From a012744e44f6ba9bad1b4ca7e92ae71e1304bb1e Mon Sep 17 00:00:00 2001
From: Schreiber <sam.schreiber@sublimesecurity.com>
Date: Mon, 4 May 2026 17:43:06 -0700
Subject: [PATCH 1/6] reset

---
 docker-compose.yml | 14 +-------------
 1 file changed, 1 insertion(+), 13 deletions(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index 38ac189..0d7f5dd 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -24,7 +24,7 @@ services:
       - net
     env_file: sublime.env
     environment:
-      MANTIS_HOST_URL: "http://host.docker.internal:8000"
+      MANTIS_HOST_URL: "http://sublime_mantis:8000"
   sublime_redis:
     image: redis:6.2
     restart: unless-stopped
@@ -177,18 +177,6 @@ services:
       /usr/bin/mc ls myminio;
       exit 0;
       "
-  sublime_hydra:
-    image: sublimesec/hydra-cpu:dev
-    restart: unless-stopped
-    ports:
-      - "8200:8200"
-    networks:
-      - net
-    container_name: sublime_hydra
-    environment:
-      WORKERS: 2
-      WEB_CONCURRENCY: 5
-      KEEP_ALIVE: 2
   sublime_localstack:
     container_name: sublime_localstack
     image: localstack/localstack:4.10.0

From 864b64a7316c41055f15e36553c838154b410ede Mon Sep 17 00:00:00 2001
From: Schreiber <sam.schreiber@sublimesecurity.com>
Date: Tue, 5 May 2026 08:45:42 -0700
Subject: [PATCH 2/6] fix

---
 docker-compose.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index 0d7f5dd..282308e 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -24,7 +24,7 @@ services:
       - net
     env_file: sublime.env
     environment:
-      MANTIS_HOST_URL: "http://sublime_mantis:8000"
+      MANTIS_HOST_URL: "http://host.docker.internal:8000"
   sublime_redis:
     image: redis:6.2
     restart: unless-stopped

From 7650c4190739588278b3be791f17ee2f0f39523c Mon Sep 17 00:00:00 2001
From: Schreiber <sam.schreiber@sublimesecurity.com>
Date: Tue, 5 May 2026 11:47:09 -0700
Subject: [PATCH 3/6] use different volume

---
 docker-compose.yml | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index 282308e..0a12340 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,19 +1,19 @@
 services:
-  sublime_postgres:
-    image: postgres:13.2
+  sublime_postgres:    
+    image: postgres:13.2                                                                                                                                                                                                                
     restart: unless-stopped
-    container_name: sublime_postgres
-    environment:
+    container_name: sublime_postgres                                                                                                                                                                                                    
+    environment:  
       POSTGRES_USER: sublime
       POSTGRES_DB: mantis
       PGDATA: /data/postgres
     env_file: sublime.env
-    volumes:
-       - postgres:/data/postgres
-    ports:
+    volumes:                                                                                                                                                                                                                            
+      - postgres_e2e:/data/postgres   # different volume than dev to avoid overwriting data
+    ports:                                                                                                                                                                                                                              
       - "5432:5432"
-    networks:
-      - net
+    networks:                                                                                                                                                                                                                           
+      - net       
   sublime_dashboard:
     image: sublimesec/dashboard:dev
     restart: unless-stopped
@@ -195,7 +195,7 @@ networks:
   net:
     driver: bridge
 volumes:
-  postgres:
+  postgres_e2e:
   logs:
   s3_data:
   localstack:

From 2f32d6e7db65b426cfb1bd693cd4ba3233d3328b Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Mon, 14 Sep 2026 22:39:41 +0000
Subject: [PATCH 4/6] Sync from 824a55c31f914af6b478a611c675552907eec82e

---
 .github/dependabot.yml                  |  14 ++
 .github/workflows/docker-deploy-dev.yml |  14 +-
 .github/workflows/docker-tests.yml      |  49 ----
 .gitignore                              |   1 +
 LICENSE                                 |   2 +-
 README.md                               |  29 ++-
 assets/sublime-logo.png                 | Bin 0 -> 32202 bytes
 docker-compose.yml                      | 292 +++++++++++++++++-------
 install-and-launch.sh                   |  12 +-
 nginx-custom-ssl/Dockerfile             |   9 +
 nginx-custom-ssl/README.md              |  12 +
 nginx-custom-ssl/certs/.keep            |   0
 nginx-custom-ssl/conf/nginx.conf        |  57 +++++
 nginx-custom-ssl/conf/ssl-params.conf   |  20 ++
 nginx-letsencrypt/Dockerfile            |   2 +-
 nginx-letsencrypt/nginx.conf            |   2 +
 nginx-letsencrypt/start.sh              |   2 +-
 update-and-run.sh                       |  10 +-
 utils.sh                                |   5 +
 19 files changed, 368 insertions(+), 164 deletions(-)
 create mode 100644 .github/dependabot.yml
 delete mode 100644 .github/workflows/docker-tests.yml
 create mode 100644 assets/sublime-logo.png
 create mode 100644 nginx-custom-ssl/Dockerfile
 create mode 100644 nginx-custom-ssl/README.md
 create mode 100644 nginx-custom-ssl/certs/.keep
 create mode 100644 nginx-custom-ssl/conf/nginx.conf
 create mode 100644 nginx-custom-ssl/conf/ssl-params.conf

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..0414fe9
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,14 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/docker-deploy-dev.yml b/.github/workflows/docker-deploy-dev.yml
index 3d54b47..b475d7e 100644
--- a/.github/workflows/docker-deploy-dev.yml
+++ b/.github/workflows/docker-deploy-dev.yml
@@ -12,23 +12,25 @@ jobs:
     steps:
 
       - name: Check out the repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: Login to DockerHub
-        uses: docker/login-action@v1
+        uses: docker/login-action@v4.1.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
       - name: Set up Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@v1
+        uses: docker/setup-buildx-action@v4
         with:
           driver: docker
 
-      - name: Build letsencrypt
-        id: build-letsencrypt
-        uses: docker/build-push-action@v2
+      - name: Build mantis
+        id: build-mantis
+        uses: docker/build-push-action@v7.1.0
         with:
           push: true
           tags: sublimesec/nginx-letsencrypt:latest
diff --git a/.github/workflows/docker-tests.yml b/.github/workflows/docker-tests.yml
deleted file mode 100644
index 3134b37..0000000
--- a/.github/workflows/docker-tests.yml
+++ /dev/null
@@ -1,49 +0,0 @@
-name: Platform PR CI
-
-on:
-  push:
-    branches: [ "**" ]
-  workflow_dispatch: {}
-
-concurrency:
-  group: ${{ github.ref }}
-  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
-
-jobs:
-  tests:
-    name: Validate Platform Installation
-    runs-on: ubuntu-22.04
-
-    permissions:
-      id-token: write
-      contents: read
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-
-      # main should never require private images
-      - name: Configure AWS Credentials
-        if: github.ref != 'refs/heads/main'
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          role-to-assume: arn:aws:iam::948971135452:role/ci-sublime-platform-ecr-read
-          aws-region: us-east-1
-
-      - name: Login to Amazon ECR
-        if: github.ref != 'refs/heads/main'
-        uses: aws-actions/amazon-ecr-login@v2
-        with:
-          registries: "948971135452"
-
-      - name: Make ECR credentials available to sudo
-        if: github.ref != 'refs/heads/main'
-        run: sudo cp -r $HOME/.docker /root/
-
-      - name: Install Platform
-        run: |
-          interactive=false clone_platform=false ./install-and-launch.sh
-
-      - name: Check Health
-        run: |
-          ./postflight_checks.sh
diff --git a/.gitignore b/.gitignore
index b3e9a4d..5333d47 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,4 @@
 certbot.env
 sublime.env
 *.swp
+.DS_Store
diff --git a/LICENSE b/LICENSE
index 90933c4..574d1b1 100644
--- a/LICENSE
+++ b/LICENSE
@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2021 Sublime Security
+Copyright (c) 2021-2026 Sublime Security
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
diff --git a/README.md b/README.md
index e18fce1..14ebf1e 100644
--- a/README.md
+++ b/README.md
@@ -1,36 +1,43 @@
- <a href="https://sublimesecurity.com"><img src="https://user-images.githubusercontent.com/11003450/115128085-5805da00-9fa9-11eb-8c7a-dc8b708053ee.png" width="75px" alt="Sublime Logo" /></a>
+ <a href="https://sublimesecurity.com"><img src="assets/sublime-logo.png" width="75px" alt="Sublime Logo" /></a>
 
 Sublime Platform
 ==========
-by Sublime Security
+by [Sublime Security](https://sublime.security/)
 
 Overview
 ---------
-An open, adaptable email security platform for writing, running, and sharing custom detection and response rules to block phishing attacks, hunt for threats, and more.
+A free and open platform for detecting and preventing email attacks like BEC, malware, and credential phishing. Gain visibility and control, hunt for advanced threats, and collaborate with the community.
 
-Why?
+Sublime uses Message Query Language (MQL), a domain-specific language purpose-built for describing behavior in email. MQL is email provider agnostic, enabling defenders to write, run, and share Detections-as-Code.
+
+Learn more about MQL: [Introduction to Message Query Language](https://sublime.security/blog/introduction-to-message-query-language-mql)
+
+Docker Usage & Caveats
 ----------
-Traditional email security is a one-size-fits-all black box.
+This Docker deployment is intended for small-medium size deployments and for testing purposes ONLY (limited to 100 active mailboxes). For the best Sublime experience, we recommend the [AWS Cloud-native deployment](https://docs.sublime.security/docs/aws-cloudformation) or [Sublime Managed Cloud](https://docs.sublime.security/docs/sublime-managed), which can support any number of mailboxes, is resilient, and has the latest features. The docker deployment allows you to gain hands on experience, but will only receive best effort support (no long term support).
+
+[Learn more about feature restrictions for Docker Compose](https://docs.sublime.security/docs/docker-requirements-and-limitations)
 
-The Sublime Platform **gives defenders control over their email environment** and uses an intuitive, interoperable, purpose-built domain-specific language (DSL).
+The Sublime Platform Docker Compose ships as an entire setup. Modifying the docker-compose file or using our docker images within your own implementation is not supported.
 
 Setup
 ----------
 
 ```console
-curl -sL https://sublime.security/install.sh | sh
+curl -sL https://raw.githubusercontent.com/sublime-security/sublime-platform/main/install-and-launch.sh | sh
 ```
 
 [View Docker Quickstart](https://docs.sublimesecurity.com/docs/quickstart-docker)
 
+[View other deployment methods](https://sublime.security/start)
+
 Detection rules
 ----------
-Open-source detection rules are maintained in the [sublime-rules repo](https://github.com/sublime-security/sublime-rules).
-
+Open-source detection rules and links to community Feeds are maintained in the [sublime-rules repo](https://github.com/sublime-security/sublime-rules).
 
 Learn more
 ----------
-- [Sublime overview](https://sublime.security)
 - [Docs](https://docs.sublimesecurity.com)
-- [Message Query Language (MQL) reference](https://docs.sublimesecurity.com/docs/message-query-language) - Sublime's DSL purpose-built for email analysis
+- [API](https://docs.sublimesecurity.com/reference/introduction)
 - [Release log](https://new.sublimesecurity.com)
+- [Message Query Language (MQL)](https://docs.sublimesecurity.com/docs/message-query-language)
diff --git a/assets/sublime-logo.png b/assets/sublime-logo.png
new file mode 100644
index 0000000000000000000000000000000000000000..b7a666a4825b37bdcdf153ad459e0cc2390c3b5f
GIT binary patch
literal 32202
zcmeEtWm{aq((Ps#G`PDv1b5fq?(Xgo+$A`KKyY^r?gR_LHMm1UaCe70Iq$jmH{1{J
zr|Ef~nZ2vKtE*P6S{<#TB#n$nfCvBpvaF1x8UTPGLl6KD3;DSAo_hoUGC)>ROvBsg
zI0qqH)AHplZ;y#1KeerIO+X^X%$8Z#*6M(TzInV^!vHg)-3!(NT~dY>o4Nojg&v;a
z2dCn`IM+0=lUJHvp^>VWi9^G2htgKiK0YqAC-^qSVbTt`r|t3GF>PM?K49!*pIrt{
z3hnvj?mhYUWd9NaM*-+$Ajx3(p9#R{oT0z0|MLwEilUbe$j=Ifhm1tQQKCo)Dgau)
z7;Rege}At6h~E8oh!%o}kq?kXgefs&{^!>KdOi?*`rjcLh>c1VN)!n$$AISFi~c<j
z3Rs8!?+|Pz6ATK*L*Z{%_`kM*fDX9-XI3Hr1F#W&bj$d!C6KQlQUAv%06mHv3K1~l
z-T%vu{+~&pLB8&j{C7x!CIP|%e!5JLSpJ*BKVz|gX`%lPCCMVdbU@Va{N%C!YYAk+
ze*Zh+|J~t#{_wvp{r}e)me^}Zx2#X|YFVlqJe^)vf*tzYd$<F=#Qf%om$&nC%IA_-
z0dk(<XKe;1v;<{N^sK9gmc38w39}!stJ}!Qg8HR<568zbU<KCE99#>A^yEV9?+00#
zanu2{v@a-M@)lNF`opb>hJ;)Nx2sLV4*uZJn$zBLa=uYY)+AQ2QJQ?42+V2!<Jo4|
z`s*f$weQp_)hCU^V*JcJB5Vzr7ZP|t!lLzTXYKm-<0qTKlfClBE}lfs8;_XXg#M-K
zX_<tCG=FXO;dR=_L3lzwm=Qe;cp#|BGdIi%<A_N%cHX3a;plH&#27tCo>25VSH$Yq
zK#|n95e6)!!;OdPpig5G4csW;<C+EN4C@V=bi59jAU{6LR`2Z1W15+s7--x}wzhvu
zaJnS9!QR+-q7!zNd|^pt{Q5x^#hrUyws;TQgE>bM>`!Il(K6AG``Rv5`TW`B+3Ii0
z+8@s1SK}{>)3%bL^pL51{X=CsfL7<`xQP>*H_j)3zvrwu&PB?<Co7#!+wjO{FZVq`
zi59d1ztldSCN${O5AC57EoX#nuojA6r=M*xHi}VOG8-)_1+k|bp489)BV>LIPPchd
zs?Cb&6<=khnUo)&=j5w6dw^y8;;e_HC>InMNM=i>UVIx9`irwzqV(B=%@etrMH}8w
z8Z1W+Ng(u1`)il*ADId5@K0^Xmu%KtI#X%?QfdqBE^Wv<l%;+L=~9KlYe?o>Ia(P{
ziS3H)b!t<|7%?pw^X)Mre%iox*lXOV)*(S41L>3f%RnT02<h$P`00nF@o=lH8Vo<a
z9u$iQT+K6BCNWW{pg>u?8iyV+)9tOiH*n{118cR7%o)b)B=J(58~;lr6ZxNl=QCdT
z7q~A5SUzwJzDJe|++#hHOm*;440FJc1;<dRBpW~aDC@NTo_)EJGE^Cr4gDrf9EZKe
zp@l_|`KmTr@{t*xE&`I#22={&V`$Iq{AL)uy$|lX?iuqi)<dnpxZ8*$yCnmJ($*MI
z&ERVPUC_AG2tJTAly{MDq*_kg7JA|`xXO?H<=7i?T*-{Kzs;{gJy3V@j_W1B{VCAH
zcEm~u6=P}l$njH~@DQ;{PEbY@{fyXH^?GJd_q%)g_pxa#U;KKsE6Y>i=dY5v5L3R8
znvoLuH*=ZZ5WG*XaR_NamCJw3$8$%5mB&7uIq9aOq?X*00N3Ssz@GN<b&I3_k+M41
z8aj5g3>)g%u5wbt;e)J>q?62x$MCU@P)wE;2j(B0Ag(v<RcE52TS+ai-A>IJWjk{j
z6H#re^li54mqr%t{s6%?XVD~+tYiftHRP9K4uXHDVUYLnOe%0$Db?kCU}{JEZ7@RU
zHH(}JaZ<Xd`>}ccmy+JLOz)`ml+?8TNzB)vy|`8!3@gU%IR=4*JJS+jbwGu_56_5&
z@!|KtCeq?l)%qDK@#LxNhR+*S%TqB)5LQyE4(7gr;M^bX?$?J9v8~|9dk^s_t+MWn
z4rEwUQE>}s7=WChx-yGF&r!fx>6|w!IN+WE@sZ9Q0a<6#C3%8}4pSyHs@DphuKckq
z_ZwQ!?=>9_nbL;CPsu;a|AC@P%BrQ>%$nnknn+v`Ot(>ysG%Gsv(;og(gWCEybbge
z;Dz_Kjfg0ful2QXlazfbN;*t#Xz+CwhnpddpOFxW{sk5usy>e4@#ehV3?8UdVgkXV
zS8H@c)SP3QOlRbVcnkeDgr%Hsm|&hz!w|JPzx06`&xm4Dcpk?FBOb`#KVqUZJ}(B{
z+E(oaJp4&}qY6DmblP2=rn0e^KB0ONmm^#3C>n@geXev@#ixD+$+@sFP^rZ-Bui*Z
zXFxncm1G^!zwycuj;t#X#Gjp`8-f?aGQbH#fRgi<W>(}*o6R;B8cHC|QLIL`oI%+v
za-3ppJJ$Cw%P6WJ@5|>Bh-c<=8rAda*WCH#Ci-RH!RPdsr|weCP>Ngg;1hX+=$@Wb
zc)MRkLN0atx5{o8N^+3}E!d~EA%1ipBd|59)x4q=swn2uMPE0!7!!y%a*Y_4x4%$w
zs!EqEIglN^o?$C~aDZmLWG)+A53@u)O>k8}btfVj3;~kFkMP5zRxo{~`85we>nOiG
z6@Gcg%5WT*_yR>f?XkX)y67%Y{h%bu#IP85=kgmgRHfTX@S)472Cajc|DO*|>ZG1T
zr;NRlG7oC^@OC?p_jQ~L9mDgY3xEQNnHq;PSut1z8j9M;wZebhDlRiYTUd-S(Q$H$
z5M$>Jf4+oQ0aQp@hYc)uSCpjrRQYy{Q!;luL@9jgiARFz4KHP#6yU$N)h(=8<&Qs$
z(CCrGMuxNEwB0mm;Cyp^KS78H$ZcciH132s9)(;Eu)N_D5f5?u{#e!@H>c&hX~N}q
zGe0VluwwQjh%uIG_(A14{@sFg96ZNkyiKX5hW!unf^ArzIR{29cf~h-0uQf^aeLma
z&vftg7|q~egLFtbImG47vq*5l-j*ul4bf8AC`DpuA@TO2n!>d-N54Y^bC=VCbEv>%
z@`!HPm!btmm?*lBlGdNv#Iq^>FKo|%c8R81#KI5!F^}CFB;qHt6a}(oO-O_l#m?83
zFUfEgz|ei2ogQF9dHS0NwU_liY<<o!&B*ZmZZXeyF!w?~FZKgf*_If7`L4Eac}!>G
z5$op;#KQtY$qI<=t{R+67M>Q9e<S=K8oRinP~&9A9iB18CMP1c*VdjgTs7{gSSc}$
zB#ybh!6DA_!jNRg1Vw}|CKoaVA+<wYtvz0^OXVoie#(S+asf&ApSV_jcJ<|mw4kq~
zMuzFjZ3s70&L3W`Xk#fQtkFaMAm}_SpbuxKHA1nY-D_NEN1ToanOIK?+Px?0aAjOJ
zf$YZzoWghfI433-nYMB650^aR7CslHZm%t9f2_XWI~O*;{;B_!v4hEawOoWm{&yxA
z30(NlX?Cm#p1aDH91<L~=G&PqWDHY)ls#mhm8e^ybyG8HjYFXlE{*QXGSFu0tR76L
z%gww_4tK&}k@iWhO?x^O&$zg~p9Sj8RYUrh$b(0N#ZOC@Ye8%w-B|K=^6MRw(O6)x
zZ~7>A0w}oQ7tH++kJ#4w?3E+R?*SF>j9=8(9(S{#1rdD}C4#k+m65!D)kVJ(CNj2P
zH5rn4zxTa168e7bcMn{C(Kh$}m$Rk2w{)A{p6WoPqrq#IRCO0&+{?}N`#s|4o<;6w
zk%c~k-)4iBLXdM}fw29MTTqd9%}?lXU}e2Zzts(BMKlL}5DBi&SvY)vf{E(uMjfk%
znB`Uub5BrJ<N@YTI6lLb1}}{_DD+Qsz_R3fmPIr-63-A@A|T94J$w>acBnEX!R>Dw
z@*4Ph#mfA%#>R8*?yR?s0*%V$f@P_Z;KcgP65hF)HZCZGM1Ng>^{JNkJFlHvhLF(Y
z5ZR?2DDniv!5xFt=X}O(b<zH*uR??oL)Hu=3R!UgDU<<oyyn)t{b-^$ZBtuw1Sy8d
z-*tlm>HBk}WK+Xt$Bu_pfeW1{E7D$RJuZ9wg(k~6>eH}BfXZMISiq?N<sQQdEqAE;
z=etm!sZJp-)JD_zBl$%1O!Wza-6!wzQL?Sh0=5osi8G0Oo<&*Cx0-wT{c$o(NG=#I
zQV(_XKF<zGD&b(oety7Ue)n3D{eo@WIfkfJAjEE*1aeGU)P17V5dc^oUR1*^gOGma
z_K_l4;`k;uAwu;rgk5N^{Z*E#)D{Zm8*|NMHJ=TKJ7%?<3ni1O8~QY|r`CBwhV)^F
z8xnN*`YYw@t{klqK98{kwGR@;hc$wX(8iDy9&j-xls~Q03oIt2eedjvOcUykxUjzX
zRQFUo9rzdjT+^fh(Fd`L$+YIM!r51>;JGrY;qrvC?c9RQ#a9z)y6l=SZq|TjnP`Lr
z;js=znH>h`BTP<W5?2gr-(cx^7BQUp)F=Fa-o9`~GqVV@IzFMV-N@Zoi{>9Rb%nBY
z{=@o`ls|^@oD?64Y}*C<k~p`aT?c!`E}<$7wGOV$9Bq8mGK2+tFYtWoN9;DXzsqxR
zq6`Z{ceBOsT}U)V`{UO?X-TtvWJY4J&(bI$X+*J|-fo-fa4^P?Iv=u*>scE>Q7R)%
zzVo_e6ECkREk23%{K5MVY^%w7>@!q52f2ZCjfZq>Mn=@hxa&D6LrbQ#7HQEWv6&PN
zvPW@uKQb9%^>(@UH$K_El@o;u#edU?mCz1g>aoDpPme5GnlY7G6CmnGZ$~;OTQ`IE
zu3r@u>`i|Ne(Js=Tm824jcmD9N<TMC)7*KHm86q@kaF3*b$Y4GQetzUD=0cy#t;WR
z$ZQ7|1~4T&)m{~`<lBH8*RS(06s}t|-w|eaVsjqn%nMxLjUP+Rw=Jhohpt~uy~$5V
z5Ic*ki<ust0r%yw$?5Zt{%b0t!&$*kd*x9`vZ&ALCsea(AAaU7wTVHArbqZHdisrF
zH8|h>WzFb<(O>+1WLm%N$zp|!X@uILJlx6)<|awldT0FnYt;__<7-wkDnb!Eny6SY
z+^_S)5Y}Tlyx<JV$mQ(}TAFKY2gDch#LbwD;Eu`VasoOppJ{XuB(a2>Bt9w}>#;9k
z-NGzkM6yK65XoF`$F4~pwvhR$|HHn06aC?<JY6it&&^^jJhv^bsYA|x#XjSswsoC`
zIi#ifCuS_=WYAE3Pl${+Mrz2RUh=F+Ub@8?l)g=MLC(>mhP*`s!C%&Hk*R`5@d~8C
z)B5$Jp{Vj;_np?P2ksq;qYq6!4ZFiPK~dIiu!9%B7|tF-Wsb!n4!p}NZ>sfaUAl*~
zSK-A@enSKQYInruEf@@HXji#MoeVlW&s?rP9rx-#Q)m)`?EL<A*4U{7dq`T4u}8fM
zsdsOe1$;|eB3^gY1$xLatCfdU&t#hyh-BFNp>ZmlfEWJ_Dn!Jr>jh=@_H=)_;(;{e
zCq>#F6S*~L&^($R<k<OuJqg@lv;;&YaYFl;?{md~fG&T=B%@9mfwlfj5hF=!Eh;)R
z+}M;Ktb6Sqiaqe*e54%WIF4c&E8Vyvhwai$74m2!Pd1p=Zi5FXVOIj7nY1Rm4I*0x
z*|B6M#-t<rYR%K88^<b62lG-?CT{cq{8F&LiIQTC2Wp?f_vZmyD6V>}#=wNX)jpp(
zu1V$Ehd;Z2Ggxii(GVG>%L4*dp9+#cYGeePyooXoon&WtVI`TrYFOF}7Z`0Mr`Pl1
z289sQ{1!gHX!zM&Ex)ui*o~6>5gZFiq<sXRh3)MYnocPdBmy7uutcxq*b!!5<sJI7
zH-#+Xj&X3)`;SLS%;8-@x2I#cZ`>hlaYz^OK<H5#+qOGg=<I43PWDR9GE3pbWV<(P
z_$xHPCxWky*QooF&ee^~OwSMld5e_k<r&pOzci_5`}~>TtL=Q@fsnuDg!}l$1C-sL
z{t1JpJ7k5M?SgRJp7LLR_z;kBq59n5VNbV6I{Wbn@|C=5TWG(9(jEnb2d=Wnk=NEK
z2FlvV^G6;fFt6w#0x=&--X#4LZyA5|j^#BL-Pq5TK^ebPA=B&@MNe@(Hhra89&ILx
zt9bp@_M6bPM0I8UqbCzQ8CtKibGz-zm|sNPt2LQF4yvx!s}vY2Kps?JRQSXB%sPVB
z>W&l4iOzureOikS!LVa~jVsm7j>hK9X~wVR7&w2zu4vD>xJcvuolwJZSz2kTp>}O{
zM{q?nkKg@F2X976^MRn4-c^f=2J7A*l6q=;#-0Cl05*#r7rr_}wajh&AZF|I+S}b5
zO%vCygs`c>3`y9-^_PyDCL~6$*#T7`w)q~7IzK$GJ%N$>&l;O}8nI{N*>P|W`_pim
zV!`+lgev8BFkauW#dL94J694uG)uHgY!Ut@LHTRw?eAGoaKQ5WmhyQ4Qb3)sNgDc$
zee(fC4r{emzarj<oarn?ky$*gwBNo6{pK!gPxOCq)+{jo=o5!9yelDtWpL_k24gSd
zr9nIZ$)%~=f?xr0A<W>6xRiu>cZ=Z5uu9>kc~(d&wo}<GZ>(L(-fFzaTe`*EfVO`f
zbDXr&7V5KpL0;88>spP<{9A;sa)N18XyF4O2nPTBh3&-dVczT*D_6)0y3Rr#YOk~2
zU&5`L;H-J12g+xLSBX!I(TJqjc?C-4Xy{a9Z(g-pOFg+)T{X%uLM##cKEAo8pQa%M
z4yDkCGE;(H(D(aZx__{OFQN5v_s=YHf{c@$SLIEX(faO2_;2=8<8h}wU<O$%M&^1v
zjwl}T{xR9ur!koZR?43d{2#`?+58qdKW|^L+;vFByRvKkp2&qMIQtW~hqmXrwJMdk
zm`4lznt)%rgL0Ru-8gD^lDX6AX9aa5evkS?fpm;Xw{@|Tbw57q$GEq9i#o7%RlZQ;
zxIW<?w~TJ{?Ap!&aNucH-x$uOtgl}ERK)wy6+rSqO&Tl;94+PYHdnSoHE2hP)}oP|
z8j;JieINAbWI>Y9Kc`!Ngt#4FX3ki|%34l*l-JihyZIvw_ne<(OvZ8k#$Cr0RHK9R
z5$RDo$<e%ikrXxg>QTWopl6mfG;Q-SlTI3#m)HOZ2Y`dL%<5q9Mho{C$C%R^|8AK?
z@eQFV1)V(s1oXhVJ6c5@G{^(rmswH>t|7$5q~~Ev3QLf7*mI!Nis2ZFMXmt4*xbQO
zt^zF@lrenNT|JdcGv)ofW)|{(n<w1Zz8EojU<(WLk=l;|%SnNBgrxwr&&=3VcR`TK
z>-@l}&MgB*1^YHBSDSz28Y?d`Ks-Lf{t2qZVx;yJy3!K*fEq&OxX^A7&MOtlI?Yy%
zicMuynxKADgA~1}hKnBh`bKBe<>FomPMUf<?%ZRt#ViYz=I%eP#ylIs8I7MW^Tagk
zL%w2!{DBvYB)d5jXP?(wJBXPYZFaI`+n$*Ya&Yk^&*gE8<s>G6^gr^^nf2%G^kt!0
zf;@ATxE?KI8MD1Qt+mYcCJ)C0iRX1_BLX^;U)d;-p(v)`>DPFo!E0Fh=`SYrm0BCd
zMEWs^D#&q_^d_$D&+)u9&AmH#{sVccieOdJRMX{htShFm&gCbl4&W)5gBg>fs(u~e
zQ__bbm89pxH?`ozM0&}5UQh#P3ljKn78T1Yq@xkG+OVbS$S1Av-6s8E@gq}oqnFC#
zz4&<P@Qyk^Cj`!jLTk`t*t_m+8@nMgHpR80@nq5D9r%3`S?(<xOrK8MVOc8UL`ILM
z1_h#dlVG3KFjJ{@dkt3WCND2GE|uIPe`@dCC$u5^Xj&lLwe-0!CM#jOJ3CZRMN60i
zd410!rDug~wcT>{Ckt}g)G=}9YgMgqly2(!yh}iNkAXkThf#5{;Hw8Eicd~~uOwQu
z9dT~laGT`69m#(B;Np^4figK>XJWg#5do~v^*Lj?@wV;{JEXfTi_+;^9RF}o%!Pw$
zcC#nG9)$qMMIHaBa#wLI{JofoL_Hzf;@P)Qt(q73K|wIo@mSz}g#?_DMy+?Y@ji{(
z;$b4Gb_NzeN94n}=*wz8SWE6k_{r=A=LUrYN1A^mH6@T?<2=!AXH4X~F+(7T(y)Mv
z%zl&bNBXS#=5=Tu$`Wx#En?V+0oa%O0YP}HgAP#P6t!Y@hc%h})CMa>5r7+}@RW8A
z%8jOb;uc8>TfeLKu!C)pJ3T8invnumN^b3WYmL)W%?4eo_hd|Ej|j2B32_|0%vEXN
zT2JNQ^&trs1y*P{DST1|^3Apc*pXBFazo4cvHw(3LmxR{zPouJ`#k5o+dy|3W(Zqw
z=6p)aHG>TWx?^L4<CVw?+ACx6g!5d$^KZ}N=h{DX6U2gs#9W(1V#Y5J$i%y*6^LJ2
z-POKy>ZS6jurlDmLF3`dW2`V|Do&!N59zN0(zlkY;yiebkY4k2kF0G7fqbdnnlffY
z67s{M=TD75<236nOJGB6CNm<yfT!BY@g&vvWv+jzl@U$-M!sIrR?5`mjL%_O*ZI*B
z$&M;JHeWXILH(U^PkwSP8HTr>w^_~Vw11WJU{?bE7zxeYLf(Fs5^@ah5Vxh()V>mD
zceR*56Qmoevdg;I9oo{}!X^#R-JpQp*QQXnNr00zBk;5AB=FAy0ps0*f`eibOOOB_
z+At!8iV%qXZZMG#D!R#8{i@*y%{ECWKyuhkV1u}@+c8W^km+0GONnPRfdzc!@N8co
zR<s&N_Nh?xW;Vhi5r8u$y-N)%_-k)LXxw;K6=XNEI0GX|wgRqOG#sagkR~T-SytA&
z8k0{}poset^;nY0-2#b&I6Duz`9I0Z;`9I=_O*MXUG+&)`t9Ctr_+8Np1|k5ttxZb
z3iweW5sIAAQIEVDNMgb0h4w-8gfmz^i;hw1bymBj|1y?NE;7wSw*0)EDDb=U0b*bj
zk^LgB*+~b#;e}k2$5`1_yAnHf&)^N|l<7)PXR8G{#^dFpau#QJCSW|(?iEP>>sa|<
z3m11GQy<kJ7`LxY#oYYZ&?yT46aSl)iuh#Jls|-@z>^Y4%ZTH8YtQG-4<7@0F~Gi9
zf4a-AaJX;t2*it=8OALjd0-Ox_yvUm4GKi8lPR$2C}X@A$<j>hnCF4)DFtS5*;RE^
zU4YNG3z6F3#R9Mp5cL-bo{U~ijakf((UBhc0<p>a#)23gDe~{(tLQPfay~#BtmaeZ
ze#Z(t%l>7gtkWD@tXAiYXys?yk;3u(xwtf;!Q>U4oQF|yHW28AC&#hq3F24#J(hQ7
z^z%SWcn8^mk6>>xm9n#_Sqg8rM235fd{||en*vP+L^LqKin*mNU@EZ4jiY(%KZY<f
z{48r#hp%M#*h=6bDb5K4ydY5$%n=P5U_C~QXXy0>hDIXDogRv){66Chi{@J@ZEOs5
zEDnK}OaX%6?N>S8c^rt`Z;=lTO=5iAak>yobHYY-xyGTV8mgK3MmK&*4=nxIUw$~&
zw)ldgU>w9T9`^m$?Nc_1H4`ECspWcidXD3eTiBTJU%#UTsmo~5zX<T2pG^z7ybKR@
z*SiZf&I8lMjYBt2wLOkzSn@Va^>*WO`{G#+7qOL)u>c3FH9NO&e%|AW8AqG%_ND`u
z?CO<pKB;O0|J4Gde~2YLGSlh~0AEe}ewF?Wh4K1@7PU|eFy7(8@kQKwLhp4x#wAMw
ziRT<MNt5{KkFAq%hn-{^5ylIMeZz&kA!e`Y8$zea_`vlIU2|I%Rs5BFw&Wqj`pSv_
zD%7x1>iQtc?6=szm?3TG`&GVs^WzrCMMjG!o%6pusgpoc3*UxlAGG;}7Ld5B>sM(5
z3RESadWRzA1TAzQ(sq9bDWgo#IgO}5$aE%irqv4ive~@<U?MiEXDQP`Nm}|OMKA+7
zS&hraN$!Ye-kf^$*VmepEU29b14Q1Y9(Re0yKKXKs+mR!)2h!O)PQrgrTwqePcvf`
zZ*)Y&OSl3HpEs7vzqkl>t4v0LI4?us!I{B*LC13?%+rpPZazw4MXc>utTL_4q<`Pw
z9EZwqlP2T?rm+dIu>gOY^5YtXWS0R!1yku_i5!s~w))6>GuEr-6c?L7QwutD6-Cjy
zn|*P91TIjG_WQ@}OBDv41>r9{p%Ov)2QwmUMQrPer9mXV)>wR^P`w`#12T@XjU(Qk
zvng8Uajx7Wv&?nP#;f>|+1xWYR47f!lU^w>I1h@Y8lr<KK-oeg?R*s~Ji7=|7(DN3
zAhdzJjvLOFfZokLwLzW8mM+)2Y$@rDyk+8z3P2`pz5d6MschHvnVx@jftN6Zt2WYO
z!#`k^3g75eoTywKbp)cC*h&VUpLZ8*UCMUo|6XY?d3t9xx>tn##npSE-WSyj(s{u|
z4;uBPyoC}yVf@zFo=V>H++)l=kZ-sz-Io_++?eCI`p$M;#3oGn_Gb*>>yY1;cDrj~
zL;M|WU4r(*r}r&zEuH$#T=B^KFB9eW8VRHqD1edU+gIIlX6W$xo!)o5Tz?Q|xutK8
z=dMGQp6X76$QNFkMZ7;giZ(=xg5kf@AaRd;liw_!#ie=(#77ulWL?G0(N&|FMsHru
zODN}uD+4XpqX3CpZU{@ZQ>EWb{N=j8`W;t`OX%4PIX5!;A>RF*XLTA%LN0y>k!q;O
z2R9D2v(jKEDe8@F=;dVC>WHK@mZ0;6hk@j0r}0ikqj)tM2<wr7<H=*N#ms1ykIBd!
z$QKIsss(iQq0wT@uS4PZ2_y07H7-Cg4JAn)qG7QGpRe}Rs0g@Ftp1K`mG5i_Z|tlg
zbnp>sn0MmD0F@kN?}Vc*;ZOTZAW%`b+c7}{9Gk*3Xd8mxhlMdSzE~V{{q`wZk4QDP
zyE+*7l-JTqLbv!*q)M(zNQa>St`y&r9(GC_Xlo+2qP2Q!(}99%Uio^@a&Ox%G+kR0
z``X#+6JP%hs7_cwAK#aMTosXlF6d1iyVw@d4#}Q~=}n3@V3~ak{$(oy*>ZH+I-H3y
znggf1_=FJ0bbe*&xE*Mng=`}mn?QcEK*wJ>Ixqm&Lra%npUQ3;DSo}!Yw~a3BEQHM
z!J;u1NCz2#CwA>pyG$N#gc>B7uLd%sZe9BM!z6%(y^7<>qp!;z9ek`+(Ja={?W|v7
zu3(+_OP^cFL>O*_D8A);lSN%uiia*%S*`1KZoDK;J9F(GTH`cn!7Dxdrt)V{k{mcH
zm>rb89!o$rM3>x(Af_ek4pll~iQzGqz?k#Xg-Rg7rEqtt^f`J032<5(bLm%#-N=vW
z%)T42Y0)3k@9>Xh7BKuN!;D_e45hKBfPFZ7vQj<V95`qep#U$ak(E%1u*;ESA(twe
z@QfY{kom4^zj_&)IiJdKKD8?@=Gb{Q6Hf@4;}cMw6#vg0AuZ(knWnhG+`fu54f$8m
z+zfl6T#jue!^<kVMf7oj5yh4@O({ZuRpJMr_ta)p8P8xLU}F%sP?$l?JvMEvV^Rn|
zuf)0oQTJ_OL4PFe4MDg=s`8&NN|>NvgiUEv+RdsZ;yqhGD`KU=Zi=aGk*g{r#(e}#
zc2=cXr#eA?LPg$T>~n0q%Zi+vl}B(1LT|~59Ih$M4^(Lo@lre(JjUk4$v;y1<Y8Oy
z?r7WRoyGj1nZmf_+>WMRL<E-P2Fg!to~rFH$LddmK59BsIF1ew%Utsz?08=!Xaz0V
zulA4`IP*~jsdjx#l7Z|1Dfm3Nr()VX-n5^fvw2^?%Rf=`X!vttfAer{gUaO38yK2N
zG1unBN{1Mnn_oyk$F8HJ@2XLPBg1>Wau`v%!=Sv-$IaG#b{KWPcVvDI|Ftv-ev6vB
zCegvDQeMB<8tO6M^%_Y=s=->63L2<_*4K!WaZ-KQ;(2zb{S{sNrkk5U%7qx<kJ^{~
z{J5zV>7OJEF)a^#j|qzz-!*c**=!Sk&jh63nB;mecxo~&{HTo)r^E%89u$hs(+%!O
zHKc0vG~e|pdmO3r*sES@dHNj*wGhDsCCpRgg=0WbY>7Z&iAq$g9&}(y2jBol)o*6w
zSp>~FP+t&%YJ(^AI6t>_5%KqoA{WVBv$77cwQpZ)5=c3$luONSExJ*bsgfabo=S9Y
zZ2btrdP^PU+Qj`S&~S(!)+))=uXT@KQvy`%P@)q(s=JFHW=PF9Z!z;XJHk!M+HZV)
zgH|ClNBx_o(u*`-@TK3d3@JK1EYzfv*9QAwolxd$QGb5<6iCJ@KsKd?C*@==X|ZqG
zIpY^Ruwk>l;GbvQ$49!&BN}v5aA<7i<^OU-uWswv@*cLo@%bjY2^}&wTqp<oERAyK
zZoSxU?{QE*Q%w5V9FKHir2`cR5J*!*pkdc@Is_1;Ok-S^k}IjRT0Ip#+w2iDs4QTH
zE!jUo9IF|;ARx5B>hR8>R_hqn)=GL;(uvhEMb=}<AVFanxjs?Ba;%+OW-(kC5UtO&
zqOuvTcpKJyd>W3YSlUh)`fMek?!4a?(tDxjBB&ne@NfG>gW+AciMb@Fu{Hba3#5Cy
z62E_jJqSUM#@%Biu~uJ~e7x<&(~KZ5Kmo=R7K++ThtuBnM$d&D(w^Zhg;?fIKN??B
zU7bexqm@9Dj8K6JD9LhN?Cg|H1QHJCO!@7ihClG{9V8OdWn>FYBAHim6dzoOE^CIe
z6(9qT4D&u9{I@^))c1r7>H=&pK}|JDU#*yDV+afQs$GViAYwi_%KXMpyr5u-I+X-n
z;Pqgp8gXa2RbYuEN-m@}{MVxkEC7N2j#dUFY4rB@%eyqQdX)rv?Z<DwhZuTZy^yw%
z6}TZ%MHQToO+KRuglf~dBTK{eDJdPb@90zC)IEk#aur-tl81AOs#vp>f+X+(o%R;K
zC}!(@FecTqc+@tepJu#Yhw!Vz;g&=8ziZ}#u=RUWO{TP&^Rln{4}M}$fJ>LQ1ODD@
zwj{&H8+CD9K<8n+fbRMVh+tt}J|w1l5>SvHGxk$F3i-ilfgvCECl5NB5+q4>4?cBA
z`U{%Nd8k2Azi=h@!agaG@B}RR=`dV)lNd=+@*T6d=ry2#(yE@YgG0vOibP4TkFfFY
zgzHuE^oqAj8!jD1q?An^cf>rF6xbn(O%-WT7jDFi<Hd^Pdl6Z9U~(wvMJMuDbo8gv
zd#Ce}Pm+ftqARTkMdFyi++V%B^K^27Idb@@G4fX{{OA4Cj%&Mll2u~)o~?}C6B{=+
zgJy>$X^5BDz^|QrpZ1|3WE)d;tY81tlE>P%hM`ld=c%&u`;)KvZy{?$LSZLE702f~
z!{6}0&mVdmBIj~=0^CR{Da+;cA(1IlMsdVgxD1UcV904elLLjuCa+6gedCXlw*JMf
z%PAds42)%my<c^^r979W0|mEfq&?oR{}A$2DIkA=oA*+6w0_z%*l0ZqVwrD{C4p!>
ze^d1Gb(SQ`<Q4YY3AAFpNR5|$97btS_*g77;s_u3CBGLAu<CZCTIk#92%;E<uG!#z
zC8W*ZSL-scP~L4=5+kom4n_HoV$?m{G<$1-t76l($@c-U557XfXzd~3n4B_=@L>0a
z6~wdXfhGo)>>G^HOCd<Z_#L~XV#`D?=Zx~lVeYF8T-y_4I9<qj5|`f+6LdydG!1ZI
zfDSZ6Ok20-_m`WRo|ETqt4zdS1IT(DX!YB)3)6qvG7uqW#5pOveV%4}ao*#Ix1s;e
zWFa_g05Rwq!yB3<j8X-6>vQG2PJ4;W8h6k)Jtw@s<UM9z^m%O9w<*`jRtT2>K(%O1
z7$Zg!@dmoe`BB6OyJPM%k}MSnohILUfvtNCAausQeka3ii2n15CK0N4@V47+J?Mx`
z{Hl-Uy@=$$VqdcOu0N3B>8PJ936TPg0hIkBQdV;XPfYD--iZ`U2(T=3k(ei|PQL7k
zb&`T0uASo;$ri>UIy1Z>7PgZtv{L$}D&<PhX0)43S{wlhz|-hxo32R{cNN?MlMn-R
zE~R<h%dnE(2dPc8VEBX}0(Ofnr@Q=vDexHyH9sp{j3Jh99*(cEjA=$>q3S9_atb#n
zbjs^cefI0v=NER-O@&^MPvWNRs}I#YDOc~+O<X|15C}UVv7r}yd>w81h><eZr0{k(
zQSHK9_7=vmtBTKd83r%;DHtutRpAaEqVh>H%ua)P_49M_WP5}eM;txDNKb>}f6fW>
zn%xnDQl}QUR($g+JQXSHc+(`%R+9&dONg=tc4R56m#>)U!R}K&;_QK5K$+U*yZQ;=
zMZo~{rM#zW_>DC$YdH~Zp&K%R`}gocqE5!Uvh5XOrXuaYmmt}82MkE=7A=O)f4N6&
zB6XhojWthpP}H&UXA-v)bK7X4uMI0>9u@e>G&ag3m@xYBDb37Va_R*k#x-9qZ>9g(
zLEw{nV6t8XRXk)_qcHYaRWS2;GEz_cQ%JP5J-M%be*TJxT*BHtD*KVBxM;$Up0|<^
zsBSmQw+(z`n3P=0lydNmL%Mxm#{9CX23wczK4Cx;8{)*UYrr4*Ph=guH?T~H*rdXR
zAQ;<?y4-+@K%D(HCtEyOMH5vC3&<!ukuQ`qf9?E6Gso`n)?Y#F4gAB?W8VXl(?$kG
zNbXLhr3R+Tzsfg2z*7_})a0pH!%F?A&^QF${TWPNN)VK6Kb}UwI&-&DV4zZ8w#zVT
z1^`D2WznqRsx5B^UnytX#J)ct*5J#ky3ti0y#(dnnAP5={rwjqY(eYir|?X&!j&uX
zO%y%2@oouf?|F(Zb4_!-T4tv&Rk)68<p7gf$G6b)?^S3pfkgyLaH_PRV0ScNcu-mn
z73-}XIa^tS;cNK6#|40hxS%i&?Lk`^obRTJV+&F1Y*5cWhWl_=kv5j@Gh*fFqyRuh
zzI@$gP&EZ<A$de2db*pRP6<czQA59>bam*sqvj~JE<`f?GdS3!$K!BzQ|+VzBAe+k
z*;TLHiO?nS41Pa=Qs)}@wB-kg9=&D}n7#5uw!_syN)!fX;6IfQ*z&C^T&^KX)B!%K
zRdH;i$J%8(R?g6<_4}k75kA04mqKV|Dt_%UNrRI#fiJRt&IPc#FK>Uj2;xG1mX2(z
zm9$_NlDp|Gx?J!d&aTvB9{HC>NWkHJO72H9qaqY4_a{nNfdaxLSh3e?bv^8-N*|NV
zN$D?RVwA7m1LY%@x7WO#1ok4MWnUReRV<+lqGUfkTH)i-3!wpmNFiUX3%)WSP=Z`3
zdTU*h=yyoby}3uU&Kh<Eh)F4eaW5TVFn7))ix(fE2J?XY+R3-ocNc{MW2j}~W&NDp
zyGXX;Y*Zf7#=QgS*;cXk@|GT~vKZ)5EFsc$n4%BT;ms{C@VmaFohTp7)9*i{e>B{R
zWa$P2o;4>9b7|c(sF6R)peJ}R{s4pehzyR>r6&dHjuoQ|7%72?OeNr4X~uG98GqzX
zrHzL=i@u);_h*i6Tb)}|opkeZKg1OQOZ!NA7X40|&Mw;+O>ZdVcU(logYQ~MWJ565
zEgr4;e+KE4z5*r^KZZC|7)V(^`X}`|qnVOc5FqKjP5$W5ZCNRYB_#1Vy4dbsyjof>
z9mqQ)o(V~NV=AM&`qeSt^3HE-?IqllD3X0Wa%3yN-2R|=7+sXY)x1C~;EF&XuL~gn
zPAQs*l?$b77eX^QxD+8RH52<n2Y2(o-SkA<TtbNtmBQntpH`@gtcP*64CSBNgN3-k
zbzzd#l9m%G>3W6-b3wPNgVI=cKh989A?k(X`Y_ezW0PSKJShW|<1>uMr+qY0^7^Xv
z$7`y2lI8Ys3k^C=qbJGc9L=wH`N{i&4g0-aND|GkfEIJ?Z8yj<@L-7u>UTrYTET%a
zJ#~}Q1$V0Y6^(_S+)h#*8OHvgybrop7vXuzZ4)W1Ui(5AA5Yf#jVJ87c_3PCM*{P>
z8jXg&si&3F;6iJb=2(3CchZoTk`DhF9AJs~+xv9kuM<>uAMr^8+rKZe#|w2v#yzCT
z86Qu!u!UZErm)Lu)xndM?OHlibp6`;Gq@pn<vw3Gc{uEkX`fP7(DPusG{aR#z@4Z>
z3h$z|RpTdGV0vt<VRuvof8^T@{>E@}tE;7LEG$Y9(23He2MUfyuyNC0-QbT)NKm+l
zOLo}MZWh^Z^FW4OxT{pFd?EA6qB^G`f#)$Zy!}wt{ctB{65dU+DWOIl3NY{yhhI#a
zLNm0MBHq|GlVT5ZvDvTpP$sTRMNXh6JqYw$Ci_N~zE!T!-az$2IJGL1KRYZ+Dvl0w
ze{W766iTHlZ{I;JZ7)HcYtFmL8qGt3=FiFKO8E~}m!ptSJ+L)sup*ToW8?DIWzrea
zUMZ_=fp3>%mp&G#-1(qL5~z-Uw|*M!a3?Fo5TH&1n27H94k)C2_@J}kP<>`lJ|iN~
zdMqE>sZ0*AYCr;wCKXw_!Cv0k_4A$^x5MZogWgQ-;Xi%p56nG^c6lGmvA~pB1b&3-
zAB~5=JYsc13u8v#l-7Hmq)T1_+&+=Z!#QF(XrQwQc{QSqNmydUS}G2`)OCp5)!r7p
z3@0FF`Ijdr&%Kb8u_!HUPVo5O9sqSS54=A8wi3B6Vx`>=!g|d_Bgh(=4n)8kUv1=B
zzVz>*O?3%f{=)Z#@VEtoIr^$%-P@X|n0;AW7clX%>Y+ob$1~1_8}JF2yC6Ql8^Y)%
zm2WTYakqsn6%i+Y^qVBb4K+Tc$vTDqGXKWqvCYk*`yn;6JKPlzvEuLyAlh5tc@r;T
z)Tpc0$o!LrA|bVIF~(S8)LwBl4+aY7x!ni3mS(=FnQ9PO0MD7Bs-3h|0#}A9uV!$)
zic3(U16&&7-y)dEPtC?5rB#`QP~<cTJ4>)Tv{>+xNRv|H?*MS(K3{vHf?)~PP=vT^
zP~^Cn+|CDGygd;QjEXCbwsI;UU#-Uyc>p?nL8!2rvDF3Ljzusg@}#eFCrQv4LGX<A
z3{CQ(_MuWUxgpcwh=hd0LidngkwK;!6@1=sk8i~kl&^<P{XR|MT4cDMPhP5GD+W?Y
zGd{iFjj=}~32d?8G4qFNaWjnX%CW1m_b_a2-nprUUC1$u<NjN7m9pd>;ACnuhDq-A
zmvXlV``&ixlzLU2k%bPES}ElAQ=?yExM#H;VZBCEXwnDy;?d>pwe9V9Hx(jj-aFDt
zwSvH~^=V(n+piQn^f7yw&ZP?FDYXN?iOhun!C94VZH<z6D*G$&Ihv#xo$$P3DeDVq
z7qqdj`bBl37(i@F)%(zx?z<t~eBfz)1nxuLIhod6#pm^bkUzo4>2k-FbU-iaBgS)n
zfUUkxbh6lY91eiCqUO}Xvzc^E=<Jm2QJ(uo0?>b{^D}3-)icJ_)f%>Gx;%jg$_2e;
zhVF%iEIKPsHJ!bzGS3CaBfiRNP7J>DM@+RGJ#EtW1WY_FmHSe|2hIbZDly={xt*cW
zE;p!^Jj@wLP%Ca)8pdQNl0MYTJAblIom)*6%IoNTKsJgOc32iDS4n#fBd{ebPJbBp
zQnfu#W3U{Q#tHhu<^|fIzDwJ7*M(I5nd9BL^v19INFSti!3wh^8yptbB4Zui9Ju79
z=G<43*TxhK1u)_`#yi*Pk#(l=>mjVtt?2vAHXK*<m3ZZZkiuXIA#qR%C^0_rthtdd
z*Dw7j(BwM>{r<wKtkg;nqCBv!&`Ko%1j8vv^XzrP!*f&BQhq%UBDlP^^xG#@wgP6d
zySO?@6*h`dgTr1R!#Kh+zG#{ZYSJv|+3sz&lTJEr6zL(=oAm=DTV=ge?aMJnei=<~
zirvCmg%NCTc@&^-0?8xmQ}w2T^aHqqZN2I{L<|fFy-U7j*ktOM2?9MM(q<$Lxc%{{
z?lBcO>bi3ZpVfd9mZbbFIq&HpqHc5sGgZUYD+*J@(1CmZ#XI%66bqdi2GEi|g15qB
zm$m(@_I0|Ql(KjEEV0X{T#ebDLxM@$>PzFducOqa{0Prs9NX984Ynyt)M6>|>~+>=
ziVrLKE7G2hF~Q#O#+jQM6R=RhYm+T`cJ1{^v`c5mpW_)z>`gA9M28BA9U5;5$kQ)R
zJ?aUlcw=LtTd^=~OXeS|6H4IN`jI64mfGU2mtXCc5cOK#&$pooK_C0S#NSs6RuCM@
zS|5PH+bo^YrG^)1{dE-r)&95I3Q?5vvT<cpNTX`w(^%_>-TMH5zVaaYxb1DGdD7g5
zsCsRYqQ--x*Dh9~kW`Y=OR8v^z45Q<tMwiVH{t2l`!D8539ut?2IVExw40H@^L>xw
zy&PtGJ*El1c+B9mI6~s@d!cwns#tq=Z4Ds!ebA7}*e1rk4k?*PzdhpKUP1n#vL?Ui
z0H?;xwOHzZnik~|uqx(Hhd1|beEo2T#o`DdGmDu|>h?P;yCzN_KLqXl+QbzLZtP)~
zh;xtNyc3`_fIRs4GBVLH&<4Ho;41~Z%Wp-dxmLP~;6XgY2)0bEa9{qCM=(EA*o(23
zp<b$E!i(uH`{qy>-B)7NZC-Ew4p3prvrSWyF^P1pp8xK#>EDd_ePz!cD9D|aj9C6R
zIeyd|YX$#TBY!w~;I85t7xfo4-gy1LyDvgu-aVe8KbsZ4#gQt9^763y`pch9yngM8
z+XNgd48}fwY-OfSbNotdCG3ZR`$x+XB#RcPWR|JE`F&t!RUZl9_Pj`1&VY_869;9-
zi+;SV6OZPMuf!;|(v<<_1XHQ#N+l=6gVB1eE?Dg-$ogo5%|y*rk;*koN(eW(8s4)K
zAHshm9Dg!%ZrFL4h+cC5>Rd(tcDxlF9+S%^1s_CD-9WBoNl+tG*^a`p4^@1XZD>Nf
zN9Bo^K$OUQEtK+=`80#&5(S&k=zam^-Yyq=!nIrruP#{$T`DKMGxo=ecMWd{!`x{7
zYup4Zkp7tWsp2hmR9ivYDIs_u$MoNAm@2ApqF}f$(C6<VU?mj=^k-4$6+*_0n5OFf
zQ|~qZq-=|<Fm#!QQ|rH-|IdY+ABEX?#O6JpE><i6lf6~xcT@T?K)zO_kZaljt26Dt
zOF`6d<G}F#1LMCnMg}7ZV=lkBbIG7|$q3}NV|#okrx87uzI4-I7t$`t2!P6`pI(YU
z*@2M82+5zNHU@=A(_W$>#PxWfDxL!Z20V&}6FkB(<rZG^s?9#Mr~nrvb5)#y@DW>M
zSuuP7>#dNF0qA8j^qN$`R14TLW}2PWq=pplXAjE@^;NZB82!By`Xl!kNj<MIp@42G
z+%0g4lwF}xi^dyK)t$P-`MsB1my`USIm->>lDv?{zq67pT6T5%)LFkydqbB-1QoK+
zaTz3I_-Y6?h;Di(1Nx3G8(dc9iE&0!G7qD<itFo>Jth5;@!0|UO$M?i4exD!wR2u4
zz^;beqzkVqHAmlHe22;y-KlKh*u5kfSlXtR9-=|`XhFafR`esgoLn4=hHOblDd173
z1g8d4zFGzz3YD<SE)Bt-FT&uO|05w$U;jWnI>$IL7%gFK<wELDX^JSW5y%cRM~j8j
zWFF@=OinLVYfRQ#3Jfk)GMra0!`8+69*aIa`psm{fyrCqiaeH=095jk6PyGEq=YXB
z+@k80F3&(Tj1EMRoIUYyh-?P&;z*d+hcpLd`Bm7gig_?^w;dRLn_suGbcNp4Be~F8
z0SUFaFvaa6ARUl5zC6(XC{R1sGlX<)H!gancIfdj5Yl)eZ-6JIz<eVFmU0|1FGO%t
zX(A?>V*%?aQ`D0UOT*5LSlH*MOhe*Tt(9zvk^rhBXwaYr?ea&MizPv*xo~NqmmYw>
zRlF1gEemO8MJ<zNfMs5+G{Rom1SdBKow8gZ!Z=E6h=jVqF2~wMDa@&h%2=tr{By4T
zg2nBP!iP_mpujNGj&CK23av0}<CU4x@gbElJ-j>O9}9n0U*5rh09_Byo<DK<jSN)N
zzpr(kTps&0qw0T-d4K^e>(#~Syr+5$#e&%Yn*5@OjwxmvZE2zRO_VhTP}a_-IPNMt
zp~4IynUfVX9hN?B0<<u|E4y`QV_G6aK_u6#Atg_(7|<}S)>%J2{arjS;#|HIvG_Nh
z1QXQts!WZBG95sdqGP#t2Lm*LRq%hR)h@6>2kU0DP(r(CR<uk%ykcyH@?amTk3G*5
zFgrpn8n_9je~27AY|~|2D9FA+n>V6_x>ltMCaH!LzpGRs$nwBt?XjRQ+dF2$H<d+^
zb+32UQznlN#wm7o0xQBt1kW)4PPQ-TzCI_O2#{-82kBKqZ$|V8s|p1qmB#?W+^+{T
zv;CSQPogN;9O{Z68!!3miTIRKVM`r@yV>4q3l~`fT9Vb8Yg=flL%*mqB!?f6xd;yi
zCZP1Geu)OQ7SDGCR4-@?0|n!sbbPw-R$%w1)-R(SgVh`rnH$T7(yKu-DWlg3610JW
zb{sawkY=mq`No1hw`}d#;F<SP=D>fo0B8_yZ*#5nEj2+AQxrI-dff&7U|K->d8q)3
zsw4TJQL6N&Ub8{c9XiO1KY}B5K3<>p?MxbjZ@lK%Rz@Rf9%v=ES%Lo^0+_(f&s=Pa
zQHv7r%o|{jJz)>N(haZ|Q99j#9AsbT<aOY*UZ0{+iUIE*54Ec5Mvn4F5Uq)xKI+#L
zARh3>lf^u5c;i8Q-%RG+c?Jzvfv<ucp(hXP$ebL>=%MKnsez*`Di4+NXCCfJL16Kb
zx-U)yc2%wcg(ZG9ag1G!3&9SyICFpK@695TOm25QOCzMyr_jh(kA2p*>NF6M;BQO~
zFccOfl?v-7L?*-|+uHecApF#-!N%W$W$!zH=Y|Tz^@Z|Ru83!${9F-nnf{giC6RS<
z`TeJjAG|GBy3T<*Lo|18neDfjyjK>&y$KyiF^vX8I|6kD^vhk!%OQYhAYXuNhA2ky
zCjgg8vs}5=9-YLkVD2*&Cv+QHW4d)!lV|UWWhZ}){LZ+h_)A_jZrzdyPUjTKYuo(<
zj(dJ6k?#j_x#l*GY5}%W%M=0#rzCv%wYLJJ5>|J~sq@D-WiC53Vy7?cUz!&Ku(03v
zpgBqZF%jy);s8X{4(K6{BztAv0Pe&)$+C8o>));7`_|sF(cqiL+L!RlMvqA<3um*-
z+68e$=@5l6uPY5f48iI!(eBHfHo{C3ifI^OXA>QKg$l=}Clw;~3q$el(8Mu*I@Eo%
zT-nLm%nJ-ho*I3!1^F21{43)6E-ys8(b)t5)>#k$jNF%+f8K8mU&;@PI67GsXp-VK
zQS*eT@3Su4_;mlRNqq46_b*Nov5>Gh^Z}IK*MSw3Eh`$T3>=MMB1T`ErKFlY@3j1o
z))<ZJV(QD?E#+&0s2rjv>i1i7IS3}QV_D6Nj!hY0dO!cfT5;Bhk;F_vg5@YtqZyg`
zAo@U1$t@p%5r-S>f6ut7f13PIuNEfGUi3@(RWC(J9aJutNoesqfEA{bt7a|fZy+?_
z!^UN+BEZX^`C|*BiPTckvZt4wmE2NBxk51=!D&C^yN&#J{dQa2>J9fsFh;130lGKt
z9Dxqz**(Q7oj3!tz0XEV0b65|<ipHn)ay^|n=lE$h3@Jn#yI%+SDxtOlNo$e1>K;F
z6q_}UU&8#aTS}|*<$+w~J<Y7(N8NloKaHBe&LT%9yX3KNLm$I~0S3L?n3z<aDo*UP
zblqW|PMMN%yfNQ#)@s)-kN6j64qR+NCedb&72(UKCR;@1q{rkgIe%7-Qa(}M0uGic
zgrYxyhk<g9Ovd|2uubVFVOm2&d2zX^jCTy{{~TnLjEGT{4)Dak{0GLUF{QHVU$EP0
z(Q}kGyoT8YZLe8y1ggJ~O2Glg?YdmMo;QnIp{1__Gx+)xK!iyD$~dZq+7HOZZnhBL
z9=QxEc^0V2_(AbP+fPRC`%)pmmVK>tHq?<?_l_J?%h!B%Ht3mN+;j);$+jMEs4#?a
zfQaDYnvrbtYFe)rg9?zjZfnKcpG(^<s51Rl%)29N`9)-u5%t-qt3Gr)_8*3s0Ec@|
z`)ms3Aa72mQ#wVaI6uK+8U$9%4NcskJw0LN8XBuQilhR$y%@o6?Ug4;ZQnO_U<Il=
znY%i41mqEcVim?TsVXIMea{(HVW^w;A<kX%O{jrKc{-)b?f#AXay<xG$rVSfih&13
zw#Gd&RkLAosjY=cC6_0IbBH<vcqzHs8g9TeF8HI>9=ZLU0XEH$T7-!+FXS(EU2`>W
zX0*K$TRt{S84-&IWeSTzT@bOj&cwz)@m8Ts^z&ocWRYoy*Qfgm^-cd=wPg2i0(#?#
z6XQ%JZrfDjCLGxvGqD^g|EImT{EDjy_Hbv0A-KD{yE{yP;4Z;}1_>Sr7Th5T8XSTK
zC%C)2hv4qPHMrc(d(OJ+-v8mS_}V>t*Y2*au72v*cpy{{A)b*Ui*KA3KkMksBVLV|
zdJ`lnJsRW<YbhGiDH~fnLZ^y(yr*?7EZoGsaH<AXi>ion+q58(N>U)s_CLdQF22e-
z2jUr4588Pnf`j|ROeJK38Al&w20s&7z=N>ajre7WBw6#BcF!I796XHK{?yvlNoopd
zREh@OEd|y=65+~IXH8_nNz81hCR=h+EpPHju9=S2vuhGtjO+T1qD^G8${ygDg>-FW
zI}SA<pHh^bgYS?wUof}$Pd@Wtf347-Nb6+yhF_$;PVF+BCteO!+w2LXBkvaXew<~#
z#L(U}r>y$xIpWfqx$e$$w<Chyx5iQSesDfCieKZgI1Mkkh>Gi?krc)<zbrxW65tbr
zNbO!PukmMpKhD8}2ayE%dtpLJ$?R0XH7ea&sX$Vfa>uhBBdgwALmk@l7;36?RH{ft
z7`|e<qaSUxlpGy4<1l%_en(DawYe>6*zXWAey-*D4cdWwRb~bFm=M;n<2Pa{UsL~S
zlY&gxPFN&4c|$Sp`yoxt3?a$UwY;_WnX^FcG^y;>pB06K6xx1ch|f{ro9o73rd<b5
zHZvuoMnSv5Oj`?F)AzIA^nbcMVR|NeYt}+|k_?AZKB%(^ES&c|<};1$6aA*nytbgg
zLjY-1FVFM8LZdc!F9cf{VArDvH6u)>op%w;AyKxIUw<VT3%?aXkPq0E?JI~<3bL=d
zy-`zZ^I_$VkX%DdbV$sGR-8+I^sp2|y>7>XKwooJ;<V?TIr!WiE1+p$gXCz`2KSt`
zoP`TCf;K*h`AzEG?upG0#Fi;!#+tY?SiX<a0sOai!2hCdg@Kl}%)P9`$2J3N+g$pk
zCg0z}Lv*M)({r>=+RNw1s*c*Fb};jtf3h8VM|6|ou`{E9__cB_I8i#H)l79s%?X#5
zN(8ue9GQLiM0ijp%e`^{$50{+t>~t=o$q_dNKZ8?jDk<FuAQkP>wCw35aQj;E$`xr
ziHO*z>K<1_qP<||$|@F4M8D03hlIy*n1&qE<?*u8;(s2*SJlJ^$+3|Tdz}`X$};~|
z>-mcqoxa7N>&UV3Cr33qI5kH-WV@$;ESjvF_&1p;m+pcdP{%-WeJv(;yg;Yq7FTLO
z*)fmEY9RjWd+h(F9hog;bl(c-4^n6WoRfY+G?1#a#+~_Oo>16Wj2h8EYN07a@v+Le
zG&z9l_?uvTLt{NM*~Lz?>z)DRM6immwCt)#7d_tiiMN#G2Fx-B8<8n>YfXjI?Pkmy
zEYcNzLOM>!Nt?yBvZo#2Umr=<mE&hxX3G`@nT)fo^pTnyN3zlUq!B_zPKP`kOyGTt
zmyGqv!3-X(N_7QteJ#b<A2A<QS^w--&4q4jO@AL{GH&(u*WUaQcI^9SRxAciD?t6n
zBiQ&EL7UPvE@?xL&NiF0K;HqnZ5ZY1x4nHmjR2x_+)eb6=e)LgIJ3nfMND89`|?^$
zEf2<o()-pSKf-oe3yvCt461&(*VpBBvN{03lQ@Va!bxbg$)AXMZmbKDsvIfpsA>LS
zuh|Jh{6E`-47G8m>|$~Hs?;vY4aSM|CG&it>udeBz`+Lg=fxiUP(V$j{0b~m$S=%&
zF6cG9cXnmoTr<GoW`U4DJ=R;3dQMTo4JRK1fo!1DS}gwsO8Rvue~Dt1KOauHje8Yz
zMom%rUtK53a*^sdZKeU07W^cdZhy8CPu96)k3m`QFQ8AIO7C-cq*X)I?7{w*2zh}V
zT?C!1#LH}$6EV7Q$6<lZzbRNEO+iSAGm*5-B#oyIF2sFL5)y2OD5q%j?Kefpg_&z5
zKM&yh`O!^8_#S2RJaIw7<naC#_9;=LSZk6>%zp%iF|66bW<dU?7!?WS&wQ*BO5grr
zVHW36JT&z#>PAH_6M9D@Qc@G#F`SaCe8&Ap@s@i`M|j-5%$x>y7s-Wnp>wMif#&_a
z$zLHtj;Hb~NBndwc!-D0vj4k09<6&xk;FT?yO*;P4Xd%}6%g#MK3nvN=VmJEv5BM`
z=T2V;FpSz!Q~L0`=n=zh3H@oe@1kf>=sg_I+|Mo?7Q=Df!O;8_M%iKivXP3w`t^|L
zdo7i-6TK+XCi*34jdv~xDHX)_+Bm#&J^$zE-7M+wLKvFE;qQEK;6DVAnwh&Lac`)%
zf2pf5j>3GPSm;%%$3U@|TAV4b4L7R}OG0i)Oowg7XFLVhc5{zo6y0(^@<C5@f@2YS
zg7cGPnuu4tdzHZ~bzG?8OHvy6<fvY2EPfIX|FSUel;}%nvrJRIm%ePGefH&--g}ks
z@*!89E*fki@vFZnT7B}kd2vo3+IKBOB`e6gFVX*&+QwGX4xzumf_+?cN(e6kTUp+a
zaexU1+v&b{zoi!cOjq|jNR;;y5Js@BKTZ@mHjZHUd82>`i34>*J6J&l!v82p^bQjV
zHRW=reM{T_N9Q1-!rCB_qMi2lYbdoGNR0Gt7Fg}4&1}V!1U%9&ox(&Cx6eLkN#BF$
zImOR?B)rc!Krz)IvU$hKHcI~)YzfhZ<c!un<=nm!@{c^3_OkeUguube3;A(I>CbnE
z6mnN{cv*Z2i~5Z=p#FVPcJGD*-1gmI1%Mx2^L+1v4s1b`k*^Qds!zM(Ui(jGI#u3!
zjb%v3qLIM|^kq{{@KvtMMFH4ZRy>HgiCkAMH$#gV_aDu#jBAVW<Z<Q%5(m@roTY2&
z_F<oUa?k)*&f&P~O3|x}t3%~F(eiWhIzTBSi??}!qFez^9v^tD*Yu|hc2Xjs#R<^_
z8T0{;`ChCUn*{D|b`<$@#bs&FAFIAvbRfdh6I(Y|)_dl|*ICrmB(kL2hW+^8i{4HP
zfWF(CJ5yOK6u(kD4+lu|)8-%M`(DM%HNuO&;huOBz(V%xJO<9qK6^$a&3^SfaaA1X
zFGeNj)g{2(lyy;9J91GDteh|&q`vimTkCh@^0gx<P6Rpwj_3KoqH!t{>Ndm_boBvC
zUncW)YTTpO>Ad-EIv*;5^Y0AZT3{-exSRKxE=#=v*GXn}G4ES5aFI^g)5N=ZE;cOh
z_`--V-*TD@0I%AH<MA8d0R&%ofCQVd+T#!0Pq>z%?&{0}Ke}d+9h97Ll<VIPKL8lP
zZ|gs$nbG5`Mbi*W+SbBSU$ty@0O;X2t=lHocTiVO*un~s!)d@xSMbYSkYY)CMBfpy
z`0OD}C_)jjtA!&y4d;*c2q7l#SFZHqdkvMW$DI0cw{u%;U)jtZ7d$I4CHdcwH5rBq
zvaAKuRPgMXP8X_WyRb6HvjZ0MKEGjRm~@I66MpXHEb;|`SOhFXo{0P+KF_Q3I?LzB
z*K3y!a@@D<He#6IQ|gT<zuv_JcmXTO!>k9oj}8JDKoCHUPLAmH|37Xc01=eiNg^U;
z_(h_x(YV95uva{%p8cO4Q;_aRqnmg&gbyr(_lZ4S3LrotkUY$arzU>2C}bwsz8S}n
zs$;6(P^d2-lXxHJN~@FD&C3ZmaPrCZ=(F;RVJBMV*{u5e9!Z~J>glH!;UdDr1MOkD
z&j5NL{k22C`xISgIn8|Y!ccs1n@7AajB8q+p9!OE2%fkQ<iDMCWR7w@q?;7Jb?El1
zHC^l2-{GpMHias2c<XXee8?gW1^`CXuVFe~=aFF8uYzawT|cb-2UVGLKLJJo#R>>W
zt@2`6y>%>B5p0ZtOq+Q$QHN@>y@2`ooJss%Y9AO&h)CdgYl_G=+Sy`$fvc(KAOA1q
zR6PHdn&Ttb-=%M)K5{E?n37Wc%O}&;w~O4cwnw>vCvDxvm}THS{?c|l?=*za%uP6@
z7uTA678sj)9_ON>e;+m*RNVNMnIi@aTXj(v7a^PQ)h`OlZZVqW?kIk{SS)ZXyBs1V
zH5d{B!16GLfRMQ)-#T=7uCXV-Boc4uZ1#ld&RUI>05lNc-F%t>Mho_<sM0@!m`3GJ
zM3ghJ9*B<c+$o4RQZT{|!uqmXqv-`R@ka@S*V-mHi$NryHTGYFwa4pR@4-*u`|4-H
zE^Kg|@f$VCu}N{PXVeNSfVZfChm>bu7)#2UrZ%WNZ*Kp8;J1?&7y`&g5lo^WJLK&@
z4v&|E-wgE7q5D5^=%kqd5`bt^x<DJK=<)Vb%V$hISPP!vy;>aiC1R0XM6NmzK<A;n
zBHRo)Ds6|9cqQFub80g&$7)A43APe}Tqo!Q%QF8<<jo<5Gmy@Ty_P+vFnFOye(*V^
zIZ5yRi(3l4JbK-ZBZ&pN9EENz`VK)e$z8H+j&KMB2QAq`cnZ0*7GkNbr73Hmf@x6;
zG#4&&(dNgW<#xn%!VWuza5qHFAHt{u#CX9VuRJm9#T7_=H5t)dfR25#iQh-*(a9Hv
zviMEfOI^$u5Pvce!1&$)kYJb8n)TF~%Hgfju!MG+=-TSAo2#7;J>GHA3nYj%me{mB
zgA3#-fbhh3uIv;Fa>mc9KC+DfLM1^;)Q{S8;UqTkX>!H|k~94lCirWXP%Vao808nJ
z5fKa?WAB-Lwj)bixIKhwwNHK5$?7(O=RV;{7H9+xrU6B;ws1sk5apK_@N%x7T~VQL
zYgk(~3^w@t5Y|Z-w7M~zE~D@=bcq9YBLf91Uy7<-2t&8pjinskxqTG+Tj$vjg+C<R
zw*!}wjRLw0^nbS_`e0k8!U_KV$o^@5a!l=CYhy~obj`Wrpn1n8WQ!w35+KzipfyM8
z0?k$ZA5|Z^C<Kbjw#i!L3h=-0)fF3P<bbnLL35w#XOb7o+ex<r8RGvs3aS#AiGNqf
z-{T|~VIAv1N7=4zcb!xCkKF{Av!|-g2pr@=E<X*Lv!5Cx??~#1FB<IlG9t|+2=><s
z4J-xWKx#x22}Ggx&Pkimt5ax9pz~)3JY-q-6YrV!_{HD<NgdHxf!j*o@gva!!z~MX
zgQvpHryb_RXUlW%$$n2~F7P*of;MHqNq6UJK{NKUUR=%%&sOmR9B7a7s+uC=@vy4i
zc`FXm2+NN06blhPEW4^XZJAIu#`B7sdT~SE!7u`zUZk;@oz;W2zzusIwHEs*^m%aH
z=giLDKP$l*q{tH9Xs#eiu&Kx*Q?gAHDH5T)guk|Wzt0#-x@<L8HR(3L%e&?vi_0NB
ze@Dh7Wys5C#sz!V8g0%9M9-T2At_zdUk-h^dv3zNeT_9VU#&!_nQlJy_?oMTR78^E
zzroF;S;=GKD+KCtL906?JDDjsnK7+ip5|Bg@Xr2U8r&Zf(@u<M9_gikOqf+N<!nmL
z^5GR(6&wu?YOH{(3RSETIbqrmFD*70#H{QD1rH#sX%1~+ejOIvWl=L|QvX(ImT0kk
z@Qga|WgDw1`SO^MfK^J<BRRuRKohSturkhN5F_{<MlBBU<sTKG?&Jd$^nKwV<yCW-
zA=Xh^bURA};g>F0`){Y8CI@3ob4@fq7r??>aY}$2E>>8xKKwzfS*SV)Grl$5sb-+k
z*?YSk2uG{NIk`{lsBGanwSpF-XOV`T4gw(_Mvdr%OxE+P*;?Qr-Gt~{f!CT-hFLq6
zx%k%z2SkAm6=?n66%B@%?-yfpu-sh^_&t7dE8qKCB!)Kn%t)-zp&FqDqSSl;yodDa
zJA@0T;#0?bl6A(49_T+dnLEi;Z~MZ6ST5;>m=guE%qL!vcJ+z%F3I?}<$j$RmZ45j
zaUVS85ZY}9Bi?~1UsGeJ2ZLY^7`!F$Zwri;t3d+=$)UMJ!~azafv`>^I}W<mA{`9(
z$qk8Vp8h>E=RXxR4elJco|Pmn$-M$$=TE0Jq8h-}YK@o7m^`YM1CNquTo*@2x&=A?
zS$x8x2Lsm65GcFsMrK`NOYHNVmEEhG$J{P1#I5aEG|=3BudADVBv5L`7PG~|t8mTg
zpJFQ!z@thJ^(~gv+;e_0vg{gDw^QGxujNv8lT!Hkti<;+f<{Nw)S)Zl`I2wOeA_Yt
zAdvP_vat+^G7dtcyC!qN3d%~k9g$?8>#<qM%1s0C%X6fU?0tZs&TKq~>9CH>-GOm<
zGizMt6d-U_`pvj@TSgcZ^YJLE?y=(OALCPla;<5}?D&bKn4^6w=Ha`8B&d`mC62M0
zqX<Cf0t*)yNM^&YN16^MUc2nQo?jI?^A<EpdSD*%K`_X{VB+PKFnmK&QxfI<lJwf*
z9u1@^Qm(MC#rdZl@T3Q-NQ=;mhi_|oGX%J_!gv^gvj_26z-gKSy#4WAq3`3c%9oK(
z1<hz|^?POnxQ&&FAX+<?Bq5CFR1(}%<RcGEB<3)d_-l3b|BjJRxT!e5s<-jm(Iz8m
zCHR|2IPFh;82WkA;gIchs_t4Nj;0+)I-lDfjT5O1>M(kzYilp2=3t+uRlBGVXSV)D
zrat>~2>scwe3s_=T_ioRk>7biTQ6~SM2Ba8)s=Y=2^UJ%ZiUF=81@g28JgCw8t~18
z0aL%2_18-FZ=fJ-+ue=qI#c7&8F0akf?hNCS&ZiJxVcEKh)a=VjUPDYQPE|Pp%L&q
zj8vz@siDe}Qx$3Pa*M$+3p$J92l#WY$#|k_Nl`Wfy&AjNvxVt>`(qK(DXV6LeJlVH
z@PbuIHe9IDtflpWkSB$9-!s9CF^&a*6SP$h)}FgL49T8gB|69%HD%8m6`$%E*z*3+
zQ}XAHhwy;bW$w94Mym%$n-((ykR0N`yGQg*NqYEWob<Hh_71f7TG<XGI8EMFz*gY0
z7Io*aq{$`bh2S2d@z;NzB|vVqs!kvGtQJLjG`9Gk>LK)T|Inv#^iiVdkF#k;gbO)G
z^F&(Mm8hUClPt%77!&oL<WGXMg+ZFdhPrXhFWa9aPeZ2Nw8poW_x$Ekv1E#kQDZ<D
z0iywTK6RjRA$dJz{w@pwN?4t#dOoBJdnZ1+n}+W>7+$oBAD{&{&AkGB7oVvu*f4gc
z??CMNpk)KKIx%^4j89W~ZqZOTXj&Pv;*hS+`sTV%IS<$vR~}X|i}j%D3}l7AwdDMo
znqay_{e$1Y&poc#XS@qBe)>0B=!!i~GXsVhV@}LpY4+V-BBDJnkAWO<7mZYB%f(d=
zfRvT*xQsYRghp~{0FN3|1@gmqi&jH__Hq6{vhE!U?5>XVUODsPqT{H*w*>8b+Z+Oj
z6_6(!j2u=wuj7(~)BM8r&V;$5?RH<m{L-B*AJR@8T+eBf((!n!?57G1lm=m(X5!T?
z*kF^mG}XC2w_)UYFJh#uVcCRtmw$Zg>nThk^c(HB$DKV2Jm~w)OX@&nbn|9v#TUb$
z-ltqhZ06Wbchgh({Jtl(v2IFW3oe|@WuNNB1a<(<68H)3;HikA_I&=-`$5D-nhx0D
z_wS2^qme&Hy>+0%Q~_Z6*OI~aXus^Km|`d}1D#m<dP3&#J>0k$-a4b7GqOYK^%4fM
zY=ISn5vWBr<UFyvENsvI!=fnsoUNC5+jvLkp`NSI#NNQLYSm!pc`|Wn9Aum0m#7Xp
zrJAX#<1?~MGIj4@e?kjjS8honv3r-zo+r?00mwZq;&M~0xfo{rH`2sq{Hyg;s7uAL
zW{*cyV2bZbhrftN9c9M0h?2QtlV7S^WoZLlR<3t0T<Oj2P}d_k;Qftd=@T5w*ys`~
zi6Lz+PM#VTNBE43&tqP+R;YxP7#YY;3lYckAXfB7F#S?)P{4kvDg-@GTFY#8**}v9
z<Ot-HXZ5Hi86@J1vq2^}f~8|4thh}La!h+RNSlX7-b|!F4O-`?eOa$X^}cW-W1uWI
z$cbYyM*Evw6K4oiyMGww*+yb~Vs?SFigSzjn7!R>pHt5VnP}!Zml~{pd+UZCA-zc{
z;RY`k!Ob*b@}MEg>&AZdD)$0#cZ{hW-6On~!cwW`T~#x1wc`2jn?#8XwgibEXg8+T
z3gStEApWD1o{fB_GpV0W&q)oDCrmO}p8Arx&|5nxCharRhwBjOx0E`rnp|VOsWB-a
zq{ANUcRn>s<%?D<vsd=G`1*mRlie-{=dYg<blFp~y&8KEBx(w?Kqe@<wjzrXyUwa(
zP;XTfABqsOEJx;+lgRhY)~uK{lbLPE-vS3Iv-)HS<nge=nF9zoOZYY2L&n8D4iabe
zqQ1HMIeE{SQh#<z8Acd^xwpHTUcX6t#06bS%@_p*3gEYWfWJ>Hdwr^0hPg`xH<M)D
zDz~kE!w<_1NAwPa6|8yOGW`C~Uh)h(6-OCwI^C6Ua%<je;PDEL@==$lJ+;XKWrbHt
zHLi85vFnaO4~={F0>t1;y^Z_)hx7bbKL}_n>A&Az{ay{KT7{4SBRyWhzq-Dme~jZ#
z0YQ?dwa_k2*sd3;<})IwYlZR%EV^rn`+ZL$v71U|7SJ!*`mp$4MY4GCR6W!A_pFQ^
zW4vEcZ$y%3{1qD+^aGKD4yhqvx-}{!$9!WRH>HuPU*2%vQQj0vICCbReB1#fMg9q8
z2`Cp?s)N)ZT+KXFjHprDAa$KCivSTk&9C2<g&mPM+2D`*wyQ)I<&b-bcdQp&V<FU-
zc#v1mm6}OS9R%)1&+`SNE64D19^{+f#C;T=qV~fF5<WC4W`6x3pAX9FIji|(Z?$O=
zx(yPq=ur%EZCaCX+1E_EHPupXv*(B=;{GT+gW;1KgczLW-!NoqMz2`cvKvM*Fx!ae
zs%m+gt(b=1>D*<)^DvY!u@g2P2uMM|31VBYcL=AfT%}peY5%7CvCW0U*$Y%bYy5WI
z&WJcPn{p-Zoyl3>{+e|V4!cA;eNjNlHIB47^uGV#^6wp}EJ$+XifqJa<j*pgug9C;
zRu~?%9Z~$D7Wg*VSuqR^XAH^xCxjYeAP|}T%N+p)f@pUr-{eMS77k}qzHyNBwHcth
zHH9Kdr+_T+lbX7Ibno~7I_p*~VYyJ=se-?`Tb;%5A$EO0j2vg5W|XMP0iN3ZgZlG|
zIU{b5bkjSm*9}ph+-y6Y#!RL9UGGezff_Cfo*O06LzQzWiakn5HYMeax79(wr@5@D
z)ywXc1-|+9GP<%3rTi=Ib^XWJ2s*o!_Er_KG=`;~)XYC1{>ZQXJ3()X5+TssqXEQ1
z9u>E{3&i<GIizf6Ey4hepAKi(Ph(+u3@k*(03+{!ai^6zH}*wa^KuS;vsY6iL@1aK
z(bsP>>FEju7xwXg5CO8y-bksujq2K!fU-&Ws?ls+=Epl5sCR*+`gF@uFYyAd@$AH%
z0vibrCRFKH{w5HZX+`>Dp7-)07(DLWTL(?g3#U7ECk2``J?xj*Eo_dMcLVuxMOo4<
z4N#Uze5v=MKt-ZBLF~h8<R0xe(EP3EUQ{^w0Oj`6QU4c(K0MJBoR1lf!tz*Hh#;`2
zN97pD4lbZK@W|VLIP@c8Ly{ZN%PKJHZSu8fu#<W5*m%Q{>4Jc$4O-)Tg4io~$1NpT
z^5VL9=usrk;|JnP<HKr8qPL$OQ6K72p>-O(q_m-k&=k;B$+t#_s#{Nq$arPn)BD6h
zXX7i)a(zQ@y6PKLtB+F(wa%MNkq}VGro*;AhRkfMv6Ojo3A{L<$c4z?P^n0j>iZ`9
z`o?@jasX!Xv7KQGNt&_+`gYJE#p8B$uLR`)-|@W=U$o?|Z`;0h$st)^3(X`}tkKig
z2EY!8TL@+&-fr<!J$5Z4q0IP4KLwq_tgBPRMEIV&W%E!=gEb5NgmDBca2I0kzC^i%
z1a)+K1dRUsnRgQAGzZiMQli2cKRpzFG+BsG*dU_1fqyymI=#ab9cBVeaMHW!c<Fnr
z*oC9pYoaX?&f?p>r+?9n08d)JF=N`sWz8Gd_V;=Cqu3PgZv@#$s(QnZ{p4G&GcKDq
z+xELD&59%mxl;u&hlXKbt3UQ3LBp3n_CU1)XKv|ac8LG-yzuLfQg2a~RK7tdf;X}&
z=g2re(!Zo3eblav@%RkqTg6nDf}bnvGd<-AuqLEH(~qJ~%z$Lh-`IAdBEwlU{#Noo
z%(u@+=@{{N(?0zt=_%Lv&p3Py_ilJ<zit@RHI@Eds@B-xXpT=Z6BhPWR5*g)l*q(=
z_)5jjb_EMWCYkdYKCV+newzPUT5FwEI@pO*lG~r_sYDG<SgvOY2ftZf7T~F0)#C)`
zoUSZhTON-*jtP0K9j-LCuby0_UGIpvA3qv$iD)(B@rK6!DNSZ=1eGhb>2x~GPm2RO
zh}tc<oO?UysLk-yYlY0IMGmtHkLhWHt2A4Z?M<QRhdv`P2kJK7AiBVtSe4{D>u*qI
zKrf`MoXMEg-JPOdw1)4ALNLQo<Tut_gVI2Iu{3M!WwuskPn=&i`y$>KAGin&ke1M(
ziug5OMD<eGdb?JFvUc_TfP#I#=cfzK2LTFIu$49s>`EDeM_)lcd*obRw`a_<<fy*9
z?q!8V?Auz{=gGf71@G{blFu);tQe|;3!>VZ+_P=hk-HtmRMH;q@w(w$3BuS6n&$pk
z=$jr8rP#YN>0gplp_)dkh78X8<8D`!h+(z!&=P;aJngoXEfsFkn5kVPE_G}rfE>q$
zSj(w50Nyu?f>7ovtw|B#t~RjIewyaoG!y(3IveBji#VO4Zrpp3De8MYOwN=S79nKk
z#ZMU!gOo*kQ_f14M8HqpOkKQi>E`HATqDitM?Y3RO5U*}ULW>DoMu!V6r6CSLtg9@
zC7J_Y4kuaCXnZyiKgVS6WSq@^uhx6dUe&GDCRPFs2I(N-%14Y!QlI)D`ftxgKNZCs
zK1LB0v~RLNRL5?l-W|l4NKrI`LIwf@ZA2vjF=R~0)@m{#lh1+aXOjqq9l1)9vzi9i
zdB>114t@qIen4?T5u$VlpZYDVnYJPtL|^=EyKc9XQ26sPi@JIz;``G!iH6%*>Fw^q
zBZW%LRTd{-ZDAXzsXNd!|Jh2rL}y*70m#>AE}!MYiCBxFos(_#wNAzO@1})H;UFLA
zRVjA(8S}T_IhMBRh>T~7BawPWg^v1IDF*vki$rr|OE&~C-2Q**5=%PYmYXV3g1740
zOpO$AL8iZ-I%d!hgLNt(SeT3d8a)!!35k#jN7=icg9@_b(3|TY6^5%4f41xg%aLZO
zYa+FTE4x;OgdSGMg4GP)|L_%PxJ3x5-thJw{ugCHsnT}*D2RY1yUGO08Pb0qLSjm2
z!VoCqklB`ebEpvRUw?=HrJ5kLI_Wk{Q0x_};i^Nt##k`6P#(2YB@Xt@N65ImsViRS
zF9)tlCr)m;&I9RLjEuWYkpf1KV~ic;Ka^3MyU=p{&%uDYGNt+2eOk$${j=C=;&pG6
z((a1?v3sfEH|Zn86Pa*L!B(;)1w~*og)%;79Z6%)eZgZioT*q96K%WAlcQN$c51nZ
z@++?}6HQ`lxJ8-Xk+%vcOsl2Q$aqCk016kr?PNDJ@)Q$CBak^7Vmvyibg|MjV4hwZ
z(He4uPJNRh!ck=i@bB1U+@HeJR?iI5jPa-IMMT<;P0wcOX-KQ=rid;C^lYWy_)0YI
z2{>n7in(%#<IdWwsm!yl4K^>IwdARfg+6uMy0qC>aU7-S;!lUKI(=KOs<t`(qVS-k
zFsV(r>AuG)olgGYKKQ&;<V>iUYfLZTxkQZ0KstY~R<J)73fP%<(5%UCT2Da`MeU7U
z6FqyvUg*0phLb!8pD7*-H?_&B!>6U)JnR6(Wc|sgdA;vQhn>3>i{Fb&Vp1;Jg`r<<
za+22ZdeTp~tA%eg%P>54+lM~=N~~}vVw+vf&6EXasfXIuxu+jDAGcQeg_ZV1Cuk{F
z1kG;huPr|fOcr&O$<SF)LdRyi7=*JKz)TsE*+mZNbs4o6N3-u6O+Q{psH%SG{Ty-<
zjJMKU7{qP8a<wsLQep!LCKvLrW8Y)Ab+Ry4nyhNtez7{3BBkEZNsLjfSs0;Nb<1Hp
za?Bd@z>%x`Q6Zl64L#$qYhXIa!N#LV<s>itVP7Qp@+8>NRT##+iqJU1hFTwfCh*ww
zAnswA2k7o;rGB8hTTHR72>a8j_BgNLLSRa9vPSlxF-y@bUBK5?v~qP3Z(-UNg1qzY
z2N4xTYSa(^2duYIm$*M%q6N<sePWw00^s0S`h_w+G1%BaRiDnDGTxefxknFuWEl6A
zC24ap4~DgH{Gw%W^0F;Gnl_<@E#qEuR*qColei^){c>S6&6Mckx2xB7S{5P~fEly9
zzeVCxBpiTNXgsYMqY~{fJn?&xbACMP*}UC{=)u5!!1_y#rQ|e6-VJdUXhO)Hk>qf|
z)Q*nTVS0Yl%)8reU)CwkP`}XDvn=__w617=hHJ3;!Io=~nGmaiQfaXUj~m>wDcf0?
zA-QlcX=?f0ImuvAMInBmyK_?C&^}Thu87}6WtFn?6_B}9qb+1iqkF&X$hkyojMtWm
zWqtcciVoWVy&%|!t*sG4bsDC=^P`SM8CE7`<RyC2K%Q<SdqiPTEZ|P{_5PQ<oSv=N
zexTMJw}P%8F33slL)(#@>^vconsH=MbJ&>^LOiUb<l${>%0+(SnVo&9a^BRe*^Kk4
z%^EhFPp)P!<|*g-pG^dTr-e$f1qa@0*KH_6dK1wnjh)SEtn0y|6Dlq?2l}qauCI;U
zbC$s%c-TAk;3RT+5ehF762HRssBgnz=Q!OJwh7-$9W1Y8>^Id>$eP=Ig=N@x{O>8O
z4;aWql3|=%Ew7Q<M~6rB3V6sFR-g26doUaxboLLeoZ5=&EA_K`OC62$-+9%21@z-#
ze~1`+#gCI!+Gvt-Fb_eNNzTO?_S33P;5vNnQ6aI%`%;}E@8fHA*)?v&fZ;Pb_oCw`
z;=jffDI=cmR1c0MO}p1_(&|2pf);P`@7zcG(c3!Xp7-?c_2WM|GtAYS%%23k;j^M)
z1Kh%g*wEiUI)3<jaeg9`gw4de<tLVgabiyI&%HfZldryf`i*{C6p~o|xHTM%LPhy7
z91B-Q9)4Bj>ABU%F?}a#cmdR=YW(=;;&(sK7~;i~KRC*AjCy3y8lbC>{BQp4kyu_3
z0-z8Xz6Za4>FN#t2@)9V|MNX@*K3CozkZx6<Z||VExV1qlZS><N=SSIsQ_gJdU)vE
z4Y`$U-i-v}8X6-@^Gb=Bk66BSk7Z(G`nX}xcGv|DZ+))&Nt|Du*jQ40QJW^HNAQ9$
zu?-FHI*}5}&}Vvha!0;b(u|BYTC#z!Dx4{T(+G5(Hw<|VdfpUIQLM+kMCiUxo~ZBq
zq;b&O&<9>775yRMW_<55;)7)5PA6T1LLk(LBJhlWP9XAJ#sFMzA$Flr1DIWw^YxL#
zl6N10&-WcPS$f2~;;GW{ve~6+3|B|Tyw|rv4`)0#Nc0%=+b9x;E{9!l=TjbLPubgp
z3}Gq`3#4^$2^Ch?b;e9=LMT3uZ|Lr(axf0#!?(YFYrWg4)xVKq7y^WL)$sXSRjTft
zc`BCn96bIZwTiN=lDtb^RC`@9g?DA6E@5kMEB3~Fr$d5tyReg~Ay&E5CXlJ^oTH<?
z;LTw|#!i9<xI7@EK6oKms4NXRMNj{*M~D4aEJU+T0_8&5(p2kjuJirmiD)g>XMNI=
zS=YPQf4XRpL2SP{JsA$4q9kPJ*I-cEQvXp;yU~S|WQNGuwhOL)dF9TBNS_>-Qs>`M
zrl0K)v-xht8^}Vi#m5`<H01J2dj*AQK|3iQ8Z#7!hfYSd@8~0wmH4);-U9M9C8Q|u
zumo_}d~2NXKZa!VQ@$4L25O~dsyR=BlNk{<RaZ0L4iu_6l<}UcnV)3!ugZ~d9dNmC
zu1N_gNHXBE^^uV!TK&^Dc)GAvn}f!x<x8+K_fKwWIC@$4?yF<Rb4Nyr8s!3YK6QOM
z;ou#4v@X;^i`0$;X4CY9%#_pV6Ok+AxDON1;qg$@E|KW8yC3T^Ddw>jh=MC@jTK?a
z>ychfD%g0umX7fM!OUh$E#sjw?O7Iv-Q93i5wGd+2CtXx#(5rjwO+SvPG4|ifNdj~
zWTk9>8p~o=q}|JI|Iyv*ebV5Xp&#W2w(DAxt*YL}Q|H3rj5NHZ2PZB_z6Eq8uKh%l
zL0_(7<`KSkALX)(HnUgTY(n@e=z6H^lEEPHM=--EPsNib_71L6SMV>Bob@lJHy{!?
z!q|DZ#WX5j0fV+{6uP6)vT`F_wE2}7?}>gT$Fk1KUhW7xrRn}61yAbP#<2;4-iEYm
ztty=>JTWk`|KCq)WEfY8m4;uS0^0qstyc7|Anmf#XPHGYcxp-Be827Bj+)*1_X%wM
zW^nWf0td0g@Ve=0-$<qjMT=%l<m%nF+%+zdRX^Vtf7GOy2d>s=C4R7#zs=7>_If4O
z&v(A#TS)3~M0`NH?nC5#B3&)be&17DIaG4g{6_BhFTrGgW3eR@sQ9bE##qqrPPmej
zE@(;fn!K)RSoW((j>6G~@L64jUqoZ(#^}?6kwo&8)6IA9EJ}zx=y+&~a0Ibt@qhK{
z268V~mJFJ1z0tFrzy(<Zew(r`dU{8b_y-8AMg(sSzn3e(<HXH0Xq0w_cO1~A5BJfk
zK?7Qc?|NK#(*wA^SAP|x%UAyM42AD&QTn8+1edk=2Dmqe5nF31Z61zMW@8uzHOYhJ
zL|duhm@0RY=(7;-oB&!bsO+SW#bz7LvakZ55R&!=O46TLdg>eURIPLlmdDZ5=l+&b
zz$%7GeORcR_e%H~b}KFos~GqBjqxuCi>kuvW2E5YTRXv?AmDK9^kTX{x9{to?jR>z
z`6N5j+2I^tKci_9TQ7E-!Z*YHA-7~mmYoZi7?&>9T3+*ak@vS9EpqFIY6By0EQH8u
z)rbTBi_utlb`s>yl5H^rob&yxXXTa*0RJZzWN{bG7DBM8g^Q+eN~La>&z^R}P!F}@
zJfHaC-M@)sq|%&JPDjvKtK2!3BZ^7`1Doh}U1Jb5Bk{kl8b7*O-h!IVg_tf{JNR6L
zLi_q+B&kg>w#vHD6Qb!#i&w?H$4#>*xXatVklY2ki0xU1LSXd~!H3by?RUsU4=^ay
zV2*yrzhdu{d*03rVn!K@1^c|pmyCcp@}xRJ<#kH@F~wl@QYkRdjFIle@>sgqX$1(v
zV`rkS2=t?T^fcmlTC8dNmZ{G)L}#2|8Ik5%8;gEpN6YL<h1g5@L-dCm-qm$!y`Lk4
zhoQ#3#Y?JZCppNCZXy%$h5iKhYxT;=rEgf5k~AaGOOFIYBQ4S8JNCxKi0{8tEBwno
ze1H1q+1`7MORlfm1=!{08-o#gGl$%HnXp>0W1QGr&c*kqR4?{ZpCXIs0u-<+?iUJv
zx}2vf{3Gy`P!L5iZ5grs;7jYW$Xmz;EC%+PIO*>@S-`70oiSFV3<zy&mQ}m5veAig
z3ZS2$=SX$`Z|@0Lzs-r-^nJ9S`o?vc&aM*+_#(XZzQ%*p*+rELQd{vv*g6CMeJX+4
zh<U0`rVsVl;a+nF^w9hGmA9!`(&!wiqbc18@~rdQ@FqPGvrRrSv=?{wp>WfhF~Kpj
zBsdrm)9Qfybp?|eRotWE@?)+a7hT2CqO9N*mo7G=c)1T$<B8DBBP7ZCj^W5BFDMqc
zAt@Zy#~W3o)jkQ4g%AyM_QN4x+ewcW>*Kvuq))Cb7ej^P`%;zk?hevq2NcyO%x;Ov
zdDT1o|M4T37#K#z=}x2^9%Pt^;G?%lYm&aW#vZf1aP+MaYympt!ZSiPs5|`w5>uR^
z;-*Nbw;1In^2TV@KeK@y9x?qJtE5AtL*@^I>^B}cD!w`T2Jf@88x0sT|0;4L&E3|O
z<W;Cq>y~UPhm3<PZzYNnbX;U?fp4W>Agj8oajUKAz0Rwc?NU^8-C!^)pgj=MmeKQ9
zI|tG3KybyWLP6$>M5H+TZ5gI-bLnAS_T7AY_zHz5CIire(@>&HTXD!+n=D`S4B?%u
z!huHhrcn8>v!ALo<B2%O-HOW}>04|aBl(?cv1WZqc7P>IU*dyU8K4iokt(G8pz?2r
z{nCCiqRDJhYbEa7c&R=roqnv%K^KSCr5g%)iO$<_ej(m$B6g7lj`AxOU#&OoBvDtW
z#vuWB%EiP;%Mgcp(xwlcqy{nM2%XaW*$(u8G-0VeJL#v9Sr>n3afVi;?Ud?%J~!F+
zWX)mFx{OP-Vfo|KrifKDx5WuOhQ}AJh>ql^1e|y4E+M*Xr35EW3>(Ys29=a^SV*{v
zFgBONfV(8FJHDbhO_^zxuLWf5{OB{IUane?r{>smvi=bNBuNV-V5&SeTQM_PN+Q0~
znjgbBL~AA(WBy|igoh+5M~Mw##CWiHx2srU=Pf4F)Fd>XHx!R{m;veN$PL4CR$krb
z5#1XPE?q0AJLjLqSc(_Z_V&IKNjOOp`wokRo|A2oWd}BbG{1`e{A*cgS4%`)zo=Z$
z-226NpXE-PpEiIR*bw0&eH|U5S=$m3XGlPnfwrj`VNm$uCsOhgaE~@BTn)C#WsyQu
z{O)xsM~@%3f81m3dL$c6MC!vW1Mzhq^3`ye+!_e@s4bMmsvy2Unqyo%XVN$kue?3~
zyvln}b@%W{CG?vrmt7_hp$t&RF8ptMBI`CT>KJcmdct;QtiX(VE%3?gpwP4`s2i9Q
zf}~VWt<KOow@6o;CC9Ap#v39{hyI2Sj<WNs2t#6-yRoo5B$GEC_8vCI{9k<$oQ|2@
z2X6C|=NfErA5XQg8DC=d$-=n`4XDO#ovP{J8bK~c{^qKt!r^sTSxteH*A#Y9<!5cA
z+zb0SA8Yt&@Ho@t#4uxS?abA7_pdD-Y9W3KK47U<r!hy^#{TH3V@%5$(g?N@z7s4;
z_RWp2$K6kTi#wHQFGr~aQ89MNj-e)87d{M_3}m}GH?*DKSYMB;k`OsWvV%chZp2c9
zFFdT`h3G1{R%+NZ;c_Q43SMDaNo=CuPxS-~J?80|*kTuo2VBB{Q7chJy%r&*+imB2
zTM_@Hk9+aC?apWtg5=E$xH%)T1<a3kA`&$5?tB?hWnCdcXD0nO$Hr+|ld;j1Yg?bb
zofee)4P*v=Z&j5mnmOwmAC@HmK24K(pzlK{>@ISN!AHk1(*38-dQv9wZ4mBwlQoy}
zkC-DmX6%UsSaJEL_o_y8j_{hbmyZ?+7sncsh(#$0@obHrPWxU`3NY+PM!ZCGfa3sq
z?ai@&c@0E3uiAHKtO)wLojk3%15DWct9t$=VwZ+cS>aj!L*RM%9OLf>G^<fWBD*7l
z6gILOz3JrhjXmE8hXW((aINztd1>`f=~>>(flb_=h{TX$Ku9tE*+3IiWzlYWFg7I^
zn==gr?>~QQbx8|@0RN%DYQ@QWhMESI^M}fH*a7cnxtlo|2Q&mB5i0mYIwpE}>|PpD
zf~$e?ot*9`qx#a2)`StTp%l(|g*?#EA38!0thxX9qyJ~#{~JjEH)R0l5b%ru4W6(r
TWK2N?0e|vuRHVx!O#=TP^sXBj

literal 0
HcmV?d00001

diff --git a/docker-compose.yml b/docker-compose.yml
index 0a12340..2c6d95f 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,60 +1,44 @@
 services:
-  sublime_postgres:    
-    image: postgres:13.2                                                                                                                                                                                                                
+  sublime_postgres:
+    image: postgres:13.2
+    command: -c 'max_connections=200'
     restart: unless-stopped
-    container_name: sublime_postgres                                                                                                                                                                                                    
-    environment:  
+    container_name: sublime_postgres
+    environment:
       POSTGRES_USER: sublime
       POSTGRES_DB: mantis
       PGDATA: /data/postgres
     env_file: sublime.env
-    volumes:                                                                                                                                                                                                                            
-      - postgres_e2e:/data/postgres   # different volume than dev to avoid overwriting data
-    ports:                                                                                                                                                                                                                              
-      - "5432:5432"
-    networks:                                                                                                                                                                                                                           
-      - net       
+    volumes:
+      - postgres_e2e:/data/postgres # different volume than dev-be to avoid overwriting data
+    networks:
+      - net
+    ports:
+      - 5432:5432
   sublime_dashboard:
     image: sublimesec/dashboard:dev
     restart: unless-stopped
     container_name: sublime_dashboard
     ports:
-      - "0.0.0.0:3000:80"
+      - 0.0.0.0:3000:80
     networks:
       - net
     env_file: sublime.env
     environment:
-      MANTIS_HOST_URL: "http://host.docker.internal:8000"
+      MANTIS_HOST_URL: http://host.docker.internal:8000
   sublime_redis:
     image: redis:6.2
     restart: unless-stopped
     container_name: sublime_redis
     command: redis-server --loglevel warning
-    ports:
-      - "6379:6379"
     networks:
       - net
-  sublime_nipper:
-    image: 948971135452.dkr.ecr.us-east-1.amazonaws.com/nipper-python-dev:dev
-    restart: unless-stopped
-    container_name: sublime_nipper
-    env_file: sublime.env
     ports:
-      - "8300:8000"
-    networks:
-      - net
-    environment:
-      NIPPER_BUCKET: "nipper-artifacts"
-      BUCKET_ENDPOINT_URL: "http://sublimes3:8110"
-      DD_TRACE_ENABLED: false
-    depends_on:
-      - sublime_create_buckets
+      - 6379:6379
   sublime_strelka_frontend:
     image: sublimesec/strelka-frontend:0.3
     restart: unless-stopped
     command: strelka-frontend
-    ports:
-      - "57314:57314"
     networks:
       - net
     volumes:
@@ -64,6 +48,8 @@ services:
       - sublime_strelka_coordinator
     deploy:
       replicas: 1
+    ports:
+      - 57314:57314
   sublime_strelka_backend:
     image: sublimesec/strelka-backend:0.3
     restart: unless-stopped
@@ -96,93 +82,204 @@ services:
     networks:
       - net
   sublime_screenshot_service:
-    image: sublimesec/render-email-html:0.1
+    image: sublimesec/render-email-html:0.2
     restart: unless-stopped
-    ports:
-      - "8100:8100"
     environment:
       - S3_ENDPOINT=http://sublimes3:8110
       - SCREENSHOT_BUCKET=email-screenshots
       - AWS_REGION=us-east-1
       - DISABLE_DD=true
     container_name: sublime_screenshot_service
-    env_file: sublime.env
     networks:
       - net
+    ports:
+      - 8100:8100
+    env_file: sublime.env
     depends_on:
       - sublime_create_buckets
-  sublime_azurite:
-      container_name: sublime_azurite
-      image: mcr.microsoft.com/azure-storage/azurite
-      restart: unless-stopped
-      networks:
-        - net
-      ports:
-        - "10000:10000"  # Blob service
-        - "10001:10001"  # Queue service
-        - "10002:10002"  # Table service
-      volumes:
-        - azurite_data:/data
-      command: azurite --blobHost 0.0.0.0 --queueHost 0.0.0.0 --tableHost 0.0.0.0 --location /data --skipApiVersionCheck
-  sublime_create_azure_blob_containers:
-    image: mcr.microsoft.com/azure-cli
-    depends_on:
-      - sublime_azurite
+  # cgr.dev/chainguard/minio has no shell, so anything needing one - fixing up volume
+  # ownership for minio's non-root UID, and writing MINIO_ROOT_USER/PASSWORD out to files from
+  # the AWS_* vars already in sublime.env - happens here instead, before minio itself starts.
+  sublimes3_init:
+    image: busybox
+    container_name: sublimes3_init
     networks:
       - net
-    environment:
-      AZURE_STORAGE_CONNECTION_STRING: "DefaultEndpointsProtocol=http;AccountName=devstoreaccount1;AccountKey=Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==;BlobEndpoint=http://sublime_azurite:10000/devstoreaccount1;"
-    command: >
-      bash -c "
-      az storage container create --name email-screenshots &&
-      az storage container create --name events &&
-      az storage container create --name message-storage &&
-      az storage container create --name message-export &&
-      az storage container create --name nipper-artifacts
-      "
+    env_file: sublime.env
+    volumes:
+      - s3_data:/data
+      - s3_creds:/creds
+    command:
+      - sh
+      - -c
+      - |
+        printf '%s' "$$AWS_ACCESS_KEY_ID" > /creds/root_user && printf '%s' "$$AWS_SECRET_ACCESS_KEY" > /creds/root_password && chmod 400 /creds/root_user /creds/root_password && chown -R 65532:65532 /creds /data
   # Keep this name as sublimes3 because underscores don't play nice with certain endpoint validation
   sublimes3:
     container_name: sublimes3
-    image: minio/minio
+    image: cgr.dev/chainguard/minio:latest
     restart: unless-stopped
     networks:
       - net
-    ports:
-      - "8110:8110"
     volumes:
       - s3_data:/data
+      - s3_creds:/creds:ro
+    environment:
+      MINIO_ROOT_USER_FILE: /creds/root_user
+      MINIO_ROOT_PASSWORD_FILE: /creds/root_password
+    depends_on:
+      sublimes3_init:
+        condition: service_completed_successfully
+    command:
+      - server
+      - --address
+      - 0.0.0.0:8110
+      - --console-address
+      - 0.0.0.0:8111
+      - /data
+    ports:
+      - 8110:8110
+  # cgr.dev/chainguard/minio-client has no shell, so it can't run `mc alias set` (which needs
+  # shell interpolation of the AWS_* secrets into CLI args), and we don't want that secret ever
+  # needing to land in sublime.env either. This throwaway busybox step hand-writes mc's
+  # config.json straight from the AWS_* vars already in sublime.env; chainguard's mc then just
+  # reads it via MC_CONFIG_DIR below. mc still needs to create its own share/certs scratch dirs
+  # under this path at runtime, so the volume can't be mounted read-only.
+  sublime_mc_config:
+    image: busybox
+    depends_on:
+      - sublimes3
+    networks:
+      - net
     env_file: sublime.env
-    entrypoint: >
-      /bin/sh -c "
-      export MINIO_ROOT_USER=$$AWS_ACCESS_KEY_ID;
-      export MINIO_ROOT_PASSWORD=$$AWS_SECRET_ACCESS_KEY;
-      minio server --address 0.0.0.0:8110 --console-address 0.0.0.0:8111  /data;
-      "
+    volumes:
+      - mc_config:/config
+    command:
+      - sh
+      - -c
+      - |
+        cat > /config/config.json <<EOF
+        {
+
+
+        	"version": "10",
+        	"aliases": {
+        		"myminio": {
+        			"url": "http://sublimes3:8110",
+        			"accessKey": "$$AWS_ACCESS_KEY_ID",
+        			"secretKey": "$$AWS_SECRET_ACCESS_KEY",
+        			"api": "s3v4",
+        			"path": "auto"
+        		}
+        	}
+        }
+        EOF
+        chmod 600 /config/config.json && chown -R 65532:65532 /config
   sublime_create_buckets:
-    image: minio/mc
+    image: cgr.dev/chainguard/minio-client:latest
     depends_on:
-      - sublimes3
+      sublime_mc_config:
+        condition: service_completed_successfully
+      sublime_s3_ready:
+        condition: service_completed_successfully
     networks:
       - net
+    volumes:
+      - mc_config:/config
+    environment:
+      MC_CONFIG_DIR: /config
+    # --ignore-existing keeps this idempotent across repeated `docker compose up` runs, since
+    # this container reruns `mb` against buckets that already exist from a prior run.
+    command:
+      - mb
+      - --ignore-existing
+      - myminio/email-screenshots
+      - myminio/events
+      - myminio/message-storage
+      - myminio/message-export
+      - myminio/nipper-artifacts
+  sublime_hydra:
+    image: sublimesec/hydra-cpu:dev
+    restart: unless-stopped
+    networks:
+      - net
+    container_name: sublime_hydra
+    environment:
+      WORKERS: 2
+      WEB_CONCURRENCY: 5
+      KEEP_ALIVE: 2
+    ports:
+      - 8200:8200
+  # sublime_mc_config on main only writes mc's config.json; it doesn't wait for MinIO to be ready
+  # (dev bakes that wait into sublime_mc_config's command instead). Waiting here, as its own
+  # service, means this overlay doesn't need to duplicate main's chainguard config-writing script
+  # to add a wait loop to it, and stays correct however that script changes on main.
+  sublime_s3_ready:
+    image: busybox
+    networks:
+      - net
+    depends_on:
+      - sublimes3
+    command:
+      - sh
+      - -c
+      - |
+        attempt=1; max_attempts=60; until wget -q -O /dev/null http://sublimes3:8110/minio/health/ready; do attempt=$$((attempt + 1)); if [ $$attempt -gt $$max_attempts ]; then echo 'sublime_s3_ready: MinIO did not become ready in time' >&2; exit 1; fi; sleep 2; done
+  sublime_nipper:
+    image: 948971135452.dkr.ecr.us-east-1.amazonaws.com/nipper-python-dev:dev
+    restart: unless-stopped
+    container_name: sublime_nipper
     env_file: sublime.env
-    entrypoint: >
-      /bin/sh -c "
-      sleep 15;
-      /usr/bin/mc alias set myminio http://sublimes3:8110 $$AWS_ACCESS_KEY_ID $$AWS_SECRET_ACCESS_KEY;
-      /usr/bin/mc mb myminio/email-screenshots;
-      /usr/bin/mc mb myminio/events;
-      /usr/bin/mc mb myminio/message-storage;
-      /usr/bin/mc mb myminio/message-export;
-      /usr/bin/mc mb myminio/nipper-artifacts;
-      /usr/bin/mc ls myminio;
-      exit 0;
-      "
+    ports:
+      - 8300:8000
+    networks:
+      - net
+    environment:
+      NIPPER_BUCKET: nipper-artifacts
+      BUCKET_ENDPOINT_URL: http://sublimes3:8110
+      TIKA_ENDPOINT: http://sublime_tika:9998
+      DD_TRACE_ENABLED: false
+    depends_on:
+      - sublime_create_buckets
+      - sublime_tika
+  sublime_tika:
+    image: apache/tika:3.3.1.0-full
+    restart: unless-stopped
+    container_name: sublime_tika
+    ports:
+      - 9998:9998
+    networks:
+      - net
+  sublime_azurite:
+    container_name: sublime_azurite
+    image: mcr.microsoft.com/azure-storage/azurite
+    restart: unless-stopped
+    networks:
+      - net
+    ports:
+      - 10000:10000 # Blob service
+      - 10001:10001 # Queue service
+      - 10002:10002 # Table service
+    volumes:
+      - azurite_data:/data
+    command: azurite --blobHost 0.0.0.0 --queueHost 0.0.0.0 --tableHost 0.0.0.0 --location /data --skipApiVersionCheck
+  sublime_create_azure_blob_containers:
+    image: mcr.microsoft.com/azure-cli
+    depends_on:
+      - sublime_azurite
+    networks:
+      - net
+    environment:
+      # Azurite's well-known, publicly documented emulator account key - not a real secret.
+      AZURE_STORAGE_CONNECTION_STRING: DefaultEndpointsProtocol=http;AccountName=devstoreaccount1;AccountKey=Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==;BlobEndpoint=http://sublime_azurite:10000/devstoreaccount1;
+    command: |
+      bash -c " az storage container create --name email-screenshots && az storage container create --name events && az storage container create --name message-storage && az storage container create --name message-export && az storage container create --name nipper-artifacts "
   sublime_localstack:
     container_name: sublime_localstack
     image: localstack/localstack:4.10.0
     ports:
-      - "127.0.0.1:4566:4566"            # LocalStack Gateway
-      - "127.0.0.1:4510-4559:4510-4559"  # external services port range
+      - 127.0.0.1:4566:4566 # LocalStack Gateway
+      - 127.0.0.1:4510-4559:4510-4559 # external services port range
     networks:
       - net
     environment:
@@ -190,13 +287,32 @@ services:
       - DEBUG=0
     volumes:
       - localstack:/var/lib/localstack
-
+  # docker compose up --wait treats any container it doesn't already expect to exit as failed the
+  # moment it exits, even with code 0 (https://github.com/docker/compose/issues/10596). Neither
+  # sublime_create_buckets nor sublime_create_azure_blob_containers has a dependent declared with
+  # condition: service_completed_successfully, so --wait has no way to know their exit is expected.
+  # This long-running sentinel supplies that dependent so --wait treats their completion as success.
+  sublime_storage_ready:
+    image: alpine:3.20
+    command:
+      - tail
+      - -f
+      - /dev/null
+    networks:
+      - net
+    depends_on:
+      sublime_create_buckets:
+        condition: service_completed_successfully
+      sublime_create_azure_blob_containers:
+        condition: service_completed_successfully
 networks:
   net:
     driver: bridge
 volumes:
-  postgres_e2e:
   logs:
   s3_data:
+  s3_creds:
+  mc_config:
   localstack:
   azurite_data:
+  postgres_e2e:
diff --git a/install-and-launch.sh b/install-and-launch.sh
index b68692c..6021048 100755
--- a/install-and-launch.sh
+++ b/install-and-launch.sh
@@ -43,10 +43,10 @@ set -e
 #
 
 : -----------------------------------------
-: Branch - default: dev
+: Branch - default: main
 : -----------------------------------------
 
-# By default, this script assumes that it should pull dependencies from branch `dev`. If you wish to get dependencies
+# By default, this script assumes that it should pull dependencies from branch `main`. If you wish to get dependencies
 # from another branch, you can specify it here.
 #
 : curl -sL https://sublimesecurity.com/install.sh | remote_branch=custom-branch sh
@@ -80,7 +80,7 @@ if [ -z "$interactive" ]; then
     # ascii art
     # credit: https://patorjk.com/
     # font: Cyberlarge
-    cat <<EOF
+    cat <<'EOF'
 
 ======================================================================
 |   _______ _     _ ______         _____ _______ _______             |
@@ -197,7 +197,7 @@ container_id_by_name() {
 }
 
 if [ -z "$remote_branch" ]; then
-    remote_branch="dev"
+    remote_branch="main"
 fi
 
 if [ "$interactive" != "true" ] && [ -z "$auto_updates" ]; then
@@ -410,6 +410,8 @@ launch_sublime() {
         else
             echo "Daily update check is already setup"
         fi
+    else
+        echo "Automatic updates not enabled"
     fi
 
     print_info "Launching Sublime Platform..."
@@ -442,7 +444,7 @@ install_sublime() {
 
     if [ "$clone_platform" = "true" ]; then
         print_info "Cloning Sublime Platform repo..."
-        if ! git clone --depth=1 https://github.com/sublime-security/sublime-platform.git; then
+        if ! git clone -b "$remote_branch" --depth=1 https://github.com/sublime-security/sublime-platform.git; then
             print_error "Failed to clone Sublime Platform repo\n"
             printf "Troubleshooting tips: https://docs.sublimesecurity.com/docs/quickstart-docker#troubleshooting\n\n"
             printf "You may need to run the following command before retrying installation:\n\n"
diff --git a/nginx-custom-ssl/Dockerfile b/nginx-custom-ssl/Dockerfile
new file mode 100644
index 0000000..1487dab
--- /dev/null
+++ b/nginx-custom-ssl/Dockerfile
@@ -0,0 +1,9 @@
+FROM nginx:1.30.0
+
+COPY conf/nginx.conf /etc/nginx/nginx.conf
+COPY conf/ssl-params.conf /etc/nginx/ssl-params.conf
+
+COPY certs/nginx.crt /etc/ssl/certs/nginx.crt
+COPY certs/nginx.key /etc/ssl/private/nginx.key
+
+CMD nginx -g "daemon off;"
diff --git a/nginx-custom-ssl/README.md b/nginx-custom-ssl/README.md
new file mode 100644
index 0000000..131be57
--- /dev/null
+++ b/nginx-custom-ssl/README.md
@@ -0,0 +1,12 @@
+# nginx-custom-ssl
+
+SSL support with custom cert.
+
+To enable SSL with your custom certificate, follow the steps below:
+
+1. Copy your certificate and key to certs/nginx.crt and certs/nginx.key
+2. Edit conf/nginx.conf to update `__server_names__` to your domain or IP address
+3. Perform any other configuration edits that you might need
+4. Run `docker build -t sublime_nginx_custom_ssl .`
+5. Run `cd ..` (back to sublime-platform directory)
+6. Run `docker compose --profile nginx-custom-ssl up`
diff --git a/nginx-custom-ssl/certs/.keep b/nginx-custom-ssl/certs/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/nginx-custom-ssl/conf/nginx.conf b/nginx-custom-ssl/conf/nginx.conf
new file mode 100644
index 0000000..9a10830
--- /dev/null
+++ b/nginx-custom-ssl/conf/nginx.conf
@@ -0,0 +1,57 @@
+events {
+	worker_connections 1024;
+}
+
+http {
+	# language server websockets
+	map $http_upgrade $connection_upgrade {
+		default upgrade;
+		'' close;
+	}
+
+	server {
+		listen 80 default_server;
+		listen [::]:80 default_server;
+		server_name __server_names__;
+		return 302 https://$server_name$request_uri;
+	}
+
+	server {
+		listen 443 ssl default_server;
+		listen [::]:443 ssl default_server;
+		http2 on;
+
+		ssl_certificate /etc/ssl/certs/nginx.crt;
+		ssl_certificate_key /etc/ssl/private/nginx.key;
+
+		include ssl-params.conf;
+
+		location /v1 {
+			proxy_pass http://sublime_mantis:8000;
+			proxy_set_header Host $host;
+			proxy_set_header X-Real-IP $remote_addr;
+			proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+			proxy_set_header X-Forwarded-Host $server_name;
+
+			# language server websockets
+			proxy_set_header Upgrade $http_upgrade;
+			proxy_set_header Connection $connection_upgrade;
+		}
+
+		location /v0 {
+			proxy_pass http://sublime_mantis:8000;
+			proxy_set_header Host $host;
+			proxy_set_header X-Real-IP $remote_addr;
+			proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+			proxy_set_header X-Forwarded-Host $server_name;
+		}
+
+		location / {
+			proxy_pass http://sublime_dashboard;
+			proxy_set_header Host $host;
+			proxy_set_header X-Real-IP $remote_addr;
+			proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+			proxy_set_header X-Forwarded-Host $server_name;
+		}
+	}
+}
diff --git a/nginx-custom-ssl/conf/ssl-params.conf b/nginx-custom-ssl/conf/ssl-params.conf
new file mode 100644
index 0000000..1e31748
--- /dev/null
+++ b/nginx-custom-ssl/conf/ssl-params.conf
@@ -0,0 +1,20 @@
+# adapted from:
+# generated 2026-05-04, Mozilla Guideline v6.0, nginx 1.30, OpenSSL 3.5.5, intermediate config, HSTS
+# https://ssl-config.mozilla.org/#server=nginx&version=1.30&config=intermediate&openssl=3.5.5&hsts&guideline=6.0
+
+# intermediate configuration
+ssl_protocols TLSv1.2 TLSv1.3;
+ssl_ecdh_curve X25519MLKEM768:X25519:prime256v1:secp384r1;
+ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
+ssl_prefer_server_ciphers off;
+
+# see also ssl_session_ticket_key alternative to stateful session cache
+ssl_session_timeout 1d;
+ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions
+
+# Disable preloading HSTS for now.  You can use the commented out header line that includes
+# the "preload" directive if you understand the implications.
+#add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
+add_header Strict-Transport-Security "max-age=63072000; includeSubdomains";
+add_header X-Frame-Options DENY;
+add_header X-Content-Type-Options nosniff;
diff --git a/nginx-letsencrypt/Dockerfile b/nginx-letsencrypt/Dockerfile
index 7a1c877..a57849f 100644
--- a/nginx-letsencrypt/Dockerfile
+++ b/nginx-letsencrypt/Dockerfile
@@ -1,4 +1,4 @@
-FROM nginx:1.23.3
+FROM nginx:1.30.0
 
 RUN apt-get update &&  apt-get install -y \
   wget \
diff --git a/nginx-letsencrypt/nginx.conf b/nginx-letsencrypt/nginx.conf
index 0d9c770..216c3d0 100644
--- a/nginx-letsencrypt/nginx.conf
+++ b/nginx-letsencrypt/nginx.conf
@@ -9,6 +9,8 @@ http {
 		'' close;
 	}
 
+	client_max_body_size 50M;
+	
 	server {
 		listen 80;
 		server_name ___server_names___;
diff --git a/nginx-letsencrypt/start.sh b/nginx-letsencrypt/start.sh
index 0136f7e..f67c657 100755
--- a/nginx-letsencrypt/start.sh
+++ b/nginx-letsencrypt/start.sh
@@ -35,7 +35,7 @@ sed -i "s/___server_names___/$_server_names/g" /etc/nginx/nginx.conf
 sleep 5
 nginx
 sleep 5
-certbot --nginx ${_args} --text --agree-tos --no-self-upgrade --keep --no-redirect --email $EMAIL_ADDRESS -v -n
+certbot --nginx ${_args} --agree-tos --keep --no-redirect --email "$EMAIL_ADDRESS" -v -n
 nginx -s stop
 sleep 3
 nginx -g "daemon off;"
diff --git a/update-and-run.sh b/update-and-run.sh
index b61c2f4..606f719 100755
--- a/update-and-run.sh
+++ b/update-and-run.sh
@@ -12,9 +12,15 @@ linux*) cmd_prefix="sudo " ;;
 darwin*) cmd_prefix="" ;;
 esac
 
+if [ ! -z "$cmd_prefix_override" ]; then
+    cmd_prefix=$cmd_prefix_override
+fi
+
 if [ "$1" != "always_launch" ]; then
     if ! $cmd_prefix docker compose ps | grep "mantis" >/dev/null 2>&1; then
-        print_error "docker compose appears to be brought down. Will not proceed to avoid relaunching."
+        print_error "Sublime Platform appears to have been manually shut down. Will not proceed to avoid relaunching."
+        print_warning "If you wish to relaunch, please refer to the documentation here:"
+        print_warning "https://docs.sublimesecurity.com/docs/quickstart-docker#how-to-update"
         exit 0
     fi
 fi
@@ -23,7 +29,7 @@ if [ -z "$(git status --porcelain)" ]; then
     echo "git working dir clean. Proceeding with git updates."
 
     old_ref=$(git rev-parse HEAD)
-    git pull
+    logrun git pull
     new_ref=$(git rev-parse HEAD)
 
     if [ "${old_ref}" != "${new_ref}" ]; then
diff --git a/utils.sh b/utils.sh
index 982d534..5610818 100644
--- a/utils.sh
+++ b/utils.sh
@@ -48,3 +48,8 @@ print_info() {
 print_warning() {
     print_color "\n$1\n" "warning"
 }
+
+logrun() {
+    echo >&2 "+ $*"
+    "$@"
+}

From 33e2bd90e3e98f3c081c97f0aaefa5aadb13433d Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Tue, 15 Sep 2026 15:29:02 +0000
Subject: [PATCH 5/6] Sync from e11d3865a36798aabbb5f23e03a2201bc8f9079a

---
 .github/workflows/docker-deploy-dev.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/docker-deploy-dev.yml b/.github/workflows/docker-deploy-dev.yml
index b475d7e..a1d43ee 100644
--- a/.github/workflows/docker-deploy-dev.yml
+++ b/.github/workflows/docker-deploy-dev.yml
@@ -12,19 +12,19 @@ jobs:
     steps:
 
       - name: Check out the repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
 
       - name: Login to DockerHub
-        uses: docker/login-action@v4.1.0
+        uses: docker/login-action@v4.6.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
       - name: Set up Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v4.1.0
         with:
           driver: docker
 

From dd98123a135e08aae9682ac5ff6319d289131890 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Wed, 16 Sep 2026 00:28:26 +0000
Subject: [PATCH 6/6] Sync from 43535a5629e0c8a6e952adffb2c0d4619e3e0d32

---
 nginx-custom-ssl/README.md | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/nginx-custom-ssl/README.md b/nginx-custom-ssl/README.md
index 131be57..30256cd 100644
--- a/nginx-custom-ssl/README.md
+++ b/nginx-custom-ssl/README.md
@@ -6,7 +6,8 @@ To enable SSL with your custom certificate, follow the steps below:
 
 1. Copy your certificate and key to certs/nginx.crt and certs/nginx.key
 2. Edit conf/nginx.conf to update `__server_names__` to your domain or IP address
-3. Perform any other configuration edits that you might need
-4. Run `docker build -t sublime_nginx_custom_ssl .`
-5. Run `cd ..` (back to sublime-platform directory)
-6. Run `docker compose --profile nginx-custom-ssl up`
+3. Configure the `sublime.env` file in the repository root for your domain, following [Configure Sublime](https://docs.sublime.security/docs/quickstart-docker#ssl). Do not include a port in `BASE_URL` or the other public URLs.
+4. Perform any other configuration edits that you might need
+5. Run `docker build -t sublime_nginx_custom_ssl .`
+6. Run `cd ..` (back to sublime-platform directory)
+7. Run `docker compose --profile nginx-custom-ssl up`