From d381eef93d6c991e38b941a77878e26b8e68ef08 Mon Sep 17 00:00:00 2001 From: Waleed Date: Mon, 20 Jul 2026 22:29:29 -0700 Subject: [PATCH 01/37] fix(mcp): pin outbound connections to IPv4 to avoid unreachable-IPv6 hangs (#5798) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * fix(mcp): pin outbound connections to IPv4 to avoid unreachable-IPv6 hangs Root cause of the MCP 'connecting forever' / tool-discovery timeouts in production: SSRF pinning forces each outbound connection to a single resolved IP, which strips Happy Eyeballs' IPv4 fallback. dns.lookup(verbatim) returns the IPv6 address first for Cloudflare-fronted dual-stack hosts (Gauge, api.exa.ai), so the connection was pinned to IPv6 — but the production app subnets have no IPv6 egress (AWS NAT gateways are IPv4-only), so the pinned IPv6 connection connects into a void and hangs until the 30s timeout. Intermittent because the resolver rotates A/AAAA order; works on retry when it happens to pick IPv4. This is why h1.1 (#5797) did not fix it (protocol-independent) and why it never reproduced locally (dev machines have IPv6 egress). Empirically verified: pinning only the IPv6 address times out; preferring the IPv4 address connects in ~600ms. Fix: at both pinned-resolution sites (validateMcpServerSsrf and validateUrlWithDNS) resolve all addresses and prefer an IPv4 one; IPv6-only hosts still pin their sole address. No signature/threading changes; SSRF validation of the pinned IP is unchanged. * chore(mcp): trim inline comments on the IPv4-preference fix --- .../core/security/input-validation.server.ts | 5 ++- apps/sim/lib/mcp/domain-check.test.ts | 37 ++++++++++++++----- apps/sim/lib/mcp/domain-check.ts | 6 ++- 3 files changed, 36 insertions(+), 12 deletions(-) diff --git a/apps/sim/lib/core/security/input-validation.server.ts b/apps/sim/lib/core/security/input-validation.server.ts index cfef31a08d2..5a89efc18ee 100644 --- a/apps/sim/lib/core/security/input-validation.server.ts +++ b/apps/sim/lib/core/security/input-validation.server.ts @@ -105,7 +105,10 @@ export async function validateUrlWithDNS( } try { - const { address } = await dns.lookup(cleanHostname, { verbatim: true }) + // Prefer IPv4: pinning strips Happy Eyeballs' fallback, and a pinned IPv6 address hangs + // on IPv4-only egress (e.g. AWS NAT gateways). See validateMcpServerSsrf. + const resolved = await dns.lookup(cleanHostname, { all: true, verbatim: true }) + const { address } = resolved.find((entry) => entry.family === 4) ?? resolved[0] const resolvedIsLoopback = ipaddr.isValid(address) && diff --git a/apps/sim/lib/mcp/domain-check.test.ts b/apps/sim/lib/mcp/domain-check.test.ts index 28f7bab6008..ab0616c6ac2 100644 --- a/apps/sim/lib/mcp/domain-check.test.ts +++ b/apps/sim/lib/mcp/domain-check.test.ts @@ -364,12 +364,31 @@ describe('validateMcpServerSsrf', () => { }) it('returns resolved IP for URLs that resolve to public IPs', async () => { - mockDnsLookup.mockResolvedValue({ address: '93.184.216.34' }) + mockDnsLookup.mockResolvedValue([{ address: '93.184.216.34', family: 4 }]) await expect(validateMcpServerSsrf('https://example.com/mcp')).resolves.toBe('93.184.216.34') }) + it('prefers IPv4 over IPv6 for a dual-stack host (verbatim returns IPv6 first)', async () => { + // Cloudflare-fronted hosts resolve IPv6-first; pinning that IPv6 hangs on an IPv4-only + // egress. The guard must pin the reachable IPv4 instead. + mockDnsLookup.mockResolvedValue([ + { address: '2606:4700:3037::ac43:cc5f', family: 6 }, + { address: '104.21.22.105', family: 4 }, + ]) + await expect(validateMcpServerSsrf('https://app.withgauge.com/mcp')).resolves.toBe( + '104.21.22.105' + ) + }) + + it('pins the sole IPv6 address for an IPv6-only host', async () => { + mockDnsLookup.mockResolvedValue([{ address: '2606:4700:3037::ac43:cc5f', family: 6 }]) + await expect(validateMcpServerSsrf('https://ipv6-only.example/mcp')).resolves.toBe( + '2606:4700:3037::ac43:cc5f' + ) + }) + it('returns resolved IP for HTTP URLs on non-localhost hosts', async () => { - mockDnsLookup.mockResolvedValue({ address: '93.184.216.34' }) + mockDnsLookup.mockResolvedValue([{ address: '93.184.216.34', family: 4 }]) await expect(validateMcpServerSsrf('http://example.com:3000/mcp')).resolves.toBe( '93.184.216.34' ) @@ -405,12 +424,12 @@ describe('validateMcpServerSsrf', () => { }) it('throws McpSsrfError for URLs resolving to private IPs', async () => { - mockDnsLookup.mockResolvedValue({ address: '10.0.0.5' }) + mockDnsLookup.mockResolvedValue([{ address: '10.0.0.5', family: 4 }]) await expect(validateMcpServerSsrf('https://internal.corp/mcp')).rejects.toThrow(McpSsrfError) }) it('throws McpSsrfError for URLs resolving to link-local IPs', async () => { - mockDnsLookup.mockResolvedValue({ address: '169.254.169.254' }) + mockDnsLookup.mockResolvedValue([{ address: '169.254.169.254', family: 4 }]) await expect(validateMcpServerSsrf('https://metadata.internal/latest')).rejects.toThrow( McpSsrfError ) @@ -424,7 +443,7 @@ describe('validateMcpServerSsrf', () => { }) it('returns resolved IP for URLs resolving to loopback on self-hosted (localhost alias)', async () => { - mockDnsLookup.mockResolvedValue({ address: '127.0.0.1' }) + mockDnsLookup.mockResolvedValue([{ address: '127.0.0.1', family: 4 }]) await expect(validateMcpServerSsrf('http://my-local-alias:3000/mcp')).resolves.toBe('127.0.0.1') }) @@ -450,14 +469,14 @@ describe('validateMcpServerSsrf', () => { }) it('rejects URLs resolving to loopback on hosted', async () => { - mockDnsLookup.mockResolvedValue({ address: '127.0.0.1' }) + mockDnsLookup.mockResolvedValue([{ address: '127.0.0.1', family: 4 }]) await expect(validateMcpServerSsrf('http://my-local-alias:3000/mcp')).rejects.toThrow( McpSsrfError ) }) it('returns resolved IP for public IP resolutions on hosted', async () => { - mockDnsLookup.mockResolvedValue({ address: '93.184.216.34' }) + mockDnsLookup.mockResolvedValue([{ address: '93.184.216.34', family: 4 }]) await expect(validateMcpServerSsrf('https://example.com/mcp')).resolves.toBe('93.184.216.34') }) @@ -483,7 +502,7 @@ describe('validateMcpServerSsrf', () => { }) it('still blocks DNS resolutions to private IPs on hosted (regression)', async () => { - mockDnsLookup.mockResolvedValue({ address: '10.0.0.5' }) + mockDnsLookup.mockResolvedValue([{ address: '10.0.0.5', family: 4 }]) await expect(validateMcpServerSsrf('https://internal.corp/mcp')).rejects.toThrow(McpSsrfError) }) @@ -508,7 +527,7 @@ describe('validateMcpServerSsrf', () => { }) it('returns resolved loopback IP for DNS aliases (caller pins)', async () => { - mockDnsLookup.mockResolvedValue({ address: '127.0.0.1' }) + mockDnsLookup.mockResolvedValue([{ address: '127.0.0.1', family: 4 }]) await expect(validateMcpServerSsrf('http://my-local-alias/mcp')).resolves.toBe('127.0.0.1') }) }) diff --git a/apps/sim/lib/mcp/domain-check.ts b/apps/sim/lib/mcp/domain-check.ts index d48588ead6b..e04b6f04cc3 100644 --- a/apps/sim/lib/mcp/domain-check.ts +++ b/apps/sim/lib/mcp/domain-check.ts @@ -185,8 +185,10 @@ export async function validateMcpServerSsrf(url: string | undefined): Promise entry.family === 4) ?? resolved[0]).address } catch (error) { logger.warn('DNS lookup failed for MCP server URL', { hostname, From 3507934427af21bd2864a3e3634d5a5083f847d2 Mon Sep 17 00:00:00 2001 From: Waleed Date: Mon, 20 Jul 2026 22:29:58 -0700 Subject: [PATCH 02/37] fix(security): prefer IPv4 when pinning DB and 1Password connections (#5799) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Same class of bug fixed for MCP in #5798: SSRF pinning forces a single resolved IP, which strips Happy Eyeballs' IPv4 fallback. dns.lookup(verbatim) returns the IPv6 address first for dual-stack hosts, so a database host or 1Password Connect server that is dual-stack gets pinned to IPv6 — unreachable on IPv4-only egress (AWS NAT gateways) and hangs until timeout. validateDatabaseHost and validateConnectServerUrl now resolve all addresses and prefer IPv4; IPv6-only hosts still pin their sole address. SSRF validation of the pinned IP is unchanged (the selected address is the one validated and pinned). --- .../app/api/tools/onepassword/utils.test.ts | 23 ++++++++++++++++--- apps/sim/app/api/tools/onepassword/utils.ts | 5 +++- .../core/security/input-validation.server.ts | 5 +++- 3 files changed, 28 insertions(+), 5 deletions(-) diff --git a/apps/sim/app/api/tools/onepassword/utils.test.ts b/apps/sim/app/api/tools/onepassword/utils.test.ts index 4c07ede1323..8d9e9a76672 100644 --- a/apps/sim/app/api/tools/onepassword/utils.test.ts +++ b/apps/sim/app/api/tools/onepassword/utils.test.ts @@ -54,18 +54,35 @@ describe('validateConnectServerUrl', () => { }) it('blocks a hostname that resolves to a private IP', async () => { - mockDnsLookup.mockResolvedValue({ address: '10.1.2.3', family: 4 }) + mockDnsLookup.mockResolvedValue([{ address: '10.1.2.3', family: 4 }]) await expect(validateConnectServerUrl('https://connect.internal')).rejects.toThrow( 'cannot point to a private or reserved IP address' ) }) it('allows a hostname that resolves to a public IP', async () => { - mockDnsLookup.mockResolvedValue({ address: '93.184.216.34', family: 4 }) + mockDnsLookup.mockResolvedValue([{ address: '93.184.216.34', family: 4 }]) await expect(validateConnectServerUrl('https://connect.example.com')).resolves.toBe( '93.184.216.34' ) }) + + it('prefers the IPv4 address for a dual-stack host (avoids unreachable IPv6 pin)', async () => { + mockDnsLookup.mockResolvedValue([ + { address: '2606:4700::6810:85e5', family: 6 }, + { address: '93.184.216.34', family: 4 }, + ]) + await expect(validateConnectServerUrl('https://connect.example.com')).resolves.toBe( + '93.184.216.34' + ) + }) + + it('pins the sole IPv6 address for an IPv6-only host', async () => { + mockDnsLookup.mockResolvedValue([{ address: '2606:4700::6810:85e5', family: 6 }]) + await expect(validateConnectServerUrl('https://connect.example.com')).resolves.toBe( + '2606:4700::6810:85e5' + ) + }) }) describe('self-hosted deployment', () => { @@ -94,7 +111,7 @@ describe('validateConnectServerUrl', () => { }) it('allows a hostname that resolves to a private IP', async () => { - mockDnsLookup.mockResolvedValue({ address: '10.1.2.3', family: 4 }) + mockDnsLookup.mockResolvedValue([{ address: '10.1.2.3', family: 4 }]) await expect(validateConnectServerUrl('https://connect.internal')).resolves.toBe('10.1.2.3') }) }) diff --git a/apps/sim/app/api/tools/onepassword/utils.ts b/apps/sim/app/api/tools/onepassword/utils.ts index b78cf0d511c..0ecdd9abe50 100644 --- a/apps/sim/app/api/tools/onepassword/utils.ts +++ b/apps/sim/app/api/tools/onepassword/utils.ts @@ -317,7 +317,10 @@ export async function validateConnectServerUrl(serverUrl: string): Promise entry.family === 4) ?? resolved[0]).address } catch (error) { connectLogger.warn('DNS lookup failed for 1Password Connect server URL', { hostname: clean, diff --git a/apps/sim/lib/core/security/input-validation.server.ts b/apps/sim/lib/core/security/input-validation.server.ts index 5a89efc18ee..f8532021313 100644 --- a/apps/sim/lib/core/security/input-validation.server.ts +++ b/apps/sim/lib/core/security/input-validation.server.ts @@ -191,7 +191,10 @@ export async function validateDatabaseHost( } try { - const { address } = await dns.lookup(cleanHost, { verbatim: true }) + // Prefer IPv4: pinning strips Happy Eyeballs' fallback, and a pinned IPv6 address hangs + // on IPv4-only egress (e.g. AWS NAT gateways). + const resolved = await dns.lookup(cleanHost, { all: true, verbatim: true }) + const { address } = resolved.find((entry) => entry.family === 4) ?? resolved[0] if (isPrivateOrReservedIP(address) && !isPrivateDatabaseHostsAllowed) { logger.warn('Database host resolves to blocked IP address', { From 7b8bbeb74feaaaf46bcfb65c6e97372b3f953988 Mon Sep 17 00:00:00 2001 From: Waleed Date: Tue, 21 Jul 2026 10:56:07 -0700 Subject: [PATCH 03/37] fix(emails): sharpen wordmark, add clear space, and standardize footer icon sizes (#5802) - Re-rasterize the email wordmark from vector at 4x with baked-in vertical clear space so it renders crisp and is no longer clipped at the top/bottom; size the header logo box to 68x41 to match. - Normalize the footer social icons (X, LinkedIn, GitHub, Slack) to a uniform cap-height on 40x40 (2x) canvases so they read as the same visual size. - Add display:block + border:0 to the linked social icons to avoid Outlook's inline-image gap and blue link border. --- .../emails/components/email-footer.tsx | 14 ++++++++++++++ .../emails/components/email-layout.tsx | 4 ++-- .../sim/public/brand/color/email/wordmark.png | Bin 15526 -> 10275 bytes apps/sim/public/static/github-icon.png | Bin 394 -> 1766 bytes apps/sim/public/static/linkedin-icon.png | Bin 652 -> 1266 bytes apps/sim/public/static/slack-icon.png | Bin 841 -> 774 bytes apps/sim/public/static/x-icon.png | Bin 407 -> 2054 bytes 7 files changed, 16 insertions(+), 2 deletions(-) diff --git a/apps/sim/components/emails/components/email-footer.tsx b/apps/sim/components/emails/components/email-footer.tsx index 2cccdce5a10..ef85acd95b3 100644 --- a/apps/sim/components/emails/components/email-footer.tsx +++ b/apps/sim/components/emails/components/email-footer.tsx @@ -37,6 +37,16 @@ export function EmailFooter({ fontFamily: typography.fontFamily, } + /** + * Social icons are linked images. `display: block` removes the 2–3px gap + * Outlook adds under inline images, and `border: 0` prevents the blue link + * border older Outlook versions draw around linked images. + */ + const socialIconStyle = { + display: 'block' as const, + border: 0, + } + return (
@@ -87,6 +98,7 @@ export function EmailFooter({ width='20' height='20' alt='LinkedIn' + style={socialIconStyle} /> @@ -97,6 +109,7 @@ export function EmailFooter({ width='20' height='20' alt='GitHub' + style={socialIconStyle} /> @@ -107,6 +120,7 @@ export function EmailFooter({ width='20' height='20' alt='Slack' + style={socialIconStyle} /> diff --git a/apps/sim/components/emails/components/email-layout.tsx b/apps/sim/components/emails/components/email-layout.tsx index f28e9a81008..021afd838d8 100644 --- a/apps/sim/components/emails/components/email-layout.tsx +++ b/apps/sim/components/emails/components/email-layout.tsx @@ -54,8 +54,8 @@ export function EmailLayout({
{brand.name} diff --git a/apps/sim/public/brand/color/email/wordmark.png b/apps/sim/public/brand/color/email/wordmark.png index 977814b5655a59b7001a9ec10bd1994024342d68..2c3a6c314f2ce34a87bd1cc2ae91c0c996f536dd 100644 GIT binary patch literal 10275 zcma)?gHvTTTUu($#sS&b9O864^^{L5YIB2IB}yA8nWK3DC)!u|>g{v{Y7+GLEEY;$jE>0l z3+U1Duh`fXAM3o>BNjrV5y@TAA*ryqPrW5o?<0P3sgnLikWZe@f1ZC>&{P*IwI@4D zwTTrgm*qclSo^hg6uNNzS)}~XVJ_&Nezues9VbJS?f-o^2!(}6hLtH2hC((%G8O9H z+ot2HcBl|@u3Fs)IxU4Vln8#kGsdp@(&_fa&lp-lq&6x7$L5_dkD>OpK2-ds_g;J# zd7dyMHq!Qjf;3@%!E-aRCrOBGm`Wv^5E!OWi3FP12n$oF;)ywTA9u0iwo5KcwJzjD zC=BZ`mq5M(o7k4RqyjT^E_|ZVMSn$=CC)Deds$JHUOl>`#*}!+GiH-=ot+b=z!l#)7|;K%$nWkg!V8 z?m-gHe)rrDk(yx$=8wWXCC-hLEyF62o21S1zwwrg&?eUFkv$fK9T6N$M#-=WDiw<@ zd_n_U-G#-WslP!@Z_W?#qN1X9lVK*=1!9y1?&4JNLDFRIhEyykH~{kEpppD;?}jTg zlraLq({rgOD@Fu_u2@xj5{=V83wuTBng)cKE(uKDGjKOxf;-W#7rWGI4`j%_yW3eq z=HIxh)X`yFK1l^g-Jxp1dtR}g2BXk|#{2IbRNK9#@NX2DH-!%t058MLU#z-&7Tzaw z<}?^MZzdZTd8pJ#^t0|&P!=ul`Hzfb=MFg?hozdfR$`4M0aeotE14+!f2VK_9WT1R zK42vqr=jEc^TVUu1$}q@vY_!yp1J9jN7OVwcv7c8yf9Rfh_l-=J!HO>Dap?tauB!U zFQO|529woEsQlpIfE5vNS33Cb4%EfpH&%GIq@={dXU|KHY}^MNC8OGv<2qr|xND2 z4C-B^BImlYtUELx%OMAM&FkFG#nS_MLCtn_`03h?!yPMDA=aODVw9S;|0k&-e$0O zK|K_8!v_2-LYO_!WFpmhud858^2fA>_Dk)}zrn#l=6d(pe?eA_|GVbcBQ;U5z|XKP zRTV^{(uS`eh^}FLvdud{^$FT)Ij-Zt>}aKU_mYBaS3|@h|X_nhUnN zyD}%5q1+|R*_DGhyB5<6<%mr83%^IH`ml2qmo(vKCU?uMYhz<$%nV(pcpf`AG&JP4 z&>CE|B${290A(?3uiGipo6hhT9_(nXiI7A{P}{k2epq@+a^Q`yb8ctslKzaRy;mi+mN>~ zmX0aJD=95a(}YGxM@6N|(7&7s&d-VIfp}@Vwv4CvXU7KzW7xQ>%Gk2>xdu`n$r?gy z^B^y73knLZKN%Rhje?OvLY7Ax8XC&_z(-(itxLhe32DYRXYm$4zD9kxGLf)_Kw31F z(O9i3+7X3}XM~r4mty<#-D~C8s;HG&#?1; z!^t_DGpHv^**S&}Q?%_FfH)wm=pE!SPJ42hH4&!?38&`Ehh9qn+r>ljY^Yi>u6b4@ zr0q^v6VBpLSy|bMN7L+z;;g4^l8akUZ*T7ntiMzn8c(ev#|q@GR^*7xkT&RZAVAPJa-lKiM|iY#9c8gVxpoxxPY7i z(E$sAtV)ll{cfTY| zF4HZCnTYw_-2jI}3p7IjtA~+N%G!Z1|7E-uX%j3~ZBna9G;{Rkb^Kmz3`^ z$B2eC7Ey}V&WJd3gZ|xWv1kgOmU3XOzq)pG3Rmv}Ls5Yf<_b!8Tfw6Sr;R}3ggoW=G5WUJ(2J-Oh;ID&-{LyE~2hUaci0|?n&Yj-kQz>R~_oc}1%H1>#f)ie# z44K0L6h*r&%8-q=<0X1DWc8-0g4Q?Ry&K-dA`jnz8ekYWz^xVM71~XJ*=WgrV~|b1 z6J8KxRz5kTIexrFSD(6l`vh%bkOZ>=N9B;K=Qpy-XqIT%$OlE`HCL#rdG|N9ehZey zo9^Qy>omn{ZvqydHTwDAUZ48Gb?vZWZ}TjiU#NH8me$@}b#-+Gl%D1%YfR;2_Es42 zrOe-t3`jk8{Rg04r^2GmKg?Boq~5f zb{M;8r7rrPUT^+b?OF!|Px(@M_)!WZK&9`L75%aN7W2uTPoVKeOK4tJR?skbo1TZp zo2)07urgzPBkf={?Z6l8J?fU}7hj3sWW@0wmZfeU5;!-ueqH?Q)kMG8M%E$J3;;KA zE^Q7kWUI_w)Y}yXW2ts$!JNZ2dE z%R;%Cqqh_MY-kpF#8uo&GLpT07=VCxuq}EcnifuY%C36W^>uZ(nhWV4Ng2%)f9$4{=)i0;|dWDdEV?>0~gc0FQfNtLK5s31TTV5@GC;)?E8}L zOX@(a$43-n)Pf;k3SJSWKxN1qv6#XE zXPrP!c)=vj6H|9^)}BFqp*duAM>_&w-QI3E%K|$vW?% zkVwso-a(PFPuHCkTvd;?pn3MO4PKxW7`Uh+@ONi!O`s>@hj4GaYA2Oy#(y$@o&^M! z88^Ol%S4kTn&2ZW9ohYU+o~GTSSq_bcW4mljd(O0sE-@QZ1Uw9m9G#UcHp$TU0t=-NG;yv!VtFo*7D}T&8l&*gkxn%(*^wXBN(ih59G{p8a@zB<9}k8)6xzMbSR9Jcd}fEq7*>C z%`sj6Pl7JDbs^-^GM5UWSLtd%IWwOxL?#H+&KbvBTB<+W7}1OKAnXaG-EGK{aKB&? zwEs6WQ|r3<___AE`%Jfg2Yh7jc?-Lm(Q)YdCZS03^WA}(UsalsJszh@P+zlJv+Kd! z?v6LOT{=^ye5jilt*PdB(Rwu5eK7qYtN93|9N~7fPsl+MZiRW=?0pobgrPx;dt$b|=ZdcUJn3Sb zzS$NlOv%BeP9J`meIoSB=|LbS8+By4^JTQ`tIUXx^T;x_e)HS!*w;~B zmmLfwEv4-x%zf3=RFe9-x`xk09;IX!fb!z4_C}72Z6*9zKLu9N-(|dN+g_NZ;oAOJ zg$QPA-GY$SGzY@`KioXHHHkiLnJhG)=BV}I+pctSGu1&#IPu!h&*5k5AE!u!^XHo;q_?|9!YalAKB%RYG&i92dlQx(q~_Xy3Zn9zZ9psXaE1GkPbTA)>g6ZM@+z)F z%@$#uf#FwnuGR-DFBbSto~7#=rcG(Eza;jOV1#cp%vcBvbt{G3r%ija)d#%%Bp97Y z#q$TkZNgj{ZiP5g=Ijcj>3EB%>}Akbmz^@emP*D7%TgU!p-(J4EnWJvVsC1;Je{P~ z%1;)`Ys!~@Qce2SOk|7JI6lMP@3K5&_pfy$WExxkrt1Q zo#c@N!`{#b=Bza)pPq!~e~U)cb8tBeDQa|Ce~gdcb2^YyrcsY}LHC{S*{dMdwV(qT z`vH^hSc%83hB#%zFc;*?kP-0-I;kVa$~=*6OVxKBycGAfsQY>9ICw3TT(7x+0CE&j z{;9V`_pl_LzB>zPD7R8EGIU9xY8*%Nt;}1@#aB1o6a3GE~Ap_>>0Uz4z8bZH8KHTG&V0LVujb3yVC`WowcW{s%i>jX4kP*uA>J( z!N1gZ$nqnBlt{|T-XMq(m&sq;$MHU9@h&IT9u}h~22Wu3;DhVqVwQR5dEFeH^3IEX zS}EMb_6tQTqF|a*w@Xfho_LwRhU|TExW+`3220_%vWHGQ3#Y zMv3FyUI~l2Z4dj~sV-w3$HlInvh?h!b=7vK?_HpjhjjFtEO5h)cy&sd*+-W1tC@=o8TY&*r=wmOZ&|iAOvpYJxUX z*U{qt)ROR(9s~pNg}N_1-1%jNzdNBl^^#WqD5z9FmcTFfa{K-DEnia$303fx#Li3d z=1>T}0z;H+$CVg09TU%98yxjcTTw`NdKbq9Hh{&rVGB z`Tij-;FA!Sm%pZl4_>giy=}@_ zKt;$swL?!D(Il?lx3_cg5Bpu4F6vE^f%L2G%Zbh1Xh!zRqA<5gui-ddyU_b?&nhgiGJDAO#&T zL;wZX#iPTyNM0bpbHZcRlD};63E>c2OlO?+&C8>;U&w<7W{ocdO+!szW=~&z>c1E^ z5|?+l`Ju{sDqi8B+ZOELHqSIez#Y+=^{#1}ZKbBN&3oV!miHmd+0#Oz`$~_ZuKkOK zz9KZc7)i^)FQQReCkBz!l%(SYel-m*%rA*_t9VHTin}E)5mKfQe;2P_+moy-eS+~? zM^B?srG6C2lEu!i-#6Wyzi52@zV>~w^92F=1S?H!`6**w9lbGUJ1Aq!QhQbB{VbZ5514;x z<&d_fg|~sHm9%4F6J}kR&l4gOPaZD6BNsA$-aw;%Iph9VL@Q}KR=DkDd941d;{!vr zIlZt|@p711Kv0MgOWpV7*&6<@)gL=UD5!K8AAI6+eikgAjd7{H1ZQk2HcvJ2YXqpq ze9(&lfwL%HQ~UiV1Ya+IMekLo)lwhK@gV}9$zy(^ytV_}@d1PVQW}Cyxz5hc+gkTo ziJAIcB9t+vs7@2N%KGdK@j>)2)rb8#=5OX;W|IcwaA(^!+uqs3|Ch)_~wZjp!Z>d?l>vqr<==LE!3za@SL<+JdaF z_n(A7WD(4asj$}G7SqU_^lqnNeG03(E1cJuvu1V=s9Z5+)06}igEEI9Vu0e(``bG$c8Qjp`bYv z5LSM%<2!dqrYrqe6S4XYwO3a`kP;AlwiI3OxI?D?bC;J19+F!m++ZO|BvUCqgWgzO zORAJp-(j^xn=Gv5Jok3uebWB-!}v4LM`2T5{J(KjEB@^IvM~{P!5z+Fb~{JV6m3cd zc!>;6z&yR3vqW~@cS*vNs5iJ|_if2L6G);TVqO?uip+1HB}&DGt}NWe3qu}G1?G@Y zX>nW^Qc|tEi%LjnSS@SmD@U2&aqdh5VbmplF{bvX_fGsKKRlK`2f3BpGFQ20WixNj6=`|x>Ui)RS0?UIz?y8K0Ex>dN;ji?(nv92a&ho^E zb0COPtT5(tY>0DsYE8%eK?84k(TZ~L$XMH`V=ZoWN2IKjko6Vh*G2?~Qq@$mv|wn$ z7ocFm>6DX;G2=~4XWS6BF2)33`Q=lv#uWnVHMwN!ssYl*pfZ{3dN@}L6PmZkA9H(4iX>LYVM8y?YQ ze_CtZT6KEa)_X~n!%E5pSOJ&ct!}4s9E)e! z#+d!*6`G@j5gflkpT-I(`9AQ-$jE4L+{U1d3myjjnCG9kWFv#ETRuE{hTvLl-eCS- z{`H@NUJ>w3RtPMmn95Dc#qt%g4jIkYQd=tRO9R*FlDQ%kgyMbL1`B~6TLzexF25nj zP4_sXLHQ(mLY5i$e&$DZ$);n6keoTx*PG($)>>zi(ku!&uG<`=g?k@2Oq0lquB8PG z7I>iixt8@10oxN36MvGElZ`Lm5s-8qzjaV4$bIh$X24pV)Q1JePPTDR_fES!Fgvk+ zF9>1=i2Oj@MMljFs>=%a^iT9td7lkdyMN$t_$(8COnuJr=kK(gJEDW7PZ>N7(I(}B zi7+clfbduofjD=GlEHSlf>`|1-0CKv6#Zv`qBG%h_7jt{EdQO~--eud*+K;{x(qyo z;dFe>f7qfpQ+%)3P{%$|MIi*eSiO8hhx7IEB{AfyfPgbPm&=`<9dQuPYh|9beC4oB zmzd7Ni>0MAE-p1GH)2H)iu^r{5!!E7`eudp=qu`TSh3thA=fpbZ7_kfsc73XG;fU6 zoMB~JeKccR$GoinHQFSInajgxMl(@VIPmR@78k7qsb8y`u>KDq zRoMk0j637U$XY7!Tcig|rzbx5X+H~h%i&SAX=ft%SvLr@s8S_@sCguMhXcD5jI;xZ z|GxiX%vUNA&?Z7wO;0CdD75mR$_vDSm5;mD4M%fhISzD~pX_hfv3;`>#0hh}qx@2p zA&OqQv_THWBs5s~*bnxl`;n^$$fr?0K0ZCJ=r*3nfQf0%tA-XKXraT46}M*B7T8v0 z5pN@BOksqm4pWrvTETcWkyV0W|Jf|)=t<#&iN=HURAnToy+n8S2A`_EeNp*ivRgXw zO7p)S!*X^7S+(Qgv+c`$r_D48FP7V2mYyCaI0n|I+K;c7f$Q{MG+qfBgDqa2`$q{) z8<>*jeBobk@kb~M$`v?NQNl@wO6BfjrKu8(Jlp>deS%#QH8nW`AdXf=?zy&e#BuND zfc^W!j^3W0WBB99R53dn%jbM46`+ed|G+r!JCL5P*EXd8`=}_~WZ$4M%#AmIG zNxRDnHVU&jA_M9m%S6EMg%s@?c0aa~kkit%vLp9E5~w{bRV526t9*!?n_B{GN?6xm z}Yco(PBQlinHmSbq9|WZD0kGcfqz zlNyYjVnGh|7>wc``A_2H*S|xD+)w<{4MtB7siSOfloIQBnJt&AaS3|5yFalkRKBT~cSt0{+@2Za;f%HAM77_)`1)SCM0}8?`*m~S| z&ukc?N{Kn=$pFDp>$fF?L!Ltdp|VN-M3Dy+2gcGPh%sw>P9%&SqjAKf5wj7a!vP5-9_^US-4_ozfDiGE^}+7U`5k1A zjvDn-wEf;=@7ziGsQ|cf%z-6ePc4QLN9ln|mq0`@ay8ytb4@;K+VS}gZddBxxv#dJ zWL#Fue4n!@>V5jA>?T?qa5{FzpG6eSl3CP`MdiFpSsEbStvJvqs33>McY0 zXcC-@X#DN~{dE~L8u}(*QlMz)YP2HZC~r2&e1O5BouJoKwubZ>y(b{`t^FV6lQQF| zcaYGez)GyEde`GQ*E*EYr5H7U@qbNGl?Svx0r`~ZT#!0ngpE(QCNz%|_2v8bbiY&= zj7B6v7UBi}-+&hU2(7QX2^8`!n{^^*5xqR)a;W)RU#wg-nF6xpkFYpE|4`Pei?Z=0~YKw1^|!)Dca1}4}zcOK>e_ulvtyR)_O&( zP9OJ>!C};fR0OQU6}jejQiXE{zetP3nHgD#W+;*wkTK5+e zvQ-E6X0eZUt_EjQBPbQ5zz(CVvi3QQvnvDEZ$ELIy(5iJtkf7~J|@;um7iNjHh$Xw z%CG&tmNy6>TO^3W=~tzQu!kLn_B>(su>K>egR7;brT0rqwtPcHQ_w}^l+q=;JA15IeWQdg-fn$lF8by3I6Ar{3~dC{_)z1Qoc zOV%j{b$6E6ti^aH!;<{Bl2}@_ThJYpn%)K0_amiP0sS;s5_vZptRGrRo;XhT@Of3_ z%=bLW;j_G(+di9Znv!Px=u#fk!%3G~O0YtuPxH1(SLBf`nqf%%kDY3Y+gLK18<0x}aknorAATB;a(2V@A_qiN=P&^pI zb=~g5M)O$_gb(5Wb-%JxJ3At5*KAuY3Cb%x=e~Q%#I00+6i$=ngsmQuW5cZioX~q1 zv%D&h#9vN3^$P_#8q6js91Q8Q^sF<%ZxZih9GO@?#2b(qmCov+6%`eI0OH6eQ4(}) zWaGF&N3Q!zdo+Sa`tZSX6-1AStXRb7j|`>0Bff)7@Ojpr18I;>T*}LS5Z2wUS!Vd_ z&czqEA~@wzyAmrbX;+h|OwH}rpt5_Rzx|zxDn5SYtT2{TepZg5M4fK=xwF4xcTdlM zt@%I@V51RI7!J)CnX_2R7@w%I1sC)Jbc^dxhQ|sksyE@x?i3S}{c} z{at-^2k`VI{?NBHV7K$&+WY$7%{_^aKp*+~?#)->wWJ(be=8Yj>GP&R39oqyA3dC~ z%(hT>4};lD62M*X+ni&t{EFYfus;WZ2gUG@1=)LdAS43A1(cB21-RTn zzVF){T;x}cIw4IX>#nskRTMJ^Qez!6>2jI15ml|^G}7{fpEr1GFi0LB$h2a-f>Pez zD!!EvZyIWQTm>;4X&b-lsEEBKeMFXQBWosmQVk??vApMbL=@T*9DQ2ljGV;do{_rSqk7gxK(44K{OiS z{*&U|kBF14KeuUd^_+$GxX>=PA+TMHYF59>)&(7*f1%XEzB(ba=U`>}zC);(A+;8G z3DWTZH92a)Bzbix=@*NTHQn3pX|Br|XBk-w$JV=4o+@f2ZJuBJR|tAIUin2a5*_;8 z9Ts@vm$g(TVgbPixpp2tV9XikvdKmU(3+-SDy0!+q_QjMWY(6BWYSVOZ+?41B#Z+X z$NAiwbfQv`%ST@P0-;z55B8vYv~UoT^EsBSP0TG?&izRQU&7IAiV~&Za>3yIS!wNR z^P-@}QEzaQTBlB$0E*}tsqzjt_ABA}(wg9r8Eq^UbOO zY0oo@-iJI{*+s(MX}0NXBYPbNr0#^IME{@7bKp4|50ST&(oPTYU043Hf}8&UEp>gh J3Kg61{{gq?$oBvM literal 15526 zcmV;XJXynuP)Px#L}ge>W=%~1DgXcg2mk?xX#fNO00031000^Q000001E2u_0{{R30RRC20H6W@ z1ONa40RR91(x3wX1ONa40RR91W&i*H0C6!|MgRaj5J^NqRCodH-CJ`VN0J|K0^nVu zBvPVow*bhi2& z9FPDBN))FnqE6kbva&KOv$CuEteu)&W8lJDZ@tC;E*TegcX!Y1?d@G!TU$Gy@ZTrz zxAB*gzMOC;d0Pp8h<_9>z7v0wPuYKp7d}cqkJ4uE?YH0F{=*;s@FeBC@q6*JdyO!# z{u<3?p301YpA7>uBmHcsp9g-OFmU>Hn#_yL<>QY(UQ7G+ot>R?3D2*uub&Y{H9Md1 zY|*U8O{G^}PA zs2FKuW1|=;*=OS~#GgwZW;qjvfG^CGXvI$_|8(M*gx3bsse2~j*|gnGxVyEr<$Q$M zW+n;}UN<*0(y*dG{P4rMxVO%nIr9(6x)P6x-a38y^w}`WCy8H;lzAfz@#m0Z zK1dwHyd5w9gD}Kf@zgvX(~v-^T54UzlP+~H^|U9I9)*GQxg7?5n7WUmLT=x=CO%{`6i6>F&+>`hdj1$Ia)ooJy(5ODt*Uygr(q6b5 zKXTlmt>=PYBnDBkjoN#ePWGtHJT9wU(|N0CaHC>r9fD?^)n+HdMBp5<)0FsB~n1;_{pan3xZTBM`f2=+hI-C=)JO)lmBCTRb)~WW(h*)L0T19BBPA!)$ zr8;0dXBZZ&KRS z2}VM27-`BJm6wN)?yimbIXhH5ggNFxA_5J;?Zxyw5~XxrJ=po@fBxs6gqa2=p?bM_ zfEmD8jFhq;FjzcTlU)w13$Ue}8uvry;e531tQ3!#%HVMC-o3rMckhmK-0$X<`W+`X zf$CL;7nrMHo`Am)eQ9%fQARR}wNF0zFn2$ttmZUU~1llaM{(w$rpa*nx^p*=6cI1B}Kc{OS9VlvN`z`2{U zvd$%0uqE&N#BT);_Y*#dC*AlbnOohtOZ=rRX8L{+XMU?RixbE7ivYQzZPU?m(W?BH zHkTJ=B#76Cdu7Em(jlbvFwt9yUkG8IOBu`8T6X63Fq{XIr?YFXCB%Ft=Sipo`fkdT zy?;X>2mf1dMy`MRMmbUlfHv>201sEUao?WSUiN9*j zI&NIQe*N_J_I5E7?Et>N{PIidv&u*!@8@(FW$pLB|NZIE!&-2?z&Ok4tix_ztn7{N zL}+F@`4?rRwIIKkBSc>el+MqD*f%l}w*%e?4SB;9Bb`d#MivJndE#FaPrMKI@@vOP zSkGTl_hH&>hF~$6Ge#|Lm~_?7X^0nbI~Olr+{!q2!w9T)-~qea+?V6s0Pph-X@s#c z3C~Op_6NzkA7Xrv^aG4GlL4zRl4hf&jJa6G*$_49MK$ss5EJ#nxhri?%I&yJ`s-i+`cB5cM2PBK#w1a%Bo9MT zGh5XxCQ6#>CT@{1;KS6r7yt0iojcon@=s-F7re@@)N<yOsy_vCg;_J>@78k>9KX~wfDy2OUt-X-fuH%Uw%N0DC4@ORve z{^NSind5q?0IrNx8-?@$>qh#v`B|r0tIS=WyYIjM{!U&ov8j1rUE>HNtvp~J4MgG- z(-f^A?(sMp)77)&WzBw6o876QdV!1W@640 zq){`{DNK~basyhs?mJa?chVj*TJ`Cj-+|v^ZKm9~>TbRH=9}L0shbG$QdU0j_2kq2 z0%D|(;?|-|Z!nT%91@T;tQ*@a7{g*&JVXhP5H4)yD*{Nm=b7jNO!7Cr{r20lQH5Q0 zWoDn&Rll6M2A;jludIQ|G*&P0G685)a77Akgy7+=2rGRQOfdu%@ugnnr_M&osN)-1 z-(oUNLb$tG+ubl(ZBX*sr;OSPF1QzM1Xi}Y#krF?^Nam8dn5f=ZPS?FL>|VNbNnSncOIZ1Dyz$0X@P`h$DeTku zerbM}7p@SU{BwB;?W`RNP{GxiAph+k?A;*t*BK1c@Cd*{eHdRxg@lO7q%Ndfo;O8% zV*0N|PFTBP>I2M~!vYj>B;Lf&R-X_2?ed=2UTc!H4Pz<|z?q?nR|=OYw=OgU`2Aj(z7gS* z#HrtZ$+)*N|N9B+N)#M@_uY5ew?U@opR5IE?2X{$-K>Fkzr4pq(w|Ge=hKhZTHZI8 zgkWd9LZ5FAVKLsMNAqfzYWwHz^kq%p3CuQdbNNP?I?lS_R`zx1=}xpC*4HU5S!)}` zf?Fk#)~;N+awd#)?(yTtwR44=&u7@gYKnliDCM&VJ=AV&b)+2`e)}nZ(n_*{B@qTY%{TPho(s zOX>Tg%<0p_KZ-Zb0hfL)@MbpD)2Vwp#9(ptuRl8~g4jW{splN|W^nOl*6-t#|83@Q zHu)FhNgm&$_*L?ZWgU}UuZAeA^^zB#D%s}KZ+sC_lENn$XESxb%ow#%q`h_8N>n<@85q1H9bgkY!hPjbOAT!DeL7o&R@%pBiHzZcV|4d*xU=*q)!8?y4U7$;wR z>h>3EKc|R4bbWayfG=B zNoZ%z*y{+(F2MwB(Mx4Z+CuQZ5+-ejs6G=KtbL*jPX4l+B00_L;U@$XaU@i3g5PJH zui`C`G$Om5(6<%NhZ#zOCEa5Pr+p`R&}9)xO+=5tE~YP%sCMzp-<;~BC&5D@GIgmF z2oE!9XB@<0Auyjj-h%h|4U_W(Mnv3KQWwF05)ZEjT>3A=Mqs)VCVCVCb&y5`bw4n9 zERIj2lGy>zYo0A)14WT%g3fAPAW6!1Vo;F~IYYbxJA{`N*KB?Yd zYlF+pjC(I-4+BfX7I2q<#CY5Im z^k?IswkDcHHp2wQIFhSLPikto5pjGjJBo*q&N(J_!KRn6nZ?cq;f272jigCe#Q?P! z)6BFxfXIx|?Vm}2#vI1B8+Bh)7iT(f+ELmm$9xtahPr;Di!O*O7y?Vr2~!p$r3|s# z32U5$>cT-wB%wUz7D^x0U&2G(Fz+76S{z0U2*n%_dJ+4u(4<7cKpGh+<%s{y;Grz0 zNg@~?TUC_3%19Iw|RwvhAq2TahyGZpRmneIyQ+PM>3e%US$F z>SGqn59c=OVyeVz?n&1MpENul)lKIsUYljt6&%rFKc*VQsz=@M;SuMCJ70hO zwbvQ!KKx1-q!k>g52@w`9y=8zGBmuMK6~ED+E-(f*HW=10wV-V9E+dF1vQtnhl9q0 zy6agixQE*}0_&T}vuLYatyAXtX8JVue$Qz=X%d;XVBNsNY)|4)?LLlowlJqUBPBG4 zV)(>+?R)b8YrBf4Zo@Cszd2wUu)=%e%h`h(iMh?i`n$wS?Yk9Kb}MIB_(u=M+qib^ z+FOCOEV;oyYwx*8)9cAAxKjt5Bwwk(Ns~&o)(J5Jyy$BRcakez!Jm@p2CS|5_$Ei; zC~(xdFR)yXU(5N(rU2jIevma|Q2I6=DRsRG0~Mj7?Z#GAQnVJ)KZS=Fw__vg6MeK9pS z5polooparengwCF@O-8gIe0xa?96ErQ{-bH7Ezd^GlBCA1~}l-Ct`Fiv9a06Y#_|f zm=$Behc6yc*D!vmZ3%6Nh`R_rY4DchNE@NGR$nhpL9KHN!lYFxGwrloL2Ma!1_<2 zu`gpOU5nuPQ6f!%!Uee0Kqg=jdZ#xTc_p3Fsd`Nyi55{6WU12*VD zc(5YSo|82Ohx7tGNgw8x>q(opHR$=nk+niIaA+fxMtsz=lF$hq>}dye=Q3sBOIYAyIkL7={^?_l(B_E`S2iLp(%pC(tn>WoCy^ zglN|jBCJv$6P8&wd0Y|uP-j15-xO;Mk^r$Fo?7fwpf;R|--wPrMPeha`tSps1m*@& z<DPm1%{@^^!DJNB@;~Z9Z9M4$BNkx8@lW#+?kztrJ(IyWpbskDyhw2p3C9ihy zp+ocSIb%w$)8fl8OSkX!R3E`*C?-j!^|!Wm^M{c-~0UXA(HfY->0M0iu z9~%Q$8jq(=M{gfHNrSTyza|4oq4&D`(W+Ili*-jJ43sPrp?W|bATWtRyyRv_Qf5Fv zsVhFJc8OyE%=IAk5sQg}LFnl=W@@5KR!vMA}m)qZGRXYItTleo>a=_ttpz3H#h4TnuI z)%W25UedK$$(J5{f`Yx^t;CN%n!_jG@uDy1y3lLg>gei_Z?`CyI8}})Hc^w(usWKA zRo74IVGN9OD;{%LI3Z+x9q%g7{V;>mrI|xWy*Zk=_GVkaC0`kWpze^0MHqNFb%<0x z(NQu&OfRMooOUuyhxx$bc?M?e%eCroO+c%5v;7*c)~|&&M}$Y}f*UdrpIx%8S>^|S zh3k~N?g9_e?Ga{a1PR5tCZv(T(zYdX5&ckSif{2w>w{};0UQmV_F%pe355A=oZv=x z&f6ue61VoX`6c8qP8|ir=V@CTSL&lp^U(fcHUm<0Jz@2q_^H!5U^6PTYu)rWY3$(GpXya!$WCXyAoA|S zyJ_&BhmiEaI2P}_gkE%GhBjFaa_e5$eli%?x0ae*ASTLP< zT~|uHcH)eIaS+hoB`m}yUIvKN`8*4FGx@t8e)yrwuX_=~ZUJoFxN(DuG@Vb9FVC6l zr1yozo8+&Gnl~c+H1lGLZ}Yd!#0FynhN|zvbwao%0j-gE-3?3{Y&DnEq1q~IqE@%yN}2V;42jnBEbIH*v=^FN zZTl%}X<`n1X*F55?-Kt!ULU2=qz$ID&i$AL4Pa*1iV!|niiuK}1rAMrl6>@nnZXT4 zbT2HQGWj+rIOxrmDL+}o;0#(|L+|Bq+$fQfQwP1|nHV4-Y2>_* zC!vMA83Mi+GcQCmFo`Y_ZrT=fp=;ySZV;puBc;!4iL*MXgJ{&@A(9%I=Cx)J2v!Sk z_b7%L*&vmS}B?%eX5z(@r^OtuU8<>balH zjBl;X!LzwKccwhiYG{7wMW~}b3Xn!NZZLaxuh; zB)<*tZfi3;L&D8GslK0gJ#g)mk&;~L0Nw6F%!_#hbCI<3EX3V4V&5);XliFmyk?*L znsD-M1hB({6|>bjB0Chr3TAW%Oxbii&0b}P%9@eHi_pv=&KmJ`9!#j*+~5YDY-AY0 zj;ft|WWFmwI?J!OViRW(EDNW+^nu}Qh-KVJ+F+ywHA?@ZI+b`iz$7xoD`Ha*jakR0 z1N~SRQmSdq5b82e2wNq^NbWB>bKgx_&Bb{uaW8=03Y_)bz?5g1H{i)8K+0es3}Xx) z4lo>iX7utn-2h))_UyHFnPFJmk>7BkZ(^ls- z=}gAN>lU(j^3`2n^RcI+MYPvXAu=I#Mt{;4*rFJl=afyyoR&e9or>q2ou&(39sELm zdhr{6^K5+dTH3r2jb~3n3`NzmbGva+2W12Z7s;pE)!L@KRV(<$SfySi4)4|j&D6Ri zL}-owM2m?UE@`ge)$e}JqU5Y~O95IcMo%34;FZS+_sY7!T?-iidqHcB%rQmQAko^<&7sZ}!sKBlIP(wda6;0!_}i}wtl7nr zF4Zn^b&LVu2u6GT=)*e8OZB>aZVgDCa>;MHY1}r$KNapMYi+q#jV~JePv_tBE@kfp=kylu3I5u+C=@{}w-XmGg9U3*cfdL|FKm zOTt&#^*X?XID)n&aCA3$@Z{V>^|4EvHx-Fd;a`%LSLceXjju4N*Y6qCHxE+I3e_7- zitB|suco*U_lLB@XwDe$jb<%W$+Rpa^oVUPeN9yyNMSz4Nn#9M+EDZwr_3laf=$*#{ z=aQg-vo{L;{Uk19kKZ^5bDQsU&d-9OcSH56U2uY!s4zCN&(r@`2{Fv0^lw-HE=HBl z6L&2K!CEs+*lQ@xC422u>Kdc)k*?hpL~w}bF9jQ=q3-A-8@A5vCEqZqTOtF^HtkF#T* z&idLh3l4Kh-o=FQqz~$uhru?6_cF%6N{IH&uN`>#as&JfJIv<{CuQL1a>P^zbQ!6j zGhRNVw1WV^nmDV8IByXlz^+hV(8*VGAmdc7ns*z?E9$E7j}hj~!6srs?*%VkXTF~&Z5?bPk3xLkhtR&v zEAOpMz$*tQT&KmyekJ0JwVqeMeZ!(8VesZ2;-xT{HFs;prCvLEt8SP|-}==bUuUj_ z@XsmZ(ULVR6+C@W+ra*9nCOf6Kcvj&>>1<}AH0btY4zXmCtCdoM>pKKpVIF}E}EWa zMGoxu(l?miPQQ!>g{y>UqWcAR!`XNdnu9rFIB@qyu*fheXoS?xl#Ww>blq`H#GriI z*cr%EJH3v_&c~L=kJMP1sJ^@stOt3_vvyO2(PQ=GleORqJ~=>4(Eb;BMjB?eupqG!6qi3KNMJ!>NA^XRNho2Ji;wYk57zYa3LYvVJA6qg=OgR5liTB)VI*@oY>X5g>ehpYy}SiL^(#|&#wcNt z`PgvL(qVMeofbZlK#bH?yi$azg3gvFROwWj=BwKs6;d*|JaHnlUad}^j=OUeo&{X0 z9PS1fN`z;OLTK_31xdJScbawv>2}UG^ExM#T97{MCd>1iwtZFO@CojM-8>R6pLnSn zLYtcW#JhfyC+4V!&}RpSQ%r^qth;fKidTKq`AECO%aD-JCTXo}oXo}gAGOakJ=_g_ zI#0O>&>Jn7;SOE#T#^gd()M!~c>w&KUyKCsa%tQMSzdraG>0Y zDqsQYjFfM%wd5E^I99M1wPZVIt1Py=(?_2Ze#FMAUS5s7Or=(>r7`@|25cs^b7yXhJf8A zx;CPyMq813chWE1w{gLy+((1M)+AN-B}_t$NIf(s-rBT*=yAp>Yh1>uPl6%*)OlWK z4h&dmvn+a<0~|3zIa88+j9Ku9)=Ax|Nn9Q$?0GgLR)NDLj%-&uSrRIBUWG~PoNftO zh1|p)M9&AnOMHOy?K%f)lO~>P0z;VK$gbMOvS!Bvh~3V|F}6Y+;x&FkjBFtfxWKEe zdwmYCx579i6dimo2T%GoLrHB22O7Vc8Fpxk&y35;Wvx78@nrv2;S zR;V*b^5E-vU9X|nubo#AI9#$6+PZCW)}YR?iM#jbA#Q6Xs!g5#z-}(z#n+iGZJ4*k zYYquLIA*5z0NpppZOXmw)BcVc-?1_0(`8h-`jl7Zu@-uIkU1F>U6;z1uwfTs95mQ; zC{1`Q(2g^QU8`K;LO&)tt=JYLgxiGd?BS|}Yw}kDlz!@dQzpNY$)C#m?Y?Q&%$edN zyFysL5^BNpTYwGW?R+Zi%OK$YWSmkh59zg3!VuSH`YClG^}xdQVs?5z_tpKiv4Pd$ zo1ulIwTnxC6@MdZ@R!^q`7#@Xye7EDz4Y_AZdZ892P(JnM+07fWJP77c9+ualiE-R zdhpuKTN!NS2A6z{M;c-BFXGLIWGV}A!mnB9LO13iuU*fn)5i(5^+{^|!P}|O5b0{O z#TZ}5n`5N|1K8yYN!O+`w2#K68#jrjavDuD8rW%GRm=}!PW9rpk+7u!!w0$bfHYwr z@Vo8vhTy=^Q%7yw&CX)t4ac;6j0dK@Ec}yL67@0N7}QzrcWn2HMogy|DxtaC9NGk1 zucDAb$!k6TX={0$DNbpj&nfUWWm~ z%TKPGs8W_ckr!}aScYRaf9cZ1^31NYvpuuUFQ|gWoidZfFQ4^&5-DBG^)ly^ahzRu z^Rb`0b&@s502bUP3YH?&r@+u_D%6(8kQGl@XW`@(AtyXZ*JJx+SxB|cU6={p#!V<` zW17n{?a6N*SSTaD99Y{GXQrcmR@C_`!_*_{sCynz`Ff6rRi5?OY1V`6^HJ{}CZ8BB z?#={uqJ038cq@xc%J(96jXh3Od0ZoN0qFgrzpCHHOBr1>bK5D%GRDyqP?R zqvIzim!jGkriXuH@ioDO+<{5$XaCjw+KAwzcFtgKstzH7pA0|78eqXZqk5UVDZM;( zVf2w@uMNRmQrYG$EE;@j;}a|d$1rBiCGljH^?KD@rVKQVpYm$K|Cqq#g(y#Zucfp1 zl7BUxHKUzDNTGJ_Sz(<2n0(?H17Q*f`b+ds?`$RKqe zE+P1eK%X+ODqvO5hTx?<^v1}bubn*qs`97wabiUow>Aai4>a1Z<}@QMkF}B>y%mZ3 z%4L3a9X+9iBHA!ni?JSn=$m%7ynua<(hieg)&#-a{=4$Tri-#{^bl9~xAL&nhw;_7 zK*nd{-pdW}(|JBZ{Hluy{ll6`j&LX5h}X8`iN2Pu=QoCk;kBIUFKAL!vymVNu0*iz zr(qX23#1H%+^rBChab%^94`g-t{9m!|GT+wi4gN3go zV)C@}E{VFuNC|g7_~3(jN}akjcFOBdza}@%o5)hV+)5a`a1Ngf1C8Tpc&v_w^{e*c zlk~CrdEUy)<1MGt?~&=opH{gZQ7#1eL%f&u{&zgFdm{xcJ-qbfyWhWxclId;NuKK# zqz=YP(fCyvh6rk%kfd|oVu)}>bv_nzr5cfHhOPBFCRSAyb_klIe2J-e(AF_Ry;Tg z{~b0gM*(1f7wpwXhiTgkb(C&Ss!ro>IXrUzBnC@Rx%_3}whx`hf4NViYu>)Z49+(1 zC#07%EXadM(yCRsVx*+|+(g2VJ_tJ5cD zIUTTMyk&n>5UQPx0qk)$NZyx$e%856=5^G$RK3$thp2Gv>MRlyv`=ZV-nm3b^3=1T zgg!-turZA@lR69vI3>|C;kC*~k}V)5#f8As?FC4ca=pXJC)O~Qw$5m7=Rz`uadz_2 zNtYds)7C3DyWK!PAM4*%7GqD4dVBdyaqZx#TYV?|CA;3O8-E@Clyh2uAvhlK3*X#P zf$6rwi9d4tqmFZgdX2~B@CZ%!tB^=`w{|WhB3KfmURh2YBN;%ti~vJ=I%u*EIFgFQ zI#BSe42uzmnJ}wc#b5#_i73S27!?y^X7D3(DL(6 z2qR5hUjea0lsc7NUOA&g-_G?Q4q=l92w5Kpx5G9>$ZMZyxiUJWU3J=-L%1qWQTNep zjY)kh>tXs*PK9(f@`qhsApoyCf4jM`O5!%5O*f5X&u+%R$zb3BBjvr1-H$*1*o##U zsj!GPM9D}%GWjOAS0|XTJwVl7zSk&(BmyEw+z4G>r{$FiJ#|Q#kwKC#uFuXZtA+aU zZOFhF`e)Jeh0d#i1v7i7>&d!*v->1Gm9w*b2ww* zxiN5nki>m=7^WLX4t}y2aQq{^Q<|r_B93 zUjf3Tq!4D&u9>hUTC(^5nS1s4Fw|z4OW&@8tPLLl zNtKdN-KX^IW(>R#29_DAh$~O8?|$;hCqAuJ>Q)GHJ@GTK>YdGw?`~c(L1@%pW%@eH z-z3jrUw;^d6uFv^|Uc`D%kmJ}1u2QfVI#^Y05{V40D0hq!j~&X16)#R+|n z;fcSH455|^7Q*$Al=rSZ;;jd&DR*PSo08NuOhs}S%h{z(*3AShi7K5sqf6aU)f+Pd zOB_aPW>Zvo8K;?+y624NLYKc;tnYrSr*d3}`>FYN#=r|=U=<_j(vID`b`P=cqm4;8 ze-t4OAAyudwPK*~fS0wcj1#0)^6L&=%JfJ2lm#v!;;(UpNvC+FTPAvGOfTx|8?csa8}k{rUI_iRASOgpARo zy*=yZgb!L^y3z2Eaz+V;1B_M%hQz6l9{kGdGf}GTtAs6 zrD!d;Bm5ujnS_YCh&{>rrb7rCkyl;_+!;zf!$gWUFc8zaI)9%y0|JI(1tf8Np~h<) z*Wxjiyc#2M*OxFa7#Ss)z<-;#`+Dz2I$cfLH6vG_d`R$f*!!vxNkigb z9?z2c3BRsK)h_XduO28T?H~K7bak6Op%1eAz~PxZFI$U+vf)k9>}Cu+9|n%gNKK?Y zn)F&Me0KCHL5g?YLVhlh)<48`2N)@4^^KgheA9tS7#`Vw$t$5}LtbBI{i6;lbe3XF zScb(oQ%fFZCGAKo^Au7UeZ+F3$4dU}W(>SA1`rq(>L{)WciEb!?U7ZZe5`SKEX2PN z3*g8|kzCu67@P5TL-U>ol~hYm=bkVJBf+wosb9>~u9zovt4%VU**xPiUj3)6eiNTE zdbgd!83V_{!0DWCj>Je&zjmVrVWwpQUX^z&AXE<1FoE~Esa_GtS;iTL+DI(}CrQM3 zAs-yeu&iPVd38T8{kNrXR4r3ByBPy7i~)Zp^|vc}Ss=&|?rv0}CwU<2hCp2c4Uw0{ zE)3vPu)e~A$d?IwMb`(iiV@TOX1u>(r26gT?O1Q={!8+_Ho@}dtmJ0IC*Vo=HyAHr ztEb5>Y16O^)5SW&h0Cm%kD-D2o$=wk_m+~^^%I@ljDhFFfOEsg&uWTr2UV-ypbc@8 z7+&vw5}Mz>e*OAGmtE5jqHGoLS>1MdF;d$1nM(eXJfqr(wEQ-Ne?McpnZVHCdJ(De zLE%)7-v8FV>b~6T!jRC~8>WqZI5M>i2CSgu4D;V`Fgy<%= z=RalQKK9558#EJiiS%~V#!*t`W38v`Vg z^T)DlBI^(%or*f-`(-R&WeiA&q4tvhGF2onG#u0TGR%jiG2G|_a(JmO_8pZG59@c% zpD{3EfP`^#VCsrLk}+itjN?6@d%3CLyy0VdB$Des52J2<9Tkl9pk@`*O*?$fIHmzZ zTiE(9HtXKrP}b7L5Y1%GbW}Jz111v8jc_;5>-Kq=zi&WjJG&VJFN6U^`J3(`L{`KY z0<0U;$uA;KJ|gs`p1Z04Hb#<{&>uwIjrHqaQkR+fB$)^-%=2!Pv*s}pINLBfkfhQh zvnMafk%v+|N+Fv7Se>cdh^VtwLisJJ)Sumqf#=2miS+L#twUS&rYcjjvyLBVeI7C_`d2%lOQs+t<4PzLfU`$xja|oX{XiFWc95t_1x|xZdhPAouSQuDfq!1e7 ztlQTKF-%FMA*3GJ)ky_RMC~i-fY=lFAaz+HB>Tl&`mWm!m?}M0d>_ms_gjpVHtAwC zGSCBOMmjPI=Zeq507mk5Yr8skgx)X^ue^7Dj6)K+vnKA0K?U@Vk7rSpzIN?eSpoCm z`|bRBuQL-V&_vr|vc|k(zNm%zWEu1dMw!)f>*DRao^c`1W9!y;#_``xm*a)%KTQN0 zi}WegF7-VJbIx=5)mM_XV}YE)mg3pX7ka zYenF3)yJz9-c7D1B(6Old$yxuZRnCkUC@Vklo_=%V05beWAmF+OVjS%XcynA#nA+?Y? z<<6deo2axtLeTzr>~y4q@8#*=-@H&CG1l+mKTI2c`9cbjOqWykLA+0TIiEE%VTkF2 zT5sGk*?$vw{*=%^0)Cay20%L9&&>%;h2ds5W8j4_upp5_teA*oL0|~3cWcCou`r%^ z=ObM8NhE!_7+Pnj)b(+G(x`mm+U$nGJcH7g^j_4rGa+!&r#@T~7?fQ|9tm_gOm#J5 zdMox)Jk=6IVItDAnJ7i&s?Q;gLCk^V@x5~AyZT5=hTP1Xz0E{Dm!a7l%osR62HN^o zEkm5eFiA|AsC#uEj<5A>Lf$0Y3#H1&^^z-ZbdcJ1B?vFanq`Uk-Ji@`y)tNfv?m@Q+!m3mY+ zk#O3IwWSPL7TWR-e`LEOV5i7=@%5h>)A3C0CdiR$SOg-hZN^=63_ zM9l8RFn}rglT;|)(^p|L5rQLyIFf_fH6`GVlREVpcS7eM1W$@w3=v~Y42NJ@6O`+> zOwcIV>?aOnEzfrdfThNWZ>jvhcPvsNHQgy-21^EPz|@iK`c zLNCW5XpU+~rK{&iNte_~8i8I(QA@Ux92&%p@zfL7mp(|J?$>x2)%cj#IGC2}I>s~{AO;&Z9fr>aO2 z4=?TLWeiA2y_%YrHERO|snraUrp0jbNT%toKN4>G>Uc3m>S3OJ&e-p_m@D;++Y(Tf zZr9^!Lo$(sw-fqXObk=z_~hLWGx?B8pNsUtfopa%22KP6p|8_-COsiG-g6;pkOMjb zClMF|oI^$ePJT&~gqUV@sk1UZX0C`#+jQ}&yp&NBml+gXo*R)u7zykc$y^@hSymZO z@~307r7j4W-N|F1)uplL5Tu(2ZMh?rs7~r7S|(~lDqVRRCcpYgy&pMfpUJA&&k{EhCRUiKK?H{O6R_M>MZ56!9Er2u3DX0GB|0)-0l3dpn?r`l(*DM zwA_^0IuG!p+BlgMbxl4vz{z7EW^I4L*?G59?@rD_-v!n?Df5~{{nZS$F3v~u$9bmR zN|$rgsS6h_cwrIqVc7DC*UNxu1Rjifm{V3#J8ciEGv=o+mB3Xm9VT4aclxT$A>|}$ zZ4TmK9KvVLE%i>+4Y0T6wTLfp_Iqj#@2WAYOx+ZMyV`btLwZ%amzFodW8>4hgR|Bp z<&G9lb*G1~_jILAA8JhEMpQlv^?f>It;0yHXYYkj?f$H0uJ$MsmrwO;H4w8*jRaHX zSzxTRDPl@{3{qCOWI-?$uKsl|A*9zLC9F4fllNVGOD9a@CdKC%DBd}b!2x0(hB>yM z#Ym~U7ZtD;H5S8?0OH~l!~#fukx@wL9h zG_;{cvrZmx=|jKOcR*@f6vGd=DuO=H@FiuKQ_j|B}ypPcYWE@Dd{QGNC72<%&pBZ)BvdggJ+Jg{gyh;NAveeijVASGi)M z6nL;)xJZ0_+c)thfF5I2A19g@IGTZk7{U(Tu$jwr^PG+if68rirEw%|e8EX?3O~tQ zhVcsi%*h1nV;;K1P}XEWVf5A2xGy+m2_Ez1mR!ED?r!7$QaRm;(`1+Ynoe zYw5P+SzMew1wt7pTU6F~N!#`H2chy>l`1P@%9_}OcDqM`sU#03Qa`Y{0kj!|0$6Hc z5}u009n}ZvBe;SIg1O+pnXz`vv@J<_SRZLqDrjJVv%{*5`RYZLHeR(8j)jv5F!Y_Q zf(LBk4Wsy^`p*&_=3BS|Z-6*-E<;&RyRynp27lvmGGO6#fXiI)K;wQ=?O?Qw1WVaE z+lm@8l~h|^`Hu5X=RRtWO6=Ul6d4dPH&Z$*S!8uaf=--Ec2VelYCmJFm!evL^jkY@ z#sY&~4)YMRn^`cb9Z!|>HCFjMQI($LWBzs#ZS-?2;z~am;;9Flg6$do)jE2+_3;&@@c}K9VHO48tHn5JpBvN1qS`A-5RFnt-jXt?c07;8Ca3IRJ1B!<5%$ zSuTTOj1fta8i=tEA%u)|gis^PvgLKyV=|eDXf%3aXlUrMTrQ_A36Q2~Vqjq4&5n+a zcU4sdhT{42=lcqU!d!1}?;(f7u@izH;?Qs<90(8a!bK8^#P1g_TzD2X@7lF%5@W0| z3`2**;RDBx9eW-2SA(qRB2ez}csxAMzo8okrPJwOXJ%$D&CSh~B9X|$?d|PdR;#ru znM}?|l5|s5Rh6b`x}l-r9*f0tza&YKt5>gvpyaGrv4Zk?y+`bJ`{Mw$X3d({JRZ;C zKp-$#)ku|IfJJ(GdOl@YwnBai>>$^CP+oZb;!9f;_#mg`ZWn2Jb zOyu+Vf53sjx&dvto}wtkaolp*C>k85{bll zS(YIy=i`RdYvk=>tQ+vTTuzBZBHywsiwwPx;cM5feWq?eJ$rY88*~`RMidMN59RZD zZDD!96#{(WI()xaEaFfoG?K|=!X!!3pcCR1IuW$Xx&WcHFbs2_ZUKd+X;UN;`Cbr& zRK2Zgp`_F4d^8$8sb9S837V!`IF2(D^#F1l#{nCB)@vD>ot^y=FNN-J!P#tfW?@MJ z{V-?{^#HOg+o-#toFK4fHk2g1tA31gZM_G zC|(>NA0Mv3S}RaG_Pa5(z=`udKoTD7Xv z7_E#4U~M+rnk`$l46j_da=$2w83-3+zy&y2mNR2xW6#x^$}0kb1cSk`SSTUcC6UAP6VUojdp9%*;%{u$u0^^4?f1b~P4@{RU+OA!J?vSDqgu zk;n(*#<@I`x zZ``=?U{g~QBuA-Qe=e0ulA%I zDwP7zd5gnej^k*L$Fr?eD&<3=(C;wT-_3s(mStI%<^L{!0XGEK$s^9q0RR9107*qo IM6N<$f^&pnF#rGn literal 394 zcmV;50d@X~P)kdg0003|NklzCoTndHH{P!D3drvGldL1>r6P`D3rmsRJf*a4OX3M zPJZF{B+0Ok&h@rw#QJ_d(PEeGYkf8^$VN1RWUI-nx12UP<+7t+fT8FFIZXF{}tnIR1hZAe--(^j olOVXZ)*b!~g&Q diff --git a/apps/sim/public/static/linkedin-icon.png b/apps/sim/public/static/linkedin-icon.png index fd97e14b0c4ce8cd3f4baedf663580267742c200..2385697d02150b607c29b57375deb4d4630e9fac 100644 GIT binary patch literal 1266 zcmVYhciMvF%qTCf%ZS{z9jIRueQe2yW3{0EbeLkNK!5-jJCe~^Rk&QatP z5(2qQ1Oka5Ys+ZRHp*yZk2Fhf(^J*m6`nj}#zw7Z6iLKkJ}A1o-kaB7y?)zBQXO^F z@n!@03J{Wn5K>Q1Po%%U|Bhi8hg(})8=9s${|SPC>FMcr#>U3Jrj*{q81qaf^Ls27 zdw6hgpjRK_Dna}N;JMM!(T9C~efKQOk_aJEOH0dLA%vKloBP6XuE&wsPXM2l5E3y> z)39yZFbqTEoZCG;J)bCw;`_VHhVP3E!+1^z2~$cNgb)tKn8>mmV2mX%oyA26Zf|d| zA0Hq80&x}$1|xw$AOzlw$K$iMZF|x+f%pjug#w?SpPxktg}b}EKd^1vOe7MIVzJm0 z&wIg7TycW@V-{nKB}yp@27?5W!!%9j_2fY4bQ3_nT2?vCX?qtY_-}x!N)RCgH8nLU zaIfn+V~mOOmMLF?vMfuJlaqH^TU&42wtXnea?ta<(&6FZ(|A0-3!hn4RWvj-bgQeY z>s`iJ7Gq2iLL`w${F+QAbDf=?jiaNZ_nVuW$0?<)V3%{A)ph;Pjg5^TcXxL)7mh(V z^~lJ`R|5kB_w)I@qpB+5oJ(tKYY!5M#P>i@Q4~BlIQY@T#Kd=oVVu-T2n$`;??xh# z!ua_3r@g(s4-`d_Dsc;5gD~mr?0kP|X=!$Od3pUTPx=xBxUOq(&Mn7rELoOsz&&`e zTE}r58|0jGCP`8VUe?{+eXpaVO)86v7zWU>su%&##09#u%Oh7-M)bB$G5eJp2f*j4>$`3bm9Ed$IsR2v5^A zD-wykH8nN$c`}*&vLdUAAdo4$AL=D8Utf<~gb>1&1sh%&@C9t!E|u+s2q6vSAAl~z zx!2g(I1-IU8`9~taS;#J4A1i%MN!D!-rnQI#l>&;_xDqjQh8`-Xnba7=BGd)5apaZ za9GdtFeFcVdwX9xonAZ5-lg?aubc(Y5_7rS{KCS*H;F{zuVS$%U_@J4S@~mib@emb zwvQ;K5DGvNyhy|0aMaK4r8a$p(8)?BlTXs=bOs1OX2TxTzMY+&-xy<1vS1Hl7Os>K z61WzE04OuLT<)poc>;(*@K?HuuIrlPI2!0cqDbec$5%2oIgVqyt_$7q)jxIuoS~EfDT)M8WWV6{@nxd%_is<3WY^zb(Ur2i^bv%7+#CT;!({69mf${TU$Tm^Z8}ypYWH{b=^`Xli8>Y zpPX}%N~K~#h}lx9l#^vy0WTdL9i=Kd)nJUdo12@D)9LijjIkW0Gz{dPJ$n}S<55Q) cb-d~L8#&j&pkG}%RsaA107*qoM6N<$f|p8Bi~s-t literal 652 zcmeAS@N?(olHy`uVBq!ia0vp^3LwnE1|*BCs=fdz#^NA%Cx&(BWL^R}E~ycoX}-P; zT0k}j17mw80}DtA5K93u0|WB{Mh0de%?J`(zyz07Sip>6gA}f5OZp5{_RZ79F(iWX zZK$pHVFw8_`IaAz9Jwk{1;T|FU1eMr)-Rgv6v#3?!fWO1{Rb}au&S4SmhX5Ju{7es z$v^=?7S`7xEF#r7b)vI=O z-PrN|xBIr-c$cT02P~Lx=7jmHO*ZwMls1!r=SRl1#H9EZg{KoV6C{pBDV$4sVLZ7^ zZE|47x(>s125!H=qzVZ`-{J|6l#b0|Jpb8G!_X)6^wUk=g@VcF8Xj9bSGafN_bC>I zy3VxLuk~LOXK#$qnPsngYHrheu4hF%Ib|MZ9&6rP+_D}TN)KIOdSuFYdJ8c(ebakCjsXX3vQb1n8 zaN2H`!m{!u&3gi@+0Stq%N??cJ?EhQY3n(&Bkj9=E+*9Q7y9)x@0w5})l{KB{ffw{ z4Gx|y5(!Igs9S%nvTZF}aWzYqxoUBeftA1Ex4o`5$8Ri&R$Sz~ri?9>KUv2{>QrWV zYY4;YXLzV&o5Ue-`Mb%0s5ZKZmbYj3N>fm1eKeV>XY&L$=+vMuVUKAOZ_$og*& z(;eRzyWV*#O)NOHTjKZ|D+zO{-fG{=c1H@I#-|IS@v{9XvF<7KXFfE`>!3&tQ|zv)MmD{jbi_VjH#EG?H>b*mOBia)p;D z!ffFU2%7<6<%!WT&7q) zPr@)9BDZv1Cz#`$3&t4jRUiZyhOw{fdLgk8;&YNDr#RK7q$niD*i9jX;GC~I3(Q+d z6+F)~ajJFe#^dol*L9<&7F3#prfKdq6$gM+*Y#RobsXoNdJhh8wHC-2+piketi|b9Wvn5AnebCrfJAWeC28^o6FV+A->mDe3&uW6o6LcKsiDg;8I+P64>GVb%$7iZtNGVT!-+!Fh3}UF(qJqdH2!cc3 z_uqD@;@!MBHKuwQA!GzWI8ltI;s9_|bvji(_@HP$O;gDjyPcmWgp8117){01aa9WB zoPR8_k`<-&PQ^aaMqC+Jt-vUXz8)VRzfi@&KI+KQG+o11nu-GlxH?twY&JVuEEccO zprQwC+7N_cc#ZdJ~BJX}gCpHt53D=~E%O%PfWva-}FHggEQ-SKUgrpsXu_ z#h}vjT@co`DYX9v(=_*N+dioH>*JuRTi#-eEiM9n0@;v^?R!&cH~;_u07*qoM6N<$ Ef+7`aH2?qr literal 841 zcmV-P1GfB$P)b~lau#tD>V+A-oJlvYiW&ygnxVT8TRkFXo9~fh{P;z#5 zcEhbkG!DQ311yvmz7wL0Yg-@NLj^HyySNjBoG?Iu4Uxs_>S_y<=jZ1Uwn&>030{jq zP7V$Zwwd-HlokZ&U>e{SvtTKD=jZ2r%32I^a&&a$GsuY2!V%zv0FgK_s1YnfC?fhs zpHRks4NyRkfPpi9Z?s)g zS^**g98)%iz0kp=Dgf-F1Pze|0kUuc24#>mz+U}v4HIU-7kGSp9LwD4Pzcw;{3YSa zkCZ_rgy>^?$i)P8=_D55xlrsQx^#cczrA7wP{VzCFrvRJ<5zS0G$Nb5LsvdW+bItY)hGm7OtCcgn6hbZNew` zO90+}*)eRR01c3ZhQow_w^(DCg>oYrltF;157C6A9&MH3G=Oe8X5fL##t`83he%a$W! zN*{N;P(oc|kdwLq`4Vh!spyhf1GxC(0GRORw^%`ndIX830R}mFV}K0WS}f0492n$; z09^uHQd%%b2dfOgUMP2Z9R@kkjfoAB1s@{)J>U^w#N{GwmLb7wX%s+V7Gh>$hcbgV zJmC!^0Rr~1J(NM)6>Xt3pm6|&5ZhQlkn6>_BZMB`ZOVkfukl8_DZszr-2?mvc(=AN Tnz?6#00000NkvXXu0mjfH1TPF diff --git a/apps/sim/public/static/x-icon.png b/apps/sim/public/static/x-icon.png index 58d635b3fb852dfcd1d423ae6f923bc830b9004e..968d1bbb7feffc1fac8a0a2dd49c30a38d3838fd 100644 GIT binary patch literal 2054 zcmV+h2>JJkP)Ke!-RoA zpx5W~O=fBcMNtMtQH(8HwrngeF0LmC;wh8KeZ`7 zFM@lvcDcboATZb7-mYS?SPYUR;|vCaT3lS5n4X@thC-p_aZ=0>UO)mBO@a}<#0G$6h)~} zD0J)k_3N)*zI?gf?RLKj;V&vGI;zv@PIEXMWH}Ggo-HgaTxT+wTEt>;13?fG7K_Dl zI2_*^7#O%m&&vuBl)}esHh=i!$&*h|6lE0@6dWoqFRzKm<5XW?-?h=v(Q~O(icwZp zcB-bPW-l07YKVs8^ZBSwr~8#eB58`nVo!NIo@i)j==*lN{WE$~FHMgZ{Q-;O@p!te zt?gti7Q4^m@z$%=>c4K@yjd2FMpJgX{q+3&yfc+bk#%)-W`#l_TWSctV;F|)*|X2zG9(Ok>V&*#$X*ladpFc{w0v17-DXfzrY2n6dVCMN!7u~^=T z#bQ(@a4Q1R;_-MM-oJnUEeLgfetxrFum6QmC}euQ-m$^K!S5jm!j?!RYJ0UcVc zR(pKs&Yc%yu^7OKLZQ%St*x!cW@l#;E1mlPaMFqsmgJJjWcqnoS=oCiilW`!-TJ=1 zzD^9oVEp|}n>PIfMNziX>HKym6dE>}OkNzv!#p03AB{#mH*Va}1cSi{U2-y&6#+qL zrBbO>aOlvXJ0g*&njnaO-nw66I$UF8V?i9pzW~D+hKUXyJotBLFviEn=Nt~lev%{!i9}M})YNnq3O60@uN9Cs z01d+7!-vmGrP5}CAP5*2i^Y45M&p}MUi$m{Z7!GVhcH(zm!H&XwcmyDuN9DP2*6`H zo$h2=S=qaZM1p_=kxHcq@a)#DThFUhs#?fLr_=fIP zKz=!$&Y|Jq;WvO#BoftYwc58i91iMoxq2Txdh|Z%Dl9Dgjz*(70fz>DuLQXwAlv!u~^=UL?Zv7C@Nl6RrQC;%F5E2nVCd)clSGx60o7h#>PuBnJo7!HLM`e_Z>KJ z;PS?e8;{~R9sxMF+x>P&N5^@%QJ%kN0XP&2;ay!_--Kr+c)YHz?jl5BY;0`CX0siM zMx*|moSYqcz5dT|k7xZRp$$RNH5!elWilBgd6>`V=XgAxpP9|(bKogt8O3z+L+E>Y zdR_%@<>lpRG#bqr@MJQX#1|G89*`tSN~O}nMx*iFmpSOA8LHK4o8g`XIOvLl!Qi!) zmX>4Ta5$Ms`^4pPk>=*+Un>-fQ}KA5AW3qLq9`a$`A`Mmrh!*uM@L8Xz`(%gSphaQ zG-w+d8akoiVi*RGdDrdRxA#JrGJ!+B%uR_z!r8xn|3^hdMX!S{dhK($M_jpbMGEin zi~vO<5vEisbqIn$y`m5VN&Ef&&&S8dpRT5LlF4ME^73*x&2tEXFrQC46h*Pw+1ZEC kb!Vk`P1a;h82|h7Z`N8CwCC%{e*gdg07*qoM6N<$g0VsS-v9sr literal 407 zcmV;I0cie-P)kdg0004ANklumn3eJ2++}oNv;>+JV=BC0K$bSOO*7&bUZ`e}Hv1JgNL9d?Cr# z$40%<@fz!#;@Ty}`6yfZhjr*GCI4OAuExHS0)L?%3GdUjLkj;G+w0}f$#&@MFGNQ?#I0l4v+vO@eb017M_Aaye2WC_L2vlJNkToGcx4h}4J67v$F-VWSHUe! z8~r%B<^s!*DEA!Ma$$45CT}1okBtjENg~%Y;uc3elYq>F9GY&D1Z~-#!-c&lO*1!F z$h_)6n;Sn9jEho%@p2@_`Wlwhms$;uVd_7g?oUZ98dC>=U26aU002ovPDHLkV1naU Bw6y>L From 53f8ce5ebc518e229462a2a4b25b317586e12c9c Mon Sep 17 00:00:00 2001 From: Waleed Date: Tue, 21 Jul 2026 11:01:30 -0700 Subject: [PATCH 04/37] fix(emails): keep custom whitelabel logos at height 34, not the padded wordmark's 41 (#5803) --- apps/sim/components/emails/components/email-layout.tsx | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/apps/sim/components/emails/components/email-layout.tsx b/apps/sim/components/emails/components/email-layout.tsx index 021afd838d8..264fd177cdb 100644 --- a/apps/sim/components/emails/components/email-layout.tsx +++ b/apps/sim/components/emails/components/email-layout.tsx @@ -54,9 +54,8 @@ export function EmailLayout({
{brand.name}
From e01cd2c18dd73bb46975ddd98d15cdd7998be4cd Mon Sep 17 00:00:00 2001 From: Waleed Date: Tue, 21 Jul 2026 11:16:36 -0700 Subject: [PATCH 05/37] fix(csp): allow X (Twitter) conversion pixel domains on hosted (#5804) --- apps/sim/lib/core/security/csp.ts | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/apps/sim/lib/core/security/csp.ts b/apps/sim/lib/core/security/csp.ts index 25e848a0d5f..2e55e81da08 100644 --- a/apps/sim/lib/core/security/csp.ts +++ b/apps/sim/lib/core/security/csp.ts @@ -66,6 +66,9 @@ const STATIC_SCRIPT_SRC = [ 'https://*.hs-analytics.net', 'https://*.hscollectedforms.net', 'https://*.hs-banner.com', + // X (Twitter) conversion pixel (landing pages) — the base code injects + // uwt.js as a