the fork — not in parent "${parent}". Full content:\n\n`
+			: entry.status === 'deleted_in_fork'
+				? `${entry.kind} "${path}" was deleted in the fork but still exists in parent "${parent}". Removed content:\n\n`
+				: `Fork changes vs parent "${parent}" for ${entry.kind} "${path}":\n\n`
+	if (args.file !== undefined && !entry.files) {
+		throw new Error(
+			`file only applies to multi-file apps; ${entry.kind} "${path}" diffs as a single document — call again without file.`
+		)
+	}
+	const body = entry.files
+		? renderEntryFiles(entry.files, entry.patch ?? '', args)
+		: windowPatchBody(entry.patch ?? '', args.offset ?? 0, args.limit ?? DIFF_READ_DEFAULT_LINES)
+	return draftCaveat + header + body
+}
+
+const DIFF_SEARCH_DEFAULT_MAX_MATCHES = 50
+const DIFF_SEARCH_MAX_MATCHES_CEILING = 200
+
+interface DiffSearchUnit {
+	/** Item path, or `${itemPath}/${fileName}` for a file inside an app. */
+	subject: string
+	patch: string
+}
+
+function collectDiffSearchUnits(
+	entries: Array<{
+		path: string
+		status?: string
+		patch?: string
+		files?: Record<string, DiffFileView>
+	}>,
+	out: DiffSearchUnit[],
+	failedPaths: string[]
+): void {
+	for (const e of entries) {
+		// A failed materialization has no patch — claiming "no matches" for it
+		// would present an incomplete search as a definitive one.
+		if (e.status === 'error') {
+			failedPaths.push(e.path)
+			continue
+		}
+		if (e.files) {
+			for (const [name, fileDiff] of Object.entries(e.files)) {
+				// App file keys lead with '/'; a raw join would yield `f/x//file`,
+				// which slash-anchored globs like `f/x/*.tsx` can never match.
+				out.push({ subject: `${e.path}/${name.replace(/^\/+/, '')}`, patch: fileDiff.patch })
+			}
+			if (e.patch) out.push({ subject: e.path, patch: e.patch })
+		} else if (e.patch) {
+			out.push({ subject: e.path, patch: e.patch })
+		}
+	}
+}
+
+// Literal substring search over the changed lines of every diff in the
+// comparison. Materializes all patches first (search cannot skip any), then
+// scans in memory — same output conventions as search_app.
+async function diffSearch(
+	args: {
+		against?: 'deployed' | 'parent_workspace'
+		search?: string
+		file_glob?: string
+		max_matches?: number
+	},
+	ctx: WriteDraftCtx
+): Promise<string> {
+	const { workspace, toolId, toolCallbacks } = ctx
+	const query = args.search ?? ''
+	if (query.length === 0) {
+		throw new Error('search requires a non-empty string.')
+	}
+	toolCallbacks.setToolStatus(toolId, { content: `Searching diffs for "${query}"...` })
+
+	const units: DiffSearchUnit[] = []
+	const failedPaths: string[] = []
+	let unflushedNote = ''
+	if (args.against === 'parent_workspace') {
+		const parent = forkParentOrThrow(workspace)
+		const index = await getForkDiffIndex(workspace, parent, { materializeAll: true })
+		if (index.skippedComparison) {
+			const message = forkComparisonUnavailableMessage(parent)
+			toolCallbacks.setToolStatus(toolId, { content: message })
+			return message
+		}
+		collectDiffSearchUnits(index.entries, units, failedPaths)
+	} else {
+		const { unflushedPaths } = await flushGlobalDraftSaves(workspace)
+		expireWorkspaceDiffList(workspace)
+		if (unflushedPaths.length > 0) {
+			unflushedNote = `\nWarning: unsaved editor changes on ${unflushedPaths.join(', ')} were not searched (auto-save off, a save failed, or a conflict is unresolved).`
+		}
+		const index = await getWorkspaceDiffIndex(workspace, { materializeAll: true })
+		collectDiffSearchUnits(index.entries, units, failedPaths)
+	}
+	if (failedPaths.length > 0) {
+		unflushedNote += `\nWarning: ${failedPaths.length === 1 ? 'this diff' : 'these diffs'} could not be computed and ${failedPaths.length === 1 ? 'was' : 'were'} NOT searched (matches may be missing): ${failedPaths.join(', ')}. Retry, or read the item${failedPaths.length === 1 ? '' : 's'} directly for the error.`
+	}
+	const filtered = args.file_glob
+		? units.filter((u) => appFileMatchesGlob(u.subject, args.file_glob as string))
+		: units
+
+	const needle = query.toLowerCase()
+	const maxMatches = Math.min(
+		args.max_matches ?? DIFF_SEARCH_DEFAULT_MAX_MATCHES,
+		DIFF_SEARCH_MAX_MATCHES_CEILING
+	)
+	const matches: { subject: string; line: number; text: string }[] = []
+	let totalMatchCount = 0
+	let renderedMatchCount = 0
+	let subjectCount = 0
+	let truncated = false
+	for (const unit of filtered.sort((a, b) => a.subject.localeCompare(b.subject))) {
+		const lines = unit.patch.split('\n')
+		const changed = new Set(changedLineIndices(unit.patch))
+		let unitHadMatch = false
+		for (let i = 0; i < lines.length; i++) {
+			if (!changed.has(i) || !lines[i].toLowerCase().includes(needle)) continue
+			totalMatchCount++
+			unitHadMatch = true
+			if (renderedMatchCount >= maxMatches) {
+				truncated = true
+				continue
+			}
+			renderedMatchCount++
+			const lo = Math.max(0, i - SEARCH_APP_CONTEXT_LINES)
+			const hi = Math.min(lines.length - 1, i + SEARCH_APP_CONTEXT_LINES)
+			for (let j = lo; j <= hi; j++) {
+				matches.push({ subject: unit.subject, line: j + 1, text: lines[j] })
+			}
+		}
+		if (unitHadMatch) subjectCount++
+	}
+
+	if (totalMatchCount === 0) {
+		toolCallbacks.setToolStatus(toolId, { content: `No diff matches for "${query}"` })
+		return (
+			`No changed lines match. Try a broader or differently-spelled term${
+				args.file_glob ? ', or drop the file_glob' : ''
+			}.` + unflushedNote
+		)
+	}
+
+	const header = `${totalMatchCount} changed line${totalMatchCount === 1 ? '' : 's'} match in ${subjectCount} diff${
+		subjectCount === 1 ? '' : 's'
+	}${truncated ? ` (showing the first ${maxMatches}; narrow with file_glob or a more specific query)` : ''}`
+	const out: string[] = [header]
+	let currentSubject = ''
+	let budgetSpent = header.length
+	let budgetHit = false
+	const seen = new Set<string>()
+	for (const m of matches) {
+		const dedupeKey = `${m.subject}:${m.line}`
+		if (seen.has(dedupeKey)) continue
+		seen.add(dedupeKey)
+		const text =
+			m.text.length > SEARCH_APP_MAX_LINE_CHARS
+				? `${m.text.slice(0, SEARCH_APP_MAX_LINE_CHARS)}… [line truncated]`
+				: m.text
+		const subjectHeader = m.subject === currentSubject ? '' : `${m.subject}\n`
+		const row = `${subjectHeader}  ${m.line}: ${text}`
+		if (budgetSpent + row.length + 1 > SEARCH_APP_TOTAL_CHAR_BUDGET) {
+			budgetHit = true
+			break
+		}
+		if (subjectHeader) currentSubject = m.subject
+		out.push(row)
+		budgetSpent += row.length + 1
+	}
+	if (budgetHit) {
+		out.push(
+			`… output truncated at the context budget — narrow with file_glob or a more specific query.`
+		)
+	}
+
+	toolCallbacks.setToolStatus(toolId, {
+		content: `Found ${totalMatchCount} matching changed line${totalMatchCount === 1 ? '' : 's'}`
+	})
+	return out.join('\n') + unflushedNote
+}
+
 // Flush a draft's pending editor autosave, then verify it actually landed before
 // the caller re-reads the persisted draft. `flush()` resolves even when the save
 // recorded a conflict (server has a newer version) or failed (network/5xx) — it
@@ -5535,6 +6423,11 @@ async function deployDraft(
 		}
 	}
 
+	// Deployed state moved for EVERY branch above (some bypass
+	// deployDraftToWorkspace, which invalidates on its own path) — evict cached
+	// fork comparisons before the fallible draft cleanup below.
+	invalidateWorkspaceComparison(workspace)
+
 	await deleteGlobalDraft(workspace, type, path, triggerKind, { preserveLiveDraft: true })
 
 	// Move the chat's mask entry to the deployed path: a draft-only item's
@@ -5617,6 +6510,10 @@ async function deleteWorkspaceItem(
 			break
 	}
 
+	// Deployed state changed — cached fork comparisons involving this workspace
+	// are no longer trustworthy (same rule as deploy success). Before the
+	// draft cleanup: a cleanup failure must not leave stale comparisons.
+	invalidateWorkspaceComparison(workspace)
 	await deleteGlobalDraft(workspace, type, path, triggerKind)
 
 	// Record the deletion in the chat's modified-items mask. In a fork this leaves a
diff --git a/frontend/src/lib/components/copilot/chat/global/diffSnapshot.test.ts b/frontend/src/lib/components/copilot/chat/global/diffSnapshot.test.ts
new file mode 100644
index 0000000000..76aed58b7c
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/global/diffSnapshot.test.ts
@@ -0,0 +1,680 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+vi.mock('$lib/workspaceDrafts.svelte', () => ({
+	getDraftItems: vi.fn(),
+	getWorkspaceDraftsVersion: vi.fn(() => 0)
+}))
+vi.mock('$lib/utils_draft_deploy', () => ({
+	getDraftDiffValues: vi.fn()
+}))
+vi.mock('$lib/utils_workspace_deploy', () => ({
+	getItemValue: vi.fn()
+}))
+vi.mock('$lib/workspaceComparison', () => ({
+	fetchWorkspaceComparisonMeta: vi.fn(),
+	isComparisonCurrent: vi.fn(() => true)
+}))
+vi.mock('$lib/stores', async () => {
+	const { readable, writable } = await import('svelte/store')
+	return {
+		userWorkspaces: readable([{ id: 'fork-ws', parent_workspace_id: 'parent-ws' }]),
+		usersWorkspaceStore: writable(undefined)
+	}
+})
+vi.mock('$lib/gen', () => ({
+	VariableService: { getVariable: vi.fn() },
+	ScriptService: { getScriptByPath: vi.fn() },
+	ResourceService: { getResource: vi.fn(), getResourceType: vi.fn() },
+	FlowService: { getFlowByPath: vi.fn() }
+}))
+vi.mock('./userDraftAdapter', () => ({
+	itemTypeForKind: (kind: string) =>
+		kind === 'script'
+			? { type: 'script' }
+			: kind === 'raw_app' || kind === 'app'
+				? { type: 'app' }
+				: kind === 'trigger_http'
+					? { type: 'trigger', triggerKind: 'http' }
+					: undefined
+}))
+
+import { getDraftItems, getWorkspaceDraftsVersion } from '$lib/workspaceDrafts.svelte'
+import { getDraftDiffValues } from '$lib/utils_draft_deploy'
+import { getItemValue } from '$lib/utils_workspace_deploy'
+import { fetchWorkspaceComparisonMeta, isComparisonCurrent } from '$lib/workspaceComparison'
+import { usersWorkspaceStore } from '$lib/stores'
+import { FlowService, ResourceService, ScriptService, VariableService } from '$lib/gen'
+import {
+	expireWorkspaceDiffList,
+	getForkDiffIndex,
+	getForkParentWorkspaceId,
+	getWorkspaceDiffIndex,
+	invalidateWorkspaceDiffCache,
+	markWorkspaceDiffEntryStale,
+	readForkDiffEntries,
+	readWorkspaceDiffEntry
+} from './diffSnapshot'
+
+const WS = 'test-ws'
+
+function row(overrides: Partial<Record<string, unknown>> = {}) {
+	return {
+		kind: 'script',
+		path: 'f/a/b',
+		draft_only: false,
+		legacy_draft: false,
+		raw_app: false,
+		can_write: true,
+		mine: true,
+		created_at: '2026-07-20T00:00:00Z',
+		...overrides
+	}
+}
+
+function mockDiffValues(deployed: unknown, draft: unknown, noDeployed = false) {
+	vi.mocked(getDraftDiffValues).mockResolvedValue({
+		deployed,
+		draft,
+		hasDraft: true,
+		noDeployed
+	} as any)
+}
+
+beforeEach(() => {
+	vi.useFakeTimers()
+	invalidateWorkspaceDiffCache()
+	vi.mocked(getDraftItems).mockReset()
+	vi.mocked(getDraftDiffValues).mockReset()
+	vi.mocked(getWorkspaceDraftsVersion).mockReset().mockReturnValue(0)
+})
+
+afterEach(() => {
+	vi.useRealTimers()
+})
+
+describe('getWorkspaceDiffIndex', () => {
+	it('materializes patches once and reuses them while rows are unchanged', async () => {
+		vi.mocked(getDraftItems).mockResolvedValue([row()] as any)
+		mockDiffValues({ content: 'a' }, { content: 'b' })
+
+		const first = await getWorkspaceDiffIndex(WS)
+		expect(first.entries).toHaveLength(1)
+		expect(first.entries[0].status).toBe('modified')
+		expect(first.entries[0].patch).toContain('-content: a')
+		expect(getDraftDiffValues).toHaveBeenCalledTimes(1)
+
+		// Second access after the list-reuse window: row unchanged → no refetch.
+		vi.advanceTimersByTime(10_000)
+		const second = await getWorkspaceDiffIndex(WS)
+		expect(second.entries[0].status).toBe('modified')
+		expect(getDraftDiffValues).toHaveBeenCalledTimes(1)
+	})
+
+	it('refetches the listing after expireWorkspaceDiffList despite the reuse window', async () => {
+		vi.mocked(getDraftItems).mockResolvedValue([row()] as any)
+		mockDiffValues({ content: 'a' }, { content: 'b' })
+		await getWorkspaceDiffIndex(WS)
+		expect(getDraftItems).toHaveBeenCalledTimes(1)
+
+		// Within the reuse window the listing is served from cache...
+		await getWorkspaceDiffIndex(WS)
+		expect(getDraftItems).toHaveBeenCalledTimes(1)
+
+		// ...but an expiry (post-flush) forces a refetch immediately.
+		expireWorkspaceDiffList(WS)
+		await getWorkspaceDiffIndex(WS)
+		expect(getDraftItems).toHaveBeenCalledTimes(2)
+	})
+
+	it('an in-flight listing fetch never serves rows that predate a mid-flight save', async () => {
+		let release!: () => void
+		const gate = new Promise<void>((res) => (release = res))
+		const oldRows = [row()]
+		const newRows = [row(), row({ path: 'f/a/created-mid-flight' })]
+		let call = 0
+		vi.mocked(getDraftItems).mockImplementation(async () => {
+			call++
+			if (call === 1) {
+				await gate
+				return oldRows as any
+			}
+			return newRows as any
+		})
+		mockDiffValues({ content: 'a' }, { content: 'b' })
+
+		const first = getWorkspaceDiffIndex(WS)
+		// A save lands while the first listing fetch is in flight...
+		markWorkspaceDiffEntryStale(WS, 'script', 'f/a/created-mid-flight')
+		release()
+		const index = await first
+		// ...so the result must reflect the post-save listing, not the stale rows.
+		expect(index.entries.map((e) => e.storagePath)).toContain('f/a/created-mid-flight')
+		expect(getDraftItems).toHaveBeenCalledTimes(2)
+	})
+
+	it('refetches a stale-marked entry immediately, despite every reuse window', async () => {
+		vi.mocked(getDraftItems).mockResolvedValue([row()] as any)
+		mockDiffValues({ content: 'a' }, { content: 'b' })
+		await readWorkspaceDiffEntry(WS, 'script', 'f/a/b')
+		expect(getDraftDiffValues).toHaveBeenCalledTimes(1)
+
+		// Within both the list throttle and the read-reuse window the patch is
+		// served from cache...
+		await readWorkspaceDiffEntry(WS, 'script', 'f/a/b')
+		expect(getDraftDiffValues).toHaveBeenCalledTimes(1)
+
+		// ...but a landed save (the syncer hook) forces content + listing fresh.
+		markWorkspaceDiffEntryStale(WS, 'script', 'f/a/b')
+		mockDiffValues({ content: 'a' }, { content: 'c' })
+		const entry = await readWorkspaceDiffEntry(WS, 'script', 'f/a/b')
+		expect(getDraftDiffValues).toHaveBeenCalledTimes(2)
+		expect(entry?.patch).toContain('+content: c')
+	})
+
+	it('refetches an entry when its draft row created_at changes', async () => {
+		vi.mocked(getDraftItems).mockResolvedValue([row()] as any)
+		mockDiffValues({ content: 'a' }, { content: 'b' })
+		await getWorkspaceDiffIndex(WS)
+		expect(getDraftDiffValues).toHaveBeenCalledTimes(1)
+
+		vi.advanceTimersByTime(10_000)
+		vi.mocked(getDraftItems).mockResolvedValue([row({ created_at: '2026-07-20T01:00:00Z' })] as any)
+		mockDiffValues({ content: 'a' }, { content: 'a' })
+		const index = await getWorkspaceDiffIndex(WS)
+		expect(getDraftDiffValues).toHaveBeenCalledTimes(2)
+		expect(index.entries[0].status).toBe('unchanged')
+	})
+
+	it('drops cached patches when the workspace drafts version bumps', async () => {
+		vi.mocked(getDraftItems).mockResolvedValue([row()] as any)
+		mockDiffValues({ content: 'a' }, { content: 'b' })
+		await getWorkspaceDiffIndex(WS)
+		expect(getDraftDiffValues).toHaveBeenCalledTimes(1)
+
+		vi.mocked(getWorkspaceDraftsVersion).mockReturnValue(1)
+		await getWorkspaceDiffIndex(WS)
+		expect(getDraftDiffValues).toHaveBeenCalledTimes(2)
+	})
+
+	it('excludes other users drafts from entries but counts them', async () => {
+		vi.mocked(getDraftItems).mockResolvedValue([
+			row(),
+			row({ path: 'f/other/x', mine: false })
+		] as any)
+		mockDiffValues({ content: 'a' }, { content: 'b' })
+		const index = await getWorkspaceDiffIndex(WS)
+		expect(index.entries).toHaveLength(1)
+		expect(index.otherUsersDraftCount).toBe(1)
+	})
+
+	it('maps statuses: never-deployed → new, unaddressable kind → not_diffable', async () => {
+		vi.mocked(getDraftItems).mockResolvedValue([
+			row({ path: 'f/a/new', draft_only: true }),
+			row({ kind: 'data_pipeline', path: 'f/a/pipe' })
+		] as any)
+		mockDiffValues(undefined, { content: 'b' }, true)
+		const index = await getWorkspaceDiffIndex(WS)
+		const byPath = Object.fromEntries(index.entries.map((e) => [e.storagePath, e]))
+		expect(byPath['f/a/new'].status).toBe('new')
+		expect(byPath['f/a/pipe'].status).toBe('not_diffable')
+		// Unaddressable kinds are never fetched.
+		expect(getDraftDiffValues).toHaveBeenCalledTimes(1)
+	})
+
+	it('masks draft-mode variable values but still marks a value change', async () => {
+		vi.mocked(getDraftItems).mockResolvedValue([
+			row({ kind: 'variable', path: 'f/a/token' })
+		] as any)
+		vi.mocked(getDraftDiffValues).mockResolvedValue({
+			deployed: { value: 'old-plaintext', is_secret: false, description: 'd' },
+			draft: { value: 'new-plaintext', is_secret: false, description: 'd' },
+			hasDraft: true,
+			noDeployed: false
+		} as any)
+		const entry = await readWorkspaceDiffEntry(WS, 'variable', 'f/a/token')
+		expect(entry?.status).toBe('modified')
+		expect(entry?.valueMasked).toBe(true)
+		// No plaintext on either side — the patch only marks that it changed.
+		expect(entry?.patch).not.toContain('plaintext')
+		expect(entry?.patch).toContain('(changed)')
+	})
+
+	it('flags a secret-only draft as uncomparable instead of claiming unchanged', async () => {
+		vi.mocked(getDraftItems).mockResolvedValue([
+			row({ kind: 'variable', path: 'f/a/secret' })
+		] as any)
+		// The shared canonicalizer already masked both sides to the same
+		// sentinel — equality between them proves nothing.
+		vi.mocked(getDraftDiffValues).mockResolvedValue({
+			deployed: { value: '<secret>', is_secret: true, description: 'd' },
+			draft: { value: '<secret>', is_secret: true, description: 'd' },
+			hasDraft: true,
+			noDeployed: false
+		} as any)
+		const entry = await readWorkspaceDiffEntry(WS, 'variable', 'f/a/secret')
+		expect(entry?.status).toBe('unchanged')
+		expect(entry?.valueUncomparable).toBe(true)
+	})
+
+	it('keeps the uncomparable flag on a secret whose metadata also changed', async () => {
+		vi.mocked(getDraftItems).mockResolvedValue([
+			row({ kind: 'variable', path: 'f/a/secret' })
+		] as any)
+		vi.mocked(getDraftDiffValues).mockResolvedValue({
+			deployed: { value: '<secret>', is_secret: true, description: 'old desc' },
+			draft: { value: '<secret>', is_secret: true, description: 'new desc' },
+			hasDraft: true,
+			noDeployed: false
+		} as any)
+		const entry = await readWorkspaceDiffEntry(WS, 'variable', 'f/a/secret')
+		// A non-empty metadata patch must not swallow the secret caveat: the
+		// value itself may ALSO differ beyond what the patch shows.
+		expect(entry?.status).toBe('modified')
+		expect(entry?.valueUncomparable).toBe(true)
+		expect(entry?.patch).toContain('desc')
+		expect(entry?.patch).not.toContain('<secret')
+	})
+
+	it('materializes classic-app drafts under the chat app type', async () => {
+		vi.mocked(getDraftItems).mockResolvedValue([row({ kind: 'app', path: 'f/a/classic' })] as any)
+		mockDiffValues({ summary: 'v1' }, { summary: 'v2' })
+		const index = await getWorkspaceDiffIndex(WS)
+		expect(index.entries[0].type).toBe('app')
+		expect(index.entries[0].status).toBe('modified')
+	})
+
+	it('leaves entries beyond the eager cap pending', async () => {
+		const rows = Array.from({ length: 55 }, (_, i) => row({ path: `f/a/s${i}` }))
+		vi.mocked(getDraftItems).mockResolvedValue(rows as any)
+		mockDiffValues({ content: 'a' }, { content: 'b' })
+		const index = await getWorkspaceDiffIndex(WS)
+		expect(index.entries).toHaveLength(55)
+		expect(index.entries.filter((e) => e.status === 'pending')).toHaveLength(5)
+		expect(getDraftDiffValues).toHaveBeenCalledTimes(50)
+	})
+})
+
+describe('raw-app file splitting (draft mode)', () => {
+	it('produces per-file patches plus a config-only patch', async () => {
+		vi.mocked(getDraftItems).mockResolvedValue([
+			row({ kind: 'raw_app', path: 'f/dash/main' })
+		] as any)
+		vi.mocked(getDraftDiffValues).mockResolvedValue({
+			deployed: {
+				summary: 'Dash',
+				files: { 'src/App.tsx': 'a\nb\nc\n', 'old.js': 'legacy\n' },
+				runnables: {}
+			},
+			draft: {
+				summary: 'Dash v2',
+				files: { 'src/App.tsx': 'a\nB\nc\n', 'new.ts': 'fresh\n' },
+				runnables: {}
+			},
+			hasDraft: true,
+			noDeployed: false
+		} as any)
+		const entry = await readWorkspaceDiffEntry(WS, 'raw_app', 'f/dash/main')
+		expect(entry?.status).toBe('modified')
+		expect(entry?.files?.['src/App.tsx'].status).toBe('modified')
+		expect(entry?.files?.['src/App.tsx'].patch).toContain('-b')
+		expect(entry?.files?.['new.ts'].status).toBe('added')
+		expect(entry?.files?.['old.js'].status).toBe('deleted')
+		// Config patch carries the summary change but no file contents.
+		expect(entry?.patch).toContain('summary')
+		expect(entry?.patch).not.toContain('src/App.tsx')
+	})
+
+	it('reports empty-file additions and deletions as changes despite the empty patch', async () => {
+		vi.mocked(getDraftItems).mockResolvedValue([
+			row({ kind: 'raw_app', path: 'f/dash/main' })
+		] as any)
+		vi.mocked(getDraftDiffValues).mockResolvedValue({
+			deployed: { summary: 'Dash', files: { 'gone.css': '', 'kept.ts': 'same\n' }, runnables: {} },
+			draft: { summary: 'Dash', files: { 'added.ts': '', 'kept.ts': 'same\n' }, runnables: {} },
+			hasDraft: true,
+			noDeployed: false
+		} as any)
+		const entry = await readWorkspaceDiffEntry(WS, 'raw_app', 'f/dash/main')
+		expect(entry?.status).toBe('modified')
+		expect(entry?.files?.['added.ts']).toEqual({ status: 'added', patch: '', lineCount: 0 })
+		expect(entry?.files?.['gone.css']).toEqual({ status: 'deleted', patch: '', lineCount: 0 })
+		expect(entry?.files?.['kept.ts']).toBeUndefined()
+	})
+
+	it('reports unchanged when neither files nor config differ', async () => {
+		const value = { summary: 'Dash', files: { 'a.ts': 'same\n' }, runnables: {} }
+		vi.mocked(getDraftItems).mockResolvedValue([
+			row({ kind: 'raw_app', path: 'f/dash/main' })
+		] as any)
+		vi.mocked(getDraftDiffValues).mockResolvedValue({
+			deployed: value,
+			draft: structuredClone(value),
+			hasDraft: true,
+			noDeployed: false
+		} as any)
+		const entry = await readWorkspaceDiffEntry(WS, 'raw_app', 'f/dash/main')
+		expect(entry?.status).toBe('unchanged')
+		expect(entry?.files).toEqual({})
+	})
+})
+
+describe('readWorkspaceDiffEntry', () => {
+	it('resolves a draft-only item by its friendly draft_path', async () => {
+		vi.mocked(getDraftItems).mockResolvedValue([
+			row({ path: 'u/admin/draft_123', draft_path: 'f/nice/name', draft_only: true })
+		] as any)
+		mockDiffValues(undefined, { summary: 'x' }, true)
+		const entry = await readWorkspaceDiffEntry(WS, 'script', 'f/nice/name')
+		expect(entry?.storagePath).toBe('u/admin/draft_123')
+		expect(entry?.status).toBe('new')
+	})
+
+	// (resolveWorkspaceDiffTarget)
+	it('resolves a renamed draft to its owning row across kinds', async () => {
+		vi.mocked(getDraftItems).mockResolvedValue([
+			row({ kind: 'app', path: 'f/old/name', draft_path: 'f/new/name' })
+		] as any)
+		const { resolveWorkspaceDiffTarget } = await import('./diffSnapshot')
+		const target = await resolveWorkspaceDiffTarget(WS, ['raw_app', 'app'], 'f/new/name')
+		expect(target).toEqual({ kind: 'app', storagePath: 'f/old/name' })
+	})
+
+	it('returns undefined when the user has no draft at the path', async () => {
+		vi.mocked(getDraftItems).mockResolvedValue([] as any)
+		const entry = await readWorkspaceDiffEntry(WS, 'script', 'f/a/b')
+		expect(entry).toBeUndefined()
+		expect(getDraftDiffValues).not.toHaveBeenCalled()
+	})
+
+	it('records a fetch failure as an error entry instead of throwing', async () => {
+		vi.mocked(getDraftItems).mockResolvedValue([row()] as any)
+		vi.mocked(getDraftDiffValues).mockRejectedValue({ status: 404 })
+		const entry = await readWorkspaceDiffEntry(WS, 'script', 'f/a/b')
+		expect(entry?.status).toBe('error')
+		expect(entry?.errorMessage).toContain('not found')
+	})
+})
+
+async function readForkDiffEntryOne(
+	workspace: string,
+	parent: string,
+	kinds: string[],
+	path: string
+) {
+	const entries = await readForkDiffEntries(workspace, parent, kinds, path)
+	return entries[0]
+}
+
+const FORK = 'fork-ws'
+const PARENT = 'parent-ws'
+
+function comparisonDiff(overrides: Partial<Record<string, unknown>> = {}) {
+	return {
+		kind: 'schedule',
+		path: 'f/a/b',
+		ahead: 1,
+		behind: 0,
+		has_changes: true,
+		exists_in_source: true,
+		exists_in_fork: true,
+		...overrides
+	}
+}
+
+let comparisonGen = 0
+function mockComparison(diffs: unknown[], meta: { fetchedAt?: number } = {}) {
+	const fetchedAt = meta.fetchedAt
+	vi.mocked(fetchWorkspaceComparisonMeta).mockImplementation(async () => ({
+		comparison: {
+			skipped_comparison: false,
+			diffs,
+			summary: { total_diffs: diffs.length },
+			hidden_ahead: { total: 0, by_kind: {}, items: [] },
+			hidden_behind: { total: 0, by_kind: {}, items: [] }
+		} as any,
+		fetchedAt: fetchedAt ?? Date.now(),
+		generation: ++comparisonGen
+	}))
+}
+
+describe('fork mode', () => {
+	beforeEach(() => {
+		vi.mocked(getDraftItems).mockResolvedValue([] as any)
+		vi.mocked(getItemValue).mockReset()
+		vi.mocked(fetchWorkspaceComparisonMeta).mockReset()
+		vi.mocked(isComparisonCurrent).mockReset().mockReturnValue(true)
+		vi.mocked(VariableService.getVariable).mockReset()
+	})
+
+	it('resolves the parent workspace from the user workspaces store', () => {
+		expect(getForkParentWorkspaceId(FORK)).toBe(PARENT)
+		expect(getForkParentWorkspaceId('plain-ws')).toBeUndefined()
+	})
+
+	it('diffs both deployed sides and maps one-sided items', async () => {
+		mockComparison([
+			comparisonDiff(),
+			comparisonDiff({ path: 'f/a/new', exists_in_source: false }),
+			comparisonDiff({ path: 'f/a/gone', exists_in_fork: false, ahead: 0, behind: 1 })
+		])
+		vi.mocked(getItemValue).mockImplementation(async (_k, path, ws) => ({
+			content: `${path}@${ws}`
+		}))
+		const index = await getForkDiffIndex(FORK, PARENT)
+		const byPath = Object.fromEntries(index.entries.map((e) => [e.path, e]))
+		expect(byPath['f/a/b'].status).toBe('modified')
+		expect(byPath['f/a/new'].status).toBe('only_in_fork')
+		expect(byPath['f/a/new'].patch).not.toContain('parent-ws')
+		expect(byPath['f/a/gone'].status).toBe('deleted_in_fork')
+		// One-sided entries fetch only the existing side: 2 + 1 + 1 calls.
+		expect(getItemValue).toHaveBeenCalledTimes(4)
+	})
+
+	it('ages a reused comparison from its fetch time, not adoption time', async () => {
+		// Adopt a tally another surface fetched 25s ago (tolerant join).
+		mockComparison([comparisonDiff()], { fetchedAt: Date.now() - 25_000 })
+		vi.mocked(getItemValue).mockResolvedValue({ content: 'x' })
+		await getForkDiffIndex(FORK, PARENT)
+		expect(fetchWorkspaceComparisonMeta).toHaveBeenCalledTimes(1)
+		// 10s later the underlying tally is 35s old — past the reuse window.
+		// The snapshot must not have granted it a fresh window of its own.
+		vi.advanceTimersByTime(10_000)
+		await getForkDiffIndex(FORK, PARENT)
+		expect(fetchWorkspaceComparisonMeta).toHaveBeenCalledTimes(2)
+	})
+
+	it('drops the snapshot when the comparison store was invalidated without a drafts bump', async () => {
+		mockComparison([comparisonDiff()])
+		vi.mocked(getItemValue).mockResolvedValue({ content: 'x' })
+		await getForkDiffIndex(FORK, PARENT)
+		expect(fetchWorkspaceComparisonMeta).toHaveBeenCalledTimes(1)
+		// A deploy invalidated the comparison store but its draft cleanup
+		// failed, so no drafts-version bump ever reaches this cache.
+		vi.mocked(isComparisonCurrent).mockReturnValue(false)
+		await getForkDiffIndex(FORK, PARENT)
+		expect(fetchWorkspaceComparisonMeta).toHaveBeenCalledTimes(2)
+	})
+
+	it('reports a swallowed side fetch as an error, never as a fabricated diff', async () => {
+		mockComparison([comparisonDiff()])
+		// The shared reader returns {} for ANY failed fetch — with both sides
+		// "empty" a real diff would read as parity, one side as an addition.
+		vi.mocked(getItemValue).mockResolvedValue({})
+		const index = await getForkDiffIndex(FORK, PARENT)
+		expect(index.entries[0].status).toBe('error')
+		expect(index.entries[0].errorMessage).toContain('failed to read')
+	})
+
+	it('never joins a fork reconciliation started under a previous account', async () => {
+		usersWorkspaceStore.set({ email: 'fork-a@x.dev' } as any)
+		mockComparison([comparisonDiff({ path: 'f/a/fresh' })])
+		let resolveStale!: (v: unknown) => void
+		vi.mocked(fetchWorkspaceComparisonMeta).mockReturnValueOnce(
+			new Promise((res) => (resolveStale = res)) as any
+		)
+		vi.mocked(getItemValue).mockResolvedValue({ content: 'x' })
+		const staleRead = getForkDiffIndex(FORK, PARENT)
+		usersWorkspaceStore.set({ email: 'fork-b@x.dev' } as any)
+		const after = await getForkDiffIndex(FORK, PARENT)
+		expect(after.entries.map((e) => e.path)).toEqual(['f/a/fresh'])
+		resolveStale({
+			comparison: {
+				skipped_comparison: false,
+				diffs: [comparisonDiff({ path: 'f/a/stale' })],
+				summary: { total_diffs: 1 },
+				hidden_ahead: { total: 0 },
+				hidden_behind: { total: 0 }
+			},
+			fetchedAt: Date.now(),
+			generation: ++comparisonGen
+		})
+		// The old account's read resolves too — it must also get the fresh
+		// snapshot, never its own late (pre-switch) tally.
+		expect((await staleRead).entries.map((e) => e.path)).toEqual(['f/a/fresh'])
+		const reread = await getForkDiffIndex(FORK, PARENT)
+		expect(reread.entries.map((e) => e.path)).toEqual(['f/a/fresh'])
+	})
+
+	it('reuses patches while the item ahead/behind marker is unchanged, refetches when it moves', async () => {
+		mockComparison([comparisonDiff()])
+		vi.mocked(getItemValue).mockResolvedValue({ content: 'x' })
+		await getForkDiffIndex(FORK, PARENT)
+		expect(getItemValue).toHaveBeenCalledTimes(2)
+
+		// Past the comparison reuse window, same marker → comparison refetched
+		// but the patch is kept.
+		vi.advanceTimersByTime(31_000)
+		await getForkDiffIndex(FORK, PARENT)
+		expect(getItemValue).toHaveBeenCalledTimes(2)
+
+		// Marker moved → content refetched.
+		vi.advanceTimersByTime(31_000)
+		mockComparison([comparisonDiff({ ahead: 2 })])
+		await getForkDiffIndex(FORK, PARENT)
+		expect(getItemValue).toHaveBeenCalledTimes(4)
+	})
+
+	it('never decrypts variables and masks every value, secret or not', async () => {
+		mockComparison([comparisonDiff({ kind: 'variable', path: 'f/a/plain' })])
+		vi.mocked(VariableService.getVariable).mockImplementation(async ({ workspace }: any) => ({
+			path: 'f/a/plain',
+			is_secret: false,
+			value: `plaintext-${workspace}`,
+			description: workspace === FORK ? 'fork side' : 'parent side'
+		})) as any
+		const entry = await readForkDiffEntryOne(FORK, PARENT, ['variable'], 'f/a/plain')
+		expect(
+			vi.mocked(VariableService.getVariable).mock.calls.every(([a]: any) => !a.decryptSecret)
+		).toBe(true)
+		// NON-secret values are masked too — the chat never sees variable values.
+		expect(entry?.patch).not.toContain('plaintext-')
+		// Description change still shows; the value itself never differs here.
+		expect(entry?.patch).toContain('fork side')
+		expect(entry?.valueMasked).toBe(true)
+	})
+
+	it('sees flow schema-only changes the shared projection drops', async () => {
+		mockComparison([comparisonDiff({ kind: 'flow', path: 'f/a/fl' })])
+		vi.mocked(FlowService.getFlowByPath).mockImplementation(async ({ workspace }: any) => ({
+			summary: 'same',
+			description: 'same',
+			schema: { properties: workspace === FORK ? { a: {} } : { a: {}, b: {} } },
+			value: { modules: [{ id: 'x', value: { type: 'script', hash: `h-${workspace}` } }] }
+		})) as any
+		const entry = await readForkDiffEntryOne(FORK, PARENT, ['flow'], 'f/a/fl')
+		expect(entry?.status).toBe('modified')
+		expect(entry?.patch).toContain('schema')
+		// Inline-script hashes are per-workspace noise, never a diff line.
+		expect(entry?.patch).not.toContain('h-fork-ws')
+	})
+
+	it('sees script description-only changes the shared projection drops', async () => {
+		mockComparison([comparisonDiff({ kind: 'script', path: 'f/a/s' })])
+		vi.mocked(ScriptService.getScriptByPath).mockImplementation(async ({ workspace }: any) => ({
+			content: 'same code',
+			summary: 'same',
+			description: workspace === FORK ? 'fork docs' : 'parent docs',
+			language: 'bun'
+		})) as any
+		const entry = await readForkDiffEntryOne(FORK, PARENT, ['script'], 'f/a/s')
+		expect(entry?.status).toBe('modified')
+		expect(entry?.patch).toContain('-description: parent docs')
+	})
+
+	it('splits a raw app into per-file patches with cross-workspace noise stripped', async () => {
+		mockComparison([comparisonDiff({ kind: 'raw_app', path: 'f/dash/main' })])
+		vi.mocked(getItemValue).mockImplementation(async (_k, _path, ws) => ({
+			raw_app: true,
+			summary: 'Dash',
+			versions: ws === FORK ? [7] : [3],
+			workspace_id: ws,
+			value: {
+				files:
+					ws === FORK
+						? { 'src/App.tsx': 'new content\n', 'src/added.ts': 'brand new\n' }
+						: { 'src/App.tsx': 'old content\n', 'src/removed.ts': 'gone\n' },
+				runnables: {}
+			}
+		}))
+		const entry = await readForkDiffEntryOne(FORK, PARENT, ['app', 'raw_app'], 'f/dash/main')
+		expect(entry?.status).toBe('modified')
+		expect(entry?.files?.['src/App.tsx'].status).toBe('modified')
+		expect(entry?.files?.['src/App.tsx'].patch).toContain('-old content')
+		expect(entry?.files?.['src/added.ts'].status).toBe('added')
+		expect(entry?.files?.['src/removed.ts'].status).toBe('deleted')
+		// Version counters and workspace ids never appear as config changes.
+		expect(entry?.patch).not.toContain('versions')
+		expect(entry?.patch).not.toContain('workspace_id')
+		expect(entry?.patch).not.toContain('parent_version')
+	})
+
+	it('reads fork-only kinds by path alone; a wildcard returns every matching kind', async () => {
+		mockComparison([
+			comparisonDiff({ kind: 'folder', path: 'f/team' }),
+			comparisonDiff({ kind: 'resource_type', path: 'shared_name' }),
+			comparisonDiff({ kind: 'folder', path: 'shared_name' })
+		])
+		vi.mocked(getItemValue).mockImplementation(async (_k, path, ws) => ({
+			name: path,
+			summary: `${ws}`
+		}))
+		vi.mocked(ResourceService.getResourceType).mockImplementation(async ({ workspace }: any) => ({
+			schema: {},
+			description: `${workspace}`
+		})) as any
+		const folder = await readForkDiffEntryOne(FORK, PARENT, [], 'f/team')
+		expect(folder?.kind).toBe('folder')
+		expect(folder?.status).toBe('modified')
+
+		const both = await readForkDiffEntries(FORK, PARENT, [], 'shared_name')
+		expect(both.map((e) => e.kind).sort()).toEqual(['folder', 'resource_type'])
+		expect(both.every((e) => e.status === 'modified')).toBe(true)
+	})
+
+	it('flags entries that also carry a local draft', async () => {
+		mockComparison([comparisonDiff(), comparisonDiff({ path: 'f/a/other' })])
+		vi.mocked(getDraftItems).mockResolvedValue([
+			row({ kind: 'trigger_schedule', path: 'f/a/b' })
+		] as any)
+		vi.mocked(getItemValue).mockResolvedValue({ content: 'x' })
+		const index = await getForkDiffIndex(FORK, PARENT)
+		const byPath = Object.fromEntries(index.entries.map((e) => [e.path, e]))
+		expect(byPath['f/a/b'].hasLocalDraft).toBe(true)
+		expect(byPath['f/a/other'].hasLocalDraft).toBe(false)
+	})
+})
+
+describe('account switches', () => {
+	it("never serves one account's cached drafts to another", async () => {
+		usersWorkspaceStore.set({ email: 'first@x.dev' } as any)
+		vi.mocked(getDraftItems).mockResolvedValue([row()] as any)
+		mockDiffValues({ content: 'a' }, { content: 'b' })
+		await getWorkspaceDiffIndex(WS)
+		await getWorkspaceDiffIndex(WS)
+		// Same account: the throttled listing is reused.
+		expect(getDraftItems).toHaveBeenCalledTimes(1)
+		usersWorkspaceStore.set({ email: 'second@x.dev' } as any)
+		await getWorkspaceDiffIndex(WS)
+		expect(getDraftItems).toHaveBeenCalledTimes(2)
+	})
+})
diff --git a/frontend/src/lib/components/copilot/chat/global/diffSnapshot.ts b/frontend/src/lib/components/copilot/chat/global/diffSnapshot.ts
new file mode 100644
index 0000000000..f8a685af60
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/global/diffSnapshot.ts
@@ -0,0 +1,1141 @@
+/**
+ * Materialized draft-vs-deployed diff cache for the chat `diff` tool.
+ *
+ * The backend has no diff endpoint — it serves item sides, the frontend
+ * computes patches. This module fetches each changed item's sides once,
+ * computes the stable-YAML patch once, and answers every subsequent query
+ * (workspace index, item read, later: search) from memory.
+ *
+ * Freshness model, cheapest signal first:
+ * - `drafts/list` is refetched per access (throttled) — one indexed query that
+ *   yields the authoritative row set. The server bumps a draft row's
+ *   `created_at` on every update, so an unchanged (path, created_at) pair
+ *   proves the draft side of a cached patch is current.
+ * - `getWorkspaceDraftsVersion` bumps on every in-app deploy/discard/draft
+ *   write; a bump drops cached patches because the deployed side may have
+ *   changed without touching any draft row.
+ * - Deploys from OTHER clients are invisible to both signals, so index
+ *   accesses also refresh patches older than `INDEX_ENTRY_STALE_MS`.
+ */
+import { get } from 'svelte/store'
+import {
+	getDraftItems,
+	getWorkspaceDraftsVersion,
+	type DraftItem
+} from '$lib/workspaceDrafts.svelte'
+import {
+	FlowService,
+	ResourceService,
+	ScriptService,
+	VariableService,
+	type UserDraftItemKind,
+	type WorkspaceItemDiff
+} from '$lib/gen'
+import { getDraftDiffValues } from '$lib/utils_draft_deploy'
+import { UserDraftDbSyncer } from '$lib/userDraftDbSyncer.svelte'
+import { getItemValue } from '$lib/utils_workspace_deploy'
+import type { Kind as DeployKind } from '$lib/utils_deployable'
+import { userWorkspaces, usersWorkspaceStore } from '$lib/stores'
+import { fetchWorkspaceComparisonMeta, isComparisonCurrent } from '$lib/workspaceComparison'
+import { appSourceToDraftValue } from '$lib/components/raw_apps/rawAppDraftValue'
+import { textFilePatch, yamlValuePatch } from './draftDiff'
+import { itemTypeForKind } from './userDraftAdapter'
+import { TRIGGER_KINDS, type TriggerKind, type WorkspaceItemType } from './workspaceItems'
+
+const LIST_REUSE_MS = 5_000
+const INDEX_ENTRY_STALE_MS = 60_000
+const READ_ENTRY_REUSE_MS = 15_000
+/** Max patches computed per index access, so a workspace with hundreds of
+ * drafts still answers its first index quickly; the rest report `pending`
+ * and materialize on item read. */
+const EAGER_MATERIALIZE_CAP = 50
+const FETCH_CONCURRENCY = 6
+
+export type WorkspaceDiffStatus =
+	| 'new'
+	| 'modified'
+	| 'unchanged'
+	| 'pending'
+	| 'error'
+	| 'not_diffable'
+
+/** One changed file inside a multi-file (raw) app. */
+export interface DiffFileView {
+	status: 'added' | 'deleted' | 'modified'
+	patch: string
+	lineCount: number
+}
+
+export interface WorkspaceDiffEntryView {
+	kind: UserDraftItemKind
+	/** Chat-facing addressing; undefined when the chat cannot address the kind. */
+	type?: WorkspaceItemType
+	triggerKind?: TriggerKind
+	/** Friendly path the model should use (draft_path when present). */
+	path: string
+	storagePath: string
+	summary?: string
+	status: WorkspaceDiffStatus
+	/** Unified patch; present once materialized ('' when unchanged). For a
+	 * multi-file app this is the config-only patch — file contents live in
+	 * `files`. */
+	patch?: string
+	patchLineCount?: number
+	/** Per-file patches for multi-file apps (changed files only). */
+	files?: Record<string, DiffFileView>
+	/** Variable content was placeholder-masked (values never reach the chat);
+	 * the patch marks a value change without revealing it. */
+	valueMasked?: boolean
+	/** Secret variable: neither side's real value is readable, so "no visible
+	 * changes" cannot prove the value is unchanged. */
+	valueUncomparable?: boolean
+	/** True when the item has never been deployed — the whole draft is new. */
+	noDeployed?: boolean
+	errorMessage?: string
+}
+
+export interface WorkspaceDiffIndexView {
+	entries: WorkspaceDiffEntryView[]
+	otherUsersDraftCount: number
+}
+
+interface Materialized {
+	status: 'new' | 'modified' | 'unchanged' | 'error'
+	patch: string
+	lineCount: number
+	files?: Record<string, DiffFileView>
+	valueMasked?: boolean
+	valueUncomparable?: boolean
+	noDeployed: boolean
+	errorMessage?: string
+	fetchedAt: number
+}
+
+/** `files` maps of string contents mark a multi-file app value; anything else
+ * (classic apps, other kinds) diffs as one document. */
+function extractAppFiles(value: unknown): Record<string, string> | undefined {
+	const files = (value as { files?: unknown } | null | undefined)?.files
+	if (files == null || typeof files !== 'object' || Array.isArray(files)) return undefined
+	const entries = Object.entries(files as Record<string, unknown>)
+	if (entries.length === 0 || !entries.every(([, v]) => typeof v === 'string')) return undefined
+	return files as Record<string, string>
+}
+
+interface AppSplit {
+	files: Record<string, DiffFileView>
+	configPatch: string
+	totalLines: number
+	hasChanges: boolean
+}
+
+/** Split a multi-file app diff into per-file text patches plus a config-only
+ * YAML patch, so code diffs read file-by-file and file addressing works.
+ * Returns undefined when neither side carries a file map. */
+function computeAppSplit(
+	before: unknown,
+	after: unknown,
+	beforeLabel: string,
+	afterLabel: string
+): AppSplit | undefined {
+	const beforeFiles = extractAppFiles(before)
+	const afterFiles = extractAppFiles(after)
+	if (!beforeFiles && !afterFiles) return undefined
+	const files: Record<string, DiffFileView> = {}
+	let totalLines = 0
+	const names = [
+		...new Set([...Object.keys(beforeFiles ?? {}), ...Object.keys(afterFiles ?? {})])
+	].sort()
+	for (const name of names) {
+		const beforeContent = beforeFiles?.[name]
+		const afterContent = afterFiles?.[name]
+		const patch = textFilePatch(beforeContent, afterContent, beforeLabel, afterLabel)
+		// An EMPTY file appearing or disappearing yields no text patch, but file
+		// presence is a change in its own right (imports/bundling see it).
+		const presenceChanged = (beforeContent === undefined) !== (afterContent === undefined)
+		if (!patch && !presenceChanged) continue
+		const lineCount = patch === '' ? 0 : patch.split('\n').length
+		totalLines += lineCount
+		files[name] = {
+			status:
+				beforeContent === undefined ? 'added' : afterContent === undefined ? 'deleted' : 'modified',
+			patch,
+			lineCount
+		}
+	}
+	const withoutFiles = (value: unknown) => {
+		if (value == null || typeof value !== 'object') return value
+		const { files: _files, ...rest } = value as Record<string, unknown>
+		return rest
+	}
+	const configPatch = yamlValuePatch(
+		withoutFiles(before),
+		withoutFiles(after),
+		beforeLabel,
+		afterLabel
+	)
+	totalLines += configPatch === '' ? 0 : configPatch.split('\n').length
+	return {
+		files,
+		configPatch,
+		totalLines,
+		hasChanges: Object.keys(files).length > 0 || configPatch !== ''
+	}
+}
+
+export interface DiffParts {
+	/** Whole-value patch, or the config-only patch for a multi-file app. */
+	patch: string
+	files?: Record<string, DiffFileView>
+	lineCount: number
+	hasChanges: boolean
+}
+
+/** Patch parts for a before/after value pair: per-file text patches for
+ * multi-file apps, one whole-value YAML patch otherwise. */
+export function computeDiffParts(
+	before: unknown,
+	after: unknown,
+	beforeLabel: string,
+	afterLabel: string
+): DiffParts {
+	const split = computeAppSplit(before, after, beforeLabel, afterLabel)
+	if (split) {
+		return {
+			patch: split.configPatch,
+			files: split.files,
+			lineCount: split.totalLines,
+			hasChanges: split.hasChanges
+		}
+	}
+	const patch = yamlValuePatch(before, after, beforeLabel, afterLabel)
+	return {
+		patch,
+		lineCount: patch === '' ? 0 : patch.split('\n').length,
+		hasChanges: patch !== ''
+	}
+}
+
+interface CacheEntry {
+	row: DraftItem
+	type?: WorkspaceItemType
+	triggerKind?: TriggerKind
+	displayPath: string
+	materialized?: Materialized
+	materializing?: Promise<void>
+	/** Bumped by stale-marking; a materialization started before the bump
+	 * must not store its (pre-save) result. */
+	staleGeneration?: number
+}
+
+interface WorkspaceCache {
+	version: number
+	epoch: number
+	listFetchedAt: number
+	entries: Map<string, CacheEntry>
+	otherUsersDraftCount: number
+}
+
+const caches = new Map<string, WorkspaceCache>()
+const reconciling = new Map<string, Promise<WorkspaceCache>>()
+// Bumped on every invalidation. Producers capture it at start and refuse to
+// store results whose inputs predate a mutation — ONE fence for every async
+// producer instead of bespoke per-surface races.
+const mutationEpochs = new Map<string, number>()
+
+function mutationEpoch(workspace: string): number {
+	return mutationEpochs.get(workspace) ?? 0
+}
+
+function bumpMutationEpoch(workspace: string): void {
+	mutationEpochs.set(workspace, mutationEpoch(workspace) + 1)
+}
+
+// Caches hold per-user drafts and permission-filtered fork patches but are
+// keyed only by workspace — an SPA logout/login must never serve one
+// account's content to another. The epoch bumps fence in-flight producers
+// started under the previous identity.
+let cacheOwner: string | undefined = undefined
+
+function ensureCacheOwner(): void {
+	const owner = get(usersWorkspaceStore)?.email
+	if (owner === cacheOwner) return
+	cacheOwner = owner
+	for (const ws of new Set([
+		...caches.keys(),
+		...forkCaches.keys(),
+		...reconciling.keys(),
+		...forkReconciling.keys()
+	])) {
+		bumpMutationEpoch(ws)
+	}
+	caches.clear()
+	forkCaches.clear()
+	reconciling.clear()
+	forkReconciling.clear()
+}
+
+function entryKey(kind: UserDraftItemKind, storagePath: string): string {
+	return `${kind}:${storagePath}`
+}
+
+/** Expire the throttled drafts listing for a workspace so the next access
+ * refetches it. Called after a flush persists edits: a flush bumps neither the
+ * drafts version nor a row's cached `created_at`, so within `LIST_REUSE_MS`
+ * the diff would otherwise be computed from the pre-flush listing. Cached
+ * patches survive — reconciliation drops exactly the rows whose `created_at`
+ * moved. */
+export function expireWorkspaceDiffList(workspace: string): void {
+	const cache = caches.get(workspace)
+	if (cache) cache.listFetchedAt = 0
+	bumpMutationEpoch(workspace)
+}
+
+/** Mark one item's cached patch stale and expire the listing throttle, so the
+ * next access refetches both — regardless of the reuse windows. Driven by the
+ * syncer's save hook: the moment a draft write lands (an editor autosave, a
+ * chat write, a delete), the pre-write patch must never be served again. */
+export function markWorkspaceDiffEntryStale(
+	workspace: string,
+	itemKind: UserDraftItemKind,
+	path: string
+): void {
+	bumpMutationEpoch(workspace)
+	const cache = caches.get(workspace)
+	if (cache) {
+		cache.listFetchedAt = 0
+		const entry = cache.entries.get(entryKey(itemKind, path))
+		if (entry) {
+			entry.materialized = undefined
+			entry.staleGeneration = (entry.staleGeneration ?? 0) + 1
+		}
+	}
+	// Fork entries embed a hasLocalDraft flag joined from the draft rows —
+	// refresh the join on the next fork access (patches survive via markers).
+	const fork = forkCaches.get(workspace)
+	if (fork) fork.fetchedAt = 0
+}
+
+// One app-lifetime subscription: every persisted draft write invalidates its
+// item eagerly instead of waiting out the listing throttle / read-reuse
+// windows. Fork caches are untouched — they compare deployed sides only.
+UserDraftDbSyncer.onAnySaved(({ workspace, itemKind, path }) => {
+	markWorkspaceDiffEntryStale(workspace, itemKind, path)
+})
+
+export function invalidateWorkspaceDiffCache(workspace?: string): void {
+	if (workspace === undefined) {
+		caches.clear()
+		reconciling.clear()
+		forkCaches.clear()
+		forkReconciling.clear()
+	} else {
+		caches.delete(workspace)
+		reconciling.delete(workspace)
+		forkCaches.delete(workspace)
+		forkReconciling.delete(workspace)
+	}
+}
+
+async function mapPool<T>(
+	items: T[],
+	limit: number,
+	fn: (item: T) => Promise<void>
+): Promise<void> {
+	const queue = [...items]
+	const workers = Array.from({ length: Math.min(limit, queue.length) }, async () => {
+		for (let item = queue.shift(); item !== undefined; item = queue.shift()) {
+			await fn(item)
+		}
+	})
+	await Promise.all(workers)
+}
+
+/** Refetch the workspace draft rows and rebuild the entry map, carrying over
+ * each cached patch whose draft row is provably unchanged. */
+async function reconcile(workspace: string): Promise<WorkspaceCache> {
+	ensureCacheOwner()
+	// Retry loop: a joiner re-validates after awaiting, and a producer refuses
+	// to store results whose inputs predate a mutation (epoch moved mid-fetch).
+	// Bounded: each retry needs another concurrent mutation, and the final
+	// attempt's result is served regardless so a save storm cannot livelock us.
+	for (let attempt = 0; ; attempt++) {
+		const prev = caches.get(workspace)
+		const version = getWorkspaceDraftsVersion(workspace)
+		const epoch = mutationEpoch(workspace)
+		if (
+			prev &&
+			prev.version === version &&
+			prev.epoch === epoch &&
+			Date.now() - prev.listFetchedAt < LIST_REUSE_MS
+		) {
+			return prev
+		}
+		const inflight = reconciling.get(workspace)
+		if (inflight) {
+			const joined = await inflight
+			if (joined.epoch === mutationEpoch(workspace) || attempt >= 4) return joined
+			continue
+		}
+		const run = (async () => {
+			const rows = await getDraftItems(workspace, true)
+			const mine = rows.filter((r) => r.mine)
+			const entries = new Map<string, CacheEntry>()
+			for (const row of mine) {
+				const key = entryKey(row.kind, row.path)
+				const old = prev?.entries.get(key)
+				const reusable =
+					old && prev!.version === version && old.row.created_at === row.created_at
+						? old.materialized
+						: undefined
+				const addressing = itemTypeForKind(row.kind)
+				entries.set(key, {
+					row,
+					type: addressing?.type,
+					triggerKind: addressing?.triggerKind,
+					displayPath: row.draft_path || row.path,
+					materialized: reusable
+				})
+			}
+			return {
+				version,
+				epoch,
+				listFetchedAt: Date.now(),
+				entries,
+				otherUsersDraftCount: rows.length - mine.length
+			} satisfies WorkspaceCache
+		})()
+		reconciling.set(workspace, run)
+		let cache: WorkspaceCache
+		try {
+			cache = await run
+		} finally {
+			if (reconciling.get(workspace) === run) reconciling.delete(workspace)
+		}
+		if (mutationEpoch(workspace) === epoch || attempt >= 4) {
+			caches.set(workspace, cache)
+			return cache
+		}
+		// Inputs predate a mutation that landed mid-fetch: refetch.
+	}
+}
+
+const VARIABLE_VALUE_PLACEHOLDER = '<variable value — never shown in chat>'
+const VARIABLE_VALUE_CHANGED_PLACEHOLDER = '<variable value — never shown in chat (changed)>'
+
+/** Chat-side redaction: variable VALUES never reach a tool result — the same
+ * invariant read_workspace_item enforces, and not limited to secrets. The
+ * placeholder pair still shows WHETHER the value changed, never its content. */
+export function maskVariableDiffSides(
+	before: unknown,
+	after: unknown
+): { before: unknown; after: unknown; valueUncomparable: boolean } {
+	const beforeObj =
+		before !== null && typeof before === 'object' ? (before as Record<string, unknown>) : undefined
+	const afterObj =
+		after !== null && typeof after === 'object' ? (after as Record<string, unknown>) : undefined
+	// A secret's sides are already masked upstream (draft rows store '' and the
+	// deployed value is never decrypted), so equality between them proves
+	// nothing — the value may have changed invisibly. Only non-secret sides
+	// carry real content worth comparing.
+	const secret = beforeObj?.is_secret === true || afterObj?.is_secret === true
+	const valueUncomparable = secret && beforeObj !== undefined && afterObj !== undefined
+	const valueChanged =
+		!secret &&
+		beforeObj !== undefined &&
+		afterObj !== undefined &&
+		JSON.stringify(beforeObj.value) !== JSON.stringify(afterObj.value)
+	return {
+		before: beforeObj ? { ...beforeObj, value: VARIABLE_VALUE_PLACEHOLDER } : before,
+		after: afterObj
+			? {
+					...afterObj,
+					value: valueChanged ? VARIABLE_VALUE_CHANGED_PLACEHOLDER : VARIABLE_VALUE_PLACEHOLDER
+				}
+			: after,
+		valueUncomparable
+	}
+}
+
+/** Fetch one entry's sides and compute its patch, deduping concurrent calls.
+ * Reuses the cached patch when younger than `maxAgeMs`. */
+async function materialize(workspace: string, entry: CacheEntry, maxAgeMs: number): Promise<void> {
+	if (entry.materialized && Date.now() - entry.materialized.fetchedAt < maxAgeMs) return
+	if (entry.materializing) {
+		// If a save landed mid-flight, the awaited run discarded its result —
+		// fall through and fetch fresh instead of serving nothing.
+		await entry.materializing
+		if (entry.materialized && Date.now() - entry.materialized.fetchedAt < maxAgeMs) return
+	}
+	const generationAtStart = entry.staleGeneration ?? 0
+	const run = (async () => {
+		try {
+			const { deployed, draft, noDeployed } = await getDraftDiffValues(
+				entry.row.kind,
+				entry.row.path,
+				workspace
+			)
+			let before = noDeployed ? undefined : deployed
+			let after: unknown = draft
+			const valueMasked = entry.row.kind === 'variable'
+			let valueUncomparable = false
+			if (valueMasked) {
+				;({ before, after, valueUncomparable } = maskVariableDiffSides(before, after))
+			}
+			const parts = computeDiffParts(before, after, 'deployed', 'draft')
+			// A save that landed mid-fetch invalidated this run's inputs.
+			if ((entry.staleGeneration ?? 0) !== generationAtStart) return
+			entry.materialized = {
+				status: noDeployed ? 'new' : parts.hasChanges ? 'modified' : 'unchanged',
+				patch: parts.patch,
+				lineCount: parts.lineCount,
+				files: parts.files,
+				valueMasked,
+				valueUncomparable,
+				noDeployed,
+				fetchedAt: Date.now()
+			}
+		} catch (e) {
+			if ((entry.staleGeneration ?? 0) !== generationAtStart) return
+			entry.materialized = {
+				status: 'error',
+				patch: '',
+				lineCount: 0,
+				noDeployed: false,
+				errorMessage:
+					(e as { status?: number } | null | undefined)?.status === 404
+						? 'item not found (the draft may reference a deleted item)'
+						: ((e as Error | null | undefined)?.message ?? 'failed to compute diff'),
+				fetchedAt: Date.now()
+			}
+		}
+	})()
+	entry.materializing = run
+	try {
+		await run
+	} finally {
+		entry.materializing = undefined
+	}
+}
+
+function toView(entry: CacheEntry): WorkspaceDiffEntryView {
+	const m = entry.materialized
+	return {
+		kind: entry.row.kind,
+		type: entry.type,
+		triggerKind: entry.triggerKind,
+		path: entry.displayPath,
+		storagePath: entry.row.path,
+		summary: entry.row.summary,
+		status: m ? m.status : entry.type === undefined ? 'not_diffable' : 'pending',
+		patch: m?.patch,
+		patchLineCount: m?.lineCount,
+		files: m?.files,
+		valueMasked: m?.valueMasked,
+		valueUncomparable: m?.valueUncomparable,
+		noDeployed: m?.noDeployed,
+		errorMessage: m?.errorMessage
+	}
+}
+
+/** Workspace index: every draft of the current user with its change status,
+ * materializing missing/stale patches up to the eager cap (`materializeAll`
+ * lifts the cap — search needs every patch). */
+export async function getWorkspaceDiffIndex(
+	workspace: string,
+	opts: { materializeAll?: boolean } = {}
+): Promise<WorkspaceDiffIndexView> {
+	const cache = await reconcile(workspace)
+	const addressable = [...cache.entries.values()].filter((e) => e.type !== undefined)
+	let toMaterialize = addressable.filter(
+		(e) => !e.materialized || Date.now() - e.materialized.fetchedAt >= INDEX_ENTRY_STALE_MS
+	)
+	if (!opts.materializeAll) {
+		toMaterialize = toMaterialize.slice(0, EAGER_MATERIALIZE_CAP)
+	}
+	await mapPool(toMaterialize, FETCH_CONCURRENCY, (e) =>
+		materialize(workspace, e, INDEX_ENTRY_STALE_MS)
+	)
+	return {
+		entries: [...cache.entries.values()].map(toView),
+		otherUsersDraftCount: cache.otherUsersDraftCount
+	}
+}
+
+/** Resolve a requested path to the draft row that owns it — by exact key or
+ * friendly draft_path — across the given kinds. Item mode flushes/probes the
+ * RESOLVED key: a renamed classic app's cell lives at its original storage
+ * path, which only the listing knows. */
+export async function resolveWorkspaceDiffTarget(
+	workspace: string,
+	kinds: UserDraftItemKind[],
+	path: string
+): Promise<{ kind: UserDraftItemKind; storagePath: string } | undefined> {
+	const cache = await reconcile(workspace)
+	for (const kind of kinds) {
+		if (cache.entries.has(entryKey(kind, path))) return { kind, storagePath: path }
+	}
+	const entry = [...cache.entries.values()].find(
+		(e) => kinds.includes(e.row.kind) && (e.displayPath === path || e.row.path === path)
+	)
+	return entry ? { kind: entry.row.kind, storagePath: entry.row.path } : undefined
+}
+
+/** One item's diff entry, addressed by storage path or friendly draft path.
+ * Returns undefined when the current user has no draft there. */
+export async function readWorkspaceDiffEntry(
+	workspace: string,
+	itemKind: UserDraftItemKind,
+	path: string
+): Promise<WorkspaceDiffEntryView | undefined> {
+	const cache = await reconcile(workspace)
+	let entry = cache.entries.get(entryKey(itemKind, path))
+	if (!entry) {
+		// Friendly-path addressing (draft-only items park at u/{user}/draft_{uuid})
+		// and the classic-app/raw-app kind pair, which share the chat type 'app'.
+		const kinds: UserDraftItemKind[] =
+			itemKind === 'raw_app' || itemKind === 'app' ? ['raw_app', 'app'] : [itemKind]
+		entry = [...cache.entries.values()].find(
+			(e) => kinds.includes(e.row.kind) && (e.displayPath === path || e.row.path === path)
+		)
+	}
+	if (!entry) return undefined
+	await materialize(workspace, entry, READ_ENTRY_REUSE_MS)
+	return toView(entry)
+}
+
+// ---------------------------------------------------------------------------
+// Fork mode: deployed fork vs deployed parent, mirroring the compare page.
+// The index comes from the shared `compareWorkspaces` fetch (same tally the
+// fork banner shows); per-item content is fetched with the same
+// `getItemValue` canonicalization the compare page's diff drawer uses, so the
+// patches match what merge-to-parent would actually ship. Local drafts are
+// NOT part of the comparison — they are only flagged on the entries.
+// ---------------------------------------------------------------------------
+
+/** How long a fetched comparison keeps serving fork index/read calls before a
+ * fresh tally is requested. In-app deploys bump the drafts version and force a
+ * refetch regardless. */
+const FORK_COMPARISON_REUSE_MS = 30_000
+
+export type ForkDiffStatus =
+	| 'modified'
+	| 'only_in_fork'
+	| 'deleted_in_fork'
+	| 'unchanged'
+	| 'pending'
+	| 'error'
+
+export interface ForkDiffEntryView {
+	/** Comparison kind (per-kind trigger names, plus folder / resource_type). */
+	kind: string
+	/** Chat-facing addressing; undefined when the chat cannot read the kind. */
+	type?: WorkspaceItemType
+	triggerKind?: TriggerKind
+	path: string
+	ahead: number
+	behind: number
+	/** The current user also has a local draft on this item — not part of the
+	 * deployed-vs-deployed comparison. */
+	hasLocalDraft: boolean
+	status: ForkDiffStatus
+	patch?: string
+	patchLineCount?: number
+	/** Per-file patches for multi-file apps (changed files only). */
+	files?: Record<string, DiffFileView>
+	/** A secret's content was placeholder-masked — content-only changes on
+	 * this item cannot appear in the patch. */
+	valueMasked?: boolean
+	errorMessage?: string
+}
+
+export interface ForkDiffIndexView {
+	parentWorkspaceId: string
+	skippedComparison: boolean
+	entries: ForkDiffEntryView[]
+	hiddenAheadCount: number
+	hiddenBehindCount: number
+}
+
+interface ForkMaterialized {
+	status: 'modified' | 'only_in_fork' | 'deleted_in_fork' | 'unchanged' | 'error'
+	patch: string
+	lineCount: number
+	files?: Record<string, DiffFileView>
+	valueMasked?: boolean
+	errorMessage?: string
+	fetchedAt: number
+}
+
+interface ForkEntry {
+	kind: string
+	path: string
+	ahead: number
+	behind: number
+	existsInParent: boolean
+	existsInFork: boolean
+	type?: WorkspaceItemType
+	triggerKind?: TriggerKind
+	hasLocalDraft: boolean
+	materialized?: ForkMaterialized
+	materializing?: Promise<void>
+}
+
+interface ForkCache {
+	parentWorkspaceId: string
+	draftsVersion: number
+	parentDraftsVersion: number
+	/** Mutation epoch the producer started under — joiners and the reuse gate
+	 * compare it against the current epoch, so a bump that landed before they
+	 * arrived (not just mid-await) is still detected. */
+	epoch: number
+	/** When the underlying comparison request STARTED (from its meta), not
+	 * when this snapshot adopted it — aging from adoption time would let a
+	 * near-expiry comparison live a whole extra reuse window here. */
+	fetchedAt: number
+	/** Comparison-store generation; reuse stops the moment
+	 * `invalidateWorkspaceComparison` fences it (e.g. a deploy whose draft
+	 * cleanup failed and thus never bumped the drafts version). */
+	comparisonGeneration: number
+	skippedComparison: boolean
+	entries: Map<string, ForkEntry>
+	hiddenAheadCount: number
+	hiddenBehindCount: number
+}
+
+const forkCaches = new Map<string, ForkCache>()
+const forkReconciling = new Map<string, Promise<ForkCache>>()
+
+/** Parent workspace id when `workspace` is a fork/dev workspace, else undefined. */
+export function getForkParentWorkspaceId(workspace: string): string | undefined {
+	return get(userWorkspaces).find((w) => w.id === workspace)?.parent_workspace_id ?? undefined
+}
+
+const CHAT_TRIGGER_KINDS = new Set<string>(TRIGGER_KINDS)
+
+function forkKindAddressing(
+	kind: string
+): { type: WorkspaceItemType; triggerKind?: TriggerKind } | undefined {
+	switch (kind) {
+		case 'script':
+		case 'flow':
+		case 'resource':
+		case 'variable':
+		case 'schedule':
+			return { type: kind as WorkspaceItemType }
+		case 'app':
+		case 'raw_app':
+			return { type: 'app' }
+		default: {
+			const triggerKind = kind.endsWith('_trigger') ? kind.slice(0, -'_trigger'.length) : undefined
+			return triggerKind && CHAT_TRIGGER_KINDS.has(triggerKind)
+				? { type: 'trigger', triggerKind: triggerKind as TriggerKind }
+				: undefined
+		}
+	}
+}
+
+/** Draft kind holding local drafts for a comparison kind (for the flag join). */
+function draftKindForForkKind(kind: string): UserDraftItemKind | undefined {
+	if (kind === 'schedule') return 'trigger_schedule'
+	if (kind.endsWith('_trigger')) {
+		const t = kind.slice(0, -'_trigger'.length)
+		return `trigger_${t}` as UserDraftItemKind
+	}
+	if (kind === 'resource_type' || kind === 'folder') return undefined
+	return kind as UserDraftItemKind
+}
+
+async function reconcileFork(workspace: string, parentWorkspaceId: string): Promise<ForkCache> {
+	ensureCacheOwner()
+	// Same epoch/version fencing as `reconcile`: joiners re-validate after
+	// awaiting, producers refuse to store pre-mutation inputs (bounded retries).
+	for (let attempt = 0; ; attempt++) {
+		const prev = forkCaches.get(workspace)
+		const version = getWorkspaceDraftsVersion(workspace)
+		const parentVersion = getWorkspaceDraftsVersion(parentWorkspaceId)
+		const epoch = mutationEpoch(workspace)
+		const isCurrent = (c: ForkCache) =>
+			c.parentWorkspaceId === parentWorkspaceId &&
+			c.draftsVersion === getWorkspaceDraftsVersion(workspace) &&
+			c.parentDraftsVersion === getWorkspaceDraftsVersion(parentWorkspaceId)
+		if (
+			prev &&
+			isCurrent(prev) &&
+			prev.epoch === epoch &&
+			prev.draftsVersion === version &&
+			Date.now() - prev.fetchedAt < FORK_COMPARISON_REUSE_MS &&
+			isComparisonCurrent(parentWorkspaceId, workspace, prev.comparisonGeneration)
+		) {
+			return prev
+		}
+		const inflight = forkReconciling.get(workspace)
+		if (inflight) {
+			const joined = await inflight
+			if ((isCurrent(joined) && joined.epoch === mutationEpoch(workspace)) || attempt >= 4) {
+				return joined
+			}
+			continue
+		}
+		const run = (async () => {
+			// A drafts-version bump means something deployed in-app: demand a fresh
+			// tally. Otherwise piggyback on a recent fetch (e.g. the fork banner's).
+			const comparisonMaxAge =
+				prev && (prev.draftsVersion !== version || prev.parentDraftsVersion !== parentVersion)
+					? 0
+					: FORK_COMPARISON_REUSE_MS
+			const [comparisonMeta, draftsCache] = await Promise.all([
+				fetchWorkspaceComparisonMeta(parentWorkspaceId, workspace, { maxAgeMs: comparisonMaxAge }),
+				reconcile(workspace)
+			])
+			const comparison = comparisonMeta.comparison
+			const localDraftKeys = new Set(
+				[...draftsCache.entries.values()].map((e) => entryKey(e.row.kind, e.row.path))
+			)
+			const entries = new Map<string, ForkEntry>()
+			for (const diff of comparison.diffs as WorkspaceItemDiff[]) {
+				const key = `${diff.kind}:${diff.path}`
+				const old = prev?.entries.get(key)
+				const reusable =
+					old &&
+					prev!.draftsVersion === version &&
+					old.ahead === diff.ahead &&
+					old.behind === diff.behind &&
+					old.existsInParent === diff.exists_in_source &&
+					old.existsInFork === diff.exists_in_fork
+						? old.materialized
+						: undefined
+				const addressing = forkKindAddressing(diff.kind)
+				const draftKind = draftKindForForkKind(diff.kind)
+				entries.set(key, {
+					kind: diff.kind,
+					path: diff.path,
+					ahead: diff.ahead,
+					behind: diff.behind,
+					existsInParent: diff.exists_in_source,
+					existsInFork: diff.exists_in_fork,
+					type: addressing?.type,
+					triggerKind: addressing?.triggerKind,
+					hasLocalDraft: draftKind ? localDraftKeys.has(entryKey(draftKind, diff.path)) : false,
+					materialized: reusable
+				})
+			}
+			const cache: ForkCache = {
+				parentWorkspaceId,
+				draftsVersion: version,
+				parentDraftsVersion: parentVersion,
+				epoch,
+				fetchedAt: comparisonMeta.fetchedAt,
+				comparisonGeneration: comparisonMeta.generation,
+				skippedComparison: comparison.skipped_comparison,
+				entries,
+				hiddenAheadCount: comparison.hidden_ahead?.total ?? 0,
+				hiddenBehindCount: comparison.hidden_behind?.total ?? 0
+			}
+			return cache
+		})()
+		forkReconciling.set(workspace, run)
+		let cache: ForkCache
+		try {
+			cache = await run
+		} finally {
+			if (forkReconciling.get(workspace) === run) forkReconciling.delete(workspace)
+		}
+		if ((isCurrent(cache) && mutationEpoch(workspace) === epoch) || attempt >= 4) {
+			forkCaches.set(workspace, cache)
+			return cache
+		}
+		// A deploy/save landed mid-fetch: this tally's inputs are pre-mutation.
+	}
+}
+
+// App-row fields that differ between workspaces without being part of what a
+// merge deploys (ids, version history, audit fields) — plus bundle_secret,
+// which must never reach a tool result.
+const APP_ROW_CROSS_WORKSPACE_IGNORE = new Set([
+	'id',
+	'workspace_id',
+	'versions',
+	'created_by',
+	'created_at',
+	'extra_perms',
+	'bundle_secret'
+])
+
+/** Inline flow scripts pin a `hash` the server recomputes per workspace —
+ * never comparable across workspaces. Generic deep walk so nested module
+ * shapes (loops, branches) need no taxonomy here. */
+function stripInlineFlowHashes(node: unknown): void {
+	if (Array.isArray(node)) {
+		for (const item of node) stripInlineFlowHashes(item)
+		return
+	}
+	if (node === null || typeof node !== 'object') return
+	const obj = node as Record<string, any>
+	if (obj.value?.type === 'script' && obj.value.hash != undefined) {
+		obj.value.hash = undefined
+	}
+	for (const child of Object.values(obj)) stripInlineFlowHashes(child)
+}
+
+interface ForkSideValue {
+	value: unknown
+	/** The variable's content was replaced by the placeholder — content-only
+	 * changes on this item are invisible in the patch. */
+	valueMasked: boolean
+}
+
+async function fetchForkSideValue(
+	kind: string,
+	path: string,
+	workspace: string
+): Promise<ForkSideValue> {
+	// Variable VALUES never reach a tool result — the chat-wide invariant, not
+	// just for secrets (and secrets are additionally never decrypted). The
+	// placeholder is identical on both sides, so a value-only change is
+	// invisible here; the `valueMasked` flag lets callers say so instead of
+	// claiming "unchanged".
+	if (kind === 'variable') {
+		const variable = await VariableService.getVariable({
+			workspace,
+			path,
+			decryptSecret: false
+		})
+		return {
+			value: {
+				description: variable.description,
+				is_secret: variable.is_secret,
+				value: VARIABLE_VALUE_PLACEHOLDER
+			},
+			valueMasked: true
+		}
+	}
+	// The shared getItemValue projection drops fields the backend comparison
+	// DOES consider (script/resource description, resource_type) — a diff of
+	// those fields alone would then falsely read "content matches parent".
+	// Project those kinds directly with the metadata included.
+	if (kind === 'script') {
+		const script = await ScriptService.getScriptByPath({ workspace, path })
+		return {
+			value: {
+				content: script.content,
+				lock: script.lock,
+				schema: script.schema,
+				summary: script.summary,
+				description: script.description,
+				language: script.language
+			},
+			valueMasked: false
+		}
+	}
+	if (kind === 'resource') {
+		const resource = await ResourceService.getResource({ workspace, path })
+		return {
+			value: {
+				value: resource.value,
+				description: resource.description,
+				resource_type: resource.resource_type
+			},
+			valueMasked: false
+		}
+	}
+	if (kind === 'flow') {
+		// The shared projection drops `schema`, which the backend comparison
+		// counts — a schema-only change would falsely read "matches parent".
+		const flow = await FlowService.getFlowByPath({ workspace, path })
+		const value = structuredClone(flow.value)
+		stripInlineFlowHashes(value)
+		return {
+			value: {
+				summary: flow.summary,
+				description: flow.description,
+				schema: flow.schema,
+				value
+			},
+			valueMasked: false
+		}
+	}
+	if (kind === 'resource_type') {
+		const rt = await ResourceService.getResourceType({ workspace, path })
+		return {
+			value: {
+				schema: rt.schema,
+				description: rt.description,
+				format_extension: rt.format_extension,
+				is_fileset: rt.is_fileset
+			},
+			valueMasked: false
+		}
+	}
+	const value = await getItemValue(kind as DeployKind, path, workspace)
+	// getItemValue reads `{}` for ANY failed fetch ("item may not exist") — but
+	// a fork side is only fetched when the comparison lists it as existing, so
+	// an empty read is a transient failure. Erroring (surfaced as a fetch-error
+	// entry) beats fabricating a one-sided or matching diff out of it.
+	if (value == null || (typeof value === 'object' && Object.keys(value).length === 0)) {
+		throw new Error(`failed to read ${kind} ${path} in ${workspace}`)
+	}
+	if ((kind === 'app' || kind === 'raw_app') && value !== null && typeof value === 'object') {
+		const row = value as Record<string, unknown>
+		// Raw apps: project onto the flat files/runnables draft shape so per-file
+		// splitting works and the sides match the draft-mode canonicalization.
+		// parent_version is a per-workspace version counter — never comparable
+		// across workspaces. Inline-script locks are server-recomputed noise.
+		if (kind === 'raw_app' || row.raw_app === true) {
+			const canonical = appSourceToDraftValue(row) as Record<string, unknown>
+			delete canonical.parent_version
+			const runnables = canonical.runnables as Record<string, any> | undefined
+			if (runnables) {
+				for (const k of Object.keys(runnables)) {
+					if (runnables[k]?.inlineScript?.lock != undefined) {
+						runnables[k].inlineScript.lock = undefined
+					}
+				}
+			}
+			return { value: canonical, valueMasked: false }
+		}
+		return {
+			value: Object.fromEntries(
+				Object.entries(row).filter(([k]) => !APP_ROW_CROSS_WORKSPACE_IGNORE.has(k))
+			),
+			valueMasked: false
+		}
+	}
+	return { value, valueMasked: false }
+}
+
+async function materializeFork(
+	workspace: string,
+	parentWorkspaceId: string,
+	entry: ForkEntry,
+	maxAgeMs: number
+): Promise<void> {
+	if (entry.materialized && Date.now() - entry.materialized.fetchedAt < maxAgeMs) return
+	if (entry.materializing) return entry.materializing
+	const run = (async () => {
+		try {
+			const [parentSide, forkSide] = await Promise.all([
+				entry.existsInParent
+					? fetchForkSideValue(entry.kind, entry.path, parentWorkspaceId)
+					: undefined,
+				entry.existsInFork ? fetchForkSideValue(entry.kind, entry.path, workspace) : undefined
+			])
+			const parentValue = parentSide?.value
+			const forkValue = forkSide?.value
+			const valueMasked = parentSide?.valueMasked === true || forkSide?.valueMasked === true
+			const oneSidedStatus = !entry.existsInFork
+				? 'deleted_in_fork'
+				: !entry.existsInParent
+					? 'only_in_fork'
+					: undefined
+			const parts = computeDiffParts(parentValue, forkValue, 'parent', 'fork')
+			entry.materialized = {
+				status: oneSidedStatus ?? (parts.hasChanges ? 'modified' : 'unchanged'),
+				patch: parts.patch,
+				lineCount: parts.lineCount,
+				files: parts.files,
+				valueMasked,
+				fetchedAt: Date.now()
+			}
+		} catch (e) {
+			entry.materialized = {
+				status: 'error',
+				patch: '',
+				lineCount: 0,
+				errorMessage: (e as Error | null | undefined)?.message ?? 'failed to compute diff',
+				fetchedAt: Date.now()
+			}
+		}
+	})()
+	entry.materializing = run
+	try {
+		await run
+	} finally {
+		entry.materializing = undefined
+	}
+}
+
+function toForkView(entry: ForkEntry): ForkDiffEntryView {
+	const m = entry.materialized
+	return {
+		kind: entry.kind,
+		type: entry.type,
+		triggerKind: entry.triggerKind,
+		path: entry.path,
+		ahead: entry.ahead,
+		behind: entry.behind,
+		hasLocalDraft: entry.hasLocalDraft,
+		status: m?.status ?? 'pending',
+		patch: m?.patch,
+		patchLineCount: m?.lineCount,
+		files: m?.files,
+		valueMasked: m?.valueMasked,
+		errorMessage: m?.errorMessage
+	}
+}
+
+/** Cheap comparison metadata (no patch materialization) — lets item/search
+ * modes distinguish "no differences" from "comparison unavailable". */
+export async function getForkComparisonStatus(
+	workspace: string,
+	parentWorkspaceId: string
+): Promise<{ skippedComparison: boolean }> {
+	const cache = await reconcileFork(workspace, parentWorkspaceId)
+	return { skippedComparison: cache.skippedComparison }
+}
+
+/** Fork index: every item that differs between the fork and its parent
+ * (`materializeAll` lifts the eager cap — search needs every patch). */
+export async function getForkDiffIndex(
+	workspace: string,
+	parentWorkspaceId: string,
+	opts: { materializeAll?: boolean } = {}
+): Promise<ForkDiffIndexView> {
+	const cache = await reconcileFork(workspace, parentWorkspaceId)
+	let toMaterialize = [...cache.entries.values()].filter(
+		(e) => !e.materialized || Date.now() - e.materialized.fetchedAt >= INDEX_ENTRY_STALE_MS
+	)
+	if (!opts.materializeAll) {
+		toMaterialize = toMaterialize.slice(0, EAGER_MATERIALIZE_CAP)
+	}
+	await mapPool(toMaterialize, FETCH_CONCURRENCY, (e) =>
+		materializeFork(workspace, parentWorkspaceId, e, INDEX_ENTRY_STALE_MS)
+	)
+	return {
+		parentWorkspaceId: cache.parentWorkspaceId,
+		skippedComparison: cache.skippedComparison,
+		entries: [...cache.entries.values()].map(toForkView),
+		hiddenAheadCount: cache.hiddenAheadCount,
+		hiddenBehindCount: cache.hiddenBehindCount
+	}
+}
+
+/** Fork-vs-parent entries for one path. `kinds` lists the comparison kinds
+ * the chat type maps to (e.g. type 'app' → ['app', 'raw_app']); an EMPTY list
+ * is a path-only wildcard — how kinds outside the chat type enum (folder,
+ * resource_type, …) stay readable. A wildcard returns EVERY kind differing at
+ * the path (nothing in the chat schema could disambiguate them); typed reads
+ * return at most one. Empty array = no difference at that path. */
+export async function readForkDiffEntries(
+	workspace: string,
+	parentWorkspaceId: string,
+	kinds: string[],
+	path: string
+): Promise<ForkDiffEntryView[]> {
+	const cache = await reconcileFork(workspace, parentWorkspaceId)
+	let entries: ForkEntry[] = []
+	if (kinds.length === 0) {
+		entries = [...cache.entries.values()].filter((e) => e.path === path)
+	} else {
+		for (const kind of kinds) {
+			const entry = cache.entries.get(`${kind}:${path}`)
+			if (entry) {
+				entries = [entry]
+				break
+			}
+		}
+	}
+	for (const entry of entries) {
+		await materializeFork(workspace, parentWorkspaceId, entry, READ_ENTRY_REUSE_MS)
+	}
+	return entries.map(toForkView)
+}
diff --git a/frontend/src/lib/components/copilot/chat/global/draftDiff.test.ts b/frontend/src/lib/components/copilot/chat/global/draftDiff.test.ts
new file mode 100644
index 0000000000..dac4df08f5
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/global/draftDiff.test.ts
@@ -0,0 +1,81 @@
+import { describe, expect, it } from 'vitest'
+import { changedLineIndices, draftDeployedPatch, textFilePatch } from './draftDiff'
+
+describe('draftDeployedPatch', () => {
+	it('returns an empty string for identical values', () => {
+		expect(draftDeployedPatch({ a: 1, b: 'x' }, { a: 1, b: 'x' })).toBe('')
+	})
+
+	it('ignores key-order differences', () => {
+		expect(draftDeployedPatch({ a: 1, b: 2 }, { b: 2, a: 1 })).toBe('')
+	})
+
+	it('treats null fields and absent fields as equal', () => {
+		expect(draftDeployedPatch({ a: 1, tag: null }, { a: 1 })).toBe('')
+		// but a real value vs null/absent still diffs
+		expect(draftDeployedPatch({ a: 1, tag: 'prod' }, { a: 1 })).toContain('-tag: prod')
+	})
+
+	it('diffs multiline code fields line-by-line', () => {
+		const deployed = { content: 'line1\nline2\nline3\n', language: 'bun' }
+		const draft = { content: 'line1\nchanged\nline3\n', language: 'bun' }
+		const patch = draftDeployedPatch(deployed, draft)
+		expect(patch).toContain('-  line2')
+		expect(patch).toContain('+  changed')
+		// Unchanged lines are context, not part of the change
+		expect(patch).not.toContain('-  line1')
+	})
+
+	it('renders a whole draft as additions when there is no deployed side', () => {
+		const patch = draftDeployedPatch(undefined, { summary: 'new item', value: { modules: [] } })
+		expect(patch).toContain('+summary: new item')
+		expect(patch).not.toMatch(/^-[^-]/m)
+	})
+})
+
+describe('windowPatch', () => {
+	it('continues from the last delivered line when the char cap cuts a window', async () => {
+		const { windowPatch } = await import('./draftDiff')
+		const patch = Array.from({ length: 20 }, (_, i) => `line-${String(i).padStart(2, '0')}`).join(
+			'\n'
+		)
+		// Cap fits ~5 complete 7-char lines ("line-NN" + newline).
+		const out = windowPatch(patch, 0, 20, 40)
+		const continueAt = Number(out.match(/offset=(\d+)/)?.[1])
+		expect(continueAt).toBeGreaterThan(0)
+		expect(continueAt).toBeLessThan(20)
+		// The continuation must resume exactly at the first undelivered line.
+		const delivered = out.split('\n').filter((l) => l.startsWith('line-'))
+		expect(delivered[delivered.length - 1]).toBe(`line-${String(continueAt - 1).padStart(2, '0')}`)
+		const next = windowPatch(patch, continueAt, 20, 40)
+		expect(next).toContain(`line-${String(continueAt).padStart(2, '0')}`)
+	})
+
+	it('reports an overshooting offset instead of an impossible range', async () => {
+		const { windowPatch } = await import('./draftDiff')
+		expect(windowPatch('a\nb', 10, 5, 100)).toContain('no lines at offset 10')
+	})
+
+	it('steps past a single line larger than the whole budget', async () => {
+		const { windowPatch } = await import('./draftDiff')
+		const patch = ['x'.repeat(100), 'after'].join('\n')
+		const out = windowPatch(patch, 0, 10, 40)
+		expect(out).toContain('offset=1')
+		const next = windowPatch(patch, 1, 10, 40)
+		expect(next).toContain('after')
+	})
+})
+
+describe('changedLineIndices', () => {
+	it('counts source lines starting with ++ or -- but never the file labels', () => {
+		const patch = textFilePatch('a\n--counter\nb\n', 'a\n++counter\nb\n', 'deployed', 'draft')
+		const lines = patch.split('\n')
+		const changed = changedLineIndices(patch).map((i) => lines[i])
+		// A changed `--counter`/`++counter` source line is byte-identical to a
+		// file label prefix — only hunk-awareness keeps it.
+		expect(changed).toContain('---counter')
+		expect(changed).toContain('+++counter')
+		// The actual file labels never count as changes.
+		expect(changed.some((l) => l.includes('deployed') || l.includes('draft'))).toBe(false)
+	})
+})
diff --git a/frontend/src/lib/components/copilot/chat/global/draftDiff.ts b/frontend/src/lib/components/copilot/chat/global/draftDiff.ts
new file mode 100644
index 0000000000..0fb12d480c
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/global/draftDiff.ts
@@ -0,0 +1,132 @@
+import { createTwoFilesPatch } from 'diff'
+import YAML from 'yaml'
+
+// Drop null/undefined object properties so `field: null` on one side never
+// diffs against the field being absent on the other (backend rows spell unset
+// as null, draft payloads omit the key). A real change keeps showing: the side
+// that has a value still emits its line. Array elements are kept (recursed
+// into, not removed) so positions stay aligned.
+function pruneNulls(value: unknown): unknown {
+	if (Array.isArray(value)) return value.map(pruneNulls)
+	if (value !== null && typeof value === 'object') {
+		return Object.fromEntries(
+			Object.entries(value as Record<string, unknown>)
+				.filter(([, v]) => v != null)
+				.map(([k, v]) => [k, pruneNulls(v)])
+		)
+	}
+	return value
+}
+
+// Serialize a draft/deployed diff value to deterministic YAML: sorted keys so
+// field order never shows as a change, no anchors/aliases (a `*a` reference in
+// a diff is unreadable), no line folding (wrapping would split one logical
+// change across hunks). Multiline strings (script content, app files) render
+// as block scalars, so code diffs read line-by-line instead of as one escaped
+// JSON string.
+export function toStableYaml(value: unknown): string {
+	if (value == null) return ''
+	return (
+		YAML.stringify(pruneNulls(value), {
+			sortMapEntries: true,
+			aliasDuplicateObjects: false,
+			lineWidth: 0
+		}) ?? ''
+	)
+}
+
+/** Unified patch between two sides of a workspace item.
+ * Returns '' when the two sides are identical. */
+export function yamlValuePatch(
+	before: unknown,
+	after: unknown,
+	beforeLabel: string,
+	afterLabel: string
+): string {
+	const beforeYaml = toStableYaml(before)
+	const afterYaml = toStableYaml(after)
+	if (beforeYaml === afterYaml) return ''
+	return createTwoFilesPatch(beforeLabel, afterLabel, beforeYaml, afterYaml, '', '', { context: 3 })
+}
+
+/** Unified patch between the deployed and draft sides of a workspace item.
+ * Returns '' when the two sides are identical. */
+export function draftDeployedPatch(deployed: unknown, draft: unknown): string {
+	return yamlValuePatch(deployed, draft, 'deployed', 'draft')
+}
+
+/** Indices of the real changed lines (+/-) in a unified patch. Hunk-aware:
+ * the `---`/`+++` file-label lines are structure, but they only occur before
+ * the first `@@` marker — a changed SOURCE line may itself start with ++ or
+ * -- (e.g. `++counter`), so prefix-matching `+++`/`---` would drop it. */
+export function changedLineIndices(patch: string): number[] {
+	const indices: number[] = []
+	const lines = patch.split('\n')
+	let inHunk = false
+	for (let i = 0; i < lines.length; i++) {
+		if (lines[i].startsWith('@@')) {
+			inHunk = true
+			continue
+		}
+		if (!inHunk) continue
+		if (lines[i].startsWith('+') || lines[i].startsWith('-')) indices.push(i)
+	}
+	return indices
+}
+
+/** Unified patch between two raw text files (no YAML wrapping — file contents
+ * diff line-by-line as-is). Returns '' when identical; an absent side is
+ * treated as empty, so a one-sided file reads as all additions/removals. */
+export function textFilePatch(
+	before: string | undefined,
+	after: string | undefined,
+	beforeLabel: string,
+	afterLabel: string
+): string {
+	const beforeText = before ?? ''
+	const afterText = after ?? ''
+	if (beforeText === afterText) return ''
+	return createTwoFilesPatch(beforeLabel, afterLabel, beforeText, afterText, '', '', { context: 3 })
+}
+
+/** Window a patch by lines with a character backstop. When the backstop cuts
+ * inside the window, the continuation offset advances only past the COMPLETE
+ * lines actually delivered — a pre-truncation offset would skip the rest of
+ * the window forever. */
+export function windowPatch(
+	patch: string,
+	offset: number,
+	limit: number,
+	maxChars: number
+): string {
+	const lines = patch.split('\n')
+	const total = lines.length
+	if (offset >= total) {
+		return `(no lines at offset ${offset} — the patch has ${total} lines; call again with a smaller offset)`
+	}
+	const start = offset
+	const requestedEnd = Math.min(total, start + limit)
+	let body = lines.slice(start, requestedEnd).join('\n')
+	let effectiveEnd = requestedEnd
+	let note = ''
+	if (body.length > maxChars) {
+		body = body.slice(0, maxChars)
+		const lastNewline = body.lastIndexOf('\n')
+		if (lastNewline === -1) {
+			// One pathological line exceeds the budget: deliver its head and step
+			// past it, or pagination could never advance.
+			effectiveEnd = start + 1
+			note = `\n… [line truncated at ${maxChars} chars]`
+		} else {
+			body = body.slice(0, lastNewline)
+			effectiveEnd = start + body.split('\n').length
+			note = `\n… window truncated at ${maxChars} chars.`
+		}
+	}
+	if (start > 0 || effectiveEnd < total) {
+		note += `\n(lines ${start + 1}-${effectiveEnd} of ${total}${
+			effectiveEnd < total ? `; call diff again with offset=${effectiveEnd} for the rest` : ''
+		})`
+	}
+	return body + note
+}
diff --git a/frontend/src/lib/components/copilot/chat/global/userDraftAdapter.ts b/frontend/src/lib/components/copilot/chat/global/userDraftAdapter.ts
index eae27fb5b4..5f73a64752 100644
--- a/frontend/src/lib/components/copilot/chat/global/userDraftAdapter.ts
+++ b/frontend/src/lib/components/copilot/chat/global/userDraftAdapter.ts
@@ -3,6 +3,7 @@ import { DraftService } from '$lib/gen'
 import { UserDraftDbSyncer } from '$lib/userDraftDbSyncer.svelte'
 import { DEFAULT_DATA as DEFAULT_RAW_APP_DATA } from '$lib/components/raw_apps/dataTableRefUtils'
 import { UserDraft, type UserDraftEntry, type UserDraftItemKind } from '$lib/userDraft.svelte'
+import { invalidateWorkspaceDrafts } from '$lib/workspaceDrafts.svelte'
 import {
 	getWorkspaceItemKey,
 	type AppDraftValue,
@@ -134,6 +135,32 @@ export function triggerKindToUserDraftKind(kind: TriggerKind): UserDraftItemKind
 	return TRIGGER_DRAFT_KIND_BY_TRIGGER_KIND[kind]
 }
 
+/** Inverse of `itemKindFor`: the chat-facing type (+ trigger kind) for a draft
+ * kind. Classic and raw app drafts both surface as the chat's `app` type —
+ * mirroring the read path, which pairs the two kinds. `undefined` for kinds
+ * the chat cannot address (webhook / poll / cli trigger drafts, data
+ * pipelines). */
+export function itemTypeForKind(
+	kind: UserDraftItemKind
+): { type: WorkspaceItemType; triggerKind?: TriggerKind } | undefined {
+	switch (kind) {
+		case 'script':
+		case 'flow':
+		case 'resource':
+		case 'variable':
+			return { type: kind }
+		case 'app':
+		case 'raw_app':
+			return { type: 'app' }
+		case 'trigger_schedule':
+			return { type: 'schedule' }
+		default: {
+			const triggerKind = TRIGGER_KIND_BY_DRAFT_KIND[kind]
+			return triggerKind ? { type: 'trigger', triggerKind } : undefined
+		}
+	}
+}
+
 function scriptDraftToWorkspaceItem(path: string, draft: NewScript): WorkspaceItem {
 	return {
 		type: 'script',
@@ -456,9 +483,17 @@ export async function persistGlobalDraft(
 	const conflict = opts.force
 		? undefined
 		: UserDraftDbSyncer.getConflict({ workspace, itemKind, path: storagePath }).conflict
-	return conflict
-		? { status: 'conflict', item, itemKind, storagePath, serverTimestamp: conflict.serverTimestamp }
-		: { status: 'saved', item, itemKind, storagePath }
+	if (conflict) {
+		return {
+			status: 'conflict',
+			item,
+			itemKind,
+			storagePath,
+			serverTimestamp: conflict.serverTimestamp
+		}
+	}
+	invalidateWorkspaceDrafts(workspace)
+	return { status: 'saved', item, itemKind, storagePath }
 }
 
 export async function getGlobalDraft(
@@ -609,6 +644,69 @@ export async function deleteGlobalDraft(
 		)
 	}
 	if (type === 'variable') clearEphemeralSecretVariableDraftValue(workspace, storagePath)
+	invalidateWorkspaceDrafts(workspace)
+}
+
+/** Kind-addressed live-editor storage resolution (friendly → storage path),
+ * for callers that must probe several draft kinds per chat type. */
+export function resolveGlobalDraftStoragePathByKind(
+	workspace: string,
+	itemKind: UserDraftItemKind,
+	path: string
+): string {
+	return resolveDraftStoragePath(workspace, itemKind, path)
+}
+
+/** Local in-memory draft cell, kind-addressed: the chat `app` type spans two
+ * draft kinds (raw_app + classic app), so callers probing both address by
+ * kind. No backend fallback — this is the freshest state when a save is
+ * parked (auto-save off), failed, or conflicted; read-only callers use it
+ * instead of persisting. */
+export function readLocalDraftCellByKind(
+	workspace: string,
+	itemKind: UserDraftItemKind,
+	path: string
+): unknown | undefined {
+	const storagePath = resolveDraftStoragePath(workspace, itemKind, path)
+	return UserDraft.get(itemKind, storagePath, { workspace })
+}
+
+/** Flush every parked local draft autosave for the workspace so the server
+ * listing reflects the latest edits — a brand-new editor draft has no server
+ * row until its first flush. No-ops per key when nothing is pending.
+ * Honors the auto-save toggle: with auto-save off, parked editor edits stay
+ * parked — a read-only caller must not persist what the user chose not to.
+ * `unflushedPaths` lists items whose latest edits did NOT reach the server
+ * (toggle-parked or failed save), so callers can say the listing excludes them. */
+export async function flushGlobalDraftSaves(
+	workspace: string
+): Promise<{ unflushedPaths: string[] }> {
+	// Classic-app editor cells live under the `app` kind, which is deliberately
+	// NOT in GLOBAL_DRAFT_KINDS (clearGlobalDrafts must never clear a user's
+	// open classic editor) — but their unflushed edits must be flushed/reported
+	// like every other kind.
+	const drafts = UserDraft.list({ workspace, itemKinds: [...GLOBAL_DRAFT_KINDS, 'app'] })
+	await Promise.all(
+		drafts.map((draft) =>
+			UserDraftDbSyncer.flush(
+				{ workspace, itemKind: draft.itemKind, path: draft.path },
+				{ honorAutosaveToggle: true }
+			)
+		)
+	)
+	const unflushedPaths = drafts
+		.filter((draft) => {
+			const query = { workspace, itemKind: draft.itemKind, path: draft.path }
+			// A conflicted save also leaves the server without the local edits:
+			// the payload stays parked but the state is neither pending nor failed.
+			return (
+				UserDraftDbSyncer.hasUnsavedDisabledChanges(query) ||
+				UserDraftDbSyncer.getState(query).state === 'failed' ||
+				UserDraftDbSyncer.getConflict(query).conflict !== undefined
+			)
+		})
+		.map((draft) => draft.path)
+	return { unflushedPaths }
 }
 
 export function clearGlobalDrafts(workspace: string): void {
diff --git a/frontend/src/lib/userDraftDbSyncer.svelte.ts b/frontend/src/lib/userDraftDbSyncer.svelte.ts
index 77e2eecc88..0e8257023d 100644
--- a/frontend/src/lib/userDraftDbSyncer.svelte.ts
+++ b/frontend/src/lib/userDraftDbSyncer.svelte.ts
@@ -237,6 +237,25 @@ const flushes = new SvelteMap<string, number>()
  */
 const saveListeners = new Map<string, Set<() => void>>()
 
+/**
+ * Global listeners fired whenever ANY draft write lands on the server —
+ * upserts and deletes alike. This is the invalidation hook for caches keyed
+ * on persisted draft state (the chat diff snapshot): the moment a save
+ * commits, the affected item can be marked stale without polling.
+ */
+type DraftSavedEvent = { workspace: string; itemKind: UserDraftItemKind; path: string }
+const anySavedListeners = new Set<(event: DraftSavedEvent) => void>()
+
+function notifyAnySaved(event: DraftSavedEvent): void {
+	for (const listener of [...anySavedListeners]) {
+		try {
+			listener(event)
+		} catch (e) {
+			console.error('UserDraftDbSyncer.onAnySaved listener threw', e)
+		}
+	}
+}
+
 /**
  * Best-effort error → readable string. The generated client wraps HTTP
  * failures as `ApiError` (`body` / `statusText`); raw fetch errors are a
@@ -310,6 +329,10 @@ async function postSave(opts: UserDraftDbSyncerSaveOpts): Promise<void> {
 			const listeners = saveListeners.get(key)
 			if (listeners) for (const l of [...listeners]) l()
 		}
+		// Global subscribers hear deletes too — a removed row invalidates
+		// cached state the same way an upsert does. Listener errors must never
+		// make a committed save read as failed.
+		notifyAnySaved({ workspace: opts.workspace, itemKind: opts.itemKind, path: opts.path })
 	} catch (e) {
 		console.error('UserDraftDbSyncer.save failed', e)
 		// Leave pending opts in place so the next attempt retries the same
@@ -366,8 +389,11 @@ function flushOnPageHide(): void {
 				console.error('UserDraftDbSyncer: keepalive flush failed', e)
 			})
 			// POST advanced the row past `lastSync` and we can't read the
-			// response — mark the key so a bfcache restore drops it.
+			// response — mark the key so a bfcache restore drops it, and notify
+			// subscribers conservatively (this path bypasses postSave; on a
+			// bfcache restore a cache must not serve the pre-flush state).
 			staleSyncAfterHideFlush.add(key)
+			notifyAnySaved({ workspace: opts.workspace, itemKind: opts.itemKind, path: opts.path })
 		} catch (e) {
 			console.error('UserDraftDbSyncer: keepalive flush threw', e)
 		}
@@ -555,6 +581,18 @@ export const UserDraftDbSyncer = {
 		}
 	},
 
+	/**
+	 * Fires when any draft write lands on the server — upserts AND deletes,
+	 * every workspace and key. For caches over persisted draft state that
+	 * must invalidate the affected item the moment a write commits.
+	 */
+	onAnySaved(listener: (event: DraftSavedEvent) => void): () => void {
+		anySavedListeners.add(listener)
+		return () => {
+			anySavedListeners.delete(listener)
+		}
+	},
+
 	/** Reactive conflict snapshot (if any) for a draft. */
 	getConflict(query: UserDraftLastSyncQuery): {
 		readonly conflict: DraftConflictInfo | undefined
diff --git a/frontend/src/lib/userDraftFlushToggle.test.ts b/frontend/src/lib/userDraftFlushToggle.test.ts
new file mode 100644
index 0000000000..6d3ab29f77
--- /dev/null
+++ b/frontend/src/lib/userDraftFlushToggle.test.ts
@@ -0,0 +1,81 @@
+import { describe, it, expect, afterEach, vi } from 'vitest'
+
+const updateDraft = vi.fn(async (..._args: any[]) => ({
+	status: 'saved' as const,
+	current_timestamp: '2020-01-01T00:00:00Z'
+}))
+
+vi.mock('./gen', () => ({
+	DraftService: { updateDraft: (...a: unknown[]) => updateDraft(...(a as [])) }
+}))
+vi.mock('./gen/core/OpenAPI', () => ({ OpenAPI: { BASE: '' } }))
+vi.mock('./localDraftHints.svelte', () => ({ setLocalDraftHint: vi.fn() }))
+
+import { UserDraftDbSyncer } from './userDraftDbSyncer.svelte'
+
+afterEach(() => {
+	vi.clearAllMocks()
+	UserDraftDbSyncer.autosaveEnabled = true
+})
+
+/**
+ * Read-only consumers (the chat `diff` tool) flush with `honorAutosaveToggle`
+ * and then read `hasUnsavedDisabledChanges` to know the persisted state is
+ * stale. Pins the contract pair: a toggle-honoring flush must NOT persist
+ * auto-save-off edits (and must keep reporting them), while an explicit flush
+ * persists them and clears the signal.
+ */
+describe('UserDraftDbSyncer toggle-honoring flush', () => {
+	it('keeps auto-save-off edits parked and reported; explicit flush clears them', async () => {
+		const q = { workspace: 'w', itemKind: 'script' as const, path: 'u/me/toggle_off' }
+		UserDraftDbSyncer.autosaveEnabled = false
+		await UserDraftDbSyncer.save({ ...q, value: { content: 'x' }, auto: true, canBeDisabled: true })
+
+		await UserDraftDbSyncer.flush(q, { honorAutosaveToggle: true })
+		expect(updateDraft).not.toHaveBeenCalled()
+		expect(UserDraftDbSyncer.hasUnsavedDisabledChanges(q)).toBe(true)
+
+		await UserDraftDbSyncer.flush(q)
+		expect(updateDraft).toHaveBeenCalledTimes(1)
+		expect(UserDraftDbSyncer.hasUnsavedDisabledChanges(q)).toBe(false)
+	})
+})
+
+/** A conflicted save leaves the local payload parked with the conflict
+ * recorded while the state reads 'none' — the exact triple the diff tool's
+ * unflushed-edits detection reads. Pins that a conflict never looks like a
+ * clean sync. */
+describe('UserDraftDbSyncer conflict aftermath', () => {
+	it('keeps the payload parked and the conflict readable after flush settles', async () => {
+		const q = { workspace: 'w', itemKind: 'script' as const, path: 'u/me/conflicted' }
+		updateDraft.mockResolvedValueOnce({
+			status: 'conflict',
+			current_timestamp: '2020-01-02T00:00:00Z'
+		})
+		await UserDraftDbSyncer.save({ ...q, value: { content: 'mine' }, immediate: true })
+
+		// The triple the diff tool's unflushed detection reads: conflict set,
+		// state 'none' (not pending/failed), auto-save signal silent.
+		expect(UserDraftDbSyncer.getConflict(q).conflict).toBeDefined()
+		expect(UserDraftDbSyncer.getState(q).state).toBe('none')
+		expect(UserDraftDbSyncer.hasUnsavedDisabledChanges(q)).toBe(false)
+	})
+})
+
+/** The diff snapshot cache invalidates through this hook — it must fire for
+ * upserts AND deletes, the moment the write lands. */
+describe('UserDraftDbSyncer.onAnySaved', () => {
+	it('fires for landed upserts and deletes, and unsubscribes cleanly', async () => {
+		const q = { workspace: 'w', itemKind: 'script' as const, path: 'u/me/hooked' }
+		const events: string[] = []
+		const off = UserDraftDbSyncer.onAnySaved((e) => events.push(`${e.itemKind}:${e.path}`))
+
+		await UserDraftDbSyncer.save({ ...q, value: { content: 'x' }, immediate: true })
+		await UserDraftDbSyncer.save({ ...q, value: null, immediate: true })
+		expect(events).toEqual(['script:u/me/hooked', 'script:u/me/hooked'])
+
+		off()
+		await UserDraftDbSyncer.save({ ...q, value: { content: 'y' }, immediate: true })
+		expect(events).toHaveLength(2)
+	})
+})
diff --git a/frontend/src/lib/utils_draft_deploy.ts b/frontend/src/lib/utils_draft_deploy.ts
index 6068753c4c..514ce9cdb2 100644
--- a/frontend/src/lib/utils_draft_deploy.ts
+++ b/frontend/src/lib/utils_draft_deploy.ts
@@ -39,7 +39,9 @@ import type { DeployResult } from '$lib/utils_workspace_deploy'
 import { TRIGGER_RUNTIME_IGNORE } from '$lib/utils_deployable'
 import { deployRawAppDraft } from '$lib/rawAppDeploy'
 import { canonicalRawAppDiffValue } from '$lib/components/raw_apps/utils'
+import { classicAppDraftParts } from '$lib/appDiffSides'
 import { invalidateWorkspaceDrafts } from '$lib/workspaceDrafts.svelte'
+import { invalidateWorkspaceComparison } from '$lib/workspaceComparison'
 import { setLocalDraftHint } from '$lib/localDraftHints.svelte'
 import { userStore } from '$lib/stores'
 import { deployTriggers, type Trigger } from '$lib/components/triggers/utils'
@@ -94,21 +96,35 @@ const OVERLAY_GETTERS: Partial<
 }
 
 /** Strip the per-user draft-overlay metadata, returning `{deployed, draft}`. */
-function splitOverlay(r: any): { deployed: any; draft: any } {
+function splitOverlay(r: any): {
+	deployed: any
+	draft: any
+	hasDraft: boolean
+	noDeployed: boolean
+} {
 	const {
 		draft,
 		is_draft: _i,
 		draft_saved_at: _c,
-		no_deployed: _n,
+		no_deployed,
 		other_drafts_users: _o,
 		...deployed
 	} = r
-	return { deployed, draft: draft ?? deployed }
+	return {
+		deployed,
+		draft: draft ?? deployed,
+		hasDraft: draft != null,
+		noDeployed: no_deployed === true
+	}
 }
 
 export interface DraftDiffValues {
 	deployed: unknown
 	draft: unknown
+	/** False when the overlay carried no draft row (the item's own value was used as the draft side). */
+	hasDraft: boolean
+	/** True when the item has never been deployed (`draft_only` overlay). */
+	noDeployed: boolean
 }
 
 // Empty-but-valid "deployed" shapes for draft_only items. A bare `{}` breaks
@@ -117,7 +133,56 @@ export interface DraftDiffValues {
 const EMPTY_DEPLOYED: Partial<Record<DraftKind, (draft: any) => unknown>> = {
 	script: (draft) => ({ content: '', language: draft?.language, schema: {} }),
 	flow: () => ({ summary: '', value: { modules: [] }, schema: {} }),
-	app: () => ({ summary: '', value: {}, policy: {} })
+	app: () => ({ summary: '', value: {} })
+}
+
+// Server-managed script-row fields, stripped from BOTH sides of a draft diff:
+// never user-edited, they are either identical noise (created_at, workspace_id)
+// or spuriously different (lock is recomputed at deploy). The draft-side
+// pinned-base `parent_hash` is stripped separately, like the flow `version_id`.
+const SCRIPT_ROW_RUNTIME_IGNORE = new Set([
+	'workspace_id',
+	'hash',
+	'parent_hash',
+	'parent_hashes',
+	'created_at',
+	'created_by',
+	'archived',
+	'deleted',
+	'extra_perms',
+	'lock',
+	'lock_error_logs',
+	'starred',
+	'has_draft',
+	'draft_only',
+	'assets',
+	'marked'
+])
+
+function stripScriptRowRuntime(row: any): Record<string, unknown> {
+	if (!row || typeof row !== 'object') return {}
+	return Object.fromEntries(Object.entries(row).filter(([k]) => !SCRIPT_ROW_RUNTIME_IGNORE.has(k)))
+}
+
+/** Canonicalize a raw draft value onto the same shape `getDraftDiffValues`
+ * yields for its draft side, so a value read from an in-memory editor cell
+ * diffs cleanly against a deployed side (and compares equal to its own
+ * persisted form instead of differing on stripped fields). */
+export function canonicalDraftSideValue(kind: DraftKind, value: unknown): unknown {
+	if (kind === 'script') return stripScriptRowRuntime(value)
+	if (kind === 'raw_app') return canonicalRawAppDiffValue((value ?? {}) as Record<string, any>)
+	if (kind === 'app') {
+		const parts = classicAppDraftParts(value)
+		return { summary: parts.summary ?? '', value: parts.value }
+	}
+	if (kind === 'flow' && value !== null && typeof value === 'object') {
+		const { version_id: _v, ...rest } = value as Record<string, unknown>
+		return rest
+	}
+	// Drawer kinds (variables/resources/schedules/triggers): the editor-state
+	// shape diverges from the backend row — same canonicalization the overlay
+	// diff applies.
+	return canonicalizeDraftDiffValue(kind, value, true)
 }
 
 // Schedule & trigger rows drop the same runtime/server-managed fields as the
@@ -193,15 +258,17 @@ export async function getDraftDiffValues(
 			draft,
 			is_draft: _i,
 			draft_saved_at: _c,
-			no_deployed: _n,
+			no_deployed,
 			other_drafts_users: _o,
 			hash: _h,
 			...deployed
 		} = r
-		const draftValue = draft ?? deployed
+		const draftValue = stripScriptRowRuntime(draft ?? deployed)
 		return {
-			deployed: draftOnly ? EMPTY_DEPLOYED.script!(draftValue) : deployed,
-			draft: draftValue
+			deployed: draftOnly ? EMPTY_DEPLOYED.script!(draftValue) : stripScriptRowRuntime(deployed),
+			draft: draftValue,
+			hasDraft: draft != null,
+			noDeployed: no_deployed === true
 		}
 	} else if (kind === 'flow') {
 		const r = (await FlowService.getFlowByPath({ workspace, path, getDraft: true })) as any
@@ -209,7 +276,7 @@ export async function getDraftDiffValues(
 			draft,
 			is_draft: _i,
 			draft_saved_at: _c,
-			no_deployed: _n,
+			no_deployed,
 			other_drafts_users: _o,
 			version_id: _v,
 			...deployed
@@ -217,7 +284,12 @@ export async function getDraftDiffValues(
 		// Strip the draft's pinned base `version_id` (which differs from the deployed
 		// head for a stale draft) so it never renders as a spurious diff line.
 		const { version_id: _dv, ...draftValue } = (draft ?? deployed) as any
-		return { deployed: draftOnly ? EMPTY_DEPLOYED.flow!(draftValue) : deployed, draft: draftValue }
+		return {
+			deployed: draftOnly ? EMPTY_DEPLOYED.flow!(draftValue) : deployed,
+			draft: draftValue,
+			hasDraft: draft != null,
+			noDeployed: no_deployed === true
+		}
 	} else if (kind === 'app' || kind === 'raw_app') {
 		// A never-deployed raw app has no `app` row; the backend resolves the
 		// draft kind from `rawApp`, so it MUST be set or the lookup 404s.
@@ -232,22 +304,36 @@ export async function getDraftDiffValues(
 			// deployed row nests them under `value`, and deployed inline scripts carry
 			// server-recomputed locks. Canonicalize both onto the same shape with the
 			// post-deploy noise stripped — the same module the editor's Diff button uses.
+			// A staged rename (`draft_path`) changes where deploy lands the app —
+			// compare it as `path` on both sides so a rename-only draft diffs.
+			const rawDraftPath = (r.draft?.draft_path as string | undefined) ?? r.path
 			return {
-				deployed: draftOnly ? canonicalRawAppDiffValue({}) : canonicalRawAppDiffValue(r),
-				draft: canonicalRawAppDiffValue(r.draft ?? r)
+				deployed: draftOnly
+					? canonicalRawAppDiffValue({})
+					: { ...canonicalRawAppDiffValue(r), path: r.path },
+				draft: { ...canonicalRawAppDiffValue(r.draft ?? r), path: rawDraftPath },
+				hasDraft: r.draft != null,
+				noDeployed: r.no_deployed === true
 			}
 		}
-		const deployed = {
-			summary: r.summary,
-			value: r.value,
-			policy: r.policy,
-			path: r.path,
-			custom_path: r.custom_path
+		// Classic app: the editor drafts the bare grid with summary/draft_path
+		// mirrored into it, while the row keeps summary as a column beside
+		// `value`. Both sides reduce to `{ summary, value }` with the metadata
+		// extracted from the grid, so a summary edit diffs as a summary edit and
+		// the grid never diffs against draft-only markers.
+		const deployedParts = classicAppDraftParts(r.value)
+		const draftParts = r.draft != null ? classicAppDraftParts(r.draft) : deployedParts
+		const deployed = { summary: r.summary ?? '', value: deployedParts.value, path: r.path }
+		return {
+			deployed: draftOnly ? EMPTY_DEPLOYED.app!(undefined) : deployed,
+			draft: {
+				summary: draftParts.summary ?? r.summary ?? '',
+				value: draftParts.value,
+				path: draftParts.draftPath ?? r.path
+			},
+			hasDraft: r.draft != null,
+			noDeployed: r.no_deployed === true
 		}
-		// Strip the draft's pinned fork-base `parent_version` (the deployed allowlist
-		// above already omits it) so it never renders as a spurious diff line.
-		const { parent_version: _pv, ...draftValue } = (r.draft ?? deployed) as any
-		return { deployed: draftOnly ? EMPTY_DEPLOYED.app!(draftValue) : deployed, draft: draftValue }
 	} else {
 		// Variables / resources / schedules / triggers: one overlay GET yields
 		// both sides, but the draft side is the editor's state shape while the
@@ -258,10 +344,12 @@ export async function getDraftDiffValues(
 		if (!getter) {
 			throw new Error(`Draft diff not supported for kind ${kind}`)
 		}
-		const { deployed, draft } = splitOverlay(await getter(workspace, path))
+		const { deployed, draft, hasDraft, noDeployed } = splitOverlay(await getter(workspace, path))
 		return {
 			deployed: draftOnly ? {} : canonicalizeDraftDiffValue(kind, deployed, false),
-			draft: canonicalizeDraftDiffValue(kind, draft, true)
+			draft: canonicalizeDraftDiffValue(kind, draft, true),
+			hasDraft,
+			noDeployed
 		}
 	}
 }
@@ -556,6 +644,10 @@ export async function deployDraft(
 		})
 		// Mutated the workspace's Server Drafts — refresh every mounted reader.
 		invalidateWorkspaceDrafts(workspace)
+		// The DEPLOYED state moved: cached fork comparisons involving this
+		// workspace (as fork or as parent) are no longer trustworthy. Draft-only
+		// mutations skip this — they never move the deployed tally.
+		invalidateWorkspaceComparison(workspace)
 		// For script/flow/app the server-side delete bypasses UserDraftDbSyncer,
 		// so the syncer-owned hint won't auto-clear — clear it explicitly.
 		// (Idempotent: the drawer-kind delete above already cleared it.)
diff --git a/frontend/src/lib/workspaceComparison.test.ts b/frontend/src/lib/workspaceComparison.test.ts
new file mode 100644
index 0000000000..bf9fc960b1
--- /dev/null
+++ b/frontend/src/lib/workspaceComparison.test.ts
@@ -0,0 +1,163 @@
+import { describe, expect, it, vi, beforeEach } from 'vitest'
+
+const compareWorkspaces = vi.fn()
+vi.mock('$lib/gen', () => ({
+	WorkspaceService: { compareWorkspaces: (...a: unknown[]) => compareWorkspaces(...(a as [])) }
+}))
+vi.mock('$lib/stores', async () => {
+	const { writable } = await import('svelte/store')
+	return { usersWorkspaceStore: writable(undefined) }
+})
+
+import { fetchWorkspaceComparison, invalidateWorkspaceComparison } from './workspaceComparison'
+import { usersWorkspaceStore } from '$lib/stores'
+
+function deferred<T>() {
+	let resolve!: (v: T) => void
+	const promise = new Promise<T>((res) => (resolve = res))
+	return { promise, resolve }
+}
+
+beforeEach(() => {
+	compareWorkspaces.mockReset()
+})
+
+describe('fetchWorkspaceComparison', () => {
+	it('a freshness-forced call never adopts an older in-flight request', async () => {
+		const first = deferred<unknown>()
+		compareWorkspaces.mockImplementationOnce(() => first.promise)
+		compareWorkspaces.mockResolvedValueOnce({ summary: { total_diffs: 1 } })
+
+		// Tolerant caller starts a request (e.g. the fork banner)...
+		const tolerant = fetchWorkspaceComparison('p', 'f-forced', { maxAgeMs: 30_000 })
+		// ...a mutation happens, then a forced caller must get its OWN fetch.
+		const forced = fetchWorkspaceComparison('p', 'f-forced', { maxAgeMs: 0 })
+		expect(compareWorkspaces).toHaveBeenCalledTimes(2)
+
+		first.resolve({ summary: { total_diffs: 0 } })
+		expect((await forced).summary.total_diffs).toBe(1)
+		expect((await tolerant).summary.total_diffs).toBe(0)
+	})
+
+	it('a superseded older request never overwrites a newer result, even same-millisecond', async () => {
+		vi.useFakeTimers()
+		try {
+			const older = deferred<unknown>()
+			compareWorkspaces.mockImplementationOnce(() => older.promise)
+			compareWorkspaces.mockResolvedValueOnce({ summary: { total_diffs: 7 } })
+
+			// Same frozen Date.now() for both requests.
+			const tolerant = fetchWorkspaceComparison('p', 'f-race', { maxAgeMs: 30_000 })
+			const forced = fetchWorkspaceComparison('p', 'f-race', { maxAgeMs: 0 })
+			// Newer (forced) resolves FIRST; older resolves after with stale data.
+			expect((await forced).summary.total_diffs).toBe(7)
+			older.resolve({ summary: { total_diffs: 0 } })
+			await tolerant
+
+			// A tolerant read must see the newer result, not the late stale write.
+			const reread = await fetchWorkspaceComparison('p', 'f-race', { maxAgeMs: 30_000 })
+			expect(reread.summary.total_diffs).toBe(7)
+			expect(compareWorkspaces).toHaveBeenCalledTimes(2)
+		} finally {
+			vi.useRealTimers()
+		}
+	})
+
+	it('invalidation evicts by EITHER side and fences in-flight requests', async () => {
+		compareWorkspaces.mockResolvedValueOnce({ summary: { total_diffs: 0 } })
+		compareWorkspaces.mockResolvedValueOnce({ summary: { total_diffs: 3 } })
+
+		// Banner prewarms the cache pre-deploy...
+		await fetchWorkspaceComparison('p-side', 'f-inval', { maxAgeMs: 30_000 })
+		// ...a deploy in the PARENT invalidates too...
+		invalidateWorkspaceComparison('p-side')
+		// ...so even a first-ever tolerant read cannot reuse the stale tally.
+		const fresh = await fetchWorkspaceComparison('p-side', 'f-inval', { maxAgeMs: 30_000 })
+		expect(fresh.summary.total_diffs).toBe(3)
+		expect(compareWorkspaces).toHaveBeenCalledTimes(2)
+	})
+
+	it('a pre-invalidation in-flight request is not joined and cannot land in the cache', async () => {
+		const stale = deferred<unknown>()
+		compareWorkspaces.mockImplementationOnce(() => stale.promise)
+		compareWorkspaces.mockResolvedValueOnce({ summary: { total_diffs: 9 } })
+
+		const preMutation = fetchWorkspaceComparison('p', 'f-fence', { maxAgeMs: 30_000 })
+		invalidateWorkspaceComparison('f-fence')
+		// Tolerant post-mutation read: must NOT join the fenced request.
+		const post = fetchWorkspaceComparison('p', 'f-fence', { maxAgeMs: 30_000 })
+		expect(compareWorkspaces).toHaveBeenCalledTimes(2)
+
+		stale.resolve({ summary: { total_diffs: 0 } })
+		await preMutation
+		expect((await post).summary.total_diffs).toBe(9)
+		// The stale request's late completion never landed in the cache.
+		const reread = await fetchWorkspaceComparison('p', 'f-fence', { maxAgeMs: 30_000 })
+		expect(reread.summary.total_diffs).toBe(9)
+		expect(compareWorkspaces).toHaveBeenCalledTimes(2)
+	})
+
+	it('a superseded request fenced by invalidation cannot repopulate the cache late', async () => {
+		const superseded = deferred<unknown>()
+		compareWorkspaces.mockImplementationOnce(() => superseded.promise)
+		compareWorkspaces.mockResolvedValueOnce({ summary: { total_diffs: 5 } })
+		compareWorkspaces.mockResolvedValueOnce({ summary: { total_diffs: 6 } })
+
+		// Request A pends; forced request B replaces it in the inflight map and completes.
+		const a = fetchWorkspaceComparison('p', 'f-late', { maxAgeMs: 30_000 })
+		await fetchWorkspaceComparison('p', 'f-late', { maxAgeMs: 0 })
+		// Invalidation happens while A (no longer tracked in inflight) still pends.
+		invalidateWorkspaceComparison('f-late')
+		// A resolves late with pre-mutation data — it must NOT land in the cache.
+		superseded.resolve({ summary: { total_diffs: 0 } })
+		await a
+		const read = await fetchWorkspaceComparison('p', 'f-late', { maxAgeMs: 30_000 })
+		expect(read.summary.total_diffs).toBe(6)
+	})
+
+	it('tolerant callers join a recent in-flight request', async () => {
+		const first = deferred<unknown>()
+		compareWorkspaces.mockImplementationOnce(() => first.promise)
+
+		const a = fetchWorkspaceComparison('p', 'f-join', { maxAgeMs: 30_000 })
+		const b = fetchWorkspaceComparison('p', 'f-join', { maxAgeMs: 30_000 })
+		expect(compareWorkspaces).toHaveBeenCalledTimes(1)
+
+		first.resolve({ summary: { total_diffs: 2 } })
+		expect((await a).summary.total_diffs).toBe(2)
+		expect((await b).summary.total_diffs).toBe(2)
+	})
+	it('an account switch clears cached comparisons', async () => {
+		usersWorkspaceStore.set({ email: 'first@x.dev' } as any)
+		compareWorkspaces.mockResolvedValueOnce({ summary: { total_diffs: 3 } })
+		await fetchWorkspaceComparison('p', 'f-owner', { maxAgeMs: 30_000 })
+		await fetchWorkspaceComparison('p', 'f-owner', { maxAgeMs: 30_000 })
+		expect(compareWorkspaces).toHaveBeenCalledTimes(1)
+
+		compareWorkspaces.mockResolvedValueOnce({ summary: { total_diffs: 9 } })
+		usersWorkspaceStore.set({ email: 'second@x.dev' } as any)
+		const fresh = await fetchWorkspaceComparison('p', 'f-owner', { maxAgeMs: 30_000 })
+		expect(fresh.summary.total_diffs).toBe(9)
+		expect(compareWorkspaces).toHaveBeenCalledTimes(2)
+	})
+
+	it('a request started under the previous account never joins or lands after a switch', async () => {
+		const old = deferred<unknown>()
+		compareWorkspaces.mockImplementationOnce(() => old.promise)
+		compareWorkspaces.mockResolvedValueOnce({ summary: { total_diffs: 5 } })
+
+		usersWorkspaceStore.set({ email: 'a@x.dev' } as any)
+		fetchWorkspaceComparison('p', 'f-switch', { maxAgeMs: 30_000 })
+		usersWorkspaceStore.set({ email: 'b@x.dev' } as any)
+		const after = fetchWorkspaceComparison('p', 'f-switch', { maxAgeMs: 30_000 })
+		// The new account must not have joined the old account's request.
+		expect(compareWorkspaces).toHaveBeenCalledTimes(2)
+
+		old.resolve({ summary: { total_diffs: 0 } })
+		expect((await after).summary.total_diffs).toBe(5)
+		// And the old account's late result must not have landed in the cache.
+		const reread = await fetchWorkspaceComparison('p', 'f-switch', { maxAgeMs: 30_000 })
+		expect(reread.summary.total_diffs).toBe(5)
+		expect(compareWorkspaces).toHaveBeenCalledTimes(2)
+	})
+})
diff --git a/frontend/src/lib/workspaceComparison.ts b/frontend/src/lib/workspaceComparison.ts
new file mode 100644
index 0000000000..0d1ad8be25
--- /dev/null
+++ b/frontend/src/lib/workspaceComparison.ts
@@ -0,0 +1,181 @@
+/**
+ * Shared fetch layer for the fork↔parent workspace comparison
+ * (`compareWorkspaces`). The comparison is the expensive tally the fork banner,
+ * the compare page, and the chat `diff` tool all need — routing every consumer
+ * through this module means concurrent tolerant requests coalesce and a
+ * consumer that accepts a slightly stale result (`maxAgeMs`) can reuse the
+ * fetch another surface just made instead of recomputing it.
+ */
+import { get } from 'svelte/store'
+import { WorkspaceService, type WorkspaceComparison } from '$lib/gen'
+import { usersWorkspaceStore } from '$lib/stores'
+
+interface CacheEntry {
+	fetchedAt: number
+	generation: number
+	comparison: WorkspaceComparison
+}
+
+interface InflightEntry {
+	startedAt: number
+	generation: number
+	promise: Promise<WorkspaceComparison>
+}
+
+const cache = new Map<string, CacheEntry>()
+const inflight = new Map<string, InflightEntry>()
+// Millisecond timestamps collide under concurrency — ordering between
+// requests rides on this monotonic generation instead.
+let requestGeneration = 0
+// Per-WORKSPACE floor: any request started at or below this generation is
+// pre-invalidation and must neither be joined nor land in the cache. Keyed by
+// workspace id (either side of a pair), so even requests the inflight map no
+// longer tracks are fenced.
+const invalidGenFloor = new Map<string, number>()
+// Raised when the authenticated identity changes — fences EVERY earlier
+// request at once, including ones whose workspace ids nothing tracks anymore.
+let globalGenFloor = 0
+
+function generationFloor(parentWorkspaceId: string, forkWorkspaceId: string): number {
+	return Math.max(
+		globalGenFloor,
+		invalidGenFloor.get(parentWorkspaceId) ?? 0,
+		invalidGenFloor.get(forkWorkspaceId) ?? 0
+	)
+}
+
+// Comparisons are permission-filtered per user but keyed only by workspace
+// pair — an SPA logout/login must never serve one account's tallies (or let
+// its in-flight fetches land) for another.
+let cacheOwner: string | undefined = undefined
+
+function ensureCacheOwner(): void {
+	const owner = get(usersWorkspaceStore)?.email
+	if (owner === cacheOwner) return
+	cacheOwner = owner
+	cache.clear()
+	inflight.clear()
+	invalidGenFloor.clear()
+	globalGenFloor = requestGeneration
+}
+// Comparisons are big; keep only the few pairs a session actually browses.
+const MAX_CACHE_ENTRIES = 8
+
+function key(parentWorkspaceId: string, forkWorkspaceId: string): string {
+	return `${parentWorkspaceId}:${forkWorkspaceId}`
+}
+
+/**
+ * Fetch (or reuse) the comparison of `forkWorkspaceId` against its parent.
+ * `maxAgeMs` (default 0) is the oldest result the caller accepts — applied to
+ * cached results AND to joining an in-flight request (a request is as old as
+ * its start). `maxAgeMs: 0` therefore always issues a fresh fetch: a caller
+ * forcing freshness after a mutation must never adopt a request that began
+ * before the mutation.
+ */
+export async function fetchWorkspaceComparison(
+	parentWorkspaceId: string,
+	forkWorkspaceId: string,
+	opts: { maxAgeMs?: number } = {}
+): Promise<WorkspaceComparison> {
+	return (await fetchWorkspaceComparisonMeta(parentWorkspaceId, forkWorkspaceId, opts)).comparison
+}
+
+export interface WorkspaceComparisonMeta {
+	comparison: WorkspaceComparison
+	/** When the underlying request STARTED — a reused result is as old as its
+	 * fetch, not as old as the reuse. Callers layering their own freshness
+	 * window must age from this, or windows compound. */
+	fetchedAt: number
+	/** Pass to `isComparisonCurrent` to learn whether an invalidation has
+	 * outdated this result since. */
+	generation: number
+}
+
+/** True while no `invalidateWorkspaceComparison` (or identity change) has
+ * fenced the request that produced `generation`. */
+export function isComparisonCurrent(
+	parentWorkspaceId: string,
+	forkWorkspaceId: string,
+	generation: number
+): boolean {
+	ensureCacheOwner()
+	return generation > generationFloor(parentWorkspaceId, forkWorkspaceId)
+}
+
+export async function fetchWorkspaceComparisonMeta(
+	parentWorkspaceId: string,
+	forkWorkspaceId: string,
+	opts: { maxAgeMs?: number } = {}
+): Promise<WorkspaceComparisonMeta> {
+	ensureCacheOwner()
+	const k = key(parentWorkspaceId, forkWorkspaceId)
+	const maxAgeMs = opts.maxAgeMs ?? 0
+	const cached = cache.get(k)
+	if (cached && Date.now() - cached.fetchedAt < maxAgeMs) {
+		return {
+			comparison: cached.comparison,
+			fetchedAt: cached.fetchedAt,
+			generation: cached.generation
+		}
+	}
+	const pending = inflight.get(k)
+	if (
+		pending &&
+		maxAgeMs > 0 &&
+		Date.now() - pending.startedAt < maxAgeMs &&
+		pending.generation > generationFloor(parentWorkspaceId, forkWorkspaceId)
+	) {
+		return {
+			comparison: await pending.promise,
+			fetchedAt: pending.startedAt,
+			generation: pending.generation
+		}
+	}
+	const startedAt = Date.now()
+	const generation = ++requestGeneration
+	const run = (async () => {
+		const comparison = await WorkspaceService.compareWorkspaces({
+			workspace: parentWorkspaceId,
+			targetWorkspaceId: forkWorkspaceId
+		})
+		// A superseded (older-generation) or pre-invalidation request must not
+		// clobber a newer result.
+		const existing = cache.get(k)
+		if (
+			generation > generationFloor(parentWorkspaceId, forkWorkspaceId) &&
+			(!existing || existing.generation < generation)
+		) {
+			cache.delete(k)
+			cache.set(k, { fetchedAt: startedAt, generation, comparison })
+			// Insertion-ordered Map: evict the oldest pairs past the cap.
+			while (cache.size > MAX_CACHE_ENTRIES) {
+				cache.delete(cache.keys().next().value as string)
+			}
+		}
+		return comparison
+	})()
+	inflight.set(k, { startedAt, generation, promise: run })
+	try {
+		return { comparison: await run, fetchedAt: startedAt, generation }
+	} finally {
+		if (inflight.get(k)?.promise === run) inflight.delete(k)
+	}
+}
+
+/** Drop cached comparisons involving this workspace on EITHER side — a
+ * deploy in a parent moves its forks' tallies too. Also fences in-flight
+ * requests: nobody new joins them and their late results never land in the
+ * cache. (Workspace ids cannot contain ':', so the matches are exact.) */
+export function invalidateWorkspaceComparison(workspaceId: string): void {
+	const matches = (k: string) => k.startsWith(`${workspaceId}:`) || k.endsWith(`:${workspaceId}`)
+	for (const k of [...cache.keys()]) {
+		if (matches(k)) cache.delete(k)
+	}
+	for (const k of [...inflight.keys()]) {
+		if (matches(k)) inflight.delete(k)
+	}
+	// Fence EVERY request started before this point — including ones the
+	// inflight map no longer tracks (superseded requests still resolve late).
+	invalidGenFloor.set(workspaceId, requestGeneration)
+}
diff --git a/frontend/src/lib/workspaceDrafts.svelte.ts b/frontend/src/lib/workspaceDrafts.svelte.ts
index 32345bd103..52e96ce7a1 100644
--- a/frontend/src/lib/workspaceDrafts.svelte.ts
+++ b/frontend/src/lib/workspaceDrafts.svelte.ts
@@ -47,6 +47,9 @@ export interface DraftItem {
 	 * `allUsers` listing surfaces other users' rows as `false` (view-only).
 	 * Defaults to true when the field is absent (older backend). */
 	mine: boolean
+	/** Server timestamp of the draft row, bumped on every draft update — a
+	 * reliable per-row change marker for caches keyed on draft content. */
+	created_at: string
 	/** Only set when listed with a `compareToWorkspace` (a fork comparing against
 	 * its parent): true when this draft is identical to the parent's — cloned in
 	 * on fork and never edited here. Undefined when no comparison was requested. */
@@ -74,6 +77,7 @@ export async function getDraftItems(
 		can_write: r.can_write ?? true,
 		draft_users: r.draft_users,
 		mine: r.mine ?? true,
+		created_at: r.created_at,
 		unchanged_from_parent: r.unchanged_from_parent
 	}))
 }
@@ -87,6 +91,13 @@ export function invalidateWorkspaceDrafts(workspace: string | undefined): void {
 	versions[workspace] = (versions[workspace] ?? 0) + 1
 }
 
+/** Current invalidation version for a workspace. Non-reactive read — callers
+ * compare it against a value captured earlier to detect Server-Draft mutations
+ * (any deploy/discard/draft write that called `invalidateWorkspaceDrafts`). */
+export function getWorkspaceDraftsVersion(workspace: string): number {
+	return versions[workspace] ?? 0
+}
+
 export interface WorkspaceDraftsHandle {
 	readonly items: DraftItem[]
 	readonly count: number
diff --git a/frontend/src/routes/(root)/(logged)/forks/compare/+page.svelte b/frontend/src/routes/(root)/(logged)/forks/compare/+page.svelte
index 13021ed4d1..152948b190 100644
--- a/frontend/src/routes/(root)/(logged)/forks/compare/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/forks/compare/+page.svelte
@@ -2,6 +2,7 @@
 	import CompareWorkspaces from '$lib/components/CompareWorkspaces.svelte'
 	import CompareDrafts from '$lib/components/CompareDrafts.svelte'
 	import { WorkspaceService, type WorkspaceComparison } from '$lib/gen'
+	import { fetchWorkspaceComparison } from '$lib/workspaceComparison'
 	import {
 		archiveSessionsForWorkspace,
 		deleteSessionsForWorkspace,
@@ -194,10 +195,7 @@
 		}
 
 		try {
-			const result = await WorkspaceService.compareWorkspaces({
-				workspace: parentWorkspaceId,
-				targetWorkspaceId: currentWorkspaceId
-			})
+			const result = await fetchWorkspaceComparison(parentWorkspaceId, currentWorkspaceId)
 
 			comparison = result
 		} catch (e) {

From 2ce21c9ef86c608d73e12a7e278d2f328e06b6fa Mon Sep 17 00:00:00 2001
From: hugocasa <hugo@casademont.ch>
Date: Tue, 21 Jul 2026 19:07:52 +0200
Subject: [PATCH 101/171] feat(git-sync): enable per-item promotion mode on dev
 workspaces (#10205)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* feat(git-sync): enable per-item promotion mode on dev workspaces

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* style: keep unrelated git-sync Alert copy at its original wrapping

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(git-sync): fall back to parent_path on empty deploy path + bump ee ref

computeGitSyncDeployBranch used ?? so a backend-serialized empty path (rename out of the repo filter) skipped the deploy branch and could commit to the tracked base; use || to fall back to parent_path like the backend. Bumps ee-repo-ref for the single-object promotion_open_prs fix (windmill-ee-private#679).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(git-sync): route dev-promotion non-branchable objects off the tracked base

user/group objects (and any unresolvable ref) returned null in promotion mode, so a dev-workspace deploy pushed them straight to the parent's tracked branch. Fall back to the dev's env-label branch instead; the backend opens no PR for them (isolated, not promoted).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(git-sync): dev-workspace promotion via a toggle on the inherited repo

A dev workspace reuses the single repo it inherited from prod: a 'Promote to prod via Git' toggle flips it between sync mode (deploys to the dev branch) and promotion mode (per-item wm_deploy/** PRs to prod), with a per-item/per-folder sub-toggle. Removes the redundant separate-promotion-repo setup for dev workspaces.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* test(git-sync): dev-promotion regression test + widen git_sync_e2e path filter

Adds a CLI integration case covering dev-workspace promotion (script -> wm_deploy branch; user/group -> env-label branch, main never touched). Widens the git-sync-test.yml relevance filter to the deploy-branch derivation, git-sync guard, and CLI git-deploy files so the e2e suite runs on PRs like this one.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(git-sync): gate dev promotion toggle on EE, fix card mode + workflow path filters

Codex review: (1) show the dev promotion toggle only under an active EE license and revert the optimistic save if the backend rejects it; (2) derive the dev card's display mode from use_individual_branch so promotion copy shows in promotion mode; (3) mirror the new relevance paths into the workflow's top-level push/pull_request filters so it actually triggers.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(git-sync): only use the single-card dev promotion UX when the dev has one repo

Codex review: an attached dev workspace keeps its own repositories rather than inheriting prod's. Gating the single-card + toggle + hidden-secondaries UX on repositories.length <= 1 makes a multi-repo attached dev fall back to the normal layout, so no active repo is hidden and an unrelated repo isn't presented as prod's promotion target.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(git-sync): runtime EE-plan gate for promotion mode, consistent with auto-pull/PR

Codex review: promotion mode only had the CE compile rejection, while auto-pull and PR creation runtime-gate on the active plan (check_git_sync_ee_license). Add check_promotion_license and call it from both edit_git_sync_config and edit_git_sync_repository, plus the matching CE rejection on edit_git_sync_config so the two endpoints are symmetric. Promotion is now gated like every other git-sync EE setting.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(git-sync): dev promotion must reuse the parent workspace's repository

Codex review: repository count doesn't prove a dev inherited prod's repo — an attached dev keeps its own. check_dev_promotion_targets_parent_repo resolves the promotion repo's URL and rejects enabling promotion unless it matches one the parent (prod) tracks, so branches/PRs can't target an unrelated repository. Called from both git-sync edit endpoints.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(git-sync): dev promotion save-time check uses shared parent-repo matcher (url+branch)

Delegates to windmill_common::git_sync_ee::dev_promotion_target_matches_parent so the settings gate and the deploy-time safety net share one url+branch identity check. Bumps ee-repo-ref for the EE deploy-time enforcement.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore: bump ee-repo-ref for private resolve_repo_url_and_branch

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore: bump ee-repo-ref for promotion-target matcher authz doc

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore(git-sync): bump hub scripts to gitsync-cli versions, fix promotion tooltips

Point LATEST_GIT_SYNC_SCRIPT_PATH (28790 -> 28796) and
GIT_SYNC_PULL_SCRIPT_PATH / gitInitRepo (28789 -> 28795) at the hub
versions pinning windmill-cli@1.763.1-gitsync.0, which carries the
dev-workspace promotion routing. Slugs unchanged, so the GitHub-App
token check and hub script cache are unaffected.

Tooltips: enabling promotion pushes a PR-ready wm_deploy/** branch;
Windmill only opens the pull request itself when automatic pull
requests are enabled. Reword both toggles to stop promising a PR.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(git-sync): dev promotion mirrors to the env-label branch, PR toggles exclusive by branch type

Bump ee-repo-ref for the dispatcher changes: a promotion dev's deploys
now also push to its env-label branch (one extra mirror job per batch,
users/groups mirror-only), and `fork_open_prs` no longer applies to a
dev in promotion mode where `promotion_open_prs` governs.

Frontend: the fork-PR toggle tooltip states its actual coverage
(wm-fork/** and the dev branch of a dev workspace) and that a promotion
dev's own pull request toggle takes over for wm_deploy/** branches.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(git-sync): reject dev promotion on pre-28796 pinned sync scripts

An older pinned sync script bundles a CLI that force-disables per-item
branches on every fork, so enabling promotion on a dev workspace with
such a pin would silently keep deploying to the env-label branch. Both
git-sync edit endpoints now reject the combination with an actionable
error; the EE dispatchers (via ee-repo-ref bump) demote inherited
configs to promotion-off semantics so markers, branch keys and the
mirror match the branch the CLI actually pushes. Roots and auto-managed
repositories are unaffected.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(git-sync): serialize dev promotion toggle saves

The promotion and per-folder toggles persist immediately via whole-repo
saves; leaving them interactive while one is pending lets rapid flips
race, and the earlier save (enabling runs extra backend checks) can
commit last, silently reversing the state the UI shows. Both toggles now
disable while a save is in flight.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(git-sync): lock auto-PR toggle during promotion save, rename-out branch routing

Frontend: the automatic-PR toggle is revealed by the promotion toggle's
in-flight save; an edit made mid-save was absorbed into the saved
baseline without reaching the backend. It now disables during that save.

EE (ee-repo-ref bump): dispatcher debounce/concurrency keys and PR
markers follow the CLI's parent_path fallback for rename-out items, so
their wm_deploy/** branches debounce per-branch and open their PR.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore(git-sync): condense comments to durable constraints

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore: update ee-repo-ref to 8bf73f803158bcbf7b8d55a36f4a1ebfcc1bbcd9

This commit updates the EE repository reference after PR #679 was merged in windmill-ee-private.

Previous ee-repo-ref: c2cd718cb53d234f909f485bd7cd43ed9605ffd1

New ee-repo-ref: 8bf73f803158bcbf7b8d55a36f4a1ebfcc1bbcd9

Automated by sync-ee-ref workflow.

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
---
 .github/workflows/git-sync-test.yml           |  12 +-
 ...854b4b727b1fab89e42f2efaf97c63dad6384.json |  28 +++
 backend/ee-repo-ref.txt                       |   2 +-
 .../windmill-api-workspaces/src/workspaces.rs | 161 +++++++++++++++---
 backend/windmill-common/src/workspaces.rs     |   4 +-
 .../windmill-worker/src/result_processor.rs   | 108 ++++++++++--
 cli/src/commands/sync/sync.ts                 |  26 +--
 cli/src/utils/git.ts                          |  42 ++++-
 cli/test/git_unit.test.ts                     |  59 +++++++
 cli/test/gitsync_promotion.test.ts            | 132 ++++++++++++++
 .../git_sync/GitSyncRepositoryCard.svelte     | 100 +++++++++--
 .../components/git_sync/GitSyncSection.svelte |  42 +++--
 frontend/src/lib/hubPaths.json                |   2 +-
 13 files changed, 634 insertions(+), 84 deletions(-)
 create mode 100644 backend/.sqlx/query-079e1dab42a783a1e5e4cba5faa854b4b727b1fab89e42f2efaf97c63dad6384.json

diff --git a/.github/workflows/git-sync-test.yml b/.github/workflows/git-sync-test.yml
index 3c4d37622a..4b99c62eae 100644
--- a/.github/workflows/git-sync-test.yml
+++ b/.github/workflows/git-sync-test.yml
@@ -9,6 +9,10 @@ on:
       - "backend/windmill-api-integration-tests/tests/git_sync*"
       - "backend/ee-repo-ref.txt"
       - "backend/windmill-common/src/workspaces.rs"
+      - "backend/windmill-worker/src/result_processor.rs"
+      - "backend/windmill-api-workspaces/**"
+      - "cli/src/commands/sync/**"
+      - "cli/src/utils/git.ts"
       - "integration_tests/test/git_sync_test.py"
       - ".github/workflows/git-sync-test.yml"
   pull_request:
@@ -18,6 +22,10 @@ on:
       - "backend/windmill-api-integration-tests/tests/git_sync*"
       - "backend/ee-repo-ref.txt"
       - "backend/windmill-common/src/workspaces.rs"
+      - "backend/windmill-worker/src/result_processor.rs"
+      - "backend/windmill-api-workspaces/**"
+      - "cli/src/commands/sync/**"
+      - "cli/src/utils/git.ts"
       - "integration_tests/test/git_sync_test.py"
       - ".github/workflows/git-sync-test.yml"
 
@@ -50,8 +58,8 @@ jobs:
           echo "Changed files:"
           echo "$CHANGED_FILES"
 
-          # Direct git sync file changes — always relevant
-          if echo "$CHANGED_FILES" | grep -qE '^(backend/windmill-git-sync/|backend/windmill-api-integration-tests/tests/git_sync|backend/windmill-common/src/workspaces\.rs|integration_tests/test/git_sync|\.github/workflows/git-sync-test\.yml)'; then
+          # Direct git sync file changes — always relevant.
+          if echo "$CHANGED_FILES" | grep -qE '^(backend/windmill-git-sync/|backend/windmill-worker/src/result_processor\.rs|backend/windmill-api-workspaces/|backend/windmill-api-integration-tests/tests/git_sync|backend/windmill-common/src/workspaces\.rs|cli/src/commands/sync/|cli/src/utils/git\.ts|integration_tests/test/git_sync|\.github/workflows/git-sync-test\.yml)'; then
             echo "should_run=true" >> "$GITHUB_OUTPUT"
             echo "Relevant: direct git sync file changes"
             exit 0
diff --git a/backend/.sqlx/query-079e1dab42a783a1e5e4cba5faa854b4b727b1fab89e42f2efaf97c63dad6384.json b/backend/.sqlx/query-079e1dab42a783a1e5e4cba5faa854b4b727b1fab89e42f2efaf97c63dad6384.json
new file mode 100644
index 0000000000..8c58b6cf54
--- /dev/null
+++ b/backend/.sqlx/query-079e1dab42a783a1e5e4cba5faa854b4b727b1fab89e42f2efaf97c63dad6384.json
@@ -0,0 +1,28 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT parent_workspace_id, is_dev_workspace FROM workspace WHERE id = $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "parent_workspace_id",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "is_dev_workspace",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      true,
+      false
+    ]
+  },
+  "hash": "079e1dab42a783a1e5e4cba5faa854b4b727b1fab89e42f2efaf97c63dad6384"
+}
diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index d0497c1e02..efc5187476 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-aaa6cb89b05b76139252c64f057e53b94d12ac60
+8bf73f803158bcbf7b8d55a36f4a1ebfcc1bbcd9
diff --git a/backend/windmill-api-workspaces/src/workspaces.rs b/backend/windmill-api-workspaces/src/workspaces.rs
index 99fb33e417..f20fce538d 100644
--- a/backend/windmill-api-workspaces/src/workspaces.rs
+++ b/backend/windmill-api-workspaces/src/workspaces.rs
@@ -826,21 +826,37 @@ async fn reject_dev_label_matching_tracked_branch(
     Ok(())
 }
 
-/// Reject parent-only git-sync settings on a fork workspace. Auto-pull, fork
-/// PRs, and promotion mode are all configured at the parent: repo → fork sync is
-/// routed by the parent's webhook/poller (`sync_forks`), a fork-owned auto-pull
-/// would register a second webhook on the same GitHub repo per fork, and a
-/// fork's deploys always go to its `wm-fork/**` branch so a promotion repo could
-/// never take effect there.
+/// Reject parent-only git-sync settings on a fork workspace. Auto-pull and fork
+/// PRs are configured at the parent: repo → fork sync is routed by the parent's
+/// webhook/poller (`sync_forks`), and a fork-owned auto-pull would register a
+/// second webhook on the same GitHub repo per fork. Promotion mode is rejected
+/// on throwaway forks (their deploys always go to their `wm-fork/**` branch, so
+/// a promotion repo could never take effect) but allowed on a **dev workspace**,
+/// which deploys per-item `wm_deploy/**` branches that promote into the parent.
 async fn reject_parent_only_git_sync_settings_on_fork<'a>(
     db: &DB,
     w_id: &str,
-    mut repos: impl Iterator<Item = &'a windmill_common::workspaces::GitRepositorySettings>,
+    repos: impl Iterator<Item = &'a windmill_common::workspaces::GitRepositorySettings>,
 ) -> Result<()> {
-    let offending = repos.find_map(|r| {
+    let row = sqlx::query!(
+        "SELECT parent_workspace_id, is_dev_workspace FROM workspace WHERE id = $1",
+        w_id
+    )
+    .fetch_optional(db)
+    .await?;
+    let is_fork = row
+        .as_ref()
+        .and_then(|r| r.parent_workspace_id.as_ref())
+        .is_some()
+        || w_id.starts_with(windmill_common::workspaces::WM_FORK_PREFIX);
+    if !is_fork {
+        return Ok(());
+    }
+    let is_dev = row.map(|r| r.is_dev_workspace).unwrap_or(false);
+    let offending = repos.into_iter().find_map(|r| {
         if r.auto_pull.as_ref().is_some_and(|a| a.enabled) {
             Some("Auto-pull")
-        } else if r.use_individual_branch.unwrap_or(false) {
+        } else if r.use_individual_branch.unwrap_or(false) && !is_dev {
             Some("Promotion mode")
         } else if r.fork_open_prs {
             Some("Opening PRs for fork deploys")
@@ -848,17 +864,7 @@ async fn reject_parent_only_git_sync_settings_on_fork<'a>(
             None
         }
     });
-    let Some(offending) = offending else {
-        return Ok(());
-    };
-    let parent = sqlx::query_scalar!(
-        "SELECT parent_workspace_id FROM workspace WHERE id = $1",
-        w_id
-    )
-    .fetch_optional(db)
-    .await?
-    .flatten();
-    if parent.is_some() || w_id.starts_with(windmill_common::workspaces::WM_FORK_PREFIX) {
+    if let Some(offending) = offending {
         return Err(Error::BadRequest(format!(
             "{offending} cannot be configured on a fork workspace: it is managed from the parent workspace's git sync settings"
         )));
@@ -3130,6 +3136,95 @@ async fn check_open_prs_license<'a>(
     Ok(())
 }
 
+/// Promotion mode (`use_individual_branch`: per-item `wm_deploy/**` deploy
+/// branches) is an EE feature; runtime-gate it like auto-pull and PR creation
+/// so an enterprise binary without an active plan can't enable it via either
+/// git-sync edit endpoint.
+#[cfg(feature = "enterprise")]
+async fn check_promotion_license<'a>(
+    mut repos: impl Iterator<Item = &'a windmill_common::workspaces::GitRepositorySettings>,
+) -> Result<()> {
+    if repos.any(|r| r.use_individual_branch.unwrap_or(false)) {
+        check_git_sync_ee_license("Promotion mode").await?;
+    }
+    Ok(())
+}
+
+/// Promotion on a dev workspace needs the dev-aware sync script (hub >= 28796):
+/// an older pinned script bundles a CLI that force-disables per-item branches
+/// on every fork, so enabling promotion would silently keep deploying to the
+/// env-label branch. Reject with an actionable error instead (the dispatcher
+/// demotes inherited configs the same way). Roots run promotion on any script
+/// version, and auto-managed repositories (no pin) always use the latest.
+#[cfg(feature = "enterprise")]
+async fn check_dev_promotion_script_version<'a>(
+    db: &DB,
+    w_id: &str,
+    repos: impl Iterator<Item = &'a windmill_common::workspaces::GitRepositorySettings>,
+) -> Result<()> {
+    let mut offending: Option<String> = None;
+    for r in repos {
+        if !r.use_individual_branch.unwrap_or(false) {
+            continue;
+        }
+        if !r.is_script_meets_min_version(28796)? {
+            offending = Some(r.effective_script_path().to_string());
+            break;
+        }
+    }
+    let Some(offending) = offending else {
+        return Ok(());
+    };
+    let is_dev = sqlx::query!(
+        "SELECT parent_workspace_id, is_dev_workspace FROM workspace WHERE id = $1",
+        w_id
+    )
+    .fetch_optional(db)
+    .await?
+    .map(|r| r.is_dev_workspace)
+    .unwrap_or(false);
+    if !is_dev {
+        return Ok(());
+    }
+    Err(Error::BadRequest(format!(
+        "Promotion mode on a dev workspace requires git sync script version 28796 or newer, \
+         but this repository pins '{offending}'. Update the pinned sync script (or reset it to \
+         auto-managed) first."
+    )))
+}
+
+/// A dev workspace's promotion must target its parent ("prod") workspace's own
+/// git repository (same URL and branch) — that is what "promote to prod" means.
+/// A fork-created dev inherits prod's repo; an **attached** dev keeps its own,
+/// which may be unrelated. Reject enabling promotion on a repo the parent does
+/// not track so the UI can't present an unrelated repo as prod's target. The
+/// deploy path re-checks the same invariant (a resource edit could break it
+/// after save), via the shared `dev_promotion_target_matches_parent`.
+#[cfg(all(feature = "enterprise", feature = "private"))]
+async fn check_dev_promotion_targets_parent_repo<'a>(
+    db: &DB,
+    w_id: &str,
+    repos: impl Iterator<Item = &'a windmill_common::workspaces::GitRepositorySettings>,
+) -> Result<()> {
+    for r in repos.filter(|r| r.use_individual_branch.unwrap_or(false)) {
+        if !windmill_common::git_sync_ee::dev_promotion_target_matches_parent(
+            db,
+            w_id,
+            &r.git_repo_resource_path,
+        )
+        .await?
+        {
+            return Err(Error::BadRequest(
+                "Promotion mode on a dev workspace must reuse the parent workspace's git repository \
+                 (same URL and branch), but this repository is not one the parent tracks — promotion \
+                 would target a repository the parent does not sync with."
+                    .to_string(),
+            ));
+        }
+    }
+    Ok(())
+}
+
 #[cfg(feature = "enterprise")]
 async fn check_git_sync_access(_db: &DB, _w_id: &str) -> Result<()> {
     Ok(())
@@ -3274,6 +3369,25 @@ async fn edit_git_sync_config(
         }
         #[cfg(feature = "enterprise")]
         check_open_prs_license(git_sync_settings.repositories.iter()).await?;
+        #[cfg(feature = "enterprise")]
+        check_promotion_license(git_sync_settings.repositories.iter()).await?;
+        #[cfg(feature = "enterprise")]
+        check_dev_promotion_script_version(&db, &w_id, git_sync_settings.repositories.iter())
+            .await?;
+        #[cfg(all(feature = "enterprise", feature = "private"))]
+        check_dev_promotion_targets_parent_repo(&db, &w_id, git_sync_settings.repositories.iter())
+            .await?;
+        // Promotion mode: EE only (mirrors edit_git_sync_repository).
+        #[cfg(not(feature = "enterprise"))]
+        if git_sync_settings
+            .repositories
+            .iter()
+            .any(|r| r.use_individual_branch.unwrap_or(false))
+        {
+            return Err(Error::BadRequest(
+                "Promotion mode is an Enterprise Edition feature".to_string(),
+            ));
+        }
         // Preserve server-owned auto-pull state (webhook id/secret, synced sha, last
         // status) that the redacted GET response omits — otherwise a whole-config
         // save from the UI would drop the webhook secret (breaking delivery) or
@@ -3486,6 +3600,13 @@ async fn edit_git_sync_repository(
     }
     #[cfg(feature = "enterprise")]
     check_open_prs_license(std::iter::once(&new_config.repository)).await?;
+    #[cfg(feature = "enterprise")]
+    check_promotion_license(std::iter::once(&new_config.repository)).await?;
+    #[cfg(feature = "enterprise")]
+    check_dev_promotion_script_version(&db, &w_id, std::iter::once(&new_config.repository)).await?;
+    #[cfg(all(feature = "enterprise", feature = "private"))]
+    check_dev_promotion_targets_parent_repo(&db, &w_id, std::iter::once(&new_config.repository))
+        .await?;
 
     // Promotion mode: EE only
     #[cfg(not(feature = "enterprise"))]
diff --git a/backend/windmill-common/src/workspaces.rs b/backend/windmill-common/src/workspaces.rs
index f1679677fb..5be60363b7 100644
--- a/backend/windmill-common/src/workspaces.rs
+++ b/backend/windmill-common/src/workspaces.rs
@@ -167,7 +167,7 @@ pub enum ObjectType {
     DatatableMigration,
 }
 
-pub const LATEST_GIT_SYNC_SCRIPT_PATH: &str = "hub/28790/sync-script-to-git-repo-windmill";
+pub const LATEST_GIT_SYNC_SCRIPT_PATH: &str = "hub/28796/sync-script-to-git-repo-windmill";
 
 /// Hub script that applies a repository's state back into a workspace
 /// (the repo → Windmill / "pull" direction). Same script the UI runs from
@@ -175,7 +175,7 @@ pub const LATEST_GIT_SYNC_SCRIPT_PATH: &str = "hub/28790/sync-script-to-git-repo
 /// ignores the slug, so the slug is kept free of characters that would be
 /// percent-encoded into the run URL (a `:` becomes `%3A`, which some hardened
 /// reverse proxies reject as double-encoding when the client re-encodes it).
-pub const GIT_SYNC_PULL_SCRIPT_PATH: &str = "hub/28789/git-sync-init-repository-windmill";
+pub const GIT_SYNC_PULL_SCRIPT_PATH: &str = "hub/28795/git-sync-init-repository-windmill";
 
 /// Prefix used to identify fork workspaces. A workspace whose id starts with this string is a
 /// fork of another workspace.
diff --git a/backend/windmill-worker/src/result_processor.rs b/backend/windmill-worker/src/result_processor.rs
index c2645f7cde..aeb9fdb329 100644
--- a/backend/windmill-worker/src/result_processor.rs
+++ b/backend/windmill-worker/src/result_processor.rs
@@ -908,8 +908,10 @@ async fn maybe_reconcile_git_sync_auto_pull(
 /// derivation: a dev workspace deploys to its environment-label branch
 /// (`dev`/`staging`), other fork workspaces to `wm-fork/<base>/<id-suffix>`,
 /// else the promotion `wm_deploy/**` formula (per-folder or per-item form).
-/// `None` when the deploy stays on the base branch (workspace-wide mode) and
-/// has no PR to open.
+/// A dev workspace in promotion mode is the exception: it takes the promotion
+/// `wm_deploy/**` formula (per-item PRs into the parent) instead of its label
+/// branch. `None` when the deploy stays on the base branch (workspace-wide
+/// mode) and has no PR to open.
 #[cfg(all(feature = "enterprise", feature = "private"))]
 fn git_sync_deploy_pr_head_branch(
     workspace_id: &str,
@@ -922,18 +924,23 @@ fn git_sync_deploy_pr_head_branch(
     item_parent_path: &str,
     path_type: &str,
 ) -> Option<String> {
-    if dev_workspace_label.is_some() {
-        return Some(windmill_common::workspaces::dev_workspace_branch(
-            dev_workspace_label,
-        ));
-    }
-    let is_fork = parent_workspace_id.is_some()
-        || workspace_id.starts_with(windmill_common::workspaces::WM_FORK_PREFIX);
-    if is_fork {
-        let suffix = workspace_id
-            .strip_prefix(windmill_common::workspaces::WM_FORK_PREFIX)
-            .unwrap_or(workspace_id);
-        return Some(format!("wm-fork/{base}/{suffix}"));
+    let is_dev = dev_workspace_label.is_some();
+    // A dev workspace with promotion on falls through to the wm_deploy/**
+    // formula below; the label/fork branches only apply when promotion is off.
+    if !(is_dev && use_individual_branch) {
+        if is_dev {
+            return Some(windmill_common::workspaces::dev_workspace_branch(
+                dev_workspace_label,
+            ));
+        }
+        let is_fork = parent_workspace_id.is_some()
+            || workspace_id.starts_with(windmill_common::workspaces::WM_FORK_PREFIX);
+        if is_fork {
+            let suffix = workspace_id
+                .strip_prefix(windmill_common::workspaces::WM_FORK_PREFIX)
+                .unwrap_or(workspace_id);
+            return Some(format!("wm-fork/{base}/{suffix}"));
+        }
     }
     if !use_individual_branch {
         return None;
@@ -2220,4 +2227,77 @@ mod git_sync_pr_tests {
             Some("dev".to_string())
         );
     }
+
+    #[test]
+    fn dev_workspace_promotion_uses_wm_deploy_branch() {
+        // Promotion on: a dev workspace gets per-item wm_deploy/** branches
+        // (namespaced by its own id), not its env-label branch.
+        assert_eq!(
+            git_sync_deploy_pr_head_branch(
+                "dev",
+                Some("prod"),
+                Some("dev"),
+                "main",
+                true,
+                false,
+                "f/folder/my_script",
+                "",
+                "script"
+            ),
+            Some("wm_deploy/dev/script/f__folder__my_script".to_string())
+        );
+        // Per-folder form still honored for a promotion dev workspace.
+        assert_eq!(
+            git_sync_deploy_pr_head_branch(
+                "dev",
+                Some("prod"),
+                Some("dev"),
+                "main",
+                true,
+                true,
+                "f/folder/my_script",
+                "",
+                "script"
+            ),
+            Some("wm_deploy/dev/f__folder".to_string())
+        );
+        // Promotion off: the env-label branch still wins.
+        assert_eq!(
+            git_sync_deploy_pr_head_branch(
+                "dev",
+                Some("prod"),
+                Some("dev"),
+                "main",
+                false,
+                false,
+                "f/x/y",
+                "",
+                "script"
+            ),
+            Some("dev".to_string())
+        );
+    }
+
+    #[test]
+    fn dev_promotion_user_group_items_open_no_pr() {
+        // User/group objects get no wm_deploy branch even on a dev workspace; the
+        // CLI isolates them to the env-label branch, so the backend opens no PR
+        // (never a PR from the env-label branch into the parent for these).
+        for path_type in ["user", "group"] {
+            assert_eq!(
+                git_sync_deploy_pr_head_branch(
+                    "dev",
+                    Some("prod"),
+                    Some("dev"),
+                    "main",
+                    true,
+                    false,
+                    "u/alice",
+                    "",
+                    path_type
+                ),
+                None
+            );
+        }
+    }
 }
diff --git a/cli/src/commands/sync/sync.ts b/cli/src/commands/sync/sync.ts
index 29d83862e4..2ddb4833b8 100644
--- a/cli/src/commands/sync/sync.ts
+++ b/cli/src/commands/sync/sync.ts
@@ -2865,17 +2865,20 @@ export async function pull(
     }
     const clonedBranchName = getCurrentGitBranch() ?? "main";
 
-    // Fork / dev workspaces force-disable use_individual_branch / group_by_folder
-    // (1:1 with the hub script's inner()). Dev workspaces have a prefix-less id, so
-    // detect them via the parent-workspace id the backend passes.
+    // Throwaway forks force-disable use_individual_branch / group_by_folder
+    // (1:1 with the hub script's inner()). A dev workspace is the exception: it
+    // honors promotion mode and gets per-item wm_deploy/** branches. Dev
+    // workspaces have a prefix-less id, so detect them via the environment label
+    // the backend passes with the deploy.
     const targetIsFork = isForkWorkspace(
       workspace.workspaceId,
       opts.parentWorkspaceId,
     );
-    const useIndividualBranch = targetIsFork
+    const forceOffPromotion = targetIsFork && !opts.devWorkspaceLabel;
+    const useIndividualBranch = forceOffPromotion
       ? false
       : !!opts.useIndividualBranch;
-    const groupByFolder = targetIsFork ? false : !!opts.groupByFolder;
+    const groupByFolder = forceOffPromotion ? false : !!opts.groupByFolder;
 
     // Fork-of-a-fork: when the parent workspace is itself a fork, root the new
     // branch on the parent's fork branch (the content this fork diverged from).
@@ -3447,13 +3450,14 @@ export async function gitDeploy(
     }
   }
 
-  // Fork / dev workspaces force-disable use_individual_branch / group_by_folder
-  // (1:1 with the hub script's inner()): they always sync to their own
-  // wm-fork/<branch>/<id> branch, and — critically — that disabling also
-  // flips the include/promotion derivation below. Dev workspaces have a
-  // prefix-less id, so detect them via the parent-workspace id too.
+  // Throwaway forks force-disable use_individual_branch / group_by_folder (1:1
+  // with the hub script's inner()): they always sync to their own
+  // wm-fork/<branch>/<id> branch, and — critically — that disabling also flips
+  // the include/promotion derivation below. A dev workspace is the exception: it
+  // honors promotion mode, detected via the environment label the backend passes.
   const isFork = isForkWorkspace(opts.workspace ?? "", opts.parentWorkspaceId);
-  const useIndividualBranch = isFork ? false : !!opts.useIndividualBranch;
+  const useIndividualBranch =
+    isFork && !opts.devWorkspaceLabel ? false : !!opts.useIndividualBranch;
 
   // Derive the include filters from the deployed items (replaces the hub
   // script's regexFromPath + per-kind --include-* construction).
diff --git a/cli/src/utils/git.ts b/cli/src/utils/git.ts
index 441133afe4..da1ac14414 100644
--- a/cli/src/utils/git.ts
+++ b/cli/src/utils/git.ts
@@ -107,10 +107,12 @@ export interface GitSyncDeployItem {
   commit_msg?: string;
 }
 
-// A fork or dev workspace syncs to its own wm-fork/<branch>/<id> branch. The hub
-// script force-disables use_individual_branch / group_by_folder for these (that
-// disabling also changes the include/promotion derivation — so callers must apply
-// it BEFORE deriving includes, not just for branch naming).
+// A throwaway fork syncs to its own wm-fork/<branch>/<id> branch. The hub script
+// force-disables use_individual_branch / group_by_folder for these (that disabling
+// also changes the include/promotion derivation — so callers must apply it BEFORE
+// deriving includes, not just for branch naming). A dev workspace is the exception:
+// with promotion on it keeps use_individual_branch / group_by_folder and gets
+// per-item wm_deploy/** branches like a root workspace.
 //
 // Fork-ness is "has a parent workspace" OR the "wm-fork-" id prefix. Regular forks
 // get an auto-generated `wm-fork-<slug>` id, but dev workspaces keep a custom id
@@ -165,11 +167,28 @@ export function computeGitSyncDeployBranch(params: {
     clonedBranchName,
   } = params;
 
-  if (isForkWorkspace(workspaceId, parentWorkspaceId)) {
+  // A dev workspace in promotion mode falls through to the wm_deploy/** formula
+  // below (per-item/-folder PRs that promote into its parent). Throwaway forks,
+  // and dev workspaces with promotion off, sync to their own wm-fork/<branch>/<id>
+  // (or env-label) branch.
+  const isDevWorkspace = !!devWorkspaceLabel;
+  if (
+    isForkWorkspace(workspaceId, parentWorkspaceId) &&
+    !(isDevWorkspace && useIndividualBranch)
+  ) {
     return forkBranchName(workspaceId, clonedBranchName, devWorkspaceLabel);
   }
 
-  if (items.length === 0) return null;
+  // A dev workspace's deploys must never fall through to the base branch — that
+  // is its parent's tracked branch, so a null here would push dev content
+  // straight to prod. Anything without its own wm_deploy/** branch (user/group
+  // objects, an unresolvable ref) goes to the dev's env-label branch instead.
+  // A root workspace has no such isolation, so its fallback stays null (base).
+  const fallback = isDevWorkspace
+    ? forkBranchName(workspaceId, clonedBranchName, devWorkspaceLabel)
+    : null;
+
+  if (items.length === 0) return fallback;
   const first = items[0];
 
   // `use_individual_branch` disables debouncing, so items is length 1 here.
@@ -178,11 +197,16 @@ export function computeGitSyncDeployBranch(params: {
     first.path_type === "user" ||
     first.path_type === "group"
   ) {
-    return null;
+    return fallback;
   }
 
-  const ref = first.path ?? first.parent_path;
-  if (!ref) return null;
+  // `||` not `??`: the backend serializes a path that no longer matches the repo
+  // filter (a rename out of the included set) as "" with the old path in
+  // parent_path. That "" must fall back to parent_path — mirroring the backend's
+  // `!item_path.is_empty()` derivation. `??` would keep "", return null, and skip
+  // the branch checkout, letting the removal land on the tracked base branch.
+  const ref = first.path || first.parent_path;
+  if (!ref) return fallback;
 
   return groupByFolder
     ? `wm_deploy/${workspaceId}/${ref.split("/").slice(0, 2).join("__")}`
diff --git a/cli/test/git_unit.test.ts b/cli/test/git_unit.test.ts
index 2db2834bd2..9665b8581a 100644
--- a/cli/test/git_unit.test.ts
+++ b/cli/test/git_unit.test.ts
@@ -117,6 +117,50 @@ describe("computeGitSyncDeployBranch", () => {
     ).toBe("staging");
   });
 
+  test("dev workspace in promotion mode -> per-item wm_deploy branch, not the label branch", () => {
+    expect(
+      computeGitSyncDeployBranch({
+        ...base,
+        workspaceId: "staging-ws",
+        parentWorkspaceId: "prod",
+        devWorkspaceLabel: "staging",
+        useIndividualBranch: true,
+        items: [{ path_type: "script", path: "f/foo/bar" }],
+      })
+    ).toBe("wm_deploy/staging-ws/script/f__foo__bar");
+  });
+
+  test("dev promotion user/group objects go to the env-label branch, never the base", () => {
+    // Non-branchable objects must not fall through to null (= the parent's
+    // tracked branch) on a dev workspace — that would push dev content to prod.
+    for (const path_type of ["user", "group"]) {
+      expect(
+        computeGitSyncDeployBranch({
+          ...base,
+          workspaceId: "staging-ws",
+          parentWorkspaceId: "prod",
+          devWorkspaceLabel: "staging",
+          useIndividualBranch: true,
+          items: [{ path_type, path: "u/alice", parent_path: null }],
+        })
+      ).toBe("staging");
+    }
+  });
+
+  test("dev workspace in promotion mode honors group_by_folder", () => {
+    expect(
+      computeGitSyncDeployBranch({
+        ...base,
+        workspaceId: "staging-ws",
+        parentWorkspaceId: "prod",
+        devWorkspaceLabel: "staging",
+        useIndividualBranch: true,
+        groupByFolder: true,
+        items: [{ path_type: "script", path: "f/foo/bar" }],
+      })
+    ).toBe("wm_deploy/staging-ws/f__foo");
+  });
+
   test("use_individual_branch=false -> null (stay on base/main, workspace-wide mode)", () => {
     expect(
       computeGitSyncDeployBranch({
@@ -148,6 +192,21 @@ describe("computeGitSyncDeployBranch", () => {
     ).toBe("wm_deploy/prod/flow/f__x__y");
   });
 
+  test("falls back to parent_path when the backend serializes path as \"\" (rename out of filter)", () => {
+    // The backend emits "" (not null) for a path that no longer matches the repo
+    // filter; it must still get its own branch, not fall through to the base.
+    expect(
+      computeGitSyncDeployBranch({
+        ...base,
+        workspaceId: "staging-ws",
+        parentWorkspaceId: "prod",
+        devWorkspaceLabel: "staging",
+        useIndividualBranch: true,
+        items: [{ path_type: "resource", path: "", parent_path: "f/folder/old" }],
+      })
+    ).toBe("wm_deploy/staging-ws/resource/f__folder__old");
+  });
+
   test("user/group objects never get a dedicated branch", () => {
     expect(
       computeGitSyncDeployBranch({
diff --git a/cli/test/gitsync_promotion.test.ts b/cli/test/gitsync_promotion.test.ts
index 3d362442ac..1eee7508b0 100644
--- a/cli/test/gitsync_promotion.test.ts
+++ b/cli/test/gitsync_promotion.test.ts
@@ -231,6 +231,138 @@ test.skipIf(shouldSkipOnCI())(
   },
 );
 
+/**
+ * Dev-workspace promotion. The backend passes `--dev-workspace-label` +
+ * `--parent-workspace-id` for a dev workspace's deploys; with promotion on it
+ * must behave like a root (per-item `wm_deploy/**`) for branchable objects, and
+ * — critically — non-branchable objects (user/group) must fall back to the dev's
+ * env-label branch, NEVER the cloned base (which for a dev is the parent's
+ * tracked branch, so a leak would push dev content straight to prod).
+ */
+test.skipIf(shouldSkipOnCI())(
+  "git-sync promotion (dev workspace): script -> wm_deploy branch; group -> env-label branch; main never touched",
+  async () => {
+    await withTestBackend(async (backend) => {
+      const ws = backend.workspace; // "test"
+      await addWorkspace(
+        {
+          remote: backend.baseUrl,
+          workspaceId: ws,
+          name: ws,
+          token: backend.token,
+        } as any,
+        { force: true, configDir: backend.testConfigDir },
+      );
+
+      const bareDir = await mkdtemp(join(tmpdir(), "wmill_devpromo_bare_"));
+      execFileSync("git", ["init", "--bare", "--initial-branch=main", bareDir]);
+      const seedDir = await mkdtemp(join(tmpdir(), "wmill_devpromo_seed_"));
+      git(seedDir, "init", "--initial-branch=main");
+      git(seedDir, "config", "user.email", "seed@windmill.dev");
+      git(seedDir, "config", "user.name", "seed");
+      await writeFile(join(seedDir, "README.md"), "# dev promo\n");
+      git(seedDir, "add", "-A");
+      git(seedDir, "commit", "-m", "seed");
+      git(seedDir, "remote", "add", "origin", `file://${bareDir}`);
+      git(seedDir, "push", "-u", "origin", "main");
+      const seedMain = remoteHead(bareDir, "main");
+
+      await backend.apiRequest!(`/api/w/${ws}/folders/create`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ name: "promo", owners: [], extra_perms: {} }),
+      });
+      await backend.apiRequest!(`/api/w/${ws}/scripts/create`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          path: "f/promo/foo",
+          summary: "",
+          description: "",
+          content: "export async function main() { return 1 }",
+          language: "bun",
+        }),
+      });
+      await backend.apiRequest!(`/api/w/${ws}/resources/create`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          path: "u/test/devpromo_repo",
+          resource_type: "git_repository",
+          value: { url: `file://${bareDir}`, branch: "main", token: "" },
+        }),
+      });
+      await backend.updateGitSyncConfig!({
+        git_sync_settings: {
+          repositories: [
+            {
+              git_repo_resource_path: "u/test/devpromo_repo",
+              script_path: "f/**",
+              use_individual_branch: true,
+              group_by_folder: false,
+              settings: { include_path: ["f/**", "g/**"], include_type: ["script", "group"] },
+            },
+          ],
+        },
+      });
+
+      // The dev flags the backend passes with every dev-workspace deploy.
+      const devFlags = ["--dev-workspace-label", "dev", "--parent-workspace-id", "prod"];
+      const commitAndPush = (work: string) => {
+        git(work, "config", "user.email", "test@windmill.dev");
+        git(work, "config", "user.name", "test");
+        git(work, "add", "-A");
+        try {
+          git(work, "diff", "--cached", "--quiet");
+        } catch {
+          git(work, "commit", "-m", "deploy");
+        }
+        git(work, "push", "--porcelain", "-u", "origin", "HEAD");
+      };
+
+      // Script: gets its own wm_deploy branch (namespaced by the dev's id), main untouched.
+      const workS = await mkdtemp(join(tmpdir(), "wmill_devpromo_s_"));
+      git(workS, "clone", `file://${bareDir}`, ".");
+      await writeFile(join(workS, "wmill.yaml"), "defaultTs: bun\nincludes:\n  - f/**\nexcludes: []\n");
+      const resS = await backend.runCLICommand(
+        [
+          "sync", "git-deploy", "--repository", "u/test/devpromo_repo",
+          "--use-individual-branch", ...devFlags,
+          "--git-deploy-items", JSON.stringify([{ path_type: "script", path: "f/promo/foo", commit_msg: "deploy foo" }]),
+        ],
+        workS,
+      );
+      expect(resS.code).toBe(0);
+      commitAndPush(workS);
+      expect(remoteBranches(bareDir)).toContain(`refs/heads/wm_deploy/${ws}/script/f__promo__foo`);
+      expect(remoteHead(bareDir, "main")).toBe(seedMain);
+
+      // Group (non-branchable): must land on the dev env-label branch, NEVER main.
+      const workG = await mkdtemp(join(tmpdir(), "wmill_devpromo_g_"));
+      git(workG, "clone", `file://${bareDir}`, ".");
+      await writeFile(join(workG, "wmill.yaml"), "defaultTs: bun\nincludes:\n  - f/**\n  - g/**\nexcludes: []\n");
+      const resG = await backend.runCLICommand(
+        [
+          "sync", "git-deploy", "--repository", "u/test/devpromo_repo",
+          "--use-individual-branch", ...devFlags,
+          "--git-deploy-items", JSON.stringify([{ path_type: "group", path: "g/all", commit_msg: "deploy group" }]),
+        ],
+        workG,
+      );
+      expect(resG.code).toBe(0);
+      commitAndPush(workG);
+      // The anti-leak regression: a group deploy must not advance main.
+      expect(remoteHead(bareDir, "main")).toBe(seedMain);
+      expect(remoteBranches(bareDir)).toContain("refs/heads/dev");
+
+      await rm(bareDir, { recursive: true, force: true });
+      await rm(seedDir, { recursive: true, force: true });
+      await rm(workS, { recursive: true, force: true });
+      await rm(workG, { recursive: true, force: true });
+    });
+  },
+);
+
 /**
  * Regression test for the promotion trigger-include bug (fix/gitsync-promotion-
  * trigger-export): deploying a trigger (or any excluded-by-default kind:
diff --git a/frontend/src/lib/components/git_sync/GitSyncRepositoryCard.svelte b/frontend/src/lib/components/git_sync/GitSyncRepositoryCard.svelte
index 06d28969ba..30a8c3ef47 100644
--- a/frontend/src/lib/components/git_sync/GitSyncRepositoryCard.svelte
+++ b/frontend/src/lib/components/git_sync/GitSyncRepositoryCard.svelte
@@ -33,7 +33,8 @@
 		repository = null,
 		onAdd = null,
 		isCollapsible = true,
-		showEmptyState = false
+		showEmptyState = false,
+		devPromotion = false
 	} = $props<{
 		idx?: number | null
 		isSecondary?: boolean
@@ -44,6 +45,9 @@
 		onAdd?: (() => void) | null
 		isCollapsible?: boolean
 		showEmptyState?: boolean
+		// Dev workspace: this is the single inherited repo, and promotion is a
+		// toggle on it (reuse prod's repo) rather than a separately-configured one.
+		devPromotion?: boolean
 	}>()
 
 	const gitSyncContext = getGitSyncContext()
@@ -78,6 +82,9 @@
 		($workspaceStore?.startsWith('wm-fork-') ?? false) ||
 			!!currentWorkspaceData?.parent_workspace_id
 	)
+	// A dev workspace is a fork that DOES run promotion mode (per-item
+	// wm_deploy/** branches into its parent), unlike a throwaway fork.
+	const isDevWorkspace = $derived(!!currentWorkspaceData?.is_dev_workspace)
 	function setSyncForks(v: boolean) {
 		if (repo?.auto_pull) repo.auto_pull = { ...repo.auto_pull, sync_forks: v }
 	}
@@ -87,6 +94,45 @@
 	function setPromotionOpenPrs(v: boolean) {
 		if (repo) repo.promotion_open_prs = v
 	}
+	// The promotion toggles persist immediately and must not overlap: concurrent
+	// whole-repository saves can complete out of order (enabling runs extra
+	// backend checks), letting a stale earlier state overwrite the latest one.
+	let savingDevPromotion = $state(false)
+	async function setDevPromotion(v: boolean) {
+		if (!repo || idx === null || savingDevPromotion) return
+		const prevIndiv = repo.use_individual_branch
+		const prevGbf = repo.group_by_folder
+		repo.use_individual_branch = v
+		if (!v) repo.group_by_folder = false
+		savingDevPromotion = true
+		try {
+			await gitSyncContext.saveRepository(idx)
+		} catch (e) {
+			// The backend rejects promotion mode without an active EE plan; revert
+			// the optimistic toggle instead of leaving it stuck on until reload.
+			if (repo) {
+				repo.use_individual_branch = prevIndiv
+				repo.group_by_folder = prevGbf
+			}
+			sendUserToast(`Could not ${v ? 'enable' : 'disable'} Git promotion: ${e}`, true)
+		} finally {
+			savingDevPromotion = false
+		}
+	}
+	async function setGroupByFolder(v: boolean) {
+		if (!repo || idx === null || savingDevPromotion) return
+		const prev = repo.group_by_folder
+		repo.group_by_folder = v
+		savingDevPromotion = true
+		try {
+			await gitSyncContext.saveRepository(idx)
+		} catch (e) {
+			if (repo) repo.group_by_folder = prev
+			sendUserToast(`Could not change promotion granularity: ${e}`, true)
+		} finally {
+			savingDevPromotion = false
+		}
+	}
 
 	let targetBranch = $state<string | undefined>(undefined) // Default to main, will be updated when resource is available
 	// The branch this fork workspace syncs with, mirroring the CLI/hub-script
@@ -580,7 +626,7 @@
 									<div class="text-sm font-semibold text-emphasis mb-1">
 										Push to Git on deploy (Windmill → Git)
 									</div>
-									{#if !isFork}
+									{#if !isFork || (isDevWorkspace && repoMode === 'promotion')}
 										<GitSyncModeDisplay mode={repoMode} {targetBranch} repository={repo} active />
 									{/if}
 								</div>
@@ -593,10 +639,42 @@
 									Push to repo
 								</Button>
 							</div>
-							{#if repoMode === 'promotion' && isGithubApp}
+							{#if devPromotion && !repo.isUnsavedConnection}
 								<div class="mt-2">
+									<Toggle
+										checked={repo.use_individual_branch ?? false}
+										disabled={savingDevPromotion}
+										options={{
+											right: 'Promote to prod via Git',
+											rightTooltip:
+												"Each deploy pushes a per-item wm_deploy/** branch to prod's repository, ready to open a pull request into its tracked branch, instead of committing to the dev branch. Enable automatic pull requests below to have Windmill open them. Reuses prod's repository, no separate setup."
+										}}
+										on:change={(e) => setDevPromotion(e.detail)}
+									/>
+									{#if repo.use_individual_branch}
+										<div class="mt-2">
+											<Toggle
+												checked={repo.group_by_folder ?? false}
+												disabled={savingDevPromotion}
+												options={{
+													right: 'One pull request per folder',
+													rightTooltip:
+														"Group a folder's items into a single wm_deploy/** branch, ready as one pull request, instead of one branch per item."
+												}}
+												on:change={(e) => setGroupByFolder(e.detail)}
+											/>
+										</div>
+									{/if}
+								</div>
+							{/if}
+							{#if repoMode === 'promotion' && isGithubApp}
+								<div class="mt-2">
+									<!-- Locked while the dev promotion toggle's save is in flight: this
+										toggle is revealed by that save, and an edit made mid-save would be
+										absorbed into the saved baseline without ever reaching the backend. -->
 									<Toggle
 										checked={repo.promotion_open_prs ?? false}
+										disabled={savingDevPromotion}
 										options={{
 											right: 'Open a pull request for each deploy branch',
 											rightTooltip:
@@ -641,7 +719,7 @@
 											options={{
 												right: 'Open a pull request when an item is deployed in a fork',
 												rightTooltip:
-													"After an item deployed in a fork is pushed to the fork's wm-fork/** branch, Windmill opens a pull request to the tracked branch of the shared repository. Runs from the deploy itself, so it works without inbound webhooks."
+													"After an item deployed in a fork is pushed to the fork's branch (wm-fork/**, or the dev branch for a dev workspace), Windmill opens a pull request to the tracked branch of the shared repository. Runs from the deploy itself, so it works without inbound webhooks. When a dev workspace enables Git promotion, its own pull request toggle takes over for its wm_deploy/** branches."
 											}}
 											on:change={(e) => setForkOpenPrs(e.detail)}
 										>
@@ -749,22 +827,22 @@
 								{#if !isGithubApp && !loadingResourceInfo}
 									<div class="mt-2">
 										<Alert type="info" title="Instant pull recommended" size="xs">
-											Pull for this repository checks the tracked branch about every minute;
-											longer gaps make drift and merge conflicts more likely. For instant pull,
-											connect the repository through the
+											Pull for this repository checks the tracked branch about every minute; longer
+											gaps make drift and merge conflicts more likely. For instant pull, connect the
+											repository through the
 											<a
 												href="https://www.windmill.dev/docs/integrations/git_repository#github-app"
 												target="_blank"
 												class="text-blue-500 hover:underline">GitHub App</a
 											>
-											(which also lets Windmill manage pull requests), or push changes into
-											Windmill with the
+											(which also lets Windmill manage pull requests), or push changes into Windmill
+											with the
 											<a
 												href="https://www.windmill.dev/docs/advanced/git_sync#github-actions"
 												target="_blank"
 												class="text-blue-500 hover:underline">sync GitHub workflow</a
-											>. If you already push changes with a GitHub Action, keep either the
-											Action or automatic pull, not both, so they don't fight over deploys.
+											>. If you already push changes with a GitHub Action, keep either the Action or
+											automatic pull, not both, so they don't fight over deploys.
 										</Alert>
 									</div>
 								{/if}
diff --git a/frontend/src/lib/components/git_sync/GitSyncSection.svelte b/frontend/src/lib/components/git_sync/GitSyncSection.svelte
index 42e147453c..3e5fe7c70d 100644
--- a/frontend/src/lib/components/git_sync/GitSyncSection.svelte
+++ b/frontend/src/lib/components/git_sync/GitSyncSection.svelte
@@ -42,13 +42,17 @@
 
 	const gitSyncAllowed = $derived(gitSyncStatus.enabled)
 	const isFreeTier = $derived(gitSyncAllowed && !$enterpriseLicense)
-	// Fork/dev workspaces never run promotion mode: their deploys always go to
-	// the fork's own wm-fork/** branch, so a promotion repo could never take
-	// effect (the backend rejects it too). Mirrors the backend/CLI fork rule.
+	// Throwaway forks never run promotion mode: their deploys always go to the
+	// fork's own wm-fork/** branch, so a promotion repo could never take effect
+	// (the backend rejects it too). A dev workspace is the exception — it deploys
+	// per-item wm_deploy/** branches that promote into its parent. Mirrors the
+	// backend/CLI rule.
+	const currentWorkspace = $derived($userWorkspaces?.find((w) => w.id === $workspaceStore))
 	const isFork = $derived(
-		($workspaceStore?.startsWith('wm-fork-') ?? false) ||
-			!!$userWorkspaces?.find((w) => w.id === $workspaceStore)?.parent_workspace_id
+		($workspaceStore?.startsWith('wm-fork-') ?? false) || !!currentWorkspace?.parent_workspace_id
 	)
+	const isDevWorkspace = $derived(!!currentWorkspace?.is_dev_workspace)
+	const showPromotion = $derived(!isFork || isDevWorkspace)
 	const hasConfiguredRepos = $derived(
 		gitSyncContext?.repositories?.some((r) => r.git_repo_resource_path) ?? false
 	)
@@ -70,6 +74,16 @@
 	// Derived state for repository categorization
 	const primarySync = $derived(gitSyncContext?.getPrimarySyncRepository() || null)
 	const primaryPromotion = $derived(gitSyncContext?.getPrimaryPromotionRepository() || null)
+	// A dev workspace reuses the single repo it inherited from prod: whether it's
+	// currently in sync or promotion mode, it's the same one card, toggled between
+	// the two — so a dev never configures a separate promotion repo.
+	const devPrimaryRepo = $derived(isDevWorkspace ? (primarySync ?? primaryPromotion) : null)
+	// The single-repo dev UX (one card + promotion toggle, secondaries hidden) is
+	// only safe when the dev actually has one repo — i.e. it inherited prod's on
+	// fork. An ATTACHED dev keeps its own repos: with more than one, fall back to
+	// the normal layout so none are hidden and we don't present an unrelated repo
+	// as prod's promotion target.
+	const devSingleRepo = $derived(isDevWorkspace && (gitSyncContext?.repositories?.length ?? 0) <= 1)
 	const secondarySync = $derived(gitSyncContext?.getSecondarySyncRepositories() || [])
 	const secondaryPromotion = $derived(gitSyncContext?.getSecondaryPromotionRepositories() || [])
 
@@ -139,17 +153,18 @@
 		<div class="space-y-6 pt-6">
 			<GitSyncRepositoryCard
 				variant="primary-sync"
-				mode="sync"
-				idx={primarySync?.idx ?? null}
-				repository={primarySync?.repo ?? null}
+				mode={devSingleRepo && devPrimaryRepo?.repo?.use_individual_branch ? 'promotion' : 'sync'}
+				idx={(devSingleRepo ? devPrimaryRepo : primarySync)?.idx ?? null}
+				repository={(devSingleRepo ? devPrimaryRepo : primarySync)?.repo ?? null}
 				onAdd={() => gitSyncContext.addSyncRepository()}
 				isCollapsible={false}
-				showEmptyState={primarySync?.repo === null}
+				showEmptyState={(devSingleRepo ? devPrimaryRepo : primarySync)?.repo == null}
+				devPromotion={devSingleRepo && !!$enterpriseLicense}
 			/>
 
 			{#if $enterpriseLicense}
-				<!-- Secondary Sync Repositories (EE only) -->
-				{#if primarySync && !primarySync.repo?.isUnsavedConnection}
+				<!-- Secondary Sync Repositories (EE only; a dev workspace has a single inherited repo) -->
+				{#if primarySync && !primarySync.repo?.isUnsavedConnection && !devSingleRepo}
 					{#if secondarySync.length > 0 || secondarySyncExpanded}
 						<div class="mt-4">
 							<button
@@ -211,8 +226,9 @@
 					{/if}
 				{/if}
 
-				<!-- Primary Promotion Repository (EE only; not on forks) -->
-				{#if !isFork}
+				<!-- Primary Promotion Repository (EE only; roots only — a dev promotes via the
+					toggle on its single inherited repo, not a separate promotion repo) -->
+				{#if showPromotion && !devSingleRepo}
 					<div class="mt-6">
 						<GitSyncRepositoryCard
 							variant="primary-promotion"
diff --git a/frontend/src/lib/hubPaths.json b/frontend/src/lib/hubPaths.json
index 0f0322676c..0cb2cd5602 100644
--- a/frontend/src/lib/hubPaths.json
+++ b/frontend/src/lib/hubPaths.json
@@ -1,6 +1,6 @@
 {
 	"gitSyncTest": "hub/28184/git-repo-test-read-write-windmill",
-	"gitInitRepo": "hub/28789/git-sync-init-repository-windmill",
+	"gitInitRepo": "hub/28795/git-sync-init-repository-windmill",
 	"slackErrorHandler": "hub/28794/workspace-or-schedule-error-handler-slack",
 	"emailErrorHandler": "hub/19795/workspace-or-error-handler-email",
 	"slackRecoveryHandler": "hub/28791/slack/schedule-recovery-handler-slack",

From ec6324409d6c0e9ddcda5d110ac570ca79fe9e38 Mon Sep 17 00:00:00 2001
From: Diego Imbert <70353967+diegoimbert@users.noreply.github.com>
Date: Tue, 21 Jul 2026 20:02:34 +0200
Subject: [PATCH 102/171] fix(s3): support instance-policy credentials in
 object storage tests (#10238)

* fix(s3): cache ambient aws credentials and surface credential chain errors

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SCczeVBDhDnLXWqxPWw6od

* fix(frontend): clarify that object storage connection tests run on the server

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SCczeVBDhDnLXWqxPWw6od

* fix: render test connection tooltip in popup and harden cache test

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SCczeVBDhDnLXWqxPWw6od

* better doc

* fix(frontend): correct tooltip wording, tests run from the executing worker

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SCczeVBDhDnLXWqxPWw6od

* fix(s3): single-flight ambient credential provider creation

* fix(frontend): clarify object storage tests run on the server process

* fix(frontend): make instance object storage test tooltip provider-neutral

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
---
 backend/windmill-api-settings/src/lib.rs      |  14 +-
 backend/windmill-object-store/src/lib.rs      | 136 ++++++++++++++++--
 .../src/lib/components/TestConnection.svelte  |  48 ++++---
 3 files changed, 165 insertions(+), 33 deletions(-)

diff --git a/backend/windmill-api-settings/src/lib.rs b/backend/windmill-api-settings/src/lib.rs
index 9d37233228..e02630b104 100644
--- a/backend/windmill-api-settings/src/lib.rs
+++ b/backend/windmill-api-settings/src/lib.rs
@@ -283,15 +283,15 @@ pub async fn test_s3_bucket(
         let mut list = client.list(Some(
             &windmill_object_store::object_store_reexports::Path::from("".to_string()),
         ));
-        let first_file = list.next().await;
-        if first_file.is_some() {
-            if let Err(e) = first_file.as_ref().unwrap() {
+        match list.next().await {
+            Some(Err(e)) => {
                 tracing::error!("error listing bucket: {e:#}");
-                error::Error::internal_err(format!("Failed to list files in blob storage: {e:#}"));
+                return Err(error::Error::internal_err(format!(
+                    "Failed to list files in blob storage: {e:#}"
+                )));
             }
-            tracing::info!("Listed files: {:?}", first_file.unwrap());
-        } else {
-            tracing::info!("No files in blob storage");
+            Some(Ok(first_file)) => tracing::info!("Listed files: {:?}", first_file),
+            None => tracing::info!("No files in blob storage"),
         }
 
         let path = windmill_object_store::object_store_reexports::Path::from(format!(
diff --git a/backend/windmill-object-store/src/lib.rs b/backend/windmill-object-store/src/lib.rs
index 553eb69917..9121f6183d 100644
--- a/backend/windmill-object-store/src/lib.rs
+++ b/backend/windmill-object-store/src/lib.rs
@@ -361,12 +361,7 @@ pub async fn build_s3_client(s3_resource_ref: &S3Resource) -> error::Result<Arc<
         || s3_resource_ref.secret_key.as_ref().is_some_and(|x| x != "");
 
     let credentials_provider = if !static_creds {
-        Some(
-            DefaultCredentialsChain::builder()
-                .region(Region::new(s3_resource_ref.region.clone()))
-                .build()
-                .await,
-        )
+        Some(ambient_aws_credentials_provider(&s3_resource_ref.region).await)
     } else {
         None
     };
@@ -764,10 +759,92 @@ pub async fn build_s3_client_from_settings(
     build_s3_client(&s3_resource).await
 }
 
+// Resolving the default chain goes over the network (ECS/IMDS) on instances relying on an
+// instance role, and object_store asks its CredentialProvider on every request — so resolved
+// credentials must be cached and only re-fetched when close to expiring.
+#[cfg(feature = "parquet")]
+#[derive(Debug)]
+struct AmbientAwsCredentials {
+    chain: DefaultCredentialsChain,
+    cached: RwLock<Option<(aws_sdk_sts::config::Credentials, std::time::Instant)>>,
+}
+
+#[cfg(feature = "parquet")]
+impl AmbientAwsCredentials {
+    // Credentials without an expiry (env vars, static profile) are still re-resolved
+    // periodically so runtime changes to the environment are eventually picked up.
+    const NO_EXPIRY_TTL: std::time::Duration = std::time::Duration::from_secs(300);
+    const EXPIRY_MARGIN: std::time::Duration = std::time::Duration::from_secs(120);
+
+    fn still_valid(creds: &aws_sdk_sts::config::Credentials, age: std::time::Duration) -> bool {
+        match creds.expiry() {
+            Some(expiry) => std::time::SystemTime::now() + Self::EXPIRY_MARGIN < expiry,
+            None => age < Self::NO_EXPIRY_TTL,
+        }
+    }
+
+    async fn get(&self) -> anyhow::Result<aws_sdk_sts::config::Credentials> {
+        if let Some((creds, fetched_at)) = self.cached.read().await.as_ref() {
+            if Self::still_valid(creds, fetched_at.elapsed()) {
+                return Ok(creds.clone());
+            }
+        }
+        // The write lock is held across the chain resolution so concurrent requests don't all
+        // hit the metadata service at once.
+        let mut guard = self.cached.write().await;
+        if let Some((creds, fetched_at)) = guard.as_ref() {
+            if Self::still_valid(creds, fetched_at.elapsed()) {
+                return Ok(creds.clone());
+            }
+        }
+        let creds = self.chain.provide_credentials().await.map_err(|e| {
+            anyhow::anyhow!(
+                "no S3 access key/secret key is configured and no ambient AWS credentials could \
+                 be loaded through the AWS SDK default chain (env vars, profile, ECS/EC2 instance \
+                 role): {cause}. If an EC2/ECS instance role is expected to be used, the instance \
+                 metadata service must be reachable from the process running Windmill — on EC2 the \
+                 AWS Rust SDK only supports IMDSv2, so when Windmill runs in a Docker container \
+                 the instance metadata hop limit (HttpPutResponseHopLimit) must be at least 2",
+                cause = format!("{:#}", anyhow::Error::new(e))
+            )
+        })?;
+        *guard = Some((creds.clone(), std::time::Instant::now()));
+        Ok(creds)
+    }
+}
+
+#[cfg(feature = "parquet")]
+lazy_static::lazy_static! {
+    static ref AMBIENT_AWS_CREDS_PROVIDERS: Cache<String, Arc<AmbientAwsCredentials>> =
+        Cache::new(20);
+}
+
+#[cfg(feature = "parquet")]
+async fn ambient_aws_credentials_provider(region: &str) -> Arc<AmbientAwsCredentials> {
+    // Single-flight: concurrent cold misses for the same region must share one provider,
+    // otherwise each gets its own instance and their per-instance refresh locks can't serialize
+    // the initial credential resolution — every caller would hit the metadata service.
+    match AMBIENT_AWS_CREDS_PROVIDERS
+        .get_value_or_guard_async(region)
+        .await
+    {
+        Ok(provider) => provider,
+        Err(guard) => {
+            let chain = DefaultCredentialsChain::builder()
+                .region(Region::new(region.to_string()))
+                .build()
+                .await;
+            let provider = Arc::new(AmbientAwsCredentials { chain, cached: RwLock::new(None) });
+            let _ = guard.insert(provider.clone());
+            provider
+        }
+    }
+}
+
 #[cfg(feature = "parquet")]
 #[derive(Debug)]
 struct AwsCredentialAdapter {
-    pub inner: DefaultCredentialsChain,
+    pub inner: Arc<AmbientAwsCredentials>,
 }
 
 #[cfg(feature = "parquet")]
@@ -775,9 +852,9 @@ struct AwsCredentialAdapter {
 impl CredentialProvider for AwsCredentialAdapter {
     type Credential = AwsCredential;
     async fn get_credential(&self) -> object_store::Result<Arc<Self::Credential>> {
-        let creds = self.inner.provide_credentials().await.map_err(|e| {
-            tracing::error!("Error getting credentials: {:?}", e);
-            object_store::Error::Generic { store: "AWS", source: Box::new(e) }
+        let creds = self.inner.get().await.map_err(|e| {
+            tracing::error!("Error getting AWS credentials: {e:#}");
+            object_store::Error::Generic { store: "AWS", source: e.into() }
         })?;
         Ok(Arc::new(Self::Credential {
             key_id: creds.access_key_id().to_string(),
@@ -1481,6 +1558,45 @@ pub async fn get_logs_from_store(
 mod tests {
     use super::*;
 
+    // --- ambient credentials cache tests ---
+
+    #[cfg(feature = "parquet")]
+    #[test]
+    fn test_ambient_credentials_still_valid() {
+        use std::time::{Duration, SystemTime};
+
+        fn creds(expiry: Option<SystemTime>) -> aws_sdk_sts::config::Credentials {
+            let mut builder = aws_sdk_sts::config::Credentials::builder()
+                .access_key_id("AK")
+                .secret_access_key("SK")
+                .provider_name("test");
+            if let Some(expiry) = expiry {
+                builder = builder.expiry(expiry);
+            }
+            builder.build()
+        }
+
+        // Expiry far in the future: valid regardless of fetch time
+        assert!(AmbientAwsCredentials::still_valid(
+            &creds(Some(SystemTime::now() + Duration::from_secs(3600))),
+            Duration::ZERO
+        ));
+        // Expiry within the refresh margin: must be re-fetched
+        assert!(!AmbientAwsCredentials::still_valid(
+            &creds(Some(SystemTime::now() + Duration::from_secs(30))),
+            Duration::ZERO
+        ));
+        // No expiry: valid while fresh, re-fetched after the TTL
+        assert!(AmbientAwsCredentials::still_valid(
+            &creds(None),
+            Duration::ZERO
+        ));
+        assert!(!AmbientAwsCredentials::still_valid(
+            &creds(None),
+            AmbientAwsCredentials::NO_EXPIRY_TTL + Duration::from_secs(1)
+        ));
+    }
+
     // --- render_endpoint tests ---
 
     #[test]
diff --git a/frontend/src/lib/components/TestConnection.svelte b/frontend/src/lib/components/TestConnection.svelte
index 7c59a2a324..37e3e152db 100644
--- a/frontend/src/lib/components/TestConnection.svelte
+++ b/frontend/src/lib/components/TestConnection.svelte
@@ -3,15 +3,16 @@
 
 	import { Database, Loader2 } from 'lucide-svelte'
 	import Button from './common/button/Button.svelte'
+	import Tooltip from './meltComponents/Tooltip.svelte'
 	import { sendUserToast } from '$lib/toast'
 	import { workspaceStore } from '$lib/stores'
 	import { tryEvery } from '$lib/utils'
 
 	interface Props {
-		workspaceOverride?: string | undefined;
-		resourceType: string | undefined;
-		args?: Record<string, any> | any;
-		buttonTextOverride?: string | undefined;
+		workspaceOverride?: string | undefined
+		resourceType: string | undefined
+		args?: Record<string, any> | any
+		buttonTextOverride?: string | undefined
 	}
 
 	let {
@@ -19,13 +20,15 @@
 		resourceType,
 		args = {},
 		buttonTextOverride = undefined
-	}: Props = $props();
+	}: Props = $props()
 
 	const scripts: {
 		[key: string]: {
 			code: string
 			lang: string
 			argName: string
+			// Shown as an info tooltip next to the button, e.g. to clarify where the test executes
+			tooltip?: string
 			additionalCheck?: (testResult: CompletedJob) => CompletedJob
 		}
 	} = {
@@ -97,7 +100,9 @@ export async function main(s3: S3) {
 }
 `,
 			lang: 'bun',
-			argName: 's3'
+			argName: 's3',
+			tooltip:
+				'The storage operations of this test run on the Windmill server (the API process), not on the worker. If no access key/secret key is set, the ambient AWS credentials of the server (environment variables, instance role) are used — scripts using this resource directly through an S3 SDK resolve credentials on the worker instead, so results may differ.'
 		},
 		azure_blob: {
 			code: `
@@ -125,7 +130,9 @@ export async function main(s3: S3) {
 }
 `,
 			lang: 'bun',
-			argName: 's3'
+			argName: 's3',
+			tooltip:
+				'The storage operations of this test run on the Windmill server (the API process), not on the worker.'
 		},
 		graphql: {
 			code: '{ __typename }',
@@ -171,7 +178,9 @@ export async function main(bucket: any) {
 }
 `,
 			lang: 'bun',
-			argName: 'bucket'
+			argName: 'bucket',
+			tooltip:
+				"The storage operations of this test run on the Windmill server (the API process). If no credentials are configured, the server's ambient credentials for the configured provider (environment variables, instance role) are used."
 		}
 	}
 
@@ -236,13 +245,20 @@ export async function main(bucket: any) {
 	}
 </script>
 
-{#if Object.keys(scripts).includes(resourceType || '')}
-	<Button spacingSize="sm" size="xs" unifiedSize="md" variant="default" on:click={testConnection}>
-		{#if loading}
-			<Loader2 class="animate-spin mr-2 !h-4 !w-4" />
-		{:else}
-			<Database class="mr-2 !h-4 !w-4" />
+{#if resourceType && Object.keys(scripts).includes(resourceType)}
+	<div class="flex items-center gap-1">
+		<Button spacingSize="sm" size="xs" unifiedSize="md" variant="default" on:click={testConnection}>
+			{#if loading}
+				<Loader2 class="animate-spin mr-2 !h-4 !w-4" />
+			{:else}
+				<Database class="mr-2 !h-4 !w-4" />
+			{/if}
+			{buttonTextOverride ?? 'Test connection'}
+		</Button>
+		{#if scripts[resourceType].tooltip}
+			<Tooltip>
+				{#snippet text()}{scripts[resourceType].tooltip}{/snippet}
+			</Tooltip>
 		{/if}
-		{buttonTextOverride ?? 'Test connection'}
-	</Button>
+	</div>
 {/if}

From 50f1375f18aacf85926f3b6a819f363279fdf0fc Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Tue, 21 Jul 2026 20:15:14 +0200
Subject: [PATCH 103/171] chore(main): release 1.765.0 (#10223)

* chore(main): release 1.765.0

* Apply automatic changes

---------

Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>
---
 CHANGELOG.md                                  |  30 ++++
 backend/Cargo.lock                            | 166 +++++++++---------
 backend/Cargo.toml                            |   4 +-
 .../parsers/windmill-parser-wasm/Cargo.lock   |  48 ++---
 .../parsers/windmill-parser-wasm/Cargo.toml   |   2 +-
 backend/windmill-api/openapi.yaml             |   2 +-
 benchmarks/lib.ts                             |   2 +-
 cli/src/core/constants.ts                     |   2 +-
 frontend/package-lock.json                    |  54 +++++-
 frontend/package.json                         |   2 +-
 lsp/Pipfile                                   |   2 +-
 openflow.openapi.yaml                         |   2 +-
 .../WindmillClient/WindmillClient.psd1        |   2 +-
 python-client/wmill/pyproject.toml            |   2 +-
 typescript-client/jsr.json                    |   2 +-
 typescript-client/package.json                |   2 +-
 version.txt                                   |   2 +-
 17 files changed, 201 insertions(+), 125 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 382a04c843..9f2f95ea2b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,35 @@
 # Changelog
 
+## [1.765.0](https://github.com/windmill-labs/windmill/compare/v1.764.0...v1.765.0) (2026-07-21)
+
+
+### Features
+
+* **ai:** open the Compare & Deploy page from chat with item preselection ([#10232](https://github.com/windmill-labs/windmill/issues/10232)) ([572d69e](https://github.com/windmill-labs/windmill/commit/572d69e5ae8ae12207dca175fdb5ea378d852a45))
+* **ai:** session chat nits — empty sends, command picker polish, session-state prompt ([#10233](https://github.com/windmill-labs/windmill/issues/10233)) ([9bc1f62](https://github.com/windmill-labs/windmill/commit/9bc1f6212837155c964a7db7103aabbcf14cbce2))
+* attach text files to chat messages, read on demand via file tools ([#10215](https://github.com/windmill-labs/windmill/issues/10215)) ([d6cf1ef](https://github.com/windmill-labs/windmill/commit/d6cf1ef9872cd0db0f51e4881237bac383e45f61))
+* **git-sync:** enable per-item promotion mode on dev workspaces ([#10205](https://github.com/windmill-labs/windmill/issues/10205)) ([2ce21c9](https://github.com/windmill-labs/windmill/commit/2ce21c9ef86c608d73e12a7e278d2f328e06b6fa))
+* **pipelines:** catalog declared measures and dimensions ([#10190](https://github.com/windmill-labs/windmill/issues/10190)) ([fd51d40](https://github.com/windmill-labs/windmill/commit/fd51d40f1254a206de1f38e59cc3dadce8e13aa5))
+* **triggers:** add AMQP (RabbitMQ) trigger via lapin ([#10230](https://github.com/windmill-labs/windmill/issues/10230)) ([68debab](https://github.com/windmill-labs/windmill/commit/68debab877c6dc8ee3732e0c23d467db85fd4584))
+* unified read-only `diff` chat tool (drafts, fork vs parent, search) ([#10211](https://github.com/windmill-labs/windmill/issues/10211)) ([9739d5a](https://github.com/windmill-labs/windmill/commit/9739d5a2c2a21beded8848ea9049b2816196a898))
+
+
+### Bug Fixes
+
+* **apps:** let entitled viewers read pre-existing S3 files from deployed apps ([#10245](https://github.com/windmill-labs/windmill/issues/10245)) ([4a89824](https://github.com/windmill-labs/windmill/commit/4a898247a21ae918fa952a993fbe407ebc49e404))
+* **db:** repair s3 asset paths missing default-storage leading slash ([#10243](https://github.com/windmill-labs/windmill/issues/10243)) ([555c751](https://github.com/windmill-labs/windmill/commit/555c751016fea4087be09fa2520af331cc872bfc))
+* **frontend:** curl fallback for +Variable/+Resource in bash sandbox mode ([#10235](https://github.com/windmill-labs/windmill/issues/10235)) ([28966bd](https://github.com/windmill-labs/windmill/commit/28966bdbf190ac461aa5259e04d6c15cf699fd94))
+* **frontend:** limit compare & deploy rows to the active direction ([#10234](https://github.com/windmill-labs/windmill/issues/10234)) ([7ac27c1](https://github.com/windmill-labs/windmill/commit/7ac27c1ef240729fc38d5fa506b96bf60be74e25))
+* **frontend:** prevent browser back-swipe navigation over monaco editors ([#10229](https://github.com/windmill-labs/windmill/issues/10229)) ([b0bf256](https://github.com/windmill-labs/windmill/commit/b0bf25683ba3aac3e94bbe9d6bbd6e22545e734e))
+* **parsers:** keep s3 asset path suffix verbatim to preserve storage distinction ([#10241](https://github.com/windmill-labs/windmill/issues/10241)) ([7fb8a2e](https://github.com/windmill-labs/windmill/commit/7fb8a2e390cef3cd01a33c89ee55d3f53cb1e20f))
+* **parser:** spurious pg arg inferred from placeholders in comments ([#10226](https://github.com/windmill-labs/windmill/issues/10226)) ([d24e176](https://github.com/windmill-labs/windmill/commit/d24e1768163c10fbbc144bd1126457e42d282e37))
+* **pg:** actionable error when s3object input exceeds jsonb 256MB cap ([#10228](https://github.com/windmill-labs/windmill/issues/10228)) ([6e42633](https://github.com/windmill-labs/windmill/commit/6e4263364325e4d4616697c6da601bbc887ff43c))
+* **postgres-triggers:** enforce resource-path scopes on ancillary routes ([#10222](https://github.com/windmill-labs/windmill/issues/10222)) ([39058c0](https://github.com/windmill-labs/windmill/commit/39058c0a01c35cf553daae3af37c6d326a7c8763))
+* return to parent workspace when a fork is deleted remotely ([#9898](https://github.com/windmill-labs/windmill/issues/9898)) ([32994df](https://github.com/windmill-labs/windmill/commit/32994df427e6df6747caf1ba6371512d5a5be5c2))
+* **s3:** support instance-policy credentials in object storage tests ([#10238](https://github.com/windmill-labs/windmill/issues/10238)) ([ec63244](https://github.com/windmill-labs/windmill/commit/ec6324409d6c0e9ddcda5d110ac570ca79fe9e38))
+* **triggers:** apply scope-path filtering to list and fix update scope check ([#10220](https://github.com/windmill-labs/windmill/issues/10220)) ([adc555d](https://github.com/windmill-labs/windmill/commit/adc555d1722cb59aa5b88503b3105357d76f5b71))
+* **worker:** mount /dev/shm as tmpfs in the Docker v2 nsjail sandbox ([#10240](https://github.com/windmill-labs/windmill/issues/10240)) ([2caee41](https://github.com/windmill-labs/windmill/commit/2caee41fdfe1e69010a1f4544d45aaa5db49f590))
+
 ## [1.764.0](https://github.com/windmill-labs/windmill/compare/v1.763.0...v1.764.0) (2026-07-20)
 
 
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index 84014f30e9..b0b0e296cd 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -5510,9 +5510,9 @@ dependencies = [
 
 [[package]]
 name = "glob"
-version = "0.3.3"
+version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0cc23270f6e1808e30a928bdc84dea0b9b4136a8bc82338574f23baf47bbd280"
+checksum = "e4eba85ea1d0a966a983acd07deee566e67395d2d96b6fb39e62b5a833f1eb0b"
 
 [[package]]
 name = "globset"
@@ -7003,9 +7003,9 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.186"
+version = "0.2.188"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
+checksum = "22053b6a34f84abc97f9129e61334f40174659a1b9bd18c970b83db6a9a6348b"
 
 [[package]]
 name = "libffi-sys"
@@ -14479,7 +14479,7 @@ dependencies = [
 
 [[package]]
 name = "windmill"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -14564,7 +14564,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-ai"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "async-stream",
  "async-trait",
@@ -14597,7 +14597,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-alerting"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14610,7 +14610,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "argon2",
@@ -14749,7 +14749,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-agent-workers"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14772,7 +14772,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-assets"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14787,7 +14787,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-auth"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14813,7 +14813,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "reqwest 0.12.28",
  "serde",
@@ -14823,7 +14823,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-configs"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14840,7 +14840,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-debug"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "axum 0.8.9",
  "base64 0.22.1",
@@ -14862,7 +14862,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-embeddings"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14885,7 +14885,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flow-conversations"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14901,7 +14901,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flows"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14922,7 +14922,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-groups"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14943,7 +14943,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-inputs"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14957,7 +14957,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-integration-tests"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -14992,7 +14992,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-jobs"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15017,7 +15017,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-npm-proxy"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "axum 0.8.9",
  "flate2",
@@ -15035,7 +15035,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-openapi"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15057,7 +15057,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-schedule"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15077,7 +15077,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-scripts"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15114,7 +15114,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-settings"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15142,7 +15142,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-sse"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "lazy_static",
  "serde",
@@ -15154,7 +15154,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-users"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "argon2",
  "axum 0.8.9",
@@ -15179,7 +15179,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workers"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15193,7 +15193,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workspaces"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15228,7 +15228,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -15242,7 +15242,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15261,7 +15261,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "aes-gcm",
  "aho-corasick",
@@ -15364,7 +15364,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-dep-map"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "chrono",
  "itertools 0.14.0",
@@ -15383,7 +15383,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "regex",
  "serde",
@@ -15398,7 +15398,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "astral-tokio-tar",
@@ -15422,7 +15422,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-jseval"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -15439,7 +15439,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -15455,7 +15455,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-mcp"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15476,7 +15476,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-native-triggers"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15507,7 +15507,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-oauth"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "arc-swap",
@@ -15532,7 +15532,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-object-store"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "async-stream",
@@ -15566,7 +15566,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-operator"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -15584,7 +15584,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -15593,7 +15593,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15605,7 +15605,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15617,7 +15617,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -15629,7 +15629,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15641,7 +15641,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15653,7 +15653,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -15664,7 +15664,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15675,7 +15675,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15687,7 +15687,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -15698,7 +15698,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15720,7 +15720,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15732,7 +15732,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15746,7 +15746,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -15763,7 +15763,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15776,7 +15776,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -15788,7 +15788,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15806,7 +15806,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -15822,7 +15822,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -15838,7 +15838,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -15849,7 +15849,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15888,7 +15888,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-runtime-nativets"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "const_format",
@@ -15928,7 +15928,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "getrandom 0.3.4",
  "wasm-bindgen",
@@ -15939,7 +15939,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-store"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15973,7 +15973,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-test-utils"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15997,7 +15997,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16030,7 +16030,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-amqp"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16057,7 +16057,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-azure"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16090,7 +16090,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-email"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16110,7 +16110,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-gcp"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16144,7 +16144,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-http"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16180,7 +16180,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-kafka"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16203,7 +16203,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-mqtt"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16227,7 +16227,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-nats"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -16251,7 +16251,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-postgres"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16286,7 +16286,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-sqs"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16314,7 +16314,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-websocket"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16339,7 +16339,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "bitflags 2.13.1",
@@ -16358,7 +16358,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "async-once-cell",
@@ -16472,7 +16472,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker-volumes"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "bytes",
  "futures",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 638e267c04..b5ef6accc8 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.764.0"
+version = "1.765.0"
 authors.workspace = true
 edition.workspace = true
 
@@ -88,7 +88,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal", "./parsers/windmill-parser-wasm"]
 
 [workspace.package]
-version = "1.764.0"
+version = "1.765.0"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.lock b/backend/parsers/windmill-parser-wasm/Cargo.lock
index a8ad779bb3..10ec092737 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.lock
+++ b/backend/parsers/windmill-parser-wasm/Cargo.lock
@@ -6191,7 +6191,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill-common"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "aho-corasick",
  "anyhow",
@@ -6272,7 +6272,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -6284,7 +6284,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "convert_case",
  "serde",
@@ -6293,7 +6293,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6305,7 +6305,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6317,7 +6317,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -6329,7 +6329,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6341,7 +6341,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6353,7 +6353,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -6364,7 +6364,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6375,7 +6375,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6387,7 +6387,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6398,7 +6398,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -6420,7 +6420,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6432,7 +6432,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6446,7 +6446,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "convert_case",
@@ -6463,7 +6463,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6476,7 +6476,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -6488,7 +6488,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6506,7 +6506,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -6522,7 +6522,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6538,7 +6538,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wasm"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "getrandom 0.2.17",
@@ -6570,7 +6570,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -6581,7 +6581,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.764.0"
+version = "1.765.0"
 dependencies = [
  "anyhow",
  "bitflags",
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.toml b/backend/parsers/windmill-parser-wasm/Cargo.toml
index d752b7d676..4a1bc8ae12 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.toml
+++ b/backend/parsers/windmill-parser-wasm/Cargo.toml
@@ -12,7 +12,7 @@ resolver = "2"
 members = ["."]
 
 [workspace.package]
-version = "1.764.0"
+version = "1.765.0"
 edition = "2021"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 81ebb3c72f..077bbc025d 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.764.0
+  version: 1.765.0
   title: Windmill API
 
   contact:
diff --git a/benchmarks/lib.ts b/benchmarks/lib.ts
index 225d80dccd..98c3d27e99 100644
--- a/benchmarks/lib.ts
+++ b/benchmarks/lib.ts
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.764.0";
+export const VERSION = "v1.765.0";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({
diff --git a/cli/src/core/constants.ts b/cli/src/core/constants.ts
index a78e01a31e..760bbaca5f 100644
--- a/cli/src/core/constants.ts
+++ b/cli/src/core/constants.ts
@@ -10,4 +10,4 @@ export const WM_FORK_PREFIX = "wm-fork";
 // (e.g. utils.ts) can read it without importing main.ts and creating a circular
 // dependency (main → workspace → utils → main) that triggers a TDZ.
 // Re-exported from main.ts for backwards compatibility.
-export const VERSION = "1.764.0";
+export const VERSION = "1.765.0";
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index daf5e8f6b8..b5a7c9feae 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.764.0",
+	"version": "1.765.0",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "@windmill-labs/components",
-			"version": "1.764.0",
+			"version": "1.765.0",
 			"hasInstallScript": true,
 			"license": "AGPL-3.0",
 			"dependencies": {
@@ -880,6 +880,7 @@
 			"version": "1.11.2",
 			"resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.11.2.tgz",
 			"integrity": "sha512-TC8MkTuZUtcTSiFeuC0ksCh9QIJ5+F21MvZ4Wn4ORfYaFJ/0dsiudv5tVkejgwZlwQ39jL9WWDe2lz8x0WglOA==",
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"dependencies": {
@@ -891,6 +892,7 @@
 			"version": "1.11.2",
 			"resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.11.2.tgz",
 			"integrity": "sha512-kyOl3X0DuTiT1h2ft8r2fYO8JYtU9a9Xis/zBSiGArNaagCOWx90N1k2wxp18czFDH+OgcWGb5ZP/XMt3dcyPA==",
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"dependencies": {
@@ -901,6 +903,7 @@
 			"version": "1.2.2",
 			"resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-1.2.2.tgz",
 			"integrity": "sha512-c95qOXkHdydNKhscBTebqEC1CVAZpyqOfVfBzQ1qgzyl3gfeldUjIggDbIZgDKsHLgnsM+igH7TJ/eAasaVuMA==",
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"dependencies": {
@@ -1416,6 +1419,7 @@
 			"version": "1.1.4",
 			"resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.4.tgz",
 			"integrity": "sha512-3NQNNgA1YSlJb/kMH1ildASP9HW7/7kYnRI2szWJaofaS1hWmbGI4H+d3+22aGzXXN9IJ+n+GiFVcGipJP18ow==",
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"dependencies": {
@@ -1564,6 +1568,7 @@
 			"cpu": [
 				"arm64"
 			],
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1580,6 +1585,7 @@
 			"cpu": [
 				"arm64"
 			],
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1596,6 +1602,7 @@
 			"cpu": [
 				"x64"
 			],
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1612,6 +1619,7 @@
 			"cpu": [
 				"x64"
 			],
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1628,6 +1636,7 @@
 			"cpu": [
 				"arm"
 			],
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1644,6 +1653,7 @@
 			"cpu": [
 				"arm64"
 			],
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1660,6 +1670,7 @@
 			"cpu": [
 				"arm64"
 			],
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1676,6 +1687,7 @@
 			"cpu": [
 				"ppc64"
 			],
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1692,6 +1704,7 @@
 			"cpu": [
 				"s390x"
 			],
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1708,6 +1721,7 @@
 			"cpu": [
 				"x64"
 			],
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1724,6 +1738,7 @@
 			"cpu": [
 				"x64"
 			],
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1740,6 +1755,7 @@
 			"cpu": [
 				"arm64"
 			],
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1756,6 +1772,7 @@
 			"cpu": [
 				"wasm32"
 			],
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"dependencies": {
@@ -1774,6 +1791,7 @@
 			"cpu": [
 				"arm64"
 			],
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1790,6 +1808,7 @@
 			"cpu": [
 				"x64"
 			],
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -2095,6 +2114,7 @@
 			"version": "0.10.2",
 			"resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.2.tgz",
 			"integrity": "sha512-RoBvJ2X0wuKlWFIjrwffGw1IqZHKQqzIchKaadZZfnNpsAYp2mM0h36JtPCjNDAHGgYez/15uMBpfGwchhiMgg==",
+			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"dependencies": {
@@ -7330,7 +7350,7 @@
 			"version": "1.21.7",
 			"resolved": "https://registry.npmjs.org/jiti/-/jiti-1.21.7.tgz",
 			"integrity": "sha512-/imKNG4EbWNrVjoNC/1H5/9GFy+tqjGBHCaSsN+P2RnPqjsLmv6UD3Ej+Kj8nBWaRAwyk7kK5ZUc+OEatnTR3A==",
-			"devOptional": true,
+			"dev": true,
 			"license": "MIT",
 			"bin": {
 				"jiti": "bin/jiti.js"
@@ -7865,6 +7885,7 @@
 			"cpu": [
 				"arm64"
 			],
+			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -7885,6 +7906,7 @@
 			"cpu": [
 				"arm64"
 			],
+			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -7905,6 +7927,7 @@
 			"cpu": [
 				"x64"
 			],
+			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -7925,6 +7948,7 @@
 			"cpu": [
 				"x64"
 			],
+			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -7945,6 +7969,7 @@
 			"cpu": [
 				"arm"
 			],
+			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -7965,6 +7990,7 @@
 			"cpu": [
 				"arm64"
 			],
+			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -7985,6 +8011,7 @@
 			"cpu": [
 				"arm64"
 			],
+			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -8005,6 +8032,7 @@
 			"cpu": [
 				"x64"
 			],
+			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -8025,6 +8053,7 @@
 			"cpu": [
 				"x64"
 			],
+			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -8045,6 +8074,7 @@
 			"cpu": [
 				"arm64"
 			],
+			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -8065,6 +8095,7 @@
 			"cpu": [
 				"x64"
 			],
+			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -12758,6 +12789,21 @@
 				}
 			}
 		},
+		"node_modules/svelte-check/node_modules/picomatch": {
+			"version": "4.0.5",
+			"resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.5.tgz",
+			"integrity": "sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==",
+			"dev": true,
+			"license": "MIT",
+			"optional": true,
+			"peer": true,
+			"engines": {
+				"node": ">=12"
+			},
+			"funding": {
+				"url": "https://github.com/sponsors/jonschlinkert"
+			}
+		},
 		"node_modules/svelte-eslint-parser": {
 			"version": "0.43.0",
 			"resolved": "https://registry.npmjs.org/svelte-eslint-parser/-/svelte-eslint-parser-0.43.0.tgz",
@@ -13497,7 +13543,7 @@
 			"version": "5.9.3",
 			"resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
 			"integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
-			"devOptional": true,
+			"dev": true,
 			"license": "Apache-2.0",
 			"bin": {
 				"tsc": "bin/tsc",
diff --git a/frontend/package.json b/frontend/package.json
index dec46b6f2d..75dc0c09ef 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.764.0",
+	"version": "1.765.0",
 	"scripts": {
 		"dev": "vite dev",
 		"dev:ui-builder": "mv static/ui_builder static/ui_builder.dev-disabled 2>/dev/null || true ; trap 'mv static/ui_builder.dev-disabled static/ui_builder 2>/dev/null || true' EXIT ; vite dev",
diff --git a/lsp/Pipfile b/lsp/Pipfile
index 7ed5878119..adfc9898f0 100644
--- a/lsp/Pipfile
+++ b/lsp/Pipfile
@@ -4,7 +4,7 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-wmill = ">=1.764.0"
+wmill = ">=1.765.0"
 sendgrid = "*"
 mysql-connector-python = "*"
 pymongo = "*"
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index b28b7184a1..f87f0827d3 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1,7 +1,7 @@
 openapi: '3.0.3'
 
 info:
-  version: 1.764.0
+  version: 1.765.0
   title: OpenFlow Spec
   contact:
     name: Ruben Fiszel
diff --git a/powershell-client/WindmillClient/WindmillClient.psd1 b/powershell-client/WindmillClient/WindmillClient.psd1
index 4f21d2832d..042c3fb14f 100644
--- a/powershell-client/WindmillClient/WindmillClient.psd1
+++ b/powershell-client/WindmillClient/WindmillClient.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'WindmillClient.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '1.764.0'
+    ModuleVersion     = '1.765.0'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()
diff --git a/python-client/wmill/pyproject.toml b/python-client/wmill/pyproject.toml
index acede5f804..d779b89092 100644
--- a/python-client/wmill/pyproject.toml
+++ b/python-client/wmill/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill"
-version = "1.764.0"
+version = "1.765.0"
 description = "A client library for accessing Windmill server wrapping the Windmill client API"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/typescript-client/jsr.json b/typescript-client/jsr.json
index cceec4de9b..6016fa91de 100644
--- a/typescript-client/jsr.json
+++ b/typescript-client/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@windmill/windmill",
-  "version": "1.764.0",
+  "version": "1.765.0",
   "exports": "./src/index.ts",
   "publish": {
     "exclude": ["!src", "./s3Types.ts", "./sqlUtils.ts", "./client.ts"]
diff --git a/typescript-client/package.json b/typescript-client/package.json
index bafac5a181..a481be9d16 100644
--- a/typescript-client/package.json
+++ b/typescript-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.764.0",
+  "version": "1.765.0",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "homepage": "https://github.com/windmill-labs/windmill/tree/main/typescript-client#readme",
diff --git a/version.txt b/version.txt
index 35944d0771..3143a6d7ae 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.764.0
+1.765.0

From b948efd3c81aada103bd141eae03fbe626bf6ee5 Mon Sep 17 00:00:00 2001
From: hugocasa <hugo@casademont.ch>
Date: Wed, 22 Jul 2026 00:26:15 +0200
Subject: [PATCH 104/171] fix: accept ssh/scheme-less git repo urls and $var:
 refs in app repo resolution (#10246)

* fix(git-sync): accept ssh/scheme-less repo urls and $var: refs in app repo resolution

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(git-sync): interpolate repo urls at github-call sites only, not in persisted markers

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* chore: update ee-repo-ref to 183f78b3ee193d6b5e55fd453c570f94a12c8b13

This commit updates the EE repository reference after PR #681 was merged in windmill-ee-private.

Previous ee-repo-ref: 9bc5018f68edf3a9f256ef6315ad6ddf4fba3a45

New ee-repo-ref: 183f78b3ee193d6b5e55fd453c570f94a12c8b13

Automated by sync-ee-ref workflow.

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
---
 backend/ee-repo-ref.txt                       |  2 +-
 .../windmill-api-workspaces/src/workspaces.rs |  8 +++--
 .../src/workspaces_extra.rs                   |  3 +-
 .../windmill-worker/src/result_processor.rs   | 36 ++++++++++++++-----
 4 files changed, 35 insertions(+), 14 deletions(-)

diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index efc5187476..fda20289f5 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-8bf73f803158bcbf7b8d55a36f4a1ebfcc1bbcd9
+183f78b3ee193d6b5e55fd453c570f94a12c8b13
diff --git a/backend/windmill-api-workspaces/src/workspaces.rs b/backend/windmill-api-workspaces/src/workspaces.rs
index f20fce538d..5ab233e994 100644
--- a/backend/windmill-api-workspaces/src/workspaces.rs
+++ b/backend/windmill-api-workspaces/src/workspaces.rs
@@ -3523,7 +3523,8 @@ async fn edit_git_sync_config(
             tracing::warn!("git auto-pull: webhook field persist error: {}", e);
         }
         for (path, hook_id) in removed_webhooks {
-            if let Ok(url) = windmill_common::git_sync_ee::resolve_repo_url(&db, &w_id, &path).await
+            if let Ok(url) =
+                windmill_common::git_sync_ee::resolve_repo_url_interpolated(&db, &w_id, &path).await
             {
                 let _ =
                     windmill_common::git_sync_ee::delete_repo_webhook(&db, &w_id, &url, hook_id)
@@ -3882,7 +3883,7 @@ async fn delete_git_sync_repository(
     // Removal is durable now — best-effort delete the GitHub webhook.
     #[cfg(all(feature = "enterprise", feature = "private"))]
     if let Some(hook_id) = webhook_to_delete {
-        if let Ok(url) = windmill_common::git_sync_ee::resolve_repo_url(
+        if let Ok(url) = windmill_common::git_sync_ee::resolve_repo_url_interpolated(
             &db,
             &w_id,
             &request.git_repo_resource_path,
@@ -7071,7 +7072,8 @@ async fn attach_dev_workspace(
     // (their auto_pull is gone), so remove them from GitHub.
     #[cfg(all(feature = "enterprise", feature = "private"))]
     for (path, hook_id) in stripped_webhooks {
-        if let Ok(url) = windmill_common::git_sync_ee::resolve_repo_url(&db, &dev_w_id, &path).await
+        if let Ok(url) =
+            windmill_common::git_sync_ee::resolve_repo_url_interpolated(&db, &dev_w_id, &path).await
         {
             let _ =
                 windmill_common::git_sync_ee::delete_repo_webhook(&db, &dev_w_id, &url, hook_id)
diff --git a/backend/windmill-api-workspaces/src/workspaces_extra.rs b/backend/windmill-api-workspaces/src/workspaces_extra.rs
index 1166d04fe3..aa89f1ffd5 100644
--- a/backend/windmill-api-workspaces/src/workspaces_extra.rs
+++ b/backend/windmill-api-workspaces/src/workspaces_extra.rs
@@ -805,7 +805,8 @@ pub(crate) async fn change_workspace_id(
     #[cfg(all(feature = "enterprise", feature = "private"))]
     for (path, hook_id) in stale_webhooks {
         if let Ok(url) =
-            windmill_common::git_sync_ee::resolve_repo_url(&db, &rw.new_id, &path).await
+            windmill_common::git_sync_ee::resolve_repo_url_interpolated(&db, &rw.new_id, &path)
+                .await
         {
             let _ =
                 windmill_common::git_sync_ee::delete_repo_webhook(&db, &rw.new_id, &url, hook_id)
diff --git a/backend/windmill-worker/src/result_processor.rs b/backend/windmill-worker/src/result_processor.rs
index aeb9fdb329..c95bd70899 100644
--- a/backend/windmill-worker/src/result_processor.rs
+++ b/backend/windmill-worker/src/result_processor.rs
@@ -1081,14 +1081,19 @@ async fn maybe_open_git_sync_deploy_pr(
         return;
     };
 
-    let repo_url =
-        match windmill_common::git_sync_ee::resolve_repo_url(db, workspace_id, &repo_path).await {
-            Ok(url) => url,
-            Err(e) => {
-                tracing::warn!("git sync PR: could not resolve repo url for {repo_path}: {e:#}");
-                return;
-            }
-        };
+    let repo_url = match windmill_common::git_sync_ee::resolve_repo_url_interpolated(
+        db,
+        workspace_id,
+        &repo_path,
+    )
+    .await
+    {
+        Ok(url) => url,
+        Err(e) => {
+            tracing::warn!("git sync PR: could not resolve repo url for {repo_path}: {e:#}");
+            return;
+        }
+    };
     // A fork of a dev workspace diverged from the dev's label branch, so its PR
     // merges back there; everything else targets the tracked branch.
     let pr_base = row.parent_dev_workspace_label.as_deref().unwrap_or(&base);
@@ -1252,9 +1257,22 @@ async fn maybe_post_git_sync_check(
         (None, Some(deploy)) => (true, deploy),
         (None, None) => return,
     };
-    let Ok(check) = serde_json::from_value::<GitSyncCheck>(marker) else {
+    let Ok(mut check) = serde_json::from_value::<GitSyncCheck>(marker) else {
         return;
     };
+    // Markers carry the literal resource URL (job args are persisted, so a
+    // `$var:`-resolved URL must not land there); interpolate before calling
+    // GitHub.
+    check.repo_url =
+        match windmill_common::variables::get_variable_or_self(check.repo_url, db, workspace_id)
+            .await
+        {
+            Ok(u) => u,
+            Err(e) => {
+                tracing::error!("git sync-check: cannot interpolate repo url: {e:#}");
+                return;
+            }
+        };
     // "In sync" on a PR that visibly changes files reads as a bug when those
     // files are outside the repo's sync filters — say what the scope is.
     let scope_note = if !is_deploy && success {

From 380cf752ca8fc57eb70f7c8efd57290f7902a030 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Wed, 22 Jul 2026 11:12:31 +0200
Subject: [PATCH 105/171] fix(prompts): prefer Bun over Deno for TypeScript
 runtime selection (#10253)

Make the AI prompting instructions explicitly pick Bun as the default and
preferred TypeScript runtime, and treat Deno as the exception (only when a
script specifically requires the Deno runtime: Deno stdlib or deno.land URL
imports).

Previously the `write-script-bun` and `write-script-deno` skill descriptions
both read as equally valid TypeScript defaults ("MUST use when writing
Bun/TypeScript scripts" vs "MUST use when writing Deno/TypeScript scripts"),
giving no signal on which to choose for a generic TypeScript request.

Source-of-truth edits (system_prompts/utils.py LANGUAGE_METADATA,
languages/bun.md, languages/deno.md, cli/src/guidance/core.ts) then
regenerated via system_prompts/generate.py into the auto-generated skills,
prompts, and cli/src/guidance/skills.gen.ts.

Fixes WIN-2220

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 cli/src/guidance/core.ts                             |  2 +-
 cli/src/guidance/skills.gen.ts                       | 12 +++++++-----
 system_prompts/auto-generated/prompts.ts             |  4 +++-
 system_prompts/auto-generated/script.md              |  4 +++-
 .../auto-generated/skills/write-script-bun/SKILL.md  |  4 ++--
 .../auto-generated/skills/write-script-deno/SKILL.md |  4 +++-
 system_prompts/languages/bun.md                      |  2 +-
 system_prompts/languages/deno.md                     |  2 ++
 system_prompts/utils.py                              |  8 ++++----
 9 files changed, 26 insertions(+), 16 deletions(-)

diff --git a/cli/src/guidance/core.ts b/cli/src/guidance/core.ts
index c43ff8c6c0..100bea6e53 100644
--- a/cli/src/guidance/core.ts
+++ b/cli/src/guidance/core.ts
@@ -74,7 +74,7 @@ You are a helpful assistant that can help with Windmill scripts, flows, apps, an
 
 ## Script Writing Guide
 
-You MUST use the \`write-script-<language>\` skill to write or modify scripts in the language specified by the user. Use bun by default.
+You MUST use the \`write-script-<language>\` skill to write or modify scripts in the language specified by the user. Use bun by default. For TypeScript, always prefer bun (\`write-script-bun\`) over deno unless the script specifically requires the Deno runtime.
 For Workflow-as-Code scripts, use the \`write-workflow-as-code\` skill.
 
 ## Flow Writing Guide
diff --git a/cli/src/guidance/skills.gen.ts b/cli/src/guidance/skills.gen.ts
index 69e4338d22..cc51106162 100644
--- a/cli/src/guidance/skills.gen.ts
+++ b/cli/src/guidance/skills.gen.ts
@@ -10,10 +10,10 @@ export const SKILLS: SkillMetadata[] = [
   { name: "write-script-ansible", description: "MUST use when writing Ansible playbooks.", languageKey: "ansible" },
   { name: "write-script-bash", description: "MUST use when writing Bash scripts.", languageKey: "bash" },
   { name: "write-script-bigquery", description: "MUST use when writing BigQuery queries.", languageKey: "bigquery" },
-  { name: "write-script-bun", description: "MUST use when writing Bun/TypeScript scripts.", languageKey: "bun" },
+  { name: "write-script-bun", description: "MUST use when writing TypeScript scripts. Bun is the default and preferred TypeScript runtime — pick it for TypeScript unless the script specifically needs Deno.", languageKey: "bun" },
   { name: "write-script-bunnative", description: "MUST use when writing Bun Native scripts. The script must start with //native to run on the native worker.", languageKey: "bunnative" },
   { name: "write-script-csharp", description: "MUST use when writing C# scripts.", languageKey: "csharp" },
-  { name: "write-script-deno", description: "MUST use when writing Deno/TypeScript scripts.", languageKey: "deno" },
+  { name: "write-script-deno", description: "Use ONLY when a TypeScript script specifically requires the Deno runtime (Deno stdlib or deno.land URL imports). For all other TypeScript, use write-script-bun instead.", languageKey: "deno" },
   { name: "write-script-duckdb", description: "MUST use when writing DuckDB queries.", languageKey: "duckdb" },
   { name: "write-script-go", description: "MUST use when writing Go scripts.", languageKey: "go" },
   { name: "write-script-graphql", description: "MUST use when writing GraphQL queries.", languageKey: "graphql" },
@@ -374,7 +374,7 @@ being buffered, bypassing the 10000-row return cap.
 `,
   "write-script-bun": `---
 name: write-script-bun
-description: MUST use when writing Bun/TypeScript scripts.
+description: MUST use when writing TypeScript scripts. Bun is the default and preferred TypeScript runtime — pick it for TypeScript unless the script specifically needs Deno.
 ---
 
 ## CLI Commands
@@ -424,7 +424,7 @@ Use \`wmill resource-type list --schema\` to discover available resource types.
 
 # TypeScript (Bun)
 
-Bun runtime with full npm ecosystem and fastest execution.
+Bun runtime with full npm ecosystem and fastest execution. **Bun is the default and preferred TypeScript runtime** — choose it for any TypeScript script unless there is a major reason to use Deno for that specific use-case.
 
 ## Structure
 
@@ -1994,7 +1994,7 @@ public class Script
 `,
   "write-script-deno": `---
 name: write-script-deno
-description: MUST use when writing Deno/TypeScript scripts.
+description: Use ONLY when a TypeScript script specifically requires the Deno runtime (Deno stdlib or deno.land URL imports). For all other TypeScript, use write-script-bun instead.
 ---
 
 ## CLI Commands
@@ -2046,6 +2046,8 @@ Use \`wmill resource-type list --schema\` to discover available resource types.
 
 Deno runtime with npm support via \`npm:\` prefix and native Deno libraries.
 
+**Prefer Bun (\`write-script-bun\`) for TypeScript.** Only use Deno when the script specifically requires the Deno runtime — Deno's standard library or \`deno.land\` URL imports that have no npm equivalent. For all other TypeScript, use Bun instead.
+
 ## Structure
 
 Export a single **async** function called \`main\`:
diff --git a/system_prompts/auto-generated/prompts.ts b/system_prompts/auto-generated/prompts.ts
index fb2e40e6ec..5670c53fcd 100644
--- a/system_prompts/auto-generated/prompts.ts
+++ b/system_prompts/auto-generated/prompts.ts
@@ -3729,7 +3729,7 @@ being buffered, bypassing the 10000-row return cap.
 
 export const LANG_BUN = `# TypeScript (Bun)
 
-Bun runtime with full npm ecosystem and fastest execution.
+Bun runtime with full npm ecosystem and fastest execution. **Bun is the default and preferred TypeScript runtime** — choose it for any TypeScript script unless there is a major reason to use Deno for that specific use-case.
 
 ## Structure
 
@@ -4016,6 +4016,8 @@ export const LANG_DENO = `# TypeScript (Deno)
 
 Deno runtime with npm support via \`npm:\` prefix and native Deno libraries.
 
+**Prefer Bun (\`write-script-bun\`) for TypeScript.** Only use Deno when the script specifically requires the Deno runtime — Deno's standard library or \`deno.land\` URL imports that have no npm equivalent. For all other TypeScript, use Bun instead.
+
 ## Structure
 
 Export a single **async** function called \`main\`:
diff --git a/system_prompts/auto-generated/script.md b/system_prompts/auto-generated/script.md
index 9d393d2c7f..f5a6fd99ba 100644
--- a/system_prompts/auto-generated/script.md
+++ b/system_prompts/auto-generated/script.md
@@ -215,7 +215,7 @@ being buffered, bypassing the 10000-row return cap.
 
 # TypeScript (Bun)
 
-Bun runtime with full npm ecosystem and fastest execution.
+Bun runtime with full npm ecosystem and fastest execution. **Bun is the default and preferred TypeScript runtime** — choose it for any TypeScript script unless there is a major reason to use Deno for that specific use-case.
 
 ## Structure
 
@@ -502,6 +502,8 @@ public class Script
 
 Deno runtime with npm support via `npm:` prefix and native Deno libraries.
 
+**Prefer Bun (`write-script-bun`) for TypeScript.** Only use Deno when the script specifically requires the Deno runtime — Deno's standard library or `deno.land` URL imports that have no npm equivalent. For all other TypeScript, use Bun instead.
+
 ## Structure
 
 Export a single **async** function called `main`:
diff --git a/system_prompts/auto-generated/skills/write-script-bun/SKILL.md b/system_prompts/auto-generated/skills/write-script-bun/SKILL.md
index 44cccc7ba8..21aafa55d0 100644
--- a/system_prompts/auto-generated/skills/write-script-bun/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-bun/SKILL.md
@@ -1,6 +1,6 @@
 ---
 name: write-script-bun
-description: MUST use when writing Bun/TypeScript scripts.
+description: MUST use when writing TypeScript scripts. Bun is the default and preferred TypeScript runtime — pick it for TypeScript unless the script specifically needs Deno.
 ---
 
 ## CLI Commands
@@ -50,7 +50,7 @@ Use `wmill resource-type list --schema` to discover available resource types.
 
 # TypeScript (Bun)
 
-Bun runtime with full npm ecosystem and fastest execution.
+Bun runtime with full npm ecosystem and fastest execution. **Bun is the default and preferred TypeScript runtime** — choose it for any TypeScript script unless there is a major reason to use Deno for that specific use-case.
 
 ## Structure
 
diff --git a/system_prompts/auto-generated/skills/write-script-deno/SKILL.md b/system_prompts/auto-generated/skills/write-script-deno/SKILL.md
index ea2bfd4421..55c7bf7155 100644
--- a/system_prompts/auto-generated/skills/write-script-deno/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-deno/SKILL.md
@@ -1,6 +1,6 @@
 ---
 name: write-script-deno
-description: MUST use when writing Deno/TypeScript scripts.
+description: Use ONLY when a TypeScript script specifically requires the Deno runtime (Deno stdlib or deno.land URL imports). For all other TypeScript, use write-script-bun instead.
 ---
 
 ## CLI Commands
@@ -52,6 +52,8 @@ Use `wmill resource-type list --schema` to discover available resource types.
 
 Deno runtime with npm support via `npm:` prefix and native Deno libraries.
 
+**Prefer Bun (`write-script-bun`) for TypeScript.** Only use Deno when the script specifically requires the Deno runtime — Deno's standard library or `deno.land` URL imports that have no npm equivalent. For all other TypeScript, use Bun instead.
+
 ## Structure
 
 Export a single **async** function called `main`:
diff --git a/system_prompts/languages/bun.md b/system_prompts/languages/bun.md
index c505b6cf97..22aeb2fb74 100644
--- a/system_prompts/languages/bun.md
+++ b/system_prompts/languages/bun.md
@@ -1,6 +1,6 @@
 # TypeScript (Bun)
 
-Bun runtime with full npm ecosystem and fastest execution.
+Bun runtime with full npm ecosystem and fastest execution. **Bun is the default and preferred TypeScript runtime** — choose it for any TypeScript script unless there is a major reason to use Deno for that specific use-case.
 
 ## Structure
 
diff --git a/system_prompts/languages/deno.md b/system_prompts/languages/deno.md
index c84e5e772a..fddd08efb2 100644
--- a/system_prompts/languages/deno.md
+++ b/system_prompts/languages/deno.md
@@ -2,6 +2,8 @@
 
 Deno runtime with npm support via `npm:` prefix and native Deno libraries.
 
+**Prefer Bun (`write-script-bun`) for TypeScript.** Only use Deno when the script specifically requires the Deno runtime — Deno's standard library or `deno.land` URL imports that have no npm equivalent. For all other TypeScript, use Bun instead.
+
 ## Structure
 
 Export a single **async** function called `main`:
diff --git a/system_prompts/utils.py b/system_prompts/utils.py
index 9666b6cf0c..e2fa77d3b6 100644
--- a/system_prompts/utils.py
+++ b/system_prompts/utils.py
@@ -87,13 +87,13 @@ CLI_EXCLUDED_FIELDS = [
 LANGUAGE_METADATA = {
     'bun': {
         'name': 'TypeScript (Bun)',
-        'description': 'MUST use when writing Bun/TypeScript scripts.',
-        'use_cases': 'TypeScript automation, npm packages, data processing, API integrations'
+        'description': 'MUST use when writing TypeScript scripts. Bun is the default and preferred TypeScript runtime — pick it for TypeScript unless the script specifically needs Deno.',
+        'use_cases': 'TypeScript automation, npm packages, data processing, API integrations — the default choice for TypeScript'
     },
     'deno': {
         'name': 'TypeScript (Deno)',
-        'description': 'MUST use when writing Deno/TypeScript scripts.',
-        'use_cases': 'TypeScript with Deno stdlib, secure sandboxed execution'
+        'description': 'Use ONLY when a TypeScript script specifically requires the Deno runtime (Deno stdlib or deno.land URL imports). For all other TypeScript, use write-script-bun instead.',
+        'use_cases': 'TypeScript that specifically needs the Deno runtime (Deno stdlib or deno.land imports); prefer Bun otherwise'
     },
     # 'nativets' is intentionally omitted: it is a legacy duplicate of
     # 'bunnative' (a Bun script with a leading //native marker). No

From d2c5d6f4b4ede9449407ed3831713d3e3d1d6972 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Wed, 22 Jul 2026 11:30:23 +0200
Subject: [PATCH 106/171] feat: make content search a full CE feature (#10252)

Content search (the `#` mode of the home-page Ctrl+K search, which
searches scripts/flows/apps/resources by content) was capped on CE to 10
scripts and 3 each of flows/apps/resources, with an "EE feature" warning
in the UI. It is now a full CE feature: the CE result caps are lifted to
match the previous EE limits (10000 scripts, 1000 each of the rest) and
the EE warning is removed.

Fixes WIN-2218

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 backend/windmill-api-flows/src/flows.rs            |  4 ----
 backend/windmill-api-scripts/src/scripts.rs        |  4 ----
 backend/windmill-api/src/apps.rs                   |  4 ----
 backend/windmill-store/src/resources.rs            |  4 ----
 .../src/lib/components/ContentSearchInner.svelte   | 14 ++------------
 5 files changed, 2 insertions(+), 28 deletions(-)

diff --git a/backend/windmill-api-flows/src/flows.rs b/backend/windmill-api-flows/src/flows.rs
index ff555113c3..7f39e61f21 100644
--- a/backend/windmill-api-flows/src/flows.rs
+++ b/backend/windmill-api-flows/src/flows.rs
@@ -101,11 +101,7 @@ async fn list_search_flows(
     Path(w_id): Path<String>,
     Extension(user_db): Extension<UserDB>,
 ) -> JsonResult<Vec<SearchFlow>> {
-    #[cfg(feature = "enterprise")]
     let n = 1000;
-
-    #[cfg(not(feature = "enterprise"))]
-    let n = 3;
     let mut tx = user_db.begin(&authed).await?;
 
     let allowed = build_scope_path_predicate(&authed, "flows", "read");
diff --git a/backend/windmill-api-scripts/src/scripts.rs b/backend/windmill-api-scripts/src/scripts.rs
index 64f997ff06..20aad98864 100644
--- a/backend/windmill-api-scripts/src/scripts.rs
+++ b/backend/windmill-api-scripts/src/scripts.rs
@@ -157,12 +157,8 @@ async fn list_search_scripts(
     Extension(user_db): Extension<UserDB>,
 ) -> JsonResult<Vec<SearchScript>> {
     let mut tx = user_db.begin(&authed).await?;
-    #[cfg(feature = "enterprise")]
     let n = 10000;
 
-    #[cfg(not(feature = "enterprise"))]
-    let n = 10;
-
     let allowed = build_scope_path_predicate(&authed, "scripts", "read");
     let rows = sqlx::query_as!(
         SearchScript,
diff --git a/backend/windmill-api/src/apps.rs b/backend/windmill-api/src/apps.rs
index 4e7942b16d..0a59d5f72f 100644
--- a/backend/windmill-api/src/apps.rs
+++ b/backend/windmill-api/src/apps.rs
@@ -383,11 +383,7 @@ async fn list_search_apps(
     // apps' definitions. `check_scopes` uses ScopeDefinition::includes, where run
     // does NOT include read, so it correctly denies such tokens.
     check_scopes(&authed, || "apps:read".to_string())?;
-    #[cfg(feature = "enterprise")]
     let n = 1000;
-
-    #[cfg(not(feature = "enterprise"))]
-    let n = 3;
     let mut tx = user_db.begin(&authed).await?;
 
     let allowed = build_scope_path_predicate(&authed, "apps", "read");
diff --git a/backend/windmill-store/src/resources.rs b/backend/windmill-store/src/resources.rs
index 7a3ca50e73..8f20e2afb6 100644
--- a/backend/windmill-store/src/resources.rs
+++ b/backend/windmill-store/src/resources.rs
@@ -242,12 +242,8 @@ async fn list_search_resources(
     Extension(user_db): Extension<UserDB>,
 ) -> JsonResult<Vec<SearchResource>> {
     let mut tx = user_db.begin(&authed).await?;
-    #[cfg(feature = "enterprise")]
     let n = 1000;
 
-    #[cfg(not(feature = "enterprise"))]
-    let n = 3;
-
     let allowed = build_scope_path_predicate(&authed, "resources", "read");
     let rows = sqlx::query_as!(
         SearchResource,
diff --git a/frontend/src/lib/components/ContentSearchInner.svelte b/frontend/src/lib/components/ContentSearchInner.svelte
index d3030254ad..4b04b9b07a 100644
--- a/frontend/src/lib/components/ContentSearchInner.svelte
+++ b/frontend/src/lib/components/ContentSearchInner.svelte
@@ -1,6 +1,6 @@
 <script lang="ts">
 	import { AppService, FlowService, ResourceService, ScriptService } from '$lib/gen'
-	import { enterpriseLicense, workspaceStore } from '$lib/stores'
+	import { workspaceStore } from '$lib/stores'
 	import {
 		ArrowDown,
 		Boxes,
@@ -14,7 +14,7 @@
 	import ToggleButtonGroup from './common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import ToggleButton from './common/toggleButton-v2/ToggleButton.svelte'
 	import FlowIcon from './home/FlowIcon.svelte'
-	import { Alert, Button } from './common'
+	import { Button } from './common'
 	import YAML from 'yaml'
 	import { twMerge } from 'tailwind-merge'
 	import ContentSearchInnerItem from './ContentSearchInnerItem.svelte'
@@ -229,16 +229,6 @@
 	</div>
 
 	<div class={twMerge('p-2')}>
-		{#if !$enterpriseLicense}
-			<div class="py-1"></div>
-
-			<Alert title="Content Search is an EE feature" type="warning">
-				Without EE, content search will only search among 10 scripts, 3 flows, 3 apps and 3
-				resources.
-			</Alert>
-			<div class="py-1"></div>
-		{/if}
-
 		{#if search.trim().length > 0}
 			<div class="flex flex-col gap-4">
 				{#if (searchKind == 'all' || searchKind == 'scripts') && filteredScriptItems?.length > 0}

From 703744fb8b76f70384cbc3341d5e1b3dbf30455e Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Wed, 22 Jul 2026 11:47:53 +0200
Subject: [PATCH 107/171] feat(ai-sessions): show item preview cards for tools
 (#10254)

* feat(ai-sessions): show item preview cards for create/update/open-preview tools

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(ai-sessions): only show open_preview card when the preview actually opened

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(ai-sessions): render preview card as a chip on the tool-call header row

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../copilot/chat/ToolExecutionDisplay.svelte  | 73 +++++++++++++------
 .../copilot/chat/ToolMessageActions.svelte    |  5 ++
 .../copilot/chat/ToolPreviewCard.svelte       | 45 ++++++++++++
 .../components/copilot/chat/global/core.ts    | 57 +++++++++++++--
 .../components/copilot/chat/shared.test.ts    | 21 ++++++
 .../src/lib/components/copilot/chat/shared.ts | 33 ++++++++-
 .../(root)/(logged)/sessions/+page.svelte     | 20 +++++
 7 files changed, 224 insertions(+), 30 deletions(-)
 create mode 100644 frontend/src/lib/components/copilot/chat/ToolPreviewCard.svelte

diff --git a/frontend/src/lib/components/copilot/chat/ToolExecutionDisplay.svelte b/frontend/src/lib/components/copilot/chat/ToolExecutionDisplay.svelte
index 59c9dcede4..be77af7e0a 100644
--- a/frontend/src/lib/components/copilot/chat/ToolExecutionDisplay.svelte
+++ b/frontend/src/lib/components/copilot/chat/ToolExecutionDisplay.svelte
@@ -9,6 +9,7 @@
 	import { slide } from 'svelte/transition'
 	import ToolContentDisplay from './ToolContentDisplay.svelte'
 	import ToolMessageActions from './ToolMessageActions.svelte'
+	import ToolPreviewCard from './ToolPreviewCard.svelte'
 	import AskUserQuestionDisplay from './AskUserQuestionDisplay.svelte'
 	import WebSearchSourcesDisplay from './WebSearchSourcesDisplay.svelte'
 	import ExpandableImage from '$lib/components/common/image/ExpandableImage.svelte'
@@ -50,6 +51,14 @@
 	const activeUserQuestion = $derived(
 		isActiveUserQuestion(message) ? message.userQuestion : undefined
 	)
+
+	// The preview chip sits on the header row (to the right of the tool-call text);
+	// shown once the tool settled, never while loading/erroring/awaiting confirmation.
+	const showPreviewChip = $derived(
+		Boolean(
+			message.previewCard && !message.isLoading && !message.error && !message.needsConfirmation
+		)
+	)
 </script>
 
 {#if activeUserQuestion}
@@ -57,32 +66,48 @@
 {:else}
 	<div class="font-mono text-xs">
 		<!-- Collapsible Header -->
-		<button
-			class={twMerge(
-				'py-0.5 my-0.5 rounded-md hover:bg-surface-hover transition-colors inline-flex items-center text-left',
-				message.needsConfirmation ? 'opacity-80' : ''
-			)}
-			onclick={() => (isExpanded = !isExpanded)}
-			disabled={!detailsAvailable && !message.isStreamingArguments}
-		>
-			<div class="flex items-center gap-2">
-				{#if message.isLoading && !message.needsConfirmation}
-					<Loader2 class="w-3.5 h-3.5 animate-spin text-blue-500" />
-				{/if}
-				<span class="text-primary font-medium text-2xs">
-					{message.content}
-				</span>
+		{#snippet headerButton()}
+			<button
+				class={twMerge(
+					'min-w-0 py-0.5 my-0.5 rounded-md hover:bg-surface-hover transition-colors inline-flex items-center text-left',
+					message.needsConfirmation ? 'opacity-80' : ''
+				)}
+				onclick={() => (isExpanded = !isExpanded)}
+				disabled={!detailsAvailable && !message.isStreamingArguments}
+			>
+				<div class="flex items-center gap-2 min-w-0">
+					{#if message.isLoading && !message.needsConfirmation}
+						<Loader2 class="w-3.5 h-3.5 animate-spin text-blue-500 shrink-0" />
+					{/if}
+					<span
+						class={twMerge('text-primary font-medium text-2xs', showPreviewChip ? 'truncate' : '')}
+					>
+						{message.content}
+					</span>
 
-				{#if detailsAvailable || message.isStreamingArguments}
-					<ChevronRight
-						class={twMerge(
-							'w-3 h-3 text-secondary transition-transform duration-150',
-							isExpanded ? 'rotate-90' : ''
-						)}
-					/>
-				{/if}
+					{#if detailsAvailable || message.isStreamingArguments}
+						<ChevronRight
+							class={twMerge(
+								'w-3 h-3 text-secondary transition-transform duration-150 shrink-0',
+								isExpanded ? 'rotate-90' : ''
+							)}
+						/>
+					{/if}
+				</div>
+			</button>
+		{/snippet}
+
+		<!-- Discrete preview chip for an item a tool created/updated/opened, pinned to
+		     the right of the header row. Rendered inline (not gated on expand) so it
+		     stays visible after the tool collapses. -->
+		{#if showPreviewChip && message.previewCard}
+			<div class="flex items-center justify-between gap-2">
+				{@render headerButton()}
+				<ToolPreviewCard card={message.previewCard} />
 			</div>
-		</button>
+		{:else}
+			{@render headerButton()}
+		{/if}
 
 		<!-- Image a tool produced (e.g. take_screenshot) — shown inline, not gated on expand. -->
 		{#if message.imageUrl}
diff --git a/frontend/src/lib/components/copilot/chat/ToolMessageActions.svelte b/frontend/src/lib/components/copilot/chat/ToolMessageActions.svelte
index 58ebfe2bb8..02612492a5 100644
--- a/frontend/src/lib/components/copilot/chat/ToolMessageActions.svelte
+++ b/frontend/src/lib/components/copilot/chat/ToolMessageActions.svelte
@@ -81,6 +81,11 @@
 			const config = navigatePageConfig[action.page] ?? { title: action.page, icon: Route }
 			return { ...config, subtitle: action.label, buttonIcon: ArrowRight }
 		}
+		if (action.type === 'open_item_preview') {
+			// Preview-item cards render through ToolPreviewCard, not here; keep this branch
+			// only so the exhaustive union stays type-safe.
+			return { title: action.label, icon: SquarePen, subtitle: action.path, buttonIcon: ArrowRight }
+		}
 		const key: ActionCardKey | undefined =
 			action.resource === 'trigger' ? action.triggerKind : action.resource
 		const config = key
diff --git a/frontend/src/lib/components/copilot/chat/ToolPreviewCard.svelte b/frontend/src/lib/components/copilot/chat/ToolPreviewCard.svelte
new file mode 100644
index 0000000000..79e37e90b7
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/ToolPreviewCard.svelte
@@ -0,0 +1,45 @@
+<script lang="ts">
+	import { PanelRight } from 'lucide-svelte'
+	import RowIcon from '$lib/components/common/table/RowIcon.svelte'
+	import { runToolDisplayAction } from './createdResourceActions.svelte'
+	import { openItemPreviewAction, type PreviewCardKind } from './shared'
+
+	interface Props {
+		card: { kind: PreviewCardKind; path: string }
+	}
+
+	let { card }: Props = $props()
+
+	// RowIcon has no 'pipeline' kind — a pipeline is a folder graph, shown with the
+	// data-pipeline icon.
+	const iconKind = $derived(card.kind === 'pipeline' ? 'data_pipeline' : card.kind)
+	const kindLabel = $derived(
+		card.kind === 'raw_app' ? 'app' : card.kind === 'pipeline' ? 'pipeline' : card.kind
+	)
+
+	let opening = $state(false)
+	async function open() {
+		if (opening) return
+		opening = true
+		try {
+			await runToolDisplayAction(openItemPreviewAction(card.kind, card.path))
+		} finally {
+			opening = false
+		}
+	}
+</script>
+
+<button
+	type="button"
+	onclick={open}
+	disabled={opening}
+	title="Open {kindLabel} preview: {card.path}"
+	class="group shrink-0 inline-flex items-center gap-1.5 rounded-md border border-light bg-surface pl-1.5 pr-2 py-1 transition-colors hover:bg-surface-hover disabled:opacity-60"
+>
+	<span class="inline-flex shrink-0">
+		<RowIcon kind={iconKind} size={12} />
+	</span>
+	<span class="inline-flex items-center gap-1 text-2xs text-tertiary group-hover:text-secondary">
+		Preview <PanelRight size={11} />
+	</span>
+</button>
diff --git a/frontend/src/lib/components/copilot/chat/global/core.ts b/frontend/src/lib/components/copilot/chat/global/core.ts
index 3e8375bf39..d3ecb3330f 100644
--- a/frontend/src/lib/components/copilot/chat/global/core.ts
+++ b/frontend/src/lib/components/copilot/chat/global/core.ts
@@ -81,6 +81,7 @@ import {
 	executeTestRun,
 	findAndReplace,
 	type CreatedResourceTriggerKind,
+	type PreviewCardKind,
 	type Tool,
 	type ToolCallbacks,
 	type ToolDisplayAction
@@ -3259,7 +3260,18 @@ export const globalTools: Tool<{}>[] = [
 		),
 		fn: async (ctx) => {
 			const parsed = openPreviewSchema.parse(ctx.args)
-			return openSessionPreview(parsed, sessionIdFromCtx(ctx))
+			const sessionId = sessionIdFromCtx(ctx)
+			const { opened, message } = openSessionPreview(parsed, sessionId)
+			// Surface the same discrete card the write tools show, so the user can
+			// re-open/focus the preview later from the tool call. Only when the tool
+			// actually opened the preview (not for a refused open, e.g. a gated
+			// pipeline), and only in a session.
+			if (sessionId && opened) {
+				ctx.toolCallbacks.setToolStatus(ctx.toolId, {
+					previewCard: { kind: parsed.kind, path: parsed.path }
+				})
+			}
+			return message
 		}
 	},
 	{
@@ -3548,18 +3560,25 @@ export function setOpenPreviewHandler(handler: OpenPreviewHandler | undefined):
 	openPreviewHandler = handler
 }
 
+// `opened` distinguishes a real open (the caller may then offer a preview card)
+// from a refusal that is returned as a message rather than thrown — so the card is
+// never shown for an item the tool declined to preview (e.g. a gated pipeline).
 function openSessionPreview(
 	args: { kind: 'script' | 'flow' | 'raw_app' | 'pipeline'; path: string },
 	sessionId: string | undefined
-) {
+): { opened: boolean; message: string } {
 	if (!openPreviewHandler) {
-		return 'Error: open_preview is only available inside an AI session. Tell the user to switch to a session to view the preview, or describe the item textually.'
+		return {
+			opened: false,
+			message:
+				'Error: open_preview is only available inside an AI session. Tell the user to switch to a session to view the preview, or describe the item textually.'
+		}
 	}
 	// open_preview only exists in sessions, so no sessionId check is needed here.
 	if (args.kind === 'pipeline' && !isSessionPipelinesEnabled()) {
-		return SESSION_PIPELINES_GATED_MESSAGE
+		return { opened: false, message: SESSION_PIPELINES_GATED_MESSAGE }
 	}
-	return openPreviewHandler({ ...args, sessionId })
+	return { opened: true, message: openPreviewHandler({ ...args, sessionId }) }
 }
 
 // Opens a workspace *page* (Runs, Schedules, …) as a page tab in the session's
@@ -3912,6 +3931,32 @@ function draftWriteFailure(result: DraftPersistResult, ctx: WriteDraftCtx): stri
 	return undefined
 }
 
+// Item kinds a session preview can host, keyed by the draft item kind a write
+// resolves to. Kinds absent here (resources, variables, triggers, legacy `app`)
+// have no preview panel, so no card is offered for them.
+const PREVIEW_CARD_KIND_BY_ITEM_KIND: Partial<
+	Record<DraftPersistResult['itemKind'], PreviewCardKind>
+> = {
+	script: 'script',
+	flow: 'flow',
+	raw_app: 'raw_app'
+}
+
+// Offer a preview card for a write that landed a previewable item. Session chats
+// only (`ctx.sessionId`): the card opens the item in the side panel, which the
+// global side-panel chat has no equivalent of. `path` is the item's display path
+// (what `open_preview` takes), not its synthetic draft storage key.
+function maybeAttachPreviewCard(
+	ctx: WriteDraftCtx,
+	itemKind: DraftPersistResult['itemKind'],
+	path: string
+): void {
+	if (!ctx.sessionId) return
+	const kind = PREVIEW_CARD_KIND_BY_ITEM_KIND[itemKind]
+	if (!kind) return
+	ctx.toolCallbacks.setToolStatus(ctx.toolId, { previewCard: { kind, path } })
+}
+
 // App write tools build varied success messages but share the same conflict /
 // save-failure handling; `onSaved` supplies the per-tool status + message.
 function finishAppDraftWrite(
@@ -3922,6 +3967,7 @@ function finishAppDraftWrite(
 	const failure = draftWriteFailure(result, ctx)
 	if (failure) return failure
 	ctx.toolCallbacks.onItemModified?.(result.itemKind, result.storagePath)
+	maybeAttachPreviewCard(ctx, result.itemKind, result.item.path)
 	const { content, message } = onSaved()
 	ctx.toolCallbacks.setToolStatus(ctx.toolId, { content, result: 'Saved as draft' })
 	return JSON.stringify({ success: true, message }, null, 2)
@@ -3935,6 +3981,7 @@ function finishDraftWrite(
 	const failure = draftWriteFailure(result, ctx)
 	if (failure) return failure
 	ctx.toolCallbacks.onItemModified?.(result.itemKind, result.storagePath)
+	maybeAttachPreviewCard(ctx, result.itemKind, result.item.path)
 	const stored = result.item
 	const verb = existed ? 'Updated' : 'Created'
 	// Don't echo the flow value back: the model just sent it in the write call,
diff --git a/frontend/src/lib/components/copilot/chat/shared.test.ts b/frontend/src/lib/components/copilot/chat/shared.test.ts
index 459ff6f5da..ec6febca80 100644
--- a/frontend/src/lib/components/copilot/chat/shared.test.ts
+++ b/frontend/src/lib/components/copilot/chat/shared.test.ts
@@ -1,6 +1,7 @@
 import { describe, expect, it, vi } from 'vitest'
 import { z } from 'zod'
 import type { DisplayMessage, ToolDisplayMessage } from './shared'
+import { openItemPreviewAction } from './shared'
 
 vi.mock('monaco-editor', () => ({
 	editor: {}
@@ -973,3 +974,23 @@ describe('appendPendingToolImages', () => {
 		expect(addedMessages).toHaveLength(1)
 	})
 })
+
+describe('openItemPreviewAction', () => {
+	// The action's `type` is the key the sessions page registers its handler under,
+	// so it must stay 'open_item_preview'; `previewKind`/`path` are passed verbatim
+	// to previewTargetForSessionTarget.
+	it('carries the kind and path through to the dispatch action', () => {
+		expect(openItemPreviewAction('flow', 'f/team/etl')).toEqual({
+			id: 'open-item-preview:flow:f/team/etl',
+			type: 'open_item_preview',
+			label: 'Open flow preview',
+			previewKind: 'flow',
+			path: 'f/team/etl'
+		})
+	})
+
+	// raw_app is the internal kind; the user-facing label says "app".
+	it('labels raw_app as "app"', () => {
+		expect(openItemPreviewAction('raw_app', 'u/me/dash').label).toBe('Open app preview')
+	})
+})
diff --git a/frontend/src/lib/components/copilot/chat/shared.ts b/frontend/src/lib/components/copilot/chat/shared.ts
index 55febeb014..ce2bfe0d02 100644
--- a/frontend/src/lib/components/copilot/chat/shared.ts
+++ b/frontend/src/lib/components/copilot/chat/shared.ts
@@ -515,7 +515,34 @@ export type NavigateAction = {
 	page: string
 }
 
-export type ToolDisplayAction = CreatedResourceAction | NavigateAction
+/** Kinds of item a session preview can host — the subset the `open_preview` tool
+ * accepts. `pipeline` targets a folder graph, the rest a workspace item path. */
+export type PreviewCardKind = 'script' | 'flow' | 'raw_app' | 'pipeline'
+
+// A discrete card shown under a tool call that created/updated/opened the preview of
+// a workspace item. Clicking it opens the item's live preview in the session side
+// panel — or focuses the tab if it is already open. The handler is registered by the
+// sessions page (the only surface with a preview panel).
+export type OpenItemPreviewAction = {
+	id: string
+	type: 'open_item_preview'
+	label: string
+	previewKind: PreviewCardKind
+	path: string
+}
+
+export type ToolDisplayAction = CreatedResourceAction | NavigateAction | OpenItemPreviewAction
+
+/** Build the action a preview card dispatches from its (kind, path). */
+export function openItemPreviewAction(kind: PreviewCardKind, path: string): OpenItemPreviewAction {
+	return {
+		id: `open-item-preview:${kind}:${path}`,
+		type: 'open_item_preview',
+		label: `Open ${kind === 'raw_app' ? 'app' : kind} preview`,
+		previewKind: kind,
+		path
+	}
+}
 
 export type UserQuestionDisplay = {
 	question: string
@@ -559,6 +586,10 @@ export type ToolDisplayMessage = {
 	webSearchSources?: WebSearchSource[]
 	/** Data URL of an image the tool produced (e.g. take_screenshot), shown on the card. */
 	imageUrl?: string
+	/** Workspace item this tool created/updated or opened a preview of. Rendered as a
+	 * discrete, always-visible card that opens (or focuses) the item's preview in the
+	 * session side panel. Set only for session chats — the side panel is their surface. */
+	previewCard?: { kind: PreviewCardKind; path: string }
 }
 
 export type AssistantDisplayMessage = BaseDisplayMessage & {
diff --git a/frontend/src/routes/(root)/(logged)/sessions/+page.svelte b/frontend/src/routes/(root)/(logged)/sessions/+page.svelte
index a3f45f95fd..befe784637 100644
--- a/frontend/src/routes/(root)/(logged)/sessions/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/sessions/+page.svelte
@@ -44,6 +44,8 @@
 	import { markSessionSeen } from '$lib/components/sessions/sessionUnread.svelte'
 	import { isGlobalAiEnabled } from '$lib/components/copilot/chat/global/gate'
 	import { setToolCompletionListener } from '$lib/components/copilot/chat/shared'
+	import { registerToolDisplayActionHandler } from '$lib/components/copilot/chat/createdResourceActions.svelte'
+	import { previewTargetForSessionTarget } from '$lib/components/sessions/sessionPreviewTabs.svelte'
 	import { base } from '$lib/base'
 	import {
 		artifactKey,
@@ -458,6 +460,24 @@
 		}
 	})
 
+	// Preview cards under create/update/open-preview tool calls dispatch here. Open
+	// (or focus, if already shown) the item's preview in the active session's panel —
+	// the visible chat is always the active session, so `owner` is its panel. Read
+	// `owner` lazily inside the handler (not in the effect body) so this registers
+	// once, not on every session switch. A 'focused' open leaves the tab where it is,
+	// so pulse it to make the click visibly land.
+	$effect(() => {
+		return registerToolDisplayActionHandler('open_item_preview', (action) => {
+			if (action.type !== 'open_item_preview') return
+			const o = owner
+			if (!o) return
+			const target = previewTargetForSessionTarget(action.previewKind, action.path)
+			if (!target) return
+			const { status } = o.open(target)
+			if (status === 'focused') o.pulseFocus(o.activeId)
+		})
+	})
+
 	// Editor-style breadcrumb over the previewed page. We only render clickable
 	// segments when the preview is sitting on a script/flow/app route — for any
 	// other page (home, runs, …) there's no item to drill into, so we fall back

From 5685981c9902ff37c3bd271dc5c5ede948a0787a Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Wed, 22 Jul 2026 11:49:08 +0200
Subject: [PATCH 108/171] fix(tutorials): repair broken frontend tutorials
 after UI redesigns (#10255)

* fix(tutorials): repair broken frontend tutorials after UI redesigns

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(tutorials): wait for New menu anchor and drop vestigial async

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 frontend/src/lib/components/RunsPage.svelte   |   8 +-
 .../components/tutorials/RunsTutorial.svelte  | 198 +++++++++++-------
 .../app/BackgroundRunnablesTutorial.svelte    |   2 +-
 .../tutorials/app/ConnectionTutorial.svelte   |   2 +-
 .../WorkspaceOnboardingTutorial.svelte        |  55 ++---
 5 files changed, 141 insertions(+), 124 deletions(-)

diff --git a/frontend/src/lib/components/RunsPage.svelte b/frontend/src/lib/components/RunsPage.svelte
index 9b447a7d0c..ed93550669 100644
--- a/frontend/src/lib/components/RunsPage.svelte
+++ b/frontend/src/lib/components/RunsPage.svelte
@@ -565,7 +565,7 @@
 {:else}
 	<div class="w-full h-screen flex flex-col" bind:clientWidth={innerWidth}>
 		<!-- Header and filters -->
-		<div class="flex flex-row items-start w-full px-4 gap-3 py-4 flex-wrap">
+		<div id="runs-filters-bar" class="flex flex-row items-start w-full px-4 gap-3 py-4 flex-wrap">
 			<div class="flex flex-row items-center gap-6">
 				<h1
 					class={twMerge(
@@ -772,11 +772,11 @@
 		</div>
 
 		<!-- Graph -->
-		<div class="p-2 px-4 bg-surface-tertiary mx-4 border rounded-md">
+		<div id="runs-chart" class="p-2 px-4 bg-surface-tertiary mx-4 border rounded-md">
 			<div class="relative z-10 mb-2 flex gap-2">
 				<Tabs bind:selected={graph}>
-					<Tab value="RunChart" label="Duration" />
-					<Tab value="ConcurrencyChart" label="Concurrency">
+					<Tab value="RunChart" label="Duration" id="runs-chart-duration-tab" />
+					<Tab value="ConcurrencyChart" label="Concurrency" id="runs-chart-concurrency-tab">
 						{#snippet extra()}
 							{#if warnJobLimit}
 								<Tooltip Icon={TriangleAlertIcon}>{warnJobLimitMsg}</Tooltip>
diff --git a/frontend/src/lib/components/tutorials/RunsTutorial.svelte b/frontend/src/lib/components/tutorials/RunsTutorial.svelte
index 8f59a42f6b..0b19ac5f0e 100644
--- a/frontend/src/lib/components/tutorials/RunsTutorial.svelte
+++ b/frontend/src/lib/components/tutorials/RunsTutorial.svelte
@@ -6,7 +6,14 @@
 	import { workspaceStore, userStore } from '$lib/stores'
 	import { wait } from '$lib/utils'
 	import { waitJob } from '$lib/components/waitJob'
-	import { DELAY_SHORT, DELAY_MEDIUM, DELAY_LONG, createFakeCursor, animateCursorToElementAndClick, animateFakeCursorClick } from './utils'
+	import {
+		DELAY_SHORT,
+		DELAY_MEDIUM,
+		DELAY_LONG,
+		createFakeCursor,
+		animateCursorToElementAndClick,
+		animateFakeCursorClick
+	} from './utils'
 	import { goto } from '$app/navigation'
 	import { base } from '$lib/base'
 	import { sendUserToast } from '$lib/toast'
@@ -38,7 +45,8 @@
 						id: 'hello',
 						value: {
 							type: 'rawscript',
-							content: 'export async function main() {\n  return {\n    message: "Hello from the Runs tutorial!",\n    timestamp: new Date().toISOString()\n  };\n}',
+							content:
+								'export async function main() {\n  return {\n    message: "Hello from the Runs tutorial!",\n    timestamp: new Date().toISOString()\n  };\n}',
 							language: 'bun',
 							input_transforms: {}
 						},
@@ -80,7 +88,8 @@
 						id: 'error',
 						value: {
 							type: 'rawscript',
-							content: 'export async function main() {\n  throw new Error("Intentional error for tutorial - this demonstrates how failed jobs appear in the runs list");\n}',
+							content:
+								'export async function main() {\n  throw new Error("Intentional error for tutorial - this demonstrates how failed jobs appear in the runs list");\n}',
 							language: 'bun',
 							input_transforms: {}
 						},
@@ -103,7 +112,7 @@
 		}
 
 		await FlowService.createFlow({
-					workspace: $workspaceStore!,
+			workspace: $workspaceStore!,
 			requestBody: flow
 		})
 
@@ -126,88 +135,101 @@
 
 	function getTutorialSteps(driver: any): DriveStep[] {
 		return [
-		{
-			popover: {
-				title: 'Welcome to your Monitoring Dashboard!',
-				description: "<p>Before we dive in, let's define a key term: a Job. A &quot;Job&quot; is simply a single run of a script or flow. Every time you run code, Windmill creates a Job to track if it succeeded or failed, how long it took, and what the results were.</p><p style='margin-top: 12px;'>In this tutorial, we will explore:</p><ul style='margin-top: 8px; padding-left: 20px;'><li style='margin-bottom: 8px;'><svg width='16' height='16' viewBox='0 0 24 24' fill='none' stroke='currentColor' stroke-width='2' stroke-linecap='round' stroke-linejoin='round' style='color: #22c55e; display: inline-block; vertical-align: middle; margin-right: 6px;'><circle cx='12' cy='12' r='10'/><path d='m9 12 2 2 4-4'/></svg>A successful job execution.</li><li style='margin-bottom: 8px;'><svg width='16' height='16' viewBox='0 0 24 24' fill='none' stroke='currentColor' stroke-width='2' stroke-linecap='round' stroke-linejoin='round' style='color: #ef4444; display: inline-block; vertical-align: middle; margin-right: 6px;'><circle cx='12' cy='12' r='10'/><path d='m12 8v4'/><path d='m12 16h.01'/></svg>A failed job execution.</li><li><svg width='16' height='16' viewBox='0 0 24 24' fill='none' stroke='currentColor' stroke-width='2' stroke-linecap='round' stroke-linejoin='round' style='color: #3b82f6; display: inline-block; vertical-align: middle; margin-right: 6px;'><circle cx='11' cy='11' r='8'/><path d='m21 21-4.35-4.35'/></svg>How to filter your monitoring view.</li></ul>",
-				onNextClick: () => {
-					driver.moveNext()
-				},
-				onPrevClick: () => {
-					sendUserToast('Previous is not available for this step', true, [], undefined, 3000)
+			{
+				popover: {
+					title: 'Welcome to your Monitoring Dashboard!',
+					description:
+						"<p>Before we dive in, let's define a key term: a Job. A &quot;Job&quot; is simply a single run of a script or flow. Every time you run code, Windmill creates a Job to track if it succeeded or failed, how long it took, and what the results were.</p><p style='margin-top: 12px;'>In this tutorial, we will explore:</p><ul style='margin-top: 8px; padding-left: 20px;'><li style='margin-bottom: 8px;'><svg width='16' height='16' viewBox='0 0 24 24' fill='none' stroke='currentColor' stroke-width='2' stroke-linecap='round' stroke-linejoin='round' style='color: #22c55e; display: inline-block; vertical-align: middle; margin-right: 6px;'><circle cx='12' cy='12' r='10'/><path d='m9 12 2 2 4-4'/></svg>A successful job execution.</li><li style='margin-bottom: 8px;'><svg width='16' height='16' viewBox='0 0 24 24' fill='none' stroke='currentColor' stroke-width='2' stroke-linecap='round' stroke-linejoin='round' style='color: #ef4444; display: inline-block; vertical-align: middle; margin-right: 6px;'><circle cx='12' cy='12' r='10'/><path d='m12 8v4'/><path d='m12 16h.01'/></svg>A failed job execution.</li><li><svg width='16' height='16' viewBox='0 0 24 24' fill='none' stroke='currentColor' stroke-width='2' stroke-linecap='round' stroke-linejoin='round' style='color: #3b82f6; display: inline-block; vertical-align: middle; margin-right: 6px;'><circle cx='11' cy='11' r='8'/><path d='m21 21-4.35-4.35'/></svg>How to filter your monitoring view.</li></ul>",
+					onNextClick: () => {
+						driver.moveNext()
+					},
+					onPrevClick: () => {
+						sendUserToast('Previous is not available for this step', true, [], undefined, 3000)
+					}
 				}
-			}
-		},
+			},
 			{
 				element: '#runs-table-wrapper',
 				onHighlighted: async () => {
 					step2Complete = false
 					await wait(DELAY_MEDIUM)
-					
+
 					// Find all jobs
 					const allJobRows = Array.from(
 						document.querySelectorAll('#runs-table-wrapper .cursor-pointer')
 					) as HTMLElement[]
-					
+
 					// Find successful job (green badge/check icon) - first one that's not failed
-					const successfulJobRow = allJobRows.find((el) => {
-						const hasRedBadge = el.querySelector('[class*="bg-red"], [class*="text-red"]')
-						const hasGreenBadge = el.querySelector('[class*="bg-green"], [class*="text-green"]')
-						return !hasRedBadge && hasGreenBadge !== null
-					}) || allJobRows[0]
+					const successfulJobRow =
+						allJobRows.find((el) => {
+							const hasRedBadge = el.querySelector('[class*="bg-red"], [class*="text-red"]')
+							const hasGreenBadge = el.querySelector('[class*="bg-green"], [class*="text-green"]')
+							return !hasRedBadge && hasGreenBadge !== null
+						}) || allJobRows[0]
 
 					if (successfulJobRow) {
 						// Create cursor
 						const cursor = createFakeCursor()
-						
+
 						// Click on successful job
 						await animateCursorToElementAndClick(cursor, successfulJobRow)
-						
+
 						// Wait for navigation to job details page
 						await wait(DELAY_LONG)
-						
+
 						// Navigate back to runs page using SvelteKit navigation
 						await goto(`${base}/runs?tutorial=runs-tutorial`, { replaceState: true })
 						await wait(DELAY_LONG)
-						
+
 						// Remove the cursor
 						cursor.remove()
 						step2Complete = true
 					}
 				},
 				popover: {
-					title: 'Exploring successful job runs <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" style="color: #22c55e; display: inline-block; vertical-align: middle;"><circle cx="12" cy="12" r="10"/><path d="m9 12 2 2 4-4"/></svg>',
+					title:
+						'Exploring successful job runs <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" style="color: #22c55e; display: inline-block; vertical-align: middle;"><circle cx="12" cy="12" r="10"/><path d="m9 12 2 2 4-4"/></svg>',
 					description:
-						'Let\'s click on a successful job to see how to inspect a completed execution.',
+						"Let's click on a successful job to see how to inspect a completed execution.",
 					side: 'bottom',
 					onNextClick: async () => {
 						if (!step2Complete) {
-							sendUserToast('Please wait for the job click to complete...', false, [], undefined, 3000)
+							sendUserToast(
+								'Please wait for the job click to complete...',
+								false,
+								[],
+								undefined,
+								3000
+							)
 							return
 						}
 						// Click on the successful job again (without showing cursor)
-						const successfulJobRow = Array.from(
-							document.querySelectorAll('#runs-table-wrapper .cursor-pointer')
-						).find((el) => {
-							const hasRedBadge = el.querySelector('[class*="bg-red"], [class*="text-red"]')
-							const hasGreenBadge = el.querySelector('[class*="bg-green"], [class*="text-green"]')
-							return !hasRedBadge && hasGreenBadge !== null
-						}) as HTMLElement || Array.from(
-							document.querySelectorAll('#runs-table-wrapper .cursor-pointer')
-						)[0] as HTMLElement
-						
+						const successfulJobRow =
+							(Array.from(document.querySelectorAll('#runs-table-wrapper .cursor-pointer')).find(
+								(el) => {
+									const hasRedBadge = el.querySelector('[class*="bg-red"], [class*="text-red"]')
+									const hasGreenBadge = el.querySelector(
+										'[class*="bg-green"], [class*="text-green"]'
+									)
+									return !hasRedBadge && hasGreenBadge !== null
+								}
+							) as HTMLElement) ||
+							(Array.from(
+								document.querySelectorAll('#runs-table-wrapper .cursor-pointer')
+							)[0] as HTMLElement)
+
 						if (successfulJobRow) {
 							successfulJobRow.click()
 							await wait(DELAY_SHORT)
-							
+
 							// Wait for navigation to job details page
 							await wait(DELAY_LONG)
-							
+
 							// Navigate back to runs page using SvelteKit navigation
 							await goto(`${base}/runs?tutorial=runs-tutorial`, { replaceState: true })
 							await wait(DELAY_LONG)
 						}
-						
+
 						driver.moveNext()
 					},
 					onPrevClick: () => {
@@ -220,12 +242,12 @@
 				onHighlighted: async () => {
 					step3Complete = false
 					await wait(DELAY_MEDIUM)
-					
+
 					// Find all jobs
 					const allJobRows = Array.from(
 						document.querySelectorAll('#runs-table-wrapper .cursor-pointer')
 					) as HTMLElement[]
-					
+
 					// Find failed job (red badge/X icon)
 					const failedJobRow = allJobRows.find((el) => {
 						const badge = el.querySelector('[class*="bg-red"], [class*="text-red"]')
@@ -235,30 +257,36 @@
 					if (failedJobRow) {
 						// Create cursor
 						const cursor = createFakeCursor()
-						
+
 						// Click on failed job
 						await animateCursorToElementAndClick(cursor, failedJobRow)
-						
+
 						// Wait for navigation to job details page
 						await wait(DELAY_LONG)
-						
+
 						// Navigate back to runs page using SvelteKit navigation
 						await goto(`${base}/runs?tutorial=runs-tutorial`, { replaceState: true })
 						await wait(DELAY_LONG)
-						
+
 						// Remove the cursor
 						cursor.remove()
 						step3Complete = true
 					}
 				},
 				popover: {
-					title: 'Exploring failed job runs <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" style="color: #ef4444; display: inline-block; vertical-align: middle;"><circle cx="12" cy="12" r="10"/><path d="m12 8v4"/><path d="m12 16h.01"/></svg>',
-					description:
-						'Now let\'s click on a failed job to see how to inspect a failed execution.',
+					title:
+						'Exploring failed job runs <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" style="color: #ef4444; display: inline-block; vertical-align: middle;"><circle cx="12" cy="12" r="10"/><path d="m12 8v4"/><path d="m12 16h.01"/></svg>',
+					description: "Now let's click on a failed job to see how to inspect a failed execution.",
 					side: 'bottom',
 					onNextClick: async () => {
 						if (!step3Complete) {
-							sendUserToast('Please wait for the job click to complete...', false, [], undefined, 3000)
+							sendUserToast(
+								'Please wait for the job click to complete...',
+								false,
+								[],
+								undefined,
+								3000
+							)
 							return
 						}
 						// Click on the failed job again (without showing cursor)
@@ -268,19 +296,19 @@
 							const badge = el.querySelector('[class*="bg-red"], [class*="text-red"]')
 							return badge !== null
 						}) as HTMLElement
-						
+
 						if (failedJobRow) {
 							failedJobRow.click()
 							await wait(DELAY_SHORT)
-							
+
 							// Wait for navigation to job details page
 							await wait(DELAY_LONG)
-							
+
 							// Navigate back to runs page using SvelteKit navigation
 							await goto(`${base}/runs?tutorial=runs-tutorial`, { replaceState: true })
 							await wait(DELAY_LONG)
 						}
-						
+
 						driver.moveNext()
 					},
 					onPrevClick: () => {
@@ -289,7 +317,7 @@
 				}
 			},
 			{
-				element: 'div.p-2.px-4.pt-8.w-full.border-b',
+				element: '#runs-chart',
 				popover: {
 					title: 'Visual run history',
 					description:
@@ -304,15 +332,15 @@
 				}
 			},
 			{
-				element: 'div.p-2.px-4.pt-8.w-full.border-b',
+				element: '#runs-chart',
 				onHighlighted: async () => {
 					step5Complete = false
 					await wait(DELAY_MEDIUM)
-					// Find the button with data-value="ConcurrencyChart"
+					// Switch to the Concurrency chart tab
 					const concurrencyButton = document.querySelector(
-						'button[data-value="ConcurrencyChart"]'
+						'#runs-chart-concurrency-tab'
 					) as HTMLElement
-					
+
 					if (concurrencyButton) {
 						await animateFakeCursorClick(concurrencyButton)
 						await wait(DELAY_MEDIUM)
@@ -326,7 +354,13 @@
 					side: 'bottom',
 					onNextClick: () => {
 						if (!step5Complete) {
-							sendUserToast('Please wait for the chart switch to complete...', false, [], undefined, 3000)
+							sendUserToast(
+								'Please wait for the chart switch to complete...',
+								false,
+								[],
+								undefined,
+								3000
+							)
 							return
 						}
 						driver.moveNext()
@@ -337,11 +371,11 @@
 				}
 			},
 			{
-				element: 'div.flex.flex-row.items-start.w-full.border-b.px-4.gap-8',
+				element: '#status',
 				onHighlighted: async () => {
 					step6Complete = false
 					await wait(DELAY_MEDIUM)
-					
+
 					// Find the success and failure filter buttons
 					const successButton = document.querySelector(
 						'button[data-value="success"]'
@@ -349,18 +383,18 @@
 					const failureButton = document.querySelector(
 						'button[data-value="failure"]'
 					) as HTMLElement
-					
+
 					if (successButton && failureButton) {
 						// Create cursor once for both clicks
 						const cursor = createFakeCursor()
-						
+
 						// Click on failure button first
 						await animateCursorToElementAndClick(cursor, failureButton)
 						await wait(DELAY_MEDIUM)
-						
+
 						// Click on success button
 						await animateCursorToElementAndClick(cursor, successButton)
-						
+
 						// Remove the cursor
 						cursor.remove()
 						await wait(DELAY_MEDIUM)
@@ -374,7 +408,13 @@
 					side: 'bottom',
 					onNextClick: () => {
 						if (!step6Complete) {
-							sendUserToast('Please wait for the filter clicks to complete...', false, [], undefined, 3000)
+							sendUserToast(
+								'Please wait for the filter clicks to complete...',
+								false,
+								[],
+								undefined,
+								3000
+							)
 							return
 						}
 						driver.moveNext()
@@ -385,11 +425,11 @@
 				}
 			},
 			{
-				element: 'div.flex.flex-row.gap-4.items-center.px-2.py-1.grow-0.justify-between',
+				element: '#runs-filters-bar',
 				popover: {
 					title: 'More filtering options',
 					description:
-						'Even more filters are available to help you find exactly what you\'re looking for. Explore the additional filtering options to refine your search.',
+						"Even more filters are available to help you find exactly what you're looking for. Explore the additional filtering options to refine your search.",
 					side: 'bottom',
 					onNextClick: () => {
 						driver.moveNext()
@@ -415,14 +455,13 @@
 		]
 	}
 
-
 	// Cleanup function to delete tutorial flows
 	async function cleanupTutorialFlows() {
 		// Don't delete flows if user is an operator (they don't have permission)
 		if ($userStore?.operator) {
 			return
 		}
-		
+
 		for (const flowPath of tutorialFlowPaths) {
 			try {
 				await FlowService.deleteFlowByPath({
@@ -441,22 +480,19 @@
 		try {
 			const successfulFlowPath = await createTutorialFlow()
 			const brokenFlowPath = await createBrokenFlow()
-			
+
 			// Store flow paths for cleanup
 			tutorialFlowPaths = [successfulFlowPath, brokenFlowPath]
-			
+
 			// Run both flows in parallel
-			await Promise.all([
-				runFlowAndWait(successfulFlowPath),
-				runFlowAndWait(brokenFlowPath)
-			])
-			
+			await Promise.all([runFlowAndWait(successfulFlowPath), runFlowAndWait(brokenFlowPath)])
+
 			// Wait a bit for jobs to appear
 			await wait(DELAY_LONG)
 		} catch (error) {
 			console.error('Error creating/running tutorial flows:', error)
 		}
-		
+
 		tutorial?.runTutorial()
 	}
 </script>
diff --git a/frontend/src/lib/components/tutorials/app/BackgroundRunnablesTutorial.svelte b/frontend/src/lib/components/tutorials/app/BackgroundRunnablesTutorial.svelte
index f2e14afaa6..65fa99ed46 100644
--- a/frontend/src/lib/components/tutorials/app/BackgroundRunnablesTutorial.svelte
+++ b/frontend/src/lib/components/tutorials/app/BackgroundRunnablesTutorial.svelte
@@ -73,7 +73,7 @@
 						setTimeout(() => {
 							driver.moveNext()
 
-							updateProgress(5)
+							updateProgress(index)
 						})
 					}
 				}
diff --git a/frontend/src/lib/components/tutorials/app/ConnectionTutorial.svelte b/frontend/src/lib/components/tutorials/app/ConnectionTutorial.svelte
index 8de12833dd..9ae02af92a 100644
--- a/frontend/src/lib/components/tutorials/app/ConnectionTutorial.svelte
+++ b/frontend/src/lib/components/tutorials/app/ConnectionTutorial.svelte
@@ -116,7 +116,7 @@
 				title: 'Connection done',
 				description: 'You can now see the email output connected to the text component input',
 				onNextClick: () => {
-					updateProgress(6)
+					updateProgress(index)
 
 					setTimeout(() => {
 						driver.moveNext()
diff --git a/frontend/src/lib/components/tutorials/workspace/WorkspaceOnboardingTutorial.svelte b/frontend/src/lib/components/tutorials/workspace/WorkspaceOnboardingTutorial.svelte
index cc73088b77..30307463a1 100644
--- a/frontend/src/lib/components/tutorials/workspace/WorkspaceOnboardingTutorial.svelte
+++ b/frontend/src/lib/components/tutorials/workspace/WorkspaceOnboardingTutorial.svelte
@@ -27,7 +27,7 @@
 
 <Tutorial
 	bind:this={tutorial}
-	index={index}
+	{index}
 	name="workspace-onboarding"
 	tainted={false}
 	on:skipAll
@@ -38,16 +38,13 @@
 					title: 'Welcome to your Windmill workspace! 🎉',
 					description:
 						"Let's take a quick tour! We will show you the main sections of your workspace.",
-					onNextClick: () => {
-						// Wait a bit to ensure the page is fully rendered before moving to next step
-						setTimeout(() => {
-							const button = document.querySelector('#create-script-button') as HTMLElement | null
-							if (button) {
-								driver.moveNext()
-							} else {
-								alert('Could not find the Create Script button. Please make sure you are on the home page.')
-							}
-						}, 100)
+					onNextClick: async () => {
+						// The New menu button mounts once an async permission check resolves, so
+						// wait for it before highlighting it in the next step.
+						for (let i = 0; i < 20 && !document.querySelector('#create-new-button'); i++) {
+							await new Promise((resolve) => setTimeout(resolve, 100))
+						}
+						driver.moveNext()
 					}
 				}
 			},
@@ -55,45 +52,29 @@
 				popover: {
 					title: 'Create your first script',
 					description:
-						'<img src="/languages.png" alt="Programming Languages" style="width: 100%; max-width: 400px; margin-bottom: 12px; border-radius: 8px; display: block; margin-left: auto; margin-right: auto;" /><p>Scripts turn code into tools. Write in Python, TypeScript, Go, Bash, SQL and more. Run them manually, on schedule, or via webhooks.</p>',
-					onNextClick: async () => {
-						// Move to the next step (Create Flow button)
-						setTimeout(() => {
-							const button = document.querySelector('#create-flow-button') as HTMLElement | null
-							if (button) {
-								driver.moveNext()
-							} else {
-								alert('Could not find the Create Flow button. Please make sure you are on the home page.')
-							}
-						}, 100)
+						'<img src="/languages.png" alt="Programming Languages" style="width: 100%; max-width: 400px; margin-bottom: 12px; border-radius: 8px; display: block; margin-left: auto; margin-right: auto;" /><p>Open the <strong>New</strong> menu to create a script. Scripts turn code into tools. Write in Python, TypeScript, Go, Bash, SQL and more. Run them manually, on schedule, or via webhooks.</p>',
+					onNextClick: () => {
+						driver.moveNext()
 					}
 				},
-				element: '#create-script-button',
+				element: '#create-new-button'
 			},
 			{
 				popover: {
 					title: 'Create your first flow',
 					description:
-						'<img src="/flow.png" alt="Flow" style="width: 100%; max-width: 400px; margin-bottom: 12px; border-radius: 8px; display: block; margin-left: auto; margin-right: auto;" /><p>Flows orchestrate multiple scripts. Chain them together with branching, loops, and error handling to build complex workflows.</p>',
-					onNextClick: async () => {
-						// Move to the next step (Create App button)
-						setTimeout(() => {
-							const button = document.querySelector('#create-app-button') as HTMLElement | null
-							if (button) {
-								driver.moveNext()
-							} else {
-								alert('Could not find the Create App button. Please make sure you are on the home page.')
-							}
-						}, 100)
+						'<img src="/flow.png" alt="Flow" style="width: 100%; max-width: 400px; margin-bottom: 12px; border-radius: 8px; display: block; margin-left: auto; margin-right: auto;" /><p>The same <strong>New</strong> menu lets you create a flow. Flows orchestrate multiple scripts. Chain them together with branching, loops, and error handling to build complex workflows.</p>',
+					onNextClick: () => {
+						driver.moveNext()
 					}
 				},
-				element: '#create-flow-button',
+				element: '#create-new-button'
 			},
 			{
 				popover: {
 					title: 'Create your first app',
 					description:
-						'<img src="/app.png" alt="App" style="width: 100%; max-width: 400px; margin-bottom: 12px; border-radius: 8px; display: block; margin-left: auto; margin-right: auto;" /><p>Apps are custom UIs built with drag-and-drop. Combine tables, forms, charts, and buttons that trigger your scripts and flows.. That\'s it for the tour!</p><p style="margin-top: 12px; padding-top: 12px; border-top: 1px solid rgba(128,128,128,0.3); font-size: 0.9em; opacity: 0.9;"><strong>💡 Want to learn more?</strong> Access more tutorials from the <strong>Tutorials</strong> page in the main menu or in the <strong>Help</strong> submenu.</p>',
+						'<img src="/app.png" alt="App" style="width: 100%; max-width: 400px; margin-bottom: 12px; border-radius: 8px; display: block; margin-left: auto; margin-right: auto;" /><p>And from the <strong>New</strong> menu you can also create an app. Apps are custom UIs built with drag-and-drop. Combine tables, forms, charts, and buttons that trigger your scripts and flows. That\'s it for the tour!</p><p style="margin-top: 12px; padding-top: 12px; border-top: 1px solid rgba(128,128,128,0.3); font-size: 0.9em; opacity: 0.9;"><strong>💡 Want to learn more?</strong> Access more tutorials from the <strong>Tutorials</strong> page in the main menu or in the <strong>Help</strong> submenu.</p>',
 					onNextClick: async () => {
 						// Mark tutorial as complete
 						updateProgress(index)
@@ -105,7 +86,7 @@
 						}
 					}
 				},
-				element: '#create-app-button',
+				element: '#create-new-button'
 			}
 		]
 

From 68b1fcc5cdd3d217ebb1b9e09c0d52334faf0a63 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Wed, 22 Jul 2026 12:14:10 +0200
Subject: [PATCH 109/171] fix: prevent u16 underflow in suspend count causing
 permanent flow deadlock (#10256)

When extra resume_messages arrive concurrently and resume_messages.len()
exceeds required_events, the u16 subtraction wraps to ~65535, which is
written as the suspend counter and permanently deadlocks the flow waiting
for events that never arrive. Use saturating_sub so it clamps to 0 instead.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 backend/windmill-worker/src/worker_flow.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/windmill-worker/src/worker_flow.rs b/backend/windmill-worker/src/worker_flow.rs
index f60fc94c0e..edb13c8104 100644
--- a/backend/windmill-worker/src/worker_flow.rs
+++ b/backend/windmill-worker/src/worker_flow.rs
@@ -3566,7 +3566,7 @@ async fn push_next_flow_job(
                         count: required_events,
                         job: last
                     }),
-                    (required_events - resume_messages.len() as u16) as i32,
+                    (required_events.saturating_sub(resume_messages.len() as u16)) as i32,
                     Duration::from_secs(
                         suspend.timeout.map(|t| t.into()).unwrap_or_else(|| 30 * 60)
                     ) as Duration,

From 0508cddf0a86b6a6a043cb31978ca68b76a95d02 Mon Sep 17 00:00:00 2001
From: Guilhem <guilhemlemouel@gmail.com>
Date: Wed, 22 Jul 2026 12:39:35 +0200
Subject: [PATCH 110/171] feat(sessions): ship AI sessions as beta with
 legacy-chat opt-out (#10242)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* feat(sessions): ship AI sessions as beta with legacy-chat opt-out

The wm_dev_global_ai dev flag becomes a beta opt-out: sessions are on by
default and gate.ts reads wm_sessions_beta_optout instead (same
isGlobalAiEnabled() name, all call sites unchanged). A slim Alert-info
banner under the session chat lets users switch back to the legacy
docked chat (plus a GitHub feedback shortcut), a mirror banner in the
legacy chat reactivates sessions, and /sessions visited while opted out
offers reactivation instead of dev-flag instructions. Both toggle
directions are recorded on the existing ai_chat_usage telemetry channel
(mode sessions_beta_optout/optin) before the page reload.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(sessions): keep dev-only routes off the beta gate

/global_drafts and /dev/session-tree were gated on the sessions gate to
hide dev tooling; the beta inversion would have shipped them enabled by
default. Gate them on dev builds (import.meta.env.DEV) instead.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(sessions): exempt operators from the sessions beta

The operator sidebar has no Workspace/Sessions switch, so gating the
docked chat on the beta left its Ask AI button toggling an unmounted
pane. Operators keep the legacy chat (without the beta banner, whose
Activate would strand them on /sessions).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(sessions): navigate even when the opt-out write fails

A throwing localStorage (quota, private browsing) made the banner
buttons silent no-ops. Navigate regardless — the reload showing the
unchanged mode is the honest feedback — and skip the toggle telemetry
since no toggle actually persisted.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(sessions): migrate toggle telemetry to feature_usage; gate /sessions for operators

Main replaced the log_chat endpoint with the allow-listed
log_feature_usage channel, so the toggle events move to
logFeatureUsage('ai_session', 'beta_optout'/'beta_optin') — the buffer's
pagehide flush + keepalive fetch carry the request across the hard
reload, so the await/cap plumbing goes away. The two kinds are added to
the backend allow-list.

Operators reaching /sessions by direct URL now get a "not available for
operators" screen instead of bypassing the layout-level exemption.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(sessions): open legacy pane on opt-out; banner matches composer column

Review nits + polish: opting out now persists ai-chat-open so a fresh
profile lands in a visible legacy chat (with its reactivation banner)
instead of a bare workspace page; the operator /sessions screen's button
now actually opens the Ask AI pane (operators have no sidebar toggle);
the beta banner is a rounded inset bar sharing the hosting chat's
composer column width.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
---
 .../windmill-api-workspaces/src/workspaces.rs |  2 +
 .../WorkspaceItemDrillPicker.svelte           |  4 +-
 .../copilot/chat/AiChatLayout.svelte          | 15 ++++-
 .../components/copilot/chat/global/gate.ts    | 55 +++++++++++----
 .../sessions/OpenInSessionButton.svelte       |  5 +-
 .../sessions/SessionModeSwitch.svelte         |  2 +-
 .../components/sessions/SessionPicker.svelte  |  4 +-
 .../components/sessions/SessionWrapper.svelte |  2 +
 .../sessions/SessionsBetaBanner.svelte        | 67 +++++++++++++++++++
 .../src/routes/(root)/(logged)/+layout.svelte | 22 +++---
 .../(logged)/dev/session-tree/+page.svelte    |  5 +-
 .../(logged)/global_drafts/+page.svelte       |  5 +-
 .../(root)/(logged)/sessions/+page.svelte     | 36 ++++++++--
 13 files changed, 181 insertions(+), 43 deletions(-)
 create mode 100644 frontend/src/lib/components/sessions/SessionsBetaBanner.svelte

diff --git a/backend/windmill-api-workspaces/src/workspaces.rs b/backend/windmill-api-workspaces/src/workspaces.rs
index 5ab233e994..f3e209c82f 100644
--- a/backend/windmill-api-workspaces/src/workspaces.rs
+++ b/backend/windmill-api-workspaces/src/workspaces.rs
@@ -10009,6 +10009,8 @@ const FEATURE_USAGE_KINDS: &[(&str, &str)] = &[
     ("ai_session", "deployed"),
     ("ai_session", "archived"),
     ("ai_session", "deleted"),
+    ("ai_session", "beta_optout"),
+    ("ai_session", "beta_optin"),
     ("ai_chat", "message"),
     ("ai_chat", "model"),
     ("ai_chat", "tool"),
diff --git a/frontend/src/lib/components/WorkspaceItemDrillPicker.svelte b/frontend/src/lib/components/WorkspaceItemDrillPicker.svelte
index 3ec635f08b..39724265a9 100644
--- a/frontend/src/lib/components/WorkspaceItemDrillPicker.svelte
+++ b/frontend/src/lib/components/WorkspaceItemDrillPicker.svelte
@@ -91,8 +91,8 @@ would be surprising.
 	// Chat tools and session editor previews write drafts through `UserDraft`
 	// (workspace-scoped, localStorage-backed). Merge those into the picker so
 	// users can navigate to in-flight items that haven't been deployed yet.
-	// Filter to kinds the picker actually displays. Gated on the global-AI
-	// flag — without sessions, the only UserDrafts present are the standalone
+	// Filter to kinds the picker actually displays. Gated on the sessions beta
+	// gate — without sessions, the only UserDrafts present are the standalone
 	// editors' autosaves and surfacing those in the breadcrumb picker would
 	// be surprising (they'd appear as navigable items that 404 on the backend
 	// draft fetch).
diff --git a/frontend/src/lib/components/copilot/chat/AiChatLayout.svelte b/frontend/src/lib/components/copilot/chat/AiChatLayout.svelte
index 19c06c4330..89574edf3e 100644
--- a/frontend/src/lib/components/copilot/chat/AiChatLayout.svelte
+++ b/frontend/src/lib/components/copilot/chat/AiChatLayout.svelte
@@ -2,6 +2,7 @@
 	import { classNames } from '$lib/utils'
 	import { Pane, Splitpanes } from 'svelte-splitpanes'
 	import AiChat from './AIChat.svelte'
+	import SessionsBetaBanner from '$lib/components/sessions/SessionsBetaBanner.svelte'
 	import { zIndexes } from '$lib/zIndexes'
 	import { userStore, workspaceStore } from '$lib/stores'
 	import { chatState } from './sharedChatState.svelte'
@@ -21,6 +22,10 @@
 		children: any
 		onMenuOpen?: () => void
 		disableAi?: boolean
+		// Only the root layout's docked chat is the "legacy" counterpart of AI
+		// Sessions — SDK wrappers reuse this layout for script/flow chats where
+		// the sessions beta banner would make no sense.
+		showSessionsBetaBanner?: boolean
 	}
 	let {
 		noPadding: noBorder = false,
@@ -29,7 +34,8 @@
 		isMobile = false,
 		children,
 		onMenuOpen,
-		disableAi
+		disableAi,
+		showSessionsBetaBanner = false
 	}: Props = $props()
 
 	// The desktop rail is fixed-positioned, so the content is offset by a matching
@@ -99,7 +105,12 @@
 				minSize={15}
 				class={`flex flex-col min-h-0 z-[${zIndexes.aiChat}]`}
 			>
-				<AiChat />
+				<div class="flex-1 min-h-0">
+					<AiChat />
+				</div>
+				{#if showSessionsBetaBanner}
+					<SessionsBetaBanner variant="legacy" />
+				{/if}
 			</Pane>
 		{/if}
 	</Splitpanes>
diff --git a/frontend/src/lib/components/copilot/chat/global/gate.ts b/frontend/src/lib/components/copilot/chat/global/gate.ts
index df8035de87..f3eb731ae2 100644
--- a/frontend/src/lib/components/copilot/chat/global/gate.ts
+++ b/frontend/src/lib/components/copilot/chat/global/gate.ts
@@ -1,26 +1,53 @@
 /**
- * Dev-only gate for the Global AI chat mode.
+ * Beta opt-out gate for AI Sessions (and the Global AI chat mode).
  *
- * While the mode is being iterated on, it should not be visible to regular
- * users. Developers/QA enable it in their browser with:
+ * Sessions ship enabled by default. Users can switch back to the legacy
+ * docked chat from the beta banner under the session chat, which stores an
+ * opt-out in this browser's localStorage; the mirror banner in the legacy
+ * chat switches back. Both toggles do a full page reload: every call site
+ * reads the gate once at init, so a live flip would leave the UI half-switched.
  *
- *     localStorage.setItem('wm_dev_global_ai', '1')
- *
- * and reload the page. To disable, remove the key or set it to anything else.
- *
- * When the mode is ready to ship to everyone, replace every call to
- * `isGlobalAiEnabled()` with `true` and delete this file. The references are
- * intentionally narrow (chat mode visibility, custom prompt settings, the
- * `change_mode` tool enum, the AI skills workspace settings tab, and the
- * `/global_drafts` dev route) so the rip-out is a small grep.
+ * When the beta ends, replace every call to `isGlobalAiEnabled()` with `true`
+ * and delete this file. The references are intentionally narrow (chat mode
+ * visibility, custom prompt settings, the `change_mode` tool enum, and the
+ * AI skills workspace settings tab) so the rip-out is a small grep.
  */
-const STORAGE_KEY = 'wm_dev_global_ai'
+import { logFeatureUsage } from '$lib/utils/featureUsage'
+
+const OPT_OUT_KEY = 'wm_sessions_beta_optout'
 
 export function isGlobalAiEnabled(): boolean {
 	if (typeof localStorage === 'undefined') return false
 	try {
-		return localStorage.getItem(STORAGE_KEY) === '1'
+		return localStorage.getItem(OPT_OUT_KEY) !== '1'
 	} catch {
 		return false
 	}
 }
+
+/** Persist the opt-out choice, then hard-reload so every gated site re-reads it. */
+export function setSessionsBetaOptOut(optOut: boolean, target: string) {
+	// Navigate even when persistence throws (quota, private browsing) — the
+	// button must not be a silent no-op. The reload then shows the unchanged
+	// mode, which is the honest feedback that the toggle didn't stick.
+	let persisted = true
+	try {
+		if (optOut) {
+			localStorage.setItem(OPT_OUT_KEY, '1')
+			// Land with the legacy pane open — on a fresh profile the pane
+			// defaults to closed, and the round-trip must end in a visible chat
+			// (with its reactivation banner), not on a bare workspace page.
+			localStorage.setItem('ai-chat-open', 'true')
+		} else {
+			localStorage.removeItem(OPT_OUT_KEY)
+		}
+	} catch {
+		persisted = false
+	}
+	// Anonymous usage counter on the shared feature_usage channel. The buffer's
+	// pagehide flush + keepalive fetch carry it across the hard navigation below.
+	if (persisted) {
+		logFeatureUsage('ai_session', optOut ? 'beta_optout' : 'beta_optin')
+	}
+	window.location.href = target
+}
diff --git a/frontend/src/lib/components/sessions/OpenInSessionButton.svelte b/frontend/src/lib/components/sessions/OpenInSessionButton.svelte
index 6470e556bd..40149640ff 100644
--- a/frontend/src/lib/components/sessions/OpenInSessionButton.svelte
+++ b/frontend/src/lib/components/sessions/OpenInSessionButton.svelte
@@ -27,8 +27,9 @@
 		/** Undefined (e.g. an item without a path yet) renders the fallback. */
 		source?: OpenInSessionSource
 		btnClasses?: string
-		/** Rendered instead when the global-AI flag is off (typically the
-		 * editor's inline-chat toggle). Never rendered inside the session panel. */
+		/** Rendered instead when the user opted out of the sessions beta
+		 * (typically the editor's inline-chat toggle). Never rendered inside
+		 * the session panel. */
 		fallback?: Snippet
 	} = $props()
 
diff --git a/frontend/src/lib/components/sessions/SessionModeSwitch.svelte b/frontend/src/lib/components/sessions/SessionModeSwitch.svelte
index 5b297b4bc8..c4d29c9791 100644
--- a/frontend/src/lib/components/sessions/SessionModeSwitch.svelte
+++ b/frontend/src/lib/components/sessions/SessionModeSwitch.svelte
@@ -47,7 +47,7 @@
 			icon={isCollapsed ? MessagesSquare : undefined}
 			label="AI Sessions"
 			iconOnly={isCollapsed}
-			tooltip={isCollapsed ? 'AI Sessions' : undefined}
+			tooltip={isCollapsed ? 'AI Sessions (beta)' : undefined}
 			size="sm"
 			class="w-full justify-center"
 		/>
diff --git a/frontend/src/lib/components/sessions/SessionPicker.svelte b/frontend/src/lib/components/sessions/SessionPicker.svelte
index fa68cdfd3b..b93d350dfe 100644
--- a/frontend/src/lib/components/sessions/SessionPicker.svelte
+++ b/frontend/src/lib/components/sessions/SessionPicker.svelte
@@ -86,8 +86,8 @@
 		return !!rt && rt.manager.instructions.trim().length > 0
 	}
 
-	// Sessions piggyback on the same dev gate as the global AI chat — when
-	// the feature flag is off, the sidebar section is hidden entirely.
+	// Sessions share the beta opt-out gate with the global AI chat — when the
+	// user opted out, the sidebar section is hidden entirely.
 	const globalEnabled = isGlobalAiEnabled()
 
 	// Only highlight the active session while the sessions page is open — elsewhere
diff --git a/frontend/src/lib/components/sessions/SessionWrapper.svelte b/frontend/src/lib/components/sessions/SessionWrapper.svelte
index 4f94dc2888..68d4a201ab 100644
--- a/frontend/src/lib/components/sessions/SessionWrapper.svelte
+++ b/frontend/src/lib/components/sessions/SessionWrapper.svelte
@@ -2,6 +2,7 @@
 	import { setContext } from 'svelte'
 	import { Pane, Splitpanes } from 'svelte-splitpanes'
 	import AIChat from '$lib/components/copilot/chat/AIChat.svelte'
+	import SessionsBetaBanner from './SessionsBetaBanner.svelte'
 	import EditableInput from '$lib/components/common/EditableInput.svelte'
 	import { Button, NameIdTooltip } from '$lib/components/common'
 	import ConfirmationModal from '$lib/components/common/confirmationModal/ConfirmationModal.svelte'
@@ -432,6 +433,7 @@
 						{inputPreface}
 					/>
 				</div>
+				<SessionsBetaBanner variant="session" />
 			</Pane>
 		</Splitpanes>
 	</div>
diff --git a/frontend/src/lib/components/sessions/SessionsBetaBanner.svelte b/frontend/src/lib/components/sessions/SessionsBetaBanner.svelte
new file mode 100644
index 0000000000..36ebee1ee2
--- /dev/null
+++ b/frontend/src/lib/components/sessions/SessionsBetaBanner.svelte
@@ -0,0 +1,67 @@
+<script lang="ts">
+	import { base } from '$lib/base'
+	import { Button } from '$lib/components/common'
+	import { classes as alertClasses, icons as alertIcons } from '$lib/components/common/alert/model'
+	import { setSessionsBetaOptOut } from '$lib/components/copilot/chat/global/gate'
+	import { ExternalLink } from 'lucide-svelte'
+
+	// Prefilled title marks the issue as beta feedback for triage.
+	const FEEDBACK_ISSUE_URL =
+		'https://github.com/windmill-labs/windmill/issues/new?title=' +
+		encodeURIComponent('AI Sessions beta feedback: ')
+
+	// Which chat hosts the banner: the session chat offers the way out of the
+	// beta, the legacy docked chat offers the way (back) in.
+	let { variant }: { variant: 'session' | 'legacy' } = $props()
+
+	const InfoIcon = alertIcons.info
+</script>
+
+<!-- Slim footer sharing the Alert info palette (bg/border/text), minus the
+     Alert component's card layout, which is too tall for a one-line bar. The
+     wrapper mirrors the composer column of the hosting chat (wide session
+     layout vs narrow docked pane) so the bar lines up with the input. -->
+<div
+	class="w-full mx-auto my-1 shrink-0 {variant === 'session' ? 'max-w-3xl px-6' : 'max-w-2xl px-2'}"
+>
+	<div
+		class="flex flex-wrap items-center justify-center gap-x-1.5 gap-y-0.5 px-3 py-1 rounded-md {alertClasses
+			.info.bgClass} border-0 text-xs {alertClasses.info.titleClass}"
+	>
+		<InfoIcon size={14} class="shrink-0 {alertClasses.info.iconClass}" />
+		{#if variant === 'session'}
+			<span class="font-medium">AI Sessions is in beta</span>
+			<span>·</span>
+			<Button
+				variant="subtle"
+				size="xs"
+				btnClasses="!text-accent font-medium !py-0.5"
+				href={FEEDBACK_ISSUE_URL}
+				target="_blank"
+				endIcon={{ icon: ExternalLink }}
+			>
+				Give feedback
+			</Button>
+			<span>·</span>
+			<Button
+				variant="subtle"
+				size="xs"
+				btnClasses="!py-0.5"
+				onclick={() => setSessionsBetaOptOut(true, `${base}/`)}
+			>
+				Switch back to legacy chat
+			</Button>
+		{:else}
+			<span class="font-medium">Try AI Sessions (beta)</span>
+			<span>·</span>
+			<Button
+				variant="subtle"
+				size="xs"
+				btnClasses="!py-0.5"
+				onclick={() => setSessionsBetaOptOut(false, `${base}/sessions`)}
+			>
+				Activate
+			</Button>
+		{/if}
+	</div>
+</div>
diff --git a/frontend/src/routes/(root)/(logged)/+layout.svelte b/frontend/src/routes/(root)/(logged)/+layout.svelte
index d36569ae95..adf7fb3314 100644
--- a/frontend/src/routes/(root)/(logged)/+layout.svelte
+++ b/frontend/src/routes/(root)/(logged)/+layout.svelte
@@ -228,10 +228,10 @@
 	// nest the whole experience. Hide it when embedded.
 	const embedded = BROWSER && window.self !== window.top
 
-	// AI sessions are still dev-gated (localStorage wm_dev_global_ai=1), same as
-	// the global chat. The Workspace ⇄ Sessions switch is the only entry point, so
-	// gate it on the flag too — otherwise it would ship the unfinished experience
-	// to prod. The /sessions page has its own gate for direct navigation.
+	// AI sessions (beta) are on unless the user opted out from the banner under
+	// the session chat. The Workspace ⇄ Sessions switch is the only entry point,
+	// so it follows the gate; opted-out users get the legacy Ask-AI pane instead.
+	// The /sessions page has its own gate for direct navigation.
 	const globalAiEnabled = isGlobalAiEnabled()
 
 	if (page.status == 404) {
@@ -975,8 +975,8 @@
 													shortcut={`${getModifierKey()}k`}
 												/>
 												{#if !globalAiEnabled}
-													<!-- Global Ask-AI pane. When the sessions dev flag is on it is
-													     replaced by SessionModeSwitch, so it only shows in prod. -->
+													<!-- Legacy Ask-AI pane, shown only when the user opted out of the
+													     AI Sessions beta (otherwise SessionModeSwitch replaces it). -->
 													<MenuButton
 														stopPropagationOnClick={true}
 														on:click={() => aiChatManager.toggleOpen()}
@@ -1108,8 +1108,8 @@
 											shortcut={`${getModifierKey()}k`}
 										/>
 										{#if !globalAiEnabled}
-											<!-- Global Ask-AI pane. When the sessions dev flag is on it is
-											     replaced by SessionModeSwitch, so it only shows in prod. -->
+											<!-- Legacy Ask-AI pane, shown only when the user opted out of the
+											     AI Sessions beta (otherwise SessionModeSwitch replaces it). -->
 											<MenuButton
 												stopPropagationOnClick={true}
 												on:click={() => aiChatManager.toggleOpen()}
@@ -1302,10 +1302,14 @@
 					</button>
 				</div>
 			{/if}
+			<!-- Operators are exempt from the sessions beta: their minimal sidebar has
+			     no Workspace ⇄ Sessions switch, so disabling the docked chat would leave
+			     their "Ask AI" button toggling an unmounted pane. -->
 			<AiChatLayout
 				{children}
 				noPadding={devOnly || menuHidden}
-				disableAi={globalAiEnabled ? true : sessionMode}
+				disableAi={globalAiEnabled && !$userStore?.operator ? true : sessionMode}
+				showSessionsBetaBanner={!$userStore?.operator}
 				sidebarWidth={railWidth}
 				transitionClass={sidebarTransitionClass}
 				isMobile={innerWidth < 768}
diff --git a/frontend/src/routes/(root)/(logged)/dev/session-tree/+page.svelte b/frontend/src/routes/(root)/(logged)/dev/session-tree/+page.svelte
index eb69dc1969..1bd8b0879b 100644
--- a/frontend/src/routes/(root)/(logged)/dev/session-tree/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/dev/session-tree/+page.svelte
@@ -2,8 +2,7 @@
 	// DEV-ONLY design exploration: how to visually distinguish a *workspace* from a
 	// *session* in the rail tree, and make the hierarchy (forks) clear. Not linked
 	// anywhere; open at /dev/session-tree. Pure mock data, no real session state.
-	// Gated behind the same dev flag as the sessions UI it explores.
-	import { isGlobalAiEnabled } from '$lib/components/copilot/chat/global/gate'
+	// Only reachable on dev builds.
 	import WorkspaceIcon from '$lib/components/workspace/WorkspaceIcon.svelte'
 	import {
 		MessageSquare,
@@ -323,7 +322,7 @@
 	</div>
 {/snippet}
 
-{#if isGlobalAiEnabled()}
+{#if import.meta.env.DEV}
 	<div class="h-full overflow-auto p-6 bg-surface">
 		<div class="max-w-[1400px] mx-auto flex flex-col gap-2">
 			<h1 class="text-xl font-semibold text-primary flex items-center gap-2">
diff --git a/frontend/src/routes/(root)/(logged)/global_drafts/+page.svelte b/frontend/src/routes/(root)/(logged)/global_drafts/+page.svelte
index 82adf2a459..f645f7e3d6 100644
--- a/frontend/src/routes/(root)/(logged)/global_drafts/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/global_drafts/+page.svelte
@@ -6,7 +6,6 @@
 		listGlobalDrafts
 	} from '$lib/components/copilot/chat/global/userDraftAdapter'
 	import type { WorkspaceItem } from '$lib/components/copilot/chat/global/workspaceItems'
-	import { isGlobalAiEnabled } from '$lib/components/copilot/chat/global/gate'
 	import { goto } from '$lib/navigation'
 	import { workspaceStore } from '$lib/stores'
 	import { Trash2 } from 'lucide-svelte'
@@ -21,8 +20,8 @@
 	}
 
 	onMount(() => {
-		// Dev-only route. Bounce to home when the global mode gate is closed.
-		enabled = isGlobalAiEnabled()
+		// Dev tooling, not part of the sessions beta — only reachable on dev builds.
+		enabled = import.meta.env.DEV
 		if (!enabled) {
 			goto('/')
 		}
diff --git a/frontend/src/routes/(root)/(logged)/sessions/+page.svelte b/frontend/src/routes/(root)/(logged)/sessions/+page.svelte
index befe784637..b0be11a98f 100644
--- a/frontend/src/routes/(root)/(logged)/sessions/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/sessions/+page.svelte
@@ -35,14 +35,17 @@
 	import { withWorkspaceParam } from '$lib/components/sessions/sessionMode.svelte'
 	import { enterSessionMode } from '$lib/components/sessions/sessionSwitch.svelte'
 	import type { SessionPreviewTabs } from '$lib/components/sessions/sessionPreviewTabs.svelte'
-	import { userWorkspaces, usersWorkspaceStore, workspaceStore } from '$lib/stores'
+	import { userStore, userWorkspaces, usersWorkspaceStore, workspaceStore } from '$lib/stores'
 	import {
 		getOrCreateRuntime,
 		getRuntime,
 		listRuntimes
 	} from '$lib/components/sessions/sessionRuntime.svelte'
 	import { markSessionSeen } from '$lib/components/sessions/sessionUnread.svelte'
-	import { isGlobalAiEnabled } from '$lib/components/copilot/chat/global/gate'
+	import {
+		isGlobalAiEnabled,
+		setSessionsBetaOptOut
+	} from '$lib/components/copilot/chat/global/gate'
 	import { setToolCompletionListener } from '$lib/components/copilot/chat/shared'
 	import { registerToolDisplayActionHandler } from '$lib/components/copilot/chat/createdResourceActions.svelte'
 	import { previewTargetForSessionTarget } from '$lib/components/sessions/sessionPreviewTabs.svelte'
@@ -631,10 +634,33 @@
 				}}>Open sessions</Button
 			>
 		</div>
+	{:else if $userStore?.operator}
+		<!-- Operators are exempt from the sessions beta (the layout keeps their
+		     legacy docked chat); a direct URL must not bypass that. -->
+		<div class="p-8 flex flex-col items-start gap-3 text-secondary text-sm">
+			<p class="text-primary font-medium">AI Sessions are not available for operators</p>
+			<p>Use the Ask AI chat instead.</p>
+			<Button
+				size="xs"
+				onclick={() => {
+					try {
+						localStorage.setItem('ai-chat-open', 'true')
+					} catch {}
+					window.location.href = `${base}/`
+				}}
+			>
+				Open Ask AI chat
+			</Button>
+		</div>
 	{:else if !globalEnabled}
-		<div class="p-8 text-secondary text-sm">
-			Sessions are gated on the global-AI dev flag. Enable with
-			<code class="text-2xs font-mono">localStorage.setItem('wm_dev_global_ai', '1')</code> and reload.
+		<!-- Direct navigation (bookmark, shared link) while the user has opted out
+		     of the beta: offer the way back in instead of a dead end. -->
+		<div class="p-8 flex flex-col items-start gap-3 text-secondary text-sm">
+			<p class="text-primary font-medium">AI Sessions are deactivated</p>
+			<p>You switched back to the legacy chat. Activate AI Sessions (beta) to open this page.</p>
+			<Button size="xs" onclick={() => setSessionsBetaOptOut(false, `${base}/sessions`)}>
+				Activate AI Sessions
+			</Button>
 		</div>
 	{:else if !sessionState.hydrated}
 		<!-- Sessions hydrate from IndexedDB after the user resolves; until then an

From 8310e46b1989fdcac726ddf08725dd14bc213598 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Wed, 22 Jul 2026 12:41:37 +0200
Subject: [PATCH 111/171] (windows) lean worker-only build, stop compiling the
 amqp trigger (#10251)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

windmill-trigger-amqp does not compile on Windows: tokio-reactor-trait only
implements reactor_trait::Reactor for its Tokio type under #[cfg(unix)]. This
broke two Windows CI jobs since the amqp trigger landed (#10230): the ee_windows
worker build (via the amqp_trigger feature) and, because the crate is a default
workspace member, the backend-test-windows job (`cargo test --all` compiles
every member regardless of features).

The amqp trigger is a server-only feature never run on Windows workers, so the
fix is to stop compiling it on Windows rather than port its reactor.

Worker binary (ee_windows): replace the ce_core+ee_core bundle (every trigger +
all server-only features) with a worker-only worker_windows_core. A non-agent
worker still runs the full windmill-api on localhost for its own operations
(main.rs run_server, under `if !is_agent`) and jobs call back into it via the
wmill client, so keep every feature the worker's own runtime path or its jobs
touch, and drop the rest.

  Kept: languages, parquet, quickjs, enterprise/license, prometheus, otel,
  jemalloc, AI-agent execution (windmill-worker/mcp + windmill-store/mcp client
  and OAuth-MCP refresh, windmill-worker/bedrock for direct AWS Bedrock), OIDC
  Vault secrets (openidconnect), instance-SMTP email — critical alerts and the
  error-handler send endpoint (windmill-api/instance_smtp), OAuth refresh (oauth2
  — reload_base_url_setting populates OAUTH_CLIENTS, get_value_internal refreshes
  tokens in the worker's internal API server), inline/preview runs (run_inline —
  jobs call /jobs/run_inline/*).

  Dropped: all *_trigger/kafka/nats/sqs listeners plus static_frontend, stripe,
  embedding, zip, the MCP gateway (windmill-api/mcp), the server Bedrock proxy
  route (windmill-api/bedrock), and cloud (runtime-gated on CLOUD_HOSTED, never
  true self-hosted).

Split windmill-api's smtp feature: the send_email_with_instance_smtp endpoint
(error-handler failure emails) only needs windmill-common's rustls sender, but
the smtp feature also bundled the inbound email trigger's openssl + mail-parser +
windmill-trigger-email. Add instance_smtp = ["windmill-common/smtp"] gating just
the endpoint; smtp now includes it. The worker uses instance_smtp, avoiding
openssl (which broke the ee_windows check step) and the email-trigger crate.

backend-test-windows: the Windows binary is worker-only, so test the crates a
worker runs (windmill-worker/-common/-queue) via -p instead of `cargo test
--all`. --all compiled every workspace member regardless of features — pulling
in the amqp crate (which does not build on Windows) and linking the whole
windmill-api integration-test suite, whose combined size overran the runner disk
(LNK1180). Also unset the setup-rust-toolchain default RUSTFLAGS=-D warnings for
this job so cross-platform dead-code (cfg(unix)-only helpers unused on Windows)
does not fail the run; hygiene stays enforced on the Linux CI and the
build_windows_worker_ release build. Full-workspace coverage runs on the Linux CI.

Also drop the redundant `mkdir frontend/build` from the Windows worker workflows
and stub openapi-deref.json alongside the .yaml to avoid embedding ~2.5MB of
openapi spec the worker never serves.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .github/workflows/backend-test-windows.yml   | 15 +++++++++++++--
 .github/workflows/build_windows_worker_.yml  |  6 +++++-
 .github/workflows/publish_windows_worker.yml |  6 +++++-
 backend/Cargo.toml                           |  7 ++++++-
 backend/windmill-api/Cargo.toml              |  6 +++++-
 backend/windmill-api/src/jobs.rs             | 10 +++++-----
 6 files changed, 39 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/backend-test-windows.yml b/.github/workflows/backend-test-windows.yml
index b952a85e7f..5042ed9bfe 100644
--- a/.github/workflows/backend-test-windows.yml
+++ b/.github/workflows/backend-test-windows.yml
@@ -51,6 +51,11 @@ jobs:
         with:
           cache-workspaces: backend
           toolchain: 1.97.0
+          # This action defaults RUSTFLAGS to "-D warnings"; unset it so the test
+          # run is not failed by cross-platform dead-code (cfg(unix)-only helpers
+          # are unused on Windows). Warning hygiene is enforced on the Linux CI
+          # and the build_windows_worker_ release build, not this test job.
+          rustflags: ""
 
       - uses: actions/setup-dotnet@v4
         with:
@@ -203,9 +208,15 @@ jobs:
           WMDEBUG_FORCE_V0_WORKSPACE_DEPENDENCIES: 1
           WMDEBUG_FORCE_RUNNABLE_SETTINGS_V0: 1
           WMDEBUG_FORCE_NO_LEGACY_DEBOUNCING_COMPAT: 1
+        # Windows ships a worker-only binary, so test the crates a worker runs
+        # (windmill-worker/-common/-queue) via -p, not `--all`: this skips the
+        # disk-heavy windmill-api test binaries (LNK1180) and the server-only
+        # windmill-trigger-* crates (amqp does not build on Windows). Linux CI runs the rest.
         run: >
           cargo test
           --no-fail-fast
-          --features enterprise,deno_core,duckdb,license,python,rust,scoped_cache,parquet,private,csharp,php,quickjs,mcp,run_inline
-          --all
+          -p windmill-worker
+          -p windmill-common
+          -p windmill-queue
+          --features private,enterprise,deno_core,duckdb,python,rust,csharp,php,quickjs,parquet,mcp,scoped_cache,windmill-git-sync/private,windmill-object-store/private,windmill-object-store/enterprise
           -- --nocapture --test-threads=10
diff --git a/.github/workflows/build_windows_worker_.yml b/.github/workflows/build_windows_worker_.yml
index 2d573c6959..84f4366235 100644
--- a/.github/workflows/build_windows_worker_.yml
+++ b/.github/workflows/build_windows_worker_.yml
@@ -45,8 +45,12 @@ jobs:
         env:
           RUSTFLAGS: "-D warnings"
         run: |
-          mkdir frontend/build && cd backend
+          cd backend
+          # Stub the openapi specs to empty: they are compiled in via an ungated
+          # include_str! but a worker binary never serves them, so this avoids
+          # embedding ~2.5MB of spec.
           New-Item -Path . -Name "windmill-api/openapi-deref.yaml" -ItemType "File" -Force
+          New-Item -Path . -Name "windmill-api/openapi-deref.json" -ItemType "File" -Force
           cargo check --features=ee_windows
 
       - name: Cargo build dynamic libraries windows
diff --git a/.github/workflows/publish_windows_worker.yml b/.github/workflows/publish_windows_worker.yml
index 019de201e6..d159619fba 100644
--- a/.github/workflows/publish_windows_worker.yml
+++ b/.github/workflows/publish_windows_worker.yml
@@ -56,8 +56,12 @@ jobs:
           vcpkg.exe integrate install
           $env:VCPKGRS_DYNAMIC=1
           $env:OPENSSL_DIR="${Env:VCPKG_INSTALLATION_ROOT}\installed\x64-windows-static"
-          mkdir frontend/build && cd backend
+          cd backend
+          # Stub the openapi specs to empty: they are compiled in via an ungated
+          # include_str! but a worker binary never serves them, so this avoids
+          # embedding ~2.5MB of spec.
           New-Item -Path . -Name "windmill-api/openapi-deref.yaml" -ItemType "File" -Force
+          New-Item -Path . -Name "windmill-api/openapi-deref.json" -ItemType "File" -Force
           cargo build --release --features=ee_windows
       - name: Rename binary with corresponding architecture
         run: |
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index b5ef6accc8..0d0dc3c936 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -200,7 +200,12 @@ ce = ["ce_rpi", "jemalloc", "dind", "agent_worker_server"]
 # Edition meta-features: EE variants
 ee = ["ce", "ee_core", "ee_server", "kafka-gssapi"]
 ee_rhel = ["ce_core", "ee_core", "kafka-gssapi", "all_languages"]
-ee_windows = ["ce_core", "ee_core", "all_languages_windows"]
+# The Windows binary is worker-only, but a non-agent worker runs windmill-api on
+# localhost (main.rs run_server, `if !is_agent`) and jobs call back into it, so
+# it needs every feature its own plumbing or its jobs invoke in-process; drop
+# only external/server-facing surface the worker never runs.
+worker_windows_core = ["private", "operator", "parquet", "quickjs", "enterprise", "prometheus", "otel", "jemalloc", "windmill-worker/mcp", "windmill-store/mcp", "windmill-worker/bedrock", "openidconnect", "run_inline", "windmill-api/instance_smtp", "oauth2"]
+ee_windows = ["worker_windows_core", "all_languages_windows"]
 all_sqlx_features = ["all_languages", "enterprise", "enterprise_saml", "embedding", "parquet", "prometheus", "flow_testing",
  "openidconnect", "cloud", "jemalloc", "tantivy", "sqlx", "kafka", "kafka-gssapi", "nats", "otel", "dind", "websocket", "http_trigger",
   "postgres_trigger", "mcp", "mqtt_trigger", "amqp_trigger", "sqs_trigger", "gcp_trigger", "azure_trigger", "smtp", "stripe",
diff --git a/backend/windmill-api/Cargo.toml b/backend/windmill-api/Cargo.toml
index b764e6ff83..ee789945f5 100644
--- a/backend/windmill-api/Cargo.toml
+++ b/backend/windmill-api/Cargo.toml
@@ -26,7 +26,11 @@ kafka = ["dep:windmill-trigger-kafka", "windmill-store/kafka"]
 kafka-gssapi = ["kafka", "windmill-trigger-kafka/kafka-gssapi"]
 nats = ["dep:windmill-trigger-nats", "windmill-store/nats"]
 websocket = ["dep:windmill-trigger-websocket"]
-smtp = ["dep:mail-parser", "dep:openssl", "windmill-common/smtp", "dep:windmill-trigger-email"]
+smtp = ["instance_smtp", "dep:mail-parser", "dep:openssl", "dep:windmill-trigger-email"]
+# Outbound instance-SMTP email (the send_email_with_instance_smtp endpoint and
+# critical alerts) without the inbound email trigger's openssl/mail-parser deps.
+# `smtp` is the full trigger + endpoint; `instance_smtp` is the endpoint only.
+instance_smtp = ["windmill-common/smtp"]
 license = ["dep:rsa", "windmill-api-settings/license"]
 zip = ["dep:async_zip"]
 oauth2 = ["dep:windmill-oauth", "windmill-store/oauth2"]
diff --git a/backend/windmill-api/src/jobs.rs b/backend/windmill-api/src/jobs.rs
index 14cbb76c91..66e806efe3 100644
--- a/backend/windmill-api/src/jobs.rs
+++ b/backend/windmill-api/src/jobs.rs
@@ -25,7 +25,7 @@ use std::time::Instant;
 use tokio::io::AsyncReadExt;
 use tower::ServiceBuilder;
 use url::Url;
-#[cfg(all(feature = "enterprise", feature = "smtp"))]
+#[cfg(all(feature = "enterprise", feature = "instance_smtp"))]
 use windmill_common::auth::is_super_admin_email;
 use windmill_common::auth::TOKEN_PREFIX_LEN;
 #[cfg(feature = "run_inline")]
@@ -54,7 +54,7 @@ use windmill_common::workspace_dependencies::{
     RawWorkspaceDependencies, MIN_VERSION_WORKSPACE_DEPENDENCIES,
 };
 use windmill_common::DYNAMIC_INPUT_CACHE;
-#[cfg(all(feature = "enterprise", feature = "smtp"))]
+#[cfg(all(feature = "enterprise", feature = "instance_smtp"))]
 use windmill_common::{email_oss::send_email_html, server::load_smtp_config};
 use windmill_object_store::upload_artifact_to_store;
 #[cfg(feature = "run_inline")]
@@ -1692,7 +1692,7 @@ impl<'a> GetQuery<'a> {
     }
 }
 
-#[cfg(all(feature = "smtp", feature = "enterprise"))]
+#[cfg(all(feature = "instance_smtp", feature = "enterprise"))]
 async fn send_workspace_trigger_failure_email_notification(
     db: &DB,
     w_id: &str,
@@ -1855,7 +1855,7 @@ struct SendEmail {
     error: Value,
 }
 
-#[cfg(all(feature = "enterprise", feature = "smtp"))]
+#[cfg(all(feature = "enterprise", feature = "instance_smtp"))]
 async fn send_email_with_instance_smtp(
     authed: ApiAuthed,
     Extension(db): Extension<DB>,
@@ -1913,7 +1913,7 @@ async fn send_email_with_instance_smtp(
     Ok(Json(resp))
 }
 
-#[cfg(not(all(feature = "enterprise", feature = "smtp")))]
+#[cfg(not(all(feature = "enterprise", feature = "instance_smtp")))]
 async fn send_email_with_instance_smtp(
     _authed: ApiAuthed,
     Extension(_db): Extension<DB>,

From 564b93b968f3e40b26d895cc222c6a5a76afc75d Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Wed, 22 Jul 2026 13:00:01 +0200
Subject: [PATCH 112/171] (cloud) restrict folder creation, sharing and group
 creation in demo workspace (#10257)

* feat: restrict folder creation, sharing and group creation in demo workspace

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix: guard update_folder sharing bypass and gate folder editor/share ACL controls in demo

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix: guard remove_owner grant path and gate alternate folder-create controls; keep pure-revoke controls enabled

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 backend/windmill-api-groups/src/folders.rs    | 15 ++++
 .../windmill-api-groups/src/granular_acls.rs  |  1 +
 backend/windmill-api-groups/src/groups.rs     |  1 +
 backend/windmill-api-groups/src/lib.rs        | 20 +++++
 frontend/src/lib/cloud.ts                     | 16 +++-
 .../src/lib/components/FolderEditor.svelte    | 46 ++++++-----
 .../src/lib/components/FolderPicker.svelte    | 33 +++++---
 frontend/src/lib/components/ShareModal.svelte | 13 ++-
 .../(root)/(logged)/folders/+page.svelte      | 79 +++++++++++--------
 .../(root)/(logged)/groups/+page.svelte       | 77 +++++++++++-------
 10 files changed, 205 insertions(+), 96 deletions(-)

diff --git a/backend/windmill-api-groups/src/folders.rs b/backend/windmill-api-groups/src/folders.rs
index 5e204a6f2c..3551435dc7 100644
--- a/backend/windmill-api-groups/src/folders.rs
+++ b/backend/windmill-api-groups/src/folders.rs
@@ -243,6 +243,7 @@ async fn create_folder(
     Path(w_id): Path<String>,
     Json(mut ng): Json<NewFolder>,
 ) -> Result<String> {
+    crate::check_demo_workspace_restriction(&authed, &w_id, "Folder creation")?;
     if let Some(labels) = ng.labels.as_mut() {
         dedup_labels(labels);
     }
@@ -418,6 +419,12 @@ async fn update_folder(
         return Err(Error::PermissionDenied(msg));
     }
 
+    // update_folder can also grant permissions (owners / extra_perms / default_permissioned_as),
+    // so it is a sharing path and must honor the demo-workspace sharing restriction.
+    if ng.owners.is_some() || ng.extra_perms.is_some() || ng.default_permissioned_as.is_some() {
+        crate::check_demo_workspace_restriction(&authed, &w_id, "Sharing")?;
+    }
+
     let mut sqlb = SqlBuilder::update_table("folder");
     sqlb.and_where_eq("name", "?".bind(&name));
     sqlb.and_where_eq("workspace_id", "?".bind(&w_id));
@@ -820,6 +827,7 @@ async fn add_owner(
     Path((w_id, name)): Path<(String, String)>,
     Json(Owner { owner, .. }): Json<Owner>,
 ) -> Result<String> {
+    crate::check_demo_workspace_restriction(&authed, &w_id, "Sharing")?;
     let mut tx = user_db.begin(&authed).await?;
 
     not_found_if_none(get_folderopt(&mut tx, &w_id, &name).await?, "Folder", &name)?;
@@ -884,6 +892,13 @@ async fn remove_owner(
     Path((w_id, name)): Path<(String, String)>,
     Json(Owner { owner, write }): Json<Owner>,
 ) -> Result<String> {
+    // remove_owner with a `write` value is a grant path: it jsonb_set's the owner's
+    // permission level into extra_perms (only write=None is a pure revoke), so the
+    // demo-workspace sharing restriction must apply when a level is being set.
+    if write.is_some() {
+        crate::check_demo_workspace_restriction(&authed, &w_id, "Sharing")?;
+    }
+
     let mut tx = user_db.begin(&authed).await?;
 
     not_found_if_none(get_folderopt(&mut tx, &w_id, &name).await?, "Folder", &name)?;
diff --git a/backend/windmill-api-groups/src/granular_acls.rs b/backend/windmill-api-groups/src/granular_acls.rs
index e413165825..5a7af05cbe 100644
--- a/backend/windmill-api-groups/src/granular_acls.rs
+++ b/backend/windmill-api-groups/src/granular_acls.rs
@@ -96,6 +96,7 @@ async fn add_granular_acl(
     Path((w_id, path)): Path<(String, StripPath)>,
     Json(GranularAcl { owner, write }): Json<GranularAcl>,
 ) -> Result<String> {
+    crate::check_demo_workspace_restriction(&authed, &w_id, "Sharing")?;
     let path = path.to_path();
 
     let (kind, path) = path
diff --git a/backend/windmill-api-groups/src/groups.rs b/backend/windmill-api-groups/src/groups.rs
index 263daad624..d2a6c7d16e 100644
--- a/backend/windmill-api-groups/src/groups.rs
+++ b/backend/windmill-api-groups/src/groups.rs
@@ -234,6 +234,7 @@ async fn create_group(
     Path(w_id): Path<String>,
     Json(ng): Json<NewGroup>,
 ) -> Result<String> {
+    crate::check_demo_workspace_restriction(&authed, &w_id, "Group creation")?;
     let mut tx = user_db.begin(&authed).await?;
 
     check_name_conflict(&mut tx, &w_id, &ng.name).await?;
diff --git a/backend/windmill-api-groups/src/lib.rs b/backend/windmill-api-groups/src/lib.rs
index 75b9349105..7abfa426ee 100644
--- a/backend/windmill-api-groups/src/lib.rs
+++ b/backend/windmill-api-groups/src/lib.rs
@@ -2,3 +2,23 @@ pub mod folder_history;
 pub mod folders;
 pub mod granular_acls;
 pub mod groups;
+
+use windmill_api_auth::ApiAuthed;
+use windmill_common::{error::Error, worker::CLOUD_HOSTED};
+
+/// The public demo workspace on the managed cloud is kept clean and consistent by
+/// restricting folder creation, item sharing, and group creation for non-admins.
+/// `action` is a short noun phrase completing "… is disabled …" (e.g.
+/// "Folder creation", "Sharing"). Returns `Err(BadRequest)` when the caller is blocked.
+pub fn check_demo_workspace_restriction(
+    authed: &ApiAuthed,
+    w_id: &str,
+    action: &str,
+) -> Result<(), Error> {
+    if *CLOUD_HOSTED && w_id == "demo" && !authed.is_admin {
+        return Err(Error::BadRequest(format!(
+            "{action} is disabled in the demo workspace. Create your own workspace to keep the demo clean and consistent."
+        )));
+    }
+    Ok(())
+}
diff --git a/frontend/src/lib/cloud.ts b/frontend/src/lib/cloud.ts
index a684153e7a..350b96aacc 100644
--- a/frontend/src/lib/cloud.ts
+++ b/frontend/src/lib/cloud.ts
@@ -2,4 +2,18 @@ import { BROWSER } from 'esm-env'
 
 export function isCloudHosted(): boolean {
 	return BROWSER && window.location.hostname == 'app.windmill.dev'
-}
\ No newline at end of file
+}
+
+// On the managed cloud, the public demo workspace is kept clean and consistent by
+// disabling folder creation, item sharing, and group creation for non-admins. The
+// backend enforces the same rule; this only drives the UI hints.
+export const DEMO_RESTRICTION_HINT =
+	'Disabled in the demo workspace. Create your own workspace to keep the demo clean and consistent.'
+
+export function isDemoWorkspaceRestricted(
+	workspace: string | undefined,
+	isAdmin: boolean | undefined,
+	isSuperAdmin: boolean | undefined
+): boolean {
+	return isCloudHosted() && workspace === 'demo' && !isAdmin && !isSuperAdmin
+}
diff --git a/frontend/src/lib/components/FolderEditor.svelte b/frontend/src/lib/components/FolderEditor.svelte
index 685743254a..dede17b953 100644
--- a/frontend/src/lib/components/FolderEditor.svelte
+++ b/frontend/src/lib/components/FolderEditor.svelte
@@ -9,6 +9,7 @@
 		GroupService
 	} from '$lib/gen'
 	import TableCustom from './TableCustom.svelte'
+	import { DEMO_RESTRICTION_HINT, isDemoWorkspaceRestricted } from '$lib/cloud'
 	import { Alert, Button, Drawer, DrawerContent } from './common'
 	import Skeleton from './common/skeleton/Skeleton.svelte'
 	import GroupEditor from './GroupEditor.svelte'
@@ -108,8 +109,13 @@
 	// --- default_permissioned_as rules editor ---
 	let defaultPermissionedAs: FolderDefaultPermissionedAs = $state([])
 
+	const restricted = $derived(
+		isDemoWorkspaceRestricted($workspaceStore, $userStore?.is_admin, $userStore?.is_super_admin)
+	)
+
 	const canEditDefaults = $derived(
 		can_write &&
+			!restricted &&
 			($userStore?.is_admin ||
 				$userStore?.is_super_admin ||
 				($userStore?.groups ?? []).includes('wm_deployers'))
@@ -315,7 +321,9 @@
 
 	<Label label={`Permissions (${perms?.length ?? 0})`}>
 		<div class="flex flex-col gap-2">
-			{#if can_write}
+			{#if can_write && restricted}
+				<Alert type="info" title="Sharing disabled">{DEMO_RESTRICTION_HINT}</Alert>
+			{:else if can_write}
 				<Alert type="info" title="New permissions may take up to 60s to apply">
 					Due to permissions cache invalidation
 				</Alert>
@@ -373,22 +381,24 @@
 					existing. A windmill folder has settable permissions that its children inherit. If an item
 					is within a non-existing folders, only admins will see it.
 				</Alert>
-				<Button
-					variant="default"
-					wrapperClasses="w-min"
-					startIcon={{ icon: Plus }}
-					size="xs"
-					on:click={() => {
-						FolderService.createFolder({
-							workspace: $workspaceStore ?? '',
-							requestBody: { name }
-						}).then(() => {
-							loadFolder()
-						})
-					}}
-				>
-					Create folder "{name}"
-				</Button>
+				{#if !restricted}
+					<Button
+						variant="default"
+						wrapperClasses="w-min"
+						startIcon={{ icon: Plus }}
+						size="xs"
+						on:click={() => {
+							FolderService.createFolder({
+								workspace: $workspaceStore ?? '',
+								requestBody: { name }
+							}).then(() => {
+								loadFolder()
+							})
+						}}
+					>
+						Create folder "{name}"
+					</Button>
+				{/if}
 			{/if}
 			{#if perms}
 				<TableCustom>
@@ -404,7 +414,7 @@
 							{#each perms ?? [] as { owner_name, role }}<tr>
 									<td>{owner_name}</td>
 									<td>
-										{#if can_write}
+										{#if can_write && !restricted}
 											<div>
 												<ToggleButtonGroup
 													disabled={owner_name == 'u/' + $userStore?.username &&
diff --git a/frontend/src/lib/components/FolderPicker.svelte b/frontend/src/lib/components/FolderPicker.svelte
index 12656a791d..69c219d0a1 100644
--- a/frontend/src/lib/components/FolderPicker.svelte
+++ b/frontend/src/lib/components/FolderPicker.svelte
@@ -1,6 +1,7 @@
 <script lang="ts">
 	import { FolderService } from '$lib/gen'
 	import { workspaceStore, userStore } from '$lib/stores'
+	import { isDemoWorkspaceRestricted } from '$lib/cloud'
 	import { ChevronDown, Pen, PlusIcon } from 'lucide-svelte'
 	import { Button, Drawer, DrawerContent } from './common'
 	import FolderEditor from './FolderEditor.svelte'
@@ -13,6 +14,10 @@
 
 	const VALID_FOLDER_NAME = /^[a-zA-Z_0-9-]+$/
 
+	const restricted = $derived(
+		isDemoWorkspaceRestricted($workspaceStore, $userStore?.is_admin, $userStore?.is_super_admin)
+	)
+
 	let folders: { name: string; write: boolean }[] = $state([])
 	let filterText: string = $state('')
 	let selectOpen: boolean = $state(false)
@@ -137,7 +142,7 @@
 	)
 
 	function handleSelectKeydown(e: KeyboardEvent) {
-		if (e.key === 'Enter' && selectOpen && noMatchingItems) {
+		if (e.key === 'Enter' && selectOpen && noMatchingItems && !restricted) {
 			e.preventDefault()
 			selectOpen = false
 			openCreateFolder()
@@ -233,18 +238,20 @@
 			/>
 		{/snippet}
 		{#snippet bottomSnippet({ close })}
-			<button
-				class="sticky py-2 px-4 w-full text-left text-xs font-medium hover:bg-surface-hover flex items-center justify-center gap-2 border-t border-border-light {noMatchingItems
-					? 'bg-surface-hover'
-					: ''}"
-				onclick={() => {
-					close()
-					openCreateFolder()
-				}}
-			>
-				<PlusIcon class="inline" size={16} />
-				Create folder
-			</button>
+			{#if !restricted}
+				<button
+					class="sticky py-2 px-4 w-full text-left text-xs font-medium hover:bg-surface-hover flex items-center justify-center gap-2 border-t border-border-light {noMatchingItems
+						? 'bg-surface-hover'
+						: ''}"
+					onclick={() => {
+						close()
+						openCreateFolder()
+					}}
+				>
+					<PlusIcon class="inline" size={16} />
+					Create folder
+				</button>
+			{/if}
 		{/snippet}
 	</Select>
 </div>
diff --git a/frontend/src/lib/components/ShareModal.svelte b/frontend/src/lib/components/ShareModal.svelte
index 65ba6215fb..29da96cf98 100644
--- a/frontend/src/lib/components/ShareModal.svelte
+++ b/frontend/src/lib/components/ShareModal.svelte
@@ -21,9 +21,14 @@
 	import { safeSelectItems } from './select/utils.svelte'
 	import Toggle from './Toggle.svelte'
 	import { Trash } from 'lucide-svelte'
+	import { DEMO_RESTRICTION_HINT, isDemoWorkspaceRestricted } from '$lib/cloud'
 
 	const dispatch = createEventDispatcher()
 
+	let restricted = $derived(
+		isDemoWorkspaceRestricted($workspaceStore, $userStore?.is_admin, $userStore?.is_super_admin)
+	)
+
 	type Kind =
 		| 'script'
 		| 'group_'
@@ -269,7 +274,9 @@
 					>
 				{/if}
 				<div>
-					{#if own}
+					{#if own && restricted}
+						<Alert type="info" title="Sharing disabled">{DEMO_RESTRICTION_HINT}</Alert>
+					{:else if own}
 						<div class="flex flex-row flex-wrap gap-2 items-center">
 							<div>
 								<ToggleButtonGroup bind:selected={ownerKind} on:selected={() => (owner = '')}>
@@ -311,7 +318,7 @@
 										<tr>
 											<td>{owner}</td>
 											<td
-												>{#if own}
+												>{#if own && !restricted}
 													<div>
 														<ToggleButtonGroup
 															selected={write ? 'writer' : 'viewer'}
@@ -331,7 +338,7 @@
 															{/snippet}
 														</ToggleButtonGroup>
 													</div>
-												{:else}{write}{/if}</td
+												{:else}{write ? 'Writer' : 'Viewer'}{/if}</td
 											>
 											<td>
 												{#if own}
diff --git a/frontend/src/routes/(root)/(logged)/folders/+page.svelte b/frontend/src/routes/(root)/(logged)/folders/+page.svelte
index 0a55acfe69..42de9d38a5 100644
--- a/frontend/src/routes/(root)/(logged)/folders/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/folders/+page.svelte
@@ -19,9 +19,14 @@
 	import Row from '$lib/components/table/Row.svelte'
 	import Badge from '$lib/components/common/badge/Badge.svelte'
 	import { untrack } from 'svelte'
+	import { DEMO_RESTRICTION_HINT, isDemoWorkspaceRestricted } from '$lib/cloud'
 
 	type FolderW = Folder & { canWrite: boolean }
 
+	let restricted = $derived(
+		isDemoWorkspaceRestricted($workspaceStore, $userStore?.is_admin, $userStore?.is_super_admin)
+	)
+
 	let newFolderName: string = $state('')
 	let folders: FolderW[] | undefined = $state(undefined)
 	let folderDrawer: Drawer | undefined = $state()
@@ -96,38 +101,50 @@
 			documentationLink="https://www.windmill.dev/docs/core_concepts/groups_and_folders"
 		>
 			<div class="flex flex-row">
-				<Popover
-					floatingConfig={{ strategy: 'absolute', placement: 'bottom-end' }}
-					contentClasses="flex flex-col gap-2 p-4"
-				>
-					{#snippet trigger()}
-						<Button variant="accent" unifiedSize="md" startIcon={{ icon: Plus }} nonCaptureEvent
-							>New folder</Button
-						>
-					{/snippet}
-					{#snippet content({ close })}
-						<input
-							class="mr-2"
-							onkeyup={(e) => handleKeyUp(e, () => close())}
-							placeholder="New folder name"
-							bind:value={newFolderName}
-						/>
-
-						<div>
-							<Button
-								variant="accent"
-								startIcon={{ icon: Plus }}
-								disabled={!newFolderName}
-								on:click={() => {
-									addFolder()
-									close()
-								}}
+				{#if restricted}
+					<Button
+						variant="accent"
+						unifiedSize="md"
+						startIcon={{ icon: Plus }}
+						disabled
+						title={DEMO_RESTRICTION_HINT}
+					>
+						New folder
+					</Button>
+				{:else}
+					<Popover
+						floatingConfig={{ strategy: 'absolute', placement: 'bottom-end' }}
+						contentClasses="flex flex-col gap-2 p-4"
+					>
+						{#snippet trigger()}
+							<Button variant="accent" unifiedSize="md" startIcon={{ icon: Plus }} nonCaptureEvent
+								>New folder</Button
 							>
-								Create
-							</Button>
-						</div>
-					{/snippet}
-				</Popover>
+						{/snippet}
+						{#snippet content({ close })}
+							<input
+								class="mr-2"
+								onkeyup={(e) => handleKeyUp(e, () => close())}
+								placeholder="New folder name"
+								bind:value={newFolderName}
+							/>
+
+							<div>
+								<Button
+									variant="accent"
+									startIcon={{ icon: Plus }}
+									disabled={!newFolderName}
+									on:click={() => {
+										addFolder()
+										close()
+									}}
+								>
+									Create
+								</Button>
+							</div>
+						{/snippet}
+					</Popover>
+				{/if}
 			</div>
 		</PageHeader>
 
diff --git a/frontend/src/routes/(root)/(logged)/groups/+page.svelte b/frontend/src/routes/(root)/(logged)/groups/+page.svelte
index 0668c4c307..85b4b536fe 100644
--- a/frontend/src/routes/(root)/(logged)/groups/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/groups/+page.svelte
@@ -22,9 +22,14 @@
 	import { untrack } from 'svelte'
 	import TextInput from '$lib/components/text_input/TextInput.svelte'
 	import { Tooltip } from '$lib/components/meltComponents'
+	import { DEMO_RESTRICTION_HINT, isDemoWorkspaceRestricted } from '$lib/cloud'
 
 	type GroupW = Group & { canWrite: boolean }
 
+	let restricted = $derived(
+		isDemoWorkspaceRestricted($workspaceStore, $userStore?.is_admin, $userStore?.is_super_admin)
+	)
+
 	let newGroupName: string = $state('')
 	let groups: GroupW[] | undefined = $state(undefined)
 	let instanceGroups: InstanceGroupWithWorkspaces[] | undefined = $state(undefined)
@@ -103,37 +108,49 @@
 		>
 			<div class="flex flex-row">
 				<div>
-					<Popover floatingConfig={{ strategy: 'absolute', placement: 'bottom-end' }}>
-						{#snippet trigger()}
-							<Button unifiedSize="md" variant="accent" startIcon={{ icon: Plus }} nonCaptureEvent
-								>New&nbsp;group</Button
-							>
-						{/snippet}
-						{#snippet content({ close })}
-							<div class="flex-col flex gap-2 p-4">
-								<TextInput
-									size="md"
-									inputProps={{
-										placeholder: 'New group name',
-										onkeyup: (e) => handleKeyUp(e, close)
-									}}
-									bind:value={newGroupName}
-								/>
-								<Button
-									unifiedSize="md"
-									variant="accent"
-									startIcon={{ icon: Plus }}
-									disabled={!newGroupName}
-									on:click={() => {
-										addGroup()
-										close()
-									}}
+					{#if restricted}
+						<Button
+							unifiedSize="md"
+							variant="accent"
+							startIcon={{ icon: Plus }}
+							disabled
+							title={DEMO_RESTRICTION_HINT}
+						>
+							New&nbsp;group
+						</Button>
+					{:else}
+						<Popover floatingConfig={{ strategy: 'absolute', placement: 'bottom-end' }}>
+							{#snippet trigger()}
+								<Button unifiedSize="md" variant="accent" startIcon={{ icon: Plus }} nonCaptureEvent
+									>New&nbsp;group</Button
 								>
-									Create
-								</Button>
-							</div>
-						{/snippet}
-					</Popover>
+							{/snippet}
+							{#snippet content({ close })}
+								<div class="flex-col flex gap-2 p-4">
+									<TextInput
+										size="md"
+										inputProps={{
+											placeholder: 'New group name',
+											onkeyup: (e) => handleKeyUp(e, close)
+										}}
+										bind:value={newGroupName}
+									/>
+									<Button
+										unifiedSize="md"
+										variant="accent"
+										startIcon={{ icon: Plus }}
+										disabled={!newGroupName}
+										on:click={() => {
+											addGroup()
+											close()
+										}}
+									>
+										Create
+									</Button>
+								</div>
+							{/snippet}
+						</Popover>
+					{/if}
 				</div>
 			</div>
 		</PageHeader>

From d03810276cbad8e8a24b6944259f67d459b1c75d Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Wed, 22 Jul 2026 13:03:37 +0200
Subject: [PATCH 113/171] remove collaborator presence badge from session
 preview (WIN-2222) (#10259)

* fix(ai-sessions): hide collaborator presence badge in script preview

The workspace-wide presence layer (MultiplayerMenu) auto-connects under an
EE license and broadcasts each user's window.location.pathname. The
<Awareness /> badge in ScriptBuilder's header renders anyone whose path
matches the current pathname. In the AI session preview the editor is
embedded in the /sessions page, so presence collides on that single coarse
URL and paints a meaningless badge (often the current user themselves) on a
brand-new draft where no one is co-editing.

Suppress the badge whenever ScriptBuilder runs inside the session pane,
reusing the existing inSessionPane context flag.

Fixes WIN-2222

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(ai-sessions): hide presence badge in flow/app/raw-app session preview too

Extend the same inSessionPane guard to FlowBuilder, AppEditorHeader and
RawAppEditorHeader so the spurious collaborator presence badge is hidden in
every editor embedded in the session pane, not just scripts. The aiChatManager
context is injected only by SessionEditorTarget, so the guard is a no-op in the
standalone editors.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 frontend/src/lib/components/FlowBuilder.svelte         | 10 ++++++++--
 frontend/src/lib/components/ScriptBuilder.svelte       |  2 +-
 .../lib/components/apps/editor/AppEditorHeader.svelte  |  2 +-
 .../lib/components/raw_apps/RawAppEditorHeader.svelte  |  2 +-
 4 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/frontend/src/lib/components/FlowBuilder.svelte b/frontend/src/lib/components/FlowBuilder.svelte
index 32767864a6..b30db19af9 100644
--- a/frontend/src/lib/components/FlowBuilder.svelte
+++ b/frontend/src/lib/components/FlowBuilder.svelte
@@ -34,7 +34,7 @@
 	import DeployOverrideConfirmationModal from '$lib/components/common/confirmationModal/DeployOverrideConfirmationModal.svelte'
 	import AIChangesWarningModal from '$lib/components/copilot/chat/flow/AIChangesWarningModal.svelte'
 
-	import { createRawSnippet, setContext, untrack } from 'svelte'
+	import { createRawSnippet, getContext, setContext, untrack } from 'svelte'
 	import { writable } from 'svelte/store'
 	import CenteredPage from './CenteredPage.svelte'
 	import { Button } from './common'
@@ -202,6 +202,12 @@
 		confirmDeploymentCallback(selectedTriggers)
 	}
 
+	// Inside an AI session pane (SessionEditorTarget injects an aiChatManager via
+	// context) the collaborator presence badge is spurious: the editor is embedded
+	// in the shared /sessions URL under the session's own workspace identity, so
+	// presence keyed on that URL leaks a phantom self-badge. Hide it here.
+	const inSessionPane = !!getContext('aiChatManager')
+
 	function hasAIChanges(): boolean {
 		return aiChatManager.flowAiChatHelpers?.hasPendingChanges() ?? false
 	}
@@ -1173,7 +1179,7 @@
 					{/if}
 				</div>
 				<div class="flex flex-row gap-2 items-center shrink-0">
-					{#if $enterpriseLicense && !newFlow}
+					{#if $enterpriseLicense && !newFlow && !inSessionPane}
 						<Awareness />
 					{/if}
 					<div class="relative">
diff --git a/frontend/src/lib/components/ScriptBuilder.svelte b/frontend/src/lib/components/ScriptBuilder.svelte
index d7214e9a24..831cabb498 100644
--- a/frontend/src/lib/components/ScriptBuilder.svelte
+++ b/frontend/src/lib/components/ScriptBuilder.svelte
@@ -1976,7 +1976,7 @@
 				<!-- Separator -->
 				<div class="flex-1"></div>
 
-				{#if $enterpriseLicense && initialPath != ''}
+				{#if $enterpriseLicense && initialPath != '' && !inSessionPane}
 					<Awareness />
 				{/if}
 
diff --git a/frontend/src/lib/components/apps/editor/AppEditorHeader.svelte b/frontend/src/lib/components/apps/editor/AppEditorHeader.svelte
index 84261bcf80..394b031026 100644
--- a/frontend/src/lib/components/apps/editor/AppEditorHeader.svelte
+++ b/frontend/src/lib/components/apps/editor/AppEditorHeader.svelte
@@ -1076,7 +1076,7 @@
 			/>
 		</div>
 	{/if}
-	{#if $enterpriseLicense && $appPath != ''}
+	{#if $enterpriseLicense && $appPath != '' && !inSessionPane}
 		<div class="shrink-0">
 			<Awareness />
 		</div>
diff --git a/frontend/src/lib/components/raw_apps/RawAppEditorHeader.svelte b/frontend/src/lib/components/raw_apps/RawAppEditorHeader.svelte
index 9a01b60ed3..29620b3739 100644
--- a/frontend/src/lib/components/raw_apps/RawAppEditorHeader.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppEditorHeader.svelte
@@ -841,7 +841,7 @@
 		{/if}
 	</div>
 
-	{#if $enterpriseLicense && appPath != ''}
+	{#if $enterpriseLicense && appPath != '' && !inSessionPane}
 		<div class="shrink-0">
 			<Awareness />
 		</div>

From 1da664fc898040dbbac76b6141b2d5a28bb37ab6 Mon Sep 17 00:00:00 2001
From: Guilhem <guilhemlemouel@gmail.com>
Date: Wed, 22 Jul 2026 14:30:51 +0200
Subject: [PATCH 114/171] open_page opens resource/variable edit drawers when
 asking user to act (#10258)

* feat: open_page opens resource/variable edit drawers when asking user to act

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix: clear handled drawer hash when navigation leaves the target

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix: force preview reload when open_page re-targets the tab's current URL

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
---
 ai_evals/cases/global.yaml                    | 41 ++++++++++++++++++
 .../components/copilot/chat/global/core.ts    | 18 +++++---
 .../chat/global/pageNavigation.test.ts        | 18 +++++++-
 .../copilot/chat/global/pageNavigation.ts     | 30 ++++++++++---
 .../components/sessions/PreviewTabHost.svelte | 24 +++++++++--
 .../sessions/sessionPreviewTabs.svelte.ts     | 15 ++++++-
 .../sessions/sessionRuntime.svelte.ts         | 22 ++++++++--
 .../(root)/(logged)/resources/+page.svelte    | 34 +++++++++++----
 .../(root)/(logged)/schedules/+page.svelte    | 42 +++++++++++++------
 .../(root)/(logged)/variables/+page.svelte    | 31 ++++++++++----
 10 files changed, 226 insertions(+), 49 deletions(-)

diff --git a/ai_evals/cases/global.yaml b/ai_evals/cases/global.yaml
index e2676c0b2a..9d5a31556c 100644
--- a/ai_evals/cases/global.yaml
+++ b/ai_evals/cases/global.yaml
@@ -1739,3 +1739,44 @@
     - creates an AI draft for the existing f/evals/global/format_greeting script with the exclamation-mark change
     - the draft changes only the returned message's punctuation — summary, language, path, and the rest of the code are untouched
     - does not deploy or save the draft to the workspace
+
+- id: global-resource-manual-credentials
+  prompt: |-
+    Set up a resource for our production Postgres database at `f/evals/global/prod_db` (host db.internal.example.com, port 5432, database `orders`, user `app`).
+    I don't want to paste the password into this chat — prepare everything so I can enter it myself.
+    Leave it as an AI draft only; do not deploy or save it.
+  initial: ai_evals/fixtures/frontend/global/initial/user_admin_evals_folder.json
+  runtime:
+    maxTurns: 12
+  validate:
+    draftCountAtLeast: 1
+    requiredDrafts:
+      - type: resource
+        path: f/evals/global/prod_db
+        valueIncludes:
+          - db.internal.example.com
+          - orders
+  toolExpect:
+    requiredToolsUsed:
+      - write_resource
+      - open_page
+    forbiddenToolsUsed:
+      - deploy_workspace_item
+      - delete_workspace_item
+    toolCallArgs:
+      # The model may land the user in the resource's drawer or in the drawer of
+      # the secret variable it created for the password — both are correct.
+      - tool: open_page
+        field: page
+        stringIncludesAnyOf:
+          - resources
+          - variables
+      - tool: open_page
+        field: open
+        stringIncludesAnyOf:
+          - prod_db
+          - password
+  judgeChecklist:
+    - creates a postgres resource draft at f/evals/global/prod_db with the provided host, port, database, and user
+    - the password is left for the user to provide (empty, a placeholder, or a secret variable reference) — no invented password value presented as real
+    - does not deploy or save anything to the workspace
diff --git a/frontend/src/lib/components/copilot/chat/global/core.ts b/frontend/src/lib/components/copilot/chat/global/core.ts
index d3ecb3330f..447b98a525 100644
--- a/frontend/src/lib/components/copilot/chat/global/core.ts
+++ b/frontend/src/lib/components/copilot/chat/global/core.ts
@@ -1104,6 +1104,7 @@ ${pipelineBullet}
 - After creating or editing a script or flow draft, run test_run_script, test_run_flow, or test_run_step with representative args before reporting that it works. These tools prefer drafts, so testing does not require deployment.
 - Use list_runs to find recent runs (optionally filtered by path, creator, label, or status), then get_job_logs with a returned id to inspect a specific run's logs — without starting a new test run.
 - Use open_page to show a workspace page with filters applied — Runs, Schedules, Variables, Resources, Assets, Audit logs, or Workspace settings on a specific tab (e.g. "open the failed runs of f/foo/bar", "open the schedule for X", "open the git sync settings"). Only the pages listed for this user in the tool are available; don't offer pages that aren't listed. Don't use it as a substitute for list_runs when you just need the data yourself.
+- Whenever you ask the user to perform a manual step in the UI — fill in a resource's credentials, set a secret variable's value, adjust a schedule or setting — call open_page in the same message, targeted at that item (pass open with its path to land in its edit drawer, or the page's filters otherwise). Never just describe where to click.
 - When the user is happy with the changes and wants to review or deploy them, use open_page with page "compare" — it opens the Compare & Deploy review page.${
 		previewTools
 			? ' By default it preselects the items this chat modified; pass items ("<kind>:<path>" entries) to control the selection'
@@ -2195,7 +2196,7 @@ const openPageFullSchema = z.object({
 		.string()
 		.optional()
 		.describe(
-			'Schedules/Triggers: exact schedule or trigger path to open in the edit drawer, e.g. f/foo/my_schedule'
+			'Schedules/Triggers/Variables/Resources: exact item path to open in the edit drawer, e.g. f/foo/my_schedule. Use it whenever the user should act on one specific item (e.g. fill in credentials) so they land directly in its editor.'
 		),
 	summary: z
 		.string()
@@ -2245,7 +2246,7 @@ const OPEN_PAGE_FIELD_PAGES: Record<string, OpenPageName[]> = {
 	schedule_path: ['runs', 'schedules'],
 	job_kinds: ['runs'],
 	user: ['runs'],
-	open: ['schedules', 'triggers'],
+	open: ['schedules', 'triggers', 'variables', 'resources'],
 	summary: ['schedules'],
 	trigger_kind: ['triggers'],
 	resource_type: ['resources'],
@@ -2296,7 +2297,7 @@ function buildOpenPageDefSchema(
 }
 
 const OPEN_PAGE_DESCRIPTION =
-	'Open a Windmill page with filters applied — Runs, Schedules, Variables, Resources, Assets, Audit logs, Folders, Groups, Triggers (by kind), Workspace settings (on a specific tab), or the Compare & Deploy review page. Inside an AI session it opens as a tab in the side-panel preview next to the chat; elsewhere it offers a clickable link. Use after surfacing something the user likely wants to inspect (e.g. "show me the failed runs of X", "open the schedule for Y", "open the git sync settings", "open the kafka triggers"), and use page "compare" when the user wants to review and deploy pending changes (the items field controls which changes are preselected). This is the only way to show one of these pages in the session preview — open_preview only handles editable items (scripts, flows, raw apps, pipelines). Only pages listed for this user are available; do not offer others.'
+	'Open a Windmill page with filters applied — Runs, Schedules, Variables, Resources, Assets, Audit logs, Folders, Groups, Triggers (by kind), Workspace settings (on a specific tab), or the Compare & Deploy review page. Inside an AI session it opens as a tab in the side-panel preview next to the chat; elsewhere it offers a clickable link. Use after surfacing something the user likely wants to inspect (e.g. "show me the failed runs of X", "open the schedule for Y", "open the git sync settings", "open the kafka triggers"), and ALWAYS when asking the user to perform a manual step themselves (fill in a resource\'s credentials, set a variable\'s value — pass open with the item path so its edit drawer opens directly). Use page "compare" when the user wants to review and deploy pending changes (the items field controls which changes are preselected). This is the only way to show one of these pages in the session preview — open_preview only handles editable items (scripts, flows, raw apps, pipelines). Only pages listed for this user are available; do not offer others.'
 
 // Non-arg inputs the URL builder needs: the chat's operating workspace (the compare
 // page cannot fall back to its own store default inside a session preview) and the
@@ -2319,9 +2320,12 @@ export function buildOpenPageUrl(page: OpenPageName, a: OpenPageArgs, ctx: OpenP
 				filters: { path: a.path, schedule_path: a.schedule_path, summary: a.summary }
 			})
 		case 'variables':
-			return buildVariablesUrl({ path: a.path, owner: a.owner })
+			return buildVariablesUrl({ open: a.open, filters: { path: a.path, owner: a.owner } })
 		case 'resources':
-			return buildResourcesUrl({ path: a.path, resource_type: a.resource_type, owner: a.owner })
+			return buildResourcesUrl({
+				open: a.open,
+				filters: { path: a.path, resource_type: a.resource_type, owner: a.owner }
+			})
 		case 'assets':
 			return buildAssetsUrl({ path: a.path })
 		case 'audit_logs':
@@ -2420,7 +2424,9 @@ export const openPageTool: Tool<{}> = {
 		if (page === 'triggers' && triggerKind && !allowedTriggerKinds().includes(triggerKind)) {
 			return `${TRIGGER_PAGES[triggerKind].label} aren't available on this instance.`
 		}
-		const urlWorkspace = workspaceId ?? get(workspaceStore)
+		// Headless callers (ai_evals) have neither helpers.operatingWorkspace nor a
+		// populated workspaceStore; the chat loop's workspace is still correct there.
+		const urlWorkspace = workspaceId ?? get(workspaceStore) ?? ctx.workspace
 		if (!urlWorkspace) {
 			return 'Error: no workspace is selected, so no page can be opened.'
 		}
diff --git a/frontend/src/lib/components/copilot/chat/global/pageNavigation.test.ts b/frontend/src/lib/components/copilot/chat/global/pageNavigation.test.ts
index f3e4f48b46..3fc0eb0b69 100644
--- a/frontend/src/lib/components/copilot/chat/global/pageNavigation.test.ts
+++ b/frontend/src/lib/components/copilot/chat/global/pageNavigation.test.ts
@@ -39,20 +39,34 @@ describe('pageNavigation builders', () => {
 
 	it('resources keeps resource_type + path, drops runs-only keys', () => {
 		const u = parse(
-			buildResourcesUrl({ resource_type: 'postgres', path: 'f/x', status: 'failure' })
+			buildResourcesUrl({ filters: { resource_type: 'postgres', path: 'f/x', status: 'failure' } })
 		)
 		expect(u.searchParams.get('resource_type')).toBe('postgres')
 		expect(u.searchParams.get('path')).toBe('f/x')
 		expect(u.searchParams.has('status')).toBe(false)
 	})
 
+	it('resources opens a specific resource via the #/resource/ hash', () => {
+		const u = parse(buildResourcesUrl({ open: 'f/x/db' }))
+		expect(u.pathname).toBe('/resources')
+		expect(u.hash).toBe('#/resource/f/x/db')
+	})
+
 	it('variables keeps path + owner only', () => {
-		const u = parse(buildVariablesUrl({ path: 'f/x', owner: 'u/alice', resource_type: 'postgres' }))
+		const u = parse(
+			buildVariablesUrl({ filters: { path: 'f/x', owner: 'u/alice', resource_type: 'postgres' } })
+		)
 		expect(u.searchParams.get('path')).toBe('f/x')
 		expect(u.searchParams.get('owner')).toBe('u/alice')
 		expect(u.searchParams.has('resource_type')).toBe(false)
 	})
 
+	it('variables opens a specific variable via hash', () => {
+		const u = parse(buildVariablesUrl({ open: 'u/alice/token' }))
+		expect(u.pathname).toBe('/variables')
+		expect(u.hash).toBe('#u/alice/token')
+	})
+
 	it('triggers route to the kind page, opening a specific trigger via hash', () => {
 		expect(parse(buildTriggersUrl({ trigger_kind: 'kafka' })).pathname).toBe('/kafka_triggers')
 		const u = parse(buildTriggersUrl({ trigger_kind: 'http', open: 'f/a/b' }))
diff --git a/frontend/src/lib/components/copilot/chat/global/pageNavigation.ts b/frontend/src/lib/components/copilot/chat/global/pageNavigation.ts
index da249b1ed0..cc5f091f9b 100644
--- a/frontend/src/lib/components/copilot/chat/global/pageNavigation.ts
+++ b/frontend/src/lib/components/copilot/chat/global/pageNavigation.ts
@@ -92,13 +92,33 @@ export function buildSchedulesUrl({
 // full filter schema), so the allow-list is the exact set of keys the builder emits —
 // these names match the query params the pages read (variablesFilter/resourcesFilter/
 // assetsFilter and audit_logs/+page.svelte).
-export function buildVariablesUrl(filters: Record<string, unknown>): string {
-	return buildFilterUrl(VARIABLES_PATH, filters, { validKeys: ['path', 'owner'] })
+/** When `open` is set, the variable at that exact path is opened in the edit
+ * drawer via the `#<path>` hash the page already handles. */
+export function buildVariablesUrl({
+	open,
+	filters
+}: {
+	open?: string
+	filters?: Record<string, unknown>
+}): string {
+	return buildFilterUrl(VARIABLES_PATH, filters ?? {}, {
+		validKeys: ['path', 'owner'],
+		hash: open
+	})
 }
 
-export function buildResourcesUrl(filters: Record<string, unknown>): string {
-	return buildFilterUrl(RESOURCES_PATH, filters, {
-		validKeys: ['path', 'resource_type', 'owner']
+/** When `open` is set, the resource at that exact path is opened in the edit
+ * drawer via the `#/resource/<path>` hash the page already handles. */
+export function buildResourcesUrl({
+	open,
+	filters
+}: {
+	open?: string
+	filters?: Record<string, unknown>
+}): string {
+	return buildFilterUrl(RESOURCES_PATH, filters ?? {}, {
+		validKeys: ['path', 'resource_type', 'owner'],
+		hash: open ? `/resource/${open}` : undefined
 	})
 }
 
diff --git a/frontend/src/lib/components/sessions/PreviewTabHost.svelte b/frontend/src/lib/components/sessions/PreviewTabHost.svelte
index d41c06c123..eadbc22293 100644
--- a/frontend/src/lib/components/sessions/PreviewTabHost.svelte
+++ b/frontend/src/lib/components/sessions/PreviewTabHost.svelte
@@ -99,9 +99,14 @@
 			// in-frame navigation may have stripped of ?workspace= — booting the frame
 			// into the top-level navigation workspace instead of the session fork
 			// (sessionStorage/localStorage are shared with the top window, so the
-			// scoping can only live in the URL). replace() forces the load even when
-			// the target equals the current URL.
-			win.location.replace(withMenuHidden(tab.loc || tab.url, workspaceId || undefined))
+			// scoping can only live in the URL). But replace() to the frame's exact
+			// current URL is a no-op when it carries a fragment (same-document
+			// navigation, no load) — only then fall back to location.reload(), which
+			// always performs a full load of that same URL.
+			const target = withMenuHidden(tab.loc || tab.url, workspaceId || undefined)
+			const { pathname, search, hash } = win.location
+			if (pathname + search + hash === target) win.location.reload()
+			else win.location.replace(target)
 		} catch {
 			// Cross-navigation timing — skip; the next mutation reloads again.
 		}
@@ -125,6 +130,19 @@
 		flashTimer = setTimeout(() => (flashing = false), 800)
 	})
 	$effect(() => () => clearTimeout(flashTimer))
+
+	// Forced-load signal for a navigation to the tab's exact current URL (see
+	// pulseReload) — without it the page never re-runs its URL-driven behavior.
+	// Seeded from the current nonce: a pulse from before this host mounted is
+	// already satisfied by the initial iframe load.
+	let lastReloadNonce = runtime?.previewTabs.reloadPulse.nonce ?? -1
+	$effect(() => {
+		const pulse = runtime?.previewTabs.reloadPulse
+		if (!pulse || pulse.nonce === lastReloadNonce) return
+		lastReloadNonce = pulse.nonce
+		if (pulse.id !== tab.id) return
+		reload()
+	})
 </script>
 
 {#snippet editorLoading()}
diff --git a/frontend/src/lib/components/sessions/sessionPreviewTabs.svelte.ts b/frontend/src/lib/components/sessions/sessionPreviewTabs.svelte.ts
index 27b0dc2454..82e5743609 100644
--- a/frontend/src/lib/components/sessions/sessionPreviewTabs.svelte.ts
+++ b/frontend/src/lib/components/sessions/sessionPreviewTabs.svelte.ts
@@ -160,8 +160,9 @@ export class SessionPreviewTabs {
 	#activeId = $state('')
 	#collapsed = $state(false)
 	#previewSize = $state<number | undefined>(undefined)
-	// Ephemeral UI signal — not part of the persisted snapshot.
+	// Ephemeral UI signals — not part of the persisted snapshot.
 	#focusPulse = $state({ id: '', nonce: 0 })
+	#reloadPulse = $state({ id: '', nonce: 0 })
 	readonly #adapter: PreviewTabsAdapter
 	readonly #flushDelay: number
 	#flushHandle: ReturnType<typeof setTimeout> | undefined
@@ -204,6 +205,18 @@ export class SessionPreviewTabs {
 		this.#focusPulse = { id, nonce: this.#focusPulse.nonce + 1 }
 	}
 
+	get reloadPulse(): { id: string; nonce: number } {
+		return this.#reloadPulse
+	}
+
+	// Ask the tab's host to reload its iframe. Needed when a navigation targets the
+	// tab's exact current URL: nothing changes, so URL-driven behavior in the page
+	// (e.g. a #<path> hash opening an edit drawer the user has since closed) would
+	// never re-fire without a forced load.
+	pulseReload(id: string): void {
+		this.#reloadPulse = { id, nonce: this.#reloadPulse.nonce + 1 }
+	}
+
 	setPreviewSize(size: number): void {
 		if (this.#previewSize === size) return
 		this.#previewSize = size
diff --git a/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts b/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts
index 9ef0b7f05f..df5ac6aada 100644
--- a/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts
+++ b/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts
@@ -1024,16 +1024,32 @@ setOpenPagePreviewHandler(({ sessionId: callerSessionId, href, label, newTab })
 			(t) => matchReusablePage(t.loc || t.url)?.path === targetPage.path
 		)
 		if (existing) {
+			// A target identical to what the tab already shows produces no navigation
+			// signal at all, so a drawer-opening hash (an edit drawer the user closed)
+			// would silently not re-fire — force a load. Hashless targets need no
+			// reload: focusing the already-correct view is enough.
+			const unchanged = href.includes('#') && (existing.loc || existing.url) === href
 			owner.select(existing.id)
 			owner.navigate({ type: 'page', href, label })
 			owner.setCollapsed(false)
+			if (unchanged) {
+				owner.pulseReload(existing.id)
+				return `Re-opened the ${label} preview tab on the requested view.`
+			}
 			return `Updated the ${label} preview tab with the new filters.`
 		}
 	}
 	const result = owner.open({ type: 'page', href, label })
-	return result.status === 'focused'
-		? `A preview tab is already showing ${label} — focused it and applied the filters.`
-		: `Opened ${label} in a new preview tab in the side panel.`
+	if (result.status === 'focused') {
+		// Same no-signal situation as above: open() only reports 'focused' when a
+		// tab already shows this exact URL.
+		if (href.includes('#')) {
+			const shown = owner.tabs.find((t) => (t.loc || t.url) === href)
+			if (shown) owner.pulseReload(shown.id)
+		}
+		return `A preview tab is already showing ${label} — focused it and applied the filters.`
+	}
+	return `Opened ${label} in a new preview tab in the side panel.`
 })
 
 // Companion to the open_preview handler: report the calling session's open
diff --git a/frontend/src/routes/(root)/(logged)/resources/+page.svelte b/frontend/src/routes/(root)/(logged)/resources/+page.svelte
index 5c0f538d3f..5edd78dfee 100644
--- a/frontend/src/routes/(root)/(logged)/resources/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/resources/+page.svelte
@@ -605,13 +605,22 @@
 		}
 	})
 
-	onMount(() => {
-		let hash = page.url.hash
-		if (hash.startsWith('#/resource/')) {
-			console.log('hash', hash)
-			let path = hash.slice(11)
-			resourceEditor?.initEdit(path)
+	// Deep link: #/resource/<path> opens that resource's edit drawer. Reactive
+	// rather than onMount so a hash change on the already-mounted page (e.g. the
+	// AI session preview re-pointing its tab) opens the drawer too. Row links
+	// pre-set handledHash: their onclick already opens the drawer.
+	let handledHash = ''
+	$effect(() => {
+		const hash = page.url.hash
+		if (!hash.startsWith('#/resource/')) {
+			// Navigating away from a drawer target must clear the tracker, or
+			// re-targeting the same item later would be skipped as already handled.
+			handledHash = ''
+			return
 		}
+		if (hash === handledHash || !resourceEditor) return
+		handledHash = hash
+		resourceEditor.initEdit(hash.slice(11))
 	})
 
 	let showTable = $derived(
@@ -1014,8 +1023,17 @@
 												<a
 													class="break-all"
 													href="#/resource/{path}"
-													onclick={() => resourceEditor?.initEdit?.(path)}
-													>{#if marked}{@html marked}{:else}{path}{/if}{(getLocalDraftHint($workspaceStore, 'resource', path) ?? is_draft) ? '*' : ''}</a
+													onclick={() => {
+														handledHash = `#/resource/${path}`
+														resourceEditor?.initEdit?.(path)
+													}}
+													>{#if marked}{@html marked}{:else}{path}{/if}{(getLocalDraftHint(
+														$workspaceStore,
+														'resource',
+														path
+													) ?? is_draft)
+														? '*'
+														: ''}</a
 												>
 												{#if draft_only}
 													<DraftBadge draft_only is_draft={false} />
diff --git a/frontend/src/routes/(root)/(logged)/schedules/+page.svelte b/frontend/src/routes/(root)/(logged)/schedules/+page.svelte
index c519c01a05..e07dfcf59e 100644
--- a/frontend/src/routes/(root)/(logged)/schedules/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/schedules/+page.svelte
@@ -199,18 +199,25 @@
 	})
 	let scheduleEditor: ScheduleEditor | undefined = $state()
 
-	let hashHandled = false
+	// Deep link: #<path> opens that schedule's edit drawer. Tracks the last
+	// handled hash (not a one-shot flag) so a hash change on the already-mounted
+	// page (e.g. the AI session preview re-pointing its tab) opens the drawer
+	// too. Row links pre-set handledHash: their onclick already opens the drawer.
+	let handledHash = ''
 	$effect(() => {
-		if (!hashHandled && schedules.length > 0 && scheduleEditor) {
-			let hash = $page.url.hash
-			if (hash.length > 1) {
-				let path = hash.slice(1)
-				let schedule = schedules.find((s) => s.path === path)
-				if (schedule) {
-					hashHandled = true
-					scheduleEditor?.openEdit(path, schedule.is_flow)
-				}
-			}
+		const hash = $page.url.hash
+		if (hash.length <= 1) {
+			// Navigating away from a drawer target must clear the tracker, or
+			// re-targeting the same schedule later would be skipped as already handled.
+			handledHash = ''
+			return
+		}
+		if (hash === handledHash || schedules.length === 0 || !scheduleEditor) return
+		const path = hash.slice(1)
+		const schedule = schedules.find((s) => s.path === path)
+		if (schedule) {
+			handledHash = hash
+			scheduleEditor.openEdit(path, schedule.is_flow)
 		}
 	})
 
@@ -381,13 +388,22 @@
 
 								<a
 									href="#{path}"
-									onclick={() => scheduleEditor?.openEdit(path, is_flow)}
+									onclick={() => {
+										handledHash = `#${path}`
+										scheduleEditor?.openEdit(path, is_flow)
+									}}
 									class="min-w-0 grow hover:underline decoration-gray-400"
 								>
 									<div
 										class="text-emphasis flex-wrap text-left text-xs font-semibold mb-1 truncate"
 									>
-										{summary || script_path}{(getLocalDraftHint($workspaceStore, 'trigger_schedule', path) ?? is_draft) ? '*' : ''}
+										{summary || script_path}{(getLocalDraftHint(
+											$workspaceStore,
+											'trigger_schedule',
+											path
+										) ?? is_draft)
+											? '*'
+											: ''}
 									</div>
 									<div class="text-secondary text-xs truncate text-left">
 										schedule: {path}
diff --git a/frontend/src/routes/(root)/(logged)/variables/+page.svelte b/frontend/src/routes/(root)/(logged)/variables/+page.svelte
index 2baf44bc77..af2184e7f5 100644
--- a/frontend/src/routes/(root)/(logged)/variables/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/variables/+page.svelte
@@ -43,7 +43,7 @@
 		EyeOff,
 		Circle
 	} from 'lucide-svelte'
-	import { onMount, untrack } from 'svelte'
+	import { untrack } from 'svelte'
 	import { page } from '$app/stores'
 
 	type ListableVariableW = ListableVariable & { canWrite: boolean }
@@ -244,12 +244,22 @@
 		}, 5000)
 	}
 
-	onMount(() => {
-		let hash = $page.url.hash
-		if (hash.length > 1) {
-			let path = hash.slice(1)
-			variableEditor?.editVariable(path)
+	// Deep link: #<path> opens that variable's edit drawer. Reactive rather than
+	// onMount so a hash change on the already-mounted page (e.g. the AI session
+	// preview re-pointing its tab) opens the drawer too. Row links pre-set
+	// handledHash: their onclick already opens the drawer.
+	let handledHash = ''
+	$effect(() => {
+		const hash = $page.url.hash
+		if (hash.length <= 1) {
+			// Navigating away from a drawer target must clear the tracker, or
+			// re-targeting the same item later would be skipped as already handled.
+			handledHash = ''
+			return
 		}
+		if (hash === handledHash || !variableEditor) return
+		handledHash = hash
+		variableEditor.editVariable(hash.slice(1))
 	})
 </script>
 
@@ -366,10 +376,15 @@
 											<a
 												class="break-all"
 												id="edit-{path}"
-												onclick={() => variableEditor?.editVariable(path)}
+												onclick={() => {
+													handledHash = `#${path}`
+													variableEditor?.editVariable(path)
+												}}
 												href="#{path}"
 											>
-												{path}{(getLocalDraftHint($workspaceStore, 'variable', path) ?? is_draft) ? '*' : ''}
+												{path}{(getLocalDraftHint($workspaceStore, 'variable', path) ?? is_draft)
+													? '*'
+													: ''}
 											</a>
 											{#if draft_only}
 												<DraftBadge draft_only is_draft={false} />

From c23f1880d2f81649dcbb01d20dd7a14f8ccf4ae6 Mon Sep 17 00:00:00 2001
From: Guilhem <guilhemlemouel@gmail.com>
Date: Wed, 22 Jul 2026 14:35:22 +0200
Subject: [PATCH 115/171] show preview chip on write tools, not open_preview
 (#10261)

* fix(ai-sessions): show preview chip on write tools, not open_preview

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ai-sessions): render preview chip label in UI font, not mono

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ai-sessions): cast RowIcon to IconType for Button startIcon

RowIcon has a required `kind` prop, so it is not assignable to Button's
`IconType` (Component<{ size?: number }>). The `props` field carries the
runtime prop, so cast the icon to satisfy the type check.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
---
 .../copilot/chat/ToolExecutionDisplay.svelte  |  2 +-
 .../copilot/chat/ToolPreviewCard.svelte       | 31 +++++++-------
 .../components/copilot/chat/global/core.ts    | 41 +++++++------------
 .../src/lib/components/copilot/chat/shared.ts | 18 ++++----
 .../(root)/(logged)/sessions/+page.svelte     |  2 +-
 5 files changed, 39 insertions(+), 55 deletions(-)

diff --git a/frontend/src/lib/components/copilot/chat/ToolExecutionDisplay.svelte b/frontend/src/lib/components/copilot/chat/ToolExecutionDisplay.svelte
index be77af7e0a..8360ed962f 100644
--- a/frontend/src/lib/components/copilot/chat/ToolExecutionDisplay.svelte
+++ b/frontend/src/lib/components/copilot/chat/ToolExecutionDisplay.svelte
@@ -97,7 +97,7 @@
 			</button>
 		{/snippet}
 
-		<!-- Discrete preview chip for an item a tool created/updated/opened, pinned to
+		<!-- Discrete preview chip for an item a tool created/updated, pinned to
 		     the right of the header row. Rendered inline (not gated on expand) so it
 		     stays visible after the tool collapses. -->
 		{#if showPreviewChip && message.previewCard}
diff --git a/frontend/src/lib/components/copilot/chat/ToolPreviewCard.svelte b/frontend/src/lib/components/copilot/chat/ToolPreviewCard.svelte
index 79e37e90b7..81d00fd8e4 100644
--- a/frontend/src/lib/components/copilot/chat/ToolPreviewCard.svelte
+++ b/frontend/src/lib/components/copilot/chat/ToolPreviewCard.svelte
@@ -1,6 +1,8 @@
 <script lang="ts">
 	import { PanelRight } from 'lucide-svelte'
+	import { Button } from '$lib/components/common'
 	import RowIcon from '$lib/components/common/table/RowIcon.svelte'
+	import type { IconType } from '$lib/utils'
 	import { runToolDisplayAction } from './createdResourceActions.svelte'
 	import { openItemPreviewAction, type PreviewCardKind } from './shared'
 
@@ -10,12 +12,7 @@
 
 	let { card }: Props = $props()
 
-	// RowIcon has no 'pipeline' kind — a pipeline is a folder graph, shown with the
-	// data-pipeline icon.
-	const iconKind = $derived(card.kind === 'pipeline' ? 'data_pipeline' : card.kind)
-	const kindLabel = $derived(
-		card.kind === 'raw_app' ? 'app' : card.kind === 'pipeline' ? 'pipeline' : card.kind
-	)
+	const kindLabel = $derived(card.kind === 'raw_app' ? 'app' : card.kind)
 
 	let opening = $state(false)
 	async function open() {
@@ -29,17 +26,17 @@
 	}
 </script>
 
-<button
-	type="button"
-	onclick={open}
+<Button
+	variant="default"
+	unifiedSize="2xs"
 	disabled={opening}
 	title="Open {kindLabel} preview: {card.path}"
-	class="group shrink-0 inline-flex items-center gap-1.5 rounded-md border border-light bg-surface pl-1.5 pr-2 py-1 transition-colors hover:bg-surface-hover disabled:opacity-60"
+	onClick={open}
+	startIcon={{ icon: RowIcon as unknown as IconType, props: { kind: card.kind, size: 12 } }}
+	endIcon={{ icon: PanelRight }}
+	wrapperClasses="shrink-0"
 >
-	<span class="inline-flex shrink-0">
-		<RowIcon kind={iconKind} size={12} />
-	</span>
-	<span class="inline-flex items-center gap-1 text-2xs text-tertiary group-hover:text-secondary">
-		Preview <PanelRight size={11} />
-	</span>
-</button>
+	<!-- The chip renders inside the tool row's font-mono scope; the label is UI text.
+	     (font-main, not font-sans — this Tailwind config only defines main/mono.) -->
+	<span class="font-main">Preview</span>
+</Button>
diff --git a/frontend/src/lib/components/copilot/chat/global/core.ts b/frontend/src/lib/components/copilot/chat/global/core.ts
index 447b98a525..0ddb11afe1 100644
--- a/frontend/src/lib/components/copilot/chat/global/core.ts
+++ b/frontend/src/lib/components/copilot/chat/global/core.ts
@@ -3266,18 +3266,7 @@ export const globalTools: Tool<{}>[] = [
 		),
 		fn: async (ctx) => {
 			const parsed = openPreviewSchema.parse(ctx.args)
-			const sessionId = sessionIdFromCtx(ctx)
-			const { opened, message } = openSessionPreview(parsed, sessionId)
-			// Surface the same discrete card the write tools show, so the user can
-			// re-open/focus the preview later from the tool call. Only when the tool
-			// actually opened the preview (not for a refused open, e.g. a gated
-			// pipeline), and only in a session.
-			if (sessionId && opened) {
-				ctx.toolCallbacks.setToolStatus(ctx.toolId, {
-					previewCard: { kind: parsed.kind, path: parsed.path }
-				})
-			}
-			return message
+			return openSessionPreview(parsed, sessionIdFromCtx(ctx))
 		}
 	},
 	{
@@ -3491,6 +3480,9 @@ type WriteDraftCtx = {
 	// reloads the preview of the session that issued the deploy — not the
 	// UI-active one. Undefined for the global side-panel chat.
 	sessionId?: string
+	// Present when the ctx is the raw tool `fn` context — session chats carry
+	// their id here (see SessionToolHelpers / sessionIdFromCtx).
+	helpers?: unknown
 }
 
 // Sessions are the only context where `open_preview` makes sense — the global
@@ -3566,25 +3558,18 @@ export function setOpenPreviewHandler(handler: OpenPreviewHandler | undefined):
 	openPreviewHandler = handler
 }
 
-// `opened` distinguishes a real open (the caller may then offer a preview card)
-// from a refusal that is returned as a message rather than thrown — so the card is
-// never shown for an item the tool declined to preview (e.g. a gated pipeline).
 function openSessionPreview(
 	args: { kind: 'script' | 'flow' | 'raw_app' | 'pipeline'; path: string },
 	sessionId: string | undefined
-): { opened: boolean; message: string } {
+): string {
 	if (!openPreviewHandler) {
-		return {
-			opened: false,
-			message:
-				'Error: open_preview is only available inside an AI session. Tell the user to switch to a session to view the preview, or describe the item textually.'
-		}
+		return 'Error: open_preview is only available inside an AI session. Tell the user to switch to a session to view the preview, or describe the item textually.'
 	}
 	// open_preview only exists in sessions, so no sessionId check is needed here.
 	if (args.kind === 'pipeline' && !isSessionPipelinesEnabled()) {
-		return { opened: false, message: SESSION_PIPELINES_GATED_MESSAGE }
+		return SESSION_PIPELINES_GATED_MESSAGE
 	}
-	return { opened: true, message: openPreviewHandler({ ...args, sessionId }) }
+	return openPreviewHandler({ ...args, sessionId })
 }
 
 // Opens a workspace *page* (Runs, Schedules, …) as a page tab in the session's
@@ -3949,15 +3934,17 @@ const PREVIEW_CARD_KIND_BY_ITEM_KIND: Partial<
 }
 
 // Offer a preview card for a write that landed a previewable item. Session chats
-// only (`ctx.sessionId`): the card opens the item in the side panel, which the
-// global side-panel chat has no equivalent of. `path` is the item's display path
-// (what `open_preview` takes), not its synthetic draft storage key.
+// only: the card opens the item in the side panel, which the global side-panel
+// chat has no equivalent of. `path` is the item's display path (what
+// `open_preview` takes), not its synthetic draft storage key.
 function maybeAttachPreviewCard(
 	ctx: WriteDraftCtx,
 	itemKind: DraftPersistResult['itemKind'],
 	path: string
 ): void {
-	if (!ctx.sessionId) return
+	// Write tools pass the raw tool ctx, whose session id lives in `helpers` —
+	// `ctx.sessionId` is only set by callers that thread it explicitly.
+	if (!ctx.sessionId && !sessionIdFromCtx(ctx)) return
 	const kind = PREVIEW_CARD_KIND_BY_ITEM_KIND[itemKind]
 	if (!kind) return
 	ctx.toolCallbacks.setToolStatus(ctx.toolId, { previewCard: { kind, path } })
diff --git a/frontend/src/lib/components/copilot/chat/shared.ts b/frontend/src/lib/components/copilot/chat/shared.ts
index ce2bfe0d02..53e72ab1c1 100644
--- a/frontend/src/lib/components/copilot/chat/shared.ts
+++ b/frontend/src/lib/components/copilot/chat/shared.ts
@@ -515,14 +515,14 @@ export type NavigateAction = {
 	page: string
 }
 
-/** Kinds of item a session preview can host — the subset the `open_preview` tool
- * accepts. `pipeline` targets a folder graph, the rest a workspace item path. */
-export type PreviewCardKind = 'script' | 'flow' | 'raw_app' | 'pipeline'
+/** Kinds of previewable item a write tool can land — the subset of draft item
+ * kinds a session preview can host. */
+export type PreviewCardKind = 'script' | 'flow' | 'raw_app'
 
-// A discrete card shown under a tool call that created/updated/opened the preview of
-// a workspace item. Clicking it opens the item's live preview in the session side
-// panel — or focuses the tab if it is already open. The handler is registered by the
-// sessions page (the only surface with a preview panel).
+// A discrete card shown on a tool call that created or updated a workspace item.
+// Clicking it opens the item's live preview in the session side panel — or focuses
+// the tab if it is already open. The handler is registered by the sessions page
+// (the only surface with a preview panel).
 export type OpenItemPreviewAction = {
 	id: string
 	type: 'open_item_preview'
@@ -586,8 +586,8 @@ export type ToolDisplayMessage = {
 	webSearchSources?: WebSearchSource[]
 	/** Data URL of an image the tool produced (e.g. take_screenshot), shown on the card. */
 	imageUrl?: string
-	/** Workspace item this tool created/updated or opened a preview of. Rendered as a
-	 * discrete, always-visible card that opens (or focuses) the item's preview in the
+	/** Workspace item this tool created or updated. Rendered as a discrete,
+	 * always-visible card that opens (or focuses) the item's preview in the
 	 * session side panel. Set only for session chats — the side panel is their surface. */
 	previewCard?: { kind: PreviewCardKind; path: string }
 }
diff --git a/frontend/src/routes/(root)/(logged)/sessions/+page.svelte b/frontend/src/routes/(root)/(logged)/sessions/+page.svelte
index b0be11a98f..225bbec8ed 100644
--- a/frontend/src/routes/(root)/(logged)/sessions/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/sessions/+page.svelte
@@ -463,7 +463,7 @@
 		}
 	})
 
-	// Preview cards under create/update/open-preview tool calls dispatch here. Open
+	// Preview cards on create/update tool calls dispatch here. Open
 	// (or focus, if already shown) the item's preview in the active session's panel —
 	// the visible chat is always the active session, so `owner` is its panel. Read
 	// `owner` lazily inside the handler (not in the effect body) so this registers

From ecb1a92070fb18048a6a1467270469e8462a3cbf Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Wed, 22 Jul 2026 16:21:13 +0200
Subject: [PATCH 116/171] fix(copilot): stop write_flow forcing rawscript code
 into nested JSON (#10260)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix(copilot): stop write_flow forcing rawscript code into nested JSON

The global-chat write_flow tool made the model embed rawscript bodies
inside the modules JSON string, so code had to survive three levels of
escaping (tool arguments -> modules string -> content string). Models
routinely mangled the quotes/newlines and flow creation failed on the
first tries.

Bring write_flow to parity with flow mode's set_module_code escape hatch:
detect rawscript modules left empty or as inline_script placeholders and
tell the model to fill them via set_flow_module_code, add a code-escaping
hint to the JSON parse error, and update the guidance to keep code out of
the modules structure.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(copilot): only warn on saved write_flow; add regression tests

Address review: writeFlowDraft reports conflicts/persistence errors as
{success:false} rather than throwing, so the empty-body warning must be
folded into the JSON result only on a successful save — otherwise the
model is told to set_flow_module_code on a flow that was never saved
(stale or nonexistent draft). Add core.test.ts coverage for the empty-body
warning (top-level, nested, preprocessor, failure; populated suppressed),
the no-warning-on-failed-save path, and the malformed-JSON escaping hint.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(copilot): warn on patch_flow_json inline_script placeholders

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* test(ai-evals): add global case for quote-heavy inline flow code

Exercises write_flow creating a rawscript whose body is multi-line and
quote-heavy (the scenario the write_flow fix targets), so the global-mode
A/B can measure that code lands out-of-band via set_flow_module_code
rather than being escaped into the modules JSON string.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(copilot): resolve inline_script placeholders in global flow writes

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* refactor(copilot): condense patch_flow_json warning comment

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(copilot): soften write_flow guidance to inline by default

Benchmarks showed the aggressive "empty content + set_flow_module_code
for any multi-line/quoted body" guidance pushed even capable models onto
the multi-round-trip fill path, inflating per-iteration overhead with no
reliability gain when inline escaping would have succeeded. Default to
inlining and reserve the empty+fill escape hatch for bodies that are
genuinely hard to escape or when a write_flow call returns a JSON parse
error — the case that actually benefits escaping-prone models. The
warning, parse-error hint, and set_flow_module_code recovery path are
unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* test(ai-evals): drop global quote-heavy inline-code case

The manual global-mode A/B (Sonnet, Gemini 3 flash/pro, GPT-4o) showed no
pass-rate delta: the GPT-5 inline-escaping failure this change targets does
not reproduce on any available model, so the case guards nothing measurable.
Keep the unit tests as the regression guard instead.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Guilhem Lemouel <guilhemlemouel@gmail.com>
---
 .../copilot/chat/flow/editableFlowJson.ts     |  42 +++-
 .../copilot/chat/flow/helperUtils.ts          |   2 +-
 .../copilot/chat/flow/inlineScriptsUtils.ts   |   2 +-
 .../copilot/chat/global/core.test.ts          | 214 ++++++++++++++++++
 .../components/copilot/chat/global/core.ts    | 126 ++++++++++-
 5 files changed, 375 insertions(+), 11 deletions(-)

diff --git a/frontend/src/lib/components/copilot/chat/flow/editableFlowJson.ts b/frontend/src/lib/components/copilot/chat/flow/editableFlowJson.ts
index 2f1cb5a699..3d5ef5f3d0 100644
--- a/frontend/src/lib/components/copilot/chat/flow/editableFlowJson.ts
+++ b/frontend/src/lib/components/copilot/chat/flow/editableFlowJson.ts
@@ -2,8 +2,14 @@ import { z } from 'zod'
 import type { FlowModule, FlowValue } from '$lib/gen'
 import { collectAllFlowModuleIdsFromModules } from '$lib/components/flows/flowTree'
 import { SPECIAL_MODULE_IDS } from '../shared'
-import type { InlineScriptSession } from './inlineScriptsUtils'
-import { validateFlowGroups, validateFlowNotes, type FlowGroup, type FlowNote } from './helperUtils'
+import { findUnresolvedInlineScriptRefs, type InlineScriptSession } from './inlineScriptsUtils'
+import {
+	replaceNewInlineScriptRefsWithEmptyCode,
+	validateFlowGroups,
+	validateFlowNotes,
+	type FlowGroup,
+	type FlowNote
+} from './helperUtils'
 import { flowModuleSchema, flowModulesSchema } from './openFlowZod.gen'
 
 /**
@@ -384,7 +390,7 @@ export function buildEditableFlowJson(
 	}
 }
 
-function restoreSpecialRawscriptModule(
+export function restoreSpecialRawscriptModule(
 	module: FlowModule | null,
 	session: InlineScriptSession
 ): FlowModule | null {
@@ -420,3 +426,33 @@ export function applyEditableFlowJsonToFlow(
 		notes: editable.notes ?? undefined
 	}
 }
+
+/**
+ * Post-restore normalization for draft flow writes. A placeholder that survived
+ * restore either names its own module — a new inline body, blanked in place so
+ * the caller's empty-body warning sends the model to the set-module-code tool —
+ * or names nothing, in which case the write is rejected so a literal
+ * `inline_script.*` string is never persisted as runnable content.
+ */
+export function finalizeUnresolvedInlineScripts(value: {
+	modules: FlowModule[]
+	preprocessor_module?: FlowModule | null
+	failure_module?: FlowModule | null
+}): void {
+	const specials = [value.preprocessor_module, value.failure_module].filter(
+		(module): module is FlowModule => module != null
+	)
+	const blanked = new Set<string>()
+	replaceNewInlineScriptRefsWithEmptyCode(value.modules, blanked)
+	replaceNewInlineScriptRefsWithEmptyCode(specials, blanked)
+	const unresolved = [
+		...findUnresolvedInlineScriptRefs(value.modules),
+		...findUnresolvedInlineScriptRefs(specials)
+	]
+	if (unresolved.length > 0) {
+		const refs = unresolved.map((id) => `"inline_script.${id}"`).join(', ')
+		throw new Error(
+			`Unresolved inline script reference(s): ${refs}. A rawscript "content" placeholder must be "inline_script.<its own module id>" (a new body, filled afterwards with the set-module-code tool) or reference an existing rawscript module to keep its current body. Nothing was saved.`
+		)
+	}
+}
diff --git a/frontend/src/lib/components/copilot/chat/flow/helperUtils.ts b/frontend/src/lib/components/copilot/chat/flow/helperUtils.ts
index c426cb8e4e..ba5d98fdfb 100644
--- a/frontend/src/lib/components/copilot/chat/flow/helperUtils.ts
+++ b/frontend/src/lib/components/copilot/chat/flow/helperUtils.ts
@@ -344,7 +344,7 @@ function assertResolvedInlineScripts(
 	}
 }
 
-function replaceNewInlineScriptRefsWithEmptyCode(
+export function replaceNewInlineScriptRefsWithEmptyCode(
 	modules: FlowModule[],
 	emptyInlineScriptModuleIds: Set<string>
 ): void {
diff --git a/frontend/src/lib/components/copilot/chat/flow/inlineScriptsUtils.ts b/frontend/src/lib/components/copilot/chat/flow/inlineScriptsUtils.ts
index e63965e52a..41d8e06b4a 100644
--- a/frontend/src/lib/components/copilot/chat/flow/inlineScriptsUtils.ts
+++ b/frontend/src/lib/components/copilot/chat/flow/inlineScriptsUtils.ts
@@ -223,7 +223,7 @@ function restoreInlineScriptReferences(
 	})
 }
 
-function findUnresolvedInlineScriptRefs(modules: FlowModule[]): string[] {
+export function findUnresolvedInlineScriptRefs(modules: FlowModule[]): string[] {
 	const unresolvedRefs: string[] = []
 
 	function checkModule(module: FlowModule) {
diff --git a/frontend/src/lib/components/copilot/chat/global/core.test.ts b/frontend/src/lib/components/copilot/chat/global/core.test.ts
index 78da313953..3ba69284d9 100644
--- a/frontend/src/lib/components/copilot/chat/global/core.test.ts
+++ b/frontend/src/lib/components/copilot/chat/global/core.test.ts
@@ -2857,6 +2857,220 @@ describe('global AI tools', () => {
 		).resolves.toBe(code)
 	})
 
+	it('warns about every empty rawscript body (top-level, nested, preprocessor, failure) and skips populated ones', async () => {
+		const result = JSON.parse(
+			await callGlobalTool('write_flow', {
+				path: 'f/flows/empty-bodies',
+				modules: JSON.stringify([
+					{
+						id: 'empty_top',
+						value: { type: 'rawscript', language: 'bun', content: '', input_transforms: {} }
+					},
+					{
+						id: 'filled',
+						value: {
+							type: 'rawscript',
+							language: 'bun',
+							content: 'export async function main() { return 1 }',
+							input_transforms: {}
+						}
+					},
+					{
+						id: 'loop',
+						value: {
+							type: 'forloopflow',
+							iterator: { type: 'javascript', expr: 'results.filled' },
+							skip_failures: false,
+							modules: [
+								{
+									id: 'empty_nested',
+									value: {
+										type: 'rawscript',
+										language: 'bun',
+										content: '',
+										input_transforms: {}
+									}
+								}
+							]
+						}
+					}
+				]),
+				preprocessor_module: JSON.stringify({
+					id: 'preprocessor',
+					value: { type: 'rawscript', language: 'bun', content: '', input_transforms: {} }
+				}),
+				failure_module: JSON.stringify({
+					id: 'failure',
+					value: { type: 'rawscript', language: 'bun', content: '', input_transforms: {} }
+				})
+			})
+		)
+
+		expect(result.success).toBe(true)
+		expect(result.message).toContain('set_flow_module_code')
+		for (const id of ['empty_top', 'empty_nested', 'preprocessor', 'failure']) {
+			expect(result.message).toContain(`"${id}"`)
+		}
+		expect(result.message).not.toContain('"filled"')
+	})
+
+	it('does not append the empty-body warning when the flow was not saved', async () => {
+		const path = 'f/flows/write-fails'
+		failingWrites.add(`flow:${path}`)
+
+		const result = JSON.parse(
+			await callGlobalTool('write_flow', {
+				path,
+				modules: JSON.stringify([
+					{
+						id: 'empty_step',
+						value: { type: 'rawscript', language: 'bun', content: '', input_transforms: {} }
+					}
+				])
+			})
+		)
+
+		expect(result.success).toBe(false)
+		expect(JSON.stringify(result)).not.toContain('set_flow_module_code')
+	})
+
+	it('hints at inline-code escaping when the modules JSON fails to parse', async () => {
+		await expect(
+			callGlobalTool('write_flow', {
+				path: 'f/flows/bad-json',
+				modules: '[{"id":"a","value":{"type":"rawscript","content":"oops"}]'
+			})
+		).rejects.toThrow(/Invalid JSON for modules.*set_flow_module_code/s)
+	})
+
+	it('warns when patch_flow_json adds a rawscript module left as an inline_script placeholder', async () => {
+		const path = 'f/flows/patch-new-module'
+		await callGlobalTool('write_flow', {
+			path,
+			modules: JSON.stringify([
+				{
+					id: 'call_api',
+					value: {
+						type: 'rawscript',
+						language: 'bun',
+						content: 'export async function main() { return 1 }',
+						input_transforms: {}
+					}
+				}
+			])
+		})
+
+		// A structural patch that adds no module must not trigger the fill-code warning.
+		const benign = JSON.parse(
+			await callGlobalTool('patch_flow_json', {
+				path,
+				old_string: '"language":"bun"',
+				new_string: '"language":"deno"'
+			})
+		)
+		expect(benign.success).toBe(true)
+		expect(benign.message).not.toContain('set_flow_module_code')
+
+		// Adding a new rawscript module in the compact view carries the
+		// inline_script.<id> placeholder as its content; the result must flag it.
+		const result = JSON.parse(
+			await callGlobalTool('patch_flow_json', {
+				path,
+				old_string: '"input_transforms":{}}}]',
+				new_string:
+					'"input_transforms":{}}},{"id":"write_to_pg","value":{"type":"rawscript","language":"postgresql","content":"inline_script.write_to_pg","input_transforms":{}}}]'
+			})
+		)
+		expect(result.success).toBe(true)
+		expect(result.message).toContain('set_flow_module_code')
+		expect(result.message).toContain('"write_to_pg"')
+		expect(result.message).not.toContain('"call_api"')
+
+		// The placeholder is blanked, never persisted as literal content, and the
+		// existing module's body survives the patch round-trip.
+		await expect(
+			callGlobalTool('read_flow_module_code', { path, module_id: 'write_to_pg' })
+		).resolves.toBe('')
+		await expect(
+			callGlobalTool('read_flow_module_code', { path, module_id: 'call_api' })
+		).resolves.toBe('export async function main() { return 1 }')
+	})
+
+	it('rejects a patch whose inline_script placeholder references no module', async () => {
+		const path = 'f/flows/patch-bad-ref'
+		await callGlobalTool('write_flow', {
+			path,
+			modules: JSON.stringify([
+				{
+					id: 'call_api',
+					value: {
+						type: 'rawscript',
+						language: 'bun',
+						content: 'export async function main() { return 1 }',
+						input_transforms: {}
+					}
+				}
+			])
+		})
+
+		await expect(
+			callGlobalTool('patch_flow_json', {
+				path,
+				old_string: '"input_transforms":{}}}]',
+				new_string:
+					'"input_transforms":{}}},{"id":"write_to_pg","value":{"type":"rawscript","language":"postgresql","content":"inline_script.call_apy","input_transforms":{}}}]'
+			})
+		).rejects.toThrow(/Unresolved inline script reference/)
+
+		// The rejected patch must not have touched the draft.
+		await expect(
+			callGlobalTool('read_flow_module_code', { path, module_id: 'call_api' })
+		).resolves.toBe('export async function main() { return 1 }')
+	})
+
+	it('write_flow resolves placeholders to existing module bodies on overwrite', async () => {
+		const path = 'f/flows/overwrite-keep-bodies'
+		const code = 'export async function main() { return 1 }'
+		await callGlobalTool('write_flow', {
+			path,
+			modules: JSON.stringify([
+				{
+					id: 'call_api',
+					value: { type: 'rawscript', language: 'bun', content: code, input_transforms: {} }
+				}
+			])
+		})
+
+		const result = JSON.parse(
+			await callGlobalTool('write_flow', {
+				path,
+				summary: 'Reordered',
+				modules: JSON.stringify([
+					{
+						id: 'call_api',
+						value: {
+							type: 'rawscript',
+							language: 'bun',
+							content: 'inline_script.call_api',
+							input_transforms: {}
+						}
+					},
+					{
+						id: 'notify',
+						value: { type: 'rawscript', language: 'bun', content: '', input_transforms: {} }
+					}
+				])
+			})
+		)
+		expect(result.success).toBe(true)
+		expect(result.message).toContain('"notify"')
+		expect(result.message).not.toContain('"call_api"')
+
+		await expect(
+			callGlobalTool('read_flow_module_code', { path, module_id: 'call_api' })
+		).resolves.toBe(code)
+	})
+
 	it('writes flows with flow-mode arguments and reads compact flow value', async () => {
 		const writeResult = JSON.parse(
 			await callGlobalTool('write_flow', {
diff --git a/frontend/src/lib/components/copilot/chat/global/core.ts b/frontend/src/lib/components/copilot/chat/global/core.ts
index 0ddb11afe1..8b68cac2f0 100644
--- a/frontend/src/lib/components/copilot/chat/global/core.ts
+++ b/frontend/src/lib/components/copilot/chat/global/core.ts
@@ -26,6 +26,7 @@ import type {
 	CreateResource,
 	CreateVariable,
 	Flow,
+	FlowModule,
 	FlowValue,
 	Job,
 	ListableApp,
@@ -57,9 +58,14 @@ import {
 	applyEditableFlowJsonToFlow,
 	buildEditableFlowJson,
 	type EditableFlowJson,
+	finalizeUnresolvedInlineScripts,
+	restoreSpecialRawscriptModule,
 	validateEditableFlowJson
 } from '../flow/editableFlowJson'
-import { createInlineScriptSession } from '../flow/inlineScriptsUtils'
+import {
+	createInlineScriptSession,
+	findUnresolvedInlineScriptRefs
+} from '../flow/inlineScriptsUtils'
 import { searchNpmPackagesTool } from '../script/core'
 import {
 	getDatatableSdkReference,
@@ -445,6 +451,10 @@ const writeFlowSchema = z.object({
 	override: draftOverrideField
 })
 
+// modules/preprocessor_module/failure_module can carry rawscript `content`, whose
+// quotes and newlines are the usual reason the JSON string fails to parse.
+const FLOW_CODE_BEARING_FIELDS = new Set(['modules', 'preprocessor_module', 'failure_module'])
+
 function parseOptionalJsonArg(value: unknown, field: string): unknown {
 	if (value === undefined || value === null) {
 		return value
@@ -454,10 +464,60 @@ function parseOptionalJsonArg(value: unknown, field: string): unknown {
 		return typeof value === 'string' ? JSON.parse(value) : value
 	} catch (error) {
 		const message = error instanceof Error ? error.message : String(error)
-		throw new Error(`Invalid JSON for ${field}: ${message}`)
+		const hint = FLOW_CODE_BEARING_FIELDS.has(field)
+			? ' A rawscript "content" string with multi-line code or quotes is the usual cause. Instead of inlining large code, create the rawscript module with empty content ("") and fill its body with set_flow_module_code afterwards.'
+			: ''
+		throw new Error(`Invalid JSON for ${field}: ${message}${hint}`)
 	}
 }
 
+/**
+ * Rawscript bodies are fragile to embed inside the `modules` JSON string: the
+ * code's quotes and newlines have to survive three levels of escaping (tool-call
+ * arguments -> modules string -> content string) and the model routinely mangles
+ * them. So a module may be saved with empty (or `inline_script.` placeholder)
+ * content; return the ids that still need a body filled out-of-band with
+ * `set_flow_module_code`.
+ */
+function emptyInlineScriptModuleIds(editable: EditableFlowJson): string[] {
+	const value: FlowValue = {
+		modules: editable.modules,
+		preprocessor_module: editable.preprocessor_module ?? undefined,
+		failure_module: editable.failure_module ?? undefined
+	}
+	const session = createInlineScriptSession()
+	buildEditableFlowJson({ value, schema: editable.schema }, session)
+	return Object.entries(session.getAll())
+		.filter(([, content]) => content.trim() === '' || /^inline_script\./.test(content))
+		.map(([id]) => id)
+}
+
+/**
+ * Fold the empty-body warning into a flow write tool's JSON result — but only
+ * when the save actually succeeded. `writeFlowDraft` reports
+ * conflicts/persistence errors as `{ success: false }` rather than throwing;
+ * telling the model to fill code on a flow that was never saved would send it
+ * after a stale or nonexistent draft.
+ */
+function appendEmptyInlineScriptWarning(result: string, editable: EditableFlowJson): string {
+	const emptyIds = emptyInlineScriptModuleIds(editable)
+	if (emptyIds.length === 0) {
+		return result
+	}
+	let parsed: { success?: unknown; message?: unknown }
+	try {
+		parsed = JSON.parse(result)
+	} catch {
+		return result
+	}
+	if (parsed.success !== true || typeof parsed.message !== 'string') {
+		return result
+	}
+	const list = emptyIds.map((id) => `"${id}"`).join(', ')
+	parsed.message += `\n\nWarning: inline scripts ${list} have no code yet. Fill each one with set_flow_module_code(path, module_id, code) — do not re-send the whole flow.`
+	return JSON.stringify(parsed, null, 2)
+}
+
 function editableFlowToDraftValue(editable: EditableFlowJson): FlowDraftValue {
 	const value: FlowValue = {
 		modules: editable.modules,
@@ -1893,7 +1953,9 @@ function getFlowInstructions(): string {
   - \`read_flow_module_code(path, module_id)\` — returns the raw inline script content for one module.
   - \`set_flow_module_code(path, module_id, code)\` — overwrites that module's inline script content; saves to the draft.
 - Use \`patch_flow_json\` for *structural* edits: module ids, paths, input_transforms, branch arrangement, summaries, preprocessor/failure swaps, schema/groups/notes. Use \`set_flow_module_code\` for changes inside a specific rawscript body.
-- \`write_flow\` is for full overwrites / create-from-scratch. Its \`modules\`, \`preprocessor_module\`, and \`failure_module\` arguments use **non-compact** flow modules (rawscript content is the actual code, not a placeholder).
+- When **adding a new rawscript module** with \`patch_flow_json\`, set its \`content\` to the placeholder \`"inline_script.<moduleId>"\` (matching the compact view) — never real code — then **immediately fill the body** with \`set_flow_module_code(path, module_id, code)\`. The module is saved with an empty body until you do; the tool result lists the module ids still awaiting code. A placeholder that names anything other than the module's own id or an existing rawscript module is rejected.
+- \`write_flow\` is for full overwrites / create-from-scratch. Its \`modules\`, \`preprocessor_module\`, and \`failure_module\` arguments are **non-compact** flow modules: inline each rawscript body directly in \`content\` by default. But if a body is long or quote/backslash-heavy enough that escaping it into the JSON string is error-prone — or if a \`write_flow\` call comes back with a JSON parse error — create that module with **empty content** (\`"content": ""\`) and fill it with \`set_flow_module_code(path, module_id, code)\`, whose \`code\` is a plain argument with no nested escaping. \`write_flow\` reports which modules still have empty bodies so you know what to fill.
+  - When overwriting an **existing** flow, set \`"content": "inline_script.<moduleId>"\` on any rawscript module whose code you are not changing — the placeholder resolves to that module's current body, so you never re-send (or re-read) unchanged code. Placeholders that match no existing rawscript module and are not the module's own id are rejected.
 
 # Windmill flow authoring reference
 
@@ -2798,15 +2860,17 @@ export const globalTools: Tool<{}>[] = [
 				groups: parseOptionalJsonArg(parsed.groups, 'groups'),
 				notes: parseOptionalJsonArg(parsed.notes, 'notes')
 			})
-			return writeFlowDraft(
+			const resolved = await resolveWriteFlowInlineScripts(parsed.path, editable, ctx.workspace)
+			const result = await writeFlowDraft(
 				{
 					path: parsed.path,
 					summary: parsed.summary,
 					description: parsed.description,
-					flow: editableFlowToDraftValue(editable)
+					flow: editableFlowToDraftValue(resolved)
 				},
 				ctx
 			)
+			return appendEmptyInlineScriptWarning(result, resolved)
 		}
 	},
 	{
@@ -4261,6 +4325,46 @@ async function loadFlowDraftValue(
 	}
 }
 
+/**
+ * `write_flow` accepts `inline_script.<id>` placeholders so the model can
+ * overwrite a flow without re-sending (or even reading) unchanged rawscript
+ * bodies. Resolve them against the current draft/deployed flow: an id with a
+ * stored body keeps it, a new module's own-id placeholder becomes an empty body
+ * (to fill via set_flow_module_code), and anything else rejects the write.
+ */
+async function resolveWriteFlowInlineScripts(
+	path: string,
+	editable: EditableFlowJson,
+	workspace: string
+): Promise<EditableFlowJson> {
+	const specials = [editable.preprocessor_module, editable.failure_module].filter(
+		(module): module is FlowModule => module != null
+	)
+	const hasPlaceholders =
+		findUnresolvedInlineScriptRefs(editable.modules).length > 0 ||
+		findUnresolvedInlineScriptRefs(specials).length > 0
+	if (!hasPlaceholders) {
+		return editable
+	}
+
+	const session = createInlineScriptSession()
+	if (
+		(await getGlobalDraft(workspace, 'flow', path)) ||
+		(await FlowService.existsFlowByPath({ workspace, path }))
+	) {
+		const base = await loadFlowDraftValue(path, workspace)
+		buildEditableFlowJson(flowDraftAsEditableInput(base.flow), session)
+	}
+	const resolved: EditableFlowJson = {
+		...editable,
+		modules: session.restoreInlineScriptReferences(editable.modules),
+		preprocessor_module: restoreSpecialRawscriptModule(editable.preprocessor_module, session),
+		failure_module: restoreSpecialRawscriptModule(editable.failure_module, session)
+	}
+	finalizeUnresolvedInlineScripts(resolved)
+	return resolved
+}
+
 async function patchFlowJson(
 	args: { path: string; old_string: string; new_string: string; replace_all: boolean },
 	ctx: WriteDraftCtx
@@ -4293,8 +4397,9 @@ async function patchFlowJson(
 
 	const patchedEditable = validateEditableFlowJson(parsedValue)
 	const newFlowValue = applyEditableFlowJsonToFlow(base.flow.value, patchedEditable, session)
+	finalizeUnresolvedInlineScripts(newFlowValue)
 
-	return writeFlowDraft(
+	const result = await writeFlowDraft(
 		{
 			path,
 			summary: base.summary,
@@ -4307,6 +4412,15 @@ async function patchFlowJson(
 		},
 		ctx
 	)
+	// Warn from the restored value, not patchedEditable — the compact view holds
+	// placeholders for every rawscript, so only post-restore content shows which
+	// modules still need bodies filled via set_flow_module_code.
+	return appendEmptyInlineScriptWarning(result, {
+		...patchedEditable,
+		modules: newFlowValue.modules,
+		preprocessor_module: newFlowValue.preprocessor_module ?? null,
+		failure_module: newFlowValue.failure_module ?? null
+	})
 }
 
 async function readFlowModuleCode(

From 26fcc93d4c4e8122c961607551b88350c8b90729 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Wed, 22 Jul 2026 16:35:56 +0200
Subject: [PATCH 117/171] chore(main): release 1.766.0 (#10247)

* chore(main): release 1.766.0

* Apply automatic changes

---------

Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>
---
 CHANGELOG.md                                  |  18 ++
 backend/Cargo.lock                            | 212 +++++++++---------
 backend/Cargo.toml                            |   4 +-
 .../parsers/windmill-parser-wasm/Cargo.lock   |  48 ++--
 .../parsers/windmill-parser-wasm/Cargo.toml   |   2 +-
 backend/windmill-api/openapi.yaml             |   2 +-
 benchmarks/lib.ts                             |   2 +-
 cli/src/core/constants.ts                     |   2 +-
 frontend/package-lock.json                    |   4 +-
 frontend/package.json                         |   2 +-
 lsp/Pipfile                                   |   2 +-
 openflow.openapi.yaml                         |   2 +-
 .../WindmillClient/WindmillClient.psd1        |   2 +-
 python-client/wmill/pyproject.toml            |   2 +-
 typescript-client/jsr.json                    |   2 +-
 typescript-client/package.json                |   2 +-
 version.txt                                   |   2 +-
 17 files changed, 164 insertions(+), 146 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9f2f95ea2b..f8de1d03a3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,23 @@
 # Changelog
 
+## [1.766.0](https://github.com/windmill-labs/windmill/compare/v1.765.0...v1.766.0) (2026-07-22)
+
+
+### Features
+
+* **ai-sessions:** show item preview cards for tools ([#10254](https://github.com/windmill-labs/windmill/issues/10254)) ([703744f](https://github.com/windmill-labs/windmill/commit/703744fb8b76f70384cbc3341d5e1b3dbf30455e))
+* make content search a full CE feature ([#10252](https://github.com/windmill-labs/windmill/issues/10252)) ([d2c5d6f](https://github.com/windmill-labs/windmill/commit/d2c5d6f4b4ede9449407ed3831713d3e3d1d6972))
+* **sessions:** ship AI sessions as beta with legacy-chat opt-out ([#10242](https://github.com/windmill-labs/windmill/issues/10242)) ([0508cdd](https://github.com/windmill-labs/windmill/commit/0508cddf0a86b6a6a043cb31978ca68b76a95d02))
+
+
+### Bug Fixes
+
+* accept ssh/scheme-less git repo urls and $var: refs in app repo resolution ([#10246](https://github.com/windmill-labs/windmill/issues/10246)) ([b948efd](https://github.com/windmill-labs/windmill/commit/b948efd3c81aada103bd141eae03fbe626bf6ee5))
+* **copilot:** stop write_flow forcing rawscript code into nested JSON ([#10260](https://github.com/windmill-labs/windmill/issues/10260)) ([ecb1a92](https://github.com/windmill-labs/windmill/commit/ecb1a92070fb18048a6a1467270469e8462a3cbf))
+* prevent u16 underflow in suspend count causing permanent flow deadlock ([#10256](https://github.com/windmill-labs/windmill/issues/10256)) ([68b1fcc](https://github.com/windmill-labs/windmill/commit/68b1fcc5cdd3d217ebb1b9e09c0d52334faf0a63))
+* **prompts:** prefer Bun over Deno for TypeScript runtime selection ([#10253](https://github.com/windmill-labs/windmill/issues/10253)) ([380cf75](https://github.com/windmill-labs/windmill/commit/380cf752ca8fc57eb70f7c8efd57290f7902a030))
+* **tutorials:** repair broken frontend tutorials after UI redesigns ([#10255](https://github.com/windmill-labs/windmill/issues/10255)) ([5685981](https://github.com/windmill-labs/windmill/commit/5685981c9902ff37c3bd271dc5c5ede948a0787a))
+
 ## [1.765.0](https://github.com/windmill-labs/windmill/compare/v1.764.0...v1.765.0) (2026-07-21)
 
 
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index b0b0e296cd..5e64afb62d 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -879,7 +879,7 @@ checksum = "ae36dc4177970ef04fde5178d3e2429882def40e57a451f919c098f72baa6cec"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.2",
+ "syn 3.0.3",
 ]
 
 [[package]]
@@ -2410,9 +2410,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.6.3"
+version = "4.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fb99565819980999fb7b4a1796046a5c949e6d4ff132cf5fadf5a641e20d776"
+checksum = "d91e0c145792ef73a6ad36d27c75ac09f1832222a3c209689d90f534685ee5b7"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -2432,14 +2432,14 @@ dependencies = [
 
 [[package]]
 name = "clap_derive"
-version = "4.6.3"
+version = "4.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32f2392eae7f16557a3d727ef3a12e57b2b2ca6f98566a5f4fb41ffe305df077"
+checksum = "d012d2b9d65aca7f18f4d9878a045bc17899bba951561ba5ec3c2ba1eed9a061"
 dependencies = [
  "heck",
  "proc-macro2",
  "quote",
- "syn 2.0.119",
+ "syn 3.0.3",
 ]
 
 [[package]]
@@ -7003,9 +7003,9 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.188"
+version = "0.2.189"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22053b6a34f84abc97f9129e61334f40174659a1b9bd18c970b83db6a9a6348b"
+checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
 
 [[package]]
 name = "libffi-sys"
@@ -8861,9 +8861,9 @@ checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 
 [[package]]
 name = "pest"
-version = "2.8.7"
+version = "2.8.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "47627dd7305c6a2d6c8c6bcd24c5a4c17dbbf425f4f9c5313e724b38fc9782e9"
+checksum = "7df728be843c7070fab6ab7c328c4e9e9d78e23bf749c0669c86ee7ebfa050a2"
 dependencies = [
  "memchr",
  "ucd-trie",
@@ -8871,9 +8871,9 @@ dependencies = [
 
 [[package]]
 name = "pest_derive"
-version = "2.8.7"
+version = "2.8.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b4254325ecad416ab689e27ba51da03ba01a9632bc6e108f5fe7c3c4ad29d58"
+checksum = "9e2dd6fc3b26b3462ee188aac870f5a41d398f1cd5e2408d16531bd71c9591fd"
 dependencies = [
  "pest",
  "pest_generator",
@@ -8881,9 +8881,9 @@ dependencies = [
 
 [[package]]
 name = "pest_generator"
-version = "2.8.7"
+version = "2.8.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c4c0e91ead7a8f7acecbca6f003fc2e8282b1dbe2dd9c9d2f16aba42995e0a7"
+checksum = "6a7a9205cfb6f596a9e8b689c0a15f9ceb7a1aafae7aaf788150ac65b29975b6"
 dependencies = [
  "pest",
  "pest_meta",
@@ -8894,9 +8894,9 @@ dependencies = [
 
 [[package]]
 name = "pest_meta"
-version = "2.8.7"
+version = "2.8.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f9744bc48116fee06334924bb5f2bad41eed5e89bd26e29b0b799f9a3f82c210"
+checksum = "85abd351c0de1e8384fc791a0737111a350394937e92b956b743dac12429f57c"
 dependencies = [
  "pest",
 ]
@@ -9967,7 +9967,7 @@ checksum = "2c9283685feec7d69af75fb0e858d5e7378f33fe4fc699383b2916ab9273e03c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.2",
+ "syn 3.0.3",
 ]
 
 [[package]]
@@ -11133,7 +11133,7 @@ checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.2",
+ "syn 3.0.3",
 ]
 
 [[package]]
@@ -11198,7 +11198,7 @@ checksum = "8d3b1629de253c70a0508c3899572da79ca359fdab27c7920ff00406df418906"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.2",
+ "syn 3.0.3",
 ]
 
 [[package]]
@@ -11870,9 +11870,9 @@ dependencies = [
 
 [[package]]
 name = "sse-stream"
-version = "0.2.4"
+version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "39f24a9b78c40b90817bbcd1821c74ddfd74916aadd29403d001532a9195532d"
+checksum = "c123f296ade4ec4b8b0f6162116e6629f5146922ca5ab40ca9d3c2e73ab4761e"
 dependencies = [
  "bytes",
  "futures-util",
@@ -12410,9 +12410,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "3.0.2"
+version = "3.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a207d6d6a2b7fc470b80443726053f18a2481b7e1eee970597051596567987a3"
+checksum = "53e9bae58849f64dfa4f5d5ae372c8341f7305f82a3868709269343628b659a3"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -12805,7 +12805,7 @@ checksum = "43cbfe0cf76104d42a574802844187e84a305e531ed54455f11fbde0f10541cd"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.2",
+ "syn 3.0.3",
 ]
 
 [[package]]
@@ -13172,9 +13172,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-stream"
-version = "0.1.18"
+version = "0.1.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32da49809aab5c3bc678af03902d4ccddea2a87d028d86392a4b1560c6906c70"
+checksum = "a3d06f0b082ba57c26b79407372e57cf2a1e28124f78e9479fe80322cf53420b"
 dependencies = [
  "futures-core",
  "pin-project-lite",
@@ -13771,7 +13771,7 @@ checksum = "f153acc4e99a5f2a5aefa09fb078be54e26271b2813f6041200b224c098d8328"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.2",
+ "syn 3.0.3",
 ]
 
 [[package]]
@@ -14479,7 +14479,7 @@ dependencies = [
 
 [[package]]
 name = "windmill"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -14564,7 +14564,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-ai"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "async-stream",
  "async-trait",
@@ -14597,7 +14597,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-alerting"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14610,7 +14610,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "argon2",
@@ -14749,7 +14749,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-agent-workers"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14772,7 +14772,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-assets"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14787,7 +14787,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-auth"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14813,7 +14813,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "reqwest 0.12.28",
  "serde",
@@ -14823,7 +14823,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-configs"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14840,7 +14840,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-debug"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "axum 0.8.9",
  "base64 0.22.1",
@@ -14862,7 +14862,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-embeddings"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14885,7 +14885,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flow-conversations"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14901,7 +14901,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flows"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14922,7 +14922,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-groups"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14943,7 +14943,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-inputs"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14957,7 +14957,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-integration-tests"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -14992,7 +14992,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-jobs"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15017,7 +15017,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-npm-proxy"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "axum 0.8.9",
  "flate2",
@@ -15035,7 +15035,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-openapi"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15057,7 +15057,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-schedule"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15077,7 +15077,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-scripts"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15114,7 +15114,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-settings"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15142,7 +15142,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-sse"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "lazy_static",
  "serde",
@@ -15154,7 +15154,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-users"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "argon2",
  "axum 0.8.9",
@@ -15179,7 +15179,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workers"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15193,7 +15193,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workspaces"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15228,7 +15228,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -15242,7 +15242,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15261,7 +15261,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "aes-gcm",
  "aho-corasick",
@@ -15364,7 +15364,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-dep-map"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "chrono",
  "itertools 0.14.0",
@@ -15383,7 +15383,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "regex",
  "serde",
@@ -15398,7 +15398,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "astral-tokio-tar",
@@ -15422,7 +15422,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-jseval"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -15439,7 +15439,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -15455,7 +15455,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-mcp"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15476,7 +15476,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-native-triggers"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15507,7 +15507,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-oauth"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "arc-swap",
@@ -15532,7 +15532,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-object-store"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "async-stream",
@@ -15566,7 +15566,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-operator"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -15584,7 +15584,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -15593,7 +15593,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15605,7 +15605,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15617,7 +15617,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -15629,7 +15629,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15641,7 +15641,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15653,7 +15653,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -15664,7 +15664,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15675,7 +15675,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15687,7 +15687,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -15698,7 +15698,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15720,7 +15720,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15732,7 +15732,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15746,7 +15746,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -15763,7 +15763,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15776,7 +15776,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -15788,7 +15788,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15806,7 +15806,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -15822,7 +15822,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -15838,7 +15838,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -15849,7 +15849,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15888,7 +15888,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-runtime-nativets"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "const_format",
@@ -15928,7 +15928,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "getrandom 0.3.4",
  "wasm-bindgen",
@@ -15939,7 +15939,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-store"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15973,7 +15973,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-test-utils"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15997,7 +15997,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16030,7 +16030,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-amqp"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16057,7 +16057,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-azure"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16090,7 +16090,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-email"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16110,7 +16110,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-gcp"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16144,7 +16144,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-http"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16180,7 +16180,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-kafka"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16203,7 +16203,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-mqtt"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16227,7 +16227,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-nats"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -16251,7 +16251,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-postgres"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16286,7 +16286,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-sqs"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16314,7 +16314,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-websocket"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16339,7 +16339,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "bitflags 2.13.1",
@@ -16358,7 +16358,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "async-once-cell",
@@ -16472,7 +16472,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker-volumes"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "bytes",
  "futures",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 0d0dc3c936..3bf98a6632 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.765.0"
+version = "1.766.0"
 authors.workspace = true
 edition.workspace = true
 
@@ -88,7 +88,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal", "./parsers/windmill-parser-wasm"]
 
 [workspace.package]
-version = "1.765.0"
+version = "1.766.0"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.lock b/backend/parsers/windmill-parser-wasm/Cargo.lock
index 10ec092737..d12f08e467 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.lock
+++ b/backend/parsers/windmill-parser-wasm/Cargo.lock
@@ -6191,7 +6191,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill-common"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "aho-corasick",
  "anyhow",
@@ -6272,7 +6272,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -6284,7 +6284,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "convert_case",
  "serde",
@@ -6293,7 +6293,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6305,7 +6305,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6317,7 +6317,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -6329,7 +6329,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6341,7 +6341,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6353,7 +6353,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -6364,7 +6364,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6375,7 +6375,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6387,7 +6387,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6398,7 +6398,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -6420,7 +6420,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6432,7 +6432,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6446,7 +6446,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "convert_case",
@@ -6463,7 +6463,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6476,7 +6476,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -6488,7 +6488,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6506,7 +6506,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -6522,7 +6522,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6538,7 +6538,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wasm"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "getrandom 0.2.17",
@@ -6570,7 +6570,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -6581,7 +6581,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.765.0"
+version = "1.766.0"
 dependencies = [
  "anyhow",
  "bitflags",
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.toml b/backend/parsers/windmill-parser-wasm/Cargo.toml
index 4a1bc8ae12..f19a51e9ac 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.toml
+++ b/backend/parsers/windmill-parser-wasm/Cargo.toml
@@ -12,7 +12,7 @@ resolver = "2"
 members = ["."]
 
 [workspace.package]
-version = "1.765.0"
+version = "1.766.0"
 edition = "2021"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 077bbc025d..7be0240614 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.765.0
+  version: 1.766.0
   title: Windmill API
 
   contact:
diff --git a/benchmarks/lib.ts b/benchmarks/lib.ts
index 98c3d27e99..ef78450f2c 100644
--- a/benchmarks/lib.ts
+++ b/benchmarks/lib.ts
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.765.0";
+export const VERSION = "v1.766.0";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({
diff --git a/cli/src/core/constants.ts b/cli/src/core/constants.ts
index 760bbaca5f..dd19e76641 100644
--- a/cli/src/core/constants.ts
+++ b/cli/src/core/constants.ts
@@ -10,4 +10,4 @@ export const WM_FORK_PREFIX = "wm-fork";
 // (e.g. utils.ts) can read it without importing main.ts and creating a circular
 // dependency (main → workspace → utils → main) that triggers a TDZ.
 // Re-exported from main.ts for backwards compatibility.
-export const VERSION = "1.765.0";
+export const VERSION = "1.766.0";
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index b5a7c9feae..a3ea464095 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.765.0",
+	"version": "1.766.0",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "@windmill-labs/components",
-			"version": "1.765.0",
+			"version": "1.766.0",
 			"hasInstallScript": true,
 			"license": "AGPL-3.0",
 			"dependencies": {
diff --git a/frontend/package.json b/frontend/package.json
index 75dc0c09ef..f7a86272a0 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.765.0",
+	"version": "1.766.0",
 	"scripts": {
 		"dev": "vite dev",
 		"dev:ui-builder": "mv static/ui_builder static/ui_builder.dev-disabled 2>/dev/null || true ; trap 'mv static/ui_builder.dev-disabled static/ui_builder 2>/dev/null || true' EXIT ; vite dev",
diff --git a/lsp/Pipfile b/lsp/Pipfile
index adfc9898f0..3404fcf8f2 100644
--- a/lsp/Pipfile
+++ b/lsp/Pipfile
@@ -4,7 +4,7 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-wmill = ">=1.765.0"
+wmill = ">=1.766.0"
 sendgrid = "*"
 mysql-connector-python = "*"
 pymongo = "*"
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index f87f0827d3..be5fe3b495 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1,7 +1,7 @@
 openapi: '3.0.3'
 
 info:
-  version: 1.765.0
+  version: 1.766.0
   title: OpenFlow Spec
   contact:
     name: Ruben Fiszel
diff --git a/powershell-client/WindmillClient/WindmillClient.psd1 b/powershell-client/WindmillClient/WindmillClient.psd1
index 042c3fb14f..3c771d33a9 100644
--- a/powershell-client/WindmillClient/WindmillClient.psd1
+++ b/powershell-client/WindmillClient/WindmillClient.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'WindmillClient.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '1.765.0'
+    ModuleVersion     = '1.766.0'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()
diff --git a/python-client/wmill/pyproject.toml b/python-client/wmill/pyproject.toml
index d779b89092..082615b69b 100644
--- a/python-client/wmill/pyproject.toml
+++ b/python-client/wmill/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill"
-version = "1.765.0"
+version = "1.766.0"
 description = "A client library for accessing Windmill server wrapping the Windmill client API"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/typescript-client/jsr.json b/typescript-client/jsr.json
index 6016fa91de..430ae8ce42 100644
--- a/typescript-client/jsr.json
+++ b/typescript-client/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@windmill/windmill",
-  "version": "1.765.0",
+  "version": "1.766.0",
   "exports": "./src/index.ts",
   "publish": {
     "exclude": ["!src", "./s3Types.ts", "./sqlUtils.ts", "./client.ts"]
diff --git a/typescript-client/package.json b/typescript-client/package.json
index a481be9d16..e4096121ba 100644
--- a/typescript-client/package.json
+++ b/typescript-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.765.0",
+  "version": "1.766.0",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "homepage": "https://github.com/windmill-labs/windmill/tree/main/typescript-client#readme",
diff --git a/version.txt b/version.txt
index 3143a6d7ae..3a15667017 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.765.0
+1.766.0

From 2d24b3ac49b65469072bca929730d2c9ecd54b8f Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Wed, 22 Jul 2026 16:52:46 +0200
Subject: [PATCH 118/171] fix(jobs): enforce self_approval_disabled on the UI
 resume path (#10262)

* fix(jobs): enforce self_approval_disabled on the UI resume path

The "Resume" button in the run detail UI calls the resume_suspended endpoint,
whose owner shortcut skipped the approval-condition checks entirely. A flow
owner/operator who triggered the run could therefore self-approve despite
self_approval_disabled, unlike the owner endpoint which enforces it. Only
admins should bypass self-approval.

- Extract require_not_self_approval and enforce it before the owner shortcut in
  resume_suspended and can_approve_step (button visibility), matching
  resume_suspended_flow_as_owner.
- Persist approval_conditions when self_approval_disabled is set even without
  user_auth_required, so the restriction is not silently dropped at the resume
  boundary for raw-flow/CLI authors.

Fixes WIN-2223

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(jobs): keep self-approval capability-based on the secret path; docs/tests

Scope the self_approval_disabled enforcement to identity-based resume boundaries
only. Possession of the full HMAC resume URL is the authorization on the secret
path (the URL is disclosed only to intended approvers, e.g. when a step returns
it), so resume_suspended_job intentionally keeps skipping approval conditions and
token-only (anonymous) resumes on resume_suspended are not gated either. The
logged-in owner/operator self-approval fix stays.

- Add extract_approval_conditions helper (WAC vs classic) reused in resume_suspended.
- Update can_approve_step doc to reflect that self_approval_disabled bars the
  triggerer before the owner shortcut (codex nit).
- Reword new test comments to state the invariant, not prior behavior (codex nit).
- Add test_self_approval_disabled_without_user_auth_required covering the
  persistence + authenticated self-approval check for a non-owner triggerer.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 backend/tests/suspend_resume.rs            | 202 +++++++++++++++++++++
 backend/windmill-api/src/jobs.rs           |  92 +++++++---
 backend/windmill-worker/src/worker_flow.rs |  12 +-
 3 files changed, 277 insertions(+), 29 deletions(-)

diff --git a/backend/tests/suspend_resume.rs b/backend/tests/suspend_resume.rs
index 704fa0d256..29fe38d2c3 100644
--- a/backend/tests/suspend_resume.rs
+++ b/backend/tests/suspend_resume.rs
@@ -352,6 +352,208 @@ mod suspend_resume {
         Ok(())
     }
 
+    /// The UI "Resume" button (POST /jobs_u/flow/resume_suspended/:job_id) must reject the
+    /// triggerer approving their own self_approval_disabled step even when they own the flow
+    /// path: only admins are exempt from the self-approval restriction, so owning the runnable
+    /// does not grant the right to self-approve.
+    #[cfg(feature = "enterprise")]
+    #[cfg(feature = "deno_core")]
+    #[sqlx::test(fixtures("base"))]
+    async fn test_self_approval_disabled_blocks_ui_resume_for_owner(
+        db: Pool<Postgres>,
+    ) -> anyhow::Result<()> {
+        initialize_tracing().await;
+
+        let server = ApiServer::start(db.clone()).await?;
+        let port = server.addr.port();
+
+        let flow_with_self_approval_disabled: FlowValue = serde_json::from_value(json!({
+            "modules": [{
+                "id": "a",
+                "value": {
+                    "type": "rawscript",
+                    "language": "deno",
+                    "content": "export function main() { return 'step1'; }"
+                },
+                "suspend": {
+                    "required_events": 1,
+                    "user_auth_required": true,
+                    "self_approval_disabled": true
+                }
+            }, {
+                "id": "b",
+                "value": {
+                    "type": "rawscript",
+                    "language": "deno",
+                    "content": "export function main() { return 'step2 - after approval'; }"
+                }
+            }]
+        }))
+        .unwrap();
+
+        // Push as a non-admin who owns the flow path, so the owner shortcut is exercised.
+        let flow = RunJob::from(JobPayload::RawFlow {
+            value: flow_with_self_approval_disabled,
+            path: Some("u/test-user-2/test_ui_resume".to_string()),
+            restarted_from: None,
+        })
+        .push_as(&db, "test-user-2", "test2@windmill.dev")
+        .await;
+
+        let queue = listen_for_queue(&db).await;
+        let db_ = db.clone();
+
+        in_test_worker(
+            &db,
+            async move {
+                let db = db_;
+
+                wait_until_flow_suspends(flow, queue, &db).await;
+
+                let token = windmill_common::auth::create_token_for_owner(
+                    &db,
+                    "test-workspace",
+                    "u/test-user-2",
+                    "test-token",
+                    100,
+                    "test2@windmill.dev",
+                    &Uuid::nil(),
+                    None,
+                    None,
+                )
+                .await
+                .unwrap();
+
+                // Resume via the UI endpoint as the owner who triggered the flow.
+                let response = reqwest::Client::new()
+                    .post(format!(
+                        "http://localhost:{port}/api/w/test-workspace/jobs_u/flow/resume_suspended/{flow}"
+                    ))
+                    .header("Authorization", format!("Bearer {token}"))
+                    .header("Content-Type", "application/json")
+                    .body("{}")
+                    .send()
+                    .await
+                    .unwrap();
+
+                let status = response.status();
+                assert!(
+                    status == reqwest::StatusCode::FORBIDDEN,
+                    "Self-approval via the UI resume endpoint should be blocked for the owner when \
+                     self_approval_disabled=true. Expected 403 Forbidden, got {}. Response: {}",
+                    status,
+                    response.text().await.unwrap_or_default()
+                );
+            },
+            port,
+        )
+        .await;
+
+        server.close().await.unwrap();
+        Ok(())
+    }
+
+    /// self_approval_disabled must hold even when user_auth_required is not set: the worker must
+    /// persist the condition and the resume boundary must enforce it for the authenticated
+    /// triggerer. The triggerer here is a non-owner (folder path they don't own), so the owner
+    /// shortcut is not involved and this exercises the persistence + authenticated-check path.
+    #[cfg(feature = "enterprise")]
+    #[cfg(feature = "deno_core")]
+    #[sqlx::test(fixtures("base"))]
+    async fn test_self_approval_disabled_without_user_auth_required(
+        db: Pool<Postgres>,
+    ) -> anyhow::Result<()> {
+        initialize_tracing().await;
+
+        let server = ApiServer::start(db.clone()).await?;
+        let port = server.addr.port();
+
+        // self_approval_disabled without user_auth_required (as a raw-flow/CLI author could set).
+        let flow_value: FlowValue = serde_json::from_value(json!({
+            "modules": [{
+                "id": "a",
+                "value": {
+                    "type": "rawscript",
+                    "language": "deno",
+                    "content": "export function main() { return 'step1'; }"
+                },
+                "suspend": {
+                    "required_events": 1,
+                    "self_approval_disabled": true
+                }
+            }, {
+                "id": "b",
+                "value": {
+                    "type": "rawscript",
+                    "language": "deno",
+                    "content": "export function main() { return 'step2 - after approval'; }"
+                }
+            }]
+        }))
+        .unwrap();
+
+        // Folder path test-user-2 does not own -> non-owner triggerer (no folders in the base
+        // fixture), so the owner shortcut is bypassed and only persistence matters here.
+        let flow = RunJob::from(JobPayload::RawFlow {
+            value: flow_value,
+            path: Some("f/system/test_persist".to_string()),
+            restarted_from: None,
+        })
+        .push_as(&db, "test-user-2", "test2@windmill.dev")
+        .await;
+
+        let queue = listen_for_queue(&db).await;
+        let db_ = db.clone();
+
+        in_test_worker(
+            &db,
+            async move {
+                let db = db_;
+
+                wait_until_flow_suspends(flow, queue, &db).await;
+
+                let token = windmill_common::auth::create_token_for_owner(
+                    &db,
+                    "test-workspace",
+                    "u/test-user-2",
+                    "test-token",
+                    100,
+                    "test2@windmill.dev",
+                    &Uuid::nil(),
+                    None,
+                    None,
+                )
+                .await
+                .unwrap();
+
+                let response = reqwest::Client::new()
+                    .post(format!(
+                        "http://localhost:{port}/api/w/test-workspace/jobs_u/flow/resume_suspended/{flow}"
+                    ))
+                    .header("Authorization", format!("Bearer {token}"))
+                    .header("Content-Type", "application/json")
+                    .body("{}")
+                    .send()
+                    .await
+                    .unwrap();
+
+                let status = response.status();
+                assert!(
+                    status == reqwest::StatusCode::FORBIDDEN,
+                    "Self-approval should be blocked when self_approval_disabled=true even without \
+                     user_auth_required. Expected 403 Forbidden, got {}. Response: {}",
+                    status,
+                    response.text().await.unwrap_or_default()
+                );
+            },
+            port,
+        )
+        .await;
+
+        server.close().await.unwrap();
+        Ok(())
+    }
+
     /// Test that self-approval WORKS when self_approval_disabled is false (default behavior).
     ///
     /// This is the complementary test to test_self_approval_disabled_blocks_owner_resume.
diff --git a/backend/windmill-api/src/jobs.rs b/backend/windmill-api/src/jobs.rs
index 66e806efe3..fe1f01f4e6 100644
--- a/backend/windmill-api/src/jobs.rs
+++ b/backend/windmill-api/src/jobs.rs
@@ -3192,17 +3192,9 @@ async fn resume_suspended(
     }
 
     // Check approval conditions
-    let approval_conditions = if is_wac {
-        flow.flow_status
-            .as_ref()
-            .and_then(|v| v.get("approval_conditions"))
-            .and_then(|v| serde_json::from_value::<ApprovalConditions>(v.clone()).ok())
-    } else {
-        flow.flow_status
-            .as_ref()
-            .and_then(|v| serde_json::from_value::<FlowStatus>(v.clone()).ok())
-            .and_then(|fs| fs.approval_conditions)
-    };
+    let approval_conditions = extract_approval_conditions(flow.flow_status.as_ref(), is_wac);
+
+    let trigger_email = flow.email.as_deref().unwrap_or("");
 
     if let Some(ref ac) = approval_conditions {
         if ac.user_auth_required && opt_authed.is_none() {
@@ -3214,6 +3206,13 @@ async fn resume_suspended(
 
     // If logged in, check authorization rules
     if let Some(ref authed) = opt_authed {
+        // self_approval_disabled applies to owners too (only admins are exempt), so it is
+        // enforced before the owner shortcut below. A token-only (anonymous) resume is treated as
+        // capability-based and intentionally not gated here; see resume_suspended_job.
+        if let Some(ref ac) = approval_conditions {
+            require_not_self_approval(authed, ac, trigger_email)?;
+        }
+
         let is_admin = authed.is_admin;
         let is_owner = flow
             .script_path
@@ -3222,7 +3221,6 @@ async fn resume_suspended(
             .unwrap_or(false);
 
         if !is_admin && !is_owner {
-            let trigger_email = flow.email.as_deref().unwrap_or("");
             conditionally_require_authed_user(
                 Some(authed.clone()),
                 approval_conditions.clone(),
@@ -3347,10 +3345,11 @@ struct ApprovalInfo {
 }
 
 /// Whether `opt_authed` is allowed to approve — and therefore view — this approval step.
-/// Mirrors the authorization performed at the resume boundary: workspace admins and owners
-/// of the runnable always qualify; otherwise the approval conditions (user_auth_required /
-/// user_groups_required / self_approval_disabled) decide. When the step does not require auth,
-/// an anonymous (token-only) caller qualifies.
+/// Mirrors the authorization performed at the resume boundary: workspace admins always qualify;
+/// self_approval_disabled then bars the triggerer even when they own the runnable; otherwise
+/// owners qualify and the remaining approval conditions (user_auth_required /
+/// user_groups_required) decide. When the step does not require auth, an anonymous (token-only)
+/// caller qualifies.
 fn can_approve_step(
     opt_authed: &Option<ApiAuthed>,
     approval_conditions: &Option<ApprovalConditions>,
@@ -3362,6 +3361,12 @@ fn can_approve_step(
             if authed.is_admin {
                 return true;
             }
+            // self_approval_disabled applies to owners too, so it gates the owner shortcut.
+            if let Some(ref ac) = approval_conditions {
+                if require_not_self_approval(authed, ac, trigger_email).is_err() {
+                    return false;
+                }
+            }
             let is_owner = script_path
                 .map(|p| require_owner_of_path(authed, p).is_ok())
                 .unwrap_or(false);
@@ -3648,8 +3653,10 @@ async fn resume_suspended_job_internal(
     // Get flow info - works for step-level, flow-level, and WAC approval
     let (flow_info, is_flow_level, is_wac) = get_flow_info_for_resume(job_id, &db).await?;
 
-    // HMAC secret = full capability. Skip approval_conditions checks.
-    // Authorization rules are enforced by the new resume_suspended endpoint instead.
+    // HMAC secret = full capability. Skip approval_conditions checks: possession of the full
+    // resume URL is the authorization (it is only disclosed to intended approvers, e.g. when a
+    // step returns it). Identity-based rules, including self_approval_disabled, are enforced by
+    // the resume_suspended endpoint instead.
 
     let exists = sqlx::query_scalar!(
         r#"
@@ -4095,6 +4102,45 @@ pub async fn get_suspended_job_flow(
     Ok(Json(SuspendedJobFlow { job: flow, approvers, view_token }).into_response())
 }
 
+/// Read the step's approval_conditions from the suspended flow status. For classic flows they
+/// live inside the deserialized `FlowStatus`; for workflow-as-code they are a top-level
+/// `approval_conditions` key in the status JSON.
+fn extract_approval_conditions(
+    flow_status: Option<&serde_json::Value>,
+    is_wac: bool,
+) -> Option<ApprovalConditions> {
+    if is_wac {
+        flow_status
+            .and_then(|v| v.get("approval_conditions"))
+            .and_then(|v| serde_json::from_value::<ApprovalConditions>(v.clone()).ok())
+    } else {
+        flow_status
+            .and_then(|v| serde_json::from_value::<FlowStatus>(v.clone()).ok())
+            .and_then(|fs| fs.approval_conditions)
+    }
+}
+
+/// The flow's triggerer may not approve their own suspended step when the step sets
+/// `self_approval_disabled`. Only admins are exempt: owning the runnable does not grant
+/// the right to approve your own run, so this must be enforced at every resume boundary
+/// independently of the owner shortcut (which only waives user_auth_required /
+/// user_groups_required).
+fn require_not_self_approval(
+    authed: &ApiAuthed,
+    approval_conditions: &ApprovalConditions,
+    trigger_email: &str,
+) -> error::Result<()> {
+    if approval_conditions.self_approval_disabled
+        && !authed.is_admin
+        && authed.email.eq(trigger_email)
+    {
+        return Err(Error::PermissionDenied(
+            "Self-approval is disabled for this flow step".to_string(),
+        ));
+    }
+    Ok(())
+}
+
 fn conditionally_require_authed_user(
     _authed: Option<ApiAuthed>,
     approval_conditions_opt: Option<ApprovalConditions>,
@@ -4106,14 +4152,8 @@ fn conditionally_require_authed_user(
     let approval_conditions = approval_conditions_opt.unwrap();
 
     // Check self-approval independently of user_auth_required
-    if approval_conditions.self_approval_disabled {
-        if let Some(ref authed) = _authed {
-            if !authed.is_admin && authed.email.eq(_trigger_email) {
-                return Err(Error::PermissionDenied(
-                    "Self-approval is disabled for this flow step".to_string(),
-                ));
-            }
-        }
+    if let Some(ref authed) = _authed {
+        require_not_self_approval(authed, &approval_conditions, _trigger_email)?;
     }
 
     if approval_conditions.user_auth_required {
diff --git a/backend/windmill-worker/src/worker_flow.rs b/backend/windmill-worker/src/worker_flow.rs
index edb13c8104..d2e5b20a1d 100644
--- a/backend/windmill-worker/src/worker_flow.rs
+++ b/backend/windmill-worker/src/worker_flow.rs
@@ -3398,10 +3398,16 @@ async fn push_next_flow_job(
             // Persist approval user groups conditions, if any. Requires runnning the InputTransform
             let required_events = suspend.required_events.unwrap() as u16;
             let user_auth_required = suspend.user_auth_required.unwrap_or(false);
-            if user_auth_required {
-                let self_approval_disabled = suspend.self_approval_disabled.unwrap_or(false);
+            let self_approval_disabled = suspend.self_approval_disabled.unwrap_or(false);
+            // self_approval_disabled must be persisted even without user_auth_required, otherwise
+            // the resume boundary sees no approval_conditions and the restriction is silently
+            // dropped. user_groups_required only applies together with user_auth_required.
+            if user_auth_required || self_approval_disabled {
                 let user_groups_required: Vec<String>;
-                if let Some(user_groups_required_as_input_transform) = suspend.user_groups_required
+                if !user_auth_required {
+                    user_groups_required = Vec::new();
+                } else if let Some(user_groups_required_as_input_transform) =
+                    suspend.user_groups_required
                 {
                     match user_groups_required_as_input_transform {
                         InputTransform::Static { value } => {

From b282cd9f5a828eae3f353a74827431d7173091f9 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Wed, 22 Jul 2026 17:00:08 +0200
Subject: [PATCH 119/171] chore(main): release 1.766.1 (#10263)

* chore(main): release 1.766.1

* Apply automatic changes

---------

Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>
---
 CHANGELOG.md                                  |   7 +
 backend/Cargo.lock                            | 158 +++++++++---------
 backend/Cargo.toml                            |   4 +-
 .../parsers/windmill-parser-wasm/Cargo.lock   |  48 +++---
 .../parsers/windmill-parser-wasm/Cargo.toml   |   2 +-
 backend/windmill-api/openapi.yaml             |   2 +-
 benchmarks/lib.ts                             |   2 +-
 cli/src/core/constants.ts                     |   2 +-
 frontend/package-lock.json                    |   4 +-
 frontend/package.json                         |   2 +-
 lsp/Pipfile                                   |   2 +-
 openflow.openapi.yaml                         |   2 +-
 .../WindmillClient/WindmillClient.psd1        |   2 +-
 python-client/wmill/pyproject.toml            |   2 +-
 typescript-client/jsr.json                    |   2 +-
 typescript-client/package.json                |   2 +-
 version.txt                                   |   2 +-
 17 files changed, 126 insertions(+), 119 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f8de1d03a3..5ad354449f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.766.1](https://github.com/windmill-labs/windmill/compare/v1.766.0...v1.766.1) (2026-07-22)
+
+
+### Bug Fixes
+
+* **jobs:** enforce self_approval_disabled on the UI resume path ([#10262](https://github.com/windmill-labs/windmill/issues/10262)) ([2d24b3a](https://github.com/windmill-labs/windmill/commit/2d24b3ac49b65469072bca929730d2c9ecd54b8f))
+
 ## [1.766.0](https://github.com/windmill-labs/windmill/compare/v1.765.0...v1.766.0) (2026-07-22)
 
 
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index 5e64afb62d..fad8a28afa 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -14479,7 +14479,7 @@ dependencies = [
 
 [[package]]
 name = "windmill"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -14564,7 +14564,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-ai"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "async-stream",
  "async-trait",
@@ -14597,7 +14597,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-alerting"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14610,7 +14610,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "argon2",
@@ -14749,7 +14749,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-agent-workers"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14772,7 +14772,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-assets"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14787,7 +14787,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-auth"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14813,7 +14813,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "reqwest 0.12.28",
  "serde",
@@ -14823,7 +14823,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-configs"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14840,7 +14840,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-debug"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "axum 0.8.9",
  "base64 0.22.1",
@@ -14862,7 +14862,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-embeddings"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14885,7 +14885,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flow-conversations"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14901,7 +14901,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flows"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14922,7 +14922,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-groups"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14943,7 +14943,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-inputs"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14957,7 +14957,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-integration-tests"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -14992,7 +14992,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-jobs"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15017,7 +15017,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-npm-proxy"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "axum 0.8.9",
  "flate2",
@@ -15035,7 +15035,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-openapi"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15057,7 +15057,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-schedule"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15077,7 +15077,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-scripts"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15114,7 +15114,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-settings"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15142,7 +15142,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-sse"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "lazy_static",
  "serde",
@@ -15154,7 +15154,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-users"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "argon2",
  "axum 0.8.9",
@@ -15179,7 +15179,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workers"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15193,7 +15193,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workspaces"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15228,7 +15228,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -15242,7 +15242,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15261,7 +15261,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "aes-gcm",
  "aho-corasick",
@@ -15364,7 +15364,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-dep-map"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "chrono",
  "itertools 0.14.0",
@@ -15383,7 +15383,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "regex",
  "serde",
@@ -15398,7 +15398,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "astral-tokio-tar",
@@ -15422,7 +15422,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-jseval"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "futures",
@@ -15439,7 +15439,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -15455,7 +15455,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-mcp"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15476,7 +15476,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-native-triggers"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15507,7 +15507,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-oauth"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "arc-swap",
@@ -15532,7 +15532,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-object-store"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "async-stream",
@@ -15566,7 +15566,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-operator"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "futures",
@@ -15584,7 +15584,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -15593,7 +15593,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15605,7 +15605,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15617,7 +15617,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -15629,7 +15629,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15641,7 +15641,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15653,7 +15653,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -15664,7 +15664,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15675,7 +15675,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15687,7 +15687,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -15698,7 +15698,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15720,7 +15720,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15732,7 +15732,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15746,7 +15746,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -15763,7 +15763,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15776,7 +15776,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "serde",
@@ -15788,7 +15788,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15806,7 +15806,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -15822,7 +15822,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -15838,7 +15838,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "serde",
@@ -15849,7 +15849,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15888,7 +15888,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-runtime-nativets"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "const_format",
@@ -15928,7 +15928,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "getrandom 0.3.4",
  "wasm-bindgen",
@@ -15939,7 +15939,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-store"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15973,7 +15973,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-test-utils"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15997,7 +15997,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16030,7 +16030,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-amqp"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16057,7 +16057,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-azure"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16090,7 +16090,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-email"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16110,7 +16110,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-gcp"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16144,7 +16144,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-http"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16180,7 +16180,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-kafka"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16203,7 +16203,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-mqtt"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16227,7 +16227,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-nats"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -16251,7 +16251,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-postgres"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16286,7 +16286,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-sqs"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16314,7 +16314,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-websocket"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16339,7 +16339,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "bitflags 2.13.1",
@@ -16358,7 +16358,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "async-once-cell",
@@ -16472,7 +16472,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker-volumes"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "bytes",
  "futures",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 3bf98a6632..aeecb11d60 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.766.0"
+version = "1.766.1"
 authors.workspace = true
 edition.workspace = true
 
@@ -88,7 +88,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal", "./parsers/windmill-parser-wasm"]
 
 [workspace.package]
-version = "1.766.0"
+version = "1.766.1"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.lock b/backend/parsers/windmill-parser-wasm/Cargo.lock
index d12f08e467..e707e6c416 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.lock
+++ b/backend/parsers/windmill-parser-wasm/Cargo.lock
@@ -6191,7 +6191,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill-common"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "aho-corasick",
  "anyhow",
@@ -6272,7 +6272,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -6284,7 +6284,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "convert_case",
  "serde",
@@ -6293,7 +6293,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6305,7 +6305,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6317,7 +6317,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -6329,7 +6329,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6341,7 +6341,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6353,7 +6353,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -6364,7 +6364,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6375,7 +6375,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6387,7 +6387,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6398,7 +6398,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -6420,7 +6420,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6432,7 +6432,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6446,7 +6446,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "convert_case",
@@ -6463,7 +6463,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6476,7 +6476,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "serde",
@@ -6488,7 +6488,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6506,7 +6506,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -6522,7 +6522,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6538,7 +6538,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wasm"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "getrandom 0.2.17",
@@ -6570,7 +6570,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "serde",
@@ -6581,7 +6581,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.766.0"
+version = "1.766.1"
 dependencies = [
  "anyhow",
  "bitflags",
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.toml b/backend/parsers/windmill-parser-wasm/Cargo.toml
index f19a51e9ac..fee0a65bef 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.toml
+++ b/backend/parsers/windmill-parser-wasm/Cargo.toml
@@ -12,7 +12,7 @@ resolver = "2"
 members = ["."]
 
 [workspace.package]
-version = "1.766.0"
+version = "1.766.1"
 edition = "2021"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 7be0240614..363984a1a4 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.766.0
+  version: 1.766.1
   title: Windmill API
 
   contact:
diff --git a/benchmarks/lib.ts b/benchmarks/lib.ts
index ef78450f2c..7a111dadd0 100644
--- a/benchmarks/lib.ts
+++ b/benchmarks/lib.ts
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.766.0";
+export const VERSION = "v1.766.1";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({
diff --git a/cli/src/core/constants.ts b/cli/src/core/constants.ts
index dd19e76641..51f3823e90 100644
--- a/cli/src/core/constants.ts
+++ b/cli/src/core/constants.ts
@@ -10,4 +10,4 @@ export const WM_FORK_PREFIX = "wm-fork";
 // (e.g. utils.ts) can read it without importing main.ts and creating a circular
 // dependency (main → workspace → utils → main) that triggers a TDZ.
 // Re-exported from main.ts for backwards compatibility.
-export const VERSION = "1.766.0";
+export const VERSION = "1.766.1";
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index a3ea464095..503858e3a5 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.766.0",
+	"version": "1.766.1",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "@windmill-labs/components",
-			"version": "1.766.0",
+			"version": "1.766.1",
 			"hasInstallScript": true,
 			"license": "AGPL-3.0",
 			"dependencies": {
diff --git a/frontend/package.json b/frontend/package.json
index f7a86272a0..c8b7c46f53 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.766.0",
+	"version": "1.766.1",
 	"scripts": {
 		"dev": "vite dev",
 		"dev:ui-builder": "mv static/ui_builder static/ui_builder.dev-disabled 2>/dev/null || true ; trap 'mv static/ui_builder.dev-disabled static/ui_builder 2>/dev/null || true' EXIT ; vite dev",
diff --git a/lsp/Pipfile b/lsp/Pipfile
index 3404fcf8f2..fecdd9c6e8 100644
--- a/lsp/Pipfile
+++ b/lsp/Pipfile
@@ -4,7 +4,7 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-wmill = ">=1.766.0"
+wmill = ">=1.766.1"
 sendgrid = "*"
 mysql-connector-python = "*"
 pymongo = "*"
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index be5fe3b495..b8586b1786 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1,7 +1,7 @@
 openapi: '3.0.3'
 
 info:
-  version: 1.766.0
+  version: 1.766.1
   title: OpenFlow Spec
   contact:
     name: Ruben Fiszel
diff --git a/powershell-client/WindmillClient/WindmillClient.psd1 b/powershell-client/WindmillClient/WindmillClient.psd1
index 3c771d33a9..f464e95706 100644
--- a/powershell-client/WindmillClient/WindmillClient.psd1
+++ b/powershell-client/WindmillClient/WindmillClient.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'WindmillClient.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '1.766.0'
+    ModuleVersion     = '1.766.1'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()
diff --git a/python-client/wmill/pyproject.toml b/python-client/wmill/pyproject.toml
index 082615b69b..389f5f16f7 100644
--- a/python-client/wmill/pyproject.toml
+++ b/python-client/wmill/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill"
-version = "1.766.0"
+version = "1.766.1"
 description = "A client library for accessing Windmill server wrapping the Windmill client API"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/typescript-client/jsr.json b/typescript-client/jsr.json
index 430ae8ce42..584571a5e7 100644
--- a/typescript-client/jsr.json
+++ b/typescript-client/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@windmill/windmill",
-  "version": "1.766.0",
+  "version": "1.766.1",
   "exports": "./src/index.ts",
   "publish": {
     "exclude": ["!src", "./s3Types.ts", "./sqlUtils.ts", "./client.ts"]
diff --git a/typescript-client/package.json b/typescript-client/package.json
index e4096121ba..95fb3c97fa 100644
--- a/typescript-client/package.json
+++ b/typescript-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.766.0",
+  "version": "1.766.1",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "homepage": "https://github.com/windmill-labs/windmill/tree/main/typescript-client#readme",
diff --git a/version.txt b/version.txt
index 3a15667017..d53aa1e733 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.766.0
+1.766.1

From 7e2f1afffb4982099870e7ce32592cf3a447e513 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Wed, 22 Jul 2026 22:42:35 +0200
Subject: [PATCH 120/171] fix(python,windows): cross-platform cross-process
 wheel-install lock (#10264)

* fix(python,windows): cross-platform cross-process wheel-install lock

The advisory lock that serializes concurrent uv installs into a shared
Python wheel-cache dir was gated `#[cfg(unix)]` and used `nix::fcntl::flock`
directly, so on Windows there was no cross-process serialization at all.
Multiple agents running as services on one Windows host share a single
per-user cache dir (`.../Temp/windmill/cache/python_<v>/`); when several jobs
install the same package at once their uv processes clobber each other's
atomic renames, surfacing as "no .dist-info directory", "RECORD ... cannot
find the file specified", and "failed to rename ... os error 2" install
failures.

Replace the unix-only flock with `fs4`'s cross-platform advisory lock
(flock on unix, LockFileEx on windows). Unix behavior is unchanged (same
flock syscall, whole-file, released on handle close/process death); Windows
now gets a real per-package cross-process lock so co-located agents serialize
their installs instead of corrupting the shared cache.

Fixes WIN-2225

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore(worker): drop now-unused nix `fs` feature

The `fs` feature was only pulled in for `nix::fcntl::flock`, which the
previous commit replaced with `fs4`. Remaining nix usages need only
`user` (plus the workspace-inherited `process`/`signal`).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 backend/Cargo.lock                            |  1 +
 backend/Cargo.toml                            |  1 +
 backend/windmill-worker/Cargo.toml            |  6 ++-
 .../windmill-worker/src/python_executor.rs    | 51 ++++++++++---------
 4 files changed, 34 insertions(+), 25 deletions(-)

diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index fad8a28afa..f1966eb6e8 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -16378,6 +16378,7 @@ dependencies = [
  "dotenv",
  "eventsource-stream",
  "flume",
+ "fs4",
  "futures",
  "gcp_auth",
  "git-version",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index aeecb11d60..683be6972d 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -588,6 +588,7 @@ rust_decimal = { version = "^1", features = ["db-postgres", "serde-float"]}
 jsonwebtoken = "8.3.0"
 pem = "3.0.1"
 nix = { version = "0.27.1", features = ["process", "signal"] }
+fs4 = "0.13"
 tinyvector = { git = "https://github.com/windmill-labs/tinyvector", rev = "20823b94c20f2b9093f318badd24026cf54dcc85" }
 hf-hub = "0.4.3"
 tokenizers = "0.14.1"
diff --git a/backend/windmill-worker/Cargo.toml b/backend/windmill-worker/Cargo.toml
index bdc6ec49d6..99647ba81f 100644
--- a/backend/windmill-worker/Cargo.toml
+++ b/backend/windmill-worker/Cargo.toml
@@ -115,9 +115,11 @@ hmac.workspace = true
 pem = { workspace = true, optional = true }
 rsa = { workspace = true, optional = true }
 urlencoding.workspace = true
-# `fs` adds flock(2) for the cross-process Python install lock (shared cache mounts);
 # `user` adds geteuid(2) to verify ownership of the ansible socket-dir root
-nix = { workspace = true, features = ["fs", "user"] }
+nix = { workspace = true, features = ["user"] }
+# Cross-platform advisory file lock (flock on unix, LockFileEx on windows) for the
+# cross-process Python install lock into shared wheel-cache dirs.
+fs4 = { workspace = true }
 bytes.workspace = true
 reqwest.workspace = true
 reqwest-middleware.workspace = true
diff --git a/backend/windmill-worker/src/python_executor.rs b/backend/windmill-worker/src/python_executor.rs
index a3ae036894..13e3749fbd 100644
--- a/backend/windmill-worker/src/python_executor.rs
+++ b/backend/windmill-worker/src/python_executor.rs
@@ -2832,11 +2832,12 @@ pub async fn handle_python_reqs(
             };
 
             // Cross-process advisory lock. Best-effort: if the filesystem doesn't
-            // support flock we log and proceed — verify_wheel_record + job retry
-            // still guard correctness, just without the dedup.
-            #[cfg(unix)]
+            // support locking we log and proceed — verify_wheel_record + job retry
+            // still guard correctness, just without the dedup. Cross-platform
+            // (flock on unix, LockFileEx on windows) so agents sharing a wheel-cache
+            // dir on a Windows host serialize just as they do on unix.
             let _venv_file_lock: Option<std::fs::File> = {
-                use std::os::unix::io::AsRawFd;
+                use fs4::fs_std::FileExt;
                 let lock_path = format!("{venv_p}.lock");
                 if let Some(parent) = std::path::Path::new(&lock_path).parent() {
                     let _ = std::fs::create_dir_all(parent);
@@ -2844,17 +2845,17 @@ pub async fn handle_python_reqs(
                 match std::fs::OpenOptions::new().create(true).write(true).open(&lock_path) {
                     Ok(f) => {
                         // Bounded wait: a holder that crashes releases the lock (the
-                        // kernel drops it on fd close), but a live-but-stuck holder
+                        // OS drops it on handle close), but a live-but-stuck holder
                         // (e.g. uv wedged on a hung mount) would otherwise block us
                         // forever. After the cap, proceed degraded rather than hang —
                         // verify_wheel_record + retry still guard correctness.
                         const MAX_WAIT: std::time::Duration = std::time::Duration::from_secs(300);
                         let waited_since = std::time::Instant::now();
                         loop {
-                            match nix::fcntl::flock(f.as_raw_fd(), nix::fcntl::FlockArg::LockExclusiveNonblock) {
-                                Ok(()) => break Some(f),
-                                // EWOULDBLOCK == EAGAIN on Linux: another holder has the lock.
-                                Err(nix::errno::Errno::EWOULDBLOCK) => {
+                            match f.try_lock_exclusive() {
+                                Ok(true) => break Some(f),
+                                // Another holder has the lock.
+                                Ok(false) => {
                                     if waited_since.elapsed() >= MAX_WAIT {
                                         tracing::warn!(
                                             workspace_id = %w_id,
@@ -2876,7 +2877,7 @@ pub async fn handle_python_reqs(
                                 Err(e) => {
                                     tracing::warn!(
                                         workspace_id = %w_id,
-                                        "could not flock {lock_path}, proceeding without cross-process install lock: {e}"
+                                        "could not lock {lock_path}, proceeding without cross-process install lock: {e}"
                                     );
                                     break Some(f);
                                 }
@@ -3782,14 +3783,14 @@ mod tests {
         );
     }
 
-    #[cfg(unix)]
     #[tokio::test]
     async fn test_venv_file_lock_excludes_across_descriptions() {
-        // The cross-process layer: flock on a sibling `.lock` excludes a second
-        // independent open file description (i.e. another worker process) while
-        // held, and frees it on close. Mirrors the loop in handle_python_reqs.
-        use nix::fcntl::{flock, FlockArg};
-        use std::os::unix::io::AsRawFd;
+        // The cross-process layer: an advisory lock on a sibling `.lock` excludes a
+        // second independent open file handle (i.e. another worker process) while
+        // held, and frees it on close. Mirrors the loop in handle_python_reqs and
+        // must hold on every platform (flock on unix, LockFileEx on windows) — a
+        // Windows host running several agents against one wheel cache relies on it.
+        use fs4::fs_std::FileExt;
 
         let dir = std::env::temp_dir().join("wm_venv_lock_test");
         std::fs::create_dir_all(&dir).unwrap();
@@ -3800,24 +3801,28 @@ mod tests {
             .write(true)
             .open(&lock_path)
             .unwrap();
-        flock(f1.as_raw_fd(), FlockArg::LockExclusiveNonblock).unwrap();
+        assert!(
+            f1.try_lock_exclusive().unwrap(),
+            "first holder must acquire the lock"
+        );
 
-        // A second descriptor (stand-in for another process) cannot take it.
+        // A second handle (stand-in for another process) cannot take it.
         let f2 = std::fs::OpenOptions::new()
             .create(true)
             .write(true)
             .open(&lock_path)
             .unwrap();
-        assert_eq!(
-            flock(f2.as_raw_fd(), FlockArg::LockExclusiveNonblock),
-            Err(nix::errno::Errno::EWOULDBLOCK),
+        assert!(
+            !f2.try_lock_exclusive().unwrap(),
             "a second holder must be blocked while the lock is held"
         );
 
         // Releasing the first lets the second acquire it.
         drop(f1);
-        flock(f2.as_raw_fd(), FlockArg::LockExclusiveNonblock)
-            .expect("lock must be acquirable once the holder releases it");
+        assert!(
+            f2.try_lock_exclusive().unwrap(),
+            "lock must be acquirable once the holder releases it"
+        );
 
         drop(f2);
         let _ = std::fs::remove_file(&lock_path);

From abd659925df94db99546ba81e7c3f65bd9e4943f Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Wed, 22 Jul 2026 22:47:34 +0200
Subject: [PATCH 121/171] chore(main): release 1.766.2 (#10265)

* chore(main): release 1.766.2

* Apply automatic changes

---------

Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>
---
 CHANGELOG.md                                  |   7 +
 backend/Cargo.lock                            | 158 +++++++++---------
 backend/Cargo.toml                            |   4 +-
 .../parsers/windmill-parser-wasm/Cargo.lock   |  48 +++---
 .../parsers/windmill-parser-wasm/Cargo.toml   |   2 +-
 backend/windmill-api/openapi.yaml             |   2 +-
 benchmarks/lib.ts                             |   2 +-
 cli/src/core/constants.ts                     |   2 +-
 frontend/package-lock.json                    |   4 +-
 frontend/package.json                         |   2 +-
 lsp/Pipfile                                   |   2 +-
 openflow.openapi.yaml                         |   2 +-
 .../WindmillClient/WindmillClient.psd1        |   2 +-
 python-client/wmill/pyproject.toml            |   2 +-
 typescript-client/jsr.json                    |   2 +-
 typescript-client/package.json                |   2 +-
 version.txt                                   |   2 +-
 17 files changed, 126 insertions(+), 119 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5ad354449f..5f0d9b7d28 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.766.2](https://github.com/windmill-labs/windmill/compare/v1.766.1...v1.766.2) (2026-07-22)
+
+
+### Bug Fixes
+
+* **python,windows:** cross-platform cross-process wheel-install lock ([#10264](https://github.com/windmill-labs/windmill/issues/10264)) ([7e2f1af](https://github.com/windmill-labs/windmill/commit/7e2f1afffb4982099870e7ce32592cf3a447e513))
+
 ## [1.766.1](https://github.com/windmill-labs/windmill/compare/v1.766.0...v1.766.1) (2026-07-22)
 
 
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index f1966eb6e8..d4e181ff52 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -14479,7 +14479,7 @@ dependencies = [
 
 [[package]]
 name = "windmill"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -14564,7 +14564,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-ai"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "async-stream",
  "async-trait",
@@ -14597,7 +14597,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-alerting"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14610,7 +14610,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "argon2",
@@ -14749,7 +14749,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-agent-workers"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14772,7 +14772,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-assets"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14787,7 +14787,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-auth"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14813,7 +14813,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "reqwest 0.12.28",
  "serde",
@@ -14823,7 +14823,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-configs"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14840,7 +14840,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-debug"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "axum 0.8.9",
  "base64 0.22.1",
@@ -14862,7 +14862,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-embeddings"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14885,7 +14885,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flow-conversations"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14901,7 +14901,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flows"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14922,7 +14922,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-groups"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14943,7 +14943,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-inputs"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14957,7 +14957,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-integration-tests"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -14992,7 +14992,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-jobs"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15017,7 +15017,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-npm-proxy"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "axum 0.8.9",
  "flate2",
@@ -15035,7 +15035,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-openapi"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15057,7 +15057,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-schedule"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15077,7 +15077,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-scripts"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15114,7 +15114,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-settings"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15142,7 +15142,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-sse"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "lazy_static",
  "serde",
@@ -15154,7 +15154,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-users"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "argon2",
  "axum 0.8.9",
@@ -15179,7 +15179,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workers"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15193,7 +15193,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workspaces"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15228,7 +15228,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -15242,7 +15242,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15261,7 +15261,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "aes-gcm",
  "aho-corasick",
@@ -15364,7 +15364,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-dep-map"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "chrono",
  "itertools 0.14.0",
@@ -15383,7 +15383,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "regex",
  "serde",
@@ -15398,7 +15398,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "astral-tokio-tar",
@@ -15422,7 +15422,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-jseval"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "futures",
@@ -15439,7 +15439,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -15455,7 +15455,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-mcp"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15476,7 +15476,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-native-triggers"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15507,7 +15507,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-oauth"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "arc-swap",
@@ -15532,7 +15532,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-object-store"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "async-stream",
@@ -15566,7 +15566,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-operator"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "futures",
@@ -15584,7 +15584,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -15593,7 +15593,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15605,7 +15605,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15617,7 +15617,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -15629,7 +15629,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15641,7 +15641,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15653,7 +15653,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -15664,7 +15664,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15675,7 +15675,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15687,7 +15687,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -15698,7 +15698,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15720,7 +15720,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15732,7 +15732,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15746,7 +15746,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -15763,7 +15763,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15776,7 +15776,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "serde",
@@ -15788,7 +15788,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15806,7 +15806,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -15822,7 +15822,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -15838,7 +15838,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "serde",
@@ -15849,7 +15849,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15888,7 +15888,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-runtime-nativets"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "const_format",
@@ -15928,7 +15928,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "getrandom 0.3.4",
  "wasm-bindgen",
@@ -15939,7 +15939,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-store"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15973,7 +15973,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-test-utils"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15997,7 +15997,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16030,7 +16030,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-amqp"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16057,7 +16057,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-azure"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16090,7 +16090,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-email"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16110,7 +16110,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-gcp"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16144,7 +16144,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-http"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16180,7 +16180,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-kafka"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16203,7 +16203,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-mqtt"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16227,7 +16227,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-nats"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -16251,7 +16251,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-postgres"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16286,7 +16286,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-sqs"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16314,7 +16314,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-websocket"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16339,7 +16339,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "bitflags 2.13.1",
@@ -16358,7 +16358,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "async-once-cell",
@@ -16473,7 +16473,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker-volumes"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "bytes",
  "futures",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 683be6972d..d5f94be93d 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.766.1"
+version = "1.766.2"
 authors.workspace = true
 edition.workspace = true
 
@@ -88,7 +88,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal", "./parsers/windmill-parser-wasm"]
 
 [workspace.package]
-version = "1.766.1"
+version = "1.766.2"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.lock b/backend/parsers/windmill-parser-wasm/Cargo.lock
index e707e6c416..0e05880c5b 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.lock
+++ b/backend/parsers/windmill-parser-wasm/Cargo.lock
@@ -6191,7 +6191,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill-common"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "aho-corasick",
  "anyhow",
@@ -6272,7 +6272,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -6284,7 +6284,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "convert_case",
  "serde",
@@ -6293,7 +6293,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6305,7 +6305,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6317,7 +6317,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -6329,7 +6329,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6341,7 +6341,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6353,7 +6353,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -6364,7 +6364,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6375,7 +6375,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6387,7 +6387,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6398,7 +6398,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -6420,7 +6420,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6432,7 +6432,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6446,7 +6446,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "convert_case",
@@ -6463,7 +6463,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6476,7 +6476,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "serde",
@@ -6488,7 +6488,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6506,7 +6506,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -6522,7 +6522,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6538,7 +6538,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wasm"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "getrandom 0.2.17",
@@ -6570,7 +6570,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "serde",
@@ -6581,7 +6581,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.766.1"
+version = "1.766.2"
 dependencies = [
  "anyhow",
  "bitflags",
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.toml b/backend/parsers/windmill-parser-wasm/Cargo.toml
index fee0a65bef..097057f582 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.toml
+++ b/backend/parsers/windmill-parser-wasm/Cargo.toml
@@ -12,7 +12,7 @@ resolver = "2"
 members = ["."]
 
 [workspace.package]
-version = "1.766.1"
+version = "1.766.2"
 edition = "2021"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 363984a1a4..9d81252f06 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.766.1
+  version: 1.766.2
   title: Windmill API
 
   contact:
diff --git a/benchmarks/lib.ts b/benchmarks/lib.ts
index 7a111dadd0..f3c0b9ef2e 100644
--- a/benchmarks/lib.ts
+++ b/benchmarks/lib.ts
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.766.1";
+export const VERSION = "v1.766.2";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({
diff --git a/cli/src/core/constants.ts b/cli/src/core/constants.ts
index 51f3823e90..52efabe215 100644
--- a/cli/src/core/constants.ts
+++ b/cli/src/core/constants.ts
@@ -10,4 +10,4 @@ export const WM_FORK_PREFIX = "wm-fork";
 // (e.g. utils.ts) can read it without importing main.ts and creating a circular
 // dependency (main → workspace → utils → main) that triggers a TDZ.
 // Re-exported from main.ts for backwards compatibility.
-export const VERSION = "1.766.1";
+export const VERSION = "1.766.2";
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 503858e3a5..38b1a4bae3 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.766.1",
+	"version": "1.766.2",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "@windmill-labs/components",
-			"version": "1.766.1",
+			"version": "1.766.2",
 			"hasInstallScript": true,
 			"license": "AGPL-3.0",
 			"dependencies": {
diff --git a/frontend/package.json b/frontend/package.json
index c8b7c46f53..f322f9efe4 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.766.1",
+	"version": "1.766.2",
 	"scripts": {
 		"dev": "vite dev",
 		"dev:ui-builder": "mv static/ui_builder static/ui_builder.dev-disabled 2>/dev/null || true ; trap 'mv static/ui_builder.dev-disabled static/ui_builder 2>/dev/null || true' EXIT ; vite dev",
diff --git a/lsp/Pipfile b/lsp/Pipfile
index fecdd9c6e8..02ee4c0626 100644
--- a/lsp/Pipfile
+++ b/lsp/Pipfile
@@ -4,7 +4,7 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-wmill = ">=1.766.1"
+wmill = ">=1.766.2"
 sendgrid = "*"
 mysql-connector-python = "*"
 pymongo = "*"
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index b8586b1786..46727bb8cf 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1,7 +1,7 @@
 openapi: '3.0.3'
 
 info:
-  version: 1.766.1
+  version: 1.766.2
   title: OpenFlow Spec
   contact:
     name: Ruben Fiszel
diff --git a/powershell-client/WindmillClient/WindmillClient.psd1 b/powershell-client/WindmillClient/WindmillClient.psd1
index f464e95706..2ff2fb69c0 100644
--- a/powershell-client/WindmillClient/WindmillClient.psd1
+++ b/powershell-client/WindmillClient/WindmillClient.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'WindmillClient.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '1.766.1'
+    ModuleVersion     = '1.766.2'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()
diff --git a/python-client/wmill/pyproject.toml b/python-client/wmill/pyproject.toml
index 389f5f16f7..2d95e9e12d 100644
--- a/python-client/wmill/pyproject.toml
+++ b/python-client/wmill/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill"
-version = "1.766.1"
+version = "1.766.2"
 description = "A client library for accessing Windmill server wrapping the Windmill client API"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/typescript-client/jsr.json b/typescript-client/jsr.json
index 584571a5e7..7cfeaf3549 100644
--- a/typescript-client/jsr.json
+++ b/typescript-client/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@windmill/windmill",
-  "version": "1.766.1",
+  "version": "1.766.2",
   "exports": "./src/index.ts",
   "publish": {
     "exclude": ["!src", "./s3Types.ts", "./sqlUtils.ts", "./client.ts"]
diff --git a/typescript-client/package.json b/typescript-client/package.json
index 95fb3c97fa..109c56e36b 100644
--- a/typescript-client/package.json
+++ b/typescript-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.766.1",
+  "version": "1.766.2",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "homepage": "https://github.com/windmill-labs/windmill/tree/main/typescript-client#readme",
diff --git a/version.txt b/version.txt
index d53aa1e733..ad7d31ec90 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.766.1
+1.766.2

From 2318481f4f2932dc578d5cb64c4c705cf5c324a0 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Wed, 22 Jul 2026 23:36:28 +0200
Subject: [PATCH 122/171] fix(embeddings): retry on failed init instead of
 disabling for a day (#10266)

* fix(embeddings): retry on failed init instead of disabling for a day

The embeddings init task treated failure and success identically, so a
transient error at startup left the embeddings DB uninitialized and every
/query_hub_scripts and /query_resource_types call returned "Embeddings db
not initialized":

- If ModelInstance::new() failed (a transient HuggingFace/network error
  surviving its own 5 download retries), the spawned task exited for good
  and embeddings never came up until the next process restart.
- If update_embeddings_db (hub fetch + fill_db) failed, the refresh loop
  still slept the full HUB_EMBEDDINGS_PULLING_INTERVAL_SECS (default 24h)
  before retrying.

Wrap model init in a retry loop, and make update_embeddings_db report
success so the refresh loop backs off by HUB_EMBEDDINGS_RETRY_INTERVAL_SECS
(default 60s, env-configurable) on failure instead of the full pulling
interval.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(embeddings): bound retry backoff to pulling interval

A fixed 60s retry loop was fine for the transient case but spun forever in
an environment where init can never succeed (air-gapped instance with
embeddings left enabled): an error log + HuggingFace fetch storm every ~60s
indefinitely, a behavior regression versus failing once and going quiet.

Decay the retry with exponential backoff capped at
HUB_EMBEDDINGS_PULLING_INTERVAL_SECS, resetting on success. A transient
blip still recovers within ~60s; a permanently-broken env settles into ~1
attempt per pulling interval (default: 1/day).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 backend/windmill-api-embeddings/src/lib.rs | 63 ++++++++++++++++------
 1 file changed, 46 insertions(+), 17 deletions(-)

diff --git a/backend/windmill-api-embeddings/src/lib.rs b/backend/windmill-api-embeddings/src/lib.rs
index 016e72be91..439de86fbb 100644
--- a/backend/windmill-api-embeddings/src/lib.rs
+++ b/backend/windmill-api-embeddings/src/lib.rs
@@ -56,6 +56,10 @@ lazy_static::lazy_static! {
     pub static ref EMBEDDINGS_DB: Arc<RwLock<Option<EmbeddingsDb>>> = Arc::new(RwLock::new(None));
     pub static ref MODEL_INSTANCE: Arc<RwLock<Option<Arc<ModelInstance>>>> = Arc::new(RwLock::new(None));
     pub static ref HUB_EMBEDDINGS_PULLING_INTERVAL_SECS: u64 = std::env::var("HUB_EMBEDDINGS_PULLING_INTERVAL_SECS").ok().map(|x| x.parse::<u64>().ok()).flatten().unwrap_or(3600 * 24);
+    // On a failed init/refresh we retry after this short interval instead of the
+    // full pulling interval, so a transient startup error doesn't leave the
+    // embeddings DB uninitialized for a whole day.
+    pub static ref HUB_EMBEDDINGS_RETRY_INTERVAL_SECS: u64 = std::env::var("HUB_EMBEDDINGS_RETRY_INTERVAL_SECS").ok().map(|x| x.parse::<u64>().ok()).flatten().unwrap_or(60);
 }
 
 #[cfg(feature = "embedding")]
@@ -601,42 +605,67 @@ pub fn load_embeddings_db(db: &Pool<Postgres>) -> () {
     if !disable_embedding {
         let db_clone = db.clone();
         tokio::spawn(async move {
-            let model_instance = ModelInstance::new().await;
-            if let Ok(model_instance) = model_instance {
-                let mut model_instance_lock = MODEL_INSTANCE.write().await;
-                *model_instance_lock = Some(Arc::new(model_instance));
-                drop(model_instance_lock);
-                loop {
-                    update_embeddings_db(&db_clone).await;
-                    tokio::time::sleep(std::time::Duration::from_secs(
-                        *HUB_EMBEDDINGS_PULLING_INTERVAL_SECS,
-                    ))
-                    .await;
+            // Keep retrying model init: a transient failure here must not
+            // permanently disable embeddings until the next process restart.
+            // Backoff decays to the pulling interval so an environment where it
+            // can never succeed (e.g. air-gapped, embeddings left enabled)
+            // settles into ~1 attempt/interval rather than a tight error loop.
+            let mut backoff_secs = *HUB_EMBEDDINGS_RETRY_INTERVAL_SECS;
+            loop {
+                match ModelInstance::new().await {
+                    Ok(model_instance) => {
+                        let mut model_instance_lock = MODEL_INSTANCE.write().await;
+                        *model_instance_lock = Some(Arc::new(model_instance));
+                        break;
+                    }
+                    Err(e) => {
+                        tracing::error!(
+                            "Failed to initialize model instance: {}. Retrying in {}s...",
+                            e,
+                            backoff_secs
+                        );
+                        tokio::time::sleep(std::time::Duration::from_secs(backoff_secs)).await;
+                        backoff_secs = backoff_secs
+                            .saturating_mul(2)
+                            .min(*HUB_EMBEDDINGS_PULLING_INTERVAL_SECS);
+                    }
                 }
-            } else {
-                tracing::error!(
-                    "Failed to initialize model instance: {}",
-                    model_instance.err().unwrap()
-                );
+            }
+            let mut backoff_secs = *HUB_EMBEDDINGS_RETRY_INTERVAL_SECS;
+            loop {
+                let sleep_secs = if update_embeddings_db(&db_clone).await {
+                    backoff_secs = *HUB_EMBEDDINGS_RETRY_INTERVAL_SECS;
+                    *HUB_EMBEDDINGS_PULLING_INTERVAL_SECS
+                } else {
+                    let secs = backoff_secs;
+                    backoff_secs = backoff_secs
+                        .saturating_mul(2)
+                        .min(*HUB_EMBEDDINGS_PULLING_INTERVAL_SECS);
+                    secs
+                };
+                tokio::time::sleep(std::time::Duration::from_secs(sleep_secs)).await;
             }
         });
     }
 }
 
 #[cfg(feature = "embedding")]
-pub async fn update_embeddings_db(db: &Pool<Postgres>) -> () {
+pub async fn update_embeddings_db(db: &Pool<Postgres>) -> bool {
     if let Some(model_instance) = MODEL_INSTANCE.read().await.as_ref() {
         tracing::info!("Creating embeddings DB...");
         let new_embeddings_db = EmbeddingsDb::new(&db, model_instance.clone()).await;
         if let Err(e) = new_embeddings_db.as_ref() {
             tracing::error!("Failed to create embeddings db: {}", e);
+            false
         } else {
             let mut embeddings_db = EMBEDDINGS_DB.write().await;
             *embeddings_db = new_embeddings_db.ok();
             tracing::info!("Created embeddings DB");
+            true
         }
     } else {
         tracing::error!("Could not update embeddings DB, model instance not initialized");
+        false
     }
 }
 

From 07d4b674f1dbd24c89f7d1e77094a40e528a3740 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Thu, 23 Jul 2026 00:09:24 +0200
Subject: [PATCH 123/171] fix: manual resource type sync fetches from hub
 first, cache as fallback (#10269)

* fix: manual resource type sync fetches from hub first, cache as fallback

The superadmin "Synchronize resource types" endpoint
(POST /api/settings/sync_cached_resource_types) was cache-first: it read the
on-disk hub_rt cache and only fell back to the hub when no cache file existed.
Since that cache is refreshed by a daily cron, a newly-published hub type could
not be pulled on demand, the button replayed the stale cache and reported
"Synced 0", so the type never landed in the admins workspace.

The manual endpoint is now hub-first: it fetches the live list and upserts it
into admins, falling back to reading the on-disk cache only when the hub is
unreachable (airgapped install / network error), logging which path it took.
The startup/offline sync in main.rs (SYNC_CACHED_RT + the cache-rt cron) stays
cache-based and owns writing the cache, so this endpoint never touches it.

Adds an optional `name` query param: when a specific type is requested and is
still absent from the hub after syncing, the endpoint returns an explicit
not-found instead of a silent "Synced 0". The three not-found frontend call
sites (ResourceForm, AppConnectInner, ApiConnectForm) thread the type name
through SyncResourceTypes; the global instance-settings button stays name-less.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix: run whole-list sync before the targeted not-found check, word 404 by source

Address review nits: the optional `name` check ran before the upsert loop, so a
`?name=<absent>` request skipped the whole-list refresh; move it after the loop so
the sync always happens. Also word the not-found 404 by source, the cache-fallback
path (hub unreachable) no longer claims it checked the hub.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 backend/windmill-api-settings/src/lib.rs      | 63 ++++++++++++++++---
 .../src/lib/components/ApiConnectForm.svelte  |  2 +-
 .../src/lib/components/AppConnectInner.svelte |  2 +-
 .../src/lib/components/ResourceForm.svelte    |  2 +-
 .../lib/components/SyncResourceTypes.svelte   | 10 ++-
 5 files changed, 64 insertions(+), 15 deletions(-)

diff --git a/backend/windmill-api-settings/src/lib.rs b/backend/windmill-api-settings/src/lib.rs
index e02630b104..1fb070c2c9 100644
--- a/backend/windmill-api-settings/src/lib.rs
+++ b/backend/windmill-api-settings/src/lib.rs
@@ -32,11 +32,9 @@ use windmill_common::DB;
 use ee_oss::validate_license_key;
 use windmill_common::usernames::generate_instance_username_for_all_users;
 
-#[cfg(feature = "enterprise")]
-use axum::extract::Query;
 use axum::{
     body::Body,
-    extract::{Extension, Path},
+    extract::{Extension, Path, Query},
     response::Response,
     routing::{get, post},
     Json, Router,
@@ -1972,25 +1970,53 @@ async fn fetch_resource_types_from_hub() -> error::Result<Vec<CachedResourceType
         .collect())
 }
 
+#[derive(serde::Deserialize)]
+struct SyncResourceTypesQuery {
+    name: Option<String>,
+}
+
 async fn sync_cached_resource_types(
     Extension(db): Extension<DB>,
     authed: ApiAuthed,
+    Query(SyncResourceTypesQuery { name }): Query<SyncResourceTypesQuery>,
 ) -> error::Result<String> {
     require_super_admin(&db, &authed.email).await?;
 
     use windmill_common::worker::HUB_RT_CACHE_DIR;
     let cache_path = format!("{}/resource_types.json", *HUB_RT_CACHE_DIR);
 
-    let cached_types = match tokio::fs::read_to_string(&cache_path).await {
-        Ok(content) => serde_json::from_str::<Vec<CachedResourceType>>(&content).map_err(|e| {
-            error::Error::InternalErr(format!("Failed to parse cached resource types: {}", e))
-        })?,
-        Err(_) => fetch_resource_types_from_hub().await?,
+    // Manual sync is hub-first so it lands newly-published hub types on demand. The
+    // on-disk cache is only a fallback for when the hub is unreachable (airgapped
+    // installs / network error); refreshing it is left to the daily cache-rt cron and
+    // the startup sync in main.rs, which own the offline path.
+    let (resource_types, from_hub) = match fetch_resource_types_from_hub().await {
+        Ok(types) => {
+            tracing::info!("Fetched {} resource types live from the hub", types.len());
+            (types, true)
+        }
+        Err(hub_err) => {
+            tracing::warn!(
+                "Live hub fetch failed ({hub_err}), falling back to on-disk cache at {cache_path}"
+            );
+            match tokio::fs::read_to_string(&cache_path).await {
+                Ok(content) => {
+                    let parsed = serde_json::from_str::<Vec<CachedResourceType>>(&content)
+                        .map_err(|e| {
+                            error::Error::InternalErr(format!(
+                                "Failed to parse cached resource types: {}",
+                                e
+                            ))
+                        })?;
+                    (parsed, false)
+                }
+                Err(_) => return Err(hub_err),
+            }
+        }
     };
 
     let mut synced_count = 0;
 
-    for rt in &cached_types {
+    for rt in &resource_types {
         let exists: Option<bool> = sqlx::query_scalar!(
             "SELECT EXISTS(SELECT 1 FROM resource_type WHERE workspace_id = 'admins' AND name = $1 AND schema IS NOT DISTINCT FROM $2 AND description IS NOT DISTINCT FROM $3)",
             &rt.name,
@@ -2019,10 +2045,27 @@ async fn sync_cached_resource_types(
         synced_count += 1;
     }
 
+    // If a specific type was requested and is still absent after syncing, surface an
+    // explicit not-found instead of a silent "Synced 0". Word it by source so the
+    // cache-fallback path does not claim it checked the hub.
+    if let Some(name) = name.as_deref() {
+        if !resource_types.iter().any(|rt| rt.name == name) {
+            let source = if from_hub {
+                "on the hub"
+            } else {
+                "in the cached resource types (hub unreachable)"
+            };
+            return Err(error::Error::NotFound(format!(
+                "resource type '{}' not found {}",
+                name, source
+            )));
+        }
+    }
+
     Ok(format!(
         "Synced {} resource types ({} unchanged)",
         synced_count,
-        cached_types.len() - synced_count
+        resource_types.len() - synced_count
     ))
 }
 
diff --git a/frontend/src/lib/components/ApiConnectForm.svelte b/frontend/src/lib/components/ApiConnectForm.svelte
index dd02a3c578..c0a25daeb7 100644
--- a/frontend/src/lib/components/ApiConnectForm.svelte
+++ b/frontend/src/lib/components/ApiConnectForm.svelte
@@ -231,7 +231,7 @@
 		>No corresponding resource type found in your workspace for {resourceType}. Define the value in
 		JSON directly</p
 	>
-	<SyncResourceTypes {onSynced} />
+	<SyncResourceTypes {resourceType} {onSynced} />
 {/if}
 {#if notFound || viewJsonSchema}
 	{#if !emptyString(error)}<span class="text-red-400 text-xs mb-1 flex flex-row-reverse"
diff --git a/frontend/src/lib/components/AppConnectInner.svelte b/frontend/src/lib/components/AppConnectInner.svelte
index ef632f5738..de5bf45cd8 100644
--- a/frontend/src/lib/components/AppConnectInner.svelte
+++ b/frontend/src/lib/components/AppConnectInner.svelte
@@ -1075,7 +1075,7 @@
 					<p class="text-red-500 dark:text-red-400 text-xs">
 						Resource type '{resourceType}' not found in your workspace
 					</p>
-					<SyncResourceTypes onSynced={getResourceTypeInfo} />
+					<SyncResourceTypes {resourceType} onSynced={getResourceTypeInfo} />
 				</div>
 			{/if}
 			{#if registryCcCapable()}
diff --git a/frontend/src/lib/components/ResourceForm.svelte b/frontend/src/lib/components/ResourceForm.svelte
index ef226501b7..2c563a8e95 100644
--- a/frontend/src/lib/components/ResourceForm.svelte
+++ b/frontend/src/lib/components/ResourceForm.svelte
@@ -296,7 +296,7 @@
 					<p class="text-red-500 dark:text-red-400 text-xs">
 						Resource type '{resource_type}' not found in your workspace
 					</p>
-					<SyncResourceTypes onSynced={() => onLoadResourceType?.()} />
+					<SyncResourceTypes resourceType={resource_type} onSynced={() => onLoadResourceType?.()} />
 					<p class="italic text-secondary text-xs"> Define the value in JSON directly </p>
 				</div>
 			{/if}
diff --git a/frontend/src/lib/components/SyncResourceTypes.svelte b/frontend/src/lib/components/SyncResourceTypes.svelte
index dd343e43f6..acda8c0567 100644
--- a/frontend/src/lib/components/SyncResourceTypes.svelte
+++ b/frontend/src/lib/components/SyncResourceTypes.svelte
@@ -6,13 +6,19 @@
 
 	interface Props {
 		onSynced?: () => void
+		// When set, the endpoint returns an explicit not-found error if the hub does
+		// not know this type (the sync itself still refreshes the whole list).
+		resourceType?: string
 	}
 
-	let { onSynced = undefined }: Props = $props()
+	let { onSynced = undefined, resourceType = undefined }: Props = $props()
 
 	let hubRtSync = usePromise(
 		async () => {
-			const res = await fetch('/api/settings/sync_cached_resource_types', { method: 'POST' })
+			const url = resourceType
+				? `/api/settings/sync_cached_resource_types?name=${encodeURIComponent(resourceType)}`
+				: '/api/settings/sync_cached_resource_types'
+			const res = await fetch(url, { method: 'POST' })
 			if (!res.ok) {
 				const body = await res.text()
 				throw new Error(body || res.statusText)

From 0819641f3a89abdf114cc5e341a9f585e5d71296 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Thu, 23 Jul 2026 00:51:48 +0200
Subject: [PATCH 124/171] feat(ai): improve data-pipeline building in AI
 sessions (prompt + evals + e2e) (#10270)

* test(ai_evals): pipeline coverage for AI sessions + editor e2e

Add a complex incremental DuckLake pipeline case, harden the two-node case,
and encode the declarative pipeline contract (`-- on` triggers, `-- materialize`
+ bare SELECT) in the pipeline judgeChecklists so the LLM judge stops
false-negativing correct nodes. Add a deterministic Playwright e2e that seeds
annotated pipeline scripts and asserts the /pipeline/<folder> editor derives
the lineage DAG.

Fixes WIN-2229

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(ai): steer pipeline chat to DuckDB+materialize and warn on missing storage

The pipeline authoring prompt (getPipelinePrompt, used by the global/session
chat and the /pipeline editor) was neutral on language choice and said nothing
about storage readiness. Default it to duckdb materializing into DuckLake unless
the work specifically needs postgres/data-tables or bun/python, and add a storage
prerequisites section: a DuckLake pipeline needs workspace object storage + a
DuckLake catalog, so warn when none is configured and give role-appropriate next
steps (admin: workspace settings; others: ask an admin). Drafting is not blocked.

A/B on sonnet (global pipeline cases): no regression, +639 finalContext tokens.

Fixes WIN-2229

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* test(ai_evals): address review - e2e teardown, async-edge note, merge-mode hedge

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore(ai): address review nits - drop phantom list_ducklakes tool ref, trim narration comments

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(ai): add list_ducklakes chat tool for pipeline storage readiness

The pipeline counterpart to list_datatables: lists the workspace's configured
DuckLake catalogs so the chat can detect the storage prerequisite before building
a DuckLake pipeline and warn with role-appropriate next steps when none exists
(drafting stays unblocked). Wired into the global tool set and referenced from the
pipeline authoring prompt. In the eval run all three pipeline cases called it
unprompted with no build regression.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore(ai): fix DuckDB annotation syntax in duckdb-default section (-- not //)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 ai_evals/cases/global.yaml                    |  71 +++++++++++-
 frontend/e2e/pipeline.spec.ts                 | 103 ++++++++++++++++++
 .../copilot/chat/ducklakeTools.test.ts        |  53 +++++++++
 .../components/copilot/chat/ducklakeTools.ts  |  62 +++++++++++
 .../components/copilot/chat/global/core.ts    |   3 +
 system_prompts/auto-generated/prompts.ts      |  20 +++-
 system_prompts/base/pipeline-base.md          |  20 +++-
 7 files changed, 327 insertions(+), 5 deletions(-)
 create mode 100644 frontend/e2e/pipeline.spec.ts
 create mode 100644 frontend/src/lib/components/copilot/chat/ducklakeTools.test.ts
 create mode 100644 frontend/src/lib/components/copilot/chat/ducklakeTools.ts

diff --git a/ai_evals/cases/global.yaml b/ai_evals/cases/global.yaml
index 9d5a31556c..fc875aa25d 100644
--- a/ai_evals/cases/global.yaml
+++ b/ai_evals/cases/global.yaml
@@ -1484,9 +1484,15 @@
       - deploy_workspace_item
       - delete_workspace_item
   judgeChecklist:
+    # A pipeline node is DECLARATIVE: triggers are declared by `-- on <ref>`
+    # annotations (the trigger row is created separately) and a `-- materialize`
+    # output is a MANAGED write where the body is a bare SELECT that the runtime
+    # wraps in the create/replace. Do not expect a separate trigger config or a
+    # hand-written CREATE TABLE / INSERT — those would be wrong for a materialize node.
     - builds a data pipeline node as a script (not a flow)
     - marks the script as a pipeline member with the pipeline annotation in the script's comment syntax (`-- pipeline` for a DuckDB/SQL node, not `// pipeline`)
-    - declares a schedule trigger and writes its output to a managed DuckLake table
+    - declares the schedule trigger with the `-- on schedule` annotation comment (this annotation is the correct and complete way a pipeline node binds a schedule; no separate trigger configuration is expected)
+    - declares the managed DuckLake output with `-- materialize ducklake://<table>` and writes the body as a bare SELECT (materialize is a managed write, so the node correctly does NOT hand-write its own CREATE TABLE / INSERT)
     - leaves the result as an AI draft and does not deploy or save it
 
 - id: global-test-pipeline-two-node-chain
@@ -1500,6 +1506,12 @@
     maxTurns: 14
   validate:
     draftCountAtLeast: 2
+    requiredDrafts:
+      - type: script
+        pathStartsWith: f/evals/global/
+        valueIncludes:
+          - pipeline
+          - ducklake
     forbiddenDrafts:
       - type: flow
         pathStartsWith: f/evals/global/
@@ -1511,12 +1523,65 @@
       - deploy_workspace_item
       - delete_workspace_item
   judgeChecklist:
+    # Pipeline nodes are declarative: `-- on <ref>` binds inputs/triggers and
+    # `-- materialize ducklake://<table>` is a managed write whose body is a bare
+    # SELECT. Do not expect hand-written CREATE TABLE / INSERT on a materialize node.
     - creates two data pipeline nodes as scripts (not a flow) in f/evals/global
     - both scripts carry the pipeline annotation in their comment syntax (`-- pipeline` for DuckDB/SQL nodes, not `// pipeline`)
-    - the first ingests orders into a DuckLake table
-    - the second reads that same table and writes a daily rollup, wired to the first step's output asset
+    - the first ingests orders into a DuckLake table (a `-- materialize ducklake://<table>` output with a bare SELECT body is correct; no hand-written CREATE TABLE / INSERT is expected)
+    - the second reads that same table via `-- on ducklake://<that-table>` and materializes a daily rollup table, wiring it to the first step's output asset
     - leaves both as AI drafts without deploying
 
+- id: global-test-pipeline-complex-incremental
+  prompt: |-
+    Build a data pipeline in the `f/evals/global` folder for our web shop's
+    orders. It has three steps:
+    1. On a schedule, ingest the raw order CSVs under `s3://raw/orders/` into a
+       managed DuckLake table.
+    2. An incremental daily rollup: read that raw orders table and, on each run,
+       append just the current day's order count and total revenue into a second
+       DuckLake table. It should process one day at a time, not rebuild the whole
+       table every run.
+    3. A final step that reads the daily rollup table and exports the latest data
+       as a Parquet file to `s3://reports/` for the BI team.
+    Wire each step to the previous step's output so they form one pipeline. Keep
+    everything as AI drafts — don't deploy or save.
+  initial: ai_evals/fixtures/frontend/global/initial/user_admin_evals_folder.json
+  runtime:
+    maxTurns: 18
+  validate:
+    draftCountAtLeast: 3
+    requiredDrafts:
+      - type: script
+        pathStartsWith: f/evals/global/
+        valueIncludes:
+          - pipeline
+          - ducklake
+    forbiddenDrafts:
+      - type: flow
+        pathStartsWith: f/evals/global/
+  toolExpect:
+    requiredToolsUsed:
+      - write_script
+    forbiddenToolsUsed:
+      - write_flow
+      - deploy_workspace_item
+      - delete_workspace_item
+  judgeChecklist:
+    # Pipeline nodes are declarative: `-- on <ref>` binds inputs/triggers, and a
+    # DuckLake `-- materialize` output is a managed write whose body is a bare SELECT
+    # (the runtime performs the create/replace/append/merge). Do not expect a
+    # separate trigger config or hand-written CREATE TABLE / INSERT on a
+    # materialize node. S3/Parquet output is NOT materialize: the body writes it.
+    - builds the pipeline as three independent scripts (not a flow) in f/evals/global
+    - every node carries the pipeline annotation in its own comment syntax (`-- pipeline` for DuckDB/SQL nodes, not `// pipeline`)
+    - step 1 binds a schedule with `-- on schedule` and declares a managed DuckLake output with `-- materialize ducklake://<table>` and a bare SELECT body (no separate trigger config or hand-written CREATE TABLE is expected)
+    - "step 2 is incremental: each run adds only that day's rows to a second DuckLake table rather than rebuilding the whole table every run (e.g. an `append` or `key=<col>` merge materialize mode, not a full replace). Selecting the day via the `-- partitioned daily` + `{partition}` / `wm_partition(...)` idiom is the idiomatic form, but an equivalent current-day filter also satisfies this; a full-refresh/replace of the whole table does not"
+    - step 2 reads the same DuckLake table step 1 writes (via `-- on ducklake://<that-table>`), wiring it to step 1's output asset
+    - step 3 reads the daily rollup table and exports it as a Parquet file to S3
+    - does not misuse `-- materialize` for the S3 Parquet export (materialize is DuckLake-only; the S3 output is written by the script body, e.g. a DuckDB COPY or an SDK write)
+    - leaves all three nodes as AI drafts without deploying or saving
+
 - id: global-path5-create-folder-then-draft
   prompt: |-
     Create a new shared folder called "analytics" for our data work, then draft a
diff --git a/frontend/e2e/pipeline.spec.ts b/frontend/e2e/pipeline.spec.ts
new file mode 100644
index 0000000000..fd472dd206
--- /dev/null
+++ b/frontend/e2e/pipeline.spec.ts
@@ -0,0 +1,103 @@
+import { test, expect, Page } from '@playwright/test'
+
+// The pipeline surface an AI session builds into: session pipeline tools emit
+// annotated scripts (`-- pipeline`, `-- on <asset>`, `-- materialize <asset>`),
+// and the /pipeline/<folder> editor derives the lineage DAG from those
+// annotations alone. This test seeds the scripts an AI-built DuckLake pipeline
+// would produce and asserts the editor renders every derived node, asset, and
+// edge (including the missing-schedule-trigger edge): a deterministic check of
+// the graph the AI session relies on, without a live model in the loop.
+
+const WORKSPACE = 'admins'
+
+declare const process: any
+
+function uniqueSuffix(project: string): string {
+	// Per-project suffix so the three browser projects don't collide on the
+	// shared dev instance when Playwright runs them in parallel.
+	return `${process.env.TEST_UNIQUE_ID ?? 'local'}_${project}`
+}
+
+async function seedScript(page: Page, path: string, content: string, summary: string) {
+	const res = await page.request.post(`/api/w/${WORKSPACE}/scripts/create`, {
+		data: { path, summary, description: '', content, language: 'duckdb', schema: {} }
+	})
+	expect(res.ok(), `seed ${path}: ${res.status()} ${await res.text()}`).toBeTruthy()
+}
+
+test.describe('Pipeline editor', () => {
+	// Track what the test seeds so afterAll can remove it (keeps the shared dev/CI
+	// instance from accumulating a folder + scripts per run).
+	let seeded: { folder: string; scripts: string[] } | undefined
+
+	test.afterAll(async ({ request }) => {
+		if (!seeded) return
+		for (const path of seeded.scripts) {
+			await request.post(`/api/w/${WORKSPACE}/scripts/delete/p/${path}`).catch(() => {})
+		}
+		await request.delete(`/api/w/${WORKSPACE}/folders/delete/${seeded.folder}`).catch(() => {})
+	})
+
+	test('derives the DAG from annotated pipeline scripts', async ({ page }, testInfo) => {
+		const suffix = uniqueSuffix(testInfo.project.name)
+		const folder = `pipeline_e2e_${suffix}`
+		const ingest = `f/${folder}/orders_ingest`
+		const daily = `f/${folder}/orders_daily`
+		const ordersTbl = `main/orders_${suffix}`
+		const dailyTbl = `main/orders_daily_${suffix}`
+		seeded = { folder, scripts: [ingest, daily] }
+
+		// Folder may already exist from a prior run; only fail on the seeds.
+		await page.request.post(`/api/w/${WORKSPACE}/folders/create`, { data: { name: folder } })
+
+		await seedScript(
+			page,
+			ingest,
+			[
+				'-- pipeline',
+				'-- on schedule',
+				`-- materialize ducklake://${ordersTbl}`,
+				"SELECT * FROM read_csv('s3://raw/orders/*.csv')"
+			].join('\n'),
+			'Ingest orders'
+		)
+		await seedScript(
+			page,
+			daily,
+			[
+				'-- pipeline',
+				`-- on ducklake://${ordersTbl}`,
+				`-- materialize ducklake://${dailyTbl}`,
+				`SELECT date_trunc('day', ts) AS day, count(*) AS n FROM ducklake.${ordersTbl.replace('/', '.')} GROUP BY 1`
+			].join('\n'),
+			'Daily rollup'
+		)
+
+		await page.goto(`/pipeline/${folder}`)
+
+		await expect(page.getByRole('heading', { name: 'Pipeline', level: 1 })).toBeVisible()
+		await expect(page.getByText('2 scripts', { exact: false })).toBeVisible()
+
+		// A long path truncates in the node label, so match the leaf name; the full
+		// paths are asserted on the edge labels below.
+		await expect(page.getByText('orders_ingest').first()).toBeVisible()
+		await expect(page.getByText('orders_daily').first()).toBeVisible()
+
+		// Two edges resolve asynchronously after the initial graph fetch (the s3 read
+		// is detected from the SQL body at deploy time; the missing-schedule edge is
+		// synthesized client-side by the page's per-script annotation sweep), so a
+		// cold-CI failure here points at that async timing, not a missing edge.
+		const edges = [
+			`Edge from asset:s3object:raw/orders/*.csv to script:${ingest}`,
+			`Edge from script:${ingest} to asset:ducklake:${ordersTbl}`,
+			`Edge from asset:ducklake:${ordersTbl} to script:${daily}`,
+			`Edge from script:${daily} to asset:ducklake:${dailyTbl}`,
+			`Edge from trigger:schedule:missing:${ingest} to script:${ingest}`
+		]
+		for (const name of edges) {
+			// Edges are SVG <g> groups (no visible box of their own), so assert they
+			// are rendered into the graph rather than in-viewport visible.
+			await expect(page.getByRole('group', { name, exact: true }).first()).toBeAttached()
+		}
+	})
+})
diff --git a/frontend/src/lib/components/copilot/chat/ducklakeTools.test.ts b/frontend/src/lib/components/copilot/chat/ducklakeTools.test.ts
new file mode 100644
index 0000000000..fdd8c74558
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/ducklakeTools.test.ts
@@ -0,0 +1,53 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { listMock } = vi.hoisted(() => ({ listMock: vi.fn() }))
+
+vi.mock('./shared', () => ({
+	createToolDef: (_schema: unknown, name: string, description: string) => ({
+		type: 'function',
+		function: { name, description, parameters: {} }
+	})
+}))
+
+vi.mock('$lib/gen', () => ({
+	WorkspaceService: { listDucklakes: listMock }
+}))
+
+import { getDucklakeTools } from './ducklakeTools'
+
+function createToolCallbacks() {
+	return { setToolStatus: vi.fn(), removeToolStatus: vi.fn() }
+}
+
+function run(name: string, args: Record<string, unknown> = {}) {
+	const tool = getDucklakeTools().find((entry) => entry.def.function.name === name)
+	if (!tool) throw new Error(`${name} tool not found`)
+	return tool.fn({
+		args,
+		workspace: 'test-workspace',
+		helpers: {},
+		toolCallbacks: createToolCallbacks(),
+		toolId: `tool-${name}`
+	})
+}
+
+beforeEach(() => listMock.mockReset())
+
+describe('list_ducklakes', () => {
+	it('returns the configured catalog names', async () => {
+		listMock.mockResolvedValue(['main', 'analytics'])
+		const result = await run('list_ducklakes')
+		expect(listMock).toHaveBeenCalledWith({ workspace: 'test-workspace' })
+		expect(JSON.parse(result)).toEqual({ ducklakes: ['main', 'analytics'] })
+	})
+
+	it('explains the storage prerequisite with role-appropriate steps when none exist', async () => {
+		listMock.mockResolvedValue([])
+		const result = await run('list_ducklakes')
+		expect(result).toContain('No DuckLake catalogs are configured')
+		expect(result).toContain('Workspace settings → Object Storage')
+		expect(result).toContain('ask a workspace admin')
+		// Drafting is not blocked: the message must say the scripts can still be drafted.
+		expect(result).toContain('still draft the pipeline scripts')
+	})
+})
diff --git a/frontend/src/lib/components/copilot/chat/ducklakeTools.ts b/frontend/src/lib/components/copilot/chat/ducklakeTools.ts
new file mode 100644
index 0000000000..8a76e63905
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/ducklakeTools.ts
@@ -0,0 +1,62 @@
+import { z } from 'zod'
+import { WorkspaceService } from '$lib/gen'
+import { createToolDef, type Tool } from './shared'
+
+/**
+ * Workspace-scoped DuckLake readiness tool, the pipeline counterpart to
+ * `list_datatables` in `datatableTools.ts`.
+ *
+ * A data pipeline materializes DuckLake tables and reads/writes S3 assets, which
+ * only work once the workspace has object storage + a DuckLake catalog
+ * configured. This tool lets the chat detect that prerequisite (and warn with
+ * role-appropriate next steps) instead of silently producing a pipeline that
+ * cannot run. It is a plain read gated only by workspace membership, so it needs
+ * no app context and belongs in the global tool set.
+ */
+
+/** List the names of the DuckLake catalogs configured in the workspace. */
+export async function listDucklakes(workspace: string): Promise<string[]> {
+	return await WorkspaceService.listDucklakes({ workspace })
+}
+
+const NO_DUCKLAKES_CONFIGURED_MESSAGE =
+	'No DuckLake catalogs are configured in this workspace. A data pipeline that materializes DuckLake tables or reads/writes S3 assets cannot run until object storage and a DuckLake catalog are set up. ' +
+	'You can still draft the pipeline scripts, but tell the user how to enable it by role: a workspace admin adds object storage under Workspace settings → Object Storage (S3/Azure/GCS), then a DuckLake catalog on top of it; a user without admin rights should ask a workspace admin. ' +
+	"Do not assume a default 'main' DuckLake exists."
+
+const listDucklakesSchema = z.object({})
+const listDucklakesToolDef = createToolDef(
+	listDucklakesSchema,
+	'list_ducklakes',
+	'List the DuckLake catalogs configured in this workspace, by name. Call this before building or deploying a data pipeline that materializes DuckLake tables or reads/writes S3 assets: if it returns none, the workspace has no object storage + DuckLake configured and the pipeline cannot run until a workspace admin sets it up. Returns names only.'
+)
+
+/** The workspace DuckLake tools, for registration in global mode. */
+export function getDucklakeTools(): Tool<{}>[] {
+	return [
+		{
+			def: listDucklakesToolDef,
+			fn: async ({ workspace, toolId, toolCallbacks }) => {
+				toolCallbacks.setToolStatus(toolId, { content: 'Listing DuckLake catalogs...' })
+				try {
+					const ducklakes = await listDucklakes(workspace)
+					if (ducklakes.length === 0) {
+						toolCallbacks.setToolStatus(toolId, {
+							content:
+								'No DuckLake configured — set up object storage + DuckLake in workspace settings'
+						})
+						return NO_DUCKLAKES_CONFIGURED_MESSAGE
+					}
+					toolCallbacks.setToolStatus(toolId, {
+						content: `Listed ${ducklakes.length} DuckLake catalog(s)`
+					})
+					return JSON.stringify({ ducklakes }, null, 2)
+				} catch (e) {
+					const errorMsg = `Error listing DuckLake catalogs: ${e instanceof Error ? e.message : String(e)}`
+					toolCallbacks.setToolStatus(toolId, { content: errorMsg, error: errorMsg })
+					return errorMsg
+				}
+			}
+		}
+	]
+}
diff --git a/frontend/src/lib/components/copilot/chat/global/core.ts b/frontend/src/lib/components/copilot/chat/global/core.ts
index 8b68cac2f0..4187cfaf20 100644
--- a/frontend/src/lib/components/copilot/chat/global/core.ts
+++ b/frontend/src/lib/components/copilot/chat/global/core.ts
@@ -96,6 +96,7 @@ import { searchDocsTool, readDocsPageTool } from '../docs/core'
 import { createDbSchemaTool } from '../script/core'
 import type { ContextElement } from '../context'
 import { getDatatableTools } from '../datatableTools'
+import { getDucklakeTools } from '../ducklakeTools'
 import { fileTools } from '../files/fileTools'
 import type { AttachedFilesStore } from '../files/attachedFiles.svelte'
 import { artifactTools } from '../artifacts/artifactTools'
@@ -3493,6 +3494,8 @@ export const globalTools: Tool<{}>[] = [
 	},
 	// Workspace-scoped datatable tools (unrestricted: no whitelist, no creation policy)
 	...getDatatableTools(),
+	// Workspace DuckLake readiness (storage prerequisite check for pipelines)
+	...getDucklakeTools(),
 	// Read-only tools over files the user attached to the conversation
 	...fileTools,
 	// Search + call access to the backend API endpoint catalog, for operations
diff --git a/system_prompts/auto-generated/prompts.ts b/system_prompts/auto-generated/prompts.ts
index 5670c53fcd..8fab73584c 100644
--- a/system_prompts/auto-generated/prompts.ts
+++ b/system_prompts/auto-generated/prompts.ts
@@ -755,6 +755,24 @@ export const PIPELINE_BASE = `# Data pipeline authoring
 
 A **data pipeline** is NOT a flow. A flow is one runnable that orchestrates steps internally. A data pipeline is a set of **independent scripts**, each deployed on its own, that form a DAG by reading and writing shared **storage assets** (DuckLake tables, data tables, S3 objects, volumes, resources) and by declaring execution **triggers**. The pipeline is visualized and edited at \`/pipeline/<folder>\`; every node is a normal workspace script that happens to carry pipeline annotations. When the user asks for a "data pipeline" (or to "ingest / transform / materialize" data across steps), build pipeline-annotated scripts — do NOT build a flow.
 
+## Default to DuckDB + DuckLake
+
+A pipeline node that produces a table should almost always be a **\`duckdb\`** node that materializes its output into a **DuckLake** table with \`-- materialize ducklake://<name>/<table>\` (in a DuckDB node the annotation uses SQL \`--\` comment syntax; write the body as a bare \`SELECT\` and let the runtime do the write). DuckLake is the default lakehouse store for pipelines and is the shape the pipeline editor is built around, so prefer it unless the work specifically calls for something else:
+
+- \`postgresql\` / data tables — only for row-level, OLTP-style mutations against an existing Postgres data table (frequent single-row upserts/updates, transactional reads that an app queries live).
+- \`bun\` / \`python3\` — only for non-tabular work that doesn't map to SQL: calling an external API, wrangling files, arbitrary glue. When such a node still produces tabular data for downstream steps, land it in DuckLake (write it with the wmill SDK / ducklake helpers) rather than inventing a parallel store.
+
+Do not spread a pipeline across postgres, S3, and DuckLake when one DuckLake lake would do; a consistent DuckLake lakehouse is the goal.
+
+## Storage prerequisites
+
+A DuckLake pipeline only runs once the workspace has **object storage** (S3 / Azure Blob / GCS) **and a DuckLake catalog** configured — DuckLake tables and \`s3://\` assets can't be materialized or read without it. Check with the \`list_ducklakes\` tool before you build (it returns the configured DuckLake catalogs, or none). Drafting the annotated scripts does not require storage, but the pipeline can't ingest, materialize, or read its assets until it exists. So if \`list_ducklakes\` returns none (or the user hits "storage not configured" errors), say so and give the right next step **by role**:
+
+- a workspace **admin** sets it up in Workspace settings → Object Storage (add an S3/Azure/GCS storage), then adds a DuckLake catalog on top of it;
+- anyone **without admin rights** should ask a workspace admin to configure object storage + a DuckLake catalog.
+
+Never hand back a DuckLake pipeline that cannot run without flagging the missing storage and pointing to who sets it up.
+
 ## What makes a script a pipeline node
 
 A script joins the pipeline when its source begins with the \`pipeline\` annotation as a top-of-file comment, **written in the script's own comment syntax** — \`//\` for TS/JS (bun), \`--\` for SQL (DuckDB/Postgres), \`#\` for Python/Bash. So it's \`-- pipeline\` in a DuckDB node, \`# pipeline\` in a Python node, \`// pipeline\` in a bun node. Every annotation below uses that same prefix (the \`//\` shown is the TS form). All other wiring is expressed as annotation comments near the top of the file:
@@ -784,7 +802,7 @@ A script joins the pipeline when its source begins with the \`pipeline\` annotat
 ## How to build one in chat
 
 1. Put every node in the **same folder**: \`f/<folder>/<name>\`. The folder is the pipeline.
-2. Author each node as a **script draft** with \`write_script\` (or \`edit_script\`), language chosen for the work: \`duckdb\` or \`postgresql\` for SQL-shaped data work, \`bun\`/\`python3\` for general transforms. SQL-heavy lakehouse steps usually use \`duckdb\`.
+2. Author each node as a **script draft** with \`write_script\` (or \`edit_script\`). Default to \`duckdb\` materializing into DuckLake (see "Default to DuckDB + DuckLake" above); pick \`postgresql\`, \`bun\`, or \`python3\` only when that section says the work calls for it.
 3. Start each body with \`// pipeline\`, then the \`// on\` input declarations, then the transform that writes the output.
 4. **Chain nodes by asset URI**: read an upstream node's output asset, then \`// on <that-same-uri>\` in the downstream node so the edge forms. Reuse exact asset paths from existing nodes rather than inventing parallel ones.
 5. Leave nodes as drafts unless the user asks to deploy. A pipeline only "runs" once its scripts are deployed and their triggers exist.
diff --git a/system_prompts/base/pipeline-base.md b/system_prompts/base/pipeline-base.md
index 55c1c53169..ccd66c6f5a 100644
--- a/system_prompts/base/pipeline-base.md
+++ b/system_prompts/base/pipeline-base.md
@@ -2,6 +2,24 @@
 
 A **data pipeline** is NOT a flow. A flow is one runnable that orchestrates steps internally. A data pipeline is a set of **independent scripts**, each deployed on its own, that form a DAG by reading and writing shared **storage assets** (DuckLake tables, data tables, S3 objects, volumes, resources) and by declaring execution **triggers**. The pipeline is visualized and edited at `/pipeline/<folder>`; every node is a normal workspace script that happens to carry pipeline annotations. When the user asks for a "data pipeline" (or to "ingest / transform / materialize" data across steps), build pipeline-annotated scripts — do NOT build a flow.
 
+## Default to DuckDB + DuckLake
+
+A pipeline node that produces a table should almost always be a **`duckdb`** node that materializes its output into a **DuckLake** table with `-- materialize ducklake://<name>/<table>` (in a DuckDB node the annotation uses SQL `--` comment syntax; write the body as a bare `SELECT` and let the runtime do the write). DuckLake is the default lakehouse store for pipelines and is the shape the pipeline editor is built around, so prefer it unless the work specifically calls for something else:
+
+- `postgresql` / data tables — only for row-level, OLTP-style mutations against an existing Postgres data table (frequent single-row upserts/updates, transactional reads that an app queries live).
+- `bun` / `python3` — only for non-tabular work that doesn't map to SQL: calling an external API, wrangling files, arbitrary glue. When such a node still produces tabular data for downstream steps, land it in DuckLake (write it with the wmill SDK / ducklake helpers) rather than inventing a parallel store.
+
+Do not spread a pipeline across postgres, S3, and DuckLake when one DuckLake lake would do; a consistent DuckLake lakehouse is the goal.
+
+## Storage prerequisites
+
+A DuckLake pipeline only runs once the workspace has **object storage** (S3 / Azure Blob / GCS) **and a DuckLake catalog** configured — DuckLake tables and `s3://` assets can't be materialized or read without it. Check with the `list_ducklakes` tool before you build (it returns the configured DuckLake catalogs, or none). Drafting the annotated scripts does not require storage, but the pipeline can't ingest, materialize, or read its assets until it exists. So if `list_ducklakes` returns none (or the user hits "storage not configured" errors), say so and give the right next step **by role**:
+
+- a workspace **admin** sets it up in Workspace settings → Object Storage (add an S3/Azure/GCS storage), then adds a DuckLake catalog on top of it;
+- anyone **without admin rights** should ask a workspace admin to configure object storage + a DuckLake catalog.
+
+Never hand back a DuckLake pipeline that cannot run without flagging the missing storage and pointing to who sets it up.
+
 ## What makes a script a pipeline node
 
 A script joins the pipeline when its source begins with the `pipeline` annotation as a top-of-file comment, **written in the script's own comment syntax** — `//` for TS/JS (bun), `--` for SQL (DuckDB/Postgres), `#` for Python/Bash. So it's `-- pipeline` in a DuckDB node, `# pipeline` in a Python node, `// pipeline` in a bun node. Every annotation below uses that same prefix (the `//` shown is the TS form). All other wiring is expressed as annotation comments near the top of the file:
@@ -31,7 +49,7 @@ A script joins the pipeline when its source begins with the `pipeline` annotatio
 ## How to build one in chat
 
 1. Put every node in the **same folder**: `f/<folder>/<name>`. The folder is the pipeline.
-2. Author each node as a **script draft** with `write_script` (or `edit_script`), language chosen for the work: `duckdb` or `postgresql` for SQL-shaped data work, `bun`/`python3` for general transforms. SQL-heavy lakehouse steps usually use `duckdb`.
+2. Author each node as a **script draft** with `write_script` (or `edit_script`). Default to `duckdb` materializing into DuckLake (see "Default to DuckDB + DuckLake" above); pick `postgresql`, `bun`, or `python3` only when that section says the work calls for it.
 3. Start each body with `// pipeline`, then the `// on` input declarations, then the transform that writes the output.
 4. **Chain nodes by asset URI**: read an upstream node's output asset, then `// on <that-same-uri>` in the downstream node so the edge forms. Reuse exact asset paths from existing nodes rather than inventing parallel ones.
 5. Leave nodes as drafts unless the user asks to deploy. A pipeline only "runs" once its scripts are deployed and their triggers exist.

From ad53673a2855e787af9fe10dcc8998ffc7f1b960 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Thu, 23 Jul 2026 00:54:18 +0200
Subject: [PATCH 125/171] fix(ai-chat): improve resource-type search tool
 description and scoring (#10272)

The global-mode search_resource_types tool described its query as a
substring match, but the backend does semantic embedding search. Rewrite
the description so the LLM sends natural-language intent instead of literal
name guesses.

Apply the top-score trim to query_resource_types so a strong match isn't
diluted by weakly-related types that merely clear the 0.75 similarity floor.
The trim was previously inlined only in query_hub_scripts; extract it into a
shared trim_to_top_score helper, use it from both search paths, and add a
unit test pinning the 5% cutoff boundary.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 backend/windmill-api-embeddings/src/lib.rs    | 64 +++++++++++++++----
 .../components/copilot/chat/global/core.ts    |  6 +-
 2 files changed, 58 insertions(+), 12 deletions(-)

diff --git a/backend/windmill-api-embeddings/src/lib.rs b/backend/windmill-api-embeddings/src/lib.rs
index 439de86fbb..35816dfaa8 100644
--- a/backend/windmill-api-embeddings/src/lib.rs
+++ b/backend/windmill-api-embeddings/src/lib.rs
@@ -116,6 +116,26 @@ pub struct ResourceTypeResult {
     score: f32,
     schema: Option<serde_json::Value>,
 }
+
+/// Drop results whose score falls more than `max_relative_drop` below the best
+/// match, so a strong hit isn't diluted by weakly-related entries that merely
+/// clear the similarity floor. Expects `results` sorted by descending score and
+/// a positive top score (guaranteed by the caller's similarity threshold).
+#[cfg(feature = "embedding")]
+fn trim_to_top_score<T>(
+    results: Vec<T>,
+    max_relative_drop: f32,
+    score: impl Fn(&T) -> f32,
+) -> Vec<T> {
+    if results.len() <= 1 {
+        return results;
+    }
+    let top_score = score(&results[0]);
+    results
+        .into_iter()
+        .take_while(|r| (top_score - score(r)) / top_score <= max_relative_drop)
+        .collect()
+}
 #[cfg(feature = "embedding")]
 async fn query_resource_types(
     Query(query): Query<ResourceTypesQuery>,
@@ -515,15 +535,7 @@ impl EmbeddingsDb {
             })
             .collect();
 
-        let mut results = results?;
-
-        if results.len() > 1 {
-            let top_score = results[0].score;
-            results = results
-                .into_iter()
-                .take_while(|r| (top_score - r.score) / top_score <= 0.05)
-                .collect();
-        }
+        let results = trim_to_top_score(results?, 0.05, |r| r.score);
 
         Ok(results)
     }
@@ -564,7 +576,7 @@ impl EmbeddingsDb {
             Some(0.75),
         );
 
-        let results: Result<_> = results
+        let results: Result<Vec<ResourceTypeResult>> = results
             .iter()
             .map(|r| {
                 let metadata = r
@@ -586,7 +598,9 @@ impl EmbeddingsDb {
             })
             .collect();
 
-        results
+        let results = trim_to_top_score(results?, 0.05, |r| r.score);
+
+        Ok(results)
     }
 }
 
@@ -688,3 +702,31 @@ pub fn workspaced_service() -> Router {
 pub fn global_service() -> Router {
     Router::new()
 }
+
+#[cfg(all(test, feature = "embedding"))]
+mod tests {
+    use super::trim_to_top_score;
+
+    #[test]
+    fn trims_scores_more_than_5pct_below_top() {
+        // top=1.0, cutoff at 0.95: 0.96 stays (0.04 drop), 0.93 is the first
+        // beyond the cutoff so take_while stops there and drops the tail.
+        let kept = trim_to_top_score(vec![1.0f32, 0.97, 0.96, 0.93, 0.9], 0.05, |s| *s);
+        assert_eq!(kept, vec![1.0, 0.97, 0.96]);
+    }
+
+    #[test]
+    fn keeps_all_when_tightly_clustered() {
+        let kept = trim_to_top_score(vec![0.9f32, 0.89, 0.88], 0.05, |s| *s);
+        assert_eq!(kept, vec![0.9, 0.89, 0.88]);
+    }
+
+    #[test]
+    fn passes_through_zero_or_one_result() {
+        assert_eq!(
+            trim_to_top_score(Vec::<f32>::new(), 0.05, |s| *s),
+            Vec::<f32>::new()
+        );
+        assert_eq!(trim_to_top_score(vec![0.42f32], 0.05, |s| *s), vec![0.42]);
+    }
+}
diff --git a/frontend/src/lib/components/copilot/chat/global/core.ts b/frontend/src/lib/components/copilot/chat/global/core.ts
index 4187cfaf20..f028ca9784 100644
--- a/frontend/src/lib/components/copilot/chat/global/core.ts
+++ b/frontend/src/lib/components/copilot/chat/global/core.ts
@@ -575,7 +575,11 @@ const writeResourceSchema = resourceRequestSchema.extend({ override: draftOverri
 const writeVariableSchema = variableRequestSchema.extend({ override: draftOverrideField })
 
 const searchResourceTypesSchema = z.object({
-	query: z.string().describe('Substring to match against resource type names.'),
+	query: z
+		.string()
+		.describe(
+			'Natural-language description of the integration or capability you need, e.g. "stripe", "postgres database", or "send emails". Matched semantically against resource type names and descriptions, so describe the intent rather than guessing the exact name.'
+		),
 	limit: z
 		.number()
 		.int()

From e41440b344d94ebe5746a89237c3d1be522aa59d Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Thu, 23 Jul 2026 01:12:55 +0200
Subject: [PATCH 126/171] feat(ai-chat): email triggers in flow/script chat +
 trigger-intent eval guards (WIN-2228) (#10267)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* test(ai-evals): guard implicit trigger/schedule intent in flow chat

Investigation of WIN-2228 (does flow AI chat understand it should create a
flow AND its associated triggers): the flow-editor chat already exposes
create_schedule and create_trigger (10 kinds), both confirmation-gated, and
an A/B eval shows the model already recognizes IMPLICIT trigger intent
reliably (12/12 across two new cases on the current prompt) without naming a
"schedule" or "trigger".

Add two ai_evals flow cases that phrase the trigger intent implicitly, to
guard that recognition against future prompt/tool regressions. These are not
redundant with the existing explicit cases (flow-test15/16): a trial system
prompt addition that spelled out a deployment prerequisite regressed the HTTP
case from 6/6 to 2/6 (the model deferred instead of creating the trigger),
which these cases caught. No prompt change ships: the addition showed no
measured benefit over baseline and the fuller version regressed behavior.

Fixes WIN-2228

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(ai-chat): support email triggers in flow/script create_trigger

The chat's create_trigger tool exposed 10 trigger kinds but not email, even
though the backend supports email triggers and the chat's open-resource
drawer was already wired for them (CreatedResourceActionDrawers, the 'email'
CreatedResourceTriggerKind). So when asked to make a flow run on incoming
email, the model had no email kind and substituted an HTTP trigger it
mislabeled as email.

Add email as a create_trigger kind (generator + regenerated zod schema +
triggerConfigs → EmailTriggerService.createEmailTrigger). Email triggering
only works once an instance superadmin has stood up an SMTP server and set
the `email_domain` global setting, so guard the create path: read
`email_domain` (readable by any authed user; returns null when unset) and,
when it is not configured, return role-aware setup guidance instead of a
failing create — pointing a superadmin to Instance settings and a regular
user to ask a superadmin, both with the docs link. When configured, create
the trigger and report the resulting inbound email address.

userStore and the email-address helper are lazy-imported so the chat tools
module does not drag in the heavy $lib/stores graph at load.

Guarded by unit tests for both branches (shared.test.ts) and an ai_evals
case (flow-test19); the model now calls create_trigger(kind=email) 3/3 on a
natural "run when an email is received" prompt.

Fixes WIN-2228

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(ai-chat): address codex review on email trigger + eval guards

- [P1] Default `workspaced_local_part` on the email trigger request body
  before it is sent, not only when formatting the success address. The
  column is BOOLEAN NOT NULL, so a request omitting it (the model may) was
  rejected by the backend. Assert the defaulted `false` in the happy-path
  unit test.
- [P2] Tighten the implicit-intent eval guards so they validate the
  requested configuration, not just tool selection + path prefix:
  flow-test17 now checks the cron time (07:30) and UTC timezone;
  flow-test18 checks kind=http, POST method, no auth, and the route path.
  Cases still pass 9/9 (sonnet).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 ai_evals/cases/flow.yaml                      |  82 +++++++++++
 .../components/copilot/chat/shared.test.ts    | 134 +++++++++++++++++-
 .../components/copilot/chat/workspaceTools.ts |  79 ++++++++++-
 .../copilot/chat/workspaceToolsZod.gen.ts     |  32 +++++
 system_prompts/generate.py                    |   2 +
 5 files changed, 324 insertions(+), 5 deletions(-)

diff --git a/ai_evals/cases/flow.yaml b/ai_evals/cases/flow.yaml
index a21ae81f17..fa2ca3bee7 100644
--- a/ai_evals/cases/flow.yaml
+++ b/ai_evals/cases/flow.yaml
@@ -480,3 +480,85 @@
   judgeChecklist:
     - "the flow includes a final top-level step named `webhook_response`"
     - "`webhook_response` returns `ok: true` and the order summary"
+
+- id: flow-test17-implicit-schedule-intent
+  prompt: |-
+    I want this order processing flow to run on its own every morning at 07:30 UTC.
+    Set that up for me. Do not ask me for the flow path.
+  initial: ai_evals/fixtures/frontend/flow/initial/scheduled_order_flow.json
+  toolExpect:
+    requiredToolsUsed:
+      - create_schedule
+    toolCallArgs:
+      - tool: create_schedule
+        field: path
+        stringStartsWithAnyOf:
+          - f/
+          - u/
+        stringMustNotStartWithAnyOf:
+          - schedules/
+      - tool: create_schedule
+        field: schedule
+        stringIncludesAnyOf:
+          - 30 7
+      - tool: create_schedule
+        field: timezone
+        stringIncludesAnyOf:
+          - UTC
+  skipJudge: true
+  judgeChecklist:
+    - "a schedule is created for the flow that runs daily at 07:30 UTC"
+
+- id: flow-test18-implicit-http-trigger-intent
+  prompt: |-
+    I need to be able to kick off this order processing flow by sending it an HTTP POST
+    from an external system, with no authentication. Use route path `ai-evals/order-processing-implicit`.
+    Do not ask me for the flow path.
+  initial: ai_evals/fixtures/frontend/flow/initial/scheduled_order_flow.json
+  toolExpect:
+    requiredToolsUsed:
+      - create_trigger
+    toolCallArgs:
+      - tool: create_trigger
+        field: path
+        stringStartsWithAnyOf:
+          - f/
+          - u/
+        stringMustNotStartWithAnyOf:
+          - schedules/
+      - tool: create_trigger
+        field: kind
+        stringStartsWithAnyOf:
+          - http
+      - tool: create_trigger
+        field: config.http_method
+        stringIncludesAnyOf:
+          - post
+      - tool: create_trigger
+        field: config.authentication_method
+        stringIncludesAnyOf:
+          - none
+      - tool: create_trigger
+        field: config.route_path
+        stringIncludesAnyOf:
+          - ai-evals/order-processing-implicit
+  skipJudge: true
+  judgeChecklist:
+    - "an HTTP trigger is created for the flow that accepts unauthenticated POST requests"
+
+- id: flow-test19-implicit-email-trigger-intent
+  prompt: |-
+    Make this order processing flow run automatically whenever an email is received.
+    Do not ask me for the flow path.
+  initial: ai_evals/fixtures/frontend/flow/initial/scheduled_order_flow.json
+  toolExpect:
+    requiredToolsUsed:
+      - create_trigger
+    toolCallArgs:
+      - tool: create_trigger
+        field: kind
+        stringStartsWithAnyOf:
+          - email
+  skipJudge: true
+  judgeChecklist:
+    - "an email trigger (kind email) is created, or the user is told how to enable email triggering on the instance"
diff --git a/frontend/src/lib/components/copilot/chat/shared.test.ts b/frontend/src/lib/components/copilot/chat/shared.test.ts
index ec6febca80..473c3d3335 100644
--- a/frontend/src/lib/components/copilot/chat/shared.test.ts
+++ b/frontend/src/lib/components/copilot/chat/shared.test.ts
@@ -7,8 +7,23 @@ vi.mock('monaco-editor', () => ({
 	editor: {}
 }))
 
+const userHolder = vi.hoisted(() => ({
+	current: { is_super_admin: true } as { is_super_admin: boolean }
+}))
+
 vi.mock('$lib/stores', () => ({
-	workspaceStore: { subscribe: () => () => undefined }
+	workspaceStore: { subscribe: () => () => undefined },
+	userStore: {
+		subscribe: (run: (value: { is_super_admin: boolean }) => void) => {
+			run(userHolder.current)
+			return () => {}
+		}
+	}
+}))
+
+vi.mock('$lib/components/triggers/email/utils', () => ({
+	getEmailAddress: (localPart: string, _wlp: boolean, _wsId: string, domain: string) =>
+		`${localPart}@${domain}`
 }))
 
 vi.mock('$lib/components/flows/flowTree', () => ({
@@ -31,7 +46,10 @@ vi.mock('$lib/gen', () => ({
 	MqttTriggerService: { createMqttTrigger: vi.fn() },
 	SqsTriggerService: { createSqsTrigger: vi.fn() },
 	GcpTriggerService: { createGcpTrigger: vi.fn() },
-	AzureTriggerService: { createAzureTrigger: vi.fn() }
+	AzureTriggerService: { createAzureTrigger: vi.fn() },
+	AmqpTriggerService: { createAmqpTrigger: vi.fn() },
+	EmailTriggerService: { createEmailTrigger: vi.fn() },
+	SettingService: { getGlobal: vi.fn() }
 }))
 
 vi.mock('$lib/utils', () => ({
@@ -555,6 +573,118 @@ describe('processToolCall', () => {
 		)
 	})
 
+	it('email trigger: guides the user to set up email triggering when unconfigured', async () => {
+		const gen = (await import('$lib/gen')) as any
+		const { processToolCall } = await import('./shared')
+		const { createWorkspaceMutationTools } = await import('./workspaceTools')
+		const tools = createWorkspaceMutationTools()
+
+		gen.SettingService.getGlobal.mockReset()
+		gen.SettingService.getGlobal.mockResolvedValue(null)
+		gen.EmailTriggerService.createEmailTrigger.mockReset()
+
+		const call = (id: string) =>
+			processToolCall({
+				tools,
+				toolCall: {
+					id,
+					type: 'function',
+					function: {
+						name: 'create_trigger',
+						arguments: JSON.stringify({
+							kind: 'email',
+							path: 'f/triggers/email_current',
+							config: { local_part: 'orders' }
+						})
+					}
+				},
+				helpers: {
+					getWorkspaceMutationTarget: () => ({
+						kind: 'flow',
+						path: 'f/flows/current',
+						deployed: true
+					})
+				},
+				workspace: 'test-workspace',
+				toolCallbacks: {
+					setToolStatus: vi.fn(),
+					removeToolStatus: vi.fn(),
+					requestConfirmation: vi.fn().mockResolvedValue(true)
+				}
+			})
+
+		userHolder.current = { is_super_admin: true }
+		const superadminResult = await call('call_email_super')
+		expect(gen.EmailTriggerService.createEmailTrigger).not.toHaveBeenCalled()
+		expect(superadminResult.content).toContain('not set up')
+		expect(superadminResult.content).toContain('As a superadmin')
+
+		userHolder.current = { is_super_admin: false }
+		const memberResult = await call('call_email_member')
+		expect(gen.EmailTriggerService.createEmailTrigger).not.toHaveBeenCalled()
+		expect(memberResult.content).toContain('Ask an instance superadmin')
+	})
+
+	it('email trigger: creates it and reports the address when email triggering is configured', async () => {
+		const gen = (await import('$lib/gen')) as any
+		const { processToolCall } = await import('./shared')
+		const { createWorkspaceMutationTools } = await import('./workspaceTools')
+		const tools = createWorkspaceMutationTools()
+
+		gen.SettingService.getGlobal.mockReset()
+		gen.SettingService.getGlobal.mockResolvedValue('mail.example.com')
+		gen.EmailTriggerService.createEmailTrigger.mockReset()
+		gen.EmailTriggerService.createEmailTrigger.mockResolvedValue('email-created')
+
+		const result = await processToolCall({
+			tools,
+			toolCall: {
+				id: 'call_email_ok',
+				type: 'function',
+				function: {
+					name: 'create_trigger',
+					arguments: JSON.stringify({
+						kind: 'email',
+						path: 'f/triggers/email_current',
+						config: { local_part: 'orders' }
+					})
+				}
+			},
+			helpers: {
+				getWorkspaceMutationTarget: () => ({
+					kind: 'flow',
+					path: 'f/flows/current',
+					deployed: true
+				})
+			},
+			workspace: 'test-workspace',
+			toolCallbacks: {
+				setToolStatus: vi.fn(),
+				removeToolStatus: vi.fn(),
+				requestConfirmation: vi.fn().mockResolvedValue(true)
+			}
+		})
+
+		expect(gen.EmailTriggerService.createEmailTrigger).toHaveBeenCalledWith({
+			workspace: 'test-workspace',
+			requestBody: expect.objectContaining({
+				local_part: 'orders',
+				// defaulted before the request is sent; the backend column is NOT NULL
+				workspaced_local_part: false,
+				script_path: 'f/flows/current',
+				is_flow: true
+			})
+		})
+		expect(JSON.parse(result.content as string)).toEqual(
+			expect.objectContaining({
+				success: true,
+				kind: 'email',
+				email_address: 'orders@mail.example.com',
+				backend_result: 'email-created'
+			})
+		)
+	})
+
 	it('surfaces workspace mutation tool execution errors to the user', async () => {
 		const gen = (await import('$lib/gen')) as any
 		const { processToolCall } = await import('./shared')
diff --git a/frontend/src/lib/components/copilot/chat/workspaceTools.ts b/frontend/src/lib/components/copilot/chat/workspaceTools.ts
index a976b7dab6..dabe63b5bc 100644
--- a/frontend/src/lib/components/copilot/chat/workspaceTools.ts
+++ b/frontend/src/lib/components/copilot/chat/workspaceTools.ts
@@ -1,5 +1,6 @@
 import {
 	AzureTriggerService,
+	EmailTriggerService,
 	GcpTriggerService,
 	HttpTriggerService,
 	KafkaTriggerService,
@@ -8,10 +9,12 @@ import {
 	NatsTriggerService,
 	PostgresTriggerService,
 	ScheduleService,
+	SettingService,
 	SqsTriggerService,
 	WebsocketTriggerService,
 	type AzureTriggerData,
 	type GcpTriggerData,
+	type NewEmailTrigger,
 	type NewHttpTrigger,
 	type NewKafkaTrigger,
 	type NewMqttTrigger,
@@ -51,6 +54,7 @@ type TriggerRequestByKind = {
 	sqs: NewSqsTrigger
 	gcp: GcpTriggerData
 	azure: AzureTriggerData
+	email: NewEmailTrigger
 }
 type TriggerRequestBody = TriggerRequestByKind[TriggerKind]
 
@@ -117,7 +121,7 @@ const createScheduleToolDef = createToolDef(
 const createTriggerToolDef = createToolDef(
 	createTriggerToolSchema,
 	'create_trigger',
-	'Create a trigger for the current script or flow.',
+	'Create a trigger for the current script or flow. For an email trigger (kind "email"), config.local_part is the local part of the receiving address (before the @); the tool reports the full address on success. Email triggers require email triggering to be configured on the instance — if it is not, the tool returns setup guidance instead of creating one.',
 	{ strict: false }
 )
 
@@ -181,6 +185,12 @@ const triggerConfigs = {
 		requestSchema: triggerRequestSchemas.azure as z.ZodType<AzureTriggerData>,
 		create: (data: { workspace: string; requestBody: AzureTriggerData }) =>
 			AzureTriggerService.createAzureTrigger(data)
+	},
+	email: {
+		label: 'Email trigger',
+		requestSchema: triggerRequestSchemas.email as z.ZodType<NewEmailTrigger>,
+		create: (data: { workspace: string; requestBody: NewEmailTrigger }) =>
+			EmailTriggerService.createEmailTrigger(data)
 	}
 } satisfies {
 	[K in TriggerKind]: {
@@ -321,6 +331,39 @@ const createScheduleTool: Tool<any> = {
 	}
 }
 
+const EMAIL_TRIGGER_DOCS = 'https://windmill.dev/docs/advanced/email_triggers'
+
+type EmailTriggerAvailability =
+	| { available: true; domain: string }
+	| { available: false; hint: string }
+
+/**
+ * Email triggers only work once an instance superadmin has stood up an SMTP
+ * server forwarding to Windmill and set the `email_domain` global setting
+ * (readable by any authed user). When it is unset the create call would fail
+ * opaquely, so we surface actionable, role-aware setup guidance instead.
+ */
+async function resolveEmailTriggerAvailability(): Promise<EmailTriggerAvailability> {
+	let emailDomain: unknown
+	try {
+		emailDomain = await SettingService.getGlobal({ key: 'email_domain' })
+	} catch {
+		emailDomain = undefined
+	}
+	if (typeof emailDomain === 'string' && emailDomain.trim() !== '') {
+		return { available: true, domain: emailDomain }
+	}
+	const [{ get }, { userStore }] = await Promise.all([
+		import('svelte/store'),
+		import('$lib/stores')
+	])
+	const isSuperadmin = get(userStore)?.is_super_admin ?? false
+	const hint = isSuperadmin
+		? `Email triggering is not set up on this instance yet, so no email trigger was created. As a superadmin, enable it: run an SMTP server that forwards inbound mail to Windmill and set the "email_domain" instance setting (Instance settings). See ${EMAIL_TRIGGER_DOCS}. Once configured, ask again and I will create the trigger.`
+		: `Email triggering is not set up on this instance yet, so no email trigger was created. Ask an instance superadmin to enable it: they need to run an SMTP server that forwards inbound mail to Windmill and set the "email_domain" instance setting. See ${EMAIL_TRIGGER_DOCS}. Once it is configured, ask again and I will create the trigger.`
+	return { available: false, hint }
+}
+
 const createTriggerTool: Tool<any> = {
 	def: createTriggerToolDef,
 	requiresConfirmation: true,
@@ -342,22 +385,52 @@ const createTriggerTool: Tool<any> = {
 				triggerConfig.label
 			)
 
+			let emailDomain: string | undefined
+			if (parsedArgs.kind === 'email') {
+				// `workspaced_local_part` maps to a NOT NULL column; the model may omit it,
+				// so default it here before the request is sent, not just when formatting the address.
+				const emailBody = requestBody as NewEmailTrigger
+				emailBody.workspaced_local_part = emailBody.workspaced_local_part ?? false
+				const availability = await resolveEmailTriggerAvailability()
+				if (!availability.available) {
+					toolCallbacks.setToolStatus(toolId, {
+						content: availability.hint,
+						isLoading: false,
+						needsConfirmation: false
+					})
+					return availability.hint
+				}
+				emailDomain = availability.domain
+			}
+
 			toolCallbacks.setToolStatus(toolId, {
 				content: `Creating ${triggerConfig.label} "${requestBody.path}"...`
 			})
 			try {
 				const result = await triggerConfig.create({ workspace, requestBody } as never)
 				const targetKind = getActionTargetKind(requestBody.is_flow)
+				const emailAddress =
+					parsedArgs.kind === 'email' && emailDomain !== undefined
+						? (await import('$lib/components/triggers/email/utils')).getEmailAddress(
+								(requestBody as NewEmailTrigger).local_part,
+								(requestBody as NewEmailTrigger).workspaced_local_part ?? false,
+								workspace,
+								emailDomain
+							)
+						: undefined
 				const toolResult = {
 					success: true,
 					kind: parsedArgs.kind,
 					path: requestBody.path,
 					target_path: requestBody.script_path,
 					target_kind: targetKind,
-					backend_result: result
+					backend_result: result,
+					...(emailAddress ? { email_address: emailAddress } : {})
 				}
 				toolCallbacks.setToolStatus(toolId, {
-					content: `Created ${triggerConfig.label} "${requestBody.path}"`,
+					content: emailAddress
+						? `Created ${triggerConfig.label} "${requestBody.path}" (send email to ${emailAddress})`
+						: `Created ${triggerConfig.label} "${requestBody.path}"`,
 					result: toolResult,
 					actions: [
 						createOpenTriggerAction(
diff --git a/frontend/src/lib/components/copilot/chat/workspaceToolsZod.gen.ts b/frontend/src/lib/components/copilot/chat/workspaceToolsZod.gen.ts
index 79883d2dd9..6aa40bce75 100644
--- a/frontend/src/lib/components/copilot/chat/workspaceToolsZod.gen.ts
+++ b/frontend/src/lib/components/copilot/chat/workspaceToolsZod.gen.ts
@@ -434,6 +434,35 @@ export const azureTriggerRequestSchema = z.object({
 	"labels": z.array(z.string()).optional()
 }).describe("Data for creating or updating an Azure Event Grid trigger.")
 
+export const emailTriggerRequestSchema = z.object({
+	"path": z.string(),
+	"script_path": z.string(),
+	"local_part": z.string(),
+	"workspaced_local_part": z.boolean().optional(),
+	"is_flow": z.boolean(),
+	"error_handler_path": z.string().optional(),
+	"error_handler_args": z.record(z.string(), z.any()).describe("The arguments to pass to the script or flow").optional(),
+	"retry": z.object({
+		"constant": z.object({
+			"attempts": z.number().int().describe("Number of retry attempts").optional(),
+			"seconds": z.number().int().describe("Seconds to wait between retries").optional()
+		}).describe("Retry with constant delay between attempts").optional(),
+		"exponential": z.object({
+			"attempts": z.number().int().describe("Number of retry attempts").optional(),
+			"multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(),
+			"seconds": z.number().int().gte(1).describe("Initial delay in seconds").optional(),
+			"random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional()
+		}).describe("Retry with exponential backoff (delay doubles each time)").optional(),
+		"retry_if": z.object({
+			"expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables")
+		}).describe("Conditional retry based on error or result").optional()
+	}).describe("Retry configuration for failed module executions").optional(),
+	"mode": z.enum(["enabled", "disabled", "suspended"]).describe("job trigger mode").optional(),
+	"permissioned_as": z.string().describe("The user or group this trigger runs as. Used during deployment to preserve the original trigger owner.").optional(),
+	"preserve_permissioned_as": z.boolean().describe("When true and the caller is a member of the 'wm_deployers' group, preserves the original permissioned_as value instead of overwriting it.").optional(),
+	"labels": z.array(z.string()).optional()
+})
+
 export const variableRequestSchema = z.object({
 	"path": z.string().describe("The path to the variable"),
 	"value": z.string().describe("The value of the variable"),
@@ -466,6 +495,7 @@ export const triggerRequestSchemas = {
 	sqs: sqsTriggerRequestSchema,
 	gcp: gcpTriggerRequestSchema,
 	azure: azureTriggerRequestSchema,
+	email: emailTriggerRequestSchema,
 } as const
 
 const triggerPathSchema = z.string().min(1).describe("The unique Windmill path for this trigger. Must be of the form `u/<user>/<path>` or `f/<folder>/<path>`. This is the trigger object path, not the HTTP route path.")
@@ -482,6 +512,7 @@ export const createTriggerToolSchema = z.object({
 		"sqs",
 		"gcp",
 		"azure",
+		"email",
 	]),
 	path: triggerPathSchema,
 	config: z.union([
@@ -495,5 +526,6 @@ export const createTriggerToolSchema = z.object({
 		sqsTriggerRequestSchema.omit({ path: true, script_path: true, is_flow: true }),
 		gcpTriggerRequestSchema.omit({ path: true, script_path: true, is_flow: true }),
 		azureTriggerRequestSchema.omit({ path: true, script_path: true, is_flow: true }),
+		emailTriggerRequestSchema.omit({ path: true, script_path: true, is_flow: true }),
 	])
 })
diff --git a/system_prompts/generate.py b/system_prompts/generate.py
index d315e3a97b..3ee993147e 100644
--- a/system_prompts/generate.py
+++ b/system_prompts/generate.py
@@ -832,6 +832,7 @@ WORKSPACE_TOOL_ZOD_SCHEMAS = [
     ('NewSqsTrigger', 'sqsTriggerRequestSchema'),
     ('GcpTriggerData', 'gcpTriggerRequestSchema'),
     ('AzureTriggerData', 'azureTriggerRequestSchema'),
+    ('NewEmailTrigger', 'emailTriggerRequestSchema'),
     ('CreateVariable', 'variableRequestSchema'),
     ('CreateResource', 'resourceRequestSchema'),
 ]
@@ -847,6 +848,7 @@ WORKSPACE_TOOL_TRIGGER_SCHEMAS = [
     ('sqs', 'sqsTriggerRequestSchema'),
     ('gcp', 'gcpTriggerRequestSchema'),
     ('azure', 'azureTriggerRequestSchema'),
+    ('email', 'emailTriggerRequestSchema'),
 ]
 
 WORKSPACE_TOOL_ZOD_OUTPUT_PATH = (

From 6de4ec0f665ad856002495c4d86269105ec28ad7 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Thu, 23 Jul 2026 01:16:55 +0200
Subject: [PATCH 127/171] chore(main): release 1.767.0 (#10268)

* chore(main): release 1.767.0

* Apply automatic changes

---------

Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>
---
 CHANGELOG.md                                  |  15 ++
 backend/Cargo.lock                            | 158 +++++++++---------
 backend/Cargo.toml                            |   4 +-
 .../parsers/windmill-parser-wasm/Cargo.lock   |  48 +++---
 .../parsers/windmill-parser-wasm/Cargo.toml   |   2 +-
 backend/windmill-api/openapi.yaml             |   2 +-
 benchmarks/lib.ts                             |   2 +-
 cli/src/core/constants.ts                     |   2 +-
 frontend/package-lock.json                    |   4 +-
 frontend/package.json                         |   2 +-
 lsp/Pipfile                                   |   2 +-
 openflow.openapi.yaml                         |   2 +-
 .../WindmillClient/WindmillClient.psd1        |   2 +-
 python-client/wmill/pyproject.toml            |   2 +-
 typescript-client/jsr.json                    |   2 +-
 typescript-client/package.json                |   2 +-
 version.txt                                   |   2 +-
 17 files changed, 134 insertions(+), 119 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5f0d9b7d28..01b01f9c09 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,20 @@
 # Changelog
 
+## [1.767.0](https://github.com/windmill-labs/windmill/compare/v1.766.2...v1.767.0) (2026-07-22)
+
+
+### Features
+
+* **ai-chat:** email triggers in flow/script chat + trigger-intent eval guards (WIN-2228) ([#10267](https://github.com/windmill-labs/windmill/issues/10267)) ([e41440b](https://github.com/windmill-labs/windmill/commit/e41440b344d94ebe5746a89237c3d1be522aa59d))
+* **ai:** improve data-pipeline building in AI sessions (prompt + evals + e2e) ([#10270](https://github.com/windmill-labs/windmill/issues/10270)) ([0819641](https://github.com/windmill-labs/windmill/commit/0819641f3a89abdf114cc5e341a9f585e5d71296))
+
+
+### Bug Fixes
+
+* **ai-chat:** improve resource-type search tool description and scoring ([#10272](https://github.com/windmill-labs/windmill/issues/10272)) ([ad53673](https://github.com/windmill-labs/windmill/commit/ad53673a2855e787af9fe10dcc8998ffc7f1b960))
+* **embeddings:** retry on failed init instead of disabling for a day ([#10266](https://github.com/windmill-labs/windmill/issues/10266)) ([2318481](https://github.com/windmill-labs/windmill/commit/2318481f4f2932dc578d5cb64c4c705cf5c324a0))
+* manual resource type sync fetches from hub first, cache as fallback ([#10269](https://github.com/windmill-labs/windmill/issues/10269)) ([07d4b67](https://github.com/windmill-labs/windmill/commit/07d4b674f1dbd24c89f7d1e77094a40e528a3740))
+
 ## [1.766.2](https://github.com/windmill-labs/windmill/compare/v1.766.1...v1.766.2) (2026-07-22)
 
 
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index d4e181ff52..7ac3d692c9 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -14479,7 +14479,7 @@ dependencies = [
 
 [[package]]
 name = "windmill"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -14564,7 +14564,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-ai"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "async-stream",
  "async-trait",
@@ -14597,7 +14597,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-alerting"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14610,7 +14610,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "argon2",
@@ -14749,7 +14749,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-agent-workers"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14772,7 +14772,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-assets"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14787,7 +14787,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-auth"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14813,7 +14813,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "reqwest 0.12.28",
  "serde",
@@ -14823,7 +14823,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-configs"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14840,7 +14840,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-debug"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "axum 0.8.9",
  "base64 0.22.1",
@@ -14862,7 +14862,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-embeddings"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14885,7 +14885,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flow-conversations"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14901,7 +14901,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flows"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14922,7 +14922,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-groups"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14943,7 +14943,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-inputs"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14957,7 +14957,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-integration-tests"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -14992,7 +14992,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-jobs"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15017,7 +15017,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-npm-proxy"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "axum 0.8.9",
  "flate2",
@@ -15035,7 +15035,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-openapi"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15057,7 +15057,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-schedule"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15077,7 +15077,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-scripts"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15114,7 +15114,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-settings"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15142,7 +15142,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-sse"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "lazy_static",
  "serde",
@@ -15154,7 +15154,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-users"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "argon2",
  "axum 0.8.9",
@@ -15179,7 +15179,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workers"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15193,7 +15193,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workspaces"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15228,7 +15228,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -15242,7 +15242,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15261,7 +15261,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "aes-gcm",
  "aho-corasick",
@@ -15364,7 +15364,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-dep-map"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "chrono",
  "itertools 0.14.0",
@@ -15383,7 +15383,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "regex",
  "serde",
@@ -15398,7 +15398,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "astral-tokio-tar",
@@ -15422,7 +15422,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-jseval"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -15439,7 +15439,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -15455,7 +15455,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-mcp"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15476,7 +15476,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-native-triggers"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15507,7 +15507,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-oauth"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "arc-swap",
@@ -15532,7 +15532,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-object-store"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "async-stream",
@@ -15566,7 +15566,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-operator"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -15584,7 +15584,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -15593,7 +15593,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15605,7 +15605,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15617,7 +15617,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -15629,7 +15629,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15641,7 +15641,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15653,7 +15653,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -15664,7 +15664,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15675,7 +15675,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15687,7 +15687,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -15698,7 +15698,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15720,7 +15720,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15732,7 +15732,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15746,7 +15746,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -15763,7 +15763,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15776,7 +15776,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -15788,7 +15788,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15806,7 +15806,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -15822,7 +15822,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -15838,7 +15838,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -15849,7 +15849,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15888,7 +15888,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-runtime-nativets"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "const_format",
@@ -15928,7 +15928,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "getrandom 0.3.4",
  "wasm-bindgen",
@@ -15939,7 +15939,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-store"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15973,7 +15973,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-test-utils"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15997,7 +15997,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16030,7 +16030,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-amqp"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16057,7 +16057,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-azure"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16090,7 +16090,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-email"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16110,7 +16110,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-gcp"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16144,7 +16144,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-http"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16180,7 +16180,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-kafka"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16203,7 +16203,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-mqtt"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16227,7 +16227,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-nats"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -16251,7 +16251,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-postgres"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16286,7 +16286,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-sqs"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16314,7 +16314,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-websocket"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16339,7 +16339,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "bitflags 2.13.1",
@@ -16358,7 +16358,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "async-once-cell",
@@ -16473,7 +16473,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker-volumes"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "bytes",
  "futures",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index d5f94be93d..4a1e2300fb 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.766.2"
+version = "1.767.0"
 authors.workspace = true
 edition.workspace = true
 
@@ -88,7 +88,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal", "./parsers/windmill-parser-wasm"]
 
 [workspace.package]
-version = "1.766.2"
+version = "1.767.0"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.lock b/backend/parsers/windmill-parser-wasm/Cargo.lock
index 0e05880c5b..c6cc54c97e 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.lock
+++ b/backend/parsers/windmill-parser-wasm/Cargo.lock
@@ -6191,7 +6191,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill-common"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "aho-corasick",
  "anyhow",
@@ -6272,7 +6272,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -6284,7 +6284,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "convert_case",
  "serde",
@@ -6293,7 +6293,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6305,7 +6305,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6317,7 +6317,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -6329,7 +6329,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6341,7 +6341,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6353,7 +6353,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -6364,7 +6364,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6375,7 +6375,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6387,7 +6387,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6398,7 +6398,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -6420,7 +6420,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6432,7 +6432,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6446,7 +6446,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "convert_case",
@@ -6463,7 +6463,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6476,7 +6476,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -6488,7 +6488,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6506,7 +6506,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -6522,7 +6522,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6538,7 +6538,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wasm"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "getrandom 0.2.17",
@@ -6570,7 +6570,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -6581,7 +6581,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.766.2"
+version = "1.767.0"
 dependencies = [
  "anyhow",
  "bitflags",
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.toml b/backend/parsers/windmill-parser-wasm/Cargo.toml
index 097057f582..c4b4ce0993 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.toml
+++ b/backend/parsers/windmill-parser-wasm/Cargo.toml
@@ -12,7 +12,7 @@ resolver = "2"
 members = ["."]
 
 [workspace.package]
-version = "1.766.2"
+version = "1.767.0"
 edition = "2021"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 9d81252f06..14183609af 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.766.2
+  version: 1.767.0
   title: Windmill API
 
   contact:
diff --git a/benchmarks/lib.ts b/benchmarks/lib.ts
index f3c0b9ef2e..cded479b5e 100644
--- a/benchmarks/lib.ts
+++ b/benchmarks/lib.ts
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.766.2";
+export const VERSION = "v1.767.0";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({
diff --git a/cli/src/core/constants.ts b/cli/src/core/constants.ts
index 52efabe215..0ca15dc0f7 100644
--- a/cli/src/core/constants.ts
+++ b/cli/src/core/constants.ts
@@ -10,4 +10,4 @@ export const WM_FORK_PREFIX = "wm-fork";
 // (e.g. utils.ts) can read it without importing main.ts and creating a circular
 // dependency (main → workspace → utils → main) that triggers a TDZ.
 // Re-exported from main.ts for backwards compatibility.
-export const VERSION = "1.766.2";
+export const VERSION = "1.767.0";
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 38b1a4bae3..bc3ab79c34 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.766.2",
+	"version": "1.767.0",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "@windmill-labs/components",
-			"version": "1.766.2",
+			"version": "1.767.0",
 			"hasInstallScript": true,
 			"license": "AGPL-3.0",
 			"dependencies": {
diff --git a/frontend/package.json b/frontend/package.json
index f322f9efe4..128dd97f02 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.766.2",
+	"version": "1.767.0",
 	"scripts": {
 		"dev": "vite dev",
 		"dev:ui-builder": "mv static/ui_builder static/ui_builder.dev-disabled 2>/dev/null || true ; trap 'mv static/ui_builder.dev-disabled static/ui_builder 2>/dev/null || true' EXIT ; vite dev",
diff --git a/lsp/Pipfile b/lsp/Pipfile
index 02ee4c0626..60a8bf6700 100644
--- a/lsp/Pipfile
+++ b/lsp/Pipfile
@@ -4,7 +4,7 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-wmill = ">=1.766.2"
+wmill = ">=1.767.0"
 sendgrid = "*"
 mysql-connector-python = "*"
 pymongo = "*"
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index 46727bb8cf..9cf2c96fbe 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1,7 +1,7 @@
 openapi: '3.0.3'
 
 info:
-  version: 1.766.2
+  version: 1.767.0
   title: OpenFlow Spec
   contact:
     name: Ruben Fiszel
diff --git a/powershell-client/WindmillClient/WindmillClient.psd1 b/powershell-client/WindmillClient/WindmillClient.psd1
index 2ff2fb69c0..67b97a9696 100644
--- a/powershell-client/WindmillClient/WindmillClient.psd1
+++ b/powershell-client/WindmillClient/WindmillClient.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'WindmillClient.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '1.766.2'
+    ModuleVersion     = '1.767.0'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()
diff --git a/python-client/wmill/pyproject.toml b/python-client/wmill/pyproject.toml
index 2d95e9e12d..448e108d7d 100644
--- a/python-client/wmill/pyproject.toml
+++ b/python-client/wmill/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill"
-version = "1.766.2"
+version = "1.767.0"
 description = "A client library for accessing Windmill server wrapping the Windmill client API"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/typescript-client/jsr.json b/typescript-client/jsr.json
index 7cfeaf3549..b347759a9c 100644
--- a/typescript-client/jsr.json
+++ b/typescript-client/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@windmill/windmill",
-  "version": "1.766.2",
+  "version": "1.767.0",
   "exports": "./src/index.ts",
   "publish": {
     "exclude": ["!src", "./s3Types.ts", "./sqlUtils.ts", "./client.ts"]
diff --git a/typescript-client/package.json b/typescript-client/package.json
index 109c56e36b..0a89406e0e 100644
--- a/typescript-client/package.json
+++ b/typescript-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.766.2",
+  "version": "1.767.0",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "homepage": "https://github.com/windmill-labs/windmill/tree/main/typescript-client#readme",
diff --git a/version.txt b/version.txt
index ad7d31ec90..3ef5bceeb2 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.766.2
+1.767.0

From d7a0078b58f74f1ffecc03b348e8935a70f02e55 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Thu, 23 Jul 2026 10:19:30 +0200
Subject: [PATCH 128/171] =?UTF-8?q?fix(resources):=20apply=20resource=5Fty?=
 =?UTF-8?q?pe=20changes=20on=20update=20(git-sync=20pull)=20=E2=80=94=20Fi?=
 =?UTF-8?q?xes=20GIT-932=20(#10277)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix(resources): apply resource_type changes on update (git-sync pull)

The OpenAPI spec and generated CLI client both declare `resource_type` on
EditResource, but the backend's EditResource struct omitted the field, so
serde silently dropped it and update_resource never changed a resource's
type. Switching a resource between two types in git and pulling back into
the workspace therefore left the workspace out of sync with git (GIT-932).

Add resource_type to EditResource and persist it in the UPDATE.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* test(resources): trim resource_type regression comment to durable rationale

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../tests/resources.rs                              | 13 +++++++++++++
 backend/windmill-store/src/resources.rs             |  4 ++++
 2 files changed, 17 insertions(+)

diff --git a/backend/windmill-api-integration-tests/tests/resources.rs b/backend/windmill-api-integration-tests/tests/resources.rs
index cc78056176..3cc59be473 100644
--- a/backend/windmill-api-integration-tests/tests/resources.rs
+++ b/backend/windmill-api-integration-tests/tests/resources.rs
@@ -275,6 +275,19 @@ async fn test_resource_endpoints(db: Pool<Postgres>) -> anyhow::Result<()> {
     let body = resp.json::<serde_json::Value>().await?;
     assert_eq!(body["description"], "Updated description");
 
+    // --- update (resource_type) ---
+    // An update that only changes resource_type must persist it.
+    let resp = authed(client().post(resource_url(port, "update", "u/test-user/new_resource")))
+        .json(&json!({"resource_type": "mcp_server"}))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 200);
+
+    let resp = authed_get(port, "get", "u/test-user/new_resource").await;
+    let body = resp.json::<serde_json::Value>().await?;
+    assert_eq!(body["resource_type"], "mcp_server");
+
     // --- update_value ---
     let resp = authed(client().post(resource_url(
         port,
diff --git a/backend/windmill-store/src/resources.rs b/backend/windmill-store/src/resources.rs
index 8f20e2afb6..4ccf364cf8 100644
--- a/backend/windmill-store/src/resources.rs
+++ b/backend/windmill-store/src/resources.rs
@@ -184,6 +184,7 @@ struct EditResource {
     path: Option<String>,
     description: Option<String>,
     value: Option<Box<RawValue>>,
+    resource_type: Option<String>,
     labels: Option<Vec<String>>,
     ws_specific: Option<bool>,
 }
@@ -1713,6 +1714,9 @@ async fn update_resource(
     if let Some(nvalue) = &ns.value {
         sqlb.set_str("value", nvalue.to_string());
     }
+    if let Some(nrt) = &ns.resource_type {
+        sqlb.set_str("resource_type", nrt);
+    }
     if let Some(ndesc) = ns.description {
         sqlb.set_str("description", ndesc);
     }

From c50a2abad0c222bf8f76ff10b864450120ee9ee7 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Thu, 23 Jul 2026 10:39:38 +0200
Subject: [PATCH 129/171] fix(jobs): sanitize NUL in completed job result
 before jsonb insert (#10274)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Summary

A job whose result contains a real NUL (U+0000) serializes to a `\u0000` JSON escape that the `jsonb`-typed `v2_job_completed.result` column rejects with Postgres `22P05` ("unsupported Unicode escape sequence"). This aborts the `INSERT` in `commit_completed_job`, which then retries 10 times and leaves the job unable to complete (surfaced as `Could not add completed job <id>: ... unsupported Unicode escape sequence`).

The fix sanitizes the serialized result immediately before the insert, with effectively zero overhead on the common NUL-free path.

## Changes

- **Promote `strip_json_nul` into `windmill-common`** (`utils.rs`): `fn strip_json_nul(&str) -> Cow<str>` — a `contains("\\u0000")` fast guard returns the input borrowed when clean; only a genuine odd-parity NUL escape triggers the O(n) rebuild. `Cow::Owned` is returned **only** when a NUL was actually stripped, so a legitimate `\\u0000` (escaped backslash + literal text) borrows through untouched. Replaces the two duplicated copies previously in `windmill-api/src/drafts.rs` (`strip_json_nul`) and `windmill-api/src/apps.rs` (`strip_null_chars`); both call sites now use the shared helper.
- **Add `serialized_json()` to the `ValidableJson` trait** (`windmill-queue/src/jobs.rs`): `Box<RawValue>` returns `Cow::Borrowed(self.get())` (zero-cost, already serialized); other impls serialize on demand via `to_raw_value`.
- **`commit_completed_job`** binds `strip_json_nul(result.serialized_json())` as `$3::text::jsonb` in both the `INSERT ... SELECT` and the `ON CONFLICT ... result = $3` (was `result as Json<&T>`). Stored data is unchanged (Postgres parses JSON text into `jsonb` identically); `wm_labels`/`result_metadata` still operate on the typed `T`.
- **Regenerated the sqlx offline cache** (one query file swapped; EE caches preserved).
- **Doc:** updated the stale `strip_null_chars` reference in `windmill-api-workspaces/src/workspaces.rs` to point at the shared `strip_json_nul`.

## Test plan

- [x] `cargo check -p windmill-queue -p windmill-api -p windmill-common -p windmill-api-workspaces` — clean, no warnings
- [x] `strip_json_nul` unit tests in `windmill-common` (clean-borrow, real-NUL, legit-escape borrow no-op, collision, nested keys/values, odd-run): 6 passed
- [x] End-to-end regression in `backend/tests/nativets_jobs.rs` (`--features deno_core`): a JS job returning a genuine NUL and a literal `\\u0000` completes, storing `"ab"` (stripped) and `"a\\u0000b"` (preserved). Without the fix the insert aborts and the job never completes.
- [x] `backend/tests/drafts_nul.rs` integration test still passes (helper refactor intact)
---
 ...79c19880e4d66dbf4dd5391f053b6dfa6b01.json} |   6 +-
 backend/Cargo.lock                            |   1 +
 backend/tests/nativets_jobs.rs                |  37 +++++
 .../windmill-api-workspaces/src/workspaces.rs |   2 +-
 backend/windmill-api/src/apps.rs              | 109 +--------------
 backend/windmill-api/src/drafts.rs            | 114 +---------------
 backend/windmill-common/Cargo.toml            |   1 +
 backend/windmill-common/src/utils.rs          | 129 ++++++++++++++++++
 backend/windmill-queue/src/jobs.rs            |  53 ++++++-
 9 files changed, 226 insertions(+), 226 deletions(-)
 rename backend/.sqlx/{query-36c4e57afcab22f4b6825ccebe47767b8a8fe0a638250f7c7777e5a9f7530e5c.json => query-042ff3003bf82d11a78a1074a63379c19880e4d66dbf4dd5391f053b6dfa6b01.json} (57%)

diff --git a/backend/.sqlx/query-36c4e57afcab22f4b6825ccebe47767b8a8fe0a638250f7c7777e5a9f7530e5c.json b/backend/.sqlx/query-042ff3003bf82d11a78a1074a63379c19880e4d66dbf4dd5391f053b6dfa6b01.json
similarity index 57%
rename from backend/.sqlx/query-36c4e57afcab22f4b6825ccebe47767b8a8fe0a638250f7c7777e5a9f7530e5c.json
rename to backend/.sqlx/query-042ff3003bf82d11a78a1074a63379c19880e4d66dbf4dd5391f053b6dfa6b01.json
index e810fc4754..fef2943c22 100644
--- a/backend/.sqlx/query-36c4e57afcab22f4b6825ccebe47767b8a8fe0a638250f7c7777e5a9f7530e5c.json
+++ b/backend/.sqlx/query-042ff3003bf82d11a78a1074a63379c19880e4d66dbf4dd5391f053b6dfa6b01.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "INSERT INTO v2_job_completed AS cj\n                    ( workspace_id\n                    , id\n                    , started_at\n                    , duration_ms\n                    , result\n                    , result_columns\n                    , canceled_by\n                    , canceled_reason\n                    , flow_status\n                    , workflow_as_code_status\n                    , memory_peak\n                    , status\n                    , worker\n                    )\n                SELECT q.workspace_id, q.id, started_at, COALESCE($9::bigint, (EXTRACT('epoch' FROM (now())) - EXTRACT('epoch' FROM (COALESCE(started_at, now()))))*1000), $3, $10, $5, $6,\n                        flow_status, workflow_as_code_status,\n                        $8, CASE WHEN $4::BOOL THEN 'canceled'::job_status\n                        WHEN $7::BOOL THEN 'skipped'::job_status\n                        WHEN $2::BOOL THEN 'success'::job_status\n                        ELSE 'failure'::job_status END AS status,\n                        q.worker\n                FROM v2_job_queue q LEFT JOIN v2_job_status USING (id) WHERE q.id = $1\n            ON CONFLICT (id) DO UPDATE SET status = EXCLUDED.status, result = $3 RETURNING duration_ms AS \"duration_ms!\"",
+  "query": "INSERT INTO v2_job_completed AS cj\n                    ( workspace_id\n                    , id\n                    , started_at\n                    , duration_ms\n                    , result\n                    , result_columns\n                    , canceled_by\n                    , canceled_reason\n                    , flow_status\n                    , workflow_as_code_status\n                    , memory_peak\n                    , status\n                    , worker\n                    )\n                SELECT q.workspace_id, q.id, started_at, COALESCE($9::bigint, (EXTRACT('epoch' FROM (now())) - EXTRACT('epoch' FROM (COALESCE(started_at, now()))))*1000), $3::text::jsonb, $10, $5, $6,\n                        flow_status, workflow_as_code_status,\n                        $8, CASE WHEN $4::BOOL THEN 'canceled'::job_status\n                        WHEN $7::BOOL THEN 'skipped'::job_status\n                        WHEN $2::BOOL THEN 'success'::job_status\n                        ELSE 'failure'::job_status END AS status,\n                        q.worker\n                FROM v2_job_queue q LEFT JOIN v2_job_status USING (id) WHERE q.id = $1\n            ON CONFLICT (id) DO UPDATE SET status = EXCLUDED.status, result = $3::text::jsonb RETURNING duration_ms AS \"duration_ms!\"",
   "describe": {
     "columns": [
       {
@@ -13,7 +13,7 @@
       "Left": [
         "Uuid",
         "Bool",
-        "Jsonb",
+        "Text",
         "Bool",
         "Varchar",
         "Text",
@@ -27,5 +27,5 @@
       false
     ]
   },
-  "hash": "36c4e57afcab22f4b6825ccebe47767b8a8fe0a638250f7c7777e5a9f7530e5c"
+  "hash": "042ff3003bf82d11a78a1074a63379c19880e4d66dbf4dd5391f053b6dfa6b01"
 }
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index 7ac3d692c9..0539483ee5 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -15305,6 +15305,7 @@ dependencies = [
  "lazy_static",
  "magic-crypt",
  "mail-send",
+ "memchr",
  "native-tls",
  "once_cell",
  "openidconnect",
diff --git a/backend/tests/nativets_jobs.rs b/backend/tests/nativets_jobs.rs
index 610d0c5ea8..ff871e2da6 100644
--- a/backend/tests/nativets_jobs.rs
+++ b/backend/tests/nativets_jobs.rs
@@ -263,6 +263,43 @@ export function main(): number[] {
         );
     }
 
+    // -- result + wm_labels carrying a NUL: must complete, jsonb-safe & text[]-safe --
+    {
+        // `\u0000` here is 6 literal chars in the raw string; the JS runtime emits
+        // a real U+0000. It aborts the jsonb result insert (22P05) and, via
+        // wm_labels, the `text[]` labels update - both in the completion tx.
+        // `nul`/label come back stripped; `literal` (escaped backslash + text
+        // "u0000", no real NUL) survives untouched.
+        let result = push_and_wait(
+            &db,
+            RunJob::from(nativets_code(
+                r#"//native
+
+export function main(): {nul: string, literal: string, wm_labels: string[]} {
+    return { nul: "a\u0000b", literal: "a\\u0000b", wm_labels: ["x\u0000y"] };
+}
+"#,
+            )),
+            &mut listener,
+        )
+        .await;
+        assert!(result.success, "nul_result failed: {:?}", result.result);
+        let val = result.json_result().unwrap();
+        assert_eq!(val["nul"], serde_json::json!("ab"));
+        assert_eq!(val["literal"], serde_json::json!("a\\u0000b"));
+
+        // The wm_labels entry is persisted to the `text[]` column NUL-free.
+        let labels: Option<Vec<String>> =
+            sqlx::query_scalar("SELECT labels FROM v2_job WHERE id = $1")
+                .bind(result.id)
+                .fetch_one(&db)
+                .await
+                .unwrap();
+        let labels = labels.unwrap_or_default();
+        assert!(labels.iter().any(|l| l == "xy"), "expected stripped label, got {labels:?}");
+        assert!(!labels.iter().any(|l| l.contains('\0')), "labels must be NUL-free: {labels:?}");
+    }
+
     killpill.send();
     Ok(())
 }
diff --git a/backend/windmill-api-workspaces/src/workspaces.rs b/backend/windmill-api-workspaces/src/workspaces.rs
index f3e209c82f..b025261270 100644
--- a/backend/windmill-api-workspaces/src/workspaces.rs
+++ b/backend/windmill-api-workspaces/src/workspaces.rs
@@ -6495,7 +6495,7 @@ async fn enforce_fork_depth(
 
 /// True if `raw` (the text form of a `json` value) contains a genuine `\u0000`
 /// NUL escape: a `u0000` preceded by an ODD run of backslashes. Mirrors the
-/// parity rule in `strip_null_chars` (windmill-api `apps.rs`) — an even run
+/// parity rule in `windmill_common::utils::strip_json_nul` — an even run
 /// (`\\u0000`) is an escaped backslash then the literal text "u0000" (common in
 /// minified JS) and is jsonb-safe. A genuine NUL is exactly what the
 /// `json`→`jsonb` re-encode in `clone_apps` / `clone_flows` rejects with
diff --git a/backend/windmill-api/src/apps.rs b/backend/windmill-api/src/apps.rs
index 0a59d5f72f..e8ac1340ca 100644
--- a/backend/windmill-api/src/apps.rs
+++ b/backend/windmill-api/src/apps.rs
@@ -69,7 +69,7 @@ use windmill_common::{
     users::username_to_permissioned_as,
     utils::{
         http_get_from_hub, not_found_if_none, paginate, query_elems_from_hub, require_admin,
-        Pagination, RunnableKind, StripPath,
+        strip_json_nul, Pagination, RunnableKind, StripPath,
     },
     variables::{build_crypt, build_crypt_with_key_suffix, encrypt},
     worker::{to_raw_value, CLOUD_HOSTED},
@@ -1828,50 +1828,6 @@ fn custom_path_conflict_error(
     }
 }
 
-/// App values live in a `json` column, which — unlike `jsonb` — accepts the
-/// `\u0000` escape. Any later `json`→`jsonb` conversion (a workspace fork's
-/// `clone_apps`, search indexing, …) then aborts with "unsupported Unicode
-/// escape sequence". Strip genuine NULs so the value is jsonb-safe before it
-/// lands in the DB; the usual source is a binary file such as `.DS_Store`
-/// accidentally bundled into a raw app's file map. A real NUL is unstorable
-/// either way, and frontend code that needs the character writes it as the
-/// source escape `\u0000`, which JSON-encodes to `\\u0000` (an escaped
-/// backslash — the even-parity case below) and is left untouched.
-///
-/// Returns `Cow::Borrowed` (no allocation) when the value is already clean.
-fn strip_null_chars(raw: &str) -> Cow<'_, str> {
-    let bytes = raw.as_bytes();
-    let mut out: Option<String> = None;
-    let mut copied_to = 0;
-    let mut search_from = 0;
-    // A genuine NUL is `\u0000`: a `u0000` introduced by an *odd* run of
-    // backslashes. An even run (`\\u0000`) is an escaped backslash then the
-    // literal text "u0000" (common in minified JS regexes) and is preserved.
-    while let Some(rel) = raw[search_from..].find("u0000") {
-        let at = search_from + rel;
-        let mut backslashes = 0;
-        let mut j = at;
-        while j > 0 && bytes[j - 1] == b'\\' {
-            backslashes += 1;
-            j -= 1;
-        }
-        if backslashes % 2 == 1 {
-            // Drop the escaping backslash + `u0000` — the 6 chars in [at-1, at+5).
-            let out = out.get_or_insert_with(String::new);
-            out.push_str(&raw[copied_to..at - 1]);
-            copied_to = at + 5;
-        }
-        search_from = at + 5;
-    }
-    match out {
-        Some(mut out) => {
-            out.push_str(&raw[copied_to..]);
-            Cow::Owned(out)
-        }
-        None => Cow::Borrowed(raw),
-    }
-}
-
 async fn create_app_internal<'a>(
     authed: ApiAuthed,
     db: sqlx::Pool<sqlx::Postgres>,
@@ -2017,7 +1973,7 @@ async fn create_app_internal<'a>(
     .await?;
     // `.get()` keeps the raw text (and thus key order); strip any NUL so the
     // `json`→`jsonb` conversion downstream (fork, indexing) can't choke on it.
-    let value = strip_null_chars(app.value.0.get());
+    let value = strip_json_nul(app.value.0.get());
     if matches!(value, Cow::Owned(_)) {
         tracing::warn!(path = %app.path, "stripped NUL character(s) from app value on create");
     }
@@ -2602,7 +2558,7 @@ async fn update_app_internal<'a>(
 
         // `.get()` keeps the raw text (and thus key order); strip any NUL so the
         // `json`→`jsonb` conversion downstream (fork, indexing) can't choke on it.
-        let value = strip_null_chars(nvalue.0.get());
+        let value = strip_json_nul(nvalue.0.get());
         if matches!(value, Cow::Owned(_)) {
             tracing::warn!(path = %npath, "stripped NUL character(s) from app value on update");
         }
@@ -4841,62 +4797,3 @@ mod embed_token_tests {
         assert!(parse_embed_policy("not json").is_err());
     }
 }
-
-#[cfg(test)]
-mod strip_null_chars_tests {
-    use super::strip_null_chars;
-    use std::borrow::Cow;
-
-    // Build `{"k":"<n backslashes>u0000"}` without writing the escape literally
-    // (a real NUL can't live in Rust source). Odd n => the trailing `u0000` is a
-    // genuine NUL escape; even n => an escaped backslash then the text "u0000".
-    fn doc(backslashes: usize) -> String {
-        format!(r#"{{"k":"{}u0000"}}"#, "\\".repeat(backslashes))
-    }
-
-    #[test]
-    fn strips_genuine_null_escape() {
-        // 1 backslash: the NUL escape is dropped, the string value becomes "".
-        assert_eq!(strip_null_chars(&doc(1)).as_ref(), r#"{"k":""}"#);
-        // 3 backslashes: escaped backslash + NUL -> keep the escaped backslash.
-        let three = doc(3);
-        let out = strip_null_chars(&three);
-        assert_eq!(out.as_ref(), r#"{"k":"\\"}"#);
-        // Result is now valid, NUL-free JSON (i.e. jsonb-safe).
-        let v: serde_json::Value = serde_json::from_str(out.as_ref()).unwrap();
-        assert!(!v["k"].as_str().unwrap().as_bytes().contains(&0u8));
-    }
-
-    #[test]
-    fn preserves_escaped_backslash_then_literal_u0000() {
-        // Even runs are the literal text "u0000" (e.g. a minified JS regex char
-        // class) and must be returned untouched, with no allocation.
-        for n in [2usize, 4] {
-            let s = doc(n);
-            let out = strip_null_chars(&s);
-            assert_eq!(out.as_ref(), s.as_str());
-            assert!(matches!(out, Cow::Borrowed(_)), "n={n} should be borrowed");
-        }
-    }
-
-    #[test]
-    fn preserves_clean_values() {
-        // Plain value, and the bare token "u0000" with no preceding backslash.
-        for s in [r#"{"files":{"/index.tsx":"hello"}}"#, r#"{"k":"u0000"}"#] {
-            let out = strip_null_chars(s);
-            assert_eq!(out.as_ref(), s);
-            assert!(matches!(out, Cow::Borrowed(_)));
-        }
-        // The escape for a literal backslash char (`u005c`) then text "u0000":
-        // the only "u0000" match is preceded by `c` (0 backslashes) -> no NUL.
-        let s = format!(r#"{{"k":"{}u005cu0000"}}"#, "\\");
-        assert!(matches!(strip_null_chars(&s), Cow::Borrowed(_)));
-    }
-
-    #[test]
-    fn strips_multiple_and_preserves_surrounding() {
-        // Mirrors the .DS_Store case: several NULs interleaved with real text.
-        let s = format!(r#"{{"a":"x{b}u0000{b}u0000y","b":"ok"}}"#, b = "\\");
-        assert_eq!(strip_null_chars(&s).as_ref(), r#"{"a":"xy","b":"ok"}"#);
-    }
-}
diff --git a/backend/windmill-api/src/drafts.rs b/backend/windmill-api/src/drafts.rs
index a4ebf74ec0..b44b0e64be 100644
--- a/backend/windmill-api/src/drafts.rs
+++ b/backend/windmill-api/src/drafts.rs
@@ -19,6 +19,7 @@ use windmill_common::{
     error::{Error, Result},
     user_drafts::{DraftUserRef, UserDraftItemKind, ENCRYPTED_DRAFT_PREFIX},
     users::resolve_username_to_email,
+    utils::strip_json_nul,
     variables::{build_crypt, encrypt},
 };
 
@@ -353,7 +354,7 @@ async fn update_draft(
         // `draft.value` is a `json` column, so a U+0000 (NUL) would persist as an
         // escape and later make any `->>`/`to_jsonb` extraction raise `22P05`.
         // Strip it here so a NUL never reaches the column.
-        let serialized = strip_json_nul(serialized);
+        let serialized = strip_json_nul(&serialized);
         // Upsert. The conflict check rides on the DO UPDATE WHERE clause —
         // when the row is newer than `last_sync`, RETURNING yields nothing.
         // `created_at` defaults to `now()` but the migration overrides it ($8)
@@ -371,7 +372,7 @@ async fn update_draft(
             email,
             path,
             kind as UserDraftItemKind,
-            serialized,
+            serialized.as_ref(),
             req.last_sync,
             req.force,
             req.created_at,
@@ -521,53 +522,6 @@ async fn migrate_legacy_draft(
     }
 }
 
-/// Remove every U+0000 (NUL) from a serialized JSON document so it is safe to
-/// store in the `json`-typed `draft.value` (a NUL there would later make any
-/// `->>`/`to_jsonb` extraction raise `22P05`).
-///
-/// A NUL can only appear in JSON text as a backslash-u0000 escape, and a
-/// backslash only ever occurs inside a string, so one backslash-parity-aware
-/// pass removes every real NUL escape — covering values and keys alike — while
-/// leaving a legitimate `\\u0000` (an escaped backslash followed by the literal
-/// text `u0000`) intact. O(n) over the bytes with no `serde_json::Value` tree to
-/// allocate, and the fast path (no such substring at all) returns the input
-/// untouched. The slow path is reached not only by genuinely poisoned values but
-/// by any value that legitimately contains `u0000` after a backslash (e.g. script
-/// source), so it must stay allocation-light for potentially large drafts.
-fn strip_json_nul(serialized: String) -> String {
-    if !serialized.contains("\\u0000") {
-        return serialized;
-    }
-    let bytes = serialized.as_bytes();
-    let mut out: Vec<u8> = Vec::with_capacity(bytes.len());
-    let mut i = 0;
-    while i < bytes.len() {
-        if bytes[i] != b'\\' {
-            out.push(bytes[i]);
-            i += 1;
-            continue;
-        }
-        // Consume the whole run of backslashes. An even run is N/2 escaped
-        // backslashes and leaves the next char unescaped; an odd run ends in an
-        // escaping backslash, so a following `u0000` is a real NUL escape.
-        let run_start = i;
-        while i < bytes.len() && bytes[i] == b'\\' {
-            i += 1;
-        }
-        let run = i - run_start;
-        if run % 2 == 1 && bytes[i..].starts_with(b"u0000") {
-            // Drop the escaping backslash + `u0000`; keep the leading literal pairs.
-            out.extend(std::iter::repeat(b'\\').take(run - 1));
-            i += 5;
-        } else {
-            out.extend(std::iter::repeat(b'\\').take(run));
-        }
-    }
-    // Only whole ASCII backslash-u0000 escapes were removed, so the bytes remain
-    // valid UTF-8 (and valid JSON).
-    String::from_utf8(out).expect("removing a NUL escape preserves valid UTF-8")
-}
-
 /// For variable-kind drafts with `variable.is_secret == true`, encrypt
 /// `variable.value` with the workspace crypt key and mark it
 /// `$encrypted:<base64>` so the secret never persists in plaintext at rest.
@@ -859,65 +813,3 @@ async fn require_can_read_path(
     }
     Err(Error::NotFound(format!("no draft visible at {path}")))
 }
-
-#[cfg(test)]
-mod tests {
-    use super::strip_json_nul;
-
-    // Parse the (NUL-free) result so assertions read clearly.
-    fn parsed(s: String) -> serde_json::Value {
-        serde_json::from_str(&s).expect("strip_json_nul must return valid JSON")
-    }
-
-    #[test]
-    fn clean_value_is_returned_byte_for_byte() {
-        let s = r#"{"summary":"all good","n":1}"#.to_string();
-        assert_eq!(strip_json_nul(s.clone()), s);
-    }
-
-    #[test]
-    fn real_nul_in_value_is_stripped() {
-        let out = strip_json_nul(r#"{"summary":"hi\u0000there"}"#.to_string());
-        assert!(!out.contains(r"\u0000"));
-        assert_eq!(parsed(out)["summary"], "hithere");
-    }
-
-    #[test]
-    fn legit_escaped_backslash_is_a_noop() {
-        // JSON "a\\u0000b" decodes to the 8-char string a,backslash,u,0,0,0,0,b
-        // — not a NUL — so the value is already clean and round-trips byte-for-byte.
-        let s = r#"{"summary":"a\\u0000b"}"#.to_string();
-        assert_eq!(strip_json_nul(s.clone()), s);
-    }
-
-    #[test]
-    fn collision_real_and_literal_both_handled() {
-        // "a" carries a real NUL; "b" carries the literal text backslash-u0000.
-        // The value walk strips the former and leaves the latter intact — the
-        // pathological case that needed a fallback in SQL is trivial in Rust.
-        let v = parsed(strip_json_nul(
-            r#"{"a":"x\u0000y","b":"p\\u0000q"}"#.to_string(),
-        ));
-        assert_eq!(v["a"], "xy");
-        assert_eq!(v["b"], "p\\u0000q");
-    }
-
-    #[test]
-    fn nested_values_and_keys_are_cleaned() {
-        let out = strip_json_nul(
-            r#"{"o":{"k\u0000":["a\u0000b",{"deep\u0000":"v\u0000"}]}}"#.to_string(),
-        );
-        assert!(!out.contains(r"\u0000"));
-        let v = parsed(out);
-        assert_eq!(v["o"]["k"][0], "ab");
-        assert_eq!(v["o"]["k"][1]["deep"], "v");
-    }
-
-    #[test]
-    fn odd_backslash_run_keeps_literal_drops_nul() {
-        // JSON "a\\\u0000b" is an escaped backslash (kept) immediately followed by
-        // a real NUL escape (dropped) -> decodes to a,backslash,b.
-        let v = parsed(strip_json_nul(r#"{"x":"a\\\u0000b"}"#.to_string()));
-        assert_eq!(v["x"], "a\\b");
-    }
-}
diff --git a/backend/windmill-common/Cargo.toml b/backend/windmill-common/Cargo.toml
index d91fb209db..e45bba05c3 100644
--- a/backend/windmill-common/Cargo.toml
+++ b/backend/windmill-common/Cargo.toml
@@ -38,6 +38,7 @@ anyhow.workspace = true
 serde.workspace = true
 serde_json.workspace = true
 serde_yml.workspace = true
+memchr.workspace = true
 erased-serde = "0.4"
 chrono.workspace = true
 chrono-tz.workspace = true
diff --git a/backend/windmill-common/src/utils.rs b/backend/windmill-common/src/utils.rs
index 17d9cfd804..a6d1eeaeb0 100644
--- a/backend/windmill-common/src/utils.rs
+++ b/backend/windmill-common/src/utils.rs
@@ -1129,9 +1129,138 @@ pub fn merge_nested_raw_values_to_array<
     serde_json::value::RawValue::from_string(result).unwrap()
 }
 
+/// Remove every U+0000 (NUL) from a serialized JSON document so it is safe to
+/// store in a `jsonb` column, which rejects the `\u0000` escape with 22P05
+/// ("unsupported Unicode escape sequence"). A `json`-typed column accepts the
+/// escape but propagates the same failure to any later `->>`/`to_jsonb`/`json`→
+/// `jsonb` conversion.
+///
+/// A NUL can only appear in JSON text as a backslash-u0000 escape, and a
+/// backslash only ever occurs inside a string, so one backslash-parity-aware
+/// pass removes every real NUL escape — covering values and keys alike — while
+/// leaving a legitimate `\\u0000` (an escaped backslash followed by the literal
+/// text `u0000`, common in minified JS regexes) intact. O(n) over the bytes with
+/// no `serde_json::Value` tree to allocate, and the fast path (no such substring
+/// at all) returns the input borrowed and untouched. The slow path is reached
+/// not only by genuinely poisoned values but by any value that legitimately
+/// contains `u0000` after a backslash (e.g. script source), so it must stay
+/// allocation-light for potentially large documents.
+pub fn strip_json_nul(serialized: &str) -> Cow<'_, str> {
+    // SIMD substring scan (several times faster than `str::contains`'s Two-Way)
+    // for the guard, since this runs on every completed job's serialized result.
+    if memchr::memmem::find(serialized.as_bytes(), b"\\u0000").is_none() {
+        return Cow::Borrowed(serialized);
+    }
+    let bytes = serialized.as_bytes();
+    let mut out: Vec<u8> = Vec::with_capacity(bytes.len());
+    let mut i = 0;
+    // The substring guard above is satisfied by legitimate `\\u0000` too, so only
+    // an odd-parity NUL escape actually drops bytes. Borrow back out when nothing
+    // was stripped, so `Cow::Owned` reliably means "a NUL was removed" — callers
+    // (e.g. apps.rs) key a warning on that.
+    let mut stripped = false;
+    while i < bytes.len() {
+        if bytes[i] != b'\\' {
+            out.push(bytes[i]);
+            i += 1;
+            continue;
+        }
+        // Consume the whole run of backslashes. An even run is N/2 escaped
+        // backslashes and leaves the next char unescaped; an odd run ends in an
+        // escaping backslash, so a following `u0000` is a real NUL escape.
+        let run_start = i;
+        while i < bytes.len() && bytes[i] == b'\\' {
+            i += 1;
+        }
+        let run = i - run_start;
+        if run % 2 == 1 && bytes[i..].starts_with(b"u0000") {
+            // Drop the escaping backslash + `u0000`; keep the leading literal pairs.
+            out.extend(std::iter::repeat(b'\\').take(run - 1));
+            i += 5;
+            stripped = true;
+        } else {
+            out.extend(std::iter::repeat(b'\\').take(run));
+        }
+    }
+    if !stripped {
+        return Cow::Borrowed(serialized);
+    }
+    // Only whole ASCII backslash-u0000 escapes were removed, so the bytes remain
+    // valid UTF-8 (and valid JSON).
+    Cow::Owned(String::from_utf8(out).expect("removing a NUL escape preserves valid UTF-8"))
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
+
+    // The 6-char JSON escape for U+0000: backslash + "u0000". Written via an
+    // escaped backslash so no literal NUL byte ever appears in this source.
+    const NUL_ESC: &str = "\\u0000";
+
+    // Parse the (NUL-free) result so assertions read clearly.
+    fn parsed(s: &str) -> serde_json::Value {
+        serde_json::from_str(s).expect("strip_json_nul must return valid JSON")
+    }
+
+    #[test]
+    fn strip_json_nul_clean_value_is_borrowed_byte_for_byte() {
+        let s = r#"{"summary":"all good","n":1}"#;
+        let out = strip_json_nul(s);
+        assert!(matches!(out, Cow::Borrowed(_)));
+        assert_eq!(out, s);
+    }
+
+    #[test]
+    fn strip_json_nul_real_nul_in_value_is_stripped() {
+        let input = format!(r#"{{"summary":"hi{NUL_ESC}there"}}"#);
+        let out = strip_json_nul(&input);
+        assert!(!out.contains(NUL_ESC));
+        assert_eq!(parsed(&out)["summary"], "hithere");
+    }
+
+    #[test]
+    fn strip_json_nul_legit_escaped_backslash_is_a_noop() {
+        // JSON "a\\u0000b" decodes to a,backslash,u,0,0,0,0,b - not a NUL - so
+        // the value is already clean and round-trips byte-for-byte. It hits the
+        // slow path (the substring is present) but strips nothing, so it must
+        // still return Cow::Borrowed - callers key a "stripped NUL" warning on
+        // the Owned variant.
+        let s = r#"{"summary":"a\\u0000b"}"#;
+        let out = strip_json_nul(s);
+        assert!(matches!(out, Cow::Borrowed(_)));
+        assert_eq!(out, s);
+    }
+
+    #[test]
+    fn strip_json_nul_collision_real_and_literal_both_handled() {
+        // "a" carries a real NUL escape; "b" carries the literal text backslash-u0000.
+        let v = parsed(&strip_json_nul(&format!(
+            r#"{{"a":"x{NUL_ESC}y","b":"p\\u0000q"}}"#
+        )));
+        assert_eq!(v["a"], "xy");
+        assert_eq!(v["b"], "p\\u0000q");
+    }
+
+    #[test]
+    fn strip_json_nul_nested_values_and_keys_are_cleaned() {
+        let input =
+            format!(r#"{{"o":{{"k{NUL_ESC}":["a{NUL_ESC}b",{{"deep{NUL_ESC}":"v{NUL_ESC}"}}]}}}}"#);
+        let out = strip_json_nul(&input);
+        assert!(!out.contains(NUL_ESC));
+        let v = parsed(&out);
+        assert_eq!(v["o"]["k"][0], "ab");
+        assert_eq!(v["o"]["k"][1]["deep"], "v");
+    }
+
+    #[test]
+    fn strip_json_nul_odd_backslash_run_keeps_literal_drops_nul() {
+        // JSON "a\\ b" is an escaped backslash (kept) immediately followed
+        // by a real NUL escape (dropped) -> decodes to a,backslash,b.
+        let v = parsed(&strip_json_nul(&format!(r#"{{"x":"a\\{NUL_ESC}b"}}"#)));
+        assert_eq!(v["x"], "a\\b");
+    }
+
     #[test]
     fn test_build_arg_str() {
         let r = build_arg_str(
diff --git a/backend/windmill-queue/src/jobs.rs b/backend/windmill-queue/src/jobs.rs
index bea3bc1008..4911b08421 100644
--- a/backend/windmill-queue/src/jobs.rs
+++ b/backend/windmill-queue/src/jobs.rs
@@ -25,6 +25,7 @@ use serde::{ser::SerializeMap, Serialize};
 use serde_json::{json, value::RawValue};
 use sqlx::{types::Json, Acquire, Pool, Postgres, Transaction};
 use sqlx::{Encode, PgExecutor};
+use std::borrow::Cow;
 use tokio::sync::mpsc::Sender;
 use tokio::sync::oneshot;
 use tokio::task::JoinHandle;
@@ -49,7 +50,7 @@ use windmill_common::runnable_settings::{
     RunnableSettings, RunnableSettingsTrait,
 };
 use windmill_common::triggers::TriggerMetadata;
-use windmill_common::utils::{calculate_hash, configure_client, now_from_db};
+use windmill_common::utils::{calculate_hash, configure_client, now_from_db, strip_json_nul};
 use windmill_common::worker::{Connection, SCRIPT_TOKEN_EXPIRY};
 
 use windmill_common::otel_oss::{
@@ -634,6 +635,12 @@ pub trait ValidableJson {
     fn wm_failure(&self) -> Option<String>;
     fn result_metadata(&self) -> ResultMetadata;
     fn size(&self) -> usize;
+    /// The result as JSON text, for binding into the `jsonb` `result` column.
+    /// `Box<RawValue>` is already serialized and returns a zero-cost borrow;
+    /// other impls serialize on demand. Callers pass this through
+    /// `strip_json_nul` before the INSERT, since a genuine NUL escape would
+    /// abort the write with 22P05.
+    fn serialized_json(&self) -> Cow<'_, str>;
 }
 
 /// The Windmill-specific markers we look for inside a job's result.
@@ -692,6 +699,10 @@ impl ValidableJson for WrappedError {
     fn size(&self) -> usize {
         0
     }
+
+    fn serialized_json(&self) -> Cow<'_, str> {
+        Cow::Owned(serde_json::to_string(self).unwrap_or_else(|_| "{}".to_string()))
+    }
 }
 
 impl ValidableJson for Box<RawValue> {
@@ -714,6 +725,11 @@ impl ValidableJson for Box<RawValue> {
     fn size(&self) -> usize {
         self.get().len()
     }
+
+    fn serialized_json(&self) -> Cow<'_, str> {
+        // Already serialized JSON text — borrow it, no re-serialization.
+        Cow::Borrowed(self.get())
+    }
 }
 
 impl<T: ValidableJson> ValidableJson for Arc<T> {
@@ -736,6 +752,10 @@ impl<T: ValidableJson> ValidableJson for Arc<T> {
     fn size(&self) -> usize {
         T::size(&self)
     }
+
+    fn serialized_json(&self) -> Cow<'_, str> {
+        T::serialized_json(&self)
+    }
 }
 
 impl ValidableJson for serde_json::Value {
@@ -758,6 +778,10 @@ impl ValidableJson for serde_json::Value {
     fn size(&self) -> usize {
         self.size_hint()
     }
+
+    fn serialized_json(&self) -> Cow<'_, str> {
+        Cow::Owned(serde_json::to_string(self).unwrap_or_else(|_| "{}".to_string()))
+    }
 }
 
 impl<T: ValidableJson> ValidableJson for Json<T> {
@@ -780,6 +804,10 @@ impl<T: ValidableJson> ValidableJson for Json<T> {
     fn size(&self) -> usize {
         self.0.size()
     }
+
+    fn serialized_json(&self) -> Cow<'_, str> {
+        self.0.serialized_json()
+    }
 }
 
 pub async fn register_metric<T, F, F2, R>(
@@ -1089,6 +1117,14 @@ async fn commit_completed_job<T: Serialize + Send + Sync + ValidableJson>(
         .concurrent_limit
         .is_some();
 
+    // A genuine NUL (U+0000) in the result serializes to a `\u0000` escape that
+    // the jsonb `result` column rejects with 22P05 ("unsupported Unicode escape
+    // sequence"), which would abort the whole completion INSERT. Strip it before
+    // binding — near-zero cost when clean: a single scan, and for an
+    // already-serialized `RawValue` result the serialization itself is a borrow.
+    let serialized_result = result.serialized_json();
+    let sanitized_result = strip_json_nul(serialized_result.as_ref());
+
     let mut tx = db.begin().warn_after_seconds(10).await?;
 
     let duration =  sqlx::query_scalar!(
@@ -1107,7 +1143,7 @@ async fn commit_completed_job<T: Serialize + Send + Sync + ValidableJson>(
                     , status
                     , worker
                     )
-                SELECT q.workspace_id, q.id, started_at, COALESCE($9::bigint, (EXTRACT('epoch' FROM (now())) - EXTRACT('epoch' FROM (COALESCE(started_at, now()))))*1000), $3, $10, $5, $6,
+                SELECT q.workspace_id, q.id, started_at, COALESCE($9::bigint, (EXTRACT('epoch' FROM (now())) - EXTRACT('epoch' FROM (COALESCE(started_at, now()))))*1000), $3::text::jsonb, $10, $5, $6,
                         flow_status, workflow_as_code_status,
                         $8, CASE WHEN $4::BOOL THEN 'canceled'::job_status
                         WHEN $7::BOOL THEN 'skipped'::job_status
@@ -1115,10 +1151,10 @@ async fn commit_completed_job<T: Serialize + Send + Sync + ValidableJson>(
                         ELSE 'failure'::job_status END AS status,
                         q.worker
                 FROM v2_job_queue q LEFT JOIN v2_job_status USING (id) WHERE q.id = $1
-            ON CONFLICT (id) DO UPDATE SET status = EXCLUDED.status, result = $3 RETURNING duration_ms AS \"duration_ms!\"",
+            ON CONFLICT (id) DO UPDATE SET status = EXCLUDED.status, result = $3::text::jsonb RETURNING duration_ms AS \"duration_ms!\"",
             /* $1 */ completed_job.id,
             /* $2 */ success,
-            /* $3 */ result as Json<&T>,
+            /* $3 */ sanitized_result.as_ref(),
             /* $4 */ canceled_by.is_some(),
             /* $5 */ canceled_by.clone().map(|cb| cb.username).flatten(),
             /* $6 */ canceled_by.clone().map(|cb| cb.reason).flatten(),
@@ -1156,7 +1192,14 @@ async fn commit_completed_job<T: Serialize + Send + Sync + ValidableJson>(
         }
     };
 
-    if let Some(labels) = result.wm_labels() {
+    if let Some(mut labels) = result.wm_labels() {
+        // A `\u0000` inside a wm_labels entry decodes to a real NUL that the
+        // `text[]` column rejects, which would abort this same transaction (and
+        // roll back the sanitized result insert) exactly like an unsanitized
+        // result. Strip it so the labels match the sanitized result.
+        for label in &mut labels {
+            label.retain(|c| c != '\0');
+        }
         sqlx::query!(
             "UPDATE v2_job SET labels = (
                     SELECT array_agg(DISTINCT all_labels)

From 05157861aae082f75c98660c74b8985dd1c37552 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Thu, 23 Jul 2026 10:45:42 +0200
Subject: [PATCH 130/171] chore(frontend): bump ui_builder to 1f1fe4f (raw-app
 deploy minify + no source map) (#10280)

Picks up windmill-code-ui-builder #22 + #23: the raw-app deploy bundler
(RawAppBundlerHost) now emits a minified bundle with no source map instead of
the editor-preview defaults (unminified + inline base64 map). Deployed raw apps
were being served multi-megabyte bundles by apps_u/get_data, which also
amplified S3 fetch latency into slow app loads. The in-editor preview is
unchanged.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 frontend/scripts/ui_builder_artifact.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/frontend/scripts/ui_builder_artifact.json b/frontend/scripts/ui_builder_artifact.json
index e8cc43672c..4360794dbe 100644
--- a/frontend/scripts/ui_builder_artifact.json
+++ b/frontend/scripts/ui_builder_artifact.json
@@ -1,5 +1,5 @@
 {
 	"baseUrl": "https://pub-06154ed168a24e73a86ab84db6bf15d8.r2.dev",
-	"version": "3246b18",
-	"sha256": "4b0be80f586bc57f91965a15bceba0a37a2ae8b727a70d8ab30d9c5e0b75f115"
+	"version": "1f1fe4f",
+	"sha256": "4c20b2b51f324e93dda3b46d914ebf7bc7d0cb4dc7eb2d37068408191220d206"
 }

From 0f1b8641f26f0eda8a8517db1a37efafdb173464 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Thu, 23 Jul 2026 10:47:34 +0200
Subject: [PATCH 131/171] feat(windows): enable ruby and rlang on the windows
 worker (#10279)

Adds ruby and rlang to all_languages_windows so the Windows worker
carries the same language set as Linux (all_languages). The only
remaining difference is mssql-winauth vs mssql-kerberos, which is the
correct per-OS integrated-auth backend.

Both are parser-only Rust crates with no dependencies, so the
build/binary cost is negligible; the ruby and r executors already have
#[cfg(windows)] branches. When the Ruby/R runtime is absent on the host,
a job degrades to a runtime "command not found", same as any other
missing runtime.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 backend/Cargo.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 4a1e2300fb..d479a6bbb9 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -176,7 +176,7 @@ ruby = ["windmill-worker/ruby"]
 rlang = ["windmill-worker/rlang"]
 all_languages = ["python", "deno_core", "rust", "mysql", "oracledb", "duckdb", "mssql-kerberos", "bigquery", "csharp", "nu", "php", "java", "ruby", "rlang"]
 # For windows we have another set of languages enabled
-all_languages_windows = ["python", "deno_core", "rust", "mysql", "oracledb", "duckdb", "mssql-winauth", "bigquery", "csharp", "nu", "php", "java"]
+all_languages_windows = ["python", "deno_core", "rust", "mysql", "oracledb", "duckdb", "mssql-winauth", "bigquery", "csharp", "nu", "php", "java", "ruby", "rlang"]
 # Edition meta-features: shared groups
 run_inline = ["windmill-api/run_inline"]
 oss_core = [

From 14c29b77e90842b8c3d4395ce50cb44666cd998c Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Thu, 23 Jul 2026 11:26:33 +0200
Subject: [PATCH 132/171] fix(cli): surface shared UI changes in sync push
 dry-run preview (#10278)

* fix(cli): surface shared UI (ui/) changes in sync push dry-run preview

The git-sync "Pull from repo" preview never showed shared UI (ui/) changes,
so users thought the shared-UI folder was not syncing. The apply step does
sync it (pushSharedUi on dryRun=false); only the dry-run preview was blind.

Shared UI maps a single top-level ui/ folder to the workspace_shared_ui store
and is handled out-of-band from the normal file diff (isNotWmillFile excludes
ui/). The dry-run path returns before pushSharedUi runs, so the `changes` list
the modal consumes never contained any ui/ entry and read as "no changes".

- Add exported diffSharedUi(workspace) computing added/edited/deleted ui/<rel>
  entries (push direction), and refactor pushSharedUi to reuse it so preview
  and apply never diverge.
- Fold the diff into `changes` in the dry-run path (both JSON and terminal),
  guarded by try/catch. Apply path is unchanged.
- Label ui/ paths as "shared UI" in prettyChanges (getTypeStrFromPath throws
  on non-wmill paths like ui/config.json).
- Do not run pushSharedUi in the zero-changes branch during a dry-run.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(cli): report shared-UI-only push in sync JSON output

Address local review: when a real apply has only ui/ changes it reaches the
zero-file-changes branch, pushes the shared-UI store, then printed
"No changes to push" in --json-output. Surface pushSharedUi's result so the
message no longer claims no changes when the store was written. Also correct
the pushSharedUi docstring (empty-but-existing folder still clears a
non-empty remote store).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* test(cli): trim shared_ui diff test header to the durable invariant

Address Codex nit: replace the narrative regression header with a 4-line
statement of the invariant (diffSharedUi mirrors pushSharedUi's apply
semantics so preview and apply never diverge).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(cli): own-property shared-UI diff and count ui/ in dry-run summary

Address Codex review:
- diffSharedUi used `rel in remote`/`rel in files`, so a file named after an
  Object.prototype member (e.g. ui/toString) always registered as present and
  was misdiffed; pushSharedUi could then skip deleting it. Use Object.hasOwn.
- The dry-run "N changes to apply" summary logged before the shared UI fold,
  so a shared-UI-only dry-run printed "0 changes to apply" then listed the
  changes. Fold before the summary so the count includes ui/.
- Add a unit test for the ui/toString inherited-property filename.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 cli/src/commands/shared_ui.ts        | 73 +++++++++++++++++-----
 cli/src/commands/sync/sync.ts        | 62 ++++++++++++++++---
 cli/test/shared_ui_diff_unit.test.ts | 92 ++++++++++++++++++++++++++++
 3 files changed, 205 insertions(+), 22 deletions(-)
 create mode 100644 cli/test/shared_ui_diff_unit.test.ts

diff --git a/cli/src/commands/shared_ui.ts b/cli/src/commands/shared_ui.ts
index e3f719d77f..3c01870fd1 100644
--- a/cli/src/commands/shared_ui.ts
+++ b/cli/src/commands/shared_ui.ts
@@ -26,34 +26,77 @@ async function readDirRecursive(
   return out;
 }
 
+export type SharedUiChange =
+  | { type: "added"; path: string }
+  | { type: "edited"; path: string; before: string; after: string }
+  | { type: "deleted"; path: string };
+
+/**
+ * Diff the local <cwd>/ui/ folder against the workspace's shared UI store in
+ * the push direction (local -> remote), returning entries whose `path` is
+ * prefixed with `ui/`. This is the same comparison pushSharedUi applies, so the
+ * dry-run preview and the real push never diverge.
+ *
+ * Mirrors pushSharedUi's no-op: with no local ui/ folder there is nothing to
+ * push, so the apply is a no-op and the preview must be empty (even when the
+ * remote store is non-empty) to avoid phantom diffs the apply won't perform.
+ */
+export async function diffSharedUi(workspace: string): Promise<SharedUiChange[]> {
+  const localDir = path.join(process.cwd(), SHARED_UI_DIR);
+  if (!fs.existsSync(localDir)) {
+    return [];
+  }
+  const files = await readDirRecursive(localDir);
+
+  let remote: Record<string, string> = {};
+  try {
+    const got = await wmill.getSharedUi({ workspace });
+    remote = got.files ?? {};
+  } catch {
+    // If endpoint missing or unauthorized, treat remote as empty (the push
+    // would attempt the PUT anyway).
+  }
+
+  // Use Object.hasOwn, not `in`: a file named after an Object.prototype member
+  // (e.g. ui/toString) would otherwise register as always-present and be
+  // misdiffed.
+  const changes: SharedUiChange[] = [];
+  for (const [rel, content] of Object.entries(files)) {
+    const p = `${SHARED_UI_DIR}/${rel}`;
+    if (!Object.hasOwn(remote, rel)) {
+      changes.push({ type: "added", path: p });
+    } else if (remote[rel] !== content) {
+      changes.push({ type: "edited", path: p, before: remote[rel], after: content });
+    }
+  }
+  for (const rel of Object.keys(remote)) {
+    if (!Object.hasOwn(files, rel)) {
+      changes.push({ type: "deleted", path: `${SHARED_UI_DIR}/${rel}` });
+    }
+  }
+  return changes;
+}
+
 /**
  * Push the local <cwd>/ui/ folder to the workspace's shared UI store.
- * Returns true if a push was performed, false if the folder is missing or empty.
+ * Returns true if a push was performed, false if the folder is missing or
+ * already matches the remote store. Note an empty-but-existing folder still
+ * pushes an empty map (clearing the remote store) if the remote is non-empty.
  */
 export async function pushSharedUi(workspace: string): Promise<boolean> {
   const localDir = path.join(process.cwd(), SHARED_UI_DIR);
   if (!fs.existsSync(localDir)) {
     return false;
   }
-  const files = await readDirRecursive(localDir);
 
-  // Skip if no change
-  let remote: Record<string, string> = {};
-  try {
-    const got = await wmill.getSharedUi({ workspace });
-    remote = got.files ?? {};
-  } catch {
-    // If endpoint missing or unauthorized, just attempt the PUT
-  }
-
-  if (
-    Object.keys(remote).length === Object.keys(files).length &&
-    Object.entries(files).every(([k, v]) => remote[k] === v)
-  ) {
+  // Skip if no change — reuse diffSharedUi so preview and push never diverge.
+  const diff = await diffSharedUi(workspace);
+  if (diff.length === 0) {
     log.info(colors.gray("Shared UI folder up to date"));
     return false;
   }
 
+  const files = await readDirRecursive(localDir);
   await wmill.updateSharedUi({
     workspace,
     requestBody: { files },
diff --git a/cli/src/commands/sync/sync.ts b/cli/src/commands/sync/sync.ts
index 2ddb4833b8..f10195670a 100644
--- a/cli/src/commands/sync/sync.ts
+++ b/cli/src/commands/sync/sync.ts
@@ -28,7 +28,7 @@ import {
 } from "../../types.ts";
 import { downloadZip } from "./pull.ts";
 import { runLint, printReport, checkMissingLocks } from "../lint/lint.ts";
-import { pullSharedUi, pushSharedUi } from "../shared_ui.ts";
+import { diffSharedUi, pullSharedUi, pushSharedUi } from "../shared_ui.ts";
 import {
   pushMigrationFromDisk,
   offerToRunNewMigrations,
@@ -3494,6 +3494,9 @@ export async function gitDeploy(
 // are self-describing via their `migrations/datatable/...` path, so they get no
 // label prefix.
 function changeTypeLabel(p: string): string {
+  // Shared UI files (ui/…) are not wmill items — getTypeStrFromPath throws on
+  // them (e.g. ui/config.json). Label them directly.
+  if (p === "ui" || p.startsWith("ui/")) return "shared UI ";
   const t = getTypeStrFromPath(p);
   return t === "datatable_migration" ? "" : `${t} `;
 }
@@ -3543,7 +3546,6 @@ function prettyChanges(
         ),
       );
     } else if (change.name === "edited") {
-      const changeType = getTypeStrFromPath(change.path);
       log.info(
         colors.yellow(
           `~ ${changeTypeLabel(change.path)}` +
@@ -3553,6 +3555,12 @@ function prettyChanges(
         ),
       );
       if (change.before != change.after) {
+        // Shared UI files (ui/…) aren't wmill items; getTypeStrFromPath throws
+        // on them, so fall back to a plain diff.
+        const changeType =
+          change.path === "ui" || change.path.startsWith("ui/")
+            ? "shared_ui"
+            : getTypeStrFromPath(change.path);
         if (changeType === "encryption_key") {
           showDiff(
             redactEncryptionKey(change.before),
@@ -4128,6 +4136,33 @@ export async function push(
 
   await fetchRemoteVersion(workspace);
 
+  // Shared UI (the ui/ folder) is pushed out-of-band via pushSharedUi on apply
+  // and is excluded from the file diff (isNotWmillFile), so surface its diff in
+  // the dry-run preview. Without this the "Pull from repo" preview reads "no
+  // changes" even when the apply will overwrite the shared-UI store. Folded in
+  // only for dry-run (before the count/summary below) so the apply path is
+  // unchanged (pushSharedUi still runs) and the summary count includes ui/.
+  if (opts.dryRun) {
+    try {
+      for (const c of await diffSharedUi(workspace.workspaceId)) {
+        if (c.type === "added") {
+          changes.push({ name: "added", path: c.path, content: "" });
+        } else if (c.type === "deleted") {
+          changes.push({ name: "deleted", path: c.path });
+        } else {
+          changes.push({
+            name: "edited",
+            path: c.path,
+            before: c.before,
+            after: c.after,
+          });
+        }
+      }
+    } catch (e) {
+      log.warn(`Failed to compute shared UI diff for dry-run preview: ${e}`);
+    }
+  }
+
   log.info(
     `remote (${workspace.name}) <- local: ${changes.length} changes to apply`,
   );
@@ -5170,16 +5205,29 @@ export async function push(
       );
     }
   } else {
-    try {
-      await pushSharedUi(workspace.workspaceId);
-    } catch (e) {
-      log.warn(`Failed to push shared UI folder: ${e}`);
+    // Dry-run with no changes reaches here (a ui/ diff would have made changes
+    // non-empty and returned above); never mutate the remote in that case.
+    let sharedUiPushed = false;
+    if (!opts.dryRun) {
+      try {
+        sharedUiPushed = await pushSharedUi(workspace.workspaceId);
+      } catch (e) {
+        log.warn(`Failed to push shared UI folder: ${e}`);
+      }
     }
     // No changes pushed, so no new datatable migrations to run.
     if (opts.jsonOutput) {
+      // Shared UI is out-of-band from the file diff (total counts diffed
+      // files), but don't claim "No changes" when the ui/ store was written.
       console.log(
         JSON.stringify(
-          { success: true, message: "No changes to push", total: 0 },
+          {
+            success: true,
+            message: sharedUiPushed
+              ? "Pushed shared UI changes"
+              : "No changes to push",
+            total: 0,
+          },
           null,
           2,
         ),
diff --git a/cli/test/shared_ui_diff_unit.test.ts b/cli/test/shared_ui_diff_unit.test.ts
new file mode 100644
index 0000000000..f2fd69210e
--- /dev/null
+++ b/cli/test/shared_ui_diff_unit.test.ts
@@ -0,0 +1,92 @@
+/**
+ * diffSharedUi must mirror pushSharedUi's apply semantics so the git-sync
+ * dry-run preview and the real apply never diverge: it emits ui/<rel> entries
+ * exactly when the local ui/ folder differs from the remote store, and nothing
+ * (including no local folder) when the apply would be a no-op.
+ */
+
+import { expect, test, describe, beforeEach, afterEach, mock } from "bun:test";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+
+let remoteFiles: Record<string, string> = {};
+
+mock.module("../gen/services.gen.ts", () => ({
+  getSharedUi: async (_args: { workspace: string }) => ({ files: remoteFiles }),
+}));
+
+const { diffSharedUi } = await import("../src/commands/shared_ui.ts");
+
+describe("diffSharedUi", () => {
+  const ws = "test-workspace";
+  let tmpDir: string;
+  let prevCwd: string;
+
+  beforeEach(() => {
+    remoteFiles = {};
+    prevCwd = process.cwd();
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "wm-shared-ui-"));
+    process.chdir(tmpDir);
+  });
+
+  afterEach(() => {
+    process.chdir(prevCwd);
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  });
+
+  function writeUi(rel: string, content: string) {
+    const full = path.join(tmpDir, "ui", rel);
+    fs.mkdirSync(path.dirname(full), { recursive: true });
+    fs.writeFileSync(full, content, "utf-8");
+  }
+
+  test("emits an added ui/<rel> entry when local has a file the remote lacks", async () => {
+    writeUi("theme.json", "{}");
+    const changes = await diffSharedUi(ws);
+    expect(changes).toEqual([{ type: "added", path: "ui/theme.json" }]);
+  });
+
+  test("emits an edited ui/<rel> entry when local content differs", async () => {
+    remoteFiles = { "theme.json": "{}" };
+    writeUi("theme.json", '{"a":1}');
+    const changes = await diffSharedUi(ws);
+    expect(changes).toEqual([
+      { type: "edited", path: "ui/theme.json", before: "{}", after: '{"a":1}' },
+    ]);
+  });
+
+  test("emits a deleted ui/<rel> entry when remote has a file local lacks", async () => {
+    remoteFiles = { "theme.json": "{}", "extra.json": "1" };
+    writeUi("theme.json", "{}");
+    const changes = await diffSharedUi(ws);
+    expect(changes).toEqual([{ type: "deleted", path: "ui/extra.json" }]);
+  });
+
+  test("emits nothing when local matches the remote store", async () => {
+    remoteFiles = { "theme.json": "{}" };
+    writeUi("theme.json", "{}");
+    const changes = await diffSharedUi(ws);
+    expect(changes).toEqual([]);
+  });
+
+  test("diffs files named after Object.prototype members (e.g. toString)", async () => {
+    // Own-property check, not `in`: a local-only ui/toString is an add, and a
+    // remote-only ui/toString is a delete, despite Object.prototype.toString.
+    writeUi("toString", "x");
+    let changes = await diffSharedUi(ws);
+    expect(changes).toEqual([{ type: "added", path: "ui/toString" }]);
+
+    fs.rmSync(path.join(tmpDir, "ui", "toString"));
+    fs.mkdirSync(path.join(tmpDir, "ui"), { recursive: true });
+    remoteFiles = { toString: "x" };
+    changes = await diffSharedUi(ws);
+    expect(changes).toEqual([{ type: "deleted", path: "ui/toString" }]);
+  });
+
+  test("emits nothing when there is no local ui/ folder (apply is a no-op)", async () => {
+    remoteFiles = { "theme.json": "{}" };
+    const changes = await diffSharedUi(ws);
+    expect(changes).toEqual([]);
+  });
+});

From 3aaceb7efb3bd232da73b79fcdcf4c712caad7d3 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Thu, 23 Jul 2026 12:31:20 +0200
Subject: [PATCH 133/171] fix(ci): make /review idempotent per head commit,
 re-run cancelled reviews in place (#10283)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix(ci): make /review idempotent per head commit, re-run cancelled reviews in place

`/review` fanned out to codex/pi/claude unconditionally. A push already
auto-triggers codex/pi (and claude on open) against the PR head, so the
comment-driven relaunch both cancelled those in-flight auto runs (shared
concurrency group) and landed its own status on main — issue_comment runs
never attach a check to the PR head — leaving the PR showing only a
cancelled review that never resolves.

Add a `plan` job that, for the `/review` fan-out, decides per agent:
skip when a running or successful review already covers the head commit;
re-run the head's cancelled/failed run in place (a re-run keeps the
original pull_request event so its checks re-attach to the PR head);
launch a fresh run when nothing usable covers the head commit (no runs,
or only a skipped draft/fork-gated run). Explicit /codex, /pi, /claude
remain deliberate re-reviews and always launch.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(ci): make explicit /codex idempotent per head, track fresh launches on head SHA

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .github/workflows/pr-review-commands.yml | 182 ++++++++++++++++++++++-
 1 file changed, 176 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/pr-review-commands.yml b/.github/workflows/pr-review-commands.yml
index ef93274d7e..3c04e4e5f2 100644
--- a/.github/workflows/pr-review-commands.yml
+++ b/.github/workflows/pr-review-commands.yml
@@ -75,14 +75,153 @@ jobs:
             "/repos/$REPO/issues/comments/$COMMENT_ID/reactions" \
             -f content=eyes >/dev/null
 
-  claude:
+  # Decide, per agent, whether to launch a fresh run, re-run in place, or skip. A push
+  # already auto-triggers codex/pi (and claude on open) against the PR head. Relaunching
+  # via this issue_comment path both cancels those in-flight auto runs (shared concurrency
+  # group) AND lands the new run's status on main — issue_comment runs never attach a
+  # check to the PR head — leaving the PR showing only a cancelled review. So for every
+  # command, launch an agent only when nothing covers the head commit; if the head's run
+  # was cancelled/failed, re-run it in place (a re-run keeps the original pull_request
+  # event, so its checks re-attach to the PR head); skip when a running or successful run
+  # already covers it. `/review` applies this to all three agents; `/codex`, `/pi`,
+  # `/claude` apply the same decision to just their own agent.
+  plan:
     needs: [parse, check-access]
+    if: |
+      needs.parse.outputs.command != '' &&
+      (
+        contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association) ||
+        needs.check-access.outputs.authorized == 'true'
+      )
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: write
+      pull-requests: read
+      statuses: write
+    outputs:
+      head_sha: ${{ steps.plan.outputs.head_sha }}
+      launch_codex: ${{ steps.plan.outputs.launch_codex }}
+      launch_pi: ${{ steps.plan.outputs.launch_pi }}
+      launch_claude: ${{ steps.plan.outputs.launch_claude }}
+    steps:
+      - name: Decide per-agent launch vs re-run for the head commit
+        id: plan
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.issue.number }}
+          COMMAND: ${{ needs.parse.outputs.command }}
+        run: |
+          set -euo pipefail
+
+          HEAD_SHA=$(gh pr view "$PR_NUMBER" --repo "$REPO" --json headRefOid --jq '.headRefOid')
+          echo "PR #$PR_NUMBER head: $HEAD_SHA"
+          echo "head_sha=$HEAD_SHA" >> "$GITHUB_OUTPUT"
+
+          RUN_URL="$GITHUB_SERVER_URL/$REPO/actions/runs/$GITHUB_RUN_ID"
+
+          # A fresh launch runs from this issue_comment workflow (associated with main),
+          # so it never appears in the PR-head run query below and its own check lands on
+          # main, not the head. To keep fresh launches idempotent per head, mark the head
+          # SHA with a `review-launch/<agent>` commit status at launch; the `finalize` job
+          # resolves it to success/failure. A prior launch's status covering the head lets
+          # a second comment skip instead of relaunching (which would cancel the first via
+          # the reviewer's shared concurrency group). All status calls are best-effort — a
+          # GitHub API hiccup must degrade to a relaunch, never abort the decision.
+          mark_launch() {
+            agent="$1"
+            gh api -X POST "repos/$REPO/statuses/$HEAD_SHA" \
+              -f state=pending -f "context=review-launch/$agent" -f "target_url=$RUN_URL" \
+              -f "description=Review launched via /$COMMAND" >/dev/null 2>&1 || true
+          }
+
+          # Returns "covered" if a prior fresh launch (this or an earlier comment run)
+          # already covers the head: a success status, or a pending status whose launching
+          # run is still alive. A pending whose run has completed is stale (that run
+          # crashed before finalize) and does not count.
+          launch_coverage() {
+            agent="$1"
+            st_json=$(gh api "repos/$REPO/commits/$HEAD_SHA/statuses" \
+              --jq "[.[] | select(.context == \"review-launch/$agent\")] | first // empty" 2>/dev/null || true)
+            [ -n "$st_json" ] || return 0
+            state=$(jq -r '.state // empty' <<<"$st_json" 2>/dev/null || true)
+            [ "$state" = success ] && { echo covered; return 0; }
+            [ "$state" = pending ] || return 0
+            target=$(jq -r '.target_url // empty' <<<"$st_json" 2>/dev/null || true)
+            run_id=$(printf '%s' "$target" | grep -oE '[0-9]+$' || true)
+            if [ -n "$run_id" ]; then
+              run_state=$(gh run view "$run_id" --repo "$REPO" --json status --jq '.status' 2>/dev/null || true)
+              [ "$run_state" = completed ] && return 0   # stale pending -> not covered
+            fi
+            echo covered
+          }
+
+          decide() {
+            wf="$1"; key="$2"; agent="$3"
+            if [ "$(launch_coverage "$agent")" = covered ]; then
+              echo "$key: a prior launch already covers $HEAD_SHA (review-launch/$agent) -> skip"
+              echo "$key=false" >> "$GITHUB_OUTPUT"
+              return
+            fi
+            # `--commit` matches runs whose head SHA is the PR head. Auto reviews run on
+            # `pull_request` against that SHA; `/review` (issue_comment) runs execute on
+            # main, so they never match and are not counted as covering the head commit.
+            runs=$(gh run list --repo "$REPO" --workflow "$wf" --commit "$HEAD_SHA" --limit 40 \
+              --json databaseId,status,conclusion)
+            # Healthy = still running, or completed successfully: a review already
+            # covers this commit, so skip.
+            healthy=$(jq -r '[.[] | select(.status != "completed" or .conclusion == "success")] | length' <<<"$runs")
+            if [ "$healthy" -gt 0 ]; then
+              echo "$key: a running or successful review already covers $HEAD_SHA -> skip"
+              echo "$key=false" >> "$GITHUB_OUTPUT"
+              return
+            fi
+            # Re-run only genuinely interrupted runs (cancelled/failed/timed out) in
+            # place, so their checks re-attach to the PR head instead of posting on
+            # main. A `skipped` run produced no review and would just skip again (it is
+            # the draft/fork gate), so it does not count — fall through to a fresh launch.
+            retry_id=$(jq -r '[.[] | select(.status == "completed" and (.conclusion == "cancelled" or .conclusion == "failure" or .conclusion == "timed_out"))] | sort_by(.databaseId) | last | .databaseId // empty' <<<"$runs")
+            if [ -n "$retry_id" ]; then
+              if gh run rerun "$retry_id" --repo "$REPO" >/dev/null 2>&1; then
+                echo "$key: re-ran interrupted run $retry_id (re-attaches to PR head)"
+                echo "$key=false" >> "$GITHUB_OUTPUT"
+                return
+              fi
+              echo "$key: re-run of $retry_id failed -> fresh launch"
+              mark_launch "$agent"
+              echo "$key=true" >> "$GITHUB_OUTPUT"
+              return
+            fi
+            echo "$key: no usable review for $HEAD_SHA -> launch"
+            mark_launch "$agent"
+            echo "$key=true" >> "$GITHUB_OUTPUT"
+          }
+
+          # `/review` targets all three agents; `/codex`, `/pi`, `/claude` target only
+          # their own. A non-targeted agent is left untouched (no launch, no re-run).
+          decide_if_targeted() {
+            wf="$1"; key="$2"; agent="$3"
+            if [ "$COMMAND" = review ] || [ "$COMMAND" = "$agent" ]; then
+              decide "$wf" "$key" "$agent"
+            else
+              echo "$key: /$COMMAND does not target $agent -> skip"
+              echo "$key=false" >> "$GITHUB_OUTPUT"
+            fi
+          }
+
+          decide_if_targeted codex-pr-review.yml launch_codex codex
+          decide_if_targeted pi-pr-review.yml launch_pi pi
+          decide_if_targeted pr-ready-review.yml launch_claude claude
+
+  claude:
+    needs: [parse, check-access, plan]
     if: |
       (
         contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association) ||
         needs.check-access.outputs.authorized == 'true'
       ) &&
-      (needs.parse.outputs.command == 'review' || needs.parse.outputs.command == 'claude')
+      needs.plan.outputs.launch_claude == 'true'
     permissions:
       contents: read
       pull-requests: read
@@ -97,13 +236,13 @@ jobs:
       WINDMILL_EE_PRIVATE_ACCESS: ${{ secrets.WINDMILL_EE_PRIVATE_ACCESS }}
 
   codex:
-    needs: [parse, check-access]
+    needs: [parse, check-access, plan]
     if: |
       (
         contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association) ||
         needs.check-access.outputs.authorized == 'true'
       ) &&
-      (needs.parse.outputs.command == 'review' || needs.parse.outputs.command == 'codex')
+      needs.plan.outputs.launch_codex == 'true'
     permissions:
       contents: read
       issues: write
@@ -119,13 +258,13 @@ jobs:
       WINDMILL_EE_PRIVATE_ACCESS: ${{ secrets.WINDMILL_EE_PRIVATE_ACCESS }}
 
   pi:
-    needs: [parse, check-access]
+    needs: [parse, check-access, plan]
     if: |
       (
         contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association) ||
         needs.check-access.outputs.authorized == 'true'
       ) &&
-      (needs.parse.outputs.command == 'review' || needs.parse.outputs.command == 'pi')
+      needs.plan.outputs.launch_pi == 'true'
     permissions:
       contents: read
       issues: write
@@ -138,3 +277,34 @@ jobs:
     secrets:
       DEEPSEEK_API_KEY: ${{ secrets.DEEPSEEK_API_KEY }}
       WINDMILL_EE_PRIVATE_ACCESS: ${{ secrets.WINDMILL_EE_PRIVATE_ACCESS }}
+
+  # Resolve the `review-launch/<agent>` head statuses that `plan` set to pending, so a
+  # fresh launch's outcome is visible on the PR head (not just on main) and never lingers
+  # as a stale pending check. Targets the exact SHA `plan` launched against, so a push
+  # that moved the head mid-review does not stamp a status on the new head.
+  finalize:
+    needs: [plan, claude, codex, pi]
+    if: always() && needs.plan.result == 'success' && needs.plan.outputs.head_sha != ''
+    runs-on: ubuntu-latest
+    permissions:
+      statuses: write
+    env:
+      GH_TOKEN: ${{ github.token }}
+      REPO: ${{ github.repository }}
+      HEAD_SHA: ${{ needs.plan.outputs.head_sha }}
+      RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+    steps:
+      - name: Finalize launch statuses on the PR head
+        run: |
+          set -uo pipefail
+          finalize() {
+            agent="$1"; launched="$2"; result="$3"
+            [ "$launched" = true ] || return 0
+            state=$([ "$result" = success ] && echo success || echo failure)
+            gh api -X POST "repos/$REPO/statuses/$HEAD_SHA" \
+              -f "state=$state" -f "context=review-launch/$agent" -f "target_url=$RUN_URL" \
+              -f "description=Review $result" >/dev/null 2>&1 || true
+          }
+          finalize codex "${{ needs.plan.outputs.launch_codex }}" "${{ needs.codex.result }}"
+          finalize pi "${{ needs.plan.outputs.launch_pi }}" "${{ needs.pi.result }}"
+          finalize claude "${{ needs.plan.outputs.launch_claude }}" "${{ needs.claude.result }}"

From 248c8751b1fd5d6f7506a7c3fc8f500dd98af26e Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Thu, 23 Jul 2026 12:32:50 +0200
Subject: [PATCH 134/171] feat(ai-chat): let the session/global chat create
 email triggers (#10282)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* feat(ai-chat): let AI create email triggers for flows and scripts

The AI chat could not identify that it can create email triggers. The
`open_page` tool advertised `email` as a trigger kind (routing to
/email_triggers), but neither `write_trigger` (global/session chat) nor
`create_trigger` (flow chat) accepted `kind: "email"` — their enums stopped
at 10 kinds. Seeing email as a navigable page but having no tool to create
one, the model concluded email triggers were unsupported and faked them with
an HTTP webhook plus an external mail provider.

Add `email` to the shared trigger-schema generation (`WORKSPACE_TOOL_*` in
system_prompts/generate.py), which feeds both `triggerRequestSchemas` (global)
and `createTriggerToolSchema` (flow), then wire the kind through the global
chat draft path (TRIGGER_KINDS, draft-kind map, triggerServices/labels,
write_trigger config union) and the flow chat `triggerConfigs`. The backend
route, EmailTriggerService, `trigger_email` draft kind, and email UI drawers
already existed.

Add discovery eval guards (`flow-test17`, `global-test29`) that assert the
model selects `kind: email` for an implicit "run when an email is received"
request. They assert the recorded tool-call kind rather than the resulting
draft, so they hold on a CE backend where email trigger routes
(smtp+private-gated) are not compiled. A mocked unit test in global/core.test.ts
covers the full draft->read->deploy path.

Verified: flow guard 5/5, global guard 4/4 (sonnet); frontend unit tests green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(ai-chat): default email trigger workspaced_local_part before persist

The global chat forwards the write_trigger draft unchanged, but
workspaced_local_part maps to a NOT NULL column and the model may omit the
optional field — deploying such a draft would fail instead of creating the
trigger. Default it to false at draft-write time (as flow chat does at create),
and assert the deployed request carries it in the unit test.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(ai-chat): make email trigger listing and edits robust

Two issues from adding the email kind to the global chat:

- list_workspace_items iterated every trigger kind and awaited each list
  unconditionally; email routes 404 without smtp+private (as do EE kinds on
  CE), so one unavailable kind threw and dropped the entire trigger listing.
  Skip a kind whose list endpoint is unavailable.

- Defaulting workspaced_local_part on the incoming config before the base
  merge reset an existing trigger's value: editing a workspaced trigger while
  omitting the optional field overwrote true with false, changing its
  receiving address. Default on the merged draft instead, so an omitted field
  keeps the existing value and only genuinely new drafts get false.

Adds regression tests for both.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(ai-chat): only skip 404 trigger-list failures, surface the rest

The prior fix caught every rejection from a per-kind trigger list, so an auth,
5xx, or network failure produced a successful-but-incomplete listing that could
make the chat treat existing triggers as absent. Skip only a 404 (route not
compiled in) and re-throw anything else. Adds a propagation test.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 ai_evals/cases/global.yaml                    |  32 ++++
 .../copilot/chat/global/core.test.ts          | 140 ++++++++++++++++++
 .../components/copilot/chat/global/core.ts    |  49 ++++--
 .../copilot/chat/global/userDraftAdapter.ts   |   4 +-
 .../copilot/chat/global/workspaceItems.ts     |   5 +-
 5 files changed, 219 insertions(+), 11 deletions(-)

diff --git a/ai_evals/cases/global.yaml b/ai_evals/cases/global.yaml
index fc875aa25d..72739d2778 100644
--- a/ai_evals/cases/global.yaml
+++ b/ai_evals/cases/global.yaml
@@ -1845,3 +1845,35 @@
     - creates a postgres resource draft at f/evals/global/prod_db with the provided host, port, database, and user
     - the password is left for the user to provide (empty, a placeholder, or a secret variable reference) — no invented password value presented as real
     - does not deploy or save anything to the workspace
+
+- id: global-test29-email-trigger-draft
+  prompt: |-
+    Set up a draft auto-reply job.
+    Create a Bun script at `f/evals/global/email_pong` that returns the string "pong".
+    Then set it up so it runs whenever an email is received at the inbox `pong`.
+    Leave everything as AI drafts only; do not deploy or save anything to the workspace.
+  runtime:
+    maxTurns: 10
+  validate:
+    requiredDrafts:
+      - type: script
+        path: f/evals/global/email_pong
+        language: bun
+        valueIncludes:
+          - pong
+  toolExpect:
+    requiredToolsUsed:
+      - write_script
+      - write_trigger
+    forbiddenToolsUsed:
+      - deploy_workspace_item
+      - delete_workspace_item
+    toolCallArgs:
+      # "Runs when an email is received" must resolve to the native email trigger kind,
+      # never a faked HTTP webhook. Assert the recorded tool-call kind (not the draft):
+      # it holds even on a CE backend where email trigger routes (smtp+private) 404.
+      - tool: write_trigger
+        field: kind
+        stringIncludesAnyOf:
+          - email
+  skipJudge: true
diff --git a/frontend/src/lib/components/copilot/chat/global/core.test.ts b/frontend/src/lib/components/copilot/chat/global/core.test.ts
index 3ba69284d9..268a66e38e 100644
--- a/frontend/src/lib/components/copilot/chat/global/core.test.ts
+++ b/frontend/src/lib/components/copilot/chat/global/core.test.ts
@@ -141,9 +141,48 @@ vi.mock('$lib/gen', async () => {
 			getHttpTrigger: vi.fn(async () => {
 				throw new Error('getHttpTrigger mock not configured')
 			}),
+			listHttpTriggers: vi.fn(async () => []),
 			createHttpTrigger: vi.fn(async () => 'created'),
 			updateHttpTrigger: vi.fn(async () => 'updated')
 		}),
+		EmailTriggerService: wrapService(actual.EmailTriggerService, {
+			existsEmailTrigger: vi.fn(async () => false),
+			getEmailTrigger: vi.fn(async () => {
+				throw new Error('getEmailTrigger mock not configured')
+			}),
+			listEmailTriggers: vi.fn(async () => []),
+			createEmailTrigger: vi.fn(async () => 'created'),
+			updateEmailTrigger: vi.fn(async () => 'updated')
+		}),
+		// The remaining trigger kinds only need a list() stub so list_workspace_items
+		// treats them as available-but-empty (a real instance answers, not rejects).
+		WebsocketTriggerService: wrapService(actual.WebsocketTriggerService, {
+			listWebsocketTriggers: vi.fn(async () => [])
+		}),
+		KafkaTriggerService: wrapService(actual.KafkaTriggerService, {
+			listKafkaTriggers: vi.fn(async () => [])
+		}),
+		NatsTriggerService: wrapService(actual.NatsTriggerService, {
+			listNatsTriggers: vi.fn(async () => [])
+		}),
+		PostgresTriggerService: wrapService(actual.PostgresTriggerService, {
+			listPostgresTriggers: vi.fn(async () => [])
+		}),
+		MqttTriggerService: wrapService(actual.MqttTriggerService, {
+			listMqttTriggers: vi.fn(async () => [])
+		}),
+		AmqpTriggerService: wrapService(actual.AmqpTriggerService, {
+			listAmqpTriggers: vi.fn(async () => [])
+		}),
+		SqsTriggerService: wrapService(actual.SqsTriggerService, {
+			listSqsTriggers: vi.fn(async () => [])
+		}),
+		GcpTriggerService: wrapService(actual.GcpTriggerService, {
+			listGcpTriggers: vi.fn(async () => [])
+		}),
+		AzureTriggerService: wrapService(actual.AzureTriggerService, {
+			listAzureTriggers: vi.fn(async () => [])
+		}),
 		AppService: wrapService(actual.AppService, {
 			existsApp: vi.fn(async () => false),
 			createAppRaw: vi.fn(async () => 'created'),
@@ -279,6 +318,7 @@ import {
 import { bundleRawAppDraft } from './rawAppBundlerBridge'
 import {
 	AppService,
+	EmailTriggerService,
 	FlowService,
 	FolderService,
 	HttpTriggerService,
@@ -1369,6 +1409,106 @@ describe('global AI tools', () => {
 		).toBeUndefined()
 	})
 
+	// Email is the kind an implicit "run when an email is received" request maps to;
+	// guards the full draft->read->deploy wiring for it end to end.
+	it('reads and deploys an email trigger draft written by the chat', async () => {
+		await callGlobalTool('write_trigger', {
+			kind: 'email',
+			config: {
+				path: 'u/admin/fresh_inbox',
+				script_path: 'f/scripts/handler',
+				is_flow: false,
+				local_part: 'support'
+			}
+		})
+
+		const readRaw = await callGlobalTool('read_workspace_item', {
+			type: 'trigger',
+			trigger_kind: 'email',
+			path: 'u/admin/fresh_inbox'
+		})
+		expect(JSON.parse(readRaw)).toMatchObject({
+			type: 'trigger',
+			triggerKind: 'email',
+			path: 'u/admin/fresh_inbox',
+			isDraft: true
+		})
+
+		await callGlobalTool('deploy_workspace_item', {
+			type: 'trigger',
+			trigger_kind: 'email',
+			path: 'u/admin/fresh_inbox'
+		})
+		expect(EmailTriggerService.createEmailTrigger).toHaveBeenCalledWith({
+			workspace: WORKSPACE,
+			requestBody: expect.objectContaining({
+				path: 'u/admin/fresh_inbox',
+				local_part: 'support',
+				script_path: 'f/scripts/handler',
+				// Omitted by the caller above; defaulted so the NOT NULL column is satisfied.
+				workspaced_local_part: false
+			})
+		})
+		expect(
+			getBackendDraft('trigger_email', 'u/admin/fresh_inbox', { workspace: WORKSPACE })
+		).toBeUndefined()
+	})
+
+	// Editing an existing email trigger whose workspaced_local_part is true while
+	// omitting the optional field must not reset it to false (that would change the
+	// receiving address). The default applies only to a genuinely new draft.
+	it('preserves workspaced_local_part when editing an existing email trigger', async () => {
+		vi.mocked(EmailTriggerService.existsEmailTrigger).mockResolvedValueOnce(true)
+		vi.mocked(EmailTriggerService.getEmailTrigger).mockResolvedValueOnce({
+			path: 'u/admin/ws_inbox',
+			script_path: 'f/scripts/handler',
+			local_part: 'support',
+			is_flow: false,
+			workspaced_local_part: true
+		} as any)
+
+		await callGlobalTool('write_trigger', {
+			kind: 'email',
+			config: {
+				path: 'u/admin/ws_inbox',
+				script_path: 'f/scripts/handler',
+				is_flow: false,
+				local_part: 'support'
+			}
+		})
+
+		const readRaw = await callGlobalTool('read_workspace_item', {
+			type: 'trigger',
+			trigger_kind: 'email',
+			path: 'u/admin/ws_inbox'
+		})
+		expect(JSON.parse(readRaw).value).toMatchObject({ workspaced_local_part: true })
+	})
+
+	// A trigger kind whose backend routes aren't compiled in (email without
+	// smtp+private, EE kinds on CE) 404s on list; that must not drop the whole listing.
+	it('skips unavailable trigger kinds when listing', async () => {
+		vi.mocked(HttpTriggerService.listHttpTriggers).mockResolvedValueOnce([
+			{ path: 'u/admin/live_route', script_path: 'f/scripts/handler', is_flow: false }
+		] as any)
+		vi.mocked(EmailTriggerService.listEmailTriggers).mockRejectedValueOnce(
+			Object.assign(new Error('not found'), { status: 404 })
+		)
+
+		const raw = await callGlobalTool('list_workspace_items', { types: ['trigger'] })
+		const paths = JSON.parse(raw).map((i: any) => i.path)
+		expect(paths).toContain('u/admin/live_route')
+	})
+
+	// Only a 404 means "route not compiled in". A real failure (auth, 5xx) must not
+	// be swallowed into a successful-but-incomplete listing.
+	it('propagates a non-404 trigger-list failure', async () => {
+		vi.mocked(HttpTriggerService.listHttpTriggers).mockRejectedValueOnce(
+			Object.assign(new Error('server error'), { status: 500 })
+		)
+		await expect(callGlobalTool('list_workspace_items', { types: ['trigger'] })).rejects.toThrow()
+	})
+
 	// Same private-owner read path as schedules, for the resource drawer kind.
 	it('reads and deploys a resource draft written by the chat', async () => {
 		await callGlobalTool('write_resource', {
diff --git a/frontend/src/lib/components/copilot/chat/global/core.ts b/frontend/src/lib/components/copilot/chat/global/core.ts
index f028ca9784..f3bd5ccae3 100644
--- a/frontend/src/lib/components/copilot/chat/global/core.ts
+++ b/frontend/src/lib/components/copilot/chat/global/core.ts
@@ -1,6 +1,7 @@
 import {
 	AppService,
 	AzureTriggerService,
+	EmailTriggerService,
 	FlowService,
 	FolderService,
 	GcpTriggerService,
@@ -562,7 +563,8 @@ const writeTriggerSchema = z.object({
 			triggerRequestSchemas.amqp,
 			triggerRequestSchemas.sqs,
 			triggerRequestSchemas.gcp,
-			triggerRequestSchemas.azure
+			triggerRequestSchemas.azure,
+			triggerRequestSchemas.email
 		])
 		.describe(
 			'Full trigger configuration. Must include path, script_path, is_flow plus the kind-specific fields.'
@@ -1755,6 +1757,14 @@ const triggerServices: Record<TriggerKind, TriggerService> = {
 		create: (a) => AzureTriggerService.createAzureTrigger(a),
 		update: (a) => AzureTriggerService.updateAzureTrigger(a),
 		delete: (a) => AzureTriggerService.deleteAzureTrigger(a)
+	},
+	email: {
+		exists: (a) => EmailTriggerService.existsEmailTrigger(a),
+		get: (a) => EmailTriggerService.getEmailTrigger(a),
+		list: (a) => EmailTriggerService.listEmailTriggers(a),
+		create: (a) => EmailTriggerService.createEmailTrigger(a),
+		update: (a) => EmailTriggerService.updateEmailTrigger(a),
+		delete: (a) => EmailTriggerService.deleteEmailTrigger(a)
 	}
 }
 
@@ -1864,12 +1874,22 @@ async function listWorkspaceItems(
 
 	if (types.includes('trigger')) {
 		for (const kind of TRIGGER_KINDS) {
-			const triggers = await triggerServices[kind].list({
-				workspace,
-				pathStart: pathPrefix,
-				perPage,
-				page
-			})
+			let triggers: Awaited<ReturnType<(typeof triggerServices)[typeof kind]['list']>>
+			try {
+				triggers = await triggerServices[kind].list({
+					workspace,
+					pathStart: pathPrefix,
+					perPage,
+					page
+				})
+			} catch (err) {
+				// A trigger kind whose backend routes aren't compiled in (e.g. email
+				// without smtp+private, or an EE kind on CE) 404s here; skip only that
+				// so one unavailable kind doesn't drop the whole listing. Any other
+				// failure (auth, 5xx, network) is real and must surface.
+				if ((err as { status?: number } | undefined)?.status === 404) continue
+				throw err
+			}
 			for (const trigger of triggers) items.push(triggerToItem(kind, trigger, false))
 		}
 	}
@@ -4233,7 +4253,17 @@ function triggerWriteSpec(kind: TriggerKind): WriteSpec<TriggerDraftConfig, Trig
 		probe: (workspace, path) => service.exists({ workspace, path }),
 		fetchDeployed: async (workspace, path) =>
 			(await service.get({ workspace, path })) as TriggerDraftConfig,
-		buildDraft: (base, config, path) => mergeDraftConfig<TriggerDraftConfig>(base, config, path)
+		buildDraft: (base, config, path) => {
+			const draft = mergeDraftConfig<TriggerDraftConfig>(base, config, path)
+			if (kind === 'email') {
+				// workspaced_local_part maps to a NOT NULL column but is optional in the
+				// tool schema. Default on the merged draft (not the incoming config) so an
+				// omitted field keeps the existing trigger's value instead of resetting it.
+				const email = draft as TriggerDraftConfig & { workspaced_local_part?: boolean }
+				email.workspaced_local_part = email.workspaced_local_part ?? false
+			}
+			return draft
+		}
 	}
 }
 
@@ -5154,7 +5184,8 @@ const triggerLabels: Record<TriggerKind, string> = {
 	amqp: 'AMQP trigger',
 	sqs: 'SQS trigger',
 	gcp: 'GCP Pub/Sub trigger',
-	azure: 'Azure Event Grid trigger'
+	azure: 'Azure Event Grid trigger',
+	email: 'Email trigger'
 }
 
 function createOpenScheduleAction(path: string, targetKind: 'script' | 'flow'): ToolDisplayAction {
diff --git a/frontend/src/lib/components/copilot/chat/global/userDraftAdapter.ts b/frontend/src/lib/components/copilot/chat/global/userDraftAdapter.ts
index 5f73a64752..59a66e4926 100644
--- a/frontend/src/lib/components/copilot/chat/global/userDraftAdapter.ts
+++ b/frontend/src/lib/components/copilot/chat/global/userDraftAdapter.ts
@@ -25,7 +25,8 @@ const TRIGGER_DRAFT_KIND_BY_TRIGGER_KIND = {
 	amqp: 'trigger_amqp',
 	sqs: 'trigger_sqs',
 	gcp: 'trigger_gcp',
-	azure: 'trigger_azure'
+	azure: 'trigger_azure',
+	email: 'trigger_email'
 } as const satisfies Record<TriggerKind, UserDraftItemKind>
 
 const TRIGGER_KIND_BY_DRAFT_KIND = Object.fromEntries(
@@ -50,6 +51,7 @@ const GLOBAL_DRAFT_KINDS = [
 	'trigger_sqs',
 	'trigger_gcp',
 	'trigger_azure',
+	'trigger_email',
 	'resource',
 	'variable'
 ] as const satisfies UserDraftItemKind[]
diff --git a/frontend/src/lib/components/copilot/chat/global/workspaceItems.ts b/frontend/src/lib/components/copilot/chat/global/workspaceItems.ts
index 31f9261227..529c87d493 100644
--- a/frontend/src/lib/components/copilot/chat/global/workspaceItems.ts
+++ b/frontend/src/lib/components/copilot/chat/global/workspaceItems.ts
@@ -4,6 +4,7 @@ import type {
 	CreateVariable,
 	FlowValue,
 	GcpTriggerData,
+	NewEmailTrigger,
 	NewHttpTrigger,
 	NewKafkaTrigger,
 	NewMqttTrigger,
@@ -42,7 +43,8 @@ export const TRIGGER_KINDS = [
 	'amqp',
 	'sqs',
 	'gcp',
-	'azure'
+	'azure',
+	'email'
 ] as const
 
 export type TriggerKind = (typeof TRIGGER_KINDS)[number]
@@ -58,6 +60,7 @@ export type TriggerRequestBody =
 	| NewSqsTrigger
 	| GcpTriggerData
 	| AzureTriggerData
+	| NewEmailTrigger
 
 export type WorkspaceItemType =
 	| 'script'

From 771eb284ada2f717a377e925bf3321d0a841d8c5 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Thu, 23 Jul 2026 12:49:06 +0200
Subject: [PATCH 135/171] chore(pr-skill): make review-round waiter
 idempotency-aware (#10285)

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
---
 .agents/skills/pr/SKILL.md        |  4 +-
 .agents/skills/pr/review-round.sh | 67 +++++++++++++++++++++++++------
 2 files changed, 58 insertions(+), 13 deletions(-)

diff --git a/.agents/skills/pr/SKILL.md b/.agents/skills/pr/SKILL.md
index 51cd2305c3..bd40b6c472 100644
--- a/.agents/skills/pr/SKILL.md
+++ b/.agents/skills/pr/SKILL.md
@@ -139,8 +139,10 @@ A PR leaves draft **only after a clean CI review round**. Never run `gh pr ready
 
    It comments `/review` on the PR — which runs the Codex, Claude and Pi CI reviewers even on a draft — waits for the spawned `PR Review Commands` workflow run(s) to complete, then prints one verdict line per reviewer and saves the full review comments to files.
 
+   `/review` (and `/codex`) are **idempotent per head SHA**: if a running or successful review already covers the current head, they skip that agent and post nothing new — the waiter reads the existing verdict for that head, so a skipped agent is *not* a missing one. A cancelled/failed head run is re-run in place; a fresh run is launched only when nothing covers the head. So an unchanged-head re-review is a near no-op, not a new round — push a commit to get genuinely fresh reviews.
+
 2. **Judge the round.** Codex is mandatory; Claude, Pi and cubic count whenever they posted. Every review starts with one of the three `REVIEW.md` verdicts:
-   - Codex verdict missing → the round is void: comment `/codex` on the PR, wait for it the same way, and judge again.
+   - Codex verdict missing → the round is void: the waiter warns only when the head has no green Codex run (cancelled/failed/absent — not merely skipped-because-already-reviewed). Comment `/codex` on the PR, which re-runs the interrupted run in place (or launches one if none exists), wait the same way, and judge again.
    - Any **"Should address issues before merging"** → fix the P0/P1 findings (and the nits while you're there), commit, push, and start a new round (step 1).
    - Only **"Mergeable, but should ideally address nits"** and/or **"Good to merge"** → fix the nits too; a nit that is wrong or genuinely not worth fixing may instead be dismissed by replying to the review comment with your reasoning. Push nit-only fixes without starting another full round.
 
diff --git a/.agents/skills/pr/review-round.sh b/.agents/skills/pr/review-round.sh
index a2dfa526a0..abd94005f6 100755
--- a/.agents/skills/pr/review-round.sh
+++ b/.agents/skills/pr/review-round.sh
@@ -79,10 +79,43 @@ while :; do
   sleep 60
 done
 
+# Head SHA at trigger time. `/review` is idempotent per head: it skips an agent a
+# running/successful review already covers, re-runs a cancelled/failed one in place on a
+# separate head-tied run, and launches fresh only when nothing covers the head. Verdict
+# reading below therefore keys off the head, not just the trigger timestamp.
+HEAD_SHA=$(retry gh api "repos/$REPO/pulls/$PR" --jq .head.sha)
+echo "Reviewing head $HEAD_SHA"
+
+# Newest non-skipped run of <workflow> tied to the head ("status conclusion"), or empty
+# when none exists. A re-run-in-place or an already-covering review resolves on such a
+# head-tied run — separate from the pr-review-commands run waited on above (a fresh
+# launch instead runs inside it, and posts after the trigger). A `skipped` run is the
+# draft/fork gate and produced no review, so it is ignored.
+head_run_state() {
+  gh run list --repo "$REPO" --workflow "$1" --commit "$HEAD_SHA" --limit 20 \
+    --json databaseId,status,conclusion \
+    --jq '[.[] | select(.conclusion != "skipped")] | sort_by(.databaseId) | last | if . then "\(.status) \(.conclusion // "-")" else empty end' 2>/dev/null || true
+}
+
+# A re-run-in-place review lands on a head-tied run that finishes after the fast
+# pr-review-commands run, so let those settle before reading verdicts.
+for wf in codex-pr-review.yml pi-pr-review.yml pr-ready-review.yml; do
+  while :; do
+    case "$(head_run_state "$wf")" in
+      ""|"completed "*) break ;;
+      *) if [ "$(date +%s)" -gt "$DEADLINE" ]; then break; fi; sleep 30 ;;
+    esac
+  done
+done
+
 OUT_DIR=$(mktemp -d -t review-round-XXXXXX)
 COMMENTS_RAW=$(retry gh api "repos/$REPO/issues/$PR/comments?per_page=100" --paginate)
+# Two views: comments from THIS round (after the trigger) and the full history. A fresh
+# launch posts after the trigger; an idempotent skip leaves the covering verdict in the
+# earlier run's comment, so fall back to history when that agent's head run is green.
 jq -s --arg t "$TRIGGER_TIME" '[.[][] | select(.created_at > $t)]' \
   <<<"$COMMENTS_RAW" > "$OUT_DIR/comments.json"
+jq -s '[.[][]]' <<<"$COMMENTS_RAW" > "$OUT_DIR/comments-all.json"
 # cubic posts through the PR reviews API, not issue comments.
 REVIEWS_RAW=$(retry gh api "repos/$REPO/pulls/$PR/reviews?per_page=100" --paginate)
 jq -s --arg t "$TRIGGER_TIME" '[.[][] | select((.submitted_at // "") > $t)]' \
@@ -90,18 +123,28 @@ jq -s --arg t "$TRIGGER_TIME" '[.[][] | select((.submitted_at // "") > $t)]' \
 
 VERDICT_RE='(Good to merge|Mergeable, but should ideally address nits|Should address issues before merging)'
 
-body_by_header() {
-  jq -r --arg h "$1" '[.[] | select(.body // "" | contains($h))] | last | .body // empty' \
-    "$OUT_DIR/comments.json"
+body_by_header() { # <file> <header-substring>
+  jq -r --arg h "$2" '[.[] | select(.body // "" | contains($h))] | last | .body // empty' "$1"
 }
-body_by_login() {
-  jq -r --arg l "$1" '[.[] | select(.user.login == $l)] | last | .body // empty' \
-    "$OUT_DIR/comments.json"
+body_by_login() { # <file> <login>
+  jq -r --arg l "$2" '[.[] | select(.user.login == $l)] | last | .body // empty' "$1"
+}
+head_ok() { [ "$(head_run_state "$1")" = "completed success" ]; }
+# Latest verdict for a reviewer: prefer this round's comment; if none and the reviewer's
+# head run succeeded (an idempotent /review skipped re-reviewing an already-green head),
+# fall back to the covering comment from the full history.
+verdict_body() { # <header|login> <value> <workflow>
+  local body
+  body=$("body_by_$1" "$OUT_DIR/comments.json" "$2")
+  if [ -z "$body" ] && head_ok "$3"; then
+    body=$("body_by_$1" "$OUT_DIR/comments-all.json" "$2")
+  fi
+  printf '%s' "$body"
 }
 report() { # <reviewer-name> <comment-body>
   local name=$1 body=$2 verdict
   if [ -z "$body" ]; then
-    echo "$name: (no review posted this round)"
+    echo "$name: (no review posted for this head)"
     return
   fi
   printf '%s\n' "$body" > "$OUT_DIR/$name.md"
@@ -110,11 +153,11 @@ report() { # <reviewer-name> <comment-body>
 }
 
 echo
-echo "=== Review round verdicts for $REPO#$PR (posted after $TRIGGER_TIME) ==="
-CODEX_BODY=$(body_by_header '## Codex Review')
+echo "=== Review round verdicts for $REPO#$PR (head $HEAD_SHA) ==="
+CODEX_BODY=$(verdict_body header '## Codex Review' codex-pr-review.yml)
 report codex "$CODEX_BODY"
-report claude "$(body_by_login 'claude[bot]')"
-report pi "$(body_by_header '## Pi Review')"
+report claude "$(verdict_body login 'claude[bot]' pr-ready-review.yml)"
+report pi "$(verdict_body header '## Pi Review' pi-pr-review.yml)"
 CUBIC_BODY=$(jq -r '[.[] | select(.user.login | test("^cubic(-dev-ai)?(\\[bot\\])?$"; "i"))] | last | .body // empty' \
   "$OUT_DIR/pr-reviews.json")
 if [ -z "$CUBIC_BODY" ]; then
@@ -125,5 +168,5 @@ report cubic "$CUBIC_BODY"
 echo
 echo "Full round output: $OUT_DIR (comments.json, pr-reviews.json, one .md per reviewer)"
 if [ -z "$CODEX_BODY" ]; then
-  echo "WARNING: Codex verdict missing - the round is incomplete. Re-trigger with a '/codex' PR comment and wait again." >&2
+  echo "WARNING: no Codex verdict for $HEAD_SHA - its head run is not green (cancelled/failed/absent, not merely skipped-because-already-reviewed). Re-trigger with a '/codex' PR comment (re-runs the interrupted run in place, or launches one) and wait again." >&2
 fi

From 1f912f410401ec68789d43973d6e0a1f8e595f86 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Thu, 23 Jul 2026 12:55:59 +0200
Subject: [PATCH 136/171] feat(ai): enable data pipelines in AI sessions with
 alpha notice (#10273)

* feat(ai): enable data pipelines in AI sessions with alpha notice

* test(ai): assert real pipeline instructions returned in session

* fix(ai): await pipeline editor registration in open_preview to end build_pipeline_node race

* test(ai): drop historical narration in pipeline instruction assertion

* docs(ai): clarify S3 asset-URI storage forms and literal-key rule in pipeline prompt

* docs(ai): document data_upload S3Object input mechanism in pipeline prompt

* test(ai): guard open_preview pipeline tool-registration wait seam

* feat(ai): report inferred asset lineage in build/edit_pipeline_node results

* test(ai): assert open_preview(pipeline) awaits async handler registration

* docs(ai): qualify S3Object as wmill.S3Object in pipeline prompt examples

* fix(ai): report failure when a backgrounded session's pipeline tools never register

* fix(ai): include output_kind-seeded outputs in build_pipeline_node lineage feedback

* fix(ai): report only body-detected lineage, never the output_kind seed placeholder

* fix(ai): include materialize target in lineage feedback, condense comments

* docs(ai): use default-storage s3:/// in canonical pipeline read example
---
 .../AssetGraph/pipelineAiHelpers.test.ts      | 31 ++++++++
 .../assets/AssetGraph/pipelineAiHelpers.ts    | 54 ++++++++++++-
 .../copilot/chat/AIChatManager.svelte.ts      | 33 +++++++-
 .../copilot/chat/AIChatManager.test.ts        | 43 ++++++++++
 .../copilot/chat/global/core.test.ts          | 78 +++++++++----------
 .../components/copilot/chat/global/core.ts    | 52 ++++---------
 .../copilot/chat/global/pipelineGate.ts       | 36 ---------
 .../copilot/chat/pipeline/core.test.ts        | 37 ++++++++-
 .../components/copilot/chat/pipeline/core.ts  | 39 +++++++---
 .../components/sessions/previewRouter.test.ts | 21 ++---
 .../lib/components/sessions/previewRouter.ts  |  6 +-
 .../sessions/sessionRuntime.svelte.ts         | 18 ++++-
 system_prompts/auto-generated/prompts.ts      | 26 ++++++-
 system_prompts/base/pipeline-base.md          | 26 ++++++-
 14 files changed, 342 insertions(+), 158 deletions(-)
 delete mode 100644 frontend/src/lib/components/copilot/chat/global/pipelineGate.ts

diff --git a/frontend/src/lib/components/assets/AssetGraph/pipelineAiHelpers.test.ts b/frontend/src/lib/components/assets/AssetGraph/pipelineAiHelpers.test.ts
index a1a82870c8..e5f3b74e3d 100644
--- a/frontend/src/lib/components/assets/AssetGraph/pipelineAiHelpers.test.ts
+++ b/frontend/src/lib/components/assets/AssetGraph/pipelineAiHelpers.test.ts
@@ -114,6 +114,37 @@ describe('pipeline AI direct-draft helpers', () => {
 		expect(drafts().size).toBe(0)
 	})
 
+	// The output_kind seed is a random placeholder that live inference overwrites
+	// and deploy re-derives, so it must not read as detected lineage — else a
+	// dynamic/unwritten output looks wired when the deployed script has no edge.
+	it('does not report the output_kind seed as detected lineage', async () => {
+		vi.spyOn(ScriptService, 'getScriptByPath').mockRejectedValue(new Error('404'))
+		const { handle, drafts } = makeHandle()
+		const res = await handle.proposeNode({
+			path: 'f/x/seeded',
+			language: 'duckdb' as any,
+			content: '-- pipeline\n-- on schedule\nSELECT 1',
+			outputKind: 'ducklake' as any
+		})
+		expect(drafts().get('f/x/seeded')?.outputAssets?.length).toBeGreaterThan(0)
+		expect(res.detectedWrites).toEqual([])
+	})
+
+	// `inferAssets` returns the `// materialize` target separately from body
+	// writes, so it must be folded into detectedWrites or a canonical materialize
+	// node would falsely read as having no output.
+	it('reports the `-- materialize` target as a detected write', async () => {
+		vi.spyOn(ScriptService, 'getScriptByPath').mockRejectedValue(new Error('404'))
+		const { handle } = makeHandle()
+		const res = await handle.proposeNode({
+			path: 'f/x/mat',
+			language: 'duckdb' as any,
+			content: '-- pipeline\n-- on schedule\n-- materialize ducklake://main/out\nSELECT 1',
+			outputKind: 'ducklake' as any
+		})
+		expect(res.detectedWrites).toEqual(['ducklake://main/out'])
+	})
+
 	it('editNode rejects a path outside the open folder', async () => {
 		const { handle, drafts } = makeHandle()
 		await expect(handle.editNode('f/other/foo', '-- pipeline')).rejects.toThrow(/open folder/)
diff --git a/frontend/src/lib/components/assets/AssetGraph/pipelineAiHelpers.ts b/frontend/src/lib/components/assets/AssetGraph/pipelineAiHelpers.ts
index 3658bc5a32..a6874d9b64 100644
--- a/frontend/src/lib/components/assets/AssetGraph/pipelineAiHelpers.ts
+++ b/frontend/src/lib/components/assets/AssetGraph/pipelineAiHelpers.ts
@@ -7,7 +7,7 @@ import {
 	type AssetWithAltAccessType
 } from '$lib/components/assets/lib'
 import { assetUri, autoOutputAsset, type PipelineOutputKind } from './pipelineTemplates'
-import { parsePipelineAnnotations } from './parsePipelineAnnotations'
+import { parsePipelineAnnotations, scd2CurrentTargetPath } from './parsePipelineAnnotations'
 import type { AssetGraphResponse } from './types'
 import type {
 	PipelineAIChatHelpers,
@@ -107,6 +107,31 @@ async function inferDraftAssets(
 	}
 }
 
+// `inferAssets` returns body reads/writes but NOT the `// materialize` target,
+// which the parser surfaces separately (resolveGraph adds it the same way).
+// A managed materialize node's output is real and deployable, so fold its
+// target(s) into the detected writes.
+function materializeWrites(content: string): Array<{ kind: AssetKind; path: string }> {
+	const m = parsePipelineAnnotations(content).materialize
+	if (!m) return []
+	const out = [{ kind: m.targetKind, path: m.targetPath }]
+	const current = scd2CurrentTargetPath(m)
+	if (current) out.push({ kind: m.targetKind, path: current })
+	return out
+}
+
+function dedupeAssets(
+	assets: Array<{ kind: AssetKind; path: string }>
+): Array<{ kind: AssetKind; path: string }> {
+	const seen = new Set<string>()
+	return assets.filter((a) => {
+		const key = `${a.kind}:${a.path}`
+		if (seen.has(key)) return false
+		seen.add(key)
+		return true
+	})
+}
+
 export function createPipelineAiHelpers(deps: PipelineAiHelperDeps): PipelineAIChatHelpers {
 	// A staged draft is always persisted into the OPEN folder's data_pipeline
 	// bundle, so a path outside the folder would silently land an unrelated script
@@ -240,17 +265,30 @@ export function createPipelineAiHelpers(deps: PipelineAiHelperDeps): PipelineAIC
 				(outputKind
 					? autoOutputAsset(outputKind as PipelineOutputKind, deps.getFolder(), language)
 					: undefined)
+			// Effective outputs = what actually becomes an output edge on the canvas:
+			// body/annotation-inferred writes, or the output_kind seed as a fallback.
+			const outputAssets =
+				inferred.writes.length > 0 ? inferred.writes : seeded ? [seeded] : undefined
 			const next = new Map(drafts)
 			next.set(path, {
 				localId: deps.newDraftLocalId(),
 				script: makePipelineScript(language, path, content, new Date().toISOString()),
-				outputAssets: inferred.writes.length > 0 ? inferred.writes : seeded ? [seeded] : undefined,
+				outputAssets,
 				inputAssets: inferred.reads
 			})
 			deps.setDrafts(next)
 			deps.onShowDrafts?.()
 			deps.onProposeNode?.(path)
-			return { path }
+			// Report deployable lineage only (body writes + `// materialize` target),
+			// never the random `seeded` placeholder — else a dynamic/unwritten output
+			// reads as wired when the deployed script has no such edge.
+			return {
+				path,
+				detectedReads: inferred.reads.map(assetUri),
+				detectedWrites: dedupeAssets([...inferred.writes, ...materializeWrites(content)]).map(
+					assetUri
+				)
+			}
 		},
 		editNode: async (path, content) => {
 			deps.ensureEditable?.()
@@ -273,16 +311,24 @@ export function createPipelineAiHelpers(deps: PipelineAiHelperDeps): PipelineAIC
 				baseScript = await ScriptService.getScriptByPath({ workspace, path })
 			}
 			const inferred = await inferDraftAssets(baseScript.language, content)
+			const outputAssets = inferred.writes.length > 0 ? inferred.writes : existing?.outputAssets
 			const next = new Map(drafts)
 			next.set(path, {
 				localId: existing?.localId ?? deps.newDraftLocalId(),
 				script: { ...baseScript, content },
-				outputAssets: inferred.writes.length > 0 ? inferred.writes : existing?.outputAssets,
+				outputAssets,
 				inputAssets: inferred.reads
 			})
 			deps.setDrafts(next)
 			deps.onShowDrafts?.()
 			deps.onProposeNode?.(path)
+			// Deployable lineage only (see proposeNode): body writes + materialize target.
+			return {
+				detectedReads: inferred.reads.map(assetUri),
+				detectedWrites: dedupeAssets([...inferred.writes, ...materializeWrites(content)]).map(
+					assetUri
+				)
+			}
 		},
 		removeProposedNode: async (path) => {
 			if (!deps.getDrafts().has(path)) {
diff --git a/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts b/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
index d33a0ded8e..847c0c6ffd 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
+++ b/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
@@ -355,6 +355,10 @@ export class AIChatManager {
 
 	mode = $state<AIMode>(AIMode.NAVIGATOR)
 	pipelineAiChatHelpers = $state<PipelineAIChatHelpers | undefined>(undefined)
+	// Resolved when a pipeline editor registers its tools. open_preview(pipeline)
+	// awaits this so the model's next build_pipeline_node call can't race ahead of
+	// the async canvas mount and hit "Unknown tool call".
+	#pipelineHelpersWaiters = new Set<() => void>()
 	readonly isOpen = $derived(chatState.size > 0)
 	savedSize = $state<number>(0)
 	instructions = $state<string>('')
@@ -1816,7 +1820,6 @@ export class AIChatManager {
 			// workspace instead, so leave it unset there — allowedOpenPages reads the store.
 			...(this.isSessionChat
 				? {
-						isSessionChat: true,
 						sessionId: this.sessionId,
 						operatingWorkspace: this.operatingWorkspace,
 						artifacts: this.artifacts,
@@ -3680,6 +3683,10 @@ export class AIChatManager {
 				this.configureGlobalMode()
 			}
 		})
+		// The pipeline tools are now registered — release anything awaiting them.
+		const waiters = [...this.#pipelineHelpersWaiters]
+		this.#pipelineHelpersWaiters.clear()
+		waiters.forEach((resolve) => resolve())
 
 		return () => {
 			this.pipelineAiChatHelpers = undefined
@@ -3691,6 +3698,30 @@ export class AIChatManager {
 		}
 	}
 
+	/**
+	 * Await the pipeline editor's tool registration. Resolves `true` immediately
+	 * when a pipeline editor is already mounted, or when the next one registers;
+	 * resolves `false` after `timeoutMs` if none registers (e.g. a backgrounded
+	 * session whose preview tab is not mounted, or a closed tab). Callers must
+	 * treat `false` as "tools NOT available" rather than silently reporting
+	 * success — the open_preview handler surfaces that to the model.
+	 */
+	waitForPipelineHelpers = (timeoutMs = 8000): Promise<boolean> => {
+		if (this.pipelineAiChatHelpers) return Promise.resolve(true)
+		return new Promise<boolean>((resolve) => {
+			let settled = false
+			const finish = (registered: boolean) => {
+				if (settled) return
+				settled = true
+				this.#pipelineHelpersWaiters.delete(onRegister)
+				resolve(registered)
+			}
+			const onRegister = () => finish(true)
+			this.#pipelineHelpersWaiters.add(onRegister)
+			setTimeout(() => finish(false), timeoutMs)
+		})
+	}
+
 	/**
 	 * Refresh cached datatables from the app helpers (async)
 	 * Creates one context element per table (not per datatable)
diff --git a/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts b/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts
index 01bb4da732..4e60c35ef3 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts
+++ b/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts
@@ -1,5 +1,6 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import type { FlowAIChatHelpers } from './flow/core'
+import type { PipelineAIChatHelpers } from './pipeline/core'
 import type { CurrentEditor } from '$lib/components/flows/types'
 import type { ReviewChangesOpts } from './monaco-adapter'
 import type { ChatCompletionMessageParam } from 'openai/resources/chat/completions.mjs'
@@ -2960,3 +2961,45 @@ describe('DOM selector chips scoped by app path', () => {
 		expect(queuedSelectors).toEqual(['div.a', 'div.b'])
 	})
 })
+
+// Guards the seam behind the open_preview(pipeline) fix: the pipeline editor
+// registers build_pipeline_node / edit_pipeline_node asynchronously on mount, so
+// open_preview must wait for that registration before returning or the model's
+// next turn races the mount and hits "Unknown tool call".
+describe('AIChatManager.waitForPipelineHelpers', () => {
+	function fakePipelineHelpers(): PipelineAIChatHelpers {
+		return {
+			getPipelineContext: () => ({ folder: 'f', mode: 'edit', nodes: [], assets: [] }),
+			getNodeBody: async () => undefined,
+			proposeNode: async () => ({ path: '', detectedReads: [], detectedWrites: [] }),
+			editNode: async () => ({ detectedReads: [], detectedWrites: [] }),
+			removeProposedNode: async () => {},
+			testNode: async () => undefined
+		}
+	}
+
+	it('resolves true immediately when a pipeline editor is already registered', async () => {
+		const manager = new AIChatManager()
+		manager.setPipelineHelpers(fakePipelineHelpers())
+		await expect(manager.waitForPipelineHelpers(1000)).resolves.toBe(true)
+	})
+
+	it('resolves true once a pipeline editor registers', async () => {
+		const manager = new AIChatManager()
+		let outcome: boolean | undefined
+		const wait = manager.waitForPipelineHelpers(1000).then((v) => (outcome = v))
+		await Promise.resolve()
+		expect(outcome).toBeUndefined()
+		manager.setPipelineHelpers(fakePipelineHelpers())
+		await wait
+		expect(outcome).toBe(true)
+	})
+
+	// The false result is the signal the open_preview handler needs: a backgrounded
+	// session's editor never mounts, so it must report "tools unavailable" rather
+	// than silently claim success.
+	it('resolves false after the timeout when no editor ever registers', async () => {
+		const manager = new AIChatManager()
+		await expect(manager.waitForPipelineHelpers(10)).resolves.toBe(false)
+	})
+})
diff --git a/frontend/src/lib/components/copilot/chat/global/core.test.ts b/frontend/src/lib/components/copilot/chat/global/core.test.ts
index 268a66e38e..19c05e00ef 100644
--- a/frontend/src/lib/components/copilot/chat/global/core.test.ts
+++ b/frontend/src/lib/components/copilot/chat/global/core.test.ts
@@ -3862,65 +3862,63 @@ describe('folder tools', () => {
 	})
 })
 
-describe('session pipeline gate', () => {
-	const FLAG = 'wm_dev_session_pipelines'
-	afterEach(() => {
-		localStorage.removeItem(FLAG)
-	})
-
-	it('replaces the session prompt pipeline guidance with the alpha notice by default', () => {
-		const content = prepareGlobalSystemMessage(undefined, { previewTools: true }).content as string
-		expect(content).toContain('Data pipelines are in alpha and NOT yet available in this chat')
-		expect(content).not.toContain('call get_instructions with subject "pipeline"')
-		expect(content).not.toContain('Building a data pipeline: call open_preview')
-	})
-
-	it('restores the session pipeline guidance when the dev flag is set', () => {
-		localStorage.setItem(FLAG, '1')
+describe('session pipeline surface (alpha)', () => {
+	it('gives the session prompt pipeline guidance plus an alpha heads-up', () => {
 		const content = prepareGlobalSystemMessage(undefined, { previewTools: true }).content as string
 		expect(content).toContain('call get_instructions with subject "pipeline"')
 		expect(content).toContain('Building a data pipeline: call open_preview')
-		expect(content).not.toContain('Data pipelines are in alpha and NOT yet available in this chat')
+		expect(content).toContain('Data pipeline support in this chat is in ALPHA')
 	})
 
-	it('leaves the standalone (non-session) chat pipeline guidance ungated', () => {
+	it('leaves the standalone (non-session) chat pipeline guidance alpha-free', () => {
 		const content = prepareGlobalSystemMessage(undefined, { previewTools: false }).content as string
 		expect(content).toContain('call get_instructions with subject "pipeline"')
-		expect(content).not.toContain('Data pipelines are in alpha and NOT yet available in this chat')
+		expect(content).not.toContain('Data pipeline support in this chat is in ALPHA')
 	})
 
-	it('refuses get_instructions(pipeline) in a session but not outside one', async () => {
+	it('serves the real pipeline instructions for get_instructions(pipeline) inside a session', async () => {
 		const inSession = await callGlobalTool('get_instructions', { subject: 'pipeline' }, undefined, {
-			isSessionChat: true,
 			sessionId: 'session-1'
 		})
-		expect(inSession).toContain('data pipelines are in alpha')
-
-		const outsideSession = await callGlobalTool('get_instructions', { subject: 'pipeline' })
-		expect(outsideSession).not.toContain('data pipelines are in alpha')
-
-		// The eval harness passes a sessionId to standalone (non-session) chats;
-		// only the explicit isSessionChat marker may engage the gate.
-		const standaloneWithSessionId = await callGlobalTool(
-			'get_instructions',
-			{ subject: 'pipeline' },
-			undefined,
-			{ sessionId: 'eval-session' }
-		)
-		expect(standaloneWithSessionId).not.toContain('data pipelines are in alpha')
+		// Assert the real authoring guidance is returned, not merely a non-error.
+		expect(inSession).toContain('Data pipeline authoring')
 	})
 
-	it('refuses open_preview(kind=pipeline) while gated', async () => {
+	it('opens open_preview(kind=pipeline) inside a session', async () => {
 		const handler = vi.fn(() => 'opened')
 		setOpenPreviewHandler(handler)
 		try {
-			const gated = await callGlobalTool('open_preview', { kind: 'pipeline', path: 'my_folder' })
-			expect(gated).toContain('data pipelines are in alpha')
-			expect(handler).not.toHaveBeenCalled()
-
-			localStorage.setItem(FLAG, '1')
 			const opened = await callGlobalTool('open_preview', { kind: 'pipeline', path: 'my_folder' })
 			expect(opened).toBe('opened')
+			expect(handler).toHaveBeenCalled()
+		} finally {
+			setOpenPreviewHandler(undefined)
+		}
+	})
+
+	// The pipeline preview handler awaits the editor's async tool registration
+	// (sessionRuntime -> AIChatManager.waitForPipelineHelpers) before resolving.
+	// open_preview must not settle until then, or the model's next turn races the
+	// mount and hits "Unknown tool call". A Promise-returning handler proves the
+	// tool awaits it rather than returning as soon as the tab opens.
+	it('keeps open_preview(kind=pipeline) pending until the async handler resolves', async () => {
+		let release!: (v: string) => void
+		const handler = vi.fn(() => new Promise<string>((resolve) => (release = resolve)))
+		setOpenPreviewHandler(handler)
+		try {
+			let settled = false
+			const call = callGlobalTool('open_preview', { kind: 'pipeline', path: 'my_folder' }).then(
+				(r) => {
+					settled = true
+					return r
+				}
+			)
+			await Promise.resolve()
+			expect(handler).toHaveBeenCalled()
+			expect(settled).toBe(false)
+			release('opened')
+			expect(await call).toBe('opened')
+			expect(settled).toBe(true)
 		} finally {
 			setOpenPreviewHandler(undefined)
 		}
diff --git a/frontend/src/lib/components/copilot/chat/global/core.ts b/frontend/src/lib/components/copilot/chat/global/core.ts
index f3bd5ccae3..e512c60d90 100644
--- a/frontend/src/lib/components/copilot/chat/global/core.ts
+++ b/frontend/src/lib/components/copilot/chat/global/core.ts
@@ -202,7 +202,6 @@ const VARIABLE_MASKED_NOTE =
 const SECRET_UNCOMPARABLE_NOTE =
 	'Note: this is a SECRET variable — its value is never shown and cannot be compared, so it may ALSO have changed beyond what this diff shows.\n\n'
 import { apiCatalogTools } from './apiCatalogTools'
-import { isSessionPipelinesEnabled, SESSION_PIPELINES_GATED_MESSAGE } from './pipelineGate'
 
 const ITEM_TYPES = [
 	'script',
@@ -1137,11 +1136,13 @@ const buildGlobalSystemPrompt = (
 	const folderGuidance = buildFolderGuidance(username, folderCtx)
 	const folderGuidanceBlock = folderGuidance ? `\n${folderGuidance}` : ''
 	// `previewTools` doubles as "this is a session chat" — sessions are the only
-	// chats that get the preview tool set, and the only surface the gate covers.
-	const pipelinesGated = previewTools && !isSessionPipelinesEnabled()
-	const pipelineBullet = pipelinesGated
-		? `- Data pipelines are in alpha and NOT yet available in this chat. A "data pipeline" is a DAG of independent annotated scripts wired by storage assets — it is not a flow. If the user asks for a data pipeline (or to ingest/transform/materialize data across steps in one), tell them that data pipelines are in alpha and will be handled by the chat soon — do not build one (no annotated pipeline scripts, no get_instructions with subject "pipeline"), and do not build a flow as a substitute.`
-		: `- A "data pipeline" is NOT a flow: it is a DAG of independent scripts in one folder, wired by storage assets (DuckLake/data tables/S3) and triggers via top-of-file \`pipeline\` / \`on <ref>\` annotation comments written in each script's comment syntax (\`--\` for SQL, \`#\` for Python/Bash, \`//\` for TS — a \`//\` line in a SQL node is a syntax error). When the user asks for a data pipeline (or to ingest/transform/materialize data across steps), call get_instructions with subject "pipeline" and build annotated script drafts — do not build a flow.`
+	// chats that get the preview tool set. The alpha heads-up only makes sense
+	// there, where the chat actively builds the pipeline on the canvas; the
+	// standalone global chat keeps its plain guidance.
+	const pipelineAlphaNote = previewTools
+		? ' Data pipeline support in this chat is in ALPHA: the first time the user asks for a data pipeline in this session, briefly tell them it is an alpha feature before you start building.'
+		: ''
+	const pipelineBullet = `- A "data pipeline" is NOT a flow: it is a DAG of independent scripts in one folder, wired by storage assets (DuckLake/data tables/S3) and triggers via top-of-file \`pipeline\` / \`on <ref>\` annotation comments written in each script's comment syntax (\`--\` for SQL, \`#\` for Python/Bash, \`//\` for TS — a \`//\` line in a SQL node is a syntax error). When the user asks for a data pipeline (or to ingest/transform/materialize data across steps), call get_instructions with subject "pipeline" and build annotated script drafts — do not build a flow.${pipelineAlphaNote}`
 	return `You are Windmill's global workspace assistant.
 
 The current user's workspace username is "${username}".
@@ -1184,12 +1185,8 @@ ${pipelineBullet}
 - Keep context targeted.${
 		previewTools
 			? `
-- After writing or substantially editing a script / flow / app draft, show it via open_preview(kind, path) so the user sees the editor and live preview right next to the chat. First check whether it is already shown: if unsure, call get_preview_status. Only call open_preview (or offer to) when no preview is open or it is showing a different item — don't re-open a preview already showing the item you just edited.${
-					pipelinesGated
-						? ''
-						: `
-- Building a data pipeline: call open_preview(kind="pipeline", path="<folder>") as the FIRST step, before creating any node — this opens the pipeline editor the user reviews in. path is the folder, not an item; an empty or not-yet-created folder is fine (create_folder first if needed, then open it). Opening it registers build_pipeline_node / edit_pipeline_node — use ONLY those to add or change pipeline nodes, never write_script for a pipeline node — they apply directly as unsaved drafts on the canvas (no separate accept/reject step) that the user reviews and deploys. Do not write pipeline scripts without first opening the editor.`
-				}
+- After writing or substantially editing a script / flow / app draft, show it via open_preview(kind, path) so the user sees the editor and live preview right next to the chat. First check whether it is already shown: if unsure, call get_preview_status. Only call open_preview (or offer to) when no preview is open or it is showing a different item — don't re-open a preview already showing the item you just edited.
+- Building a data pipeline: call open_preview(kind="pipeline", path="<folder>") as the FIRST step, before creating any node — this opens the pipeline editor the user reviews in. path is the folder, not an item; an empty or not-yet-created folder is fine (create_folder first if needed, then open it). Opening it registers build_pipeline_node / edit_pipeline_node — use ONLY those to add or change pipeline nodes, never write_script for a pipeline node — they apply directly as unsaved drafts on the canvas (no separate accept/reject step) that the user reviews and deploys. Do not write pipeline scripts without first opening the editor.
 - When debugging a running raw app, call get_app_runtime_logs to read the live preview's browser console output. It needs the raw app preview open (open_preview kind="raw_app").
 - To inspect what actually rendered in a running raw app (verify an edit landed on screen, diagnose a blank/empty or wrong view, answer "what's showing"), use search_dom (regex over the live HTML) and read_dom (a line-numbered window). Pass a \`selector\` to scope to an element — prefer the selector from a DOM element chip the user attached — or omit it for the whole page. When a chip lists an \`app_path\`, pass it too so the RIGHT app is read (several previews can be open; a query without \`app_path\` hits the visible one). The DOM is read live and is never in context; no match means the element isn't rendered. Both need the raw app preview open.
 - get_app_runtime_logs only shows the app's browser console. For the server-side logs of a backend runnable the app invoked (a backend.<id> call), call list_app_runs to get that run's job_id from the live preview, then get_job_logs with it. Use this when a backend call errors or returns something unexpected.
@@ -2562,16 +2559,6 @@ export const globalTools: Tool<{}>[] = [
 		fn: async (ctx) => {
 			const { args, toolId, toolCallbacks } = ctx
 			const parsed = getInstructionsSchema.parse(args)
-			// Session chats (explicit isSessionChat helper) don't get pipeline
-			// authoring while pipelines are gated; the standalone global chat keeps it.
-			if (
-				parsed.subject === 'pipeline' &&
-				isSessionChatFromCtx(ctx) &&
-				!isSessionPipelinesEnabled()
-			) {
-				toolCallbacks.setToolStatus(toolId, { content: 'Data pipelines are in alpha' })
-				return SESSION_PIPELINES_GATED_MESSAGE
-			}
 			const label =
 				parsed.subject === 'script' && parsed.language
 					? `${parsed.subject} (${parsed.language})`
@@ -3608,20 +3595,12 @@ export type GlobalToolHelpers = SessionToolHelpers & {
 	// side-panel chat). Backs open_page's compare-page default preselection.
 	getModifiedItems?: () => string[] | undefined
 	openArtifact?: (artifactId: string, name: string) => void
-	// Explicit "this chat is an AI session" marker for session-scoped gating
-	// (the pipeline gate). Do NOT infer it from `sessionId`: the eval harness
-	// passes a sessionId to its standalone (non-session) chats too.
-	isSessionChat?: boolean
 }
 
 function sessionIdFromCtx(ctx: { helpers?: unknown }): string | undefined {
 	return (ctx.helpers as GlobalToolHelpers | undefined)?.sessionId
 }
 
-function isSessionChatFromCtx(ctx: { helpers?: unknown }): boolean {
-	return (ctx.helpers as GlobalToolHelpers | undefined)?.isSessionChat === true
-}
-
 function operatingWorkspaceFromHelpers(helpers: unknown): string | undefined {
 	return (helpers as GlobalToolHelpers | undefined)?.operatingWorkspace
 }
@@ -3641,7 +3620,7 @@ export type OpenPreviewHandler = (req: {
 	sessionId: string | undefined
 	kind: 'script' | 'flow' | 'raw_app' | 'pipeline'
 	path: string
-}) => string
+}) => string | Promise<string>
 
 let openPreviewHandler: OpenPreviewHandler | undefined
 
@@ -3649,18 +3628,17 @@ export function setOpenPreviewHandler(handler: OpenPreviewHandler | undefined):
 	openPreviewHandler = handler
 }
 
-function openSessionPreview(
+async function openSessionPreview(
 	args: { kind: 'script' | 'flow' | 'raw_app' | 'pipeline'; path: string },
 	sessionId: string | undefined
-): string {
+): Promise<string> {
 	if (!openPreviewHandler) {
 		return 'Error: open_preview is only available inside an AI session. Tell the user to switch to a session to view the preview, or describe the item textually.'
 	}
 	// open_preview only exists in sessions, so no sessionId check is needed here.
-	if (args.kind === 'pipeline' && !isSessionPipelinesEnabled()) {
-		return SESSION_PIPELINES_GATED_MESSAGE
-	}
-	return openPreviewHandler({ ...args, sessionId })
+	// For a pipeline the handler awaits the editor's tool registration, so the
+	// model's next build_pipeline_node call can't race the async canvas mount.
+	return await openPreviewHandler({ ...args, sessionId })
 }
 
 // Opens a workspace *page* (Runs, Schedules, …) as a page tab in the session's
diff --git a/frontend/src/lib/components/copilot/chat/global/pipelineGate.ts b/frontend/src/lib/components/copilot/chat/global/pipelineGate.ts
deleted file mode 100644
index e397b23b42..0000000000
--- a/frontend/src/lib/components/copilot/chat/global/pipelineGate.ts
+++ /dev/null
@@ -1,36 +0,0 @@
-/**
- * Dev-only gate for data pipelines inside AI sessions.
- *
- * Data pipelines are in alpha: a session chat must not build them for regular
- * users yet — it tells the user pipelines will be handled by the chat soon
- * instead. Developers/QA enable the session pipeline surface in their browser
- * with:
- *
- *     localStorage.setItem('wm_dev_session_pipelines', '1')
- *
- * and reload the page. To disable, remove the key or set it to anything else.
- *
- * Only the session surface is gated: the standalone global side-panel chat and
- * the full-page /pipeline editor keep their pipeline support (the eval harness
- * exercises the former in Node, where this gate must never engage). When
- * pipelines ship in sessions, replace every call to
- * `isSessionPipelinesEnabled()` with `true` and delete this file. The
- * references are intentionally narrow (the session system-prompt bullets, the
- * get_instructions/open_preview execution guards, and the session preview
- * router) so the rip-out is a small grep.
- */
-const STORAGE_KEY = 'wm_dev_session_pipelines'
-
-export function isSessionPipelinesEnabled(): boolean {
-	if (typeof localStorage === 'undefined') return false
-	try {
-		return localStorage.getItem(STORAGE_KEY) === '1'
-	} catch {
-		return false
-	}
-}
-
-/** Tool result returned when a gated session chat still tries a pipeline
- * action — instructs the model to deliver the alpha notice instead. */
-export const SESSION_PIPELINES_GATED_MESSAGE =
-	'Not available: data pipelines are in alpha and this chat cannot build them yet. Tell the user that data pipelines are in alpha and will be handled by the chat soon. Do not write annotated pipeline scripts manually, and do not build a flow as a substitute.'
diff --git a/frontend/src/lib/components/copilot/chat/pipeline/core.test.ts b/frontend/src/lib/components/copilot/chat/pipeline/core.test.ts
index 4f3e31986d..c0d9b7ac8b 100644
--- a/frontend/src/lib/components/copilot/chat/pipeline/core.test.ts
+++ b/frontend/src/lib/components/copilot/chat/pipeline/core.test.ts
@@ -57,10 +57,11 @@ function makeHelpers(overrides: Partial<PipelineAIChatHelpers> = {}): {
 		},
 		proposeNode: async (input) => {
 			calls.proposeNode = [...(calls.proposeNode ?? []), [input]]
-			return { path: input.path }
+			return { path: input.path, detectedReads: [], detectedWrites: [] }
 		},
 		editNode: async (path, content) => {
 			calls.editNode = [...(calls.editNode ?? []), [path, content]]
+			return { detectedReads: [], detectedWrites: [] }
 		},
 		removeProposedNode: record('removeProposedNode'),
 		testNode: async () => 'job-123',
@@ -115,6 +116,40 @@ describe('pipeline tools', () => {
 		expect(out).toContain('not deployed')
 	})
 
+	it('build_pipeline_node reports the inferred asset lineage', async () => {
+		const { helpers } = makeHelpers({
+			proposeNode: async (input) => ({
+				path: input.path,
+				detectedReads: ['s3:///raw/in.csv'],
+				detectedWrites: ['ducklake://main/out']
+			})
+		})
+		const out = await toolByName('build_pipeline_node').fn({
+			args: { path: 'f/analytics/clean', language: 'duckdb', content: '-- pipeline' },
+			workspace: 'w',
+			helpers,
+			toolCallbacks: noopCallbacks(),
+			toolId: 't'
+		})
+		expect(out).toContain('writes ducklake://main/out')
+		expect(out).toContain('reads s3:///raw/in.csv')
+	})
+
+	it('build_pipeline_node warns when no asset lineage is inferred', async () => {
+		const { helpers } = makeHelpers({
+			proposeNode: async (input) => ({ path: input.path, detectedReads: [], detectedWrites: [] })
+		})
+		const out = await toolByName('build_pipeline_node').fn({
+			args: { path: 'f/analytics/clean', language: 'duckdb', content: '-- pipeline' },
+			workspace: 'w',
+			helpers,
+			toolCallbacks: noopCallbacks(),
+			toolId: 't'
+		})
+		expect(out).toMatch(/no storage-asset read or write was inferred/i)
+		expect(out).toContain('string literal')
+	})
+
 	it('edit_pipeline_node reads then applies an exact find/replace', async () => {
 		const { helpers, calls } = makeHelpers({
 			getNodeBody: async () => ({ language: 'bun', content: 'const x = 1\nconst y = 2\n' })
diff --git a/frontend/src/lib/components/copilot/chat/pipeline/core.ts b/frontend/src/lib/components/copilot/chat/pipeline/core.ts
index 795b2983fe..f689699dd5 100644
--- a/frontend/src/lib/components/copilot/chat/pipeline/core.ts
+++ b/frontend/src/lib/components/copilot/chat/pipeline/core.ts
@@ -53,15 +53,21 @@ export interface PipelineAIChatHelpers {
 	getPipelineContext: () => PipelineContext
 	/** Read a node's source (the in-flight draft body if one exists, else deployed). */
 	getNodeBody: (path: string) => Promise<{ language: ScriptLang; content: string } | undefined>
-	/** Create a brand-new pipeline node as an unsaved draft on the canvas. */
+	/** Create a brand-new pipeline node as an unsaved draft on the canvas.
+	 * Returns the asset lineage inferred from the node (as URIs) so the caller can
+	 * confirm the intended edges formed without a separate graph read. */
 	proposeNode: (input: {
 		path: string
 		language: ScriptLang
 		content: string
 		outputKind?: PipelineOutputKind
-	}) => Promise<{ path: string }>
-	/** Replace an existing node's body, applied as an unsaved draft. */
-	editNode: (path: string, content: string) => Promise<void>
+	}) => Promise<{ path: string; detectedReads: string[]; detectedWrites: string[] }>
+	/** Replace an existing node's body, applied as an unsaved draft. Returns the
+	 * re-inferred asset lineage (URIs) so the caller sees the effect of the edit. */
+	editNode: (
+		path: string,
+		content: string
+	) => Promise<{ detectedReads: string[]; detectedWrites: string[] }>
 	/** Discard the unsaved draft at a path (undo a build_pipeline_node). */
 	removeProposedNode: (path: string) => Promise<void>
 	/** Preview-run a node (draft body preferred). Returns the started job id. */
@@ -184,9 +190,20 @@ const testPipelineNodeToolDef = createToolDef(
 	{ strict: false }
 )
 
-// ----------------------------------------------------------------------------
-// Tool set
-// ----------------------------------------------------------------------------
+// Summarize the asset lineage the parser inferred from a just-applied node so the
+// model gets same-turn feedback on whether its intended edges formed. An empty
+// result is the useful signal: a write/read expressed via a variable or dynamic
+// path is not detected, so no lineage edge forms — flag it rather than let the
+// model discover it only on a later graph read.
+function inferredLineageNote(reads: string[], writes: string[]): string {
+	const parts: string[] = []
+	if (writes.length) parts.push(`writes ${writes.join(', ')}`)
+	if (reads.length) parts.push(`reads ${reads.join(', ')}`)
+	if (parts.length === 0) {
+		return ' No storage-asset read or write was inferred from it — if this node is meant to feed or consume another node, make sure the asset reference is a string literal (a variable, f-string, or computed path is not detected, so no lineage edge forms).'
+	}
+	return ` Inferred lineage: ${parts.join('; ')}.`
+}
 
 export const pipelineTools: Tool<PipelineToolHelpers>[] = [
 	{
@@ -225,7 +242,7 @@ export const pipelineTools: Tool<PipelineToolHelpers>[] = [
 			const pipeline = requirePipeline(helpers)
 			const { path, language, content, output_kind } = buildPipelineNodeSchema.parse(args)
 			toolCallbacks.setToolStatus(toolId, { content: `Building node '${path}'...` })
-			await pipeline.proposeNode({
+			const { detectedReads, detectedWrites } = await pipeline.proposeNode({
 				path,
 				language: language as ScriptLang,
 				content,
@@ -235,7 +252,7 @@ export const pipelineTools: Tool<PipelineToolHelpers>[] = [
 				content: `Added draft node '${path}'`,
 				result: 'Success'
 			})
-			return `Pipeline node '${path}' added as an unsaved draft on the canvas. It is not deployed — the user deploys it.`
+			return `Pipeline node '${path}' added as an unsaved draft on the canvas. It is not deployed — the user deploys it.${inferredLineageNote(detectedReads, detectedWrites)}`
 		}
 	},
 	{
@@ -258,12 +275,12 @@ export const pipelineTools: Tool<PipelineToolHelpers>[] = [
 				replace_all ?? false,
 				'node source'
 			)
-			await pipeline.editNode(path, updated)
+			const { detectedReads, detectedWrites } = await pipeline.editNode(path, updated)
 			toolCallbacks.setToolStatus(toolId, {
 				content: `Edited draft '${path}'`,
 				result: 'Success'
 			})
-			return `Pipeline node '${path}' updated as an unsaved draft on the canvas (not deployed).`
+			return `Pipeline node '${path}' updated as an unsaved draft on the canvas (not deployed).${inferredLineageNote(detectedReads, detectedWrites)}`
 		}
 	},
 	{
diff --git a/frontend/src/lib/components/sessions/previewRouter.test.ts b/frontend/src/lib/components/sessions/previewRouter.test.ts
index cd1a78fd8e..8dfcbb52fc 100644
--- a/frontend/src/lib/components/sessions/previewRouter.test.ts
+++ b/frontend/src/lib/components/sessions/previewRouter.test.ts
@@ -108,21 +108,12 @@ describe('resolvePreviewTab', () => {
 		expect(resolvePreviewTab('/apps/edit/f/a/b')).toEqual({ kind: 'iframe' })
 	})
 
-	it('routes a pipeline folder to the pipeline editor kind when session pipelines are enabled', () => {
-		localStorage.setItem('wm_dev_session_pipelines', '1')
-		try {
-			expect(resolvePreviewTab('/pipeline/my_folder')).toEqual({
-				kind: 'editor',
-				editorKind: 'pipeline',
-				path: 'my_folder'
-			})
-		} finally {
-			localStorage.removeItem('wm_dev_session_pipelines')
-		}
-	})
-
-	it('routes a pipeline folder to the iframe fallback while session pipelines are gated', () => {
-		expect(resolvePreviewTab('/pipeline/my_folder')).toEqual({ kind: 'iframe' })
+	it('routes a pipeline folder to the pipeline editor kind', () => {
+		expect(resolvePreviewTab('/pipeline/my_folder')).toEqual({
+			kind: 'editor',
+			editorKind: 'pipeline',
+			path: 'my_folder'
+		})
 	})
 
 	it('routes the bare pipeline list page to the iframe fallback', () => {
diff --git a/frontend/src/lib/components/sessions/previewRouter.ts b/frontend/src/lib/components/sessions/previewRouter.ts
index 1a876491db..4fd55861fd 100644
--- a/frontend/src/lib/components/sessions/previewRouter.ts
+++ b/frontend/src/lib/components/sessions/previewRouter.ts
@@ -14,7 +14,6 @@ import {
 } from 'lucide-svelte'
 import type { DrillIcon } from '$lib/components/drillPicker'
 import type { WorkspaceItem, WorkspaceItemKind } from '$lib/components/workspacePicker'
-import { isSessionPipelinesEnabled } from '$lib/components/copilot/chat/global/pipelineGate'
 import type { SessionTargetKind } from './sessionRuntime.svelte'
 
 /** What the preview breadcrumb picker can route to: a static workspace page
@@ -208,11 +207,8 @@ export type PreviewSlot =
 export function resolvePreviewTab(url: string): PreviewSlot {
 	const artifact = parseArtifactRoute(url)
 	if (artifact) return { kind: 'artifact', id: artifact.id }
-	// While session pipelines are gated, a /pipeline/<folder> tab stays a plain
-	// iframe: mounting the in-realm pipeline editor would register the pipeline
-	// canvas tools on the session chat, un-gating it through the back door.
 	const pipelineFolder = parsePipelineRoute(url)
-	if (pipelineFolder && isSessionPipelinesEnabled()) {
+	if (pipelineFolder) {
 		return { kind: 'editor', editorKind: 'pipeline', path: pipelineFolder }
 	}
 	const route = parsePreviewItemRoute(url)
diff --git a/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts b/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts
index df5ac6aada..f95e4afa9b 100644
--- a/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts
+++ b/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts
@@ -986,7 +986,7 @@ export function removeSession(sessionId: string): void {
 // backgrounded session's tool call opens its OWN preview, not the one the user
 // happens to be viewing. Outside a session there is no calling/active id and
 // the tool returns a polite error.
-setOpenPreviewHandler(({ sessionId: callerSessionId, kind, path }) => {
+setOpenPreviewHandler(async ({ sessionId: callerSessionId, kind, path }) => {
 	const sessionId = callerSessionId ?? sessionState.currentSessionId
 	if (!sessionId) {
 		return 'Error: no active session to open the preview in.'
@@ -999,7 +999,21 @@ setOpenPreviewHandler(({ sessionId: callerSessionId, kind, path }) => {
 	if (!target) {
 		return `Error: ${kind} targets cannot be shown in the preview panel.`
 	}
-	const result = getOrCreateRuntime(session).previewTabs.open(target)
+	const runtime = getOrCreateRuntime(session)
+	const result = runtime.previewTabs.open(target)
+	// The pipeline editor registers its build_pipeline_node / edit_pipeline_node
+	// tools asynchronously once the canvas mounts. Block the tool result until
+	// they are live so the model's next turn doesn't race ahead and hit an
+	// "Unknown tool call" error on the first node it tries to build.
+	if (kind === 'pipeline') {
+		const ready = await runtime.manager.waitForPipelineHelpers()
+		// A backgrounded session's preview tab does not mount, so its editor never
+		// registers — don't claim success, or the model calls build_pipeline_node
+		// into the void. Tell it the tools aren't available and how to recover.
+		if (!ready) {
+			return `Opened the pipeline preview for "${path}", but its editor tools (build_pipeline_node / edit_pipeline_node) have not registered — this usually means this session is not the one currently displayed. Do NOT call build_pipeline_node yet: ask the user to open/focus this session's pipeline preview, then retry open_preview.`
+		}
+	}
 	return result.status === 'focused'
 		? `A preview tab is already showing ${kind} "${path}" — focused it.`
 		: `Opened ${kind} preview for ${path} in a new tab in the side panel.`
diff --git a/system_prompts/auto-generated/prompts.ts b/system_prompts/auto-generated/prompts.ts
index 8fab73584c..7ab815b644 100644
--- a/system_prompts/auto-generated/prompts.ts
+++ b/system_prompts/auto-generated/prompts.ts
@@ -778,11 +778,31 @@ Never hand back a DuckLake pipeline that cannot run without flagging the missing
 A script joins the pipeline when its source begins with the \`pipeline\` annotation as a top-of-file comment, **written in the script's own comment syntax** — \`//\` for TS/JS (bun), \`--\` for SQL (DuckDB/Postgres), \`#\` for Python/Bash. So it's \`-- pipeline\` in a DuckDB node, \`# pipeline\` in a Python node, \`// pipeline\` in a bun node. Every annotation below uses that same prefix (the \`//\` shown is the TS form). All other wiring is expressed as annotation comments near the top of the file:
 
 - \`// on <ref>\` — declares an execution-DAG **input** (what triggers/feeds this node). \`<ref>\` is either:
-  - an **asset URI** (the node runs when that asset is produced upstream): \`ducklake://main/orders\`, \`datatable://main/users\`, \`s3://<key>\`, \`$res:f/folder/my_resource\`, \`volume://name/path\`.
-  - a **native trigger kind**: \`schedule\`, \`webhook\`, \`email\`, \`kafka\`, \`mqtt\`, \`amqp\`, \`nats\`, \`postgres\`, \`sqs\`, \`gcp\`, or \`data_upload\` (a user-uploaded S3 file). For these the actual trigger row (cron, topic, …) is created separately; the annotation only declares the binding.
+  - an **asset URI** (the node runs when that asset is produced upstream): \`ducklake://main/orders\`, \`datatable://main/users\`, \`$res:f/folder/my_resource\`, \`volume://name/path\`, or an S3 object (see the S3 storage-form rule below).
+  - a **native trigger kind**: \`schedule\`, \`webhook\`, \`email\`, \`kafka\`, \`mqtt\`, \`amqp\`, \`nats\`, \`postgres\`, \`sqs\`, \`gcp\`, or \`data_upload\` (a user-uploaded S3 file). For these the actual trigger row (cron, topic, …) is created separately; the annotation only declares the binding. **\`data_upload\` is special**: there is no trigger row — the node instead declares an **\`S3Object\` input parameter** fed by the auto-generated upload picker; it never hard-codes a key. Any language can be the \`data_upload\` node:
+    - Python (has \`import wmill\`): \`def main(file: wmill.S3Object):\` then \`wmill.load_s3_file(file)\`; TS (has \`import * as wmill from "windmill-client"\`): \`export async function main(file: wmill.S3Object)\`. Qualify the type as \`wmill.S3Object\` (or add \`from wmill import S3Object\` / \`import { S3Object } from "windmill-client"\`) — a bare \`S3Object\` is undefined.
+    - **DuckDB** takes the s3object arg via a \`-- $<name> (s3object)\` declaration and reads it directly, so a single DuckDB node can ingest **and** materialize:
+      \`\`\`
+      -- pipeline
+      -- on data_upload
+      -- materialize ducklake://main/raw_uploads
+      -- $file (s3object)
+      SELECT * FROM read_csv($file)
+      \`\`\`
 - **Outputs** are inferred from what the body writes — a \`CREATE TABLE\`, a \`wmill.writeS3File(...)\`, a DuckLake/datatable write. To declare a managed output explicitly, use \`// materialize <asset-uri>\`.
 - Optional badges: \`// partitioned <daily|hourly|weekly|monthly|dynamic>\`, \`// freshness <duration>\` (e.g. \`1h\`), \`// tag <worker-tag>\`, \`// retry <count> [delay]\`, \`// data_test <kind> ...\`.
 
+## S3 object wiring (storage form matters)
+
+An \`s3://\` URI's first slashes select the **storage**, not part of the key — get this wrong and the producer/consumer edge silently won't connect:
+
+- \`s3:///<key>\` (**triple** slash, empty first segment) = the **default** workspace storage. A downstream node reading or triggering on that object uses \`s3:///<key>\` — e.g. DuckDB \`-- on s3:///orders/2024.parquet\` and \`read_parquet('s3:///orders/2024.parquet')\`.
+- \`s3://<storage>/<key>\` (**double** slash, non-empty first segment) = a **named secondary** storage called \`<storage>\` — so \`s3://ingest/x\` means storage \`ingest\`, key \`x\`, NOT key \`ingest/x\`. Only use this when the object genuinely lives in a configured secondary storage; never invent a bucket/storage name for a default-storage object (it breaks the edge).
+
+To make the producer side visible to lineage, a Python/TS node MUST pass the **\`S3Object\` form**, not a bare key string: Python \`wmill.write_s3_file(wmill.S3Object(s3="<key>"), data)\` (or the import-free dict \`{"s3": "<key>"}\`), TS \`wmill.writeS3File({ s3: "<key>" }, data)\`. That records the default-storage asset \`/<key>\`, which a downstream \`s3:///<key>\` reader connects to (same key both sides). A bare \`write_s3_file("<key>", ...)\` records **no** asset and produces **no** edge. Add \`storage="<name>"\` only for a named secondary storage.
+
+The key must be a **string literal** — the graph parser is static and cannot follow a variable, f-string, or computed path, so \`write_s3_file(wmill.S3Object(s3=key_var), ...)\` records no edge. Inline the literal (\`s3="events/user_events.parquet"\`) on both the writing and reading node. The same rule applies to every asset URI in an annotation or SDK call (\`ducklake://\`, \`datatable://\`, \`s3://\`): write them literally, not via a variable.
+
 ## Materialize (the managed output)
 
 > **\`// materialize\` is DuckDB-only**, and its target must be a DuckLake table (\`ducklake://<name>/<table>\`). Deploy **rejects** \`// materialize\` on any other language (\`python3\`, \`bun\`, \`postgresql\`) or a non-DuckLake target. For a non-DuckDB node, do **not** use \`// materialize\` — write the output via the SDK (\`wmill.writeS3File(...)\`, a postgresql \`CREATE TABLE\`, ducklake helpers, …) and let it be inferred. Use \`duckdb\` when a node should materialize a DuckLake table.
@@ -817,7 +837,7 @@ Node \`f/sales/orders_ingest\` (runs on a schedule, materializes a DuckLake tabl
 -- pipeline
 -- on schedule
 -- materialize ducklake://main/orders
-SELECT * FROM read_csv('s3://raw/orders/*.csv')
+SELECT * FROM read_csv('s3:///raw/orders/*.csv')
 \`\`\`
 
 Node \`f/sales/orders_daily\` (runs when \`orders\` is produced, writes a rollup):
diff --git a/system_prompts/base/pipeline-base.md b/system_prompts/base/pipeline-base.md
index ccd66c6f5a..b2b428c401 100644
--- a/system_prompts/base/pipeline-base.md
+++ b/system_prompts/base/pipeline-base.md
@@ -25,11 +25,31 @@ Never hand back a DuckLake pipeline that cannot run without flagging the missing
 A script joins the pipeline when its source begins with the `pipeline` annotation as a top-of-file comment, **written in the script's own comment syntax** — `//` for TS/JS (bun), `--` for SQL (DuckDB/Postgres), `#` for Python/Bash. So it's `-- pipeline` in a DuckDB node, `# pipeline` in a Python node, `// pipeline` in a bun node. Every annotation below uses that same prefix (the `//` shown is the TS form). All other wiring is expressed as annotation comments near the top of the file:
 
 - `// on <ref>` — declares an execution-DAG **input** (what triggers/feeds this node). `<ref>` is either:
-  - an **asset URI** (the node runs when that asset is produced upstream): `ducklake://main/orders`, `datatable://main/users`, `s3://<key>`, `$res:f/folder/my_resource`, `volume://name/path`.
-  - a **native trigger kind**: `schedule`, `webhook`, `email`, `kafka`, `mqtt`, `amqp`, `nats`, `postgres`, `sqs`, `gcp`, or `data_upload` (a user-uploaded S3 file). For these the actual trigger row (cron, topic, …) is created separately; the annotation only declares the binding.
+  - an **asset URI** (the node runs when that asset is produced upstream): `ducklake://main/orders`, `datatable://main/users`, `$res:f/folder/my_resource`, `volume://name/path`, or an S3 object (see the S3 storage-form rule below).
+  - a **native trigger kind**: `schedule`, `webhook`, `email`, `kafka`, `mqtt`, `amqp`, `nats`, `postgres`, `sqs`, `gcp`, or `data_upload` (a user-uploaded S3 file). For these the actual trigger row (cron, topic, …) is created separately; the annotation only declares the binding. **`data_upload` is special**: there is no trigger row — the node instead declares an **`S3Object` input parameter** fed by the auto-generated upload picker; it never hard-codes a key. Any language can be the `data_upload` node:
+    - Python (has `import wmill`): `def main(file: wmill.S3Object):` then `wmill.load_s3_file(file)`; TS (has `import * as wmill from "windmill-client"`): `export async function main(file: wmill.S3Object)`. Qualify the type as `wmill.S3Object` (or add `from wmill import S3Object` / `import { S3Object } from "windmill-client"`) — a bare `S3Object` is undefined.
+    - **DuckDB** takes the s3object arg via a `-- $<name> (s3object)` declaration and reads it directly, so a single DuckDB node can ingest **and** materialize:
+      ```
+      -- pipeline
+      -- on data_upload
+      -- materialize ducklake://main/raw_uploads
+      -- $file (s3object)
+      SELECT * FROM read_csv($file)
+      ```
 - **Outputs** are inferred from what the body writes — a `CREATE TABLE`, a `wmill.writeS3File(...)`, a DuckLake/datatable write. To declare a managed output explicitly, use `// materialize <asset-uri>`.
 - Optional badges: `// partitioned <daily|hourly|weekly|monthly|dynamic>`, `// freshness <duration>` (e.g. `1h`), `// tag <worker-tag>`, `// retry <count> [delay]`, `// data_test <kind> ...`.
 
+## S3 object wiring (storage form matters)
+
+An `s3://` URI's first slashes select the **storage**, not part of the key — get this wrong and the producer/consumer edge silently won't connect:
+
+- `s3:///<key>` (**triple** slash, empty first segment) = the **default** workspace storage. A downstream node reading or triggering on that object uses `s3:///<key>` — e.g. DuckDB `-- on s3:///orders/2024.parquet` and `read_parquet('s3:///orders/2024.parquet')`.
+- `s3://<storage>/<key>` (**double** slash, non-empty first segment) = a **named secondary** storage called `<storage>` — so `s3://ingest/x` means storage `ingest`, key `x`, NOT key `ingest/x`. Only use this when the object genuinely lives in a configured secondary storage; never invent a bucket/storage name for a default-storage object (it breaks the edge).
+
+To make the producer side visible to lineage, a Python/TS node MUST pass the **`S3Object` form**, not a bare key string: Python `wmill.write_s3_file(wmill.S3Object(s3="<key>"), data)` (or the import-free dict `{"s3": "<key>"}`), TS `wmill.writeS3File({ s3: "<key>" }, data)`. That records the default-storage asset `/<key>`, which a downstream `s3:///<key>` reader connects to (same key both sides). A bare `write_s3_file("<key>", ...)` records **no** asset and produces **no** edge. Add `storage="<name>"` only for a named secondary storage.
+
+The key must be a **string literal** — the graph parser is static and cannot follow a variable, f-string, or computed path, so `write_s3_file(wmill.S3Object(s3=key_var), ...)` records no edge. Inline the literal (`s3="events/user_events.parquet"`) on both the writing and reading node. The same rule applies to every asset URI in an annotation or SDK call (`ducklake://`, `datatable://`, `s3://`): write them literally, not via a variable.
+
 ## Materialize (the managed output)
 
 > **`// materialize` is DuckDB-only**, and its target must be a DuckLake table (`ducklake://<name>/<table>`). Deploy **rejects** `// materialize` on any other language (`python3`, `bun`, `postgresql`) or a non-DuckLake target. For a non-DuckDB node, do **not** use `// materialize` — write the output via the SDK (`wmill.writeS3File(...)`, a postgresql `CREATE TABLE`, ducklake helpers, …) and let it be inferred. Use `duckdb` when a node should materialize a DuckLake table.
@@ -64,7 +84,7 @@ Node `f/sales/orders_ingest` (runs on a schedule, materializes a DuckLake table)
 -- pipeline
 -- on schedule
 -- materialize ducklake://main/orders
-SELECT * FROM read_csv('s3://raw/orders/*.csv')
+SELECT * FROM read_csv('s3:///raw/orders/*.csv')
 ```
 
 Node `f/sales/orders_daily` (runs when `orders` is produced, writes a rollup):

From fa3644281f30d90aa0c4ca86520a38db5d8b91f0 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Thu, 23 Jul 2026 13:40:23 +0200
Subject: [PATCH 137/171] fix(monitor): diagnose zombie-flow OOM on the
 transition worker, not q.worker (#10286)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

handle_zombie_flows() joined worker_ping on the flow's queue-row worker
(q.worker) only. In nested/subflow/forloop cases that worker is frequently
NOT the one that performed the flow's final state transition, so all OOM
detection ran against a healthy bystander and the diagnostic wrongly told
on-call to chase a deadlock / SIGQUIT.

Change 1: when q.worker itself looks healthy, additionally search worker_ping
for a plausible culprit — a different worker on the same pod (worker_instance)
or worker group whose last ping clusters around the flow's last_ping and has
since gone silent (the signature of a worker OOM-killed mid state-transition),
picking the one closest in time to the transition. If found, the message names
that worker and routes to the OOM explanation. The extra query runs only on the
rare zombie path and fails soft (warn + fall back) so it never blocks the cancel.

Change 2: reorder the healthy-q.worker hint to lead with "check whether a
different worker on the same pod/group was OOM-killed around {last_ping}",
keeping deadlock/SIGQUIT as the secondary possibility.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 ...d41e538012b79637c9c0dcd29345ded09f699.json |  65 +++++
 backend/src/monitor.rs                        | 247 ++++++++++++++++--
 2 files changed, 291 insertions(+), 21 deletions(-)
 create mode 100644 backend/.sqlx/query-856697038686ec82f1925f70c57d41e538012b79637c9c0dcd29345ded09f699.json

diff --git a/backend/.sqlx/query-856697038686ec82f1925f70c57d41e538012b79637c9c0dcd29345ded09f699.json b/backend/.sqlx/query-856697038686ec82f1925f70c57d41e538012b79637c9c0dcd29345ded09f699.json
new file mode 100644
index 0000000000..067c1f31b4
--- /dev/null
+++ b/backend/.sqlx/query-856697038686ec82f1925f70c57d41e538012b79637c9c0dcd29345ded09f699.json
@@ -0,0 +1,65 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        WITH ref AS (\n            SELECT worker_instance, worker_group FROM worker_ping WHERE worker = $1 LIMIT 1\n        )\n        SELECT\n            wp.worker AS \"worker!\",\n            wp.ping_at AS \"ping_at!\",\n            wp.memory_usage,\n            wp.wm_memory_usage,\n            wp.memory AS memory_total,\n            wp.worker_group,\n            wp.worker_instance,\n            EXTRACT(EPOCH FROM (wp.ping_at - $2::timestamptz))::float8 AS ping_delta_secs\n        FROM worker_ping wp, ref\n        WHERE wp.worker <> $1\n            AND (\n                (ref.worker_instance IS NOT NULL AND wp.worker_instance = ref.worker_instance)\n                OR (ref.worker_group IS NOT NULL AND wp.worker_group = ref.worker_group)\n            )\n            AND wp.ping_at >= $2::timestamptz - interval '5 seconds'\n            AND wp.ping_at <= $2::timestamptz + interval '15 seconds'\n        ORDER BY ABS(EXTRACT(EPOCH FROM (wp.ping_at - $2::timestamptz))) ASC\n        LIMIT 1\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "worker!",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "ping_at!",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 2,
+        "name": "memory_usage",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 3,
+        "name": "wm_memory_usage",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 4,
+        "name": "memory_total",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 5,
+        "name": "worker_group",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 6,
+        "name": "worker_instance",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 7,
+        "name": "ping_delta_secs",
+        "type_info": "Float8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Timestamptz"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      true,
+      true,
+      true,
+      false,
+      false,
+      null
+    ]
+  },
+  "hash": "856697038686ec82f1925f70c57d41e538012b79637c9c0dcd29345ded09f699"
+}
diff --git a/backend/src/monitor.rs b/backend/src/monitor.rs
index 0a3333e58c..4947b9b211 100644
--- a/backend/src/monitor.rs
+++ b/backend/src/monitor.rs
@@ -4864,6 +4864,87 @@ WHERE concurrency_id IN (SELECT concurrency_id FROM rows_to_delete)  RETURNING c
     Ok(())
 }
 
+/// Memory usage at a worker's last ping as a fraction of its cgroup limit.
+/// Takes the larger of the cgroup-wide reading and the windmill process's
+/// jemalloc resident — if only one is present, that value wins; if both are
+/// present, the larger is the more conservative (higher-signal) choice.
+fn zombie_worker_memory_pct(
+    usage: Option<i64>,
+    wm_usage: Option<i64>,
+    total: Option<i64>,
+) -> Option<f64> {
+    let total = total?;
+    if total <= 0 {
+        return None;
+    }
+    let used = usage.max(wm_usage)?;
+    Some(used as f64 / total as f64)
+}
+
+struct ZombieFlowCulprit {
+    worker: String,
+    ping_at: DateTime<Utc>,
+    memory_usage: Option<i64>,
+    wm_memory_usage: Option<i64>,
+    memory_total: Option<i64>,
+    worker_group: Option<String>,
+    worker_instance: Option<String>,
+    ping_delta_secs: Option<f64>,
+}
+
+/// Finds the worker that likely performed and dropped the flow's final state
+/// transition when `q.worker` (the outer queue-row worker) looks healthy — a
+/// different worker on the same pod/group whose *latest* ping is frozen in the
+/// `[last_ping-5s, +15s]` window (a live worker would have advanced its in-place
+/// ping past that old window, so a frozen ping there proves it has gone silent),
+/// nearest the transition. Diagnostics-only: fails soft to `None`.
+async fn find_zombie_flow_culprit_worker(
+    db: &DB,
+    q_worker: &str,
+    last_ping: DateTime<Utc>,
+) -> Option<ZombieFlowCulprit> {
+    let res = sqlx::query_as!(
+        ZombieFlowCulprit,
+        r#"
+        WITH ref AS (
+            SELECT worker_instance, worker_group FROM worker_ping WHERE worker = $1 LIMIT 1
+        )
+        SELECT
+            wp.worker AS "worker!",
+            wp.ping_at AS "ping_at!",
+            wp.memory_usage,
+            wp.wm_memory_usage,
+            wp.memory AS memory_total,
+            wp.worker_group,
+            wp.worker_instance,
+            EXTRACT(EPOCH FROM (wp.ping_at - $2::timestamptz))::float8 AS ping_delta_secs
+        FROM worker_ping wp, ref
+        WHERE wp.worker <> $1
+            AND (
+                (ref.worker_instance IS NOT NULL AND wp.worker_instance = ref.worker_instance)
+                OR (ref.worker_group IS NOT NULL AND wp.worker_group = ref.worker_group)
+            )
+            AND wp.ping_at >= $2::timestamptz - interval '5 seconds'
+            AND wp.ping_at <= $2::timestamptz + interval '15 seconds'
+        ORDER BY ABS(EXTRACT(EPOCH FROM (wp.ping_at - $2::timestamptz))) ASC
+        LIMIT 1
+        "#,
+        q_worker,
+        last_ping,
+    )
+    .fetch_optional(db)
+    .await;
+    match res {
+        Ok(culprit) => culprit,
+        Err(e) => {
+            tracing::warn!(
+                "failed to query for zombie-flow culprit worker (q_worker={q_worker}): {e:#}"
+            );
+            None
+        }
+    }
+}
+
 async fn handle_zombie_flows(db: &DB) -> error::Result<()> {
     let flows = sqlx::query!(
         r#"
@@ -4963,18 +5044,35 @@ async fn handle_zombie_flows(db: &DB) -> error::Result<()> {
             // worker name; this flow's recorded worker name still points at the
             // dead process whose last ping can be under 60s old, and the memory
             // signal is what lets us catch that window.
-            let memory_pct: Option<f64> = flow.worker_memory_total.and_then(|total| {
-                if total <= 0 {
-                    return None;
-                }
-                let used = flow.worker_memory_usage.max(flow.worker_wm_memory_usage)?;
-                Some(used as f64 / total as f64)
-            });
+            let memory_pct: Option<f64> = zombie_worker_memory_pct(
+                flow.worker_memory_usage,
+                flow.worker_wm_memory_usage,
+                flow.worker_memory_total,
+            );
             let oom_strong = memory_pct.is_some_and(|p| p >= 0.85);
             let oom_moderate = memory_pct.is_some_and(|p| p >= 0.60);
             let mem_pct_str = memory_pct
                 .map(|p| format!("{:.1}% of container limit", (p * 100.0).min(100.0)))
                 .unwrap_or_else(|| "memory unknown at last ping".to_string());
+
+            // When q.worker itself already shows OOM evidence the diagnosis below is
+            // already correct. Otherwise q.worker is likely a bystander (the outer
+            // queue-row worker) and the dropped transition was performed by a
+            // different worker on the same pod/group that OOM-died — go find it.
+            let q_worker_shows_oom = oom_moderate || worker_ping_stale == Some(true);
+            let culprit = if q_worker_shows_oom {
+                None
+            } else if let (Some(qw), Some(lp)) = (flow.worker.as_deref(), flow.last_ping) {
+                find_zombie_flow_culprit_worker(db, qw, lp).await
+            } else {
+                None
+            };
+            let culprit_pct = culprit.as_ref().and_then(|c| {
+                zombie_worker_memory_pct(c.memory_usage, c.wm_memory_usage, c.memory_total)
+            });
+            let culprit_pct_str =
+                culprit_pct.map(|p| format!("{:.1}% of its memory limit", (p * 100.0).min(100.0)));
+
             let worker_info = if let Some(worker_name) = flow.worker.as_deref() {
                 let mut s = format!("\nWorker handling the flow: {worker_name}");
                 match (flow.worker_group.as_deref(), flow.worker_version.as_deref()) {
@@ -5005,8 +5103,11 @@ async fn handle_zombie_flows(db: &DB) -> error::Result<()> {
                         (false, false, true) => format!(
                             "LIKELY OOM-KILLED — {mem_pct_str} at last ping (a replacement worker process may have started in the same pod under a new windmill worker name)"
                         ),
+                        (false, false, false) if culprit.is_some() => {
+                            "still pinging with healthy memory — this is NOT the worker that performed the flow's final state transition (see likely culprit worker below)".to_string()
+                        }
                         (false, false, false) => {
-                            "worker still pinging with healthy memory — likely deadlocked or blocking on the state transition".to_string()
+                            "worker still pinging with healthy memory — most likely a different worker performed and dropped the final transition (see hint); less likely: this worker deadlocked or is blocking on the state transition".to_string()
                         }
                     };
                     s.push_str(&format!("\nWorker last ping: {wp} ({age}s ago) — {status}"));
@@ -5051,20 +5152,88 @@ async fn handle_zombie_flows(db: &DB) -> error::Result<()> {
                     .to_string()
             };
 
-            let hint: String = match (worker_ping_stale, oom_moderate) {
-                (Some(_), true) => format!(
-                    "\nThis is almost certainly an OOM-kill: container memory at the worker's last ping was at {mem_pct_str}. Raise the worker memory limit (e.g. k8s `resources.limits.memory`) or reduce per-flow memory usage. Confirm via pod restart count (`kubectl describe pod` / `kube_pod_container_status_last_terminated_reason`)."
-                ),
-                (Some(true), false) => {
-                    "\nWorker stopped pinging and its last memory snapshot did not look high — in practice the overwhelmingly common cause here is still OOM-kill (memory may have spiked between the last ping and the kill, or never been reported). First check pod restart count (`kubectl describe pod` / `kube_pod_container_status_last_terminated_reason`). Less likely: host failure, network partition, or a panic — check worker logs / k8s events around the last ping time.".to_string()
-                }
-                (Some(false), false) => {
-                    "\nWorker is still pinging and memory looked healthy at its last ping — most likely a deadlock or blocking call during the state transition. Capture a stack trace (e.g. via SIGQUIT) from the worker process. As a sanity check, also verify pod restart count in case a replacement worker process in the same pod has silently taken over.".to_string()
-                }
-                (None, _) => String::new(),
+            let culprit_info = if let Some(c) = culprit.as_ref() {
+                let age = (now - c.ping_at).num_seconds();
+                let rel = match c.ping_delta_secs {
+                    Some(d) if d >= 0.0 => format!("{d:.0}s after"),
+                    Some(d) => format!("{:.0}s before", -d),
+                    None => "around".to_string(),
+                };
+                let loc =
+                    if c.worker_instance.is_some() && c.worker_instance == flow.worker_instance {
+                        format!(
+                            "same pod/instance '{}'",
+                            c.worker_instance.as_deref().unwrap()
+                        )
+                    } else if let Some(g) = c.worker_group.as_deref() {
+                        format!("worker group '{g}'")
+                    } else if let Some(inst) = c.worker_instance.as_deref() {
+                        format!("instance '{inst}'")
+                    } else {
+                        "same pod/group".to_string()
+                    };
+                let mem = match culprit_pct_str.as_deref() {
+                    Some(p) => format!("was at {p}"),
+                    None => "did not report memory".to_string(),
+                };
+                let mem_detail = match (c.memory_usage, c.wm_memory_usage, c.memory_total) {
+                    (host, wm, Some(total)) => {
+                        let used = host.max(wm);
+                        match used {
+                            Some(u) => format!(
+                                " (memory at last ping: {} of {})",
+                                fmt_mb(u),
+                                fmt_mb(total)
+                            ),
+                            None => format!(" (total available: {})", fmt_mb(total)),
+                        }
+                    }
+                    _ => String::new(),
+                };
+                let q_name = flow.worker.as_deref().unwrap_or("the recorded worker");
+                format!(
+                    "\nLikely culprit worker (on {loc}): {} — last pinged {} ({age}s ago, {rel} this flow's last ping) and then stopped pinging; it {mem} at that last ping{mem_detail}. This flow's dropped state transition was most likely performed by this worker and lost to its death (most likely OOM-kill), not a deadlock on {q_name}.",
+                    c.worker, c.ping_at,
+                )
+            } else {
+                String::new()
             };
 
-            let service_logs_info = match (flow.worker_instance.as_deref(), flow.worker_last_ping) {
+            let hint: String = if let Some(c) = culprit.as_ref() {
+                let q_name = flow.worker.as_deref().unwrap_or("the recorded worker");
+                match culprit_pct {
+                    Some(p) if p >= 0.60 => format!(
+                        "\nThis is almost certainly an OOM-kill on a *different* worker: {} (on the same pod/worker group) was at {} at its last ping right around this flow's transition, then stopped pinging. The flow's recorded worker ({q_name}) looks healthy because it is not the worker that performed the dropped transition. Raise the worker memory limit (e.g. k8s `resources.limits.memory`) or reduce per-flow memory usage. Confirm via that pod's restart count (`kubectl describe pod` / `kube_pod_container_status_last_terminated_reason`).",
+                        c.worker,
+                        culprit_pct_str.as_deref().unwrap_or("a high fraction of its limit"),
+                    ),
+                    _ => format!(
+                        "\nMost likely an OOM-kill on a *different* worker: {} (on the same pod/worker group) stopped pinging right around this flow's transition ({last_ping:?}); its memory may have spiked after its last ping or not been reported. The flow's recorded worker ({q_name}) looks healthy because it did not perform the dropped transition. First check that pod's restart count (`kubectl describe pod` / `kube_pod_container_status_last_terminated_reason`). Only if that worker was not OOM-killed, consider a deadlock on {q_name} and capture a stack trace (e.g. via SIGQUIT).",
+                        c.worker,
+                    ),
+                }
+            } else {
+                match (worker_ping_stale, oom_moderate) {
+                    (Some(_), true) => format!(
+                        "\nThis is almost certainly an OOM-kill: container memory at the worker's last ping was at {mem_pct_str}. Raise the worker memory limit (e.g. k8s `resources.limits.memory`) or reduce per-flow memory usage. Confirm via pod restart count (`kubectl describe pod` / `kube_pod_container_status_last_terminated_reason`)."
+                    ),
+                    (Some(true), false) => {
+                        "\nWorker stopped pinging and its last memory snapshot did not look high — in practice the overwhelmingly common cause here is still OOM-kill (memory may have spiked between the last ping and the kill, or never been reported). First check pod restart count (`kubectl describe pod` / `kube_pod_container_status_last_terminated_reason`). Less likely: host failure, network partition, or a panic — check worker logs / k8s events around the last ping time.".to_string()
+                    }
+                    (Some(false), false) => {
+                        format!("\nThe flow's recorded worker is still pinging with healthy memory, but that worker is often NOT the one that performed the final state transition (in nested/subflow/forloop cases the last iteration runs on another worker). First check whether a different worker on the same pod / worker group was OOM-killed around {last_ping:?} (`kubectl describe pod` / `kube_pod_container_status_last_terminated_reason`, and that pod's worker memory metrics). Only if no such worker died, treat this as a deadlock or blocking call on the recorded worker during the state transition and capture a stack trace (e.g. via SIGQUIT).")
+                    }
+                    (None, _) => String::new(),
+                }
+            };
+
+            // Pull logs for the worker (and around the time) we actually blame: the
+            // culprit's instance/last-ping when one was found, else q.worker's.
+            let (log_instance, log_ping) = match culprit.as_ref() {
+                Some(c) => (c.worker_instance.as_deref(), Some(c.ping_at)),
+                None => (flow.worker_instance.as_deref(), flow.worker_last_ping),
+            };
+            let service_logs_info = match (log_instance, log_ping) {
                 (Some(host), Some(wlp)) => {
                     let after = (wlp - chrono::Duration::seconds(90))
                         .to_rfc3339_opts(chrono::SecondsFormat::Millis, true);
@@ -5118,7 +5287,7 @@ async fn handle_zombie_flows(db: &DB) -> error::Result<()> {
             };
 
             let reason = format!(
-                "{} was hanging in between 2 steps. Last ping: {last_ping:?} (now: {now}){worker_info}{hint}{service_logs_info}",
+                "{} was hanging in between 2 steps. Last ping: {last_ping:?} (now: {now}){worker_info}{culprit_info}{hint}{service_logs_info}",
                 if flow.is_flow_step.unwrap_or(false) && flow.parent_job.is_some() {
                     format!("Flow was cancelled because subflow {id} ({base_url}/run/{id}?workspace={workspace_id})")
                 } else {
@@ -5788,3 +5957,39 @@ mod strike_unarmed_tests {
         assert_eq!(strike_unarmed(&mut seen, set(&["b"])), vec![key("b")]);
     }
 }
+
+#[cfg(test)]
+mod zombie_worker_memory_pct_tests {
+    use super::zombie_worker_memory_pct;
+
+    #[test]
+    fn takes_the_larger_of_the_two_readings() {
+        // Both present: the larger (higher-signal) reading wins, not either
+        // one unconditionally — a "simplify to `usage.or(wm_usage)`" refactor
+        // would silently under-report and miss OOMs.
+        let p = zombie_worker_memory_pct(Some(600), Some(900), Some(1000)).unwrap();
+        assert!((p - 0.9).abs() < f64::EPSILON);
+    }
+
+    #[test]
+    fn falls_back_to_whichever_reading_is_present() {
+        assert_eq!(
+            zombie_worker_memory_pct(Some(700), None, Some(1000)),
+            Some(0.7)
+        );
+        assert_eq!(
+            zombie_worker_memory_pct(None, Some(800), Some(1000)),
+            Some(0.8)
+        );
+    }
+
+    #[test]
+    fn none_when_no_usage_or_no_valid_total() {
+        assert_eq!(zombie_worker_memory_pct(None, None, Some(1000)), None);
+        assert_eq!(zombie_worker_memory_pct(Some(500), Some(500), None), None);
+        assert_eq!(
+            zombie_worker_memory_pct(Some(500), Some(500), Some(0)),
+            None
+        );
+    }
+}

From 30eedf9ee1754cb2bbf46e82d2b3eac766bd3e6d Mon Sep 17 00:00:00 2001
From: Tristan TR <69242752+tristantr@users.noreply.github.com>
Date: Thu, 23 Jul 2026 13:47:28 +0200
Subject: [PATCH 138/171] feat: Add section to deploy projects to hub (#9332)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* feat: add Deploy to Hub workspace settings tab

* Init record logic

* Fix wordings

* Add publish-app drawer with per-app rate limit mock

- Publish drawer on raw_apps/apps exposes public URL, copy-iframe, unpublish
- Inline per-app rate limit config (req/min, burst, per-IP toggle)
- Rename workspace settings "Default app" tab header to "Apps" to cover both default app and public rate limiting

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* Simplify publish drawer to show workspace-wide rate limit only

Drop per-app rate limit fields (req/min, burst, per-IP) — none of these
are supported by the backend. The drawer now shows the existing
workspace-level rate limit read-only with a link to edit it in
Workspace settings → Apps.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* Rename publish-app drawer wording to 'Share as iframe'

'Publish publicly' was ambiguous (publish to Hub vs make public URL).
Use 'Share as iframe' for the button and drawer title, and 'Generate
iframe' for the confirm action. Intro text now explicitly mentions
iframe embedding use cases (Hub, docs page, own site).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* Wire DeployToHub to real workspace data

- Fetch apps, raw_apps, flows, scripts, resources via their services
- Fetch workspace rate limit via WorkspaceService.getSettings
- Share-as-iframe flips app policy.execution_mode to 'anonymous' via
  AppService.updateApp and resolves the real public URL via
  getPublicSecretOfApp + computeSecretUrl
- Detect already-public apps from listApps execution_mode field
- Filter out app_theme resources (noise, present in every workspace)
- Hub bundle/version push and recording remain mocked (no backend yet)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* Wire recordings to real jobs with run-preview UX

- Recording flow now fetches the real schema, runs the job, and polls
  getCompletedJobResultMaybe to surface success/failure before saving.
- Drawer shows a sticky status box (loader / success / failure) with a
  result preview, a job link, and an in-context Save CTA.
- Only successful runs can be saved as a recording. Failures show the
  error and offer re-run.
- Filter cache/state/app_theme internal resource types (mirrors
  workspaces_export.rs filter).
- Added "What is a recording?" explainer banner above the items list.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* Add draft/review state machine and submission gating

- Phases: predeploy → draft → under_review → live, with workflow
  step indicator and contextual footer actions per phase
- Bundle drawer collects name + readme before pushing the draft
- draftItems snapshot frozen at deploy time; workspaceItems keep
  refreshing without affecting the draft
- Folder MultiSelect lets users scope the bundle to one or more
  folders; empty = whole workspace
- Submit-for-review disabled until every script and flow in the
  draft has a recording (progress bar + counter)
- Recordings now run the real job and poll for success/failure;
  only successful runs can be saved
- under_review phase locks editing, sharing, and recording
- Dark mode variants on every coloured banner
- Steps card shows the full 3-step process always, highlighting the
  current step

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* Make recordings optional, encourage them for discoverability

- Submit for review no longer gated on full recordings
- Footer hint now frames recordings as boosting approval speed and
  public Hub featuring, not as a hard requirement
- Progress card label switched from 'Recordings needed' to
  'Recordings recommended'
- Items without a recording display a yellow 'No recording' badge in
  every phase so the gap stays visible after submission

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* Allow per-item selection inside the bundle scope

- Items in predeploy now have checkboxes (all selected by default)
- Select all / Deselect all act on the current folder filter
- manualDeselected resets when the folder filter changes
- Bundle button uses the selected count, disabled when zero
- Draft snapshot keeps only the selected items
- Checkboxes hidden in draft / under_review / live phases

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* Add diff button once approved by admins

* Small fix

* Nits

* fix(deploy-to-hub): paginate workspace list and cancel stale record polls

- loadWorkspace fetches all pages instead of capping at 100 items per kind
- pollJobUntilComplete now bails when recordRunSeq advances (new record
  target, re-run, or drawer close), preventing late completion of a
  previous run from overwriting current state

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* perf(deploy-to-hub): parallelize public-app URL resolution

resolvePublicUrl now runs once per anonymous app via Promise.all instead
of serially inside the items loop, removing N round-trips from initial
tab load.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(indexer): tell admins when ingress routes search to wrong pod (#9274)

* [ee] fix(indexer): tell admins when ingress routes search to wrong pod

When the IndexReader is absent on the pod handling a search request but
another pod is actively holding the indexer lock, the EE handler now
returns a tailored error pointing at the ingress/load-balancer
configuration instead of the generic "indexer not running" message.

The indexer status endpoint reads the DB lock so it reports "running"
from any pod, but search endpoints need the in-memory IndexReader that
only exists on the lock holder. In multi-replica deployments this looks
like the indexer is healthy but every search 404s.

Companion: windmill-labs/windmill-ee-private#TBD

Fixes WIN-1968.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore: update ee-repo-ref to eb18d7b4c0e37fea3f6e1e2cc44e0fddd74ff817

This commit updates the EE repository reference after PR #586 was merged in windmill-ee-private.

Previous ee-repo-ref: 7dd43d1850813071cc18ba49ba090583e7321f4b

New ee-repo-ref: eb18d7b4c0e37fea3f6e1e2cc44e0fddd74ff817

Automated by sync-ee-ref workflow.

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>

* feat(cli): add `wmill init prompts` and custom override slot (#9266)

* feat(cli): add `wmill init prompts` and custom override slot

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor(cli): replace init prompts with refresh prompts + AGENTS.md/AGENTS.cli.md split

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(cli): dedupe claude skills via @-includes and add prompts freshness check

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor(cli): drop migration-choice flags from `refresh prompts`

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* docs(cli): add 'Running and previewing local changes' section to AGENTS.cli.md

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(cli): write full skill content to .claude/, drop @-include wrapper

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(cli): reconcile CLAUDE.md the same way as AGENTS.md

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(cli): address PR review nits — argv parsing, lazy import, comment detection, error propagation

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat: add yolo mode for ai chat tools (#9258)

* feat: add yolo mode for ai chat tools

* nit

* fix: align chat footer controls

* feat: add ai chat autonomy modes

* feat: add autonomy mode dropdown

* fix: highlight yolo autonomy icon

* fix: auto accept flow edits

* fix: hide unsupported autonomy modes

* fix: handle auto-accept flow editor races

* fix(debugger): add non-root user support to Dockerfile (#9277)

Mirrors the main Windmill Dockerfile pattern: creates a windmill user
(UID/GID 1000) and makes cache/work directories world-writable so the
image runs cleanly under Kubernetes securityContext.runAsNonRoot or
runAsUser: 1000 without permission errors on Bun, pip, or windmill
cache writes.

Fixes WIN-1969

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(ai): enforce RLS and scope check on user-supplied X-Resource-Path (#9276)

* fix(ai): enforce RLS and scope check on user-supplied X-Resource-Path

The AI proxy handler accepts an X-Resource-Path header to override the
configured workspace AI provider. When supplied, the handler loaded the
resource value from the resource table using the root DB pool with no
resources:read scope check, so any authenticated workspace user could
point X-Resource-Path at a restricted AI resource (e.g. one in a folder
they cannot read) and the proxy would use that resource's provider
credentials for the outbound AI request.

For user-supplied resource paths, now require resources:read:{path}
scope and fetch the resource through user_db.begin(&authed) so RLS
enforces the same folder/group boundary as the resource API. The RLS-
scoped $var: resolution stays in place as defense in depth. The
admin-configured workspace/instance ai_config path is unchanged.

Fixes WIN-1971

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* test(ai): regression test for X-Resource-Path RLS enforcement

Cover all four cases:
- non-admin pointing X-Resource-Path at a restricted resource is rejected
- non-admin pointing it at a resource they own still works
- admin can point it at any resource
- workspace-configured proxy flow (no X-Resource-Path) is unchanged

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat: add userdraft listing primitives (#9268)

* feat: add userdraft listing primitives

* fix: cancel stale userdraft discard writes

* docs: remove global ai userdraft plan

* feat(nsjail): optional disk-backed /tmp via instance setting (#9272)

* feat(nsjail): optional disk-backed /tmp via instance setting

* test(nsjail): unit-test tmp mount resolver and narrow visibility

* refactor(nsjail): switch tmp backing to select + conditional UI

* ui(nsjail): make tmpfs the visible default in /tmp backing select

* fix(nsjail): refuse preexisting jail_tmp to block symlink escape

* fix(nsjail): allow jail_tmp reuse on sequential nsjail calls

Codex flagged that python/ruby/rust executors invoke nsjail twice per
job_dir (install then run). The previous resolver treated any preexisting
jail_tmp as hostile and silently fell back to tmpfs on the second call,
so disk-backed mode never reached the main script run for those langs.

Use symlink_metadata().is_dir() to distinguish a real directory left by
an earlier call in the same job_dir (safe to reuse) from a symlink or
other entity (still refused, as the codebase-tar escape requires).

Also loosen the frontend visibility predicate: only hide nsjail settings
when job_isolation is explicitly 'none' or 'unshare', so deployments
that enable nsjail via DISABLE_NSJAIL=false with no DB setting can
still see the controls.

* chore(main): release 1.706.0 (#9270)

* chore(main): release 1.706.0

* Apply automatic changes

---------

Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>

* fix(nsjail): gate unix-symlink test behind cfg(unix) for Windows build (#9280)

The disk_backed_refuses_preexisting_symlink_at_jail_tmp test calls
std::os::unix::fs::symlink directly, which doesn't exist on Windows
targets. Without a cfg gate, `cargo check --tests` fails on Windows
with E0433. Other symlink call sites in this crate (php_executor,
bun_executor, rust_executor, etc.) already follow this pattern.

Fixes WIN-1972

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* Reduce slim image vulnerability surface (#9279)

* Reduce slim image vulnerability surface

* chore(docker): drop apt-get upgrade -y from slim images

apt-get upgrade hurts build reproducibility (same Dockerfile + same
commit at different times produces divergent images) and trips hadolint
DL3005. The freshness it buys is dominated by simply rebuilding against
the periodically-refreshed debian:bookworm-slim base image.

The --no-install-recommends and apt-list cleanup wins are kept.

---------

Co-authored-by: Ruben Fiszel <ruben@windmill.dev>

* fix(git-sync): bump to hub/28234 with stateless gpg.program wrapper (WIN-1974) (#9282)

* fix(git-sync): revert LATEST_GIT_SYNC_SCRIPT_PATH to hub/28230 to restore GPG-signed deploys (WIN-1974)

hub/28231 (PR #9230) is the "thin" script that hands the actual `git commit`
to the CLI's hidden `sync git-deploy`. The hub script still does the GPG
setup (import key into a fresh GNUPGHOME, dummy `gpg -bsau` to warm the
agent passphrase cache, then `git config user.signingkey` + `commit.gpgsign`
locally), but the commit no longer runs in the same `git_push` flow — it
runs minutes later inside the CLI after workspace API resolution, zip pull,
file extraction, and lockfile autofill. By the time the spawned `git commit`
asks gpg-agent for the cached passphrase, the cache state is no longer
reliable (or the spawned `gpg` ends up talking to a fresh agent), so signing
fails non-interactively with `gpg failed to sign the data`.

hub/28230 is hub/28217's in-script logic rebuilt with windmill-cli@1.703.3:
the GPG setup and the in-script `sh_run("git commit ...")` happen back-to-back
in `git_push`, so the cache is always fresh. It preserves wm_deploy / fork
branch behavior, the EE deployment-callback `main()` signature is unchanged,
and the only min-version check in EE (`is_script_meets_min_version(28103)`)
is comfortably below 28230 — so this revert is safe.

Forward fix (separate PR): publish a new thin script that, alongside the
existing GPG setup, writes a `gpg.program` wrapper using `--pinentry-mode
loopback --passphrase-file` so signing is independent of the agent's cache
state. Re-bump past 28231 then.

Fixes WIN-1974

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(git-sync): check in source-of-truth for the next hub script (gpg.program wrapper)

This is the script that will be published to hub.windmill.dev once verified
on a customer GPG-signed deploy. It replaces hub/28231's agent-cache
pre-warm (`gpg -bsau` with --passphrase) with a stateless gpg.program
wrapper + chmod-600 passphrase file. Every git-invoked gpg call goes
through the wrapper, which always uses --pinentry-mode loopback (and
--passphrase-file when a passphrase exists). Signing no longer depends on
gpg-agent having a cached passphrase by the time the CLI's `git commit`
runs — which closes WIN-1974.

Not wired in yet: LATEST_GIT_SYNC_SCRIPT_PATH stays on hub/28230 until this
script is uploaded and the new hub id is known. This file is checked in so
the diff is reviewable, future bumps have a source of truth, and a CLI
regression test can `cat` it for fixture parity.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(frontend): skip format/pattern validation for $var/$res/$jsonvar references in ArgInput

A resource field with a `pattern` constraint (e.g. the gpg_key.private_key
field, whose pattern enforces a `-----BEGIN PGP PRIVATE KEY BLOCK-----`
prefix) rejects values like `$var:u/me/gpg-private-key` with an "invalid
format" error in the resource editor — even though `$var:`/`$res:`/`$jsonvar:`
are placeholders the backend resolves at runtime, not the actual string
that needs to match the regex.

Bail out of all format/pattern checks (email, ipv4, ipv6, uuid, custom
pattern) when the value is one of these references. Required/numeric
bounds/array checks still apply since they're shape-level, not regex.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(git-sync): bump LATEST_GIT_SYNC_SCRIPT_PATH to hub/28234 (gpg.program-wrapper fix)

hub/28234 is the forward fix for WIN-1974: replaces hub/28231's agent-cache
pre-warm (which became stale by the time the CLI's `git commit` ran) with
a stateless `gpg.program` wrapper that uses `--pinentry-mode loopback`
(and `--passphrase-file` when a passphrase exists) on every gpg invocation.
Bundled CLI is windmill-cli@1.705.0.

Verified via reproducer at /tmp/git-sync-diff/test-gpg-fix.sh: deliberately
killing gpg-agent between GPG setup and `git commit` reproduces the
customer's `gpg failed to sign the data` error verbatim under the old
flow, and the wrapper signs through it. Holds for passphrase-protected
keys, split-subkey [C]+[S] layouts, and unprotected keys.

Drops the local source-of-truth copy (`hub-scripts/`) — hub is canonical
now that 28234 is published.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(git-sync): drop verbose comment above LATEST_GIT_SYNC_SCRIPT_PATH

The git history (this PR) carries the why; the constant name + value carry
the what.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor(cli): wmill sync git-deploy stops committing; caller owns commit+push (#9284)

Single contract for the deployment-callback path: the CLI does branch
checkout + pull, the caller (hub script in production, test in test)
does git add + commit + push. This restores the WIN-1974 invariant —
GPG setup and `git commit` run back-to-back in the same process, so
the agent's pre-warmed passphrase cache is still warm at sign time —
without needing a `--skip-commit` flag for the hub case and a default
"also-commit" for everything else. Same behavior in every call site.

Changes:
  - sync.ts: drop the gitSyncDeployPush call from pull()'s deploy path
    (both the onlyCreateBranch fast-return and the post-pull commit).
    `gitSyncDeployPush` stays exported for any caller that wants the
    same commit/push semantics — just not invoked by the CLI subcommand.
  - gitsync_promotion.test.ts: e2e test now does its own git add +
    commit + push after `wmill sync git-deploy`, mirroring what the
    hub script does in production. Same regression coverage
    (wm_deploy branch created in Case A, main untouched; main updated
    in Case B, no new wm_deploy).

CLI typecheck unchanged (two pre-existing TarAsZip errors at lines
2578/3307, present before this PR). All 743 unit tests still pass.

The accompanying hub script (option-C — CLI for branch+pull, script
for commit+push) lives at /tmp/git-sync-diff/sync-script-to-git-repo-windmill.option-C.ts.
Once published, a follow-up bumps LATEST_GIT_SYNC_SCRIPT_PATH to its id.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* bump git sync to 28236

* fix: fork compare visibility for non-admins and stale-token superadmins (#9283)

* fix: use fork-scoped authed for fork visibility in compare_workspaces

* test: add EE end-to-end repro for fork rename visibility

* chore: restore concurrency_locks sqlx cache lost in cleanup

* test: add regression for stale-superadmin-token fork visibility bug

* chore: update sqlx cache for new test queries

* chore(main): release 1.706.1 (#9281)

* chore(main): release 1.706.1

* Apply automatic changes

---------

Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>

* feat: add wmill job rerun subcommand (#9275)

* feat: add wmill job rerun subcommand

* feat: add wmill job restart subcommand for flow restart-at-step

* chore(system_prompts): point plugin skills sync at plugins/windmill/ (#9287)

* chore(system_prompts): point plugin skills sync at plugins/windmill/

The plugin checkout's plugin folder is being renamed from
`plugins/windmill-code-plugin/` to `plugins/windmill/` to shorten the
slash-command namespace and align with the matching Cursor plugin
layout.

Paired with windmill-labs/windmill-claude-plugin#8. That PR must merge
first so the next sync run finds the new folder.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* docs(system_prompts): update plugin-dir example to plugins/windmill

Co-authored-by: centdix <centdix@users.noreply.github.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: centdix <centdix@users.noreply.github.com>

* fix(cli): wmill sync pull updates wmill-lock.yaml for raw apps (#9289)

* fix: flow recording teardown crash + rename package to @windmill-labs/components (#9288)

* fix: guard against null recording during FlowRecordingReplay teardown

Navigating away from a flow recording inside a workspace file-tree view
threw `TypeError: Cannot read properties of null (reading 'flow')` from
FlowGraphViewer once during the teardown tick.

Svelte 5 compiles child component props as live getters that close over
`$$props.recording.flow`. When `recording` flips to null on the parent's
navigation, an outer `{#if !recording?.flow}` doesn't stop those getters
from firing one more time as derived effects re-evaluate before the
unmount lands — so the getter dereferences null and throws.

Fix at the two layers where the deref actually happens:

- FlowRecordingReplay: use `recording?.flow` at the binding sites
  (FlowViewer + graph-snippet FlowGraphViewer) so the compiler emits an
  optional-chained getter, and guard the snippet branch with
  `{:else if recording?.flow}` so it doesn't mount when there's nothing
  to show.
- FlowGraphViewer: finish the optional chaining the rest of the file
  already used everywhere else (`flow?.value?.skip_expr`,
  `flow?.value?.cache_ttl`, `flow?.schema`). When the upstream
  binding returns undefined during teardown, the graph degrades to an
  empty frame instead of crashing.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore: rename package to @windmill-labs/components

- frontend/package.json: rename `windmill-components` → `@windmill-labs/components`
- frontend/publish.sh: drop the in-place sed rename dance; the checked-in name now matches what's published, so `npm run package && npm publish` is enough
- frontend/package-lock.json, system_prompts/auto-generated/prompts.d.ts: regenerated by `npm run package` under the new name

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(flows): restore Variables and Resources in flow editor prop picker (#9290)

The design system overhaul in 888837431c accidentally dropped the
fallback condition that displayed the Variables and Resources sections
in the prop picker by default. After that commit, these sections only
appeared when the user typed `variable.` or `resource.` in their
expression, which meant they effectively disappeared from the flow
editor's prop picker for most users.

Restore the previous behavior by showing the sections when no input
match is active (the equivalent of the old `!filterActive` clause).

Fixes WIN-1976

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(auth): tighten token-owner fallback for unscoped tokens (WIN-1978) (#9293)

* fix(auth): reject unscoped tokens with cross-workspace forged owners (WIN-1978)

An unscoped token (workspace_id IS NULL) whose `owner` field references a
user, group, or unprefixed value that is not present in the target
workspace must not authenticate. The previous fallback in the
`u/<username>` branch granted `(is_admin=false, is_operator=true)` when
no `usr` row matched in the target workspace, letting a token holder
who could mutate the `token` table cross workspace boundaries with
operator privileges.

The `g/<groupname>` branch likewise silently accepted any group name as a
"group user", and the no-prefix branch granted operator state from
arbitrary owner strings. Both are now rejected unless the owner matches
a real user/group membership in the target workspace.

Adds an integration regression covering all three forged-owner shapes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore: drop integration regression for auth fallback

The test added in the previous commit relies on a sqlx::query! that
requires offline-cache regeneration; removing per code-review preference
to keep this PR scoped to the auth-layer fix.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(ResourceEditor): don't reset state when `selected` reverts to undefined (#9295)

The bootstrap effect tracked `selected` via its early-return check, so any
time `selected` flipped back to `undefined` it would re-run and reinitialize
`states[effectiveWorkspace]` to empty — wiping user input. This happens in
the React SDK consumer: reactify re-syncs all Svelte props on every React
render, and since `selected` isn't passed through, `$props()` reverts it.

Move the `selected !== undefined` check inside the existing `untrack` so
the effect only tracks `effectiveWorkspace`. Bootstrap still runs once on
mount; subsequent `selected` flips no longer retrigger it.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(secret-backend): pass DB to Vault migrations + show failure details (#9292)

* [ee] fix(secret-backend): pass DB to Vault migrations + surface failure details

Companion to windmill-ee-private fix for WIN-1977. The HashiCorp Vault
migration always failed under JWT/OIDC auth because the migration
constructed VaultBackend without a DB, so every secret hit "Database
connection required for JWT authentication". Creating new secrets worked
because the runtime path passes the DB.

Frontend: when failed_count > 0, the toast and console now show the
per-secret failures (path + error, capped at 5 with "...and N more")
instead of just aggregate counts.

Fixes WIN-1977

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore: update ee-repo-ref to 14315067c083d3361512de621b12e41dbe3b017d

This commit updates the EE repository reference after PR #587 was merged in windmill-ee-private.

Previous ee-repo-ref: 390ed6c851b1915f0b492897c663f8058477680f

New ee-repo-ref: 14315067c083d3361512de621b12e41dbe3b017d

Automated by sync-ee-ref workflow.

* fix(secret-backend): escape failure fields and use <br> in migration toast

Address CI review on PR #9292:

- P1 (cubic/codex): backend-supplied workspace_id/path/error are now
  HTML-escaped before being interpolated into the migration toast,
  which renders through {@html processMessage(...)} in Toast.svelte.
  This prevents stored XSS via secret paths or backend errors that
  contain markup. '/' is intentionally left intact so the toast's
  path-highlight regex still tags workspace paths.
- P2 (pi): swap '\n' for '<br>' so multi-line failure lists actually
  break in the toast instead of collapsing to a single run-on line.
- Extend the same per-secret failure surfacing (toast + console.error)
  to the Azure Key Vault and AWS Secrets Manager migration handlers
  via a shared reportMigrationFailures() helper so all six migration
  paths report identically.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>

* nit react-sdk resource editor

* sdk_resource

* make `selected` resilient + snapshot args for React (#9298)

* fix(ResourceEditor): make `selected` resilient + snapshot args for React

Two issues surfaced via the React SDK (reactify wrapper re-spreads Svelte
props on every host re-render):

1. The bindable `selected` prop transiently resets to undefined on each
   re-spread, flipping `current` through undefined and unmounting the
   form (input loses focus on every keystroke). Rename the prop to
   `selectedProp` and derive `selected = selectedProp ?? effectiveWorkspace`
   so the fallback insulates the component without effects.

2. The onChange dispatch passed `current.args` (a `$state` proxy) directly,
   so React consumers diffing by reference or JSON.stringify saw the same
   value forever, and the effect only tracked the args reference (not
   nested mutations). Wrap with `$state.snapshot` to deep-track and emit
   a plain object.

The bootstrap effect is also restructured: it no longer writes `selected`
(the derived handles defaulting) and now guards on `selected in initialStates`
so workspace flips remain idempotent.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(ResourceEditor): declare effectiveWorkspace before use in selected

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* remove unused workflow

* feat(typescript-client): add deleteS3File + optional workspace arg on S3 helpers (#9300)

* feat(typescript-client): add deleteS3File + optional workspace arg on S3 helpers

Customer-requested ergonomics for the TypeScript SDK:

- New `deleteS3File(s3object, workspace?)` wrapper around the existing
  `HelpersService.deleteS3File` (backend endpoint is already there). Saves
  callers from having to either hand-roll `denoS3LightClientSettings()` +
  AWS SDK calls, or wire up `HelpersService` directly.
- `denoS3LightClientSettings`, `loadS3File`, `loadS3FileStream`, `writeS3File`,
  and the new `deleteS3File` all gain an optional trailing `workspace?: string`
  parameter that falls back to the `WM_WORKSPACE` env var via `getWorkspace()`.
  Mirrors the calling convention customers already expect from helpers like
  `getVariable` / `runScript`.

`build.sh` and `build.jsr.sh` are updated to export `deleteS3File` from both
the NPM and JSR entry points.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore: regenerate system_prompts auto-generated for new S3 helpers

`python system_prompts/generate.py` after adding deleteS3File and the
optional workspace param to the existing S3 helpers, so the agent-facing
docs (CLI skills, TS SDK prompt, script skills) reflect the new signatures.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(github-app): hide cloud-only UI on self-managed + admin assignment UI (#9299)

* feat(github-app): hide cloud-only UI on self-managed + admin assignment UI

Two related UX fixes for the GitHub App self-managed (GHES) integration:

1. On self-managed instances, the per-installation Export button and the
   "Import installation from other instance" section in the workspace UI both
   hide. Both round-trip a JWT carrying only {installation_id, account_id} with
   no github_base_url, so they would produce broken cloud-style installs on a
   self-managed instance. The previous Export attempt also failed with
   "No JWT token received from server" because self-managed installs store an
   empty JWT by design.

2. New "Workspace assignments" panel in instance settings (GhesAppSettings.svelte)
   that auto-discovers installations of the configured GHES App and lets the
   super-admin assign them to specific workspaces. Workspace users without
   GitHub permissions no longer need to install the App themselves — the admin
   provisions the link from instance settings. Admin-provisioned installs show a
   "Provisioned by admin" badge in the workspace UI and can only be removed by
   the super-admin from instance settings.

Backend support is in the EE companion PR
windmill-labs/windmill-ee-private#588.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore: update ee-repo-ref to da5189cf69a453de3855057f41be0d84e5910707

This commit updates the EE repository reference after PR #588 was merged in windmill-ee-private.

Previous ee-repo-ref: d959b83ce413ad531e9cc28e0f8199cdecb73a31

New ee-repo-ref: da5189cf69a453de3855057f41be0d84e5910707

Automated by sync-ee-ref workflow.

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>

* chore(main): release 1.707.0 (#9285)

* chore(main): release 1.707.0

* Apply automatic changes

---------

Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>

* feat(queue): per-workspace fairness cap on the shared cloud worker pool (#9303)

* feat(queue): cloud-only per-workspace fairness cap on the shared worker pool

On `app.windmill.dev` the cluster runs a single default worker group, so a
single workspace flooding the queue can degrade quality of service for
everyone else. This adds an opt-in mechanism that caps any single workspace
at a configurable share of the shared worker pool when it has been
dominating cluster activity for more than a configurable window.

Detection signal counts both currently-running jobs and jobs completed in
the rolling window, so it catches workspaces hogging slots with long jobs
**and** workspaces spamming many tiny jobs (where no individual job's
started_at is old, but throughput share dominates).

Refresh is coordinated cluster-wide via a single UPDATE on
`background_task_state`: the `WHERE updated_at < now() - interval` predicate
combined with row-level locking means only one process per refresh cycle
actually runs the aggregation, regardless of fleet size. Every other
process gets the freshly written value in the same round trip via
`UNION ALL ... LIMIT 1`. Heavy aggregation rate stays at ~0.2-0.5 qps for
the whole cluster.

Pull queries are split: the existing query string and its bind shape stay
bit-identical to today, so the planner keeps using the same indexes when
fairness is off or no workspace is currently capped. A separate
`WORKER_PULL_QUERIES_FAIRNESS` adds `AND workspace_id <> ALL($2::text[])`
and is only materialized while the feature is enabled.

Hard-gated to `CLOUD_HOSTED=true` + BASE_URL host == app.windmill.dev at
three layers: frontend `cloudonly: true`, API setter rejection in
`set_global_setting_internal`, runtime check in `fairness_active`. Settings
are exposed under Jobs in the instance-settings UI; defaults are off so
the change is a no-op for self-hosted.

Two-pass pull guarantees no worker idling: if every queued job belongs to
a capped workspace, the second pass uses the unmodified pull queries.
Cap re-asserts on the next refresh.

Fixes WIN-1982

* fix(queue): address CI review findings on workspace fairness

Six fixes from the four-reviewer cross-check on #9303:

1. **Aggregation evaluation (Codex P1).** The previous `INSERT ... ON CONFLICT
   DO UPDATE WHERE updated_at < ...` had the heavy `v2_job_queue ∪
   v2_job_completed` aggregation inlined into `VALUES`, which Postgres
   evaluates for every contender to build the proposed row — losing the
   "one heavy aggregation per cycle cluster-wide" property the design
   advertises. Split into three small statements: (a) cheap claim with
   constant `VALUES`, (b) winner-only `UPDATE ... SET value = jsonb_build_object('overloaded', <agg>)`
   (Postgres only evaluates `SET` per row matching `WHERE`, so losers never
   compute the aggregation), (c) read for everyone. Heavy query now truly
   runs ~0.2-0.5 qps cluster-wide regardless of fleet size.

2. **Numeric setting wraparound (cubic P1).** `u64 as u32` and downstream
   `u32 as i32` could silently flip sign and feed `make_interval(secs => -N)`,
   making `now() - interval` a future timestamp and disabling the
   completed-jobs half of the activity signal. Clamp `duration_secs` to
   [1, 86400] and `min_total_jobs` to [0, u32::MAX] before storing.

3. **`/instance_config` bypass (cubic/Claude/Codex P2).** Bulk config endpoint
   sidestepped `set_global_setting_internal`'s gate; a self-hosted superadmin
   could persist `workspace_fairness_*` rows via the bulk path. Mirror the
   per-key check in `set_instance_config` upsert flow.

4. **DB error coerced to false (Claude P2).** `load_workspace_fairness_enabled`
   collapsed `Err(_)` to `false` and unconditionally swapped the atomic — a
   transient DB blip during notify-event propagation toggled the feature off
   cluster-wide (and triggered a `store_pull_query` rebuild precisely when load
   is highest). Now propagates the error so the atomic stays at its prior value.

5. **Refresh failure cooldown (Claude P2).** Storing `0` removed the rate
   limit entirely; every subsequent pull spawned a new refresh task. Leave
   `LAST_REFRESH_MICROS` at `now_us` (already written by the CAS) so the
   natural interval acts as the cooldown.

6. **Visibility + duplication (Pi P2).** Mark `make_pull_query_fairness` as
   `pub(crate)`. Move the duplicated `BASE_URL host == app.windmill.dev`
   parser into `windmill-common::worker::is_cloud_production_host` and share
   it between the API setter and the runtime path.

Verified locally:
- `POST /api/settings/global/workspace_fairness_enabled` → 400 (per-key gate)
- `PUT /api/settings/instance_config` with fairness key → 400 (bulk gate)
- `cargo check --workspace --features=private,enterprise,quickjs` — clean

Refs WIN-1982.

* fix(queue): second round of CI review nits on workspace fairness

Three issues raised by the Codex/Claude re-review of commit 0b38ff2:

1. Non-cloud deletes were rejected (Codex P2). The cloud gate ran before
   the Null / empty-string deletion branches in both `set_global_setting_internal`
   and the bulk `set_instance_config`. A self-hosted instance that inherited
   stale `workspace_fairness_*` rows from a cloned cloud DB couldn't clear
   them through the API — the rows stayed in `global_settings` and continued
   to show up in the YAML export. Now the gate only blocks upserts; Null /
   empty-string deletes pass through on any host.

2. Deleted numeric knobs kept stale runtime values (Codex P2). When a
   cloud admin cleared `workspace_fairness_max_percent`, `..._duration_secs`,
   or `..._min_total_jobs`, the notify-event fired but the numeric loaders
   ignored `Ok(None)` and left the previous in-memory value pinned until
   process restart. Loaders now distinguish three outcomes:
     - `Err(_)`: transient — leave atomic alone (preserves the
       previous-round fix).
     - `Ok(None)` / `Ok(Some(invalid))`: reset to the documented default.
     - `Ok(Some(valid))`: clamp and store.
   Defaults are extracted to `WORKSPACE_FAIRNESS_*_DEFAULT` constants kept
   in sync with the `AtomicU32::new(...)` initialisers in
   `windmill-common/src/worker.rs`.

3. `fairness_active` was `pub` with no cross-crate caller (Claude nit).
   Tightened to module-private.

Verified locally on this non-cloud instance:
  POST .../workspace_fairness_enabled  body=null  → 200 (delete passes)
  POST .../workspace_fairness_enabled  body=true  → 400 (set blocked)
  PUT .../instance_config              {}         → 200 (no-op passes)
  PUT .../instance_config  with fairness key      → 400 (bulk set blocked)

Skipped the partial index on `v2_job_queue WHERE running = true` that
Claude flagged as a residual nit — queue stays under 50k rows per the
operator's measurement, so the seq-scan cost (~10 ms × 0.5 qps =
~0.5% of a DB core) is well below the noise floor and the index isn't
worth the maintenance cost on job transitions.

Refs WIN-1982.

* chore(main): release 1.708.0 (#9304)

* chore(main): release 1.708.0

* Apply automatic changes

---------

Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>

* feat: add copy button to Path component (#9311)

* feat: plug global chat drafts into userdraft (#9291)

* refactor: move global chat drafts to userdraft

* feat: share script and flow drafts with editors

* feat: share trigger drafts with editors

* feat: share raw app drafts with editor

* feat: share resource drafts with editors

* docs: rename global chat drafts copy

* feat: add global chat draft discard tool

* fix: resolve global chat editor draft paths

* fix: remove editor draft path resolver

* feat: track live editor drafts in userdraft

* fix: snapshot live userdraft reads

* chore: checkpoint pending global draft changes

* fix: address global draft review issues

* fix: defer raw app draft persistence

* docs: remove pr investigation docs

* fix: persist live global draft writes

* refactor: move bedrock proxy handling to windmill-ai (#9309)

* refactor: move bedrock proxy handling to windmill-ai

* docs: track ai refactor follow-ups

* fix(auth): filter resource/variable listings by token scope (WIN-1981) (#9302)

A token scoped to a single resource (e.g. `resources:read:u/alice/foo`)
could call `GET /api/w/{w}/resources/list_search` and receive `path` and
`value` for unrelated resources in the workspace. Route-level scope
checks only validate `domain:action`; per-resource handlers do a
`check_scopes` against the path, but the listing endpoints did not —
leaking integration credentials, API keys, and other secrets stored as
resource values to narrowly-scoped tokens.

Add `build_scope_path_predicate` to `windmill-api-auth` (mirrors
`check_scopes` semantics but parses the token's scopes once, suitable
for filtering many rows). Apply it to `list_search_resources`,
`list_resources`, `list_names` (resources) and `list_variables`
(non-secret value leak), so a scope-restricted token only ever sees the
paths it is authorized to read. Unscoped tokens and tokens whose only
scopes are `if_jobs:filter_tags:*` are unaffected.

Includes regression tests covering: unscoped, tag-filter-only,
single-resource, wildcard, wrong-domain, and write-implies-read.

Fixes WIN-1981

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* audit-log workspace-fairness cap transitions (#9306)

* feat(queue): audit-log workspace-fairness cap transitions

When the cloud per-workspace fairness mechanism adds a workspace to the
capped set or releases one, write `workspace_fairness.capped` /
`workspace_fairness.uncapped` audit-log entries to the affected workspace.
The cluster admin can review the full timeline from the `admins` workspace
audit view with `all_workspaces=true`; per-workspace owners see their own
events in their normal audit list.

Only the per-cycle refresh winner emits entries (matching where the heavy
aggregation runs), so a fleet of N workers does not produce N duplicates
per transition. The diff is computed against the value already in
`background_task_state` rather than the winner's in-memory cache, so a
freshly-restarted process winning the claim does not spuriously emit
"newly capped" entries for workspaces that were already capped before it
started.

Audit writes are best-effort: failures are logged via tracing and do not
abort the refresh cycle.

Fixes WIN-1984

* feat(queue): scope fairness audit to admins workspace + queue-metrics pane

- Write `workspace_fairness.capped` / `workspace_fairness.uncapped` to the
  `admins` workspace (was: per-affected-workspace) with the affected
  workspace_id moved to the `resource` field. Cluster admins now get the
  full timeline in one place without `all_workspaces=true`.
- Add `GET /workers/workspace_fairness_events` returning the last 100
  events. Cloud-gated (returns `[]` on non-cloud) and devops-only.
- Add a `WorkspaceFairnessEvents` Section to the Queue Metrics drawer,
  rendered only when `isCloudHosted()` is true. Shows time / event
  badge / workspace / parameters with a refresh button.

Fixes WIN-1984

* feat(ai-chat): expand chat question answers (#9310)

* feat(ai-chat): align footer bar + DropdownV2 mode/autonomy selectors (#9308)

* feat(ai-chat): align footer bar, use DropdownV2 for mode/autonomy selectors

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(dropdown): add `selected` item prop rendering a trailing check

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* style(ai-chat): add small spacing between chat input and footer bar

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(ai-chat): always offer the 3 autonomy options in the auto-accept picker

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(ai-chat): default autonomy mode to auto-accept on

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor(ai-chat): use Button component for footer dropdown triggers

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* style(ai-chat): use a hand icon for the auto-accept-off autonomy state

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* style(ai-chat): use subtle Button variant for mode and model selectors

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* style(ai-chat): tighten spacing between input and footer bar

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(ai-chat): reword autonomy levels as ask/auto-accept/bypass permissions

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(button): add 2xs unified size with tighter padding

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(ai-chat): compact footer bar — 2xs buttons, AtSign context icon, short Yolo label, discreet model

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* style(ai-chat): widen the permission selector dropdown

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(dropdown): group shortcut + selected check to avoid ml-auto collision

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* test(ai-chat): cover getPersistedAutonomyMode default; clarify default comment

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(raw_apps): tab-based editor surface with split-with-preview (#9273)

* feat(raw_apps): custom tab system for source / runnable / preview

Replaces the fixed split-pane layout with a tab bar inside the editor
area. Each frontend file is a tab, each selected runnable is a tab,
and the Preview is pinned to the right (non-closable). Tabs are an
alternative discoverability surface to the sidebar — both stay
functional, but tabs make navigation viable on small screens with
the sidebar collapsed.

A "Split with Preview" toggle in the tab bar's trailing slot pairs
the active tab with the preview side-by-side for wide-screen
multitasking. The toggle hides when Preview is already the active
tab.

The UI Builder, runnable editor, and preview iframe all stay mounted
across tab switches (toggled via `display`) — no bundler restarts, no
preview state loss, no editor remounts.

- New common/tabs/DraggableTabs.svelte: reusable tab strip with
  drag-reorder (@windmill-labs/svelte-dnd-action), pinned-left/right
  slots excluded from the drag zone, hover-revealed X close, middle-
  click close, keyboard navigation (arrows / Enter / Backspace),
  and a `trailing` snippet for inline toolbar add-ons.
- raw_apps/RawAppEditor.svelte:
  - Tab state (`tabs`, `activeTabId`, `splitWithPreview`) lives in
    Windmill. Persisted in localStorage keyed by workspace + app path.
  - Sidebar file clicks (`handleSelectFile`) and runnable selection
    (`selectedRunnable` via `bind:`) are mirrored into tabs via an
    effect — the sidebar interaction is otherwise untouched.
  - Listener augmented: `setActiveDocument` backfills tabs for files
    VS Code opens by itself; `setFiles` / `runnables` updates drop
    stale tabs.
  - Bundler / inspector / rebuild toolbar moves into the tab bar's
    trailing slot — always visible regardless of active tab.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(raw_apps): modern tab styling + resizable split-with-preview

Two polish passes on the new tab system:

DraggableTabs styling:
- Remove the bottom border on the tab strip + the accent-coloured
  border-b-2 on the active tab. The active tab now shares the
  surface background with the content area below it, so the
  boundary visually "disappears" — modern IDE-style tabs.
- Inactive tabs sit on the darker surface-secondary tab strip and
  get a subtle right separator so they don't blur into each other.

Split-with-Preview is now a real resizable Splitpanes:
- The content area is rendered as a Splitpanes (always), with the
  source/runnable slot on the left and the preview iframe on the
  right. The user can drag the divider to adjust the ratio when
  the "Split with Preview" toggle is on.
- Iframes never remount across single↔split toggles — pane sizes
  are driven reactively from (activeTabKind, splitWithPreview),
  not by adding/removing the Splitpanes itself.
- The user's preferred split ratio is remembered while they're
  dragging and reapplied next time split is enabled.
- The inner splitter is CSS-hidden in single mode so the toggle
  button stays the single canonical way to flip layouts.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor(raw_apps): split mode moves preview tab into the right pane

Cleaner mental model for split-with-preview. Instead of "split the
active tab + always keep the Preview tab around", the Split toggle
now physically moves the Preview tab out of the bar and into a
permanent right pane. When the user toggles split off, the Preview
tab reappears in the bar like any other tab.

- New `displayedTabs` derived: filters out the Preview tab when
  splitWithPreview is on, so the user sees only file/runnable tabs
  in the bar and a dedicated preview pane on the right.
- `toggleSplit` redirects the active tab to the most recent
  file/runnable when the user toggles split on with Preview active,
  so they don't end up staring at an empty left pane.
- Split toggle is now always visible — the user can flip both ways.
  The button label flips between "Pin preview to the right" and
  "Move preview back into a tab" to reflect what's about to happen.
- reorderTabs preserves the Preview tab in the underlying `tabs`
  array even though it's filtered out of the drag set in split mode.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(raw_apps): VS Code-style "Preview" header on the right pane

In split mode, the right pane now shows a small "Preview" tab-styled
header anchored at its top-left — making the layout read like a real
VS Code editor split, where each group has its own tab bar.

- Header appears only when `splitWithPreview && activeTabKind !== 'preview'`
  (i.e. when the right pane is meaningfully separate from the left's
  content). In single mode with preview active, the right pane is the
  only thing visible and the main tab bar already labels it.
- The header uses the same styling as an active tab: `bg-surface`
  on a `bg-surface-secondary` strip, h-8, text-xs, no border.
- An X button next to the label toggles split off — equivalent to
  closing the editor in VS Code's split view (preview goes back to
  living as a tab in the main bar).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor(raw_apps): VS Code-style symmetric tab bars per pane

Restructure the editor area so each pane is a self-contained "editor
group" with its own tab bar at the top. The Splitpanes is now the
topmost element — the divider runs floor-to-ceiling, splitting both
the tab bars and the content.

Layout (left pane = source / runnable, right pane = preview):
- Left pane top: DraggableTabs (file/runnable tabs, Preview tab when
  split is off) + Split-toggle in the trailing slot.
- Right pane top: a custom preview header — "Preview" label styled
  like an active tab on the left + the preview-affecting toolbar
  (bundler, inspector, rebuild) on the right.
- Each pane independently sized via Splitpanes; iframes + the
  runnable panel stay mounted and toggled via `display` so state
  survives every transition.

Trade-off: in single-mode with Preview active (paneA=0), the left
tab bar is hidden along with the left pane. To switch back to a
file tab the user uses the sidebar — which is exactly the
discoverability surface tabs were meant to complement, not replace.

Button placement by semantic ownership:
- Layout control (Split toggle) — left side, with the editor.
- Preview-affecting controls (bundler, inspector, rebuild) — right
  side, with the preview. No close-X on the right; the Split toggle
  on the left is the canonical way to flip layouts.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(raw_apps): keep tab bar visible when Preview is active in single mode

The "VS Code-style" restructure put the tab bar inside the left
Pane. When activeTabKind became 'preview' in single mode, the left
pane collapsed to width 0 and the entire tab bar disappeared with
it — leaving the user with no way to switch back to a file tab
except via the sidebar.

Move the main tab bar back above the inner Splitpanes (full width,
always visible). The preview pseudo-header stays inside the right
pane, carrying the bundler / inspector / rebuild toolbar. The
splitter only goes through the content area below the tab bar,
which is acceptable given how much friction the disappearing-tabs
edge case caused.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor(raw_apps): per-pane tab bars with mirrored single-mode lists

Replace the single tab bar above the inner Splitpanes with one
DraggableTabs per pane. Splitter now goes floor-to-ceiling through
tabs AND content in split mode.

In single mode both bars mirror the full tab list, so the visible
pane always carries every tab — fixes the bug where activating
Preview hid the tab strip. Clicking Preview while in split mode is
a no-op (Preview is permanently visible in the right pane).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor(raw_apps): polish tab strip and sync editor font to text-xs

* feat(raw_apps): move logs overlay onto the preview pane

* refactor(splitpanes): extract pixel-aware minSize helper

* fix(raw_apps): tab hydration loads correct file; closeTab in split mode

* fix(raw_apps): lazy-mount UI Builder iframe + add dev:ui-builder script

* feat(raw_apps): default split view, blue preview tab, fix dnd ghosting

* fix(raw_apps): remove 1px splitter sliver beside preview in single view

* fix(raw_apps): tab scrollbar on hover, fix thumb height + resize staleness

* refactor(raw_apps): don't persist tab/split layout in localStorage

* refactor(raw_apps): derive pane sizes + binding setter instead of effects

* style(raw_apps): trim verbose comments

* feat(raw_apps): accept appendLogs delta from the UI Builder iframe

* fix(raw_apps): exit inspect mode on Escape

* fix(raw_apps): Escape clears lingering inspector selection after pick

* style(raw_apps): accent-selected styling for active tab, bg-surface strip

* fix(raw_apps): address PR review nits (drop debug log, timer/reorder/pane-setter, dev script restore)

* fix(raw_apps): clear inspector overlay on the preview iframe, not the source

* style(raw_apps): neutral tab look (surface-tertiary/text-emphasis selected, text-hint idle)

* chore(raw_apps): bump bundled ui_builder to 61b6fdd

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(raw_apps): bump bundled ui_builder to b4f6219 (#9314)

* skip workspaced-route duplicate checks on cloud (#9305)

* fix(settings): skip workspaced-route duplicate checks on cloud

The pre-write validation hooks for `app_workspaced_route` and
`http_route_workspaced_route` query the DB for cross-workspace duplicates
and fail the save when any are found. On cloud both `custom_path_exists`
(apps) and `route_path_key_exists` (HTTP triggers) already scope lookups
by `workspace_id` regardless of these settings, so duplicates across
workspaces are expected and the validation has no runtime meaning. The
result was that any cloud super-admin attempting to save instance
settings with these toggles set to false received
`Duplicate HTTP route paths detected` even though the setting has no
effect on cloud routing.

Fixes WIN-1983

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(error): render JsonErr as readable text and return 400

`Error::JsonErr` previously rendered through `#[error("Error: {0:#?}")]`,
leaking Rust's `Debug` output (`Object { "error": String(...), "details":
Array [...] }`) into the HTTP response body, and was bucketed into the
catch-all 500 branch in `IntoResponse`. The result was a 500 status with
a wall of Rust debug syntax in the toast — confusing and user-hostile.

- Bucket `JsonErr` into 400 (Bad Request): every current call site
  (workspaced-route duplicate checks, OAuth client errors, etc.) is a
  client/validation issue, not an internal server fault.
- Add `format_json_err_message` which surfaces the `error` field as the
  headline, summarises `details` (with a `- key=value` per entry), and
  pretty-prints the rest as JSON for unknown shapes. The frontend toast
  now reads e.g.

      Duplicate HTTP route paths detected
      - route_path=a, workspace_id=admins, http_method=post
      - route_path=a, workspace_id=starter, http_method=post

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(toast): preserve newlines and escape HTML in multi-line errors

The toast renders via `{@html processMessage(message)}`, so server-side
error bodies that span multiple lines (e.g. the duplicate-route response
from the settings endpoint) collapsed into a single line because HTML
treats consecutive whitespace (including `\n`) as a single space.

When the message contains a newline, escape HTML first (defends against
injected markup in server error bodies) and convert `\n` to `<br />` so
multi-line errors stay readable in the toast.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fixup: address CI review feedback

- toast.ts: escape HTML unconditionally. The previous gate on `\n` left
  single-line server error bodies unsafe under {@html}, which cubic
  flagged as P0. The path regex below only inserts a `<span>` around a
  `u/...` or `f/...` capture that can't contain HTML metacharacters, so
  escaping the whole input is the simpler and correct fix.
- error.rs: add unit tests pinning the rendered shape of
  `format_json_err_message` (error+details, error-only, truncation cap,
  non-object fallback to pretty JSON).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(service-accounts): allow choosing role at creation time (#9307)

* [ee] feat(service-accounts): allow choosing role at creation time

Previously, service accounts were hardcoded to operator and could not be
used as the CLI sync user since they had no write access. They also only
counted as 0.5 seat each.

This change:
- Extends `NewServiceAccount` to accept optional `is_admin` / `operator`
  (defaults to `operator=true` for backward compatibility).
- Exposes a role picker in `AddUser.svelte` when creating a service
  account (Operator / Developer / Admin).
- Lets admins update a service account's role from the user list (it
  used to be locked to "Operator" with a tooltip).
- Updates the OpenAPI spec + regenerates the frontend client.

A developer/admin service account counts as 1 seat under the existing
seat-cap logic (operators stay at 0.5).

Companion PR on windmill-ee-private updates the `INSERT INTO usr` to
honour the chosen role.

Fixes WIN-1985

* [ee] feat(service-accounts): wm_deployers opt-in for Dev role

When creating a service account with role=Developer, surface a toggle
"Add to wm_deployers" (recommended). Members of wm_deployers can deploy
on behalf of other users — the typical setup when the service account is
used as the CLI sync / CI deploy identity.

- `NewServiceAccount` gains an optional `add_to_deployers` flag.
- Frontend defaults the toggle to on but only shows it under Developer
  (admins have it implicitly; operators can't deploy).
- Tooltip links to docs.windmill.dev "Run on behalf of".

Companion EE PR updates the handler to INSERT into usr_to_group for
wm_deployers when the flag is set.

Refs WIN-1985

* chore: update ee-repo-ref to 974ed42067d9f63acb42332b671b8c01ffd4b625

This commit updates the EE repository reference after PR #589 was merged in windmill-ee-private.

Previous ee-repo-ref: f7dbc3cc2ba21c396f4828881e3b9d9ab6f50c69

New ee-repo-ref: 974ed42067d9f63acb42332b671b8c01ffd4b625

Automated by sync-ee-ref workflow.

* [ee] fix(service-accounts): unhardcode role in superadmin user list

Two review issues from the merged #9307 / #589:

1. P1 — The global Users tab in #superadmin-settings still pinned every
   service account to "Operator". Now it shows the actual role
   (Admin / Operator / Developer), derived from the SA's usr row.

   - `list_users_as_super_admin`: replaced `true as operator_only` with
     the real `operator` value, and added `is_workspace_admin` from the
     row (NULL for password users since their admin status is
     per-workspace).
   - `global_whoami`: when the email belongs to a service account, look
     up its real `operator` / `is_admin` instead of pinning to operator.
   - `SuperadminSettingsInner.svelte`: drop the hardcoded "Operator"
     badge; render Admin / Operator / Developer using the new fields,
     matching the workspace-level view.

2. P2 — Regenerate the bundled `openapi-deref.{yaml,json}` so the
   `createServiceAccount` body (now exposing `is_admin`, `operator`,
   `add_to_deployers`) and the new `GlobalUserInfo.is_workspace_admin`
   field show up at runtime in `/api/openapi.{yaml,json}`.

Bumps `ee-repo-ref.txt` to the EE follow-up that adds the offline
seat-cap check on `create_service_account`.

Refs WIN-1985

* chore: update ee-repo-ref to b7a6068c1f3dc845e012959268b2426f0de4d697

This commit updates the EE repository reference after PR #590 was merged in windmill-ee-private.

Previous ee-repo-ref: 0b1307c21d1bfd6fb43a03c2ba39d2a8bf8e6470

New ee-repo-ref: b7a6068c1f3dc845e012959268b2426f0de4d697

Automated by sync-ee-ref workflow.

---------

Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>

* fix(jobs): authorization bypass in only_result job updates (WIN-1980) (#9301)

* fix(jobs): enforce anonymous-only guard on `only_result` job updates

The `jobs_u/getupdate/{id}` and `jobs_u/getupdate_sse/{id}` endpoints
accept `only_result=true`. In that branch, `get_job_update_data` queried
the result solely by (workspace_id, job_id) and skipped the
`created_by == "anonymous"` check that the non-only_result path and
adjacent unauthenticated endpoints apply. An unauthenticated requester
who learned a private job UUID could therefore retrieve that job's
output.

Hoist the guard to the top of `get_job_update_data` so both branches are
covered.

Fixes WIN-1980

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor: fold `created_by` check into existing only_result queries

Avoids the extra `SELECT created_by` round-trip per call by joining
`v2_job` once in the two queries that handled the unauth path and
checking inline. Behavior is identical to the prior commit; the SSE
polling loop now does one query per poll instead of two for
unauthenticated callers.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor: cache anonymous_verified across SSE polls

Replace the LEFT JOIN approach with an upfront `SELECT created_by`
guarded by a new `&mut bool anonymous_verified` parameter that mirrors
`early_return_suppressed`. The SSE polling loop now performs the auth
check exactly once per stream rather than per poll, and the data SQL
reverts to its original form so authenticated callers pay no extra
cost. `created_by` cannot change after job creation, so caching the
verification across polls is safe.

Cost matrix:
- Authed (any path): 0 extra queries
- Unauthed one-shot: 1 extra query (unavoidable)
- Unauthed SSE: 1 extra query at stream start, 0 per poll

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor: scope anonymous check to only_result branch

The non-only_result branch already enforces the `created_by` check via
its main query, so a top-level hoisted check duplicated work for
unauthenticated default-path callers. Move the check inside the
`if only_result.unwrap_or(false)` block — exactly where the bypass
lives — and leave the non-only_result path untouched.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(raw_apps): surface UI Builder build errors over the preview pane (#9316)

* feat(raw_apps): surface UI Builder build errors over the preview pane

Companion to the matching change in the UI Builder repo (see linked PR),
which stops rendering the build-error overlay over the VS Code editor
iframe and instead emits a `buildError` postMessage on every build
(message: undefined on success to clear).

Listen for that message on the existing window message handler (already
source-gated by the UI Builder iframe), store it in a `buildError`
$state, and surface it in two places:

* A red banner over the preview iframe, sibling to the existing logs
  overlay (`top-12 left-2 right-2 z-20` so it clears the tab bar) —
  failures appear right where the user looks for the rendered output.
* The Preview tab's icon and label tint red
  (`text-red-600 dark:text-red-400`, matching the existing error
  convention in raw_apps) — important in single-tab mode where the
  preview pane is collapsed to 0px and the banner would be hidden.
  Done by mapping `leftPaneTabs` / `rightPaneTabs` through a small
  `tintPreviewOnError` helper so the source-of-truth `tabs` array is
  untouched (DnD, ordering, fallback selection keep using the original
  previewTab object).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor(raw_apps): use Alert component for the build-error banner

Replace the hand-rolled red div with the shared `Alert` component
(`type="error"`, `title="Build failed"`). The error text stays in a
`<pre>` child so multi-line bundler output keeps its formatting, with
`max-h-60` so a long error never takes over the whole preview pane.

The absolute-positioned wrapper (`top-12 left-2 right-2 z-20`) and the
`role="alert"` move to that wrapper so the Alert component itself stays
unstyled at the call site.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(raw_apps): solid bg-surface backing behind build-error Alert

The Alert's error background is semi-transparent in dark mode
(`bg-red-900/40` in `common/alert/model.ts`), so the preview iframe
shows through when the banner is laid over it. Add a `::before`
pseudo on the Alert root with `bg-surface` (matched `rounded-md`,
`-z-10` so it sits behind the red bg) to give it a solid plate.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor(raw_apps): isolate banner stacking context, DRY tab tint chain

Two small follow-ups from review:

* Add `isolate` to the build-error banner wrapper so the `before:-z-10`
  pseudo's stacking context is pinned locally — it works today because
  `position: absolute` + `z-20` creates one, but `isolate` makes the
  dependency self-documenting and survives a future refactor that
  removes the explicit `z-20`.
* Extract `tintTabs = (ts) => ts.map(tintPreviewOnError)` so the two
  `$derived` blocks for leftPaneTabs / rightPaneTabs read identically.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(raw_apps): trim build-error overlay comments

Per review feedback. Keep only the load-bearing facts (bg-surface backs
the Alert's translucent red, isolate pins the pseudo stacking, the
`message: undefined` clear convention) and drop the prose context that
duplicated what the code already shows.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(raw_apps): bump bundled ui_builder to 00c9834

Brings in the postMessage emission from
windmill-labs/windmill-code-ui-builder#9 (merged) so this PR's host
listener actually receives `buildError` events. SHA verified against
the R2 artifact.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(main): release 1.709.0 (#9312)

* chore(main): release 1.709.0

* Apply automatic changes

---------

Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>

* add cli-sync workspace snapshot/load scripts (#9322)

* feat(fixtures): add cli-sync workspace snapshot/load scripts

* fix(fixtures): address review nits (env var password, mktemp, dead refs)

* fix(fixtures): address CI review (SIGPIPE, JSON escaping, doc/code drift)

* feat(queue): stochastic admission + EE availability of workspace fairness algorithm (#9321)

* refactor: unify AI provider credentials (#9317)

* refactor: use provider credentials for worker builders

* refactor: resolve api proxy credentials directly

* fix: lazy load frontend eval modes

* fix(websocket-trigger): honor HTTPS_PROXY/HTTP_PROXY/NO_PROXY (#9324)

* feat(websocket-trigger): honor HTTPS_PROXY/HTTP_PROXY/NO_PROXY (WIN-1988)

`tokio_tungstenite::connect_async` opens a raw TCP socket and ignores
the standard outbound-proxy env vars, so deployments behind a forward
HTTP proxy can't reach the WebSocket endpoint and Test Connection
times out after 30s.

Add a small `proxy` module that resolves the right proxy URL for the
target host (HTTPS_PROXY for wss://, HTTP_PROXY for ws://, NO_PROXY
exclusions, ALL_PROXY fallback, lowercase variants), opens an HTTP
CONNECT tunnel when one applies, and hands the resulting TcpStream to
`client_async_tls_with_config` for the TLS + WS handshake. Direct
connect remains the default when no proxy env is set.

Unit tests cover NO_PROXY matching, proxy URL parsing (including IPv6
literals and basic-auth userinfo), and the CONNECT handshake itself
against an in-process fake proxy (success, basic-auth header, 407
rejection).

Fixes WIN-1988

* refactor(websocket-trigger): reduce blast radius and reuse existing logic

Follow-up to the proxy support change. Three things:

1. Skip the new code path entirely when no proxy is configured.
   `connect_async_with_proxy` now checks the env-var snapshots up front
   and delegates straight to `tokio_tungstenite::connect_async` if
   neither `HTTP_PROXY` nor `HTTPS_PROXY` is set. Same fall-through
   applies when proxy env is set but `NO_PROXY` excludes the host or
   the proxy URL doesn't parse. Non-proxied deployments now exercise
   exactly the previous code path.

2. Move the `NO_PROXY` / `HTTP_PROXY` / `HTTPS_PROXY` env-var snapshots
   from `windmill-worker::worker` into `windmill-common`. The worker's
   `PROXY_ENVS` static now reads from there, and the websocket trigger
   reads from the same source — one place reads the env, one source
   of truth for both call sites.

3. Replace the hand-rolled proxy-URL parser with `url::Url::parse`
   (already a workspace dep, used across the codebase). Half the LoC
   and handles edge cases (userinfo percent-encoding, IPv6 literals,
   path/query stripping) via the well-tested crate instead of by hand.

All 13 proxy unit tests still pass. `cargo check` is clean.

* fix(websocket-trigger): unbreak EE build + trim proxy tests

- Re-export `NO_PROXY` / `HTTP_PROXY` / `HTTPS_PROXY` from
  `windmill-worker::worker` (via `pub use windmill_common::...`) so the
  EE `otel_tracing_proxy_ee` module's `use crate::{HTTPS_PROXY, ...}`
  resolves like it did before. Fixes the `check_ee_full` / `cargo_test`
  CI failures from the previous commit.

- Trim the proxy tests to one un-ignored canary
  (`http_connect_tunnel_sends_well_formed_request_and_unwraps_stream`)
  that exercises the actual on-wire CONNECT handshake plus byte-perfect
  tunnel passthrough. The NO_PROXY-matching, URL-parsing, and edge-case
  tunnel tests are kept under `#[ignore]` for manual debugging
  (`cargo test -- --ignored`) since they're either delegated to
  `url::Url::parse` or trivial string matching — low ROI on every CI run.

* chore(main): release 1.710.0 (#9323)

* chore(main): release 1.710.0

* Apply automatic changes

---------

Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>

* fix: improve workspace fairness

* chore(main): release 1.710.1 (#9327)

* chore(main): release 1.710.1

* Apply automatic changes

---------

Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>

* prevent windows backend tests from running out of disk space (#9325)

* ignore flaky fairness regression tests in CI (#9328)

`fairness_ignores_zombie_running_rows` and
`fairness_ignores_concurrency_suspended_rows` panic intermittently in CI
(both Linux and Windows runs). Mark them `#[ignore]` until the
underlying flakiness is resolved.

* feat(cli): add object-storage commands and flow test-step (#9326)

* feat(cli): add object-storage commands and flow test-step

* docs(cli): clarify flow test-step doesn't recurse into aiagent tools

* fix(cli): correct failure step id in docs, handle bare flow.yaml path

* refactor(cli): fold flow test-step into flow preview --step (#9330)

* fix(queue): duration-weighted workspace fairness signal (#9329)

* fix(queue): bump EE ref to include worker_ping fairness signal

The current ee-repo-ref.txt pointed to 31cda7c (an unrelated merge
commit on the asset-graph-view-ee branch) instead of ddc9e80, which
contains the workspace-fairness fix that switches the active-share
signal from v2_job_queue.running=true to worker_ping. As a result
cloud was still computing overload off the legacy signal, so a
workspace with many in-flight/suspended flows (lancom01-prod, with
799 suspended flows × 3 v2_job_queue bookkeeping rows each = 2397
running-true rows) was flagged as 95% of cluster activity despite
consuming zero worker slots.

Bumping to ddc9e80 picks up the worker_ping-based signal, which
naturally excludes (a) suspended jobs (no worker pinging them),
(b) zombie running-rows from dead workers, and (c) flow/flownode
orchestration rows that never run on a worker in the first place.

* test(queue): seed v2_job rows + realistic durations for fairness helpers

The new duration-weighted fairness algorithm joins v2_job_queue and
v2_job_completed to v2_job for the `kind` filter (excluding flow
bookkeeping) and reads `duration_ms` for the completed contribution.
Update the test helpers to mirror that schema:

* `insert_completed` now inserts a matching v2_job row (kind=script)
  and writes `duration_ms = 1000` with a 1-second [started_at,
  completed_at] interval, so each completed row contributes ~1
  worker-second when fully inside the refresh window.
* `insert_queued` likewise pre-inserts v2_job, sets `started_at`
  to NOW() - 1s when running=true (so running rows contribute ~1
  worker-second by the time the refresh runs), and seeds
  v2_job_runtime.ping so the running side accrues real-time worker
  seconds (the algorithm bounds end-of-interval by ping).

The zombie/suspended insert helpers are intentionally left without
v2_job rows — the new algorithm's INNER JOIN excludes them, so they
still correctly contribute zero worker-seconds.

* chore(queue): bump EE ref to duration-weighted fairness algorithm

Companion to windmill-ee-private#<TBD>: switch the EE workspace
fairness aggregation from a count-based UNION (worker_ping snapshot
+ v2_job_completed count) to a worker-seconds aggregation sourced
directly from v2_job_queue and v2_job_completed, with kind/suspend
filters mirroring handle_zombie_jobs and per-row defenses against
zombie inflation on both halves.

* chore(queue): bump EE ref for fairness perf fix (inline window_start)

* chore(queue): bump EE ref for fairness perf rewrite (driver-side flip)

* update ee ref

* feat(hub-publish): add backend proxy routes for hub publishing

New workspaced router /api/w/:ws/hub/* forwarding to the Hub:
- POST /publish_draft → POST {HUB}/workspaces (slug/name/summary/readme)
- POST /scripts → POST {HUB}/scripts/add (workspace_slug + content)
- POST /flows | /apps | /raw_apps → corresponding hub endpoints
- POST /scripts/:ask_id/recording, /flows/:flow_id/recording → recording uploads

Auth uses HUB_DEV_TOKEN env var (dev shortcut). All bodies are
serde-typed; the helper forward_to_hub centralises the HTTP call.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(deploy-to-hub): wire frontend to backend hub proxy

Replaces the mocked deploy flow with real backend calls:
- confirmBundle() POSTs /hub/publish_draft with sanitized slug,
  name, summary and readme.
- deployAll() pushes selectedItems one by one via pushItem(),
  fetching the live content (Script/Flow/AppService + raw_apps
  get_data) before forwarding to /hub/{scripts,flows,apps,raw_apps}.
- saveRecording() builds the replay-shaped payload expected by
  the Hub (initial_job + events with type: 'CompletedJob') and
  POSTs to /hub/{scripts,flows}/{hub_id}/recording.
- Adds bundleSummary state + TextInput in the drawer.

Hub item ids (ask_id / flow_id) returned by the create calls are
cached client-side to wire later recording uploads.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(hub-publish): add /resources proxy route

Forward workspace resource stubs (path + type) to the hub's
/workspaces/{slug}/resources endpoint.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(deploy-to-hub): auto-detect resource dependencies from selection

Derive resource dependencies from the $res:/res:// references in the selected
scripts/flows/apps instead of a manual resource list, sync them as empty stubs,
and show them read-only (chip per type, hover for path + which items use it).
Aborts item publish if dependency sync fails to avoid broken fork references.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(deploy-to-hub): add project-bundle closure + path-rewrite logic

Pure, unit-tested module (projectBundle.ts) backing the "project = folder"
Hub bundle:
- extractScriptRefs / extractFlowRefs / extractAppRefs: structural detection
  of $res: references (code, static step inputs, script-by-path), hub refs
  classified separately.
- classifyPath / buildPathMap: relocate external u/.. and f/other/.. paths
  under f/<slug>/, with deterministic _2/_3 collision suffixes.
- rewriteContent / rewriteFlowValue / rewriteAppValue: rewrite every ref to
  its relocated path, leaving hub/.. untouched.
- buildProjectBundle: walk the transitive closure of a seed selection
  (scripts pulled in recursively, resources pulled as stubs), returning the
  rewritten items + resource stubs + unresolved list.

14 vitest cases cover classification, extraction, collision suffixing,
partial-match safety, deep-clone, and the closure orchestrator.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(deploy-to-hub): publish as relocated project bundle + resource drawer

- deployAll now builds a self-contained project bundle (buildProjectBundle),
  pushing resource types, empty resource stubs at relocated f/<slug>/ paths,
  and the rewritten items — so a fork's references resolve inside the project.
- Resource-dependency detection is unified on the same bundle: the UI list
  (dependencyTypes) is derived from the bundle preview, guaranteeing what's
  shown matches what's pushed. Removes the duplicate in-component detection
  (extractResRefs/refsForItem/resolveResourceSet/typeForResource).
- Input-type deps (schema format: resource-<type>) are synced as types and
  conventional f/<slug>/<type> stubs alongside hardcoded ones.
- Replaces the hardcoded-path warning/fix/block machinery with a read-only
  "Resource dependencies" drawer: per-type usages tagged input vs hardcoded
  path, with an info popover explaining the portability tradeoff.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(deploy-to-hub): gate hub publish endpoints + harden trigger detection

- Add ApiAuthed + require_admin to all hub publish handlers; previously any
  workspace-authenticated session could trigger Hub-side writes attributed
  to the URL workspace via the shared HUB_DEV_TOKEN.
- Track per-kind trigger fetch failures (triggerLoadErrors) so an EE-gated
  or transiently failing trigger service no longer silently maps to "0
  triggers"; UI surfaces an amber badge listing the missing kinds and a
  toast warns the operator before publish.
- Add workspaceLoadSeq cancellation so the parallel loadWorkspace +
  loadTriggers stop bleeding stale data when the workspace switches mid
  load.
- Drop the silent effectiveSlug fallback to sanitizeSlug(hubName) when
  the Hub response can't be parsed; abort the publish instead so items
  don't land under a slug the Hub never locked.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(deploy-to-hub): thin /triggers proxy to forward trigger bulk-sync to Hub

Mirrors the existing /scripts, /flows, /apps thin proxies. Forwards
{ triggers, workspace_slug } to Hub's POST /workspaces/[slug]/triggers
bulk-replace endpoint, with the same require_admin + HUB_DEV_TOKEN
guardrails. Lets the frontend push trigger stubs in a single round-trip
after the items they reference have landed on the Hub.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(deploy-to-hub): push trigger stubs as the final bundle step

After scripts/flows/apps land on the Hub, pushTriggers() builds a
relocation map for the trigger paths, strips operational metadata
(workspace_id, edited_by/at, enabled, last_*/captured_*, capture data,
error_handler_path/args, permissioned_as*) from each config, resolves
script_ask_id / flow_id via the hubItemIds map produced by step 3, and
POSTs the whole set to /api/w/:wsp/hub/triggers. Triggers whose runnable
didn't publish are skipped with a warning rather than emitted as broken
stubs.

Also drops the per-kind trigger-load error surfacing: feature-gated
services (Kafka, NATS, ...) 404 on instances that don't enable them, and
the banner was lighting up on every load for nothing. Errors are
swallowed silently again, matching the pre-review behaviour.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor(hub_publish): rename Hub-facing fields and URLs from workspace to project

Matches the windmillhub rename: every body now carries `project_slug`
instead of `workspace_slug`, the draft creation forwards to `/projects`,
and the resource_types/resources/triggers proxies hit
`/projects/{slug}/...`. `HubWorkspaceBody` becomes `HubProjectBody`. The
instance-side `Path(workspace)` extractor and the `workspace` URL
parameter stay because that's still the source tenant's identifier.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* ui(deploy-to-hub): user-facing rename from "workspace" to "project"

The Hub-deploy surface now talks about *projects* (the bundle published
to the Hub) instead of *workspaces* (which still means the source
tenant). Tab is "Publish project", header copy mentions "project", the
Hub URL in the breadcrumb points to /projects/<slug>, payload field is
`project_slug`. Internal state names (`workspaceItems`, `workspaceStore`,
`WorkspaceService`, …) stay — they refer to the instance workspace the
items are read from, which has not been renamed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* ui(deploy-to-hub): open-in-tab affordance on each dependency and trigger

Adds a small ExternalLink icon at the far right of every row in the
Resource dependencies drawer (script / flow / app / raw_app) and the
Triggers drawer (per trigger kind, opens the matching list page —
/routes, /schedules, /websocket_triggers, /kafka_triggers, …). Both
buttons open in a new tab scoped to the current $workspaceStore. Sized
to sit after the role badge so the dominant signal (input vs hardcoded
path, script vs flow) stays read first.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(deploy-to-hub): proxy raw app embed to the Hub

Add POST /w/{workspace}/hub/raw_apps/{id}/embed forwarding to the Hub so a
shared (public) raw app's external_embed_url can be set/cleared. null is
forwarded (not skipped) so unpublish clears the embed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(deploy-to-hub): bundle raw apps, share live iframe, folder-scoped bundles

- Detect modern raw apps (app table, raw_app=true) and push them to the Hub
  as raw apps: fetch source files + runnables + the compiled bundle (via the
  latest-version bundle secret) and shape them into the raw payload RawAppView
  expects. Fail loudly when no compiled bundle exists.
- Capture the Hub id for raw apps and wire "Share as iframe"/"Unpublish" for
  them (post-bundle, like recordings); re-sync the embed on re-bundle for
  already-public apps. Factor the publish/unpublish flow into setAppShared +
  pushRawAppEmbed helpers.
- Scope bundles to a single required f/<folder>/ (Select instead of MultiSelect)
  so relocated paths stay predictable.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(hub): send item path when publishing a project to the hub

Include each item's newPath in the script/flow/app/raw_app publish payloads so
the hub can store the relocated Windmill path.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(hub): accept path on publish and proxy project export

Add an optional path field to the publish bodies and a GET
/projects/{slug}/export route that proxies the hub export (admin-only,
authenticated with HUB_DEV_TOKEN).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(projects): add project install page

New /projects/install page pulls a hub project's export and re-creates it in
the selected workspace.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(deploy-to-hub): let user pick target folder on project import

Add a FolderPicker to the project install page (defaulting to the
project slug, with create-new-folder support) and retarget every
`f/<slug>/` prefix in the bundle — item paths, $res:/script refs,
schedule runnable paths — to the chosen folder in one pass. Ensures
the target folder exists before creating items.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Fix wording

* fix(hub-publish): bind Hub publish/export to the trusted workspace via source_id

Hub publish endpoints ignored the {workspace} path and addressed the Hub
project purely by client-supplied project_slug, forwarding with an
instance-wide HUB_DEV_TOKEN. Any workspace admin could mutate or export
another workspace's Hub project by passing its slug.

Stamp the server-trusted workspace from the path onto every forwarded
request as source_id (body for mutations, query param for export) so the
Hub can enforce that the targeted project belongs to the calling
workspace. Requires the matching Hub-side source_id ownership check.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(deploy-to-hub): reset draft/publish state on workspace switch

The workspace-switch effect only reset load-derived state, so phase,
draftItems, recordings, hub/bundle metadata, hubVersion, deploymentStatus,
effectiveSlug and hubItemIds survived a switch — a draft built in one
workspace could publish its items/slug under the next workspace's auth.
Reset the full publish session on switch. Also drop explanatory comments.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(deploy-to-hub): pull sub-flows referenced by type: flow steps into the bundle

extractFlowRefs only emitted refs for type: script steps, so a flow calling
an external sub-flow by path was never followed and the published project
was silently incomplete. Add a 'flow' RefKind, emit it for type: flow steps,
recurse on it in buildProjectBundle, and rewrite its path on relocation.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(deploy-to-hub): fall back to slug when import folder is whitespace-only

(folderName || slug).trim() let a whitespace-only folder bypass the slug
fallback and trim to an empty target, producing invalid f//... paths and a
failed import. Trim first, then fall back.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(hub-publish): validate project slug before interpolating into Hub path

slug/project_slug are caller-controlled and were interpolated straight into
the Hub request path; a crafted value (e.g. ../../admin) could reach an
unintended Hub endpoint after URL normalization. Validate against the
frontend charset (lowercase alphanumerics + hyphens, 3-50 chars) in the four
handlers that put the slug in the path.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(deploy-to-hub): use ?tab query param to link to the Apps settings tab

The "Edit in Workspace settings → Apps" link set window.location.hash, but
the settings page derives the active tab from ?tab=..., so the link was a
dead affordance. Navigate with goto('?tab=default_app') instead.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(deploy-to-hub): point Open in Hub link at the project slug, not the workspace

hubSlug was derived from $workspaceStore, so the Open in Hub link and badge
used the workspace id instead of the published project slug — navigating to
the wrong (or nonexistent) Hub project. Derive hubSlug from the actual
project slug (effectiveSlug, falling back to sanitizeSlug(hubName)).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Sync hub to instance

* feat(deploy-to-hub): rehydrate project state, wire review flow, bundle trigger resources

- Rehydrate the publish panel from the Hub by source_id on load (phase, slug,
  metadata, items, hub ids, recordings) so refresh no longer loses the draft.
- Map Hub project status to the draft/under_review/live phase; submitForReview
  now persists to the Hub instead of a local stub; drop the unused v{n} version
  display (status is the source of truth).
- Send source_path (original workspace path) per item for recording round-trip.
- Detect resources referenced by triggers, add them to the bundle closure
  (extraResourcePaths) so they appear in dependencies, get stubbed/relocated,
  and rewrite the trigger config path via the full bundle pathMap (no leaked
  private path); show trigger usages in the dependency drawer.
- Review fixes: Array.isArray guards on trigger topic/subject lists; snapshot
  relevantTriggers in deployAll to avoid a mid-deploy folder-switch race;
  index-key the usage list.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(deploy-to-hub): keep item summary on rehydrated draft, drop placeholder diff button

Rehydrated draft items now carry their summary (from the Hub) so step 2 shows
the summary like step 1 instead of falling back to the path. Remove the
"Diff vs submitted" button: it only toasted add/remove counts with no view,
which read as broken.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(deploy-to-hub): New draft returns to the folder-picker step instead of erroring

In the live phase the folder picker is hidden, so startNewDraft's
selectedFolder guard always failed with "Pick a folder..." and the user had
no way to pick one. Now New draft goes back to step 1 (predeploy) with the
project's folder pre-selected (inferred from the item paths) so the user can
re-bundle.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(hub_publish): return 500 not 400 when HUB_DEV_TOKEN missing

* fix(deploy-to-hub): keep internal subfolder paths identity-mapped when bundling

* fix(projects-install): never overwrite existing resources; isolate invalid raw app json

* fix(deploy-to-hub): route raw_app to apps_raw/get and guard openRecord schema race

* refactor(hub_publish): extract hub_token helper, drop duplicated env lookup

* refactor(projects-install): route raw-app and unsupported-trigger failures through record()

* fix(deploy-to-hub): refresh review status from Hub and use configured hub base url

* fix(hub_publish): return 400 not 500 when HUB_DEV_TOKEN is unset

Missing config is a client/config error, not a server fault. Restores the
BadRequest class lost when hub_token() was extracted.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(hub_publish): scope Hub projects per folder via workspace:folder source key

* feat(deploy-to-hub): publish per-folder projects from the Folders page

* ui(deploy-to-hub): move phase CTA to the top-right header

* Fable review

* feat(hub_publish): forward the caller's token to the Hub instead of HUB_DEV_TOKEN

* style(windmill-api): cargo fmt fallout in build.rs and lib.rs

* Nit fixes

* Nit fix

* fix: structural project-ref rewrite and deploy-to-hub state fixes

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix: deterministic draft phase fallback when post-deploy rehydrate fails

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(frontend): skip EE-only native trigger calls on CE to avoid console 404s

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(deploy-to-hub): fork all trigger kinds on project install

The project install (fork) flow recreated only schedule triggers and
rejected every other kind with "not supported yet". Recreate all trigger
kinds instead, imported disabled (enabled: false → mode disabled).

Kafka, NATS, SQS, GCP and Azure require an Enterprise license, so they are
gated behind enterpriseLicense and reported as "requires Enterprise" on CE
rather than firing backend calls that 404. http, websocket, postgres, mqtt
and email are recreated on CE. The kind-specific config (with retargeted
resource paths) is spread into the create body; explicit path/script_path/
is_flow/summary/enabled win over it. Also carry the schedule summary through.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(deploy-to-hub): list CE trigger kinds without an Enterprise license

loadTriggers wrapped http, websocket, postgres, mqtt and email list calls
in eeList, so on CE (no enterpriseLicense) they resolved to [] and never
made it into deploy state — those triggers silently disappeared from the
Hub publish set. Only Kafka, NATS, SQS, GCP and Azure are EE; switch the CE
kinds back to safeList so they are always listed and published. Mirrors the
EE gating used on the project install (fork) side.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(deploy-to-hub): reload triggers when EE license hydrates late

loadTriggers captures enterpriseLicense at call time and the main reload
$effect only depends on workspace/folder, guarded by lastLoadedKey. When the
license store hydrates asynchronously after loadTriggers already ran, the EE
trigger kinds (kafka/nats/sqs/gcp/azure) stay empty until the workspace or
folder changes. Add a dedicated $effect that re-fetches triggers on the
license false→true transition, mirroring the sidebar's license-race handling.
prevHadLicense is seeded from the current value so a license already present
at mount doesn't trigger a redundant reload.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(deploy-to-hub): token loadTriggers so a late EE reload can't be clobbered

The license-late reload calls loadTriggers with the same workspaceLoadSeq as
the original license-less load, so the workspace guard alone lets both assign
workspaceTriggers. If the earlier (EE-empty) request resolves last, it
overwrites the newer license-aware result and the EE trigger kinds disappear
again. Add a per-invocation triggerLoadSeq token and only let the latest load
assign (and toggle triggersLoading), so a slow earlier request is discarded.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(deploy-to-hub): use mode 'disabled' for forked non-schedule triggers

Non-schedule triggers expose `mode` (TriggerMode), not the deprecated
`enabled` flag, in their create body. `enabled: false` happens to still map
to disabled today via the backend's legacy BaseTriggerData field, but relying
on a deprecated path is fragile. Set `mode: 'disabled'` explicitly so imported
http/websocket/postgres/mqtt/native triggers stay disabled. Schedules keep
`enabled: false` (NewSchedule uses the enabled flag).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(deploy-to-hub): snapshot workspace + key bundle by kind:path

Address three P1 review findings:

- Project install (fork) read the reactive `workspace` ($derived) across many
  sequential awaits, so a workspace switch mid-import could create the folder in
  one workspace and later items in another. Snapshot the target workspace once at
  the top of install().
- DeployToHub.deployAll re-read $workspaceStore after confirmBundle had already
  created the Hub draft bound to a specific workspace's source_id, so a switch
  during draft creation could publish items to a different workspace. Pass the
  workspace captured by confirmBundle into deployAll instead.
- buildProjectBundle keyed its fetched/queued maps by bare path, silently
  dropping one of two distinct-kind items at the same path (script vs flow). Key
  by `${kind}:${path}` and derive item paths from the fetched values, keeping
  path relocation separate.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* style(deploy-to-hub): condense comments

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(deploy-to-hub): surface backend error body on failed project import

record() only showed `e.message`, which for API errors is the generic status
text ("Bad Request"). Prefer the ApiError `.body` (plain-text reason for
Windmill 4xx) so a failed import reports the actual cause — e.g. a path or
route_path collision — instead of a bare "Bad Request".

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(deploy-to-hub): close mid-request workspace-switch races

Two follow-ups to the workspace snapshotting:

- confirmBundle captured `workspace` but read selectedItems / relevantTriggers
  / hubSlug only inside deployAll, after the publish_draft await. A workspace
  switch during that request resets those to the new workspace, so deployAll
  would push the new workspace's items into the old workspace's Hub draft.
  Capture workspaceLoadSeq before the request and abort (with a toast) if it
  changed before publishing.
- install() snapshotted `workspace` but still read the reactive `data` after
  the createFolder await; load() can replace `data` on a workspace switch, so
  retarget() could run against a different export than `folder` was derived
  from. Snapshot `data` up-front and use it throughout install().

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(deploy-to-hub): guard stale load response and mid-publish status writes

- install load() assigned `data`/`folderName` unconditionally, so a slow
  /export for an old ?hub= could overwrite a newer project after navigation.
  Add a load token + captured slug/workspace and only assign if still current.
- deployAll wrote deploymentStatus/hubItemIds incrementally and only checked
  the workspace at the very end. Bail at the top of the per-item loop when the
  active workspace changed, so a mid-publish switch can't keep writing the old
  workspace's item statuses and Hub IDs into the new workspace's live view.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(hub-projects): generate and apply datatable migrations on project publish/install (#9977)

* feat: add datatable_migrations table

* feat: add route to run datatable migrations

* feat: sync datatable migrations as .up.sql/.down.sql files

* feat: add datatable migrate up/down commands and post-push run prompt

* feat: add datatable migrate new command to scaffold migrations

* feat: add datatable migrations management UI

* feat: prompt to create migration on DDL in datatable SQL editors

* feat: support running a single specific datatable migration

* feat: view migration content, run single migration, fix stacked modal

* feat: per-row revert button with out-of-order warning

* fix: avoid migrations list flicker on refresh after an action

* feat: generate initial datatable migration via pg_dump

* fix: surface datatable migration API error details in toasts

* fix: revert created migration if create-and-run fails to run

* fix: include postgres error detail in migration run/rollback failures

* feat: sync datatable migrations as files via the workspace export

* refactor: move datatable migrations to migrations/datatable/ path

* fix: drop redundant datatable_migration label in sync output

* fix: exclude datatable migration sql files from script metadata generation

* feat: run datatable migrations as user-permissioned labeled jobs

* feat: reject invalid datatable migrations on sync push

* feat: datatable migrate up/down default to all datatables, --datatable to target one

* fix: surface postgres error detail when datatable migrations fail to run

* chore: regenerate CLI docs for datatable migrate commands

* feat: default new datatable migration to a BEGIN/END transaction template

* fix: validate datatable migration name and datatable at the API boundary

* fix: ensure detected DDL ends with semicolon when wrapped in transaction

* fix: re-prompt instead of stripping DDL when new-migration modal is cancelled

* feat: refresh datatable schema after running a migration from the SQL REPL

* feat: record db manager DDL on data tables as migrations

* feat: make datatable migrations opt-in per data table

* fix: make migration view editor read-only so its code can scroll

* fix: don't re-prompt DDL guard when creating a migration without running

* feat: generate down migrations for db manager DDL (postgres)

* fix: correct down migration for db manager alters (no double-wrap, serial)

* feat: explain migrations purpose with a tooltip in the migrations modal

* compare paeg

* feat: add datatable_migration kind to workspace diff pipeline

* chore: point ee-repo-ref at datatable_migration git-sync companion

* fix: harden datatable migration version allocation and initial-migration bookkeeping, add tests

* feat: deploy and run datatable migrations on workspace merge

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Refactor + handle datatable setting delete/rename

* refactor: move datatable migration rename/delete cascade into module

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore(windmill-utils-internal): bump to 1.7.1 for datatable migration deploy provider methods

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(db-manager): add Migrations button to top bar, make Refresh icon-only

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* BEGIN/END placeholder in down migration

* feat: autofocus migration name input and flag it red when empty

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(datatable-migrations): allow non-admins to create/run/revert migrations, gate only opt in/out

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* border nits

* refresh db manager schema on migrations

* BEGIN/END scaffold in CLI

* feat(cli): push local datatable migrations before running on migrate up

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat: flag invalid migration name with red border, not just empty

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* refactor: drop random slug from auto-generated migration names

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat: offer revert-and-delete when deleting an installed migration

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat: record fork merge as a migration when target datatable opts in

* nit

* clone migrations on fork

* windmill-utils-internal

* fix(datatable-migrations): serialize run/rollback with a per-db advisory lock

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(db-manager): fail closed when migrations-status check errors on DDL apply

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* docs: fix generate_initial migration ordering comment to match code

* chore(datatable-migrations): remove unused update_datatable_migrations endpoint

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix: run DDL migration guard on the script editor Test button

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* split

* ee-repo-ref

* chore(frontend): sync package-lock with package.json (@emnapi deps)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(datatable-migrations): never resolve instance credentials into migration job args

datatable_database_arg eagerly resolved instance data-table credentials
(including the shared instance-wide Postgres password) and passed them as the
migration job's plaintext `database` arg, landing in v2_job.args. Since the
run route has no admin gate, a non-admin could run a migration and read
args.database to recover the password, granting cross-workspace psql access to
all instance data-table DBs.

Pass a `datatable://<name>` reference for both resource-backed and instance
data tables instead; the pg executor already resolves it to real credentials
server-side at run time, so nothing sensitive is ever stored in the job args.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* nit

* fix: handle dollar-quoting and comments when splitting SQL statements

* feat: deploy datatable migrations on merge with explicit opt-in error

* fix(frontend): sync package-lock with npm 11 peer-dep resolution

npm ci failed with 'Missing: @emnapi/core@1.11.2 / @emnapi/runtime@1.11.2 from
lock file'. @napi-rs/wasm-runtime declares @emnapi/core|runtime ^1.7.1 as
peerDependencies while @rolldown/binding-wasm32-wasi pins them to exactly
1.10.0. Newer npm (bundled with node 24 in CI) installs the peer deps at the
highest match (1.11.2) alongside rolldown's nested 1.10.0, so the ideal tree
needs both versions; the committed lock only had 1.10.0.

Regenerate the lock with npm 11.18 so it carries both 1.11.2 (top-level, for
the peer deps) and 1.10.0 (nested, for rolldown's pin). Verified npm ci passes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* nit npm publish

* fix: fail closed on migrations-status error in fork schema merge

* nit CI emnapi/core version

* prevent initial_datatable_migration if migrations already exist

* fix(datatable-migrations): validate persisted data table names as path segments

edit_datatable_config only validated rename segments, not the actual
settings.datatables keys, so a data table could be saved directly under a name
like '..' or one containing '/'. Since new tables default to
migrations_enabled = true, generate_initial_datatable_migration would then
insert a migration row and the sync export would build
migrations/datatable/<name>/... paths from that name, producing malformed or
directory-escaping export paths.

Validate every persisted data table name in edit_datatable_config (alongside
the existing rename checks) and add validate_datatable_path_segment to
generate_initial_datatable_migration for defense in depth.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix: scope datatable _wm_migrations by data table and cascade renames/deletes

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(system_prompts): resolve nested local command groups in CLI docs generator

The CLI docs generator anchored on the first `new Command()` in a file and
never resolved locally-defined command groups passed as
`.command("name", localCmd)`. For datatable this flattened the nested
`migrate` group: it emitted `datatable new/up/down` plus a bare
`datatable migrate`, and mislabeled the datatable command with the migrate
group's description. jobs was broken the same way (its description was pull's,
and pull/push rendered empty).

Anchor block extraction on the `export default`ed command, recurse into
locally-defined `const x = new Command()` groups mounted as subcommands, and
render nested sub-subcommands. Regenerated docs now show
`datatable migrate new/up/down` and `jobs pull/push` with their real
options.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* refactor: drop unreleased _wm_migrations legacy-upgrade handling

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix: return datatable migration SQL from getItemValue for the diff drawer

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore(frontend): use windmill-utils-internal 1.8.2 for migration diff drawer

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* nit

* nit

* fix: handle datatable migration renames on push and dedupe timestamps

* fix: reject rewriting an already-applied datatable migration on upsert

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(frontend): add missing @emnapi/core and @emnapi/runtime lockfile entries

Resolves npm ci EUSAGE failure: the optional cpu:wasm32 @rolldown/binding-wasm32-wasi
declares deps on @emnapi/core@1.11.2 and @emnapi/runtime@1.11.2 that had no resolved
lockfile entries.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(cli): datatable migrate up/down default to main datatable, not all

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix: fail closed when applied status unreadable on datatable migration rewrite

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix: surface full error detail in Database Manager DDL/query errors

* "See migration" button in the toast

* feat: add Enter shortcut to Create-a-migration in the DDL guard

* fix(frontend): warn before running a newly-created datatable migration out of order

The row-level Run action warns when earlier migrations are still pending, but
the create-and-run paths ran a just-created migration with `only` directly,
applying it ahead of older pending migrations without that confirmation.

Reuse the same "Run migration out of order" confirmation across all
create-and-run paths via a shared helper (datatableMigrationUtils):
- NewDataTableMigrationModal "Create and run" (and the DDL guard path)
- DatatableSchemaDiff fork→parent merge
- dbOps schema ops (DB manager create/alter/drop) — the pure factory throws a
  MigrationRunCancelled sentinel on decline, which DBTableEditor treats as a
  silent cancel

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix: keep renamed datatable migrations visible in compare view

* fix: record per-migration deployment on datatable migrations disable

* fix(cli): run deployed datatable migrations after workspace merge

The merge command upserted datatable_migration definitions into the target
workspace and reported the item as successfully deployed, but never ran the
migrations. For forked datatables backed by separate databases, this left the
target schema unchanged until someone manually ran `wmill datatable migrate up`,
while the CLI reported a successful merge.

Collect the datatable migrations deployed (not deleted) into the target and,
after the deploy loop, offer to run them via the existing offerToRunNewMigrations
helper — the same post-deploy run prompt the push/sync path uses (interactive
only; `--yes`/non-TTY skip the mutating run, matching push behavior). Export
parseDatatableMigrationDeployPath so the merge path can parse the deployed items.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(backend): serialize datatable migration edits/deletes with the run lock

A migration run snapshots a migration's code_up from datatable_migrations and
only records its version in the data table's _wm_migrations after the job
succeeds. upsert_datatable_migration checked _wm_migrations before allowing an
edit but took no lock, so a concurrent edit could read "not applied yet",
rewrite code_up/code_down, and then the in-flight run would record the version
for the old SQL — leaving _wm_migrations pointing at SQL that was never applied
(migrate up then skips it; rollback runs a down that doesn't match).

Serialize definition rewrites and deletes with the same per-database advisory
lock the run/rollback paths use:
- Factor the connect+advisory-lock into lock_datatable_migration_runs and the
  applied-versions read into read_applied_versions_on_client.
- run_datatable_migrations now snapshots the definitions AFTER taking the lock,
  so code_up can't change between snapshot and version-record.
- upsert (when changing an existing def) and delete take the lock across the
  applied-check and the write; delete now rejects deleting an already-applied
  migration (would orphan its _wm_migrations record), symmetric with upsert.
  Both fail closed if the data table database is unreachable.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(frontend): stack the out-of-order migration confirm above the DB editor preview

Creating a table on a migrations-enabled data table opened the DB table editor's
"Confirm running the following" preview modal, whose confirm triggers applyDdl,
which then asks for out-of-order confirmation. Both are ConfirmationModals with a
hardcoded z-[9999]; the out-of-order one lives in DBManagerContent (mounted before
the editor), so it rendered behind the still-open preview modal.

Add an optional zIndexClass prop to ConfirmationModal (default z-[9999],
backward-compatible) and give the DB-manager out-of-order confirm z-[10000] so it
stacks on top.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(hub-projects): generate and apply datatable migrations for projects

Detect datatable assets in a project's scripts/flows/raw apps when
publishing to the Hub, generate a best-effort CREATE TABLE migration per
data table from the source workspace's live schema, and let the publisher
edit/toggle them in the bundle drawer. On import, offer to run the shipped
migrations: recorded (datatable_migrations + _wm_migrations) when the
target data table opted into migrations, otherwise as a one-off preview
job. Missing target data tables are surfaced and skipped.

- backend: POST /hub/migrations proxy forwarding to the Hub
- frontend publish: projectMigrations.ts detection + generation, new
  "Data table migrations" section in DeployToHub
- frontend import: run/skip modal + missing-datatable confirmation
- extract pure SQL-gen from DatatableSchemaDiff.svelte into
  datatableSchemaSql.ts so plain .ts modules can import it

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(hub-projects): close datatable migration table set over foreign keys

Pull a referenced table's FK targets into the generated migration
transitively, so it creates every table it references (ordered by FK
dependency), and drop any FK whose target still isn't in the set so the
generated SQL always runs.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(hub-projects): show Data table dependencies in the publish view

Detect data table usage off the predeploy bundle preview and surface it as
a "Data table dependencies" summary right after "Resource dependencies",
mirroring how resource types and triggers are shown. The editable
migration itself stays in the bundle drawer.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(hub-projects): explain un-generated migrations with SQL comments

When a table can't be found in the schema, a data table is referenced as a
whole, or the schema can't be loaded, write a `--` comment describing the
problem into the migration instead of leaving it blank. Partial migrations
keep the CREATE TABLEs that did generate and comment the rest; comment-only
migrations stay disabled. The bundle drawer now always shows the SQL box so
those comments are visible and editable.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(hub-projects): review/edit migrations on import + rollback down migration

Replace the plain "run migrations?" confirmation with a review drawer that
previews each runnable migration, lets the user edit the SQL and toggle
which to run, before the import proceeds. When recording an imported
migration, also record a down migration (DROP TABLE of the created tables,
in reverse order) derived from the up SQL, so it can be rolled back; the
derived rollback is previewed in both the publish bundle drawer and the
import review drawer.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* nit

* feat(hub-projects): editable Up/Down Monaco editor for migrations

Replace the plain textarea with a Monaco SQL editor split into Up/Down
tabs. The down migration is now generated once as best-effort (DROP TABLE
in reverse creation order) and is fully editable — no longer parsed back
out of the up SQL. The down is threaded through publish → Hub → import
(new project_migration.sql_down) and recorded as code_down when an imported
migration is applied.

- projectMigrations: GeneratedMigration.sql_down generated from the table set
- MigrationSqlEditor.svelte: shared Up/Down tabbed Monaco editor (re-keyed on
  regeneration since Monaco ignores external code changes)
- DeployToHub + install review drawer use it; sql_down pushed/applied
- backend: PublishMigrationBody carries sql_down

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(hub-projects): generate CREATE TABLE IF NOT EXISTS for project migrations

The FK closure pulls a referenced table's parents into the same transaction
(e.g. `orders` drags in `customers`); those shared parents often already
exist in the target, so a plain CREATE TABLE aborted the whole migration on
the first collision. Emit CREATE TABLE IF NOT EXISTS for project migrations
(via a new opt-in flag on generateMigrationSql, leaving the schema-diff
behavior unchanged) so a pre-existing parent is skipped instead of failing.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(hub-projects): key FK ordering by schema-qualified table name

orderByFkDependency keyed its dependency graph by bare table name (and
resolved FK targets with .split('.').pop()), so two same-named tables in
different schemas collapsed and one was dropped from the ordered set and
never created. Key by schema.table like the rest of the pipeline, resolving
FK targets through resolveTable. Also let resolveTable fall back to the bare
table name when a schema-qualified ref's schema doesn't match.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(hub-projects): comment out generated down-migration DROP statements

The generated down migration listed DROP TABLE for every table in the FK
closure, including shared parent tables that may have pre-existed in the
target — a rollback could drop a table the project never created (data
loss). Emit all DROP statements commented out with a note, so nothing is
dropped by default; the publisher uncomments the tables this migration
actually owns.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(hub-projects): disable Import button during migration review

planMigrations awaits the review / missing-datatable modals before setting
installing = true, so the Import button stayed enabled during review and a
second click launched a concurrent install() (second review drawer,
duplicated item creation). Track a planningMigrations flag, disable the
button on it, and early-return install() if already installing or planning.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(hub-projects): toast when migration generation fails

regenerateMigrations cleared the drafts on error, showing "No data table
usage detected" — indistinguishable from a genuine schema-load failure. Add
a toast on the catch so the publisher can tell the two apart.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(hub-projects): honor cancel on the missing-data-table warning

planMigrations awaited missingDatatableModal.ask() but ignored its boolean,
so cancelling the "some data tables are missing" warning still proceeded
with the import — the cancel affordance did nothing. Show the warning first
and abort the whole import when the user cancels (planMigrations returns
null; install() early-returns), so they can create the data table(s) and
re-run. Confirming still imports without the missing migrations.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(hub-projects): detect data tables from low-code app DB-table config

Low-code apps don't carry a persisted asset list, but the DB-table
component declares its data table and table explicitly: a `oneOf` `type`
config with `selected === 'datatable'` holding `datatable://<name>` and the
table. Walk the app value for those configs so an app that reads a data
table is picked up by the Data table dependencies detection.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Revert "feat(hub-projects): detect data tables from low-code app DB-table config"

This reverts commit 9c43ebd5126276e9b436b5f7d2d9d94683b999e1.

* fix(hub-projects): detect data tables from full-code apps' declaration

Full-code (raw) apps explicitly declare the data tables/tables they use in
value.data.tables (refs like main/customers or main/schema:table), which the
"Data table dependencies" detection missed — it only looked at inline-script
assets. Read the declaration via extractDataConfig/parseDataTableRef. The
bundler previously dropped value.data (kept only files + runnables); include
it so detection sees it and the imported app keeps its declaration, and pass
it through on import.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(hub-projects): recompute app policy on project import

Apps imported from a Hub project were created with an empty triggerables_v2
policy, so running any inline component script failed at runtime with
"Path rawscript/<sha> forbidden by policy". The policy is computed client-side
on deploy and stored verbatim by the backend, and import skipped that step;
retargeting also rewrites inline-script content (changing its sha), so a copied
policy would not match either.

Recompute the policy from the retargeted value at import, mirroring the deploy
path: updatePolicy for grid apps, updateRawAppPolicy for raw apps, defaulting
execution_mode to publisher.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* nit fix

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(hub-projects): retarget plain trigger resource paths on import

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(hub-projects): reset migration drafts on workspace/folder switch

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(hub-projects): bundle http auth resources, pin drafts during deploy

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(hub-projects): make generated data table migrations idempotent

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Reapply "feat(hub-projects): detect data tables from low-code app DB-table config"

This reverts commit 112844deea5441c63a6f0553b129a9f6ebea543e.

* fix(hub-projects): create all tables before FK constraints in migrations

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(hub-projects): reset install state when the hub slug or workspace changes

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Revert "Reapply "feat(hub-projects): detect data tables from low-code app DB-table config""

This reverts commit 14abefb4f6912f4be77ca89832856434e4f34359.

* fix: dedupe args state duplicated by main merge in AssetGraphDetailsPane

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* refactor(deploy-to-hub): extract session class keyed by workspace+folder

All DeployToHub state and async operations move into DeployToHubSession
(deployToHubSession.svelte.ts), an immutable-(workspace, folder) state class.
A workspace/folder change replaces the instance and remounts the UI via
{#key} instead of manually resetting ~20 state vars, and in-flight async
work writes to the discarded object instead of racing the new scope. The
workspace-scoped seq counters (workspaceLoadSeq/triggerLoadSeq for
lifecycle, migrationsSeq) collapse into a dispose flag plus intra-session
tokens only.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WqqWYQR46tcunvPVRfidZS

* refactor(triggers): single shared module for all-kind workspace trigger listing

TRIGGER_KINDS (badge/route/note/resourceField/eeOnly + list call),
listAllWorkspaceTriggers, triggerResourcePath, stripTriggerConfig and
triggerDetails move to $lib/components/triggers/workspaceTriggersList.ts, so
EE-license gating per trigger kind is declared once instead of being re-decided
at each call site. DeployToHubSession consumes it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WqqWYQR46tcunvPVRfidZS

* refactor(hub-publish): route every endpoint through one validation choke point

HubPublishCtx (a FromRequestParts extractor) is now the only way a handler
reaches the Hub: it performs the admin check, resolves and validates the
workspace:folder source key, and carries the forwarded token — a new endpoint
cannot skip any of it. Project slugs become a ProjectSlug newtype whose only
constructor is validating deserialization (body field or path segment), so
every slug that reaches a Hub URL or payload is valid by construction; the
previously unvalidated slugs in publish_draft/scripts/flows/apps/raw_apps/
embed/recording bodies are now checked too.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018DoHaGJdACgE7RvknRDAb6

* refactor(hub-projects): shared bundle format module + per-kind project installer

The Hub export format (types + retargetProjectExport/buildRetargetMap) moves
into projectBundle.ts so publish and install share one definition, with unit
tests for retargeting. projectInstall.ts owns the import: one importer per
item kind with per-item error capture, and trigger creation goes through
createWorkspaceTriggerDisabled in the shared trigger module, which encodes
the per-kind disable semantics (schedules use enabled:false, everything else
mode:'disabled') and EE gating once. The install page shrinks to
orchestration and UI.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018DoHaGJdACgE7RvknRDAb6

* fix(hub-projects): AMQP kind, trigger handler bundling, import containment

Review-round fixes: register the AMQP trigger kind (CE) in the shared
registry so it lists/bundles/imports like every other kind; stop stripping
error_handler_path/args from trigger configs and bundle + relocate handler
runnables (including schedules' script|flow-prefixed on_* refs) with the
project; resolve full schedule rows on listing (listSchedules is slim) and
spread the exported config on import so cron_version, retry, handlers and
no_flow_overlap survive; refuse per-item any export path that escapes the
selected f/<folder>/ target; and gate the install page's results/done
writes on the load sequence so a stale import can't mark a newly loaded
project as imported.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018DoHaGJdACgE7RvknRDAb6

* fix(hub-projects): schedule config hygiene and complete handler bundling

Strip email/is_draft/paused_until from exported trigger configs (the full
schedule row carries owner and runtime state that must not reach the Hub);
bundle and relocate dynamic_skip handler scripts (schedule creation refuses a
missing one, so an unrelocated path breaks the import); exclude and report a
schedule whose detail fetch fails instead of silently exporting the slim row
with default behavior; and seed migration detection with the same
handler-augmented item set as deployment so data tables used only by bundled
handlers get their migrations.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018DoHaGJdACgE7RvknRDAb6

* fix(deploy-to-hub): single guarded publish path, gated on trigger load

publishBundle() owns draft creation + deployment under one synchronously-set
deploying flag, so a double-click can't start two interleaved publishes, and
it refuses to run while triggers are still loading — snapshotting an
incomplete relevantTriggers list would permanently omit triggers, their
handlers and handler-only migrations from the draft. The bundle CTAs disable
while trigger discovery is in flight.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018DoHaGJdACgE7RvknRDAb6

* fix(hub-projects): block publish on failed trigger discovery, strict schema-qualified table resolution

listAllWorkspaceTriggers now distinguishes a feature-gated 404 (kind not
compiled into the instance — legitimately empty) from a real listing or
detail-fetch failure: failures are surfaced, recorded per kind, and the
session blocks publishing with a visible retry until discovery completes
cleanly, so an incomplete trigger snapshot can't be bundled silently.
resolveTable no longer falls back to a same-named table in another schema
when a qualified ref misses — that generated a migration for an unrelated
table; the miss now produces the existing commented warning instead.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018DoHaGJdACgE7RvknRDAb6

* docs(openapi): document the 15 hub publish proxy routes

All /w/{workspace}/hub endpoints (draft/items/recordings/resource
types/resources/triggers/migrations/export/submit/by-source) enter the
public API contract with their body schemas derived from the serde structs,
a shared HubProjectSlug schema encoding the slug validation, and passthrough
text responses matching the proxy behavior.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018DoHaGJdACgE7RvknRDAb6

* fix(hub-projects): bundle $res refs nested in trigger configs, nullable trigger payload fields

Trigger dependency collection now scans the full stripped config for
$res:/res:// tokens (schedule args, on_*_extra_args, error_handler_args —
e.g. the built-in Slack handler's channel resource) in addition to the
kind-specific resource field, so those resources enter the bundle path map,
get relocated by rewriteTriggerConfig, export a typed stub, and show up in
the dependency pane. PublishTriggerBody's summary/description/
script_ask_id/flow_id become nullable in the OpenAPI contract, matching
what the publisher actually sends and the Rust Options accept.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018DoHaGJdACgE7RvknRDAb6

* fix(hub-projects): flow preprocessor/env refs, no cloud provisioning on import, config containment

Flow extraction and rewriting now cover preprocessor_module (walked like any
other module) and flow_env $res: values, so those dependencies are bundled
and relocated instead of keeping source-workspace paths. GCP/Azure triggers
are refused at import with an actionable message — their create endpoints
manage cloud subscriptions before storing the trigger, even disabled, so
auto-creating them from an import could mutate external infrastructure. The
import containment guard now also validates everything a trigger config
binds to (kind resource field, handler runnables incl. hub/ refs, nested
$res: tokens), closing the path where a crafted export binds a trigger to
assets outside the chosen folder.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018DoHaGJdACgE7RvknRDAb6

* refactor(hub-projects): per-kind config allowlists from a full trigger-field audit

Every trigger kind's boundary-crossing config is now an explicit per-kind
allowlist (configFields in TRIGGER_KINDS), derived from a field-by-field
audit of every create type: portableTriggerConfig replaces the blocklist
and is applied on export AND import, so an upstream field addition is
dropped until consciously admitted (no more email-style leaks) and a
crafted export can't inject fields like permissioned_as into create calls.
The audit also surfaced unbundled websocket runnables — $script:/$flow:
URLs and initial-message runnable_result paths are now collected and
relocated — and drops GCP/Azure provisioned identities (subscription ids,
delivery_config with the source instance's endpoint) from exports.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018DoHaGJdACgE7RvknRDAb6

* fix(hub-projects): bundle $res refs nested in JSON flow_env values

The worker resolves $res: references inside nested JSON flow_env values
(transform_json walks the full value), so extraction and rewriting now scan
the env's full serialization instead of only top-level strings. Also: the
install-page Enterprise note includes GCP/Azure, the trigger-discovery Retry
button binds to the loading state so clicks can't stack requests, and
extractTriggerConfigResourceRefs no longer splits rewriteTriggerConfig from
its doc comment.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018DoHaGJdACgE7RvknRDAb6

* fix(hub-projects): scope $script:/$flow: relocation to the websocket url field

The runnable-url form is only meaningful in that one field; remapping it on
every nested config string could corrupt a literal payload that happens to
look like one (e.g. a websocket initial raw_message).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018DoHaGJdACgE7RvknRDAb6

* fix(hub-projects): nested static-transform refs, shared flow walk for migrations, top-level-only url remap

Static input transforms accept arbitrary JSON and the worker resolves $res:
refs nested inside them — extraction and rewriting now scan the full
serialization, preserving the value's type. projectMigrations reuses
projectBundle's allFlowModules instead of carrying its own module walk, so
the preprocessor module (and any future module class) can't diverge between
bundling and migration detection. The websocket $script:/$flow: url remap
applies only at the config's top level, leaving nested url keys in args or
handler payloads untouched. Schedule tag stays excluded by design (a
source instance's worker-group name; a foreign tag queues jobs forever) —
now documented in the allowlist contract.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018DoHaGJdACgE7RvknRDAb6

* fix(hub-projects): remap prefixed runnable refs only in their known config fields

script/<path> and flow/<path> forms are now rewritten only in the top-level
schedule handler fields (on_failure/on_recovery/on_success), joining the url
field treatment — shape-based remapping on arbitrary strings could rewrite a
literal payload that merely looked like a handler ref. Bare-path exact
matches and $res: tokens remain position-independent.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018DoHaGJdACgE7RvknRDAb6

* fix(hub-projects): abort stale-session imports after review, walk failure-module descendants

Confirming a migration review whose project/workspace was switched away from
now aborts with a toast before any write — previously the writes went to the
old workspace with all feedback suppressed by the session guard. And
allFlowModules puts the failure module in the root list so its nested
children (loops/branches inside a failure handler) are expanded like every
other module, for both bundling and migration detection.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018DoHaGJdACgE7RvknRDAb6

* fix(hub-projects): preserve app share state on Hub draft rehydration

`rehydrateFromHub()` rebuilt `draftItems` from the Hub project payload, which
carries only draft membership, so it dropped each app's `published`/`publicUrl`
and app-table origin. Outside `predeploy` the UI reads `draftItems` exclusively,
so reopening a draft showed a still-public app as unshared and removed its
Unpublish control. Merge the live workspace-item state onto matching drafts after
both `#loadWorkspace` and `rehydrateFromHub` (they race).

Also gate the Share-as-iframe action on `canShareAsIframe`: legacy raw apps live
only in the `raw_app` table, but that flow drives `AppService` (the `app` table)
and fails with "App not found" for them, so the action is now hidden for legacy
entries.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(hub-projects): stale-identity import guard, live publish state on drafts, iframe action gating

The install session check now also compares the live slug and workspace to
the captured ones — loadSeq only advances when a new load starts, so
navigating away (workspace or ?hub becoming empty) previously left the
stale migration review able to import into the captured workspace. Draft
items are decorated with the live workspace item's shared-iframe fields
(published/publicUrl/appTable) so a public app still shows as public after
reopening a draft, settling reactively regardless of load order. The
share-as-iframe action is offered only for apps and app-table raw apps —
legacy raw_app entries have no AppService representation and the action
could only fail.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018DoHaGJdACgE7RvknRDAb6

* refactor(deploy-to-hub): drive share-state merge from one reactive derived

The rebase left two parallel fixes for the same rehydration gap: an
imperative mergeShareState call after each racing load, and a read-time
derived. Keep the pure, tested mergeShareState as the single implementation
and invoke it from the derived — no load-completion call sites to maintain,
and the merge settles whichever load finishes last.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018DoHaGJdACgE7RvknRDAb6

* fix(hub-projects): block publish on unresolved refs; contain imported item refs

Address two Codex findings:

- Publish continued after `buildProjectBundle` reported unresolved references
  (a selected root or transitive runnable that failed to fetch, or a resource
  with no resolvable type), shipping a project whose items silently vanished or
  still pointed at the publisher's private source-workspace path. `#deployAll`
  now aborts before any Hub write when the bundle doesn't close, and the bundle
  drawer surfaces the unresolved list and disables "Create bundle".

- `installProject` validated only each item's own path, so a crafted or
  incomplete export could place a script/flow/app inside the target folder while
  its `$res:`/script/flow reference stayed bound to an existing `u/...` or other
  `f/...` asset. Extract each item's live references and reject any that escape
  `f/<folder>/` (hub/ script refs allowed), mirroring the existing trigger-config
  containment check.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(hub-projects): contain imported $var refs; dedupe unresolved list

Follow-up to the publish-blocker and import-containment fixes:

- `$var:` references (flow static inputs, flow_env, app values, and trigger
  config fields such as SQS queue_url) were not caught by the containment check,
  which only recognized `$res:`/runnable refs. Retargeting leaves them unchanged,
  so an export with `$var:u/admin/token` imported an item that resolves a
  variable outside the target folder under the runnable's permissions. Scan each
  imported flow/app/trigger for `$var:` tokens and reject out-of-folder ones.
  Scripts are skipped: `$var:` is resolved in job args, not script source.

- `buildProjectBundle` stored bare paths in `unresolved` while keying missing
  items by kind:path, so a script and flow sharing a missing path produced a
  duplicate string. The new keyed unresolved list in the bundle drawer then hit
  Svelte's duplicate-key runtime error instead of rendering the publish blocker.
  Dedupe `unresolved` at the source.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(hub-projects): contain $var/$jsonvar imports; retryable partial publish; iframe rollback

Address four Codex findings:

- `$jsonvar:` (secret JSON args) was not contained on import, and scanning the
  serialized flow/app for `$var:` tokens falsely rejected inline-code literals.
  The worker only substitutes a variable when an argument value *is* the
  reference (whole value, walking nested JSON), never a token embedded in code.
  Replace the token scan with a structural whole-value walk (`$var:`/`$jsonvar:`)
  and reject out-of-folder refs in flows, apps, and trigger config. Scripts carry
  no variable args, so they are skipped.

- A partial publish (failed item/trigger/migration write) still transitioned to
  the submit-ready `draft` phase. Stay in the retryable `predeploy` state on any
  failure, keeping the failed items visible, so nothing incomplete can be
  submitted and re-publishing retries every idempotent write.

- `#setAppShared` flipped a raw app public before checking its Hub item id or
  syncing the embed, so a missing id or a failed embed sync left the app publicly
  accessible while reporting failure. Validate the Hub target up front and roll
  the policy back if the embed sync fails.

- `buildProjectBundle` could emit duplicate unresolved paths (a script and flow
  sharing a missing path), breaking the keyed publish-blocker render. Deduped.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(hub-projects): full-set trigger sync; count iframe re-sync + URL failures

Address three Codex findings, two of them refinements of the incomplete-publish
gate and iframe-rollback fixes:

- `#pushTriggers` returned early on an empty set, so re-deploying a project after
  removing all its triggers left the previous Hub triggers intact. Always post the
  trigger list (an empty one clears them), mirroring the migrations full-set sync.

- A raw app's post-deploy iframe re-sync failure only toasted; it now increments
  `failures`, so a public app left with a stale embed keeps the draft out of the
  submit-ready phase.

- `#setAppShared` skipped the embed and still returned success when the public URL
  couldn't be resolved, leaving the app anonymous with no usable link. It now rolls
  the policy back and throws when a share has no resolvable URL, alongside the
  existing embed-failure rollback (factored into one helper).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(hub-projects): count URL-less iframe re-sync; evict failed preview caches

Two Codex findings, both refinements of earlier fixes:

- The post-deploy iframe re-sync skipped a published raw app whose public URL was
  missing (URL resolution had failed) without counting it, so the re-bundle left
  the app public with a cleared Hub embed yet the draft still became submit-ready.
  Treat a published raw app with no resolvable URL as an incomplete publish and
  count it like a push failure.

- The bundle-preview dependency caches memoized promises that resolve to undefined
  after transient item/resource fetch failures, so fixing or retrying a dependency
  could never clear `bundlePreview.unresolved` and the Create bundle button stayed
  disabled until the session was recreated. Evict a cache entry once it resolves to
  undefined so a later rebuild re-fetches.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(hub-projects): keep Unpublish for a public app whose URL didn't resolve

The iframe controls required both `published` and `publicUrl`, so an anonymous app
whose public-URL lookup failed rendered as unshared with only a Share action and no
way to unpublish. Branch the Public badge and Unpublish on `published` alone, gate
the URL-dependent Open/Copy-iframe actions on `publicUrl`, and offer a Retry link
that re-resolves the URL when it is missing.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(hub-projects): make $var/$jsonvar dependencies portable on import

Variable references were neither retargeted nor materialized, so a published
project that used a variable broke on import: a renamed-folder import rejected the
containing item (the `$var:` kept the old folder prefix), and a same-folder import
left the reference dangling (the target variable never existed).

Treat variables like resource stubs, fully on the import side (their `$var:`/
`$jsonvar:` refs already travel inside the exported item values):

- `buildRetargetMap` now also relocates the internal variable paths embedded in
  the export's flows/apps/triggers, and `rewriteContent` rewrites `$var:`/
  `$jsonvar:` tokens (kind preserved) for any path in the map — so the publish map,
  which omits variables, is unaffected.
- `installProject` creates an empty secret placeholder for each in-folder variable
  ref, conflict-safe via `existsVariable`, for the importer to fill. Values are
  never shipped. External refs stay rejected by containment.

Custom resource-type definitions (the sibling finding) are intentionally left to
the standardized official Hub resource types, so no schema import is needed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(hub-projects): relocate $var refs structurally, never in inline code

Routing variable retargeting through `rewriteContent` also rewrote `$var:`/
`$jsonvar:` tokens embedded in script source, inline rawscript, and serialized app
strings, so an inert literal sharing a real variable's path was silently altered on
a renamed-folder import — contradicting the whole-string runtime-reference rule.

Relocate variables with a structural walk (`rewriteVarRefsInValue`) that rewrites
only whole-string `$var:`/`$jsonvar:` values (the sole form the worker resolves),
applied to flow/app/trigger values in `retargetProjectExport`; `rewriteContent` is
back to `$res:`-only. Inline code literals are left untouched.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(hub-projects): relocate $var refs into the slug at publish

Import-side retargeting assumed exported `$var:`/`$jsonvar:` refs already began with
the project slug, but `buildProjectBundle` never relocated them from the source
folder. Publishing `f/source_folder/...` as slug `my-toolkit` therefore exported
`$var:f/source_folder/key`; import (fromSlug=my-toolkit) left it unchanged and
containment rejected the item.

Collect each item's runtime variable refs, feed them through the same path map that
relocates items/resources into `f/<slug>/`, and structurally rewrite the whole-value
refs — symmetric with the import retarget. The export is now slug-relative whatever
the source folder, and inline-code literals stay untouched.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(hub-projects): relocate trigger config $var refs at publish

Item variable refs were relocated into the slug, but triggers publish through a
separate path (`#pushTriggers` → `rewriteTriggerConfig`), which doesn't touch
`$var:`/`$jsonvar:`. Publishing `f/source/...` under a different Hub slug left
schedule args and other config refs pointing at `f/source/...`, and import
containment then rejected the trigger.

Collect each trigger config's whole-string variable refs (`#triggerVarPaths`), feed
them through the bundle path map via a new `extraVarPaths` arg to
`buildProjectBundle`, and structurally rewrite the config on publish. Symmetric with
the item and import-side handling; the import retarget already relocated trigger vars.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* docs(hub-projects): correct varContainmentViolation retargeting contract

The comment claimed retargeting doesn't rewrite variable refs; it now relocates a
project's own refs into the target folder, and containment rejects only those left
outside it. Describe the current behavior.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Co-authored-by: hugocasa <hugo@casademont.ch>
Co-authored-by: centdix <40307056+centdix@users.noreply.github.com>
Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>
Co-authored-by: Aldrin Jenson <aldrinjenson@gmail.com>
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: centdix <centdix@users.noreply.github.com>
Co-authored-by: Alexander Petric <alpetric@users.noreply.github.com>
Co-authored-by: Diego Imbert <70353967+diegoimbert@users.noreply.github.com>
Co-authored-by: Guilhem <guilhemlemouel@gmail.com>
Co-authored-by: Diego Imbert <diego@windmill.dev>
---
 backend/windmill-api/openapi.yaml             |  715 +++++++
 backend/windmill-api/src/hub_publish.rs       |  521 ++++++
 backend/windmill-api/src/lib.rs               |    2 +
 .../lib/components/DatatableSchemaDiff.svelte |  198 +-
 .../components/WorkspaceDeployLayout.svelte   |   39 +-
 .../AssetGraph/AssetGraphDetailsPane.svelte   |    4 +
 .../src/lib/components/datatableSchemaSql.ts  |  220 +++
 .../components/sidebar/SidebarContent.svelte  |    8 +-
 .../triggers/workspaceTriggersList.test.ts    |  113 ++
 .../triggers/workspaceTriggersList.ts         |  562 ++++++
 .../workspaceSettings/DeployToHub.svelte      | 1031 +++++++++++
 .../MigrationSqlEditor.svelte                 |   40 +
 .../deployToHubSession.svelte.ts              | 1635 +++++++++++++++++
 .../deployToHubSession.test.ts                |   54 +
 .../workspaceSettings/projectBundle.test.ts   |  869 +++++++++
 .../workspaceSettings/projectBundle.ts        |  652 +++++++
 .../workspaceSettings/projectInstall.test.ts  |   78 +
 .../workspaceSettings/projectInstall.ts       |  405 ++++
 .../projectMigrations.test.ts                 |  372 ++++
 .../workspaceSettings/projectMigrations.ts    |  345 ++++
 .../(root)/(logged)/folders/+page.svelte      |   30 +-
 .../(logged)/projects/install/+page.svelte    |  374 ++++
 22 files changed, 8057 insertions(+), 210 deletions(-)
 create mode 100644 backend/windmill-api/src/hub_publish.rs
 create mode 100644 frontend/src/lib/components/datatableSchemaSql.ts
 create mode 100644 frontend/src/lib/components/triggers/workspaceTriggersList.test.ts
 create mode 100644 frontend/src/lib/components/triggers/workspaceTriggersList.ts
 create mode 100644 frontend/src/lib/components/workspaceSettings/DeployToHub.svelte
 create mode 100644 frontend/src/lib/components/workspaceSettings/MigrationSqlEditor.svelte
 create mode 100644 frontend/src/lib/components/workspaceSettings/deployToHubSession.svelte.ts
 create mode 100644 frontend/src/lib/components/workspaceSettings/deployToHubSession.test.ts
 create mode 100644 frontend/src/lib/components/workspaceSettings/projectBundle.test.ts
 create mode 100644 frontend/src/lib/components/workspaceSettings/projectBundle.ts
 create mode 100644 frontend/src/lib/components/workspaceSettings/projectInstall.test.ts
 create mode 100644 frontend/src/lib/components/workspaceSettings/projectInstall.ts
 create mode 100644 frontend/src/lib/components/workspaceSettings/projectMigrations.test.ts
 create mode 100644 frontend/src/lib/components/workspaceSettings/projectMigrations.ts
 create mode 100644 frontend/src/routes/(root)/(logged)/projects/install/+page.svelte

diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 14183609af..d3e1661fde 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -22895,6 +22895,438 @@ paths:
               schema:
                 type: string
 
+  /w/{workspace}/hub/publish_draft:
+    post:
+      summary: create or update a hub project draft
+      description: |
+        Requires the caller to be a workspace admin. Forwards the request to the
+        configured Hub scoped to the `{workspace}:{folder}` source and returns
+        the Hub's status code and raw response body.
+      operationId: publishHubDraft
+      tags:
+        - hubPublish
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - $ref: "#/components/parameters/HubPublishFolder"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/PublishDraftBody"
+      responses:
+        "200":
+          description: raw Hub response body (status code is passed through from the Hub)
+          content:
+            text/plain:
+              schema:
+                type: string
+
+  /w/{workspace}/hub/scripts:
+    post:
+      summary: publish a script to a hub project
+      description: |
+        Requires the caller to be a workspace admin. Forwards the request to the
+        configured Hub scoped to the `{workspace}:{folder}` source and returns
+        the Hub's status code and raw response body.
+      operationId: publishHubScript
+      tags:
+        - hubPublish
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - $ref: "#/components/parameters/HubPublishFolder"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/PublishScriptBody"
+      responses:
+        "200":
+          description: raw Hub response body (status code is passed through from the Hub)
+          content:
+            text/plain:
+              schema:
+                type: string
+
+  /w/{workspace}/hub/flows:
+    post:
+      summary: publish a flow to a hub project
+      description: |
+        Requires the caller to be a workspace admin. Forwards the request to the
+        configured Hub scoped to the `{workspace}:{folder}` source and returns
+        the Hub's status code and raw response body.
+      operationId: publishHubFlow
+      tags:
+        - hubPublish
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - $ref: "#/components/parameters/HubPublishFolder"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/PublishFlowBody"
+      responses:
+        "200":
+          description: raw Hub response body (status code is passed through from the Hub)
+          content:
+            text/plain:
+              schema:
+                type: string
+
+  /w/{workspace}/hub/apps:
+    post:
+      summary: publish an app to a hub project
+      description: |
+        Requires the caller to be a workspace admin. Forwards the request to the
+        configured Hub scoped to the `{workspace}:{folder}` source and returns
+        the Hub's status code and raw response body.
+      operationId: publishHubApp
+      tags:
+        - hubPublish
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - $ref: "#/components/parameters/HubPublishFolder"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/PublishAppBody"
+      responses:
+        "200":
+          description: raw Hub response body (status code is passed through from the Hub)
+          content:
+            text/plain:
+              schema:
+                type: string
+
+  /w/{workspace}/hub/raw_apps:
+    post:
+      summary: publish a raw app to a hub project
+      description: |
+        Requires the caller to be a workspace admin. Forwards the request to the
+        configured Hub scoped to the `{workspace}:{folder}` source and returns
+        the Hub's status code and raw response body.
+      operationId: publishHubRawApp
+      tags:
+        - hubPublish
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - $ref: "#/components/parameters/HubPublishFolder"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/PublishRawAppBody"
+      responses:
+        "200":
+          description: raw Hub response body (status code is passed through from the Hub)
+          content:
+            text/plain:
+              schema:
+                type: string
+
+  /w/{workspace}/hub/raw_apps/{id}/embed:
+    post:
+      summary: set or clear the embed url of a hub raw app
+      description: |
+        Requires the caller to be a workspace admin. Forwards the request to the
+        configured Hub scoped to the `{workspace}:{folder}` source and returns
+        the Hub's status code and raw response body.
+      operationId: publishHubRawAppEmbed
+      tags:
+        - hubPublish
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - name: id
+          in: path
+          required: true
+          description: hub id of the raw app
+          schema:
+            type: integer
+            format: int64
+        - $ref: "#/components/parameters/HubPublishFolder"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/RawAppEmbedBody"
+      responses:
+        "200":
+          description: raw Hub response body (status code is passed through from the Hub)
+          content:
+            text/plain:
+              schema:
+                type: string
+
+  /w/{workspace}/hub/scripts/{ask_id}/recording:
+    post:
+      summary: attach a recording to a hub script
+      description: |
+        Requires the caller to be a workspace admin. Forwards the request to the
+        configured Hub scoped to the `{workspace}:{folder}` source and returns
+        the Hub's status code and raw response body.
+      operationId: publishHubScriptRecording
+      tags:
+        - hubPublish
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - name: ask_id
+          in: path
+          required: true
+          description: hub ask id of the script
+          schema:
+            type: integer
+            format: int64
+        - $ref: "#/components/parameters/HubPublishFolder"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/RecordingBody"
+      responses:
+        "200":
+          description: raw Hub response body (status code is passed through from the Hub)
+          content:
+            text/plain:
+              schema:
+                type: string
+
+  /w/{workspace}/hub/flows/{flow_id}/recording:
+    post:
+      summary: attach a recording to a hub flow
+      description: |
+        Requires the caller to be a workspace admin. Forwards the request to the
+        configured Hub scoped to the `{workspace}:{folder}` source and returns
+        the Hub's status code and raw response body.
+      operationId: publishHubFlowRecording
+      tags:
+        - hubPublish
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - name: flow_id
+          in: path
+          required: true
+          description: hub id of the flow
+          schema:
+            type: integer
+            format: int64
+        - $ref: "#/components/parameters/HubPublishFolder"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/RecordingBody"
+      responses:
+        "200":
+          description: raw Hub response body (status code is passed through from the Hub)
+          content:
+            text/plain:
+              schema:
+                type: string
+
+  /w/{workspace}/hub/resource_types:
+    post:
+      summary: publish a resource type to a hub project
+      description: |
+        Requires the caller to be a workspace admin. Forwards the request to the
+        configured Hub scoped to the `{workspace}:{folder}` source and returns
+        the Hub's status code and raw response body.
+      operationId: publishHubResourceType
+      tags:
+        - hubPublish
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - $ref: "#/components/parameters/HubPublishFolder"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/PublishResourceTypeBody"
+      responses:
+        "200":
+          description: raw Hub response body (status code is passed through from the Hub)
+          content:
+            text/plain:
+              schema:
+                type: string
+
+  /w/{workspace}/hub/resources:
+    post:
+      summary: publish resource placeholders to a hub project
+      description: |
+        Requires the caller to be a workspace admin. Forwards the request to the
+        configured Hub scoped to the `{workspace}:{folder}` source and returns
+        the Hub's status code and raw response body.
+      operationId: publishHubResources
+      tags:
+        - hubPublish
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - $ref: "#/components/parameters/HubPublishFolder"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/PublishResourcesBody"
+      responses:
+        "200":
+          description: raw Hub response body (status code is passed through from the Hub)
+          content:
+            text/plain:
+              schema:
+                type: string
+
+  /w/{workspace}/hub/triggers:
+    post:
+      summary: publish triggers to a hub project
+      description: |
+        Requires the caller to be a workspace admin. Forwards the request to the
+        configured Hub scoped to the `{workspace}:{folder}` source and returns
+        the Hub's status code and raw response body.
+      operationId: publishHubTriggers
+      tags:
+        - hubPublish
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - $ref: "#/components/parameters/HubPublishFolder"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/PublishTriggersBody"
+      responses:
+        "200":
+          description: raw Hub response body (status code is passed through from the Hub)
+          content:
+            text/plain:
+              schema:
+                type: string
+
+  /w/{workspace}/hub/migrations:
+    post:
+      summary: publish data table migrations to a hub project
+      description: |
+        Requires the caller to be a workspace admin. Forwards the request to the
+        configured Hub scoped to the `{workspace}:{folder}` source and returns
+        the Hub's status code and raw response body.
+      operationId: publishHubMigrations
+      tags:
+        - hubPublish
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - $ref: "#/components/parameters/HubPublishFolder"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/PublishMigrationsBody"
+      responses:
+        "200":
+          description: raw Hub response body (status code is passed through from the Hub)
+          content:
+            text/plain:
+              schema:
+                type: string
+
+  /w/{workspace}/hub/projects/{slug}/export:
+    get:
+      summary: export a hub project
+      description: |
+        Requires the caller to be a workspace admin. Forwards the request to the
+        configured Hub and returns the Hub's status code and raw response body.
+        The folder scope is only needed to re-export the caller's own draft;
+        approved projects are public, so it is optional here.
+      operationId: getHubProjectExport
+      tags:
+        - hubPublish
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - name: slug
+          in: path
+          required: true
+          description: hub project slug (3-50 chars, lowercase alphanumeric and hyphens, no leading/trailing hyphen)
+          schema:
+            type: string
+            minLength: 3
+            maxLength: 50
+            pattern: "^[a-z0-9][a-z0-9-]*[a-z0-9]$"
+        - name: folder
+          in: query
+          required: false
+          description: folder scoping the Hub project source (`{workspace}:{folder}`)
+          schema:
+            type: string
+      responses:
+        "200":
+          description: raw Hub response body (status code is passed through from the Hub)
+          content:
+            text/plain:
+              schema:
+                type: string
+
+  /w/{workspace}/hub/projects/{slug}/submit:
+    post:
+      summary: submit a hub project draft for review
+      description: |
+        Requires the caller to be a workspace admin. Forwards the request to the
+        configured Hub scoped to the `{workspace}:{folder}` source and returns
+        the Hub's status code and raw response body.
+      operationId: submitHubProject
+      tags:
+        - hubPublish
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - name: slug
+          in: path
+          required: true
+          description: hub project slug (3-50 chars, lowercase alphanumeric and hyphens, no leading/trailing hyphen)
+          schema:
+            type: string
+            minLength: 3
+            maxLength: 50
+            pattern: "^[a-z0-9][a-z0-9-]*[a-z0-9]$"
+        - $ref: "#/components/parameters/HubPublishFolder"
+      responses:
+        "200":
+          description: raw Hub response body (status code is passed through from the Hub)
+          content:
+            text/plain:
+              schema:
+                type: string
+
+  /w/{workspace}/hub/project:
+    get:
+      summary: get the hub project linked to a workspace folder
+      description: |
+        Requires the caller to be a workspace admin. Forwards the request to the
+        configured Hub scoped to the `{workspace}:{folder}` source and returns
+        the Hub's status code and raw response body.
+      operationId: getHubProjectBySource
+      tags:
+        - hubPublish
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - $ref: "#/components/parameters/HubPublishFolder"
+      responses:
+        "200":
+          description: raw Hub response body (status code is passed through from the Hub)
+          content:
+            text/plain:
+              schema:
+                type: string
+
 components:
   securitySchemes:
     bearerAuth:
@@ -22943,6 +23375,16 @@ components:
       required: true
       schema:
         type: string
+    HubPublishFolder:
+      name: folder
+      in: query
+      required: true
+      description: |
+        workspace folder scoping the Hub publication: a workspace can publish
+        one Hub project per folder and the Hub-side source key is
+        `{workspace}:{folder}`
+      schema:
+        type: string
     PublicationName:
       name: publication
       in: path
@@ -31839,3 +32281,276 @@ components:
         - name
         - owner
         - private
+
+    HubProjectSlug:
+      type: string
+      description: hub project slug (3-50 chars, lowercase alphanumeric and hyphens, no leading/trailing hyphen)
+      minLength: 3
+      maxLength: 50
+      pattern: "^[a-z0-9][a-z0-9-]*[a-z0-9]$"
+
+    PublishDraftBody:
+      type: object
+      properties:
+        slug:
+          $ref: "#/components/schemas/HubProjectSlug"
+        name:
+          type: string
+        summary:
+          type: string
+        readme:
+          type: string
+      required:
+        - slug
+        - name
+        - summary
+
+    PublishScriptBody:
+      type: object
+      properties:
+        summary:
+          type: string
+        app:
+          type: string
+        description:
+          type: string
+        kind:
+          type: string
+        content:
+          type: string
+        language:
+          type: string
+        schema:
+          type: object
+        lockfile:
+          type: string
+        path:
+          type: string
+        source_path:
+          type: string
+        project_slug:
+          $ref: "#/components/schemas/HubProjectSlug"
+      required:
+        - summary
+        - app
+        - content
+        - language
+        - project_slug
+
+    PublishFlowInner:
+      type: object
+      properties:
+        summary:
+          type: string
+        description:
+          type: string
+        value:
+          type: object
+        schema:
+          type: object
+      required:
+        - summary
+        - value
+
+    PublishFlowBody:
+      type: object
+      properties:
+        flow:
+          $ref: "#/components/schemas/PublishFlowInner"
+        apps:
+          type: array
+          items:
+            type: string
+        path:
+          type: string
+        source_path:
+          type: string
+        project_slug:
+          $ref: "#/components/schemas/HubProjectSlug"
+      required:
+        - flow
+        - apps
+        - project_slug
+
+    PublishAppBody:
+      type: object
+      properties:
+        app:
+          type: object
+        apps:
+          type: array
+          items:
+            type: string
+        description:
+          type: string
+        summary:
+          type: string
+        path:
+          type: string
+        source_path:
+          type: string
+        project_slug:
+          $ref: "#/components/schemas/HubProjectSlug"
+      required:
+        - app
+        - apps
+        - summary
+        - project_slug
+
+    PublishRawAppBody:
+      type: object
+      properties:
+        raw:
+          type: string
+        apps:
+          type: array
+          items:
+            type: string
+        description:
+          type: string
+        summary:
+          type: string
+        path:
+          type: string
+        source_path:
+          type: string
+        project_slug:
+          $ref: "#/components/schemas/HubProjectSlug"
+      required:
+        - raw
+        - apps
+        - summary
+        - project_slug
+
+    RawAppEmbedBody:
+      type: object
+      properties:
+        external_embed_url:
+          type: string
+          nullable: true
+          description: explicit `null` clears the embed (unpublish)
+        project_slug:
+          $ref: "#/components/schemas/HubProjectSlug"
+      required:
+        - project_slug
+
+    RecordingBody:
+      type: object
+      properties:
+        recording:
+          type: object
+        project_slug:
+          $ref: "#/components/schemas/HubProjectSlug"
+      required:
+        - project_slug
+
+    PublishResourceTypeBody:
+      type: object
+      properties:
+        name:
+          type: string
+        schema:
+          type: object
+        description:
+          type: string
+        project_slug:
+          $ref: "#/components/schemas/HubProjectSlug"
+      required:
+        - name
+        - project_slug
+
+    PublishResourceBody:
+      type: object
+      properties:
+        path:
+          type: string
+        resource_type:
+          type: string
+      required:
+        - path
+        - resource_type
+
+    PublishResourcesBody:
+      type: object
+      properties:
+        resources:
+          type: array
+          items:
+            $ref: "#/components/schemas/PublishResourceBody"
+        project_slug:
+          $ref: "#/components/schemas/HubProjectSlug"
+      required:
+        - resources
+        - project_slug
+
+    PublishTriggerBody:
+      type: object
+      properties:
+        path:
+          type: string
+        kind:
+          type: string
+        summary:
+          type: string
+          nullable: true
+        description:
+          type: string
+          nullable: true
+        config:
+          type: object
+        script_ask_id:
+          type: integer
+          format: int64
+          nullable: true
+        flow_id:
+          type: integer
+          format: int64
+          nullable: true
+      required:
+        - path
+        - kind
+        - config
+
+    PublishTriggersBody:
+      type: object
+      properties:
+        triggers:
+          type: array
+          items:
+            $ref: "#/components/schemas/PublishTriggerBody"
+        project_slug:
+          $ref: "#/components/schemas/HubProjectSlug"
+      required:
+        - triggers
+        - project_slug
+
+    PublishMigrationBody:
+      type: object
+      description: one best-effort data table migration attached to a project (per data table)
+      properties:
+        datatable_name:
+          type: string
+        sql:
+          type: string
+        sql_down:
+          type: string
+          description: defaults to an empty string when omitted
+        enabled:
+          type: boolean
+      required:
+        - datatable_name
+        - sql
+        - enabled
+
+    PublishMigrationsBody:
+      type: object
+      properties:
+        migrations:
+          type: array
+          items:
+            $ref: "#/components/schemas/PublishMigrationBody"
+        project_slug:
+          $ref: "#/components/schemas/HubProjectSlug"
+      required:
+        - migrations
+        - project_slug
diff --git a/backend/windmill-api/src/hub_publish.rs b/backend/windmill-api/src/hub_publish.rs
new file mode 100644
index 0000000000..e0baaecccf
--- /dev/null
+++ b/backend/windmill-api/src/hub_publish.rs
@@ -0,0 +1,521 @@
+use crate::auth::Tokened;
+use crate::db::ApiAuthed;
+use crate::HTTP_CLIENT;
+use axum::{
+    extract::{FromRequestParts, Json, Path, Query, RawPathParams},
+    http::{request::Parts, StatusCode},
+    response::{IntoResponse, Response},
+    routing::{get, post},
+    Router,
+};
+use serde::{Deserialize, Deserializer, Serialize};
+use windmill_common::{
+    error::{to_anyhow, Error},
+    utils::require_admin,
+    HUB_BASE_URL,
+};
+
+pub fn workspaced_service() -> Router {
+    Router::new()
+        .route("/publish_draft", post(publish_draft))
+        .route("/scripts", post(publish_script))
+        .route("/flows", post(publish_flow))
+        .route("/apps", post(publish_app))
+        .route("/raw_apps", post(publish_raw_app))
+        .route("/raw_apps/{id}/embed", post(publish_raw_app_embed))
+        .route(
+            "/scripts/{ask_id}/recording",
+            post(publish_script_recording),
+        )
+        .route("/flows/{flow_id}/recording", post(publish_flow_recording))
+        .route("/resource_types", post(publish_resource_type))
+        .route("/resources", post(publish_resources))
+        .route("/triggers", post(publish_triggers))
+        .route("/migrations", post(publish_migrations))
+        .route("/projects/{slug}/export", get(get_project_export))
+        .route("/projects/{slug}/submit", post(submit_project))
+        .route("/project", get(get_project_by_source))
+}
+
+#[derive(Deserialize)]
+struct HubScope {
+    folder: Option<String>,
+}
+
+fn validate_folder(folder: &str) -> Result<(), Error> {
+    let ok = !folder.is_empty()
+        && folder.len() <= 255
+        && folder
+            .bytes()
+            .all(|b| b.is_ascii_alphanumeric() || b == b'_' || b == b'-');
+    if ok {
+        Ok(())
+    } else {
+        Err(Error::BadRequest(format!("invalid folder: {folder}")))
+    }
+}
+
+fn source_key(workspace: &str, folder: &str) -> Result<String, Error> {
+    validate_folder(folder)?;
+    Ok(format!("{workspace}:{folder}"))
+}
+
+fn validate_project_slug(slug: &str) -> Result<(), Error> {
+    let ok = slug.len() >= 3
+        && slug.len() <= 50
+        && !slug.starts_with('-')
+        && !slug.ends_with('-')
+        && slug
+            .bytes()
+            .all(|b| b.is_ascii_lowercase() || b.is_ascii_digit() || b == b'-');
+    if ok {
+        Ok(())
+    } else {
+        Err(Error::BadRequest(format!("invalid project slug: {slug}")))
+    }
+}
+
+/// A Hub project slug that is valid by construction: deserialization (from a
+/// request body or a path segment) is the only way to obtain one and it runs
+/// `validate_project_slug`, so no handler can forward or interpolate an
+/// unvalidated slug into a Hub URL.
+#[derive(Serialize)]
+#[serde(transparent)]
+struct ProjectSlug(String);
+
+impl<'de> Deserialize<'de> for ProjectSlug {
+    fn deserialize<D: Deserializer<'de>>(d: D) -> Result<Self, D::Error> {
+        let s = String::deserialize(d)?;
+        validate_project_slug(&s).map_err(serde::de::Error::custom)?;
+        Ok(ProjectSlug(s))
+    }
+}
+
+impl std::fmt::Display for ProjectSlug {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(&self.0)
+    }
+}
+
+/// The single gate every Hub endpoint goes through: an admin caller, their
+/// token (the Hub authenticates it back against this instance's whoami), and
+/// the validated `workspace_id:folder` source key scoping ownership Hub-side.
+/// Handlers can only reach the Hub via this extractor's methods, so a new
+/// endpoint cannot forget the admin check or folder validation.
+///
+/// A workspace can publish one Hub project per folder. The stable, never-mutated
+/// link key is `workspace_id:folder_name` (folder name is the path segment and is
+/// never renamed — only display_name changes). `:` is safe: neither workspace ids
+/// nor folder names (alphanumeric, underscore, hyphen) contain it.
+struct HubPublishCtx {
+    source_id: Option<String>,
+    token: String,
+}
+
+impl<S> FromRequestParts<S> for HubPublishCtx
+where
+    S: Send + Sync,
+{
+    type Rejection = Response;
+
+    async fn from_request_parts(
+        parts: &mut Parts,
+        state: &S,
+    ) -> std::result::Result<Self, Self::Rejection> {
+        let authed = ApiAuthed::from_request_parts(parts, state)
+            .await
+            .map_err(IntoResponse::into_response)?;
+        let tokened = Tokened::from_request_parts(parts, state)
+            .await
+            .map_err(IntoResponse::into_response)?;
+        let params = RawPathParams::from_request_parts(parts, state)
+            .await
+            .map_err(IntoResponse::into_response)?;
+        let workspace = params
+            .iter()
+            .find(|(k, _)| *k == "workspace_id")
+            .map(|(_, v)| v.to_owned());
+        let Query(scope) = Query::<HubScope>::from_request_parts(parts, state)
+            .await
+            .map_err(IntoResponse::into_response)?;
+        let build = || -> Result<HubPublishCtx, Error> {
+            require_admin(authed.is_admin, &authed.username)?;
+            let workspace = workspace.ok_or_else(|| {
+                Error::internal_err(
+                    "hub publish route must be nested under /w/{workspace_id}".to_string(),
+                )
+            })?;
+            let source_id = scope
+                .folder
+                .as_deref()
+                .map(|f| source_key(&workspace, f))
+                .transpose()?;
+            Ok(HubPublishCtx { source_id, token: tokened.token })
+        };
+        build().map_err(IntoResponse::into_response)
+    }
+}
+
+impl HubPublishCtx {
+    fn require_source(&self) -> Result<&str, Error> {
+        self.source_id
+            .as_deref()
+            .ok_or_else(|| Error::BadRequest("missing folder query param".to_string()))
+    }
+
+    async fn post<T: Serialize>(
+        &self,
+        path: &str,
+        body: &T,
+    ) -> Result<(StatusCode, String), Error> {
+        forward_to_hub(path, self.require_source()?, &self.token, body).await
+    }
+
+    async fn get(&self, path: &str) -> Result<(StatusCode, String), Error> {
+        get_from_hub(path, self.require_source()?, &self.token).await
+    }
+
+    /// GET without requiring a folder scope. Only for reads the Hub allows
+    /// publicly (e.g. exporting an approved project); the empty source id makes
+    /// the Hub skip the ownership match.
+    async fn get_maybe_unscoped(&self, path: &str) -> Result<(StatusCode, String), Error> {
+        get_from_hub(path, self.source_id.as_deref().unwrap_or(""), &self.token).await
+    }
+}
+
+#[derive(Deserialize, Serialize)]
+struct PublishDraftBody {
+    slug: ProjectSlug,
+    name: String,
+    summary: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    readme: Option<String>,
+}
+
+async fn publish_draft(
+    ctx: HubPublishCtx,
+    Json(body): Json<PublishDraftBody>,
+) -> Result<impl IntoResponse, Error> {
+    ctx.post("/projects", &body).await
+}
+
+#[derive(Deserialize, Serialize)]
+struct PublishScriptBody {
+    summary: String,
+    app: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    description: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    kind: Option<String>,
+    content: String,
+    language: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    schema: Option<serde_json::Value>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    lockfile: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    path: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    source_path: Option<String>,
+    project_slug: ProjectSlug,
+}
+
+async fn publish_script(
+    ctx: HubPublishCtx,
+    Json(body): Json<PublishScriptBody>,
+) -> Result<impl IntoResponse, Error> {
+    ctx.post("/scripts/add", &body).await
+}
+
+#[derive(Deserialize, Serialize)]
+struct PublishFlowInner {
+    summary: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    description: Option<String>,
+    value: serde_json::Value,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    schema: Option<serde_json::Value>,
+}
+
+#[derive(Deserialize, Serialize)]
+struct PublishFlowBody {
+    flow: PublishFlowInner,
+    apps: Vec<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    path: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    source_path: Option<String>,
+    project_slug: ProjectSlug,
+}
+
+async fn publish_flow(
+    ctx: HubPublishCtx,
+    Json(body): Json<PublishFlowBody>,
+) -> Result<impl IntoResponse, Error> {
+    ctx.post("/flows", &body).await
+}
+
+#[derive(Deserialize, Serialize)]
+struct PublishAppBody {
+    app: serde_json::Value,
+    apps: Vec<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    description: Option<String>,
+    summary: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    path: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    source_path: Option<String>,
+    project_slug: ProjectSlug,
+}
+
+async fn publish_app(
+    ctx: HubPublishCtx,
+    Json(body): Json<PublishAppBody>,
+) -> Result<impl IntoResponse, Error> {
+    ctx.post("/apps", &body).await
+}
+
+#[derive(Deserialize, Serialize)]
+struct PublishRawAppBody {
+    raw: String,
+    apps: Vec<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    description: Option<String>,
+    summary: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    path: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    source_path: Option<String>,
+    project_slug: ProjectSlug,
+}
+
+async fn publish_raw_app(
+    ctx: HubPublishCtx,
+    Json(body): Json<PublishRawAppBody>,
+) -> Result<impl IntoResponse, Error> {
+    ctx.post("/raw_apps", &body).await
+}
+
+#[derive(Deserialize, Serialize)]
+struct RawAppEmbedBody {
+    // No skip_serializing_if: `null` must reach the Hub to clear the embed (unpublish).
+    external_embed_url: Option<String>,
+    project_slug: ProjectSlug,
+}
+
+async fn publish_raw_app_embed(
+    ctx: HubPublishCtx,
+    Path((_workspace, id)): Path<(String, i64)>,
+    Json(body): Json<RawAppEmbedBody>,
+) -> Result<impl IntoResponse, Error> {
+    ctx.post(&format!("/raw_apps/{}/embed", id), &body).await
+}
+
+#[derive(Deserialize, Serialize)]
+struct RecordingBody {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    recording: Option<serde_json::Value>,
+    project_slug: ProjectSlug,
+}
+
+async fn publish_script_recording(
+    ctx: HubPublishCtx,
+    Path((_workspace, ask_id)): Path<(String, i64)>,
+    Json(body): Json<RecordingBody>,
+) -> Result<impl IntoResponse, Error> {
+    ctx.post(&format!("/scripts/{}/recording", ask_id), &body)
+        .await
+}
+
+async fn publish_flow_recording(
+    ctx: HubPublishCtx,
+    Path((_workspace, flow_id)): Path<(String, i64)>,
+    Json(body): Json<RecordingBody>,
+) -> Result<impl IntoResponse, Error> {
+    ctx.post(&format!("/flows/{}/recording", flow_id), &body)
+        .await
+}
+
+#[derive(Deserialize, Serialize)]
+struct PublishResourceTypeBody {
+    name: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    schema: Option<serde_json::Value>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    description: Option<String>,
+    project_slug: ProjectSlug,
+}
+
+async fn publish_resource_type(
+    ctx: HubPublishCtx,
+    Json(body): Json<PublishResourceTypeBody>,
+) -> Result<impl IntoResponse, Error> {
+    ctx.post(
+        &format!("/projects/{}/resource_types", body.project_slug),
+        &body,
+    )
+    .await
+}
+
+#[derive(Deserialize, Serialize)]
+struct PublishResourceBody {
+    path: String,
+    resource_type: String,
+}
+
+#[derive(Deserialize, Serialize)]
+struct PublishResourcesBody {
+    resources: Vec<PublishResourceBody>,
+    project_slug: ProjectSlug,
+}
+
+async fn publish_resources(
+    ctx: HubPublishCtx,
+    Json(body): Json<PublishResourcesBody>,
+) -> Result<impl IntoResponse, Error> {
+    ctx.post(&format!("/projects/{}/resources", body.project_slug), &body)
+        .await
+}
+
+#[derive(Deserialize, Serialize)]
+struct PublishTriggerBody {
+    path: String,
+    kind: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    summary: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    description: Option<String>,
+    config: serde_json::Value,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    script_ask_id: Option<i64>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    flow_id: Option<i64>,
+}
+
+#[derive(Deserialize, Serialize)]
+struct PublishTriggersBody {
+    triggers: Vec<PublishTriggerBody>,
+    project_slug: ProjectSlug,
+}
+
+async fn publish_triggers(
+    ctx: HubPublishCtx,
+    Json(body): Json<PublishTriggersBody>,
+) -> Result<impl IntoResponse, Error> {
+    ctx.post(&format!("/projects/{}/triggers", body.project_slug), &body)
+        .await
+}
+
+// One best-effort data table migration attached to a project (per data table).
+#[derive(Deserialize, Serialize)]
+struct PublishMigrationBody {
+    datatable_name: String,
+    sql: String,
+    #[serde(default)]
+    sql_down: String,
+    enabled: bool,
+}
+
+#[derive(Deserialize, Serialize)]
+struct PublishMigrationsBody {
+    migrations: Vec<PublishMigrationBody>,
+    project_slug: ProjectSlug,
+}
+
+async fn publish_migrations(
+    ctx: HubPublishCtx,
+    Json(body): Json<PublishMigrationsBody>,
+) -> Result<impl IntoResponse, Error> {
+    ctx.post(
+        &format!("/projects/{}/migrations", body.project_slug),
+        &body,
+    )
+    .await
+}
+
+// Export is owner-scoped only when re-exporting your own draft; approved
+// projects are public, so the folder scope is optional here.
+async fn get_project_export(
+    ctx: HubPublishCtx,
+    Path((_workspace, slug)): Path<(String, ProjectSlug)>,
+) -> Result<impl IntoResponse, Error> {
+    ctx.get_maybe_unscoped(&format!("/projects/{}/export", slug))
+        .await
+}
+
+async fn get_project_by_source(ctx: HubPublishCtx) -> Result<impl IntoResponse, Error> {
+    ctx.get("/projects/by_source").await
+}
+
+async fn submit_project(
+    ctx: HubPublishCtx,
+    Path((_workspace, slug)): Path<(String, ProjectSlug)>,
+) -> Result<impl IntoResponse, Error> {
+    ctx.post(
+        &format!("/projects/{}/submit", slug),
+        &serde_json::json!({}),
+    )
+    .await
+}
+
+// The Hub has no auth of its own: it validates bearer tokens by calling this
+// instance's /api/users/whoami. Forwarding the caller's own token logs them in
+// on the Hub as themselves (account auto-created on first use).
+async fn get_from_hub(
+    path: &str,
+    source_id: &str,
+    token: &str,
+) -> Result<(StatusCode, String), Error> {
+    let url = format!("{}{}", **HUB_BASE_URL.load(), path);
+
+    let res = HTTP_CLIENT
+        .get(&url)
+        .query(&[("source_id", source_id)])
+        .bearer_auth(token)
+        .send()
+        .await
+        .map_err(|e| Error::InternalErr(format!("hub request failed: {e}")))?;
+
+    let status = StatusCode::from_u16(res.status().as_u16()).unwrap_or(StatusCode::BAD_GATEWAY);
+    let text = res
+        .text()
+        .await
+        .map_err(|e| Error::InternalErr(format!("hub response read failed: {e}")))?;
+
+    Ok((status, text))
+}
+
+async fn forward_to_hub<T: Serialize>(
+    path: &str,
+    source_id: &str,
+    token: &str,
+    body: &T,
+) -> Result<(StatusCode, String), Error> {
+    let url = format!("{}{}", **HUB_BASE_URL.load(), path);
+
+    let mut payload = serde_json::to_value(body).map_err(to_anyhow)?;
+    let obj = payload
+        .as_object_mut()
+        .ok_or_else(|| Error::internal_err("hub publish body must be a JSON object".to_string()))?;
+    obj.insert(
+        "source_id".to_string(),
+        serde_json::Value::String(source_id.to_string()),
+    );
+
+    let res = HTTP_CLIENT
+        .post(&url)
+        .bearer_auth(token)
+        .json(&payload)
+        .send()
+        .await
+        .map_err(|e| Error::InternalErr(format!("hub request failed: {e}")))?;
+
+    let status = StatusCode::from_u16(res.status().as_u16()).unwrap_or(StatusCode::BAD_GATEWAY);
+    let text = res
+        .text()
+        .await
+        .map_err(|e| Error::InternalErr(format!("hub response read failed: {e}")))?;
+
+    Ok((status, text))
+}
diff --git a/backend/windmill-api/src/lib.rs b/backend/windmill-api/src/lib.rs
index d56928a712..ce66ec22da 100644
--- a/backend/windmill-api/src/lib.rs
+++ b/backend/windmill-api/src/lib.rs
@@ -94,6 +94,7 @@ mod granular_acls;
 mod group_history;
 mod groups;
 mod health;
+mod hub_publish;
 #[cfg(feature = "private")]
 pub mod indexer_ee;
 mod indexer_oss;
@@ -656,6 +657,7 @@ pub async fn run_server(
                         .nest("/volumes", volumes_oss::workspaced_service())
                         .nest("/workers", windmill_api_workers::workspaced_service())
                         .nest("/workspaces", workspaces::workspaced_service())
+                        .nest("/hub", hub_publish::workspaced_service())
                         .nest(
                             "/data_metrics",
                             windmill_api_workspaces::data_metrics::workspaced_service(),
diff --git a/frontend/src/lib/components/DatatableSchemaDiff.svelte b/frontend/src/lib/components/DatatableSchemaDiff.svelte
index 9eccda8195..ac215747e0 100644
--- a/frontend/src/lib/components/DatatableSchemaDiff.svelte
+++ b/frontend/src/lib/components/DatatableSchemaDiff.svelte
@@ -1,195 +1,11 @@
-<script module lang="ts">
-	import type {
-		TableEditorValues,
-		TableEditorValuesColumn,
-		TableEditorForeignKey
-	} from '$lib/components/apps/components/display/dbtable/tableEditor'
-	import {
-		diffTableEditorValues,
-		type AlterTableValues,
-		makeAlterTableQueries
-	} from '$lib/components/apps/components/display/dbtable/queries/alterTable'
-	import { renderForeignKey } from '$lib/components/apps/components/display/dbtable/queries/dbQueriesUtils'
-	import type { GetDatatableFullSchemaResponse } from '$lib/gen'
-
-	export type DatabaseSchema = Record<string, Record<string, TableEditorValues>>
-
-	export function apiSchemaToEditorSchema(
-		apiSchema: GetDatatableFullSchemaResponse
-	): DatabaseSchema {
-		const result: DatabaseSchema = {}
-		for (const [schemaName, tables] of Object.entries(apiSchema)) {
-			result[schemaName] = {}
-			for (const [tableName, table] of Object.entries(tables as Record<string, any>)) {
-				if (!table || typeof table !== 'object') continue
-				result[schemaName][tableName] = {
-					name: table.name ?? tableName,
-					columns: (table.columns ?? []).map(
-						(c: any): TableEditorValuesColumn => ({
-							name: c.name,
-							datatype: c.datatype,
-							primaryKey: c.primary_key ?? c.primaryKey,
-							defaultValue: c.default_value ?? c.defaultValue,
-							nullable: c.nullable
-						})
-					),
-					foreignKeys: (table.foreign_keys ?? table.foreignKeys ?? []).map(
-						(fk: any): TableEditorForeignKey => ({
-							targetTable: fk.target_table ?? fk.targetTable,
-							columns: (fk.columns ?? []).map((col: any) => ({
-								sourceColumn: col.source_column ?? col.sourceColumn,
-								targetColumn: col.target_column ?? col.targetColumn
-							})),
-							onDelete: (fk.on_delete ?? fk.onDelete ?? 'NO ACTION') as
-								| 'CASCADE'
-								| 'SET NULL'
-								| 'NO ACTION',
-							onUpdate: (fk.on_update ?? fk.onUpdate ?? 'NO ACTION') as
-								| 'CASCADE'
-								| 'SET NULL'
-								| 'NO ACTION',
-							fk_constraint_name: fk.fk_constraint_name
-						})
-					),
-					pk_constraint_name: table.pk_constraint_name
-				}
-			}
-		}
-		return result
-	}
-
-	export type TableDiff = {
-		schemaName: string
-		tableName: string
-		kind: 'added' | 'removed' | 'modified'
-		operations?: AlterTableValues
-	}
-
-	export type DatatableDiff = {
-		datatableName: string
-		aheadChanges: TableDiff[]
-		behindChanges: TableDiff[]
-		originalSchema: DatabaseSchema
-		parentSchema: DatabaseSchema
-		forkSchema: DatabaseSchema
-	}
-
-	export function diffDatabaseSchemas(
-		original: DatabaseSchema,
-		current: DatabaseSchema
-	): TableDiff[] {
-		const diffs: TableDiff[] = []
-		const allSchemas = new Set([...Object.keys(original), ...Object.keys(current)])
-		for (const schemaName of allSchemas) {
-			const origTables = original[schemaName] ?? {}
-			const currTables = current[schemaName] ?? {}
-			const allTables = new Set([...Object.keys(origTables), ...Object.keys(currTables)])
-			for (const tableName of allTables) {
-				const origTable = origTables[tableName]
-				const currTable = currTables[tableName]
-				if (!origTable && currTable) {
-					diffs.push({ schemaName, tableName, kind: 'added' })
-				} else if (origTable && !currTable) {
-					diffs.push({ schemaName, tableName, kind: 'removed' })
-				} else if (origTable && currTable) {
-					const currWithInitial: TableEditorValues = {
-						...currTable,
-						columns: currTable.columns.map((col) => ({
-							...col,
-							initialName: col.name,
-							defaultValue: col.defaultValue ? `{${col.defaultValue}}` : undefined
-						}))
-					}
-					const origTableTransformed: TableEditorValues = {
-						...origTable,
-						columns: origTable.columns.map((col) => ({
-							...col,
-							defaultValue: col.defaultValue ? `{${col.defaultValue}}` : undefined
-						}))
-					}
-					const diff = diffTableEditorValues(origTableTransformed, currWithInitial)
-					if (diff.operations.length > 0) {
-						diffs.push({ schemaName, tableName, kind: 'modified', operations: diff })
-					}
-				}
-			}
-		}
-		return diffs
-	}
-
-	export function computeDatatableDiff(
-		datatableName: string,
-		originalSchema: DatabaseSchema,
-		parentSchema: DatabaseSchema,
-		forkSchema: DatabaseSchema
-	): DatatableDiff {
-		return {
-			datatableName,
-			behindChanges: diffDatabaseSchemas(originalSchema, parentSchema),
-			aheadChanges: diffDatabaseSchemas(originalSchema, forkSchema),
-			originalSchema,
-			parentSchema,
-			forkSchema
-		}
-	}
-
-	/** Detect PostgreSQL auto-increment columns and return the serial type + cleaned props.
-	 *  e.g. bigint + nextval('seq'::regclass) → BIGSERIAL (no DEFAULT needed) */
-	function resolveColumnType(c: TableEditorValuesColumn): {
-		datatype: string
-		defaultValue: string | undefined
-	} {
-		const dv = c.defaultValue ?? ''
-		if (/^{?nextval\(/.test(dv)) {
-			const dt = c.datatype?.toLowerCase() ?? ''
-			if (dt === 'bigint') return { datatype: 'BIGSERIAL', defaultValue: undefined }
-			if (dt === 'integer' || dt === 'int') return { datatype: 'SERIAL', defaultValue: undefined }
-			if (dt === 'smallint') return { datatype: 'SMALLSERIAL', defaultValue: undefined }
-		}
-		return { datatype: c.datatype, defaultValue: c.defaultValue }
-	}
-
-	export function generateMigrationSql(change: TableDiff, sourceSchema: DatabaseSchema): string {
-		if (change.kind === 'modified' && change.operations) {
-			const queries = makeAlterTableQueries(change.operations, 'postgresql', change.schemaName)
-			if (queries.length === 0) return ''
-			return 'BEGIN;\n' + queries.join('\n') + '\nCOMMIT;'
-		}
-		if (change.kind === 'added') {
-			const table = sourceSchema[change.schemaName]?.[change.tableName]
-			if (!table) return ''
-			const colDefs = table.columns
-				.map((c) => {
-					const { datatype, defaultValue } = resolveColumnType(c)
-					let def = `"${c.name}" ${datatype}`
-					if (c.nullable === false) def += ' NOT NULL'
-					if (defaultValue) def += ` DEFAULT ${defaultValue}`
-					return def
-				})
-				.join(',\n  ')
-			const pkCols = table.columns.filter((c) => c.primaryKey).map((c) => `"${c.name}"`)
-			const pkLine = pkCols.length > 0 ? `,\n  PRIMARY KEY (${pkCols.join(', ')})` : ''
-			const qualifiedName = `"${change.schemaName}"."${change.tableName}"`
-			let sql = `BEGIN;\nCREATE TABLE ${qualifiedName} (\n  ${colDefs}${pkLine}\n);`
-			for (const fk of table.foreignKeys ?? []) {
-				const fkSql = renderForeignKey(fk, {
-					useSchema: true,
-					dbType: 'postgresql',
-					tableName: change.tableName
-				})
-				sql += `\nALTER TABLE ${qualifiedName} ADD ${fkSql};`
-			}
-			sql += '\nCOMMIT;'
-			return sql
-		}
-		if (change.kind === 'removed') {
-			return `BEGIN;\nDROP TABLE IF EXISTS "${change.schemaName}"."${change.tableName}";\nCOMMIT;`
-		}
-		return ''
-	}
-</script>
-
 <script lang="ts">
+	import {
+		apiSchemaToEditorSchema,
+		computeDatatableDiff,
+		generateMigrationSql,
+		type DatatableDiff,
+		type TableDiff
+	} from './datatableSchemaSql'
 	import { WorkspaceService } from '$lib/gen'
 	import { Loader2, ChevronDown, ChevronRight, Plus, Minus, Pencil, Eye } from 'lucide-svelte'
 	import { Button } from '$lib/components/common'
diff --git a/frontend/src/lib/components/WorkspaceDeployLayout.svelte b/frontend/src/lib/components/WorkspaceDeployLayout.svelte
index b7d87d6321..491d649a44 100644
--- a/frontend/src/lib/components/WorkspaceDeployLayout.svelte
+++ b/frontend/src/lib/components/WorkspaceDeployLayout.svelte
@@ -34,6 +34,7 @@
 		deploymentStatus: Record<string, { status: 'loading' | 'deployed' | 'failed'; error?: string }>
 		allSelected?: boolean
 		emptyMessage?: string
+		hideSelection?: boolean
 		children?: Snippet
 
 		// Snippets for customization
@@ -64,6 +65,7 @@
 		deploymentStatus,
 		allSelected = false,
 		emptyMessage = 'No items to deploy',
+		hideSelection = false,
 		header,
 		alerts,
 		selectAllActions,
@@ -150,12 +152,13 @@
 		{@render alerts()}
 	{/if}
 
-	<!-- Controls row: "Select all" (when there are items) + optional right-side
-	     actions (e.g. a filter toggle). Renders when there are items OR actions are
-	     provided, so a filter that empties the list doesn't take its own toggle with it. -->
+	<!-- Controls row: "Select all" (when there are items and selection is enabled) +
+	     optional right-side actions (e.g. a filter toggle). Renders when there are
+	     items OR actions are provided, so a filter that empties the list doesn't take
+	     its own toggle with it. -->
 	{#if items.length > 0 || selectAllActions}
 		<div class="px-4 py-2 flex items-center justify-between">
-			{#if items.length > 0}
+			{#if items.length > 0 && !hideSelection}
 				<label
 					class="flex items-center gap-2 text-secondary text-xs"
 					class:opacity-50={!hasSelectableItems}
@@ -190,15 +193,17 @@
 							class="sticky top-0 z-10 flex items-center gap-2 px-4 py-1.5 bg-surface-secondary border-b first:rounded-t-md"
 							title={selectable.length === 0 ? 'No selectable items in this group' : undefined}
 						>
-							<Checkbox
-								checked={selectable.length > 0 && selectedCount === selectable.length}
-								indeterminate={selectedCount > 0 && selectedCount < selectable.length}
-								disabled={selectable.length === 0}
-								title={selectedCount === selectable.length
-									? `Deselect all in ${group.label}`
-									: `Select all in ${group.label}`}
-								onChange={() => toggleGroup(group)}
-							/>
+							{#if !hideSelection}
+								<Checkbox
+									checked={selectable.length > 0 && selectedCount === selectable.length}
+									indeterminate={selectedCount > 0 && selectedCount < selectable.length}
+									disabled={selectable.length === 0}
+									title={selectedCount === selectable.length
+										? `Deselect all in ${group.label}`
+										: `Select all in ${group.label}`}
+									onChange={() => toggleGroup(group)}
+								/>
+							{/if}
 							{#if group.groupKind === 'folder'}
 								<Folder size={14} class="text-tertiary shrink-0" />
 							{:else if group.groupKind === 'user'}
@@ -234,11 +239,11 @@
 								: item.path}
 
 						<Row
-							isSelectable={isSelectable && !isDeployed}
+							isSelectable={!hideSelection && isSelectable && !isDeployed}
 							selectDisabledReason={blockedReason}
-							selectOnRowClick={true}
-							alignWithSelectable={true}
-							disabled={blockedReason ? false : !isSelectable}
+							selectOnRowClick={!hideSelection}
+							alignWithSelectable={!hideSelection}
+							disabled={!hideSelection && (blockedReason ? false : !isSelectable)}
 							selected={isSelected && !isDeployed}
 							onSelect={() => handleSelect(item)}
 							path={showPath ? item.path : ''}
diff --git a/frontend/src/lib/components/assets/AssetGraph/AssetGraphDetailsPane.svelte b/frontend/src/lib/components/assets/AssetGraph/AssetGraphDetailsPane.svelte
index 425565353a..d48ecbe09e 100644
--- a/frontend/src/lib/components/assets/AssetGraph/AssetGraphDetailsPane.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/AssetGraphDetailsPane.svelte
@@ -493,6 +493,10 @@
 	// restores its input. Guarded on the path so a staging round-trip
 	// (emit → page → runFormInitialArgs) doesn't re-seed and loop. The read-only
 	// branch uses PipelineScriptView's own onArgsChange instead.
+	// Declared before the pre-effect that seeds it: a `$state` referenced by an
+	// earlier-registered `$effect.pre` hits a TDZ ("Cannot access 'args' before
+	// initialization") when the pane remounts and the pre-effect runs before this
+	// line executes.
 	let args = $state<Record<string, any>>({})
 	let argsSeedPath: string | undefined = undefined
 	$effect.pre(() => {
diff --git a/frontend/src/lib/components/datatableSchemaSql.ts b/frontend/src/lib/components/datatableSchemaSql.ts
new file mode 100644
index 0000000000..cd3d0f9154
--- /dev/null
+++ b/frontend/src/lib/components/datatableSchemaSql.ts
@@ -0,0 +1,220 @@
+import type {
+	TableEditorValues,
+	TableEditorValuesColumn,
+	TableEditorForeignKey
+} from '$lib/components/apps/components/display/dbtable/tableEditor'
+import {
+	diffTableEditorValues,
+	type AlterTableValues,
+	makeAlterTableQueries
+} from '$lib/components/apps/components/display/dbtable/queries/alterTable'
+import { renderForeignKey } from '$lib/components/apps/components/display/dbtable/queries/dbQueriesUtils'
+import type { GetDatatableFullSchemaResponse } from '$lib/gen'
+
+export type DatabaseSchema = Record<string, Record<string, TableEditorValues>>
+
+export function apiSchemaToEditorSchema(apiSchema: GetDatatableFullSchemaResponse): DatabaseSchema {
+	const result: DatabaseSchema = {}
+	for (const [schemaName, tables] of Object.entries(apiSchema)) {
+		result[schemaName] = {}
+		for (const [tableName, table] of Object.entries(tables as Record<string, any>)) {
+			if (!table || typeof table !== 'object') continue
+			result[schemaName][tableName] = {
+				name: table.name ?? tableName,
+				columns: (table.columns ?? []).map(
+					(c: any): TableEditorValuesColumn => ({
+						name: c.name,
+						datatype: c.datatype,
+						primaryKey: c.primary_key ?? c.primaryKey,
+						defaultValue: c.default_value ?? c.defaultValue,
+						nullable: c.nullable
+					})
+				),
+				foreignKeys: (table.foreign_keys ?? table.foreignKeys ?? []).map(
+					(fk: any): TableEditorForeignKey => ({
+						targetTable: fk.target_table ?? fk.targetTable,
+						columns: (fk.columns ?? []).map((col: any) => ({
+							sourceColumn: col.source_column ?? col.sourceColumn,
+							targetColumn: col.target_column ?? col.targetColumn
+						})),
+						onDelete: (fk.on_delete ?? fk.onDelete ?? 'NO ACTION') as
+							| 'CASCADE'
+							| 'SET NULL'
+							| 'NO ACTION',
+						onUpdate: (fk.on_update ?? fk.onUpdate ?? 'NO ACTION') as
+							| 'CASCADE'
+							| 'SET NULL'
+							| 'NO ACTION',
+						fk_constraint_name: fk.fk_constraint_name
+					})
+				),
+				pk_constraint_name: table.pk_constraint_name
+			}
+		}
+	}
+	return result
+}
+
+export type TableDiff = {
+	schemaName: string
+	tableName: string
+	kind: 'added' | 'removed' | 'modified'
+	operations?: AlterTableValues
+}
+
+export type DatatableDiff = {
+	datatableName: string
+	aheadChanges: TableDiff[]
+	behindChanges: TableDiff[]
+	originalSchema: DatabaseSchema
+	parentSchema: DatabaseSchema
+	forkSchema: DatabaseSchema
+}
+
+export function diffDatabaseSchemas(
+	original: DatabaseSchema,
+	current: DatabaseSchema
+): TableDiff[] {
+	const diffs: TableDiff[] = []
+	const allSchemas = new Set([...Object.keys(original), ...Object.keys(current)])
+	for (const schemaName of allSchemas) {
+		const origTables = original[schemaName] ?? {}
+		const currTables = current[schemaName] ?? {}
+		const allTables = new Set([...Object.keys(origTables), ...Object.keys(currTables)])
+		for (const tableName of allTables) {
+			const origTable = origTables[tableName]
+			const currTable = currTables[tableName]
+			if (!origTable && currTable) {
+				diffs.push({ schemaName, tableName, kind: 'added' })
+			} else if (origTable && !currTable) {
+				diffs.push({ schemaName, tableName, kind: 'removed' })
+			} else if (origTable && currTable) {
+				const currWithInitial: TableEditorValues = {
+					...currTable,
+					columns: currTable.columns.map((col) => ({
+						...col,
+						initialName: col.name,
+						defaultValue: col.defaultValue ? `{${col.defaultValue}}` : undefined
+					}))
+				}
+				const origTableTransformed: TableEditorValues = {
+					...origTable,
+					columns: origTable.columns.map((col) => ({
+						...col,
+						defaultValue: col.defaultValue ? `{${col.defaultValue}}` : undefined
+					}))
+				}
+				const diff = diffTableEditorValues(origTableTransformed, currWithInitial)
+				if (diff.operations.length > 0) {
+					diffs.push({ schemaName, tableName, kind: 'modified', operations: diff })
+				}
+			}
+		}
+	}
+	return diffs
+}
+
+export function computeDatatableDiff(
+	datatableName: string,
+	originalSchema: DatabaseSchema,
+	parentSchema: DatabaseSchema,
+	forkSchema: DatabaseSchema
+): DatatableDiff {
+	return {
+		datatableName,
+		behindChanges: diffDatabaseSchemas(originalSchema, parentSchema),
+		aheadChanges: diffDatabaseSchemas(originalSchema, forkSchema),
+		originalSchema,
+		parentSchema,
+		forkSchema
+	}
+}
+
+/** Detect PostgreSQL auto-increment columns and return the serial type + cleaned props.
+ *  e.g. bigint + nextval('seq'::regclass) → BIGSERIAL (no DEFAULT needed) */
+function resolveColumnType(c: TableEditorValuesColumn): {
+	datatype: string
+	defaultValue: string | undefined
+} {
+	const dv = c.defaultValue ?? ''
+	if (/^{?nextval\(/.test(dv)) {
+		const dt = c.datatype?.toLowerCase() ?? ''
+		if (dt === 'bigint') return { datatype: 'BIGSERIAL', defaultValue: undefined }
+		if (dt === 'integer' || dt === 'int') return { datatype: 'SERIAL', defaultValue: undefined }
+		if (dt === 'smallint') return { datatype: 'SMALLSERIAL', defaultValue: undefined }
+	}
+	return { datatype: c.datatype, defaultValue: c.defaultValue }
+}
+
+/**
+ * SQL for an added table, with the CREATE TABLE and the FK constraints split so
+ * callers creating several tables can emit every CREATE before any constraint —
+ * required for circular FKs, where no creation order satisfies inline FKs.
+ */
+export function generateAddedTableSql(
+	change: TableDiff,
+	sourceSchema: DatabaseSchema,
+	options?: { ifNotExists?: boolean }
+): { create: string; constraints: string[] } | undefined {
+	const table = sourceSchema[change.schemaName]?.[change.tableName]
+	if (!table) return undefined
+	const colDefs = table.columns
+		.map((c) => {
+			const { datatype, defaultValue } = resolveColumnType(c)
+			let def = `"${c.name}" ${datatype}`
+			if (c.nullable === false) def += ' NOT NULL'
+			if (defaultValue) def += ` DEFAULT ${defaultValue}`
+			return def
+		})
+		.join(',\n  ')
+	const pkCols = table.columns.filter((c) => c.primaryKey).map((c) => `"${c.name}"`)
+	const pkLine = pkCols.length > 0 ? `,\n  PRIMARY KEY (${pkCols.join(', ')})` : ''
+	const qualifiedName = `"${change.schemaName}"."${change.tableName}"`
+	const createKeyword = options?.ifNotExists ? 'CREATE TABLE IF NOT EXISTS' : 'CREATE TABLE'
+	// The target may not have the schema at all (fresh data table import).
+	const schemaDdl =
+		change.schemaName !== 'public' ? `CREATE SCHEMA IF NOT EXISTS "${change.schemaName}";\n` : ''
+	const create = `${schemaDdl}${createKeyword} ${qualifiedName} (\n  ${colDefs}${pkLine}\n);`
+	const constraints: string[] = []
+	for (const fk of table.foreignKeys ?? []) {
+		const fkSql = renderForeignKey(fk, {
+			useSchema: true,
+			dbType: 'postgresql',
+			tableName: change.tableName
+		})
+		// With IF NOT EXISTS the table may pre-exist with this FK already in
+		// place; an unconditional ADD would then abort the whole transaction.
+		// The constraint name is emitted unquoted, so Postgres folds it to
+		// lowercase — compare against the folded form.
+		const fkName = options?.ifNotExists
+			? fkSql.match(/^CONSTRAINT\s+(\S+)/)?.[1]?.toLowerCase()
+			: undefined
+		constraints.push(
+			fkName
+				? `DO $$\nBEGIN\n  IF NOT EXISTS (\n    SELECT 1 FROM pg_constraint\n    WHERE conname = '${fkName}' AND conrelid = '${qualifiedName}'::regclass\n  ) THEN\n    ALTER TABLE ${qualifiedName} ADD ${fkSql};\n  END IF;\nEND $$;`
+				: `ALTER TABLE ${qualifiedName} ADD ${fkSql};`
+		)
+	}
+	return { create, constraints }
+}
+
+export function generateMigrationSql(
+	change: TableDiff,
+	sourceSchema: DatabaseSchema,
+	options?: { ifNotExists?: boolean }
+): string {
+	if (change.kind === 'modified' && change.operations) {
+		const queries = makeAlterTableQueries(change.operations, 'postgresql', change.schemaName)
+		if (queries.length === 0) return ''
+		return 'BEGIN;\n' + queries.join('\n') + '\nCOMMIT;'
+	}
+	if (change.kind === 'added') {
+		const gen = generateAddedTableSql(change, sourceSchema, options)
+		if (!gen) return ''
+		return `BEGIN;\n${[gen.create, ...gen.constraints].join('\n')}\nCOMMIT;`
+	}
+	if (change.kind === 'removed') {
+		return `BEGIN;\nDROP TABLE IF EXISTS "${change.schemaName}"."${change.tableName}";\nCOMMIT;`
+	}
+	return ''
+}
diff --git a/frontend/src/lib/components/sidebar/SidebarContent.svelte b/frontend/src/lib/components/sidebar/SidebarContent.svelte
index 2fffd7b22c..91b52972a1 100644
--- a/frontend/src/lib/components/sidebar/SidebarContent.svelte
+++ b/frontend/src/lib/components/sidebar/SidebarContent.svelte
@@ -102,7 +102,13 @@
 		}
 	}
 
-	loadAvailableNativeTriggers()
+	// Native triggers are EE-only; on CE the `/exists` checks just 404. Gate the
+	// load by license (reactive, since the license loads asynchronously).
+	$effect(() => {
+		if ($enterpriseLicense && $workspaceStore) {
+			loadAvailableNativeTriggers()
+		}
+	})
 
 	const triggersCollapsed = useLocalStorageValue(
 		'windmill_triggers_section_collapsed',
diff --git a/frontend/src/lib/components/triggers/workspaceTriggersList.test.ts b/frontend/src/lib/components/triggers/workspaceTriggersList.test.ts
new file mode 100644
index 0000000000..7ca752c780
--- /dev/null
+++ b/frontend/src/lib/components/triggers/workspaceTriggersList.test.ts
@@ -0,0 +1,113 @@
+import { describe, it, expect } from 'vitest'
+import {
+	portableTriggerConfig,
+	triggerHandlerRefs,
+	type WorkspaceTrigger
+} from './workspaceTriggersList'
+
+const trigger = (kind: string, config: Record<string, unknown>): WorkspaceTrigger =>
+	({ kind, path: 'f/p/t', script_path: 'f/p/s', is_flow: false, config }) as WorkspaceTrigger
+
+describe('portableTriggerConfig', () => {
+	it('is an allowlist: unknown and instance-side fields never cross the boundary', () => {
+		const out = portableTriggerConfig('schedule', {
+			// portable
+			schedule: '0 0 * * * *',
+			cron_version: 'v2',
+			no_flow_overlap: true,
+			on_failure: 'script/f/p/handler',
+			dynamic_skip: 'f/p/skip',
+			retry: { constant: { attempts: 1 } },
+			// instance-side / identity — must all be dropped
+			email: 'owner@corp.com',
+			edited_by: 'admin',
+			is_draft: false,
+			paused_until: '2026-01-01',
+			enabled: true,
+			workspace_id: 'ws',
+			extra_perms: {},
+			permissioned_as: 'u/admin',
+			tag: 'gpu-worker',
+			// a field upstream might add tomorrow — dropped until admitted
+			some_future_field: 'x'
+		})
+		expect(Object.keys(out).sort()).toEqual([
+			'cron_version',
+			'dynamic_skip',
+			'no_flow_overlap',
+			'on_failure',
+			'retry',
+			'schedule'
+		])
+	})
+
+	it('appends shared behavior fields for non-schedule kinds', () => {
+		const out = portableTriggerConfig('mqtt', {
+			mqtt_resource_path: 'f/p/broker',
+			error_handler_path: 'f/p/handler',
+			retry: {},
+			permissioned_as: 'u/admin',
+			server_id: 'srv-1'
+		})
+		expect(Object.keys(out).sort()).toEqual(['error_handler_path', 'mqtt_resource_path', 'retry'])
+	})
+
+	it('returns empty for unknown kinds or missing config', () => {
+		expect(portableTriggerConfig('nope', { a: 1 })).toEqual({})
+		expect(portableTriggerConfig('mqtt', null)).toEqual({})
+	})
+})
+
+describe('triggerHandlerRefs', () => {
+	it('collects schedule handlers including dynamic_skip', () => {
+		expect(
+			triggerHandlerRefs(
+				trigger('schedule', {
+					on_failure: 'script/f/p/fail',
+					on_recovery: 'flow/f/p/recover',
+					dynamic_skip: 'f/p/skip'
+				})
+			)
+		).toEqual([
+			{ kind: 'script', path: 'f/p/fail' },
+			{ kind: 'flow', path: 'f/p/recover' },
+			{ kind: 'script', path: 'f/p/skip' }
+		])
+	})
+
+	it('collects bare error_handler_path for non-schedule kinds', () => {
+		expect(triggerHandlerRefs(trigger('mqtt', { error_handler_path: 'u/admin/handler' }))).toEqual([
+			{ kind: 'script', path: 'u/admin/handler' }
+		])
+	})
+
+	it('collects websocket runnable url and initial-message runnables', () => {
+		expect(
+			triggerHandlerRefs(
+				trigger('websocket', {
+					url: '$script:f/p/url_builder',
+					initial_messages: [
+						{ raw_message: 'hi' },
+						{ runnable_result: { path: 'f/p/greeter', args: {}, is_flow: true } }
+					]
+				})
+			)
+		).toEqual([
+			{ kind: 'script', path: 'f/p/url_builder' },
+			{ kind: 'flow', path: 'f/p/greeter' }
+		])
+	})
+})
+
+describe('triggerHandlerRefs edge cases', () => {
+	it('returns empty when no handlers are configured', () => {
+		expect(triggerHandlerRefs(trigger('schedule', { schedule: '0 0 * * * *', timezone: 'UTC' }))).toEqual([])
+		expect(triggerHandlerRefs(trigger('mqtt', { mqtt_resource_path: 'f/p/broker' }))).toEqual([])
+	})
+
+	it('collects on_success handlers', () => {
+		expect(triggerHandlerRefs(trigger('schedule', { on_success: 'script/f/p/notify' }))).toEqual([
+			{ kind: 'script', path: 'f/p/notify' }
+		])
+	})
+})
diff --git a/frontend/src/lib/components/triggers/workspaceTriggersList.ts b/frontend/src/lib/components/triggers/workspaceTriggersList.ts
new file mode 100644
index 0000000000..3299665e69
--- /dev/null
+++ b/frontend/src/lib/components/triggers/workspaceTriggersList.ts
@@ -0,0 +1,562 @@
+import {
+	HttpTriggerService,
+	WebsocketTriggerService,
+	KafkaTriggerService,
+	NatsTriggerService,
+	SqsTriggerService,
+	MqttTriggerService,
+	AmqpTriggerService,
+	GcpTriggerService,
+	AzureTriggerService,
+	PostgresTriggerService,
+	EmailTriggerService,
+	ScheduleService
+} from '$lib/gen'
+
+export type WorkspaceTriggerKind =
+	| 'http'
+	| 'websocket'
+	| 'schedule'
+	| 'kafka'
+	| 'nats'
+	| 'sqs'
+	| 'mqtt'
+	| 'amqp'
+	| 'gcp'
+	| 'azure'
+	| 'postgres'
+	| 'email'
+
+/** One trigger row, normalized across kinds; `config` keeps the raw API row. */
+export interface WorkspaceTrigger {
+	kind: WorkspaceTriggerKind
+	path: string
+	script_path: string
+	is_flow: boolean
+	summary?: string
+	config: Record<string, unknown>
+}
+
+/**
+ * Single source of truth for per-kind trigger knowledge shared by surfaces that
+ * handle every trigger kind (Hub publish/install, exports): display badge, the
+ * workspace list route, an optional post-import caveat, the config field
+ * holding the kind's resource path, whether the kind requires an EE license
+ * (its endpoints 404 on CE), and the list/create calls. Schedules have no
+ * `create` entry: they disable via `enabled` (not `mode`) and use a dedicated
+ * body shape, handled in `createWorkspaceTriggerDisabled`.
+ */
+export const TRIGGER_KINDS: Record<
+	WorkspaceTriggerKind,
+	{
+		badge: string
+		route: string
+		note?: string
+		resourceField?: string
+		eeOnly?: boolean
+		/**
+		 * Creating a trigger of this kind manages external cloud state (e.g.
+		 * Pub/Sub or Event Grid subscriptions) before storing it, even with
+		 * `mode: 'disabled'` — so it must never be auto-created from an import.
+		 */
+		provisionsOnCreate?: boolean
+		/**
+		 * The kind-specific config fields that cross the workspace boundary
+		 * (export to the Hub AND import from it) — an allowlist, so a field
+		 * added upstream is dropped until someone consciously admits it here,
+		 * instead of leaking to the Hub or being injectable from a crafted
+		 * export. Identity/ownership/runtime fields (path, permissioned_as,
+		 * email, enabled, server_id, provisioned subscription ids, …) must
+		 * never be listed. `tag` (schedules) is excluded deliberately: it names
+		 * a worker group of the source instance, and a foreign tag makes
+		 * imported jobs queue forever on a tag no worker serves. Non-schedule
+		 * kinds get the shared behavior fields (error handler, retry) appended
+		 * by `portableTriggerConfig`.
+		 */
+		configFields: string[]
+		list: (
+			workspace: string,
+			onError?: (message: string) => void
+		) => Promise<Array<Record<string, any>>>
+		create?: (workspace: string, requestBody: any) => Promise<unknown>
+	}
+> = {
+	http: {
+		configFields: [
+			'route_path',
+			'workspaced_route',
+			'http_method',
+			'authentication_resource_path',
+			'is_async',
+			'request_type',
+			'authentication_method',
+			'is_static_website',
+			'static_asset_config',
+			'wrap_body',
+			'raw_string'
+		],
+		badge: 'HTTP',
+		route: 'routes',
+		note: 'Webhook URL regenerates on import — re-register with the external service.',
+		resourceField: 'authentication_resource_path',
+		list: (workspace) => HttpTriggerService.listHttpTriggers({ workspace }),
+		create: (workspace, requestBody) =>
+			HttpTriggerService.createHttpTrigger({ workspace, requestBody })
+	},
+	websocket: {
+		configFields: [
+			'url',
+			'filters',
+			'filter_logic',
+			'initial_messages',
+			'url_runnable_args',
+			'can_return_message',
+			'can_return_error_result',
+			'heartbeat'
+		],
+		badge: 'WebSocket',
+		route: 'websocket_triggers',
+		note: 'Reconnect WebSocket auth after import if external service requires it.',
+		list: (workspace) => WebsocketTriggerService.listWebsocketTriggers({ workspace }),
+		create: (workspace, requestBody) =>
+			WebsocketTriggerService.createWebsocketTrigger({ workspace, requestBody })
+	},
+	schedule: {
+		configFields: [
+			'schedule',
+			'timezone',
+			'args',
+			'on_failure',
+			'on_failure_times',
+			'on_failure_exact',
+			'on_failure_extra_args',
+			'on_recovery',
+			'on_recovery_times',
+			'on_recovery_extra_args',
+			'on_success',
+			'on_success_extra_args',
+			'ws_error_handler_muted',
+			'retry',
+			'no_flow_overlap',
+			'cron_version',
+			'dynamic_skip'
+		],
+		badge: 'Schedule',
+		route: 'schedules',
+		// listSchedules returns slim rows (no args, handlers, cron_version, retry,
+		// no_flow_overlap) — resolve each to the full schedule so exported configs
+		// are complete. A schedule whose detail fetch fails is excluded and
+		// reported: exporting the slim row would silently publish a schedule with
+		// default behavior instead of its real settings.
+		list: async (workspace, onError) => {
+			const rows = await ScheduleService.listSchedules({ workspace })
+			const full = await Promise.all(
+				rows.map((r) =>
+					ScheduleService.getSchedule({ workspace, path: r.path }).catch((e: any) => {
+						onError?.(
+							`Failed to load schedule ${r.path} (${e?.message ?? e}) — excluded from the project`
+						)
+						return undefined
+					})
+				)
+			)
+			return full.filter((r): r is NonNullable<typeof r> => r !== undefined)
+		}
+	},
+	kafka: {
+		configFields: [
+			'kafka_resource_path',
+			'group_id',
+			'topics',
+			'filters',
+			'filter_logic',
+			'auto_offset_reset',
+			'auto_commit'
+		],
+		badge: 'Kafka',
+		route: 'kafka_triggers',
+		note: 'Verify Kafka broker access from the importing instance.',
+		resourceField: 'kafka_resource_path',
+		eeOnly: true,
+		list: (workspace) => KafkaTriggerService.listKafkaTriggers({ workspace }),
+		create: (workspace, requestBody) =>
+			KafkaTriggerService.createKafkaTrigger({ workspace, requestBody })
+	},
+	nats: {
+		configFields: [
+			'nats_resource_path',
+			'use_jetstream',
+			'stream_name',
+			'consumer_name',
+			'subjects'
+		],
+		badge: 'NATS',
+		route: 'nats_triggers',
+		note: 'Verify NATS connection from the importing instance.',
+		resourceField: 'nats_resource_path',
+		eeOnly: true,
+		list: (workspace) => NatsTriggerService.listNatsTriggers({ workspace }),
+		create: (workspace, requestBody) =>
+			NatsTriggerService.createNatsTrigger({ workspace, requestBody })
+	},
+	sqs: {
+		configFields: [
+			'queue_url',
+			'aws_auth_resource_type',
+			'aws_resource_path',
+			'message_attributes'
+		],
+		badge: 'SQS',
+		route: 'sqs_triggers',
+		resourceField: 'aws_resource_path',
+		eeOnly: true,
+		list: (workspace) => SqsTriggerService.listSqsTriggers({ workspace }),
+		create: (workspace, requestBody) =>
+			SqsTriggerService.createSqsTrigger({ workspace, requestBody })
+	},
+	mqtt: {
+		configFields: [
+			'mqtt_resource_path',
+			'subscribe_topics',
+			'client_id',
+			'v3_config',
+			'v5_config',
+			'client_version'
+		],
+		badge: 'MQTT',
+		route: 'mqtt_triggers',
+		resourceField: 'mqtt_resource_path',
+		list: (workspace) => MqttTriggerService.listMqttTriggers({ workspace }),
+		create: (workspace, requestBody) =>
+			MqttTriggerService.createMqttTrigger({ workspace, requestBody })
+	},
+	amqp: {
+		configFields: ['amqp_resource_path', 'queue_name', 'exchange', 'options'],
+		badge: 'AMQP',
+		route: 'amqp_triggers',
+		note: 'Verify AMQP broker access from the importing instance.',
+		resourceField: 'amqp_resource_path',
+		list: (workspace) => AmqpTriggerService.listAmqpTriggers({ workspace }),
+		create: (workspace, requestBody) =>
+			AmqpTriggerService.createAmqpTrigger({ workspace, requestBody })
+	},
+	gcp: {
+		configFields: ['gcp_resource_path', 'topic_id', 'delivery_type', 'subscription_mode'],
+		provisionsOnCreate: true,
+		badge: 'GCP Pub/Sub',
+		route: 'gcp_triggers',
+		note: 'Re-link GCP Pub/Sub subscription after import.',
+		resourceField: 'gcp_resource_path',
+		eeOnly: true,
+		list: (workspace) => GcpTriggerService.listGcpTriggers({ workspace }),
+		create: (workspace, requestBody) =>
+			GcpTriggerService.createGcpTrigger({ workspace, requestBody })
+	},
+	azure: {
+		configFields: [
+			'azure_resource_path',
+			'azure_mode',
+			'scope_resource_id',
+			'topic_name',
+			'event_type_filters'
+		],
+		provisionsOnCreate: true,
+		badge: 'Azure',
+		route: 'azure_triggers',
+		note: 'Re-link Azure Event Grid subscription after import.',
+		resourceField: 'azure_resource_path',
+		eeOnly: true,
+		list: (workspace) => AzureTriggerService.listAzureTriggers({ workspace }),
+		create: (workspace, requestBody) =>
+			AzureTriggerService.createAzureTrigger({ workspace, requestBody })
+	},
+	postgres: {
+		configFields: [
+			'postgres_resource_path',
+			'replication_slot_name',
+			'publication_name',
+			'publication'
+		],
+		badge: 'Postgres',
+		route: 'postgres_triggers',
+		resourceField: 'postgres_resource_path',
+		list: (workspace) => PostgresTriggerService.listPostgresTriggers({ workspace }),
+		create: (workspace, requestBody) =>
+			PostgresTriggerService.createPostgresTrigger({ workspace, requestBody })
+	},
+	email: {
+		configFields: ['local_part', 'workspaced_local_part'],
+		badge: 'Email',
+		route: 'email_triggers',
+		note: 'Email address regenerates on import.',
+		list: (workspace) => EmailTriggerService.listEmailTriggers({ workspace }),
+		create: (workspace, requestBody) =>
+			EmailTriggerService.createEmailTrigger({ workspace, requestBody })
+	}
+}
+
+export const WORKSPACE_TRIGGER_KINDS = Object.keys(TRIGGER_KINDS) as WorkspaceTriggerKind[]
+
+export interface WorkspaceTriggersListing {
+	triggers: WorkspaceTrigger[]
+	/**
+	 * Kinds whose discovery failed or was incomplete. A 404 on a kind's list
+	 * endpoint is NOT a failure (the instance doesn't have that trigger feature
+	 * compiled in); anything else means triggers of that kind may exist but
+	 * couldn't be enumerated, so consumers must not treat the listing as a
+	 * complete snapshot (e.g. publishing should be blocked until a retry).
+	 */
+	failedKinds: WorkspaceTriggerKind[]
+}
+
+/**
+ * List every trigger of every kind in the workspace, normalized. EE-only kinds
+ * are skipped without a license (their endpoints 404 on CE and would flood the
+ * console). Failures are reported through `opts.onError` and recorded in
+ * `failedKinds` rather than silently yielding an empty kind.
+ */
+export async function listAllWorkspaceTriggers(
+	workspace: string,
+	opts: { includeEeOnly: boolean; onError?: (message: string) => void }
+): Promise<WorkspaceTriggersListing> {
+	const failedKinds: WorkspaceTriggerKind[] = []
+	const perKind = await Promise.all(
+		WORKSPACE_TRIGGER_KINDS.map(async (kind) => {
+			const def = TRIGGER_KINDS[kind]
+			if (def.eeOnly && !opts.includeEeOnly) return []
+			let kindFailed = false
+			const reportError = (message: string) => {
+				kindFailed = true
+				opts.onError?.(message)
+			}
+			let rows: Array<Record<string, any>>
+			try {
+				rows = await def.list(workspace, reportError)
+			} catch (e: any) {
+				if (e?.status !== 404) {
+					reportError(`Failed to list ${kind} triggers: ${e?.message ?? e}`)
+				}
+				rows = []
+			}
+			if (kindFailed) failedKinds.push(kind)
+			return rows.map(
+				(r): WorkspaceTrigger => ({
+					kind,
+					path: r.path,
+					script_path: r.script_path,
+					is_flow: r.is_flow ?? false,
+					summary: r.summary,
+					config: r
+				})
+			)
+		})
+	)
+	return { triggers: perKind.flat(), failedKinds }
+}
+
+/**
+ * Create a trigger in its disabled state — the semantics differ per kind
+ * (schedules use `enabled: false`, every other kind uses `mode: 'disabled'`)
+ * and are encoded here once so importers can't get them wrong.
+ */
+export async function createWorkspaceTriggerDisabled(
+	workspace: string,
+	trigger: {
+		kind: string
+		path: string
+		script_path: string
+		is_flow: boolean
+		summary?: string | null
+		config?: Record<string, any> | null
+	},
+	opts: { hasEeLicense: boolean }
+): Promise<unknown> {
+	const def = TRIGGER_KINDS[trigger.kind as WorkspaceTriggerKind]
+	if (!def) throw new Error(`trigger kind '${trigger.kind}' not supported yet`)
+	if (def.eeOnly && !opts.hasEeLicense) {
+		throw new Error(`trigger kind '${trigger.kind}' requires Enterprise`)
+	}
+	if (def.provisionsOnCreate) {
+		throw new Error(
+			`${def.badge} triggers manage cloud subscriptions at creation — fill in the imported resource, then re-create this trigger manually`
+		)
+	}
+	// Remote input: only the allowlisted portable slice may reach the create call.
+	const config = portableTriggerConfig(trigger.kind, trigger.config)
+	if (trigger.kind === 'schedule') {
+		// Spread the portable config first so behavioral settings survive the
+		// import (cron_version, retry, failure/recovery/success handlers,
+		// no_flow_overlap, …) — restoring only cron+timezone would silently
+		// change the schedule's semantics once re-enabled.
+		return ScheduleService.createSchedule({
+			workspace,
+			requestBody: {
+				...config,
+				path: trigger.path,
+				schedule: (config.schedule as string) ?? '0 0 * * * *',
+				timezone: (config.timezone as string) ?? 'UTC',
+				script_path: trigger.script_path,
+				is_flow: trigger.is_flow,
+				enabled: false,
+				args: (config.args as any) ?? {},
+				summary: trigger.summary ?? null
+			}
+		})
+	}
+	// `config` holds only allowlisted kind-specific fields; explicit fields win.
+	return def.create!(workspace, {
+		...config,
+		path: trigger.path,
+		script_path: trigger.script_path,
+		is_flow: trigger.is_flow,
+		summary: trigger.summary ?? null,
+		mode: 'disabled'
+	})
+}
+
+/** The resource path a trigger's config points at, if its kind has one. */
+export function triggerResourcePath(t: WorkspaceTrigger): string | undefined {
+	const field = TRIGGER_KINDS[t.kind]?.resourceField
+	const v = field ? (t.config as any)?.[field] : undefined
+	return typeof v === 'string' && v !== '' ? v : undefined
+}
+
+/**
+ * Runnables a trigger's config references beyond its primary target, so they
+ * can be bundled alongside it: `error_handler_path` (bare script path) for
+ * non-schedule kinds, and schedules' `on_failure`/`on_recovery`/`on_success`
+ * (`script/<path>` or `flow/<path>`) plus `dynamic_skip` (bare script path —
+ * schedule creation refuses a dynamic_skip whose script doesn't exist, so an
+ * unbundled one would make the import fail).
+ */
+export function triggerHandlerRefs(
+	t: WorkspaceTrigger
+): Array<{ kind: 'script' | 'flow'; path: string }> {
+	const c = t.config as any
+	const out: Array<{ kind: 'script' | 'flow'; path: string }> = []
+	if (t.kind === 'schedule') {
+		for (const field of ['on_failure', 'on_recovery', 'on_success']) {
+			const v = c?.[field]
+			const m = typeof v === 'string' ? /^(script|flow)\/(.+)$/.exec(v) : null
+			if (m) out.push({ kind: m[1] as 'script' | 'flow', path: m[2] })
+		}
+		if (typeof c?.dynamic_skip === 'string' && c.dynamic_skip !== '') {
+			out.push({ kind: 'script', path: c.dynamic_skip })
+		}
+	} else {
+		if (typeof c?.error_handler_path === 'string' && c.error_handler_path !== '') {
+			out.push({ kind: 'script', path: c.error_handler_path })
+		}
+		if (t.kind === 'websocket') {
+			// The URL itself can be a runnable ($script:<path> / $flow:<path>), and
+			// initial messages can be runnable results.
+			const um = typeof c?.url === 'string' ? /^\$(script|flow):(.+)$/.exec(c.url) : null
+			if (um) out.push({ kind: um[1] as 'script' | 'flow', path: um[2] })
+			for (const msg of Array.isArray(c?.initial_messages) ? c.initial_messages : []) {
+				const rr = msg?.runnable_result
+				if (rr && typeof rr.path === 'string' && rr.path !== '') {
+					out.push({ kind: rr.is_flow ? 'flow' : 'script', path: rr.path })
+				}
+			}
+		}
+	}
+	return out
+}
+
+// Instance-side metadata that has no meaning outside the source workspace
+// (ownership, runtime state). Anything `last_*` or `captured_*` is also
+// dropped. Error handlers (error_handler_path/args, schedules' on_* fields)
+// are functional config and stay: their runnables are bundled with the
+// project and the paths relocated.
+// Portable behavior fields shared by every non-schedule kind (schedules carry
+// their own handler fields in configFields).
+const COMMON_CONFIG_FIELDS = ['error_handler_path', 'error_handler_args', 'retry']
+
+/**
+ * The portable slice of a trigger config — the ONLY fields that cross the
+ * workspace boundary, in either direction. Applied on export (what reaches
+ * the Hub) and on import (what a Hub export may feed into a create call), so
+ * an upstream field addition can't leak out, and a crafted export can't
+ * inject non-allowlisted fields like `permissioned_as`.
+ */
+export function portableTriggerConfig(
+	kind: string,
+	config: Record<string, unknown> | null | undefined
+): Record<string, unknown> {
+	const def = TRIGGER_KINDS[kind as WorkspaceTriggerKind]
+	if (!def || !config) return {}
+	const fields =
+		kind === 'schedule' ? def.configFields : [...def.configFields, ...COMMON_CONFIG_FIELDS]
+	const out: Record<string, unknown> = {}
+	for (const f of fields) {
+		if (config[f] !== undefined) out[f] = config[f]
+	}
+	return out
+}
+
+/** Human-readable config facts per kind, for detail panes. */
+export function triggerDetails(t: WorkspaceTrigger): Array<{ label: string; value: string }> {
+	const c = t.config as any
+	const out: Array<{ label: string; value: string }> = []
+	const push = (label: string, v: any) => {
+		if (v != null && v !== '') out.push({ label, value: String(v) })
+	}
+	switch (t.kind) {
+		case 'http':
+			push('Route', `${(c.http_method ?? '').toUpperCase()} /${c.route_path ?? ''}`)
+			push('Auth', c.authentication_method)
+			break
+		case 'schedule':
+			push('Cron', c.schedule)
+			push('Timezone', c.timezone)
+			break
+		case 'websocket':
+			push('URL', c.url)
+			break
+		case 'kafka':
+			push('Resource', c.kafka_resource_path)
+			push('Group', c.group_id)
+			push('Topics', (Array.isArray(c.topics) ? c.topics : []).join(', '))
+			break
+		case 'nats':
+			push('Resource', c.nats_resource_path)
+			push('Subjects', (Array.isArray(c.subjects) ? c.subjects : []).join(', '))
+			push('Jetstream', c.use_jetstream)
+			break
+		case 'sqs':
+			push('Queue', c.queue_url)
+			push('Resource', c.aws_resource_path)
+			break
+		case 'mqtt':
+			push('Resource', c.mqtt_resource_path)
+			push(
+				'Topics',
+				(Array.isArray(c.subscribe_topics) ? c.subscribe_topics : [])
+					.map((x: any) => x?.topic ?? x)
+					.join(', ')
+			)
+			break
+		case 'amqp':
+			push('Resource', c.amqp_resource_path)
+			push('Queue', c.queue_name)
+			break
+		case 'gcp':
+			push('Resource', c.gcp_resource_path)
+			push('Topic', c.topic_id)
+			push('Subscription', c.subscription_id)
+			break
+		case 'azure':
+			push('Resource', c.azure_resource_path)
+			push('Scope', c.scope_resource_id)
+			push('Subscription', c.subscription_name)
+			break
+		case 'postgres':
+			push('Resource', c.postgres_resource_path)
+			push('Publication', c.publication_name)
+			break
+		case 'email':
+			push('Email prefix', c.local_part ? `${c.local_part}@…` : undefined)
+			break
+	}
+	return out
+}
diff --git a/frontend/src/lib/components/workspaceSettings/DeployToHub.svelte b/frontend/src/lib/components/workspaceSettings/DeployToHub.svelte
new file mode 100644
index 0000000000..cf2cd3ceb0
--- /dev/null
+++ b/frontend/src/lib/components/workspaceSettings/DeployToHub.svelte
@@ -0,0 +1,1031 @@
+<script lang="ts">
+	import { base } from '$lib/base'
+	import { Badge, Button, Drawer, DrawerContent } from '$lib/components/common'
+	import WorkspaceDeployLayout from '$lib/components/WorkspaceDeployLayout.svelte'
+	import SchemaForm from '$lib/components/SchemaForm.svelte'
+	import Tooltip from '$lib/components/Tooltip.svelte'
+	import TextInput from '$lib/components/text_input/TextInput.svelte'
+	import { sendUserToast } from '$lib/toast'
+	import { workspaceStore, hubBaseUrlStore, enterpriseLicense } from '$lib/stores'
+	import { displayDate } from '$lib/utils'
+	import {
+		useDeployToHubSession,
+		canRecord,
+		canShareAsIframe,
+		sanitizeSlug,
+		isValidSlug,
+		type DeployItem
+	} from './deployToHubSession.svelte'
+	import { TRIGGER_KINDS, triggerDetails } from '$lib/components/triggers/workspaceTriggersList'
+	import Toggle from '../Toggle.svelte'
+	import MigrationSqlEditor from './MigrationSqlEditor.svelte'
+	import {
+		Check,
+		Cloud,
+		Code2,
+		Copy,
+		Database,
+		ExternalLink,
+		Globe,
+		Info,
+		LayoutDashboard,
+		Loader2,
+		Play,
+		RotateCcw,
+		TriangleAlert,
+		X,
+		Zap
+	} from 'lucide-svelte'
+	import BarsStaggered from '$lib/components/icons/BarsStaggered.svelte'
+	import Popover from '$lib/components/Popover.svelte'
+
+	// Folder name (no `f/`) this project is scoped to; provided by the /folders launcher.
+	let { folder: folderProp }: { folder: string } = $props()
+
+	// All deploy state lives in a session keyed by (workspace, folder): switching
+	// either replaces the instance (and the {#key} below remounts the UI, closing
+	// drawers), so nothing here needs resetting by hand.
+	const deployHub = useDeployToHubSession({
+		workspace: () => $workspaceStore,
+		folder: () => folderProp,
+		hasEeLicense: () => !!$enterpriseLicense
+	})
+
+	let recordDrawer = $state<Drawer | undefined>()
+	let publishDrawer = $state<Drawer | undefined>()
+	let resourceDrawer = $state<Drawer | undefined>()
+	let triggerDrawer = $state<Drawer | undefined>()
+	let bundleDrawer = $state<Drawer | undefined>()
+
+	let hubUrl = $derived(
+		`${$hubBaseUrlStore.replace(/\/+$/, '')}/projects/${deployHub.session?.hubSlug ?? ''}`
+	)
+
+	// The session is UI-free; the component owns drawer open/close around its
+	// operations.
+	function openBundle() {
+		const s = deployHub.session
+		if (!s || s.triggersLoading) return
+		s.prepareBundle()
+		bundleDrawer?.openDrawer()
+	}
+	async function confirmBundle() {
+		await deployHub.session?.publishBundle(() => bundleDrawer?.closeDrawer())
+	}
+	function openRecord(it: DeployItem) {
+		recordDrawer?.openDrawer()
+		void deployHub.session?.openRecord(it)
+	}
+	async function saveRecording() {
+		if (await deployHub.session?.saveRecording()) recordDrawer?.closeDrawer()
+	}
+	function openPublish(it: DeployItem) {
+		const s = deployHub.session
+		if (!s) return
+		s.publishTarget = it
+		publishDrawer?.openDrawer()
+	}
+	async function confirmPublish() {
+		if (await deployHub.session?.confirmPublish()) publishDrawer?.closeDrawer()
+	}
+	async function copyIframeSnippet(url: string) {
+		const snippet = `<iframe src="${url}" width="100%" height="600" frameborder="0"></iframe>`
+		try {
+			await navigator.clipboard.writeText(snippet)
+			sendUserToast('Iframe snippet copied to clipboard')
+		} catch {
+			sendUserToast('Failed to copy snippet', true)
+		}
+	}
+</script>
+
+{#if deployHub.session}
+	{#key deployHub.session}
+		{@const s = deployHub.session}
+		<div>
+			<WorkspaceDeployLayout
+				items={s.items}
+				selectedItems={s.selectedItemKeys}
+				deploymentStatus={s.deploymentStatus}
+				hideSelection={s.phase !== 'predeploy'}
+				allSelected={s.allSelected}
+				onToggleItem={s.toggleItem}
+				onSelectAll={s.selectAll}
+				onDeselectAll={s.deselectAll}
+				emptyMessage={s.loading ? 'Loading project items…' : 'No items to publish'}
+			>
+				{#snippet header()}
+					{@const stepNum =
+						s.phase === 'predeploy'
+							? 1
+							: s.phase === 'draft'
+								? 2
+								: s.phase === 'under_review'
+									? 3
+									: 4}
+					<div class="flex flex-col gap-2 w-full pb-4">
+						<ol
+							class="flex flex-col gap-2 rounded-md border bg-surface-secondary p-3 text-xs text-secondary"
+						>
+							<span class="text-sm font-semibold text-primary">
+								How to publish your project to the Hub
+							</span>
+							<li class={stepNum === 1 ? 'text-primary' : stepNum > 1 ? 'opacity-60' : ''}>
+								<span class="font-mono text-emphasis">{stepNum > 1 ? '✓' : '1.'}</span>
+								<span class="font-semibold text-primary">Bundle your project</span> — creates a draft
+								on the Hub with every selected script, flow, app and resource from this folder.
+							</li>
+							<li
+								class={stepNum === 2 ? 'text-primary' : stepNum > 2 ? 'opacity-60' : 'opacity-40'}
+							>
+								<span class="font-mono text-emphasis">{stepNum > 2 ? '✓' : '2.'}</span>
+								<span class="font-semibold text-primary">Generate iframes &amp; recordings</span> — share
+								public apps as iframes and capture one execution per script/flow.
+							</li>
+							<li
+								class={stepNum === 3 ? 'text-primary' : stepNum > 3 ? 'opacity-60' : 'opacity-40'}
+							>
+								<span class="font-mono text-emphasis">{stepNum > 3 ? '✓' : '3.'}</span>
+								<span class="font-semibold text-primary">Submit for review</span> — send the bundle for
+								approval.
+							</li>
+						</ol>
+						<div class="flex flex-wrap items-center gap-2 pt-4">
+							{#if s.phase === 'predeploy'}
+								<span class="text-sm font-semibold text-primary">
+									Step 1: Bundle your project
+								</span>
+							{:else if s.phase === 'draft'}
+								<span class="text-sm font-semibold text-primary">
+									Step 2: Generate iframes &amp; recordings
+								</span>
+							{:else if s.phase === 'under_review'}
+								<span class="text-sm font-semibold text-primary">Step 3: Awaiting review</span>
+							{:else}
+								<span class="text-sm font-semibold text-primary">Live on the Hub</span>
+							{/if}
+							{#if s.phase !== 'predeploy'}
+								<Badge color="transparent" class="font-semibold">
+									<Cloud size={14} class="mr-1" />
+									<span class="text-secondary">on Hub:</span>
+									<span class="text-emphasis">{s.hubName || s.hubSlug}</span>
+								</Badge>
+								<a
+									href={hubUrl}
+									target="_blank"
+									rel="noopener noreferrer"
+									class="inline-flex items-center gap-1 text-xs text-blue-600 dark:text-blue-400 hover:underline"
+								>
+									<ExternalLink size={12} /> Open in Hub
+								</a>
+							{/if}
+							<div class="ml-auto flex items-center gap-2">
+								{#if s.phase === 'predeploy'}
+									<Button
+										variant="accent"
+										loading={s.deploying || s.triggersLoading}
+										disabled={s.selectedItems.length === 0 ||
+											s.triggersLoading ||
+											s.triggerDiscoveryFailed}
+										startIcon={{ icon: Cloud }}
+										onclick={openBundle}
+									>
+										Create Hub draft ({s.selectedItems.length})
+									</Button>
+								{:else if s.phase === 'draft'}
+									<Button
+										variant="accent"
+										loading={s.submitting}
+										startIcon={{ icon: Check }}
+										onclick={s.submitForReview}
+									>
+										Submit for review
+									</Button>
+								{:else if s.phase === 'under_review'}
+									<Button
+										size="xs"
+										variant="subtle"
+										loading={s.syncing}
+										startIcon={{ icon: RotateCcw }}
+										iconOnly
+										title="Refresh review status"
+										onclick={s.syncWithHub}
+									/>
+								{:else}
+									<Button
+										variant="accent"
+										startIcon={{ icon: RotateCcw }}
+										onclick={s.startNewDraft}
+									>
+										New draft
+									</Button>
+								{/if}
+							</div>
+						</div>
+						{#if s.phase === 'predeploy'}
+							<div class="flex flex-col gap-1 pb-3">
+								<span class="text-xs text-secondary">
+									Bundling creates a draft project on the Hub from the selected scripts, flows and
+									apps of <span class="font-mono">{s.selectedFolder}/</span>.
+									{s.selectedItems.length} of {s.filteredWorkspaceItems.length} items selected.
+								</span>
+							</div>
+							<div class="flex flex-wrap items-center gap-2 text-xs">
+								<span class="font-semibold text-primary shrink-0">
+									Resource dependencies
+									{#if s.detectingResources}
+										<Loader2 size={11} class="inline animate-spin text-hint" />
+									{:else}
+										<span class="text-hint font-normal">({s.dependencyTypes.length})</span>
+									{/if}
+									<Tooltip>
+										Resource types the selected items depend on (whether passed as inputs or
+										referenced by a hardcoded path). Synced to the Hub so a fork knows what
+										credentials it needs to fill.
+									</Tooltip>
+								</span>
+								{#if s.dependencyTypes.length === 0}
+									<span class="text-[11px] text-hint">
+										No resource references detected in the current selection.
+									</span>
+								{:else}
+									{#each s.dependencyTypes as r (r.resource_type)}
+										<span
+											class="inline-flex items-center gap-1 rounded border px-1.5 py-0.5 font-mono text-[11px] text-secondary {r.hasHardcoded
+												? 'border-amber-300 bg-amber-50 dark:border-amber-800 dark:bg-amber-950/40'
+												: 'bg-surface'}"
+										>
+											{r.resource_type}
+										</span>
+									{/each}
+									<Button
+										variant="subtle"
+										unifiedSize="sm"
+										wrapperClasses="ml-auto"
+										onclick={() => resourceDrawer?.openDrawer()}
+									>
+										View details
+									</Button>
+								{/if}
+							</div>
+							<div class="flex flex-wrap items-center gap-2 text-xs">
+								<span class="font-semibold text-primary shrink-0">
+									Data table dependencies
+									{#if s.detectingDatatables}
+										<Loader2 size={11} class="inline animate-spin text-hint" />
+									{:else}
+										<span class="text-hint font-normal">({s.datatableUsage.size})</span>
+									{/if}
+									<Tooltip>
+										Data tables the selected items read or write. A best-effort CREATE TABLE
+										migration for these is generated in the bundle step and shipped with the
+										project, so a fork can recreate the tables it needs.
+									</Tooltip>
+								</span>
+								{#if s.datatableUsage.size === 0}
+									<span class="text-[11px] text-hint">
+										No data table usage detected in the current selection.
+									</span>
+								{:else}
+									{#each [...s.datatableUsage] as [dt, tables] (dt)}
+										<span
+											class="inline-flex items-center gap-1 rounded border bg-surface px-1.5 py-0.5 font-mono text-[11px] text-secondary"
+										>
+											{dt}
+											{#if tables.size > 0}
+												<span class="text-hint">×{tables.size}</span>
+											{/if}
+										</span>
+									{/each}
+								{/if}
+							</div>
+						{/if}
+						{#if s.phase === 'draft'}
+							<div class="flex flex-col gap-1 pb-3">
+								<span class="text-xs text-secondary">
+									A recording captures one real run of a script or flow — inputs, logs, step outputs
+									and result — replayable on the Hub so visitors see it work before forking. Public
+									apps can also be shared as live iframes. Optional, but recommended.
+								</span>
+							</div>
+						{/if}
+						{#if s.phase === 'predeploy'}
+							<div class="flex flex-wrap items-center gap-2 text-xs">
+								<span class="font-semibold text-primary shrink-0">
+									Triggers
+									{#if s.triggersLoading}
+										<Loader2 size={11} class="inline animate-spin text-hint" />
+									{:else}
+										<span class="text-hint font-normal">({s.relevantTriggers.length})</span>
+									{/if}
+								</span>
+								{#if s.triggerDiscoveryFailed}
+									<span class="text-[11px] text-red-600 dark:text-red-400">
+										Some trigger kinds could not be listed — publishing is disabled so triggers
+										aren't silently left out of the bundle.
+									</span>
+									<Button
+										size="xs"
+										variant="subtle"
+										loading={s.triggersLoading}
+										disabled={s.triggersLoading}
+										startIcon={{ icon: RotateCcw }}
+										onclick={() => s.reloadTriggers()}
+									>
+										Retry
+									</Button>
+								{:else if s.relevantTriggers.length === 0}
+									<span class="text-[11px] text-hint"
+										>No triggers reference the selected items.</span
+									>
+								{:else}
+									{#each s.triggersByKind as [kind, triggers] (kind)}
+										<span
+											class="inline-flex items-center gap-1 rounded border bg-surface px-1.5 py-0.5 font-mono text-[11px] text-secondary"
+										>
+											{TRIGGER_KINDS[kind].badge}
+											<span class="text-hint">×{triggers.length}</span>
+										</span>
+									{/each}
+									<Button
+										variant="subtle"
+										unifiedSize="sm"
+										wrapperClasses="ml-auto"
+										onclick={() => triggerDrawer?.openDrawer()}
+									>
+										View details
+									</Button>
+								{/if}
+							</div>
+						{/if}
+						{#if s.phase === 'under_review'}
+							<div
+								class="flex items-start gap-2 rounded-md border border-blue-300 bg-blue-50 p-3 text-xs text-blue-900 dark:border-blue-800 dark:bg-blue-950/40 dark:text-blue-100"
+							>
+								<TriangleAlert size={14} class="mt-0.5 shrink-0 text-blue-600 dark:text-blue-400" />
+								<div class="flex flex-col gap-1">
+									<span class="font-semibold">Locked while under review</span>
+									<span>
+										The Windmill team is reviewing this submission. Editing, recording, and sharing
+										actions are disabled. Estimated turnaround: 1-2 business days.
+									</span>
+								</div>
+							</div>
+						{/if}
+						{#if s.phase === 'draft'}
+							{@const recordedCount = s.recordableItems.filter((i) => i.rec === 'recorded').length}
+							{@const pct = s.recordableItems.length
+								? Math.round((recordedCount / s.recordableItems.length) * 100)
+								: 0}
+							<div class="flex items-center gap-2 self-end text-[11px] text-tertiary">
+								<span class="font-mono">{recordedCount}/{s.recordableItems.length}</span>
+								<div class="h-1 w-24 overflow-hidden rounded bg-surface-tertiary">
+									<div
+										class="h-full {s.allRecorded ? 'bg-green-500' : 'bg-hint'} transition-all"
+										style="width: {pct}%"
+									></div>
+								</div>
+								<span class={s.allRecorded ? 'text-green-700 dark:text-green-400' : 'text-hint'}>
+									{s.allRecorded ? 'Full recordings' : 'Recordings recommended'}
+								</span>
+							</div>
+						{/if}
+					</div>
+				{/snippet}
+
+				{#snippet itemSummary(item)}
+					{@const it = item as DeployItem}
+					<span class="truncate">
+						{it.summary?.trim() || it.path}
+					</span>
+				{/snippet}
+
+				{#snippet itemActions(item)}
+					{@const it = item as DeployItem}
+					{#if s.phase !== 'predeploy' && canRecord(it.kind)}
+						{#if it.rec === 'recorded'}
+							<Badge color="green" size="xs">
+								<Check size={10} class="mr-0.5" />Recorded
+							</Badge>
+							{#if s.recordings[it.key]}
+								<a
+									href={`/run/${s.recordings[it.key]}?workspace=${s.workspace}`}
+									target="_blank"
+									rel="noopener noreferrer"
+									class="inline-flex items-center gap-1 text-xs text-blue-600 dark:text-blue-400 hover:underline"
+								>
+									<ExternalLink size={12} /> See recording
+								</a>
+							{/if}
+							{#if s.phase === 'draft'}
+								<Button
+									size="xs"
+									variant="subtle"
+									startIcon={{ icon: RotateCcw }}
+									onclick={() => openRecord(it)}
+								>
+									Re-record
+								</Button>
+							{/if}
+						{:else if s.phase === 'draft'}
+							<Badge color="yellow" size="xs">No recording</Badge>
+							<Button
+								size="xs"
+								variant="subtle"
+								startIcon={{ icon: Play }}
+								onclick={() => openRecord(it)}
+							>
+								Add recording
+							</Button>
+						{:else}
+							<Badge color="yellow" size="xs">No recording</Badge>
+						{/if}
+					{/if}
+					{#if s.phase !== 'predeploy' && canShareAsIframe(it)}
+						{#if it.published}
+							<Badge color="green" size="xs">
+								<Globe size={10} class="mr-0.5" />Public
+							</Badge>
+							{#if it.publicUrl}
+								<a
+									href={it.publicUrl}
+									target="_blank"
+									rel="noopener noreferrer"
+									class="inline-flex items-center gap-1 text-xs text-blue-600 dark:text-blue-400 hover:underline"
+								>
+									<ExternalLink size={12} /> Open
+								</a>
+								<Button
+									size="xs"
+									variant="subtle"
+									startIcon={{ icon: Copy }}
+									onclick={() => copyIframeSnippet(it.publicUrl!)}
+								>
+									Copy iframe
+								</Button>
+							{:else if s.phase !== 'under_review'}
+								<!-- Public but its URL didn't resolve: offer a retry, keep Unpublish. -->
+								<Button
+									size="xs"
+									variant="subtle"
+									startIcon={{ icon: RotateCcw }}
+									onclick={() => openPublish(it)}
+								>
+									Retry link
+								</Button>
+							{/if}
+							{#if s.phase !== 'under_review'}
+								<Button size="xs" variant="subtle" onclick={() => s.unpublishApp(it)}
+									>Unpublish</Button
+								>
+							{/if}
+						{:else if s.phase !== 'under_review'}
+							<Button
+								size="xs"
+								variant="subtle"
+								startIcon={{ icon: Globe }}
+								onclick={() => openPublish(it)}
+							>
+								Share as iframe
+							</Button>
+						{/if}
+					{/if}
+				{/snippet}
+
+				{#snippet footer()}
+					<div class="flex items-center justify-end gap-3">
+						{#if s.phase === 'predeploy'}
+							<span class="text-[11px] text-hint">
+								Select the items to include — all selected by default.
+							</span>
+						{:else if s.phase === 'draft'}
+							<span class="text-[11px] text-hint">
+								{#if s.allRecorded}
+									All scripts and flows have a recording — best chance of approval and featuring.
+								{:else}
+									{s.recordableItems.filter((i) => i.rec === 'recorded').length} of {s
+										.recordableItems.length}
+									recorded. Bundles with full recordings get approved faster and featured on the public
+									Hub.
+								{/if}
+							</span>
+						{:else if s.phase === 'under_review'}
+							<span class="text-[11px] text-hint">
+								Waiting for the Windmill team to review the submission.
+							</span>
+						{:else}
+							<span class="text-[11px] text-hint"> Iterate further by starting a new draft. </span>
+						{/if}
+					</div>
+				{/snippet}
+			</WorkspaceDeployLayout>
+		</div>
+
+		<Drawer bind:this={recordDrawer} size="600px" on:close={s.cancelRecordRun}>
+			<DrawerContent
+				title={s.recordTarget ? `Record — ${s.recordTarget.path}` : 'Record'}
+				on:close={() => recordDrawer?.closeDrawer()}
+			>
+				<div class="flex flex-col gap-3">
+					<p class="text-xs text-secondary">
+						Run this {s.recordTarget?.kind} once with the inputs below. The full execution — args, logs,
+						intermediate step outputs and final result — is saved as a <b>replayable recording</b>
+						shown on the Hub page. Visitors can step through it to see how the {s.recordTarget
+							?.kind} works without running anything themselves.
+					</p>
+
+					{#if s.runState !== 'idle'}
+						<div
+							class="sticky top-0 z-10 flex flex-col gap-2 rounded-md border bg-surface-secondary p-3 shadow-sm"
+						>
+							<div class="flex items-center gap-2 text-sm">
+								{#if s.runState === 'running'}
+									<Loader2 size={14} class="animate-spin text-blue-600 dark:text-blue-400" />
+									<span class="font-semibold">Running…</span>
+								{:else if s.runState === 'success'}
+									<Check size={14} class="text-green-600 dark:text-green-400" />
+									<span class="font-semibold text-green-700 dark:text-green-300">
+										Execution succeeded
+									</span>
+								{:else}
+									<X size={14} class="text-red-600 dark:text-red-400" />
+									<span class="font-semibold text-red-700 dark:text-red-300">Execution failed</span>
+								{/if}
+								{#if s.runJobId}
+									<a
+										href={`/run/${s.runJobId}?workspace=${s.workspace}`}
+										target="_blank"
+										rel="noopener noreferrer"
+										class="inline-flex items-center gap-1 text-xs text-blue-600 dark:text-blue-400 hover:underline"
+									>
+										<ExternalLink size={12} /> Open job
+									</a>
+								{/if}
+							</div>
+							{#if s.runState === 'success' && s.runResult !== undefined}
+								<div class="flex flex-col gap-1 text-xs">
+									<span class="text-secondary">Result preview:</span>
+									<pre class="max-h-40 overflow-auto rounded bg-surface p-2 font-mono text-[11px]"
+										>{JSON.stringify(s.runResult, null, 2)}</pre
+									>
+								</div>
+							{:else if s.runState === 'failed' && s.runError}
+								<pre
+									class="max-h-40 overflow-auto rounded bg-surface p-2 font-mono text-[11px] text-red-700 dark:text-red-300"
+									>{s.runError}</pre
+								>
+							{/if}
+							{#if s.runState === 'success'}
+								<div
+									class="mt-1 flex items-center justify-between gap-3 rounded-md border border-green-300 bg-green-50 p-2 dark:border-green-800 dark:bg-green-950/40"
+								>
+									<span class="text-xs text-green-900 dark:text-green-100">
+										Looks good? Save this run as the Hub recording.
+									</span>
+									<Button
+										size="xs"
+										variant="accent"
+										startIcon={{ icon: Check }}
+										onclick={saveRecording}
+									>
+										Save as recording
+									</Button>
+								</div>
+							{:else if s.runState === 'failed'}
+								<span class="text-[11px] text-hint">
+									Fix inputs and try again. Only successful runs can be saved as a recording.
+								</span>
+							{/if}
+						</div>
+					{/if}
+
+					{#if s.recordSchemaLoading}
+						<span class="text-xs text-hint">Loading schema…</span>
+					{:else}
+						<SchemaForm
+							bind:args={s.recordArgs}
+							bind:isValid={s.recordValid}
+							schema={s.recordSchema}
+						/>
+					{/if}
+				</div>
+				{#snippet actions()}
+					{#if s.runState === 'success'}
+						<Button variant="default" startIcon={{ icon: RotateCcw }} onclick={s.runJob}
+							>Re-run</Button
+						>
+						<Button variant="accent" startIcon={{ icon: Check }} onclick={saveRecording}>
+							Save as recording
+						</Button>
+					{:else}
+						<Button
+							variant="accent"
+							loading={s.runState === 'running'}
+							disabled={!s.recordValid || s.recordSchemaLoading}
+							startIcon={{ icon: Play }}
+							onclick={s.runJob}
+						>
+							{s.runState === 'failed' ? 'Re-run' : 'Run'}
+						</Button>
+					{/if}
+				{/snippet}
+			</DrawerContent>
+		</Drawer>
+
+		<Drawer bind:this={publishDrawer} size="600px">
+			<DrawerContent
+				title={s.publishTarget ? `Share as iframe — ${s.publishTarget.path}` : 'Share as iframe'}
+				on:close={() => publishDrawer?.closeDrawer()}
+			>
+				<div class="flex flex-col gap-4">
+					<p class="text-xs text-secondary">
+						Expose <span class="font-mono text-emphasis">{s.publishTarget?.path}</span> at a public URL
+						so it can be embedded as an iframe (e.g. on the Hub, a docs page, or your own site). Anyone
+						with the URL will be able to interact with it.
+					</p>
+
+					<div class="flex flex-col gap-2 rounded-md border bg-surface-secondary p-3">
+						<div class="flex items-center gap-2">
+							<TriangleAlert
+								size={14}
+								class={s.workspaceRateLimit
+									? 'text-secondary'
+									: 'text-orange-600 dark:text-orange-400'}
+							/>
+							<span class="text-sm font-semibold">Rate limit (workspace-wide)</span>
+							<Tooltip>
+								Caps public app executions per minute per server. Applies to all public apps in this
+								workspace.
+							</Tooltip>
+						</div>
+						{#if s.workspaceRateLimit && s.workspaceRateLimit > 0}
+							<span class="text-xs text-secondary">
+								Currently <span class="font-mono text-emphasis">{s.workspaceRateLimit}</span> executions
+								/ minute / server.
+							</span>
+						{:else}
+							<span class="text-xs text-orange-700 dark:text-orange-300">
+								No rate limit configured — anyone with the URL can hit this app at any rate.
+							</span>
+						{/if}
+						<a
+							href="{base}/workspace_settings?tab=default_app"
+							class="text-[11px] text-blue-600 underline"
+							onclick={() => publishDrawer?.closeDrawer()}
+						>
+							Edit in Workspace settings → Apps
+						</a>
+					</div>
+				</div>
+				{#snippet actions()}
+					<Button variant="default" onclick={() => publishDrawer?.closeDrawer()}>Cancel</Button>
+					<Button
+						variant="accent"
+						loading={s.publishing}
+						startIcon={{ icon: Globe }}
+						onclick={confirmPublish}
+					>
+						Generate iframe
+					</Button>
+				{/snippet}
+			</DrawerContent>
+		</Drawer>
+
+		<Drawer bind:this={resourceDrawer} size="640px">
+			<DrawerContent title="Resource dependencies" on:close={() => resourceDrawer?.closeDrawer()}>
+				<div class="flex flex-col gap-4">
+					<p class="text-xs text-secondary">
+						Resource types the selected items depend on. Each is synced to the Hub so a fork knows
+						what credentials it needs to fill. <span class="font-semibold">Input</span> means the
+						item takes the resource as a parameter;
+						<span class="font-semibold">hardcoded path</span> means the item pins a specific resource
+						path in its code.
+					</p>
+					{#if s.dependencyTypes.length === 0}
+						<span class="text-xs text-hint">No resource references in the current selection.</span>
+					{:else}
+						{#each s.dependencyTypes as r (r.resource_type)}
+							<div class="flex flex-col gap-2 rounded-md border bg-surface-secondary p-3">
+								<div class="flex items-center gap-2 border-b pb-2">
+									<span
+										class="rounded border px-1.5 py-0.5 font-mono text-xs text-primary {r.hasHardcoded
+											? 'border-amber-300 bg-amber-50 dark:border-amber-800 dark:bg-amber-950/40'
+											: 'bg-surface'}"
+									>
+										{r.resource_type}
+									</span>
+									<span class="text-[11px] text-hint">
+										{r.usages.length} usage{r.usages.length > 1 ? 's' : ''}
+									</span>
+								</div>
+								<div class="flex flex-col gap-3">
+									{#each r.usages as u, ui (ui)}
+										{#if u.role === 'trigger'}
+											<div class="flex items-center gap-2 text-xs">
+												<Zap size={14} class="shrink-0 text-hint" />
+												<span class="break-all font-mono text-primary">{u.label}</span>
+												<span
+													class="ml-auto inline-flex shrink-0 items-center gap-1 rounded bg-surface px-1.5 py-px text-[10px] font-semibold uppercase tracking-wide text-secondary"
+												>
+													{TRIGGER_KINDS[u.triggerKind].badge} trigger
+												</span>
+											</div>
+										{:else}
+											{@const itemUrl = s.itemUrl(u.kind, u.itemPath)}
+											<div class="flex flex-col gap-1 text-xs">
+												<div class="flex items-center gap-2">
+													{#if u.kind === 'script'}
+														<Code2 size={14} class="shrink-0 text-hint" />
+													{:else if u.kind === 'flow'}
+														<BarsStaggered size={14} class="shrink-0 text-hint" />
+													{:else}
+														<LayoutDashboard size={14} class="shrink-0 text-hint" />
+													{/if}
+													<span class="break-all font-mono text-primary">{u.label}</span>
+													<span
+														class="ml-auto inline-flex shrink-0 items-center gap-1 rounded px-1.5 py-px text-[10px] font-semibold uppercase tracking-wide {u.role ===
+														'hardcoded'
+															? 'bg-amber-100 text-amber-800 dark:bg-amber-950/50 dark:text-amber-200'
+															: 'bg-surface text-secondary'}"
+													>
+														{u.role === 'hardcoded' ? 'hardcoded path' : 'input'}
+														{#if u.role === 'hardcoded'}
+															<Popover notClickable placement="top">
+																<Info size={11} class="text-amber-600 dark:text-amber-400" />
+																{#snippet text()}
+																	<div
+																		class="flex w-80 max-w-[90vw] flex-col gap-2 text-left text-[11px] normal-case"
+																	>
+																		<span>
+																			This {u.kind} references the resource by a hardcoded path
+																			<span class="break-all font-mono">$res:{u.path}</span>.
+																		</span>
+																		<span class="text-hint">
+																			For portability, prefer taking the resource as an input — a
+																			fork won't have this exact path. It's relocated into the
+																			project on publish, but converting it to an input keeps the
+																			item reusable.
+																		</span>
+																	</div>
+																{/snippet}
+															</Popover>
+														{/if}
+													</span>
+													{#if itemUrl}
+														<a
+															href={itemUrl}
+															target="_blank"
+															rel="noopener"
+															title="Open {u.kind} in new tab"
+															class="shrink-0 text-hint hover:text-primary"
+														>
+															<ExternalLink size={12} />
+														</a>
+													{/if}
+												</div>
+											</div>
+										{/if}
+									{/each}
+								</div>
+							</div>
+						{/each}
+					{/if}
+				</div>
+			</DrawerContent>
+		</Drawer>
+
+		<Drawer bind:this={triggerDrawer} size="640px">
+			<DrawerContent title="Triggers" on:close={() => triggerDrawer?.closeDrawer()}>
+				<div class="flex flex-col gap-4">
+					<p class="text-xs text-secondary">
+						Triggers attached to the selected scripts and flows. Synced to the Hub as
+						<span class="font-semibold">disabled stubs</span>. Recipients review and enable each one
+						manually after importing. External hooks (Slack/Discord webhooks, message-queue
+						subscriptions, etc.) must be re-registered against the importing instance.
+					</p>
+					{#if s.relevantTriggers.length === 0}
+						<span class="text-xs text-hint">No triggers reference the selected items.</span>
+					{:else}
+						{#each s.triggersByKind as [kind, triggers] (kind)}
+							<div class="flex flex-col gap-2 rounded-md border bg-surface-secondary p-3">
+								<div class="flex items-center gap-2 border-b pb-2">
+									<span
+										class="rounded border bg-surface px-1.5 py-0.5 font-mono text-xs text-primary"
+									>
+										{TRIGGER_KINDS[kind].badge}
+									</span>
+									<span class="text-[11px] text-hint">
+										{triggers.length} trigger{triggers.length > 1 ? 's' : ''}
+									</span>
+									{#if TRIGGER_KINDS[kind].note}
+										<span class="ml-auto">
+											<Popover notClickable placement="top">
+												<Info size={12} class="text-blue-600 dark:text-blue-400" />
+												{#snippet text()}
+													<div
+														class="flex w-72 max-w-[90vw] flex-col gap-1 text-left text-[11px] normal-case"
+													>
+														<span>{TRIGGER_KINDS[kind].note}</span>
+													</div>
+												{/snippet}
+											</Popover>
+										</span>
+									{/if}
+								</div>
+								<div class="flex flex-col gap-3">
+									{#each triggers as t (t.path)}
+										{@const runnableSummary = s.runnableSummaryByPath.get(
+											`${t.is_flow ? 'flow' : 'script'}:${t.script_path}`
+										)}
+										{@const details = triggerDetails(t)}
+										{@const cfg = t.config as any}
+										{@const previewKey =
+											t.kind === 'schedule' ? `${cfg.schedule}|${cfg.timezone}` : ''}
+										{@const preview =
+											t.kind === 'schedule' ? s.schedulePreviews[previewKey] : undefined}
+										{@const triggerUrl = s.triggerListUrl(t.kind)}
+										<div class="flex flex-col gap-1 text-xs">
+											<div class="flex items-center gap-2">
+												{#if t.is_flow}
+													<BarsStaggered size={14} class="shrink-0 text-hint" />
+												{:else}
+													<Code2 size={14} class="shrink-0 text-hint" />
+												{/if}
+												<span class="break-all font-mono text-primary">
+													{runnableSummary || t.script_path}
+												</span>
+												<span
+													class="ml-auto inline-flex shrink-0 items-center gap-1 rounded bg-surface px-1.5 py-px text-[10px] font-semibold uppercase tracking-wide text-secondary"
+												>
+													{t.is_flow ? 'flow' : 'script'}
+												</span>
+												{#if triggerUrl}
+													<a
+														href={triggerUrl}
+														target="_blank"
+														rel="noopener"
+														title="Open {TRIGGER_KINDS[t.kind].badge} trigger list in new tab"
+														class="shrink-0 text-hint hover:text-primary"
+													>
+														<ExternalLink size={12} />
+													</a>
+												{/if}
+											</div>
+											{#if details.length > 0}
+												<dl class="ml-5 grid grid-cols-[auto_1fr] gap-x-2 gap-y-0.5 text-[11px]">
+													{#each details as d (d.label)}
+														<dt class="text-hint">{d.label}</dt>
+														<dd class="break-all font-mono text-tertiary">{d.value}</dd>
+													{/each}
+													{#if t.kind === 'schedule'}
+														<dt class="text-hint">Next runs</dt>
+														<dd class="text-tertiary">
+															{#if preview && preview.length > 0}
+																<div class="flex flex-col gap-0.5">
+																	{#each preview as date (date)}
+																		<span>{displayDate(date)}</span>
+																	{/each}
+																</div>
+															{:else if preview && preview.length === 0}
+																<span class="text-hint">No upcoming run</span>
+															{:else}
+																<span class="text-hint">Loading…</span>
+															{/if}
+														</dd>
+													{/if}
+												</dl>
+											{/if}
+										</div>
+									{/each}
+								</div>
+							</div>
+						{/each}
+					{/if}
+				</div>
+			</DrawerContent>
+		</Drawer>
+
+		<Drawer bind:this={bundleDrawer} size="600px">
+			<DrawerContent title="Bundle to Hub" on:close={() => bundleDrawer?.closeDrawer()}>
+				<div class="flex flex-col gap-4">
+					<p class="text-xs text-secondary">
+						Name and document your bundle. The readme can be updated later, but a clear one speeds
+						up the Windmill team's review.
+					</p>
+					{#if s.bundlePreview && s.bundlePreview.unresolved.length > 0}
+						<div
+							class="flex flex-col gap-1 rounded-md border border-red-300 bg-red-50 p-3 text-xs text-red-800 dark:border-red-800 dark:bg-red-950/40 dark:text-red-200"
+						>
+							<span class="font-semibold"
+								>{s.bundlePreview.unresolved.length} unresolved reference(s) — cannot publish</span
+							>
+							<span class="text-[11px]">
+								These items or resources couldn't be resolved, so the bundle would ship broken
+								references. Deselect or fix them, then retry:
+							</span>
+							<ul class="list-disc pl-4 font-mono text-[11px]">
+								{#each s.bundlePreview.unresolved as u (u)}
+									<li class="break-all">{u}</li>
+								{/each}
+							</ul>
+						</div>
+					{/if}
+					<label class="flex flex-col gap-1 text-xs">
+						<span class="font-semibold text-primary">Name</span>
+						<TextInput
+							bind:value={s.hubName}
+							inputProps={{ placeholder: 'e.g. Acme CRM toolkit' }}
+						/>
+					</label>
+					<div class="flex flex-col gap-1 text-xs">
+						<span class="font-semibold text-primary">Project slug</span>
+						<span class="rounded border bg-surface-secondary px-2 py-1.5 font-mono text-secondary">
+							{s.effectiveSlug || sanitizeSlug(s.hubName) || '—'}
+						</span>
+						<span class="text-[11px] text-hint">
+							{#if s.effectiveSlug}
+								Locked — items live under <span class="font-mono">f/{s.effectiveSlug}/</span>.
+							{:else if s.hubName.trim() && !isValidSlug(sanitizeSlug(s.hubName))}
+								<span class="text-red-600 dark:text-red-400">
+									The name yields an invalid slug. Use at least 3 letters/digits.
+								</span>
+							{:else}
+								Auto-generated from the name. Once project forked, items will live under
+								<span class="font-mono">f/{sanitizeSlug(s.hubName) || '<slug>'}/</span>.
+							{/if}
+						</span>
+					</div>
+					<label class="flex flex-col gap-1 text-xs">
+						<span class="font-semibold text-primary">Summary</span>
+						<TextInput
+							bind:value={s.hubSummary}
+							inputProps={{ placeholder: 'Short one-liner shown on the Hub card' }}
+						/>
+					</label>
+					<label class="flex flex-col gap-1 text-xs">
+						<span class="font-semibold text-primary">Readme</span>
+						<textarea
+							bind:value={s.hubReadme}
+							placeholder={"# What this workspace does\n\n# Who it's for\n\n# How to use it\n"}
+							rows="10"
+							class="rounded border px-2 py-1.5 text-xs font-mono bg-surface"
+						></textarea>
+						<span class="text-[11px] text-hint">
+							Markdown supported. Editable any time before and after publication.
+						</span>
+					</label>
+					<div class="flex flex-col gap-2 border-t pt-4 text-xs">
+						<div class="flex items-center gap-2">
+							<Database size={14} />
+							<span class="font-semibold text-primary">Data table migrations</span>
+						</div>
+						{#if s.migrationsGenerating}
+							<div class="flex items-center gap-2 text-secondary">
+								<Loader2 size={14} class="animate-spin" />
+								Detecting data tables used by this project…
+							</div>
+						{:else if s.migrationDrafts.length === 0}
+							<span class="text-[11px] text-hint">
+								No data table usage detected in this project's scripts, flows, or raw apps.
+							</span>
+						{:else}
+							<span class="text-[11px] text-hint">
+								We detected these data tables. When included, the migration recreates their tables
+								on import. Best-effort — review and edit before publishing.
+							</span>
+							{#each s.migrationDrafts as m (m.datatable_name)}
+								<div class="flex flex-col gap-1.5 rounded border bg-surface-secondary p-2">
+									<div class="flex items-center justify-between gap-2">
+										<span class="font-mono text-primary">{m.datatable_name}</span>
+										<Toggle bind:checked={m.enabled} size="xs" options={{ right: 'Include' }} />
+									</div>
+									<MigrationSqlEditor
+										bind:up={m.sql}
+										bind:down={m.sql_down}
+										generation={s.migrationsGeneration}
+									/>
+								</div>
+							{/each}
+						{/if}
+					</div>
+				</div>
+				{#snippet actions()}
+					<Button
+						variant="accent"
+						loading={s.deploying}
+						disabled={!s.hubName.trim() ||
+							(!s.effectiveSlug && !isValidSlug(sanitizeSlug(s.hubName))) ||
+							s.migrationsGenerating ||
+							s.triggersLoading ||
+							s.triggerDiscoveryFailed ||
+							(s.bundlePreview?.unresolved.length ?? 0) > 0}
+						startIcon={{ icon: Cloud }}
+						onclick={confirmBundle}
+					>
+						Create bundle
+					</Button>
+				{/snippet}
+			</DrawerContent>
+		</Drawer>
+	{/key}
+{/if}
diff --git a/frontend/src/lib/components/workspaceSettings/MigrationSqlEditor.svelte b/frontend/src/lib/components/workspaceSettings/MigrationSqlEditor.svelte
new file mode 100644
index 0000000000..76e3da3e07
--- /dev/null
+++ b/frontend/src/lib/components/workspaceSettings/MigrationSqlEditor.svelte
@@ -0,0 +1,40 @@
+<script lang="ts">
+	import SimpleEditor from '../SimpleEditor.svelte'
+
+	// Up/Down SQL editor for a data table migration. Two tabs keep the up (CREATE)
+	// and down (DROP) SQL from cluttering the view; both are editable Monaco.
+	let {
+		up = $bindable(),
+		down = $bindable(),
+		// Bump to force the Monaco editors to re-mount with fresh code — Monaco does
+		// not sync external `code` changes, so re-keying is how regenerated SQL shows.
+		generation = 0
+	}: { up: string; down: string; generation?: number } = $props()
+
+	let tab = $state<'up' | 'down'>('up')
+</script>
+
+<div class="flex flex-col gap-1">
+	<div class="flex gap-1 text-[11px]">
+		{#each [{ id: 'up', label: 'Up' }, { id: 'down', label: 'Down' }] as t (t.id)}
+			<button
+				type="button"
+				class="rounded px-2 py-0.5 font-medium {tab === t.id
+					? 'bg-surface-selected text-primary'
+					: 'text-secondary hover:bg-surface-hover'}"
+				onclick={() => (tab = t.id as 'up' | 'down')}
+			>
+				{t.label}
+			</button>
+		{/each}
+	</div>
+	{#key generation}
+		<div class="h-44 overflow-hidden rounded border bg-surface">
+			{#if tab === 'up'}
+				<SimpleEditor class="h-full" lang="sql" bind:code={up} small automaticLayout />
+			{:else}
+				<SimpleEditor class="h-full" lang="sql" bind:code={down} small automaticLayout />
+			{/if}
+		</div>
+	{/key}
+</div>
diff --git a/frontend/src/lib/components/workspaceSettings/deployToHubSession.svelte.ts b/frontend/src/lib/components/workspaceSettings/deployToHubSession.svelte.ts
new file mode 100644
index 0000000000..11926c804b
--- /dev/null
+++ b/frontend/src/lib/components/workspaceSettings/deployToHubSession.svelte.ts
@@ -0,0 +1,1635 @@
+import { untrack } from 'svelte'
+import { base } from '$lib/base'
+import {
+	AppService,
+	FlowService,
+	JobService,
+	RawAppService,
+	ResourceService,
+	ScriptService,
+	WorkspaceService,
+	ScheduleService
+} from '$lib/gen'
+import { sendUserToast } from '$lib/toast'
+import { sleep, emptySchema } from '$lib/utils'
+import { computeSecretUrl } from '$lib/components/apps/editor/appDeploy.svelte'
+import {
+	buildProjectBundle,
+	buildPathMap,
+	classifyPath,
+	extractScriptRefs,
+	extractFlowRefs,
+	extractAppRefs,
+	extractTriggerConfigResourceRefs,
+	extractVarRefsFromValue,
+	rewriteTriggerConfig,
+	rewriteVarRefsInValue,
+	type BundleDeps,
+	type BundledItem,
+	type FetchedItem,
+	type ItemKind,
+	type ItemRef,
+	type ProjectBundle
+} from './projectBundle'
+import {
+	detectDatatableTables,
+	generateDatatableMigrations,
+	type GeneratedMigration
+} from './projectMigrations'
+import type { Kind } from '$lib/utils_deployable'
+import {
+	TRIGGER_KINDS,
+	listAllWorkspaceTriggers,
+	triggerResourcePath,
+	triggerHandlerRefs,
+	portableTriggerConfig,
+	type WorkspaceTrigger,
+	type WorkspaceTriggerKind
+} from '../triggers/workspaceTriggersList'
+
+export type Phase = 'predeploy' | 'draft' | 'under_review' | 'live'
+export type RecStatus = 'none' | 'recorded'
+export interface DeployItem {
+	key: string
+	path: string
+	kind: Kind
+	summary?: string
+	rec: RecStatus
+	published?: boolean
+	publicUrl?: string
+	[k: string]: unknown
+}
+
+export const canRecord = (k: Kind) => k === 'script' || k === 'flow'
+// Legacy raw apps live only in the `raw_app` table, but the iframe share flow
+// drives AppService (the `app` table), so it can only target apps stored there.
+export const canShareAsIframe = (it: DeployItem): boolean =>
+	it.kind === 'app' || (it.kind === 'raw_app' && it.appTable === true)
+
+// Hub rehydration only carries draft membership, not the live share state of an
+// app. Copy the public-execution flag, public URL, and app-table origin from the
+// loaded workspace items onto matching draft items so a still-public app keeps its
+// Public badge, Unpublish, and iframe controls after its draft is reopened. Returns
+// the original array unchanged when nothing needs merging (stable reference).
+export function mergeShareState(
+	draftItems: DeployItem[],
+	workspaceItems: DeployItem[]
+): DeployItem[] {
+	if (draftItems.length === 0 || workspaceItems.length === 0) return draftItems
+	const byKey = new Map(workspaceItems.map((w) => [w.key, w]))
+	let changed = false
+	const merged = draftItems.map((d) => {
+		const w = byKey.get(d.key)
+		if (!w) return d
+		if (w.published !== d.published || w.publicUrl !== d.publicUrl || w.appTable !== d.appTable) {
+			changed = true
+			return { ...d, published: w.published, publicUrl: w.publicUrl, appTable: w.appTable }
+		}
+		return d
+	})
+	return changed ? merged : draftItems
+}
+
+export function sanitizeSlug(s: string): string {
+	return s
+		.toLowerCase()
+		.replace(/[_\s]+/g, '-')
+		.replace(/[^a-z0-9-]/g, '')
+		.replace(/-+/g, '-')
+		.replace(/^-+|-+$/g, '')
+		.slice(0, 50)
+		.replace(/-+$/g, '')
+}
+const SLUG_RE = /^[a-z0-9][a-z0-9-]{1,48}[a-z0-9]$/
+export function isValidSlug(s: string): boolean {
+	return SLUG_RE.test(s)
+}
+
+export type RunState = 'idle' | 'running' | 'success' | 'failed'
+
+const ITEM_KIND_ROUTE: Record<ItemKind, string> = {
+	script: 'scripts/get',
+	flow: 'flows/get',
+	app: 'apps/get',
+	raw_app: 'apps_raw/get'
+}
+
+const HIDDEN_RESOURCE_TYPES = new Set(['app_theme', 'state', 'cache'])
+
+function typesFromSchema(schema: any): string[] {
+	const out = new Set<string>()
+	const props = schema?.properties
+	if (props && typeof props === 'object') {
+		for (const key of Object.keys(props)) {
+			const fmt = props[key]?.format
+			if (typeof fmt === 'string' && fmt.startsWith('resource-')) {
+				out.add(fmt.slice('resource-'.length))
+			}
+		}
+	}
+	return [...out]
+}
+
+type DependencyUsage =
+	| { role: 'input'; label: string; kind: ItemKind; itemPath: string }
+	| { role: 'hardcoded'; label: string; kind: ItemKind; path: string; itemPath: string }
+	| { role: 'trigger'; label: string; triggerKind: WorkspaceTriggerKind; path: string }
+export interface DependencyType {
+	resource_type: string
+	hasHardcoded: boolean
+	usages: DependencyUsage[]
+}
+
+interface SessionDeps {
+	hasEeLicense: () => boolean
+}
+
+/**
+ * All state and async operations for one Deploy-to-Hub surface, bound to an
+ * immutable (workspace, folder) pair. A workspace or folder change never mutates
+ * a session — `useDeployToHubSession` replaces the instance, so in-flight async
+ * work keeps writing to the discarded object and cannot leak into the new scope.
+ * The only invalidation tokens left are intra-session (competing calls on the
+ * same session), not lifecycle guards.
+ */
+export class DeployToHubSession {
+	readonly workspace: string
+	readonly folder: string
+	/** `f/`-prefixed folder path the project is scoped to. */
+	readonly selectedFolder: string
+
+	#disposed = false
+	#deps: SessionDeps
+
+	phase = $state<Phase>('predeploy')
+	workspaceItems = $state<DeployItem[]>([])
+	draftItems = $state<DeployItem[]>([])
+	workspaceTriggers = $state<WorkspaceTrigger[]>([])
+	triggersLoading = $state(false)
+	// True when a trigger kind's discovery failed (not a feature-gated 404):
+	// the trigger list may be incomplete, so publishing is blocked until a
+	// retry succeeds.
+	triggerDiscoveryFailed = $state(false)
+	schedulePreviews = $state<Record<string, string[]>>({})
+	manualDeselected = $state<Set<string>>(new Set())
+	loading = $state(false)
+	workspaceRateLimit = $state<number | undefined>(undefined)
+	deploymentStatus = $state<
+		Record<string, { status: 'loading' | 'deployed' | 'failed'; error?: string }>
+	>({})
+	deploying = $state(false)
+
+	recordTarget = $state<DeployItem | undefined>()
+	recordArgs = $state<Record<string, any>>({})
+	recordValid = $state(true)
+	recordSchema = $state<Record<string, any>>(emptySchema())
+	recordSchemaLoading = $state(false)
+	runState = $state<RunState>('idle')
+	runJobId = $state<string | undefined>(undefined)
+	runResult = $state<unknown>(undefined)
+	runError = $state<string | undefined>(undefined)
+	recordings = $state<Record<string, string>>({})
+
+	publishTarget = $state<DeployItem | undefined>()
+	publishing = $state(false)
+
+	hubName = $state('')
+	hubSummary = $state('')
+	hubReadme = $state('')
+	effectiveSlug = $state('')
+	hubItemIds = $state<Record<string, number>>({})
+
+	// Best-effort data table migrations for the bundle, editable in the drawer and
+	// pushed on deploy. Regenerated when the bundle drawer opens.
+	migrationDrafts = $state<GeneratedMigration[]>([])
+	migrationsGenerating = $state(false)
+	// Bumped whenever the drafts are (re)generated, to re-key the Monaco editors so
+	// they pick up the fresh SQL (Monaco doesn't sync external `code` changes).
+	migrationsGeneration = $state(0)
+
+	bundlePreview = $state<ProjectBundle | undefined>(undefined)
+	detectingResources = $state(false)
+	// Data tables (→ tables) the current selection reads/writes, detected off the
+	// same bundle preview. Drives the predeploy "Data table dependencies" summary;
+	// the editable migration itself is generated in the bundle drawer.
+	datatableUsage = $state<Map<string, Set<string>>>(new Map())
+	detectingDatatables = $state(false)
+
+	submitting = $state(false)
+	syncing = $state(false)
+
+	// Intra-session tokens: latest call wins among competing calls on this session.
+	#triggerLoadTok = 0
+	#recordRunTok = 0
+	#migrationsTok = 0
+	#schedulePreviewsInFlight = new Set<string>()
+	// Preview-only cache: toggling checkboxes re-runs the closure walk, but item
+	// contents don't change mid-session. deployAll bypasses this and fetches fresh.
+	#previewItemCache = new Map<string, Promise<FetchedItem | undefined>>()
+	#previewTypeCache = new Map<string, Promise<string | undefined>>()
+
+	constructor(workspace: string, folder: string, deps: SessionDeps) {
+		this.workspace = workspace
+		this.folder = folder
+		this.selectedFolder = `f/${folder}`
+		this.#deps = deps
+	}
+
+	dispose() {
+		this.#disposed = true
+	}
+
+	load() {
+		void this.#loadWorkspace()
+		void this.#loadTriggers()
+		void this.rehydrateFromHub()
+	}
+
+	filteredWorkspaceItems = $derived(
+		this.workspaceItems.filter((i) => i.path.startsWith(this.selectedFolder + '/'))
+	)
+	// Derived (not merged at load time) so it settles regardless of which of the
+	// racing loads (#loadWorkspace / rehydrateFromHub) finishes last.
+	draftItemsWithLocalState = $derived(mergeShareState(this.draftItems, this.workspaceItems))
+	items = $derived(
+		this.phase === 'predeploy' ? this.filteredWorkspaceItems : this.draftItemsWithLocalState
+	)
+	selectedItems = $derived(
+		this.phase === 'predeploy'
+			? this.filteredWorkspaceItems.filter((i) => !this.manualDeselected.has(i.key))
+			: []
+	)
+	selectedItemKeys = $derived(this.selectedItems.map((i) => i.key))
+	allSelected = $derived(
+		this.phase === 'predeploy' &&
+			this.selectedItemKeys.length === this.filteredWorkspaceItems.length
+	)
+	recordableItems = $derived(this.items.filter((i) => canRecord(i.kind)))
+	allRecorded = $derived(
+		this.recordableItems.length > 0 && this.recordableItems.every((i) => i.rec === 'recorded')
+	)
+	hubSlug = $derived(this.effectiveSlug || sanitizeSlug(this.hubName))
+
+	relevantTriggers = $derived.by(() => {
+		const selectedScripts = new Set(
+			this.selectedItems.filter((i) => i.kind === 'script').map((i) => i.path)
+		)
+		const selectedFlows = new Set(
+			this.selectedItems.filter((i) => i.kind === 'flow').map((i) => i.path)
+		)
+		return this.workspaceTriggers.filter((t) =>
+			t.is_flow ? selectedFlows.has(t.script_path) : selectedScripts.has(t.script_path)
+		)
+	})
+
+	triggersByKind = $derived.by(() => {
+		const out = new Map<WorkspaceTriggerKind, WorkspaceTrigger[]>()
+		for (const t of this.relevantTriggers) {
+			const arr = out.get(t.kind) ?? []
+			arr.push(t)
+			out.set(t.kind, arr)
+		}
+		return Array.from(out.entries()).sort((a, b) => a[0].localeCompare(b[0]))
+	})
+
+	runnableSummaryByPath = $derived.by(() => {
+		const m = new Map<string, string | undefined>()
+		for (const it of this.workspaceItems) {
+			if (it.kind === 'script' || it.kind === 'flow') {
+				m.set(`${it.kind}:${it.path}`, it.summary)
+			}
+		}
+		return m
+	})
+
+	// `hasHardcoded` = pinned via $res: path (relocated as a stub); else input-only.
+	dependencyTypes = $derived.by(() => {
+		const b = this.bundlePreview
+		if (!b) return [] as DependencyType[]
+		const stubByNewPath = new Map(b.resourceStubs.map((s) => [s.newPath, s]))
+		const byType = new Map<string, DependencyType>()
+		const ensure = (rt: string) => {
+			let e = byType.get(rt)
+			if (!e) {
+				e = { resource_type: rt, hasHardcoded: false, usages: [] }
+				byType.set(rt, e)
+			}
+			return e
+		}
+		for (const it of b.items) {
+			const label = (it.summary?.trim() || it.path) ?? it.path
+			const refs =
+				it.kind === 'flow'
+					? extractFlowRefs(it.value).filter((r) => r.kind === 'resource')
+					: it.kind === 'app'
+						? extractAppRefs(it.value)
+						: extractScriptRefs(it.content ?? '')
+			for (const r of refs) {
+				const stub = stubByNewPath.get(r.path)
+				if (!stub || HIDDEN_RESOURCE_TYPES.has(stub.resource_type)) continue
+				const e = ensure(stub.resource_type)
+				e.hasHardcoded = true
+				e.usages.push({
+					role: 'hardcoded',
+					label,
+					kind: it.kind,
+					path: stub.originalPath,
+					itemPath: it.path
+				})
+			}
+			for (const t of typesFromSchema(it.schema)) {
+				if (HIDDEN_RESOURCE_TYPES.has(t)) continue
+				ensure(t).usages.push({ role: 'input', label, kind: it.kind, itemPath: it.path })
+			}
+		}
+		// Resources referenced only by a trigger (no item uses them in code) —
+		// its kind resource field or any `$res:` token in its config.
+		const stubByOriginal = new Map(b.resourceStubs.map((s) => [s.originalPath, s]))
+		for (const t of this.relevantTriggers) {
+			const refs = new Set(
+				extractTriggerConfigResourceRefs(portableTriggerConfig(t.kind, t.config))
+			)
+			const rp = triggerResourcePath(t)
+			if (rp) refs.add(rp)
+			for (const ref of refs) {
+				const stub = stubByOriginal.get(ref)
+				if (!stub || HIDDEN_RESOURCE_TYPES.has(stub.resource_type)) continue
+				ensure(stub.resource_type).usages.push({
+					role: 'trigger',
+					label: t.summary?.trim() || t.path,
+					triggerKind: t.kind,
+					path: stub.originalPath
+				})
+			}
+		}
+		return [...byType.values()].sort((a, b) => a.resource_type.localeCompare(b.resource_type))
+	})
+
+	toggleItem = (item: { key: string }) => {
+		const next = new Set(this.manualDeselected)
+		if (next.has(item.key)) next.delete(item.key)
+		else next.add(item.key)
+		this.manualDeselected = next
+	}
+	selectAll = () => {
+		this.manualDeselected = new Set()
+	}
+	deselectAll = () => {
+		this.manualDeselected = new Set(this.filteredWorkspaceItems.map((i) => i.key))
+	}
+
+	#folderQs(): string {
+		return `?folder=${encodeURIComponent(this.folder)}`
+	}
+
+	itemUrl(kind: ItemKind, path: string): string | undefined {
+		if (!path) return undefined
+		return `${base}/${ITEM_KIND_ROUTE[kind]}/${path}?workspace=${this.workspace}`
+	}
+	triggerListUrl(kind: WorkspaceTriggerKind): string {
+		return `${base}/${TRIGGER_KINDS[kind].route}?workspace=${this.workspace}`
+	}
+
+	#patchItem(key: string, patch: Partial<DeployItem>) {
+		this.workspaceItems = this.workspaceItems.map((i) => (i.key === key ? { ...i, ...patch } : i))
+		this.draftItems = this.draftItems.map((i) => (i.key === key ? { ...i, ...patch } : i))
+	}
+
+	async #listAllPages<T>(
+		fetcher: (params: { perPage: number; page: number }) => Promise<T[]>
+	): Promise<T[]> {
+		const perPage = 100
+		const out: T[] = []
+		for (let page = 1; page <= 1000; page++) {
+			const batch = await fetcher({ perPage, page })
+			out.push(...batch)
+			if (batch.length < perPage) return out
+		}
+		return out
+	}
+
+	async #loadWorkspace() {
+		const workspace = this.workspace
+		this.loading = true
+		try {
+			const [apps, rawApps, flows, scripts, settings] = await Promise.all([
+				this.#listAllPages((p) => AppService.listApps({ workspace, ...p })),
+				this.#listAllPages((p) => RawAppService.listRawApps({ workspace, ...p })),
+				this.#listAllPages((p) => FlowService.listFlows({ workspace, ...p })),
+				this.#listAllPages((p) => ScriptService.listScripts({ workspace, ...p })),
+				WorkspaceService.getSettings({ workspace }).catch(() => undefined)
+			])
+			if (this.#disposed) return
+
+			this.workspaceRateLimit = settings?.public_app_execution_limit_per_minute
+
+			const next: DeployItem[] = []
+			const publicApps = apps.filter((a) => a.execution_mode === 'anonymous')
+			const publicUrls = await Promise.all(publicApps.map((a) => this.#resolvePublicUrl(a.path)))
+			const publicUrlByPath = new Map(publicApps.map((a, i) => [a.path, publicUrls[i]]))
+			for (const a of apps) {
+				const isPublic = a.execution_mode === 'anonymous'
+				// Raw apps live in the `app` table (value = files/runnables) but must be
+				// published to the Hub as raw apps, not low-code apps.
+				const isRaw = (a as any).raw_app === true
+				next.push({
+					key: `${isRaw ? 'raw_app' : 'app'}:${a.path}`,
+					path: a.path,
+					kind: isRaw ? 'raw_app' : 'app',
+					appTable: isRaw || undefined,
+					summary: a.summary,
+					rec: 'none',
+					published: isPublic,
+					publicUrl: isPublic ? publicUrlByPath.get(a.path) : undefined
+				})
+			}
+			for (const a of rawApps) {
+				next.push({
+					key: `raw_app:${a.path}`,
+					path: a.path,
+					kind: 'raw_app',
+					summary: a.summary,
+					rec: 'none'
+				})
+			}
+			for (const f of flows) {
+				next.push({
+					key: `flow:${f.path}`,
+					path: f.path,
+					kind: 'flow',
+					summary: f.summary,
+					rec: 'none'
+				})
+			}
+			for (const s of scripts) {
+				next.push({
+					key: `script:${s.path}`,
+					path: s.path,
+					kind: 'script',
+					summary: s.summary,
+					rec: 'none'
+				})
+			}
+			if (this.#disposed) return
+			this.workspaceItems = next
+		} catch (e: any) {
+			if (!this.#disposed) {
+				sendUserToast(`Failed to load project items: ${e?.message ?? e}`, true)
+			}
+		} finally {
+			if (!this.#disposed) this.loading = false
+		}
+	}
+
+	/** Re-fetch triggers, e.g. after the EE license hydrates late. */
+	reloadTriggers() {
+		void this.#loadTriggers()
+	}
+
+	async #loadTriggers() {
+		const tok = ++this.#triggerLoadTok
+		this.triggersLoading = true
+		try {
+			const { triggers, failedKinds } = await listAllWorkspaceTriggers(this.workspace, {
+				includeEeOnly: this.#deps.hasEeLicense(),
+				onError: (message) => {
+					if (!this.#disposed) sendUserToast(message, true)
+				}
+			})
+			if (this.#disposed || tok !== this.#triggerLoadTok) return
+			this.workspaceTriggers = triggers
+			this.triggerDiscoveryFailed = failedKinds.length > 0
+		} finally {
+			if (!this.#disposed && tok === this.#triggerLoadTok) this.triggersLoading = false
+		}
+	}
+
+	async #resolvePublicUrl(path: string): Promise<string | undefined> {
+		try {
+			const secret = await AppService.getPublicSecretOfApp({ workspace: this.workspace, path })
+			return computeSecretUrl(secret)
+		} catch {
+			return undefined
+		}
+	}
+
+	async rehydrateFromHub() {
+		try {
+			const res = await fetch(`/api/w/${this.workspace}/hub/project${this.#folderQs()}`, {
+				credentials: 'include',
+				headers: { accept: 'application/json' }
+			})
+			if (this.#disposed) return
+			if (!res.ok) return // 404 = no project published for this folder yet
+			const p = JSON.parse(await res.text())
+			if (this.#disposed || !p?.slug) return
+			this.effectiveSlug = p.slug
+			this.hubName = p.name ?? ''
+			this.hubSummary = p.summary ?? ''
+			this.hubReadme = p.readme ?? ''
+			this.phase =
+				p.status === 'live' ? 'live' : p.status === 'under_review' ? 'under_review' : 'draft'
+			const ids: Record<string, number> = {}
+			this.draftItems = (p.items ?? []).map((it: any) => {
+				const wpath = it.source_path ?? it.path
+				const key = `${it.kind}:${wpath}`
+				if (typeof it.hub_id === 'number') ids[key] = it.hub_id
+				return {
+					key,
+					path: wpath,
+					kind: it.kind as Kind,
+					summary: it.summary ?? undefined,
+					rec: it.has_recording ? 'recorded' : 'none'
+				} satisfies DeployItem
+			})
+			this.hubItemIds = ids
+		} catch {}
+	}
+
+	/** Kick off schedule-preview fetches for any relevant schedule trigger missing one. */
+	ensureSchedulePreviews() {
+		for (const t of this.relevantTriggers) {
+			if (t.kind !== 'schedule') continue
+			const c = t.config as any
+			const key = `${c.schedule}|${c.timezone}`
+			if (this.schedulePreviews[key] || this.#schedulePreviewsInFlight.has(key)) continue
+			this.#schedulePreviewsInFlight.add(key)
+			ScheduleService.previewSchedule({
+				requestBody: {
+					schedule: c.schedule,
+					timezone: c.timezone,
+					cron_version: c.cron_version ?? 'v2'
+				}
+			})
+				.then((dates) => {
+					this.schedulePreviews = { ...this.schedulePreviews, [key]: dates.slice(0, 3) }
+				})
+				.catch(() => {})
+				.finally(() => this.#schedulePreviewsInFlight.delete(key))
+		}
+	}
+
+	/**
+	 * Rebuild the predeploy bundle preview (resource + data table dependency
+	 * summaries), debounced so rapid checkbox toggles coalesce into one walk.
+	 * Reads its reactive inputs synchronously and returns a cancel function, so
+	 * it can be driven from an `$effect` with proper cleanup.
+	 */
+	queueBundlePreview(): (() => void) | undefined {
+		if (this.phase !== 'predeploy') {
+			this.bundlePreview = undefined
+			this.datatableUsage = new Map()
+			return undefined
+		}
+		this.detectingResources = true
+		this.detectingDatatables = true
+		const slug = this.hubSlug
+		const seed: ItemRef[] = [
+			...this.selectedItems
+				.filter((i) => i.kind !== 'resource')
+				.map((i) => ({ kind: i.kind as ItemRef['kind'], path: i.path })),
+			...this.#triggerHandlerSeed(this.relevantTriggers, slug)
+		]
+		const triggerResources = this.#triggerResourcePaths(this.relevantTriggers)
+		const triggerVars = this.#triggerVarPaths(this.relevantTriggers)
+		let cancelled = false
+		const timer = setTimeout(() => {
+			buildProjectBundle(seed, slug, this.#cachedBundleDeps(), triggerResources, triggerVars)
+				.then((b) => {
+					if (cancelled) return
+					this.bundlePreview = b
+					// Detect data table usage off the same fetched items.
+					detectDatatableTables(b.items)
+						.then((usage) => {
+							if (!cancelled) this.datatableUsage = usage
+						})
+						.finally(() => {
+							if (!cancelled) this.detectingDatatables = false
+						})
+				})
+				.finally(() => {
+					if (!cancelled) this.detectingResources = false
+				})
+		}, 250)
+		return () => {
+			cancelled = true
+			clearTimeout(timer)
+		}
+	}
+
+	#buildBundleDeps(): BundleDeps {
+		const workspace = this.workspace
+		return {
+			fetchItem: async (ref: ItemRef): Promise<FetchedItem | undefined> => {
+				try {
+					if (ref.kind === 'script') {
+						const s = await ScriptService.getScriptByPath({ workspace, path: ref.path })
+						return {
+							kind: 'script',
+							path: ref.path,
+							summary: s.summary,
+							description: s.description ?? undefined,
+							content: s.content,
+							language: s.language,
+							schema: s.schema,
+							lock: s.lock ?? undefined,
+							scriptKind: typeof s.kind === 'string' ? s.kind.toLowerCase() : 'script'
+						}
+					} else if (ref.kind === 'flow') {
+						const f = await FlowService.getFlowByPath({ workspace, path: ref.path })
+						return {
+							kind: 'flow',
+							path: ref.path,
+							summary: f.summary,
+							description: f.description ?? undefined,
+							value: f.value,
+							schema: f.schema
+						}
+					} else if (ref.kind === 'app') {
+						const a = await AppService.getAppByPath({ workspace, path: ref.path })
+						return { kind: 'app', path: ref.path, summary: a.summary, value: a.value }
+					} else if (ref.kind === 'raw_app') {
+						// Modern raw apps live in the `app` table: fetch source files +
+						// runnables + the compiled bundle, and shape them into the `raw`
+						// payload the Hub's RawAppView expects (JSON is valid YAML).
+						const isModern = this.workspaceItems.some(
+							(i) => i.kind === 'raw_app' && i.path === ref.path && i.appTable
+						)
+						if (isModern) {
+							const a = await AppService.getAppByPath({ workspace, path: ref.path })
+							const secret = await AppService.getPublicSecretOfLatestVersionOfApp({
+								workspace,
+								path: ref.path
+							})
+							// The compiled JS bundle is required; a missing one means the app
+							// was never built/deployed, so fail loudly instead of pushing a blank app.
+							const [jsRes, cssRes] = await Promise.all([
+								fetch(`/api/w/${workspace}/apps/get_data/v/${secret}.js`, {
+									credentials: 'include'
+								}),
+								fetch(`/api/w/${workspace}/apps/get_data/v/${secret}.css`, {
+									credentials: 'include'
+								})
+							])
+							if (!jsRes.ok) {
+								throw new Error(`raw app ${ref.path} has no compiled bundle — deploy it first`)
+							}
+							const js = await jsRes.text()
+							const css = cssRes.ok ? await cssRes.text() : ''
+							const v: any = a.value ?? {}
+							const content = JSON.stringify({
+								files: { ...(v.files ?? {}), '/bundle.js': js, '/bundle.css': css },
+								runnables: v.runnables ?? {},
+								// Preserve the full-code app's explicit data table declaration so it
+								// survives publish/import and feeds migration detection.
+								...(v.data !== undefined ? { data: v.data } : {}),
+								...(v.datatables !== undefined ? { datatables: v.datatables } : {})
+							})
+							return { kind: 'raw_app', path: ref.path, summary: a.summary, content }
+						}
+						const r = await fetch(`/api/w/${workspace}/raw_apps/get_data/0/${ref.path}`, {
+							credentials: 'include'
+						})
+						if (!r.ok) return undefined
+						return { kind: 'raw_app', path: ref.path, content: await r.text() }
+					}
+				} catch (e: any) {
+					return undefined
+				}
+				return undefined
+			},
+			resolveResourceType: async (path: string): Promise<string | undefined> => {
+				try {
+					const r = await ResourceService.getResource({ workspace, path })
+					return r.resource_type ?? undefined
+				} catch (e: any) {
+					return undefined
+				}
+			}
+		}
+	}
+
+	#cachedBundleDeps(): BundleDeps {
+		const deps = this.#buildBundleDeps()
+		// Memoize only successful lookups: a miss (undefined) is likely transient, so
+		// evict it once it resolves. Otherwise a fixed/retried dependency can never
+		// clear `bundlePreview.unresolved` until the whole session is recreated.
+		const memoize = <T>(
+			cache: Map<string, Promise<T | undefined>>,
+			key: string,
+			run: () => Promise<T | undefined>
+		) => {
+			let p = cache.get(key)
+			if (!p) {
+				p = run()
+				cache.set(key, p)
+				void p.then((r) => {
+					if (r === undefined && cache.get(key) === p) cache.delete(key)
+				})
+			}
+			return p
+		}
+		return {
+			fetchItem: (ref) =>
+				memoize(this.#previewItemCache, `${ref.kind}:${ref.path}`, () => deps.fetchItem(ref)),
+			resolveResourceType: (path) =>
+				memoize(this.#previewTypeCache, path, () => deps.resolveResourceType(path))
+		}
+	}
+
+	async #postHub(path: string, body: unknown): Promise<Record<string, any> | undefined> {
+		const res = await fetch(`/api/w/${this.workspace}${path}${this.#folderQs()}`, {
+			method: 'POST',
+			headers: { 'Content-Type': 'application/json' },
+			credentials: 'include',
+			body: JSON.stringify(body)
+		})
+		const text = await res.text()
+		if (!res.ok) throw new Error(text)
+		try {
+			return JSON.parse(text)
+		} catch {
+			return undefined
+		}
+	}
+
+	async regenerateMigrations() {
+		const tok = ++this.#migrationsTok
+		this.migrationsGenerating = true
+		try {
+			// Same handler-augmented seed as deployAll: a data table used only by a
+			// bundled trigger handler must still get its migration.
+			const seed: ItemRef[] = [
+				...this.selectedItems
+					.filter((i) => i.kind !== 'resource')
+					.map((i) => ({ kind: i.kind as ItemRef['kind'], path: i.path })),
+				...this.#triggerHandlerSeed(this.relevantTriggers, this.hubSlug || 'project')
+			]
+			// Detection is independent of the final slug (data table refs aren't
+			// relocated), so any placeholder slug works for this throwaway bundle.
+			const bundle = await buildProjectBundle(
+				seed,
+				this.hubSlug || 'project',
+				this.#buildBundleDeps(),
+				[]
+			)
+			const usage = await detectDatatableTables(bundle.items)
+			const drafts = await generateDatatableMigrations(this.workspace, usage)
+			if (this.#disposed || tok !== this.#migrationsTok) return
+			this.migrationDrafts = drafts
+			this.migrationsGeneration++
+		} catch (e: any) {
+			if (!this.#disposed && tok === this.#migrationsTok) {
+				this.migrationDrafts = []
+				this.migrationsGeneration++
+				// Toast so a genuine failure isn't mistaken for "no data table usage".
+				sendUserToast(`Could not generate data table migrations: ${e?.message ?? e}`, true)
+			}
+		} finally {
+			if (!this.#disposed && tok === this.#migrationsTok) this.migrationsGenerating = false
+		}
+	}
+
+	/** Prefill bundle metadata and start migration detection (bundle drawer opening). */
+	prepareBundle() {
+		this.hubName = this.hubName || this.folder
+		void this.regenerateMigrations()
+	}
+
+	/**
+	 * Create the Hub draft then push the full bundle. `deploying` is set
+	 * synchronously before the first request so a double-click cannot start a
+	 * second publish, and the whole run is refused while triggers are still
+	 * loading — an incomplete `relevantTriggers` snapshot would permanently
+	 * omit triggers (and their handlers and migrations) from the draft.
+	 * `onDraftCreated` fires once the draft exists (the bundle drawer closes
+	 * there while items continue publishing).
+	 */
+	async publishBundle(onDraftCreated?: () => void): Promise<void> {
+		if (this.deploying || this.triggersLoading || this.triggerDiscoveryFailed) return
+		this.deploying = true
+		try {
+			if (!(await this.#createDraft())) return
+			onDraftCreated?.()
+			await this.#deployAll()
+		} finally {
+			this.deploying = false
+		}
+	}
+
+	/**
+	 * Create the Hub draft project. Returns true when the draft exists and
+	 * publishing can proceed.
+	 */
+	async #createDraft(): Promise<boolean> {
+		this.hubName = this.hubName.trim()
+		this.hubSummary = this.hubSummary.trim()
+		this.hubReadme = this.hubReadme.trim()
+		try {
+			const res = await fetch(`/api/w/${this.workspace}/hub/publish_draft${this.#folderQs()}`, {
+				method: 'POST',
+				headers: { 'Content-Type': 'application/json' },
+				credentials: 'include',
+				body: JSON.stringify({
+					slug: this.hubSlug,
+					name: this.hubName,
+					summary: this.hubSummary || this.hubName,
+					readme: this.hubReadme || undefined
+				})
+			})
+			const text = await res.text()
+			if (!res.ok) {
+				sendUserToast(`Hub draft creation failed: ${text}`, true)
+				return false
+			}
+			// Abort if Hub didn't echo a slug — guessing here lands items under
+			// a folder the Hub never locked.
+			let returnedSlug: string | undefined
+			try {
+				const parsed = JSON.parse(text)
+				if (typeof parsed?.slug === 'string') returnedSlug = parsed.slug
+			} catch {}
+			if (!returnedSlug) {
+				sendUserToast(`Hub did not return a slug. Aborting publish to avoid path drift.`, true)
+				return false
+			}
+			// Session replaced mid-request (workspace/folder switch): publishing now
+			// would push another scope's items into this draft. Abort.
+			if (this.#disposed) {
+				sendUserToast(`Workspace changed during publish — aborted to avoid mixing items.`, true)
+				return false
+			}
+			this.effectiveSlug = returnedSlug
+			return true
+		} catch (e: any) {
+			sendUserToast(`Hub draft creation failed: ${e?.message ?? e}`, true)
+			return false
+		}
+	}
+
+	async #pushBundledItem(slug: string, it: BundledItem): Promise<void> {
+		const key = `${it.kind}:${it.path}`
+		if (it.kind === 'script') {
+			const resp = await this.#postHub('/hub/scripts', {
+				summary: it.summary || it.newPath,
+				app: slug,
+				description: it.description ?? '',
+				kind: it.scriptKind ?? 'script',
+				content: it.content,
+				language: it.language,
+				schema: it.schema ?? undefined,
+				lockfile: it.lock ?? undefined,
+				path: it.newPath,
+				source_path: it.path,
+				project_slug: slug
+			})
+			if (typeof resp?.id === 'number') this.hubItemIds = { ...this.hubItemIds, [key]: resp.id }
+		} else if (it.kind === 'flow') {
+			const resp = await this.#postHub('/hub/flows', {
+				flow: {
+					summary: it.summary || it.newPath,
+					description: it.description ?? undefined,
+					value: it.value,
+					schema: it.schema ?? undefined
+				},
+				apps: [],
+				path: it.newPath,
+				source_path: it.path,
+				project_slug: slug
+			})
+			if (typeof resp?.id === 'number') this.hubItemIds = { ...this.hubItemIds, [key]: resp.id }
+		} else if (it.kind === 'app') {
+			await this.#postHub('/hub/apps', {
+				app: it.value,
+				apps: [],
+				summary: it.summary || it.newPath,
+				description: undefined,
+				path: it.newPath,
+				source_path: it.path,
+				project_slug: slug
+			})
+		} else if (it.kind === 'raw_app') {
+			const resp = await this.#postHub('/hub/raw_apps', {
+				raw: it.content ?? '',
+				apps: [],
+				summary: it.summary || it.newPath,
+				path: it.newPath,
+				source_path: it.path,
+				description: undefined,
+				project_slug: slug
+			})
+			if (typeof resp?.id === 'number') this.hubItemIds = { ...this.hubItemIds, [key]: resp.id }
+		}
+	}
+
+	// Handler runnables (trigger error handlers, schedule on_* handlers) ship
+	// with the bundle like the primary runnables do; hub refs stay external.
+	#triggerHandlerSeed(triggers: WorkspaceTrigger[], slug: string): ItemRef[] {
+		return triggers.flatMap(triggerHandlerRefs).filter((r) => classifyPath(r.path, slug) !== 'hub')
+	}
+
+	// Every resource a trigger's exported config references: the kind-specific
+	// broker/auth field plus any `$res:` token nested in it (schedule args,
+	// handler extra args, …) — all must enter the bundle path map.
+	#triggerResourcePaths(triggers: WorkspaceTrigger[]): string[] {
+		const out = new Set<string>()
+		for (const t of triggers) {
+			const rp = triggerResourcePath(t)
+			if (rp) out.add(rp)
+			for (const p of extractTriggerConfigResourceRefs(portableTriggerConfig(t.kind, t.config))) {
+				out.add(p)
+			}
+		}
+		return [...out]
+	}
+
+	// Every whole-string `$var:`/`$jsonvar:` value a trigger's config resolves (SQS
+	// queue_url, schedule args, …) — relocated through the bundle map like item vars.
+	#triggerVarPaths(triggers: WorkspaceTrigger[]): string[] {
+		const out = new Set<string>()
+		for (const t of triggers) {
+			for (const p of extractVarRefsFromValue(portableTriggerConfig(t.kind, t.config))) out.add(p)
+		}
+		return [...out]
+	}
+
+	async #pushTriggers(
+		slug: string,
+		resourcePathMap: Map<string, string>,
+		relevant: WorkspaceTrigger[]
+	): Promise<void> {
+		const pathMap = buildPathMap(
+			relevant.map((t) => t.path),
+			slug
+		)
+		const triggers: Array<Record<string, unknown>> = []
+		const skipped: string[] = []
+		for (const t of relevant) {
+			const itemKind: ItemKind = t.is_flow ? 'flow' : 'script'
+			const runnableKey = `${itemKind}:${t.script_path}`
+			const hubId = this.hubItemIds[runnableKey]
+			if (!hubId) {
+				skipped.push(t.path)
+				continue
+			}
+			// Full-config remap: resource paths, error-handler paths, schedule on_*
+			// handler refs and whole-string `$var:` values all relocate through the map.
+			const config = rewriteVarRefsInValue(
+				rewriteTriggerConfig(portableTriggerConfig(t.kind, t.config), resourcePathMap),
+				resourcePathMap
+			)
+			triggers.push({
+				path: pathMap.get(t.path) ?? t.path,
+				kind: t.kind,
+				summary: t.summary ?? null,
+				description: (t.config as any)?.description ?? null,
+				config,
+				script_ask_id: t.is_flow ? null : hubId,
+				flow_id: t.is_flow ? hubId : null
+			})
+		}
+		if (skipped.length > 0) {
+			sendUserToast(
+				`Skipped ${skipped.length} trigger(s) whose runnable did not publish: ${skipped.join(', ')}`,
+				true
+			)
+		}
+		// Full-set sync: always push (an empty list clears the Hub's triggers on a
+		// re-deploy), so removing every trigger doesn't leave stale ones on the Hub.
+		await this.#postHub('/hub/triggers', { triggers, project_slug: slug })
+	}
+
+	// Builtin types (git_repository, ...) aren't in resource_type — push with empty schema.
+	async #pushResourceTypes(slug: string, types: string[]): Promise<number> {
+		const results = await Promise.all(
+			types.map(async (name) => {
+				let schema: unknown = undefined
+				let description: string | undefined = undefined
+				try {
+					const rt = await ResourceService.getResourceType({
+						workspace: this.workspace,
+						path: name
+					})
+					schema = rt.schema ?? undefined
+					description = rt.description ?? undefined
+				} catch (e: any) {}
+				try {
+					await this.#postHub('/hub/resource_types', {
+						name,
+						schema,
+						description,
+						project_slug: slug
+					})
+					return 0
+				} catch (e: any) {
+					sendUserToast(`Resource type ${name} push failed: ${e?.message ?? e}`, true)
+					return 1
+				}
+			})
+		)
+		return results.reduce((a: number, b) => a + b, 0)
+	}
+
+	async #deployAll() {
+		const slug = this.hubSlug
+		// Snapshot the selection up-front: `selectedItems`/`relevantTriggers` are
+		// derived from live workspace data and `migrationDrafts` is edited in the
+		// drawer — the deploy must publish exactly what the user confirmed.
+		const itemsSnapshot = this.selectedItems.slice()
+		const triggersSnapshot = this.relevantTriggers.slice()
+		const migrationsSnapshot = this.migrationDrafts.slice()
+		this.hubItemIds = {}
+		this.deploymentStatus = {}
+		let failures = 0
+		try {
+			const seed: ItemRef[] = [
+				...itemsSnapshot
+					.filter((i) => i.kind !== 'resource')
+					.map((i) => ({ kind: i.kind as ItemRef['kind'], path: i.path })),
+				...this.#triggerHandlerSeed(triggersSnapshot, slug)
+			]
+			const triggerResources = this.#triggerResourcePaths(triggersSnapshot)
+			const triggerVars = this.#triggerVarPaths(triggersSnapshot)
+			const bundle = await buildProjectBundle(
+				seed,
+				slug,
+				this.#buildBundleDeps(),
+				triggerResources,
+				triggerVars
+			)
+			// Full path map (incl. unresolved) so a trigger's resource path is always
+			// relocated — never leaks the publisher's original private path to the Hub.
+			const resourcePathMap = bundle.pathMap
+
+			// A dangling reference (a selected root or transitive runnable that failed
+			// to fetch, or a resource whose type can't be resolved) means the bundle
+			// doesn't close: the root would silently vanish, or a published item would
+			// still point at the publisher's private source-workspace path. Refuse to
+			// publish until every reference resolves rather than ship a broken project.
+			if (bundle.unresolved.length > 0) {
+				sendUserToast(
+					`Cannot publish: ${bundle.unresolved.length} unresolved reference(s): ${bundle.unresolved.join(', ')}. Deselect or fix them, then retry.`,
+					true
+				)
+				return
+			}
+
+			// Bundle building is slow — bail before the first Hub write if the session
+			// was replaced (workspace/folder switch) in the meantime.
+			if (this.#disposed) return
+
+			// Types come from $res: stubs AND schema inputs (resource-<type>).
+			const inputTypes = bundle.items
+				.flatMap((i) => typesFromSchema(i.schema))
+				.filter((t) => !HIDDEN_RESOURCE_TYPES.has(t))
+			const types = [
+				...new Set([...bundle.resourceStubs.map((s) => s.resource_type), ...inputTypes])
+			]
+			const depFailures = await this.#pushResourceTypes(slug, types)
+
+			// Input-type deps with no path get a conventional f/<slug>/<type> stub.
+			const stubsByPath = new Map<string, { path: string; resource_type: string }>()
+			for (const s of bundle.resourceStubs)
+				stubsByPath.set(s.newPath, { path: s.newPath, resource_type: s.resource_type })
+			for (const t of inputTypes) {
+				const path = `f/${slug}/${t}`
+				if (!stubsByPath.has(path)) stubsByPath.set(path, { path, resource_type: t })
+			}
+			const stubs = [...stubsByPath.values()]
+			if (stubs.length > 0) {
+				try {
+					await this.#postHub('/hub/resources', { resources: stubs, project_slug: slug })
+				} catch (e: any) {
+					sendUserToast(`Resource sync failed: ${e?.message ?? e}`, true)
+					failures++
+				}
+			}
+			failures += depFailures
+			if (failures > 0) {
+				sendUserToast(
+					`Resource dependency sync failed — items not published to avoid broken references.`,
+					true
+				)
+				return
+			}
+
+			for (const it of bundle.items) {
+				// Stop writing item status / Hub IDs once the session is replaced —
+				// continuing would publish into a project the user has moved away from.
+				if (this.#disposed) return
+				const key = `${it.kind}:${it.path}`
+				this.deploymentStatus = { ...this.deploymentStatus, [key]: { status: 'loading' } }
+				try {
+					await this.#pushBundledItem(slug, it)
+					this.deploymentStatus = { ...this.deploymentStatus, [key]: { status: 'deployed' } }
+				} catch (e: any) {
+					failures++
+					this.deploymentStatus = {
+						...this.deploymentStatus,
+						[key]: { status: 'failed', error: e?.message ?? String(e) }
+					}
+				}
+			}
+			// A re-bundle clears the Hub-side embed (idempotent replace), so re-push it
+			// for any raw app that is already public — keeps the live iframe in sync
+			// without forcing an unpublish/share round-trip. Updates by hub id, safe in parallel.
+			const embedResults = await Promise.all(
+				bundle.items
+					.filter((it) => it.kind === 'raw_app')
+					.map(async (it) => {
+						const hubId = this.hubItemIds[`${it.kind}:${it.path}`]
+						const src = itemsSnapshot.find((i) => i.kind === 'raw_app' && i.path === it.path)
+						if (!hubId || !src?.published) return 0
+						// The re-bundle cleared the embed; a public raw app with no resolved URL
+						// can't have its iframe restored, so it's an incomplete publish too —
+						// count it (like a push failure) so the draft can't become submit-ready.
+						if (!src.publicUrl) {
+							sendUserToast(`Cannot restore the iframe for ${it.path}: missing public URL`, true)
+							return 1
+						}
+						try {
+							await this.#pushRawAppEmbed(hubId, src.publicUrl)
+							return 0
+						} catch (e: any) {
+							sendUserToast(`Failed to sync iframe for ${it.path}: ${e?.message ?? e}`, true)
+							return 1
+						}
+					})
+			)
+			failures += embedResults.reduce((a: number, b) => a + b, 0)
+			if (this.#disposed) return
+			try {
+				await this.#pushTriggers(slug, resourcePathMap, triggersSnapshot)
+			} catch (e: any) {
+				sendUserToast(`Trigger sync failed: ${e?.message ?? e}`, true)
+				failures++
+			}
+
+			// Full-set sync: always push (an empty list clears the Hub's migrations on
+			// a re-deploy). The Hub drops empty-SQL entries, so disabled placeholders
+			// don't persist.
+			try {
+				await this.#postHub('/hub/migrations', {
+					migrations: migrationsSnapshot.map((m) => ({
+						datatable_name: m.datatable_name,
+						sql: m.sql,
+						sql_down: m.sql_down,
+						enabled: m.enabled
+					})),
+					project_slug: slug
+				})
+			} catch (e: any) {
+				sendUserToast(`Data table migration sync failed: ${e?.message ?? e}`, true)
+				failures++
+			}
+
+			await sleep(150)
+			if (this.#disposed) return
+			// An incomplete push must never become submittable: a failed transitive item
+			// can leave a pushed runnable pointing at content that never landed. Stay in
+			// predeploy (deploymentStatus keeps the failed items visible) so re-publishing
+			// retries every write — createDraft and the item pushes are idempotent.
+			if (failures > 0) {
+				sendUserToast(
+					`Publish incomplete: ${failures} write(s) failed. Nothing was submitted — fix them and re-publish.`,
+					true
+				)
+				return
+			}
+			this.deploymentStatus = {}
+			this.recordings = {}
+			// Deterministic baseline so a transient Hub read failure can't leave the
+			// UI stuck in `predeploy`; rehydrate then upgrades to authoritative state.
+			this.draftItems = itemsSnapshot.map((i) => ({ ...i, rec: 'none' }))
+			this.phase = 'draft'
+			await this.rehydrateFromHub()
+			sendUserToast(`Draft created on the Hub. Add recordings before submitting for review.`)
+		} finally {
+			this.deploying = false
+		}
+	}
+
+	submitForReview = async () => {
+		const slug = this.hubSlug
+		if (!slug) return
+		this.submitting = true
+		try {
+			const res = await fetch(
+				`/api/w/${this.workspace}/hub/projects/${encodeURIComponent(slug)}/submit${this.#folderQs()}`,
+				{
+					method: 'POST',
+					credentials: 'include',
+					headers: { 'Content-Type': 'application/json' },
+					body: '{}'
+				}
+			)
+			if (!res.ok) {
+				sendUserToast(`Submit for review failed: ${await res.text()}`, true)
+				return
+			}
+			this.phase = 'under_review'
+			sendUserToast('Submitted for review by the Windmill team.')
+		} finally {
+			this.submitting = false
+		}
+	}
+
+	syncWithHub = async () => {
+		this.syncing = true
+		try {
+			if (this.phase === 'draft') {
+				await this.#loadWorkspace()
+				const prev = new Map(this.draftItems.map((i) => [i.key, { rec: i.rec }]))
+				this.draftItems = this.workspaceItems
+					.filter((i) => prev.has(i.key))
+					.map((i) => ({ ...i, rec: prev.get(i.key)?.rec ?? 'none' }))
+			} else {
+				// under_review / live: re-fetch the Hub project to pick up an
+				// admin status change (under_review -> live).
+				const before = this.phase
+				await this.rehydrateFromHub()
+				sendUserToast(
+					this.phase === before
+						? 'Still waiting for review.'
+						: this.phase === 'live'
+							? 'Approved — your project is now live.'
+							: `Status updated: ${this.phase}.`
+				)
+			}
+		} catch (e: any) {
+			sendUserToast(`Sync failed: ${e?.message ?? e}`, true)
+		} finally {
+			this.syncing = false
+		}
+	}
+
+	startNewDraft = () => {
+		this.draftItems = []
+		this.recordings = {}
+		this.phase = 'predeploy'
+	}
+
+	/** Reset record-drawer state and load the target's schema. */
+	async openRecord(it: DeployItem) {
+		const tok = ++this.#recordRunTok
+		this.recordTarget = it
+		this.recordArgs = {}
+		this.recordValid = true
+		this.recordSchema = emptySchema()
+		this.recordSchemaLoading = true
+		this.runState = 'idle'
+		this.runJobId = undefined
+		this.runResult = undefined
+		this.runError = undefined
+		try {
+			if (it.kind === 'script') {
+				const s = await ScriptService.getScriptByPath({
+					workspace: this.workspace,
+					path: it.path
+				})
+				if (tok !== this.#recordRunTok) return
+				this.recordSchema = (s.schema as Record<string, any>) ?? emptySchema()
+			} else if (it.kind === 'flow') {
+				const f = await FlowService.getFlowByPath({ workspace: this.workspace, path: it.path })
+				if (tok !== this.#recordRunTok) return
+				this.recordSchema = (f.schema as Record<string, any>) ?? emptySchema()
+			}
+		} catch (e: any) {
+			if (tok !== this.#recordRunTok) return
+			sendUserToast(`Failed to load schema: ${e?.message ?? e}`, true)
+		} finally {
+			if (tok === this.#recordRunTok) this.recordSchemaLoading = false
+		}
+	}
+
+	/** Invalidate any in-flight record run/poll (record drawer closed). */
+	cancelRecordRun = () => {
+		this.#recordRunTok++
+	}
+
+	runJob = async () => {
+		const it = this.recordTarget
+		if (!it) return
+		const tok = ++this.#recordRunTok
+		this.runState = 'running'
+		this.runJobId = undefined
+		this.runResult = undefined
+		this.runError = undefined
+		try {
+			let jobId: string
+			if (it.kind === 'script') {
+				jobId = await JobService.runScriptByPath({
+					workspace: this.workspace,
+					path: it.path,
+					requestBody: this.recordArgs
+				})
+			} else if (it.kind === 'flow') {
+				jobId = await JobService.runFlowByPath({
+					workspace: this.workspace,
+					path: it.path,
+					requestBody: this.recordArgs
+				})
+			} else {
+				if (tok === this.#recordRunTok) this.runState = 'idle'
+				return
+			}
+			if (tok !== this.#recordRunTok) return
+			this.runJobId = jobId
+			await this.#pollJobUntilComplete(jobId, tok)
+		} catch (e: any) {
+			if (tok !== this.#recordRunTok) return
+			this.runState = 'failed'
+			this.runError = `Failed to start: ${e?.message ?? e}`
+		}
+	}
+
+	async #pollJobUntilComplete(jobId: string, tok: number) {
+		// First check immediately (fast scripts complete in ms), then back off to 2s.
+		const deadline = Date.now() + 5 * 60_000
+		let interval = 250
+		while (Date.now() < deadline) {
+			if (tok !== this.#recordRunTok) return
+			try {
+				const r = await JobService.getCompletedJobResultMaybe({
+					workspace: this.workspace,
+					id: jobId
+				})
+				if (tok !== this.#recordRunTok) return
+				if (r.completed) {
+					this.runResult = r.result
+					if (r.success) {
+						this.runState = 'success'
+					} else {
+						this.runState = 'failed'
+						this.runError = typeof r.result === 'string' ? r.result : JSON.stringify(r.result)
+					}
+					return
+				}
+			} catch (e: any) {
+				if (tok !== this.#recordRunTok) return
+				this.runState = 'failed'
+				this.runError = `Polling failed: ${e?.message ?? e}`
+				return
+			}
+			await sleep(interval)
+			interval = Math.min(interval * 2, 2000)
+		}
+		if (tok !== this.#recordRunTok) return
+		this.runState = 'failed'
+		this.runError = 'Timed out after 5 minutes'
+	}
+
+	async #buildScriptRecording(it: DeployItem, jobId: string) {
+		const workspace = this.workspace
+		const s = await ScriptService.getScriptByPath({ workspace, path: it.path })
+		const job = await JobService.getCompletedJob({ workspace, id: jobId })
+		const initial_job = { ...(job as any), type: 'CompletedJob' }
+		const events = [{ t: 0, data: { completed: true, job: initial_job } }]
+		const duration = (initial_job.duration_ms as number) ?? 0
+		return {
+			version: 1,
+			type: 'script' as const,
+			recorded_at: new Date().toISOString(),
+			script_path: it.path,
+			total_duration_ms: duration,
+			code: s.content,
+			language: s.language,
+			args: (job.args ?? {}) as Record<string, any>,
+			schema: s.schema,
+			job: { initial_job, events }
+		}
+	}
+
+	async #buildFlowRecording(it: DeployItem, jobId: string) {
+		const workspace = this.workspace
+		const f = await FlowService.getFlowByPath({ workspace, path: it.path })
+		const root = (await JobService.getCompletedJob({ workspace, id: jobId })) as any
+		const jobs: Record<string, { initial_job: any; events: any[] }> = {}
+		const collect = async (j: any) => {
+			const stamped = { ...j, type: 'CompletedJob' }
+			jobs[j.id] = {
+				initial_job: stamped,
+				events: [{ t: 0, data: { completed: true, job: stamped } }]
+			}
+			const modules = (j.flow_status?.modules ?? []).filter(
+				(m: any) => m.job && typeof m.job === 'string'
+			)
+			// Sub-jobs at the same level are independent reads.
+			await Promise.all(
+				modules.map(async (m: any) => {
+					try {
+						const sub = (await JobService.getCompletedJob({ workspace, id: m.job })) as any
+						await collect(sub)
+					} catch {
+						/* sub-job missing — skip */
+					}
+				})
+			)
+		}
+		await collect(root)
+		return {
+			version: 1,
+			recorded_at: new Date().toISOString(),
+			flow_path: it.path,
+			total_duration_ms: (root.duration_ms as number) ?? 0,
+			flow: {
+				path: it.path,
+				value: f.value,
+				schema: f.schema ?? { type: 'object', properties: {}, required: [] },
+				summary: f.summary ?? '',
+				archived: false,
+				edited_at: '',
+				edited_by: '',
+				extra_perms: {}
+			},
+			jobs
+		}
+	}
+
+	/** Save the current successful run as the Hub recording. Returns true on success. */
+	async saveRecording(): Promise<boolean> {
+		const it = this.recordTarget
+		if (!it || !this.runJobId || this.runState !== 'success') return false
+		const hubId = this.hubItemIds[it.key]
+		if (!hubId) {
+			sendUserToast(`Push the bundle to the Hub first before saving recordings`, true)
+			return false
+		}
+		if (it.kind !== 'script' && it.kind !== 'flow') {
+			sendUserToast(`Recordings only supported for script/flow`, true)
+			return false
+		}
+		try {
+			const recording =
+				it.kind === 'script'
+					? await this.#buildScriptRecording(it, this.runJobId)
+					: await this.#buildFlowRecording(it, this.runJobId)
+			const path = it.kind === 'script' ? 'scripts' : 'flows'
+			await this.#postHub(`/hub/${path}/${hubId}/recording`, {
+				recording,
+				project_slug: this.hubSlug
+			})
+			this.recordings = { ...this.recordings, [it.key]: this.runJobId }
+			this.#patchItem(it.key, { rec: 'recorded' })
+			sendUserToast(`Recording saved — job ${this.runJobId}`)
+			return true
+		} catch (e: any) {
+			sendUserToast(`Failed to save recording: ${e?.message ?? e}`, true)
+			return false
+		}
+	}
+
+	// Set the Hub raw app's live-iframe URL (or clear it with null). The Hub renders
+	// from external_embed_url; project_slug scopes ownership.
+	async #pushRawAppEmbed(hubId: number, url: string | null) {
+		await this.#postHub(`/hub/raw_apps/${hubId}/embed`, {
+			external_embed_url: url,
+			project_slug: this.hubSlug
+		})
+	}
+
+	// Flip an app/raw app between public (anonymous) and private (publisher) and keep
+	// the Hub raw-app iframe in sync. Returns the resolved public URL when shared.
+	async #setAppShared(it: DeployItem, shared: boolean): Promise<string | null> {
+		const workspace = this.workspace
+		const hubId = it.kind === 'raw_app' ? this.hubItemIds[it.key] : undefined
+		// Sharing a raw app as an iframe needs its Hub item to wire the embed. Fail
+		// before flipping the app public so it can't be left anonymous with no embed.
+		if (shared && it.kind === 'raw_app' && !hubId) {
+			throw new Error('Push the bundle to the Hub first to share the live iframe')
+		}
+		const app = await AppService.getAppByPath({ workspace, path: it.path })
+		const prevMode = (app.policy?.execution_mode ?? 'publisher') as 'anonymous' | 'publisher'
+		const nextMode = (shared ? 'anonymous' : 'publisher') as 'anonymous' | 'publisher'
+		const setMode = (mode: 'anonymous' | 'publisher', message: string) =>
+			AppService.updateApp({
+				workspace,
+				path: it.path,
+				requestBody: {
+					policy: { ...(app.policy ?? {}), execution_mode: mode },
+					deployment_message: message
+				}
+			})
+		// Undo the policy flip so the app's public state stays consistent when a later
+		// step of the share fails. Best-effort: a revert failure must not mask the cause.
+		const rollback = () => setMode(prevMode, 'Revert iframe share').catch(() => {})
+		await setMode(nextMode, shared ? 'Share as iframe' : 'Unshare iframe')
+		const url = shared ? ((await this.#resolvePublicUrl(it.path)) ?? null) : null
+		// A share with no resolvable public URL is incomplete (no embeddable link, no
+		// Unpublish control); don't leave the app anonymous while reporting success.
+		if (shared && url === null) {
+			await rollback()
+			throw new Error(`Could not resolve the public URL for ${it.path}`)
+		}
+		if (hubId && it.kind === 'raw_app' && (!shared || url)) {
+			try {
+				await this.#pushRawAppEmbed(hubId, shared ? url : null)
+			} catch (e) {
+				await rollback()
+				throw e
+			}
+		}
+		return url
+	}
+
+	/** Make the publish target public. Returns true on success. */
+	async confirmPublish(): Promise<boolean> {
+		const it = this.publishTarget
+		if (!it || !canShareAsIframe(it)) return false
+		this.publishing = true
+		try {
+			const url = await this.#setAppShared(it, true)
+			this.#patchItem(it.key, { published: true, publicUrl: url ?? undefined })
+			sendUserToast(`${it.path} is now public`)
+			return true
+		} catch (e: any) {
+			sendUserToast(`Failed to publish: ${e?.message ?? e}`, true)
+			return false
+		} finally {
+			this.publishing = false
+		}
+	}
+
+	unpublishApp = async (it: DeployItem) => {
+		if (!canShareAsIframe(it)) return
+		try {
+			await this.#setAppShared(it, false)
+			this.#patchItem(it.key, { published: false, publicUrl: undefined })
+			sendUserToast('App unpublished')
+		} catch (e: any) {
+			sendUserToast(`Failed to unpublish: ${e?.message ?? e}`, true)
+		}
+	}
+}
+
+/**
+ * Owns the session lifecycle: a new `DeployToHubSession` is created whenever the
+ * (workspace, folder) identity actually changes — a spurious same-value store
+ * emit reuses the live session — and the previous one is disposed, which is the
+ * single mechanism invalidating its in-flight work. Also hosts the reactive
+ * plumbing the session itself can't (license-hydration reload, schedule
+ * previews, debounced bundle preview).
+ */
+export function useDeployToHubSession(args: {
+	workspace: () => string | undefined
+	folder: () => string
+	hasEeLicense: () => boolean
+}) {
+	let session = $state<DeployToHubSession | undefined>()
+
+	$effect(() => {
+		const workspace = args.workspace()
+		const folder = args.folder()
+		if (!workspace) return
+		untrack(() => {
+			if (session && session.workspace === workspace && session.folder === folder) return
+			session?.dispose()
+			const next = new DeployToHubSession(workspace, folder, {
+				hasEeLicense: args.hasEeLicense
+			})
+			session = next
+			next.load()
+		})
+	})
+
+	// The EE license hydrates async; if it lands after a license-less trigger load,
+	// EE kinds stay empty. Re-fetch on false→true (the session reads the license
+	// getter at call time).
+	let prevHadLicense: boolean | undefined = undefined
+	$effect(() => {
+		const hasLicense = args.hasEeLicense()
+		untrack(() => {
+			if (hasLicense && prevHadLicense === false) session?.reloadTriggers()
+			prevHadLicense = hasLicense
+		})
+	})
+
+	// Leaving/entering predeploy invalidates manual selection tweaks.
+	$effect(() => {
+		const s = session
+		if (!s) return
+		s.phase
+		untrack(() => {
+			s.manualDeselected = new Set()
+		})
+	})
+
+	// Schedule previews for relevant schedule triggers (deduped in the session).
+	$effect(() => {
+		session?.ensureSchedulePreviews()
+	})
+
+	// Debounced predeploy bundle preview; the session reads its reactive inputs
+	// synchronously and returns the cancel function used as effect cleanup.
+	$effect(() => {
+		const s = session
+		if (!s) return
+		return s.queueBundlePreview()
+	})
+
+	return {
+		get session() {
+			return session
+		}
+	}
+}
diff --git a/frontend/src/lib/components/workspaceSettings/deployToHubSession.test.ts b/frontend/src/lib/components/workspaceSettings/deployToHubSession.test.ts
new file mode 100644
index 0000000000..7b61251fcc
--- /dev/null
+++ b/frontend/src/lib/components/workspaceSettings/deployToHubSession.test.ts
@@ -0,0 +1,54 @@
+import { describe, it, expect } from 'vitest'
+import { canShareAsIframe, mergeShareState, type DeployItem } from './deployToHubSession.svelte'
+
+function item(over: Partial<DeployItem> & Pick<DeployItem, 'key' | 'path' | 'kind'>): DeployItem {
+	return { rec: 'none', ...over }
+}
+
+describe('canShareAsIframe', () => {
+	it('allows low-code apps and app-table raw apps', () => {
+		expect(canShareAsIframe(item({ key: 'app:f/a', path: 'f/a', kind: 'app' }))).toBe(true)
+		expect(
+			canShareAsIframe(item({ key: 'raw_app:f/r', path: 'f/r', kind: 'raw_app', appTable: true }))
+		).toBe(true)
+	})
+	it('hides the action for legacy raw apps (raw_app table only)', () => {
+		// Legacy entries from RawAppService carry no appTable flag; AppService can't load them.
+		expect(canShareAsIframe(item({ key: 'raw_app:f/r', path: 'f/r', kind: 'raw_app' }))).toBe(false)
+	})
+	it('never offers the action for flows or scripts', () => {
+		expect(canShareAsIframe(item({ key: 'flow:f/f', path: 'f/f', kind: 'flow' }))).toBe(false)
+	})
+})
+
+describe('mergeShareState', () => {
+	it('carries live public-share state from workspace items onto matching drafts', () => {
+		const drafts = [item({ key: 'app:f/a', path: 'f/a', kind: 'app' })]
+		const workspace = [
+			item({
+				key: 'app:f/a',
+				path: 'f/a',
+				kind: 'app',
+				published: true,
+				publicUrl: 'https://x/app'
+			})
+		]
+		const merged = mergeShareState(drafts, workspace)
+		expect(merged[0].published).toBe(true)
+		expect(merged[0].publicUrl).toBe('https://x/app')
+	})
+	it('restores the app-table origin so app-table raw apps stay shareable', () => {
+		const drafts = [item({ key: 'raw_app:f/r', path: 'f/r', kind: 'raw_app' })]
+		const workspace = [item({ key: 'raw_app:f/r', path: 'f/r', kind: 'raw_app', appTable: true })]
+		expect(canShareAsIframe(mergeShareState(drafts, workspace)[0])).toBe(true)
+	})
+	it('returns the same reference when nothing changes', () => {
+		const drafts = [item({ key: 'flow:f/f', path: 'f/f', kind: 'flow' })]
+		expect(mergeShareState(drafts, drafts)).toBe(drafts)
+	})
+	it('leaves drafts without a workspace match untouched', () => {
+		const drafts = [item({ key: 'app:f/gone', path: 'f/gone', kind: 'app' })]
+		const merged = mergeShareState(drafts, [item({ key: 'app:f/a', path: 'f/a', kind: 'app' })])
+		expect(merged).toBe(drafts)
+	})
+})
diff --git a/frontend/src/lib/components/workspaceSettings/projectBundle.test.ts b/frontend/src/lib/components/workspaceSettings/projectBundle.test.ts
new file mode 100644
index 0000000000..669c0a43de
--- /dev/null
+++ b/frontend/src/lib/components/workspaceSettings/projectBundle.test.ts
@@ -0,0 +1,869 @@
+import { describe, it, expect } from 'vitest'
+import {
+	classifyPath,
+	extractScriptRefs,
+	extractFlowRefs,
+	extractAppRefs,
+	buildPathMap,
+	rewriteContent,
+	rewriteTriggerConfig,
+	rewriteFlowValue,
+	rewriteAppValue,
+	extractRawAppRefs,
+	rewriteRawAppContent,
+	buildProjectBundle,
+	retargetProjectExport,
+	collectExportVarPaths,
+	extractTriggerConfigResourceRefs,
+	extractVarRefsFromValue,
+	type ProjectExport,
+	type FetchedItem,
+	type ItemRef
+} from './projectBundle'
+
+describe('classifyPath', () => {
+	it('internal for paths under the project folder', () => {
+		expect(classifyPath('f/proj/db', 'proj')).toBe('internal')
+		expect(classifyPath('f/proj', 'proj')).toBe('internal')
+	})
+	it('hub for hub paths', () => {
+		expect(classifyPath('hub/16043/discord/send', 'proj')).toBe('hub')
+	})
+	it('external for user and other folders', () => {
+		expect(classifyPath('u/admin/db', 'proj')).toBe('external')
+		expect(classifyPath('f/other/db', 'proj')).toBe('external')
+	})
+	it('does not treat a prefix-only match as internal', () => {
+		expect(classifyPath('f/project2/db', 'proj')).toBe('external')
+	})
+})
+
+describe('extractScriptRefs', () => {
+	it('finds $res: and res:// resource refs, deduped', () => {
+		const c = `const a = "$res:u/admin/db"; const b = "res://f/x/api"; const c2 = "$res:u/admin/db"`
+		expect(extractScriptRefs(c)).toEqual([
+			{ kind: 'resource', path: 'u/admin/db' },
+			{ kind: 'resource', path: 'f/x/api' }
+		])
+	})
+	it('returns nothing when no refs', () => {
+		expect(extractScriptRefs('export async function main() {}')).toEqual([])
+	})
+})
+
+describe('extractFlowRefs', () => {
+	it('finds inline-code, static-input, and script-path refs', () => {
+		const value = {
+			modules: [
+				{
+					id: 'a',
+					value: {
+						type: 'rawscript',
+						content: 'const db = "$res:u/admin/pg"',
+						input_transforms: {
+							other: { type: 'static', value: '$res:f/shared/api' },
+							expr1: { type: 'javascript', expr: 'flow_input.x' }
+						}
+					}
+				},
+				{
+					id: 'b',
+					value: {
+						type: 'branchone',
+						branches: [
+							{
+								modules: [
+									{ id: 'c', value: { type: 'script', path: 'u/admin/my_script' } },
+									{ id: 'd', value: { type: 'script', path: 'hub/123/x/y' } }
+								]
+							}
+						],
+						default: [{ id: 'e', value: { type: 'rawscript', content: 'no refs' } }]
+					}
+				}
+			]
+		}
+		const refs = extractFlowRefs(value)
+		expect(refs).toContainEqual({ kind: 'resource', path: 'u/admin/pg' })
+		expect(refs).toContainEqual({ kind: 'resource', path: 'f/shared/api' })
+		expect(refs).toContainEqual({ kind: 'script', path: 'u/admin/my_script' })
+		expect(refs).toContainEqual({ kind: 'script', path: 'hub/123/x/y' })
+		// a javascript expr (flow_input) is not a hardcoded ref
+		expect(refs.filter((r) => r.path === 'flow_input.x')).toEqual([])
+	})
+	it('finds sub-flow refs from type: flow steps', () => {
+		const value = {
+			modules: [
+				{ id: 'a', value: { type: 'flow', path: 'u/admin/sub_flow' } },
+				{ id: 'b', value: { type: 'flow', path: 'hub/9/x/y' } }
+			]
+		}
+		const refs = extractFlowRefs(value)
+		expect(refs).toContainEqual({ kind: 'flow', path: 'u/admin/sub_flow' })
+		expect(refs).toContainEqual({ kind: 'flow', path: 'hub/9/x/y' })
+	})
+})
+
+describe('buildPathMap', () => {
+	it('reparents into the project folder keeping the leaf name', () => {
+		const m = buildPathMap(['u/admin/db', 'f/other/api'], 'proj')
+		expect(m.get('u/admin/db')).toBe('f/proj/db')
+		expect(m.get('f/other/api')).toBe('f/proj/api')
+	})
+	it('suffixes collisions deterministically', () => {
+		const m = buildPathMap(['u/alice/db', 'f/shared/db', 'u/bob/db'], 'proj')
+		// sorted: f/shared/db, u/alice/db, u/bob/db
+		expect(m.get('f/shared/db')).toBe('f/proj/db')
+		expect(m.get('u/alice/db')).toBe('f/proj/db_2')
+		expect(m.get('u/bob/db')).toBe('f/proj/db_3')
+	})
+	it('maps internal paths to themselves, preserving subfolder depth', () => {
+		const m = buildPathMap(['f/proj/api', 'f/proj/sub/deep/script'], 'proj')
+		expect(m.get('f/proj/api')).toBe('f/proj/api')
+		expect(m.get('f/proj/sub/deep/script')).toBe('f/proj/sub/deep/script')
+	})
+	it('does not flatten two internal items sharing a leaf name', () => {
+		const m = buildPathMap(['f/proj/a/x', 'f/proj/b/x'], 'proj')
+		expect(m.get('f/proj/a/x')).toBe('f/proj/a/x')
+		expect(m.get('f/proj/b/x')).toBe('f/proj/b/x')
+	})
+	it('relocates an external onto a suffix when its leaf collides with an internal path', () => {
+		const m = buildPathMap(['f/proj/db', 'u/admin/db'], 'proj')
+		expect(m.get('f/proj/db')).toBe('f/proj/db')
+		expect(m.get('u/admin/db')).toBe('f/proj/db_2')
+	})
+})
+
+describe('rewriteContent', () => {
+	it('rewrites mapped refs and leaves unmapped ones', () => {
+		const map = new Map([['u/admin/db', 'f/proj/db']])
+		expect(rewriteContent('x = "$res:u/admin/db"', map)).toBe('x = "$res:f/proj/db"')
+		expect(rewriteContent('x = "res://u/admin/db"', map)).toBe('x = "$res:f/proj/db"')
+		expect(rewriteContent('x = "$res:hub/1/a/b"', map)).toBe('x = "$res:hub/1/a/b"')
+	})
+	it('does not partial-match a longer path', () => {
+		const map = new Map([['u/admin/db', 'f/proj/db']])
+		// u/admin/db2 must not be rewritten by the u/admin/db entry
+		expect(rewriteContent('x = "$res:u/admin/db2"', map)).toBe('x = "$res:u/admin/db2"')
+	})
+})
+
+describe('rewriteTriggerConfig', () => {
+	const map = new Map([
+		['f/proj/kafka', 'f/target/kafka'],
+		['f/proj/script', 'f/target/script']
+	])
+	it('remaps plain resource path fields', () => {
+		expect(
+			rewriteTriggerConfig({ kafka_resource_path: 'f/proj/kafka', group_id: 'g1' }, map)
+		).toEqual({ kafka_resource_path: 'f/target/kafka', group_id: 'g1' })
+	})
+	it('remaps nested objects, arrays, and $res: tokens', () => {
+		expect(
+			rewriteTriggerConfig(
+				{
+					nested: { path: 'f/proj/script' },
+					list: ['f/proj/kafka', 'unrelated'],
+					code: 'x = "$res:f/proj/kafka"'
+				},
+				map
+			)
+		).toEqual({
+			nested: { path: 'f/target/script' },
+			list: ['f/target/kafka', 'unrelated'],
+			code: 'x = "$res:f/target/kafka"'
+		})
+	})
+	it('leaves non-matching strings and non-string values untouched', () => {
+		const config = { url: 'wss://example.com', port: 9092, enabled: true, extra: null }
+		expect(rewriteTriggerConfig(config, map)).toEqual(config)
+	})
+})
+
+describe('rewriteFlowValue', () => {
+	it('rewrites inline code, static inputs, and script paths; clones input', () => {
+		const map = new Map([
+			['u/admin/pg', 'f/proj/pg'],
+			['f/shared/api', 'f/proj/api'],
+			['u/admin/my_script', 'f/proj/my_script']
+		])
+		const value = {
+			modules: [
+				{
+					id: 'a',
+					value: {
+						type: 'rawscript',
+						content: 'const db = "$res:u/admin/pg"',
+						input_transforms: { other: { type: 'static', value: '$res:f/shared/api' } }
+					}
+				},
+				{ id: 'b', value: { type: 'script', path: 'u/admin/my_script' } },
+				{ id: 'c', value: { type: 'script', path: 'hub/1/keep/me' } }
+			]
+		}
+		const out = rewriteFlowValue(value, map)
+		expect(out.modules[0].value.content).toBe('const db = "$res:f/proj/pg"')
+		expect(out.modules[0].value.input_transforms.other.value).toBe('$res:f/proj/api')
+		expect(out.modules[1].value.path).toBe('f/proj/my_script')
+		expect(out.modules[2].value.path).toBe('hub/1/keep/me')
+		// original untouched (deep clone)
+		expect(value.modules[0].value.content).toBe('const db = "$res:u/admin/pg"')
+	})
+})
+
+// A trimmed app value: a runnable-by-path component, a hub runnable, a $res in an
+// inline script, and incidental `f/...` text that must NOT be rewritten.
+const appValue = () => ({
+	grid: [
+		{
+			data: {
+				componentInput: {
+					runnable: { type: 'runnableByPath', runType: 'script', path: 'u/admin/charts' }
+				}
+			}
+		},
+		{
+			data: {
+				componentInput: {
+					runnable: { type: 'runnableByPath', runType: 'flow', path: 'f/shared/sync' }
+				}
+			}
+		},
+		{
+			data: {
+				componentInput: {
+					runnable: { type: 'runnableByPath', runType: 'hubscript', path: 'hub/1/keep' }
+				}
+			}
+		}
+	],
+	hiddenInlineScripts: [
+		{ name: 'h', inlineScript: { content: 'x = "$res:u/admin/pg"', language: 'deno' } }
+	],
+	someLabel: 'see docs at f/shared/sync for details'
+})
+
+describe('extractAppRefs', () => {
+	it('extracts runnable-by-path scripts/flows and $res resources, skips hub', () => {
+		const refs = extractAppRefs(appValue())
+		expect(refs).toContainEqual({ kind: 'script', path: 'u/admin/charts' })
+		expect(refs).toContainEqual({ kind: 'flow', path: 'f/shared/sync' })
+		expect(refs).toContainEqual({ kind: 'resource', path: 'u/admin/pg' })
+		expect(refs.some((r) => r.path === 'hub/1/keep')).toBe(false)
+	})
+})
+
+describe('rewriteAppValue', () => {
+	it('relocates runnable paths and $res, leaves hub refs and incidental text intact', () => {
+		const map = new Map([
+			['u/admin/charts', 'f/proj/charts'],
+			['f/shared/sync', 'f/proj/sync'],
+			['u/admin/pg', 'f/proj/pg']
+		])
+		const value = appValue()
+		const out = rewriteAppValue(value, map)
+		expect(out.grid[0].data.componentInput.runnable.path).toBe('f/proj/charts')
+		expect(out.grid[1].data.componentInput.runnable.path).toBe('f/proj/sync')
+		expect(out.grid[2].data.componentInput.runnable.path).toBe('hub/1/keep')
+		expect(out.hiddenInlineScripts[0].inlineScript.content).toBe('x = "$res:f/proj/pg"')
+		// incidental text untouched
+		expect(out.someLabel).toBe('see docs at f/shared/sync for details')
+		// original untouched (deep clone)
+		expect(value.grid[0].data.componentInput.runnable.path).toBe('u/admin/charts')
+	})
+})
+
+describe('raw app (value.raw JSON string)', () => {
+	const rawContent = () =>
+		JSON.stringify({
+			runnables: {
+				a: { type: 'path', runType: 'flow', path: 'u/admin/sync' },
+				b: { type: 'path', runType: 'script', path: 'f/shared/calc' },
+				c: { type: 'path', runType: 'hubscript', path: 'hub/1/keep' }
+			},
+			files: { '/bundle.js': 'const conn = "$res:u/admin/pg"' }
+		})
+
+	it('extractRawAppRefs sees nested runnables and $res, skips hub', () => {
+		const refs = extractRawAppRefs(rawContent())
+		expect(refs).toContainEqual({ kind: 'flow', path: 'u/admin/sync' })
+		expect(refs).toContainEqual({ kind: 'script', path: 'f/shared/calc' })
+		expect(refs).toContainEqual({ kind: 'resource', path: 'u/admin/pg' })
+		expect(refs.some((r) => r.path === 'hub/1/keep')).toBe(false)
+	})
+
+	it('rewriteRawAppContent relocates nested runnable paths and $res', () => {
+		const map = new Map([
+			['u/admin/sync', 'f/proj/sync'],
+			['f/shared/calc', 'f/proj/calc'],
+			['u/admin/pg', 'f/proj/pg']
+		])
+		const out = JSON.parse(rewriteRawAppContent(rawContent(), map))
+		expect(out.runnables.a.path).toBe('f/proj/sync')
+		expect(out.runnables.b.path).toBe('f/proj/calc')
+		expect(out.runnables.c.path).toBe('hub/1/keep')
+		expect(out.files['/bundle.js']).toBe('const conn = "$res:f/proj/pg"')
+	})
+
+	it('falls back to $res scan on non-JSON content', () => {
+		expect(extractRawAppRefs('x = "$res:u/admin/pg"')).toContainEqual({
+			kind: 'resource',
+			path: 'u/admin/pg'
+		})
+		expect(
+			rewriteRawAppContent('x = "$res:u/admin/pg"', new Map([['u/admin/pg', 'f/proj/pg']]))
+		).toBe('x = "$res:f/proj/pg"')
+	})
+})
+
+describe('buildProjectBundle', () => {
+	// A flow that calls an external script which itself hardcodes a resource.
+	const flow: FetchedItem = {
+		kind: 'flow',
+		path: 'u/admin/my_flow',
+		summary: 'Flow',
+		value: {
+			modules: [
+				{ id: 'a', value: { type: 'script', path: 'u/admin/helper' } },
+				{
+					id: 'b',
+					value: {
+						type: 'rawscript',
+						content: 'const x = "$res:f/shared/api"',
+						input_transforms: {}
+					}
+				}
+			]
+		}
+	}
+	const helper: FetchedItem = {
+		kind: 'script',
+		path: 'u/admin/helper',
+		summary: 'Helper',
+		language: 'bun',
+		content: 'const db = "$res:u/admin/pg"; export async function main(){}'
+	}
+
+	const deps = {
+		fetchItem: async (ref: ItemRef) => {
+			if (ref.path === 'u/admin/my_flow') return flow
+			if (ref.path === 'u/admin/helper') return helper
+			return undefined
+		},
+		resolveResourceType: async (path: string) => {
+			if (path === 'u/admin/pg') return 'postgresql'
+			if (path === 'f/shared/api') return 'http_api'
+			return undefined
+		}
+	}
+
+	it('pulls in referenced scripts + resources and rewrites everything under the folder', async () => {
+		const bundle = await buildProjectBundle(
+			[{ kind: 'flow', path: 'u/admin/my_flow' }],
+			'proj',
+			deps
+		)
+
+		// flow + transitively-pulled helper script are both bundled
+		const byPath = Object.fromEntries(bundle.items.map((i) => [i.path, i]))
+		expect(Object.keys(byPath).sort()).toEqual(['u/admin/helper', 'u/admin/my_flow'])
+
+		// items relocated under f/proj/
+		expect(byPath['u/admin/my_flow'].newPath).toBe('f/proj/my_flow')
+		expect(byPath['u/admin/helper'].newPath).toBe('f/proj/helper')
+
+		// flow's script-path ref rewritten to the helper's new path
+		expect(byPath['u/admin/my_flow'].value.modules[0].value.path).toBe('f/proj/helper')
+		// flow inline + helper code resource refs rewritten
+		expect(byPath['u/admin/my_flow'].value.modules[1].value.content).toBe(
+			'const x = "$res:f/proj/api"'
+		)
+		expect(byPath['u/admin/helper'].content).toContain('"$res:f/proj/pg"')
+
+		// resource stubs created at new paths with resolved types
+		const stubs = Object.fromEntries(bundle.resourceStubs.map((s) => [s.originalPath, s]))
+		expect(stubs['u/admin/pg'].newPath).toBe('f/proj/pg')
+		expect(stubs['u/admin/pg'].resource_type).toBe('postgresql')
+		expect(stubs['f/shared/api'].resource_type).toBe('http_api')
+
+		expect(bundle.unresolved).toEqual([])
+	})
+
+	it('pulls in a sub-flow referenced by a type: flow step and rewrites its path', async () => {
+		const parent: FetchedItem = {
+			kind: 'flow',
+			path: 'u/admin/parent_flow',
+			value: { modules: [{ id: 'a', value: { type: 'flow', path: 'u/admin/sub_flow' } }] }
+		}
+		const sub: FetchedItem = {
+			kind: 'flow',
+			path: 'u/admin/sub_flow',
+			value: {
+				modules: [{ id: 'a', value: { type: 'script', path: 'hub/1/keep/me' } }]
+			}
+		}
+		const d = {
+			fetchItem: async (ref: ItemRef) => {
+				if (ref.path === 'u/admin/parent_flow') return parent
+				if (ref.path === 'u/admin/sub_flow') return sub
+				return undefined
+			},
+			resolveResourceType: async () => undefined
+		}
+		const bundle = await buildProjectBundle(
+			[{ kind: 'flow', path: 'u/admin/parent_flow' }],
+			'proj',
+			d
+		)
+		const byPath = Object.fromEntries(bundle.items.map((i) => [i.path, i]))
+		// both flows bundled
+		expect(Object.keys(byPath).sort()).toEqual(['u/admin/parent_flow', 'u/admin/sub_flow'])
+		// parent's type: flow ref rewritten to the sub-flow's new path
+		expect(byPath['u/admin/parent_flow'].value.modules[0].value.path).toBe('f/proj/sub_flow')
+		expect(byPath['u/admin/sub_flow'].newPath).toBe('f/proj/sub_flow')
+		// hub ref inside the sub-flow left untouched
+		expect(byPath['u/admin/sub_flow'].value.modules[0].value.path).toBe('hub/1/keep/me')
+		expect(bundle.unresolved).toEqual([])
+	})
+
+	it('leaves hub script references untouched and does not fetch them', async () => {
+		const hubFlow: FetchedItem = {
+			kind: 'flow',
+			path: 'u/admin/hub_flow',
+			value: { modules: [{ id: 'a', value: { type: 'script', path: 'hub/1/x/y' } }] }
+		}
+		const d = {
+			fetchItem: async (ref: ItemRef) => (ref.path === 'u/admin/hub_flow' ? hubFlow : undefined),
+			resolveResourceType: async () => undefined
+		}
+		const bundle = await buildProjectBundle([{ kind: 'flow', path: 'u/admin/hub_flow' }], 'proj', d)
+		expect(bundle.items.map((i) => i.path)).toEqual(['u/admin/hub_flow'])
+		expect(bundle.items[0].value.modules[0].value.path).toBe('hub/1/x/y')
+		expect(bundle.unresolved).toEqual([])
+	})
+
+	it('reports a missing item and an unresolvable resource as unresolved', async () => {
+		const root: FetchedItem = {
+			kind: 'flow',
+			path: 'u/admin/root',
+			value: {
+				modules: [
+					{ id: 'a', value: { type: 'script', path: 'u/admin/gone' } },
+					{
+						id: 'b',
+						value: {
+							type: 'rawscript',
+							content: 'const x = "$res:u/admin/untyped"',
+							input_transforms: {}
+						}
+					}
+				]
+			}
+		}
+		const d = {
+			fetchItem: async (ref: ItemRef) => (ref.path === 'u/admin/root' ? root : undefined),
+			resolveResourceType: async () => undefined
+		}
+		const bundle = await buildProjectBundle([{ kind: 'flow', path: 'u/admin/root' }], 'proj', d)
+		expect(bundle.unresolved.sort()).toEqual(['u/admin/gone', 'u/admin/untyped'])
+	})
+
+	it('relocates $var:/$jsonvar: refs into the slug when it differs from the source folder', async () => {
+		const flow: FetchedItem = {
+			kind: 'flow',
+			path: 'f/source_folder/main',
+			value: {
+				flow_env: { CFG: '$jsonvar:f/source_folder/cfg' },
+				modules: [
+					{
+						id: 'a',
+						value: {
+							type: 'rawscript',
+							// Whole-value ref is relocated; the inline literal is not.
+							content: 'return "$var:f/source_folder/key"',
+							input_transforms: { k: { type: 'static', value: '$var:f/source_folder/key' } }
+						}
+					}
+				]
+			}
+		}
+		const d = {
+			fetchItem: async (ref: ItemRef) => (ref.path === 'f/source_folder/main' ? flow : undefined),
+			resolveResourceType: async () => undefined
+		}
+		const bundle = await buildProjectBundle(
+			[{ kind: 'flow', path: 'f/source_folder/main' }],
+			'kit',
+			d
+		)
+		const v = bundle.items[0].value
+		expect(v.modules[0].value.input_transforms.k.value).toBe('$var:f/kit/key')
+		expect(v.flow_env.CFG).toBe('$jsonvar:f/kit/cfg')
+		// Inline code literal is untouched.
+		expect(v.modules[0].value.content).toBe('return "$var:f/source_folder/key"')
+	})
+
+	it('dedupes a path missing as both a script and a flow', async () => {
+		// A missing script + flow sharing a path each push the bare path once; the
+		// list must stay unique so a keyed UI render of it can't collide.
+		const root: FetchedItem = {
+			kind: 'flow',
+			path: 'u/admin/root',
+			value: {
+				modules: [
+					{ id: 'a', value: { type: 'script', path: 'u/admin/dup' } },
+					{ id: 'b', value: { type: 'flow', path: 'u/admin/dup' } }
+				]
+			}
+		}
+		const d = {
+			fetchItem: async (ref: ItemRef) => (ref.path === 'u/admin/root' ? root : undefined),
+			resolveResourceType: async () => undefined
+		}
+		const bundle = await buildProjectBundle([{ kind: 'flow', path: 'u/admin/root' }], 'proj', d)
+		expect(bundle.unresolved).toEqual(['u/admin/dup'])
+	})
+})
+
+describe('extractVarRefsFromValue', () => {
+	it('collects whole-value `$var:`/`$jsonvar:` refs, deduped, walking nested JSON', () => {
+		const value = {
+			flow_env: { API: '$var:u/admin/key' },
+			modules: [
+				{ value: { input_transforms: { a: { type: 'static', value: '$var:f/proj/token' } } } },
+				{ value: { input_transforms: { b: { type: 'static', value: '$jsonvar:u/admin/cfg' } } } },
+				{ value: { input_transforms: { c: { type: 'static', value: '$var:u/admin/key' } } } }
+			]
+		}
+		expect(extractVarRefsFromValue(value).sort()).toEqual([
+			'f/proj/token',
+			'u/admin/cfg',
+			'u/admin/key'
+		])
+	})
+	it('ignores a `$var:` token embedded in inline code (not a whole value)', () => {
+		// The worker only substitutes a value that *is* the reference, so an inline
+		// script literal must not be treated as a variable arg.
+		const value = {
+			modules: [{ value: { type: 'rawscript', content: 'return "$var:u/example/template"' } }]
+		}
+		expect(extractVarRefsFromValue(value)).toEqual([])
+	})
+})
+
+describe('retargetProjectExport', () => {
+	const baseExport = (): ProjectExport => ({
+		project: { slug: 'proj', name: 'Proj', summary: '', readme: null },
+		scripts: [
+			{
+				path: 'f/proj/hello',
+				content: 'const r = "$res:f/proj/db"',
+				summary: 'hello'
+			}
+		],
+		flows: [
+			{
+				path: 'f/proj/main_flow',
+				value: {
+					modules: [
+						{ id: 'a', value: { type: 'script', path: 'f/proj/hello', input_transforms: {} } }
+					]
+				}
+			}
+		],
+		apps: [
+			{
+				path: 'f/proj/dashboard',
+				value: { grid: [{ data: { componentInput: { runnable: {} } } }] }
+			},
+			{
+				path: 'f/proj/rawapp',
+				app_type: 'raw',
+				value: { raw: JSON.stringify({ files: {}, runnables: {} }) }
+			}
+		],
+		resources: [{ path: 'f/proj/db', resource_type: 'postgresql' }],
+		triggers: [
+			{
+				path: 'f/proj/every_day',
+				kind: 'schedule',
+				runnable_path: 'f/proj/hello',
+				runnable_kind: 'script',
+				config: { schedule: '0 0 12 * * *' }
+			},
+			{
+				path: 'f/proj/kafka_in',
+				kind: 'kafka',
+				runnable_path: 'f/proj/hello',
+				runnable_kind: 'script',
+				config: { kafka_resource_path: 'f/proj/db' }
+			}
+		]
+	})
+
+	it('returns the bundle unchanged when the folder matches the slug', () => {
+		const bundle = baseExport()
+		expect(retargetProjectExport(bundle, 'proj', 'proj')).toBe(bundle)
+	})
+
+	it('relocates every item path and internal reference into the target folder', () => {
+		const out = retargetProjectExport(baseExport(), 'proj', 'dest')
+		expect(out.scripts[0].path).toBe('f/dest/hello')
+		expect(out.scripts[0].content).toContain('$res:f/dest/db')
+		expect(out.flows[0].path).toBe('f/dest/main_flow')
+		expect(out.flows[0].value.modules[0].value.path).toBe('f/dest/hello')
+		expect(out.apps.map((a) => a.path)).toEqual(['f/dest/dashboard', 'f/dest/rawapp'])
+		expect(out.resources[0].path).toBe('f/dest/db')
+		expect(out.triggers[0].path).toBe('f/dest/every_day')
+		expect(out.triggers[0].runnable_path).toBe('f/dest/hello')
+		// Plain-string resource path in a trigger config is remapped too.
+		expect(out.triggers[1].config.kafka_resource_path).toBe('f/dest/db')
+	})
+
+	it('leaves external and hub paths untouched', () => {
+		const bundle = baseExport()
+		bundle.scripts[0].content = 'const a = "$res:u/admin/db"; const b = "$res:hub/1/x"'
+		const out = retargetProjectExport(bundle, 'proj', 'dest')
+		expect(out.scripts[0].content).toContain('$res:u/admin/db')
+		expect(out.scripts[0].content).toContain('$res:hub/1/x')
+	})
+
+	it('retargets internal $var:/$jsonvar: refs but leaves external ones', () => {
+		const bundle = baseExport()
+		bundle.flows[0].value.modules[0].value.input_transforms = {
+			key: { type: 'static', value: '$var:f/proj/api_key' },
+			ext: { type: 'static', value: '$var:u/admin/personal' }
+		}
+		bundle.flows[0].value.flow_env = { CFG: '$jsonvar:f/proj/cfg' }
+		bundle.triggers[1].config.queue_url = '$var:f/proj/sqs'
+		const out = retargetProjectExport(bundle, 'proj', 'dest')
+		const it = out.flows[0].value.modules[0].value.input_transforms
+		expect(it.key.value).toBe('$var:f/dest/api_key')
+		expect(it.ext.value).toBe('$var:u/admin/personal')
+		expect(out.flows[0].value.flow_env.CFG).toBe('$jsonvar:f/dest/cfg')
+		expect(out.triggers[1].config.queue_url).toBe('$var:f/dest/sqs')
+	})
+
+	it('leaves an inert $var: literal embedded in inline code unchanged', () => {
+		const bundle = baseExport()
+		// Same path as a real runtime ref, but here it is a literal inside code: it
+		// must not be rewritten even once the path enters the retarget map.
+		bundle.flows[0].value.modules[0].value = {
+			type: 'rawscript',
+			content: 'return "$var:f/proj/api_key"',
+			input_transforms: { real: { type: 'static', value: '$var:f/proj/api_key' } }
+		}
+		const out = retargetProjectExport(bundle, 'proj', 'dest')
+		const mod = out.flows[0].value.modules[0].value
+		expect(mod.content).toBe('return "$var:f/proj/api_key"')
+		expect(mod.input_transforms.real.value).toBe('$var:f/dest/api_key')
+	})
+})
+
+describe('collectExportVarPaths', () => {
+	it('gathers variable refs from flows, apps, and triggers (deduped)', () => {
+		const bundle: ProjectExport = {
+			project: { slug: 'proj', name: 'P', summary: '', readme: null },
+			scripts: [],
+			flows: [{ path: 'f/proj/f', value: { flow_env: { A: '$var:f/proj/a' }, modules: [] } }],
+			apps: [
+				{
+					path: 'f/proj/raw',
+					app_type: 'raw',
+					value: { raw: JSON.stringify({ runnables: { r: { fields: { x: '$var:u/admin/b' } } } }) }
+				}
+			],
+			triggers: [{ path: 'f/proj/t', kind: 'sqs', config: { queue_url: '$jsonvar:f/proj/a' } }],
+			resources: []
+		}
+		expect(collectExportVarPaths(bundle).sort()).toEqual(['f/proj/a', 'u/admin/b'])
+	})
+})
+
+describe('trigger handler relocation', () => {
+	it('rewriteTriggerConfig remaps script/- and flow/-prefixed handler refs', () => {
+		const map = new Map([
+			['u/admin/handler', 'f/proj/handler'],
+			['u/admin/recovery_flow', 'f/proj/recovery_flow']
+		])
+		const out = rewriteTriggerConfig(
+			{
+				error_handler_path: 'u/admin/handler',
+				on_failure: 'script/u/admin/handler',
+				on_recovery: 'flow/u/admin/recovery_flow',
+				on_success: 'script/u/admin/unmapped'
+			},
+			map
+		)
+		expect(out.error_handler_path).toBe('f/proj/handler')
+		expect(out.on_failure).toBe('script/f/proj/handler')
+		expect(out.on_recovery).toBe('flow/f/proj/recovery_flow')
+		expect(out.on_success).toBe('script/u/admin/unmapped')
+	})
+
+	it('remaps $script:/$flow: only in the url field, never in literal payloads', () => {
+		const map = new Map([['u/admin/builder', 'f/proj/builder']])
+		const out = rewriteTriggerConfig(
+			{
+				url: '$script:u/admin/builder',
+				initial_messages: [{ raw_message: '$script:u/admin/builder' }]
+			},
+			map
+		)
+		expect(out.url).toBe('$script:f/proj/builder')
+		expect(out.initial_messages[0].raw_message).toBe('$script:u/admin/builder')
+	})
+
+	it('leaves literal handler-shaped strings in args untouched', () => {
+		const map = new Map([['f/proj/handler', 'f/dest/handler']])
+		const out = rewriteTriggerConfig(
+			{
+				on_failure: 'script/f/proj/handler',
+				args: { note: 'script/f/proj/handler' }
+			},
+			map
+		)
+		expect(out.on_failure).toBe('script/f/dest/handler')
+		expect(out.args.note).toBe('script/f/proj/handler')
+	})
+
+	it('leaves nested url keys untouched, rewriting only the top-level websocket url', () => {
+		const map = new Map([['u/admin/builder', 'f/proj/builder']])
+		const out = rewriteTriggerConfig(
+			{
+				url: '$script:u/admin/builder',
+				args: { url: '$script:u/admin/builder' }
+			},
+			map
+		)
+		expect(out.url).toBe('$script:f/proj/builder')
+		expect(out.args.url).toBe('$script:u/admin/builder')
+	})
+
+	it('extracts and relocates $res refs nested in static input transform JSON', () => {
+		const value = {
+			modules: [
+				{
+					id: 'a',
+					value: {
+						type: 'script',
+						path: 'f/proj/step',
+						input_transforms: {
+							provider: { type: 'static', value: { resource: '$res:u/admin/openai' } },
+							note: { type: 'static', value: 'plain text' }
+						}
+					}
+				}
+			]
+		}
+		const refs = extractFlowRefs(value)
+		expect(refs).toContainEqual({ kind: 'resource', path: 'u/admin/openai' })
+		const out = rewriteFlowValue(value, new Map([['u/admin/openai', 'f/proj/openai']]))
+		const it0 = out.modules[0].value.input_transforms
+		expect(it0.provider.value).toEqual({ resource: '$res:f/proj/openai' })
+		expect(typeof it0.note.value).toBe('string')
+	})
+
+	it('retargetProjectExport remaps trigger error handlers with the bundle', () => {
+		const bundle: ProjectExport = {
+			project: { slug: 'proj', name: 'P', summary: '', readme: null },
+			scripts: [{ path: 'f/proj/handler', content: '' }],
+			flows: [],
+			apps: [],
+			resources: [],
+			triggers: [
+				{
+					path: 'f/proj/sched',
+					kind: 'schedule',
+					runnable_path: 'f/proj/handler',
+					runnable_kind: 'script',
+					config: { schedule: '0 0 * * * *', on_failure: 'script/f/proj/handler' }
+				},
+				{
+					path: 'f/proj/mq',
+					kind: 'mqtt',
+					runnable_path: 'f/proj/handler',
+					runnable_kind: 'script',
+					config: { error_handler_path: 'f/proj/handler' }
+				}
+			]
+		}
+		const out = retargetProjectExport(bundle, 'proj', 'dest')
+		expect(out.triggers[0].config.on_failure).toBe('script/f/dest/handler')
+		expect(out.triggers[1].config.error_handler_path).toBe('f/dest/handler')
+	})
+})
+
+describe('extractTriggerConfigResourceRefs', () => {
+	it('collects $res: tokens nested anywhere in a trigger config', () => {
+		expect(
+			extractTriggerConfigResourceRefs({
+				schedule: '0 0 * * * *',
+				args: { channel: '$res:u/admin/slack' },
+				on_failure_extra_args: { db: 'res://f/other/pg' },
+				error_handler_args: { nested: { deep: '$res:u/admin/slack' } }
+			})
+		).toEqual(['u/admin/slack', 'f/other/pg'])
+	})
+})
+
+describe('flow_env and preprocessor_module', () => {
+	const flowValue = {
+		modules: [],
+		preprocessor_module: {
+			id: 'pre',
+			value: { type: 'script', path: 'u/admin/preproc', input_transforms: {} }
+		},
+		flow_env: { SLACK: '$res:u/admin/slack', PLAIN: 'not-a-ref' }
+	}
+
+	it('walks nested children of the failure module', () => {
+		const refs = extractFlowRefs({
+			modules: [],
+			failure_module: {
+				id: 'failure',
+				value: {
+					type: 'forloopflow',
+					modules: [
+						{ id: 'f-a', value: { type: 'script', path: 'u/admin/cleanup', input_transforms: {} } }
+					]
+				}
+			}
+		})
+		expect(refs).toContainEqual({ kind: 'script', path: 'u/admin/cleanup' })
+	})
+
+	it('extractFlowRefs sees preprocessor scripts and flow_env resources', () => {
+		const refs = extractFlowRefs(flowValue)
+		expect(refs).toContainEqual({ kind: 'script', path: 'u/admin/preproc' })
+		expect(refs).toContainEqual({ kind: 'resource', path: 'u/admin/slack' })
+	})
+
+	it('sees and relocates $res refs nested inside JSON flow_env values', () => {
+		const value = {
+			modules: [],
+			flow_env: { CFG: { db: '$res:u/admin/pg', opts: ['res://u/admin/s3'] } }
+		}
+		const refs = extractFlowRefs(value)
+		expect(refs).toContainEqual({ kind: 'resource', path: 'u/admin/pg' })
+		expect(refs).toContainEqual({ kind: 'resource', path: 'u/admin/s3' })
+		const map = new Map([
+			['u/admin/pg', 'f/proj/pg'],
+			['u/admin/s3', 'f/proj/s3']
+		])
+		const out = rewriteFlowValue(value, map)
+		expect(out.flow_env.CFG.db).toBe('$res:f/proj/pg')
+		expect(out.flow_env.CFG.opts[0]).toBe('$res:f/proj/s3')
+	})
+
+	it('rewriteFlowValue relocates both', () => {
+		const map = new Map([
+			['u/admin/preproc', 'f/proj/preproc'],
+			['u/admin/slack', 'f/proj/slack']
+		])
+		const out = rewriteFlowValue(flowValue, map)
+		expect(out.preprocessor_module.value.path).toBe('f/proj/preproc')
+		expect(out.flow_env.SLACK).toBe('$res:f/proj/slack')
+		expect(out.flow_env.PLAIN).toBe('not-a-ref')
+	})
+})
diff --git a/frontend/src/lib/components/workspaceSettings/projectBundle.ts b/frontend/src/lib/components/workspaceSettings/projectBundle.ts
new file mode 100644
index 0000000000..1fd62498d5
--- /dev/null
+++ b/frontend/src/lib/components/workspaceSettings/projectBundle.ts
@@ -0,0 +1,652 @@
+// Pure logic for the "project = folder" Hub bundle. A project is one folder
+// `f/<slug>/...`. Bundling: collect the transitive closure, relocate external
+// refs (`u/<user>/<name>`, `f/<other>/<name>` -> `f/<slug>/<name>`, `_2`/`_3`…
+// on collision) and rewrite them. Hub refs stay external; runtime string-concat
+// paths are out of scope. No API/Svelte deps so it's unit-testable.
+
+import { getAllModules } from '$lib/components/flows/flowExplorer'
+import { isRunnableByPath } from '$lib/components/apps/inputType'
+
+export type RefKind = 'resource' | 'script' | 'flow'
+
+export interface Ref {
+	kind: RefKind
+	/** Bare path, without the `$res:` / `res://` prefix for resources. */
+	path: string
+}
+
+export type PathClass = 'internal' | 'hub' | 'external'
+
+/** A single `$res:PATH` / `res://PATH` token (path captured in group 1). */
+const RES_TOKEN_RE = /(?:\$res:|res:\/\/)([\w\-./]+)/g
+
+// A whole-string `$var:PATH` / `$jsonvar:PATH` value. The worker substitutes these
+// only when an argument value *is* the reference (walking nested JSON), never a
+// token embedded in inline code, so the whole value must match. `_KIND` captures
+// the prefix (group 1) and path (group 2) so a rewrite can preserve `var`/`jsonvar`.
+const VAR_VALUE_RE = /^\$(?:json)?var:([\w\-./]+)$/
+const VAR_VALUE_RE_KIND = /^\$(var|jsonvar):([\w\-./]+)$/
+
+// Variable paths a value will resolve at runtime (flow static inputs, flow_env,
+// app runnable inputs, trigger config fields). Walk the parsed structure and match
+// whole string values so inline code carrying a literal `$var:` string is ignored.
+export function extractVarRefsFromValue(value: any): string[] {
+	const out = new Set<string>()
+	const walk = (v: any) => {
+		if (typeof v === 'string') {
+			const m = VAR_VALUE_RE.exec(v)
+			if (m) out.add(m[1])
+		} else if (Array.isArray(v)) {
+			for (const x of v) walk(x)
+		} else if (v && typeof v === 'object') {
+			for (const k of Object.keys(v)) walk(v[k])
+		}
+	}
+	walk(value)
+	return [...out]
+}
+
+export function classifyPath(path: string, slug: string): PathClass {
+	if (path.startsWith(`f/${slug}/`) || path === `f/${slug}`) return 'internal'
+	if (path.startsWith('hub/')) return 'hub'
+	return 'external'
+}
+
+export function extractScriptRefs(content: string): Ref[] {
+	const out: Ref[] = []
+	const seen = new Set<string>()
+	let m: RegExpExecArray | null
+	RES_TOKEN_RE.lastIndex = 0
+	while ((m = RES_TOKEN_RE.exec(content)) !== null) {
+		if (!seen.has(m[1])) {
+			seen.add(m[1])
+			out.push({ kind: 'resource', path: m[1] })
+		}
+	}
+	return out
+}
+
+/**
+ * References inside a flow value:
+ *  - inline rawscript code with `$res:` (resource)
+ *  - static step inputs whose value is a `$res:` literal (resource)
+ *  - `type: script` steps that reference a script by path (script)
+ *  - `type: flow` steps that reference a sub-flow by path (flow)
+ */
+export function extractFlowRefs(value: any): Ref[] {
+	const out: Ref[] = []
+	const seen = new Set<string>()
+	const add = (kind: RefKind, path: string) => {
+		const key = `${kind}:${path}`
+		if (!seen.has(key)) {
+			seen.add(key)
+			out.push({ kind, path })
+		}
+	}
+	// getAllModules flattens the whole tree (loops, branches, aiagent tools,
+	// failure module) so each module only needs local inspection; the
+	// preprocessor module sits outside `modules` and is walked the same way.
+	for (const mod of allFlowModules(value)) {
+		const v: any = (mod as any)?.value
+		if (!v || typeof v !== 'object') continue
+		if (v.type === 'script' && typeof v.path === 'string') add('script', v.path)
+		if (v.type === 'flow' && typeof v.path === 'string') add('flow', v.path)
+		if (typeof v.content === 'string') {
+			for (const r of extractScriptRefs(v.content)) add('resource', r.path)
+		}
+		const it = v.input_transforms
+		if (it && typeof it === 'object') {
+			for (const key of Object.keys(it)) {
+				const t = it[key]
+				// Static values can be a bare `$res:` string or arbitrary JSON with
+				// refs nested anywhere — the worker resolves both, so scan the full
+				// serialization.
+				if (t?.type === 'static' && t.value !== undefined) {
+					const text = typeof t.value === 'string' ? t.value : JSON.stringify(t.value)
+					for (const r of extractScriptRefs(text)) add('resource', r.path)
+				}
+			}
+		}
+	}
+	// flow_env values support `$res:path` references — as whole string values or
+	// nested inside JSON values (the worker resolves both), so scan the full
+	// serialization.
+	if (value?.flow_env && typeof value.flow_env === 'object') {
+		for (const r of extractScriptRefs(JSON.stringify(value.flow_env))) add('resource', r.path)
+	}
+	return out
+}
+
+// Every module of a flow value: the tree under `modules`, the failure module,
+// and the preprocessor module (which lives outside `modules`). Any walk over a
+// flow's modules must go through this — a walk that misses a module class
+// silently drops its dependencies from bundles or migrations. All three go in
+// the root list (not getAllModules' failure_module parameter, which appends
+// the module without expanding its descendants) so nested children of a
+// failure or preprocessor module are walked too.
+export function allFlowModules(value: any) {
+	return getAllModules([
+		...(value?.modules ?? []),
+		...(value?.preprocessor_module ? [value.preprocessor_module] : []),
+		...(value?.failure_module ? [value.failure_module] : [])
+	])
+}
+
+// Visit every object node in an app value tree (JSON-safe, no cycles).
+function walkAppNodes(value: any, visit: (node: Record<string, any>) => void): void {
+	if (value == null || typeof value !== 'object') return
+	if (Array.isArray(value)) {
+		for (const v of value) walkAppNodes(v, visit)
+		return
+	}
+	visit(value)
+	for (const k of Object.keys(value)) walkAppNodes(value[k], visit)
+}
+
+// `runnableByPath`/`path` nodes reference a workspace runnable by path.
+function runnableRef(node: Record<string, any>): Ref | undefined {
+	if (!isRunnableByPath(node as any) || typeof node.path !== 'string') return undefined
+	if (node.runType === 'flow') return { kind: 'flow', path: node.path }
+	if (node.runType === 'script') return { kind: 'script', path: node.path }
+	return undefined // hubscript -> external hub, ignored
+}
+
+// App refs: `$res:` resources anywhere in the value, plus script/flow runnables
+// referenced by path in components.
+export function extractAppRefs(value: any): Ref[] {
+	const out: Ref[] = []
+	const seen = new Set<string>()
+	const add = (kind: RefKind, path: string) => {
+		const key = `${kind}:${path}`
+		if (!seen.has(key)) {
+			seen.add(key)
+			out.push({ kind, path })
+		}
+	}
+	walkAppNodes(value, (node) => {
+		const r = runnableRef(node)
+		if (r) add(r.kind, r.path)
+	})
+	for (const r of extractScriptRefs(JSON.stringify(value ?? {}))) add('resource', r.path)
+	return out
+}
+
+/**
+ * Build the relocation map. Internal paths (`f/<slug>/...`) map to themselves
+ * and are reserved first; external paths relocate to `f/<slug>/<name>` (`_2`/`_3`…
+ * on collision). Input is sorted so suffix assignment is deterministic.
+ */
+export function buildPathMap(paths: Iterable<string>, slug: string): Map<string, string> {
+	const map = new Map<string, string>()
+	const used = new Set<string>()
+	const sorted = [...new Set(paths)].sort()
+	for (const p of sorted) {
+		if (classifyPath(p, slug) === 'internal') {
+			map.set(p, p)
+			used.add(p)
+		}
+	}
+	for (const old of sorted) {
+		if (map.has(old)) continue
+		const name = old.split('/').filter(Boolean).pop() ?? old
+		let candidate = `f/${slug}/${name}`
+		let n = 2
+		while (used.has(candidate)) candidate = `f/${slug}/${name}_${n++}`
+		used.add(candidate)
+		map.set(old, candidate)
+	}
+	return map
+}
+
+// Both ref forms normalize to `$res:` on rewrite.
+export function rewriteContent(content: string, map: Map<string, string>): string {
+	return content.replace(RES_TOKEN_RE, (whole, path) => {
+		const next = map.get(path)
+		return next ? `$res:${next}` : whole
+	})
+}
+
+// Structurally relocate whole-string `$var:`/`$jsonvar:` values — the only form the
+// worker resolves. Walks the parsed value so an inert token embedded in inline code
+// or arbitrary text is left untouched, unlike token replacement over serialized
+// strings. Only paths present in the map move (the retarget map carries variables).
+export function rewriteVarRefsInValue(value: any, map: Map<string, string>): any {
+	if (typeof value === 'string') {
+		const m = VAR_VALUE_RE_KIND.exec(value)
+		if (m) {
+			const next = map.get(m[2])
+			if (next) return `$${m[1]}:${next}`
+		}
+		return value
+	}
+	if (Array.isArray(value)) return value.map((v) => rewriteVarRefsInValue(v, map))
+	if (value && typeof value === 'object') {
+		const out: Record<string, any> = {}
+		for (const k of Object.keys(value)) out[k] = rewriteVarRefsInValue(value[k], map)
+		return out
+	}
+	return value
+}
+
+/**
+ * `$res:`/`res://` tokens anywhere in a trigger config — schedule args,
+ * on_*_extra_args, error_handler_args, … (e.g. the built-in Slack handler
+ * stores its channel resource this way). These must enter the bundle path map
+ * so `rewriteTriggerConfig` relocates them and a stub is exported.
+ */
+export function extractTriggerConfigResourceRefs(config: any): string[] {
+	return extractScriptRefs(JSON.stringify(config ?? {})).map((r) => r.path)
+}
+
+/**
+ * Trigger configs reference resources as plain path strings (e.g.
+ * `kafka_resource_path: "f/slug/db"`), not `$res:` tokens, so token rewriting
+ * misses them. Deep-walk the config and remap any string that exact-matches a
+ * map key (map keys are full bundle paths, so an exact match is a reference),
+ * or a `script/<path>`/`flow/<path>` handler reference (schedules' on_failure
+ * et al.), falling back to `$res:` token rewriting for embedded refs.
+ */
+// Top-level config fields whose string values are prefixed runnable refs.
+// Prefixed forms are remapped ONLY in these known positions: deciding meaning
+// from string shape alone rewrote literal payloads that merely looked like
+// refs. Bare-path exact matches and $res: tokens stay position-independent.
+const HANDLER_REF_FIELDS = new Set(['on_failure', 'on_recovery', 'on_success'])
+
+export function rewriteTriggerConfig(config: any, map: Map<string, string>, depth = 0): any {
+	if (typeof config === 'string') {
+		const direct = map.get(config)
+		if (direct) return direct
+		return rewriteContent(config, map)
+	}
+	if (Array.isArray(config)) return config.map((v) => rewriteTriggerConfig(v, map, depth + 1))
+	if (config && typeof config === 'object') {
+		return Object.fromEntries(
+			Object.entries(config).map(([k, v]) => {
+				if (depth === 0 && typeof v === 'string') {
+					// Websocket url: $script:<path> / $flow:<path>.
+					if (k === 'url') {
+						const m = /^\$(script|flow):(.+)$/.exec(v)
+						if (m && map.has(m[2])) return [k, `$${m[1]}:${map.get(m[2])}`]
+					}
+					// Schedule handlers: script/<path> / flow/<path>.
+					if (HANDLER_REF_FIELDS.has(k)) {
+						const m = /^(script|flow)\/(.+)$/.exec(v)
+						if (m && map.has(m[2])) return [k, `${m[1]}/${map.get(m[2])}`]
+					}
+				}
+				return [k, rewriteTriggerConfig(v, map, depth + 1)]
+			})
+		)
+	}
+	return config
+}
+
+export function rewriteFlowValue(value: any, map: Map<string, string>): any {
+	const cloned = JSON.parse(JSON.stringify(value ?? {}))
+	for (const mod of allFlowModules(cloned)) {
+		const v: any = (mod as any)?.value
+		if (!v || typeof v !== 'object') continue
+		if (
+			(v.type === 'script' || v.type === 'flow') &&
+			typeof v.path === 'string' &&
+			map.has(v.path)
+		) {
+			v.path = map.get(v.path)
+		}
+		if (typeof v.content === 'string') v.content = rewriteContent(v.content, map)
+		const it = v.input_transforms
+		if (it && typeof it === 'object') {
+			for (const key of Object.keys(it)) {
+				const t = it[key]
+				// Mirror extraction: rewrite refs wherever they sit, preserving the
+				// value's type (a string stays a string, JSON round-trips).
+				if (t?.type === 'static' && t.value !== undefined) {
+					if (typeof t.value === 'string') {
+						t.value = rewriteContent(t.value, map)
+					} else {
+						t.value = JSON.parse(rewriteContent(JSON.stringify(t.value), map))
+					}
+				}
+			}
+		}
+	}
+	if (cloned?.flow_env && typeof cloned.flow_env === 'object') {
+		// Tokens can sit inside nested JSON values, not just string values; the
+		// serialize→rewrite→parse round-trip reaches all of them (paths contain
+		// no characters that would break JSON string literals).
+		cloned.flow_env = JSON.parse(rewriteContent(JSON.stringify(cloned.flow_env), map))
+	}
+	return cloned
+}
+
+// Relocate `$res:` tokens (one round-trip, also produces a fresh clone) then
+// runnable-by-path refs structurally. Incidental `f/<slug>/` strings stay intact.
+export function rewriteAppValue(value: any, map: Map<string, string>): any {
+	if (value == null) return value
+	const cloned = JSON.parse(rewriteContent(JSON.stringify(value), map))
+	walkAppNodes(cloned, (node) => {
+		if (runnableRef(node) && map.has(node.path)) node.path = map.get(node.path)
+	})
+	return cloned
+}
+
+// Raw/compiled apps store their structure as a JSON string (`{ runnables, files }`).
+// Parse it so runnable-by-path refs in the runnables map are seen, reusing the
+// same walk; fall back to plain `$res:` scanning if it isn't valid JSON.
+export function extractRawAppRefs(content: string): Ref[] {
+	let parsed: any
+	try {
+		parsed = JSON.parse(content)
+	} catch {
+		return extractScriptRefs(content)
+	}
+	return extractAppRefs(parsed)
+}
+
+export function rewriteRawAppContent(content: string, map: Map<string, string>): string {
+	let parsed: any
+	try {
+		parsed = JSON.parse(content)
+	} catch {
+		return rewriteContent(content, map)
+	}
+	return JSON.stringify(rewriteAppValue(parsed, map))
+}
+
+// ---------------------------------------------------------------------------
+// Hub project export format (what /projects/{slug}/export returns) and its
+// retargeting into a destination folder. Kept here, next to the rewriters,
+// so the bundle format is defined in one module for both publish and install.
+// ---------------------------------------------------------------------------
+
+export type ExportItem = Record<string, any>
+export interface ProjectMigration {
+	datatable_name: string
+	sql: string
+	sql_down?: string
+	enabled: boolean
+}
+export interface ProjectExport {
+	project: { slug: string; name: string; summary: string; readme: string | null }
+	scripts: ExportItem[]
+	flows: ExportItem[]
+	apps: ExportItem[]
+	resources: ExportItem[]
+	triggers: ExportItem[]
+	migrations?: ProjectMigration[]
+}
+
+// Map bundled paths `f/<fromSlug>/...` -> `f/<folder>/...`. Only enumerated
+// paths go in, so rewriters touch real refs, never incidental text.
+export function buildRetargetMap(
+	bundle: ProjectExport,
+	fromSlug: string,
+	folder: string
+): Map<string, string> {
+	const map = new Map<string, string>()
+	const prefix = `f/${fromSlug}/`
+	const add = (p: unknown) => {
+		if (typeof p === 'string' && p.startsWith(prefix)) {
+			map.set(p, `f/${folder}/${p.slice(prefix.length)}`)
+		}
+	}
+	for (const s of bundle.scripts) add(s.path)
+	for (const f of bundle.flows) add(f.path)
+	for (const a of bundle.apps) add(a.path)
+	for (const r of bundle.resources) add(r.path)
+	for (const t of bundle.triggers) {
+		add(t.path)
+		add(t.runnable_path)
+	}
+	// Variables aren't enumerated in the export; their `$var:`/`$jsonvar:` refs live
+	// inside item values. Relocate the internal ones so a renamed-folder import
+	// rewrites them into the target folder instead of retaining the old prefix.
+	for (const p of collectExportVarPaths(bundle)) add(p)
+	return map
+}
+
+// Internal-or-external variable paths referenced by the export's flows, apps and
+// triggers. Scripts carry no variable args. Raw apps hold their structure in the
+// `value.raw` JSON string.
+export function collectExportVarPaths(bundle: ProjectExport): string[] {
+	const out = new Set<string>()
+	const collect = (value: any) => {
+		for (const p of extractVarRefsFromValue(value)) out.add(p)
+	}
+	for (const f of bundle.flows) collect(f.value)
+	for (const a of bundle.apps) collect(a.app_type === 'raw' ? safeParseRaw(a.value?.raw) : a.value)
+	for (const t of bundle.triggers) collect(t.config)
+	return [...out]
+}
+
+function safeParseRaw(raw: unknown): any {
+	if (typeof raw !== 'string') return undefined
+	try {
+		return JSON.parse(raw)
+	} catch {
+		return undefined
+	}
+}
+
+// Structural retarget: rewrite each item's path and its internal refs,
+// leaving Hub refs and arbitrary content untouched.
+export function retargetProjectExport(
+	bundle: ProjectExport,
+	fromSlug: string,
+	folder: string
+): ProjectExport {
+	if (folder === fromSlug) return bundle
+	const map = buildRetargetMap(bundle, fromSlug, folder)
+	const remap = (p: unknown) => (typeof p === 'string' ? (map.get(p) ?? p) : p)
+	return {
+		...bundle,
+		scripts: bundle.scripts.map((s) => ({
+			...s,
+			path: remap(s.path),
+			content: rewriteContent(s.content ?? '', map)
+		})),
+		flows: bundle.flows.map((f) => ({
+			...f,
+			path: remap(f.path),
+			value: rewriteVarRefsInValue(rewriteFlowValue(f.value, map), map)
+		})),
+		apps: bundle.apps.map((a) => ({
+			...a,
+			path: remap(a.path),
+			// Raw apps keep their structure in the `value.raw` JSON string.
+			value:
+				a.app_type === 'raw'
+					? {
+							...a.value,
+							raw: rewriteRawVarRefs(rewriteRawAppContent(a.value?.raw ?? '', map), map)
+						}
+					: rewriteVarRefsInValue(rewriteAppValue(a.value, map), map)
+		})),
+		resources: bundle.resources.map((r) => ({ ...r, path: remap(r.path) })),
+		triggers: bundle.triggers.map((t) => ({
+			...t,
+			path: remap(t.path),
+			runnable_path: remap(t.runnable_path),
+			// Configs hold `$res:` tokens, plain resource paths (kafka_resource_path
+			// etc.) and whole-string `$var:` values — rewrite all three.
+			config: t.config ? rewriteVarRefsInValue(rewriteTriggerConfig(t.config, map), map) : t.config
+		}))
+	}
+}
+
+// Var relocation for a raw app's `value.raw` JSON string: parse, structurally
+// rewrite whole-string var values, re-serialize; leave invalid JSON untouched.
+function rewriteRawVarRefs(raw: string, map: Map<string, string>): string {
+	const parsed = safeParseRaw(raw)
+	if (parsed === undefined) return raw
+	return JSON.stringify(rewriteVarRefsInValue(parsed, map))
+}
+
+export type ItemKind = 'script' | 'flow' | 'app' | 'raw_app'
+
+export interface ItemRef {
+	kind: ItemKind
+	path: string
+}
+
+export interface FetchedItem {
+	kind: ItemKind
+	path: string
+	summary?: string
+	description?: string
+	/** scripts + raw_apps */
+	content?: string
+	/** flows + apps */
+	value?: any
+	/** scripts */
+	language?: string
+	schema?: any
+	lock?: string
+	scriptKind?: string
+}
+
+export interface BundleDeps {
+	/** Fetch a workspace item by ref, or undefined if it doesn't exist. */
+	fetchItem: (ref: ItemRef) => Promise<FetchedItem | undefined>
+	/** Resolve a resource path to its type, or undefined if missing. */
+	resolveResourceType: (path: string) => Promise<string | undefined>
+}
+
+export interface BundledItem extends FetchedItem {
+	/** Path the item takes inside the project folder. */
+	newPath: string
+}
+
+export interface ResourceStub {
+	originalPath: string
+	newPath: string
+	resource_type: string
+}
+
+export interface ProjectBundle {
+	items: BundledItem[]
+	resourceStubs: ResourceStub[]
+	/** Original -> relocated path for every item and resource (incl. unresolved). */
+	pathMap: Map<string, string>
+	/** External paths we couldn't fetch/resolve (missing items or untyped resources). */
+	unresolved: string[]
+}
+
+function refsForFetched(item: FetchedItem): Ref[] {
+	if (item.kind === 'script') return extractScriptRefs(item.content ?? '')
+	if (item.kind === 'flow') return extractFlowRefs(item.value)
+	if (item.kind === 'app') return extractAppRefs(item.value)
+	if (item.kind === 'raw_app') return extractRawAppRefs(item.content ?? '')
+	return []
+}
+
+// Whole-string `$var:`/`$jsonvar:` paths an item resolves at runtime. Scripts carry
+// no variable args; raw apps hold their structure in the `content` JSON string.
+function varRefsForFetched(item: FetchedItem): string[] {
+	if (item.kind === 'flow' || item.kind === 'app') return extractVarRefsFromValue(item.value)
+	if (item.kind === 'raw_app') return extractVarRefsFromValue(safeParseRaw(item.content))
+	return []
+}
+
+// Walks the transitive closure: scripts referenced by path are pulled in
+// recursively, resources become empty stubs, hub refs stay external.
+export async function buildProjectBundle(
+	seed: ItemRef[],
+	slug: string,
+	deps: BundleDeps,
+	extraResourcePaths: string[] = [],
+	extraVarPaths: string[] = []
+): Promise<ProjectBundle> {
+	const fetched = new Map<string, FetchedItem>()
+	const queued = new Set<string>()
+	const resourcePaths = new Set<string>()
+	const varPaths = new Set<string>()
+	const unresolved: string[] = []
+
+	// Resources and variables referenced by triggers (by config value, not `$res:`
+	// in code) — relocated through the same map so the export stays slug-relative.
+	for (const p of extraResourcePaths) {
+		if (classifyPath(p, slug) !== 'hub') resourcePaths.add(p)
+	}
+	for (const p of extraVarPaths) varPaths.add(p)
+
+	// Key by `${kind}:${path}`, not bare path: a script and flow can share a path,
+	// and keying by path alone would silently drop one.
+	const refKey = (kind: string, path: string) => `${kind}:${path}`
+
+	// Refs at the same BFS depth are independent: fetch each level concurrently.
+	let level: ItemRef[] = []
+	for (const s of seed) {
+		const key = refKey(s.kind, s.path)
+		if (!queued.has(key)) {
+			queued.add(key)
+			level.push(s)
+		}
+	}
+	while (level.length > 0) {
+		const results = await Promise.all(
+			level.map(async (ref) => ({ ref, item: await deps.fetchItem(ref) }))
+		)
+		const next: ItemRef[] = []
+		for (const { ref, item } of results) {
+			if (!item) {
+				unresolved.push(ref.path)
+				continue
+			}
+			fetched.set(refKey(ref.kind, ref.path), item)
+			for (const r of refsForFetched(item)) {
+				if (classifyPath(r.path, slug) === 'hub') continue
+				if (r.kind === 'resource') {
+					resourcePaths.add(r.path)
+				} else if (r.kind === 'script' || r.kind === 'flow') {
+					const key = refKey(r.kind, r.path)
+					if (!queued.has(key)) {
+						queued.add(key)
+						next.push({ kind: r.kind, path: r.path })
+					}
+				}
+			}
+			// Relocate the item's runtime variable refs into the project folder too, so
+			// the export is slug-relative regardless of the source folder (import then
+			// materializes them as placeholders). Variables are never hub-hosted.
+			for (const p of varRefsForFetched(item)) varPaths.add(p)
+		}
+		level = next
+	}
+
+	const fetchedItems = [...fetched.values()]
+	const itemPaths = fetchedItems.map((it) => it.path)
+	const map = buildPathMap([...itemPaths, ...resourcePaths, ...varPaths], slug)
+
+	const items: BundledItem[] = fetchedItems.map((it) => {
+		const rewritten: BundledItem = { ...it, newPath: map.get(it.path) ?? it.path }
+		if (it.kind === 'script') {
+			rewritten.content = rewriteContent(it.content ?? '', map)
+		} else if (it.kind === 'raw_app') {
+			rewritten.content = rewriteRawVarRefs(rewriteRawAppContent(it.content ?? '', map), map)
+		} else if (it.kind === 'flow') {
+			rewritten.value = rewriteVarRefsInValue(rewriteFlowValue(it.value, map), map)
+		} else if (it.kind === 'app') {
+			rewritten.value = rewriteVarRefsInValue(rewriteAppValue(it.value, map), map)
+		}
+		return rewritten
+	})
+
+	const resourceStubs: ResourceStub[] = []
+	const resolved = await Promise.all(
+		[...resourcePaths].map(async (path) => ({ path, type: await deps.resolveResourceType(path) }))
+	)
+	for (const { path, type } of resolved) {
+		if (!type) {
+			unresolved.push(path)
+			continue
+		}
+		resourceStubs.push({ originalPath: path, newPath: map.get(path) ?? path, resource_type: type })
+	}
+
+	// `unresolved` keys missing items by kind:path but stores the bare path, so a
+	// missing script and flow (or a runnable and resource) sharing a path can push
+	// the same string twice. Dedupe: callers use it as a display/blocker list where
+	// duplicate keys would break keyed rendering.
+	return { items, resourceStubs, pathMap: map, unresolved: [...new Set(unresolved)] }
+}
diff --git a/frontend/src/lib/components/workspaceSettings/projectInstall.test.ts b/frontend/src/lib/components/workspaceSettings/projectInstall.test.ts
new file mode 100644
index 0000000000..a02d4e264d
--- /dev/null
+++ b/frontend/src/lib/components/workspaceSettings/projectInstall.test.ts
@@ -0,0 +1,78 @@
+import { describe, it, expect } from 'vitest'
+import { refContainmentViolation, varContainmentViolation } from './projectInstall'
+import type { Ref } from './projectBundle'
+
+describe('refContainmentViolation', () => {
+	const folder = 'proj'
+	const violation = (r: Ref) => refContainmentViolation([r], folder)
+
+	it('allows references relocated into the target folder', () => {
+		expect(violation({ kind: 'resource', path: 'f/proj/db' })).toBeUndefined()
+		expect(violation({ kind: 'script', path: 'f/proj/helper' })).toBeUndefined()
+		expect(violation({ kind: 'flow', path: 'f/proj/sub' })).toBeUndefined()
+	})
+
+	it('allows hub script/flow references but never hub resources', () => {
+		expect(violation({ kind: 'script', path: 'hub/1/x/y' })).toBeUndefined()
+		expect(violation({ kind: 'flow', path: 'hub/1/a/b' })).toBeUndefined()
+		// Resources are not hub-hosted, so a hub/ resource path is still an escape.
+		expect(violation({ kind: 'resource', path: 'hub/1/x/y' })).toBeDefined()
+	})
+
+	it('rejects references bound to another namespace', () => {
+		// The crux: an in-folder runnable pointing its resource at an existing asset.
+		expect(violation({ kind: 'resource', path: 'u/admin/db' })).toContain('escapes')
+		expect(violation({ kind: 'script', path: 'f/other/helper' })).toContain('escapes')
+		expect(violation({ kind: 'flow', path: 'u/admin/sub' })).toContain('escapes')
+	})
+
+	it('does not treat a prefix-only folder match as internal', () => {
+		expect(violation({ kind: 'script', path: 'f/proj2/helper' })).toContain('escapes')
+	})
+
+	it('reports the first offending reference and passes a fully-contained set', () => {
+		expect(
+			refContainmentViolation(
+				[
+					{ kind: 'resource', path: 'f/proj/db' },
+					{ kind: 'script', path: 'hub/1/x/y' }
+				],
+				folder
+			)
+		).toBeUndefined()
+		expect(
+			refContainmentViolation(
+				[
+					{ kind: 'resource', path: 'f/proj/db' },
+					{ kind: 'resource', path: 'u/admin/secret' }
+				],
+				folder
+			)
+		).toContain('u/admin/secret')
+	})
+})
+
+describe('varContainmentViolation', () => {
+	const folder = 'proj'
+
+	it('allows in-folder variable references', () => {
+		expect(varContainmentViolation({ token: '$var:f/proj/token' }, folder)).toBeUndefined()
+		expect(varContainmentViolation({ x: 'no refs here' }, folder)).toBeUndefined()
+	})
+
+	it('rejects a `$var:` or `$jsonvar:` bound to another namespace', () => {
+		// The crux: a variable arg the ref extractors miss, resolved under the perms.
+		expect(varContainmentViolation({ queue_url: '$var:u/admin/token' }, folder)).toContain(
+			'u/admin/token'
+		)
+		expect(varContainmentViolation({ cfg: '$jsonvar:f/other/secret' }, folder)).toContain('escapes')
+	})
+
+	it('ignores a `$var:` literal embedded in inline code', () => {
+		const flowValue = {
+			flow_env: { API: '$var:f/proj/api_key' },
+			modules: [{ value: { type: 'rawscript', content: 'return "$var:u/admin/should_not_flag"' } }]
+		}
+		expect(varContainmentViolation(flowValue, folder)).toBeUndefined()
+	})
+})
diff --git a/frontend/src/lib/components/workspaceSettings/projectInstall.ts b/frontend/src/lib/components/workspaceSettings/projectInstall.ts
new file mode 100644
index 0000000000..1827e00283
--- /dev/null
+++ b/frontend/src/lib/components/workspaceSettings/projectInstall.ts
@@ -0,0 +1,405 @@
+// Imports a Hub project export into a workspace: one importer per item kind,
+// each item reported individually so one bad item never aborts the rest.
+// UI-free — the install page owns folder choice and migration review.
+
+import {
+	AppService,
+	FlowService,
+	FolderService,
+	ResourceService,
+	ScriptService,
+	VariableService,
+	WorkspaceService
+} from '$lib/gen'
+import {
+	TRIGGER_KINDS,
+	createWorkspaceTriggerDisabled,
+	triggerHandlerRefs,
+	type WorkspaceTrigger,
+	type WorkspaceTriggerKind
+} from '../triggers/workspaceTriggersList'
+import { updatePolicy } from '$lib/components/apps/editor/appPolicy'
+import { updateRawAppPolicy } from '$lib/sharedUtils'
+import type { App } from '$lib/components/apps/types'
+import { runScriptAndPollResult } from '$lib/components/jobs/utils'
+import {
+	classifyPath,
+	collectExportVarPaths,
+	extractAppRefs,
+	extractFlowRefs,
+	extractRawAppRefs,
+	extractScriptRefs,
+	extractTriggerConfigResourceRefs,
+	extractVarRefsFromValue,
+	retargetProjectExport,
+	type ExportItem,
+	type ProjectExport,
+	type ProjectMigration,
+	type Ref
+} from './projectBundle'
+
+export interface InstallResult {
+	path: string
+	ok: boolean
+	error?: string
+}
+
+// Guarding an item's own path is not enough: the `$res:`/script/flow refs baked
+// into its content are live bindings the backend acts on. A well-formed export
+// relocates them all into f/<folder>/ (hub/ script refs stay external); anything
+// else points a runnable at an existing asset in another namespace, so refuse the
+// item rather than bind it there. Resources are never hub-hosted, so a hub/ path
+// there is not a valid escape hatch. Mirrors the trigger-config containment.
+export function refContainmentViolation(refs: Ref[], folder: string): string | undefined {
+	for (const r of refs) {
+		const cls = classifyPath(r.path, folder)
+		if (cls === 'internal') continue
+		if (cls === 'hub' && r.kind !== 'resource') continue
+		return `reference '${r.path}' escapes the target folder f/${folder}/ — skipped`
+	}
+	return undefined
+}
+
+// `$var:`/`$jsonvar:` references (in flow static inputs, flow_env, app runnable
+// inputs, trigger config) are resolved at runtime under the imported runnable's
+// permissions and are never hub-hosted. Retargeting relocates a project's own refs
+// into the target folder; anything still outside it points at another namespace, so
+// reject those. Takes the parsed value so inline code carrying a literal is ignored.
+export function varContainmentViolation(value: any, folder: string): string | undefined {
+	for (const p of extractVarRefsFromValue(value)) {
+		if (classifyPath(p, folder) !== 'internal') {
+			return `variable '${p}' escapes the target folder f/${folder}/ — skipped`
+		}
+	}
+	return undefined
+}
+
+// Surface the backend's explanation: API errors carry the real message in
+// `.body` (plain text for Windmill 4xx), while `.message` is the generic
+// status text ("Bad Request"). Prefer the body so e.g. a path/route_path
+// collision reads as the actual reason, not just "Bad Request".
+function errorMessage(e: any): string {
+	const body = e?.body
+	if (typeof body === 'string' && body.trim() !== '') return body
+	if (body && typeof body === 'object')
+		return body.error?.message ?? body.message ?? JSON.stringify(body)
+	return e?.message ?? String(e)
+}
+
+// Recompute an app's execution policy from its (retargeted) value, mirroring
+// what the editor does on deploy. `triggerables_v2` is keyed by
+// `<component>:rawscript/<sha256(inline content)>`; retargeting rewrites that
+// content, so a copied or empty policy would leave every inline runnable
+// "forbidden by policy" at runtime. Default to publisher (auth required).
+async function computeAppPolicy(value: any): Promise<any> {
+	const policy = (await updatePolicy(value as App, undefined)) as any
+	if (!policy.execution_mode) policy.execution_mode = 'publisher'
+	return policy
+}
+async function computeRawAppPolicy(runnables: Record<string, any>): Promise<any> {
+	const policy = (await updateRawAppPolicy(runnables, undefined)) as any
+	if (!policy.execution_mode) policy.execution_mode = 'publisher'
+	return policy
+}
+
+function importScript(workspace: string, s: ExportItem): Promise<unknown> {
+	return ScriptService.createScript({
+		workspace,
+		requestBody: {
+			path: s.path,
+			summary: s.summary ?? '',
+			description: s.description ?? '',
+			content: s.content ?? '',
+			language: s.language,
+			schema: s.schema ?? undefined,
+			kind: s.kind ?? 'script',
+			lock: s.lockfile ?? undefined
+		}
+	})
+}
+
+function importFlow(workspace: string, f: ExportItem): Promise<unknown> {
+	return FlowService.createFlow({
+		workspace,
+		requestBody: {
+			path: f.path,
+			summary: f.summary ?? '',
+			description: f.description ?? '',
+			value: f.value,
+			schema: f.schema ?? undefined
+		}
+	})
+}
+
+// Stubs only: never overwrite an existing resource's value (updateIfExists
+// stays false so a path collision is reported as a failed item instead).
+function importResourceStub(workspace: string, r: ExportItem): Promise<unknown> {
+	return ResourceService.createResource({
+		workspace,
+		updateIfExists: false,
+		requestBody: {
+			path: r.path,
+			resource_type: r.resource_type,
+			value: {},
+			description: 'Imported stub — fill in the value.'
+		}
+	})
+}
+
+// Variables hold secrets/config, so their values are never shipped. Create an empty
+// secret placeholder for a project variable the importer must fill, mirroring the
+// resource stubs. Conflict-safe: an already-present variable (the importer filled it,
+// or a re-import) is left untouched rather than clobbered.
+async function importVariablePlaceholder(workspace: string, path: string): Promise<void> {
+	if (await VariableService.existsVariable({ workspace, path })) return
+	await VariableService.createVariable({
+		workspace,
+		requestBody: {
+			path,
+			value: '',
+			is_secret: true,
+			description: 'Imported placeholder — fill in the value.'
+		}
+	})
+}
+
+async function importApp(workspace: string, a: ExportItem): Promise<unknown> {
+	if (a.app_type === 'raw') {
+		let parsed: any
+		try {
+			parsed = JSON.parse(a.value?.raw ?? '{}')
+		} catch (e: any) {
+			throw new Error(`invalid raw app bundle: ${e?.message ?? String(e)}`)
+		}
+		const files = { ...(parsed.files ?? {}) }
+		const js = files['/bundle.js'] ?? ''
+		const css = files['/bundle.css'] ?? ''
+		delete files['/bundle.js']
+		delete files['/bundle.css']
+		const runnables = parsed.runnables ?? {}
+		return AppService.createAppRaw({
+			workspace,
+			formData: {
+				app: {
+					path: a.path,
+					summary: a.summary ?? '',
+					value: {
+						files,
+						runnables,
+						// Keep the full-code app's explicit data table declaration.
+						...(parsed.data !== undefined ? { data: parsed.data } : {}),
+						...(parsed.datatables !== undefined ? { datatables: parsed.datatables } : {})
+					},
+					policy: await computeRawAppPolicy(runnables)
+				},
+				js,
+				css
+			}
+		})
+	}
+	return AppService.createApp({
+		workspace,
+		requestBody: {
+			path: a.path,
+			summary: a.summary ?? '',
+			value: a.value,
+			policy: await computeAppPolicy(a.value)
+		}
+	})
+}
+
+// Apply one migration to the target data table. If the data table opted into
+// migrations, record it (datatable_migrations + _wm_migrations, run only this
+// version); otherwise run the SQL once as a preview job (unrecorded).
+async function applyOneMigration(
+	workspace: string,
+	projectSlug: string,
+	m: ProjectMigration
+): Promise<void> {
+	let recorded = false
+	try {
+		const status = await WorkspaceService.getDatatableMigrationsStatus({
+			workspace,
+			datatableName: m.datatable_name
+		})
+		recorded = !!status.enabled
+	} catch {}
+
+	if (recorded) {
+		// Record the shipped down migration (DROP the created tables) so it can be
+		// rolled back.
+		const codeDown = (m.sql_down ?? '').trim()
+		const created = await WorkspaceService.createDatatableMigration({
+			workspace,
+			datatableName: m.datatable_name,
+			requestBody: {
+				name: `hub_import_${projectSlug}`,
+				code_up: m.sql,
+				code_down: codeDown || undefined
+			}
+		})
+		await WorkspaceService.runDatatableMigrations({
+			workspace,
+			datatableName: m.datatable_name,
+			only: created.timestamp
+		})
+	} else {
+		await runScriptAndPollResult({
+			workspace,
+			requestBody: {
+				language: 'postgresql',
+				content: m.sql,
+				args: { database: `datatable://${m.datatable_name}` }
+			}
+		})
+	}
+}
+
+/**
+ * Install a project export into `workspace` under `f/<folder>/`: create the
+ * folder, retarget every item, import kind by kind, then apply the (already
+ * reviewed) migrations. Each item's outcome is reported through `onResult`;
+ * failures never abort the remaining items.
+ */
+export async function installProject(args: {
+	workspace: string
+	exportData: ProjectExport
+	folder: string
+	migrations: ProjectMigration[]
+	hasEeLicense: boolean
+	onResult: (r: InstallResult) => void
+}): Promise<void> {
+	const { workspace, exportData, folder, migrations, hasEeLicense, onResult } = args
+
+	const record = (path: string, p: Promise<unknown>): Promise<void> =>
+		p.then(
+			() => onResult({ path, ok: true }),
+			(e: any) => onResult({ path, ok: false, error: errorMessage(e) })
+		)
+
+	try {
+		await FolderService.createFolder({ workspace, requestBody: { name: folder } })
+	} catch {}
+
+	const proj = retargetProjectExport(exportData, exportData.project.slug, folder)
+
+	// The export is remote input: every path it wants to write must stay inside
+	// the folder the user chose. Anything else (crafted export, or an export
+	// whose items weren't relocated into f/<slug>/ at publish) is refused
+	// per-item instead of being created in another namespace.
+	const prefix = `f/${folder}/`
+	const guard = (path: unknown, ...also: unknown[]): string | undefined => {
+		for (const p of [path, ...also]) {
+			if (typeof p !== 'string' || !p.startsWith(prefix)) {
+				return `path '${String(p)}' escapes the target folder ${prefix} — skipped`
+			}
+		}
+		return undefined
+	}
+	const checked = (path: unknown, run: () => Promise<unknown>, ...also: unknown[]) => {
+		const violation = guard(path, ...also)
+		return violation
+			? record(String(path), Promise.reject(new Error(violation)))
+			: record(String(path), run())
+	}
+
+	// `refs` catches structured runnable/`$res:` refs; `varValue` is the parsed item
+	// walked for `$var:`/`$jsonvar:` argument refs (which the ref extractors miss).
+	const checkedItem = (path: unknown, refs: Ref[], varValue: any, run: () => Promise<unknown>) => {
+		const violation =
+			guard(path) ??
+			refContainmentViolation(refs, folder) ??
+			varContainmentViolation(varValue, folder)
+		return violation
+			? record(String(path), Promise.reject(new Error(violation)))
+			: record(String(path), run())
+	}
+
+	for (const s of proj.scripts) {
+		// `$var:` is resolved in job args (flow inputs, schedule args, trigger config),
+		// not in script source, so there is no variable arg to contain here.
+		await checkedItem(s.path, extractScriptRefs(s.content ?? ''), undefined, () =>
+			importScript(workspace, s)
+		)
+	}
+	for (const f of proj.flows) {
+		await checkedItem(f.path, extractFlowRefs(f.value), f.value, () => importFlow(workspace, f))
+	}
+	for (const r of proj.resources) {
+		await checked(r.path, () => importResourceStub(workspace, r))
+	}
+	// Placeholders for the project's internal `$var:`/`$jsonvar:` refs (retargeted
+	// into this folder). External refs are rejected per-item, so only stub in-folder
+	// ones; guard again in case an out-of-folder ref slipped through retargeting.
+	for (const p of collectExportVarPaths(proj)) {
+		if (!p.startsWith(prefix)) continue
+		await record(`variable: ${p}`, importVariablePlaceholder(workspace, p))
+	}
+	for (const a of proj.apps) {
+		const isRaw = a.app_type === 'raw'
+		const refs = isRaw ? extractRawAppRefs(a.value?.raw ?? '') : extractAppRefs(a.value)
+		// Raw apps hold their runnables in the `value.raw` JSON string; parse it so the
+		// walk sees the same structure the backend resolves. Malformed raw fails at import.
+		let varValue: any = a.value
+		if (isRaw) {
+			try {
+				varValue = JSON.parse(a.value?.raw ?? '{}')
+			} catch {
+				varValue = undefined
+			}
+		}
+		await checkedItem(a.path, refs, varValue, () => importApp(workspace, a))
+	}
+	// A trigger's config is a live binding, not inert content: resource fields,
+	// handler runnables and $res: refs it names are acted on by the backend, so
+	// every one must stay inside the chosen folder (handlers may also point at
+	// hub/ scripts). Otherwise a crafted export could bind the trigger to
+	// existing assets in another namespace.
+	const triggerConfigViolation = (t: ExportItem): string | undefined => {
+		const cfg = (t.config ?? {}) as Record<string, any>
+		for (const r of triggerHandlerRefs({ kind: t.kind, config: cfg } as WorkspaceTrigger)) {
+			if (!r.path.startsWith(prefix) && !r.path.startsWith('hub/')) {
+				return `handler '${r.path}' escapes the target folder ${prefix} — skipped`
+			}
+		}
+		const resourceRefs = new Set(extractTriggerConfigResourceRefs(cfg))
+		const field = TRIGGER_KINDS[t.kind as WorkspaceTriggerKind]?.resourceField
+		const fieldValue = field ? cfg[field] : undefined
+		if (typeof fieldValue === 'string' && fieldValue !== '') resourceRefs.add(fieldValue)
+		for (const p of resourceRefs) {
+			if (!p.startsWith(prefix)) {
+				return `resource '${p}' escapes the target folder ${prefix} — skipped`
+			}
+		}
+		// Config fields (e.g. SQS queue_url) can carry `$var:`/`$jsonvar:` refs too.
+		return varContainmentViolation(cfg, folder)
+	}
+	for (const t of proj.triggers) {
+		const violation = guard(t.path, t.runnable_path) ?? triggerConfigViolation(t)
+		await record(
+			String(t.path),
+			violation
+				? Promise.reject(new Error(violation))
+				: createWorkspaceTriggerDisabled(
+						workspace,
+						{
+							kind: t.kind,
+							path: t.path,
+							script_path: t.runnable_path,
+							is_flow: t.runnable_kind === 'flow',
+							summary: t.summary ?? null,
+							config: t.config ?? null
+						},
+						{ hasEeLicense }
+					)
+		)
+	}
+
+	// Apply the reviewed data table migrations after items exist.
+	for (const m of migrations) {
+		await record(
+			`data table: ${m.datatable_name}`,
+			applyOneMigration(workspace, exportData.project.slug, m)
+		)
+	}
+}
diff --git a/frontend/src/lib/components/workspaceSettings/projectMigrations.test.ts b/frontend/src/lib/components/workspaceSettings/projectMigrations.test.ts
new file mode 100644
index 0000000000..7d35c51650
--- /dev/null
+++ b/frontend/src/lib/components/workspaceSettings/projectMigrations.test.ts
@@ -0,0 +1,372 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+// inferAssets loads WASM; stub it so script detection is deterministic and no
+// wasm init runs in the test.
+const inferAssetsMock = vi.fn()
+vi.mock('$lib/infer', () => ({ inferAssets: (...a: any[]) => inferAssetsMock(...a) }))
+
+// Only getDatatableFullSchema is used by the generator; stub the whole service.
+const getDatatableFullSchemaMock = vi.fn()
+vi.mock('$lib/gen', () => ({
+	WorkspaceService: {
+		getDatatableFullSchema: (...a: any[]) => getDatatableFullSchemaMock(...a)
+	}
+}))
+
+import { detectDatatableTables, generateDatatableMigrations } from './projectMigrations'
+import type { FetchedItem } from './projectBundle'
+
+describe('detectDatatableTables', () => {
+	beforeEach(() => inferAssetsMock.mockReset())
+
+	it('collects datatable/table refs from scripts (re-parsed), flows and raw apps', async () => {
+		inferAssetsMock.mockResolvedValue({
+			status: 'ok',
+			assets: [
+				{ kind: 'datatable', path: 'main/customers' },
+				{ kind: 'resource', path: 'u/admin/pg' } // ignored
+			]
+		})
+		const items: FetchedItem[] = [
+			{ kind: 'script', path: 'f/p/s', language: 'duckdb', content: 'select 1' },
+			{
+				kind: 'flow',
+				path: 'f/p/fl',
+				value: {
+					modules: [
+						{
+							id: 'a',
+							value: {
+								type: 'rawscript',
+								language: 'duckdb',
+								content: '',
+								assets: [{ kind: 'datatable', path: 'main/orders' }]
+							}
+						}
+					]
+				}
+			},
+			{
+				kind: 'raw_app',
+				path: 'f/p/app',
+				content: JSON.stringify({
+					runnables: {
+						r1: { inlineScript: { assets: [{ kind: 'datatable', path: 'analytics/events' }] } }
+					}
+				})
+			}
+		]
+		const usage = await detectDatatableTables(items)
+		expect([...(usage.get('main') ?? [])].sort()).toEqual(['customers', 'orders'])
+		expect([...(usage.get('analytics') ?? [])]).toEqual(['events'])
+	})
+
+	it('collects datatable refs from the preprocessor module', async () => {
+		inferAssetsMock.mockResolvedValue({ status: 'ok', assets: [] })
+		const items: FetchedItem[] = [
+			{
+				kind: 'flow',
+				path: 'f/p/fl',
+				value: {
+					modules: [],
+					preprocessor_module: {
+						id: 'pre',
+						value: {
+							type: 'rawscript',
+							language: 'duckdb',
+							content: '',
+							assets: [{ kind: 'datatable', path: 'main/inbox' }]
+						}
+					}
+				}
+			}
+		]
+		const usage = await detectDatatableTables(items)
+		expect([...(usage.get('main') ?? [])]).toEqual(['inbox'])
+	})
+
+	it('records a datatable used with no specific table', async () => {
+		inferAssetsMock.mockResolvedValue({
+			status: 'ok',
+			assets: [{ kind: 'datatable', path: 'main' }]
+		})
+		const usage = await detectDatatableTables([
+			{ kind: 'script', path: 'f/p/s', language: 'duckdb', content: 'x' }
+		])
+		expect(usage.has('main')).toBe(true)
+		expect(usage.get('main')?.size).toBe(0)
+	})
+
+	it('reads a full-code app’s explicit data.tables declaration', async () => {
+		const items: FetchedItem[] = [
+			{
+				kind: 'raw_app',
+				path: 'f/p/app',
+				content: JSON.stringify({
+					runnables: {},
+					data: {
+						datatable: 'main',
+						schema: 'app1',
+						tables: ['main/customers', 'main/app1:orders']
+					}
+				})
+			}
+		]
+		const usage = await detectDatatableTables(items)
+		// public-schema ref keeps the bare name; non-public keeps schema.table.
+		expect([...(usage.get('main') ?? [])].sort()).toEqual(['app1.orders', 'customers'])
+	})
+})
+
+describe('generateDatatableMigrations', () => {
+	beforeEach(() => getDatatableFullSchemaMock.mockReset())
+
+	const schema = {
+		public: {
+			customers: {
+				name: 'customers',
+				columns: [
+					{ name: 'id', datatype: 'integer', primary_key: true, nullable: false },
+					{ name: 'email', datatype: 'text', nullable: true }
+				],
+				foreign_keys: []
+			},
+			orders: {
+				name: 'orders',
+				columns: [
+					{ name: 'id', datatype: 'integer', primary_key: true, nullable: false },
+					{ name: 'customer_id', datatype: 'integer', nullable: false }
+				],
+				foreign_keys: [
+					{
+						target_table: 'public.customers',
+						columns: [{ source_column: 'customer_id', target_column: 'id' }],
+						on_delete: 'NO ACTION',
+						on_update: 'NO ACTION'
+					}
+				]
+			}
+		}
+	}
+
+	it('creates referenced tables in FK-dependency order in one transaction, enabled', async () => {
+		getDatatableFullSchemaMock.mockResolvedValue(schema)
+		const usage = new Map([['main', new Set(['orders', 'customers'])]])
+		const migrations = await generateDatatableMigrations('ws', usage)
+		expect(migrations).toHaveLength(1)
+		const m = migrations[0]
+		expect(m.datatable_name).toBe('main')
+		expect(m.enabled).toBe(true)
+		expect(m.sql.startsWith('BEGIN;')).toBe(true)
+		expect(m.sql.trimEnd().endsWith('COMMIT;')).toBe(true)
+		// customers (FK target) must be created before orders (FK source).
+		expect(m.sql.indexOf('"public"."customers"')).toBeLessThan(m.sql.indexOf('"public"."orders"'))
+		// A single wrapping transaction, not one per table.
+		expect(m.sql.match(/BEGIN;/g)?.length).toBe(1)
+		// Idempotent: won't abort if a pulled-in parent already exists in the target.
+		expect(m.sql).toContain('CREATE TABLE IF NOT EXISTS "public"."customers"')
+		// Down migration lists drops commented out (nothing dropped by default),
+		// in reverse order: orders (child) before customers (parent).
+		expect(m.sql_down).toContain('-- DROP TABLE IF EXISTS "public"."orders";')
+		expect(m.sql_down).toContain('-- DROP TABLE IF EXISTS "public"."customers";')
+		// No uncommented DROP TABLE anywhere.
+		expect(/^\s*DROP TABLE/m.test(m.sql_down)).toBe(false)
+		expect(m.sql_down.indexOf('"public"."orders"')).toBeLessThan(
+			m.sql_down.indexOf('"public"."customers"')
+		)
+	})
+
+	it('accepts schema-qualified table refs', async () => {
+		getDatatableFullSchemaMock.mockResolvedValue(schema)
+		const usage = new Map([['main', new Set(['public.customers'])]])
+		const migrations = await generateDatatableMigrations('ws', usage)
+		expect(migrations[0].enabled).toBe(true)
+		expect(migrations[0].sql).toContain('"public"."customers"')
+	})
+
+	it('leaves a qualified ref unresolved when its schema misses, never another schema\'s table', async () => {
+		getDatatableFullSchemaMock.mockResolvedValue(schema)
+		const usage = new Map([['main', new Set(['sales.orders'])]])
+		const migrations = await generateDatatableMigrations('ws', usage)
+		expect(migrations[0].sql).toContain('"sales.orders" is referenced but was not found')
+		expect(migrations[0].sql).not.toContain('CREATE TABLE "')
+	})
+
+	it('emits all CREATE TABLEs before any FK constraint so circular FKs work', async () => {
+		const cyclicSchema = {
+			public: {
+				a: {
+					name: 'a',
+					columns: [
+						{ name: 'id', datatype: 'integer', primary_key: true, nullable: false },
+						{ name: 'b_id', datatype: 'integer', nullable: true }
+					],
+					foreign_keys: [
+						{
+							target_table: 'public.b',
+							columns: [{ source_column: 'b_id', target_column: 'id' }],
+							on_delete: 'NO ACTION',
+							on_update: 'NO ACTION'
+						}
+					]
+				},
+				b: {
+					name: 'b',
+					columns: [
+						{ name: 'id', datatype: 'integer', primary_key: true, nullable: false },
+						{ name: 'a_id', datatype: 'integer', nullable: true }
+					],
+					foreign_keys: [
+						{
+							target_table: 'public.a',
+							columns: [{ source_column: 'a_id', target_column: 'id' }],
+							on_delete: 'NO ACTION',
+							on_update: 'NO ACTION'
+						}
+					]
+				}
+			}
+		}
+		getDatatableFullSchemaMock.mockResolvedValue(cyclicSchema)
+		const usage = new Map([['main', new Set(['a', 'b'])]])
+		const migrations = await generateDatatableMigrations('ws', usage)
+		const sql = migrations[0].sql
+		expect(sql).toContain('"public"."a"')
+		expect(sql).toContain('"public"."b"')
+		// Both FK constraints present, and every CREATE TABLE precedes the first one.
+		expect(sql.match(/ADD CONSTRAINT/g)?.length).toBe(2)
+		const lastCreate = sql.lastIndexOf('CREATE TABLE IF NOT EXISTS')
+		const firstConstraint = sql.indexOf('DO $$')
+		expect(lastCreate).toBeGreaterThan(-1)
+		expect(firstConstraint).toBeGreaterThan(lastCreate)
+	})
+
+	it('guards FK creation so re-running on an existing table does not abort', async () => {
+		getDatatableFullSchemaMock.mockResolvedValue(schema)
+		const usage = new Map([['main', new Set(['orders'])]])
+		const migrations = await generateDatatableMigrations('ws', usage)
+		const sql = migrations[0].sql
+		// The ADD CONSTRAINT must be wrapped in a pg_constraint existence check.
+		expect(sql).toContain('DO $$')
+		expect(sql).toContain('SELECT 1 FROM pg_constraint')
+		expect(sql).toContain(`conrelid = '"public"."orders"'::regclass`)
+		// No unguarded ALTER TABLE ... ADD at the start of a line.
+		expect(/^ALTER TABLE .* ADD CONSTRAINT/m.test(sql)).toBe(false)
+	})
+
+	it('creates non-public schemas before their tables', async () => {
+		const appSchema = {
+			app: {
+				customers: {
+					name: 'customers',
+					columns: [{ name: 'id', datatype: 'integer', primary_key: true, nullable: false }],
+					foreign_keys: []
+				}
+			}
+		}
+		getDatatableFullSchemaMock.mockResolvedValue(appSchema)
+		const usage = new Map([['main', new Set(['app.customers'])]])
+		const migrations = await generateDatatableMigrations('ws', usage)
+		const sql = migrations[0].sql
+		expect(sql).toContain('CREATE SCHEMA IF NOT EXISTS "app";')
+		expect(sql.indexOf('CREATE SCHEMA IF NOT EXISTS "app";')).toBeLessThan(
+			sql.indexOf('CREATE TABLE IF NOT EXISTS "app"."customers"')
+		)
+		expect(sql).not.toContain('CREATE SCHEMA IF NOT EXISTS "public"')
+	})
+
+	it('keeps same-named tables from different schemas both created', async () => {
+		const twoSchemas = {
+			public: {
+				customers: {
+					name: 'customers',
+					columns: [{ name: 'id', datatype: 'integer', primary_key: true, nullable: false }],
+					foreign_keys: []
+				}
+			},
+			app: {
+				customers: {
+					name: 'customers',
+					columns: [{ name: 'id', datatype: 'integer', primary_key: true, nullable: false }],
+					foreign_keys: []
+				}
+			}
+		}
+		getDatatableFullSchemaMock.mockResolvedValue(twoSchemas)
+		const usage = new Map([['main', new Set(['public.customers', 'app.customers'])]])
+		const migrations = await generateDatatableMigrations('ws', usage)
+		expect(migrations[0].sql).toContain('"public"."customers"')
+		expect(migrations[0].sql).toContain('"app"."customers"')
+	})
+
+	it('transitively pulls in FK-referenced tables not directly used', async () => {
+		getDatatableFullSchemaMock.mockResolvedValue(schema)
+		// Only `orders` is referenced; `customers` (its FK target) must still be
+		// created, and before `orders`.
+		const usage = new Map([['main', new Set(['orders'])]])
+		const migrations = await generateDatatableMigrations('ws', usage)
+		const m = migrations[0]
+		expect(m.enabled).toBe(true)
+		expect(m.sql).toContain('"public"."customers"')
+		expect(m.sql).toContain('"public"."orders"')
+		expect(m.sql.indexOf('"public"."customers"')).toBeLessThan(m.sql.indexOf('"public"."orders"'))
+	})
+
+	it('drops a foreign key whose target is not in the schema', async () => {
+		// `orders` references a `warehouses` table that no longer exists in the
+		// schema: the FK must be pruned so the migration still runs.
+		const schemaWithDanglingFk = {
+			public: {
+				orders: {
+					name: 'orders',
+					columns: [{ name: 'id', datatype: 'integer', primary_key: true, nullable: false }],
+					foreign_keys: [
+						{
+							target_table: 'public.warehouses',
+							columns: [{ source_column: 'id', target_column: 'id' }],
+							on_delete: 'NO ACTION',
+							on_update: 'NO ACTION'
+						}
+					]
+				}
+			}
+		}
+		getDatatableFullSchemaMock.mockResolvedValue(schemaWithDanglingFk)
+		const usage = new Map([['main', new Set(['orders'])]])
+		const migrations = await generateDatatableMigrations('ws', usage)
+		expect(migrations[0].enabled).toBe(true)
+		expect(migrations[0].sql).toContain('"public"."orders"')
+		expect(migrations[0].sql).not.toContain('warehouses')
+	})
+
+	it('emits a disabled comment entry when a referenced table is not found', async () => {
+		getDatatableFullSchemaMock.mockResolvedValue(schema)
+		const usage = new Map([['main', new Set(['nonexistent'])]])
+		const migrations = await generateDatatableMigrations('ws', usage)
+		expect(migrations).toHaveLength(1)
+		expect(migrations[0].enabled).toBe(false)
+		expect(migrations[0].sql).toContain('-- Table "nonexistent" is referenced but was not found')
+		expect(migrations[0].sql).not.toContain('BEGIN;')
+	})
+
+	it('keeps found tables and comments the missing ones in one migration', async () => {
+		getDatatableFullSchemaMock.mockResolvedValue(schema)
+		const usage = new Map([['main', new Set(['customers', 'ghost'])]])
+		const migrations = await generateDatatableMigrations('ws', usage)
+		expect(migrations[0].enabled).toBe(true)
+		expect(migrations[0].sql).toContain('"public"."customers"')
+		expect(migrations[0].sql).toContain('-- Table "ghost" is referenced but was not found')
+		// Comments precede the runnable transaction.
+		expect(migrations[0].sql.indexOf('-- Table "ghost"')).toBeLessThan(
+			migrations[0].sql.indexOf('BEGIN;')
+		)
+	})
+
+	it('comments a data table used with no specific table', async () => {
+		getDatatableFullSchemaMock.mockResolvedValue(schema)
+		const usage = new Map([['main', new Set<string>()]])
+		const migrations = await generateDatatableMigrations('ws', usage)
+		expect(migrations[0].enabled).toBe(false)
+		expect(migrations[0].sql).toContain('no specific table was referenced')
+	})
+})
diff --git a/frontend/src/lib/components/workspaceSettings/projectMigrations.ts b/frontend/src/lib/components/workspaceSettings/projectMigrations.ts
new file mode 100644
index 0000000000..b4e72389c0
--- /dev/null
+++ b/frontend/src/lib/components/workspaceSettings/projectMigrations.ts
@@ -0,0 +1,345 @@
+// Best-effort data table migration generation for the "project = folder" Hub
+// bundle. Detects which data tables (and tables within them) a project's
+// scripts/flows/raw apps reference via `datatable` assets, then generates a
+// `CREATE TABLE` bundle per data table from the source workspace's live schema,
+// so importing the project into another workspace can recreate those tables.
+//
+// Best-effort by design: the generated SQL is shown to the publisher and is
+// fully editable before publishing. Low-code (non-raw) apps have no persisted
+// asset list and are not scanned.
+
+import { inferAssets } from '$lib/infer'
+import type { SupportedLanguage } from '$lib/common'
+import { allFlowModules } from './projectBundle'
+import { getFlowModuleAssets } from '$lib/components/assets/lib'
+import { extractDataConfig, parseDataTableRef } from '$lib/components/raw_apps/dataTableRefUtils'
+import {
+	apiSchemaToEditorSchema,
+	generateAddedTableSql,
+	type DatabaseSchema
+} from '$lib/components/datatableSchemaSql'
+import { WorkspaceService } from '$lib/gen'
+import type { FetchedItem } from './projectBundle'
+
+export interface GeneratedMigration {
+	datatable_name: string
+	/** Up migration: creates the tables. */
+	sql: string
+	/** Down migration: drops the created tables. Best-effort, generated once and
+	 *  editable by the publisher (not re-derived from `sql`). */
+	sql_down: string
+	enabled: boolean
+}
+
+// A datatable asset path is `datatable`, `datatable/table`, or
+// `datatable/schema.table` (see the SQL asset parser). The first segment is the
+// data table name; the remainder identifies a specific table (absent = whole
+// data table, no table to create).
+function parseDatatableAssetPath(path: string): { datatable: string; table?: string } {
+	const slash = path.indexOf('/')
+	if (slash === -1) return { datatable: path }
+	const datatable = path.slice(0, slash)
+	const table = path.slice(slash + 1).trim()
+	return { datatable, table: table || undefined }
+}
+
+function addDatatableTable(
+	map: Map<string, Set<string>>,
+	datatable: string,
+	table: string | undefined
+): void {
+	if (!datatable) return
+	const set = map.get(datatable) ?? new Set<string>()
+	if (table) set.add(table)
+	map.set(datatable, set)
+}
+
+function addUsage(map: Map<string, Set<string>>, path: string): void {
+	const { datatable, table } = parseDatatableAssetPath(path)
+	addDatatableTable(map, datatable, table)
+}
+
+/**
+ * Scan a project's fetched items for data table usage and return
+ * `datatable -> set of table refs` (a table ref is `table` or `schema.table`).
+ *  - scripts: re-parse the code with the asset parser (`inferAssets`)
+ *  - flows: read each module's stored `assets`
+ *  - full-code (raw) apps: read the explicit `data.tables` declaration; fall back
+ *    to `runnables[key].inlineScript.assets` for older apps
+ */
+export async function detectDatatableTables(
+	items: FetchedItem[]
+): Promise<Map<string, Set<string>>> {
+	const map = new Map<string, Set<string>>()
+
+	for (const item of items) {
+		if (item.kind === 'script') {
+			const res = await inferAssets(
+				item.language as SupportedLanguage | undefined,
+				item.content ?? ''
+			)
+			if (res.status === 'ok') {
+				for (const a of res.assets) if (a.kind === 'datatable') addUsage(map, a.path)
+			}
+		} else if (item.kind === 'flow') {
+			for (const mod of allFlowModules(item.value)) {
+				const assets = getFlowModuleAssets(mod)
+				if (assets) for (const a of assets) if (a.kind === 'datatable') addUsage(map, a.path)
+			}
+		} else if (item.kind === 'raw_app') {
+			let parsed: any
+			try {
+				parsed = JSON.parse(item.content ?? '{}')
+			} catch {
+				continue
+			}
+			// Full-code apps explicitly declare the data tables/tables they use
+			// (`data.tables`, refs like `main/customers` or `main/schema:table`), so
+			// read that rather than parsing assets.
+			const config = extractDataConfig(parsed)
+			if (config) {
+				for (const ref of config.tables) {
+					const r = parseDataTableRef(ref)
+					const table = r.table
+						? r.schema && r.schema !== 'public'
+							? `${r.schema}.${r.table}`
+							: r.table
+						: undefined
+					addDatatableTable(map, r.datatable, table)
+				}
+			}
+			// Older raw apps instead carry datatable usage as inline-script assets.
+			const runnables = parsed?.runnables ?? {}
+			for (const key of Object.keys(runnables)) {
+				const assets = runnables[key]?.inlineScript?.assets
+				if (Array.isArray(assets))
+					for (const a of assets)
+						if (a?.kind === 'datatable' && typeof a.path === 'string') addUsage(map, a.path)
+			}
+		}
+	}
+	return map
+}
+
+// Resolve a table ref (`table` or `schema.table`) to a concrete
+// `{ schemaName, tableName }` present in the live schema, or undefined if the
+// table can't be found (dropped since, typo, …). A schema-qualified ref that
+// misses stays unresolved: falling back to a same-named table in another
+// schema would generate a migration for an unrelated table while the code
+// still references the missing one.
+function resolveTable(
+	schema: DatabaseSchema,
+	tableRef: string
+): { schemaName: string; tableName: string } | undefined {
+	const dot = tableRef.indexOf('.')
+	if (dot !== -1) {
+		const schemaName = tableRef.slice(0, dot)
+		const tableName = tableRef.slice(dot + 1)
+		return schema[schemaName]?.[tableName] ? { schemaName, tableName } : undefined
+	}
+	// Bare name: find it across every schema, first match wins.
+	for (const schemaName of Object.keys(schema)) {
+		if (schema[schemaName][tableRef]) return { schemaName, tableName: tableRef }
+	}
+	return undefined
+}
+
+type ResolvedTable = { schemaName: string; tableName: string }
+
+const tableKey = (t: ResolvedTable) => `${t.schemaName}.${t.tableName}`
+
+// Grow the set of tables to create so it's closed under foreign keys: a used
+// table's FK targets (and their FK targets, transitively) are pulled in, so the
+// generated CREATE TABLEs never reference a table that isn't also created. FK
+// targets that don't resolve in this schema are left out (their FK is pruned by
+// pruneSchemaForTables).
+function expandFkClosure(schema: DatabaseSchema, seed: ResolvedTable[]): ResolvedTable[] {
+	const inSet = new Map(seed.map((t) => [tableKey(t), t]))
+	const queue = [...seed]
+	while (queue.length > 0) {
+		const t = queue.shift()!
+		const fks = schema[t.schemaName]?.[t.tableName]?.foreignKeys ?? []
+		for (const fk of fks) {
+			const target = resolveTable(schema, fk.targetTable ?? '')
+			if (target && !inSet.has(tableKey(target))) {
+				inSet.set(tableKey(target), target)
+				queue.push(target)
+			}
+		}
+	}
+	return [...inSet.values()]
+}
+
+// A copy of the schema restricted to `tables`, with each table's foreign keys
+// filtered to targets that are also in `tables`. generateAddedTableSql emits every
+// FK it finds on a table, so pruning here keeps a stray FK (to a table outside the
+// migration) from making the generated SQL fail.
+function pruneSchemaForTables(schema: DatabaseSchema, tables: ResolvedTable[]): DatabaseSchema {
+	const inSet = new Set(tables.map(tableKey))
+	const pruned: DatabaseSchema = {}
+	for (const t of tables) {
+		const orig = schema[t.schemaName]?.[t.tableName]
+		if (!orig) continue
+		;(pruned[t.schemaName] ??= {})[t.tableName] = {
+			...orig,
+			foreignKeys: (orig.foreignKeys ?? []).filter((fk) => {
+				const target = resolveTable(schema, fk.targetTable ?? '')
+				return target != null && inSet.has(tableKey(target))
+			})
+		}
+	}
+	return pruned
+}
+
+// Order tables so a table is created after the in-set tables it references via a
+// foreign key. Keyed by schema-qualified name (like the rest of the pipeline) so
+// two same-named tables in different schemas aren't collapsed. Falls back to input
+// order on a cycle so generation never hangs.
+function orderByFkDependency(schema: DatabaseSchema, tables: ResolvedTable[]): ResolvedTable[] {
+	const inSet = new Set(tables.map(tableKey))
+	const deps = new Map<string, Set<string>>()
+	for (const t of tables) {
+		const fks = schema[t.schemaName]?.[t.tableName]?.foreignKeys ?? []
+		const targets = new Set<string>()
+		for (const fk of fks) {
+			const target = resolveTable(schema, fk.targetTable ?? '')
+			if (target && tableKey(target) !== tableKey(t) && inSet.has(tableKey(target))) {
+				targets.add(tableKey(target))
+			}
+		}
+		deps.set(tableKey(t), targets)
+	}
+	const ordered: ResolvedTable[] = []
+	const done = new Set<string>()
+	const visiting = new Set<string>()
+	const byKey = new Map(tables.map((t) => [tableKey(t), t]))
+	const visit = (key: string) => {
+		if (done.has(key) || visiting.has(key)) return
+		visiting.add(key)
+		for (const dep of deps.get(key) ?? []) visit(dep)
+		visiting.delete(key)
+		done.add(key)
+		const t = byKey.get(key)
+		if (t) ordered.push(t)
+	}
+	for (const t of tables) visit(tableKey(t))
+	return ordered
+}
+
+// Pull a readable one-line message out of an API error for embedding in a SQL
+// comment (collapse whitespace so it can't break out of the `--` line).
+function errorText(e: any): string {
+	const body = e?.body
+	const raw =
+		typeof body === 'string' && body.trim()
+			? body
+			: body && typeof body === 'object'
+				? (body.error?.message ?? body.message ?? JSON.stringify(body))
+				: (e?.message ?? String(e))
+	return String(raw).replace(/\s+/g, ' ').trim()
+}
+
+/**
+ * Generate one best-effort migration per used data table. Resolved tables (plus
+ * the tables they depend on via foreign key, in FK-dependency order) become a
+ * single CREATE TABLE transaction, enabled by default. Anything that couldn't be
+ * auto-generated — a table not found in the schema, a data table referenced as a
+ * whole, or a schema that couldn't be loaded — is written as a `--` SQL comment
+ * describing the problem, so the publisher sees what's missing instead of a blank
+ * entry. A migration with no runnable statements (only comments) is left disabled.
+ */
+export async function generateDatatableMigrations(
+	workspace: string,
+	usage: Map<string, Set<string>>
+): Promise<GeneratedMigration[]> {
+	const out: GeneratedMigration[] = []
+	for (const [datatable, tableRefs] of usage) {
+		let schema: DatabaseSchema
+		try {
+			const api = await WorkspaceService.getDatatableFullSchema({
+				workspace,
+				requestBody: { source: `datatable://${datatable}` }
+			})
+			schema = apiSchemaToEditorSchema(api)
+		} catch (e) {
+			// Couldn't reach the schema at all: leave a commented stub explaining why,
+			// so the publisher can fill it in rather than seeing a silent blank.
+			out.push({
+				datatable_name: datatable,
+				sql:
+					`-- Could not load the schema of data table "${datatable}": ${errorText(e)}\n` +
+					`-- Add the CREATE TABLE statement(s) for the tables this project uses.`,
+				sql_down: '',
+				enabled: false
+			})
+			continue
+		}
+		// Resolve the referenced tables; record a comment for each one we can't find
+		// so a partial migration still explains what's missing.
+		const resolved: ResolvedTable[] = []
+		const comments: string[] = []
+		for (const ref of tableRefs) {
+			const t = resolveTable(schema, ref)
+			if (t) resolved.push(t)
+			else
+				comments.push(
+					`-- Table "${ref}" is referenced but was not found in data table "${datatable}"; add its CREATE TABLE manually.`
+				)
+		}
+		if (tableRefs.size === 0) {
+			comments.push(
+				`-- Data table "${datatable}" is used but no specific table was referenced; nothing to generate automatically.`
+			)
+		}
+		// Pull in the tables the referenced ones depend on via FK, then generate
+		// against a schema whose FKs are restricted to this set, so the migration
+		// creates everything it references and never emits a dangling FK.
+		const closure = expandFkClosure(schema, resolved)
+		const ordered = orderByFkDependency(schema, closure)
+		const prunedSchema = pruneSchemaForTables(schema, ordered)
+		// Every CREATE TABLE is emitted before any FK constraint: circular FKs have
+		// no valid creation order, so constraints can only run once all tables exist.
+		const creates: string[] = []
+		const constraints: string[] = []
+		for (const t of ordered) {
+			// IF NOT EXISTS: FK closure pulls in shared parent tables (e.g. a
+			// referenced `orders` drags in `customers`) that often already exist in
+			// the target, so a plain CREATE would abort the whole transaction. The
+			// caveat — an existing differently-shaped table is silently left as-is —
+			// is acceptable for a best-effort, editable migration.
+			const gen = generateAddedTableSql(
+				{ schemaName: t.schemaName, tableName: t.tableName, kind: 'added' },
+				prunedSchema,
+				{ ifNotExists: true }
+			)
+			if (!gen) continue
+			creates.push(gen.create)
+			constraints.push(...gen.constraints)
+		}
+		const statements = [...creates, ...constraints]
+		// Comments (the errors) go on top; the CREATE TABLE transaction, if any,
+		// follows. Enabled only when there's something to run.
+		const parts: string[] = []
+		if (comments.length > 0) parts.push(comments.join('\n'))
+		if (statements.length > 0) parts.push(`BEGIN;\n${statements.join('\n\n')}\nCOMMIT;`)
+		// Best-effort down migration: the DROP TABLE statements are commented out
+		// because the FK closure pulls in shared parent tables that may have
+		// pre-existed in the target (dropping them would lose data the project never
+		// created). The publisher uncomments the tables this migration should drop.
+		const drops = [...ordered]
+			.reverse()
+			.map((t) => `-- DROP TABLE IF EXISTS "${t.schemaName}"."${t.tableName}";`)
+		const sqlDown =
+			drops.length > 0
+				? `-- Rollback: uncomment the tables this migration should drop (leave shared\n` +
+					`-- tables that already existed in the workspace commented out).\nBEGIN;\n${drops.join('\n')}\nCOMMIT;`
+				: ''
+		out.push({
+			datatable_name: datatable,
+			sql: parts.join('\n\n'),
+			sql_down: sqlDown,
+			enabled: statements.length > 0
+		})
+	}
+	return out.sort((a, b) => a.datatable_name.localeCompare(b.datatable_name))
+}
diff --git a/frontend/src/routes/(root)/(logged)/folders/+page.svelte b/frontend/src/routes/(root)/(logged)/folders/+page.svelte
index 42de9d38a5..343e7a3e48 100644
--- a/frontend/src/routes/(root)/(logged)/folders/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/folders/+page.svelte
@@ -14,7 +14,8 @@
 	import { sendUserToast } from '$lib/utils'
 	import DataTable from '$lib/components/table/DataTable.svelte'
 	import Cell from '$lib/components/table/Cell.svelte'
-	import { Pen, Trash, Plus } from 'lucide-svelte'
+	import { Pen, Trash, Plus, UploadCloud } from 'lucide-svelte'
+	import DeployToHub from '$lib/components/workspaceSettings/DeployToHub.svelte'
 	import Head from '$lib/components/table/Head.svelte'
 	import Row from '$lib/components/table/Row.svelte'
 	import Badge from '$lib/components/common/badge/Badge.svelte'
@@ -30,6 +31,8 @@
 	let newFolderName: string = $state('')
 	let folders: FolderW[] | undefined = $state(undefined)
 	let folderDrawer: Drawer | undefined = $state()
+	let hubDrawer: Drawer | undefined = $state()
+	let publishFolderName: string = $state('')
 
 	async function loadFolders(): Promise<void> {
 		folders = (await FolderService.listFolders({ workspace: $workspaceStore! })).map((x) => {
@@ -88,6 +91,22 @@
 	</DrawerContent>
 </Drawer>
 
+<Drawer bind:this={hubDrawer} size="1100px">
+	<DrawerContent
+		title="Publish {publishFolderName} to Hub"
+		on:close={() => {
+			hubDrawer?.closeDrawer()
+			publishFolderName = ''
+		}}
+	>
+		{#if publishFolderName}
+			{#key publishFolderName}
+				<DeployToHub folder={publishFolderName} />
+			{/key}
+		{/if}
+	</DrawerContent>
+</Drawer>
+
 {#if $userStore?.operator && $workspaceStore && !$userWorkspaces.find((_) => _.id === $workspaceStore)?.operator_settings?.folders}
 	<div class="bg-red-100 border-l-4 border-red-600 text-orange-700 p-4 m-4 mt-12" role="alert">
 		<p class="font-bold">Unauthorized</p>
@@ -235,6 +254,15 @@
 													folderDrawer?.openDrawer()
 												}
 											},
+											{
+												displayName: 'Publish to Hub',
+												icon: UploadCloud,
+												disabled: !($userStore?.is_admin || $userStore?.is_super_admin),
+												action: () => {
+													publishFolderName = name
+													hubDrawer?.openDrawer()
+												}
+											},
 											{
 												displayName: `Delete${canWrite ? '' : ' (require owner permissions)'}`,
 												icon: Trash,
diff --git a/frontend/src/routes/(root)/(logged)/projects/install/+page.svelte b/frontend/src/routes/(root)/(logged)/projects/install/+page.svelte
new file mode 100644
index 0000000000..06f2344356
--- /dev/null
+++ b/frontend/src/routes/(root)/(logged)/projects/install/+page.svelte
@@ -0,0 +1,374 @@
+<script lang="ts">
+	import { page } from '$app/stores'
+	import { goto } from '$app/navigation'
+	import { workspaceStore, enterpriseLicense } from '$lib/stores'
+	import { sendUserToast } from '$lib/toast'
+	import { Button, Drawer, DrawerContent } from '$lib/components/common'
+	import Toggle from '$lib/components/Toggle.svelte'
+	import { WorkspaceService } from '$lib/gen'
+	import FolderPicker from '$lib/components/FolderPicker.svelte'
+	import type {
+		ProjectExport,
+		ProjectMigration
+	} from '$lib/components/workspaceSettings/projectBundle'
+	import {
+		installProject,
+		type InstallResult
+	} from '$lib/components/workspaceSettings/projectInstall'
+	import MigrationSqlEditor from '$lib/components/workspaceSettings/MigrationSqlEditor.svelte'
+	import ConfirmationModal from '$lib/components/common/confirmationModal/ConfirmationModal.svelte'
+	import { createAsyncConfirmationModal } from '$lib/components/common/confirmationModal/asyncConfirmationModal.svelte'
+	import Portal from '$lib/components/Portal.svelte'
+	import { Cloud, Download, Loader2 } from 'lucide-svelte'
+
+	let slug = $derived($page.url.searchParams.get('hub') ?? '')
+	let workspace = $derived($workspaceStore)
+
+	let loading = $state(true)
+	let loadError = $state<string | undefined>(undefined)
+	let data = $state<ProjectExport | undefined>(undefined)
+	let installing = $state(false)
+	// True while the migration review/missing-datatable modals are open, before the
+	// import spinner starts — keeps the Import button from launching a second import.
+	let planningMigrations = $state(false)
+	let results = $state<InstallResult[]>([])
+	let done = $state(false)
+	let folderName = $state('')
+
+	// When the target lacks a needed data table, "import without that migration".
+	const missingDatatableModal = createAsyncConfirmationModal()
+
+	// Migration review drawer: preview + edit each runnable migration's SQL and
+	// choose which to run, resolved linearly via `reviewResolve`.
+	let reviewDrawer = $state<Drawer | undefined>()
+	let reviewList = $state<
+		{ datatable_name: string; sql: string; sql_down: string; run: boolean }[]
+	>([])
+	// Bumped per review session so the Monaco editors re-mount with the new SQL.
+	let reviewGeneration = $state(0)
+	let reviewResolve: ((run: boolean) => void) | undefined
+	function openMigrationReview(migs: ProjectMigration[]): Promise<boolean> {
+		reviewList = migs.map((m) => ({
+			datatable_name: m.datatable_name,
+			sql: m.sql,
+			sql_down: m.sql_down ?? '',
+			run: true
+		}))
+		reviewGeneration++
+		reviewDrawer?.openDrawer()
+		return new Promise((resolve) => (reviewResolve = resolve))
+	}
+	function closeMigrationReview(run: boolean) {
+		// Capture + clear first so the `on:close` fired by closeDrawer() (which would
+		// call this again with run=false) can't override an explicit Run/Skip choice.
+		const resolve = reviewResolve
+		reviewResolve = undefined
+		reviewDrawer?.closeDrawer()
+		resolve?.(run)
+	}
+
+	let loadSeq = 0
+
+	$effect(() => {
+		if (slug && workspace) void load()
+	})
+
+	async function load() {
+		// Token + captured slug/workspace: a slow /export for an old ?hub= must not
+		// overwrite the data of a newer one once we've navigated away.
+		const reqSeq = ++loadSeq
+		const reqSlug = slug
+		const reqWorkspace = workspace
+		loading = true
+		loadError = undefined
+		// New slug/workspace = a fresh import session: drop the previous project's
+		// outcome, otherwise project B stays disabled as "Imported" with A's
+		// results, and keeps A's folder.
+		data = undefined
+		done = false
+		results = []
+		folderName = ''
+		try {
+			const res = await fetch(
+				`/api/w/${reqWorkspace}/hub/projects/${encodeURIComponent(reqSlug)}/export`,
+				{ credentials: 'include', headers: { accept: 'application/json' } }
+			)
+			const text = await res.text()
+			if (reqSeq !== loadSeq) return // a newer load() superseded this one
+			if (!res.ok) throw new Error(`export ${res.status}: ${text}`)
+			data = JSON.parse(text)
+			if (data && !folderName) folderName = data.project.slug
+		} catch (e: any) {
+			if (reqSeq !== loadSeq) return
+			loadError = e?.message ?? String(e)
+		} finally {
+			if (reqSeq === loadSeq) loading = false
+		}
+	}
+
+	const counts = $derived(
+		data
+			? {
+					scripts: data.scripts.length,
+					flows: data.flows.length,
+					apps: data.apps.length,
+					resources: data.resources.length,
+					triggers: data.triggers.length,
+					migrations: (data.migrations ?? []).filter(
+						(m) => m.enabled && (m.sql ?? '').trim() !== ''
+					).length
+				}
+			: undefined
+	)
+
+	// Decide which data table migrations to run. Migrations are keyed by data table
+	// name and applied only to a target data table of the same name. Returns the
+	// migrations to run (with any edits the user made), an empty array when there's
+	// nothing to run, or `null` when the user backs out of the whole import at the
+	// missing-data-table warning.
+	async function planMigrations(
+		workspace: string,
+		migrations: ProjectMigration[]
+	): Promise<ProjectMigration[] | null> {
+		const enabled = migrations.filter((m) => m.enabled && (m.sql ?? '').trim() !== '')
+		if (enabled.length === 0) return []
+
+		let present: Set<string>
+		try {
+			const dts = await WorkspaceService.listDataTables({ workspace })
+			present = new Set(dts.map((d) => d.name))
+		} catch {
+			// Can't read the target's data tables — skip migrations rather than guess.
+			return []
+		}
+		const runnable = enabled.filter((m) => present.has(m.datatable_name))
+		const missingNames = [
+			...new Set(enabled.filter((m) => !present.has(m.datatable_name)).map((m) => m.datatable_name))
+		]
+
+		// Warn about missing data tables first: confirming imports without their
+		// migrations, cancelling backs out of the whole import so the user can create
+		// the data table(s) and re-run.
+		if (missingNames.length > 0) {
+			const proceed = await missingDatatableModal.ask({
+				title: 'Some data tables are missing',
+				confirmationText: 'Import without them',
+				children: `This project uses data table(s) "${missingNames.join(
+					'", "'
+				)}" that don't exist in this workspace, so their migrations will be skipped. To apply them, cancel, create the data table(s) with the same name in Workspace settings → Data tables, then re-run this import.`
+			})
+			if (!proceed) return null
+		}
+
+		let toRun: ProjectMigration[] = []
+		if (runnable.length > 0) {
+			const run = await openMigrationReview(runnable)
+			if (run) {
+				toRun = reviewList
+					.filter((r) => r.run && r.sql.trim() !== '')
+					.map((r) => ({
+						datatable_name: r.datatable_name,
+						sql: r.sql,
+						sql_down: r.sql_down,
+						enabled: true
+					}))
+			}
+		}
+		return toRun
+	}
+
+	async function install() {
+		// Snapshot reactive state up-front: `workspace` ($derived) and `data`
+		// ($state, replaced by load()) can both change mid-import on a workspace
+		// switch, which would split items or mix two exports. Pin both.
+		// Guard against a second click while the review modal is open (the Import
+		// button isn't `installing` yet during planning, so it would otherwise be
+		// clickable and start a concurrent import).
+		if (installing || planningMigrations) return
+		const workspace = $workspaceStore
+		const exportData = data
+		if (!exportData || !workspace) return
+		const folder = folderName.trim() || exportData.project.slug
+		// A slug/workspace switch mid-import bumps loadSeq and resets the view for
+		// the new project; this import's UI writes (results/done/toast) must then
+		// be dropped so they can't mark the new project as imported.
+		const sessionSeq = loadSeq
+		const sessionSlug = slug
+		// loadSeq only advances when a NEW load starts; navigating away (workspace
+		// or ?hub becoming empty) never bumps it, so also require the live
+		// identity to still match the captured one.
+		const current = () =>
+			sessionSeq === loadSeq && slug === sessionSlug && $workspaceStore === workspace
+
+		// Review data table migrations first (before the import spinner), so the user
+		// previews/edits and decides, then the whole import runs uninterrupted.
+		planningMigrations = true
+		let migrationsToRun: ProjectMigration[] | null
+		try {
+			migrationsToRun = await planMigrations(workspace, exportData.migrations ?? [])
+		} finally {
+			planningMigrations = false
+		}
+		// User backed out at the missing-data-table warning — abort the whole import.
+		if (migrationsToRun === null) return
+		// The migration review can stay open indefinitely; if the project or
+		// workspace changed underneath it, confirming the stale dialog must not
+		// write the old export into the old workspace (with all feedback
+		// suppressed by the session guard).
+		if (!current()) {
+			sendUserToast('Import cancelled — the project or workspace changed during review.', true)
+			return
+		}
+
+		installing = true
+		results = []
+		done = false
+		try {
+			await installProject({
+				workspace,
+				exportData,
+				folder,
+				migrations: migrationsToRun,
+				hasEeLicense: !!$enterpriseLicense,
+				onResult: (r) => {
+					if (current()) results = [...results, r]
+				}
+			})
+
+			if (current()) {
+				done = true
+				const failed = results.filter((r) => !r.ok).length
+				sendUserToast(
+					failed > 0
+						? `Imported with ${failed} item(s) failed.`
+						: `Project imported into ${workspace}.`,
+					failed > 0
+				)
+			}
+		} finally {
+			installing = false
+		}
+	}
+</script>
+
+<div class="mx-auto w-full max-w-screen-md px-4 py-10">
+	{#if !slug}
+		<p class="text-sm text-secondary">Missing <span class="font-mono">?hub=&lt;slug&gt;</span>.</p>
+	{:else if loading}
+		<div class="flex items-center gap-2 text-sm text-secondary">
+			<Loader2 size={16} class="animate-spin" /> Loading project…
+		</div>
+	{:else if loadError}
+		<p class="text-sm text-red-600">Failed to load project: {loadError}</p>
+	{:else if data}
+		<h1 class="text-2xl font-semibold text-primary">Add “{data.project.name}” to workspace</h1>
+		<p class="mt-1 text-sm text-secondary">{data.project.summary}</p>
+
+		<div class="mt-4 max-w-xs">
+			<p class="mb-1 text-xs text-tertiary">
+				Folder in <span class="font-mono">{workspace}</span>
+			</p>
+			<FolderPicker bind:folderName disabled={installing || done} size="sm" />
+			<p class="mt-1 text-xs text-tertiary">
+				Items import under <span class="font-mono">f/{folderName.trim() || data.project.slug}/</span
+				>.
+			</p>
+		</div>
+
+		<div class="mt-6 flex flex-wrap gap-2 text-xs">
+			<span class="rounded border px-2 py-1">{counts?.scripts} scripts</span>
+			<span class="rounded border px-2 py-1">{counts?.flows} flows</span>
+			<span class="rounded border px-2 py-1">{counts?.apps} apps</span>
+			<span class="rounded border px-2 py-1">{counts?.resources} resources</span>
+			<span class="rounded border px-2 py-1">{counts?.triggers} triggers</span>
+			{#if counts && counts.migrations > 0}
+				<span class="rounded border px-2 py-1">{counts.migrations} data table migrations</span>
+			{/if}
+		</div>
+
+		<div
+			class="mt-4 rounded-md border border-amber-300 bg-amber-50 px-3 py-2 text-xs text-amber-900 dark:border-amber-800 dark:bg-amber-950/40 dark:text-amber-100"
+		>
+			Resources are imported as empty stubs — set their values after import; a resource whose path
+			already exists is reported as failed (existing values are never overwritten). Trigger kinds
+			are recreated disabled, except GCP and Azure triggers, which manage cloud subscriptions at
+			creation and must be re-created manually after filling their resource. Kafka, NATS, SQS, GCP
+			and Azure triggers all require Enterprise. Triggers that reference a resource depend on stubs
+			imported empty, so fill in the resource value before re-enabling the trigger.
+		</div>
+
+		<div class="mt-6 flex items-center gap-3">
+			<Button
+				variant="accent"
+				startIcon={{ icon: done ? Cloud : Download }}
+				disabled={installing || done || planningMigrations}
+				onclick={install}
+			>
+				{#if installing}
+					<Loader2 size={16} class="animate-spin mr-1" /> Importing…
+				{:else if done}
+					Imported
+				{:else}
+					Import to {workspace}
+				{/if}
+			</Button>
+			{#if done}
+				<Button variant="border" onclick={() => goto(`/`)}>Go to workspace</Button>
+			{/if}
+		</div>
+
+		{#if results.length}
+			<ul class="mt-6 flex flex-col gap-1 text-xs">
+				{#each results as r}
+					<li class="flex items-center gap-2">
+						<span class={r.ok ? 'text-emerald-600' : 'text-red-600'}>{r.ok ? '✓' : '✗'}</span>
+						<span class="font-mono">{r.path}</span>
+						{#if !r.ok}<span class="text-red-600">— {r.error}</span>{/if}
+					</li>
+				{/each}
+			</ul>
+		{/if}
+	{/if}
+</div>
+
+<Portal>
+	<ConfirmationModal {...missingDatatableModal.props} />
+</Portal>
+
+<Drawer bind:this={reviewDrawer} size="700px" on:close={() => closeMigrationReview(false)}>
+	<DrawerContent title="Data table migrations" on:close={() => closeMigrationReview(false)}>
+		<div class="flex flex-col gap-4">
+			<p class="text-xs text-secondary">
+				This project ships migrations that recreate the data tables it uses. Review and edit the
+				SQL, then choose which to run. A migration runs against the data table of the same name in
+				<span class="font-mono">{workspace}</span>; if that data table has migrations enabled it is
+				recorded, otherwise it runs once as a preview job.
+			</p>
+			{#each reviewList as m (m.datatable_name)}
+				<div class="flex flex-col gap-1.5 rounded border bg-surface-secondary p-2 text-xs">
+					<div class="flex items-center justify-between gap-2">
+						<span class="font-mono text-primary">{m.datatable_name}</span>
+						<Toggle bind:checked={m.run} size="xs" options={{ right: 'Run' }} />
+					</div>
+					{#if m.run}
+						<MigrationSqlEditor
+							bind:up={m.sql}
+							bind:down={m.sql_down}
+							generation={reviewGeneration}
+						/>
+					{/if}
+				</div>
+			{/each}
+		</div>
+		{#snippet actions()}
+			<Button variant="border" onclick={() => closeMigrationReview(false)}>Skip migrations</Button>
+			<Button
+				variant="accent"
+				disabled={!reviewList.some((m) => m.run && m.sql.trim() !== '')}
+				onclick={() => closeMigrationReview(true)}
+			>
+				Run selected
+			</Button>
+		{/snippet}
+	</DrawerContent>
+</Drawer>

From 65e504146d832b105603ceec89c6de0ad1d66e32 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Thu, 23 Jul 2026 18:31:40 +0200
Subject: [PATCH 139/171] feat: data-pipeline recorder, interactive player, and
 deploy-to-hub recording (WIN-2156) (#10055)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* feat(frontend): add data-pipeline run recorder and interactive player

Adds a recorder/player for data pipelines, mirroring the existing flow and
script recorders. Arm "Record" on a pipeline, run it, and the resulting
cascade is captured into a downloadable JSON that the /replay player can
rerun fully offline.

Because a pipeline run is a cascade of independent jobs (not a single root
SSE job like flows), the recording captures three things: the resolved
asset graph, the per-node cascade status timeline (from the orchestrator's
onUpdate), and each node's job stream (opened via getupdate_sse on launch).

The player renders the graph read-only, animates the recorded node
transitions in real time, and lets you click any node to inspect its
recorded args, logs and result — reusing the same JobLoader replay path
the flow/script players use (setActiveReplay + isReplay gating), so no
network calls are made during replay.

- recording/types.ts: PipelineRecording, PipelineTimelineFrame, RecordedNodeState
- recording/pipelineRecording.svelte.ts: createPipelineRecording() store
- recording/PipelineRecordingReplay.svelte: the player component
- replay/+page.svelte: dispatch type === 'pipeline'
- pipeline/[folder]/+page.svelte: Record toggle + Download recording; capture
  the whole-pipeline / bounded cascade run

Fixes WIN-2156

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(frontend): capture DuckLake/datatable data samples in pipeline recordings

Follow-up to the pipeline recorder/player: asset nodes are now inspectable
offline in the player, showing what each table held after the recorded run.

At record finalization, for each ducklake/datatable asset in the pipeline the
recorder samples the table (up to 100 rows + columns + row count) reusing the
exact live-preview query path (loadAllTablesMetaData + getRows), so a replayed
sample matches what the asset-detail pane would have shown. Captures are
best-effort and per-asset — a missing/unconfigured table is stored as an error
marker, never thrown, so the recording still completes.

The player renders the sample as a read-only typed grid when an asset node is
clicked (script nodes keep their logs/result/args detail).

- recording/types.ts: PipelineAssetSample + assetSamples on PipelineRecording
- recording/pipelineAssetSample.ts: capturePipelineAssetSample() helper
- recording/pipelineRecording.svelte.ts: recordAssetSample() + assetSamples
- recording/PipelineRecordingReplay.svelte: asset-node data-sample panel
- pipeline/[folder]/+page.svelte: sample each asset in finalizePipelineRecording

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* recorder

* feat(hub): record data pipelines in deploy-to-hub with interactive player

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(hub): match editor cascade timeout, warn on cycles, reset badge on re-run

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(recording): address review — finalize race, stale replay timers, /replay redirect, bounded sampling, jobs validation

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(recording): structural recording validation, guard-clear + SSE cleanup on throw paths

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(recording): validate nested graph arrays and timeline frame statuses

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(hub): scope recording to bundle membership, fail cyclic runs, validate recording elements

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(hub): prune recorded graph + asset samples to bundle membership

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(recording): validate graph.triggers array and per-job initial_job/events shapes

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(recording): guard non-object payloads, event elements, and asset-sample/code maps

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(recording): render error boundary + validate trigger_kind and non-empty sample error

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(recording): validate event.data and recorded-job shapes for all replay types

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(recording): make the replay event timer crash-proof against malformed events

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(recording): await replay completion and boundary-wrap all three players

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(recording): guard flow Play handler, cap ?src= download size, trim comment

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 backend/windmill-api/openapi.yaml             |  40 ++
 backend/windmill-api/src/hub_publish.rs       |  22 +
 frontend/package.json                         |  10 +-
 frontend/src/lib/components/JobLoader.svelte  |  46 +-
 .../assets/AssetGraph/AssetGraphCanvas.svelte |  20 +-
 .../assets/AssetGraph/AssetNode.svelte        |  28 +
 .../assets/AssetGraph/RunnableNode.svelte     |  10 +-
 .../assets/AssetGraph/cascadeRun.ts           |   5 +
 .../recording/FlowRecordingReplay.svelte      |  27 +-
 .../recording/PipelineRecordingReplay.svelte  | 520 ++++++++++++++++++
 .../recording/pipelineAssetSample.ts          |  77 +++
 .../recording/pipelineRecording.svelte.ts     | 335 +++++++++++
 .../src/lib/components/recording/types.ts     |  66 ++-
 .../workspaceSettings/DeployToHub.svelte      |  89 ++-
 .../deployToHubSession.svelte.ts              | 184 +++++++
 .../(logged)/pipeline/[folder]/+page.svelte   |  85 ++-
 .../(logged)/pipeline_replay/+page.svelte     | 296 ++++++++++
 .../(root)/(logged)/replay/+page.svelte       |  79 ---
 .../routes/(root)/(logged)/replay/+page.ts    |   9 +
 19 files changed, 1835 insertions(+), 113 deletions(-)
 create mode 100644 frontend/src/lib/components/recording/PipelineRecordingReplay.svelte
 create mode 100644 frontend/src/lib/components/recording/pipelineAssetSample.ts
 create mode 100644 frontend/src/lib/components/recording/pipelineRecording.svelte.ts
 create mode 100644 frontend/src/routes/(root)/(logged)/pipeline_replay/+page.svelte
 delete mode 100644 frontend/src/routes/(root)/(logged)/replay/+page.svelte
 create mode 100644 frontend/src/routes/(root)/(logged)/replay/+page.ts

diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index d3e1661fde..12300d4a69 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -23132,6 +23132,40 @@ paths:
               schema:
                 type: string
 
+  /w/{workspace}/hub/projects/{slug}/pipeline_recording:
+    post:
+      summary: attach a data-pipeline recording to a hub project
+      description: |
+        Requires the caller to be a workspace admin. A data-pipeline recording is
+        scoped to the whole project (a folder cascade), not a single item. Forwards
+        the request to the configured Hub scoped to the `{workspace}:{folder}`
+        source and returns the Hub's status code and raw response body.
+      operationId: publishHubPipelineRecording
+      tags:
+        - hubPublish
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - name: slug
+          in: path
+          required: true
+          description: hub project slug
+          schema:
+            $ref: "#/components/schemas/HubProjectSlug"
+        - $ref: "#/components/parameters/HubPublishFolder"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/PipelineRecordingBody"
+      responses:
+        "200":
+          description: raw Hub response body (status code is passed through from the Hub)
+          content:
+            text/plain:
+              schema:
+                type: string
+
   /w/{workspace}/hub/resource_types:
     post:
       summary: publish a resource type to a hub project
@@ -32444,6 +32478,12 @@ components:
       required:
         - project_slug
 
+    PipelineRecordingBody:
+      type: object
+      properties:
+        recording:
+          type: object
+
     PublishResourceTypeBody:
       type: object
       properties:
diff --git a/backend/windmill-api/src/hub_publish.rs b/backend/windmill-api/src/hub_publish.rs
index e0baaecccf..fab473ea41 100644
--- a/backend/windmill-api/src/hub_publish.rs
+++ b/backend/windmill-api/src/hub_publish.rs
@@ -28,6 +28,10 @@ pub fn workspaced_service() -> Router {
             post(publish_script_recording),
         )
         .route("/flows/{flow_id}/recording", post(publish_flow_recording))
+        .route(
+            "/projects/{slug}/pipeline_recording",
+            post(publish_pipeline_recording),
+        )
         .route("/resource_types", post(publish_resource_type))
         .route("/resources", post(publish_resources))
         .route("/triggers", post(publish_triggers))
@@ -337,6 +341,24 @@ async fn publish_flow_recording(
         .await
 }
 
+// A data-pipeline recording is scoped to the whole project (a folder cascade),
+// not a single Hub item, so the slug comes from the path (validated by
+// construction) and only the opaque recording is forwarded.
+#[derive(Deserialize, Serialize)]
+struct PipelineRecordingBody {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    recording: Option<serde_json::Value>,
+}
+
+async fn publish_pipeline_recording(
+    ctx: HubPublishCtx,
+    Path((_workspace, slug)): Path<(String, ProjectSlug)>,
+    Json(body): Json<PipelineRecordingBody>,
+) -> Result<impl IntoResponse, Error> {
+    ctx.post(&format!("/projects/{}/pipeline_recording", slug), &body)
+        .await
+}
+
 #[derive(Deserialize, Serialize)]
 struct PublishResourceTypeBody {
     name: String,
diff --git a/frontend/package.json b/frontend/package.json
index 128dd97f02..13fa000c49 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -304,6 +304,11 @@
 			"svelte": "./package/components/recording/ScriptRecordingReplay.svelte",
 			"default": "./package/components/recording/ScriptRecordingReplay.svelte"
 		},
+		"./components/PipelineRecordingReplay.svelte": {
+			"types": "./package/components/recording/PipelineRecordingReplay.svelte.d.ts",
+			"svelte": "./package/components/recording/PipelineRecordingReplay.svelte",
+			"default": "./package/components/recording/PipelineRecordingReplay.svelte"
+		},
 		"./components/recording/types": {
 			"types": "./package/components/recording/types.d.ts",
 			"default": "./package/components/recording/types.js"
@@ -532,6 +537,9 @@
 			"components/ScriptRecordingReplay.svelte": [
 				"./package/components/recording/ScriptRecordingReplay.svelte.d.ts"
 			],
+			"components/PipelineRecordingReplay.svelte": [
+				"./package/components/recording/PipelineRecordingReplay.svelte.d.ts"
+			],
 			"components/recording/types": [
 				"./package/components/recording/types.d.ts"
 			],
@@ -628,4 +636,4 @@
 		"@rollup/rollup-linux-x64-gnu": "^4.35.0",
 		"fsevents": "^2.3.3"
 	}
-}
\ No newline at end of file
+}
diff --git a/frontend/src/lib/components/JobLoader.svelte b/frontend/src/lib/components/JobLoader.svelte
index c9eb2e7230..7d00731f94 100644
--- a/frontend/src/lib/components/JobLoader.svelte
+++ b/frontend/src/lib/components/JobLoader.svelte
@@ -401,6 +401,11 @@
 
 	let startedWatchingJob: number | undefined = undefined
 	export async function watchJob(testId: string, callbacks?: Callbacks) {
+		// Cancel a previous replay's pending event timers: switching the watched job
+		// on a reused loader (the recording players click node→node) would otherwise
+		// let the old job's scheduled events mutate the newly-watched job.
+		replayTimeouts.forEach(clearTimeout)
+		replayTimeouts = []
 		logOffset = 0
 		resultStreamOffset = 0
 		syncIteration = 0
@@ -420,23 +425,32 @@
 				const elapsed = Date.now() - getReplayStartTime()
 				for (const event of recorded.events) {
 					const delay = Math.max(0, event.t - elapsed)
-					const timeout = setTimeout(() => {
-						if (job) {
-							updateJobFromProgress(event.data, job, callbacks)
-						}
-						if (event.data.completed) {
-							const njob = (event.data as any).job as Job & { result_stream?: string }
-							if (njob) {
-								// Use whichever logs are more complete (longer), but never
-								// let the WM_LOGS_SKIPPED sentinel win over real logs.
-								njob.logs = pickMoreCompleteLogs(job?.logs, njob.logs)
-								const streamedResult = job?.result_stream ?? ''
-								const completedResult = njob.result_stream ?? ''
-								njob.result_stream =
-									streamedResult.length >= completedResult.length ? streamedResult : completedResult
-								job = njob
-								onJobCompleted(testId, job, callbacks)
+					const timeout = setTimeout(async () => {
+						// A malformed replayed event (recordings are caller-controlled) would
+						// throw in this timer where no boundary can catch it, so skip it.
+						// `onJobCompleted` is awaited so its async rejection is caught too.
+						try {
+							if (job) {
+								updateJobFromProgress(event.data, job, callbacks)
 							}
+							if (event.data.completed) {
+								const njob = (event.data as any).job as Job & { result_stream?: string }
+								if (njob) {
+									// Use whichever logs are more complete (longer), but never
+									// let the WM_LOGS_SKIPPED sentinel win over real logs.
+									njob.logs = pickMoreCompleteLogs(job?.logs, njob.logs)
+									const streamedResult = job?.result_stream ?? ''
+									const completedResult = njob.result_stream ?? ''
+									njob.result_stream =
+										streamedResult.length >= completedResult.length
+											? streamedResult
+											: completedResult
+									job = njob
+									await onJobCompleted(testId, job, callbacks)
+								}
+							}
+						} catch (err) {
+							console.error('replay event failed', err)
 						}
 					}, delay)
 					replayTimeouts.push(timeout)
diff --git a/frontend/src/lib/components/assets/AssetGraph/AssetGraphCanvas.svelte b/frontend/src/lib/components/assets/AssetGraph/AssetGraphCanvas.svelte
index 64bd2790cb..8b2310a38b 100644
--- a/frontend/src/lib/components/assets/AssetGraph/AssetGraphCanvas.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/AssetGraphCanvas.svelte
@@ -171,6 +171,14 @@
 		 * initial viewport fit re-arms when it changes, so switching folders
 		 * in-place gets a fresh fit. */
 		viewportFitKey?: string
+		/** Tint the currently-running runnable nodes amber (the compute is
+		 * happening now). Opt-in — the recorder's replay player turns it on so
+		 * the active transform stands out; the live editor stays calm. */
+		highlightActiveRun?: boolean
+		/** Asset node id (`asset:${kind}:${path}`) → a monotonic "recompute" nonce.
+		 * When a node's nonce changes, it flashes a fading green background — its
+		 * producer just recomputed it. Driven by the replay player frame-by-frame. */
+		recomputedAssetIds?: ReadonlyMap<string, number>
 	}
 	let {
 		graph,
@@ -199,7 +207,9 @@
 		boundPick,
 		onPickEnd,
 		showMinimap = true,
-		viewportFitKey = ''
+		viewportFitKey = '',
+		highlightActiveRun = false,
+		recomputedAssetIds
 	}: Props = $props()
 
 	// `${kind}:${path}` ids for the hovered / pinned runs (both script and flow
@@ -385,7 +395,10 @@
 					producers: producersByAsset.get(`${a.kind}:${a.path}`) ?? [],
 					onRunProducer,
 					dataTestGuarded,
-					producerFailed
+					producerFailed,
+					// Bumped by the replay player when this asset's producer just
+					// recomputed it — the node flashes green and fades.
+					recomputePulse: recomputedAssetIds?.get(assetId)
 				}
 			})
 		}
@@ -474,6 +487,9 @@
 					downstreamCount: downstreamByScript.get(r.path) ?? 0,
 					downstreamUnsavedCount: downstreamUnsavedByScript.get(r.path) ?? 0,
 					runState,
+					// Amber-tint this node while it's the transform actively running
+					// (replay player only — the live editor keeps its calm styling).
+					highlightRunning: highlightActiveRun,
 					// Bounded-cascade entrypoint: only valid starts (schedule /
 					// manual roots) with downstream get the "Run downstream up
 					// to…" menu item.
diff --git a/frontend/src/lib/components/assets/AssetGraph/AssetNode.svelte b/frontend/src/lib/components/assets/AssetGraph/AssetNode.svelte
index 762bdbc0fc..999559a0c7 100644
--- a/frontend/src/lib/components/assets/AssetGraph/AssetNode.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/AssetNode.svelte
@@ -74,6 +74,10 @@
 			// asset failed. Escalates the guard badge from "protected" to a
 			// failed-run outcome (rolled-back on EE, published-anyway on CE).
 			producerFailed?: boolean
+			// Monotonic nonce bumped by the replay player when this asset's
+			// producer just recomputed it. A change triggers a one-shot green
+			// fade so a freshly-written table stands out as the run progresses.
+			recomputePulse?: number
 		}
 		// SvelteFlow injects this on the node component when the user clicks
 		// the node. Combined with our own `hovered` state to drive the
@@ -170,6 +174,13 @@
 	onmouseleave={() => (hovered = false)}
 	role="presentation"
 >
+	{#if data.recomputePulse !== undefined}
+		{#key data.recomputePulse}
+			<!-- One-shot green wash when the replay player recomputes this asset.
+			     Keyed on the nonce so a repeat recompute replays the animation. -->
+			<div class="wm-recompute-flash pointer-events-none absolute inset-0 z-10 rounded-md"></div>
+		{/key}
+	{/if}
 	<!-- Mirrors the flow editor's asset pill: quiet surface + gray border at
 	     rest, accent reserved for the selected state. -->
 	<div
@@ -324,3 +335,20 @@
 
 <Handle type="target" position={Position.Top} isConnectable={false} />
 <Handle type="source" position={Position.Bottom} isConnectable={false} />
+
+<style>
+	.wm-recompute-flash {
+		animation: wm-recompute-flash 1.2s ease-out 1;
+	}
+	@keyframes wm-recompute-flash {
+		0% {
+			background-color: rgba(16, 185, 129, 0);
+		}
+		15% {
+			background-color: rgba(16, 185, 129, 0.45);
+		}
+		100% {
+			background-color: rgba(16, 185, 129, 0);
+		}
+	}
+</style>
diff --git a/frontend/src/lib/components/assets/AssetGraph/RunnableNode.svelte b/frontend/src/lib/components/assets/AssetGraph/RunnableNode.svelte
index 4cb65ee8f3..d8a977539b 100644
--- a/frontend/src/lib/components/assets/AssetGraph/RunnableNode.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/RunnableNode.svelte
@@ -48,6 +48,9 @@
 			// Last-run status + run count observed this session (from the
 			// folder queue poll). Undefined until the first observed run.
 			runState?: RunnableRunState
+			// Opt-in (replay player): when this node is the transform actively
+			// running, tint its whole surface amber so the compute is unmissable.
+			highlightRunning?: boolean
 			// True for nodes synthesized from local drafts (script not yet
 			// persisted). Same convention as `unsaved` on triggers/edges.
 			unsaved?: boolean
@@ -103,6 +106,9 @@
 	let hover = $state(false)
 	let menuOpen = $state(false)
 	let running = $state(false)
+
+	// Amber "computing now" surface, gated so only the replay player lights it up.
+	let computingNow = $derived(data.highlightRunning === true && data.runState?.status === 'running')
 	// Popover state for the on-node Run-button caret. Sticky while open so
 	// `showRun` (which gates the whole pill) stays true even after the
 	// pointer leaves the node — otherwise picking an option would unmount
@@ -195,7 +201,9 @@
 			'flex items-center rounded-md drop-shadow-sm overflow-hidden border transition-colors',
 			'bg-surface border-gray-400 dark:border-gray-600 hover:border-gray-500 dark:hover:border-gray-500',
 			selected && 'bg-surface-accent-selected border-border-selected',
-			data.unsaved && 'border-2 border-dashed border-gray-400 dark:border-gray-500'
+			data.unsaved && 'border-2 border-dashed border-gray-400 dark:border-gray-500',
+			computingNow &&
+				'bg-amber-50 dark:bg-amber-900/30 border-amber-400 dark:border-amber-600 animate-pulse'
 		)}
 		style="width: {NODE.width}px; min-height: {NODE.height}px;"
 		title={nodeTooltip}
diff --git a/frontend/src/lib/components/assets/AssetGraph/cascadeRun.ts b/frontend/src/lib/components/assets/AssetGraph/cascadeRun.ts
index ede66ebe4b..407dc886f9 100644
--- a/frontend/src/lib/components/assets/AssetGraph/cascadeRun.ts
+++ b/frontend/src/lib/components/assets/AssetGraph/cascadeRun.ts
@@ -20,6 +20,11 @@ import type { AssetGraphResponse } from './types'
 export const CASCADE_POLL_INTERVAL_MS = 1000
 export const CASCADE_JOB_TIMEOUT_MS = 30 * 60 * 1000
 
+// Data-asset kinds a pipeline graph resolves — the `asset_kinds` filter for the
+// `/assets/graph` fetch. Shared so the pipeline editor and deploy-to-hub request
+// the same nodes/edges (and can't silently diverge when a kind is added).
+export const DATA_ASSET_KINDS = ['s3object', 'ducklake', 'datatable', 'volume']
+
 export type LocalScriptContent = {
 	content: string
 	language: Preview['language']
diff --git a/frontend/src/lib/components/recording/FlowRecordingReplay.svelte b/frontend/src/lib/components/recording/FlowRecordingReplay.svelte
index fce96e7b64..3d677d8f54 100644
--- a/frontend/src/lib/components/recording/FlowRecordingReplay.svelte
+++ b/frontend/src/lib/components/recording/FlowRecordingReplay.svelte
@@ -169,15 +169,24 @@
 
 	export function startReplay() {
 		if (!rootJobId) return
-		// JSON round-trip to unwrap reactive proxies and strip non-cloneable properties
-		const snapshot = JSON.parse(JSON.stringify(recording)) as FlowRecording
-		fixEventOrdering(snapshot, rootJobId)
-		rebaseTimestamps(snapshot, rootJobId)
-		setActiveReplay(snapshot)
-		rootInitialJob = buildInitialJob(snapshot, rootJobId)
-		job = undefined
-		replayState = 'playing'
-		selectedTab = 'ui'
+		try {
+			// JSON round-trip to unwrap reactive proxies and strip non-cloneable properties
+			const snapshot = JSON.parse(JSON.stringify(recording)) as FlowRecording
+			// A malformed recording (upload / `?src=` fetch) can throw while walking
+			// its jobs' flow_status here — an event-handler throw a Svelte boundary
+			// can't catch, so it's guarded rather than left to break the page.
+			fixEventOrdering(snapshot, rootJobId)
+			rebaseTimestamps(snapshot, rootJobId)
+			setActiveReplay(snapshot)
+			rootInitialJob = buildInitialJob(snapshot, rootJobId)
+			job = undefined
+			replayState = 'playing'
+			selectedTab = 'ui'
+		} catch {
+			setActiveReplay(undefined)
+			replayState = 'loaded'
+			sendUserToast('This recording could not be replayed — it may be malformed', true)
+		}
 	}
 
 	onDestroy(() => {
diff --git a/frontend/src/lib/components/recording/PipelineRecordingReplay.svelte b/frontend/src/lib/components/recording/PipelineRecordingReplay.svelte
new file mode 100644
index 0000000000..033ff211fe
--- /dev/null
+++ b/frontend/src/lib/components/recording/PipelineRecordingReplay.svelte
@@ -0,0 +1,520 @@
+<script lang="ts">
+	import type { Job } from '$lib/gen'
+	import { setActiveReplay } from './flowRecording.svelte'
+	import type { PipelineRecording, RecordedJob, RecordedNodeState } from './types'
+	import AssetGraphCanvas from '$lib/components/assets/AssetGraph/AssetGraphCanvas.svelte'
+	import type { AssetGraphSelection } from '$lib/components/assets/AssetGraph/types'
+	import type { RunnableRunState } from '$lib/components/assets/AssetGraph/activeRunnables.svelte'
+	import JobLoader from '$lib/components/JobLoader.svelte'
+	import LogViewer from '$lib/components/LogViewer.svelte'
+	import DisplayResult from '$lib/components/DisplayResult.svelte'
+	import JobArgs from '$lib/components/JobArgs.svelte'
+	import HighlightCode from '$lib/components/HighlightCode.svelte'
+	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
+	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
+	import { Button } from '$lib/components/common'
+	import Tooltip from '$lib/components/meltComponents/Tooltip.svelte'
+	import {
+		CheckCircle2,
+		Database,
+		InfoIcon,
+		Loader2,
+		LogOut,
+		Play,
+		RotateCcw,
+		Square,
+		XCircle
+	} from 'lucide-svelte'
+	import { onDestroy, tick, untrack } from 'svelte'
+	import { Pane, Splitpanes } from 'svelte-splitpanes'
+
+	type ReplayState = 'loaded' | 'playing' | 'done'
+
+	interface Props {
+		recording: PipelineRecording
+		hideControls?: boolean
+	}
+
+	let { recording, hideControls = false }: Props = $props()
+
+	let replayState = $state<ReplayState>('loaded')
+	let currentStatuses: Record<string, RecordedNodeState> = $state({})
+	let selection: AssetGraphSelection | undefined = $state(undefined)
+	let job: Job | undefined = $state(undefined)
+	let jobLoader: JobLoader | undefined = $state(undefined)
+	let timeouts: ReturnType<typeof setTimeout>[] = []
+
+	// Graph/detail split, mirroring PipelineGraphEditor: the graph keeps the full
+	// height and the detail pane only mounts on selection. Below `STACK_BELOW` the
+	// split flips to vertical, where the detail pane needs the larger share.
+	const STACK_BELOW = 680
+	let containerWidth = $state(0)
+	let stacked = $derived(containerWidth > 0 && containerWidth < STACK_BELOW)
+	let leftPaneSize = $state(100)
+	let rightPaneSize = $state(0)
+	// 0 = no user-chosen size yet, so the orientation-aware default applies.
+	let storedRightPaneSize = $state(0)
+	// Depend on the open/closed transition, not on `selection` itself — selecting
+	// another node must not throw away a size the user dragged.
+	let detailsOpen = $derived(selection != undefined)
+
+	// untrack the writes (and the rightPaneSize read) so the effect tracks only
+	// `detailsOpen`/`stacked` — a tracked `bind:size` read feeds back through Pane
+	// and pegs the main thread.
+	$effect(() => {
+		const fallback = stacked ? 55 : 40
+		if (detailsOpen) {
+			untrack(() => {
+				const size = storedRightPaneSize > 0 ? storedRightPaneSize : fallback
+				rightPaneSize = size
+				leftPaneSize = 100 - size
+			})
+		} else {
+			untrack(() => {
+				if (rightPaneSize > 0) storedRightPaneSize = rightPaneSize
+				rightPaneSize = 0
+				leftPaneSize = 100
+			})
+		}
+	})
+
+	let jobDone = $derived((job as any)?.type === 'CompletedJob')
+
+	// Runnable path -> the asset node ids (`asset:${kind}:${path}`) it writes,
+	// from the graph's write/rw edges. Lets a producer's success flash the green
+	// "recomputed" wash on exactly the tables it materialized.
+	let producerToAssets = $derived.by(() => {
+		const m = new Map<string, string[]>()
+		for (const e of recording.graph.edges ?? []) {
+			const access = e.access_type ?? 'r'
+			if (access !== 'w' && access !== 'rw') continue
+			const assetId = `asset:${e.asset_kind}:${e.asset_path}`
+			const list = m.get(e.runnable_path) ?? []
+			if (!list.includes(assetId)) list.push(assetId)
+			m.set(e.runnable_path, list)
+		}
+		return m
+	})
+
+	// asset node id -> a monotonic nonce, bumped each time the replay reaches the
+	// frame where the asset's producer turned successful. The canvas hands each
+	// asset node its nonce; a change replays the one-shot green fade.
+	let recomputePulses = $state<Record<string, number>>({})
+	let recomputedAssetIds = $derived(new Map(Object.entries(recomputePulses)))
+
+	// last-wins map path -> job id across all recorded frames, so any node that
+	// ran is clickable regardless of the current animation position.
+	let pathToJobId = $derived.by(() => {
+		const m: Record<string, string> = {}
+		for (const frame of recording.timeline) {
+			for (const [path, st] of Object.entries(frame.statuses)) {
+				if (st.jobId) m[path] = st.jobId
+			}
+		}
+		return m
+	})
+
+	// Final per-node status (last frame) — used before Play and after the
+	// animation completes so node badges reflect the recorded outcome.
+	let finalStatuses = $derived.by(() => {
+		const frames = recording.timeline
+		return frames.length > 0 ? frames[frames.length - 1].statuses : {}
+	})
+
+	// Statuses actually shown on the canvas: the animation snapshot while
+	// playing, otherwise the recorded final outcome.
+	let shownStatuses = $derived(replayState === 'playing' ? currentStatuses : finalStatuses)
+
+	let activeRunnableIds = $derived.by(() => {
+		const s = new Set<string>()
+		for (const [path, st] of Object.entries(shownStatuses)) {
+			if (st.status === 'running') s.add(`script:${path}`)
+		}
+		return s
+	})
+
+	let runStates = $derived.by(() => {
+		const m = new Map<string, RunnableRunState>()
+		for (const [path, st] of Object.entries(shownStatuses)) {
+			if (st.status === 'running') m.set(`script:${path}`, { status: 'running', runs: 0 })
+			else if (st.status === 'success') m.set(`script:${path}`, { status: 'success', runs: 1 })
+			else if (st.status === 'failure') m.set(`script:${path}`, { status: 'failure', runs: 1 })
+		}
+		return m
+	})
+
+	function clearTimeouts() {
+		timeouts.forEach((t) => clearTimeout(t))
+		timeouts = []
+	}
+
+	/** Offset a recorded job's absolute timestamps to "now" so duration/elapsed
+	 * displays compute correctly during replay. */
+	function rebaseJobTimestamps(rec: RecordedJob) {
+		const anchor = rec.initial_job?.started_at ?? rec.initial_job?.created_at
+		if (!anchor) return
+		const earliest = new Date(anchor).getTime()
+		if (isNaN(earliest)) return
+		const offset = Date.now() - earliest
+		const offsetDate = (d: string | undefined): string | undefined => {
+			if (!d) return d
+			const t = new Date(d).getTime()
+			return isNaN(t) ? d : new Date(t + offset).toISOString()
+		}
+		const fix = (j: any) => {
+			if (!j) return
+			if (j.started_at) j.started_at = offsetDate(j.started_at)
+			if (j.created_at) j.created_at = offsetDate(j.created_at)
+			if (j.completed_at) j.completed_at = offsetDate(j.completed_at)
+		}
+		fix(rec.initial_job)
+		for (const e of rec.events) fix((e.data as any)?.job)
+	}
+
+	// The recorded job id for the selected runnable, if it ran.
+	let selectedJobId = $derived.by(() => {
+		if (selection?.kind !== 'runnable') return undefined
+		const jobId = pathToJobId[selection.path]
+		return jobId && recording.jobs[jobId] ? jobId : undefined
+	})
+
+	export function startReplay() {
+		clearTimeouts()
+		currentStatuses = {}
+		recomputePulses = {}
+		selection = undefined
+		job = undefined
+		replayState = 'playing'
+		// Put JobLoader into replay mode (no network) even before a node is opened.
+		setActiveReplay({ jobs: {} })
+		const frames = recording.timeline
+		let pulseCounter = 0
+		for (let i = 0; i < frames.length; i++) {
+			const frame = frames[i]
+			const prev = i > 0 ? frames[i - 1].statuses : {}
+			// Assets whose producer transitions into `success` at this frame — they
+			// were just (re)materialized, so pulse them green as the frame lands.
+			const pulsedAssets: string[] = []
+			for (const [path, st] of Object.entries(frame.statuses)) {
+				if (st.status === 'success' && prev[path]?.status !== 'success') {
+					for (const a of producerToAssets.get(path) ?? []) pulsedAssets.push(a)
+				}
+			}
+			timeouts.push(
+				setTimeout(() => {
+					currentStatuses = frame.statuses
+					for (const a of pulsedAssets) recomputePulses[a] = ++pulseCounter
+				}, frame.t)
+			)
+		}
+		const last = frames.length > 0 ? frames[frames.length - 1].t : 0
+		timeouts.push(
+			setTimeout(() => {
+				replayState = 'done'
+			}, last + 50)
+		)
+	}
+
+	export function stop() {
+		clearTimeouts()
+		setActiveReplay(undefined)
+		replayState = 'loaded'
+		currentStatuses = {}
+		recomputePulses = {}
+		selection = undefined
+		job = undefined
+	}
+
+	async function openNodeDetail(jobId: string) {
+		job = undefined
+		const rec = recording.jobs[jobId]
+		if (!rec) return
+		const cloned = JSON.parse(JSON.stringify(rec)) as RecordedJob
+		// Only a node that is still running in the animation replays its stream
+		// live; a node the graph already shows as finished reveals its logs and
+		// result at once (collapse every event to t=0) rather than re-playing the
+		// whole execution as if it were computing now. Recorded `t` is relative to
+		// the whole-pipeline start, so rebase to the moment of open for the live case.
+		const streamLive = selectedStatus === 'running'
+		const base = cloned.events[0]?.t ?? 0
+		for (const e of cloned.events) e.t = streamLive ? Math.max(0, e.t - base) : 0
+		rebaseJobTimestamps(cloned)
+		setActiveReplay({ jobs: { [jobId]: cloned } })
+		await tick()
+		jobLoader?.watchJob(jobId)
+	}
+
+	// When the selected node's recorded job changes, (re)start its replay stream.
+	// `openNodeDetail` is imperative (drives the JobLoader ref), so it runs in
+	// `untrack` — the effect only re-fires on `selectedJobId` changes.
+	$effect(() => {
+		const jobId = selectedJobId
+		if (jobId) {
+			untrack(() => openNodeDetail(jobId))
+		} else {
+			job = undefined
+		}
+	})
+
+	let selectedStatus = $derived.by(() => {
+		if (selection?.kind !== 'runnable') return undefined
+		return (shownStatuses[selection.path] ?? finalStatuses[selection.path])?.status
+	})
+
+	// Output (args/logs/result) vs the step's source code, for a runnable node.
+	let runnableTab = $state<'output' | 'code'>('output')
+	let selectedCode = $derived.by(() => {
+		if (selection?.kind !== 'runnable') return undefined
+		return recording.codes?.[selection.path]
+	})
+
+	// Recorded data-sample for a selected asset node (ducklake/datatable).
+	let selectedAssetSample = $derived.by(() => {
+		if (selection?.kind !== 'asset') return undefined
+		return recording.assetSamples?.[`${selection.asset_kind}:${selection.path}`]
+	})
+
+	// Render a cell value: primitives as-is, objects/arrays as compact JSON.
+	function fmtCell(v: unknown): string {
+		if (v === null || v === undefined) return ''
+		if (typeof v === 'object') return JSON.stringify(v)
+		return String(v)
+	}
+
+	onDestroy(() => {
+		clearTimeouts()
+		setActiveReplay(undefined)
+	})
+</script>
+
+<div class="flex flex-col gap-2 h-full min-h-0">
+	{#if !hideControls}
+		<div class="flex items-center justify-between shrink-0">
+			<div class="flex items-center gap-2">
+				<h2 class="text-lg font-semibold text-emphasis">
+					{replayState === 'playing' ? 'Replaying: ' : ''}{recording.folder || 'Pipeline'}
+				</h2>
+				<Tooltip placement="bottom">
+					<InfoIcon size={16} class="text-tertiary" />
+					{#snippet text()}
+						<span class="text-2xs">
+							Recorded {new Date(recording.recorded_at).toLocaleString()} &mdash;
+							{(recording.total_duration_ms / 1000).toFixed(1)}s &mdash;
+							{Object.keys(recording.jobs).length} job(s)
+						</span>
+					{/snippet}
+				</Tooltip>
+			</div>
+			{#if replayState === 'playing'}
+				<Button variant="border" size="xs" onclick={stop} startIcon={{ icon: Square }}>Stop</Button>
+			{:else if replayState === 'done'}
+				<div class="flex items-center gap-2">
+					<Button variant="border" size="xs" onclick={stop} startIcon={{ icon: LogOut }}
+						>Exit</Button
+					>
+					<Button
+						variant="contained"
+						color="blue"
+						onclick={startReplay}
+						startIcon={{ icon: RotateCcw }}
+					>
+						Replay
+					</Button>
+				</div>
+			{:else}
+				<Button variant="contained" color="blue" onclick={startReplay} startIcon={{ icon: Play }}>
+					Play
+				</Button>
+			{/if}
+		</div>
+	{/if}
+
+	<!-- Always mounted: a node's recorded detail can be inspected before/after
+	     Play, and openNodeDetail drives this loader's `watchJob` in replay mode. -->
+	<JobLoader noCode={true} bind:this={jobLoader} bind:job />
+
+	<div
+		class="flex-1 min-h-0 rounded-md border bg-surface overflow-hidden"
+		bind:clientWidth={containerWidth}
+	>
+		<Splitpanes class="!h-full" horizontal={stacked}>
+			<Pane bind:size={leftPaneSize}>
+				<div class="relative h-full">
+					<AssetGraphCanvas
+						graph={recording.graph}
+						{selection}
+						onselect={(s) => (selection = s)}
+						{activeRunnableIds}
+						{runStates}
+						highlightActiveRun={replayState === 'playing'}
+						{recomputedAssetIds}
+						showMinimap={!stacked}
+						viewportFitKey={recording.folder}
+					/>
+					{#if !selection}
+						<p
+							class="absolute bottom-2 left-1/2 -translate-x-1/2 z-20 px-2 py-1 rounded-md bg-surface/95 backdrop-blur-sm border text-2xs text-tertiary shadow-sm"
+						>
+							{replayState === 'playing'
+								? 'Replaying the recorded run — click a node to inspect its logs, result or data sample.'
+								: 'Click a script node for its logs/result, or an asset node for its recorded data sample.'}
+						</p>
+					{/if}
+				</div>
+			</Pane>
+			{#if selection}
+				<Pane bind:size={rightPaneSize} minSize={25}>
+					<div class="h-full min-h-0">
+						{#if selection.kind === 'runnable'}
+							<div class="flex flex-col gap-2 p-3 h-full min-h-0">
+								<div class="flex items-center gap-2 shrink-0">
+									{#if selectedStatus === 'running'}
+										<Loader2 size={16} class="text-blue-500 animate-spin" />
+									{:else if selectedStatus === 'success'}
+										<CheckCircle2 size={16} class="text-green-600" />
+									{:else if selectedStatus === 'failure'}
+										<XCircle size={16} class="text-red-600" />
+									{/if}
+									<span class="text-xs font-mono text-emphasis break-all">{selection.path}</span>
+									<div class="ml-auto shrink-0">
+										<ToggleButtonGroup
+											selected={runnableTab}
+											on:selected={(e) => (runnableTab = e.detail)}
+										>
+											{#snippet children({ item })}
+												<ToggleButton size="sm" value="output" label="Output" {item} />
+												<ToggleButton size="sm" value="code" label="Code" {item} />
+											{/snippet}
+										</ToggleButtonGroup>
+									</div>
+								</div>
+
+								{#if runnableTab === 'code'}
+									<div class="flex-1 min-h-0 overflow-auto rounded-md border bg-surface-tertiary">
+										{#if selectedCode}
+											<HighlightCode
+												code={selectedCode.content}
+												language={selectedCode.language as any}
+											/>
+										{:else}
+											<p class="text-xs text-secondary p-3">
+												No code was captured for this step in the recording.
+											</p>
+										{/if}
+									</div>
+								{:else if selectedJobId && recording.jobs[selectedJobId]}
+									{#if job?.args && Object.keys(job.args).length > 0}
+										<div class="shrink-0">
+											<h3 class="text-2xs font-semibold text-tertiary mb-1">Arguments</h3>
+											<JobArgs args={job.args} />
+										</div>
+									{/if}
+									<!-- Logs and Result share the leftover height; Result gets the
+									     larger share (2:1) since a pipeline step's output is what you
+									     usually inspect, while both stay scrollable when squeezed. -->
+									<div class="flex flex-col flex-1 min-h-0">
+										<h3 class="text-2xs font-semibold text-tertiary mb-1">Logs</h3>
+										<div class="flex-1 min-h-0 overflow-auto rounded-md border bg-surface-tertiary">
+											<LogViewer
+												jobId={job?.id}
+												duration={job?.['duration_ms']}
+												mem={job?.['mem_peak']}
+												isLoading={!jobDone}
+												content={job?.logs}
+												tag={job?.tag}
+												download={false}
+											/>
+										</div>
+									</div>
+									<div class="flex flex-col flex-[2_1_0%] min-h-0">
+										<h3 class="text-2xs font-semibold text-tertiary mb-1">Result</h3>
+										<div
+											class="flex-1 min-h-0 overflow-auto rounded-md border bg-surface-tertiary p-3"
+										>
+											{#if job !== undefined && job.type === 'CompletedJob' && job.result !== undefined}
+												<DisplayResult result={job.result} language={job.language} />
+											{:else if jobDone}
+												<div class="text-secondary text-xs">No output available</div>
+											{:else}
+												<div class="text-secondary text-xs">Waiting for result…</div>
+											{/if}
+										</div>
+									</div>
+								{:else}
+									<p class="text-xs text-secondary"
+										>This node did not run in the recorded session.</p
+									>
+								{/if}
+							</div>
+						{:else if selection.kind === 'asset'}
+							<div class="flex flex-col gap-2 p-3 h-full min-h-0">
+								<div class="flex items-center gap-2">
+									<Database size={16} class="text-tertiary" />
+									<span class="text-xs font-mono text-emphasis break-all"
+										>{selectedAssetSample?.uri ??
+											`${selection.asset_kind}://${selection.path}`}</span
+									>
+									{#if selectedAssetSample && !selectedAssetSample.error}
+										<span class="text-2xs text-tertiary">
+											{selectedAssetSample.rowCount != undefined
+												? `${selectedAssetSample.rowCount} row${selectedAssetSample.rowCount === 1 ? '' : 's'}`
+												: `${selectedAssetSample.rows.length} sampled`}
+											· {selectedAssetSample.columns.length} column{selectedAssetSample.columns
+												.length === 1
+												? ''
+												: 's'}
+										</span>
+									{/if}
+								</div>
+
+								{#if !selectedAssetSample}
+									<p class="text-xs text-secondary">
+										No data sample was captured for this asset in the recorded session.
+									</p>
+								{:else if selectedAssetSample.error}
+									<p class="text-xs text-secondary">
+										Could not capture a sample of this table: {selectedAssetSample.error}
+									</p>
+								{:else if selectedAssetSample.rows.length === 0}
+									<p class="text-xs text-secondary"
+										>This table was empty when the recording was taken.</p
+									>
+								{:else}
+									<div class="flex-1 min-h-0 overflow-auto rounded-md border bg-surface-tertiary">
+										<table class="text-2xs w-full border-collapse">
+											<thead class="sticky top-0 bg-surface-secondary">
+												<tr>
+													{#each selectedAssetSample.columns as c}
+														<th
+															class="text-left px-2 py-1 font-semibold border-b whitespace-nowrap"
+														>
+															{c.field}
+															{#if c.datatype}<span class="text-tertiary font-normal"
+																	>· {c.datatype}</span
+																>{/if}
+														</th>
+													{/each}
+												</tr>
+											</thead>
+											<tbody>
+												{#each selectedAssetSample.rows as row}
+													<tr class="border-b last:border-b-0">
+														{#each selectedAssetSample.columns as c}
+															<td class="px-2 py-1 font-mono whitespace-nowrap max-w-xs truncate">
+																{fmtCell((row as any)?.[c.field])}
+															</td>
+														{/each}
+													</tr>
+												{/each}
+											</tbody>
+										</table>
+									</div>
+								{/if}
+							</div>
+						{/if}
+					</div>
+				</Pane>
+			{/if}
+		</Splitpanes>
+	</div>
+</div>
diff --git a/frontend/src/lib/components/recording/pipelineAssetSample.ts b/frontend/src/lib/components/recording/pipelineAssetSample.ts
new file mode 100644
index 0000000000..a5b9cf6456
--- /dev/null
+++ b/frontend/src/lib/components/recording/pipelineAssetSample.ts
@@ -0,0 +1,77 @@
+import type { AssetKind } from '$lib/gen'
+import { parseDbInputFromAssetSyntax } from '$lib/utils'
+import { loadAllTablesMetaData } from '$lib/components/apps/components/display/dbtable/metadata'
+import { dbTableOpsWithPreviewScripts } from '$lib/components/dbOps'
+import type { PipelineAssetSample } from './types'
+
+// How many rows to sample per asset — a preview, not a dump.
+const SAMPLE_LIMIT = 100
+
+/**
+ * Capture a data-sample of a pipeline asset for the recorder, reusing the exact
+ * same query path the live asset-preview panes use (`loadAllTablesMetaData` +
+ * `dbTableOpsWithPreviewScripts.getRows`), so a replayed sample matches what the
+ * pane would have shown. Only ducklake / datatable assets are sampleable this
+ * way (s3object files use a different preview); other kinds return an error
+ * marker the player renders as "no sample".
+ *
+ * Never throws — a failed capture (missing table, unconfigured datatable) is
+ * returned as a `PipelineAssetSample` with `error` set so the recording still
+ * completes.
+ */
+export async function capturePipelineAssetSample(
+	workspace: string,
+	kind: AssetKind,
+	path: string
+): Promise<PipelineAssetSample> {
+	const uri = `${kind}://${path}`
+	const base: PipelineAssetSample = { kind, path, uri, columns: [], rows: [] }
+	if (kind !== 'ducklake' && kind !== 'datatable') {
+		return { ...base, error: `no sample for ${kind} assets` }
+	}
+	try {
+		const input = parseDbInputFromAssetSyntax(uri)
+		if (!input) return { ...base, error: 'could not parse asset uri' }
+		const table = 'specificTable' in input ? (input.specificTable as string | undefined) : undefined
+		const schema =
+			'specificSchema' in input ? (input.specificSchema as string | undefined) : undefined
+		if (!table) return { ...base, error: 'asset uri has no table' }
+
+		const defs = await loadAllTablesMetaData(workspace, input)
+		if (!defs) return { ...base, error: 'table metadata unavailable' }
+
+		// Same table-key resolution as the ducklake/datatable preview panes:
+		// try `schema.table` then bare `table`, then any key ending in `.table`.
+		const defaultSchema = kind === 'ducklake' ? 'main' : 'public'
+		const colDefs =
+			defs[`${schema ?? defaultSchema}.${table}`] ??
+			defs[table] ??
+			(() => {
+				const key = Object.keys(defs).find((k) => k === table || k.endsWith(`.${table}`))
+				return key ? defs[key] : undefined
+			})()
+		if (!colDefs) return { ...base, error: 'table does not exist yet' }
+
+		const tableKey = schema && table ? `${schema}.${table}` : table
+		const ops = dbTableOpsWithPreviewScripts({ input, tableKey, colDefs, workspace })
+		const rows = await ops.getRows({
+			offset: 0,
+			limit: SAMPLE_LIMIT,
+			quicksearch: '',
+			order_by: '',
+			is_desc: false
+		})
+		let rowCount: number | undefined
+		try {
+			rowCount = await ops.getCount({ quicksearch: '' })
+		} catch {
+			// count is best-effort — the sample rows are the important part
+		}
+		const columns = colDefs
+			.filter((c) => c.field)
+			.map((c) => ({ field: c.field as string, datatype: (c as any).datatype }))
+		return { ...base, columns, rows: rows.slice(0, SAMPLE_LIMIT), rowCount }
+	} catch (e) {
+		return { ...base, error: e instanceof Error ? e.message : String(e) }
+	}
+}
diff --git a/frontend/src/lib/components/recording/pipelineRecording.svelte.ts b/frontend/src/lib/components/recording/pipelineRecording.svelte.ts
new file mode 100644
index 0000000000..557a3636ec
--- /dev/null
+++ b/frontend/src/lib/components/recording/pipelineRecording.svelte.ts
@@ -0,0 +1,335 @@
+import { JobService, ScriptService, type Job } from '$lib/gen'
+import type { AssetGraphResponse } from '$lib/components/assets/AssetGraph/types'
+import { runBoundedCascade } from '$lib/components/assets/AssetGraph/cascadeRun'
+import type {
+	CascadeNodeState,
+	CascadeRunResult
+} from '$lib/components/assets/AssetGraph/cascadeOrchestrator'
+import { truncateUuids } from './flowRecording.svelte'
+import { capturePipelineAssetSample } from './pipelineAssetSample'
+import type {
+	PipelineAssetSample,
+	PipelineRecordedCode,
+	PipelineRecording,
+	PipelineTimelineFrame,
+	RecordedJob,
+	RecordedNodeState
+} from './types'
+
+/**
+ * Recorder for a data-pipeline cascade run. Unlike the flow/script recorders
+ * there is no single root job streaming sub-jobs over SSE — a pipeline run is a
+ * cascade of independent script jobs launched client-side and polled to
+ * completion. So this store captures two things:
+ *
+ *  1. the resolved asset graph (rendered read-only by the player), and
+ *  2. a timeline of per-node status snapshots (from the cascade orchestrator's
+ *     `onUpdate`), each node mapped to its job id.
+ *
+ * For each launched node it opens the job's own SSE stream (`watchJob`) to
+ * capture incremental logs/result, storing them in the shared `RecordedJob`
+ * shape so the player can replay each node's details through the same
+ * `JobLoader` replay path the flow/script players use.
+ */
+export function createPipelineRecording(): PipelineRecordingStore {
+	let active = $state(false)
+	let startTime = 0
+	let folder = ''
+	let graph: AssetGraphResponse | undefined = undefined
+	let timeline: PipelineTimelineFrame[] = []
+	let jobs: Record<string, RecordedJob> = {}
+	let assetSamples: Record<string, PipelineAssetSample> = {}
+	let codes: Record<string, PipelineRecordedCode> = {}
+	let watchedJobs = new Set<string>()
+	let jobSources: EventSource[] = []
+
+	function closeSources() {
+		jobSources.forEach((es) => es.close())
+		jobSources = []
+		watchedJobs.clear()
+	}
+
+	return {
+		get active() {
+			return active
+		},
+		start(f: string, g: AssetGraphResponse) {
+			closeSources()
+			active = true
+			startTime = Date.now()
+			folder = f
+			// JSON round-trip to strip reactive proxies / non-serializable props.
+			graph = JSON.parse(JSON.stringify(g)) as AssetGraphResponse
+			timeline = []
+			jobs = {}
+			assetSamples = {}
+			codes = {}
+		},
+		/** Push a cascade status snapshot. Deep-cloned so a later mutation of the
+		 * orchestrator's map can't rewrite an already-captured frame. */
+		recordStatuses(statuses: Map<string, RecordedNodeState>) {
+			if (!active) return
+			const snapshot: Record<string, RecordedNodeState> = {}
+			for (const [path, st] of statuses) {
+				snapshot[path] = { status: st.status, jobId: st.jobId, error: st.error }
+			}
+			timeline.push({ t: Date.now() - startTime, statuses: snapshot })
+		},
+		/** Watch a launched node's SSE stream to capture its incremental
+		 * logs/result. Mirrors flowRecording.watchSubJob's log-offset dedup. */
+		watchJob(jobId: string, workspace: string) {
+			if (!active || watchedJobs.has(jobId)) return
+			watchedJobs.add(jobId)
+
+			let logOffset = 0
+			const params = new URLSearchParams({
+				log_offset: '0',
+				running: 'true',
+				fast: 'true'
+			})
+			const url = `/api/w/${workspace}/jobs_u/getupdate_sse/${jobId}?${params}`
+			const es = new EventSource(url)
+			jobSources.push(es)
+
+			es.onmessage = (event) => {
+				try {
+					const data = JSON.parse(event.data)
+					if (data.type === 'ping' || data.type === 'timeout') return
+					if (data.type === 'error' || data.type === 'not_found') {
+						es.close()
+						return
+					}
+					if (!active) {
+						es.close()
+						return
+					}
+
+					// Deduplicate log data: SSE may resend full log dumps on reconnect.
+					if (data.new_logs != null && data.log_offset != null) {
+						if (logOffset > 0 && data.log_offset <= logOffset) {
+							delete data.new_logs
+							delete data.log_offset
+						} else {
+							logOffset = data.log_offset
+						}
+					} else if (data.log_offset != null && data.log_offset > logOffset) {
+						logOffset = data.log_offset
+					}
+
+					if (!jobs[jobId]) {
+						jobs[jobId] = {
+							initial_job: data.job ? (data.job as Job) : ({ id: jobId } as Job),
+							events: []
+						}
+					}
+					jobs[jobId].events.push({
+						t: Date.now() - startTime,
+						data
+					})
+					if (data.completed) {
+						es.close()
+					}
+				} catch {
+					// Ignore parse errors
+				}
+			}
+			es.onerror = () => {
+				es.close()
+			}
+		},
+		/** Fill in a node's completed job (fallback for anything the SSE stream
+		 * missed — e.g. a job that finished before its stream was opened).
+		 * Callable after stop() so late-fetched completed jobs still attach. */
+		addCompletedJob(jobId: string, completedJob: Job) {
+			const snapshotJob = $state.snapshot(completedJob) as Job
+			if (!jobs[jobId]) {
+				jobs[jobId] = { initial_job: snapshotJob, events: [] }
+			} else if (!jobs[jobId].initial_job?.id) {
+				jobs[jobId].initial_job = snapshotJob
+			}
+			const hasCompleted = jobs[jobId].events.some((e) => e.data.completed)
+			if (!hasCompleted) {
+				jobs[jobId].events.push({
+					t: Date.now() - startTime,
+					data: { completed: true, job: snapshotJob }
+				})
+			}
+		},
+		/** Attach a captured asset data-sample (called during finalize, after
+		 * the run, for each ducklake/datatable asset). Keyed by `${kind}:${path}`.
+		 * Callable after stop() so late captures still attach to the returned
+		 * recording (which references the same `assetSamples` object). */
+		recordAssetSample(sample: PipelineAssetSample) {
+			assetSamples[`${sample.kind}:${sample.path}`] = sample
+		},
+		/** Attach a runnable's source (called during finalize, per script path).
+		 * Callable after stop() so late captures still attach to the returned
+		 * recording (which references the same `codes` object). */
+		recordCode(path: string, code: PipelineRecordedCode) {
+			codes[path] = code
+		},
+		stop(): PipelineRecording {
+			active = false
+			closeSources()
+			return {
+				version: 1,
+				type: 'pipeline',
+				recorded_at: new Date().toISOString(),
+				folder,
+				total_duration_ms: Date.now() - startTime,
+				graph: graph ?? ({ assets: [], runnables: [], edges: [], triggers: [] } as any),
+				timeline,
+				jobs,
+				assetSamples,
+				codes
+			}
+		},
+		download(recording: PipelineRecording) {
+			const blob = new Blob([truncateUuids(JSON.stringify(recording, null, 2))], {
+				type: 'application/json'
+			})
+			const url = URL.createObjectURL(blob)
+			const a = document.createElement('a')
+			a.href = url
+			a.download = `pipeline-recording-${(recording.folder || 'untitled').replace(/\//g, '-')}-${Date.now()}.json`
+			a.click()
+			URL.revokeObjectURL(url)
+		}
+	}
+}
+
+export type PipelineRecordingStore = {
+	readonly active: boolean
+	start(folder: string, graph: AssetGraphResponse): void
+	recordStatuses(statuses: Map<string, RecordedNodeState>): void
+	watchJob(jobId: string, workspace: string): void
+	addCompletedJob(jobId: string, completedJob: Job): void
+	recordAssetSample(sample: PipelineAssetSample): void
+	recordCode(path: string, code: PipelineRecordedCode): void
+	stop(): PipelineRecording
+	download(recording: PipelineRecording): void
+}
+
+// Max asset samples in flight during finalize — each is several preview jobs.
+const ASSET_SAMPLE_CONCURRENCY = 4
+
+/** Run `fn` over `items` at most `limit` at a time (sequential batches). */
+async function forEachWithConcurrency<T>(
+	items: T[],
+	limit: number,
+	fn: (item: T) => Promise<void>
+): Promise<void> {
+	for (let i = 0; i < items.length; i += limit) {
+		await Promise.all(items.slice(i, i + limit).map(fn))
+	}
+}
+
+/**
+ * Stop the recorder and enrich the recording with data the live SSE streams
+ * can't guarantee: each node's completed job (a fast job may finish before its
+ * stream opens), a data-sample per ducklake/datatable asset (offline table
+ * preview), and each step's source (by the exact hash that ran). Every fetch is
+ * best-effort — a step we can't resolve just replays with less detail. Shared by
+ * the pipeline editor's recorder and deploy-to-hub so both produce identical
+ * recordings.
+ */
+export async function finalizePipelineRecording(
+	store: PipelineRecordingStore,
+	workspace: string | undefined
+): Promise<PipelineRecording> {
+	const rec = store.stop()
+	if (!workspace) return rec
+	const ws = workspace
+	const jobIds = new Set<string>()
+	for (const frame of rec.timeline) {
+		for (const st of Object.values(frame.statuses)) {
+			if (st.jobId) jobIds.add(st.jobId)
+		}
+	}
+	await Promise.all(
+		[...jobIds].map(async (jobId) => {
+			if (rec.jobs[jobId]?.events.some((e) => e.data.completed)) return
+			try {
+				const j = await JobService.getJob({ workspace: ws, id: jobId })
+				store.addCompletedJob(jobId, j)
+			} catch {
+				// best-effort — a job we can't fetch just replays from its stream
+			}
+		})
+	)
+	// Each asset sample runs a metadata scan + a SELECT + a COUNT preview job, so a
+	// wide pipeline could fan out hundreds of jobs at once. Bound the concurrency
+	// to keep the recorder from saturating the worker pool.
+	const sampleTargets = (rec.graph.assets ?? []).filter(
+		(a) => a.kind === 'ducklake' || a.kind === 'datatable'
+	)
+	await forEachWithConcurrency(sampleTargets, ASSET_SAMPLE_CONCURRENCY, async (a) => {
+		const sample = await capturePipelineAssetSample(ws, a.kind, a.path)
+		store.recordAssetSample(sample)
+	})
+	const codeByPath = new Map<string, string>()
+	for (const r of Object.values(rec.jobs)) {
+		const j = r.events.find((e) => e.data.completed)?.data.job as
+			| { job_kind?: string; script_path?: string; script_hash?: string }
+			| undefined
+		if (j?.job_kind === 'script' && j.script_path && j.script_hash) {
+			codeByPath.set(j.script_path, j.script_hash)
+		}
+	}
+	await Promise.all(
+		[...codeByPath].map(async ([path, hash]) => {
+			try {
+				const s = await ScriptService.getScriptByHash({ workspace: ws, hash })
+				store.recordCode(path, { content: s.content, language: s.language })
+			} catch {
+				// best-effort — a step we can't fetch just has no code in the player
+			}
+		})
+	)
+	return rec
+}
+
+/**
+ * Run a folder's pipeline cascade end-to-end and capture it into a
+ * PipelineRecording — the self-contained path used by deploy-to-hub, where
+ * there is no editor page orchestrating the run. `launch`/`waitTerminal` are
+ * supplied by the caller (deployed-only launch, poll-based wait); this wires
+ * status/job capture around them and finalizes.
+ */
+export async function capturePipelineRecording(opts: {
+	workspace: string
+	folder: string
+	graph: AssetGraphResponse
+	scriptPaths: Set<string>
+	launch: (path: string) => Promise<string>
+	waitTerminal: (jobId: string) => Promise<'success' | 'failure'>
+	onUpdate?: (statuses: Map<string, CascadeNodeState>) => void
+}): Promise<{ recording: PipelineRecording; result: CascadeRunResult & { cyclic: string[] } }> {
+	const store = createPipelineRecording()
+	store.start(opts.folder, opts.graph)
+	let result: CascadeRunResult & { cyclic: string[] }
+	try {
+		result = await runBoundedCascade({
+			graph: opts.graph,
+			scripts: opts.scriptPaths,
+			launch: async (path) => {
+				const jobId = await opts.launch(path)
+				// No-op unless the store is active; captures the node's stream.
+				store.watchJob(jobId, opts.workspace)
+				return jobId
+			},
+			waitTerminal: opts.waitTerminal,
+			onUpdate: (statuses) => {
+				store.recordStatuses(statuses)
+				opts.onUpdate?.(statuses)
+			}
+		})
+	} catch (e) {
+		// The cascade threw before finalize could `stop()` the store: close the
+		// per-node SSE streams `watchJob` opened so they don't dangle.
+		store.stop()
+		throw e
+	}
+	const recording = await finalizePipelineRecording(store, opts.workspace)
+	return { recording, result }
+}
diff --git a/frontend/src/lib/components/recording/types.ts b/frontend/src/lib/components/recording/types.ts
index 8d1dc8ca27..c47c9dc4e4 100644
--- a/frontend/src/lib/components/recording/types.ts
+++ b/frontend/src/lib/components/recording/types.ts
@@ -1,4 +1,5 @@
-import type { Job, OpenFlow } from '$lib/gen'
+import type { AssetKind, Job, OpenFlow } from '$lib/gen'
+import type { AssetGraphResponse } from '$lib/components/assets/AssetGraph/types'
 
 export type RecordedEvent = {
 	t: number
@@ -33,6 +34,69 @@ export type ScriptRecording = {
 	job: RecordedJob
 }
 
+/** Per-node status inside a recorded cascade frame (mirror of
+ * cascadeOrchestrator.CascadeNodeState, kept structurally independent so the
+ * recording module doesn't depend on the orchestrator internals). */
+export type RecordedNodeState = {
+	status: 'pending' | 'running' | 'success' | 'failure' | 'skipped'
+	jobId?: string
+	error?: string
+}
+
+/** One frame of the cascade timeline: the full per-path status snapshot at
+ * `t` ms since the run started. Replaying these in order reproduces the graph
+ * animation (nodes lighting up / turning green/red) a live run would show. */
+export type PipelineTimelineFrame = {
+	t: number
+	statuses: Record<string, RecordedNodeState>
+}
+
+/** A captured data-sample of a pipeline asset (ducklake table / datatable),
+ * so the player can show what an asset held after the run — offline, without
+ * re-querying the backend. Keyed in `assetSamples` by `${kind}:${path}`. */
+export type PipelineAssetSample = {
+	kind: AssetKind
+	path: string
+	/** Full asset URI, e.g. `ducklake://main/orders`. */
+	uri: string
+	/** Column names (in order) of the sampled table. */
+	columns: { field: string; datatype?: string }[]
+	/** Sampled rows (capped), each a record keyed by column field. */
+	rows: unknown[]
+	/** Total row count if it could be fetched. */
+	rowCount?: number
+	/** Set when the sample couldn't be captured (table missing, unsupported…). */
+	error?: string
+}
+
+export type PipelineRecording = {
+	version: 1
+	type: 'pipeline'
+	recorded_at: string
+	folder: string
+	total_duration_ms: number
+	/** The resolved asset graph rendered read-only by the player. */
+	graph: AssetGraphResponse
+	/** Ordered cascade status snapshots driving the node animation. */
+	timeline: PipelineTimelineFrame[]
+	/** Per-node job streams (initial job + SSE events), keyed by job id, so the
+	 * player can replay each node's logs/result/args offline via JobLoader. */
+	jobs: Record<string, RecordedJob>
+	/** Per-asset data samples captured after the run, keyed by `${kind}:${path}`,
+	 * so asset nodes are inspectable offline in the player. */
+	assetSamples?: Record<string, PipelineAssetSample>
+	/** Source code of each runnable, keyed by script path, captured at record
+	 * time so the player can show a step's code offline. Absent for recordings
+	 * taken before code capture existed (the player degrades gracefully). */
+	codes?: Record<string, PipelineRecordedCode>
+}
+
+/** A pipeline step's captured source. */
+export type PipelineRecordedCode = {
+	content: string
+	language: string
+}
+
 /** Minimal interface that both flow and script recording stores implement */
 export interface ActiveRecording {
 	recordInitialJob(jobId: string, job: Job): void
diff --git a/frontend/src/lib/components/workspaceSettings/DeployToHub.svelte b/frontend/src/lib/components/workspaceSettings/DeployToHub.svelte
index cf2cd3ceb0..6b51b9a782 100644
--- a/frontend/src/lib/components/workspaceSettings/DeployToHub.svelte
+++ b/frontend/src/lib/components/workspaceSettings/DeployToHub.svelte
@@ -19,12 +19,14 @@
 	import { TRIGGER_KINDS, triggerDetails } from '$lib/components/triggers/workspaceTriggersList'
 	import Toggle from '../Toggle.svelte'
 	import MigrationSqlEditor from './MigrationSqlEditor.svelte'
+	import PipelineRecordingReplay from '$lib/components/recording/PipelineRecordingReplay.svelte'
 	import {
 		Check,
 		Cloud,
 		Code2,
 		Copy,
 		Database,
+		Eye,
 		ExternalLink,
 		Globe,
 		Info,
@@ -52,6 +54,7 @@
 	})
 
 	let recordDrawer = $state<Drawer | undefined>()
+	let pipelinePreviewDrawer = $state<Drawer | undefined>()
 	let publishDrawer = $state<Drawer | undefined>()
 	let resourceDrawer = $state<Drawer | undefined>()
 	let triggerDrawer = $state<Drawer | undefined>()
@@ -79,6 +82,9 @@
 	async function saveRecording() {
 		if (await deployHub.session?.saveRecording()) recordDrawer?.closeDrawer()
 	}
+	async function savePipelineRecording() {
+		await deployHub.session?.savePipelineRecording()
+	}
 	function openPublish(it: DeployItem) {
 		const s = deployHub.session
 		if (!s) return
@@ -140,7 +146,8 @@
 							>
 								<span class="font-mono text-emphasis">{stepNum > 2 ? '✓' : '2.'}</span>
 								<span class="font-semibold text-primary">Generate iframes &amp; recordings</span> — share
-								public apps as iframes and capture one execution per script/flow.
+								public apps as iframes, capture one execution per script/flow, and record the whole data-pipeline
+								cascade as one interactive replay.
 							</li>
 							<li
 								class={stepNum === 3 ? 'text-primary' : stepNum > 3 ? 'opacity-60' : 'opacity-40'}
@@ -309,6 +316,73 @@
 								</span>
 							</div>
 						{/if}
+						{#if s.phase === 'draft' && s.isPipelineProject}
+							<div
+								class="flex flex-col gap-2 rounded-md border border-blue-300 bg-blue-50 p-3 dark:border-blue-800 dark:bg-blue-950/40"
+							>
+								<div class="flex flex-wrap items-center gap-2">
+									<BarsStaggered class="text-blue-600 dark:text-blue-400" />
+									<span class="text-sm font-semibold text-primary">Data pipeline recording</span>
+									{#if s.pipelineRecorded}
+										<Badge color="green" size="xs">
+											<Check size={10} class="mr-0.5" />Recorded
+										</Badge>
+									{/if}
+									<div class="ml-auto flex items-center gap-2">
+										<Button
+											size="xs"
+											variant="subtle"
+											loading={s.pipelineRunState === 'running'}
+											startIcon={{ icon: s.pipelineRecordingResult ? RotateCcw : Play }}
+											onclick={() => s.runPipelineRecording()}
+										>
+											{s.pipelineRecordingResult ? 'Re-run' : 'Record pipeline run'}
+										</Button>
+										{#if s.pipelineRecordingResult}
+											<Button
+												size="xs"
+												variant="subtle"
+												startIcon={{ icon: Eye }}
+												onclick={() => pipelinePreviewDrawer?.openDrawer()}
+											>
+												Preview
+											</Button>
+											<Button
+												size="xs"
+												variant="accent"
+												disabled={s.pipelineRunState !== 'success'}
+												startIcon={{ icon: Check }}
+												onclick={savePipelineRecording}
+											>
+												Save as recording
+											</Button>
+										{/if}
+									</div>
+								</div>
+								<span class="text-xs text-secondary">
+									Runs this project's <span class="font-mono">{s.selectedFolder}/</span> pipeline
+									cascade ({s.recordablePipelineScriptPaths.length} step{s
+										.recordablePipelineScriptPaths.length === 1
+										? ''
+										: 's'}) and captures the asset graph, per-step logs/results and table samples
+									into one interactive replay for the project page.
+								</span>
+								{#if s.pipelineRunState === 'running'}
+									<div class="flex items-center gap-2 text-xs text-secondary">
+										<Loader2 size={12} class="animate-spin" /> Running the pipeline cascade…
+									</div>
+								{:else if s.pipelineRunState === 'success'}
+									<div class="flex items-center gap-2 text-xs text-green-700 dark:text-green-400">
+										<Check size={12} /> Cascade succeeded — preview it, then save as the recording.
+									</div>
+								{:else if s.pipelineRunState === 'failed'}
+									<div class="flex items-center gap-2 text-xs text-red-600 dark:text-red-400">
+										<TriangleAlert size={12} />
+										{s.pipelineRunError ?? 'Cascade failed'}
+									</div>
+								{/if}
+							</div>
+						{/if}
 						{#if s.phase === 'predeploy'}
 							<div class="flex flex-wrap items-center gap-2 text-xs">
 								<span class="font-semibold text-primary shrink-0">
@@ -632,6 +706,19 @@
 			</DrawerContent>
 		</Drawer>
 
+		<Drawer bind:this={pipelinePreviewDrawer} size="1100px">
+			<DrawerContent
+				title="Pipeline recording preview"
+				on:close={() => pipelinePreviewDrawer?.closeDrawer()}
+			>
+				{#if s.pipelineRecordingResult}
+					<div class="h-full min-h-[600px]">
+						<PipelineRecordingReplay recording={s.pipelineRecordingResult} />
+					</div>
+				{/if}
+			</DrawerContent>
+		</Drawer>
+
 		<Drawer bind:this={publishDrawer} size="600px">
 			<DrawerContent
 				title={s.publishTarget ? `Share as iframe — ${s.publishTarget.path}` : 'Share as iframe'}
diff --git a/frontend/src/lib/components/workspaceSettings/deployToHubSession.svelte.ts b/frontend/src/lib/components/workspaceSettings/deployToHubSession.svelte.ts
index 11926c804b..c98b39be5d 100644
--- a/frontend/src/lib/components/workspaceSettings/deployToHubSession.svelte.ts
+++ b/frontend/src/lib/components/workspaceSettings/deployToHubSession.svelte.ts
@@ -37,6 +37,14 @@ import {
 	type GeneratedMigration
 } from './projectMigrations'
 import type { Kind } from '$lib/utils_deployable'
+import type { AssetGraphResponse } from '$lib/components/assets/AssetGraph/types'
+import {
+	CASCADE_JOB_TIMEOUT_MS,
+	CASCADE_POLL_INTERVAL_MS,
+	DATA_ASSET_KINDS
+} from '$lib/components/assets/AssetGraph/cascadeRun'
+import { capturePipelineRecording } from '$lib/components/recording/pipelineRecording.svelte'
+import type { PipelineRecording } from '$lib/components/recording/types'
 import {
 	TRIGGER_KINDS,
 	listAllWorkspaceTriggers,
@@ -116,6 +124,26 @@ const ITEM_KIND_ROUTE: Record<ItemKind, string> = {
 
 const HIDDEN_RESOURCE_TYPES = new Set(['app_theme', 'state', 'cache'])
 
+// Prune a folder's asset graph to a set of scripts so a pipeline recording only
+// runs, renders and samples the project's included members — a deselected branch
+// (its nodes, code, logs/results and table samples) never enters the recording.
+// Assets kept are only those an included script touches; edges/triggers only
+// those anchored on an included runnable.
+function pruneGraphToScripts(graph: AssetGraphResponse, scripts: Set<string>): AssetGraphResponse {
+	const runnables = graph.runnables.filter((r) => scripts.has(r.path))
+	const edges = graph.edges.filter((e) => scripts.has(e.runnable_path))
+	const keptAssets = new Set(edges.map((e) => `${e.asset_kind}:${e.asset_path}`))
+	const assets = graph.assets.filter((a) => keptAssets.has(`${a.kind}:${a.path}`))
+	const triggers = graph.triggers.filter((t) => scripts.has(t.runnable_path))
+	const macro_edges = graph.macro_edges?.filter(
+		(m) => scripts.has(m.consumer_path) && scripts.has(m.lib_path)
+	)
+	const test_edges = graph.test_edges?.filter(
+		(t) => scripts.has(t.runnable_path) && scripts.has(t.producer_path)
+	)
+	return { assets, runnables, edges, triggers, macro_edges, test_edges }
+}
+
 function typesFromSchema(schema: any): string[] {
 	const out = new Set<string>()
 	const props = schema?.properties
@@ -190,6 +218,16 @@ export class DeployToHubSession {
 	runError = $state<string | undefined>(undefined)
 	recordings = $state<Record<string, string>>({})
 
+	// Project-level data-pipeline recording. Unlike script/flow recordings (one
+	// job per item) a pipeline is the whole folder cascade, so it gets a single
+	// recording: the resolved asset graph, per-node status timeline, per-node job
+	// streams and asset samples — replayed by PipelineRecordingReplay.
+	pipelineGraph = $state<AssetGraphResponse | undefined>(undefined)
+	pipelineRunState = $state<RunState>('idle')
+	pipelineRecordingResult = $state<PipelineRecording | undefined>(undefined)
+	pipelineRunError = $state<string | undefined>(undefined)
+	pipelineRecorded = $state(false)
+
 	publishTarget = $state<DeployItem | undefined>()
 	publishing = $state(false)
 
@@ -221,6 +259,7 @@ export class DeployToHubSession {
 	// Intra-session tokens: latest call wins among competing calls on this session.
 	#triggerLoadTok = 0
 	#recordRunTok = 0
+	#pipelineRunTok = 0
 	#migrationsTok = 0
 	#schedulePreviewsInFlight = new Set<string>()
 	// Preview-only cache: toggling checkboxes re-runs the closure walk, but item
@@ -237,12 +276,16 @@ export class DeployToHubSession {
 
 	dispose() {
 		this.#disposed = true
+		// Invalidate any in-flight pipeline cascade poll so it stops on the next
+		// tick instead of polling to the timeout against a discarded session.
+		this.#pipelineRunTok++
 	}
 
 	load() {
 		void this.#loadWorkspace()
 		void this.#loadTriggers()
 		void this.rehydrateFromHub()
+		void this.#loadPipelineGraph()
 	}
 
 	filteredWorkspaceItems = $derived(
@@ -268,6 +311,21 @@ export class DeployToHubSession {
 	allRecorded = $derived(
 		this.recordableItems.length > 0 && this.recordableItems.every((i) => i.rec === 'recorded')
 	)
+	// Pipeline members of this project's folder (`// pipeline` scripts).
+	pipelineScriptPaths = $derived(
+		(this.pipelineGraph?.runnables ?? [])
+			.filter((r) => r.usage_kind === 'script' && r.in_pipeline)
+			.map((r) => r.path)
+	)
+	// The subset actually in the Hub project — so a member the user deselected from
+	// the bundle is neither executed nor embedded (with its code/logs/samples) in
+	// the recording. In the draft phase `items` is the project's membership.
+	recordablePipelineScriptPaths = $derived(
+		this.pipelineScriptPaths.filter((p) =>
+			this.items.some((i) => i.kind === 'script' && i.path === p)
+		)
+	)
+	isPipelineProject = $derived(this.pipelineScriptPaths.length > 0)
 	hubSlug = $derived(this.effectiveSlug || sanitizeSlug(this.hubName))
 
 	relevantTriggers = $derived.by(() => {
@@ -1479,6 +1537,132 @@ export class DeployToHubSession {
 		}
 	}
 
+	/** Resolve the project folder's asset graph so a data-pipeline project can be
+	 * detected and its whole-folder cascade recorded. Best-effort — a project
+	 * with no pipeline just never shows the pipeline record card. */
+	async #loadPipelineGraph() {
+		try {
+			const params = new URLSearchParams({
+				folder: this.folder,
+				asset_kinds: DATA_ASSET_KINDS.join(',')
+			})
+			const res = await fetch(`/api/w/${this.workspace}/assets/graph?${params}`, {
+				credentials: 'include'
+			})
+			if (!res.ok) throw new Error(`GET /assets/graph → ${res.status}`)
+			const graph = (await res.json()) as AssetGraphResponse
+			if (this.#disposed) return
+			this.pipelineGraph = graph
+		} catch {
+			// No pipeline graph — the pipeline record card simply stays hidden.
+		}
+	}
+
+	/** Run the whole-folder cascade and capture it into a single PipelineRecording.
+	 * Deployed-only (no drafts) and arg-less — unlike the editor it seeds no
+	 * per-node input, so a root that needs uploaded data or a schedule's static
+	 * payload records a failure the user can see and fix rather than a green run. */
+	runPipelineRecording = async () => {
+		const fullGraph = this.pipelineGraph
+		const scripts = this.recordablePipelineScriptPaths
+		if (!fullGraph || scripts.length === 0) return
+		const scriptSet = new Set(scripts)
+		// Scope the graph to the project's members so the run, the recorded graph
+		// (rendered by the player) and the asset samples all exclude deselected
+		// branches.
+		const graph = pruneGraphToScripts(fullGraph, scriptSet)
+		const tok = ++this.#pipelineRunTok
+		this.pipelineRunState = 'running'
+		this.pipelineRecordingResult = undefined
+		this.pipelineRunError = undefined
+		// A previous save's badge must not linger over a fresh, unsaved re-run.
+		this.pipelineRecorded = false
+		const workspace = this.workspace
+		try {
+			const { recording, result } = await capturePipelineRecording({
+				workspace,
+				folder: this.folder,
+				graph,
+				scriptPaths: scriptSet,
+				launch: (path) =>
+					JobService.runScriptByPath({
+						workspace,
+						path,
+						// Skip the backend asset-trigger dispatcher: the cascade engine owns
+						// the whole closure (parity with the pipeline editor's bounded run).
+						requestBody: { _wmill_skip_asset_dispatch: true }
+					}),
+				waitTerminal: (jobId) => this.#waitJobTerminal(jobId, tok)
+			})
+			if (tok !== this.#pipelineRunTok) return
+			this.pipelineRecordingResult = recording
+			// A dependency cycle drops its members from the schedule, so an all- or
+			// partially-cyclic run leaves the recording missing steps (and an empty
+			// schedule reports `ok`). Treat any dropped cyclic member as a failure so
+			// an incomplete pipeline can't be saved as a successful recording.
+			if (result.cyclic.length > 0) {
+				this.pipelineRunState = 'failed'
+				this.pipelineRunError = `Cannot record — ${result.cyclic.length} script(s) on a dependency cycle: ${result.cyclic.join(', ')}`
+			} else if (result.ok) {
+				this.pipelineRunState = 'success'
+			} else {
+				this.pipelineRunState = 'failed'
+				const failed = [...result.statuses.entries()]
+					.filter(([, s]) => s.status === 'failure')
+					.map(([p]) => p)
+				this.pipelineRunError =
+					failed.length > 0 ? `Failed at ${failed.join(', ')}` : 'Cascade did not complete'
+			}
+		} catch (e: any) {
+			if (tok !== this.#pipelineRunTok) return
+			this.pipelineRunState = 'failed'
+			this.pipelineRunError = `Failed to run pipeline: ${e?.message ?? e}`
+		}
+	}
+
+	// Poll a launched step to terminal, matching the pipeline editor's cascade
+	// timeout (DuckLake/DuckDB steps routinely exceed a few minutes). Adds the
+	// `#pipelineRunTok` cancellation the shared `makeWaitJobTerminal` lacks.
+	async #waitJobTerminal(jobId: string, tok: number): Promise<'success' | 'failure'> {
+		const deadline = Date.now() + CASCADE_JOB_TIMEOUT_MS
+		while (Date.now() < deadline) {
+			if (tok !== this.#pipelineRunTok) throw new Error('cancelled')
+			try {
+				const r = await JobService.getCompletedJobResultMaybe({
+					workspace: this.workspace,
+					id: jobId,
+					getStarted: false
+				})
+				if (r.completed) return r.success ? 'success' : 'failure'
+			} catch {
+				// transient — retry on the next tick
+			}
+			await sleep(CASCADE_POLL_INTERVAL_MS)
+		}
+		throw new Error(`Timed out waiting for job ${jobId}`)
+	}
+
+	/** Save the captured pipeline recording to the Hub, scoped to the project
+	 * (a pipeline is the whole folder, not a single Hub item). Returns true on
+	 * success. */
+	async savePipelineRecording(): Promise<boolean> {
+		const recording = this.pipelineRecordingResult
+		if (!recording || this.pipelineRunState !== 'success') return false
+		if (this.phase === 'predeploy') {
+			sendUserToast(`Push the project to the Hub first before saving its pipeline recording`, true)
+			return false
+		}
+		try {
+			await this.#postHub(`/hub/projects/${this.hubSlug}/pipeline_recording`, { recording })
+			this.pipelineRecorded = true
+			sendUserToast(`Pipeline recording saved`)
+			return true
+		} catch (e: any) {
+			sendUserToast(`Failed to save pipeline recording: ${e?.message ?? e}`, true)
+			return false
+		}
+	}
+
 	// Set the Hub raw app's live-iframe URL (or clear it with null). The Hub renders
 	// from external_embed_url; project_slug scopes ownership.
 	async #pushRawAppEmbed(hubId: number, url: string | null) {
diff --git a/frontend/src/routes/(root)/(logged)/pipeline/[folder]/+page.svelte b/frontend/src/routes/(root)/(logged)/pipeline/[folder]/+page.svelte
index 0c1a6eeb8c..765c0d251e 100644
--- a/frontend/src/routes/(root)/(logged)/pipeline/[folder]/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/pipeline/[folder]/+page.svelte
@@ -43,6 +43,7 @@
 		assetProducers
 	} from '$lib/components/assets/AssetGraph/graphTraversal'
 	import { runCascade, runSelection } from '$lib/components/assets/AssetGraph/cascadeOrchestrator'
+	import { DATA_ASSET_KINDS } from '$lib/components/assets/AssetGraph/cascadeRun'
 	import {
 		boundedSet,
 		buildLineageDag,
@@ -72,6 +73,11 @@
 		type PipelineDraft
 	} from '$lib/components/assets/AssetGraph/pipelineAiHelpers'
 	import { PipelineEditorState } from '$lib/components/assets/AssetGraph/pipelineEditorState.svelte'
+	import {
+		createPipelineRecording,
+		finalizePipelineRecording
+	} from '$lib/components/recording/pipelineRecording.svelte'
+	import type { PipelineRecording } from '$lib/components/recording/types'
 	import AutosaveIndicator from '$lib/components/AutosaveIndicator.svelte'
 	import { onMount, tick, untrack } from 'svelte'
 	import { aiChatManager } from '$lib/components/copilot/chat/AIChatManager.svelte'
@@ -79,6 +85,8 @@
 		AlertTriangle,
 		ArrowLeft,
 		ChevronDown,
+		Circle,
+		Download,
 		Folder,
 		FolderSearch,
 		History,
@@ -113,7 +121,7 @@
 	// Variables and resources are declarative config, not pipeline assets —
 	// they're hub-shaped (referenced by most runnables) and would swamp the
 	// layout without adding lineage information.
-	const DATA_KINDS = ['s3object', 'ducklake', 'datatable', 'volume']
+	const DATA_KINDS = DATA_ASSET_KINDS
 
 	let folder = $derived(page.params.folder as string)
 
@@ -1404,6 +1412,22 @@
 	// other's storage writes.
 	let cascadeRunningRoot = $state<string | undefined>(undefined)
 
+	// Recorder: when armed, the next cascade run captures the resolved graph, the
+	// per-node status timeline and each node's job stream into a downloadable
+	// recording that the /pipeline_replay player can rerun offline (parity with the
+	// flow/script recorders). Job capture (`watchJob`) and status capture
+	// (`recordStatuses`) no-op unless the store is active, so the cascade run
+	// paths call them unconditionally.
+	let pipelineRecording = createPipelineRecording()
+	let recordingMode = $state(false)
+	let lastPipelineRecording = $state<PipelineRecording | undefined>(undefined)
+
+	function downloadPipelineRecording() {
+		if (lastPipelineRecording) {
+			pipelineRecording.download(lastPipelineRecording)
+		}
+	}
+
 	// Script path → its schedule's configured args, so a manual "Run pipeline"
 	// launches a schedule-triggered script with the same payload a real tick
 	// would (rather than empty args). Schedule is the only trigger that stores a
@@ -1711,6 +1735,10 @@
 		// Claim the running-guard BEFORE the first await so a rapid second click
 		// (which reads `cascadeRunningRoot`) can't slip through and double-launch.
 		cascadeRunningRoot = schedule.roots[0] ?? scripts[0]
+		if (recordingMode) {
+			lastPipelineRecording = undefined
+			pipelineRecording.start(folder, displayGraph)
+		}
 		let firstJobId: string | undefined
 		try {
 			// Seed schedule-triggered roots with their configured payload.
@@ -1720,6 +1748,8 @@
 				launch: async (path) => {
 					const jobId = await launchCascadeScript(path)
 					activeRunnables.arm(`script:${path}`)
+					// No-op unless a recording is active; captures the node's stream.
+					if ($workspaceStore) pipelineRecording.watchJob(jobId, $workspaceStore)
 					if (firstJobId === undefined) {
 						firstJobId = jobId
 						runsPendingJobId = jobId
@@ -1727,7 +1757,8 @@
 					}
 					return jobId
 				},
-				waitTerminal: waitJobTerminal
+				waitTerminal: waitJobTerminal,
+				onUpdate: (statuses) => pipelineRecording.recordStatuses(statuses)
 			})
 			const n = res.statuses.size
 			if (res.ok) {
@@ -1750,7 +1781,21 @@
 				)
 			}
 		} finally {
-			cascadeRunningRoot = undefined
+			// Hold the run guard until finalization finishes: finalize keeps writing
+			// jobs/samples/code through the recorder store, and a second run's
+			// `start()` would reset those maps mid-write, corrupting both recordings.
+			// The nested finally still clears the guard if finalize ever rejects, so
+			// Run can't wedge permanently.
+			try {
+				if (pipelineRecording.active) {
+					lastPipelineRecording = await finalizePipelineRecording(
+						pipelineRecording,
+						$workspaceStore
+					)
+				}
+			} finally {
+				cascadeRunningRoot = undefined
+			}
 		}
 	}
 
@@ -2326,6 +2371,40 @@
 		{/if}
 		<div class="flex flex-row items-center gap-2 flex-1 justify-end">
 			{#if !isOperator && allPipelineScripts.length > 0}
+				<!-- Recorder: arm to capture the next pipeline run into a
+				     downloadable recording the /pipeline_replay player can rerun offline
+				     (parity with the flow/script recorders). -->
+				{#if lastPipelineRecording && !cascadeRunningRoot}
+					<Button
+						variant="subtle"
+						unifiedSize="sm"
+						startIcon={{ icon: Download }}
+						onclick={downloadPipelineRecording}
+						title="Download the last recorded pipeline run"
+					>
+						Download recording
+					</Button>
+				{/if}
+				<button
+					type="button"
+					onclick={() => (recordingMode = !recordingMode)}
+					disabled={!!cascadeRunningRoot}
+					class={twMerge(
+						'flex items-center gap-1.5 px-2.5 py-1 rounded-md border text-xs font-medium transition-colors disabled:opacity-50',
+						recordingMode
+							? 'bg-red-50 dark:bg-red-900/30 border-red-300 dark:border-red-700 text-red-700 dark:text-red-400'
+							: 'bg-surface border-gray-300 dark:border-gray-600 text-secondary hover:bg-surface-hover'
+					)}
+					title={recordingMode
+						? 'Recording armed — the next pipeline run will be captured. Click to disarm.'
+						: 'Arm the recorder so the next pipeline run is captured for offline replay'}
+				>
+					<Circle
+						size={12}
+						class={recordingMode ? 'fill-red-600 text-red-600 animate-pulse' : ''}
+					/>
+					{recordingMode ? 'Recording' : 'Record'}
+				</button>
 				<!-- Pipeline-level run: always visible in both View and Edit so a
 				     run never requires hunting for a specific node's play button
 				     (dbt `build` / Dagster "Materialize all"). Runs every script in
diff --git a/frontend/src/routes/(root)/(logged)/pipeline_replay/+page.svelte b/frontend/src/routes/(root)/(logged)/pipeline_replay/+page.svelte
new file mode 100644
index 0000000000..d9adcb1887
--- /dev/null
+++ b/frontend/src/routes/(root)/(logged)/pipeline_replay/+page.svelte
@@ -0,0 +1,296 @@
+<script lang="ts">
+	import FlowRecordingReplay from '$lib/components/recording/FlowRecordingReplay.svelte'
+	import ScriptRecordingReplay from '$lib/components/recording/ScriptRecordingReplay.svelte'
+	import PipelineRecordingReplay from '$lib/components/recording/PipelineRecordingReplay.svelte'
+	import type {
+		FlowRecording,
+		PipelineRecording,
+		ScriptRecording
+	} from '$lib/components/recording/types'
+	import { sendUserToast } from '$lib/toast'
+	import { Button } from '$lib/components/common'
+	import FileInput from '$lib/components/common/fileInput/FileInput.svelte'
+	import { Loader2, TriangleAlert, Upload } from 'lucide-svelte'
+	import { setActiveReplay } from '$lib/components/recording/flowRecording.svelte'
+	import { onMount } from 'svelte'
+
+	let flowRecording: FlowRecording | undefined = $state(undefined)
+	let scriptRecording: ScriptRecording | undefined = $state(undefined)
+	let pipelineRecording: PipelineRecording | undefined = $state(undefined)
+
+	// Upper bound on a `?src=` fetched recording (JSON with capped samples/logs) so
+	// an arbitrary origin can't OOM the tab with an endless/huge response.
+	const MAX_RECORDING_BYTES = 100 * 1024 * 1024
+
+	// Auto-download state: when the page is opened with `?src=<url>` it fetches
+	// the recording JSON at that URL (with progress) instead of showing the
+	// drag-and-drop. Lets a recording be shared as a deep link.
+	let downloading = $state(false)
+	let downloadPercent = $state<number | undefined>(undefined)
+	let downloadedBytes = $state(0)
+	let downloadError = $state<string | undefined>(undefined)
+
+	function reset() {
+		flowRecording = undefined
+		scriptRecording = undefined
+		pipelineRecording = undefined
+	}
+
+	/** Parse recording JSON text and route it to the right player. Returns false
+	 * (and toasts) when the payload isn't a recognized recording. */
+	function loadRecordingFromText(content: string): boolean {
+		let data: any
+		try {
+			data = JSON.parse(content)
+		} catch (err) {
+			sendUserToast('Failed to load recording: ' + err, true)
+			return false
+		}
+		const isObject = (v: unknown): v is Record<string, unknown> =>
+			typeof v === 'object' && v !== null && !Array.isArray(v)
+		// A RecordedJob whose events all carry an object `data`: JobLoader replays
+		// each `event.data` in a `setTimeout`, whose throw a Svelte boundary can't
+		// catch, so a malformed event must be rejected at load. Shared by all three
+		// recording types (flow/script/pipeline all mount jobs through JobLoader).
+		const isRecordedJob = (j: unknown): boolean =>
+			isObject(j) &&
+			isObject(j.initial_job) &&
+			Array.isArray(j.events) &&
+			j.events.every((e) => isObject(e) && isObject(e.data))
+		const isJobsMap = (v: unknown): boolean => isObject(v) && Object.values(v).every(isRecordedJob)
+		// A non-object payload (JSON `null`, an array, a scalar) has no `.version`
+		// to read — guard before dereferencing so it toasts instead of throwing.
+		if (!isObject(data)) {
+			sendUserToast('Invalid recording format', true)
+			return false
+		}
+		if (data.version !== 1) {
+			sendUserToast('Invalid recording format', true)
+			return false
+		}
+		if (data.type === 'script') {
+			if (!isRecordedJob(data.job)) {
+				sendUserToast('Invalid script recording format', true)
+				return false
+			}
+			reset()
+			scriptRecording = data as ScriptRecording
+		} else if (data.type === 'pipeline') {
+			// Load-time check on caller-controlled input (upload / `?src=` fetch) so the
+			// common malformed shapes toast here; the render boundary below is the
+			// catch-all for anything deeper.
+			const objectArray = (v: unknown) => Array.isArray(v) && v.every(isObject)
+			const optionalObjectArray = (v: unknown) => v === undefined || objectArray(v)
+			const optionalRecord = (v: unknown, valid: (x: Record<string, unknown>) => boolean) =>
+				v === undefined || (isObject(v) && Object.values(v).every((x) => isObject(x) && valid(x)))
+			const g = data.graph as Record<string, unknown> | null
+			const validGraph =
+				isObject(g) &&
+				objectArray(g.runnables) &&
+				objectArray(g.assets) &&
+				objectArray(g.edges) &&
+				Array.isArray(g.triggers) &&
+				g.triggers.every((t) => isObject(t) && typeof t.trigger_kind === 'string') &&
+				optionalObjectArray(g.macro_edges) &&
+				optionalObjectArray(g.test_edges)
+			const validTimeline =
+				Array.isArray(data.timeline) &&
+				data.timeline.every(
+					(f: unknown) =>
+						isObject(f) && isObject(f.statuses) && Object.values(f.statuses).every(isObject)
+				)
+			const validJobs = isJobsMap(data.jobs)
+			// A sample renders `rows`/`columns` unless it carries a non-empty `error`.
+			const validSamples = optionalRecord(
+				data.assetSamples,
+				(s) =>
+					(typeof s.error === 'string' && s.error !== '') ||
+					(objectArray(s.rows) && objectArray(s.columns))
+			)
+			const validCodes = optionalRecord(
+				data.codes,
+				(c) => typeof c.content === 'string' && typeof c.language === 'string'
+			)
+			if (!(validGraph && validTimeline && validJobs && validSamples && validCodes)) {
+				sendUserToast('Invalid pipeline recording format', true)
+				return false
+			}
+			reset()
+			pipelineRecording = data as PipelineRecording
+		} else {
+			// Flow recording (type === 'flow' or type is absent for backwards compat).
+			// Validate jobs structurally — the `?src=` loader accepts remote payloads
+			// and FlowRecordingReplay mounts them straight into JobLoader, outside the
+			// pipeline boundary.
+			if (!isJobsMap(data.jobs)) {
+				sendUserToast('Invalid flow recording format', true)
+				return false
+			}
+			reset()
+			flowRecording = data as FlowRecording
+		}
+		return true
+	}
+
+	function handleFileChange(event: CustomEvent<(string | ArrayBuffer | null)[]>) {
+		const content = event.detail?.[0]
+		if (!content || typeof content !== 'string') return
+		loadRecordingFromText(content)
+	}
+
+	/** Fetch a recording JSON from `url`, streaming so a progress bar can show,
+	 * then hand it to the players. Falls back to the drag-and-drop on failure. */
+	async function loadFromUrl(url: string) {
+		downloading = true
+		downloadError = undefined
+		downloadPercent = undefined
+		downloadedBytes = 0
+		try {
+			const res = await fetch(url)
+			if (!res.ok) throw new Error(`HTTP ${res.status} ${res.statusText}`)
+			const total = Number(res.headers.get('content-length')) || 0
+			// `?src=` is an arbitrary (possibly permissive-CORS) origin, so cap the
+			// download: reject an oversized advertised length up front and abort the
+			// stream once the running total exceeds the limit, so an endless/huge
+			// response can't exhaust the tab before validation runs.
+			if (total > MAX_RECORDING_BYTES) {
+				throw new Error(
+					`Recording is too large (${fmtBytes(total)}, max ${fmtBytes(MAX_RECORDING_BYTES)})`
+				)
+			}
+			const reader = res.body?.getReader()
+			let text: string
+			if (reader) {
+				const chunks: Uint8Array[] = []
+				for (;;) {
+					const { done, value } = await reader.read()
+					if (done) break
+					if (value) {
+						chunks.push(value)
+						downloadedBytes += value.length
+						if (downloadedBytes > MAX_RECORDING_BYTES) {
+							await reader.cancel()
+							throw new Error(`Recording exceeded the ${fmtBytes(MAX_RECORDING_BYTES)} limit`)
+						}
+						if (total) downloadPercent = Math.round((downloadedBytes / total) * 100)
+					}
+				}
+				text = await new Blob(chunks as BlobPart[]).text()
+			} else {
+				text = await res.text()
+				if (text.length > MAX_RECORDING_BYTES) {
+					throw new Error(`Recording exceeded the ${fmtBytes(MAX_RECORDING_BYTES)} limit`)
+				}
+			}
+			if (!loadRecordingFromText(text)) {
+				downloadError = 'The downloaded file is not a valid recording.'
+			}
+		} catch (err) {
+			downloadError = `Could not download the recording: ${err instanceof Error ? err.message : err}`
+		} finally {
+			downloading = false
+		}
+	}
+
+	onMount(() => {
+		const src = new URL(window.location.href).searchParams.get('src')
+		if (src) loadFromUrl(src)
+	})
+
+	function quit() {
+		setActiveReplay(undefined)
+		reset()
+	}
+
+	function fmtBytes(n: number): string {
+		if (n < 1024) return `${n} B`
+		if (n < 1024 * 1024) return `${(n / 1024).toFixed(0)} KB`
+		return `${(n / (1024 * 1024)).toFixed(1)} MB`
+	}
+</script>
+
+<!-- Shown by every player's boundary when a malformed recording crashes on
+     render/effect (the load-time validation and JobLoader guards cover the rest). -->
+{#snippet replayFailed()}
+	<div class="flex flex-col items-center justify-center h-full gap-2 text-center">
+		<TriangleAlert class="text-red-500" size={28} />
+		<p class="max-w-md text-sm text-secondary">
+			This recording could not be replayed — it may be malformed or from an incompatible version.
+		</p>
+		<Button variant="border" size="xs" onclick={quit} startIcon={{ icon: Upload }}>
+			Load another recording
+		</Button>
+	</div>
+{/snippet}
+
+<!-- The pipeline player fills the viewport (graph left, detail right, like the
+     pipeline editor); the flow/script players keep the centered scrolling page. -->
+<div
+	class={pipelineRecording
+		? 'flex flex-col h-full w-full px-4 py-4 min-h-0'
+		: 'max-w-7xl mx-auto px-4 py-8 w-full'}
+>
+	{#if flowRecording}
+		<div class="flex justify-end mb-4">
+			<Button variant="border" size="xs" onclick={quit} startIcon={{ icon: Upload }}>
+				Load another recording
+			</Button>
+		</div>
+		<svelte:boundary onerror={() => setActiveReplay(undefined)}>
+			<FlowRecordingReplay recording={flowRecording} />
+			{#snippet failed()}{@render replayFailed()}{/snippet}
+		</svelte:boundary>
+	{:else if scriptRecording}
+		<div class="flex justify-end mb-4">
+			<Button variant="border" size="xs" onclick={quit} startIcon={{ icon: Upload }}>
+				Load another recording
+			</Button>
+		</div>
+		<svelte:boundary onerror={() => setActiveReplay(undefined)}>
+			<ScriptRecordingReplay recording={scriptRecording} />
+			{#snippet failed()}{@render replayFailed()}{/snippet}
+		</svelte:boundary>
+	{:else if pipelineRecording}
+		<div class="flex justify-end mb-2 shrink-0">
+			<Button variant="border" size="xs" onclick={quit} startIcon={{ icon: Upload }}>
+				Load another recording
+			</Button>
+		</div>
+		<div class="flex-1 min-h-0">
+			<svelte:boundary onerror={() => setActiveReplay(undefined)}>
+				<PipelineRecordingReplay recording={pipelineRecording} />
+				{#snippet failed()}{@render replayFailed()}{/snippet}
+			</svelte:boundary>
+		</div>
+	{:else if downloading}
+		<div class="flex flex-col items-center justify-center min-h-[60vh]">
+			<div class="flex flex-col items-center gap-3 max-w-md w-full">
+				<Loader2 class="animate-spin text-blue-500" size={28} />
+				<h2 class="text-lg font-semibold text-emphasis">Downloading recording…</h2>
+				{#if downloadPercent !== undefined}
+					<div class="w-full h-2 rounded-full bg-surface-secondary overflow-hidden">
+						<div class="h-full bg-blue-500 transition-all" style="width: {downloadPercent}%"></div>
+					</div>
+					<p class="text-2xs text-tertiary">{downloadPercent}% · {fmtBytes(downloadedBytes)}</p>
+				{:else}
+					<p class="text-2xs text-tertiary">{fmtBytes(downloadedBytes)}</p>
+				{/if}
+			</div>
+		</div>
+	{:else}
+		<div class="flex flex-col items-center justify-center min-h-[60vh]">
+			<div class="flex flex-col items-center gap-2 max-w-md w-full">
+				<h2 class="text-lg font-semibold text-emphasis">Replay a recording</h2>
+				<p class="text-xs text-secondary mb-2">
+					Upload a recording JSON file to replay a flow, script or data-pipeline execution offline.
+				</p>
+				{#if downloadError}
+					<p class="text-xs text-red-600 dark:text-red-400 mb-1 text-center">{downloadError}</p>
+				{/if}
+				<FileInput accept=".json" convertTo="text" class="w-full" on:change={handleFileChange}>
+					Drag and drop a recording file
+				</FileInput>
+			</div>
+		</div>
+	{/if}
+</div>
diff --git a/frontend/src/routes/(root)/(logged)/replay/+page.svelte b/frontend/src/routes/(root)/(logged)/replay/+page.svelte
deleted file mode 100644
index d89bcbb9b0..0000000000
--- a/frontend/src/routes/(root)/(logged)/replay/+page.svelte
+++ /dev/null
@@ -1,79 +0,0 @@
-<script lang="ts">
-	import FlowRecordingReplay from '$lib/components/recording/FlowRecordingReplay.svelte'
-	import ScriptRecordingReplay from '$lib/components/recording/ScriptRecordingReplay.svelte'
-	import type { FlowRecording, ScriptRecording } from '$lib/components/recording/types'
-	import { sendUserToast } from '$lib/toast'
-	import { Button } from '$lib/components/common'
-	import FileInput from '$lib/components/common/fileInput/FileInput.svelte'
-	import { Upload } from 'lucide-svelte'
-	import { setActiveReplay } from '$lib/components/recording/flowRecording.svelte'
-
-	let flowRecording: FlowRecording | undefined = $state(undefined)
-	let scriptRecording: ScriptRecording | undefined = $state(undefined)
-
-	function handleFileChange(event: CustomEvent<(string | ArrayBuffer | null)[]>) {
-		const content = event.detail?.[0]
-		if (!content || typeof content !== 'string') return
-		try {
-			const data = JSON.parse(content)
-			if (data.version !== 1) {
-				sendUserToast('Invalid recording format', true)
-				return
-			}
-			if (data.type === 'script') {
-				if (!data.job) {
-					sendUserToast('Invalid script recording format', true)
-					return
-				}
-				scriptRecording = data as ScriptRecording
-				flowRecording = undefined
-			} else {
-				// Flow recording (type === 'flow' or type is absent for backwards compat)
-				if (!data.jobs) {
-					sendUserToast('Invalid flow recording format', true)
-					return
-				}
-				flowRecording = data as FlowRecording
-				scriptRecording = undefined
-			}
-		} catch (err) {
-			sendUserToast('Failed to load recording: ' + err, true)
-		}
-	}
-
-	function quit() {
-		setActiveReplay(undefined)
-		flowRecording = undefined
-		scriptRecording = undefined
-	}
-</script>
-
-<div class="max-w-7xl mx-auto px-4 py-8 w-full">
-	{#if flowRecording}
-		<div class="flex justify-end mb-4">
-			<Button variant="border" size="xs" onclick={quit} startIcon={{ icon: Upload }}>
-				Load another recording
-			</Button>
-		</div>
-		<FlowRecordingReplay recording={flowRecording} />
-	{:else if scriptRecording}
-		<div class="flex justify-end mb-4">
-			<Button variant="border" size="xs" onclick={quit} startIcon={{ icon: Upload }}>
-				Load another recording
-			</Button>
-		</div>
-		<ScriptRecordingReplay recording={scriptRecording} />
-	{:else}
-		<div class="flex flex-col items-center justify-center min-h-[60vh]">
-			<div class="flex flex-col items-center gap-2 max-w-md w-full">
-				<h2 class="text-lg font-semibold text-emphasis">Replay a recording</h2>
-				<p class="text-xs text-secondary mb-2">
-					Upload a recording JSON file to replay a flow or script execution offline.
-				</p>
-				<FileInput accept=".json" convertTo="text" class="w-full" on:change={handleFileChange}>
-					Drag and drop a recording file
-				</FileInput>
-			</div>
-		</div>
-	{/if}
-</div>
diff --git a/frontend/src/routes/(root)/(logged)/replay/+page.ts b/frontend/src/routes/(root)/(logged)/replay/+page.ts
new file mode 100644
index 0000000000..811dac8e18
--- /dev/null
+++ b/frontend/src/routes/(root)/(logged)/replay/+page.ts
@@ -0,0 +1,9 @@
+import { redirect } from '@sveltejs/kit'
+import { base } from '$app/paths'
+
+// The replay page moved to /pipeline_replay (it now replays data-pipeline
+// recordings in addition to flow/script ones). Redirect the old path in `load`
+// so existing /replay links and bookmarks still resolve instead of 404-ing.
+export function load({ url }: { url: URL }) {
+	redirect(307, `${base}/pipeline_replay${url.search}`)
+}

From 68daed8501130456af3c7229ad18b1fb303887ae Mon Sep 17 00:00:00 2001
From: Diego Imbert <70353967+diegoimbert@users.noreply.github.com>
Date: Thu, 23 Jul 2026 18:57:31 +0200
Subject: [PATCH 140/171] refactor: custom-instance datatable connection
 handling (#10271)

Attach custom-instance datatables in the DuckDB executor through a DuckDB
secret instead of an inline connection string, and route postgres triggers on
custom-instance datatables through a dedicated custom_instance_replication_user
role (with its own auto-generated password in global_settings). Normalize
custom_instance_user attributes on server boot.


Claude-Session: https://claude.ai/code/session_01Tp6NNNinCB8dwWqGaFXDRF

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
---
 ...f4367ef6b6cc3de20da6ef8c98f679b832240.json |  20 ++++
 ..._custom_instance_replication_user.down.sql |  14 +++
 ...46_custom_instance_replication_user.up.sql |  34 ++++++
 backend/windmill-api-settings/src/lib.rs      |  17 ++-
 backend/windmill-api/openapi.yaml             |   2 +-
 backend/windmill-api/src/live_migrations.rs   |  24 ++++
 .../windmill-common/src/global_settings.rs    |   7 ++
 .../windmill-common/src/instance_config.rs    |  99 ++++++++++------
 backend/windmill-common/src/utils.rs          |  86 ++++++++++++++
 backend/windmill-common/src/workspaces.rs     |  37 +++++-
 backend/windmill-trigger-postgres/src/lib.rs  |   6 +-
 .../windmill-worker/src/duckdb_executor.rs    | 107 +++++++++++++++++-
 .../CustomInstanceDbWizardModal.svelte        |  15 ++-
 13 files changed, 419 insertions(+), 49 deletions(-)
 create mode 100644 backend/.sqlx/query-ffbe9fe78a7fc0e95a5a29c8d17f4367ef6b6cc3de20da6ef8c98f679b832240.json
 create mode 100644 backend/migrations/20260716152346_custom_instance_replication_user.down.sql
 create mode 100644 backend/migrations/20260716152346_custom_instance_replication_user.up.sql

diff --git a/backend/.sqlx/query-ffbe9fe78a7fc0e95a5a29c8d17f4367ef6b6cc3de20da6ef8c98f679b832240.json b/backend/.sqlx/query-ffbe9fe78a7fc0e95a5a29c8d17f4367ef6b6cc3de20da6ef8c98f679b832240.json
new file mode 100644
index 0000000000..9320a9625f
--- /dev/null
+++ b/backend/.sqlx/query-ffbe9fe78a7fc0e95a5a29c8d17f4367ef6b6cc3de20da6ef8c98f679b832240.json
@@ -0,0 +1,20 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT value->>'replication_user_pwd' FROM global_settings WHERE name = 'custom_instance_pg_databases';",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "?column?",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "ffbe9fe78a7fc0e95a5a29c8d17f4367ef6b6cc3de20da6ef8c98f679b832240"
+}
diff --git a/backend/migrations/20260716152346_custom_instance_replication_user.down.sql b/backend/migrations/20260716152346_custom_instance_replication_user.down.sql
new file mode 100644
index 0000000000..2350875885
--- /dev/null
+++ b/backend/migrations/20260716152346_custom_instance_replication_user.down.sql
@@ -0,0 +1,14 @@
+DO $$
+BEGIN
+    IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'custom_instance_user') THEN
+        ALTER ROLE custom_instance_user REPLICATION;
+    END IF;
+
+    DROP ROLE IF EXISTS custom_instance_replication_user;
+
+    DELETE FROM global_settings WHERE name = 'custom_instance_replication_pwd';
+EXCEPTION
+    WHEN others THEN
+        RAISE NOTICE 'custom_instance_replication_user down-migration error, skipping: %', SQLERRM;
+END
+$$;
diff --git a/backend/migrations/20260716152346_custom_instance_replication_user.up.sql b/backend/migrations/20260716152346_custom_instance_replication_user.up.sql
new file mode 100644
index 0000000000..3fb0f0d9d0
--- /dev/null
+++ b/backend/migrations/20260716152346_custom_instance_replication_user.up.sql
@@ -0,0 +1,34 @@
+-- Dedicated logical-replication role used by postgres triggers on custom-instance
+-- datatables. Its password is stored server-only in global_settings.custom_instance_replication_pwd
+-- (hidden from the config surface); membership in custom_instance_user lets it manage
+-- publications on the datatable tables. custom_instance_user itself must not hold REPLICATION.
+DO $$
+DECLARE
+    pwd text;
+BEGIN
+    SELECT gen_random_uuid()::text INTO pwd;
+
+    IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'custom_instance_replication_user') THEN
+        EXECUTE format('ALTER USER custom_instance_replication_user WITH PASSWORD %L REPLICATION', pwd);
+    ELSE
+        EXECUTE format('CREATE USER custom_instance_replication_user WITH PASSWORD %L REPLICATION', pwd);
+    END IF;
+
+    IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'custom_instance_user') THEN
+        GRANT custom_instance_user TO custom_instance_replication_user;
+        ALTER ROLE custom_instance_user NOREPLICATION;
+    END IF;
+
+    INSERT INTO global_settings (name, value)
+    VALUES ('custom_instance_replication_pwd', to_jsonb(pwd::text))
+    ON CONFLICT (name) DO UPDATE SET value = EXCLUDED.value;
+
+    -- Drop any replication password an earlier iteration stored in the operator-facing row.
+    UPDATE global_settings
+    SET value = value - 'replication_user_pwd'
+    WHERE name = 'custom_instance_pg_databases';
+EXCEPTION
+    WHEN others THEN
+        RAISE NOTICE 'custom_instance_replication_user migration error, skipping: %', SQLERRM;
+END
+$$;
diff --git a/backend/windmill-api-settings/src/lib.rs b/backend/windmill-api-settings/src/lib.rs
index 1fb070c2c9..8351ec0d2f 100644
--- a/backend/windmill-api-settings/src/lib.rs
+++ b/backend/windmill-api-settings/src/lib.rs
@@ -1578,6 +1578,7 @@ async fn refresh_custom_instance_user_pwd(
 ) -> JsonResult<()> {
     require_super_admin(&db, &authed.email).await?;
     windmill_common::utils::refresh_custom_instance_user_pwd(&db).await?;
+    windmill_common::utils::refresh_custom_instance_replication_user_pwd(&db).await?;
     Ok(Json(()))
 }
 
@@ -1704,11 +1705,23 @@ async fn setup_custom_instance_pg_database_inner(
             ))
         })?;
 
+    // The replication attribute lives on a dedicated role used by postgres trigger
+    // connections. The getter creates the role (with its stored password) when the
+    // migration couldn't.
+    if let Err(e) = windmill_common::utils::get_custom_pg_instance_replication_password(db).await {
+        tracing::error!("Failed to ensure custom_instance_replication_user exists: {e:#}");
+    }
     if let Err(e) = client
-        .batch_execute(&format!("ALTER ROLE custom_instance_user REPLICATION;"))
+        .batch_execute(
+            "ALTER ROLE custom_instance_replication_user REPLICATION;
+             GRANT custom_instance_user TO custom_instance_replication_user;
+             ALTER ROLE custom_instance_user NOREPLICATION;",
+        )
         .await
     {
-        tracing::error!("Failed to grant replication permission to custom_instance_user: {e:#}");
+        tracing::error!(
+            "Failed to grant replication permission to custom_instance_replication_user: {e:#}"
+        );
     }
 
     logs.grant_permissions = "OK".to_string();
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 12300d4a69..8c082f5052 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1330,7 +1330,7 @@ paths:
 
   /settings/refresh_custom_instance_user_pwd:
     post:
-      summary: Refreshes the password for the custom_instance_user
+      summary: Refreshes the passwords for the custom_instance_user and the custom_instance_replication_user (used by postgres triggers)
       operationId: refreshCustomInstanceUserPwd
       tags:
         - setting
diff --git a/backend/windmill-api/src/live_migrations.rs b/backend/windmill-api/src/live_migrations.rs
index d5c759fc18..7c359300c3 100644
--- a/backend/windmill-api/src/live_migrations.rs
+++ b/backend/windmill-api/src/live_migrations.rs
@@ -19,6 +19,30 @@ pub async fn custom_migrations(migrator: &mut CustomMigrator) -> Result<(), Erro
         tracing::error!("Could not apply flow versioning fix migration: {err:#}");
     }
 
+    if let Err(err) = normalize_custom_instance_user_attributes(migrator).await {
+        tracing::error!("Could not normalize custom_instance_user attributes: {err:#}");
+    }
+
+    Ok(())
+}
+
+// Converged on every boot, not once: the one-shot migration swallows errors (it must not
+// abort startup without superuser), and an older instance sharing the cluster can re-add
+// the attribute. REPLICATION belongs only on custom_instance_replication_user.
+async fn normalize_custom_instance_user_attributes(
+    migrator: &mut CustomMigrator,
+) -> Result<(), Error> {
+    let has_replication = sqlx::query_scalar::<_, bool>(
+        "SELECT rolreplication FROM pg_roles WHERE rolname = 'custom_instance_user'",
+    )
+    .fetch_optional(migrator.connection())
+    .await?;
+    if has_replication == Some(true) {
+        sqlx::query("ALTER ROLE custom_instance_user NOREPLICATION")
+            .execute(migrator.connection())
+            .await?;
+        tracing::info!("Normalized custom_instance_user attributes");
+    }
     Ok(())
 }
 
diff --git a/backend/windmill-common/src/global_settings.rs b/backend/windmill-common/src/global_settings.rs
index 2714d31276..b91922dffb 100644
--- a/backend/windmill-common/src/global_settings.rs
+++ b/backend/windmill-common/src/global_settings.rs
@@ -165,6 +165,11 @@ pub const AGENT_WORKER_BLOCKED_SETTINGS: &[&str] = &[
     INSTANCE_EVENTS_WEBHOOK_SETTING,
     OTEL_SETTING,
     OTEL_TRACING_PROXY_SETTING,
+    // Custom-instance DB credentials: `custom_instance_pg_databases` holds `user_pwd`,
+    // `custom_instance_replication_pwd` holds the REPLICATION-role password. Agent workers
+    // resolve datatable connections through the dedicated datatable endpoints, never these.
+    "custom_instance_pg_databases",
+    "custom_instance_replication_pwd",
 ];
 
 /// Whether an agent worker may read the given global setting over HTTP.
@@ -381,6 +386,8 @@ mod tests {
             INSTANCE_EVENTS_WEBHOOK_SETTING,
             OTEL_SETTING,
             OTEL_TRACING_PROXY_SETTING,
+            "custom_instance_pg_databases",
+            "custom_instance_replication_pwd",
         ] {
             assert!(
                 !is_setting_readable_by_agent_worker(key),
diff --git a/backend/windmill-common/src/instance_config.rs b/backend/windmill-common/src/instance_config.rs
index 74b0647d82..7e32fe6e56 100644
--- a/backend/windmill-common/src/instance_config.rs
+++ b/backend/windmill-common/src/instance_config.rs
@@ -776,7 +776,10 @@ pub enum DucklakeCatalogResourceType {
 // Custom instance PG databases
 // ---------------------------------------------------------------------------
 
-/// Custom PostgreSQL databases managed by the instance.
+/// Custom PostgreSQL databases managed by the instance. `user_pwd` is operator-configurable
+/// (resolved from a Kubernetes secretKeyRef by the EE operator); `databases` is runtime
+/// setup status. The replication-role password lives in a separate hidden setting
+/// (`custom_instance_replication_pwd`), never in this operator-facing config row.
 #[derive(Deserialize, Serialize, Clone, Debug, Default)]
 #[cfg_attr(feature = "instance_config_schema", derive(schemars::JsonSchema))]
 pub struct CustomInstancePgDatabases {
@@ -945,6 +948,7 @@ pub const PROTECTED_SETTINGS: &[&str] = &[
     "ducklake_user_pg_pwd",
     "ducklake_settings",
     "custom_instance_pg_databases",
+    "custom_instance_replication_pwd",
     "uid",
     "rsa_keys",
     "jwt_secret",
@@ -966,6 +970,10 @@ pub const HIDDEN_SETTINGS: &[&str] = &[
     // every bulk InstanceSettings save via `GlobalSettings::extra`. Hiding it
     // on read + rejecting it in `diff_global_settings` breaks that loop.
     "worker_configs",
+    // Auto-generated password for the REPLICATION role used by postgres triggers.
+    // Server-only (written by setup/refresh via direct SQL), never operator-authored —
+    // hidden so the config machinery can't read, rewrite, or drop it.
+    "custom_instance_replication_pwd",
 ];
 
 /// Top-level settings whose entire value is sensitive and must be fully redacted in logs.
@@ -976,6 +984,7 @@ const SENSITIVE_SETTINGS: &[&str] = &[
     "hub_api_secret",
     "license_key",
     "ducklake_user_pg_pwd",
+    "custom_instance_replication_pwd",
     "pip_index_url",
     "pip_extra_index_url",
     "npm_config_registry",
@@ -1000,6 +1009,7 @@ const NESTED_SENSITIVE_FIELDS: &[(&str, &[&str])] = &[
         "object_store_cache_config",
         &["secret_key", "serviceAccountKey"],
     ),
+    ("custom_instance_pg_databases", &["user_pwd"]),
 ];
 
 fn redact_json_value(value: &serde_json::Value) -> serde_json::Value {
@@ -1024,10 +1034,7 @@ fn mask_nested_sensitive(key: &str, value: &serde_json::Value) -> serde_json::Va
         }
     }
     // Settings that are maps-of-objects where each child has a sensitive sub-field.
-    const NESTED_MAP_SENSITIVE: &[(&str, &str)] = &[
-        ("oauths", "secret"),
-        ("custom_instance_pg_databases", "user_pwd"),
-    ];
+    const NESTED_MAP_SENSITIVE: &[(&str, &str)] = &[("oauths", "secret")];
     for &(parent_key, child_field) in NESTED_MAP_SENSITIVE {
         if key == parent_key {
             if let serde_json::Value::Object(entries) = value {
@@ -1142,14 +1149,13 @@ pub fn diff_global_settings(
     let mut previous_values = BTreeMap::new();
     let mut unchanged_count: usize = 0;
     for (key, desired_value) in desired {
-        // `worker_configs` is a legacy ghost: worker configs belong in the
-        // `config` table with a `worker__` prefix. If a client PUT carries a
-        // top-level `worker_configs` key (it flattens into
-        // `GlobalSettings::extra` on deserialize), drop it here instead of
-        // letting it resurrect a stale `global_settings` row.
-        if key == "worker_configs" {
+        // Hidden settings are server-managed and never driven by config: they are
+        // filtered out on read (`from_db`) and must be ignored on write too, so a client
+        // PUT that flattened one into `GlobalSettings::extra` can't resurrect or clobber
+        // the row (e.g. `worker_configs`, or the custom-instance credentials/status).
+        if HIDDEN_SETTINGS.contains(&key.as_str()) {
             tracing::warn!(
-                "Ignoring 'worker_configs' in global_settings diff: worker configs must be written to the config table (worker__ prefix), not global_settings"
+                "Ignoring hidden setting '{key}' in global_settings diff (server-managed, not configurable)"
             );
             continue;
         }
@@ -2367,34 +2373,63 @@ mod tests {
     }
 
     #[test]
-    fn custom_instance_pg_databases_roundtrips() {
+    fn custom_instance_replication_pwd_is_isolated_from_config() {
+        // The replication-role password is server-only: written by setup/refresh via direct
+        // SQL, never operator-authored. It must stay out of the declarative config surface
+        // (hidden on read) and be undeletable, so config sync can't read, rewrite, or drop it.
+        assert!(HIDDEN_SETTINGS.contains(&"custom_instance_replication_pwd"));
+        assert!(PROTECTED_SETTINGS.contains(&"custom_instance_replication_pwd"));
+        assert!(SENSITIVE_SETTINGS.contains(&"custom_instance_replication_pwd"));
+
+        // A stray desired value (e.g. flattened into `extra`) is ignored, not upserted.
+        let mut desired = BTreeMap::new();
+        desired.insert(
+            "custom_instance_replication_pwd".to_string(),
+            serde_json::json!("attacker-set"),
+        );
+        let diff = diff_global_settings(&BTreeMap::new(), &desired, ApplyMode::Merge);
+        assert!(
+            diff.upserts.is_empty(),
+            "hidden setting must not be upserted"
+        );
+
+        // A current value is never deleted by a Replace that omits it.
+        let mut current = BTreeMap::new();
+        current.insert(
+            "custom_instance_replication_pwd".to_string(),
+            serde_json::json!("live"),
+        );
+        let diff = diff_global_settings(&current, &BTreeMap::new(), ApplyMode::Replace);
+        assert!(
+            !diff
+                .deletes
+                .contains(&"custom_instance_replication_pwd".to_string()),
+            "hidden setting must not be deleted"
+        );
+    }
+
+    #[test]
+    fn custom_instance_pg_databases_roundtrips_and_redacts_user_pwd() {
+        // user_pwd stays operator-configurable (EE secretKeyRef); databases is runtime status.
         let json = r#"{
             "user_pwd": "secret123",
-            "databases": {
-                "mydb": {
-                    "logs": {
-                        "super_admin": "OK",
-                        "database_credentials": "OK",
-                        "valid_dbname": "OK",
-                        "created_database": "OK",
-                        "db_connect": "OK",
-                        "grant_permissions": "OK"
-                    },
-                    "success": true,
-                    "tag": "production"
-                }
-            }
+            "databases": { "mydb": { "success": true, "tag": "production" } }
         }"#;
         let pg: CustomInstancePgDatabases = serde_json::from_str(json).unwrap();
         assert_eq!(
             pg.user_pwd.as_ref().and_then(|v| v.as_literal()),
             Some("secret123")
         );
-        let db = &pg.databases["mydb"];
-        assert!(db.success);
-        assert_eq!(db.tag.as_deref(), Some("production"));
-        assert_eq!(db.logs.super_admin, "OK");
-        assert_eq!(db.logs.grant_permissions, "OK");
+        assert!(pg.databases["mydb"].success);
+
+        let out = format_setting_value(
+            "custom_instance_pg_databases",
+            &serde_json::json!({ "user_pwd": "user-plaintext-password" }),
+        );
+        assert!(
+            !out.contains("user-plaintext-password"),
+            "user_pwd leaked: {out}"
+        );
     }
 
     #[test]
diff --git a/backend/windmill-common/src/utils.rs b/backend/windmill-common/src/utils.rs
index a6d1eeaeb0..efe6477ad3 100644
--- a/backend/windmill-common/src/utils.rs
+++ b/backend/windmill-common/src/utils.rs
@@ -1044,6 +1044,92 @@ pub async fn get_custom_pg_instance_password(db: &DB) -> Result<String> {
     )
 }
 
+const REFRESH_CUSTOM_INSTANCE_REPLICATION_USER_SQL: &str = r#"
+    DO $$
+        DECLARE
+            pwd text;
+        BEGIN
+            SELECT gen_random_uuid()::text INTO pwd;
+
+            IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'custom_instance_replication_user') THEN
+                EXECUTE format('ALTER USER custom_instance_replication_user WITH PASSWORD %L REPLICATION', pwd);
+            ELSE
+                EXECUTE format('CREATE USER custom_instance_replication_user WITH PASSWORD %L REPLICATION', pwd);
+            END IF;
+
+            IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'custom_instance_user') THEN
+                GRANT custom_instance_user TO custom_instance_replication_user;
+                ALTER ROLE custom_instance_user NOREPLICATION;
+            END IF;
+
+            INSERT INTO global_settings (name, value)
+            VALUES ('custom_instance_replication_pwd', to_jsonb(pwd::text))
+            ON CONFLICT (name) DO UPDATE SET value = EXCLUDED.value;
+        END
+        $$;
+"#;
+
+const REPLICATION_PWD_READ_SQL: &str =
+    "SELECT value #>> '{}' FROM global_settings WHERE name = 'custom_instance_replication_pwd'";
+
+/// (Re)create `custom_instance_replication_user` with a fresh password. This role is
+/// used by postgres trigger connections on custom-instance datatables; membership in
+/// `custom_instance_user` lets it manage publications on the datatable tables.
+///
+/// Authorization: rotates a stored database credential and performs no authorization
+/// itself — callers MUST restrict this to superadmin or internal server paths.
+pub async fn refresh_custom_instance_replication_user_pwd(db: &DB) -> Result<()> {
+    sqlx::query(REFRESH_CUSTOM_INSTANCE_REPLICATION_USER_SQL)
+        .execute(db)
+        .await?;
+    Ok(())
+}
+
+/// Authorization: returns a stored database credential and performs no authorization
+/// itself — callers MUST restrict this to superadmin or internal server paths (mirrors
+/// [`get_custom_pg_instance_password`]).
+pub async fn get_custom_pg_instance_replication_password(db: &DB) -> Result<String> {
+    // Fast path: already provisioned by the migration.
+    if let Some(pwd) = sqlx::query_scalar::<_, Option<String>>(REPLICATION_PWD_READ_SQL)
+        .fetch_optional(db)
+        .await?
+        .flatten()
+    {
+        return Ok(pwd);
+    }
+    // Self-heal when the role-creating migration was swallowed. The advisory lock + re-check
+    // serialize concurrent workers: otherwise two callers both rotate, and the second
+    // rotation invalidates the password the first already returned. Rotating and reading in
+    // one locked transaction keeps the decision atomic.
+    let mut tx = db.begin().await?;
+    sqlx::query("SELECT pg_advisory_xact_lock(hashtext('custom_instance_replication_pwd'))")
+        .execute(&mut *tx)
+        .await?;
+    if let Some(pwd) = sqlx::query_scalar::<_, Option<String>>(REPLICATION_PWD_READ_SQL)
+        .fetch_optional(&mut *tx)
+        .await?
+        .flatten()
+    {
+        tx.commit().await?;
+        return Ok(pwd);
+    }
+    sqlx::query(REFRESH_CUSTOM_INSTANCE_REPLICATION_USER_SQL)
+        .execute(&mut *tx)
+        .await?;
+    let pwd = sqlx::query_scalar::<_, Option<String>>(REPLICATION_PWD_READ_SQL)
+        .fetch_optional(&mut *tx)
+        .await?
+        .flatten()
+        .ok_or_else(|| {
+            Error::BadRequest(
+                "Custom instance replication user password not found, did you run migrations ?"
+                    .to_string(),
+            )
+        })?;
+    tx.commit().await?;
+    Ok(pwd)
+}
+
 /// Convert a JSON string to a `Box<RawValue>` without validation.
 ///
 /// # Safety
diff --git a/backend/windmill-common/src/workspaces.rs b/backend/windmill-common/src/workspaces.rs
index 5be60363b7..59d50ef44a 100644
--- a/backend/windmill-common/src/workspaces.rs
+++ b/backend/windmill-common/src/workspaces.rs
@@ -9,7 +9,7 @@ use crate::{
     error::{self, to_anyhow, Error, Result},
     get_database_url,
     secret_backend::{get_secret_value, is_external_stored_value},
-    utils::get_custom_pg_instance_password,
+    utils::{get_custom_pg_instance_password, get_custom_pg_instance_replication_password},
     variables::{build_crypt, decrypt},
     PgDatabase, DB,
 };
@@ -1044,6 +1044,32 @@ pub async fn get_datatable_resource_from_db_unchecked(
     db: &DB,
     w_id: &str,
     name: &str,
+) -> Result<serde_json::Value> {
+    get_datatable_resource_inner(db, w_id, name, false).await
+}
+
+/// Same as [`get_datatable_resource_from_db_unchecked`] but for postgres trigger
+/// connections: custom-instance datatables resolve to
+/// `custom_instance_replication_user` rather than `custom_instance_user`. BYO-postgres
+/// datatables resolve to the user's own resource unchanged; configuring it for
+/// replication there is the user's responsibility.
+///
+/// Authorization: like its `_unchecked` sibling, returns resolved connection
+/// credentials and performs no authorization — callers MUST have already authorized
+/// access to the datatable (e.g. the trigger's own create-time check).
+pub async fn get_datatable_replication_resource_from_db_unchecked(
+    db: &DB,
+    w_id: &str,
+    name: &str,
+) -> Result<serde_json::Value> {
+    get_datatable_resource_inner(db, w_id, name, true).await
+}
+
+async fn get_datatable_resource_inner(
+    db: &DB,
+    w_id: &str,
+    name: &str,
+    replication: bool,
 ) -> Result<serde_json::Value> {
     let datatables = sqlx::query_scalar!(
         r#"
@@ -1068,8 +1094,13 @@ pub async fn get_datatable_resource_from_db_unchecked(
     {
         let mut pg_creds = PgDatabase::parse_uri(&get_database_url().await?.as_str().await)?;
         pg_creds.dbname = datatable.database.resource_path.clone();
-        pg_creds.user = Some("custom_instance_user".to_string());
-        pg_creds.password = Some(get_custom_pg_instance_password(&db).await?);
+        if replication {
+            pg_creds.user = Some("custom_instance_replication_user".to_string());
+            pg_creds.password = Some(get_custom_pg_instance_replication_password(&db).await?);
+        } else {
+            pg_creds.user = Some("custom_instance_user".to_string());
+            pg_creds.password = Some(get_custom_pg_instance_password(&db).await?);
+        }
         serde_json::to_value(&pg_creds)
             .map_err(|e| Error::internal_err(format!("Error serializing pg creds: {}", e)))?
     } else {
diff --git a/backend/windmill-trigger-postgres/src/lib.rs b/backend/windmill-trigger-postgres/src/lib.rs
index d6fcebfddb..a295183dfc 100644
--- a/backend/windmill-trigger-postgres/src/lib.rs
+++ b/backend/windmill-trigger-postgres/src/lib.rs
@@ -11,7 +11,7 @@ use serde::{Deserialize, Deserializer, Serialize};
 use serde_json::value::RawValue;
 use sqlx::FromRow;
 use windmill_api_auth::ApiAuthed;
-use windmill_common::workspaces::get_datatable_resource_from_db_unchecked;
+use windmill_common::workspaces::get_datatable_replication_resource_from_db_unchecked;
 use windmill_common::{
     db::UserDB,
     error::{to_anyhow, Error, Result},
@@ -382,8 +382,10 @@ pub async fn resolve_postgres_resource(
     w_id: &str,
 ) -> Result<Postgres> {
     if let Some(datatable_name) = postgres_resource_path.strip_prefix("datatable://") {
+        // Trigger connections (publication/slot management + logical replication) run
+        // as the dedicated replication user on custom-instance databases.
         let resource_value =
-            get_datatable_resource_from_db_unchecked(db, w_id, datatable_name).await?;
+            get_datatable_replication_resource_from_db_unchecked(db, w_id, datatable_name).await?;
         serde_json::from_value::<Postgres>(resource_value).map_err(|e| Error::SerdeJson {
             error: e,
             location: "resolve_postgres_resource".to_string(),
diff --git a/backend/windmill-worker/src/duckdb_executor.rs b/backend/windmill-worker/src/duckdb_executor.rs
index e4e24d6653..e2807547e7 100644
--- a/backend/windmill-worker/src/duckdb_executor.rs
+++ b/backend/windmill-worker/src/duckdb_executor.rs
@@ -2571,15 +2571,57 @@ async fn transform_attach_datatable(
         }
         Connection::Sql(db) => get_datatable_resource_from_db_unchecked(db, w_id, name).await?,
     };
-    let db_type = "postgres";
 
     if let Some(pwd) = db_resource.get("password").and_then(|p| p.as_str()) {
         hidden_passwords.lock().unwrap().push(pwd.to_string());
     }
 
-    Ok(Some(
-        db_resource_to_attach_statements(db_resource, alias_name, db_type, None).await?,
-    ))
+    Ok(Some(pg_secret_attach_statements(db_resource, alias_name)?))
+}
+
+// Secret names must be plain identifiers; the hash keeps two aliases distinct even
+// when sanitizing maps them to the same string.
+fn datatable_secret_name(alias: &str) -> String {
+    use sha2::{Digest, Sha256};
+    let sanitized: String = alias
+        .chars()
+        .map(|c| if c.is_ascii_alphanumeric() { c } else { '_' })
+        .collect();
+    let hash = &Sha256::digest(alias.as_bytes())[..4];
+    format!(
+        "__wm_datatable_{sanitized}_{:08x}",
+        u32::from_be_bytes([hash[0], hash[1], hash[2], hash[3]])
+    )
+}
+
+/// ATTACH a datatable's postgres database through a DuckDB TEMPORARY SECRET holding
+/// the connection parameters; only sslmode rides in the ATTACH string.
+fn pg_secret_attach_statements(db_resource: Value, alias_name: &str) -> Result<Vec<String>> {
+    let res: PgDatabase = serde_json::from_value(db_resource)?;
+    // Escape single quotes: each field is embedded in a single-quoted DuckDB literal,
+    // so an unescaped quote would break out of the CREATE SECRET statement.
+    let esc = |s: &str| s.replace('\'', "''");
+    // The postgres secret type has no sslmode parameter, so it goes in the ATTACH
+    // string; only the libpq values PgDatabase::to_uri collapses to are forwarded.
+    let sslmode = match res.sslmode.as_deref() {
+        Some("disable") => "disable",
+        Some("require") | Some("verify-ca") | Some("verify-full") => "require",
+        _ => "prefer",
+    };
+    let secret_name = datatable_secret_name(alias_name);
+    Ok(vec![
+        "INSTALL postgres;".to_string(),
+        "LOAD postgres;".to_string(),
+        format!(
+            "CREATE OR REPLACE TEMPORARY SECRET {secret_name} (TYPE postgres, HOST '{}', PORT {}, DATABASE '{}', USER '{}', PASSWORD '{}');",
+            esc(&res.host),
+            res.port.unwrap_or(5432),
+            esc(&res.dbname),
+            esc(res.user.as_deref().unwrap_or("postgres")),
+            esc(res.password.as_deref().unwrap_or("")),
+        ),
+        format!("ATTACH 'sslmode={sslmode}' AS {alias_name} (TYPE postgres, SECRET {secret_name});"),
+    ])
 }
 
 async fn transform_s3_uris(query: &str) -> Result<String> {
@@ -3716,6 +3758,63 @@ mod tests {
         assert!(result.contains("sslmode=prefer"));
     }
 
+    #[test]
+    fn test_pg_secret_attach_statements() {
+        let db_resource = json!({
+            "host": "localhost",
+            "port": 5433,
+            "user": "custom_instance_user",
+            "password": "it's-secret",
+            "dbname": "wm_datatables",
+            "sslmode": "require"
+        });
+        let stmts = pg_secret_attach_statements(db_resource, "dt").unwrap();
+        assert_eq!(stmts[0], "INSTALL postgres;");
+        assert_eq!(stmts[1], "LOAD postgres;");
+        let secret_name = datatable_secret_name("dt");
+        assert_eq!(
+            stmts[2],
+            format!(
+                "CREATE OR REPLACE TEMPORARY SECRET {secret_name} (TYPE postgres, HOST 'localhost', PORT 5433, DATABASE 'wm_datatables', USER 'custom_instance_user', PASSWORD 'it''s-secret');"
+            )
+        );
+        assert_eq!(
+            stmts[3],
+            format!("ATTACH 'sslmode=require' AS dt (TYPE postgres, SECRET {secret_name});")
+        );
+    }
+
+    #[test]
+    fn test_pg_secret_attach_statements_sslmode_whitelist() {
+        for (input, expected) in [
+            (Some("allow"), "prefer"),
+            (Some("verify-full"), "require"),
+            (Some("disable"), "disable"),
+            (Some("unknown-value"), "prefer"),
+            (None, "prefer"),
+        ] {
+            let mut db_resource = json!({ "host": "h", "dbname": "d" });
+            if let Some(s) = input {
+                db_resource["sslmode"] = json!(s);
+            }
+            let stmts = pg_secret_attach_statements(db_resource, "dt").unwrap();
+            assert!(
+                stmts[3].starts_with(&format!("ATTACH 'sslmode={expected}'")),
+                "sslmode {input:?} → {}",
+                stmts[3]
+            );
+        }
+    }
+
+    #[test]
+    fn test_datatable_secret_name_sanitizes_and_disambiguates() {
+        let a = datatable_secret_name("a.b");
+        let b = datatable_secret_name("a_b");
+        assert!(a.starts_with("__wm_datatable_a_b_"));
+        assert_ne!(a, b);
+        assert!(a.chars().all(|c| c.is_ascii_alphanumeric() || c == '_'));
+    }
+
     #[test]
     fn test_format_attach_db_conn_str_bigquery() {
         let db_resource = json!({
diff --git a/frontend/src/lib/components/workspaceSettings/CustomInstanceDbWizardModal.svelte b/frontend/src/lib/components/workspaceSettings/CustomInstanceDbWizardModal.svelte
index 156d11ce95..dcf41788ae 100644
--- a/frontend/src/lib/components/workspaceSettings/CustomInstanceDbWizardModal.svelte
+++ b/frontend/src/lib/components/workspaceSettings/CustomInstanceDbWizardModal.svelte
@@ -165,14 +165,17 @@
 									title: 'Grant permissions to custom_instance_user',
 									status: status?.logs.grant_permissions,
 									description:
-										'Gives custom_instance_user the required permissions to use the database. custom_instance_user is already created during a migration and has an auto-generated password stored in global_settings.custom_instance_pg_databases.user_pwd. These are the commands : \n\n' +
+										'Gives custom_instance_user the required permissions to use the database. custom_instance_user is already created during a migration and has an auto-generated password stored in global_settings.custom_instance_pg_databases.user_pwd. Postgres triggers use custom_instance_replication_user (password in global_settings.custom_instance_replication_pwd). These are the commands : \n\n' +
 										`GRANT CONNECT ON DATABASE "${dbname}" TO custom_instance_user;\n` +
 										'GRANT USAGE ON SCHEMA public TO custom_instance_user;\n' +
 										'GRANT CREATE ON SCHEMA public TO custom_instance_user;\n' +
 										`GRANT CREATE ON DATABASE "${dbname}" TO custom_instance_user;\n` +
 										'ALTER DEFAULT PRIVILEGES IN SCHEMA public \n' +
 										'  	GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES\n    TO custom_instance_user;\n' +
-										'ALTER ROLE custom_instance_user CREATEROLE;'
+										'ALTER ROLE custom_instance_user CREATEROLE;\n' +
+										'ALTER ROLE custom_instance_replication_user REPLICATION;\n' +
+										'GRANT custom_instance_user TO custom_instance_replication_user;\n' +
+										'ALTER ROLE custom_instance_user NOREPLICATION;'
 								}
 							],
 							status?.error ?? undefined
@@ -185,11 +188,13 @@
 							endIcon={{ icon: InfoIcon }}
 							onClick={async () => {
 								await SettingService.refreshCustomInstanceUserPwd()
-								sendUserToast('custom_instance_user password refreshed')
-							}}>Refresh custom_instance_user password</Button
+								sendUserToast('custom instance user passwords refreshed')
+							}}>Refresh custom instance passwords</Button
 						>
 						{#snippet text()}
-							Try this if there is an issue with your custom instance database password.
+							Try this if there is an issue with your custom instance database passwords. Rotates
+							both custom_instance_user and the custom_instance_replication_user used by postgres
+							triggers.
 						{/snippet}
 					</Tooltip>
 				{/if}

From 8eb36ce008b4efe2be9a9bfebc91af68070f7a6c Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Thu, 23 Jul 2026 19:05:09 +0200
Subject: [PATCH 141/171] fix: treat concurrent_limit/timeout <= 0 as unset
 instead of a zero cap (#10288)

* fix: treat concurrent_limit/timeout <= 0 as unset instead of a zero cap

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix: flow-step timeout <= 0 inherits the script timeout, not the global default

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 backend/windmill-api-flows/src/flows.rs       |   9 +-
 backend/windmill-api-scripts/src/scripts.rs   |   7 +
 backend/windmill-queue/src/jobs.rs            |  42 ++--
 .../tests/concurrency_limit_zero_test.rs      |  21 ++
 .../windmill-types/src/runnable_settings.rs   | 190 +++++++++++++++++-
 backend/windmill-worker/src/common.rs         |   4 +-
 backend/windmill-worker/src/worker.rs         |  19 +-
 backend/windmill-worker/src/worker_flow.rs    |  64 ++++--
 cli/src/commands/script/script.ts             |  51 ++++-
 9 files changed, 355 insertions(+), 52 deletions(-)
 create mode 100644 backend/windmill-queue/tests/concurrency_limit_zero_test.rs

diff --git a/backend/windmill-api-flows/src/flows.rs b/backend/windmill-api-flows/src/flows.rs
index 7f39e61f21..97e6999e23 100644
--- a/backend/windmill-api-flows/src/flows.rs
+++ b/backend/windmill-api-flows/src/flows.rs
@@ -527,6 +527,11 @@ async fn create_flow(
     }
     check_scopes(&authed, || format!("flows:write:{}", nf.path))?;
 
+    // A `<= 0` flow timeout is "unset", not a 0-second limit that kills every run instantly.
+    // (The concurrency settings inside the flow value are normalized on deserialization; see
+    // ConcurrencySettings.) Runtime guards also protect already-stored rows.
+    nf.timeout = windmill_common::runnable_settings::none_if_non_positive(nf.timeout);
+
     if let RuleCheckResult::Blocked(msg) = check_deploy_rules(
         &w_id,
         AuditAuthorable::username(&authed),
@@ -1012,7 +1017,9 @@ async fn update_flow(
     }
     let flow_path = flow_path.to_path();
     // The URL identifies the flow being updated; the body path is only needed to rename.
-    let nf = ef.into_new_flow(flow_path);
+    let mut nf = ef.into_new_flow(flow_path);
+    // A `<= 0` flow timeout is "unset", not a 0-second limit (see create_flow).
+    nf.timeout = windmill_common::runnable_settings::none_if_non_positive(nf.timeout);
     check_scopes(&authed, || format!("flows:write:{}", flow_path))?;
 
     if let RuleCheckResult::Blocked(msg) = check_deploy_rules(
diff --git a/backend/windmill-api-scripts/src/scripts.rs b/backend/windmill-api-scripts/src/scripts.rs
index 20aad98864..c2f023ce5a 100644
--- a/backend/windmill-api-scripts/src/scripts.rs
+++ b/backend/windmill-api-scripts/src/scripts.rs
@@ -914,6 +914,13 @@ async fn create_script_internal<'c>(
     }
     check_scopes(&authed, || format!("scripts:write:{}", ns.path))?;
 
+    // Normalize positive-only settings so a `<= 0` value (e.g. a CLI-pushed `0`) persists as
+    // disabled rather than as a zero-slot concurrency cap or a 0-second timeout. Deserialization
+    // already normalizes the concurrency fields; re-applying here also covers `timeout` and any
+    // NewScript built in-process rather than from a request body.
+    ns.timeout = windmill_common::runnable_settings::none_if_non_positive(ns.timeout);
+    ns.concurrency_settings = ns.concurrency_settings.normalized();
+
     guard_script_from_debounce_data(&ns).await?;
 
     let codebase = ns.codebase.as_ref();
diff --git a/backend/windmill-queue/src/jobs.rs b/backend/windmill-queue/src/jobs.rs
index 4911b08421..433d2e4ed5 100644
--- a/backend/windmill-queue/src/jobs.rs
+++ b/backend/windmill-queue/src/jobs.rs
@@ -1107,15 +1107,16 @@ async fn commit_completed_job<T: Serialize + Send + Sync + ValidableJson>(
     // Resolve the concurrency-limit settings on the pool *before* opening the
     // completion transaction: doing it inside the tx would hold a second
     // simultaneous connection from the small per-worker pool.
-    let has_concurrent_limit = completed_job.concurrent_limit.is_some()
-        || windmill_common::runnable_settings::prefetch_cached_from_handle(
-            completed_job.runnable_settings_handle,
-            db,
-        )
-        .await?
-        .1
-        .concurrent_limit
-        .is_some();
+    let has_concurrent_limit = has_active_concurrency_limit(completed_job.concurrent_limit)
+        || has_active_concurrency_limit(
+            windmill_common::runnable_settings::prefetch_cached_from_handle(
+                completed_job.runnable_settings_handle,
+                db,
+            )
+            .await?
+            .1
+            .concurrent_limit,
+        );
 
     // A genuine NUL (U+0000) in the result serializes to a `\u0000` escape that
     // the jsonb `result` column rejects with 22P05 ("unsupported Unicode escape
@@ -3921,7 +3922,7 @@ pub async fn pull(
                 let pulled_job_result = match job {
                     #[cfg(feature = "private")]
                     Some(job)
-                        if concurrency_settings.concurrent_limit.is_some()
+                        if has_active_concurrency_limit(concurrency_settings.concurrent_limit)
                             // Concurrency limit is available for either enterprise job or dependency job
                             && (cfg!(feature = "enterprise") || (job.is_dependency() && !*WMDEBUG_NO_DEBOUNCING)) =>
                     {
@@ -3985,7 +3986,8 @@ pub async fn pull(
         .1
         .maybe_fallback(None, job.concurrent_limit, job.concurrency_time_window_s);
 
-        let has_concurent_limit = concurrency_settings.concurrent_limit.is_some();
+        let has_concurent_limit =
+            has_active_concurrency_limit(concurrency_settings.concurrent_limit);
 
         #[cfg(not(feature = "enterprise"))]
         if has_concurent_limit && !job.is_dependency() {
@@ -3994,7 +3996,7 @@ pub async fn pull(
 
         #[cfg(not(feature = "enterprise"))]
         let has_concurent_limit = job.is_dependency()
-            && job.concurrent_limit.is_some()
+            && has_active_concurrency_limit(job.concurrent_limit)
             && cfg!(feature = "private")
             && !*WMDEBUG_NO_DEBOUNCING;
         // if we don't have private flag, we don't have concurrency limit
@@ -4162,6 +4164,13 @@ async fn pull_single_job_and_mark_as_running_no_concurrency_limit<'c>(
     Ok(job_and_suspended)
 }
 
+/// A concurrency limit is only active when it caps at 1+ slots. `Some(0)` (or negative) is
+/// a disabled limit, not a zero-slot one — see [`ConcurrencySettings::normalized`]. The gate
+/// checks must use this instead of `.is_some()` so a legacy stored `0` behaves as disabled.
+pub fn has_active_concurrency_limit(concurrent_limit: Option<i32>) -> bool {
+    concurrent_limit.is_some_and(|n| n > 0)
+}
+
 pub async fn custom_concurrency_key(
     db: &Pool<Postgres>,
     job_id: &Uuid,
@@ -6141,6 +6150,11 @@ async fn push_inner<'c, 'd>(
         },
     };
 
+    // Guard against an already-stored `concurrent_limit <= 0` reaching the queue: it would
+    // register a zero-slot concurrency key and permanently block the job. Coerce it to
+    // disabled before it is persisted onto the job row / concurrency key here.
+    concurrency_settings = concurrency_settings.normalized();
+
     // Enforce concurrency limit on all dependency jobs.
     // TODO: We can ignore this for scripts djobs. The main reason we need all djobs to be sequential is because we have
     // nodes_to_relock and we need all locks whose corresponding steps aren't in nodes_to_relock be already present.
@@ -6328,7 +6342,7 @@ async fn push_inner<'c, 'd>(
         check_workspace_queue_cap(&mut *tx, workspace_id).await?;
     }
 
-    if concurrency_settings.concurrent_limit.is_some() {
+    if has_active_concurrency_limit(concurrency_settings.concurrent_limit) {
         let concurrency_key = resolve_concurrency_key(
             workspace_id,
             &args,
@@ -6732,7 +6746,7 @@ pub async fn insert_concurrency_key_capped<'d, 'c, E: PgExecutor<'c> + Copy>(
         custom_concurrency_key,
     );
     #[cfg(feature = "cloud")]
-    if *CLOUD_HOSTED && concurrent_limit.is_some() {
+    if *CLOUD_HOSTED && has_active_concurrency_limit(concurrent_limit) {
         check_concurrency_key_queue_cap(db, &concurrency_key).await?;
     }
     #[cfg(not(feature = "cloud"))]
diff --git a/backend/windmill-queue/tests/concurrency_limit_zero_test.rs b/backend/windmill-queue/tests/concurrency_limit_zero_test.rs
new file mode 100644
index 0000000000..bd72571bcd
--- /dev/null
+++ b/backend/windmill-queue/tests/concurrency_limit_zero_test.rs
@@ -0,0 +1,21 @@
+//! Runtime gate for the `Some(0)` concurrency footgun: a stored `concurrent_limit <= 0`
+//! must read as "disabled", never as a zero-slot cap that permanently blocks the job at the
+//! concurrency gate (the re-queue storm the zombie monitor eventually fails as a fake OOM).
+//!
+//! Run with:
+//!   cargo test -p windmill-queue --test concurrency_limit_zero_test
+
+use windmill_queue::jobs::has_active_concurrency_limit;
+
+#[test]
+fn zero_and_negative_are_not_active_limits() {
+    assert!(!has_active_concurrency_limit(None));
+    assert!(!has_active_concurrency_limit(Some(0)));
+    assert!(!has_active_concurrency_limit(Some(-1)));
+}
+
+#[test]
+fn positive_limit_is_active() {
+    assert!(has_active_concurrency_limit(Some(1)));
+    assert!(has_active_concurrency_limit(Some(i32::MAX)));
+}
diff --git a/backend/windmill-types/src/runnable_settings.rs b/backend/windmill-types/src/runnable_settings.rs
index ea0fd30dc0..038246cbe6 100644
--- a/backend/windmill-types/src/runnable_settings.rs
+++ b/backend/windmill-types/src/runnable_settings.rs
@@ -93,9 +93,7 @@ pub struct DebouncingSettings {
     pub debounce_args_to_accumulate: Option<Vec<String>>,
 }
 
-#[derive(
-    Debug, Default, Clone, Serialize, Deserialize, Hash, PartialEq, sqlx::FromRow, sqlx::Decode,
-)]
+#[derive(Debug, Default, Clone, Serialize, Hash, PartialEq, sqlx::FromRow, sqlx::Decode)]
 pub struct ConcurrencySettings {
     #[serde(skip_serializing_if = "Option::is_none")]
     pub concurrency_key: Option<String>,
@@ -105,7 +103,65 @@ pub struct ConcurrencySettings {
     pub concurrency_time_window_s: Option<i32>,
 }
 
-#[derive(Debug, Clone, Serialize, Deserialize, sqlx::FromRow, Default)]
+/// Shared normalization for the positive-only `Option<i32>` runnable settings
+/// (`concurrent_limit`, `timeout`, ...): a `<= 0` value is never meaningful — zero
+/// concurrent slots permanently blocks a runnable at the concurrency gate (a re-queue
+/// storm the zombie monitor eventually fails with a misleading OOM error), and a
+/// 0-second timeout kills every job on the spot. The frontend already treats `0` as
+/// "disabled", so `<= 0` maps to `None` (unset) everywhere. Idempotent.
+pub fn none_if_non_positive(v: Option<i32>) -> Option<i32> {
+    v.filter(|n| *n > 0)
+}
+
+/// Coerce a `concurrent_limit <= 0` to disabled, dropping the now-meaningless time window
+/// alongside it. Idempotent.
+fn normalize_concurrency(
+    concurrent_limit: &mut Option<i32>,
+    concurrency_time_window_s: &mut Option<i32>,
+) {
+    if none_if_non_positive(*concurrent_limit).is_none() {
+        *concurrent_limit = None;
+        *concurrency_time_window_s = None;
+    }
+}
+
+impl ConcurrencySettings {
+    pub fn normalized(mut self) -> Self {
+        normalize_concurrency(
+            &mut self.concurrent_limit,
+            &mut self.concurrency_time_window_s,
+        );
+        self
+    }
+}
+
+// Manual `Deserialize` so every ingestion path (script/flow create & update, app and
+// http-trigger payloads, and read-back of already-stored settings) normalizes a `<= 0`
+// limit uniformly, without each call site remembering to call `normalized()`.
+impl<'de> Deserialize<'de> for ConcurrencySettings {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: serde::Deserializer<'de>,
+    {
+        #[derive(Deserialize)]
+        struct Raw {
+            #[serde(default)]
+            concurrency_key: Option<String>,
+            #[serde(default)]
+            concurrent_limit: Option<i32>,
+            #[serde(default)]
+            concurrency_time_window_s: Option<i32>,
+        }
+        let Raw { concurrency_key, concurrent_limit, concurrency_time_window_s } =
+            Raw::deserialize(deserializer)?;
+        Ok(
+            ConcurrencySettings { concurrency_key, concurrent_limit, concurrency_time_window_s }
+                .normalized(),
+        )
+    }
+}
+
+#[derive(Debug, Clone, Serialize, sqlx::FromRow, Default)]
 pub struct ConcurrencySettingsWithCustom {
     #[serde(skip_serializing_if = "Option::is_none")]
     pub custom_concurrency_key: Option<String>,
@@ -115,6 +171,41 @@ pub struct ConcurrencySettingsWithCustom {
     pub concurrency_time_window_s: Option<i32>,
 }
 
+impl ConcurrencySettingsWithCustom {
+    pub fn normalized(mut self) -> Self {
+        normalize_concurrency(
+            &mut self.concurrent_limit,
+            &mut self.concurrency_time_window_s,
+        );
+        self
+    }
+}
+
+impl<'de> Deserialize<'de> for ConcurrencySettingsWithCustom {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: serde::Deserializer<'de>,
+    {
+        #[derive(Deserialize)]
+        struct Raw {
+            #[serde(default)]
+            custom_concurrency_key: Option<String>,
+            #[serde(default)]
+            concurrent_limit: Option<i32>,
+            #[serde(default)]
+            concurrency_time_window_s: Option<i32>,
+        }
+        let Raw { custom_concurrency_key, concurrent_limit, concurrency_time_window_s } =
+            Raw::deserialize(deserializer)?;
+        Ok(ConcurrencySettingsWithCustom {
+            custom_concurrency_key,
+            concurrent_limit,
+            concurrency_time_window_s,
+        }
+        .normalized())
+    }
+}
+
 impl DebouncingSettings {
     pub fn maybe_fallback(
         self,
@@ -142,11 +233,15 @@ impl ConcurrencySettings {
         concurrent_limit: Option<i32>,
         concurrency_time_window_s: Option<i32>,
     ) -> Self {
+        // Legacy columns can still hold a stored `0` that predates ingestion normalization,
+        // so re-normalize here: this is the single load boundary for every DB-backed read
+        // (script/schedule read, flow value, and the worker pull path).
         Self {
             concurrency_key: self.concurrency_key.or(concurrency_key),
             concurrent_limit: self.concurrent_limit.or(concurrent_limit),
             concurrency_time_window_s: self.concurrency_time_window_s.or(concurrency_time_window_s),
         }
+        .normalized()
     }
 }
 
@@ -229,4 +324,91 @@ mod tests {
         assert_eq!(r, Retry::default());
         assert_eq!(r.exponential.multiplier, 1);
     }
+
+    // The positive-only settings share one rule: `<= 0` means "unset". This is what keeps a
+    // stored `0` from being enforced as a zero-slot cap or a 0-second timeout.
+    #[test]
+    fn none_if_non_positive_coerces_zero_and_negative() {
+        assert_eq!(none_if_non_positive(Some(0)), None);
+        assert_eq!(none_if_non_positive(Some(-3)), None);
+        assert_eq!(none_if_non_positive(Some(1)), Some(1));
+        assert_eq!(none_if_non_positive(Some(i32::MAX)), Some(i32::MAX));
+        assert_eq!(none_if_non_positive(None), None);
+    }
+
+    // Ingestion path (scripts flatten this on `NewScript`, flows on `FlowModule`): a `0`
+    // concurrent_limit deserializes to disabled and drops the now-meaningless time window,
+    // while a real limit and its window survive untouched.
+    #[test]
+    fn concurrency_settings_deserialize_normalizes_non_positive_limit() {
+        let zero: ConcurrencySettings = serde_json::from_value(
+            serde_json::json!({"concurrent_limit": 0, "concurrency_time_window_s": 30}),
+        )
+        .unwrap();
+        assert_eq!(zero.concurrent_limit, None);
+        assert_eq!(zero.concurrency_time_window_s, None);
+
+        let negative: ConcurrencySettings =
+            serde_json::from_value(serde_json::json!({"concurrent_limit": -1})).unwrap();
+        assert_eq!(negative.concurrent_limit, None);
+
+        let real: ConcurrencySettings = serde_json::from_value(
+            serde_json::json!({"concurrent_limit": 2, "concurrency_time_window_s": 30}),
+        )
+        .unwrap();
+        assert_eq!(real.concurrent_limit, Some(2));
+        assert_eq!(real.concurrency_time_window_s, Some(30));
+    }
+
+    // Per-flow-step overrides use the `custom_concurrency_key` variant; same rule.
+    #[test]
+    fn concurrency_settings_with_custom_deserialize_normalizes() {
+        let zero: ConcurrencySettingsWithCustom = serde_json::from_value(
+            serde_json::json!({"concurrent_limit": 0, "concurrency_time_window_s": 5}),
+        )
+        .unwrap();
+        assert_eq!(zero.concurrent_limit, None);
+        assert_eq!(zero.concurrency_time_window_s, None);
+    }
+
+    // A normalized value serializes with the limit omitted (skip_serializing_if), matching the
+    // frontend's "disabled" representation instead of re-emitting a `0`.
+    #[test]
+    fn normalized_disabled_limit_serializes_as_omitted() {
+        let s =
+            ConcurrencySettings { concurrent_limit: Some(0), ..Default::default() }.normalized();
+        let json = serde_json::to_value(&s).unwrap();
+        assert!(json.get("concurrent_limit").is_none());
+    }
+
+    // Runtime load boundary: legacy rows still hold a raw `0` in the fallback columns. The
+    // fallback must not resurrect it as an active limit.
+    #[test]
+    fn maybe_fallback_normalizes_legacy_zero_column() {
+        let merged = ConcurrencySettings::default().maybe_fallback(None, Some(0), Some(30));
+        assert_eq!(merged.concurrent_limit, None);
+        assert_eq!(merged.concurrency_time_window_s, None);
+    }
+
+    // `NewScript`/`FlowModule` embed the settings via `#[serde(flatten)]`, which drives the
+    // manual Deserialize through a content-buffer deserializer rather than a plain map. Guard
+    // that path: normalization must still fire and sibling fields must still parse.
+    #[test]
+    fn flattened_concurrency_normalizes_and_preserves_siblings() {
+        #[derive(Deserialize)]
+        struct Wrapper {
+            name: String,
+            #[serde(flatten)]
+            concurrency: ConcurrencySettings,
+        }
+        let w: Wrapper = serde_json::from_value(serde_json::json!({
+            "name": "s",
+            "concurrent_limit": 0,
+            "concurrency_time_window_s": 42,
+        }))
+        .unwrap();
+        assert_eq!(w.name, "s");
+        assert_eq!(w.concurrency.concurrent_limit, None);
+        assert_eq!(w.concurrency.concurrency_time_window_s, None);
+    }
 }
diff --git a/backend/windmill-worker/src/common.rs b/backend/windmill-worker/src/common.rs
index 6618ac7906..a406f3610c 100644
--- a/backend/windmill-worker/src/common.rs
+++ b/backend/windmill-worker/src/common.rs
@@ -1081,7 +1081,9 @@ pub async fn resolve_job_timeout(
         *MAX_TIMEOUT_DURATION
     };
 
-    match custom_timeout_secs {
+    // A `custom_timeout_secs <= 0` is not a 0-second limit but "unset": fall through to the
+    // default/global-max timeout instead of killing the job immediately.
+    match windmill_common::runnable_settings::none_if_non_positive(custom_timeout_secs) {
         Some(timeout_secs)
             if Duration::from_secs(timeout_secs as u64) < global_max_timeout_duration =>
         {
diff --git a/backend/windmill-worker/src/worker.rs b/backend/windmill-worker/src/worker.rs
index 1b11d735c3..003ddd3876 100644
--- a/backend/windmill-worker/src/worker.rs
+++ b/backend/windmill-worker/src/worker.rs
@@ -3892,15 +3892,16 @@ pub async fn handle_queued_job(
 
         #[cfg(not(feature = "enterprise"))]
         if let Connection::Sql(db) = conn {
-            if (job.concurrent_limit.is_some()
-                || windmill_common::runnable_settings::prefetch_cached_from_handle(
-                    job.runnable_settings_handle,
-                    db,
-                )
-                .await?
-                .1
-                .concurrent_limit
-                .is_some())
+            if (windmill_queue::jobs::has_active_concurrency_limit(job.concurrent_limit)
+                || windmill_queue::jobs::has_active_concurrency_limit(
+                    windmill_common::runnable_settings::prefetch_cached_from_handle(
+                        job.runnable_settings_handle,
+                        db,
+                    )
+                    .await?
+                    .1
+                    .concurrent_limit,
+                ))
                 && !job.kind.is_dependency()
             {
                 logs.push_str("---\n");
diff --git a/backend/windmill-worker/src/worker_flow.rs b/backend/windmill-worker/src/worker_flow.rs
index d2e5b20a1d..0793aff053 100644
--- a/backend/windmill-worker/src/worker_flow.rs
+++ b/backend/windmill-worker/src/worker_flow.rs
@@ -1525,9 +1525,14 @@ pub async fn update_flow_status_after_job_completion_internal(
             let concurrency_key = tag_and_concurrency_key
                 .as_ref()
                 .and_then(|x| x.concurrency_key.clone());
-            let concurrent_limit = tag_and_concurrency_key
-                .as_ref()
-                .and_then(|x| x.concurrent_limit);
+            // `concurrent_limit` here can come straight from the raw flow JSON (see
+            // get_tag_and_concurrency), bypassing the ConcurrencySettings deserialization guard,
+            // so a stored `0` must still be coerced to disabled before we register a key for it.
+            let concurrent_limit = windmill_common::runnable_settings::none_if_non_positive(
+                tag_and_concurrency_key
+                    .as_ref()
+                    .and_then(|x| x.concurrent_limit),
+            );
             let concurrency_time_window_s = tag_and_concurrency_key
                 .as_ref()
                 .and_then(|x| x.concurrency_time_window_s);
@@ -4389,13 +4394,10 @@ async fn push_next_flow_job(
             )
             .await?;
 
-            if timeout_value < 0 {
-                return Err(Error::ExecutionErr(
-                    "Timeout value cannot be negative".to_string(),
-                ));
-            }
-
-            Some(timeout_value)
+            // A `<= 0` step timeout (including a negative eval) means "no override": fall back
+            // to the referenced runnable's own timeout rather than a 0-second/negative timeout
+            // that would kill the step instantly.
+            effective_flow_step_timeout(Some(timeout_value), payload_tag.timeout)
         } else {
             payload_tag.timeout
         };
@@ -6048,6 +6050,18 @@ async fn flow_to_payload(
     })
 }
 
+/// Effective timeout for a flow step given the module's (already-evaluated) timeout override and
+/// the timeout inherited from the referenced runnable. A `<= 0` override — or none — means "no
+/// override": fall back to the inherited value (which is itself `None` when unset, i.e. the
+/// instance default). A positive override wins. This keeps a step `timeout: 0` equivalent to an
+/// omitted one rather than a 0-second, instant-kill timeout.
+pub(crate) fn effective_flow_step_timeout(
+    module_override: Option<i32>,
+    inherited: Option<i32>,
+) -> Option<i32> {
+    windmill_common::runnable_settings::none_if_non_positive(module_override).or(inherited)
+}
+
 pub async fn script_to_payload(
     script_hash: Option<windmill_common::scripts::ScriptHash>,
     script_path: String,
@@ -6137,11 +6151,13 @@ pub async fn script_to_payload(
         module.delete_after_use.unwrap_or(false) || delete_after_use.unwrap_or(false);
     let final_delete_after_secs = module.delete_after_secs.or(delete_after_secs);
 
-    let flow_step_timeout = if module.timeout.is_some() {
-        None
-    } else {
-        script_timeout
-    };
+    // Always carry the referenced script's own timeout as the inherited fallback. The module's
+    // timeout override (if any) is selected at the push site, where a `<= 0` override is treated
+    // as "no override" and falls back to this value — so `timeout: 0` on a step means "use the
+    // script's timeout", not a 0-second (immediate-kill) timeout. Normalize the inherited value
+    // too, so a legacy `0` script timeout resolves to the default rather than a zero-second kill.
+    let flow_step_timeout =
+        windmill_common::runnable_settings::none_if_non_positive(script_timeout);
     Ok(JobPayloadWithTag {
         payload,
         tag,
@@ -6266,9 +6282,25 @@ pub async fn get_previous_job_result(
 
 #[cfg(test)]
 mod tests {
-    use super::extract_chat_message_from_flow_result;
+    use super::{effective_flow_step_timeout, extract_chat_message_from_flow_result};
     use serde_json::{json, value::to_raw_value};
 
+    // A `<= 0` step timeout override must behave as "no override" and inherit the referenced
+    // script's timeout, not collapse to a 0-second (instant-kill) timeout. A positive override
+    // still wins. Guards the flow-step timeout footgun.
+    #[test]
+    fn flow_step_timeout_zero_or_negative_inherits_script_timeout() {
+        // zero / negative override -> inherited script timeout
+        assert_eq!(effective_flow_step_timeout(Some(0), Some(300)), Some(300));
+        assert_eq!(effective_flow_step_timeout(Some(-5), Some(300)), Some(300));
+        // no inherited timeout either -> None (falls through to the instance default)
+        assert_eq!(effective_flow_step_timeout(Some(0), None), None);
+        // positive override wins over the inherited value
+        assert_eq!(effective_flow_step_timeout(Some(120), Some(300)), Some(120));
+        // no override -> inherited
+        assert_eq!(effective_flow_step_timeout(None, Some(300)), Some(300));
+    }
+
     #[test]
     fn pretty_prints_full_result_when_no_override_is_present() {
         let value = json!({
diff --git a/cli/src/commands/script/script.ts b/cli/src/commands/script/script.ts
index 3db9c7b53e..82fe63719b 100644
--- a/cli/src/commands/script/script.ts
+++ b/cli/src/commands/script/script.ts
@@ -100,6 +100,30 @@ export function isRawAppBackendPath(filePath: string): boolean {
   return isRawAppBackendPathInternal(filePath);
 }
 
+/**
+ * The positive-only runnable settings (concurrent_limit, timeout, ...) treat any `<= 0`
+ * value as "unset": the backend coerces it to null (a 0-slot concurrency limit bricks the
+ * runnable, a 0s timeout kills every run). Coerce to undefined so it is serialized as
+ * omitted, never as 0, and redeploys don't churn against the backend-normalized value.
+ */
+export function nonePositiveInt(
+  v: number | undefined | null
+): number | undefined {
+  return v != null && v > 0 ? v : undefined;
+}
+
+/**
+ * Normalize a concurrent_limit + its time window together: when the limit is disabled
+ * (<= 0) the window is dropped too. Returns [concurrent_limit, concurrency_time_window_s].
+ */
+export function normalizeConcurrency(
+  concurrentLimit: number | undefined | null,
+  concurrencyTimeWindowS?: number | undefined | null
+): [number | undefined, number | undefined] {
+  const limit = nonePositiveInt(concurrentLimit);
+  return limit === undefined ? [undefined, undefined] : [limit, concurrencyTimeWindowS ?? undefined];
+}
+
 /**
  * Checks if a path is inside a normal app folder (inline script).
  * Matches patterns like: .../myApp.app/... or .../myApp__app/...
@@ -469,6 +493,15 @@ export async function handleFile(
     const moduleFolderPath = scriptBasePath + getModuleFolderSuffix();
     const modules = await readModulesFromDisk(moduleFolderPath, opts?.defaultTs, moduleEntryPoint);
 
+    // A concurrent_limit of <= 0 means "concurrency disabled", not "zero slots" (which
+    // would brick the runnable at the queue's concurrency gate). Emit it as omitted rather
+    // than 0 so a redeploy never re-persists a zero-slot limit, and drop the now-meaningless
+    // time window alongside it. Mirrors the backend's ConcurrencySettings::normalized.
+    const [normConcurrentLimit, normConcurrencyTimeWindowS] = normalizeConcurrency(
+      typed?.concurrent_limit,
+      typed?.concurrency_time_window_s
+    );
+
     const requestBodyCommon: NewScript = {
       content,
       description: typed?.description ?? "",
@@ -482,8 +515,8 @@ export async function handleFile(
       ws_error_handler_muted: typed?.ws_error_handler_muted,
       dedicated_worker: typed?.dedicated_worker,
       cache_ttl: typed?.cache_ttl,
-      concurrency_time_window_s: typed?.concurrency_time_window_s,
-      concurrent_limit: typed?.concurrent_limit,
+      concurrency_time_window_s: normConcurrencyTimeWindowS,
+      concurrent_limit: normConcurrentLimit,
       deployment_message: message,
       restart_unless_cancelled: typed?.restart_unless_cancelled,
       visible_to_runner_only: typed?.visible_to_runner_only,
@@ -493,7 +526,7 @@ export async function handleFile(
       debounce_key: typed?.debounce_key,
       debounce_delay_s: typed?.debounce_delay_s,
       codebase: await codebase?.getDigest(forceTar),
-      timeout: typed?.timeout,
+      timeout: nonePositiveInt(typed?.timeout),
       on_behalf_of_email: typed?.on_behalf_of_email,
       envs: typed?.envs,
       modules: modules,
@@ -530,9 +563,13 @@ export async function handleFile(
               remote.ws_error_handler_muted &&
             typed.dedicated_worker == remote.dedicated_worker &&
             typed.cache_ttl == remote.cache_ttl &&
-            typed.concurrency_time_window_s ==
-              remote.concurrency_time_window_s &&
-            typed.concurrent_limit == remote.concurrent_limit &&
+            normConcurrencyTimeWindowS ==
+              normalizeConcurrency(
+                remote.concurrent_limit,
+                remote.concurrency_time_window_s
+              )[1] &&
+            normConcurrentLimit ==
+              normalizeConcurrency(remote.concurrent_limit)[0] &&
             Boolean(typed.restart_unless_cancelled) ==
               Boolean(remote.restart_unless_cancelled) &&
             Boolean(typed.visible_to_runner_only) ==
@@ -540,7 +577,7 @@ export async function handleFile(
             Boolean(typed.has_preprocessor) ==
               Boolean(remote.has_preprocessor) &&
             typed.priority == Boolean(remote.priority) &&
-            typed.timeout == remote.timeout &&
+            nonePositiveInt(typed.timeout) == nonePositiveInt(remote.timeout) &&
             //@ts-ignore
             typed.concurrency_key == remote["concurrency_key"] &&
             typed.debounce_key == remote["debounce_key"] &&

From f02df7fc454b0c2a2afa9ae9848e26af0e379246 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Thu, 23 Jul 2026 19:09:28 +0200
Subject: [PATCH 142/171] feat(monitor): make between-steps zombie flows
 hand-recoverable (#10287)

* feat(monitor): make between-steps zombie flows hand-recoverable

When a worker is OOM-killed mid state-transition, the flow is reaped as a
between-steps zombie (children all success, module still InProgress). We do
not auto-recover (a re-driven transition can OOM again), so instead:

- Append actionable recovery guidance to the cancellation reason when the
  reaped step's state is derivable (every child a success completion): which
  step, iterations completed, raise memory then restart-from-step (UI + API).
- Restart-from-step now reuses a zombie step verbatim (InProgress with all
  children successful) and restarts from the next step, so no completed child
  re-runs; downstream steps re-derive its result from flow_jobs on demand.
- Cast flow_status ::text in the reaper query: reading the jsonb column as
  Box<str> included the binary version byte and silently failed FlowStatus
  parsing (disabling the restart-not-yet-started branch since the v2 migration).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(monitor): only reuse a between-steps zombie step that provably finished

Address review findings on the zombie-restart reuse path:

- Require structural completeness (FlowStatusModule::is_between_steps_complete):
  a serial for-loop / branch-all reaped mid-fan-out has an all-success prefix but
  unrun remaining iterations, so the cursor must sit on the last element; while-loops
  are never derivable (continuation is a post-iteration condition). Parallel
  containers preallocate all children, so success alone is conclusive. Shared by the
  monitor guidance and the restart resolution.
- Decline reuse when the step carries stop_after_if / stop_after_all_iters_if: those
  predicates decide whether downstream steps run, and reuse would bypass them; such a
  step re-runs instead.
- Decline reuse when the zombie step is the last module (advancing past it lands on
  the failure step); it falls back to the existing re-run path.
- Unit tests for is_between_steps_complete and an integration test asserting a
  mid-iteration serial-loop zombie is re-run, not reused.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(monitor): align zombie recovery guidance with restart eligibility

Address CI review findings:

- Exclude skip_if / suspend / sleep (not just stop predicates) from reuse via
  FlowModule::allows_zombie_reuse, so a skipped/suspend-armed step is never
  synthesized as Success (which would strand a restart waiting on an approval it
  never armed).
- The reaper does not load the flow definition, so it cannot know whether restart
  will reuse or re-run a given step; reword the guidance to state both outcomes
  (reuse where derivable, re-run for the flow's last step or one carrying a
  stop/skip condition, approval, or sleep) instead of promising "no re-run".
- Make the mid-iteration regression test exercise the cursor-completeness guard:
  a downstream step makes the loop non-final, so reuse is prevented only by the
  guard; a truncated loop result would then fail the assertion.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(monitor): never let zombie reuse swallow a nested restart request

A nested restart (RestartedFrom.nested) descends into the restart step's child to
re-run an inner step. For an eligible zombie BranchOne/Subflow the outer
branch_or_iteration_n is None, so reuse fired, skipped the container, and the
explicitly requested inner step never re-ran. Thread the presence of a nested
chain into restarted_flows_resolution and decline reuse when set. Regression test
added (RED without the guard: the nested target is reused instead of re-run).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(monitor): don't auto-requeue preprocessor zombies as unstarted flows

The ::text parse fix re-activated the "hasn't started yet, restart it" branch,
but its `modules[0] == WaitingForPriorSteps` check also matches a flow whose
preprocessor is still InProgress (step == -1, first module waiting). Requeuing
such a flow re-runs the preprocessor, duplicating side effects / repeating the
OOM. Gate the branch on FlowStatus::is_not_yet_started, which also requires the
preprocessor (if any) to be WaitingForPriorSteps. Unit-tested.

Also drop the numbered procedural narration from the happy-path test comments.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(monitor): only emit restart guidance for restartable (deployed, top-level) flows

The recovery guidance points operators at the run page's "Re-start from" button
and the restart API, but both require a top-level deployed flow: a preview has no
flow path (the button is hidden, the API 400s) and a subflow child restarts via
its root, not itself. Gate the guidance on runnable_path IS NOT NULL AND
parent_job IS NULL so previews/subflows keep the existing wording instead of
being told to use a button/endpoint that isn't there. Verified end-to-end: a
reaped preview gets no RECOVERY block, a reaped deployed flow does.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(monitor): gate recovery guidance on kind='flow' to match the restart surface

Addresses review nit: a pathful editor preview (kind='flowpreview' with a
runnable_path) satisfied the previous runnable_path check but the run page only
renders the "Re-start from" button for kind='flow'. Match that condition exactly
so previews/singlestepflow keep the plain wording. Verified end-to-end: a reaped
pathful preview now gets no RECOVERY block.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(monitor): disable zombie reuse for raw-flow (editor preview) restarts

A JobPayload::RawFlow restart queues the request's current, possibly EDITED,
definition, but restarted_flows_resolution validates reuse against the completed
job's STORED definition. For an eligible preview zombie, editing the restart step
and restarting from it would synthesize Success from the old children and skip the
edit. Thread allow_zombie_reuse into the resolver (true only for
JobPayload::RestartedFlow, which queues the stored definition) and decline reuse
for raw-flow restarts. Regression test added (RED without the guard: the edited
step is skipped and the old result is reused).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore(sqlx): add offline cache for zombie_flow_recovery test queries

The integration test's UPDATE v2_job_completed queries had no .sqlx entry, so the
CI SQLX_OFFLINE build of the test failed to compile. Regenerated with
--all-targets --features deno_core,quickjs to capture the test-target queries.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* test(monitor): drop procedural narration from the raw-flow zombie test

Per AGENTS.md (comments record constraints, not narration): remove the two
step-describing comments the reviewer flagged; the test doc comment already
carries the durable rationale.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(monitor): restrict zombie reuse to monitor-reaped flows

The reuse predicate matched the InProgress/all-children-success shape without
checking provenance, so an ordinary force-cancel at the same boundary (a child
succeeded before its parent transition landed) would also be reused, dropping
the usual restart-from-step re-run. Gate reuse on canceled_by = 'monitor' (the
username the zombie reaper cancels with). Regression test added (RED without the
guard: a user-cancelled flow reuses the child instead of re-running it).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(monitor): reuse zombie step on Some(0) too, so the run-page button works

The run page's "Re-start from" button always sends branch_or_iteration_n = 0
(never omits it), but reuse only fired for None, so the exact UI path the
recovery message points to would re-run the children instead of reusing them.
Treat a whole-step restart (None or Some(0)) as reuse-eligible; Some(n>=1) keeps
the explicit partial-container restart. Verified against the live EE restart API
with branch_or_iteration_n=0: all loop-iteration child UUIDs are reused. Happy-
path test now sends Some(0) to match the button.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 ...291f4ff5c979be956369fa4406d789cca92fc.json | 112 +++
 ...9dd4864f4e0aa0093df47df7d444ee748dbb2.json |  23 +
 ...e8a4b96c9629cdc785edc7a389c3eb7269608.json |  22 +
 ...9d4c24699c2c7abad4086e0bb876c5c6b2c38.json |  15 +
 ...31fe94999ca4f11934fbab4638b2653a678dc.json |  15 +
 ...7e00942a8f4f5251502ef8efc0f510a857551.json |  15 +
 ...8e375d93caf76c4cec362c2b92d2a7b8704a2.json |  83 +++
 backend/src/monitor.rs                        | 119 +++-
 backend/tests/zombie_flow_recovery.rs         | 661 ++++++++++++++++++
 backend/windmill-queue/src/jobs.rs            | 130 +++-
 backend/windmill-types/src/flow_status.rs     | 154 ++++
 backend/windmill-types/src/flows.rs           |  13 +
 12 files changed, 1352 insertions(+), 10 deletions(-)
 create mode 100644 backend/.sqlx/query-1bf87fe9667f860c6089bffb803291f4ff5c979be956369fa4406d789cca92fc.json
 create mode 100644 backend/.sqlx/query-387e135bf363533089493c35eb39dd4864f4e0aa0093df47df7d444ee748dbb2.json
 create mode 100644 backend/.sqlx/query-4371e59b85cc279dba03800aacde8a4b96c9629cdc785edc7a389c3eb7269608.json
 create mode 100644 backend/.sqlx/query-4a35f9a0201e283d854bd77f7f79d4c24699c2c7abad4086e0bb876c5c6b2c38.json
 create mode 100644 backend/.sqlx/query-60201b41a0bfea89a201a25ae2431fe94999ca4f11934fbab4638b2653a678dc.json
 create mode 100644 backend/.sqlx/query-7d2923f940cf5a8cbbdc51de91c7e00942a8f4f5251502ef8efc0f510a857551.json
 create mode 100644 backend/.sqlx/query-fa1b9fcdd344fa2c88a187f4a558e375d93caf76c4cec362c2b92d2a7b8704a2.json
 create mode 100644 backend/tests/zombie_flow_recovery.rs

diff --git a/backend/.sqlx/query-1bf87fe9667f860c6089bffb803291f4ff5c979be956369fa4406d789cca92fc.json b/backend/.sqlx/query-1bf87fe9667f860c6089bffb803291f4ff5c979be956369fa4406d789cca92fc.json
new file mode 100644
index 0000000000..1ee774a993
--- /dev/null
+++ b/backend/.sqlx/query-1bf87fe9667f860c6089bffb803291f4ff5c979be956369fa4406d789cca92fc.json
@@ -0,0 +1,112 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        SELECT\n            j.id AS \"id!\", j.workspace_id AS \"workspace_id!\", j.parent_job, j.flow_step_id IS NOT NULL AS \"is_flow_step?\",\n            COALESCE(s.flow_status, s.workflow_as_code_status)::text AS \"flow_status: Box<str>\", r.ping AS last_ping, j.same_worker AS \"same_worker?\",\n            q.worker AS \"worker?\",\n            wp.ping_at AS \"worker_last_ping?\",\n            wp.memory_usage AS \"worker_memory_usage?\",\n            wp.wm_memory_usage AS \"worker_wm_memory_usage?\",\n            wp.memory AS \"worker_memory_total?\",\n            wp.worker_group AS \"worker_group?\",\n            wp.wm_version AS \"worker_version?\",\n            wp.current_job_id AS \"worker_current_job_id?\",\n            wp.worker_instance AS \"worker_instance?\"\n        FROM v2_job_queue q JOIN v2_job j USING (id) LEFT JOIN v2_job_runtime r USING (id) LEFT JOIN v2_job_status s USING (id)\n            LEFT JOIN worker_ping wp ON wp.worker = q.worker\n        WHERE q.running = true AND q.suspend = 0 AND q.suspend_until IS null AND q.scheduled_for <= now()\n            AND (j.kind = 'flow' OR j.kind = 'flowpreview' OR j.kind = 'flownode' OR j.kind = 'singlestepflow')\n            AND r.ping IS NOT NULL AND r.ping < NOW() - ($1 || ' seconds')::interval\n            AND q.canceled_by IS NULL\n\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id!",
+        "type_info": "Uuid"
+      },
+      {
+        "ordinal": 1,
+        "name": "workspace_id!",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "parent_job",
+        "type_info": "Uuid"
+      },
+      {
+        "ordinal": 3,
+        "name": "is_flow_step?",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 4,
+        "name": "flow_status: Box<str>",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 5,
+        "name": "last_ping",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 6,
+        "name": "same_worker?",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 7,
+        "name": "worker?",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 8,
+        "name": "worker_last_ping?",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 9,
+        "name": "worker_memory_usage?",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 10,
+        "name": "worker_wm_memory_usage?",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 11,
+        "name": "worker_memory_total?",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 12,
+        "name": "worker_group?",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 13,
+        "name": "worker_version?",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 14,
+        "name": "worker_current_job_id?",
+        "type_info": "Uuid"
+      },
+      {
+        "ordinal": 15,
+        "name": "worker_instance?",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      true,
+      null,
+      null,
+      true,
+      false,
+      true,
+      false,
+      true,
+      true,
+      true,
+      false,
+      false,
+      true,
+      false
+    ]
+  },
+  "hash": "1bf87fe9667f860c6089bffb803291f4ff5c979be956369fa4406d789cca92fc"
+}
diff --git a/backend/.sqlx/query-387e135bf363533089493c35eb39dd4864f4e0aa0093df47df7d444ee748dbb2.json b/backend/.sqlx/query-387e135bf363533089493c35eb39dd4864f4e0aa0093df47df7d444ee748dbb2.json
new file mode 100644
index 0000000000..50f0bf86e5
--- /dev/null
+++ b/backend/.sqlx/query-387e135bf363533089493c35eb39dd4864f4e0aa0093df47df7d444ee748dbb2.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT count(*) FROM v2_job_completed\n         WHERE workspace_id = $1 AND id = ANY($2) AND status = 'success'",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "count",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "UuidArray"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "387e135bf363533089493c35eb39dd4864f4e0aa0093df47df7d444ee748dbb2"
+}
diff --git a/backend/.sqlx/query-4371e59b85cc279dba03800aacde8a4b96c9629cdc785edc7a389c3eb7269608.json b/backend/.sqlx/query-4371e59b85cc279dba03800aacde8a4b96c9629cdc785edc7a389c3eb7269608.json
new file mode 100644
index 0000000000..4bf6f3692b
--- /dev/null
+++ b/backend/.sqlx/query-4371e59b85cc279dba03800aacde8a4b96c9629cdc785edc7a389c3eb7269608.json
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT (kind = 'flow' AND parent_job IS NULL) AS \"restartable!\"\n           FROM v2_job WHERE id = $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "restartable!",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "4371e59b85cc279dba03800aacde8a4b96c9629cdc785edc7a389c3eb7269608"
+}
diff --git a/backend/.sqlx/query-4a35f9a0201e283d854bd77f7f79d4c24699c2c7abad4086e0bb876c5c6b2c38.json b/backend/.sqlx/query-4a35f9a0201e283d854bd77f7f79d4c24699c2c7abad4086e0bb876c5c6b2c38.json
new file mode 100644
index 0000000000..6c5b364a5b
--- /dev/null
+++ b/backend/.sqlx/query-4a35f9a0201e283d854bd77f7f79d4c24699c2c7abad4086e0bb876c5c6b2c38.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE v2_job_completed SET status = 'canceled', canceled_by = 'monitor',\n         flow_status = $2 WHERE id = $1",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Jsonb"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "4a35f9a0201e283d854bd77f7f79d4c24699c2c7abad4086e0bb876c5c6b2c38"
+}
diff --git a/backend/.sqlx/query-60201b41a0bfea89a201a25ae2431fe94999ca4f11934fbab4638b2653a678dc.json b/backend/.sqlx/query-60201b41a0bfea89a201a25ae2431fe94999ca4f11934fbab4638b2653a678dc.json
new file mode 100644
index 0000000000..9f4c0f9bf6
--- /dev/null
+++ b/backend/.sqlx/query-60201b41a0bfea89a201a25ae2431fe94999ca4f11934fbab4638b2653a678dc.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE v2_job_completed SET status = 'canceled', canceled_by = 'admin',\n         flow_status = $2 WHERE id = $1",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Jsonb"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "60201b41a0bfea89a201a25ae2431fe94999ca4f11934fbab4638b2653a678dc"
+}
diff --git a/backend/.sqlx/query-7d2923f940cf5a8cbbdc51de91c7e00942a8f4f5251502ef8efc0f510a857551.json b/backend/.sqlx/query-7d2923f940cf5a8cbbdc51de91c7e00942a8f4f5251502ef8efc0f510a857551.json
new file mode 100644
index 0000000000..7967a56868
--- /dev/null
+++ b/backend/.sqlx/query-7d2923f940cf5a8cbbdc51de91c7e00942a8f4f5251502ef8efc0f510a857551.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE v2_job_completed\n         SET status = 'canceled', canceled_by = 'monitor', canceled_reason = 'zombie flow',\n             flow_status = $2\n         WHERE id = $1",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Jsonb"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "7d2923f940cf5a8cbbdc51de91c7e00942a8f4f5251502ef8efc0f510a857551"
+}
diff --git a/backend/.sqlx/query-fa1b9fcdd344fa2c88a187f4a558e375d93caf76c4cec362c2b92d2a7b8704a2.json b/backend/.sqlx/query-fa1b9fcdd344fa2c88a187f4a558e375d93caf76c4cec362c2b92d2a7b8704a2.json
new file mode 100644
index 0000000000..0d9e4ac3ad
--- /dev/null
+++ b/backend/.sqlx/query-fa1b9fcdd344fa2c88a187f4a558e375d93caf76c4cec362c2b92d2a7b8704a2.json
@@ -0,0 +1,83 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT\n            j.runnable_path as script_path, j.runnable_id AS \"script_hash: ScriptHash\",\n            j.kind AS \"job_kind!: JobKind\", c.canceled_by,\n            COALESCE(c.flow_status, c.workflow_as_code_status) AS \"flow_status: Json<Box<RawValue>>\",\n            j.raw_flow AS \"raw_flow: Json<Box<RawValue>>\"\n        FROM v2_job_completed c JOIN v2_job j USING (id) WHERE j.id = $1 and j.workspace_id = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "script_path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "script_hash: ScriptHash",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 2,
+        "name": "job_kind!: JobKind",
+        "type_info": {
+          "Custom": {
+            "name": "job_kind",
+            "kind": {
+              "Enum": [
+                "script",
+                "preview",
+                "flow",
+                "dependencies",
+                "flowpreview",
+                "script_hub",
+                "identity",
+                "flowdependencies",
+                "http",
+                "graphql",
+                "postgresql",
+                "noop",
+                "appdependencies",
+                "deploymentcallback",
+                "singlestepflow",
+                "flowscript",
+                "flownode",
+                "appscript",
+                "aiagent",
+                "unassigned_script",
+                "unassigned_flow",
+                "unassigned_singlestepflow"
+              ]
+            }
+          }
+        }
+      },
+      {
+        "ordinal": 3,
+        "name": "canceled_by",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 4,
+        "name": "flow_status: Json<Box<RawValue>>",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 5,
+        "name": "raw_flow: Json<Box<RawValue>>",
+        "type_info": "Jsonb"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Text"
+      ]
+    },
+    "nullable": [
+      true,
+      true,
+      false,
+      true,
+      null,
+      true
+    ]
+  },
+  "hash": "fa1b9fcdd344fa2c88a187f4a558e375d93caf76c4cec362c2b92d2a7b8704a2"
+}
diff --git a/backend/src/monitor.rs b/backend/src/monitor.rs
index 4947b9b211..d1e63958e2 100644
--- a/backend/src/monitor.rs
+++ b/backend/src/monitor.rs
@@ -4946,11 +4946,13 @@ async fn find_zombie_flow_culprit_worker(
 }
 
 async fn handle_zombie_flows(db: &DB) -> error::Result<()> {
+    // flow_status is cast ::text on purpose: decoding the jsonb column directly as Box<str>
+    // yields its binary form (leading version byte) and fails serde_json parsing at column 1.
     let flows = sqlx::query!(
         r#"
         SELECT
             j.id AS "id!", j.workspace_id AS "workspace_id!", j.parent_job, j.flow_step_id IS NOT NULL AS "is_flow_step?",
-            COALESCE(s.flow_status, s.workflow_as_code_status) AS "flow_status: Box<str>", r.ping AS last_ping, j.same_worker AS "same_worker?",
+            COALESCE(s.flow_status, s.workflow_as_code_status)::text AS "flow_status: Box<str>", r.ping AS last_ping, j.same_worker AS "same_worker?",
             q.worker AS "worker?",
             wp.ping_at AS "worker_last_ping?",
             wp.memory_usage AS "worker_memory_usage?",
@@ -4979,11 +4981,7 @@ async fn handle_zombie_flows(db: &DB) -> error::Result<()> {
             .as_deref()
             .and_then(|x| serde_json::from_str::<FlowStatus>(x).ok());
         if !flow.same_worker.unwrap_or(false)
-            && status.is_some_and(|s| {
-                s.modules
-                    .get(0)
-                    .is_some_and(|x| matches!(x, FlowStatusModule::WaitingForPriorSteps { .. }))
-            })
+            && status.as_ref().is_some_and(|s| s.is_not_yet_started())
         {
             let error_message = format!(
                 "Zombie flow detected: {} in workspace {}. It hasn't started yet, restarting it.",
@@ -5294,6 +5292,18 @@ async fn handle_zombie_flows(db: &DB) -> error::Result<()> {
                     format!("Flow {id} ({base_url}/run/{id}?workspace={workspace_id}) was cancelled because it")
                 }
             );
+            let reason = match between_steps_recovery_guidance(
+                db,
+                status.as_ref(),
+                id,
+                &workspace_id,
+                &base_url,
+            )
+            .await
+            {
+                Some(guidance) => format!("{reason}\n\n{guidance}"),
+                None => reason,
+            };
             report_critical_error(reason.clone(), db.clone(), Some(&flow.workspace_id), None).await;
             cancel_zombie_flow_job(db, flow.id, &flow.workspace_id,
                 format!(r#"{reason}
@@ -5340,6 +5350,103 @@ Please check your worker logs for more details and feel free to report it to the
     Ok(())
 }
 
+/// When a between-steps zombie's stuck step has every child recorded as a
+/// `success` completion, the flow's state is fully derivable: only the final
+/// state transition was lost to the worker failure, not any real work. In that
+/// case return concrete restart-from-step recovery guidance to append to the
+/// cancellation reason / critical alert. Returns `None` when the state isn't
+/// derivable (some child missing or not successful), so the existing wording is
+/// left untouched. Auto-recovery is deliberately not attempted (a re-driven
+/// transition can OOM again on the same aggregated state; a human raises the
+/// memory limit first, then restarts).
+async fn between_steps_recovery_guidance(
+    db: &DB,
+    status: Option<&FlowStatus>,
+    flow_id: Uuid,
+    workspace_id: &str,
+    base_url: &str,
+) -> Option<String> {
+    // The stuck module is the current step, left InProgress because the
+    // transition that would have marked it Success was dropped. It is only
+    // derivable when its own cursor reached the end (a serial fan-out reaped
+    // mid-iteration has unrun work left; while-loops are never derivable). Whether
+    // restart reuses the children or re-runs the step (final step, or one carrying a
+    // stop/skip/approval/sleep) is decided by the restart path against the flow
+    // definition, which the reaper doesn't load; the guidance states both outcomes
+    // rather than promising reuse the restart might decline.
+    let status = status?;
+    let idx = usize::try_from(status.step).ok()?;
+    let module = status.modules.get(idx)?;
+    if !module.is_between_steps_complete() {
+        return None;
+    }
+    let step_id = module.id();
+
+    // Only a top-level deployed flow exposes a working restart-from-step: the run page's
+    // "Re-start from" button is rendered only for job_kind == 'flow' (a flowpreview, even a
+    // pathful editor preview, or a singlestepflow does not qualify), and a subflow child
+    // restarts via its root. Match that surface exactly so the guidance never points at a
+    // button / endpoint that isn't there; leave the existing wording otherwise.
+    let restartable = sqlx::query_scalar!(
+        r#"SELECT (kind = 'flow' AND parent_job IS NULL) AS "restartable!"
+           FROM v2_job WHERE id = $1"#,
+        flow_id,
+    )
+    .fetch_one(db)
+    .await
+    .ok()?;
+    if !restartable {
+        return None;
+    }
+
+    // Children whose completion the lost transition would have aggregated: the
+    // loop/branchall iterations, or the single leaf/subflow child.
+    let child_ids: Vec<Uuid> = module
+        .flow_jobs()
+        .filter(|v| !v.is_empty())
+        .or_else(|| module.job().map(|j| vec![j]))?;
+
+    // Derivable only when every child is recorded as a success completion.
+    let success_children = sqlx::query_scalar!(
+        "SELECT count(*) FROM v2_job_completed
+         WHERE workspace_id = $1 AND id = ANY($2) AND status = 'success'",
+        workspace_id,
+        &child_ids,
+    )
+    .fetch_one(db)
+    .await
+    .ok()?
+    .unwrap_or(0);
+    if success_children != child_ids.len() as i64 {
+        return None;
+    }
+    let n = child_ids.len();
+
+    // For loop/branchall, name the completed iteration/branch count so the
+    // operator can confirm the whole fan-out is intact.
+    let iteration_hint = match module {
+        FlowStatusModule::InProgress { iterator: Some(_), .. } => {
+            format!(" (loop step, all {n} iterations completed)")
+        }
+        FlowStatusModule::InProgress { branchall: Some(_), .. } => {
+            format!(" (branchall step, all {n} branches completed)")
+        }
+        _ => String::new(),
+    };
+
+    Some(format!(
+        "RECOVERY: all {n} child job(s) of step `{step_id}`{iteration_hint} completed successfully; \
+only the flow's final state transition was lost to the worker failure above (not any genuine failure), so \
+the completed work is intact. To recover: first change the failure condition (raise the worker memory limit, \
+e.g. k8s `resources.limits.memory`, or move the flow to a larger worker group), then restart from step \
+`{step_id}`. Restart replays only the dropped transition and reuses the completed children where the step's \
+result is fully derivable; a step that is the flow's last, or carries a stop/skip condition, an approval, or a \
+sleep, is re-run instead (re-evaluating those on the larger worker).\n\
+  UI:  open {base_url}/run/{flow_id}?workspace={workspace_id} and use \"Re-start from {step_id}\".\n\
+  API: POST {base_url}/api/w/{workspace_id}/jobs/restart/f/{flow_id} with body {{\"step_id\":\"{step_id}\"}}."
+    ))
+}
+
 async fn cancel_zombie_flow_job(
     db: &Pool<Postgres>,
     id: Uuid,
diff --git a/backend/tests/zombie_flow_recovery.rs b/backend/tests/zombie_flow_recovery.rs
new file mode 100644
index 0000000000..fb658dfb03
--- /dev/null
+++ b/backend/tests/zombie_flow_recovery.rs
@@ -0,0 +1,661 @@
+//! Regression test for hand-recovery of between-steps zombie flows.
+//!
+//! When a worker is OOM-killed mid state-transition, the zombie monitor
+//! (`handle_zombie_flows` → `cancel_job` with force) reaps the flow: it lands in
+//! `v2_job_completed` as `canceled`, with its `flow_status` preserved: the step
+//! whose transition was lost stays `InProgress` even though all its children
+//! completed successfully. This test reproduces that exact terminal state and
+//! asserts that a hand-restart from the stuck step reuses every completed child
+//! (no re-run) and the flow reaches success.
+//!
+//! The reaper itself lives in the `windmill` binary crate and is unreachable
+//! from an integration test, so we reproduce the state `cancel_job(force)`
+//! leaves behind directly; the fix under test is the restart-resolution path,
+//! not the detection query.
+
+#![cfg(feature = "deno_core")]
+
+use serde_json::json;
+use sqlx::{Pool, Postgres};
+use windmill_common::flow_status::{BranchChosen, FlowStatus, RestartedFrom};
+use windmill_common::flows::FlowValue;
+use windmill_common::jobs::JobPayload;
+use windmill_test_utils::*;
+
+/// Child job UUID for a top-level step in a completed flow's `flow_status`
+/// (optionally the iteration index for a ForLoop / BranchAll container).
+async fn child_job_id_for_step(
+    db: &Pool<Postgres>,
+    flow_job_id: uuid::Uuid,
+    step_id: &str,
+    iter: Option<usize>,
+) -> uuid::Uuid {
+    let raw: serde_json::Value = sqlx::query_scalar!(
+        "SELECT flow_status FROM v2_job_completed WHERE id = $1",
+        flow_job_id
+    )
+    .fetch_one(db)
+    .await
+    .unwrap()
+    .expect("flow_status missing");
+    let status: FlowStatus = serde_json::from_value(raw).expect("parse flow_status");
+    let module = status
+        .modules
+        .iter()
+        .find(|m| m.id() == step_id)
+        .expect("step in flow_status");
+    match iter {
+        Some(i) => module.flow_jobs().expect("flow_jobs")[i],
+        None => module.job().expect("job"),
+    }
+}
+
+/// A between-steps zombie whose fan-out completed but whose final transition was
+/// lost can be hand-restarted from the stuck step, reusing every completed child
+/// (including the last iteration) and reaching success.
+#[sqlx::test(fixtures("base", "hello"))]
+async fn test_between_steps_zombie_restart_reuses_all_children(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    // A fan-out ForLoop `fanout` (2 iterations) followed by `after`, which
+    // consumes the loop's aggregated result. In the zombie scenario `fanout`
+    // finished all iterations but its final transition was lost, so `after`
+    // never ran.
+    let flow_value: FlowValue = serde_json::from_value(json!({
+        "modules": [
+            {
+                "id": "fanout",
+                "value": {
+                    "type": "forloopflow",
+                    "iterator": { "type": "javascript", "expr": "['a', 'b']" },
+                    "skip_failures": false,
+                    "parallel": false,
+                    "modules": [{
+                        "id": "inner",
+                        "value": {
+                            "type": "rawscript",
+                            "language": "deno",
+                            "input_transforms": {
+                                "v": { "type": "javascript", "expr": "flow_input.iter.value" }
+                            },
+                            "content": "export function main(v: string) { return v }"
+                        }
+                    }]
+                }
+            },
+            {
+                "id": "after",
+                "value": {
+                    "type": "rawscript",
+                    "language": "deno",
+                    "input_transforms": {
+                        "loop_res": { "type": "javascript", "expr": "results.fanout" }
+                    },
+                    "content": "export function main(loop_res: string[]) { return loop_res.join(',') }"
+                }
+            }
+        ]
+    }))
+    .unwrap();
+
+    // Run to completion to obtain real, successful child jobs.
+    let full_run = RunJob::from(JobPayload::RawFlow {
+        value: flow_value.clone(),
+        path: None,
+        restarted_from: None,
+    })
+    .run_until_complete(&db, false, port)
+    .await;
+    assert!(full_run.success, "baseline run should succeed");
+    assert_eq!(full_run.json_result().unwrap(), json!("a,b"));
+
+    let orig_iter0 = child_job_id_for_step(&db, full_run.id, "fanout", Some(0)).await;
+    let orig_iter1 = child_job_id_for_step(&db, full_run.id, "fanout", Some(1)).await;
+    let orig_after = child_job_id_for_step(&db, full_run.id, "after", None).await;
+
+    // Reproduce the zombie-reaper's terminal state: cancelled by `monitor` with
+    // `flow_status` frozen mid-transition: `fanout` still `InProgress` (all
+    // iterations done), `after` never reached.
+    let mut flow_status: serde_json::Value = sqlx::query_scalar!(
+        "SELECT flow_status FROM v2_job_completed WHERE id = $1",
+        full_run.id
+    )
+    .fetch_one(&db)
+    .await?
+    .expect("flow_status");
+    for m in flow_status["modules"].as_array_mut().unwrap() {
+        match m["id"].as_str() {
+            Some("fanout") => {
+                m["type"] = json!("InProgress");
+                // A reaped loop keeps its cursor at the last iteration.
+                m["iterator"] = json!({ "index": 1, "itered_len": 2 });
+            }
+            Some("after") => *m = json!({ "type": "WaitingForPriorSteps", "id": "after" }),
+            _ => {}
+        }
+    }
+    flow_status["step"] = json!(0);
+    sqlx::query!(
+        "UPDATE v2_job_completed
+         SET status = 'canceled', canceled_by = 'monitor', canceled_reason = 'zombie flow',
+             flow_status = $2
+         WHERE id = $1",
+        full_run.id,
+        flow_status,
+    )
+    .execute(&db)
+    .await?;
+
+    // Hand-restart from the stuck step. `fanout` is recognised as a derivable
+    // between-steps zombie (all children succeeded), so it is reused verbatim and
+    // only the dropped transition onward is replayed. `Some(0)` is the exact value the
+    // run page's "Re-start from" button sends (a whole-step restart), not `None`.
+    let restarted = RunJob::from(JobPayload::RestartedFlow {
+        completed_job_id: full_run.id,
+        step_id: "fanout".into(),
+        branch_or_iteration_n: Some(0),
+        flow_version: None,
+        branch_chosen: None,
+        nested: None,
+    })
+    .run_until_complete(&db, false, port)
+    .await;
+
+    // Flow reaches success, reusing the loop's aggregated result.
+    assert!(
+        restarted.success,
+        "restarted zombie flow should succeed: {:?}",
+        restarted.json_result()
+    );
+    assert_eq!(restarted.json_result().unwrap(), json!("a,b"));
+
+    // Every completed loop iteration reuses its original child job (no re-run);
+    // only `after`, which never ran, executes fresh.
+    let new_iter0 = child_job_id_for_step(&db, restarted.id, "fanout", Some(0)).await;
+    let new_iter1 = child_job_id_for_step(&db, restarted.id, "fanout", Some(1)).await;
+    let new_after = child_job_id_for_step(&db, restarted.id, "after", None).await;
+    assert_eq!(new_iter0, orig_iter0, "loop iteration 0 must be reused");
+    assert_eq!(new_iter1, orig_iter1, "loop iteration 1 must be reused");
+    assert_ne!(new_after, orig_after, "`after` should run fresh");
+
+    Ok(())
+}
+
+/// A serial for-loop reaped *between* iterations (an all-success prefix, but the
+/// cursor not yet at the last iteration) must NOT be treated as complete: reuse
+/// would silently drop the remaining iterations. A downstream `after` step makes
+/// the loop non-final, so the ONLY thing that can prevent reuse here is the
+/// cursor-completeness guard; if it regresses, `after` would consume a truncated
+/// loop result and this test fails. Restart must re-run the whole loop instead.
+#[sqlx::test(fixtures("base", "hello"))]
+async fn test_mid_iteration_zombie_not_reused(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    let flow_value: FlowValue = serde_json::from_value(json!({
+        "modules": [
+            {
+                "id": "fanout",
+                "value": {
+                    "type": "forloopflow",
+                    "iterator": { "type": "javascript", "expr": "['a', 'b', 'c']" },
+                    "skip_failures": false,
+                    "parallel": false,
+                    "modules": [{
+                        "id": "inner",
+                        "value": {
+                            "type": "rawscript",
+                            "language": "deno",
+                            "input_transforms": {
+                                "v": { "type": "javascript", "expr": "flow_input.iter.value" }
+                            },
+                            "content": "export function main(v: string) { return v }"
+                        }
+                    }]
+                }
+            },
+            {
+                "id": "after",
+                "value": {
+                    "type": "rawscript",
+                    "language": "deno",
+                    "input_transforms": {
+                        "loop_res": { "type": "javascript", "expr": "results.fanout" }
+                    },
+                    "content": "export function main(loop_res: string[]) { return loop_res.join(',') }"
+                }
+            }
+        ]
+    }))
+    .unwrap();
+
+    let full_run = RunJob::from(JobPayload::RawFlow {
+        value: flow_value.clone(),
+        path: None,
+        restarted_from: None,
+    })
+    .run_until_complete(&db, false, port)
+    .await;
+    assert!(full_run.success);
+    let orig_iter0 = child_job_id_for_step(&db, full_run.id, "fanout", Some(0)).await;
+
+    // Reap after iteration 0: the loop is InProgress with the cursor still on
+    // iteration 0 (of 3), only iteration 0 recorded; `after` never reached.
+    let mut flow_status: serde_json::Value = sqlx::query_scalar!(
+        "SELECT flow_status FROM v2_job_completed WHERE id = $1",
+        full_run.id
+    )
+    .fetch_one(&db)
+    .await?
+    .expect("flow_status");
+    for m in flow_status["modules"].as_array_mut().unwrap() {
+        match m["id"].as_str() {
+            Some("fanout") => {
+                m["type"] = json!("InProgress");
+                m["iterator"] = json!({ "index": 0, "itered_len": 3 });
+                m["flow_jobs"] = json!([m["flow_jobs"][0]]);
+                m["flow_jobs_success"] = json!([true]);
+            }
+            Some("after") => *m = json!({ "type": "WaitingForPriorSteps", "id": "after" }),
+            _ => {}
+        }
+    }
+    flow_status["step"] = json!(0);
+    sqlx::query!(
+        "UPDATE v2_job_completed SET status = 'canceled', canceled_by = 'monitor',
+         flow_status = $2 WHERE id = $1",
+        full_run.id,
+        flow_status,
+    )
+    .execute(&db)
+    .await?;
+
+    let restarted = RunJob::from(JobPayload::RestartedFlow {
+        completed_job_id: full_run.id,
+        step_id: "fanout".into(),
+        branch_or_iteration_n: None,
+        flow_version: None,
+        branch_chosen: None,
+        nested: None,
+    })
+    .run_until_complete(&db, false, port)
+    .await;
+
+    // The loop re-runs from scratch: all three iterations execute (so `after` sees
+    // "a,b,c", not a truncated "a"), and iteration 0 is a fresh job.
+    assert!(
+        restarted.success,
+        "restart should re-run the loop and succeed: {:?}",
+        restarted.json_result()
+    );
+    assert_eq!(restarted.json_result().unwrap(), json!("a,b,c"));
+    let new_iter0 = child_job_id_for_step(&db, restarted.id, "fanout", Some(0)).await;
+    assert_ne!(
+        new_iter0, orig_iter0,
+        "iteration 0 must re-run, not be reused"
+    );
+
+    Ok(())
+}
+
+/// A nested restart request targets an inner step of the restart-step container.
+/// Even when that container is an eligible between-steps zombie, reuse must NOT
+/// fire (it would skip the whole container and ignore the explicit nested target).
+/// The inner step must re-run.
+#[sqlx::test(fixtures("base", "hello"))]
+async fn test_nested_restart_not_swallowed_by_zombie_reuse(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    // `branch` is a BranchOne (single child, so branch_or_iteration_n is None on
+    // restart: the exact shape that would trip zombie reuse) with two inner steps,
+    // followed by a downstream `after`.
+    let flow_value: FlowValue = serde_json::from_value(json!({
+        "modules": [
+            {
+                "id": "branch",
+                "value": {
+                    "type": "branchone",
+                    "default": [],
+                    "branches": [{
+                        "expr": "true",
+                        "modules": [
+                            {
+                                "id": "inner_first",
+                                "value": {
+                                    "type": "rawscript", "language": "deno",
+                                    "input_transforms": {},
+                                    "content": "export function main() { return 'first' }"
+                                }
+                            },
+                            {
+                                "id": "inner_second",
+                                "value": {
+                                    "type": "rawscript", "language": "deno",
+                                    "input_transforms": {
+                                        "first": { "type": "javascript", "expr": "results.inner_first" }
+                                    },
+                                    "content": "export function main(first: string) { return `${first}|second` }"
+                                }
+                            }
+                        ]
+                    }]
+                }
+            },
+            {
+                "id": "after",
+                "value": {
+                    "type": "rawscript", "language": "deno",
+                    "input_transforms": {
+                        "b": { "type": "javascript", "expr": "results.branch" }
+                    },
+                    "content": "export function main(b: string) { return `after:${b}` }"
+                }
+            }
+        ]
+    }))
+    .unwrap();
+
+    let full_run = RunJob::from(JobPayload::RawFlow {
+        value: flow_value.clone(),
+        path: None,
+        restarted_from: None,
+    })
+    .run_until_complete(&db, false, port)
+    .await;
+    assert!(full_run.success);
+    assert_eq!(full_run.json_result().unwrap(), json!("after:first|second"));
+    let branch_child = child_job_id_for_step(&db, full_run.id, "branch", None).await;
+    let orig_inner_second = child_job_id_for_step(&db, branch_child, "inner_second", None).await;
+
+    // Reap `branch` as a between-steps zombie (its child completed, transition lost);
+    // `after` never reached.
+    let mut flow_status: serde_json::Value = sqlx::query_scalar!(
+        "SELECT flow_status FROM v2_job_completed WHERE id = $1",
+        full_run.id
+    )
+    .fetch_one(&db)
+    .await?
+    .expect("flow_status");
+    for m in flow_status["modules"].as_array_mut().unwrap() {
+        match m["id"].as_str() {
+            Some("branch") => m["type"] = json!("InProgress"),
+            Some("after") => *m = json!({ "type": "WaitingForPriorSteps", "id": "after" }),
+            _ => {}
+        }
+    }
+    flow_status["step"] = json!(0);
+    sqlx::query!(
+        "UPDATE v2_job_completed SET status = 'canceled', canceled_by = 'monitor',
+         flow_status = $2 WHERE id = $1",
+        full_run.id,
+        flow_status,
+    )
+    .execute(&db)
+    .await?;
+
+    // Nested restart: re-run `inner_second` inside `branch`. Zombie reuse must step
+    // aside so the nested chain is honored.
+    let restarted = RunJob::from(JobPayload::RestartedFlow {
+        completed_job_id: full_run.id,
+        step_id: "branch".into(),
+        branch_or_iteration_n: None,
+        flow_version: None,
+        branch_chosen: Some(BranchChosen::Branch { branch: 0 }),
+        nested: Some(Box::new(RestartedFrom {
+            flow_job_id: branch_child,
+            step_id: "inner_second".into(),
+            branch_or_iteration_n: None,
+            flow_version: None,
+            branch_chosen: None,
+            nested: None,
+        })),
+    })
+    .run_until_complete(&db, false, port)
+    .await;
+
+    assert!(
+        restarted.success,
+        "nested restart of a zombie container should succeed: {:?}",
+        restarted.json_result()
+    );
+    assert_eq!(
+        restarted.json_result().unwrap(),
+        json!("after:first|second")
+    );
+    let new_branch_child = child_job_id_for_step(&db, restarted.id, "branch", None).await;
+    let new_inner_second = child_job_id_for_step(&db, new_branch_child, "inner_second", None).await;
+    assert_ne!(
+        new_inner_second, orig_inner_second,
+        "the nested target inner_second must re-run, not be skipped by zombie reuse"
+    );
+
+    Ok(())
+}
+
+/// A raw-flow (editor preview) restart queues the request's CURRENT definition, which the editor
+/// allows to differ from the completed run. Zombie reuse must not fire there: it would validate the
+/// stored step and synthesize Success from the old children, skipping the user's edit. The edited
+/// step must re-run and downstream must observe its new result.
+#[sqlx::test(fixtures("base", "hello"))]
+async fn test_raw_flow_restart_does_not_reuse_edited_step(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    let flow_of = |suffix: &str| -> FlowValue {
+        serde_json::from_value(json!({
+            "modules": [
+                {
+                    "id": "fanout",
+                    "value": {
+                        "type": "forloopflow",
+                        "iterator": { "type": "javascript", "expr": "['a', 'b']" },
+                        "skip_failures": false,
+                        "parallel": false,
+                        "modules": [{
+                            "id": "inner",
+                            "value": {
+                                "type": "rawscript", "language": "deno",
+                                "input_transforms": {
+                                    "v": { "type": "javascript", "expr": "flow_input.iter.value" }
+                                },
+                                "content": format!("export function main(v: string) {{ return v + '{suffix}' }}")
+                            }
+                        }]
+                    }
+                },
+                {
+                    "id": "after",
+                    "value": {
+                        "type": "rawscript", "language": "deno",
+                        "input_transforms": {
+                            "loop_res": { "type": "javascript", "expr": "results.fanout" }
+                        },
+                        "content": "export function main(loop_res: string[]) { return loop_res.join(',') }"
+                    }
+                }
+            ]
+        }))
+        .unwrap()
+    };
+
+    let full_run =
+        RunJob::from(JobPayload::RawFlow { value: flow_of(""), path: None, restarted_from: None })
+            .run_until_complete(&db, false, port)
+            .await;
+    assert!(full_run.success);
+    assert_eq!(full_run.json_result().unwrap(), json!("a,b"));
+    let orig_iter0 = child_job_id_for_step(&db, full_run.id, "fanout", Some(0)).await;
+
+    let mut flow_status: serde_json::Value = sqlx::query_scalar!(
+        "SELECT flow_status FROM v2_job_completed WHERE id = $1",
+        full_run.id
+    )
+    .fetch_one(&db)
+    .await?
+    .expect("flow_status");
+    for m in flow_status["modules"].as_array_mut().unwrap() {
+        match m["id"].as_str() {
+            Some("fanout") => {
+                m["type"] = json!("InProgress");
+                m["iterator"] = json!({ "index": 1, "itered_len": 2 });
+            }
+            Some("after") => *m = json!({ "type": "WaitingForPriorSteps", "id": "after" }),
+            _ => {}
+        }
+    }
+    flow_status["step"] = json!(0);
+    sqlx::query!(
+        "UPDATE v2_job_completed SET status = 'canceled', canceled_by = 'monitor',
+         flow_status = $2 WHERE id = $1",
+        full_run.id,
+        flow_status,
+    )
+    .execute(&db)
+    .await?;
+
+    let restarted = RunJob::from(JobPayload::RawFlow {
+        value: flow_of("X"),
+        path: None,
+        restarted_from: Some(RestartedFrom {
+            flow_job_id: full_run.id,
+            step_id: "fanout".into(),
+            branch_or_iteration_n: None,
+            flow_version: None,
+            branch_chosen: None,
+            nested: None,
+        }),
+    })
+    .run_until_complete(&db, false, port)
+    .await;
+
+    // The edited step must run: results reflect the new definition, not the reused old children.
+    assert!(
+        restarted.success,
+        "edited raw-flow restart should succeed: {:?}",
+        restarted.json_result()
+    );
+    assert_eq!(restarted.json_result().unwrap(), json!("aX,bX"));
+    let new_iter0 = child_job_id_for_step(&db, restarted.id, "fanout", Some(0)).await;
+    assert_ne!(
+        new_iter0, orig_iter0,
+        "the edited fanout step must re-run, not be reused"
+    );
+
+    Ok(())
+}
+
+/// Only a flow reaped by the zombie monitor (canceled_by = 'monitor') is eligible for reuse. A
+/// plain force-cancel at the same boundary (a child succeeded, its parent transition not yet
+/// landed) yields the identical InProgress/all-success shape but must keep restart-from-step
+/// semantics: the selected step re-runs.
+#[sqlx::test(fixtures("base", "hello"))]
+async fn test_non_monitor_cancel_is_not_reused(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    let flow_value: FlowValue = serde_json::from_value(json!({
+        "modules": [
+            {
+                "id": "fanout",
+                "value": {
+                    "type": "forloopflow",
+                    "iterator": { "type": "javascript", "expr": "['a', 'b']" },
+                    "skip_failures": false,
+                    "parallel": false,
+                    "modules": [{
+                        "id": "inner",
+                        "value": {
+                            "type": "rawscript", "language": "deno",
+                            "input_transforms": {
+                                "v": { "type": "javascript", "expr": "flow_input.iter.value" }
+                            },
+                            "content": "export function main(v: string) { return v }"
+                        }
+                    }]
+                }
+            },
+            {
+                "id": "after",
+                "value": {
+                    "type": "rawscript", "language": "deno",
+                    "input_transforms": {
+                        "loop_res": { "type": "javascript", "expr": "results.fanout" }
+                    },
+                    "content": "export function main(loop_res: string[]) { return loop_res.join(',') }"
+                }
+            }
+        ]
+    }))
+    .unwrap();
+
+    let full_run = RunJob::from(JobPayload::RawFlow {
+        value: flow_value.clone(),
+        path: None,
+        restarted_from: None,
+    })
+    .run_until_complete(&db, false, port)
+    .await;
+    assert!(full_run.success);
+    let orig_iter0 = child_job_id_for_step(&db, full_run.id, "fanout", Some(0)).await;
+
+    // Same frozen-transition shape as a zombie, but canceled by a USER, not the monitor.
+    let mut flow_status: serde_json::Value = sqlx::query_scalar!(
+        "SELECT flow_status FROM v2_job_completed WHERE id = $1",
+        full_run.id
+    )
+    .fetch_one(&db)
+    .await?
+    .expect("flow_status");
+    for m in flow_status["modules"].as_array_mut().unwrap() {
+        match m["id"].as_str() {
+            Some("fanout") => {
+                m["type"] = json!("InProgress");
+                m["iterator"] = json!({ "index": 1, "itered_len": 2 });
+            }
+            Some("after") => *m = json!({ "type": "WaitingForPriorSteps", "id": "after" }),
+            _ => {}
+        }
+    }
+    flow_status["step"] = json!(0);
+    sqlx::query!(
+        "UPDATE v2_job_completed SET status = 'canceled', canceled_by = 'admin',
+         flow_status = $2 WHERE id = $1",
+        full_run.id,
+        flow_status,
+    )
+    .execute(&db)
+    .await?;
+
+    let restarted = RunJob::from(JobPayload::RestartedFlow {
+        completed_job_id: full_run.id,
+        step_id: "fanout".into(),
+        branch_or_iteration_n: None,
+        flow_version: None,
+        branch_chosen: None,
+        nested: None,
+    })
+    .run_until_complete(&db, false, port)
+    .await;
+
+    assert!(restarted.success);
+    let new_iter0 = child_job_id_for_step(&db, restarted.id, "fanout", Some(0)).await;
+    assert_ne!(
+        new_iter0, orig_iter0,
+        "a non-monitor cancel must re-run the step, not reuse the child"
+    );
+
+    Ok(())
+}
diff --git a/backend/windmill-queue/src/jobs.rs b/backend/windmill-queue/src/jobs.rs
index 433d2e4ed5..4b2196bf63 100644
--- a/backend/windmill-queue/src/jobs.rs
+++ b/backend/windmill-queue/src/jobs.rs
@@ -5666,6 +5666,10 @@ async fn push_inner<'c, 'd>(
                             restarted_from_val.step_id.as_str(),
                             restarted_from_val.branch_or_iteration_n,
                             restarted_from_val.flow_version,
+                            restarted_from_val.nested.is_some(),
+                            // RawFlow queues the request's (possibly edited) definition, not the
+                            // stored one, so zombie reuse of the stored step is unsafe here.
+                            false,
                         )
                         .await?;
                     FlowStatus {
@@ -6055,6 +6059,10 @@ async fn push_inner<'c, 'd>(
                 step_id.as_str(),
                 branch_or_iteration_n,
                 flow_version,
+                nested.is_some(),
+                // RestartedFlow resolves and queues the completed job's stored definition, so the
+                // step validated for reuse is the one that will run.
+                true,
             )
             .await?;
 
@@ -7063,6 +7071,78 @@ fn create_restarted_module(
     }
 }
 
+/// A between-steps-zombie step: an `InProgress` module (in an otherwise terminal,
+/// reaped flow) whose every child is recorded as a `success` completion. Only the
+/// module's final state transition was lost, so the whole step is derivable and
+/// safe to reuse on restart. Children incomplete/failed/cancelled ⟹ not a zombie.
+async fn is_derivable_between_steps_zombie(
+    db: &Pool<Postgres>,
+    workspace_id: &str,
+    module: &FlowStatusModule,
+) -> Result<bool, Error> {
+    // The module's own cursor must prove it reached the end (a serial loop/branch-all reaped
+    // mid-fan-out has an all-success prefix but unrun remaining iterations); while-loops are
+    // never derivable. Children-success is verified below.
+    if !module.is_between_steps_complete() {
+        return Ok(false);
+    }
+    let child_ids: Vec<Uuid> = module
+        .flow_jobs()
+        .filter(|v| !v.is_empty())
+        .or_else(|| module.job().map(|j| vec![j]))
+        .unwrap_or_default();
+    if child_ids.is_empty() {
+        return Ok(false);
+    }
+    let success_children = sqlx::query_scalar!(
+        "SELECT count(*) FROM v2_job_completed
+         WHERE workspace_id = $1 AND id = ANY($2) AND status = 'success'",
+        workspace_id,
+        &child_ids,
+    )
+    .fetch_one(db)
+    .await?
+    .unwrap_or(0);
+    Ok(success_children == child_ids.len() as i64)
+}
+
+/// Convert a between-steps-zombie `InProgress` module (validated by
+/// [`is_derivable_between_steps_zombie`]) into the `Success` it would have become
+/// had its dropped transition landed, reusing all completed children. Downstream
+/// steps re-derive this step's result from `flow_jobs`/`job` on demand
+/// (`get_previous_job_result`), so no aggregate needs recomputing here.
+fn reuse_completed_zombie_module(module: FlowStatusModule) -> FlowStatusModule {
+    match module {
+        FlowStatusModule::InProgress {
+            id,
+            job,
+            flow_jobs,
+            flow_jobs_success,
+            flow_jobs_duration,
+            branch_chosen,
+            agent_actions,
+            agent_actions_success,
+            ..
+        } => FlowStatusModule::Success {
+            id,
+            job,
+            // Every child was verified successful, so normalise the success
+            // vector (the dropped transition may have left the last entry unset).
+            flow_jobs_success: flow_jobs_success
+                .map(|v| v.into_iter().map(|_| Some(true)).collect()),
+            flow_jobs,
+            flow_jobs_duration,
+            branch_chosen,
+            approvers: vec![],
+            failed_retries: vec![],
+            skipped: false,
+            agent_actions,
+            agent_actions_success,
+        },
+        other => other,
+    }
+}
+
 async fn restarted_flows_resolution(
     db: &Pool<Postgres>,
     workspace_id: &str,
@@ -7070,6 +7150,15 @@ async fn restarted_flows_resolution(
     restart_step_id: &str,
     branch_or_iteration_n: Option<usize>,
     flow_version: Option<i64>,
+    // A nested restart chain (RestartedFrom.nested) descends into the restart step's child to
+    // re-run an inner step; zombie reuse would skip the whole container and ignore it.
+    nested_restart: bool,
+    // Zombie reuse validates the restart step against the completed job's STORED definition and
+    // synthesizes Success from its recorded children. That is only sound when the run being queued
+    // uses that same definition (JobPayload::RestartedFlow). A JobPayload::RawFlow restart queues
+    // the editor's current, possibly EDITED, definition instead, so reuse would skip the edited
+    // step and reuse the old child result; disable it there.
+    allow_zombie_reuse: bool,
 ) -> Result<
     (
         Option<i64>,
@@ -7086,7 +7175,7 @@ async fn restarted_flows_resolution(
     let row = sqlx::query!(
         "SELECT
             j.runnable_path as script_path, j.runnable_id AS \"script_hash: ScriptHash\",
-            j.kind AS \"job_kind!: JobKind\",
+            j.kind AS \"job_kind!: JobKind\", c.canceled_by,
             COALESCE(c.flow_status, c.workflow_as_code_status) AS \"flow_status: Json<Box<RawValue>>\",
             j.raw_flow AS \"raw_flow: Json<Box<RawValue>>\"
         FROM v2_job_completed c JOIN v2_job j USING (id) WHERE j.id = $1 and j.workspace_id = $2",
@@ -7102,6 +7191,12 @@ async fn restarted_flows_resolution(
         ))
     })?;
 
+    // Zombie reuse must only apply to flows the zombie monitor reaped (canceled_by = 'monitor').
+    // An ordinary force-cancel copies the same live flow_status, so a user canceling after a child
+    // succeeds but before the parent transition lands produces the identical InProgress/all-success
+    // shape; those must retain restart-from-step semantics (the step re-runs).
+    let reaped_by_monitor = row.canceled_by.as_deref() == Some("monitor");
+
     let current_flow_version = row.script_hash.map(|x| x.0);
     let is_version_change = flow_version.is_some()
         && current_flow_version.is_some()
@@ -7192,9 +7287,36 @@ async fn restarted_flows_resolution(
                 continue;
             };
             if module.id() == restart_step_id {
-                // if the module ID is the one we want to restart the flow at, or if it's past it in the flow,
-                // set the module as WaitingForPriorSteps as it needs to be re-run
-                if branch_or_iteration_n.is_none() || branch_or_iteration_n.unwrap() == 0 {
+                // Reuse is only safe when there is a NEXT step to advance into (advancing past the
+                // last module lands on the failure step) and the step's definition carries no
+                // completion/arming semantics that reuse would skip (stop predicates, skip_if,
+                // suspend, sleep); such a step must re-run, not be synthesized as Success.
+                let has_next_step = flow_value
+                    .modules
+                    .last()
+                    .is_none_or(|m| m.id != restart_step_id);
+                // A whole-step restart is `None` (restart API with the field omitted) or `Some(0)`
+                // (the run page's "Re-start from" button always sends 0); both mean "redo this step",
+                // which for a monitor-reaped zombie means reuse it. `Some(n>=1)` is an explicit
+                // partial container restart and keeps its existing reuse-0..n-1 / rerun-from-n path.
+                if allow_zombie_reuse
+                    && reaped_by_monitor
+                    && branch_or_iteration_n.unwrap_or(0) == 0
+                    && !nested_restart
+                    && has_next_step
+                    && module_definition.allows_zombie_reuse()
+                    && is_derivable_between_steps_zombie(db, workspace_id, &module).await?
+                {
+                    // Between-steps-zombie recovery: this step's children all
+                    // completed but its final state transition was dropped (the
+                    // flow was reaped by the zombie monitor). Reuse the completed
+                    // step verbatim and restart from the NEXT step, so no child
+                    // re-runs and only the dropped transition is replayed onward.
+                    step_n += 1;
+                    truncated_modules.push(reuse_completed_zombie_module(module));
+                } else if branch_or_iteration_n.is_none() || branch_or_iteration_n.unwrap() == 0 {
+                    // if the module ID is the one we want to restart the flow at, or if it's past it in the flow,
+                    // set the module as WaitingForPriorSteps as it needs to be re-run
                     // The module as WaitingForPriorSteps as the entire module (i.e. all the branches) need to be re-run
                     truncated_modules
                         .push(FlowStatusModule::WaitingForPriorSteps { id: module.id() });
diff --git a/backend/windmill-types/src/flow_status.rs b/backend/windmill-types/src/flow_status.rs
index 62da4d5517..79890e3c6e 100644
--- a/backend/windmill-types/src/flow_status.rs
+++ b/backend/windmill-types/src/flow_status.rs
@@ -475,6 +475,33 @@ impl FlowStatusModule {
         }
     }
 
+    /// For a still-`InProgress` module (a between-steps zombie), whether the module's own
+    /// iteration/branch cursor proves it actually reached the end, so the only thing left is
+    /// the final state transition (children-success is a separate, DB-side check).
+    ///
+    /// A serial for-loop / branch-all grows `flow_jobs` one entry at a time, so an all-success
+    /// prefix does NOT mean the module finished: the cursor must sit on the last element. Parallel
+    /// containers preallocate every child up front, so a full success set is conclusive. While-loops
+    /// are never derivable here (continuation depends on a condition evaluated after each iteration,
+    /// which a reaped zombie never persisted). Non-`InProgress` modules return false.
+    pub fn is_between_steps_complete(&self) -> bool {
+        match self {
+            FlowStatusModule::InProgress { while_loop: true, .. } => false,
+            // Parallel loop/branch-all: all children exist up front, so children-success suffices.
+            FlowStatusModule::InProgress { parallel: true, .. } => true,
+            FlowStatusModule::InProgress { iterator: Some(it), .. } => {
+                let total = it
+                    .itered_len
+                    .or_else(|| it.itered.as_ref().map(|v| v.len()));
+                total.is_some_and(|t| t > 0 && it.index + 1 == t)
+            }
+            FlowStatusModule::InProgress { branchall: Some(ba), .. } => ba.branch + 1 == ba.len,
+            // Single-child leaf / subflow / branch-one: the child ran, nothing else to advance.
+            FlowStatusModule::InProgress { .. } => true,
+            _ => false,
+        }
+    }
+
     pub fn agent_actions(&self) -> Option<Vec<AgentAction>> {
         match self {
             FlowStatusModule::InProgress { agent_actions, .. } => agent_actions.clone(),
@@ -549,4 +576,131 @@ impl FlowStatus {
         let i = usize::try_from(self.step).ok()?;
         self.modules.get(i)
     }
+
+    /// Whether no step has begun executing yet: the preprocessor (if any) and the first
+    /// module are both still `WaitingForPriorSteps`. A reaped flow in this state can be
+    /// safely re-queued because nothing ran. A preprocessor that is `InProgress` means its
+    /// child already ran (only the parent transition was lost), so re-queuing would
+    /// re-run the preprocessor and duplicate its side effects.
+    pub fn is_not_yet_started(&self) -> bool {
+        self.preprocessor_module
+            .as_ref()
+            .is_none_or(|p| matches!(p, FlowStatusModule::WaitingForPriorSteps { .. }))
+            && self
+                .modules
+                .first()
+                .is_some_and(|m| matches!(m, FlowStatusModule::WaitingForPriorSteps { .. }))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{FlowStatus, FlowStatusModule};
+
+    fn module(json: serde_json::Value) -> FlowStatusModule {
+        serde_json::from_value(json).unwrap()
+    }
+
+    fn status(json: serde_json::Value) -> FlowStatus {
+        serde_json::from_value(json).unwrap()
+    }
+
+    #[test]
+    fn is_not_yet_started_distinguishes_preprocessor_zombie() {
+        let nil = "00000000-0000-0000-0000-000000000000";
+        let waiting = serde_json::json!({ "type": "WaitingForPriorSteps", "id": "a" });
+        let failure = serde_json::json!({ "type": "WaitingForPriorSteps", "id": "failure" });
+        // No preprocessor, first module waiting: genuinely unstarted.
+        assert!(status(serde_json::json!({
+            "step": 0, "modules": [waiting], "failure_module": failure
+        }))
+        .is_not_yet_started());
+        // First module already InProgress: started.
+        assert!(!status(serde_json::json!({
+            "step": 0,
+            "modules": [{ "type": "InProgress", "id": "a", "job": nil }],
+            "failure_module": failure
+        }))
+        .is_not_yet_started());
+        // Preprocessor still waiting, first module waiting: unstarted.
+        assert!(status(serde_json::json!({
+            "step": -1, "modules": [waiting], "failure_module": failure,
+            "preprocessor_module": { "type": "WaitingForPriorSteps", "id": "pre" }
+        }))
+        .is_not_yet_started());
+        // Preprocessor InProgress (its child ran) while modules[0] still waits: a
+        // preprocessor zombie, NOT unstarted, so it must not be auto-requeued.
+        assert!(!status(serde_json::json!({
+            "step": -1, "modules": [waiting], "failure_module": failure,
+            "preprocessor_module": { "type": "InProgress", "id": "pre", "job": nil }
+        }))
+        .is_not_yet_started());
+    }
+
+    #[test]
+    fn between_steps_complete_serial_loop() {
+        // Cursor on the last iteration => complete.
+        assert!(module(serde_json::json!({
+            "type": "InProgress", "id": "a", "job": "00000000-0000-0000-0000-000000000000",
+            "iterator": { "index": 1, "itered_len": 2 }, "flow_jobs": []
+        }))
+        .is_between_steps_complete());
+        // Reaped mid-iteration (iteration 1 of 2 never scheduled) => NOT complete.
+        assert!(!module(serde_json::json!({
+            "type": "InProgress", "id": "a", "job": "00000000-0000-0000-0000-000000000000",
+            "iterator": { "index": 0, "itered_len": 2 }, "flow_jobs": []
+        }))
+        .is_between_steps_complete());
+        // Legacy shape: itered array present, itered_len absent.
+        assert!(module(serde_json::json!({
+            "type": "InProgress", "id": "a", "job": "00000000-0000-0000-0000-000000000000",
+            "iterator": { "index": 1, "itered": ["x", "y"] }
+        }))
+        .is_between_steps_complete());
+    }
+
+    #[test]
+    fn between_steps_complete_while_loop_never() {
+        assert!(!module(serde_json::json!({
+            "type": "InProgress", "id": "a", "job": "00000000-0000-0000-0000-000000000000",
+            "while_loop": true, "iterator": { "index": 1, "itered_len": 2 }
+        }))
+        .is_between_steps_complete());
+    }
+
+    #[test]
+    fn between_steps_complete_branchall_and_parallel() {
+        // Serial branch-all on the last branch => complete; earlier branch => not.
+        assert!(module(serde_json::json!({
+            "type": "InProgress", "id": "a", "job": "00000000-0000-0000-0000-000000000000",
+            "branchall": { "branch": 1, "len": 2 }
+        }))
+        .is_between_steps_complete());
+        assert!(!module(serde_json::json!({
+            "type": "InProgress", "id": "a", "job": "00000000-0000-0000-0000-000000000000",
+            "branchall": { "branch": 0, "len": 2 }
+        }))
+        .is_between_steps_complete());
+        // Parallel loop: children preallocated, so any cursor is fine (success is checked elsewhere).
+        assert!(module(serde_json::json!({
+            "type": "InProgress", "id": "a", "job": "00000000-0000-0000-0000-000000000000",
+            "parallel": true, "iterator": { "index": 0, "itered_len": 3 }
+        }))
+        .is_between_steps_complete());
+    }
+
+    #[test]
+    fn between_steps_complete_leaf_and_non_inprogress() {
+        // Single-child leaf: the child ran, nothing to advance.
+        assert!(module(serde_json::json!({
+            "type": "InProgress", "id": "a", "job": "00000000-0000-0000-0000-000000000000"
+        }))
+        .is_between_steps_complete());
+        // A Success module is not a between-steps zombie.
+        assert!(!module(serde_json::json!({
+            "type": "Success", "id": "a", "job": "00000000-0000-0000-0000-000000000000",
+            "skipped": false
+        }))
+        .is_between_steps_complete());
+    }
 }
diff --git a/backend/windmill-types/src/flows.rs b/backend/windmill-types/src/flows.rs
index 7e70dc5acd..b06e2af05e 100644
--- a/backend/windmill-types/src/flows.rs
+++ b/backend/windmill-types/src/flows.rs
@@ -664,6 +664,19 @@ impl FlowModule {
             .is_ok_and(|x| x == "script" || x == "rawscript" || x == "flowscript")
     }
 
+    /// Whether a between-steps-zombie step carrying this definition can be safely reused as
+    /// `Success` on restart (see restart-resolution reuse). Excludes steps whose completion
+    /// transition or arming carries semantics that reuse would silently skip: stop predicates
+    /// (`stop_after_if` / `stop_after_all_iters_if`, which decide whether downstream steps run),
+    /// `skip_if` (skipped-state and suspend arming), a `suspend` approval boundary, and `sleep`.
+    pub fn allows_zombie_reuse(&self) -> bool {
+        self.stop_after_if.is_none()
+            && self.stop_after_all_iters_if.is_none()
+            && self.skip_if.is_none()
+            && self.suspend.is_none()
+            && self.sleep.is_none()
+    }
+
     pub fn get_type(&self) -> anyhow::Result<&str> {
         #[derive(Deserialize)]
         pub struct FlowModuleValueType<'a> {

From a29e13fd18bcc09f43b32af80e9178801edf412e Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Thu, 23 Jul 2026 23:03:25 +0200
Subject: [PATCH 143/171] reference the file-search worker by its packaged .js
 name (#10290)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

svelte-package does not rewrite the string literal inside new URL(), and ships only the compiled searchWorker.js — so the .ts URL is dangling for any downstream consumer of @windmill-labs/components (rollup: Could not resolve searchWorker.ts). Vite maps .js back to the .ts source in-repo, so both builds resolve.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 frontend/src/lib/components/copilot/chat/files/fileEngine.ts | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/frontend/src/lib/components/copilot/chat/files/fileEngine.ts b/frontend/src/lib/components/copilot/chat/files/fileEngine.ts
index 5dbceb77e2..5508ab8b68 100644
--- a/frontend/src/lib/components/copilot/chat/files/fileEngine.ts
+++ b/frontend/src/lib/components/copilot/chat/files/fileEngine.ts
@@ -294,7 +294,10 @@ export function searchFilesInWorker(
 ): Promise<SearchResult> {
 	let worker: Worker
 	try {
-		worker = new Worker(new URL('./searchWorker.ts', import.meta.url), { type: 'module' })
+		// Reference the worker by its .js name: svelte-package doesn't rewrite this
+		// string literal and ships only searchWorker.js, so a `.ts` URL is dangling
+		// when the package is consumed downstream (vite maps `.js`→`.ts` here in-repo).
+		worker = new Worker(new URL('./searchWorker.js', import.meta.url), { type: 'module' })
 	} catch {
 		return searchFiles(entries, pattern, opts)
 	}

From bf16e7d49a7486d37cf9eb1907e80abae47a78a7 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Thu, 23 Jul 2026 23:21:24 +0200
Subject: [PATCH 144/171] feat: surface workspace-script advanced settings in
 flow editor (#10289)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* feat(flow-editor): surface workspace-script advanced settings in flows

Workspace-script steps in a flow could not view or edit script-level
runtime settings (concurrency, cache, timeout, debounce, dedicated
worker, priority, delete-after-use). The concurrency and cache tabs
only showed a "set it on the script" warning with no value and no way
to act on it.

- Add ScriptAdvancedSettings, a reusable subset of the script editor's
  runtime settings, and two entry points that reuse it:
  - WorkspaceScriptSettingsDrawer: a mini settings drawer reachable from
    the flow step (header "Settings" button and the delegating tabs),
    saving a new script version with the code left unchanged.
  - an inner "Settings" drawer inside ScriptEditorDrawer, saved together
    with the code.
- Replace the concurrency/cache delegation warnings with a box that
  fetches the referenced script's current value and offers an
  "Edit script settings" shortcut (useWorkspaceScriptSettings loader).
- Add ScriptSettingsBadges showing active advanced settings, in the
  standalone script editor top bar, the edit-code drawer, and above the
  workspace-script step preview.

Fixes WIN-2233

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(flow-editor): keep subflow concurrency note distinct from workspace-script

The concurrency delegation box is workspace-script specific; subflow
steps now keep a plain limitation note instead of the script settings
shortcut.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(flow-editor): preserve all script fields when saving settings-only version

Building the createScript body by hand dropped codebase/labels/envs and
other fields on the new version. Spread the loaded script instead and
override only lineage, matching ScriptEditorDrawer's save.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(flow-editor): address review — settings-save safety and stale display

- WorkspaceScriptSettingsDrawer: keep settings-only saves from hijacking
  execution identity or discarding the author's draft (preserve_on_behalf_of
  + skip_draft_deletion), and normalize cleared concurrency/debounce keys to
  undefined so blanks don't become shared global keys.
- ScriptEditorDrawer: normalize cleared keys in its save too (the inner
  settings drawer edits them).
- FlowModuleComponent: reload the surfaced concurrency/cache values + badges
  after a header settings/code save; gate settings editing on customUi.scriptEdit.
- useWorkspaceScriptSettings: sequence-guard load() against stale overwrites.
- Add unit tests for getActiveScriptSettingsBadges.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(flow-editor): round-3 review — concurrency-safe save, load guards, UI gates

- WorkspaceScriptSettingsDrawer: drop auto_parent so a settings-only save uses
  the loaded parent as an optimistic-concurrency guard (fails loudly instead of
  silently reverting a concurrent deploy); sequence-guard openDrawer so a slow
  load for a previous script can't clobber a reopened one.
- useWorkspaceScriptSettings: clear loading in the superseded/early-return path
  so a hub/empty step can't spin forever.
- ScriptBuilder: gate the clickable settings badges on customUi.topBar.settings
  and settingsPanel.disableRuntime.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(flow-editor): round-4 review — template, load-error, legacy-zero handling

- WorkspaceScriptSettingsDrawer: stop forcing is_template=false so saving a
  setting on a template keeps its template status; show a recoverable error
  (with Retry) when the settings load fails instead of spinning forever.
- scriptSettings/FlowModuleComponent: treat non-positive concurrent_limit and
  timeout as unset (legacy zero rows), so no "Max 0 executions"/"Timeout 0s".
- Add badge tests for the non-positive cases.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(flow-editor): round-5 nits — neutral card wording, load-error surfacing, cache zero

- WorkspaceScriptSettingInfo: neutral "managed on the referenced workspace
  script" header (no longer claims "configured" when unset) and a distinct
  error line so a failed load isn't misread as "not set".
- useWorkspaceScriptSettings: expose an error state; thread it into the
  concurrency and cache cards.
- Treat cache_ttl <= 0 as unset, matching concurrency/timeout; add test.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(flow-editor): icon-only script action buttons + gate settings in local-dev

- Gate the workspace-script settings actions (header button, clickable badges,
  Concurrency/Cache shortcuts) on the settings drawer actually being mounted, so
  the local-dev flow editors (Dev.svelte / flows/dev) that provide the context
  store but never render the drawer keep the values read-only instead of showing
  no-op controls.
- Make the script action buttons icon-only with clear hover popovers to save
  space in the crowded step/script-editor top bars: Edit, Settings and Fork in
  the step header, Settings in the edit-code drawer, and the settings badges
  (icon chip + label/value popover).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(flow-editor): round-6 nits — a11y names + accurate read-only reason

- Add aria-label to the icon-only Edit/Settings/Fork buttons and the setting
  badges so keyboard/screen-reader users get an accessible name (the hover
  popover alone didn't expose it).
- WorkspaceScriptSettingInfo takes a noEditReason so the read-only explanation
  matches the actual gate (hub / hash-pinned / unavailable-in-this-editor)
  instead of always blaming hub/pinned — fixes the wrong reason shown in the
  local-dev flow editors.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore(flow-editor): drop narrating comment on the no-edit-reason derived

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(flow-editor): bind settings save completion to the drawer target

The drawer is a singleton, so a save that outlived a reopen ran the new
target's callback and closed its drawer, discarding edits in progress.
Capture the target sequence and callback at save time: the captured
callback still fires (it refreshes the script it belongs to) while the
close, error toast and saving flag only apply if the target is unchanged.
Reopening also resets the saving flag, which the seq-guarded save no
longer clears for a superseded target.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 frontend/src/lib/components/Dev.svelte        |   2 +
 .../src/lib/components/FlowBuilder.svelte     |   6 +
 .../components/ScriptAdvancedSettings.svelte  | 286 ++++++++++++++++++
 .../src/lib/components/ScriptBuilder.svelte   |  15 +
 .../components/ScriptSettingsBadges.svelte    |  42 +++
 .../flows/content/FlowModuleCache.svelte      |  37 ++-
 .../flows/content/FlowModuleComponent.svelte  | 108 ++++++-
 .../flows/content/FlowModuleHeader.svelte     |  93 ++++--
 .../flows/content/ScriptEditorDrawer.svelte   |  70 ++++-
 .../content/WorkspaceScriptSettingInfo.svelte |  61 ++++
 .../WorkspaceScriptSettingsDrawer.svelte      | 150 +++++++++
 frontend/src/lib/components/flows/types.ts    |   2 +
 .../useWorkspaceScriptSettings.svelte.ts      |  72 +++++
 .../src/lib/components/scriptSettings.test.ts |  53 ++++
 frontend/src/lib/components/scriptSettings.ts | 137 +++++++++
 frontend/src/routes/flows/dev/+page.svelte    |  10 +-
 16 files changed, 1101 insertions(+), 43 deletions(-)
 create mode 100644 frontend/src/lib/components/ScriptAdvancedSettings.svelte
 create mode 100644 frontend/src/lib/components/ScriptSettingsBadges.svelte
 create mode 100644 frontend/src/lib/components/flows/content/WorkspaceScriptSettingInfo.svelte
 create mode 100644 frontend/src/lib/components/flows/content/WorkspaceScriptSettingsDrawer.svelte
 create mode 100644 frontend/src/lib/components/flows/useWorkspaceScriptSettings.svelte.ts
 create mode 100644 frontend/src/lib/components/scriptSettings.test.ts
 create mode 100644 frontend/src/lib/components/scriptSettings.ts

diff --git a/frontend/src/lib/components/Dev.svelte b/frontend/src/lib/components/Dev.svelte
index ca8ecb8451..6d9b21aeb9 100644
--- a/frontend/src/lib/components/Dev.svelte
+++ b/frontend/src/lib/components/Dev.svelte
@@ -662,6 +662,7 @@
 
 	const previewArgsStore = $state({ val: {} })
 	const scriptEditorDrawer = writable(undefined)
+	const workspaceScriptSettingsDrawer = writable(undefined)
 	const history = initHistory(flowStore.val)
 	const stepsInputArgs = new StepsInputArgs()
 	const selectionManager = new SelectionManager()
@@ -687,6 +688,7 @@
 		selectionManager,
 		previewArgs: previewArgsStore,
 		scriptEditorDrawer,
+		workspaceScriptSettingsDrawer,
 		flowEditorDrawer: writable(undefined),
 		history,
 		pathStore: pathStore,
diff --git a/frontend/src/lib/components/FlowBuilder.svelte b/frontend/src/lib/components/FlowBuilder.svelte
index b30db19af9..3ce0a9fa03 100644
--- a/frontend/src/lib/components/FlowBuilder.svelte
+++ b/frontend/src/lib/components/FlowBuilder.svelte
@@ -40,6 +40,7 @@
 	import { Button } from './common'
 	import FlowEditor from './flows/FlowEditor.svelte'
 	import ScriptEditorDrawer from './flows/content/ScriptEditorDrawer.svelte'
+	import WorkspaceScriptSettingsDrawer from './flows/content/WorkspaceScriptSettingsDrawer.svelte'
 	import FlowEditorDrawer from './flows/content/FlowEditorDrawer.svelte'
 	import { dfs as dfsApply } from './flows/dfs'
 	import FlowImportExportMenu from './flows/header/FlowImportExportMenu.svelte'
@@ -540,6 +541,9 @@
 
 	const previewArgsStore = $state({ val: untrack(() => initialArgs) })
 	const scriptEditorDrawer = writable<ScriptEditorDrawer | undefined>(undefined)
+	const workspaceScriptSettingsDrawer = writable<WorkspaceScriptSettingsDrawer | undefined>(
+		undefined
+	)
 	const flowEditorDrawer = writable<FlowEditorDrawer | undefined>(undefined)
 	const history = initHistory(untrack(() => flowStore).val)
 	const pathStore = writable<string>(untrack(() => pathStoreInit) ?? initialPath)
@@ -589,6 +593,7 @@
 		currentEditor: writable(undefined),
 		previewArgs: previewArgsStore,
 		scriptEditorDrawer,
+		workspaceScriptSettingsDrawer,
 		flowEditorDrawer,
 		history,
 		flowStateStore: untrack(() => flowStateStore),
@@ -1139,6 +1144,7 @@
 		<FlowYamlEditor bind:drawer={yamlEditorDrawer} />
 		<FlowImportExportMenu bind:drawer={jsonViewerDrawer} />
 		<ScriptEditorDrawer bind:this={$scriptEditorDrawer} />
+		<WorkspaceScriptSettingsDrawer bind:this={$workspaceScriptSettingsDrawer} />
 		<FlowEditorDrawer bind:this={$flowEditorDrawer} />
 
 		<div bind:this={flowBuilderRoot} class="flex flex-col h-full">
diff --git a/frontend/src/lib/components/ScriptAdvancedSettings.svelte b/frontend/src/lib/components/ScriptAdvancedSettings.svelte
new file mode 100644
index 0000000000..67fadbe36a
--- /dev/null
+++ b/frontend/src/lib/components/ScriptAdvancedSettings.svelte
@@ -0,0 +1,286 @@
+<script lang="ts">
+	import { createBubbler } from 'svelte/legacy'
+	import Section from '$lib/components/Section.svelte'
+	import Label from '$lib/components/Label.svelte'
+	import Toggle from '$lib/components/Toggle.svelte'
+	import Tooltip from '$lib/components/Tooltip.svelte'
+	import Alert from '$lib/components/common/alert/Alert.svelte'
+	import { SecondsInput } from '$lib/components/common'
+	import WorkerTagPicker from '$lib/components/WorkerTagPicker.svelte'
+	import DebounceLimit from '$lib/components/flows/DebounceLimit.svelte'
+	import { enterpriseLicense } from '$lib/stores'
+	import { isCloudHosted } from '$lib/cloud'
+	import type { Schema } from '$lib/common'
+	import type { ScriptAdvancedSettingsFields } from './scriptSettings'
+
+	const bubble = createBubbler()
+
+	interface Props {
+		script: ScriptAdvancedSettingsFields
+		// Workspace to read worker tags from (defaults to $workspaceStore inside the picker).
+		workspaceId?: string | undefined
+	}
+
+	let { script = $bindable(), workspaceId = undefined }: Props = $props()
+</script>
+
+<div class="flex flex-col gap-8">
+	<Section label="Worker group tag (queue)">
+		{#snippet header()}
+			<Tooltip documentationLink="https://www.windmill.dev/docs/core_concepts/worker_groups">
+				The script will be executed on a worker configured to listen to this worker group tag
+				(queue). For instance, you could setup an "highmem", or "gpu" tag.
+			</Tooltip>
+		{/snippet}
+		<WorkerTagPicker bind:tag={script.tag} {workspaceId} />
+	</Section>
+
+	<Section label="Concurrency limits" eeOnly>
+		{#snippet header()}
+			<Tooltip documentationLink="https://www.windmill.dev/docs/core_concepts/concurrency_limits">
+				Allowed concurrency within a given timeframe
+			</Tooltip>
+		{/snippet}
+		<Toggle
+			size="sm"
+			checked={Boolean(script.concurrent_limit)}
+			on:change={() => {
+				if (script.concurrent_limit && script.concurrent_limit != undefined) {
+					script.concurrent_limit = undefined
+					script.concurrency_time_window_s = undefined
+					script.concurrency_key = undefined
+				} else {
+					script.concurrent_limit = 1
+				}
+			}}
+			options={{ right: 'Concurrency limits' }}
+		/>
+		{#if Boolean(script.concurrent_limit)}
+			<div class="flex flex-col gap-4 mt-2">
+				<Label label="Max number of executions within the time window">
+					<div class="flex flex-row gap-2 max-w-sm whitespace-nowrap">
+						<input
+							disabled={!$enterpriseLicense}
+							bind:value={script.concurrent_limit}
+							type="number"
+						/>
+					</div>
+				</Label>
+				<Label label="Time window in seconds">
+					<SecondsInput
+						disabled={!$enterpriseLicense}
+						bind:seconds={script.concurrency_time_window_s}
+					/>
+				</Label>
+				<Label label="Custom concurrency key (optional)">
+					{#snippet header()}
+						<Tooltip
+							documentationLink="https://www.windmill.dev/docs/core_concepts/concurrency_limits#custom-concurrency-key"
+						>
+							Concurrency keys are global, you can have them be workspace specific using the
+							variable `$workspace`. You can also use an argument's value using `$args[name_of_arg]`</Tooltip
+						>
+					{/snippet}
+					<input
+						disabled={!$enterpriseLicense}
+						type="text"
+						bind:value={script.concurrency_key}
+						placeholder={`$workspace/script/${script.path ?? ''}-$args[foo]`}
+					/>
+				</Label>
+			</div>
+		{/if}
+	</Section>
+
+	<Section label="Cache">
+		{#snippet header()}
+			<Tooltip documentationLink="https://www.windmill.dev/docs/core_concepts/caching">
+				Cache the results for each possible inputs
+			</Tooltip>
+		{/snippet}
+		<div class="flex gap-2 shrink flex-col">
+			<Toggle
+				size="sm"
+				bind:checked={() => !!script.cache_ttl, (v) => (script.cache_ttl = v ? 300 : undefined)}
+				options={{ right: 'Cache the results for each possible inputs' }}
+			/>
+			{#if script.cache_ttl}
+				<div class="text-2xs text-secondary">How long to keep the cache valid</div>
+				<SecondsInput bind:seconds={script.cache_ttl} />
+				<Toggle
+					size="2xs"
+					bind:checked={
+						() => script.cache_ignore_s3_path, (v) => (script.cache_ignore_s3_path = v || undefined)
+					}
+					options={{
+						right: 'Ignore S3 Object paths for caching purposes',
+						rightTooltip:
+							'If two S3 objects passed as input have the same content, they will hit the same cache entry, regardless of their path.'
+					}}
+				/>
+			{/if}
+		</div>
+	</Section>
+
+	<Section label="Timeout">
+		{#snippet header()}
+			<Tooltip documentationLink="https://www.windmill.dev/docs/script_editor/settings#timeout">
+				Add a custom timeout for this script
+			</Tooltip>
+		{/snippet}
+		<div class="flex gap-2 shrink flex-col">
+			<Toggle
+				size="sm"
+				checked={Boolean(script.timeout)}
+				on:change={() => {
+					if (script.timeout && script.timeout != undefined) {
+						script.timeout = undefined
+					} else {
+						script.timeout = 300
+					}
+				}}
+				options={{ right: 'Add a custom timeout for this script' }}
+			/>
+			{#if Boolean(script.timeout)}
+				<span class="text-xs font-semibold text-emphasis leading-none mt-2">Timeout duration</span>
+				<SecondsInput bind:seconds={script.timeout} />
+			{/if}
+		</div>
+	</Section>
+
+	<Section label="Debouncing">
+		{#snippet header()}
+			<Tooltip documentationLink="https://www.windmill.dev/docs/core_concepts/job_debouncing">
+				Debounce Jobs
+			</Tooltip>
+		{/snippet}
+		<DebounceLimit
+			size="sm"
+			bind:debounce_delay_s={script.debounce_delay_s}
+			bind:debounce_key={script.debounce_key}
+			bind:debounce_args_to_accumulate={script.debounce_args_to_accumulate}
+			bind:max_total_debouncing_time={script.max_total_debouncing_time}
+			bind:max_total_debounces_amount={script.max_total_debounces_amount}
+			schema={script.schema as Schema}
+			placeholder={`$workspace/script/${script.path ?? ''}-$args[foo]`}
+		/>
+	</Section>
+
+	<Section label="Perpetual script">
+		{#snippet header()}
+			<Tooltip documentationLink="https://www.windmill.dev/docs/script_editor/perpetual_scripts">
+				Restart the script upon ending unless cancelled
+			</Tooltip>
+		{/snippet}
+		<Toggle
+			size="sm"
+			checked={Boolean(script.restart_unless_cancelled)}
+			on:change={() => {
+				script.restart_unless_cancelled = script.restart_unless_cancelled ? undefined : true
+			}}
+			options={{ right: 'Restart upon ending unless cancelled' }}
+		/>
+	</Section>
+
+	<Section label="Dedicated workers" eeOnly>
+		{#snippet header()}
+			<Tooltip documentationLink="https://www.windmill.dev/docs/core_concepts/dedicated_workers">
+				In this mode, the script is meant to be run on dedicated workers that run the script at
+				native speed. Can reach &gt;1500rps per dedicated worker. Only available on enterprise
+				edition and for Python3, Deno, Bun and Bunnative.
+			</Tooltip>
+		{/snippet}
+		<Toggle
+			disabled={!$enterpriseLicense ||
+				isCloudHosted() ||
+				(script.language != 'bun' &&
+					script.language != 'bunnative' &&
+					script.language != 'python3' &&
+					script.language != 'deno')}
+			size="sm"
+			checked={Boolean(script.dedicated_worker)}
+			on:change={() => {
+				script.dedicated_worker = script.dedicated_worker ? undefined : true
+			}}
+			options={{ right: 'Script is run on dedicated workers' }}
+		/>
+		{#if script.dedicated_worker}
+			<div class="py-2">
+				<Alert type="info" title="Require dedicated workers">
+					A worker group needs to be configured to listen to this script. Select it in the dedicated
+					workers section of the worker group configuration.
+				</Alert>
+			</div>
+		{/if}
+	</Section>
+
+	<Section label="Delete after completion">
+		{#snippet header()}
+			<Tooltip
+				documentationLink="https://www.windmill.dev/docs/script_editor/settings#delete-after-use"
+			>
+				The logs, arguments and results of the job will be completely deleted from Windmill after
+				the specified delay once it is complete. Set to 0 for immediate deletion. The deletion is
+				irreversible. This settings ONLY applies when the script is used within a flow or triggered
+				synchronously.
+				{#if !$enterpriseLicense}
+					This option is only available on Windmill Enterprise Edition.
+				{/if}
+			</Tooltip>
+		{/snippet}
+		<div class="flex gap-2 shrink flex-col">
+			<Toggle
+				disabled={!$enterpriseLicense}
+				size="sm"
+				checked={script.delete_after_secs != null}
+				on:change={() => {
+					script.delete_after_secs = script.delete_after_secs != null ? undefined : 0
+				}}
+				options={{ right: 'Delete logs, arguments and results after completion' }}
+			/>
+			{#if script.delete_after_secs != null}
+				<SecondsInput bind:seconds={script.delete_after_secs} disabled={!$enterpriseLicense} />
+			{/if}
+		</div>
+	</Section>
+
+	{#if !isCloudHosted()}
+		<Section label="High priority script" eeOnly>
+			{#snippet header()}
+				<Tooltip
+					documentationLink="https://www.windmill.dev/docs/core_concepts/jobs#high-priority-jobs"
+				>
+					Jobs from script labeled as high priority take precedence over the other jobs when in the
+					jobs queue.
+					{#if !$enterpriseLicense}This is a feature only available on enterprise edition.{/if}
+				</Tooltip>
+			{/snippet}
+			<Toggle
+				disabled={!$enterpriseLicense || isCloudHosted()}
+				size="sm"
+				checked={script.priority !== undefined && script.priority > 0}
+				on:change={() => {
+					script.priority = script.priority ? undefined : 100
+				}}
+				options={{ right: 'Label as high priority' }}
+			>
+				{#snippet right()}
+					<input
+						type="number"
+						class="!w-16 ml-4"
+						disabled={script.priority === undefined}
+						bind:value={script.priority}
+						onfocus={bubble('focus')}
+						onchange={() => {
+							if (script.priority && script.priority > 100) {
+								script.priority = 100
+							} else if (script.priority && script.priority < 0) {
+								script.priority = 0
+							}
+						}}
+					/>
+				{/snippet}
+			</Toggle>
+		</Section>
+	{/if}
+</div>
diff --git a/frontend/src/lib/components/ScriptBuilder.svelte b/frontend/src/lib/components/ScriptBuilder.svelte
index 831cabb498..4007f3bf0f 100644
--- a/frontend/src/lib/components/ScriptBuilder.svelte
+++ b/frontend/src/lib/components/ScriptBuilder.svelte
@@ -87,6 +87,7 @@
 	import DefaultScripts from './DefaultScripts.svelte'
 	import { getContext, onMount, setContext, tick, untrack } from 'svelte'
 	import EditorHeader from './EditorHeader.svelte'
+	import ScriptSettingsBadges from './ScriptSettingsBadges.svelte'
 	import AutosaveIndicator from './AutosaveIndicator.svelte'
 	import LabelsInput from './LabelsInput.svelte'
 
@@ -1971,6 +1972,20 @@
 							{onOpenOthersDrafts}
 						/>
 					{/if}
+					{#if !condensedHeader}
+						{@const canOpenRuntime =
+							customUi?.topBar?.settings != false &&
+							customUi?.settingsPanel?.disableRuntime !== true}
+						<ScriptSettingsBadges
+							settings={script}
+							onclick={canOpenRuntime
+								? () => {
+										selectedTab = 'runtime'
+										metadataOpen = true
+									}
+								: undefined}
+						/>
+					{/if}
 				</div>
 
 				<!-- Separator -->
diff --git a/frontend/src/lib/components/ScriptSettingsBadges.svelte b/frontend/src/lib/components/ScriptSettingsBadges.svelte
new file mode 100644
index 0000000000..8d73609891
--- /dev/null
+++ b/frontend/src/lib/components/ScriptSettingsBadges.svelte
@@ -0,0 +1,42 @@
+<script lang="ts">
+	import Badge from '$lib/components/common/badge/Badge.svelte'
+	import Popover from '$lib/components/Popover.svelte'
+	import {
+		getActiveScriptSettingsBadges,
+		type ScriptAdvancedSettingsFields
+	} from './scriptSettings'
+
+	interface Props {
+		settings: ScriptAdvancedSettingsFields | undefined
+		// When provided, badges become clickable and call this with the badge key
+		// (e.g. to open the settings drawer focused on that section).
+		onclick?: (key: string) => void
+		small?: boolean
+	}
+
+	let { settings, onclick, small = true }: Props = $props()
+
+	let badges = $derived(getActiveScriptSettingsBadges(settings))
+</script>
+
+{#if badges.length > 0}
+	<div class="flex flex-row flex-wrap gap-1 items-center">
+		{#each badges as badge (badge.key)}
+			<!-- Icon-only chips to save space in crowded top bars; the label and current
+				value are shown in the hover popover. -->
+			<Popover notClickable placement="bottom">
+				<Badge
+					color="blue"
+					{small}
+					icon={{ icon: badge.icon, position: 'left' }}
+					clickable={Boolean(onclick)}
+					onclick={onclick ? () => onclick?.(badge.key) : undefined}
+					aria-label={`${badge.label}: ${badge.detail}`}
+				/>
+				{#snippet text()}
+					<span class="font-semibold">{badge.label}</span> — {badge.detail}
+				{/snippet}
+			</Popover>
+		{/each}
+	</div>
+{/if}
diff --git a/frontend/src/lib/components/flows/content/FlowModuleCache.svelte b/frontend/src/lib/components/flows/content/FlowModuleCache.svelte
index f9744af36c..99fc4c7b3a 100644
--- a/frontend/src/lib/components/flows/content/FlowModuleCache.svelte
+++ b/frontend/src/lib/components/flows/content/FlowModuleCache.svelte
@@ -6,12 +6,29 @@
 
 	import type { FlowModule } from '$lib/gen'
 	import { SecondsInput } from '../../common'
+	import WorkspaceScriptSettingInfo from './WorkspaceScriptSettingInfo.svelte'
 
 	interface Props {
 		flowModule: FlowModule
+		// For workspace-script steps: the cache_ttl currently set on the referenced
+		// script, and a shortcut to edit it. Undefined for inline/subflow steps.
+		workspaceScriptCacheTtl?: number | undefined
+		loadingWorkspaceScript?: boolean
+		workspaceScriptError?: string | undefined
+		canEditWorkspaceScript?: boolean
+		workspaceScriptNoEditReason?: string | undefined
+		onEditWorkspaceScript?: () => void
 	}
 
-	let { flowModule = $bindable() }: Props = $props()
+	let {
+		flowModule = $bindable(),
+		workspaceScriptCacheTtl = undefined,
+		loadingWorkspaceScript = false,
+		workspaceScriptError = undefined,
+		canEditWorkspaceScript = false,
+		workspaceScriptNoEditReason = undefined,
+		onEditWorkspaceScript
+	}: Props = $props()
 
 	let isCacheEnabled = $derived(Boolean(flowModule.cache_ttl))
 </script>
@@ -25,10 +42,22 @@
 		</Tooltip>
 	{/snippet}
 
-	{#if flowModule.value.type != 'rawscript'}
+	{#if flowModule.value.type == 'script'}
+		<WorkspaceScriptSettingInfo
+			label="Cache"
+			active={workspaceScriptCacheTtl != undefined}
+			valueText={workspaceScriptCacheTtl != undefined
+				? `Cached for ${workspaceScriptCacheTtl}s`
+				: undefined}
+			loading={loadingWorkspaceScript}
+			error={workspaceScriptError}
+			canEdit={canEditWorkspaceScript}
+			noEditReason={workspaceScriptNoEditReason}
+			onEdit={onEditWorkspaceScript}
+		/>
+	{:else if flowModule.value.type != 'rawscript'}
 		<p class="text-xs text-secondary">
-			The cache settings need to be set in the referenced script/flow settings directly. Cache for
-			hub scripts is not available yet.
+			The cache settings need to be set in the referenced flow settings directly.
 		</p>
 	{:else}
 		<Toggle
diff --git a/frontend/src/lib/components/flows/content/FlowModuleComponent.svelte b/frontend/src/lib/components/flows/content/FlowModuleComponent.svelte
index 5160836a32..fc5f69265f 100644
--- a/frontend/src/lib/components/flows/content/FlowModuleComponent.svelte
+++ b/frontend/src/lib/components/flows/content/FlowModuleComponent.svelte
@@ -55,6 +55,10 @@
 	import { type Job } from '$lib/gen'
 	import { workspaceStore } from '$lib/stores'
 	import { checkIfParentLoop } from '../utils.svelte'
+	import { useWorkspaceScriptSettings } from '../useWorkspaceScriptSettings.svelte'
+	import ScriptSettingsBadges from '$lib/components/ScriptSettingsBadges.svelte'
+	import { getActiveScriptSettingsBadges } from '$lib/components/scriptSettings'
+	import WorkspaceScriptSettingInfo from './WorkspaceScriptSettingInfo.svelte'
 	import ModulePreviewResultViewer from '$lib/components/ModulePreviewResultViewer.svelte'
 	import LogViewer from '$lib/components/LogViewer.svelte'
 	import DisplayResult from '$lib/components/DisplayResult.svelte'
@@ -95,7 +99,8 @@
 		saveDraft,
 		customUi,
 		executionCount,
-		opWorkspace
+		opWorkspace,
+		workspaceScriptSettingsDrawer
 	} = getContext<FlowEditorContext>('FlowEditorContext')
 
 	const selectedId = $derived(selectionManager.getSelectedId())
@@ -180,6 +185,59 @@
 	let assets = $derived((flowModule.value.type === 'rawscript' && flowModule.value.assets) || [])
 	const flowGraphAssetsCtx = getContext<FlowGraphAssetContext | undefined>('FlowGraphAssetContext')
 
+	// For workspace-script steps, load the referenced script's advanced settings so
+	// the delegating settings tabs (concurrency, cache, ...) can show current values
+	// and offer an "Edit script settings" shortcut instead of a bare warning.
+	const referencedScriptSettings = useWorkspaceScriptSettings(
+		() => (flowModule.value.type === 'script' ? flowModule.value.path : undefined),
+		() => (flowModule.value.type === 'script' ? flowModule.value.hash : undefined),
+		() => opWs
+	)
+	// Hub scripts, hash-pinned steps, and embeddings that disable script editing
+	// can't have their settings edited from here. The drawer must also be mounted:
+	// local-dev editors (Dev.svelte / flows/dev) provide the context store but never
+	// render the drawer, so editing there would be a no-op — keep values read-only.
+	let canEditWorkspaceScriptSettings = $derived(
+		flowModule.value.type === 'script' &&
+			!flowModule.value.path?.startsWith('hub/') &&
+			flowModule.value.hash == undefined &&
+			customUi?.scriptEdit != false &&
+			$workspaceScriptSettingsDrawer != undefined
+	)
+	let workspaceScriptNoEditReason = $derived(
+		flowModule.value.type !== 'script' || canEditWorkspaceScriptSettings
+			? undefined
+			: flowModule.value.path?.startsWith('hub/')
+				? 'Hub scripts cannot be edited from here.'
+				: flowModule.value.hash != undefined
+					? 'Steps pinned to a specific version cannot be edited from here.'
+					: 'Editing script settings is not available in this editor.'
+	)
+	// Non-positive concurrent_limit / cache_ttl are treated as unset by the runtime (legacy rows).
+	let referencedConcurrentLimit = $derived(
+		referencedScriptSettings.settings?.concurrent_limit != undefined &&
+			referencedScriptSettings.settings.concurrent_limit > 0
+			? referencedScriptSettings.settings.concurrent_limit
+			: undefined
+	)
+	let referencedCacheTtl = $derived(
+		referencedScriptSettings.settings?.cache_ttl != undefined &&
+			referencedScriptSettings.settings.cache_ttl > 0
+			? referencedScriptSettings.settings.cache_ttl
+			: undefined
+	)
+	function openWorkspaceScriptSettings() {
+		if (flowModule.value.type !== 'script') return
+		$workspaceScriptSettingsDrawer?.openDrawer(
+			flowModule.value.path,
+			flowModule.value.hash,
+			async () => {
+				await referencedScriptSettings.reload()
+				forceReload++
+			}
+		)
+	}
+
 	// UI Intent handling for AI tool control
 	useUiIntent(`flow-${flowModule.id}`, {
 		openTab: (tab) => {
@@ -770,6 +828,9 @@
 								flowModule.value.hash = await getLatestHashForScript(flowModule.value.path, opWs)
 							}
 							forceReload++
+							// Keep the surfaced concurrency/cache values and badges in sync after
+							// a settings/code save from the header (path/hash may be unchanged).
+							await referencedScriptSettings.reload()
 							await reload(flowModule)
 						}
 						if (flowModule.value.type == 'flow') {
@@ -991,6 +1052,16 @@
 						{:else if flowModule.value.type === 'script'}
 							{#if !noEditor && (customUi?.hubCode != false || !flowModule?.value?.path?.startsWith('hub/'))}
 								<div class="border-t">
+									{#if referencedScriptSettings.settings && getActiveScriptSettingsBadges(referencedScriptSettings.settings).length > 0}
+										<div class="flex flex-row items-center gap-2 px-2 pt-2 flex-wrap">
+											<ScriptSettingsBadges
+												settings={referencedScriptSettings.settings}
+												onclick={canEditWorkspaceScriptSettings
+													? openWorkspaceScriptSettings
+													: undefined}
+											/>
+										</div>
+									{/if}
 									{#key forceReload}
 										<FlowModuleScript
 											bind:tag={workspaceScriptTag}
@@ -1251,11 +1322,30 @@
 																placeholder={`$workspace/script/${$pathStore}-$args[foo]`}
 															/>
 														</Label>
+													{:else if flowModule.value.type == 'script'}
+														<WorkspaceScriptSettingInfo
+															label="Concurrency limit"
+															active={referencedConcurrentLimit != undefined}
+															valueText={referencedConcurrentLimit != undefined
+																? `Max ${referencedConcurrentLimit} execution${
+																		referencedConcurrentLimit === 1 ? '' : 's'
+																	}${
+																		referencedScriptSettings.settings?.concurrency_time_window_s !=
+																		undefined
+																			? ` within ${referencedScriptSettings.settings.concurrency_time_window_s}s`
+																			: ''
+																	}`
+																: undefined}
+															loading={referencedScriptSettings.loading}
+															error={referencedScriptSettings.error}
+															canEdit={canEditWorkspaceScriptSettings}
+															noEditReason={workspaceScriptNoEditReason}
+															onEdit={openWorkspaceScriptSettings}
+														/>
 													{:else}
 														<Alert type="warning" title="Limitation" size="xs">
-															The concurrency limit of a workspace script is only settable in the
-															script metadata itself. For hub scripts, this feature is non available
-															yet.
+															The concurrency limit of a referenced flow is only settable in the
+															flow settings directly.
 														</Alert>
 													{/if}
 												</Section>
@@ -1322,7 +1412,15 @@
 												</div>
 											{:else if advancedSelected === 'cache'}
 												<div>
-													<FlowModuleCache bind:flowModule />
+													<FlowModuleCache
+														bind:flowModule
+														workspaceScriptCacheTtl={referencedCacheTtl}
+														loadingWorkspaceScript={referencedScriptSettings.loading}
+														workspaceScriptError={referencedScriptSettings.error}
+														canEditWorkspaceScript={canEditWorkspaceScriptSettings}
+														{workspaceScriptNoEditReason}
+														onEditWorkspaceScript={openWorkspaceScriptSettings}
+													/>
 												</div>
 											{:else if advancedSelected === 'early-stop'}
 												<FlowModuleEarlyStop bind:flowModule />
diff --git a/frontend/src/lib/components/flows/content/FlowModuleHeader.svelte b/frontend/src/lib/components/flows/content/FlowModuleHeader.svelte
index c3d6742b54..b34a78e1db 100644
--- a/frontend/src/lib/components/flows/content/FlowModuleHeader.svelte
+++ b/frontend/src/lib/components/flows/content/FlowModuleHeader.svelte
@@ -13,7 +13,8 @@
 		Repeat,
 		Square,
 		Pin,
-		Save
+		Save,
+		Settings
 	} from 'lucide-svelte'
 	import Popover from '../../Popover.svelte'
 	import type { FlowEditorContext } from '../types'
@@ -28,7 +29,7 @@
 	}
 
 	let { module, tag }: Props = $props()
-	const { scriptEditorDrawer, flowEditorDrawer, opWorkspace } =
+	const { scriptEditorDrawer, workspaceScriptSettingsDrawer, flowEditorDrawer, opWorkspace } =
 		getContext<FlowEditorContext>('FlowEditorContext')
 
 	const dispatch = createEventDispatcher()
@@ -107,26 +108,54 @@
 	{/if}
 	{#if module.value.type === 'script'}
 		{#if !module.value.path.startsWith('hub/') && customUi?.scriptEdit != false}
-			<Button
-				unifiedSize="sm"
-				variant="subtle"
-				onClick={async () => {
-					if (module.value.type == 'script') {
-						const hash =
-							module.value.hash ??
-							(await getLatestHashForScript(module.value.path, opWorkspace?.()))
-						$scriptEditorDrawer?.openDrawer(hash, () => {
-							dispatch('reload')
-							sendUserToast('Script has been updated')
-						})
-					}
-				}}
-				startIcon={{ icon: Pen }}
-				iconOnly={false}
-				disabled={module.value.hash != undefined}
-			>
-				Edit
-			</Button>
+			<Popover notClickable placement="bottom">
+				<Button
+					unifiedSize="sm"
+					variant="subtle"
+					onClick={async () => {
+						if (module.value.type == 'script') {
+							const hash =
+								module.value.hash ??
+								(await getLatestHashForScript(module.value.path, opWorkspace?.()))
+							$scriptEditorDrawer?.openDrawer(hash, () => {
+								dispatch('reload')
+								sendUserToast('Script has been updated')
+							})
+						}
+					}}
+					startIcon={{ icon: Pen }}
+					iconOnly
+					aria-label="Edit the script's code"
+					disabled={module.value.hash != undefined}
+				/>
+				{#snippet text()}Edit the script's code{/snippet}
+			</Popover>
+			<!-- Only when the settings drawer is actually mounted (not in the local-dev
+				editors, which provide the context store but never render it). -->
+			{#if $workspaceScriptSettingsDrawer}
+				<Popover notClickable placement="bottom">
+					<Button
+						unifiedSize="sm"
+						variant="subtle"
+						onClick={() => {
+							if (module.value.type == 'script') {
+								$workspaceScriptSettingsDrawer?.openDrawer(
+									module.value.path,
+									module.value.hash,
+									() => {
+										dispatch('reload')
+									}
+								)
+							}
+						}}
+						startIcon={{ icon: Settings }}
+						iconOnly
+						aria-label="Edit the script's runtime settings"
+						disabled={module.value.hash != undefined}
+					/>
+					{#snippet text()}Edit the script's runtime settings (concurrency, cache, timeout, ...){/snippet}
+				</Popover>
+			{/if}
 		{/if}
 		{#if customUi?.tagEdit != false}
 			<FlowModuleWorkerTagSelect
@@ -139,15 +168,17 @@
 			/>
 		{/if}
 		{#if customUi?.scriptFork != false}
-			<Button
-				unifiedSize="sm"
-				variant="subtle"
-				on:click={() => dispatch('fork')}
-				startIcon={{ icon: GitFork }}
-				iconOnly={false}
-			>
-				Fork
-			</Button>
+			<Popover notClickable placement="bottom">
+				<Button
+					unifiedSize="sm"
+					variant="subtle"
+					on:click={() => dispatch('fork')}
+					startIcon={{ icon: GitFork }}
+					iconOnly
+					aria-label="Fork into an inline script"
+				/>
+				{#snippet text()}Fork into an inline script{/snippet}
+			</Popover>
 		{/if}
 	{:else if module.value.type === 'flow'}
 		<Button
diff --git a/frontend/src/lib/components/flows/content/ScriptEditorDrawer.svelte b/frontend/src/lib/components/flows/content/ScriptEditorDrawer.svelte
index 7156b19462..538bcf26c7 100644
--- a/frontend/src/lib/components/flows/content/ScriptEditorDrawer.svelte
+++ b/frontend/src/lib/components/flows/content/ScriptEditorDrawer.svelte
@@ -6,10 +6,14 @@
 	import { ScriptService, type Preview, type Script } from '$lib/gen'
 	import { inferArgs } from '$lib/infer'
 	import { workspaceStore } from '$lib/stores'
-	import { Loader2, Save, DiffIcon } from 'lucide-svelte'
+	import { Loader2, Save, DiffIcon, Settings } from 'lucide-svelte'
+	import ScriptAdvancedSettings from '$lib/components/ScriptAdvancedSettings.svelte'
+	import ScriptSettingsBadges from '$lib/components/ScriptSettingsBadges.svelte'
+	import Popover from '$lib/components/Popover.svelte'
 	import {
 		cleanValueProperties,
 		emptySchema,
+		emptyString,
 		orderedJsonStringify,
 		sendUserToast
 	} from '$lib/utils'
@@ -56,6 +60,20 @@
 				on_behalf_of_email?: string
 				auto_kind?: string
 				has_preprocessor?: boolean
+				concurrent_limit?: number
+				concurrency_time_window_s?: number
+				concurrency_key?: string
+				cache_ttl?: number
+				cache_ignore_s3_path?: boolean
+				timeout?: number
+				debounce_delay_s?: number
+				debounce_key?: string
+				debounce_args_to_accumulate?: string[]
+				max_total_debouncing_time?: number
+				max_total_debounces_amount?: number
+				restart_unless_cancelled?: boolean
+				priority?: number
+				delete_after_secs?: number
 		  }
 		| undefined = $state(undefined)
 
@@ -77,6 +95,20 @@
 				on_behalf_of_email?: string
 				auto_kind?: string
 				has_preprocessor?: boolean
+				concurrent_limit?: number
+				concurrency_time_window_s?: number
+				concurrency_key?: string
+				cache_ttl?: number
+				cache_ignore_s3_path?: boolean
+				timeout?: number
+				debounce_delay_s?: number
+				debounce_key?: string
+				debounce_args_to_accumulate?: string[]
+				max_total_debouncing_time?: number
+				max_total_debounces_amount?: number
+				restart_unless_cancelled?: boolean
+				priority?: number
+				delete_after_secs?: number
 		  }
 		| undefined = $state(undefined)
 
@@ -102,6 +134,11 @@
 						is_template: false,
 						tag: script.tag,
 						kind: script.kind as Script['kind'] | undefined,
+						// Empty keys are shared global keys server-side; treat cleared inputs as unset.
+						concurrency_key: emptyString(script.concurrency_key)
+							? undefined
+							: script.concurrency_key,
+						debounce_key: emptyString(script.debounce_key) ? undefined : script.debounce_key,
 						lock: undefined
 					}
 				})
@@ -135,6 +172,7 @@
 	let args = $state({})
 
 	let displayEditor = $state(true)
+	let settingsDrawer: Drawer | undefined = $state()
 </script>
 
 <ConfirmationModal
@@ -239,6 +277,20 @@
 			</div>
 		{/if}
 		{#snippet actions()}
+			{#if script}
+				<ScriptSettingsBadges settings={script} onclick={() => settingsDrawer?.openDrawer()} />
+			{/if}
+			<Popover notClickable placement="bottom">
+				<Button
+					disabled={!script}
+					variant="default"
+					iconOnly
+					startIcon={{ icon: Settings }}
+					aria-label="Runtime settings"
+					on:click={() => settingsDrawer?.openDrawer()}
+				/>
+				{#snippet text()}Runtime settings (concurrency, cache, timeout, ...){/snippet}
+			</Popover>
 			<Button
 				disabled={!savedScript || !script}
 				variant="default"
@@ -290,3 +342,19 @@
 		displayEditor = true
 	}}
 />
+
+<Drawer bind:this={settingsDrawer} size="600px">
+	<DrawerContent title="Script settings" on:close={() => settingsDrawer?.closeDrawer()}>
+		{#if script}
+			<div class="flex flex-col gap-4">
+				<p class="text-xs text-secondary">
+					These runtime settings are saved together with the script when you press Save.
+				</p>
+				<ScriptAdvancedSettings {script} workspaceId={opWs} />
+			</div>
+		{/if}
+		{#snippet actions()}
+			<Button variant="border" on:click={() => settingsDrawer?.closeDrawer()}>Done</Button>
+		{/snippet}
+	</DrawerContent>
+</Drawer>
diff --git a/frontend/src/lib/components/flows/content/WorkspaceScriptSettingInfo.svelte b/frontend/src/lib/components/flows/content/WorkspaceScriptSettingInfo.svelte
new file mode 100644
index 0000000000..505474c24c
--- /dev/null
+++ b/frontend/src/lib/components/flows/content/WorkspaceScriptSettingInfo.svelte
@@ -0,0 +1,61 @@
+<script lang="ts">
+	import Button from '$lib/components/common/button/Button.svelte'
+	import { Loader2, Settings } from 'lucide-svelte'
+
+	interface Props {
+		// Human label of the setting, e.g. "Concurrency limit" or "Cache".
+		label: string
+		// Whether the setting is currently configured on the referenced script.
+		active: boolean
+		// Rendered summary of the current value (only shown when active).
+		valueText?: string | undefined
+		loading?: boolean
+		// Set when loading the referenced script failed, to distinguish that from "not set".
+		error?: string | undefined
+		// Editing is possible only for non-hub, non-hash-pinned workspace scripts.
+		canEdit: boolean
+		// Explanation shown when editing isn't possible (varies: hub, pinned, dev editor).
+		noEditReason?: string | undefined
+		onEdit?: () => void
+	}
+
+	let {
+		label,
+		active,
+		valueText,
+		loading = false,
+		error = undefined,
+		canEdit,
+		noEditReason = undefined,
+		onEdit
+	}: Props = $props()
+</script>
+
+<div class="flex flex-col gap-2 rounded-md border p-3 bg-surface-secondary">
+	<div class="flex flex-row items-center justify-between gap-2">
+		<span class="text-xs text-secondary">
+			{label} is managed on the referenced workspace script.
+		</span>
+		{#if canEdit}
+			<Button size="xs" variant="border" startIcon={{ icon: Settings }} on:click={() => onEdit?.()}>
+				Edit script settings
+			</Button>
+		{/if}
+	</div>
+	<div class="text-xs">
+		{#if loading}
+			<span class="text-tertiary inline-flex items-center gap-1">
+				<Loader2 class="animate-spin" size={12} /> Loading current value…
+			</span>
+		{:else if error}
+			<span class="text-red-500">Could not load the current value: {error}</span>
+		{:else if active}
+			<span class="font-semibold text-emphasis">{valueText}</span>
+		{:else}
+			<span class="text-tertiary">Not set on the script.</span>
+		{/if}
+	</div>
+	{#if !canEdit && noEditReason}
+		<span class="text-2xs text-tertiary">{noEditReason}</span>
+	{/if}
+</div>
diff --git a/frontend/src/lib/components/flows/content/WorkspaceScriptSettingsDrawer.svelte b/frontend/src/lib/components/flows/content/WorkspaceScriptSettingsDrawer.svelte
new file mode 100644
index 0000000000..3a88e6214a
--- /dev/null
+++ b/frontend/src/lib/components/flows/content/WorkspaceScriptSettingsDrawer.svelte
@@ -0,0 +1,150 @@
+<script lang="ts">
+	import { Button, Drawer, DrawerContent } from '$lib/components/common'
+	import Alert from '$lib/components/common/alert/Alert.svelte'
+	import ScriptAdvancedSettings from '$lib/components/ScriptAdvancedSettings.svelte'
+	import ScriptSettingsBadges from '$lib/components/ScriptSettingsBadges.svelte'
+	import { ScriptService, type Script } from '$lib/gen'
+	import { workspaceStore } from '$lib/stores'
+	import { emptyString, sendUserToast } from '$lib/utils'
+	import { Loader2, Save } from 'lucide-svelte'
+	import { getContext } from 'svelte'
+	import type { FlowEditorContext } from '../types'
+
+	const flowEditorContext = getContext<FlowEditorContext>('FlowEditorContext')
+	let opWs = $derived(flowEditorContext?.opWorkspace?.() ?? $workspaceStore)
+
+	let drawer: Drawer | undefined = $state()
+	// cache_ignore_s3_path lives on NewScript but not the returned Script type;
+	// ScriptAdvancedSettings still edits it, so widen the local type to keep it.
+	let script: (Script & { cache_ignore_s3_path?: boolean }) | undefined = $state(undefined)
+	let loading = $state(false)
+	let loadError = $state<string | undefined>(undefined)
+	let saving = $state(false)
+	let callback: (() => void) | undefined = undefined
+	let current: { path: string; hash: string | undefined } | undefined = undefined
+	// Guards against a slow load for a previously-opened script resolving after
+	// the drawer was reopened for a different one and overwriting its target.
+	let openSeq = 0
+
+	// Open the settings drawer for the workspace script referenced by `path`.
+	// A specific `hash` may be passed to load that version.
+	export async function openDrawer(
+		path: string,
+		hash: string | undefined,
+		cb?: () => void
+	): Promise<void> {
+		callback = cb
+		drawer?.openDrawer?.()
+		await load(path, hash)
+	}
+
+	async function load(path: string, hash: string | undefined): Promise<void> {
+		const seq = ++openSeq
+		script = undefined
+		loadError = undefined
+		current = { path, hash }
+		loading = true
+		// A save still in flight for the previous target no longer clears this flag
+		// (it is seq-guarded), so reset it here or the new target's Save stays disabled.
+		saving = false
+		try {
+			const loaded = hash
+				? await ScriptService.getScriptByHash({ workspace: opWs!, hash })
+				: await ScriptService.getScriptByPath({ workspace: opWs!, path })
+			if (seq !== openSeq) return
+			script = loaded
+		} catch (e) {
+			if (seq === openSeq) loadError = `${e?.body ?? e}`
+		} finally {
+			if (seq === openSeq) loading = false
+		}
+	}
+
+	async function save(): Promise<void> {
+		if (!script) return
+		// The drawer is a singleton: bind this save to the target that started it, so a
+		// reopen for another script can't receive its callback or get closed under the
+		// user. The captured callback still fires — it refreshes the script it belongs to.
+		const seq = openSeq
+		const cb = callback
+		saving = true
+		try {
+			// Spread the full loaded script so fields we don't edit here (codebase,
+			// labels, envs, on_behalf_of_email, ...) survive the new version; only
+			// override lineage and normalize the edited settings.
+			// parent_hash without auto_parent is an optimistic-concurrency guard: if the
+			// script was deployed elsewhere while the drawer was open, the save fails
+			// loudly (non-linear lineage) instead of silently reverting that deploy.
+			// preserve_on_behalf_of/skip_draft_deletion keep a settings-only save from
+			// hijacking the execution identity or discarding the author's code draft.
+			await ScriptService.createScript({
+				workspace: opWs!,
+				requestBody: {
+					...script,
+					summary: script.summary ?? '',
+					description: script.description ?? '',
+					parent_hash: script.hash,
+					lock: script.lock,
+					concurrency_key: emptyString(script.concurrency_key) ? undefined : script.concurrency_key,
+					debounce_key: emptyString(script.debounce_key) ? undefined : script.debounce_key,
+					preserve_on_behalf_of: true,
+					skip_draft_deletion: true
+				}
+			})
+			sendUserToast('Script settings saved')
+			cb?.()
+			if (seq === openSeq) drawer?.closeDrawer()
+		} catch (e) {
+			if (seq === openSeq) sendUserToast(`Could not save script settings: ${e.body ?? e}`, true)
+		} finally {
+			if (seq === openSeq) saving = false
+		}
+	}
+</script>
+
+<Drawer bind:this={drawer} size="600px">
+	<DrawerContent title="Script settings" on:close={() => drawer?.closeDrawer()}>
+		{#if loading}
+			<div class="center-center flex-col h-full text-tertiary">
+				<Loader2 class="animate-spin" size={16} />
+				<span class="text-xs mt-1">Loading</span>
+			</div>
+		{:else if loadError || !script}
+			<div class="center-center flex-col h-full gap-3">
+				<Alert type="error" title="Could not load script settings" size="xs">
+					{loadError ?? 'Script not found.'}
+				</Alert>
+				{#if current}
+					<Button
+						size="xs"
+						variant="border"
+						on:click={() => current && load(current.path, current.hash)}
+					>
+						Retry
+					</Button>
+				{/if}
+			</div>
+		{:else}
+			<div class="flex flex-col gap-4">
+				<div class="flex flex-row items-center gap-2 flex-wrap">
+					<span class="text-xs text-tertiary">{script.path}</span>
+					<ScriptSettingsBadges settings={script} />
+				</div>
+				<p class="text-xs text-secondary">
+					Saving creates a new version of the workspace script with these runtime settings. The code
+					is left unchanged.
+				</p>
+				<ScriptAdvancedSettings {script} workspaceId={opWs} />
+			</div>
+		{/if}
+		{#snippet actions()}
+			<Button
+				on:click={save}
+				disabled={!script || loading || saving}
+				startIcon={{ icon: saving ? Loader2 : Save }}
+			>
+				Save
+			</Button>
+		{/snippet}
+	</DrawerContent>
+</Drawer>
diff --git a/frontend/src/lib/components/flows/types.ts b/frontend/src/lib/components/flows/types.ts
index 41165865ae..a527bd765d 100644
--- a/frontend/src/lib/components/flows/types.ts
+++ b/frontend/src/lib/components/flows/types.ts
@@ -2,6 +2,7 @@ import type { Job, OpenFlow } from '$lib/gen'
 import type { History } from '$lib/history.svelte'
 import type { Writable } from 'svelte/store'
 import type ScriptEditorDrawer from './content/ScriptEditorDrawer.svelte'
+import type WorkspaceScriptSettingsDrawer from './content/WorkspaceScriptSettingsDrawer.svelte'
 import type FlowEditorDrawer from './content/FlowEditorDrawer.svelte'
 import type { FlowState } from './flowState'
 import type { FlowBuilderWhitelabelCustomUi } from '../custom_ui'
@@ -76,6 +77,7 @@ export type FlowEditorContext = {
 	currentEditor: Writable<CurrentEditor>
 	previewArgs: StateStore<Record<string, any>>
 	scriptEditorDrawer: Writable<ScriptEditorDrawer | undefined>
+	workspaceScriptSettingsDrawer: Writable<WorkspaceScriptSettingsDrawer | undefined>
 	flowEditorDrawer: Writable<FlowEditorDrawer | undefined>
 	history: History<OpenFlow>
 	pathStore: Writable<string>
diff --git a/frontend/src/lib/components/flows/useWorkspaceScriptSettings.svelte.ts b/frontend/src/lib/components/flows/useWorkspaceScriptSettings.svelte.ts
new file mode 100644
index 0000000000..861f85e7bf
--- /dev/null
+++ b/frontend/src/lib/components/flows/useWorkspaceScriptSettings.svelte.ts
@@ -0,0 +1,72 @@
+import { ScriptService } from '$lib/gen'
+import type { ScriptAdvancedSettingsFields } from '$lib/components/scriptSettings'
+
+// Loads the advanced runtime settings (concurrency, cache, timeout, ...) of the
+// workspace script referenced by a flow step, so the flow editor can surface the
+// current values instead of only a "set it on the script" warning. Reactive to
+// the path/hash/workspace getters; call reload() after saving new settings.
+export function useWorkspaceScriptSettings(
+	pathGetter: () => string | undefined,
+	hashGetter: () => string | undefined,
+	workspaceGetter: () => string | undefined
+) {
+	let settings = $state<ScriptAdvancedSettingsFields | undefined>(undefined)
+	let loading = $state(false)
+	let error = $state<string | undefined>(undefined)
+	// Guards against an older in-flight load resolving after a newer one and
+	// clobbering the displayed settings when path/hash change quickly.
+	let loadSeq = 0
+
+	async function load(
+		path: string | undefined,
+		hash: string | undefined,
+		workspace: string | undefined
+	) {
+		const seq = ++loadSeq
+		if (!path || !workspace || path.startsWith('hub/')) {
+			settings = undefined
+			error = undefined
+			// Clear here too: this supersedes any in-flight load, whose guarded
+			// finally can no longer reset loading, else the card spins forever.
+			loading = false
+			return
+		}
+		loading = true
+		error = undefined
+		try {
+			const script = hash
+				? await ScriptService.getScriptByHash({ workspace, hash })
+				: await ScriptService.getScriptByPath({ workspace, path })
+			if (seq !== loadSeq) return
+			settings = script as ScriptAdvancedSettingsFields
+		} catch (e) {
+			console.error('Could not load referenced script settings', e)
+			if (seq === loadSeq) {
+				settings = undefined
+				// Surface failure so cards distinguish "load failed" from "not set".
+				error = `${(e as { body?: string })?.body ?? e}`
+			}
+		} finally {
+			if (seq === loadSeq) loading = false
+		}
+	}
+
+	$effect(() => {
+		load(pathGetter(), hashGetter(), workspaceGetter())
+	})
+
+	return {
+		get settings() {
+			return settings
+		},
+		get loading() {
+			return loading
+		},
+		get error() {
+			return error
+		},
+		reload() {
+			return load(pathGetter(), hashGetter(), workspaceGetter())
+		}
+	}
+}
diff --git a/frontend/src/lib/components/scriptSettings.test.ts b/frontend/src/lib/components/scriptSettings.test.ts
new file mode 100644
index 0000000000..f010e3863a
--- /dev/null
+++ b/frontend/src/lib/components/scriptSettings.test.ts
@@ -0,0 +1,53 @@
+import { describe, it, expect } from 'vitest'
+import { getActiveScriptSettingsBadges } from './scriptSettings'
+
+describe('getActiveScriptSettingsBadges', () => {
+	it('returns no badges for undefined or empty settings', () => {
+		expect(getActiveScriptSettingsBadges(undefined)).toEqual([])
+		expect(getActiveScriptSettingsBadges({})).toEqual([])
+	})
+
+	it('only surfaces settings that are actually active', () => {
+		const keys = getActiveScriptSettingsBadges({
+			concurrent_limit: 3,
+			concurrency_time_window_s: 60,
+			cache_ttl: 600,
+			timeout: 120,
+			priority: 50,
+			tag: 'gpu'
+		}).map((b) => b.key)
+		expect(keys).toEqual(['concurrency', 'cache', 'timeout', 'priority', 'tag'])
+	})
+
+	it('treats a zero/absent priority and non-positive debounce as inactive', () => {
+		const keys = getActiveScriptSettingsBadges({
+			priority: 0,
+			debounce_delay_s: 0
+		}).map((b) => b.key)
+		expect(keys).toEqual([])
+	})
+
+	it('treats non-positive concurrency limits, timeouts and cache ttl as inactive (legacy zero rows)', () => {
+		const keys = getActiveScriptSettingsBadges({
+			concurrent_limit: 0,
+			timeout: 0,
+			cache_ttl: 0
+		}).map((b) => b.key)
+		expect(keys).toEqual([])
+	})
+
+	it('keeps delete_after_secs of 0 active (immediate deletion is a real setting)', () => {
+		const badge = getActiveScriptSettingsBadges({ delete_after_secs: 0 })
+		expect(badge.map((b) => b.key)).toEqual(['delete_after_use'])
+		expect(badge[0].detail).toContain('immediately')
+	})
+
+	it('pluralizes the concurrency detail correctly', () => {
+		expect(getActiveScriptSettingsBadges({ concurrent_limit: 1 })[0].detail).toContain(
+			'Max 1 execution'
+		)
+		expect(getActiveScriptSettingsBadges({ concurrent_limit: 2 })[0].detail).toContain(
+			'Max 2 executions'
+		)
+	})
+})
diff --git a/frontend/src/lib/components/scriptSettings.ts b/frontend/src/lib/components/scriptSettings.ts
new file mode 100644
index 0000000000..4a3b3ad5b8
--- /dev/null
+++ b/frontend/src/lib/components/scriptSettings.ts
@@ -0,0 +1,137 @@
+import {
+	Gauge,
+	Database,
+	Timer,
+	Hourglass,
+	Repeat,
+	Cpu,
+	Trash2,
+	ChevronsUp,
+	Tag
+} from 'lucide-svelte'
+import type { ScriptLang } from '$lib/gen'
+
+// Subset of Script/NewScript fields that make up the "advanced runtime settings"
+// surfaced both in the standalone script editor and, via the mini settings drawer,
+// from within the flow editor for workspace-script steps.
+export type ScriptAdvancedSettingsFields = {
+	path?: string
+	language?: ScriptLang
+	schema?: unknown
+	tag?: string
+	concurrent_limit?: number
+	concurrency_time_window_s?: number
+	concurrency_key?: string
+	cache_ttl?: number
+	cache_ignore_s3_path?: boolean
+	timeout?: number
+	debounce_delay_s?: number
+	debounce_key?: string
+	debounce_args_to_accumulate?: string[]
+	max_total_debouncing_time?: number
+	max_total_debounces_amount?: number
+	restart_unless_cancelled?: boolean
+	dedicated_worker?: boolean
+	delete_after_secs?: number
+	priority?: number
+}
+
+export type ScriptSettingsBadge = {
+	key: string
+	label: string
+	icon: any
+	detail: string
+}
+
+// Compute the list of active advanced settings for a script, used to render
+// at-a-glance badges in the editor top bar and in the flow drawers.
+export function getActiveScriptSettingsBadges(
+	settings: ScriptAdvancedSettingsFields | undefined
+): ScriptSettingsBadge[] {
+	if (!settings) return []
+	const badges: ScriptSettingsBadge[] = []
+	// Non-positive concurrent_limit / timeout are treated as unset by the runtime
+	// (legacy zero rows), so don't surface them as active settings.
+	if (settings.concurrent_limit != undefined && settings.concurrent_limit > 0) {
+		badges.push({
+			key: 'concurrency',
+			label: 'Concurrency',
+			icon: Gauge,
+			detail: `Max ${settings.concurrent_limit} execution${
+				settings.concurrent_limit === 1 ? '' : 's'
+			}${
+				settings.concurrency_time_window_s != undefined
+					? ` / ${settings.concurrency_time_window_s}s`
+					: ''
+			}`
+		})
+	}
+	if (settings.cache_ttl != undefined && settings.cache_ttl > 0) {
+		badges.push({
+			key: 'cache',
+			label: 'Cache',
+			icon: Database,
+			detail: `Cached for ${settings.cache_ttl}s`
+		})
+	}
+	if (settings.timeout != undefined && settings.timeout > 0) {
+		badges.push({
+			key: 'timeout',
+			label: 'Timeout',
+			icon: Timer,
+			detail: `${settings.timeout}s`
+		})
+	}
+	if (settings.debounce_delay_s != undefined && settings.debounce_delay_s > 0) {
+		badges.push({
+			key: 'debounce',
+			label: 'Debounce',
+			icon: Hourglass,
+			detail: `Debounced by ${settings.debounce_delay_s}s`
+		})
+	}
+	if (settings.restart_unless_cancelled) {
+		badges.push({
+			key: 'perpetual',
+			label: 'Perpetual',
+			icon: Repeat,
+			detail: 'Restarts unless cancelled'
+		})
+	}
+	if (settings.dedicated_worker) {
+		badges.push({
+			key: 'dedicated',
+			label: 'Dedicated',
+			icon: Cpu,
+			detail: 'Runs on dedicated workers'
+		})
+	}
+	if (settings.delete_after_secs != undefined) {
+		badges.push({
+			key: 'delete_after_use',
+			label: 'Delete after use',
+			icon: Trash2,
+			detail:
+				settings.delete_after_secs === 0
+					? 'Deleted immediately after completion'
+					: `Deleted ${settings.delete_after_secs}s after completion`
+		})
+	}
+	if (settings.priority != undefined && settings.priority > 0) {
+		badges.push({
+			key: 'priority',
+			label: 'High priority',
+			icon: ChevronsUp,
+			detail: `Priority ${settings.priority}`
+		})
+	}
+	if (settings.tag) {
+		badges.push({
+			key: 'tag',
+			label: settings.tag,
+			icon: Tag,
+			detail: `Worker tag: ${settings.tag}`
+		})
+	}
+	return badges
+}
diff --git a/frontend/src/routes/flows/dev/+page.svelte b/frontend/src/routes/flows/dev/+page.svelte
index 620cd60523..fdb3c512f1 100644
--- a/frontend/src/routes/flows/dev/+page.svelte
+++ b/frontend/src/routes/flows/dev/+page.svelte
@@ -77,6 +77,7 @@
 
 	const previewArgsStore = $state({ val: {} })
 	const scriptEditorDrawer = writable(undefined)
+	const workspaceScriptSettingsDrawer = writable(undefined)
 	const history = initHistory(flowStore.val)
 
 	const stepsInputArgs = new StepsInputArgs()
@@ -94,6 +95,7 @@
 		selectionManager,
 		previewArgs: previewArgsStore,
 		scriptEditorDrawer,
+		workspaceScriptSettingsDrawer,
 		flowEditorDrawer: writable(undefined),
 		history,
 		pathStore: writable(''),
@@ -252,7 +254,7 @@
 	const selectedId = $derived(selectionManager.getSelectedId())
 	const selectedModule = $derived(
 		selectedId && flowStore.val?.value
-			? findModuleInFlow(flowStore.val.value, selectedId) ?? undefined
+			? (findModuleInFlow(flowStore.val.value, selectedId) ?? undefined)
 			: undefined
 	)
 
@@ -293,7 +295,11 @@
 				{/if}
 			</div>
 
-			<div class="flex justify-center pt-1 z-50 absolute gap-2 {compactPreview ? 'left-1/2 -translate-x-1/2 top-14' : 'right-2 top-2'}">
+			<div
+				class="flex justify-center pt-1 z-50 absolute gap-2 {compactPreview
+					? 'left-1/2 -translate-x-1/2 top-14'
+					: 'right-2 top-2'}"
+			>
 				<FlowPreviewButtons bind:this={flowPreviewButtons} {suspendStatus} />
 			</div>
 			<Splitpanes horizontal class="max-h-screen grow min-h-0">

From 9b182aaf3879d4d81b6a785222dca75f085e6fb7 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 24 Jul 2026 00:20:38 +0200
Subject: [PATCH 145/171] fix: surface workspace ids on duplicate names and
 explain fork promotion (#10291)

* fix: disambiguate same-named workspaces in the workspace menu

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix: explain why git promotion is absent on a fork

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix: link a fork to dev-workspace pairing from git sync settings

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../components/git_sync/GitSyncSection.svelte | 41 +++++++++++++++++++
 .../components/sidebar/WorkspaceMenu.svelte   | 26 +++++++++++-
 2 files changed, 66 insertions(+), 1 deletion(-)

diff --git a/frontend/src/lib/components/git_sync/GitSyncSection.svelte b/frontend/src/lib/components/git_sync/GitSyncSection.svelte
index 3e5fe7c70d..7327912697 100644
--- a/frontend/src/lib/components/git_sync/GitSyncSection.svelte
+++ b/frontend/src/lib/components/git_sync/GitSyncSection.svelte
@@ -6,6 +6,7 @@
 	import GitSyncRepositoryCard from './GitSyncRepositoryCard.svelte'
 	import GitSyncModalManager from './GitSyncModalManager.svelte'
 	import { enterpriseLicense, workspaceStore, userWorkspaces } from '$lib/stores'
+	import { base } from '$lib/base'
 	import { WorkspaceService } from '$lib/gen'
 	import { sendUserToast } from '$lib/toast'
 	import { untrack } from 'svelte'
@@ -86,6 +87,22 @@
 	const devSingleRepo = $derived(isDevWorkspace && (gitSyncContext?.repositories?.length ?? 0) <= 1)
 	const secondarySync = $derived(gitSyncContext?.getSecondarySyncRepositories() || [])
 	const secondaryPromotion = $derived(gitSyncContext?.getSecondaryPromotionRepositories() || [])
+	// Fork creation keeps only sync-mode repositories and a fork is refused a
+	// promotion one, so the single way a fork holds one is a dev workspace
+	// detached back into a plain fork. Deploys still sync through it (only the
+	// promotion branching is dropped), so name it instead of showing nothing.
+	const promotionModeRepos = $derived(
+		showPromotion ? [] : [primaryPromotion, ...secondaryPromotion].filter((r) => r != null)
+	)
+	// Promotion is what a dev workspace does, so a fork that wants it can be
+	// re-designated as one. Pairing is prod-scoped and admin-gated there, so this
+	// only links to the parent's screen, and only when the parent is a workspace
+	// the user actually has.
+	const devPairingHref = $derived.by(() => {
+		const parent = currentWorkspace?.parent_workspace_id
+		if (!parent || !$userWorkspaces?.some((w) => w.id === parent)) return undefined
+		return `${base}/workspace_settings?workspace=${parent}&tab=dev_workspace`
+	})
 
 	// State for collapsible sections
 	let secondarySyncExpanded = $state(false)
@@ -303,6 +320,30 @@
 							{/if}
 						{/if}
 					</div>
+				{:else if !showPromotion}
+					<div class="mt-6">
+						<Alert
+							type="info"
+							title="Promotion does not apply to a fork"
+							documentationLink="https://www.windmill.dev/docs/advanced/workspace_forks"
+						>
+							Deploys in a fork always commit to the fork's own wm-fork/** branch, so a promotion
+							repository would never take effect here. Promote this fork's work by merging that
+							branch into the tracked branch instead.
+							{#if devPairingHref}
+								<div class="mt-2">
+									To promote per item from this workspace, pair it with its parent as a
+									<a href={devPairingHref} class="text-blue-500 hover:underline">dev workspace</a>.
+								</div>
+							{/if}
+							{#if promotionModeRepos.length > 0}
+								<div class="mt-2">
+									Still set to promotion mode here, and still syncing deploys to the fork's branch:
+									{promotionModeRepos.map((r) => r.repo.git_repo_resource_path).join(', ')}
+								</div>
+							{/if}
+						</Alert>
+					</div>
 				{/if}
 			{/if}
 		</div>
diff --git a/frontend/src/lib/components/sidebar/WorkspaceMenu.svelte b/frontend/src/lib/components/sidebar/WorkspaceMenu.svelte
index 38eddb2b95..2631af792f 100644
--- a/frontend/src/lib/components/sidebar/WorkspaceMenu.svelte
+++ b/frontend/src/lib/components/sidebar/WorkspaceMenu.svelte
@@ -165,6 +165,20 @@
 	// shown in the breadcrumb).
 	const currentFamily = $derived(findRoot($workspaceStore ?? undefined))
 
+	// Workspace names carry no uniqueness constraint, and this menu labels every
+	// row by name alone: a prod/staging pair sharing one name renders as two
+	// identical rows. Show the (unique) id alongside the name wherever a name is
+	// shared, so the rows stay tellable apart.
+	const ambiguousNames = $derived.by(() => {
+		const seen = new Set<string>()
+		const ambiguous = new Set<string>()
+		for (const w of $userWorkspaces ?? []) {
+			if (seen.has(w.name)) ambiguous.add(w.name)
+			seen.add(w.name)
+		}
+		return ambiguous
+	})
+
 	// The active workspace itself (fork included) — names the settings entry.
 	const activeWorkspace = $derived($userWorkspaces?.find((w) => w.id === $workspaceStore))
 	const canManageWorkspace = $derived(
@@ -205,6 +219,9 @@
 				icon={Building}
 				iconProps={iconColor ? { style: `color: ${iconColor}` } : undefined}
 				label={currentFamily?.name ?? $workspaceStore ?? ''}
+				sublabel={!isCollapsed && currentFamily && ambiguousNames.has(currentFamily.name)
+					? currentFamily.id
+					: undefined}
 				{isCollapsed}
 				color={familyColor}
 				showChevron
@@ -293,6 +310,11 @@
 												>
 											{/if}
 										</div>
+										{#if ambiguousNames.has(workspace.name)}
+											<div class="truncate text-left text-2xs text-tertiary" title={workspace.id}>
+												{workspace.id}
+											</div>
+										{/if}
 									</div>
 								</div>
 								{#if isSelected}
@@ -363,7 +385,9 @@
 						{item}
 					>
 						<Settings size={16} />
-						{activeWorkspace?.name ?? $workspaceStore} settings
+						{(activeWorkspace && ambiguousNames.has(activeWorkspace.name)
+							? activeWorkspace.id
+							: activeWorkspace?.name) ?? $workspaceStore} settings
 					</MenuItem>
 				</div>
 			{/if}

From 717e38a0c6b5bb2340e236a9d49645a4cebf4849 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 24 Jul 2026 09:58:27 +0200
Subject: [PATCH 146/171] feat: let a workspace fall back to the instance
 critical alert channels (#10292)

* feat(alerts): let a workspace fall back to the instance critical alert channels

A workspace with no error handler had no way to surface failed jobs, and the
instance critical alert channels a superadmin already configured (Slack, Teams,
email) were unreachable from a workspace: the workspace Slack error handler
posts with the workspace's own bot token, not the instance one.

Adds an opt-in workspace setting that reports failed jobs to those channels
when, and only when, no workspace error handler is configured. The report is
send-only: it skips the `alerts` table so workspace job failures never flood the
instance-wide feed superadmins triage.

Rejected on cloud (the channels belong to the instance operator, who is not the
tenant) and on fork workspaces (throwaway copies of a parent's runnables).
Settable from workspace settings and from the new-workspace screen.

The opt-in and the existing `mute_critical_alerts` flag are folded into the
query already behind WORKSPACE_ERROR_HANDLER_CACHE, so a failed job costs no
extra round trip, and workspaces with neither a handler nor the opt-in return
before the per-runnable mute lookup.

* chore(sqlx): add offline query cache entries for the new settings queries

* refactor(alerts): make instance alerts a destination tab and address review

Instance alerts are a fifth error-handler destination rather than a separate
toggle: the backend already treats them as mutually exclusive with a handler
script, so one "where do failures go?" control matches the semantics and drops
the inert-while-a-handler-is-set state. The tab is offered on the workspace
error handler only, not on schedules or triggers.

Review fixes:
- the fork boundary is enforced at dispatch (join on parent_workspace_id), so a
  workspace attached as a fork/dev after opting in stops reporting; attaching
  also clears the stored flag, and the settings page never selects a tab it does
  not render, which would have submitted a value the API rejects on a fork
- mute_critical_alerts no longer gates this path: it is the UI-feed mute, and
  this path writes no feed entry
- cancellations are not reported: they are a human action, and this destination
  has no per-workspace mute of its own
- per-workspace throttle with a rollup count, so a flapping runnable cannot turn
  into unbounded Slack/SMTP traffic on channels shared by the whole instance
- log the dispatch, audit the flag, name the columns in the rename INSERT, drop
  the generated migration placeholders

* chore(alerts): state the fork/cloud invariant on canUseInstanceAlerts

* chore(sqlx): cache the attach_dev_workspace settings update
---
 ...0d6b7f686d9c7d505590eec7ba3bfeeb406ca.json |  15 ++
 ...234f6a2f295a9c46897f5e9aab8f7298ff0d7.json |  15 ++
 ...76705eeda7d17d49cafb3e9e6285dee6804c9.json |  15 ++
 ...67ad00ff6c13918d46dd474cc48824b12ccaf.json | 208 ++++++++++++++++++
 ...e63954f39b291f525e36e6ece916b98b4d2c9.json |  15 ++
 ...d8a46dc7320e7dcdd64befe808dec8cbe2265.json |  16 ++
 ...6a8e333912b6a5eba1c5d7b3a0ee75cc95b10.json |  20 ++
 ...ad84b0a1bb18b35e0f505ab008bff1310528b.json |  12 +
 ...ndler_fallback_to_instance_alerts.down.sql |   2 +
 ...handler_fallback_to_instance_alerts.up.sql |   2 +
 .../tests/workspaces.rs                       |  58 +++++
 .../windmill-api-workspaces/src/workspaces.rs |  78 ++++++-
 .../src/workspaces_extra.rs                   |   2 +-
 backend/windmill-api/openapi.yaml             |  11 +
 backend/windmill-common/src/utils.rs          |  14 ++
 backend/windmill-queue/src/jobs.rs            | 178 ++++++++++-----
 .../components/ErrorOrRecoveryHandler.svelte  |  35 ++-
 .../CreateWorkspaceInner.svelte               |  29 ++-
 .../(logged)/workspace_settings/+page.svelte  |  65 ++++--
 19 files changed, 703 insertions(+), 87 deletions(-)
 create mode 100644 backend/.sqlx/query-042c42957221352891f7433f2ec0d6b7f686d9c7d505590eec7ba3bfeeb406ca.json
 create mode 100644 backend/.sqlx/query-2dc5a74c4e614b43148925cdbac234f6a2f295a9c46897f5e9aab8f7298ff0d7.json
 create mode 100644 backend/.sqlx/query-40c591ab93adf3bb4f17598f78b76705eeda7d17d49cafb3e9e6285dee6804c9.json
 create mode 100644 backend/.sqlx/query-5ae9ad14effe923f1952d0e1d1f67ad00ff6c13918d46dd474cc48824b12ccaf.json
 create mode 100644 backend/.sqlx/query-620c9efca071cb5fb8b33857129e63954f39b291f525e36e6ece916b98b4d2c9.json
 create mode 100644 backend/.sqlx/query-7da2e04f64cef6634256d7b3b12d8a46dc7320e7dcdd64befe808dec8cbe2265.json
 create mode 100644 backend/.sqlx/query-88943f52672bffc69c75bc6b06a6a8e333912b6a5eba1c5d7b3a0ee75cc95b10.json
 create mode 100644 backend/.sqlx/query-d6269058b3e5146de5b32ac2363ad84b0a1bb18b35e0f505ab008bff1310528b.json
 create mode 100644 backend/migrations/20260723215437_error_handler_fallback_to_instance_alerts.down.sql
 create mode 100644 backend/migrations/20260723215437_error_handler_fallback_to_instance_alerts.up.sql

diff --git a/backend/.sqlx/query-042c42957221352891f7433f2ec0d6b7f686d9c7d505590eec7ba3bfeeb406ca.json b/backend/.sqlx/query-042c42957221352891f7433f2ec0d6b7f686d9c7d505590eec7ba3bfeeb406ca.json
new file mode 100644
index 0000000000..9574582d5f
--- /dev/null
+++ b/backend/.sqlx/query-042c42957221352891f7433f2ec0d6b7f686d9c7d505590eec7ba3bfeeb406ca.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace_settings (workspace_id, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, deploy_to, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, ducklake, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts) SELECT $1, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, deploy_to, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, ducklake, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts FROM workspace_settings WHERE workspace_id = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "042c42957221352891f7433f2ec0d6b7f686d9c7d505590eec7ba3bfeeb406ca"
+}
diff --git a/backend/.sqlx/query-2dc5a74c4e614b43148925cdbac234f6a2f295a9c46897f5e9aab8f7298ff0d7.json b/backend/.sqlx/query-2dc5a74c4e614b43148925cdbac234f6a2f295a9c46897f5e9aab8f7298ff0d7.json
new file mode 100644
index 0000000000..8714711595
--- /dev/null
+++ b/backend/.sqlx/query-2dc5a74c4e614b43148925cdbac234f6a2f295a9c46897f5e9aab8f7298ff0d7.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace_settings SELECT $1, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, deploy_to, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, ducklake, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts FROM workspace_settings WHERE workspace_id = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "2dc5a74c4e614b43148925cdbac234f6a2f295a9c46897f5e9aab8f7298ff0d7"
+}
diff --git a/backend/.sqlx/query-40c591ab93adf3bb4f17598f78b76705eeda7d17d49cafb3e9e6285dee6804c9.json b/backend/.sqlx/query-40c591ab93adf3bb4f17598f78b76705eeda7d17d49cafb3e9e6285dee6804c9.json
new file mode 100644
index 0000000000..114712fc28
--- /dev/null
+++ b/backend/.sqlx/query-40c591ab93adf3bb4f17598f78b76705eeda7d17d49cafb3e9e6285dee6804c9.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE workspace_settings SET error_handler_fallback_to_instance_alerts = $1 WHERE workspace_id = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Bool",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "40c591ab93adf3bb4f17598f78b76705eeda7d17d49cafb3e9e6285dee6804c9"
+}
diff --git a/backend/.sqlx/query-5ae9ad14effe923f1952d0e1d1f67ad00ff6c13918d46dd474cc48824b12ccaf.json b/backend/.sqlx/query-5ae9ad14effe923f1952d0e1d1f67ad00ff6c13918d46dd474cc48824b12ccaf.json
new file mode 100644
index 0000000000..353920fdeb
--- /dev/null
+++ b/backend/.sqlx/query-5ae9ad14effe923f1952d0e1d1f67ad00ff6c13918d46dd474cc48824b12ccaf.json
@@ -0,0 +1,208 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        SELECT\n            workspace_id,\n            slack_team_id,\n            teams_team_id,\n            teams_team_name,\n            teams_team_guid,\n            slack_name,\n            slack_command_script,\n            teams_command_script,\n            slack_email,\n            slack_oauth_client_id,\n            slack_oauth_client_secret,\n            customer_id,\n            plan,\n            webhook,\n            deploy_to,\n            ai_config,\n            large_file_storage,\n            datatable,\n            ducklake,\n            git_sync,\n            deploy_ui,\n            default_app,\n            default_scripts,\n            mute_critical_alerts,\n            color,\n            operator_settings,\n            git_app_installations,\n            auto_invite,\n            error_handler,\n            success_handler,\n            public_app_execution_limit_per_minute,\n            error_handler_fallback_to_instance_alerts\n        FROM\n            workspace_settings\n        WHERE\n            workspace_id = $1\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "workspace_id",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "slack_team_id",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "teams_team_id",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 3,
+        "name": "teams_team_name",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 4,
+        "name": "teams_team_guid",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 5,
+        "name": "slack_name",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 6,
+        "name": "slack_command_script",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 7,
+        "name": "teams_command_script",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 8,
+        "name": "slack_email",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 9,
+        "name": "slack_oauth_client_id",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 10,
+        "name": "slack_oauth_client_secret",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 11,
+        "name": "customer_id",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 12,
+        "name": "plan",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 13,
+        "name": "webhook",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 14,
+        "name": "deploy_to",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 15,
+        "name": "ai_config",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 16,
+        "name": "large_file_storage",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 17,
+        "name": "datatable",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 18,
+        "name": "ducklake",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 19,
+        "name": "git_sync",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 20,
+        "name": "deploy_ui",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 21,
+        "name": "default_app",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 22,
+        "name": "default_scripts",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 23,
+        "name": "mute_critical_alerts",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 24,
+        "name": "color",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 25,
+        "name": "operator_settings",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 26,
+        "name": "git_app_installations",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 27,
+        "name": "auto_invite",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 28,
+        "name": "error_handler",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 29,
+        "name": "success_handler",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 30,
+        "name": "public_app_execution_limit_per_minute",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 31,
+        "name": "error_handler_fallback_to_instance_alerts",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      false,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      false,
+      true,
+      true,
+      true,
+      true,
+      false
+    ]
+  },
+  "hash": "5ae9ad14effe923f1952d0e1d1f67ad00ff6c13918d46dd474cc48824b12ccaf"
+}
diff --git a/backend/.sqlx/query-620c9efca071cb5fb8b33857129e63954f39b291f525e36e6ece916b98b4d2c9.json b/backend/.sqlx/query-620c9efca071cb5fb8b33857129e63954f39b291f525e36e6ece916b98b4d2c9.json
new file mode 100644
index 0000000000..243c3f5fa7
--- /dev/null
+++ b/backend/.sqlx/query-620c9efca071cb5fb8b33857129e63954f39b291f525e36e6ece916b98b4d2c9.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE workspace_settings SET deploy_to = $1, error_handler_fallback_to_instance_alerts = false WHERE workspace_id = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "620c9efca071cb5fb8b33857129e63954f39b291f525e36e6ece916b98b4d2c9"
+}
diff --git a/backend/.sqlx/query-7da2e04f64cef6634256d7b3b12d8a46dc7320e7dcdd64befe808dec8cbe2265.json b/backend/.sqlx/query-7da2e04f64cef6634256d7b3b12d8a46dc7320e7dcdd64befe808dec8cbe2265.json
new file mode 100644
index 0000000000..7eef899aa7
--- /dev/null
+++ b/backend/.sqlx/query-7da2e04f64cef6634256d7b3b12d8a46dc7320e7dcdd64befe808dec8cbe2265.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace_settings\n            (workspace_id, color, error_handler_fallback_to_instance_alerts)\n            VALUES ($1, $2, $3)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar",
+        "Bool"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "7da2e04f64cef6634256d7b3b12d8a46dc7320e7dcdd64befe808dec8cbe2265"
+}
diff --git a/backend/.sqlx/query-88943f52672bffc69c75bc6b06a6a8e333912b6a5eba1c5d7b3a0ee75cc95b10.json b/backend/.sqlx/query-88943f52672bffc69c75bc6b06a6a8e333912b6a5eba1c5d7b3a0ee75cc95b10.json
new file mode 100644
index 0000000000..21679c4ec2
--- /dev/null
+++ b/backend/.sqlx/query-88943f52672bffc69c75bc6b06a6a8e333912b6a5eba1c5d7b3a0ee75cc95b10.json
@@ -0,0 +1,20 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT error_handler_fallback_to_instance_alerts FROM workspace_settings WHERE workspace_id = 'test-workspace'",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "error_handler_fallback_to_instance_alerts",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "88943f52672bffc69c75bc6b06a6a8e333912b6a5eba1c5d7b3a0ee75cc95b10"
+}
diff --git a/backend/.sqlx/query-d6269058b3e5146de5b32ac2363ad84b0a1bb18b35e0f505ab008bff1310528b.json b/backend/.sqlx/query-d6269058b3e5146de5b32ac2363ad84b0a1bb18b35e0f505ab008bff1310528b.json
new file mode 100644
index 0000000000..13e31508a0
--- /dev/null
+++ b/backend/.sqlx/query-d6269058b3e5146de5b32ac2363ad84b0a1bb18b35e0f505ab008bff1310528b.json
@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE workspace SET parent_workspace_id = 'test-workspace' WHERE id = 'test-workspace'",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "d6269058b3e5146de5b32ac2363ad84b0a1bb18b35e0f505ab008bff1310528b"
+}
diff --git a/backend/migrations/20260723215437_error_handler_fallback_to_instance_alerts.down.sql b/backend/migrations/20260723215437_error_handler_fallback_to_instance_alerts.down.sql
new file mode 100644
index 0000000000..a1e5abccc3
--- /dev/null
+++ b/backend/migrations/20260723215437_error_handler_fallback_to_instance_alerts.down.sql
@@ -0,0 +1,2 @@
+ALTER TABLE workspace_settings
+    DROP COLUMN IF EXISTS error_handler_fallback_to_instance_alerts;
diff --git a/backend/migrations/20260723215437_error_handler_fallback_to_instance_alerts.up.sql b/backend/migrations/20260723215437_error_handler_fallback_to_instance_alerts.up.sql
new file mode 100644
index 0000000000..2ab4b8b673
--- /dev/null
+++ b/backend/migrations/20260723215437_error_handler_fallback_to_instance_alerts.up.sql
@@ -0,0 +1,2 @@
+ALTER TABLE workspace_settings
+    ADD COLUMN IF NOT EXISTS error_handler_fallback_to_instance_alerts BOOLEAN NOT NULL DEFAULT false;
diff --git a/backend/windmill-api-integration-tests/tests/workspaces.rs b/backend/windmill-api-integration-tests/tests/workspaces.rs
index c319a1b9ec..a681fd982e 100644
--- a/backend/windmill-api-integration-tests/tests/workspaces.rs
+++ b/backend/windmill-api-integration-tests/tests/workspaces.rs
@@ -901,6 +901,64 @@ async fn test_get_copilot_info_ignores_empty_instance_ai_row(
     Ok(())
 }
 
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_error_handler_instance_alerts_fallback(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let base = format!("http://localhost:{port}/api/w/test-workspace/workspaces");
+
+    let stored = || async {
+        sqlx::query_scalar!(
+            "SELECT error_handler_fallback_to_instance_alerts FROM workspace_settings WHERE workspace_id = 'test-workspace'"
+        )
+        .fetch_one(&db)
+        .await
+    };
+
+    let resp = authed(client().post(format!("{base}/edit_error_handler")))
+        .json(&json!({"path": null, "fallback_to_instance_alerts": true}))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 200, "enable: {}", resp.text().await?);
+    assert!(stored().await?);
+
+    // A client that predates the setting (the CLI pushing settings.yaml) omits the field and
+    // must not silently turn it back off.
+    let resp = authed(client().post(format!("{base}/edit_error_handler")))
+        .json(&json!({"path": null, "extra_args": null}))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 200, "omitted: {}", resp.text().await?);
+    assert!(stored().await?);
+
+    sqlx::query!(
+        "UPDATE workspace SET parent_workspace_id = 'test-workspace' WHERE id = 'test-workspace'"
+    )
+    .execute(&db)
+    .await?;
+    let resp = authed(client().post(format!("{base}/edit_error_handler")))
+        .json(&json!({"path": null, "fallback_to_instance_alerts": true}))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 400, "fork must be rejected");
+
+    // The settings page stops offering the option once the workspace is a fork, so its next save
+    // sends `false`: that must go through rather than lock the whole error handler behind a 400.
+    let resp = authed(client().post(format!("{base}/edit_error_handler")))
+        .json(&json!({"path": null, "fallback_to_instance_alerts": false}))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 200, "disable on fork: {}", resp.text().await?);
+    assert!(!stored().await?);
+
+    Ok(())
+}
+
 #[sqlx::test(migrations = "../migrations", fixtures("base"))]
 async fn test_get_imports(db: Pool<Postgres>) -> anyhow::Result<()> {
     initialize_tracing().await;
diff --git a/backend/windmill-api-workspaces/src/workspaces.rs b/backend/windmill-api-workspaces/src/workspaces.rs
index b025261270..9cf80e5e39 100644
--- a/backend/windmill-api-workspaces/src/workspaces.rs
+++ b/backend/windmill-api-workspaces/src/workspaces.rs
@@ -302,6 +302,7 @@ pub struct WorkspaceSettings {
     pub success_handler: Option<serde_json::Value>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub public_app_execution_limit_per_minute: Option<i32>,
+    pub error_handler_fallback_to_instance_alerts: bool,
 }
 
 /// Subset of `WorkspaceSettings` that is safe to return to any workspace
@@ -451,6 +452,8 @@ struct CreateWorkspace {
     name: String,
     username: Option<String>,
     color: Option<String>,
+    #[serde(default)]
+    error_handler_fallback_to_instance_alerts: bool,
 }
 
 #[derive(Deserialize)]
@@ -558,6 +561,9 @@ pub struct EditErrorHandlerNew {
     pub muted_on_cancel: bool,
     #[serde(default)]
     pub muted_on_user_path: bool,
+    /// Left as `None` by clients that predate the setting (the CLI among them), which must
+    /// keep the stored value rather than silently reset it on every settings push.
+    pub fallback_to_instance_alerts: Option<bool>,
 }
 
 // Legacy format for error handler (flat fields from old CLI)
@@ -586,6 +592,7 @@ impl EditErrorHandler {
                 extra_args: legacy.error_handler_extra_args,
                 muted_on_cancel: legacy.error_handler_muted_on_cancel,
                 muted_on_user_path: false, // Old format doesn't have this field
+                fallback_to_instance_alerts: None,
             },
         }
     }
@@ -973,7 +980,8 @@ async fn get_settings(
             auto_invite,
             error_handler,
             success_handler,
-            public_app_execution_limit_per_minute
+            public_app_execution_limit_per_minute,
+            error_handler_fallback_to_instance_alerts
         FROM
             workspace_settings
         WHERE
@@ -4182,6 +4190,19 @@ async fn edit_error_handler(
 
     let mut tx = db.begin().await?;
 
+    if let Some(fallback_to_instance_alerts) = ee.fallback_to_instance_alerts {
+        if fallback_to_instance_alerts {
+            ensure_instance_alert_fallback_allowed(&mut tx, &w_id).await?;
+        }
+        sqlx::query!(
+            "UPDATE workspace_settings SET error_handler_fallback_to_instance_alerts = $1 WHERE workspace_id = $2",
+            fallback_to_instance_alerts,
+            &w_id
+        )
+        .execute(&mut *tx)
+        .await?;
+    }
+
     sqlx::query_as!(
         Group,
         "INSERT INTO group_ (workspace_id, name, summary, extra_perms) VALUES ($1, $2, $3, $4) ON CONFLICT DO NOTHING",
@@ -4260,7 +4281,16 @@ async fn edit_error_handler(
         ActionKind::Update,
         &w_id,
         Some(&authed.email),
-        Some([("error_handler", &format!("{:?}", ee.path)[..])].into()),
+        Some(
+            [
+                ("error_handler", &format!("{:?}", ee.path)[..]),
+                (
+                    "fallback_to_instance_alerts",
+                    &format!("{:?}", ee.fallback_to_instance_alerts)[..],
+                ),
+            ]
+            .into(),
+        ),
     )
     .await?;
     tx.commit().await?;
@@ -4737,6 +4767,36 @@ async fn session_workspace_status(
     Ok(Json(statuses))
 }
 
+/// The instance critical alert channels belong to the instance operator, who on cloud is
+/// not the workspace owner and never opted into a tenant's job failures. Fork workspaces run
+/// throwaway copies of their parent's runnables, so instance-wide operational alerting must
+/// stay a property of the real workspace.
+async fn ensure_instance_alert_fallback_allowed<'c>(
+    tx: &mut Transaction<'c, Postgres>,
+    w_id: &str,
+) -> Result<()> {
+    if *CLOUD_HOSTED {
+        return Err(Error::BadRequest(
+            "Reporting to the instance critical alert channels is not available on cloud"
+                .to_string(),
+        ));
+    }
+    let is_fork = sqlx::query_scalar!(
+        r#"SELECT (parent_workspace_id IS NOT NULL) AS "is_fork!" FROM workspace WHERE id = $1"#,
+        w_id
+    )
+    .fetch_optional(&mut **tx)
+    .await?
+    .unwrap_or(false);
+    if is_fork {
+        return Err(Error::BadRequest(
+            "Reporting to the instance critical alert channels cannot be enabled on a fork workspace"
+                .to_string(),
+        ));
+    }
+    Ok(())
+}
+
 pub async fn check_w_id_conflict<'c>(tx: &mut Transaction<'c, Postgres>, w_id: &str) -> Result<()> {
     if w_id == "global" {
         return Err(windmill_common::error::Error::BadRequest(
@@ -4913,12 +4973,16 @@ async fn create_workspace(
     )
     .execute(&mut *tx)
     .await?;
+    if nw.error_handler_fallback_to_instance_alerts {
+        ensure_instance_alert_fallback_allowed(&mut tx, &nw.id).await?;
+    }
     sqlx::query!(
         "INSERT INTO workspace_settings
-            (workspace_id, color)
-            VALUES ($1, $2)",
+            (workspace_id, color, error_handler_fallback_to_instance_alerts)
+            VALUES ($1, $2, $3)",
         nw.id,
         nw.color,
+        nw.error_handler_fallback_to_instance_alerts,
     )
     .execute(&mut *tx)
     .await?;
@@ -6996,8 +7060,12 @@ async fn attach_dev_workspace(
     )
     .execute(&mut *tx)
     .await?;
+    // Clearing the instance-alert opt-in here keeps the stored setting truthful for a workspace
+    // that becomes parent-managed: dispatch enforces the fork boundary on its own, but a lingering
+    // `true` would survive a later detach and would make the settings page submit a value the API
+    // rejects on a fork.
     sqlx::query!(
-        "UPDATE workspace_settings SET deploy_to = $1 WHERE workspace_id = $2",
+        "UPDATE workspace_settings SET deploy_to = $1, error_handler_fallback_to_instance_alerts = false WHERE workspace_id = $2",
         &prod_w_id,
         &dev_w_id
     )
diff --git a/backend/windmill-api-workspaces/src/workspaces_extra.rs b/backend/windmill-api-workspaces/src/workspaces_extra.rs
index aa89f1ffd5..7998a769f9 100644
--- a/backend/windmill-api-workspaces/src/workspaces_extra.rs
+++ b/backend/windmill-api-workspaces/src/workspaces_extra.rs
@@ -108,7 +108,7 @@ pub(crate) async fn change_workspace_id(
     // Duplicate workspace settings (keep copy in old workspace for reference)
     info!("Duplicating workspace_settings table");
     sqlx::query!(
-        "INSERT INTO workspace_settings SELECT $1, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, deploy_to, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, ducklake, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler FROM workspace_settings WHERE workspace_id = $2",
+        "INSERT INTO workspace_settings (workspace_id, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, deploy_to, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, ducklake, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts) SELECT $1, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, deploy_to, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, ducklake, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts FROM workspace_settings WHERE workspace_id = $2",
         &rw.new_id,
         &old_id
     )
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 8c082f5052..b67461de43 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -3617,6 +3617,9 @@ paths:
                   public_app_execution_limit_per_minute:
                     type: integer
                     description: Rate limit for public app executions per minute per server. NULL or 0 means disabled.
+                  error_handler_fallback_to_instance_alerts:
+                    type: boolean
+                    description: Report failed jobs to the instance critical alert channels when no workspace error handler is set.
 
   /w/{workspace}/workspaces/get_deploy_to:
     get:
@@ -24232,6 +24235,9 @@ components:
         muted_on_user_path:
           type: boolean
           default: false
+        fallback_to_instance_alerts:
+          type: boolean
+          description: Report failed jobs to the instance critical alert channels when no workspace error handler is set. Omit to leave the stored value untouched.
 
     EditErrorHandlerLegacy:
       type: object
@@ -26883,6 +26889,7 @@ components:
         - slack
         - teams
         - email
+        - instance_alerts
 
     NewSchedule:
       type: object
@@ -29811,6 +29818,10 @@ components:
           type: string
         color:
           type: string
+        error_handler_fallback_to_instance_alerts:
+          type: boolean
+          default: false
+          description: Report failed jobs to the instance critical alert channels when no workspace error handler is set. Not available on cloud or on fork workspaces.
       required:
         - id
         - name
diff --git a/backend/windmill-common/src/utils.rs b/backend/windmill-common/src/utils.rs
index efe6477ad3..e2597fdfce 100644
--- a/backend/windmill-common/src/utils.rs
+++ b/backend/windmill-common/src/utils.rs
@@ -563,6 +563,20 @@ pub async fn report_critical_error(
     }
 }
 
+/// Route a workspace-level failure to the instance critical alert channels without
+/// recording an `alerts` row: job failures are workspace noise and would otherwise flood
+/// the instance-wide feed superadmins triage. The channels belong to the instance operator,
+/// who on cloud is not the workspace owner, hence the hard stop there. Callers own the
+/// per-workspace opt-in.
+pub async fn send_workspace_error_to_instance_channels(_error_message: String, _db: &DB) -> () {
+    if *CLOUD_HOSTED {
+        return;
+    }
+
+    #[cfg(feature = "enterprise")]
+    send_critical_alert(_error_message, _db, CriticalAlertKind::CriticalError, None).await;
+}
+
 pub async fn report_recovered_critical_error(
     message: String,
     _db: DB,
diff --git a/backend/windmill-queue/src/jobs.rs b/backend/windmill-queue/src/jobs.rs
index 4b2196bf63..f2d0425710 100644
--- a/backend/windmill-queue/src/jobs.rs
+++ b/backend/windmill-queue/src/jobs.rs
@@ -953,8 +953,13 @@ lazy_static::lazy_static! {
     static ref RESTART_UNLESS_CANCELLED_CACHE: Cache<(i64, String), (bool, Option<i32>)> = Cache::new(10000);
 
     // Cache for workspace error handler settings with 60s TTL
-    // Key: workspace_id, Value: (error_handler, error_handler_extra_args, error_handler_muted_on_cancel, error_handler_muted_on_user_path, expiry_timestamp)
-    static ref WORKSPACE_ERROR_HANDLER_CACHE: Cache<String, (Option<String>, Option<Json<Box<RawValue>>>, bool, bool, i64)> = Cache::new(1000);
+    // Key: workspace_id, Value: (error_handler, error_handler_extra_args, error_handler_muted_on_cancel, error_handler_muted_on_user_path, report_to_instance_alerts, expiry_timestamp)
+    static ref WORKSPACE_ERROR_HANDLER_CACHE: Cache<String, (Option<String>, Option<Json<Box<RawValue>>>, bool, bool, bool, i64)> = Cache::new(1000);
+
+    // Best-effort per-worker throttle for the instance-channel fallback: a flapping runnable
+    // would otherwise turn every failure into outbound Slack/SMTP traffic on channels shared by
+    // the whole instance. Key: workspace_id, Value: (last_sent_epoch, failures suppressed since)
+    static ref INSTANCE_ALERT_THROTTLE: Cache<String, (i64, u64)> = Cache::new(1000);
 
     // Cache for workspace success handler settings with 60s TTL
     // Key: workspace_id, Value: (success_handler, success_handler_extra_args, expiry_timestamp)
@@ -962,6 +967,7 @@ lazy_static::lazy_static! {
 }
 
 const WORKSPACE_HANDLER_CACHE_TTL_SECONDS: i64 = 60;
+const INSTANCE_ALERT_COOLDOWN_SECONDS: i64 = 60;
 
 pub async fn add_completed_job<T: Serialize + Send + Sync + ValidableJson>(
     db: &Pool<Postgres>,
@@ -2125,7 +2131,7 @@ pub async fn report_error_to_workspace_handler_or_critical_side_channel(
 async fn fetch_error_handler_from_db(
     db: &Pool<Postgres>,
     w_id: &str,
-) -> Result<(Option<String>, Option<Json<Box<RawValue>>>, bool, bool), Error> {
+) -> Result<(Option<String>, Option<Json<Box<RawValue>>>, bool, bool, bool), Error> {
     sqlx::query_as::<
         _,
         (
@@ -2133,6 +2139,7 @@ async fn fetch_error_handler_from_db(
             Option<Json<Box<RawValue>>>,
             Option<bool>,
             Option<bool>,
+            bool,
         ),
     >(
         r#"
@@ -2140,23 +2147,28 @@ async fn fetch_error_handler_from_db(
             error_handler->>'path',
             (error_handler->'extra_args')::text::json,
             (error_handler->>'muted_on_cancel')::boolean,
-            (error_handler->>'muted_on_user_path')::boolean
-        FROM workspace_settings
-        WHERE workspace_id = $1
+            (error_handler->>'muted_on_user_path')::boolean,
+            ws.error_handler_fallback_to_instance_alerts AND w.parent_workspace_id IS NULL
+        FROM workspace_settings ws
+        JOIN workspace w ON w.id = ws.workspace_id
+        WHERE ws.workspace_id = $1
         "#,
     )
     .bind(w_id)
     .fetch_optional(db)
     .await
     .context("fetching error handler info from workspace_settings")?
-    .map(|(path, extra_args, muted_on_cancel, muted_on_user_path)| {
-        (
-            path,
-            extra_args,
-            muted_on_cancel.unwrap_or(false),
-            muted_on_user_path.unwrap_or(false),
-        )
-    })
+    .map(
+        |(path, extra_args, muted_on_cancel, muted_on_user_path, report_to_instance_alerts)| {
+            (
+                path,
+                extra_args,
+                muted_on_cancel.unwrap_or(false),
+                muted_on_user_path.unwrap_or(false),
+                report_to_instance_alerts,
+            )
+        },
+    )
     .ok_or_else(|| Error::internal_err(format!("no workspace settings for id {w_id}")))
 }
 
@@ -2174,15 +2186,22 @@ pub async fn send_error_to_workspace_handler<'a, 'c, T: Serialize + Send + Sync>
         error_handler_extra_args,
         error_handler_muted_on_cancel,
         error_handler_muted_on_user_path,
+        report_to_instance_alerts,
     ) = if let Some(cached) = WORKSPACE_ERROR_HANDLER_CACHE.get(w_id) {
-        if cached.4 > now {
-            (cached.0.clone(), cached.1.clone(), cached.2, cached.3)
+        if cached.5 > now {
+            (
+                cached.0.clone(),
+                cached.1.clone(),
+                cached.2,
+                cached.3,
+                cached.4,
+            )
         } else {
             let row = fetch_error_handler_from_db(db, w_id).await?;
             let expiry = now + WORKSPACE_HANDLER_CACHE_TTL_SECONDS;
             WORKSPACE_ERROR_HANDLER_CACHE.insert(
                 w_id.clone(),
-                (row.0.clone(), row.1.clone(), row.2, row.3, expiry),
+                (row.0.clone(), row.1.clone(), row.2, row.3, row.4, expiry),
             );
             row
         }
@@ -2191,11 +2210,17 @@ pub async fn send_error_to_workspace_handler<'a, 'c, T: Serialize + Send + Sync>
         let expiry = now + WORKSPACE_HANDLER_CACHE_TTL_SECONDS;
         WORKSPACE_ERROR_HANDLER_CACHE.insert(
             w_id.clone(),
-            (row.0.clone(), row.1.clone(), row.2, row.3, expiry),
+            (row.0.clone(), row.1.clone(), row.2, row.3, row.4, expiry),
         );
         row
     };
 
+    // Nothing to do for the vast majority of workspaces, and returning here keeps the
+    // per-runnable mute lookup below off the path of every failed job.
+    if error_handler.is_none() && !report_to_instance_alerts {
+        return Ok(());
+    }
+
     if is_canceled && error_handler_muted_on_cancel {
         return Ok(());
     }
@@ -2209,51 +2234,90 @@ pub async fn send_error_to_workspace_handler<'a, 'c, T: Serialize + Send + Sync>
         }
     }
 
-    if let Some(error_handler) = error_handler {
-        let ws_error_handler_muted: Option<bool> = match queued_job.kind {
-            JobKind::Script => {
-                sqlx::query_scalar!(
+    let ws_error_handler_muted: Option<bool> = match queued_job.kind {
+        JobKind::Script => {
+            sqlx::query_scalar!(
                 "SELECT ws_error_handler_muted FROM script WHERE workspace_id = $1 AND hash = $2",
                 queued_job.workspace_id,
                 queued_job.runnable_id.map(|x| x.0),
             )
-                .fetch_optional(db)
-                .await?
-            }
-            JobKind::Flow => {
-                sqlx::query_scalar!(
-                    "SELECT ws_error_handler_muted FROM flow WHERE workspace_id = $1 AND path = $2",
-                    queued_job.workspace_id,
-                    queued_job.runnable_path.clone(),
-                )
-                .fetch_optional(db)
-                .await?
-            }
-            _ => None,
-        };
-
-        let muted = ws_error_handler_muted.unwrap_or(false);
-        if !muted {
-            tracing::info!("workspace error handled for job {}", &queued_job.id);
-
-            push_error_handler(
-                db,
-                queued_job.id,
-                queued_job.schedule_path(),
+            .fetch_optional(db)
+            .await?
+        }
+        JobKind::Flow => {
+            sqlx::query_scalar!(
+                "SELECT ws_error_handler_muted FROM flow WHERE workspace_id = $1 AND path = $2",
+                queued_job.workspace_id,
                 queued_job.runnable_path.clone(),
-                queued_job.is_flow(),
-                &queued_job.workspace_id,
-                &error_handler,
-                result,
-                None,
-                queued_job.started_at,
-                error_handler_extra_args,
-                &queued_job.permissioned_as_email,
-                false,
-                false,
-                None,
             )
-            .await?;
+            .fetch_optional(db)
+            .await?
+        }
+        _ => None,
+    };
+
+    if ws_error_handler_muted.unwrap_or(false) {
+        return Ok(());
+    }
+
+    if let Some(error_handler) = error_handler {
+        tracing::info!("workspace error handled for job {}", &queued_job.id);
+
+        push_error_handler(
+            db,
+            queued_job.id,
+            queued_job.schedule_path(),
+            queued_job.runnable_path.clone(),
+            queued_job.is_flow(),
+            &queued_job.workspace_id,
+            &error_handler,
+            result,
+            None,
+            queued_job.started_at,
+            error_handler_extra_args,
+            &queued_job.permissioned_as_email,
+            false,
+            false,
+            None,
+        )
+        .await?;
+    } else if !is_canceled {
+        // A cancellation is a human action rather than an operational failure, and unlike the
+        // handler path this one has no per-workspace toggle to opt out of reporting them.
+        let suppressed = match INSTANCE_ALERT_THROTTLE.get(w_id) {
+            Some((last_sent, suppressed))
+                if now - last_sent < INSTANCE_ALERT_COOLDOWN_SECONDS =>
+            {
+                INSTANCE_ALERT_THROTTLE.insert(w_id.clone(), (last_sent, suppressed + 1));
+                None
+            }
+            entry => {
+                INSTANCE_ALERT_THROTTLE.insert(w_id.clone(), (now, 0));
+                Some(entry.map(|(_, suppressed)| suppressed).unwrap_or(0))
+            }
+        };
+        if let Some(suppressed) = suppressed {
+            tracing::info!(
+                "reporting failed job {} to the instance critical alert channels",
+                &queued_job.id
+            );
+            let base_url = windmill_common::BASE_URL.load();
+            let rollup = if suppressed > 0 {
+                format!(
+                    " (and {suppressed} more failure(s) in the preceding {INSTANCE_ALERT_COOLDOWN_SECONDS}s)"
+                )
+            } else {
+                String::new()
+            };
+            windmill_common::utils::send_workspace_error_to_instance_channels(
+                format!(
+                    "Job {} failed in workspace {w_id} ({base_url}/run/{}?workspace={w_id}){rollup}",
+                    queued_job.runnable_path.as_deref().unwrap_or("preview"),
+                    queued_job.id
+                ),
+                db,
+            )
+            .await;
         }
     }
     Ok(())
diff --git a/frontend/src/lib/components/ErrorOrRecoveryHandler.svelte b/frontend/src/lib/components/ErrorOrRecoveryHandler.svelte
index 330275ee75..89e2554c01 100644
--- a/frontend/src/lib/components/ErrorOrRecoveryHandler.svelte
+++ b/frontend/src/lib/components/ErrorOrRecoveryHandler.svelte
@@ -85,6 +85,9 @@
 		 * nav `$workspaceStore`; a trigger editor in a forked session passes its
 		 * acting workspace so the handler is resolved and saved there. */
 		workspace?: string
+		/** Offer the instance critical alert channels as a destination. Workspace-level
+		 * error handling only: schedules and triggers have no such setting. */
+		showInstanceAlerts?: boolean
 	}
 
 	let {
@@ -99,7 +102,8 @@
 		customHandlerKind = $bindable('script'),
 		customTabTooltip,
 		noMargin = false,
-		workspace = undefined
+		workspace = undefined,
+		showInstanceAlerts = false
 	}: Props = $props()
 
 	let effectiveWorkspace = $derived(workspace ?? $workspaceStore)
@@ -363,6 +367,14 @@
 			handlerPath = hubPaths.emailErrorHandler
 		}
 	})
+
+	// The instance channels are reached by having no workspace handler at all, so the tab
+	// owns an empty path rather than a handler script.
+	$effect(() => {
+		if (handlerSelected === 'instance_alerts') {
+			handlerPath = undefined
+		}
+	})
 </script>
 
 <div class={classNames('space-y-2', noMargin ? '' : 'mt-2')}>
@@ -378,6 +390,15 @@
 				disabled={!isEditable}
 				tooltip={customTabTooltip ? 'Custom error handler with script or flow' : undefined}
 			/>
+			{#if showInstanceAlerts}
+				<ToggleButton
+					label="Instance alerts"
+					value="instance_alerts"
+					{item}
+					disabled={!isEditable}
+					tooltip="Report failures to the instance critical alert channels"
+				/>
+			{/if}
 		{/snippet}
 	</ToggleButtonGroup>
 
@@ -652,6 +673,18 @@
 					{/if}
 				</div>
 			{/if}
+		{:else if handlerSelected === 'instance_alerts'}
+			<div class="flex flex-col gap-2">
+				<span class="text-xs text-secondary">
+					Failed jobs are reported to the Slack, Teams and email channels configured at the instance
+					level. Those channels are managed in instance settings by a superadmin, not here, and the
+					report is sent without adding an entry to the instance critical alert feed. Canceled jobs
+					are not reported.
+				</span>
+				<a class="text-xs w-fit" href="{base}/?workspace=admins#superadmin-settings">
+					Configure the instance critical alert channels
+				</a>
+			</div>
 		{/if}
 	</div>
 </div>
diff --git a/frontend/src/lib/components/workspaceSettings/CreateWorkspaceInner.svelte b/frontend/src/lib/components/workspaceSettings/CreateWorkspaceInner.svelte
index b085649b89..23ed37caad 100644
--- a/frontend/src/lib/components/workspaceSettings/CreateWorkspaceInner.svelte
+++ b/frontend/src/lib/components/workspaceSettings/CreateWorkspaceInner.svelte
@@ -14,7 +14,13 @@
 	import { validateUsername } from '$lib/utils'
 	import { logoutWithRedirect } from '$lib/logoutKit'
 	import { page } from '$app/state'
-	import { superadmin, usersWorkspaceStore, userWorkspaces, workspaceStore } from '$lib/stores'
+	import {
+		enterpriseLicense,
+		superadmin,
+		usersWorkspaceStore,
+		userWorkspaces,
+		workspaceStore
+	} from '$lib/stores'
 	import {
 		workspaceIsFork,
 		findWorkspaceRoot,
@@ -204,6 +210,7 @@
 
 	let workspaceColor: string | undefined = $state(undefined)
 	let colorEnabled = $state(false)
+	let errorHandlerFallbackToInstanceAlerts = $state(false)
 
 	function generateRandomColor() {
 		const randomColor =
@@ -452,7 +459,8 @@
 				id,
 				name,
 				color: colorEnabled && workspaceColor ? workspaceColor : undefined,
-				username: automateUsernameCreation ? undefined : username
+				username: automateUsernameCreation ? undefined : username,
+				error_handler_fallback_to_instance_alerts: errorHandlerFallbackToInstanceAlerts
 			}
 		})
 		if (auto_invite) {
@@ -784,6 +792,23 @@
 					</div>
 				{/if}
 			</Label>
+			{#if !isFork && !isCloudHosted() && $enterpriseLicense}
+				<Label label="Error reporting">
+					{#snippet header()}
+						<span class="text-2xs text-secondary">(optional)</span>
+					{/snippet}
+					<span class="text-xs text-secondary">
+						Until this workspace has its own error handler, report failed jobs to the Slack, Teams
+						and email channels a superadmin configured in the instance critical alert settings.
+					</span>
+					<div class="pt-1">
+						<Toggle
+							bind:checked={errorHandlerFallbackToInstanceAlerts}
+							options={{ right: 'Use the instance critical alert channels' }}
+						/>
+					</div>
+				</Label>
+			{/if}
 			{#if isFork && canDesignateDevWorkspace}
 				<Label label="Persistent dev workspace">
 					<span class="text-xs text-secondary">
diff --git a/frontend/src/routes/(root)/(logged)/workspace_settings/+page.svelte b/frontend/src/routes/(root)/(logged)/workspace_settings/+page.svelte
index 54b03d9b9c..49c29cc1a7 100644
--- a/frontend/src/routes/(root)/(logged)/workspace_settings/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/workspace_settings/+page.svelte
@@ -346,6 +346,12 @@
 	// their `usr` row is copied from the parent, so forking as an ordinary developer leaves them
 	// unable to bring anyone in to collaborate. Nothing else on this page opens up — the backend
 	// only grants them developer memberships on the fork they created.
+	// The instance channels are not a valid destination on cloud or on a fork. Never select a tab
+	// the group does not render: saving would submit a value the API rejects, locking the whole
+	// error handler behind a 400.
+	const canUseInstanceAlerts = $derived(
+		!isCloudHosted() && !currentWorkspace?.parent_workspace_id
+	)
 	const isForkOwner = $derived(
 		Boolean(currentWorkspace?.parent_workspace_id) &&
 			currentWorkspace?.created_by === $userStore?.email
@@ -609,6 +615,12 @@
 		initialPublicAppRateLimitPerMinute = settings.public_app_execution_limit_per_minute ?? undefined
 		if (emptyString($enterpriseLicense)) {
 			errorHandlerSelected = 'custom'
+		} else if (
+			canUseInstanceAlerts &&
+			!errorHandlerPath &&
+			settings.error_handler_fallback_to_instance_alerts
+		) {
+			errorHandlerSelected = 'instance_alerts'
 		} else {
 			errorHandlerSelected = getHandlerType(errorHandlerScriptPath)
 		}
@@ -805,7 +817,8 @@
 					path: `${errorHandlerItemKind}/${errorHandlerScriptPath}`,
 					extra_args: errorHandlerExtraArgs,
 					muted_on_cancel: errorHandlerMutedOnCancel,
-					muted_on_user_path: errorHandlerMutedOnUserPath
+					muted_on_user_path: errorHandlerMutedOnUserPath,
+					fallback_to_instance_alerts: false
 				}
 			})
 			sendUserToast(`workspace error handler set to ${errorHandlerScriptPath}`)
@@ -816,10 +829,17 @@
 					path: undefined,
 					extra_args: undefined,
 					muted_on_cancel: undefined,
-					muted_on_user_path: undefined
+					muted_on_user_path: undefined,
+					fallback_to_instance_alerts: errorHandlerSelected === 'instance_alerts'
 				}
 			})
-			sendUserToast(`workspace error handler removed`)
+			sendUserToast(
+				errorHandlerSelected === 'instance_alerts'
+					? `failed jobs will be reported to the instance critical alert channels`
+					: initialErrorHandlerScriptPath
+						? `workspace error handler removed`
+						: `error handler settings saved`
+			)
 		}
 
 		// Update initial values for dirty detection
@@ -1809,6 +1829,7 @@
 										customScriptTemplate="/scripts/add?hub=hub%2F9083%2Fwindmill%2Fworkspace_error_handler_template"
 										bind:customHandlerKind={errorHandlerItemKind}
 										bind:handlerExtraArgs={errorHandlerExtraArgs}
+										showInstanceAlerts={canUseInstanceAlerts}
 									>
 										{#snippet customTabTooltip()}
 											<Tooltip>
@@ -1838,24 +1859,26 @@
 										{/snippet}
 									</ErrorOrRecoveryHandler>
 
-									<SettingCard class="gap-2">
-										<Toggle
-											disabled={!$enterpriseLicense ||
-												((errorHandlerSelected === 'slack' || errorHandlerSelected === 'teams') &&
-													!emptyString(errorHandlerScriptPath) &&
-													emptyString(errorHandlerExtraArgs['channel']))}
-											bind:checked={errorHandlerMutedOnCancel}
-											options={{ right: 'Do not run error handler for canceled jobs' }}
-										/>
-										<Toggle
-											disabled={!$enterpriseLicense ||
-												((errorHandlerSelected === 'slack' || errorHandlerSelected === 'teams') &&
-													!emptyString(errorHandlerScriptPath) &&
-													emptyString(errorHandlerExtraArgs['channel']))}
-											bind:checked={errorHandlerMutedOnUserPath}
-											options={{ right: 'Do not run error handler for u/ scripts and flows' }}
-										/>
-									</SettingCard>
+									{#if errorHandlerSelected !== 'instance_alerts'}
+										<SettingCard class="gap-2">
+											<Toggle
+												disabled={!$enterpriseLicense ||
+													((errorHandlerSelected === 'slack' || errorHandlerSelected === 'teams') &&
+														!emptyString(errorHandlerScriptPath) &&
+														emptyString(errorHandlerExtraArgs['channel']))}
+												bind:checked={errorHandlerMutedOnCancel}
+												options={{ right: 'Do not run error handler for canceled jobs' }}
+											/>
+											<Toggle
+												disabled={!$enterpriseLicense ||
+													((errorHandlerSelected === 'slack' || errorHandlerSelected === 'teams') &&
+														!emptyString(errorHandlerScriptPath) &&
+														emptyString(errorHandlerExtraArgs['channel']))}
+												bind:checked={errorHandlerMutedOnUserPath}
+												options={{ right: 'Do not run error handler for u/ scripts and flows' }}
+											/>
+										</SettingCard>
+									{/if}
 								</div>
 
 								<SettingsFooter

From 161c7f46557ed46361538f213cfba20e0d1cde05 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 24 Jul 2026 10:23:18 +0200
Subject: [PATCH 147/171] test(cli): drain async dependency jobs after sync
 push to fix flake (#10293)

* test(cli): drain async dependency jobs after sync push to fix flake

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* docs(cli): condense waitForDeploymentJobs comment

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 cli/test/new_commands_helpers.ts | 25 +++++++++++++
 cli/test/raw_app_sync.test.ts    | 10 +++++
 cli/test/sync_pull_push.test.ts  | 63 +++-----------------------------
 3 files changed, 41 insertions(+), 57 deletions(-)

diff --git a/cli/test/new_commands_helpers.ts b/cli/test/new_commands_helpers.ts
index 4702ca5eb6..641c35eb5d 100644
--- a/cli/test/new_commands_helpers.ts
+++ b/cli/test/new_commands_helpers.ts
@@ -104,6 +104,31 @@ export async function waitForJob(
   throw new Error(`Job ${jobId} did not complete within ${timeoutMs}ms`);
 }
 
+/**
+ * `sync push` returns before its async dependency job (relock + raw-app bundle)
+ * rewrites the deployed version; pulling or re-pushing meanwhile races that
+ * write-back. Call after each push to let the isolated workspace's queue drain.
+ */
+export async function waitForDeploymentJobs(
+  backend: TestBackend,
+  timeoutMs: number = 30000
+): Promise<void> {
+  const start = Date.now();
+  while (Date.now() - start < timeoutMs) {
+    const resp = await backend.apiRequest!(
+      `/api/w/${backend.workspace}/jobs/queue/list?job_kinds=dependencies,flowdependencies,appdependencies`
+    );
+    if (!resp.ok) {
+      await resp.text().catch(() => {});
+      throw new Error(`Failed to list queued dependency jobs: ${resp.status}`);
+    }
+    const jobs = await resp.json();
+    if (Array.isArray(jobs) && jobs.length === 0) return;
+    await new Promise((r) => setTimeout(r, 100));
+  }
+  throw new Error(`Dependency jobs did not drain within ${timeoutMs}ms`);
+}
+
 export async function createRemoteFlow(
   backend: TestBackend,
   flowPath: string
diff --git a/cli/test/raw_app_sync.test.ts b/cli/test/raw_app_sync.test.ts
index 3cf1172daa..3cc7026430 100644
--- a/cli/test/raw_app_sync.test.ts
+++ b/cli/test/raw_app_sync.test.ts
@@ -1,5 +1,6 @@
 import { expect, test } from "bun:test";
 import { withTestBackend } from "./test_backend.ts";
+import { waitForDeploymentJobs } from "./new_commands_helpers.ts";
 import { addWorkspace } from "../workspace.ts";
 import * as path from "node:path";
 import { writeFile, readFile, stat, rm, mkdir, readdir } from "node:fs/promises";
@@ -174,6 +175,7 @@ excludes: []`, "utf-8");
       ], tempDir, "raw_app_test");
 
       expect(pushResult1.code).toEqual(0);
+      await waitForDeploymentJobs(backend);
 
       // =========================================================================
       // STEP 2: Clear disk and pull - verify raw app is pulled correctly
@@ -240,6 +242,7 @@ excludes: []`, "utf-8");
       ], tempDir, "raw_app_test");
 
       expect(pushResult2.code).toEqual(0);
+      await waitForDeploymentJobs(backend);
 
       // =========================================================================
       // STEP 5: Clear disk (delete the app directory)
@@ -349,6 +352,7 @@ excludes: []`, "utf-8");
       ], tempDir, "raw_app_new_file_test");
 
       expect(pushResult1.code).toEqual(0);
+      await waitForDeploymentJobs(backend);
 
       // Add a new file
       const newFilePath = path.join(appDir, "utils.ts");
@@ -364,6 +368,7 @@ excludes: []`, "utf-8");
       ], tempDir, "raw_app_new_file_test");
 
       expect(pushResult2.code).toEqual(0);
+      await waitForDeploymentJobs(backend);
 
       // Clear and pull again
       await rm(appDir, { recursive: true });
@@ -420,6 +425,7 @@ excludes: []`, "utf-8");
         tempDir, "raw_app_ts_first_test"
       );
       expect(pushResult1.code).toEqual(0);
+      await waitForDeploymentJobs(backend);
 
       // Edit App.tsx (and the .ts file that sorts first) and push again.
       const appTsxPath = path.join(appDir, "App.tsx");
@@ -436,6 +442,7 @@ excludes: []`, "utf-8");
         tempDir, "raw_app_ts_first_test"
       );
       expect(pushResult2.code).toEqual(0);
+      await waitForDeploymentJobs(backend);
 
       // The App.tsx edit must have landed on the remote app's bundled files.
       const appResp = await backend.apiRequest!(
@@ -486,6 +493,7 @@ excludes: []`, "utf-8");
       ], tempDir, "raw_app_delete_file_test");
 
       expect(pushResult1.code).toEqual(0);
+      await waitForDeploymentJobs(backend);
 
       const indexCssPath = path.join(appDir, "index.css");
       const appTsxPath = path.join(appDir, "App.tsx");
@@ -507,6 +515,7 @@ excludes: []`, "utf-8");
       ], tempDir, "raw_app_delete_file_test");
 
       expect(pushResult2.code).toEqual(0);
+      await waitForDeploymentJobs(backend);
 
       // Clear and pull again
       await rm(appDir, { recursive: true });
@@ -620,6 +629,7 @@ excludes: []`, "utf-8");
         tempDir, "raw_app_camelcase_test"
       );
       expect(pushResult1.code).toEqual(0);
+      await waitForDeploymentJobs(backend);
 
       await rm(appDir, { recursive: true });
 
diff --git a/cli/test/sync_pull_push.test.ts b/cli/test/sync_pull_push.test.ts
index 4b5b8e5389..343ed49ef7 100644
--- a/cli/test/sync_pull_push.test.ts
+++ b/cli/test/sync_pull_push.test.ts
@@ -47,6 +47,7 @@ import {
   newPathAssigner,
   newRawAppPathAssigner,
 } from "../windmill-utils-internal/src/path-utils/path-assigner.ts";
+import { waitForDeploymentJobs } from "./new_commands_helpers.ts";
 
 // =============================================================================
 // Test Fixtures - Every Type of Windmill Resource
@@ -497,58 +498,6 @@ async function cleanupTempDir(dir: string): Promise<void> {
   }
 }
 
-// Polls /flows/deployment_status/p/{path} + /jobs_u/completed/get until the
-// most recent flow dependency job has completed. After a flow create/update
-// the API queues a FlowDependencies job that asynchronously fills inline-
-// script lockfiles and rewrites flow.value; tests that round-trip through
-// sync push/pull must wait for it or they race the worker (CI-only flake).
-// `deployment_status` is the right read here — `/flows/get` does not return
-// `dependency_job`, but the `deployment_metadata.job_id` row is written in
-// the same tx as the dep-job push, so the returned `job_id` is the latest
-// dep-job UUID by the time the create/update API call has returned. Returns
-// silently if the flow doesn't exist on the server (treats it as a no-op
-// push, since the route returns 404 when the flow row is missing).
-async function waitForFlowDependencyJob(
-  backend: any,
-  flowPath: string,
-  timeoutMs: number = 30000,
-): Promise<void> {
-  const start = Date.now();
-  while (Date.now() - start < timeoutMs) {
-    const statusResp = await backend.apiRequest!(
-      `/api/w/${backend.workspace}/flows/deployment_status/p/${flowPath}`,
-    );
-    if (statusResp.status === 404) {
-      await statusResp.text().catch(() => {});
-      return;
-    }
-    if (!statusResp.ok) {
-      await statusResp.text().catch(() => {});
-      throw new Error(
-        `Failed to fetch deployment status for ${flowPath}: ${statusResp.status}`,
-      );
-    }
-    const status = await statusResp.json();
-    const depJobId: string | undefined = status?.job_id;
-    if (!depJobId) {
-      await new Promise((r) => setTimeout(r, 100));
-      continue;
-    }
-    const completed = await backend.apiRequest!(
-      `/api/w/${backend.workspace}/jobs_u/completed/get/${depJobId}`,
-    );
-    if (completed.ok) {
-      await completed.text();
-      return;
-    }
-    await completed.text().catch(() => {});
-    await new Promise((r) => setTimeout(r, 100));
-  }
-  throw new Error(
-    `Flow dependency job for ${flowPath} did not complete within ${timeoutMs}ms`,
-  );
-}
-
 // =============================================================================
 // Tests
 // =============================================================================
@@ -1853,11 +1802,11 @@ excludes: []
 
       expect(pushResult.code).toEqual(0);
 
-      // sync push of the flow enqueues an async FlowDependencies job that
-      // generates the inline-script lockfile and rewrites flow.value. Wait for
-      // it before pulling back, otherwise pull races the worker and the
-      // dry-run push idempotency check sees phantom diffs (CI-only flake).
-      await waitForFlowDependencyJob(backend, flowName);
+      // Both the script (empty lock) and the flow enqueue async dependency jobs
+      // that generate lockfiles and rewrite the deployed value. Drain them before
+      // pulling back, otherwise pull races the worker and the dry-run push
+      // idempotency check sees phantom diffs (CI-only flake).
+      await waitForDeploymentJobs(backend);
 
       // Pull back
       const pullResult = await backend.runCLICommand(

From 53ad86cd1e3ad1954aef031ece169355d0251dc9 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 24 Jul 2026 10:43:44 +0200
Subject: [PATCH 148/171] docs: fix stale detach_dev_workspace comment on
 parent_workspace_id (#10296)

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 backend/windmill-api-workspaces/src/workspaces.rs | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/backend/windmill-api-workspaces/src/workspaces.rs b/backend/windmill-api-workspaces/src/workspaces.rs
index 9cf80e5e39..9089b6e8b6 100644
--- a/backend/windmill-api-workspaces/src/workspaces.rs
+++ b/backend/windmill-api-workspaces/src/workspaces.rs
@@ -7178,7 +7178,8 @@ async fn attach_dev_workspace(
 }
 
 /// Reverse [`attach_dev_workspace`] / clear the dev designation: unset the dev flag and remove the
-/// prod lock. The workspace keeps its `parent_workspace_id` (it remains an ordinary fork).
+/// prod lock. Whether `parent_workspace_id` is kept depends on the workspace's origin (see the
+/// UPDATE below): a genuine fork stays a fork, a standalone workspace returns to standalone.
 async fn detach_dev_workspace(
     authed: ApiAuthed,
     Extension(db): Extension<DB>,

From 9713e6074d2df55db1331cf31ee1357606b1dbe9 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 24 Jul 2026 10:50:46 +0200
Subject: [PATCH 149/171] fix: resolve svelte/style export conditions in
 raw-app CLI bundler (#10294)

The `wmill app dev`/`app bundle` esbuild config never set custom export
conditions, so it only used esbuild's browser-platform defaults
(browser/module/import/default). Packages that gate their entry points
behind other conditions failed to resolve:

- tailwindcss v4 exposes its CSS entry only under `style` (`@import
  "tailwindcss"` -> ./index.css)
- flowbite-svelte exposes its entry only under `svelte` (-> raw .svelte)

Enable the needed conditions, split by scope:

- `style` + `module` are global (DEFAULT_BUILD_OPTIONS): `style` benefits
  any app (Tailwind, CSS libs), and `module` must be re-added because
  esbuild drops its auto-included `module` default once any custom
  condition is set.
- `svelte` is gated per-app via conditionsFor(frameworks.svelte). It
  points at raw .svelte sources that only compile with the Svelte plugin
  (itself loaded only for Svelte apps), so enabling it globally would make
  a Svelte-dual-published import in a plain app hard-fail with no .svelte
  loader.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 cli/src/commands/app/bundle.ts | 19 ++++++++++++++++++-
 cli/src/commands/app/dev.ts    |  2 +-
 2 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/cli/src/commands/app/bundle.ts b/cli/src/commands/app/bundle.ts
index 07ee266145..c515e1e86e 100644
--- a/cli/src/commands/app/bundle.ts
+++ b/cli/src/commands/app/bundle.ts
@@ -35,10 +35,24 @@ export const DEFAULT_BUILD_OPTIONS = {
   loader: {
     ".css": "css" as const,
   },
+  // esbuild export conditions safe for any app: "style" resolves tailwindcss v4's CSS
+  // entry (@import "tailwindcss"); "module" is re-added because esbuild drops its
+  // auto-included "module" default once any custom condition is set. The Svelte-only
+  // "svelte" condition is gated per-app in conditionsFor().
+  conditions: ["style", "module"],
   logLevel: "info" as const,
   write: true,
 };
 
+// "svelte" points at raw .svelte sources that only compile with the Svelte plugin, so
+// enable it only for Svelte apps — for a plain app a Svelte-dual-published import would
+// otherwise resolve to .svelte and hard-fail with no loader configured.
+function conditionsFor(svelte: boolean): string[] {
+  return svelte
+    ? [...DEFAULT_BUILD_OPTIONS.conditions, "svelte"]
+    : DEFAULT_BUILD_OPTIONS.conditions;
+}
+
 /**
  * Detects which frontend frameworks are present in package.json
  */
@@ -284,6 +298,7 @@ export async function createBundle(
 
   const buildOptions = {
     ...DEFAULT_BUILD_OPTIONS,
+    conditions: conditionsFor(frameworks.svelte),
     entryPoints: [entryPoint],
     outfile,
     sourcemap,
@@ -337,11 +352,13 @@ export async function createBundle(
 /**
  * Gets the esbuild build options for use in watch mode (dev server)
  * @param entryPoint Entry point file
+ * @param svelte Whether the app is a Svelte app (enables the "svelte" condition)
  * @returns esbuild build options
  */
-export function getDevBuildOptions(entryPoint: string = "index.tsx") {
+export function getDevBuildOptions(entryPoint: string = "index.tsx", svelte = false) {
   return {
     ...DEFAULT_BUILD_OPTIONS,
+    conditions: conditionsFor(svelte),
     entryPoints: [entryPoint],
     outfile: "dist/bundle.js",
     sourcemap: true,
diff --git a/cli/src/commands/app/dev.ts b/cli/src/commands/app/dev.ts
index 1a226ec5ef..1842e1d007 100644
--- a/cli/src/commands/app/dev.ts
+++ b/cli/src/commands/app/dev.ts
@@ -538,7 +538,7 @@ async function dev(opts: DevOptions, appFolder?: string) {
     });
   }
 
-  const buildOptions = getDevBuildOptions(entryPoint);
+  const buildOptions = getDevBuildOptions(entryPoint, frameworks.svelte);
 
   // Load framework-specific plugins (svelte, vue) based on package.json
   const frameworkPlugins = await createFrameworkPlugins(appDir);

From 30d8104edcbdb7f0c63f186d22ac03000e0d4f07 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 24 Jul 2026 10:53:24 +0200
Subject: [PATCH 150/171] feat: alert on expired online license key (#10295)

* [ee] feat: alert on expired online license key

Wire alert_on_online_license_expired into the periodic monitor loop
(verify_license_key_f), server-mode gated so only servers report to the
alerts table and critical channels. Add the ee_oss stub so the
enterprise-without-private build still compiles.

Closes the gap where an expired online (renewable) license force-set
externally (env var / CI / k8s) halted all jobs with only a stdout
tracing::error! and no critical alert.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore: point ee-repo-ref at license-expired-alert EE branch

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore: update ee-repo-ref to 9e63619688588fda434dfa06ed585f050e75ee67

This commit updates the EE repository reference after PR #682 was merged in windmill-ee-private.

Previous ee-repo-ref: 7847711567a9c66da6a5c85d176b8cacc5aa7a7f

New ee-repo-ref: 9e63619688588fda434dfa06ed585f050e75ee67

Automated by sync-ee-ref workflow.

* chore: bump ee-repo-ref to license-expiry alert review fixes

Point at the EE follow-up (windmill-ee-private#683): cross-replica dedup via
acquire_lock and no false recovery on malformed key replacement.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore: update ee-repo-ref to eb8733a36010a7509b438903e95edfa293da079b

This commit updates the EE repository reference after PR #683 was merged in windmill-ee-private.

Previous ee-repo-ref: 562a306d9b66624b28ff90958f8b45d8db5481b9

New ee-repo-ref: eb8733a36010a7509b438903e95edfa293da079b

Automated by sync-ee-ref workflow.

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
---
 backend/ee-repo-ref.txt               | 2 +-
 backend/src/monitor.rs                | 8 ++++++++
 backend/windmill-common/src/ee_oss.rs | 5 +++++
 3 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index fda20289f5..c650a8f872 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-183f78b3ee193d6b5e55fd453c570f94a12c8b13
+eb8733a36010a7509b438903e95edfa293da079b
diff --git a/backend/src/monitor.rs b/backend/src/monitor.rs
index d1e63958e2..adf859d139 100644
--- a/backend/src/monitor.rs
+++ b/backend/src/monitor.rs
@@ -3193,6 +3193,14 @@ pub async fn monitor_db(
         if !initial_load {
             verify_license_key(conn.as_sql()).await;
             refetch_license_key_if_invalid(conn).await;
+            // Server-side only: the alert writes to the alerts table and notifies
+            // the critical channels, so gate it like enforce_offline_caps rather
+            // than have every worker re-report the same expiry.
+            if server_mode {
+                if let Some(db) = conn.as_sql() {
+                    windmill_common::ee_oss::alert_on_online_license_expired(db).await;
+                }
+            }
         }
     };
 
diff --git a/backend/windmill-common/src/ee_oss.rs b/backend/windmill-common/src/ee_oss.rs
index 26b9c87b7e..2510df0960 100644
--- a/backend/windmill-common/src/ee_oss.rs
+++ b/backend/windmill-common/src/ee_oss.rs
@@ -83,6 +83,11 @@ pub async fn enforce_offline_caps(_db: &DB) -> anyhow::Result<Option<OfflineCapS
     Ok(None)
 }
 
+#[cfg(all(feature = "enterprise", not(feature = "private")))]
+pub async fn alert_on_online_license_expired(_db: &DB) {
+    // Implementation is not open source
+}
+
 #[cfg(not(feature = "private"))]
 #[derive(PartialEq, Eq)]
 pub enum LicensePlan {

From c24d6f9d11db8df295b019f10d08b85b1f81cea2 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 24 Jul 2026 11:00:22 +0200
Subject: [PATCH 151/171] chore(main): release 1.768.0 (#10281)

* chore(main): release 1.768.0

* Apply automatic changes

---------

Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>
---
 CHANGELOG.md                                  |  27 +++
 backend/Cargo.lock                            | 162 +++++++++---------
 backend/Cargo.toml                            |   4 +-
 .../parsers/windmill-parser-wasm/Cargo.lock   |  48 +++---
 .../parsers/windmill-parser-wasm/Cargo.toml   |   2 +-
 backend/windmill-api/openapi.yaml             |   2 +-
 benchmarks/lib.ts                             |   2 +-
 cli/src/core/constants.ts                     |   2 +-
 frontend/package-lock.json                    |   4 +-
 frontend/package.json                         |   2 +-
 lsp/Pipfile                                   |   2 +-
 openflow.openapi.yaml                         |   2 +-
 .../WindmillClient/WindmillClient.psd1        |   2 +-
 python-client/wmill/pyproject.toml            |   2 +-
 typescript-client/jsr.json                    |   2 +-
 typescript-client/package.json                |   2 +-
 version.txt                                   |   2 +-
 17 files changed, 148 insertions(+), 121 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 01b01f9c09..6cfff0dc6d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,32 @@
 # Changelog
 
+## [1.768.0](https://github.com/windmill-labs/windmill/compare/v1.767.0...v1.768.0) (2026-07-24)
+
+
+### Features
+
+* Add section to deploy projects to hub ([#9332](https://github.com/windmill-labs/windmill/issues/9332)) ([30eedf9](https://github.com/windmill-labs/windmill/commit/30eedf9ee1754cb2bbf46e82d2b3eac766bd3e6d))
+* **ai-chat:** let the session/global chat create email triggers ([#10282](https://github.com/windmill-labs/windmill/issues/10282)) ([248c875](https://github.com/windmill-labs/windmill/commit/248c8751b1fd5d6f7506a7c3fc8f500dd98af26e))
+* **ai:** enable data pipelines in AI sessions with alpha notice ([#10273](https://github.com/windmill-labs/windmill/issues/10273)) ([1f912f4](https://github.com/windmill-labs/windmill/commit/1f912f410401ec68789d43973d6e0a1f8e595f86))
+* alert on expired online license key ([#10295](https://github.com/windmill-labs/windmill/issues/10295)) ([30d8104](https://github.com/windmill-labs/windmill/commit/30d8104edcbdb7f0c63f186d22ac03000e0d4f07))
+* data-pipeline recorder, interactive player, and deploy-to-hub recording (WIN-2156) ([#10055](https://github.com/windmill-labs/windmill/issues/10055)) ([65e5041](https://github.com/windmill-labs/windmill/commit/65e504146d832b105603ceec89c6de0ad1d66e32))
+* let a workspace fall back to the instance critical alert channels ([#10292](https://github.com/windmill-labs/windmill/issues/10292)) ([717e38a](https://github.com/windmill-labs/windmill/commit/717e38a0c6b5bb2340e236a9d49645a4cebf4849))
+* **monitor:** make between-steps zombie flows hand-recoverable ([#10287](https://github.com/windmill-labs/windmill/issues/10287)) ([f02df7f](https://github.com/windmill-labs/windmill/commit/f02df7fc454b0c2a2afa9ae9848e26af0e379246))
+* surface workspace-script advanced settings in flow editor ([#10289](https://github.com/windmill-labs/windmill/issues/10289)) ([bf16e7d](https://github.com/windmill-labs/windmill/commit/bf16e7d49a7486d37cf9eb1907e80abae47a78a7))
+* **windows:** enable ruby and rlang on the windows worker ([#10279](https://github.com/windmill-labs/windmill/issues/10279)) ([0f1b864](https://github.com/windmill-labs/windmill/commit/0f1b8641f26f0eda8a8517db1a37efafdb173464))
+
+
+### Bug Fixes
+
+* **ci:** make /review idempotent per head commit, re-run cancelled reviews in place ([#10283](https://github.com/windmill-labs/windmill/issues/10283)) ([3aaceb7](https://github.com/windmill-labs/windmill/commit/3aaceb7efb3bd232da73b79fcdcf4c712caad7d3))
+* **cli:** surface shared UI changes in sync push dry-run preview ([#10278](https://github.com/windmill-labs/windmill/issues/10278)) ([14c29b7](https://github.com/windmill-labs/windmill/commit/14c29b77e90842b8c3d4395ce50cb44666cd998c))
+* **jobs:** sanitize NUL in completed job result before jsonb insert ([#10274](https://github.com/windmill-labs/windmill/issues/10274)) ([c50a2ab](https://github.com/windmill-labs/windmill/commit/c50a2abad0c222bf8f76ff10b864450120ee9ee7))
+* **monitor:** diagnose zombie-flow OOM on the transition worker, not q.worker ([#10286](https://github.com/windmill-labs/windmill/issues/10286)) ([fa36442](https://github.com/windmill-labs/windmill/commit/fa3644281f30d90aa0c4ca86520a38db5d8b91f0))
+* resolve svelte/style export conditions in raw-app CLI bundler ([#10294](https://github.com/windmill-labs/windmill/issues/10294)) ([9713e60](https://github.com/windmill-labs/windmill/commit/9713e6074d2df55db1331cf31ee1357606b1dbe9))
+* **resources:** apply resource_type changes on update (git-sync pull) — Fixes GIT-932 ([#10277](https://github.com/windmill-labs/windmill/issues/10277)) ([d7a0078](https://github.com/windmill-labs/windmill/commit/d7a0078b58f74f1ffecc03b348e8935a70f02e55))
+* surface workspace ids on duplicate names and explain fork promotion ([#10291](https://github.com/windmill-labs/windmill/issues/10291)) ([9b182aa](https://github.com/windmill-labs/windmill/commit/9b182aaf3879d4d81b6a785222dca75f085e6fb7))
+* treat concurrent_limit/timeout &lt;= 0 as unset instead of a zero cap ([#10288](https://github.com/windmill-labs/windmill/issues/10288)) ([8eb36ce](https://github.com/windmill-labs/windmill/commit/8eb36ce008b4efe2be9a9bfebc91af68070f7a6c))
+
 ## [1.767.0](https://github.com/windmill-labs/windmill/compare/v1.766.2...v1.767.0) (2026-07-22)
 
 
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index 0539483ee5..e988871068 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -10638,9 +10638,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-pki-types"
-version = "1.15.0"
+version = "1.15.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "764899a24af3980067ee14bc143654f297b22eaebfe3c7b6b211920a5a59b046"
+checksum = "2f4925028c7eb5d1fcdaf196971378ed9d2c1c4efc7dc5d011256f76c99c0a96"
 dependencies = [
  "web-time",
  "zeroize",
@@ -14479,7 +14479,7 @@ dependencies = [
 
 [[package]]
 name = "windmill"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -14564,7 +14564,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-ai"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "async-stream",
  "async-trait",
@@ -14597,7 +14597,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-alerting"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14610,7 +14610,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "argon2",
@@ -14749,7 +14749,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-agent-workers"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14772,7 +14772,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-assets"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14787,7 +14787,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-auth"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14813,7 +14813,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "reqwest 0.12.28",
  "serde",
@@ -14823,7 +14823,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-configs"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14840,7 +14840,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-debug"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "axum 0.8.9",
  "base64 0.22.1",
@@ -14862,7 +14862,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-embeddings"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14885,7 +14885,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flow-conversations"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14901,7 +14901,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flows"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14922,7 +14922,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-groups"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14943,7 +14943,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-inputs"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14957,7 +14957,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-integration-tests"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -14992,7 +14992,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-jobs"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15017,7 +15017,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-npm-proxy"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "axum 0.8.9",
  "flate2",
@@ -15035,7 +15035,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-openapi"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15057,7 +15057,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-schedule"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15077,7 +15077,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-scripts"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15114,7 +15114,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-settings"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15142,7 +15142,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-sse"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "lazy_static",
  "serde",
@@ -15154,7 +15154,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-users"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "argon2",
  "axum 0.8.9",
@@ -15179,7 +15179,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workers"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15193,7 +15193,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workspaces"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15228,7 +15228,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -15242,7 +15242,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15261,7 +15261,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "aes-gcm",
  "aho-corasick",
@@ -15365,7 +15365,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-dep-map"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "chrono",
  "itertools 0.14.0",
@@ -15384,7 +15384,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "regex",
  "serde",
@@ -15399,7 +15399,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "astral-tokio-tar",
@@ -15423,7 +15423,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-jseval"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -15440,7 +15440,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -15456,7 +15456,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-mcp"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15477,7 +15477,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-native-triggers"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15508,7 +15508,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-oauth"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "arc-swap",
@@ -15533,7 +15533,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-object-store"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "async-stream",
@@ -15567,7 +15567,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-operator"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -15585,7 +15585,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -15594,7 +15594,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15606,7 +15606,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15618,7 +15618,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -15630,7 +15630,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15642,7 +15642,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15654,7 +15654,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -15665,7 +15665,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15676,7 +15676,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15688,7 +15688,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -15699,7 +15699,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15721,7 +15721,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15733,7 +15733,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15747,7 +15747,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -15764,7 +15764,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15777,7 +15777,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -15789,7 +15789,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15807,7 +15807,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -15823,7 +15823,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -15839,7 +15839,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -15850,7 +15850,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15889,7 +15889,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-runtime-nativets"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "const_format",
@@ -15929,7 +15929,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "getrandom 0.3.4",
  "wasm-bindgen",
@@ -15940,7 +15940,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-store"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15974,7 +15974,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-test-utils"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15998,7 +15998,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16031,7 +16031,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-amqp"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16058,7 +16058,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-azure"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16091,7 +16091,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-email"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16111,7 +16111,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-gcp"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16145,7 +16145,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-http"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16181,7 +16181,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-kafka"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16204,7 +16204,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-mqtt"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16228,7 +16228,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-nats"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -16252,7 +16252,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-postgres"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16287,7 +16287,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-sqs"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16315,7 +16315,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-websocket"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16340,7 +16340,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "bitflags 2.13.1",
@@ -16359,7 +16359,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "async-once-cell",
@@ -16474,7 +16474,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker-volumes"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "bytes",
  "futures",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index d479a6bbb9..93dd9b8da8 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.767.0"
+version = "1.768.0"
 authors.workspace = true
 edition.workspace = true
 
@@ -88,7 +88,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal", "./parsers/windmill-parser-wasm"]
 
 [workspace.package]
-version = "1.767.0"
+version = "1.768.0"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.lock b/backend/parsers/windmill-parser-wasm/Cargo.lock
index c6cc54c97e..b2ff7a2348 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.lock
+++ b/backend/parsers/windmill-parser-wasm/Cargo.lock
@@ -6191,7 +6191,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill-common"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "aho-corasick",
  "anyhow",
@@ -6272,7 +6272,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -6284,7 +6284,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "convert_case",
  "serde",
@@ -6293,7 +6293,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6305,7 +6305,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6317,7 +6317,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -6329,7 +6329,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6341,7 +6341,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6353,7 +6353,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -6364,7 +6364,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6375,7 +6375,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6387,7 +6387,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6398,7 +6398,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -6420,7 +6420,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6432,7 +6432,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6446,7 +6446,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "convert_case",
@@ -6463,7 +6463,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6476,7 +6476,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -6488,7 +6488,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6506,7 +6506,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -6522,7 +6522,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6538,7 +6538,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wasm"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "getrandom 0.2.17",
@@ -6570,7 +6570,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -6581,7 +6581,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.767.0"
+version = "1.768.0"
 dependencies = [
  "anyhow",
  "bitflags",
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.toml b/backend/parsers/windmill-parser-wasm/Cargo.toml
index c4b4ce0993..dcb0d1f661 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.toml
+++ b/backend/parsers/windmill-parser-wasm/Cargo.toml
@@ -12,7 +12,7 @@ resolver = "2"
 members = ["."]
 
 [workspace.package]
-version = "1.767.0"
+version = "1.768.0"
 edition = "2021"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index b67461de43..fd1f3fb70d 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.767.0
+  version: 1.768.0
   title: Windmill API
 
   contact:
diff --git a/benchmarks/lib.ts b/benchmarks/lib.ts
index cded479b5e..6bf6c47c25 100644
--- a/benchmarks/lib.ts
+++ b/benchmarks/lib.ts
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.767.0";
+export const VERSION = "v1.768.0";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({
diff --git a/cli/src/core/constants.ts b/cli/src/core/constants.ts
index 0ca15dc0f7..2679cd1062 100644
--- a/cli/src/core/constants.ts
+++ b/cli/src/core/constants.ts
@@ -10,4 +10,4 @@ export const WM_FORK_PREFIX = "wm-fork";
 // (e.g. utils.ts) can read it without importing main.ts and creating a circular
 // dependency (main → workspace → utils → main) that triggers a TDZ.
 // Re-exported from main.ts for backwards compatibility.
-export const VERSION = "1.767.0";
+export const VERSION = "1.768.0";
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index bc3ab79c34..b266491ae4 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.767.0",
+	"version": "1.768.0",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "@windmill-labs/components",
-			"version": "1.767.0",
+			"version": "1.768.0",
 			"hasInstallScript": true,
 			"license": "AGPL-3.0",
 			"dependencies": {
diff --git a/frontend/package.json b/frontend/package.json
index 13fa000c49..a9045ec8c5 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.767.0",
+	"version": "1.768.0",
 	"scripts": {
 		"dev": "vite dev",
 		"dev:ui-builder": "mv static/ui_builder static/ui_builder.dev-disabled 2>/dev/null || true ; trap 'mv static/ui_builder.dev-disabled static/ui_builder 2>/dev/null || true' EXIT ; vite dev",
diff --git a/lsp/Pipfile b/lsp/Pipfile
index 60a8bf6700..30bac8a5de 100644
--- a/lsp/Pipfile
+++ b/lsp/Pipfile
@@ -4,7 +4,7 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-wmill = ">=1.767.0"
+wmill = ">=1.768.0"
 sendgrid = "*"
 mysql-connector-python = "*"
 pymongo = "*"
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index 9cf2c96fbe..dcf69637f1 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1,7 +1,7 @@
 openapi: '3.0.3'
 
 info:
-  version: 1.767.0
+  version: 1.768.0
   title: OpenFlow Spec
   contact:
     name: Ruben Fiszel
diff --git a/powershell-client/WindmillClient/WindmillClient.psd1 b/powershell-client/WindmillClient/WindmillClient.psd1
index 67b97a9696..dc61f39186 100644
--- a/powershell-client/WindmillClient/WindmillClient.psd1
+++ b/powershell-client/WindmillClient/WindmillClient.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'WindmillClient.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '1.767.0'
+    ModuleVersion     = '1.768.0'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()
diff --git a/python-client/wmill/pyproject.toml b/python-client/wmill/pyproject.toml
index 448e108d7d..6578f09d74 100644
--- a/python-client/wmill/pyproject.toml
+++ b/python-client/wmill/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill"
-version = "1.767.0"
+version = "1.768.0"
 description = "A client library for accessing Windmill server wrapping the Windmill client API"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/typescript-client/jsr.json b/typescript-client/jsr.json
index b347759a9c..a12896410b 100644
--- a/typescript-client/jsr.json
+++ b/typescript-client/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@windmill/windmill",
-  "version": "1.767.0",
+  "version": "1.768.0",
   "exports": "./src/index.ts",
   "publish": {
     "exclude": ["!src", "./s3Types.ts", "./sqlUtils.ts", "./client.ts"]
diff --git a/typescript-client/package.json b/typescript-client/package.json
index 0a89406e0e..90788d794f 100644
--- a/typescript-client/package.json
+++ b/typescript-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.767.0",
+  "version": "1.768.0",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "homepage": "https://github.com/windmill-labs/windmill/tree/main/typescript-client#readme",
diff --git a/version.txt b/version.txt
index 3ef5bceeb2..3778ed6399 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.767.0
+1.768.0

From 1d25d7539ed7fb17c47a732d6b1cd7fc19202a04 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 24 Jul 2026 13:13:24 +0200
Subject: [PATCH 152/171] feat(pipeline): collapse secondary top-bar controls
 into an overflow menu (#10300)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* feat(pipeline): collapse secondary top-bar controls into an overflow menu

The data-pipeline editor top bar crowded primary actions (mode toggle,
Run pipeline, Save) with secondary ones (Record, Download recording,
Macros), which overflowed on small screens. Move the recorder and Macros
into a single overflow (⋮) menu, and surface recording only while armed
as a compact inline "Recording" disarm pill rather than an always-present
Record button.

Fixes WIN-2237

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* refactor(pipeline): hoist armed-recorder hint to a shared const

The overflow-menu Record item and the inline armed pill both showed the
same "Recording armed…" tooltip as separate literals, which could drift.
Share one RECORDING_ARMED_HINT const.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* docs(pipeline): keep the overflow-menu rationale at a single site

Address Codex P2: the same crowding/overflow rationale was narrated at
three sites. State it once on the overflowMenuItems derived; the pill and
DropdownV2 mount keep only their local, non-duplicated notes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../(logged)/pipeline/[folder]/+page.svelte   | 95 +++++++++++--------
 1 file changed, 53 insertions(+), 42 deletions(-)

diff --git a/frontend/src/routes/(root)/(logged)/pipeline/[folder]/+page.svelte b/frontend/src/routes/(root)/(logged)/pipeline/[folder]/+page.svelte
index 765c0d251e..6123c07000 100644
--- a/frontend/src/routes/(root)/(logged)/pipeline/[folder]/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/pipeline/[folder]/+page.svelte
@@ -109,7 +109,7 @@
 		type ScriptLang
 	} from '$lib/gen'
 	import { resource } from 'runed'
-	import { emptySchema, sendUserToast } from '$lib/utils'
+	import { emptySchema, sendUserToast, type Item } from '$lib/utils'
 	import type { Schema } from '$lib/common'
 	import { beforeNavigate, goto } from '$app/navigation'
 	import { fade } from 'svelte/transition'
@@ -1422,12 +1422,51 @@
 	let recordingMode = $state(false)
 	let lastPipelineRecording = $state<PipelineRecording | undefined>(undefined)
 
+	// Shared by the overflow-menu Record item and the inline armed pill so their
+	// wording can't drift — both describe the same armed recorder.
+	const RECORDING_ARMED_HINT =
+		'Recording armed — the next pipeline run will be captured. Click to disarm.'
+
 	function downloadPipelineRecording() {
 		if (lastPipelineRecording) {
 			pipelineRecording.download(lastPipelineRecording)
 		}
 	}
 
+	// Secondary top-bar controls (recorder, macros) collapse into a single
+	// overflow (⋮) menu so the bar stays legible on small screens; only primary
+	// actions stay inline. Recording lives here rather than on the bar at all
+	// times — while armed it surfaces a compact inline pill (below) instead.
+	let overflowMenuItems = $derived.by<Item[]>(() => {
+		const items: Item[] = []
+		if (!isOperator && allPipelineScripts.length > 0) {
+			items.push({
+				displayName: recordingMode ? 'Disarm recorder' : 'Record next run',
+				icon: Circle,
+				iconColor: recordingMode ? 'rgb(220 38 38)' : undefined,
+				disabled: !!cascadeRunningRoot,
+				tooltip: recordingMode
+					? RECORDING_ARMED_HINT
+					: 'Arm the recorder so the next pipeline run is captured for offline replay',
+				action: () => (recordingMode = !recordingMode)
+			})
+			if (lastPipelineRecording && !cascadeRunningRoot) {
+				items.push({
+					displayName: 'Download last recording',
+					icon: Download,
+					action: () => downloadPipelineRecording()
+				})
+			}
+		}
+		items.push({
+			displayName: 'Macros',
+			icon: SquareFunction,
+			tooltip: "Browse the workspace's DuckDB macros (deployed // macros libraries)",
+			action: () => macroDrawer?.openDrawer()
+		})
+		return items
+	})
+
 	// Script path → its schedule's configured args, so a manual "Run pipeline"
 	// launches a schedule-triggered script with the same payload a real tick
 	// would (rather than empty args). Schedule is the only trigger that stores a
@@ -2371,40 +2410,20 @@
 		{/if}
 		<div class="flex flex-row items-center gap-2 flex-1 justify-end">
 			{#if !isOperator && allPipelineScripts.length > 0}
-				<!-- Recorder: arm to capture the next pipeline run into a
-				     downloadable recording the /pipeline_replay player can rerun offline
-				     (parity with the flow/script recorders). -->
-				{#if lastPipelineRecording && !cascadeRunningRoot}
-					<Button
-						variant="subtle"
-						unifiedSize="sm"
-						startIcon={{ icon: Download }}
-						onclick={downloadPipelineRecording}
-						title="Download the last recorded pipeline run"
+				<!-- Only the armed state surfaces on the bar (arming lives in the ⋮
+				     menu) — a compact disarm pill. -->
+				{#if recordingMode}
+					<button
+						type="button"
+						onclick={() => (recordingMode = false)}
+						disabled={!!cascadeRunningRoot}
+						class="flex items-center gap-1.5 px-2.5 py-1 rounded-md border text-xs font-medium transition-colors disabled:opacity-50 bg-red-50 dark:bg-red-900/30 border-red-300 dark:border-red-700 text-red-700 dark:text-red-400"
+						title={RECORDING_ARMED_HINT}
 					>
-						Download recording
-					</Button>
+						<Circle size={12} class="fill-red-600 text-red-600 animate-pulse" />
+						Recording
+					</button>
 				{/if}
-				<button
-					type="button"
-					onclick={() => (recordingMode = !recordingMode)}
-					disabled={!!cascadeRunningRoot}
-					class={twMerge(
-						'flex items-center gap-1.5 px-2.5 py-1 rounded-md border text-xs font-medium transition-colors disabled:opacity-50',
-						recordingMode
-							? 'bg-red-50 dark:bg-red-900/30 border-red-300 dark:border-red-700 text-red-700 dark:text-red-400'
-							: 'bg-surface border-gray-300 dark:border-gray-600 text-secondary hover:bg-surface-hover'
-					)}
-					title={recordingMode
-						? 'Recording armed — the next pipeline run will be captured. Click to disarm.'
-						: 'Arm the recorder so the next pipeline run is captured for offline replay'}
-				>
-					<Circle
-						size={12}
-						class={recordingMode ? 'fill-red-600 text-red-600 animate-pulse' : ''}
-					/>
-					{recordingMode ? 'Recording' : 'Record'}
-				</button>
 				<!-- Pipeline-level run: always visible in both View and Edit so a
 				     run never requires hunting for a specific node's play button
 				     (dbt `build` / Dagster "Materialize all"). Runs every script in
@@ -2499,15 +2518,6 @@
 					Activity
 				</Button>
 			{/if}
-			<Button
-				variant="subtle"
-				unifiedSize="sm"
-				startIcon={{ icon: SquareFunction }}
-				onclick={() => macroDrawer?.openDrawer()}
-				title="Browse the workspace's DuckDB macros (deployed // macros libraries)"
-			>
-				Macros
-			</Button>
 			<Button
 				variant="subtle"
 				unifiedSize="sm"
@@ -2517,6 +2527,7 @@
 				iconOnly
 				title="Refresh"
 			/>
+			<DropdownV2 size="sm" items={overflowMenuItems} />
 		</div>
 	</div>
 

From 010059a449f4d0cde0656086f1b3f03a02a1c78c Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 24 Jul 2026 13:29:36 +0200
Subject: [PATCH 153/171] feat(hub): surface data pipelines in deploy-to-hub
 drawer (#10299)

* feat(hub): surface data pipelines in deploy-to-hub drawer

The predeploy step listed a folder's scripts with no indication that some
form a data pipeline. Add a "Data pipeline" summary row (step count +
"View pipeline graph" drawer rendering the asset-graph cascade) and tag
pipeline-member scripts with a Pipeline badge in the item list.

Fixes WIN-2238

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(hub): drop misleading node-inspect hint from pipeline graph drawer

The read-only graph doesn't wire node selection, so the "Click a node to
inspect it" copy promised interaction that doesn't happen.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(hub): render pipeline graph inline above the list, collapsed by default

Replace the "View pipeline graph" drawer with an inline collapsible panel
above the deploy item list for pipeline folders. Collapsed by default so
the selection list stays the first thing in view; expanding reveals the
folder's asset-graph cascade in place.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(hub): don't let the inline pipeline graph capture the drawer scroll

Add an opt-in scrollZoom prop to AssetGraphCanvas (default true, preserving
the full-height editor/player). The inline deploy-to-hub panel sets it false
so wheel gestures over the 420px graph scroll the surrounding drawer instead
of zooming the canvas and swallowing the scroll.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../assets/AssetGraph/AssetGraphCanvas.svelte | 10 ++-
 .../workspaceSettings/DeployToHub.svelte      | 69 ++++++++++++++++++-
 .../deployToHubSession.svelte.ts              |  1 +
 3 files changed, 77 insertions(+), 3 deletions(-)

diff --git a/frontend/src/lib/components/assets/AssetGraph/AssetGraphCanvas.svelte b/frontend/src/lib/components/assets/AssetGraph/AssetGraphCanvas.svelte
index 8b2310a38b..3e5e9d8cef 100644
--- a/frontend/src/lib/components/assets/AssetGraph/AssetGraphCanvas.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/AssetGraphCanvas.svelte
@@ -179,6 +179,11 @@
 		 * When a node's nonce changes, it flashes a fading green background — its
 		 * producer just recomputed it. Driven by the replay player frame-by-frame. */
 		recomputedAssetIds?: ReadonlyMap<string, number>
+		/** Let the wheel zoom the canvas (and swallow the page scroll while doing
+		 * so). Default true for the full-height editor/player. Set false when the
+		 * canvas is embedded inline inside a scrollable container, so a wheel
+		 * gesture over it scrolls the container instead of being captured. */
+		scrollZoom?: boolean
 	}
 	let {
 		graph,
@@ -209,7 +214,8 @@
 		showMinimap = true,
 		viewportFitKey = '',
 		highlightActiveRun = false,
-		recomputedAssetIds
+		recomputedAssetIds,
+		scrollZoom = true
 	}: Props = $props()
 
 	// `${kind}:${path}` ids for the hovered / pinned runs (both script and flow
@@ -1188,6 +1194,8 @@
 		nodesDraggable={false}
 		nodesConnectable={false}
 		elementsSelectable
+		zoomOnScroll={scrollZoom}
+		preventScrolling={scrollZoom}
 		zoomOnDoubleClick={false}
 		connectionLineType={ConnectionLineType.SmoothStep}
 		defaultEdgeOptions={{ type: 'asset' }}
diff --git a/frontend/src/lib/components/workspaceSettings/DeployToHub.svelte b/frontend/src/lib/components/workspaceSettings/DeployToHub.svelte
index 6b51b9a782..97ce779cea 100644
--- a/frontend/src/lib/components/workspaceSettings/DeployToHub.svelte
+++ b/frontend/src/lib/components/workspaceSettings/DeployToHub.svelte
@@ -20,8 +20,10 @@
 	import Toggle from '../Toggle.svelte'
 	import MigrationSqlEditor from './MigrationSqlEditor.svelte'
 	import PipelineRecordingReplay from '$lib/components/recording/PipelineRecordingReplay.svelte'
+	import AssetGraphCanvas from '$lib/components/assets/AssetGraph/AssetGraphCanvas.svelte'
 	import {
 		Check,
+		ChevronDown,
 		Cloud,
 		Code2,
 		Copy,
@@ -55,6 +57,9 @@
 
 	let recordDrawer = $state<Drawer | undefined>()
 	let pipelinePreviewDrawer = $state<Drawer | undefined>()
+	// Inline pipeline graph above the item list, collapsed by default so the
+	// selection list stays the first thing in view.
+	let pipelineGraphOpen = $state(false)
 	let publishDrawer = $state<Drawer | undefined>()
 	let resourceDrawer = $state<Drawer | undefined>()
 	let triggerDrawer = $state<Drawer | undefined>()
@@ -464,13 +469,73 @@
 								</span>
 							</div>
 						{/if}
+						{#if s.phase === 'predeploy' && s.isPipelineProject}
+							<div
+								class="flex flex-col rounded-md border border-blue-300 bg-blue-50 dark:border-blue-800 dark:bg-blue-950/40"
+							>
+								<button
+									type="button"
+									class="flex items-center gap-2 px-3 py-2 text-left"
+									aria-expanded={pipelineGraphOpen}
+									onclick={() => (pipelineGraphOpen = !pipelineGraphOpen)}
+								>
+									<BarsStaggered class="text-blue-600 dark:text-blue-400" />
+									<span class="text-sm font-semibold text-primary">Data pipeline</span>
+									<span class="text-xs text-hint">
+										({s.pipelineScriptPaths.length} step{s.pipelineScriptPaths.length === 1
+											? ''
+											: 's'})
+									</span>
+									<Tooltip>
+										Scripts in this folder form a data-pipeline cascade (each reads or writes data
+										tables consumed by the next). Bundle the whole folder, then record the cascade
+										as one interactive replay in step 2.
+									</Tooltip>
+									<ChevronDown
+										size={16}
+										class="ml-auto shrink-0 text-tertiary transition-transform {pipelineGraphOpen
+											? 'rotate-180'
+											: ''}"
+									/>
+								</button>
+								{#if pipelineGraphOpen}
+									<div
+										class="flex flex-col gap-2 border-t border-blue-200 p-3 dark:border-blue-900"
+									>
+										<span class="text-xs text-secondary">
+											The <span class="font-mono">{s.selectedFolder}/</span> scripts and the data tables
+											they read and write, as a single pipeline. This whole cascade can be captured as
+											an interactive replay once the project is bundled.
+										</span>
+										{#if s.pipelineGraph}
+											<div class="h-[420px] overflow-hidden rounded-md border bg-surface">
+												<AssetGraphCanvas
+													graph={s.pipelineGraph}
+													viewportFitKey={s.folder}
+													scrollZoom={false}
+												/>
+											</div>
+										{:else}
+											<span class="text-xs text-hint">Loading pipeline graph…</span>
+										{/if}
+									</div>
+								{/if}
+							</div>
+						{/if}
 					</div>
 				{/snippet}
 
 				{#snippet itemSummary(item)}
 					{@const it = item as DeployItem}
-					<span class="truncate">
-						{it.summary?.trim() || it.path}
+					<span class="flex min-w-0 items-center gap-1.5">
+						<span class="truncate">
+							{it.summary?.trim() || it.path}
+						</span>
+						{#if it.kind === 'script' && s.pipelineScriptPathSet.has(it.path)}
+							<Badge color="blue" size="xs" wrapperClass="shrink-0">
+								<BarsStaggered size={10} class="mr-0.5" />Pipeline
+							</Badge>
+						{/if}
 					</span>
 				{/snippet}
 
diff --git a/frontend/src/lib/components/workspaceSettings/deployToHubSession.svelte.ts b/frontend/src/lib/components/workspaceSettings/deployToHubSession.svelte.ts
index c98b39be5d..96cb8b117c 100644
--- a/frontend/src/lib/components/workspaceSettings/deployToHubSession.svelte.ts
+++ b/frontend/src/lib/components/workspaceSettings/deployToHubSession.svelte.ts
@@ -325,6 +325,7 @@ export class DeployToHubSession {
 			this.items.some((i) => i.kind === 'script' && i.path === p)
 		)
 	)
+	pipelineScriptPathSet = $derived(new Set(this.pipelineScriptPaths))
 	isPipelineProject = $derived(this.pipelineScriptPaths.length > 0)
 	hubSlug = $derived(this.effectiveSlug || sanitizeSlug(this.hubName))
 

From 75acf7207b151f0227600be555bfa5e14dfa8dd1 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 24 Jul 2026 13:37:21 +0200
Subject: [PATCH 154/171] fix: pin table actions column so it stays visible on
 narrow screens (#10301)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix: pin table actions column so it stays visible on narrow screens

Wide DataTables (folders, variables, resources) scroll horizontally on
small screens, pushing the trailing per-row actions column (the ⋯ menu,
Edit/Delete, and folders' "Publish to Hub") off the right edge where it
was effectively unreachable.

Add an opt-in `stickyEnd` prop to Cell that pins a column to the right of
the scroll container with an opaque background and a left divider, and
apply it to the actions column (header + body) on the folders, variables,
and resources pages.

The background is opaque (bg-surface / bg-surface-secondary) rather than
the row's translucent hover tint, so cells sliding under the pinned column
are occluded instead of bleeding through.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix: keep resources actions cell as table-cell so sticky pins correctly

The workspace resources actions cell used class="flex justify-end" on the
Cell, which forces the <td> to display:flex. A flex box inside a table row
is wrapped in an anonymous table-cell, so position:sticky on it is
constrained to that wrapper and no longer pins to the scrollport — the
header stayed pinned while the row actions scrolled away.

Move the flex layout to an inner <div> so the <td> keeps display:table-cell
and the stickyEnd pin works.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix: address review nits on pinned actions column

- resources Workspace table: add `last` to the body actions cell so its
  right padding (sm:pr-6) matches the header and the other tables.
- variables table: isolate the refresh-error ping indicator's stacking
  context so its z-50 can't paint over a sticky-pinned actions column
  scrolling past it.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 frontend/src/lib/components/table/Cell.svelte |   7 +
 .../(root)/(logged)/folders/+page.svelte      |   4 +-
 .../(root)/(logged)/resources/+page.svelte    | 152 +++++++++---------
 .../(root)/(logged)/variables/+page.svelte    |  10 +-
 4 files changed, 93 insertions(+), 80 deletions(-)

diff --git a/frontend/src/lib/components/table/Cell.svelte b/frontend/src/lib/components/table/Cell.svelte
index c14e9e02c6..94aac6db7a 100644
--- a/frontend/src/lib/components/table/Cell.svelte
+++ b/frontend/src/lib/components/table/Cell.svelte
@@ -11,6 +11,7 @@
 		shouldStopPropagation?: boolean
 		selected?: boolean
 		sticky?: boolean
+		stickyEnd?: boolean
 		wrap?: boolean
 		children?: import('svelte').Snippet
 		[key: string]: any
@@ -24,6 +25,7 @@
 		shouldStopPropagation = false,
 		selected = false,
 		sticky = false,
+		stickyEnd = false,
 		wrap = false,
 		children,
 		...rest
@@ -53,6 +55,11 @@
 		last && size === 'xs' ? 'sm:pr-3' : '',
 
 		numeric ? 'text-right' : '',
+		// Pin an actions column to the right so it stays visible when a wide table
+		// scrolls horizontally. The background must be opaque so cells sliding under it
+		// are occluded — the row's hover tint is translucent and would bleed through.
+		stickyEnd ? 'sticky right-0 border-l' : '',
+		stickyEnd ? (head ? 'bg-surface-secondary' : 'bg-surface') : '',
 		sticky ? `!p-0 sticky ${first ? 'left-0' : 'right-0'}` : 'px-2 py-2',
 		size === 'sm' ? 'px-1.5 py-2.5' : '',
 		size === 'lg' ? 'px-3 py-4' : '',
diff --git a/frontend/src/routes/(root)/(logged)/folders/+page.svelte b/frontend/src/routes/(root)/(logged)/folders/+page.svelte
index 343e7a3e48..0df2235212 100644
--- a/frontend/src/routes/(root)/(logged)/folders/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/folders/+page.svelte
@@ -180,7 +180,7 @@
 						<Cell head class="w-20">Variables</Cell>
 						<Cell head class="w-20">Resources</Cell>
 						<Cell head class="w-20">Participants</Cell>
-						<Cell head last />
+						<Cell head last stickyEnd />
 					</tr>
 				</Head>
 				<tbody class="divide-y">
@@ -242,7 +242,7 @@
 								<FolderUsageInfo {name} tabular />
 
 								<Cell><FolderInfo members={computeMembers(owners, extra_perms)} /></Cell>
-								<Cell shouldStopPropagation>
+								<Cell last stickyEnd shouldStopPropagation>
 									<Dropdown
 										items={[
 											{
diff --git a/frontend/src/routes/(root)/(logged)/resources/+page.svelte b/frontend/src/routes/(root)/(logged)/resources/+page.svelte
index 5edd78dfee..d03fe118ee 100644
--- a/frontend/src/routes/(root)/(logged)/resources/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/resources/+page.svelte
@@ -1008,7 +1008,7 @@
 								<Cell head>Resource type</Cell>
 								<Cell head>Description</Cell>
 								<Cell head />
-								<Cell head last />
+								<Cell head last stickyEnd />
 							</Row>
 						</Head>
 						<tbody class="divide-y bg-surface">
@@ -1176,83 +1176,85 @@
 												{/if}
 											</div>
 										</Cell>
-										<Cell class="flex justify-end">
-											{#if path && assetCanBeExplored({ kind: 'resource', path }, { resource_type }) && !$userStore?.operator}
-												<ExploreAssetButton
-													asset={{ kind: 'resource', path }}
-													_resourceMetadata={{ resource_type }}
-													class="w-24"
-												/>
-											{/if}
-											<Dropdown
-												class="w-fit"
-												items={[
-													{
-														displayName: 'Permissions',
-														icon: Shield,
-														action: () => {
-															shareModal?.openDrawer?.(path, 'resource')
-														}
-													},
-													{
-														displayName: 'Edit',
-														icon: Pen,
-														disabled: !canWrite || !showCreateButtons,
-														action: () => {
-															resourceEditor?.initEdit?.(path)
-														}
-													},
-													...(!ws_specific && isDeployable('resource', path, deployUiSettings)
-														? [
-																{
-																	displayName: 'Deploy to prod/staging',
-																	icon: FileUp,
-																	action: () => {
-																		deploymentDrawer?.openDrawer(path, 'resource')
+										<Cell last stickyEnd>
+											<div class="flex justify-end">
+												{#if path && assetCanBeExplored({ kind: 'resource', path }, { resource_type }) && !$userStore?.operator}
+													<ExploreAssetButton
+														asset={{ kind: 'resource', path }}
+														_resourceMetadata={{ resource_type }}
+														class="w-24"
+													/>
+												{/if}
+												<Dropdown
+													class="w-fit"
+													items={[
+														{
+															displayName: 'Permissions',
+															icon: Shield,
+															action: () => {
+																shareModal?.openDrawer?.(path, 'resource')
+															}
+														},
+														{
+															displayName: 'Edit',
+															icon: Pen,
+															disabled: !canWrite || !showCreateButtons,
+															action: () => {
+																resourceEditor?.initEdit?.(path)
+															}
+														},
+														...(!ws_specific && isDeployable('resource', path, deployUiSettings)
+															? [
+																	{
+																		displayName: 'Deploy to prod/staging',
+																		icon: FileUp,
+																		action: () => {
+																			deploymentDrawer?.openDrawer(path, 'resource')
+																		}
 																	}
-																}
-															]
-														: []),
-													{
-														displayName: 'Delete',
-														disabled: !canWrite || !showCreateButtons,
-														icon: Trash,
-														type: 'delete',
-														action: (event) => {
-															// TODO
-															// @ts-ignore
-															if (event?.shiftKey) {
-																deleteResource(path, account)
-															} else {
-																deleteIsLinked = is_linked ?? false
-																deleteConfirmedCallback = () => {
+																]
+															: []),
+														{
+															displayName: 'Delete',
+															disabled: !canWrite || !showCreateButtons,
+															icon: Trash,
+															type: 'delete',
+															action: (event) => {
+																// TODO
+																// @ts-ignore
+																if (event?.shiftKey) {
 																	deleteResource(path, account)
+																} else {
+																	deleteIsLinked = is_linked ?? false
+																	deleteConfirmedCallback = () => {
+																		deleteResource(path, account)
+																	}
 																}
 															}
-														}
-													},
-													...(account != undefined
-														? [
-																{
-																	displayName: 'Refresh token',
-																	icon: RotateCw,
-																	action: async () => {
-																		await OauthService.refreshToken({
-																			workspace: $workspaceStore ?? '',
-																			id: account ?? 0,
-																			requestBody: {
-																				path
-																			}
-																		})
-																		sendUserToast('Token refreshed')
-																		loadResources()
+														},
+														...(account != undefined
+															? [
+																	{
+																		displayName: 'Refresh token',
+																		icon: RotateCw,
+																		action: async () => {
+																			await OauthService.refreshToken({
+																				workspace: $workspaceStore ?? '',
+																				id: account ?? 0,
+																				requestBody: {
+																					path
+																				}
+																			})
+																			sendUserToast('Token refreshed')
+																			loadResources()
+																		}
 																	}
-																}
-															]
-														: [])
-												]}
-											/>
-										</Cell>
+																]
+															: [])
+													]}
+												/>
+											</div></Cell
+										>
 									</Row>
 								{/each}
 							{/if}
@@ -1280,7 +1282,7 @@
 							<Row>
 								<Cell head first>Name</Cell>
 								<Cell head>Description</Cell>
-								<Cell head last />
+								<Cell head last stickyEnd />
 							</Row>
 						</Head>
 						<tbody class="divide-y bg-surface">
@@ -1316,7 +1318,7 @@
 												{removeMarkdown(truncate(description ?? '', 200))}
 											</span>
 										</Cell>
-										<Cell last>
+										<Cell last stickyEnd>
 											{#if !canWrite}
 												<Badge>
 													Shared globally
diff --git a/frontend/src/routes/(root)/(logged)/variables/+page.svelte b/frontend/src/routes/(root)/(logged)/variables/+page.svelte
index af2184e7f5..ed01a56ac6 100644
--- a/frontend/src/routes/(root)/(logged)/variables/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/variables/+page.svelte
@@ -362,7 +362,7 @@
 								<Cell head>Value</Cell>
 								<Cell head>Description</Cell>
 								<Cell head />
-								<Cell head last />
+								<Cell head last stickyEnd />
 							</tr>
 						</Head>
 						<tbody class="divide-y">
@@ -465,7 +465,11 @@
 												<div class="">
 													{#if refresh_error}
 														<Popover notClickable>
-															<div class="relative inline-flex justify-center items-center w-4 h-4">
+															<!-- isolate: confine the ping indicator's z-50 to a local stacking context
+											     so it can't paint over a sticky-pinned actions column scrolling past it -->
+															<div
+																class="relative inline-flex justify-center items-center w-4 h-4 isolate"
+															>
 																<Circle
 																	class="text-red-600 animate-ping absolute z-50 w-4 h-4 fill-current"
 																	size={12}
@@ -514,7 +518,7 @@
 											{/if}
 										</div>
 									</Cell>
-									<Cell last shouldStopPropagation>
+									<Cell last stickyEnd shouldStopPropagation>
 										<Dropdown
 											items={() => {
 												let owner = isOwner(path, $userStore, $workspaceStore)

From 1478d12eb352b1b7906ccfe3ab5eaafe60ffbe4f Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 24 Jul 2026 14:37:21 +0200
Subject: [PATCH 155/171] perf: optimize get_datatable_full_schema to avoid
 timeout on large catalogs (#10304)

pg_get_full_schema built each column row with three per-column correlated
subqueries (default value, primary-key EXISTS on pg_index, pk constraint
name on pg_constraint). On large catalogs those run once per column and the
introspection times out. Replace them with plain joins to pg_attrdef and the
table's single primary-key constraint, so the planner does one hash/merge
join instead of O(columns) index searches. Output is byte-for-byte identical.

Fixes WIN-2239

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 backend/windmill-common/src/query_builders.rs | 22 ++++++++++---------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/backend/windmill-common/src/query_builders.rs b/backend/windmill-common/src/query_builders.rs
index ce7dbc2533..063d3958de 100644
--- a/backend/windmill-common/src/query_builders.rs
+++ b/backend/windmill-common/src/query_builders.rs
@@ -4835,6 +4835,10 @@ fn pg_action_to_string(action: &str) -> String {
 pub async fn pg_get_full_schema(
     client: &tokio_postgres::Client,
 ) -> Result<FullDatabaseSchema, String> {
+    // Primary-key and default-value info are joined in (a table has at most one
+    // primary-key constraint, so `pkc` stays 1:1) rather than fetched via
+    // per-column correlated subqueries — on large catalogs those subqueries run
+    // once per column and make the introspection time out.
     let column_rows = client
         .query(
             "SELECT
@@ -4842,19 +4846,17 @@ pub async fn pg_get_full_schema(
                 c.relname AS table_name,
                 a.attname AS column_name,
                 pg_catalog.format_type(a.atttypid, a.atttypmod) AS datatype,
-                (SELECT substring(pg_catalog.pg_get_expr(d.adbin, d.adrelid, true) for 128)
-                 FROM pg_catalog.pg_attrdef d
-                 WHERE d.adrelid = a.attrelid AND d.adnum = a.attnum AND a.atthasdef) AS default_value,
-                CASE a.attnotnull WHEN false THEN true ELSE false END AS nullable,
-                EXISTS (
-                    SELECT 1 FROM pg_catalog.pg_index i
-                    WHERE i.indrelid = c.oid AND i.indisprimary AND a.attnum = ANY(i.indkey)
-                ) AS is_primary_key,
-                (SELECT con.conname FROM pg_catalog.pg_constraint con
-                 WHERE con.conrelid = c.oid AND con.contype = 'p' LIMIT 1) AS pk_constraint_name
+                substring(pg_catalog.pg_get_expr(ad.adbin, ad.adrelid, true) for 128) AS default_value,
+                NOT a.attnotnull AS nullable,
+                COALESCE(pkc.conkey @> ARRAY[a.attnum], false) AS is_primary_key,
+                pkc.conname AS pk_constraint_name
             FROM pg_catalog.pg_attribute a
             JOIN pg_catalog.pg_class c ON a.attrelid = c.oid
             JOIN pg_catalog.pg_namespace ns ON c.relnamespace = ns.oid
+            LEFT JOIN pg_catalog.pg_attrdef ad
+                ON ad.adrelid = a.attrelid AND ad.adnum = a.attnum AND a.atthasdef
+            LEFT JOIN pg_catalog.pg_constraint pkc
+                ON pkc.conrelid = c.oid AND pkc.contype = 'p'
             WHERE c.relkind = 'r'
                 AND a.attnum > 0
                 AND NOT a.attisdropped

From 3cf7a390a37c07a818248c95defa4ecf5bf262e5 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 24 Jul 2026 15:04:40 +0200
Subject: [PATCH 156/171] fix: pin validated DNS address to close SSRF
 DNS-rebinding TOCTOU (#10303)

* [ee] fix: pin validated DNS address to close SSRF DNS-rebinding TOCTOU

validate_url_for_ssrf resolved the host, checked every address was
public, then discarded them. Callers re-used the hostname and let stock
reqwest re-resolve at connect time, so a TTL-0 DNS rebinder that answered
a public IP at check-time and an internal one (e.g. 169.254.169.254) at
connect-time slipped straight through the guard.

Return the resolved addresses as a ValidatedTarget and pin them onto the
client that connects, so validate-time and connect-time target the same
address. Covers the AI proxy and worker AI-agent base_url (the primary
readable-SSRF sink), AI OAuth token_url, MCP server + OAuth
registration/discovery/token endpoints, SAML metadata, and the WebSocket
trigger connect.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore: update ee-repo-ref to 22abd6d4e229f1206a13ebee8a6a9b808cd82a0d

This commit updates the EE repository reference after PR #684 was merged in windmill-ee-private.

Previous ee-repo-ref: 700feb02ef1b96758ba9425358dbebc83bc02c61

New ee-repo-ref: 22abd6d4e229f1206a13ebee8a6a9b808cd82a0d

Automated by sync-ee-ref workflow.

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
---
 backend/ee-repo-ref.txt                       |   2 +-
 backend/windmill-ai/src/utils.rs              |  78 +++++++++--
 backend/windmill-api/src/ai.rs                | 114 +++++++++++-----
 backend/windmill-common/src/ssrf.rs           | 126 ++++++++++++++++--
 backend/windmill-mcp/src/client/mod.rs        |  16 ++-
 .../windmill-mcp/src/client_registration.rs   |  18 ++-
 backend/windmill-mcp/src/lib.rs               |  21 +++
 .../windmill-trigger-websocket/src/handler.rs |   4 +-
 backend/windmill-trigger-websocket/src/lib.rs |  31 +++--
 .../src/listener.rs                           |   4 +-
 .../windmill-trigger-websocket/src/proxy.rs   |  81 +++++++----
 backend/windmill-worker/src/ai_executor.rs    |  11 +-
 12 files changed, 401 insertions(+), 105 deletions(-)

diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index c650a8f872..90323f6205 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-eb8733a36010a7509b438903e95edfa293da079b
+22abd6d4e229f1206a13ebee8a6a9b808cd82a0d
diff --git a/backend/windmill-ai/src/utils.rs b/backend/windmill-ai/src/utils.rs
index 66b68e9b6f..328d2e0458 100644
--- a/backend/windmill-ai/src/utils.rs
+++ b/backend/windmill-ai/src/utils.rs
@@ -18,20 +18,19 @@ lazy_static::lazy_static! {
     /// use it instead of the shared `HTTP_CLIENT`. Redirects are governed by
     /// `ALLOW_AI_BASE_URL_REDIRECTS` (disabled by default). Mirrors the API proxy
     /// client (windmill-api/src/ai.rs).
+    ///
+    /// This pooled client does no DNS pinning: callers reaching a user-controlled
+    /// base_url must go through [`pinned_ai_client_for`] so the connect targets
+    /// the SSRF-validated address (DNS-rebinding TOCTOU). It is the safe default
+    /// only for trusted/fixed hosts.
     pub static ref AI_HTTP_CLIENT: reqwest::Client = {
-        let redirect = if *ALLOW_AI_BASE_URL_REDIRECTS {
+        if *ALLOW_AI_BASE_URL_REDIRECTS {
             tracing::warn!(
                 "ALLOW_AI_BASE_URL_REDIRECTS is enabled - the AI HTTP client will follow \
                  redirects, weakening SSRF protection on provider base URLs"
             );
-            reqwest::redirect::Policy::default()
-        } else {
-            reqwest::redirect::Policy::none()
-        };
-        configure_client(reqwest::ClientBuilder::new()
-            .user_agent("windmill/beta")
-            .connect_timeout(std::time::Duration::from_secs(10))
-            .redirect(redirect))
+        }
+        ai_http_client_builder()
             .build()
             .expect("Failed to build AI HTTP client - check system TLS configuration")
     };
@@ -64,6 +63,67 @@ lazy_static::lazy_static! {
     };
 }
 
+/// Shared configuration for every client that targets a user-configured AI
+/// provider `base_url` (the pooled [`AI_HTTP_CLIENT`] and per-request DNS-pinned
+/// clients from [`pinned_ai_client_for`]). Redirects are disabled by default
+/// because the SSRF check on base_url is single-shot; DNS pinning likewise only
+/// covers the original host, so a redirect could bounce a validated public host
+/// into a private/internal one (see `ALLOW_AI_BASE_URL_REDIRECTS`).
+pub fn ai_http_client_builder() -> reqwest::ClientBuilder {
+    let redirect = if *ALLOW_AI_BASE_URL_REDIRECTS {
+        reqwest::redirect::Policy::default()
+    } else {
+        reqwest::redirect::Policy::none()
+    };
+    configure_client(
+        reqwest::ClientBuilder::new()
+            .user_agent("windmill/beta")
+            .connect_timeout(std::time::Duration::from_secs(10))
+            .redirect(redirect),
+    )
+}
+
+/// Build the client for a single outbound AI request to `url`, pinning DNS to
+/// the SSRF-validated address so the connect cannot rebind to an internal IP
+/// after the check (DNS-rebinding TOCTOU).
+///
+/// Returns the shared pooled [`AI_HTTP_CLIENT`] unchanged when there is nothing
+/// to pin — an IP-literal host, or a deployment that opted into private AI
+/// endpoints via `ALLOW_PRIVATE_AI_BASE_URLS`. The same opt-out and error hint
+/// as `AIProvider::get_base_url` apply, so this is consistent with the
+/// credential-time validation while additionally closing the connect-time window.
+pub async fn pinned_ai_client_for(
+    url: &str,
+) -> windmill_common::error::Result<std::borrow::Cow<'static, reqwest::Client>> {
+    use std::borrow::Cow;
+    use windmill_common::error::{to_anyhow, Error};
+    use windmill_common::ssrf::SsrfValidationError;
+
+    if *crate::ai_providers::ALLOW_PRIVATE_AI_BASE_URLS {
+        return Ok(Cow::Borrowed(&AI_HTTP_CLIENT));
+    }
+
+    let target = windmill_common::ssrf::validate_url_for_ssrf(url)
+        .await
+        .map_err(|e| match e {
+            e @ SsrfValidationError::Private { .. } => Error::BadRequest(format!(
+                "{e}. If you need to use private/internal AI endpoints, \
+                 set the ALLOW_PRIVATE_AI_BASE_URLS=true environment variable"
+            )),
+            e => Error::from(e),
+        })?;
+
+    if target.pinned_addrs().is_empty() {
+        return Ok(Cow::Borrowed(&AI_HTTP_CLIENT));
+    }
+
+    let client = target
+        .apply_dns_pinning(ai_http_client_builder())
+        .build()
+        .map_err(to_anyhow)?;
+    Ok(Cow::Owned(client))
+}
+
 /// AWS Bedrock do not handle structured output query param, so we use a tool for structured output. Same for every Claude models.
 pub fn should_use_structured_output_tool(provider: &AIProvider, model: &str) -> bool {
     model.contains("claude") || provider == &AIProvider::AWSBedrock
diff --git a/backend/windmill-api/src/ai.rs b/backend/windmill-api/src/ai.rs
index 89dff4cfd6..efc2ba7e60 100644
--- a/backend/windmill-api/src/ai.rs
+++ b/backend/windmill-api/src/ai.rs
@@ -104,18 +104,7 @@ lazy_static::lazy_static! {
         }
     };
 
-    pub(crate) static ref HTTP_CLIENT: Client = configure_client(reqwest::ClientBuilder::new()
-        .timeout(std::time::Duration::from_secs(*AI_TIMEOUT_SECS))
-        .pool_max_idle_per_host(HTTP_POOL_MAX_IDLE_PER_HOST)
-        .pool_idle_timeout(Some(std::time::Duration::from_secs(HTTP_POOL_IDLE_TIMEOUT_SECS)))
-        // The SSRF check in `get_base_url` only validates the configured `base_url`.
-        // reqwest follows up to 10 redirects by default and does not revalidate the
-        // hops, so a public base_url could 3xx the server into a private/internal
-        // address. Disable redirect following so the validated host is the only one
-        // we ever connect to. AI APIs respond directly and do not rely on redirects,
-        // so this holds even for ALLOW_PRIVATE_AI_BASE_URLS deployments.
-        .redirect(reqwest::redirect::Policy::none())
-        .user_agent("windmill/beta"))
+    pub(crate) static ref HTTP_CLIENT: Client = ai_http_client_builder()
         .build()
         .expect("Failed to build AI HTTP client - check system TLS configuration");
 
@@ -129,6 +118,65 @@ pub(crate) fn invalidate_ai_request_cache_for_workspace(workspace_id: &str) {
     AI_REQUEST_CACHE.retain(|(cached_workspace_id, _), _| cached_workspace_id != workspace_id);
 }
 
+/// Shared configuration for every outbound AI HTTP client (the pooled
+/// [`HTTP_CLIENT`] and the per-request DNS-pinned clients).
+///
+/// Redirects are disabled: the SSRF check only validates the configured host, so
+/// a public host that 3xx-es could otherwise bounce us to a private/internal
+/// address. AI APIs respond directly and do not rely on redirects, so this holds
+/// even for ALLOW_PRIVATE_AI_BASE_URLS deployments. DNS pinning likewise only
+/// covers the original host, so following a redirect would reopen the hole.
+fn ai_http_client_builder() -> reqwest::ClientBuilder {
+    configure_client(
+        reqwest::ClientBuilder::new()
+            .timeout(std::time::Duration::from_secs(*AI_TIMEOUT_SECS))
+            .pool_max_idle_per_host(HTTP_POOL_MAX_IDLE_PER_HOST)
+            .pool_idle_timeout(Some(std::time::Duration::from_secs(
+                HTTP_POOL_IDLE_TIMEOUT_SECS,
+            )))
+            .redirect(reqwest::redirect::Policy::none())
+            .user_agent("windmill/beta"),
+    )
+}
+
+/// Build the client for a single outbound AI request to `url`, pinning DNS to
+/// the SSRF-validated address so the connect cannot rebind to an internal IP
+/// after the check (DNS-rebinding TOCTOU).
+///
+/// Returns the shared pooled [`HTTP_CLIENT`] unchanged when there is nothing to
+/// pin — an IP-literal host, or a deployment that opted into private AI
+/// endpoints via `ALLOW_PRIVATE_AI_BASE_URLS`. The same opt-out and error hint
+/// as `get_base_url` apply, so the guard here is consistent with save-time
+/// validation while additionally closing the connect-time window.
+async fn pinned_ai_client_for(url: &str) -> Result<std::borrow::Cow<'static, Client>> {
+    use std::borrow::Cow;
+    use windmill_common::ssrf::SsrfValidationError;
+
+    if *windmill_ai::ai_providers::ALLOW_PRIVATE_AI_BASE_URLS {
+        return Ok(Cow::Borrowed(&HTTP_CLIENT));
+    }
+
+    let target = windmill_common::ssrf::validate_url_for_ssrf(url)
+        .await
+        .map_err(|e| match e {
+            e @ SsrfValidationError::Private { .. } => Error::BadRequest(format!(
+                "{e}. If you need to use private/internal AI endpoints, \
+                 set the ALLOW_PRIVATE_AI_BASE_URLS=true environment variable"
+            )),
+            e => Error::from(e),
+        })?;
+
+    if target.pinned_addrs().is_empty() {
+        return Ok(Cow::Borrowed(&HTTP_CLIENT));
+    }
+
+    let client = target
+        .apply_dns_pinning(ai_http_client_builder())
+        .build()
+        .map_err(to_anyhow)?;
+    Ok(Cow::Owned(client))
+}
+
 #[derive(Deserialize, Debug)]
 struct AIOAuthResource {
     client_id: String,
@@ -303,23 +351,13 @@ async fn get_token_using_oauth(
     // Validate the resolved token_url against SSRF rules before issuing the request,
     // mirroring the protection applied to base_url in `get_base_url` (same
     // ALLOW_PRIVATE_AI_BASE_URLS opt-in). Without this a workspace member could
-    // point token_url at an internal/metadata address.
-    if !*windmill_ai::ai_providers::ALLOW_PRIVATE_AI_BASE_URLS {
-        use windmill_common::ssrf::SsrfValidationError;
-        windmill_common::ssrf::validate_url_for_ssrf(&resource.token_url)
-            .await
-            .map_err(|e| match e {
-                e @ SsrfValidationError::Private { .. } => Error::BadRequest(format!(
-                    "{e}. If you need to use private/internal AI endpoints, \
-                     set the ALLOW_PRIVATE_AI_BASE_URLS=true environment variable"
-                )),
-                e => Error::from(e),
-            })?;
-    }
+    // point token_url at an internal/metadata address. The returned client pins
+    // DNS to the validated address so the connect cannot rebind after the check.
+    let client = pinned_ai_client_for(&resource.token_url).await?;
     let mut params = HashMap::new();
     params.insert("grant_type", "client_credentials");
     params.insert("scope", "https://cognitiveservices.azure.com/.default");
-    let response = HTTP_CLIENT
+    let response = client
         .post(resource.token_url)
         .form(&params)
         .basic_auth(resource.client_id, Some(resource.client_secret))
@@ -420,8 +458,11 @@ fn is_sse_response(headers: &HeaderMap) -> bool {
         .unwrap_or(false)
 }
 
-fn proxy_request_to_request_builder(proxy_request: ProxyRequest) -> RequestBuilder {
-    let mut request = HTTP_CLIENT.request(proxy_request.method.clone(), &proxy_request.url);
+fn proxy_request_to_request_builder(
+    client: &Client,
+    proxy_request: ProxyRequest,
+) -> RequestBuilder {
+    let mut request = client.request(proxy_request.method.clone(), &proxy_request.url);
     for (header_name, header_value) in &proxy_request.headers {
         request = request.header(header_name.as_str(), header_value.as_str());
     }
@@ -546,6 +587,8 @@ async fn global_proxy(
         custom_headers: HashMap::new(),
     };
 
+    let client = pinned_ai_client_for(&credentials.base_url).await?;
+
     if matches!(proxy_mode, ProxyExecutionMode::NativeGoogleAi) {
         let proxy_args = ProxyBuildArgs {
             method: &method,
@@ -558,8 +601,8 @@ async fn global_proxy(
         audit_global_ai_request(&db, &authed).await?;
 
         let response = match ai_path.as_str() {
-            "chat/completions" => handle_google_ai_chat_proxy(&HTTP_CLIENT, &proxy_args).await,
-            "models" => handle_google_ai_models_proxy(&HTTP_CLIENT, &proxy_args).await,
+            "chat/completions" => handle_google_ai_chat_proxy(&client, &proxy_args).await,
+            "models" => handle_google_ai_models_proxy(&client, &proxy_args).await,
             _ => Err(Error::BadRequest(format!(
                 "Unsupported Google AI path: {}",
                 ai_path
@@ -582,7 +625,7 @@ async fn global_proxy(
                 body: &body,
                 credentials: &credentials,
             })?;
-            proxy_request_to_request_builder(proxy_request)
+            proxy_request_to_request_builder(&client, proxy_request)
         }
         ProxyExecutionMode::NativeGoogleAi | ProxyExecutionMode::NativeAwsBedrock => {
             return Err(Error::BadRequest(format!(
@@ -826,9 +869,11 @@ async fn proxy(
             credentials: &credentials,
         };
 
+        let client = pinned_ai_client_for(&credentials.base_url).await?;
+
         let response = match ai_path.as_str() {
-            "chat/completions" => handle_google_ai_chat_proxy(&HTTP_CLIENT, &proxy_args).await,
-            "models" => handle_google_ai_models_proxy(&HTTP_CLIENT, &proxy_args).await,
+            "chat/completions" => handle_google_ai_chat_proxy(&client, &proxy_args).await,
+            "models" => handle_google_ai_models_proxy(&client, &proxy_args).await,
             _ => Err(Error::BadRequest(format!(
                 "Unsupported Google AI path: {}",
                 ai_path
@@ -887,7 +932,8 @@ async fn proxy(
                 body: &body,
                 credentials: &credentials,
             })?;
-            proxy_request_to_request_builder(proxy_request)
+            let client = pinned_ai_client_for(&credentials.base_url).await?;
+            proxy_request_to_request_builder(&client, proxy_request)
         }
         ProxyExecutionMode::NativeGoogleAi => {
             return Err(Error::internal_err(
diff --git a/backend/windmill-common/src/ssrf.rs b/backend/windmill-common/src/ssrf.rs
index 627636b8f5..99471acfe9 100644
--- a/backend/windmill-common/src/ssrf.rs
+++ b/backend/windmill-common/src/ssrf.rs
@@ -1,4 +1,4 @@
-use std::net::{IpAddr, Ipv4Addr, Ipv6Addr};
+use std::net::{IpAddr, Ipv4Addr, Ipv6Addr, SocketAddr};
 
 use crate::error::Error;
 
@@ -58,6 +58,63 @@ impl std::fmt::Display for SsrfValidationError {
 // `anyhow::Result` (e.g. the EE SAML metadata loader).
 impl std::error::Error for SsrfValidationError {}
 
+/// A URL that passed SSRF validation, carrying the exact addresses its host
+/// resolved to so the eventual connect targets the SAME address that was
+/// checked.
+///
+/// Validation resolves the host once and verifies every address is public; it
+/// then hands those addresses back instead of discarding them. Callers pin them
+/// onto their client — [`apply_dns_pinning`](ValidatedTarget::apply_dns_pinning)
+/// for reqwest, or [`pinned_addrs`](ValidatedTarget::pinned_addrs) for a raw TCP
+/// connect — so a DNS rebinder cannot answer a public IP at check-time and an
+/// internal one (e.g. 169.254.169.254) at connect-time. Without pinning the
+/// check and the connect resolve independently and the guard is a TOCTOU no-op.
+///
+/// `addrs` is empty when the host was an IP literal (there is nothing to rebind)
+/// or when an `ALLOW_PRIVATE_*` override skipped resolution entirely; pinning is
+/// then a no-op and the caller connects normally.
+///
+/// Limitation: pinning governs only *direct* connections. When a deployment
+/// configures an outbound egress proxy (`HTTP_PROXY`/`HTTPS_PROXY`), the proxy
+/// resolves the target host itself and the pin does not reach it — a property of
+/// proxy-based egress shared by every app-side SSRF guard, not specific to this
+/// one. The public/private pre-check still runs; closing the proxy hop would
+/// require the proxy to resolve, which it owns.
+#[derive(Debug, Clone)]
+pub struct ValidatedTarget {
+    /// The URL host, exactly as reqwest keys its DNS override on.
+    pub host: String,
+    /// Public addresses the host resolved to, to pin at connect time.
+    pub addrs: Vec<SocketAddr>,
+}
+
+impl ValidatedTarget {
+    /// A target with nothing to pin: an IP-literal host (no rebinding possible)
+    /// or a host whose SSRF check was skipped by an `ALLOW_PRIVATE_*` override.
+    fn unpinned(host: &str) -> Self {
+        ValidatedTarget { host: host.to_string(), addrs: Vec::new() }
+    }
+
+    /// Pin the validated addresses onto a reqwest client builder so connect-time
+    /// resolution cannot diverge from what was checked. No-op when there is
+    /// nothing to pin (IP-literal host, or a skipped `ALLOW_PRIVATE_*` check).
+    pub fn apply_dns_pinning(&self, builder: reqwest::ClientBuilder) -> reqwest::ClientBuilder {
+        if self.addrs.is_empty() {
+            builder
+        } else {
+            builder.resolve_to_addrs(&self.host, &self.addrs)
+        }
+    }
+
+    /// The validated addresses to connect to, for callers that pin by opening
+    /// the socket themselves (e.g. the WebSocket trigger's raw TCP connect)
+    /// rather than through reqwest. Empty means "nothing to pin, connect
+    /// normally".
+    pub fn pinned_addrs(&self) -> &[SocketAddr] {
+        &self.addrs
+    }
+}
+
 impl From<SsrfValidationError> for Error {
     fn from(e: SsrfValidationError) -> Self {
         Error::BadRequest(e.to_string())
@@ -69,8 +126,13 @@ impl From<SsrfValidationError> for Error {
 /// Checks:
 /// 1. Scheme must be http or https
 /// 2. Host must be present and not a private/loopback/link-local IP
-/// 3. DNS resolution is checked to prevent DNS rebinding to internal IPs
-pub async fn validate_url_for_ssrf(url: &str) -> Result<(), SsrfValidationError> {
+/// 3. The host is resolved and every address verified public
+///
+/// Returns the resolved addresses as a [`ValidatedTarget`] so the caller can pin
+/// them onto the client that actually connects. Validating here and re-resolving
+/// at connect time is a TOCTOU no-op against a DNS rebinder — the check only
+/// closes the hole if the connect targets the SAME address this resolved.
+pub async fn validate_url_for_ssrf(url: &str) -> Result<ValidatedTarget, SsrfValidationError> {
     let parsed =
         url::Url::parse(url).map_err(|e| SsrfValidationError::InvalidUrl(e.to_string()))?;
 
@@ -85,12 +147,13 @@ pub async fn validate_url_for_ssrf(url: &str) -> Result<(), SsrfValidationError>
     // 2. Host check
     let host = parsed.host_str().ok_or(SsrfValidationError::MissingHost)?;
 
-    // 3. If the host is an IP literal, check it directly
+    // 3. If the host is an IP literal, check it directly. There is nothing to
+    // rebind (reqwest connects straight to the literal), so no addresses to pin.
     if let Ok(ip) = host.parse::<IpAddr>() {
         if is_private_ip(&ip) {
             return Err(SsrfValidationError::Private { resolved: false });
         }
-        return Ok(());
+        return Ok(ValidatedTarget::unpinned(host));
     }
 
     // 4. DNS resolution check — resolve the hostname and verify all IPs are public
@@ -117,7 +180,7 @@ pub async fn validate_url_for_ssrf(url: &str) -> Result<(), SsrfValidationError>
         }
     }
 
-    Ok(())
+    Ok(ValidatedTarget { host: host.to_string(), addrs })
 }
 
 pub fn allow_private_mcp_server_urls() -> bool {
@@ -132,7 +195,7 @@ pub fn allow_private_saml_metadata_urls() -> bool {
         .is_some_and(|v| v == "true" || v == "1")
 }
 
-pub async fn validate_saml_metadata_url(url: &str) -> Result<(), SsrfValidationError> {
+pub async fn validate_saml_metadata_url(url: &str) -> Result<ValidatedTarget, SsrfValidationError> {
     let parsed =
         url::Url::parse(url).map_err(|e| SsrfValidationError::InvalidUrl(e.to_string()))?;
 
@@ -141,16 +204,16 @@ pub async fn validate_saml_metadata_url(url: &str) -> Result<(), SsrfValidationE
         scheme => return Err(SsrfValidationError::DisallowedScheme(scheme.to_string())),
     }
 
-    parsed.host_str().ok_or(SsrfValidationError::MissingHost)?;
+    let host = parsed.host_str().ok_or(SsrfValidationError::MissingHost)?;
 
     if allow_private_saml_metadata_urls() {
-        return Ok(());
+        return Ok(ValidatedTarget::unpinned(host));
     }
 
     validate_url_for_ssrf(url).await
 }
 
-pub async fn validate_mcp_server_url(url: &str) -> Result<(), SsrfValidationError> {
+pub async fn validate_mcp_server_url(url: &str) -> Result<ValidatedTarget, SsrfValidationError> {
     let parsed =
         url::Url::parse(url).map_err(|e| SsrfValidationError::InvalidUrl(e.to_string()))?;
 
@@ -159,16 +222,24 @@ pub async fn validate_mcp_server_url(url: &str) -> Result<(), SsrfValidationErro
         scheme => return Err(SsrfValidationError::DisallowedScheme(scheme.to_string())),
     }
 
-    parsed.host_str().ok_or(SsrfValidationError::MissingHost)?;
+    let host = parsed.host_str().ok_or(SsrfValidationError::MissingHost)?;
 
     if allow_private_mcp_server_urls() {
-        return Ok(());
+        return Ok(ValidatedTarget::unpinned(host));
     }
 
     validate_url_for_ssrf(url).await
 }
 
-pub async fn validate_mcp_server_url_for_bad_request(url: &str, label: &str) -> Result<(), Error> {
+/// Validate an MCP-related URL and return the [`ValidatedTarget`] so the caller
+/// can pin the connect: the OAuth registration/discovery/token requests carry
+/// secrets, so they must target the validated address (see
+/// `windmill_mcp::oauth::no_redirect_http_client_pinned`). Callers that only
+/// pre-validate (no adjacent connect) can discard the target.
+pub async fn validate_mcp_server_url_for_bad_request(
+    url: &str,
+    label: &str,
+) -> Result<ValidatedTarget, Error> {
     validate_mcp_server_url(url).await.map_err(|e| {
         Error::BadRequest(format!(
             "{label} is not allowed: {}",
@@ -331,6 +402,35 @@ mod tests {
         assert!(validate_url_for_ssrf("https://google.com").await.is_ok());
     }
 
+    /// An IP-literal host has nothing to rebind — reqwest connects straight to
+    /// the literal — so the target pins no addresses.
+    #[tokio::test]
+    async fn validate_url_ip_literal_pins_nothing() {
+        let target = validate_url_for_ssrf("http://8.8.8.8:1234/x")
+            .await
+            .unwrap();
+        assert_eq!(target.host, "8.8.8.8");
+        assert!(target.pinned_addrs().is_empty());
+    }
+
+    /// Regression for the DNS-rebinding TOCTOU: the guard must surface the exact
+    /// public addresses it validated so the caller can pin the connect to the
+    /// SAME address. If
+    /// this returned nothing, the connect would re-resolve and a rebinder could
+    /// swap in an internal IP after the check.
+    #[tokio::test]
+    async fn validate_url_surfaces_resolved_addrs_for_pinning() {
+        let target = validate_url_for_ssrf("https://google.com").await.unwrap();
+        assert_eq!(target.host, "google.com");
+        assert!(!target.pinned_addrs().is_empty());
+        assert!(target
+            .pinned_addrs()
+            .iter()
+            .all(|a| !is_private_ip(&a.ip())));
+        // The pin applies cleanly onto a reqwest builder.
+        let _ = target.apply_dns_pinning(reqwest::ClientBuilder::new());
+    }
+
     /// Regression for #9171: a malformed base URL (missing scheme) must report
     /// `InvalidUrl`/`DisallowedScheme`, not `Private` — only `Private` gets the
     /// "set ALLOW_PRIVATE_AI_BASE_URLS" hint, which is misleading for a typo'd
diff --git a/backend/windmill-mcp/src/client/mod.rs b/backend/windmill-mcp/src/client/mod.rs
index 34dc141209..f61a1c3f85 100644
--- a/backend/windmill-mcp/src/client/mod.rs
+++ b/backend/windmill-mcp/src/client/mod.rs
@@ -43,7 +43,7 @@ impl McpClient {
         // The resource URL is author-controlled and we send a (potentially
         // secret) bearer token to it, so it must be validated against SSRF
         // before we connect (e.g. cloud metadata endpoints, internal services).
-        windmill_common::ssrf::validate_mcp_server_url(&resource.url)
+        let validated = windmill_common::ssrf::validate_mcp_server_url(&resource.url)
             .await
             .map_err(|e| {
                 anyhow::anyhow!(
@@ -76,14 +76,24 @@ impl McpClient {
             }
         }
 
-        let reqwest_client = reqwest::Client::builder()
+        let mut client_builder = reqwest::Client::builder()
             .default_headers(headers)
             // Don't follow redirects: the SSRF check above only validates the
             // initial (author-controlled) URL, so following a redirect could
             // still reach a private/internal address with the bearer token
             // attached. The MCP streamable-HTTP endpoint is a direct endpoint
             // and does not legitimately rely on redirects.
-            .redirect(reqwest::redirect::Policy::none())
+            .redirect(reqwest::redirect::Policy::none());
+        // Pin DNS to the address validated above so the connect cannot rebind to
+        // an internal IP between the check and the request. `apply_dns_pinning`
+        // lives on windmill-common's reqwest, but this crate resolves a
+        // different reqwest version (via rmcp), so pin directly with the
+        // std-typed host/addrs the validation surfaced. Empty addrs (IP literal
+        // or ALLOW_PRIVATE_MCP_SERVER_URLS) leave resolution untouched.
+        if !validated.addrs.is_empty() {
+            client_builder = client_builder.resolve_to_addrs(&validated.host, &validated.addrs);
+        }
+        let reqwest_client = client_builder
             .build()
             .context("Failed to build HTTP client")?;
 
diff --git a/backend/windmill-mcp/src/client_registration.rs b/backend/windmill-mcp/src/client_registration.rs
index b0b07cada1..637b76df80 100644
--- a/backend/windmill-mcp/src/client_registration.rs
+++ b/backend/windmill-mcp/src/client_registration.rs
@@ -17,7 +17,7 @@ use windmill_common::db::DB;
 use windmill_common::error;
 use windmill_common::variables::{build_crypt, decrypt, encrypt};
 
-use crate::oauth::{no_redirect_http_client, AuthorizationManager};
+use crate::oauth::{no_redirect_http_client_pinned, AuthorizationManager};
 
 /// MCP client credentials returned by [`get_or_refresh_mcp_client`].
 pub struct McpClientCredentials {
@@ -77,13 +77,15 @@ async fn register_client(
     redirect_uri: &str,
     client_name: &str,
 ) -> Result<DcrResponse, error::Error> {
-    windmill_common::ssrf::validate_mcp_server_url_for_bad_request(
+    let validated = windmill_common::ssrf::validate_mcp_server_url_for_bad_request(
         registration_endpoint,
         "MCP server registration endpoint URL",
     )
     .await?;
 
-    let client = no_redirect_http_client()
+    // Pin to the validated address: DCR posts to an author-controlled endpoint,
+    // so the connect must not rebind to an internal IP after the check.
+    let client = no_redirect_http_client_pinned(&validated)
         .map_err(|e| error::Error::BadRequest(format!("Failed to build DCR client: {e}")))?;
     let request = DcrRequest {
         client_name: client_name.to_string(),
@@ -128,7 +130,7 @@ pub async fn get_or_refresh_mcp_client(
     let base_url = (**windmill_common::BASE_URL.load()).clone();
     let redirect_uri = format!("{}/api/mcp/oauth/callback", base_url);
 
-    windmill_common::ssrf::validate_mcp_server_url_for_bad_request(
+    let validated_server = windmill_common::ssrf::validate_mcp_server_url_for_bad_request(
         mcp_server_url,
         "MCP server URL",
     )
@@ -166,7 +168,13 @@ pub async fn get_or_refresh_mcp_client(
     let mut manager = AuthorizationManager::new(mcp_server_url)
         .await
         .map_err(|e| error::Error::BadRequest(format!("Failed to create auth manager: {e}")))?;
-    let discovery_client = no_redirect_http_client().map_err(|e| {
+    // Discovery hits the well-known endpoint on the MCP server host validated
+    // above; pin to that address so it cannot rebind between check and connect.
+    // Limitation: rmcp's discover_metadata may additionally follow server-supplied
+    // metadata URLs (resource_metadata / authorization_servers) on other hosts,
+    // which this per-host pin does not cover — a pre-existing gap in rmcp discovery
+    // that a validating resolver would need to close, out of scope for this pin.
+    let discovery_client = no_redirect_http_client_pinned(&validated_server).map_err(|e| {
         error::Error::BadRequest(format!("Failed to build MCP OAuth discovery client: {e}"))
     })?;
     manager
diff --git a/backend/windmill-mcp/src/lib.rs b/backend/windmill-mcp/src/lib.rs
index d9cae883de..d5eb0b9597 100644
--- a/backend/windmill-mcp/src/lib.rs
+++ b/backend/windmill-mcp/src/lib.rs
@@ -57,6 +57,27 @@ pub mod oauth {
             .build()
     }
 
+    /// Like [`no_redirect_http_client`], but pins DNS to the address the SSRF
+    /// guard validated for the request URL so the connect cannot rebind to an
+    /// internal IP after the check (TOCTOU). The OAuth DCR/discovery/token
+    /// requests target author-controlled URLs and carry secrets, so they must
+    /// go through this rather than the unpinned client. `apply_dns_pinning`
+    /// lives on windmill-common's reqwest, which this crate resolves at a
+    /// different version (via rmcp), so pin directly with the std-typed
+    /// host/addrs. Empty `addrs` (IP literal or ALLOW_PRIVATE_MCP_SERVER_URLS)
+    /// leaves resolution untouched.
+    pub fn no_redirect_http_client_pinned(
+        target: &windmill_common::ssrf::ValidatedTarget,
+    ) -> Result<reqwest::Client, reqwest::Error> {
+        let mut builder = reqwest::Client::builder()
+            .timeout(DEFAULT_OAUTH_HTTP_TIMEOUT)
+            .redirect(reqwest::redirect::Policy::none());
+        if !target.addrs.is_empty() {
+            builder = builder.resolve_to_addrs(&target.host, &target.addrs);
+        }
+        builder.build()
+    }
+
     // Re-export oauth2 types needed for MCP OAuth flow
     pub use oauth2::{
         basic::BasicClient, AuthUrl, ClientId, ClientSecret, CsrfToken, PkceCodeChallenge,
diff --git a/backend/windmill-trigger-websocket/src/handler.rs b/backend/windmill-trigger-websocket/src/handler.rs
index 529e5902cc..c2ca37c500 100644
--- a/backend/windmill-trigger-websocket/src/handler.rs
+++ b/backend/windmill-trigger-websocket/src/handler.rs
@@ -316,9 +316,9 @@ impl TriggerCrud for WebsocketTrigger {
             Cow::Borrowed(&url)
         };
 
-        validate_websocket_url_for_ssrf(&connect_url).await?;
+        let validated = validate_websocket_url_for_ssrf(&connect_url).await?;
 
-        connect_async_with_proxy(&*connect_url)
+        connect_async_with_proxy(&*connect_url, validated.pinned_addrs())
             .await
             .map_err(|err| {
                 Error::BadConfig(format!(
diff --git a/backend/windmill-trigger-websocket/src/lib.rs b/backend/windmill-trigger-websocket/src/lib.rs
index 4111606b2b..81b87ee3a1 100644
--- a/backend/windmill-trigger-websocket/src/lib.rs
+++ b/backend/windmill-trigger-websocket/src/lib.rs
@@ -119,14 +119,15 @@ pub const ALLOW_PRIVATE_WEBSOCKET_URLS_ENV: &str = "ALLOW_PRIVATE_WEBSOCKET_URLS
 /// `$flow:`/`$script:` URL is checked on its returned value and re-checked on
 /// each reconnect (DNS rebinding). `validate_config` also calls this at save
 /// time to reject static URLs early.
-pub async fn validate_websocket_url_for_ssrf(url: &str) -> Result<()> {
-    if std::env::var(ALLOW_PRIVATE_WEBSOCKET_URLS_ENV)
-        .ok()
-        .is_some_and(|v| v == "true" || v == "1")
-    {
-        return Ok(());
-    }
-
+///
+/// Returns the resolved [`ValidatedTarget`]: the connect must pin these
+/// addresses (see [`proxy::connect_async_with_proxy`]) so a rebinder cannot swap
+/// in an internal IP between this check and the connect (TOCTOU). The returned
+/// `addrs` carry the http(s) port, which equals the ws(s) port the connection
+/// uses (ws→80, wss→443, or the explicit port preserved through the mapping).
+pub async fn validate_websocket_url_for_ssrf(
+    url: &str,
+) -> Result<windmill_common::ssrf::ValidatedTarget> {
     // `ws`/`wss` aren't recognised by `validate_url_for_ssrf`'s scheme check, so
     // map them to the http(s) equivalent the same connection would tunnel over.
     // The prefixes are ASCII, so byte-slicing at their length stays on a char
@@ -140,6 +141,20 @@ pub async fn validate_websocket_url_for_ssrf(url: &str) -> Result<()> {
         url.to_string()
     };
 
+    if std::env::var(ALLOW_PRIVATE_WEBSOCKET_URLS_ENV)
+        .ok()
+        .is_some_and(|v| v == "true" || v == "1")
+    {
+        // Opted out of the SSRF guard: allow any host and pin nothing. Parse the
+        // host for a uniform return; fall back to an empty target if unparseable
+        // (the connect then resolves normally, matching the pre-guard behavior).
+        let host = url::Url::parse(&http_url)
+            .ok()
+            .and_then(|u| u.host_str().map(str::to_string))
+            .unwrap_or_default();
+        return Ok(windmill_common::ssrf::ValidatedTarget { host, addrs: Vec::new() });
+    }
+
     windmill_common::ssrf::validate_url_for_ssrf(&http_url)
         .await
         .map_err(|e| match e {
diff --git a/backend/windmill-trigger-websocket/src/listener.rs b/backend/windmill-trigger-websocket/src/listener.rs
index e34fe6e4f6..a38f2434a4 100644
--- a/backend/windmill-trigger-websocket/src/listener.rs
+++ b/backend/windmill-trigger-websocket/src/listener.rs
@@ -191,7 +191,7 @@ impl Listener for WebsocketTrigger {
             Cow::Borrowed(&url)
         };
 
-        validate_websocket_url_for_ssrf(&connect_url).await?;
+        let validated = validate_websocket_url_for_ssrf(&connect_url).await?;
 
         // Gateway endpoints are often fronted by an edge proxy (e.g. Cloudflare)
         // that sporadically answers the upgrade request with a transient 5xx
@@ -203,7 +203,7 @@ impl Listener for WebsocketTrigger {
         let mut attempt = 0;
         loop {
             attempt += 1;
-            match connect_async_with_proxy(&*connect_url).await {
+            match connect_async_with_proxy(&*connect_url, validated.pinned_addrs()).await {
                 Ok(conn) => return Ok(Some(conn)),
                 // Only retry in trigger mode: a failed connect there disables the
                 // trigger until a human re-enables it, while capture mode is an
diff --git a/backend/windmill-trigger-websocket/src/proxy.rs b/backend/windmill-trigger-websocket/src/proxy.rs
index 8670b7ca3a..701401d277 100644
--- a/backend/windmill-trigger-websocket/src/proxy.rs
+++ b/backend/windmill-trigger-websocket/src/proxy.rs
@@ -15,6 +15,7 @@
 
 use base64::{engine::general_purpose::STANDARD as BASE64_STANDARD, Engine as _};
 use std::io;
+use std::net::SocketAddr;
 use tokio::{
     io::{AsyncBufReadExt, AsyncWriteExt, BufReader},
     net::TcpStream,
@@ -33,19 +34,28 @@ use windmill_common::{HTTPS_PROXY, HTTP_PROXY, NO_PROXY};
 
 /// Drop-in replacement for `tokio_tungstenite::connect_async` that routes
 /// the underlying TCP connection through `HTTPS_PROXY` / `HTTP_PROXY`
-/// (with `NO_PROXY` exclusions) when those env vars are set. When none
-/// is set we short-circuit straight to `connect_async`, keeping the
-/// behaviour for non-proxied deployments unchanged.
+/// (with `NO_PROXY` exclusions) when those env vars are set, and — for direct
+/// (non-proxied) connections — pins DNS to `pinned_addrs`.
+///
+/// `pinned_addrs` are the addresses the SSRF guard already resolved and
+/// validated for this URL (see `validate_websocket_url_for_ssrf`). Connecting
+/// straight to them, rather than letting `connect_async` re-resolve the host,
+/// closes the DNS-rebinding window between the check and the connect: a rebinder
+/// cannot answer a public IP at validation time and an internal one here. When
+/// `pinned_addrs` is empty (IP-literal host, or the SSRF guard opted out via
+/// `ALLOW_PRIVATE_WEBSOCKET_URLS`) there is nothing to pin and we fall back to
+/// `connect_async`, keeping the behaviour for those cases unchanged.
+///
+/// When a proxy applies, the proxy itself resolves the target host, so DNS
+/// rebinding at this hop is not the worker's concern and `pinned_addrs` is
+/// unused for that path.
 pub async fn connect_async_with_proxy<R>(
     request: R,
+    pinned_addrs: &[SocketAddr],
 ) -> Result<(WebSocketStream<MaybeTlsStream<TcpStream>>, Response), WsError>
 where
     R: IntoClientRequest + Unpin,
 {
-    if HTTPS_PROXY.is_none() && HTTP_PROXY.is_none() {
-        return connect_async(request).await;
-    }
-
     let request = request.into_client_request()?;
     let uri = request.uri().clone();
     let scheme = uri.scheme_str().unwrap_or_default().to_ascii_lowercase();
@@ -62,26 +72,49 @@ where
         })
         .ok_or(WsError::Url(UrlError::UnsupportedUrlScheme))?;
 
-    let proxy = proxy_url_for(&scheme, &host).and_then(|raw| parse_proxy_target(&raw));
-
-    let Some(proxy) = proxy else {
-        // Proxy env was set but doesn't apply to this host (NO_PROXY hit
-        // or unparseable URL): preserve the original connect path.
-        return connect_async(request).await;
+    let proxy = if HTTPS_PROXY.is_none() && HTTP_PROXY.is_none() {
+        None
+    } else {
+        proxy_url_for(&scheme, &host).and_then(|raw| parse_proxy_target(&raw))
     };
 
-    tracing::debug!(
-        "Connecting to WebSocket {}:{} through HTTP proxy {}:{}",
-        host,
-        port,
-        proxy.host,
-        proxy.port,
-    );
-    let socket = http_connect_tunnel(&proxy, &host, port)
-        .await
-        .map_err(WsError::Io)?;
+    if let Some(proxy) = proxy {
+        tracing::debug!(
+            "Connecting to WebSocket {}:{} through HTTP proxy {}:{}",
+            host,
+            port,
+            proxy.host,
+            proxy.port,
+        );
+        let socket = http_connect_tunnel(&proxy, &host, port)
+            .await
+            .map_err(WsError::Io)?;
+        return client_async_tls_with_config(request, socket, None, None).await;
+    }
 
-    client_async_tls_with_config(request, socket, None, None).await
+    // Direct connection. Nothing to pin (IP literal or SSRF guard opted out):
+    // preserve the original resolve-and-connect path.
+    if pinned_addrs.is_empty() {
+        return connect_async(request).await;
+    }
+
+    // Pin to a validated address so this connect targets the same IP the SSRF
+    // guard checked. Try each in order (e.g. IPv6 then IPv4) until one connects.
+    let mut last_err: Option<io::Error> = None;
+    for addr in pinned_addrs {
+        match TcpStream::connect(addr).await {
+            Ok(socket) => {
+                return client_async_tls_with_config(request, socket, None, None).await;
+            }
+            Err(e) => last_err = Some(e),
+        }
+    }
+    Err(WsError::Io(last_err.unwrap_or_else(|| {
+        io::Error::new(
+            io::ErrorKind::AddrNotAvailable,
+            "no pinned address to connect",
+        )
+    })))
 }
 
 #[derive(Debug, Clone, PartialEq, Eq)]
diff --git a/backend/windmill-worker/src/ai_executor.rs b/backend/windmill-worker/src/ai_executor.rs
index 879f560916..8605bca374 100644
--- a/backend/windmill-worker/src/ai_executor.rs
+++ b/backend/windmill-worker/src/ai_executor.rs
@@ -26,7 +26,7 @@ use windmill_ai::{
     providers::create_query_builder,
     query_builder::{BuildRequestArgs, ParsedResponse},
     types::*,
-    utils::{should_use_structured_output_tool, AI_HTTP_CLIENT, AI_HTTP_HEADERS},
+    utils::{pinned_ai_client_for, should_use_structured_output_tool, AI_HTTP_HEADERS},
 };
 use windmill_common::{
     cache,
@@ -984,11 +984,14 @@ pub async fn run_agent(
 
             let resource_headers = &credentials.custom_headers;
 
+            // `endpoint` derives from the user-controlled provider base_url, so pin
+            // DNS to the SSRF-validated address: the connect must not rebind to an
+            // internal IP between the check and the request (TOCTOU).
+            let pinned_ai_client = pinned_ai_client_for(base_url).await?;
+
             // Helper to build HTTP request with headers
             let build_http_request = |body: String| {
-                // `endpoint` derives from the user-controlled provider base_url: use
-                // AI_HTTP_CLIENT, not the shared HTTP_CLIENT. See AI_HTTP_CLIENT.
-                let mut req = AI_HTTP_CLIENT
+                let mut req = pinned_ai_client
                     .post(&endpoint)
                     .timeout(timeout)
                     .header("Content-Type", "application/json");

From a26ea4d43f45e4f3dcd6fa326534b0aa1f18a264 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 24 Jul 2026 15:46:50 +0200
Subject: [PATCH 157/171] chore(main): release 1.769.0 (#10302)

* chore(main): release 1.769.0

* Apply automatic changes

---------

Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>
---
 CHANGELOG.md                                  |  19 ++
 backend/Cargo.lock                            | 162 +++++++++---------
 backend/Cargo.toml                            |   4 +-
 .../parsers/windmill-parser-wasm/Cargo.lock   |  48 +++---
 .../parsers/windmill-parser-wasm/Cargo.toml   |   2 +-
 backend/windmill-api/openapi.yaml             |   2 +-
 benchmarks/lib.ts                             |   2 +-
 cli/src/core/constants.ts                     |   2 +-
 frontend/package-lock.json                    |   4 +-
 frontend/package.json                         |   2 +-
 lsp/Pipfile                                   |   2 +-
 openflow.openapi.yaml                         |   2 +-
 .../WindmillClient/WindmillClient.psd1        |   2 +-
 python-client/wmill/pyproject.toml            |   2 +-
 typescript-client/jsr.json                    |   2 +-
 typescript-client/package.json                |   2 +-
 version.txt                                   |   2 +-
 17 files changed, 140 insertions(+), 121 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6cfff0dc6d..e800f74201 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,24 @@
 # Changelog
 
+## [1.769.0](https://github.com/windmill-labs/windmill/compare/v1.768.0...v1.769.0) (2026-07-24)
+
+
+### Features
+
+* **hub:** surface data pipelines in deploy-to-hub drawer ([#10299](https://github.com/windmill-labs/windmill/issues/10299)) ([010059a](https://github.com/windmill-labs/windmill/commit/010059a449f4d0cde0656086f1b3f03a02a1c78c))
+* **pipeline:** collapse secondary top-bar controls into an overflow menu ([#10300](https://github.com/windmill-labs/windmill/issues/10300)) ([1d25d75](https://github.com/windmill-labs/windmill/commit/1d25d7539ed7fb17c47a732d6b1cd7fc19202a04))
+
+
+### Bug Fixes
+
+* pin table actions column so it stays visible on narrow screens ([#10301](https://github.com/windmill-labs/windmill/issues/10301)) ([75acf72](https://github.com/windmill-labs/windmill/commit/75acf7207b151f0227600be555bfa5e14dfa8dd1))
+* pin validated DNS address to close SSRF DNS-rebinding TOCTOU ([#10303](https://github.com/windmill-labs/windmill/issues/10303)) ([3cf7a39](https://github.com/windmill-labs/windmill/commit/3cf7a390a37c07a818248c95defa4ecf5bf262e5))
+
+
+### Performance Improvements
+
+* optimize get_datatable_full_schema to avoid timeout on large catalogs ([#10304](https://github.com/windmill-labs/windmill/issues/10304)) ([1478d12](https://github.com/windmill-labs/windmill/commit/1478d12eb352b1b7906ccfe3ab5eaafe60ffbe4f))
+
 ## [1.768.0](https://github.com/windmill-labs/windmill/compare/v1.767.0...v1.768.0) (2026-07-24)
 
 
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index e988871068..dd15d30d97 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -2290,9 +2290,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.3.0"
+version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c89588d05638b5b4594a3348a2d6c20277e43a7f5c5202b05cc56888475a47b8"
+checksum = "5add81bb678e6cb321aff7fa0dc7689ad82b112dbc032cea19f91d6b8e3582b9"
 dependencies = [
  "find-msvc-tools",
  "jobserver",
@@ -14479,7 +14479,7 @@ dependencies = [
 
 [[package]]
 name = "windmill"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -14564,7 +14564,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-ai"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "async-stream",
  "async-trait",
@@ -14597,7 +14597,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-alerting"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14610,7 +14610,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "argon2",
@@ -14749,7 +14749,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-agent-workers"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14772,7 +14772,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-assets"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14787,7 +14787,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-auth"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14813,7 +14813,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "reqwest 0.12.28",
  "serde",
@@ -14823,7 +14823,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-configs"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14840,7 +14840,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-debug"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "axum 0.8.9",
  "base64 0.22.1",
@@ -14862,7 +14862,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-embeddings"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14885,7 +14885,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flow-conversations"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14901,7 +14901,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flows"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14922,7 +14922,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-groups"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14943,7 +14943,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-inputs"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14957,7 +14957,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-integration-tests"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -14992,7 +14992,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-jobs"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15017,7 +15017,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-npm-proxy"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "axum 0.8.9",
  "flate2",
@@ -15035,7 +15035,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-openapi"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15057,7 +15057,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-schedule"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15077,7 +15077,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-scripts"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15114,7 +15114,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-settings"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15142,7 +15142,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-sse"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "lazy_static",
  "serde",
@@ -15154,7 +15154,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-users"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "argon2",
  "axum 0.8.9",
@@ -15179,7 +15179,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workers"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15193,7 +15193,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workspaces"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15228,7 +15228,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -15242,7 +15242,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15261,7 +15261,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "aes-gcm",
  "aho-corasick",
@@ -15365,7 +15365,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-dep-map"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "chrono",
  "itertools 0.14.0",
@@ -15384,7 +15384,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "regex",
  "serde",
@@ -15399,7 +15399,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "astral-tokio-tar",
@@ -15423,7 +15423,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-jseval"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -15440,7 +15440,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -15456,7 +15456,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-mcp"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15477,7 +15477,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-native-triggers"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15508,7 +15508,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-oauth"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "arc-swap",
@@ -15533,7 +15533,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-object-store"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "async-stream",
@@ -15567,7 +15567,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-operator"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -15585,7 +15585,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -15594,7 +15594,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15606,7 +15606,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15618,7 +15618,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -15630,7 +15630,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15642,7 +15642,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15654,7 +15654,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -15665,7 +15665,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15676,7 +15676,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15688,7 +15688,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -15699,7 +15699,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15721,7 +15721,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15733,7 +15733,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15747,7 +15747,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -15764,7 +15764,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15777,7 +15777,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -15789,7 +15789,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15807,7 +15807,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -15823,7 +15823,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -15839,7 +15839,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -15850,7 +15850,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15889,7 +15889,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-runtime-nativets"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "const_format",
@@ -15929,7 +15929,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "getrandom 0.3.4",
  "wasm-bindgen",
@@ -15940,7 +15940,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-store"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15974,7 +15974,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-test-utils"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15998,7 +15998,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16031,7 +16031,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-amqp"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16058,7 +16058,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-azure"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16091,7 +16091,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-email"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16111,7 +16111,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-gcp"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16145,7 +16145,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-http"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16181,7 +16181,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-kafka"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16204,7 +16204,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-mqtt"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16228,7 +16228,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-nats"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -16252,7 +16252,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-postgres"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16287,7 +16287,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-sqs"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16315,7 +16315,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-websocket"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16340,7 +16340,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "bitflags 2.13.1",
@@ -16359,7 +16359,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "async-once-cell",
@@ -16474,7 +16474,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker-volumes"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "bytes",
  "futures",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 93dd9b8da8..df718e84e1 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.768.0"
+version = "1.769.0"
 authors.workspace = true
 edition.workspace = true
 
@@ -88,7 +88,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal", "./parsers/windmill-parser-wasm"]
 
 [workspace.package]
-version = "1.768.0"
+version = "1.769.0"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.lock b/backend/parsers/windmill-parser-wasm/Cargo.lock
index b2ff7a2348..14c380ff9b 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.lock
+++ b/backend/parsers/windmill-parser-wasm/Cargo.lock
@@ -6191,7 +6191,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill-common"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "aho-corasick",
  "anyhow",
@@ -6272,7 +6272,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -6284,7 +6284,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "convert_case",
  "serde",
@@ -6293,7 +6293,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6305,7 +6305,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6317,7 +6317,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -6329,7 +6329,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6341,7 +6341,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6353,7 +6353,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -6364,7 +6364,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6375,7 +6375,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6387,7 +6387,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6398,7 +6398,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -6420,7 +6420,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6432,7 +6432,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6446,7 +6446,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "convert_case",
@@ -6463,7 +6463,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6476,7 +6476,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -6488,7 +6488,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6506,7 +6506,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -6522,7 +6522,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6538,7 +6538,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wasm"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "getrandom 0.2.17",
@@ -6570,7 +6570,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -6581,7 +6581,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.768.0"
+version = "1.769.0"
 dependencies = [
  "anyhow",
  "bitflags",
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.toml b/backend/parsers/windmill-parser-wasm/Cargo.toml
index dcb0d1f661..e0e2e22cdb 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.toml
+++ b/backend/parsers/windmill-parser-wasm/Cargo.toml
@@ -12,7 +12,7 @@ resolver = "2"
 members = ["."]
 
 [workspace.package]
-version = "1.768.0"
+version = "1.769.0"
 edition = "2021"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index fd1f3fb70d..ea15c8167b 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.768.0
+  version: 1.769.0
   title: Windmill API
 
   contact:
diff --git a/benchmarks/lib.ts b/benchmarks/lib.ts
index 6bf6c47c25..f71ef92a15 100644
--- a/benchmarks/lib.ts
+++ b/benchmarks/lib.ts
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.768.0";
+export const VERSION = "v1.769.0";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({
diff --git a/cli/src/core/constants.ts b/cli/src/core/constants.ts
index 2679cd1062..fa0b9346d5 100644
--- a/cli/src/core/constants.ts
+++ b/cli/src/core/constants.ts
@@ -10,4 +10,4 @@ export const WM_FORK_PREFIX = "wm-fork";
 // (e.g. utils.ts) can read it without importing main.ts and creating a circular
 // dependency (main → workspace → utils → main) that triggers a TDZ.
 // Re-exported from main.ts for backwards compatibility.
-export const VERSION = "1.768.0";
+export const VERSION = "1.769.0";
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index b266491ae4..a97ff8cb23 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.768.0",
+	"version": "1.769.0",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "@windmill-labs/components",
-			"version": "1.768.0",
+			"version": "1.769.0",
 			"hasInstallScript": true,
 			"license": "AGPL-3.0",
 			"dependencies": {
diff --git a/frontend/package.json b/frontend/package.json
index a9045ec8c5..b70dbf980b 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.768.0",
+	"version": "1.769.0",
 	"scripts": {
 		"dev": "vite dev",
 		"dev:ui-builder": "mv static/ui_builder static/ui_builder.dev-disabled 2>/dev/null || true ; trap 'mv static/ui_builder.dev-disabled static/ui_builder 2>/dev/null || true' EXIT ; vite dev",
diff --git a/lsp/Pipfile b/lsp/Pipfile
index 30bac8a5de..2c9459087d 100644
--- a/lsp/Pipfile
+++ b/lsp/Pipfile
@@ -4,7 +4,7 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-wmill = ">=1.768.0"
+wmill = ">=1.769.0"
 sendgrid = "*"
 mysql-connector-python = "*"
 pymongo = "*"
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index dcf69637f1..43cc0a5866 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1,7 +1,7 @@
 openapi: '3.0.3'
 
 info:
-  version: 1.768.0
+  version: 1.769.0
   title: OpenFlow Spec
   contact:
     name: Ruben Fiszel
diff --git a/powershell-client/WindmillClient/WindmillClient.psd1 b/powershell-client/WindmillClient/WindmillClient.psd1
index dc61f39186..cdc502b04f 100644
--- a/powershell-client/WindmillClient/WindmillClient.psd1
+++ b/powershell-client/WindmillClient/WindmillClient.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'WindmillClient.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '1.768.0'
+    ModuleVersion     = '1.769.0'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()
diff --git a/python-client/wmill/pyproject.toml b/python-client/wmill/pyproject.toml
index 6578f09d74..f44b602c3c 100644
--- a/python-client/wmill/pyproject.toml
+++ b/python-client/wmill/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill"
-version = "1.768.0"
+version = "1.769.0"
 description = "A client library for accessing Windmill server wrapping the Windmill client API"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/typescript-client/jsr.json b/typescript-client/jsr.json
index a12896410b..b600205868 100644
--- a/typescript-client/jsr.json
+++ b/typescript-client/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@windmill/windmill",
-  "version": "1.768.0",
+  "version": "1.769.0",
   "exports": "./src/index.ts",
   "publish": {
     "exclude": ["!src", "./s3Types.ts", "./sqlUtils.ts", "./client.ts"]
diff --git a/typescript-client/package.json b/typescript-client/package.json
index 90788d794f..40b609e7f5 100644
--- a/typescript-client/package.json
+++ b/typescript-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.768.0",
+  "version": "1.769.0",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "homepage": "https://github.com/windmill-labs/windmill/tree/main/typescript-client#readme",
diff --git a/version.txt b/version.txt
index 3778ed6399..475443dad3 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.768.0
+1.769.0

From 992ed0124492f5c6b9e3dcc6a309caeda8d6a7b1 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 24 Jul 2026 17:09:57 +0200
Subject: [PATCH 158/171] fix: do not apply workspace display name on git-sync
 pull (#10308)

* fix: do not apply workspace display name on git-sync pull

The workspace display name is stored in settings.yaml and was re-applied on
every pull via changeWorkspaceName. Because settings.yaml is shared across the
branches of a repo, a workspace could have its name overwritten by another
workspace that syncs the same repo. Keep name in settings.yaml for reference
(written on push) but stop applying it on pull.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* docs: consolidate workspace-name rationale to one comment (review nit)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore: bump git-sync hub scripts to windmill-cli 1.769.1

Repin GIT_SYNC_PULL_SCRIPT_PATH (28795->28808), LATEST_GIT_SYNC_SCRIPT_PATH
(28796->28809) and frontend gitInitRepo to the hub scripts bundling
windmill-cli@1.769.1, so backend automatic git pulls no longer apply the
workspace display name (the CLI fix in this PR only reaches auto-pull via the
pinned hub script bundle).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 backend/windmill-common/src/workspaces.rs     |  4 +-
 cli/src/core/settings.ts                      | 20 ++---
 .../push_workspace_settings_name_unit.test.ts | 73 +++++++++++++++++++
 frontend/src/lib/hubPaths.json                |  2 +-
 4 files changed, 84 insertions(+), 15 deletions(-)
 create mode 100644 cli/test/push_workspace_settings_name_unit.test.ts

diff --git a/backend/windmill-common/src/workspaces.rs b/backend/windmill-common/src/workspaces.rs
index 59d50ef44a..135b8b9558 100644
--- a/backend/windmill-common/src/workspaces.rs
+++ b/backend/windmill-common/src/workspaces.rs
@@ -167,7 +167,7 @@ pub enum ObjectType {
     DatatableMigration,
 }
 
-pub const LATEST_GIT_SYNC_SCRIPT_PATH: &str = "hub/28796/sync-script-to-git-repo-windmill";
+pub const LATEST_GIT_SYNC_SCRIPT_PATH: &str = "hub/28809/sync-script-to-git-repo-windmill";
 
 /// Hub script that applies a repository's state back into a workspace
 /// (the repo → Windmill / "pull" direction). Same script the UI runs from
@@ -175,7 +175,7 @@ pub const LATEST_GIT_SYNC_SCRIPT_PATH: &str = "hub/28796/sync-script-to-git-repo
 /// ignores the slug, so the slug is kept free of characters that would be
 /// percent-encoded into the run URL (a `:` becomes `%3A`, which some hardened
 /// reverse proxies reject as double-encoding when the client re-encodes it).
-pub const GIT_SYNC_PULL_SCRIPT_PATH: &str = "hub/28795/git-sync-init-repository-windmill";
+pub const GIT_SYNC_PULL_SCRIPT_PATH: &str = "hub/28808/git-sync-init-repository-windmill";
 
 /// Prefix used to identify fork workspaces. A workspace whose id starts with this string is a
 /// fork of another workspace.
diff --git a/cli/src/core/settings.ts b/cli/src/core/settings.ts
index e4b618180f..54e52564d0 100644
--- a/cli/src/core/settings.ts
+++ b/cli/src/core/settings.ts
@@ -217,9 +217,10 @@ export async function pushWorkspaceSettings(
     throw new Error(`Failed to get workspace settings: ${err}`);
   }
 
-  // Exclude read-only fields from comparison (slack_team_id and slack_name are set via OAuth only)
-  const { slack_team_id: _lst, slack_name: _lsn, ...comparableLocal } = localSettings;
-  const { slack_team_id: _rst, slack_name: _rsn, ...comparableRemote } = settings;
+  // Exclude fields that are never applied here: slack_team_id/slack_name are OAuth-only,
+  // and name is not applied on pull (see below), so a name-only diff stays a no-op.
+  const { slack_team_id: _lst, slack_name: _lsn, name: _ln, ...comparableLocal } = localSettings;
+  const { slack_team_id: _rst, slack_name: _rsn, name: _rn, ...comparableRemote } = settings;
   if (isSuperset(comparableLocal, comparableRemote)) {
     log.debug(`Workspace settings are up to date`);
     return;
@@ -364,15 +365,10 @@ export async function pushWorkspaceSettings(
     });
   }
 
-  if (localSettings.name != settings.name) {
-    log.debug(`Updating workspace name...`);
-    await wmill.changeWorkspaceName({
-      workspace,
-      requestBody: {
-        new_name: localSettings.name,
-      },
-    });
-  }
+  // Workspace display name is intentionally not applied on pull: settings.yaml is shared
+  // across a repo's branches, so applying it would let one workspace's name overwrite
+  // another's when both sync the same repo. It stays in the file (written on push), but a
+  // live workspace is only renamed by its owner.
 
   if (localSettings.mute_critical_alerts != settings.mute_critical_alerts) {
     log.debug(`Updating mute critical alerts...`);
diff --git a/cli/test/push_workspace_settings_name_unit.test.ts b/cli/test/push_workspace_settings_name_unit.test.ts
new file mode 100644
index 0000000000..22bdf7c677
--- /dev/null
+++ b/cli/test/push_workspace_settings_name_unit.test.ts
@@ -0,0 +1,73 @@
+/**
+ * Regression guard: a pull (pushWorkspaceSettings) must not apply the workspace
+ * display name from settings.yaml. Rationale lives at the apply site in settings.ts.
+ */
+
+import { expect, test, describe, beforeEach, mock } from "bun:test";
+
+let changeWorkspaceNameCalls: unknown[] = [];
+let editWebhookCalls: unknown[] = [];
+let remoteName = "";
+let remoteWebhook: string | undefined = undefined;
+
+// Every wmill.* call reachable from pushWorkspaceSettings is stubbed so the
+// function runs without a backend; only the two we assert on record calls.
+mock.module("../gen/services.gen.ts", () => ({
+  getSettings: async (_a: { workspace: string }) => ({ webhook: remoteWebhook }),
+  getWorkspaceName: async (_a: { workspace: string }) => remoteName,
+  changeWorkspaceName: async (a: unknown) => {
+    changeWorkspaceNameCalls.push(a);
+  },
+  editWebhook: async (a: unknown) => {
+    editWebhookCalls.push(a);
+  },
+  editAutoInvite: async () => {},
+  editErrorHandler: async () => {},
+  editSuccessHandler: async () => {},
+  editDeployTo: async () => {},
+  editCopilotConfig: async () => {},
+  editLargeFileStorageConfig: async () => {},
+  editWorkspaceGitSyncConfig: async () => {},
+  editWorkspaceDefaultApp: async () => {},
+  editDefaultScripts: async () => {},
+  workspaceMuteCriticalAlertsUi: async () => {},
+  changeWorkspaceColor: async () => {},
+  updateOperatorSettings: async () => {},
+  editDataTableConfig: async () => {},
+  editSlackCommand: async () => {},
+  setWorkspaceSlackOauthConfig: async () => {},
+  deleteWorkspaceSlackOauthConfig: async () => {},
+}));
+
+const { pushWorkspaceSettings } = await import("../src/core/settings.ts");
+
+describe("pushWorkspaceSettings workspace name", () => {
+  const ws = "phoenix";
+
+  beforeEach(() => {
+    changeWorkspaceNameCalls = [];
+    editWebhookCalls = [];
+    remoteName = "phoenix";
+    remoteWebhook = undefined;
+  });
+
+  test("a differing name in settings.yaml is not applied to the workspace", async () => {
+    // Another setting also differs so the function proceeds past its no-op early
+    // return; only that setting must be applied, never the name.
+    remoteWebhook = "https://old";
+    await pushWorkspaceSettings(ws, "settings", undefined, {
+      name: "phoenix-staging",
+      webhook: "https://new",
+    });
+    expect(editWebhookCalls.length).toBe(1);
+    expect(changeWorkspaceNameCalls.length).toBe(0);
+  });
+
+  test("a name-only difference is a complete no-op", async () => {
+    await pushWorkspaceSettings(ws, "settings", undefined, {
+      name: "phoenix-staging",
+    });
+    expect(editWebhookCalls.length).toBe(0);
+    expect(changeWorkspaceNameCalls.length).toBe(0);
+  });
+});
diff --git a/frontend/src/lib/hubPaths.json b/frontend/src/lib/hubPaths.json
index 0cb2cd5602..3a9874596d 100644
--- a/frontend/src/lib/hubPaths.json
+++ b/frontend/src/lib/hubPaths.json
@@ -1,6 +1,6 @@
 {
 	"gitSyncTest": "hub/28184/git-repo-test-read-write-windmill",
-	"gitInitRepo": "hub/28795/git-sync-init-repository-windmill",
+	"gitInitRepo": "hub/28808/git-sync-init-repository-windmill",
 	"slackErrorHandler": "hub/28794/workspace-or-schedule-error-handler-slack",
 	"emailErrorHandler": "hub/19795/workspace-or-error-handler-email",
 	"slackRecoveryHandler": "hub/28791/slack/schedule-recovery-handler-slack",

From f00fcb2d1b1030b47c824bdefc9f0d12499bc6b6 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 24 Jul 2026 18:12:09 +0200
Subject: [PATCH 159/171] fix: show scheduled singlestepflow runs in flow
 history sidebar (#10312)

* fix: show scheduled singlestepflow runs in flow input history

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix: only match flow-wrapped singlestepflow rows in flow history

singlestepflow wraps either a script or a flow; a script and flow may share
a runnable_path, so filter flow history to flow-wrapped rows via the wrapped
module type. Extends the regression test to cover the same-path collision.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix: surface scheduled singlestepflow runs in script history too

Scheduled scripts with a dynamic-skip handler or native retry also run as
singlestepflow. Include that kind for ScriptPath history, filtered to
script-wrapped rows so a same-path flow run does not leak in. ScriptHash is
untouched (these wrappers carry no runnable_id). Test covers both directions.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 backend/windmill-api-inputs/src/lib.rs        | 62 ++++++++++---
 .../tests/inputs.rs                           | 91 +++++++++++++++++++
 2 files changed, 138 insertions(+), 15 deletions(-)

diff --git a/backend/windmill-api-inputs/src/lib.rs b/backend/windmill-api-inputs/src/lib.rs
index 8764736e83..8e33789c3d 100644
--- a/backend/windmill-api-inputs/src/lib.rs
+++ b/backend/windmill-api-inputs/src/lib.rs
@@ -73,14 +73,6 @@ impl Display for RunnableType {
 }
 
 impl RunnableType {
-    fn job_kind(&self) -> JobKind {
-        match self {
-            RunnableType::ScriptHash => JobKind::Script,
-            RunnableType::ScriptPath => JobKind::Script,
-            RunnableType::FlowPath => JobKind::Flow,
-        }
-    }
-
     fn column_name(&self) -> &'static str {
         match self {
             RunnableType::ScriptHash => "runnable_id",
@@ -159,6 +151,28 @@ async fn get_input_history(
         "AND parent_job IS NULL"
     };
 
+    // A scheduled runnable with a dynamic-skip handler (or a scheduled script with
+    // native retry) is wrapped in a synthetic `singlestepflow`, so its runs land under
+    // that kind rather than `flow`/`script` (see windmill-queue schedule.rs). Such a
+    // wrapper holds either a script or a flow, and the two may share a runnable_path, so
+    // match only the wrapped kind that belongs to the queried runnable. The wrapped type
+    // lives in raw_flow.modules[id in ('a','main')].value.type (mirrors the projection in
+    // windmill-api jobs.rs). runnable_id is NULL on these rows, so ScriptHash never matches.
+    let singlestepflow_filter = match r.runnable_type {
+        RunnableType::FlowPath => {
+            "AND (kind <> 'singlestepflow' OR EXISTS (\
+                SELECT 1 FROM jsonb_array_elements(v2_job.raw_flow->'modules') m \
+                WHERE m->>'id' IN ('a', 'main') AND m->'value'->>'type' = 'flow'))"
+        }
+        RunnableType::ScriptPath => {
+            "AND (kind <> 'singlestepflow' OR EXISTS (\
+                SELECT 1 FROM jsonb_array_elements(v2_job.raw_flow->'modules') m \
+                WHERE m->>'id' IN ('a', 'main') \
+                  AND COALESCE(m->'value'->>'type', 'script') <> 'flow'))"
+        }
+        RunnableType::ScriptHash => "",
+    };
+
     // Two-step approach: first fetch 2*(per_page+offset) rows using created_at ordering
     // (which leverages the ix_job_root_job_index_by_path_2 index on v2_job), then sort
     // the small result set by completed_at. This works because created_at and completed_at
@@ -172,7 +186,7 @@ async fn get_input_history(
             kind IN ('preview', 'flowpreview') as is_preview \
             FROM v2_job JOIN v2_job_completed USING (id) \
             WHERE v2_job.workspace_id = $3 AND {} = $1 AND kind = any($2) \
-            AND v2_job.script_entrypoint_override IS NULL \
+            AND v2_job.script_entrypoint_override IS NULL {singlestepflow_filter} \
             {args_query} AND v2_job_completed.status != 'skipped' {include_non_root} \
             ORDER BY v2_job.created_at DESC LIMIT $4\
         ) t ORDER BY completed_at DESC LIMIT $5 OFFSET $6",
@@ -186,14 +200,32 @@ async fn get_input_history(
         _ => query.bind(&r.runnable_id),
     };
 
-    let job_kinds = match r.runnable_type.job_kind() {
-        kind @ JobKind::Script if g.include_preview.unwrap_or(false) => {
-            vec![kind, JobKind::Preview]
+    // Include SingleStepFlow so scheduled runs surface (see `singlestepflow_filter`
+    // above, which restricts it to the wrapped kind matching the runnable). ScriptHash
+    // is omitted: those wrappers carry no runnable_id, so it can never match.
+    let include_preview = g.include_preview.unwrap_or(false);
+    let job_kinds = match r.runnable_type {
+        RunnableType::ScriptHash => {
+            let mut kinds = vec![JobKind::Script];
+            if include_preview {
+                kinds.push(JobKind::Preview);
+            }
+            kinds
         }
-        kind @ JobKind::Flow if g.include_preview.unwrap_or(false) => {
-            vec![kind, JobKind::FlowPreview]
+        RunnableType::ScriptPath => {
+            let mut kinds = vec![JobKind::Script, JobKind::SingleStepFlow];
+            if include_preview {
+                kinds.push(JobKind::Preview);
+            }
+            kinds
+        }
+        RunnableType::FlowPath => {
+            let mut kinds = vec![JobKind::Flow, JobKind::SingleStepFlow];
+            if include_preview {
+                kinds.push(JobKind::FlowPreview);
+            }
+            kinds
         }
-        kind => vec![kind],
     };
 
     let rows = query
diff --git a/backend/windmill-api-integration-tests/tests/inputs.rs b/backend/windmill-api-integration-tests/tests/inputs.rs
index 6f806efdb5..a3f0610e55 100644
--- a/backend/windmill-api-integration-tests/tests/inputs.rs
+++ b/backend/windmill-api-integration-tests/tests/inputs.rs
@@ -74,3 +74,94 @@ async fn test_inputs_endpoints(db: Pool<Postgres>) -> anyhow::Result<()> {
 
     Ok(())
 }
+
+// A scheduled runnable with a dynamic-skip handler (or a scheduled script with native
+// retry) runs as a `singlestepflow`, not `flow`/`script` (see windmill-queue schedule.rs).
+// Both a flow's and a script's history must surface their own singlestepflow runs, but a
+// script and flow may share a path, so each side must match only the wrapped kind that
+// belongs to it — the other must not leak in.
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_input_history_singlestepflow_flow_vs_script(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+
+    // Both rows share runnable_path 'f/test/scheduled'.
+    let flow_job = insert_singlestepflow(&db, "flow").await?;
+    let script_job = insert_singlestepflow(&db, "script").await?;
+
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let base = format!("http://localhost:{port}/api/w/test-workspace/inputs");
+
+    let history_ids = |runnable_type: &'static str| {
+        let base = base.clone();
+        async move {
+            let resp = authed(client().get(format!(
+                "{base}/history?runnable_id=f/test/scheduled&runnable_type={runnable_type}"
+            )))
+            .send()
+            .await?;
+            let status = resp.status().as_u16();
+            let body = resp.text().await?;
+            assert_2xx(status, &body, "GET /inputs/history");
+            let inputs: Vec<serde_json::Value> = serde_json::from_str(&body)?;
+            anyhow::Ok(
+                inputs
+                    .iter()
+                    .filter_map(|i| i.get("id").and_then(|v| v.as_str()).map(String::from))
+                    .collect::<std::collections::HashSet<_>>(),
+            )
+        }
+    };
+
+    let flow_hist = history_ids("FlowPath").await?;
+    assert!(
+        flow_hist.contains(&flow_job.to_string()),
+        "flow-wrapped singlestepflow missing from flow history: {flow_hist:?}",
+    );
+    assert!(
+        !flow_hist.contains(&script_job.to_string()),
+        "script-wrapped singlestepflow leaked into flow history: {flow_hist:?}",
+    );
+
+    let script_hist = history_ids("ScriptPath").await?;
+    assert!(
+        script_hist.contains(&script_job.to_string()),
+        "script-wrapped singlestepflow missing from script history: {script_hist:?}",
+    );
+    assert!(
+        !script_hist.contains(&flow_job.to_string()),
+        "flow-wrapped singlestepflow leaked into script history: {script_hist:?}",
+    );
+
+    Ok(())
+}
+
+// Insert a completed root singlestepflow at path f/test/scheduled wrapping `wrapped_type`
+// ('flow' or 'script') as its single module — mirrors the schedule.rs wrapper shape.
+async fn insert_singlestepflow(
+    db: &Pool<Postgres>,
+    wrapped_type: &str,
+) -> anyhow::Result<uuid::Uuid> {
+    let id = uuid::Uuid::new_v4();
+    let raw_flow = json!({ "modules": [{ "id": "a", "value": { "type": wrapped_type } }] });
+    sqlx::query(
+        "INSERT INTO v2_job (id, workspace_id, tag, created_by, permissioned_as, \
+         permissioned_as_email, kind, runnable_path, raw_flow, same_worker, visible_to_owner) \
+         VALUES ($1, 'test-workspace', 'flow', 'test-user', 'u/test-user', \
+         'test@windmill.dev', 'singlestepflow', 'f/test/scheduled', $2, false, true)",
+    )
+    .bind(id)
+    .bind(sqlx::types::Json(&raw_flow))
+    .execute(db)
+    .await?;
+    sqlx::query(
+        "INSERT INTO v2_job_completed (id, workspace_id, duration_ms, deleted, status) \
+         VALUES ($1, 'test-workspace', 1, false, 'success')",
+    )
+    .bind(id)
+    .execute(db)
+    .await?;
+    Ok(id)
+}

From 48618cff8c35a345babd12844653f83addbcd7e8 Mon Sep 17 00:00:00 2001
From: Tristan TR <69242752+tristantr@users.noreply.github.com>
Date: Fri, 24 Jul 2026 18:19:25 +0200
Subject: [PATCH 160/171] feat: Add image when publishing a project (#10310)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* refactor(hub): remove per-item Publish to Hub entry points

Publishing to the Hub now happens exclusively through the folder-level
deploy-to-hub flow (/folders). Remove the standalone entry points:

- script detail page menu item (and the SCRIPT_VIEW_SHOW_PUBLISH_TO_HUB
  const that gated it)
- script list row dropdown item
- raw app editor menu item, its zip-download drawer and publishToHub()
- long-dead commented block in AppEditorHeader

Also drop the now-orphaned URL helpers (scriptToHubUrl, flowToHubUrl,
appToHubUrl, rawAppToHubUrl) from lib/hub.ts.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(hub): upload a custom project logo from the deploy-to-hub drawer

Add a Logo field to the bundle metadata form: a drag-and-drop dropzone
(png/svg, 512KB client-side cap mirrored server-side by the Hub) that
turns into a live replica of the Hub project card once an image is
picked, so the logo can be judged in context before publishing. The
logo is pushed after the draft's items/migrations via the new
POST /projects/{slug}/logo proxy in hub_publish.rs (slug validated by
construction, `logo: null` forwarded to clear). Leaving the field empty
never touches the Hub's existing logo, so re-publishing a bundle keeps it.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(hub): logo removal, safer mime inference, explicit clear semantics

Review follow-ups on the project logo upload:

- Removing a published logo is now possible: hubLogo is three-state
  (undefined = leave the Hub's logo alone, null = clear on publish,
  object = upload). Rehydration reads has_logo so the drawer shows a
  "Remove on publish" affordance when the Hub already has one, with an
  undo banner before publishing.
- hub_publish.rs uses a double-Option for the logo field: a missing
  `logo` key is now a 400 instead of being serialized as `logo: null`,
  which the Hub interprets as an explicit clear — POSTing `{}` can no
  longer silently delete a project's logo.
- Client mime inference prefers the browser-reported file.type over the
  filename extension, so a PNG misnamed *.svg no longer produces a
  broken preview and a guaranteed server-side sniff rejection.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Update frontend/src/lib/components/workspaceSettings/deployToHubSession.svelte.ts

Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>

* Update frontend/src/lib/components/workspaceSettings/DeployToHub.svelte

Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>

* fix(hub): validate logo size/mime/base64 in the proxy, document the endpoint

- Enforce the logo constraints in windmill-api itself instead of relying
  on the browser and remote Hub: a route-level DefaultBodyLimit sized
  for a max logo in base64 (+JSON envelope) overrides the global request
  limit, and the handler validates the mime allowlist, base64 alphabet
  and decoded length (512KB cap) before anything is forwarded.
- Add /w/{workspace}/hub/projects/{slug}/logo to openapi.yaml (with the
  ProjectLogoBody schema) and regenerate the frontend client.
- Drop a narrating comment on the hidden file input.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
---
 backend/windmill-api/openapi.yaml             |  56 ++++++
 backend/windmill-api/src/hub_publish.rs       |  81 ++++++++-
 .../apps/editor/AppEditorHeader.svelte        |   9 -
 .../components/common/table/ScriptRow.svelte  |  27 +--
 .../raw_apps/RawAppEditorHeader.svelte        |  81 ---------
 .../workspaceSettings/DeployToHub.svelte      | 166 ++++++++++++++++++
 .../deployToHubSession.svelte.ts              |  25 +++
 frontend/src/lib/consts.ts                    |   2 -
 frontend/src/lib/hub.ts                       |  46 +----
 .../scripts/get/[...hash]/+page.svelte        |  28 ---
 10 files changed, 329 insertions(+), 192 deletions(-)

diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index ea15c8167b..bc6d731756 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -23313,6 +23313,42 @@ paths:
               schema:
                 type: string
 
+  /w/{workspace}/hub/projects/{slug}/logo:
+    post:
+      summary: set or clear a hub project's custom logo
+      description: |
+        Requires the caller to be a workspace admin. Sets the project's custom
+        logo (base64 png/svg, decoded size max 512KB) or clears it when `logo`
+        is null; the `logo` field itself is required so an empty body cannot
+        clear the logo by accident. Forwards the request to the configured Hub
+        scoped to the `{workspace}:{folder}` source and returns the Hub's
+        status code and raw response body.
+      operationId: publishHubProjectLogo
+      tags:
+        - hubPublish
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - name: slug
+          in: path
+          required: true
+          description: hub project slug
+          schema:
+            $ref: "#/components/schemas/HubProjectSlug"
+        - $ref: "#/components/parameters/HubPublishFolder"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/ProjectLogoBody"
+      responses:
+        "200":
+          description: raw Hub response body (status code is passed through from the Hub)
+          content:
+            text/plain:
+              schema:
+                type: string
+
   /w/{workspace}/hub/projects/{slug}/submit:
     post:
       summary: submit a hub project draft for review
@@ -32495,6 +32531,26 @@ components:
         recording:
           type: object
 
+    ProjectLogoBody:
+      type: object
+      properties:
+        logo:
+          description: the logo to set, or null to clear the project's current logo
+          nullable: true
+          type: object
+          properties:
+            b64:
+              description: base64-encoded image bytes (decoded size max 512KB)
+              type: string
+            mime:
+              type: string
+              enum: [image/png, image/svg+xml]
+          required:
+            - b64
+            - mime
+      required:
+        - logo
+
     PublishResourceTypeBody:
       type: object
       properties:
diff --git a/backend/windmill-api/src/hub_publish.rs b/backend/windmill-api/src/hub_publish.rs
index fab473ea41..9c1412cb0b 100644
--- a/backend/windmill-api/src/hub_publish.rs
+++ b/backend/windmill-api/src/hub_publish.rs
@@ -2,7 +2,7 @@ use crate::auth::Tokened;
 use crate::db::ApiAuthed;
 use crate::HTTP_CLIENT;
 use axum::{
-    extract::{FromRequestParts, Json, Path, Query, RawPathParams},
+    extract::{DefaultBodyLimit, FromRequestParts, Json, Path, Query, RawPathParams},
     http::{request::Parts, StatusCode},
     response::{IntoResponse, Response},
     routing::{get, post},
@@ -32,6 +32,10 @@ pub fn workspaced_service() -> Router {
             "/projects/{slug}/pipeline_recording",
             post(publish_pipeline_recording),
         )
+        .route(
+            "/projects/{slug}/logo",
+            post(publish_project_logo).layer(DefaultBodyLimit::max(LOGO_BODY_LIMIT)),
+        )
         .route("/resource_types", post(publish_resource_type))
         .route("/resources", post(publish_resources))
         .route("/triggers", post(publish_triggers))
@@ -359,6 +363,81 @@ async fn publish_pipeline_recording(
         .await
 }
 
+#[derive(Deserialize, Serialize)]
+struct ProjectLogoInner {
+    b64: String,
+    mime: String,
+}
+
+// Custom project logo (png/svg, base64). Double-Option so a missing `logo`
+// key is distinguishable from an explicit `logo: null` (which clears the
+// logo on the Hub) — otherwise POSTing `{}` would silently delete it.
+#[derive(Deserialize, Serialize)]
+struct ProjectLogoBody {
+    #[serde(default, deserialize_with = "deserialize_explicit")]
+    logo: Option<Option<ProjectLogoInner>>,
+}
+
+fn deserialize_explicit<'de, D: Deserializer<'de>>(
+    d: D,
+) -> Result<Option<Option<ProjectLogoInner>>, D::Error> {
+    Option::<ProjectLogoInner>::deserialize(d).map(Some)
+}
+
+// Mirrors the Hub's own limits so an oversized/invalid payload is rejected
+// here instead of being deserialized, copied and forwarded first. The route
+// also carries a DefaultBodyLimit sized for a max logo in base64 + JSON
+// envelope, overriding the much larger global request limit.
+const MAX_LOGO_BYTES: usize = 512 * 1024;
+const LOGO_BODY_LIMIT: usize = MAX_LOGO_BYTES / 3 * 4 + 16 * 1024;
+const ALLOWED_LOGO_MIMES: [&str; 2] = ["image/png", "image/svg+xml"];
+
+fn validate_logo(inner: &ProjectLogoInner) -> Result<(), Error> {
+    if !ALLOWED_LOGO_MIMES.contains(&inner.mime.as_str()) {
+        return Err(Error::BadRequest(
+            "logo mime must be image/png or image/svg+xml".to_string(),
+        ));
+    }
+    let b = inner.b64.as_bytes();
+    let padding = b.iter().rev().take_while(|&&c| c == b'=').count();
+    let valid = !b.is_empty()
+        && b.len() % 4 == 0
+        && padding <= 2
+        && b[..b.len() - padding]
+            .iter()
+            .all(|&c| c.is_ascii_alphanumeric() || c == b'+' || c == b'/');
+    if !valid {
+        return Err(Error::BadRequest("invalid base64".to_string()));
+    }
+    if b.len() / 4 * 3 - padding > MAX_LOGO_BYTES {
+        return Err(Error::BadRequest(format!(
+            "logo too large (max {}KB)",
+            MAX_LOGO_BYTES / 1024
+        )));
+    }
+    Ok(())
+}
+
+async fn publish_project_logo(
+    ctx: HubPublishCtx,
+    Path((_workspace, slug)): Path<(String, ProjectSlug)>,
+    Json(body): Json<ProjectLogoBody>,
+) -> Result<impl IntoResponse, Error> {
+    let Some(logo) = body.logo else {
+        return Err(Error::BadRequest(
+            "logo field is required: an object to set it, or null to clear it".to_string(),
+        ));
+    };
+    if let Some(inner) = &logo {
+        validate_logo(inner)?;
+    }
+    ctx.post(
+        &format!("/projects/{}/logo", slug),
+        &serde_json::json!({ "logo": logo }),
+    )
+    .await
+}
+
 #[derive(Deserialize, Serialize)]
 struct PublishResourceTypeBody {
     name: String,
diff --git a/frontend/src/lib/components/apps/editor/AppEditorHeader.svelte b/frontend/src/lib/components/apps/editor/AppEditorHeader.svelte
index 394b031026..0871833613 100644
--- a/frontend/src/lib/components/apps/editor/AppEditorHeader.svelte
+++ b/frontend/src/lib/components/apps/editor/AppEditorHeader.svelte
@@ -599,15 +599,6 @@
 				window.open(computeSecretUrl(secretUrl), '_blank')
 			}
 		},
-		// {
-		// 	displayName: 'Publish to Hub',
-		// 	icon: faGlobe,
-		// 	action: () => {
-		// 		const url = appToHubUrl(toStatic($app, $staticExporter, $summary, $hubBaseUrlStore))
-		// 		window.open(url.toString(), '_blank')
-		// 	}
-		// },
-
 		{
 			displayName: 'App inputs',
 			icon: FormInput,
diff --git a/frontend/src/lib/components/common/table/ScriptRow.svelte b/frontend/src/lib/components/common/table/ScriptRow.svelte
index 507986294f..4891ac8fc3 100644
--- a/frontend/src/lib/components/common/table/ScriptRow.svelte
+++ b/frontend/src/lib/components/common/table/ScriptRow.svelte
@@ -9,7 +9,7 @@
 	import type ShareModal from '$lib/components/ShareModal.svelte'
 
 	import { ScriptService, type Script } from '$lib/gen'
-	import { hubBaseUrlStore, userStore, userWorkspaces, workspaceStore } from '$lib/stores'
+	import { userStore, userWorkspaces, workspaceStore } from '$lib/stores'
 	import { UserDraftDbSyncer } from '$lib/userDraftDbSyncer.svelte'
 
 	import { createEventDispatcher } from 'svelte'
@@ -36,7 +36,6 @@
 		Shield,
 		Trash,
 		History,
-		Globe2,
 		FileText
 	} from 'lucide-svelte'
 	import ScriptVersionHistory from '$lib/components/ScriptVersionHistory.svelte'
@@ -47,7 +46,6 @@
 	import Popover from '$lib/components/Popover.svelte'
 	import Tooltip from '$lib/components/Tooltip.svelte'
 	import { getDeployUiSettings } from '$lib/components/home/deploy_ui'
-	import { scriptToHubUrl } from '$lib/hub'
 	import { buildForkEditUrl, editInForkAllowed, editInForkLabel } from '$lib/utils/editInFork'
 	import { isCloudHosted } from '$lib/cloud'
 
@@ -406,29 +404,6 @@
 							copyToClipboard(script.path)
 						}
 					},
-					{
-						displayName: 'Publish to Hub',
-						icon: Globe2,
-						action: async () => {
-							const scriptData = await ScriptService.getScriptByPath({
-								workspace: $workspaceStore!,
-								path: script.path
-							})
-							window.open(
-								scriptToHubUrl(
-									scriptData.content,
-									scriptData.summary,
-									scriptData.description ?? '',
-									scriptData.kind,
-									scriptData.language,
-									scriptData.schema,
-									scriptData.lock ?? '',
-									$hubBaseUrlStore
-								).toString(),
-								'_blank'
-							)
-						}
-					},
 					{
 						displayName: script.archived ? 'Unarchive' : 'Archive',
 						icon: Archive,
diff --git a/frontend/src/lib/components/raw_apps/RawAppEditorHeader.svelte b/frontend/src/lib/components/raw_apps/RawAppEditorHeader.svelte
index 29620b3739..ca9e0ef091 100644
--- a/frontend/src/lib/components/raw_apps/RawAppEditorHeader.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppEditorHeader.svelte
@@ -10,22 +10,17 @@
 	import { UserDraftDbSyncer } from '$lib/userDraftDbSyncer.svelte'
 	import OpenInSessionButton from '$lib/components/sessions/OpenInSessionButton.svelte'
 	import { discardDraftAfterDeploy } from '$lib/userDraftToast'
-	import { rawAppToHubUrl } from '$lib/hub'
 	import {
 		enterpriseLicense,
-		hubBaseUrlStore,
 		userStore,
 		userWorkspaces,
 		workspaceStore
 	} from '$lib/stores'
-	import YAML from 'yaml'
 	import {
 		Bug,
 		DiffIcon,
-		Download,
 		EllipsisVertical,
 		FileJson,
-		Globe,
 		History,
 		PanelLeft,
 		PanelLeftClose,
@@ -295,8 +290,6 @@
 
 	let saveDrawerOpen = $state(false)
 	let historyBrowserDrawerOpen = $state(false)
-	let publishToHubDrawerOpen = $state(false)
-	let publishingToHub = $state(false)
 	let deploymentMsg: string | undefined = $state(undefined)
 
 	// Top-bar responsive collapse — container width, not viewport.
@@ -307,37 +300,6 @@
 	// smallest well-supported unified size (`sm`) so the bar is thinner.
 	const headerBtnSize = $derived(condensedHeader ? 'sm' : 'md')
 
-	async function publishToHub() {
-		if (!app) return
-		publishingToHub = true
-		try {
-			const { default: JSZip } = await import('jszip')
-			const { js, css } = await getBundle()
-			const zip = new JSZip()
-			zip.file('app.yaml', YAML.stringify(app))
-			zip.file('bundle.js', js)
-			zip.file('bundle.css', css)
-			const blob = await zip.generateAsync({ type: 'blob' })
-
-			// Download the zip
-			const url = window.URL.createObjectURL(blob)
-			const a = document.createElement('a')
-			a.href = url
-			a.download = `${(appPath || 'raw-app').replaceAll('/', '__')}.zip`
-			a.click()
-			setTimeout(() => URL.revokeObjectURL(url), 100)
-
-			// Open hub page
-			const hubUrl = rawAppToHubUrl(
-				$hubBaseUrlStore,
-				summary || appPath.split('/').pop()?.replace('_', ' ') || 'my raw app'
-			)
-			window.open(hubUrl.toString(), '_blank')
-		} finally {
-			publishingToHub = false
-		}
-	}
-
 	function closeSaveDrawer() {
 		saveDrawerOpen = false
 	}
@@ -615,13 +577,6 @@
 			displayName: 'Edit in YAML',
 			icon: FileJson,
 			action: () => onOpenYamlEditor?.()
-		},
-		{
-			displayName: 'Publish to Hub',
-			icon: Globe,
-			action: () => {
-				publishToHubDrawerOpen = true
-			}
 		}
 	])
 
@@ -744,42 +699,6 @@
 	</DrawerContent>
 </Drawer>
 
-<Drawer bind:open={publishToHubDrawerOpen} size="600px">
-	<DrawerContent title="Publish to Hub" on:close={() => (publishToHubDrawerOpen = false)}>
-		{#snippet actions()}
-			<Button
-				loading={publishingToHub}
-				disabled={!app}
-				on:click={publishToHub}
-				variant="accent"
-				startIcon={{ icon: Download }}
-			>
-				Download & open hub
-			</Button>
-		{/snippet}
-		<div class="flex flex-col gap-4">
-			<p class="text-secondary text-sm">
-				This will download a zip file containing your raw app bundle and open the Windmill Hub
-				submission page.
-			</p>
-			<div class="text-sm">
-				<p class="font-semibold mb-2">The zip file will contain:</p>
-				<ul class="list-disc list-inside text-secondary space-y-1">
-					<li
-						><code class="text-xs bg-surface-secondary px-1 rounded">app.yaml</code> - App configuration</li
-					>
-					<li
-						><code class="text-xs bg-surface-secondary px-1 rounded">bundle.js</code> - JavaScript bundle</li
-					>
-					<li
-						><code class="text-xs bg-surface-secondary px-1 rounded">bundle.css</code> - CSS styles</li
-					>
-				</ul>
-			</div>
-		</div>
-	</DrawerContent>
-</Drawer>
-
 <AppJobsDrawer
 	bind:open={jobsDrawerOpen}
 	on:clear={() => {
diff --git a/frontend/src/lib/components/workspaceSettings/DeployToHub.svelte b/frontend/src/lib/components/workspaceSettings/DeployToHub.svelte
index 97ce779cea..573e8138d9 100644
--- a/frontend/src/lib/components/workspaceSettings/DeployToHub.svelte
+++ b/frontend/src/lib/components/workspaceSettings/DeployToHub.svelte
@@ -31,6 +31,7 @@
 		Eye,
 		ExternalLink,
 		Globe,
+		Image as ImageIcon,
 		Info,
 		LayoutDashboard,
 		Loader2,
@@ -99,6 +100,56 @@
 	async function confirmPublish() {
 		if (await deployHub.session?.confirmPublish()) publishDrawer?.closeDrawer()
 	}
+	// Client-side mirror of the Hub's logo constraints (it re-validates server-side).
+	const MAX_LOGO_BYTES = 512 * 1024
+	let logoDragOver = $state(false)
+	let logoFileInput = $state<HTMLInputElement | undefined>()
+	async function handleLogoFile(file: File | undefined) {
+		const s = deployHub.session
+		if (!s || !file) return
+		// Browser-reported type wins over the extension: a PNG misnamed *.svg
+		// must be treated as PNG or the Hub's content sniff rejects it later.
+		const lower = file.name.toLowerCase()
+		const mime =
+			file.type
+				? file.type === 'image/png'
+					? 'image/png'
+					: file.type === 'image/svg+xml'
+						? 'image/svg+xml'
+						: undefined
+				: lower.endsWith('.png')
+					? 'image/png'
+					: lower.endsWith('.svg')
+						? 'image/svg+xml'
+						: undefined
+		if (!mime) {
+			sendUserToast('Logo must be a PNG or SVG file', true)
+			return
+		}
+		if (file.size > MAX_LOGO_BYTES) {
+			sendUserToast('Logo too large (max 512KB)', true)
+			return
+		}
+		const buf = new Uint8Array(await file.arrayBuffer())
+		let bin = ''
+		for (let i = 0; i < buf.length; i += 0x8000) {
+			bin += String.fromCharCode(...buf.subarray(i, i + 0x8000))
+		}
+		s.hubLogo = { b64: btoa(bin), mime, name: file.name }
+	}
+	async function onLogoPicked(e: Event) {
+		const input = e.currentTarget as HTMLInputElement
+		const file = input.files?.[0]
+		// Reset so re-picking the same file re-fires `change`.
+		input.value = ''
+		await handleLogoFile(file)
+	}
+	async function onLogoDrop(e: DragEvent) {
+		e.preventDefault()
+		logoDragOver = false
+		await handleLogoFile(e.dataTransfer?.files?.[0])
+	}
+
 	async function copyIframeSnippet(url: string) {
 		const snippet = `<iframe src="${url}" width="100%" height="600" frameborder="0"></iframe>`
 		try {
@@ -1114,6 +1165,121 @@
 							inputProps={{ placeholder: 'Short one-liner shown on the Hub card' }}
 						/>
 					</label>
+					<div class="flex flex-col gap-1 text-xs">
+						<span class="font-semibold text-primary">{s.hubLogo ? 'Preview' : 'Logo'}</span>
+						{#if s.hubLogo}
+							<!-- Live replica of the Hub project card so the user can judge the
+							     logo in its real context before publishing. -->
+							<span class="text-[11px] text-hint">
+								This is how your project card will look on the Hub.
+							</span>
+							<div class="mt-1 flex flex-col items-center gap-2">
+								<div class="w-64 overflow-hidden rounded-2xl border shadow-sm">
+									<div
+										class="flex h-32 items-center justify-center bg-surface-secondary/50 px-4"
+									>
+										<img
+											src={`data:${s.hubLogo.mime};base64,${s.hubLogo.b64}`}
+											alt="Project logo preview"
+											class="max-h-16 max-w-36 object-contain"
+										/>
+									</div>
+									<div class="border-t bg-surface p-3">
+										<div class="truncate text-xs font-medium text-primary">
+											{s.hubName.trim() || 'Project name'}
+										</div>
+										<p class="mt-0.5 line-clamp-2 text-[11px] text-secondary">
+											{s.hubSummary.trim() || s.hubName.trim() || 'Short one-liner shown on the Hub card'}
+										</p>
+									</div>
+								</div>
+								<div class="flex items-center gap-2">
+									<Button
+										size="xs"
+										variant="default"
+										startIcon={{ icon: ImageIcon }}
+										onclick={() => logoFileInput?.click()}
+									>
+										Replace
+									</Button>
+									<Button
+										size="xs"
+										variant="default"
+										startIcon={{ icon: X }}
+										onclick={() => (s.hubLogo = undefined)}
+									>
+										Remove
+									</Button>
+								</div>
+							</div>
+						{:else}
+							{#if s.hubLogo === null}
+								<div
+									class="flex items-center justify-between gap-2 rounded border border-orange-300 bg-orange-50 px-3 py-2 dark:border-orange-800 dark:bg-orange-950/30"
+								>
+									<span class="text-orange-700 dark:text-orange-300">
+										The project's current logo will be removed when you publish.
+									</span>
+									<Button size="xs" variant="default" onclick={() => (s.hubLogo = undefined)}>
+										Undo
+									</Button>
+								</div>
+							{:else if s.hubHasRemoteLogo}
+								<div
+									class="flex items-center justify-between gap-2 rounded border bg-surface-secondary/50 px-3 py-2"
+								>
+									<span class="text-secondary">
+										This project already has a custom logo on the Hub.
+									</span>
+									<Button
+										size="xs"
+										variant="default"
+										startIcon={{ icon: X }}
+										onclick={() => (s.hubLogo = null)}
+									>
+										Remove on publish
+									</Button>
+								</div>
+							{/if}
+							<button
+								type="button"
+								class={`group flex w-full cursor-pointer flex-col items-center justify-center gap-1.5 rounded-lg border border-dashed px-4 py-6 text-center transition-colors ${
+									logoDragOver
+										? 'border-blue-400 bg-blue-50 dark:bg-blue-950/30'
+										: 'text-secondary hover:border-blue-300 hover:bg-surface-secondary/50'
+								}`}
+								onclick={() => logoFileInput?.click()}
+								ondragover={(e) => {
+									e.preventDefault()
+									logoDragOver = true
+								}}
+								ondragleave={() => (logoDragOver = false)}
+								ondrop={onLogoDrop}
+							>
+								<ImageIcon
+									size={20}
+									class="text-tertiary transition-colors group-hover:text-secondary"
+								/>
+								<span class="font-medium text-primary">
+									Drop an image or <span class="text-blue-500">browse</span>
+								</span>
+								<span class="text-[11px] text-hint">PNG or SVG, max 512KB</span>
+							</button>
+						{/if}
+						<input
+							bind:this={logoFileInput}
+							type="file"
+							accept=".png,.svg,image/png,image/svg+xml"
+							style="display: none"
+							onchange={onLogoPicked}
+						/>
+						{#if s.hubLogo === undefined}
+							<span class="text-[11px] text-hint">
+								Optional. Shown on the Hub project card and page. Leaving it empty keeps the
+								project's current logo.
+							</span>
+						{/if}
+					</div>
 					<label class="flex flex-col gap-1 text-xs">
 						<span class="font-semibold text-primary">Readme</span>
 						<textarea
diff --git a/frontend/src/lib/components/workspaceSettings/deployToHubSession.svelte.ts b/frontend/src/lib/components/workspaceSettings/deployToHubSession.svelte.ts
index 96cb8b117c..99d45a7007 100644
--- a/frontend/src/lib/components/workspaceSettings/deployToHubSession.svelte.ts
+++ b/frontend/src/lib/components/workspaceSettings/deployToHubSession.svelte.ts
@@ -234,6 +234,14 @@ export class DeployToHubSession {
 	hubName = $state('')
 	hubSummary = $state('')
 	hubReadme = $state('')
+	// Custom logo state for the next publish (png/svg, base64 without the
+	// data: prefix). Three-state: undefined = untouched (publishing leaves the
+	// Hub's current logo alone), null = clear the Hub's logo on publish,
+	// object = upload this image.
+	hubLogo = $state<{ b64: string; mime: string; name: string } | null | undefined>(undefined)
+	// Whether the Hub currently has a custom logo for this project (from
+	// rehydration) — drives the "Remove current logo" affordance.
+	hubHasRemoteLogo = $state(false)
 	effectiveSlug = $state('')
 	hubItemIds = $state<Record<string, number>>({})
 
@@ -586,6 +594,7 @@ export class DeployToHubSession {
 			this.hubName = p.name ?? ''
 			this.hubSummary = p.summary ?? ''
 			this.hubReadme = p.readme ?? ''
+			this.hubHasRemoteLogo = p.has_logo === true
 			this.phase =
 				p.status === 'live' ? 'live' : p.status === 'under_review' ? 'under_review' : 'draft'
 			const ids: Record<string, number> = {}
@@ -1242,6 +1251,22 @@ export class DeployToHubSession {
 				failures++
 			}
 
+			// Push the logo only when touched this session: an object uploads it,
+			// null clears the Hub's current logo, undefined leaves it alone
+			// (re-publishing a bundle must not clear it).
+			if (this.hubLogo !== undefined) {
+				try {
+					await this.#postHub(`/hub/projects/${encodeURIComponent(slug)}/logo`, {
+						logo: this.hubLogo ? { b64: this.hubLogo.b64, mime: this.hubLogo.mime } : null
+					})
+					this.hubHasRemoteLogo = this.hubLogo !== null
+					this.hubLogo = undefined
+				} catch (e: any) {
+					sendUserToast(`Logo ${this.hubLogo ? 'upload' : 'removal'} failed: ${e?.message ?? e}`, true)
+					failures++
+				}
+			}
+
 			await sleep(150)
 			if (this.#disposed) return
 			// An incomplete push must never become submittable: a failed transitive item
diff --git a/frontend/src/lib/consts.ts b/frontend/src/lib/consts.ts
index 95afa84802..11d801543c 100644
--- a/frontend/src/lib/consts.ts
+++ b/frontend/src/lib/consts.ts
@@ -22,8 +22,6 @@ export const SIDEBAR_SHOW_SCHEDULES = true
 export const WORKSPACE_SHOW_SLACK_CMD = true
 export const WORKSPACE_SHOW_WEBHOOK_CLI_SYNC = true
 
-export const SCRIPT_VIEW_SHOW_PUBLISH_TO_HUB = true
-
 export const SCRIPT_VIEW_SHOW_SCHEDULE = true
 export const SCRIPT_VIEW_SHOW_EXAMPLE_CURL = true
 
diff --git a/frontend/src/lib/hub.ts b/frontend/src/lib/hub.ts
index a038f18580..25b3f8b3fd 100644
--- a/frontend/src/lib/hub.ts
+++ b/frontend/src/lib/hub.ts
@@ -1,6 +1,4 @@
-import type { Schema } from './common'
-import { AppService, FlowService, type Flow, type Script } from './gen'
-import { encodeState } from './utils'
+import { AppService, FlowService } from './gen'
 import hubPathsData from './hubPaths.json'
 import {
 	replacePlaceholderForSignatureScriptTemplate,
@@ -11,22 +9,6 @@ import {
 export const DEFAULT_HUB_BASE_URL = 'https://hub.windmill.dev'
 export const PRIVATE_HUB_MIN_VERSION = 10_000_000
 
-export function scriptToHubUrl(
-	content: string,
-	summary: string,
-	description: string,
-	kind: Script['kind'],
-	language: Script['language'],
-	schema: Schema | any,
-	lock: string | undefined,
-	hubBaseUrl: string
-): URL {
-	const url = new URL(hubBaseUrl + '/scripts/add')
-	url.hash = encodeState({ content, summary, description, kind, language, schema, lock })
-
-	return url
-}
-
 export const HubScript = {
 	SIGNATURE_TEMPLATE: SIGNATURE_TEMPLATE_SCRIPT_HUB_PATH
 } as const
@@ -65,32 +47,6 @@ export async function loadHubApps() {
 	}
 }
 
-export function flowToHubUrl(flow: Flow, hubBaseUrl: string): URL {
-	const url = new URL(hubBaseUrl + '/flows/add')
-	const openFlow = {
-		value: flow.value,
-		summary: flow.summary,
-		description: flow.description,
-		schema: flow.schema
-	}
-	url.searchParams.append('flow', encodeState(openFlow))
-	return url
-}
-
-export function appToHubUrl(staticApp: any, hubBaseUrl: string): URL {
-	const url = new URL(hubBaseUrl + '/apps/add')
-	url.searchParams.append('app', encodeState(staticApp))
-	return url
-}
-
-export function rawAppToHubUrl(hubBaseUrl: string, summary?: string): URL {
-	const url = new URL(hubBaseUrl + '/raw_apps/add')
-	if (summary) {
-		url.searchParams.append('summary', summary)
-	}
-	return url
-}
-
 type HubPaths = {
 	gitSyncTest: string
 	gitInitRepo: string
diff --git a/frontend/src/routes/(root)/(logged)/scripts/get/[...hash]/+page.svelte b/frontend/src/routes/(root)/(logged)/scripts/get/[...hash]/+page.svelte
index e9a5419b7e..4c0992395b 100644
--- a/frontend/src/routes/(root)/(logged)/scripts/get/[...hash]/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/scripts/get/[...hash]/+page.svelte
@@ -24,7 +24,6 @@
 	import ShareModal from '$lib/components/ShareModal.svelte'
 	import {
 		enterpriseLicense,
-		hubBaseUrlStore,
 		userStore,
 		userWorkspaces,
 		workspaceStore
@@ -63,7 +62,6 @@
 		Eye,
 		FolderOpen,
 		GitFork,
-		Globe2,
 		History,
 		Loader2,
 		Pen,
@@ -76,8 +74,6 @@
 		ChevronDown,
 		ChevronRight
 	} from 'lucide-svelte'
-	import { SCRIPT_VIEW_SHOW_PUBLISH_TO_HUB } from '$lib/consts'
-	import { scriptToHubUrl } from '$lib/hub'
 	import SharedBadge from '$lib/components/SharedBadge.svelte'
 	import Popover from '$lib/components/Popover.svelte'
 	import ScriptVersionHistory from '$lib/components/ScriptVersionHistory.svelte'
@@ -550,30 +546,6 @@
 			})
 		}
 
-		if (SCRIPT_VIEW_SHOW_PUBLISH_TO_HUB) {
-			menuItems.push({
-				label: 'Publish to Hub',
-				Icon: Globe2,
-				onclick: () => {
-					if (!script) return
-
-					window.open(
-						scriptToHubUrl(
-							script.content,
-							script.summary,
-							script.description ?? '',
-							script.kind,
-							script.language,
-							script.schema,
-							script.lock ?? '',
-							$hubBaseUrlStore
-						).toString(),
-						'_blank'
-					)
-				}
-			})
-		}
-
 		if (showEditButtons) {
 			if (script.archived) {
 				menuItems.push({

From 85008e47b4a21313ec66496d3c68eb746fc8a151 Mon Sep 17 00:00:00 2001
From: Alexander Petric <alpetric@users.noreply.github.com>
Date: Fri, 24 Jul 2026 18:33:42 +0200
Subject: [PATCH 161/171] fix: pass Windows system env vars to R renv install
 subprocess (#10313)

Claude-Session: https://claude.ai/code/session_01WTZ5UBBLNh2rkgfNzUmCWs

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
---
 backend/windmill-worker/src/r_executor.rs | 15 +++++----------
 1 file changed, 5 insertions(+), 10 deletions(-)

diff --git a/backend/windmill-worker/src/r_executor.rs b/backend/windmill-worker/src/r_executor.rs
index 0d4219c0df..9b29ae35b6 100644
--- a/backend/windmill-worker/src/r_executor.rs
+++ b/backend/windmill-worker/src/r_executor.rs
@@ -30,7 +30,7 @@ use crate::{
         par_install_language_dependencies_seq, DependencyGraph, InstallDeps, RequiredDependency,
     },
     DISABLE_NUSER, NSJAIL_AVAILABLE, NSJAIL_PATH, PATH_ENV, PROXY_ENVS, R_CACHE_DIR,
-    TRACING_PROXY_CA_CERT_PATH,
+    TRACING_PROXY_CA_CERT_PATH, WIN_ENVS,
 };
 use windmill_common::scripts::ScriptLang;
 
@@ -518,6 +518,9 @@ async fn install<'a>(
             cmd.env_clear()
                 .current_dir(&job_dir)
                 .env("PATH", PATH_ENV.as_str())
+                // On Windows, renv needs SystemRoot (winsock init — without it DNS
+                // and sockets fail) and LOCALAPPDATA (its cache root) to install.
+                .envs(WIN_ENVS.to_vec())
                 .envs(R_PROXY_ENVS.clone());
             cmd
                 .args(&[
@@ -694,15 +697,7 @@ async fn run<'a>(
             .stdout(Stdio::piped())
             .stderr(Stdio::piped());
 
-        #[cfg(windows)]
-        {
-            cmd.env("SystemRoot", crate::SYSTEM_ROOT.as_str())
-                .env("USERPROFILE", crate::USERPROFILE_ENV.as_str())
-                .env(
-                    "TMP",
-                    std::env::var("TMP").unwrap_or_else(|_| String::from("/tmp")),
-                );
-        }
+        cmd.envs(WIN_ENVS.to_vec());
         start_child_process(cmd, rscript_executable, false).await?
     };
     handle_child::handle_child(

From 28a79ced155e6bb3540ab76feb5415ea8f3d8f8f Mon Sep 17 00:00:00 2001
From: Diego Imbert <70353967+diegoimbert@users.noreply.github.com>
Date: Fri, 24 Jul 2026 18:41:09 +0200
Subject: [PATCH 162/171] feat: add explore button for object storage resources
 (#10306)

* feat: add explore button for object storage resources in resource list

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015FhmfSxPuTck3yAhDpkfcA

* fix: make s3 drawer tooltip reflect explored resource

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015FhmfSxPuTck3yAhDpkfcA

* fix: honor workspace prop in global s3 explorer and add resource connection error state

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015FhmfSxPuTck3yAhDpkfcA

* fix: use picker's effective workspace in S3FilePreview requests

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015FhmfSxPuTck3yAhDpkfcA

* fix: pass acting workspace to explore button in ResourcePicker

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015FhmfSxPuTck3yAhDpkfcA

* chore: update ee-repo-ref to f78df23339e3136e8b6e9148a509508633448dd2

This commit updates the EE repository reference after PR #686 was merged in windmill-ee-private.

Previous ee-repo-ref: efb5e014fec34fc580b9dbb1b260494dd76c5462

New ee-repo-ref: f78df23339e3136e8b6e9148a509508633448dd2

Automated by sync-ee-ref workflow.

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
---
 backend/ee-repo-ref.txt                       |  2 +-
 backend/windmill-api/openapi.yaml             | 30 +++++++++++++
 backend/windmill-api/src/apps.rs              | 16 +++++--
 backend/windmill-api/src/job_helpers_oss.rs   |  7 +++-
 .../lib/components/ExploreAssetButton.svelte  | 42 ++++++++++++++++---
 .../src/lib/components/ResourcePicker.svelte  |  1 +
 .../src/lib/components/S3FilePicker.svelte    | 30 +++++++++----
 .../lib/components/S3FilePickerInner.svelte   | 34 +++++++++++----
 .../src/lib/components/S3FilePreview.svelte   | 36 +++++++++++-----
 frontend/src/lib/stores.ts                    |  9 ++++
 .../src/routes/(root)/(logged)/+layout.svelte | 15 ++++++-
 11 files changed, 184 insertions(+), 38 deletions(-)

diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index 90323f6205..b9f57e8175 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-22abd6d4e229f1206a13ebee8a6a9b808cd82a0d
+f78df23339e3136e8b6e9148a509508633448dd2
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index bc6d731756..5d89c8ae04 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -20889,6 +20889,11 @@ paths:
           in: query
           schema:
             type: string
+        - name: s3_resource_path
+          in: query
+          description: When set, test the connection of this object storage resource instead of the workspace storage
+          schema:
+            type: string
       responses:
         "200":
           description: Connection settings
@@ -20970,6 +20975,11 @@ paths:
           in: query
           schema:
             type: string
+        - name: s3_resource_path
+          in: query
+          description: When set, list the files of this object storage resource instead of the workspace storage
+          schema:
+            type: string
       responses:
         "200":
           description: List of file keys
@@ -21006,6 +21016,11 @@ paths:
           in: query
           schema:
             type: string
+        - name: s3_resource_path
+          in: query
+          description: When set, load the file metadata from this object storage resource instead of the workspace storage
+          schema:
+            type: string
       responses:
         "200":
           description: FileMetadata
@@ -21055,6 +21070,11 @@ paths:
           in: query
           schema:
             type: string
+        - name: s3_resource_path
+          in: query
+          description: When set, load the file preview from this object storage resource instead of the workspace storage
+          schema:
+            type: string
       responses:
         "200":
           description: FilePreview
@@ -21365,6 +21385,11 @@ paths:
           in: query
           schema:
             type: string
+        - name: s3_resource_path
+          in: query
+          description: When set, delete the file from this object storage resource instead of the workspace storage
+          schema:
+            type: string
       responses:
         "200":
           description: Confirmation
@@ -21394,6 +21419,11 @@ paths:
           in: query
           schema:
             type: string
+        - name: s3_resource_path
+          in: query
+          description: When set, move the file within this object storage resource instead of the workspace storage
+          schema:
+            type: string
       responses:
         "200":
           description: Confirmation
diff --git a/backend/windmill-api/src/apps.rs b/backend/windmill-api/src/apps.rs
index e8ac1340ca..4a6d5134d2 100644
--- a/backend/windmill-api/src/apps.rs
+++ b/backend/windmill-api/src/apps.rs
@@ -4191,15 +4191,19 @@ async fn app_load_file_metadata(
     OptAuthed(opt_authed): OptAuthed,
     Extension(db): Extension<DB>,
     Path((w_id, path)): Path<(String, StripPath)>,
-    Query(query): Query<LoadFileMetadataQuery>,
+    Query(mut query): Query<LoadFileMetadataQuery>,
     Query(sig): Query<AppS3Sig>,
 ) -> Result<Response> {
     let path = path.to_path();
     let file_query = app_s3_file_query(query.file_key.clone(), query.storage.clone(), sig);
     let job_authed =
         app_s3_on_behalf_and_provenance(&db, &path, &w_id, &opt_authed, &file_query).await?;
+    // On-behalf app reads are confined to the workspace storage; a
+    // viewer-supplied custom resource must not be honored.
+    query.s3_resource_path = None;
     let resp =
-        crate::job_helpers_oss::load_file_metadata_internal(job_authed, &db, &w_id, query).await?;
+        crate::job_helpers_oss::load_file_metadata_internal(job_authed, &db, None, &w_id, query)
+            .await?;
     Ok(Json(resp).into_response())
 }
 
@@ -4208,15 +4212,19 @@ async fn app_load_file_preview(
     OptAuthed(opt_authed): OptAuthed,
     Extension(db): Extension<DB>,
     Path((w_id, path)): Path<(String, StripPath)>,
-    Query(query): Query<LoadFilePreviewQuery>,
+    Query(mut query): Query<LoadFilePreviewQuery>,
     Query(sig): Query<AppS3Sig>,
 ) -> Result<Response> {
     let path = path.to_path();
     let file_query = app_s3_file_query(query.file_key.clone(), query.storage.clone(), sig);
     let job_authed =
         app_s3_on_behalf_and_provenance(&db, &path, &w_id, &opt_authed, &file_query).await?;
+    // On-behalf app reads are confined to the workspace storage; a
+    // viewer-supplied custom resource must not be honored.
+    query.s3_resource_path = None;
     let resp =
-        crate::job_helpers_oss::load_file_preview_internal(job_authed, &db, &w_id, query).await?;
+        crate::job_helpers_oss::load_file_preview_internal(job_authed, &db, None, &w_id, query)
+            .await?;
     Ok(Json(resp).into_response())
 }
 
diff --git a/backend/windmill-api/src/job_helpers_oss.rs b/backend/windmill-api/src/job_helpers_oss.rs
index 8a50f2e481..6cb7a4c769 100644
--- a/backend/windmill-api/src/job_helpers_oss.rs
+++ b/backend/windmill-api/src/job_helpers_oss.rs
@@ -200,7 +200,7 @@ pub async fn read_object_streamable(
 pub async fn delete_s3_file_internal(
     _authed: OptJobAuthed,
     _db: &DB,
-    _token: &str,
+    _user_db: Option<windmill_common::db::UserDB>,
     _w_id: &str,
     _query: DeleteS3FileQuery,
 ) -> error::Result<()> {
@@ -215,6 +215,7 @@ pub async fn delete_s3_file_internal(
 pub struct DeleteS3FileQuery {
     pub file_key: String,
     pub storage: Option<String>,
+    pub s3_resource_path: Option<String>,
 }
 
 // Stubs for the app-scoped S3 display ops (mirrors the EE `*_internal` helpers +
@@ -231,6 +232,7 @@ mod app_s3_display_stubs {
     pub struct LoadFileMetadataQuery {
         pub file_key: String,
         pub storage: Option<String>,
+        pub s3_resource_path: Option<String>,
     }
 
     #[derive(Serialize)]
@@ -242,6 +244,7 @@ mod app_s3_display_stubs {
     #[allow(dead_code)]
     pub struct LoadFilePreviewQuery {
         pub storage: Option<String>,
+        pub s3_resource_path: Option<String>,
         pub file_key: String,
         pub file_size_in_bytes: Option<u64>,
         pub file_mime_type: Option<String>,
@@ -281,6 +284,7 @@ mod app_s3_display_stubs {
     pub async fn load_file_metadata_internal(
         _authed: OptJobAuthed,
         _db: &DB,
+        _user_db: Option<UserDB>,
         _w_id: &str,
         _query: LoadFileMetadataQuery,
     ) -> error::Result<LoadFileMetadataResponse> {
@@ -292,6 +296,7 @@ mod app_s3_display_stubs {
     pub async fn load_file_preview_internal(
         _authed: OptJobAuthed,
         _db: &DB,
+        _user_db: Option<UserDB>,
         _w_id: &str,
         _query: LoadFilePreviewQuery,
     ) -> error::Result<LoadFilePreviewResponse> {
diff --git a/frontend/src/lib/components/ExploreAssetButton.svelte b/frontend/src/lib/components/ExploreAssetButton.svelte
index 45d378fd86..85ee7f0b98 100644
--- a/frontend/src/lib/components/ExploreAssetButton.svelte
+++ b/frontend/src/lib/components/ExploreAssetButton.svelte
@@ -1,4 +1,16 @@
 <script module lang="ts">
+	const OBJECT_STORAGE_RESOURCE_TYPES = [
+		's3',
+		'azure_blob',
+		's3_aws_oidc',
+		'azure_workload_identity',
+		'gcloud_storage'
+	]
+
+	export function isObjectStorageResourceType(resourceType: string | undefined): boolean {
+		return resourceType !== undefined && OBJECT_STORAGE_RESOURCE_TYPES.includes(resourceType)
+	}
+
 	export function assetCanBeExplored(
 		asset: Asset,
 		_resourceMetadata?: { resource_type?: string }
@@ -8,7 +20,9 @@
 			asset.kind === 'datatable' ||
 			asset.kind === 's3object' ||
 			asset.kind === 'volume' ||
-			(asset.kind === 'resource' && isDbType(_resourceMetadata?.resource_type))
+			(asset.kind === 'resource' &&
+				(isDbType(_resourceMetadata?.resource_type) ||
+					isObjectStorageResourceType(_resourceMetadata?.resource_type)))
 		)
 	}
 </script>
@@ -19,7 +33,12 @@
 	import { Button, ButtonType } from '$lib/components/common'
 	import S3FilePicker from '$lib/components/S3FilePicker.svelte'
 	import { VolumeService } from '$lib/gen'
-	import { globalDbManagerDrawer, userStore, workspaceStore } from '$lib/stores'
+	import {
+		globalDbManagerDrawer,
+		globalS3FilePickerExplorer,
+		userStore,
+		workspaceStore
+	} from '$lib/stores'
 	import { isS3Uri } from '$lib/utils'
 	import { Database, File, HardDriveIcon } from 'lucide-svelte'
 	import DucklakeIcon from './icons/DucklakeIcon.svelte'
@@ -52,6 +71,12 @@
 	let dbManagerDrawer = $derived(globalDbManagerDrawer.val)
 	let ws = $derived(workspace ?? $workspaceStore)
 	const assetUri = $derived(formatAsset(asset))
+	// Contexts with a select/upload flow pass their own picker; everything else
+	// (e.g. the resources list) falls back to the global read-only explorer.
+	let effectiveS3FilePicker = $derived(s3FilePicker ?? globalS3FilePickerExplorer.val)
+	let isStorageResource = $derived(
+		asset.kind === 'resource' && isObjectStorageResourceType(_resourceMetadata?.resource_type)
+	)
 </script>
 
 <Button
@@ -73,11 +98,16 @@
 				},
 				ws
 			)
+		} else if (isStorageResource) {
+			effectiveS3FilePicker?.open(undefined, { s3ResourcePath: asset.path, workspace: ws })
 		} else if (asset.kind === 's3object' && isS3Uri(assetUri)) {
-			s3FilePicker?.open(assetUri)
+			effectiveS3FilePicker?.open(assetUri, { workspace: ws })
 		} else if (asset.kind === 'volume') {
 			const storage = (await VolumeService.getVolumeStorage({ workspace: ws! })) ?? undefined
-			s3FilePicker?.open({ s3: `volumes/${ws}/${asset.path}/`, storage })
+			effectiveS3FilePicker?.open(
+				{ s3: `volumes/${ws}/${asset.path}/`, storage },
+				{ workspace: ws }
+			)
 		} else if (asset.kind === 'ducklake') {
 			let ducklake = asset.path.split('/')[0]
 			let specificTableSplit = asset.path.split('/')[1]?.split('.') as string[] | undefined
@@ -106,7 +136,7 @@
 		}
 		onClick?.()
 	}}
-	endIcon={asset.kind === 's3object'
+	endIcon={asset.kind === 's3object' || isStorageResource
 		? { icon: File }
 		: asset.kind === 'resource' || asset.kind === 'datatable'
 			? { icon: Database }
@@ -116,7 +146,7 @@
 					? { icon: HardDriveIcon }
 					: undefined}
 >
-	{#if asset.kind === 's3object' || asset.kind === 'volume'}
+	{#if asset.kind === 's3object' || asset.kind === 'volume' || isStorageResource}
 		<span class:hidden={noText}>Explore</span>
 	{:else if asset.kind === 'resource' || asset.kind === 'ducklake' || asset.kind === 'datatable'}
 		<span class:hidden={noText}>Manage</span>
diff --git a/frontend/src/lib/components/ResourcePicker.svelte b/frontend/src/lib/components/ResourcePicker.svelte
index e74e6f7285..60b15277e0 100644
--- a/frontend/src/lib/components/ResourcePicker.svelte
+++ b/frontend/src/lib/components/ResourcePicker.svelte
@@ -331,6 +331,7 @@
 			class="mt-1"
 			_resourceMetadata={{ resource_type: resourceType }}
 			asset={{ kind: 'resource', path: value }}
+			workspace={effectiveWorkspace}
 		/>
 	{/if}
 </div>
diff --git a/frontend/src/lib/components/S3FilePicker.svelte b/frontend/src/lib/components/S3FilePicker.svelte
index 8829660ea3..9f702a53c3 100644
--- a/frontend/src/lib/components/S3FilePicker.svelte
+++ b/frontend/src/lib/components/S3FilePicker.svelte
@@ -38,13 +38,17 @@
 		onSelectAndClose
 	}: Props = $props()
 
-	let ws = $derived(workspace ?? $workspaceStore)
-
 	let drawer: Drawer | undefined = $state()
 	let s3FilePickerInner: S3FilePickerInner | undefined = $state()
 
 	let workspaceSettingsInitialized = $state(true)
 	let storage: string | undefined = $state(undefined)
+	let s3ResourcePath: string | undefined = $state(undefined)
+	/** Per-open workspace override, for callers (e.g. the global explorer) whose
+	 * asset lives in a different workspace than this picker was mounted for. */
+	let workspaceOverride: string | undefined = $state(undefined)
+	let effectiveWorkspace = $derived(workspaceOverride ?? workspace)
+	let ws = $derived(effectiveWorkspace ?? $workspaceStore)
 	let uploadModalOpen = $state(false)
 
 	let allFilesByKey: Record<
@@ -66,8 +70,15 @@
 		{ lazy: true }
 	)
 
-	export async function open(_preSelectedFileKey: S3Object | undefined = undefined) {
-		secondaryStorageNames.refetch()
+	export async function open(
+		_preSelectedFileKey: S3Object | undefined = undefined,
+		opts: { s3ResourcePath?: string; workspace?: string } = {}
+	) {
+		s3ResourcePath = opts.s3ResourcePath
+		workspaceOverride = opts.workspace
+		if (!s3ResourcePath) {
+			secondaryStorageNames.refetch()
+		}
 		drawer?.openDrawer?.()
 
 		await tick()
@@ -86,12 +97,14 @@
 	size="1200px"
 >
 	<DrawerContent
-		title="S3 file browser"
+		title={s3ResourcePath ? `Exploring ${s3ResourcePath}` : 'S3 file browser'}
 		on:close={() => {
 			s3FilePickerInner?.exit?.()
 			drawer?.closeDrawer?.()
 		}}
-		tooltip="Files present in the Workspace S3 bucket. You can set the workspace S3 bucket in the settings."
+		tooltip={s3ResourcePath
+			? `Files present in the bucket of the ${s3ResourcePath} resource.`
+			: 'Files present in the Workspace S3 bucket. You can set the workspace S3 bucket in the settings.'}
 		documentationLink="https://www.windmill.dev/docs/integrations/s3"
 	>
 		<S3FilePickerInner
@@ -109,13 +122,14 @@
 			bind:storage
 			bind:allFilesByKey
 			bind:uploadModalOpen
+			{s3ResourcePath}
 			{folderOnly}
 			{regexFilter}
-			{workspace}
+			workspace={effectiveWorkspace}
 		/>
 		{#snippet actions()}
 			<div class="flex gap-1">
-				{#if secondaryStorageNames.current?.length}
+				{#if !s3ResourcePath && secondaryStorageNames.current?.length}
 					<Select
 						inputClass="h-10 min-w-44 !placeholder-secondary"
 						items={[
diff --git a/frontend/src/lib/components/S3FilePickerInner.svelte b/frontend/src/lib/components/S3FilePickerInner.svelte
index 9475c0041a..8c6ee879fa 100644
--- a/frontend/src/lib/components/S3FilePickerInner.svelte
+++ b/frontend/src/lib/components/S3FilePickerInner.svelte
@@ -69,6 +69,8 @@
 		workspace?: string | undefined
 		workspaceSettingsInitialized?: boolean
 		storage?: string | undefined
+		/** Browse this object storage resource directly instead of the workspace storage. */
+		s3ResourcePath?: string | undefined
 		uploadModalOpen?: boolean
 		allFilesByKey?: Record<
 			string,
@@ -108,6 +110,7 @@
 		workspace = undefined,
 		workspaceSettingsInitialized = $bindable(true),
 		storage = $bindable(undefined),
+		s3ResourcePath = undefined,
 		uploadModalOpen = $bindable(false),
 		allFilesByKey = $bindable({}),
 		allowDelete = false,
@@ -192,7 +195,8 @@
 			maxKeys: maxKeys, // fixed pages of 1000 files for now
 			marker: page == 0 ? undefined : listMarkers[page - 1],
 			prefix: rootPath ?? (filter.trim() != '' ? filter : undefined),
-			storage: storage
+			storage: storage,
+			s3ResourcePath
 		})
 		if (
 			availableFiles.restricted_access === null ||
@@ -287,7 +291,8 @@
 		let fileMetadataRaw = await loadFileMetadataRequest({
 			workspace: ws!,
 			fileKey: fileKey,
-			storage: storage
+			storage: storage,
+			s3ResourcePath
 		})
 
 		if (fileMetadataRaw !== undefined) {
@@ -313,7 +318,8 @@
 			csvHasHeader: csvHasHeader,
 			readBytesFrom: 0,
 			readBytesLength: 128 * 1024, // For now static limit of 128Kb per file,
-			storage: storage
+			storage: storage,
+			s3ResourcePath
 		})
 
 		let filePreviewContent = filePreviewRaw.content
@@ -356,7 +362,8 @@
 			await deleteS3FileRequest({
 				workspace: ws!,
 				fileKey: fileKey,
-				storage: storage
+				storage: storage,
+				s3ResourcePath
 			})
 		} finally {
 			fileDeletionInProgress = false
@@ -417,7 +424,8 @@
 				workspace: ws!,
 				srcFileKey: srcFileKey,
 				destFileKey: destFileKey!,
-				storage: storage
+				storage: storage,
+				s3ResourcePath
 			})
 		} finally {
 			fileMoveInProgress = false
@@ -463,7 +471,8 @@
 		try {
 			await testConnectionRequest({
 				workspace: ws!,
-				storage: storage
+				storage: storage,
+				s3ResourcePath
 			})
 			workspaceSettingsInitialized = true
 		} catch (e) {
@@ -554,6 +563,15 @@
 				<p class="text-clip grow min-w-0"> Double check the S3 resource fields and try again. </p>
 			</div>
 		</Alert>
+	{:else if s3ResourcePath}
+		<Alert type="error" title="Could not connect to the object storage of {s3ResourcePath}">
+			<div class="flex flex-row gap-x-1 w-full items-center">
+				<p class="text-clip grow min-w-0">
+					Double check the resource fields and that its object storage is reachable, then try again.
+				</p>
+				<Button variant="default" on:click={reloadContent} startIcon={{ icon: RotateCw }} />
+			</div>
+		</Alert>
 	{:else}
 		<Alert type="error" title="Workspace not connected to any S3 storage">
 			<div class="flex flex-row gap-x-1 w-full items-center">
@@ -721,7 +739,7 @@
 						{#if filePreview !== undefined && (!hideS3SpecificDetails || !readOnlyMode || allowDelete)}
 							<div class="flex gap-2 shrink-0">
 								{#if !hideS3SpecificDetails}
-									{@const downloadApiPath = `/w/${ws}/job_helpers/download_s3_file?file_key=${encodeURIComponent(fileMetadata?.fileKey ?? '')}${storage ? `&storage=${storage}` : ''}`}
+									{@const downloadApiPath = `/w/${ws}/job_helpers/download_s3_file?file_key=${encodeURIComponent(fileMetadata?.fileKey ?? '')}${storage ? `&storage=${storage}` : ''}${s3ResourcePath ? `&s3_resource_path=${encodeURIComponent(s3ResourcePath)}` : ''}`}
 									{@const downloadName =
 										fileMetadata?.fileKey.split('/').pop() ?? 'unnamed_download.file'}
 									{#if shouldDownloadViaClient()}
@@ -789,6 +807,8 @@
 			<S3FilePreview
 				fileKey={fileMetadata?.fileKey}
 				{storage}
+				{s3ResourcePath}
+				workspace={ws}
 				{loadFilePreviewRequest}
 				{loadFileMetadataRequest}
 				class="h-full"
diff --git a/frontend/src/lib/components/S3FilePreview.svelte b/frontend/src/lib/components/S3FilePreview.svelte
index cbad09f879..a9c168d68c 100644
--- a/frontend/src/lib/components/S3FilePreview.svelte
+++ b/frontend/src/lib/components/S3FilePreview.svelte
@@ -26,6 +26,12 @@
 		// Optional override of the storage backend (matches the picker's
 		// `storage` prop). Empty/undefined uses the workspace default.
 		storage?: string | undefined
+		// Browse this object storage resource directly instead of the
+		// workspace storage (matches the picker's `s3ResourcePath` prop).
+		s3ResourcePath?: string | undefined
+		// Workspace the previewed object lives in — the acting workspace of the
+		// surface that opened the preview; defaults to the nav workspace.
+		workspace?: string | undefined
 		// Override hooks for non-default backends (e.g. workspace settings
 		// preview before the storage is committed). Default to the standard
 		// helpers service — same defaults as S3FilePickerInner.
@@ -48,6 +54,8 @@
 	let {
 		fileKey,
 		storage = undefined,
+		s3ResourcePath = undefined,
+		workspace = undefined,
 		loadFilePreviewRequest = HelpersService.loadFilePreview,
 		loadFileMetadataRequest = HelpersService.loadFileMetadata,
 		showMetadata = false,
@@ -103,11 +111,13 @@
 	// existence after an upstream run completes — moving from the
 	// "not yet materialized" empty state to the actual preview without
 	// requiring the user to re-click the asset.
+	let ws = $derived(workspace ?? $workspaceStore)
+
 	$effect(() => {
 		const key = fileKey
-		const ws = $workspaceStore
+		const ws_ = ws
 		void refreshKey
-		if (!key || !ws) {
+		if (!key || !ws_) {
 			fileMetadata = undefined
 			filePreview = undefined
 			notFound = false
@@ -129,9 +139,10 @@
 		loadError = undefined
 		try {
 			const meta = await loadFileMetadataRequest({
-				workspace: $workspaceStore!,
+				workspace: ws!,
 				fileKey: key,
-				storage
+				storage,
+				s3ResourcePath
 			})
 			if (meta !== undefined) {
 				fileMetadata = {
@@ -158,7 +169,7 @@
 		filePreviewLoading = true
 		try {
 			const raw = await loadFilePreviewRequest({
-				workspace: $workspaceStore!,
+				workspace: ws!,
 				fileKey: key,
 				fileSizeInBytes: size,
 				fileMimeType: mimeType,
@@ -166,7 +177,8 @@
 				csvHasHeader: csvHasHeader,
 				readBytesFrom: 0,
 				readBytesLength: 128 * 1024,
-				storage
+				storage,
+				s3ResourcePath
 			})
 			let content = raw.content
 			if (content !== null && content !== undefined && content.length >= 128 * 1024) {
@@ -191,8 +203,12 @@
 	}
 
 	// `storage` is keyed by the workspace's S3 storage config name — used as
-	// a query-string suffix on the image/PDF preview URLs.
-	let storageQS = $derived(storage ? `&storage=${storage}` : '')
+	// a query-string suffix on the image/PDF preview URLs, together with the
+	// optional custom resource override.
+	let storageQS = $derived(
+		(storage ? `&storage=${storage}` : '') +
+			(s3ResourcePath ? `&s3_resource_path=${encodeURIComponent(s3ResourcePath)}` : '')
+	)
 
 	function onCsvControlsChanged() {
 		if (fileMetadata?.fileKey) {
@@ -245,7 +261,7 @@
 		{:else if fileMetadata?.fileKey.endsWith('.png') || fileMetadata?.fileKey.endsWith('.jpg') || fileMetadata?.fileKey.endsWith('.jpeg') || fileMetadata?.fileKey.endsWith('.webp')}
 			<div>
 				<ExpandableImage
-					src={`/api/w/${$workspaceStore}/job_helpers/load_image_preview?file_key=${encodeURIComponent(
+					src={`/api/w/${ws}/job_helpers/load_image_preview?file_key=${encodeURIComponent(
 						fileMetadata.fileKey
 					)}${storageQS}`}
 					alt="S3 preview"
@@ -258,7 +274,7 @@
 					<Loader2 class="animate-spin" />
 				{:then Module}
 					<Module.default
-						source={`/api/w/${$workspaceStore}/job_helpers/load_image_preview?file_key=${encodeURIComponent(
+						source={`/api/w/${ws}/job_helpers/load_image_preview?file_key=${encodeURIComponent(
 							fileMetadata.fileKey
 						)}${storageQS}`}
 					/>
diff --git a/frontend/src/lib/stores.ts b/frontend/src/lib/stores.ts
index 476afa8027..72526a3819 100644
--- a/frontend/src/lib/stores.ts
+++ b/frontend/src/lib/stores.ts
@@ -146,6 +146,15 @@ export const aiUserDisabled = writable<boolean>(
 export const usedTriggerKinds = writable<string[]>([])
 
 export let globalDbManagerDrawer: StateStore<DbManagerUriState | undefined> = { val: undefined }
+/** Read-only S3 file browser (S3FilePicker instance) mounted in the logged
+ * layout, used by Explore buttons in contexts that don't wire their own picker
+ * instance. Typed loosely because the component instance type resolves
+ * differently in .ts and .svelte contexts. */
+export let globalS3FilePickerExplorer: StateStore<
+	{ open: (fileKey?: any, opts?: { s3ResourcePath?: string }) => Promise<void> } | undefined
+> = createState({
+	val: undefined
+})
 export let globalForkModal: StateStore<GlobalForkModalState | undefined> = createState({
 	val: undefined
 })
diff --git a/frontend/src/routes/(root)/(logged)/+layout.svelte b/frontend/src/routes/(root)/(logged)/+layout.svelte
index adf7fb3314..323f6b9ed7 100644
--- a/frontend/src/routes/(root)/(logged)/+layout.svelte
+++ b/frontend/src/routes/(root)/(logged)/+layout.svelte
@@ -38,7 +38,8 @@
 		devopsRole,
 		whitelabelNameStore,
 		globalDbManagerDrawer,
-		globalForkModal
+		globalForkModal,
+		globalS3FilePickerExplorer
 	} from '$lib/stores'
 	import CenteredModal from '$lib/components/CenteredModal.svelte'
 	import { afterNavigate, beforeNavigate } from '$app/navigation'
@@ -83,6 +84,7 @@
 	import WorkspaceScopeHeader from '$lib/components/sidebar/WorkspaceScopeHeader.svelte'
 	import { DEFAULT_HUB_BASE_URL } from '$lib/hub'
 	import DBManagerDrawer from '$lib/components/DBManagerDrawer.svelte'
+	import S3FilePicker from '$lib/components/S3FilePicker.svelte'
 	import { useIsDarkMode } from '$lib/components/DarkModeObserver.svelte'
 	import { useDbManagerUriState } from '$lib/components/dbManagerDrawerModel.svelte'
 	import Modal2 from '$lib/components/common/modal/Modal2.svelte'
@@ -778,6 +780,13 @@
 	})
 
 	globalDbManagerDrawer.val = useDbManagerUriState()
+
+	let globalS3FilePicker: S3FilePicker | undefined = $state()
+	$effect(() => {
+		// `as any`: the component instance type is opaque in svelte2tsx context
+		// and does not match the store's structural type.
+		globalS3FilePickerExplorer.val = globalS3FilePicker as any
+	})
 </script>
 
 <svelte:window bind:innerWidth />
@@ -1327,6 +1336,10 @@
 	<DBManagerDrawer uriState={globalDbManagerDrawer.val} />
 {/if}
 
+{#if $workspaceStore}
+	<S3FilePicker bind:this={globalS3FilePicker} readOnlyMode allowDelete />
+{/if}
+
 <ForkConflictModal />
 
 <Modal2

From 2143d45815af7a95182721aeb0dc937a12c5759f Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 24 Jul 2026 18:47:50 +0200
Subject: [PATCH 163/171] fix: WAC wait_for_approval reads its own approval
 result, not the first (#10314)

In prepare_checkpoint_for_resume the resume_job lookup took the oldest row
for the job (ORDER BY created_at ASC LIMIT 1), so a WAC workflow with
multiple sequential wait_for_approval() calls always read the first
approval's result for every step. Consumed rows are never deleted, so the
2nd and 3rd approvals inherited the 1st's result (all showed approved:true
even if the 2nd was cancelled and the 3rd timed out).

Track the resume_job row ids consumed by earlier approval steps in the
checkpoint (consumed_resume_ids) and exclude them, so each step reads its
own row. This is channel-agnostic and needs no clock reasoning:
resume_job.resume_id is only hash(step_key) for the inline resume URL; the
approval page, the in-run approve button, Slack, Teams and resume-as-owner
all store a random resume_id, so filtering by resume_id would drop those
approvals and return approved:false even for a legitimate approval. A
timed-out step matches no row and still falls to the else branch returning
{approved: false}.

Adds a regression test driving three sequential approvals (approved,
cancelled, timed-out) against Postgres.

Fixes WIN-2241

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 backend/tests/wac_approval_resume.rs        | 83 +++++++++++++++++++++
 backend/windmill-common/src/wac.rs          |  7 ++
 backend/windmill-worker/src/wac_executor.rs | 23 +++++-
 3 files changed, 110 insertions(+), 3 deletions(-)
 create mode 100644 backend/tests/wac_approval_resume.rs

diff --git a/backend/tests/wac_approval_resume.rs b/backend/tests/wac_approval_resume.rs
new file mode 100644
index 0000000000..ea17b87ff9
--- /dev/null
+++ b/backend/tests/wac_approval_resume.rs
@@ -0,0 +1,83 @@
+//! WIN-2241: each sequential `wait_for_approval()` in a WAC workflow must
+//! resolve to its own approval, not the workflow's first. Guards approved,
+//! cancelled and timed-out steps sharing one parent job.
+
+use serde_json::{json, Value};
+use sqlx::{Pool, Postgres};
+use uuid::Uuid;
+use windmill_common::wac::{WacCheckpoint, WacPendingSteps};
+use windmill_worker::wac_executor::prepare_checkpoint_for_resume;
+
+async fn insert_resume_row(
+    db: &Pool<Postgres>,
+    job_id: Uuid,
+    resume_id: i32,
+    approver: &str,
+    approved: bool,
+    value: Value,
+) -> anyhow::Result<()> {
+    // resume_id is deliberately arbitrary (a stand-in for the random ids the
+    // interactive approval channels store) — the fix must not depend on it.
+    sqlx::query(
+        "INSERT INTO resume_job (id, job, flow, value, approver, resume_id, approved) \
+         VALUES ($1, $2, $2, $3, $4, $5, $6)",
+    )
+    .bind(Uuid::new_v4())
+    .bind(job_id)
+    .bind(value)
+    .bind(approver)
+    .bind(resume_id)
+    .bind(approved)
+    .execute(db)
+    .await?;
+    Ok(())
+}
+
+fn pending_approval(mut prior: WacCheckpoint, key: &str) -> WacCheckpoint {
+    prior.pending_steps = Some(WacPendingSteps {
+        mode: "approval".to_string(),
+        keys: vec![key.to_string()],
+        job_ids: Default::default(),
+    });
+    prior
+}
+
+#[sqlx::test]
+async fn wac_sequential_approvals_read_own_row(db: Pool<Postgres>) -> anyhow::Result<()> {
+    let job_id = Uuid::new_v4();
+    // FK target for resume_job.flow and v2_job_status.id (written by save_checkpoint).
+    sqlx::query(
+        "INSERT INTO v2_job_queue (id, workspace_id, scheduled_for) VALUES ($1, 'test-workspace', now())",
+    )
+    .bind(job_id)
+    .execute(&db)
+    .await?;
+
+    // Step A: approved.
+    insert_resume_row(&db, job_id, 1, "alice", true, json!({"n": 1})).await?;
+    let ckpt = pending_approval(WacCheckpoint::default(), "apprA");
+    let ckpt = prepare_checkpoint_for_resume(&db, &job_id, ckpt).await?;
+    assert_eq!(ckpt.completed_steps["apprA"]["approved"], json!(true));
+    assert_eq!(ckpt.completed_steps["apprA"]["approver"], json!("alice"));
+    assert_eq!(ckpt.completed_steps["apprA"]["value"], json!({"n": 1}));
+
+    // Step B: cancelled. Carrying `ckpt` forward preserves consumed_resume_row_ids,
+    // so B must resolve to its own row, not A's stale approved=true.
+    insert_resume_row(&db, job_id, 2, "bob", false, json!({"n": 2})).await?;
+    let ckpt = pending_approval(ckpt, "apprB");
+    let ckpt = prepare_checkpoint_for_resume(&db, &job_id, ckpt).await?;
+    assert_eq!(
+        ckpt.completed_steps["apprB"]["approved"],
+        json!(false),
+        "2nd approval must read its own (cancelled) row, not the 1st's"
+    );
+    assert_eq!(ckpt.completed_steps["apprB"]["approver"], json!("bob"));
+
+    // Step C: timed out — no resume_job row. Falls to the approved=false default.
+    let ckpt = pending_approval(ckpt, "apprC");
+    let ckpt = prepare_checkpoint_for_resume(&db, &job_id, ckpt).await?;
+    assert_eq!(ckpt.completed_steps["apprC"]["approved"], json!(false));
+    assert_eq!(ckpt.completed_steps["apprC"]["approver"], json!(null));
+
+    Ok(())
+}
diff --git a/backend/windmill-common/src/wac.rs b/backend/windmill-common/src/wac.rs
index 7f12dfbcdb..df076b3070 100644
--- a/backend/windmill-common/src/wac.rs
+++ b/backend/windmill-common/src/wac.rs
@@ -34,6 +34,13 @@ pub struct WacCheckpoint {
     #[serde(skip_serializing_if = "Option::is_none")]
     #[serde(default)]
     pub _executing_key: Option<String>,
+    /// `resume_job.id` values already consumed by earlier approval steps (the
+    /// row primary key, not the distinct integer `resume_id` column). Rows are
+    /// never deleted, so a workflow with several sequential wait_for_approval()
+    /// calls accumulates one per approval; excluding these lets each step read
+    /// its own row rather than the oldest.
+    #[serde(default)]
+    pub consumed_resume_row_ids: Vec<Uuid>,
 }
 
 #[derive(Debug, Serialize, Deserialize, Clone)]
diff --git a/backend/windmill-worker/src/wac_executor.rs b/backend/windmill-worker/src/wac_executor.rs
index 2fcfc8e2c5..f016427346 100644
--- a/backend/windmill-worker/src/wac_executor.rs
+++ b/backend/windmill-worker/src/wac_executor.rs
@@ -143,14 +143,31 @@ pub async fn prepare_checkpoint_for_resume(
                 .and_then(|p| p.keys.first().cloned())
                 .unwrap_or_default();
 
-            let resume_row = sqlx::query_as::<_, (sqlx::types::Json<Box<serde_json::value::RawValue>>, Option<String>, bool)>(
-                "SELECT value, approver, approved FROM resume_job WHERE job = $1 ORDER BY created_at ASC LIMIT 1",
+            // Exclude rows already consumed by earlier approvals so each step
+            // reads its own (rows are never deleted). resume_id can't key this:
+            // it's only hash(step_key) for the inline URL, while the approval
+            // page, in-run button, Slack, Teams and resume-as-owner store a
+            // random id. A timed-out step matches no row -> else branch below.
+            let consumed = checkpoint.consumed_resume_row_ids.clone();
+            let resume_row = sqlx::query_as::<
+                _,
+                (
+                    Uuid,
+                    sqlx::types::Json<Box<serde_json::value::RawValue>>,
+                    Option<String>,
+                    bool,
+                ),
+            >(
+                "SELECT id, value, approver, approved FROM resume_job \
+                 WHERE job = $1 AND id <> ALL($2) ORDER BY created_at ASC LIMIT 1",
             )
             .bind(job_id)
+            .bind(&consumed)
             .fetch_optional(db)
             .await?;
 
-            let approval_result = if let Some((value, approver, approved)) = resume_row {
+            let approval_result = if let Some((row_id, value, approver, approved)) = resume_row {
+                checkpoint.consumed_resume_row_ids.push(row_id);
                 serde_json::json!({
                     "value": serde_json::from_str::<Value>(value.get()).unwrap_or(Value::Null),
                     "approver": approver.unwrap_or_else(|| "anonymous".to_string()),

From 03e727777c686ba74483fb9e2cd201eefa0c554b Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 24 Jul 2026 18:55:34 +0200
Subject: [PATCH 164/171] chore: auto-allow rm in /tmp and git repos, plus
 read-only gmail (#10307)

* chore: allow /tmp rm and read-only gmail in local permission rules

* fix: gate rm outside /tmp via PreToolUse hook and gate gmail drafts

* fix: reject shell expansion and multi-line commands in rm guard

* fix: make rm guard allow-only with Bash(rm:*) ask as safety net

* fix: reject quotes and backslashes in rm guard to block obscured traversal

* fix: switch rm guard to deny-by-default whitelist of safe /tmp operands

* fix: treat lone dash as rm operand, not an option flag

* fix: defer option tokens containing glob chars in rm guard

* feat: also auto-allow rm strictly inside git working trees under $HOME

* feat: auto-allow deleting linked worktree root folders, still guard primary checkouts

* fix: restrict globs to /tmp and validate post-operand option tokens in rm guard

* docs: correct rm guard rationale to not overclaim git recoverability
---
 .claude/hooks/guard-rm-outside-tmp.sh | 106 ++++++++++++++++++++++++++
 .claude/settings.json                 |  25 ++++--
 2 files changed, 126 insertions(+), 5 deletions(-)
 create mode 100755 .claude/hooks/guard-rm-outside-tmp.sh

diff --git a/.claude/hooks/guard-rm-outside-tmp.sh b/.claude/hooks/guard-rm-outside-tmp.sh
new file mode 100755
index 0000000000..66d4dd27b5
--- /dev/null
+++ b/.claude/hooks/guard-rm-outside-tmp.sh
@@ -0,0 +1,106 @@
+#!/usr/bin/env bash
+# PreToolUse guard for `rm`: auto-allow ONLY a single, plain, single-line `rm` whose every
+# operand is a whitelisted target — under /tmp, or inside a git working tree located in $HOME
+# (a version-controlled project dir). Anything else makes no decision (exit 0) and falls back
+# to the normal permission flow, where the `Bash(rm:*)` ask rule prompts (classifier as a
+# backstop).
+#
+# The git-tree allowance trades on "this is a project under version control" being lower-stakes
+# than a delete elsewhere — NOT on full recoverability: committed content is restorable via git,
+# but untracked / .gitignore'd / uncommitted content, and an independent nested repo's history
+# under a recursively-deleted parent, are NOT. Accepted as a deliberate convenience tradeoff.
+#
+# Deny-by-default: every token must consist only of a safe character set (alphanumerics,
+# `. _ / -` and glob chars `* ? [ ]`). That set contains none of the characters bash uses for
+# quoting, expansion, or command separation ($ ` ~ { } ( ) ' " \ ; & | < >), so those forms
+# fail by construction rather than needing to be enumerated. `realpath -m` then resolves `..`
+# and existing symlinks (so a symlink out of the allowed roots is caught), and a wildcard in a
+# non-final path segment is refused because it can expand through a symlink realpath can't see.
+#
+# The git-repo allowance covers targets inside a git working tree under $HOME, and the tree's
+# own root folder only when it is a linked worktree (`.git` is a pointer file, so history in
+# the main repo survives); a primary checkout's root (`.git` is a history dir) and any `.git`
+# path are never auto-allowed. Globs auto-allow only under /tmp — elsewhere their expansion
+# could reach `.git` or a dotfile the literal checks never see. Relative operands resolve
+# against the command's cwd (from the hook input). A PreToolUse `allow` overrides the ask rule.
+#
+# Assumes GNU `realpath` (-m) and `jq`, both present in this repo's Linux dev env.
+set -uo pipefail
+
+input=$(cat)
+command -v jq >/dev/null 2>&1 || exit 0
+cmd=$(printf '%s' "$input" | jq -r '.tool_input.command // empty' 2>/dev/null)
+[ -z "$cmd" ] && exit 0
+cwd=$(printf '%s' "$input" | jq -r '.cwd // empty' 2>/dev/null)
+
+# A newline separates commands, and the tokenizer below only reads the first line — defer.
+case "$cmd" in *$'\n'*) exit 0 ;; esac
+
+read -r -a toks <<< "$cmd"
+# Bare leading `rm` only; wrappers (`timeout rm`), env prefixes, and `/bin/rm` defer.
+[ "${toks[0]:-}" = "rm" ] || exit 0
+
+# 0 (allow) iff the canonical path is an auto-allowable rm target: under /tmp, or strictly
+# inside a git working tree located under $HOME. The walk stops at $HOME, so a dotfiles repo at
+# ~ can't make all of $HOME deletable, and top-level ~ files stay protected.
+allowed_target() {
+  local canon="$1" d root=""
+  case "$canon" in /tmp/?*) return 0 ;; esac
+  [ -n "${HOME:-}" ] || return 1
+  case "$canon" in "$HOME"/?*) ;; *) return 1 ;; esac
+  case "$canon" in *"/.git" | *"/.git/"*) return 1 ;; esac   # protect history, not recoverable
+  d="$canon"
+  while [ "$d" != "/" ] && [ "$d" != "$HOME" ]; do
+    [ -e "$d/.git" ] && { root="$d"; break; }
+    d=$(dirname "$d")
+  done
+  [ -n "$root" ] || return 1              # not inside a git working tree under $HOME
+  if [ "$canon" = "$root" ]; then
+    # Deleting the repo root folder itself: allow only for a linked worktree, whose `.git` is
+    # a file/pointer so the history lives in the main repo and survives. A primary checkout's
+    # `.git` is a directory holding the history, so deleting it is unrecoverable — defer.
+    [ -f "$root/.git" ] && return 0
+    return 1
+  fi
+  return 0
+}
+
+had_operand=0
+end_opts=0
+i=1
+while [ "$i" -lt "${#toks[@]}" ]; do
+  t="${toks[$i]}"
+  i=$((i + 1))
+  # Whitelist every token (flags included, so an operator hidden in a flag like `-rf;rm`
+  # can't slip past): any character outside the safe set makes it unsafe to reason about.
+  [ -n "$(printf '%s' "$t" | tr -d 'A-Za-z0-9._/*?[]-')" ] && exit 0
+  # A glob in an option-looking token (`-[-]`) can expand to `--` and turn a later `-name`
+  # into an operand — never a real option, so defer.
+  case "$t" in -*[*?[]*) exit 0 ;; esac
+  if [ "$end_opts" = 0 ]; then
+    [ "$t" = "--" ] && { end_opts=1; continue; }
+    # Skip real options only before the first operand. A bare `-` is a filename, and under
+    # POSIXLY_CORRECT GNU rm stops option parsing at the first operand, so a later `-name`
+    # is a filename too — validate it rather than skipping it.
+    if [ "$had_operand" = 0 ]; then
+      case "$t" in -?*) continue ;; esac
+    fi
+  fi
+  had_operand=1
+  # No wildcard in a non-final path segment (`a/*/b`): it can expand through a symlink
+  # realpath can't see. A slashless glob (`*.rs`) is a final-segment match — fine.
+  case "$t" in */*) case "${t%/*}" in *[*?[]*) exit 0 ;; esac ;; esac
+  case "$t" in
+    /*) canon=$(realpath -m -- "$t" 2>/dev/null) ;;
+    *)  canon=$(realpath -m -- "${cwd:-$PWD}/$t" 2>/dev/null) ;;
+  esac
+  [ -n "$canon" ] || exit 0
+  # A glob may auto-allow only under /tmp, where everything is deletable. Elsewhere its
+  # expansion could match `.git`, a dotfile like `.*`, or a nested checkout root that the
+  # literal-path checks never see — so require literal operands in git repos.
+  case "$t" in *[*?[]*) case "$canon" in /tmp/?*) ;; *) exit 0 ;; esac ;; esac
+  allowed_target "$canon" || exit 0
+done
+
+[ "$had_operand" = 1 ] || exit 0
+jq -nc '{hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"allow",permissionDecisionReason:"rm operands are under /tmp or inside a git checkout in $HOME"}}'
diff --git a/.claude/settings.json b/.claude/settings.json
index ca8d9a898d..eeb3683842 100644
--- a/.claude/settings.json
+++ b/.claude/settings.json
@@ -48,9 +48,6 @@
       "Read(/tmp/**)",
       "Write(/tmp/**)",
       "Edit(/tmp/**)",
-      "Bash(rm:/tmp/*)",
-      "Bash(rm:/tmp/**)",
-      "Bash(rmdir:/tmp/*)",
       "Bash(mkdir:/tmp/*)",
       "Bash(mkdir:/tmp/**)",
       "Bash(cp:/tmp/*)",
@@ -62,7 +59,12 @@
       "Bash(chmod:/tmp/*)",
       "Bash(chmod:/tmp/**)",
       "Bash(tar * /tmp/*)",
-      "Bash(unzip * /tmp/*)"
+      "Bash(unzip * /tmp/*)",
+      "mcp__claude_ai_Gmail__search_threads",
+      "mcp__claude_ai_Gmail__get_thread",
+      "mcp__claude_ai_Gmail__get_message",
+      "mcp__claude_ai_Gmail__list_labels",
+      "mcp__claude_ai_Gmail__list_drafts"
     ],
     "deny": [
       "Read(.env)",
@@ -92,7 +94,15 @@
       "Bash(shred:*)",
       "Bash(unlink:*)",
       "mcp__claude_ai_Stripe",
-      "mcp__claude_ai_Gmail",
+      "mcp__claude_ai_Gmail__create_draft",
+      "mcp__claude_ai_Gmail__update_draft",
+      "mcp__claude_ai_Gmail__create_label",
+      "mcp__claude_ai_Gmail__label_message",
+      "mcp__claude_ai_Gmail__label_thread",
+      "mcp__claude_ai_Gmail__unlabel_message",
+      "mcp__claude_ai_Gmail__unlabel_thread",
+      "mcp__claude_ai_Gmail__apply_sensitive_message_label",
+      "mcp__claude_ai_Gmail__apply_sensitive_thread_label",
       "mcp__claude_ai_Google_Calendar",
       "mcp__claude_ai_Google_Drive",
       "mcp__claude_ai_Slack",
@@ -109,6 +119,11 @@
             "type": "command",
             "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/guard-main-branch.sh",
             "timeout": 5
+          },
+          {
+            "type": "command",
+            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/guard-rm-outside-tmp.sh",
+            "timeout": 5
           }
         ]
       }

From 113f41bab558764fd8b49bd645d6e08ac884d5c4 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 24 Jul 2026 19:14:23 +0200
Subject: [PATCH 165/171] chore(main): release 1.770.0 (#10309)

* chore(main): release 1.770.0

* Apply automatic changes

---------

Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>
---
 CHANGELOG.md                                  |  16 ++
 backend/Cargo.lock                            | 158 +++++++++---------
 backend/Cargo.toml                            |   4 +-
 .../parsers/windmill-parser-wasm/Cargo.lock   |  48 +++---
 .../parsers/windmill-parser-wasm/Cargo.toml   |   2 +-
 backend/windmill-api/openapi.yaml             |   2 +-
 benchmarks/lib.ts                             |   2 +-
 cli/src/core/constants.ts                     |   2 +-
 frontend/package-lock.json                    |   4 +-
 frontend/package.json                         |   2 +-
 lsp/Pipfile                                   |   2 +-
 openflow.openapi.yaml                         |   2 +-
 .../WindmillClient/WindmillClient.psd1        |   2 +-
 python-client/wmill/pyproject.toml            |   2 +-
 typescript-client/jsr.json                    |   2 +-
 typescript-client/package.json                |   2 +-
 version.txt                                   |   2 +-
 17 files changed, 135 insertions(+), 119 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e800f74201..7fb6624a0b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,21 @@
 # Changelog
 
+## [1.770.0](https://github.com/windmill-labs/windmill/compare/v1.769.0...v1.770.0) (2026-07-24)
+
+
+### Features
+
+* add explore button for object storage resources ([#10306](https://github.com/windmill-labs/windmill/issues/10306)) ([28a79ce](https://github.com/windmill-labs/windmill/commit/28a79ced155e6bb3540ab76feb5415ea8f3d8f8f))
+* Add image when publishing a project ([#10310](https://github.com/windmill-labs/windmill/issues/10310)) ([48618cf](https://github.com/windmill-labs/windmill/commit/48618cff8c35a345babd12844653f83addbcd7e8))
+
+
+### Bug Fixes
+
+* do not apply workspace display name on git-sync pull ([#10308](https://github.com/windmill-labs/windmill/issues/10308)) ([992ed01](https://github.com/windmill-labs/windmill/commit/992ed0124492f5c6b9e3dcc6a309caeda8d6a7b1))
+* pass Windows system env vars to R renv install subprocess ([#10313](https://github.com/windmill-labs/windmill/issues/10313)) ([85008e4](https://github.com/windmill-labs/windmill/commit/85008e47b4a21313ec66496d3c68eb746fc8a151))
+* show scheduled singlestepflow runs in flow history sidebar ([#10312](https://github.com/windmill-labs/windmill/issues/10312)) ([f00fcb2](https://github.com/windmill-labs/windmill/commit/f00fcb2d1b1030b47c824bdefc9f0d12499bc6b6))
+* WAC wait_for_approval reads its own approval result, not the first ([#10314](https://github.com/windmill-labs/windmill/issues/10314)) ([2143d45](https://github.com/windmill-labs/windmill/commit/2143d45815af7a95182721aeb0dc937a12c5759f))
+
 ## [1.769.0](https://github.com/windmill-labs/windmill/compare/v1.768.0...v1.769.0) (2026-07-24)
 
 
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index dd15d30d97..05435680b0 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -14479,7 +14479,7 @@ dependencies = [
 
 [[package]]
 name = "windmill"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -14564,7 +14564,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-ai"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "async-stream",
  "async-trait",
@@ -14597,7 +14597,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-alerting"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14610,7 +14610,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "argon2",
@@ -14749,7 +14749,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-agent-workers"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14772,7 +14772,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-assets"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14787,7 +14787,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-auth"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14813,7 +14813,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "reqwest 0.12.28",
  "serde",
@@ -14823,7 +14823,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-configs"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14840,7 +14840,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-debug"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "axum 0.8.9",
  "base64 0.22.1",
@@ -14862,7 +14862,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-embeddings"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14885,7 +14885,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flow-conversations"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14901,7 +14901,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flows"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14922,7 +14922,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-groups"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14943,7 +14943,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-inputs"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14957,7 +14957,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-integration-tests"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -14992,7 +14992,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-jobs"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15017,7 +15017,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-npm-proxy"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "axum 0.8.9",
  "flate2",
@@ -15035,7 +15035,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-openapi"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15057,7 +15057,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-schedule"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15077,7 +15077,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-scripts"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15114,7 +15114,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-settings"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15142,7 +15142,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-sse"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "lazy_static",
  "serde",
@@ -15154,7 +15154,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-users"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "argon2",
  "axum 0.8.9",
@@ -15179,7 +15179,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workers"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15193,7 +15193,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workspaces"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15228,7 +15228,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -15242,7 +15242,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15261,7 +15261,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "aes-gcm",
  "aho-corasick",
@@ -15365,7 +15365,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-dep-map"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "chrono",
  "itertools 0.14.0",
@@ -15384,7 +15384,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "regex",
  "serde",
@@ -15399,7 +15399,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "astral-tokio-tar",
@@ -15423,7 +15423,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-jseval"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -15440,7 +15440,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -15456,7 +15456,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-mcp"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15477,7 +15477,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-native-triggers"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15508,7 +15508,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-oauth"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "arc-swap",
@@ -15533,7 +15533,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-object-store"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "async-stream",
@@ -15567,7 +15567,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-operator"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -15585,7 +15585,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -15594,7 +15594,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15606,7 +15606,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15618,7 +15618,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -15630,7 +15630,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15642,7 +15642,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15654,7 +15654,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -15665,7 +15665,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15676,7 +15676,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15688,7 +15688,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -15699,7 +15699,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15721,7 +15721,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15733,7 +15733,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15747,7 +15747,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -15764,7 +15764,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15777,7 +15777,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -15789,7 +15789,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15807,7 +15807,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -15823,7 +15823,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -15839,7 +15839,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -15850,7 +15850,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15889,7 +15889,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-runtime-nativets"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "const_format",
@@ -15929,7 +15929,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "getrandom 0.3.4",
  "wasm-bindgen",
@@ -15940,7 +15940,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-store"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15974,7 +15974,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-test-utils"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15998,7 +15998,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16031,7 +16031,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-amqp"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16058,7 +16058,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-azure"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16091,7 +16091,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-email"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16111,7 +16111,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-gcp"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16145,7 +16145,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-http"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16181,7 +16181,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-kafka"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16204,7 +16204,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-mqtt"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16228,7 +16228,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-nats"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -16252,7 +16252,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-postgres"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16287,7 +16287,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-sqs"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16315,7 +16315,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-websocket"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16340,7 +16340,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "bitflags 2.13.1",
@@ -16359,7 +16359,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "async-once-cell",
@@ -16474,7 +16474,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker-volumes"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "bytes",
  "futures",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index df718e84e1..49056c8b0f 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.769.0"
+version = "1.770.0"
 authors.workspace = true
 edition.workspace = true
 
@@ -88,7 +88,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal", "./parsers/windmill-parser-wasm"]
 
 [workspace.package]
-version = "1.769.0"
+version = "1.770.0"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.lock b/backend/parsers/windmill-parser-wasm/Cargo.lock
index 14c380ff9b..8a0052d2c7 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.lock
+++ b/backend/parsers/windmill-parser-wasm/Cargo.lock
@@ -6191,7 +6191,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill-common"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "aho-corasick",
  "anyhow",
@@ -6272,7 +6272,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -6284,7 +6284,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "convert_case",
  "serde",
@@ -6293,7 +6293,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6305,7 +6305,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6317,7 +6317,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -6329,7 +6329,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6341,7 +6341,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6353,7 +6353,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -6364,7 +6364,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6375,7 +6375,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6387,7 +6387,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6398,7 +6398,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -6420,7 +6420,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6432,7 +6432,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6446,7 +6446,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "convert_case",
@@ -6463,7 +6463,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6476,7 +6476,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -6488,7 +6488,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6506,7 +6506,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -6522,7 +6522,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6538,7 +6538,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wasm"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "getrandom 0.2.17",
@@ -6570,7 +6570,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -6581,7 +6581,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.769.0"
+version = "1.770.0"
 dependencies = [
  "anyhow",
  "bitflags",
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.toml b/backend/parsers/windmill-parser-wasm/Cargo.toml
index e0e2e22cdb..7c866fbd30 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.toml
+++ b/backend/parsers/windmill-parser-wasm/Cargo.toml
@@ -12,7 +12,7 @@ resolver = "2"
 members = ["."]
 
 [workspace.package]
-version = "1.769.0"
+version = "1.770.0"
 edition = "2021"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 5d89c8ae04..0b493da2f4 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.769.0
+  version: 1.770.0
   title: Windmill API
 
   contact:
diff --git a/benchmarks/lib.ts b/benchmarks/lib.ts
index f71ef92a15..debc81ac94 100644
--- a/benchmarks/lib.ts
+++ b/benchmarks/lib.ts
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.769.0";
+export const VERSION = "v1.770.0";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({
diff --git a/cli/src/core/constants.ts b/cli/src/core/constants.ts
index fa0b9346d5..eb25ef24ea 100644
--- a/cli/src/core/constants.ts
+++ b/cli/src/core/constants.ts
@@ -10,4 +10,4 @@ export const WM_FORK_PREFIX = "wm-fork";
 // (e.g. utils.ts) can read it without importing main.ts and creating a circular
 // dependency (main → workspace → utils → main) that triggers a TDZ.
 // Re-exported from main.ts for backwards compatibility.
-export const VERSION = "1.769.0";
+export const VERSION = "1.770.0";
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index a97ff8cb23..5f0ff36020 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.769.0",
+	"version": "1.770.0",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "@windmill-labs/components",
-			"version": "1.769.0",
+			"version": "1.770.0",
 			"hasInstallScript": true,
 			"license": "AGPL-3.0",
 			"dependencies": {
diff --git a/frontend/package.json b/frontend/package.json
index b70dbf980b..37b3aff639 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.769.0",
+	"version": "1.770.0",
 	"scripts": {
 		"dev": "vite dev",
 		"dev:ui-builder": "mv static/ui_builder static/ui_builder.dev-disabled 2>/dev/null || true ; trap 'mv static/ui_builder.dev-disabled static/ui_builder 2>/dev/null || true' EXIT ; vite dev",
diff --git a/lsp/Pipfile b/lsp/Pipfile
index 2c9459087d..30119c0328 100644
--- a/lsp/Pipfile
+++ b/lsp/Pipfile
@@ -4,7 +4,7 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-wmill = ">=1.769.0"
+wmill = ">=1.770.0"
 sendgrid = "*"
 mysql-connector-python = "*"
 pymongo = "*"
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index 43cc0a5866..4344fc4d1e 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1,7 +1,7 @@
 openapi: '3.0.3'
 
 info:
-  version: 1.769.0
+  version: 1.770.0
   title: OpenFlow Spec
   contact:
     name: Ruben Fiszel
diff --git a/powershell-client/WindmillClient/WindmillClient.psd1 b/powershell-client/WindmillClient/WindmillClient.psd1
index cdc502b04f..1f103d3671 100644
--- a/powershell-client/WindmillClient/WindmillClient.psd1
+++ b/powershell-client/WindmillClient/WindmillClient.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'WindmillClient.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '1.769.0'
+    ModuleVersion     = '1.770.0'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()
diff --git a/python-client/wmill/pyproject.toml b/python-client/wmill/pyproject.toml
index f44b602c3c..e146031b92 100644
--- a/python-client/wmill/pyproject.toml
+++ b/python-client/wmill/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill"
-version = "1.769.0"
+version = "1.770.0"
 description = "A client library for accessing Windmill server wrapping the Windmill client API"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/typescript-client/jsr.json b/typescript-client/jsr.json
index b600205868..eeefd19a4c 100644
--- a/typescript-client/jsr.json
+++ b/typescript-client/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@windmill/windmill",
-  "version": "1.769.0",
+  "version": "1.770.0",
   "exports": "./src/index.ts",
   "publish": {
     "exclude": ["!src", "./s3Types.ts", "./sqlUtils.ts", "./client.ts"]
diff --git a/typescript-client/package.json b/typescript-client/package.json
index 40b609e7f5..968f4ed8e3 100644
--- a/typescript-client/package.json
+++ b/typescript-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.769.0",
+  "version": "1.770.0",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "homepage": "https://github.com/windmill-labs/windmill/tree/main/typescript-client#readme",
diff --git a/version.txt b/version.txt
index 475443dad3..dc6e88537c 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.769.0
+1.770.0

From 1973bc806bbd127f3d24512e0168300a058c45f4 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 24 Jul 2026 23:05:31 +0200
Subject: [PATCH 166/171] migrate to opus 5

---
 .github/workflows/claude-plan.yml     | 2 +-
 .github/workflows/claude.yml          | 2 +-
 .github/workflows/pr-ready-review.yml | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/claude-plan.yml b/.github/workflows/claude-plan.yml
index ef25554f83..bc81801417 100644
--- a/.github/workflows/claude-plan.yml
+++ b/.github/workflows/claude-plan.yml
@@ -49,7 +49,7 @@ jobs:
           allowed_bots: 'windmill-internal-app[bot]'
           trigger_phrase: '/plan'
           claude_args: |
-            --model claude-opus-4-8
+            --model claude-opus-5
             --system-prompt "# Claude Planning Mode
 
             You are operating in PLANNING MODE ONLY. Your role is to create detailed, structured plans without making any code changes.
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index 115115dac6..5e9aab00d3 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -93,4 +93,4 @@ jobs:
             }
           claude_args: |
             --allowedTools "Bash,WebFetch,WebSearch"
-            --model claude-opus-4-8
+            --model claude-opus-5
diff --git a/.github/workflows/pr-ready-review.yml b/.github/workflows/pr-ready-review.yml
index c41ccafa9a..d2acde0dbe 100644
--- a/.github/workflows/pr-ready-review.yml
+++ b/.github/workflows/pr-ready-review.yml
@@ -199,4 +199,4 @@ jobs:
             ${{ env.REVIEW_PROMPT }}
           claude_args: |
             --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"
-            --model claude-opus-4-8
+            --model claude-opus-5

From 71b7135cf2457034949540a6c1568424ce9ba8b5 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 24 Jul 2026 23:16:10 +0200
Subject: [PATCH 167/171] feat: multiple homepage sort orders via an efficient
 merged runnables endpoint (#10297)

Adds recently-updated / oldest / name A-Z / name Z-A sort orders to the homepage (WIN-2236), produced server-side by a new merged, index-backed, keyset-paginated GET /w/{workspace}/runnables/list so a chosen order is globally correct across scripts + flows + apps and stays efficient on large workspaces.

- Backend: UNION ALL of script/flow/app ordered by index (Merge Append + LIMIT); keyset (sort_key, path, kind, tiebreak) cursor; per-branch LIMIT bounds correlated projections; starred-first pinning; RLS + scope-token filters in SQL. Archived view returns the latest row per path. Migration adds time + lowered-name indexes (built CONCURRENTLY).
- Frontend: server-side sort/kind/owner filters + hybrid search (instant client + on-demand server pagination); file-explorer tree with every folder and your user namespace as lazy-loaded top-level nodes (per-owner "Load more", nested subfolders, bounded "expand all", in-place re-sort without collapse or flicker); the client sorts by the server fetch ordinal to reproduce the endpoint's exact order; empty state distinguishes an empty workspace from too-narrow filters.

Reviewed clean by Claude and Pi (good to merge) and Codex (mergeable).
---
 ...0724094737_runnables_sort_indexes.down.sql |   5 +
 ...260724094737_runnables_sort_indexes.up.sql |  26 +
 backend/tests/runnables_list_pagination.rs    | 417 +++++++++
 backend/windmill-api-groups/src/folders.rs    |  54 +-
 backend/windmill-api/openapi.yaml             | 149 ++++
 backend/windmill-api/src/db.rs                |   3 +
 backend/windmill-api/src/lib.rs               |   2 +
 backend/windmill-api/src/runnables.rs         | 541 ++++++++++++
 backend/windmill-api/src/utils.rs             |   3 +-
 .../src/lib/components/home/ItemsList.svelte  | 833 +++++++++++++++---
 .../lib/components/home/NoItemFound.svelte    |  29 +-
 .../src/lib/components/home/TreeView.svelte   | 216 +++--
 .../lib/components/home/TreeViewRoot.svelte   | 110 ++-
 .../src/lib/components/home/treeViewUtils.ts  |  45 +-
 14 files changed, 2175 insertions(+), 258 deletions(-)
 create mode 100644 backend/migrations/20260724094737_runnables_sort_indexes.down.sql
 create mode 100644 backend/migrations/20260724094737_runnables_sort_indexes.up.sql
 create mode 100644 backend/tests/runnables_list_pagination.rs
 create mode 100644 backend/windmill-api/src/runnables.rs

diff --git a/backend/migrations/20260724094737_runnables_sort_indexes.down.sql b/backend/migrations/20260724094737_runnables_sort_indexes.down.sql
new file mode 100644
index 0000000000..a3821b17ab
--- /dev/null
+++ b/backend/migrations/20260724094737_runnables_sort_indexes.down.sql
@@ -0,0 +1,5 @@
+DROP INDEX IF EXISTS index_script_on_workspace_created_at;
+DROP INDEX IF EXISTS index_flow_on_workspace_edited_at;
+DROP INDEX IF EXISTS index_script_on_workspace_name;
+DROP INDEX IF EXISTS index_flow_on_workspace_name;
+DROP INDEX IF EXISTS index_app_on_workspace_name;
diff --git a/backend/migrations/20260724094737_runnables_sort_indexes.up.sql b/backend/migrations/20260724094737_runnables_sort_indexes.up.sql
new file mode 100644
index 0000000000..a1839906bb
--- /dev/null
+++ b/backend/migrations/20260724094737_runnables_sort_indexes.up.sql
@@ -0,0 +1,26 @@
+-- Indexes backing the unified homepage runnables listing so the merged,
+-- keyset-paginated query stays an index scan (Merge Append + LIMIT) even on big
+-- workspaces, for both the time orders and the name orders.
+--
+-- `archived` is the second key so the default (archived = false) and the
+-- "Only archived" views each seek their own slice and still get the sort key
+-- ordered within it, instead of one view scanning past the other's rows. Apps
+-- have no archived column and are excluded from the archived view.
+
+-- Time orders.
+CREATE INDEX IF NOT EXISTS index_script_on_workspace_created_at
+    ON script (workspace_id, archived, created_at DESC);
+
+CREATE INDEX IF NOT EXISTS index_flow_on_workspace_edited_at
+    ON flow (workspace_id, archived, edited_at DESC);
+
+-- Name orders sort on the lowered summary-or-path expression, so a matching
+-- expression index makes that order presorted instead of a full sort per page.
+CREATE INDEX IF NOT EXISTS index_script_on_workspace_name
+    ON script (workspace_id, archived, lower(COALESCE(NULLIF(summary, ''), path)));
+
+CREATE INDEX IF NOT EXISTS index_flow_on_workspace_name
+    ON flow (workspace_id, archived, lower(COALESCE(NULLIF(summary, ''), path)));
+
+CREATE INDEX IF NOT EXISTS index_app_on_workspace_name
+    ON app (workspace_id, lower(COALESCE(NULLIF(summary, ''), path)));
diff --git a/backend/tests/runnables_list_pagination.rs b/backend/tests/runnables_list_pagination.rs
new file mode 100644
index 0000000000..05655f4561
--- /dev/null
+++ b/backend/tests/runnables_list_pagination.rs
@@ -0,0 +1,417 @@
+//! Regression tests for the merged runnables listing endpoint
+//! (`GET /w/{workspace}/runnables/list`), which UNION-ALLs scripts, flows and
+//! apps into one keyset-paginated, globally-ordered stream.
+//!
+//! The delicate parts:
+//!   1. Cross-kind ties — a script and a flow sharing the exact same
+//!      `(sort_key, path)` must each appear exactly once across pages, never
+//!      duplicated or skipped, in every order (the keyset cursor
+//!      `(sort_key, path, kind, tiebreak)`).
+//!   2. Archived view semantics — scripts keep every version as a row (old ones
+//!      archived=true), so "Only archived" must key off the LATEST row per path:
+//!      an active path's superseded version must not leak in, and a fully-archived
+//!      path appears exactly once.
+
+use serde_json::json;
+use sqlx::{Pool, Postgres};
+use windmill_test_utils::*;
+
+fn client() -> reqwest::Client {
+    reqwest::Client::new()
+}
+
+fn authed(builder: reqwest::RequestBuilder, token: &str) -> reqwest::RequestBuilder {
+    builder.header("Authorization", format!("Bearer {}", token))
+}
+
+fn new_script(path: &str, summary: &str) -> serde_json::Value {
+    json!({
+        "path": path,
+        "summary": summary,
+        "description": "",
+        "content": "export async function main() {}",
+        "language": "deno",
+        "schema": { "$schema": "https://json-schema.org/draft/2020-12/schema", "type": "object", "properties": {}, "required": [] }
+    })
+}
+
+fn new_flow(path: &str, summary: &str) -> serde_json::Value {
+    json!({
+        "path": path,
+        "summary": summary,
+        "description": "",
+        "value": { "modules": [] },
+        "schema": { "$schema": "https://json-schema.org/draft/2020-12/schema", "type": "object", "properties": {}, "required": [] }
+    })
+}
+
+/// Page through the endpoint one item at a time and return the ordered list of
+/// `type:path` identifiers.
+async fn paginate_all(port: u16, query: &str) -> Vec<String> {
+    let base = format!("http://localhost:{port}/api/w/test-workspace/runnables/list");
+    let mut out = vec![];
+    let mut cursor: Option<String> = None;
+    for _ in 0..50 {
+        let mut url = format!("{base}?{query}&per_page=1");
+        if let Some(c) = &cursor {
+            url.push_str(&format!("&cursor={c}"));
+        }
+        let resp = authed(client().get(&url), "SECRET_TOKEN")
+            .send()
+            .await
+            .unwrap();
+        assert_eq!(resp.status(), 200, "list should succeed");
+        let body: serde_json::Value = resp.json().await.unwrap();
+        for it in body["items"].as_array().unwrap() {
+            out.push(format!(
+                "{}:{}",
+                it["type"].as_str().unwrap(),
+                it["path"].as_str().unwrap()
+            ));
+        }
+        match body["next_cursor"].as_str() {
+            Some(c) => cursor = Some(c.to_string()),
+            None => break,
+        }
+    }
+    out
+}
+
+fn assert_no_dupes(items: &[String], label: &str) {
+    let mut sorted = items.to_vec();
+    sorted.sort();
+    let mut deduped = sorted.clone();
+    deduped.dedup();
+    assert_eq!(
+        sorted, deduped,
+        "{label}: keyset pagination must not duplicate or skip items, got {items:?}"
+    );
+}
+
+#[sqlx::test(fixtures("base"))]
+async fn test_runnables_keyset_no_dupes_across_kind_ties(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let base = format!("http://localhost:{port}/api/w/test-workspace");
+
+    // A script and a flow sharing a path, plus two more scripts.
+    for (p, s) in [
+        ("u/test-user/tie", "Tie item"),
+        ("u/test-user/aaa", "Aaa"),
+        ("u/test-user/zzz", "Zzz"),
+    ] {
+        let r = authed(
+            client().post(format!("{base}/scripts/create")),
+            "SECRET_TOKEN",
+        )
+        .json(&new_script(p, s))
+        .send()
+        .await?;
+        assert_eq!(r.status(), 201, "create script: {}", r.text().await?);
+    }
+    let r = authed(
+        client().post(format!("{base}/flows/create")),
+        "SECRET_TOKEN",
+    )
+    .json(&new_flow("u/test-user/tie", "Tie item"))
+    .send()
+    .await?;
+    assert_eq!(r.status(), 201, "create flow: {}", r.text().await?);
+
+    // Force an exact (sort_time, path, summary) tie between the script and flow
+    // at u/test-user/tie so the cross-kind boundary is actually exercised.
+    let ts = "2026-07-20 10:00:00+00";
+    sqlx::query(
+        "UPDATE script SET created_at = $1::timestamptz WHERE workspace_id = 'test-workspace'",
+    )
+    .bind(ts)
+    .execute(&db)
+    .await?;
+    sqlx::query(
+        "UPDATE flow SET edited_at = $1::timestamptz WHERE workspace_id = 'test-workspace'",
+    )
+    .bind(ts)
+    .execute(&db)
+    .await?;
+
+    // Expected: 3 scripts + 1 flow, each exactly once.
+    for q in [
+        "order_by=updated&order_desc=true",
+        "order_by=name&order_desc=false",
+        "order_by=name&order_desc=true",
+    ] {
+        let items = paginate_all(port, q).await;
+        assert_eq!(items.len(), 4, "{q}: expected 4 items, got {items:?}");
+        assert_no_dupes(&items, q);
+        assert!(
+            items.contains(&"flow:u/test-user/tie".to_string()),
+            "{q}: flow present"
+        );
+        assert!(
+            items.contains(&"script:u/test-user/tie".to_string()),
+            "{q}: script present"
+        );
+    }
+    Ok(())
+}
+
+#[sqlx::test(fixtures("base"))]
+async fn test_runnables_archived_shows_only_paths_whose_latest_is_archived(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    // Scripts keep every version as its own row; superseded ones are archived=true.
+    // "Only archived" must key off the LATEST row per path, not every row.
+
+    // Path A: an archived predecessor, then an active latest version. The path is
+    // active, so it must NOT appear in the archived view (the old version leaking in
+    // was the bug).
+    for (h, sec, archived) in [(811111111i64, 0, true), (822222222, 1, false)] {
+        sqlx::query(
+            "INSERT INTO script (workspace_id, hash, path, summary, description, content, created_by, created_at, language, archived)
+             VALUES ('test-workspace', $1, 'u/test-user/active_hist', 'AH', '', 'x', 'test-user', ('2026-07-19 10:00:0' || $2)::timestamptz, 'deno', $3)",
+        )
+        .bind(h).bind(sec.to_string()).bind(archived)
+        .execute(&db)
+        .await?;
+    }
+
+    // Path B: fully archived — an older archived version plus a latest archived one.
+    // The archived view must surface it exactly once (its latest row), not per version.
+    for (h, sec) in [(833333333i64, 0), (844444444, 1)] {
+        sqlx::query(
+            "INSERT INTO script (workspace_id, hash, path, summary, description, content, created_by, created_at, language, archived)
+             VALUES ('test-workspace', $1, 'u/test-user/archived_path', 'AP', '', 'x', 'test-user', ('2026-07-19 10:00:0' || $2)::timestamptz, 'deno', true)",
+        )
+        .bind(h).bind(sec.to_string())
+        .execute(&db)
+        .await?;
+    }
+
+    // Favorite both paths (pinned first now); this test only checks presence/dedup, so
+    // pinning doesn't affect the assertions — favorite-ordering is covered separately.
+    for p in ["u/test-user/active_hist", "u/test-user/archived_path"] {
+        sqlx::query(
+            "INSERT INTO favorite (usr, workspace_id, path, favorite_kind) VALUES ('test-user', 'test-workspace', $1, 'script')",
+        )
+        .bind(p)
+        .execute(&db)
+        .await?;
+    }
+
+    // paginate_all pages one at a time, so a path crossing a page boundary is caught.
+    let items = paginate_all(port, "order_by=name&order_desc=false&show_archived=true").await;
+    assert_eq!(
+        items
+            .iter()
+            .filter(|i| *i == "script:u/test-user/active_hist")
+            .count(),
+        0,
+        "an active path's archived predecessor must not leak into the archived view, got {items:?}"
+    );
+    assert_eq!(
+        items
+            .iter()
+            .filter(|i| *i == "script:u/test-user/archived_path")
+            .count(),
+        1,
+        "a fully-archived path must appear exactly once (its latest row), got {items:?}"
+    );
+    Ok(())
+}
+
+#[sqlx::test(fixtures("base"))]
+async fn test_runnables_archived_favorite_is_pinned_first(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    // Three fully-archived paths whose names sort aaa < mmm < zzz. Favorite the
+    // last-sorting one; the archived view pins starred first (each path is one row
+    // now), so it must lead under name-ascending order despite its late sort key.
+    for (h, name) in [
+        (911111111i64, "aaa"),
+        (922222222, "mmm"),
+        (933333333, "zzz"),
+    ] {
+        sqlx::query(
+            "INSERT INTO script (workspace_id, hash, path, summary, description, content, created_by, created_at, language, archived)
+             VALUES ('test-workspace', $1, $2, $3, '', 'x', 'test-user', '2026-07-19 10:00:00'::timestamptz, 'deno', true)",
+        )
+        .bind(h).bind(format!("u/test-user/{name}")).bind(name)
+        .execute(&db)
+        .await?;
+    }
+    sqlx::query(
+        "INSERT INTO favorite (usr, workspace_id, path, favorite_kind) VALUES ('test-user', 'test-workspace', 'u/test-user/zzz', 'script')",
+    )
+    .execute(&db)
+    .await?;
+
+    let items = paginate_all(port, "order_by=name&order_desc=false&show_archived=true").await;
+    let pos = |p: &str| items.iter().position(|i| i == p);
+    let zzz = pos("script:u/test-user/zzz").expect("favorited archived path present");
+    let aaa = pos("script:u/test-user/aaa").expect("aaa present");
+    let mmm = pos("script:u/test-user/mmm").expect("mmm present");
+    assert!(
+        zzz < aaa && zzz < mmm,
+        "favorited archived path must be pinned ahead of earlier-named non-favorites, got {items:?}"
+    );
+    Ok(())
+}
+
+fn new_app(path: &str, summary: &str) -> serde_json::Value {
+    json!({
+        "path": path,
+        "summary": summary,
+        "value": {},
+        "policy": { "execution_mode": "publisher", "triggerables": {} }
+    })
+}
+
+/// A single list request; returns the ordered `type:path` identifiers.
+async fn list_once(port: u16, query: &str) -> Vec<String> {
+    let url = format!("http://localhost:{port}/api/w/test-workspace/runnables/list?{query}");
+    let resp = authed(client().get(&url), "SECRET_TOKEN")
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 200, "list should succeed for {query}");
+    let body: serde_json::Value = resp.json().await.unwrap();
+    body["items"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .map(|it| {
+            format!(
+                "{}:{}",
+                it["type"].as_str().unwrap(),
+                it["path"].as_str().unwrap()
+            )
+        })
+        .collect()
+}
+
+async fn seed_mixed(base: &str, db: &Pool<Postgres>) -> anyhow::Result<()> {
+    for (p, s) in [
+        ("f/alpha/one", "Deploy tool"),
+        ("f/alpha/two", "Cleanup job"),
+        ("f/beta/one", "Beta thing"),
+        ("u/test-user/solo", "Solo script"),
+    ] {
+        let r = authed(
+            client().post(format!("{base}/scripts/create")),
+            "SECRET_TOKEN",
+        )
+        .json(&new_script(p, s))
+        .send()
+        .await?;
+        assert_eq!(r.status(), 201, "create script {p}: {}", r.text().await?);
+    }
+    let r = authed(
+        client().post(format!("{base}/flows/create")),
+        "SECRET_TOKEN",
+    )
+    .json(&new_flow("f/alpha/flowy", "Alpha flow"))
+    .send()
+    .await?;
+    assert_eq!(r.status(), 201, "create flow: {}", r.text().await?);
+    let r = authed(client().post(format!("{base}/apps/create")), "SECRET_TOKEN")
+        .json(&new_app("f/beta/appy", "Beta app"))
+        .send()
+        .await?;
+    assert_eq!(r.status(), 201, "create app: {}", r.text().await?);
+    // Silence unused warnings on db in case future assertions drop it.
+    let _ = db;
+    Ok(())
+}
+
+#[sqlx::test(fixtures("base"))]
+async fn test_runnables_path_start_scopes_to_folder(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let base = format!("http://localhost:{port}/api/w/test-workspace");
+    seed_mixed(&base, &db).await?;
+
+    // path_start scopes to exactly one folder subtree (the folder-navigation path).
+    let mut alpha = list_once(port, "path_start=f/alpha/").await;
+    alpha.sort();
+    assert_eq!(
+        alpha,
+        vec![
+            "flow:f/alpha/flowy".to_string(),
+            "script:f/alpha/one".to_string(),
+            "script:f/alpha/two".to_string(),
+        ],
+        "path_start=f/alpha/ must return only that folder's items"
+    );
+
+    // A prefix that matches nothing returns an empty list, not an error.
+    let empty = list_once(port, "path_start=f/nope/").await;
+    assert!(
+        empty.is_empty(),
+        "unknown folder must be empty, got {empty:?}"
+    );
+    Ok(())
+}
+
+#[sqlx::test(fixtures("base"))]
+async fn test_runnables_search_and_kind_filters(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let base = format!("http://localhost:{port}/api/w/test-workspace");
+    seed_mixed(&base, &db).await?;
+
+    // Case-insensitive substring search over summary/path.
+    let deploy = list_once(port, "search=deploy").await;
+    assert_eq!(
+        deploy,
+        vec!["script:f/alpha/one".to_string()],
+        "search must substring-match the summary only"
+    );
+
+    // kinds filter selects a single kind.
+    let flows = list_once(port, "kinds=flow").await;
+    assert_eq!(flows, vec!["flow:f/alpha/flowy".to_string()], "kinds=flow");
+    let apps = list_once(port, "kinds=app").await;
+    assert_eq!(apps, vec!["app:f/beta/appy".to_string()], "kinds=app");
+    let scripts = list_once(port, "kinds=script").await;
+    assert_eq!(
+        scripts.len(),
+        4,
+        "kinds=script -> 4 scripts, got {scripts:?}"
+    );
+    Ok(())
+}
+
+#[sqlx::test(fixtures("base"))]
+async fn test_runnables_starred_pinned_first(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let base = format!("http://localhost:{port}/api/w/test-workspace");
+    seed_mixed(&base, &db).await?;
+
+    // Favorite a path that would otherwise sort last (name Z-ish); it must lead.
+    sqlx::query(
+        "INSERT INTO favorite (usr, workspace_id, path, favorite_kind) VALUES ('test-user','test-workspace','u/test-user/solo','script')",
+    )
+    .execute(&db)
+    .await?;
+
+    let items = list_once(port, "order_by=name&order_desc=false").await;
+    assert_eq!(
+        items.first().map(String::as_str),
+        Some("script:u/test-user/solo"),
+        "starred item pins to the top of the browse view regardless of order, got {items:?}"
+    );
+    Ok(())
+}
diff --git a/backend/windmill-api-groups/src/folders.rs b/backend/windmill-api-groups/src/folders.rs
index 3551435dc7..a5741ccfd3 100644
--- a/backend/windmill-api-groups/src/folders.rs
+++ b/backend/windmill-api-groups/src/folders.rs
@@ -15,7 +15,10 @@ use axum::{
 };
 use lazy_static::lazy_static;
 use regex::Regex;
-use windmill_api_auth::{build_scope_path_predicate, check_scopes, ApiAuthed, AuthCache, Tokened};
+use windmill_api_auth::{
+    build_scope_path_filter, build_scope_path_predicate, check_scopes, ApiAuthed, AuthCache,
+    ScopePathFilter, Tokened,
+};
 use windmill_audit::audit_oss::{audit_log, AuditAuthorable};
 use windmill_audit::ActionKind;
 use windmill_common::DB;
@@ -135,18 +138,43 @@ async fn list_foldernames(
     let (per_page, offset) = paginate(pagination);
     let mut tx = user_db.begin(&authed).await?;
 
-    let allowed = build_scope_path_predicate(&authed, "folders", "read");
-    let rows = sqlx::query_scalar!(
-        "SELECT name FROM folder WHERE workspace_id = $1 ORDER BY name asc LIMIT $2 OFFSET $3",
-        w_id,
-        per_page as i64,
-        offset as i64
-    )
-    .fetch_all(&mut *tx)
-    .await?
-    .into_iter()
-    .filter(|name| allowed(&format!("f/{}", name)))
-    .collect::<Vec<_>>();
+    // Push the token's scope grant into the query so LIMIT/OFFSET page over the
+    // AUTHORIZED folders — the returned count then reflects the authorized set, so a
+    // paginating caller can rely on `< per_page` meaning exhaustion. (Filtering after the
+    // LIMIT would let a page return fewer than per_page while authorized folders remain
+    // on later DB pages, stopping such a caller early.)
+    let mut sql = String::from("SELECT name FROM folder WHERE workspace_id = $1");
+    let restricted = match build_scope_path_filter(&authed, "folders", "read") {
+        ScopePathFilter::AllowAll => None,
+        ScopePathFilter::Restricted { exact, mut prefix } => {
+            // A prefix grant also authorizes the folder at the prefix itself.
+            let mut eq = exact;
+            eq.append(&mut prefix.clone());
+            let like: Vec<String> = prefix
+                .iter()
+                .map(|p| {
+                    format!(
+                        "{}/%",
+                        p.replace('\\', "\\\\")
+                            .replace('%', "\\%")
+                            .replace('_', "\\_")
+                    )
+                })
+                .collect();
+            sql.push_str(" AND (('f/' || name) = ANY($4) OR ('f/' || name) LIKE ANY($5))");
+            Some((eq, like))
+        }
+    };
+    sql.push_str(" ORDER BY name asc LIMIT $2 OFFSET $3");
+
+    let mut query = sqlx::query_scalar::<_, String>(&sql)
+        .bind(&w_id)
+        .bind(per_page as i64)
+        .bind(offset as i64);
+    if let Some((eq, like)) = restricted {
+        query = query.bind(eq).bind(like);
+    }
+    let rows = query.fetch_all(&mut *tx).await?;
 
     tx.commit().await?;
 
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 0b493da2f4..0ab5695994 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -10481,6 +10481,73 @@ paths:
                     - path
                     - value
 
+  /w/{workspace}/runnables/list:
+    get:
+      summary: list runnables (scripts, flows, apps) merged, ordered and keyset-paginated
+      operationId: listRunnables
+      tags:
+        - script
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - name: order_by
+          in: query
+          description: "sort key: 'updated' (default) or 'name'"
+          schema:
+            type: string
+            enum:
+              - updated
+              - name
+        - $ref: "#/components/parameters/OrderDesc"
+        - name: kinds
+          in: query
+          description: comma-separated subset of script,flow,app (default all)
+          schema:
+            type: string
+        - name: show_archived
+          in: query
+          schema:
+            type: boolean
+        - name: include_without_main
+          in: query
+          description: include library scripts (no runnable main)
+          schema:
+            type: boolean
+        - name: path_start
+          in: query
+          description: restrict to paths under this prefix
+          schema:
+            type: string
+        - name: label
+          in: query
+          schema:
+            type: string
+        - name: search
+          in: query
+          description: case-insensitive substring match on summary or path
+          schema:
+            type: string
+        - $ref: "#/components/parameters/PerPage"
+        - name: cursor
+          in: query
+          description: opaque keyset cursor from a previous page's next_cursor
+          schema:
+            type: string
+      responses:
+        "200":
+          description: a page of merged, ordered runnables
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - items
+                properties:
+                  items:
+                    type: array
+                    items:
+                      $ref: "#/components/schemas/RunnableItem"
+                  next_cursor:
+                    type: string
   /w/{workspace}/flows/list:
     get:
       summary: list all flows
@@ -19364,6 +19431,8 @@ paths:
         - folder
       parameters:
         - $ref: "#/components/parameters/WorkspaceId"
+        - $ref: "#/components/parameters/Page"
+        - $ref: "#/components/parameters/PerPage"
         - name: only_member_of
           in: query
           description: only list the folders the user is member of (default false)
@@ -24772,6 +24841,86 @@ components:
         - language
         - content
 
+    RunnableItem:
+      type: object
+      description: |
+        A row in the merged runnables listing. `type` is the discriminator;
+        kind-specific fields (hash/language/kind for scripts, execution_mode/
+        version for apps) are present only for that kind. `edited_at` is the
+        unified last-updated time (a script's created_at, a flow/app's edit
+        time).
+      properties:
+        type:
+          type: string
+          enum:
+            - script
+            - flow
+            - app
+        path:
+          type: string
+        summary:
+          type: string
+        workspace_id:
+          type: string
+        extra_perms:
+          type: object
+          additionalProperties:
+            type: boolean
+        starred:
+          type: boolean
+        archived:
+          type: boolean
+        is_draft:
+          type: boolean
+        draft_only:
+          type: boolean
+          nullable: true
+        draft_path:
+          type: string
+        draft_users:
+          type: array
+          items:
+            type: object
+        labels:
+          type: array
+          items:
+            type: string
+        inherited_labels:
+          type: array
+          items:
+            type: string
+        ws_error_handler_muted:
+          type: boolean
+        edited_at:
+          type: string
+          format: date-time
+        hash:
+          type: string
+          description: script version hash as a 16-char hex string
+        language:
+          type: string
+        kind:
+          type: string
+        auto_kind:
+          type: string
+        use_codebase:
+          type: boolean
+        has_deploy_errors:
+          type: boolean
+        raw_app:
+          type: boolean
+        execution_mode:
+          type: string
+        id:
+          type: integer
+          format: int64
+        version:
+          type: integer
+          format: int64
+      required:
+        - type
+        - path
+
     Script:
       type: object
       properties:
diff --git a/backend/windmill-api/src/db.rs b/backend/windmill-api/src/db.rs
index c564548b42..aa94fd80c4 100644
--- a/backend/windmill-api/src/db.rs
+++ b/backend/windmill-api/src/db.rs
@@ -93,6 +93,9 @@ lazy_static::lazy_static! {
                     (20260710073406, include_str!(
                         "../../migrations/20260710073406_index_v2_job_parent_job.up.sql"
                     ).replace("CREATE INDEX", "CREATE INDEX CONCURRENTLY")),
+                    (20260724094737, include_str!(
+                        "../../migrations/20260724094737_runnables_sort_indexes.up.sql"
+                    ).replace("CREATE INDEX", "CREATE INDEX CONCURRENTLY")),
                     ].into_iter().collect();
 }
 
diff --git a/backend/windmill-api/src/lib.rs b/backend/windmill-api/src/lib.rs
index ce66ec22da..f4d30cbd77 100644
--- a/backend/windmill-api/src/lib.rs
+++ b/backend/windmill-api/src/lib.rs
@@ -101,6 +101,7 @@ mod indexer_oss;
 mod integration;
 mod internal_db;
 mod live_migrations;
+mod runnables;
 #[cfg(all(feature = "private", feature = "parquet"))]
 pub mod s3_proxy_ee;
 mod s3_proxy_oss;
@@ -571,6 +572,7 @@ pub async fn run_server(
                         .nest("/embeddings", embeddings::workspaced_service())
                         .nest("/favorites", favorite::workspaced_service())
                         .nest("/flows", flows::workspaced_service())
+                        .nest("/runnables", runnables::workspaced_service())
                         .nest(
                             "/workspace_dependencies",
                             workspace_dependencies::workspaced_service(),
diff --git a/backend/windmill-api/src/runnables.rs b/backend/windmill-api/src/runnables.rs
new file mode 100644
index 0000000000..489c0d5dd5
--- /dev/null
+++ b/backend/windmill-api/src/runnables.rs
@@ -0,0 +1,541 @@
+/*
+ * Author: Windmill Labs, Inc
+ * Copyright: Windmill Labs, Inc 2024
+ * This file and its contents are licensed under the AGPLv3 License.
+ * Please see the included NOTICE for copyright information and
+ * LICENSE-AGPL for a copy of the license.
+ */
+
+//! Unified, keyset-paginated listing of a workspace's runnables (scripts,
+//! flows, apps) merged into one globally-ordered stream. The homepage uses it
+//! so a chosen order (recently updated / oldest / name) is correct and complete
+//! across all three kinds at any workspace size, instead of client-sorting a
+//! per-kind capped window.
+//!
+//! Efficiency: each kind is a UNION ALL branch ordered by an index on
+//! `(workspace_id, archived, <sort key>)` (created_at / edited_at, or the lowered
+//! summary-or-path expression for name orders); Postgres merges the ordered
+//! branches and stops at the page limit. Pagination is keyset — a
+//! `(sort_key, path, kind, tiebreak)` cursor, where `tiebreak` (a script's hash,
+//! 0 for flow/app) is a stable final key that keeps the order total even when rows
+//! tie on (sort_key, path, kind) — so deep pages don't re-scan. Visibility is
+//! enforced in-SQL by RLS via the `user_db` transaction.
+
+use crate::db::{ApiAuthed, DB};
+use crate::utils::{build_scope_path_filter, ScopePathFilter};
+use axum::{
+    extract::{Extension, Path, Query},
+    routing::get,
+    Json, Router,
+};
+use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
+use serde::{Deserialize, Serialize};
+use windmill_common::{
+    db::UserDB,
+    error::{Error, JsonResult},
+};
+use windmill_types::scripts::ScriptHash;
+use windmill_types::user_drafts::DraftUserRef;
+
+pub fn workspaced_service() -> Router {
+    Router::new().route("/list", get(list_runnables))
+}
+
+#[derive(Deserialize)]
+struct ListRunnablesQuery {
+    /// `updated` (default) or `name`.
+    order_by: Option<String>,
+    /// Descending when true (default true).
+    order_desc: Option<bool>,
+    /// Comma-separated subset of `script,flow,app`; omitted means all.
+    kinds: Option<String>,
+    show_archived: Option<bool>,
+    /// Include library scripts (no runnable main). Ignored for flows/apps.
+    include_without_main: Option<bool>,
+    /// Restrict to paths under this prefix (owner/folder filter).
+    path_start: Option<String>,
+    /// Comma-separated labels; a row matches if it (or its folder) carries all.
+    label: Option<String>,
+    /// Case-insensitive substring match on summary or path.
+    search: Option<String>,
+    per_page: Option<usize>,
+    /// Opaque keyset cursor from a previous page's `next_cursor`.
+    cursor: Option<String>,
+}
+
+// Absent optional fields are omitted (not serialized as null) to match the
+// per-kind list contract; the frontend row components expect `undefined`.
+#[derive(Serialize, sqlx::FromRow)]
+struct RunnableItem {
+    #[serde(rename = "type")]
+    kind: String, // 'script' | 'flow' | 'app'
+    path: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    summary: Option<String>,
+    workspace_id: String,
+    extra_perms: serde_json::Value,
+    starred: bool,
+    archived: bool,
+    is_draft: bool,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    draft_only: Option<bool>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    draft_path: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    draft_users: Option<sqlx::types::Json<Vec<DraftUserRef>>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    labels: Option<Vec<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    inherited_labels: Option<Vec<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    ws_error_handler_muted: Option<bool>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    edited_at: Option<chrono::DateTime<chrono::Utc>>,
+    // script-only. ScriptHash serializes as the 16-char hex string that
+    // /scripts/get/{hash} parses (a raw i64 would produce a broken link).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    hash: Option<ScriptHash>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    language: Option<String>,
+    #[serde(rename = "kind", skip_serializing_if = "Option::is_none")]
+    script_kind: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    auto_kind: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    use_codebase: Option<bool>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    has_deploy_errors: Option<bool>,
+    // app-only
+    #[serde(skip_serializing_if = "Option::is_none")]
+    raw_app: Option<bool>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    execution_mode: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    id: Option<i64>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    version: Option<i64>,
+    // sort keys, echoed into the cursor (not serialized to the client)
+    #[serde(skip)]
+    sort_time: chrono::DateTime<chrono::Utc>,
+    #[serde(skip)]
+    sort_name: String,
+    // Final tiebreaker making the sort total: a script's hash, 0 for flow/app. A stable
+    // last key so rows that tie on (sort_key, path, kind) still have a strict order and
+    // none is skipped when a tie crosses a page boundary.
+    #[serde(skip)]
+    tiebreak: i64,
+}
+
+#[derive(Serialize)]
+struct ListRunnablesResponse {
+    items: Vec<RunnableItem>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    next_cursor: Option<String>,
+}
+
+#[derive(Serialize, Deserialize)]
+struct Cursor {
+    /// sort key of the last row: rfc3339 timestamp (updated) or lowered name.
+    k: String,
+    p: String,
+    t: String,
+    /// tiebreak (script hash / 0) of the last row.
+    #[serde(default)]
+    tb: i64,
+}
+
+fn encode_cursor(item: &RunnableItem, order_by_name: bool) -> String {
+    let k = if order_by_name {
+        item.sort_name.clone()
+    } else {
+        item.sort_time.to_rfc3339()
+    };
+    let c = Cursor { k, p: item.path.clone(), t: item.kind.clone(), tb: item.tiebreak };
+    URL_SAFE_NO_PAD.encode(serde_json::to_vec(&c).unwrap_or_default())
+}
+
+fn decode_cursor(raw: &str) -> Result<Cursor, Error> {
+    let bytes = URL_SAFE_NO_PAD
+        .decode(raw)
+        .map_err(|_| Error::BadRequest("invalid cursor".to_string()))?;
+    serde_json::from_slice(&bytes).map_err(|_| Error::BadRequest("invalid cursor".to_string()))
+}
+
+/// Escape LIKE/ILIKE wildcards so a caller value (search term, path/scope
+/// prefix) matches literally. Relies on the default `\` escape character.
+fn escape_like(s: &str) -> String {
+    s.replace('\\', "\\\\")
+        .replace('%', "\\%")
+        .replace('_', "\\_")
+}
+
+/// The three UNION-ALL branch SELECTs, each projecting the shared `RunnableItem`
+/// column set (NULL for columns that don't apply to that kind). `$1`=workspace,
+/// `$2`=username (favorites), `$3`=email (drafts). Kind-specific and per-request
+/// WHERE fragments are appended by the caller.
+struct Branches {
+    script: String,
+    flow: String,
+    app: String,
+}
+
+fn branch_sqls() -> Branches {
+    // draft_users subquery (correlated) mirrors the per-kind list endpoints; run
+    // only for the returned page, so its cost is bounded by per_page.
+    let draft_users = |typ_pred: &str| -> String {
+        format!(
+            "(SELECT json_agg(json_build_object('username', COALESCE(u.username, p.username, CASE WHEN p.email IS NOT NULL THEN d.email END)) ORDER BY COALESCE(u.username, p.username, CASE WHEN p.email IS NOT NULL THEN d.email END) NULLS LAST) \
+              FROM draft d \
+              LEFT JOIN usr u ON u.workspace_id = d.workspace_id AND u.email = d.email \
+              LEFT JOIN password p ON p.email = d.email AND p.super_admin = true \
+              WHERE d.workspace_id = o.workspace_id AND d.path = o.path AND {typ_pred}) as draft_users"
+        )
+    };
+
+    let script = format!(
+        "SELECT 'script' as kind, o.path, o.summary, o.workspace_id, o.extra_perms, \
+                favorite.path IS NOT NULL as starred, o.archived, \
+                draft.email IS NOT NULL as is_draft, NULL::bool as draft_only, NULL::text as draft_path, \
+                {draft_users}, o.labels, folder_labels(o.workspace_id, o.path) as inherited_labels, \
+                o.ws_error_handler_muted, o.created_at as edited_at, \
+                o.hash, o.language::text as language, o.kind::text as script_kind, o.auto_kind, \
+                o.codebase IS NOT NULL as use_codebase, \
+                (o.lock_error_logs IS NOT NULL) as has_deploy_errors, \
+                NULL::bool as raw_app, NULL::text as execution_mode, NULL::bigint as id, NULL::bigint as version, \
+                o.created_at as sort_time, lower(COALESCE(NULLIF(o.summary, ''), o.path)) as sort_name, o.hash as tiebreak \
+         FROM script o \
+         LEFT JOIN favorite ON favorite.favorite_kind = 'script' AND favorite.workspace_id = o.workspace_id AND favorite.path = o.path AND favorite.usr = $2 \
+         LEFT JOIN draft ON draft.path = o.path AND draft.workspace_id = o.workspace_id AND draft.typ = 'script' AND draft.email = $3",
+        draft_users = draft_users("d.typ = 'script'")
+    );
+
+    let flow = format!(
+        "SELECT 'flow' as kind, o.path, o.summary, o.workspace_id, o.extra_perms, \
+                favorite.path IS NOT NULL as starred, o.archived, \
+                draft.email IS NOT NULL as is_draft, NULL::bool as draft_only, NULL::text as draft_path, \
+                {draft_users}, o.labels, folder_labels(o.workspace_id, o.path) as inherited_labels, \
+                o.ws_error_handler_muted, o.edited_at, \
+                NULL::bigint as hash, NULL::text as language, NULL::text as script_kind, NULL::text as auto_kind, \
+                NULL::bool as use_codebase, NULL::bool as has_deploy_errors, \
+                NULL::bool as raw_app, NULL::text as execution_mode, NULL::bigint as id, NULL::bigint as version, \
+                o.edited_at as sort_time, lower(COALESCE(NULLIF(o.summary, ''), o.path)) as sort_name, 0::bigint as tiebreak \
+         FROM flow o \
+         LEFT JOIN favorite ON favorite.favorite_kind = 'flow' AND favorite.workspace_id = o.workspace_id AND favorite.path = o.path AND favorite.usr = $2 \
+         LEFT JOIN draft ON draft.path = o.path AND draft.workspace_id = o.workspace_id AND draft.typ = 'flow' AND draft.email = $3",
+        draft_users = draft_users("d.typ = 'flow'")
+    );
+
+    let app = format!(
+        "SELECT 'app' as kind, o.path, o.summary, o.workspace_id, o.extra_perms, \
+                favorite.path IS NOT NULL as starred, false as archived, \
+                draft.path IS NOT NULL as is_draft, NULL::bool as draft_only, NULL::text as draft_path, \
+                {draft_users}, o.labels, folder_labels(o.workspace_id, o.path) as inherited_labels, \
+                NULL::bool as ws_error_handler_muted, av.created_at as edited_at, \
+                NULL::bigint as hash, NULL::text as language, NULL::text as script_kind, NULL::text as auto_kind, \
+                NULL::bool as use_codebase, NULL::bool as has_deploy_errors, \
+                av.raw_app, o.policy->>'execution_mode' as execution_mode, o.id, \
+                o.versions[array_upper(o.versions, 1)] as version, \
+                COALESCE(av.created_at, 'epoch'::timestamptz) as sort_time, lower(COALESCE(NULLIF(o.summary, ''), o.path)) as sort_name, 0::bigint as tiebreak \
+         FROM app o \
+         LEFT JOIN favorite ON favorite.favorite_kind = 'app' AND favorite.workspace_id = o.workspace_id AND favorite.path = o.path AND favorite.usr = $2 \
+         LEFT JOIN (SELECT DISTINCT path, workspace_id FROM draft WHERE typ IN ('app', 'raw_app') AND email = $3) draft ON draft.path = o.path AND draft.workspace_id = o.workspace_id \
+         LEFT JOIN app_version av ON av.id = o.versions[array_upper(o.versions, 1)]",
+        draft_users = draft_users("d.typ IN ('app', 'raw_app')")
+    );
+
+    Branches { script, flow, app }
+}
+
+async fn list_runnables(
+    authed: ApiAuthed,
+    Extension(user_db): Extension<UserDB>,
+    Extension(_db): Extension<DB>,
+    Path(w_id): Path<String>,
+    Query(q): Query<ListRunnablesQuery>,
+) -> JsonResult<ListRunnablesResponse> {
+    let order_by_name = q.order_by.as_deref() == Some("name");
+    let desc = q.order_desc.unwrap_or(true);
+    let per_page = q.per_page.unwrap_or(50).clamp(1, 1000);
+    let show_archived = q.show_archived.unwrap_or(false);
+    let order_dir = if desc { "DESC" } else { "ASC" };
+    let sort_col = if order_by_name {
+        "sort_name"
+    } else {
+        "sort_time"
+    };
+
+    let mut kinds: Vec<&str> = match q.kinds.as_deref() {
+        None | Some("") => vec!["script", "flow", "app"],
+        Some(csv) => csv
+            .split(',')
+            .map(|s| s.trim())
+            .filter(|s| ["script", "flow", "app"].contains(s))
+            .collect(),
+    };
+    // Apps carry no `archived` column and are never listed as archived.
+    if show_archived {
+        kinds.retain(|k| *k != "app");
+    }
+    // Operators may only see scripts.
+    if authed.is_operator {
+        kinds.retain(|k| *k == "script");
+    }
+
+    let branches = branch_sqls();
+
+    // Params after the fixed $1=w_id, $2=username, $3=email. `add_bind` returns
+    // the next placeholder (`$N`) and records the value in order.
+    let mut binds: Vec<String> = vec![];
+    let add_bind = |binds: &mut Vec<String>, v: String| -> String {
+        binds.push(v);
+        format!("${}", 3 + binds.len())
+    };
+
+    let mut common: Vec<String> = vec!["o.workspace_id = $1".to_string()];
+    if let Some(ps) = q.path_start.as_ref().filter(|s| !s.is_empty()) {
+        let p = add_bind(&mut binds, format!("{}%", escape_like(ps)));
+        common.push(format!("o.path LIKE {}", p));
+    }
+    if let Some(search) = q.search.as_ref().filter(|s| !s.is_empty()) {
+        let p = add_bind(&mut binds, format!("%{}%", escape_like(search)));
+        common.push(format!("(o.summary ILIKE {p} OR o.path ILIKE {p})"));
+    }
+    if let Some(label) = q.label.as_ref().filter(|s| !s.is_empty()) {
+        for l in label.split(',') {
+            let p = add_bind(&mut binds, l.trim().to_string());
+            common.push(format!(
+                "(o.labels @> ARRAY[{p}] OR folder_labels(o.workspace_id, o.path) @> ARRAY[{p}])"
+            ));
+        }
+    }
+    let common_where = common.join(" AND ");
+
+    // Keyset predicate for pages after the first (non-starred rows only). A
+    // row-value comparison keeps the composite order; the key is cast to the
+    // branch column's type.
+    let keyset_sql: Option<String> = match &q.cursor {
+        Some(raw) => {
+            let cur = decode_cursor(raw)?;
+            let kp = add_bind(&mut binds, cur.k);
+            let pp = add_bind(&mut binds, cur.p);
+            let tp = add_bind(&mut binds, cur.t);
+            let tbp = add_bind(&mut binds, cur.tb.to_string());
+            let cmp = if desc { "<" } else { ">" };
+            let key_cast = if order_by_name {
+                format!("{}::text", kp)
+            } else {
+                format!("{}::timestamptz", kp)
+            };
+            Some(format!(
+                "({sort_col}, path, kind, tiebreak) {cmp} ({key_cast}, {pp}::text, {tp}::text, {tbp}::bigint)"
+            ))
+        }
+        None => None,
+    };
+
+    // Fine-grained scoped tokens (e.g. `scripts:read:f/foo/*`) must be confined to
+    // their granted paths. RLS alone doesn't honor token scopes, so push the
+    // per-domain path grant into SQL (empty grant -> the branch matches nothing).
+    // Unscoped sessions -> AllowAll -> no predicate.
+    let scope_where = |filter: ScopePathFilter, binds: &mut Vec<String>| -> Option<String> {
+        match filter {
+            ScopePathFilter::AllowAll => None,
+            ScopePathFilter::Restricted { exact, prefix } => {
+                let mut terms: Vec<String> = vec![];
+                for e in exact {
+                    binds.push(e);
+                    terms.push(format!("o.path = ${}", 3 + binds.len()));
+                }
+                for pre in prefix {
+                    binds.push(pre.clone());
+                    let pe = format!("${}", 3 + binds.len());
+                    binds.push(format!("{}/%", escape_like(&pre)));
+                    let pl = format!("${}", 3 + binds.len());
+                    terms.push(format!("(o.path = {} OR o.path LIKE {})", pe, pl));
+                }
+                Some(if terms.is_empty() {
+                    "false".to_string()
+                } else {
+                    format!("({})", terms.join(" OR "))
+                })
+            }
+        }
+    };
+    // Only push scope binds for kinds whose branch is actually included: a scoped token
+    // with e.g. `kinds=script` omits the flow/app branches, so binding their scope values
+    // (which no SQL references) would make the parameter count mismatch and 500.
+    let script_scope = if kinds.contains(&"script") {
+        scope_where(
+            build_scope_path_filter(&authed, "scripts", "read"),
+            &mut binds,
+        )
+    } else {
+        None
+    };
+    let flow_scope = if kinds.contains(&"flow") {
+        scope_where(
+            build_scope_path_filter(&authed, "flows", "read"),
+            &mut binds,
+        )
+    } else {
+        None
+    };
+    let app_scope = if kinds.contains(&"app") {
+        scope_where(build_scope_path_filter(&authed, "apps", "read"), &mut binds)
+    } else {
+        None
+    };
+
+    // Per-kind archived predicate (scripts/flows have the column; apps don't and
+    // are excluded from the archived view).
+    let archived_pred = if show_archived {
+        "o.archived = true"
+    } else {
+        "o.archived = false"
+    };
+    let mut script_extras: Vec<String> = vec![];
+    if !q.include_without_main.unwrap_or(false) || authed.is_operator {
+        script_extras.push("(o.auto_kind IS NULL OR o.auto_kind <> 'lib')".to_string());
+    }
+    script_extras.push(archived_pred.to_string());
+    if show_archived {
+        // The script table keeps every version as its own row and marks superseded
+        // ones archived=true, so a bare `archived = true` would surface an active
+        // path's old versions and repeat a genuinely archived path once per version.
+        // Match the canonical script listing: only a path whose LATEST row is archived
+        // belongs in the archived view. (Flows/apps are one row per path, so this only
+        // applies to scripts.)
+        script_extras.push(
+            "o.ctid = (SELECT ctid FROM script s2 WHERE s2.path = o.path \
+             AND s2.workspace_id = o.workspace_id ORDER BY s2.created_at DESC LIMIT 1)"
+                .to_string(),
+        );
+    }
+    if let Some(s) = &script_scope {
+        script_extras.push(s.clone());
+    }
+    let mut flow_extras: Vec<String> = vec![archived_pred.to_string()];
+    if let Some(s) = &flow_scope {
+        flow_extras.push(s.clone());
+    }
+    let mut app_extras: Vec<String> = vec![];
+    if let Some(s) = &app_scope {
+        app_extras.push(s.clone());
+    }
+
+    // Favorite filter for a branch: Some(true) = starred only, Some(false) =
+    // non-starred only, None = no filter. Both views pin starred on the first page
+    // (each is one row per path), so the paged stream always passes Some(false).
+    let build_branch = |base: &str,
+                        kind: &str,
+                        extras: &[String],
+                        fav: Option<bool>,
+                        keyset: Option<&str>,
+                        limit: Option<usize>|
+     -> String {
+        // Base-table predicates go inside the projection subquery (they read
+        // o.*/favorite.*); the keyset reads the projected sort aliases, so it
+        // sits in the wrapper WHERE where those aliases are visible.
+        let mut w = vec![common_where.clone()];
+        w.extend(extras.iter().cloned());
+        match fav {
+            Some(true) => w.push("favorite.path IS NOT NULL".to_string()),
+            Some(false) => w.push("favorite.path IS NULL".to_string()),
+            None => {}
+        }
+        let keyset_clause = keyset
+            .map(|ks| format!(" WHERE {}", ks))
+            .unwrap_or_default();
+        // Per-branch LIMIT so each branch's correlated projections (draft_users,
+        // folder_labels) are evaluated only for its own top rows, not the whole
+        // table; the outer union re-limits to the global page.
+        let limit_clause = limit.map(|n| format!(" LIMIT {}", n)).unwrap_or_default();
+        format!(
+            "(SELECT * FROM ({base} WHERE {where_}) {kind}_b{keyset_clause} ORDER BY {sort_col} {dir}, path {dir}, kind {dir}, tiebreak {dir}{limit_clause})",
+            where_ = w.join(" AND "),
+            dir = order_dir,
+        )
+    };
+
+    let branch_for = |kind: &str,
+                      fav: Option<bool>,
+                      keyset: Option<&str>,
+                      limit: Option<usize>|
+     -> Option<String> {
+        if !kinds.contains(&kind) {
+            return None;
+        }
+        let (base, extras): (&str, &[String]) = match kind {
+            "script" => (&branches.script, &script_extras),
+            "flow" => (&branches.flow, &flow_extras),
+            "app" => (&branches.app, &app_extras),
+            _ => return None,
+        };
+        Some(build_branch(base, kind, extras, fav, keyset, limit))
+    };
+
+    let run_union = |branches_sql: Vec<String>, limit: Option<usize>| -> String {
+        let unioned = branches_sql.join(" UNION ALL ");
+        let limit_clause = limit.map(|n| format!(" LIMIT {}", n)).unwrap_or_default();
+        format!(
+            "SELECT * FROM ({unioned}) q ORDER BY {sort_col} {dir}, path {dir}, kind {dir}, tiebreak {dir}{limit_clause}",
+            dir = order_dir,
+        )
+    };
+
+    let mut tx = user_db.begin(&authed).await?;
+    let mut items: Vec<RunnableItem> = vec![];
+    let first_page = q.cursor.is_none();
+
+    // Pin starred on the first page. Both views are now one row per path (the
+    // archived view filters to each path's latest row, see archived_pred), so a
+    // favorite is a single row in either — the starred-first contract holds in the
+    // archived view too, and the pinned first page stays bounded.
+    if first_page {
+        let starred_branches: Vec<String> = ["script", "flow", "app"]
+            .iter()
+            .filter_map(|k| branch_for(k, Some(true), None, None))
+            .collect();
+        if !starred_branches.is_empty() {
+            let sql = run_union(starred_branches, None);
+            let mut query = sqlx::query_as::<_, RunnableItem>(&sql)
+                .bind(&w_id)
+                .bind(&authed.username)
+                .bind(&authed.email);
+            for b in &binds {
+                query = query.bind(b);
+            }
+            items.extend(query.fetch_all(&mut *tx).await?);
+        }
+    }
+
+    // Main paged stream: non-starred rows (starred were pinned on the first page above).
+    let main_fav = Some(false);
+    let ns_branches: Vec<String> = ["script", "flow", "app"]
+        .iter()
+        .filter_map(|k| branch_for(k, main_fav, keyset_sql.as_deref(), Some(per_page)))
+        .collect();
+
+    let mut next_cursor: Option<String> = None;
+    if !ns_branches.is_empty() {
+        let sql = run_union(ns_branches, Some(per_page));
+        let mut query = sqlx::query_as::<_, RunnableItem>(&sql)
+            .bind(&w_id)
+            .bind(&authed.username)
+            .bind(&authed.email);
+        for b in &binds {
+            query = query.bind(b);
+        }
+        let ns = query.fetch_all(&mut *tx).await?;
+        if ns.len() == per_page {
+            if let Some(last) = ns.last() {
+                next_cursor = Some(encode_cursor(last, order_by_name));
+            }
+        }
+        items.extend(ns);
+    }
+
+    tx.commit().await?;
+
+    Ok(Json(ListRunnablesResponse { items, next_cursor }))
+}
diff --git a/backend/windmill-api/src/utils.rs b/backend/windmill-api/src/utils.rs
index 5f472c49d3..3f27247d23 100644
--- a/backend/windmill-api/src/utils.rs
+++ b/backend/windmill-api/src/utils.rs
@@ -10,7 +10,8 @@ use axum::{body::Body, response::Response};
 use serde::{Deserialize, Deserializer};
 
 pub use windmill_api_auth::{
-    build_scope_path_predicate, check_scopes, require_devops_role, require_super_admin,
+    build_scope_path_filter, build_scope_path_predicate, check_scopes, require_devops_role,
+    require_super_admin, ScopePathFilter,
 };
 
 #[cfg(feature = "private")]
diff --git a/frontend/src/lib/components/home/ItemsList.svelte b/frontend/src/lib/components/home/ItemsList.svelte
index 49a0dc62ee..41de70108e 100644
--- a/frontend/src/lib/components/home/ItemsList.svelte
+++ b/frontend/src/lib/components/home/ItemsList.svelte
@@ -3,20 +3,22 @@
 	import { Badge, Button, Skeleton } from '$lib/components/common'
 	import Toggle from '$lib/components/Toggle.svelte'
 	import {
-		AppService,
 		AssetService,
-		FlowService,
+		FolderService,
+		UserService,
 		type ListableApp,
 		type Script,
 		ScriptService,
 		type Flow,
-		type ListableRawApp
+		type ListableRawApp,
+		type RunnableItem
 	} from '$lib/gen'
 	import { resource } from 'runed'
 	import { getDraftItems } from '$lib/workspaceDrafts.svelte'
 	import { userStore, workspaceStore } from '$lib/stores'
 	import type uFuzzy from '@leeoniya/ufuzzy'
 	import {
+		ArrowDownUp,
 		ChevronsDownUp,
 		ChevronsUpDown,
 		Code2,
@@ -25,6 +27,8 @@
 		SearchCode,
 		Tag
 	} from 'lucide-svelte'
+	import DropdownV2 from '$lib/components/DropdownV2.svelte'
+	import type { Item as MenuItem } from '$lib/utils'
 
 	import { HOME_SEARCH_SHOW_FLOW, HOME_SEARCH_PLACEHOLDER } from '$lib/consts'
 
@@ -35,6 +39,7 @@
 	import ToggleButton from '../common/toggleButton-v2/ToggleButton.svelte'
 	import FlowIcon from './FlowIcon.svelte'
 	import { canWrite, getLocalSetting, storeLocalSetting } from '$lib/utils'
+	import { sendUserToast } from '$lib/toast'
 	import { page } from '$app/state'
 	import { setQuery } from '$lib/navigation'
 	import Drawer from '../common/drawer/Drawer.svelte'
@@ -42,6 +47,7 @@
 	import DrawerContent from '../common/drawer/DrawerContent.svelte'
 	import Item from './Item.svelte'
 	import TreeViewRoot from './TreeViewRoot.svelte'
+	import type { ItemType } from './treeViewUtils'
 	import Popover from '$lib/components/meltComponents/Popover.svelte'
 	import { getContext, tick, untrack } from 'svelte'
 	import { triggerableByAI } from '$lib/actions/triggerableByAI.svelte'
@@ -67,6 +73,11 @@
 		time?: number
 		starred?: boolean
 		hash?: string
+		// Fetch ordinal: the position this row arrived in from the server (which already
+		// applied the chosen order + starred-first). Sorting by it reproduces the server's
+		// global order EXACTLY — no client re-derivation that could disagree on collation
+		// or sub-millisecond ties and make a later page jump above shown rows.
+		ord?: number
 	}
 
 	type TableScript = TableItem<Script, 'script'>
@@ -104,7 +115,7 @@
 		}
 	)
 	// Folders of pipeline-member scripts present in the current listing (captured
-	// in loadScripts before they're filtered out). Unioned in so a folder whose
+	// in loadRunnables before they're filtered out). Unioned in so a folder whose
 	// only pipeline node is a never-deployed `// pipeline` script draft — not in
 	// listPipelineFolders (deployed-only) nor a `data_pipeline` bundle — still gets
 	// a pipeline entry instead of vanishing.
@@ -113,10 +124,53 @@
 		new Set<string>([...(pipelineFoldersRes.current ?? []), ...pipelineMemberFolders])
 	)
 
+	// The workspace's full folder list, independent of which items are paged in,
+	// so the owner facet and tree show every folder even when its items sit far
+	// down the sorted stream. Cheap and cached per workspace.
+	let folderNamesRes = resource(
+		() => $workspaceStore,
+		async (ws) => {
+			if (!ws) return [] as string[]
+			// Page to exhaustion: listFolderNames is capped per page, so a workspace
+			// with more folders than the cap would otherwise be truncated.
+			const perPage = 1000
+			const all: string[] = []
+			try {
+				for (let page = 1; ; page++) {
+					const batch = await FolderService.listFolderNames({ workspace: ws, page, perPage })
+					all.push(...batch)
+					if (batch.length < perPage) break
+				}
+			} catch {
+				// Best-effort facet; return whatever we gathered.
+			}
+			return all
+		}
+	)
+	let allFolderOwners = $derived((folderNamesRes.current ?? []).map((f) => `f/${f}`))
+	// Every workspace username, so a user whose items sit beyond the loaded browse
+	// window is still a selectable owner chip (scoping the stream to `u/<user>/`).
+	// Without this, user owners would derive only from loaded rows and a user past
+	// the first page would be unreachable in the tree without searching.
+	let usernamesRes = resource(
+		() => $workspaceStore,
+		async (ws) => {
+			if (!ws) return [] as string[]
+			try {
+				return await UserService.listUsernames({ workspace: ws })
+			} catch {
+				return [] as string[] // best-effort facet
+			}
+		}
+	)
+	let allUserOwners = $derived((usernamesRes.current ?? []).map((u) => `u/${u}`))
+
 	let scripts: TableScript[] | undefined = $state()
 	let flows: TableFlow[] | undefined = $state()
 	let apps: TableApp[] | undefined = $state()
 	let raw_apps: TableRawApp[] | undefined = $state()
+	// Monotonic fetch-order counter stamped onto each row as it arrives (see TableItem.ord).
+	let fetchOrd = 0
 
 	let filteredItems: (TableScript | TableFlow | TableApp | TableRawApp)[] = $state([])
 
@@ -128,76 +182,301 @@
 
 	let nbDisplayed = $state(15)
 
-	async function loadScripts(includeWithoutMain: boolean): Promise<void> {
-		const loadedScripts = await ScriptService.listScripts({
-			workspace: $workspaceStore!,
-			showArchived: archived ? true : undefined,
-			includeWithoutMain: includeWithoutMain ? true : undefined,
-			includeDraftOnly: true,
-			withoutDescription: true
-		})
+	// Keyset cursor for the next browse page; null once the stream is exhausted.
+	let serverCursor: string | undefined = undefined
+	let hasMoreServer = $state(false)
+	// Guards against out-of-order responses: only the latest request applies.
+	let loadGen = 0
 
-		// Pipeline-member scripts (`auto_kind='pipeline'`) are represented by their
-		// pipeline's entry, not listed individually — but capture their folders so
-		// the pipeline entry still surfaces (incl. a members-only / draft-only folder).
-		const memberFolders = new Set<string>()
-		scripts = loadedScripts
-			.filter((script: Script) => {
-				if (script.auto_kind === 'pipeline') {
-					const m = script.path.match(/^f\/([^/]+)\//)
+	// Sort selector value -> merged-endpoint order params.
+	function sortToParams(o: SortOrder): { orderBy: 'updated' | 'name'; orderDesc: boolean } {
+		switch (o) {
+			case 'updated_asc':
+				return { orderBy: 'updated', orderDesc: false }
+			case 'name_asc':
+				return { orderBy: 'name', orderDesc: false }
+			case 'name_desc':
+				return { orderBy: 'name', orderDesc: true }
+			case 'updated_desc':
+			default:
+				return { orderBy: 'updated', orderDesc: true }
+		}
+	}
+
+	function mapRunnable(it: RunnableItem): TableScript | TableFlow | TableApp {
+		const base = {
+			...it,
+			canWrite:
+				canWrite(it.path, (it.extra_perms ?? {}) as any, $userStore) &&
+				(it.type === 'script' || it.workspace_id == $workspaceStore) &&
+				!$userStore?.operator
+		}
+		// combinedItems reads a script's time from `created_at`; the endpoint's
+		// unified `edited_at` holds exactly that for scripts.
+		if (it.type === 'script') return { ...base, created_at: it.edited_at } as unknown as TableScript
+		return base as unknown as TableFlow | TableApp
+	}
+
+	// The merged, server-ordered, keyset-paginated source. `reset` reloads from
+	// the first page (order/filter change or workspace switch); otherwise it
+	// appends the next page. All three kinds arrive interleaved and are split into
+	// the existing per-kind arrays so the downstream pipeline is unchanged.
+	async function loadRunnables(reset: boolean): Promise<void> {
+		const ws = $workspaceStore
+		if (!ws || !$userStore) return
+		// Only the very first load shows the skeleton; reorder/filter reloads keep
+		// the toolbar and current items visible (they're replaced on arrival) so the
+		// sort control itself doesn't flicker out when you use it.
+		// An append (load-more) needs a live cursor. If there isn't one — the stream
+		// is exhausted, or a reset just cleared it and its page-1 response hasn't
+		// landed — bail so a load-more can't append a fresh page-1 onto the old
+		// arrays (mixing streams) or clobber the pending reset's generation.
+		if (!reset && serverCursor === undefined) return
+		if (scripts === undefined) loading = true
+		if (reset) {
+			serverCursor = undefined
+			hasMoreServer = false
+			// Note: this resets only the global/flat stream. The lazy tree's own store
+			// (treeOwnerItems/ownerLoad/openOwners) is managed separately — a mode change
+			// clears it (see the treeKey effect), while an in-place sort/filter change
+			// replaces each open owner's rows atomically as they re-load (see
+			// loadOwnerItems), so expanded folders don't blank out mid-reorder.
+		}
+		const { orderBy, orderDesc } = sortToParams(sortOrder)
+		const gen = ++loadGen
+		// Snapshot the cursor now: a later request must not consume a cursor minted
+		// by an order/filter that has since changed.
+		const cursor = reset ? undefined : serverCursor
+		let res: { items: RunnableItem[]; next_cursor?: string }
+		try {
+			res = await ScriptService.listRunnables({
+				workspace: ws,
+				orderBy,
+				orderDesc,
+				showArchived: archived ? true : undefined,
+				includeWithoutMain: includeWithoutMain ? true : undefined,
+				kinds: itemKind !== 'all' ? itemKind : undefined,
+				// Selecting an owner/folder scopes the paged stream to it server-side,
+				// so a folder's full contents load on demand rather than relying on the
+				// folder happening to be within the loaded browse window.
+				pathStart: ownerFilter ? ownerFilter + '/' : undefined,
+				perPage: 100,
+				cursor
+			})
+		} catch (e: any) {
+			if (gen !== loadGen) return
+			loading = false
+			sendUserToast(`Failed to load items: ${e?.body ?? e?.message ?? e}`, true)
+			return
+		}
+		// A newer request superseded this one (e.g. order changed mid-flight); drop
+		// this response so a stale page/cursor can't be mixed with the new order.
+		if (gen !== loadGen) return
+		serverCursor = res.next_cursor ?? undefined
+		hasMoreServer = !!res.next_cursor
+
+		const s: TableScript[] = reset ? [] : [...(scripts ?? [])]
+		const f: TableFlow[] = reset ? [] : [...(flows ?? [])]
+		const a: TableApp[] = reset ? [] : [...(apps ?? [])]
+		const memberFolders = reset ? new Set<string>() : new Set(pipelineMemberFolders)
+		if (reset) fetchOrd = 0
+		for (const it of res.items ?? []) {
+			if (it.type === 'script') {
+				// Pipeline-member scripts are folded into their pipeline entry.
+				if (it.auto_kind === 'pipeline') {
+					const m = it.path.match(/^f\/([^/]+)\//)
 					if (m) memberFolders.add(m[1])
-					return false
+					continue
 				}
-				return true
-			})
-			.map((script: Script) => {
-				return {
-					canWrite: canWrite(script.path, script.extra_perms, $userStore) && !$userStore?.operator,
-					...script
-				}
-			})
+				s.push({ ...mapRunnable(it), ord: fetchOrd++ } as TableScript)
+			} else if (it.type === 'flow') {
+				f.push({ ...mapRunnable(it), ord: fetchOrd++ } as TableFlow)
+			} else if (it.type === 'app') {
+				a.push({ ...mapRunnable(it), ord: fetchOrd++ } as TableApp)
+			}
+		}
+		scripts = s
+		flows = f
+		apps = a
+		raw_apps = []
 		pipelineMemberFolders = memberFolders
 		loading = false
 	}
 
-	async function loadFlows(): Promise<void> {
-		flows = (
-			await FlowService.listFlows({
-				workspace: $workspaceStore!,
+	function itemKey(x: { type?: string; path: string; hash?: unknown }): string {
+		return `${x.type}/${x.path}${x.hash ? '/' + x.hash : ''}`
+	}
+
+	// Merge server rows (from the search-augmentation pass) into the loaded arrays,
+	// skipping ones already present. Lets a search reach matches outside the loaded
+	// browse window without re-fetching the whole list.
+	function mergeRunnables(newItems: RunnableItem[]) {
+		const have = new Set([...(scripts ?? []), ...(flows ?? []), ...(apps ?? [])].map(itemKey))
+		const s = [...(scripts ?? [])]
+		const f = [...(flows ?? [])]
+		const a = [...(apps ?? [])]
+		const memberFolders = new Set(pipelineMemberFolders)
+		let changed = false
+		for (const it of newItems) {
+			if (it.type === 'script' && it.auto_kind === 'pipeline') {
+				const m = it.path.match(/^f\/([^/]+)\//)
+				if (m) memberFolders.add(m[1])
+				continue
+			}
+			if (have.has(itemKey(it))) continue
+			// Appended after the browse window; a higher ord keeps them after it (search
+			// itself ranks by relevance, so this ordinal only matters if sort resumes).
+			const mapped = { ...mapRunnable(it), ord: fetchOrd++ }
+			if (it.type === 'script') s.push(mapped as TableScript)
+			else if (it.type === 'flow') f.push(mapped as TableFlow)
+			else if (it.type === 'app') a.push(mapped as TableApp)
+			changed = true
+		}
+		if (changed) {
+			scripts = s
+			flows = f
+			apps = a
+			pipelineMemberFolders = memberFolders
+		}
+	}
+
+	// Per-top-level-folder lazy loading for tree view: expanding a folder loads its
+	// items on demand (server-scoped to that folder), paginated within the folder,
+	// instead of relying on the global browse window. Keyed by folder name (the
+	// `f/<name>` node).
+	//
+	// Every top-level namespace — a folder (`f/<name>`) OR a user (`u/<name>`) — is a
+	// lazily-loaded owner, keyed here by its full path prefix. Its items live in their
+	// OWN store (`treeOwnerItems`), never merged into the global browse arrays: those
+	// advance by a single `serverCursor`, so injecting out-of-window rows there would
+	// make the flat stream non-contiguous and, once pagination reached those rows,
+	// duplicate them. Loading users lazily too (rather than sourcing them from the
+	// loaded window) is why a user node no longer vanishes under a name sort whose
+	// first page happens to be all folder rows. `treeGen` ties every request to the
+	// active scope (order/archived/library/kind/workspace); a reset bumps it so an
+	// in-flight response from a stale scope is discarded.
+	type OwnerLoadState = {
+		cursor?: string
+		hasMore: boolean
+		loading: boolean
+		loaded: boolean
+		gen: number
+		// Total rows fetched for this owner so far (leaves + subfolder rows) — the tree
+		// node's own children count undercounts because rows nest into subfolders.
+		count: number
+	}
+	let ownerLoad = $state<Record<string, OwnerLoadState>>({})
+	let treeOwnerItems = $state<ItemType[]>([])
+	let treeGen = 0
+	// Owners the user currently has expanded (full path prefixes). A reload re-fetches
+	// only these: ownerLoad also retains collapsed owners as a cache, so keying reloads
+	// off its entries would re-request every owner ever opened in this scope.
+	let openOwners = new Set<string>()
+
+	// The endpoint returns a unified `edited_at` per row; combinedItems derives every
+	// kind's sort time from it (scripts read it as `created_at`, see mapRunnable), so
+	// the owner store mirrors that to keep tree ordering consistent with the list.
+	function toTreeItem(it: RunnableItem): ItemType {
+		return {
+			...mapRunnable(it),
+			time: new Date(it.edited_at ?? 0).getTime()
+		} as unknown as ItemType
+	}
+
+	// `owner` is the full prefix: `f/<folder>` or `u/<username>`.
+	// `force` re-fetches an owner's first page even if already loaded (a re-sort /
+	// re-filter reload uses it to refresh the loaded rows in place).
+	async function loadOwnerItems(owner: string, more = false, force = false): Promise<void> {
+		const ws = $workspaceStore
+		if (!ws || !$userStore) return
+		// Track the owner as open first — even a no-op call (re-expanding a cached owner)
+		// means it's expanded, so later reloads must refresh it.
+		openOwners.add(owner)
+		const st = ownerLoad[owner]
+		// Only a load for the CURRENT generation blocks a new one. A load left in flight
+		// by a superseded generation (treeGen bumped on a sort/filter reload) has already
+		// been invalidated, so it must not wedge the owner as permanently loading.
+		if (st?.loading && st.gen === treeGen) return
+		if (!force && (more ? !st?.hasMore : st?.loaded)) return
+		const gen = treeGen
+		ownerLoad[owner] = {
+			cursor: st?.cursor,
+			hasMore: st?.hasMore ?? false,
+			loading: true,
+			loaded: st?.loaded ?? false,
+			gen,
+			// A fresh (non-more) load replaces this owner's rows, so its count restarts.
+			count: more ? (st?.count ?? 0) : 0
+		}
+		const { orderBy, orderDesc } = sortToParams(sortOrder)
+		let res: { items: RunnableItem[]; next_cursor?: string }
+		try {
+			res = await ScriptService.listRunnables({
+				workspace: ws,
+				orderBy,
+				orderDesc,
 				showArchived: archived ? true : undefined,
-				includeDraftOnly: true,
-				withoutDescription: true
+				includeWithoutMain: includeWithoutMain ? true : undefined,
+				kinds: itemKind !== 'all' ? itemKind : undefined,
+				pathStart: `${owner}/`,
+				perPage: 100,
+				cursor: more ? st?.cursor : undefined
 			})
-		).map((x: Flow) => {
-			return {
-				canWrite:
-					canWrite(x.path, x.extra_perms, $userStore) &&
-					x.workspace_id == $workspaceStore &&
-					!$userStore?.operator,
-				...x
-			}
-		})
-		loading = false
+		} catch (e: any) {
+			if (gen !== treeGen) return
+			ownerLoad[owner] = { ...ownerLoad[owner], loading: false }
+			sendUserToast(`Failed to load ${owner}: ${e?.body ?? e?.message ?? e}`, true)
+			return
+		}
+		// The scope moved on while this was in flight (order/archive/library/kind/
+		// workspace changed and reset the tree); drop the response so stale rows from
+		// another scope can't appear under the current one.
+		if (gen !== treeGen) return
+		// A fresh load REPLACES this owner's rows (drop its previous ones, keep every
+		// other owner's untouched) so a re-sort/re-filter swaps its items atomically
+		// without blanking the whole tree; load-more appends to what's already shown.
+		const prefix = `${owner}/`
+		const base = more ? treeOwnerItems : treeOwnerItems.filter((x) => !x.path.startsWith(prefix))
+		const have = new Set(base.map(itemKey))
+		const merged = [...base]
+		for (const it of res.items ?? []) {
+			// Pipeline-member scripts are folded into their folder's Pipeline entry, so
+			// they never render as their own tree leaf (visiblePipelineFolders drives it).
+			if (it.type === 'script' && it.auto_kind === 'pipeline') continue
+			if (have.has(itemKey(it))) continue
+			merged.push({ ...toTreeItem(it), ord: fetchOrd++ })
+		}
+		treeOwnerItems = merged
+		ownerLoad[owner] = {
+			cursor: res.next_cursor,
+			hasMore: !!res.next_cursor,
+			loading: false,
+			loaded: true,
+			gen,
+			count: merged.filter((x) => x.path.startsWith(prefix)).length
+		}
 	}
 
-	async function loadApps(): Promise<void> {
-		apps = (await AppService.listApps({ workspace: $workspaceStore!, includeDraftOnly: true })).map(
-			(app: ListableApp) => {
-				return {
-					canWrite:
-						canWrite(app.path!, app.extra_perms!, $userStore) &&
-						app.workspace_id == $workspaceStore &&
-						!$userStore?.operator,
-					...app
-				}
-			}
-		)
-		loading = false
+	function collapseOwner(owner: string): void {
+		openOwners.delete(owner)
 	}
-
-	async function loadRawApps(): Promise<void> {
-		raw_apps = []
-		loading = false
+	// Reload the merged list once and re-fetch the owners that are currently expanded so
+	// they don't go blank. Used both for row mutations (create/edit/archive/move/share)
+	// and for in-place scope changes (sort/archive/library/kind): those keep the tree in
+	// lazy mode (treeKey unchanged, so folders stay open like a file explorer), and the
+	// re-fetch reloads each open owner's items in the new order/filter. When a mode
+	// change (owner/search) has switched the tree out of lazy mode, there's nothing to
+	// re-fetch — the tree remounts and groups the global stream instead.
+	async function reloadItems(): Promise<void> {
+		// Invalidate any in-flight owner loads from the previous sort/filter so their
+		// late responses can't overwrite the fresh ones.
+		treeGen++
+		const toReload = treeLazyMode ? [...openOwners] : []
+		await loadRunnables(true)
+		// force: the owners are still marked loaded, so re-fetch their first page and
+		// swap it in place (loadOwnerItems replaces each owner's rows atomically — the
+		// old rows stay visible until the new ones arrive, so nothing blanks mid-reorder).
+		for (const o of toReload) loadOwnerItems(o, false, true)
 	}
 
 	function filterItemsPathsBaseOnUserFilters(
@@ -217,6 +496,46 @@
 
 	const cmp = new Intl.Collator('en').compare
 
+	// The selected order maps to the endpoint's order_by/order_desc (see
+	// sortToParams) so it is applied server-side and stays correct across the
+	// whole workspace, not just loaded pages. Starred items are pinned on top of
+	// the first page.
+	type SortOrder = 'updated_desc' | 'updated_asc' | 'name_asc' | 'name_desc'
+	const SORT_SETTING_NAME = 'homeSort'
+	// `short` labels the trigger button next to the sort icon (the button is icon-only
+	// only while searching, when sorting is disabled — see below).
+	const sortOptions: { value: SortOrder; label: string; short: string }[] = [
+		{ value: 'updated_desc', label: 'Recently updated', short: 'Recent' },
+		{ value: 'updated_asc', label: 'Oldest updated', short: 'Oldest' },
+		{ value: 'name_asc', label: 'Name (A-Z)', short: 'A-Z' },
+		{ value: 'name_desc', label: 'Name (Z-A)', short: 'Z-A' }
+	]
+	let sortOrder = $state<SortOrder>(
+		sortOptions.find((o) => o.value === getLocalSetting(SORT_SETTING_NAME))?.value ?? 'updated_desc'
+	)
+	$effect(() => {
+		storeLocalSetting(SORT_SETTING_NAME, sortOrder === 'updated_desc' ? undefined : sortOrder)
+	})
+	let sortItems: MenuItem[] = $derived(
+		sortOptions.map((o) => ({
+			displayName: o.label,
+			selected: o.value === sortOrder,
+			action: () => (sortOrder = o.value)
+		}))
+	)
+	// Preserve the endpoint's exact order rather than re-deriving it on the client:
+	// each row carries its server fetch ordinal (`ord`), which already reflects the
+	// chosen order, the (path, kind) tiebreaks, full-precision timestamps, the database
+	// collation, and starred-first pinning. Sorting by it can never disagree with the
+	// server, so a later page never jumps above shown rows on "load more". Depends on
+	// `sortOrder` only so its identity changes when the order does (re-grouping the tree,
+	// whose leaves also sort by ord); the actual reordering comes from the reload that
+	// restamps ord.
+	let compareItems = $derived.by(() => {
+		sortOrder
+		return (a: { ord?: number }, b: { ord?: number }): number => (a.ord ?? 0) - (b.ord ?? 0)
+	})
+
 	const opts: uFuzzy.Options = {
 		sort: (info, haystack, needle) => {
 			let {
@@ -328,28 +647,189 @@
 	}
 
 	let collapseAll = $state(true)
+	// Human-readable list of the filters currently narrowing the list. Empty means no
+	// filter is active, so an empty result then means the workspace itself has no items
+	// (NoItemFound shows the welcome message); otherwise the filters are just too narrow
+	// and NoItemFound lists them.
+	let activeFilters = $derived.by(() => {
+		const f: string[] = []
+		if (filter !== '') f.push(`search “${filter}”`)
+		if (itemKind !== 'all')
+			f.push(itemKind === 'script' ? 'Scripts' : itemKind === 'flow' ? 'Flows' : 'Apps')
+		if (ownerFilter != undefined) f.push(ownerFilter)
+		if (labelFilter != undefined) f.push(`label “${labelFilter}”`)
+		if (archived) f.push('archived only')
+		if (filterUserFolders)
+			f.push(
+				filterUserFoldersType === 'only f/*'
+					? 'only f/* folders'
+					: `only f/* and u/${$userStore?.username}`
+			)
+		if (!includeWithoutMain) f.push('library scripts hidden')
+		return f
+	})
+	// Complete owner list: every folder (from the folder list, not just loaded
+	// pages) plus the user prefixes present in the loaded/filtered items. So a
+	// folder whose items are far down the stream is still a selectable chip.
 	let owners = $derived(
 		Array.from(
-			new Set(filteredItems?.map((x) => x.path.split('/').slice(0, 2).join('/')) ?? [])
+			new Set([
+				...allFolderOwners,
+				...allUserOwners,
+				...(filteredItems?.map((x) => x.path.split('/').slice(0, 2).join('/')) ?? [])
+			])
 		).sort()
 	)
+	// Reload from the server whenever an input the endpoint resolves changes: order,
+	// archived/library scope, kind, the selected owner/folder, or entering/leaving
+	// search (see the reload effect below). Only the label filter and fuzzy ranking
+	// stay client-side over the loaded pages, so they don't reload here.
+	let searching = $derived(filter !== '')
+	// Lazy owner tree is active only in the tree view when browsing all (no owner
+	// selected, no search, no label filter): every folder AND user shows as a top-level
+	// node and paginates on expand, its items coming from the separate `treeOwnerItems`
+	// store. In the flat view, or a selected owner / active search / label filter, the
+	// lazy store is unused (the flat list and reloadItems must not touch it), so this is
+	// false and those views group the global loaded window instead.
+	let treeLazyMode = $derived(
+		treeView && !searching && ownerFilter == undefined && labelFilter == undefined
+	)
+	let treeInjectFolders = $derived(treeLazyMode ? (folderNamesRes.current ?? []) : [])
+	let treeInjectUsers = $derived.by(() => {
+		// "Only f/*" hides every user namespace; "u/<you> and f/*" keeps just your own.
+		if (!treeLazyMode) return []
+		if (filterUserFolders && filterUserFoldersType === 'only f/*') return []
+		const s = new Set<string>()
+		// Always inject your own personal space (u/<you>): list_usernames can be empty
+		// (you may not be a listed workspace member) yet u/<you> still holds runnables,
+		// and it must not vanish under a name sort whose first page is all folders.
+		if ($userStore?.username) s.add($userStore.username)
+		// Other users only when no user-folder restriction is active.
+		if (!filterUserFolders) for (const u of usernamesRes.current ?? []) s.add(u)
+		return [...s]
+	})
+	// The bottom "load more" only pages the *global* stream, which in lazy mode holds
+	// folder rows the tree ignores (folders come from the store and are all injected
+	// already) — so surfacing it there is confusing. Restrict it to scoped mode, where
+	// it pages within the selected owner. In lazy mode the footer instead reveals more
+	// root nodes purely client-side (nbDisplayed) when there are more than are shown,
+	// and each folder paginates within itself; users past the window are reached via
+	// their owner chip.
+	let treeGlobalHasMore = $derived(ownerFilter != undefined && !searching ? hasMoreServer : false)
 	$effect(() => {
 		if ($userStore && $workspaceStore) {
-			;[archived, includeWithoutMain]
+			;[archived, includeWithoutMain, sortOrder, searching, ownerFilter, itemKind]
+			// reloadItems (not a bare loadRunnables) so an in-place change — sort, archive,
+			// library, kind — reloads the global stream AND re-fetches the currently-open
+			// owners in the new order/filter, keeping folders expanded (file-explorer style)
+			// rather than collapsing them. Mode changes (owner/search) flip treeLazyMode, so
+			// reloadItems skips the re-fetch and the {#key} remount handles the reset.
 			untrack(() => {
-				loadScripts(includeWithoutMain)
-				loadFlows()
-				if (!archived) {
-					loadApps()
-					loadRawApps()
-				} else {
-					apps = []
-					raw_apps = []
-				}
+				reloadItems()
 			})
 		}
 	})
 
+	// Debounced server-side search augmentation. Instant filtering stays fully
+	// client-side (SearchItems over the loaded pages) for reactivity; this fetches ONE
+	// page of matches beyond the loaded browse window and, if the server has more,
+	// exposes them through an explicit "load more results" control (searchCursor) rather
+	// than auto-downloading the whole workspace for a broad term.
+	let searchCursor = $state<string | undefined>(undefined)
+	let searchLoadingMore = $state(false)
+	$effect(() => {
+		const term = filter
+		const ws = $workspaceStore
+		// Same view scope as the browse list, so a search can't surface archived /
+		// library items the current view excludes, and stays within the selected folder.
+		const showArchived = archived
+		const withoutMain = includeWithoutMain
+		const owner = ownerFilter
+		const kind = itemKind
+		// Any term/scope change restarts search paging.
+		searchCursor = undefined
+		if (term === '' || !ws || !$userStore) return
+		const handle = setTimeout(async () => {
+			let res: { items: RunnableItem[]; next_cursor?: string }
+			try {
+				res = await ScriptService.listRunnables({
+					workspace: ws,
+					search: term,
+					showArchived: showArchived ? true : undefined,
+					includeWithoutMain: withoutMain ? true : undefined,
+					kinds: kind !== 'all' ? kind : undefined,
+					pathStart: owner ? owner + '/' : undefined,
+					perPage: 1000
+				})
+			} catch {
+				return
+			}
+			// Drop a stale response: workspace, term, or view scope moved on while it was
+			// in flight (the debounce cancels superseded timers; this guards the request).
+			if (
+				untrack(() => $workspaceStore) !== ws ||
+				untrack(() => filter) !== term ||
+				untrack(() => archived) !== showArchived ||
+				untrack(() => includeWithoutMain) !== withoutMain ||
+				untrack(() => ownerFilter) !== owner ||
+				untrack(() => itemKind) !== kind
+			)
+				return
+			mergeRunnables(res.items ?? [])
+			searchCursor = res.next_cursor
+		}, 300)
+		return () => clearTimeout(handle)
+	})
+
+	// Fetch the next page of search matches on demand — one page per click, so a broad
+	// search stays complete without auto-loading the entire workspace into memory.
+	async function loadMoreSearchResults(): Promise<void> {
+		// Capture the full scope: a cursor only encodes the last row's sort keys, so two
+		// different scopes can mint the same cursor — the response must be rejected unless
+		// EVERY scope input still matches, not just workspace + cursor.
+		const ws = $workspaceStore
+		const term = filter
+		const showArchived = archived
+		const withoutMain = includeWithoutMain
+		const owner = ownerFilter
+		const kind = itemKind
+		const cursor = searchCursor
+		if (!cursor || !ws || term === '' || searchLoadingMore) return
+		searchLoadingMore = true
+		let res: { items: RunnableItem[]; next_cursor?: string }
+		try {
+			res = await ScriptService.listRunnables({
+				workspace: ws,
+				search: term,
+				showArchived: showArchived ? true : undefined,
+				includeWithoutMain: withoutMain ? true : undefined,
+				kinds: kind !== 'all' ? kind : undefined,
+				pathStart: owner ? owner + '/' : undefined,
+				perPage: 1000,
+				cursor
+			})
+		} catch {
+			searchLoadingMore = false
+			return
+		}
+		searchLoadingMore = false
+		// Discard unless the term AND every view scope are still the ones we fetched for.
+		if (
+			untrack(() => $workspaceStore) !== ws ||
+			untrack(() => filter) !== term ||
+			untrack(() => archived) !== showArchived ||
+			untrack(() => includeWithoutMain) !== withoutMain ||
+			untrack(() => ownerFilter) !== owner ||
+			untrack(() => itemKind) !== kind ||
+			untrack(() => searchCursor) !== cursor
+		)
+			return
+		mergeRunnables(res.items ?? [])
+		searchCursor = res.next_cursor
+		// Reveal the freshly fetched matches instead of leaving them behind the display cap.
+		nbDisplayed += 30
+	}
+
 	let combinedItems = $derived(
 		flows == undefined || scripts == undefined || apps == undefined || raw_apps == undefined
 			? undefined
@@ -374,9 +854,7 @@
 						type: 'raw_app' as 'raw_app',
 						time: new Date(x.edited_at).getTime()
 					}))
-				].sort((a, b) =>
-					a.starred != b.starred ? (a.starred ? -1 : 1) : a.time - b.time > 0 ? -1 : 1
-				)
+				].sort(compareItems)
 	)
 	function itemLabels(x: { labels?: string[]; inherited_labels?: string[] }): string[] {
 		return [...(x.labels ?? []), ...(x.inherited_labels ?? [])]
@@ -396,30 +874,60 @@
 		}
 		prevWorkspace = ws
 	})
+	// The kind and owner/folder filters are resolved server-side (kinds, path_start),
+	// so only the user-folder toggle and label filters run client-side here.
 	let preFilteredItems = $derived(
-		ownerFilter != undefined
-			? combinedItems?.filter(
-					(x) =>
-						x.path.startsWith(ownerFilter + '/') &&
-						(x.type == itemKind || itemKind == 'all') &&
-						filterItemsPathsBaseOnUserFilters(x, filterUserFolders, filterUserFoldersType) &&
-						(labelFilter == undefined || itemLabels(x).includes(labelFilter))
-				)
-			: combinedItems?.filter(
-					(x) =>
-						(x.type == itemKind || itemKind == 'all') &&
-						filterItemsPathsBaseOnUserFilters(x, filterUserFolders, filterUserFoldersType) &&
-						(labelFilter == undefined || itemLabels(x).includes(labelFilter))
-				)
+		combinedItems?.filter(
+			(x) =>
+				filterItemsPathsBaseOnUserFilters(x, filterUserFolders, filterUserFoldersType) &&
+				(labelFilter == undefined || itemLabels(x).includes(labelFilter))
+		)
 	)
 	let items = $derived(filter !== '' ? filteredItems : preFilteredItems)
+	// Source the tree groups. In lazy mode every top-level owner (folder and user) is
+	// injected as a node and its rows come from the on-demand `treeOwnerItems` store,
+	// so the tree never depends on which owners happen to be in the loaded window.
+	// Otherwise (scoped/search/label) the tree just groups the global `items`.
+	let treeSource = $derived(
+		treeLazyMode
+			? treeOwnerItems.filter((x) =>
+					filterItemsPathsBaseOnUserFilters(x, filterUserFolders, filterUserFoldersType)
+				)
+			: items
+	)
+	// Remount identity: only a *mode* change (workspace, selected owner, entering/leaving
+	// search, label filter) restructures the tree, so only those key the {#key} remount.
+	// A sort/archive/library/kind change keeps the same lazy tree and is applied in place
+	// by reloadItems re-fetching the open owners — so expanded folders don't collapse when
+	// you re-sort (searching is a boolean so per-keystroke query changes don't remount).
+	let treeKey = $derived(
+		`${treeView}|${$workspaceStore}|${ownerFilter}|${searching}|${labelFilter}`
+	)
+	// A mode change restructures the tree (it remounts on treeKey), so the lazy owner
+	// store is stale — clear it here (the global reset no longer does). An in-place
+	// sort/filter change leaves treeKey unchanged, so the store survives and its owners
+	// are refreshed in place instead of blanking.
+	$effect(() => {
+		treeKey
+		untrack(() => {
+			treeGen++
+			ownerLoad = {}
+			treeOwnerItems = []
+			openOwners = new Set()
+		})
+	})
 	let displayedItems = $derived((items ?? []).slice(0, nbDisplayed))
 	$effect(() => {
 		items && resetScroll()
 	})
 
 	let selectedIndex: number = $state(-1)
-	let hasMore = $derived(items != undefined && items.length > nbDisplayed)
+	// More to show: either loaded items not yet sliced in, or the server has further
+	// browse pages (not while searching — the browse cursor is paused then; further
+	// search matches load on demand via searchCursor / "Load more results").
+	let hasMore = $derived(
+		items != undefined && (items.length > nbDisplayed || (hasMoreServer && !searching))
+	)
 	let loadMoreIndex = $derived(displayedItems.length)
 	let loadMoreEl: HTMLButtonElement | undefined = $state()
 	let pendingAutoSelect = $state(true)
@@ -485,9 +993,27 @@
 		return () => window.removeEventListener('keydown', handleGlobalKeydown, true)
 	})
 
-	function loadMoreAndPreselectFirstNew() {
-		const previousNbDisplayed = nbDisplayed
+	async function loadMore() {
+		// Fetch the next server page once all loaded items are already sliced in.
+		if (items && nbDisplayed >= items.length && hasMoreServer && !searching) {
+			await loadRunnables(false)
+		}
 		nbDisplayed += 30
+	}
+
+	// Fetch the next server page directly (tree view and the empty-state control
+	// use this — their "all shown" threshold is on a different scale than the flat
+	// list's, so they must not route through loadMore's item-count check).
+	async function fetchMoreServer() {
+		if (hasMoreServer && !searching) {
+			await loadRunnables(false)
+			nbDisplayed += 30
+		}
+	}
+
+	async function loadMoreAndPreselectFirstNew() {
+		const previousNbDisplayed = nbDisplayed
+		await loadMore()
 		selectedIndex = previousNbDisplayed
 	}
 
@@ -855,6 +1381,32 @@
 					/>
 				{/if}
 				<Toggle size="xs" bind:checked={treeView} options={{ right: 'Tree view' }} />
+				<DropdownV2
+					items={sortItems}
+					disabled={filter !== ''}
+					placement="bottom-end"
+					fixedHeight={false}
+				>
+					{#snippet buttonReplacement()}
+						{@const active = sortOptions.find((o) => o.value === sortOrder)}
+						{@const short = filter !== '' ? '' : (active?.short ?? '')}
+						<Button
+							nonCaptureEvent
+							disabled={filter !== ''}
+							iconOnly={short === ''}
+							size="xs"
+							color="light"
+							variant="default"
+							spacingSize="xs2"
+							startIcon={{ icon: ArrowDownUp }}
+							title={filter !== ''
+								? 'Sorting is disabled while searching (results are ranked by relevance)'
+								: `Sort: ${active?.label ?? ''}`}
+						>
+							{#if short !== ''}{short}{/if}
+						</Button>
+					{/snippet}
+				</DropdownV2>
 				{#if treeView}
 					<Button
 						unifiedSize="sm"
@@ -885,26 +1437,46 @@
 			<!-- Pipelines aren't part of the text filter, so only fall through to show
 			     them (list rows / injected tree folders) when not actively searching;
 			     a no-match search still reads as empty. -->
-			<NoItemFound hasFilters={filter !== '' || archived || filterUserFolders} />
+			<NoItemFound {activeFilters} />
+			{#if hasMoreServer && !searching}
+				<!-- The active filter matched nothing on the loaded pages, but the server
+				     has more: keep paging reachable so matches on later pages aren't lost. -->
+				<div class="text-center text-xs text-secondary mt-2">
+					<button class="text-primary hover:text-emphasis underline" onclick={fetchMoreServer}
+						>Load more to search further</button
+					>
+				</div>
+			{/if}
 		{:else if treeView}
-			<TreeViewRoot
-				{items}
-				{nbDisplayed}
-				{collapseAll}
-				pipelineFolders={visiblePipelineFolders}
-				isSearching={filter !== ''}
-				on:scriptChanged={() => loadScripts(includeWithoutMain)}
-				on:flowChanged={loadFlows}
-				on:appChanged={loadApps}
-				on:rawAppChanged={loadRawApps}
-				on:reload={() => {
-					loadScripts(includeWithoutMain)
-					loadFlows()
-					loadApps()
-					loadRawApps()
-				}}
-				{showCode}
-			/>
+			<!-- Remount the tree on a MODE change only (treeKey = view/owner/search/label):
+			     expanded folders (their `opened` state is local to each TreeView) collapse
+			     and re-load fresh for the new mode. An in-place order/archive/library/kind
+			     change keeps treeKey stable, so folders stay open and refresh via
+			     reloadItems instead (see loadOwnerItems). -->
+			{#key treeKey}
+				<TreeViewRoot
+					items={treeSource}
+					{nbDisplayed}
+					{collapseAll}
+					sortCompare={compareItems}
+					groupDesc={sortOrder === 'name_desc'}
+					hasMoreServer={treeGlobalHasMore}
+					onLoadMore={fetchMoreServer}
+					pipelineFolders={visiblePipelineFolders}
+					allFolders={treeInjectFolders}
+					allUsers={treeInjectUsers}
+					ownerLoad={treeLazyMode ? ownerLoad : undefined}
+					onExpandOwner={treeLazyMode ? loadOwnerItems : undefined}
+					onCollapseOwner={treeLazyMode ? collapseOwner : undefined}
+					isSearching={filter !== ''}
+					on:scriptChanged={reloadItems}
+					on:flowChanged={reloadItems}
+					on:appChanged={reloadItems}
+					on:rawAppChanged={reloadItems}
+					on:reload={reloadItems}
+					{showCode}
+				/>
+			{/key}
 		{:else}
 			<div class="border rounded-md bg-surface-tertiary">
 				{#if filter === ''}
@@ -921,35 +1493,46 @@
 				{#each displayedItems as item, i (item.type + '/' + item.path + (item.hash ? '/' + item.hash : ''))}
 					<Item
 						{item}
-						on:scriptChanged={() => loadScripts(includeWithoutMain)}
-						on:flowChanged={loadFlows}
-						on:appChanged={loadApps}
-						on:rawAppChanged={loadRawApps}
-						on:reload={() => {
-							loadScripts(includeWithoutMain)
-							loadFlows()
-							loadApps()
-							loadRawApps()
-						}}
+						on:scriptChanged={reloadItems}
+						on:flowChanged={reloadItems}
+						on:appChanged={reloadItems}
+						on:rawAppChanged={reloadItems}
+						on:reload={reloadItems}
 						{showCode}
 						showEditButton={showEditButtons}
 						keyboardSelected={selectedIndex === i}
 					/>
 				{/each}
 			</div>
-			{#if items && items?.length > 15 && nbDisplayed < items.length}
+			{#if items && hasMore}
 				<span class="text-xs font-normal text-secondary"
-					>{nbDisplayed} items out of {items.length}
+					>{Math.min(nbDisplayed, items.length)} items{hasMoreServer && !searching
+						? ''
+						: ` out of ${items.length}`}
 					<button
 						bind:this={loadMoreEl}
 						class="ml-4 text-xs font-normal text-primary hover:text-emphasis rounded px-1 {selectedIndex ===
 						loadMoreIndex
 							? 'bg-gray-200 dark:bg-gray-700 underline'
 							: ''}"
-						onclick={() => (nbDisplayed += 30)}>load 30 more</button
+						onclick={loadMore}>load 30 more</button
 					></span
 				>
 			{/if}
 		{/if}
+		{#if searching && searchCursor}
+			<!-- The server has further search matches beyond the page already merged in;
+			     fetch them one page at a time on demand rather than auto-downloading a
+			     broad query's entire result set. -->
+			<div class="text-center text-xs text-secondary mt-2">
+				{#if searchLoadingMore}
+					Loading more results…
+				{:else}
+					<button class="text-primary hover:text-emphasis underline" onclick={loadMoreSearchResults}
+						>Load more results</button
+					>
+				{/if}
+			</div>
+		{/if}
 	</div>
 </CenteredPage>
diff --git a/frontend/src/lib/components/home/NoItemFound.svelte b/frontend/src/lib/components/home/NoItemFound.svelte
index 75778a4637..dd88ea9d4f 100644
--- a/frontend/src/lib/components/home/NoItemFound.svelte
+++ b/frontend/src/lib/components/home/NoItemFound.svelte
@@ -1,24 +1,39 @@
 <script lang="ts">
 	interface Props {
 		hasFilters?: boolean
+		// When provided (home page), it's the authoritative list of active filters:
+		// non-empty means the current filters are too narrow (and are listed to the
+		// user); empty means the workspace itself has no items. Takes precedence over
+		// `hasFilters`, which other callers still use as a plain boolean.
+		activeFilters?: string[]
 	}
 
-	let { hasFilters = false }: Props = $props()
+	let { hasFilters = false, activeFilters }: Props = $props()
+
+	let narrowed = $derived(activeFilters != undefined ? activeFilters.length > 0 : hasFilters)
 </script>
 
-{#if hasFilters}
+{#if narrowed}
 	<div class="flex justify-center items-center h-48">
-		<div class="text-primary text-center">
-			<div class="text-lg font-semibold text-emphasis">No items found</div>
-			<div class="text-xs font-normal text-hint">Try changing your search or filters</div>
+		<div class="text-primary text-center max-w-md px-4">
+			<div class="text-lg font-semibold text-emphasis">No items match the current filters</div>
+			{#if activeFilters && activeFilters.length > 0}
+				<div class="text-xs font-normal text-hint mt-1">
+					Active: {activeFilters.join(' · ')}
+				</div>
+				<div class="text-xs font-normal text-hint mt-0.5">Clear or widen them to see more.</div>
+			{:else}
+				<div class="text-xs font-normal text-hint">Try changing your search or filters</div>
+			{/if}
 		</div>
 	</div>
 {:else}
 	<div class="flex justify-center items-center h-48">
 		<div class="text-primary text-center">
 			<div class="text-lg font-semibold text-emphasis">Welcome to Windmill</div>
-			<div class="text-xs font-normal text-hint">Get started by creating your first script, flow, or app</div>
+			<div class="text-xs font-normal text-hint">
+				Get started by creating your first script, flow, or app
+			</div>
 		</div>
 	</div>
 {/if}
-
diff --git a/frontend/src/lib/components/home/TreeView.svelte b/frontend/src/lib/components/home/TreeView.svelte
index aa8a3d2b14..e437ccddf1 100644
--- a/frontend/src/lib/components/home/TreeView.svelte
+++ b/frontend/src/lib/components/home/TreeView.svelte
@@ -1,5 +1,6 @@
 <script lang="ts">
 	import TreeView from './TreeView.svelte'
+	import { untrack } from 'svelte'
 
 	import { ChevronDown, ChevronUp, Folder, FolderTree, NetworkIcon, User } from 'lucide-svelte'
 	import Item from './Item.svelte'
@@ -15,6 +16,18 @@
 		showCode: (path: string, summary: string) => void
 		isSearching?: boolean
 		pipelineFolders?: Set<string>
+		// Lazy per-owner loading (top-level folders and users only): expanding an owner
+		// loads its items on demand and paginates within it. `ownerLoad` keys are full
+		// path prefixes (`f/<name>` / `u/<name>`).
+		ownerLoad?: Record<
+			string,
+			{ cursor?: string; hasMore: boolean; loading: boolean; loaded: boolean; count: number }
+		>
+		onExpandOwner?: (owner: string, more?: boolean) => void
+		onCollapseOwner?: (owner: string) => void
+		// Position of this node among the rendered root nodes; "expand all" only
+		// auto-loads the first EXPAND_ALL_LOAD_LIMIT of them (see the effect below).
+		rootIndex?: number
 	}
 
 	let {
@@ -23,10 +36,22 @@
 		depth = 0,
 		showCode,
 		isSearching = false,
-		pipelineFolders
+		pipelineFolders,
+		ownerLoad,
+		onExpandOwner,
+		onCollapseOwner,
+		rootIndex = 0
 	}: Props = $props()
 
+	// Bounds the request burst from "expand all": however many root owners are rendered
+	// (nbDisplayed can grow via "load 30 more"), it fetches at most this many. Lazy
+	// owners past the cap stay collapsed and load on a single click (see the effect).
+	const EXPAND_ALL_LOAD_LIMIT = 20
+
 	const isFolderItem = (i: typeof item): i is FolderItem => i && 'folderName' in i
+	const isFolder = isFolderItem
+	const isUser = (i: typeof item): i is UserItem => i && 'username' in i
+
 	// Hidden while searching: pipelines aren't part of the text filter (the list
 	// view hides their rows on a query too), so a folder matching the search
 	// shouldn't surface an unrelated Pipeline row.
@@ -37,23 +62,89 @@
 			(pipelineFolders?.has(item.folderName) ?? false)
 	)
 
-	const isFolder = isFolderItem
-	const isUser = (i: typeof item): i is UserItem => i && 'username' in i
-
 	let opened: boolean = $state(true)
 
+	// Full path prefix of this node when it's a top-level owner (folder or user).
+	let ownerKey = $derived(
+		depth === 0
+			? isFolder(item)
+				? `f/${item.folderName}`
+				: isUser(item)
+					? `u/${item.username}`
+					: undefined
+			: undefined
+	)
+	// A top-level owner in lazy mode: its items load on demand into a separate store
+	// (ownerLoad tracks per-owner state), so its count/pagination differ from a node
+	// whose items are already grouped from the loaded window.
+	let isLazyOwner = $derived(ownerKey != undefined && ownerLoad != undefined)
+	let ownerState = $derived(ownerKey != undefined ? ownerLoad?.[ownerKey] : undefined)
+
 	let showMax = $state(15)
+	// A lazy owner paginates server-side ("Load more"), so when opened on its own it
+	// shows all its already-loaded rows (no second, confusing client "Show more").
+	// EXCEPT under "expand all" (collapseAll=false), which opens every visible owner at
+	// once — rendering all of each would be thousands of rows and freeze the tab — so
+	// there we cap to the client slice and let "Show more" reveal the rest per owner.
+	let effectiveMax = $derived(
+		isLazyOwner && ownerState != undefined && (isFolder(item) || isUser(item))
+			? collapseAll
+				? item.items.length
+				: Math.min(item.items.length, showMax)
+			: showMax
+	)
+
 	$effect(() => {
-		opened = !collapseAll
+		const expandAll = !collapseAll
+		untrack(() => {
+			// "Expand all" opens every node — EXCEPT LAZY top-level owners past the request
+			// cap: opening those without loading would leave them empty and take two clicks
+			// to load (the first would just collapse). Keep them closed so one click
+			// opens+loads them. Only lazy owners (ownerLoad present) issue requests, so a
+			// non-lazy owner (e.g. label-filtered mode, already loaded) is never capped.
+			const cappedOwner =
+				expandAll &&
+				depth === 0 &&
+				ownerKey != undefined &&
+				ownerLoad != undefined &&
+				rootIndex >= EXPAND_ALL_LOAD_LIMIT
+			const shouldOpen = expandAll && !cappedOwner
+			opened = shouldOpen
+			if (ownerKey == undefined) return
+			if (shouldOpen) {
+				// Open+load this owner (onExpandOwner is a no-op for non-lazy owners).
+				onExpandOwner?.(ownerKey)
+			} else {
+				// Closed here (collapse all, or a capped lazy owner): untrack it so a later
+				// reload doesn't re-fetch a hidden owner, recreating the fan-out openOwners
+				// exists to prevent.
+				onCollapseOwner?.(ownerKey)
+			}
+		})
 	})
+	let lastToggle = 0
+	function toggleOwner() {
+		// A double-click would otherwise toggle twice — expand then immediately collapse,
+		// and for a lazy owner waste the fetch the first click kicked off, which reads as
+		// the node "expanding and collapsing at once". Swallow a second toggle landing
+		// within 300ms so a rapid double-click settles open.
+		const now = Date.now()
+		if (now - lastToggle < 300) return
+		lastToggle = now
+		opened = !opened
+		if (ownerKey != undefined) {
+			if (opened) onExpandOwner?.(ownerKey)
+			else onCollapseOwner?.(ownerKey)
+		}
+	}
 </script>
 
-{#if isFolder(item)}
+{#if isFolder(item) || isUser(item)}
 	<div>
 		<!-- svelte-ignore a11y_click_events_have_key_events -->
 		<!-- svelte-ignore a11y_no_static_element_interactions -->
 		<div
-			onclick={() => (opened = !opened)}
+			onclick={toggleOwner}
 			class="px-4 py-2 border-b w-full flex flex-row items-center justify-between cursor-pointer"
 		>
 			<div
@@ -61,7 +152,9 @@
 				style={depth > 0 ? `padding-left: ${depth * 16}px;` : ''}
 			>
 				<div class="flex justify-center items-center">
-					{#if depth === 0}
+					{#if isUser(item)}
+						<User size={16} class="text-secondary" />
+					{:else if depth === 0}
 						<Folder size={16} class="text-secondary" />
 					{:else}
 						<FolderTree size={16} class="text-secondary" />
@@ -69,11 +162,19 @@
 				</div>
 
 				<div>
-					<span class="whitespace-nowrap text-xs text-emphasis font-semibold"
-						>{#if depth === 0}f/{/if}{item.folderName}</span
-					>
+					<span class="whitespace-nowrap text-xs text-emphasis font-semibold">
+						{#if isUser(item)}u/{item.username}{:else}{#if depth === 0}f/{/if}{item.folderName}{/if}
+					</span>
 					<div class="text-2xs font-normal text-secondary whitespace-nowrap">
-						({pluralize(item.items.length, ' item')})
+						{#if isLazyOwner && !ownerState?.loaded}
+							<!-- Lazy owner not expanded yet: its true item count is unknown until
+							     loaded, so showing "(0 items)" would be misleading. -->
+							&nbsp;
+						{:else if isLazyOwner && ownerState?.hasMore}
+							({item.items.length}+ items)
+						{:else}
+							({pluralize(item.items.length, ' item')})
+						{/if}
 					</div>
 				</div>
 			</div>
@@ -100,7 +201,7 @@
 						<span class="text-xs font-medium text-emphasis">Pipeline</span>
 					</a>
 				{/if}
-				{#each item.items.slice(0, showMax) as subItem, index ((subItem['path'] ? subItem['type'] + '__' + subItem['path'] + '__' + index : undefined) ?? 'folder__' + subItem['folderName'] + '__' + index)}
+				{#each item.items.slice(0, effectiveMax) as subItem, index ((subItem['path'] ? subItem['type'] + '__' + subItem['path'] + '__' + index : undefined) ?? 'folder__' + subItem['folderName'] + '__' + index)}
 					<TreeView
 						{isSearching}
 						{collapseAll}
@@ -115,85 +216,36 @@
 						depth={depth + 1}
 					/>
 				{/each}
-				{#if showMax < item.items.length}
+				{#if effectiveMax < item.items.length}
 					<!-- svelte-ignore a11y_click_events_have_key_events -->
 					<!-- svelte-ignore a11y_no_static_element_interactions -->
 					<div
 						class="text-center text-xs py-2 text-secondary cursor-pointer hover:text-primary"
 						onclick={() => {
-							if (isFolder(item)) {
-								showMax += Math.min(30, item.items.length - showMax)
-								showMax = showMax
-							}
+							showMax += Math.min(30, item.items.length - showMax)
 						}}
 					>
 						Show more ({showMax}/{item.items.length})
 					</div>
 				{/if}
-			</div>
-		{/if}
-	</div>
-{:else if isUser(item)}
-	<div>
-		<!-- svelte-ignore a11y_click_events_have_key_events -->
-		<!-- svelte-ignore a11y_no_static_element_interactions -->
-		<div
-			onclick={() => (opened = !opened)}
-			class="px-4 py-2 border-b w-full flex flex-row items-center justify-between cursor-pointer"
-		>
-			<div
-				class={twMerge('flex flex-row items-center gap-4 text-sm font-semibold')}
-				style={depth > 0 ? `padding-left: ${depth * 16}px;` : ''}
-			>
-				<div class="flex justify-center items-center">
-					<User size={16} class="text-secondary" />
-				</div>
-
-				<div>
-					<span class="whitespace-nowrap text-xs text-emphasis font-semibold"
-						>u/{item.username}</span
-					>
-					<div class="text-2xs font-normal text-secondary whitespace-nowrap"
-						>({pluralize(item.items.length, ' item')})</div
-					>
-				</div>
-			</div>
-			<div class="w-full flex flex-row-reverse">
-				{#if opened}
-					<ChevronUp size={16} />
-				{:else}
-					<ChevronDown size={16} />
-				{/if}
-			</div>
-		</div>
-		{#if opened || isSearching}
-			<div>
-				{#each item.items.slice(0, showMax) as subItem, index ((subItem['path'] ? subItem['type'] + '__' + subItem['path'] + '__' + index : undefined) ?? 'folder__' + subItem['folderName'] + '__' + index)}
-					<TreeView
-						{collapseAll}
-						item={subItem}
-						on:scriptChanged
-						on:flowChanged
-						on:appChanged
-						on:rawAppChanged
-						on:reload
-						{showCode}
-						depth={depth + 1}
-					/>
-				{/each}
-				{#if showMax < item.items.length}
-					<!-- svelte-ignore a11y_click_events_have_key_events -->
-					<!-- svelte-ignore a11y_no_static_element_interactions -->
-					<div
-						class="text-center text-xs text-secondary cursor-pointer py-2 hover:text-primary"
-						onclick={() => {
-							if (isUser(item)) {
-								showMax += Math.min(30, item.items.length - showMax)
-							}
-						}}
-					>
-						Show more ({showMax}/{item.items.length})
-					</div>
+				{#if ownerKey != undefined}
+					{#if ownerState?.loading && item.items.length === 0}
+						<!-- Show the spinner only on the first load, when there's nothing yet. A
+						     re-sort/re-filter re-fetch keeps the old rows visible and swaps them
+						     in place, so flashing "Loading…" under them would just be noise. -->
+						<div class="text-center text-xs py-2 text-secondary">Loading…</div>
+					{:else if !ownerState?.loading && ownerState?.hasMore && effectiveMax >= item.items.length}
+						<!-- Fetch the next server page only once every already-loaded row is shown
+						     (in "expand all" the client "Show more" above reveals those first). -->
+						<!-- svelte-ignore a11y_click_events_have_key_events -->
+						<!-- svelte-ignore a11y_no_static_element_interactions -->
+						<div
+							class="text-center text-xs py-2 text-primary cursor-pointer hover:text-emphasis"
+							onclick={() => ownerKey != undefined && onExpandOwner?.(ownerKey, true)}
+						>
+							Load more in {ownerKey} ({ownerState?.count ?? item.items.length} loaded)
+						</div>
+					{/if}
 				{/if}
 			</div>
 		{/if}
diff --git a/frontend/src/lib/components/home/TreeViewRoot.svelte b/frontend/src/lib/components/home/TreeViewRoot.svelte
index ef5cf25d58..94869b44d9 100644
--- a/frontend/src/lib/components/home/TreeViewRoot.svelte
+++ b/frontend/src/lib/components/home/TreeViewRoot.svelte
@@ -10,6 +10,26 @@
 		items: ItemType[] | undefined
 		isSearching?: boolean
 		pipelineFolders?: Set<string>
+		sortCompare?: (a: ItemType, b: ItemType) => number
+		// Order of the top-level folder/user nodes: Z-A when the active sort is
+		// name-descending (like a file explorer), alphabetical otherwise.
+		groupDesc?: boolean
+		// The server has further pages beyond the loaded items; `onLoadMore` fetches
+		// the next one (grouping only reorders what's already loaded).
+		hasMoreServer?: boolean
+		onLoadMore?: () => void
+		// Lazy per-owner loading: every folder and every user shows as a top-level node
+		// regardless of the loaded window; expanding one loads its items on demand,
+		// paginated within it. `ownerLoad` keys are full path prefixes (`f/<name>` /
+		// `u/<name>`).
+		allFolders?: string[]
+		allUsers?: string[]
+		ownerLoad?: Record<
+			string,
+			{ cursor?: string; hasMore: boolean; loading: boolean; loaded: boolean; count: number }
+		>
+		onExpandOwner?: (owner: string, more?: boolean) => void
+		onCollapseOwner?: (owner: string) => void
 	}
 
 	let {
@@ -18,7 +38,16 @@
 		nbDisplayed = $bindable(),
 		items,
 		isSearching = false,
-		pipelineFolders
+		pipelineFolders,
+		sortCompare,
+		groupDesc = false,
+		hasMoreServer = false,
+		onLoadMore,
+		allFolders = [],
+		allUsers = [],
+		ownerLoad,
+		onExpandOwner,
+		onCollapseOwner
 	}: Props = $props()
 
 	let groupedItems: ReturnType<typeof groupItems> | 'loading' = $state('loading')
@@ -26,8 +55,15 @@
 		items
 		pipelineFolders
 		isSearching
+		sortCompare
+		groupDesc
+		allFolders
+		allUsers
 		untrack(() => {
-			const grouped = groupItems(items)
+			// While searching, `items` is already relevance-ranked and the sort
+			// selector is disabled, so keep that order: a no-op leaf comparator
+			// preserves insertion order within each group (Array.sort is stable).
+			const grouped = groupItems(items, isSearching ? () => 0 : sortCompare, groupDesc)
 			// Ensure every pipeline folder is present at the top level so its
 			// "Pipeline" entry shows even when it has no listed items — a bundle-phase
 			// pipeline (only a draft so far) or a folder whose only scripts are
@@ -36,26 +72,49 @@
 			// hides them on `filter !== ''`), so injecting them would surface unrelated
 			// folders in the results.
 			if (!isSearching) {
-				const present = new Set(
+				// Inject a top-level node for every pipeline folder (so its Pipeline entry
+				// shows even with no listed items), every workspace folder, and every user
+				// — so an owner whose items sit outside the loaded window still appears;
+				// expanding one loads its items on demand (see onExpandOwner). Injecting
+				// users too is what stops a user node from vanishing under a name sort whose
+				// first page is all folder rows.
+				const presentFolders = new Set(
 					grouped
 						.filter((g) => 'folderName' in g)
 						.map((g) => (g as { folderName: string }).folderName)
 				)
-				// Insert each missing pipeline folder among the existing folders in name
-				// order — `groupItems` already sorts user groups first then folders
-				// alphabetically, so inserting before the first greater-named folder
-				// keeps that ordering (rather than prepending out of order).
-				for (const folderName of [...(pipelineFolders ?? [])]
-					.filter((f) => !present.has(f))
-					.sort()) {
-					const item = { folderName, items: [] }
-					const idx = grouped.findIndex(
-						(g) =>
-							'folderName' in g &&
-							(g as { folderName: string }).folderName.localeCompare(folderName) > 0
+				const missingFolders: { folderName: string; items: [] }[] = []
+				for (const folderName of [...(pipelineFolders ?? []), ...allFolders]) {
+					if (presentFolders.has(folderName)) continue
+					presentFolders.add(folderName)
+					missingFolders.push({ folderName, items: [] })
+				}
+				const presentUsers = new Set(
+					grouped.filter((g) => 'username' in g).map((g) => (g as { username: string }).username)
+				)
+				const missingUsers: { username: string; items: [] }[] = []
+				for (const username of allUsers) {
+					if (presentUsers.has(username)) continue
+					presentUsers.add(username)
+					missingUsers.push({ username, items: [] })
+				}
+				if (missingFolders.length || missingUsers.length) {
+					// `groupItems` returns user groups first, then folders alphabetically.
+					// Append the missing nodes and sort each section once (O(n log n)) rather
+					// than splicing each in with findIndex (O(n²) — at 10k owners that was
+					// ~50M comparisons on every page merge).
+					const dir = groupDesc ? -1 : 1
+					const users = grouped.filter((g) => 'username' in g) as { username: string }[]
+					const folders = grouped.filter((g) => 'folderName' in g) as { folderName: string }[]
+					users.push(...missingUsers)
+					folders.push(...missingFolders)
+					users.sort((a, b) => dir * a.username.localeCompare(b.username))
+					folders.sort((a, b) => dir * a.folderName.localeCompare(b.folderName))
+					grouped.length = 0
+					grouped.push(
+						...(users as unknown as typeof grouped),
+						...(folders as unknown as typeof grouped)
 					)
-					if (idx < 0) grouped.push(item)
-					else grouped.splice(idx, 0, item)
 				}
 			}
 			groupedItems = grouped
@@ -74,13 +133,17 @@
 	</div>
 {:else}
 	<div class="border rounded-md bg-surface-tertiary">
-		{#each groupedItems.slice(0, nbDisplayed) as item ('folderName' in item ? `f__${item.folderName}` : 'username' in item ? `u__${item.username}` : `i__${item.type}__${item.path}`)}
+		{#each groupedItems.slice(0, nbDisplayed) as item, rootIndex ('folderName' in item ? `f__${item.folderName}` : 'username' in item ? `u__${item.username}` : `i__${item.type}__${item.path}`)}
 			{#if item}
 				<TreeView
+					{rootIndex}
 					{isSearching}
 					{collapseAll}
 					{item}
 					{pipelineFolders}
+					{ownerLoad}
+					{onExpandOwner}
+					{onCollapseOwner}
 					on:scriptChanged
 					on:flowChanged
 					on:appChanged
@@ -91,12 +154,17 @@
 			{/if}
 		{/each}
 	</div>
-	{#if groupedItems.length > 15 && nbDisplayed < groupedItems.length}
+	{#if nbDisplayed < groupedItems.length || hasMoreServer}
 		<span class="text-xs font-normal text-secondary"
-			>{nbDisplayed} root nodes out of {groupedItems.length}
+			>{Math.min(nbDisplayed, groupedItems.length)} root nodes{hasMoreServer
+				? ''
+				: ` out of ${groupedItems.length}`}
 			<button
 				class="ml-4 text-xs font-normal text-primary hover:text-emphasis"
-				onclick={() => (nbDisplayed += 30)}>load 30 more</button
+				onclick={() => {
+					if (nbDisplayed < groupedItems.length) nbDisplayed += 30
+					else onLoadMore?.()
+				}}>load 30 more</button
 			></span
 		>
 	{/if}
diff --git a/frontend/src/lib/components/home/treeViewUtils.ts b/frontend/src/lib/components/home/treeViewUtils.ts
index 1bbe013e46..e1d769fd56 100644
--- a/frontend/src/lib/components/home/treeViewUtils.ts
+++ b/frontend/src/lib/components/home/treeViewUtils.ts
@@ -5,6 +5,9 @@ type TableItem<T, U extends 'script' | 'flow' | 'app' | 'raw_app'> = T & {
 	type?: U
 	time?: number
 	starred?: boolean
+	// Server fetch ordinal (see ItemsList) — the tree sorts leaves by it to preserve
+	// the endpoint's order rather than re-deriving it.
+	ord?: number
 }
 
 type TableScript = TableItem<Script, 'script'>
@@ -48,7 +51,23 @@ function insertItemInFolder(
 	})
 }
 
-export function groupItems(items: ItemType[] | undefined): (ItemType | FolderItem | UserItem)[] {
+// Default leaf ordering when the caller doesn't impose one: starred first, then
+// most recently modified. Folders/users always sort alphabetically regardless.
+const defaultLeafCompare = (a: ItemType, b: ItemType): number => {
+	if (a.starred && !b.starred) return -1
+	if (!a.starred && b.starred) return 1
+	return getModifiedAt(b) - getModifiedAt(a)
+}
+
+export function groupItems(
+	items: ItemType[] | undefined,
+	leafCompare: (a: ItemType, b: ItemType) => number = defaultLeafCompare,
+	// Folders/users have only a name, so the sort key is always name; `groupDesc`
+	// flips its direction (Z-A) to follow a name-descending sort, like a file explorer
+	// reordering folders when you reverse the name sort. Time sorts pass false (no
+	// folder timestamp to order by, so folders stay alphabetical).
+	groupDesc: boolean = false
+): (ItemType | FolderItem | UserItem)[] {
 	if (!items) {
 		return []
 	}
@@ -78,27 +97,37 @@ export function groupItems(items: ItemType[] | undefined): (ItemType | FolderIte
 		}
 	})
 
+	const dir = groupDesc ? -1 : 1
 	root.sort((a, b) => {
+		// Users always group before folders regardless of direction; only the name
+		// comparison within each kind follows `groupDesc`.
 		if ('username' in a && 'folderName' in b) {
 			return -1
 		}
 		if ('folderName' in a && 'username' in b) {
 			return 1
 		}
-		return (a['username'] ?? a['folderName'] ?? '').localeCompare(b['username'] ?? b['folderName'])
+		return (
+			dir * (a['username'] ?? a['folderName'] ?? '').localeCompare(b['username'] ?? b['folderName'])
+		)
 	})
 
-	sortGroup(root)
+	sortGroup(root, leafCompare, dir)
 
 	return root
 }
 
-function sortGroup(group: (ItemType | FolderItem | UserItem)[]) {
+function sortGroup(
+	group: (ItemType | FolderItem | UserItem)[],
+	leafCompare: (a: ItemType, b: ItemType) => number,
+	dir: number = 1
+) {
 	group.forEach((item) => {
 		if ('items' in item) {
 			item.items.sort((a, b) => {
+				// Nested subfolders sort before leaves and follow the group direction.
 				if ('folderName' in a && 'folderName' in b) {
-					return a.folderName.localeCompare(b.folderName)
+					return dir * a.folderName.localeCompare(b.folderName)
 				}
 				if ('folderName' in a) {
 					return -1
@@ -107,14 +136,12 @@ function sortGroup(group: (ItemType | FolderItem | UserItem)[]) {
 					return 1
 				}
 				if (isItemType(a) && isItemType(b)) {
-					if (a.starred && !b.starred) return -1
-					if (!a.starred && b.starred) return 1
-					return getModifiedAt(b) - getModifiedAt(a)
+					return leafCompare(a, b)
 				}
 				return 0
 			})
 
-			sortGroup(item.items)
+			sortGroup(item.items, leafCompare, dir)
 		}
 	})
 }

From 65db58bfdaf50009931e3594bd55c5d6c4c07332 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 24 Jul 2026 23:55:47 +0200
Subject: [PATCH 168/171] fix(frontend): pin sveltekit version.name so builds
 are reproducible across architectures (#10315)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix(docker): pin frontend build stage to linux/amd64

Rollup selects platform-specific native binaries that can emit different
content-hashed chunk filenames for identical sources. The frontend assets are
embedded into the Rust binary via rust_embed, so building the stage once per
target architecture produced amd64 and arm64 images whose HTML references
`_app/immutable/chunks/<hash>.js` files that only exist in that architecture's
image. In a mixed-architecture cluster, a page served by a pod of one arch 404s
on JS/CSS fetched from a pod of the other.

Pinning the stage makes both image variants embed byte-identical assets. The
stage output is JS/CSS/HTML/WASM only, so the build platform does not leak into
the artifacts.

Fixes WIN-2242

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* docs: tighten frontend platform-pin comment

Vite 8 bundles with rolldown, not rollup; name the right bindings and keep the
constraint to four lines.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix(frontend): make the build reproducible so mixed-arch clusters agree on asset names

SvelteKit defaults `kit.version.name` to `Date.now().toString()`, so every build
of the same commit gets a different version string. It is embedded in the client
chunk (and in the `__sveltekit_<hash>` global derived from it), which changes
that chunk's content hash and cascades into new filenames for roughly a quarter
of `_app/immutable`. The assets are baked into the binary via rust_embed, so the
amd64 and arm64 images of one release ship different `chunks/<hash>.js` names:
in a mixed-architecture cluster, HTML served by a pod of one architecture 404s
on assets requested from a pod of the other.

Measured on the published windmill:1.770.0 images: 224 of 863 asset filenames
differ between the two architecture variants, yet 854 of 855 chunks are
byte-identical once chunk-name references are normalized. The single genuinely
differing chunk is the one carrying the timestamp. The bundler is deterministic
across architectures; the timestamp is the whole divergence.

Pinning the version to the package version (overridable via WM_BUILD_VERSION)
makes repeat builds byte-identical. `version.pollInterval` is 0 and nothing
reads the `updated` store, so this has no runtime behavior change.

This supersedes pinning the Docker frontend stage to linux/amd64, which fixed
the symptom by building the stage under emulation on the arm64 builder — that
cost 32 minutes of QEMU time per build and left the underlying non-determinism
in place.

Fixes WIN-2242

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix(frontend): key the sveltekit version on the commit sha

The package version only moves on releases, but `:dev` and RHEL images are
published on every main push. Two such deployments would then advertise the same
SvelteKit version, and SvelteKit only recovers from a chunk that 404s after a
redeploy (client.js: "Referenced node could have been removed due to redeploy")
when the deployed version differs from the baked-in one, so an open tab would
render an error page instead of reloading.

Pass the commit sha through WM_BUILD_VERSION from every workflow that builds the
root Dockerfile, so the value is identical across the per-architecture builds of
one commit and distinct between commits. The package version stays the fallback,
which keeps unwired builds architecture-consistent.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix(docker): declare WM_BUILD_VERSION in the RHEL frontend stages

The RHEL workflows copy docker/RHEL{8,9}/Dockerfile over the root one before
building, so the build-arg was unconsumed there and those images fell back to
the package version: two RHEL builds between releases would share a SvelteKit
version across different manifests.

Also switch the root declaration to the `ARG name=""` form used by `features`.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* docs: keep the version-arg rationale in one place

The root Dockerfile comment restated what frontend/svelte.config.js already
documents; point at it instead, matching the RHEL Dockerfiles.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/build-publish-rh-image.yml  |  1 +
 .github/workflows/build-publish-rh8-image.yml |  2 ++
 .github/workflows/docker-image-rpi4.yml       |  1 +
 .github/workflows/docker-image.yml            |  3 +++
 Dockerfile                                    |  2 ++
 docker/RHEL8/Dockerfile                       |  2 ++
 docker/RHEL9/Dockerfile                       |  2 ++
 frontend/svelte.config.js                     | 11 +++++++++++
 8 files changed, 24 insertions(+)

diff --git a/.github/workflows/build-publish-rh-image.yml b/.github/workflows/build-publish-rh-image.yml
index e36473f2aa..dcb223b534 100644
--- a/.github/workflows/build-publish-rh-image.yml
+++ b/.github/workflows/build-publish-rh-image.yml
@@ -63,6 +63,7 @@ jobs:
           push: true
           build-args: |
             features=ee_rhel
+            WM_BUILD_VERSION=${{ github.sha }}
           secrets: |
             rh_username=${{ secrets.RH_USERNAME }}
             rh_password=${{ secrets.RH_PASSWORD }}
diff --git a/.github/workflows/build-publish-rh8-image.yml b/.github/workflows/build-publish-rh8-image.yml
index b7a7196077..7c820eb290 100644
--- a/.github/workflows/build-publish-rh8-image.yml
+++ b/.github/workflows/build-publish-rh8-image.yml
@@ -65,6 +65,7 @@ jobs:
           push: true
           build-args: |
             features=ee_rhel
+            WM_BUILD_VERSION=${{ github.sha }}
           secrets: |
             rh_username=${{ secrets.RH_USERNAME }}
             rh_password=${{ secrets.RH_PASSWORD }}
@@ -82,6 +83,7 @@ jobs:
           push: true
           build-args: |
             features=ee_rhel
+            WM_BUILD_VERSION=${{ github.sha }}
           secrets: |
             rh_username=${{ secrets.RH_USERNAME }}
             rh_password=${{ secrets.RH_PASSWORD }}
diff --git a/.github/workflows/docker-image-rpi4.yml b/.github/workflows/docker-image-rpi4.yml
index 4a7fc2a874..fa5f4ba3fe 100644
--- a/.github/workflows/docker-image-rpi4.yml
+++ b/.github/workflows/docker-image-rpi4.yml
@@ -68,6 +68,7 @@ jobs:
           push: true
           build-args: |
             features=ce_rpi
+            WM_BUILD_VERSION=${{ github.sha }}
           tags: |
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:dev
             ${{ steps.meta-public.outputs.tags }}
diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml
index bdc53a6f22..433f3a86b3 100644
--- a/.github/workflows/docker-image.yml
+++ b/.github/workflows/docker-image.yml
@@ -93,6 +93,7 @@ jobs:
           push: true
           build-args: |
             features=ce
+            WM_BUILD_VERSION=${{ github.sha }}
           tags: |
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.DEV_SHA }}
             ${{ steps.meta-public.outputs.tags }}
@@ -155,6 +156,7 @@ jobs:
           push: true
           build-args: |
             features=ee
+            WM_BUILD_VERSION=${{ github.sha }}
           tags: |
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee:${{ env.DEV_SHA }}
             ${{ steps.meta-ee-public.outputs.tags }}
@@ -254,6 +256,7 @@ jobs:
           target: debuginfo
           build-args: |
             features=ee
+            WM_BUILD_VERSION=${{ github.sha }}
           outputs: type=local,dest=./debuginfo
 
       - name: Rename debug file with corresponding architecture
diff --git a/Dockerfile b/Dockerfile
index 83bf4c8513..b0b429803e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -79,6 +79,8 @@ COPY /python-client/docs/ /frontend/static/pydocs/
 RUN npm run generate-backend-client
 ENV NODE_OPTIONS "--max-old-space-size=8192"
 ARG VITE_BASE_URL ""
+# Must be declared for the build-arg to reach the bundle. See frontend/svelte.config.js.
+ARG WM_BUILD_VERSION=""
 # Read more about macro in docker/dev.nu
 # -- MACRO-SPREAD-WASM-PARSER-DEV-ONLY -- #
 RUN npm run build
diff --git a/docker/RHEL8/Dockerfile b/docker/RHEL8/Dockerfile
index 57b74b75af..1af03cc5f4 100644
--- a/docker/RHEL8/Dockerfile
+++ b/docker/RHEL8/Dockerfile
@@ -41,6 +41,8 @@ COPY /python-client/docs/ /frontend/static/pydocs/
 
 RUN npm run generate-backend-client
 ENV NODE_OPTIONS "--max-old-space-size=8192"
+# Must be declared for the build-arg to reach the bundle. See frontend/svelte.config.js.
+ARG WM_BUILD_VERSION=""
 RUN npm run build
 
 
diff --git a/docker/RHEL9/Dockerfile b/docker/RHEL9/Dockerfile
index 21816ba8a5..9ab5c78318 100644
--- a/docker/RHEL9/Dockerfile
+++ b/docker/RHEL9/Dockerfile
@@ -41,6 +41,8 @@ COPY /python-client/docs/ /frontend/static/pydocs/
 
 RUN npm run generate-backend-client
 ENV NODE_OPTIONS "--max-old-space-size=8192"
+# Must be declared for the build-arg to reach the bundle. See frontend/svelte.config.js.
+ARG WM_BUILD_VERSION=""
 RUN npm run build
 
 
diff --git a/frontend/svelte.config.js b/frontend/svelte.config.js
index 4b318efcd5..1752fed97c 100644
--- a/frontend/svelte.config.js
+++ b/frontend/svelte.config.js
@@ -1,6 +1,12 @@
 import preprocess from 'svelte-preprocess'
 import adapter from '@sveltejs/adapter-static'
 import { preprocessMeltUI, sequence } from '@melt-ui/pp'
+import { readFileSync } from 'fs'
+import { fileURLToPath } from 'url'
+
+const pkg = JSON.parse(
+	readFileSync(fileURLToPath(new URL('package.json', import.meta.url)), 'utf8')
+)
 
 /** @type {import('@sveltejs/kit').Config} */
 const config = {
@@ -23,6 +29,11 @@ const config = {
 						assets: 'build',
 						fallback: '200.html'
 					}),
+		// Same for every build of one revision (SvelteKit's Date.now() default is not, so
+		// the per-architecture images disagreed on content-hashed asset filenames and
+		// mixed-arch clusters 404ed on each other's chunks), and different between
+		// revisions (SvelteKit only full-page reloads on a missing chunk if this changed).
+		version: { name: process.env.WM_BUILD_VERSION || pkg.version },
 		prerender: { entries: [] },
 		paths: {
 			base: process.env.VITE_BASE_URL ?? ''

From 15a6382c893f4117e4e8054154bbcf96a5685d6c Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Sat, 25 Jul 2026 09:32:01 +0200
Subject: [PATCH 169/171] remove unused mut breaking backend CI (#10320)

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
---
 backend/windmill-api-groups/src/folders.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/windmill-api-groups/src/folders.rs b/backend/windmill-api-groups/src/folders.rs
index a5741ccfd3..8736f7b60f 100644
--- a/backend/windmill-api-groups/src/folders.rs
+++ b/backend/windmill-api-groups/src/folders.rs
@@ -146,7 +146,7 @@ async fn list_foldernames(
     let mut sql = String::from("SELECT name FROM folder WHERE workspace_id = $1");
     let restricted = match build_scope_path_filter(&authed, "folders", "read") {
         ScopePathFilter::AllowAll => None,
-        ScopePathFilter::Restricted { exact, mut prefix } => {
+        ScopePathFilter::Restricted { exact, prefix } => {
             // A prefix grant also authorizes the folder at the prefix itself.
             let mut eq = exact;
             eq.append(&mut prefix.clone());

From 9cef724ff2fcae7aea7b11582ce18529f589665d Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Sat, 25 Jul 2026 11:41:48 +0200
Subject: [PATCH 170/171] feat: bind WAC approval urls to a named
 wait_for_approval step (#10317)

* feat: bind WAC approval urls to a named wait_for_approval step

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix: reject duplicate WAC approval step keys instead of renaming them

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix: reject WAC approval links minted for a step that is not awaiting approval

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix: bind WAC approval links to the awaiting step and stop step key aliasing

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix: reject empty approval keys and scope minted-key writes to the workspace

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix: enforce WAC approval binding at consumption and reject colliding keys

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix: make WAC approval binding and collision checks atomic, harden TS step keys

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix: decrement WAC suspend atomically instead of from a pre-lock snapshot

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* chore: add sqlx cache entry for the atomic WAC suspend decrement

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix: omit empty approver param from python get_approval_urls

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* test: pin the suspend-snapshot decrement and the colliding-mint race

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* test: drop the suspend-snapshot interleave test, it cannot both be stable and discriminate

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix: reject step keys that cannot be minted as a URL path segment

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
---
 ...e6f11e55231d2e62b0f8a7404f0e6093d7d68.json |  14 +
 ...bf55f4e0a37d7c9280064a5636d9d3bf1f6c2.json |  22 ++
 ...c9203012a7d3754f56af665e2f34a969eabd7.json |  23 ++
 backend/tests/fixtures/wac_approval_urls.sql  |  23 ++
 backend/tests/wac_approval_resume.rs          |  46 +++
 backend/tests/wac_approval_urls.rs            | 267 ++++++++++++++++++
 backend/windmill-api/openapi.yaml             |  38 +++
 backend/windmill-api/src/jobs.rs              | 205 +++++++++++++-
 backend/windmill-common/src/wac.rs            |  32 +++
 backend/windmill-worker/src/bun_executor.rs   |  15 +-
 backend/windmill-worker/src/wac_executor.rs   |  24 +-
 cli/src/guidance/skills.gen.ts                | 253 +++++++++++++----
 python-client/wmill/tests/test_workflow.py    |  57 +++-
 python-client/wmill/wmill/client.py           | 112 +++++++-
 system_prompts/auto-generated/prompts.ts      | 173 +++++++++---
 system_prompts/auto-generated/script.md       |  65 ++++-
 system_prompts/auto-generated/sdks/python.md  |  25 +-
 .../auto-generated/sdks/typescript.md         |  40 ++-
 .../auto-generated/sdks/wac-python.md         |  39 ++-
 .../auto-generated/sdks/wac-typescript.md     |  38 ++-
 .../skills/write-script-bun/SKILL.md          |  40 ++-
 .../skills/write-script-bunnative/SKILL.md    |  40 ++-
 .../skills/write-script-deno/SKILL.md         |  40 ++-
 .../skills/write-script-python3/SKILL.md      |  25 +-
 .../skills/write-workflow-as-code/SKILL.md    | 108 +++++--
 system_prompts/base/workflow-as-code.md       |  31 +-
 system_prompts/generate.py                    |   6 +-
 typescript-client/build.sh                    |   4 +-
 typescript-client/client.ts                   |  99 ++++++-
 29 files changed, 1676 insertions(+), 228 deletions(-)
 create mode 100644 backend/.sqlx/query-d1b882ab87de6d6cd16e8bc4364e6f11e55231d2e62b0f8a7404f0e6093d7d68.json
 create mode 100644 backend/.sqlx/query-ed42846826aa3f82f17097e52fcbf55f4e0a37d7c9280064a5636d9d3bf1f6c2.json
 create mode 100644 backend/.sqlx/query-f3bae157b92cbc1b3741593a620c9203012a7d3754f56af665e2f34a969eabd7.json
 create mode 100644 backend/tests/fixtures/wac_approval_urls.sql
 create mode 100644 backend/tests/wac_approval_urls.rs

diff --git a/backend/.sqlx/query-d1b882ab87de6d6cd16e8bc4364e6f11e55231d2e62b0f8a7404f0e6093d7d68.json b/backend/.sqlx/query-d1b882ab87de6d6cd16e8bc4364e6f11e55231d2e62b0f8a7404f0e6093d7d68.json
new file mode 100644
index 0000000000..97d811b347
--- /dev/null
+++ b/backend/.sqlx/query-d1b882ab87de6d6cd16e8bc4364e6f11e55231d2e62b0f8a7404f0e6093d7d68.json
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE v2_job_queue SET suspend = GREATEST(suspend - 1, 0) WHERE id = $1 AND suspend > 0",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Uuid"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "d1b882ab87de6d6cd16e8bc4364e6f11e55231d2e62b0f8a7404f0e6093d7d68"
+}
diff --git a/backend/.sqlx/query-ed42846826aa3f82f17097e52fcbf55f4e0a37d7c9280064a5636d9d3bf1f6c2.json b/backend/.sqlx/query-ed42846826aa3f82f17097e52fcbf55f4e0a37d7c9280064a5636d9d3bf1f6c2.json
new file mode 100644
index 0000000000..9b5c969f66
--- /dev/null
+++ b/backend/.sqlx/query-ed42846826aa3f82f17097e52fcbf55f4e0a37d7c9280064a5636d9d3bf1f6c2.json
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT (kind::text NOT IN ('flow', 'flowpreview', 'flownode', 'singlestepflow')\n                   AND parent_job IS NULL) AS \"is_wac!\"\n           FROM v2_job WHERE id = $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "is_wac!",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "ed42846826aa3f82f17097e52fcbf55f4e0a37d7c9280064a5636d9d3bf1f6c2"
+}
diff --git a/backend/.sqlx/query-f3bae157b92cbc1b3741593a620c9203012a7d3754f56af665e2f34a969eabd7.json b/backend/.sqlx/query-f3bae157b92cbc1b3741593a620c9203012a7d3754f56af665e2f34a969eabd7.json
new file mode 100644
index 0000000000..f787574b3a
--- /dev/null
+++ b/backend/.sqlx/query-f3bae157b92cbc1b3741593a620c9203012a7d3754f56af665e2f34a969eabd7.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT EXISTS (SELECT 1 FROM v2_job WHERE id = $1 AND workspace_id = $2)",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "exists",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "f3bae157b92cbc1b3741593a620c9203012a7d3754f56af665e2f34a969eabd7"
+}
diff --git a/backend/tests/fixtures/wac_approval_urls.sql b/backend/tests/fixtures/wac_approval_urls.sql
new file mode 100644
index 0000000000..099b185e30
--- /dev/null
+++ b/backend/tests/fixtures/wac_approval_urls.sql
@@ -0,0 +1,23 @@
+-- A Workflow-as-Code job in the queue, suspended on a wait_for_approval step
+-- (see tests/wac_approval_urls.rs). WAC parents are plain script jobs with no
+-- parent_job, which is what makes get_flow_info_for_resume treat them as WAC.
+INSERT INTO public.v2_job (
+    id, workspace_id, created_by, created_at, permissioned_as, permissioned_as_email,
+    kind, script_lang, runnable_path, tag, visible_to_owner
+) VALUES (
+    'a1a1a1a1-a1a1-a1a1-a1a1-a1a1a1a1a1a1', 'test-workspace', 'test-user',
+    '2023-01-01 00:00:00', 'u/test-user', 'test@windmill.dev',
+    'script', 'bun', 'u/test-user/wac_workflow', 'bun', true
+);
+INSERT INTO public.v2_job_queue (id, workspace_id, scheduled_for, running, suspend, tag) VALUES
+    ('a1a1a1a1-a1a1-a1a1-a1a1-a1a1a1a1a1a1', 'test-workspace', '2023-01-01 00:00:00', true, 1, 'bun');
+
+-- A second workspace the caller also administers, so a cross-workspace mint is
+-- rejected by the job's workspace check rather than by workspace authorization.
+INSERT INTO workspace (id, name, owner) VALUES
+    ('test-workspace-2', 'test-workspace-2', 'test-user');
+INSERT INTO usr(workspace_id, email, username, is_admin, role) VALUES
+    ('test-workspace-2', 'test@windmill.dev', 'test-user', true, 'Admin');
+INSERT INTO workspace_key(workspace_id, kind, key) VALUES
+    ('test-workspace-2', 'cloud', 'test-key-2');
+INSERT INTO workspace_settings (workspace_id) VALUES ('test-workspace-2');
diff --git a/backend/tests/wac_approval_resume.rs b/backend/tests/wac_approval_resume.rs
index ea17b87ff9..436c3d0cf9 100644
--- a/backend/tests/wac_approval_resume.rs
+++ b/backend/tests/wac_approval_resume.rs
@@ -81,3 +81,49 @@ async fn wac_sequential_approvals_read_own_row(db: Pool<Postgres>) -> anyhow::Re
 
     Ok(())
 }
+
+/// A row carrying another step's bound resume_id belongs to that step. The API
+/// refuses such resumes but cannot do so atomically with the insert, so
+/// consumption must skip them however they got in — while leaving the random ids
+/// the interactive channels sign fully eligible.
+#[sqlx::test]
+async fn wac_approval_skips_another_steps_bound_row(db: Pool<Postgres>) -> anyhow::Result<()> {
+    let job_id = Uuid::new_v4();
+    sqlx::query(
+        "INSERT INTO v2_job_queue (id, workspace_id, scheduled_for) VALUES ($1, 'test-workspace', now())",
+    )
+    .bind(job_id)
+    .execute(&db)
+    .await?;
+    sqlx::query(
+        "INSERT INTO v2_job_status (id, workflow_as_code_status) VALUES ($1, $2)",
+    )
+    .bind(job_id)
+    .bind(sqlx::types::Json(json!({
+        "_minted_approval_keys": { "legal": true, "finance": true }
+    })))
+    .execute(&db)
+    .await?;
+
+    // Oldest row is bound to `finance`; the later one is a plain Slack-style resume.
+    insert_resume_row(
+        &db,
+        job_id,
+        windmill_common::wac::approval_resume_id("finance") as i32,
+        "bob",
+        true,
+        json!({"n": "finance"}),
+    )
+    .await?;
+    insert_resume_row(&db, job_id, 4242, "alice", true, json!({"n": "slack"})).await?;
+
+    let ckpt = pending_approval(WacCheckpoint::default(), "legal");
+    let ckpt = prepare_checkpoint_for_resume(&db, &job_id, ckpt).await?;
+    assert_eq!(
+        ckpt.completed_steps["legal"]["approver"],
+        json!("alice"),
+        "`legal` must skip finance's bound row and take the unbound one"
+    );
+
+    Ok(())
+}
diff --git a/backend/tests/wac_approval_urls.rs b/backend/tests/wac_approval_urls.rs
new file mode 100644
index 0000000000..0cb33e67c0
--- /dev/null
+++ b/backend/tests/wac_approval_urls.rs
@@ -0,0 +1,267 @@
+//! `jobs/wac_approval_urls/{job}/{step_key}` mints the resume URLs a WAC
+//! workflow routes through its own channel. They must address the same
+//! `resume_job` record the step's built-in buttons use — i.e. carry
+//! `approval_resume_id(step_key)` — and be signed so the unauthenticated resume
+//! route accepts them, without that route becoming any easier to forge.
+
+use sqlx::{Pool, Postgres};
+use windmill_common::wac::approval_resume_id;
+use windmill_test_utils::*;
+
+const WAC_JOB: &str = "a1a1a1a1-a1a1-a1a1-a1a1-a1a1a1a1a1a1";
+// Distinct keys whose SHA-256 prefixes collide in the u32 the resume routes take.
+const APPROVAL_COLLISION_A: &str = "approval-12509";
+const APPROVAL_COLLISION_B: &str = "approval-81661";
+
+/// The minted URLs point at `BASE_URL`, not the ephemeral test server.
+fn to_test_url(base: &str, url: &str) -> String {
+    let (_, path) = url.split_once("/api/").expect("url has an /api/ segment");
+    format!("{base}/{path}")
+}
+
+/// Park the job on `step_key`, as the worker does when that approval suspends.
+async fn awaiting_approval(db: &Pool<Postgres>, step_key: &str) -> anyhow::Result<()> {
+    sqlx::query(
+        "INSERT INTO v2_job_status (id, workflow_as_code_status) VALUES ($1::uuid, $2)
+         ON CONFLICT (id) DO UPDATE SET workflow_as_code_status =
+            v2_job_status.workflow_as_code_status || EXCLUDED.workflow_as_code_status",
+    )
+    .bind(WAC_JOB)
+    .bind(sqlx::types::Json(serde_json::json!({
+        "_checkpoint": { "pending_steps": { "mode": "approval", "keys": [step_key], "job_ids": {} } }
+    })))
+    .execute(db)
+    .await?;
+    Ok(())
+}
+
+#[sqlx::test(fixtures("base", "wac_approval_urls"))]
+async fn wac_approval_urls_bind_to_step_key(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+
+    let server = ApiServer::start(db.clone()).await?;
+    let base = format!("http://localhost:{}/api", server.addr.port());
+    let client = reqwest::Client::new();
+
+    let urls: serde_json::Value = client
+        .get(format!(
+            "{base}/w/test-workspace/jobs/wac_approval_urls/{WAC_JOB}/manager"
+        ))
+        .header("Authorization", "Bearer SECRET_TOKEN")
+        .send()
+        .await?
+        .error_for_status()?
+        .json()
+        .await?;
+
+    let resume = urls["resume"].as_str().expect("resume url").to_string();
+    let manager_id = approval_resume_id("manager");
+    assert!(
+        resume.contains(&format!("/jobs_u/resume/{WAC_JOB}/{manager_id}/")),
+        "resume url must carry the step key's resume_id: {resume}"
+    );
+    assert!(
+        urls["cancel"]
+            .as_str()
+            .is_some_and(|c| c.contains(&format!("/jobs_u/cancel/{WAC_JOB}/{manager_id}/"))),
+        "cancel url must carry the same resume_id: {urls}"
+    );
+    assert_ne!(
+        manager_id,
+        approval_resume_id("finance"),
+        "distinct approval steps must not share a resume_job record"
+    );
+
+    // A signature is only valid for the resume_id it was minted for, so the URL
+    // can't be retargeted at another step of the same workflow.
+    let retargeted = resume.replace(
+        &format!("/{manager_id}/"),
+        &format!("/{}/", approval_resume_id("finance")),
+    );
+    let status = client
+        .post(to_test_url(&base, &retargeted))
+        .json(&serde_json::json!({}))
+        .send()
+        .await?
+        .status();
+    assert!(
+        !status.is_success(),
+        "signature minted for `manager` must not resume another step (got {status})"
+    );
+
+    // The genuine URL resumes without any credential — possession of the
+    // signature is the authority, as for the built-in approval buttons.
+    awaiting_approval(&db, "manager").await?;
+    let resp = client
+        .post(to_test_url(&base, &resume))
+        .json(&serde_json::json!({ "ok": true }))
+        .send()
+        .await?;
+    assert!(
+        resp.status().is_success(),
+        "minted resume url must be accepted: {} {}",
+        resp.status(),
+        resp.text().await.unwrap_or_default()
+    );
+
+    let (approved, value): (bool, sqlx::types::Json<serde_json::Value>) = sqlx::query_as(
+        "SELECT approved, value FROM resume_job WHERE job = $1::uuid AND resume_id = $2",
+    )
+    .bind(WAC_JOB)
+    .bind(manager_id as i32)
+    .fetch_one(&db)
+    .await?;
+    assert!(approved);
+    assert_eq!(value.0, serde_json::json!({ "ok": true }));
+
+    Ok(())
+}
+
+/// Approval rows are consumed oldest-first regardless of resume_id (WIN-2241), so
+/// a URL minted for a later step and clicked while an earlier one is pending would
+/// otherwise resolve the earlier step with this approver's answer.
+#[sqlx::test(fixtures("base", "wac_approval_urls"))]
+async fn wac_approval_url_for_another_step_is_rejected(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+
+    let server = ApiServer::start(db.clone()).await?;
+    let base = format!("http://localhost:{}/api", server.addr.port());
+    let client = reqwest::Client::new();
+
+    // The workflow mints both approvals' URLs up front, then suspends on `legal`.
+    let mut minted = Vec::new();
+    for step_key in ["legal", "finance"] {
+        let urls: serde_json::Value = client
+            .get(format!(
+                "{base}/w/test-workspace/jobs/wac_approval_urls/{WAC_JOB}/{step_key}"
+            ))
+            .header("Authorization", "Bearer SECRET_TOKEN")
+            .send()
+            .await?
+            .error_for_status()?
+            .json()
+            .await?;
+        minted.push(urls["resume"].as_str().expect("resume url").to_string());
+    }
+    // Nothing pending yet: the link must not bank a row that the next approval
+    // to be reached would consume, whichever step that turns out to be.
+    let resp = client
+        .post(to_test_url(&base, &minted[1]))
+        .json(&serde_json::json!({}))
+        .send()
+        .await?;
+    assert_eq!(
+        resp.status(),
+        reqwest::StatusCode::BAD_REQUEST,
+        "a bound link must not be bankable before its step awaits approval"
+    );
+
+    awaiting_approval(&db, "legal").await?;
+
+    let resp = client
+        .post(to_test_url(&base, &minted[1]))
+        .json(&serde_json::json!({}))
+        .send()
+        .await?;
+    let status = resp.status();
+    let body = resp.text().await.unwrap_or_default();
+    assert_eq!(
+        status,
+        reqwest::StatusCode::BAD_REQUEST,
+        "finance's url must not resume the pending `legal` step: {body}"
+    );
+    assert!(
+        body.contains("finance"),
+        "error must name the bound step: {body}"
+    );
+
+    // The pending step's own url still works.
+    let resp = client
+        .post(to_test_url(&base, &minted[0]))
+        .json(&serde_json::json!({}))
+        .send()
+        .await?;
+    assert!(
+        resp.status().is_success(),
+        "the pending step's url must still resume: {}",
+        resp.text().await.unwrap_or_default()
+    );
+
+    Ok(())
+}
+
+/// The guards around minting: a step key must be non-empty, the job must be in the
+/// caller's workspace and be WAC-shaped, and two keys may not share a resume id.
+#[sqlx::test(fixtures("base", "wac_approval_urls"))]
+async fn wac_approval_urls_mint_guards(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+
+    let server = ApiServer::start(db.clone()).await?;
+    let base = format!("http://localhost:{}/api", server.addr.port());
+    let client = reqwest::Client::new();
+    let mint = |ws: &str, job: &str, key: &str| {
+        let url = format!("{base}/w/{ws}/jobs/wac_approval_urls/{job}/{key}");
+        client.get(url).header("Authorization", "Bearer SECRET_TOKEN").send()
+    };
+
+    assert_eq!(
+        mint("test-workspace", WAC_JOB, "%20").await?.status(),
+        reqwest::StatusCode::BAD_REQUEST,
+        "a blank step key must be refused rather than silently meaning `approval`"
+    );
+
+    // `v2_job_status` is keyed by job id alone, so the mint must not accept a job
+    // from another workspace and stamp its status row.
+    assert_eq!(
+        mint("test-workspace-2", WAC_JOB, "manager").await?.status(),
+        reqwest::StatusCode::NOT_FOUND,
+        "a job outside the caller's workspace must not be mintable"
+    );
+
+    // APPROVAL_COLLISION_A and _B hash to the same 32-bit resume id, so they would
+    // share one resume_job row and one capability.
+    assert!(mint("test-workspace", WAC_JOB, APPROVAL_COLLISION_A)
+        .await?
+        .status()
+        .is_success());
+    let resp = mint("test-workspace", WAC_JOB, APPROVAL_COLLISION_B).await?;
+    let status = resp.status();
+    let body = resp.text().await.unwrap_or_default();
+    assert_eq!(status, reqwest::StatusCode::BAD_REQUEST, "colliding key: {body}");
+    assert!(body.contains(APPROVAL_COLLISION_A), "error must name the other key: {body}");
+
+    Ok(())
+}
+
+/// Colliding keys share one resume_job row and one capability, so the mint that
+/// records them must let exactly one through however the requests interleave.
+#[sqlx::test(fixtures("base", "wac_approval_urls"))]
+async fn wac_concurrent_colliding_mints_admit_exactly_one(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let base = format!("http://localhost:{}/api", server.addr.port());
+
+    let mut set = tokio::task::JoinSet::new();
+    for key in [APPROVAL_COLLISION_A, APPROVAL_COLLISION_B] {
+        let url = format!("{base}/w/test-workspace/jobs/wac_approval_urls/{WAC_JOB}/{key}");
+        set.spawn(async move {
+            reqwest::Client::new()
+                .get(url)
+                .header("Authorization", "Bearer SECRET_TOKEN")
+                .send()
+                .await
+                .map(|r| r.status())
+        });
+    }
+    let mut ok = 0;
+    let mut rejected = 0;
+    while let Some(res) = set.join_next().await {
+        match res?? {
+            s if s.is_success() => ok += 1,
+            reqwest::StatusCode::BAD_REQUEST => rejected += 1,
+            other => anyhow::bail!("unexpected status {other}"),
+        }
+    }
+    assert_eq!((ok, rejected), (1, 1), "exactly one colliding key may be minted");
+    Ok(())
+}
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 0ab5695994..c4f030516f 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -14771,6 +14771,44 @@ paths:
                   - resume
                   - cancel
 
+  /w/{workspace}/jobs/wac_approval_urls/{id}/{step_key}:
+    get:
+      summary: get the resume urls bound to a specific wait_for_approval step of a workflow-as-code job
+      operationId: getWacApprovalUrls
+      tags:
+        - job
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - $ref: "#/components/parameters/JobId"
+        - name: step_key
+          in: path
+          required: true
+          description: checkpoint key of the wait_for_approval step, as passed to `wait_for_approval(key=...)`
+          schema:
+            type: string
+        - name: approver
+          in: query
+          schema:
+            type: string
+      responses:
+        "200":
+          description: url endpoints
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  approvalPage:
+                    type: string
+                  resume:
+                    type: string
+                  cancel:
+                    type: string
+                required:
+                  - approvalPage
+                  - resume
+                  - cancel
+
   /w/{workspace}/jobs/slack_approval/{id}:
     get:
       summary: generate interactive slack approval for suspended job
diff --git a/backend/windmill-api/src/jobs.rs b/backend/windmill-api/src/jobs.rs
index fe1f01f4e6..2413ef47ff 100644
--- a/backend/windmill-api/src/jobs.rs
+++ b/backend/windmill-api/src/jobs.rs
@@ -342,6 +342,10 @@ pub fn workspaced_service() -> Router {
             "/resume_urls/{job_id}/{resume_id}",
             get(get_resume_urls).layer(cors.clone()),
         )
+        .route(
+            "/wac_approval_urls/{job_id}/{step_key}",
+            get(get_wac_approval_urls).layer(cors.clone()),
+        )
         .route(
             "/result_by_id/{job_id}/{node_id}",
             get(get_result_by_id).layer(cors.clone()),
@@ -3684,6 +3688,13 @@ async fn resume_suspended_job_internal(
     };
     let mut tx: Transaction<'_, Postgres> = db.begin().await?;
 
+    // Inside the transaction that inserts the row and moves the suspend counter:
+    // validating earlier would let the workflow resolve this step and suspend on the
+    // next one in between, so a stale request would wake that later step instead.
+    if is_wac {
+        reject_mismatched_wac_approval(&mut tx, flow_info.id, resume_id).await?;
+    }
+
     insert_resume_job(
         resume_id,
         job_id,
@@ -3703,15 +3714,17 @@ async fn resume_suspended_job_internal(
         .execute(&mut *tx)
         .await?;
     } else if is_wac {
-        // WAC approval: decrement suspend counter directly on the WAC parent job
-        if flow_info.suspend > 0 {
-            sqlx::query!(
-                "UPDATE v2_job_queue SET suspend = GREATEST(suspend - 1, 0) WHERE id = $1",
-                flow_info.id,
-            )
-            .execute(&mut *tx)
-            .await?;
-        }
+        // WAC approval: decrement suspend counter directly on the WAC parent job.
+        // `flow_info.suspend` was read before this transaction took the queue-row
+        // lock, so gating on it would skip the decrement for a workflow that
+        // suspended in between and leave the approval parked until timeout.
+        sqlx::query!(
+            "UPDATE v2_job_queue SET suspend = GREATEST(suspend - 1, 0) \
+             WHERE id = $1 AND suspend > 0",
+            flow_info.id,
+        )
+        .execute(&mut *tx)
+        .await?;
     } else if is_flow_level {
         // For flow-level resumes, decrement the suspend counter if the flow is currently suspended
         // The approval will be matched when the worker checks for resumes (both step-level and flow-level)
@@ -4308,6 +4321,180 @@ pub async fn get_resume_urls(
     .await
 }
 
+/// Resume URLs bound to one `wait_for_approval(key=...)` step of a running
+/// Workflow-as-Code job, so the workflow can route the request through its own
+/// channel instead of the built-in ones. Same authority as `get_resume_urls`:
+/// only the `resume_id` derivation differs, and it is the one the worker will
+/// use when that step suspends.
+pub async fn get_wac_approval_urls(
+    authed: ApiAuthed,
+    Extension(db): Extension<DB>,
+    Path((w_id, job_id, step_key)): Path<(String, Uuid, String)>,
+    Query(approver): Query<QueryApprover>,
+) -> error::JsonResult<ResumeUrls> {
+    if step_key.trim().is_empty() {
+        return Err(Error::BadRequest(
+            "step_key must be the key of a wait_for_approval step".to_string(),
+        ));
+    }
+    let flow_path = resume_target_flow_path(&db, &w_id, job_id).await?;
+    check_scopes(&authed, || format!("jobs:run:flows:{}", flow_path))?;
+
+    // This handler writes to the job's status row, so the job must actually be in
+    // the caller's workspace — `v2_job_status` is keyed by job id alone and would
+    // otherwise take a write aimed at another workspace's job.
+    let in_workspace = sqlx::query_scalar!(
+        "SELECT EXISTS (SELECT 1 FROM v2_job WHERE id = $1 AND workspace_id = $2)",
+        job_id,
+        w_id
+    )
+    .fetch_one(&db)
+    .await?
+    .unwrap_or(false);
+    if !in_workspace {
+        return Err(Error::NotFound(format!("job {job_id} not found")));
+    }
+
+    // The approval belongs to the WAC parent, but WM_JOB_ID is the child job when
+    // this is called from inside a task() rather than a step(). Resolve up so the
+    // URL still targets the workflow that will suspend.
+    let job_id = get_flow_id_for_job(&db, job_id).await.unwrap_or(job_id);
+
+    // The write below is what the run page keys its WAC timeline off, so it must not
+    // land on a job that has no WAC status. Rules out flows and step/child jobs; a
+    // WAC parent is itself a script job, so a plain script is indistinguishable here
+    // and still passes — it simply never mints, since only the SDK calls this.
+    let is_wac = sqlx::query_scalar!(
+        r#"SELECT (kind::text NOT IN ('flow', 'flowpreview', 'flownode', 'singlestepflow')
+                   AND parent_job IS NULL) AS "is_wac!"
+           FROM v2_job WHERE id = $1"#,
+        job_id
+    )
+    .fetch_optional(&db)
+    .await?
+    .unwrap_or(false);
+    if !is_wac {
+        return Err(Error::BadRequest(format!(
+            "job {job_id} is not a workflow-as-code job"
+        )));
+    }
+
+    let resume_id = windmill_common::wac::approval_resume_id(&step_key);
+
+    // Remember which steps have a minted URL in circulation. A workflow may mint
+    // several up front, and the resume path uses this to tell "URL for the step
+    // awaiting approval" apart from "URL for some other step of this workflow",
+    // which it otherwise cannot: the interactive channels sign random resume_ids
+    // and must keep resuming whatever step is pending.
+    //
+    // Record first, then look for a collision, both in one transaction: the upsert
+    // takes the row lock, so a concurrent mint of a colliding key is serialized
+    // behind it and sees this key rather than racing past an earlier read. Upsert
+    // because a workflow can mint before any step has checkpointed, and a bare
+    // UPDATE would silently match nothing and leave the link unbound.
+    let mut tx = db.begin().await?;
+    sqlx::query(
+        "INSERT INTO v2_job_status (id, workflow_as_code_status)
+         VALUES ($1, jsonb_build_object('_minted_approval_keys',
+                    jsonb_build_object($2::text, true)))
+         ON CONFLICT (id) DO UPDATE SET workflow_as_code_status = jsonb_set(
+            COALESCE(v2_job_status.workflow_as_code_status, '{}'::jsonb),
+            ARRAY['_minted_approval_keys'],
+            COALESCE(v2_job_status.workflow_as_code_status->'_minted_approval_keys', '{}'::jsonb)
+                || jsonb_build_object($2::text, true)
+        )",
+    )
+    .bind(job_id)
+    .bind(&step_key)
+    .execute(&mut *tx)
+    .await?;
+
+    // Two keys sharing a resume_id share one resume_job row and one capability, and
+    // the binding check could not tell which of them a link was minted for.
+    if let Some(other) = sqlx::query_scalar::<_, String>(
+        "SELECT jsonb_object_keys(
+            COALESCE(workflow_as_code_status->'_minted_approval_keys', '{}'::jsonb))
+         FROM v2_job_status WHERE id = $1",
+    )
+    .bind(job_id)
+    .fetch_all(&mut *tx)
+    .await?
+    .into_iter()
+    .find(|k| *k != step_key && windmill_common::wac::approval_resume_id(k) == resume_id)
+    {
+        tx.rollback().await?;
+        return Err(Error::BadRequest(format!(
+            "step key `{step_key}` collides with `{other}` on the same resume id; rename one"
+        )));
+    }
+    tx.commit().await?;
+
+    get_resume_urls_internal(
+        Extension(db),
+        Path((w_id, job_id, resume_id)),
+        Query(approver),
+    )
+    .await
+}
+
+/// A WAC resume URL minted for a named `wait_for_approval` step is accepted only
+/// while that step is the one awaiting approval. Approval rows are consumed
+/// oldest-first regardless of resume_id (WIN-2241 — required so Slack/Teams/the
+/// approval page, which sign random ids, keep working), so a row banked at any
+/// other moment is picked up by whichever approval is reached first, silently
+/// answering it with this approver's response. Unbound resume_ids are untouched.
+async fn reject_mismatched_wac_approval(
+    tx: &mut Transaction<'_, Postgres>,
+    job_id: Uuid,
+    resume_id: u32,
+) -> Result<(), Error> {
+    // Lock the queue row the worker also writes when it suspends on the next step,
+    // so the pending step read below cannot change before this transaction commits.
+    sqlx::query("SELECT 1 FROM v2_job_queue WHERE id = $1 FOR UPDATE")
+        .bind(job_id)
+        .fetch_optional(&mut **tx)
+        .await?;
+
+    let status: Option<sqlx::types::Json<WacApprovalBinding>> = sqlx::query_scalar(
+        "SELECT jsonb_build_object(
+            'minted', COALESCE(workflow_as_code_status->'_minted_approval_keys', '{}'::jsonb),
+            'pending', workflow_as_code_status->'_checkpoint'->'pending_steps'
+         ) FROM v2_job_status WHERE id = $1",
+    )
+    .bind(job_id)
+    .fetch_optional(&mut **tx)
+    .await?;
+
+    let Some(sqlx::types::Json(binding)) = status else {
+        return Ok(());
+    };
+    let awaiting = binding.pending.as_ref().filter(|p| p.mode == "approval");
+    let bound_to = binding
+        .minted
+        .keys()
+        .find(|k| windmill_common::wac::approval_resume_id(k) == resume_id);
+
+    // A bound link is only ever valid while its own step is the one awaiting
+    // approval. Accepting it at any other time — including while the workflow is
+    // still running toward that step — leaves a row that the next approval to be
+    // reached consumes, whichever step that is.
+    match (bound_to, awaiting) {
+        (Some(step), pending) if !pending.is_some_and(|p| p.keys.iter().any(|k| k == step)) => {
+            Err(Error::BadRequest(format!(
+                "this approval link is bound to step `{step}`, which is not currently awaiting \
+                 approval"
+            )))
+        }
+        _ => Ok(()),
+    }
+}
+
+#[derive(Deserialize)]
+struct WacApprovalBinding {
+    minted: std::collections::HashMap<String, serde_json::Value>,
+    pending: Option<windmill_common::wac::WacPendingSteps>,
+}
+
 pub async fn get_resume_urls_internal(
     Extension(db): Extension<DB>,
     Path((w_id, job_id, resume_id)): Path<(String, Uuid, u32)>,
diff --git a/backend/windmill-common/src/wac.rs b/backend/windmill-common/src/wac.rs
index df076b3070..51abc5d60f 100644
--- a/backend/windmill-common/src/wac.rs
+++ b/backend/windmill-common/src/wac.rs
@@ -50,6 +50,38 @@ pub struct WacPendingSteps {
     pub job_ids: serde_json::Map<String, Value>,
 }
 
+/// `resume_id` bound to a WAC `wait_for_approval` step key.
+///
+/// Two callers must agree on it — the worker minting the inline resume/cancel
+/// buttons at suspend time, and the API signing URLs the workflow asked for
+/// ahead of time — so the derivation must be stable across processes and
+/// releases. `DefaultHasher` is explicitly not (std makes no cross-release
+/// guarantee), hence SHA-256 truncated to the `u32` the resume routes take.
+/// Distinctness per key is what matters: `resume_job`'s primary key is
+/// `job_id ^ resume_id`, so two steps sharing a resume_id would collide on
+/// one row.
+pub fn approval_resume_id(step_key: &str) -> u32 {
+    use sha2::{Digest, Sha256};
+    let digest = Sha256::digest(step_key.as_bytes());
+    u32::from_be_bytes([digest[0], digest[1], digest[2], digest[3]])
+}
+
+#[cfg(test)]
+mod tests {
+    use super::approval_resume_id;
+
+    /// Golden values: worker and API must agree on this mapping, and they can run
+    /// different builds during a rolling deploy. Changing it strands every resume
+    /// URL already in the hands of an approver, so a diff here is a deliberate
+    /// break, not a refactor.
+    #[test]
+    fn approval_resume_id_is_a_stable_cross_process_contract() {
+        assert_eq!(approval_resume_id("approval"), 0x9deb_65b8);
+        assert_eq!(approval_resume_id("approval_2"), 0x50d1_eeca);
+        assert_eq!(approval_resume_id("manager"), 0x6ee4_a469);
+    }
+}
+
 /// Load the WAC checkpoint from `v2_job_status.workflow_as_code_status._checkpoint`.
 pub async fn load_checkpoint(db: &DB, job_id: &Uuid) -> error::Result<WacCheckpoint> {
     let row: Option<Option<Value>> = sqlx::query_scalar(
diff --git a/backend/windmill-worker/src/bun_executor.rs b/backend/windmill-worker/src/bun_executor.rs
index f6b093f766..0f9f73ad1d 100644
--- a/backend/windmill-worker/src/bun_executor.rs
+++ b/backend/windmill-worker/src/bun_executor.rs
@@ -3125,15 +3125,12 @@ pub async fn handle_wac_v2_output(
                 }
             }
 
-            // Generate resume URLs for the inline approval buttons.
-            // Use a hash of the step key as resume_id so each waitForApproval()
-            // in the same workflow gets a unique resume_job record.
-            let resume_id: u32 = {
-                use std::hash::{Hash, Hasher};
-                let mut hasher = std::collections::hash_map::DefaultHasher::new();
-                key.hash(&mut hasher);
-                (hasher.finish() & 0xFFFF_FFFF) as u32
-            };
+            // Generate resume URLs for the inline approval buttons. The resume_id
+            // is derived from the step key so each waitForApproval() in the same
+            // workflow gets a unique resume_job record, and so URLs the workflow
+            // minted for this step ahead of time (getApprovalUrls) address the
+            // same one.
+            let resume_id: u32 = windmill_common::wac::approval_resume_id(&key);
             // Generate stateless approval token using shared utility
             let approval_token =
                 windmill_common::variables::generate_approval_token(&job.workspace_id, job.id, db)
diff --git a/backend/windmill-worker/src/wac_executor.rs b/backend/windmill-worker/src/wac_executor.rs
index f016427346..e3eedac36b 100644
--- a/backend/windmill-worker/src/wac_executor.rs
+++ b/backend/windmill-worker/src/wac_executor.rs
@@ -149,6 +149,26 @@ pub async fn prepare_checkpoint_for_resume(
             // page, in-run button, Slack, Teams and resume-as-owner store a
             // random id. A timed-out step matches no row -> else branch below.
             let consumed = checkpoint.consumed_resume_row_ids.clone();
+
+            // A row carrying another step's bound resume_id answers that step, not
+            // this one, so it must never be picked up here however it got in — the
+            // API rejects such resumes but cannot do so atomically with the insert.
+            // Only keys this workflow minted a URL for are known to be bound; every
+            // other resume_id stays eligible, preserving WIN-2241 for the channels
+            // that sign random ids.
+            let foreign_bound_ids: Vec<i32> = sqlx::query_scalar::<_, String>(
+                "SELECT jsonb_object_keys(
+                        COALESCE(workflow_as_code_status->'_minted_approval_keys', '{}'::jsonb))
+                     FROM v2_job_status WHERE id = $1",
+            )
+            .bind(job_id)
+            .fetch_all(db)
+            .await?
+            .into_iter()
+            .filter(|k| *k != approval_key)
+            .map(|k| windmill_common::wac::approval_resume_id(&k) as i32)
+            .collect();
+
             let resume_row = sqlx::query_as::<
                 _,
                 (
@@ -159,10 +179,12 @@ pub async fn prepare_checkpoint_for_resume(
                 ),
             >(
                 "SELECT id, value, approver, approved FROM resume_job \
-                 WHERE job = $1 AND id <> ALL($2) ORDER BY created_at ASC LIMIT 1",
+                 WHERE job = $1 AND id <> ALL($2) AND resume_id <> ALL($3) \
+                 ORDER BY created_at ASC LIMIT 1",
             )
             .bind(job_id)
             .bind(&consumed)
+            .bind(&foreign_bound_ids)
             .fetch_optional(db)
             .await?;
 
diff --git a/cli/src/guidance/skills.gen.ts b/cli/src/guidance/skills.gen.ts
index cc51106162..75084ce204 100644
--- a/cli/src/guidance/skills.gen.ts
+++ b/cli/src/guidance/skills.gen.ts
@@ -1038,15 +1038,43 @@ workflow<T>(fn: (...args: any[]) => Promise<T>): void
 /**
  * Suspend the workflow and wait for an external approval.
  * 
- * Use \`getResumeUrls()\` (wrapped in \`step()\`) to obtain resume/cancel/approvalPage
- * URLs before calling this function.
+ * Pass \`key\` to name the step, then \`getApprovalUrls(key)\` yields the URLs that
+ * resume exactly this approval — route them through your own channel. Without a
+ * key the steps are named \`approval\`, \`approval_2\`, ...
  * 
  * @example
- * const urls = await step("urls", () => getResumeUrls());
- * await step("notify", () => sendEmail(urls.approvalPage));
- * const { value, approver } = await waitForApproval({ timeout: 3600 });
+ * const urls = await step("urls", () => getApprovalUrls("manager"));
+ * await step("notify", () => sendEmail(urls.resume, urls.cancel));
+ * const { value, approver } = await waitForApproval({ key: "manager", timeout: 3600 });
  */
-waitForApproval(options?: { timeout?: number; form?: object; selfApproval?: boolean; }): PromiseLike<{ value: any; approver: string; approved: boolean }>
+waitForApproval(options?: { timeout?: number; form?: object; selfApproval?: boolean; key?: string; }): PromiseLike<{ value: any; approver: string; approved: boolean }>
+
+/**
+ * Resume/cancel/approval-page URLs bound to one \`waitForApproval\` step.
+ * 
+ * Unlike \`getResumeUrls()\`, which signs a random nonce, these address the very
+ * \`resume_job\` record the step's built-in approval buttons use, so they are
+ * stable across replays and safe to embed in a custom notification.
+ * 
+ * \`stepKey\` must match the \`key\` given to \`waitForApproval\`. Keys must be unique
+ * within a workflow; reusing one throws rather than silently renaming it. The URL
+ * only resumes while that step is awaiting approval; used at any other moment it is
+ * rejected rather than banking a row a different approval would consume. Send it
+ * ahead of time — approvers just cannot act before the workflow reaches the step.
+ * 
+ * \`resume\` and \`cancel\` are step-bound; \`approvalPage\` is not — it opens the job's
+ * approval page, which acts on whichever approval is pending when it is used.
+ * 
+ * @example
+ * const urls = await step("urls", () => getApprovalUrls("manager"));
+ * await step("notify", () => sendEmail(urls.resume, urls.cancel));
+ * await waitForApproval({ key: "manager" });
+ */
+async getApprovalUrls(stepKey: string = "approval", approver?: string): Promise<{
+  approvalPage: string;
+  resume: string;
+  cancel: string;
+}>
 
 /**
  * Process items in parallel with optional concurrency control.
@@ -1802,15 +1830,43 @@ workflow<T>(fn: (...args: any[]) => Promise<T>): void
 /**
  * Suspend the workflow and wait for an external approval.
  * 
- * Use \`getResumeUrls()\` (wrapped in \`step()\`) to obtain resume/cancel/approvalPage
- * URLs before calling this function.
+ * Pass \`key\` to name the step, then \`getApprovalUrls(key)\` yields the URLs that
+ * resume exactly this approval — route them through your own channel. Without a
+ * key the steps are named \`approval\`, \`approval_2\`, ...
  * 
  * @example
- * const urls = await step("urls", () => getResumeUrls());
- * await step("notify", () => sendEmail(urls.approvalPage));
- * const { value, approver } = await waitForApproval({ timeout: 3600 });
+ * const urls = await step("urls", () => getApprovalUrls("manager"));
+ * await step("notify", () => sendEmail(urls.resume, urls.cancel));
+ * const { value, approver } = await waitForApproval({ key: "manager", timeout: 3600 });
  */
-waitForApproval(options?: { timeout?: number; form?: object; selfApproval?: boolean; }): PromiseLike<{ value: any; approver: string; approved: boolean }>
+waitForApproval(options?: { timeout?: number; form?: object; selfApproval?: boolean; key?: string; }): PromiseLike<{ value: any; approver: string; approved: boolean }>
+
+/**
+ * Resume/cancel/approval-page URLs bound to one \`waitForApproval\` step.
+ * 
+ * Unlike \`getResumeUrls()\`, which signs a random nonce, these address the very
+ * \`resume_job\` record the step's built-in approval buttons use, so they are
+ * stable across replays and safe to embed in a custom notification.
+ * 
+ * \`stepKey\` must match the \`key\` given to \`waitForApproval\`. Keys must be unique
+ * within a workflow; reusing one throws rather than silently renaming it. The URL
+ * only resumes while that step is awaiting approval; used at any other moment it is
+ * rejected rather than banking a row a different approval would consume. Send it
+ * ahead of time — approvers just cannot act before the workflow reaches the step.
+ * 
+ * \`resume\` and \`cancel\` are step-bound; \`approvalPage\` is not — it opens the job's
+ * approval page, which acts on whichever approval is pending when it is used.
+ * 
+ * @example
+ * const urls = await step("urls", () => getApprovalUrls("manager"));
+ * await step("notify", () => sendEmail(urls.resume, urls.cancel));
+ * await waitForApproval({ key: "manager" });
+ */
+async getApprovalUrls(stepKey: string = "approval", approver?: string): Promise<{
+  approvalPage: string;
+  resume: string;
+  cancel: string;
+}>
 
 /**
  * Process items in parallel with optional concurrency control.
@@ -2660,15 +2716,43 @@ workflow<T>(fn: (...args: any[]) => Promise<T>): void
 /**
  * Suspend the workflow and wait for an external approval.
  * 
- * Use \`getResumeUrls()\` (wrapped in \`step()\`) to obtain resume/cancel/approvalPage
- * URLs before calling this function.
+ * Pass \`key\` to name the step, then \`getApprovalUrls(key)\` yields the URLs that
+ * resume exactly this approval — route them through your own channel. Without a
+ * key the steps are named \`approval\`, \`approval_2\`, ...
  * 
  * @example
- * const urls = await step("urls", () => getResumeUrls());
- * await step("notify", () => sendEmail(urls.approvalPage));
- * const { value, approver } = await waitForApproval({ timeout: 3600 });
+ * const urls = await step("urls", () => getApprovalUrls("manager"));
+ * await step("notify", () => sendEmail(urls.resume, urls.cancel));
+ * const { value, approver } = await waitForApproval({ key: "manager", timeout: 3600 });
  */
-waitForApproval(options?: { timeout?: number; form?: object; selfApproval?: boolean; }): PromiseLike<{ value: any; approver: string; approved: boolean }>
+waitForApproval(options?: { timeout?: number; form?: object; selfApproval?: boolean; key?: string; }): PromiseLike<{ value: any; approver: string; approved: boolean }>
+
+/**
+ * Resume/cancel/approval-page URLs bound to one \`waitForApproval\` step.
+ * 
+ * Unlike \`getResumeUrls()\`, which signs a random nonce, these address the very
+ * \`resume_job\` record the step's built-in approval buttons use, so they are
+ * stable across replays and safe to embed in a custom notification.
+ * 
+ * \`stepKey\` must match the \`key\` given to \`waitForApproval\`. Keys must be unique
+ * within a workflow; reusing one throws rather than silently renaming it. The URL
+ * only resumes while that step is awaiting approval; used at any other moment it is
+ * rejected rather than banking a row a different approval would consume. Send it
+ * ahead of time — approvers just cannot act before the workflow reaches the step.
+ * 
+ * \`resume\` and \`cancel\` are step-bound; \`approvalPage\` is not — it opens the job's
+ * approval page, which acts on whichever approval is pending when it is used.
+ * 
+ * @example
+ * const urls = await step("urls", () => getApprovalUrls("manager"));
+ * await step("notify", () => sendEmail(urls.resume, urls.cancel));
+ * await waitForApproval({ key: "manager" });
+ */
+async getApprovalUrls(stepKey: string = "approval", approver?: string): Promise<{
+  approvalPage: string;
+  resume: string;
+  cancel: string;
+}>
 
 /**
  * Process items in parallel with optional concurrency control.
@@ -4254,6 +4338,17 @@ def get_shared_state(path: str = 'state.json') -> None
 #     Dictionary with approvalPage, resume, and cancel URLs
 def get_resume_urls(approver: str = None, flow_level: bool = None) -> dict
 
+# Get the resume URLs bound to one \`\`wait_for_approval\`\` step of this workflow.
+# 
+# Args:
+#     step_key: Checkpoint key of the approval step, as passed to
+#         \`\`wait_for_approval(key=...)\`\`
+#     approver: Optional approver name
+# 
+# Returns:
+#     Dictionary with approvalPage, resume, and cancel URLs
+def get_approval_urls(step_key: str = 'approval', approver: str = None) -> dict
+
 # Sends an interactive approval request via Slack, allowing optional customization of the message, approver, and form fields.
 # 
 # **[Enterprise Edition Only]** To include form fields in the Slack approval request, use the "Advanced -> Suspend -> Form" functionality.
@@ -4530,8 +4625,9 @@ async def sleep(seconds: int)
 
 # Suspend the workflow and wait for an external approval.
 # 
-# Use \`\`get_resume_urls()\`\` (wrapped in \`\`step()\`\`) to obtain
-# resume/cancel/approval URLs before calling this function.
+# Pass \`\`key\`\` to name the step, then \`\`get_approval_urls(key)\`\` yields the URLs
+# that resume exactly this approval — route them through your own channel.
+# Without a key the steps are named \`\`approval\`\`, \`\`approval_2\`\`, ...
 # 
 # Returns a dict with \`\`value\`\` (form data), \`\`approver\`\`, and \`\`approved\`\`.
 # 
@@ -4539,13 +4635,14 @@ async def sleep(seconds: int)
 #     timeout: Approval timeout in seconds (default 1800).
 #     form: Optional form schema for the approval page.
 #     self_approval: Whether the user who triggered the flow can approve it (default True).
+#     key: Optional checkpoint key naming this approval step.
 # 
 # Example::
 # 
-#     urls = await step("urls", lambda: get_resume_urls())
-#     await step("notify", lambda: send_email(urls["approvalPage"]))
-#     result = await wait_for_approval(timeout=3600)
-async def wait_for_approval(timeout: int = 1800, form: dict | None = None, self_approval: bool = True) -> dict
+#     urls = await step("urls", lambda: get_approval_urls("manager"))
+#     await step("notify", lambda: send_email(urls["resume"], urls["cancel"]))
+#     result = await wait_for_approval(key="manager", timeout=3600)
+async def wait_for_approval(timeout: int = 1800, form: dict | None = None, self_approval: bool = True, key: str | None = None) -> dict
 
 # Process items in parallel with optional concurrency control.
 # 
@@ -6177,7 +6274,7 @@ import {
   step,
   sleep,
   waitForApproval,
-  getResumeUrls,
+  getApprovalUrls,
   parallel,
   workflow,
 } from "windmill-client";
@@ -6195,7 +6292,7 @@ export const main = workflow(async (x: string) => {
 Python:
 
 \`\`\`python
-from wmill import task, task_script, task_flow, step, sleep, wait_for_approval, get_resume_urls, parallel, workflow
+from wmill import task, task_script, task_flow, step, sleep, wait_for_approval, get_approval_urls, parallel, workflow
 
 @task()
 async def process(x: str) -> str:
@@ -6279,12 +6376,13 @@ output = await pipeline(input=data)
 Use \`step()\` for lightweight inline values that must not change during replay:
 
 \`\`\`typescript
-const urls = await step("get_urls", () => getResumeUrls());
 const startedAt = await step("started_at", () => new Date().toISOString());
 \`\`\`
 
 \`\`\`python
-urls = await step("get_urls", lambda: get_resume_urls())
+from datetime import datetime
+
+started_at = await step("started_at", lambda: datetime.now().isoformat())
 \`\`\`
 
 Use stable, descriptive step names. Do not generate step names dynamically.
@@ -6309,20 +6407,28 @@ Only parallelize independent steps. Do not read the result of a task before it i
 
 ## Approvals
 
-Generate resume URLs inside \`step()\` before sending them:
+Name the approval step and generate its URLs inside \`step()\` before sending them.
+\`getApprovalUrls\` / \`get_approval_urls\` returns the URLs bound to that step, the same
+ones its built-in approve/reject buttons use:
 
 \`\`\`typescript
-const urls = await step("get_urls", () => getResumeUrls());
-await step("notify", () => sendApprovalEmail(urls.approvalPage));
-const approval = await waitForApproval({ timeout: 3600 });
+const urls = await step("urls", () => getApprovalUrls("manager"));
+await step("notify", () => sendApprovalEmail(urls.resume, urls.cancel));
+const approval = await waitForApproval({ key: "manager", timeout: 3600 });
 \`\`\`
 
 \`\`\`python
-urls = await step("get_urls", lambda: get_resume_urls())
-await step("notify", lambda: send_approval_email(urls["approvalPage"]))
-approval = await wait_for_approval(timeout=3600)
+urls = await step("urls", lambda: get_approval_urls("manager"))
+await step("notify", lambda: send_approval_email(urls["resume"], urls["cancel"]))
+approval = await wait_for_approval(key="manager", timeout=3600)
 \`\`\`
 
+With several approvals in one workflow, give each its own key so each notification
+resumes its own step. Keys must be unique — reusing one raises an error rather than
+silently renaming the step. A minted URL only resumes while its own step is awaiting
+approval; used at any other moment it is rejected rather than resuming the wrong one. \`getResumeUrls()\` / \`get_resume_urls()\` still works but signs a
+random nonce, so its URLs are not tied to any particular approval step.
+
 \`selfApproval: false\` and \`self_approval=False\` are Enterprise-only approval behavior. Do not use them unless the user asks for that behavior.
 
 ## Error Handling
@@ -6336,7 +6442,7 @@ TypeScript: avoid broad \`try/catch\` around WAC SDK calls. The SDK uses an inte
 
 ## TypeScript Workflow-as-Code API (windmill-client)
 
-Import: \`import { workflow, task, taskScript, taskFlow, step, sleep, waitForApproval, getResumeUrls, parallel } from "windmill-client"\`
+Import: \`import { workflow, task, taskScript, taskFlow, step, sleep, waitForApproval, getApprovalUrls, getResumeUrls, parallel } from "windmill-client"\`
 
 \`\`\`typescript
 export interface TaskOptions {
@@ -6406,15 +6512,39 @@ export async function sleep(seconds: number): Promise<void>
 /**
  * Suspend the workflow and wait for an external approval.
  *
- * Use \`getResumeUrls()\` (wrapped in \`step()\`) to obtain resume/cancel/approvalPage
- * URLs before calling this function.
+ * Pass \`key\` to name the step, then \`getApprovalUrls(key)\` yields the URLs that
+ * resume exactly this approval — route them through your own channel. Without a
+ * key the steps are named \`approval\`, \`approval_2\`, ...
  *
  * @example
- * const urls = await step("urls", () => getResumeUrls());
- * await step("notify", () => sendEmail(urls.approvalPage));
- * const { value, approver } = await waitForApproval({ timeout: 3600 });
+ * const urls = await step("urls", () => getApprovalUrls("manager"));
+ * await step("notify", () => sendEmail(urls.resume, urls.cancel));
+ * const { value, approver } = await waitForApproval({ key: "manager", timeout: 3600 });
  */
-export function waitForApproval(options?: { timeout?: number; form?: object; selfApproval?: boolean; }): PromiseLike<{ value: any; approver: string; approved: boolean }>
+export function waitForApproval(options?: { timeout?: number; form?: object; selfApproval?: boolean; key?: string; }): PromiseLike<{ value: any; approver: string; approved: boolean }>
+
+/**
+ * Resume/cancel/approval-page URLs bound to one \`waitForApproval\` step.
+ *
+ * Unlike \`getResumeUrls()\`, which signs a random nonce, these address the very
+ * \`resume_job\` record the step's built-in approval buttons use, so they are
+ * stable across replays and safe to embed in a custom notification.
+ *
+ * \`stepKey\` must match the \`key\` given to \`waitForApproval\`. Keys must be unique
+ * within a workflow; reusing one throws rather than silently renaming it. The URL
+ * only resumes while that step is awaiting approval; used at any other moment it is
+ * rejected rather than banking a row a different approval would consume. Send it
+ * ahead of time — approvers just cannot act before the workflow reaches the step.
+ *
+ * \`resume\` and \`cancel\` are step-bound; \`approvalPage\` is not — it opens the job's
+ * approval page, which acts on whichever approval is pending when it is used.
+ *
+ * @example
+ * const urls = await step("urls", () => getApprovalUrls("manager"));
+ * await step("notify", () => sendEmail(urls.resume, urls.cancel));
+ * await waitForApproval({ key: "manager" });
+ */
+export async function getApprovalUrls(stepKey: string = "approval", approver?: string): Promise<{ approvalPage: string; resume: string; cancel: string; }>
 
 /**
  * Process items in parallel with optional concurrency control.
@@ -6432,7 +6562,7 @@ export async function parallel<T, R>(items: T[], fn: (item: T) => PromiseLike<R>
 
 ## Python Workflow-as-Code API (wmill)
 
-Import: \`from wmill import workflow, task, task_script, task_flow, step, sleep, wait_for_approval, get_resume_urls, parallel, TaskError\`
+Import: \`from wmill import workflow, task, task_script, task_flow, step, sleep, wait_for_approval, get_approval_urls, get_resume_urls, parallel, TaskError\`
 
 \`\`\`python
 # Raised when a WAC task step failed.
@@ -6520,8 +6650,9 @@ async def sleep(seconds: int)
 
 # Suspend the workflow and wait for an external approval.
 #
-# Use \`\`get_resume_urls()\`\` (wrapped in \`\`step()\`\`) to obtain
-# resume/cancel/approval URLs before calling this function.
+# Pass \`\`key\`\` to name the step, then \`\`get_approval_urls(key)\`\` yields the URLs
+# that resume exactly this approval — route them through your own channel.
+# Without a key the steps are named \`\`approval\`\`, \`\`approval_2\`\`, ...
 #
 # Returns a dict with \`\`value\`\` (form data), \`\`approver\`\`, and \`\`approved\`\`.
 #
@@ -6529,13 +6660,37 @@ async def sleep(seconds: int)
 #     timeout: Approval timeout in seconds (default 1800).
 #     form: Optional form schema for the approval page.
 #     self_approval: Whether the user who triggered the flow can approve it (default True).
+#     key: Optional checkpoint key naming this approval step.
 #
 # Example::
 #
-#     urls = await step("urls", lambda: get_resume_urls())
-#     await step("notify", lambda: send_email(urls["approvalPage"]))
-#     result = await wait_for_approval(timeout=3600)
-async def wait_for_approval(timeout: int = 1800, form: dict | None = None, self_approval: bool = True) -> dict
+#     urls = await step("urls", lambda: get_approval_urls("manager"))
+#     await step("notify", lambda: send_email(urls["resume"], urls["cancel"]))
+#     result = await wait_for_approval(key="manager", timeout=3600)
+async def wait_for_approval(timeout: int = 1800, form: dict | None = None, self_approval: bool = True, key: str | None = None) -> dict
+
+# Get the resume/cancel/approval-page URLs bound to one \`\`wait_for_approval\`\` step.
+#
+# Unlike :func:\`get_resume_urls\`, which signs a random nonce, these address the
+# very \`\`resume_job\`\` record the step's built-in approval buttons use, so they
+# are stable across replays and safe to embed in a custom notification.
+#
+# Args:
+#     step_key: Checkpoint key of the approval step, as passed to
+#         \`\`wait_for_approval(key=...)\`\`. Keys must be unique within a workflow;
+#         reusing one raises rather than silently renaming it. The URL only
+#         resumes while that step is awaiting approval; used at any other moment
+#         it is rejected rather than banking a row a different approval would
+#         consume. Send it ahead of time — approvers just cannot act before the
+#         workflow reaches the step.
+#         \`\`resume\`\` and \`\`cancel\`\` are step-bound; \`\`approvalPage\`\` is not — it
+#         opens the job's approval page, which acts on whichever approval is
+#         pending when it is used.
+#     approver: Optional approver name
+#
+# Returns:
+#     Dictionary with approvalPage, resume, and cancel URLs
+def get_approval_urls(step_key: str = 'approval', approver: str = None) -> dict
 
 # Process items in parallel with optional concurrency control.
 #
diff --git a/python-client/wmill/tests/test_workflow.py b/python-client/wmill/tests/test_workflow.py
index 43a5f22693..a8c97a31d2 100644
--- a/python-client/wmill/tests/test_workflow.py
+++ b/python-client/wmill/tests/test_workflow.py
@@ -3,7 +3,7 @@
 import asyncio
 import pytest
 
-from wmill.client import WorkflowCtx, _StepSuspend, TaskError, workflow, task, step, sleep, parallel, _run_workflow
+from wmill.client import WorkflowCtx, _StepSuspend, TaskError, workflow, task, step, sleep, parallel, wait_for_approval, _run_workflow
 
 
 @task
@@ -1112,3 +1112,58 @@ class TestParallel:
         r = _run_workflow(wf, {}, {})
         assert r["type"] == "complete"
         assert r["result"] == []
+
+
+class TestApprovalKeys:
+    """`key` names the step that get_approval_urls() mints URLs against, so a
+    duplicate must fail rather than silently become `<key>_2` and leave the
+    caller holding a URL for the earlier step."""
+
+    def test_explicit_key_is_used_verbatim(self):
+        @workflow
+        async def wf():
+            return await wait_for_approval(key="manager")
+
+        assert _run_workflow(wf, {}, {})["key"] == "manager"
+
+    def test_duplicate_explicit_key_raises(self):
+        @workflow
+        async def wf():
+            await wait_for_approval(key="manager")
+            await wait_for_approval(key="manager")
+
+        with pytest.raises(RuntimeError, match="already used"):
+            _run_workflow(wf, {"completed_steps": {"manager": {"approved": True}}}, {})
+
+    def test_explicit_key_colliding_with_a_suffixed_step_key_raises(self):
+        """`step("dup")` twice yields `dup`/`dup_2`, so an approval explicitly named
+        `dup_2` would alias the second step's key."""
+
+        @workflow
+        async def wf():
+            await step("dup", lambda: 1)
+            await step("dup", lambda: 2)
+            await wait_for_approval(key="dup_2")
+
+        with pytest.raises(RuntimeError, match="already used"):
+            _run_workflow(wf, {"completed_steps": {"dup": 1, "dup_2": 2}}, {})
+
+    @pytest.mark.parametrize("bad", ["", "  ", ".", "..", "a/b"])
+    def test_unusable_key_raises(self, bad):
+        """The key travels as one path segment when its URLs are minted, so anything
+        `get_approval_urls` could not address must be refused here too."""
+
+        @workflow
+        async def wf():
+            await wait_for_approval(key=bad)
+
+        with pytest.raises(RuntimeError, match="non-empty step name"):
+            _run_workflow(wf, {}, {})
+
+    def test_unnamed_approvals_still_auto_number(self):
+        @workflow
+        async def wf():
+            await wait_for_approval()
+            await wait_for_approval()
+
+        assert _run_workflow(wf, {"completed_steps": {"approval": {}}}, {})["key"] == "approval_2"
diff --git a/python-client/wmill/wmill/client.py b/python-client/wmill/wmill/client.py
index fc4c34737d..f18cffc8e7 100644
--- a/python-client/wmill/wmill/client.py
+++ b/python-client/wmill/wmill/client.py
@@ -1274,6 +1274,29 @@ class Windmill:
             params=params,
         ).json()
 
+    def get_approval_urls(self, step_key: str = "approval", approver: str = None) -> dict:
+        """Get the resume URLs bound to one ``wait_for_approval`` step of this workflow.
+
+        Args:
+            step_key: Checkpoint key of the approval step, as passed to
+                ``wait_for_approval(key=...)``
+            approver: Optional approver name
+
+        Returns:
+            Dictionary with approvalPage, resume, and cancel URLs
+        """
+        from urllib.parse import quote
+
+        _assert_usable_step_key(step_key, "get_approval_urls step_key")
+        job_id = os.environ.get("WM_JOB_ID") or "NO_ID"
+        # Omit rather than send `approver=`: an empty value is echoed into the
+        # returned URLs and recorded as the approver instead of "anonymous".
+        params = {"approver": approver} if approver is not None else {}
+        return self.get(
+            f"/w/{self.workspace}/jobs/wac_approval_urls/{job_id}/{quote(step_key, safe='')}",
+            params=params,
+        ).json()
+
     def request_interactive_slack_approval(
         self,
         slack_resource_path: str,
@@ -2027,6 +2050,33 @@ def get_resume_urls(approver: str = None, flow_level: bool = None) -> dict:
     return _client.get_resume_urls(approver, flow_level)
 
 
+@init_global_client
+def get_approval_urls(step_key: str = "approval", approver: str = None) -> dict:
+    """Get the resume/cancel/approval-page URLs bound to one ``wait_for_approval`` step.
+
+    Unlike :func:`get_resume_urls`, which signs a random nonce, these address the
+    very ``resume_job`` record the step's built-in approval buttons use, so they
+    are stable across replays and safe to embed in a custom notification.
+
+    Args:
+        step_key: Checkpoint key of the approval step, as passed to
+            ``wait_for_approval(key=...)``. Keys must be unique within a workflow;
+            reusing one raises rather than silently renaming it. The URL only
+            resumes while that step is awaiting approval; used at any other moment
+            it is rejected rather than banking a row a different approval would
+            consume. Send it ahead of time — approvers just cannot act before the
+            workflow reaches the step.
+            ``resume`` and ``cancel`` are step-bound; ``approvalPage`` is not — it
+            opens the job's approval page, which acts on whichever approval is
+            pending when it is used.
+        approver: Optional approver name
+
+    Returns:
+        Dictionary with approvalPage, resume, and cancel URLs
+    """
+    return _client.get_approval_urls(step_key, approver)
+
+
 @init_global_client
 def request_interactive_slack_approval(
     slack_resource_path: str,
@@ -2606,6 +2656,15 @@ import asyncio as _asyncio
 import contextvars as _contextvars
 
 
+def _assert_usable_step_key(key: str, what: str) -> None:
+    """A step key travels as one path segment when its URLs are minted, so it must be
+    non-empty and free of ``/`` and dot segments — otherwise ``wait_for_approval``
+    would accept a key ``get_approval_urls`` can never address."""
+    k = key.strip()
+    if not k or k in (".", "..") or "/" in key or "\\" in key:
+        raise RuntimeError(f"{what} must be a non-empty step name without `/` or dot segments")
+
+
 class _StepSuspend(BaseException):
     """Raised to suspend workflow execution. Inherits from BaseException
     so it is not caught by bare `except Exception:` blocks."""
@@ -2645,6 +2704,8 @@ class WorkflowCtx:
         checkpoint = checkpoint or {}
         self._completed: dict = checkpoint.get("completed_steps", {})
         self._counters: dict[str, int] = {}
+        # Every key handed out by _alloc_key, so distinct names can't alias one key.
+        self._used_keys: set[str] = set()
         self._pending: list = []
         self._executing_key: str | None = checkpoint.get("_executing_key")
         # Reuse a single httpx.AsyncClient across all fast-path step() calls
@@ -2666,10 +2727,20 @@ class WorkflowCtx:
         self._inline_lock: "_asyncio.Lock | None" = None
 
     def _alloc_key(self, name: str = "step") -> str:
-        """Name-based key: ``double`` for first call, ``double_2``, ``double_3`` for subsequent."""
+        """Name-based key: ``double`` for first call, ``double_2``, ``double_3`` for subsequent.
+
+        Suffixing alone can alias — a second ``step("x")`` and a first ``step("x_2")``
+        both want ``x_2`` — so keep bumping past keys already handed out. Allocation
+        order is fixed by the workflow body, so replays reproduce the same keys.
+        """
         n = self._counters.get(name, 0) + 1
+        key = name if n == 1 else f"{name}_{n}"
+        while key in self._used_keys:
+            n += 1
+            key = f"{name}_{n}"
         self._counters[name] = n
-        return name if n == 1 else f"{name}_{n}"
+        self._used_keys.add(key)
+        return key
 
     def _next_step(self, name: str, script: str, func=None, dispatch_type: str = "inline", _task_options: Optional[dict] = None, **kwargs):
         """Return an awaitable that either resolves from cache or suspends."""
@@ -2724,9 +2795,25 @@ class WorkflowCtx:
         )
 
     async def _wait_for_approval(
-        self, timeout: int = 1800, form: dict | None = None, self_approval: bool = True
+        self,
+        timeout: int = 1800,
+        form: dict | None = None,
+        self_approval: bool = True,
+        key: str | None = None,
     ):
-        key = self._alloc_key("approval")
+        if key is not None:
+            _assert_usable_step_key(key, "wait_for_approval key")
+        requested_key, key = key, self._alloc_key(key or "approval")
+
+        # An explicit key is an identifier callers mint URLs against, so silently
+        # renaming a duplicate to ``<key>_2`` would hand them a URL for the *first*
+        # step — which then fails with "resume request already sent" and parks the
+        # workflow until timeout. Unnamed approvals keep auto-numbering.
+        if requested_key and key != requested_key:
+            raise RuntimeError(
+                f'WAC step key "{requested_key}" is already used in this workflow. '
+                "Give each wait_for_approval() its own key so get_approval_urls() can address it."
+            )
 
         if key in self._completed:
             return self._completed[key]
@@ -3073,11 +3160,13 @@ async def wait_for_approval(
     timeout: int = 1800,
     form: dict | None = None,
     self_approval: bool = True,
+    key: str | None = None,
 ) -> dict:
     """Suspend the workflow and wait for an external approval.
 
-    Use ``get_resume_urls()`` (wrapped in ``step()``) to obtain
-    resume/cancel/approval URLs before calling this function.
+    Pass ``key`` to name the step, then ``get_approval_urls(key)`` yields the URLs
+    that resume exactly this approval — route them through your own channel.
+    Without a key the steps are named ``approval``, ``approval_2``, ...
 
     Returns a dict with ``value`` (form data), ``approver``, and ``approved``.
 
@@ -3085,16 +3174,19 @@ async def wait_for_approval(
         timeout: Approval timeout in seconds (default 1800).
         form: Optional form schema for the approval page.
         self_approval: Whether the user who triggered the flow can approve it (default True).
+        key: Optional checkpoint key naming this approval step.
 
     Example::
 
-        urls = await step("urls", lambda: get_resume_urls())
-        await step("notify", lambda: send_email(urls["approvalPage"]))
-        result = await wait_for_approval(timeout=3600)
+        urls = await step("urls", lambda: get_approval_urls("manager"))
+        await step("notify", lambda: send_email(urls["resume"], urls["cancel"]))
+        result = await wait_for_approval(key="manager", timeout=3600)
     """
     ctx: WorkflowCtx | None = _workflow_ctx.get(None)
     if ctx is not None:
-        return await ctx._wait_for_approval(timeout=timeout, form=form, self_approval=self_approval)
+        return await ctx._wait_for_approval(
+            timeout=timeout, form=form, self_approval=self_approval, key=key
+        )
     raise RuntimeError("wait_for_approval can only be called inside a @workflow")
 
 
diff --git a/system_prompts/auto-generated/prompts.ts b/system_prompts/auto-generated/prompts.ts
index 7ab815b644..cb933dfb0d 100644
--- a/system_prompts/auto-generated/prompts.ts
+++ b/system_prompts/auto-generated/prompts.ts
@@ -874,7 +874,7 @@ import {
   step,
   sleep,
   waitForApproval,
-  getResumeUrls,
+  getApprovalUrls,
   parallel,
   workflow,
 } from "windmill-client";
@@ -892,7 +892,7 @@ export const main = workflow(async (x: string) => {
 Python:
 
 \`\`\`python
-from wmill import task, task_script, task_flow, step, sleep, wait_for_approval, get_resume_urls, parallel, workflow
+from wmill import task, task_script, task_flow, step, sleep, wait_for_approval, get_approval_urls, parallel, workflow
 
 @task()
 async def process(x: str) -> str:
@@ -976,12 +976,13 @@ output = await pipeline(input=data)
 Use \`step()\` for lightweight inline values that must not change during replay:
 
 \`\`\`typescript
-const urls = await step("get_urls", () => getResumeUrls());
 const startedAt = await step("started_at", () => new Date().toISOString());
 \`\`\`
 
 \`\`\`python
-urls = await step("get_urls", lambda: get_resume_urls())
+from datetime import datetime
+
+started_at = await step("started_at", lambda: datetime.now().isoformat())
 \`\`\`
 
 Use stable, descriptive step names. Do not generate step names dynamically.
@@ -1006,20 +1007,28 @@ Only parallelize independent steps. Do not read the result of a task before it i
 
 ## Approvals
 
-Generate resume URLs inside \`step()\` before sending them:
+Name the approval step and generate its URLs inside \`step()\` before sending them.
+\`getApprovalUrls\` / \`get_approval_urls\` returns the URLs bound to that step, the same
+ones its built-in approve/reject buttons use:
 
 \`\`\`typescript
-const urls = await step("get_urls", () => getResumeUrls());
-await step("notify", () => sendApprovalEmail(urls.approvalPage));
-const approval = await waitForApproval({ timeout: 3600 });
+const urls = await step("urls", () => getApprovalUrls("manager"));
+await step("notify", () => sendApprovalEmail(urls.resume, urls.cancel));
+const approval = await waitForApproval({ key: "manager", timeout: 3600 });
 \`\`\`
 
 \`\`\`python
-urls = await step("get_urls", lambda: get_resume_urls())
-await step("notify", lambda: send_approval_email(urls["approvalPage"]))
-approval = await wait_for_approval(timeout=3600)
+urls = await step("urls", lambda: get_approval_urls("manager"))
+await step("notify", lambda: send_approval_email(urls["resume"], urls["cancel"]))
+approval = await wait_for_approval(key="manager", timeout=3600)
 \`\`\`
 
+With several approvals in one workflow, give each its own key so each notification
+resumes its own step. Keys must be unique — reusing one raises an error rather than
+silently renaming the step. A minted URL only resumes while its own step is awaiting
+approval; used at any other moment it is rejected rather than resuming the wrong one. \`getResumeUrls()\` / \`get_resume_urls()\` still works but signs a
+random nonce, so its URLs are not tied to any particular approval step.
+
 \`selfApproval: false\` and \`self_approval=False\` are Enterprise-only approval behavior. Do not use them unless the user asks for that behavior.
 
 ## Error Handling
@@ -1566,15 +1575,43 @@ workflow<T>(fn: (...args: any[]) => Promise<T>): void
 /**
  * Suspend the workflow and wait for an external approval.
  * 
- * Use \`getResumeUrls()\` (wrapped in \`step()\`) to obtain resume/cancel/approvalPage
- * URLs before calling this function.
+ * Pass \`key\` to name the step, then \`getApprovalUrls(key)\` yields the URLs that
+ * resume exactly this approval — route them through your own channel. Without a
+ * key the steps are named \`approval\`, \`approval_2\`, ...
  * 
  * @example
- * const urls = await step("urls", () => getResumeUrls());
- * await step("notify", () => sendEmail(urls.approvalPage));
- * const { value, approver } = await waitForApproval({ timeout: 3600 });
+ * const urls = await step("urls", () => getApprovalUrls("manager"));
+ * await step("notify", () => sendEmail(urls.resume, urls.cancel));
+ * const { value, approver } = await waitForApproval({ key: "manager", timeout: 3600 });
  */
-waitForApproval(options?: { timeout?: number; form?: object; selfApproval?: boolean; }): PromiseLike<{ value: any; approver: string; approved: boolean }>
+waitForApproval(options?: { timeout?: number; form?: object; selfApproval?: boolean; key?: string; }): PromiseLike<{ value: any; approver: string; approved: boolean }>
+
+/**
+ * Resume/cancel/approval-page URLs bound to one \`waitForApproval\` step.
+ * 
+ * Unlike \`getResumeUrls()\`, which signs a random nonce, these address the very
+ * \`resume_job\` record the step's built-in approval buttons use, so they are
+ * stable across replays and safe to embed in a custom notification.
+ * 
+ * \`stepKey\` must match the \`key\` given to \`waitForApproval\`. Keys must be unique
+ * within a workflow; reusing one throws rather than silently renaming it. The URL
+ * only resumes while that step is awaiting approval; used at any other moment it is
+ * rejected rather than banking a row a different approval would consume. Send it
+ * ahead of time — approvers just cannot act before the workflow reaches the step.
+ * 
+ * \`resume\` and \`cancel\` are step-bound; \`approvalPage\` is not — it opens the job's
+ * approval page, which acts on whichever approval is pending when it is used.
+ * 
+ * @example
+ * const urls = await step("urls", () => getApprovalUrls("manager"));
+ * await step("notify", () => sendEmail(urls.resume, urls.cancel));
+ * await waitForApproval({ key: "manager" });
+ */
+async getApprovalUrls(stepKey: string = "approval", approver?: string): Promise<{
+  approvalPage: string;
+  resume: string;
+  cancel: string;
+}>
 
 /**
  * Process items in parallel with optional concurrency control.
@@ -2066,6 +2103,17 @@ def get_shared_state(path: str = 'state.json') -> None
 #     Dictionary with approvalPage, resume, and cancel URLs
 def get_resume_urls(approver: str = None, flow_level: bool = None) -> dict
 
+# Get the resume URLs bound to one \`\`wait_for_approval\`\` step of this workflow.
+# 
+# Args:
+#     step_key: Checkpoint key of the approval step, as passed to
+#         \`\`wait_for_approval(key=...)\`\`
+#     approver: Optional approver name
+# 
+# Returns:
+#     Dictionary with approvalPage, resume, and cancel URLs
+def get_approval_urls(step_key: str = 'approval', approver: str = None) -> dict
+
 # Sends an interactive approval request via Slack, allowing optional customization of the message, approver, and form fields.
 # 
 # **[Enterprise Edition Only]** To include form fields in the Slack approval request, use the "Advanced -> Suspend -> Form" functionality.
@@ -2342,8 +2390,9 @@ async def sleep(seconds: int)
 
 # Suspend the workflow and wait for an external approval.
 # 
-# Use \`\`get_resume_urls()\`\` (wrapped in \`\`step()\`\`) to obtain
-# resume/cancel/approval URLs before calling this function.
+# Pass \`\`key\`\` to name the step, then \`\`get_approval_urls(key)\`\` yields the URLs
+# that resume exactly this approval — route them through your own channel.
+# Without a key the steps are named \`\`approval\`\`, \`\`approval_2\`\`, ...
 # 
 # Returns a dict with \`\`value\`\` (form data), \`\`approver\`\`, and \`\`approved\`\`.
 # 
@@ -2351,13 +2400,14 @@ async def sleep(seconds: int)
 #     timeout: Approval timeout in seconds (default 1800).
 #     form: Optional form schema for the approval page.
 #     self_approval: Whether the user who triggered the flow can approve it (default True).
+#     key: Optional checkpoint key naming this approval step.
 # 
 # Example::
 # 
-#     urls = await step("urls", lambda: get_resume_urls())
-#     await step("notify", lambda: send_email(urls["approvalPage"]))
-#     result = await wait_for_approval(timeout=3600)
-async def wait_for_approval(timeout: int = 1800, form: dict | None = None, self_approval: bool = True) -> dict
+#     urls = await step("urls", lambda: get_approval_urls("manager"))
+#     await step("notify", lambda: send_email(urls["resume"], urls["cancel"]))
+#     result = await wait_for_approval(key="manager", timeout=3600)
+async def wait_for_approval(timeout: int = 1800, form: dict | None = None, self_approval: bool = True, key: str | None = None) -> dict
 
 # Process items in parallel with optional concurrency control.
 # 
@@ -2386,7 +2436,7 @@ def commit_kafka_offsets(trigger_path: str, topic: str, partition: int, offset:
 
 export const WAC_SDK_TYPESCRIPT = `## TypeScript Workflow-as-Code API (windmill-client)
 
-Import: \`import { workflow, task, taskScript, taskFlow, step, sleep, waitForApproval, getResumeUrls, parallel } from "windmill-client"\`
+Import: \`import { workflow, task, taskScript, taskFlow, step, sleep, waitForApproval, getApprovalUrls, getResumeUrls, parallel } from "windmill-client"\`
 
 \`\`\`typescript
 export interface TaskOptions {
@@ -2456,15 +2506,39 @@ export async function sleep(seconds: number): Promise<void>
 /**
  * Suspend the workflow and wait for an external approval.
  *
- * Use \`getResumeUrls()\` (wrapped in \`step()\`) to obtain resume/cancel/approvalPage
- * URLs before calling this function.
+ * Pass \`key\` to name the step, then \`getApprovalUrls(key)\` yields the URLs that
+ * resume exactly this approval — route them through your own channel. Without a
+ * key the steps are named \`approval\`, \`approval_2\`, ...
  *
  * @example
- * const urls = await step("urls", () => getResumeUrls());
- * await step("notify", () => sendEmail(urls.approvalPage));
- * const { value, approver } = await waitForApproval({ timeout: 3600 });
+ * const urls = await step("urls", () => getApprovalUrls("manager"));
+ * await step("notify", () => sendEmail(urls.resume, urls.cancel));
+ * const { value, approver } = await waitForApproval({ key: "manager", timeout: 3600 });
  */
-export function waitForApproval(options?: { timeout?: number; form?: object; selfApproval?: boolean; }): PromiseLike<{ value: any; approver: string; approved: boolean }>
+export function waitForApproval(options?: { timeout?: number; form?: object; selfApproval?: boolean; key?: string; }): PromiseLike<{ value: any; approver: string; approved: boolean }>
+
+/**
+ * Resume/cancel/approval-page URLs bound to one \`waitForApproval\` step.
+ *
+ * Unlike \`getResumeUrls()\`, which signs a random nonce, these address the very
+ * \`resume_job\` record the step's built-in approval buttons use, so they are
+ * stable across replays and safe to embed in a custom notification.
+ *
+ * \`stepKey\` must match the \`key\` given to \`waitForApproval\`. Keys must be unique
+ * within a workflow; reusing one throws rather than silently renaming it. The URL
+ * only resumes while that step is awaiting approval; used at any other moment it is
+ * rejected rather than banking a row a different approval would consume. Send it
+ * ahead of time — approvers just cannot act before the workflow reaches the step.
+ *
+ * \`resume\` and \`cancel\` are step-bound; \`approvalPage\` is not — it opens the job's
+ * approval page, which acts on whichever approval is pending when it is used.
+ *
+ * @example
+ * const urls = await step("urls", () => getApprovalUrls("manager"));
+ * await step("notify", () => sendEmail(urls.resume, urls.cancel));
+ * await waitForApproval({ key: "manager" });
+ */
+export async function getApprovalUrls(stepKey: string = "approval", approver?: string): Promise<{ approvalPage: string; resume: string; cancel: string; }>
 
 /**
  * Process items in parallel with optional concurrency control.
@@ -2482,7 +2556,7 @@ export async function parallel<T, R>(items: T[], fn: (item: T) => PromiseLike<R>
 
 export const WAC_SDK_PYTHON = `## Python Workflow-as-Code API (wmill)
 
-Import: \`from wmill import workflow, task, task_script, task_flow, step, sleep, wait_for_approval, get_resume_urls, parallel, TaskError\`
+Import: \`from wmill import workflow, task, task_script, task_flow, step, sleep, wait_for_approval, get_approval_urls, get_resume_urls, parallel, TaskError\`
 
 \`\`\`python
 # Raised when a WAC task step failed.
@@ -2570,8 +2644,9 @@ async def sleep(seconds: int)
 
 # Suspend the workflow and wait for an external approval.
 #
-# Use \`\`get_resume_urls()\`\` (wrapped in \`\`step()\`\`) to obtain
-# resume/cancel/approval URLs before calling this function.
+# Pass \`\`key\`\` to name the step, then \`\`get_approval_urls(key)\`\` yields the URLs
+# that resume exactly this approval — route them through your own channel.
+# Without a key the steps are named \`\`approval\`\`, \`\`approval_2\`\`, ...
 #
 # Returns a dict with \`\`value\`\` (form data), \`\`approver\`\`, and \`\`approved\`\`.
 #
@@ -2579,13 +2654,37 @@ async def sleep(seconds: int)
 #     timeout: Approval timeout in seconds (default 1800).
 #     form: Optional form schema for the approval page.
 #     self_approval: Whether the user who triggered the flow can approve it (default True).
+#     key: Optional checkpoint key naming this approval step.
 #
 # Example::
 #
-#     urls = await step("urls", lambda: get_resume_urls())
-#     await step("notify", lambda: send_email(urls["approvalPage"]))
-#     result = await wait_for_approval(timeout=3600)
-async def wait_for_approval(timeout: int = 1800, form: dict | None = None, self_approval: bool = True) -> dict
+#     urls = await step("urls", lambda: get_approval_urls("manager"))
+#     await step("notify", lambda: send_email(urls["resume"], urls["cancel"]))
+#     result = await wait_for_approval(key="manager", timeout=3600)
+async def wait_for_approval(timeout: int = 1800, form: dict | None = None, self_approval: bool = True, key: str | None = None) -> dict
+
+# Get the resume/cancel/approval-page URLs bound to one \`\`wait_for_approval\`\` step.
+#
+# Unlike :func:\`get_resume_urls\`, which signs a random nonce, these address the
+# very \`\`resume_job\`\` record the step's built-in approval buttons use, so they
+# are stable across replays and safe to embed in a custom notification.
+#
+# Args:
+#     step_key: Checkpoint key of the approval step, as passed to
+#         \`\`wait_for_approval(key=...)\`\`. Keys must be unique within a workflow;
+#         reusing one raises rather than silently renaming it. The URL only
+#         resumes while that step is awaiting approval; used at any other moment
+#         it is rejected rather than banking a row a different approval would
+#         consume. Send it ahead of time — approvers just cannot act before the
+#         workflow reaches the step.
+#         \`\`resume\`\` and \`\`cancel\`\` are step-bound; \`\`approvalPage\`\` is not — it
+#         opens the job's approval page, which acts on whichever approval is
+#         pending when it is used.
+#     approver: Optional approver name
+#
+# Returns:
+#     Dictionary with approvalPage, resume, and cancel URLs
+def get_approval_urls(step_key: str = 'approval', approver: str = None) -> dict
 
 # Process items in parallel with optional concurrency control.
 #
diff --git a/system_prompts/auto-generated/script.md b/system_prompts/auto-generated/script.md
index f5a6fd99ba..751b10e3a8 100644
--- a/system_prompts/auto-generated/script.md
+++ b/system_prompts/auto-generated/script.md
@@ -1928,15 +1928,43 @@ workflow<T>(fn: (...args: any[]) => Promise<T>): void
 /**
  * Suspend the workflow and wait for an external approval.
  * 
- * Use `getResumeUrls()` (wrapped in `step()`) to obtain resume/cancel/approvalPage
- * URLs before calling this function.
+ * Pass `key` to name the step, then `getApprovalUrls(key)` yields the URLs that
+ * resume exactly this approval — route them through your own channel. Without a
+ * key the steps are named `approval`, `approval_2`, ...
  * 
  * @example
- * const urls = await step("urls", () => getResumeUrls());
- * await step("notify", () => sendEmail(urls.approvalPage));
- * const { value, approver } = await waitForApproval({ timeout: 3600 });
+ * const urls = await step("urls", () => getApprovalUrls("manager"));
+ * await step("notify", () => sendEmail(urls.resume, urls.cancel));
+ * const { value, approver } = await waitForApproval({ key: "manager", timeout: 3600 });
  */
-waitForApproval(options?: { timeout?: number; form?: object; selfApproval?: boolean; }): PromiseLike<{ value: any; approver: string; approved: boolean }>
+waitForApproval(options?: { timeout?: number; form?: object; selfApproval?: boolean; key?: string; }): PromiseLike<{ value: any; approver: string; approved: boolean }>
+
+/**
+ * Resume/cancel/approval-page URLs bound to one `waitForApproval` step.
+ * 
+ * Unlike `getResumeUrls()`, which signs a random nonce, these address the very
+ * `resume_job` record the step's built-in approval buttons use, so they are
+ * stable across replays and safe to embed in a custom notification.
+ * 
+ * `stepKey` must match the `key` given to `waitForApproval`. Keys must be unique
+ * within a workflow; reusing one throws rather than silently renaming it. The URL
+ * only resumes while that step is awaiting approval; used at any other moment it is
+ * rejected rather than banking a row a different approval would consume. Send it
+ * ahead of time — approvers just cannot act before the workflow reaches the step.
+ * 
+ * `resume` and `cancel` are step-bound; `approvalPage` is not — it opens the job's
+ * approval page, which acts on whichever approval is pending when it is used.
+ * 
+ * @example
+ * const urls = await step("urls", () => getApprovalUrls("manager"));
+ * await step("notify", () => sendEmail(urls.resume, urls.cancel));
+ * await waitForApproval({ key: "manager" });
+ */
+async getApprovalUrls(stepKey: string = "approval", approver?: string): Promise<{
+  approvalPage: string;
+  resume: string;
+  cancel: string;
+}>
 
 /**
  * Process items in parallel with optional concurrency control.
@@ -2428,6 +2456,17 @@ def get_shared_state(path: str = 'state.json') -> None
 #     Dictionary with approvalPage, resume, and cancel URLs
 def get_resume_urls(approver: str = None, flow_level: bool = None) -> dict
 
+# Get the resume URLs bound to one ``wait_for_approval`` step of this workflow.
+# 
+# Args:
+#     step_key: Checkpoint key of the approval step, as passed to
+#         ``wait_for_approval(key=...)``
+#     approver: Optional approver name
+# 
+# Returns:
+#     Dictionary with approvalPage, resume, and cancel URLs
+def get_approval_urls(step_key: str = 'approval', approver: str = None) -> dict
+
 # Sends an interactive approval request via Slack, allowing optional customization of the message, approver, and form fields.
 # 
 # **[Enterprise Edition Only]** To include form fields in the Slack approval request, use the "Advanced -> Suspend -> Form" functionality.
@@ -2704,8 +2743,9 @@ async def sleep(seconds: int)
 
 # Suspend the workflow and wait for an external approval.
 # 
-# Use ``get_resume_urls()`` (wrapped in ``step()``) to obtain
-# resume/cancel/approval URLs before calling this function.
+# Pass ``key`` to name the step, then ``get_approval_urls(key)`` yields the URLs
+# that resume exactly this approval — route them through your own channel.
+# Without a key the steps are named ``approval``, ``approval_2``, ...
 # 
 # Returns a dict with ``value`` (form data), ``approver``, and ``approved``.
 # 
@@ -2713,13 +2753,14 @@ async def sleep(seconds: int)
 #     timeout: Approval timeout in seconds (default 1800).
 #     form: Optional form schema for the approval page.
 #     self_approval: Whether the user who triggered the flow can approve it (default True).
+#     key: Optional checkpoint key naming this approval step.
 # 
 # Example::
 # 
-#     urls = await step("urls", lambda: get_resume_urls())
-#     await step("notify", lambda: send_email(urls["approvalPage"]))
-#     result = await wait_for_approval(timeout=3600)
-async def wait_for_approval(timeout: int = 1800, form: dict | None = None, self_approval: bool = True) -> dict
+#     urls = await step("urls", lambda: get_approval_urls("manager"))
+#     await step("notify", lambda: send_email(urls["resume"], urls["cancel"]))
+#     result = await wait_for_approval(key="manager", timeout=3600)
+async def wait_for_approval(timeout: int = 1800, form: dict | None = None, self_approval: bool = True, key: str | None = None) -> dict
 
 # Process items in parallel with optional concurrency control.
 # 
diff --git a/system_prompts/auto-generated/sdks/python.md b/system_prompts/auto-generated/sdks/python.md
index c750f03bcf..bef29c4403 100644
--- a/system_prompts/auto-generated/sdks/python.md
+++ b/system_prompts/auto-generated/sdks/python.md
@@ -399,6 +399,17 @@ def get_shared_state(path: str = 'state.json') -> None
 #     Dictionary with approvalPage, resume, and cancel URLs
 def get_resume_urls(approver: str = None, flow_level: bool = None) -> dict
 
+# Get the resume URLs bound to one ``wait_for_approval`` step of this workflow.
+# 
+# Args:
+#     step_key: Checkpoint key of the approval step, as passed to
+#         ``wait_for_approval(key=...)``
+#     approver: Optional approver name
+# 
+# Returns:
+#     Dictionary with approvalPage, resume, and cancel URLs
+def get_approval_urls(step_key: str = 'approval', approver: str = None) -> dict
+
 # Sends an interactive approval request via Slack, allowing optional customization of the message, approver, and form fields.
 # 
 # **[Enterprise Edition Only]** To include form fields in the Slack approval request, use the "Advanced -> Suspend -> Form" functionality.
@@ -675,8 +686,9 @@ async def sleep(seconds: int)
 
 # Suspend the workflow and wait for an external approval.
 # 
-# Use ``get_resume_urls()`` (wrapped in ``step()``) to obtain
-# resume/cancel/approval URLs before calling this function.
+# Pass ``key`` to name the step, then ``get_approval_urls(key)`` yields the URLs
+# that resume exactly this approval — route them through your own channel.
+# Without a key the steps are named ``approval``, ``approval_2``, ...
 # 
 # Returns a dict with ``value`` (form data), ``approver``, and ``approved``.
 # 
@@ -684,13 +696,14 @@ async def sleep(seconds: int)
 #     timeout: Approval timeout in seconds (default 1800).
 #     form: Optional form schema for the approval page.
 #     self_approval: Whether the user who triggered the flow can approve it (default True).
+#     key: Optional checkpoint key naming this approval step.
 # 
 # Example::
 # 
-#     urls = await step("urls", lambda: get_resume_urls())
-#     await step("notify", lambda: send_email(urls["approvalPage"]))
-#     result = await wait_for_approval(timeout=3600)
-async def wait_for_approval(timeout: int = 1800, form: dict | None = None, self_approval: bool = True) -> dict
+#     urls = await step("urls", lambda: get_approval_urls("manager"))
+#     await step("notify", lambda: send_email(urls["resume"], urls["cancel"]))
+#     result = await wait_for_approval(key="manager", timeout=3600)
+async def wait_for_approval(timeout: int = 1800, form: dict | None = None, self_approval: bool = True, key: str | None = None) -> dict
 
 # Process items in parallel with optional concurrency control.
 # 
diff --git a/system_prompts/auto-generated/sdks/typescript.md b/system_prompts/auto-generated/sdks/typescript.md
index 8100929776..dd98da4ea9 100644
--- a/system_prompts/auto-generated/sdks/typescript.md
+++ b/system_prompts/auto-generated/sdks/typescript.md
@@ -493,15 +493,43 @@ workflow<T>(fn: (...args: any[]) => Promise<T>): void
 /**
  * Suspend the workflow and wait for an external approval.
  * 
- * Use `getResumeUrls()` (wrapped in `step()`) to obtain resume/cancel/approvalPage
- * URLs before calling this function.
+ * Pass `key` to name the step, then `getApprovalUrls(key)` yields the URLs that
+ * resume exactly this approval — route them through your own channel. Without a
+ * key the steps are named `approval`, `approval_2`, ...
  * 
  * @example
- * const urls = await step("urls", () => getResumeUrls());
- * await step("notify", () => sendEmail(urls.approvalPage));
- * const { value, approver } = await waitForApproval({ timeout: 3600 });
+ * const urls = await step("urls", () => getApprovalUrls("manager"));
+ * await step("notify", () => sendEmail(urls.resume, urls.cancel));
+ * const { value, approver } = await waitForApproval({ key: "manager", timeout: 3600 });
  */
-waitForApproval(options?: { timeout?: number; form?: object; selfApproval?: boolean; }): PromiseLike<{ value: any; approver: string; approved: boolean }>
+waitForApproval(options?: { timeout?: number; form?: object; selfApproval?: boolean; key?: string; }): PromiseLike<{ value: any; approver: string; approved: boolean }>
+
+/**
+ * Resume/cancel/approval-page URLs bound to one `waitForApproval` step.
+ * 
+ * Unlike `getResumeUrls()`, which signs a random nonce, these address the very
+ * `resume_job` record the step's built-in approval buttons use, so they are
+ * stable across replays and safe to embed in a custom notification.
+ * 
+ * `stepKey` must match the `key` given to `waitForApproval`. Keys must be unique
+ * within a workflow; reusing one throws rather than silently renaming it. The URL
+ * only resumes while that step is awaiting approval; used at any other moment it is
+ * rejected rather than banking a row a different approval would consume. Send it
+ * ahead of time — approvers just cannot act before the workflow reaches the step.
+ * 
+ * `resume` and `cancel` are step-bound; `approvalPage` is not — it opens the job's
+ * approval page, which acts on whichever approval is pending when it is used.
+ * 
+ * @example
+ * const urls = await step("urls", () => getApprovalUrls("manager"));
+ * await step("notify", () => sendEmail(urls.resume, urls.cancel));
+ * await waitForApproval({ key: "manager" });
+ */
+async getApprovalUrls(stepKey: string = "approval", approver?: string): Promise<{
+  approvalPage: string;
+  resume: string;
+  cancel: string;
+}>
 
 /**
  * Process items in parallel with optional concurrency control.
diff --git a/system_prompts/auto-generated/sdks/wac-python.md b/system_prompts/auto-generated/sdks/wac-python.md
index ad9cb2736a..3ef7d752e5 100644
--- a/system_prompts/auto-generated/sdks/wac-python.md
+++ b/system_prompts/auto-generated/sdks/wac-python.md
@@ -1,6 +1,6 @@
 ## Python Workflow-as-Code API (wmill)
 
-Import: `from wmill import workflow, task, task_script, task_flow, step, sleep, wait_for_approval, get_resume_urls, parallel, TaskError`
+Import: `from wmill import workflow, task, task_script, task_flow, step, sleep, wait_for_approval, get_approval_urls, get_resume_urls, parallel, TaskError`
 
 ```python
 # Raised when a WAC task step failed.
@@ -88,8 +88,9 @@ async def sleep(seconds: int)
 
 # Suspend the workflow and wait for an external approval.
 #
-# Use ``get_resume_urls()`` (wrapped in ``step()``) to obtain
-# resume/cancel/approval URLs before calling this function.
+# Pass ``key`` to name the step, then ``get_approval_urls(key)`` yields the URLs
+# that resume exactly this approval — route them through your own channel.
+# Without a key the steps are named ``approval``, ``approval_2``, ...
 #
 # Returns a dict with ``value`` (form data), ``approver``, and ``approved``.
 #
@@ -97,13 +98,37 @@ async def sleep(seconds: int)
 #     timeout: Approval timeout in seconds (default 1800).
 #     form: Optional form schema for the approval page.
 #     self_approval: Whether the user who triggered the flow can approve it (default True).
+#     key: Optional checkpoint key naming this approval step.
 #
 # Example::
 #
-#     urls = await step("urls", lambda: get_resume_urls())
-#     await step("notify", lambda: send_email(urls["approvalPage"]))
-#     result = await wait_for_approval(timeout=3600)
-async def wait_for_approval(timeout: int = 1800, form: dict | None = None, self_approval: bool = True) -> dict
+#     urls = await step("urls", lambda: get_approval_urls("manager"))
+#     await step("notify", lambda: send_email(urls["resume"], urls["cancel"]))
+#     result = await wait_for_approval(key="manager", timeout=3600)
+async def wait_for_approval(timeout: int = 1800, form: dict | None = None, self_approval: bool = True, key: str | None = None) -> dict
+
+# Get the resume/cancel/approval-page URLs bound to one ``wait_for_approval`` step.
+#
+# Unlike :func:`get_resume_urls`, which signs a random nonce, these address the
+# very ``resume_job`` record the step's built-in approval buttons use, so they
+# are stable across replays and safe to embed in a custom notification.
+#
+# Args:
+#     step_key: Checkpoint key of the approval step, as passed to
+#         ``wait_for_approval(key=...)``. Keys must be unique within a workflow;
+#         reusing one raises rather than silently renaming it. The URL only
+#         resumes while that step is awaiting approval; used at any other moment
+#         it is rejected rather than banking a row a different approval would
+#         consume. Send it ahead of time — approvers just cannot act before the
+#         workflow reaches the step.
+#         ``resume`` and ``cancel`` are step-bound; ``approvalPage`` is not — it
+#         opens the job's approval page, which acts on whichever approval is
+#         pending when it is used.
+#     approver: Optional approver name
+#
+# Returns:
+#     Dictionary with approvalPage, resume, and cancel URLs
+def get_approval_urls(step_key: str = 'approval', approver: str = None) -> dict
 
 # Process items in parallel with optional concurrency control.
 #
diff --git a/system_prompts/auto-generated/sdks/wac-typescript.md b/system_prompts/auto-generated/sdks/wac-typescript.md
index 6314025285..3c3405611f 100644
--- a/system_prompts/auto-generated/sdks/wac-typescript.md
+++ b/system_prompts/auto-generated/sdks/wac-typescript.md
@@ -1,6 +1,6 @@
 ## TypeScript Workflow-as-Code API (windmill-client)
 
-Import: `import { workflow, task, taskScript, taskFlow, step, sleep, waitForApproval, getResumeUrls, parallel } from "windmill-client"`
+Import: `import { workflow, task, taskScript, taskFlow, step, sleep, waitForApproval, getApprovalUrls, getResumeUrls, parallel } from "windmill-client"`
 
 ```typescript
 export interface TaskOptions {
@@ -70,15 +70,39 @@ export async function sleep(seconds: number): Promise<void>
 /**
  * Suspend the workflow and wait for an external approval.
  *
- * Use `getResumeUrls()` (wrapped in `step()`) to obtain resume/cancel/approvalPage
- * URLs before calling this function.
+ * Pass `key` to name the step, then `getApprovalUrls(key)` yields the URLs that
+ * resume exactly this approval — route them through your own channel. Without a
+ * key the steps are named `approval`, `approval_2`, ...
  *
  * @example
- * const urls = await step("urls", () => getResumeUrls());
- * await step("notify", () => sendEmail(urls.approvalPage));
- * const { value, approver } = await waitForApproval({ timeout: 3600 });
+ * const urls = await step("urls", () => getApprovalUrls("manager"));
+ * await step("notify", () => sendEmail(urls.resume, urls.cancel));
+ * const { value, approver } = await waitForApproval({ key: "manager", timeout: 3600 });
  */
-export function waitForApproval(options?: { timeout?: number; form?: object; selfApproval?: boolean; }): PromiseLike<{ value: any; approver: string; approved: boolean }>
+export function waitForApproval(options?: { timeout?: number; form?: object; selfApproval?: boolean; key?: string; }): PromiseLike<{ value: any; approver: string; approved: boolean }>
+
+/**
+ * Resume/cancel/approval-page URLs bound to one `waitForApproval` step.
+ *
+ * Unlike `getResumeUrls()`, which signs a random nonce, these address the very
+ * `resume_job` record the step's built-in approval buttons use, so they are
+ * stable across replays and safe to embed in a custom notification.
+ *
+ * `stepKey` must match the `key` given to `waitForApproval`. Keys must be unique
+ * within a workflow; reusing one throws rather than silently renaming it. The URL
+ * only resumes while that step is awaiting approval; used at any other moment it is
+ * rejected rather than banking a row a different approval would consume. Send it
+ * ahead of time — approvers just cannot act before the workflow reaches the step.
+ *
+ * `resume` and `cancel` are step-bound; `approvalPage` is not — it opens the job's
+ * approval page, which acts on whichever approval is pending when it is used.
+ *
+ * @example
+ * const urls = await step("urls", () => getApprovalUrls("manager"));
+ * await step("notify", () => sendEmail(urls.resume, urls.cancel));
+ * await waitForApproval({ key: "manager" });
+ */
+export async function getApprovalUrls(stepKey: string = "approval", approver?: string): Promise<{ approvalPage: string; resume: string; cancel: string; }>
 
 /**
  * Process items in parallel with optional concurrency control.
diff --git a/system_prompts/auto-generated/skills/write-script-bun/SKILL.md b/system_prompts/auto-generated/skills/write-script-bun/SKILL.md
index 21aafa55d0..015bd52be4 100644
--- a/system_prompts/auto-generated/skills/write-script-bun/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-bun/SKILL.md
@@ -664,15 +664,43 @@ workflow<T>(fn: (...args: any[]) => Promise<T>): void
 /**
  * Suspend the workflow and wait for an external approval.
  * 
- * Use `getResumeUrls()` (wrapped in `step()`) to obtain resume/cancel/approvalPage
- * URLs before calling this function.
+ * Pass `key` to name the step, then `getApprovalUrls(key)` yields the URLs that
+ * resume exactly this approval — route them through your own channel. Without a
+ * key the steps are named `approval`, `approval_2`, ...
  * 
  * @example
- * const urls = await step("urls", () => getResumeUrls());
- * await step("notify", () => sendEmail(urls.approvalPage));
- * const { value, approver } = await waitForApproval({ timeout: 3600 });
+ * const urls = await step("urls", () => getApprovalUrls("manager"));
+ * await step("notify", () => sendEmail(urls.resume, urls.cancel));
+ * const { value, approver } = await waitForApproval({ key: "manager", timeout: 3600 });
  */
-waitForApproval(options?: { timeout?: number; form?: object; selfApproval?: boolean; }): PromiseLike<{ value: any; approver: string; approved: boolean }>
+waitForApproval(options?: { timeout?: number; form?: object; selfApproval?: boolean; key?: string; }): PromiseLike<{ value: any; approver: string; approved: boolean }>
+
+/**
+ * Resume/cancel/approval-page URLs bound to one `waitForApproval` step.
+ * 
+ * Unlike `getResumeUrls()`, which signs a random nonce, these address the very
+ * `resume_job` record the step's built-in approval buttons use, so they are
+ * stable across replays and safe to embed in a custom notification.
+ * 
+ * `stepKey` must match the `key` given to `waitForApproval`. Keys must be unique
+ * within a workflow; reusing one throws rather than silently renaming it. The URL
+ * only resumes while that step is awaiting approval; used at any other moment it is
+ * rejected rather than banking a row a different approval would consume. Send it
+ * ahead of time — approvers just cannot act before the workflow reaches the step.
+ * 
+ * `resume` and `cancel` are step-bound; `approvalPage` is not — it opens the job's
+ * approval page, which acts on whichever approval is pending when it is used.
+ * 
+ * @example
+ * const urls = await step("urls", () => getApprovalUrls("manager"));
+ * await step("notify", () => sendEmail(urls.resume, urls.cancel));
+ * await waitForApproval({ key: "manager" });
+ */
+async getApprovalUrls(stepKey: string = "approval", approver?: string): Promise<{
+  approvalPage: string;
+  resume: string;
+  cancel: string;
+}>
 
 /**
  * Process items in parallel with optional concurrency control.
diff --git a/system_prompts/auto-generated/skills/write-script-bunnative/SKILL.md b/system_prompts/auto-generated/skills/write-script-bunnative/SKILL.md
index ba1253b66f..2e6f37bd62 100644
--- a/system_prompts/auto-generated/skills/write-script-bunnative/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-bunnative/SKILL.md
@@ -664,15 +664,43 @@ workflow<T>(fn: (...args: any[]) => Promise<T>): void
 /**
  * Suspend the workflow and wait for an external approval.
  * 
- * Use `getResumeUrls()` (wrapped in `step()`) to obtain resume/cancel/approvalPage
- * URLs before calling this function.
+ * Pass `key` to name the step, then `getApprovalUrls(key)` yields the URLs that
+ * resume exactly this approval — route them through your own channel. Without a
+ * key the steps are named `approval`, `approval_2`, ...
  * 
  * @example
- * const urls = await step("urls", () => getResumeUrls());
- * await step("notify", () => sendEmail(urls.approvalPage));
- * const { value, approver } = await waitForApproval({ timeout: 3600 });
+ * const urls = await step("urls", () => getApprovalUrls("manager"));
+ * await step("notify", () => sendEmail(urls.resume, urls.cancel));
+ * const { value, approver } = await waitForApproval({ key: "manager", timeout: 3600 });
  */
-waitForApproval(options?: { timeout?: number; form?: object; selfApproval?: boolean; }): PromiseLike<{ value: any; approver: string; approved: boolean }>
+waitForApproval(options?: { timeout?: number; form?: object; selfApproval?: boolean; key?: string; }): PromiseLike<{ value: any; approver: string; approved: boolean }>
+
+/**
+ * Resume/cancel/approval-page URLs bound to one `waitForApproval` step.
+ * 
+ * Unlike `getResumeUrls()`, which signs a random nonce, these address the very
+ * `resume_job` record the step's built-in approval buttons use, so they are
+ * stable across replays and safe to embed in a custom notification.
+ * 
+ * `stepKey` must match the `key` given to `waitForApproval`. Keys must be unique
+ * within a workflow; reusing one throws rather than silently renaming it. The URL
+ * only resumes while that step is awaiting approval; used at any other moment it is
+ * rejected rather than banking a row a different approval would consume. Send it
+ * ahead of time — approvers just cannot act before the workflow reaches the step.
+ * 
+ * `resume` and `cancel` are step-bound; `approvalPage` is not — it opens the job's
+ * approval page, which acts on whichever approval is pending when it is used.
+ * 
+ * @example
+ * const urls = await step("urls", () => getApprovalUrls("manager"));
+ * await step("notify", () => sendEmail(urls.resume, urls.cancel));
+ * await waitForApproval({ key: "manager" });
+ */
+async getApprovalUrls(stepKey: string = "approval", approver?: string): Promise<{
+  approvalPage: string;
+  resume: string;
+  cancel: string;
+}>
 
 /**
  * Process items in parallel with optional concurrency control.
diff --git a/system_prompts/auto-generated/skills/write-script-deno/SKILL.md b/system_prompts/auto-generated/skills/write-script-deno/SKILL.md
index 55c7bf7155..2cfdf4e980 100644
--- a/system_prompts/auto-generated/skills/write-script-deno/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-deno/SKILL.md
@@ -666,15 +666,43 @@ workflow<T>(fn: (...args: any[]) => Promise<T>): void
 /**
  * Suspend the workflow and wait for an external approval.
  * 
- * Use `getResumeUrls()` (wrapped in `step()`) to obtain resume/cancel/approvalPage
- * URLs before calling this function.
+ * Pass `key` to name the step, then `getApprovalUrls(key)` yields the URLs that
+ * resume exactly this approval — route them through your own channel. Without a
+ * key the steps are named `approval`, `approval_2`, ...
  * 
  * @example
- * const urls = await step("urls", () => getResumeUrls());
- * await step("notify", () => sendEmail(urls.approvalPage));
- * const { value, approver } = await waitForApproval({ timeout: 3600 });
+ * const urls = await step("urls", () => getApprovalUrls("manager"));
+ * await step("notify", () => sendEmail(urls.resume, urls.cancel));
+ * const { value, approver } = await waitForApproval({ key: "manager", timeout: 3600 });
  */
-waitForApproval(options?: { timeout?: number; form?: object; selfApproval?: boolean; }): PromiseLike<{ value: any; approver: string; approved: boolean }>
+waitForApproval(options?: { timeout?: number; form?: object; selfApproval?: boolean; key?: string; }): PromiseLike<{ value: any; approver: string; approved: boolean }>
+
+/**
+ * Resume/cancel/approval-page URLs bound to one `waitForApproval` step.
+ * 
+ * Unlike `getResumeUrls()`, which signs a random nonce, these address the very
+ * `resume_job` record the step's built-in approval buttons use, so they are
+ * stable across replays and safe to embed in a custom notification.
+ * 
+ * `stepKey` must match the `key` given to `waitForApproval`. Keys must be unique
+ * within a workflow; reusing one throws rather than silently renaming it. The URL
+ * only resumes while that step is awaiting approval; used at any other moment it is
+ * rejected rather than banking a row a different approval would consume. Send it
+ * ahead of time — approvers just cannot act before the workflow reaches the step.
+ * 
+ * `resume` and `cancel` are step-bound; `approvalPage` is not — it opens the job's
+ * approval page, which acts on whichever approval is pending when it is used.
+ * 
+ * @example
+ * const urls = await step("urls", () => getApprovalUrls("manager"));
+ * await step("notify", () => sendEmail(urls.resume, urls.cancel));
+ * await waitForApproval({ key: "manager" });
+ */
+async getApprovalUrls(stepKey: string = "approval", approver?: string): Promise<{
+  approvalPage: string;
+  resume: string;
+  cancel: string;
+}>
 
 /**
  * Process items in parallel with optional concurrency control.
diff --git a/system_prompts/auto-generated/skills/write-script-python3/SKILL.md b/system_prompts/auto-generated/skills/write-script-python3/SKILL.md
index 3db3b90942..38cf7d33e6 100644
--- a/system_prompts/auto-generated/skills/write-script-python3/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-python3/SKILL.md
@@ -584,6 +584,17 @@ def get_shared_state(path: str = 'state.json') -> None
 #     Dictionary with approvalPage, resume, and cancel URLs
 def get_resume_urls(approver: str = None, flow_level: bool = None) -> dict
 
+# Get the resume URLs bound to one ``wait_for_approval`` step of this workflow.
+# 
+# Args:
+#     step_key: Checkpoint key of the approval step, as passed to
+#         ``wait_for_approval(key=...)``
+#     approver: Optional approver name
+# 
+# Returns:
+#     Dictionary with approvalPage, resume, and cancel URLs
+def get_approval_urls(step_key: str = 'approval', approver: str = None) -> dict
+
 # Sends an interactive approval request via Slack, allowing optional customization of the message, approver, and form fields.
 # 
 # **[Enterprise Edition Only]** To include form fields in the Slack approval request, use the "Advanced -> Suspend -> Form" functionality.
@@ -860,8 +871,9 @@ async def sleep(seconds: int)
 
 # Suspend the workflow and wait for an external approval.
 # 
-# Use ``get_resume_urls()`` (wrapped in ``step()``) to obtain
-# resume/cancel/approval URLs before calling this function.
+# Pass ``key`` to name the step, then ``get_approval_urls(key)`` yields the URLs
+# that resume exactly this approval — route them through your own channel.
+# Without a key the steps are named ``approval``, ``approval_2``, ...
 # 
 # Returns a dict with ``value`` (form data), ``approver``, and ``approved``.
 # 
@@ -869,13 +881,14 @@ async def sleep(seconds: int)
 #     timeout: Approval timeout in seconds (default 1800).
 #     form: Optional form schema for the approval page.
 #     self_approval: Whether the user who triggered the flow can approve it (default True).
+#     key: Optional checkpoint key naming this approval step.
 # 
 # Example::
 # 
-#     urls = await step("urls", lambda: get_resume_urls())
-#     await step("notify", lambda: send_email(urls["approvalPage"]))
-#     result = await wait_for_approval(timeout=3600)
-async def wait_for_approval(timeout: int = 1800, form: dict | None = None, self_approval: bool = True) -> dict
+#     urls = await step("urls", lambda: get_approval_urls("manager"))
+#     await step("notify", lambda: send_email(urls["resume"], urls["cancel"]))
+#     result = await wait_for_approval(key="manager", timeout=3600)
+async def wait_for_approval(timeout: int = 1800, form: dict | None = None, self_approval: bool = True, key: str | None = None) -> dict
 
 # Process items in parallel with optional concurrency control.
 # 
diff --git a/system_prompts/auto-generated/skills/write-workflow-as-code/SKILL.md b/system_prompts/auto-generated/skills/write-workflow-as-code/SKILL.md
index 9ec901e003..4f2aa46290 100644
--- a/system_prompts/auto-generated/skills/write-workflow-as-code/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-workflow-as-code/SKILL.md
@@ -73,7 +73,7 @@ import {
   step,
   sleep,
   waitForApproval,
-  getResumeUrls,
+  getApprovalUrls,
   parallel,
   workflow,
 } from "windmill-client";
@@ -91,7 +91,7 @@ export const main = workflow(async (x: string) => {
 Python:
 
 ```python
-from wmill import task, task_script, task_flow, step, sleep, wait_for_approval, get_resume_urls, parallel, workflow
+from wmill import task, task_script, task_flow, step, sleep, wait_for_approval, get_approval_urls, parallel, workflow
 
 @task()
 async def process(x: str) -> str:
@@ -175,12 +175,13 @@ output = await pipeline(input=data)
 Use `step()` for lightweight inline values that must not change during replay:
 
 ```typescript
-const urls = await step("get_urls", () => getResumeUrls());
 const startedAt = await step("started_at", () => new Date().toISOString());
 ```
 
 ```python
-urls = await step("get_urls", lambda: get_resume_urls())
+from datetime import datetime
+
+started_at = await step("started_at", lambda: datetime.now().isoformat())
 ```
 
 Use stable, descriptive step names. Do not generate step names dynamically.
@@ -205,20 +206,28 @@ Only parallelize independent steps. Do not read the result of a task before it i
 
 ## Approvals
 
-Generate resume URLs inside `step()` before sending them:
+Name the approval step and generate its URLs inside `step()` before sending them.
+`getApprovalUrls` / `get_approval_urls` returns the URLs bound to that step, the same
+ones its built-in approve/reject buttons use:
 
 ```typescript
-const urls = await step("get_urls", () => getResumeUrls());
-await step("notify", () => sendApprovalEmail(urls.approvalPage));
-const approval = await waitForApproval({ timeout: 3600 });
+const urls = await step("urls", () => getApprovalUrls("manager"));
+await step("notify", () => sendApprovalEmail(urls.resume, urls.cancel));
+const approval = await waitForApproval({ key: "manager", timeout: 3600 });
 ```
 
 ```python
-urls = await step("get_urls", lambda: get_resume_urls())
-await step("notify", lambda: send_approval_email(urls["approvalPage"]))
-approval = await wait_for_approval(timeout=3600)
+urls = await step("urls", lambda: get_approval_urls("manager"))
+await step("notify", lambda: send_approval_email(urls["resume"], urls["cancel"]))
+approval = await wait_for_approval(key="manager", timeout=3600)
 ```
 
+With several approvals in one workflow, give each its own key so each notification
+resumes its own step. Keys must be unique — reusing one raises an error rather than
+silently renaming the step. A minted URL only resumes while its own step is awaiting
+approval; used at any other moment it is rejected rather than resuming the wrong one. `getResumeUrls()` / `get_resume_urls()` still works but signs a
+random nonce, so its URLs are not tied to any particular approval step.
+
 `selfApproval: false` and `self_approval=False` are Enterprise-only approval behavior. Do not use them unless the user asks for that behavior.
 
 ## Error Handling
@@ -232,7 +241,7 @@ TypeScript: avoid broad `try/catch` around WAC SDK calls. The SDK uses an intern
 
 ## TypeScript Workflow-as-Code API (windmill-client)
 
-Import: `import { workflow, task, taskScript, taskFlow, step, sleep, waitForApproval, getResumeUrls, parallel } from "windmill-client"`
+Import: `import { workflow, task, taskScript, taskFlow, step, sleep, waitForApproval, getApprovalUrls, getResumeUrls, parallel } from "windmill-client"`
 
 ```typescript
 export interface TaskOptions {
@@ -302,15 +311,39 @@ export async function sleep(seconds: number): Promise<void>
 /**
  * Suspend the workflow and wait for an external approval.
  *
- * Use `getResumeUrls()` (wrapped in `step()`) to obtain resume/cancel/approvalPage
- * URLs before calling this function.
+ * Pass `key` to name the step, then `getApprovalUrls(key)` yields the URLs that
+ * resume exactly this approval — route them through your own channel. Without a
+ * key the steps are named `approval`, `approval_2`, ...
  *
  * @example
- * const urls = await step("urls", () => getResumeUrls());
- * await step("notify", () => sendEmail(urls.approvalPage));
- * const { value, approver } = await waitForApproval({ timeout: 3600 });
+ * const urls = await step("urls", () => getApprovalUrls("manager"));
+ * await step("notify", () => sendEmail(urls.resume, urls.cancel));
+ * const { value, approver } = await waitForApproval({ key: "manager", timeout: 3600 });
  */
-export function waitForApproval(options?: { timeout?: number; form?: object; selfApproval?: boolean; }): PromiseLike<{ value: any; approver: string; approved: boolean }>
+export function waitForApproval(options?: { timeout?: number; form?: object; selfApproval?: boolean; key?: string; }): PromiseLike<{ value: any; approver: string; approved: boolean }>
+
+/**
+ * Resume/cancel/approval-page URLs bound to one `waitForApproval` step.
+ *
+ * Unlike `getResumeUrls()`, which signs a random nonce, these address the very
+ * `resume_job` record the step's built-in approval buttons use, so they are
+ * stable across replays and safe to embed in a custom notification.
+ *
+ * `stepKey` must match the `key` given to `waitForApproval`. Keys must be unique
+ * within a workflow; reusing one throws rather than silently renaming it. The URL
+ * only resumes while that step is awaiting approval; used at any other moment it is
+ * rejected rather than banking a row a different approval would consume. Send it
+ * ahead of time — approvers just cannot act before the workflow reaches the step.
+ *
+ * `resume` and `cancel` are step-bound; `approvalPage` is not — it opens the job's
+ * approval page, which acts on whichever approval is pending when it is used.
+ *
+ * @example
+ * const urls = await step("urls", () => getApprovalUrls("manager"));
+ * await step("notify", () => sendEmail(urls.resume, urls.cancel));
+ * await waitForApproval({ key: "manager" });
+ */
+export async function getApprovalUrls(stepKey: string = "approval", approver?: string): Promise<{ approvalPage: string; resume: string; cancel: string; }>
 
 /**
  * Process items in parallel with optional concurrency control.
@@ -328,7 +361,7 @@ export async function parallel<T, R>(items: T[], fn: (item: T) => PromiseLike<R>
 
 ## Python Workflow-as-Code API (wmill)
 
-Import: `from wmill import workflow, task, task_script, task_flow, step, sleep, wait_for_approval, get_resume_urls, parallel, TaskError`
+Import: `from wmill import workflow, task, task_script, task_flow, step, sleep, wait_for_approval, get_approval_urls, get_resume_urls, parallel, TaskError`
 
 ```python
 # Raised when a WAC task step failed.
@@ -416,8 +449,9 @@ async def sleep(seconds: int)
 
 # Suspend the workflow and wait for an external approval.
 #
-# Use ``get_resume_urls()`` (wrapped in ``step()``) to obtain
-# resume/cancel/approval URLs before calling this function.
+# Pass ``key`` to name the step, then ``get_approval_urls(key)`` yields the URLs
+# that resume exactly this approval — route them through your own channel.
+# Without a key the steps are named ``approval``, ``approval_2``, ...
 #
 # Returns a dict with ``value`` (form data), ``approver``, and ``approved``.
 #
@@ -425,13 +459,37 @@ async def sleep(seconds: int)
 #     timeout: Approval timeout in seconds (default 1800).
 #     form: Optional form schema for the approval page.
 #     self_approval: Whether the user who triggered the flow can approve it (default True).
+#     key: Optional checkpoint key naming this approval step.
 #
 # Example::
 #
-#     urls = await step("urls", lambda: get_resume_urls())
-#     await step("notify", lambda: send_email(urls["approvalPage"]))
-#     result = await wait_for_approval(timeout=3600)
-async def wait_for_approval(timeout: int = 1800, form: dict | None = None, self_approval: bool = True) -> dict
+#     urls = await step("urls", lambda: get_approval_urls("manager"))
+#     await step("notify", lambda: send_email(urls["resume"], urls["cancel"]))
+#     result = await wait_for_approval(key="manager", timeout=3600)
+async def wait_for_approval(timeout: int = 1800, form: dict | None = None, self_approval: bool = True, key: str | None = None) -> dict
+
+# Get the resume/cancel/approval-page URLs bound to one ``wait_for_approval`` step.
+#
+# Unlike :func:`get_resume_urls`, which signs a random nonce, these address the
+# very ``resume_job`` record the step's built-in approval buttons use, so they
+# are stable across replays and safe to embed in a custom notification.
+#
+# Args:
+#     step_key: Checkpoint key of the approval step, as passed to
+#         ``wait_for_approval(key=...)``. Keys must be unique within a workflow;
+#         reusing one raises rather than silently renaming it. The URL only
+#         resumes while that step is awaiting approval; used at any other moment
+#         it is rejected rather than banking a row a different approval would
+#         consume. Send it ahead of time — approvers just cannot act before the
+#         workflow reaches the step.
+#         ``resume`` and ``cancel`` are step-bound; ``approvalPage`` is not — it
+#         opens the job's approval page, which acts on whichever approval is
+#         pending when it is used.
+#     approver: Optional approver name
+#
+# Returns:
+#     Dictionary with approvalPage, resume, and cancel URLs
+def get_approval_urls(step_key: str = 'approval', approver: str = None) -> dict
 
 # Process items in parallel with optional concurrency control.
 #
diff --git a/system_prompts/base/workflow-as-code.md b/system_prompts/base/workflow-as-code.md
index 78be861213..f0b72ead96 100644
--- a/system_prompts/base/workflow-as-code.md
+++ b/system_prompts/base/workflow-as-code.md
@@ -21,7 +21,7 @@ import {
   step,
   sleep,
   waitForApproval,
-  getResumeUrls,
+  getApprovalUrls,
   parallel,
   workflow,
 } from "windmill-client";
@@ -39,7 +39,7 @@ export const main = workflow(async (x: string) => {
 Python:
 
 ```python
-from wmill import task, task_script, task_flow, step, sleep, wait_for_approval, get_resume_urls, parallel, workflow
+from wmill import task, task_script, task_flow, step, sleep, wait_for_approval, get_approval_urls, parallel, workflow
 
 @task()
 async def process(x: str) -> str:
@@ -123,12 +123,13 @@ output = await pipeline(input=data)
 Use `step()` for lightweight inline values that must not change during replay:
 
 ```typescript
-const urls = await step("get_urls", () => getResumeUrls());
 const startedAt = await step("started_at", () => new Date().toISOString());
 ```
 
 ```python
-urls = await step("get_urls", lambda: get_resume_urls())
+from datetime import datetime
+
+started_at = await step("started_at", lambda: datetime.now().isoformat())
 ```
 
 Use stable, descriptive step names. Do not generate step names dynamically.
@@ -153,20 +154,28 @@ Only parallelize independent steps. Do not read the result of a task before it i
 
 ## Approvals
 
-Generate resume URLs inside `step()` before sending them:
+Name the approval step and generate its URLs inside `step()` before sending them.
+`getApprovalUrls` / `get_approval_urls` returns the URLs bound to that step, the same
+ones its built-in approve/reject buttons use:
 
 ```typescript
-const urls = await step("get_urls", () => getResumeUrls());
-await step("notify", () => sendApprovalEmail(urls.approvalPage));
-const approval = await waitForApproval({ timeout: 3600 });
+const urls = await step("urls", () => getApprovalUrls("manager"));
+await step("notify", () => sendApprovalEmail(urls.resume, urls.cancel));
+const approval = await waitForApproval({ key: "manager", timeout: 3600 });
 ```
 
 ```python
-urls = await step("get_urls", lambda: get_resume_urls())
-await step("notify", lambda: send_approval_email(urls["approvalPage"]))
-approval = await wait_for_approval(timeout=3600)
+urls = await step("urls", lambda: get_approval_urls("manager"))
+await step("notify", lambda: send_approval_email(urls["resume"], urls["cancel"]))
+approval = await wait_for_approval(key="manager", timeout=3600)
 ```
 
+With several approvals in one workflow, give each its own key so each notification
+resumes its own step. Keys must be unique — reusing one raises an error rather than
+silently renaming the step. A minted URL only resumes while its own step is awaiting
+approval; used at any other moment it is rejected rather than resuming the wrong one. `getResumeUrls()` / `get_resume_urls()` still works but signs a
+random nonce, so its URLs are not tied to any particular approval step.
+
 `selfApproval: false` and `self_approval=False` are Enterprise-only approval behavior. Do not use them unless the user asks for that behavior.
 
 ## Error Handling
diff --git a/system_prompts/generate.py b/system_prompts/generate.py
index 3ee993147e..0c11a86b1b 100644
--- a/system_prompts/generate.py
+++ b/system_prompts/generate.py
@@ -1249,6 +1249,7 @@ WAC_TS_FUNCTIONS = [
     'step',
     'sleep',
     'waitForApproval',
+    'getApprovalUrls',
     'parallel',
 ]
 
@@ -1261,6 +1262,7 @@ WAC_PY_FUNCTIONS = [
     'step',
     'sleep',
     'wait_for_approval',
+    'get_approval_urls',
     'parallel',
 ]
 
@@ -1406,7 +1408,7 @@ def extract_wac_ts_sdk(ts_content: str) -> str:
         return ''
 
     md = "## TypeScript Workflow-as-Code API (windmill-client)\n\n"
-    md += 'Import: `import { workflow, task, taskScript, taskFlow, step, sleep, waitForApproval, getResumeUrls, parallel } from "windmill-client"`\n\n'
+    md += 'Import: `import { workflow, task, taskScript, taskFlow, step, sleep, waitForApproval, getApprovalUrls, getResumeUrls, parallel } from "windmill-client"`\n\n'
     md += "```typescript\n"
     md += "\n\n".join(declarations)
     md += "\n```\n"
@@ -1528,7 +1530,7 @@ def extract_wac_py_sdk(py_content: str) -> str:
         return ''
 
     md = "## Python Workflow-as-Code API (wmill)\n\n"
-    md += "Import: `from wmill import workflow, task, task_script, task_flow, step, sleep, wait_for_approval, get_resume_urls, parallel, TaskError`\n\n"
+    md += "Import: `from wmill import workflow, task, task_script, task_flow, step, sleep, wait_for_approval, get_approval_urls, get_resume_urls, parallel, TaskError`\n\n"
     md += "```python\n"
     md += "\n\n".join(declarations)
     md += "\n```\n"
diff --git a/typescript-client/build.sh b/typescript-client/build.sh
index b3bd5b5c1c..926ab962ae 100755
--- a/typescript-client/build.sh
+++ b/typescript-client/build.sh
@@ -40,7 +40,7 @@ cp "${script_dirpath}/sqlUtils.ts" "${script_dirpath}/src/"
 echo "" >> "${script_dirpath}/src/index.ts"
 echo 'export type { DenoS3LightClientSettings } from "./s3Types";' >> "${script_dirpath}/src/index.ts"
 echo "" >> "${script_dirpath}/src/index.ts"
-echo 'export { type Base64, setClient, getVariable, setVariable, getResource, setResource, getResumeUrls, setState, setProgress, getProgress, getState, getIdToken, denoS3LightClientSettings, loadS3FileStream, loadS3File, writeS3File, deleteS3File, signS3Objects, signS3Object, getPresignedS3PublicUrls, getPresignedS3PublicUrl, task, taskScript, taskFlow, workflow, step, sleep, parallel, waitForApproval, type TaskOptions, WorkflowCtx, _workflowCtx, setWorkflowCtx, StepSuspend, runScript, runScriptAsync, runScriptByPath, runScriptByHash, runScriptByPathAsync, runScriptByHashAsync, runFlow, runFlowAsync, waitJob, getRootJobId, setFlowUserState, getFlowUserState, usernameToEmail, requestInteractiveSlackApproval, type Sql, requestInteractiveTeamsApproval, appendToResultStream, streamResult, datatable, ducklake, upsertPartition, appendPartition, type DucklakeMaterializeOptions, type SqlStatement, type DatatableSqlTemplateFunction, type SqlTemplateFunction, type S3Object, type S3ObjectRecord, type S3ObjectURI, commitKafkaOffsets } from "./client";' >> "${script_dirpath}/src/index.ts"
+echo 'export { type Base64, setClient, getVariable, setVariable, getResource, setResource, getResumeUrls, setState, setProgress, getProgress, getState, getIdToken, denoS3LightClientSettings, loadS3FileStream, loadS3File, writeS3File, deleteS3File, signS3Objects, signS3Object, getPresignedS3PublicUrls, getPresignedS3PublicUrl, task, taskScript, taskFlow, workflow, step, sleep, parallel, waitForApproval, getApprovalUrls, type TaskOptions, WorkflowCtx, _workflowCtx, setWorkflowCtx, StepSuspend, runScript, runScriptAsync, runScriptByPath, runScriptByHash, runScriptByPathAsync, runScriptByHashAsync, runFlow, runFlowAsync, waitJob, getRootJobId, setFlowUserState, getFlowUserState, usernameToEmail, requestInteractiveSlackApproval, type Sql, requestInteractiveTeamsApproval, appendToResultStream, streamResult, datatable, ducklake, upsertPartition, appendPartition, type DucklakeMaterializeOptions, type SqlStatement, type DatatableSqlTemplateFunction, type SqlTemplateFunction, type S3Object, type S3ObjectRecord, type S3ObjectURI, commitKafkaOffsets } from "./client";' >> "${script_dirpath}/src/index.ts"
 
 # Build default export by combining client utilities + services
 # This preserves backward compatibility for `import wmill from "windmill-client"`
@@ -76,6 +76,7 @@ import {
   sleep,
   parallel,
   waitForApproval,
+  getApprovalUrls,
   WorkflowCtx,
   _workflowCtx,
   setWorkflowCtx,
@@ -164,6 +165,7 @@ const wmill = {
   sleep,
   parallel,
   waitForApproval,
+  getApprovalUrls,
   WorkflowCtx,
   _workflowCtx,
   setWorkflowCtx,
diff --git a/typescript-client/client.ts b/typescript-client/client.ts
index 5d2342471b..1b5d8473f6 100644
--- a/typescript-client/client.ts
+++ b/typescript-client/client.ts
@@ -1530,6 +1530,16 @@ export interface TaskOptions {
   concurrency_time_window_s?: number;
 }
 
+/** A step key travels as one path segment when its URLs are minted, so it must be
+ *  non-empty and free of `/` and dot segments — otherwise `waitForApproval` would
+ *  accept a key `getApprovalUrls` can never address. */
+function assertUsableStepKey(key: string, what: string): void {
+  const k = key.trim();
+  if (k === "" || k === "." || k === ".." || key.includes("/") || key.includes("\\")) {
+    throw new Error(`${what} must be a non-empty step name without \`/\` or dot segments`);
+  }
+}
+
 export let _workflowCtx: WorkflowCtx | null = null;
 export function setWorkflowCtx(ctx: WorkflowCtx | null) {
   _workflowCtx = ctx;
@@ -1539,7 +1549,11 @@ export function setWorkflowCtx(ctx: WorkflowCtx | null) {
 
 export class WorkflowCtx {
   private completed: Record<string, any>;
-  private counters: Record<string, number> = {};
+  /** Null-prototype: step keys are caller-supplied, and a plain object would
+   *  resolve `toString`/`constructor`/`__proto__` off `Object.prototype`. */
+  private counters: Record<string, number> = Object.create(null);
+  /** Every key handed out by `_allocKey`, so distinct names can't alias one key. */
+  private _usedKeys = new Set<string>();
   private pending: Array<{
     name: string;
     script: string;
@@ -1563,15 +1577,24 @@ export class WorkflowCtx {
   private _inlineChain: Promise<void> = Promise.resolve();
 
   constructor(checkpoint: Record<string, any> = {}) {
-    this.completed = checkpoint?.completed_steps ?? {};
+    this.completed = Object.assign(Object.create(null), checkpoint?.completed_steps ?? {});
     this._executingKey = checkpoint?._executing_key ?? null;
   }
 
-  /** Name-based key: `double` for first call, `double_2`, `double_3` for subsequent. */
+  /** Name-based key: `double` for first call, `double_2`, `double_3` for subsequent.
+   *  Suffixing alone can alias — a second `step("x")` and a first `step("x_2")` both
+   *  want `x_2` — so keep bumping past keys already handed out. Allocation order is
+   *  fixed by the workflow body, so replays reproduce the same keys. */
   _allocKey(name: string): string {
-    const n = (this.counters[name] ?? 0) + 1;
+    let n = (this.counters[name] ?? 0) + 1;
+    let key = n === 1 ? name : `${name}_${n}`;
+    while (this._usedKeys.has(key)) {
+      n++;
+      key = `${name}_${n}`;
+    }
     this.counters[name] = n;
-    return n === 1 ? name : `${name}_${n}`;
+    this._usedKeys.add(key);
+    return key;
   }
 
   _nextStep(
@@ -1649,8 +1672,21 @@ export class WorkflowCtx {
     timeout?: number;
     form?: object;
     selfApproval?: boolean;
+    key?: string;
   }): PromiseLike<{ value: any; approver: string; approved: boolean }> {
-    const key = this._allocKey("approval");
+    if (options?.key !== undefined) assertUsableStepKey(options.key, "waitForApproval key");
+    const key = this._allocKey(options?.key || "approval");
+
+    // An explicit key is an identifier callers mint URLs against, so silently
+    // renaming a duplicate to `<key>_2` would hand them a URL for the *first*
+    // step — which then fails with "resume request already sent" and parks the
+    // workflow until timeout. Unnamed approvals keep auto-numbering.
+    if (options?.key && key !== options.key) {
+      throw new Error(
+        `WAC step key "${options.key}" is already used in this workflow. ` +
+          `Give each waitForApproval() its own key so getApprovalUrls() can address it.`,
+      );
+    }
 
     if (key in this.completed) {
       const value = this.completed[key];
@@ -1970,18 +2006,20 @@ export function workflow<T>(fn: (...args: any[]) => Promise<T>) {
 /**
  * Suspend the workflow and wait for an external approval.
  *
- * Use `getResumeUrls()` (wrapped in `step()`) to obtain resume/cancel/approvalPage
- * URLs before calling this function.
+ * Pass `key` to name the step, then `getApprovalUrls(key)` yields the URLs that
+ * resume exactly this approval — route them through your own channel. Without a
+ * key the steps are named `approval`, `approval_2`, ...
  *
  * @example
- * const urls = await step("urls", () => getResumeUrls());
- * await step("notify", () => sendEmail(urls.approvalPage));
- * const { value, approver } = await waitForApproval({ timeout: 3600 });
+ * const urls = await step("urls", () => getApprovalUrls("manager"));
+ * await step("notify", () => sendEmail(urls.resume, urls.cancel));
+ * const { value, approver } = await waitForApproval({ key: "manager", timeout: 3600 });
  */
 export function waitForApproval(options?: {
   timeout?: number;
   form?: object;
   selfApproval?: boolean;
+  key?: string;
 }): PromiseLike<{ value: any; approver: string; approved: boolean }> {
   const ctx: WorkflowCtx | null = _workflowCtx ?? Reflect.get(globalThis, "__wmill_wf_ctx");
   if (!ctx) {
@@ -1990,6 +2028,45 @@ export function waitForApproval(options?: {
   return ctx._waitForApproval(options);
 }
 
+/**
+ * Resume/cancel/approval-page URLs bound to one `waitForApproval` step.
+ *
+ * Unlike `getResumeUrls()`, which signs a random nonce, these address the very
+ * `resume_job` record the step's built-in approval buttons use, so they are
+ * stable across replays and safe to embed in a custom notification.
+ *
+ * `stepKey` must match the `key` given to `waitForApproval`. Keys must be unique
+ * within a workflow; reusing one throws rather than silently renaming it. The URL
+ * only resumes while that step is awaiting approval; used at any other moment it is
+ * rejected rather than banking a row a different approval would consume. Send it
+ * ahead of time — approvers just cannot act before the workflow reaches the step.
+ *
+ * `resume` and `cancel` are step-bound; `approvalPage` is not — it opens the job's
+ * approval page, which acts on whichever approval is pending when it is used.
+ *
+ * @example
+ * const urls = await step("urls", () => getApprovalUrls("manager"));
+ * await step("notify", () => sendEmail(urls.resume, urls.cancel));
+ * await waitForApproval({ key: "manager" });
+ */
+export async function getApprovalUrls(
+  stepKey: string = "approval",
+  approver?: string
+): Promise<{
+  approvalPage: string;
+  resume: string;
+  cancel: string;
+}> {
+  assertUsableStepKey(stepKey, "getApprovalUrls stepKey");
+  const workspace = getWorkspace();
+  return await JobService.getWacApprovalUrls({
+    workspace,
+    stepKey,
+    approver,
+    id: getEnv("WM_JOB_ID") ?? "NO_JOB_ID",
+  });
+}
+
 /**
  * Process items in parallel with optional concurrency control.
  *

From a8455acd7dd11a79f775a401275a128f206cace7 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Sat, 25 Jul 2026 12:07:28 +0200
Subject: [PATCH 171/171] feat: make bigquery and snowflake script languages
 available in CE (#10324)

* feat: make bigquery and snowflake script languages available in CE

* docs: add snowflake to backend cargo feature map

* fix: stop logging the snowflake bearer token at debug level
---
 backend/CLAUDE.md                             |  2 +-
 backend/Cargo.toml                            |  5 +++--
 backend/windmill-worker/Cargo.toml            |  3 ++-
 backend/windmill-worker/src/lib.rs            |  4 ++--
 .../windmill-worker/src/snowflake_executor.rs |  2 --
 backend/windmill-worker/src/worker.rs         | 22 ++++++-------------
 .../src/lib/components/ScriptBuilder.svelte   |  2 +-
 .../flows/content/FlowInputsQuick.svelte      |  2 +-
 .../flows/pickers/FlowScriptPicker.svelte     |  2 +-
 9 files changed, 18 insertions(+), 26 deletions(-)

diff --git a/backend/CLAUDE.md b/backend/CLAUDE.md
index 96ad6a9d76..f686e94493 100644
--- a/backend/CLAUDE.md
+++ b/backend/CLAUDE.md
@@ -60,7 +60,7 @@ only what you need — build time scales with the set.
 | `license` | License-key/plan plumbing (`LICENSE_KEY`). Pulled in by `enterprise`. Having the feature compiled does **not** require a license *key* at runtime — CE defaults to a free plan and most EE paths still run keyless. | License-gated behavior. |
 | `parquet` | S3/object-storage support: the `job_helpers/*` and `apps_u/*` S3 endpoints, parquet/CSV preview, workspace large-file storage. Without it those routes return `"requires parquet"`. | Anything touching S3/object storage or datasets. |
 | `duckdb` | DuckDB script executor (also needs the FFI dylib — see above). | DuckDB scripts, DuckLake. |
-| `python` `rust` `php` `java` `ruby` `csharp` `nu` `deno_core` `mysql` `mssql` `bigquery` `oracledb` `rlang` | Each enables that language/DB runtime for job execution. | Running jobs in that language. |
+| `python` `rust` `php` `java` `ruby` `csharp` `nu` `deno_core` `mysql` `mssql` `bigquery` `snowflake` `oracledb` `rlang` | Each enables that language/DB runtime for job execution. | Running jobs in that language. |
 | `mcp` | MCP gateway routes (baseline `quickjs` does NOT include it → MCP routes 404). | MCP work. |
 | `websocket` `http_trigger` `kafka` `nats` `mqtt_trigger` `sqs_trigger` `gcp_trigger` `azure_trigger` `postgres_trigger` `native_trigger` | Each native trigger kind; none on by default (creating one 404s without its feature). | Working on / exercising that trigger. |
 | `no_auth` | Treats every request as an admin superadmin (`CLOUD_HOSTED`-guarded). | Local auth-free experiments only. |
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 49056c8b0f..b10de4017f 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -168,15 +168,16 @@ mssql = ["windmill-worker/mssql"]
 mssql-kerberos = ["windmill-worker/mssql-kerberos"]  # Linux/Unix integrated auth
 mssql-winauth = ["windmill-worker/mssql-winauth"]  # Windows integrated auth
 bigquery = ["windmill-worker/bigquery"]
+snowflake = ["windmill-worker/snowflake"]
 php = ["windmill-worker/php"]
 csharp = ["windmill-worker/csharp"]
 nu = ["windmill-worker/nu"]
 java = ["windmill-worker/java"]
 ruby = ["windmill-worker/ruby"]
 rlang = ["windmill-worker/rlang"]
-all_languages = ["python", "deno_core", "rust", "mysql", "oracledb", "duckdb", "mssql-kerberos", "bigquery", "csharp", "nu", "php", "java", "ruby", "rlang"]
+all_languages = ["python", "deno_core", "rust", "mysql", "oracledb", "duckdb", "mssql-kerberos", "bigquery", "snowflake", "csharp", "nu", "php", "java", "ruby", "rlang"]
 # For windows we have another set of languages enabled
-all_languages_windows = ["python", "deno_core", "rust", "mysql", "oracledb", "duckdb", "mssql-winauth", "bigquery", "csharp", "nu", "php", "java", "ruby", "rlang"]
+all_languages_windows = ["python", "deno_core", "rust", "mysql", "oracledb", "duckdb", "mssql-winauth", "bigquery", "snowflake", "csharp", "nu", "php", "java", "ruby", "rlang"]
 # Edition meta-features: shared groups
 run_inline = ["windmill-api/run_inline"]
 oss_core = [
diff --git a/backend/windmill-worker/Cargo.toml b/backend/windmill-worker/Cargo.toml
index 99647ba81f..f4659f7d82 100644
--- a/backend/windmill-worker/Cargo.toml
+++ b/backend/windmill-worker/Cargo.toml
@@ -13,11 +13,12 @@ default = []
 private = ["windmill-worker-volumes/private", "windmill-queue/private", "windmill-common/private", "windmill-dep-map/private", "windmill-runtime-nativets?/private"]
 mcp = ["windmill-ai/mcp", "dep:windmill-mcp"]
 prometheus = ["dep:prometheus", "windmill-common/prometheus"]
-enterprise = ["windmill-queue/enterprise", "windmill-git-sync/enterprise", "windmill-common/enterprise", "windmill-worker-volumes/enterprise", "windmill-runtime-nativets?/enterprise", "dep:pem", "dep:rsa", "dep:tokio-util", "dep:opentelemetry-proto", "dep:prost", "dep:hudsucker", "dep:rcgen", "dep:hyper-http-proxy", "dep:hyper-rustls", "dep:tokio-rustls", "dep:rustls", "dep:rustls-native-certs", "dep:rustls-pemfile", "dep:hyper-util"]
+enterprise = ["windmill-queue/enterprise", "windmill-git-sync/enterprise", "windmill-common/enterprise", "windmill-worker-volumes/enterprise", "windmill-runtime-nativets?/enterprise", "dep:tokio-util", "dep:opentelemetry-proto", "dep:prost", "dep:hudsucker", "dep:rcgen", "dep:hyper-http-proxy", "dep:hyper-rustls", "dep:tokio-rustls", "dep:rustls", "dep:rustls-native-certs", "dep:rustls-pemfile", "dep:hyper-util"]
 mssql = ["dep:tiberius"]
 mssql-kerberos = ["mssql", "tiberius/integrated-auth-gssapi"]  # Linux/Unix integrated auth
 mssql-winauth = ["mssql", "tiberius/winauth"]  # Windows integrated auth
 bigquery = ["dep:gcp_auth"]
+snowflake = ["dep:pem", "dep:rsa"]  # pem/rsa: key-pair auth
 benchmark = ["windmill-queue/benchmark", "windmill-common/benchmark"]
 parquet = ["windmill-common/parquet", "windmill-object-store/parquet"]
 flow_testing = []
diff --git a/backend/windmill-worker/src/lib.rs b/backend/windmill-worker/src/lib.rs
index 9fa0b514c4..fe2fffb93e 100644
--- a/backend/windmill-worker/src/lib.rs
+++ b/backend/windmill-worker/src/lib.rs
@@ -1,8 +1,8 @@
-#[cfg(all(feature = "enterprise", feature = "bigquery"))]
+#[cfg(feature = "bigquery")]
 mod bigquery_executor;
 #[cfg(all(feature = "enterprise", feature = "mssql"))]
 mod mssql_executor;
-#[cfg(feature = "enterprise")]
+#[cfg(feature = "snowflake")]
 mod snowflake_executor;
 
 mod agent_workers;
diff --git a/backend/windmill-worker/src/snowflake_executor.rs b/backend/windmill-worker/src/snowflake_executor.rs
index cc05adecf8..b4bb448b99 100644
--- a/backend/windmill-worker/src/snowflake_executor.rs
+++ b/backend/windmill-worker/src/snowflake_executor.rs
@@ -720,8 +720,6 @@ pub async fn do_snowflake(
         )
     };
 
-    tracing::debug!("Snowflake token: {}", token);
-
     let mut body = serde_json::Map::new();
     if database.schema.is_some() {
         body.insert(
diff --git a/backend/windmill-worker/src/worker.rs b/backend/windmill-worker/src/worker.rs
index 003ddd3876..ab7051af08 100644
--- a/backend/windmill-worker/src/worker.rs
+++ b/backend/windmill-worker/src/worker.rs
@@ -194,13 +194,13 @@ use crate::oracledb_executor::do_oracledb;
 #[cfg(all(feature = "private", feature = "enterprise"))]
 use crate::dedicated_worker_oss::create_dedicated_worker_map;
 
-#[cfg(feature = "enterprise")]
+#[cfg(feature = "snowflake")]
 use crate::snowflake_executor::do_snowflake;
 
 #[cfg(all(feature = "enterprise", feature = "mssql"))]
 use crate::mssql_executor::do_mssql;
 
-#[cfg(all(feature = "enterprise", feature = "bigquery"))]
+#[cfg(feature = "bigquery")]
 use crate::bigquery_executor::do_bigquery;
 
 #[cfg(feature = "benchmark")]
@@ -4909,14 +4909,6 @@ pub async fn run_language_executor(
             .await;
         }
     } else if language == Some(ScriptLang::Bigquery) {
-        #[cfg(not(feature = "enterprise"))]
-        {
-            return Err(Error::ExecutionErr(
-                "Bigquery is only available with an enterprise license".to_string(),
-            ));
-        }
-
-        #[allow(unreachable_code)]
         #[cfg(not(feature = "bigquery"))]
         {
             return Err(Error::internal_err(
@@ -4924,7 +4916,7 @@ pub async fn run_language_executor(
             ));
         }
 
-        #[cfg(all(feature = "enterprise", feature = "bigquery"))]
+        #[cfg(feature = "bigquery")]
         {
             if run_inline {
                 return Err(Error::internal_err(
@@ -4946,14 +4938,14 @@ pub async fn run_language_executor(
             .await;
         }
     } else if language == Some(ScriptLang::Snowflake) {
-        #[cfg(not(feature = "enterprise"))]
+        #[cfg(not(feature = "snowflake"))]
         {
-            return Err(Error::ExecutionErr(
-                "Snowflake is only available with an enterprise license".to_string(),
+            return Err(Error::internal_err(
+                "Snowflake requires the snowflake feature to be enabled".to_string(),
             ));
         }
 
-        #[cfg(feature = "enterprise")]
+        #[cfg(feature = "snowflake")]
         {
             if run_inline {
                 return Err(Error::internal_err(
diff --git a/frontend/src/lib/components/ScriptBuilder.svelte b/frontend/src/lib/components/ScriptBuilder.svelte
index 4007f3bf0f..bd30cd6909 100644
--- a/frontend/src/lib/components/ScriptBuilder.svelte
+++ b/frontend/src/lib/components/ScriptBuilder.svelte
@@ -332,7 +332,7 @@
 		triggersState
 	})
 
-	const enterpriseLangs = ['bigquery', 'snowflake', 'mssql', 'oracledb']
+	const enterpriseLangs = ['mssql', 'oracledb']
 
 	// Languages the pipeline editor treats as warehouse/dataset transforms —
 	// the ones where a `-- pipeline` annotation is a natural next step.
diff --git a/frontend/src/lib/components/flows/content/FlowInputsQuick.svelte b/frontend/src/lib/components/flows/content/FlowInputsQuick.svelte
index 3f070dd74e..dc2cba93d4 100644
--- a/frontend/src/lib/components/flows/content/FlowInputsQuick.svelte
+++ b/frontend/src/lib/components/flows/content/FlowInputsQuick.svelte
@@ -146,7 +146,7 @@
 
 	let inlineScripts: [string, SupportedLanguage | 'docker'][] = $state([])
 
-	const enterpriseLangs = ['bigquery', 'snowflake', 'mssql', 'oracledb']
+	const enterpriseLangs = ['mssql', 'oracledb']
 
 	function computeInlineScriptChoices(
 		funcDesc: string,
diff --git a/frontend/src/lib/components/flows/pickers/FlowScriptPicker.svelte b/frontend/src/lib/components/flows/pickers/FlowScriptPicker.svelte
index 573db39435..0484762705 100644
--- a/frontend/src/lib/components/flows/pickers/FlowScriptPicker.svelte
+++ b/frontend/src/lib/components/flows/pickers/FlowScriptPicker.svelte
@@ -14,7 +14,7 @@
 
 	let { disabled = false, label, lang = undefined, id = undefined }: Props = $props()
 
-	const enterpriseLangs = ['bigquery', 'snowflake', 'mssql', 'oracledb']
+	const enterpriseLangs = ['mssql', 'oracledb']
 </script>
 
 <Popover disablePopup={!enterpriseLangs.includes(lang || '') || !!$enterpriseLicense}>